* [gentoo-commits] proj/linux-patches:3.18 commit in: /
@ 2014-11-26 0:36 Mike Pagano
0 siblings, 0 replies; 67+ messages in thread
From: Mike Pagano @ 2014-11-26 0:36 UTC (permalink / raw
To: gentoo-commits
commit: 05f871e03f13d99674e5ccce73f8a6dcee968ac8
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed Nov 26 00:35:58 2014 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed Nov 26 00:35:58 2014 +0000
URL: http://sources.gentoo.org/gitweb/?p=proj/linux-patches.git;a=commit;h=05f871e0
Support for namespace user.pax.* on tmpfs. ACPI: Disable Windows 8 compatibility for some Lenovo ThinkPads.Ensure that /dev/root doesn't appear in /proc/mounts when bootint without an initramfs. Do not lock when UMH is waiting on current thread spawned by linuxrc. (bug #481344). Bootsplash ported by Uladzimir Bely (bug #513334).Add Gentoo Linux support config settings and defaults.Kernel patch enables gcc optimizations for additional CPUs.
---
0000_README | 20 +
2700_ThinkPad-30-brightness-control-fix.patch | 67 +
2900_dev-root-proc-mount-fix.patch | 30 +
2905_2disk-resume-image-fix.patch | 24 +
4200_fbcondecor-3.16.patch | 2119 ++++++++++++++++++++
...able-additional-cpu-optimizations-for-gcc.patch | 327 +++
6 files changed, 2587 insertions(+)
diff --git a/0000_README b/0000_README
index 36c2b96..7a25c41 100644
--- a/0000_README
+++ b/0000_README
@@ -47,6 +47,26 @@ Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
+Patch: 2700_ThinkPad-30-brightness-control-fix.patch
+From: Seth Forshee <seth.forshee@canonical.com>
+Desc: ACPI: Disable Windows 8 compatibility for some Lenovo ThinkPads.
+
+Patch: 2900_dev-root-proc-mount-fix.patch
+From: https://bugs.gentoo.org/show_bug.cgi?id=438380
+Desc: Ensure that /dev/root doesn't appear in /proc/mounts when bootint without an initramfs.
+
+Patch: 2905_s2disk-resume-image-fix.patch
+From: Al Viro <viro <at> ZenIV.linux.org.uk>
+Desc: Do not lock when UMH is waiting on current thread spawned by linuxrc. (bug #481344)
+
+Patch: 4200_fbcondecor-3.16.patch
+From: http://www.mepiscommunity.org/fbcondecor
+Desc: Bootsplash ported by Uladzimir Bely (bug #513334)
+
Patch: 4567_distro-Gentoo-Kconfig.patch
From: Tom Wijsman <TomWij@gentoo.org>
Desc: Add Gentoo Linux support config settings and defaults.
+
+Patch: 5000_enable-additional-cpu-optimizations-for-gcc.patch
+From: https://github.com/graysky2/kernel_gcc_patch/
+Desc: Kernel patch enables gcc optimizations for additional CPUs.
diff --git a/2700_ThinkPad-30-brightness-control-fix.patch b/2700_ThinkPad-30-brightness-control-fix.patch
new file mode 100644
index 0000000..b548c6d
--- /dev/null
+++ b/2700_ThinkPad-30-brightness-control-fix.patch
@@ -0,0 +1,67 @@
+diff --git a/drivers/acpi/blacklist.c b/drivers/acpi/blacklist.c
+index cb96296..6c242ed 100644
+--- a/drivers/acpi/blacklist.c
++++ b/drivers/acpi/blacklist.c
+@@ -269,6 +276,61 @@ static struct dmi_system_id acpi_osi_dmi_table[] __initdata = {
+ },
+
+ /*
++ * The following Lenovo models have a broken workaround in the
++ * acpi_video backlight implementation to meet the Windows 8
++ * requirement of 101 backlight levels. Reverting to pre-Win8
++ * behavior fixes the problem.
++ */
++ {
++ .callback = dmi_disable_osi_win8,
++ .ident = "Lenovo ThinkPad L430",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad L430"),
++ },
++ },
++ {
++ .callback = dmi_disable_osi_win8,
++ .ident = "Lenovo ThinkPad T430s",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T430s"),
++ },
++ },
++ {
++ .callback = dmi_disable_osi_win8,
++ .ident = "Lenovo ThinkPad T530",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T530"),
++ },
++ },
++ {
++ .callback = dmi_disable_osi_win8,
++ .ident = "Lenovo ThinkPad W530",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad W530"),
++ },
++ },
++ {
++ .callback = dmi_disable_osi_win8,
++ .ident = "Lenovo ThinkPad X1 Carbon",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad X1 Carbon"),
++ },
++ },
++ {
++ .callback = dmi_disable_osi_win8,
++ .ident = "Lenovo ThinkPad X230",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad X230"),
++ },
++ },
++
++ /*
+ * BIOS invocation of _OSI(Linux) is almost always a BIOS bug.
+ * Linux ignores it, except for the machines enumerated below.
+ */
+
diff --git a/2900_dev-root-proc-mount-fix.patch b/2900_dev-root-proc-mount-fix.patch
new file mode 100644
index 0000000..6ea86e2
--- /dev/null
+++ b/2900_dev-root-proc-mount-fix.patch
@@ -0,0 +1,30 @@
+--- a/init/do_mounts.c 2014-08-26 08:03:30.000013100 -0400
++++ b/init/do_mounts.c 2014-08-26 08:11:19.720014712 -0400
+@@ -484,7 +484,10 @@ void __init change_floppy(char *fmt, ...
+ va_start(args, fmt);
+ vsprintf(buf, fmt, args);
+ va_end(args);
+- fd = sys_open("/dev/root", O_RDWR | O_NDELAY, 0);
++ if (saved_root_name[0])
++ fd = sys_open(saved_root_name, O_RDWR | O_NDELAY, 0);
++ else
++ fd = sys_open("/dev/root", O_RDWR | O_NDELAY, 0);
+ if (fd >= 0) {
+ sys_ioctl(fd, FDEJECT, 0);
+ sys_close(fd);
+@@ -527,8 +530,13 @@ void __init mount_root(void)
+ }
+ #endif
+ #ifdef CONFIG_BLOCK
+- create_dev("/dev/root", ROOT_DEV);
+- mount_block_root("/dev/root", root_mountflags);
++ if (saved_root_name[0]) {
++ create_dev(saved_root_name, ROOT_DEV);
++ mount_block_root(saved_root_name, root_mountflags);
++ } else {
++ create_dev("/dev/root", ROOT_DEV);
++ mount_block_root("/dev/root", root_mountflags);
++ }
+ #endif
+ }
+
diff --git a/2905_2disk-resume-image-fix.patch b/2905_2disk-resume-image-fix.patch
new file mode 100644
index 0000000..7e95d29
--- /dev/null
+++ b/2905_2disk-resume-image-fix.patch
@@ -0,0 +1,24 @@
+diff --git a/kernel/kmod.c b/kernel/kmod.c
+index fb32636..d968882 100644
+--- a/kernel/kmod.c
++++ b/kernel/kmod.c
+@@ -575,7 +575,8 @@
+ call_usermodehelper_freeinfo(sub_info);
+ return -EINVAL;
+ }
+- helper_lock();
++ if (!(current->flags & PF_FREEZER_SKIP))
++ helper_lock();
+ if (!khelper_wq || usermodehelper_disabled) {
+ retval = -EBUSY;
+ goto out;
+@@ -611,7 +612,8 @@ wait_done:
+ out:
+ call_usermodehelper_freeinfo(sub_info);
+ unlock:
+- helper_unlock();
++ if (!(current->flags & PF_FREEZER_SKIP))
++ helper_unlock();
+ return retval;
+ }
+ EXPORT_SYMBOL(call_usermodehelper_exec);
diff --git a/4200_fbcondecor-3.16.patch b/4200_fbcondecor-3.16.patch
new file mode 100644
index 0000000..c96e5dc
--- /dev/null
+++ b/4200_fbcondecor-3.16.patch
@@ -0,0 +1,2119 @@
+diff --git a/Documentation/fb/00-INDEX b/Documentation/fb/00-INDEX
+index fe85e7c..2230930 100644
+--- a/Documentation/fb/00-INDEX
++++ b/Documentation/fb/00-INDEX
+@@ -23,6 +23,8 @@ ep93xx-fb.txt
+ - info on the driver for EP93xx LCD controller.
+ fbcon.txt
+ - intro to and usage guide for the framebuffer console (fbcon).
++fbcondecor.txt
++ - info on the Framebuffer Console Decoration
+ framebuffer.txt
+ - introduction to frame buffer devices.
+ gxfb.txt
+diff --git a/Documentation/fb/fbcondecor.txt b/Documentation/fb/fbcondecor.txt
+new file mode 100644
+index 0000000..3388c61
+--- /dev/null
++++ b/Documentation/fb/fbcondecor.txt
+@@ -0,0 +1,207 @@
++What is it?
++-----------
++
++The framebuffer decorations are a kernel feature which allows displaying a
++background picture on selected consoles.
++
++What do I need to get it to work?
++---------------------------------
++
++To get fbcondecor up-and-running you will have to:
++ 1) get a copy of splashutils [1] or a similar program
++ 2) get some fbcondecor themes
++ 3) build the kernel helper program
++ 4) build your kernel with the FB_CON_DECOR option enabled.
++
++To get fbcondecor operational right after fbcon initialization is finished, you
++will have to include a theme and the kernel helper into your initramfs image.
++Please refer to splashutils documentation for instructions on how to do that.
++
++[1] The splashutils package can be downloaded from:
++ http://github.com/alanhaggai/fbsplash
++
++The userspace helper
++--------------------
++
++The userspace fbcondecor helper (by default: /sbin/fbcondecor_helper) is called by the
++kernel whenever an important event occurs and the kernel needs some kind of
++job to be carried out. Important events include console switches and video
++mode switches (the kernel requests background images and configuration
++parameters for the current console). The fbcondecor helper must be accessible at
++all times. If it's not, fbcondecor will be switched off automatically.
++
++It's possible to set path to the fbcondecor helper by writing it to
++/proc/sys/kernel/fbcondecor.
++
++*****************************************************************************
++
++The information below is mostly technical stuff. There's probably no need to
++read it unless you plan to develop a userspace helper.
++
++The fbcondecor protocol
++-----------------------
++
++The fbcondecor protocol defines a communication interface between the kernel and
++the userspace fbcondecor helper.
++
++The kernel side is responsible for:
++
++ * rendering console text, using an image as a background (instead of a
++ standard solid color fbcon uses),
++ * accepting commands from the user via ioctls on the fbcondecor device,
++ * calling the userspace helper to set things up as soon as the fb subsystem
++ is initialized.
++
++The userspace helper is responsible for everything else, including parsing
++configuration files, decompressing the image files whenever the kernel needs
++it, and communicating with the kernel if necessary.
++
++The fbcondecor protocol specifies how communication is done in both ways:
++kernel->userspace and userspace->helper.
++
++Kernel -> Userspace
++-------------------
++
++The kernel communicates with the userspace helper by calling it and specifying
++the task to be done in a series of arguments.
++
++The arguments follow the pattern:
++<fbcondecor protocol version> <command> <parameters>
++
++All commands defined in fbcondecor protocol v2 have the following parameters:
++ virtual console
++ framebuffer number
++ theme
++
++Fbcondecor protocol v1 specified an additional 'fbcondecor mode' after the
++framebuffer number. Fbcondecor protocol v1 is deprecated and should not be used.
++
++Fbcondecor protocol v2 specifies the following commands:
++
++getpic
++------
++ The kernel issues this command to request image data. It's up to the
++ userspace helper to find a background image appropriate for the specified
++ theme and the current resolution. The userspace helper should respond by
++ issuing the FBIOCONDECOR_SETPIC ioctl.
++
++init
++----
++ The kernel issues this command after the fbcondecor device is created and
++ the fbcondecor interface is initialized. Upon receiving 'init', the userspace
++ helper should parse the kernel command line (/proc/cmdline) or otherwise
++ decide whether fbcondecor is to be activated.
++
++ To activate fbcondecor on the first console the helper should issue the
++ FBIOCONDECOR_SETCFG, FBIOCONDECOR_SETPIC and FBIOCONDECOR_SETSTATE commands,
++ in the above-mentioned order.
++
++ When the userspace helper is called in an early phase of the boot process
++ (right after the initialization of fbcon), no filesystems will be mounted.
++ The helper program should mount sysfs and then create the appropriate
++ framebuffer, fbcondecor and tty0 devices (if they don't already exist) to get
++ current display settings and to be able to communicate with the kernel side.
++ It should probably also mount the procfs to be able to parse the kernel
++ command line parameters.
++
++ Note that the console sem is not held when the kernel calls fbcondecor_helper
++ with the 'init' command. The fbcondecor helper should perform all ioctls with
++ origin set to FBCON_DECOR_IO_ORIG_USER.
++
++modechange
++----------
++ The kernel issues this command on a mode change. The helper's response should
++ be similar to the response to the 'init' command. Note that this time the
++ console sem is held and all ioctls must be performed with origin set to
++ FBCON_DECOR_IO_ORIG_KERNEL.
++
++
++Userspace -> Kernel
++-------------------
++
++Userspace programs can communicate with fbcondecor via ioctls on the
++fbcondecor device. These ioctls are to be used by both the userspace helper
++(called only by the kernel) and userspace configuration tools (run by the users).
++
++The fbcondecor helper should set the origin field to FBCON_DECOR_IO_ORIG_KERNEL
++when doing the appropriate ioctls. All userspace configuration tools should
++use FBCON_DECOR_IO_ORIG_USER. Failure to set the appropriate value in the origin
++field when performing ioctls from the kernel helper will most likely result
++in a console deadlock.
++
++FBCON_DECOR_IO_ORIG_KERNEL instructs fbcondecor not to try to acquire the console
++semaphore. Not surprisingly, FBCON_DECOR_IO_ORIG_USER instructs it to acquire
++the console sem.
++
++The framebuffer console decoration provides the following ioctls (all defined in
++linux/fb.h):
++
++FBIOCONDECOR_SETPIC
++description: loads a background picture for a virtual console
++argument: struct fbcon_decor_iowrapper*; data: struct fb_image*
++notes:
++If called for consoles other than the current foreground one, the picture data
++will be ignored.
++
++If the current virtual console is running in a 8-bpp mode, the cmap substruct
++of fb_image has to be filled appropriately: start should be set to 16 (first
++16 colors are reserved for fbcon), len to a value <= 240 and red, green and
++blue should point to valid cmap data. The transp field is ingored. The fields
++dx, dy, bg_color, fg_color in fb_image are ignored as well.
++
++FBIOCONDECOR_SETCFG
++description: sets the fbcondecor config for a virtual console
++argument: struct fbcon_decor_iowrapper*; data: struct vc_decor*
++notes: The structure has to be filled with valid data.
++
++FBIOCONDECOR_GETCFG
++description: gets the fbcondecor config for a virtual console
++argument: struct fbcon_decor_iowrapper*; data: struct vc_decor*
++
++FBIOCONDECOR_SETSTATE
++description: sets the fbcondecor state for a virtual console
++argument: struct fbcon_decor_iowrapper*; data: unsigned int*
++ values: 0 = disabled, 1 = enabled.
++
++FBIOCONDECOR_GETSTATE
++description: gets the fbcondecor state for a virtual console
++argument: struct fbcon_decor_iowrapper*; data: unsigned int*
++ values: as in FBIOCONDECOR_SETSTATE
++
++Info on used structures:
++
++Definition of struct vc_decor can be found in linux/console_decor.h. It's
++heavily commented. Note that the 'theme' field should point to a string
++no longer than FBCON_DECOR_THEME_LEN. When FBIOCONDECOR_GETCFG call is
++performed, the theme field should point to a char buffer of length
++FBCON_DECOR_THEME_LEN.
++
++Definition of struct fbcon_decor_iowrapper can be found in linux/fb.h.
++The fields in this struct have the following meaning:
++
++vc:
++Virtual console number.
++
++origin:
++Specifies if the ioctl is performed as a response to a kernel request. The
++fbcondecor helper should set this field to FBCON_DECOR_IO_ORIG_KERNEL, userspace
++programs should set it to FBCON_DECOR_IO_ORIG_USER. This field is necessary to
++avoid console semaphore deadlocks.
++
++data:
++Pointer to a data structure appropriate for the performed ioctl. Type of
++the data struct is specified in the ioctls description.
++
++*****************************************************************************
++
++Credit
++------
++
++Original 'bootsplash' project & implementation by:
++ Volker Poplawski <volker@poplawski.de>, Stefan Reinauer <stepan@suse.de>,
++ Steffen Winterfeldt <snwint@suse.de>, Michael Schroeder <mls@suse.de>,
++ Ken Wimer <wimer@suse.de>.
++
++Fbcondecor, fbcondecor protocol design, current implementation & docs by:
++ Michal Januszewski <michalj+fbcondecor@gmail.com>
++
+diff --git a/drivers/Makefile b/drivers/Makefile
+index 7183b6a..d576148 100644
+--- a/drivers/Makefile
++++ b/drivers/Makefile
+@@ -17,6 +17,10 @@ obj-y += pwm/
+ obj-$(CONFIG_PCI) += pci/
+ obj-$(CONFIG_PARISC) += parisc/
+ obj-$(CONFIG_RAPIDIO) += rapidio/
++# tty/ comes before char/ so that the VT console is the boot-time
++# default.
++obj-y += tty/
++obj-y += char/
+ obj-y += video/
+ obj-y += idle/
+
+@@ -42,11 +46,6 @@ obj-$(CONFIG_REGULATOR) += regulator/
+ # reset controllers early, since gpu drivers might rely on them to initialize
+ obj-$(CONFIG_RESET_CONTROLLER) += reset/
+
+-# tty/ comes before char/ so that the VT console is the boot-time
+-# default.
+-obj-y += tty/
+-obj-y += char/
+-
+ # gpu/ comes after char for AGP vs DRM startup
+ obj-y += gpu/
+
+diff --git a/drivers/video/console/Kconfig b/drivers/video/console/Kconfig
+index fe1cd01..6d2e87a 100644
+--- a/drivers/video/console/Kconfig
++++ b/drivers/video/console/Kconfig
+@@ -126,6 +126,19 @@ config FRAMEBUFFER_CONSOLE_ROTATION
+ such that other users of the framebuffer will remain normally
+ oriented.
+
++config FB_CON_DECOR
++ bool "Support for the Framebuffer Console Decorations"
++ depends on FRAMEBUFFER_CONSOLE=y && !FB_TILEBLITTING
++ default n
++ ---help---
++ This option enables support for framebuffer console decorations which
++ makes it possible to display images in the background of the system
++ consoles. Note that userspace utilities are necessary in order to take
++ advantage of these features. Refer to Documentation/fb/fbcondecor.txt
++ for more information.
++
++ If unsure, say N.
++
+ config STI_CONSOLE
+ bool "STI text console"
+ depends on PARISC
+diff --git a/drivers/video/console/Makefile b/drivers/video/console/Makefile
+index 43bfa48..cc104b6 100644
+--- a/drivers/video/console/Makefile
++++ b/drivers/video/console/Makefile
+@@ -16,4 +16,5 @@ obj-$(CONFIG_FRAMEBUFFER_CONSOLE) += fbcon_rotate.o fbcon_cw.o fbcon_ud.o \
+ fbcon_ccw.o
+ endif
+
++obj-$(CONFIG_FB_CON_DECOR) += fbcondecor.o cfbcondecor.o
+ obj-$(CONFIG_FB_STI) += sticore.o
+diff --git a/drivers/video/console/bitblit.c b/drivers/video/console/bitblit.c
+index 61b182b..984384b 100644
+--- a/drivers/video/console/bitblit.c
++++ b/drivers/video/console/bitblit.c
+@@ -18,6 +18,7 @@
+ #include <linux/console.h>
+ #include <asm/types.h>
+ #include "fbcon.h"
++#include "fbcondecor.h"
+
+ /*
+ * Accelerated handlers.
+@@ -55,6 +56,13 @@ static void bit_bmove(struct vc_data *vc, struct fb_info *info, int sy,
+ area.height = height * vc->vc_font.height;
+ area.width = width * vc->vc_font.width;
+
++ if (fbcon_decor_active(info, vc)) {
++ area.sx += vc->vc_decor.tx;
++ area.sy += vc->vc_decor.ty;
++ area.dx += vc->vc_decor.tx;
++ area.dy += vc->vc_decor.ty;
++ }
++
+ info->fbops->fb_copyarea(info, &area);
+ }
+
+@@ -380,11 +388,15 @@ static void bit_cursor(struct vc_data *vc, struct fb_info *info, int mode,
+ cursor.image.depth = 1;
+ cursor.rop = ROP_XOR;
+
+- if (info->fbops->fb_cursor)
+- err = info->fbops->fb_cursor(info, &cursor);
++ if (fbcon_decor_active(info, vc)) {
++ fbcon_decor_cursor(info, &cursor);
++ } else {
++ if (info->fbops->fb_cursor)
++ err = info->fbops->fb_cursor(info, &cursor);
+
+- if (err)
+- soft_cursor(info, &cursor);
++ if (err)
++ soft_cursor(info, &cursor);
++ }
+
+ ops->cursor_reset = 0;
+ }
+diff --git a/drivers/video/console/cfbcondecor.c b/drivers/video/console/cfbcondecor.c
+new file mode 100644
+index 0000000..a2b4497
+--- /dev/null
++++ b/drivers/video/console/cfbcondecor.c
+@@ -0,0 +1,471 @@
++/*
++ * linux/drivers/video/cfbcon_decor.c -- Framebuffer decor render functions
++ *
++ * Copyright (C) 2004 Michal Januszewski <michalj+fbcondecor@gmail.com>
++ *
++ * Code based upon "Bootdecor" (C) 2001-2003
++ * Volker Poplawski <volker@poplawski.de>,
++ * Stefan Reinauer <stepan@suse.de>,
++ * Steffen Winterfeldt <snwint@suse.de>,
++ * Michael Schroeder <mls@suse.de>,
++ * Ken Wimer <wimer@suse.de>.
++ *
++ * This file is subject to the terms and conditions of the GNU General Public
++ * License. See the file COPYING in the main directory of this archive for
++ * more details.
++ */
++#include <linux/module.h>
++#include <linux/types.h>
++#include <linux/fb.h>
++#include <linux/selection.h>
++#include <linux/slab.h>
++#include <linux/vt_kern.h>
++#include <asm/irq.h>
++
++#include "fbcon.h"
++#include "fbcondecor.h"
++
++#define parse_pixel(shift,bpp,type) \
++ do { \
++ if (d & (0x80 >> (shift))) \
++ dd2[(shift)] = fgx; \
++ else \
++ dd2[(shift)] = transparent ? *(type *)decor_src : bgx; \
++ decor_src += (bpp); \
++ } while (0) \
++
++extern int get_color(struct vc_data *vc, struct fb_info *info,
++ u16 c, int is_fg);
++
++void fbcon_decor_fix_pseudo_pal(struct fb_info *info, struct vc_data *vc)
++{
++ int i, j, k;
++ int minlen = min(min(info->var.red.length, info->var.green.length),
++ info->var.blue.length);
++ u32 col;
++
++ for (j = i = 0; i < 16; i++) {
++ k = color_table[i];
++
++ col = ((vc->vc_palette[j++] >> (8-minlen))
++ << info->var.red.offset);
++ col |= ((vc->vc_palette[j++] >> (8-minlen))
++ << info->var.green.offset);
++ col |= ((vc->vc_palette[j++] >> (8-minlen))
++ << info->var.blue.offset);
++ ((u32 *)info->pseudo_palette)[k] = col;
++ }
++}
++
++void fbcon_decor_renderc(struct fb_info *info, int ypos, int xpos, int height,
++ int width, u8* src, u32 fgx, u32 bgx, u8 transparent)
++{
++ unsigned int x, y;
++ u32 dd;
++ int bytespp = ((info->var.bits_per_pixel + 7) >> 3);
++ unsigned int d = ypos * info->fix.line_length + xpos * bytespp;
++ unsigned int ds = (ypos * info->var.xres + xpos) * bytespp;
++ u16 dd2[4];
++
++ u8* decor_src = (u8 *)(info->bgdecor.data + ds);
++ u8* dst = (u8 *)(info->screen_base + d);
++
++ if ((ypos + height) > info->var.yres || (xpos + width) > info->var.xres)
++ return;
++
++ for (y = 0; y < height; y++) {
++ switch (info->var.bits_per_pixel) {
++
++ case 32:
++ for (x = 0; x < width; x++) {
++
++ if ((x & 7) == 0)
++ d = *src++;
++ if (d & 0x80)
++ dd = fgx;
++ else
++ dd = transparent ?
++ *(u32 *)decor_src : bgx;
++
++ d <<= 1;
++ decor_src += 4;
++ fb_writel(dd, dst);
++ dst += 4;
++ }
++ break;
++ case 24:
++ for (x = 0; x < width; x++) {
++
++ if ((x & 7) == 0)
++ d = *src++;
++ if (d & 0x80)
++ dd = fgx;
++ else
++ dd = transparent ?
++ (*(u32 *)decor_src & 0xffffff) : bgx;
++
++ d <<= 1;
++ decor_src += 3;
++#ifdef __LITTLE_ENDIAN
++ fb_writew(dd & 0xffff, dst);
++ dst += 2;
++ fb_writeb((dd >> 16), dst);
++#else
++ fb_writew(dd >> 8, dst);
++ dst += 2;
++ fb_writeb(dd & 0xff, dst);
++#endif
++ dst++;
++ }
++ break;
++ case 16:
++ for (x = 0; x < width; x += 2) {
++ if ((x & 7) == 0)
++ d = *src++;
++
++ parse_pixel(0, 2, u16);
++ parse_pixel(1, 2, u16);
++#ifdef __LITTLE_ENDIAN
++ dd = dd2[0] | (dd2[1] << 16);
++#else
++ dd = dd2[1] | (dd2[0] << 16);
++#endif
++ d <<= 2;
++ fb_writel(dd, dst);
++ dst += 4;
++ }
++ break;
++
++ case 8:
++ for (x = 0; x < width; x += 4) {
++ if ((x & 7) == 0)
++ d = *src++;
++
++ parse_pixel(0, 1, u8);
++ parse_pixel(1, 1, u8);
++ parse_pixel(2, 1, u8);
++ parse_pixel(3, 1, u8);
++
++#ifdef __LITTLE_ENDIAN
++ dd = dd2[0] | (dd2[1] << 8) | (dd2[2] << 16) | (dd2[3] << 24);
++#else
++ dd = dd2[3] | (dd2[2] << 8) | (dd2[1] << 16) | (dd2[0] << 24);
++#endif
++ d <<= 4;
++ fb_writel(dd, dst);
++ dst += 4;
++ }
++ }
++
++ dst += info->fix.line_length - width * bytespp;
++ decor_src += (info->var.xres - width) * bytespp;
++ }
++}
++
++#define cc2cx(a) \
++ ((info->fix.visual == FB_VISUAL_TRUECOLOR || \
++ info->fix.visual == FB_VISUAL_DIRECTCOLOR) ? \
++ ((u32*)info->pseudo_palette)[a] : a)
++
++void fbcon_decor_putcs(struct vc_data *vc, struct fb_info *info,
++ const unsigned short *s, int count, int yy, int xx)
++{
++ unsigned short charmask = vc->vc_hi_font_mask ? 0x1ff : 0xff;
++ struct fbcon_ops *ops = info->fbcon_par;
++ int fg_color, bg_color, transparent;
++ u8 *src;
++ u32 bgx, fgx;
++ u16 c = scr_readw(s);
++
++ fg_color = get_color(vc, info, c, 1);
++ bg_color = get_color(vc, info, c, 0);
++
++ /* Don't paint the background image if console is blanked */
++ transparent = ops->blank_state ? 0 :
++ (vc->vc_decor.bg_color == bg_color);
++
++ xx = xx * vc->vc_font.width + vc->vc_decor.tx;
++ yy = yy * vc->vc_font.height + vc->vc_decor.ty;
++
++ fgx = cc2cx(fg_color);
++ bgx = cc2cx(bg_color);
++
++ while (count--) {
++ c = scr_readw(s++);
++ src = vc->vc_font.data + (c & charmask) * vc->vc_font.height *
++ ((vc->vc_font.width + 7) >> 3);
++
++ fbcon_decor_renderc(info, yy, xx, vc->vc_font.height,
++ vc->vc_font.width, src, fgx, bgx, transparent);
++ xx += vc->vc_font.width;
++ }
++}
++
++void fbcon_decor_cursor(struct fb_info *info, struct fb_cursor *cursor)
++{
++ int i;
++ unsigned int dsize, s_pitch;
++ struct fbcon_ops *ops = info->fbcon_par;
++ struct vc_data* vc;
++ u8 *src;
++
++ /* we really don't need any cursors while the console is blanked */
++ if (info->state != FBINFO_STATE_RUNNING || ops->blank_state)
++ return;
++
++ vc = vc_cons[ops->currcon].d;
++
++ src = kmalloc(64 + sizeof(struct fb_image), GFP_ATOMIC);
++ if (!src)
++ return;
++
++ s_pitch = (cursor->image.width + 7) >> 3;
++ dsize = s_pitch * cursor->image.height;
++ if (cursor->enable) {
++ switch (cursor->rop) {
++ case ROP_XOR:
++ for (i = 0; i < dsize; i++)
++ src[i] = cursor->image.data[i] ^ cursor->mask[i];
++ break;
++ case ROP_COPY:
++ default:
++ for (i = 0; i < dsize; i++)
++ src[i] = cursor->image.data[i] & cursor->mask[i];
++ break;
++ }
++ } else
++ memcpy(src, cursor->image.data, dsize);
++
++ fbcon_decor_renderc(info,
++ cursor->image.dy + vc->vc_decor.ty,
++ cursor->image.dx + vc->vc_decor.tx,
++ cursor->image.height,
++ cursor->image.width,
++ (u8*)src,
++ cc2cx(cursor->image.fg_color),
++ cc2cx(cursor->image.bg_color),
++ cursor->image.bg_color == vc->vc_decor.bg_color);
++
++ kfree(src);
++}
++
++static void decorset(u8 *dst, int height, int width, int dstbytes,
++ u32 bgx, int bpp)
++{
++ int i;
++
++ if (bpp == 8)
++ bgx |= bgx << 8;
++ if (bpp == 16 || bpp == 8)
++ bgx |= bgx << 16;
++
++ while (height-- > 0) {
++ u8 *p = dst;
++
++ switch (bpp) {
++
++ case 32:
++ for (i=0; i < width; i++) {
++ fb_writel(bgx, p); p += 4;
++ }
++ break;
++ case 24:
++ for (i=0; i < width; i++) {
++#ifdef __LITTLE_ENDIAN
++ fb_writew((bgx & 0xffff),(u16*)p); p += 2;
++ fb_writeb((bgx >> 16),p++);
++#else
++ fb_writew((bgx >> 8),(u16*)p); p += 2;
++ fb_writeb((bgx & 0xff),p++);
++#endif
++ }
++ case 16:
++ for (i=0; i < width/4; i++) {
++ fb_writel(bgx,p); p += 4;
++ fb_writel(bgx,p); p += 4;
++ }
++ if (width & 2) {
++ fb_writel(bgx,p); p += 4;
++ }
++ if (width & 1)
++ fb_writew(bgx,(u16*)p);
++ break;
++ case 8:
++ for (i=0; i < width/4; i++) {
++ fb_writel(bgx,p); p += 4;
++ }
++
++ if (width & 2) {
++ fb_writew(bgx,p); p += 2;
++ }
++ if (width & 1)
++ fb_writeb(bgx,(u8*)p);
++ break;
++
++ }
++ dst += dstbytes;
++ }
++}
++
++void fbcon_decor_copy(u8 *dst, u8 *src, int height, int width, int linebytes,
++ int srclinebytes, int bpp)
++{
++ int i;
++
++ while (height-- > 0) {
++ u32 *p = (u32 *)dst;
++ u32 *q = (u32 *)src;
++
++ switch (bpp) {
++
++ case 32:
++ for (i=0; i < width; i++)
++ fb_writel(*q++, p++);
++ break;
++ case 24:
++ for (i=0; i < (width*3/4); i++)
++ fb_writel(*q++, p++);
++ if ((width*3) % 4) {
++ if (width & 2) {
++ fb_writeb(*(u8*)q, (u8*)p);
++ } else if (width & 1) {
++ fb_writew(*(u16*)q, (u16*)p);
++ fb_writeb(*(u8*)((u16*)q+1),(u8*)((u16*)p+2));
++ }
++ }
++ break;
++ case 16:
++ for (i=0; i < width/4; i++) {
++ fb_writel(*q++, p++);
++ fb_writel(*q++, p++);
++ }
++ if (width & 2)
++ fb_writel(*q++, p++);
++ if (width & 1)
++ fb_writew(*(u16*)q, (u16*)p);
++ break;
++ case 8:
++ for (i=0; i < width/4; i++)
++ fb_writel(*q++, p++);
++
++ if (width & 2) {
++ fb_writew(*(u16*)q, (u16*)p);
++ q = (u32*) ((u16*)q + 1);
++ p = (u32*) ((u16*)p + 1);
++ }
++ if (width & 1)
++ fb_writeb(*(u8*)q, (u8*)p);
++ break;
++ }
++
++ dst += linebytes;
++ src += srclinebytes;
++ }
++}
++
++static void decorfill(struct fb_info *info, int sy, int sx, int height,
++ int width)
++{
++ int bytespp = ((info->var.bits_per_pixel + 7) >> 3);
++ int d = sy * info->fix.line_length + sx * bytespp;
++ int ds = (sy * info->var.xres + sx) * bytespp;
++
++ fbcon_decor_copy((u8 *)(info->screen_base + d), (u8 *)(info->bgdecor.data + ds),
++ height, width, info->fix.line_length, info->var.xres * bytespp,
++ info->var.bits_per_pixel);
++}
++
++void fbcon_decor_clear(struct vc_data *vc, struct fb_info *info, int sy, int sx,
++ int height, int width)
++{
++ int bgshift = (vc->vc_hi_font_mask) ? 13 : 12;
++ struct fbcon_ops *ops = info->fbcon_par;
++ u8 *dst;
++ int transparent, bg_color = attr_bgcol_ec(bgshift, vc, info);
++
++ transparent = (vc->vc_decor.bg_color == bg_color);
++ sy = sy * vc->vc_font.height + vc->vc_decor.ty;
++ sx = sx * vc->vc_font.width + vc->vc_decor.tx;
++ height *= vc->vc_font.height;
++ width *= vc->vc_font.width;
++
++ /* Don't paint the background image if console is blanked */
++ if (transparent && !ops->blank_state) {
++ decorfill(info, sy, sx, height, width);
++ } else {
++ dst = (u8 *)(info->screen_base + sy * info->fix.line_length +
++ sx * ((info->var.bits_per_pixel + 7) >> 3));
++ decorset(dst, height, width, info->fix.line_length, cc2cx(bg_color),
++ info->var.bits_per_pixel);
++ }
++}
++
++void fbcon_decor_clear_margins(struct vc_data *vc, struct fb_info *info,
++ int bottom_only)
++{
++ unsigned int tw = vc->vc_cols*vc->vc_font.width;
++ unsigned int th = vc->vc_rows*vc->vc_font.height;
++
++ if (!bottom_only) {
++ /* top margin */
++ decorfill(info, 0, 0, vc->vc_decor.ty, info->var.xres);
++ /* left margin */
++ decorfill(info, vc->vc_decor.ty, 0, th, vc->vc_decor.tx);
++ /* right margin */
++ decorfill(info, vc->vc_decor.ty, vc->vc_decor.tx + tw, th,
++ info->var.xres - vc->vc_decor.tx - tw);
++ }
++ decorfill(info, vc->vc_decor.ty + th, 0,
++ info->var.yres - vc->vc_decor.ty - th, info->var.xres);
++}
++
++void fbcon_decor_bmove_redraw(struct vc_data *vc, struct fb_info *info, int y,
++ int sx, int dx, int width)
++{
++ u16 *d = (u16 *) (vc->vc_origin + vc->vc_size_row * y + dx * 2);
++ u16 *s = d + (dx - sx);
++ u16 *start = d;
++ u16 *ls = d;
++ u16 *le = d + width;
++ u16 c;
++ int x = dx;
++ u16 attr = 1;
++
++ do {
++ c = scr_readw(d);
++ if (attr != (c & 0xff00)) {
++ attr = c & 0xff00;
++ if (d > start) {
++ fbcon_decor_putcs(vc, info, start, d - start, y, x);
++ x += d - start;
++ start = d;
++ }
++ }
++ if (s >= ls && s < le && c == scr_readw(s)) {
++ if (d > start) {
++ fbcon_decor_putcs(vc, info, start, d - start, y, x);
++ x += d - start + 1;
++ start = d + 1;
++ } else {
++ x++;
++ start++;
++ }
++ }
++ s++;
++ d++;
++ } while (d < le);
++ if (d > start)
++ fbcon_decor_putcs(vc, info, start, d - start, y, x);
++}
++
++void fbcon_decor_blank(struct vc_data *vc, struct fb_info *info, int blank)
++{
++ if (blank) {
++ decorset((u8 *)info->screen_base, info->var.yres, info->var.xres,
++ info->fix.line_length, 0, info->var.bits_per_pixel);
++ } else {
++ update_screen(vc);
++ fbcon_decor_clear_margins(vc, info, 0);
++ }
++}
++
+diff --git a/drivers/video/console/fbcon.c b/drivers/video/console/fbcon.c
+index f447734..1a840c2 100644
+--- a/drivers/video/console/fbcon.c
++++ b/drivers/video/console/fbcon.c
+@@ -79,6 +79,7 @@
+ #include <asm/irq.h>
+
+ #include "fbcon.h"
++#include "fbcondecor.h"
+
+ #ifdef FBCONDEBUG
+ # define DPRINTK(fmt, args...) printk(KERN_DEBUG "%s: " fmt, __func__ , ## args)
+@@ -94,7 +95,7 @@ enum {
+
+ static struct display fb_display[MAX_NR_CONSOLES];
+
+-static signed char con2fb_map[MAX_NR_CONSOLES];
++signed char con2fb_map[MAX_NR_CONSOLES];
+ static signed char con2fb_map_boot[MAX_NR_CONSOLES];
+
+ static int logo_lines;
+@@ -286,7 +287,7 @@ static inline int fbcon_is_inactive(struct vc_data *vc, struct fb_info *info)
+ !vt_force_oops_output(vc);
+ }
+
+-static int get_color(struct vc_data *vc, struct fb_info *info,
++int get_color(struct vc_data *vc, struct fb_info *info,
+ u16 c, int is_fg)
+ {
+ int depth = fb_get_color_depth(&info->var, &info->fix);
+@@ -551,6 +552,9 @@ static int do_fbcon_takeover(int show_logo)
+ info_idx = -1;
+ } else {
+ fbcon_has_console_bind = 1;
++#ifdef CONFIG_FB_CON_DECOR
++ fbcon_decor_init();
++#endif
+ }
+
+ return err;
+@@ -1007,6 +1011,12 @@ static const char *fbcon_startup(void)
+ rows = FBCON_SWAP(ops->rotate, info->var.yres, info->var.xres);
+ cols /= vc->vc_font.width;
+ rows /= vc->vc_font.height;
++
++ if (fbcon_decor_active(info, vc)) {
++ cols = vc->vc_decor.twidth / vc->vc_font.width;
++ rows = vc->vc_decor.theight / vc->vc_font.height;
++ }
++
+ vc_resize(vc, cols, rows);
+
+ DPRINTK("mode: %s\n", info->fix.id);
+@@ -1036,7 +1046,7 @@ static void fbcon_init(struct vc_data *vc, int init)
+ cap = info->flags;
+
+ if (vc != svc || logo_shown == FBCON_LOGO_DONTSHOW ||
+- (info->fix.type == FB_TYPE_TEXT))
++ (info->fix.type == FB_TYPE_TEXT) || fbcon_decor_active(info, vc))
+ logo = 0;
+
+ if (var_to_display(p, &info->var, info))
+@@ -1260,6 +1270,11 @@ static void fbcon_clear(struct vc_data *vc, int sy, int sx, int height,
+ fbcon_clear_margins(vc, 0);
+ }
+
++ if (fbcon_decor_active(info, vc)) {
++ fbcon_decor_clear(vc, info, sy, sx, height, width);
++ return;
++ }
++
+ /* Split blits that cross physical y_wrap boundary */
+
+ y_break = p->vrows - p->yscroll;
+@@ -1279,10 +1294,15 @@ static void fbcon_putcs(struct vc_data *vc, const unsigned short *s,
+ struct display *p = &fb_display[vc->vc_num];
+ struct fbcon_ops *ops = info->fbcon_par;
+
+- if (!fbcon_is_inactive(vc, info))
+- ops->putcs(vc, info, s, count, real_y(p, ypos), xpos,
+- get_color(vc, info, scr_readw(s), 1),
+- get_color(vc, info, scr_readw(s), 0));
++ if (!fbcon_is_inactive(vc, info)) {
++
++ if (fbcon_decor_active(info, vc))
++ fbcon_decor_putcs(vc, info, s, count, ypos, xpos);
++ else
++ ops->putcs(vc, info, s, count, real_y(p, ypos), xpos,
++ get_color(vc, info, scr_readw(s), 1),
++ get_color(vc, info, scr_readw(s), 0));
++ }
+ }
+
+ static void fbcon_putc(struct vc_data *vc, int c, int ypos, int xpos)
+@@ -1298,8 +1318,13 @@ static void fbcon_clear_margins(struct vc_data *vc, int bottom_only)
+ struct fb_info *info = registered_fb[con2fb_map[vc->vc_num]];
+ struct fbcon_ops *ops = info->fbcon_par;
+
+- if (!fbcon_is_inactive(vc, info))
+- ops->clear_margins(vc, info, bottom_only);
++ if (!fbcon_is_inactive(vc, info)) {
++ if (fbcon_decor_active(info, vc)) {
++ fbcon_decor_clear_margins(vc, info, bottom_only);
++ } else {
++ ops->clear_margins(vc, info, bottom_only);
++ }
++ }
+ }
+
+ static void fbcon_cursor(struct vc_data *vc, int mode)
+@@ -1819,7 +1844,7 @@ static int fbcon_scroll(struct vc_data *vc, int t, int b, int dir,
+ count = vc->vc_rows;
+ if (softback_top)
+ fbcon_softback_note(vc, t, count);
+- if (logo_shown >= 0)
++ if (logo_shown >= 0 || fbcon_decor_active(info, vc))
+ goto redraw_up;
+ switch (p->scrollmode) {
+ case SCROLL_MOVE:
+@@ -1912,6 +1937,8 @@ static int fbcon_scroll(struct vc_data *vc, int t, int b, int dir,
+ count = vc->vc_rows;
+ if (logo_shown >= 0)
+ goto redraw_down;
++ if (fbcon_decor_active(info, vc))
++ goto redraw_down;
+ switch (p->scrollmode) {
+ case SCROLL_MOVE:
+ fbcon_redraw_blit(vc, info, p, b - 1, b - t - count,
+@@ -2060,6 +2087,13 @@ static void fbcon_bmove_rec(struct vc_data *vc, struct display *p, int sy, int s
+ }
+ return;
+ }
++
++ if (fbcon_decor_active(info, vc) && sy == dy && height == 1) {
++ /* must use slower redraw bmove to keep background pic intact */
++ fbcon_decor_bmove_redraw(vc, info, sy, sx, dx, width);
++ return;
++ }
++
+ ops->bmove(vc, info, real_y(p, sy), sx, real_y(p, dy), dx,
+ height, width);
+ }
+@@ -2130,8 +2164,8 @@ static int fbcon_resize(struct vc_data *vc, unsigned int width,
+ var.yres = virt_h * virt_fh;
+ x_diff = info->var.xres - var.xres;
+ y_diff = info->var.yres - var.yres;
+- if (x_diff < 0 || x_diff > virt_fw ||
+- y_diff < 0 || y_diff > virt_fh) {
++ if ((x_diff < 0 || x_diff > virt_fw ||
++ y_diff < 0 || y_diff > virt_fh) && !vc->vc_decor.state) {
+ const struct fb_videomode *mode;
+
+ DPRINTK("attempting resize %ix%i\n", var.xres, var.yres);
+@@ -2167,6 +2201,21 @@ static int fbcon_switch(struct vc_data *vc)
+
+ info = registered_fb[con2fb_map[vc->vc_num]];
+ ops = info->fbcon_par;
++ prev_console = ops->currcon;
++ if (prev_console != -1)
++ old_info = registered_fb[con2fb_map[prev_console]];
++
++#ifdef CONFIG_FB_CON_DECOR
++ if (!fbcon_decor_active_vc(vc) && info->fix.visual == FB_VISUAL_DIRECTCOLOR) {
++ struct vc_data *vc_curr = vc_cons[prev_console].d;
++ if (vc_curr && fbcon_decor_active_vc(vc_curr)) {
++ /* Clear the screen to avoid displaying funky colors during
++ * palette updates. */
++ memset((u8*)info->screen_base + info->fix.line_length * info->var.yoffset,
++ 0, info->var.yres * info->fix.line_length);
++ }
++ }
++#endif
+
+ if (softback_top) {
+ if (softback_lines)
+@@ -2185,9 +2234,6 @@ static int fbcon_switch(struct vc_data *vc)
+ logo_shown = FBCON_LOGO_CANSHOW;
+ }
+
+- prev_console = ops->currcon;
+- if (prev_console != -1)
+- old_info = registered_fb[con2fb_map[prev_console]];
+ /*
+ * FIXME: If we have multiple fbdev's loaded, we need to
+ * update all info->currcon. Perhaps, we can place this
+@@ -2231,6 +2277,18 @@ static int fbcon_switch(struct vc_data *vc)
+ fbcon_del_cursor_timer(old_info);
+ }
+
++ if (fbcon_decor_active_vc(vc)) {
++ struct vc_data *vc_curr = vc_cons[prev_console].d;
++
++ if (!vc_curr->vc_decor.theme ||
++ strcmp(vc->vc_decor.theme, vc_curr->vc_decor.theme) ||
++ (fbcon_decor_active_nores(info, vc_curr) &&
++ !fbcon_decor_active(info, vc_curr))) {
++ fbcon_decor_disable(vc, 0);
++ fbcon_decor_call_helper("modechange", vc->vc_num);
++ }
++ }
++
+ if (fbcon_is_inactive(vc, info) ||
+ ops->blank_state != FB_BLANK_UNBLANK)
+ fbcon_del_cursor_timer(info);
+@@ -2339,15 +2397,20 @@ static int fbcon_blank(struct vc_data *vc, int blank, int mode_switch)
+ }
+ }
+
+- if (!fbcon_is_inactive(vc, info)) {
++ if (!fbcon_is_inactive(vc, info)) {
+ if (ops->blank_state != blank) {
+ ops->blank_state = blank;
+ fbcon_cursor(vc, blank ? CM_ERASE : CM_DRAW);
+ ops->cursor_flash = (!blank);
+
+- if (!(info->flags & FBINFO_MISC_USEREVENT))
+- if (fb_blank(info, blank))
+- fbcon_generic_blank(vc, info, blank);
++ if (!(info->flags & FBINFO_MISC_USEREVENT)) {
++ if (fb_blank(info, blank)) {
++ if (fbcon_decor_active(info, vc))
++ fbcon_decor_blank(vc, info, blank);
++ else
++ fbcon_generic_blank(vc, info, blank);
++ }
++ }
+ }
+
+ if (!blank)
+@@ -2522,13 +2585,22 @@ static int fbcon_do_set_font(struct vc_data *vc, int w, int h,
+ }
+
+ if (resize) {
++ /* reset wrap/pan */
+ int cols, rows;
+
+ cols = FBCON_SWAP(ops->rotate, info->var.xres, info->var.yres);
+ rows = FBCON_SWAP(ops->rotate, info->var.yres, info->var.xres);
++
++ if (fbcon_decor_active(info, vc)) {
++ info->var.xoffset = info->var.yoffset = p->yscroll = 0;
++ cols = vc->vc_decor.twidth;
++ rows = vc->vc_decor.theight;
++ }
+ cols /= w;
+ rows /= h;
++
+ vc_resize(vc, cols, rows);
++
+ if (CON_IS_VISIBLE(vc) && softback_buf)
+ fbcon_update_softback(vc);
+ } else if (CON_IS_VISIBLE(vc)
+@@ -2657,7 +2729,11 @@ static int fbcon_set_palette(struct vc_data *vc, unsigned char *table)
+ int i, j, k, depth;
+ u8 val;
+
+- if (fbcon_is_inactive(vc, info))
++ if (fbcon_is_inactive(vc, info)
++#ifdef CONFIG_FB_CON_DECOR
++ || vc->vc_num != fg_console
++#endif
++ )
+ return -EINVAL;
+
+ if (!CON_IS_VISIBLE(vc))
+@@ -2683,14 +2759,56 @@ static int fbcon_set_palette(struct vc_data *vc, unsigned char *table)
+ } else
+ fb_copy_cmap(fb_default_cmap(1 << depth), &palette_cmap);
+
+- return fb_set_cmap(&palette_cmap, info);
++ if (fbcon_decor_active(info, vc_cons[fg_console].d) &&
++ info->fix.visual == FB_VISUAL_DIRECTCOLOR) {
++
++ u16 *red, *green, *blue;
++ int minlen = min(min(info->var.red.length, info->var.green.length),
++ info->var.blue.length);
++ int h;
++
++ struct fb_cmap cmap = {
++ .start = 0,
++ .len = (1 << minlen),
++ .red = NULL,
++ .green = NULL,
++ .blue = NULL,
++ .transp = NULL
++ };
++
++ red = kmalloc(256 * sizeof(u16) * 3, GFP_KERNEL);
++
++ if (!red)
++ goto out;
++
++ green = red + 256;
++ blue = green + 256;
++ cmap.red = red;
++ cmap.green = green;
++ cmap.blue = blue;
++
++ for (i = 0; i < cmap.len; i++) {
++ red[i] = green[i] = blue[i] = (0xffff * i)/(cmap.len-1);
++ }
++
++ h = fb_set_cmap(&cmap, info);
++ fbcon_decor_fix_pseudo_pal(info, vc_cons[fg_console].d);
++ kfree(red);
++
++ return h;
++
++ } else if (fbcon_decor_active(info, vc_cons[fg_console].d) &&
++ info->var.bits_per_pixel == 8 && info->bgdecor.cmap.red != NULL)
++ fb_set_cmap(&info->bgdecor.cmap, info);
++
++out: return fb_set_cmap(&palette_cmap, info);
+ }
+
+ static u16 *fbcon_screen_pos(struct vc_data *vc, int offset)
+ {
+ unsigned long p;
+ int line;
+-
++
+ if (vc->vc_num != fg_console || !softback_lines)
+ return (u16 *) (vc->vc_origin + offset);
+ line = offset / vc->vc_size_row;
+@@ -2909,7 +3027,14 @@ static void fbcon_modechanged(struct fb_info *info)
+ rows = FBCON_SWAP(ops->rotate, info->var.yres, info->var.xres);
+ cols /= vc->vc_font.width;
+ rows /= vc->vc_font.height;
+- vc_resize(vc, cols, rows);
++
++ if (!fbcon_decor_active_nores(info, vc)) {
++ vc_resize(vc, cols, rows);
++ } else {
++ fbcon_decor_disable(vc, 0);
++ fbcon_decor_call_helper("modechange", vc->vc_num);
++ }
++
+ updatescrollmode(p, info, vc);
+ scrollback_max = 0;
+ scrollback_current = 0;
+@@ -2954,7 +3079,9 @@ static void fbcon_set_all_vcs(struct fb_info *info)
+ rows = FBCON_SWAP(ops->rotate, info->var.yres, info->var.xres);
+ cols /= vc->vc_font.width;
+ rows /= vc->vc_font.height;
+- vc_resize(vc, cols, rows);
++ if (!fbcon_decor_active_nores(info, vc)) {
++ vc_resize(vc, cols, rows);
++ }
+ }
+
+ if (fg != -1)
+@@ -3596,6 +3723,7 @@ static void fbcon_exit(void)
+ }
+ }
+
++ fbcon_decor_exit();
+ fbcon_has_exited = 1;
+ }
+
+diff --git a/drivers/video/console/fbcondecor.c b/drivers/video/console/fbcondecor.c
+new file mode 100644
+index 0000000..babc8c5
+--- /dev/null
++++ b/drivers/video/console/fbcondecor.c
+@@ -0,0 +1,555 @@
++/*
++ * linux/drivers/video/console/fbcondecor.c -- Framebuffer console decorations
++ *
++ * Copyright (C) 2004-2009 Michal Januszewski <michalj+fbcondecor@gmail.com>
++ *
++ * Code based upon "Bootsplash" (C) 2001-2003
++ * Volker Poplawski <volker@poplawski.de>,
++ * Stefan Reinauer <stepan@suse.de>,
++ * Steffen Winterfeldt <snwint@suse.de>,
++ * Michael Schroeder <mls@suse.de>,
++ * Ken Wimer <wimer@suse.de>.
++ *
++ * Compat ioctl support by Thorsten Klein <TK@Thorsten-Klein.de>.
++ *
++ * This file is subject to the terms and conditions of the GNU General Public
++ * License. See the file COPYING in the main directory of this archive for
++ * more details.
++ *
++ */
++#include <linux/module.h>
++#include <linux/kernel.h>
++#include <linux/string.h>
++#include <linux/types.h>
++#include <linux/fb.h>
++#include <linux/vt_kern.h>
++#include <linux/vmalloc.h>
++#include <linux/unistd.h>
++#include <linux/syscalls.h>
++#include <linux/init.h>
++#include <linux/proc_fs.h>
++#include <linux/workqueue.h>
++#include <linux/kmod.h>
++#include <linux/miscdevice.h>
++#include <linux/device.h>
++#include <linux/fs.h>
++#include <linux/compat.h>
++#include <linux/console.h>
++
++#include <asm/uaccess.h>
++#include <asm/irq.h>
++
++#include "fbcon.h"
++#include "fbcondecor.h"
++
++extern signed char con2fb_map[];
++static int fbcon_decor_enable(struct vc_data *vc);
++char fbcon_decor_path[KMOD_PATH_LEN] = "/sbin/fbcondecor_helper";
++static int initialized = 0;
++
++int fbcon_decor_call_helper(char* cmd, unsigned short vc)
++{
++ char *envp[] = {
++ "HOME=/",
++ "PATH=/sbin:/bin",
++ NULL
++ };
++
++ char tfb[5];
++ char tcons[5];
++ unsigned char fb = (int) con2fb_map[vc];
++
++ char *argv[] = {
++ fbcon_decor_path,
++ "2",
++ cmd,
++ tcons,
++ tfb,
++ vc_cons[vc].d->vc_decor.theme,
++ NULL
++ };
++
++ snprintf(tfb,5,"%d",fb);
++ snprintf(tcons,5,"%d",vc);
++
++ return call_usermodehelper(fbcon_decor_path, argv, envp, UMH_WAIT_EXEC);
++}
++
++/* Disables fbcondecor on a virtual console; called with console sem held. */
++int fbcon_decor_disable(struct vc_data *vc, unsigned char redraw)
++{
++ struct fb_info* info;
++
++ if (!vc->vc_decor.state)
++ return -EINVAL;
++
++ info = registered_fb[(int) con2fb_map[vc->vc_num]];
++
++ if (info == NULL)
++ return -EINVAL;
++
++ vc->vc_decor.state = 0;
++ vc_resize(vc, info->var.xres / vc->vc_font.width,
++ info->var.yres / vc->vc_font.height);
++
++ if (fg_console == vc->vc_num && redraw) {
++ redraw_screen(vc, 0);
++ update_region(vc, vc->vc_origin +
++ vc->vc_size_row * vc->vc_top,
++ vc->vc_size_row * (vc->vc_bottom - vc->vc_top) / 2);
++ }
++
++ printk(KERN_INFO "fbcondecor: switched decor state to 'off' on console %d\n",
++ vc->vc_num);
++
++ return 0;
++}
++
++/* Enables fbcondecor on a virtual console; called with console sem held. */
++static int fbcon_decor_enable(struct vc_data *vc)
++{
++ struct fb_info* info;
++
++ info = registered_fb[(int) con2fb_map[vc->vc_num]];
++
++ if (vc->vc_decor.twidth == 0 || vc->vc_decor.theight == 0 ||
++ info == NULL || vc->vc_decor.state || (!info->bgdecor.data &&
++ vc->vc_num == fg_console))
++ return -EINVAL;
++
++ vc->vc_decor.state = 1;
++ vc_resize(vc, vc->vc_decor.twidth / vc->vc_font.width,
++ vc->vc_decor.theight / vc->vc_font.height);
++
++ if (fg_console == vc->vc_num) {
++ redraw_screen(vc, 0);
++ update_region(vc, vc->vc_origin +
++ vc->vc_size_row * vc->vc_top,
++ vc->vc_size_row * (vc->vc_bottom - vc->vc_top) / 2);
++ fbcon_decor_clear_margins(vc, info, 0);
++ }
++
++ printk(KERN_INFO "fbcondecor: switched decor state to 'on' on console %d\n",
++ vc->vc_num);
++
++ return 0;
++}
++
++static inline int fbcon_decor_ioctl_dosetstate(struct vc_data *vc, unsigned int state, unsigned char origin)
++{
++ int ret;
++
++// if (origin == FBCON_DECOR_IO_ORIG_USER)
++ console_lock();
++ if (!state)
++ ret = fbcon_decor_disable(vc, 1);
++ else
++ ret = fbcon_decor_enable(vc);
++// if (origin == FBCON_DECOR_IO_ORIG_USER)
++ console_unlock();
++
++ return ret;
++}
++
++static inline void fbcon_decor_ioctl_dogetstate(struct vc_data *vc, unsigned int *state)
++{
++ *state = vc->vc_decor.state;
++}
++
++static int fbcon_decor_ioctl_dosetcfg(struct vc_data *vc, struct vc_decor *cfg, unsigned char origin)
++{
++ struct fb_info *info;
++ int len;
++ char *tmp;
++
++ info = registered_fb[(int) con2fb_map[vc->vc_num]];
++
++ if (info == NULL || !cfg->twidth || !cfg->theight ||
++ cfg->tx + cfg->twidth > info->var.xres ||
++ cfg->ty + cfg->theight > info->var.yres)
++ return -EINVAL;
++
++ len = strlen_user(cfg->theme);
++ if (!len || len > FBCON_DECOR_THEME_LEN)
++ return -EINVAL;
++ tmp = kmalloc(len, GFP_KERNEL);
++ if (!tmp)
++ return -ENOMEM;
++ if (copy_from_user(tmp, (void __user *)cfg->theme, len))
++ return -EFAULT;
++ cfg->theme = tmp;
++ cfg->state = 0;
++
++ /* If this ioctl is a response to a request from kernel, the console sem
++ * is already held; we also don't need to disable decor because either the
++ * new config and background picture will be successfully loaded, and the
++ * decor will stay on, or in case of a failure it'll be turned off in fbcon. */
++// if (origin == FBCON_DECOR_IO_ORIG_USER) {
++ console_lock();
++ if (vc->vc_decor.state)
++ fbcon_decor_disable(vc, 1);
++// }
++
++ if (vc->vc_decor.theme)
++ kfree(vc->vc_decor.theme);
++
++ vc->vc_decor = *cfg;
++
++// if (origin == FBCON_DECOR_IO_ORIG_USER)
++ console_unlock();
++
++ printk(KERN_INFO "fbcondecor: console %d using theme '%s'\n",
++ vc->vc_num, vc->vc_decor.theme);
++ return 0;
++}
++
++static int fbcon_decor_ioctl_dogetcfg(struct vc_data *vc, struct vc_decor *decor)
++{
++ char __user *tmp;
++
++ tmp = decor->theme;
++ *decor = vc->vc_decor;
++ decor->theme = tmp;
++
++ if (vc->vc_decor.theme) {
++ if (copy_to_user(tmp, vc->vc_decor.theme, strlen(vc->vc_decor.theme) + 1))
++ return -EFAULT;
++ } else
++ if (put_user(0, tmp))
++ return -EFAULT;
++
++ return 0;
++}
++
++static int fbcon_decor_ioctl_dosetpic(struct vc_data *vc, struct fb_image *img, unsigned char origin)
++{
++ struct fb_info *info;
++ int len;
++ u8 *tmp;
++
++ if (vc->vc_num != fg_console)
++ return -EINVAL;
++
++ info = registered_fb[(int) con2fb_map[vc->vc_num]];
++
++ if (info == NULL)
++ return -EINVAL;
++
++ if (img->width != info->var.xres || img->height != info->var.yres) {
++ printk(KERN_ERR "fbcondecor: picture dimensions mismatch\n");
++ printk(KERN_ERR "%dx%d vs %dx%d\n", img->width, img->height, info->var.xres, info->var.yres);
++ return -EINVAL;
++ }
++
++ if (img->depth != info->var.bits_per_pixel) {
++ printk(KERN_ERR "fbcondecor: picture depth mismatch\n");
++ return -EINVAL;
++ }
++
++ if (img->depth == 8) {
++ if (!img->cmap.len || !img->cmap.red || !img->cmap.green ||
++ !img->cmap.blue)
++ return -EINVAL;
++
++ tmp = vmalloc(img->cmap.len * 3 * 2);
++ if (!tmp)
++ return -ENOMEM;
++
++ if (copy_from_user(tmp,
++ (void __user*)img->cmap.red, (img->cmap.len << 1)) ||
++ copy_from_user(tmp + (img->cmap.len << 1),
++ (void __user*)img->cmap.green, (img->cmap.len << 1)) ||
++ copy_from_user(tmp + (img->cmap.len << 2),
++ (void __user*)img->cmap.blue, (img->cmap.len << 1))) {
++ vfree(tmp);
++ return -EFAULT;
++ }
++
++ img->cmap.transp = NULL;
++ img->cmap.red = (u16*)tmp;
++ img->cmap.green = img->cmap.red + img->cmap.len;
++ img->cmap.blue = img->cmap.green + img->cmap.len;
++ } else {
++ img->cmap.red = NULL;
++ }
++
++ len = ((img->depth + 7) >> 3) * img->width * img->height;
++
++ /*
++ * Allocate an additional byte so that we never go outside of the
++ * buffer boundaries in the rendering functions in a 24 bpp mode.
++ */
++ tmp = vmalloc(len + 1);
++
++ if (!tmp)
++ goto out;
++
++ if (copy_from_user(tmp, (void __user*)img->data, len))
++ goto out;
++
++ img->data = tmp;
++
++ /* If this ioctl is a response to a request from kernel, the console sem
++ * is already held. */
++// if (origin == FBCON_DECOR_IO_ORIG_USER)
++ console_lock();
++
++ if (info->bgdecor.data)
++ vfree((u8*)info->bgdecor.data);
++ if (info->bgdecor.cmap.red)
++ vfree(info->bgdecor.cmap.red);
++
++ info->bgdecor = *img;
++
++ if (fbcon_decor_active_vc(vc) && fg_console == vc->vc_num) {
++ redraw_screen(vc, 0);
++ update_region(vc, vc->vc_origin +
++ vc->vc_size_row * vc->vc_top,
++ vc->vc_size_row * (vc->vc_bottom - vc->vc_top) / 2);
++ fbcon_decor_clear_margins(vc, info, 0);
++ }
++
++// if (origin == FBCON_DECOR_IO_ORIG_USER)
++ console_unlock();
++
++ return 0;
++
++out: if (img->cmap.red)
++ vfree(img->cmap.red);
++
++ if (tmp)
++ vfree(tmp);
++ return -ENOMEM;
++}
++
++static long fbcon_decor_ioctl(struct file *filp, u_int cmd, u_long arg)
++{
++ struct fbcon_decor_iowrapper __user *wrapper = (void __user*) arg;
++ struct vc_data *vc = NULL;
++ unsigned short vc_num = 0;
++ unsigned char origin = 0;
++ void __user *data = NULL;
++
++ if (!access_ok(VERIFY_READ, wrapper,
++ sizeof(struct fbcon_decor_iowrapper)))
++ return -EFAULT;
++
++ __get_user(vc_num, &wrapper->vc);
++ __get_user(origin, &wrapper->origin);
++ __get_user(data, &wrapper->data);
++
++ if (!vc_cons_allocated(vc_num))
++ return -EINVAL;
++
++ vc = vc_cons[vc_num].d;
++
++ switch (cmd) {
++ case FBIOCONDECOR_SETPIC:
++ {
++ struct fb_image img;
++ if (copy_from_user(&img, (struct fb_image __user *)data, sizeof(struct fb_image)))
++ return -EFAULT;
++
++ return fbcon_decor_ioctl_dosetpic(vc, &img, origin);
++ }
++ case FBIOCONDECOR_SETCFG:
++ {
++ struct vc_decor cfg;
++ if (copy_from_user(&cfg, (struct vc_decor __user *)data, sizeof(struct vc_decor)))
++ return -EFAULT;
++
++ return fbcon_decor_ioctl_dosetcfg(vc, &cfg, origin);
++ }
++ case FBIOCONDECOR_GETCFG:
++ {
++ int rval;
++ struct vc_decor cfg;
++
++ if (copy_from_user(&cfg, (struct vc_decor __user *)data, sizeof(struct vc_decor)))
++ return -EFAULT;
++
++ rval = fbcon_decor_ioctl_dogetcfg(vc, &cfg);
++
++ if (copy_to_user(data, &cfg, sizeof(struct vc_decor)))
++ return -EFAULT;
++ return rval;
++ }
++ case FBIOCONDECOR_SETSTATE:
++ {
++ unsigned int state = 0;
++ if (get_user(state, (unsigned int __user *)data))
++ return -EFAULT;
++ return fbcon_decor_ioctl_dosetstate(vc, state, origin);
++ }
++ case FBIOCONDECOR_GETSTATE:
++ {
++ unsigned int state = 0;
++ fbcon_decor_ioctl_dogetstate(vc, &state);
++ return put_user(state, (unsigned int __user *)data);
++ }
++
++ default:
++ return -ENOIOCTLCMD;
++ }
++}
++
++#ifdef CONFIG_COMPAT
++
++static long fbcon_decor_compat_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) {
++
++ struct fbcon_decor_iowrapper32 __user *wrapper = (void __user *)arg;
++ struct vc_data *vc = NULL;
++ unsigned short vc_num = 0;
++ unsigned char origin = 0;
++ compat_uptr_t data_compat = 0;
++ void __user *data = NULL;
++
++ if (!access_ok(VERIFY_READ, wrapper,
++ sizeof(struct fbcon_decor_iowrapper32)))
++ return -EFAULT;
++
++ __get_user(vc_num, &wrapper->vc);
++ __get_user(origin, &wrapper->origin);
++ __get_user(data_compat, &wrapper->data);
++ data = compat_ptr(data_compat);
++
++ if (!vc_cons_allocated(vc_num))
++ return -EINVAL;
++
++ vc = vc_cons[vc_num].d;
++
++ switch (cmd) {
++ case FBIOCONDECOR_SETPIC32:
++ {
++ struct fb_image32 img_compat;
++ struct fb_image img;
++
++ if (copy_from_user(&img_compat, (struct fb_image32 __user *)data, sizeof(struct fb_image32)))
++ return -EFAULT;
++
++ fb_image_from_compat(img, img_compat);
++
++ return fbcon_decor_ioctl_dosetpic(vc, &img, origin);
++ }
++
++ case FBIOCONDECOR_SETCFG32:
++ {
++ struct vc_decor32 cfg_compat;
++ struct vc_decor cfg;
++
++ if (copy_from_user(&cfg_compat, (struct vc_decor32 __user *)data, sizeof(struct vc_decor32)))
++ return -EFAULT;
++
++ vc_decor_from_compat(cfg, cfg_compat);
++
++ return fbcon_decor_ioctl_dosetcfg(vc, &cfg, origin);
++ }
++
++ case FBIOCONDECOR_GETCFG32:
++ {
++ int rval;
++ struct vc_decor32 cfg_compat;
++ struct vc_decor cfg;
++
++ if (copy_from_user(&cfg_compat, (struct vc_decor32 __user *)data, sizeof(struct vc_decor32)))
++ return -EFAULT;
++ cfg.theme = compat_ptr(cfg_compat.theme);
++
++ rval = fbcon_decor_ioctl_dogetcfg(vc, &cfg);
++
++ vc_decor_to_compat(cfg_compat, cfg);
++
++ if (copy_to_user((struct vc_decor32 __user *)data, &cfg_compat, sizeof(struct vc_decor32)))
++ return -EFAULT;
++ return rval;
++ }
++
++ case FBIOCONDECOR_SETSTATE32:
++ {
++ compat_uint_t state_compat = 0;
++ unsigned int state = 0;
++
++ if (get_user(state_compat, (compat_uint_t __user *)data))
++ return -EFAULT;
++
++ state = (unsigned int)state_compat;
++
++ return fbcon_decor_ioctl_dosetstate(vc, state, origin);
++ }
++
++ case FBIOCONDECOR_GETSTATE32:
++ {
++ compat_uint_t state_compat = 0;
++ unsigned int state = 0;
++
++ fbcon_decor_ioctl_dogetstate(vc, &state);
++ state_compat = (compat_uint_t)state;
++
++ return put_user(state_compat, (compat_uint_t __user *)data);
++ }
++
++ default:
++ return -ENOIOCTLCMD;
++ }
++}
++#else
++ #define fbcon_decor_compat_ioctl NULL
++#endif
++
++static struct file_operations fbcon_decor_ops = {
++ .owner = THIS_MODULE,
++ .unlocked_ioctl = fbcon_decor_ioctl,
++ .compat_ioctl = fbcon_decor_compat_ioctl
++};
++
++static struct miscdevice fbcon_decor_dev = {
++ .minor = MISC_DYNAMIC_MINOR,
++ .name = "fbcondecor",
++ .fops = &fbcon_decor_ops
++};
++
++void fbcon_decor_reset(void)
++{
++ int i;
++
++ for (i = 0; i < num_registered_fb; i++) {
++ registered_fb[i]->bgdecor.data = NULL;
++ registered_fb[i]->bgdecor.cmap.red = NULL;
++ }
++
++ for (i = 0; i < MAX_NR_CONSOLES && vc_cons[i].d; i++) {
++ vc_cons[i].d->vc_decor.state = vc_cons[i].d->vc_decor.twidth =
++ vc_cons[i].d->vc_decor.theight = 0;
++ vc_cons[i].d->vc_decor.theme = NULL;
++ }
++
++ return;
++}
++
++int fbcon_decor_init(void)
++{
++ int i;
++
++ fbcon_decor_reset();
++
++ if (initialized)
++ return 0;
++
++ i = misc_register(&fbcon_decor_dev);
++ if (i) {
++ printk(KERN_ERR "fbcondecor: failed to register device\n");
++ return i;
++ }
++
++ fbcon_decor_call_helper("init", 0);
++ initialized = 1;
++ return 0;
++}
++
++int fbcon_decor_exit(void)
++{
++ fbcon_decor_reset();
++ return 0;
++}
++
++EXPORT_SYMBOL(fbcon_decor_path);
+diff --git a/drivers/video/console/fbcondecor.h b/drivers/video/console/fbcondecor.h
+new file mode 100644
+index 0000000..3b3724b
+--- /dev/null
++++ b/drivers/video/console/fbcondecor.h
+@@ -0,0 +1,78 @@
++/*
++ * linux/drivers/video/console/fbcondecor.h -- Framebuffer Console Decoration headers
++ *
++ * Copyright (C) 2004 Michal Januszewski <michalj+fbcondecor@gmail.com>
++ *
++ */
++
++#ifndef __FBCON_DECOR_H
++#define __FBCON_DECOR_H
++
++#ifndef _LINUX_FB_H
++#include <linux/fb.h>
++#endif
++
++/* This is needed for vc_cons in fbcmap.c */
++#include <linux/vt_kern.h>
++
++struct fb_cursor;
++struct fb_info;
++struct vc_data;
++
++#ifdef CONFIG_FB_CON_DECOR
++/* fbcondecor.c */
++int fbcon_decor_init(void);
++int fbcon_decor_exit(void);
++int fbcon_decor_call_helper(char* cmd, unsigned short cons);
++int fbcon_decor_disable(struct vc_data *vc, unsigned char redraw);
++
++/* cfbcondecor.c */
++void fbcon_decor_putcs(struct vc_data *vc, struct fb_info *info, const unsigned short *s, int count, int yy, int xx);
++void fbcon_decor_cursor(struct fb_info *info, struct fb_cursor *cursor);
++void fbcon_decor_clear(struct vc_data *vc, struct fb_info *info, int sy, int sx, int height, int width);
++void fbcon_decor_clear_margins(struct vc_data *vc, struct fb_info *info, int bottom_only);
++void fbcon_decor_blank(struct vc_data *vc, struct fb_info *info, int blank);
++void fbcon_decor_bmove_redraw(struct vc_data *vc, struct fb_info *info, int y, int sx, int dx, int width);
++void fbcon_decor_copy(u8 *dst, u8 *src, int height, int width, int linebytes, int srclinesbytes, int bpp);
++void fbcon_decor_fix_pseudo_pal(struct fb_info *info, struct vc_data *vc);
++
++/* vt.c */
++void acquire_console_sem(void);
++void release_console_sem(void);
++void do_unblank_screen(int entering_gfx);
++
++/* struct vc_data *y */
++#define fbcon_decor_active_vc(y) (y->vc_decor.state && y->vc_decor.theme)
++
++/* struct fb_info *x, struct vc_data *y */
++#define fbcon_decor_active_nores(x,y) (x->bgdecor.data && fbcon_decor_active_vc(y))
++
++/* struct fb_info *x, struct vc_data *y */
++#define fbcon_decor_active(x,y) (fbcon_decor_active_nores(x,y) && \
++ x->bgdecor.width == x->var.xres && \
++ x->bgdecor.height == x->var.yres && \
++ x->bgdecor.depth == x->var.bits_per_pixel)
++
++
++#else /* CONFIG_FB_CON_DECOR */
++
++static inline void fbcon_decor_putcs(struct vc_data *vc, struct fb_info *info, const unsigned short *s, int count, int yy, int xx) {}
++static inline void fbcon_decor_putc(struct vc_data *vc, struct fb_info *info, int c, int ypos, int xpos) {}
++static inline void fbcon_decor_cursor(struct fb_info *info, struct fb_cursor *cursor) {}
++static inline void fbcon_decor_clear(struct vc_data *vc, struct fb_info *info, int sy, int sx, int height, int width) {}
++static inline void fbcon_decor_clear_margins(struct vc_data *vc, struct fb_info *info, int bottom_only) {}
++static inline void fbcon_decor_blank(struct vc_data *vc, struct fb_info *info, int blank) {}
++static inline void fbcon_decor_bmove_redraw(struct vc_data *vc, struct fb_info *info, int y, int sx, int dx, int width) {}
++static inline void fbcon_decor_fix_pseudo_pal(struct fb_info *info, struct vc_data *vc) {}
++static inline int fbcon_decor_call_helper(char* cmd, unsigned short cons) { return 0; }
++static inline int fbcon_decor_init(void) { return 0; }
++static inline int fbcon_decor_exit(void) { return 0; }
++static inline int fbcon_decor_disable(struct vc_data *vc, unsigned char redraw) { return 0; }
++
++#define fbcon_decor_active_vc(y) (0)
++#define fbcon_decor_active_nores(x,y) (0)
++#define fbcon_decor_active(x,y) (0)
++
++#endif /* CONFIG_FB_CON_DECOR */
++
++#endif /* __FBCON_DECOR_H */
+diff --git a/drivers/video/fbdev/Kconfig b/drivers/video/fbdev/Kconfig
+index e1f4727..2952e33 100644
+--- a/drivers/video/fbdev/Kconfig
++++ b/drivers/video/fbdev/Kconfig
+@@ -1204,7 +1204,6 @@ config FB_MATROX
+ select FB_CFB_FILLRECT
+ select FB_CFB_COPYAREA
+ select FB_CFB_IMAGEBLIT
+- select FB_TILEBLITTING
+ select FB_MACMODES if PPC_PMAC
+ ---help---
+ Say Y here if you have a Matrox Millennium, Matrox Millennium II,
+diff --git a/drivers/video/fbdev/core/fbcmap.c b/drivers/video/fbdev/core/fbcmap.c
+index f89245b..05e036c 100644
+--- a/drivers/video/fbdev/core/fbcmap.c
++++ b/drivers/video/fbdev/core/fbcmap.c
+@@ -17,6 +17,8 @@
+ #include <linux/slab.h>
+ #include <linux/uaccess.h>
+
++#include "../../console/fbcondecor.h"
++
+ static u16 red2[] __read_mostly = {
+ 0x0000, 0xaaaa
+ };
+@@ -249,14 +251,17 @@ int fb_set_cmap(struct fb_cmap *cmap, struct fb_info *info)
+ if (transp)
+ htransp = *transp++;
+ if (info->fbops->fb_setcolreg(start++,
+- hred, hgreen, hblue,
++ hred, hgreen, hblue,
+ htransp, info))
+ break;
+ }
+ }
+- if (rc == 0)
++ if (rc == 0) {
+ fb_copy_cmap(cmap, &info->cmap);
+-
++ if (fbcon_decor_active(info, vc_cons[fg_console].d) &&
++ info->fix.visual == FB_VISUAL_DIRECTCOLOR)
++ fbcon_decor_fix_pseudo_pal(info, vc_cons[fg_console].d);
++ }
+ return rc;
+ }
+
+diff --git a/drivers/video/fbdev/core/fbmem.c b/drivers/video/fbdev/core/fbmem.c
+index b6d5008..d6703f2 100644
+--- a/drivers/video/fbdev/core/fbmem.c
++++ b/drivers/video/fbdev/core/fbmem.c
+@@ -1250,15 +1250,6 @@ struct fb_fix_screeninfo32 {
+ u16 reserved[3];
+ };
+
+-struct fb_cmap32 {
+- u32 start;
+- u32 len;
+- compat_caddr_t red;
+- compat_caddr_t green;
+- compat_caddr_t blue;
+- compat_caddr_t transp;
+-};
+-
+ static int fb_getput_cmap(struct fb_info *info, unsigned int cmd,
+ unsigned long arg)
+ {
+diff --git a/include/linux/console_decor.h b/include/linux/console_decor.h
+new file mode 100644
+index 0000000..04b8d80
+--- /dev/null
++++ b/include/linux/console_decor.h
+@@ -0,0 +1,46 @@
++#ifndef _LINUX_CONSOLE_DECOR_H_
++#define _LINUX_CONSOLE_DECOR_H_ 1
++
++/* A structure used by the framebuffer console decorations (drivers/video/console/fbcondecor.c) */
++struct vc_decor {
++ __u8 bg_color; /* The color that is to be treated as transparent */
++ __u8 state; /* Current decor state: 0 = off, 1 = on */
++ __u16 tx, ty; /* Top left corner coordinates of the text field */
++ __u16 twidth, theight; /* Width and height of the text field */
++ char* theme;
++};
++
++#ifdef __KERNEL__
++#ifdef CONFIG_COMPAT
++#include <linux/compat.h>
++
++struct vc_decor32 {
++ __u8 bg_color; /* The color that is to be treated as transparent */
++ __u8 state; /* Current decor state: 0 = off, 1 = on */
++ __u16 tx, ty; /* Top left corner coordinates of the text field */
++ __u16 twidth, theight; /* Width and height of the text field */
++ compat_uptr_t theme;
++};
++
++#define vc_decor_from_compat(to, from) \
++ (to).bg_color = (from).bg_color; \
++ (to).state = (from).state; \
++ (to).tx = (from).tx; \
++ (to).ty = (from).ty; \
++ (to).twidth = (from).twidth; \
++ (to).theight = (from).theight; \
++ (to).theme = compat_ptr((from).theme)
++
++#define vc_decor_to_compat(to, from) \
++ (to).bg_color = (from).bg_color; \
++ (to).state = (from).state; \
++ (to).tx = (from).tx; \
++ (to).ty = (from).ty; \
++ (to).twidth = (from).twidth; \
++ (to).theight = (from).theight; \
++ (to).theme = ptr_to_compat((from).theme)
++
++#endif /* CONFIG_COMPAT */
++#endif /* __KERNEL__ */
++
++#endif
+diff --git a/include/linux/console_struct.h b/include/linux/console_struct.h
+index 7f0c329..98f5d60 100644
+--- a/include/linux/console_struct.h
++++ b/include/linux/console_struct.h
+@@ -19,6 +19,7 @@
+ struct vt_struct;
+
+ #define NPAR 16
++#include <linux/console_decor.h>
+
+ struct vc_data {
+ struct tty_port port; /* Upper level data */
+@@ -107,6 +108,8 @@ struct vc_data {
+ unsigned long vc_uni_pagedir;
+ unsigned long *vc_uni_pagedir_loc; /* [!] Location of uni_pagedir variable for this console */
+ bool vc_panic_force_write; /* when oops/panic this VC can accept forced output/blanking */
++
++ struct vc_decor vc_decor;
+ /* additional information is in vt_kern.h */
+ };
+
+diff --git a/include/linux/fb.h b/include/linux/fb.h
+index fe6ac95..1e36b03 100644
+--- a/include/linux/fb.h
++++ b/include/linux/fb.h
+@@ -219,6 +219,34 @@ struct fb_deferred_io {
+ };
+ #endif
+
++#ifdef __KERNEL__
++#ifdef CONFIG_COMPAT
++struct fb_image32 {
++ __u32 dx; /* Where to place image */
++ __u32 dy;
++ __u32 width; /* Size of image */
++ __u32 height;
++ __u32 fg_color; /* Only used when a mono bitmap */
++ __u32 bg_color;
++ __u8 depth; /* Depth of the image */
++ const compat_uptr_t data; /* Pointer to image data */
++ struct fb_cmap32 cmap; /* color map info */
++};
++
++#define fb_image_from_compat(to, from) \
++ (to).dx = (from).dx; \
++ (to).dy = (from).dy; \
++ (to).width = (from).width; \
++ (to).height = (from).height; \
++ (to).fg_color = (from).fg_color; \
++ (to).bg_color = (from).bg_color; \
++ (to).depth = (from).depth; \
++ (to).data = compat_ptr((from).data); \
++ fb_cmap_from_compat((to).cmap, (from).cmap)
++
++#endif /* CONFIG_COMPAT */
++#endif /* __KERNEL__ */
++
+ /*
+ * Frame buffer operations
+ *
+@@ -489,6 +517,9 @@ struct fb_info {
+ #define FBINFO_STATE_SUSPENDED 1
+ u32 state; /* Hardware state i.e suspend */
+ void *fbcon_par; /* fbcon use-only private area */
++
++ struct fb_image bgdecor;
++
+ /* From here on everything is device dependent */
+ void *par;
+ /* we need the PCI or similar aperture base/size not
+diff --git a/include/uapi/linux/fb.h b/include/uapi/linux/fb.h
+index fb795c3..dc77a03 100644
+--- a/include/uapi/linux/fb.h
++++ b/include/uapi/linux/fb.h
+@@ -8,6 +8,25 @@
+
+ #define FB_MAX 32 /* sufficient for now */
+
++struct fbcon_decor_iowrapper
++{
++ unsigned short vc; /* Virtual console */
++ unsigned char origin; /* Point of origin of the request */
++ void *data;
++};
++
++#ifdef __KERNEL__
++#ifdef CONFIG_COMPAT
++#include <linux/compat.h>
++struct fbcon_decor_iowrapper32
++{
++ unsigned short vc; /* Virtual console */
++ unsigned char origin; /* Point of origin of the request */
++ compat_uptr_t data;
++};
++#endif /* CONFIG_COMPAT */
++#endif /* __KERNEL__ */
++
+ /* ioctls
+ 0x46 is 'F' */
+ #define FBIOGET_VSCREENINFO 0x4600
+@@ -35,6 +54,25 @@
+ #define FBIOGET_DISPINFO 0x4618
+ #define FBIO_WAITFORVSYNC _IOW('F', 0x20, __u32)
+
++#define FBIOCONDECOR_SETCFG _IOWR('F', 0x19, struct fbcon_decor_iowrapper)
++#define FBIOCONDECOR_GETCFG _IOR('F', 0x1A, struct fbcon_decor_iowrapper)
++#define FBIOCONDECOR_SETSTATE _IOWR('F', 0x1B, struct fbcon_decor_iowrapper)
++#define FBIOCONDECOR_GETSTATE _IOR('F', 0x1C, struct fbcon_decor_iowrapper)
++#define FBIOCONDECOR_SETPIC _IOWR('F', 0x1D, struct fbcon_decor_iowrapper)
++#ifdef __KERNEL__
++#ifdef CONFIG_COMPAT
++#define FBIOCONDECOR_SETCFG32 _IOWR('F', 0x19, struct fbcon_decor_iowrapper32)
++#define FBIOCONDECOR_GETCFG32 _IOR('F', 0x1A, struct fbcon_decor_iowrapper32)
++#define FBIOCONDECOR_SETSTATE32 _IOWR('F', 0x1B, struct fbcon_decor_iowrapper32)
++#define FBIOCONDECOR_GETSTATE32 _IOR('F', 0x1C, struct fbcon_decor_iowrapper32)
++#define FBIOCONDECOR_SETPIC32 _IOWR('F', 0x1D, struct fbcon_decor_iowrapper32)
++#endif /* CONFIG_COMPAT */
++#endif /* __KERNEL__ */
++
++#define FBCON_DECOR_THEME_LEN 128 /* Maximum lenght of a theme name */
++#define FBCON_DECOR_IO_ORIG_KERNEL 0 /* Kernel ioctl origin */
++#define FBCON_DECOR_IO_ORIG_USER 1 /* User ioctl origin */
++
+ #define FB_TYPE_PACKED_PIXELS 0 /* Packed Pixels */
+ #define FB_TYPE_PLANES 1 /* Non interleaved planes */
+ #define FB_TYPE_INTERLEAVED_PLANES 2 /* Interleaved planes */
+@@ -277,6 +315,29 @@ struct fb_var_screeninfo {
+ __u32 reserved[4]; /* Reserved for future compatibility */
+ };
+
++#ifdef __KERNEL__
++#ifdef CONFIG_COMPAT
++struct fb_cmap32 {
++ __u32 start;
++ __u32 len; /* Number of entries */
++ compat_uptr_t red; /* Red values */
++ compat_uptr_t green;
++ compat_uptr_t blue;
++ compat_uptr_t transp; /* transparency, can be NULL */
++};
++
++#define fb_cmap_from_compat(to, from) \
++ (to).start = (from).start; \
++ (to).len = (from).len; \
++ (to).red = compat_ptr((from).red); \
++ (to).green = compat_ptr((from).green); \
++ (to).blue = compat_ptr((from).blue); \
++ (to).transp = compat_ptr((from).transp)
++
++#endif /* CONFIG_COMPAT */
++#endif /* __KERNEL__ */
++
++
+ struct fb_cmap {
+ __u32 start; /* First entry */
+ __u32 len; /* Number of entries */
+diff --git a/kernel/sysctl.c b/kernel/sysctl.c
+index 74f5b58..6386ab0 100644
+--- a/kernel/sysctl.c
++++ b/kernel/sysctl.c
+@@ -146,6 +146,10 @@ static const int cap_last_cap = CAP_LAST_CAP;
+ static unsigned long hung_task_timeout_max = (LONG_MAX/HZ);
+ #endif
+
++#ifdef CONFIG_FB_CON_DECOR
++extern char fbcon_decor_path[];
++#endif
++
+ #ifdef CONFIG_INOTIFY_USER
+ #include <linux/inotify.h>
+ #endif
+@@ -255,6 +259,15 @@ static struct ctl_table sysctl_base_table[] = {
+ .mode = 0555,
+ .child = dev_table,
+ },
++#ifdef CONFIG_FB_CON_DECOR
++ {
++ .procname = "fbcondecor",
++ .data = &fbcon_decor_path,
++ .maxlen = KMOD_PATH_LEN,
++ .mode = 0644,
++ .proc_handler = &proc_dostring,
++ },
++#endif
+ { }
+ };
+
diff --git a/5000_enable-additional-cpu-optimizations-for-gcc.patch b/5000_enable-additional-cpu-optimizations-for-gcc.patch
new file mode 100644
index 0000000..f7ab6f0
--- /dev/null
+++ b/5000_enable-additional-cpu-optimizations-for-gcc.patch
@@ -0,0 +1,327 @@
+This patch has been tested on and known to work with kernel versions from 3.2
+up to the latest git version (pulled on 12/14/2013).
+
+This patch will expand the number of microarchitectures to include new
+processors including: AMD K10-family, AMD Family 10h (Barcelona), AMD Family
+14h (Bobcat), AMD Family 15h (Bulldozer), AMD Family 15h (Piledriver), AMD
+Family 16h (Jaguar), Intel 1st Gen Core i3/i5/i7 (Nehalem), Intel 2nd Gen Core
+i3/i5/i7 (Sandybridge), Intel 3rd Gen Core i3/i5/i7 (Ivybridge), and Intel 4th
+Gen Core i3/i5/i7 (Haswell). It also offers the compiler the 'native' flag.
+
+Small but real speed increases are measurable using a make endpoint comparing
+a generic kernel to one built with one of the respective microarchs.
+
+See the following experimental evidence supporting this statement:
+https://github.com/graysky2/kernel_gcc_patch
+
+REQUIREMENTS
+linux version >=3.15
+gcc version <4.9
+
+---
+diff -uprN a/arch/x86/include/asm/module.h b/arch/x86/include/asm/module.h
+--- a/arch/x86/include/asm/module.h 2013-11-03 18:41:51.000000000 -0500
++++ b/arch/x86/include/asm/module.h 2013-12-15 06:21:24.351122516 -0500
+@@ -15,6 +15,16 @@
+ #define MODULE_PROC_FAMILY "586MMX "
+ #elif defined CONFIG_MCORE2
+ #define MODULE_PROC_FAMILY "CORE2 "
++#elif defined CONFIG_MNATIVE
++#define MODULE_PROC_FAMILY "NATIVE "
++#elif defined CONFIG_MCOREI7
++#define MODULE_PROC_FAMILY "COREI7 "
++#elif defined CONFIG_MCOREI7AVX
++#define MODULE_PROC_FAMILY "COREI7AVX "
++#elif defined CONFIG_MCOREAVXI
++#define MODULE_PROC_FAMILY "COREAVXI "
++#elif defined CONFIG_MCOREAVX2
++#define MODULE_PROC_FAMILY "COREAVX2 "
+ #elif defined CONFIG_MATOM
+ #define MODULE_PROC_FAMILY "ATOM "
+ #elif defined CONFIG_M686
+@@ -33,6 +43,18 @@
+ #define MODULE_PROC_FAMILY "K7 "
+ #elif defined CONFIG_MK8
+ #define MODULE_PROC_FAMILY "K8 "
++#elif defined CONFIG_MK10
++#define MODULE_PROC_FAMILY "K10 "
++#elif defined CONFIG_MBARCELONA
++#define MODULE_PROC_FAMILY "BARCELONA "
++#elif defined CONFIG_MBOBCAT
++#define MODULE_PROC_FAMILY "BOBCAT "
++#elif defined CONFIG_MBULLDOZER
++#define MODULE_PROC_FAMILY "BULLDOZER "
++#elif defined CONFIG_MPILEDRIVER
++#define MODULE_PROC_FAMILY "PILEDRIVER "
++#elif defined CONFIG_MJAGUAR
++#define MODULE_PROC_FAMILY "JAGUAR "
+ #elif defined CONFIG_MELAN
+ #define MODULE_PROC_FAMILY "ELAN "
+ #elif defined CONFIG_MCRUSOE
+diff -uprN a/arch/x86/Kconfig.cpu b/arch/x86/Kconfig.cpu
+--- a/arch/x86/Kconfig.cpu 2013-11-03 18:41:51.000000000 -0500
++++ b/arch/x86/Kconfig.cpu 2013-12-15 06:21:24.351122516 -0500
+@@ -139,7 +139,7 @@ config MPENTIUM4
+
+
+ config MK6
+- bool "K6/K6-II/K6-III"
++ bool "AMD K6/K6-II/K6-III"
+ depends on X86_32
+ ---help---
+ Select this for an AMD K6-family processor. Enables use of
+@@ -147,7 +147,7 @@ config MK6
+ flags to GCC.
+
+ config MK7
+- bool "Athlon/Duron/K7"
++ bool "AMD Athlon/Duron/K7"
+ depends on X86_32
+ ---help---
+ Select this for an AMD Athlon K7-family processor. Enables use of
+@@ -155,12 +155,55 @@ config MK7
+ flags to GCC.
+
+ config MK8
+- bool "Opteron/Athlon64/Hammer/K8"
++ bool "AMD Opteron/Athlon64/Hammer/K8"
+ ---help---
+ Select this for an AMD Opteron or Athlon64 Hammer-family processor.
+ Enables use of some extended instructions, and passes appropriate
+ optimization flags to GCC.
+
++config MK10
++ bool "AMD 61xx/7x50/PhenomX3/X4/II/K10"
++ ---help---
++ Select this for an AMD 61xx Eight-Core Magny-Cours, Athlon X2 7x50,
++ Phenom X3/X4/II, Athlon II X2/X3/X4, or Turion II-family processor.
++ Enables use of some extended instructions, and passes appropriate
++ optimization flags to GCC.
++
++config MBARCELONA
++ bool "AMD Barcelona"
++ ---help---
++ Select this for AMD Barcelona and newer processors.
++
++ Enables -march=barcelona
++
++config MBOBCAT
++ bool "AMD Bobcat"
++ ---help---
++ Select this for AMD Bobcat processors.
++
++ Enables -march=btver1
++
++config MBULLDOZER
++ bool "AMD Bulldozer"
++ ---help---
++ Select this for AMD Bulldozer processors.
++
++ Enables -march=bdver1
++
++config MPILEDRIVER
++ bool "AMD Piledriver"
++ ---help---
++ Select this for AMD Piledriver processors.
++
++ Enables -march=bdver2
++
++config MJAGUAR
++ bool "AMD Jaguar"
++ ---help---
++ Select this for AMD Jaguar processors.
++
++ Enables -march=btver2
++
+ config MCRUSOE
+ bool "Crusoe"
+ depends on X86_32
+@@ -251,8 +294,17 @@ config MPSC
+ using the cpu family field
+ in /proc/cpuinfo. Family 15 is an older Xeon, Family 6 a newer one.
+
++config MATOM
++ bool "Intel Atom"
++ ---help---
++
++ Select this for the Intel Atom platform. Intel Atom CPUs have an
++ in-order pipelining architecture and thus can benefit from
++ accordingly optimized code. Use a recent GCC with specific Atom
++ support in order to fully benefit from selecting this option.
++
+ config MCORE2
+- bool "Core 2/newer Xeon"
++ bool "Intel Core 2"
+ ---help---
+
+ Select this for Intel Core 2 and newer Core 2 Xeons (Xeon 51xx and
+@@ -260,14 +312,40 @@ config MCORE2
+ family in /proc/cpuinfo. Newer ones have 6 and older ones 15
+ (not a typo)
+
+-config MATOM
+- bool "Intel Atom"
++ Enables -march=core2
++
++config MCOREI7
++ bool "Intel Core i7"
+ ---help---
+
+- Select this for the Intel Atom platform. Intel Atom CPUs have an
+- in-order pipelining architecture and thus can benefit from
+- accordingly optimized code. Use a recent GCC with specific Atom
+- support in order to fully benefit from selecting this option.
++ Select this for the Intel Nehalem platform. Intel Nehalem proecessors
++ include Core i3, i5, i7, Xeon: 34xx, 35xx, 55xx, 56xx, 75xx processors.
++
++ Enables -march=corei7
++
++config MCOREI7AVX
++ bool "Intel Core 2nd Gen AVX"
++ ---help---
++
++ Select this for 2nd Gen Core processors including Sandy Bridge.
++
++ Enables -march=corei7-avx
++
++config MCOREAVXI
++ bool "Intel Core 3rd Gen AVX"
++ ---help---
++
++ Select this for 3rd Gen Core processors including Ivy Bridge.
++
++ Enables -march=core-avx-i
++
++config MCOREAVX2
++ bool "Intel Core AVX2"
++ ---help---
++
++ Select this for AVX2 enabled processors including Haswell.
++
++ Enables -march=core-avx2
+
+ config GENERIC_CPU
+ bool "Generic-x86-64"
+@@ -276,6 +354,19 @@ config GENERIC_CPU
+ Generic x86-64 CPU.
+ Run equally well on all x86-64 CPUs.
+
++config MNATIVE
++ bool "Native optimizations autodetected by GCC"
++ ---help---
++
++ GCC 4.2 and above support -march=native, which automatically detects
++ the optimum settings to use based on your processor. -march=native
++ also detects and applies additional settings beyond -march specific
++ to your CPU, (eg. -msse4). Unless you have a specific reason not to
++ (e.g. distcc cross-compiling), you should probably be using
++ -march=native rather than anything listed below.
++
++ Enables -march=native
++
+ endchoice
+
+ config X86_GENERIC
+@@ -300,7 +391,7 @@ config X86_INTERNODE_CACHE_SHIFT
+ config X86_L1_CACHE_SHIFT
+ int
+ default "7" if MPENTIUM4 || MPSC
+- default "6" if MK7 || MK8 || MPENTIUMM || MCORE2 || MATOM || MVIAC7 || X86_GENERIC || GENERIC_CPU
++ default "6" if MK7 || MK8 || MK10 || MBARCELONA || MBOBCAT || MBULLDOZER || MPILEDRIVER || MJAGUAR || MPENTIUMM || MCORE2 || MCOREI7 || MCOREI7AVX || MCOREAVXI || MCOREAVX2 || MATOM || MVIAC7 || X86_GENERIC || MNATIVE || GENERIC_CPU
+ default "4" if MELAN || M486 || MGEODEGX1
+ default "5" if MWINCHIP3D || MWINCHIPC6 || MCRUSOE || MEFFICEON || MCYRIXIII || MK6 || MPENTIUMIII || MPENTIUMII || M686 || M586MMX || M586TSC || M586 || MVIAC3_2 || MGEODE_LX
+
+@@ -331,11 +422,11 @@ config X86_ALIGNMENT_16
+
+ config X86_INTEL_USERCOPY
+ def_bool y
+- depends on MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M586MMX || X86_GENERIC || MK8 || MK7 || MEFFICEON || MCORE2
++ depends on MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M586MMX || MNATIVE || X86_GENERIC || MK8 || MK7 || MK10 || MBARCELONA || MEFFICEON || MCORE2 || MCOREI7 || MCOREI7AVX || MCOREAVXI || MCOREAVX2
+
+ config X86_USE_PPRO_CHECKSUM
+ def_bool y
+- depends on MWINCHIP3D || MWINCHIPC6 || MCYRIXIII || MK7 || MK6 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MK8 || MVIAC3_2 || MVIAC7 || MEFFICEON || MGEODE_LX || MCORE2 || MATOM
++ depends on MWINCHIP3D || MWINCHIPC6 || MCYRIXIII || MK7 || MK6 || MK10 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MK8 || MVIAC3_2 || MVIAC7 || MEFFICEON || MGEODE_LX || MCORE2 || MCOREI7 || MCOREI7AVX || MCOREAVXI || MCOREAVX2 || MATOM || MNATIVE
+
+ config X86_USE_3DNOW
+ def_bool y
+@@ -363,17 +454,17 @@ config X86_P6_NOP
+
+ config X86_TSC
+ def_bool y
+- depends on (MWINCHIP3D || MCRUSOE || MEFFICEON || MCYRIXIII || MK7 || MK6 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || M586MMX || M586TSC || MK8 || MVIAC3_2 || MVIAC7 || MGEODEGX1 || MGEODE_LX || MCORE2 || MATOM) || X86_64
++ depends on (MWINCHIP3D || MCRUSOE || MEFFICEON || MCYRIXIII || MK7 || MK6 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || M586MMX || M586TSC || MK8 || MK10 || MBARCELONA || MBOBCAT || MBULLDOZER || MPILEDRIVER || MJAGUAR || MVIAC3_2 || MVIAC7 || MGEODEGX1 || MGEODE_LX || MCORE2 || MCOREI7 || MCOREI7-AVX || MATOM) || X86_64 || MNATIVE
+
+ config X86_CMPXCHG64
+ def_bool y
+- depends on X86_PAE || X86_64 || MCORE2 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MATOM
++ depends on X86_PAE || X86_64 || MCORE2 || MCOREI7 || MCOREI7AVX || MCOREAVXI || MCOREAVX2 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MATOM || MNATIVE
+
+ # this should be set for all -march=.. options where the compiler
+ # generates cmov.
+ config X86_CMOV
+ def_bool y
+- depends on (MK8 || MK7 || MCORE2 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MVIAC3_2 || MVIAC7 || MCRUSOE || MEFFICEON || X86_64 || MATOM || MGEODE_LX)
++ depends on (MK8 || MK10 || MBARCELONA || MBOBCAT || MBULLDOZER || MPILEDRIVER || MJAGUAR || MK7 || MCORE2 || MCOREI7 || MCOREI7AVX || MCOREAVXI || MCOREAVX2 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MVIAC3_2 || MVIAC7 || MCRUSOE || MEFFICEON || X86_64 || MNATIVE || MATOM || MGEODE_LX)
+
+ config X86_MINIMUM_CPU_FAMILY
+ int
+diff -uprN a/arch/x86/Makefile b/arch/x86/Makefile
+--- a/arch/x86/Makefile 2013-11-03 18:41:51.000000000 -0500
++++ b/arch/x86/Makefile 2013-12-15 06:21:24.354455723 -0500
+@@ -61,11 +61,26 @@ else
+ KBUILD_CFLAGS += $(call cc-option,-mno-sse -mpreferred-stack-boundary=3)
+
+ # FIXME - should be integrated in Makefile.cpu (Makefile_32.cpu)
++ cflags-$(CONFIG_MNATIVE) += $(call cc-option,-march=native)
+ cflags-$(CONFIG_MK8) += $(call cc-option,-march=k8)
++ cflags-$(CONFIG_MK10) += $(call cc-option,-march=amdfam10)
++ cflags-$(CONFIG_MBARCELONA) += $(call cc-option,-march=barcelona)
++ cflags-$(CONFIG_MBOBCAT) += $(call cc-option,-march=btver1)
++ cflags-$(CONFIG_MBULLDOZER) += $(call cc-option,-march=bdver1)
++ cflags-$(CONFIG_MPILEDRIVER) += $(call cc-option,-march=bdver2)
++ cflags-$(CONFIG_MJAGUAR) += $(call cc-option,-march=btver2)
+ cflags-$(CONFIG_MPSC) += $(call cc-option,-march=nocona)
+
+ cflags-$(CONFIG_MCORE2) += \
+- $(call cc-option,-march=core2,$(call cc-option,-mtune=generic))
++ $(call cc-option,-march=core2,$(call cc-option,-mtune=core2))
++ cflags-$(CONFIG_MCOREI7) += \
++ $(call cc-option,-march=corei7,$(call cc-option,-mtune=corei7))
++ cflags-$(CONFIG_MCOREI7AVX) += \
++ $(call cc-option,-march=corei7-avx,$(call cc-option,-mtune=corei7-avx))
++ cflags-$(CONFIG_MCOREAVXI) += \
++ $(call cc-option,-march=core-avx-i,$(call cc-option,-mtune=core-avx-i))
++ cflags-$(CONFIG_MCOREAVX2) += \
++ $(call cc-option,-march=core-avx2,$(call cc-option,-mtune=core-avx2))
+ cflags-$(CONFIG_MATOM) += $(call cc-option,-march=atom) \
+ $(call cc-option,-mtune=atom,$(call cc-option,-mtune=generic))
+ cflags-$(CONFIG_GENERIC_CPU) += $(call cc-option,-mtune=generic)
+diff -uprN a/arch/x86/Makefile_32.cpu b/arch/x86/Makefile_32.cpu
+--- a/arch/x86/Makefile_32.cpu 2013-11-03 18:41:51.000000000 -0500
++++ b/arch/x86/Makefile_32.cpu 2013-12-15 06:21:24.354455723 -0500
+@@ -23,7 +23,14 @@ cflags-$(CONFIG_MK6) += -march=k6
+ # Please note, that patches that add -march=athlon-xp and friends are pointless.
+ # They make zero difference whatsosever to performance at this time.
+ cflags-$(CONFIG_MK7) += -march=athlon
++cflags-$(CONFIG_MNATIVE) += $(call cc-option,-march=native)
+ cflags-$(CONFIG_MK8) += $(call cc-option,-march=k8,-march=athlon)
++cflags-$(CONFIG_MK10) += $(call cc-option,-march=amdfam10,-march=athlon)
++cflags-$(CONFIG_MBARCELONA) += $(call cc-option,-march=barcelona,-march=athlon)
++cflags-$(CONFIG_MBOBCAT) += $(call cc-option,-march=btver1,-march=athlon)
++cflags-$(CONFIG_MBULLDOZER) += $(call cc-option,-march=bdver1,-march=athlon)
++cflags-$(CONFIG_MPILEDRIVER) += $(call cc-option,-march=bdver2,-march=athlon)
++cflags-$(CONFIG_MJAGUAR) += $(call cc-option,-march=btver2,-march=athlon)
+ cflags-$(CONFIG_MCRUSOE) += -march=i686 $(align)-functions=0 $(align)-jumps=0 $(align)-loops=0
+ cflags-$(CONFIG_MEFFICEON) += -march=i686 $(call tune,pentium3) $(align)-functions=0 $(align)-jumps=0 $(align)-loops=0
+ cflags-$(CONFIG_MWINCHIPC6) += $(call cc-option,-march=winchip-c6,-march=i586)
+@@ -32,6 +39,10 @@ cflags-$(CONFIG_MCYRIXIII) += $(call cc-
+ cflags-$(CONFIG_MVIAC3_2) += $(call cc-option,-march=c3-2,-march=i686)
+ cflags-$(CONFIG_MVIAC7) += -march=i686
+ cflags-$(CONFIG_MCORE2) += -march=i686 $(call tune,core2)
++cflags-$(CONFIG_MCOREI7) += -march=i686 $(call tune,corei7)
++cflags-$(CONFIG_MCOREI7AVX) += -march=i686 $(call tune,corei7-avx)
++cflags-$(CONFIG_MCOREAVXI) += -march=i686 $(call tune,core-avx-i)
++cflags-$(CONFIG_MCOREAVX2) += -march=i686 $(call tune,core-avx2)
+ cflags-$(CONFIG_MATOM) += $(call cc-option,-march=atom,$(call cc-option,-march=core2,-march=i686)) \
+ $(call cc-option,-mtune=atom,$(call cc-option,-mtune=generic))
^ permalink raw reply related [flat|nested] 67+ messages in thread
* [gentoo-commits] proj/linux-patches:3.18 commit in: /
@ 2014-12-09 20:49 Mike Pagano
0 siblings, 0 replies; 67+ messages in thread
From: Mike Pagano @ 2014-12-09 20:49 UTC (permalink / raw
To: gentoo-commits
commit: 855b5fe071e6037f06ebfa0a1ac132b0877e0354
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Tue Dec 9 20:49:18 2014 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Tue Dec 9 20:49:18 2014 +0000
URL: http://sources.gentoo.org/gitweb/?p=proj/linux-patches.git;a=commit;h=855b5fe0
Added BFQ patchset
---
0000_README | 12 +
...oups-kconfig-build-bits-for-BFQ-v7r6-3.18.patch | 104 +
...ntroduce-the-BFQ-v7r6-I-O-sched-for-3.18.patch1 | 6936 ++++++++++++++++++++
...ly-Queue-Merge-EQM-to-BFQ-v7r6-for-3.18.0.patch | 1214 ++++
4 files changed, 8266 insertions(+)
diff --git a/0000_README b/0000_README
index 7a25c41..bde1067 100644
--- a/0000_README
+++ b/0000_README
@@ -70,3 +70,15 @@ Desc: Add Gentoo Linux support config settings and defaults.
Patch: 5000_enable-additional-cpu-optimizations-for-gcc.patch
From: https://github.com/graysky2/kernel_gcc_patch/
Desc: Kernel patch enables gcc optimizations for additional CPUs.
+
+Patch: 5001_block-cgroups-kconfig-build-bits-for-BFQ-v7r6-3.18.patch
+From: http://algo.ing.unimo.it/people/paolo/disk_sched/
+Desc: BFQ v7r6 patch 1 for 3.17: Build, cgroups and kconfig bits
+
+Patch: 5002_block-introduce-the-BFQ-v7r6-I-O-sched-for-3.18.patch1
+From: http://algo.ing.unimo.it/people/paolo/disk_sched/
+Desc: BFQ v7r6 patch 2 for 3.17: BFQ Scheduler
+
+Patch: 5003_block-bfq-add-Early-Queue-Merge-EQM-to-BFQ-v7r6-for-3.18.0.patch
+From: http://algo.ing.unimo.it/people/paolo/disk_sched/
+Desc: BFQ v7r6 patch 3 for 3.17: Early Queue Merge (EQM)
diff --git a/5001_block-cgroups-kconfig-build-bits-for-BFQ-v7r6-3.18.patch b/5001_block-cgroups-kconfig-build-bits-for-BFQ-v7r6-3.18.patch
new file mode 100644
index 0000000..617e934
--- /dev/null
+++ b/5001_block-cgroups-kconfig-build-bits-for-BFQ-v7r6-3.18.patch
@@ -0,0 +1,104 @@
+From 419f79b0ff5a322c1d0d88a687a207f948c6b2ee Mon Sep 17 00:00:00 2001
+From: Paolo Valente <paolo.valente@unimore.it>
+Date: Mon, 8 Dec 2014 16:04:25 +0100
+Subject: [PATCH 1/3] block: cgroups, kconfig, build bits for BFQ-v7r6-3.18
+
+Update Kconfig.iosched and do the related Makefile changes to include
+kernel configuration options for BFQ. Also add the bfqio controller
+to the cgroups subsystem.
+
+Signed-off-by: Paolo Valente <paolo.valente@unimore.it>
+Signed-off-by: Arianna Avanzini <avanzini.arianna@gmail.com>
+---
+ block/Kconfig.iosched | 32 ++++++++++++++++++++++++++++++++
+ block/Makefile | 1 +
+ include/linux/cgroup_subsys.h | 4 ++++
+ 3 files changed, 37 insertions(+)
+
+diff --git a/block/Kconfig.iosched b/block/Kconfig.iosched
+index 421bef9..0ee5f0f 100644
+--- a/block/Kconfig.iosched
++++ b/block/Kconfig.iosched
+@@ -39,6 +39,27 @@ config CFQ_GROUP_IOSCHED
+ ---help---
+ Enable group IO scheduling in CFQ.
+
++config IOSCHED_BFQ
++ tristate "BFQ I/O scheduler"
++ default n
++ ---help---
++ The BFQ I/O scheduler tries to distribute bandwidth among
++ all processes according to their weights.
++ It aims at distributing the bandwidth as desired, independently of
++ the disk parameters and with any workload. It also tries to
++ guarantee low latency to interactive and soft real-time
++ applications. If compiled built-in (saying Y here), BFQ can
++ be configured to support hierarchical scheduling.
++
++config CGROUP_BFQIO
++ bool "BFQ hierarchical scheduling support"
++ depends on CGROUPS && IOSCHED_BFQ=y
++ default n
++ ---help---
++ Enable hierarchical scheduling in BFQ, using the cgroups
++ filesystem interface. The name of the subsystem will be
++ bfqio.
++
+ choice
+ prompt "Default I/O scheduler"
+ default DEFAULT_CFQ
+@@ -52,6 +73,16 @@ choice
+ config DEFAULT_CFQ
+ bool "CFQ" if IOSCHED_CFQ=y
+
++ config DEFAULT_BFQ
++ bool "BFQ" if IOSCHED_BFQ=y
++ help
++ Selects BFQ as the default I/O scheduler which will be
++ used by default for all block devices.
++ The BFQ I/O scheduler aims at distributing the bandwidth
++ as desired, independently of the disk parameters and with
++ any workload. It also tries to guarantee low latency to
++ interactive and soft real-time applications.
++
+ config DEFAULT_NOOP
+ bool "No-op"
+
+@@ -61,6 +92,7 @@ config DEFAULT_IOSCHED
+ string
+ default "deadline" if DEFAULT_DEADLINE
+ default "cfq" if DEFAULT_CFQ
++ default "bfq" if DEFAULT_BFQ
+ default "noop" if DEFAULT_NOOP
+
+ endmenu
+diff --git a/block/Makefile b/block/Makefile
+index 00ecc97..1ed86d5 100644
+--- a/block/Makefile
++++ b/block/Makefile
+@@ -18,6 +18,7 @@ obj-$(CONFIG_BLK_DEV_THROTTLING) += blk-throttle.o
+ obj-$(CONFIG_IOSCHED_NOOP) += noop-iosched.o
+ obj-$(CONFIG_IOSCHED_DEADLINE) += deadline-iosched.o
+ obj-$(CONFIG_IOSCHED_CFQ) += cfq-iosched.o
++obj-$(CONFIG_IOSCHED_BFQ) += bfq-iosched.o
+
+ obj-$(CONFIG_BLOCK_COMPAT) += compat_ioctl.o
+ obj-$(CONFIG_BLK_CMDLINE_PARSER) += cmdline-parser.o
+diff --git a/include/linux/cgroup_subsys.h b/include/linux/cgroup_subsys.h
+index 98c4f9b..13b010d 100644
+--- a/include/linux/cgroup_subsys.h
++++ b/include/linux/cgroup_subsys.h
+@@ -35,6 +35,10 @@ SUBSYS(net_cls)
+ SUBSYS(blkio)
+ #endif
+
++#if IS_ENABLED(CONFIG_CGROUP_BFQIO)
++SUBSYS(bfqio)
++#endif
++
+ #if IS_ENABLED(CONFIG_CGROUP_PERF)
+ SUBSYS(perf_event)
+ #endif
+--
+2.1.3
+
diff --git a/5002_block-introduce-the-BFQ-v7r6-I-O-sched-for-3.18.patch1 b/5002_block-introduce-the-BFQ-v7r6-I-O-sched-for-3.18.patch1
new file mode 100644
index 0000000..981e93f
--- /dev/null
+++ b/5002_block-introduce-the-BFQ-v7r6-I-O-sched-for-3.18.patch1
@@ -0,0 +1,6936 @@
+From 37542f69f6f11019b792c0b60ddc468edd0d5487 Mon Sep 17 00:00:00 2001
+From: Paolo Valente <paolo.valente@unimore.it>
+Date: Thu, 9 May 2013 19:10:02 +0200
+Subject: [PATCH 2/3] block: introduce the BFQ-v7r6 I/O sched for 3.18
+
+Add the BFQ-v7r6 I/O scheduler to 3.18.
+The general structure is borrowed from CFQ, as much of the code for
+handling I/O contexts. Over time, several useful features have been
+ported from CFQ as well (details in the changelog in README.BFQ). A
+(bfq_)queue is associated to each task doing I/O on a device, and each
+time a scheduling decision has to be made a queue is selected and served
+until it expires.
+
+ - Slices are given in the service domain: tasks are assigned
+ budgets, measured in number of sectors. Once got the disk, a task
+ must however consume its assigned budget within a configurable
+ maximum time (by default, the maximum possible value of the
+ budgets is automatically computed to comply with this timeout).
+ This allows the desired latency vs "throughput boosting" tradeoff
+ to be set.
+
+ - Budgets are scheduled according to a variant of WF2Q+, implemented
+ using an augmented rb-tree to take eligibility into account while
+ preserving an O(log N) overall complexity.
+
+ - A low-latency tunable is provided; if enabled, both interactive
+ and soft real-time applications are guaranteed a very low latency.
+
+ - Latency guarantees are preserved also in the presence of NCQ.
+
+ - Also with flash-based devices, a high throughput is achieved
+ while still preserving latency guarantees.
+
+ - BFQ features Early Queue Merge (EQM), a sort of fusion of the
+ cooperating-queue-merging and the preemption mechanisms present
+ in CFQ. EQM is in fact a unified mechanism that tries to get a
+ sequential read pattern, and hence a high throughput, with any
+ set of processes performing interleaved I/O over a contiguous
+ sequence of sectors.
+
+ - BFQ supports full hierarchical scheduling, exporting a cgroups
+ interface. Since each node has a full scheduler, each group can
+ be assigned its own weight.
+
+ - If the cgroups interface is not used, only I/O priorities can be
+ assigned to processes, with ioprio values mapped to weights
+ with the relation weight = IOPRIO_BE_NR - ioprio.
+
+ - ioprio classes are served in strict priority order, i.e., lower
+ priority queues are not served as long as there are higher
+ priority queues. Among queues in the same class the bandwidth is
+ distributed in proportion to the weight of each queue. A very
+ thin extra bandwidth is however guaranteed to the Idle class, to
+ prevent it from starving.
+
+Signed-off-by: Paolo Valente <paolo.valente@unimore.it>
+Signed-off-by: Arianna Avanzini <avanzini.arianna@gmail.com>
+---
+ block/bfq-cgroup.c | 930 ++++++++++++
+ block/bfq-ioc.c | 36 +
+ block/bfq-iosched.c | 3887 +++++++++++++++++++++++++++++++++++++++++++++++++++
+ block/bfq-sched.c | 1207 ++++++++++++++++
+ block/bfq.h | 773 ++++++++++
+ 5 files changed, 6833 insertions(+)
+ create mode 100644 block/bfq-cgroup.c
+ create mode 100644 block/bfq-ioc.c
+ create mode 100644 block/bfq-iosched.c
+ create mode 100644 block/bfq-sched.c
+ create mode 100644 block/bfq.h
+
+diff --git a/block/bfq-cgroup.c b/block/bfq-cgroup.c
+new file mode 100644
+index 0000000..eb140eb
+--- /dev/null
++++ b/block/bfq-cgroup.c
+@@ -0,0 +1,930 @@
++/*
++ * BFQ: CGROUPS support.
++ *
++ * Based on ideas and code from CFQ:
++ * Copyright (C) 2003 Jens Axboe <axboe@kernel.dk>
++ *
++ * Copyright (C) 2008 Fabio Checconi <fabio@gandalf.sssup.it>
++ * Paolo Valente <paolo.valente@unimore.it>
++ *
++ * Copyright (C) 2010 Paolo Valente <paolo.valente@unimore.it>
++ *
++ * Licensed under the GPL-2 as detailed in the accompanying COPYING.BFQ
++ * file.
++ */
++
++#ifdef CONFIG_CGROUP_BFQIO
++
++static DEFINE_MUTEX(bfqio_mutex);
++
++static bool bfqio_is_removed(struct bfqio_cgroup *bgrp)
++{
++ return bgrp ? !bgrp->online : false;
++}
++
++static struct bfqio_cgroup bfqio_root_cgroup = {
++ .weight = BFQ_DEFAULT_GRP_WEIGHT,
++ .ioprio = BFQ_DEFAULT_GRP_IOPRIO,
++ .ioprio_class = BFQ_DEFAULT_GRP_CLASS,
++};
++
++static inline void bfq_init_entity(struct bfq_entity *entity,
++ struct bfq_group *bfqg)
++{
++ entity->weight = entity->new_weight;
++ entity->orig_weight = entity->new_weight;
++ entity->ioprio = entity->new_ioprio;
++ entity->ioprio_class = entity->new_ioprio_class;
++ entity->parent = bfqg->my_entity;
++ entity->sched_data = &bfqg->sched_data;
++}
++
++static struct bfqio_cgroup *css_to_bfqio(struct cgroup_subsys_state *css)
++{
++ return css ? container_of(css, struct bfqio_cgroup, css) : NULL;
++}
++
++/*
++ * Search the bfq_group for bfqd into the hash table (by now only a list)
++ * of bgrp. Must be called under rcu_read_lock().
++ */
++static struct bfq_group *bfqio_lookup_group(struct bfqio_cgroup *bgrp,
++ struct bfq_data *bfqd)
++{
++ struct bfq_group *bfqg;
++ void *key;
++
++ hlist_for_each_entry_rcu(bfqg, &bgrp->group_data, group_node) {
++ key = rcu_dereference(bfqg->bfqd);
++ if (key == bfqd)
++ return bfqg;
++ }
++
++ return NULL;
++}
++
++static inline void bfq_group_init_entity(struct bfqio_cgroup *bgrp,
++ struct bfq_group *bfqg)
++{
++ struct bfq_entity *entity = &bfqg->entity;
++
++ /*
++ * If the weight of the entity has never been set via the sysfs
++ * interface, then bgrp->weight == 0. In this case we initialize
++ * the weight from the current ioprio value. Otherwise, the group
++ * weight, if set, has priority over the ioprio value.
++ */
++ if (bgrp->weight == 0) {
++ entity->new_weight = bfq_ioprio_to_weight(bgrp->ioprio);
++ entity->new_ioprio = bgrp->ioprio;
++ } else {
++ entity->new_weight = bgrp->weight;
++ entity->new_ioprio = bfq_weight_to_ioprio(bgrp->weight);
++ }
++ entity->orig_weight = entity->weight = entity->new_weight;
++ entity->ioprio = entity->new_ioprio;
++ entity->ioprio_class = entity->new_ioprio_class = bgrp->ioprio_class;
++ entity->my_sched_data = &bfqg->sched_data;
++ bfqg->active_entities = 0;
++}
++
++static inline void bfq_group_set_parent(struct bfq_group *bfqg,
++ struct bfq_group *parent)
++{
++ struct bfq_entity *entity;
++
++ BUG_ON(parent == NULL);
++ BUG_ON(bfqg == NULL);
++
++ entity = &bfqg->entity;
++ entity->parent = parent->my_entity;
++ entity->sched_data = &parent->sched_data;
++}
++
++/**
++ * bfq_group_chain_alloc - allocate a chain of groups.
++ * @bfqd: queue descriptor.
++ * @css: the leaf cgroup_subsys_state this chain starts from.
++ *
++ * Allocate a chain of groups starting from the one belonging to
++ * @cgroup up to the root cgroup. Stop if a cgroup on the chain
++ * to the root has already an allocated group on @bfqd.
++ */
++static struct bfq_group *bfq_group_chain_alloc(struct bfq_data *bfqd,
++ struct cgroup_subsys_state *css)
++{
++ struct bfqio_cgroup *bgrp;
++ struct bfq_group *bfqg, *prev = NULL, *leaf = NULL;
++
++ for (; css != NULL; css = css->parent) {
++ bgrp = css_to_bfqio(css);
++
++ bfqg = bfqio_lookup_group(bgrp, bfqd);
++ if (bfqg != NULL) {
++ /*
++ * All the cgroups in the path from there to the
++ * root must have a bfq_group for bfqd, so we don't
++ * need any more allocations.
++ */
++ break;
++ }
++
++ bfqg = kzalloc(sizeof(*bfqg), GFP_ATOMIC);
++ if (bfqg == NULL)
++ goto cleanup;
++
++ bfq_group_init_entity(bgrp, bfqg);
++ bfqg->my_entity = &bfqg->entity;
++
++ if (leaf == NULL) {
++ leaf = bfqg;
++ prev = leaf;
++ } else {
++ bfq_group_set_parent(prev, bfqg);
++ /*
++ * Build a list of allocated nodes using the bfqd
++ * filed, that is still unused and will be
++ * initialized only after the node will be
++ * connected.
++ */
++ prev->bfqd = bfqg;
++ prev = bfqg;
++ }
++ }
++
++ return leaf;
++
++cleanup:
++ while (leaf != NULL) {
++ prev = leaf;
++ leaf = leaf->bfqd;
++ kfree(prev);
++ }
++
++ return NULL;
++}
++
++/**
++ * bfq_group_chain_link - link an allocated group chain to a cgroup
++ * hierarchy.
++ * @bfqd: the queue descriptor.
++ * @css: the leaf cgroup_subsys_state to start from.
++ * @leaf: the leaf group (to be associated to @cgroup).
++ *
++ * Try to link a chain of groups to a cgroup hierarchy, connecting the
++ * nodes bottom-up, so we can be sure that when we find a cgroup in the
++ * hierarchy that already as a group associated to @bfqd all the nodes
++ * in the path to the root cgroup have one too.
++ *
++ * On locking: the queue lock protects the hierarchy (there is a hierarchy
++ * per device) while the bfqio_cgroup lock protects the list of groups
++ * belonging to the same cgroup.
++ */
++static void bfq_group_chain_link(struct bfq_data *bfqd,
++ struct cgroup_subsys_state *css,
++ struct bfq_group *leaf)
++{
++ struct bfqio_cgroup *bgrp;
++ struct bfq_group *bfqg, *next, *prev = NULL;
++ unsigned long flags;
++
++ assert_spin_locked(bfqd->queue->queue_lock);
++
++ for (; css != NULL && leaf != NULL; css = css->parent) {
++ bgrp = css_to_bfqio(css);
++ next = leaf->bfqd;
++
++ bfqg = bfqio_lookup_group(bgrp, bfqd);
++ BUG_ON(bfqg != NULL);
++
++ spin_lock_irqsave(&bgrp->lock, flags);
++
++ rcu_assign_pointer(leaf->bfqd, bfqd);
++ hlist_add_head_rcu(&leaf->group_node, &bgrp->group_data);
++ hlist_add_head(&leaf->bfqd_node, &bfqd->group_list);
++
++ spin_unlock_irqrestore(&bgrp->lock, flags);
++
++ prev = leaf;
++ leaf = next;
++ }
++
++ BUG_ON(css == NULL && leaf != NULL);
++ if (css != NULL && prev != NULL) {
++ bgrp = css_to_bfqio(css);
++ bfqg = bfqio_lookup_group(bgrp, bfqd);
++ bfq_group_set_parent(prev, bfqg);
++ }
++}
++
++/**
++ * bfq_find_alloc_group - return the group associated to @bfqd in @cgroup.
++ * @bfqd: queue descriptor.
++ * @cgroup: cgroup being searched for.
++ *
++ * Return a group associated to @bfqd in @cgroup, allocating one if
++ * necessary. When a group is returned all the cgroups in the path
++ * to the root have a group associated to @bfqd.
++ *
++ * If the allocation fails, return the root group: this breaks guarantees
++ * but is a safe fallback. If this loss becomes a problem it can be
++ * mitigated using the equivalent weight (given by the product of the
++ * weights of the groups in the path from @group to the root) in the
++ * root scheduler.
++ *
++ * We allocate all the missing nodes in the path from the leaf cgroup
++ * to the root and we connect the nodes only after all the allocations
++ * have been successful.
++ */
++static struct bfq_group *bfq_find_alloc_group(struct bfq_data *bfqd,
++ struct cgroup_subsys_state *css)
++{
++ struct bfqio_cgroup *bgrp = css_to_bfqio(css);
++ struct bfq_group *bfqg;
++
++ bfqg = bfqio_lookup_group(bgrp, bfqd);
++ if (bfqg != NULL)
++ return bfqg;
++
++ bfqg = bfq_group_chain_alloc(bfqd, css);
++ if (bfqg != NULL)
++ bfq_group_chain_link(bfqd, css, bfqg);
++ else
++ bfqg = bfqd->root_group;
++
++ return bfqg;
++}
++
++/**
++ * bfq_bfqq_move - migrate @bfqq to @bfqg.
++ * @bfqd: queue descriptor.
++ * @bfqq: the queue to move.
++ * @entity: @bfqq's entity.
++ * @bfqg: the group to move to.
++ *
++ * Move @bfqq to @bfqg, deactivating it from its old group and reactivating
++ * it on the new one. Avoid putting the entity on the old group idle tree.
++ *
++ * Must be called under the queue lock; the cgroup owning @bfqg must
++ * not disappear (by now this just means that we are called under
++ * rcu_read_lock()).
++ */
++static void bfq_bfqq_move(struct bfq_data *bfqd, struct bfq_queue *bfqq,
++ struct bfq_entity *entity, struct bfq_group *bfqg)
++{
++ int busy, resume;
++
++ busy = bfq_bfqq_busy(bfqq);
++ resume = !RB_EMPTY_ROOT(&bfqq->sort_list);
++
++ BUG_ON(resume && !entity->on_st);
++ BUG_ON(busy && !resume && entity->on_st &&
++ bfqq != bfqd->in_service_queue);
++
++ if (busy) {
++ BUG_ON(atomic_read(&bfqq->ref) < 2);
++
++ if (!resume)
++ bfq_del_bfqq_busy(bfqd, bfqq, 0);
++ else
++ bfq_deactivate_bfqq(bfqd, bfqq, 0);
++ } else if (entity->on_st)
++ bfq_put_idle_entity(bfq_entity_service_tree(entity), entity);
++
++ /*
++ * Here we use a reference to bfqg. We don't need a refcounter
++ * as the cgroup reference will not be dropped, so that its
++ * destroy() callback will not be invoked.
++ */
++ entity->parent = bfqg->my_entity;
++ entity->sched_data = &bfqg->sched_data;
++
++ if (busy && resume)
++ bfq_activate_bfqq(bfqd, bfqq);
++
++ if (bfqd->in_service_queue == NULL && !bfqd->rq_in_driver)
++ bfq_schedule_dispatch(bfqd);
++}
++
++/**
++ * __bfq_bic_change_cgroup - move @bic to @cgroup.
++ * @bfqd: the queue descriptor.
++ * @bic: the bic to move.
++ * @cgroup: the cgroup to move to.
++ *
++ * Move bic to cgroup, assuming that bfqd->queue is locked; the caller
++ * has to make sure that the reference to cgroup is valid across the call.
++ *
++ * NOTE: an alternative approach might have been to store the current
++ * cgroup in bfqq and getting a reference to it, reducing the lookup
++ * time here, at the price of slightly more complex code.
++ */
++static struct bfq_group *__bfq_bic_change_cgroup(struct bfq_data *bfqd,
++ struct bfq_io_cq *bic,
++ struct cgroup_subsys_state *css)
++{
++ struct bfq_queue *async_bfqq = bic_to_bfqq(bic, 0);
++ struct bfq_queue *sync_bfqq = bic_to_bfqq(bic, 1);
++ struct bfq_entity *entity;
++ struct bfq_group *bfqg;
++ struct bfqio_cgroup *bgrp;
++
++ bgrp = css_to_bfqio(css);
++
++ bfqg = bfq_find_alloc_group(bfqd, css);
++ if (async_bfqq != NULL) {
++ entity = &async_bfqq->entity;
++
++ if (entity->sched_data != &bfqg->sched_data) {
++ bic_set_bfqq(bic, NULL, 0);
++ bfq_log_bfqq(bfqd, async_bfqq,
++ "bic_change_group: %p %d",
++ async_bfqq, atomic_read(&async_bfqq->ref));
++ bfq_put_queue(async_bfqq);
++ }
++ }
++
++ if (sync_bfqq != NULL) {
++ entity = &sync_bfqq->entity;
++ if (entity->sched_data != &bfqg->sched_data)
++ bfq_bfqq_move(bfqd, sync_bfqq, entity, bfqg);
++ }
++
++ return bfqg;
++}
++
++/**
++ * bfq_bic_change_cgroup - move @bic to @cgroup.
++ * @bic: the bic being migrated.
++ * @cgroup: the destination cgroup.
++ *
++ * When the task owning @bic is moved to @cgroup, @bic is immediately
++ * moved into its new parent group.
++ */
++static void bfq_bic_change_cgroup(struct bfq_io_cq *bic,
++ struct cgroup_subsys_state *css)
++{
++ struct bfq_data *bfqd;
++ unsigned long uninitialized_var(flags);
++
++ bfqd = bfq_get_bfqd_locked(&(bic->icq.q->elevator->elevator_data),
++ &flags);
++ if (bfqd != NULL) {
++ __bfq_bic_change_cgroup(bfqd, bic, css);
++ bfq_put_bfqd_unlock(bfqd, &flags);
++ }
++}
++
++/**
++ * bfq_bic_update_cgroup - update the cgroup of @bic.
++ * @bic: the @bic to update.
++ *
++ * Make sure that @bic is enqueued in the cgroup of the current task.
++ * We need this in addition to moving bics during the cgroup attach
++ * phase because the task owning @bic could be at its first disk
++ * access or we may end up in the root cgroup as the result of a
++ * memory allocation failure and here we try to move to the right
++ * group.
++ *
++ * Must be called under the queue lock. It is safe to use the returned
++ * value even after the rcu_read_unlock() as the migration/destruction
++ * paths act under the queue lock too. IOW it is impossible to race with
++ * group migration/destruction and end up with an invalid group as:
++ * a) here cgroup has not yet been destroyed, nor its destroy callback
++ * has started execution, as current holds a reference to it,
++ * b) if it is destroyed after rcu_read_unlock() [after current is
++ * migrated to a different cgroup] its attach() callback will have
++ * taken care of remove all the references to the old cgroup data.
++ */
++static struct bfq_group *bfq_bic_update_cgroup(struct bfq_io_cq *bic)
++{
++ struct bfq_data *bfqd = bic_to_bfqd(bic);
++ struct bfq_group *bfqg;
++ struct cgroup_subsys_state *css;
++
++ BUG_ON(bfqd == NULL);
++
++ rcu_read_lock();
++ css = task_css(current, bfqio_cgrp_id);
++ bfqg = __bfq_bic_change_cgroup(bfqd, bic, css);
++ rcu_read_unlock();
++
++ return bfqg;
++}
++
++/**
++ * bfq_flush_idle_tree - deactivate any entity on the idle tree of @st.
++ * @st: the service tree being flushed.
++ */
++static inline void bfq_flush_idle_tree(struct bfq_service_tree *st)
++{
++ struct bfq_entity *entity = st->first_idle;
++
++ for (; entity != NULL; entity = st->first_idle)
++ __bfq_deactivate_entity(entity, 0);
++}
++
++/**
++ * bfq_reparent_leaf_entity - move leaf entity to the root_group.
++ * @bfqd: the device data structure with the root group.
++ * @entity: the entity to move.
++ */
++static inline void bfq_reparent_leaf_entity(struct bfq_data *bfqd,
++ struct bfq_entity *entity)
++{
++ struct bfq_queue *bfqq = bfq_entity_to_bfqq(entity);
++
++ BUG_ON(bfqq == NULL);
++ bfq_bfqq_move(bfqd, bfqq, entity, bfqd->root_group);
++ return;
++}
++
++/**
++ * bfq_reparent_active_entities - move to the root group all active
++ * entities.
++ * @bfqd: the device data structure with the root group.
++ * @bfqg: the group to move from.
++ * @st: the service tree with the entities.
++ *
++ * Needs queue_lock to be taken and reference to be valid over the call.
++ */
++static inline void bfq_reparent_active_entities(struct bfq_data *bfqd,
++ struct bfq_group *bfqg,
++ struct bfq_service_tree *st)
++{
++ struct rb_root *active = &st->active;
++ struct bfq_entity *entity = NULL;
++
++ if (!RB_EMPTY_ROOT(&st->active))
++ entity = bfq_entity_of(rb_first(active));
++
++ for (; entity != NULL; entity = bfq_entity_of(rb_first(active)))
++ bfq_reparent_leaf_entity(bfqd, entity);
++
++ if (bfqg->sched_data.in_service_entity != NULL)
++ bfq_reparent_leaf_entity(bfqd,
++ bfqg->sched_data.in_service_entity);
++
++ return;
++}
++
++/**
++ * bfq_destroy_group - destroy @bfqg.
++ * @bgrp: the bfqio_cgroup containing @bfqg.
++ * @bfqg: the group being destroyed.
++ *
++ * Destroy @bfqg, making sure that it is not referenced from its parent.
++ */
++static void bfq_destroy_group(struct bfqio_cgroup *bgrp, struct bfq_group *bfqg)
++{
++ struct bfq_data *bfqd;
++ struct bfq_service_tree *st;
++ struct bfq_entity *entity = bfqg->my_entity;
++ unsigned long uninitialized_var(flags);
++ int i;
++
++ hlist_del(&bfqg->group_node);
++
++ /*
++ * Empty all service_trees belonging to this group before
++ * deactivating the group itself.
++ */
++ for (i = 0; i < BFQ_IOPRIO_CLASSES; i++) {
++ st = bfqg->sched_data.service_tree + i;
++
++ /*
++ * The idle tree may still contain bfq_queues belonging
++ * to exited task because they never migrated to a different
++ * cgroup from the one being destroyed now. No one else
++ * can access them so it's safe to act without any lock.
++ */
++ bfq_flush_idle_tree(st);
++
++ /*
++ * It may happen that some queues are still active
++ * (busy) upon group destruction (if the corresponding
++ * processes have been forced to terminate). We move
++ * all the leaf entities corresponding to these queues
++ * to the root_group.
++ * Also, it may happen that the group has an entity
++ * in service, which is disconnected from the active
++ * tree: it must be moved, too.
++ * There is no need to put the sync queues, as the
++ * scheduler has taken no reference.
++ */
++ bfqd = bfq_get_bfqd_locked(&bfqg->bfqd, &flags);
++ if (bfqd != NULL) {
++ bfq_reparent_active_entities(bfqd, bfqg, st);
++ bfq_put_bfqd_unlock(bfqd, &flags);
++ }
++ BUG_ON(!RB_EMPTY_ROOT(&st->active));
++ BUG_ON(!RB_EMPTY_ROOT(&st->idle));
++ }
++ BUG_ON(bfqg->sched_data.next_in_service != NULL);
++ BUG_ON(bfqg->sched_data.in_service_entity != NULL);
++
++ /*
++ * We may race with device destruction, take extra care when
++ * dereferencing bfqg->bfqd.
++ */
++ bfqd = bfq_get_bfqd_locked(&bfqg->bfqd, &flags);
++ if (bfqd != NULL) {
++ hlist_del(&bfqg->bfqd_node);
++ __bfq_deactivate_entity(entity, 0);
++ bfq_put_async_queues(bfqd, bfqg);
++ bfq_put_bfqd_unlock(bfqd, &flags);
++ }
++ BUG_ON(entity->tree != NULL);
++
++ /*
++ * No need to defer the kfree() to the end of the RCU grace
++ * period: we are called from the destroy() callback of our
++ * cgroup, so we can be sure that no one is a) still using
++ * this cgroup or b) doing lookups in it.
++ */
++ kfree(bfqg);
++}
++
++static void bfq_end_wr_async(struct bfq_data *bfqd)
++{
++ struct hlist_node *tmp;
++ struct bfq_group *bfqg;
++
++ hlist_for_each_entry_safe(bfqg, tmp, &bfqd->group_list, bfqd_node)
++ bfq_end_wr_async_queues(bfqd, bfqg);
++ bfq_end_wr_async_queues(bfqd, bfqd->root_group);
++}
++
++/**
++ * bfq_disconnect_groups - disconnect @bfqd from all its groups.
++ * @bfqd: the device descriptor being exited.
++ *
++ * When the device exits we just make sure that no lookup can return
++ * the now unused group structures. They will be deallocated on cgroup
++ * destruction.
++ */
++static void bfq_disconnect_groups(struct bfq_data *bfqd)
++{
++ struct hlist_node *tmp;
++ struct bfq_group *bfqg;
++
++ bfq_log(bfqd, "disconnect_groups beginning");
++ hlist_for_each_entry_safe(bfqg, tmp, &bfqd->group_list, bfqd_node) {
++ hlist_del(&bfqg->bfqd_node);
++
++ __bfq_deactivate_entity(bfqg->my_entity, 0);
++
++ /*
++ * Don't remove from the group hash, just set an
++ * invalid key. No lookups can race with the
++ * assignment as bfqd is being destroyed; this
++ * implies also that new elements cannot be added
++ * to the list.
++ */
++ rcu_assign_pointer(bfqg->bfqd, NULL);
++
++ bfq_log(bfqd, "disconnect_groups: put async for group %p",
++ bfqg);
++ bfq_put_async_queues(bfqd, bfqg);
++ }
++}
++
++static inline void bfq_free_root_group(struct bfq_data *bfqd)
++{
++ struct bfqio_cgroup *bgrp = &bfqio_root_cgroup;
++ struct bfq_group *bfqg = bfqd->root_group;
++
++ bfq_put_async_queues(bfqd, bfqg);
++
++ spin_lock_irq(&bgrp->lock);
++ hlist_del_rcu(&bfqg->group_node);
++ spin_unlock_irq(&bgrp->lock);
++
++ /*
++ * No need to synchronize_rcu() here: since the device is gone
++ * there cannot be any read-side access to its root_group.
++ */
++ kfree(bfqg);
++}
++
++static struct bfq_group *bfq_alloc_root_group(struct bfq_data *bfqd, int node)
++{
++ struct bfq_group *bfqg;
++ struct bfqio_cgroup *bgrp;
++ int i;
++
++ bfqg = kzalloc_node(sizeof(*bfqg), GFP_KERNEL, node);
++ if (bfqg == NULL)
++ return NULL;
++
++ bfqg->entity.parent = NULL;
++ for (i = 0; i < BFQ_IOPRIO_CLASSES; i++)
++ bfqg->sched_data.service_tree[i] = BFQ_SERVICE_TREE_INIT;
++
++ bgrp = &bfqio_root_cgroup;
++ spin_lock_irq(&bgrp->lock);
++ rcu_assign_pointer(bfqg->bfqd, bfqd);
++ hlist_add_head_rcu(&bfqg->group_node, &bgrp->group_data);
++ spin_unlock_irq(&bgrp->lock);
++
++ return bfqg;
++}
++
++#define SHOW_FUNCTION(__VAR) \
++static u64 bfqio_cgroup_##__VAR##_read(struct cgroup_subsys_state *css, \
++ struct cftype *cftype) \
++{ \
++ struct bfqio_cgroup *bgrp = css_to_bfqio(css); \
++ u64 ret = -ENODEV; \
++ \
++ mutex_lock(&bfqio_mutex); \
++ if (bfqio_is_removed(bgrp)) \
++ goto out_unlock; \
++ \
++ spin_lock_irq(&bgrp->lock); \
++ ret = bgrp->__VAR; \
++ spin_unlock_irq(&bgrp->lock); \
++ \
++out_unlock: \
++ mutex_unlock(&bfqio_mutex); \
++ return ret; \
++}
++
++SHOW_FUNCTION(weight);
++SHOW_FUNCTION(ioprio);
++SHOW_FUNCTION(ioprio_class);
++#undef SHOW_FUNCTION
++
++#define STORE_FUNCTION(__VAR, __MIN, __MAX) \
++static int bfqio_cgroup_##__VAR##_write(struct cgroup_subsys_state *css,\
++ struct cftype *cftype, \
++ u64 val) \
++{ \
++ struct bfqio_cgroup *bgrp = css_to_bfqio(css); \
++ struct bfq_group *bfqg; \
++ int ret = -EINVAL; \
++ \
++ if (val < (__MIN) || val > (__MAX)) \
++ return ret; \
++ \
++ ret = -ENODEV; \
++ mutex_lock(&bfqio_mutex); \
++ if (bfqio_is_removed(bgrp)) \
++ goto out_unlock; \
++ ret = 0; \
++ \
++ spin_lock_irq(&bgrp->lock); \
++ bgrp->__VAR = (unsigned short)val; \
++ hlist_for_each_entry(bfqg, &bgrp->group_data, group_node) { \
++ /* \
++ * Setting the ioprio_changed flag of the entity \
++ * to 1 with new_##__VAR == ##__VAR would re-set \
++ * the value of the weight to its ioprio mapping. \
++ * Set the flag only if necessary. \
++ */ \
++ if ((unsigned short)val != bfqg->entity.new_##__VAR) { \
++ bfqg->entity.new_##__VAR = (unsigned short)val; \
++ /* \
++ * Make sure that the above new value has been \
++ * stored in bfqg->entity.new_##__VAR before \
++ * setting the ioprio_changed flag. In fact, \
++ * this flag may be read asynchronously (in \
++ * critical sections protected by a different \
++ * lock than that held here), and finding this \
++ * flag set may cause the execution of the code \
++ * for updating parameters whose value may \
++ * depend also on bfqg->entity.new_##__VAR (in \
++ * __bfq_entity_update_weight_prio). \
++ * This barrier makes sure that the new value \
++ * of bfqg->entity.new_##__VAR is correctly \
++ * seen in that code. \
++ */ \
++ smp_wmb(); \
++ bfqg->entity.ioprio_changed = 1; \
++ } \
++ } \
++ spin_unlock_irq(&bgrp->lock); \
++ \
++out_unlock: \
++ mutex_unlock(&bfqio_mutex); \
++ return ret; \
++}
++
++STORE_FUNCTION(weight, BFQ_MIN_WEIGHT, BFQ_MAX_WEIGHT);
++STORE_FUNCTION(ioprio, 0, IOPRIO_BE_NR - 1);
++STORE_FUNCTION(ioprio_class, IOPRIO_CLASS_RT, IOPRIO_CLASS_IDLE);
++#undef STORE_FUNCTION
++
++static struct cftype bfqio_files[] = {
++ {
++ .name = "weight",
++ .read_u64 = bfqio_cgroup_weight_read,
++ .write_u64 = bfqio_cgroup_weight_write,
++ },
++ {
++ .name = "ioprio",
++ .read_u64 = bfqio_cgroup_ioprio_read,
++ .write_u64 = bfqio_cgroup_ioprio_write,
++ },
++ {
++ .name = "ioprio_class",
++ .read_u64 = bfqio_cgroup_ioprio_class_read,
++ .write_u64 = bfqio_cgroup_ioprio_class_write,
++ },
++ { }, /* terminate */
++};
++
++static struct cgroup_subsys_state *bfqio_create(struct cgroup_subsys_state
++ *parent_css)
++{
++ struct bfqio_cgroup *bgrp;
++
++ if (parent_css != NULL) {
++ bgrp = kzalloc(sizeof(*bgrp), GFP_KERNEL);
++ if (bgrp == NULL)
++ return ERR_PTR(-ENOMEM);
++ } else
++ bgrp = &bfqio_root_cgroup;
++
++ spin_lock_init(&bgrp->lock);
++ INIT_HLIST_HEAD(&bgrp->group_data);
++ bgrp->ioprio = BFQ_DEFAULT_GRP_IOPRIO;
++ bgrp->ioprio_class = BFQ_DEFAULT_GRP_CLASS;
++
++ return &bgrp->css;
++}
++
++/*
++ * We cannot support shared io contexts, as we have no means to support
++ * two tasks with the same ioc in two different groups without major rework
++ * of the main bic/bfqq data structures. By now we allow a task to change
++ * its cgroup only if it's the only owner of its ioc; the drawback of this
++ * behavior is that a group containing a task that forked using CLONE_IO
++ * will not be destroyed until the tasks sharing the ioc die.
++ */
++static int bfqio_can_attach(struct cgroup_subsys_state *css,
++ struct cgroup_taskset *tset)
++{
++ struct task_struct *task;
++ struct io_context *ioc;
++ int ret = 0;
++
++ cgroup_taskset_for_each(task, tset) {
++ /*
++ * task_lock() is needed to avoid races with
++ * exit_io_context()
++ */
++ task_lock(task);
++ ioc = task->io_context;
++ if (ioc != NULL && atomic_read(&ioc->nr_tasks) > 1)
++ /*
++ * ioc == NULL means that the task is either too
++ * young or exiting: if it has still no ioc the
++ * ioc can't be shared, if the task is exiting the
++ * attach will fail anyway, no matter what we
++ * return here.
++ */
++ ret = -EINVAL;
++ task_unlock(task);
++ if (ret)
++ break;
++ }
++
++ return ret;
++}
++
++static void bfqio_attach(struct cgroup_subsys_state *css,
++ struct cgroup_taskset *tset)
++{
++ struct task_struct *task;
++ struct io_context *ioc;
++ struct io_cq *icq;
++
++ /*
++ * IMPORTANT NOTE: The move of more than one process at a time to a
++ * new group has not yet been tested.
++ */
++ cgroup_taskset_for_each(task, tset) {
++ ioc = get_task_io_context(task, GFP_ATOMIC, NUMA_NO_NODE);
++ if (ioc) {
++ /*
++ * Handle cgroup change here.
++ */
++ rcu_read_lock();
++ hlist_for_each_entry_rcu(icq, &ioc->icq_list, ioc_node)
++ if (!strncmp(
++ icq->q->elevator->type->elevator_name,
++ "bfq", ELV_NAME_MAX))
++ bfq_bic_change_cgroup(icq_to_bic(icq),
++ css);
++ rcu_read_unlock();
++ put_io_context(ioc);
++ }
++ }
++}
++
++static void bfqio_destroy(struct cgroup_subsys_state *css)
++{
++ struct bfqio_cgroup *bgrp = css_to_bfqio(css);
++ struct hlist_node *tmp;
++ struct bfq_group *bfqg;
++
++ /*
++ * Since we are destroying the cgroup, there are no more tasks
++ * referencing it, and all the RCU grace periods that may have
++ * referenced it are ended (as the destruction of the parent
++ * cgroup is RCU-safe); bgrp->group_data will not be accessed by
++ * anything else and we don't need any synchronization.
++ */
++ hlist_for_each_entry_safe(bfqg, tmp, &bgrp->group_data, group_node)
++ bfq_destroy_group(bgrp, bfqg);
++
++ BUG_ON(!hlist_empty(&bgrp->group_data));
++
++ kfree(bgrp);
++}
++
++static int bfqio_css_online(struct cgroup_subsys_state *css)
++{
++ struct bfqio_cgroup *bgrp = css_to_bfqio(css);
++
++ mutex_lock(&bfqio_mutex);
++ bgrp->online = true;
++ mutex_unlock(&bfqio_mutex);
++
++ return 0;
++}
++
++static void bfqio_css_offline(struct cgroup_subsys_state *css)
++{
++ struct bfqio_cgroup *bgrp = css_to_bfqio(css);
++
++ mutex_lock(&bfqio_mutex);
++ bgrp->online = false;
++ mutex_unlock(&bfqio_mutex);
++}
++
++struct cgroup_subsys bfqio_cgrp_subsys = {
++ .css_alloc = bfqio_create,
++ .css_online = bfqio_css_online,
++ .css_offline = bfqio_css_offline,
++ .can_attach = bfqio_can_attach,
++ .attach = bfqio_attach,
++ .css_free = bfqio_destroy,
++ .legacy_cftypes = bfqio_files,
++};
++#else
++static inline void bfq_init_entity(struct bfq_entity *entity,
++ struct bfq_group *bfqg)
++{
++ entity->weight = entity->new_weight;
++ entity->orig_weight = entity->new_weight;
++ entity->ioprio = entity->new_ioprio;
++ entity->ioprio_class = entity->new_ioprio_class;
++ entity->sched_data = &bfqg->sched_data;
++}
++
++static inline struct bfq_group *
++bfq_bic_update_cgroup(struct bfq_io_cq *bic)
++{
++ struct bfq_data *bfqd = bic_to_bfqd(bic);
++ return bfqd->root_group;
++}
++
++static inline void bfq_bfqq_move(struct bfq_data *bfqd,
++ struct bfq_queue *bfqq,
++ struct bfq_entity *entity,
++ struct bfq_group *bfqg)
++{
++}
++
++static void bfq_end_wr_async(struct bfq_data *bfqd)
++{
++ bfq_end_wr_async_queues(bfqd, bfqd->root_group);
++}
++
++static inline void bfq_disconnect_groups(struct bfq_data *bfqd)
++{
++ bfq_put_async_queues(bfqd, bfqd->root_group);
++}
++
++static inline void bfq_free_root_group(struct bfq_data *bfqd)
++{
++ kfree(bfqd->root_group);
++}
++
++static struct bfq_group *bfq_alloc_root_group(struct bfq_data *bfqd, int node)
++{
++ struct bfq_group *bfqg;
++ int i;
++
++ bfqg = kmalloc_node(sizeof(*bfqg), GFP_KERNEL | __GFP_ZERO, node);
++ if (bfqg == NULL)
++ return NULL;
++
++ for (i = 0; i < BFQ_IOPRIO_CLASSES; i++)
++ bfqg->sched_data.service_tree[i] = BFQ_SERVICE_TREE_INIT;
++
++ return bfqg;
++}
++#endif
+diff --git a/block/bfq-ioc.c b/block/bfq-ioc.c
+new file mode 100644
+index 0000000..7f6b000
+--- /dev/null
++++ b/block/bfq-ioc.c
+@@ -0,0 +1,36 @@
++/*
++ * BFQ: I/O context handling.
++ *
++ * Based on ideas and code from CFQ:
++ * Copyright (C) 2003 Jens Axboe <axboe@kernel.dk>
++ *
++ * Copyright (C) 2008 Fabio Checconi <fabio@gandalf.sssup.it>
++ * Paolo Valente <paolo.valente@unimore.it>
++ *
++ * Copyright (C) 2010 Paolo Valente <paolo.valente@unimore.it>
++ */
++
++/**
++ * icq_to_bic - convert iocontext queue structure to bfq_io_cq.
++ * @icq: the iocontext queue.
++ */
++static inline struct bfq_io_cq *icq_to_bic(struct io_cq *icq)
++{
++ /* bic->icq is the first member, %NULL will convert to %NULL */
++ return container_of(icq, struct bfq_io_cq, icq);
++}
++
++/**
++ * bfq_bic_lookup - search into @ioc a bic associated to @bfqd.
++ * @bfqd: the lookup key.
++ * @ioc: the io_context of the process doing I/O.
++ *
++ * Queue lock must be held.
++ */
++static inline struct bfq_io_cq *bfq_bic_lookup(struct bfq_data *bfqd,
++ struct io_context *ioc)
++{
++ if (ioc)
++ return icq_to_bic(ioc_lookup_icq(ioc, bfqd->queue));
++ return NULL;
++}
+diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c
+new file mode 100644
+index 0000000..b919b03
+--- /dev/null
++++ b/block/bfq-iosched.c
+@@ -0,0 +1,3887 @@
++/*
++ * Budget Fair Queueing (BFQ) disk scheduler.
++ *
++ * Based on ideas and code from CFQ:
++ * Copyright (C) 2003 Jens Axboe <axboe@kernel.dk>
++ *
++ * Copyright (C) 2008 Fabio Checconi <fabio@gandalf.sssup.it>
++ * Paolo Valente <paolo.valente@unimore.it>
++ *
++ * Copyright (C) 2010 Paolo Valente <paolo.valente@unimore.it>
++ *
++ * Licensed under the GPL-2 as detailed in the accompanying COPYING.BFQ
++ * file.
++ *
++ * BFQ is a proportional-share storage-I/O scheduling algorithm based on
++ * the slice-by-slice service scheme of CFQ. But BFQ assigns budgets,
++ * measured in number of sectors, to processes instead of time slices. The
++ * device is not granted to the in-service process for a given time slice,
++ * but until it has exhausted its assigned budget. This change from the time
++ * to the service domain allows BFQ to distribute the device throughput
++ * among processes as desired, without any distortion due to ZBR, workload
++ * fluctuations or other factors. BFQ uses an ad hoc internal scheduler,
++ * called B-WF2Q+, to schedule processes according to their budgets. More
++ * precisely, BFQ schedules queues associated to processes. Thanks to the
++ * accurate policy of B-WF2Q+, BFQ can afford to assign high budgets to
++ * I/O-bound processes issuing sequential requests (to boost the
++ * throughput), and yet guarantee a low latency to interactive and soft
++ * real-time applications.
++ *
++ * BFQ is described in [1], where also a reference to the initial, more
++ * theoretical paper on BFQ can be found. The interested reader can find
++ * in the latter paper full details on the main algorithm, as well as
++ * formulas of the guarantees and formal proofs of all the properties.
++ * With respect to the version of BFQ presented in these papers, this
++ * implementation adds a few more heuristics, such as the one that
++ * guarantees a low latency to soft real-time applications, and a
++ * hierarchical extension based on H-WF2Q+.
++ *
++ * B-WF2Q+ is based on WF2Q+, that is described in [2], together with
++ * H-WF2Q+, while the augmented tree used to implement B-WF2Q+ with O(log N)
++ * complexity derives from the one introduced with EEVDF in [3].
++ *
++ * [1] P. Valente and M. Andreolini, ``Improving Application Responsiveness
++ * with the BFQ Disk I/O Scheduler'',
++ * Proceedings of the 5th Annual International Systems and Storage
++ * Conference (SYSTOR '12), June 2012.
++ *
++ * http://algogroup.unimo.it/people/paolo/disk_sched/bf1-v1-suite-results.pdf
++ *
++ * [2] Jon C.R. Bennett and H. Zhang, ``Hierarchical Packet Fair Queueing
++ * Algorithms,'' IEEE/ACM Transactions on Networking, 5(5):675-689,
++ * Oct 1997.
++ *
++ * http://www.cs.cmu.edu/~hzhang/papers/TON-97-Oct.ps.gz
++ *
++ * [3] I. Stoica and H. Abdel-Wahab, ``Earliest Eligible Virtual Deadline
++ * First: A Flexible and Accurate Mechanism for Proportional Share
++ * Resource Allocation,'' technical report.
++ *
++ * http://www.cs.berkeley.edu/~istoica/papers/eevdf-tr-95.pdf
++ */
++#include <linux/module.h>
++#include <linux/slab.h>
++#include <linux/blkdev.h>
++#include <linux/cgroup.h>
++#include <linux/elevator.h>
++#include <linux/jiffies.h>
++#include <linux/rbtree.h>
++#include <linux/ioprio.h>
++#include "bfq.h"
++#include "blk.h"
++
++/* Max number of dispatches in one round of service. */
++static const int bfq_quantum = 4;
++
++/* Expiration time of sync (0) and async (1) requests, in jiffies. */
++static const int bfq_fifo_expire[2] = { HZ / 4, HZ / 8 };
++
++/* Maximum backwards seek, in KiB. */
++static const int bfq_back_max = 16 * 1024;
++
++/* Penalty of a backwards seek, in number of sectors. */
++static const int bfq_back_penalty = 2;
++
++/* Idling period duration, in jiffies. */
++static int bfq_slice_idle = HZ / 125;
++
++/* Default maximum budget values, in sectors and number of requests. */
++static const int bfq_default_max_budget = 16 * 1024;
++static const int bfq_max_budget_async_rq = 4;
++
++/*
++ * Async to sync throughput distribution is controlled as follows:
++ * when an async request is served, the entity is charged the number
++ * of sectors of the request, multiplied by the factor below
++ */
++static const int bfq_async_charge_factor = 10;
++
++/* Default timeout values, in jiffies, approximating CFQ defaults. */
++static const int bfq_timeout_sync = HZ / 8;
++static int bfq_timeout_async = HZ / 25;
++
++struct kmem_cache *bfq_pool;
++
++/* Below this threshold (in ms), we consider thinktime immediate. */
++#define BFQ_MIN_TT 2
++
++/* hw_tag detection: parallel requests threshold and min samples needed. */
++#define BFQ_HW_QUEUE_THRESHOLD 4
++#define BFQ_HW_QUEUE_SAMPLES 32
++
++#define BFQQ_SEEK_THR (sector_t)(8 * 1024)
++#define BFQQ_SEEKY(bfqq) ((bfqq)->seek_mean > BFQQ_SEEK_THR)
++
++/* Min samples used for peak rate estimation (for autotuning). */
++#define BFQ_PEAK_RATE_SAMPLES 32
++
++/* Shift used for peak rate fixed precision calculations. */
++#define BFQ_RATE_SHIFT 16
++
++/*
++ * By default, BFQ computes the duration of the weight raising for
++ * interactive applications automatically, using the following formula:
++ * duration = (R / r) * T, where r is the peak rate of the device, and
++ * R and T are two reference parameters.
++ * In particular, R is the peak rate of the reference device (see below),
++ * and T is a reference time: given the systems that are likely to be
++ * installed on the reference device according to its speed class, T is
++ * about the maximum time needed, under BFQ and while reading two files in
++ * parallel, to load typical large applications on these systems.
++ * In practice, the slower/faster the device at hand is, the more/less it
++ * takes to load applications with respect to the reference device.
++ * Accordingly, the longer/shorter BFQ grants weight raising to interactive
++ * applications.
++ *
++ * BFQ uses four different reference pairs (R, T), depending on:
++ * . whether the device is rotational or non-rotational;
++ * . whether the device is slow, such as old or portable HDDs, as well as
++ * SD cards, or fast, such as newer HDDs and SSDs.
++ *
++ * The device's speed class is dynamically (re)detected in
++ * bfq_update_peak_rate() every time the estimated peak rate is updated.
++ *
++ * In the following definitions, R_slow[0]/R_fast[0] and T_slow[0]/T_fast[0]
++ * are the reference values for a slow/fast rotational device, whereas
++ * R_slow[1]/R_fast[1] and T_slow[1]/T_fast[1] are the reference values for
++ * a slow/fast non-rotational device. Finally, device_speed_thresh are the
++ * thresholds used to switch between speed classes.
++ * Both the reference peak rates and the thresholds are measured in
++ * sectors/usec, left-shifted by BFQ_RATE_SHIFT.
++ */
++static int R_slow[2] = {1536, 10752};
++static int R_fast[2] = {17415, 34791};
++/*
++ * To improve readability, a conversion function is used to initialize the
++ * following arrays, which entails that they can be initialized only in a
++ * function.
++ */
++static int T_slow[2];
++static int T_fast[2];
++static int device_speed_thresh[2];
++
++#define BFQ_SERVICE_TREE_INIT ((struct bfq_service_tree) \
++ { RB_ROOT, RB_ROOT, NULL, NULL, 0, 0 })
++
++#define RQ_BIC(rq) ((struct bfq_io_cq *) (rq)->elv.priv[0])
++#define RQ_BFQQ(rq) ((rq)->elv.priv[1])
++
++static inline void bfq_schedule_dispatch(struct bfq_data *bfqd);
++
++#include "bfq-ioc.c"
++#include "bfq-sched.c"
++#include "bfq-cgroup.c"
++
++#define bfq_class_idle(bfqq) ((bfqq)->entity.ioprio_class ==\
++ IOPRIO_CLASS_IDLE)
++#define bfq_class_rt(bfqq) ((bfqq)->entity.ioprio_class ==\
++ IOPRIO_CLASS_RT)
++
++#define bfq_sample_valid(samples) ((samples) > 80)
++
++/*
++ * We regard a request as SYNC, if either it's a read or has the SYNC bit
++ * set (in which case it could also be a direct WRITE).
++ */
++static inline int bfq_bio_sync(struct bio *bio)
++{
++ if (bio_data_dir(bio) == READ || (bio->bi_rw & REQ_SYNC))
++ return 1;
++
++ return 0;
++}
++
++/*
++ * Scheduler run of queue, if there are requests pending and no one in the
++ * driver that will restart queueing.
++ */
++static inline void bfq_schedule_dispatch(struct bfq_data *bfqd)
++{
++ if (bfqd->queued != 0) {
++ bfq_log(bfqd, "schedule dispatch");
++ kblockd_schedule_work(&bfqd->unplug_work);
++ }
++}
++
++/*
++ * Lifted from AS - choose which of rq1 and rq2 that is best served now.
++ * We choose the request that is closesr to the head right now. Distance
++ * behind the head is penalized and only allowed to a certain extent.
++ */
++static struct request *bfq_choose_req(struct bfq_data *bfqd,
++ struct request *rq1,
++ struct request *rq2,
++ sector_t last)
++{
++ sector_t s1, s2, d1 = 0, d2 = 0;
++ unsigned long back_max;
++#define BFQ_RQ1_WRAP 0x01 /* request 1 wraps */
++#define BFQ_RQ2_WRAP 0x02 /* request 2 wraps */
++ unsigned wrap = 0; /* bit mask: requests behind the disk head? */
++
++ if (rq1 == NULL || rq1 == rq2)
++ return rq2;
++ if (rq2 == NULL)
++ return rq1;
++
++ if (rq_is_sync(rq1) && !rq_is_sync(rq2))
++ return rq1;
++ else if (rq_is_sync(rq2) && !rq_is_sync(rq1))
++ return rq2;
++ if ((rq1->cmd_flags & REQ_META) && !(rq2->cmd_flags & REQ_META))
++ return rq1;
++ else if ((rq2->cmd_flags & REQ_META) && !(rq1->cmd_flags & REQ_META))
++ return rq2;
++
++ s1 = blk_rq_pos(rq1);
++ s2 = blk_rq_pos(rq2);
++
++ /*
++ * By definition, 1KiB is 2 sectors.
++ */
++ back_max = bfqd->bfq_back_max * 2;
++
++ /*
++ * Strict one way elevator _except_ in the case where we allow
++ * short backward seeks which are biased as twice the cost of a
++ * similar forward seek.
++ */
++ if (s1 >= last)
++ d1 = s1 - last;
++ else if (s1 + back_max >= last)
++ d1 = (last - s1) * bfqd->bfq_back_penalty;
++ else
++ wrap |= BFQ_RQ1_WRAP;
++
++ if (s2 >= last)
++ d2 = s2 - last;
++ else if (s2 + back_max >= last)
++ d2 = (last - s2) * bfqd->bfq_back_penalty;
++ else
++ wrap |= BFQ_RQ2_WRAP;
++
++ /* Found required data */
++
++ /*
++ * By doing switch() on the bit mask "wrap" we avoid having to
++ * check two variables for all permutations: --> faster!
++ */
++ switch (wrap) {
++ case 0: /* common case for CFQ: rq1 and rq2 not wrapped */
++ if (d1 < d2)
++ return rq1;
++ else if (d2 < d1)
++ return rq2;
++ else {
++ if (s1 >= s2)
++ return rq1;
++ else
++ return rq2;
++ }
++
++ case BFQ_RQ2_WRAP:
++ return rq1;
++ case BFQ_RQ1_WRAP:
++ return rq2;
++ case (BFQ_RQ1_WRAP|BFQ_RQ2_WRAP): /* both rqs wrapped */
++ default:
++ /*
++ * Since both rqs are wrapped,
++ * start with the one that's further behind head
++ * (--> only *one* back seek required),
++ * since back seek takes more time than forward.
++ */
++ if (s1 <= s2)
++ return rq1;
++ else
++ return rq2;
++ }
++}
++
++static struct bfq_queue *
++bfq_rq_pos_tree_lookup(struct bfq_data *bfqd, struct rb_root *root,
++ sector_t sector, struct rb_node **ret_parent,
++ struct rb_node ***rb_link)
++{
++ struct rb_node **p, *parent;
++ struct bfq_queue *bfqq = NULL;
++
++ parent = NULL;
++ p = &root->rb_node;
++ while (*p) {
++ struct rb_node **n;
++
++ parent = *p;
++ bfqq = rb_entry(parent, struct bfq_queue, pos_node);
++
++ /*
++ * Sort strictly based on sector. Smallest to the left,
++ * largest to the right.
++ */
++ if (sector > blk_rq_pos(bfqq->next_rq))
++ n = &(*p)->rb_right;
++ else if (sector < blk_rq_pos(bfqq->next_rq))
++ n = &(*p)->rb_left;
++ else
++ break;
++ p = n;
++ bfqq = NULL;
++ }
++
++ *ret_parent = parent;
++ if (rb_link)
++ *rb_link = p;
++
++ bfq_log(bfqd, "rq_pos_tree_lookup %llu: returning %d",
++ (long long unsigned)sector,
++ bfqq != NULL ? bfqq->pid : 0);
++
++ return bfqq;
++}
++
++static void bfq_rq_pos_tree_add(struct bfq_data *bfqd, struct bfq_queue *bfqq)
++{
++ struct rb_node **p, *parent;
++ struct bfq_queue *__bfqq;
++
++ if (bfqq->pos_root != NULL) {
++ rb_erase(&bfqq->pos_node, bfqq->pos_root);
++ bfqq->pos_root = NULL;
++ }
++
++ if (bfq_class_idle(bfqq))
++ return;
++ if (!bfqq->next_rq)
++ return;
++
++ bfqq->pos_root = &bfqd->rq_pos_tree;
++ __bfqq = bfq_rq_pos_tree_lookup(bfqd, bfqq->pos_root,
++ blk_rq_pos(bfqq->next_rq), &parent, &p);
++ if (__bfqq == NULL) {
++ rb_link_node(&bfqq->pos_node, parent, p);
++ rb_insert_color(&bfqq->pos_node, bfqq->pos_root);
++ } else
++ bfqq->pos_root = NULL;
++}
++
++/*
++ * Tell whether there are active queues or groups with differentiated weights.
++ */
++static inline bool bfq_differentiated_weights(struct bfq_data *bfqd)
++{
++ BUG_ON(!bfqd->hw_tag);
++ /*
++ * For weights to differ, at least one of the trees must contain
++ * at least two nodes.
++ */
++ return (!RB_EMPTY_ROOT(&bfqd->queue_weights_tree) &&
++ (bfqd->queue_weights_tree.rb_node->rb_left ||
++ bfqd->queue_weights_tree.rb_node->rb_right)
++#ifdef CONFIG_CGROUP_BFQIO
++ ) ||
++ (!RB_EMPTY_ROOT(&bfqd->group_weights_tree) &&
++ (bfqd->group_weights_tree.rb_node->rb_left ||
++ bfqd->group_weights_tree.rb_node->rb_right)
++#endif
++ );
++}
++
++/*
++ * If the weight-counter tree passed as input contains no counter for
++ * the weight of the input entity, then add that counter; otherwise just
++ * increment the existing counter.
++ *
++ * Note that weight-counter trees contain few nodes in mostly symmetric
++ * scenarios. For example, if all queues have the same weight, then the
++ * weight-counter tree for the queues may contain at most one node.
++ * This holds even if low_latency is on, because weight-raised queues
++ * are not inserted in the tree.
++ * In most scenarios, the rate at which nodes are created/destroyed
++ * should be low too.
++ */
++static void bfq_weights_tree_add(struct bfq_data *bfqd,
++ struct bfq_entity *entity,
++ struct rb_root *root)
++{
++ struct rb_node **new = &(root->rb_node), *parent = NULL;
++
++ /*
++ * Do not insert if:
++ * - the device does not support queueing;
++ * - the entity is already associated with a counter, which happens if:
++ * 1) the entity is associated with a queue, 2) a request arrival
++ * has caused the queue to become both non-weight-raised, and hence
++ * change its weight, and backlogged; in this respect, each
++ * of the two events causes an invocation of this function,
++ * 3) this is the invocation of this function caused by the second
++ * event. This second invocation is actually useless, and we handle
++ * this fact by exiting immediately. More efficient or clearer
++ * solutions might possibly be adopted.
++ */
++ if (!bfqd->hw_tag || entity->weight_counter)
++ return;
++
++ while (*new) {
++ struct bfq_weight_counter *__counter = container_of(*new,
++ struct bfq_weight_counter,
++ weights_node);
++ parent = *new;
++
++ if (entity->weight == __counter->weight) {
++ entity->weight_counter = __counter;
++ goto inc_counter;
++ }
++ if (entity->weight < __counter->weight)
++ new = &((*new)->rb_left);
++ else
++ new = &((*new)->rb_right);
++ }
++
++ entity->weight_counter = kzalloc(sizeof(struct bfq_weight_counter),
++ GFP_ATOMIC);
++ entity->weight_counter->weight = entity->weight;
++ rb_link_node(&entity->weight_counter->weights_node, parent, new);
++ rb_insert_color(&entity->weight_counter->weights_node, root);
++
++inc_counter:
++ entity->weight_counter->num_active++;
++}
++
++/*
++ * Decrement the weight counter associated with the entity, and, if the
++ * counter reaches 0, remove the counter from the tree.
++ * See the comments to the function bfq_weights_tree_add() for considerations
++ * about overhead.
++ */
++static void bfq_weights_tree_remove(struct bfq_data *bfqd,
++ struct bfq_entity *entity,
++ struct rb_root *root)
++{
++ /*
++ * Check whether the entity is actually associated with a counter.
++ * In fact, the device may not be considered NCQ-capable for a while,
++ * which implies that no insertion in the weight trees is performed,
++ * after which the device may start to be deemed NCQ-capable, and hence
++ * this function may start to be invoked. This may cause the function
++ * to be invoked for entities that are not associated with any counter.
++ */
++ if (!entity->weight_counter)
++ return;
++
++ BUG_ON(RB_EMPTY_ROOT(root));
++ BUG_ON(entity->weight_counter->weight != entity->weight);
++
++ BUG_ON(!entity->weight_counter->num_active);
++ entity->weight_counter->num_active--;
++ if (entity->weight_counter->num_active > 0)
++ goto reset_entity_pointer;
++
++ rb_erase(&entity->weight_counter->weights_node, root);
++ kfree(entity->weight_counter);
++
++reset_entity_pointer:
++ entity->weight_counter = NULL;
++}
++
++static struct request *bfq_find_next_rq(struct bfq_data *bfqd,
++ struct bfq_queue *bfqq,
++ struct request *last)
++{
++ struct rb_node *rbnext = rb_next(&last->rb_node);
++ struct rb_node *rbprev = rb_prev(&last->rb_node);
++ struct request *next = NULL, *prev = NULL;
++
++ BUG_ON(RB_EMPTY_NODE(&last->rb_node));
++
++ if (rbprev != NULL)
++ prev = rb_entry_rq(rbprev);
++
++ if (rbnext != NULL)
++ next = rb_entry_rq(rbnext);
++ else {
++ rbnext = rb_first(&bfqq->sort_list);
++ if (rbnext && rbnext != &last->rb_node)
++ next = rb_entry_rq(rbnext);
++ }
++
++ return bfq_choose_req(bfqd, next, prev, blk_rq_pos(last));
++}
++
++/* see the definition of bfq_async_charge_factor for details */
++static inline unsigned long bfq_serv_to_charge(struct request *rq,
++ struct bfq_queue *bfqq)
++{
++ return blk_rq_sectors(rq) *
++ (1 + ((!bfq_bfqq_sync(bfqq)) * (bfqq->wr_coeff == 1) *
++ bfq_async_charge_factor));
++}
++
++/**
++ * bfq_updated_next_req - update the queue after a new next_rq selection.
++ * @bfqd: the device data the queue belongs to.
++ * @bfqq: the queue to update.
++ *
++ * If the first request of a queue changes we make sure that the queue
++ * has enough budget to serve at least its first request (if the
++ * request has grown). We do this because if the queue has not enough
++ * budget for its first request, it has to go through two dispatch
++ * rounds to actually get it dispatched.
++ */
++static void bfq_updated_next_req(struct bfq_data *bfqd,
++ struct bfq_queue *bfqq)
++{
++ struct bfq_entity *entity = &bfqq->entity;
++ struct bfq_service_tree *st = bfq_entity_service_tree(entity);
++ struct request *next_rq = bfqq->next_rq;
++ unsigned long new_budget;
++
++ if (next_rq == NULL)
++ return;
++
++ if (bfqq == bfqd->in_service_queue)
++ /*
++ * In order not to break guarantees, budgets cannot be
++ * changed after an entity has been selected.
++ */
++ return;
++
++ BUG_ON(entity->tree != &st->active);
++ BUG_ON(entity == entity->sched_data->in_service_entity);
++
++ new_budget = max_t(unsigned long, bfqq->max_budget,
++ bfq_serv_to_charge(next_rq, bfqq));
++ if (entity->budget != new_budget) {
++ entity->budget = new_budget;
++ bfq_log_bfqq(bfqd, bfqq, "updated next rq: new budget %lu",
++ new_budget);
++ bfq_activate_bfqq(bfqd, bfqq);
++ }
++}
++
++static inline unsigned int bfq_wr_duration(struct bfq_data *bfqd)
++{
++ u64 dur;
++
++ if (bfqd->bfq_wr_max_time > 0)
++ return bfqd->bfq_wr_max_time;
++
++ dur = bfqd->RT_prod;
++ do_div(dur, bfqd->peak_rate);
++
++ return dur;
++}
++
++/* Empty burst list and add just bfqq (see comments to bfq_handle_burst) */
++static inline void bfq_reset_burst_list(struct bfq_data *bfqd,
++ struct bfq_queue *bfqq)
++{
++ struct bfq_queue *item;
++ struct hlist_node *n;
++
++ hlist_for_each_entry_safe(item, n, &bfqd->burst_list, burst_list_node)
++ hlist_del_init(&item->burst_list_node);
++ hlist_add_head(&bfqq->burst_list_node, &bfqd->burst_list);
++ bfqd->burst_size = 1;
++}
++
++/* Add bfqq to the list of queues in current burst (see bfq_handle_burst) */
++static void bfq_add_to_burst(struct bfq_data *bfqd, struct bfq_queue *bfqq)
++{
++ /* Increment burst size to take into account also bfqq */
++ bfqd->burst_size++;
++
++ if (bfqd->burst_size == bfqd->bfq_large_burst_thresh) {
++ struct bfq_queue *pos, *bfqq_item;
++ struct hlist_node *n;
++
++ /*
++ * Enough queues have been activated shortly after each
++ * other to consider this burst as large.
++ */
++ bfqd->large_burst = true;
++
++ /*
++ * We can now mark all queues in the burst list as
++ * belonging to a large burst.
++ */
++ hlist_for_each_entry(bfqq_item, &bfqd->burst_list,
++ burst_list_node)
++ bfq_mark_bfqq_in_large_burst(bfqq_item);
++ bfq_mark_bfqq_in_large_burst(bfqq);
++
++ /*
++ * From now on, and until the current burst finishes, any
++ * new queue being activated shortly after the last queue
++ * was inserted in the burst can be immediately marked as
++ * belonging to a large burst. So the burst list is not
++ * needed any more. Remove it.
++ */
++ hlist_for_each_entry_safe(pos, n, &bfqd->burst_list,
++ burst_list_node)
++ hlist_del_init(&pos->burst_list_node);
++ } else /* burst not yet large: add bfqq to the burst list */
++ hlist_add_head(&bfqq->burst_list_node, &bfqd->burst_list);
++}
++
++/*
++ * If many queues happen to become active shortly after each other, then,
++ * to help the processes associated to these queues get their job done as
++ * soon as possible, it is usually better to not grant either weight-raising
++ * or device idling to these queues. In this comment we describe, firstly,
++ * the reasons why this fact holds, and, secondly, the next function, which
++ * implements the main steps needed to properly mark these queues so that
++ * they can then be treated in a different way.
++ *
++ * As for the terminology, we say that a queue becomes active, i.e.,
++ * switches from idle to backlogged, either when it is created (as a
++ * consequence of the arrival of an I/O request), or, if already existing,
++ * when a new request for the queue arrives while the queue is idle.
++ * Bursts of activations, i.e., activations of different queues occurring
++ * shortly after each other, are typically caused by services or applications
++ * that spawn or reactivate many parallel threads/processes. Examples are
++ * systemd during boot or git grep.
++ *
++ * These services or applications benefit mostly from a high throughput:
++ * the quicker the requests of the activated queues are cumulatively served,
++ * the sooner the target job of these queues gets completed. As a consequence,
++ * weight-raising any of these queues, which also implies idling the device
++ * for it, is almost always counterproductive: in most cases it just lowers
++ * throughput.
++ *
++ * On the other hand, a burst of activations may be also caused by the start
++ * of an application that does not consist in a lot of parallel I/O-bound
++ * threads. In fact, with a complex application, the burst may be just a
++ * consequence of the fact that several processes need to be executed to
++ * start-up the application. To start an application as quickly as possible,
++ * the best thing to do is to privilege the I/O related to the application
++ * with respect to all other I/O. Therefore, the best strategy to start as
++ * quickly as possible an application that causes a burst of activations is
++ * to weight-raise all the queues activated during the burst. This is the
++ * exact opposite of the best strategy for the other type of bursts.
++ *
++ * In the end, to take the best action for each of the two cases, the two
++ * types of bursts need to be distinguished. Fortunately, this seems
++ * relatively easy to do, by looking at the sizes of the bursts. In
++ * particular, we found a threshold such that bursts with a larger size
++ * than that threshold are apparently caused only by services or commands
++ * such as systemd or git grep. For brevity, hereafter we call just 'large'
++ * these bursts. BFQ *does not* weight-raise queues whose activations occur
++ * in a large burst. In addition, for each of these queues BFQ performs or
++ * does not perform idling depending on which choice boosts the throughput
++ * most. The exact choice depends on the device and request pattern at
++ * hand.
++ *
++ * Turning back to the next function, it implements all the steps needed
++ * to detect the occurrence of a large burst and to properly mark all the
++ * queues belonging to it (so that they can then be treated in a different
++ * way). This goal is achieved by maintaining a special "burst list" that
++ * holds, temporarily, the queues that belong to the burst in progress. The
++ * list is then used to mark these queues as belonging to a large burst if
++ * the burst does become large. The main steps are the following.
++ *
++ * . when the very first queue is activated, the queue is inserted into the
++ * list (as it could be the first queue in a possible burst)
++ *
++ * . if the current burst has not yet become large, and a queue Q that does
++ * not yet belong to the burst is activated shortly after the last time
++ * at which a new queue entered the burst list, then the function appends
++ * Q to the burst list
++ *
++ * . if, as a consequence of the previous step, the burst size reaches
++ * the large-burst threshold, then
++ *
++ * . all the queues in the burst list are marked as belonging to a
++ * large burst
++ *
++ * . the burst list is deleted; in fact, the burst list already served
++ * its purpose (keeping temporarily track of the queues in a burst,
++ * so as to be able to mark them as belonging to a large burst in the
++ * previous sub-step), and now is not needed any more
++ *
++ * . the device enters a large-burst mode
++ *
++ * . if a queue Q that does not belong to the burst is activated while
++ * the device is in large-burst mode and shortly after the last time
++ * at which a queue either entered the burst list or was marked as
++ * belonging to the current large burst, then Q is immediately marked
++ * as belonging to a large burst.
++ *
++ * . if a queue Q that does not belong to the burst is activated a while
++ * later, i.e., not shortly after, than the last time at which a queue
++ * either entered the burst list or was marked as belonging to the
++ * current large burst, then the current burst is deemed as finished and:
++ *
++ * . the large-burst mode is reset if set
++ *
++ * . the burst list is emptied
++ *
++ * . Q is inserted in the burst list, as Q may be the first queue
++ * in a possible new burst (then the burst list contains just Q
++ * after this step).
++ */
++static void bfq_handle_burst(struct bfq_data *bfqd, struct bfq_queue *bfqq,
++ bool idle_for_long_time)
++{
++ /*
++ * If bfqq happened to be activated in a burst, but has been idle
++ * for at least as long as an interactive queue, then we assume
++ * that, in the overall I/O initiated in the burst, the I/O
++ * associated to bfqq is finished. So bfqq does not need to be
++ * treated as a queue belonging to a burst anymore. Accordingly,
++ * we reset bfqq's in_large_burst flag if set, and remove bfqq
++ * from the burst list if it's there. We do not decrement instead
++ * burst_size, because the fact that bfqq does not need to belong
++ * to the burst list any more does not invalidate the fact that
++ * bfqq may have been activated during the current burst.
++ */
++ if (idle_for_long_time) {
++ hlist_del_init(&bfqq->burst_list_node);
++ bfq_clear_bfqq_in_large_burst(bfqq);
++ }
++
++ /*
++ * If bfqq is already in the burst list or is part of a large
++ * burst, then there is nothing else to do.
++ */
++ if (!hlist_unhashed(&bfqq->burst_list_node) ||
++ bfq_bfqq_in_large_burst(bfqq))
++ return;
++
++ /*
++ * If bfqq's activation happens late enough, then the current
++ * burst is finished, and related data structures must be reset.
++ *
++ * In this respect, consider the special case where bfqq is the very
++ * first queue being activated. In this case, last_ins_in_burst is
++ * not yet significant when we get here. But it is easy to verify
++ * that, whether or not the following condition is true, bfqq will
++ * end up being inserted into the burst list. In particular the
++ * list will happen to contain only bfqq. And this is exactly what
++ * has to happen, as bfqq may be the first queue in a possible
++ * burst.
++ */
++ if (time_is_before_jiffies(bfqd->last_ins_in_burst +
++ bfqd->bfq_burst_interval)) {
++ bfqd->large_burst = false;
++ bfq_reset_burst_list(bfqd, bfqq);
++ return;
++ }
++
++ /*
++ * If we get here, then bfqq is being activated shortly after the
++ * last queue. So, if the current burst is also large, we can mark
++ * bfqq as belonging to this large burst immediately.
++ */
++ if (bfqd->large_burst) {
++ bfq_mark_bfqq_in_large_burst(bfqq);
++ return;
++ }
++
++ /*
++ * If we get here, then a large-burst state has not yet been
++ * reached, but bfqq is being activated shortly after the last
++ * queue. Then we add bfqq to the burst.
++ */
++ bfq_add_to_burst(bfqd, bfqq);
++}
++
++static void bfq_add_request(struct request *rq)
++{
++ struct bfq_queue *bfqq = RQ_BFQQ(rq);
++ struct bfq_entity *entity = &bfqq->entity;
++ struct bfq_data *bfqd = bfqq->bfqd;
++ struct request *next_rq, *prev;
++ unsigned long old_wr_coeff = bfqq->wr_coeff;
++ bool interactive = false;
++
++ bfq_log_bfqq(bfqd, bfqq, "add_request %d", rq_is_sync(rq));
++ bfqq->queued[rq_is_sync(rq)]++;
++ bfqd->queued++;
++
++ elv_rb_add(&bfqq->sort_list, rq);
++
++ /*
++ * Check if this request is a better next-serve candidate.
++ */
++ prev = bfqq->next_rq;
++ next_rq = bfq_choose_req(bfqd, bfqq->next_rq, rq, bfqd->last_position);
++ BUG_ON(next_rq == NULL);
++ bfqq->next_rq = next_rq;
++
++ /*
++ * Adjust priority tree position, if next_rq changes.
++ */
++ if (prev != bfqq->next_rq)
++ bfq_rq_pos_tree_add(bfqd, bfqq);
++
++ if (!bfq_bfqq_busy(bfqq)) {
++ bool soft_rt,
++ idle_for_long_time = time_is_before_jiffies(
++ bfqq->budget_timeout +
++ bfqd->bfq_wr_min_idle_time);
++
++ if (bfq_bfqq_sync(bfqq)) {
++ bool already_in_burst =
++ !hlist_unhashed(&bfqq->burst_list_node) ||
++ bfq_bfqq_in_large_burst(bfqq);
++ bfq_handle_burst(bfqd, bfqq, idle_for_long_time);
++ /*
++ * If bfqq was not already in the current burst,
++ * then, at this point, bfqq either has been
++ * added to the current burst or has caused the
++ * current burst to terminate. In particular, in
++ * the second case, bfqq has become the first
++ * queue in a possible new burst.
++ * In both cases last_ins_in_burst needs to be
++ * moved forward.
++ */
++ if (!already_in_burst)
++ bfqd->last_ins_in_burst = jiffies;
++ }
++
++ soft_rt = bfqd->bfq_wr_max_softrt_rate > 0 &&
++ !bfq_bfqq_in_large_burst(bfqq) &&
++ time_is_before_jiffies(bfqq->soft_rt_next_start);
++ interactive = !bfq_bfqq_in_large_burst(bfqq) &&
++ idle_for_long_time;
++ entity->budget = max_t(unsigned long, bfqq->max_budget,
++ bfq_serv_to_charge(next_rq, bfqq));
++
++ if (!bfq_bfqq_IO_bound(bfqq)) {
++ if (time_before(jiffies,
++ RQ_BIC(rq)->ttime.last_end_request +
++ bfqd->bfq_slice_idle)) {
++ bfqq->requests_within_timer++;
++ if (bfqq->requests_within_timer >=
++ bfqd->bfq_requests_within_timer)
++ bfq_mark_bfqq_IO_bound(bfqq);
++ } else
++ bfqq->requests_within_timer = 0;
++ }
++
++ if (!bfqd->low_latency)
++ goto add_bfqq_busy;
++
++ /*
++ * If the queue is not being boosted and has been idle
++ * for enough time, start a weight-raising period
++ */
++ if (old_wr_coeff == 1 && (interactive || soft_rt)) {
++ bfqq->wr_coeff = bfqd->bfq_wr_coeff;
++ if (interactive)
++ bfqq->wr_cur_max_time = bfq_wr_duration(bfqd);
++ else
++ bfqq->wr_cur_max_time =
++ bfqd->bfq_wr_rt_max_time;
++ bfq_log_bfqq(bfqd, bfqq,
++ "wrais starting at %lu, rais_max_time %u",
++ jiffies,
++ jiffies_to_msecs(bfqq->wr_cur_max_time));
++ } else if (old_wr_coeff > 1) {
++ if (interactive)
++ bfqq->wr_cur_max_time = bfq_wr_duration(bfqd);
++ else if (bfq_bfqq_in_large_burst(bfqq) ||
++ (bfqq->wr_cur_max_time ==
++ bfqd->bfq_wr_rt_max_time &&
++ !soft_rt)) {
++ bfqq->wr_coeff = 1;
++ bfq_log_bfqq(bfqd, bfqq,
++ "wrais ending at %lu, rais_max_time %u",
++ jiffies,
++ jiffies_to_msecs(bfqq->
++ wr_cur_max_time));
++ } else if (time_before(
++ bfqq->last_wr_start_finish +
++ bfqq->wr_cur_max_time,
++ jiffies +
++ bfqd->bfq_wr_rt_max_time) &&
++ soft_rt) {
++ /*
++ *
++ * The remaining weight-raising time is lower
++ * than bfqd->bfq_wr_rt_max_time, which
++ * means that the application is enjoying
++ * weight raising either because deemed soft-
++ * rt in the near past, or because deemed
++ * interactive a long ago. In both cases,
++ * resetting now the current remaining weight-
++ * raising time for the application to the
++ * weight-raising duration for soft rt
++ * applications would not cause any latency
++ * increase for the application (as the new
++ * duration would be higher than the remaining
++ * time).
++ *
++ * In addition, the application is now meeting
++ * the requirements for being deemed soft rt.
++ * In the end we can correctly and safely
++ * (re)charge the weight-raising duration for
++ * the application with the weight-raising
++ * duration for soft rt applications.
++ *
++ * In particular, doing this recharge now, i.e.,
++ * before the weight-raising period for the
++ * application finishes, reduces the probability
++ * of the following negative scenario:
++ * 1) the weight of a soft rt application is
++ * raised at startup (as for any newly
++ * created application),
++ * 2) since the application is not interactive,
++ * at a certain time weight-raising is
++ * stopped for the application,
++ * 3) at that time the application happens to
++ * still have pending requests, and hence
++ * is destined to not have a chance to be
++ * deemed soft rt before these requests are
++ * completed (see the comments to the
++ * function bfq_bfqq_softrt_next_start()
++ * for details on soft rt detection),
++ * 4) these pending requests experience a high
++ * latency because the application is not
++ * weight-raised while they are pending.
++ */
++ bfqq->last_wr_start_finish = jiffies;
++ bfqq->wr_cur_max_time =
++ bfqd->bfq_wr_rt_max_time;
++ }
++ }
++ if (old_wr_coeff != bfqq->wr_coeff)
++ entity->ioprio_changed = 1;
++add_bfqq_busy:
++ bfqq->last_idle_bklogged = jiffies;
++ bfqq->service_from_backlogged = 0;
++ bfq_clear_bfqq_softrt_update(bfqq);
++ bfq_add_bfqq_busy(bfqd, bfqq);
++ } else {
++ if (bfqd->low_latency && old_wr_coeff == 1 && !rq_is_sync(rq) &&
++ time_is_before_jiffies(
++ bfqq->last_wr_start_finish +
++ bfqd->bfq_wr_min_inter_arr_async)) {
++ bfqq->wr_coeff = bfqd->bfq_wr_coeff;
++ bfqq->wr_cur_max_time = bfq_wr_duration(bfqd);
++
++ bfqd->wr_busy_queues++;
++ entity->ioprio_changed = 1;
++ bfq_log_bfqq(bfqd, bfqq,
++ "non-idle wrais starting at %lu, rais_max_time %u",
++ jiffies,
++ jiffies_to_msecs(bfqq->wr_cur_max_time));
++ }
++ if (prev != bfqq->next_rq)
++ bfq_updated_next_req(bfqd, bfqq);
++ }
++
++ if (bfqd->low_latency &&
++ (old_wr_coeff == 1 || bfqq->wr_coeff == 1 || interactive))
++ bfqq->last_wr_start_finish = jiffies;
++}
++
++static struct request *bfq_find_rq_fmerge(struct bfq_data *bfqd,
++ struct bio *bio)
++{
++ struct task_struct *tsk = current;
++ struct bfq_io_cq *bic;
++ struct bfq_queue *bfqq;
++
++ bic = bfq_bic_lookup(bfqd, tsk->io_context);
++ if (bic == NULL)
++ return NULL;
++
++ bfqq = bic_to_bfqq(bic, bfq_bio_sync(bio));
++ if (bfqq != NULL)
++ return elv_rb_find(&bfqq->sort_list, bio_end_sector(bio));
++
++ return NULL;
++}
++
++static void bfq_activate_request(struct request_queue *q, struct request *rq)
++{
++ struct bfq_data *bfqd = q->elevator->elevator_data;
++
++ bfqd->rq_in_driver++;
++ bfqd->last_position = blk_rq_pos(rq) + blk_rq_sectors(rq);
++ bfq_log(bfqd, "activate_request: new bfqd->last_position %llu",
++ (long long unsigned)bfqd->last_position);
++}
++
++static inline void bfq_deactivate_request(struct request_queue *q,
++ struct request *rq)
++{
++ struct bfq_data *bfqd = q->elevator->elevator_data;
++
++ BUG_ON(bfqd->rq_in_driver == 0);
++ bfqd->rq_in_driver--;
++}
++
++static void bfq_remove_request(struct request *rq)
++{
++ struct bfq_queue *bfqq = RQ_BFQQ(rq);
++ struct bfq_data *bfqd = bfqq->bfqd;
++ const int sync = rq_is_sync(rq);
++
++ if (bfqq->next_rq == rq) {
++ bfqq->next_rq = bfq_find_next_rq(bfqd, bfqq, rq);
++ bfq_updated_next_req(bfqd, bfqq);
++ }
++
++ list_del_init(&rq->queuelist);
++ BUG_ON(bfqq->queued[sync] == 0);
++ bfqq->queued[sync]--;
++ bfqd->queued--;
++ elv_rb_del(&bfqq->sort_list, rq);
++
++ if (RB_EMPTY_ROOT(&bfqq->sort_list)) {
++ if (bfq_bfqq_busy(bfqq) && bfqq != bfqd->in_service_queue)
++ bfq_del_bfqq_busy(bfqd, bfqq, 1);
++ /*
++ * Remove queue from request-position tree as it is empty.
++ */
++ if (bfqq->pos_root != NULL) {
++ rb_erase(&bfqq->pos_node, bfqq->pos_root);
++ bfqq->pos_root = NULL;
++ }
++ }
++
++ if (rq->cmd_flags & REQ_META) {
++ BUG_ON(bfqq->meta_pending == 0);
++ bfqq->meta_pending--;
++ }
++}
++
++static int bfq_merge(struct request_queue *q, struct request **req,
++ struct bio *bio)
++{
++ struct bfq_data *bfqd = q->elevator->elevator_data;
++ struct request *__rq;
++
++ __rq = bfq_find_rq_fmerge(bfqd, bio);
++ if (__rq != NULL && elv_rq_merge_ok(__rq, bio)) {
++ *req = __rq;
++ return ELEVATOR_FRONT_MERGE;
++ }
++
++ return ELEVATOR_NO_MERGE;
++}
++
++static void bfq_merged_request(struct request_queue *q, struct request *req,
++ int type)
++{
++ if (type == ELEVATOR_FRONT_MERGE &&
++ rb_prev(&req->rb_node) &&
++ blk_rq_pos(req) <
++ blk_rq_pos(container_of(rb_prev(&req->rb_node),
++ struct request, rb_node))) {
++ struct bfq_queue *bfqq = RQ_BFQQ(req);
++ struct bfq_data *bfqd = bfqq->bfqd;
++ struct request *prev, *next_rq;
++
++ /* Reposition request in its sort_list */
++ elv_rb_del(&bfqq->sort_list, req);
++ elv_rb_add(&bfqq->sort_list, req);
++ /* Choose next request to be served for bfqq */
++ prev = bfqq->next_rq;
++ next_rq = bfq_choose_req(bfqd, bfqq->next_rq, req,
++ bfqd->last_position);
++ BUG_ON(next_rq == NULL);
++ bfqq->next_rq = next_rq;
++ /*
++ * If next_rq changes, update both the queue's budget to
++ * fit the new request and the queue's position in its
++ * rq_pos_tree.
++ */
++ if (prev != bfqq->next_rq) {
++ bfq_updated_next_req(bfqd, bfqq);
++ bfq_rq_pos_tree_add(bfqd, bfqq);
++ }
++ }
++}
++
++static void bfq_merged_requests(struct request_queue *q, struct request *rq,
++ struct request *next)
++{
++ struct bfq_queue *bfqq = RQ_BFQQ(rq);
++
++ /*
++ * Reposition in fifo if next is older than rq.
++ */
++ if (!list_empty(&rq->queuelist) && !list_empty(&next->queuelist) &&
++ time_before(next->fifo_time, rq->fifo_time)) {
++ list_move(&rq->queuelist, &next->queuelist);
++ rq->fifo_time = next->fifo_time;
++ }
++
++ if (bfqq->next_rq == next)
++ bfqq->next_rq = rq;
++
++ bfq_remove_request(next);
++}
++
++/* Must be called with bfqq != NULL */
++static inline void bfq_bfqq_end_wr(struct bfq_queue *bfqq)
++{
++ BUG_ON(bfqq == NULL);
++ if (bfq_bfqq_busy(bfqq))
++ bfqq->bfqd->wr_busy_queues--;
++ bfqq->wr_coeff = 1;
++ bfqq->wr_cur_max_time = 0;
++ /* Trigger a weight change on the next activation of the queue */
++ bfqq->entity.ioprio_changed = 1;
++}
++
++static void bfq_end_wr_async_queues(struct bfq_data *bfqd,
++ struct bfq_group *bfqg)
++{
++ int i, j;
++
++ for (i = 0; i < 2; i++)
++ for (j = 0; j < IOPRIO_BE_NR; j++)
++ if (bfqg->async_bfqq[i][j] != NULL)
++ bfq_bfqq_end_wr(bfqg->async_bfqq[i][j]);
++ if (bfqg->async_idle_bfqq != NULL)
++ bfq_bfqq_end_wr(bfqg->async_idle_bfqq);
++}
++
++static void bfq_end_wr(struct bfq_data *bfqd)
++{
++ struct bfq_queue *bfqq;
++
++ spin_lock_irq(bfqd->queue->queue_lock);
++
++ list_for_each_entry(bfqq, &bfqd->active_list, bfqq_list)
++ bfq_bfqq_end_wr(bfqq);
++ list_for_each_entry(bfqq, &bfqd->idle_list, bfqq_list)
++ bfq_bfqq_end_wr(bfqq);
++ bfq_end_wr_async(bfqd);
++
++ spin_unlock_irq(bfqd->queue->queue_lock);
++}
++
++static int bfq_allow_merge(struct request_queue *q, struct request *rq,
++ struct bio *bio)
++{
++ struct bfq_data *bfqd = q->elevator->elevator_data;
++ struct bfq_io_cq *bic;
++ struct bfq_queue *bfqq;
++
++ /*
++ * Disallow merge of a sync bio into an async request.
++ */
++ if (bfq_bio_sync(bio) && !rq_is_sync(rq))
++ return 0;
++
++ /*
++ * Lookup the bfqq that this bio will be queued with. Allow
++ * merge only if rq is queued there.
++ * Queue lock is held here.
++ */
++ bic = bfq_bic_lookup(bfqd, current->io_context);
++ if (bic == NULL)
++ return 0;
++
++ bfqq = bic_to_bfqq(bic, bfq_bio_sync(bio));
++ return bfqq == RQ_BFQQ(rq);
++}
++
++static void __bfq_set_in_service_queue(struct bfq_data *bfqd,
++ struct bfq_queue *bfqq)
++{
++ if (bfqq != NULL) {
++ bfq_mark_bfqq_must_alloc(bfqq);
++ bfq_mark_bfqq_budget_new(bfqq);
++ bfq_clear_bfqq_fifo_expire(bfqq);
++
++ bfqd->budgets_assigned = (bfqd->budgets_assigned*7 + 256) / 8;
++
++ bfq_log_bfqq(bfqd, bfqq,
++ "set_in_service_queue, cur-budget = %lu",
++ bfqq->entity.budget);
++ }
++
++ bfqd->in_service_queue = bfqq;
++}
++
++/*
++ * Get and set a new queue for service.
++ */
++static struct bfq_queue *bfq_set_in_service_queue(struct bfq_data *bfqd,
++ struct bfq_queue *bfqq)
++{
++ if (!bfqq)
++ bfqq = bfq_get_next_queue(bfqd);
++ else
++ bfq_get_next_queue_forced(bfqd, bfqq);
++
++ __bfq_set_in_service_queue(bfqd, bfqq);
++ return bfqq;
++}
++
++static inline sector_t bfq_dist_from_last(struct bfq_data *bfqd,
++ struct request *rq)
++{
++ if (blk_rq_pos(rq) >= bfqd->last_position)
++ return blk_rq_pos(rq) - bfqd->last_position;
++ else
++ return bfqd->last_position - blk_rq_pos(rq);
++}
++
++/*
++ * Return true if bfqq has no request pending and rq is close enough to
++ * bfqd->last_position, or if rq is closer to bfqd->last_position than
++ * bfqq->next_rq
++ */
++static inline int bfq_rq_close(struct bfq_data *bfqd, struct request *rq)
++{
++ return bfq_dist_from_last(bfqd, rq) <= BFQQ_SEEK_THR;
++}
++
++static struct bfq_queue *bfqq_close(struct bfq_data *bfqd)
++{
++ struct rb_root *root = &bfqd->rq_pos_tree;
++ struct rb_node *parent, *node;
++ struct bfq_queue *__bfqq;
++ sector_t sector = bfqd->last_position;
++
++ if (RB_EMPTY_ROOT(root))
++ return NULL;
++
++ /*
++ * First, if we find a request starting at the end of the last
++ * request, choose it.
++ */
++ __bfqq = bfq_rq_pos_tree_lookup(bfqd, root, sector, &parent, NULL);
++ if (__bfqq != NULL)
++ return __bfqq;
++
++ /*
++ * If the exact sector wasn't found, the parent of the NULL leaf
++ * will contain the closest sector (rq_pos_tree sorted by
++ * next_request position).
++ */
++ __bfqq = rb_entry(parent, struct bfq_queue, pos_node);
++ if (bfq_rq_close(bfqd, __bfqq->next_rq))
++ return __bfqq;
++
++ if (blk_rq_pos(__bfqq->next_rq) < sector)
++ node = rb_next(&__bfqq->pos_node);
++ else
++ node = rb_prev(&__bfqq->pos_node);
++ if (node == NULL)
++ return NULL;
++
++ __bfqq = rb_entry(node, struct bfq_queue, pos_node);
++ if (bfq_rq_close(bfqd, __bfqq->next_rq))
++ return __bfqq;
++
++ return NULL;
++}
++
++/*
++ * bfqd - obvious
++ * cur_bfqq - passed in so that we don't decide that the current queue
++ * is closely cooperating with itself.
++ *
++ * We are assuming that cur_bfqq has dispatched at least one request,
++ * and that bfqd->last_position reflects a position on the disk associated
++ * with the I/O issued by cur_bfqq.
++ */
++static struct bfq_queue *bfq_close_cooperator(struct bfq_data *bfqd,
++ struct bfq_queue *cur_bfqq)
++{
++ struct bfq_queue *bfqq;
++
++ if (bfq_class_idle(cur_bfqq))
++ return NULL;
++ if (!bfq_bfqq_sync(cur_bfqq))
++ return NULL;
++ if (BFQQ_SEEKY(cur_bfqq))
++ return NULL;
++
++ /* If device has only one backlogged bfq_queue, don't search. */
++ if (bfqd->busy_queues == 1)
++ return NULL;
++
++ /*
++ * We should notice if some of the queues are cooperating, e.g.
++ * working closely on the same area of the disk. In that case,
++ * we can group them together and don't waste time idling.
++ */
++ bfqq = bfqq_close(bfqd);
++ if (bfqq == NULL || bfqq == cur_bfqq)
++ return NULL;
++
++ /*
++ * Do not merge queues from different bfq_groups.
++ */
++ if (bfqq->entity.parent != cur_bfqq->entity.parent)
++ return NULL;
++
++ /*
++ * It only makes sense to merge sync queues.
++ */
++ if (!bfq_bfqq_sync(bfqq))
++ return NULL;
++ if (BFQQ_SEEKY(bfqq))
++ return NULL;
++
++ /*
++ * Do not merge queues of different priority classes.
++ */
++ if (bfq_class_rt(bfqq) != bfq_class_rt(cur_bfqq))
++ return NULL;
++
++ return bfqq;
++}
++
++/*
++ * If enough samples have been computed, return the current max budget
++ * stored in bfqd, which is dynamically updated according to the
++ * estimated disk peak rate; otherwise return the default max budget
++ */
++static inline unsigned long bfq_max_budget(struct bfq_data *bfqd)
++{
++ if (bfqd->budgets_assigned < 194)
++ return bfq_default_max_budget;
++ else
++ return bfqd->bfq_max_budget;
++}
++
++/*
++ * Return min budget, which is a fraction of the current or default
++ * max budget (trying with 1/32)
++ */
++static inline unsigned long bfq_min_budget(struct bfq_data *bfqd)
++{
++ if (bfqd->budgets_assigned < 194)
++ return bfq_default_max_budget / 32;
++ else
++ return bfqd->bfq_max_budget / 32;
++}
++
++static void bfq_arm_slice_timer(struct bfq_data *bfqd)
++{
++ struct bfq_queue *bfqq = bfqd->in_service_queue;
++ struct bfq_io_cq *bic;
++ unsigned long sl;
++
++ BUG_ON(!RB_EMPTY_ROOT(&bfqq->sort_list));
++
++ /* Processes have exited, don't wait. */
++ bic = bfqd->in_service_bic;
++ if (bic == NULL || atomic_read(&bic->icq.ioc->active_ref) == 0)
++ return;
++
++ bfq_mark_bfqq_wait_request(bfqq);
++
++ /*
++ * We don't want to idle for seeks, but we do want to allow
++ * fair distribution of slice time for a process doing back-to-back
++ * seeks. So allow a little bit of time for him to submit a new rq.
++ *
++ * To prevent processes with (partly) seeky workloads from
++ * being too ill-treated, grant them a small fraction of the
++ * assigned budget before reducing the waiting time to
++ * BFQ_MIN_TT. This happened to help reduce latency.
++ */
++ sl = bfqd->bfq_slice_idle;
++ /*
++ * Unless the queue is being weight-raised, grant only minimum idle
++ * time if the queue either has been seeky for long enough or has
++ * already proved to be constantly seeky.
++ */
++ if (bfq_sample_valid(bfqq->seek_samples) &&
++ ((BFQQ_SEEKY(bfqq) && bfqq->entity.service >
++ bfq_max_budget(bfqq->bfqd) / 8) ||
++ bfq_bfqq_constantly_seeky(bfqq)) && bfqq->wr_coeff == 1)
++ sl = min(sl, msecs_to_jiffies(BFQ_MIN_TT));
++ else if (bfqq->wr_coeff > 1)
++ sl = sl * 3;
++ bfqd->last_idling_start = ktime_get();
++ mod_timer(&bfqd->idle_slice_timer, jiffies + sl);
++ bfq_log(bfqd, "arm idle: %u/%u ms",
++ jiffies_to_msecs(sl), jiffies_to_msecs(bfqd->bfq_slice_idle));
++}
++
++/*
++ * Set the maximum time for the in-service queue to consume its
++ * budget. This prevents seeky processes from lowering the disk
++ * throughput (always guaranteed with a time slice scheme as in CFQ).
++ */
++static void bfq_set_budget_timeout(struct bfq_data *bfqd)
++{
++ struct bfq_queue *bfqq = bfqd->in_service_queue;
++ unsigned int timeout_coeff;
++ if (bfqq->wr_cur_max_time == bfqd->bfq_wr_rt_max_time)
++ timeout_coeff = 1;
++ else
++ timeout_coeff = bfqq->entity.weight / bfqq->entity.orig_weight;
++
++ bfqd->last_budget_start = ktime_get();
++
++ bfq_clear_bfqq_budget_new(bfqq);
++ bfqq->budget_timeout = jiffies +
++ bfqd->bfq_timeout[bfq_bfqq_sync(bfqq)] * timeout_coeff;
++
++ bfq_log_bfqq(bfqd, bfqq, "set budget_timeout %u",
++ jiffies_to_msecs(bfqd->bfq_timeout[bfq_bfqq_sync(bfqq)] *
++ timeout_coeff));
++}
++
++/*
++ * Move request from internal lists to the request queue dispatch list.
++ */
++static void bfq_dispatch_insert(struct request_queue *q, struct request *rq)
++{
++ struct bfq_data *bfqd = q->elevator->elevator_data;
++ struct bfq_queue *bfqq = RQ_BFQQ(rq);
++
++ /*
++ * For consistency, the next instruction should have been executed
++ * after removing the request from the queue and dispatching it.
++ * We execute instead this instruction before bfq_remove_request()
++ * (and hence introduce a temporary inconsistency), for efficiency.
++ * In fact, in a forced_dispatch, this prevents two counters related
++ * to bfqq->dispatched to risk to be uselessly decremented if bfqq
++ * is not in service, and then to be incremented again after
++ * incrementing bfqq->dispatched.
++ */
++ bfqq->dispatched++;
++ bfq_remove_request(rq);
++ elv_dispatch_sort(q, rq);
++
++ if (bfq_bfqq_sync(bfqq))
++ bfqd->sync_flight++;
++}
++
++/*
++ * Return expired entry, or NULL to just start from scratch in rbtree.
++ */
++static struct request *bfq_check_fifo(struct bfq_queue *bfqq)
++{
++ struct request *rq = NULL;
++
++ if (bfq_bfqq_fifo_expire(bfqq))
++ return NULL;
++
++ bfq_mark_bfqq_fifo_expire(bfqq);
++
++ if (list_empty(&bfqq->fifo))
++ return NULL;
++
++ rq = rq_entry_fifo(bfqq->fifo.next);
++
++ if (time_before(jiffies, rq->fifo_time))
++ return NULL;
++
++ return rq;
++}
++
++/* Must be called with the queue_lock held. */
++static int bfqq_process_refs(struct bfq_queue *bfqq)
++{
++ int process_refs, io_refs;
++
++ io_refs = bfqq->allocated[READ] + bfqq->allocated[WRITE];
++ process_refs = atomic_read(&bfqq->ref) - io_refs - bfqq->entity.on_st;
++ BUG_ON(process_refs < 0);
++ return process_refs;
++}
++
++static void bfq_setup_merge(struct bfq_queue *bfqq, struct bfq_queue *new_bfqq)
++{
++ int process_refs, new_process_refs;
++ struct bfq_queue *__bfqq;
++
++ /*
++ * If there are no process references on the new_bfqq, then it is
++ * unsafe to follow the ->new_bfqq chain as other bfqq's in the chain
++ * may have dropped their last reference (not just their last process
++ * reference).
++ */
++ if (!bfqq_process_refs(new_bfqq))
++ return;
++
++ /* Avoid a circular list and skip interim queue merges. */
++ while ((__bfqq = new_bfqq->new_bfqq)) {
++ if (__bfqq == bfqq)
++ return;
++ new_bfqq = __bfqq;
++ }
++
++ process_refs = bfqq_process_refs(bfqq);
++ new_process_refs = bfqq_process_refs(new_bfqq);
++ /*
++ * If the process for the bfqq has gone away, there is no
++ * sense in merging the queues.
++ */
++ if (process_refs == 0 || new_process_refs == 0)
++ return;
++
++ /*
++ * Merge in the direction of the lesser amount of work.
++ */
++ if (new_process_refs >= process_refs) {
++ bfqq->new_bfqq = new_bfqq;
++ atomic_add(process_refs, &new_bfqq->ref);
++ } else {
++ new_bfqq->new_bfqq = bfqq;
++ atomic_add(new_process_refs, &bfqq->ref);
++ }
++ bfq_log_bfqq(bfqq->bfqd, bfqq, "scheduling merge with queue %d",
++ new_bfqq->pid);
++}
++
++static inline unsigned long bfq_bfqq_budget_left(struct bfq_queue *bfqq)
++{
++ struct bfq_entity *entity = &bfqq->entity;
++ return entity->budget - entity->service;
++}
++
++static void __bfq_bfqq_expire(struct bfq_data *bfqd, struct bfq_queue *bfqq)
++{
++ BUG_ON(bfqq != bfqd->in_service_queue);
++
++ __bfq_bfqd_reset_in_service(bfqd);
++
++ /*
++ * If this bfqq is shared between multiple processes, check
++ * to make sure that those processes are still issuing I/Os
++ * within the mean seek distance. If not, it may be time to
++ * break the queues apart again.
++ */
++ if (bfq_bfqq_coop(bfqq) && BFQQ_SEEKY(bfqq))
++ bfq_mark_bfqq_split_coop(bfqq);
++
++ if (RB_EMPTY_ROOT(&bfqq->sort_list)) {
++ /*
++ * Overloading budget_timeout field to store the time
++ * at which the queue remains with no backlog; used by
++ * the weight-raising mechanism.
++ */
++ bfqq->budget_timeout = jiffies;
++ bfq_del_bfqq_busy(bfqd, bfqq, 1);
++ } else {
++ bfq_activate_bfqq(bfqd, bfqq);
++ /*
++ * Resort priority tree of potential close cooperators.
++ */
++ bfq_rq_pos_tree_add(bfqd, bfqq);
++ }
++}
++
++/**
++ * __bfq_bfqq_recalc_budget - try to adapt the budget to the @bfqq behavior.
++ * @bfqd: device data.
++ * @bfqq: queue to update.
++ * @reason: reason for expiration.
++ *
++ * Handle the feedback on @bfqq budget. See the body for detailed
++ * comments.
++ */
++static void __bfq_bfqq_recalc_budget(struct bfq_data *bfqd,
++ struct bfq_queue *bfqq,
++ enum bfqq_expiration reason)
++{
++ struct request *next_rq;
++ unsigned long budget, min_budget;
++
++ budget = bfqq->max_budget;
++ min_budget = bfq_min_budget(bfqd);
++
++ BUG_ON(bfqq != bfqd->in_service_queue);
++
++ bfq_log_bfqq(bfqd, bfqq, "recalc_budg: last budg %lu, budg left %lu",
++ bfqq->entity.budget, bfq_bfqq_budget_left(bfqq));
++ bfq_log_bfqq(bfqd, bfqq, "recalc_budg: last max_budg %lu, min budg %lu",
++ budget, bfq_min_budget(bfqd));
++ bfq_log_bfqq(bfqd, bfqq, "recalc_budg: sync %d, seeky %d",
++ bfq_bfqq_sync(bfqq), BFQQ_SEEKY(bfqd->in_service_queue));
++
++ if (bfq_bfqq_sync(bfqq)) {
++ switch (reason) {
++ /*
++ * Caveat: in all the following cases we trade latency
++ * for throughput.
++ */
++ case BFQ_BFQQ_TOO_IDLE:
++ /*
++ * This is the only case where we may reduce
++ * the budget: if there is no request of the
++ * process still waiting for completion, then
++ * we assume (tentatively) that the timer has
++ * expired because the batch of requests of
++ * the process could have been served with a
++ * smaller budget. Hence, betting that
++ * process will behave in the same way when it
++ * becomes backlogged again, we reduce its
++ * next budget. As long as we guess right,
++ * this budget cut reduces the latency
++ * experienced by the process.
++ *
++ * However, if there are still outstanding
++ * requests, then the process may have not yet
++ * issued its next request just because it is
++ * still waiting for the completion of some of
++ * the still outstanding ones. So in this
++ * subcase we do not reduce its budget, on the
++ * contrary we increase it to possibly boost
++ * the throughput, as discussed in the
++ * comments to the BUDGET_TIMEOUT case.
++ */
++ if (bfqq->dispatched > 0) /* still outstanding reqs */
++ budget = min(budget * 2, bfqd->bfq_max_budget);
++ else {
++ if (budget > 5 * min_budget)
++ budget -= 4 * min_budget;
++ else
++ budget = min_budget;
++ }
++ break;
++ case BFQ_BFQQ_BUDGET_TIMEOUT:
++ /*
++ * We double the budget here because: 1) it
++ * gives the chance to boost the throughput if
++ * this is not a seeky process (which may have
++ * bumped into this timeout because of, e.g.,
++ * ZBR), 2) together with charge_full_budget
++ * it helps give seeky processes higher
++ * timestamps, and hence be served less
++ * frequently.
++ */
++ budget = min(budget * 2, bfqd->bfq_max_budget);
++ break;
++ case BFQ_BFQQ_BUDGET_EXHAUSTED:
++ /*
++ * The process still has backlog, and did not
++ * let either the budget timeout or the disk
++ * idling timeout expire. Hence it is not
++ * seeky, has a short thinktime and may be
++ * happy with a higher budget too. So
++ * definitely increase the budget of this good
++ * candidate to boost the disk throughput.
++ */
++ budget = min(budget * 4, bfqd->bfq_max_budget);
++ break;
++ case BFQ_BFQQ_NO_MORE_REQUESTS:
++ /*
++ * Leave the budget unchanged.
++ */
++ default:
++ return;
++ }
++ } else /* async queue */
++ /* async queues get always the maximum possible budget
++ * (their ability to dispatch is limited by
++ * @bfqd->bfq_max_budget_async_rq).
++ */
++ budget = bfqd->bfq_max_budget;
++
++ bfqq->max_budget = budget;
++
++ if (bfqd->budgets_assigned >= 194 && bfqd->bfq_user_max_budget == 0 &&
++ bfqq->max_budget > bfqd->bfq_max_budget)
++ bfqq->max_budget = bfqd->bfq_max_budget;
++
++ /*
++ * Make sure that we have enough budget for the next request.
++ * Since the finish time of the bfqq must be kept in sync with
++ * the budget, be sure to call __bfq_bfqq_expire() after the
++ * update.
++ */
++ next_rq = bfqq->next_rq;
++ if (next_rq != NULL)
++ bfqq->entity.budget = max_t(unsigned long, bfqq->max_budget,
++ bfq_serv_to_charge(next_rq, bfqq));
++ else
++ bfqq->entity.budget = bfqq->max_budget;
++
++ bfq_log_bfqq(bfqd, bfqq, "head sect: %u, new budget %lu",
++ next_rq != NULL ? blk_rq_sectors(next_rq) : 0,
++ bfqq->entity.budget);
++}
++
++static unsigned long bfq_calc_max_budget(u64 peak_rate, u64 timeout)
++{
++ unsigned long max_budget;
++
++ /*
++ * The max_budget calculated when autotuning is equal to the
++ * amount of sectors transfered in timeout_sync at the
++ * estimated peak rate.
++ */
++ max_budget = (unsigned long)(peak_rate * 1000 *
++ timeout >> BFQ_RATE_SHIFT);
++
++ return max_budget;
++}
++
++/*
++ * In addition to updating the peak rate, checks whether the process
++ * is "slow", and returns 1 if so. This slow flag is used, in addition
++ * to the budget timeout, to reduce the amount of service provided to
++ * seeky processes, and hence reduce their chances to lower the
++ * throughput. See the code for more details.
++ */
++static int bfq_update_peak_rate(struct bfq_data *bfqd, struct bfq_queue *bfqq,
++ int compensate, enum bfqq_expiration reason)
++{
++ u64 bw, usecs, expected, timeout;
++ ktime_t delta;
++ int update = 0;
++
++ if (!bfq_bfqq_sync(bfqq) || bfq_bfqq_budget_new(bfqq))
++ return 0;
++
++ if (compensate)
++ delta = bfqd->last_idling_start;
++ else
++ delta = ktime_get();
++ delta = ktime_sub(delta, bfqd->last_budget_start);
++ usecs = ktime_to_us(delta);
++
++ /* Don't trust short/unrealistic values. */
++ if (usecs < 100 || usecs >= LONG_MAX)
++ return 0;
++
++ /*
++ * Calculate the bandwidth for the last slice. We use a 64 bit
++ * value to store the peak rate, in sectors per usec in fixed
++ * point math. We do so to have enough precision in the estimate
++ * and to avoid overflows.
++ */
++ bw = (u64)bfqq->entity.service << BFQ_RATE_SHIFT;
++ do_div(bw, (unsigned long)usecs);
++
++ timeout = jiffies_to_msecs(bfqd->bfq_timeout[BLK_RW_SYNC]);
++
++ /*
++ * Use only long (> 20ms) intervals to filter out spikes for
++ * the peak rate estimation.
++ */
++ if (usecs > 20000) {
++ if (bw > bfqd->peak_rate ||
++ (!BFQQ_SEEKY(bfqq) &&
++ reason == BFQ_BFQQ_BUDGET_TIMEOUT)) {
++ bfq_log(bfqd, "measured bw =%llu", bw);
++ /*
++ * To smooth oscillations use a low-pass filter with
++ * alpha=7/8, i.e.,
++ * new_rate = (7/8) * old_rate + (1/8) * bw
++ */
++ do_div(bw, 8);
++ if (bw == 0)
++ return 0;
++ bfqd->peak_rate *= 7;
++ do_div(bfqd->peak_rate, 8);
++ bfqd->peak_rate += bw;
++ update = 1;
++ bfq_log(bfqd, "new peak_rate=%llu", bfqd->peak_rate);
++ }
++
++ update |= bfqd->peak_rate_samples == BFQ_PEAK_RATE_SAMPLES - 1;
++
++ if (bfqd->peak_rate_samples < BFQ_PEAK_RATE_SAMPLES)
++ bfqd->peak_rate_samples++;
++
++ if (bfqd->peak_rate_samples == BFQ_PEAK_RATE_SAMPLES &&
++ update) {
++ int dev_type = blk_queue_nonrot(bfqd->queue);
++ if (bfqd->bfq_user_max_budget == 0) {
++ bfqd->bfq_max_budget =
++ bfq_calc_max_budget(bfqd->peak_rate,
++ timeout);
++ bfq_log(bfqd, "new max_budget=%lu",
++ bfqd->bfq_max_budget);
++ }
++ if (bfqd->device_speed == BFQ_BFQD_FAST &&
++ bfqd->peak_rate < device_speed_thresh[dev_type]) {
++ bfqd->device_speed = BFQ_BFQD_SLOW;
++ bfqd->RT_prod = R_slow[dev_type] *
++ T_slow[dev_type];
++ } else if (bfqd->device_speed == BFQ_BFQD_SLOW &&
++ bfqd->peak_rate > device_speed_thresh[dev_type]) {
++ bfqd->device_speed = BFQ_BFQD_FAST;
++ bfqd->RT_prod = R_fast[dev_type] *
++ T_fast[dev_type];
++ }
++ }
++ }
++
++ /*
++ * If the process has been served for a too short time
++ * interval to let its possible sequential accesses prevail on
++ * the initial seek time needed to move the disk head on the
++ * first sector it requested, then give the process a chance
++ * and for the moment return false.
++ */
++ if (bfqq->entity.budget <= bfq_max_budget(bfqd) / 8)
++ return 0;
++
++ /*
++ * A process is considered ``slow'' (i.e., seeky, so that we
++ * cannot treat it fairly in the service domain, as it would
++ * slow down too much the other processes) if, when a slice
++ * ends for whatever reason, it has received service at a
++ * rate that would not be high enough to complete the budget
++ * before the budget timeout expiration.
++ */
++ expected = bw * 1000 * timeout >> BFQ_RATE_SHIFT;
++
++ /*
++ * Caveat: processes doing IO in the slower disk zones will
++ * tend to be slow(er) even if not seeky. And the estimated
++ * peak rate will actually be an average over the disk
++ * surface. Hence, to not be too harsh with unlucky processes,
++ * we keep a budget/3 margin of safety before declaring a
++ * process slow.
++ */
++ return expected > (4 * bfqq->entity.budget) / 3;
++}
++
++/*
++ * To be deemed as soft real-time, an application must meet two
++ * requirements. First, the application must not require an average
++ * bandwidth higher than the approximate bandwidth required to playback or
++ * record a compressed high-definition video.
++ * The next function is invoked on the completion of the last request of a
++ * batch, to compute the next-start time instant, soft_rt_next_start, such
++ * that, if the next request of the application does not arrive before
++ * soft_rt_next_start, then the above requirement on the bandwidth is met.
++ *
++ * The second requirement is that the request pattern of the application is
++ * isochronous, i.e., that, after issuing a request or a batch of requests,
++ * the application stops issuing new requests until all its pending requests
++ * have been completed. After that, the application may issue a new batch,
++ * and so on.
++ * For this reason the next function is invoked to compute
++ * soft_rt_next_start only for applications that meet this requirement,
++ * whereas soft_rt_next_start is set to infinity for applications that do
++ * not.
++ *
++ * Unfortunately, even a greedy application may happen to behave in an
++ * isochronous way if the CPU load is high. In fact, the application may
++ * stop issuing requests while the CPUs are busy serving other processes,
++ * then restart, then stop again for a while, and so on. In addition, if
++ * the disk achieves a low enough throughput with the request pattern
++ * issued by the application (e.g., because the request pattern is random
++ * and/or the device is slow), then the application may meet the above
++ * bandwidth requirement too. To prevent such a greedy application to be
++ * deemed as soft real-time, a further rule is used in the computation of
++ * soft_rt_next_start: soft_rt_next_start must be higher than the current
++ * time plus the maximum time for which the arrival of a request is waited
++ * for when a sync queue becomes idle, namely bfqd->bfq_slice_idle.
++ * This filters out greedy applications, as the latter issue instead their
++ * next request as soon as possible after the last one has been completed
++ * (in contrast, when a batch of requests is completed, a soft real-time
++ * application spends some time processing data).
++ *
++ * Unfortunately, the last filter may easily generate false positives if
++ * only bfqd->bfq_slice_idle is used as a reference time interval and one
++ * or both the following cases occur:
++ * 1) HZ is so low that the duration of a jiffy is comparable to or higher
++ * than bfqd->bfq_slice_idle. This happens, e.g., on slow devices with
++ * HZ=100.
++ * 2) jiffies, instead of increasing at a constant rate, may stop increasing
++ * for a while, then suddenly 'jump' by several units to recover the lost
++ * increments. This seems to happen, e.g., inside virtual machines.
++ * To address this issue, we do not use as a reference time interval just
++ * bfqd->bfq_slice_idle, but bfqd->bfq_slice_idle plus a few jiffies. In
++ * particular we add the minimum number of jiffies for which the filter
++ * seems to be quite precise also in embedded systems and KVM/QEMU virtual
++ * machines.
++ */
++static inline unsigned long bfq_bfqq_softrt_next_start(struct bfq_data *bfqd,
++ struct bfq_queue *bfqq)
++{
++ return max(bfqq->last_idle_bklogged +
++ HZ * bfqq->service_from_backlogged /
++ bfqd->bfq_wr_max_softrt_rate,
++ jiffies + bfqq->bfqd->bfq_slice_idle + 4);
++}
++
++/*
++ * Return the largest-possible time instant such that, for as long as possible,
++ * the current time will be lower than this time instant according to the macro
++ * time_is_before_jiffies().
++ */
++static inline unsigned long bfq_infinity_from_now(unsigned long now)
++{
++ return now + ULONG_MAX / 2;
++}
++
++/**
++ * bfq_bfqq_expire - expire a queue.
++ * @bfqd: device owning the queue.
++ * @bfqq: the queue to expire.
++ * @compensate: if true, compensate for the time spent idling.
++ * @reason: the reason causing the expiration.
++ *
++ *
++ * If the process associated to the queue is slow (i.e., seeky), or in
++ * case of budget timeout, or, finally, if it is async, we
++ * artificially charge it an entire budget (independently of the
++ * actual service it received). As a consequence, the queue will get
++ * higher timestamps than the correct ones upon reactivation, and
++ * hence it will be rescheduled as if it had received more service
++ * than what it actually received. In the end, this class of processes
++ * will receive less service in proportion to how slowly they consume
++ * their budgets (and hence how seriously they tend to lower the
++ * throughput).
++ *
++ * In contrast, when a queue expires because it has been idling for
++ * too much or because it exhausted its budget, we do not touch the
++ * amount of service it has received. Hence when the queue will be
++ * reactivated and its timestamps updated, the latter will be in sync
++ * with the actual service received by the queue until expiration.
++ *
++ * Charging a full budget to the first type of queues and the exact
++ * service to the others has the effect of using the WF2Q+ policy to
++ * schedule the former on a timeslice basis, without violating the
++ * service domain guarantees of the latter.
++ */
++static void bfq_bfqq_expire(struct bfq_data *bfqd,
++ struct bfq_queue *bfqq,
++ int compensate,
++ enum bfqq_expiration reason)
++{
++ int slow;
++ BUG_ON(bfqq != bfqd->in_service_queue);
++
++ /* Update disk peak rate for autotuning and check whether the
++ * process is slow (see bfq_update_peak_rate).
++ */
++ slow = bfq_update_peak_rate(bfqd, bfqq, compensate, reason);
++
++ /*
++ * As above explained, 'punish' slow (i.e., seeky), timed-out
++ * and async queues, to favor sequential sync workloads.
++ *
++ * Processes doing I/O in the slower disk zones will tend to be
++ * slow(er) even if not seeky. Hence, since the estimated peak
++ * rate is actually an average over the disk surface, these
++ * processes may timeout just for bad luck. To avoid punishing
++ * them we do not charge a full budget to a process that
++ * succeeded in consuming at least 2/3 of its budget.
++ */
++ if (slow || (reason == BFQ_BFQQ_BUDGET_TIMEOUT &&
++ bfq_bfqq_budget_left(bfqq) >= bfqq->entity.budget / 3))
++ bfq_bfqq_charge_full_budget(bfqq);
++
++ bfqq->service_from_backlogged += bfqq->entity.service;
++
++ if (BFQQ_SEEKY(bfqq) && reason == BFQ_BFQQ_BUDGET_TIMEOUT &&
++ !bfq_bfqq_constantly_seeky(bfqq)) {
++ bfq_mark_bfqq_constantly_seeky(bfqq);
++ if (!blk_queue_nonrot(bfqd->queue))
++ bfqd->const_seeky_busy_in_flight_queues++;
++ }
++
++ if (reason == BFQ_BFQQ_TOO_IDLE &&
++ bfqq->entity.service <= 2 * bfqq->entity.budget / 10 )
++ bfq_clear_bfqq_IO_bound(bfqq);
++
++ if (bfqd->low_latency && bfqq->wr_coeff == 1)
++ bfqq->last_wr_start_finish = jiffies;
++
++ if (bfqd->low_latency && bfqd->bfq_wr_max_softrt_rate > 0 &&
++ RB_EMPTY_ROOT(&bfqq->sort_list)) {
++ /*
++ * If we get here, and there are no outstanding requests,
++ * then the request pattern is isochronous (see the comments
++ * to the function bfq_bfqq_softrt_next_start()). Hence we
++ * can compute soft_rt_next_start. If, instead, the queue
++ * still has outstanding requests, then we have to wait
++ * for the completion of all the outstanding requests to
++ * discover whether the request pattern is actually
++ * isochronous.
++ */
++ if (bfqq->dispatched == 0)
++ bfqq->soft_rt_next_start =
++ bfq_bfqq_softrt_next_start(bfqd, bfqq);
++ else {
++ /*
++ * The application is still waiting for the
++ * completion of one or more requests:
++ * prevent it from possibly being incorrectly
++ * deemed as soft real-time by setting its
++ * soft_rt_next_start to infinity. In fact,
++ * without this assignment, the application
++ * would be incorrectly deemed as soft
++ * real-time if:
++ * 1) it issued a new request before the
++ * completion of all its in-flight
++ * requests, and
++ * 2) at that time, its soft_rt_next_start
++ * happened to be in the past.
++ */
++ bfqq->soft_rt_next_start =
++ bfq_infinity_from_now(jiffies);
++ /*
++ * Schedule an update of soft_rt_next_start to when
++ * the task may be discovered to be isochronous.
++ */
++ bfq_mark_bfqq_softrt_update(bfqq);
++ }
++ }
++
++ bfq_log_bfqq(bfqd, bfqq,
++ "expire (%d, slow %d, num_disp %d, idle_win %d)", reason,
++ slow, bfqq->dispatched, bfq_bfqq_idle_window(bfqq));
++
++ /*
++ * Increase, decrease or leave budget unchanged according to
++ * reason.
++ */
++ __bfq_bfqq_recalc_budget(bfqd, bfqq, reason);
++ __bfq_bfqq_expire(bfqd, bfqq);
++}
++
++/*
++ * Budget timeout is not implemented through a dedicated timer, but
++ * just checked on request arrivals and completions, as well as on
++ * idle timer expirations.
++ */
++static int bfq_bfqq_budget_timeout(struct bfq_queue *bfqq)
++{
++ if (bfq_bfqq_budget_new(bfqq) ||
++ time_before(jiffies, bfqq->budget_timeout))
++ return 0;
++ return 1;
++}
++
++/*
++ * If we expire a queue that is waiting for the arrival of a new
++ * request, we may prevent the fictitious timestamp back-shifting that
++ * allows the guarantees of the queue to be preserved (see [1] for
++ * this tricky aspect). Hence we return true only if this condition
++ * does not hold, or if the queue is slow enough to deserve only to be
++ * kicked off for preserving a high throughput.
++*/
++static inline int bfq_may_expire_for_budg_timeout(struct bfq_queue *bfqq)
++{
++ bfq_log_bfqq(bfqq->bfqd, bfqq,
++ "may_budget_timeout: wait_request %d left %d timeout %d",
++ bfq_bfqq_wait_request(bfqq),
++ bfq_bfqq_budget_left(bfqq) >= bfqq->entity.budget / 3,
++ bfq_bfqq_budget_timeout(bfqq));
++
++ return (!bfq_bfqq_wait_request(bfqq) ||
++ bfq_bfqq_budget_left(bfqq) >= bfqq->entity.budget / 3)
++ &&
++ bfq_bfqq_budget_timeout(bfqq);
++}
++
++/*
++ * Device idling is allowed only for the queues for which this function
++ * returns true. For this reason, the return value of this function plays a
++ * critical role for both throughput boosting and service guarantees. The
++ * return value is computed through a logical expression. In this rather
++ * long comment, we try to briefly describe all the details and motivations
++ * behind the components of this logical expression.
++ *
++ * First, the expression is false if bfqq is not sync, or if: bfqq happened
++ * to become active during a large burst of queue activations, and the
++ * pattern of requests bfqq contains boosts the throughput if bfqq is
++ * expired. In fact, queues that became active during a large burst benefit
++ * only from throughput, as discussed in the comments to bfq_handle_burst.
++ * In this respect, expiring bfqq certainly boosts the throughput on NCQ-
++ * capable flash-based devices, whereas, on rotational devices, it boosts
++ * the throughput only if bfqq contains random requests.
++ *
++ * On the opposite end, if (a) bfqq is sync, (b) the above burst-related
++ * condition does not hold, and (c) bfqq is being weight-raised, then the
++ * expression always evaluates to true, as device idling is instrumental
++ * for preserving low-latency guarantees (see [1]). If, instead, conditions
++ * (a) and (b) do hold, but (c) does not, then the expression evaluates to
++ * true only if: (1) bfqq is I/O-bound and has a non-null idle window, and
++ * (2) at least one of the following two conditions holds.
++ * The first condition is that the device is not performing NCQ, because
++ * idling the device most certainly boosts the throughput if this condition
++ * holds and bfqq is I/O-bound and has been granted a non-null idle window.
++ * The second compound condition is made of the logical AND of two components.
++ *
++ * The first component is true only if there is no weight-raised busy
++ * queue. This guarantees that the device is not idled for a sync non-
++ * weight-raised queue when there are busy weight-raised queues. The former
++ * is then expired immediately if empty. Combined with the timestamping
++ * rules of BFQ (see [1] for details), this causes sync non-weight-raised
++ * queues to get a lower number of requests served, and hence to ask for a
++ * lower number of requests from the request pool, before the busy weight-
++ * raised queues get served again.
++ *
++ * This is beneficial for the processes associated with weight-raised
++ * queues, when the request pool is saturated (e.g., in the presence of
++ * write hogs). In fact, if the processes associated with the other queues
++ * ask for requests at a lower rate, then weight-raised processes have a
++ * higher probability to get a request from the pool immediately (or at
++ * least soon) when they need one. Hence they have a higher probability to
++ * actually get a fraction of the disk throughput proportional to their
++ * high weight. This is especially true with NCQ-capable drives, which
++ * enqueue several requests in advance and further reorder internally-
++ * queued requests.
++ *
++ * In the end, mistreating non-weight-raised queues when there are busy
++ * weight-raised queues seems to mitigate starvation problems in the
++ * presence of heavy write workloads and NCQ, and hence to guarantee a
++ * higher application and system responsiveness in these hostile scenarios.
++ *
++ * If the first component of the compound condition is instead true, i.e.,
++ * there is no weight-raised busy queue, then the second component of the
++ * compound condition takes into account service-guarantee and throughput
++ * issues related to NCQ (recall that the compound condition is evaluated
++ * only if the device is detected as supporting NCQ).
++ *
++ * As for service guarantees, allowing the drive to enqueue more than one
++ * request at a time, and hence delegating de facto final scheduling
++ * decisions to the drive's internal scheduler, causes loss of control on
++ * the actual request service order. In this respect, when the drive is
++ * allowed to enqueue more than one request at a time, the service
++ * distribution enforced by the drive's internal scheduler is likely to
++ * coincide with the desired device-throughput distribution only in the
++ * following, perfectly symmetric, scenario:
++ * 1) all active queues have the same weight,
++ * 2) all active groups at the same level in the groups tree have the same
++ * weight,
++ * 3) all active groups at the same level in the groups tree have the same
++ * number of children.
++ *
++ * Even in such a scenario, sequential I/O may still receive a preferential
++ * treatment, but this is not likely to be a big issue with flash-based
++ * devices, because of their non-dramatic loss of throughput with random
++ * I/O. Things do differ with HDDs, for which additional care is taken, as
++ * explained after completing the discussion for flash-based devices.
++ *
++ * Unfortunately, keeping the necessary state for evaluating exactly the
++ * above symmetry conditions would be quite complex and time-consuming.
++ * Therefore BFQ evaluates instead the following stronger sub-conditions,
++ * for which it is much easier to maintain the needed state:
++ * 1) all active queues have the same weight,
++ * 2) all active groups have the same weight,
++ * 3) all active groups have at most one active child each.
++ * In particular, the last two conditions are always true if hierarchical
++ * support and the cgroups interface are not enabled, hence no state needs
++ * to be maintained in this case.
++ *
++ * According to the above considerations, the second component of the
++ * compound condition evaluates to true if any of the above symmetry
++ * sub-condition does not hold, or the device is not flash-based. Therefore,
++ * if also the first component is true, then idling is allowed for a sync
++ * queue. These are the only sub-conditions considered if the device is
++ * flash-based, as, for such a device, it is sensible to force idling only
++ * for service-guarantee issues. In fact, as for throughput, idling
++ * NCQ-capable flash-based devices would not boost the throughput even
++ * with sequential I/O; rather it would lower the throughput in proportion
++ * to how fast the device is. In the end, (only) if all the three
++ * sub-conditions hold and the device is flash-based, the compound
++ * condition evaluates to false and therefore no idling is performed.
++ *
++ * As already said, things change with a rotational device, where idling
++ * boosts the throughput with sequential I/O (even with NCQ). Hence, for
++ * such a device the second component of the compound condition evaluates
++ * to true also if the following additional sub-condition does not hold:
++ * the queue is constantly seeky. Unfortunately, this different behavior
++ * with respect to flash-based devices causes an additional asymmetry: if
++ * some sync queues enjoy idling and some other sync queues do not, then
++ * the latter get a low share of the device throughput, simply because the
++ * former get many requests served after being set as in service, whereas
++ * the latter do not. As a consequence, to guarantee the desired throughput
++ * distribution, on HDDs the compound expression evaluates to true (and
++ * hence device idling is performed) also if the following last symmetry
++ * condition does not hold: no other queue is benefiting from idling. Also
++ * this last condition is actually replaced with a simpler-to-maintain and
++ * stronger condition: there is no busy queue which is not constantly seeky
++ * (and hence may also benefit from idling).
++ *
++ * To sum up, when all the required symmetry and throughput-boosting
++ * sub-conditions hold, the second component of the compound condition
++ * evaluates to false, and hence no idling is performed. This helps to
++ * keep the drives' internal queues full on NCQ-capable devices, and hence
++ * to boost the throughput, without causing 'almost' any loss of service
++ * guarantees. The 'almost' follows from the fact that, if the internal
++ * queue of one such device is filled while all the sub-conditions hold,
++ * but at some point in time some sub-condition stops to hold, then it may
++ * become impossible to let requests be served in the new desired order
++ * until all the requests already queued in the device have been served.
++ */
++static inline bool bfq_bfqq_must_not_expire(struct bfq_queue *bfqq)
++{
++ struct bfq_data *bfqd = bfqq->bfqd;
++#ifdef CONFIG_CGROUP_BFQIO
++#define symmetric_scenario (!bfqd->active_numerous_groups && \
++ !bfq_differentiated_weights(bfqd))
++#else
++#define symmetric_scenario (!bfq_differentiated_weights(bfqd))
++#endif
++#define cond_for_seeky_on_ncq_hdd (bfq_bfqq_constantly_seeky(bfqq) && \
++ bfqd->busy_in_flight_queues == \
++ bfqd->const_seeky_busy_in_flight_queues)
++
++#define cond_for_expiring_in_burst (bfq_bfqq_in_large_burst(bfqq) && \
++ bfqd->hw_tag && \
++ (blk_queue_nonrot(bfqd->queue) || \
++ bfq_bfqq_constantly_seeky(bfqq)))
++
++/*
++ * Condition for expiring a non-weight-raised queue (and hence not idling
++ * the device).
++ */
++#define cond_for_expiring_non_wr (bfqd->hw_tag && \
++ (bfqd->wr_busy_queues > 0 || \
++ (symmetric_scenario && \
++ (blk_queue_nonrot(bfqd->queue) || \
++ cond_for_seeky_on_ncq_hdd))))
++
++ return bfq_bfqq_sync(bfqq) &&
++ !cond_for_expiring_in_burst &&
++ (bfqq->wr_coeff > 1 ||
++ (bfq_bfqq_IO_bound(bfqq) && bfq_bfqq_idle_window(bfqq) &&
++ !cond_for_expiring_non_wr)
++ );
++}
++
++/*
++ * If the in-service queue is empty but sync, and the function
++ * bfq_bfqq_must_not_expire returns true, then:
++ * 1) the queue must remain in service and cannot be expired, and
++ * 2) the disk must be idled to wait for the possible arrival of a new
++ * request for the queue.
++ * See the comments to the function bfq_bfqq_must_not_expire for the reasons
++ * why performing device idling is the best choice to boost the throughput
++ * and preserve service guarantees when bfq_bfqq_must_not_expire itself
++ * returns true.
++ */
++static inline bool bfq_bfqq_must_idle(struct bfq_queue *bfqq)
++{
++ struct bfq_data *bfqd = bfqq->bfqd;
++
++ return RB_EMPTY_ROOT(&bfqq->sort_list) && bfqd->bfq_slice_idle != 0 &&
++ bfq_bfqq_must_not_expire(bfqq);
++}
++
++/*
++ * Select a queue for service. If we have a current queue in service,
++ * check whether to continue servicing it, or retrieve and set a new one.
++ */
++static struct bfq_queue *bfq_select_queue(struct bfq_data *bfqd)
++{
++ struct bfq_queue *bfqq, *new_bfqq = NULL;
++ struct request *next_rq;
++ enum bfqq_expiration reason = BFQ_BFQQ_BUDGET_TIMEOUT;
++
++ bfqq = bfqd->in_service_queue;
++ if (bfqq == NULL)
++ goto new_queue;
++
++ bfq_log_bfqq(bfqd, bfqq, "select_queue: already in-service queue");
++
++ /*
++ * If another queue has a request waiting within our mean seek
++ * distance, let it run. The expire code will check for close
++ * cooperators and put the close queue at the front of the
++ * service tree. If possible, merge the expiring queue with the
++ * new bfqq.
++ */
++ new_bfqq = bfq_close_cooperator(bfqd, bfqq);
++ if (new_bfqq != NULL && bfqq->new_bfqq == NULL)
++ bfq_setup_merge(bfqq, new_bfqq);
++
++ if (bfq_may_expire_for_budg_timeout(bfqq) &&
++ !timer_pending(&bfqd->idle_slice_timer) &&
++ !bfq_bfqq_must_idle(bfqq))
++ goto expire;
++
++ next_rq = bfqq->next_rq;
++ /*
++ * If bfqq has requests queued and it has enough budget left to
++ * serve them, keep the queue, otherwise expire it.
++ */
++ if (next_rq != NULL) {
++ if (bfq_serv_to_charge(next_rq, bfqq) >
++ bfq_bfqq_budget_left(bfqq)) {
++ reason = BFQ_BFQQ_BUDGET_EXHAUSTED;
++ goto expire;
++ } else {
++ /*
++ * The idle timer may be pending because we may
++ * not disable disk idling even when a new request
++ * arrives.
++ */
++ if (timer_pending(&bfqd->idle_slice_timer)) {
++ /*
++ * If we get here: 1) at least a new request
++ * has arrived but we have not disabled the
++ * timer because the request was too small,
++ * 2) then the block layer has unplugged
++ * the device, causing the dispatch to be
++ * invoked.
++ *
++ * Since the device is unplugged, now the
++ * requests are probably large enough to
++ * provide a reasonable throughput.
++ * So we disable idling.
++ */
++ bfq_clear_bfqq_wait_request(bfqq);
++ del_timer(&bfqd->idle_slice_timer);
++ }
++ if (new_bfqq == NULL)
++ goto keep_queue;
++ else
++ goto expire;
++ }
++ }
++
++ /*
++ * No requests pending. If the in-service queue still has requests
++ * in flight (possibly waiting for a completion) or is idling for a
++ * new request, then keep it.
++ */
++ if (new_bfqq == NULL && (timer_pending(&bfqd->idle_slice_timer) ||
++ (bfqq->dispatched != 0 && bfq_bfqq_must_not_expire(bfqq)))) {
++ bfqq = NULL;
++ goto keep_queue;
++ } else if (new_bfqq != NULL && timer_pending(&bfqd->idle_slice_timer)) {
++ /*
++ * Expiring the queue because there is a close cooperator,
++ * cancel timer.
++ */
++ bfq_clear_bfqq_wait_request(bfqq);
++ del_timer(&bfqd->idle_slice_timer);
++ }
++
++ reason = BFQ_BFQQ_NO_MORE_REQUESTS;
++expire:
++ bfq_bfqq_expire(bfqd, bfqq, 0, reason);
++new_queue:
++ bfqq = bfq_set_in_service_queue(bfqd, new_bfqq);
++ bfq_log(bfqd, "select_queue: new queue %d returned",
++ bfqq != NULL ? bfqq->pid : 0);
++keep_queue:
++ return bfqq;
++}
++
++static void bfq_update_wr_data(struct bfq_data *bfqd,
++ struct bfq_queue *bfqq)
++{
++ if (bfqq->wr_coeff > 1) { /* queue is being boosted */
++ struct bfq_entity *entity = &bfqq->entity;
++
++ bfq_log_bfqq(bfqd, bfqq,
++ "raising period dur %u/%u msec, old coeff %u, w %d(%d)",
++ jiffies_to_msecs(jiffies -
++ bfqq->last_wr_start_finish),
++ jiffies_to_msecs(bfqq->wr_cur_max_time),
++ bfqq->wr_coeff,
++ bfqq->entity.weight, bfqq->entity.orig_weight);
++
++ BUG_ON(bfqq != bfqd->in_service_queue && entity->weight !=
++ entity->orig_weight * bfqq->wr_coeff);
++ if (entity->ioprio_changed)
++ bfq_log_bfqq(bfqd, bfqq, "WARN: pending prio change");
++ /*
++ * If the queue was activated in a burst, or
++ * too much time has elapsed from the beginning
++ * of this weight-raising, then end weight raising.
++ */
++ if (bfq_bfqq_in_large_burst(bfqq) ||
++ time_is_before_jiffies(bfqq->last_wr_start_finish +
++ bfqq->wr_cur_max_time)) {
++ bfqq->last_wr_start_finish = jiffies;
++ bfq_log_bfqq(bfqd, bfqq,
++ "wrais ending at %lu, rais_max_time %u",
++ bfqq->last_wr_start_finish,
++ jiffies_to_msecs(bfqq->wr_cur_max_time));
++ bfq_bfqq_end_wr(bfqq);
++ __bfq_entity_update_weight_prio(
++ bfq_entity_service_tree(entity),
++ entity);
++ }
++ }
++}
++
++/*
++ * Dispatch one request from bfqq, moving it to the request queue
++ * dispatch list.
++ */
++static int bfq_dispatch_request(struct bfq_data *bfqd,
++ struct bfq_queue *bfqq)
++{
++ int dispatched = 0;
++ struct request *rq;
++ unsigned long service_to_charge;
++
++ BUG_ON(RB_EMPTY_ROOT(&bfqq->sort_list));
++
++ /* Follow expired path, else get first next available. */
++ rq = bfq_check_fifo(bfqq);
++ if (rq == NULL)
++ rq = bfqq->next_rq;
++ service_to_charge = bfq_serv_to_charge(rq, bfqq);
++
++ if (service_to_charge > bfq_bfqq_budget_left(bfqq)) {
++ /*
++ * This may happen if the next rq is chosen in fifo order
++ * instead of sector order. The budget is properly
++ * dimensioned to be always sufficient to serve the next
++ * request only if it is chosen in sector order. The reason
++ * is that it would be quite inefficient and little useful
++ * to always make sure that the budget is large enough to
++ * serve even the possible next rq in fifo order.
++ * In fact, requests are seldom served in fifo order.
++ *
++ * Expire the queue for budget exhaustion, and make sure
++ * that the next act_budget is enough to serve the next
++ * request, even if it comes from the fifo expired path.
++ */
++ bfqq->next_rq = rq;
++ /*
++ * Since this dispatch is failed, make sure that
++ * a new one will be performed
++ */
++ if (!bfqd->rq_in_driver)
++ bfq_schedule_dispatch(bfqd);
++ goto expire;
++ }
++
++ /* Finally, insert request into driver dispatch list. */
++ bfq_bfqq_served(bfqq, service_to_charge);
++ bfq_dispatch_insert(bfqd->queue, rq);
++
++ bfq_update_wr_data(bfqd, bfqq);
++
++ bfq_log_bfqq(bfqd, bfqq,
++ "dispatched %u sec req (%llu), budg left %lu",
++ blk_rq_sectors(rq),
++ (long long unsigned)blk_rq_pos(rq),
++ bfq_bfqq_budget_left(bfqq));
++
++ dispatched++;
++
++ if (bfqd->in_service_bic == NULL) {
++ atomic_long_inc(&RQ_BIC(rq)->icq.ioc->refcount);
++ bfqd->in_service_bic = RQ_BIC(rq);
++ }
++
++ if (bfqd->busy_queues > 1 && ((!bfq_bfqq_sync(bfqq) &&
++ dispatched >= bfqd->bfq_max_budget_async_rq) ||
++ bfq_class_idle(bfqq)))
++ goto expire;
++
++ return dispatched;
++
++expire:
++ bfq_bfqq_expire(bfqd, bfqq, 0, BFQ_BFQQ_BUDGET_EXHAUSTED);
++ return dispatched;
++}
++
++static int __bfq_forced_dispatch_bfqq(struct bfq_queue *bfqq)
++{
++ int dispatched = 0;
++
++ while (bfqq->next_rq != NULL) {
++ bfq_dispatch_insert(bfqq->bfqd->queue, bfqq->next_rq);
++ dispatched++;
++ }
++
++ BUG_ON(!list_empty(&bfqq->fifo));
++ return dispatched;
++}
++
++/*
++ * Drain our current requests.
++ * Used for barriers and when switching io schedulers on-the-fly.
++ */
++static int bfq_forced_dispatch(struct bfq_data *bfqd)
++{
++ struct bfq_queue *bfqq, *n;
++ struct bfq_service_tree *st;
++ int dispatched = 0;
++
++ bfqq = bfqd->in_service_queue;
++ if (bfqq != NULL)
++ __bfq_bfqq_expire(bfqd, bfqq);
++
++ /*
++ * Loop through classes, and be careful to leave the scheduler
++ * in a consistent state, as feedback mechanisms and vtime
++ * updates cannot be disabled during the process.
++ */
++ list_for_each_entry_safe(bfqq, n, &bfqd->active_list, bfqq_list) {
++ st = bfq_entity_service_tree(&bfqq->entity);
++
++ dispatched += __bfq_forced_dispatch_bfqq(bfqq);
++ bfqq->max_budget = bfq_max_budget(bfqd);
++
++ bfq_forget_idle(st);
++ }
++
++ BUG_ON(bfqd->busy_queues != 0);
++
++ return dispatched;
++}
++
++static int bfq_dispatch_requests(struct request_queue *q, int force)
++{
++ struct bfq_data *bfqd = q->elevator->elevator_data;
++ struct bfq_queue *bfqq;
++ int max_dispatch;
++
++ bfq_log(bfqd, "dispatch requests: %d busy queues", bfqd->busy_queues);
++ if (bfqd->busy_queues == 0)
++ return 0;
++
++ if (unlikely(force))
++ return bfq_forced_dispatch(bfqd);
++
++ bfqq = bfq_select_queue(bfqd);
++ if (bfqq == NULL)
++ return 0;
++
++ max_dispatch = bfqd->bfq_quantum;
++ if (bfq_class_idle(bfqq))
++ max_dispatch = 1;
++
++ if (!bfq_bfqq_sync(bfqq))
++ max_dispatch = bfqd->bfq_max_budget_async_rq;
++
++ if (bfqq->dispatched >= max_dispatch) {
++ if (bfqd->busy_queues > 1)
++ return 0;
++ if (bfqq->dispatched >= 4 * max_dispatch)
++ return 0;
++ }
++
++ if (bfqd->sync_flight != 0 && !bfq_bfqq_sync(bfqq))
++ return 0;
++
++ bfq_clear_bfqq_wait_request(bfqq);
++ BUG_ON(timer_pending(&bfqd->idle_slice_timer));
++
++ if (!bfq_dispatch_request(bfqd, bfqq))
++ return 0;
++
++ bfq_log_bfqq(bfqd, bfqq, "dispatched one request of %d (max_disp %d)",
++ bfqq->pid, max_dispatch);
++
++ return 1;
++}
++
++/*
++ * Task holds one reference to the queue, dropped when task exits. Each rq
++ * in-flight on this queue also holds a reference, dropped when rq is freed.
++ *
++ * Queue lock must be held here.
++ */
++static void bfq_put_queue(struct bfq_queue *bfqq)
++{
++ struct bfq_data *bfqd = bfqq->bfqd;
++
++ BUG_ON(atomic_read(&bfqq->ref) <= 0);
++
++ bfq_log_bfqq(bfqd, bfqq, "put_queue: %p %d", bfqq,
++ atomic_read(&bfqq->ref));
++ if (!atomic_dec_and_test(&bfqq->ref))
++ return;
++
++ BUG_ON(rb_first(&bfqq->sort_list) != NULL);
++ BUG_ON(bfqq->allocated[READ] + bfqq->allocated[WRITE] != 0);
++ BUG_ON(bfqq->entity.tree != NULL);
++ BUG_ON(bfq_bfqq_busy(bfqq));
++ BUG_ON(bfqd->in_service_queue == bfqq);
++
++ if (bfq_bfqq_sync(bfqq))
++ /*
++ * The fact that this queue is being destroyed does not
++ * invalidate the fact that this queue may have been
++ * activated during the current burst. As a consequence,
++ * although the queue does not exist anymore, and hence
++ * needs to be removed from the burst list if there,
++ * the burst size has not to be decremented.
++ */
++ hlist_del_init(&bfqq->burst_list_node);
++
++ bfq_log_bfqq(bfqd, bfqq, "put_queue: %p freed", bfqq);
++
++ kmem_cache_free(bfq_pool, bfqq);
++}
++
++static void bfq_put_cooperator(struct bfq_queue *bfqq)
++{
++ struct bfq_queue *__bfqq, *next;
++
++ /*
++ * If this queue was scheduled to merge with another queue, be
++ * sure to drop the reference taken on that queue (and others in
++ * the merge chain). See bfq_setup_merge and bfq_merge_bfqqs.
++ */
++ __bfqq = bfqq->new_bfqq;
++ while (__bfqq) {
++ if (__bfqq == bfqq)
++ break;
++ next = __bfqq->new_bfqq;
++ bfq_put_queue(__bfqq);
++ __bfqq = next;
++ }
++}
++
++static void bfq_exit_bfqq(struct bfq_data *bfqd, struct bfq_queue *bfqq)
++{
++ if (bfqq == bfqd->in_service_queue) {
++ __bfq_bfqq_expire(bfqd, bfqq);
++ bfq_schedule_dispatch(bfqd);
++ }
++
++ bfq_log_bfqq(bfqd, bfqq, "exit_bfqq: %p, %d", bfqq,
++ atomic_read(&bfqq->ref));
++
++ bfq_put_cooperator(bfqq);
++
++ bfq_put_queue(bfqq);
++}
++
++static inline void bfq_init_icq(struct io_cq *icq)
++{
++ struct bfq_io_cq *bic = icq_to_bic(icq);
++
++ bic->ttime.last_end_request = jiffies;
++}
++
++static void bfq_exit_icq(struct io_cq *icq)
++{
++ struct bfq_io_cq *bic = icq_to_bic(icq);
++ struct bfq_data *bfqd = bic_to_bfqd(bic);
++
++ if (bic->bfqq[BLK_RW_ASYNC]) {
++ bfq_exit_bfqq(bfqd, bic->bfqq[BLK_RW_ASYNC]);
++ bic->bfqq[BLK_RW_ASYNC] = NULL;
++ }
++
++ if (bic->bfqq[BLK_RW_SYNC]) {
++ bfq_exit_bfqq(bfqd, bic->bfqq[BLK_RW_SYNC]);
++ bic->bfqq[BLK_RW_SYNC] = NULL;
++ }
++}
++
++/*
++ * Update the entity prio values; note that the new values will not
++ * be used until the next (re)activation.
++ */
++static void bfq_init_prio_data(struct bfq_queue *bfqq, struct bfq_io_cq *bic)
++{
++ struct task_struct *tsk = current;
++ int ioprio_class;
++
++ if (!bfq_bfqq_prio_changed(bfqq))
++ return;
++
++ ioprio_class = IOPRIO_PRIO_CLASS(bic->ioprio);
++ switch (ioprio_class) {
++ default:
++ dev_err(bfqq->bfqd->queue->backing_dev_info.dev,
++ "bfq: bad prio %x\n", ioprio_class);
++ case IOPRIO_CLASS_NONE:
++ /*
++ * No prio set, inherit CPU scheduling settings.
++ */
++ bfqq->entity.new_ioprio = task_nice_ioprio(tsk);
++ bfqq->entity.new_ioprio_class = task_nice_ioclass(tsk);
++ break;
++ case IOPRIO_CLASS_RT:
++ bfqq->entity.new_ioprio = IOPRIO_PRIO_DATA(bic->ioprio);
++ bfqq->entity.new_ioprio_class = IOPRIO_CLASS_RT;
++ break;
++ case IOPRIO_CLASS_BE:
++ bfqq->entity.new_ioprio = IOPRIO_PRIO_DATA(bic->ioprio);
++ bfqq->entity.new_ioprio_class = IOPRIO_CLASS_BE;
++ break;
++ case IOPRIO_CLASS_IDLE:
++ bfqq->entity.new_ioprio_class = IOPRIO_CLASS_IDLE;
++ bfqq->entity.new_ioprio = 7;
++ bfq_clear_bfqq_idle_window(bfqq);
++ break;
++ }
++
++ bfqq->entity.ioprio_changed = 1;
++
++ bfq_clear_bfqq_prio_changed(bfqq);
++}
++
++static void bfq_changed_ioprio(struct bfq_io_cq *bic)
++{
++ struct bfq_data *bfqd;
++ struct bfq_queue *bfqq, *new_bfqq;
++ struct bfq_group *bfqg;
++ unsigned long uninitialized_var(flags);
++ int ioprio = bic->icq.ioc->ioprio;
++
++ bfqd = bfq_get_bfqd_locked(&(bic->icq.q->elevator->elevator_data),
++ &flags);
++ /*
++ * This condition may trigger on a newly created bic, be sure to
++ * drop the lock before returning.
++ */
++ if (unlikely(bfqd == NULL) || likely(bic->ioprio == ioprio))
++ goto out;
++
++ bfqq = bic->bfqq[BLK_RW_ASYNC];
++ if (bfqq != NULL) {
++ bfqg = container_of(bfqq->entity.sched_data, struct bfq_group,
++ sched_data);
++ new_bfqq = bfq_get_queue(bfqd, bfqg, BLK_RW_ASYNC, bic,
++ GFP_ATOMIC);
++ if (new_bfqq != NULL) {
++ bic->bfqq[BLK_RW_ASYNC] = new_bfqq;
++ bfq_log_bfqq(bfqd, bfqq,
++ "changed_ioprio: bfqq %p %d",
++ bfqq, atomic_read(&bfqq->ref));
++ bfq_put_queue(bfqq);
++ }
++ }
++
++ bfqq = bic->bfqq[BLK_RW_SYNC];
++ if (bfqq != NULL)
++ bfq_mark_bfqq_prio_changed(bfqq);
++
++ bic->ioprio = ioprio;
++
++out:
++ bfq_put_bfqd_unlock(bfqd, &flags);
++}
++
++static void bfq_init_bfqq(struct bfq_data *bfqd, struct bfq_queue *bfqq,
++ pid_t pid, int is_sync)
++{
++ RB_CLEAR_NODE(&bfqq->entity.rb_node);
++ INIT_LIST_HEAD(&bfqq->fifo);
++ INIT_HLIST_NODE(&bfqq->burst_list_node);
++
++ atomic_set(&bfqq->ref, 0);
++ bfqq->bfqd = bfqd;
++
++ bfq_mark_bfqq_prio_changed(bfqq);
++
++ if (is_sync) {
++ if (!bfq_class_idle(bfqq))
++ bfq_mark_bfqq_idle_window(bfqq);
++ bfq_mark_bfqq_sync(bfqq);
++ }
++ bfq_mark_bfqq_IO_bound(bfqq);
++
++ /* Tentative initial value to trade off between thr and lat */
++ bfqq->max_budget = (2 * bfq_max_budget(bfqd)) / 3;
++ bfqq->pid = pid;
++
++ bfqq->wr_coeff = 1;
++ bfqq->last_wr_start_finish = 0;
++ /*
++ * Set to the value for which bfqq will not be deemed as
++ * soft rt when it becomes backlogged.
++ */
++ bfqq->soft_rt_next_start = bfq_infinity_from_now(jiffies);
++}
++
++static struct bfq_queue *bfq_find_alloc_queue(struct bfq_data *bfqd,
++ struct bfq_group *bfqg,
++ int is_sync,
++ struct bfq_io_cq *bic,
++ gfp_t gfp_mask)
++{
++ struct bfq_queue *bfqq, *new_bfqq = NULL;
++
++retry:
++ /* bic always exists here */
++ bfqq = bic_to_bfqq(bic, is_sync);
++
++ /*
++ * Always try a new alloc if we fall back to the OOM bfqq
++ * originally, since it should just be a temporary situation.
++ */
++ if (bfqq == NULL || bfqq == &bfqd->oom_bfqq) {
++ bfqq = NULL;
++ if (new_bfqq != NULL) {
++ bfqq = new_bfqq;
++ new_bfqq = NULL;
++ } else if (gfp_mask & __GFP_WAIT) {
++ spin_unlock_irq(bfqd->queue->queue_lock);
++ new_bfqq = kmem_cache_alloc_node(bfq_pool,
++ gfp_mask | __GFP_ZERO,
++ bfqd->queue->node);
++ spin_lock_irq(bfqd->queue->queue_lock);
++ if (new_bfqq != NULL)
++ goto retry;
++ } else {
++ bfqq = kmem_cache_alloc_node(bfq_pool,
++ gfp_mask | __GFP_ZERO,
++ bfqd->queue->node);
++ }
++
++ if (bfqq != NULL) {
++ bfq_init_bfqq(bfqd, bfqq, current->pid, is_sync);
++ bfq_log_bfqq(bfqd, bfqq, "allocated");
++ } else {
++ bfqq = &bfqd->oom_bfqq;
++ bfq_log_bfqq(bfqd, bfqq, "using oom bfqq");
++ }
++
++ bfq_init_prio_data(bfqq, bic);
++ bfq_init_entity(&bfqq->entity, bfqg);
++ }
++
++ if (new_bfqq != NULL)
++ kmem_cache_free(bfq_pool, new_bfqq);
++
++ return bfqq;
++}
++
++static struct bfq_queue **bfq_async_queue_prio(struct bfq_data *bfqd,
++ struct bfq_group *bfqg,
++ int ioprio_class, int ioprio)
++{
++ switch (ioprio_class) {
++ case IOPRIO_CLASS_RT:
++ return &bfqg->async_bfqq[0][ioprio];
++ case IOPRIO_CLASS_NONE:
++ ioprio = IOPRIO_NORM;
++ /* fall through */
++ case IOPRIO_CLASS_BE:
++ return &bfqg->async_bfqq[1][ioprio];
++ case IOPRIO_CLASS_IDLE:
++ return &bfqg->async_idle_bfqq;
++ default:
++ BUG();
++ }
++}
++
++static struct bfq_queue *bfq_get_queue(struct bfq_data *bfqd,
++ struct bfq_group *bfqg, int is_sync,
++ struct bfq_io_cq *bic, gfp_t gfp_mask)
++{
++ const int ioprio = IOPRIO_PRIO_DATA(bic->ioprio);
++ const int ioprio_class = IOPRIO_PRIO_CLASS(bic->ioprio);
++ struct bfq_queue **async_bfqq = NULL;
++ struct bfq_queue *bfqq = NULL;
++
++ if (!is_sync) {
++ async_bfqq = bfq_async_queue_prio(bfqd, bfqg, ioprio_class,
++ ioprio);
++ bfqq = *async_bfqq;
++ }
++
++ if (bfqq == NULL)
++ bfqq = bfq_find_alloc_queue(bfqd, bfqg, is_sync, bic, gfp_mask);
++
++ /*
++ * Pin the queue now that it's allocated, scheduler exit will
++ * prune it.
++ */
++ if (!is_sync && *async_bfqq == NULL) {
++ atomic_inc(&bfqq->ref);
++ bfq_log_bfqq(bfqd, bfqq, "get_queue, bfqq not in async: %p, %d",
++ bfqq, atomic_read(&bfqq->ref));
++ *async_bfqq = bfqq;
++ }
++
++ atomic_inc(&bfqq->ref);
++ bfq_log_bfqq(bfqd, bfqq, "get_queue, at end: %p, %d", bfqq,
++ atomic_read(&bfqq->ref));
++ return bfqq;
++}
++
++static void bfq_update_io_thinktime(struct bfq_data *bfqd,
++ struct bfq_io_cq *bic)
++{
++ unsigned long elapsed = jiffies - bic->ttime.last_end_request;
++ unsigned long ttime = min(elapsed, 2UL * bfqd->bfq_slice_idle);
++
++ bic->ttime.ttime_samples = (7*bic->ttime.ttime_samples + 256) / 8;
++ bic->ttime.ttime_total = (7*bic->ttime.ttime_total + 256*ttime) / 8;
++ bic->ttime.ttime_mean = (bic->ttime.ttime_total + 128) /
++ bic->ttime.ttime_samples;
++}
++
++static void bfq_update_io_seektime(struct bfq_data *bfqd,
++ struct bfq_queue *bfqq,
++ struct request *rq)
++{
++ sector_t sdist;
++ u64 total;
++
++ if (bfqq->last_request_pos < blk_rq_pos(rq))
++ sdist = blk_rq_pos(rq) - bfqq->last_request_pos;
++ else
++ sdist = bfqq->last_request_pos - blk_rq_pos(rq);
++
++ /*
++ * Don't allow the seek distance to get too large from the
++ * odd fragment, pagein, etc.
++ */
++ if (bfqq->seek_samples == 0) /* first request, not really a seek */
++ sdist = 0;
++ else if (bfqq->seek_samples <= 60) /* second & third seek */
++ sdist = min(sdist, (bfqq->seek_mean * 4) + 2*1024*1024);
++ else
++ sdist = min(sdist, (bfqq->seek_mean * 4) + 2*1024*64);
++
++ bfqq->seek_samples = (7*bfqq->seek_samples + 256) / 8;
++ bfqq->seek_total = (7*bfqq->seek_total + (u64)256*sdist) / 8;
++ total = bfqq->seek_total + (bfqq->seek_samples/2);
++ do_div(total, bfqq->seek_samples);
++ bfqq->seek_mean = (sector_t)total;
++
++ bfq_log_bfqq(bfqd, bfqq, "dist=%llu mean=%llu", (u64)sdist,
++ (u64)bfqq->seek_mean);
++}
++
++/*
++ * Disable idle window if the process thinks too long or seeks so much that
++ * it doesn't matter.
++ */
++static void bfq_update_idle_window(struct bfq_data *bfqd,
++ struct bfq_queue *bfqq,
++ struct bfq_io_cq *bic)
++{
++ int enable_idle;
++
++ /* Don't idle for async or idle io prio class. */
++ if (!bfq_bfqq_sync(bfqq) || bfq_class_idle(bfqq))
++ return;
++
++ enable_idle = bfq_bfqq_idle_window(bfqq);
++
++ if (atomic_read(&bic->icq.ioc->active_ref) == 0 ||
++ bfqd->bfq_slice_idle == 0 ||
++ (bfqd->hw_tag && BFQQ_SEEKY(bfqq) &&
++ bfqq->wr_coeff == 1))
++ enable_idle = 0;
++ else if (bfq_sample_valid(bic->ttime.ttime_samples)) {
++ if (bic->ttime.ttime_mean > bfqd->bfq_slice_idle &&
++ bfqq->wr_coeff == 1)
++ enable_idle = 0;
++ else
++ enable_idle = 1;
++ }
++ bfq_log_bfqq(bfqd, bfqq, "update_idle_window: enable_idle %d",
++ enable_idle);
++
++ if (enable_idle)
++ bfq_mark_bfqq_idle_window(bfqq);
++ else
++ bfq_clear_bfqq_idle_window(bfqq);
++}
++
++/*
++ * Called when a new fs request (rq) is added to bfqq. Check if there's
++ * something we should do about it.
++ */
++static void bfq_rq_enqueued(struct bfq_data *bfqd, struct bfq_queue *bfqq,
++ struct request *rq)
++{
++ struct bfq_io_cq *bic = RQ_BIC(rq);
++
++ if (rq->cmd_flags & REQ_META)
++ bfqq->meta_pending++;
++
++ bfq_update_io_thinktime(bfqd, bic);
++ bfq_update_io_seektime(bfqd, bfqq, rq);
++ if (!BFQQ_SEEKY(bfqq) && bfq_bfqq_constantly_seeky(bfqq)) {
++ bfq_clear_bfqq_constantly_seeky(bfqq);
++ if (!blk_queue_nonrot(bfqd->queue)) {
++ BUG_ON(!bfqd->const_seeky_busy_in_flight_queues);
++ bfqd->const_seeky_busy_in_flight_queues--;
++ }
++ }
++ if (bfqq->entity.service > bfq_max_budget(bfqd) / 8 ||
++ !BFQQ_SEEKY(bfqq))
++ bfq_update_idle_window(bfqd, bfqq, bic);
++
++ bfq_log_bfqq(bfqd, bfqq,
++ "rq_enqueued: idle_window=%d (seeky %d, mean %llu)",
++ bfq_bfqq_idle_window(bfqq), BFQQ_SEEKY(bfqq),
++ (long long unsigned)bfqq->seek_mean);
++
++ bfqq->last_request_pos = blk_rq_pos(rq) + blk_rq_sectors(rq);
++
++ if (bfqq == bfqd->in_service_queue && bfq_bfqq_wait_request(bfqq)) {
++ int small_req = bfqq->queued[rq_is_sync(rq)] == 1 &&
++ blk_rq_sectors(rq) < 32;
++ int budget_timeout = bfq_bfqq_budget_timeout(bfqq);
++
++ /*
++ * There is just this request queued: if the request
++ * is small and the queue is not to be expired, then
++ * just exit.
++ *
++ * In this way, if the disk is being idled to wait for
++ * a new request from the in-service queue, we avoid
++ * unplugging the device and committing the disk to serve
++ * just a small request. On the contrary, we wait for
++ * the block layer to decide when to unplug the device:
++ * hopefully, new requests will be merged to this one
++ * quickly, then the device will be unplugged and
++ * larger requests will be dispatched.
++ */
++ if (small_req && !budget_timeout)
++ return;
++
++ /*
++ * A large enough request arrived, or the queue is to
++ * be expired: in both cases disk idling is to be
++ * stopped, so clear wait_request flag and reset
++ * timer.
++ */
++ bfq_clear_bfqq_wait_request(bfqq);
++ del_timer(&bfqd->idle_slice_timer);
++
++ /*
++ * The queue is not empty, because a new request just
++ * arrived. Hence we can safely expire the queue, in
++ * case of budget timeout, without risking that the
++ * timestamps of the queue are not updated correctly.
++ * See [1] for more details.
++ */
++ if (budget_timeout)
++ bfq_bfqq_expire(bfqd, bfqq, 0, BFQ_BFQQ_BUDGET_TIMEOUT);
++
++ /*
++ * Let the request rip immediately, or let a new queue be
++ * selected if bfqq has just been expired.
++ */
++ __blk_run_queue(bfqd->queue);
++ }
++}
++
++static void bfq_insert_request(struct request_queue *q, struct request *rq)
++{
++ struct bfq_data *bfqd = q->elevator->elevator_data;
++ struct bfq_queue *bfqq = RQ_BFQQ(rq);
++
++ assert_spin_locked(bfqd->queue->queue_lock);
++ bfq_init_prio_data(bfqq, RQ_BIC(rq));
++
++ bfq_add_request(rq);
++
++ rq->fifo_time = jiffies + bfqd->bfq_fifo_expire[rq_is_sync(rq)];
++ list_add_tail(&rq->queuelist, &bfqq->fifo);
++
++ bfq_rq_enqueued(bfqd, bfqq, rq);
++}
++
++static void bfq_update_hw_tag(struct bfq_data *bfqd)
++{
++ bfqd->max_rq_in_driver = max(bfqd->max_rq_in_driver,
++ bfqd->rq_in_driver);
++
++ if (bfqd->hw_tag == 1)
++ return;
++
++ /*
++ * This sample is valid if the number of outstanding requests
++ * is large enough to allow a queueing behavior. Note that the
++ * sum is not exact, as it's not taking into account deactivated
++ * requests.
++ */
++ if (bfqd->rq_in_driver + bfqd->queued < BFQ_HW_QUEUE_THRESHOLD)
++ return;
++
++ if (bfqd->hw_tag_samples++ < BFQ_HW_QUEUE_SAMPLES)
++ return;
++
++ bfqd->hw_tag = bfqd->max_rq_in_driver > BFQ_HW_QUEUE_THRESHOLD;
++ bfqd->max_rq_in_driver = 0;
++ bfqd->hw_tag_samples = 0;
++}
++
++static void bfq_completed_request(struct request_queue *q, struct request *rq)
++{
++ struct bfq_queue *bfqq = RQ_BFQQ(rq);
++ struct bfq_data *bfqd = bfqq->bfqd;
++ bool sync = bfq_bfqq_sync(bfqq);
++
++ bfq_log_bfqq(bfqd, bfqq, "completed one req with %u sects left (%d)",
++ blk_rq_sectors(rq), sync);
++
++ bfq_update_hw_tag(bfqd);
++
++ BUG_ON(!bfqd->rq_in_driver);
++ BUG_ON(!bfqq->dispatched);
++ bfqd->rq_in_driver--;
++ bfqq->dispatched--;
++
++ if (!bfqq->dispatched && !bfq_bfqq_busy(bfqq)) {
++ bfq_weights_tree_remove(bfqd, &bfqq->entity,
++ &bfqd->queue_weights_tree);
++ if (!blk_queue_nonrot(bfqd->queue)) {
++ BUG_ON(!bfqd->busy_in_flight_queues);
++ bfqd->busy_in_flight_queues--;
++ if (bfq_bfqq_constantly_seeky(bfqq)) {
++ BUG_ON(!bfqd->
++ const_seeky_busy_in_flight_queues);
++ bfqd->const_seeky_busy_in_flight_queues--;
++ }
++ }
++ }
++
++ if (sync) {
++ bfqd->sync_flight--;
++ RQ_BIC(rq)->ttime.last_end_request = jiffies;
++ }
++
++ /*
++ * If we are waiting to discover whether the request pattern of the
++ * task associated with the queue is actually isochronous, and
++ * both requisites for this condition to hold are satisfied, then
++ * compute soft_rt_next_start (see the comments to the function
++ * bfq_bfqq_softrt_next_start()).
++ */
++ if (bfq_bfqq_softrt_update(bfqq) && bfqq->dispatched == 0 &&
++ RB_EMPTY_ROOT(&bfqq->sort_list))
++ bfqq->soft_rt_next_start =
++ bfq_bfqq_softrt_next_start(bfqd, bfqq);
++
++ /*
++ * If this is the in-service queue, check if it needs to be expired,
++ * or if we want to idle in case it has no pending requests.
++ */
++ if (bfqd->in_service_queue == bfqq) {
++ if (bfq_bfqq_budget_new(bfqq))
++ bfq_set_budget_timeout(bfqd);
++
++ if (bfq_bfqq_must_idle(bfqq)) {
++ bfq_arm_slice_timer(bfqd);
++ goto out;
++ } else if (bfq_may_expire_for_budg_timeout(bfqq))
++ bfq_bfqq_expire(bfqd, bfqq, 0, BFQ_BFQQ_BUDGET_TIMEOUT);
++ else if (RB_EMPTY_ROOT(&bfqq->sort_list) &&
++ (bfqq->dispatched == 0 ||
++ !bfq_bfqq_must_not_expire(bfqq)))
++ bfq_bfqq_expire(bfqd, bfqq, 0,
++ BFQ_BFQQ_NO_MORE_REQUESTS);
++ }
++
++ if (!bfqd->rq_in_driver)
++ bfq_schedule_dispatch(bfqd);
++
++out:
++ return;
++}
++
++static inline int __bfq_may_queue(struct bfq_queue *bfqq)
++{
++ if (bfq_bfqq_wait_request(bfqq) && bfq_bfqq_must_alloc(bfqq)) {
++ bfq_clear_bfqq_must_alloc(bfqq);
++ return ELV_MQUEUE_MUST;
++ }
++
++ return ELV_MQUEUE_MAY;
++}
++
++static int bfq_may_queue(struct request_queue *q, int rw)
++{
++ struct bfq_data *bfqd = q->elevator->elevator_data;
++ struct task_struct *tsk = current;
++ struct bfq_io_cq *bic;
++ struct bfq_queue *bfqq;
++
++ /*
++ * Don't force setup of a queue from here, as a call to may_queue
++ * does not necessarily imply that a request actually will be
++ * queued. So just lookup a possibly existing queue, or return
++ * 'may queue' if that fails.
++ */
++ bic = bfq_bic_lookup(bfqd, tsk->io_context);
++ if (bic == NULL)
++ return ELV_MQUEUE_MAY;
++
++ bfqq = bic_to_bfqq(bic, rw_is_sync(rw));
++ if (bfqq != NULL) {
++ bfq_init_prio_data(bfqq, bic);
++
++ return __bfq_may_queue(bfqq);
++ }
++
++ return ELV_MQUEUE_MAY;
++}
++
++/*
++ * Queue lock held here.
++ */
++static void bfq_put_request(struct request *rq)
++{
++ struct bfq_queue *bfqq = RQ_BFQQ(rq);
++
++ if (bfqq != NULL) {
++ const int rw = rq_data_dir(rq);
++
++ BUG_ON(!bfqq->allocated[rw]);
++ bfqq->allocated[rw]--;
++
++ rq->elv.priv[0] = NULL;
++ rq->elv.priv[1] = NULL;
++
++ bfq_log_bfqq(bfqq->bfqd, bfqq, "put_request %p, %d",
++ bfqq, atomic_read(&bfqq->ref));
++ bfq_put_queue(bfqq);
++ }
++}
++
++static struct bfq_queue *
++bfq_merge_bfqqs(struct bfq_data *bfqd, struct bfq_io_cq *bic,
++ struct bfq_queue *bfqq)
++{
++ bfq_log_bfqq(bfqd, bfqq, "merging with queue %lu",
++ (long unsigned)bfqq->new_bfqq->pid);
++ bic_set_bfqq(bic, bfqq->new_bfqq, 1);
++ bfq_mark_bfqq_coop(bfqq->new_bfqq);
++ bfq_put_queue(bfqq);
++ return bic_to_bfqq(bic, 1);
++}
++
++/*
++ * Returns NULL if a new bfqq should be allocated, or the old bfqq if this
++ * was the last process referring to said bfqq.
++ */
++static struct bfq_queue *
++bfq_split_bfqq(struct bfq_io_cq *bic, struct bfq_queue *bfqq)
++{
++ bfq_log_bfqq(bfqq->bfqd, bfqq, "splitting queue");
++ if (bfqq_process_refs(bfqq) == 1) {
++ bfqq->pid = current->pid;
++ bfq_clear_bfqq_coop(bfqq);
++ bfq_clear_bfqq_split_coop(bfqq);
++ return bfqq;
++ }
++
++ bic_set_bfqq(bic, NULL, 1);
++
++ bfq_put_cooperator(bfqq);
++
++ bfq_put_queue(bfqq);
++ return NULL;
++}
++
++/*
++ * Allocate bfq data structures associated with this request.
++ */
++static int bfq_set_request(struct request_queue *q, struct request *rq,
++ struct bio *bio, gfp_t gfp_mask)
++{
++ struct bfq_data *bfqd = q->elevator->elevator_data;
++ struct bfq_io_cq *bic = icq_to_bic(rq->elv.icq);
++ const int rw = rq_data_dir(rq);
++ const int is_sync = rq_is_sync(rq);
++ struct bfq_queue *bfqq;
++ struct bfq_group *bfqg;
++ unsigned long flags;
++
++ might_sleep_if(gfp_mask & __GFP_WAIT);
++
++ bfq_changed_ioprio(bic);
++
++ spin_lock_irqsave(q->queue_lock, flags);
++
++ if (bic == NULL)
++ goto queue_fail;
++
++ bfqg = bfq_bic_update_cgroup(bic);
++
++new_queue:
++ bfqq = bic_to_bfqq(bic, is_sync);
++ if (bfqq == NULL || bfqq == &bfqd->oom_bfqq) {
++ bfqq = bfq_get_queue(bfqd, bfqg, is_sync, bic, gfp_mask);
++ bic_set_bfqq(bic, bfqq, is_sync);
++ } else {
++ /*
++ * If the queue was seeky for too long, break it apart.
++ */
++ if (bfq_bfqq_coop(bfqq) && bfq_bfqq_split_coop(bfqq)) {
++ bfq_log_bfqq(bfqd, bfqq, "breaking apart bfqq");
++ bfqq = bfq_split_bfqq(bic, bfqq);
++ if (!bfqq)
++ goto new_queue;
++ }
++
++ /*
++ * Check to see if this queue is scheduled to merge with
++ * another closely cooperating queue. The merging of queues
++ * happens here as it must be done in process context.
++ * The reference on new_bfqq was taken in merge_bfqqs.
++ */
++ if (bfqq->new_bfqq != NULL)
++ bfqq = bfq_merge_bfqqs(bfqd, bic, bfqq);
++ }
++
++ bfqq->allocated[rw]++;
++ atomic_inc(&bfqq->ref);
++ bfq_log_bfqq(bfqd, bfqq, "set_request: bfqq %p, %d", bfqq,
++ atomic_read(&bfqq->ref));
++
++ rq->elv.priv[0] = bic;
++ rq->elv.priv[1] = bfqq;
++
++ spin_unlock_irqrestore(q->queue_lock, flags);
++
++ return 0;
++
++queue_fail:
++ bfq_schedule_dispatch(bfqd);
++ spin_unlock_irqrestore(q->queue_lock, flags);
++
++ return 1;
++}
++
++static void bfq_kick_queue(struct work_struct *work)
++{
++ struct bfq_data *bfqd =
++ container_of(work, struct bfq_data, unplug_work);
++ struct request_queue *q = bfqd->queue;
++
++ spin_lock_irq(q->queue_lock);
++ __blk_run_queue(q);
++ spin_unlock_irq(q->queue_lock);
++}
++
++/*
++ * Handler of the expiration of the timer running if the in-service queue
++ * is idling inside its time slice.
++ */
++static void bfq_idle_slice_timer(unsigned long data)
++{
++ struct bfq_data *bfqd = (struct bfq_data *)data;
++ struct bfq_queue *bfqq;
++ unsigned long flags;
++ enum bfqq_expiration reason;
++
++ spin_lock_irqsave(bfqd->queue->queue_lock, flags);
++
++ bfqq = bfqd->in_service_queue;
++ /*
++ * Theoretical race here: the in-service queue can be NULL or
++ * different from the queue that was idling if the timer handler
++ * spins on the queue_lock and a new request arrives for the
++ * current queue and there is a full dispatch cycle that changes
++ * the in-service queue. This can hardly happen, but in the worst
++ * case we just expire a queue too early.
++ */
++ if (bfqq != NULL) {
++ bfq_log_bfqq(bfqd, bfqq, "slice_timer expired");
++ if (bfq_bfqq_budget_timeout(bfqq))
++ /*
++ * Also here the queue can be safely expired
++ * for budget timeout without wasting
++ * guarantees
++ */
++ reason = BFQ_BFQQ_BUDGET_TIMEOUT;
++ else if (bfqq->queued[0] == 0 && bfqq->queued[1] == 0)
++ /*
++ * The queue may not be empty upon timer expiration,
++ * because we may not disable the timer when the
++ * first request of the in-service queue arrives
++ * during disk idling.
++ */
++ reason = BFQ_BFQQ_TOO_IDLE;
++ else
++ goto schedule_dispatch;
++
++ bfq_bfqq_expire(bfqd, bfqq, 1, reason);
++ }
++
++schedule_dispatch:
++ bfq_schedule_dispatch(bfqd);
++
++ spin_unlock_irqrestore(bfqd->queue->queue_lock, flags);
++}
++
++static void bfq_shutdown_timer_wq(struct bfq_data *bfqd)
++{
++ del_timer_sync(&bfqd->idle_slice_timer);
++ cancel_work_sync(&bfqd->unplug_work);
++}
++
++static inline void __bfq_put_async_bfqq(struct bfq_data *bfqd,
++ struct bfq_queue **bfqq_ptr)
++{
++ struct bfq_group *root_group = bfqd->root_group;
++ struct bfq_queue *bfqq = *bfqq_ptr;
++
++ bfq_log(bfqd, "put_async_bfqq: %p", bfqq);
++ if (bfqq != NULL) {
++ bfq_bfqq_move(bfqd, bfqq, &bfqq->entity, root_group);
++ bfq_log_bfqq(bfqd, bfqq, "put_async_bfqq: putting %p, %d",
++ bfqq, atomic_read(&bfqq->ref));
++ bfq_put_queue(bfqq);
++ *bfqq_ptr = NULL;
++ }
++}
++
++/*
++ * Release all the bfqg references to its async queues. If we are
++ * deallocating the group these queues may still contain requests, so
++ * we reparent them to the root cgroup (i.e., the only one that will
++ * exist for sure until all the requests on a device are gone).
++ */
++static void bfq_put_async_queues(struct bfq_data *bfqd, struct bfq_group *bfqg)
++{
++ int i, j;
++
++ for (i = 0; i < 2; i++)
++ for (j = 0; j < IOPRIO_BE_NR; j++)
++ __bfq_put_async_bfqq(bfqd, &bfqg->async_bfqq[i][j]);
++
++ __bfq_put_async_bfqq(bfqd, &bfqg->async_idle_bfqq);
++}
++
++static void bfq_exit_queue(struct elevator_queue *e)
++{
++ struct bfq_data *bfqd = e->elevator_data;
++ struct request_queue *q = bfqd->queue;
++ struct bfq_queue *bfqq, *n;
++
++ bfq_shutdown_timer_wq(bfqd);
++
++ spin_lock_irq(q->queue_lock);
++
++ BUG_ON(bfqd->in_service_queue != NULL);
++ list_for_each_entry_safe(bfqq, n, &bfqd->idle_list, bfqq_list)
++ bfq_deactivate_bfqq(bfqd, bfqq, 0);
++
++ bfq_disconnect_groups(bfqd);
++ spin_unlock_irq(q->queue_lock);
++
++ bfq_shutdown_timer_wq(bfqd);
++
++ synchronize_rcu();
++
++ BUG_ON(timer_pending(&bfqd->idle_slice_timer));
++
++ bfq_free_root_group(bfqd);
++ kfree(bfqd);
++}
++
++static int bfq_init_queue(struct request_queue *q, struct elevator_type *e)
++{
++ struct bfq_group *bfqg;
++ struct bfq_data *bfqd;
++ struct elevator_queue *eq;
++
++ eq = elevator_alloc(q, e);
++ if (eq == NULL)
++ return -ENOMEM;
++
++ bfqd = kzalloc_node(sizeof(*bfqd), GFP_KERNEL, q->node);
++ if (bfqd == NULL) {
++ kobject_put(&eq->kobj);
++ return -ENOMEM;
++ }
++ eq->elevator_data = bfqd;
++
++ /*
++ * Our fallback bfqq if bfq_find_alloc_queue() runs into OOM issues.
++ * Grab a permanent reference to it, so that the normal code flow
++ * will not attempt to free it.
++ */
++ bfq_init_bfqq(bfqd, &bfqd->oom_bfqq, 1, 0);
++ atomic_inc(&bfqd->oom_bfqq.ref);
++
++ bfqd->queue = q;
++
++ spin_lock_irq(q->queue_lock);
++ q->elevator = eq;
++ spin_unlock_irq(q->queue_lock);
++
++ bfqg = bfq_alloc_root_group(bfqd, q->node);
++ if (bfqg == NULL) {
++ kfree(bfqd);
++ kobject_put(&eq->kobj);
++ return -ENOMEM;
++ }
++
++ bfqd->root_group = bfqg;
++#ifdef CONFIG_CGROUP_BFQIO
++ bfqd->active_numerous_groups = 0;
++#endif
++
++ init_timer(&bfqd->idle_slice_timer);
++ bfqd->idle_slice_timer.function = bfq_idle_slice_timer;
++ bfqd->idle_slice_timer.data = (unsigned long)bfqd;
++
++ bfqd->rq_pos_tree = RB_ROOT;
++ bfqd->queue_weights_tree = RB_ROOT;
++ bfqd->group_weights_tree = RB_ROOT;
++
++ INIT_WORK(&bfqd->unplug_work, bfq_kick_queue);
++
++ INIT_LIST_HEAD(&bfqd->active_list);
++ INIT_LIST_HEAD(&bfqd->idle_list);
++ INIT_HLIST_HEAD(&bfqd->burst_list);
++
++ bfqd->hw_tag = -1;
++
++ bfqd->bfq_max_budget = bfq_default_max_budget;
++
++ bfqd->bfq_quantum = bfq_quantum;
++ bfqd->bfq_fifo_expire[0] = bfq_fifo_expire[0];
++ bfqd->bfq_fifo_expire[1] = bfq_fifo_expire[1];
++ bfqd->bfq_back_max = bfq_back_max;
++ bfqd->bfq_back_penalty = bfq_back_penalty;
++ bfqd->bfq_slice_idle = bfq_slice_idle;
++ bfqd->bfq_class_idle_last_service = 0;
++ bfqd->bfq_max_budget_async_rq = bfq_max_budget_async_rq;
++ bfqd->bfq_timeout[BLK_RW_ASYNC] = bfq_timeout_async;
++ bfqd->bfq_timeout[BLK_RW_SYNC] = bfq_timeout_sync;
++
++ bfqd->bfq_coop_thresh = 2;
++ bfqd->bfq_failed_cooperations = 7000;
++ bfqd->bfq_requests_within_timer = 120;
++
++ bfqd->bfq_large_burst_thresh = 11;
++ bfqd->bfq_burst_interval = msecs_to_jiffies(500);
++
++ bfqd->low_latency = true;
++
++ bfqd->bfq_wr_coeff = 20;
++ bfqd->bfq_wr_rt_max_time = msecs_to_jiffies(300);
++ bfqd->bfq_wr_max_time = 0;
++ bfqd->bfq_wr_min_idle_time = msecs_to_jiffies(2000);
++ bfqd->bfq_wr_min_inter_arr_async = msecs_to_jiffies(500);
++ bfqd->bfq_wr_max_softrt_rate = 7000; /*
++ * Approximate rate required
++ * to playback or record a
++ * high-definition compressed
++ * video.
++ */
++ bfqd->wr_busy_queues = 0;
++ bfqd->busy_in_flight_queues = 0;
++ bfqd->const_seeky_busy_in_flight_queues = 0;
++
++ /*
++ * Begin by assuming, optimistically, that the device peak rate is
++ * equal to the highest reference rate.
++ */
++ bfqd->RT_prod = R_fast[blk_queue_nonrot(bfqd->queue)] *
++ T_fast[blk_queue_nonrot(bfqd->queue)];
++ bfqd->peak_rate = R_fast[blk_queue_nonrot(bfqd->queue)];
++ bfqd->device_speed = BFQ_BFQD_FAST;
++
++ return 0;
++}
++
++static void bfq_slab_kill(void)
++{
++ if (bfq_pool != NULL)
++ kmem_cache_destroy(bfq_pool);
++}
++
++static int __init bfq_slab_setup(void)
++{
++ bfq_pool = KMEM_CACHE(bfq_queue, 0);
++ if (bfq_pool == NULL)
++ return -ENOMEM;
++ return 0;
++}
++
++static ssize_t bfq_var_show(unsigned int var, char *page)
++{
++ return sprintf(page, "%d\n", var);
++}
++
++static ssize_t bfq_var_store(unsigned long *var, const char *page,
++ size_t count)
++{
++ unsigned long new_val;
++ int ret = kstrtoul(page, 10, &new_val);
++
++ if (ret == 0)
++ *var = new_val;
++
++ return count;
++}
++
++static ssize_t bfq_wr_max_time_show(struct elevator_queue *e, char *page)
++{
++ struct bfq_data *bfqd = e->elevator_data;
++ return sprintf(page, "%d\n", bfqd->bfq_wr_max_time > 0 ?
++ jiffies_to_msecs(bfqd->bfq_wr_max_time) :
++ jiffies_to_msecs(bfq_wr_duration(bfqd)));
++}
++
++static ssize_t bfq_weights_show(struct elevator_queue *e, char *page)
++{
++ struct bfq_queue *bfqq;
++ struct bfq_data *bfqd = e->elevator_data;
++ ssize_t num_char = 0;
++
++ num_char += sprintf(page + num_char, "Tot reqs queued %d\n\n",
++ bfqd->queued);
++
++ spin_lock_irq(bfqd->queue->queue_lock);
++
++ num_char += sprintf(page + num_char, "Active:\n");
++ list_for_each_entry(bfqq, &bfqd->active_list, bfqq_list) {
++ num_char += sprintf(page + num_char,
++ "pid%d: weight %hu, nr_queued %d %d, dur %d/%u\n",
++ bfqq->pid,
++ bfqq->entity.weight,
++ bfqq->queued[0],
++ bfqq->queued[1],
++ jiffies_to_msecs(jiffies - bfqq->last_wr_start_finish),
++ jiffies_to_msecs(bfqq->wr_cur_max_time));
++ }
++
++ num_char += sprintf(page + num_char, "Idle:\n");
++ list_for_each_entry(bfqq, &bfqd->idle_list, bfqq_list) {
++ num_char += sprintf(page + num_char,
++ "pid%d: weight %hu, dur %d/%u\n",
++ bfqq->pid,
++ bfqq->entity.weight,
++ jiffies_to_msecs(jiffies -
++ bfqq->last_wr_start_finish),
++ jiffies_to_msecs(bfqq->wr_cur_max_time));
++ }
++
++ spin_unlock_irq(bfqd->queue->queue_lock);
++
++ return num_char;
++}
++
++#define SHOW_FUNCTION(__FUNC, __VAR, __CONV) \
++static ssize_t __FUNC(struct elevator_queue *e, char *page) \
++{ \
++ struct bfq_data *bfqd = e->elevator_data; \
++ unsigned int __data = __VAR; \
++ if (__CONV) \
++ __data = jiffies_to_msecs(__data); \
++ return bfq_var_show(__data, (page)); \
++}
++SHOW_FUNCTION(bfq_quantum_show, bfqd->bfq_quantum, 0);
++SHOW_FUNCTION(bfq_fifo_expire_sync_show, bfqd->bfq_fifo_expire[1], 1);
++SHOW_FUNCTION(bfq_fifo_expire_async_show, bfqd->bfq_fifo_expire[0], 1);
++SHOW_FUNCTION(bfq_back_seek_max_show, bfqd->bfq_back_max, 0);
++SHOW_FUNCTION(bfq_back_seek_penalty_show, bfqd->bfq_back_penalty, 0);
++SHOW_FUNCTION(bfq_slice_idle_show, bfqd->bfq_slice_idle, 1);
++SHOW_FUNCTION(bfq_max_budget_show, bfqd->bfq_user_max_budget, 0);
++SHOW_FUNCTION(bfq_max_budget_async_rq_show,
++ bfqd->bfq_max_budget_async_rq, 0);
++SHOW_FUNCTION(bfq_timeout_sync_show, bfqd->bfq_timeout[BLK_RW_SYNC], 1);
++SHOW_FUNCTION(bfq_timeout_async_show, bfqd->bfq_timeout[BLK_RW_ASYNC], 1);
++SHOW_FUNCTION(bfq_low_latency_show, bfqd->low_latency, 0);
++SHOW_FUNCTION(bfq_wr_coeff_show, bfqd->bfq_wr_coeff, 0);
++SHOW_FUNCTION(bfq_wr_rt_max_time_show, bfqd->bfq_wr_rt_max_time, 1);
++SHOW_FUNCTION(bfq_wr_min_idle_time_show, bfqd->bfq_wr_min_idle_time, 1);
++SHOW_FUNCTION(bfq_wr_min_inter_arr_async_show, bfqd->bfq_wr_min_inter_arr_async,
++ 1);
++SHOW_FUNCTION(bfq_wr_max_softrt_rate_show, bfqd->bfq_wr_max_softrt_rate, 0);
++#undef SHOW_FUNCTION
++
++#define STORE_FUNCTION(__FUNC, __PTR, MIN, MAX, __CONV) \
++static ssize_t \
++__FUNC(struct elevator_queue *e, const char *page, size_t count) \
++{ \
++ struct bfq_data *bfqd = e->elevator_data; \
++ unsigned long uninitialized_var(__data); \
++ int ret = bfq_var_store(&__data, (page), count); \
++ if (__data < (MIN)) \
++ __data = (MIN); \
++ else if (__data > (MAX)) \
++ __data = (MAX); \
++ if (__CONV) \
++ *(__PTR) = msecs_to_jiffies(__data); \
++ else \
++ *(__PTR) = __data; \
++ return ret; \
++}
++STORE_FUNCTION(bfq_quantum_store, &bfqd->bfq_quantum, 1, INT_MAX, 0);
++STORE_FUNCTION(bfq_fifo_expire_sync_store, &bfqd->bfq_fifo_expire[1], 1,
++ INT_MAX, 1);
++STORE_FUNCTION(bfq_fifo_expire_async_store, &bfqd->bfq_fifo_expire[0], 1,
++ INT_MAX, 1);
++STORE_FUNCTION(bfq_back_seek_max_store, &bfqd->bfq_back_max, 0, INT_MAX, 0);
++STORE_FUNCTION(bfq_back_seek_penalty_store, &bfqd->bfq_back_penalty, 1,
++ INT_MAX, 0);
++STORE_FUNCTION(bfq_slice_idle_store, &bfqd->bfq_slice_idle, 0, INT_MAX, 1);
++STORE_FUNCTION(bfq_max_budget_async_rq_store, &bfqd->bfq_max_budget_async_rq,
++ 1, INT_MAX, 0);
++STORE_FUNCTION(bfq_timeout_async_store, &bfqd->bfq_timeout[BLK_RW_ASYNC], 0,
++ INT_MAX, 1);
++STORE_FUNCTION(bfq_wr_coeff_store, &bfqd->bfq_wr_coeff, 1, INT_MAX, 0);
++STORE_FUNCTION(bfq_wr_max_time_store, &bfqd->bfq_wr_max_time, 0, INT_MAX, 1);
++STORE_FUNCTION(bfq_wr_rt_max_time_store, &bfqd->bfq_wr_rt_max_time, 0, INT_MAX,
++ 1);
++STORE_FUNCTION(bfq_wr_min_idle_time_store, &bfqd->bfq_wr_min_idle_time, 0,
++ INT_MAX, 1);
++STORE_FUNCTION(bfq_wr_min_inter_arr_async_store,
++ &bfqd->bfq_wr_min_inter_arr_async, 0, INT_MAX, 1);
++STORE_FUNCTION(bfq_wr_max_softrt_rate_store, &bfqd->bfq_wr_max_softrt_rate, 0,
++ INT_MAX, 0);
++#undef STORE_FUNCTION
++
++/* do nothing for the moment */
++static ssize_t bfq_weights_store(struct elevator_queue *e,
++ const char *page, size_t count)
++{
++ return count;
++}
++
++static inline unsigned long bfq_estimated_max_budget(struct bfq_data *bfqd)
++{
++ u64 timeout = jiffies_to_msecs(bfqd->bfq_timeout[BLK_RW_SYNC]);
++
++ if (bfqd->peak_rate_samples >= BFQ_PEAK_RATE_SAMPLES)
++ return bfq_calc_max_budget(bfqd->peak_rate, timeout);
++ else
++ return bfq_default_max_budget;
++}
++
++static ssize_t bfq_max_budget_store(struct elevator_queue *e,
++ const char *page, size_t count)
++{
++ struct bfq_data *bfqd = e->elevator_data;
++ unsigned long uninitialized_var(__data);
++ int ret = bfq_var_store(&__data, (page), count);
++
++ if (__data == 0)
++ bfqd->bfq_max_budget = bfq_estimated_max_budget(bfqd);
++ else {
++ if (__data > INT_MAX)
++ __data = INT_MAX;
++ bfqd->bfq_max_budget = __data;
++ }
++
++ bfqd->bfq_user_max_budget = __data;
++
++ return ret;
++}
++
++static ssize_t bfq_timeout_sync_store(struct elevator_queue *e,
++ const char *page, size_t count)
++{
++ struct bfq_data *bfqd = e->elevator_data;
++ unsigned long uninitialized_var(__data);
++ int ret = bfq_var_store(&__data, (page), count);
++
++ if (__data < 1)
++ __data = 1;
++ else if (__data > INT_MAX)
++ __data = INT_MAX;
++
++ bfqd->bfq_timeout[BLK_RW_SYNC] = msecs_to_jiffies(__data);
++ if (bfqd->bfq_user_max_budget == 0)
++ bfqd->bfq_max_budget = bfq_estimated_max_budget(bfqd);
++
++ return ret;
++}
++
++static ssize_t bfq_low_latency_store(struct elevator_queue *e,
++ const char *page, size_t count)
++{
++ struct bfq_data *bfqd = e->elevator_data;
++ unsigned long uninitialized_var(__data);
++ int ret = bfq_var_store(&__data, (page), count);
++
++ if (__data > 1)
++ __data = 1;
++ if (__data == 0 && bfqd->low_latency != 0)
++ bfq_end_wr(bfqd);
++ bfqd->low_latency = __data;
++
++ return ret;
++}
++
++#define BFQ_ATTR(name) \
++ __ATTR(name, S_IRUGO|S_IWUSR, bfq_##name##_show, bfq_##name##_store)
++
++static struct elv_fs_entry bfq_attrs[] = {
++ BFQ_ATTR(quantum),
++ BFQ_ATTR(fifo_expire_sync),
++ BFQ_ATTR(fifo_expire_async),
++ BFQ_ATTR(back_seek_max),
++ BFQ_ATTR(back_seek_penalty),
++ BFQ_ATTR(slice_idle),
++ BFQ_ATTR(max_budget),
++ BFQ_ATTR(max_budget_async_rq),
++ BFQ_ATTR(timeout_sync),
++ BFQ_ATTR(timeout_async),
++ BFQ_ATTR(low_latency),
++ BFQ_ATTR(wr_coeff),
++ BFQ_ATTR(wr_max_time),
++ BFQ_ATTR(wr_rt_max_time),
++ BFQ_ATTR(wr_min_idle_time),
++ BFQ_ATTR(wr_min_inter_arr_async),
++ BFQ_ATTR(wr_max_softrt_rate),
++ BFQ_ATTR(weights),
++ __ATTR_NULL
++};
++
++static struct elevator_type iosched_bfq = {
++ .ops = {
++ .elevator_merge_fn = bfq_merge,
++ .elevator_merged_fn = bfq_merged_request,
++ .elevator_merge_req_fn = bfq_merged_requests,
++ .elevator_allow_merge_fn = bfq_allow_merge,
++ .elevator_dispatch_fn = bfq_dispatch_requests,
++ .elevator_add_req_fn = bfq_insert_request,
++ .elevator_activate_req_fn = bfq_activate_request,
++ .elevator_deactivate_req_fn = bfq_deactivate_request,
++ .elevator_completed_req_fn = bfq_completed_request,
++ .elevator_former_req_fn = elv_rb_former_request,
++ .elevator_latter_req_fn = elv_rb_latter_request,
++ .elevator_init_icq_fn = bfq_init_icq,
++ .elevator_exit_icq_fn = bfq_exit_icq,
++ .elevator_set_req_fn = bfq_set_request,
++ .elevator_put_req_fn = bfq_put_request,
++ .elevator_may_queue_fn = bfq_may_queue,
++ .elevator_init_fn = bfq_init_queue,
++ .elevator_exit_fn = bfq_exit_queue,
++ },
++ .icq_size = sizeof(struct bfq_io_cq),
++ .icq_align = __alignof__(struct bfq_io_cq),
++ .elevator_attrs = bfq_attrs,
++ .elevator_name = "bfq",
++ .elevator_owner = THIS_MODULE,
++};
++
++static int __init bfq_init(void)
++{
++ /*
++ * Can be 0 on HZ < 1000 setups.
++ */
++ if (bfq_slice_idle == 0)
++ bfq_slice_idle = 1;
++
++ if (bfq_timeout_async == 0)
++ bfq_timeout_async = 1;
++
++ if (bfq_slab_setup())
++ return -ENOMEM;
++
++ /*
++ * Times to load large popular applications for the typical systems
++ * installed on the reference devices (see the comments before the
++ * definitions of the two arrays).
++ */
++ T_slow[0] = msecs_to_jiffies(2600);
++ T_slow[1] = msecs_to_jiffies(1000);
++ T_fast[0] = msecs_to_jiffies(5500);
++ T_fast[1] = msecs_to_jiffies(2000);
++
++ /*
++ * Thresholds that determine the switch between speed classes (see
++ * the comments before the definition of the array).
++ */
++ device_speed_thresh[0] = (R_fast[0] + R_slow[0]) / 2;
++ device_speed_thresh[1] = (R_fast[1] + R_slow[1]) / 2;
++
++ elv_register(&iosched_bfq);
++ pr_info("BFQ I/O-scheduler version: v7r6");
++
++ return 0;
++}
++
++static void __exit bfq_exit(void)
++{
++ elv_unregister(&iosched_bfq);
++ bfq_slab_kill();
++}
++
++module_init(bfq_init);
++module_exit(bfq_exit);
++
++MODULE_AUTHOR("Fabio Checconi, Paolo Valente");
++MODULE_LICENSE("GPL");
+diff --git a/block/bfq-sched.c b/block/bfq-sched.c
+new file mode 100644
+index 0000000..c4831b7
+--- /dev/null
++++ b/block/bfq-sched.c
+@@ -0,0 +1,1207 @@
++/*
++ * BFQ: Hierarchical B-WF2Q+ scheduler.
++ *
++ * Based on ideas and code from CFQ:
++ * Copyright (C) 2003 Jens Axboe <axboe@kernel.dk>
++ *
++ * Copyright (C) 2008 Fabio Checconi <fabio@gandalf.sssup.it>
++ * Paolo Valente <paolo.valente@unimore.it>
++ *
++ * Copyright (C) 2010 Paolo Valente <paolo.valente@unimore.it>
++ */
++
++#ifdef CONFIG_CGROUP_BFQIO
++#define for_each_entity(entity) \
++ for (; entity != NULL; entity = entity->parent)
++
++#define for_each_entity_safe(entity, parent) \
++ for (; entity && ({ parent = entity->parent; 1; }); entity = parent)
++
++static struct bfq_entity *bfq_lookup_next_entity(struct bfq_sched_data *sd,
++ int extract,
++ struct bfq_data *bfqd);
++
++static inline void bfq_update_budget(struct bfq_entity *next_in_service)
++{
++ struct bfq_entity *bfqg_entity;
++ struct bfq_group *bfqg;
++ struct bfq_sched_data *group_sd;
++
++ BUG_ON(next_in_service == NULL);
++
++ group_sd = next_in_service->sched_data;
++
++ bfqg = container_of(group_sd, struct bfq_group, sched_data);
++ /*
++ * bfq_group's my_entity field is not NULL only if the group
++ * is not the root group. We must not touch the root entity
++ * as it must never become an in-service entity.
++ */
++ bfqg_entity = bfqg->my_entity;
++ if (bfqg_entity != NULL)
++ bfqg_entity->budget = next_in_service->budget;
++}
++
++static int bfq_update_next_in_service(struct bfq_sched_data *sd)
++{
++ struct bfq_entity *next_in_service;
++
++ if (sd->in_service_entity != NULL)
++ /* will update/requeue at the end of service */
++ return 0;
++
++ /*
++ * NOTE: this can be improved in many ways, such as returning
++ * 1 (and thus propagating upwards the update) only when the
++ * budget changes, or caching the bfqq that will be scheduled
++ * next from this subtree. By now we worry more about
++ * correctness than about performance...
++ */
++ next_in_service = bfq_lookup_next_entity(sd, 0, NULL);
++ sd->next_in_service = next_in_service;
++
++ if (next_in_service != NULL)
++ bfq_update_budget(next_in_service);
++
++ return 1;
++}
++
++static inline void bfq_check_next_in_service(struct bfq_sched_data *sd,
++ struct bfq_entity *entity)
++{
++ BUG_ON(sd->next_in_service != entity);
++}
++#else
++#define for_each_entity(entity) \
++ for (; entity != NULL; entity = NULL)
++
++#define for_each_entity_safe(entity, parent) \
++ for (parent = NULL; entity != NULL; entity = parent)
++
++static inline int bfq_update_next_in_service(struct bfq_sched_data *sd)
++{
++ return 0;
++}
++
++static inline void bfq_check_next_in_service(struct bfq_sched_data *sd,
++ struct bfq_entity *entity)
++{
++}
++
++static inline void bfq_update_budget(struct bfq_entity *next_in_service)
++{
++}
++#endif
++
++/*
++ * Shift for timestamp calculations. This actually limits the maximum
++ * service allowed in one timestamp delta (small shift values increase it),
++ * the maximum total weight that can be used for the queues in the system
++ * (big shift values increase it), and the period of virtual time
++ * wraparounds.
++ */
++#define WFQ_SERVICE_SHIFT 22
++
++/**
++ * bfq_gt - compare two timestamps.
++ * @a: first ts.
++ * @b: second ts.
++ *
++ * Return @a > @b, dealing with wrapping correctly.
++ */
++static inline int bfq_gt(u64 a, u64 b)
++{
++ return (s64)(a - b) > 0;
++}
++
++static inline struct bfq_queue *bfq_entity_to_bfqq(struct bfq_entity *entity)
++{
++ struct bfq_queue *bfqq = NULL;
++
++ BUG_ON(entity == NULL);
++
++ if (entity->my_sched_data == NULL)
++ bfqq = container_of(entity, struct bfq_queue, entity);
++
++ return bfqq;
++}
++
++
++/**
++ * bfq_delta - map service into the virtual time domain.
++ * @service: amount of service.
++ * @weight: scale factor (weight of an entity or weight sum).
++ */
++static inline u64 bfq_delta(unsigned long service,
++ unsigned long weight)
++{
++ u64 d = (u64)service << WFQ_SERVICE_SHIFT;
++
++ do_div(d, weight);
++ return d;
++}
++
++/**
++ * bfq_calc_finish - assign the finish time to an entity.
++ * @entity: the entity to act upon.
++ * @service: the service to be charged to the entity.
++ */
++static inline void bfq_calc_finish(struct bfq_entity *entity,
++ unsigned long service)
++{
++ struct bfq_queue *bfqq = bfq_entity_to_bfqq(entity);
++
++ BUG_ON(entity->weight == 0);
++
++ entity->finish = entity->start +
++ bfq_delta(service, entity->weight);
++
++ if (bfqq != NULL) {
++ bfq_log_bfqq(bfqq->bfqd, bfqq,
++ "calc_finish: serv %lu, w %d",
++ service, entity->weight);
++ bfq_log_bfqq(bfqq->bfqd, bfqq,
++ "calc_finish: start %llu, finish %llu, delta %llu",
++ entity->start, entity->finish,
++ bfq_delta(service, entity->weight));
++ }
++}
++
++/**
++ * bfq_entity_of - get an entity from a node.
++ * @node: the node field of the entity.
++ *
++ * Convert a node pointer to the relative entity. This is used only
++ * to simplify the logic of some functions and not as the generic
++ * conversion mechanism because, e.g., in the tree walking functions,
++ * the check for a %NULL value would be redundant.
++ */
++static inline struct bfq_entity *bfq_entity_of(struct rb_node *node)
++{
++ struct bfq_entity *entity = NULL;
++
++ if (node != NULL)
++ entity = rb_entry(node, struct bfq_entity, rb_node);
++
++ return entity;
++}
++
++/**
++ * bfq_extract - remove an entity from a tree.
++ * @root: the tree root.
++ * @entity: the entity to remove.
++ */
++static inline void bfq_extract(struct rb_root *root,
++ struct bfq_entity *entity)
++{
++ BUG_ON(entity->tree != root);
++
++ entity->tree = NULL;
++ rb_erase(&entity->rb_node, root);
++}
++
++/**
++ * bfq_idle_extract - extract an entity from the idle tree.
++ * @st: the service tree of the owning @entity.
++ * @entity: the entity being removed.
++ */
++static void bfq_idle_extract(struct bfq_service_tree *st,
++ struct bfq_entity *entity)
++{
++ struct bfq_queue *bfqq = bfq_entity_to_bfqq(entity);
++ struct rb_node *next;
++
++ BUG_ON(entity->tree != &st->idle);
++
++ if (entity == st->first_idle) {
++ next = rb_next(&entity->rb_node);
++ st->first_idle = bfq_entity_of(next);
++ }
++
++ if (entity == st->last_idle) {
++ next = rb_prev(&entity->rb_node);
++ st->last_idle = bfq_entity_of(next);
++ }
++
++ bfq_extract(&st->idle, entity);
++
++ if (bfqq != NULL)
++ list_del(&bfqq->bfqq_list);
++}
++
++/**
++ * bfq_insert - generic tree insertion.
++ * @root: tree root.
++ * @entity: entity to insert.
++ *
++ * This is used for the idle and the active tree, since they are both
++ * ordered by finish time.
++ */
++static void bfq_insert(struct rb_root *root, struct bfq_entity *entity)
++{
++ struct bfq_entity *entry;
++ struct rb_node **node = &root->rb_node;
++ struct rb_node *parent = NULL;
++
++ BUG_ON(entity->tree != NULL);
++
++ while (*node != NULL) {
++ parent = *node;
++ entry = rb_entry(parent, struct bfq_entity, rb_node);
++
++ if (bfq_gt(entry->finish, entity->finish))
++ node = &parent->rb_left;
++ else
++ node = &parent->rb_right;
++ }
++
++ rb_link_node(&entity->rb_node, parent, node);
++ rb_insert_color(&entity->rb_node, root);
++
++ entity->tree = root;
++}
++
++/**
++ * bfq_update_min - update the min_start field of a entity.
++ * @entity: the entity to update.
++ * @node: one of its children.
++ *
++ * This function is called when @entity may store an invalid value for
++ * min_start due to updates to the active tree. The function assumes
++ * that the subtree rooted at @node (which may be its left or its right
++ * child) has a valid min_start value.
++ */
++static inline void bfq_update_min(struct bfq_entity *entity,
++ struct rb_node *node)
++{
++ struct bfq_entity *child;
++
++ if (node != NULL) {
++ child = rb_entry(node, struct bfq_entity, rb_node);
++ if (bfq_gt(entity->min_start, child->min_start))
++ entity->min_start = child->min_start;
++ }
++}
++
++/**
++ * bfq_update_active_node - recalculate min_start.
++ * @node: the node to update.
++ *
++ * @node may have changed position or one of its children may have moved,
++ * this function updates its min_start value. The left and right subtrees
++ * are assumed to hold a correct min_start value.
++ */
++static inline void bfq_update_active_node(struct rb_node *node)
++{
++ struct bfq_entity *entity = rb_entry(node, struct bfq_entity, rb_node);
++
++ entity->min_start = entity->start;
++ bfq_update_min(entity, node->rb_right);
++ bfq_update_min(entity, node->rb_left);
++}
++
++/**
++ * bfq_update_active_tree - update min_start for the whole active tree.
++ * @node: the starting node.
++ *
++ * @node must be the deepest modified node after an update. This function
++ * updates its min_start using the values held by its children, assuming
++ * that they did not change, and then updates all the nodes that may have
++ * changed in the path to the root. The only nodes that may have changed
++ * are the ones in the path or their siblings.
++ */
++static void bfq_update_active_tree(struct rb_node *node)
++{
++ struct rb_node *parent;
++
++up:
++ bfq_update_active_node(node);
++
++ parent = rb_parent(node);
++ if (parent == NULL)
++ return;
++
++ if (node == parent->rb_left && parent->rb_right != NULL)
++ bfq_update_active_node(parent->rb_right);
++ else if (parent->rb_left != NULL)
++ bfq_update_active_node(parent->rb_left);
++
++ node = parent;
++ goto up;
++}
++
++static void bfq_weights_tree_add(struct bfq_data *bfqd,
++ struct bfq_entity *entity,
++ struct rb_root *root);
++
++static void bfq_weights_tree_remove(struct bfq_data *bfqd,
++ struct bfq_entity *entity,
++ struct rb_root *root);
++
++
++/**
++ * bfq_active_insert - insert an entity in the active tree of its
++ * group/device.
++ * @st: the service tree of the entity.
++ * @entity: the entity being inserted.
++ *
++ * The active tree is ordered by finish time, but an extra key is kept
++ * per each node, containing the minimum value for the start times of
++ * its children (and the node itself), so it's possible to search for
++ * the eligible node with the lowest finish time in logarithmic time.
++ */
++static void bfq_active_insert(struct bfq_service_tree *st,
++ struct bfq_entity *entity)
++{
++ struct bfq_queue *bfqq = bfq_entity_to_bfqq(entity);
++ struct rb_node *node = &entity->rb_node;
++#ifdef CONFIG_CGROUP_BFQIO
++ struct bfq_sched_data *sd = NULL;
++ struct bfq_group *bfqg = NULL;
++ struct bfq_data *bfqd = NULL;
++#endif
++
++ bfq_insert(&st->active, entity);
++
++ if (node->rb_left != NULL)
++ node = node->rb_left;
++ else if (node->rb_right != NULL)
++ node = node->rb_right;
++
++ bfq_update_active_tree(node);
++
++#ifdef CONFIG_CGROUP_BFQIO
++ sd = entity->sched_data;
++ bfqg = container_of(sd, struct bfq_group, sched_data);
++ BUG_ON(!bfqg);
++ bfqd = (struct bfq_data *)bfqg->bfqd;
++#endif
++ if (bfqq != NULL)
++ list_add(&bfqq->bfqq_list, &bfqq->bfqd->active_list);
++#ifdef CONFIG_CGROUP_BFQIO
++ else { /* bfq_group */
++ BUG_ON(!bfqd);
++ bfq_weights_tree_add(bfqd, entity, &bfqd->group_weights_tree);
++ }
++ if (bfqg != bfqd->root_group) {
++ BUG_ON(!bfqg);
++ BUG_ON(!bfqd);
++ bfqg->active_entities++;
++ if (bfqg->active_entities == 2)
++ bfqd->active_numerous_groups++;
++ }
++#endif
++}
++
++/**
++ * bfq_ioprio_to_weight - calc a weight from an ioprio.
++ * @ioprio: the ioprio value to convert.
++ */
++static inline unsigned short bfq_ioprio_to_weight(int ioprio)
++{
++ BUG_ON(ioprio < 0 || ioprio >= IOPRIO_BE_NR);
++ return IOPRIO_BE_NR - ioprio;
++}
++
++/**
++ * bfq_weight_to_ioprio - calc an ioprio from a weight.
++ * @weight: the weight value to convert.
++ *
++ * To preserve as mush as possible the old only-ioprio user interface,
++ * 0 is used as an escape ioprio value for weights (numerically) equal or
++ * larger than IOPRIO_BE_NR
++ */
++static inline unsigned short bfq_weight_to_ioprio(int weight)
++{
++ BUG_ON(weight < BFQ_MIN_WEIGHT || weight > BFQ_MAX_WEIGHT);
++ return IOPRIO_BE_NR - weight < 0 ? 0 : IOPRIO_BE_NR - weight;
++}
++
++static inline void bfq_get_entity(struct bfq_entity *entity)
++{
++ struct bfq_queue *bfqq = bfq_entity_to_bfqq(entity);
++
++ if (bfqq != NULL) {
++ atomic_inc(&bfqq->ref);
++ bfq_log_bfqq(bfqq->bfqd, bfqq, "get_entity: %p %d",
++ bfqq, atomic_read(&bfqq->ref));
++ }
++}
++
++/**
++ * bfq_find_deepest - find the deepest node that an extraction can modify.
++ * @node: the node being removed.
++ *
++ * Do the first step of an extraction in an rb tree, looking for the
++ * node that will replace @node, and returning the deepest node that
++ * the following modifications to the tree can touch. If @node is the
++ * last node in the tree return %NULL.
++ */
++static struct rb_node *bfq_find_deepest(struct rb_node *node)
++{
++ struct rb_node *deepest;
++
++ if (node->rb_right == NULL && node->rb_left == NULL)
++ deepest = rb_parent(node);
++ else if (node->rb_right == NULL)
++ deepest = node->rb_left;
++ else if (node->rb_left == NULL)
++ deepest = node->rb_right;
++ else {
++ deepest = rb_next(node);
++ if (deepest->rb_right != NULL)
++ deepest = deepest->rb_right;
++ else if (rb_parent(deepest) != node)
++ deepest = rb_parent(deepest);
++ }
++
++ return deepest;
++}
++
++/**
++ * bfq_active_extract - remove an entity from the active tree.
++ * @st: the service_tree containing the tree.
++ * @entity: the entity being removed.
++ */
++static void bfq_active_extract(struct bfq_service_tree *st,
++ struct bfq_entity *entity)
++{
++ struct bfq_queue *bfqq = bfq_entity_to_bfqq(entity);
++ struct rb_node *node;
++#ifdef CONFIG_CGROUP_BFQIO
++ struct bfq_sched_data *sd = NULL;
++ struct bfq_group *bfqg = NULL;
++ struct bfq_data *bfqd = NULL;
++#endif
++
++ node = bfq_find_deepest(&entity->rb_node);
++ bfq_extract(&st->active, entity);
++
++ if (node != NULL)
++ bfq_update_active_tree(node);
++
++#ifdef CONFIG_CGROUP_BFQIO
++ sd = entity->sched_data;
++ bfqg = container_of(sd, struct bfq_group, sched_data);
++ BUG_ON(!bfqg);
++ bfqd = (struct bfq_data *)bfqg->bfqd;
++#endif
++ if (bfqq != NULL)
++ list_del(&bfqq->bfqq_list);
++#ifdef CONFIG_CGROUP_BFQIO
++ else { /* bfq_group */
++ BUG_ON(!bfqd);
++ bfq_weights_tree_remove(bfqd, entity,
++ &bfqd->group_weights_tree);
++ }
++ if (bfqg != bfqd->root_group) {
++ BUG_ON(!bfqg);
++ BUG_ON(!bfqd);
++ BUG_ON(!bfqg->active_entities);
++ bfqg->active_entities--;
++ if (bfqg->active_entities == 1) {
++ BUG_ON(!bfqd->active_numerous_groups);
++ bfqd->active_numerous_groups--;
++ }
++ }
++#endif
++}
++
++/**
++ * bfq_idle_insert - insert an entity into the idle tree.
++ * @st: the service tree containing the tree.
++ * @entity: the entity to insert.
++ */
++static void bfq_idle_insert(struct bfq_service_tree *st,
++ struct bfq_entity *entity)
++{
++ struct bfq_queue *bfqq = bfq_entity_to_bfqq(entity);
++ struct bfq_entity *first_idle = st->first_idle;
++ struct bfq_entity *last_idle = st->last_idle;
++
++ if (first_idle == NULL || bfq_gt(first_idle->finish, entity->finish))
++ st->first_idle = entity;
++ if (last_idle == NULL || bfq_gt(entity->finish, last_idle->finish))
++ st->last_idle = entity;
++
++ bfq_insert(&st->idle, entity);
++
++ if (bfqq != NULL)
++ list_add(&bfqq->bfqq_list, &bfqq->bfqd->idle_list);
++}
++
++/**
++ * bfq_forget_entity - remove an entity from the wfq trees.
++ * @st: the service tree.
++ * @entity: the entity being removed.
++ *
++ * Update the device status and forget everything about @entity, putting
++ * the device reference to it, if it is a queue. Entities belonging to
++ * groups are not refcounted.
++ */
++static void bfq_forget_entity(struct bfq_service_tree *st,
++ struct bfq_entity *entity)
++{
++ struct bfq_queue *bfqq = bfq_entity_to_bfqq(entity);
++ struct bfq_sched_data *sd;
++
++ BUG_ON(!entity->on_st);
++
++ entity->on_st = 0;
++ st->wsum -= entity->weight;
++ if (bfqq != NULL) {
++ sd = entity->sched_data;
++ bfq_log_bfqq(bfqq->bfqd, bfqq, "forget_entity: %p %d",
++ bfqq, atomic_read(&bfqq->ref));
++ bfq_put_queue(bfqq);
++ }
++}
++
++/**
++ * bfq_put_idle_entity - release the idle tree ref of an entity.
++ * @st: service tree for the entity.
++ * @entity: the entity being released.
++ */
++static void bfq_put_idle_entity(struct bfq_service_tree *st,
++ struct bfq_entity *entity)
++{
++ bfq_idle_extract(st, entity);
++ bfq_forget_entity(st, entity);
++}
++
++/**
++ * bfq_forget_idle - update the idle tree if necessary.
++ * @st: the service tree to act upon.
++ *
++ * To preserve the global O(log N) complexity we only remove one entry here;
++ * as the idle tree will not grow indefinitely this can be done safely.
++ */
++static void bfq_forget_idle(struct bfq_service_tree *st)
++{
++ struct bfq_entity *first_idle = st->first_idle;
++ struct bfq_entity *last_idle = st->last_idle;
++
++ if (RB_EMPTY_ROOT(&st->active) && last_idle != NULL &&
++ !bfq_gt(last_idle->finish, st->vtime)) {
++ /*
++ * Forget the whole idle tree, increasing the vtime past
++ * the last finish time of idle entities.
++ */
++ st->vtime = last_idle->finish;
++ }
++
++ if (first_idle != NULL && !bfq_gt(first_idle->finish, st->vtime))
++ bfq_put_idle_entity(st, first_idle);
++}
++
++static struct bfq_service_tree *
++__bfq_entity_update_weight_prio(struct bfq_service_tree *old_st,
++ struct bfq_entity *entity)
++{
++ struct bfq_service_tree *new_st = old_st;
++
++ if (entity->ioprio_changed) {
++ struct bfq_queue *bfqq = bfq_entity_to_bfqq(entity);
++ unsigned short prev_weight, new_weight;
++ struct bfq_data *bfqd = NULL;
++ struct rb_root *root;
++#ifdef CONFIG_CGROUP_BFQIO
++ struct bfq_sched_data *sd;
++ struct bfq_group *bfqg;
++#endif
++
++ if (bfqq != NULL)
++ bfqd = bfqq->bfqd;
++#ifdef CONFIG_CGROUP_BFQIO
++ else {
++ sd = entity->my_sched_data;
++ bfqg = container_of(sd, struct bfq_group, sched_data);
++ BUG_ON(!bfqg);
++ bfqd = (struct bfq_data *)bfqg->bfqd;
++ BUG_ON(!bfqd);
++ }
++#endif
++
++ BUG_ON(old_st->wsum < entity->weight);
++ old_st->wsum -= entity->weight;
++
++ if (entity->new_weight != entity->orig_weight) {
++ entity->orig_weight = entity->new_weight;
++ entity->ioprio =
++ bfq_weight_to_ioprio(entity->orig_weight);
++ } else if (entity->new_ioprio != entity->ioprio) {
++ entity->ioprio = entity->new_ioprio;
++ entity->orig_weight =
++ bfq_ioprio_to_weight(entity->ioprio);
++ } else
++ entity->new_weight = entity->orig_weight =
++ bfq_ioprio_to_weight(entity->ioprio);
++
++ entity->ioprio_class = entity->new_ioprio_class;
++ entity->ioprio_changed = 0;
++
++ /*
++ * NOTE: here we may be changing the weight too early,
++ * this will cause unfairness. The correct approach
++ * would have required additional complexity to defer
++ * weight changes to the proper time instants (i.e.,
++ * when entity->finish <= old_st->vtime).
++ */
++ new_st = bfq_entity_service_tree(entity);
++
++ prev_weight = entity->weight;
++ new_weight = entity->orig_weight *
++ (bfqq != NULL ? bfqq->wr_coeff : 1);
++ /*
++ * If the weight of the entity changes, remove the entity
++ * from its old weight counter (if there is a counter
++ * associated with the entity), and add it to the counter
++ * associated with its new weight.
++ */
++ if (prev_weight != new_weight) {
++ root = bfqq ? &bfqd->queue_weights_tree :
++ &bfqd->group_weights_tree;
++ bfq_weights_tree_remove(bfqd, entity, root);
++ }
++ entity->weight = new_weight;
++ /*
++ * Add the entity to its weights tree only if it is
++ * not associated with a weight-raised queue.
++ */
++ if (prev_weight != new_weight &&
++ (bfqq ? bfqq->wr_coeff == 1 : 1))
++ /* If we get here, root has been initialized. */
++ bfq_weights_tree_add(bfqd, entity, root);
++
++ new_st->wsum += entity->weight;
++
++ if (new_st != old_st)
++ entity->start = new_st->vtime;
++ }
++
++ return new_st;
++}
++
++/**
++ * bfq_bfqq_served - update the scheduler status after selection for
++ * service.
++ * @bfqq: the queue being served.
++ * @served: bytes to transfer.
++ *
++ * NOTE: this can be optimized, as the timestamps of upper level entities
++ * are synchronized every time a new bfqq is selected for service. By now,
++ * we keep it to better check consistency.
++ */
++static void bfq_bfqq_served(struct bfq_queue *bfqq, unsigned long served)
++{
++ struct bfq_entity *entity = &bfqq->entity;
++ struct bfq_service_tree *st;
++
++ for_each_entity(entity) {
++ st = bfq_entity_service_tree(entity);
++
++ entity->service += served;
++ BUG_ON(entity->service > entity->budget);
++ BUG_ON(st->wsum == 0);
++
++ st->vtime += bfq_delta(served, st->wsum);
++ bfq_forget_idle(st);
++ }
++ bfq_log_bfqq(bfqq->bfqd, bfqq, "bfqq_served %lu secs", served);
++}
++
++/**
++ * bfq_bfqq_charge_full_budget - set the service to the entity budget.
++ * @bfqq: the queue that needs a service update.
++ *
++ * When it's not possible to be fair in the service domain, because
++ * a queue is not consuming its budget fast enough (the meaning of
++ * fast depends on the timeout parameter), we charge it a full
++ * budget. In this way we should obtain a sort of time-domain
++ * fairness among all the seeky/slow queues.
++ */
++static inline void bfq_bfqq_charge_full_budget(struct bfq_queue *bfqq)
++{
++ struct bfq_entity *entity = &bfqq->entity;
++
++ bfq_log_bfqq(bfqq->bfqd, bfqq, "charge_full_budget");
++
++ bfq_bfqq_served(bfqq, entity->budget - entity->service);
++}
++
++/**
++ * __bfq_activate_entity - activate an entity.
++ * @entity: the entity being activated.
++ *
++ * Called whenever an entity is activated, i.e., it is not active and one
++ * of its children receives a new request, or has to be reactivated due to
++ * budget exhaustion. It uses the current budget of the entity (and the
++ * service received if @entity is active) of the queue to calculate its
++ * timestamps.
++ */
++static void __bfq_activate_entity(struct bfq_entity *entity)
++{
++ struct bfq_sched_data *sd = entity->sched_data;
++ struct bfq_service_tree *st = bfq_entity_service_tree(entity);
++
++ if (entity == sd->in_service_entity) {
++ BUG_ON(entity->tree != NULL);
++ /*
++ * If we are requeueing the current entity we have
++ * to take care of not charging to it service it has
++ * not received.
++ */
++ bfq_calc_finish(entity, entity->service);
++ entity->start = entity->finish;
++ sd->in_service_entity = NULL;
++ } else if (entity->tree == &st->active) {
++ /*
++ * Requeueing an entity due to a change of some
++ * next_in_service entity below it. We reuse the
++ * old start time.
++ */
++ bfq_active_extract(st, entity);
++ } else if (entity->tree == &st->idle) {
++ /*
++ * Must be on the idle tree, bfq_idle_extract() will
++ * check for that.
++ */
++ bfq_idle_extract(st, entity);
++ entity->start = bfq_gt(st->vtime, entity->finish) ?
++ st->vtime : entity->finish;
++ } else {
++ /*
++ * The finish time of the entity may be invalid, and
++ * it is in the past for sure, otherwise the queue
++ * would have been on the idle tree.
++ */
++ entity->start = st->vtime;
++ st->wsum += entity->weight;
++ bfq_get_entity(entity);
++
++ BUG_ON(entity->on_st);
++ entity->on_st = 1;
++ }
++
++ st = __bfq_entity_update_weight_prio(st, entity);
++ bfq_calc_finish(entity, entity->budget);
++ bfq_active_insert(st, entity);
++}
++
++/**
++ * bfq_activate_entity - activate an entity and its ancestors if necessary.
++ * @entity: the entity to activate.
++ *
++ * Activate @entity and all the entities on the path from it to the root.
++ */
++static void bfq_activate_entity(struct bfq_entity *entity)
++{
++ struct bfq_sched_data *sd;
++
++ for_each_entity(entity) {
++ __bfq_activate_entity(entity);
++
++ sd = entity->sched_data;
++ if (!bfq_update_next_in_service(sd))
++ /*
++ * No need to propagate the activation to the
++ * upper entities, as they will be updated when
++ * the in-service entity is rescheduled.
++ */
++ break;
++ }
++}
++
++/**
++ * __bfq_deactivate_entity - deactivate an entity from its service tree.
++ * @entity: the entity to deactivate.
++ * @requeue: if false, the entity will not be put into the idle tree.
++ *
++ * Deactivate an entity, independently from its previous state. If the
++ * entity was not on a service tree just return, otherwise if it is on
++ * any scheduler tree, extract it from that tree, and if necessary
++ * and if the caller did not specify @requeue, put it on the idle tree.
++ *
++ * Return %1 if the caller should update the entity hierarchy, i.e.,
++ * if the entity was in service or if it was the next_in_service for
++ * its sched_data; return %0 otherwise.
++ */
++static int __bfq_deactivate_entity(struct bfq_entity *entity, int requeue)
++{
++ struct bfq_sched_data *sd = entity->sched_data;
++ struct bfq_service_tree *st = bfq_entity_service_tree(entity);
++ int was_in_service = entity == sd->in_service_entity;
++ int ret = 0;
++
++ if (!entity->on_st)
++ return 0;
++
++ BUG_ON(was_in_service && entity->tree != NULL);
++
++ if (was_in_service) {
++ bfq_calc_finish(entity, entity->service);
++ sd->in_service_entity = NULL;
++ } else if (entity->tree == &st->active)
++ bfq_active_extract(st, entity);
++ else if (entity->tree == &st->idle)
++ bfq_idle_extract(st, entity);
++ else if (entity->tree != NULL)
++ BUG();
++
++ if (was_in_service || sd->next_in_service == entity)
++ ret = bfq_update_next_in_service(sd);
++
++ if (!requeue || !bfq_gt(entity->finish, st->vtime))
++ bfq_forget_entity(st, entity);
++ else
++ bfq_idle_insert(st, entity);
++
++ BUG_ON(sd->in_service_entity == entity);
++ BUG_ON(sd->next_in_service == entity);
++
++ return ret;
++}
++
++/**
++ * bfq_deactivate_entity - deactivate an entity.
++ * @entity: the entity to deactivate.
++ * @requeue: true if the entity can be put on the idle tree
++ */
++static void bfq_deactivate_entity(struct bfq_entity *entity, int requeue)
++{
++ struct bfq_sched_data *sd;
++ struct bfq_entity *parent;
++
++ for_each_entity_safe(entity, parent) {
++ sd = entity->sched_data;
++
++ if (!__bfq_deactivate_entity(entity, requeue))
++ /*
++ * The parent entity is still backlogged, and
++ * we don't need to update it as it is still
++ * in service.
++ */
++ break;
++
++ if (sd->next_in_service != NULL)
++ /*
++ * The parent entity is still backlogged and
++ * the budgets on the path towards the root
++ * need to be updated.
++ */
++ goto update;
++
++ /*
++ * If we reach there the parent is no more backlogged and
++ * we want to propagate the dequeue upwards.
++ */
++ requeue = 1;
++ }
++
++ return;
++
++update:
++ entity = parent;
++ for_each_entity(entity) {
++ __bfq_activate_entity(entity);
++
++ sd = entity->sched_data;
++ if (!bfq_update_next_in_service(sd))
++ break;
++ }
++}
++
++/**
++ * bfq_update_vtime - update vtime if necessary.
++ * @st: the service tree to act upon.
++ *
++ * If necessary update the service tree vtime to have at least one
++ * eligible entity, skipping to its start time. Assumes that the
++ * active tree of the device is not empty.
++ *
++ * NOTE: this hierarchical implementation updates vtimes quite often,
++ * we may end up with reactivated processes getting timestamps after a
++ * vtime skip done because we needed a ->first_active entity on some
++ * intermediate node.
++ */
++static void bfq_update_vtime(struct bfq_service_tree *st)
++{
++ struct bfq_entity *entry;
++ struct rb_node *node = st->active.rb_node;
++
++ entry = rb_entry(node, struct bfq_entity, rb_node);
++ if (bfq_gt(entry->min_start, st->vtime)) {
++ st->vtime = entry->min_start;
++ bfq_forget_idle(st);
++ }
++}
++
++/**
++ * bfq_first_active_entity - find the eligible entity with
++ * the smallest finish time
++ * @st: the service tree to select from.
++ *
++ * This function searches the first schedulable entity, starting from the
++ * root of the tree and going on the left every time on this side there is
++ * a subtree with at least one eligible (start >= vtime) entity. The path on
++ * the right is followed only if a) the left subtree contains no eligible
++ * entities and b) no eligible entity has been found yet.
++ */
++static struct bfq_entity *bfq_first_active_entity(struct bfq_service_tree *st)
++{
++ struct bfq_entity *entry, *first = NULL;
++ struct rb_node *node = st->active.rb_node;
++
++ while (node != NULL) {
++ entry = rb_entry(node, struct bfq_entity, rb_node);
++left:
++ if (!bfq_gt(entry->start, st->vtime))
++ first = entry;
++
++ BUG_ON(bfq_gt(entry->min_start, st->vtime));
++
++ if (node->rb_left != NULL) {
++ entry = rb_entry(node->rb_left,
++ struct bfq_entity, rb_node);
++ if (!bfq_gt(entry->min_start, st->vtime)) {
++ node = node->rb_left;
++ goto left;
++ }
++ }
++ if (first != NULL)
++ break;
++ node = node->rb_right;
++ }
++
++ BUG_ON(first == NULL && !RB_EMPTY_ROOT(&st->active));
++ return first;
++}
++
++/**
++ * __bfq_lookup_next_entity - return the first eligible entity in @st.
++ * @st: the service tree.
++ *
++ * Update the virtual time in @st and return the first eligible entity
++ * it contains.
++ */
++static struct bfq_entity *__bfq_lookup_next_entity(struct bfq_service_tree *st,
++ bool force)
++{
++ struct bfq_entity *entity, *new_next_in_service = NULL;
++
++ if (RB_EMPTY_ROOT(&st->active))
++ return NULL;
++
++ bfq_update_vtime(st);
++ entity = bfq_first_active_entity(st);
++ BUG_ON(bfq_gt(entity->start, st->vtime));
++
++ /*
++ * If the chosen entity does not match with the sched_data's
++ * next_in_service and we are forcedly serving the IDLE priority
++ * class tree, bubble up budget update.
++ */
++ if (unlikely(force && entity != entity->sched_data->next_in_service)) {
++ new_next_in_service = entity;
++ for_each_entity(new_next_in_service)
++ bfq_update_budget(new_next_in_service);
++ }
++
++ return entity;
++}
++
++/**
++ * bfq_lookup_next_entity - return the first eligible entity in @sd.
++ * @sd: the sched_data.
++ * @extract: if true the returned entity will be also extracted from @sd.
++ *
++ * NOTE: since we cache the next_in_service entity at each level of the
++ * hierarchy, the complexity of the lookup can be decreased with
++ * absolutely no effort just returning the cached next_in_service value;
++ * we prefer to do full lookups to test the consistency of * the data
++ * structures.
++ */
++static struct bfq_entity *bfq_lookup_next_entity(struct bfq_sched_data *sd,
++ int extract,
++ struct bfq_data *bfqd)
++{
++ struct bfq_service_tree *st = sd->service_tree;
++ struct bfq_entity *entity;
++ int i = 0;
++
++ BUG_ON(sd->in_service_entity != NULL);
++
++ if (bfqd != NULL &&
++ jiffies - bfqd->bfq_class_idle_last_service > BFQ_CL_IDLE_TIMEOUT) {
++ entity = __bfq_lookup_next_entity(st + BFQ_IOPRIO_CLASSES - 1,
++ true);
++ if (entity != NULL) {
++ i = BFQ_IOPRIO_CLASSES - 1;
++ bfqd->bfq_class_idle_last_service = jiffies;
++ sd->next_in_service = entity;
++ }
++ }
++ for (; i < BFQ_IOPRIO_CLASSES; i++) {
++ entity = __bfq_lookup_next_entity(st + i, false);
++ if (entity != NULL) {
++ if (extract) {
++ bfq_check_next_in_service(sd, entity);
++ bfq_active_extract(st + i, entity);
++ sd->in_service_entity = entity;
++ sd->next_in_service = NULL;
++ }
++ break;
++ }
++ }
++
++ return entity;
++}
++
++/*
++ * Get next queue for service.
++ */
++static struct bfq_queue *bfq_get_next_queue(struct bfq_data *bfqd)
++{
++ struct bfq_entity *entity = NULL;
++ struct bfq_sched_data *sd;
++ struct bfq_queue *bfqq;
++
++ BUG_ON(bfqd->in_service_queue != NULL);
++
++ if (bfqd->busy_queues == 0)
++ return NULL;
++
++ sd = &bfqd->root_group->sched_data;
++ for (; sd != NULL; sd = entity->my_sched_data) {
++ entity = bfq_lookup_next_entity(sd, 1, bfqd);
++ BUG_ON(entity == NULL);
++ entity->service = 0;
++ }
++
++ bfqq = bfq_entity_to_bfqq(entity);
++ BUG_ON(bfqq == NULL);
++
++ return bfqq;
++}
++
++/*
++ * Forced extraction of the given queue.
++ */
++static void bfq_get_next_queue_forced(struct bfq_data *bfqd,
++ struct bfq_queue *bfqq)
++{
++ struct bfq_entity *entity;
++ struct bfq_sched_data *sd;
++
++ BUG_ON(bfqd->in_service_queue != NULL);
++
++ entity = &bfqq->entity;
++ /*
++ * Bubble up extraction/update from the leaf to the root.
++ */
++ for_each_entity(entity) {
++ sd = entity->sched_data;
++ bfq_update_budget(entity);
++ bfq_update_vtime(bfq_entity_service_tree(entity));
++ bfq_active_extract(bfq_entity_service_tree(entity), entity);
++ sd->in_service_entity = entity;
++ sd->next_in_service = NULL;
++ entity->service = 0;
++ }
++
++ return;
++}
++
++static void __bfq_bfqd_reset_in_service(struct bfq_data *bfqd)
++{
++ if (bfqd->in_service_bic != NULL) {
++ put_io_context(bfqd->in_service_bic->icq.ioc);
++ bfqd->in_service_bic = NULL;
++ }
++
++ bfqd->in_service_queue = NULL;
++ del_timer(&bfqd->idle_slice_timer);
++}
++
++static void bfq_deactivate_bfqq(struct bfq_data *bfqd, struct bfq_queue *bfqq,
++ int requeue)
++{
++ struct bfq_entity *entity = &bfqq->entity;
++
++ if (bfqq == bfqd->in_service_queue)
++ __bfq_bfqd_reset_in_service(bfqd);
++
++ bfq_deactivate_entity(entity, requeue);
++}
++
++static void bfq_activate_bfqq(struct bfq_data *bfqd, struct bfq_queue *bfqq)
++{
++ struct bfq_entity *entity = &bfqq->entity;
++
++ bfq_activate_entity(entity);
++}
++
++/*
++ * Called when the bfqq no longer has requests pending, remove it from
++ * the service tree.
++ */
++static void bfq_del_bfqq_busy(struct bfq_data *bfqd, struct bfq_queue *bfqq,
++ int requeue)
++{
++ BUG_ON(!bfq_bfqq_busy(bfqq));
++ BUG_ON(!RB_EMPTY_ROOT(&bfqq->sort_list));
++
++ bfq_log_bfqq(bfqd, bfqq, "del from busy");
++
++ bfq_clear_bfqq_busy(bfqq);
++
++ BUG_ON(bfqd->busy_queues == 0);
++ bfqd->busy_queues--;
++
++ if (!bfqq->dispatched) {
++ bfq_weights_tree_remove(bfqd, &bfqq->entity,
++ &bfqd->queue_weights_tree);
++ if (!blk_queue_nonrot(bfqd->queue)) {
++ BUG_ON(!bfqd->busy_in_flight_queues);
++ bfqd->busy_in_flight_queues--;
++ if (bfq_bfqq_constantly_seeky(bfqq)) {
++ BUG_ON(!bfqd->
++ const_seeky_busy_in_flight_queues);
++ bfqd->const_seeky_busy_in_flight_queues--;
++ }
++ }
++ }
++ if (bfqq->wr_coeff > 1)
++ bfqd->wr_busy_queues--;
++
++ bfq_deactivate_bfqq(bfqd, bfqq, requeue);
++}
++
++/*
++ * Called when an inactive queue receives a new request.
++ */
++static void bfq_add_bfqq_busy(struct bfq_data *bfqd, struct bfq_queue *bfqq)
++{
++ BUG_ON(bfq_bfqq_busy(bfqq));
++ BUG_ON(bfqq == bfqd->in_service_queue);
++
++ bfq_log_bfqq(bfqd, bfqq, "add to busy");
++
++ bfq_activate_bfqq(bfqd, bfqq);
++
++ bfq_mark_bfqq_busy(bfqq);
++ bfqd->busy_queues++;
++
++ if (!bfqq->dispatched) {
++ if (bfqq->wr_coeff == 1)
++ bfq_weights_tree_add(bfqd, &bfqq->entity,
++ &bfqd->queue_weights_tree);
++ if (!blk_queue_nonrot(bfqd->queue)) {
++ bfqd->busy_in_flight_queues++;
++ if (bfq_bfqq_constantly_seeky(bfqq))
++ bfqd->const_seeky_busy_in_flight_queues++;
++ }
++ }
++ if (bfqq->wr_coeff > 1)
++ bfqd->wr_busy_queues++;
++}
+diff --git a/block/bfq.h b/block/bfq.h
+new file mode 100644
+index 0000000..01dcdc4
+--- /dev/null
++++ b/block/bfq.h
+@@ -0,0 +1,773 @@
++/*
++ * BFQ-v7r6 for 3.18.0: data structures and common functions prototypes.
++ *
++ * Based on ideas and code from CFQ:
++ * Copyright (C) 2003 Jens Axboe <axboe@kernel.dk>
++ *
++ * Copyright (C) 2008 Fabio Checconi <fabio@gandalf.sssup.it>
++ * Paolo Valente <paolo.valente@unimore.it>
++ *
++ * Copyright (C) 2010 Paolo Valente <paolo.valente@unimore.it>
++ */
++
++#ifndef _BFQ_H
++#define _BFQ_H
++
++#include <linux/blktrace_api.h>
++#include <linux/hrtimer.h>
++#include <linux/ioprio.h>
++#include <linux/rbtree.h>
++
++#define BFQ_IOPRIO_CLASSES 3
++#define BFQ_CL_IDLE_TIMEOUT (HZ/5)
++
++#define BFQ_MIN_WEIGHT 1
++#define BFQ_MAX_WEIGHT 1000
++
++#define BFQ_DEFAULT_GRP_WEIGHT 10
++#define BFQ_DEFAULT_GRP_IOPRIO 0
++#define BFQ_DEFAULT_GRP_CLASS IOPRIO_CLASS_BE
++
++struct bfq_entity;
++
++/**
++ * struct bfq_service_tree - per ioprio_class service tree.
++ * @active: tree for active entities (i.e., those backlogged).
++ * @idle: tree for idle entities (i.e., those not backlogged, with V <= F_i).
++ * @first_idle: idle entity with minimum F_i.
++ * @last_idle: idle entity with maximum F_i.
++ * @vtime: scheduler virtual time.
++ * @wsum: scheduler weight sum; active and idle entities contribute to it.
++ *
++ * Each service tree represents a B-WF2Q+ scheduler on its own. Each
++ * ioprio_class has its own independent scheduler, and so its own
++ * bfq_service_tree. All the fields are protected by the queue lock
++ * of the containing bfqd.
++ */
++struct bfq_service_tree {
++ struct rb_root active;
++ struct rb_root idle;
++
++ struct bfq_entity *first_idle;
++ struct bfq_entity *last_idle;
++
++ u64 vtime;
++ unsigned long wsum;
++};
++
++/**
++ * struct bfq_sched_data - multi-class scheduler.
++ * @in_service_entity: entity in service.
++ * @next_in_service: head-of-the-line entity in the scheduler.
++ * @service_tree: array of service trees, one per ioprio_class.
++ *
++ * bfq_sched_data is the basic scheduler queue. It supports three
++ * ioprio_classes, and can be used either as a toplevel queue or as
++ * an intermediate queue on a hierarchical setup.
++ * @next_in_service points to the active entity of the sched_data
++ * service trees that will be scheduled next.
++ *
++ * The supported ioprio_classes are the same as in CFQ, in descending
++ * priority order, IOPRIO_CLASS_RT, IOPRIO_CLASS_BE, IOPRIO_CLASS_IDLE.
++ * Requests from higher priority queues are served before all the
++ * requests from lower priority queues; among requests of the same
++ * queue requests are served according to B-WF2Q+.
++ * All the fields are protected by the queue lock of the containing bfqd.
++ */
++struct bfq_sched_data {
++ struct bfq_entity *in_service_entity;
++ struct bfq_entity *next_in_service;
++ struct bfq_service_tree service_tree[BFQ_IOPRIO_CLASSES];
++};
++
++/**
++ * struct bfq_weight_counter - counter of the number of all active entities
++ * with a given weight.
++ * @weight: weight of the entities that this counter refers to.
++ * @num_active: number of active entities with this weight.
++ * @weights_node: weights tree member (see bfq_data's @queue_weights_tree
++ * and @group_weights_tree).
++ */
++struct bfq_weight_counter {
++ short int weight;
++ unsigned int num_active;
++ struct rb_node weights_node;
++};
++
++/**
++ * struct bfq_entity - schedulable entity.
++ * @rb_node: service_tree member.
++ * @weight_counter: pointer to the weight counter associated with this entity.
++ * @on_st: flag, true if the entity is on a tree (either the active or
++ * the idle one of its service_tree).
++ * @finish: B-WF2Q+ finish timestamp (aka F_i).
++ * @start: B-WF2Q+ start timestamp (aka S_i).
++ * @tree: tree the entity is enqueued into; %NULL if not on a tree.
++ * @min_start: minimum start time of the (active) subtree rooted at
++ * this entity; used for O(log N) lookups into active trees.
++ * @service: service received during the last round of service.
++ * @budget: budget used to calculate F_i; F_i = S_i + @budget / @weight.
++ * @weight: weight of the queue
++ * @parent: parent entity, for hierarchical scheduling.
++ * @my_sched_data: for non-leaf nodes in the cgroup hierarchy, the
++ * associated scheduler queue, %NULL on leaf nodes.
++ * @sched_data: the scheduler queue this entity belongs to.
++ * @ioprio: the ioprio in use.
++ * @new_weight: when a weight change is requested, the new weight value.
++ * @orig_weight: original weight, used to implement weight boosting
++ * @new_ioprio: when an ioprio change is requested, the new ioprio value.
++ * @ioprio_class: the ioprio_class in use.
++ * @new_ioprio_class: when an ioprio_class change is requested, the new
++ * ioprio_class value.
++ * @ioprio_changed: flag, true when the user requested a weight, ioprio or
++ * ioprio_class change.
++ *
++ * A bfq_entity is used to represent either a bfq_queue (leaf node in the
++ * cgroup hierarchy) or a bfq_group into the upper level scheduler. Each
++ * entity belongs to the sched_data of the parent group in the cgroup
++ * hierarchy. Non-leaf entities have also their own sched_data, stored
++ * in @my_sched_data.
++ *
++ * Each entity stores independently its priority values; this would
++ * allow different weights on different devices, but this
++ * functionality is not exported to userspace by now. Priorities and
++ * weights are updated lazily, first storing the new values into the
++ * new_* fields, then setting the @ioprio_changed flag. As soon as
++ * there is a transition in the entity state that allows the priority
++ * update to take place the effective and the requested priority
++ * values are synchronized.
++ *
++ * Unless cgroups are used, the weight value is calculated from the
++ * ioprio to export the same interface as CFQ. When dealing with
++ * ``well-behaved'' queues (i.e., queues that do not spend too much
++ * time to consume their budget and have true sequential behavior, and
++ * when there are no external factors breaking anticipation) the
++ * relative weights at each level of the cgroups hierarchy should be
++ * guaranteed. All the fields are protected by the queue lock of the
++ * containing bfqd.
++ */
++struct bfq_entity {
++ struct rb_node rb_node;
++ struct bfq_weight_counter *weight_counter;
++
++ int on_st;
++
++ u64 finish;
++ u64 start;
++
++ struct rb_root *tree;
++
++ u64 min_start;
++
++ unsigned long service, budget;
++ unsigned short weight, new_weight;
++ unsigned short orig_weight;
++
++ struct bfq_entity *parent;
++
++ struct bfq_sched_data *my_sched_data;
++ struct bfq_sched_data *sched_data;
++
++ unsigned short ioprio, new_ioprio;
++ unsigned short ioprio_class, new_ioprio_class;
++
++ int ioprio_changed;
++};
++
++struct bfq_group;
++
++/**
++ * struct bfq_queue - leaf schedulable entity.
++ * @ref: reference counter.
++ * @bfqd: parent bfq_data.
++ * @new_bfqq: shared bfq_queue if queue is cooperating with
++ * one or more other queues.
++ * @pos_node: request-position tree member (see bfq_data's @rq_pos_tree).
++ * @pos_root: request-position tree root (see bfq_data's @rq_pos_tree).
++ * @sort_list: sorted list of pending requests.
++ * @next_rq: if fifo isn't expired, next request to serve.
++ * @queued: nr of requests queued in @sort_list.
++ * @allocated: currently allocated requests.
++ * @meta_pending: pending metadata requests.
++ * @fifo: fifo list of requests in sort_list.
++ * @entity: entity representing this queue in the scheduler.
++ * @max_budget: maximum budget allowed from the feedback mechanism.
++ * @budget_timeout: budget expiration (in jiffies).
++ * @dispatched: number of requests on the dispatch list or inside driver.
++ * @flags: status flags.
++ * @bfqq_list: node for active/idle bfqq list inside our bfqd.
++ * @burst_list_node: node for the device's burst list.
++ * @seek_samples: number of seeks sampled
++ * @seek_total: sum of the distances of the seeks sampled
++ * @seek_mean: mean seek distance
++ * @last_request_pos: position of the last request enqueued
++ * @requests_within_timer: number of consecutive pairs of request completion
++ * and arrival, such that the queue becomes idle
++ * after the completion, but the next request arrives
++ * within an idle time slice; used only if the queue's
++ * IO_bound has been cleared.
++ * @pid: pid of the process owning the queue, used for logging purposes.
++ * @last_wr_start_finish: start time of the current weight-raising period if
++ * the @bfq-queue is being weight-raised, otherwise
++ * finish time of the last weight-raising period
++ * @wr_cur_max_time: current max raising time for this queue
++ * @soft_rt_next_start: minimum time instant such that, only if a new
++ * request is enqueued after this time instant in an
++ * idle @bfq_queue with no outstanding requests, then
++ * the task associated with the queue it is deemed as
++ * soft real-time (see the comments to the function
++ * bfq_bfqq_softrt_next_start()).
++ * @last_idle_bklogged: time of the last transition of the @bfq_queue from
++ * idle to backlogged
++ * @service_from_backlogged: cumulative service received from the @bfq_queue
++ * since the last transition from idle to
++ * backlogged
++ *
++ * A bfq_queue is a leaf request queue; it can be associated with an io_context
++ * or more, if it is async or shared between cooperating processes. @cgroup
++ * holds a reference to the cgroup, to be sure that it does not disappear while
++ * a bfqq still references it (mostly to avoid races between request issuing and
++ * task migration followed by cgroup destruction).
++ * All the fields are protected by the queue lock of the containing bfqd.
++ */
++struct bfq_queue {
++ atomic_t ref;
++ struct bfq_data *bfqd;
++
++ /* fields for cooperating queues handling */
++ struct bfq_queue *new_bfqq;
++ struct rb_node pos_node;
++ struct rb_root *pos_root;
++
++ struct rb_root sort_list;
++ struct request *next_rq;
++ int queued[2];
++ int allocated[2];
++ int meta_pending;
++ struct list_head fifo;
++
++ struct bfq_entity entity;
++
++ unsigned long max_budget;
++ unsigned long budget_timeout;
++
++ int dispatched;
++
++ unsigned int flags;
++
++ struct list_head bfqq_list;
++
++ struct hlist_node burst_list_node;
++
++ unsigned int seek_samples;
++ u64 seek_total;
++ sector_t seek_mean;
++ sector_t last_request_pos;
++
++ unsigned int requests_within_timer;
++
++ pid_t pid;
++
++ /* weight-raising fields */
++ unsigned long wr_cur_max_time;
++ unsigned long soft_rt_next_start;
++ unsigned long last_wr_start_finish;
++ unsigned int wr_coeff;
++ unsigned long last_idle_bklogged;
++ unsigned long service_from_backlogged;
++};
++
++/**
++ * struct bfq_ttime - per process thinktime stats.
++ * @ttime_total: total process thinktime
++ * @ttime_samples: number of thinktime samples
++ * @ttime_mean: average process thinktime
++ */
++struct bfq_ttime {
++ unsigned long last_end_request;
++
++ unsigned long ttime_total;
++ unsigned long ttime_samples;
++ unsigned long ttime_mean;
++};
++
++/**
++ * struct bfq_io_cq - per (request_queue, io_context) structure.
++ * @icq: associated io_cq structure
++ * @bfqq: array of two process queues, the sync and the async
++ * @ttime: associated @bfq_ttime struct
++ */
++struct bfq_io_cq {
++ struct io_cq icq; /* must be the first member */
++ struct bfq_queue *bfqq[2];
++ struct bfq_ttime ttime;
++ int ioprio;
++};
++
++enum bfq_device_speed {
++ BFQ_BFQD_FAST,
++ BFQ_BFQD_SLOW,
++};
++
++/**
++ * struct bfq_data - per device data structure.
++ * @queue: request queue for the managed device.
++ * @root_group: root bfq_group for the device.
++ * @rq_pos_tree: rbtree sorted by next_request position, used when
++ * determining if two or more queues have interleaving
++ * requests (see bfq_close_cooperator()).
++ * @active_numerous_groups: number of bfq_groups containing more than one
++ * active @bfq_entity.
++ * @queue_weights_tree: rbtree of weight counters of @bfq_queues, sorted by
++ * weight. Used to keep track of whether all @bfq_queues
++ * have the same weight. The tree contains one counter
++ * for each distinct weight associated to some active
++ * and not weight-raised @bfq_queue (see the comments to
++ * the functions bfq_weights_tree_[add|remove] for
++ * further details).
++ * @group_weights_tree: rbtree of non-queue @bfq_entity weight counters, sorted
++ * by weight. Used to keep track of whether all
++ * @bfq_groups have the same weight. The tree contains
++ * one counter for each distinct weight associated to
++ * some active @bfq_group (see the comments to the
++ * functions bfq_weights_tree_[add|remove] for further
++ * details).
++ * @busy_queues: number of bfq_queues containing requests (including the
++ * queue in service, even if it is idling).
++ * @busy_in_flight_queues: number of @bfq_queues containing pending or
++ * in-flight requests, plus the @bfq_queue in
++ * service, even if idle but waiting for the
++ * possible arrival of its next sync request. This
++ * field is updated only if the device is rotational,
++ * but used only if the device is also NCQ-capable.
++ * The reason why the field is updated also for non-
++ * NCQ-capable rotational devices is related to the
++ * fact that the value of @hw_tag may be set also
++ * later than when busy_in_flight_queues may need to
++ * be incremented for the first time(s). Taking also
++ * this possibility into account, to avoid unbalanced
++ * increments/decrements, would imply more overhead
++ * than just updating busy_in_flight_queues
++ * regardless of the value of @hw_tag.
++ * @const_seeky_busy_in_flight_queues: number of constantly-seeky @bfq_queues
++ * (that is, seeky queues that expired
++ * for budget timeout at least once)
++ * containing pending or in-flight
++ * requests, including the in-service
++ * @bfq_queue if constantly seeky. This
++ * field is updated only if the device
++ * is rotational, but used only if the
++ * device is also NCQ-capable (see the
++ * comments to @busy_in_flight_queues).
++ * @wr_busy_queues: number of weight-raised busy @bfq_queues.
++ * @queued: number of queued requests.
++ * @rq_in_driver: number of requests dispatched and waiting for completion.
++ * @sync_flight: number of sync requests in the driver.
++ * @max_rq_in_driver: max number of reqs in driver in the last
++ * @hw_tag_samples completed requests.
++ * @hw_tag_samples: nr of samples used to calculate hw_tag.
++ * @hw_tag: flag set to one if the driver is showing a queueing behavior.
++ * @budgets_assigned: number of budgets assigned.
++ * @idle_slice_timer: timer set when idling for the next sequential request
++ * from the queue in service.
++ * @unplug_work: delayed work to restart dispatching on the request queue.
++ * @in_service_queue: bfq_queue in service.
++ * @in_service_bic: bfq_io_cq (bic) associated with the @in_service_queue.
++ * @last_position: on-disk position of the last served request.
++ * @last_budget_start: beginning of the last budget.
++ * @last_idling_start: beginning of the last idle slice.
++ * @peak_rate: peak transfer rate observed for a budget.
++ * @peak_rate_samples: number of samples used to calculate @peak_rate.
++ * @bfq_max_budget: maximum budget allotted to a bfq_queue before
++ * rescheduling.
++ * @group_list: list of all the bfq_groups active on the device.
++ * @active_list: list of all the bfq_queues active on the device.
++ * @idle_list: list of all the bfq_queues idle on the device.
++ * @bfq_quantum: max number of requests dispatched per dispatch round.
++ * @bfq_fifo_expire: timeout for async/sync requests; when it expires
++ * requests are served in fifo order.
++ * @bfq_back_penalty: weight of backward seeks wrt forward ones.
++ * @bfq_back_max: maximum allowed backward seek.
++ * @bfq_slice_idle: maximum idling time.
++ * @bfq_user_max_budget: user-configured max budget value
++ * (0 for auto-tuning).
++ * @bfq_max_budget_async_rq: maximum budget (in nr of requests) allotted to
++ * async queues.
++ * @bfq_timeout: timeout for bfq_queues to consume their budget; used to
++ * to prevent seeky queues to impose long latencies to well
++ * behaved ones (this also implies that seeky queues cannot
++ * receive guarantees in the service domain; after a timeout
++ * they are charged for the whole allocated budget, to try
++ * to preserve a behavior reasonably fair among them, but
++ * without service-domain guarantees).
++ * @bfq_coop_thresh: number of queue merges after which a @bfq_queue is
++ * no more granted any weight-raising.
++ * @bfq_failed_cooperations: number of consecutive failed cooperation
++ * chances after which weight-raising is restored
++ * to a queue subject to more than bfq_coop_thresh
++ * queue merges.
++ * @bfq_requests_within_timer: number of consecutive requests that must be
++ * issued within the idle time slice to set
++ * again idling to a queue which was marked as
++ * non-I/O-bound (see the definition of the
++ * IO_bound flag for further details).
++ * @last_ins_in_burst: last time at which a queue entered the current
++ * burst of queues being activated shortly after
++ * each other; for more details about this and the
++ * following parameters related to a burst of
++ * activations, see the comments to the function
++ * @bfq_handle_burst.
++ * @bfq_burst_interval: reference time interval used to decide whether a
++ * queue has been activated shortly after
++ * @last_ins_in_burst.
++ * @burst_size: number of queues in the current burst of queue activations.
++ * @bfq_large_burst_thresh: maximum burst size above which the current
++ * queue-activation burst is deemed as 'large'.
++ * @large_burst: true if a large queue-activation burst is in progress.
++ * @burst_list: head of the burst list (as for the above fields, more details
++ * in the comments to the function bfq_handle_burst).
++ * @low_latency: if set to true, low-latency heuristics are enabled.
++ * @bfq_wr_coeff: maximum factor by which the weight of a weight-raised
++ * queue is multiplied.
++ * @bfq_wr_max_time: maximum duration of a weight-raising period (jiffies).
++ * @bfq_wr_rt_max_time: maximum duration for soft real-time processes.
++ * @bfq_wr_min_idle_time: minimum idle period after which weight-raising
++ * may be reactivated for a queue (in jiffies).
++ * @bfq_wr_min_inter_arr_async: minimum period between request arrivals
++ * after which weight-raising may be
++ * reactivated for an already busy queue
++ * (in jiffies).
++ * @bfq_wr_max_softrt_rate: max service-rate for a soft real-time queue,
++ * sectors per seconds.
++ * @RT_prod: cached value of the product R*T used for computing the maximum
++ * duration of the weight raising automatically.
++ * @device_speed: device-speed class for the low-latency heuristic.
++ * @oom_bfqq: fallback dummy bfqq for extreme OOM conditions.
++ *
++ * All the fields are protected by the @queue lock.
++ */
++struct bfq_data {
++ struct request_queue *queue;
++
++ struct bfq_group *root_group;
++ struct rb_root rq_pos_tree;
++
++#ifdef CONFIG_CGROUP_BFQIO
++ int active_numerous_groups;
++#endif
++
++ struct rb_root queue_weights_tree;
++ struct rb_root group_weights_tree;
++
++ int busy_queues;
++ int busy_in_flight_queues;
++ int const_seeky_busy_in_flight_queues;
++ int wr_busy_queues;
++ int queued;
++ int rq_in_driver;
++ int sync_flight;
++
++ int max_rq_in_driver;
++ int hw_tag_samples;
++ int hw_tag;
++
++ int budgets_assigned;
++
++ struct timer_list idle_slice_timer;
++ struct work_struct unplug_work;
++
++ struct bfq_queue *in_service_queue;
++ struct bfq_io_cq *in_service_bic;
++
++ sector_t last_position;
++
++ ktime_t last_budget_start;
++ ktime_t last_idling_start;
++ int peak_rate_samples;
++ u64 peak_rate;
++ unsigned long bfq_max_budget;
++
++ struct hlist_head group_list;
++ struct list_head active_list;
++ struct list_head idle_list;
++
++ unsigned int bfq_quantum;
++ unsigned int bfq_fifo_expire[2];
++ unsigned int bfq_back_penalty;
++ unsigned int bfq_back_max;
++ unsigned int bfq_slice_idle;
++ u64 bfq_class_idle_last_service;
++
++ unsigned int bfq_user_max_budget;
++ unsigned int bfq_max_budget_async_rq;
++ unsigned int bfq_timeout[2];
++
++ unsigned int bfq_coop_thresh;
++ unsigned int bfq_failed_cooperations;
++ unsigned int bfq_requests_within_timer;
++
++ unsigned long last_ins_in_burst;
++ unsigned long bfq_burst_interval;
++ int burst_size;
++ unsigned long bfq_large_burst_thresh;
++ bool large_burst;
++ struct hlist_head burst_list;
++
++ bool low_latency;
++
++ /* parameters of the low_latency heuristics */
++ unsigned int bfq_wr_coeff;
++ unsigned int bfq_wr_max_time;
++ unsigned int bfq_wr_rt_max_time;
++ unsigned int bfq_wr_min_idle_time;
++ unsigned long bfq_wr_min_inter_arr_async;
++ unsigned int bfq_wr_max_softrt_rate;
++ u64 RT_prod;
++ enum bfq_device_speed device_speed;
++
++ struct bfq_queue oom_bfqq;
++};
++
++enum bfqq_state_flags {
++ BFQ_BFQQ_FLAG_busy = 0, /* has requests or is in service */
++ BFQ_BFQQ_FLAG_wait_request, /* waiting for a request */
++ BFQ_BFQQ_FLAG_must_alloc, /* must be allowed rq alloc */
++ BFQ_BFQQ_FLAG_fifo_expire, /* FIFO checked in this slice */
++ BFQ_BFQQ_FLAG_idle_window, /* slice idling enabled */
++ BFQ_BFQQ_FLAG_prio_changed, /* task priority has changed */
++ BFQ_BFQQ_FLAG_sync, /* synchronous queue */
++ BFQ_BFQQ_FLAG_budget_new, /* no completion with this budget */
++ BFQ_BFQQ_FLAG_IO_bound, /*
++ * bfqq has timed-out at least once
++ * having consumed at most 2/10 of
++ * its budget
++ */
++ BFQ_BFQQ_FLAG_in_large_burst, /*
++ * bfqq activated in a large burst,
++ * see comments to bfq_handle_burst.
++ */
++ BFQ_BFQQ_FLAG_constantly_seeky, /*
++ * bfqq has proved to be slow and
++ * seeky until budget timeout
++ */
++ BFQ_BFQQ_FLAG_softrt_update, /*
++ * may need softrt-next-start
++ * update
++ */
++ BFQ_BFQQ_FLAG_coop, /* bfqq is shared */
++ BFQ_BFQQ_FLAG_split_coop, /* shared bfqq will be splitted */
++};
++
++#define BFQ_BFQQ_FNS(name) \
++static inline void bfq_mark_bfqq_##name(struct bfq_queue *bfqq) \
++{ \
++ (bfqq)->flags |= (1 << BFQ_BFQQ_FLAG_##name); \
++} \
++static inline void bfq_clear_bfqq_##name(struct bfq_queue *bfqq) \
++{ \
++ (bfqq)->flags &= ~(1 << BFQ_BFQQ_FLAG_##name); \
++} \
++static inline int bfq_bfqq_##name(const struct bfq_queue *bfqq) \
++{ \
++ return ((bfqq)->flags & (1 << BFQ_BFQQ_FLAG_##name)) != 0; \
++}
++
++BFQ_BFQQ_FNS(busy);
++BFQ_BFQQ_FNS(wait_request);
++BFQ_BFQQ_FNS(must_alloc);
++BFQ_BFQQ_FNS(fifo_expire);
++BFQ_BFQQ_FNS(idle_window);
++BFQ_BFQQ_FNS(prio_changed);
++BFQ_BFQQ_FNS(sync);
++BFQ_BFQQ_FNS(budget_new);
++BFQ_BFQQ_FNS(IO_bound);
++BFQ_BFQQ_FNS(in_large_burst);
++BFQ_BFQQ_FNS(constantly_seeky);
++BFQ_BFQQ_FNS(coop);
++BFQ_BFQQ_FNS(split_coop);
++BFQ_BFQQ_FNS(softrt_update);
++#undef BFQ_BFQQ_FNS
++
++/* Logging facilities. */
++#define bfq_log_bfqq(bfqd, bfqq, fmt, args...) \
++ blk_add_trace_msg((bfqd)->queue, "bfq%d " fmt, (bfqq)->pid, ##args)
++
++#define bfq_log(bfqd, fmt, args...) \
++ blk_add_trace_msg((bfqd)->queue, "bfq " fmt, ##args)
++
++/* Expiration reasons. */
++enum bfqq_expiration {
++ BFQ_BFQQ_TOO_IDLE = 0, /*
++ * queue has been idling for
++ * too long
++ */
++ BFQ_BFQQ_BUDGET_TIMEOUT, /* budget took too long to be used */
++ BFQ_BFQQ_BUDGET_EXHAUSTED, /* budget consumed */
++ BFQ_BFQQ_NO_MORE_REQUESTS, /* the queue has no more requests */
++};
++
++#ifdef CONFIG_CGROUP_BFQIO
++/**
++ * struct bfq_group - per (device, cgroup) data structure.
++ * @entity: schedulable entity to insert into the parent group sched_data.
++ * @sched_data: own sched_data, to contain child entities (they may be
++ * both bfq_queues and bfq_groups).
++ * @group_node: node to be inserted into the bfqio_cgroup->group_data
++ * list of the containing cgroup's bfqio_cgroup.
++ * @bfqd_node: node to be inserted into the @bfqd->group_list list
++ * of the groups active on the same device; used for cleanup.
++ * @bfqd: the bfq_data for the device this group acts upon.
++ * @async_bfqq: array of async queues for all the tasks belonging to
++ * the group, one queue per ioprio value per ioprio_class,
++ * except for the idle class that has only one queue.
++ * @async_idle_bfqq: async queue for the idle class (ioprio is ignored).
++ * @my_entity: pointer to @entity, %NULL for the toplevel group; used
++ * to avoid too many special cases during group creation/
++ * migration.
++ * @active_entities: number of active entities belonging to the group;
++ * unused for the root group. Used to know whether there
++ * are groups with more than one active @bfq_entity
++ * (see the comments to the function
++ * bfq_bfqq_must_not_expire()).
++ *
++ * Each (device, cgroup) pair has its own bfq_group, i.e., for each cgroup
++ * there is a set of bfq_groups, each one collecting the lower-level
++ * entities belonging to the group that are acting on the same device.
++ *
++ * Locking works as follows:
++ * o @group_node is protected by the bfqio_cgroup lock, and is accessed
++ * via RCU from its readers.
++ * o @bfqd is protected by the queue lock, RCU is used to access it
++ * from the readers.
++ * o All the other fields are protected by the @bfqd queue lock.
++ */
++struct bfq_group {
++ struct bfq_entity entity;
++ struct bfq_sched_data sched_data;
++
++ struct hlist_node group_node;
++ struct hlist_node bfqd_node;
++
++ void *bfqd;
++
++ struct bfq_queue *async_bfqq[2][IOPRIO_BE_NR];
++ struct bfq_queue *async_idle_bfqq;
++
++ struct bfq_entity *my_entity;
++
++ int active_entities;
++};
++
++/**
++ * struct bfqio_cgroup - bfq cgroup data structure.
++ * @css: subsystem state for bfq in the containing cgroup.
++ * @online: flag marked when the subsystem is inserted.
++ * @weight: cgroup weight.
++ * @ioprio: cgroup ioprio.
++ * @ioprio_class: cgroup ioprio_class.
++ * @lock: spinlock that protects @ioprio, @ioprio_class and @group_data.
++ * @group_data: list containing the bfq_group belonging to this cgroup.
++ *
++ * @group_data is accessed using RCU, with @lock protecting the updates,
++ * @ioprio and @ioprio_class are protected by @lock.
++ */
++struct bfqio_cgroup {
++ struct cgroup_subsys_state css;
++ bool online;
++
++ unsigned short weight, ioprio, ioprio_class;
++
++ spinlock_t lock;
++ struct hlist_head group_data;
++};
++#else
++struct bfq_group {
++ struct bfq_sched_data sched_data;
++
++ struct bfq_queue *async_bfqq[2][IOPRIO_BE_NR];
++ struct bfq_queue *async_idle_bfqq;
++};
++#endif
++
++static inline struct bfq_service_tree *
++bfq_entity_service_tree(struct bfq_entity *entity)
++{
++ struct bfq_sched_data *sched_data = entity->sched_data;
++ unsigned int idx = entity->ioprio_class - 1;
++
++ BUG_ON(idx >= BFQ_IOPRIO_CLASSES);
++ BUG_ON(sched_data == NULL);
++
++ return sched_data->service_tree + idx;
++}
++
++static inline struct bfq_queue *bic_to_bfqq(struct bfq_io_cq *bic,
++ bool is_sync)
++{
++ return bic->bfqq[is_sync];
++}
++
++static inline void bic_set_bfqq(struct bfq_io_cq *bic,
++ struct bfq_queue *bfqq, bool is_sync)
++{
++ bic->bfqq[is_sync] = bfqq;
++}
++
++static inline struct bfq_data *bic_to_bfqd(struct bfq_io_cq *bic)
++{
++ return bic->icq.q->elevator->elevator_data;
++}
++
++/**
++ * bfq_get_bfqd_locked - get a lock to a bfqd using a RCU protected pointer.
++ * @ptr: a pointer to a bfqd.
++ * @flags: storage for the flags to be saved.
++ *
++ * This function allows bfqg->bfqd to be protected by the
++ * queue lock of the bfqd they reference; the pointer is dereferenced
++ * under RCU, so the storage for bfqd is assured to be safe as long
++ * as the RCU read side critical section does not end. After the
++ * bfqd->queue->queue_lock is taken the pointer is rechecked, to be
++ * sure that no other writer accessed it. If we raced with a writer,
++ * the function returns NULL, with the queue unlocked, otherwise it
++ * returns the dereferenced pointer, with the queue locked.
++ */
++static inline struct bfq_data *bfq_get_bfqd_locked(void **ptr,
++ unsigned long *flags)
++{
++ struct bfq_data *bfqd;
++
++ rcu_read_lock();
++ bfqd = rcu_dereference(*(struct bfq_data **)ptr);
++
++ if (bfqd != NULL) {
++ spin_lock_irqsave(bfqd->queue->queue_lock, *flags);
++ if (*ptr == bfqd)
++ goto out;
++ spin_unlock_irqrestore(bfqd->queue->queue_lock, *flags);
++ }
++
++ bfqd = NULL;
++out:
++ rcu_read_unlock();
++ return bfqd;
++}
++
++static inline void bfq_put_bfqd_unlock(struct bfq_data *bfqd,
++ unsigned long *flags)
++{
++ spin_unlock_irqrestore(bfqd->queue->queue_lock, *flags);
++}
++
++static void bfq_changed_ioprio(struct bfq_io_cq *bic);
++static void bfq_put_queue(struct bfq_queue *bfqq);
++static void bfq_dispatch_insert(struct request_queue *q, struct request *rq);
++static struct bfq_queue *bfq_get_queue(struct bfq_data *bfqd,
++ struct bfq_group *bfqg, int is_sync,
++ struct bfq_io_cq *bic, gfp_t gfp_mask);
++static void bfq_end_wr_async_queues(struct bfq_data *bfqd,
++ struct bfq_group *bfqg);
++static void bfq_put_async_queues(struct bfq_data *bfqd, struct bfq_group *bfqg);
++static void bfq_exit_bfqq(struct bfq_data *bfqd, struct bfq_queue *bfqq);
++
++#endif /* _BFQ_H */
+--
+2.1.3
+
diff --git a/5003_block-bfq-add-Early-Queue-Merge-EQM-to-BFQ-v7r6-for-3.18.0.patch b/5003_block-bfq-add-Early-Queue-Merge-EQM-to-BFQ-v7r6-for-3.18.0.patch
new file mode 100644
index 0000000..5c9a70b
--- /dev/null
+++ b/5003_block-bfq-add-Early-Queue-Merge-EQM-to-BFQ-v7r6-for-3.18.0.patch
@@ -0,0 +1,1214 @@
+From 04f637beb4b6801a81894e9918eee5899e5cc5b5 Mon Sep 17 00:00:00 2001
+From: Mauro Andreolini <mauro.andreolini@unimore.it>
+Date: Sun, 19 Oct 2014 01:15:59 +0200
+Subject: [PATCH 3/3] block, bfq: add Early Queue Merge (EQM) to BFQ-v7r6 for
+ 3.18.0
+
+A set of processes may happen to perform interleaved reads, i.e.,requests
+whose union would give rise to a sequential read pattern. There are two
+typical cases: in the first case, processes read fixed-size chunks of
+data at a fixed distance from each other, while in the second case processes
+may read variable-size chunks at variable distances. The latter case occurs
+for example with QEMU, which splits the I/O generated by the guest into
+multiple chunks, and lets these chunks be served by a pool of cooperating
+processes, iteratively assigning the next chunk of I/O to the first
+available process. CFQ uses actual queue merging for the first type of
+rocesses, whereas it uses preemption to get a sequential read pattern out
+of the read requests performed by the second type of processes. In the end
+it uses two different mechanisms to achieve the same goal: boosting the
+throughput with interleaved I/O.
+
+This patch introduces Early Queue Merge (EQM), a unified mechanism to get a
+sequential read pattern with both types of processes. The main idea is
+checking newly arrived requests against the next request of the active queue
+both in case of actual request insert and in case of request merge. By doing
+so, both the types of processes can be handled by just merging their queues.
+EQM is then simpler and more compact than the pair of mechanisms used in
+CFQ.
+
+Finally, EQM also preserves the typical low-latency properties of BFQ, by
+properly restoring the weight-raising state of a queue when it gets back to
+a non-merged state.
+
+Signed-off-by: Mauro Andreolini <mauro.andreolini@unimore.it>
+Signed-off-by: Arianna Avanzini <avanzini.arianna@gmail.com>
+Signed-off-by: Paolo Valente <paolo.valente@unimore.it>
+---
+ block/bfq-iosched.c | 743 +++++++++++++++++++++++++++++++++++++---------------
+ block/bfq-sched.c | 28 --
+ block/bfq.h | 54 +++-
+ 3 files changed, 573 insertions(+), 252 deletions(-)
+
+diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c
+index b919b03..bbfb4e1 100644
+--- a/block/bfq-iosched.c
++++ b/block/bfq-iosched.c
+@@ -571,6 +571,57 @@ static inline unsigned int bfq_wr_duration(struct bfq_data *bfqd)
+ return dur;
+ }
+
++static inline unsigned
++bfq_bfqq_cooperations(struct bfq_queue *bfqq)
++{
++ return bfqq->bic ? bfqq->bic->cooperations : 0;
++}
++
++static inline void
++bfq_bfqq_resume_state(struct bfq_queue *bfqq, struct bfq_io_cq *bic)
++{
++ if (bic->saved_idle_window)
++ bfq_mark_bfqq_idle_window(bfqq);
++ else
++ bfq_clear_bfqq_idle_window(bfqq);
++ if (bic->saved_IO_bound)
++ bfq_mark_bfqq_IO_bound(bfqq);
++ else
++ bfq_clear_bfqq_IO_bound(bfqq);
++ /* Assuming that the flag in_large_burst is already correctly set */
++ if (bic->wr_time_left && bfqq->bfqd->low_latency &&
++ !bfq_bfqq_in_large_burst(bfqq) &&
++ bic->cooperations < bfqq->bfqd->bfq_coop_thresh) {
++ /*
++ * Start a weight raising period with the duration given by
++ * the raising_time_left snapshot.
++ */
++ if (bfq_bfqq_busy(bfqq))
++ bfqq->bfqd->wr_busy_queues++;
++ bfqq->wr_coeff = bfqq->bfqd->bfq_wr_coeff;
++ bfqq->wr_cur_max_time = bic->wr_time_left;
++ bfqq->last_wr_start_finish = jiffies;
++ bfqq->entity.ioprio_changed = 1;
++ }
++ /*
++ * Clear wr_time_left to prevent bfq_bfqq_save_state() from
++ * getting confused about the queue's need of a weight-raising
++ * period.
++ */
++ bic->wr_time_left = 0;
++}
++
++/* Must be called with the queue_lock held. */
++static int bfqq_process_refs(struct bfq_queue *bfqq)
++{
++ int process_refs, io_refs;
++
++ io_refs = bfqq->allocated[READ] + bfqq->allocated[WRITE];
++ process_refs = atomic_read(&bfqq->ref) - io_refs - bfqq->entity.on_st;
++ BUG_ON(process_refs < 0);
++ return process_refs;
++}
++
+ /* Empty burst list and add just bfqq (see comments to bfq_handle_burst) */
+ static inline void bfq_reset_burst_list(struct bfq_data *bfqd,
+ struct bfq_queue *bfqq)
+@@ -815,7 +866,7 @@ static void bfq_add_request(struct request *rq)
+ bfq_rq_pos_tree_add(bfqd, bfqq);
+
+ if (!bfq_bfqq_busy(bfqq)) {
+- bool soft_rt,
++ bool soft_rt, coop_or_in_burst,
+ idle_for_long_time = time_is_before_jiffies(
+ bfqq->budget_timeout +
+ bfqd->bfq_wr_min_idle_time);
+@@ -839,11 +890,12 @@ static void bfq_add_request(struct request *rq)
+ bfqd->last_ins_in_burst = jiffies;
+ }
+
++ coop_or_in_burst = bfq_bfqq_in_large_burst(bfqq) ||
++ bfq_bfqq_cooperations(bfqq) >= bfqd->bfq_coop_thresh;
+ soft_rt = bfqd->bfq_wr_max_softrt_rate > 0 &&
+- !bfq_bfqq_in_large_burst(bfqq) &&
++ !coop_or_in_burst &&
+ time_is_before_jiffies(bfqq->soft_rt_next_start);
+- interactive = !bfq_bfqq_in_large_burst(bfqq) &&
+- idle_for_long_time;
++ interactive = !coop_or_in_burst && idle_for_long_time;
+ entity->budget = max_t(unsigned long, bfqq->max_budget,
+ bfq_serv_to_charge(next_rq, bfqq));
+
+@@ -862,11 +914,20 @@ static void bfq_add_request(struct request *rq)
+ if (!bfqd->low_latency)
+ goto add_bfqq_busy;
+
++ if (bfq_bfqq_just_split(bfqq))
++ goto set_ioprio_changed;
++
+ /*
+- * If the queue is not being boosted and has been idle
+- * for enough time, start a weight-raising period
++ * If the queue:
++ * - is not being boosted,
++ * - has been idle for enough time,
++ * - is not a sync queue or is linked to a bfq_io_cq (it is
++ * shared "for its nature" or it is not shared and its
++ * requests have not been redirected to a shared queue)
++ * start a weight-raising period.
+ */
+- if (old_wr_coeff == 1 && (interactive || soft_rt)) {
++ if (old_wr_coeff == 1 && (interactive || soft_rt) &&
++ (!bfq_bfqq_sync(bfqq) || bfqq->bic != NULL)) {
+ bfqq->wr_coeff = bfqd->bfq_wr_coeff;
+ if (interactive)
+ bfqq->wr_cur_max_time = bfq_wr_duration(bfqd);
+@@ -880,7 +941,7 @@ static void bfq_add_request(struct request *rq)
+ } else if (old_wr_coeff > 1) {
+ if (interactive)
+ bfqq->wr_cur_max_time = bfq_wr_duration(bfqd);
+- else if (bfq_bfqq_in_large_burst(bfqq) ||
++ else if (coop_or_in_burst ||
+ (bfqq->wr_cur_max_time ==
+ bfqd->bfq_wr_rt_max_time &&
+ !soft_rt)) {
+@@ -899,18 +960,18 @@ static void bfq_add_request(struct request *rq)
+ /*
+ *
+ * The remaining weight-raising time is lower
+- * than bfqd->bfq_wr_rt_max_time, which
+- * means that the application is enjoying
+- * weight raising either because deemed soft-
+- * rt in the near past, or because deemed
+- * interactive a long ago. In both cases,
+- * resetting now the current remaining weight-
+- * raising time for the application to the
+- * weight-raising duration for soft rt
+- * applications would not cause any latency
+- * increase for the application (as the new
+- * duration would be higher than the remaining
+- * time).
++ * than bfqd->bfq_wr_rt_max_time, which means
++ * that the application is enjoying weight
++ * raising either because deemed soft-rt in
++ * the near past, or because deemed interactive
++ * a long ago.
++ * In both cases, resetting now the current
++ * remaining weight-raising time for the
++ * application to the weight-raising duration
++ * for soft rt applications would not cause any
++ * latency increase for the application (as the
++ * new duration would be higher than the
++ * remaining time).
+ *
+ * In addition, the application is now meeting
+ * the requirements for being deemed soft rt.
+@@ -945,6 +1006,7 @@ static void bfq_add_request(struct request *rq)
+ bfqd->bfq_wr_rt_max_time;
+ }
+ }
++set_ioprio_changed:
+ if (old_wr_coeff != bfqq->wr_coeff)
+ entity->ioprio_changed = 1;
+ add_bfqq_busy:
+@@ -1156,90 +1218,35 @@ static void bfq_end_wr(struct bfq_data *bfqd)
+ spin_unlock_irq(bfqd->queue->queue_lock);
+ }
+
+-static int bfq_allow_merge(struct request_queue *q, struct request *rq,
+- struct bio *bio)
++static inline sector_t bfq_io_struct_pos(void *io_struct, bool request)
+ {
+- struct bfq_data *bfqd = q->elevator->elevator_data;
+- struct bfq_io_cq *bic;
+- struct bfq_queue *bfqq;
+-
+- /*
+- * Disallow merge of a sync bio into an async request.
+- */
+- if (bfq_bio_sync(bio) && !rq_is_sync(rq))
+- return 0;
+-
+- /*
+- * Lookup the bfqq that this bio will be queued with. Allow
+- * merge only if rq is queued there.
+- * Queue lock is held here.
+- */
+- bic = bfq_bic_lookup(bfqd, current->io_context);
+- if (bic == NULL)
+- return 0;
+-
+- bfqq = bic_to_bfqq(bic, bfq_bio_sync(bio));
+- return bfqq == RQ_BFQQ(rq);
+-}
+-
+-static void __bfq_set_in_service_queue(struct bfq_data *bfqd,
+- struct bfq_queue *bfqq)
+-{
+- if (bfqq != NULL) {
+- bfq_mark_bfqq_must_alloc(bfqq);
+- bfq_mark_bfqq_budget_new(bfqq);
+- bfq_clear_bfqq_fifo_expire(bfqq);
+-
+- bfqd->budgets_assigned = (bfqd->budgets_assigned*7 + 256) / 8;
+-
+- bfq_log_bfqq(bfqd, bfqq,
+- "set_in_service_queue, cur-budget = %lu",
+- bfqq->entity.budget);
+- }
+-
+- bfqd->in_service_queue = bfqq;
+-}
+-
+-/*
+- * Get and set a new queue for service.
+- */
+-static struct bfq_queue *bfq_set_in_service_queue(struct bfq_data *bfqd,
+- struct bfq_queue *bfqq)
+-{
+- if (!bfqq)
+- bfqq = bfq_get_next_queue(bfqd);
++ if (request)
++ return blk_rq_pos(io_struct);
+ else
+- bfq_get_next_queue_forced(bfqd, bfqq);
+-
+- __bfq_set_in_service_queue(bfqd, bfqq);
+- return bfqq;
++ return ((struct bio *)io_struct)->bi_iter.bi_sector;
+ }
+
+-static inline sector_t bfq_dist_from_last(struct bfq_data *bfqd,
+- struct request *rq)
++static inline sector_t bfq_dist_from(sector_t pos1,
++ sector_t pos2)
+ {
+- if (blk_rq_pos(rq) >= bfqd->last_position)
+- return blk_rq_pos(rq) - bfqd->last_position;
++ if (pos1 >= pos2)
++ return pos1 - pos2;
+ else
+- return bfqd->last_position - blk_rq_pos(rq);
++ return pos2 - pos1;
+ }
+
+-/*
+- * Return true if bfqq has no request pending and rq is close enough to
+- * bfqd->last_position, or if rq is closer to bfqd->last_position than
+- * bfqq->next_rq
+- */
+-static inline int bfq_rq_close(struct bfq_data *bfqd, struct request *rq)
++static inline int bfq_rq_close_to_sector(void *io_struct, bool request,
++ sector_t sector)
+ {
+- return bfq_dist_from_last(bfqd, rq) <= BFQQ_SEEK_THR;
++ return bfq_dist_from(bfq_io_struct_pos(io_struct, request), sector) <=
++ BFQQ_SEEK_THR;
+ }
+
+-static struct bfq_queue *bfqq_close(struct bfq_data *bfqd)
++static struct bfq_queue *bfqq_close(struct bfq_data *bfqd, sector_t sector)
+ {
+ struct rb_root *root = &bfqd->rq_pos_tree;
+ struct rb_node *parent, *node;
+ struct bfq_queue *__bfqq;
+- sector_t sector = bfqd->last_position;
+
+ if (RB_EMPTY_ROOT(root))
+ return NULL;
+@@ -1258,7 +1265,7 @@ static struct bfq_queue *bfqq_close(struct bfq_data *bfqd)
+ * next_request position).
+ */
+ __bfqq = rb_entry(parent, struct bfq_queue, pos_node);
+- if (bfq_rq_close(bfqd, __bfqq->next_rq))
++ if (bfq_rq_close_to_sector(__bfqq->next_rq, true, sector))
+ return __bfqq;
+
+ if (blk_rq_pos(__bfqq->next_rq) < sector)
+@@ -1269,7 +1276,7 @@ static struct bfq_queue *bfqq_close(struct bfq_data *bfqd)
+ return NULL;
+
+ __bfqq = rb_entry(node, struct bfq_queue, pos_node);
+- if (bfq_rq_close(bfqd, __bfqq->next_rq))
++ if (bfq_rq_close_to_sector(__bfqq->next_rq, true, sector))
+ return __bfqq;
+
+ return NULL;
+@@ -1278,14 +1285,12 @@ static struct bfq_queue *bfqq_close(struct bfq_data *bfqd)
+ /*
+ * bfqd - obvious
+ * cur_bfqq - passed in so that we don't decide that the current queue
+- * is closely cooperating with itself.
+- *
+- * We are assuming that cur_bfqq has dispatched at least one request,
+- * and that bfqd->last_position reflects a position on the disk associated
+- * with the I/O issued by cur_bfqq.
++ * is closely cooperating with itself
++ * sector - used as a reference point to search for a close queue
+ */
+ static struct bfq_queue *bfq_close_cooperator(struct bfq_data *bfqd,
+- struct bfq_queue *cur_bfqq)
++ struct bfq_queue *cur_bfqq,
++ sector_t sector)
+ {
+ struct bfq_queue *bfqq;
+
+@@ -1305,7 +1310,7 @@ static struct bfq_queue *bfq_close_cooperator(struct bfq_data *bfqd,
+ * working closely on the same area of the disk. In that case,
+ * we can group them together and don't waste time idling.
+ */
+- bfqq = bfqq_close(bfqd);
++ bfqq = bfqq_close(bfqd, sector);
+ if (bfqq == NULL || bfqq == cur_bfqq)
+ return NULL;
+
+@@ -1332,6 +1337,307 @@ static struct bfq_queue *bfq_close_cooperator(struct bfq_data *bfqd,
+ return bfqq;
+ }
+
++static struct bfq_queue *
++bfq_setup_merge(struct bfq_queue *bfqq, struct bfq_queue *new_bfqq)
++{
++ int process_refs, new_process_refs;
++ struct bfq_queue *__bfqq;
++
++ /*
++ * If there are no process references on the new_bfqq, then it is
++ * unsafe to follow the ->new_bfqq chain as other bfqq's in the chain
++ * may have dropped their last reference (not just their last process
++ * reference).
++ */
++ if (!bfqq_process_refs(new_bfqq))
++ return NULL;
++
++ /* Avoid a circular list and skip interim queue merges. */
++ while ((__bfqq = new_bfqq->new_bfqq)) {
++ if (__bfqq == bfqq)
++ return NULL;
++ new_bfqq = __bfqq;
++ }
++
++ process_refs = bfqq_process_refs(bfqq);
++ new_process_refs = bfqq_process_refs(new_bfqq);
++ /*
++ * If the process for the bfqq has gone away, there is no
++ * sense in merging the queues.
++ */
++ if (process_refs == 0 || new_process_refs == 0)
++ return NULL;
++
++ bfq_log_bfqq(bfqq->bfqd, bfqq, "scheduling merge with queue %d",
++ new_bfqq->pid);
++
++ /*
++ * Merging is just a redirection: the requests of the process
++ * owning one of the two queues are redirected to the other queue.
++ * The latter queue, in its turn, is set as shared if this is the
++ * first time that the requests of some process are redirected to
++ * it.
++ *
++ * We redirect bfqq to new_bfqq and not the opposite, because we
++ * are in the context of the process owning bfqq, hence we have
++ * the io_cq of this process. So we can immediately configure this
++ * io_cq to redirect the requests of the process to new_bfqq.
++ *
++ * NOTE, even if new_bfqq coincides with the in-service queue, the
++ * io_cq of new_bfqq is not available, because, if the in-service
++ * queue is shared, bfqd->in_service_bic may not point to the
++ * io_cq of the in-service queue.
++ * Redirecting the requests of the process owning bfqq to the
++ * currently in-service queue is in any case the best option, as
++ * we feed the in-service queue with new requests close to the
++ * last request served and, by doing so, hopefully increase the
++ * throughput.
++ */
++ bfqq->new_bfqq = new_bfqq;
++ atomic_add(process_refs, &new_bfqq->ref);
++ return new_bfqq;
++}
++
++/*
++ * Attempt to schedule a merge of bfqq with the currently in-service queue
++ * or with a close queue among the scheduled queues.
++ * Return NULL if no merge was scheduled, a pointer to the shared bfq_queue
++ * structure otherwise.
++ */
++static struct bfq_queue *
++bfq_setup_cooperator(struct bfq_data *bfqd, struct bfq_queue *bfqq,
++ void *io_struct, bool request)
++{
++ struct bfq_queue *in_service_bfqq, *new_bfqq;
++
++ if (bfqq->new_bfqq)
++ return bfqq->new_bfqq;
++
++ if (!io_struct)
++ return NULL;
++
++ in_service_bfqq = bfqd->in_service_queue;
++
++ if (in_service_bfqq == NULL || in_service_bfqq == bfqq ||
++ !bfqd->in_service_bic)
++ goto check_scheduled;
++
++ if (bfq_class_idle(in_service_bfqq) || bfq_class_idle(bfqq))
++ goto check_scheduled;
++
++ if (bfq_class_rt(in_service_bfqq) != bfq_class_rt(bfqq))
++ goto check_scheduled;
++
++ if (in_service_bfqq->entity.parent != bfqq->entity.parent)
++ goto check_scheduled;
++
++ if (bfq_rq_close_to_sector(io_struct, request, bfqd->last_position) &&
++ bfq_bfqq_sync(in_service_bfqq) && bfq_bfqq_sync(bfqq)) {
++ new_bfqq = bfq_setup_merge(bfqq, in_service_bfqq);
++ if (new_bfqq != NULL)
++ return new_bfqq; /* Merge with in-service queue */
++ }
++
++ /*
++ * Check whether there is a cooperator among currently scheduled
++ * queues. The only thing we need is that the bio/request is not
++ * NULL, as we need it to establish whether a cooperator exists.
++ */
++check_scheduled:
++ new_bfqq = bfq_close_cooperator(bfqd, bfqq,
++ bfq_io_struct_pos(io_struct, request));
++ if (new_bfqq)
++ return bfq_setup_merge(bfqq, new_bfqq);
++
++ return NULL;
++}
++
++static inline void
++bfq_bfqq_save_state(struct bfq_queue *bfqq)
++{
++ /*
++ * If bfqq->bic == NULL, the queue is already shared or its requests
++ * have already been redirected to a shared queue; both idle window
++ * and weight raising state have already been saved. Do nothing.
++ */
++ if (bfqq->bic == NULL)
++ return;
++ if (bfqq->bic->wr_time_left)
++ /*
++ * This is the queue of a just-started process, and would
++ * deserve weight raising: we set wr_time_left to the full
++ * weight-raising duration to trigger weight-raising when
++ * and if the queue is split and the first request of the
++ * queue is enqueued.
++ */
++ bfqq->bic->wr_time_left = bfq_wr_duration(bfqq->bfqd);
++ else if (bfqq->wr_coeff > 1) {
++ unsigned long wr_duration =
++ jiffies - bfqq->last_wr_start_finish;
++ /*
++ * It may happen that a queue's weight raising period lasts
++ * longer than its wr_cur_max_time, as weight raising is
++ * handled only when a request is enqueued or dispatched (it
++ * does not use any timer). If the weight raising period is
++ * about to end, don't save it.
++ */
++ if (bfqq->wr_cur_max_time <= wr_duration)
++ bfqq->bic->wr_time_left = 0;
++ else
++ bfqq->bic->wr_time_left =
++ bfqq->wr_cur_max_time - wr_duration;
++ /*
++ * The bfq_queue is becoming shared or the requests of the
++ * process owning the queue are being redirected to a shared
++ * queue. Stop the weight raising period of the queue, as in
++ * both cases it should not be owned by an interactive or
++ * soft real-time application.
++ */
++ bfq_bfqq_end_wr(bfqq);
++ } else
++ bfqq->bic->wr_time_left = 0;
++ bfqq->bic->saved_idle_window = bfq_bfqq_idle_window(bfqq);
++ bfqq->bic->saved_IO_bound = bfq_bfqq_IO_bound(bfqq);
++ bfqq->bic->saved_in_large_burst = bfq_bfqq_in_large_burst(bfqq);
++ bfqq->bic->was_in_burst_list = !hlist_unhashed(&bfqq->burst_list_node);
++ bfqq->bic->cooperations++;
++ bfqq->bic->failed_cooperations = 0;
++}
++
++static inline void
++bfq_get_bic_reference(struct bfq_queue *bfqq)
++{
++ /*
++ * If bfqq->bic has a non-NULL value, the bic to which it belongs
++ * is about to begin using a shared bfq_queue.
++ */
++ if (bfqq->bic)
++ atomic_long_inc(&bfqq->bic->icq.ioc->refcount);
++}
++
++static void
++bfq_merge_bfqqs(struct bfq_data *bfqd, struct bfq_io_cq *bic,
++ struct bfq_queue *bfqq, struct bfq_queue *new_bfqq)
++{
++ bfq_log_bfqq(bfqd, bfqq, "merging with queue %lu",
++ (long unsigned)new_bfqq->pid);
++ /* Save weight raising and idle window of the merged queues */
++ bfq_bfqq_save_state(bfqq);
++ bfq_bfqq_save_state(new_bfqq);
++ if (bfq_bfqq_IO_bound(bfqq))
++ bfq_mark_bfqq_IO_bound(new_bfqq);
++ bfq_clear_bfqq_IO_bound(bfqq);
++ /*
++ * Grab a reference to the bic, to prevent it from being destroyed
++ * before being possibly touched by a bfq_split_bfqq().
++ */
++ bfq_get_bic_reference(bfqq);
++ bfq_get_bic_reference(new_bfqq);
++ /*
++ * Merge queues (that is, let bic redirect its requests to new_bfqq)
++ */
++ bic_set_bfqq(bic, new_bfqq, 1);
++ bfq_mark_bfqq_coop(new_bfqq);
++ /*
++ * new_bfqq now belongs to at least two bics (it is a shared queue):
++ * set new_bfqq->bic to NULL. bfqq either:
++ * - does not belong to any bic any more, and hence bfqq->bic must
++ * be set to NULL, or
++ * - is a queue whose owning bics have already been redirected to a
++ * different queue, hence the queue is destined to not belong to
++ * any bic soon and bfqq->bic is already NULL (therefore the next
++ * assignment causes no harm).
++ */
++ new_bfqq->bic = NULL;
++ bfqq->bic = NULL;
++ bfq_put_queue(bfqq);
++}
++
++static inline void bfq_bfqq_increase_failed_cooperations(struct bfq_queue *bfqq)
++{
++ struct bfq_io_cq *bic = bfqq->bic;
++ struct bfq_data *bfqd = bfqq->bfqd;
++
++ if (bic && bfq_bfqq_cooperations(bfqq) >= bfqd->bfq_coop_thresh) {
++ bic->failed_cooperations++;
++ if (bic->failed_cooperations >= bfqd->bfq_failed_cooperations)
++ bic->cooperations = 0;
++ }
++}
++
++static int bfq_allow_merge(struct request_queue *q, struct request *rq,
++ struct bio *bio)
++{
++ struct bfq_data *bfqd = q->elevator->elevator_data;
++ struct bfq_io_cq *bic;
++ struct bfq_queue *bfqq, *new_bfqq;
++
++ /*
++ * Disallow merge of a sync bio into an async request.
++ */
++ if (bfq_bio_sync(bio) && !rq_is_sync(rq))
++ return 0;
++
++ /*
++ * Lookup the bfqq that this bio will be queued with. Allow
++ * merge only if rq is queued there.
++ * Queue lock is held here.
++ */
++ bic = bfq_bic_lookup(bfqd, current->io_context);
++ if (bic == NULL)
++ return 0;
++
++ bfqq = bic_to_bfqq(bic, bfq_bio_sync(bio));
++ /*
++ * We take advantage of this function to perform an early merge
++ * of the queues of possible cooperating processes.
++ */
++ if (bfqq != NULL) {
++ new_bfqq = bfq_setup_cooperator(bfqd, bfqq, bio, false);
++ if (new_bfqq != NULL) {
++ bfq_merge_bfqqs(bfqd, bic, bfqq, new_bfqq);
++ /*
++ * If we get here, the bio will be queued in the
++ * shared queue, i.e., new_bfqq, so use new_bfqq
++ * to decide whether bio and rq can be merged.
++ */
++ bfqq = new_bfqq;
++ } else
++ bfq_bfqq_increase_failed_cooperations(bfqq);
++ }
++
++ return bfqq == RQ_BFQQ(rq);
++}
++
++static void __bfq_set_in_service_queue(struct bfq_data *bfqd,
++ struct bfq_queue *bfqq)
++{
++ if (bfqq != NULL) {
++ bfq_mark_bfqq_must_alloc(bfqq);
++ bfq_mark_bfqq_budget_new(bfqq);
++ bfq_clear_bfqq_fifo_expire(bfqq);
++
++ bfqd->budgets_assigned = (bfqd->budgets_assigned*7 + 256) / 8;
++
++ bfq_log_bfqq(bfqd, bfqq,
++ "set_in_service_queue, cur-budget = %lu",
++ bfqq->entity.budget);
++ }
++
++ bfqd->in_service_queue = bfqq;
++}
++
++/*
++ * Get and set a new queue for service.
++ */
++static struct bfq_queue *bfq_set_in_service_queue(struct bfq_data *bfqd)
++{
++ struct bfq_queue *bfqq = bfq_get_next_queue(bfqd);
++
++ __bfq_set_in_service_queue(bfqd, bfqq);
++ return bfqq;
++}
++
+ /*
+ * If enough samples have been computed, return the current max budget
+ * stored in bfqd, which is dynamically updated according to the
+@@ -1475,61 +1781,6 @@ static struct request *bfq_check_fifo(struct bfq_queue *bfqq)
+ return rq;
+ }
+
+-/* Must be called with the queue_lock held. */
+-static int bfqq_process_refs(struct bfq_queue *bfqq)
+-{
+- int process_refs, io_refs;
+-
+- io_refs = bfqq->allocated[READ] + bfqq->allocated[WRITE];
+- process_refs = atomic_read(&bfqq->ref) - io_refs - bfqq->entity.on_st;
+- BUG_ON(process_refs < 0);
+- return process_refs;
+-}
+-
+-static void bfq_setup_merge(struct bfq_queue *bfqq, struct bfq_queue *new_bfqq)
+-{
+- int process_refs, new_process_refs;
+- struct bfq_queue *__bfqq;
+-
+- /*
+- * If there are no process references on the new_bfqq, then it is
+- * unsafe to follow the ->new_bfqq chain as other bfqq's in the chain
+- * may have dropped their last reference (not just their last process
+- * reference).
+- */
+- if (!bfqq_process_refs(new_bfqq))
+- return;
+-
+- /* Avoid a circular list and skip interim queue merges. */
+- while ((__bfqq = new_bfqq->new_bfqq)) {
+- if (__bfqq == bfqq)
+- return;
+- new_bfqq = __bfqq;
+- }
+-
+- process_refs = bfqq_process_refs(bfqq);
+- new_process_refs = bfqq_process_refs(new_bfqq);
+- /*
+- * If the process for the bfqq has gone away, there is no
+- * sense in merging the queues.
+- */
+- if (process_refs == 0 || new_process_refs == 0)
+- return;
+-
+- /*
+- * Merge in the direction of the lesser amount of work.
+- */
+- if (new_process_refs >= process_refs) {
+- bfqq->new_bfqq = new_bfqq;
+- atomic_add(process_refs, &new_bfqq->ref);
+- } else {
+- new_bfqq->new_bfqq = bfqq;
+- atomic_add(new_process_refs, &bfqq->ref);
+- }
+- bfq_log_bfqq(bfqq->bfqd, bfqq, "scheduling merge with queue %d",
+- new_bfqq->pid);
+-}
+-
+ static inline unsigned long bfq_bfqq_budget_left(struct bfq_queue *bfqq)
+ {
+ struct bfq_entity *entity = &bfqq->entity;
+@@ -2263,7 +2514,7 @@ static inline bool bfq_bfqq_must_idle(struct bfq_queue *bfqq)
+ */
+ static struct bfq_queue *bfq_select_queue(struct bfq_data *bfqd)
+ {
+- struct bfq_queue *bfqq, *new_bfqq = NULL;
++ struct bfq_queue *bfqq;
+ struct request *next_rq;
+ enum bfqq_expiration reason = BFQ_BFQQ_BUDGET_TIMEOUT;
+
+@@ -2273,17 +2524,6 @@ static struct bfq_queue *bfq_select_queue(struct bfq_data *bfqd)
+
+ bfq_log_bfqq(bfqd, bfqq, "select_queue: already in-service queue");
+
+- /*
+- * If another queue has a request waiting within our mean seek
+- * distance, let it run. The expire code will check for close
+- * cooperators and put the close queue at the front of the
+- * service tree. If possible, merge the expiring queue with the
+- * new bfqq.
+- */
+- new_bfqq = bfq_close_cooperator(bfqd, bfqq);
+- if (new_bfqq != NULL && bfqq->new_bfqq == NULL)
+- bfq_setup_merge(bfqq, new_bfqq);
+-
+ if (bfq_may_expire_for_budg_timeout(bfqq) &&
+ !timer_pending(&bfqd->idle_slice_timer) &&
+ !bfq_bfqq_must_idle(bfqq))
+@@ -2322,10 +2562,7 @@ static struct bfq_queue *bfq_select_queue(struct bfq_data *bfqd)
+ bfq_clear_bfqq_wait_request(bfqq);
+ del_timer(&bfqd->idle_slice_timer);
+ }
+- if (new_bfqq == NULL)
+- goto keep_queue;
+- else
+- goto expire;
++ goto keep_queue;
+ }
+ }
+
+@@ -2334,40 +2571,30 @@ static struct bfq_queue *bfq_select_queue(struct bfq_data *bfqd)
+ * in flight (possibly waiting for a completion) or is idling for a
+ * new request, then keep it.
+ */
+- if (new_bfqq == NULL && (timer_pending(&bfqd->idle_slice_timer) ||
+- (bfqq->dispatched != 0 && bfq_bfqq_must_not_expire(bfqq)))) {
++ if (timer_pending(&bfqd->idle_slice_timer) ||
++ (bfqq->dispatched != 0 && bfq_bfqq_must_not_expire(bfqq))) {
+ bfqq = NULL;
+ goto keep_queue;
+- } else if (new_bfqq != NULL && timer_pending(&bfqd->idle_slice_timer)) {
+- /*
+- * Expiring the queue because there is a close cooperator,
+- * cancel timer.
+- */
+- bfq_clear_bfqq_wait_request(bfqq);
+- del_timer(&bfqd->idle_slice_timer);
+ }
+
+ reason = BFQ_BFQQ_NO_MORE_REQUESTS;
+ expire:
+ bfq_bfqq_expire(bfqd, bfqq, 0, reason);
+ new_queue:
+- bfqq = bfq_set_in_service_queue(bfqd, new_bfqq);
++ bfqq = bfq_set_in_service_queue(bfqd);
+ bfq_log(bfqd, "select_queue: new queue %d returned",
+ bfqq != NULL ? bfqq->pid : 0);
+ keep_queue:
+ return bfqq;
+ }
+
+-static void bfq_update_wr_data(struct bfq_data *bfqd,
+- struct bfq_queue *bfqq)
++static void bfq_update_wr_data(struct bfq_data *bfqd, struct bfq_queue *bfqq)
+ {
+- if (bfqq->wr_coeff > 1) { /* queue is being boosted */
+- struct bfq_entity *entity = &bfqq->entity;
+-
++ struct bfq_entity *entity = &bfqq->entity;
++ if (bfqq->wr_coeff > 1) { /* queue is being weight-raised */
+ bfq_log_bfqq(bfqd, bfqq,
+ "raising period dur %u/%u msec, old coeff %u, w %d(%d)",
+- jiffies_to_msecs(jiffies -
+- bfqq->last_wr_start_finish),
++ jiffies_to_msecs(jiffies - bfqq->last_wr_start_finish),
+ jiffies_to_msecs(bfqq->wr_cur_max_time),
+ bfqq->wr_coeff,
+ bfqq->entity.weight, bfqq->entity.orig_weight);
+@@ -2376,12 +2603,16 @@ static void bfq_update_wr_data(struct bfq_data *bfqd,
+ entity->orig_weight * bfqq->wr_coeff);
+ if (entity->ioprio_changed)
+ bfq_log_bfqq(bfqd, bfqq, "WARN: pending prio change");
++
+ /*
+ * If the queue was activated in a burst, or
+ * too much time has elapsed from the beginning
+- * of this weight-raising, then end weight raising.
++ * of this weight-raising period, or the queue has
++ * exceeded the acceptable number of cooperations,
++ * then end weight raising.
+ */
+ if (bfq_bfqq_in_large_burst(bfqq) ||
++ bfq_bfqq_cooperations(bfqq) >= bfqd->bfq_coop_thresh ||
+ time_is_before_jiffies(bfqq->last_wr_start_finish +
+ bfqq->wr_cur_max_time)) {
+ bfqq->last_wr_start_finish = jiffies;
+@@ -2390,11 +2621,13 @@ static void bfq_update_wr_data(struct bfq_data *bfqd,
+ bfqq->last_wr_start_finish,
+ jiffies_to_msecs(bfqq->wr_cur_max_time));
+ bfq_bfqq_end_wr(bfqq);
+- __bfq_entity_update_weight_prio(
+- bfq_entity_service_tree(entity),
+- entity);
+ }
+ }
++ /* Update weight both if it must be raised and if it must be lowered */
++ if ((entity->weight > entity->orig_weight) != (bfqq->wr_coeff > 1))
++ __bfq_entity_update_weight_prio(
++ bfq_entity_service_tree(entity),
++ entity);
+ }
+
+ /*
+@@ -2642,6 +2875,25 @@ static inline void bfq_init_icq(struct io_cq *icq)
+ struct bfq_io_cq *bic = icq_to_bic(icq);
+
+ bic->ttime.last_end_request = jiffies;
++ /*
++ * A newly created bic indicates that the process has just
++ * started doing I/O, and is probably mapping into memory its
++ * executable and libraries: it definitely needs weight raising.
++ * There is however the possibility that the process performs,
++ * for a while, I/O close to some other process. EQM intercepts
++ * this behavior and may merge the queue corresponding to the
++ * process with some other queue, BEFORE the weight of the queue
++ * is raised. Merged queues are not weight-raised (they are assumed
++ * to belong to processes that benefit only from high throughput).
++ * If the merge is basically the consequence of an accident, then
++ * the queue will be split soon and will get back its old weight.
++ * It is then important to write down somewhere that this queue
++ * does need weight raising, even if it did not make it to get its
++ * weight raised before being merged. To this purpose, we overload
++ * the field raising_time_left and assign 1 to it, to mark the queue
++ * as needing weight raising.
++ */
++ bic->wr_time_left = 1;
+ }
+
+ static void bfq_exit_icq(struct io_cq *icq)
+@@ -2655,6 +2907,13 @@ static void bfq_exit_icq(struct io_cq *icq)
+ }
+
+ if (bic->bfqq[BLK_RW_SYNC]) {
++ /*
++ * If the bic is using a shared queue, put the reference
++ * taken on the io_context when the bic started using a
++ * shared bfq_queue.
++ */
++ if (bfq_bfqq_coop(bic->bfqq[BLK_RW_SYNC]))
++ put_io_context(icq->ioc);
+ bfq_exit_bfqq(bfqd, bic->bfqq[BLK_RW_SYNC]);
+ bic->bfqq[BLK_RW_SYNC] = NULL;
+ }
+@@ -2944,6 +3203,10 @@ static void bfq_update_idle_window(struct bfq_data *bfqd,
+ if (!bfq_bfqq_sync(bfqq) || bfq_class_idle(bfqq))
+ return;
+
++ /* Idle window just restored, statistics are meaningless. */
++ if (bfq_bfqq_just_split(bfqq))
++ return;
++
+ enable_idle = bfq_bfqq_idle_window(bfqq);
+
+ if (atomic_read(&bic->icq.ioc->active_ref) == 0 ||
+@@ -2991,6 +3254,7 @@ static void bfq_rq_enqueued(struct bfq_data *bfqd, struct bfq_queue *bfqq,
+ if (bfqq->entity.service > bfq_max_budget(bfqd) / 8 ||
+ !BFQQ_SEEKY(bfqq))
+ bfq_update_idle_window(bfqd, bfqq, bic);
++ bfq_clear_bfqq_just_split(bfqq);
+
+ bfq_log_bfqq(bfqd, bfqq,
+ "rq_enqueued: idle_window=%d (seeky %d, mean %llu)",
+@@ -3051,13 +3315,49 @@ static void bfq_rq_enqueued(struct bfq_data *bfqd, struct bfq_queue *bfqq,
+ static void bfq_insert_request(struct request_queue *q, struct request *rq)
+ {
+ struct bfq_data *bfqd = q->elevator->elevator_data;
+- struct bfq_queue *bfqq = RQ_BFQQ(rq);
++ struct bfq_queue *bfqq = RQ_BFQQ(rq), *new_bfqq;
+
+ assert_spin_locked(bfqd->queue->queue_lock);
++
++ /*
++ * An unplug may trigger a requeue of a request from the device
++ * driver: make sure we are in process context while trying to
++ * merge two bfq_queues.
++ */
++ if (!in_interrupt()) {
++ new_bfqq = bfq_setup_cooperator(bfqd, bfqq, rq, true);
++ if (new_bfqq != NULL) {
++ if (bic_to_bfqq(RQ_BIC(rq), 1) != bfqq)
++ new_bfqq = bic_to_bfqq(RQ_BIC(rq), 1);
++ /*
++ * Release the request's reference to the old bfqq
++ * and make sure one is taken to the shared queue.
++ */
++ new_bfqq->allocated[rq_data_dir(rq)]++;
++ bfqq->allocated[rq_data_dir(rq)]--;
++ atomic_inc(&new_bfqq->ref);
++ bfq_put_queue(bfqq);
++ if (bic_to_bfqq(RQ_BIC(rq), 1) == bfqq)
++ bfq_merge_bfqqs(bfqd, RQ_BIC(rq),
++ bfqq, new_bfqq);
++ rq->elv.priv[1] = new_bfqq;
++ bfqq = new_bfqq;
++ } else
++ bfq_bfqq_increase_failed_cooperations(bfqq);
++ }
++
+ bfq_init_prio_data(bfqq, RQ_BIC(rq));
+
+ bfq_add_request(rq);
+
++ /*
++ * Here a newly-created bfq_queue has already started a weight-raising
++ * period: clear raising_time_left to prevent bfq_bfqq_save_state()
++ * from assigning it a full weight-raising period. See the detailed
++ * comments about this field in bfq_init_icq().
++ */
++ if (bfqq->bic != NULL)
++ bfqq->bic->wr_time_left = 0;
+ rq->fifo_time = jiffies + bfqd->bfq_fifo_expire[rq_is_sync(rq)];
+ list_add_tail(&rq->queuelist, &bfqq->fifo);
+
+@@ -3222,18 +3522,6 @@ static void bfq_put_request(struct request *rq)
+ }
+ }
+
+-static struct bfq_queue *
+-bfq_merge_bfqqs(struct bfq_data *bfqd, struct bfq_io_cq *bic,
+- struct bfq_queue *bfqq)
+-{
+- bfq_log_bfqq(bfqd, bfqq, "merging with queue %lu",
+- (long unsigned)bfqq->new_bfqq->pid);
+- bic_set_bfqq(bic, bfqq->new_bfqq, 1);
+- bfq_mark_bfqq_coop(bfqq->new_bfqq);
+- bfq_put_queue(bfqq);
+- return bic_to_bfqq(bic, 1);
+-}
+-
+ /*
+ * Returns NULL if a new bfqq should be allocated, or the old bfqq if this
+ * was the last process referring to said bfqq.
+@@ -3242,6 +3530,9 @@ static struct bfq_queue *
+ bfq_split_bfqq(struct bfq_io_cq *bic, struct bfq_queue *bfqq)
+ {
+ bfq_log_bfqq(bfqq->bfqd, bfqq, "splitting queue");
++
++ put_io_context(bic->icq.ioc);
++
+ if (bfqq_process_refs(bfqq) == 1) {
+ bfqq->pid = current->pid;
+ bfq_clear_bfqq_coop(bfqq);
+@@ -3270,6 +3561,7 @@ static int bfq_set_request(struct request_queue *q, struct request *rq,
+ struct bfq_queue *bfqq;
+ struct bfq_group *bfqg;
+ unsigned long flags;
++ bool split = false;
+
+ might_sleep_if(gfp_mask & __GFP_WAIT);
+
+@@ -3287,25 +3579,26 @@ new_queue:
+ if (bfqq == NULL || bfqq == &bfqd->oom_bfqq) {
+ bfqq = bfq_get_queue(bfqd, bfqg, is_sync, bic, gfp_mask);
+ bic_set_bfqq(bic, bfqq, is_sync);
++ if (split && is_sync) {
++ if ((bic->was_in_burst_list && bfqd->large_burst) ||
++ bic->saved_in_large_burst)
++ bfq_mark_bfqq_in_large_burst(bfqq);
++ else {
++ bfq_clear_bfqq_in_large_burst(bfqq);
++ if (bic->was_in_burst_list)
++ hlist_add_head(&bfqq->burst_list_node,
++ &bfqd->burst_list);
++ }
++ }
+ } else {
+- /*
+- * If the queue was seeky for too long, break it apart.
+- */
++ /* If the queue was seeky for too long, break it apart. */
+ if (bfq_bfqq_coop(bfqq) && bfq_bfqq_split_coop(bfqq)) {
+ bfq_log_bfqq(bfqd, bfqq, "breaking apart bfqq");
+ bfqq = bfq_split_bfqq(bic, bfqq);
++ split = true;
+ if (!bfqq)
+ goto new_queue;
+ }
+-
+- /*
+- * Check to see if this queue is scheduled to merge with
+- * another closely cooperating queue. The merging of queues
+- * happens here as it must be done in process context.
+- * The reference on new_bfqq was taken in merge_bfqqs.
+- */
+- if (bfqq->new_bfqq != NULL)
+- bfqq = bfq_merge_bfqqs(bfqd, bic, bfqq);
+ }
+
+ bfqq->allocated[rw]++;
+@@ -3316,6 +3609,26 @@ new_queue:
+ rq->elv.priv[0] = bic;
+ rq->elv.priv[1] = bfqq;
+
++ /*
++ * If a bfq_queue has only one process reference, it is owned
++ * by only one bfq_io_cq: we can set the bic field of the
++ * bfq_queue to the address of that structure. Also, if the
++ * queue has just been split, mark a flag so that the
++ * information is available to the other scheduler hooks.
++ */
++ if (bfqq_process_refs(bfqq) == 1) {
++ bfqq->bic = bic;
++ if (split) {
++ bfq_mark_bfqq_just_split(bfqq);
++ /*
++ * If the queue has just been split from a shared
++ * queue, restore the idle window and the possible
++ * weight raising period.
++ */
++ bfq_bfqq_resume_state(bfqq, bic);
++ }
++ }
++
+ spin_unlock_irqrestore(q->queue_lock, flags);
+
+ return 0;
+diff --git a/block/bfq-sched.c b/block/bfq-sched.c
+index c4831b7..546a254 100644
+--- a/block/bfq-sched.c
++++ b/block/bfq-sched.c
+@@ -1084,34 +1084,6 @@ static struct bfq_queue *bfq_get_next_queue(struct bfq_data *bfqd)
+ return bfqq;
+ }
+
+-/*
+- * Forced extraction of the given queue.
+- */
+-static void bfq_get_next_queue_forced(struct bfq_data *bfqd,
+- struct bfq_queue *bfqq)
+-{
+- struct bfq_entity *entity;
+- struct bfq_sched_data *sd;
+-
+- BUG_ON(bfqd->in_service_queue != NULL);
+-
+- entity = &bfqq->entity;
+- /*
+- * Bubble up extraction/update from the leaf to the root.
+- */
+- for_each_entity(entity) {
+- sd = entity->sched_data;
+- bfq_update_budget(entity);
+- bfq_update_vtime(bfq_entity_service_tree(entity));
+- bfq_active_extract(bfq_entity_service_tree(entity), entity);
+- sd->in_service_entity = entity;
+- sd->next_in_service = NULL;
+- entity->service = 0;
+- }
+-
+- return;
+-}
+-
+ static void __bfq_bfqd_reset_in_service(struct bfq_data *bfqd)
+ {
+ if (bfqd->in_service_bic != NULL) {
+diff --git a/block/bfq.h b/block/bfq.h
+index 01dcdc4..a193a56 100644
+--- a/block/bfq.h
++++ b/block/bfq.h
+@@ -216,18 +216,21 @@ struct bfq_group;
+ * idle @bfq_queue with no outstanding requests, then
+ * the task associated with the queue it is deemed as
+ * soft real-time (see the comments to the function
+- * bfq_bfqq_softrt_next_start()).
++ * bfq_bfqq_softrt_next_start())
+ * @last_idle_bklogged: time of the last transition of the @bfq_queue from
+ * idle to backlogged
+ * @service_from_backlogged: cumulative service received from the @bfq_queue
+ * since the last transition from idle to
+ * backlogged
++ * @bic: pointer to the bfq_io_cq owning the bfq_queue, set to %NULL if the
++ * queue is shared
+ *
+- * A bfq_queue is a leaf request queue; it can be associated with an io_context
+- * or more, if it is async or shared between cooperating processes. @cgroup
+- * holds a reference to the cgroup, to be sure that it does not disappear while
+- * a bfqq still references it (mostly to avoid races between request issuing and
+- * task migration followed by cgroup destruction).
++ * A bfq_queue is a leaf request queue; it can be associated with an
++ * io_context or more, if it is async or shared between cooperating
++ * processes. @cgroup holds a reference to the cgroup, to be sure that it
++ * does not disappear while a bfqq still references it (mostly to avoid
++ * races between request issuing and task migration followed by cgroup
++ * destruction).
+ * All the fields are protected by the queue lock of the containing bfqd.
+ */
+ struct bfq_queue {
+@@ -267,6 +270,7 @@ struct bfq_queue {
+ unsigned int requests_within_timer;
+
+ pid_t pid;
++ struct bfq_io_cq *bic;
+
+ /* weight-raising fields */
+ unsigned long wr_cur_max_time;
+@@ -296,12 +300,42 @@ struct bfq_ttime {
+ * @icq: associated io_cq structure
+ * @bfqq: array of two process queues, the sync and the async
+ * @ttime: associated @bfq_ttime struct
++ * @wr_time_left: snapshot of the time left before weight raising ends
++ * for the sync queue associated to this process; this
++ * snapshot is taken to remember this value while the weight
++ * raising is suspended because the queue is merged with a
++ * shared queue, and is used to set @raising_cur_max_time
++ * when the queue is split from the shared queue and its
++ * weight is raised again
++ * @saved_idle_window: same purpose as the previous field for the idle
++ * window
++ * @saved_IO_bound: same purpose as the previous two fields for the I/O
++ * bound classification of a queue
++ * @saved_in_large_burst: same purpose as the previous fields for the
++ * value of the field keeping the queue's belonging
++ * to a large burst
++ * @was_in_burst_list: true if the queue belonged to a burst list
++ * before its merge with another cooperating queue
++ * @cooperations: counter of consecutive successful queue merges underwent
++ * by any of the process' @bfq_queues
++ * @failed_cooperations: counter of consecutive failed queue merges of any
++ * of the process' @bfq_queues
+ */
+ struct bfq_io_cq {
+ struct io_cq icq; /* must be the first member */
+ struct bfq_queue *bfqq[2];
+ struct bfq_ttime ttime;
+ int ioprio;
++
++ unsigned int wr_time_left;
++ bool saved_idle_window;
++ bool saved_IO_bound;
++
++ bool saved_in_large_burst;
++ bool was_in_burst_list;
++
++ unsigned int cooperations;
++ unsigned int failed_cooperations;
+ };
+
+ enum bfq_device_speed {
+@@ -537,7 +571,7 @@ enum bfqq_state_flags {
+ BFQ_BFQQ_FLAG_prio_changed, /* task priority has changed */
+ BFQ_BFQQ_FLAG_sync, /* synchronous queue */
+ BFQ_BFQQ_FLAG_budget_new, /* no completion with this budget */
+- BFQ_BFQQ_FLAG_IO_bound, /*
++ BFQ_BFQQ_FLAG_IO_bound, /*
+ * bfqq has timed-out at least once
+ * having consumed at most 2/10 of
+ * its budget
+@@ -550,12 +584,13 @@ enum bfqq_state_flags {
+ * bfqq has proved to be slow and
+ * seeky until budget timeout
+ */
+- BFQ_BFQQ_FLAG_softrt_update, /*
++ BFQ_BFQQ_FLAG_softrt_update, /*
+ * may need softrt-next-start
+ * update
+ */
+ BFQ_BFQQ_FLAG_coop, /* bfqq is shared */
+- BFQ_BFQQ_FLAG_split_coop, /* shared bfqq will be splitted */
++ BFQ_BFQQ_FLAG_split_coop, /* shared bfqq will be split */
++ BFQ_BFQQ_FLAG_just_split, /* queue has just been split */
+ };
+
+ #define BFQ_BFQQ_FNS(name) \
+@@ -585,6 +620,7 @@ BFQ_BFQQ_FNS(in_large_burst);
+ BFQ_BFQQ_FNS(constantly_seeky);
+ BFQ_BFQQ_FNS(coop);
+ BFQ_BFQQ_FNS(split_coop);
++BFQ_BFQQ_FNS(just_split);
+ BFQ_BFQQ_FNS(softrt_update);
+ #undef BFQ_BFQQ_FNS
+
+--
+2.1.3
+
^ permalink raw reply related [flat|nested] 67+ messages in thread
* [gentoo-commits] proj/linux-patches:3.18 commit in: /
@ 2014-12-16 19:44 Mike Pagano
0 siblings, 0 replies; 67+ messages in thread
From: Mike Pagano @ 2014-12-16 19:44 UTC (permalink / raw
To: gentoo-commits
commit: 2746011051bd7572b73c0122fda80ead35cec711
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Tue Dec 16 19:43:56 2014 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Tue Dec 16 19:43:56 2014 +0000
URL: http://sources.gentoo.org/gitweb/?p=proj/linux-patches.git;a=commit;h=27460110
Linux patch 3.18.1
---
0000_README | 4 +
1000_linux-3.18.1.patch | 1189 +++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 1193 insertions(+)
diff --git a/0000_README b/0000_README
index bde1067..f79b1b4 100644
--- a/0000_README
+++ b/0000_README
@@ -43,6 +43,10 @@ EXPERIMENTAL
Individual Patch Descriptions:
--------------------------------------------------------------------------
+Patch: 1000_linux-3.18.1.patch
+From: http://www.kernel.org
+Desc: Linux 3.18.1
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1000_linux-3.18.1.patch b/1000_linux-3.18.1.patch
new file mode 100644
index 0000000..1dc8609
--- /dev/null
+++ b/1000_linux-3.18.1.patch
@@ -0,0 +1,1189 @@
+diff --git a/Makefile b/Makefile
+index fd80c6e9bc23..3f84029f2b31 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 18
+-SUBLEVEL = 0
++SUBLEVEL = 1
+ EXTRAVERSION =
+ NAME = Diseased Newt
+
+diff --git a/arch/mips/net/bpf_jit.c b/arch/mips/net/bpf_jit.c
+index 9b55143d19db..9fd6834a2172 100644
+--- a/arch/mips/net/bpf_jit.c
++++ b/arch/mips/net/bpf_jit.c
+@@ -426,7 +426,7 @@ static inline void emit_mod(unsigned int dst, unsigned int src,
+ u32 *p = &ctx->target[ctx->idx];
+ uasm_i_divu(&p, dst, src);
+ p = &ctx->target[ctx->idx + 1];
+- uasm_i_mflo(&p, dst);
++ uasm_i_mfhi(&p, dst);
+ }
+ ctx->idx += 2; /* 2 insts */
+ }
+@@ -971,7 +971,7 @@ load_ind:
+ break;
+ case BPF_ALU | BPF_MOD | BPF_K:
+ /* A %= k */
+- if (k == 1 || optimize_div(&k)) {
++ if (k == 1) {
+ ctx->flags |= SEEN_A;
+ emit_jit_reg_move(r_A, r_zero, ctx);
+ } else {
+diff --git a/arch/powerpc/platforms/cell/spufs/inode.c b/arch/powerpc/platforms/cell/spufs/inode.c
+index 87ba7cf99cd7..65d633f20d37 100644
+--- a/arch/powerpc/platforms/cell/spufs/inode.c
++++ b/arch/powerpc/platforms/cell/spufs/inode.c
+@@ -164,7 +164,7 @@ static void spufs_prune_dir(struct dentry *dir)
+ struct dentry *dentry, *tmp;
+
+ mutex_lock(&dir->d_inode->i_mutex);
+- list_for_each_entry_safe(dentry, tmp, &dir->d_subdirs, d_u.d_child) {
++ list_for_each_entry_safe(dentry, tmp, &dir->d_subdirs, d_child) {
+ spin_lock(&dentry->d_lock);
+ if (!(d_unhashed(dentry)) && dentry->d_inode) {
+ dget_dlock(dentry);
+diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c
+index ade067de1689..67a84cfaefa1 100644
+--- a/drivers/net/ethernet/marvell/mvneta.c
++++ b/drivers/net/ethernet/marvell/mvneta.c
+@@ -216,7 +216,7 @@
+ /* Various constants */
+
+ /* Coalescing */
+-#define MVNETA_TXDONE_COAL_PKTS 16
++#define MVNETA_TXDONE_COAL_PKTS 1
+ #define MVNETA_RX_COAL_PKTS 32
+ #define MVNETA_RX_COAL_USEC 100
+
+@@ -1721,6 +1721,7 @@ static int mvneta_tx(struct sk_buff *skb, struct net_device *dev)
+ u16 txq_id = skb_get_queue_mapping(skb);
+ struct mvneta_tx_queue *txq = &pp->txqs[txq_id];
+ struct mvneta_tx_desc *tx_desc;
++ int len = skb->len;
+ int frags = 0;
+ u32 tx_cmd;
+
+@@ -1788,7 +1789,7 @@ out:
+
+ u64_stats_update_begin(&stats->syncp);
+ stats->tx_packets++;
+- stats->tx_bytes += skb->len;
++ stats->tx_bytes += len;
+ u64_stats_update_end(&stats->syncp);
+ } else {
+ dev->stats.tx_dropped++;
+diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
+index be4649a49c5e..42b2d6a56d05 100644
+--- a/drivers/net/vxlan.c
++++ b/drivers/net/vxlan.c
+@@ -1995,9 +1995,8 @@ static int vxlan_init(struct net_device *dev)
+ spin_lock(&vn->sock_lock);
+ vs = vxlan_find_sock(vxlan->net, ipv6 ? AF_INET6 : AF_INET,
+ vxlan->dst_port);
+- if (vs) {
++ if (vs && atomic_add_unless(&vs->refcnt, 1, 0)) {
+ /* If we have a socket with same port already, reuse it */
+- atomic_inc(&vs->refcnt);
+ vxlan_vs_add_dev(vs, vxlan);
+ } else {
+ /* otherwise make new socket outside of RTNL */
+@@ -2396,12 +2395,9 @@ struct vxlan_sock *vxlan_sock_add(struct net *net, __be16 port,
+
+ spin_lock(&vn->sock_lock);
+ vs = vxlan_find_sock(net, ipv6 ? AF_INET6 : AF_INET, port);
+- if (vs) {
+- if (vs->rcv == rcv)
+- atomic_inc(&vs->refcnt);
+- else
++ if (vs && ((vs->rcv != rcv) ||
++ !atomic_add_unless(&vs->refcnt, 1, 0)))
+ vs = ERR_PTR(-EBUSY);
+- }
+ spin_unlock(&vn->sock_lock);
+
+ if (!vs)
+diff --git a/drivers/net/wireless/rtlwifi/rtl8192ce/hw.c b/drivers/net/wireless/rtlwifi/rtl8192ce/hw.c
+index 55357d69397a..d2ec5160bbf0 100644
+--- a/drivers/net/wireless/rtlwifi/rtl8192ce/hw.c
++++ b/drivers/net/wireless/rtlwifi/rtl8192ce/hw.c
+@@ -1287,6 +1287,7 @@ void rtl92ce_enable_interrupt(struct ieee80211_hw *hw)
+
+ rtl_write_dword(rtlpriv, REG_HIMR, rtlpci->irq_mask[0] & 0xFFFFFFFF);
+ rtl_write_dword(rtlpriv, REG_HIMRE, rtlpci->irq_mask[1] & 0xFFFFFFFF);
++ rtlpci->irq_enabled = true;
+ }
+
+ void rtl92ce_disable_interrupt(struct ieee80211_hw *hw)
+@@ -1296,7 +1297,7 @@ void rtl92ce_disable_interrupt(struct ieee80211_hw *hw)
+
+ rtl_write_dword(rtlpriv, REG_HIMR, IMR8190_DISABLED);
+ rtl_write_dword(rtlpriv, REG_HIMRE, IMR8190_DISABLED);
+- synchronize_irq(rtlpci->pdev->irq);
++ rtlpci->irq_enabled = false;
+ }
+
+ static void _rtl92ce_poweroff_adapter(struct ieee80211_hw *hw)
+diff --git a/drivers/net/wireless/rtlwifi/rtl8192ce/sw.c b/drivers/net/wireless/rtlwifi/rtl8192ce/sw.c
+index 46ea07605eb4..dd5aa089126a 100644
+--- a/drivers/net/wireless/rtlwifi/rtl8192ce/sw.c
++++ b/drivers/net/wireless/rtlwifi/rtl8192ce/sw.c
+@@ -228,6 +228,7 @@ static struct rtl_hal_ops rtl8192ce_hal_ops = {
+ .led_control = rtl92ce_led_control,
+ .set_desc = rtl92ce_set_desc,
+ .get_desc = rtl92ce_get_desc,
++ .is_tx_desc_closed = rtl92ce_is_tx_desc_closed,
+ .tx_polling = rtl92ce_tx_polling,
+ .enable_hw_sec = rtl92ce_enable_hw_security_config,
+ .set_key = rtl92ce_set_key,
+@@ -271,6 +272,8 @@ static struct rtl_hal_cfg rtl92ce_hal_cfg = {
+ .maps[MAC_RCR_ACRC32] = ACRC32,
+ .maps[MAC_RCR_ACF] = ACF,
+ .maps[MAC_RCR_AAP] = AAP,
++ .maps[MAC_HIMR] = REG_HIMR,
++ .maps[MAC_HIMRE] = REG_HIMRE,
+
+ .maps[EFUSE_TEST] = REG_EFUSE_TEST,
+ .maps[EFUSE_CTRL] = REG_EFUSE_CTRL,
+diff --git a/drivers/net/wireless/rtlwifi/rtl8192ce/trx.c b/drivers/net/wireless/rtlwifi/rtl8192ce/trx.c
+index dc3d20b17a26..e88dcd0e0af1 100644
+--- a/drivers/net/wireless/rtlwifi/rtl8192ce/trx.c
++++ b/drivers/net/wireless/rtlwifi/rtl8192ce/trx.c
+@@ -720,16 +720,15 @@ u32 rtl92ce_get_desc(u8 *p_desc, bool istx, u8 desc_name)
+ break;
+ }
+ } else {
+- struct rx_desc_92c *pdesc = (struct rx_desc_92c *)p_desc;
+ switch (desc_name) {
+ case HW_DESC_OWN:
+- ret = GET_RX_DESC_OWN(pdesc);
++ ret = GET_RX_DESC_OWN(p_desc);
+ break;
+ case HW_DESC_RXPKT_LEN:
+- ret = GET_RX_DESC_PKT_LEN(pdesc);
++ ret = GET_RX_DESC_PKT_LEN(p_desc);
+ break;
+ case HW_DESC_RXBUFF_ADDR:
+- ret = GET_RX_STATUS_DESC_BUFF_ADDR(pdesc);
++ ret = GET_RX_DESC_BUFF_ADDR(p_desc);
+ break;
+ default:
+ RT_ASSERT(false, "ERR rxdesc :%d not process\n",
+@@ -740,6 +739,23 @@ u32 rtl92ce_get_desc(u8 *p_desc, bool istx, u8 desc_name)
+ return ret;
+ }
+
++bool rtl92ce_is_tx_desc_closed(struct ieee80211_hw *hw,
++ u8 hw_queue, u16 index)
++{
++ struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
++ struct rtl8192_tx_ring *ring = &rtlpci->tx_ring[hw_queue];
++ u8 *entry = (u8 *)(&ring->desc[ring->idx]);
++ u8 own = (u8)rtl92ce_get_desc(entry, true, HW_DESC_OWN);
++
++ /*beacon packet will only use the first
++ *descriptor defautly,and the own may not
++ *be cleared by the hardware
++ */
++ if (own)
++ return false;
++ return true;
++}
++
+ void rtl92ce_tx_polling(struct ieee80211_hw *hw, u8 hw_queue)
+ {
+ struct rtl_priv *rtlpriv = rtl_priv(hw);
+diff --git a/drivers/net/wireless/rtlwifi/rtl8192ce/trx.h b/drivers/net/wireless/rtlwifi/rtl8192ce/trx.h
+index 9a39ec4204dd..4bec4b07e3e0 100644
+--- a/drivers/net/wireless/rtlwifi/rtl8192ce/trx.h
++++ b/drivers/net/wireless/rtlwifi/rtl8192ce/trx.h
+@@ -723,6 +723,8 @@ bool rtl92ce_rx_query_desc(struct ieee80211_hw *hw,
+ void rtl92ce_set_desc(struct ieee80211_hw *hw, u8 *pdesc, bool istx,
+ u8 desc_name, u8 *val);
+ u32 rtl92ce_get_desc(u8 *pdesc, bool istx, u8 desc_name);
++bool rtl92ce_is_tx_desc_closed(struct ieee80211_hw *hw,
++ u8 hw_queue, u16 index);
+ void rtl92ce_tx_polling(struct ieee80211_hw *hw, u8 hw_queue);
+ void rtl92ce_tx_fill_cmddesc(struct ieee80211_hw *hw, u8 *pdesc,
+ bool b_firstseg, bool b_lastseg,
+diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
+index ece8d1804d13..eeed0ce620f3 100644
+--- a/drivers/net/xen-netfront.c
++++ b/drivers/net/xen-netfront.c
+@@ -627,6 +627,9 @@ static int xennet_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ slots, skb->len);
+ if (skb_linearize(skb))
+ goto drop;
++ data = skb->data;
++ offset = offset_in_page(data);
++ len = skb_headlen(skb);
+ }
+
+ spin_lock_irqsave(&queue->tx_lock, flags);
+diff --git a/drivers/staging/lustre/lustre/llite/dcache.c b/drivers/staging/lustre/lustre/llite/dcache.c
+index 439e4875b05c..311907b762bd 100644
+--- a/drivers/staging/lustre/lustre/llite/dcache.c
++++ b/drivers/staging/lustre/lustre/llite/dcache.c
+@@ -258,7 +258,7 @@ void ll_invalidate_aliases(struct inode *inode)
+ inode->i_ino, inode->i_generation, inode);
+
+ ll_lock_dcache(inode);
+- ll_d_hlist_for_each_entry(dentry, p, &inode->i_dentry, d_alias) {
++ ll_d_hlist_for_each_entry(dentry, p, &inode->i_dentry, d_u.d_alias) {
+ CDEBUG(D_DENTRY, "dentry in drop %.*s (%p) parent %p "
+ "inode %p flags %d\n", dentry->d_name.len,
+ dentry->d_name.name, dentry, dentry->d_parent,
+diff --git a/drivers/staging/lustre/lustre/llite/llite_lib.c b/drivers/staging/lustre/lustre/llite/llite_lib.c
+index a8bcc51057f1..f4ca7b753021 100644
+--- a/drivers/staging/lustre/lustre/llite/llite_lib.c
++++ b/drivers/staging/lustre/lustre/llite/llite_lib.c
+@@ -711,7 +711,7 @@ void lustre_dump_dentry(struct dentry *dentry, int recur)
+ return;
+
+ list_for_each(tmp, &dentry->d_subdirs) {
+- struct dentry *d = list_entry(tmp, struct dentry, d_u.d_child);
++ struct dentry *d = list_entry(tmp, struct dentry, d_child);
+ lustre_dump_dentry(d, recur - 1);
+ }
+ }
+diff --git a/drivers/staging/lustre/lustre/llite/namei.c b/drivers/staging/lustre/lustre/llite/namei.c
+index 7a68c1e027e0..6dfd98509268 100644
+--- a/drivers/staging/lustre/lustre/llite/namei.c
++++ b/drivers/staging/lustre/lustre/llite/namei.c
+@@ -167,14 +167,14 @@ static void ll_invalidate_negative_children(struct inode *dir)
+ struct ll_d_hlist_node *p;
+
+ ll_lock_dcache(dir);
+- ll_d_hlist_for_each_entry(dentry, p, &dir->i_dentry, d_alias) {
++ ll_d_hlist_for_each_entry(dentry, p, &dir->i_dentry, d_u.d_alias) {
+ spin_lock(&dentry->d_lock);
+ if (!list_empty(&dentry->d_subdirs)) {
+ struct dentry *child;
+
+ list_for_each_entry_safe(child, tmp_subdir,
+ &dentry->d_subdirs,
+- d_u.d_child) {
++ d_child) {
+ if (child->d_inode == NULL)
+ d_lustre_invalidate(child, 1);
+ }
+@@ -362,7 +362,7 @@ static struct dentry *ll_find_alias(struct inode *inode, struct dentry *dentry)
+ discon_alias = invalid_alias = NULL;
+
+ ll_lock_dcache(inode);
+- ll_d_hlist_for_each_entry(alias, p, &inode->i_dentry, d_alias) {
++ ll_d_hlist_for_each_entry(alias, p, &inode->i_dentry, d_u.d_alias) {
+ LASSERT(alias != dentry);
+
+ spin_lock(&alias->d_lock);
+@@ -953,7 +953,7 @@ static void ll_get_child_fid(struct inode * dir, struct qstr *name,
+ {
+ struct dentry *parent, *child;
+
+- parent = ll_d_hlist_entry(dir->i_dentry, struct dentry, d_alias);
++ parent = ll_d_hlist_entry(dir->i_dentry, struct dentry, d_u.d_alias);
+ child = d_lookup(parent, name);
+ if (child) {
+ if (child->d_inode)
+diff --git a/fs/affs/amigaffs.c b/fs/affs/amigaffs.c
+index abc853968fed..937ce8754b24 100644
+--- a/fs/affs/amigaffs.c
++++ b/fs/affs/amigaffs.c
+@@ -125,7 +125,7 @@ affs_fix_dcache(struct inode *inode, u32 entry_ino)
+ {
+ struct dentry *dentry;
+ spin_lock(&inode->i_lock);
+- hlist_for_each_entry(dentry, &inode->i_dentry, d_alias) {
++ hlist_for_each_entry(dentry, &inode->i_dentry, d_u.d_alias) {
+ if (entry_ino == (u32)(long)dentry->d_fsdata) {
+ dentry->d_fsdata = (void *)inode->i_ino;
+ break;
+diff --git a/fs/autofs4/expire.c b/fs/autofs4/expire.c
+index 683a5b9ce22a..dcdec6fd33c6 100644
+--- a/fs/autofs4/expire.c
++++ b/fs/autofs4/expire.c
+@@ -85,7 +85,7 @@ static struct dentry *get_next_positive_subdir(struct dentry *prev,
+ spin_lock(&root->d_lock);
+
+ if (prev)
+- next = prev->d_u.d_child.next;
++ next = prev->d_child.next;
+ else {
+ prev = dget_dlock(root);
+ next = prev->d_subdirs.next;
+@@ -99,13 +99,13 @@ cont:
+ return NULL;
+ }
+
+- q = list_entry(next, struct dentry, d_u.d_child);
++ q = list_entry(next, struct dentry, d_child);
+
+ spin_lock_nested(&q->d_lock, DENTRY_D_LOCK_NESTED);
+ /* Already gone or negative dentry (under construction) - try next */
+ if (!d_count(q) || !simple_positive(q)) {
+ spin_unlock(&q->d_lock);
+- next = q->d_u.d_child.next;
++ next = q->d_child.next;
+ goto cont;
+ }
+ dget_dlock(q);
+@@ -155,13 +155,13 @@ again:
+ goto relock;
+ }
+ spin_unlock(&p->d_lock);
+- next = p->d_u.d_child.next;
++ next = p->d_child.next;
+ p = parent;
+ if (next != &parent->d_subdirs)
+ break;
+ }
+ }
+- ret = list_entry(next, struct dentry, d_u.d_child);
++ ret = list_entry(next, struct dentry, d_child);
+
+ spin_lock_nested(&ret->d_lock, DENTRY_D_LOCK_NESTED);
+ /* Negative dentry - try next */
+@@ -489,7 +489,7 @@ found:
+ spin_lock(&sbi->lookup_lock);
+ spin_lock(&expired->d_parent->d_lock);
+ spin_lock_nested(&expired->d_lock, DENTRY_D_LOCK_NESTED);
+- list_move(&expired->d_parent->d_subdirs, &expired->d_u.d_child);
++ list_move(&expired->d_parent->d_subdirs, &expired->d_child);
+ spin_unlock(&expired->d_lock);
+ spin_unlock(&expired->d_parent->d_lock);
+ spin_unlock(&sbi->lookup_lock);
+diff --git a/fs/autofs4/root.c b/fs/autofs4/root.c
+index d76d083f2f06..0822c9eacc56 100644
+--- a/fs/autofs4/root.c
++++ b/fs/autofs4/root.c
+@@ -687,7 +687,7 @@ static void autofs_clear_leaf_automount_flags(struct dentry *dentry)
+ /* only consider parents below dentrys in the root */
+ if (IS_ROOT(parent->d_parent))
+ return;
+- d_child = &dentry->d_u.d_child;
++ d_child = &dentry->d_child;
+ /* Set parent managed if it's becoming empty */
+ if (d_child->next == &parent->d_subdirs &&
+ d_child->prev == &parent->d_subdirs)
+diff --git a/fs/ceph/dir.c b/fs/ceph/dir.c
+index e6d63f8f98c0..695e7888fef8 100644
+--- a/fs/ceph/dir.c
++++ b/fs/ceph/dir.c
+@@ -111,7 +111,7 @@ static int fpos_cmp(loff_t l, loff_t r)
+ /*
+ * When possible, we try to satisfy a readdir by peeking at the
+ * dcache. We make this work by carefully ordering dentries on
+- * d_u.d_child when we initially get results back from the MDS, and
++ * d_child when we initially get results back from the MDS, and
+ * falling back to a "normal" sync readdir if any dentries in the dir
+ * are dropped.
+ *
+@@ -147,11 +147,11 @@ static int __dcache_readdir(struct file *file, struct dir_context *ctx,
+ p = parent->d_subdirs.prev;
+ dout(" initial p %p/%p\n", p->prev, p->next);
+ } else {
+- p = last->d_u.d_child.prev;
++ p = last->d_child.prev;
+ }
+
+ more:
+- dentry = list_entry(p, struct dentry, d_u.d_child);
++ dentry = list_entry(p, struct dentry, d_child);
+ di = ceph_dentry(dentry);
+ while (1) {
+ dout(" p %p/%p %s d_subdirs %p/%p\n", p->prev, p->next,
+@@ -174,7 +174,7 @@ more:
+ !dentry->d_inode ? " null" : "");
+ spin_unlock(&dentry->d_lock);
+ p = p->prev;
+- dentry = list_entry(p, struct dentry, d_u.d_child);
++ dentry = list_entry(p, struct dentry, d_child);
+ di = ceph_dentry(dentry);
+ }
+
+diff --git a/fs/ceph/inode.c b/fs/ceph/inode.c
+index 7b6139004401..7a1df90c7771 100644
+--- a/fs/ceph/inode.c
++++ b/fs/ceph/inode.c
+@@ -1399,7 +1399,7 @@ retry_lookup:
+ /* reorder parent's d_subdirs */
+ spin_lock(&parent->d_lock);
+ spin_lock_nested(&dn->d_lock, DENTRY_D_LOCK_NESTED);
+- list_move(&dn->d_u.d_child, &parent->d_subdirs);
++ list_move(&dn->d_child, &parent->d_subdirs);
+ spin_unlock(&dn->d_lock);
+ spin_unlock(&parent->d_lock);
+ }
+diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
+index 197cb503d528..0c3ce464cae4 100644
+--- a/fs/cifs/inode.c
++++ b/fs/cifs/inode.c
+@@ -895,7 +895,7 @@ inode_has_hashed_dentries(struct inode *inode)
+ struct dentry *dentry;
+
+ spin_lock(&inode->i_lock);
+- hlist_for_each_entry(dentry, &inode->i_dentry, d_alias) {
++ hlist_for_each_entry(dentry, &inode->i_dentry, d_u.d_alias) {
+ if (!d_unhashed(dentry) || IS_ROOT(dentry)) {
+ spin_unlock(&inode->i_lock);
+ return true;
+diff --git a/fs/coda/cache.c b/fs/coda/cache.c
+index 278f8fdeb9ef..46ee6f238985 100644
+--- a/fs/coda/cache.c
++++ b/fs/coda/cache.c
+@@ -92,7 +92,7 @@ static void coda_flag_children(struct dentry *parent, int flag)
+ struct dentry *de;
+
+ spin_lock(&parent->d_lock);
+- list_for_each_entry(de, &parent->d_subdirs, d_u.d_child) {
++ list_for_each_entry(de, &parent->d_subdirs, d_child) {
+ /* don't know what to do with negative dentries */
+ if (de->d_inode )
+ coda_flag_inode(de->d_inode, flag);
+diff --git a/fs/dcache.c b/fs/dcache.c
+index 5bc72b07fde2..71acf8d6f2be 100644
+--- a/fs/dcache.c
++++ b/fs/dcache.c
+@@ -44,7 +44,7 @@
+ /*
+ * Usage:
+ * dcache->d_inode->i_lock protects:
+- * - i_dentry, d_alias, d_inode of aliases
++ * - i_dentry, d_u.d_alias, d_inode of aliases
+ * dcache_hash_bucket lock protects:
+ * - the dcache hash table
+ * s_anon bl list spinlock protects:
+@@ -59,7 +59,7 @@
+ * - d_unhashed()
+ * - d_parent and d_subdirs
+ * - childrens' d_child and d_parent
+- * - d_alias, d_inode
++ * - d_u.d_alias, d_inode
+ *
+ * Ordering:
+ * dentry->d_inode->i_lock
+@@ -252,14 +252,12 @@ static void __d_free(struct rcu_head *head)
+ {
+ struct dentry *dentry = container_of(head, struct dentry, d_u.d_rcu);
+
+- WARN_ON(!hlist_unhashed(&dentry->d_alias));
+ kmem_cache_free(dentry_cache, dentry);
+ }
+
+ static void __d_free_external(struct rcu_head *head)
+ {
+ struct dentry *dentry = container_of(head, struct dentry, d_u.d_rcu);
+- WARN_ON(!hlist_unhashed(&dentry->d_alias));
+ kfree(external_name(dentry));
+ kmem_cache_free(dentry_cache, dentry);
+ }
+@@ -271,6 +269,7 @@ static inline int dname_external(const struct dentry *dentry)
+
+ static void dentry_free(struct dentry *dentry)
+ {
++ WARN_ON(!hlist_unhashed(&dentry->d_u.d_alias));
+ if (unlikely(dname_external(dentry))) {
+ struct external_name *p = external_name(dentry);
+ if (likely(atomic_dec_and_test(&p->u.count))) {
+@@ -311,7 +310,7 @@ static void dentry_iput(struct dentry * dentry)
+ struct inode *inode = dentry->d_inode;
+ if (inode) {
+ dentry->d_inode = NULL;
+- hlist_del_init(&dentry->d_alias);
++ hlist_del_init(&dentry->d_u.d_alias);
+ spin_unlock(&dentry->d_lock);
+ spin_unlock(&inode->i_lock);
+ if (!inode->i_nlink)
+@@ -336,7 +335,7 @@ static void dentry_unlink_inode(struct dentry * dentry)
+ struct inode *inode = dentry->d_inode;
+ __d_clear_type(dentry);
+ dentry->d_inode = NULL;
+- hlist_del_init(&dentry->d_alias);
++ hlist_del_init(&dentry->d_u.d_alias);
+ dentry_rcuwalk_barrier(dentry);
+ spin_unlock(&dentry->d_lock);
+ spin_unlock(&inode->i_lock);
+@@ -496,7 +495,7 @@ static void __dentry_kill(struct dentry *dentry)
+ }
+ /* if it was on the hash then remove it */
+ __d_drop(dentry);
+- list_del(&dentry->d_u.d_child);
++ __list_del_entry(&dentry->d_child);
+ /*
+ * Inform d_walk() that we are no longer attached to the
+ * dentry tree
+@@ -722,7 +721,7 @@ static struct dentry *__d_find_alias(struct inode *inode)
+
+ again:
+ discon_alias = NULL;
+- hlist_for_each_entry(alias, &inode->i_dentry, d_alias) {
++ hlist_for_each_entry(alias, &inode->i_dentry, d_u.d_alias) {
+ spin_lock(&alias->d_lock);
+ if (S_ISDIR(inode->i_mode) || !d_unhashed(alias)) {
+ if (IS_ROOT(alias) &&
+@@ -772,7 +771,7 @@ void d_prune_aliases(struct inode *inode)
+ struct dentry *dentry;
+ restart:
+ spin_lock(&inode->i_lock);
+- hlist_for_each_entry(dentry, &inode->i_dentry, d_alias) {
++ hlist_for_each_entry(dentry, &inode->i_dentry, d_u.d_alias) {
+ spin_lock(&dentry->d_lock);
+ if (!dentry->d_lockref.count) {
+ struct dentry *parent = lock_parent(dentry);
+@@ -1051,7 +1050,7 @@ repeat:
+ resume:
+ while (next != &this_parent->d_subdirs) {
+ struct list_head *tmp = next;
+- struct dentry *dentry = list_entry(tmp, struct dentry, d_u.d_child);
++ struct dentry *dentry = list_entry(tmp, struct dentry, d_child);
+ next = tmp->next;
+
+ spin_lock_nested(&dentry->d_lock, DENTRY_D_LOCK_NESTED);
+@@ -1083,33 +1082,31 @@ resume:
+ /*
+ * All done at this level ... ascend and resume the search.
+ */
++ rcu_read_lock();
++ascend:
+ if (this_parent != parent) {
+ struct dentry *child = this_parent;
+ this_parent = child->d_parent;
+
+- rcu_read_lock();
+ spin_unlock(&child->d_lock);
+ spin_lock(&this_parent->d_lock);
+
+- /*
+- * might go back up the wrong parent if we have had a rename
+- * or deletion
+- */
+- if (this_parent != child->d_parent ||
+- (child->d_flags & DCACHE_DENTRY_KILLED) ||
+- need_seqretry(&rename_lock, seq)) {
+- spin_unlock(&this_parent->d_lock);
+- rcu_read_unlock();
++ /* might go back up the wrong parent if we have had a rename. */
++ if (need_seqretry(&rename_lock, seq))
+ goto rename_retry;
++ next = child->d_child.next;
++ while (unlikely(child->d_flags & DCACHE_DENTRY_KILLED)) {
++ if (next == &this_parent->d_subdirs)
++ goto ascend;
++ child = list_entry(next, struct dentry, d_child);
++ next = next->next;
+ }
+ rcu_read_unlock();
+- next = child->d_u.d_child.next;
+ goto resume;
+ }
+- if (need_seqretry(&rename_lock, seq)) {
+- spin_unlock(&this_parent->d_lock);
++ if (need_seqretry(&rename_lock, seq))
+ goto rename_retry;
+- }
++ rcu_read_unlock();
+ if (finish)
+ finish(data);
+
+@@ -1119,6 +1116,9 @@ out_unlock:
+ return;
+
+ rename_retry:
++ spin_unlock(&this_parent->d_lock);
++ rcu_read_unlock();
++ BUG_ON(seq & 1);
+ if (!retry)
+ return;
+ seq = 1;
+@@ -1455,8 +1455,8 @@ struct dentry *__d_alloc(struct super_block *sb, const struct qstr *name)
+ INIT_HLIST_BL_NODE(&dentry->d_hash);
+ INIT_LIST_HEAD(&dentry->d_lru);
+ INIT_LIST_HEAD(&dentry->d_subdirs);
+- INIT_HLIST_NODE(&dentry->d_alias);
+- INIT_LIST_HEAD(&dentry->d_u.d_child);
++ INIT_HLIST_NODE(&dentry->d_u.d_alias);
++ INIT_LIST_HEAD(&dentry->d_child);
+ d_set_d_op(dentry, dentry->d_sb->s_d_op);
+
+ this_cpu_inc(nr_dentry);
+@@ -1486,7 +1486,7 @@ struct dentry *d_alloc(struct dentry * parent, const struct qstr *name)
+ */
+ __dget_dlock(parent);
+ dentry->d_parent = parent;
+- list_add(&dentry->d_u.d_child, &parent->d_subdirs);
++ list_add(&dentry->d_child, &parent->d_subdirs);
+ spin_unlock(&parent->d_lock);
+
+ return dentry;
+@@ -1579,7 +1579,7 @@ static void __d_instantiate(struct dentry *dentry, struct inode *inode)
+ spin_lock(&dentry->d_lock);
+ __d_set_type(dentry, add_flags);
+ if (inode)
+- hlist_add_head(&dentry->d_alias, &inode->i_dentry);
++ hlist_add_head(&dentry->d_u.d_alias, &inode->i_dentry);
+ dentry->d_inode = inode;
+ dentry_rcuwalk_barrier(dentry);
+ spin_unlock(&dentry->d_lock);
+@@ -1603,7 +1603,7 @@ static void __d_instantiate(struct dentry *dentry, struct inode *inode)
+
+ void d_instantiate(struct dentry *entry, struct inode * inode)
+ {
+- BUG_ON(!hlist_unhashed(&entry->d_alias));
++ BUG_ON(!hlist_unhashed(&entry->d_u.d_alias));
+ if (inode)
+ spin_lock(&inode->i_lock);
+ __d_instantiate(entry, inode);
+@@ -1642,7 +1642,7 @@ static struct dentry *__d_instantiate_unique(struct dentry *entry,
+ return NULL;
+ }
+
+- hlist_for_each_entry(alias, &inode->i_dentry, d_alias) {
++ hlist_for_each_entry(alias, &inode->i_dentry, d_u.d_alias) {
+ /*
+ * Don't need alias->d_lock here, because aliases with
+ * d_parent == entry->d_parent are not subject to name or
+@@ -1668,7 +1668,7 @@ struct dentry *d_instantiate_unique(struct dentry *entry, struct inode *inode)
+ {
+ struct dentry *result;
+
+- BUG_ON(!hlist_unhashed(&entry->d_alias));
++ BUG_ON(!hlist_unhashed(&entry->d_u.d_alias));
+
+ if (inode)
+ spin_lock(&inode->i_lock);
+@@ -1699,7 +1699,7 @@ EXPORT_SYMBOL(d_instantiate_unique);
+ */
+ int d_instantiate_no_diralias(struct dentry *entry, struct inode *inode)
+ {
+- BUG_ON(!hlist_unhashed(&entry->d_alias));
++ BUG_ON(!hlist_unhashed(&entry->d_u.d_alias));
+
+ spin_lock(&inode->i_lock);
+ if (S_ISDIR(inode->i_mode) && !hlist_empty(&inode->i_dentry)) {
+@@ -1738,7 +1738,7 @@ static struct dentry * __d_find_any_alias(struct inode *inode)
+
+ if (hlist_empty(&inode->i_dentry))
+ return NULL;
+- alias = hlist_entry(inode->i_dentry.first, struct dentry, d_alias);
++ alias = hlist_entry(inode->i_dentry.first, struct dentry, d_u.d_alias);
+ __dget(alias);
+ return alias;
+ }
+@@ -1800,7 +1800,7 @@ static struct dentry *__d_obtain_alias(struct inode *inode, int disconnected)
+ spin_lock(&tmp->d_lock);
+ tmp->d_inode = inode;
+ tmp->d_flags |= add_flags;
+- hlist_add_head(&tmp->d_alias, &inode->i_dentry);
++ hlist_add_head(&tmp->d_u.d_alias, &inode->i_dentry);
+ hlist_bl_lock(&tmp->d_sb->s_anon);
+ hlist_bl_add_head(&tmp->d_hash, &tmp->d_sb->s_anon);
+ hlist_bl_unlock(&tmp->d_sb->s_anon);
+@@ -2235,7 +2235,7 @@ int d_validate(struct dentry *dentry, struct dentry *dparent)
+ struct dentry *child;
+
+ spin_lock(&dparent->d_lock);
+- list_for_each_entry(child, &dparent->d_subdirs, d_u.d_child) {
++ list_for_each_entry(child, &dparent->d_subdirs, d_child) {
+ if (dentry == child) {
+ spin_lock_nested(&dentry->d_lock, DENTRY_D_LOCK_NESTED);
+ __dget_dlock(dentry);
+@@ -2526,13 +2526,13 @@ static void __d_move(struct dentry *dentry, struct dentry *target,
+ /* splicing a tree */
+ dentry->d_parent = target->d_parent;
+ target->d_parent = target;
+- list_del_init(&target->d_u.d_child);
+- list_move(&dentry->d_u.d_child, &dentry->d_parent->d_subdirs);
++ list_del_init(&target->d_child);
++ list_move(&dentry->d_child, &dentry->d_parent->d_subdirs);
+ } else {
+ /* swapping two dentries */
+ swap(dentry->d_parent, target->d_parent);
+- list_move(&target->d_u.d_child, &target->d_parent->d_subdirs);
+- list_move(&dentry->d_u.d_child, &dentry->d_parent->d_subdirs);
++ list_move(&target->d_child, &target->d_parent->d_subdirs);
++ list_move(&dentry->d_child, &dentry->d_parent->d_subdirs);
+ if (exchange)
+ fsnotify_d_move(target);
+ fsnotify_d_move(dentry);
+@@ -3321,7 +3321,7 @@ void d_tmpfile(struct dentry *dentry, struct inode *inode)
+ {
+ inode_dec_link_count(inode);
+ BUG_ON(dentry->d_name.name != dentry->d_iname ||
+- !hlist_unhashed(&dentry->d_alias) ||
++ !hlist_unhashed(&dentry->d_u.d_alias) ||
+ !d_unlinked(dentry));
+ spin_lock(&dentry->d_parent->d_lock);
+ spin_lock_nested(&dentry->d_lock, DENTRY_D_LOCK_NESTED);
+diff --git a/fs/debugfs/inode.c b/fs/debugfs/inode.c
+index 1e3b99d3db0d..05f2960ed7c3 100644
+--- a/fs/debugfs/inode.c
++++ b/fs/debugfs/inode.c
+@@ -553,7 +553,7 @@ void debugfs_remove_recursive(struct dentry *dentry)
+ * use the d_u.d_child as the rcu head and corrupt this list.
+ */
+ spin_lock(&parent->d_lock);
+- list_for_each_entry(child, &parent->d_subdirs, d_u.d_child) {
++ list_for_each_entry(child, &parent->d_subdirs, d_child) {
+ if (!debugfs_positive(child))
+ continue;
+
+diff --git a/fs/exportfs/expfs.c b/fs/exportfs/expfs.c
+index b01fbfb51f43..a3aa6baad1a1 100644
+--- a/fs/exportfs/expfs.c
++++ b/fs/exportfs/expfs.c
+@@ -50,7 +50,7 @@ find_acceptable_alias(struct dentry *result,
+
+ inode = result->d_inode;
+ spin_lock(&inode->i_lock);
+- hlist_for_each_entry(dentry, &inode->i_dentry, d_alias) {
++ hlist_for_each_entry(dentry, &inode->i_dentry, d_u.d_alias) {
+ dget(dentry);
+ spin_unlock(&inode->i_lock);
+ if (toput)
+diff --git a/fs/libfs.c b/fs/libfs.c
+index 171d2846f2a3..005843ce5dbd 100644
+--- a/fs/libfs.c
++++ b/fs/libfs.c
+@@ -114,18 +114,18 @@ loff_t dcache_dir_lseek(struct file *file, loff_t offset, int whence)
+
+ spin_lock(&dentry->d_lock);
+ /* d_lock not required for cursor */
+- list_del(&cursor->d_u.d_child);
++ list_del(&cursor->d_child);
+ p = dentry->d_subdirs.next;
+ while (n && p != &dentry->d_subdirs) {
+ struct dentry *next;
+- next = list_entry(p, struct dentry, d_u.d_child);
++ next = list_entry(p, struct dentry, d_child);
+ spin_lock_nested(&next->d_lock, DENTRY_D_LOCK_NESTED);
+ if (simple_positive(next))
+ n--;
+ spin_unlock(&next->d_lock);
+ p = p->next;
+ }
+- list_add_tail(&cursor->d_u.d_child, p);
++ list_add_tail(&cursor->d_child, p);
+ spin_unlock(&dentry->d_lock);
+ }
+ }
+@@ -150,7 +150,7 @@ int dcache_readdir(struct file *file, struct dir_context *ctx)
+ {
+ struct dentry *dentry = file->f_path.dentry;
+ struct dentry *cursor = file->private_data;
+- struct list_head *p, *q = &cursor->d_u.d_child;
++ struct list_head *p, *q = &cursor->d_child;
+
+ if (!dir_emit_dots(file, ctx))
+ return 0;
+@@ -159,7 +159,7 @@ int dcache_readdir(struct file *file, struct dir_context *ctx)
+ list_move(q, &dentry->d_subdirs);
+
+ for (p = q->next; p != &dentry->d_subdirs; p = p->next) {
+- struct dentry *next = list_entry(p, struct dentry, d_u.d_child);
++ struct dentry *next = list_entry(p, struct dentry, d_child);
+ spin_lock_nested(&next->d_lock, DENTRY_D_LOCK_NESTED);
+ if (!simple_positive(next)) {
+ spin_unlock(&next->d_lock);
+@@ -287,7 +287,7 @@ int simple_empty(struct dentry *dentry)
+ int ret = 0;
+
+ spin_lock(&dentry->d_lock);
+- list_for_each_entry(child, &dentry->d_subdirs, d_u.d_child) {
++ list_for_each_entry(child, &dentry->d_subdirs, d_child) {
+ spin_lock_nested(&child->d_lock, DENTRY_D_LOCK_NESTED);
+ if (simple_positive(child)) {
+ spin_unlock(&child->d_lock);
+diff --git a/fs/ncpfs/dir.c b/fs/ncpfs/dir.c
+index 7cb751dfbeef..75424d692fde 100644
+--- a/fs/ncpfs/dir.c
++++ b/fs/ncpfs/dir.c
+@@ -403,7 +403,7 @@ ncp_dget_fpos(struct dentry *dentry, struct dentry *parent, unsigned long fpos)
+
+ /* If a pointer is invalid, we search the dentry. */
+ spin_lock(&parent->d_lock);
+- list_for_each_entry(dent, &parent->d_subdirs, d_u.d_child) {
++ list_for_each_entry(dent, &parent->d_subdirs, d_child) {
+ if ((unsigned long)dent->d_fsdata == fpos) {
+ if (dent->d_inode)
+ dget(dent);
+diff --git a/fs/ncpfs/ncplib_kernel.h b/fs/ncpfs/ncplib_kernel.h
+index 52cb19d66ecb..b785f74bfe3c 100644
+--- a/fs/ncpfs/ncplib_kernel.h
++++ b/fs/ncpfs/ncplib_kernel.h
+@@ -191,7 +191,7 @@ ncp_renew_dentries(struct dentry *parent)
+ struct dentry *dentry;
+
+ spin_lock(&parent->d_lock);
+- list_for_each_entry(dentry, &parent->d_subdirs, d_u.d_child) {
++ list_for_each_entry(dentry, &parent->d_subdirs, d_child) {
+ if (dentry->d_fsdata == NULL)
+ ncp_age_dentry(server, dentry);
+ else
+@@ -207,7 +207,7 @@ ncp_invalidate_dircache_entries(struct dentry *parent)
+ struct dentry *dentry;
+
+ spin_lock(&parent->d_lock);
+- list_for_each_entry(dentry, &parent->d_subdirs, d_u.d_child) {
++ list_for_each_entry(dentry, &parent->d_subdirs, d_child) {
+ dentry->d_fsdata = NULL;
+ ncp_age_dentry(server, dentry);
+ }
+diff --git a/fs/nfs/getroot.c b/fs/nfs/getroot.c
+index 880618a8b048..ebc6a0add5ae 100644
+--- a/fs/nfs/getroot.c
++++ b/fs/nfs/getroot.c
+@@ -58,7 +58,7 @@ static int nfs_superblock_set_dummy_root(struct super_block *sb, struct inode *i
+ */
+ spin_lock(&sb->s_root->d_inode->i_lock);
+ spin_lock(&sb->s_root->d_lock);
+- hlist_del_init(&sb->s_root->d_alias);
++ hlist_del_init(&sb->s_root->d_u.d_alias);
+ spin_unlock(&sb->s_root->d_lock);
+ spin_unlock(&sb->s_root->d_inode->i_lock);
+ }
+diff --git a/fs/notify/fsnotify.c b/fs/notify/fsnotify.c
+index 89326acd4561..41e39102743a 100644
+--- a/fs/notify/fsnotify.c
++++ b/fs/notify/fsnotify.c
+@@ -63,14 +63,14 @@ void __fsnotify_update_child_dentry_flags(struct inode *inode)
+ spin_lock(&inode->i_lock);
+ /* run all of the dentries associated with this inode. Since this is a
+ * directory, there damn well better only be one item on this list */
+- hlist_for_each_entry(alias, &inode->i_dentry, d_alias) {
++ hlist_for_each_entry(alias, &inode->i_dentry, d_u.d_alias) {
+ struct dentry *child;
+
+ /* run all of the children of the original inode and fix their
+ * d_flags to indicate parental interest (their parent is the
+ * original inode) */
+ spin_lock(&alias->d_lock);
+- list_for_each_entry(child, &alias->d_subdirs, d_u.d_child) {
++ list_for_each_entry(child, &alias->d_subdirs, d_child) {
+ if (!child->d_inode)
+ continue;
+
+diff --git a/fs/ocfs2/dcache.c b/fs/ocfs2/dcache.c
+index e2e05a106beb..92edcfc23c1c 100644
+--- a/fs/ocfs2/dcache.c
++++ b/fs/ocfs2/dcache.c
+@@ -172,7 +172,7 @@ struct dentry *ocfs2_find_local_alias(struct inode *inode,
+ struct dentry *dentry;
+
+ spin_lock(&inode->i_lock);
+- hlist_for_each_entry(dentry, &inode->i_dentry, d_alias) {
++ hlist_for_each_entry(dentry, &inode->i_dentry, d_u.d_alias) {
+ spin_lock(&dentry->d_lock);
+ if (ocfs2_match_dentry(dentry, parent_blkno, skip_unhashed)) {
+ trace_ocfs2_find_local_alias(dentry->d_name.len,
+diff --git a/include/linux/dcache.h b/include/linux/dcache.h
+index b2a2a08523bf..1c2f1b84468b 100644
+--- a/include/linux/dcache.h
++++ b/include/linux/dcache.h
+@@ -124,15 +124,15 @@ struct dentry {
+ void *d_fsdata; /* fs-specific data */
+
+ struct list_head d_lru; /* LRU list */
++ struct list_head d_child; /* child of parent list */
++ struct list_head d_subdirs; /* our children */
+ /*
+- * d_child and d_rcu can share memory
++ * d_alias and d_rcu can share memory
+ */
+ union {
+- struct list_head d_child; /* child of parent list */
++ struct hlist_node d_alias; /* inode alias list */
+ struct rcu_head d_rcu;
+ } d_u;
+- struct list_head d_subdirs; /* our children */
+- struct hlist_node d_alias; /* inode alias list */
+ };
+
+ /*
+diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
+index 92f4a6cee172..426962b04183 100644
+--- a/kernel/trace/trace.c
++++ b/kernel/trace/trace.c
+@@ -6417,7 +6417,7 @@ static int instance_mkdir (struct inode *inode, struct dentry *dentry, umode_t m
+ int ret;
+
+ /* Paranoid: Make sure the parent is the "instances" directory */
+- parent = hlist_entry(inode->i_dentry.first, struct dentry, d_alias);
++ parent = hlist_entry(inode->i_dentry.first, struct dentry, d_u.d_alias);
+ if (WARN_ON_ONCE(parent != trace_instance_dir))
+ return -ENOENT;
+
+@@ -6444,7 +6444,7 @@ static int instance_rmdir(struct inode *inode, struct dentry *dentry)
+ int ret;
+
+ /* Paranoid: Make sure the parent is the "instances" directory */
+- parent = hlist_entry(inode->i_dentry.first, struct dentry, d_alias);
++ parent = hlist_entry(inode->i_dentry.first, struct dentry, d_u.d_alias);
+ if (WARN_ON_ONCE(parent != trace_instance_dir))
+ return -ENOENT;
+
+diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c
+index 0cc51edde3a8..1b0df1e504f0 100644
+--- a/kernel/trace/trace_events.c
++++ b/kernel/trace/trace_events.c
+@@ -461,7 +461,7 @@ static void remove_event_file_dir(struct ftrace_event_file *file)
+
+ if (dir) {
+ spin_lock(&dir->d_lock); /* probably unneeded */
+- list_for_each_entry(child, &dir->d_subdirs, d_u.d_child) {
++ list_for_each_entry(child, &dir->d_subdirs, d_child) {
+ if (child->d_inode) /* probably unneeded */
+ child->d_inode->i_private = NULL;
+ }
+diff --git a/net/ipv4/gre_offload.c b/net/ipv4/gre_offload.c
+index bb5947b0ce2d..51973ddc05a6 100644
+--- a/net/ipv4/gre_offload.c
++++ b/net/ipv4/gre_offload.c
+@@ -247,6 +247,9 @@ static int gre_gro_complete(struct sk_buff *skb, int nhoff)
+ err = ptype->callbacks.gro_complete(skb, nhoff + grehlen);
+
+ rcu_read_unlock();
++
++ skb_set_inner_mac_header(skb, nhoff + grehlen);
++
+ return err;
+ }
+
+diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
+index 147be2024290..ef7089ca86e2 100644
+--- a/net/ipv4/tcp_ipv4.c
++++ b/net/ipv4/tcp_ipv4.c
+@@ -623,6 +623,7 @@ static void tcp_v4_send_reset(struct sock *sk, struct sk_buff *skb)
+ arg.iov[0].iov_base = (unsigned char *)&rep;
+ arg.iov[0].iov_len = sizeof(rep.th);
+
++ net = sk ? sock_net(sk) : dev_net(skb_dst(skb)->dev);
+ #ifdef CONFIG_TCP_MD5SIG
+ hash_location = tcp_parse_md5sig_option(th);
+ if (!sk && hash_location) {
+@@ -633,7 +634,7 @@ static void tcp_v4_send_reset(struct sock *sk, struct sk_buff *skb)
+ * Incoming packet is checked with md5 hash with finding key,
+ * no RST generated if md5 hash doesn't match.
+ */
+- sk1 = __inet_lookup_listener(dev_net(skb_dst(skb)->dev),
++ sk1 = __inet_lookup_listener(net,
+ &tcp_hashinfo, ip_hdr(skb)->saddr,
+ th->source, ip_hdr(skb)->daddr,
+ ntohs(th->source), inet_iif(skb));
+@@ -681,7 +682,6 @@ static void tcp_v4_send_reset(struct sock *sk, struct sk_buff *skb)
+ if (sk)
+ arg.bound_dev_if = sk->sk_bound_dev_if;
+
+- net = dev_net(skb_dst(skb)->dev);
+ arg.tos = ip_hdr(skb)->tos;
+ ip_send_unicast_reply(net, skb, &TCP_SKB_CB(skb)->header.h4.opt,
+ ip_hdr(skb)->saddr, ip_hdr(skb)->daddr,
+diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
+index dc495ae2ead0..c277951d783b 100644
+--- a/net/ipv6/tcp_ipv6.c
++++ b/net/ipv6/tcp_ipv6.c
+@@ -787,16 +787,16 @@ static const struct tcp_request_sock_ops tcp_request_sock_ipv6_ops = {
+ .queue_hash_add = inet6_csk_reqsk_queue_hash_add,
+ };
+
+-static void tcp_v6_send_response(struct sk_buff *skb, u32 seq, u32 ack, u32 win,
+- u32 tsval, u32 tsecr, int oif,
+- struct tcp_md5sig_key *key, int rst, u8 tclass,
+- u32 label)
++static void tcp_v6_send_response(struct sock *sk, struct sk_buff *skb, u32 seq,
++ u32 ack, u32 win, u32 tsval, u32 tsecr,
++ int oif, struct tcp_md5sig_key *key, int rst,
++ u8 tclass, u32 label)
+ {
+ const struct tcphdr *th = tcp_hdr(skb);
+ struct tcphdr *t1;
+ struct sk_buff *buff;
+ struct flowi6 fl6;
+- struct net *net = dev_net(skb_dst(skb)->dev);
++ struct net *net = sk ? sock_net(sk) : dev_net(skb_dst(skb)->dev);
+ struct sock *ctl_sk = net->ipv6.tcp_sk;
+ unsigned int tot_len = sizeof(struct tcphdr);
+ struct dst_entry *dst;
+@@ -946,7 +946,7 @@ static void tcp_v6_send_reset(struct sock *sk, struct sk_buff *skb)
+ (th->doff << 2);
+
+ oif = sk ? sk->sk_bound_dev_if : 0;
+- tcp_v6_send_response(skb, seq, ack_seq, 0, 0, 0, oif, key, 1, 0, 0);
++ tcp_v6_send_response(sk, skb, seq, ack_seq, 0, 0, 0, oif, key, 1, 0, 0);
+
+ #ifdef CONFIG_TCP_MD5SIG
+ release_sk1:
+@@ -957,13 +957,13 @@ release_sk1:
+ #endif
+ }
+
+-static void tcp_v6_send_ack(struct sk_buff *skb, u32 seq, u32 ack,
+- u32 win, u32 tsval, u32 tsecr, int oif,
++static void tcp_v6_send_ack(struct sock *sk, struct sk_buff *skb, u32 seq,
++ u32 ack, u32 win, u32 tsval, u32 tsecr, int oif,
+ struct tcp_md5sig_key *key, u8 tclass,
+ u32 label)
+ {
+- tcp_v6_send_response(skb, seq, ack, win, tsval, tsecr, oif, key, 0, tclass,
+- label);
++ tcp_v6_send_response(sk, skb, seq, ack, win, tsval, tsecr, oif, key, 0,
++ tclass, label);
+ }
+
+ static void tcp_v6_timewait_ack(struct sock *sk, struct sk_buff *skb)
+@@ -971,7 +971,7 @@ static void tcp_v6_timewait_ack(struct sock *sk, struct sk_buff *skb)
+ struct inet_timewait_sock *tw = inet_twsk(sk);
+ struct tcp_timewait_sock *tcptw = tcp_twsk(sk);
+
+- tcp_v6_send_ack(skb, tcptw->tw_snd_nxt, tcptw->tw_rcv_nxt,
++ tcp_v6_send_ack(sk, skb, tcptw->tw_snd_nxt, tcptw->tw_rcv_nxt,
+ tcptw->tw_rcv_wnd >> tw->tw_rcv_wscale,
+ tcp_time_stamp + tcptw->tw_ts_offset,
+ tcptw->tw_ts_recent, tw->tw_bound_dev_if, tcp_twsk_md5_key(tcptw),
+@@ -986,10 +986,10 @@ static void tcp_v6_reqsk_send_ack(struct sock *sk, struct sk_buff *skb,
+ /* sk->sk_state == TCP_LISTEN -> for regular TCP_SYN_RECV
+ * sk->sk_state == TCP_SYN_RECV -> for Fast Open.
+ */
+- tcp_v6_send_ack(skb, (sk->sk_state == TCP_LISTEN) ?
++ tcp_v6_send_ack(sk, skb, (sk->sk_state == TCP_LISTEN) ?
+ tcp_rsk(req)->snt_isn + 1 : tcp_sk(sk)->snd_nxt,
+- tcp_rsk(req)->rcv_nxt,
+- req->rcv_wnd, tcp_time_stamp, req->ts_recent, sk->sk_bound_dev_if,
++ tcp_rsk(req)->rcv_nxt, req->rcv_wnd,
++ tcp_time_stamp, req->ts_recent, sk->sk_bound_dev_if,
+ tcp_v6_md5_do_lookup(sk, &ipv6_hdr(skb)->daddr),
+ 0, 0);
+ }
+diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
+index 0007b8180397..b6bf8e8caec7 100644
+--- a/net/netlink/af_netlink.c
++++ b/net/netlink/af_netlink.c
+@@ -3130,7 +3130,7 @@ static int __init netlink_proto_init(void)
+ .head_offset = offsetof(struct netlink_sock, node),
+ .key_offset = offsetof(struct netlink_sock, portid),
+ .key_len = sizeof(u32), /* portid */
+- .hashfn = arch_fast_hash,
++ .hashfn = jhash,
+ .max_shift = 16, /* 64K */
+ .grow_decision = rht_grow_above_75,
+ .shrink_decision = rht_shrink_below_30,
+diff --git a/net/openvswitch/flow_netlink.c b/net/openvswitch/flow_netlink.c
+index 089b195c064a..918e96645b05 100644
+--- a/net/openvswitch/flow_netlink.c
++++ b/net/openvswitch/flow_netlink.c
+@@ -145,7 +145,7 @@ static bool match_validate(const struct sw_flow_match *match,
+ if (match->key->eth.type == htons(ETH_P_ARP)
+ || match->key->eth.type == htons(ETH_P_RARP)) {
+ key_expected |= 1 << OVS_KEY_ATTR_ARP;
+- if (match->mask && (match->mask->key.tp.src == htons(0xff)))
++ if (match->mask && (match->mask->key.eth.type == htons(0xffff)))
+ mask_allowed |= 1 << OVS_KEY_ATTR_ARP;
+ }
+
+@@ -220,7 +220,7 @@ static bool match_validate(const struct sw_flow_match *match,
+ htons(NDISC_NEIGHBOUR_SOLICITATION) ||
+ match->key->tp.src == htons(NDISC_NEIGHBOUR_ADVERTISEMENT)) {
+ key_expected |= 1 << OVS_KEY_ATTR_ND;
+- if (match->mask && (match->mask->key.tp.src == htons(0xffff)))
++ if (match->mask && (match->mask->key.tp.src == htons(0xff)))
+ mask_allowed |= 1 << OVS_KEY_ATTR_ND;
+ }
+ }
+diff --git a/net/sched/sch_fq_codel.c b/net/sched/sch_fq_codel.c
+index b9ca32ebc1de..1e52decb7b59 100644
+--- a/net/sched/sch_fq_codel.c
++++ b/net/sched/sch_fq_codel.c
+@@ -94,7 +94,7 @@ static unsigned int fq_codel_classify(struct sk_buff *skb, struct Qdisc *sch,
+ TC_H_MIN(skb->priority) <= q->flows_cnt)
+ return TC_H_MIN(skb->priority);
+
+- filter = rcu_dereference(q->filter_list);
++ filter = rcu_dereference_bh(q->filter_list);
+ if (!filter)
+ return fq_codel_hash(q, skb) + 1;
+
+diff --git a/net/sctp/output.c b/net/sctp/output.c
+index 42dffd428389..fc5e45b8a832 100644
+--- a/net/sctp/output.c
++++ b/net/sctp/output.c
+@@ -401,12 +401,12 @@ int sctp_packet_transmit(struct sctp_packet *packet)
+ sk = chunk->skb->sk;
+
+ /* Allocate the new skb. */
+- nskb = alloc_skb(packet->size + LL_MAX_HEADER, GFP_ATOMIC);
++ nskb = alloc_skb(packet->size + MAX_HEADER, GFP_ATOMIC);
+ if (!nskb)
+ goto nomem;
+
+ /* Make sure the outbound skb has enough header room reserved. */
+- skb_reserve(nskb, packet->overhead + LL_MAX_HEADER);
++ skb_reserve(nskb, packet->overhead + MAX_HEADER);
+
+ /* Set the owning socket so that we know where to get the
+ * destination IP address.
+diff --git a/security/selinux/selinuxfs.c b/security/selinux/selinuxfs.c
+index c71737f6d1cc..33db1ad4fd10 100644
+--- a/security/selinux/selinuxfs.c
++++ b/security/selinux/selinuxfs.c
+@@ -1200,7 +1200,7 @@ static void sel_remove_entries(struct dentry *de)
+ spin_lock(&de->d_lock);
+ node = de->d_subdirs.next;
+ while (node != &de->d_subdirs) {
+- struct dentry *d = list_entry(node, struct dentry, d_u.d_child);
++ struct dentry *d = list_entry(node, struct dentry, d_child);
+
+ spin_lock_nested(&d->d_lock, DENTRY_D_LOCK_NESTED);
+ list_del_init(node);
+@@ -1674,12 +1674,12 @@ static void sel_remove_classes(void)
+
+ list_for_each(class_node, &class_dir->d_subdirs) {
+ struct dentry *class_subdir = list_entry(class_node,
+- struct dentry, d_u.d_child);
++ struct dentry, d_child);
+ struct list_head *class_subdir_node;
+
+ list_for_each(class_subdir_node, &class_subdir->d_subdirs) {
+ struct dentry *d = list_entry(class_subdir_node,
+- struct dentry, d_u.d_child);
++ struct dentry, d_child);
+
+ if (d->d_inode)
+ if (d->d_inode->i_mode & S_IFDIR)
+diff --git a/sound/pci/hda/patch_analog.c b/sound/pci/hda/patch_analog.c
+index 06275f8807a8..4714ff92f15e 100644
+--- a/sound/pci/hda/patch_analog.c
++++ b/sound/pci/hda/patch_analog.c
+@@ -332,6 +332,7 @@ static const struct hda_fixup ad1986a_fixups[] = {
+
+ static const struct snd_pci_quirk ad1986a_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x103c, 0x30af, "HP B2800", AD1986A_FIXUP_LAPTOP_IMIC),
++ SND_PCI_QUIRK(0x1043, 0x1443, "ASUS Z99He", AD1986A_FIXUP_EAPD),
+ SND_PCI_QUIRK(0x1043, 0x1447, "ASUS A8JN", AD1986A_FIXUP_EAPD),
+ SND_PCI_QUIRK_MASK(0x1043, 0xff00, 0x8100, "ASUS P5", AD1986A_FIXUP_3STACK),
+ SND_PCI_QUIRK_MASK(0x1043, 0xff00, 0x8200, "ASUS M2", AD1986A_FIXUP_3STACK),
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index b118a5be18df..c5ad83e4e0c7 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -4887,6 +4887,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x17aa, 0x2212, "Thinkpad T440", ALC292_FIXUP_TPT440_DOCK),
+ SND_PCI_QUIRK(0x17aa, 0x2214, "Thinkpad X240", ALC292_FIXUP_TPT440_DOCK),
+ SND_PCI_QUIRK(0x17aa, 0x2215, "Thinkpad", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
++ SND_PCI_QUIRK(0x17aa, 0x3977, "IdeaPad S210", ALC283_FIXUP_INT_MIC),
+ SND_PCI_QUIRK(0x17aa, 0x3978, "IdeaPad Y410P", ALC269_FIXUP_NO_SHUTUP),
+ SND_PCI_QUIRK(0x17aa, 0x5013, "Thinkpad", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
+ SND_PCI_QUIRK(0x17aa, 0x501a, "Thinkpad", ALC283_FIXUP_INT_MIC),
+diff --git a/sound/usb/midi.c b/sound/usb/midi.c
+index d3d49525a16b..5bfb695547f8 100644
+--- a/sound/usb/midi.c
++++ b/sound/usb/midi.c
+@@ -365,6 +365,8 @@ static void snd_usbmidi_error_timer(unsigned long data)
+ if (in && in->error_resubmit) {
+ in->error_resubmit = 0;
+ for (j = 0; j < INPUT_URBS; ++j) {
++ if (atomic_read(&in->urbs[j]->use_count))
++ continue;
+ in->urbs[j]->dev = umidi->dev;
+ snd_usbmidi_submit_urb(in->urbs[j], GFP_ATOMIC);
+ }
^ permalink raw reply related [flat|nested] 67+ messages in thread
* [gentoo-commits] proj/linux-patches:3.18 commit in: /
@ 2015-01-01 14:15 Mike Pagano
0 siblings, 0 replies; 67+ messages in thread
From: Mike Pagano @ 2015-01-01 14:15 UTC (permalink / raw
To: gentoo-commits
commit: 410aa733bb46912b99ce35684653ffe4466c15a3
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Thu Jan 1 14:15:19 2015 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Thu Jan 1 14:15:19 2015 +0000
URL: http://sources.gentoo.org/gitweb/?p=proj/linux-patches.git;a=commit;h=410aa733
Bump BFQ to v7r6. Remove old.
---
...oups-kconfig-build-bits-for-BFQ-v7r7-3.18.patch | 4 +-
...ntroduce-the-BFQ-v7r7-I-O-sched-for-3.18.patch1 | 74 +++++++++++++------
...ly-Queue-Merge-EQM-to-BFQ-v7r7-for-3.18.0.patch | 84 ++++++++++++----------
3 files changed, 100 insertions(+), 62 deletions(-)
diff --git a/5001_block-cgroups-kconfig-build-bits-for-BFQ-v7r6-3.18.patch b/5001_block-cgroups-kconfig-build-bits-for-BFQ-v7r7-3.18.patch
similarity index 97%
rename from 5001_block-cgroups-kconfig-build-bits-for-BFQ-v7r6-3.18.patch
rename to 5001_block-cgroups-kconfig-build-bits-for-BFQ-v7r7-3.18.patch
index 617e934..9f0a7b3 100644
--- a/5001_block-cgroups-kconfig-build-bits-for-BFQ-v7r6-3.18.patch
+++ b/5001_block-cgroups-kconfig-build-bits-for-BFQ-v7r7-3.18.patch
@@ -1,7 +1,7 @@
-From 419f79b0ff5a322c1d0d88a687a207f948c6b2ee Mon Sep 17 00:00:00 2001
+From e5cfe6a861feffa55dda77cd60bdb571fc7c3065 Mon Sep 17 00:00:00 2001
From: Paolo Valente <paolo.valente@unimore.it>
Date: Mon, 8 Dec 2014 16:04:25 +0100
-Subject: [PATCH 1/3] block: cgroups, kconfig, build bits for BFQ-v7r6-3.18
+Subject: [PATCH 1/3] block: cgroups, kconfig, build bits for BFQ-v7r7-3.18
Update Kconfig.iosched and do the related Makefile changes to include
kernel configuration options for BFQ. Also add the bfqio controller
diff --git a/5002_block-introduce-the-BFQ-v7r6-I-O-sched-for-3.18.patch1 b/5002_block-introduce-the-BFQ-v7r7-I-O-sched-for-3.18.patch1
similarity index 99%
rename from 5002_block-introduce-the-BFQ-v7r6-I-O-sched-for-3.18.patch1
rename to 5002_block-introduce-the-BFQ-v7r7-I-O-sched-for-3.18.patch1
index 981e93f..dcd10f7 100644
--- a/5002_block-introduce-the-BFQ-v7r6-I-O-sched-for-3.18.patch1
+++ b/5002_block-introduce-the-BFQ-v7r7-I-O-sched-for-3.18.patch1
@@ -1,9 +1,9 @@
-From 37542f69f6f11019b792c0b60ddc468edd0d5487 Mon Sep 17 00:00:00 2001
+From df04e0bc0d8b72775a74d45e355af9433f8e420e Mon Sep 17 00:00:00 2001
From: Paolo Valente <paolo.valente@unimore.it>
Date: Thu, 9 May 2013 19:10:02 +0200
-Subject: [PATCH 2/3] block: introduce the BFQ-v7r6 I/O sched for 3.18
+Subject: [PATCH 2/3] block: introduce the BFQ-v7r7 I/O sched for 3.18
-Add the BFQ-v7r6 I/O scheduler to 3.18.
+Add the BFQ-v7r7 I/O scheduler to 3.18.
The general structure is borrowed from CFQ, as much of the code for
handling I/O contexts. Over time, several useful features have been
ported from CFQ as well (details in the changelog in README.BFQ). A
@@ -56,12 +56,12 @@ until it expires.
Signed-off-by: Paolo Valente <paolo.valente@unimore.it>
Signed-off-by: Arianna Avanzini <avanzini.arianna@gmail.com>
---
- block/bfq-cgroup.c | 930 ++++++++++++
+ block/bfq-cgroup.c | 936 ++++++++++++
block/bfq-ioc.c | 36 +
- block/bfq-iosched.c | 3887 +++++++++++++++++++++++++++++++++++++++++++++++++++
- block/bfq-sched.c | 1207 ++++++++++++++++
- block/bfq.h | 773 ++++++++++
- 5 files changed, 6833 insertions(+)
+ block/bfq-iosched.c | 3902 +++++++++++++++++++++++++++++++++++++++++++++++++++
+ block/bfq-sched.c | 1214 ++++++++++++++++
+ block/bfq.h | 775 ++++++++++
+ 5 files changed, 6863 insertions(+)
create mode 100644 block/bfq-cgroup.c
create mode 100644 block/bfq-ioc.c
create mode 100644 block/bfq-iosched.c
@@ -70,10 +70,10 @@ Signed-off-by: Arianna Avanzini <avanzini.arianna@gmail.com>
diff --git a/block/bfq-cgroup.c b/block/bfq-cgroup.c
new file mode 100644
-index 0000000..eb140eb
+index 0000000..11e2f1d
--- /dev/null
+++ b/block/bfq-cgroup.c
-@@ -0,0 +1,930 @@
+@@ -0,0 +1,936 @@
+/*
+ * BFQ: CGROUPS support.
+ *
@@ -154,6 +154,12 @@ index 0000000..eb140eb
+ entity->new_weight = bfq_ioprio_to_weight(bgrp->ioprio);
+ entity->new_ioprio = bgrp->ioprio;
+ } else {
++ if (bgrp->weight < BFQ_MIN_WEIGHT ||
++ bgrp->weight > BFQ_MAX_WEIGHT) {
++ printk(KERN_CRIT "bfq_group_init_entity: "
++ "bgrp->weight %d\n", bgrp->weight);
++ BUG();
++ }
+ entity->new_weight = bgrp->weight;
+ entity->new_ioprio = bfq_weight_to_ioprio(bgrp->weight);
+ }
@@ -1048,10 +1054,10 @@ index 0000000..7f6b000
+}
diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c
new file mode 100644
-index 0000000..b919b03
+index 0000000..97ee934
--- /dev/null
+++ b/block/bfq-iosched.c
-@@ -0,0 +1,3887 @@
+@@ -0,0 +1,3902 @@
+/*
+ * Budget Fair Queueing (BFQ) disk scheduler.
+ *
@@ -3730,7 +3736,7 @@ index 0000000..b919b03
+ switch (ioprio_class) {
+ default:
+ dev_err(bfqq->bfqd->queue->backing_dev_info.dev,
-+ "bfq: bad prio %x\n", ioprio_class);
++ "bfq: bad prio class %d\n", ioprio_class);
+ case IOPRIO_CLASS_NONE:
+ /*
+ * No prio set, inherit CPU scheduling settings.
@@ -3753,6 +3759,13 @@ index 0000000..b919b03
+ break;
+ }
+
++ if (bfqq->entity.new_ioprio < 0 ||
++ bfqq->entity.new_ioprio >= IOPRIO_BE_NR) {
++ printk(KERN_CRIT "bfq_init_prio_data: new_ioprio %d\n",
++ bfqq->entity.new_ioprio);
++ BUG();
++ }
++
+ bfqq->entity.ioprio_changed = 1;
+
+ bfq_clear_bfqq_prio_changed(bfqq);
@@ -3869,14 +3882,13 @@ index 0000000..b919b03
+
+ if (bfqq != NULL) {
+ bfq_init_bfqq(bfqd, bfqq, current->pid, is_sync);
++ bfq_init_prio_data(bfqq, bic);
++ bfq_init_entity(&bfqq->entity, bfqg);
+ bfq_log_bfqq(bfqd, bfqq, "allocated");
+ } else {
+ bfqq = &bfqd->oom_bfqq;
+ bfq_log_bfqq(bfqd, bfqq, "using oom bfqq");
+ }
-+
-+ bfq_init_prio_data(bfqq, bic);
-+ bfq_init_entity(&bfqq->entity, bfqg);
+ }
+
+ if (new_bfqq != NULL)
@@ -4533,6 +4545,14 @@ index 0000000..b919b03
+ */
+ bfq_init_bfqq(bfqd, &bfqd->oom_bfqq, 1, 0);
+ atomic_inc(&bfqd->oom_bfqq.ref);
++ bfqd->oom_bfqq.entity.new_ioprio = BFQ_DEFAULT_QUEUE_IOPRIO;
++ bfqd->oom_bfqq.entity.new_ioprio_class = IOPRIO_CLASS_BE;
++ /*
++ * Trigger weight initialization, according to ioprio, at the
++ * oom_bfqq's first activation. The oom_bfqq's ioprio and ioprio
++ * class won't be changed any more.
++ */
++ bfqd->oom_bfqq.entity.ioprio_changed = 1;
+
+ bfqd->queue = q;
+
@@ -4548,6 +4568,7 @@ index 0000000..b919b03
+ }
+
+ bfqd->root_group = bfqg;
++ bfq_init_entity(&bfqd->oom_bfqq.entity, bfqd->root_group);
+#ifdef CONFIG_CGROUP_BFQIO
+ bfqd->active_numerous_groups = 0;
+#endif
@@ -4923,7 +4944,7 @@ index 0000000..b919b03
+ device_speed_thresh[1] = (R_fast[1] + R_slow[1]) / 2;
+
+ elv_register(&iosched_bfq);
-+ pr_info("BFQ I/O-scheduler version: v7r6");
++ pr_info("BFQ I/O-scheduler version: v7r7");
+
+ return 0;
+}
@@ -4941,10 +4962,10 @@ index 0000000..b919b03
+MODULE_LICENSE("GPL");
diff --git a/block/bfq-sched.c b/block/bfq-sched.c
new file mode 100644
-index 0000000..c4831b7
+index 0000000..2931563
--- /dev/null
+++ b/block/bfq-sched.c
-@@ -0,0 +1,1207 @@
+@@ -0,0 +1,1214 @@
+/*
+ * BFQ: Hierarchical B-WF2Q+ scheduler.
+ *
@@ -5573,6 +5594,13 @@ index 0000000..c4831b7
+ old_st->wsum -= entity->weight;
+
+ if (entity->new_weight != entity->orig_weight) {
++ if (entity->new_weight < BFQ_MIN_WEIGHT ||
++ entity->new_weight > BFQ_MAX_WEIGHT) {
++ printk(KERN_CRIT "update_weight_prio: "
++ "new_weight %d\n",
++ entity->new_weight);
++ BUG();
++ }
+ entity->orig_weight = entity->new_weight;
+ entity->ioprio =
+ bfq_weight_to_ioprio(entity->orig_weight);
@@ -6154,12 +6182,12 @@ index 0000000..c4831b7
+}
diff --git a/block/bfq.h b/block/bfq.h
new file mode 100644
-index 0000000..01dcdc4
+index 0000000..649afe9
--- /dev/null
+++ b/block/bfq.h
-@@ -0,0 +1,773 @@
+@@ -0,0 +1,775 @@
+/*
-+ * BFQ-v7r6 for 3.18.0: data structures and common functions prototypes.
++ * BFQ-v7r7 for 3.18.0: data structures and common functions prototypes.
+ *
+ * Based on ideas and code from CFQ:
+ * Copyright (C) 2003 Jens Axboe <axboe@kernel.dk>
@@ -6184,6 +6212,8 @@ index 0000000..01dcdc4
+#define BFQ_MIN_WEIGHT 1
+#define BFQ_MAX_WEIGHT 1000
+
++#define BFQ_DEFAULT_QUEUE_IOPRIO 4
++
+#define BFQ_DEFAULT_GRP_WEIGHT 10
+#define BFQ_DEFAULT_GRP_IOPRIO 0
+#define BFQ_DEFAULT_GRP_CLASS IOPRIO_CLASS_BE
diff --git a/5003_block-bfq-add-Early-Queue-Merge-EQM-to-BFQ-v7r6-for-3.18.0.patch b/5003_block-bfq-add-Early-Queue-Merge-EQM-to-BFQ-v7r7-for-3.18.0.patch
similarity index 94%
rename from 5003_block-bfq-add-Early-Queue-Merge-EQM-to-BFQ-v7r6-for-3.18.0.patch
rename to 5003_block-bfq-add-Early-Queue-Merge-EQM-to-BFQ-v7r7-for-3.18.0.patch
index 5c9a70b..1292c2b 100644
--- a/5003_block-bfq-add-Early-Queue-Merge-EQM-to-BFQ-v7r6-for-3.18.0.patch
+++ b/5003_block-bfq-add-Early-Queue-Merge-EQM-to-BFQ-v7r7-for-3.18.0.patch
@@ -1,7 +1,7 @@
-From 04f637beb4b6801a81894e9918eee5899e5cc5b5 Mon Sep 17 00:00:00 2001
+From b941be79912544b39141eff175bc1964568a5b1b Mon Sep 17 00:00:00 2001
From: Mauro Andreolini <mauro.andreolini@unimore.it>
-Date: Sun, 19 Oct 2014 01:15:59 +0200
-Subject: [PATCH 3/3] block, bfq: add Early Queue Merge (EQM) to BFQ-v7r6 for
+Date: Thu, 18 Dec 2014 21:32:08 +0100
+Subject: [PATCH 3/3] block, bfq: add Early Queue Merge (EQM) to BFQ-v7r7 for
3.18.0
A set of processes may happen to perform interleaved reads, i.e.,requests
@@ -27,20 +27,20 @@ EQM is then simpler and more compact than the pair of mechanisms used in
CFQ.
Finally, EQM also preserves the typical low-latency properties of BFQ, by
-properly restoring the weight-raising state of a queue when it gets back to
+properly restoring the weight-raising state of a queue when it gets back to
a non-merged state.
Signed-off-by: Mauro Andreolini <mauro.andreolini@unimore.it>
Signed-off-by: Arianna Avanzini <avanzini.arianna@gmail.com>
Signed-off-by: Paolo Valente <paolo.valente@unimore.it>
---
- block/bfq-iosched.c | 743 +++++++++++++++++++++++++++++++++++++---------------
+ block/bfq-iosched.c | 751 +++++++++++++++++++++++++++++++++++++---------------
block/bfq-sched.c | 28 --
block/bfq.h | 54 +++-
- 3 files changed, 573 insertions(+), 252 deletions(-)
+ 3 files changed, 581 insertions(+), 252 deletions(-)
diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c
-index b919b03..bbfb4e1 100644
+index 97ee934..328f33c 100644
--- a/block/bfq-iosched.c
+++ b/block/bfq-iosched.c
@@ -571,6 +571,57 @@ static inline unsigned int bfq_wr_duration(struct bfq_data *bfqd)
@@ -349,7 +349,7 @@ index b919b03..bbfb4e1 100644
if (bfqq == NULL || bfqq == cur_bfqq)
return NULL;
-@@ -1332,6 +1337,307 @@ static struct bfq_queue *bfq_close_cooperator(struct bfq_data *bfqd,
+@@ -1332,6 +1337,315 @@ static struct bfq_queue *bfq_close_cooperator(struct bfq_data *bfqd,
return bfqq;
}
@@ -419,6 +419,13 @@ index b919b03..bbfb4e1 100644
+ * or with a close queue among the scheduled queues.
+ * Return NULL if no merge was scheduled, a pointer to the shared bfq_queue
+ * structure otherwise.
++ *
++ * The OOM queue is not allowed to participate to cooperation: in fact, since
++ * the requests temporarily redirected to the OOM queue could be redirected
++ * again to dedicated queues at any time, the state needed to correctly
++ * handle merging with the OOM queue would be quite complex and expensive
++ * to maintain. Besides, in such a critical condition as an out of memory,
++ * the benefits of queue merging may be little relevant, or even negligible.
+ */
+static struct bfq_queue *
+bfq_setup_cooperator(struct bfq_data *bfqd, struct bfq_queue *bfqq,
@@ -429,13 +436,14 @@ index b919b03..bbfb4e1 100644
+ if (bfqq->new_bfqq)
+ return bfqq->new_bfqq;
+
-+ if (!io_struct)
++ if (!io_struct || unlikely(bfqq == &bfqd->oom_bfqq))
+ return NULL;
+
+ in_service_bfqq = bfqd->in_service_queue;
+
+ if (in_service_bfqq == NULL || in_service_bfqq == bfqq ||
-+ !bfqd->in_service_bic)
++ !bfqd->in_service_bic ||
++ unlikely(in_service_bfqq == &bfqd->oom_bfqq))
+ goto check_scheduled;
+
+ if (bfq_class_idle(in_service_bfqq) || bfq_class_idle(bfqq))
@@ -462,7 +470,7 @@ index b919b03..bbfb4e1 100644
+check_scheduled:
+ new_bfqq = bfq_close_cooperator(bfqd, bfqq,
+ bfq_io_struct_pos(io_struct, request));
-+ if (new_bfqq)
++ if (new_bfqq && likely(new_bfqq != &bfqd->oom_bfqq))
+ return bfq_setup_merge(bfqq, new_bfqq);
+
+ return NULL;
@@ -657,7 +665,7 @@ index b919b03..bbfb4e1 100644
/*
* If enough samples have been computed, return the current max budget
* stored in bfqd, which is dynamically updated according to the
-@@ -1475,61 +1781,6 @@ static struct request *bfq_check_fifo(struct bfq_queue *bfqq)
+@@ -1475,61 +1789,6 @@ static struct request *bfq_check_fifo(struct bfq_queue *bfqq)
return rq;
}
@@ -719,7 +727,7 @@ index b919b03..bbfb4e1 100644
static inline unsigned long bfq_bfqq_budget_left(struct bfq_queue *bfqq)
{
struct bfq_entity *entity = &bfqq->entity;
-@@ -2263,7 +2514,7 @@ static inline bool bfq_bfqq_must_idle(struct bfq_queue *bfqq)
+@@ -2263,7 +2522,7 @@ static inline bool bfq_bfqq_must_idle(struct bfq_queue *bfqq)
*/
static struct bfq_queue *bfq_select_queue(struct bfq_data *bfqd)
{
@@ -728,7 +736,7 @@ index b919b03..bbfb4e1 100644
struct request *next_rq;
enum bfqq_expiration reason = BFQ_BFQQ_BUDGET_TIMEOUT;
-@@ -2273,17 +2524,6 @@ static struct bfq_queue *bfq_select_queue(struct bfq_data *bfqd)
+@@ -2273,17 +2532,6 @@ static struct bfq_queue *bfq_select_queue(struct bfq_data *bfqd)
bfq_log_bfqq(bfqd, bfqq, "select_queue: already in-service queue");
@@ -746,7 +754,7 @@ index b919b03..bbfb4e1 100644
if (bfq_may_expire_for_budg_timeout(bfqq) &&
!timer_pending(&bfqd->idle_slice_timer) &&
!bfq_bfqq_must_idle(bfqq))
-@@ -2322,10 +2562,7 @@ static struct bfq_queue *bfq_select_queue(struct bfq_data *bfqd)
+@@ -2322,10 +2570,7 @@ static struct bfq_queue *bfq_select_queue(struct bfq_data *bfqd)
bfq_clear_bfqq_wait_request(bfqq);
del_timer(&bfqd->idle_slice_timer);
}
@@ -758,7 +766,7 @@ index b919b03..bbfb4e1 100644
}
}
-@@ -2334,40 +2571,30 @@ static struct bfq_queue *bfq_select_queue(struct bfq_data *bfqd)
+@@ -2334,40 +2579,30 @@ static struct bfq_queue *bfq_select_queue(struct bfq_data *bfqd)
* in flight (possibly waiting for a completion) or is idling for a
* new request, then keep it.
*/
@@ -806,7 +814,7 @@ index b919b03..bbfb4e1 100644
jiffies_to_msecs(bfqq->wr_cur_max_time),
bfqq->wr_coeff,
bfqq->entity.weight, bfqq->entity.orig_weight);
-@@ -2376,12 +2603,16 @@ static void bfq_update_wr_data(struct bfq_data *bfqd,
+@@ -2376,12 +2611,16 @@ static void bfq_update_wr_data(struct bfq_data *bfqd,
entity->orig_weight * bfqq->wr_coeff);
if (entity->ioprio_changed)
bfq_log_bfqq(bfqd, bfqq, "WARN: pending prio change");
@@ -824,7 +832,7 @@ index b919b03..bbfb4e1 100644
time_is_before_jiffies(bfqq->last_wr_start_finish +
bfqq->wr_cur_max_time)) {
bfqq->last_wr_start_finish = jiffies;
-@@ -2390,11 +2621,13 @@ static void bfq_update_wr_data(struct bfq_data *bfqd,
+@@ -2390,11 +2629,13 @@ static void bfq_update_wr_data(struct bfq_data *bfqd,
bfqq->last_wr_start_finish,
jiffies_to_msecs(bfqq->wr_cur_max_time));
bfq_bfqq_end_wr(bfqq);
@@ -841,7 +849,7 @@ index b919b03..bbfb4e1 100644
}
/*
-@@ -2642,6 +2875,25 @@ static inline void bfq_init_icq(struct io_cq *icq)
+@@ -2642,6 +2883,25 @@ static inline void bfq_init_icq(struct io_cq *icq)
struct bfq_io_cq *bic = icq_to_bic(icq);
bic->ttime.last_end_request = jiffies;
@@ -867,7 +875,7 @@ index b919b03..bbfb4e1 100644
}
static void bfq_exit_icq(struct io_cq *icq)
-@@ -2655,6 +2907,13 @@ static void bfq_exit_icq(struct io_cq *icq)
+@@ -2655,6 +2915,13 @@ static void bfq_exit_icq(struct io_cq *icq)
}
if (bic->bfqq[BLK_RW_SYNC]) {
@@ -881,7 +889,7 @@ index b919b03..bbfb4e1 100644
bfq_exit_bfqq(bfqd, bic->bfqq[BLK_RW_SYNC]);
bic->bfqq[BLK_RW_SYNC] = NULL;
}
-@@ -2944,6 +3203,10 @@ static void bfq_update_idle_window(struct bfq_data *bfqd,
+@@ -2950,6 +3217,10 @@ static void bfq_update_idle_window(struct bfq_data *bfqd,
if (!bfq_bfqq_sync(bfqq) || bfq_class_idle(bfqq))
return;
@@ -892,7 +900,7 @@ index b919b03..bbfb4e1 100644
enable_idle = bfq_bfqq_idle_window(bfqq);
if (atomic_read(&bic->icq.ioc->active_ref) == 0 ||
-@@ -2991,6 +3254,7 @@ static void bfq_rq_enqueued(struct bfq_data *bfqd, struct bfq_queue *bfqq,
+@@ -2997,6 +3268,7 @@ static void bfq_rq_enqueued(struct bfq_data *bfqd, struct bfq_queue *bfqq,
if (bfqq->entity.service > bfq_max_budget(bfqd) / 8 ||
!BFQQ_SEEKY(bfqq))
bfq_update_idle_window(bfqd, bfqq, bic);
@@ -900,7 +908,7 @@ index b919b03..bbfb4e1 100644
bfq_log_bfqq(bfqd, bfqq,
"rq_enqueued: idle_window=%d (seeky %d, mean %llu)",
-@@ -3051,13 +3315,49 @@ static void bfq_rq_enqueued(struct bfq_data *bfqd, struct bfq_queue *bfqq,
+@@ -3057,13 +3329,49 @@ static void bfq_rq_enqueued(struct bfq_data *bfqd, struct bfq_queue *bfqq,
static void bfq_insert_request(struct request_queue *q, struct request *rq)
{
struct bfq_data *bfqd = q->elevator->elevator_data;
@@ -951,7 +959,7 @@ index b919b03..bbfb4e1 100644
rq->fifo_time = jiffies + bfqd->bfq_fifo_expire[rq_is_sync(rq)];
list_add_tail(&rq->queuelist, &bfqq->fifo);
-@@ -3222,18 +3522,6 @@ static void bfq_put_request(struct request *rq)
+@@ -3228,18 +3536,6 @@ static void bfq_put_request(struct request *rq)
}
}
@@ -970,7 +978,7 @@ index b919b03..bbfb4e1 100644
/*
* Returns NULL if a new bfqq should be allocated, or the old bfqq if this
* was the last process referring to said bfqq.
-@@ -3242,6 +3530,9 @@ static struct bfq_queue *
+@@ -3248,6 +3544,9 @@ static struct bfq_queue *
bfq_split_bfqq(struct bfq_io_cq *bic, struct bfq_queue *bfqq)
{
bfq_log_bfqq(bfqq->bfqd, bfqq, "splitting queue");
@@ -980,7 +988,7 @@ index b919b03..bbfb4e1 100644
if (bfqq_process_refs(bfqq) == 1) {
bfqq->pid = current->pid;
bfq_clear_bfqq_coop(bfqq);
-@@ -3270,6 +3561,7 @@ static int bfq_set_request(struct request_queue *q, struct request *rq,
+@@ -3276,6 +3575,7 @@ static int bfq_set_request(struct request_queue *q, struct request *rq,
struct bfq_queue *bfqq;
struct bfq_group *bfqg;
unsigned long flags;
@@ -988,7 +996,7 @@ index b919b03..bbfb4e1 100644
might_sleep_if(gfp_mask & __GFP_WAIT);
-@@ -3287,25 +3579,26 @@ new_queue:
+@@ -3293,25 +3593,26 @@ new_queue:
if (bfqq == NULL || bfqq == &bfqd->oom_bfqq) {
bfqq = bfq_get_queue(bfqd, bfqg, is_sync, bic, gfp_mask);
bic_set_bfqq(bic, bfqq, is_sync);
@@ -1027,7 +1035,7 @@ index b919b03..bbfb4e1 100644
}
bfqq->allocated[rw]++;
-@@ -3316,6 +3609,26 @@ new_queue:
+@@ -3322,6 +3623,26 @@ new_queue:
rq->elv.priv[0] = bic;
rq->elv.priv[1] = bfqq;
@@ -1038,7 +1046,7 @@ index b919b03..bbfb4e1 100644
+ * queue has just been split, mark a flag so that the
+ * information is available to the other scheduler hooks.
+ */
-+ if (bfqq_process_refs(bfqq) == 1) {
++ if (likely(bfqq != &bfqd->oom_bfqq) && bfqq_process_refs(bfqq) == 1) {
+ bfqq->bic = bic;
+ if (split) {
+ bfq_mark_bfqq_just_split(bfqq);
@@ -1055,10 +1063,10 @@ index b919b03..bbfb4e1 100644
return 0;
diff --git a/block/bfq-sched.c b/block/bfq-sched.c
-index c4831b7..546a254 100644
+index 2931563..6764a7e 100644
--- a/block/bfq-sched.c
+++ b/block/bfq-sched.c
-@@ -1084,34 +1084,6 @@ static struct bfq_queue *bfq_get_next_queue(struct bfq_data *bfqd)
+@@ -1091,34 +1091,6 @@ static struct bfq_queue *bfq_get_next_queue(struct bfq_data *bfqd)
return bfqq;
}
@@ -1094,10 +1102,10 @@ index c4831b7..546a254 100644
{
if (bfqd->in_service_bic != NULL) {
diff --git a/block/bfq.h b/block/bfq.h
-index 01dcdc4..a193a56 100644
+index 649afe9..0767d75 100644
--- a/block/bfq.h
+++ b/block/bfq.h
-@@ -216,18 +216,21 @@ struct bfq_group;
+@@ -218,18 +218,21 @@ struct bfq_group;
* idle @bfq_queue with no outstanding requests, then
* the task associated with the queue it is deemed as
* soft real-time (see the comments to the function
@@ -1125,7 +1133,7 @@ index 01dcdc4..a193a56 100644
* All the fields are protected by the queue lock of the containing bfqd.
*/
struct bfq_queue {
-@@ -267,6 +270,7 @@ struct bfq_queue {
+@@ -269,6 +272,7 @@ struct bfq_queue {
unsigned int requests_within_timer;
pid_t pid;
@@ -1133,7 +1141,7 @@ index 01dcdc4..a193a56 100644
/* weight-raising fields */
unsigned long wr_cur_max_time;
-@@ -296,12 +300,42 @@ struct bfq_ttime {
+@@ -298,12 +302,42 @@ struct bfq_ttime {
* @icq: associated io_cq structure
* @bfqq: array of two process queues, the sync and the async
* @ttime: associated @bfq_ttime struct
@@ -1176,7 +1184,7 @@ index 01dcdc4..a193a56 100644
};
enum bfq_device_speed {
-@@ -537,7 +571,7 @@ enum bfqq_state_flags {
+@@ -539,7 +573,7 @@ enum bfqq_state_flags {
BFQ_BFQQ_FLAG_prio_changed, /* task priority has changed */
BFQ_BFQQ_FLAG_sync, /* synchronous queue */
BFQ_BFQQ_FLAG_budget_new, /* no completion with this budget */
@@ -1185,7 +1193,7 @@ index 01dcdc4..a193a56 100644
* bfqq has timed-out at least once
* having consumed at most 2/10 of
* its budget
-@@ -550,12 +584,13 @@ enum bfqq_state_flags {
+@@ -552,12 +586,13 @@ enum bfqq_state_flags {
* bfqq has proved to be slow and
* seeky until budget timeout
*/
@@ -1201,7 +1209,7 @@ index 01dcdc4..a193a56 100644
};
#define BFQ_BFQQ_FNS(name) \
-@@ -585,6 +620,7 @@ BFQ_BFQQ_FNS(in_large_burst);
+@@ -587,6 +622,7 @@ BFQ_BFQQ_FNS(in_large_burst);
BFQ_BFQQ_FNS(constantly_seeky);
BFQ_BFQQ_FNS(coop);
BFQ_BFQQ_FNS(split_coop);
^ permalink raw reply related [flat|nested] 67+ messages in thread
* [gentoo-commits] proj/linux-patches:3.18 commit in: /
@ 2015-01-02 19:06 Mike Pagano
0 siblings, 0 replies; 67+ messages in thread
From: Mike Pagano @ 2015-01-02 19:06 UTC (permalink / raw
To: gentoo-commits
commit: bcf85145e9c6f5580f132709daa1d5cfe4f85452
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Fri Jan 2 19:06:37 2015 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Fri Jan 2 19:06:37 2015 +0000
URL: http://sources.gentoo.org/gitweb/?p=proj/linux-patches.git;a=commit;h=bcf85145
Add DEVPTS_MULTIPLE_INSTANCES when GENTOO_LINUX_INIT_SYSTEMD is selected. See bug #534216
---
4567_distro-Gentoo-Kconfig.patch | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/4567_distro-Gentoo-Kconfig.patch b/4567_distro-Gentoo-Kconfig.patch
index 652e2a7..690454a 100644
--- a/4567_distro-Gentoo-Kconfig.patch
+++ b/4567_distro-Gentoo-Kconfig.patch
@@ -7,9 +7,9 @@
+source "distro/Kconfig"
+
source "arch/$SRCARCH/Kconfig"
---- 1969-12-31 19:00:00.000000000 -0500
-+++ b/distro/Kconfig 2014-04-02 09:57:03.539218861 -0400
-@@ -0,0 +1,108 @@
+--- a/distro/Kconfig 1969-12-31 19:00:00.000000000 -0500
++++ b/distro/Kconfig 2015-01-02 13:54:45.589830665 -0500
+@@ -0,0 +1,109 @@
+menu "Gentoo Linux"
+
+config GENTOO_LINUX
@@ -87,6 +87,7 @@
+ select AUTOFS4_FS
+ select BLK_DEV_BSG
+ select CGROUPS
++ select DEVPTS_MULTIPLE_INSTANCES
+ select EPOLL
+ select FANOTIFY
+ select FHANDLE
^ permalink raw reply related [flat|nested] 67+ messages in thread
* [gentoo-commits] proj/linux-patches:3.18 commit in: /
@ 2015-01-04 19:03 Mike Pagano
0 siblings, 0 replies; 67+ messages in thread
From: Mike Pagano @ 2015-01-04 19:03 UTC (permalink / raw
To: gentoo-commits
commit: 18a149bb135ad1bc6d336cdabfbd819e2cb7436f
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Sun Jan 4 19:03:48 2015 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Sun Jan 4 19:03:48 2015 +0000
URL: http://sources.gentoo.org/gitweb/?p=proj/linux-patches.git;a=commit;h=18a149bb
drm/i915: Patch to disallow pin ioctl completely for kms drivers. See bug #532926
---
0000_README | 16 +++--
...15-drm-disallow-pin-ioctl-for-kms-drivers.patch | 76 ++++++++++++++++++++++
2 files changed, 86 insertions(+), 6 deletions(-)
diff --git a/0000_README b/0000_README
index f79b1b4..62aec14 100644
--- a/0000_README
+++ b/0000_README
@@ -63,6 +63,10 @@ Patch: 2905_s2disk-resume-image-fix.patch
From: Al Viro <viro <at> ZenIV.linux.org.uk>
Desc: Do not lock when UMH is waiting on current thread spawned by linuxrc. (bug #481344)
+Patch: 2710_i915-drm-disallow-pin-ioctl-for-kms-drivers.patch
+From: http://www.kernel.org
+Desc: drm/i915: Patch to disallow pin ioctl completely for kms drivers. See bug #532926
+
Patch: 4200_fbcondecor-3.16.patch
From: http://www.mepiscommunity.org/fbcondecor
Desc: Bootsplash ported by Uladzimir Bely (bug #513334)
@@ -75,14 +79,14 @@ Patch: 5000_enable-additional-cpu-optimizations-for-gcc.patch
From: https://github.com/graysky2/kernel_gcc_patch/
Desc: Kernel patch enables gcc optimizations for additional CPUs.
-Patch: 5001_block-cgroups-kconfig-build-bits-for-BFQ-v7r6-3.18.patch
+Patch: 5001_block-cgroups-kconfig-build-bits-for-BFQ-v7r7-3.18.patch
From: http://algo.ing.unimo.it/people/paolo/disk_sched/
-Desc: BFQ v7r6 patch 1 for 3.17: Build, cgroups and kconfig bits
+Desc: BFQ v7r7 patch 1 for 3.17: Build, cgroups and kconfig bits
-Patch: 5002_block-introduce-the-BFQ-v7r6-I-O-sched-for-3.18.patch1
+Patch: 5002_block-introduce-the-BFQ-v7r7-I-O-sched-for-3.18.patch1
From: http://algo.ing.unimo.it/people/paolo/disk_sched/
-Desc: BFQ v7r6 patch 2 for 3.17: BFQ Scheduler
+Desc: BFQ v7r7 patch 2 for 3.17: BFQ Scheduler
-Patch: 5003_block-bfq-add-Early-Queue-Merge-EQM-to-BFQ-v7r6-for-3.18.0.patch
+Patch: 5003_block-bfq-add-Early-Queue-Merge-EQM-to-BFQ-v7r7-for-3.18.0.patch
From: http://algo.ing.unimo.it/people/paolo/disk_sched/
-Desc: BFQ v7r6 patch 3 for 3.17: Early Queue Merge (EQM)
+Desc: BFQ v7r7 patch 3 for 3.17: Early Queue Merge (EQM)
diff --git a/2710_i915-drm-disallow-pin-ioctl-for-kms-drivers.patch b/2710_i915-drm-disallow-pin-ioctl-for-kms-drivers.patch
new file mode 100644
index 0000000..f298aa4
--- /dev/null
+++ b/2710_i915-drm-disallow-pin-ioctl-for-kms-drivers.patch
@@ -0,0 +1,76 @@
+From d472fcc8379c062bd56a3876fc6ef22258f14a91 Mon Sep 17 00:00:00 2001
+From: Daniel Vetter <daniel.vetter@ffwll.ch>
+Date: Mon, 24 Nov 2014 11:12:42 +0100
+Subject: drm/i915: Disallow pin ioctl completely for kms drivers
+
+The problem here is that SNA pins batchbuffers to etch out a bit more
+performance. Iirc it started out as a w/a for i830M (which we've
+implemented in the kernel since a long time already). The problem is
+that the pin ioctl wasn't added in
+
+commit d23db88c3ab233daed18709e3a24d6c95344117f
+Author: Chris Wilson <chris@chris-wilson.co.uk>
+Date: Fri May 23 08:48:08 2014 +0200
+
+ drm/i915: Prevent negative relocation deltas from wrapping
+
+Fix this by simply disallowing pinning from userspace so that the
+kernel is in full control of batch placement again. Especially since
+distros are moving towards running X as non-root, so most users won't
+even be able to see any benefits.
+
+UMS support is dead now, but we need this minimal patch for
+backporting. Follow-up patch will remove the pin ioctl code
+completely.
+
+Note to backporters: You must have both
+
+commit b45305fce5bb1abec263fcff9d81ebecd6306ede
+Author: Daniel Vetter <daniel.vetter@ffwll.ch>
+Date: Mon Dec 17 16:21:27 2012 +0100
+
+ drm/i915: Implement workaround for broken CS tlb on i830/845
+
+which laned in 3.8 and
+
+commit c4d69da167fa967749aeb70bc0e94a457e5d00c1
+Author: Chris Wilson <chris@chris-wilson.co.uk>
+Date: Mon Sep 8 14:25:41 2014 +0100
+
+ drm/i915: Evict CS TLBs between batches
+
+which is also marked cc: stable. Otherwise this could introduce a
+regression by disabling the userspace w/a without the kernel w/a being
+fully functional on i830/45.
+
+References: https://bugs.freedesktop.org/show_bug.cgi?id=76554#c116
+Cc: stable@vger.kernel.org # requires c4d69da167fa967749a and v3.8
+Cc: Chris Wilson <chris@chris-wilson.co.uk>
+Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
+
+diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
+index fd17cca..97b86a5 100644
+--- a/drivers/gpu/drm/i915/i915_gem.c
++++ b/drivers/gpu/drm/i915/i915_gem.c
+@@ -4263,7 +4263,7 @@ i915_gem_pin_ioctl(struct drm_device *dev, void *data,
+ struct drm_i915_gem_object *obj;
+ int ret;
+
+- if (INTEL_INFO(dev)->gen >= 6)
++ if (drm_core_check_feature(dev, DRIVER_MODESET))
+ return -ENODEV;
+
+ ret = i915_mutex_lock_interruptible(dev);
+@@ -4319,6 +4319,9 @@ i915_gem_unpin_ioctl(struct drm_device *dev, void *data,
+ struct drm_i915_gem_object *obj;
+ int ret;
+
++ if (drm_core_check_feature(dev, DRIVER_MODESET))
++ return -ENODEV;
++
+ ret = i915_mutex_lock_interruptible(dev);
+ if (ret)
+ return ret;
+--
+cgit v0.10.2
+
^ permalink raw reply related [flat|nested] 67+ messages in thread
* [gentoo-commits] proj/linux-patches:3.18 commit in: /
@ 2015-01-05 14:39 Mike Pagano
0 siblings, 0 replies; 67+ messages in thread
From: Mike Pagano @ 2015-01-05 14:39 UTC (permalink / raw
To: gentoo-commits
commit: ae97d6689a4fcf0ff3e20635be00684011c17fe7
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Mon Jan 5 14:38:56 2015 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Mon Jan 5 14:38:56 2015 +0000
URL: http://sources.gentoo.org/gitweb/?p=proj/linux-patches.git;a=commit;h=ae97d668
ARM: dts: Add support for Pogoplug E02.
---
0000_README | 4 +
1700_ARM-dts-patch-to-support-popoplug-e02.patch | 132 +++++++++++++++++++++++
2 files changed, 136 insertions(+)
diff --git a/0000_README b/0000_README
index 62aec14..e650125 100644
--- a/0000_README
+++ b/0000_README
@@ -51,6 +51,10 @@ Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
+Patch: 1700_ARM-dts-patch-to-support-popoplug-e02.patch
+From: https://bugs.gentoo.org/show_bug.cgi?id=508248
+Desc: ARM: dts: Add support for Pogoplug E02.
+
Patch: 2700_ThinkPad-30-brightness-control-fix.patch
From: Seth Forshee <seth.forshee@canonical.com>
Desc: ACPI: Disable Windows 8 compatibility for some Lenovo ThinkPads.
diff --git a/1700_ARM-dts-patch-to-support-popoplug-e02.patch b/1700_ARM-dts-patch-to-support-popoplug-e02.patch
new file mode 100644
index 0000000..ceaa99d
--- /dev/null
+++ b/1700_ARM-dts-patch-to-support-popoplug-e02.patch
@@ -0,0 +1,132 @@
+diff -uprN a/arch/arm/boot/dts/kirkwood-pogo_e02.dts b/arch/arm/boot/dts/kirkwood-pogo_e02.dts
+--- a/arch/arm/boot/dts/kirkwood-pogo_e02.dts 1969-12-31 17:00:00.000000000 -0700
++++ b/arch/arm/boot/dts/kirkwood-pogo_e02.dts 2014-08-10 03:59:10.616338535 -0600
+@@ -0,0 +1,117 @@
++/dts-v1/;
++
++#include "kirkwood.dtsi"
++#include "kirkwood-6281.dtsi"
++
++/ {
++ model = "CloudEngines Pogoplug E02";
++ compatible = "cloudengines,pogo_e02", "marvell,kirkwood-88f6281", "marvell,kirkwood";
++
++ memory {
++ device_type = "memory";
++ reg = <0x00000000 0x10000000>;
++ };
++
++ chosen {
++ bootargs = "console=ttyS0,115200n8 earlyprintk root=/dev/sda1 rootdelay=10";
++ stdout-path = &uart0;
++ };
++
++ ocp@f1000000 {
++ pinctrl: pin-controller@10000 {
++ pmx_usb_power_enable: pmx-usb-power-enable {
++ marvell,pins = "mpp29";
++ marvell,function = "gpio";
++ };
++ pmx_led_green: pmx-led_green {
++ marvell,pins = "mpp48";
++ marvell,function = "gpio";
++ };
++ pmx_led_orange: pmx-led_orange {
++ marvell,pins = "mpp49";
++ marvell,function = "gpio";
++ };
++ };
++ serial@12000 {
++ status = "ok";
++ };
++
++ };
++ gpio-leds {
++ compatible = "gpio-leds";
++ pinctrl-0 = < &pmx_led_orange
++ &pmx_led_green
++ >;
++ pinctrl-names = "default";
++
++ health {
++ label = "status:green:health";
++ gpios = <&gpio1 16 GPIO_ACTIVE_LOW>;
++ default-state = "keep";
++ };
++ fault {
++ label = "status:orange:fault";
++ gpios = <&gpio1 17 GPIO_ACTIVE_LOW>;
++ };
++ };
++ regulators {
++ compatible = "simple-bus";
++ #address-cells = <1>;
++ #size-cells = <0>;
++ pinctrl-0 = <&pmx_usb_power_enable>;
++ pinctrl-names = "default";
++
++ usb_power: regulator@1 {
++ compatible = "regulator-fixed";
++ reg = <1>;
++ regulator-name = "USB Power";
++ regulator-min-microvolt = <5000000>;
++ regulator-max-microvolt = <5000000>;
++ enable-active-high;
++ regulator-always-on;
++ regulator-boot-on;
++ gpio = <&gpio0 29 GPIO_ACTIVE_HIGH>;
++ };
++ };
++};
++
++&nand {
++ chip-delay = <25>;
++ status = "okay";
++
++ partition@0 {
++ label = "u-boot";
++ reg = <0x0000000 0x100000>;
++ read-only;
++ };
++
++ partition@100000 {
++ label = "uImage";
++ reg = <0x0100000 0x0500000>;
++ };
++
++ partition@0500000 {
++ label = "pogoplug";
++ reg = <0x0500000 0x2500000>;
++ };
++
++ partition@2500000 {
++ label = "root";
++ reg = <0x2500000 0x6c00000>;
++ };
++};
++
++&mdio {
++ status = "okay";
++
++ ethphy0: ethernet-phy@0 {
++ reg = <0>;
++ };
++};
++
++ð0 {
++ status = "okay";
++ ethernet0-port@0 {
++ phy-handle = <ðphy0>;
++ };
++};
+diff -uprN a/arch/arm/boot/dts/Makefile b/arch/arm/boot/dts/Makefile
+--- a/arch/arm/boot/dts/Makefile 2014-08-10 03:54:22.764885366 -0600
++++ b/arch/arm/boot/dts/Makefile 2014-08-10 04:00:43.570037020 -0600
+@@ -137,6 +137,7 @@ kirkwood := \
+ kirkwood-openrd-base.dtb \
+ kirkwood-openrd-client.dtb \
+ kirkwood-openrd-ultimate.dtb \
++ kirkwood-pogo_e02.dtb \
+ kirkwood-rd88f6192.dtb \
+ kirkwood-rd88f6281-a0.dtb \
+ kirkwood-rd88f6281-a1.dtb \
^ permalink raw reply related [flat|nested] 67+ messages in thread
* [gentoo-commits] proj/linux-patches:3.18 commit in: /
@ 2015-01-09 13:39 Mike Pagano
0 siblings, 0 replies; 67+ messages in thread
From: Mike Pagano @ 2015-01-09 13:39 UTC (permalink / raw
To: gentoo-commits
commit: 9075c0bbea7faa9ff0732c954490c3e7658b90d7
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Fri Jan 9 13:39:42 2015 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Fri Jan 9 13:39:42 2015 +0000
URL: http://sources.gentoo.org/gitweb/?p=proj/linux-patches.git;a=commit;h=9075c0bb
Linux patch 3.18.2
---
0000_README | 4 +
1001_linux-3.18.2.patch | 3472 +++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 3476 insertions(+)
diff --git a/0000_README b/0000_README
index e650125..3b11b74 100644
--- a/0000_README
+++ b/0000_README
@@ -47,6 +47,10 @@ Patch: 1000_linux-3.18.1.patch
From: http://www.kernel.org
Desc: Linux 3.18.1
+Patch: 1001_linux-3.18.2.patch
+From: http://www.kernel.org
+Desc: Linux 3.18.2
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1001_linux-3.18.2.patch b/1001_linux-3.18.2.patch
new file mode 100644
index 0000000..6086fd1
--- /dev/null
+++ b/1001_linux-3.18.2.patch
@@ -0,0 +1,3472 @@
+diff --git a/Makefile b/Makefile
+index 3f84029f2b31..8f73b417dc1a 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 18
+-SUBLEVEL = 1
++SUBLEVEL = 2
+ EXTRAVERSION =
+ NAME = Diseased Newt
+
+diff --git a/arch/arm/boot/dts/armada-370-db.dts b/arch/arm/boot/dts/armada-370-db.dts
+index a495e5821ab8..d5051358fb1b 100644
+--- a/arch/arm/boot/dts/armada-370-db.dts
++++ b/arch/arm/boot/dts/armada-370-db.dts
+@@ -102,30 +102,6 @@
+ broken-cd;
+ };
+
+- pinctrl {
+- /*
+- * These pins might be muxed as I2S by
+- * the bootloader, but it conflicts
+- * with the real I2S pins that are
+- * muxed using i2s_pins. We must mux
+- * those pins to a function other than
+- * I2S.
+- */
+- pinctrl-0 = <&hog_pins1 &hog_pins2>;
+- pinctrl-names = "default";
+-
+- hog_pins1: hog-pins1 {
+- marvell,pins = "mpp6", "mpp8", "mpp10",
+- "mpp12", "mpp13";
+- marvell,function = "gpio";
+- };
+-
+- hog_pins2: hog-pins2 {
+- marvell,pins = "mpp5", "mpp7", "mpp9";
+- marvell,function = "gpo";
+- };
+- };
+-
+ usb@50000 {
+ status = "okay";
+ };
+diff --git a/arch/arm/boot/dts/armada-370.dtsi b/arch/arm/boot/dts/armada-370.dtsi
+index 6b3c23b1e138..7513410f7b89 100644
+--- a/arch/arm/boot/dts/armada-370.dtsi
++++ b/arch/arm/boot/dts/armada-370.dtsi
+@@ -106,11 +106,6 @@
+ reg = <0x11100 0x20>;
+ };
+
+- system-controller@18200 {
+- compatible = "marvell,armada-370-xp-system-controller";
+- reg = <0x18200 0x100>;
+- };
+-
+ pinctrl {
+ compatible = "marvell,mv88f6710-pinctrl";
+ reg = <0x18000 0x38>;
+@@ -205,6 +200,11 @@
+ interrupts = <91>;
+ };
+
++ system-controller@18200 {
++ compatible = "marvell,armada-370-xp-system-controller";
++ reg = <0x18200 0x100>;
++ };
++
+ gateclk: clock-gating-control@18220 {
+ compatible = "marvell,armada-370-gating-clock";
+ reg = <0x18220 0x4>;
+diff --git a/arch/arm/include/asm/arch_timer.h b/arch/arm/include/asm/arch_timer.h
+index 92793ba69c40..d4ebf5679f1f 100644
+--- a/arch/arm/include/asm/arch_timer.h
++++ b/arch/arm/include/asm/arch_timer.h
+@@ -78,6 +78,15 @@ static inline u32 arch_timer_get_cntfrq(void)
+ return val;
+ }
+
++static inline u64 arch_counter_get_cntpct(void)
++{
++ u64 cval;
++
++ isb();
++ asm volatile("mrrc p15, 0, %Q0, %R0, c14" : "=r" (cval));
++ return cval;
++}
++
+ static inline u64 arch_counter_get_cntvct(void)
+ {
+ u64 cval;
+diff --git a/arch/arm/mach-mvebu/coherency.c b/arch/arm/mach-mvebu/coherency.c
+index 044b51185fcc..c31f4c00b1fc 100644
+--- a/arch/arm/mach-mvebu/coherency.c
++++ b/arch/arm/mach-mvebu/coherency.c
+@@ -361,25 +361,41 @@ static int coherency_type(void)
+ {
+ struct device_node *np;
+ const struct of_device_id *match;
++ int type;
+
+- np = of_find_matching_node_and_match(NULL, of_coherency_table, &match);
+- if (np) {
+- int type = (int) match->data;
++ /*
++ * The coherency fabric is needed:
++ * - For coherency between processors on Armada XP, so only
++ * when SMP is enabled.
++ * - For coherency between the processor and I/O devices, but
++ * this coherency requires many pre-requisites (write
++ * allocate cache policy, shareable pages, SMP bit set) that
++ * are only meant in SMP situations.
++ *
++ * Note that this means that on Armada 370, there is currently
++ * no way to use hardware I/O coherency, because even when
++ * CONFIG_SMP is enabled, is_smp() returns false due to the
++ * Armada 370 being a single-core processor. To lift this
++ * limitation, we would have to find a way to make the cache
++ * policy set to write-allocate (on all Armada SoCs), and to
++ * set the shareable attribute in page tables (on all Armada
++ * SoCs except the Armada 370). Unfortunately, such decisions
++ * are taken very early in the kernel boot process, at a point
++ * where we don't know yet on which SoC we are running.
+
+- /* Armada 370/XP coherency works in both UP and SMP */
+- if (type == COHERENCY_FABRIC_TYPE_ARMADA_370_XP)
+- return type;
++ */
++ if (!is_smp())
++ return COHERENCY_FABRIC_TYPE_NONE;
+
+- /* Armada 375 coherency works only on SMP */
+- else if (type == COHERENCY_FABRIC_TYPE_ARMADA_375 && is_smp())
+- return type;
++ np = of_find_matching_node_and_match(NULL, of_coherency_table, &match);
++ if (!np)
++ return COHERENCY_FABRIC_TYPE_NONE;
+
+- /* Armada 380 coherency works only on SMP */
+- else if (type == COHERENCY_FABRIC_TYPE_ARMADA_380 && is_smp())
+- return type;
+- }
++ type = (int) match->data;
++
++ of_node_put(np);
+
+- return COHERENCY_FABRIC_TYPE_NONE;
++ return type;
+ }
+
+ int coherency_available(void)
+diff --git a/arch/arm/mach-mvebu/coherency_ll.S b/arch/arm/mach-mvebu/coherency_ll.S
+index f5d881b5d0f7..8b2fbc8b6bc6 100644
+--- a/arch/arm/mach-mvebu/coherency_ll.S
++++ b/arch/arm/mach-mvebu/coherency_ll.S
+@@ -24,7 +24,10 @@
+ #include <asm/cp15.h>
+
+ .text
+-/* Returns the coherency base address in r1 (r0 is untouched) */
++/*
++ * Returns the coherency base address in r1 (r0 is untouched), or 0 if
++ * the coherency fabric is not enabled.
++ */
+ ENTRY(ll_get_coherency_base)
+ mrc p15, 0, r1, c1, c0, 0
+ tst r1, #CR_M @ Check MMU bit enabled
+@@ -32,8 +35,13 @@ ENTRY(ll_get_coherency_base)
+
+ /*
+ * MMU is disabled, use the physical address of the coherency
+- * base address.
++ * base address. However, if the coherency fabric isn't mapped
++ * (i.e its virtual address is zero), it means coherency is
++ * not enabled, so we return 0.
+ */
++ ldr r1, =coherency_base
++ cmp r1, #0
++ beq 2f
+ adr r1, 3f
+ ldr r3, [r1]
+ ldr r1, [r1, r3]
+@@ -85,6 +93,9 @@ ENTRY(ll_add_cpu_to_smp_group)
+ */
+ mov r0, lr
+ bl ll_get_coherency_base
++ /* Bail out if the coherency is not enabled */
++ cmp r1, #0
++ reteq r0
+ bl ll_get_coherency_cpumask
+ mov lr, r0
+ add r0, r1, #ARMADA_XP_CFB_CFG_REG_OFFSET
+@@ -107,6 +118,9 @@ ENTRY(ll_enable_coherency)
+ */
+ mov r0, lr
+ bl ll_get_coherency_base
++ /* Bail out if the coherency is not enabled */
++ cmp r1, #0
++ reteq r0
+ bl ll_get_coherency_cpumask
+ mov lr, r0
+ add r0, r1, #ARMADA_XP_CFB_CTL_REG_OFFSET
+@@ -131,6 +145,9 @@ ENTRY(ll_disable_coherency)
+ */
+ mov r0, lr
+ bl ll_get_coherency_base
++ /* Bail out if the coherency is not enabled */
++ cmp r1, #0
++ reteq r0
+ bl ll_get_coherency_cpumask
+ mov lr, r0
+ add r0, r1, #ARMADA_XP_CFB_CTL_REG_OFFSET
+diff --git a/arch/arm/mach-tegra/reset-handler.S b/arch/arm/mach-tegra/reset-handler.S
+index 7b2baab0f0bd..71be4af5e975 100644
+--- a/arch/arm/mach-tegra/reset-handler.S
++++ b/arch/arm/mach-tegra/reset-handler.S
+@@ -51,6 +51,7 @@ ENTRY(tegra_resume)
+ THUMB( it ne )
+ bne cpu_resume @ no
+
++ tegra_get_soc_id TEGRA_APB_MISC_BASE, r6
+ /* Are we on Tegra20? */
+ cmp r6, #TEGRA20
+ beq 1f @ Yes
+diff --git a/arch/arm64/include/asm/arch_timer.h b/arch/arm64/include/asm/arch_timer.h
+index f19097134b02..b1fa4e614718 100644
+--- a/arch/arm64/include/asm/arch_timer.h
++++ b/arch/arm64/include/asm/arch_timer.h
+@@ -104,6 +104,15 @@ static inline void arch_timer_set_cntkctl(u32 cntkctl)
+ asm volatile("msr cntkctl_el1, %0" : : "r" (cntkctl));
+ }
+
++static inline u64 arch_counter_get_cntpct(void)
++{
++ /*
++ * AArch64 kernel and user space mandate the use of CNTVCT.
++ */
++ BUG();
++ return 0;
++}
++
+ static inline u64 arch_counter_get_cntvct(void)
+ {
+ u64 cval;
+diff --git a/arch/arm64/include/asm/hwcap.h b/arch/arm64/include/asm/hwcap.h
+index 024c46183c3c..0ad735166d9f 100644
+--- a/arch/arm64/include/asm/hwcap.h
++++ b/arch/arm64/include/asm/hwcap.h
+@@ -30,6 +30,7 @@
+ #define COMPAT_HWCAP_IDIVA (1 << 17)
+ #define COMPAT_HWCAP_IDIVT (1 << 18)
+ #define COMPAT_HWCAP_IDIV (COMPAT_HWCAP_IDIVA|COMPAT_HWCAP_IDIVT)
++#define COMPAT_HWCAP_LPAE (1 << 20)
+ #define COMPAT_HWCAP_EVTSTRM (1 << 21)
+
+ #define COMPAT_HWCAP2_AES (1 << 0)
+diff --git a/arch/arm64/kernel/setup.c b/arch/arm64/kernel/setup.c
+index 2437196cc5d4..f9620154bfb0 100644
+--- a/arch/arm64/kernel/setup.c
++++ b/arch/arm64/kernel/setup.c
+@@ -72,7 +72,8 @@ EXPORT_SYMBOL_GPL(elf_hwcap);
+ COMPAT_HWCAP_FAST_MULT|COMPAT_HWCAP_EDSP|\
+ COMPAT_HWCAP_TLS|COMPAT_HWCAP_VFP|\
+ COMPAT_HWCAP_VFPv3|COMPAT_HWCAP_VFPv4|\
+- COMPAT_HWCAP_NEON|COMPAT_HWCAP_IDIV)
++ COMPAT_HWCAP_NEON|COMPAT_HWCAP_IDIV|\
++ COMPAT_HWCAP_LPAE)
+ unsigned int compat_elf_hwcap __read_mostly = COMPAT_ELF_HWCAP_DEFAULT;
+ unsigned int compat_elf_hwcap2 __read_mostly;
+ #endif
+diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c
+index 41f1e3e2ea24..edba042b2325 100644
+--- a/arch/arm64/net/bpf_jit_comp.c
++++ b/arch/arm64/net/bpf_jit_comp.c
+@@ -60,7 +60,7 @@ struct jit_ctx {
+ const struct bpf_prog *prog;
+ int idx;
+ int tmp_used;
+- int body_offset;
++ int epilogue_offset;
+ int *offset;
+ u32 *image;
+ };
+@@ -130,8 +130,8 @@ static void jit_fill_hole(void *area, unsigned int size)
+
+ static inline int epilogue_offset(const struct jit_ctx *ctx)
+ {
+- int to = ctx->offset[ctx->prog->len - 1];
+- int from = ctx->idx - ctx->body_offset;
++ int to = ctx->epilogue_offset;
++ int from = ctx->idx;
+
+ return to - from;
+ }
+@@ -463,6 +463,8 @@ emit_cond_jmp:
+ }
+ /* function return */
+ case BPF_JMP | BPF_EXIT:
++ /* Optimization: when last instruction is EXIT,
++ simply fallthrough to epilogue. */
+ if (i == ctx->prog->len - 1)
+ break;
+ jmp_offset = epilogue_offset(ctx);
+@@ -685,11 +687,13 @@ void bpf_int_jit_compile(struct bpf_prog *prog)
+
+ /* 1. Initial fake pass to compute ctx->idx. */
+
+- /* Fake pass to fill in ctx->offset. */
++ /* Fake pass to fill in ctx->offset and ctx->tmp_used. */
+ if (build_body(&ctx))
+ goto out;
+
+ build_prologue(&ctx);
++
++ ctx.epilogue_offset = ctx.idx;
+ build_epilogue(&ctx);
+
+ /* Now we know the actual image size. */
+@@ -706,7 +710,6 @@ void bpf_int_jit_compile(struct bpf_prog *prog)
+
+ build_prologue(&ctx);
+
+- ctx.body_offset = ctx.idx;
+ if (build_body(&ctx)) {
+ bpf_jit_binary_free(header);
+ goto out;
+diff --git a/arch/s390/kernel/compat_linux.c b/arch/s390/kernel/compat_linux.c
+index ca38139423ae..437e61159279 100644
+--- a/arch/s390/kernel/compat_linux.c
++++ b/arch/s390/kernel/compat_linux.c
+@@ -249,7 +249,7 @@ COMPAT_SYSCALL_DEFINE2(s390_setgroups16, int, gidsetsize, u16 __user *, grouplis
+ struct group_info *group_info;
+ int retval;
+
+- if (!capable(CAP_SETGID))
++ if (!may_setgroups())
+ return -EPERM;
+ if ((unsigned)gidsetsize > NGROUPS_MAX)
+ return -EINVAL;
+diff --git a/arch/x86/include/asm/microcode.h b/arch/x86/include/asm/microcode.h
+index 64dc362506b7..201b520521ed 100644
+--- a/arch/x86/include/asm/microcode.h
++++ b/arch/x86/include/asm/microcode.h
+@@ -78,6 +78,7 @@ static inline void __exit exit_amd_microcode(void) {}
+ extern void __init load_ucode_bsp(void);
+ extern void load_ucode_ap(void);
+ extern int __init save_microcode_in_initrd(void);
++void reload_early_microcode(void);
+ #else
+ static inline void __init load_ucode_bsp(void) {}
+ static inline void load_ucode_ap(void) {}
+@@ -85,6 +86,7 @@ static inline int __init save_microcode_in_initrd(void)
+ {
+ return 0;
+ }
++static inline void reload_early_microcode(void) {}
+ #endif
+
+ #endif /* _ASM_X86_MICROCODE_H */
+diff --git a/arch/x86/include/asm/microcode_amd.h b/arch/x86/include/asm/microcode_amd.h
+index b7b10b82d3e5..af935397e053 100644
+--- a/arch/x86/include/asm/microcode_amd.h
++++ b/arch/x86/include/asm/microcode_amd.h
+@@ -59,7 +59,7 @@ static inline u16 find_equiv_id(struct equiv_cpu_entry *equiv_cpu_table,
+
+ extern int __apply_microcode_amd(struct microcode_amd *mc_amd);
+ extern int apply_microcode_amd(int cpu);
+-extern enum ucode_state load_microcode_amd(u8 family, const u8 *data, size_t size);
++extern enum ucode_state load_microcode_amd(int cpu, u8 family, const u8 *data, size_t size);
+
+ #define PATCH_MAX_SIZE PAGE_SIZE
+ extern u8 amd_ucode_patch[PATCH_MAX_SIZE];
+@@ -68,10 +68,12 @@ extern u8 amd_ucode_patch[PATCH_MAX_SIZE];
+ extern void __init load_ucode_amd_bsp(void);
+ extern void load_ucode_amd_ap(void);
+ extern int __init save_microcode_in_initrd_amd(void);
++void reload_ucode_amd(void);
+ #else
+ static inline void __init load_ucode_amd_bsp(void) {}
+ static inline void load_ucode_amd_ap(void) {}
+ static inline int __init save_microcode_in_initrd_amd(void) { return -EINVAL; }
++void reload_ucode_amd(void) {}
+ #endif
+
+ #endif /* _ASM_X86_MICROCODE_AMD_H */
+diff --git a/arch/x86/include/asm/microcode_intel.h b/arch/x86/include/asm/microcode_intel.h
+index bbe296e0bce1..dd4c20043ce7 100644
+--- a/arch/x86/include/asm/microcode_intel.h
++++ b/arch/x86/include/asm/microcode_intel.h
+@@ -68,11 +68,13 @@ extern void __init load_ucode_intel_bsp(void);
+ extern void load_ucode_intel_ap(void);
+ extern void show_ucode_info_early(void);
+ extern int __init save_microcode_in_initrd_intel(void);
++void reload_ucode_intel(void);
+ #else
+ static inline __init void load_ucode_intel_bsp(void) {}
+ static inline void load_ucode_intel_ap(void) {}
+ static inline void show_ucode_info_early(void) {}
+ static inline int __init save_microcode_in_initrd_intel(void) { return -EINVAL; }
++static inline void reload_ucode_intel(void) {}
+ #endif
+
+ #if defined(CONFIG_MICROCODE_INTEL_EARLY) && defined(CONFIG_HOTPLUG_CPU)
+diff --git a/arch/x86/include/uapi/asm/ldt.h b/arch/x86/include/uapi/asm/ldt.h
+index 46727eb37bfe..6e1aaf73852a 100644
+--- a/arch/x86/include/uapi/asm/ldt.h
++++ b/arch/x86/include/uapi/asm/ldt.h
+@@ -28,6 +28,13 @@ struct user_desc {
+ unsigned int seg_not_present:1;
+ unsigned int useable:1;
+ #ifdef __x86_64__
++ /*
++ * Because this bit is not present in 32-bit user code, user
++ * programs can pass uninitialized values here. Therefore, in
++ * any context in which a user_desc comes from a 32-bit program,
++ * the kernel must act as though lm == 0, regardless of the
++ * actual value.
++ */
+ unsigned int lm:1;
+ #endif
+ };
+diff --git a/arch/x86/kernel/cpu/microcode/amd.c b/arch/x86/kernel/cpu/microcode/amd.c
+index 8fffd845e22b..bfbbe6195e2d 100644
+--- a/arch/x86/kernel/cpu/microcode/amd.c
++++ b/arch/x86/kernel/cpu/microcode/amd.c
+@@ -376,7 +376,7 @@ static enum ucode_state __load_microcode_amd(u8 family, const u8 *data,
+ return UCODE_OK;
+ }
+
+-enum ucode_state load_microcode_amd(u8 family, const u8 *data, size_t size)
++enum ucode_state load_microcode_amd(int cpu, u8 family, const u8 *data, size_t size)
+ {
+ enum ucode_state ret;
+
+@@ -390,8 +390,8 @@ enum ucode_state load_microcode_amd(u8 family, const u8 *data, size_t size)
+
+ #if defined(CONFIG_MICROCODE_AMD_EARLY) && defined(CONFIG_X86_32)
+ /* save BSP's matching patch for early load */
+- if (cpu_data(smp_processor_id()).cpu_index == boot_cpu_data.cpu_index) {
+- struct ucode_patch *p = find_patch(smp_processor_id());
++ if (cpu_data(cpu).cpu_index == boot_cpu_data.cpu_index) {
++ struct ucode_patch *p = find_patch(cpu);
+ if (p) {
+ memset(amd_ucode_patch, 0, PATCH_MAX_SIZE);
+ memcpy(amd_ucode_patch, p->data, min_t(u32, ksize(p->data),
+@@ -444,7 +444,7 @@ static enum ucode_state request_microcode_amd(int cpu, struct device *device,
+ goto fw_release;
+ }
+
+- ret = load_microcode_amd(c->x86, fw->data, fw->size);
++ ret = load_microcode_amd(cpu, c->x86, fw->data, fw->size);
+
+ fw_release:
+ release_firmware(fw);
+diff --git a/arch/x86/kernel/cpu/microcode/amd_early.c b/arch/x86/kernel/cpu/microcode/amd_early.c
+index 06674473b0e6..737737edbd1e 100644
+--- a/arch/x86/kernel/cpu/microcode/amd_early.c
++++ b/arch/x86/kernel/cpu/microcode/amd_early.c
+@@ -389,7 +389,7 @@ int __init save_microcode_in_initrd_amd(void)
+ eax = cpuid_eax(0x00000001);
+ eax = ((eax >> 8) & 0xf) + ((eax >> 20) & 0xff);
+
+- ret = load_microcode_amd(eax, container, container_size);
++ ret = load_microcode_amd(smp_processor_id(), eax, container, container_size);
+ if (ret != UCODE_OK)
+ retval = -EINVAL;
+
+@@ -402,3 +402,21 @@ int __init save_microcode_in_initrd_amd(void)
+
+ return retval;
+ }
++
++void reload_ucode_amd(void)
++{
++ struct microcode_amd *mc;
++ u32 rev, eax;
++
++ rdmsr(MSR_AMD64_PATCH_LEVEL, rev, eax);
++
++ mc = (struct microcode_amd *)amd_ucode_patch;
++
++ if (mc && rev < mc->hdr.patch_id) {
++ if (!__apply_microcode_amd(mc)) {
++ ucode_new_rev = mc->hdr.patch_id;
++ pr_info("microcode: reload patch_level=0x%08x\n",
++ ucode_new_rev);
++ }
++ }
++}
+diff --git a/arch/x86/kernel/cpu/microcode/core.c b/arch/x86/kernel/cpu/microcode/core.c
+index 08fe6e8a726e..15c29096136b 100644
+--- a/arch/x86/kernel/cpu/microcode/core.c
++++ b/arch/x86/kernel/cpu/microcode/core.c
+@@ -465,16 +465,8 @@ static void mc_bp_resume(void)
+
+ if (uci->valid && uci->mc)
+ microcode_ops->apply_microcode(cpu);
+-#ifdef CONFIG_X86_64
+ else if (!uci->mc)
+- /*
+- * We might resume and not have applied late microcode but still
+- * have a newer patch stashed from the early loader. We don't
+- * have it in uci->mc so we have to load it the same way we're
+- * applying patches early on the APs.
+- */
+- load_ucode_ap();
+-#endif
++ reload_early_microcode();
+ }
+
+ static struct syscore_ops mc_syscore_ops = {
+@@ -559,7 +551,7 @@ static int __init microcode_init(void)
+ struct cpuinfo_x86 *c = &cpu_data(0);
+ int error;
+
+- if (dis_ucode_ldr)
++ if (paravirt_enabled() || dis_ucode_ldr)
+ return 0;
+
+ if (c->x86_vendor == X86_VENDOR_INTEL)
+diff --git a/arch/x86/kernel/cpu/microcode/core_early.c b/arch/x86/kernel/cpu/microcode/core_early.c
+index 2c017f242a78..d45df4bd16ab 100644
+--- a/arch/x86/kernel/cpu/microcode/core_early.c
++++ b/arch/x86/kernel/cpu/microcode/core_early.c
+@@ -176,3 +176,24 @@ int __init save_microcode_in_initrd(void)
+
+ return 0;
+ }
++
++void reload_early_microcode(void)
++{
++ int vendor, x86;
++
++ vendor = x86_vendor();
++ x86 = x86_family();
++
++ switch (vendor) {
++ case X86_VENDOR_INTEL:
++ if (x86 >= 6)
++ reload_ucode_intel();
++ break;
++ case X86_VENDOR_AMD:
++ if (x86 >= 0x10)
++ reload_ucode_amd();
++ break;
++ default:
++ break;
++ }
++}
+diff --git a/arch/x86/kernel/cpu/microcode/intel_early.c b/arch/x86/kernel/cpu/microcode/intel_early.c
+index b88343f7a3b3..ec9df6f9cd47 100644
+--- a/arch/x86/kernel/cpu/microcode/intel_early.c
++++ b/arch/x86/kernel/cpu/microcode/intel_early.c
+@@ -650,8 +650,7 @@ static inline void print_ucode(struct ucode_cpu_info *uci)
+ }
+ #endif
+
+-static int apply_microcode_early(struct mc_saved_data *mc_saved_data,
+- struct ucode_cpu_info *uci)
++static int apply_microcode_early(struct ucode_cpu_info *uci, bool early)
+ {
+ struct microcode_intel *mc_intel;
+ unsigned int val[2];
+@@ -680,7 +679,10 @@ static int apply_microcode_early(struct mc_saved_data *mc_saved_data,
+ #endif
+ uci->cpu_sig.rev = val[1];
+
+- print_ucode(uci);
++ if (early)
++ print_ucode(uci);
++ else
++ print_ucode_info(uci, mc_intel->hdr.date);
+
+ return 0;
+ }
+@@ -715,12 +717,17 @@ _load_ucode_intel_bsp(struct mc_saved_data *mc_saved_data,
+ unsigned long initrd_end_early,
+ struct ucode_cpu_info *uci)
+ {
++ enum ucode_state ret;
++
+ collect_cpu_info_early(uci);
+ scan_microcode(initrd_start_early, initrd_end_early, mc_saved_data,
+ mc_saved_in_initrd, uci);
+- load_microcode(mc_saved_data, mc_saved_in_initrd,
+- initrd_start_early, uci);
+- apply_microcode_early(mc_saved_data, uci);
++
++ ret = load_microcode(mc_saved_data, mc_saved_in_initrd,
++ initrd_start_early, uci);
++
++ if (ret == UCODE_OK)
++ apply_microcode_early(uci, true);
+ }
+
+ void __init
+@@ -749,7 +756,8 @@ load_ucode_intel_bsp(void)
+ initrd_end_early = initrd_start_early + ramdisk_size;
+
+ _load_ucode_intel_bsp(&mc_saved_data, mc_saved_in_initrd,
+- initrd_start_early, initrd_end_early, &uci);
++ initrd_start_early, initrd_end_early,
++ &uci);
+ #endif
+ }
+
+@@ -783,5 +791,23 @@ void load_ucode_intel_ap(void)
+ collect_cpu_info_early(&uci);
+ load_microcode(mc_saved_data_p, mc_saved_in_initrd_p,
+ initrd_start_addr, &uci);
+- apply_microcode_early(mc_saved_data_p, &uci);
++ apply_microcode_early(&uci, true);
++}
++
++void reload_ucode_intel(void)
++{
++ struct ucode_cpu_info uci;
++ enum ucode_state ret;
++
++ if (!mc_saved_data.mc_saved_count)
++ return;
++
++ collect_cpu_info_early(&uci);
++
++ ret = generic_load_microcode_early(mc_saved_data.mc_saved,
++ mc_saved_data.mc_saved_count, &uci);
++ if (ret != UCODE_OK)
++ return;
++
++ apply_microcode_early(&uci, false);
+ }
+diff --git a/arch/x86/kernel/kvm.c b/arch/x86/kernel/kvm.c
+index f6945bef2cd1..94f643484300 100644
+--- a/arch/x86/kernel/kvm.c
++++ b/arch/x86/kernel/kvm.c
+@@ -283,7 +283,14 @@ NOKPROBE_SYMBOL(do_async_page_fault);
+ static void __init paravirt_ops_setup(void)
+ {
+ pv_info.name = "KVM";
+- pv_info.paravirt_enabled = 1;
++
++ /*
++ * KVM isn't paravirt in the sense of paravirt_enabled. A KVM
++ * guest kernel works like a bare metal kernel with additional
++ * features, and paravirt_enabled is about features that are
++ * missing.
++ */
++ pv_info.paravirt_enabled = 0;
+
+ if (kvm_para_has_feature(KVM_FEATURE_NOP_IO_DELAY))
+ pv_cpu_ops.io_delay = kvm_io_delay;
+diff --git a/arch/x86/kernel/kvmclock.c b/arch/x86/kernel/kvmclock.c
+index d9156ceecdff..a2de9bc7ac0b 100644
+--- a/arch/x86/kernel/kvmclock.c
++++ b/arch/x86/kernel/kvmclock.c
+@@ -263,7 +263,6 @@ void __init kvmclock_init(void)
+ #endif
+ kvm_get_preset_lpj();
+ clocksource_register_hz(&kvm_clock, NSEC_PER_SEC);
+- pv_info.paravirt_enabled = 1;
+ pv_info.name = "KVM";
+
+ if (kvm_para_has_feature(KVM_FEATURE_CLOCKSOURCE_STABLE_BIT))
+diff --git a/arch/x86/kernel/process_64.c b/arch/x86/kernel/process_64.c
+index 3ed4a68d4013..5a2c02913af3 100644
+--- a/arch/x86/kernel/process_64.c
++++ b/arch/x86/kernel/process_64.c
+@@ -283,24 +283,9 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
+
+ fpu = switch_fpu_prepare(prev_p, next_p, cpu);
+
+- /*
+- * Reload esp0, LDT and the page table pointer:
+- */
++ /* Reload esp0 and ss1. */
+ load_sp0(tss, next);
+
+- /*
+- * Switch DS and ES.
+- * This won't pick up thread selector changes, but I guess that is ok.
+- */
+- savesegment(es, prev->es);
+- if (unlikely(next->es | prev->es))
+- loadsegment(es, next->es);
+-
+- savesegment(ds, prev->ds);
+- if (unlikely(next->ds | prev->ds))
+- loadsegment(ds, next->ds);
+-
+-
+ /* We must save %fs and %gs before load_TLS() because
+ * %fs and %gs may be cleared by load_TLS().
+ *
+@@ -309,41 +294,101 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
+ savesegment(fs, fsindex);
+ savesegment(gs, gsindex);
+
++ /*
++ * Load TLS before restoring any segments so that segment loads
++ * reference the correct GDT entries.
++ */
+ load_TLS(next, cpu);
+
+ /*
+- * Leave lazy mode, flushing any hypercalls made here.
+- * This must be done before restoring TLS segments so
+- * the GDT and LDT are properly updated, and must be
+- * done before math_state_restore, so the TS bit is up
+- * to date.
++ * Leave lazy mode, flushing any hypercalls made here. This
++ * must be done after loading TLS entries in the GDT but before
++ * loading segments that might reference them, and and it must
++ * be done before math_state_restore, so the TS bit is up to
++ * date.
+ */
+ arch_end_context_switch(next_p);
+
++ /* Switch DS and ES.
++ *
++ * Reading them only returns the selectors, but writing them (if
++ * nonzero) loads the full descriptor from the GDT or LDT. The
++ * LDT for next is loaded in switch_mm, and the GDT is loaded
++ * above.
++ *
++ * We therefore need to write new values to the segment
++ * registers on every context switch unless both the new and old
++ * values are zero.
++ *
++ * Note that we don't need to do anything for CS and SS, as
++ * those are saved and restored as part of pt_regs.
++ */
++ savesegment(es, prev->es);
++ if (unlikely(next->es | prev->es))
++ loadsegment(es, next->es);
++
++ savesegment(ds, prev->ds);
++ if (unlikely(next->ds | prev->ds))
++ loadsegment(ds, next->ds);
++
+ /*
+ * Switch FS and GS.
+ *
+- * Segment register != 0 always requires a reload. Also
+- * reload when it has changed. When prev process used 64bit
+- * base always reload to avoid an information leak.
++ * These are even more complicated than FS and GS: they have
++ * 64-bit bases are that controlled by arch_prctl. Those bases
++ * only differ from the values in the GDT or LDT if the selector
++ * is 0.
++ *
++ * Loading the segment register resets the hidden base part of
++ * the register to 0 or the value from the GDT / LDT. If the
++ * next base address zero, writing 0 to the segment register is
++ * much faster than using wrmsr to explicitly zero the base.
++ *
++ * The thread_struct.fs and thread_struct.gs values are 0
++ * if the fs and gs bases respectively are not overridden
++ * from the values implied by fsindex and gsindex. They
++ * are nonzero, and store the nonzero base addresses, if
++ * the bases are overridden.
++ *
++ * (fs != 0 && fsindex != 0) || (gs != 0 && gsindex != 0) should
++ * be impossible.
++ *
++ * Therefore we need to reload the segment registers if either
++ * the old or new selector is nonzero, and we need to override
++ * the base address if next thread expects it to be overridden.
++ *
++ * This code is unnecessarily slow in the case where the old and
++ * new indexes are zero and the new base is nonzero -- it will
++ * unnecessarily write 0 to the selector before writing the new
++ * base address.
++ *
++ * Note: This all depends on arch_prctl being the only way that
++ * user code can override the segment base. Once wrfsbase and
++ * wrgsbase are enabled, most of this code will need to change.
+ */
+ if (unlikely(fsindex | next->fsindex | prev->fs)) {
+ loadsegment(fs, next->fsindex);
++
+ /*
+- * Check if the user used a selector != 0; if yes
+- * clear 64bit base, since overloaded base is always
+- * mapped to the Null selector
++ * If user code wrote a nonzero value to FS, then it also
++ * cleared the overridden base address.
++ *
++ * XXX: if user code wrote 0 to FS and cleared the base
++ * address itself, we won't notice and we'll incorrectly
++ * restore the prior base address next time we reschdule
++ * the process.
+ */
+ if (fsindex)
+ prev->fs = 0;
+ }
+- /* when next process has a 64bit base use it */
+ if (next->fs)
+ wrmsrl(MSR_FS_BASE, next->fs);
+ prev->fsindex = fsindex;
+
+ if (unlikely(gsindex | next->gsindex | prev->gs)) {
+ load_gs_index(next->gsindex);
++
++ /* This works (and fails) the same way as fsindex above. */
+ if (gsindex)
+ prev->gs = 0;
+ }
+diff --git a/arch/x86/kernel/tls.c b/arch/x86/kernel/tls.c
+index f7fec09e3e3a..4e942f31b1a7 100644
+--- a/arch/x86/kernel/tls.c
++++ b/arch/x86/kernel/tls.c
+@@ -27,6 +27,37 @@ static int get_free_idx(void)
+ return -ESRCH;
+ }
+
++static bool tls_desc_okay(const struct user_desc *info)
++{
++ if (LDT_empty(info))
++ return true;
++
++ /*
++ * espfix is required for 16-bit data segments, but espfix
++ * only works for LDT segments.
++ */
++ if (!info->seg_32bit)
++ return false;
++
++ /* Only allow data segments in the TLS array. */
++ if (info->contents > 1)
++ return false;
++
++ /*
++ * Non-present segments with DPL 3 present an interesting attack
++ * surface. The kernel should handle such segments correctly,
++ * but TLS is very difficult to protect in a sandbox, so prevent
++ * such segments from being created.
++ *
++ * If userspace needs to remove a TLS entry, it can still delete
++ * it outright.
++ */
++ if (info->seg_not_present)
++ return false;
++
++ return true;
++}
++
+ static void set_tls_desc(struct task_struct *p, int idx,
+ const struct user_desc *info, int n)
+ {
+@@ -66,6 +97,9 @@ int do_set_thread_area(struct task_struct *p, int idx,
+ if (copy_from_user(&info, u_info, sizeof(info)))
+ return -EFAULT;
+
++ if (!tls_desc_okay(&info))
++ return -EINVAL;
++
+ if (idx == -1)
+ idx = info.entry_number;
+
+@@ -192,6 +226,7 @@ int regset_tls_set(struct task_struct *target, const struct user_regset *regset,
+ {
+ struct user_desc infobuf[GDT_ENTRY_TLS_ENTRIES];
+ const struct user_desc *info;
++ int i;
+
+ if (pos >= GDT_ENTRY_TLS_ENTRIES * sizeof(struct user_desc) ||
+ (pos % sizeof(struct user_desc)) != 0 ||
+@@ -205,6 +240,10 @@ int regset_tls_set(struct task_struct *target, const struct user_regset *regset,
+ else
+ info = infobuf;
+
++ for (i = 0; i < count / sizeof(struct user_desc); i++)
++ if (!tls_desc_okay(info + i))
++ return -EINVAL;
++
+ set_tls_desc(target,
+ GDT_ENTRY_TLS_MIN + (pos / sizeof(struct user_desc)),
+ info, count / sizeof(struct user_desc));
+diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c
+index de801f22128a..07ab8e9733c5 100644
+--- a/arch/x86/kernel/traps.c
++++ b/arch/x86/kernel/traps.c
+@@ -387,7 +387,7 @@ NOKPROBE_SYMBOL(do_int3);
+ * for scheduling or signal handling. The actual stack switch is done in
+ * entry.S
+ */
+-asmlinkage __visible struct pt_regs *sync_regs(struct pt_regs *eregs)
++asmlinkage __visible notrace struct pt_regs *sync_regs(struct pt_regs *eregs)
+ {
+ struct pt_regs *regs = eregs;
+ /* Did already sync */
+@@ -413,7 +413,7 @@ struct bad_iret_stack {
+ struct pt_regs regs;
+ };
+
+-asmlinkage __visible
++asmlinkage __visible notrace
+ struct bad_iret_stack *fixup_bad_iret(struct bad_iret_stack *s)
+ {
+ /*
+@@ -436,6 +436,7 @@ struct bad_iret_stack *fixup_bad_iret(struct bad_iret_stack *s)
+ BUG_ON(!user_mode_vm(&new_stack->regs));
+ return new_stack;
+ }
++NOKPROBE_SYMBOL(fixup_bad_iret);
+ #endif
+
+ /*
+diff --git a/crypto/af_alg.c b/crypto/af_alg.c
+index 6a3ad8011585..1de4beeb25f8 100644
+--- a/crypto/af_alg.c
++++ b/crypto/af_alg.c
+@@ -449,6 +449,9 @@ void af_alg_complete(struct crypto_async_request *req, int err)
+ {
+ struct af_alg_completion *completion = req->data;
+
++ if (err == -EINPROGRESS)
++ return;
++
+ completion->err = err;
+ complete(&completion->completion);
+ }
+diff --git a/drivers/clocksource/arm_arch_timer.c b/drivers/clocksource/arm_arch_timer.c
+index 43005d4d3348..1fa2af957b18 100644
+--- a/drivers/clocksource/arm_arch_timer.c
++++ b/drivers/clocksource/arm_arch_timer.c
+@@ -462,7 +462,10 @@ static void __init arch_counter_register(unsigned type)
+
+ /* Register the CP15 based counter if we have one */
+ if (type & ARCH_CP15_TIMER) {
+- arch_timer_read_counter = arch_counter_get_cntvct;
++ if (arch_timer_use_virtual)
++ arch_timer_read_counter = arch_counter_get_cntvct;
++ else
++ arch_timer_read_counter = arch_counter_get_cntpct;
+ } else {
+ arch_timer_read_counter = arch_counter_get_cntvct_mem;
+
+diff --git a/drivers/gpu/drm/tegra/gem.c b/drivers/gpu/drm/tegra/gem.c
+index ce023fa3e8ae..ab9a4539a446 100644
+--- a/drivers/gpu/drm/tegra/gem.c
++++ b/drivers/gpu/drm/tegra/gem.c
+@@ -259,16 +259,12 @@ void tegra_bo_free_object(struct drm_gem_object *gem)
+ int tegra_bo_dumb_create(struct drm_file *file, struct drm_device *drm,
+ struct drm_mode_create_dumb *args)
+ {
+- int min_pitch = DIV_ROUND_UP(args->width * args->bpp, 8);
++ unsigned int min_pitch = DIV_ROUND_UP(args->width * args->bpp, 8);
+ struct tegra_drm *tegra = drm->dev_private;
+ struct tegra_bo *bo;
+
+- min_pitch = round_up(min_pitch, tegra->pitch_align);
+- if (args->pitch < min_pitch)
+- args->pitch = min_pitch;
+-
+- if (args->size < args->pitch * args->height)
+- args->size = args->pitch * args->height;
++ args->pitch = round_up(min_pitch, tegra->pitch_align);
++ args->size = args->pitch * args->height;
+
+ bo = tegra_bo_create_with_handle(file, drm, args->size, 0,
+ &args->handle);
+diff --git a/drivers/md/dm-bufio.c b/drivers/md/dm-bufio.c
+index afe79719ea32..ecbd3ffcf359 100644
+--- a/drivers/md/dm-bufio.c
++++ b/drivers/md/dm-bufio.c
+@@ -532,6 +532,19 @@ static void use_dmio(struct dm_buffer *b, int rw, sector_t block,
+ end_io(&b->bio, r);
+ }
+
++static void inline_endio(struct bio *bio, int error)
++{
++ bio_end_io_t *end_fn = bio->bi_private;
++
++ /*
++ * Reset the bio to free any attached resources
++ * (e.g. bio integrity profiles).
++ */
++ bio_reset(bio);
++
++ end_fn(bio, error);
++}
++
+ static void use_inline_bio(struct dm_buffer *b, int rw, sector_t block,
+ bio_end_io_t *end_io)
+ {
+@@ -543,7 +556,12 @@ static void use_inline_bio(struct dm_buffer *b, int rw, sector_t block,
+ b->bio.bi_max_vecs = DM_BUFIO_INLINE_VECS;
+ b->bio.bi_iter.bi_sector = block << b->c->sectors_per_block_bits;
+ b->bio.bi_bdev = b->c->bdev;
+- b->bio.bi_end_io = end_io;
++ b->bio.bi_end_io = inline_endio;
++ /*
++ * Use of .bi_private isn't a problem here because
++ * the dm_buffer's inline bio is local to bufio.
++ */
++ b->bio.bi_private = end_io;
+
+ /*
+ * We assume that if len >= PAGE_SIZE ptr is page-aligned.
+diff --git a/drivers/md/dm-cache-target.c b/drivers/md/dm-cache-target.c
+index 7130505c2425..da496cfb458d 100644
+--- a/drivers/md/dm-cache-target.c
++++ b/drivers/md/dm-cache-target.c
+@@ -951,10 +951,14 @@ static void migration_success_post_commit(struct dm_cache_migration *mg)
+ }
+
+ } else {
+- clear_dirty(cache, mg->new_oblock, mg->cblock);
+- if (mg->requeue_holder)
++ if (mg->requeue_holder) {
++ clear_dirty(cache, mg->new_oblock, mg->cblock);
+ cell_defer(cache, mg->new_ocell, true);
+- else {
++ } else {
++ /*
++ * The block was promoted via an overwrite, so it's dirty.
++ */
++ set_dirty(cache, mg->new_oblock, mg->cblock);
+ bio_endio(mg->new_ocell->holder, 0);
+ cell_defer(cache, mg->new_ocell, false);
+ }
+@@ -1070,7 +1074,8 @@ static void issue_copy(struct dm_cache_migration *mg)
+
+ avoid = is_discarded_oblock(cache, mg->new_oblock);
+
+- if (!avoid && bio_writes_complete_block(cache, bio)) {
++ if (writeback_mode(&cache->features) &&
++ !avoid && bio_writes_complete_block(cache, bio)) {
+ issue_overwrite(mg, bio);
+ return;
+ }
+@@ -2549,11 +2554,11 @@ static int __cache_map(struct cache *cache, struct bio *bio, struct dm_bio_priso
+ static int cache_map(struct dm_target *ti, struct bio *bio)
+ {
+ int r;
+- struct dm_bio_prison_cell *cell;
++ struct dm_bio_prison_cell *cell = NULL;
+ struct cache *cache = ti->private;
+
+ r = __cache_map(cache, bio, &cell);
+- if (r == DM_MAPIO_REMAPPED) {
++ if (r == DM_MAPIO_REMAPPED && cell) {
+ inc_ds(cache, bio, cell);
+ cell_defer(cache, cell, false);
+ }
+diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c
+index fc93b9330af4..08981be7baa1 100644
+--- a/drivers/md/dm-crypt.c
++++ b/drivers/md/dm-crypt.c
+@@ -705,7 +705,7 @@ static int crypt_iv_tcw_whitening(struct crypt_config *cc,
+ for (i = 0; i < ((1 << SECTOR_SHIFT) / 8); i++)
+ crypto_xor(data + i * 8, buf, 8);
+ out:
+- memset(buf, 0, sizeof(buf));
++ memzero_explicit(buf, sizeof(buf));
+ return r;
+ }
+
+diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c
+index 0f86d802b533..aae19133cfac 100644
+--- a/drivers/md/dm-thin.c
++++ b/drivers/md/dm-thin.c
+@@ -990,6 +990,24 @@ static void schedule_external_copy(struct thin_c *tc, dm_block_t virt_block,
+ schedule_zero(tc, virt_block, data_dest, cell, bio);
+ }
+
++static void set_pool_mode(struct pool *pool, enum pool_mode new_mode);
++
++static void check_for_space(struct pool *pool)
++{
++ int r;
++ dm_block_t nr_free;
++
++ if (get_pool_mode(pool) != PM_OUT_OF_DATA_SPACE)
++ return;
++
++ r = dm_pool_get_free_block_count(pool->pmd, &nr_free);
++ if (r)
++ return;
++
++ if (nr_free)
++ set_pool_mode(pool, PM_WRITE);
++}
++
+ /*
+ * A non-zero return indicates read_only or fail_io mode.
+ * Many callers don't care about the return value.
+@@ -1004,6 +1022,8 @@ static int commit(struct pool *pool)
+ r = dm_pool_commit_metadata(pool->pmd);
+ if (r)
+ metadata_operation_failed(pool, "dm_pool_commit_metadata", r);
++ else
++ check_for_space(pool);
+
+ return r;
+ }
+@@ -1022,8 +1042,6 @@ static void check_low_water_mark(struct pool *pool, dm_block_t free_blocks)
+ }
+ }
+
+-static void set_pool_mode(struct pool *pool, enum pool_mode new_mode);
+-
+ static int alloc_data_block(struct thin_c *tc, dm_block_t *result)
+ {
+ int r;
+@@ -1824,7 +1842,7 @@ static void set_pool_mode(struct pool *pool, enum pool_mode new_mode)
+ pool->process_bio = process_bio_read_only;
+ pool->process_discard = process_discard;
+ pool->process_prepared_mapping = process_prepared_mapping;
+- pool->process_prepared_discard = process_prepared_discard_passdown;
++ pool->process_prepared_discard = process_prepared_discard;
+
+ if (!pool->pf.error_if_no_space && no_space_timeout)
+ queue_delayed_work(pool->wq, &pool->no_space_timeout, no_space_timeout);
+@@ -3248,14 +3266,14 @@ static void thin_dtr(struct dm_target *ti)
+ struct thin_c *tc = ti->private;
+ unsigned long flags;
+
+- thin_put(tc);
+- wait_for_completion(&tc->can_destroy);
+-
+ spin_lock_irqsave(&tc->pool->lock, flags);
+ list_del_rcu(&tc->list);
+ spin_unlock_irqrestore(&tc->pool->lock, flags);
+ synchronize_rcu();
+
++ thin_put(tc);
++ wait_for_completion(&tc->can_destroy);
++
+ mutex_lock(&dm_thin_pool_table.mutex);
+
+ __pool_dec(tc->pool);
+diff --git a/drivers/md/persistent-data/dm-space-map-metadata.c b/drivers/md/persistent-data/dm-space-map-metadata.c
+index 786b689bdfc7..f4e22bcc7fb8 100644
+--- a/drivers/md/persistent-data/dm-space-map-metadata.c
++++ b/drivers/md/persistent-data/dm-space-map-metadata.c
+@@ -564,7 +564,9 @@ static int sm_bootstrap_get_nr_blocks(struct dm_space_map *sm, dm_block_t *count
+ {
+ struct sm_metadata *smm = container_of(sm, struct sm_metadata, sm);
+
+- return smm->ll.nr_blocks;
++ *count = smm->ll.nr_blocks;
++
++ return 0;
+ }
+
+ static int sm_bootstrap_get_nr_free(struct dm_space_map *sm, dm_block_t *count)
+diff --git a/drivers/mfd/tc6393xb.c b/drivers/mfd/tc6393xb.c
+index 4fac16bcd732..0afddf6c37af 100644
+--- a/drivers/mfd/tc6393xb.c
++++ b/drivers/mfd/tc6393xb.c
+@@ -263,6 +263,17 @@ static int tc6393xb_ohci_disable(struct platform_device *dev)
+ return 0;
+ }
+
++static int tc6393xb_ohci_suspend(struct platform_device *dev)
++{
++ struct tc6393xb_platform_data *tcpd = dev_get_platdata(dev->dev.parent);
++
++ /* We can't properly store/restore OHCI state, so fail here */
++ if (tcpd->resume_restore)
++ return -EBUSY;
++
++ return tc6393xb_ohci_disable(dev);
++}
++
+ static int tc6393xb_fb_enable(struct platform_device *dev)
+ {
+ struct tc6393xb *tc6393xb = dev_get_drvdata(dev->dev.parent);
+@@ -403,7 +414,7 @@ static struct mfd_cell tc6393xb_cells[] = {
+ .num_resources = ARRAY_SIZE(tc6393xb_ohci_resources),
+ .resources = tc6393xb_ohci_resources,
+ .enable = tc6393xb_ohci_enable,
+- .suspend = tc6393xb_ohci_disable,
++ .suspend = tc6393xb_ohci_suspend,
+ .resume = tc6393xb_ohci_enable,
+ .disable = tc6393xb_ohci_disable,
+ },
+diff --git a/drivers/mfd/twl4030-power.c b/drivers/mfd/twl4030-power.c
+index 50f9091bcd38..7d63e324e6a8 100644
+--- a/drivers/mfd/twl4030-power.c
++++ b/drivers/mfd/twl4030-power.c
+@@ -831,6 +831,9 @@ static struct twl4030_power_data osc_off_idle = {
+
+ static struct of_device_id twl4030_power_of_match[] = {
+ {
++ .compatible = "ti,twl4030-power",
++ },
++ {
+ .compatible = "ti,twl4030-power-reset",
+ .data = &omap3_reset,
+ },
+diff --git a/drivers/mmc/card/block.c b/drivers/mmc/card/block.c
+index 1fa4c80ff886..a11451f4f408 100644
+--- a/drivers/mmc/card/block.c
++++ b/drivers/mmc/card/block.c
+@@ -260,7 +260,7 @@ static ssize_t force_ro_show(struct device *dev, struct device_attribute *attr,
+ int ret;
+ struct mmc_blk_data *md = mmc_blk_get(dev_to_disk(dev));
+
+- ret = snprintf(buf, PAGE_SIZE, "%d",
++ ret = snprintf(buf, PAGE_SIZE, "%d\n",
+ get_disk_ro(dev_to_disk(dev)) ^
+ md->read_only);
+ mmc_blk_put(md);
+diff --git a/drivers/mmc/host/dw_mmc.c b/drivers/mmc/host/dw_mmc.c
+index 69f0cc68d5b2..f7c95abc8c11 100644
+--- a/drivers/mmc/host/dw_mmc.c
++++ b/drivers/mmc/host/dw_mmc.c
+@@ -626,6 +626,13 @@ static void dw_mci_ctrl_rd_thld(struct dw_mci *host, struct mmc_data *data)
+
+ WARN_ON(!(data->flags & MMC_DATA_READ));
+
++ /*
++ * CDTHRCTL doesn't exist prior to 240A (in fact that register offset is
++ * in the FIFO region, so we really shouldn't access it).
++ */
++ if (host->verid < DW_MMC_240A)
++ return;
++
+ if (host->timing != MMC_TIMING_MMC_HS200 &&
+ host->timing != MMC_TIMING_UHS_SDR104)
+ goto disable;
+diff --git a/drivers/mmc/host/omap_hsmmc.c b/drivers/mmc/host/omap_hsmmc.c
+index df27bb4fc098..9c2b9cbcbce0 100644
+--- a/drivers/mmc/host/omap_hsmmc.c
++++ b/drivers/mmc/host/omap_hsmmc.c
+@@ -609,6 +609,7 @@ static void omap_hsmmc_set_clock(struct omap_hsmmc_host *host)
+ */
+ if ((mmc_slot(host).features & HSMMC_HAS_HSPE_SUPPORT) &&
+ (ios->timing != MMC_TIMING_MMC_DDR52) &&
++ (ios->timing != MMC_TIMING_UHS_DDR50) &&
+ ((OMAP_HSMMC_READ(host->base, CAPA) & HSS) == HSS)) {
+ regval = OMAP_HSMMC_READ(host->base, HCTL);
+ if (clkdiv && (clk_get_rate(host->fclk)/clkdiv) > 25000000)
+@@ -628,7 +629,8 @@ static void omap_hsmmc_set_bus_width(struct omap_hsmmc_host *host)
+ u32 con;
+
+ con = OMAP_HSMMC_READ(host->base, CON);
+- if (ios->timing == MMC_TIMING_MMC_DDR52)
++ if (ios->timing == MMC_TIMING_MMC_DDR52 ||
++ ios->timing == MMC_TIMING_UHS_DDR50)
+ con |= DDR; /* configure in DDR mode */
+ else
+ con &= ~DDR;
+diff --git a/drivers/mmc/host/sdhci-pci-o2micro.c b/drivers/mmc/host/sdhci-pci-o2micro.c
+index 5670e381b0cf..e2ec108dba0e 100644
+--- a/drivers/mmc/host/sdhci-pci-o2micro.c
++++ b/drivers/mmc/host/sdhci-pci-o2micro.c
+@@ -127,8 +127,6 @@ void sdhci_pci_o2_fujin2_pci_init(struct sdhci_pci_chip *chip)
+ return;
+ scratch_32 &= ~((1 << 21) | (1 << 30));
+
+- /* Set RTD3 function disabled */
+- scratch_32 |= ((1 << 29) | (1 << 28));
+ pci_write_config_dword(chip->pdev, O2_SD_FUNC_REG3, scratch_32);
+
+ /* Set L1 Entrance Timer */
+diff --git a/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c b/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c
+index 11cc051f97cd..8079a9ddcba9 100644
+--- a/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c
++++ b/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c
+@@ -1355,6 +1355,7 @@ int brcmf_proto_msgbuf_attach(struct brcmf_pub *drvr)
+ }
+ INIT_WORK(&msgbuf->txflow_work, brcmf_msgbuf_txflow_worker);
+ count = BITS_TO_LONGS(if_msgbuf->nrof_flowrings);
++ count = count * sizeof(unsigned long);
+ msgbuf->flow_map = kzalloc(count, GFP_KERNEL);
+ if (!msgbuf->flow_map)
+ goto fail;
+diff --git a/drivers/regulator/anatop-regulator.c b/drivers/regulator/anatop-regulator.c
+index 4f730af70e7c..30e8d7ad5813 100644
+--- a/drivers/regulator/anatop-regulator.c
++++ b/drivers/regulator/anatop-regulator.c
+@@ -283,6 +283,14 @@ static int anatop_regulator_probe(struct platform_device *pdev)
+ sreg->sel = 0;
+ sreg->bypass = true;
+ }
++
++ /*
++ * In case vddpu was disabled by the bootloader, we need to set
++ * a sane default until imx6-cpufreq was probed and changes the
++ * voltage to the correct value. In this case we set 1.25V.
++ */
++ if (!sreg->sel && !strcmp(sreg->name, "vddpu"))
++ sreg->sel = 22;
+ } else {
+ rdesc->ops = &anatop_rops;
+ }
+diff --git a/drivers/scsi/NCR5380.c b/drivers/scsi/NCR5380.c
+index 45da3c823322..ab1c09eaa5b8 100644
+--- a/drivers/scsi/NCR5380.c
++++ b/drivers/scsi/NCR5380.c
+@@ -2647,14 +2647,14 @@ static void NCR5380_dma_complete(NCR5380_instance * instance) {
+ *
+ * Purpose : abort a command
+ *
+- * Inputs : cmd - the Scsi_Cmnd to abort, code - code to set the
+- * host byte of the result field to, if zero DID_ABORTED is
++ * Inputs : cmd - the Scsi_Cmnd to abort, code - code to set the
++ * host byte of the result field to, if zero DID_ABORTED is
+ * used.
+ *
+- * Returns : 0 - success, -1 on failure.
++ * Returns : SUCCESS - success, FAILED on failure.
+ *
+- * XXX - there is no way to abort the command that is currently
+- * connected, you have to wait for it to complete. If this is
++ * XXX - there is no way to abort the command that is currently
++ * connected, you have to wait for it to complete. If this is
+ * a problem, we could implement longjmp() / setjmp(), setjmp()
+ * called where the loop started in NCR5380_main().
+ *
+@@ -2704,7 +2704,7 @@ static int NCR5380_abort(Scsi_Cmnd * cmd) {
+ * aborted flag and get back into our main loop.
+ */
+
+- return 0;
++ return SUCCESS;
+ }
+ #endif
+
+diff --git a/drivers/scsi/aha1740.c b/drivers/scsi/aha1740.c
+index 5f3101797c93..31ace4bef8fe 100644
+--- a/drivers/scsi/aha1740.c
++++ b/drivers/scsi/aha1740.c
+@@ -531,7 +531,7 @@ static int aha1740_eh_abort_handler (Scsi_Cmnd *dummy)
+ * quiet as possible...
+ */
+
+- return 0;
++ return SUCCESS;
+ }
+
+ static struct scsi_host_template aha1740_template = {
+diff --git a/drivers/scsi/atari_NCR5380.c b/drivers/scsi/atari_NCR5380.c
+index 79e6f045c2a9..e3bbc0a0f9f1 100644
+--- a/drivers/scsi/atari_NCR5380.c
++++ b/drivers/scsi/atari_NCR5380.c
+@@ -2607,7 +2607,7 @@ static void NCR5380_reselect(struct Scsi_Host *instance)
+ * host byte of the result field to, if zero DID_ABORTED is
+ * used.
+ *
+- * Returns : 0 - success, -1 on failure.
++ * Returns : SUCCESS - success, FAILED on failure.
+ *
+ * XXX - there is no way to abort the command that is currently
+ * connected, you have to wait for it to complete. If this is
+diff --git a/drivers/scsi/esas2r/esas2r_main.c b/drivers/scsi/esas2r/esas2r_main.c
+index 6504a195c874..45aa684f8b74 100644
+--- a/drivers/scsi/esas2r/esas2r_main.c
++++ b/drivers/scsi/esas2r/esas2r_main.c
+@@ -1057,7 +1057,7 @@ int esas2r_eh_abort(struct scsi_cmnd *cmd)
+
+ cmd->scsi_done(cmd);
+
+- return 0;
++ return SUCCESS;
+ }
+
+ spin_lock_irqsave(&a->queue_lock, flags);
+diff --git a/drivers/scsi/megaraid.c b/drivers/scsi/megaraid.c
+index ac5d94cfd52f..2485255f3414 100644
+--- a/drivers/scsi/megaraid.c
++++ b/drivers/scsi/megaraid.c
+@@ -1945,7 +1945,7 @@ megaraid_abort_and_reset(adapter_t *adapter, Scsi_Cmnd *cmd, int aor)
+ cmd->device->id, (u32)cmd->device->lun);
+
+ if(list_empty(&adapter->pending_list))
+- return FALSE;
++ return FAILED;
+
+ list_for_each_safe(pos, next, &adapter->pending_list) {
+
+@@ -1968,7 +1968,7 @@ megaraid_abort_and_reset(adapter_t *adapter, Scsi_Cmnd *cmd, int aor)
+ (aor==SCB_ABORT) ? "ABORTING":"RESET",
+ scb->idx);
+
+- return FALSE;
++ return FAILED;
+ }
+ else {
+
+@@ -1993,12 +1993,12 @@ megaraid_abort_and_reset(adapter_t *adapter, Scsi_Cmnd *cmd, int aor)
+ list_add_tail(SCSI_LIST(cmd),
+ &adapter->completed_list);
+
+- return TRUE;
++ return SUCCESS;
+ }
+ }
+ }
+
+- return FALSE;
++ return FAILED;
+ }
+
+ static inline int
+diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c
+index 5640ad1c8214..5e881e5e67b6 100644
+--- a/drivers/scsi/megaraid/megaraid_sas_base.c
++++ b/drivers/scsi/megaraid/megaraid_sas_base.c
+@@ -1008,7 +1008,7 @@ megasas_issue_blocked_abort_cmd(struct megasas_instance *instance,
+ cpu_to_le32(upper_32_bits(cmd_to_abort->frame_phys_addr));
+
+ cmd->sync_cmd = 1;
+- cmd->cmd_status = 0xFF;
++ cmd->cmd_status = ENODATA;
+
+ instance->instancet->issue_dcmd(instance, cmd);
+
+diff --git a/drivers/scsi/megaraid/megaraid_sas_fp.c b/drivers/scsi/megaraid/megaraid_sas_fp.c
+index 685e6f391fe4..0f66d0ef0b26 100644
+--- a/drivers/scsi/megaraid/megaraid_sas_fp.c
++++ b/drivers/scsi/megaraid/megaraid_sas_fp.c
+@@ -183,14 +183,15 @@ void MR_PopulateDrvRaidMap(struct megasas_instance *instance)
+ /* New Raid map will not set totalSize, so keep expected value
+ * for legacy code in ValidateMapInfo
+ */
+- pDrvRaidMap->totalSize = sizeof(struct MR_FW_RAID_MAP_EXT);
++ pDrvRaidMap->totalSize =
++ cpu_to_le32(sizeof(struct MR_FW_RAID_MAP_EXT));
+ } else {
+ fw_map_old = (struct MR_FW_RAID_MAP_ALL *)
+ fusion->ld_map[(instance->map_id & 1)];
+ pFwRaidMap = &fw_map_old->raidMap;
+
+ #if VD_EXT_DEBUG
+- for (i = 0; i < pFwRaidMap->ldCount; i++) {
++ for (i = 0; i < le16_to_cpu(pFwRaidMap->ldCount); i++) {
+ dev_dbg(&instance->pdev->dev, "(%d) :Index 0x%x "
+ "Target Id 0x%x Seq Num 0x%x Size 0/%llx\n",
+ instance->unique_id, i,
+@@ -202,12 +203,12 @@ void MR_PopulateDrvRaidMap(struct megasas_instance *instance)
+
+ memset(drv_map, 0, fusion->drv_map_sz);
+ pDrvRaidMap->totalSize = pFwRaidMap->totalSize;
+- pDrvRaidMap->ldCount = pFwRaidMap->ldCount;
++ pDrvRaidMap->ldCount = (__le16)pFwRaidMap->ldCount;
+ pDrvRaidMap->fpPdIoTimeoutSec = pFwRaidMap->fpPdIoTimeoutSec;
+ for (i = 0; i < MAX_RAIDMAP_LOGICAL_DRIVES + MAX_RAIDMAP_VIEWS; i++)
+ pDrvRaidMap->ldTgtIdToLd[i] =
+ (u8)pFwRaidMap->ldTgtIdToLd[i];
+- for (i = 0; i < pDrvRaidMap->ldCount; i++) {
++ for (i = 0; i < le16_to_cpu(pDrvRaidMap->ldCount); i++) {
+ pDrvRaidMap->ldSpanMap[i] = pFwRaidMap->ldSpanMap[i];
+ #if VD_EXT_DEBUG
+ dev_dbg(&instance->pdev->dev,
+@@ -268,7 +269,7 @@ u8 MR_ValidateMapInfo(struct megasas_instance *instance)
+ else
+ expected_size =
+ (sizeof(struct MR_FW_RAID_MAP) - sizeof(struct MR_LD_SPAN_MAP) +
+- (sizeof(struct MR_LD_SPAN_MAP) * le32_to_cpu(pDrvRaidMap->ldCount)));
++ (sizeof(struct MR_LD_SPAN_MAP) * le16_to_cpu(pDrvRaidMap->ldCount)));
+
+ if (le32_to_cpu(pDrvRaidMap->totalSize) != expected_size) {
+ dev_err(&instance->pdev->dev, "map info structure size 0x%x is not matching with ld count\n",
+@@ -284,7 +285,7 @@ u8 MR_ValidateMapInfo(struct megasas_instance *instance)
+
+ mr_update_load_balance_params(drv_map, lbInfo);
+
+- num_lds = le32_to_cpu(drv_map->raidMap.ldCount);
++ num_lds = le16_to_cpu(drv_map->raidMap.ldCount);
+
+ /*Convert Raid capability values to CPU arch */
+ for (ldCount = 0; ldCount < num_lds; ldCount++) {
+@@ -457,7 +458,7 @@ u32 mr_spanset_get_span_block(struct megasas_instance *instance,
+ quad = &map->raidMap.ldSpanMap[ld].
+ spanBlock[span].
+ block_span_info.quad[info];
+- if (le32_to_cpu(quad->diff == 0))
++ if (le32_to_cpu(quad->diff) == 0)
+ return SPAN_INVALID;
+ if (le64_to_cpu(quad->logStart) <= row &&
+ row <= le64_to_cpu(quad->logEnd) &&
+@@ -520,7 +521,7 @@ static u64 get_row_from_strip(struct megasas_instance *instance,
+ span_set->span_row_data_width) * span_set->diff;
+ for (span = 0, span_offset = 0; span < raid->spanDepth; span++)
+ if (le32_to_cpu(map->raidMap.ldSpanMap[ld].spanBlock[span].
+- block_span_info.noElements >= info+1)) {
++ block_span_info.noElements) >= info+1) {
+ if (strip_offset >=
+ span_set->strip_offset[span])
+ span_offset++;
+diff --git a/drivers/scsi/megaraid/megaraid_sas_fusion.c b/drivers/scsi/megaraid/megaraid_sas_fusion.c
+index f37eed682c75..9d9c27cd4687 100644
+--- a/drivers/scsi/megaraid/megaraid_sas_fusion.c
++++ b/drivers/scsi/megaraid/megaraid_sas_fusion.c
+@@ -880,7 +880,7 @@ megasas_sync_map_info(struct megasas_instance *instance)
+
+ map = fusion->ld_drv_map[instance->map_id & 1];
+
+- num_lds = le32_to_cpu(map->raidMap.ldCount);
++ num_lds = le16_to_cpu(map->raidMap.ldCount);
+
+ dcmd = &cmd->frame->dcmd;
+
+@@ -1173,9 +1173,10 @@ megasas_fire_cmd_fusion(struct megasas_instance *instance,
+ struct megasas_register_set __iomem *regs)
+ {
+ #if defined(writeq) && defined(CONFIG_64BIT)
+- u64 req_data = (((u64)req_desc_hi << 32) | (u32)req_desc_lo);
++ u64 req_data = (((u64)le32_to_cpu(req_desc_hi) << 32) |
++ le32_to_cpu(req_desc_lo));
+
+- writeq(le64_to_cpu(req_data), &(regs)->inbound_low_queue_port);
++ writeq(req_data, &(regs)->inbound_low_queue_port);
+ #else
+ unsigned long flags;
+
+@@ -1373,7 +1374,7 @@ megasas_set_pd_lba(struct MPI2_RAID_SCSI_IO_REQUEST *io_request, u8 cdb_len,
+ /* Logical block reference tag */
+ io_request->CDB.EEDP32.PrimaryReferenceTag =
+ cpu_to_be32(ref_tag);
+- io_request->CDB.EEDP32.PrimaryApplicationTagMask = 0xffff;
++ io_request->CDB.EEDP32.PrimaryApplicationTagMask = cpu_to_be16(0xffff);
+ io_request->IoFlags = cpu_to_le16(32); /* Specify 32-byte cdb */
+
+ /* Transfer length */
+@@ -1769,7 +1770,7 @@ megasas_build_dcdb_fusion(struct megasas_instance *instance,
+
+ /* set RAID context values */
+ pRAID_Context->regLockFlags = REGION_TYPE_SHARED_READ;
+- pRAID_Context->timeoutValue = raid->fpIoTimeoutForLd;
++ pRAID_Context->timeoutValue = cpu_to_le16(raid->fpIoTimeoutForLd);
+ pRAID_Context->VirtualDiskTgtId = cpu_to_le16(device_id);
+ pRAID_Context->regLockRowLBA = 0;
+ pRAID_Context->regLockLength = 0;
+@@ -2254,7 +2255,7 @@ build_mpt_mfi_pass_thru(struct megasas_instance *instance,
+ * megasas_complete_cmd
+ */
+
+- if (frame_hdr->flags & MFI_FRAME_DONT_POST_IN_REPLY_QUEUE)
++ if (frame_hdr->flags & cpu_to_le16(MFI_FRAME_DONT_POST_IN_REPLY_QUEUE))
+ cmd->flags = MFI_FRAME_DONT_POST_IN_REPLY_QUEUE;
+
+ fusion = instance->ctrl_context;
+diff --git a/drivers/scsi/sun3_NCR5380.c b/drivers/scsi/sun3_NCR5380.c
+index 1a2367a1b1f2..6d248a299bc4 100644
+--- a/drivers/scsi/sun3_NCR5380.c
++++ b/drivers/scsi/sun3_NCR5380.c
+@@ -2590,15 +2590,15 @@ static void NCR5380_reselect (struct Scsi_Host *instance)
+ * Purpose : abort a command
+ *
+ * Inputs : cmd - the struct scsi_cmnd to abort, code - code to set the
+- * host byte of the result field to, if zero DID_ABORTED is
++ * host byte of the result field to, if zero DID_ABORTED is
+ * used.
+ *
+- * Returns : 0 - success, -1 on failure.
++ * Returns : SUCCESS - success, FAILED on failure.
+ *
+- * XXX - there is no way to abort the command that is currently
+- * connected, you have to wait for it to complete. If this is
++ * XXX - there is no way to abort the command that is currently
++ * connected, you have to wait for it to complete. If this is
+ * a problem, we could implement longjmp() / setjmp(), setjmp()
+- * called where the loop started in NCR5380_main().
++ * called where the loop started in NCR5380_main().
+ */
+
+ static int NCR5380_abort(struct scsi_cmnd *cmd)
+diff --git a/drivers/thermal/thermal_core.c b/drivers/thermal/thermal_core.c
+index 43b90709585f..488e9bfd996b 100644
+--- a/drivers/thermal/thermal_core.c
++++ b/drivers/thermal/thermal_core.c
+@@ -1835,10 +1835,10 @@ static int __init thermal_init(void)
+
+ exit_netlink:
+ genetlink_exit();
+-unregister_governors:
+- thermal_unregister_governors();
+ unregister_class:
+ class_unregister(&thermal_class);
++unregister_governors:
++ thermal_unregister_governors();
+ error:
+ idr_destroy(&thermal_tz_idr);
+ idr_destroy(&thermal_cdev_idr);
+diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
+index 1bf9f897065d..97676731190c 100644
+--- a/fs/btrfs/disk-io.c
++++ b/fs/btrfs/disk-io.c
+@@ -4106,12 +4106,6 @@ again:
+ if (ret)
+ break;
+
+- /* opt_discard */
+- if (btrfs_test_opt(root, DISCARD))
+- ret = btrfs_error_discard_extent(root, start,
+- end + 1 - start,
+- NULL);
+-
+ clear_extent_dirty(unpin, start, end, GFP_NOFS);
+ btrfs_error_unpin_extent_range(root, start, end);
+ cond_resched();
+@@ -4129,6 +4123,25 @@ again:
+ return 0;
+ }
+
++static void btrfs_free_pending_ordered(struct btrfs_transaction *cur_trans,
++ struct btrfs_fs_info *fs_info)
++{
++ struct btrfs_ordered_extent *ordered;
++
++ spin_lock(&fs_info->trans_lock);
++ while (!list_empty(&cur_trans->pending_ordered)) {
++ ordered = list_first_entry(&cur_trans->pending_ordered,
++ struct btrfs_ordered_extent,
++ trans_list);
++ list_del_init(&ordered->trans_list);
++ spin_unlock(&fs_info->trans_lock);
++
++ btrfs_put_ordered_extent(ordered);
++ spin_lock(&fs_info->trans_lock);
++ }
++ spin_unlock(&fs_info->trans_lock);
++}
++
+ void btrfs_cleanup_one_transaction(struct btrfs_transaction *cur_trans,
+ struct btrfs_root *root)
+ {
+@@ -4140,6 +4153,7 @@ void btrfs_cleanup_one_transaction(struct btrfs_transaction *cur_trans,
+ cur_trans->state = TRANS_STATE_UNBLOCKED;
+ wake_up(&root->fs_info->transaction_wait);
+
++ btrfs_free_pending_ordered(cur_trans, root->fs_info);
+ btrfs_destroy_delayed_inodes(root);
+ btrfs_assert_delayed_root_empty(root);
+
+diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
+index 47c1ba141082..4bd5e06fa5ab 100644
+--- a/fs/btrfs/extent-tree.c
++++ b/fs/btrfs/extent-tree.c
+@@ -5715,7 +5715,8 @@ void btrfs_prepare_extent_commit(struct btrfs_trans_handle *trans,
+ update_global_block_rsv(fs_info);
+ }
+
+-static int unpin_extent_range(struct btrfs_root *root, u64 start, u64 end)
++static int unpin_extent_range(struct btrfs_root *root, u64 start, u64 end,
++ const bool return_free_space)
+ {
+ struct btrfs_fs_info *fs_info = root->fs_info;
+ struct btrfs_block_group_cache *cache = NULL;
+@@ -5739,7 +5740,8 @@ static int unpin_extent_range(struct btrfs_root *root, u64 start, u64 end)
+
+ if (start < cache->last_byte_to_unpin) {
+ len = min(len, cache->last_byte_to_unpin - start);
+- btrfs_add_free_space(cache, start, len);
++ if (return_free_space)
++ btrfs_add_free_space(cache, start, len);
+ }
+
+ start += len;
+@@ -5803,7 +5805,7 @@ int btrfs_finish_extent_commit(struct btrfs_trans_handle *trans,
+ end + 1 - start, NULL);
+
+ clear_extent_dirty(unpin, start, end, GFP_NOFS);
+- unpin_extent_range(root, start, end);
++ unpin_extent_range(root, start, end, true);
+ cond_resched();
+ }
+
+@@ -9585,7 +9587,7 @@ out:
+
+ int btrfs_error_unpin_extent_range(struct btrfs_root *root, u64 start, u64 end)
+ {
+- return unpin_extent_range(root, start, end);
++ return unpin_extent_range(root, start, end, false);
+ }
+
+ int btrfs_error_discard_extent(struct btrfs_root *root, u64 bytenr,
+diff --git a/fs/btrfs/extent_map.c b/fs/btrfs/extent_map.c
+index 225302b39afb..6a98bddd8f33 100644
+--- a/fs/btrfs/extent_map.c
++++ b/fs/btrfs/extent_map.c
+@@ -287,8 +287,6 @@ int unpin_extent_cache(struct extent_map_tree *tree, u64 start, u64 len,
+ if (!em)
+ goto out;
+
+- if (!test_bit(EXTENT_FLAG_LOGGING, &em->flags))
+- list_move(&em->list, &tree->modified_extents);
+ em->generation = gen;
+ clear_bit(EXTENT_FLAG_PINNED, &em->flags);
+ em->mod_start = em->start;
+diff --git a/fs/btrfs/ordered-data.c b/fs/btrfs/ordered-data.c
+index ac734ec4cc20..269e21dd1506 100644
+--- a/fs/btrfs/ordered-data.c
++++ b/fs/btrfs/ordered-data.c
+@@ -220,6 +220,7 @@ static int __btrfs_add_ordered_extent(struct inode *inode, u64 file_offset,
+ INIT_LIST_HEAD(&entry->work_list);
+ init_completion(&entry->completion);
+ INIT_LIST_HEAD(&entry->log_list);
++ INIT_LIST_HEAD(&entry->trans_list);
+
+ trace_btrfs_ordered_extent_add(inode, entry);
+
+@@ -443,6 +444,8 @@ void btrfs_get_logged_extents(struct inode *inode,
+ ordered = rb_entry(n, struct btrfs_ordered_extent, rb_node);
+ if (!list_empty(&ordered->log_list))
+ continue;
++ if (test_bit(BTRFS_ORDERED_LOGGED, &ordered->flags))
++ continue;
+ list_add_tail(&ordered->log_list, logged_list);
+ atomic_inc(&ordered->refs);
+ }
+@@ -472,7 +475,8 @@ void btrfs_submit_logged_extents(struct list_head *logged_list,
+ spin_unlock_irq(&log->log_extents_lock[index]);
+ }
+
+-void btrfs_wait_logged_extents(struct btrfs_root *log, u64 transid)
++void btrfs_wait_logged_extents(struct btrfs_trans_handle *trans,
++ struct btrfs_root *log, u64 transid)
+ {
+ struct btrfs_ordered_extent *ordered;
+ int index = transid % 2;
+@@ -497,7 +501,8 @@ void btrfs_wait_logged_extents(struct btrfs_root *log, u64 transid)
+ wait_event(ordered->wait, test_bit(BTRFS_ORDERED_IO_DONE,
+ &ordered->flags));
+
+- btrfs_put_ordered_extent(ordered);
++ if (!test_and_set_bit(BTRFS_ORDERED_LOGGED, &ordered->flags))
++ list_add_tail(&ordered->trans_list, &trans->ordered);
+ spin_lock_irq(&log->log_extents_lock[index]);
+ }
+ spin_unlock_irq(&log->log_extents_lock[index]);
+diff --git a/fs/btrfs/ordered-data.h b/fs/btrfs/ordered-data.h
+index d81a274d621e..0124bffc775f 100644
+--- a/fs/btrfs/ordered-data.h
++++ b/fs/btrfs/ordered-data.h
+@@ -71,6 +71,8 @@ struct btrfs_ordered_sum {
+ ordered extent */
+ #define BTRFS_ORDERED_TRUNCATED 9 /* Set when we have to truncate an extent */
+
++#define BTRFS_ORDERED_LOGGED 10 /* Set when we've waited on this ordered extent
++ * in the logging code. */
+ struct btrfs_ordered_extent {
+ /* logical offset in the file */
+ u64 file_offset;
+@@ -121,6 +123,9 @@ struct btrfs_ordered_extent {
+ /* If we need to wait on this to be done */
+ struct list_head log_list;
+
++ /* If the transaction needs to wait on this ordered extent */
++ struct list_head trans_list;
++
+ /* used to wait for the BTRFS_ORDERED_COMPLETE bit */
+ wait_queue_head_t wait;
+
+@@ -197,7 +202,8 @@ void btrfs_get_logged_extents(struct inode *inode,
+ void btrfs_put_logged_extents(struct list_head *logged_list);
+ void btrfs_submit_logged_extents(struct list_head *logged_list,
+ struct btrfs_root *log);
+-void btrfs_wait_logged_extents(struct btrfs_root *log, u64 transid);
++void btrfs_wait_logged_extents(struct btrfs_trans_handle *trans,
++ struct btrfs_root *log, u64 transid);
+ void btrfs_free_logged_extents(struct btrfs_root *log, u64 transid);
+ int __init ordered_data_init(void);
+ void ordered_data_exit(void);
+diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c
+index 54bd91ece35b..cde9c03e3913 100644
+--- a/fs/btrfs/super.c
++++ b/fs/btrfs/super.c
+@@ -1824,7 +1824,7 @@ static int btrfs_statfs(struct dentry *dentry, struct kstatfs *buf)
+ buf->f_bfree -= block_rsv->size >> bits;
+ spin_unlock(&block_rsv->lock);
+
+- buf->f_bavail = total_free_data;
++ buf->f_bavail = div_u64(total_free_data, factor);
+ ret = btrfs_calc_avail_data_space(fs_info->tree_root, &total_free_data);
+ if (ret) {
+ mutex_unlock(&fs_info->chunk_mutex);
+diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c
+index dcaae3616728..63c6d05950f2 100644
+--- a/fs/btrfs/transaction.c
++++ b/fs/btrfs/transaction.c
+@@ -220,6 +220,7 @@ loop:
+ INIT_LIST_HEAD(&cur_trans->pending_snapshots);
+ INIT_LIST_HEAD(&cur_trans->pending_chunks);
+ INIT_LIST_HEAD(&cur_trans->switch_commits);
++ INIT_LIST_HEAD(&cur_trans->pending_ordered);
+ list_add_tail(&cur_trans->list, &fs_info->trans_list);
+ extent_io_tree_init(&cur_trans->dirty_pages,
+ fs_info->btree_inode->i_mapping);
+@@ -488,6 +489,7 @@ again:
+ h->sync = false;
+ INIT_LIST_HEAD(&h->qgroup_ref_list);
+ INIT_LIST_HEAD(&h->new_bgs);
++ INIT_LIST_HEAD(&h->ordered);
+
+ smp_mb();
+ if (cur_trans->state >= TRANS_STATE_BLOCKED &&
+@@ -719,6 +721,12 @@ static int __btrfs_end_transaction(struct btrfs_trans_handle *trans,
+ if (!list_empty(&trans->new_bgs))
+ btrfs_create_pending_block_groups(trans, root);
+
++ if (!list_empty(&trans->ordered)) {
++ spin_lock(&info->trans_lock);
++ list_splice(&trans->ordered, &cur_trans->pending_ordered);
++ spin_unlock(&info->trans_lock);
++ }
++
+ trans->delayed_ref_updates = 0;
+ if (!trans->sync) {
+ must_run_delayed_refs =
+@@ -1652,6 +1660,28 @@ static inline void btrfs_wait_delalloc_flush(struct btrfs_fs_info *fs_info)
+ btrfs_wait_ordered_roots(fs_info, -1);
+ }
+
++static inline void
++btrfs_wait_pending_ordered(struct btrfs_transaction *cur_trans,
++ struct btrfs_fs_info *fs_info)
++{
++ struct btrfs_ordered_extent *ordered;
++
++ spin_lock(&fs_info->trans_lock);
++ while (!list_empty(&cur_trans->pending_ordered)) {
++ ordered = list_first_entry(&cur_trans->pending_ordered,
++ struct btrfs_ordered_extent,
++ trans_list);
++ list_del_init(&ordered->trans_list);
++ spin_unlock(&fs_info->trans_lock);
++
++ wait_event(ordered->wait, test_bit(BTRFS_ORDERED_COMPLETE,
++ &ordered->flags));
++ btrfs_put_ordered_extent(ordered);
++ spin_lock(&fs_info->trans_lock);
++ }
++ spin_unlock(&fs_info->trans_lock);
++}
++
+ int btrfs_commit_transaction(struct btrfs_trans_handle *trans,
+ struct btrfs_root *root)
+ {
+@@ -1702,6 +1732,7 @@ int btrfs_commit_transaction(struct btrfs_trans_handle *trans,
+ }
+
+ spin_lock(&root->fs_info->trans_lock);
++ list_splice(&trans->ordered, &cur_trans->pending_ordered);
+ if (cur_trans->state >= TRANS_STATE_COMMIT_START) {
+ spin_unlock(&root->fs_info->trans_lock);
+ atomic_inc(&cur_trans->use_count);
+@@ -1754,6 +1785,8 @@ int btrfs_commit_transaction(struct btrfs_trans_handle *trans,
+
+ btrfs_wait_delalloc_flush(root->fs_info);
+
++ btrfs_wait_pending_ordered(cur_trans, root->fs_info);
++
+ btrfs_scrub_pause(root);
+ /*
+ * Ok now we need to make sure to block out any other joins while we
+diff --git a/fs/btrfs/transaction.h b/fs/btrfs/transaction.h
+index d8f40e1a5d2d..1ba9c3e04191 100644
+--- a/fs/btrfs/transaction.h
++++ b/fs/btrfs/transaction.h
+@@ -56,6 +56,7 @@ struct btrfs_transaction {
+ wait_queue_head_t commit_wait;
+ struct list_head pending_snapshots;
+ struct list_head pending_chunks;
++ struct list_head pending_ordered;
+ struct list_head switch_commits;
+ struct btrfs_delayed_ref_root delayed_refs;
+ int aborted;
+@@ -105,6 +106,7 @@ struct btrfs_trans_handle {
+ */
+ struct btrfs_root *root;
+ struct seq_list delayed_ref_elem;
++ struct list_head ordered;
+ struct list_head qgroup_ref_list;
+ struct list_head new_bgs;
+ };
+diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
+index 286213cec861..7d96cc961663 100644
+--- a/fs/btrfs/tree-log.c
++++ b/fs/btrfs/tree-log.c
+@@ -2600,9 +2600,9 @@ int btrfs_sync_log(struct btrfs_trans_handle *trans,
+ if (atomic_read(&log_root_tree->log_commit[index2])) {
+ blk_finish_plug(&plug);
+ btrfs_wait_marked_extents(log, &log->dirty_log_pages, mark);
++ btrfs_wait_logged_extents(trans, log, log_transid);
+ wait_log_commit(trans, log_root_tree,
+ root_log_ctx.log_transid);
+- btrfs_free_logged_extents(log, log_transid);
+ mutex_unlock(&log_root_tree->log_mutex);
+ ret = root_log_ctx.log_ret;
+ goto out;
+@@ -2645,7 +2645,7 @@ int btrfs_sync_log(struct btrfs_trans_handle *trans,
+ btrfs_wait_marked_extents(log_root_tree,
+ &log_root_tree->dirty_log_pages,
+ EXTENT_NEW | EXTENT_DIRTY);
+- btrfs_wait_logged_extents(log, log_transid);
++ btrfs_wait_logged_extents(trans, log, log_transid);
+
+ btrfs_set_super_log_root(root->fs_info->super_for_commit,
+ log_root_tree->node->start);
+@@ -3766,7 +3766,7 @@ static int log_one_extent(struct btrfs_trans_handle *trans,
+ fi = btrfs_item_ptr(leaf, path->slots[0],
+ struct btrfs_file_extent_item);
+
+- btrfs_set_token_file_extent_generation(leaf, fi, em->generation,
++ btrfs_set_token_file_extent_generation(leaf, fi, trans->transid,
+ &token);
+ if (test_bit(EXTENT_FLAG_PREALLOC, &em->flags))
+ btrfs_set_token_file_extent_type(leaf, fi,
+diff --git a/fs/dcache.c b/fs/dcache.c
+index 71acf8d6f2be..03dca3cad918 100644
+--- a/fs/dcache.c
++++ b/fs/dcache.c
+@@ -2393,6 +2393,8 @@ static void swap_names(struct dentry *dentry, struct dentry *target)
+ */
+ unsigned int i;
+ BUILD_BUG_ON(!IS_ALIGNED(DNAME_INLINE_LEN, sizeof(long)));
++ kmemcheck_mark_initialized(dentry->d_iname, DNAME_INLINE_LEN);
++ kmemcheck_mark_initialized(target->d_iname, DNAME_INLINE_LEN);
+ for (i = 0; i < DNAME_INLINE_LEN / sizeof(long); i++) {
+ swap(((long *) &dentry->d_iname)[i],
+ ((long *) &target->d_iname)[i]);
+diff --git a/fs/ecryptfs/crypto.c b/fs/ecryptfs/crypto.c
+index 2f6735dbf1a9..31b148f3e772 100644
+--- a/fs/ecryptfs/crypto.c
++++ b/fs/ecryptfs/crypto.c
+@@ -1917,7 +1917,6 @@ ecryptfs_decode_from_filename(unsigned char *dst, size_t *dst_size,
+ break;
+ case 2:
+ dst[dst_byte_offset++] |= (src_byte);
+- dst[dst_byte_offset] = 0;
+ current_bit_offset = 0;
+ break;
+ }
+diff --git a/fs/ecryptfs/file.c b/fs/ecryptfs/file.c
+index f5bce9096555..54742f9a67a8 100644
+--- a/fs/ecryptfs/file.c
++++ b/fs/ecryptfs/file.c
+@@ -190,23 +190,11 @@ static int ecryptfs_open(struct inode *inode, struct file *file)
+ {
+ int rc = 0;
+ struct ecryptfs_crypt_stat *crypt_stat = NULL;
+- struct ecryptfs_mount_crypt_stat *mount_crypt_stat;
+ struct dentry *ecryptfs_dentry = file->f_path.dentry;
+ /* Private value of ecryptfs_dentry allocated in
+ * ecryptfs_lookup() */
+ struct ecryptfs_file_info *file_info;
+
+- mount_crypt_stat = &ecryptfs_superblock_to_private(
+- ecryptfs_dentry->d_sb)->mount_crypt_stat;
+- if ((mount_crypt_stat->flags & ECRYPTFS_ENCRYPTED_VIEW_ENABLED)
+- && ((file->f_flags & O_WRONLY) || (file->f_flags & O_RDWR)
+- || (file->f_flags & O_CREAT) || (file->f_flags & O_TRUNC)
+- || (file->f_flags & O_APPEND))) {
+- printk(KERN_WARNING "Mount has encrypted view enabled; "
+- "files may only be read\n");
+- rc = -EPERM;
+- goto out;
+- }
+ /* Released in ecryptfs_release or end of function if failure */
+ file_info = kmem_cache_zalloc(ecryptfs_file_info_cache, GFP_KERNEL);
+ ecryptfs_set_file_private(file, file_info);
+diff --git a/fs/ecryptfs/main.c b/fs/ecryptfs/main.c
+index c4cd1fd86cc2..d9eb84bda559 100644
+--- a/fs/ecryptfs/main.c
++++ b/fs/ecryptfs/main.c
+@@ -493,6 +493,7 @@ static struct dentry *ecryptfs_mount(struct file_system_type *fs_type, int flags
+ {
+ struct super_block *s;
+ struct ecryptfs_sb_info *sbi;
++ struct ecryptfs_mount_crypt_stat *mount_crypt_stat;
+ struct ecryptfs_dentry_info *root_info;
+ const char *err = "Getting sb failed";
+ struct inode *inode;
+@@ -511,6 +512,7 @@ static struct dentry *ecryptfs_mount(struct file_system_type *fs_type, int flags
+ err = "Error parsing options";
+ goto out;
+ }
++ mount_crypt_stat = &sbi->mount_crypt_stat;
+
+ s = sget(fs_type, NULL, set_anon_super, flags, NULL);
+ if (IS_ERR(s)) {
+@@ -557,11 +559,19 @@ static struct dentry *ecryptfs_mount(struct file_system_type *fs_type, int flags
+
+ /**
+ * Set the POSIX ACL flag based on whether they're enabled in the lower
+- * mount. Force a read-only eCryptfs mount if the lower mount is ro.
+- * Allow a ro eCryptfs mount even when the lower mount is rw.
++ * mount.
+ */
+ s->s_flags = flags & ~MS_POSIXACL;
+- s->s_flags |= path.dentry->d_sb->s_flags & (MS_RDONLY | MS_POSIXACL);
++ s->s_flags |= path.dentry->d_sb->s_flags & MS_POSIXACL;
++
++ /**
++ * Force a read-only eCryptfs mount when:
++ * 1) The lower mount is ro
++ * 2) The ecryptfs_encrypted_view mount option is specified
++ */
++ if (path.dentry->d_sb->s_flags & MS_RDONLY ||
++ mount_crypt_stat->flags & ECRYPTFS_ENCRYPTED_VIEW_ENABLED)
++ s->s_flags |= MS_RDONLY;
+
+ s->s_maxbytes = path.dentry->d_sb->s_maxbytes;
+ s->s_blocksize = path.dentry->d_sb->s_blocksize;
+diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c
+index 8e58c4cc2cb9..f988b01b6f89 100644
+--- a/fs/f2fs/data.c
++++ b/fs/f2fs/data.c
+@@ -1007,21 +1007,19 @@ inline_data:
+ goto out;
+ }
+
+- if (dn.data_blkaddr == NEW_ADDR) {
++ if (f2fs_has_inline_data(inode)) {
++ err = f2fs_read_inline_data(inode, page);
++ if (err) {
++ page_cache_release(page);
++ goto fail;
++ }
++ } else if (dn.data_blkaddr == NEW_ADDR) {
+ zero_user_segment(page, 0, PAGE_CACHE_SIZE);
+ } else {
+- if (f2fs_has_inline_data(inode)) {
+- err = f2fs_read_inline_data(inode, page);
+- if (err) {
+- page_cache_release(page);
+- goto fail;
+- }
+- } else {
+- err = f2fs_submit_page_bio(sbi, page, dn.data_blkaddr,
+- READ_SYNC);
+- if (err)
+- goto fail;
+- }
++ err = f2fs_submit_page_bio(sbi, page, dn.data_blkaddr,
++ READ_SYNC);
++ if (err)
++ goto fail;
+
+ lock_page(page);
+ if (unlikely(!PageUptodate(page))) {
+diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c
+index 923cb76fdc46..3c31221affe6 100644
+--- a/fs/f2fs/segment.c
++++ b/fs/f2fs/segment.c
+@@ -1004,6 +1004,7 @@ int f2fs_trim_fs(struct f2fs_sb_info *sbi, struct fstrim_range *range)
+ range->len < sbi->blocksize)
+ return -EINVAL;
+
++ cpc.trimmed = 0;
+ if (end <= MAIN_BLKADDR(sbi))
+ goto out;
+
+@@ -1015,7 +1016,6 @@ int f2fs_trim_fs(struct f2fs_sb_info *sbi, struct fstrim_range *range)
+ cpc.trim_start = start_segno;
+ cpc.trim_end = end_segno;
+ cpc.trim_minlen = range->minlen >> sbi->log_blocksize;
+- cpc.trimmed = 0;
+
+ /* do checkpoint to issue discard commands safely */
+ write_checkpoint(sbi, &cpc);
+diff --git a/fs/isofs/rock.c b/fs/isofs/rock.c
+index f488bbae541a..735d7522a3a9 100644
+--- a/fs/isofs/rock.c
++++ b/fs/isofs/rock.c
+@@ -30,6 +30,7 @@ struct rock_state {
+ int cont_size;
+ int cont_extent;
+ int cont_offset;
++ int cont_loops;
+ struct inode *inode;
+ };
+
+@@ -73,6 +74,9 @@ static void init_rock_state(struct rock_state *rs, struct inode *inode)
+ rs->inode = inode;
+ }
+
++/* Maximum number of Rock Ridge continuation entries */
++#define RR_MAX_CE_ENTRIES 32
++
+ /*
+ * Returns 0 if the caller should continue scanning, 1 if the scan must end
+ * and -ve on error.
+@@ -105,6 +109,8 @@ static int rock_continue(struct rock_state *rs)
+ goto out;
+ }
+ ret = -EIO;
++ if (++rs->cont_loops >= RR_MAX_CE_ENTRIES)
++ goto out;
+ bh = sb_bread(rs->inode->i_sb, rs->cont_extent);
+ if (bh) {
+ memcpy(rs->buffer, bh->b_data + rs->cont_offset,
+@@ -356,6 +362,9 @@ repeat:
+ rs.cont_size = isonum_733(rr->u.CE.size);
+ break;
+ case SIG('E', 'R'):
++ /* Invalid length of ER tag id? */
++ if (rr->u.ER.len_id + offsetof(struct rock_ridge, u.ER.data) > rr->len)
++ goto out;
+ ISOFS_SB(inode->i_sb)->s_rock = 1;
+ printk(KERN_DEBUG "ISO 9660 Extensions: ");
+ {
+diff --git a/fs/namespace.c b/fs/namespace.c
+index 5b66b2b3624d..bbde14719655 100644
+--- a/fs/namespace.c
++++ b/fs/namespace.c
+@@ -1369,6 +1369,8 @@ void umount_tree(struct mount *mnt, int how)
+ }
+ if (last) {
+ last->mnt_hash.next = unmounted.first;
++ if (unmounted.first)
++ unmounted.first->pprev = &last->mnt_hash.next;
+ unmounted.first = tmp_list.first;
+ unmounted.first->pprev = &unmounted.first;
+ }
+@@ -1544,6 +1546,9 @@ SYSCALL_DEFINE2(umount, char __user *, name, int, flags)
+ goto dput_and_out;
+ if (mnt->mnt.mnt_flags & MNT_LOCKED)
+ goto dput_and_out;
++ retval = -EPERM;
++ if (flags & MNT_FORCE && !capable(CAP_SYS_ADMIN))
++ goto dput_and_out;
+
+ retval = do_umount(mnt, flags);
+ dput_and_out:
+@@ -2098,7 +2103,13 @@ static int do_remount(struct path *path, int flags, int mnt_flags,
+ }
+ if ((mnt->mnt.mnt_flags & MNT_LOCK_NODEV) &&
+ !(mnt_flags & MNT_NODEV)) {
+- return -EPERM;
++ /* Was the nodev implicitly added in mount? */
++ if ((mnt->mnt_ns->user_ns != &init_user_ns) &&
++ !(sb->s_type->fs_flags & FS_USERNS_DEV_MOUNT)) {
++ mnt_flags |= MNT_NODEV;
++ } else {
++ return -EPERM;
++ }
+ }
+ if ((mnt->mnt.mnt_flags & MNT_LOCK_NOSUID) &&
+ !(mnt_flags & MNT_NOSUID)) {
+diff --git a/fs/ncpfs/ioctl.c b/fs/ncpfs/ioctl.c
+index d5659d96ee7f..cf7e043a9447 100644
+--- a/fs/ncpfs/ioctl.c
++++ b/fs/ncpfs/ioctl.c
+@@ -447,7 +447,6 @@ static long __ncp_ioctl(struct inode *inode, unsigned int cmd, unsigned long arg
+ result = -EIO;
+ }
+ }
+- result = 0;
+ }
+ mutex_unlock(&server->root_setup_lock);
+
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index 69dc20a743f9..83f3a7d7466e 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -7704,6 +7704,9 @@ nfs4_proc_layoutget(struct nfs4_layoutget *lgp, gfp_t gfp_flags)
+
+ dprintk("--> %s\n", __func__);
+
++ /* nfs4_layoutget_release calls pnfs_put_layout_hdr */
++ pnfs_get_layout_hdr(NFS_I(inode)->layout);
++
+ lgp->args.layout.pages = nfs4_alloc_pages(max_pages, gfp_flags);
+ if (!lgp->args.layout.pages) {
+ nfs4_layoutget_release(lgp);
+@@ -7716,9 +7719,6 @@ nfs4_proc_layoutget(struct nfs4_layoutget *lgp, gfp_t gfp_flags)
+ lgp->res.seq_res.sr_slot = NULL;
+ nfs4_init_sequence(&lgp->args.seq_args, &lgp->res.seq_res, 0);
+
+- /* nfs4_layoutget_release calls pnfs_put_layout_hdr */
+- pnfs_get_layout_hdr(NFS_I(inode)->layout);
+-
+ task = rpc_run_task(&task_setup_data);
+ if (IS_ERR(task))
+ return ERR_CAST(task);
+diff --git a/fs/proc/base.c b/fs/proc/base.c
+index 772efa45a452..7dc3ea89ef1a 100644
+--- a/fs/proc/base.c
++++ b/fs/proc/base.c
+@@ -2464,6 +2464,57 @@ static const struct file_operations proc_projid_map_operations = {
+ .llseek = seq_lseek,
+ .release = proc_id_map_release,
+ };
++
++static int proc_setgroups_open(struct inode *inode, struct file *file)
++{
++ struct user_namespace *ns = NULL;
++ struct task_struct *task;
++ int ret;
++
++ ret = -ESRCH;
++ task = get_proc_task(inode);
++ if (task) {
++ rcu_read_lock();
++ ns = get_user_ns(task_cred_xxx(task, user_ns));
++ rcu_read_unlock();
++ put_task_struct(task);
++ }
++ if (!ns)
++ goto err;
++
++ if (file->f_mode & FMODE_WRITE) {
++ ret = -EACCES;
++ if (!ns_capable(ns, CAP_SYS_ADMIN))
++ goto err_put_ns;
++ }
++
++ ret = single_open(file, &proc_setgroups_show, ns);
++ if (ret)
++ goto err_put_ns;
++
++ return 0;
++err_put_ns:
++ put_user_ns(ns);
++err:
++ return ret;
++}
++
++static int proc_setgroups_release(struct inode *inode, struct file *file)
++{
++ struct seq_file *seq = file->private_data;
++ struct user_namespace *ns = seq->private;
++ int ret = single_release(inode, file);
++ put_user_ns(ns);
++ return ret;
++}
++
++static const struct file_operations proc_setgroups_operations = {
++ .open = proc_setgroups_open,
++ .write = proc_setgroups_write,
++ .read = seq_read,
++ .llseek = seq_lseek,
++ .release = proc_setgroups_release,
++};
+ #endif /* CONFIG_USER_NS */
+
+ static int proc_pid_personality(struct seq_file *m, struct pid_namespace *ns,
+@@ -2572,6 +2623,7 @@ static const struct pid_entry tgid_base_stuff[] = {
+ REG("uid_map", S_IRUGO|S_IWUSR, proc_uid_map_operations),
+ REG("gid_map", S_IRUGO|S_IWUSR, proc_gid_map_operations),
+ REG("projid_map", S_IRUGO|S_IWUSR, proc_projid_map_operations),
++ REG("setgroups", S_IRUGO|S_IWUSR, proc_setgroups_operations),
+ #endif
+ #ifdef CONFIG_CHECKPOINT_RESTORE
+ REG("timers", S_IRUGO, proc_timers_operations),
+@@ -2913,6 +2965,7 @@ static const struct pid_entry tid_base_stuff[] = {
+ REG("uid_map", S_IRUGO|S_IWUSR, proc_uid_map_operations),
+ REG("gid_map", S_IRUGO|S_IWUSR, proc_gid_map_operations),
+ REG("projid_map", S_IRUGO|S_IWUSR, proc_projid_map_operations),
++ REG("setgroups", S_IRUGO|S_IWUSR, proc_setgroups_operations),
+ #endif
+ };
+
+diff --git a/fs/udf/dir.c b/fs/udf/dir.c
+index a012c51caffd..a7690b46ce0a 100644
+--- a/fs/udf/dir.c
++++ b/fs/udf/dir.c
+@@ -167,7 +167,8 @@ static int udf_readdir(struct file *file, struct dir_context *ctx)
+ continue;
+ }
+
+- flen = udf_get_filename(dir->i_sb, nameptr, fname, lfi);
++ flen = udf_get_filename(dir->i_sb, nameptr, lfi, fname,
++ UDF_NAME_LEN);
+ if (!flen)
+ continue;
+
+diff --git a/fs/udf/inode.c b/fs/udf/inode.c
+index c9b4df5810d5..5bc71d9a674a 100644
+--- a/fs/udf/inode.c
++++ b/fs/udf/inode.c
+@@ -1489,6 +1489,20 @@ reread:
+ }
+ inode->i_generation = iinfo->i_unique;
+
++ /* Sanity checks for files in ICB so that we don't get confused later */
++ if (iinfo->i_alloc_type == ICBTAG_FLAG_AD_IN_ICB) {
++ /*
++ * For file in ICB data is stored in allocation descriptor
++ * so sizes should match
++ */
++ if (iinfo->i_lenAlloc != inode->i_size)
++ goto out;
++ /* File in ICB has to fit in there... */
++ if (inode->i_size > inode->i_sb->s_blocksize -
++ udf_file_entry_alloc_offset(inode))
++ goto out;
++ }
++
+ switch (fe->icbTag.fileType) {
+ case ICBTAG_FILE_TYPE_DIRECTORY:
+ inode->i_op = &udf_dir_inode_operations;
+diff --git a/fs/udf/namei.c b/fs/udf/namei.c
+index c12e260fd6c4..6ff19b54b51f 100644
+--- a/fs/udf/namei.c
++++ b/fs/udf/namei.c
+@@ -233,7 +233,8 @@ static struct fileIdentDesc *udf_find_entry(struct inode *dir,
+ if (!lfi)
+ continue;
+
+- flen = udf_get_filename(dir->i_sb, nameptr, fname, lfi);
++ flen = udf_get_filename(dir->i_sb, nameptr, lfi, fname,
++ UDF_NAME_LEN);
+ if (flen && udf_match(flen, fname, child->len, child->name))
+ goto out_ok;
+ }
+diff --git a/fs/udf/symlink.c b/fs/udf/symlink.c
+index 6fb7945c1e6e..ac10ca939f26 100644
+--- a/fs/udf/symlink.c
++++ b/fs/udf/symlink.c
+@@ -30,49 +30,73 @@
+ #include <linux/buffer_head.h>
+ #include "udf_i.h"
+
+-static void udf_pc_to_char(struct super_block *sb, unsigned char *from,
+- int fromlen, unsigned char *to)
++static int udf_pc_to_char(struct super_block *sb, unsigned char *from,
++ int fromlen, unsigned char *to, int tolen)
+ {
+ struct pathComponent *pc;
+ int elen = 0;
++ int comp_len;
+ unsigned char *p = to;
+
++ /* Reserve one byte for terminating \0 */
++ tolen--;
+ while (elen < fromlen) {
+ pc = (struct pathComponent *)(from + elen);
++ elen += sizeof(struct pathComponent);
+ switch (pc->componentType) {
+ case 1:
+ /*
+ * Symlink points to some place which should be agreed
+ * upon between originator and receiver of the media. Ignore.
+ */
+- if (pc->lengthComponentIdent > 0)
++ if (pc->lengthComponentIdent > 0) {
++ elen += pc->lengthComponentIdent;
+ break;
++ }
+ /* Fall through */
+ case 2:
++ if (tolen == 0)
++ return -ENAMETOOLONG;
+ p = to;
+ *p++ = '/';
++ tolen--;
+ break;
+ case 3:
++ if (tolen < 3)
++ return -ENAMETOOLONG;
+ memcpy(p, "../", 3);
+ p += 3;
++ tolen -= 3;
+ break;
+ case 4:
++ if (tolen < 2)
++ return -ENAMETOOLONG;
+ memcpy(p, "./", 2);
+ p += 2;
++ tolen -= 2;
+ /* that would be . - just ignore */
+ break;
+ case 5:
+- p += udf_get_filename(sb, pc->componentIdent, p,
+- pc->lengthComponentIdent);
++ elen += pc->lengthComponentIdent;
++ if (elen > fromlen)
++ return -EIO;
++ comp_len = udf_get_filename(sb, pc->componentIdent,
++ pc->lengthComponentIdent,
++ p, tolen);
++ p += comp_len;
++ tolen -= comp_len;
++ if (tolen == 0)
++ return -ENAMETOOLONG;
+ *p++ = '/';
++ tolen--;
+ break;
+ }
+- elen += sizeof(struct pathComponent) + pc->lengthComponentIdent;
+ }
+ if (p > to + 1)
+ p[-1] = '\0';
+ else
+ p[0] = '\0';
++ return 0;
+ }
+
+ static int udf_symlink_filler(struct file *file, struct page *page)
+@@ -80,11 +104,17 @@ static int udf_symlink_filler(struct file *file, struct page *page)
+ struct inode *inode = page->mapping->host;
+ struct buffer_head *bh = NULL;
+ unsigned char *symlink;
+- int err = -EIO;
++ int err;
+ unsigned char *p = kmap(page);
+ struct udf_inode_info *iinfo;
+ uint32_t pos;
+
++ /* We don't support symlinks longer than one block */
++ if (inode->i_size > inode->i_sb->s_blocksize) {
++ err = -ENAMETOOLONG;
++ goto out_unmap;
++ }
++
+ iinfo = UDF_I(inode);
+ pos = udf_block_map(inode, 0);
+
+@@ -94,14 +124,18 @@ static int udf_symlink_filler(struct file *file, struct page *page)
+ } else {
+ bh = sb_bread(inode->i_sb, pos);
+
+- if (!bh)
+- goto out;
++ if (!bh) {
++ err = -EIO;
++ goto out_unlock_inode;
++ }
+
+ symlink = bh->b_data;
+ }
+
+- udf_pc_to_char(inode->i_sb, symlink, inode->i_size, p);
++ err = udf_pc_to_char(inode->i_sb, symlink, inode->i_size, p, PAGE_SIZE);
+ brelse(bh);
++ if (err)
++ goto out_unlock_inode;
+
+ up_read(&iinfo->i_data_sem);
+ SetPageUptodate(page);
+@@ -109,9 +143,10 @@ static int udf_symlink_filler(struct file *file, struct page *page)
+ unlock_page(page);
+ return 0;
+
+-out:
++out_unlock_inode:
+ up_read(&iinfo->i_data_sem);
+ SetPageError(page);
++out_unmap:
+ kunmap(page);
+ unlock_page(page);
+ return err;
+diff --git a/fs/udf/udfdecl.h b/fs/udf/udfdecl.h
+index 1cc3c993ebd0..47bb3f5ca360 100644
+--- a/fs/udf/udfdecl.h
++++ b/fs/udf/udfdecl.h
+@@ -211,7 +211,8 @@ udf_get_lb_pblock(struct super_block *sb, struct kernel_lb_addr *loc,
+ }
+
+ /* unicode.c */
+-extern int udf_get_filename(struct super_block *, uint8_t *, uint8_t *, int);
++extern int udf_get_filename(struct super_block *, uint8_t *, int, uint8_t *,
++ int);
+ extern int udf_put_filename(struct super_block *, const uint8_t *, uint8_t *,
+ int);
+ extern int udf_build_ustr(struct ustr *, dstring *, int);
+diff --git a/fs/udf/unicode.c b/fs/udf/unicode.c
+index afd470e588ff..b84fee372734 100644
+--- a/fs/udf/unicode.c
++++ b/fs/udf/unicode.c
+@@ -28,7 +28,8 @@
+
+ #include "udf_sb.h"
+
+-static int udf_translate_to_linux(uint8_t *, uint8_t *, int, uint8_t *, int);
++static int udf_translate_to_linux(uint8_t *, int, uint8_t *, int, uint8_t *,
++ int);
+
+ static int udf_char_to_ustr(struct ustr *dest, const uint8_t *src, int strlen)
+ {
+@@ -333,8 +334,8 @@ try_again:
+ return u_len + 1;
+ }
+
+-int udf_get_filename(struct super_block *sb, uint8_t *sname, uint8_t *dname,
+- int flen)
++int udf_get_filename(struct super_block *sb, uint8_t *sname, int slen,
++ uint8_t *dname, int dlen)
+ {
+ struct ustr *filename, *unifilename;
+ int len = 0;
+@@ -347,7 +348,7 @@ int udf_get_filename(struct super_block *sb, uint8_t *sname, uint8_t *dname,
+ if (!unifilename)
+ goto out1;
+
+- if (udf_build_ustr_exact(unifilename, sname, flen))
++ if (udf_build_ustr_exact(unifilename, sname, slen))
+ goto out2;
+
+ if (UDF_QUERY_FLAG(sb, UDF_FLAG_UTF8)) {
+@@ -366,7 +367,8 @@ int udf_get_filename(struct super_block *sb, uint8_t *sname, uint8_t *dname,
+ } else
+ goto out2;
+
+- len = udf_translate_to_linux(dname, filename->u_name, filename->u_len,
++ len = udf_translate_to_linux(dname, dlen,
++ filename->u_name, filename->u_len,
+ unifilename->u_name, unifilename->u_len);
+ out2:
+ kfree(unifilename);
+@@ -403,10 +405,12 @@ int udf_put_filename(struct super_block *sb, const uint8_t *sname,
+ #define EXT_MARK '.'
+ #define CRC_MARK '#'
+ #define EXT_SIZE 5
++/* Number of chars we need to store generated CRC to make filename unique */
++#define CRC_LEN 5
+
+-static int udf_translate_to_linux(uint8_t *newName, uint8_t *udfName,
+- int udfLen, uint8_t *fidName,
+- int fidNameLen)
++static int udf_translate_to_linux(uint8_t *newName, int newLen,
++ uint8_t *udfName, int udfLen,
++ uint8_t *fidName, int fidNameLen)
+ {
+ int index, newIndex = 0, needsCRC = 0;
+ int extIndex = 0, newExtIndex = 0, hasExt = 0;
+@@ -439,7 +443,7 @@ static int udf_translate_to_linux(uint8_t *newName, uint8_t *udfName,
+ newExtIndex = newIndex;
+ }
+ }
+- if (newIndex < 256)
++ if (newIndex < newLen)
+ newName[newIndex++] = curr;
+ else
+ needsCRC = 1;
+@@ -467,13 +471,13 @@ static int udf_translate_to_linux(uint8_t *newName, uint8_t *udfName,
+ }
+ ext[localExtIndex++] = curr;
+ }
+- maxFilenameLen = 250 - localExtIndex;
++ maxFilenameLen = newLen - CRC_LEN - localExtIndex;
+ if (newIndex > maxFilenameLen)
+ newIndex = maxFilenameLen;
+ else
+ newIndex = newExtIndex;
+- } else if (newIndex > 250)
+- newIndex = 250;
++ } else if (newIndex > newLen - CRC_LEN)
++ newIndex = newLen - CRC_LEN;
+ newName[newIndex++] = CRC_MARK;
+ valueCRC = crc_itu_t(0, fidName, fidNameLen);
+ newName[newIndex++] = hex_asc_upper_hi(valueCRC >> 8);
+diff --git a/include/linux/audit.h b/include/linux/audit.h
+index e58fe7df8b9c..10f155b7daf6 100644
+--- a/include/linux/audit.h
++++ b/include/linux/audit.h
+@@ -47,6 +47,7 @@ struct sk_buff;
+
+ struct audit_krule {
+ int vers_ops;
++ u32 pflags;
+ u32 flags;
+ u32 listnr;
+ u32 action;
+@@ -64,6 +65,9 @@ struct audit_krule {
+ u64 prio;
+ };
+
++/* Flag to indicate legacy AUDIT_LOGINUID unset usage */
++#define AUDIT_LOGINUID_LEGACY 0x1
++
+ struct audit_field {
+ u32 type;
+ union {
+diff --git a/include/linux/cred.h b/include/linux/cred.h
+index b2d0820837c4..2fb2ca2127ed 100644
+--- a/include/linux/cred.h
++++ b/include/linux/cred.h
+@@ -68,6 +68,7 @@ extern void groups_free(struct group_info *);
+ extern int set_current_groups(struct group_info *);
+ extern void set_groups(struct cred *, struct group_info *);
+ extern int groups_search(const struct group_info *, kgid_t);
++extern bool may_setgroups(void);
+
+ /* access the groups "array" with this macro */
+ #define GROUP_AT(gi, i) \
+diff --git a/include/linux/user_namespace.h b/include/linux/user_namespace.h
+index e95372654f09..9f3579ff543d 100644
+--- a/include/linux/user_namespace.h
++++ b/include/linux/user_namespace.h
+@@ -17,6 +17,10 @@ struct uid_gid_map { /* 64 bytes -- 1 cache line */
+ } extent[UID_GID_MAP_MAX_EXTENTS];
+ };
+
++#define USERNS_SETGROUPS_ALLOWED 1UL
++
++#define USERNS_INIT_FLAGS USERNS_SETGROUPS_ALLOWED
++
+ struct user_namespace {
+ struct uid_gid_map uid_map;
+ struct uid_gid_map gid_map;
+@@ -27,6 +31,7 @@ struct user_namespace {
+ kuid_t owner;
+ kgid_t group;
+ unsigned int proc_inum;
++ unsigned long flags;
+
+ /* Register of per-UID persistent keyrings for this namespace */
+ #ifdef CONFIG_PERSISTENT_KEYRINGS
+@@ -63,6 +68,9 @@ extern const struct seq_operations proc_projid_seq_operations;
+ extern ssize_t proc_uid_map_write(struct file *, const char __user *, size_t, loff_t *);
+ extern ssize_t proc_gid_map_write(struct file *, const char __user *, size_t, loff_t *);
+ extern ssize_t proc_projid_map_write(struct file *, const char __user *, size_t, loff_t *);
++extern ssize_t proc_setgroups_write(struct file *, const char __user *, size_t, loff_t *);
++extern int proc_setgroups_show(struct seq_file *m, void *v);
++extern bool userns_may_setgroups(const struct user_namespace *ns);
+ #else
+
+ static inline struct user_namespace *get_user_ns(struct user_namespace *ns)
+@@ -87,6 +95,10 @@ static inline void put_user_ns(struct user_namespace *ns)
+ {
+ }
+
++static inline bool userns_may_setgroups(const struct user_namespace *ns)
++{
++ return true;
++}
+ #endif
+
+ #endif /* _LINUX_USER_H */
+diff --git a/kernel/audit.c b/kernel/audit.c
+index cebb11db4d34..c6df9905f1c6 100644
+--- a/kernel/audit.c
++++ b/kernel/audit.c
+@@ -429,7 +429,7 @@ static void kauditd_send_skb(struct sk_buff *skb)
+ * This function doesn't consume an skb as might be expected since it has to
+ * copy it anyways.
+ */
+-static void kauditd_send_multicast_skb(struct sk_buff *skb)
++static void kauditd_send_multicast_skb(struct sk_buff *skb, gfp_t gfp_mask)
+ {
+ struct sk_buff *copy;
+ struct audit_net *aunet = net_generic(&init_net, audit_net_id);
+@@ -448,11 +448,11 @@ static void kauditd_send_multicast_skb(struct sk_buff *skb)
+ * no reason for new multicast clients to continue with this
+ * non-compliance.
+ */
+- copy = skb_copy(skb, GFP_KERNEL);
++ copy = skb_copy(skb, gfp_mask);
+ if (!copy)
+ return;
+
+- nlmsg_multicast(sock, copy, 0, AUDIT_NLGRP_READLOG, GFP_KERNEL);
++ nlmsg_multicast(sock, copy, 0, AUDIT_NLGRP_READLOG, gfp_mask);
+ }
+
+ /*
+@@ -1949,7 +1949,7 @@ void audit_log_end(struct audit_buffer *ab)
+ struct nlmsghdr *nlh = nlmsg_hdr(ab->skb);
+
+ nlh->nlmsg_len = ab->skb->len;
+- kauditd_send_multicast_skb(ab->skb);
++ kauditd_send_multicast_skb(ab->skb, ab->gfp_mask);
+
+ /*
+ * The original kaudit unicast socket sends up messages with
+diff --git a/kernel/auditfilter.c b/kernel/auditfilter.c
+index 3598e13f2a65..4f68a326d92e 100644
+--- a/kernel/auditfilter.c
++++ b/kernel/auditfilter.c
+@@ -442,19 +442,7 @@ static struct audit_entry *audit_data_to_entry(struct audit_rule_data *data,
+ if ((f->type == AUDIT_LOGINUID) && (f->val == AUDIT_UID_UNSET)) {
+ f->type = AUDIT_LOGINUID_SET;
+ f->val = 0;
+- }
+-
+- if ((f->type == AUDIT_PID) || (f->type == AUDIT_PPID)) {
+- struct pid *pid;
+- rcu_read_lock();
+- pid = find_vpid(f->val);
+- if (!pid) {
+- rcu_read_unlock();
+- err = -ESRCH;
+- goto exit_free;
+- }
+- f->val = pid_nr(pid);
+- rcu_read_unlock();
++ entry->rule.pflags |= AUDIT_LOGINUID_LEGACY;
+ }
+
+ err = audit_field_valid(entry, f);
+@@ -630,6 +618,13 @@ static struct audit_rule_data *audit_krule_to_data(struct audit_krule *krule)
+ data->buflen += data->values[i] =
+ audit_pack_string(&bufp, krule->filterkey);
+ break;
++ case AUDIT_LOGINUID_SET:
++ if (krule->pflags & AUDIT_LOGINUID_LEGACY && !f->val) {
++ data->fields[i] = AUDIT_LOGINUID;
++ data->values[i] = AUDIT_UID_UNSET;
++ break;
++ }
++ /* fallthrough if set */
+ default:
+ data->values[i] = f->val;
+ }
+@@ -646,6 +641,7 @@ static int audit_compare_rule(struct audit_krule *a, struct audit_krule *b)
+ int i;
+
+ if (a->flags != b->flags ||
++ a->pflags != b->pflags ||
+ a->listnr != b->listnr ||
+ a->action != b->action ||
+ a->field_count != b->field_count)
+@@ -764,6 +760,7 @@ struct audit_entry *audit_dupe_rule(struct audit_krule *old)
+ new = &entry->rule;
+ new->vers_ops = old->vers_ops;
+ new->flags = old->flags;
++ new->pflags = old->pflags;
+ new->listnr = old->listnr;
+ new->action = old->action;
+ for (i = 0; i < AUDIT_BITMASK_SIZE; i++)
+diff --git a/kernel/groups.c b/kernel/groups.c
+index 451698f86cfa..664411f171b5 100644
+--- a/kernel/groups.c
++++ b/kernel/groups.c
+@@ -6,6 +6,7 @@
+ #include <linux/slab.h>
+ #include <linux/security.h>
+ #include <linux/syscalls.h>
++#include <linux/user_namespace.h>
+ #include <asm/uaccess.h>
+
+ /* init to 2 - one for init_task, one to ensure it is never freed */
+@@ -213,6 +214,14 @@ out:
+ return i;
+ }
+
++bool may_setgroups(void)
++{
++ struct user_namespace *user_ns = current_user_ns();
++
++ return ns_capable(user_ns, CAP_SETGID) &&
++ userns_may_setgroups(user_ns);
++}
++
+ /*
+ * SMP: Our groups are copy-on-write. We can set them safely
+ * without another task interfering.
+@@ -223,7 +232,7 @@ SYSCALL_DEFINE2(setgroups, int, gidsetsize, gid_t __user *, grouplist)
+ struct group_info *group_info;
+ int retval;
+
+- if (!ns_capable(current_user_ns(), CAP_SETGID))
++ if (!may_setgroups())
+ return -EPERM;
+ if ((unsigned)gidsetsize > NGROUPS_MAX)
+ return -EINVAL;
+diff --git a/kernel/pid.c b/kernel/pid.c
+index 9b9a26698144..82430c858d69 100644
+--- a/kernel/pid.c
++++ b/kernel/pid.c
+@@ -341,6 +341,8 @@ out:
+
+ out_unlock:
+ spin_unlock_irq(&pidmap_lock);
++ put_pid_ns(ns);
++
+ out_free:
+ while (++i <= ns->level)
+ free_pidmap(pid->numbers + i);
+diff --git a/kernel/uid16.c b/kernel/uid16.c
+index 602e5bbbceff..d58cc4d8f0d1 100644
+--- a/kernel/uid16.c
++++ b/kernel/uid16.c
+@@ -176,7 +176,7 @@ SYSCALL_DEFINE2(setgroups16, int, gidsetsize, old_gid_t __user *, grouplist)
+ struct group_info *group_info;
+ int retval;
+
+- if (!ns_capable(current_user_ns(), CAP_SETGID))
++ if (!may_setgroups())
+ return -EPERM;
+ if ((unsigned)gidsetsize > NGROUPS_MAX)
+ return -EINVAL;
+diff --git a/kernel/user.c b/kernel/user.c
+index 4efa39350e44..2d09940c9632 100644
+--- a/kernel/user.c
++++ b/kernel/user.c
+@@ -51,6 +51,7 @@ struct user_namespace init_user_ns = {
+ .owner = GLOBAL_ROOT_UID,
+ .group = GLOBAL_ROOT_GID,
+ .proc_inum = PROC_USER_INIT_INO,
++ .flags = USERNS_INIT_FLAGS,
+ #ifdef CONFIG_PERSISTENT_KEYRINGS
+ .persistent_keyring_register_sem =
+ __RWSEM_INITIALIZER(init_user_ns.persistent_keyring_register_sem),
+diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c
+index aa312b0dc3ec..a2e37c5d2f63 100644
+--- a/kernel/user_namespace.c
++++ b/kernel/user_namespace.c
+@@ -24,6 +24,7 @@
+ #include <linux/fs_struct.h>
+
+ static struct kmem_cache *user_ns_cachep __read_mostly;
++static DEFINE_MUTEX(userns_state_mutex);
+
+ static bool new_idmap_permitted(const struct file *file,
+ struct user_namespace *ns, int cap_setid,
+@@ -99,6 +100,11 @@ int create_user_ns(struct cred *new)
+ ns->owner = owner;
+ ns->group = group;
+
++ /* Inherit USERNS_SETGROUPS_ALLOWED from our parent */
++ mutex_lock(&userns_state_mutex);
++ ns->flags = parent_ns->flags;
++ mutex_unlock(&userns_state_mutex);
++
+ set_cred_user_ns(new, ns);
+
+ #ifdef CONFIG_PERSISTENT_KEYRINGS
+@@ -583,9 +589,6 @@ static bool mappings_overlap(struct uid_gid_map *new_map,
+ return false;
+ }
+
+-
+-static DEFINE_MUTEX(id_map_mutex);
+-
+ static ssize_t map_write(struct file *file, const char __user *buf,
+ size_t count, loff_t *ppos,
+ int cap_setid,
+@@ -602,7 +605,7 @@ static ssize_t map_write(struct file *file, const char __user *buf,
+ ssize_t ret = -EINVAL;
+
+ /*
+- * The id_map_mutex serializes all writes to any given map.
++ * The userns_state_mutex serializes all writes to any given map.
+ *
+ * Any map is only ever written once.
+ *
+@@ -620,7 +623,7 @@ static ssize_t map_write(struct file *file, const char __user *buf,
+ * order and smp_rmb() is guaranteed that we don't have crazy
+ * architectures returning stale data.
+ */
+- mutex_lock(&id_map_mutex);
++ mutex_lock(&userns_state_mutex);
+
+ ret = -EPERM;
+ /* Only allow one successful write to the map */
+@@ -750,7 +753,7 @@ static ssize_t map_write(struct file *file, const char __user *buf,
+ *ppos = count;
+ ret = count;
+ out:
+- mutex_unlock(&id_map_mutex);
++ mutex_unlock(&userns_state_mutex);
+ if (page)
+ free_page(page);
+ return ret;
+@@ -812,16 +815,21 @@ static bool new_idmap_permitted(const struct file *file,
+ struct user_namespace *ns, int cap_setid,
+ struct uid_gid_map *new_map)
+ {
+- /* Allow mapping to your own filesystem ids */
+- if ((new_map->nr_extents == 1) && (new_map->extent[0].count == 1)) {
++ const struct cred *cred = file->f_cred;
++ /* Don't allow mappings that would allow anything that wouldn't
++ * be allowed without the establishment of unprivileged mappings.
++ */
++ if ((new_map->nr_extents == 1) && (new_map->extent[0].count == 1) &&
++ uid_eq(ns->owner, cred->euid)) {
+ u32 id = new_map->extent[0].lower_first;
+ if (cap_setid == CAP_SETUID) {
+ kuid_t uid = make_kuid(ns->parent, id);
+- if (uid_eq(uid, file->f_cred->fsuid))
++ if (uid_eq(uid, cred->euid))
+ return true;
+ } else if (cap_setid == CAP_SETGID) {
+ kgid_t gid = make_kgid(ns->parent, id);
+- if (gid_eq(gid, file->f_cred->fsgid))
++ if (!(ns->flags & USERNS_SETGROUPS_ALLOWED) &&
++ gid_eq(gid, cred->egid))
+ return true;
+ }
+ }
+@@ -841,6 +849,100 @@ static bool new_idmap_permitted(const struct file *file,
+ return false;
+ }
+
++int proc_setgroups_show(struct seq_file *seq, void *v)
++{
++ struct user_namespace *ns = seq->private;
++ unsigned long userns_flags = ACCESS_ONCE(ns->flags);
++
++ seq_printf(seq, "%s\n",
++ (userns_flags & USERNS_SETGROUPS_ALLOWED) ?
++ "allow" : "deny");
++ return 0;
++}
++
++ssize_t proc_setgroups_write(struct file *file, const char __user *buf,
++ size_t count, loff_t *ppos)
++{
++ struct seq_file *seq = file->private_data;
++ struct user_namespace *ns = seq->private;
++ char kbuf[8], *pos;
++ bool setgroups_allowed;
++ ssize_t ret;
++
++ /* Only allow a very narrow range of strings to be written */
++ ret = -EINVAL;
++ if ((*ppos != 0) || (count >= sizeof(kbuf)))
++ goto out;
++
++ /* What was written? */
++ ret = -EFAULT;
++ if (copy_from_user(kbuf, buf, count))
++ goto out;
++ kbuf[count] = '\0';
++ pos = kbuf;
++
++ /* What is being requested? */
++ ret = -EINVAL;
++ if (strncmp(pos, "allow", 5) == 0) {
++ pos += 5;
++ setgroups_allowed = true;
++ }
++ else if (strncmp(pos, "deny", 4) == 0) {
++ pos += 4;
++ setgroups_allowed = false;
++ }
++ else
++ goto out;
++
++ /* Verify there is not trailing junk on the line */
++ pos = skip_spaces(pos);
++ if (*pos != '\0')
++ goto out;
++
++ ret = -EPERM;
++ mutex_lock(&userns_state_mutex);
++ if (setgroups_allowed) {
++ /* Enabling setgroups after setgroups has been disabled
++ * is not allowed.
++ */
++ if (!(ns->flags & USERNS_SETGROUPS_ALLOWED))
++ goto out_unlock;
++ } else {
++ /* Permanently disabling setgroups after setgroups has
++ * been enabled by writing the gid_map is not allowed.
++ */
++ if (ns->gid_map.nr_extents != 0)
++ goto out_unlock;
++ ns->flags &= ~USERNS_SETGROUPS_ALLOWED;
++ }
++ mutex_unlock(&userns_state_mutex);
++
++ /* Report a successful write */
++ *ppos = count;
++ ret = count;
++out:
++ return ret;
++out_unlock:
++ mutex_unlock(&userns_state_mutex);
++ goto out;
++}
++
++bool userns_may_setgroups(const struct user_namespace *ns)
++{
++ bool allowed;
++
++ mutex_lock(&userns_state_mutex);
++ /* It is not safe to use setgroups until a gid mapping in
++ * the user namespace has been established.
++ */
++ allowed = ns->gid_map.nr_extents != 0;
++ /* Is setgroups allowed? */
++ allowed = allowed && (ns->flags & USERNS_SETGROUPS_ALLOWED);
++ mutex_unlock(&userns_state_mutex);
++
++ return allowed;
++}
++
+ static void *userns_get(struct task_struct *task)
+ {
+ struct user_namespace *user_ns;
+diff --git a/mm/cma.c b/mm/cma.c
+index fde706e1284f..8e9ec13d31db 100644
+--- a/mm/cma.c
++++ b/mm/cma.c
+@@ -215,9 +215,21 @@ int __init cma_declare_contiguous(phys_addr_t base,
+ bool fixed, struct cma **res_cma)
+ {
+ phys_addr_t memblock_end = memblock_end_of_DRAM();
+- phys_addr_t highmem_start = __pa(high_memory);
++ phys_addr_t highmem_start;
+ int ret = 0;
+
++#ifdef CONFIG_X86
++ /*
++ * high_memory isn't direct mapped memory so retrieving its physical
++ * address isn't appropriate. But it would be useful to check the
++ * physical address of the highmem boundary so it's justfiable to get
++ * the physical address from it. On x86 there is a validation check for
++ * this case, so the following workaround is needed to avoid it.
++ */
++ highmem_start = __pa_nodebug(high_memory);
++#else
++ highmem_start = __pa(high_memory);
++#endif
+ pr_debug("%s(size %pa, base %pa, limit %pa alignment %pa)\n",
+ __func__, &size, &base, &limit, &alignment);
+
+diff --git a/net/mac80211/chan.c b/net/mac80211/chan.c
+index 4c74e8da64b9..5ce13a76d0fd 100644
+--- a/net/mac80211/chan.c
++++ b/net/mac80211/chan.c
+@@ -929,6 +929,21 @@ ieee80211_vif_chanctx_reservation_complete(struct ieee80211_sub_if_data *sdata)
+ }
+ }
+
++static void
++ieee80211_vif_update_chandef(struct ieee80211_sub_if_data *sdata,
++ const struct cfg80211_chan_def *chandef)
++{
++ struct ieee80211_sub_if_data *vlan;
++
++ sdata->vif.bss_conf.chandef = *chandef;
++
++ if (sdata->vif.type != NL80211_IFTYPE_AP)
++ return;
++
++ list_for_each_entry(vlan, &sdata->u.ap.vlans, u.vlan.list)
++ vlan->vif.bss_conf.chandef = *chandef;
++}
++
+ static int
+ ieee80211_vif_use_reserved_reassign(struct ieee80211_sub_if_data *sdata)
+ {
+@@ -991,7 +1006,7 @@ ieee80211_vif_use_reserved_reassign(struct ieee80211_sub_if_data *sdata)
+ if (sdata->vif.bss_conf.chandef.width != sdata->reserved_chandef.width)
+ changed = BSS_CHANGED_BANDWIDTH;
+
+- sdata->vif.bss_conf.chandef = sdata->reserved_chandef;
++ ieee80211_vif_update_chandef(sdata, &sdata->reserved_chandef);
+
+ if (changed)
+ ieee80211_bss_info_change_notify(sdata, changed);
+@@ -1333,7 +1348,7 @@ static int ieee80211_vif_use_reserved_switch(struct ieee80211_local *local)
+ sdata->reserved_chandef.width)
+ changed = BSS_CHANGED_BANDWIDTH;
+
+- sdata->vif.bss_conf.chandef = sdata->reserved_chandef;
++ ieee80211_vif_update_chandef(sdata, &sdata->reserved_chandef);
+ if (changed)
+ ieee80211_bss_info_change_notify(sdata,
+ changed);
+@@ -1504,7 +1519,7 @@ int ieee80211_vif_use_channel(struct ieee80211_sub_if_data *sdata,
+ goto out;
+ }
+
+- sdata->vif.bss_conf.chandef = *chandef;
++ ieee80211_vif_update_chandef(sdata, chandef);
+
+ ret = ieee80211_assign_vif_chanctx(sdata, ctx);
+ if (ret) {
+@@ -1646,7 +1661,7 @@ int ieee80211_vif_change_bandwidth(struct ieee80211_sub_if_data *sdata,
+ break;
+ }
+
+- sdata->vif.bss_conf.chandef = *chandef;
++ ieee80211_vif_update_chandef(sdata, chandef);
+
+ ieee80211_recalc_chanctx_chantype(local, ctx);
+
+diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
+index 653f5eb07a27..eeae0abd01de 100644
+--- a/net/mac80211/iface.c
++++ b/net/mac80211/iface.c
+@@ -511,6 +511,7 @@ int ieee80211_do_open(struct wireless_dev *wdev, bool coming_up)
+ sdata->vif.cab_queue = master->vif.cab_queue;
+ memcpy(sdata->vif.hw_queue, master->vif.hw_queue,
+ sizeof(sdata->vif.hw_queue));
++ sdata->vif.bss_conf.chandef = master->vif.bss_conf.chandef;
+ break;
+ }
+ case NL80211_IFTYPE_AP:
+diff --git a/net/mac80211/key.c b/net/mac80211/key.c
+index 4712150dc210..d66c6443164c 100644
+--- a/net/mac80211/key.c
++++ b/net/mac80211/key.c
+@@ -647,7 +647,7 @@ void ieee80211_free_sta_keys(struct ieee80211_local *local,
+ int i;
+
+ mutex_lock(&local->key_mtx);
+- for (i = 0; i < NUM_DEFAULT_KEYS; i++) {
++ for (i = 0; i < ARRAY_SIZE(sta->gtk); i++) {
+ key = key_mtx_dereference(local, sta->gtk[i]);
+ if (!key)
+ continue;
+diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
+index 93af0f1c9d99..da1f639ecfb6 100644
+--- a/net/mac80211/mlme.c
++++ b/net/mac80211/mlme.c
+@@ -174,6 +174,7 @@ ieee80211_determine_chantype(struct ieee80211_sub_if_data *sdata,
+ if (!(ht_cap->cap_info &
+ cpu_to_le16(IEEE80211_HT_CAP_SUP_WIDTH_20_40))) {
+ ret = IEEE80211_STA_DISABLE_40MHZ;
++ vht_chandef = *chandef;
+ goto out;
+ }
+
+diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
+index a37f9af634cb..e60da9a062c2 100644
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -1678,14 +1678,14 @@ ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
+ sc = le16_to_cpu(hdr->seq_ctrl);
+ frag = sc & IEEE80211_SCTL_FRAG;
+
+- if (likely(!ieee80211_has_morefrags(fc) && frag == 0))
+- goto out;
+-
+ if (is_multicast_ether_addr(hdr->addr1)) {
+ rx->local->dot11MulticastReceivedFrameCount++;
+- goto out;
++ goto out_no_led;
+ }
+
++ if (likely(!ieee80211_has_morefrags(fc) && frag == 0))
++ goto out;
++
+ I802_DEBUG_INC(rx->local->rx_handlers_fragments);
+
+ if (skb_linearize(rx->skb))
+@@ -1776,9 +1776,10 @@ ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
+ status->rx_flags |= IEEE80211_RX_FRAGMENTED;
+
+ out:
++ ieee80211_led_rx(rx->local);
++ out_no_led:
+ if (rx->sta)
+ rx->sta->rx_packets++;
+- ieee80211_led_rx(rx->local);
+ return RX_CONTINUE;
+ }
+
+diff --git a/security/keys/encrypted-keys/encrypted.c b/security/keys/encrypted-keys/encrypted.c
+index db9675db1026..7bed4ad7cd76 100644
+--- a/security/keys/encrypted-keys/encrypted.c
++++ b/security/keys/encrypted-keys/encrypted.c
+@@ -1017,10 +1017,13 @@ static int __init init_encrypted(void)
+ ret = encrypted_shash_alloc();
+ if (ret < 0)
+ return ret;
++ ret = aes_get_sizes();
++ if (ret < 0)
++ goto out;
+ ret = register_key_type(&key_type_encrypted);
+ if (ret < 0)
+ goto out;
+- return aes_get_sizes();
++ return 0;
+ out:
+ encrypted_shash_release();
+ return ret;
+diff --git a/tools/testing/selftests/mount/unprivileged-remount-test.c b/tools/testing/selftests/mount/unprivileged-remount-test.c
+index 1b3ff2fda4d0..517785052f1c 100644
+--- a/tools/testing/selftests/mount/unprivileged-remount-test.c
++++ b/tools/testing/selftests/mount/unprivileged-remount-test.c
+@@ -6,6 +6,8 @@
+ #include <sys/types.h>
+ #include <sys/mount.h>
+ #include <sys/wait.h>
++#include <sys/vfs.h>
++#include <sys/statvfs.h>
+ #include <stdlib.h>
+ #include <unistd.h>
+ #include <fcntl.h>
+@@ -32,11 +34,14 @@
+ # define CLONE_NEWPID 0x20000000
+ #endif
+
++#ifndef MS_REC
++# define MS_REC 16384
++#endif
+ #ifndef MS_RELATIME
+-#define MS_RELATIME (1 << 21)
++# define MS_RELATIME (1 << 21)
+ #endif
+ #ifndef MS_STRICTATIME
+-#define MS_STRICTATIME (1 << 24)
++# define MS_STRICTATIME (1 << 24)
+ #endif
+
+ static void die(char *fmt, ...)
+@@ -48,17 +53,14 @@ static void die(char *fmt, ...)
+ exit(EXIT_FAILURE);
+ }
+
+-static void write_file(char *filename, char *fmt, ...)
++static void vmaybe_write_file(bool enoent_ok, char *filename, char *fmt, va_list ap)
+ {
+ char buf[4096];
+ int fd;
+ ssize_t written;
+ int buf_len;
+- va_list ap;
+
+- va_start(ap, fmt);
+ buf_len = vsnprintf(buf, sizeof(buf), fmt, ap);
+- va_end(ap);
+ if (buf_len < 0) {
+ die("vsnprintf failed: %s\n",
+ strerror(errno));
+@@ -69,6 +71,8 @@ static void write_file(char *filename, char *fmt, ...)
+
+ fd = open(filename, O_WRONLY);
+ if (fd < 0) {
++ if ((errno == ENOENT) && enoent_ok)
++ return;
+ die("open of %s failed: %s\n",
+ filename, strerror(errno));
+ }
+@@ -87,6 +91,65 @@ static void write_file(char *filename, char *fmt, ...)
+ }
+ }
+
++static void maybe_write_file(char *filename, char *fmt, ...)
++{
++ va_list ap;
++
++ va_start(ap, fmt);
++ vmaybe_write_file(true, filename, fmt, ap);
++ va_end(ap);
++
++}
++
++static void write_file(char *filename, char *fmt, ...)
++{
++ va_list ap;
++
++ va_start(ap, fmt);
++ vmaybe_write_file(false, filename, fmt, ap);
++ va_end(ap);
++
++}
++
++static int read_mnt_flags(const char *path)
++{
++ int ret;
++ struct statvfs stat;
++ int mnt_flags;
++
++ ret = statvfs(path, &stat);
++ if (ret != 0) {
++ die("statvfs of %s failed: %s\n",
++ path, strerror(errno));
++ }
++ if (stat.f_flag & ~(ST_RDONLY | ST_NOSUID | ST_NODEV | \
++ ST_NOEXEC | ST_NOATIME | ST_NODIRATIME | ST_RELATIME | \
++ ST_SYNCHRONOUS | ST_MANDLOCK)) {
++ die("Unrecognized mount flags\n");
++ }
++ mnt_flags = 0;
++ if (stat.f_flag & ST_RDONLY)
++ mnt_flags |= MS_RDONLY;
++ if (stat.f_flag & ST_NOSUID)
++ mnt_flags |= MS_NOSUID;
++ if (stat.f_flag & ST_NODEV)
++ mnt_flags |= MS_NODEV;
++ if (stat.f_flag & ST_NOEXEC)
++ mnt_flags |= MS_NOEXEC;
++ if (stat.f_flag & ST_NOATIME)
++ mnt_flags |= MS_NOATIME;
++ if (stat.f_flag & ST_NODIRATIME)
++ mnt_flags |= MS_NODIRATIME;
++ if (stat.f_flag & ST_RELATIME)
++ mnt_flags |= MS_RELATIME;
++ if (stat.f_flag & ST_SYNCHRONOUS)
++ mnt_flags |= MS_SYNCHRONOUS;
++ if (stat.f_flag & ST_MANDLOCK)
++ mnt_flags |= ST_MANDLOCK;
++
++ return mnt_flags;
++}
++
+ static void create_and_enter_userns(void)
+ {
+ uid_t uid;
+@@ -100,13 +163,10 @@ static void create_and_enter_userns(void)
+ strerror(errno));
+ }
+
++ maybe_write_file("/proc/self/setgroups", "deny");
+ write_file("/proc/self/uid_map", "0 %d 1", uid);
+ write_file("/proc/self/gid_map", "0 %d 1", gid);
+
+- if (setgroups(0, NULL) != 0) {
+- die("setgroups failed: %s\n",
+- strerror(errno));
+- }
+ if (setgid(0) != 0) {
+ die ("setgid(0) failed %s\n",
+ strerror(errno));
+@@ -118,7 +178,8 @@ static void create_and_enter_userns(void)
+ }
+
+ static
+-bool test_unpriv_remount(int mount_flags, int remount_flags, int invalid_flags)
++bool test_unpriv_remount(const char *fstype, const char *mount_options,
++ int mount_flags, int remount_flags, int invalid_flags)
+ {
+ pid_t child;
+
+@@ -151,9 +212,11 @@ bool test_unpriv_remount(int mount_flags, int remount_flags, int invalid_flags)
+ strerror(errno));
+ }
+
+- if (mount("testing", "/tmp", "ramfs", mount_flags, NULL) != 0) {
+- die("mount of /tmp failed: %s\n",
+- strerror(errno));
++ if (mount("testing", "/tmp", fstype, mount_flags, mount_options) != 0) {
++ die("mount of %s with options '%s' on /tmp failed: %s\n",
++ fstype,
++ mount_options? mount_options : "",
++ strerror(errno));
+ }
+
+ create_and_enter_userns();
+@@ -181,62 +244,127 @@ bool test_unpriv_remount(int mount_flags, int remount_flags, int invalid_flags)
+
+ static bool test_unpriv_remount_simple(int mount_flags)
+ {
+- return test_unpriv_remount(mount_flags, mount_flags, 0);
++ return test_unpriv_remount("ramfs", NULL, mount_flags, mount_flags, 0);
+ }
+
+ static bool test_unpriv_remount_atime(int mount_flags, int invalid_flags)
+ {
+- return test_unpriv_remount(mount_flags, mount_flags, invalid_flags);
++ return test_unpriv_remount("ramfs", NULL, mount_flags, mount_flags,
++ invalid_flags);
++}
++
++static bool test_priv_mount_unpriv_remount(void)
++{
++ pid_t child;
++ int ret;
++ const char *orig_path = "/dev";
++ const char *dest_path = "/tmp";
++ int orig_mnt_flags, remount_mnt_flags;
++
++ child = fork();
++ if (child == -1) {
++ die("fork failed: %s\n",
++ strerror(errno));
++ }
++ if (child != 0) { /* parent */
++ pid_t pid;
++ int status;
++ pid = waitpid(child, &status, 0);
++ if (pid == -1) {
++ die("waitpid failed: %s\n",
++ strerror(errno));
++ }
++ if (pid != child) {
++ die("waited for %d got %d\n",
++ child, pid);
++ }
++ if (!WIFEXITED(status)) {
++ die("child did not terminate cleanly\n");
++ }
++ return WEXITSTATUS(status) == EXIT_SUCCESS ? true : false;
++ }
++
++ orig_mnt_flags = read_mnt_flags(orig_path);
++
++ create_and_enter_userns();
++ ret = unshare(CLONE_NEWNS);
++ if (ret != 0) {
++ die("unshare(CLONE_NEWNS) failed: %s\n",
++ strerror(errno));
++ }
++
++ ret = mount(orig_path, dest_path, "bind", MS_BIND | MS_REC, NULL);
++ if (ret != 0) {
++ die("recursive bind mount of %s onto %s failed: %s\n",
++ orig_path, dest_path, strerror(errno));
++ }
++
++ ret = mount(dest_path, dest_path, "none",
++ MS_REMOUNT | MS_BIND | orig_mnt_flags , NULL);
++ if (ret != 0) {
++ /* system("cat /proc/self/mounts"); */
++ die("remount of /tmp failed: %s\n",
++ strerror(errno));
++ }
++
++ remount_mnt_flags = read_mnt_flags(dest_path);
++ if (orig_mnt_flags != remount_mnt_flags) {
++ die("Mount flags unexpectedly changed during remount of %s originally mounted on %s\n",
++ dest_path, orig_path);
++ }
++ exit(EXIT_SUCCESS);
+ }
+
+ int main(int argc, char **argv)
+ {
+- if (!test_unpriv_remount_simple(MS_RDONLY|MS_NODEV)) {
++ if (!test_unpriv_remount_simple(MS_RDONLY)) {
+ die("MS_RDONLY malfunctions\n");
+ }
+- if (!test_unpriv_remount_simple(MS_NODEV)) {
++ if (!test_unpriv_remount("devpts", "newinstance", MS_NODEV, MS_NODEV, 0)) {
+ die("MS_NODEV malfunctions\n");
+ }
+- if (!test_unpriv_remount_simple(MS_NOSUID|MS_NODEV)) {
++ if (!test_unpriv_remount_simple(MS_NOSUID)) {
+ die("MS_NOSUID malfunctions\n");
+ }
+- if (!test_unpriv_remount_simple(MS_NOEXEC|MS_NODEV)) {
++ if (!test_unpriv_remount_simple(MS_NOEXEC)) {
+ die("MS_NOEXEC malfunctions\n");
+ }
+- if (!test_unpriv_remount_atime(MS_RELATIME|MS_NODEV,
+- MS_NOATIME|MS_NODEV))
++ if (!test_unpriv_remount_atime(MS_RELATIME,
++ MS_NOATIME))
+ {
+ die("MS_RELATIME malfunctions\n");
+ }
+- if (!test_unpriv_remount_atime(MS_STRICTATIME|MS_NODEV,
+- MS_NOATIME|MS_NODEV))
++ if (!test_unpriv_remount_atime(MS_STRICTATIME,
++ MS_NOATIME))
+ {
+ die("MS_STRICTATIME malfunctions\n");
+ }
+- if (!test_unpriv_remount_atime(MS_NOATIME|MS_NODEV,
+- MS_STRICTATIME|MS_NODEV))
++ if (!test_unpriv_remount_atime(MS_NOATIME,
++ MS_STRICTATIME))
+ {
+- die("MS_RELATIME malfunctions\n");
++ die("MS_NOATIME malfunctions\n");
+ }
+- if (!test_unpriv_remount_atime(MS_RELATIME|MS_NODIRATIME|MS_NODEV,
+- MS_NOATIME|MS_NODEV))
++ if (!test_unpriv_remount_atime(MS_RELATIME|MS_NODIRATIME,
++ MS_NOATIME))
+ {
+- die("MS_RELATIME malfunctions\n");
++ die("MS_RELATIME|MS_NODIRATIME malfunctions\n");
+ }
+- if (!test_unpriv_remount_atime(MS_STRICTATIME|MS_NODIRATIME|MS_NODEV,
+- MS_NOATIME|MS_NODEV))
++ if (!test_unpriv_remount_atime(MS_STRICTATIME|MS_NODIRATIME,
++ MS_NOATIME))
+ {
+- die("MS_RELATIME malfunctions\n");
++ die("MS_STRICTATIME|MS_NODIRATIME malfunctions\n");
+ }
+- if (!test_unpriv_remount_atime(MS_NOATIME|MS_NODIRATIME|MS_NODEV,
+- MS_STRICTATIME|MS_NODEV))
++ if (!test_unpriv_remount_atime(MS_NOATIME|MS_NODIRATIME,
++ MS_STRICTATIME))
+ {
+- die("MS_RELATIME malfunctions\n");
++ die("MS_NOATIME|MS_DIRATIME malfunctions\n");
+ }
+- if (!test_unpriv_remount(MS_STRICTATIME|MS_NODEV, MS_NODEV,
+- MS_NOATIME|MS_NODEV))
++ if (!test_unpriv_remount("ramfs", NULL, MS_STRICTATIME, 0, MS_NOATIME))
+ {
+ die("Default atime malfunctions\n");
+ }
++ if (!test_priv_mount_unpriv_remount()) {
++ die("Mount flags unexpectedly changed after remount\n");
++ }
+ return EXIT_SUCCESS;
+ }
^ permalink raw reply related [flat|nested] 67+ messages in thread
* [gentoo-commits] proj/linux-patches:3.18 commit in: /
@ 2015-01-16 0:28 Mike Pagano
0 siblings, 0 replies; 67+ messages in thread
From: Mike Pagano @ 2015-01-16 0:28 UTC (permalink / raw
To: gentoo-commits
commit: f9bb09550d8abf4ea422bce7a714bf666e1e7212
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Fri Jan 16 00:28:40 2015 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Fri Jan 16 00:28:40 2015 +0000
URL: http://sources.gentoo.org/gitweb/?p=proj/linux-patches.git;a=commit;h=f9bb0955
Patch to not BUG_ON(\!spin_is_locked()) on UP
---
0000_README | 8 ++++++--
2800_nouveau-spin-is-locked.patch | 31 +++++++++++++++++++++++++++++++
2 files changed, 37 insertions(+), 2 deletions(-)
diff --git a/0000_README b/0000_README
index 3b11b74..d04c7db 100644
--- a/0000_README
+++ b/0000_README
@@ -69,11 +69,15 @@ Desc: Ensure that /dev/root doesn't appear in /proc/mounts when bootint withou
Patch: 2905_s2disk-resume-image-fix.patch
From: Al Viro <viro <at> ZenIV.linux.org.uk>
-Desc: Do not lock when UMH is waiting on current thread spawned by linuxrc. (bug #481344)
+Desc: Do not lock when UMH is waiting on current thread spawned by linuxrc. (bug #481344.)
Patch: 2710_i915-drm-disallow-pin-ioctl-for-kms-drivers.patch
From: http://www.kernel.org
-Desc: drm/i915: Patch to disallow pin ioctl completely for kms drivers. See bug #532926
+Desc: drm/i915: Patch to disallow pin ioctl completely for kms drivers. See bug #532926.
+
+Patch: 2800_nouveau-spin-is-locked.patch
+From: http://www.kernel.org
+Desc: nouveau: Do not BUG_ON(!spin_is_locked()) on UP.
Patch: 4200_fbcondecor-3.16.patch
From: http://www.mepiscommunity.org/fbcondecor
diff --git a/2800_nouveau-spin-is-locked.patch b/2800_nouveau-spin-is-locked.patch
new file mode 100644
index 0000000..4cd72c9
--- /dev/null
+++ b/2800_nouveau-spin-is-locked.patch
@@ -0,0 +1,31 @@
+--- a/drivers/gpu/drm/nouveau/core/core/event.c 2015-01-12 14:01:30.999164123 -0500
++++ b/drivers/gpu/drm/nouveau/core/core/event.c 2015-01-12 14:03:11.229163330 -0500
+@@ -26,7 +26,7 @@
+ void
+ nvkm_event_put(struct nvkm_event *event, u32 types, int index)
+ {
+- BUG_ON(!spin_is_locked(&event->refs_lock));
++ assert_spin_locked(&event->refs_lock);
+ while (types) {
+ int type = __ffs(types); types &= ~(1 << type);
+ if (--event->refs[index * event->types_nr + type] == 0) {
+@@ -39,7 +39,7 @@ nvkm_event_put(struct nvkm_event *event,
+ void
+ nvkm_event_get(struct nvkm_event *event, u32 types, int index)
+ {
+- BUG_ON(!spin_is_locked(&event->refs_lock));
++ assert_spin_locked(&event->refs_lock);
+ while (types) {
+ int type = __ffs(types); types &= ~(1 << type);
+ if (++event->refs[index * event->types_nr + type] == 1) {
+--- a/drivers/gpu/drm/nouveau/core/core/notify.c 2015-01-12 14:01:38.299164065 -0500
++++ b/drivers/gpu/drm/nouveau/core/core/notify.c 2015-01-12 14:03:45.739163057 -0500
+@@ -98,7 +98,7 @@ nvkm_notify_send(struct nvkm_notify *not
+ struct nvkm_event *event = notify->event;
+ unsigned long flags;
+
+- BUG_ON(!spin_is_locked(&event->list_lock));
++ assert_spin_locked(&event->list_lock);
+ BUG_ON(size != notify->size);
+
+ spin_lock_irqsave(&event->refs_lock, flags);
^ permalink raw reply related [flat|nested] 67+ messages in thread
* [gentoo-commits] proj/linux-patches:3.18 commit in: /
@ 2015-01-16 18:31 Mike Pagano
0 siblings, 0 replies; 67+ messages in thread
From: Mike Pagano @ 2015-01-16 18:31 UTC (permalink / raw
To: gentoo-commits
commit: 9e45c43b5f94229af08b5fc1702e8414e66dddf3
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Fri Jan 16 18:31:15 2015 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Fri Jan 16 18:31:15 2015 +0000
URL: http://sources.gentoo.org/gitweb/?p=proj/linux-patches.git;a=commit;h=9e45c43b
Linux 3.18.3 patch. Removal of redundant patch for nouveau.
---
0000_README | 8 +-
1002_linux-3.18.3.patch | 4593 +++++++++++++++++++++++++++++++++++++
2800_nouveau-spin-is-locked.patch | 31 -
3 files changed, 4597 insertions(+), 35 deletions(-)
diff --git a/0000_README b/0000_README
index d04c7db..0df447d 100644
--- a/0000_README
+++ b/0000_README
@@ -51,6 +51,10 @@ Patch: 1001_linux-3.18.2.patch
From: http://www.kernel.org
Desc: Linux 3.18.2
+Patch: 1002_linux-3.18.3.patch
+From: http://www.kernel.org
+Desc: Linux 3.18.3
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
@@ -75,10 +79,6 @@ Patch: 2710_i915-drm-disallow-pin-ioctl-for-kms-drivers.patch
From: http://www.kernel.org
Desc: drm/i915: Patch to disallow pin ioctl completely for kms drivers. See bug #532926.
-Patch: 2800_nouveau-spin-is-locked.patch
-From: http://www.kernel.org
-Desc: nouveau: Do not BUG_ON(!spin_is_locked()) on UP.
-
Patch: 4200_fbcondecor-3.16.patch
From: http://www.mepiscommunity.org/fbcondecor
Desc: Bootsplash ported by Uladzimir Bely (bug #513334)
diff --git a/1002_linux-3.18.3.patch b/1002_linux-3.18.3.patch
new file mode 100644
index 0000000..bfa35ef
--- /dev/null
+++ b/1002_linux-3.18.3.patch
@@ -0,0 +1,4593 @@
+diff --git a/Documentation/devicetree/bindings/i2c/i2c-designware.txt b/Documentation/devicetree/bindings/i2c/i2c-designware.txt
+index 5199b0c8cf7a..fee26dc3e858 100644
+--- a/Documentation/devicetree/bindings/i2c/i2c-designware.txt
++++ b/Documentation/devicetree/bindings/i2c/i2c-designware.txt
+@@ -14,10 +14,10 @@ Optional properties :
+ - i2c-sda-hold-time-ns : should contain the SDA hold time in nanoseconds.
+ This option is only supported in hardware blocks version 1.11a or newer.
+
+- - i2c-scl-falling-time : should contain the SCL falling time in nanoseconds.
++ - i2c-scl-falling-time-ns : should contain the SCL falling time in nanoseconds.
+ This value which is by default 300ns is used to compute the tLOW period.
+
+- - i2c-sda-falling-time : should contain the SDA falling time in nanoseconds.
++ - i2c-sda-falling-time-ns : should contain the SDA falling time in nanoseconds.
+ This value which is by default 300ns is used to compute the tHIGH period.
+
+ Example :
+diff --git a/Documentation/ramoops.txt b/Documentation/ramoops.txt
+index 69b3cac4749d..5d8675615e59 100644
+--- a/Documentation/ramoops.txt
++++ b/Documentation/ramoops.txt
+@@ -14,11 +14,19 @@ survive after a restart.
+
+ 1. Ramoops concepts
+
+-Ramoops uses a predefined memory area to store the dump. The start and size of
+-the memory area are set using two variables:
++Ramoops uses a predefined memory area to store the dump. The start and size
++and type of the memory area are set using three variables:
+ * "mem_address" for the start
+ * "mem_size" for the size. The memory size will be rounded down to a
+ power of two.
++ * "mem_type" to specifiy if the memory type (default is pgprot_writecombine).
++
++Typically the default value of mem_type=0 should be used as that sets the pstore
++mapping to pgprot_writecombine. Setting mem_type=1 attempts to use
++pgprot_noncached, which only works on some platforms. This is because pstore
++depends on atomic operations. At least on ARM, pgprot_noncached causes the
++memory to be mapped strongly ordered, and atomic operations on strongly ordered
++memory are implementation defined, and won't work on many ARMs such as omaps.
+
+ The memory area is divided into "record_size" chunks (also rounded down to
+ power of two) and each oops/panic writes a "record_size" chunk of
+@@ -55,6 +63,7 @@ Setting the ramoops parameters can be done in 2 different manners:
+ static struct ramoops_platform_data ramoops_data = {
+ .mem_size = <...>,
+ .mem_address = <...>,
++ .mem_type = <...>,
+ .record_size = <...>,
+ .dump_oops = <...>,
+ .ecc = <...>,
+diff --git a/Makefile b/Makefile
+index 8f73b417dc1a..91cfe8d5ee06 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 18
+-SUBLEVEL = 2
++SUBLEVEL = 3
+ EXTRAVERSION =
+ NAME = Diseased Newt
+
+diff --git a/arch/arm/boot/dts/am437x-sk-evm.dts b/arch/arm/boot/dts/am437x-sk-evm.dts
+index 87aa4f3b8b3d..53bbfc90b26a 100644
+--- a/arch/arm/boot/dts/am437x-sk-evm.dts
++++ b/arch/arm/boot/dts/am437x-sk-evm.dts
+@@ -100,7 +100,7 @@
+ };
+
+ lcd0: display {
+- compatible = "osddisplays,osd057T0559-34ts", "panel-dpi";
++ compatible = "newhaven,nhd-4.3-480272ef-atxl", "panel-dpi";
+ label = "lcd";
+
+ pinctrl-names = "default";
+@@ -112,11 +112,11 @@
+ clock-frequency = <9000000>;
+ hactive = <480>;
+ vactive = <272>;
+- hfront-porch = <8>;
+- hback-porch = <43>;
+- hsync-len = <4>;
+- vback-porch = <12>;
+- vfront-porch = <4>;
++ hfront-porch = <2>;
++ hback-porch = <2>;
++ hsync-len = <41>;
++ vfront-porch = <2>;
++ vback-porch = <2>;
+ vsync-len = <10>;
+ hsync-active = <0>;
+ vsync-active = <0>;
+@@ -320,8 +320,7 @@
+
+ lcd_pins: lcd_pins {
+ pinctrl-single,pins = <
+- /* GPIO 5_8 to select LCD / HDMI */
+- 0x238 (PIN_OUTPUT_PULLUP | MUX_MODE7)
++ 0x1c (PIN_OUTPUT_PULLDOWN | MUX_MODE7) /* gpcm_ad7.gpio1_7 */
+ >;
+ };
+ };
+diff --git a/arch/arm/boot/dts/dra7.dtsi b/arch/arm/boot/dts/dra7.dtsi
+index 9cc98436a982..666e796847d8 100644
+--- a/arch/arm/boot/dts/dra7.dtsi
++++ b/arch/arm/boot/dts/dra7.dtsi
+@@ -653,7 +653,7 @@
+ };
+
+ wdt2: wdt@4ae14000 {
+- compatible = "ti,omap4-wdt";
++ compatible = "ti,omap3-wdt";
+ reg = <0x4ae14000 0x80>;
+ interrupts = <GIC_SPI 75 IRQ_TYPE_LEVEL_HIGH>;
+ ti,hwmods = "wd_timer2";
+diff --git a/arch/arm/boot/dts/s3c6410-mini6410.dts b/arch/arm/boot/dts/s3c6410-mini6410.dts
+index 57e00f9bce99..a25debb50401 100644
+--- a/arch/arm/boot/dts/s3c6410-mini6410.dts
++++ b/arch/arm/boot/dts/s3c6410-mini6410.dts
+@@ -198,10 +198,6 @@
+ status = "okay";
+ };
+
+-&pwm {
+- status = "okay";
+-};
+-
+ &pinctrl0 {
+ gpio_leds: gpio-leds {
+ samsung,pins = "gpk-4", "gpk-5", "gpk-6", "gpk-7";
+diff --git a/arch/arm/boot/dts/s3c64xx.dtsi b/arch/arm/boot/dts/s3c64xx.dtsi
+index ff5bdaac987a..0ccb414cd268 100644
+--- a/arch/arm/boot/dts/s3c64xx.dtsi
++++ b/arch/arm/boot/dts/s3c64xx.dtsi
+@@ -172,7 +172,6 @@
+ clocks = <&clocks PCLK_PWM>;
+ samsung,pwm-outputs = <0>, <1>;
+ #pwm-cells = <3>;
+- status = "disabled";
+ };
+
+ pinctrl0: pinctrl@7f008000 {
+diff --git a/arch/arm/configs/multi_v7_defconfig b/arch/arm/configs/multi_v7_defconfig
+index 9d7a32f93fcf..37560f19d346 100644
+--- a/arch/arm/configs/multi_v7_defconfig
++++ b/arch/arm/configs/multi_v7_defconfig
+@@ -320,6 +320,7 @@ CONFIG_USB=y
+ CONFIG_USB_XHCI_HCD=y
+ CONFIG_USB_XHCI_MVEBU=y
+ CONFIG_USB_EHCI_HCD=y
++CONFIG_USB_EHCI_EXYNOS=y
+ CONFIG_USB_EHCI_TEGRA=y
+ CONFIG_USB_EHCI_HCD_PLATFORM=y
+ CONFIG_USB_ISP1760_HCD=y
+@@ -445,4 +446,4 @@ CONFIG_DEBUG_FS=y
+ CONFIG_MAGIC_SYSRQ=y
+ CONFIG_LOCKUP_DETECTOR=y
+ CONFIG_CRYPTO_DEV_TEGRA_AES=y
+-CONFIG_GENERIC_CPUFREQ_CPU0=y
++CONFIG_CPUFREQ_DT=y
+diff --git a/arch/arm/configs/shmobile_defconfig b/arch/arm/configs/shmobile_defconfig
+index d7346ad51043..bfe79d5b8213 100644
+--- a/arch/arm/configs/shmobile_defconfig
++++ b/arch/arm/configs/shmobile_defconfig
+@@ -176,5 +176,5 @@ CONFIG_CPU_FREQ_GOV_USERSPACE=y
+ CONFIG_CPU_FREQ_GOV_ONDEMAND=y
+ CONFIG_CPU_FREQ_GOV_CONSERVATIVE=y
+ CONFIG_CPU_THERMAL=y
+-CONFIG_GENERIC_CPUFREQ_CPU0=y
++CONFIG_CPUFREQ_DT=y
+ CONFIG_REGULATOR_DA9210=y
+diff --git a/arch/arm/kernel/setup.c b/arch/arm/kernel/setup.c
+index c03106378b49..306e1ac2c8e3 100644
+--- a/arch/arm/kernel/setup.c
++++ b/arch/arm/kernel/setup.c
+@@ -1043,6 +1043,15 @@ static int c_show(struct seq_file *m, void *v)
+ seq_printf(m, "model name\t: %s rev %d (%s)\n",
+ cpu_name, cpuid & 15, elf_platform);
+
++#if defined(CONFIG_SMP)
++ seq_printf(m, "BogoMIPS\t: %lu.%02lu\n",
++ per_cpu(cpu_data, i).loops_per_jiffy / (500000UL/HZ),
++ (per_cpu(cpu_data, i).loops_per_jiffy / (5000UL/HZ)) % 100);
++#else
++ seq_printf(m, "BogoMIPS\t: %lu.%02lu\n",
++ loops_per_jiffy / (500000/HZ),
++ (loops_per_jiffy / (5000/HZ)) % 100);
++#endif
+ /* dump out the processor features */
+ seq_puts(m, "Features\t: ");
+
+diff --git a/arch/arm/kernel/smp.c b/arch/arm/kernel/smp.c
+index 13396d3d600e..a8e32aaf0383 100644
+--- a/arch/arm/kernel/smp.c
++++ b/arch/arm/kernel/smp.c
+@@ -387,8 +387,17 @@ asmlinkage void secondary_start_kernel(void)
+
+ void __init smp_cpus_done(unsigned int max_cpus)
+ {
+- printk(KERN_INFO "SMP: Total of %d processors activated.\n",
+- num_online_cpus());
++ int cpu;
++ unsigned long bogosum = 0;
++
++ for_each_online_cpu(cpu)
++ bogosum += per_cpu(cpu_data, cpu).loops_per_jiffy;
++
++ printk(KERN_INFO "SMP: Total of %d processors activated "
++ "(%lu.%02lu BogoMIPS).\n",
++ num_online_cpus(),
++ bogosum / (500000/HZ),
++ (bogosum / (5000/HZ)) % 100);
+
+ hyp_mode_check();
+ }
+diff --git a/arch/arm/mach-omap2/pm44xx.c b/arch/arm/mach-omap2/pm44xx.c
+index 503097c72b82..e7f823b960c2 100644
+--- a/arch/arm/mach-omap2/pm44xx.c
++++ b/arch/arm/mach-omap2/pm44xx.c
+@@ -160,26 +160,6 @@ static inline int omap4_init_static_deps(void)
+ struct clockdomain *ducati_clkdm, *l3_2_clkdm;
+ int ret = 0;
+
+- if (omap_rev() == OMAP4430_REV_ES1_0) {
+- WARN(1, "Power Management not supported on OMAP4430 ES1.0\n");
+- return -ENODEV;
+- }
+-
+- pr_err("Power Management for TI OMAP4.\n");
+- /*
+- * OMAP4 chip PM currently works only with certain (newer)
+- * versions of bootloaders. This is due to missing code in the
+- * kernel to properly reset and initialize some devices.
+- * http://www.spinics.net/lists/arm-kernel/msg218641.html
+- */
+- pr_warn("OMAP4 PM: u-boot >= v2012.07 is required for full PM support\n");
+-
+- ret = pwrdm_for_each(pwrdms_setup, NULL);
+- if (ret) {
+- pr_err("Failed to setup powerdomains\n");
+- return ret;
+- }
+-
+ /*
+ * The dynamic dependency between MPUSS -> MEMIF and
+ * MPUSS -> L4_PER/L3_* and DUCATI -> L3_* doesn't work as
+@@ -272,6 +252,15 @@ int __init omap4_pm_init(void)
+
+ pr_info("Power Management for TI OMAP4+ devices.\n");
+
++ /*
++ * OMAP4 chip PM currently works only with certain (newer)
++ * versions of bootloaders. This is due to missing code in the
++ * kernel to properly reset and initialize some devices.
++ * http://www.spinics.net/lists/arm-kernel/msg218641.html
++ */
++ if (cpu_is_omap44xx())
++ pr_warn("OMAP4 PM: u-boot >= v2012.07 is required for full PM support\n");
++
+ ret = pwrdm_for_each(pwrdms_setup, NULL);
+ if (ret) {
+ pr_err("Failed to setup powerdomains.\n");
+diff --git a/arch/arm64/kernel/efi.c b/arch/arm64/kernel/efi.c
+index 95c49ebc660d..1d85a7c5a850 100644
+--- a/arch/arm64/kernel/efi.c
++++ b/arch/arm64/kernel/efi.c
+@@ -327,6 +327,7 @@ void __init efi_idmap_init(void)
+
+ /* boot time idmap_pg_dir is incomplete, so fill in missing parts */
+ efi_setup_idmap();
++ early_memunmap(memmap.map, memmap.map_end - memmap.map);
+ }
+
+ static int __init remap_region(efi_memory_desc_t *md, void **new)
+@@ -381,7 +382,6 @@ static int __init arm64_enter_virtual_mode(void)
+ }
+
+ mapsize = memmap.map_end - memmap.map;
+- early_memunmap(memmap.map, mapsize);
+
+ if (efi_runtime_disabled()) {
+ pr_info("EFI runtime services will be disabled.\n");
+diff --git a/arch/arm64/kernel/setup.c b/arch/arm64/kernel/setup.c
+index f9620154bfb0..64c4f0800ee3 100644
+--- a/arch/arm64/kernel/setup.c
++++ b/arch/arm64/kernel/setup.c
+@@ -394,6 +394,7 @@ void __init setup_arch(char **cmdline_p)
+ request_standard_resources();
+
+ efi_idmap_init();
++ early_ioremap_reset();
+
+ unflatten_device_tree();
+
+diff --git a/arch/arm64/kernel/sleep.S b/arch/arm64/kernel/sleep.S
+index a564b440416a..ede186cdd452 100644
+--- a/arch/arm64/kernel/sleep.S
++++ b/arch/arm64/kernel/sleep.S
+@@ -147,14 +147,12 @@ cpu_resume_after_mmu:
+ ret
+ ENDPROC(cpu_resume_after_mmu)
+
+- .data
+ ENTRY(cpu_resume)
+ bl el2_setup // if in EL2 drop to EL1 cleanly
+ #ifdef CONFIG_SMP
+ mrs x1, mpidr_el1
+- adr x4, mpidr_hash_ptr
+- ldr x5, [x4]
+- add x8, x4, x5 // x8 = struct mpidr_hash phys address
++ adrp x8, mpidr_hash
++ add x8, x8, #:lo12:mpidr_hash // x8 = struct mpidr_hash phys address
+ /* retrieve mpidr_hash members to compute the hash */
+ ldr x2, [x8, #MPIDR_HASH_MASK]
+ ldp w3, w4, [x8, #MPIDR_HASH_SHIFTS]
+@@ -164,14 +162,15 @@ ENTRY(cpu_resume)
+ #else
+ mov x7, xzr
+ #endif
+- adr x0, sleep_save_sp
++ adrp x0, sleep_save_sp
++ add x0, x0, #:lo12:sleep_save_sp
+ ldr x0, [x0, #SLEEP_SAVE_SP_PHYS]
+ ldr x0, [x0, x7, lsl #3]
+ /* load sp from context */
+ ldr x2, [x0, #CPU_CTX_SP]
+- adr x1, sleep_idmap_phys
++ adrp x1, sleep_idmap_phys
+ /* load physical address of identity map page table in x1 */
+- ldr x1, [x1]
++ ldr x1, [x1, #:lo12:sleep_idmap_phys]
+ mov sp, x2
+ /*
+ * cpu_do_resume expects x0 to contain context physical address
+@@ -180,26 +179,3 @@ ENTRY(cpu_resume)
+ bl cpu_do_resume // PC relative jump, MMU off
+ b cpu_resume_mmu // Resume MMU, never returns
+ ENDPROC(cpu_resume)
+-
+- .align 3
+-mpidr_hash_ptr:
+- /*
+- * offset of mpidr_hash symbol from current location
+- * used to obtain run-time mpidr_hash address with MMU off
+- */
+- .quad mpidr_hash - .
+-/*
+- * physical address of identity mapped page tables
+- */
+- .type sleep_idmap_phys, #object
+-ENTRY(sleep_idmap_phys)
+- .quad 0
+-/*
+- * struct sleep_save_sp {
+- * phys_addr_t *save_ptr_stash;
+- * phys_addr_t save_ptr_stash_phys;
+- * };
+- */
+- .type sleep_save_sp, #object
+-ENTRY(sleep_save_sp)
+- .space SLEEP_SAVE_SP_SZ // struct sleep_save_sp
+diff --git a/arch/arm64/kernel/suspend.c b/arch/arm64/kernel/suspend.c
+index 13ad4dbb1615..2d6b6065fe7f 100644
+--- a/arch/arm64/kernel/suspend.c
++++ b/arch/arm64/kernel/suspend.c
+@@ -5,6 +5,7 @@
+ #include <asm/debug-monitors.h>
+ #include <asm/pgtable.h>
+ #include <asm/memory.h>
++#include <asm/mmu_context.h>
+ #include <asm/smp_plat.h>
+ #include <asm/suspend.h>
+ #include <asm/tlbflush.h>
+@@ -98,7 +99,18 @@ int __cpu_suspend(unsigned long arg, int (*fn)(unsigned long))
+ */
+ ret = __cpu_suspend_enter(arg, fn);
+ if (ret == 0) {
+- cpu_switch_mm(mm->pgd, mm);
++ /*
++ * We are resuming from reset with TTBR0_EL1 set to the
++ * idmap to enable the MMU; restore the active_mm mappings in
++ * TTBR0_EL1 unless the active_mm == &init_mm, in which case
++ * the thread entered __cpu_suspend with TTBR0_EL1 set to
++ * reserved TTBR0 page tables and should be restored as such.
++ */
++ if (mm == &init_mm)
++ cpu_set_reserved_ttbr0();
++ else
++ cpu_switch_mm(mm->pgd, mm);
++
+ flush_tlb_all();
+
+ /*
+@@ -126,8 +138,8 @@ int __cpu_suspend(unsigned long arg, int (*fn)(unsigned long))
+ return ret;
+ }
+
+-extern struct sleep_save_sp sleep_save_sp;
+-extern phys_addr_t sleep_idmap_phys;
++struct sleep_save_sp sleep_save_sp;
++phys_addr_t sleep_idmap_phys;
+
+ static int __init cpu_suspend_init(void)
+ {
+diff --git a/arch/powerpc/include/asm/reg.h b/arch/powerpc/include/asm/reg.h
+index c998279bd85b..a68ee15964b3 100644
+--- a/arch/powerpc/include/asm/reg.h
++++ b/arch/powerpc/include/asm/reg.h
+@@ -118,8 +118,10 @@
+ #define __MSR (MSR_ME | MSR_RI | MSR_IR | MSR_DR | MSR_ISF |MSR_HV)
+ #ifdef __BIG_ENDIAN__
+ #define MSR_ __MSR
++#define MSR_IDLE (MSR_ME | MSR_SF | MSR_HV)
+ #else
+ #define MSR_ (__MSR | MSR_LE)
++#define MSR_IDLE (MSR_ME | MSR_SF | MSR_HV | MSR_LE)
+ #endif
+ #define MSR_KERNEL (MSR_ | MSR_64BIT)
+ #define MSR_USER32 (MSR_ | MSR_PR | MSR_EE)
+diff --git a/arch/powerpc/include/asm/syscall.h b/arch/powerpc/include/asm/syscall.h
+index 6240698fee9a..ff21b7a2f0cc 100644
+--- a/arch/powerpc/include/asm/syscall.h
++++ b/arch/powerpc/include/asm/syscall.h
+@@ -90,6 +90,10 @@ static inline void syscall_set_arguments(struct task_struct *task,
+
+ static inline int syscall_get_arch(void)
+ {
+- return is_32bit_task() ? AUDIT_ARCH_PPC : AUDIT_ARCH_PPC64;
++ int arch = is_32bit_task() ? AUDIT_ARCH_PPC : AUDIT_ARCH_PPC64;
++#ifdef __LITTLE_ENDIAN__
++ arch |= __AUDIT_ARCH_LE;
++#endif
++ return arch;
+ }
+ #endif /* _ASM_SYSCALL_H */
+diff --git a/arch/powerpc/kernel/idle_power7.S b/arch/powerpc/kernel/idle_power7.S
+index c0754bbf8118..283c603716a0 100644
+--- a/arch/powerpc/kernel/idle_power7.S
++++ b/arch/powerpc/kernel/idle_power7.S
+@@ -101,7 +101,23 @@ _GLOBAL(power7_powersave_common)
+ std r9,_MSR(r1)
+ std r1,PACAR1(r13)
+
+-_GLOBAL(power7_enter_nap_mode)
++ /*
++ * Go to real mode to do the nap, as required by the architecture.
++ * Also, we need to be in real mode before setting hwthread_state,
++ * because as soon as we do that, another thread can switch
++ * the MMU context to the guest.
++ */
++ LOAD_REG_IMMEDIATE(r5, MSR_IDLE)
++ li r6, MSR_RI
++ andc r6, r9, r6
++ LOAD_REG_ADDR(r7, power7_enter_nap_mode)
++ mtmsrd r6, 1 /* clear RI before setting SRR0/1 */
++ mtspr SPRN_SRR0, r7
++ mtspr SPRN_SRR1, r5
++ rfid
++
++ .globl power7_enter_nap_mode
++power7_enter_nap_mode:
+ #ifdef CONFIG_KVM_BOOK3S_HV_POSSIBLE
+ /* Tell KVM we're napping */
+ li r4,KVM_HWTHREAD_IN_NAP
+diff --git a/arch/powerpc/kernel/mce_power.c b/arch/powerpc/kernel/mce_power.c
+index aa9aff3d6ad3..b6f123ab90ed 100644
+--- a/arch/powerpc/kernel/mce_power.c
++++ b/arch/powerpc/kernel/mce_power.c
+@@ -79,7 +79,7 @@ static long mce_handle_derror(uint64_t dsisr, uint64_t slb_error_bits)
+ }
+ if (dsisr & P7_DSISR_MC_TLB_MULTIHIT_MFTLB) {
+ if (cur_cpu_spec && cur_cpu_spec->flush_tlb)
+- cur_cpu_spec->flush_tlb(TLBIEL_INVAL_PAGE);
++ cur_cpu_spec->flush_tlb(TLBIEL_INVAL_SET);
+ /* reset error bits */
+ dsisr &= ~P7_DSISR_MC_TLB_MULTIHIT_MFTLB;
+ }
+@@ -110,7 +110,7 @@ static long mce_handle_common_ierror(uint64_t srr1)
+ break;
+ case P7_SRR1_MC_IFETCH_TLB_MULTIHIT:
+ if (cur_cpu_spec && cur_cpu_spec->flush_tlb) {
+- cur_cpu_spec->flush_tlb(TLBIEL_INVAL_PAGE);
++ cur_cpu_spec->flush_tlb(TLBIEL_INVAL_SET);
+ handled = 1;
+ }
+ break;
+diff --git a/arch/powerpc/kernel/udbg_16550.c b/arch/powerpc/kernel/udbg_16550.c
+index 6e7c4923b5ea..411116c38da4 100644
+--- a/arch/powerpc/kernel/udbg_16550.c
++++ b/arch/powerpc/kernel/udbg_16550.c
+@@ -69,8 +69,12 @@ static void udbg_uart_putc(char c)
+
+ static int udbg_uart_getc_poll(void)
+ {
+- if (!udbg_uart_in || !(udbg_uart_in(UART_LSR) & LSR_DR))
++ if (!udbg_uart_in)
++ return -1;
++
++ if (!(udbg_uart_in(UART_LSR) & LSR_DR))
+ return udbg_uart_in(UART_RBR);
++
+ return -1;
+ }
+
+diff --git a/arch/powerpc/perf/hv-24x7.c b/arch/powerpc/perf/hv-24x7.c
+index dba34088da28..d073e0679a0c 100644
+--- a/arch/powerpc/perf/hv-24x7.c
++++ b/arch/powerpc/perf/hv-24x7.c
+@@ -217,11 +217,14 @@ static bool is_physical_domain(int domain)
+ domain == HV_24X7_PERF_DOMAIN_PHYSICAL_CORE;
+ }
+
++DEFINE_PER_CPU(char, hv_24x7_reqb[4096]) __aligned(4096);
++DEFINE_PER_CPU(char, hv_24x7_resb[4096]) __aligned(4096);
++
+ static unsigned long single_24x7_request(u8 domain, u32 offset, u16 ix,
+ u16 lpar, u64 *res,
+ bool success_expected)
+ {
+- unsigned long ret = -ENOMEM;
++ unsigned long ret;
+
+ /*
+ * request_buffer and result_buffer are not required to be 4k aligned,
+@@ -243,13 +246,11 @@ static unsigned long single_24x7_request(u8 domain, u32 offset, u16 ix,
+ BUILD_BUG_ON(sizeof(*request_buffer) > 4096);
+ BUILD_BUG_ON(sizeof(*result_buffer) > 4096);
+
+- request_buffer = kmem_cache_zalloc(hv_page_cache, GFP_USER);
+- if (!request_buffer)
+- goto out;
++ request_buffer = (void *)get_cpu_var(hv_24x7_reqb);
++ result_buffer = (void *)get_cpu_var(hv_24x7_resb);
+
+- result_buffer = kmem_cache_zalloc(hv_page_cache, GFP_USER);
+- if (!result_buffer)
+- goto out_free_request_buffer;
++ memset(request_buffer, 0, 4096);
++ memset(result_buffer, 0, 4096);
+
+ *request_buffer = (struct reqb) {
+ .buf = {
+@@ -278,15 +279,11 @@ static unsigned long single_24x7_request(u8 domain, u32 offset, u16 ix,
+ domain, offset, ix, lpar, ret, ret,
+ result_buffer->buf.detailed_rc,
+ result_buffer->buf.failing_request_ix);
+- goto out_free_result_buffer;
++ goto out;
+ }
+
+ *res = be64_to_cpu(result_buffer->result);
+
+-out_free_result_buffer:
+- kfree(result_buffer);
+-out_free_request_buffer:
+- kfree(request_buffer);
+ out:
+ return ret;
+ }
+diff --git a/arch/s390/kvm/gaccess.c b/arch/s390/kvm/gaccess.c
+index 0f961a1c64b3..6dc0ad9c7050 100644
+--- a/arch/s390/kvm/gaccess.c
++++ b/arch/s390/kvm/gaccess.c
+@@ -229,10 +229,12 @@ static void ipte_lock_simple(struct kvm_vcpu *vcpu)
+ goto out;
+ ic = &vcpu->kvm->arch.sca->ipte_control;
+ do {
+- old = ACCESS_ONCE(*ic);
++ old = *ic;
++ barrier();
+ while (old.k) {
+ cond_resched();
+- old = ACCESS_ONCE(*ic);
++ old = *ic;
++ barrier();
+ }
+ new = old;
+ new.k = 1;
+@@ -251,7 +253,9 @@ static void ipte_unlock_simple(struct kvm_vcpu *vcpu)
+ goto out;
+ ic = &vcpu->kvm->arch.sca->ipte_control;
+ do {
+- new = old = ACCESS_ONCE(*ic);
++ old = *ic;
++ barrier();
++ new = old;
+ new.k = 0;
+ } while (cmpxchg(&ic->val, old.val, new.val) != old.val);
+ wake_up(&vcpu->kvm->arch.ipte_wq);
+@@ -265,10 +269,12 @@ static void ipte_lock_siif(struct kvm_vcpu *vcpu)
+
+ ic = &vcpu->kvm->arch.sca->ipte_control;
+ do {
+- old = ACCESS_ONCE(*ic);
++ old = *ic;
++ barrier();
+ while (old.kg) {
+ cond_resched();
+- old = ACCESS_ONCE(*ic);
++ old = *ic;
++ barrier();
+ }
+ new = old;
+ new.k = 1;
+@@ -282,7 +288,9 @@ static void ipte_unlock_siif(struct kvm_vcpu *vcpu)
+
+ ic = &vcpu->kvm->arch.sca->ipte_control;
+ do {
+- new = old = ACCESS_ONCE(*ic);
++ old = *ic;
++ barrier();
++ new = old;
+ new.kh--;
+ if (!new.kh)
+ new.k = 0;
+diff --git a/arch/s390/kvm/interrupt.c b/arch/s390/kvm/interrupt.c
+index a39838457f01..4fc3fed636dc 100644
+--- a/arch/s390/kvm/interrupt.c
++++ b/arch/s390/kvm/interrupt.c
+@@ -270,7 +270,7 @@ static int __must_check __deliver_prog_irq(struct kvm_vcpu *vcpu,
+ break;
+ case PGM_MONITOR:
+ rc = put_guest_lc(vcpu, pgm_info->mon_class_nr,
+- (u64 *)__LC_MON_CLASS_NR);
++ (u16 *)__LC_MON_CLASS_NR);
+ rc |= put_guest_lc(vcpu, pgm_info->mon_code,
+ (u64 *)__LC_MON_CODE);
+ break;
+diff --git a/arch/s390/kvm/priv.c b/arch/s390/kvm/priv.c
+index 72bb2dd8b9cd..9c565b6b4ccb 100644
+--- a/arch/s390/kvm/priv.c
++++ b/arch/s390/kvm/priv.c
+@@ -791,7 +791,7 @@ int kvm_s390_handle_lctl(struct kvm_vcpu *vcpu)
+ break;
+ reg = (reg + 1) % 16;
+ } while (1);
+-
++ kvm_make_request(KVM_REQ_TLB_FLUSH, vcpu);
+ return 0;
+ }
+
+@@ -863,7 +863,7 @@ static int handle_lctlg(struct kvm_vcpu *vcpu)
+ break;
+ reg = (reg + 1) % 16;
+ } while (1);
+-
++ kvm_make_request(KVM_REQ_TLB_FLUSH, vcpu);
+ return 0;
+ }
+
+diff --git a/arch/x86/crypto/Makefile b/arch/x86/crypto/Makefile
+index fd0f848938cc..5a4a089e8b1f 100644
+--- a/arch/x86/crypto/Makefile
++++ b/arch/x86/crypto/Makefile
+@@ -26,7 +26,6 @@ obj-$(CONFIG_CRYPTO_GHASH_CLMUL_NI_INTEL) += ghash-clmulni-intel.o
+
+ obj-$(CONFIG_CRYPTO_CRC32C_INTEL) += crc32c-intel.o
+ obj-$(CONFIG_CRYPTO_SHA1_SSSE3) += sha1-ssse3.o
+-obj-$(CONFIG_CRYPTO_SHA1_MB) += sha-mb/
+ obj-$(CONFIG_CRYPTO_CRC32_PCLMUL) += crc32-pclmul.o
+ obj-$(CONFIG_CRYPTO_SHA256_SSSE3) += sha256-ssse3.o
+ obj-$(CONFIG_CRYPTO_SHA512_SSSE3) += sha512-ssse3.o
+@@ -46,6 +45,7 @@ endif
+ ifeq ($(avx2_supported),yes)
+ obj-$(CONFIG_CRYPTO_CAMELLIA_AESNI_AVX2_X86_64) += camellia-aesni-avx2.o
+ obj-$(CONFIG_CRYPTO_SERPENT_AVX2_X86_64) += serpent-avx2.o
++ obj-$(CONFIG_CRYPTO_SHA1_MB) += sha-mb/
+ endif
+
+ aes-i586-y := aes-i586-asm_32.o aes_glue.o
+diff --git a/arch/x86/crypto/aes_ctrby8_avx-x86_64.S b/arch/x86/crypto/aes_ctrby8_avx-x86_64.S
+index 2df2a0298f5a..a916c4a61165 100644
+--- a/arch/x86/crypto/aes_ctrby8_avx-x86_64.S
++++ b/arch/x86/crypto/aes_ctrby8_avx-x86_64.S
+@@ -208,7 +208,7 @@ ddq_add_8:
+
+ .if (klen == KEY_128)
+ .if (load_keys)
+- vmovdqa 3*16(p_keys), xkeyA
++ vmovdqa 3*16(p_keys), xkey4
+ .endif
+ .else
+ vmovdqa 3*16(p_keys), xkeyA
+@@ -224,7 +224,7 @@ ddq_add_8:
+ add $(16*by), p_in
+
+ .if (klen == KEY_128)
+- vmovdqa 4*16(p_keys), xkey4
++ vmovdqa 4*16(p_keys), xkeyB
+ .else
+ .if (load_keys)
+ vmovdqa 4*16(p_keys), xkey4
+@@ -234,7 +234,12 @@ ddq_add_8:
+ .set i, 0
+ .rept by
+ club XDATA, i
+- vaesenc xkeyA, var_xdata, var_xdata /* key 3 */
++ /* key 3 */
++ .if (klen == KEY_128)
++ vaesenc xkey4, var_xdata, var_xdata
++ .else
++ vaesenc xkeyA, var_xdata, var_xdata
++ .endif
+ .set i, (i +1)
+ .endr
+
+@@ -243,13 +248,18 @@ ddq_add_8:
+ .set i, 0
+ .rept by
+ club XDATA, i
+- vaesenc xkey4, var_xdata, var_xdata /* key 4 */
++ /* key 4 */
++ .if (klen == KEY_128)
++ vaesenc xkeyB, var_xdata, var_xdata
++ .else
++ vaesenc xkey4, var_xdata, var_xdata
++ .endif
+ .set i, (i +1)
+ .endr
+
+ .if (klen == KEY_128)
+ .if (load_keys)
+- vmovdqa 6*16(p_keys), xkeyB
++ vmovdqa 6*16(p_keys), xkey8
+ .endif
+ .else
+ vmovdqa 6*16(p_keys), xkeyB
+@@ -267,12 +277,17 @@ ddq_add_8:
+ .set i, 0
+ .rept by
+ club XDATA, i
+- vaesenc xkeyB, var_xdata, var_xdata /* key 6 */
++ /* key 6 */
++ .if (klen == KEY_128)
++ vaesenc xkey8, var_xdata, var_xdata
++ .else
++ vaesenc xkeyB, var_xdata, var_xdata
++ .endif
+ .set i, (i +1)
+ .endr
+
+ .if (klen == KEY_128)
+- vmovdqa 8*16(p_keys), xkey8
++ vmovdqa 8*16(p_keys), xkeyB
+ .else
+ .if (load_keys)
+ vmovdqa 8*16(p_keys), xkey8
+@@ -288,7 +303,7 @@ ddq_add_8:
+
+ .if (klen == KEY_128)
+ .if (load_keys)
+- vmovdqa 9*16(p_keys), xkeyA
++ vmovdqa 9*16(p_keys), xkey12
+ .endif
+ .else
+ vmovdqa 9*16(p_keys), xkeyA
+@@ -297,7 +312,12 @@ ddq_add_8:
+ .set i, 0
+ .rept by
+ club XDATA, i
+- vaesenc xkey8, var_xdata, var_xdata /* key 8 */
++ /* key 8 */
++ .if (klen == KEY_128)
++ vaesenc xkeyB, var_xdata, var_xdata
++ .else
++ vaesenc xkey8, var_xdata, var_xdata
++ .endif
+ .set i, (i +1)
+ .endr
+
+@@ -306,7 +326,12 @@ ddq_add_8:
+ .set i, 0
+ .rept by
+ club XDATA, i
+- vaesenc xkeyA, var_xdata, var_xdata /* key 9 */
++ /* key 9 */
++ .if (klen == KEY_128)
++ vaesenc xkey12, var_xdata, var_xdata
++ .else
++ vaesenc xkeyA, var_xdata, var_xdata
++ .endif
+ .set i, (i +1)
+ .endr
+
+@@ -412,7 +437,6 @@ ddq_add_8:
+ /* main body of aes ctr load */
+
+ .macro do_aes_ctrmain key_len
+-
+ cmp $16, num_bytes
+ jb .Ldo_return2\key_len
+
+diff --git a/arch/x86/include/asm/vsyscall.h b/arch/x86/include/asm/vsyscall.h
+index 2a46ca720afc..2874be9aef0a 100644
+--- a/arch/x86/include/asm/vsyscall.h
++++ b/arch/x86/include/asm/vsyscall.h
+@@ -34,7 +34,7 @@ static inline unsigned int __getcpu(void)
+ native_read_tscp(&p);
+ } else {
+ /* Load per CPU data from GDT */
+- asm("lsl %1,%0" : "=r" (p) : "r" (__PER_CPU_SEG));
++ asm volatile ("lsl %1,%0" : "=r" (p) : "r" (__PER_CPU_SEG));
+ }
+
+ return p;
+diff --git a/arch/x86/kernel/cpu/perf_event_intel_uncore.c b/arch/x86/kernel/cpu/perf_event_intel_uncore.c
+index 9762dbd9f3f7..e98f68cfea02 100644
+--- a/arch/x86/kernel/cpu/perf_event_intel_uncore.c
++++ b/arch/x86/kernel/cpu/perf_event_intel_uncore.c
+@@ -276,6 +276,17 @@ static struct intel_uncore_box *uncore_alloc_box(struct intel_uncore_type *type,
+ return box;
+ }
+
++/*
++ * Using uncore_pmu_event_init pmu event_init callback
++ * as a detection point for uncore events.
++ */
++static int uncore_pmu_event_init(struct perf_event *event);
++
++static bool is_uncore_event(struct perf_event *event)
++{
++ return event->pmu->event_init == uncore_pmu_event_init;
++}
++
+ static int
+ uncore_collect_events(struct intel_uncore_box *box, struct perf_event *leader, bool dogrp)
+ {
+@@ -290,13 +301,18 @@ uncore_collect_events(struct intel_uncore_box *box, struct perf_event *leader, b
+ return -EINVAL;
+
+ n = box->n_events;
+- box->event_list[n] = leader;
+- n++;
++
++ if (is_uncore_event(leader)) {
++ box->event_list[n] = leader;
++ n++;
++ }
++
+ if (!dogrp)
+ return n;
+
+ list_for_each_entry(event, &leader->sibling_list, group_entry) {
+- if (event->state <= PERF_EVENT_STATE_OFF)
++ if (!is_uncore_event(event) ||
++ event->state <= PERF_EVENT_STATE_OFF)
+ continue;
+
+ if (n >= max_count)
+diff --git a/arch/x86/kernel/cpu/perf_event_intel_uncore.h b/arch/x86/kernel/cpu/perf_event_intel_uncore.h
+index 18eb78bbdd10..863d9b02563e 100644
+--- a/arch/x86/kernel/cpu/perf_event_intel_uncore.h
++++ b/arch/x86/kernel/cpu/perf_event_intel_uncore.h
+@@ -17,7 +17,7 @@
+ #define UNCORE_PCI_DEV_TYPE(data) ((data >> 8) & 0xff)
+ #define UNCORE_PCI_DEV_IDX(data) (data & 0xff)
+ #define UNCORE_EXTRA_PCI_DEV 0xff
+-#define UNCORE_EXTRA_PCI_DEV_MAX 2
++#define UNCORE_EXTRA_PCI_DEV_MAX 3
+
+ /* support up to 8 sockets */
+ #define UNCORE_SOCKET_MAX 8
+diff --git a/arch/x86/kernel/cpu/perf_event_intel_uncore_snbep.c b/arch/x86/kernel/cpu/perf_event_intel_uncore_snbep.c
+index f9ed429d6e4f..ab474faa262b 100644
+--- a/arch/x86/kernel/cpu/perf_event_intel_uncore_snbep.c
++++ b/arch/x86/kernel/cpu/perf_event_intel_uncore_snbep.c
+@@ -887,6 +887,7 @@ void snbep_uncore_cpu_init(void)
+ enum {
+ SNBEP_PCI_QPI_PORT0_FILTER,
+ SNBEP_PCI_QPI_PORT1_FILTER,
++ HSWEP_PCI_PCU_3,
+ };
+
+ static int snbep_qpi_hw_config(struct intel_uncore_box *box, struct perf_event *event)
+@@ -2022,6 +2023,17 @@ void hswep_uncore_cpu_init(void)
+ {
+ if (hswep_uncore_cbox.num_boxes > boot_cpu_data.x86_max_cores)
+ hswep_uncore_cbox.num_boxes = boot_cpu_data.x86_max_cores;
++
++ /* Detect 6-8 core systems with only two SBOXes */
++ if (uncore_extra_pci_dev[0][HSWEP_PCI_PCU_3]) {
++ u32 capid4;
++
++ pci_read_config_dword(uncore_extra_pci_dev[0][HSWEP_PCI_PCU_3],
++ 0x94, &capid4);
++ if (((capid4 >> 6) & 0x3) == 0)
++ hswep_uncore_sbox.num_boxes = 2;
++ }
++
+ uncore_msr_uncores = hswep_msr_uncores;
+ }
+
+@@ -2279,6 +2291,11 @@ static DEFINE_PCI_DEVICE_TABLE(hswep_uncore_pci_ids) = {
+ .driver_data = UNCORE_PCI_DEV_DATA(UNCORE_EXTRA_PCI_DEV,
+ SNBEP_PCI_QPI_PORT1_FILTER),
+ },
++ { /* PCU.3 (for Capability registers) */
++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x2fc0),
++ .driver_data = UNCORE_PCI_DEV_DATA(UNCORE_EXTRA_PCI_DEV,
++ HSWEP_PCI_PCU_3),
++ },
+ { /* end: all zeroes */ }
+ };
+
+diff --git a/arch/x86/kernel/xsave.c b/arch/x86/kernel/xsave.c
+index 4c540c4719d8..0de1fae2bdf0 100644
+--- a/arch/x86/kernel/xsave.c
++++ b/arch/x86/kernel/xsave.c
+@@ -738,3 +738,4 @@ void *get_xsave_addr(struct xsave_struct *xsave, int xstate)
+
+ return (void *)xsave + xstate_comp_offsets[feature];
+ }
++EXPORT_SYMBOL_GPL(get_xsave_addr);
+diff --git a/arch/x86/kvm/cpuid.c b/arch/x86/kvm/cpuid.c
+index 976e3a57f9ea..88f92014ba6b 100644
+--- a/arch/x86/kvm/cpuid.c
++++ b/arch/x86/kvm/cpuid.c
+@@ -319,6 +319,10 @@ static inline int __do_cpuid_ent(struct kvm_cpuid_entry2 *entry, u32 function,
+ F(BMI2) | F(ERMS) | f_invpcid | F(RTM) | f_mpx | F(RDSEED) |
+ F(ADX) | F(SMAP);
+
++ /* cpuid 0xD.1.eax */
++ const u32 kvm_supported_word10_x86_features =
++ F(XSAVEOPT) | F(XSAVEC) | F(XGETBV1);
++
+ /* all calls to cpuid_count() should be made on the same cpu */
+ get_cpu();
+
+@@ -455,13 +459,18 @@ static inline int __do_cpuid_ent(struct kvm_cpuid_entry2 *entry, u32 function,
+ entry->eax &= supported;
+ entry->edx &= supported >> 32;
+ entry->flags |= KVM_CPUID_FLAG_SIGNIFCANT_INDEX;
++ if (!supported)
++ break;
++
+ for (idx = 1, i = 1; idx < 64; ++idx) {
+ u64 mask = ((u64)1 << idx);
+ if (*nent >= maxnent)
+ goto out;
+
+ do_cpuid_1_ent(&entry[i], function, idx);
+- if (entry[i].eax == 0 || !(supported & mask))
++ if (idx == 1)
++ entry[i].eax &= kvm_supported_word10_x86_features;
++ else if (entry[i].eax == 0 || !(supported & mask))
+ continue;
+ entry[i].flags |=
+ KVM_CPUID_FLAG_SIGNIFCANT_INDEX;
+diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
+index 9f8a2faf5040..22e7ed9e6d8e 100644
+--- a/arch/x86/kvm/emulate.c
++++ b/arch/x86/kvm/emulate.c
+@@ -2128,7 +2128,7 @@ static int em_ret_far(struct x86_emulate_ctxt *ctxt)
+ /* Outer-privilege level return is not implemented */
+ if (ctxt->mode >= X86EMUL_MODE_PROT16 && (cs & 3) > cpl)
+ return X86EMUL_UNHANDLEABLE;
+- rc = __load_segment_descriptor(ctxt, (u16)cs, VCPU_SREG_CS, 0, false,
++ rc = __load_segment_descriptor(ctxt, (u16)cs, VCPU_SREG_CS, cpl, false,
+ &new_desc);
+ if (rc != X86EMUL_CONTINUE)
+ return rc;
+diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
+index 978f402006ee..9c12e63c653f 100644
+--- a/arch/x86/kvm/mmu.c
++++ b/arch/x86/kvm/mmu.c
+@@ -4449,7 +4449,7 @@ void kvm_mmu_invalidate_mmio_sptes(struct kvm *kvm)
+ * zap all shadow pages.
+ */
+ if (unlikely(kvm_current_mmio_generation(kvm) == 0)) {
+- printk_ratelimited(KERN_INFO "kvm: zapping shadow pages for mmio generation wraparound\n");
++ printk_ratelimited(KERN_DEBUG "kvm: zapping shadow pages for mmio generation wraparound\n");
+ kvm_mmu_invalidate_zap_all_pages(kvm);
+ }
+ }
+diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
+index 0033df32a745..506488cfa385 100644
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -3128,15 +3128,89 @@ static int kvm_vcpu_ioctl_x86_set_debugregs(struct kvm_vcpu *vcpu,
+ return 0;
+ }
+
++#define XSTATE_COMPACTION_ENABLED (1ULL << 63)
++
++static void fill_xsave(u8 *dest, struct kvm_vcpu *vcpu)
++{
++ struct xsave_struct *xsave = &vcpu->arch.guest_fpu.state->xsave;
++ u64 xstate_bv = xsave->xsave_hdr.xstate_bv;
++ u64 valid;
++
++ /*
++ * Copy legacy XSAVE area, to avoid complications with CPUID
++ * leaves 0 and 1 in the loop below.
++ */
++ memcpy(dest, xsave, XSAVE_HDR_OFFSET);
++
++ /* Set XSTATE_BV */
++ *(u64 *)(dest + XSAVE_HDR_OFFSET) = xstate_bv;
++
++ /*
++ * Copy each region from the possibly compacted offset to the
++ * non-compacted offset.
++ */
++ valid = xstate_bv & ~XSTATE_FPSSE;
++ while (valid) {
++ u64 feature = valid & -valid;
++ int index = fls64(feature) - 1;
++ void *src = get_xsave_addr(xsave, feature);
++
++ if (src) {
++ u32 size, offset, ecx, edx;
++ cpuid_count(XSTATE_CPUID, index,
++ &size, &offset, &ecx, &edx);
++ memcpy(dest + offset, src, size);
++ }
++
++ valid -= feature;
++ }
++}
++
++static void load_xsave(struct kvm_vcpu *vcpu, u8 *src)
++{
++ struct xsave_struct *xsave = &vcpu->arch.guest_fpu.state->xsave;
++ u64 xstate_bv = *(u64 *)(src + XSAVE_HDR_OFFSET);
++ u64 valid;
++
++ /*
++ * Copy legacy XSAVE area, to avoid complications with CPUID
++ * leaves 0 and 1 in the loop below.
++ */
++ memcpy(xsave, src, XSAVE_HDR_OFFSET);
++
++ /* Set XSTATE_BV and possibly XCOMP_BV. */
++ xsave->xsave_hdr.xstate_bv = xstate_bv;
++ if (cpu_has_xsaves)
++ xsave->xsave_hdr.xcomp_bv = host_xcr0 | XSTATE_COMPACTION_ENABLED;
++
++ /*
++ * Copy each region from the non-compacted offset to the
++ * possibly compacted offset.
++ */
++ valid = xstate_bv & ~XSTATE_FPSSE;
++ while (valid) {
++ u64 feature = valid & -valid;
++ int index = fls64(feature) - 1;
++ void *dest = get_xsave_addr(xsave, feature);
++
++ if (dest) {
++ u32 size, offset, ecx, edx;
++ cpuid_count(XSTATE_CPUID, index,
++ &size, &offset, &ecx, &edx);
++ memcpy(dest, src + offset, size);
++ } else
++ WARN_ON_ONCE(1);
++
++ valid -= feature;
++ }
++}
++
+ static void kvm_vcpu_ioctl_x86_get_xsave(struct kvm_vcpu *vcpu,
+ struct kvm_xsave *guest_xsave)
+ {
+ if (cpu_has_xsave) {
+- memcpy(guest_xsave->region,
+- &vcpu->arch.guest_fpu.state->xsave,
+- vcpu->arch.guest_xstate_size);
+- *(u64 *)&guest_xsave->region[XSAVE_HDR_OFFSET / sizeof(u32)] &=
+- vcpu->arch.guest_supported_xcr0 | XSTATE_FPSSE;
++ memset(guest_xsave, 0, sizeof(struct kvm_xsave));
++ fill_xsave((u8 *) guest_xsave->region, vcpu);
+ } else {
+ memcpy(guest_xsave->region,
+ &vcpu->arch.guest_fpu.state->fxsave,
+@@ -3160,8 +3234,7 @@ static int kvm_vcpu_ioctl_x86_set_xsave(struct kvm_vcpu *vcpu,
+ */
+ if (xstate_bv & ~kvm_supported_xcr0())
+ return -EINVAL;
+- memcpy(&vcpu->arch.guest_fpu.state->xsave,
+- guest_xsave->region, vcpu->arch.guest_xstate_size);
++ load_xsave(vcpu, (u8 *)guest_xsave->region);
+ } else {
+ if (xstate_bv & ~XSTATE_FPSSE)
+ return -EINVAL;
+@@ -6873,6 +6946,9 @@ int fx_init(struct kvm_vcpu *vcpu)
+ return err;
+
+ fpu_finit(&vcpu->arch.guest_fpu);
++ if (cpu_has_xsaves)
++ vcpu->arch.guest_fpu.state->xsave.xsave_hdr.xcomp_bv =
++ host_xcr0 | XSTATE_COMPACTION_ENABLED;
+
+ /*
+ * Ensure guest xcr0 is valid for loading
+diff --git a/arch/x86/vdso/vma.c b/arch/x86/vdso/vma.c
+index 970463b566cf..208c2206df46 100644
+--- a/arch/x86/vdso/vma.c
++++ b/arch/x86/vdso/vma.c
+@@ -54,12 +54,17 @@ subsys_initcall(init_vdso);
+
+ struct linux_binprm;
+
+-/* Put the vdso above the (randomized) stack with another randomized offset.
+- This way there is no hole in the middle of address space.
+- To save memory make sure it is still in the same PTE as the stack top.
+- This doesn't give that many random bits.
+-
+- Only used for the 64-bit and x32 vdsos. */
++/*
++ * Put the vdso above the (randomized) stack with another randomized
++ * offset. This way there is no hole in the middle of address space.
++ * To save memory make sure it is still in the same PTE as the stack
++ * top. This doesn't give that many random bits.
++ *
++ * Note that this algorithm is imperfect: the distribution of the vdso
++ * start address within a PMD is biased toward the end.
++ *
++ * Only used for the 64-bit and x32 vdsos.
++ */
+ static unsigned long vdso_addr(unsigned long start, unsigned len)
+ {
+ #ifdef CONFIG_X86_32
+@@ -67,22 +72,30 @@ static unsigned long vdso_addr(unsigned long start, unsigned len)
+ #else
+ unsigned long addr, end;
+ unsigned offset;
+- end = (start + PMD_SIZE - 1) & PMD_MASK;
++
++ /*
++ * Round up the start address. It can start out unaligned as a result
++ * of stack start randomization.
++ */
++ start = PAGE_ALIGN(start);
++
++ /* Round the lowest possible end address up to a PMD boundary. */
++ end = (start + len + PMD_SIZE - 1) & PMD_MASK;
+ if (end >= TASK_SIZE_MAX)
+ end = TASK_SIZE_MAX;
+ end -= len;
+- /* This loses some more bits than a modulo, but is cheaper */
+- offset = get_random_int() & (PTRS_PER_PTE - 1);
+- addr = start + (offset << PAGE_SHIFT);
+- if (addr >= end)
+- addr = end;
++
++ if (end > start) {
++ offset = get_random_int() % (((end - start) >> PAGE_SHIFT) + 1);
++ addr = start + (offset << PAGE_SHIFT);
++ } else {
++ addr = start;
++ }
+
+ /*
+- * page-align it here so that get_unmapped_area doesn't
+- * align it wrongfully again to the next page. addr can come in 4K
+- * unaligned here as a result of stack start randomization.
++ * Forcibly align the final address in case we have a hardware
++ * issue that requires alignment for performance reasons.
+ */
+- addr = PAGE_ALIGN(addr);
+ addr = align_vdso_addr(addr);
+
+ return addr;
+diff --git a/arch/xtensa/include/asm/highmem.h b/arch/xtensa/include/asm/highmem.h
+index 2c7901edffaf..01cef6b40829 100644
+--- a/arch/xtensa/include/asm/highmem.h
++++ b/arch/xtensa/include/asm/highmem.h
+@@ -25,7 +25,7 @@
+ #define PKMAP_NR(virt) (((virt) - PKMAP_BASE) >> PAGE_SHIFT)
+ #define PKMAP_ADDR(nr) (PKMAP_BASE + ((nr) << PAGE_SHIFT))
+
+-#define kmap_prot PAGE_KERNEL
++#define kmap_prot PAGE_KERNEL_EXEC
+
+ #if DCACHE_WAY_SIZE > PAGE_SIZE
+ #define get_pkmap_color get_pkmap_color
+diff --git a/block/blk-core.c b/block/blk-core.c
+index 0421b53e6431..93f9152fc271 100644
+--- a/block/blk-core.c
++++ b/block/blk-core.c
+@@ -525,6 +525,9 @@ void blk_cleanup_queue(struct request_queue *q)
+ del_timer_sync(&q->backing_dev_info.laptop_mode_wb_timer);
+ blk_sync_queue(q);
+
++ if (q->mq_ops)
++ blk_mq_free_queue(q);
++
+ spin_lock_irq(lock);
+ if (q->queue_lock != &q->__queue_lock)
+ q->queue_lock = &q->__queue_lock;
+diff --git a/block/blk-mq-cpumap.c b/block/blk-mq-cpumap.c
+index 1065d7c65fa1..72e5ed691e37 100644
+--- a/block/blk-mq-cpumap.c
++++ b/block/blk-mq-cpumap.c
+@@ -90,7 +90,7 @@ unsigned int *blk_mq_make_queue_map(struct blk_mq_tag_set *set)
+ unsigned int *map;
+
+ /* If cpus are offline, map them to first hctx */
+- map = kzalloc_node(sizeof(*map) * num_possible_cpus(), GFP_KERNEL,
++ map = kzalloc_node(sizeof(*map) * nr_cpu_ids, GFP_KERNEL,
+ set->numa_node);
+ if (!map)
+ return NULL;
+diff --git a/block/blk-mq-sysfs.c b/block/blk-mq-sysfs.c
+index 371d8800b48a..1630a20d5dcf 100644
+--- a/block/blk-mq-sysfs.c
++++ b/block/blk-mq-sysfs.c
+@@ -390,16 +390,15 @@ static void blk_mq_sysfs_init(struct request_queue *q)
+ {
+ struct blk_mq_hw_ctx *hctx;
+ struct blk_mq_ctx *ctx;
+- int i, j;
++ int i;
+
+ kobject_init(&q->mq_kobj, &blk_mq_ktype);
+
+- queue_for_each_hw_ctx(q, hctx, i) {
++ queue_for_each_hw_ctx(q, hctx, i)
+ kobject_init(&hctx->kobj, &blk_mq_hw_ktype);
+
+- hctx_for_each_ctx(hctx, ctx, j)
+- kobject_init(&ctx->kobj, &blk_mq_ctx_ktype);
+- }
++ queue_for_each_ctx(q, ctx, i)
++ kobject_init(&ctx->kobj, &blk_mq_ctx_ktype);
+ }
+
+ /* see blk_register_queue() */
+diff --git a/block/blk-mq-tag.c b/block/blk-mq-tag.c
+index 8317175a3009..ff18dab6b585 100644
+--- a/block/blk-mq-tag.c
++++ b/block/blk-mq-tag.c
+@@ -137,6 +137,7 @@ static inline bool hctx_may_queue(struct blk_mq_hw_ctx *hctx,
+ static int __bt_get_word(struct blk_align_bitmap *bm, unsigned int last_tag)
+ {
+ int tag, org_last_tag, end;
++ bool wrap = last_tag != 0;
+
+ org_last_tag = last_tag;
+ end = bm->depth;
+@@ -148,15 +149,16 @@ restart:
+ * We started with an offset, start from 0 to
+ * exhaust the map.
+ */
+- if (org_last_tag && last_tag) {
+- end = last_tag;
++ if (wrap) {
++ wrap = false;
++ end = org_last_tag;
+ last_tag = 0;
+ goto restart;
+ }
+ return -1;
+ }
+ last_tag = tag + 1;
+- } while (test_and_set_bit_lock(tag, &bm->word));
++ } while (test_and_set_bit(tag, &bm->word));
+
+ return tag;
+ }
+@@ -340,11 +342,10 @@ static void bt_clear_tag(struct blk_mq_bitmap_tags *bt, unsigned int tag)
+ struct bt_wait_state *bs;
+ int wait_cnt;
+
+- /*
+- * The unlock memory barrier need to order access to req in free
+- * path and clearing tag bit
+- */
+- clear_bit_unlock(TAG_TO_BIT(bt, tag), &bt->map[index].word);
++ clear_bit(TAG_TO_BIT(bt, tag), &bt->map[index].word);
++
++ /* Ensure that the wait list checks occur after clear_bit(). */
++ smp_mb();
+
+ bs = bt_wake_ptr(bt);
+ if (!bs)
+diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c
+index 1fac43408911..935ea2aa0730 100644
+--- a/block/blk-sysfs.c
++++ b/block/blk-sysfs.c
+@@ -492,17 +492,15 @@ static void blk_free_queue_rcu(struct rcu_head *rcu_head)
+ * Currently, its primary task it to free all the &struct request
+ * structures that were allocated to the queue and the queue itself.
+ *
+- * Caveat:
+- * Hopefully the low level driver will have finished any
+- * outstanding requests first...
++ * Note:
++ * The low level driver must have finished any outstanding requests first
++ * via blk_cleanup_queue().
+ **/
+ static void blk_release_queue(struct kobject *kobj)
+ {
+ struct request_queue *q =
+ container_of(kobj, struct request_queue, kobj);
+
+- blk_sync_queue(q);
+-
+ blkcg_exit_queue(q);
+
+ if (q->elevator) {
+@@ -517,9 +515,7 @@ static void blk_release_queue(struct kobject *kobj)
+ if (q->queue_tags)
+ __blk_queue_free_tags(q);
+
+- if (q->mq_ops)
+- blk_mq_free_queue(q);
+- else
++ if (!q->mq_ops)
+ blk_free_flush_queue(q->fq);
+
+ blk_trace_shutdown(q);
+diff --git a/block/genhd.c b/block/genhd.c
+index bd3060684ab2..0a536dc05f3b 100644
+--- a/block/genhd.c
++++ b/block/genhd.c
+@@ -1070,9 +1070,16 @@ int disk_expand_part_tbl(struct gendisk *disk, int partno)
+ struct disk_part_tbl *old_ptbl = disk->part_tbl;
+ struct disk_part_tbl *new_ptbl;
+ int len = old_ptbl ? old_ptbl->len : 0;
+- int target = partno + 1;
++ int i, target;
+ size_t size;
+- int i;
++
++ /*
++ * check for int overflow, since we can get here from blkpg_ioctl()
++ * with a user passed 'partno'.
++ */
++ target = partno + 1;
++ if (target < 0)
++ return -EINVAL;
+
+ /* disk_max_parts() is zero during initialization, ignore if so */
+ if (disk_max_parts(disk) && target > disk_max_parts(disk))
+diff --git a/drivers/acpi/device_pm.c b/drivers/acpi/device_pm.c
+index 7db193160766..93b71420a046 100644
+--- a/drivers/acpi/device_pm.c
++++ b/drivers/acpi/device_pm.c
+@@ -257,7 +257,7 @@ int acpi_bus_init_power(struct acpi_device *device)
+
+ device->power.state = ACPI_STATE_UNKNOWN;
+ if (!acpi_device_is_present(device))
+- return 0;
++ return -ENXIO;
+
+ result = acpi_device_get_power(device, &state);
+ if (result)
+diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
+index 0476e90b2091..c9ea3dfb4974 100644
+--- a/drivers/acpi/scan.c
++++ b/drivers/acpi/scan.c
+@@ -909,7 +909,7 @@ static void acpi_free_power_resources_lists(struct acpi_device *device)
+ if (device->wakeup.flags.valid)
+ acpi_power_resources_list_free(&device->wakeup.resources);
+
+- if (!device->flags.power_manageable)
++ if (!device->power.flags.power_resources)
+ return;
+
+ for (i = ACPI_STATE_D0; i <= ACPI_STATE_D3_HOT; i++) {
+@@ -1631,10 +1631,8 @@ static void acpi_bus_get_power_flags(struct acpi_device *device)
+ device->power.flags.power_resources)
+ device->power.states[ACPI_STATE_D3_COLD].flags.os_accessible = 1;
+
+- if (acpi_bus_init_power(device)) {
+- acpi_free_power_resources_lists(device);
++ if (acpi_bus_init_power(device))
+ device->flags.power_manageable = 0;
+- }
+ }
+
+ static void acpi_bus_get_flags(struct acpi_device *device)
+@@ -2202,13 +2200,18 @@ static void acpi_bus_attach(struct acpi_device *device)
+ /* Skip devices that are not present. */
+ if (!acpi_device_is_present(device)) {
+ device->flags.visited = false;
++ device->flags.power_manageable = 0;
+ return;
+ }
+ if (device->handler)
+ goto ok;
+
+ if (!device->flags.initialized) {
+- acpi_bus_update_power(device, NULL);
++ device->flags.power_manageable =
++ device->power.states[ACPI_STATE_D0].flags.valid;
++ if (acpi_bus_init_power(device))
++ device->flags.power_manageable = 0;
++
+ device->flags.initialized = true;
+ }
+ device->flags.visited = false;
+diff --git a/drivers/acpi/video.c b/drivers/acpi/video.c
+index 9d75ead2a1f9..41322591fb43 100644
+--- a/drivers/acpi/video.c
++++ b/drivers/acpi/video.c
+@@ -155,6 +155,7 @@ struct acpi_video_bus {
+ u8 dos_setting;
+ struct acpi_video_enumerated_device *attached_array;
+ u8 attached_count;
++ u8 child_count;
+ struct acpi_video_bus_cap cap;
+ struct acpi_video_bus_flags flags;
+ struct list_head video_device_list;
+@@ -504,6 +505,23 @@ static struct dmi_system_id video_dmi_table[] __initdata = {
+ DMI_MATCH(DMI_PRODUCT_NAME, "HP ENVY 15 Notebook PC"),
+ },
+ },
++
++ {
++ .callback = video_disable_native_backlight,
++ .ident = "SAMSUNG 870Z5E/880Z5E/680Z5E",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "SAMSUNG ELECTRONICS CO., LTD."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "870Z5E/880Z5E/680Z5E"),
++ },
++ },
++ {
++ .callback = video_disable_native_backlight,
++ .ident = "SAMSUNG 370R4E/370R4V/370R5E/3570RE/370R5V",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "SAMSUNG ELECTRONICS CO., LTD."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "370R4E/370R4V/370R5E/3570RE/370R5V"),
++ },
++ },
+ {}
+ };
+
+@@ -1159,8 +1177,12 @@ static bool acpi_video_device_in_dod(struct acpi_video_device *device)
+ struct acpi_video_bus *video = device->video;
+ int i;
+
+- /* If we have a broken _DOD, no need to test */
+- if (!video->attached_count)
++ /*
++ * If we have a broken _DOD or we have more than 8 output devices
++ * under the graphics controller node that we can't proper deal with
++ * in the operation region code currently, no need to test.
++ */
++ if (!video->attached_count || video->child_count > 8)
+ return true;
+
+ for (i = 0; i < video->attached_count; i++) {
+@@ -1413,6 +1435,7 @@ acpi_video_bus_get_devices(struct acpi_video_bus *video,
+ dev_err(&dev->dev, "Can't attach device\n");
+ break;
+ }
++ video->child_count++;
+ }
+ return status;
+ }
+diff --git a/drivers/base/bus.c b/drivers/base/bus.c
+index 83e910a57563..876bae5ade33 100644
+--- a/drivers/base/bus.c
++++ b/drivers/base/bus.c
+@@ -254,13 +254,15 @@ static ssize_t store_drivers_probe(struct bus_type *bus,
+ const char *buf, size_t count)
+ {
+ struct device *dev;
++ int err = -EINVAL;
+
+ dev = bus_find_device_by_name(bus, NULL, buf);
+ if (!dev)
+ return -ENODEV;
+- if (bus_rescan_devices_helper(dev, NULL) != 0)
+- return -EINVAL;
+- return count;
++ if (bus_rescan_devices_helper(dev, NULL) == 0)
++ err = count;
++ put_device(dev);
++ return err;
+ }
+
+ static struct device *next_device(struct klist_iter *i)
+diff --git a/drivers/block/drbd/drbd_req.c b/drivers/block/drbd/drbd_req.c
+index 5a01c53dddeb..3b797cd5a407 100644
+--- a/drivers/block/drbd/drbd_req.c
++++ b/drivers/block/drbd/drbd_req.c
+@@ -1545,6 +1545,7 @@ int drbd_merge_bvec(struct request_queue *q, struct bvec_merge_data *bvm, struct
+ struct request_queue * const b =
+ device->ldev->backing_bdev->bd_disk->queue;
+ if (b->merge_bvec_fn) {
++ bvm->bi_bdev = device->ldev->backing_bdev;
+ backing_limit = b->merge_bvec_fn(b, bvm, bvec);
+ limit = min(limit, backing_limit);
+ }
+@@ -1628,7 +1629,7 @@ void request_timer_fn(unsigned long data)
+ time_after(now, req_peer->pre_send_jif + ent) &&
+ !time_in_range(now, connection->last_reconnect_jif, connection->last_reconnect_jif + ent)) {
+ drbd_warn(device, "Remote failed to finish a request within ko-count * timeout\n");
+- _drbd_set_state(_NS(device, conn, C_TIMEOUT), CS_VERBOSE | CS_HARD, NULL);
++ _conn_request_state(connection, NS(conn, C_TIMEOUT), CS_VERBOSE | CS_HARD);
+ }
+ if (dt && oldest_submit_jif != now &&
+ time_after(now, oldest_submit_jif + dt) &&
+diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c
+index d85ced27ebd5..086240cd29c3 100644
+--- a/drivers/bluetooth/ath3k.c
++++ b/drivers/bluetooth/ath3k.c
+@@ -105,6 +105,7 @@ static const struct usb_device_id ath3k_table[] = {
+ { USB_DEVICE(0x13d3, 0x3375) },
+ { USB_DEVICE(0x13d3, 0x3393) },
+ { USB_DEVICE(0x13d3, 0x3402) },
++ { USB_DEVICE(0x13d3, 0x3408) },
+ { USB_DEVICE(0x13d3, 0x3432) },
+
+ /* Atheros AR5BBU12 with sflash firmware */
+@@ -156,6 +157,7 @@ static const struct usb_device_id ath3k_blist_tbl[] = {
+ { USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x13d3, 0x3393), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x13d3, 0x3402), .driver_info = BTUSB_ATH3012 },
++ { USB_DEVICE(0x13d3, 0x3408), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x13d3, 0x3432), .driver_info = BTUSB_ATH3012 },
+
+ /* Atheros AR5BBU22 with sflash firmware */
+diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
+index edfc17bfcd44..091c813df8e9 100644
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -182,6 +182,7 @@ static const struct usb_device_id blacklist_table[] = {
+ { USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x13d3, 0x3393), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x13d3, 0x3402), .driver_info = BTUSB_ATH3012 },
++ { USB_DEVICE(0x13d3, 0x3408), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x13d3, 0x3432), .driver_info = BTUSB_ATH3012 },
+
+ /* Atheros AR5BBU12 with sflash firmware */
+diff --git a/drivers/char/i8k.c b/drivers/char/i8k.c
+index 34174d01462e..471f985e38d2 100644
+--- a/drivers/char/i8k.c
++++ b/drivers/char/i8k.c
+@@ -711,6 +711,14 @@ static struct dmi_system_id i8k_dmi_table[] __initdata = {
+ .driver_data = (void *)&i8k_config_data[DELL_LATITUDE_D520],
+ },
+ {
++ .ident = "Dell Latitude E6440",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Latitude E6440"),
++ },
++ .driver_data = (void *)&i8k_config_data[DELL_LATITUDE_E6540],
++ },
++ {
+ .ident = "Dell Latitude E6540",
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+diff --git a/drivers/gpu/drm/nouveau/core/core/event.c b/drivers/gpu/drm/nouveau/core/core/event.c
+index ff2b434b3db4..760947e380c9 100644
+--- a/drivers/gpu/drm/nouveau/core/core/event.c
++++ b/drivers/gpu/drm/nouveau/core/core/event.c
+@@ -26,7 +26,7 @@
+ void
+ nvkm_event_put(struct nvkm_event *event, u32 types, int index)
+ {
+- BUG_ON(!spin_is_locked(&event->refs_lock));
++ assert_spin_locked(&event->refs_lock);
+ while (types) {
+ int type = __ffs(types); types &= ~(1 << type);
+ if (--event->refs[index * event->types_nr + type] == 0) {
+@@ -39,7 +39,7 @@ nvkm_event_put(struct nvkm_event *event, u32 types, int index)
+ void
+ nvkm_event_get(struct nvkm_event *event, u32 types, int index)
+ {
+- BUG_ON(!spin_is_locked(&event->refs_lock));
++ assert_spin_locked(&event->refs_lock);
+ while (types) {
+ int type = __ffs(types); types &= ~(1 << type);
+ if (++event->refs[index * event->types_nr + type] == 1) {
+diff --git a/drivers/gpu/drm/nouveau/core/core/notify.c b/drivers/gpu/drm/nouveau/core/core/notify.c
+index d1bcde55e9d7..839a32577680 100644
+--- a/drivers/gpu/drm/nouveau/core/core/notify.c
++++ b/drivers/gpu/drm/nouveau/core/core/notify.c
+@@ -98,7 +98,7 @@ nvkm_notify_send(struct nvkm_notify *notify, void *data, u32 size)
+ struct nvkm_event *event = notify->event;
+ unsigned long flags;
+
+- BUG_ON(!spin_is_locked(&event->list_lock));
++ assert_spin_locked(&event->list_lock);
+ BUG_ON(size != notify->size);
+
+ spin_lock_irqsave(&event->refs_lock, flags);
+diff --git a/drivers/gpu/drm/nouveau/nouveau_ttm.c b/drivers/gpu/drm/nouveau/nouveau_ttm.c
+index 753a6def61e7..3d1cfcb96b6b 100644
+--- a/drivers/gpu/drm/nouveau/nouveau_ttm.c
++++ b/drivers/gpu/drm/nouveau/nouveau_ttm.c
+@@ -28,6 +28,7 @@
+ #include "nouveau_ttm.h"
+ #include "nouveau_gem.h"
+
++#include "drm_legacy.h"
+ static int
+ nouveau_vram_manager_init(struct ttm_mem_type_manager *man, unsigned long psize)
+ {
+@@ -281,7 +282,7 @@ nouveau_ttm_mmap(struct file *filp, struct vm_area_struct *vma)
+ struct nouveau_drm *drm = nouveau_drm(file_priv->minor->dev);
+
+ if (unlikely(vma->vm_pgoff < DRM_FILE_PAGE_OFFSET))
+- return -EINVAL;
++ return drm_legacy_mmap(filp, vma);
+
+ return ttm_bo_mmap(filp, vma, &drm->ttm.bdev);
+ }
+diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
+index 3402033fa52a..dfaccfca0688 100644
+--- a/drivers/hid/hid-core.c
++++ b/drivers/hid/hid-core.c
+@@ -1809,6 +1809,7 @@ static const struct hid_device_id hid_have_special_driver[] = {
+ { HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_ERGO_525V) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_EASYPEN_I405X) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_MOUSEPEN_I608X) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_MOUSEPEN_I608X_2) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_EASYPEN_M610X) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_LABTEC, USB_DEVICE_ID_LABTEC_WIRELESS_KEYBOARD) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_LCPOWER, USB_DEVICE_ID_LCPOWER_LC1000 ) },
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index 7c863738e419..0e28190480d7 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -300,6 +300,7 @@
+ #define USB_DEVICE_ID_ELAN_TOUCHSCREEN 0x0089
+ #define USB_DEVICE_ID_ELAN_TOUCHSCREEN_009B 0x009b
+ #define USB_DEVICE_ID_ELAN_TOUCHSCREEN_0103 0x0103
++#define USB_DEVICE_ID_ELAN_TOUCHSCREEN_010c 0x010c
+ #define USB_DEVICE_ID_ELAN_TOUCHSCREEN_016F 0x016f
+
+ #define USB_VENDOR_ID_ELECOM 0x056e
+@@ -525,6 +526,7 @@
+ #define USB_DEVICE_ID_KYE_GPEN_560 0x5003
+ #define USB_DEVICE_ID_KYE_EASYPEN_I405X 0x5010
+ #define USB_DEVICE_ID_KYE_MOUSEPEN_I608X 0x5011
++#define USB_DEVICE_ID_KYE_MOUSEPEN_I608X_2 0x501a
+ #define USB_DEVICE_ID_KYE_EASYPEN_M610X 0x5013
+
+ #define USB_VENDOR_ID_LABTEC 0x1020
+diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
+index 725f22ca47fc..8df8ceb47659 100644
+--- a/drivers/hid/hid-input.c
++++ b/drivers/hid/hid-input.c
+@@ -312,6 +312,9 @@ static const struct hid_device_id hid_battery_quirks[] = {
+ USB_DEVICE_ID_APPLE_ALU_WIRELESS_2011_ANSI),
+ HID_BATTERY_QUIRK_PERCENT | HID_BATTERY_QUIRK_FEATURE },
+ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE,
++ USB_DEVICE_ID_APPLE_ALU_WIRELESS_2011_ISO),
++ HID_BATTERY_QUIRK_PERCENT | HID_BATTERY_QUIRK_FEATURE },
++ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE,
+ USB_DEVICE_ID_APPLE_ALU_WIRELESS_ANSI),
+ HID_BATTERY_QUIRK_PERCENT | HID_BATTERY_QUIRK_FEATURE },
+ {}
+diff --git a/drivers/hid/hid-kye.c b/drivers/hid/hid-kye.c
+index b92bf01a1ae8..158fcf577fae 100644
+--- a/drivers/hid/hid-kye.c
++++ b/drivers/hid/hid-kye.c
+@@ -323,6 +323,7 @@ static __u8 *kye_report_fixup(struct hid_device *hdev, __u8 *rdesc,
+ }
+ break;
+ case USB_DEVICE_ID_KYE_MOUSEPEN_I608X:
++ case USB_DEVICE_ID_KYE_MOUSEPEN_I608X_2:
+ if (*rsize == MOUSEPEN_I608X_RDESC_ORIG_SIZE) {
+ rdesc = mousepen_i608x_rdesc_fixed;
+ *rsize = sizeof(mousepen_i608x_rdesc_fixed);
+@@ -415,6 +416,7 @@ static int kye_probe(struct hid_device *hdev, const struct hid_device_id *id)
+ switch (id->product) {
+ case USB_DEVICE_ID_KYE_EASYPEN_I405X:
+ case USB_DEVICE_ID_KYE_MOUSEPEN_I608X:
++ case USB_DEVICE_ID_KYE_MOUSEPEN_I608X_2:
+ case USB_DEVICE_ID_KYE_EASYPEN_M610X:
+ ret = kye_tablet_enable(hdev);
+ if (ret) {
+@@ -446,6 +448,8 @@ static const struct hid_device_id kye_devices[] = {
+ { HID_USB_DEVICE(USB_VENDOR_ID_KYE,
+ USB_DEVICE_ID_KYE_MOUSEPEN_I608X) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_KYE,
++ USB_DEVICE_ID_KYE_MOUSEPEN_I608X_2) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_KYE,
+ USB_DEVICE_ID_KYE_EASYPEN_M610X) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_KYE,
+ USB_DEVICE_ID_GENIUS_GILA_GAMING_MOUSE) },
+diff --git a/drivers/hid/hid-roccat-pyra.c b/drivers/hid/hid-roccat-pyra.c
+index 1a07e07d99a0..47d7e74231e5 100644
+--- a/drivers/hid/hid-roccat-pyra.c
++++ b/drivers/hid/hid-roccat-pyra.c
+@@ -35,6 +35,8 @@ static struct class *pyra_class;
+ static void profile_activated(struct pyra_device *pyra,
+ unsigned int new_profile)
+ {
++ if (new_profile >= ARRAY_SIZE(pyra->profile_settings))
++ return;
+ pyra->actual_profile = new_profile;
+ pyra->actual_cpi = pyra->profile_settings[pyra->actual_profile].y_cpi;
+ }
+@@ -257,9 +259,11 @@ static ssize_t pyra_sysfs_write_settings(struct file *fp,
+ if (off != 0 || count != PYRA_SIZE_SETTINGS)
+ return -EINVAL;
+
+- mutex_lock(&pyra->pyra_lock);
+-
+ settings = (struct pyra_settings const *)buf;
++ if (settings->startup_profile >= ARRAY_SIZE(pyra->profile_settings))
++ return -EINVAL;
++
++ mutex_lock(&pyra->pyra_lock);
+
+ retval = pyra_set_settings(usb_dev, settings);
+ if (retval) {
+diff --git a/drivers/hid/i2c-hid/i2c-hid.c b/drivers/hid/i2c-hid/i2c-hid.c
+index 747d54421e73..80e33e0abc52 100644
+--- a/drivers/hid/i2c-hid/i2c-hid.c
++++ b/drivers/hid/i2c-hid/i2c-hid.c
+@@ -137,6 +137,7 @@ struct i2c_hid {
+ * descriptor. */
+ unsigned int bufsize; /* i2c buffer size */
+ char *inbuf; /* Input buffer */
++ char *rawbuf; /* Raw Input buffer */
+ char *cmdbuf; /* Command buffer */
+ char *argsbuf; /* Command arguments buffer */
+
+@@ -369,7 +370,7 @@ static int i2c_hid_hwreset(struct i2c_client *client)
+ static void i2c_hid_get_input(struct i2c_hid *ihid)
+ {
+ int ret, ret_size;
+- int size = le16_to_cpu(ihid->hdesc.wMaxInputLength);
++ int size = ihid->bufsize;
+
+ ret = i2c_master_recv(ihid->client, ihid->inbuf, size);
+ if (ret != size) {
+@@ -504,9 +505,11 @@ static void i2c_hid_find_max_report(struct hid_device *hid, unsigned int type,
+ static void i2c_hid_free_buffers(struct i2c_hid *ihid)
+ {
+ kfree(ihid->inbuf);
++ kfree(ihid->rawbuf);
+ kfree(ihid->argsbuf);
+ kfree(ihid->cmdbuf);
+ ihid->inbuf = NULL;
++ ihid->rawbuf = NULL;
+ ihid->cmdbuf = NULL;
+ ihid->argsbuf = NULL;
+ ihid->bufsize = 0;
+@@ -522,10 +525,11 @@ static int i2c_hid_alloc_buffers(struct i2c_hid *ihid, size_t report_size)
+ report_size; /* report */
+
+ ihid->inbuf = kzalloc(report_size, GFP_KERNEL);
++ ihid->rawbuf = kzalloc(report_size, GFP_KERNEL);
+ ihid->argsbuf = kzalloc(args_len, GFP_KERNEL);
+ ihid->cmdbuf = kzalloc(sizeof(union command) + args_len, GFP_KERNEL);
+
+- if (!ihid->inbuf || !ihid->argsbuf || !ihid->cmdbuf) {
++ if (!ihid->inbuf || !ihid->rawbuf || !ihid->argsbuf || !ihid->cmdbuf) {
+ i2c_hid_free_buffers(ihid);
+ return -ENOMEM;
+ }
+@@ -552,12 +556,12 @@ static int i2c_hid_get_raw_report(struct hid_device *hid,
+
+ ret = i2c_hid_get_report(client,
+ report_type == HID_FEATURE_REPORT ? 0x03 : 0x01,
+- report_number, ihid->inbuf, ask_count);
++ report_number, ihid->rawbuf, ask_count);
+
+ if (ret < 0)
+ return ret;
+
+- ret_count = ihid->inbuf[0] | (ihid->inbuf[1] << 8);
++ ret_count = ihid->rawbuf[0] | (ihid->rawbuf[1] << 8);
+
+ if (ret_count <= 2)
+ return 0;
+@@ -566,7 +570,7 @@ static int i2c_hid_get_raw_report(struct hid_device *hid,
+
+ /* The query buffer contains the size, dropping it in the reply */
+ count = min(count, ret_count - 2);
+- memcpy(buf, ihid->inbuf + 2, count);
++ memcpy(buf, ihid->rawbuf + 2, count);
+
+ return count;
+ }
+@@ -702,12 +706,7 @@ static int i2c_hid_start(struct hid_device *hid)
+
+ static void i2c_hid_stop(struct hid_device *hid)
+ {
+- struct i2c_client *client = hid->driver_data;
+- struct i2c_hid *ihid = i2c_get_clientdata(client);
+-
+ hid->claimed = 0;
+-
+- i2c_hid_free_buffers(ihid);
+ }
+
+ static int i2c_hid_open(struct hid_device *hid)
+diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c
+index 552671ee7c5d..4477eb7457de 100644
+--- a/drivers/hid/usbhid/hid-quirks.c
++++ b/drivers/hid/usbhid/hid-quirks.c
+@@ -73,6 +73,7 @@ static const struct hid_blacklist {
+ { USB_VENDOR_ID_ELAN, USB_DEVICE_ID_ELAN_TOUCHSCREEN, HID_QUIRK_ALWAYS_POLL },
+ { USB_VENDOR_ID_ELAN, USB_DEVICE_ID_ELAN_TOUCHSCREEN_009B, HID_QUIRK_ALWAYS_POLL },
+ { USB_VENDOR_ID_ELAN, USB_DEVICE_ID_ELAN_TOUCHSCREEN_0103, HID_QUIRK_ALWAYS_POLL },
++ { USB_VENDOR_ID_ELAN, USB_DEVICE_ID_ELAN_TOUCHSCREEN_010c, HID_QUIRK_ALWAYS_POLL },
+ { USB_VENDOR_ID_ELAN, USB_DEVICE_ID_ELAN_TOUCHSCREEN_016F, HID_QUIRK_ALWAYS_POLL },
+ { USB_VENDOR_ID_ELO, USB_DEVICE_ID_ELO_TS2700, HID_QUIRK_NOGET },
+ { USB_VENDOR_ID_FORMOSA, USB_DEVICE_ID_FORMOSA_IR_RECEIVER, HID_QUIRK_NO_INIT_REPORTS },
+@@ -122,6 +123,7 @@ static const struct hid_blacklist {
+ { USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_WIRELESS, HID_QUIRK_MULTI_INPUT },
+ { USB_VENDOR_ID_SIGMA_MICRO, USB_DEVICE_ID_SIGMA_MICRO_KEYBOARD, HID_QUIRK_NO_INIT_REPORTS },
+ { USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_MOUSEPEN_I608X, HID_QUIRK_MULTI_INPUT },
++ { USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_MOUSEPEN_I608X_2, HID_QUIRK_MULTI_INPUT },
+ { USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_EASYPEN_M610X, HID_QUIRK_MULTI_INPUT },
+ { USB_VENDOR_ID_NTRIG, USB_DEVICE_ID_NTRIG_DUOSENSE, HID_QUIRK_NO_INIT_REPORTS },
+ { USB_VENDOR_ID_SEMICO, USB_DEVICE_ID_SEMICO_USB_KEYKOARD, HID_QUIRK_NO_INIT_REPORTS },
+diff --git a/drivers/hid/wacom_sys.c b/drivers/hid/wacom_sys.c
+index 8593047bb726..b6bcd251c4a8 100644
+--- a/drivers/hid/wacom_sys.c
++++ b/drivers/hid/wacom_sys.c
+@@ -70,22 +70,15 @@ static int wacom_raw_event(struct hid_device *hdev, struct hid_report *report,
+ static int wacom_open(struct input_dev *dev)
+ {
+ struct wacom *wacom = input_get_drvdata(dev);
+- int retval;
+-
+- mutex_lock(&wacom->lock);
+- retval = hid_hw_open(wacom->hdev);
+- mutex_unlock(&wacom->lock);
+
+- return retval;
++ return hid_hw_open(wacom->hdev);
+ }
+
+ static void wacom_close(struct input_dev *dev)
+ {
+ struct wacom *wacom = input_get_drvdata(dev);
+
+- mutex_lock(&wacom->lock);
+ hid_hw_close(wacom->hdev);
+- mutex_unlock(&wacom->lock);
+ }
+
+ /*
+diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c
+index 586b2405b0d4..7cf998cdd011 100644
+--- a/drivers/hid/wacom_wac.c
++++ b/drivers/hid/wacom_wac.c
+@@ -3026,6 +3026,7 @@ const struct hid_device_id wacom_ids[] = {
+ { USB_DEVICE_WACOM(0x4004) },
+ { USB_DEVICE_WACOM(0x5000) },
+ { USB_DEVICE_WACOM(0x5002) },
++ { USB_DEVICE_LENOVO(0x6004) },
+
+ { USB_DEVICE_WACOM(HID_ANY_ID) },
+ { }
+diff --git a/drivers/hv/channel_mgmt.c b/drivers/hv/channel_mgmt.c
+index a2d1a9612c86..d36ce6835fb7 100644
+--- a/drivers/hv/channel_mgmt.c
++++ b/drivers/hv/channel_mgmt.c
+@@ -216,9 +216,16 @@ static void vmbus_process_rescind_offer(struct work_struct *work)
+ unsigned long flags;
+ struct vmbus_channel *primary_channel;
+ struct vmbus_channel_relid_released msg;
++ struct device *dev;
++
++ if (channel->device_obj) {
++ dev = get_device(&channel->device_obj->device);
++ if (dev) {
++ vmbus_device_unregister(channel->device_obj);
++ put_device(dev);
++ }
++ }
+
+- if (channel->device_obj)
+- vmbus_device_unregister(channel->device_obj);
+ memset(&msg, 0, sizeof(struct vmbus_channel_relid_released));
+ msg.child_relid = channel->offermsg.child_relid;
+ msg.header.msgtype = CHANNELMSG_RELID_RELEASED;
+diff --git a/drivers/input/mouse/alps.c b/drivers/input/mouse/alps.c
+index d125a019383f..54ff03791940 100644
+--- a/drivers/input/mouse/alps.c
++++ b/drivers/input/mouse/alps.c
+@@ -919,18 +919,21 @@ static void alps_get_finger_coordinate_v7(struct input_mt_pos *mt,
+
+ static int alps_get_mt_count(struct input_mt_pos *mt)
+ {
+- int i;
++ int i, fingers = 0;
+
+- for (i = 0; i < MAX_TOUCHES && mt[i].x != 0 && mt[i].y != 0; i++)
+- /* empty */;
++ for (i = 0; i < MAX_TOUCHES; i++) {
++ if (mt[i].x != 0 || mt[i].y != 0)
++ fingers++;
++ }
+
+- return i;
++ return fingers;
+ }
+
+ static int alps_decode_packet_v7(struct alps_fields *f,
+ unsigned char *p,
+ struct psmouse *psmouse)
+ {
++ struct alps_data *priv = psmouse->private;
+ unsigned char pkt_id;
+
+ pkt_id = alps_get_packet_id_v7(p);
+@@ -938,19 +941,52 @@ static int alps_decode_packet_v7(struct alps_fields *f,
+ return 0;
+ if (pkt_id == V7_PACKET_ID_UNKNOWN)
+ return -1;
++ /*
++ * NEW packets are send to indicate a discontinuity in the finger
++ * coordinate reporting. Specifically a finger may have moved from
++ * slot 0 to 1 or vice versa. INPUT_MT_TRACK takes care of this for
++ * us.
++ *
++ * NEW packets have 3 problems:
++ * 1) They do not contain middle / right button info (on non clickpads)
++ * this can be worked around by preserving the old button state
++ * 2) They do not contain an accurate fingercount, and they are
++ * typically send when the number of fingers changes. We cannot use
++ * the old finger count as that may mismatch with the amount of
++ * touch coordinates we've available in the NEW packet
++ * 3) Their x data for the second touch is inaccurate leading to
++ * a possible jump of the x coordinate by 16 units when the first
++ * non NEW packet comes in
++ * Since problems 2 & 3 cannot be worked around, just ignore them.
++ */
++ if (pkt_id == V7_PACKET_ID_NEW)
++ return 1;
+
+ alps_get_finger_coordinate_v7(f->mt, p, pkt_id);
+
+- if (pkt_id == V7_PACKET_ID_TWO || pkt_id == V7_PACKET_ID_MULTI) {
+- f->left = (p[0] & 0x80) >> 7;
++ if (pkt_id == V7_PACKET_ID_TWO)
++ f->fingers = alps_get_mt_count(f->mt);
++ else /* pkt_id == V7_PACKET_ID_MULTI */
++ f->fingers = 3 + (p[5] & 0x03);
++
++ f->left = (p[0] & 0x80) >> 7;
++ if (priv->flags & ALPS_BUTTONPAD) {
++ if (p[0] & 0x20)
++ f->fingers++;
++ if (p[0] & 0x10)
++ f->fingers++;
++ } else {
+ f->right = (p[0] & 0x20) >> 5;
+ f->middle = (p[0] & 0x10) >> 4;
+ }
+
+- if (pkt_id == V7_PACKET_ID_TWO)
+- f->fingers = alps_get_mt_count(f->mt);
+- else if (pkt_id == V7_PACKET_ID_MULTI)
+- f->fingers = 3 + (p[5] & 0x03);
++ /* Sometimes a single touch is reported in mt[1] rather then mt[0] */
++ if (f->fingers == 1 && f->mt[0].x == 0 && f->mt[0].y == 0) {
++ f->mt[0].x = f->mt[1].x;
++ f->mt[0].y = f->mt[1].y;
++ f->mt[1].x = 0;
++ f->mt[1].y = 0;
++ }
+
+ return 0;
+ }
+diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
+index a27d6cb1a793..b2b9c9264131 100644
+--- a/drivers/iommu/intel-iommu.c
++++ b/drivers/iommu/intel-iommu.c
+@@ -1983,7 +1983,7 @@ static int __domain_mapping(struct dmar_domain *domain, unsigned long iov_pfn,
+ {
+ struct dma_pte *first_pte = NULL, *pte = NULL;
+ phys_addr_t uninitialized_var(pteval);
+- unsigned long sg_res;
++ unsigned long sg_res = 0;
+ unsigned int largepage_lvl = 0;
+ unsigned long lvl_pages = 0;
+
+@@ -1994,10 +1994,8 @@ static int __domain_mapping(struct dmar_domain *domain, unsigned long iov_pfn,
+
+ prot &= DMA_PTE_READ | DMA_PTE_WRITE | DMA_PTE_SNP;
+
+- if (sg)
+- sg_res = 0;
+- else {
+- sg_res = nr_pages + 1;
++ if (!sg) {
++ sg_res = nr_pages;
+ pteval = ((phys_addr_t)phys_pfn << VTD_PAGE_SHIFT) | prot;
+ }
+
+@@ -4267,6 +4265,10 @@ static int intel_iommu_attach_device(struct iommu_domain *domain,
+ domain_remove_one_dev_info(old_domain, dev);
+ else
+ domain_remove_dev_info(old_domain);
++
++ if (!domain_type_is_vm_or_si(old_domain) &&
++ list_empty(&old_domain->devices))
++ domain_exit(old_domain);
+ }
+ }
+
+diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
+index 9c66e5997fc8..c1b0d52bfcb0 100644
+--- a/drivers/md/raid5.c
++++ b/drivers/md/raid5.c
+@@ -2917,8 +2917,11 @@ static int fetch_block(struct stripe_head *sh, struct stripe_head_state *s,
+ (sh->raid_conf->level <= 5 && s->failed && fdev[0]->towrite &&
+ (!test_bit(R5_Insync, &dev->flags) || test_bit(STRIPE_PREREAD_ACTIVE, &sh->state)) &&
+ !test_bit(R5_OVERWRITE, &fdev[0]->flags)) ||
+- (sh->raid_conf->level == 6 && s->failed && s->to_write &&
+- s->to_write - s->non_overwrite < sh->raid_conf->raid_disks - 2 &&
++ ((sh->raid_conf->level == 6 ||
++ sh->sector >= sh->raid_conf->mddev->recovery_cp)
++ && s->failed && s->to_write &&
++ (s->to_write - s->non_overwrite <
++ sh->raid_conf->raid_disks - sh->raid_conf->max_degraded) &&
+ (!test_bit(R5_Insync, &dev->flags) || test_bit(STRIPE_PREREAD_ACTIVE, &sh->state))))) {
+ /* we would like to get this block, possibly by computing it,
+ * otherwise read it if the backing disk is insync
+diff --git a/drivers/misc/genwqe/card_utils.c b/drivers/misc/genwqe/card_utils.c
+index 7cb3b7e41739..1ca94e6fa8fb 100644
+--- a/drivers/misc/genwqe/card_utils.c
++++ b/drivers/misc/genwqe/card_utils.c
+@@ -590,6 +590,8 @@ int genwqe_user_vmap(struct genwqe_dev *cd, struct dma_mapping *m, void *uaddr,
+ m->nr_pages,
+ 1, /* write by caller */
+ m->page_list); /* ptrs to pages */
++ if (rc < 0)
++ goto fail_get_user_pages;
+
+ /* assumption: get_user_pages can be killed by signals. */
+ if (rc < m->nr_pages) {
+diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c
+index ada1a3ea3a87..7625bd791fca 100644
+--- a/drivers/mmc/host/sdhci.c
++++ b/drivers/mmc/host/sdhci.c
+@@ -1319,6 +1319,8 @@ static void sdhci_request(struct mmc_host *mmc, struct mmc_request *mrq)
+
+ sdhci_runtime_pm_get(host);
+
++ present = mmc_gpio_get_cd(host->mmc);
++
+ spin_lock_irqsave(&host->lock, flags);
+
+ WARN_ON(host->mrq != NULL);
+@@ -1347,7 +1349,6 @@ static void sdhci_request(struct mmc_host *mmc, struct mmc_request *mrq)
+ * zero: cd-gpio is used, and card is removed
+ * one: cd-gpio is used, and card is present
+ */
+- present = mmc_gpio_get_cd(host->mmc);
+ if (present < 0) {
+ /* If polling, assume that the card is always present. */
+ if (host->quirks & SDHCI_QUIRK_BROKEN_CARD_DETECTION)
+@@ -2072,15 +2073,18 @@ static void sdhci_card_event(struct mmc_host *mmc)
+ {
+ struct sdhci_host *host = mmc_priv(mmc);
+ unsigned long flags;
++ int present;
+
+ /* First check if client has provided their own card event */
+ if (host->ops->card_event)
+ host->ops->card_event(host);
+
++ present = sdhci_do_get_cd(host);
++
+ spin_lock_irqsave(&host->lock, flags);
+
+ /* Check host->mrq first in case we are runtime suspended */
+- if (host->mrq && !sdhci_do_get_cd(host)) {
++ if (host->mrq && !present) {
+ pr_err("%s: Card removed during transfer!\n",
+ mmc_hostname(host->mmc));
+ pr_err("%s: Resetting controller.\n",
+diff --git a/drivers/mtd/devices/m25p80.c b/drivers/mtd/devices/m25p80.c
+index ed827cf894e4..dd8f66ccd2d6 100644
+--- a/drivers/mtd/devices/m25p80.c
++++ b/drivers/mtd/devices/m25p80.c
+@@ -300,11 +300,11 @@ static const struct spi_device_id m25p_ids[] = {
+ {"m45pe10"}, {"m45pe80"}, {"m45pe16"},
+ {"m25pe20"}, {"m25pe80"}, {"m25pe16"},
+ {"m25px16"}, {"m25px32"}, {"m25px32-s0"}, {"m25px32-s1"},
+- {"m25px64"},
++ {"m25px64"}, {"m25px80"},
+ {"w25x10"}, {"w25x20"}, {"w25x40"}, {"w25x80"},
+ {"w25x16"}, {"w25x32"}, {"w25q32"}, {"w25q32dw"},
+- {"w25x64"}, {"w25q64"}, {"w25q128"}, {"w25q80"},
+- {"w25q80bl"}, {"w25q128"}, {"w25q256"}, {"cat25c11"},
++ {"w25x64"}, {"w25q64"}, {"w25q80"}, {"w25q80bl"},
++ {"w25q128"}, {"w25q256"}, {"cat25c11"},
+ {"cat25c03"}, {"cat25c09"}, {"cat25c17"}, {"cat25128"},
+ { },
+ };
+diff --git a/drivers/mtd/nand/omap2.c b/drivers/mtd/nand/omap2.c
+index 3b357e920a0c..10d07dd20f7c 100644
+--- a/drivers/mtd/nand/omap2.c
++++ b/drivers/mtd/nand/omap2.c
+@@ -1741,13 +1741,6 @@ static int omap_nand_probe(struct platform_device *pdev)
+ goto return_error;
+ }
+
+- /* check for small page devices */
+- if ((mtd->oobsize < 64) && (pdata->ecc_opt != OMAP_ECC_HAM1_CODE_HW)) {
+- dev_err(&info->pdev->dev, "small page devices are not supported\n");
+- err = -EINVAL;
+- goto return_error;
+- }
+-
+ /* re-populate low-level callbacks based on xfer modes */
+ switch (pdata->xfer_type) {
+ case NAND_OMAP_PREFETCH_POLLED:
+diff --git a/drivers/mtd/tests/torturetest.c b/drivers/mtd/tests/torturetest.c
+index eeab96973cf0..b55bc52a1340 100644
+--- a/drivers/mtd/tests/torturetest.c
++++ b/drivers/mtd/tests/torturetest.c
+@@ -264,7 +264,9 @@ static int __init tort_init(void)
+ int i;
+ void *patt;
+
+- mtdtest_erase_good_eraseblocks(mtd, bad_ebs, eb, ebcnt);
++ err = mtdtest_erase_good_eraseblocks(mtd, bad_ebs, eb, ebcnt);
++ if (err)
++ goto out;
+
+ /* Check if the eraseblocks contain only 0xFF bytes */
+ if (check) {
+diff --git a/drivers/mtd/ubi/upd.c b/drivers/mtd/ubi/upd.c
+index ec2c2dc1c1ca..2a1b6e037e1a 100644
+--- a/drivers/mtd/ubi/upd.c
++++ b/drivers/mtd/ubi/upd.c
+@@ -133,6 +133,10 @@ int ubi_start_update(struct ubi_device *ubi, struct ubi_volume *vol,
+ ubi_assert(!vol->updating && !vol->changing_leb);
+ vol->updating = 1;
+
++ vol->upd_buf = vmalloc(ubi->leb_size);
++ if (!vol->upd_buf)
++ return -ENOMEM;
++
+ err = set_update_marker(ubi, vol);
+ if (err)
+ return err;
+@@ -152,14 +156,12 @@ int ubi_start_update(struct ubi_device *ubi, struct ubi_volume *vol,
+ err = clear_update_marker(ubi, vol, 0);
+ if (err)
+ return err;
++
++ vfree(vol->upd_buf);
+ vol->updating = 0;
+ return 0;
+ }
+
+- vol->upd_buf = vmalloc(ubi->leb_size);
+- if (!vol->upd_buf)
+- return -ENOMEM;
+-
+ vol->upd_ebs = div_u64(bytes + vol->usable_leb_size - 1,
+ vol->usable_leb_size);
+ vol->upd_bytes = bytes;
+diff --git a/drivers/mtd/ubi/wl.c b/drivers/mtd/ubi/wl.c
+index 6654f191868e..b9686c1472d2 100644
+--- a/drivers/mtd/ubi/wl.c
++++ b/drivers/mtd/ubi/wl.c
+@@ -1212,7 +1212,6 @@ static int wear_leveling_worker(struct ubi_device *ubi, struct ubi_work *wrk,
+
+ err = do_sync_erase(ubi, e1, vol_id, lnum, 0);
+ if (err) {
+- kmem_cache_free(ubi_wl_entry_slab, e1);
+ if (e2)
+ kmem_cache_free(ubi_wl_entry_slab, e2);
+ goto out_ro;
+@@ -1226,10 +1225,8 @@ static int wear_leveling_worker(struct ubi_device *ubi, struct ubi_work *wrk,
+ dbg_wl("PEB %d (LEB %d:%d) was put meanwhile, erase",
+ e2->pnum, vol_id, lnum);
+ err = do_sync_erase(ubi, e2, vol_id, lnum, 0);
+- if (err) {
+- kmem_cache_free(ubi_wl_entry_slab, e2);
++ if (err)
+ goto out_ro;
+- }
+ }
+
+ dbg_wl("done");
+@@ -1265,10 +1262,9 @@ out_not_moved:
+
+ ubi_free_vid_hdr(ubi, vid_hdr);
+ err = do_sync_erase(ubi, e2, vol_id, lnum, torture);
+- if (err) {
+- kmem_cache_free(ubi_wl_entry_slab, e2);
++ if (err)
+ goto out_ro;
+- }
++
+ mutex_unlock(&ubi->move_mutex);
+ return 0;
+
+diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_core.c b/drivers/net/can/usb/peak_usb/pcan_usb_core.c
+index 644e6ab8a489..dc807e10f802 100644
+--- a/drivers/net/can/usb/peak_usb/pcan_usb_core.c
++++ b/drivers/net/can/usb/peak_usb/pcan_usb_core.c
+@@ -735,7 +735,7 @@ static int peak_usb_create_dev(struct peak_usb_adapter *peak_usb_adapter,
+ dev->cmd_buf = kmalloc(PCAN_USB_MAX_CMD_LEN, GFP_KERNEL);
+ if (!dev->cmd_buf) {
+ err = -ENOMEM;
+- goto lbl_set_intf_data;
++ goto lbl_free_candev;
+ }
+
+ dev->udev = usb_dev;
+@@ -775,7 +775,7 @@ static int peak_usb_create_dev(struct peak_usb_adapter *peak_usb_adapter,
+ err = register_candev(netdev);
+ if (err) {
+ dev_err(&intf->dev, "couldn't register CAN device: %d\n", err);
+- goto lbl_free_cmd_buf;
++ goto lbl_restore_intf_data;
+ }
+
+ if (dev->prev_siblings)
+@@ -788,14 +788,14 @@ static int peak_usb_create_dev(struct peak_usb_adapter *peak_usb_adapter,
+ if (dev->adapter->dev_init) {
+ err = dev->adapter->dev_init(dev);
+ if (err)
+- goto lbl_free_cmd_buf;
++ goto lbl_unregister_candev;
+ }
+
+ /* set bus off */
+ if (dev->adapter->dev_set_bus) {
+ err = dev->adapter->dev_set_bus(dev, 0);
+ if (err)
+- goto lbl_free_cmd_buf;
++ goto lbl_unregister_candev;
+ }
+
+ /* get device number early */
+@@ -807,11 +807,14 @@ static int peak_usb_create_dev(struct peak_usb_adapter *peak_usb_adapter,
+
+ return 0;
+
+-lbl_free_cmd_buf:
+- kfree(dev->cmd_buf);
++lbl_unregister_candev:
++ unregister_candev(netdev);
+
+-lbl_set_intf_data:
++lbl_restore_intf_data:
+ usb_set_intfdata(intf, dev->prev_siblings);
++ kfree(dev->cmd_buf);
++
++lbl_free_candev:
+ free_candev(netdev);
+
+ return err;
+diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_pro.c b/drivers/net/can/usb/peak_usb/pcan_usb_pro.c
+index 263dd921edc4..f7f796a2c50b 100644
+--- a/drivers/net/can/usb/peak_usb/pcan_usb_pro.c
++++ b/drivers/net/can/usb/peak_usb/pcan_usb_pro.c
+@@ -333,8 +333,6 @@ static int pcan_usb_pro_send_req(struct peak_usb_device *dev, int req_id,
+ if (!(dev->state & PCAN_USB_STATE_CONNECTED))
+ return 0;
+
+- memset(req_addr, '\0', req_size);
+-
+ req_type = USB_TYPE_VENDOR | USB_RECIP_OTHER;
+
+ switch (req_id) {
+@@ -345,6 +343,7 @@ static int pcan_usb_pro_send_req(struct peak_usb_device *dev, int req_id,
+ default:
+ p = usb_rcvctrlpipe(dev->udev, 0);
+ req_type |= USB_DIR_IN;
++ memset(req_addr, '\0', req_size);
+ break;
+ }
+
+diff --git a/drivers/net/wireless/ath/ath5k/qcu.c b/drivers/net/wireless/ath/ath5k/qcu.c
+index 0583c69d26db..ddaad712c59a 100644
+--- a/drivers/net/wireless/ath/ath5k/qcu.c
++++ b/drivers/net/wireless/ath/ath5k/qcu.c
+@@ -225,13 +225,7 @@ ath5k_hw_setup_tx_queue(struct ath5k_hw *ah, enum ath5k_tx_queue queue_type,
+ } else {
+ switch (queue_type) {
+ case AR5K_TX_QUEUE_DATA:
+- for (queue = AR5K_TX_QUEUE_ID_DATA_MIN;
+- ah->ah_txq[queue].tqi_type !=
+- AR5K_TX_QUEUE_INACTIVE; queue++) {
+-
+- if (queue > AR5K_TX_QUEUE_ID_DATA_MAX)
+- return -EINVAL;
+- }
++ queue = queue_info->tqi_subtype;
+ break;
+ case AR5K_TX_QUEUE_UAPSD:
+ queue = AR5K_TX_QUEUE_ID_UAPSD;
+diff --git a/drivers/net/wireless/ath/ath9k/hw.h b/drivers/net/wireless/ath/ath9k/hw.h
+index 975074fc11bc..e8e8dd28bade 100644
+--- a/drivers/net/wireless/ath/ath9k/hw.h
++++ b/drivers/net/wireless/ath/ath9k/hw.h
+@@ -217,8 +217,8 @@
+ #define AH_WOW_BEACON_MISS BIT(3)
+
+ enum ath_hw_txq_subtype {
+- ATH_TXQ_AC_BE = 0,
+- ATH_TXQ_AC_BK = 1,
++ ATH_TXQ_AC_BK = 0,
++ ATH_TXQ_AC_BE = 1,
+ ATH_TXQ_AC_VI = 2,
+ ATH_TXQ_AC_VO = 3,
+ };
+diff --git a/drivers/net/wireless/ath/ath9k/mac.c b/drivers/net/wireless/ath/ath9k/mac.c
+index 275205ab5f15..3e58bfa0c1fd 100644
+--- a/drivers/net/wireless/ath/ath9k/mac.c
++++ b/drivers/net/wireless/ath/ath9k/mac.c
+@@ -311,14 +311,7 @@ int ath9k_hw_setuptxqueue(struct ath_hw *ah, enum ath9k_tx_queue type,
+ q = ATH9K_NUM_TX_QUEUES - 3;
+ break;
+ case ATH9K_TX_QUEUE_DATA:
+- for (q = 0; q < ATH9K_NUM_TX_QUEUES; q++)
+- if (ah->txq[q].tqi_type ==
+- ATH9K_TX_QUEUE_INACTIVE)
+- break;
+- if (q == ATH9K_NUM_TX_QUEUES) {
+- ath_err(common, "No available TX queue\n");
+- return -1;
+- }
++ q = qinfo->tqi_subtype;
+ break;
+ default:
+ ath_err(common, "Invalid TX queue type: %u\n", type);
+diff --git a/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c b/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c
+index 8079a9ddcba9..0c9671f2f01a 100644
+--- a/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c
++++ b/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c
+@@ -1081,8 +1081,17 @@ brcmf_msgbuf_rx_skb(struct brcmf_msgbuf *msgbuf, struct sk_buff *skb,
+ {
+ struct brcmf_if *ifp;
+
++ /* The ifidx is the idx to map to matching netdev/ifp. When receiving
++ * events this is easy because it contains the bssidx which maps
++ * 1-on-1 to the netdev/ifp. But for data frames the ifidx is rcvd.
++ * bssidx 1 is used for p2p0 and no data can be received or
++ * transmitted on it. Therefor bssidx is ifidx + 1 if ifidx > 0
++ */
++ if (ifidx)
++ (ifidx)++;
+ ifp = msgbuf->drvr->iflist[ifidx];
+ if (!ifp || !ifp->ndev) {
++ brcmf_err("Received pkt for invalid ifidx %d\n", ifidx);
+ brcmu_pkt_buf_free_skb(skb);
+ return;
+ }
+diff --git a/drivers/net/wireless/iwlwifi/dvm/commands.h b/drivers/net/wireless/iwlwifi/dvm/commands.h
+index 751ae1d10b7f..7a34e4d158d1 100644
+--- a/drivers/net/wireless/iwlwifi/dvm/commands.h
++++ b/drivers/net/wireless/iwlwifi/dvm/commands.h
+@@ -966,21 +966,21 @@ struct iwl_rem_sta_cmd {
+
+
+ /* WiFi queues mask */
+-#define IWL_SCD_BK_MSK cpu_to_le32(BIT(0))
+-#define IWL_SCD_BE_MSK cpu_to_le32(BIT(1))
+-#define IWL_SCD_VI_MSK cpu_to_le32(BIT(2))
+-#define IWL_SCD_VO_MSK cpu_to_le32(BIT(3))
+-#define IWL_SCD_MGMT_MSK cpu_to_le32(BIT(3))
++#define IWL_SCD_BK_MSK BIT(0)
++#define IWL_SCD_BE_MSK BIT(1)
++#define IWL_SCD_VI_MSK BIT(2)
++#define IWL_SCD_VO_MSK BIT(3)
++#define IWL_SCD_MGMT_MSK BIT(3)
+
+ /* PAN queues mask */
+-#define IWL_PAN_SCD_BK_MSK cpu_to_le32(BIT(4))
+-#define IWL_PAN_SCD_BE_MSK cpu_to_le32(BIT(5))
+-#define IWL_PAN_SCD_VI_MSK cpu_to_le32(BIT(6))
+-#define IWL_PAN_SCD_VO_MSK cpu_to_le32(BIT(7))
+-#define IWL_PAN_SCD_MGMT_MSK cpu_to_le32(BIT(7))
+-#define IWL_PAN_SCD_MULTICAST_MSK cpu_to_le32(BIT(8))
++#define IWL_PAN_SCD_BK_MSK BIT(4)
++#define IWL_PAN_SCD_BE_MSK BIT(5)
++#define IWL_PAN_SCD_VI_MSK BIT(6)
++#define IWL_PAN_SCD_VO_MSK BIT(7)
++#define IWL_PAN_SCD_MGMT_MSK BIT(7)
++#define IWL_PAN_SCD_MULTICAST_MSK BIT(8)
+
+-#define IWL_AGG_TX_QUEUE_MSK cpu_to_le32(0xffc00)
++#define IWL_AGG_TX_QUEUE_MSK 0xffc00
+
+ #define IWL_DROP_ALL BIT(1)
+
+@@ -1005,12 +1005,17 @@ struct iwl_rem_sta_cmd {
+ * 1: Dump multiple MSDU according to PS, INVALID STA, TTL, TID disable.
+ * 2: Dump all FIFO
+ */
+-struct iwl_txfifo_flush_cmd {
++struct iwl_txfifo_flush_cmd_v3 {
+ __le32 queue_control;
+ __le16 flush_control;
+ __le16 reserved;
+ } __packed;
+
++struct iwl_txfifo_flush_cmd_v2 {
++ __le16 queue_control;
++ __le16 flush_control;
++} __packed;
++
+ /*
+ * REPLY_WEP_KEY = 0x20
+ */
+diff --git a/drivers/net/wireless/iwlwifi/dvm/lib.c b/drivers/net/wireless/iwlwifi/dvm/lib.c
+index 2191621d69c1..cfe1293692fc 100644
+--- a/drivers/net/wireless/iwlwifi/dvm/lib.c
++++ b/drivers/net/wireless/iwlwifi/dvm/lib.c
+@@ -137,37 +137,38 @@ int iwlagn_manage_ibss_station(struct iwl_priv *priv,
+ */
+ int iwlagn_txfifo_flush(struct iwl_priv *priv, u32 scd_q_msk)
+ {
+- struct iwl_txfifo_flush_cmd flush_cmd;
+- struct iwl_host_cmd cmd = {
+- .id = REPLY_TXFIFO_FLUSH,
+- .len = { sizeof(struct iwl_txfifo_flush_cmd), },
+- .data = { &flush_cmd, },
++ struct iwl_txfifo_flush_cmd_v3 flush_cmd_v3 = {
++ .flush_control = cpu_to_le16(IWL_DROP_ALL),
++ };
++ struct iwl_txfifo_flush_cmd_v2 flush_cmd_v2 = {
++ .flush_control = cpu_to_le16(IWL_DROP_ALL),
+ };
+
+- memset(&flush_cmd, 0, sizeof(flush_cmd));
++ u32 queue_control = IWL_SCD_VO_MSK | IWL_SCD_VI_MSK |
++ IWL_SCD_BE_MSK | IWL_SCD_BK_MSK | IWL_SCD_MGMT_MSK;
+
+- flush_cmd.queue_control = IWL_SCD_VO_MSK | IWL_SCD_VI_MSK |
+- IWL_SCD_BE_MSK | IWL_SCD_BK_MSK |
+- IWL_SCD_MGMT_MSK;
+ if ((priv->valid_contexts != BIT(IWL_RXON_CTX_BSS)))
+- flush_cmd.queue_control |= IWL_PAN_SCD_VO_MSK |
+- IWL_PAN_SCD_VI_MSK |
+- IWL_PAN_SCD_BE_MSK |
+- IWL_PAN_SCD_BK_MSK |
+- IWL_PAN_SCD_MGMT_MSK |
+- IWL_PAN_SCD_MULTICAST_MSK;
++ queue_control |= IWL_PAN_SCD_VO_MSK | IWL_PAN_SCD_VI_MSK |
++ IWL_PAN_SCD_BE_MSK | IWL_PAN_SCD_BK_MSK |
++ IWL_PAN_SCD_MGMT_MSK |
++ IWL_PAN_SCD_MULTICAST_MSK;
+
+ if (priv->nvm_data->sku_cap_11n_enable)
+- flush_cmd.queue_control |= IWL_AGG_TX_QUEUE_MSK;
++ queue_control |= IWL_AGG_TX_QUEUE_MSK;
+
+ if (scd_q_msk)
+- flush_cmd.queue_control = cpu_to_le32(scd_q_msk);
+-
+- IWL_DEBUG_INFO(priv, "queue control: 0x%x\n",
+- flush_cmd.queue_control);
+- flush_cmd.flush_control = cpu_to_le16(IWL_DROP_ALL);
+-
+- return iwl_dvm_send_cmd(priv, &cmd);
++ queue_control = scd_q_msk;
++
++ IWL_DEBUG_INFO(priv, "queue control: 0x%x\n", queue_control);
++ flush_cmd_v3.queue_control = cpu_to_le32(queue_control);
++ flush_cmd_v2.queue_control = cpu_to_le16((u16)queue_control);
++
++ if (IWL_UCODE_API(priv->fw->ucode_ver) > 2)
++ return iwl_dvm_send_cmd_pdu(priv, REPLY_TXFIFO_FLUSH, 0,
++ sizeof(flush_cmd_v3),
++ &flush_cmd_v3);
++ return iwl_dvm_send_cmd_pdu(priv, REPLY_TXFIFO_FLUSH, 0,
++ sizeof(flush_cmd_v2), &flush_cmd_v2);
+ }
+
+ void iwlagn_dev_txfifo_flush(struct iwl_priv *priv)
+diff --git a/drivers/net/wireless/iwlwifi/mvm/fw-api.h b/drivers/net/wireless/iwlwifi/mvm/fw-api.h
+index c62575d86bcd..5bd902c976e7 100644
+--- a/drivers/net/wireless/iwlwifi/mvm/fw-api.h
++++ b/drivers/net/wireless/iwlwifi/mvm/fw-api.h
+@@ -1589,7 +1589,7 @@ enum iwl_sf_scenario {
+ #define SF_NUM_TIMEOUT_TYPES 2 /* Aging timer and Idle timer */
+
+ /* smart FIFO default values */
+-#define SF_W_MARK_SISO 4096
++#define SF_W_MARK_SISO 6144
+ #define SF_W_MARK_MIMO2 8192
+ #define SF_W_MARK_MIMO3 6144
+ #define SF_W_MARK_LEGACY 4096
+diff --git a/drivers/net/wireless/iwlwifi/pcie/drv.c b/drivers/net/wireless/iwlwifi/pcie/drv.c
+index 6ced8549eb3a..05cba8c05d3f 100644
+--- a/drivers/net/wireless/iwlwifi/pcie/drv.c
++++ b/drivers/net/wireless/iwlwifi/pcie/drv.c
+@@ -367,7 +367,11 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
+
+ /* 3165 Series */
+ {IWL_PCI_DEVICE(0x3165, 0x4010, iwl3165_2ac_cfg)},
++ {IWL_PCI_DEVICE(0x3165, 0x4012, iwl3165_2ac_cfg)},
++ {IWL_PCI_DEVICE(0x3165, 0x4110, iwl3165_2ac_cfg)},
+ {IWL_PCI_DEVICE(0x3165, 0x4210, iwl3165_2ac_cfg)},
++ {IWL_PCI_DEVICE(0x3165, 0x4410, iwl3165_2ac_cfg)},
++ {IWL_PCI_DEVICE(0x3165, 0x4510, iwl3165_2ac_cfg)},
+
+ /* 7265 Series */
+ {IWL_PCI_DEVICE(0x095A, 0x5010, iwl7265_2ac_cfg)},
+diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
+index c8ca98c2b480..3010ffc9029d 100644
+--- a/drivers/pci/probe.c
++++ b/drivers/pci/probe.c
+@@ -216,14 +216,17 @@ int __pci_read_base(struct pci_dev *dev, enum pci_bar_type type,
+ res->flags |= IORESOURCE_SIZEALIGN;
+ if (res->flags & IORESOURCE_IO) {
+ l &= PCI_BASE_ADDRESS_IO_MASK;
++ sz &= PCI_BASE_ADDRESS_IO_MASK;
+ mask = PCI_BASE_ADDRESS_IO_MASK & (u32) IO_SPACE_LIMIT;
+ } else {
+ l &= PCI_BASE_ADDRESS_MEM_MASK;
++ sz &= PCI_BASE_ADDRESS_MEM_MASK;
+ mask = (u32)PCI_BASE_ADDRESS_MEM_MASK;
+ }
+ } else {
+ res->flags |= (l & IORESOURCE_ROM_ENABLE);
+ l &= PCI_ROM_ADDRESS_MASK;
++ sz &= PCI_ROM_ADDRESS_MASK;
+ mask = (u32)PCI_ROM_ADDRESS_MASK;
+ }
+
+diff --git a/drivers/regulator/s2mps11.c b/drivers/regulator/s2mps11.c
+index adab82d5279f..697be114e21a 100644
+--- a/drivers/regulator/s2mps11.c
++++ b/drivers/regulator/s2mps11.c
+@@ -479,7 +479,7 @@ static struct regulator_ops s2mps14_reg_ops = {
+ .enable_mask = S2MPS14_ENABLE_MASK \
+ }
+
+-#define regulator_desc_s2mps14_buck(num, min, step) { \
++#define regulator_desc_s2mps14_buck(num, min, step, min_sel) { \
+ .name = "BUCK"#num, \
+ .id = S2MPS14_BUCK##num, \
+ .ops = &s2mps14_reg_ops, \
+@@ -488,7 +488,7 @@ static struct regulator_ops s2mps14_reg_ops = {
+ .min_uV = min, \
+ .uV_step = step, \
+ .n_voltages = S2MPS14_BUCK_N_VOLTAGES, \
+- .linear_min_sel = S2MPS14_BUCK1235_START_SEL, \
++ .linear_min_sel = min_sel, \
+ .ramp_delay = S2MPS14_BUCK_RAMP_DELAY, \
+ .vsel_reg = S2MPS14_REG_B1CTRL2 + (num - 1) * 2, \
+ .vsel_mask = S2MPS14_BUCK_VSEL_MASK, \
+@@ -522,11 +522,16 @@ static const struct regulator_desc s2mps14_regulators[] = {
+ regulator_desc_s2mps14_ldo(23, MIN_800_MV, STEP_25_MV),
+ regulator_desc_s2mps14_ldo(24, MIN_1800_MV, STEP_25_MV),
+ regulator_desc_s2mps14_ldo(25, MIN_1800_MV, STEP_25_MV),
+- regulator_desc_s2mps14_buck(1, MIN_600_MV, STEP_6_25_MV),
+- regulator_desc_s2mps14_buck(2, MIN_600_MV, STEP_6_25_MV),
+- regulator_desc_s2mps14_buck(3, MIN_600_MV, STEP_6_25_MV),
+- regulator_desc_s2mps14_buck(4, MIN_1400_MV, STEP_12_5_MV),
+- regulator_desc_s2mps14_buck(5, MIN_600_MV, STEP_6_25_MV),
++ regulator_desc_s2mps14_buck(1, MIN_600_MV, STEP_6_25_MV,
++ S2MPS14_BUCK1235_START_SEL),
++ regulator_desc_s2mps14_buck(2, MIN_600_MV, STEP_6_25_MV,
++ S2MPS14_BUCK1235_START_SEL),
++ regulator_desc_s2mps14_buck(3, MIN_600_MV, STEP_6_25_MV,
++ S2MPS14_BUCK1235_START_SEL),
++ regulator_desc_s2mps14_buck(4, MIN_1400_MV, STEP_12_5_MV,
++ S2MPS14_BUCK4_START_SEL),
++ regulator_desc_s2mps14_buck(5, MIN_600_MV, STEP_6_25_MV,
++ S2MPS14_BUCK1235_START_SEL),
+ };
+
+ static int s2mps14_pmic_enable_ext_control(struct s2mps11_info *s2mps11,
+diff --git a/drivers/rtc/rtc-isl12057.c b/drivers/rtc/rtc-isl12057.c
+index 455b601d731d..8c3f60737df8 100644
+--- a/drivers/rtc/rtc-isl12057.c
++++ b/drivers/rtc/rtc-isl12057.c
+@@ -88,7 +88,7 @@ static void isl12057_rtc_regs_to_tm(struct rtc_time *tm, u8 *regs)
+ tm->tm_min = bcd2bin(regs[ISL12057_REG_RTC_MN]);
+
+ if (regs[ISL12057_REG_RTC_HR] & ISL12057_REG_RTC_HR_MIL) { /* AM/PM */
+- tm->tm_hour = bcd2bin(regs[ISL12057_REG_RTC_HR] & 0x0f);
++ tm->tm_hour = bcd2bin(regs[ISL12057_REG_RTC_HR] & 0x1f);
+ if (regs[ISL12057_REG_RTC_HR] & ISL12057_REG_RTC_HR_PM)
+ tm->tm_hour += 12;
+ } else { /* 24 hour mode */
+@@ -97,7 +97,7 @@ static void isl12057_rtc_regs_to_tm(struct rtc_time *tm, u8 *regs)
+
+ tm->tm_mday = bcd2bin(regs[ISL12057_REG_RTC_DT]);
+ tm->tm_wday = bcd2bin(regs[ISL12057_REG_RTC_DW]) - 1; /* starts at 1 */
+- tm->tm_mon = bcd2bin(regs[ISL12057_REG_RTC_MO]) - 1; /* starts at 1 */
++ tm->tm_mon = bcd2bin(regs[ISL12057_REG_RTC_MO] & 0x1f) - 1; /* ditto */
+ tm->tm_year = bcd2bin(regs[ISL12057_REG_RTC_YR]) + 100;
+ }
+
+diff --git a/drivers/rtc/rtc-omap.c b/drivers/rtc/rtc-omap.c
+index 21142e6574a9..828cb9983cc2 100644
+--- a/drivers/rtc/rtc-omap.c
++++ b/drivers/rtc/rtc-omap.c
+@@ -416,6 +416,8 @@ static int __init omap_rtc_probe(struct platform_device *pdev)
+ rtc_writel(KICK1_VALUE, OMAP_RTC_KICK1_REG);
+ }
+
++ device_init_wakeup(&pdev->dev, true);
++
+ rtc = devm_rtc_device_register(&pdev->dev, pdev->name,
+ &omap_rtc_ops, THIS_MODULE);
+ if (IS_ERR(rtc)) {
+@@ -431,8 +433,10 @@ static int __init omap_rtc_probe(struct platform_device *pdev)
+ rtc_write(0, OMAP_RTC_INTERRUPTS_REG);
+
+ /* enable RTC functional clock */
+- if (id_entry->driver_data & OMAP_RTC_HAS_32KCLK_EN)
+- rtc_writel(OMAP_RTC_OSC_32KCLK_EN, OMAP_RTC_OSC_REG);
++ if (id_entry->driver_data & OMAP_RTC_HAS_32KCLK_EN) {
++ reg = rtc_read(OMAP_RTC_OSC_REG);
++ rtc_writel(reg | OMAP_RTC_OSC_32KCLK_EN, OMAP_RTC_OSC_REG);
++ }
+
+ /* clear old status */
+ reg = rtc_read(OMAP_RTC_STATUS_REG);
+@@ -482,8 +486,6 @@ static int __init omap_rtc_probe(struct platform_device *pdev)
+ * is write-only, and always reads as zero...)
+ */
+
+- device_init_wakeup(&pdev->dev, true);
+-
+ if (new_ctrl & (u8) OMAP_RTC_CTRL_SPLIT)
+ pr_info("%s: split power mode\n", pdev->name);
+
+@@ -493,6 +495,7 @@ static int __init omap_rtc_probe(struct platform_device *pdev)
+ return 0;
+
+ fail0:
++ device_init_wakeup(&pdev->dev, false);
+ if (id_entry->driver_data & OMAP_RTC_HAS_KICKER)
+ rtc_writel(0, OMAP_RTC_KICK0_REG);
+ pm_runtime_put_sync(&pdev->dev);
+diff --git a/drivers/rtc/rtc-sirfsoc.c b/drivers/rtc/rtc-sirfsoc.c
+index 76e38007ba90..24ba97d3286e 100644
+--- a/drivers/rtc/rtc-sirfsoc.c
++++ b/drivers/rtc/rtc-sirfsoc.c
+@@ -286,14 +286,6 @@ static int sirfsoc_rtc_probe(struct platform_device *pdev)
+ rtc_div = ((32768 / RTC_HZ) / 2) - 1;
+ sirfsoc_rtc_iobrg_writel(rtc_div, rtcdrv->rtc_base + RTC_DIV);
+
+- rtcdrv->rtc = devm_rtc_device_register(&pdev->dev, pdev->name,
+- &sirfsoc_rtc_ops, THIS_MODULE);
+- if (IS_ERR(rtcdrv->rtc)) {
+- err = PTR_ERR(rtcdrv->rtc);
+- dev_err(&pdev->dev, "can't register RTC device\n");
+- return err;
+- }
+-
+ /* 0x3 -> RTC_CLK */
+ sirfsoc_rtc_iobrg_writel(SIRFSOC_RTC_CLK,
+ rtcdrv->rtc_base + RTC_CLOCK_SWITCH);
+@@ -308,6 +300,14 @@ static int sirfsoc_rtc_probe(struct platform_device *pdev)
+ rtcdrv->overflow_rtc =
+ sirfsoc_rtc_iobrg_readl(rtcdrv->rtc_base + RTC_SW_VALUE);
+
++ rtcdrv->rtc = devm_rtc_device_register(&pdev->dev, pdev->name,
++ &sirfsoc_rtc_ops, THIS_MODULE);
++ if (IS_ERR(rtcdrv->rtc)) {
++ err = PTR_ERR(rtcdrv->rtc);
++ dev_err(&pdev->dev, "can't register RTC device\n");
++ return err;
++ }
++
+ rtcdrv->irq = platform_get_irq(pdev, 0);
+ err = devm_request_irq(
+ &pdev->dev,
+diff --git a/drivers/spi/spi-sh-msiof.c b/drivers/spi/spi-sh-msiof.c
+index 3f365402fcc0..14052936b1c5 100644
+--- a/drivers/spi/spi-sh-msiof.c
++++ b/drivers/spi/spi-sh-msiof.c
+@@ -480,6 +480,8 @@ static int sh_msiof_spi_setup(struct spi_device *spi)
+ struct device_node *np = spi->master->dev.of_node;
+ struct sh_msiof_spi_priv *p = spi_master_get_devdata(spi->master);
+
++ pm_runtime_get_sync(&p->pdev->dev);
++
+ if (!np) {
+ /*
+ * Use spi->controller_data for CS (same strategy as spi_gpio),
+@@ -498,6 +500,9 @@ static int sh_msiof_spi_setup(struct spi_device *spi)
+ if (spi->cs_gpio >= 0)
+ gpio_set_value(spi->cs_gpio, !(spi->mode & SPI_CS_HIGH));
+
++
++ pm_runtime_put_sync(&p->pdev->dev);
++
+ return 0;
+ }
+
+diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c
+index 2e900a98c3e3..47ca0f3b8c85 100644
+--- a/drivers/tty/n_tty.c
++++ b/drivers/tty/n_tty.c
+@@ -321,7 +321,8 @@ static void n_tty_check_unthrottle(struct tty_struct *tty)
+
+ static inline void put_tty_queue(unsigned char c, struct n_tty_data *ldata)
+ {
+- *read_buf_addr(ldata, ldata->read_head++) = c;
++ *read_buf_addr(ldata, ldata->read_head) = c;
++ ldata->read_head++;
+ }
+
+ /**
+diff --git a/drivers/tty/serial/men_z135_uart.c b/drivers/tty/serial/men_z135_uart.c
+index 30e9e60bc5cd..517cd073dc08 100644
+--- a/drivers/tty/serial/men_z135_uart.c
++++ b/drivers/tty/serial/men_z135_uart.c
+@@ -809,6 +809,7 @@ static void men_z135_remove(struct mcb_device *mdev)
+
+ static const struct mcb_device_id men_z135_ids[] = {
+ { .device = 0x87 },
++ { }
+ };
+ MODULE_DEVICE_TABLE(mcb, men_z135_ids);
+
+diff --git a/drivers/tty/serial/samsung.c b/drivers/tty/serial/samsung.c
+index c78f43a481ce..587d63bcbd0e 100644
+--- a/drivers/tty/serial/samsung.c
++++ b/drivers/tty/serial/samsung.c
+@@ -559,11 +559,15 @@ static void s3c24xx_serial_pm(struct uart_port *port, unsigned int level,
+ unsigned int old)
+ {
+ struct s3c24xx_uart_port *ourport = to_ourport(port);
++ int timeout = 10000;
+
+ ourport->pm_level = level;
+
+ switch (level) {
+ case 3:
++ while (--timeout && !s3c24xx_serial_txempty_nofifo(port))
++ udelay(100);
++
+ if (!IS_ERR(ourport->baudclk))
+ clk_disable_unprepare(ourport->baudclk);
+
+diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
+index 077d58ac3dcb..64d9c3daa856 100644
+--- a/drivers/usb/class/cdc-acm.c
++++ b/drivers/usb/class/cdc-acm.c
+@@ -1197,10 +1197,11 @@ next_desc:
+ } else {
+ control_interface = usb_ifnum_to_if(usb_dev, union_header->bMasterInterface0);
+ data_interface = usb_ifnum_to_if(usb_dev, (data_interface_num = union_header->bSlaveInterface0));
+- if (!control_interface || !data_interface) {
+- dev_dbg(&intf->dev, "no interfaces\n");
+- return -ENODEV;
+- }
++ }
++
++ if (!control_interface || !data_interface) {
++ dev_dbg(&intf->dev, "no interfaces\n");
++ return -ENODEV;
+ }
+
+ if (data_interface_num != call_interface_num)
+@@ -1475,6 +1476,7 @@ alloc_fail8:
+ &dev_attr_wCountryCodes);
+ device_remove_file(&acm->control->dev,
+ &dev_attr_iCountryCodeRelDate);
++ kfree(acm->country_codes);
+ }
+ device_remove_file(&acm->control->dev, &dev_attr_bmCapabilities);
+ alloc_fail7:
+diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
+index 96fafed92b76..0ffb4ed0a945 100644
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -103,6 +103,9 @@ static const struct usb_device_id usb_quirk_list[] = {
+ { USB_DEVICE(0x04f3, 0x009b), .driver_info =
+ USB_QUIRK_DEVICE_QUALIFIER },
+
++ { USB_DEVICE(0x04f3, 0x010c), .driver_info =
++ USB_QUIRK_DEVICE_QUALIFIER },
++
+ { USB_DEVICE(0x04f3, 0x016f), .driver_info =
+ USB_QUIRK_DEVICE_QUALIFIER },
+
+diff --git a/drivers/usb/gadget/udc/at91_udc.c b/drivers/usb/gadget/udc/at91_udc.c
+index 9968f5331fe4..0716c1994e28 100644
+--- a/drivers/usb/gadget/udc/at91_udc.c
++++ b/drivers/usb/gadget/udc/at91_udc.c
+@@ -870,12 +870,10 @@ static void clk_on(struct at91_udc *udc)
+ return;
+ udc->clocked = 1;
+
+- if (IS_ENABLED(CONFIG_COMMON_CLK)) {
+- clk_set_rate(udc->uclk, 48000000);
+- clk_prepare_enable(udc->uclk);
+- }
+- clk_prepare_enable(udc->iclk);
+- clk_prepare_enable(udc->fclk);
++ if (IS_ENABLED(CONFIG_COMMON_CLK))
++ clk_enable(udc->uclk);
++ clk_enable(udc->iclk);
++ clk_enable(udc->fclk);
+ }
+
+ static void clk_off(struct at91_udc *udc)
+@@ -884,10 +882,10 @@ static void clk_off(struct at91_udc *udc)
+ return;
+ udc->clocked = 0;
+ udc->gadget.speed = USB_SPEED_UNKNOWN;
+- clk_disable_unprepare(udc->fclk);
+- clk_disable_unprepare(udc->iclk);
++ clk_disable(udc->fclk);
++ clk_disable(udc->iclk);
+ if (IS_ENABLED(CONFIG_COMMON_CLK))
+- clk_disable_unprepare(udc->uclk);
++ clk_disable(udc->uclk);
+ }
+
+ /*
+@@ -1780,14 +1778,24 @@ static int at91udc_probe(struct platform_device *pdev)
+ }
+
+ /* don't do anything until we have both gadget driver and VBUS */
++ if (IS_ENABLED(CONFIG_COMMON_CLK)) {
++ clk_set_rate(udc->uclk, 48000000);
++ retval = clk_prepare(udc->uclk);
++ if (retval)
++ goto fail1;
++ }
++ retval = clk_prepare(udc->fclk);
++ if (retval)
++ goto fail1a;
++
+ retval = clk_prepare_enable(udc->iclk);
+ if (retval)
+- goto fail1;
++ goto fail1b;
+ at91_udp_write(udc, AT91_UDP_TXVC, AT91_UDP_TXVC_TXVDIS);
+ at91_udp_write(udc, AT91_UDP_IDR, 0xffffffff);
+ /* Clear all pending interrupts - UDP may be used by bootloader. */
+ at91_udp_write(udc, AT91_UDP_ICR, 0xffffffff);
+- clk_disable_unprepare(udc->iclk);
++ clk_disable(udc->iclk);
+
+ /* request UDC and maybe VBUS irqs */
+ udc->udp_irq = platform_get_irq(pdev, 0);
+@@ -1795,7 +1803,7 @@ static int at91udc_probe(struct platform_device *pdev)
+ 0, driver_name, udc);
+ if (retval < 0) {
+ DBG("request irq %d failed\n", udc->udp_irq);
+- goto fail1;
++ goto fail1c;
+ }
+ if (gpio_is_valid(udc->board.vbus_pin)) {
+ retval = gpio_request(udc->board.vbus_pin, "udc_vbus");
+@@ -1848,6 +1856,13 @@ fail3:
+ gpio_free(udc->board.vbus_pin);
+ fail2:
+ free_irq(udc->udp_irq, udc);
++fail1c:
++ clk_unprepare(udc->iclk);
++fail1b:
++ clk_unprepare(udc->fclk);
++fail1a:
++ if (IS_ENABLED(CONFIG_COMMON_CLK))
++ clk_unprepare(udc->uclk);
+ fail1:
+ if (IS_ENABLED(CONFIG_COMMON_CLK) && !IS_ERR(udc->uclk))
+ clk_put(udc->uclk);
+@@ -1896,6 +1911,11 @@ static int __exit at91udc_remove(struct platform_device *pdev)
+ res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+ release_mem_region(res->start, resource_size(res));
+
++ if (IS_ENABLED(CONFIG_COMMON_CLK))
++ clk_unprepare(udc->uclk);
++ clk_unprepare(udc->fclk);
++ clk_unprepare(udc->iclk);
++
+ clk_put(udc->iclk);
+ clk_put(udc->fclk);
+ if (IS_ENABLED(CONFIG_COMMON_CLK))
+diff --git a/drivers/usb/renesas_usbhs/mod_gadget.c b/drivers/usb/renesas_usbhs/mod_gadget.c
+index 2d17c10a0428..294d43c387b2 100644
+--- a/drivers/usb/renesas_usbhs/mod_gadget.c
++++ b/drivers/usb/renesas_usbhs/mod_gadget.c
+@@ -602,6 +602,9 @@ static int usbhsg_ep_disable(struct usb_ep *ep)
+ struct usbhsg_uep *uep = usbhsg_ep_to_uep(ep);
+ struct usbhs_pipe *pipe = usbhsg_uep_to_pipe(uep);
+
++ if (!pipe)
++ return -EINVAL;
++
+ usbhsg_pipe_disable(uep);
+ usbhs_pipe_free(pipe);
+
+diff --git a/drivers/usb/serial/qcserial.c b/drivers/usb/serial/qcserial.c
+index b2aa003bf411..cb3e14780a7e 100644
+--- a/drivers/usb/serial/qcserial.c
++++ b/drivers/usb/serial/qcserial.c
+@@ -27,12 +27,15 @@ enum qcserial_layouts {
+ QCSERIAL_G2K = 0, /* Gobi 2000 */
+ QCSERIAL_G1K = 1, /* Gobi 1000 */
+ QCSERIAL_SWI = 2, /* Sierra Wireless */
++ QCSERIAL_HWI = 3, /* Huawei */
+ };
+
+ #define DEVICE_G1K(v, p) \
+ USB_DEVICE(v, p), .driver_info = QCSERIAL_G1K
+ #define DEVICE_SWI(v, p) \
+ USB_DEVICE(v, p), .driver_info = QCSERIAL_SWI
++#define DEVICE_HWI(v, p) \
++ USB_DEVICE(v, p), .driver_info = QCSERIAL_HWI
+
+ static const struct usb_device_id id_table[] = {
+ /* Gobi 1000 devices */
+@@ -157,6 +160,9 @@ static const struct usb_device_id id_table[] = {
+ {DEVICE_SWI(0x413c, 0x81a8)}, /* Dell Wireless 5808 Gobi(TM) 4G LTE Mobile Broadband Card */
+ {DEVICE_SWI(0x413c, 0x81a9)}, /* Dell Wireless 5808e Gobi(TM) 4G LTE Mobile Broadband Card */
+
++ /* Huawei devices */
++ {DEVICE_HWI(0x03f0, 0x581d)}, /* HP lt4112 LTE/HSPA+ Gobi 4G Modem (Huawei me906e) */
++
+ { } /* Terminating entry */
+ };
+ MODULE_DEVICE_TABLE(usb, id_table);
+@@ -287,6 +293,33 @@ static int qcprobe(struct usb_serial *serial, const struct usb_device_id *id)
+ break;
+ }
+ break;
++ case QCSERIAL_HWI:
++ /*
++ * Huawei layout:
++ * 0: AT-capable modem port
++ * 1: DM/DIAG
++ * 2: AT-capable modem port
++ * 3: CCID-compatible PCSC interface
++ * 4: QMI/net
++ * 5: NMEA
++ */
++ switch (ifnum) {
++ case 0:
++ case 2:
++ dev_dbg(dev, "Modem port found\n");
++ break;
++ case 1:
++ dev_dbg(dev, "DM/DIAG interface found\n");
++ break;
++ case 5:
++ dev_dbg(dev, "NMEA GPS interface found\n");
++ break;
++ default:
++ /* don't claim any unsupported interface */
++ altsetting = -1;
++ break;
++ }
++ break;
+ default:
+ dev_err(dev, "unsupported device layout type: %lu\n",
+ id->driver_info);
+diff --git a/drivers/xen/swiotlb-xen.c b/drivers/xen/swiotlb-xen.c
+index ebd8f218a788..9df5d6ec7eec 100644
+--- a/drivers/xen/swiotlb-xen.c
++++ b/drivers/xen/swiotlb-xen.c
+@@ -96,8 +96,6 @@ static inline phys_addr_t xen_bus_to_phys(dma_addr_t baddr)
+ dma_addr_t dma = (dma_addr_t)pfn << PAGE_SHIFT;
+ phys_addr_t paddr = dma;
+
+- BUG_ON(paddr != dma); /* truncation has occurred, should never happen */
+-
+ paddr |= baddr & ~PAGE_MASK;
+
+ return paddr;
+@@ -447,11 +445,11 @@ static void xen_unmap_single(struct device *hwdev, dma_addr_t dev_addr,
+
+ BUG_ON(dir == DMA_NONE);
+
+- xen_dma_unmap_page(hwdev, paddr, size, dir, attrs);
++ xen_dma_unmap_page(hwdev, dev_addr, size, dir, attrs);
+
+ /* NOTE: We use dev_addr here, not paddr! */
+ if (is_xen_swiotlb_buffer(dev_addr)) {
+- swiotlb_tbl_unmap_single(hwdev, paddr, size, dir);
++ swiotlb_tbl_unmap_single(hwdev, dev_addr, size, dir);
+ return;
+ }
+
+@@ -495,14 +493,14 @@ xen_swiotlb_sync_single(struct device *hwdev, dma_addr_t dev_addr,
+ BUG_ON(dir == DMA_NONE);
+
+ if (target == SYNC_FOR_CPU)
+- xen_dma_sync_single_for_cpu(hwdev, paddr, size, dir);
++ xen_dma_sync_single_for_cpu(hwdev, dev_addr, size, dir);
+
+ /* NOTE: We use dev_addr here, not paddr! */
+ if (is_xen_swiotlb_buffer(dev_addr))
+ swiotlb_tbl_sync_single(hwdev, paddr, size, dir, target);
+
+ if (target == SYNC_FOR_DEVICE)
+- xen_dma_sync_single_for_cpu(hwdev, paddr, size, dir);
++ xen_dma_sync_single_for_device(hwdev, dev_addr, size, dir);
+
+ if (dir != DMA_FROM_DEVICE)
+ return;
+diff --git a/fs/btrfs/delayed-inode.c b/fs/btrfs/delayed-inode.c
+index 054577bddaf2..de4e70fb3cbb 100644
+--- a/fs/btrfs/delayed-inode.c
++++ b/fs/btrfs/delayed-inode.c
+@@ -1857,6 +1857,14 @@ int btrfs_delayed_delete_inode_ref(struct inode *inode)
+ {
+ struct btrfs_delayed_node *delayed_node;
+
++ /*
++ * we don't do delayed inode updates during log recovery because it
++ * leads to enospc problems. This means we also can't do
++ * delayed inode refs
++ */
++ if (BTRFS_I(inode)->root->fs_info->log_root_recovering)
++ return -EAGAIN;
++
+ delayed_node = btrfs_get_or_create_delayed_node(inode);
+ if (IS_ERR(delayed_node))
+ return PTR_ERR(delayed_node);
+diff --git a/fs/ceph/addr.c b/fs/ceph/addr.c
+index 18c06bbaf136..481529b879fe 100644
+--- a/fs/ceph/addr.c
++++ b/fs/ceph/addr.c
+@@ -673,7 +673,7 @@ static int ceph_writepages_start(struct address_space *mapping,
+ int rc = 0;
+ unsigned wsize = 1 << inode->i_blkbits;
+ struct ceph_osd_request *req = NULL;
+- int do_sync;
++ int do_sync = 0;
+ u64 truncate_size, snap_size;
+ u32 truncate_seq;
+
+diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c
+index ef9bef118342..2d609a5fbfea 100644
+--- a/fs/fs-writeback.c
++++ b/fs/fs-writeback.c
+@@ -479,12 +479,28 @@ __writeback_single_inode(struct inode *inode, struct writeback_control *wbc)
+ * write_inode()
+ */
+ spin_lock(&inode->i_lock);
+- /* Clear I_DIRTY_PAGES if we've written out all dirty pages */
+- if (!mapping_tagged(mapping, PAGECACHE_TAG_DIRTY))
+- inode->i_state &= ~I_DIRTY_PAGES;
++
+ dirty = inode->i_state & I_DIRTY;
+- inode->i_state &= ~(I_DIRTY_SYNC | I_DIRTY_DATASYNC);
++ inode->i_state &= ~I_DIRTY;
++
++ /*
++ * Paired with smp_mb() in __mark_inode_dirty(). This allows
++ * __mark_inode_dirty() to test i_state without grabbing i_lock -
++ * either they see the I_DIRTY bits cleared or we see the dirtied
++ * inode.
++ *
++ * I_DIRTY_PAGES is always cleared together above even if @mapping
++ * still has dirty pages. The flag is reinstated after smp_mb() if
++ * necessary. This guarantees that either __mark_inode_dirty()
++ * sees clear I_DIRTY_PAGES or we see PAGECACHE_TAG_DIRTY.
++ */
++ smp_mb();
++
++ if (mapping_tagged(mapping, PAGECACHE_TAG_DIRTY))
++ inode->i_state |= I_DIRTY_PAGES;
++
+ spin_unlock(&inode->i_lock);
++
+ /* Don't write the inode if only I_DIRTY_PAGES was set */
+ if (dirty & (I_DIRTY_SYNC | I_DIRTY_DATASYNC)) {
+ int err = write_inode(inode, wbc);
+@@ -1148,12 +1164,11 @@ void __mark_inode_dirty(struct inode *inode, int flags)
+ }
+
+ /*
+- * make sure that changes are seen by all cpus before we test i_state
+- * -- mikulas
++ * Paired with smp_mb() in __writeback_single_inode() for the
++ * following lockless i_state test. See there for details.
+ */
+ smp_mb();
+
+- /* avoid the locking if we can */
+ if ((inode->i_state & flags) == flags)
+ return;
+
+diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
+index e9c3afe4b5d3..d66e3ad1de48 100644
+--- a/fs/nfsd/nfs4state.c
++++ b/fs/nfsd/nfs4state.c
+@@ -1711,15 +1711,14 @@ static int copy_cred(struct svc_cred *target, struct svc_cred *source)
+ return 0;
+ }
+
+-static long long
++static int
+ compare_blob(const struct xdr_netobj *o1, const struct xdr_netobj *o2)
+ {
+- long long res;
+-
+- res = o1->len - o2->len;
+- if (res)
+- return res;
+- return (long long)memcmp(o1->data, o2->data, o1->len);
++ if (o1->len < o2->len)
++ return -1;
++ if (o1->len > o2->len)
++ return 1;
++ return memcmp(o1->data, o2->data, o1->len);
+ }
+
+ static int same_name(const char *n1, const char *n2)
+@@ -1907,7 +1906,7 @@ add_clp_to_name_tree(struct nfs4_client *new_clp, struct rb_root *root)
+ static struct nfs4_client *
+ find_clp_in_name_tree(struct xdr_netobj *name, struct rb_root *root)
+ {
+- long long cmp;
++ int cmp;
+ struct rb_node *node = root->rb_node;
+ struct nfs4_client *clp;
+
+@@ -3891,11 +3890,11 @@ nfs4_set_delegation(struct nfs4_client *clp, struct svc_fh *fh,
+ status = nfs4_setlease(dp);
+ goto out;
+ }
+- atomic_inc(&fp->fi_delegees);
+ if (fp->fi_had_conflict) {
+ status = -EAGAIN;
+ goto out_unlock;
+ }
++ atomic_inc(&fp->fi_delegees);
+ hash_delegation_locked(dp, fp);
+ status = 0;
+ out_unlock:
+diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
+index eeea7a90eb87..2a77603d7cfd 100644
+--- a/fs/nfsd/nfs4xdr.c
++++ b/fs/nfsd/nfs4xdr.c
+@@ -1795,9 +1795,12 @@ static __be32 nfsd4_encode_components_esc(struct xdr_stream *xdr, char sep,
+ }
+ else
+ end++;
++ if (found_esc)
++ end = next;
++
+ str = end;
+ }
+- pathlen = htonl(xdr->buf->len - pathlen_offset);
++ pathlen = htonl(count);
+ write_bytes_to_xdr_buf(xdr->buf, pathlen_offset, &pathlen, 4);
+ return 0;
+ }
+diff --git a/fs/nilfs2/inode.c b/fs/nilfs2/inode.c
+index e1fa69b341b9..8b5969538f39 100644
+--- a/fs/nilfs2/inode.c
++++ b/fs/nilfs2/inode.c
+@@ -49,6 +49,8 @@ struct nilfs_iget_args {
+ int for_gc;
+ };
+
++static int nilfs_iget_test(struct inode *inode, void *opaque);
++
+ void nilfs_inode_add_blocks(struct inode *inode, int n)
+ {
+ struct nilfs_root *root = NILFS_I(inode)->i_root;
+@@ -348,6 +350,17 @@ const struct address_space_operations nilfs_aops = {
+ .is_partially_uptodate = block_is_partially_uptodate,
+ };
+
++static int nilfs_insert_inode_locked(struct inode *inode,
++ struct nilfs_root *root,
++ unsigned long ino)
++{
++ struct nilfs_iget_args args = {
++ .ino = ino, .root = root, .cno = 0, .for_gc = 0
++ };
++
++ return insert_inode_locked4(inode, ino, nilfs_iget_test, &args);
++}
++
+ struct inode *nilfs_new_inode(struct inode *dir, umode_t mode)
+ {
+ struct super_block *sb = dir->i_sb;
+@@ -383,7 +396,7 @@ struct inode *nilfs_new_inode(struct inode *dir, umode_t mode)
+ if (S_ISREG(mode) || S_ISDIR(mode) || S_ISLNK(mode)) {
+ err = nilfs_bmap_read(ii->i_bmap, NULL);
+ if (err < 0)
+- goto failed_bmap;
++ goto failed_after_creation;
+
+ set_bit(NILFS_I_BMAP, &ii->i_state);
+ /* No lock is needed; iget() ensures it. */
+@@ -399,21 +412,24 @@ struct inode *nilfs_new_inode(struct inode *dir, umode_t mode)
+ spin_lock(&nilfs->ns_next_gen_lock);
+ inode->i_generation = nilfs->ns_next_generation++;
+ spin_unlock(&nilfs->ns_next_gen_lock);
+- insert_inode_hash(inode);
++ if (nilfs_insert_inode_locked(inode, root, ino) < 0) {
++ err = -EIO;
++ goto failed_after_creation;
++ }
+
+ err = nilfs_init_acl(inode, dir);
+ if (unlikely(err))
+- goto failed_acl; /* never occur. When supporting
++ goto failed_after_creation; /* never occur. When supporting
+ nilfs_init_acl(), proper cancellation of
+ above jobs should be considered */
+
+ return inode;
+
+- failed_acl:
+- failed_bmap:
++ failed_after_creation:
+ clear_nlink(inode);
++ unlock_new_inode(inode);
+ iput(inode); /* raw_inode will be deleted through
+- generic_delete_inode() */
++ nilfs_evict_inode() */
+ goto failed;
+
+ failed_ifile_create_inode:
+@@ -461,8 +477,8 @@ int nilfs_read_inode_common(struct inode *inode,
+ inode->i_atime.tv_nsec = le32_to_cpu(raw_inode->i_mtime_nsec);
+ inode->i_ctime.tv_nsec = le32_to_cpu(raw_inode->i_ctime_nsec);
+ inode->i_mtime.tv_nsec = le32_to_cpu(raw_inode->i_mtime_nsec);
+- if (inode->i_nlink == 0 && inode->i_mode == 0)
+- return -EINVAL; /* this inode is deleted */
++ if (inode->i_nlink == 0)
++ return -ESTALE; /* this inode is deleted */
+
+ inode->i_blocks = le64_to_cpu(raw_inode->i_blocks);
+ ii->i_flags = le32_to_cpu(raw_inode->i_flags);
+diff --git a/fs/nilfs2/namei.c b/fs/nilfs2/namei.c
+index 9de78f08989e..0f84b257932c 100644
+--- a/fs/nilfs2/namei.c
++++ b/fs/nilfs2/namei.c
+@@ -51,9 +51,11 @@ static inline int nilfs_add_nondir(struct dentry *dentry, struct inode *inode)
+ int err = nilfs_add_link(dentry, inode);
+ if (!err) {
+ d_instantiate(dentry, inode);
++ unlock_new_inode(inode);
+ return 0;
+ }
+ inode_dec_link_count(inode);
++ unlock_new_inode(inode);
+ iput(inode);
+ return err;
+ }
+@@ -182,6 +184,7 @@ out:
+ out_fail:
+ drop_nlink(inode);
+ nilfs_mark_inode_dirty(inode);
++ unlock_new_inode(inode);
+ iput(inode);
+ goto out;
+ }
+@@ -201,11 +204,15 @@ static int nilfs_link(struct dentry *old_dentry, struct inode *dir,
+ inode_inc_link_count(inode);
+ ihold(inode);
+
+- err = nilfs_add_nondir(dentry, inode);
+- if (!err)
++ err = nilfs_add_link(dentry, inode);
++ if (!err) {
++ d_instantiate(dentry, inode);
+ err = nilfs_transaction_commit(dir->i_sb);
+- else
++ } else {
++ inode_dec_link_count(inode);
++ iput(inode);
+ nilfs_transaction_abort(dir->i_sb);
++ }
+
+ return err;
+ }
+@@ -243,6 +250,7 @@ static int nilfs_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode)
+
+ nilfs_mark_inode_dirty(inode);
+ d_instantiate(dentry, inode);
++ unlock_new_inode(inode);
+ out:
+ if (!err)
+ err = nilfs_transaction_commit(dir->i_sb);
+@@ -255,6 +263,7 @@ out_fail:
+ drop_nlink(inode);
+ drop_nlink(inode);
+ nilfs_mark_inode_dirty(inode);
++ unlock_new_inode(inode);
+ iput(inode);
+ out_dir:
+ drop_nlink(dir);
+diff --git a/fs/ocfs2/aops.c b/fs/ocfs2/aops.c
+index 1ef547e49373..c71174a0b1b5 100644
+--- a/fs/ocfs2/aops.c
++++ b/fs/ocfs2/aops.c
+@@ -894,7 +894,7 @@ void ocfs2_unlock_and_free_pages(struct page **pages, int num_pages)
+ }
+ }
+
+-static void ocfs2_free_write_ctxt(struct ocfs2_write_ctxt *wc)
++static void ocfs2_unlock_pages(struct ocfs2_write_ctxt *wc)
+ {
+ int i;
+
+@@ -915,7 +915,11 @@ static void ocfs2_free_write_ctxt(struct ocfs2_write_ctxt *wc)
+ page_cache_release(wc->w_target_page);
+ }
+ ocfs2_unlock_and_free_pages(wc->w_pages, wc->w_num_pages);
++}
+
++static void ocfs2_free_write_ctxt(struct ocfs2_write_ctxt *wc)
++{
++ ocfs2_unlock_pages(wc);
+ brelse(wc->w_di_bh);
+ kfree(wc);
+ }
+@@ -2042,11 +2046,19 @@ out_write_size:
+ ocfs2_update_inode_fsync_trans(handle, inode, 1);
+ ocfs2_journal_dirty(handle, wc->w_di_bh);
+
++ /* unlock pages before dealloc since it needs acquiring j_trans_barrier
++ * lock, or it will cause a deadlock since journal commit threads holds
++ * this lock and will ask for the page lock when flushing the data.
++ * put it here to preserve the unlock order.
++ */
++ ocfs2_unlock_pages(wc);
++
+ ocfs2_commit_trans(osb, handle);
+
+ ocfs2_run_deallocs(osb, &wc->w_dealloc);
+
+- ocfs2_free_write_ctxt(wc);
++ brelse(wc->w_di_bh);
++ kfree(wc);
+
+ return copied;
+ }
+diff --git a/fs/ocfs2/namei.c b/fs/ocfs2/namei.c
+index b931e04e3388..914c121ec890 100644
+--- a/fs/ocfs2/namei.c
++++ b/fs/ocfs2/namei.c
+@@ -94,6 +94,14 @@ static int ocfs2_create_symlink_data(struct ocfs2_super *osb,
+ struct inode *inode,
+ const char *symname);
+
++static int ocfs2_double_lock(struct ocfs2_super *osb,
++ struct buffer_head **bh1,
++ struct inode *inode1,
++ struct buffer_head **bh2,
++ struct inode *inode2,
++ int rename);
++
++static void ocfs2_double_unlock(struct inode *inode1, struct inode *inode2);
+ /* An orphan dir name is an 8 byte value, printed as a hex string */
+ #define OCFS2_ORPHAN_NAMELEN ((int)(2 * sizeof(u64)))
+
+@@ -678,8 +686,10 @@ static int ocfs2_link(struct dentry *old_dentry,
+ {
+ handle_t *handle;
+ struct inode *inode = old_dentry->d_inode;
++ struct inode *old_dir = old_dentry->d_parent->d_inode;
+ int err;
+ struct buffer_head *fe_bh = NULL;
++ struct buffer_head *old_dir_bh = NULL;
+ struct buffer_head *parent_fe_bh = NULL;
+ struct ocfs2_dinode *fe = NULL;
+ struct ocfs2_super *osb = OCFS2_SB(dir->i_sb);
+@@ -696,19 +706,33 @@ static int ocfs2_link(struct dentry *old_dentry,
+
+ dquot_initialize(dir);
+
+- err = ocfs2_inode_lock_nested(dir, &parent_fe_bh, 1, OI_LS_PARENT);
++ err = ocfs2_double_lock(osb, &old_dir_bh, old_dir,
++ &parent_fe_bh, dir, 0);
+ if (err < 0) {
+ if (err != -ENOENT)
+ mlog_errno(err);
+ return err;
+ }
+
++ /* make sure both dirs have bhs
++ * get an extra ref on old_dir_bh if old==new */
++ if (!parent_fe_bh) {
++ if (old_dir_bh) {
++ parent_fe_bh = old_dir_bh;
++ get_bh(parent_fe_bh);
++ } else {
++ mlog(ML_ERROR, "%s: no old_dir_bh!\n", osb->uuid_str);
++ err = -EIO;
++ goto out;
++ }
++ }
++
+ if (!dir->i_nlink) {
+ err = -ENOENT;
+ goto out;
+ }
+
+- err = ocfs2_lookup_ino_from_name(dir, old_dentry->d_name.name,
++ err = ocfs2_lookup_ino_from_name(old_dir, old_dentry->d_name.name,
+ old_dentry->d_name.len, &old_de_ino);
+ if (err) {
+ err = -ENOENT;
+@@ -801,10 +825,11 @@ out_unlock_inode:
+ ocfs2_inode_unlock(inode, 1);
+
+ out:
+- ocfs2_inode_unlock(dir, 1);
++ ocfs2_double_unlock(old_dir, dir);
+
+ brelse(fe_bh);
+ brelse(parent_fe_bh);
++ brelse(old_dir_bh);
+
+ ocfs2_free_dir_lookup_result(&lookup);
+
+@@ -1072,14 +1097,15 @@ static int ocfs2_check_if_ancestor(struct ocfs2_super *osb,
+ }
+
+ /*
+- * The only place this should be used is rename!
++ * The only place this should be used is rename and link!
+ * if they have the same id, then the 1st one is the only one locked.
+ */
+ static int ocfs2_double_lock(struct ocfs2_super *osb,
+ struct buffer_head **bh1,
+ struct inode *inode1,
+ struct buffer_head **bh2,
+- struct inode *inode2)
++ struct inode *inode2,
++ int rename)
+ {
+ int status;
+ int inode1_is_ancestor, inode2_is_ancestor;
+@@ -1127,7 +1153,7 @@ static int ocfs2_double_lock(struct ocfs2_super *osb,
+ }
+ /* lock id2 */
+ status = ocfs2_inode_lock_nested(inode2, bh2, 1,
+- OI_LS_RENAME1);
++ rename == 1 ? OI_LS_RENAME1 : OI_LS_PARENT);
+ if (status < 0) {
+ if (status != -ENOENT)
+ mlog_errno(status);
+@@ -1136,7 +1162,8 @@ static int ocfs2_double_lock(struct ocfs2_super *osb,
+ }
+
+ /* lock id1 */
+- status = ocfs2_inode_lock_nested(inode1, bh1, 1, OI_LS_RENAME2);
++ status = ocfs2_inode_lock_nested(inode1, bh1, 1,
++ rename == 1 ? OI_LS_RENAME2 : OI_LS_PARENT);
+ if (status < 0) {
+ /*
+ * An error return must mean that no cluster locks
+@@ -1252,7 +1279,7 @@ static int ocfs2_rename(struct inode *old_dir,
+
+ /* if old and new are the same, this'll just do one lock. */
+ status = ocfs2_double_lock(osb, &old_dir_bh, old_dir,
+- &new_dir_bh, new_dir);
++ &new_dir_bh, new_dir, 1);
+ if (status < 0) {
+ mlog_errno(status);
+ goto bail;
+diff --git a/fs/pstore/ram.c b/fs/pstore/ram.c
+index 3b5744306ed8..5fa34243b1ae 100644
+--- a/fs/pstore/ram.c
++++ b/fs/pstore/ram.c
+@@ -61,6 +61,11 @@ module_param(mem_size, ulong, 0400);
+ MODULE_PARM_DESC(mem_size,
+ "size of reserved RAM used to store oops/panic logs");
+
++static unsigned int mem_type;
++module_param(mem_type, uint, 0600);
++MODULE_PARM_DESC(mem_type,
++ "set to 1 to try to use unbuffered memory (default 0)");
++
+ static int dump_oops = 1;
+ module_param(dump_oops, int, 0600);
+ MODULE_PARM_DESC(dump_oops,
+@@ -79,6 +84,7 @@ struct ramoops_context {
+ struct persistent_ram_zone *fprz;
+ phys_addr_t phys_addr;
+ unsigned long size;
++ unsigned int memtype;
+ size_t record_size;
+ size_t console_size;
+ size_t ftrace_size;
+@@ -358,7 +364,8 @@ static int ramoops_init_przs(struct device *dev, struct ramoops_context *cxt,
+ size_t sz = cxt->record_size;
+
+ cxt->przs[i] = persistent_ram_new(*paddr, sz, 0,
+- &cxt->ecc_info);
++ &cxt->ecc_info,
++ cxt->memtype);
+ if (IS_ERR(cxt->przs[i])) {
+ err = PTR_ERR(cxt->przs[i]);
+ dev_err(dev, "failed to request mem region (0x%zx@0x%llx): %d\n",
+@@ -388,7 +395,7 @@ static int ramoops_init_prz(struct device *dev, struct ramoops_context *cxt,
+ return -ENOMEM;
+ }
+
+- *prz = persistent_ram_new(*paddr, sz, sig, &cxt->ecc_info);
++ *prz = persistent_ram_new(*paddr, sz, sig, &cxt->ecc_info, cxt->memtype);
+ if (IS_ERR(*prz)) {
+ int err = PTR_ERR(*prz);
+
+@@ -435,6 +442,7 @@ static int ramoops_probe(struct platform_device *pdev)
+
+ cxt->size = pdata->mem_size;
+ cxt->phys_addr = pdata->mem_address;
++ cxt->memtype = pdata->mem_type;
+ cxt->record_size = pdata->record_size;
+ cxt->console_size = pdata->console_size;
+ cxt->ftrace_size = pdata->ftrace_size;
+@@ -564,6 +572,7 @@ static void ramoops_register_dummy(void)
+
+ dummy_data->mem_size = mem_size;
+ dummy_data->mem_address = mem_address;
++ dummy_data->mem_type = 0;
+ dummy_data->record_size = record_size;
+ dummy_data->console_size = ramoops_console_size;
+ dummy_data->ftrace_size = ramoops_ftrace_size;
+diff --git a/fs/pstore/ram_core.c b/fs/pstore/ram_core.c
+index 9d7b9a83699e..76c3f80efdfa 100644
+--- a/fs/pstore/ram_core.c
++++ b/fs/pstore/ram_core.c
+@@ -380,7 +380,8 @@ void persistent_ram_zap(struct persistent_ram_zone *prz)
+ persistent_ram_update_header_ecc(prz);
+ }
+
+-static void *persistent_ram_vmap(phys_addr_t start, size_t size)
++static void *persistent_ram_vmap(phys_addr_t start, size_t size,
++ unsigned int memtype)
+ {
+ struct page **pages;
+ phys_addr_t page_start;
+@@ -392,7 +393,10 @@ static void *persistent_ram_vmap(phys_addr_t start, size_t size)
+ page_start = start - offset_in_page(start);
+ page_count = DIV_ROUND_UP(size + offset_in_page(start), PAGE_SIZE);
+
+- prot = pgprot_noncached(PAGE_KERNEL);
++ if (memtype)
++ prot = pgprot_noncached(PAGE_KERNEL);
++ else
++ prot = pgprot_writecombine(PAGE_KERNEL);
+
+ pages = kmalloc_array(page_count, sizeof(struct page *), GFP_KERNEL);
+ if (!pages) {
+@@ -411,8 +415,11 @@ static void *persistent_ram_vmap(phys_addr_t start, size_t size)
+ return vaddr;
+ }
+
+-static void *persistent_ram_iomap(phys_addr_t start, size_t size)
++static void *persistent_ram_iomap(phys_addr_t start, size_t size,
++ unsigned int memtype)
+ {
++ void *va;
++
+ if (!request_mem_region(start, size, "persistent_ram")) {
+ pr_err("request mem region (0x%llx@0x%llx) failed\n",
+ (unsigned long long)size, (unsigned long long)start);
+@@ -422,19 +429,24 @@ static void *persistent_ram_iomap(phys_addr_t start, size_t size)
+ buffer_start_add = buffer_start_add_locked;
+ buffer_size_add = buffer_size_add_locked;
+
+- return ioremap(start, size);
++ if (memtype)
++ va = ioremap(start, size);
++ else
++ va = ioremap_wc(start, size);
++
++ return va;
+ }
+
+ static int persistent_ram_buffer_map(phys_addr_t start, phys_addr_t size,
+- struct persistent_ram_zone *prz)
++ struct persistent_ram_zone *prz, int memtype)
+ {
+ prz->paddr = start;
+ prz->size = size;
+
+ if (pfn_valid(start >> PAGE_SHIFT))
+- prz->vaddr = persistent_ram_vmap(start, size);
++ prz->vaddr = persistent_ram_vmap(start, size, memtype);
+ else
+- prz->vaddr = persistent_ram_iomap(start, size);
++ prz->vaddr = persistent_ram_iomap(start, size, memtype);
+
+ if (!prz->vaddr) {
+ pr_err("%s: Failed to map 0x%llx pages at 0x%llx\n", __func__,
+@@ -500,7 +512,8 @@ void persistent_ram_free(struct persistent_ram_zone *prz)
+ }
+
+ struct persistent_ram_zone *persistent_ram_new(phys_addr_t start, size_t size,
+- u32 sig, struct persistent_ram_ecc_info *ecc_info)
++ u32 sig, struct persistent_ram_ecc_info *ecc_info,
++ unsigned int memtype)
+ {
+ struct persistent_ram_zone *prz;
+ int ret = -ENOMEM;
+@@ -511,7 +524,7 @@ struct persistent_ram_zone *persistent_ram_new(phys_addr_t start, size_t size,
+ goto err;
+ }
+
+- ret = persistent_ram_buffer_map(start, size, prz);
++ ret = persistent_ram_buffer_map(start, size, prz, memtype);
+ if (ret)
+ goto err;
+
+diff --git a/fs/reiserfs/super.c b/fs/reiserfs/super.c
+index f1376c92cf74..b27ef3541490 100644
+--- a/fs/reiserfs/super.c
++++ b/fs/reiserfs/super.c
+@@ -2161,6 +2161,9 @@ error_unlocked:
+ reiserfs_write_unlock(s);
+ }
+
++ if (sbi->commit_wq)
++ destroy_workqueue(sbi->commit_wq);
++
+ cancel_delayed_work_sync(&REISERFS_SB(s)->old_work);
+
+ reiserfs_free_bitmap_cache(s);
+diff --git a/include/linux/mm.h b/include/linux/mm.h
+index b46461116cd2..5ab2da9811c1 100644
+--- a/include/linux/mm.h
++++ b/include/linux/mm.h
+@@ -1936,7 +1936,7 @@ extern int expand_downwards(struct vm_area_struct *vma,
+ #if VM_GROWSUP
+ extern int expand_upwards(struct vm_area_struct *vma, unsigned long address);
+ #else
+- #define expand_upwards(vma, address) do { } while (0)
++ #define expand_upwards(vma, address) (0)
+ #endif
+
+ /* Look up the first VMA which satisfies addr < vm_end, NULL if none. */
+diff --git a/include/linux/pstore_ram.h b/include/linux/pstore_ram.h
+index 9974975d40db..4af3fdc85b01 100644
+--- a/include/linux/pstore_ram.h
++++ b/include/linux/pstore_ram.h
+@@ -53,7 +53,8 @@ struct persistent_ram_zone {
+ };
+
+ struct persistent_ram_zone *persistent_ram_new(phys_addr_t start, size_t size,
+- u32 sig, struct persistent_ram_ecc_info *ecc_info);
++ u32 sig, struct persistent_ram_ecc_info *ecc_info,
++ unsigned int memtype);
+ void persistent_ram_free(struct persistent_ram_zone *prz);
+ void persistent_ram_zap(struct persistent_ram_zone *prz);
+
+@@ -76,6 +77,7 @@ ssize_t persistent_ram_ecc_string(struct persistent_ram_zone *prz,
+ struct ramoops_platform_data {
+ unsigned long mem_size;
+ unsigned long mem_address;
++ unsigned int mem_type;
+ unsigned long record_size;
+ unsigned long console_size;
+ unsigned long ftrace_size;
+diff --git a/include/linux/writeback.h b/include/linux/writeback.h
+index a219be961c0a..00048339c23e 100644
+--- a/include/linux/writeback.h
++++ b/include/linux/writeback.h
+@@ -177,7 +177,6 @@ int write_cache_pages(struct address_space *mapping,
+ struct writeback_control *wbc, writepage_t writepage,
+ void *data);
+ int do_writepages(struct address_space *mapping, struct writeback_control *wbc);
+-void set_page_dirty_balance(struct page *page);
+ void writeback_set_ratelimit(void);
+ void tag_pages_for_writeback(struct address_space *mapping,
+ pgoff_t start, pgoff_t end);
+diff --git a/include/net/mac80211.h b/include/net/mac80211.h
+index 0ad1f47d2dc7..a9de1da73c01 100644
+--- a/include/net/mac80211.h
++++ b/include/net/mac80211.h
+@@ -1227,8 +1227,7 @@ struct ieee80211_vif *wdev_to_ieee80211_vif(struct wireless_dev *wdev);
+ *
+ * @IEEE80211_KEY_FLAG_GENERATE_IV: This flag should be set by the
+ * driver to indicate that it requires IV generation for this
+- * particular key. Setting this flag does not necessarily mean that SKBs
+- * will have sufficient tailroom for ICV or MIC.
++ * particular key.
+ * @IEEE80211_KEY_FLAG_GENERATE_MMIC: This flag should be set by
+ * the driver for a TKIP key if it requires Michael MIC
+ * generation in software.
+@@ -1240,9 +1239,7 @@ struct ieee80211_vif *wdev_to_ieee80211_vif(struct wireless_dev *wdev);
+ * @IEEE80211_KEY_FLAG_PUT_IV_SPACE: This flag should be set by the driver
+ * if space should be prepared for the IV, but the IV
+ * itself should not be generated. Do not set together with
+- * @IEEE80211_KEY_FLAG_GENERATE_IV on the same key. Setting this flag does
+- * not necessarily mean that SKBs will have sufficient tailroom for ICV or
+- * MIC.
++ * @IEEE80211_KEY_FLAG_GENERATE_IV on the same key.
+ * @IEEE80211_KEY_FLAG_RX_MGMT: This key will be used to decrypt received
+ * management frames. The flag can help drivers that have a hardware
+ * crypto implementation that doesn't deal with management frames
+diff --git a/include/trace/events/sched.h b/include/trace/events/sched.h
+index 0a68d5ae584e..a7d67bc14906 100644
+--- a/include/trace/events/sched.h
++++ b/include/trace/events/sched.h
+@@ -100,7 +100,7 @@ static inline long __trace_sched_switch_state(struct task_struct *p)
+ /*
+ * For all intents and purposes a preempted task is a running task.
+ */
+- if (task_preempt_count(p) & PREEMPT_ACTIVE)
++ if (preempt_count() & PREEMPT_ACTIVE)
+ state = TASK_RUNNING | TASK_STATE_MAX;
+ #endif
+
+diff --git a/include/uapi/linux/audit.h b/include/uapi/linux/audit.h
+index d4dbef14d4df..584bb0113e25 100644
+--- a/include/uapi/linux/audit.h
++++ b/include/uapi/linux/audit.h
+@@ -365,7 +365,9 @@ enum {
+ #define AUDIT_ARCH_PARISC (EM_PARISC)
+ #define AUDIT_ARCH_PARISC64 (EM_PARISC|__AUDIT_ARCH_64BIT)
+ #define AUDIT_ARCH_PPC (EM_PPC)
++/* do not define AUDIT_ARCH_PPCLE since it is not supported by audit */
+ #define AUDIT_ARCH_PPC64 (EM_PPC64|__AUDIT_ARCH_64BIT)
++#define AUDIT_ARCH_PPC64LE (EM_PPC64|__AUDIT_ARCH_64BIT|__AUDIT_ARCH_LE)
+ #define AUDIT_ARCH_S390 (EM_S390)
+ #define AUDIT_ARCH_S390X (EM_S390|__AUDIT_ARCH_64BIT)
+ #define AUDIT_ARCH_SH (EM_SH)
+diff --git a/include/uapi/linux/hyperv.h b/include/uapi/linux/hyperv.h
+index 0a8e6badb29b..bb1cb73c927a 100644
+--- a/include/uapi/linux/hyperv.h
++++ b/include/uapi/linux/hyperv.h
+@@ -134,6 +134,7 @@ struct hv_start_fcopy {
+
+ struct hv_do_fcopy {
+ struct hv_fcopy_hdr hdr;
++ __u32 pad;
+ __u64 offset;
+ __u32 size;
+ __u8 data[DATA_FRAGMENT];
+diff --git a/kernel/events/core.c b/kernel/events/core.c
+index 1cd5eef1fcdd..2ab023803945 100644
+--- a/kernel/events/core.c
++++ b/kernel/events/core.c
+@@ -7435,11 +7435,11 @@ SYSCALL_DEFINE5(perf_event_open,
+
+ if (move_group) {
+ synchronize_rcu();
+- perf_install_in_context(ctx, group_leader, event->cpu);
++ perf_install_in_context(ctx, group_leader, group_leader->cpu);
+ get_ctx(ctx);
+ list_for_each_entry(sibling, &group_leader->sibling_list,
+ group_entry) {
+- perf_install_in_context(ctx, sibling, event->cpu);
++ perf_install_in_context(ctx, sibling, sibling->cpu);
+ get_ctx(ctx);
+ }
+ }
+diff --git a/kernel/exit.c b/kernel/exit.c
+index 5d30019ff953..2116aace6c85 100644
+--- a/kernel/exit.c
++++ b/kernel/exit.c
+@@ -1302,9 +1302,15 @@ static int wait_task_continued(struct wait_opts *wo, struct task_struct *p)
+ static int wait_consider_task(struct wait_opts *wo, int ptrace,
+ struct task_struct *p)
+ {
++ /*
++ * We can race with wait_task_zombie() from another thread.
++ * Ensure that EXIT_ZOMBIE -> EXIT_DEAD/EXIT_TRACE transition
++ * can't confuse the checks below.
++ */
++ int exit_state = ACCESS_ONCE(p->exit_state);
+ int ret;
+
+- if (unlikely(p->exit_state == EXIT_DEAD))
++ if (unlikely(exit_state == EXIT_DEAD))
+ return 0;
+
+ ret = eligible_child(wo, p);
+@@ -1325,7 +1331,7 @@ static int wait_consider_task(struct wait_opts *wo, int ptrace,
+ return 0;
+ }
+
+- if (unlikely(p->exit_state == EXIT_TRACE)) {
++ if (unlikely(exit_state == EXIT_TRACE)) {
+ /*
+ * ptrace == 0 means we are the natural parent. In this case
+ * we should clear notask_error, debugger will notify us.
+@@ -1352,7 +1358,7 @@ static int wait_consider_task(struct wait_opts *wo, int ptrace,
+ }
+
+ /* slay zombie? */
+- if (p->exit_state == EXIT_ZOMBIE) {
++ if (exit_state == EXIT_ZOMBIE) {
+ /* we don't reap group leaders with subthreads */
+ if (!delay_group_leader(p)) {
+ /*
+diff --git a/kernel/sched/core.c b/kernel/sched/core.c
+index 89e7283015a6..efdca2f08222 100644
+--- a/kernel/sched/core.c
++++ b/kernel/sched/core.c
+@@ -1623,8 +1623,10 @@ void wake_up_if_idle(int cpu)
+ struct rq *rq = cpu_rq(cpu);
+ unsigned long flags;
+
+- if (!is_idle_task(rq->curr))
+- return;
++ rcu_read_lock();
++
++ if (!is_idle_task(rcu_dereference(rq->curr)))
++ goto out;
+
+ if (set_nr_if_polling(rq->idle)) {
+ trace_sched_wake_idle_without_ipi(cpu);
+@@ -1635,6 +1637,9 @@ void wake_up_if_idle(int cpu)
+ /* Else cpu is not in idle, do nothing here */
+ raw_spin_unlock_irqrestore(&rq->lock, flags);
+ }
++
++out:
++ rcu_read_unlock();
+ }
+
+ bool cpus_share_cache(int this_cpu, int that_cpu)
+diff --git a/kernel/sched/deadline.c b/kernel/sched/deadline.c
+index 28fa9d9e9201..40a97c3d8aba 100644
+--- a/kernel/sched/deadline.c
++++ b/kernel/sched/deadline.c
+@@ -575,24 +575,7 @@ void init_dl_task_timer(struct sched_dl_entity *dl_se)
+ static
+ int dl_runtime_exceeded(struct rq *rq, struct sched_dl_entity *dl_se)
+ {
+- int dmiss = dl_time_before(dl_se->deadline, rq_clock(rq));
+- int rorun = dl_se->runtime <= 0;
+-
+- if (!rorun && !dmiss)
+- return 0;
+-
+- /*
+- * If we are beyond our current deadline and we are still
+- * executing, then we have already used some of the runtime of
+- * the next instance. Thus, if we do not account that, we are
+- * stealing bandwidth from the system at each deadline miss!
+- */
+- if (dmiss) {
+- dl_se->runtime = rorun ? dl_se->runtime : 0;
+- dl_se->runtime -= rq_clock(rq) - dl_se->deadline;
+- }
+-
+- return 1;
++ return (dl_se->runtime <= 0);
+ }
+
+ extern bool sched_rt_bandwidth_account(struct rt_rq *rt_rq);
+@@ -831,10 +814,10 @@ enqueue_dl_entity(struct sched_dl_entity *dl_se,
+ * parameters of the task might need updating. Otherwise,
+ * we want a replenishment of its runtime.
+ */
+- if (!dl_se->dl_new && flags & ENQUEUE_REPLENISH)
+- replenish_dl_entity(dl_se, pi_se);
+- else
++ if (dl_se->dl_new || flags & ENQUEUE_WAKEUP)
+ update_dl_entity(dl_se, pi_se);
++ else if (flags & ENQUEUE_REPLENISH)
++ replenish_dl_entity(dl_se, pi_se);
+
+ __enqueue_dl_entity(dl_se);
+ }
+diff --git a/mm/memory.c b/mm/memory.c
+index d5f2ae9c4a23..7f86cf6252bd 100644
+--- a/mm/memory.c
++++ b/mm/memory.c
+@@ -2150,17 +2150,24 @@ reuse:
+ if (!dirty_page)
+ return ret;
+
+- /*
+- * Yes, Virginia, this is actually required to prevent a race
+- * with clear_page_dirty_for_io() from clearing the page dirty
+- * bit after it clear all dirty ptes, but before a racing
+- * do_wp_page installs a dirty pte.
+- *
+- * do_shared_fault is protected similarly.
+- */
+ if (!page_mkwrite) {
+- wait_on_page_locked(dirty_page);
+- set_page_dirty_balance(dirty_page);
++ struct address_space *mapping;
++ int dirtied;
++
++ lock_page(dirty_page);
++ dirtied = set_page_dirty(dirty_page);
++ VM_BUG_ON_PAGE(PageAnon(dirty_page), dirty_page);
++ mapping = dirty_page->mapping;
++ unlock_page(dirty_page);
++
++ if (dirtied && mapping) {
++ /*
++ * Some device drivers do not set page.mapping
++ * but still dirty their pages
++ */
++ balance_dirty_pages_ratelimited(mapping);
++ }
++
+ /* file_update_time outside page_lock */
+ if (vma->vm_file)
+ file_update_time(vma->vm_file);
+@@ -2606,7 +2613,7 @@ static inline int check_stack_guard_page(struct vm_area_struct *vma, unsigned lo
+ if (prev && prev->vm_end == address)
+ return prev->vm_flags & VM_GROWSDOWN ? 0 : -ENOMEM;
+
+- expand_downwards(vma, address - PAGE_SIZE);
++ return expand_downwards(vma, address - PAGE_SIZE);
+ }
+ if ((vma->vm_flags & VM_GROWSUP) && address + PAGE_SIZE == vma->vm_end) {
+ struct vm_area_struct *next = vma->vm_next;
+@@ -2615,7 +2622,7 @@ static inline int check_stack_guard_page(struct vm_area_struct *vma, unsigned lo
+ if (next && next->vm_start == address + PAGE_SIZE)
+ return next->vm_flags & VM_GROWSUP ? 0 : -ENOMEM;
+
+- expand_upwards(vma, address + PAGE_SIZE);
++ return expand_upwards(vma, address + PAGE_SIZE);
+ }
+ return 0;
+ }
+diff --git a/mm/mmap.c b/mm/mmap.c
+index ae919891a087..1620adbbd77f 100644
+--- a/mm/mmap.c
++++ b/mm/mmap.c
+@@ -2099,14 +2099,17 @@ static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, uns
+ {
+ struct mm_struct *mm = vma->vm_mm;
+ struct rlimit *rlim = current->signal->rlim;
+- unsigned long new_start;
++ unsigned long new_start, actual_size;
+
+ /* address space limit tests */
+ if (!may_expand_vm(mm, grow))
+ return -ENOMEM;
+
+ /* Stack limit test */
+- if (size > ACCESS_ONCE(rlim[RLIMIT_STACK].rlim_cur))
++ actual_size = size;
++ if (size && (vma->vm_flags & (VM_GROWSUP | VM_GROWSDOWN)))
++ actual_size -= PAGE_SIZE;
++ if (actual_size > ACCESS_ONCE(rlim[RLIMIT_STACK].rlim_cur))
+ return -ENOMEM;
+
+ /* mlock limit tests */
+diff --git a/mm/page-writeback.c b/mm/page-writeback.c
+index 19ceae87522d..437174a2aaa3 100644
+--- a/mm/page-writeback.c
++++ b/mm/page-writeback.c
+@@ -1541,16 +1541,6 @@ pause:
+ bdi_start_background_writeback(bdi);
+ }
+
+-void set_page_dirty_balance(struct page *page)
+-{
+- if (set_page_dirty(page)) {
+- struct address_space *mapping = page_mapping(page);
+-
+- if (mapping)
+- balance_dirty_pages_ratelimited(mapping);
+- }
+-}
+-
+ static DEFINE_PER_CPU(int, bdp_ratelimits);
+
+ /*
+@@ -2123,32 +2113,25 @@ EXPORT_SYMBOL(account_page_dirtied);
+ * page dirty in that case, but not all the buffers. This is a "bottom-up"
+ * dirtying, whereas __set_page_dirty_buffers() is a "top-down" dirtying.
+ *
+- * Most callers have locked the page, which pins the address_space in memory.
+- * But zap_pte_range() does not lock the page, however in that case the
+- * mapping is pinned by the vma's ->vm_file reference.
+- *
+- * We take care to handle the case where the page was truncated from the
+- * mapping by re-checking page_mapping() inside tree_lock.
++ * The caller must ensure this doesn't race with truncation. Most will simply
++ * hold the page lock, but e.g. zap_pte_range() calls with the page mapped and
++ * the pte lock held, which also locks out truncation.
+ */
+ int __set_page_dirty_nobuffers(struct page *page)
+ {
+ if (!TestSetPageDirty(page)) {
+ struct address_space *mapping = page_mapping(page);
+- struct address_space *mapping2;
+ unsigned long flags;
+
+ if (!mapping)
+ return 1;
+
+ spin_lock_irqsave(&mapping->tree_lock, flags);
+- mapping2 = page_mapping(page);
+- if (mapping2) { /* Race with truncate? */
+- BUG_ON(mapping2 != mapping);
+- WARN_ON_ONCE(!PagePrivate(page) && !PageUptodate(page));
+- account_page_dirtied(page, mapping);
+- radix_tree_tag_set(&mapping->page_tree,
+- page_index(page), PAGECACHE_TAG_DIRTY);
+- }
++ BUG_ON(page_mapping(page) != mapping);
++ WARN_ON_ONCE(!PagePrivate(page) && !PageUptodate(page));
++ account_page_dirtied(page, mapping);
++ radix_tree_tag_set(&mapping->page_tree, page_index(page),
++ PAGECACHE_TAG_DIRTY);
+ spin_unlock_irqrestore(&mapping->tree_lock, flags);
+ if (mapping->host) {
+ /* !PageAnon && !swapper_space */
+@@ -2305,12 +2288,10 @@ int clear_page_dirty_for_io(struct page *page)
+ /*
+ * We carefully synchronise fault handlers against
+ * installing a dirty pte and marking the page dirty
+- * at this point. We do this by having them hold the
+- * page lock at some point after installing their
+- * pte, but before marking the page dirty.
+- * Pages are always locked coming in here, so we get
+- * the desired exclusion. See mm/memory.c:do_wp_page()
+- * for more comments.
++ * at this point. We do this by having them hold the
++ * page lock while dirtying the page, and pages are
++ * always locked coming in here, so we get the desired
++ * exclusion.
+ */
+ if (TestClearPageDirty(page)) {
+ dec_zone_page_state(page, NR_FILE_DIRTY);
+diff --git a/mm/vmscan.c b/mm/vmscan.c
+index dcb47074ae03..e3b0a54a44aa 100644
+--- a/mm/vmscan.c
++++ b/mm/vmscan.c
+@@ -2904,18 +2904,20 @@ static bool prepare_kswapd_sleep(pg_data_t *pgdat, int order, long remaining,
+ return false;
+
+ /*
+- * There is a potential race between when kswapd checks its watermarks
+- * and a process gets throttled. There is also a potential race if
+- * processes get throttled, kswapd wakes, a large process exits therby
+- * balancing the zones that causes kswapd to miss a wakeup. If kswapd
+- * is going to sleep, no process should be sleeping on pfmemalloc_wait
+- * so wake them now if necessary. If necessary, processes will wake
+- * kswapd and get throttled again
++ * The throttled processes are normally woken up in balance_pgdat() as
++ * soon as pfmemalloc_watermark_ok() is true. But there is a potential
++ * race between when kswapd checks the watermarks and a process gets
++ * throttled. There is also a potential race if processes get
++ * throttled, kswapd wakes, a large process exits thereby balancing the
++ * zones, which causes kswapd to exit balance_pgdat() before reaching
++ * the wake up checks. If kswapd is going to sleep, no process should
++ * be sleeping on pfmemalloc_wait, so wake them now if necessary. If
++ * the wake up is premature, processes will wake kswapd and get
++ * throttled again. The difference from wake ups in balance_pgdat() is
++ * that here we are under prepare_to_wait().
+ */
+- if (waitqueue_active(&pgdat->pfmemalloc_wait)) {
+- wake_up(&pgdat->pfmemalloc_wait);
+- return false;
+- }
++ if (waitqueue_active(&pgdat->pfmemalloc_wait))
++ wake_up_all(&pgdat->pfmemalloc_wait);
+
+ return pgdat_balanced(pgdat, order, classzone_idx);
+ }
+diff --git a/net/bluetooth/6lowpan.c b/net/bluetooth/6lowpan.c
+index c2e0d14433df..cfbb39e6fdfd 100644
+--- a/net/bluetooth/6lowpan.c
++++ b/net/bluetooth/6lowpan.c
+@@ -591,17 +591,13 @@ static netdev_tx_t bt_xmit(struct sk_buff *skb, struct net_device *netdev)
+ int err = 0;
+ bdaddr_t addr;
+ u8 addr_type;
+- struct sk_buff *tmpskb;
+
+ /* We must take a copy of the skb before we modify/replace the ipv6
+ * header as the header could be used elsewhere
+ */
+- tmpskb = skb_unshare(skb, GFP_ATOMIC);
+- if (!tmpskb) {
+- kfree_skb(skb);
++ skb = skb_unshare(skb, GFP_ATOMIC);
++ if (!skb)
+ return NET_XMIT_DROP;
+- }
+- skb = tmpskb;
+
+ /* Return values from setup_header()
+ * <0 - error, packet is dropped
+diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
+index b9517bd17190..b45eb243a5ee 100644
+--- a/net/bluetooth/hci_conn.c
++++ b/net/bluetooth/hci_conn.c
+@@ -415,7 +415,7 @@ static void le_conn_timeout(struct work_struct *work)
+ * happen with broken hardware or if low duty cycle was used
+ * (which doesn't have a timeout of its own).
+ */
+- if (test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
++ if (conn->role == HCI_ROLE_SLAVE) {
+ u8 enable = 0x00;
+ hci_send_cmd(hdev, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable),
+ &enable);
+@@ -517,7 +517,7 @@ int hci_conn_del(struct hci_conn *conn)
+ /* Unacked frames */
+ hdev->acl_cnt += conn->sent;
+ } else if (conn->type == LE_LINK) {
+- cancel_delayed_work_sync(&conn->le_conn_timeout);
++ cancel_delayed_work(&conn->le_conn_timeout);
+
+ if (hdev->le_pkts)
+ hdev->le_cnt += conn->sent;
+diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
+index 8b0a2a6de419..e5124a9ea6f6 100644
+--- a/net/bluetooth/hci_event.c
++++ b/net/bluetooth/hci_event.c
+@@ -205,6 +205,8 @@ static void hci_cc_reset(struct hci_dev *hdev, struct sk_buff *skb)
+ hdev->le_scan_type = LE_SCAN_PASSIVE;
+
+ hdev->ssp_debug_mode = 0;
++
++ hci_bdaddr_list_clear(&hdev->le_white_list);
+ }
+
+ static void hci_cc_write_local_name(struct hci_dev *hdev, struct sk_buff *skb)
+@@ -237,7 +239,8 @@ static void hci_cc_read_local_name(struct hci_dev *hdev, struct sk_buff *skb)
+ if (rp->status)
+ return;
+
+- if (test_bit(HCI_SETUP, &hdev->dev_flags))
++ if (test_bit(HCI_SETUP, &hdev->dev_flags) ||
++ test_bit(HCI_CONFIG, &hdev->dev_flags))
+ memcpy(hdev->dev_name, rp->name, HCI_MAX_NAME_LENGTH);
+ }
+
+@@ -492,7 +495,8 @@ static void hci_cc_read_local_version(struct hci_dev *hdev, struct sk_buff *skb)
+ if (rp->status)
+ return;
+
+- if (test_bit(HCI_SETUP, &hdev->dev_flags)) {
++ if (test_bit(HCI_SETUP, &hdev->dev_flags) ||
++ test_bit(HCI_CONFIG, &hdev->dev_flags)) {
+ hdev->hci_ver = rp->hci_ver;
+ hdev->hci_rev = __le16_to_cpu(rp->hci_rev);
+ hdev->lmp_ver = rp->lmp_ver;
+@@ -511,7 +515,8 @@ static void hci_cc_read_local_commands(struct hci_dev *hdev,
+ if (rp->status)
+ return;
+
+- if (test_bit(HCI_SETUP, &hdev->dev_flags))
++ if (test_bit(HCI_SETUP, &hdev->dev_flags) ||
++ test_bit(HCI_CONFIG, &hdev->dev_flags))
+ memcpy(hdev->commands, rp->commands, sizeof(hdev->commands));
+ }
+
+@@ -2139,7 +2144,12 @@ static void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
+ return;
+ }
+
+- if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags) &&
++ /* Require HCI_CONNECTABLE or a whitelist entry to accept the
++ * connection. These features are only touched through mgmt so
++ * only do the checks if HCI_MGMT is set.
++ */
++ if (test_bit(HCI_MGMT, &hdev->dev_flags) &&
++ !test_bit(HCI_CONNECTABLE, &hdev->dev_flags) &&
+ !hci_bdaddr_list_lookup(&hdev->whitelist, &ev->bdaddr,
+ BDADDR_BREDR)) {
+ hci_reject_conn(hdev, &ev->bdaddr);
+diff --git a/net/mac80211/key.c b/net/mac80211/key.c
+index d66c6443164c..94368404744b 100644
+--- a/net/mac80211/key.c
++++ b/net/mac80211/key.c
+@@ -131,7 +131,9 @@ static int ieee80211_key_enable_hw_accel(struct ieee80211_key *key)
+ if (!ret) {
+ key->flags |= KEY_FLAG_UPLOADED_TO_HARDWARE;
+
+- if (!(key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_MMIC))
++ if (!((key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_MMIC) ||
++ (key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_IV) ||
++ (key->conf.flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE)))
+ sdata->crypto_tx_tailroom_needed_cnt--;
+
+ WARN_ON((key->conf.flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE) &&
+@@ -179,7 +181,9 @@ static void ieee80211_key_disable_hw_accel(struct ieee80211_key *key)
+ sta = key->sta;
+ sdata = key->sdata;
+
+- if (!(key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_MMIC))
++ if (!((key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_MMIC) ||
++ (key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_IV) ||
++ (key->conf.flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE)))
+ increment_tailroom_need_count(sdata);
+
+ ret = drv_set_key(key->local, DISABLE_KEY, sdata,
+@@ -875,7 +879,9 @@ void ieee80211_remove_key(struct ieee80211_key_conf *keyconf)
+ if (key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE) {
+ key->flags &= ~KEY_FLAG_UPLOADED_TO_HARDWARE;
+
+- if (!(key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_MMIC))
++ if (!((key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_MMIC) ||
++ (key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_IV) ||
++ (key->conf.flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE)))
+ increment_tailroom_need_count(key->sdata);
+ }
+
+diff --git a/net/sunrpc/xdr.c b/net/sunrpc/xdr.c
+index 290af97bf6f9..2a81e77c4477 100644
+--- a/net/sunrpc/xdr.c
++++ b/net/sunrpc/xdr.c
+@@ -606,7 +606,7 @@ void xdr_truncate_encode(struct xdr_stream *xdr, size_t len)
+ struct kvec *head = buf->head;
+ struct kvec *tail = buf->tail;
+ int fraglen;
+- int new, old;
++ int new;
+
+ if (len > buf->len) {
+ WARN_ON_ONCE(1);
+@@ -628,8 +628,8 @@ void xdr_truncate_encode(struct xdr_stream *xdr, size_t len)
+ buf->len -= fraglen;
+
+ new = buf->page_base + buf->page_len;
+- old = new + fraglen;
+- xdr->page_ptr -= (old >> PAGE_SHIFT) - (new >> PAGE_SHIFT);
++
++ xdr->page_ptr = buf->pages + (new >> PAGE_SHIFT);
+
+ if (buf->page_len && buf->len == len) {
+ xdr->p = page_address(*xdr->page_ptr);
+diff --git a/scripts/kernel-doc b/scripts/kernel-doc
+index 70bea942b413..9922e66883a5 100755
+--- a/scripts/kernel-doc
++++ b/scripts/kernel-doc
+@@ -1753,7 +1753,7 @@ sub dump_struct($$) {
+ # strip kmemcheck_bitfield_{begin,end}.*;
+ $members =~ s/kmemcheck_bitfield_.*?;//gos;
+ # strip attributes
+- $members =~ s/__aligned\s*\(.+\)//gos;
++ $members =~ s/__aligned\s*\([^;]*\)//gos;
+
+ create_parameterlist($members, ';', $file);
+ check_sections($file, $declaration_name, "struct", $sectcheck, $struct_actual, $nested);
+diff --git a/sound/firewire/fireworks/fireworks_transaction.c b/sound/firewire/fireworks/fireworks_transaction.c
+index 255dabc6fc33..2a85e4209f0b 100644
+--- a/sound/firewire/fireworks/fireworks_transaction.c
++++ b/sound/firewire/fireworks/fireworks_transaction.c
+@@ -124,7 +124,7 @@ copy_resp_to_buf(struct snd_efw *efw, void *data, size_t length, int *rcode)
+ spin_lock_irq(&efw->lock);
+
+ t = (struct snd_efw_transaction *)data;
+- length = min_t(size_t, t->length * sizeof(t->length), length);
++ length = min_t(size_t, be32_to_cpu(t->length) * sizeof(u32), length);
+
+ if (efw->push_ptr < efw->pull_ptr)
+ capacity = (unsigned int)(efw->pull_ptr - efw->push_ptr);
+diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c
+index 15e0089492f7..e708368d208f 100644
+--- a/sound/pci/hda/hda_codec.c
++++ b/sound/pci/hda/hda_codec.c
+@@ -338,8 +338,10 @@ int snd_hda_get_sub_nodes(struct hda_codec *codec, hda_nid_t nid,
+ unsigned int parm;
+
+ parm = snd_hda_param_read(codec, nid, AC_PAR_NODE_COUNT);
+- if (parm == -1)
++ if (parm == -1) {
++ *start_id = 0;
+ return 0;
++ }
+ *start_id = (parm >> 16) & 0x7fff;
+ return (int)(parm & 0x7fff);
+ }
+diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
+index 9dc9cf8c90e9..edb6e6124a23 100644
+--- a/sound/pci/hda/patch_hdmi.c
++++ b/sound/pci/hda/patch_hdmi.c
+@@ -3351,6 +3351,7 @@ static const struct hda_codec_preset snd_hda_preset_hdmi[] = {
+ { .id = 0x10de0067, .name = "MCP67 HDMI", .patch = patch_nvhdmi_2ch },
+ { .id = 0x10de0070, .name = "GPU 70 HDMI/DP", .patch = patch_nvhdmi },
+ { .id = 0x10de0071, .name = "GPU 71 HDMI/DP", .patch = patch_nvhdmi },
++{ .id = 0x10de0072, .name = "GPU 72 HDMI/DP", .patch = patch_nvhdmi },
+ { .id = 0x10de8001, .name = "MCP73 HDMI", .patch = patch_nvhdmi_2ch },
+ { .id = 0x11069f80, .name = "VX900 HDMI/DP", .patch = patch_via_hdmi },
+ { .id = 0x11069f81, .name = "VX900 HDMI/DP", .patch = patch_via_hdmi },
+@@ -3410,6 +3411,7 @@ MODULE_ALIAS("snd-hda-codec-id:10de0060");
+ MODULE_ALIAS("snd-hda-codec-id:10de0067");
+ MODULE_ALIAS("snd-hda-codec-id:10de0070");
+ MODULE_ALIAS("snd-hda-codec-id:10de0071");
++MODULE_ALIAS("snd-hda-codec-id:10de0072");
+ MODULE_ALIAS("snd-hda-codec-id:10de8001");
+ MODULE_ALIAS("snd-hda-codec-id:11069f80");
+ MODULE_ALIAS("snd-hda-codec-id:11069f81");
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index c5ad83e4e0c7..c879c3709eae 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -319,10 +319,12 @@ static void alc_fill_eapd_coef(struct hda_codec *codec)
+ break;
+ case 0x10ec0233:
+ case 0x10ec0255:
++ case 0x10ec0256:
+ case 0x10ec0282:
+ case 0x10ec0283:
+ case 0x10ec0286:
+ case 0x10ec0288:
++ case 0x10ec0298:
+ alc_update_coef_idx(codec, 0x10, 1<<9, 0);
+ break;
+ case 0x10ec0285:
+@@ -2657,7 +2659,9 @@ enum {
+ ALC269_TYPE_ALC284,
+ ALC269_TYPE_ALC285,
+ ALC269_TYPE_ALC286,
++ ALC269_TYPE_ALC298,
+ ALC269_TYPE_ALC255,
++ ALC269_TYPE_ALC256,
+ };
+
+ /*
+@@ -2684,7 +2688,9 @@ static int alc269_parse_auto_config(struct hda_codec *codec)
+ case ALC269_TYPE_ALC282:
+ case ALC269_TYPE_ALC283:
+ case ALC269_TYPE_ALC286:
++ case ALC269_TYPE_ALC298:
+ case ALC269_TYPE_ALC255:
++ case ALC269_TYPE_ALC256:
+ ssids = alc269_ssids;
+ break;
+ default:
+@@ -4790,6 +4796,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1028, 0x0638, "Dell Inspiron 5439", ALC290_FIXUP_MONO_SPEAKERS_HSJACK),
+ SND_PCI_QUIRK(0x1028, 0x064a, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1028, 0x064b, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
++ SND_PCI_QUIRK(0x1028, 0x06c7, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1028, 0x06d9, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1028, 0x06da, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1028, 0x164a, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
+@@ -5377,9 +5384,15 @@ static int patch_alc269(struct hda_codec *codec)
+ spec->codec_variant = ALC269_TYPE_ALC286;
+ spec->shutup = alc286_shutup;
+ break;
++ case 0x10ec0298:
++ spec->codec_variant = ALC269_TYPE_ALC298;
++ break;
+ case 0x10ec0255:
+ spec->codec_variant = ALC269_TYPE_ALC255;
+ break;
++ case 0x10ec0256:
++ spec->codec_variant = ALC269_TYPE_ALC256;
++ break;
+ }
+
+ if (snd_hda_codec_read(codec, 0x51, 0, AC_VERB_PARAMETERS, 0) == 0x10ec5505) {
+@@ -6315,6 +6328,7 @@ static const struct hda_codec_preset snd_hda_preset_realtek[] = {
+ { .id = 0x10ec0233, .name = "ALC233", .patch = patch_alc269 },
+ { .id = 0x10ec0235, .name = "ALC233", .patch = patch_alc269 },
+ { .id = 0x10ec0255, .name = "ALC255", .patch = patch_alc269 },
++ { .id = 0x10ec0256, .name = "ALC256", .patch = patch_alc269 },
+ { .id = 0x10ec0260, .name = "ALC260", .patch = patch_alc260 },
+ { .id = 0x10ec0262, .name = "ALC262", .patch = patch_alc262 },
+ { .id = 0x10ec0267, .name = "ALC267", .patch = patch_alc268 },
+@@ -6334,6 +6348,7 @@ static const struct hda_codec_preset snd_hda_preset_realtek[] = {
+ { .id = 0x10ec0290, .name = "ALC290", .patch = patch_alc269 },
+ { .id = 0x10ec0292, .name = "ALC292", .patch = patch_alc269 },
+ { .id = 0x10ec0293, .name = "ALC293", .patch = patch_alc269 },
++ { .id = 0x10ec0298, .name = "ALC298", .patch = patch_alc269 },
+ { .id = 0x10ec0861, .rev = 0x100340, .name = "ALC660",
+ .patch = patch_alc861 },
+ { .id = 0x10ec0660, .name = "ALC660-VD", .patch = patch_alc861vd },
+diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
+index 4f6413e01c13..605d14003d25 100644
+--- a/sound/pci/hda/patch_sigmatel.c
++++ b/sound/pci/hda/patch_sigmatel.c
+@@ -568,9 +568,9 @@ static void stac_store_hints(struct hda_codec *codec)
+ spec->gpio_mask;
+ }
+ if (get_int_hint(codec, "gpio_dir", &spec->gpio_dir))
+- spec->gpio_mask &= spec->gpio_mask;
+- if (get_int_hint(codec, "gpio_data", &spec->gpio_data))
+ spec->gpio_dir &= spec->gpio_mask;
++ if (get_int_hint(codec, "gpio_data", &spec->gpio_data))
++ spec->gpio_data &= spec->gpio_mask;
+ if (get_int_hint(codec, "eapd_mask", &spec->eapd_mask))
+ spec->eapd_mask &= spec->gpio_mask;
+ if (get_int_hint(codec, "gpio_mute", &spec->gpio_mute))
+diff --git a/sound/soc/codecs/max98090.c b/sound/soc/codecs/max98090.c
+index 1229554f1464..d492d6ea656e 100644
+--- a/sound/soc/codecs/max98090.c
++++ b/sound/soc/codecs/max98090.c
+@@ -1395,8 +1395,8 @@ static const struct snd_soc_dapm_route max98090_dapm_routes[] = {
+ {"STENL Mux", "Sidetone Left", "DMICL"},
+ {"STENR Mux", "Sidetone Right", "ADCR"},
+ {"STENR Mux", "Sidetone Right", "DMICR"},
+- {"DACL", "NULL", "STENL Mux"},
+- {"DACR", "NULL", "STENL Mux"},
++ {"DACL", NULL, "STENL Mux"},
++ {"DACR", NULL, "STENL Mux"},
+
+ {"AIFINL", NULL, "SHDN"},
+ {"AIFINR", NULL, "SHDN"},
+diff --git a/sound/soc/codecs/pcm512x-i2c.c b/sound/soc/codecs/pcm512x-i2c.c
+index 4d62230bd378..d0547fa275fc 100644
+--- a/sound/soc/codecs/pcm512x-i2c.c
++++ b/sound/soc/codecs/pcm512x-i2c.c
+@@ -24,8 +24,13 @@ static int pcm512x_i2c_probe(struct i2c_client *i2c,
+ const struct i2c_device_id *id)
+ {
+ struct regmap *regmap;
++ struct regmap_config config = pcm512x_regmap;
+
+- regmap = devm_regmap_init_i2c(i2c, &pcm512x_regmap);
++ /* msb needs to be set to enable auto-increment of addresses */
++ config.read_flag_mask = 0x80;
++ config.write_flag_mask = 0x80;
++
++ regmap = devm_regmap_init_i2c(i2c, &config);
+ if (IS_ERR(regmap))
+ return PTR_ERR(regmap);
+
+diff --git a/sound/soc/codecs/sigmadsp.c b/sound/soc/codecs/sigmadsp.c
+index f2de7e049bc6..81a38dd9af1f 100644
+--- a/sound/soc/codecs/sigmadsp.c
++++ b/sound/soc/codecs/sigmadsp.c
+@@ -159,6 +159,13 @@ int _process_sigma_firmware(struct device *dev,
+ goto done;
+ }
+
++ if (ssfw_head->version != 1) {
++ dev_err(dev,
++ "Failed to load firmware: Invalid version %d. Supported firmware versions: 1\n",
++ ssfw_head->version);
++ goto done;
++ }
++
+ crc = crc32(0, fw->data + sizeof(*ssfw_head),
+ fw->size - sizeof(*ssfw_head));
+ pr_debug("%s: crc=%x\n", __func__, crc);
+diff --git a/sound/soc/codecs/tlv320aic31xx.c b/sound/soc/codecs/tlv320aic31xx.c
+index 145fe5b253d4..93de5dd0a7b9 100644
+--- a/sound/soc/codecs/tlv320aic31xx.c
++++ b/sound/soc/codecs/tlv320aic31xx.c
+@@ -911,12 +911,13 @@ static int aic31xx_set_dai_sysclk(struct snd_soc_dai *codec_dai,
+ }
+ aic31xx->p_div = i;
+
+- for (i = 0; aic31xx_divs[i].mclk_p != freq/aic31xx->p_div; i++) {
+- if (i == ARRAY_SIZE(aic31xx_divs)) {
+- dev_err(aic31xx->dev, "%s: Unsupported frequency %d\n",
+- __func__, freq);
+- return -EINVAL;
+- }
++ for (i = 0; i < ARRAY_SIZE(aic31xx_divs) &&
++ aic31xx_divs[i].mclk_p != freq/aic31xx->p_div; i++)
++ ;
++ if (i == ARRAY_SIZE(aic31xx_divs)) {
++ dev_err(aic31xx->dev, "%s: Unsupported frequency %d\n",
++ __func__, freq);
++ return -EINVAL;
+ }
+
+ /* set clock on MCLK, BCLK, or GPIO1 as PLL input */
+diff --git a/sound/soc/dwc/designware_i2s.c b/sound/soc/dwc/designware_i2s.c
+index e961388e6e9c..10e1b8ca42ed 100644
+--- a/sound/soc/dwc/designware_i2s.c
++++ b/sound/soc/dwc/designware_i2s.c
+@@ -263,6 +263,19 @@ static void dw_i2s_shutdown(struct snd_pcm_substream *substream,
+ snd_soc_dai_set_dma_data(dai, substream, NULL);
+ }
+
++static int dw_i2s_prepare(struct snd_pcm_substream *substream,
++ struct snd_soc_dai *dai)
++{
++ struct dw_i2s_dev *dev = snd_soc_dai_get_drvdata(dai);
++
++ if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK)
++ i2s_write_reg(dev->i2s_base, TXFFR, 1);
++ else
++ i2s_write_reg(dev->i2s_base, RXFFR, 1);
++
++ return 0;
++}
++
+ static int dw_i2s_trigger(struct snd_pcm_substream *substream,
+ int cmd, struct snd_soc_dai *dai)
+ {
+@@ -294,6 +307,7 @@ static struct snd_soc_dai_ops dw_i2s_dai_ops = {
+ .startup = dw_i2s_startup,
+ .shutdown = dw_i2s_shutdown,
+ .hw_params = dw_i2s_hw_params,
++ .prepare = dw_i2s_prepare,
+ .trigger = dw_i2s_trigger,
+ };
+
+diff --git a/sound/soc/fsl/eukrea-tlv320.c b/sound/soc/fsl/eukrea-tlv320.c
+index eb093d5b85c4..54790461f39e 100644
+--- a/sound/soc/fsl/eukrea-tlv320.c
++++ b/sound/soc/fsl/eukrea-tlv320.c
+@@ -105,7 +105,7 @@ static int eukrea_tlv320_probe(struct platform_device *pdev)
+ int ret;
+ int int_port = 0, ext_port;
+ struct device_node *np = pdev->dev.of_node;
+- struct device_node *ssi_np, *codec_np;
++ struct device_node *ssi_np = NULL, *codec_np = NULL;
+
+ eukrea_tlv320.dev = &pdev->dev;
+ if (np) {
+diff --git a/sound/usb/caiaq/audio.c b/sound/usb/caiaq/audio.c
+index 272844746135..327f8642ca80 100644
+--- a/sound/usb/caiaq/audio.c
++++ b/sound/usb/caiaq/audio.c
+@@ -816,7 +816,7 @@ int snd_usb_caiaq_audio_init(struct snd_usb_caiaqdev *cdev)
+ return -EINVAL;
+ }
+
+- if (cdev->n_streams < 2) {
++ if (cdev->n_streams < 1) {
+ dev_err(dev, "bogus number of streams: %d\n", cdev->n_streams);
+ return -EINVAL;
+ }
+diff --git a/sound/usb/mixer_maps.c b/sound/usb/mixer_maps.c
+index d1d72ff50347..621bc9ebb55e 100644
+--- a/sound/usb/mixer_maps.c
++++ b/sound/usb/mixer_maps.c
+@@ -328,8 +328,11 @@ static struct usbmix_name_map gamecom780_map[] = {
+ {}
+ };
+
+-static const struct usbmix_name_map kef_x300a_map[] = {
+- { 10, NULL }, /* firmware locks up (?) when we try to access this FU */
++/* some (all?) SCMS USB3318 devices are affected by a firmware lock up
++ * when anything attempts to access FU 10 (control)
++ */
++static const struct usbmix_name_map scms_usb3318_map[] = {
++ { 10, NULL },
+ { 0 }
+ };
+
+@@ -425,8 +428,14 @@ static struct usbmix_ctl_map usbmix_ctl_maps[] = {
+ .map = ebox44_map,
+ },
+ {
++ /* KEF X300A */
+ .id = USB_ID(0x27ac, 0x1000),
+- .map = kef_x300a_map,
++ .map = scms_usb3318_map,
++ },
++ {
++ /* Arcam rPAC */
++ .id = USB_ID(0x25c4, 0x0003),
++ .map = scms_usb3318_map,
+ },
+ { 0 } /* terminator */
+ };
+diff --git a/tools/perf/util/event.h b/tools/perf/util/event.h
+index 5699e7e2a790..50a7b115698c 100644
+--- a/tools/perf/util/event.h
++++ b/tools/perf/util/event.h
+@@ -214,6 +214,7 @@ struct events_stats {
+ u32 nr_invalid_chains;
+ u32 nr_unknown_id;
+ u32 nr_unprocessable_samples;
++ u32 nr_unordered_events;
+ };
+
+ struct attr_event {
+diff --git a/tools/perf/util/session.c b/tools/perf/util/session.c
+index 6702ac28754b..80dbba095f30 100644
+--- a/tools/perf/util/session.c
++++ b/tools/perf/util/session.c
+@@ -521,15 +521,11 @@ int perf_session_queue_event(struct perf_session *s, union perf_event *event,
+ return -ETIME;
+
+ if (timestamp < oe->last_flush) {
+- WARN_ONCE(1, "Timestamp below last timeslice flush\n");
+-
+- pr_oe_time(timestamp, "out of order event");
++ pr_oe_time(timestamp, "out of order event\n");
+ pr_oe_time(oe->last_flush, "last flush, last_flush_type %d\n",
+ oe->last_flush_type);
+
+- /* We could get out of order messages after forced flush. */
+- if (oe->last_flush_type != OE_FLUSH__HALF)
+- return -EINVAL;
++ s->stats.nr_unordered_events++;
+ }
+
+ new = ordered_events__new(oe, timestamp, event);
+@@ -1057,6 +1053,9 @@ static void perf_session__warn_about_errors(const struct perf_session *session,
+ "Do you have a KVM guest running and not using 'perf kvm'?\n",
+ session->stats.nr_unprocessable_samples);
+ }
++
++ if (session->stats.nr_unordered_events != 0)
++ ui__warning("%u out of order events recorded.\n", session->stats.nr_unordered_events);
+ }
+
+ volatile int session_done;
+diff --git a/tools/testing/ktest/ktest.pl b/tools/testing/ktest/ktest.pl
+index bf1398180785..dcb1e9ac949c 100755
+--- a/tools/testing/ktest/ktest.pl
++++ b/tools/testing/ktest/ktest.pl
+@@ -3571,7 +3571,9 @@ sub test_this_config {
+ undef %configs;
+ assign_configs \%configs, $output_config;
+
+- return $config if (!defined($configs{$config}));
++ if (!defined($configs{$config}) || $configs{$config} =~ /^#/) {
++ return $config;
++ }
+
+ doprint "disabling config $config did not change .config\n";
+
diff --git a/2800_nouveau-spin-is-locked.patch b/2800_nouveau-spin-is-locked.patch
deleted file mode 100644
index 4cd72c9..0000000
--- a/2800_nouveau-spin-is-locked.patch
+++ /dev/null
@@ -1,31 +0,0 @@
---- a/drivers/gpu/drm/nouveau/core/core/event.c 2015-01-12 14:01:30.999164123 -0500
-+++ b/drivers/gpu/drm/nouveau/core/core/event.c 2015-01-12 14:03:11.229163330 -0500
-@@ -26,7 +26,7 @@
- void
- nvkm_event_put(struct nvkm_event *event, u32 types, int index)
- {
-- BUG_ON(!spin_is_locked(&event->refs_lock));
-+ assert_spin_locked(&event->refs_lock);
- while (types) {
- int type = __ffs(types); types &= ~(1 << type);
- if (--event->refs[index * event->types_nr + type] == 0) {
-@@ -39,7 +39,7 @@ nvkm_event_put(struct nvkm_event *event,
- void
- nvkm_event_get(struct nvkm_event *event, u32 types, int index)
- {
-- BUG_ON(!spin_is_locked(&event->refs_lock));
-+ assert_spin_locked(&event->refs_lock);
- while (types) {
- int type = __ffs(types); types &= ~(1 << type);
- if (++event->refs[index * event->types_nr + type] == 1) {
---- a/drivers/gpu/drm/nouveau/core/core/notify.c 2015-01-12 14:01:38.299164065 -0500
-+++ b/drivers/gpu/drm/nouveau/core/core/notify.c 2015-01-12 14:03:45.739163057 -0500
-@@ -98,7 +98,7 @@ nvkm_notify_send(struct nvkm_notify *not
- struct nvkm_event *event = notify->event;
- unsigned long flags;
-
-- BUG_ON(!spin_is_locked(&event->list_lock));
-+ assert_spin_locked(&event->list_lock);
- BUG_ON(size != notify->size);
-
- spin_lock_irqsave(&event->refs_lock, flags);
^ permalink raw reply related [flat|nested] 67+ messages in thread
* [gentoo-commits] proj/linux-patches:3.18 commit in: /
@ 2015-01-28 22:18 Anthony G. Basile
0 siblings, 0 replies; 67+ messages in thread
From: Anthony G. Basile @ 2015-01-28 22:18 UTC (permalink / raw
To: gentoo-commits
commit: 425d26faaf8ad9dcc54756902763a1388e5985d3
Author: Anthony G. Basile <blueness <AT> gentoo <DOT> org>
AuthorDate: Wed Jan 28 22:20:55 2015 +0000
Commit: Anthony G. Basile <blueness <AT> gentoo <DOT> org>
CommitDate: Wed Jan 28 22:20:55 2015 +0000
URL: http://sources.gentoo.org/gitweb/?p=proj/linux-patches.git;a=commit;h=425d26fa
Linux 3.18.4 patch
---
0000_README | 4 +
1003_linux-3.18.4.patch | 7410 +++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 7414 insertions(+)
diff --git a/0000_README b/0000_README
index 0df447d..6e4c6e3 100644
--- a/0000_README
+++ b/0000_README
@@ -55,6 +55,10 @@ Patch: 1002_linux-3.18.3.patch
From: http://www.kernel.org
Desc: Linux 3.18.3
+Patch: 1003_linux-3.18.4.patch
+From: http://www.kernel.org
+Desc: Linux 3.18.4
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1003_linux-3.18.4.patch b/1003_linux-3.18.4.patch
new file mode 100644
index 0000000..23e256c
--- /dev/null
+++ b/1003_linux-3.18.4.patch
@@ -0,0 +1,7410 @@
+diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
+index 479f33204a37..f4c71d4a9ba3 100644
+--- a/Documentation/kernel-parameters.txt
++++ b/Documentation/kernel-parameters.txt
+@@ -1270,6 +1270,7 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
+ i8042.notimeout [HW] Ignore timeout condition signalled by controller
+ i8042.reset [HW] Reset the controller during init and cleanup
+ i8042.unlock [HW] Unlock (ignore) the keylock
++ i8042.kbdreset [HW] Reset device connected to KBD port
+
+ i810= [HW,DRM]
+
+diff --git a/Makefile b/Makefile
+index 91cfe8d5ee06..4e9328491c1e 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 18
+-SUBLEVEL = 3
++SUBLEVEL = 4
+ EXTRAVERSION =
+ NAME = Diseased Newt
+
+diff --git a/arch/arc/boot/dts/nsimosci.dts b/arch/arc/boot/dts/nsimosci.dts
+index cfaedd9c61c9..1c169dc74ad1 100644
+--- a/arch/arc/boot/dts/nsimosci.dts
++++ b/arch/arc/boot/dts/nsimosci.dts
+@@ -20,7 +20,7 @@
+ /* this is for console on PGU */
+ /* bootargs = "console=tty0 consoleblank=0"; */
+ /* this is for console on serial */
+- bootargs = "earlycon=uart8250,mmio32,0xc0000000,115200n8 console=tty0 console=ttyS0,115200n8 consoleblank=0 debug";
++ bootargs = "earlycon=uart8250,mmio32,0xf0000000,115200n8 console=tty0 console=ttyS0,115200n8 consoleblank=0 debug";
+ };
+
+ aliases {
+@@ -41,9 +41,9 @@
+ #interrupt-cells = <1>;
+ };
+
+- uart0: serial@c0000000 {
++ uart0: serial@f0000000 {
+ compatible = "ns8250";
+- reg = <0xc0000000 0x2000>;
++ reg = <0xf0000000 0x2000>;
+ interrupts = <11>;
+ clock-frequency = <3686400>;
+ baud = <115200>;
+@@ -52,21 +52,21 @@
+ no-loopback-test = <1>;
+ };
+
+- pgu0: pgu@c9000000 {
++ pgu0: pgu@f9000000 {
+ compatible = "snps,arcpgufb";
+- reg = <0xc9000000 0x400>;
++ reg = <0xf9000000 0x400>;
+ };
+
+- ps2: ps2@c9001000 {
++ ps2: ps2@f9001000 {
+ compatible = "snps,arc_ps2";
+- reg = <0xc9000400 0x14>;
++ reg = <0xf9000400 0x14>;
+ interrupts = <13>;
+ interrupt-names = "arc_ps2_irq";
+ };
+
+- eth0: ethernet@c0003000 {
++ eth0: ethernet@f0003000 {
+ compatible = "snps,oscilan";
+- reg = <0xc0003000 0x44>;
++ reg = <0xf0003000 0x44>;
+ interrupts = <7>, <8>;
+ interrupt-names = "rx", "tx";
+ };
+diff --git a/arch/arm/boot/dts/berlin2q-marvell-dmp.dts b/arch/arm/boot/dts/berlin2q-marvell-dmp.dts
+index ea1f99b8eed6..45ac1d04cf42 100644
+--- a/arch/arm/boot/dts/berlin2q-marvell-dmp.dts
++++ b/arch/arm/boot/dts/berlin2q-marvell-dmp.dts
+@@ -30,6 +30,8 @@
+ };
+
+ &sdhci2 {
++ broken-cd;
++ bus-width = <8>;
+ non-removable;
+ status = "okay";
+ };
+diff --git a/arch/arm/boot/dts/berlin2q.dtsi b/arch/arm/boot/dts/berlin2q.dtsi
+index 891d56b03922..b805e19ed390 100644
+--- a/arch/arm/boot/dts/berlin2q.dtsi
++++ b/arch/arm/boot/dts/berlin2q.dtsi
+@@ -83,7 +83,8 @@
+ compatible = "mrvl,pxav3-mmc";
+ reg = <0xab1000 0x200>;
+ interrupts = <GIC_SPI 28 IRQ_TYPE_LEVEL_HIGH>;
+- clocks = <&chip CLKID_SDIO1XIN>;
++ clocks = <&chip CLKID_NFC_ECC>, <&chip CLKID_NFC>;
++ clock-names = "io", "core";
+ status = "disabled";
+ };
+
+@@ -314,36 +315,6 @@
+ interrupt-parent = <&gic>;
+ interrupts = <GIC_SPI 3 IRQ_TYPE_LEVEL_HIGH>;
+ };
+-
+- gpio4: gpio@5000 {
+- compatible = "snps,dw-apb-gpio";
+- reg = <0x5000 0x400>;
+- #address-cells = <1>;
+- #size-cells = <0>;
+-
+- porte: gpio-port@4 {
+- compatible = "snps,dw-apb-gpio-port";
+- gpio-controller;
+- #gpio-cells = <2>;
+- snps,nr-gpios = <32>;
+- reg = <0>;
+- };
+- };
+-
+- gpio5: gpio@c000 {
+- compatible = "snps,dw-apb-gpio";
+- reg = <0xc000 0x400>;
+- #address-cells = <1>;
+- #size-cells = <0>;
+-
+- portf: gpio-port@5 {
+- compatible = "snps,dw-apb-gpio-port";
+- gpio-controller;
+- #gpio-cells = <2>;
+- snps,nr-gpios = <32>;
+- reg = <0>;
+- };
+- };
+ };
+
+ chip: chip-control@ea0000 {
+@@ -372,6 +343,21 @@
+ ranges = <0 0xfc0000 0x10000>;
+ interrupt-parent = <&sic>;
+
++ sm_gpio1: gpio@5000 {
++ compatible = "snps,dw-apb-gpio";
++ reg = <0x5000 0x400>;
++ #address-cells = <1>;
++ #size-cells = <0>;
++
++ portf: gpio-port@5 {
++ compatible = "snps,dw-apb-gpio-port";
++ gpio-controller;
++ #gpio-cells = <2>;
++ snps,nr-gpios = <32>;
++ reg = <0>;
++ };
++ };
++
+ i2c2: i2c@7000 {
+ compatible = "snps,designware-i2c";
+ #address-cells = <1>;
+@@ -422,6 +408,21 @@
+ status = "disabled";
+ };
+
++ sm_gpio0: gpio@c000 {
++ compatible = "snps,dw-apb-gpio";
++ reg = <0xc000 0x400>;
++ #address-cells = <1>;
++ #size-cells = <0>;
++
++ porte: gpio-port@4 {
++ compatible = "snps,dw-apb-gpio-port";
++ gpio-controller;
++ #gpio-cells = <2>;
++ snps,nr-gpios = <32>;
++ reg = <0>;
++ };
++ };
++
+ sysctrl: pin-controller@d000 {
+ compatible = "marvell,berlin2q-system-ctrl";
+ reg = <0xd000 0x100>;
+diff --git a/arch/arm/boot/dts/dra7-evm.dts b/arch/arm/boot/dts/dra7-evm.dts
+index c6ce6258434f..1bd6c79f445e 100644
+--- a/arch/arm/boot/dts/dra7-evm.dts
++++ b/arch/arm/boot/dts/dra7-evm.dts
+@@ -399,23 +399,23 @@
+ };
+ partition@5 {
+ label = "QSPI.u-boot-spl-os";
+- reg = <0x00140000 0x00010000>;
++ reg = <0x00140000 0x00080000>;
+ };
+ partition@6 {
+ label = "QSPI.u-boot-env";
+- reg = <0x00150000 0x00010000>;
++ reg = <0x001c0000 0x00010000>;
+ };
+ partition@7 {
+ label = "QSPI.u-boot-env.backup1";
+- reg = <0x00160000 0x0010000>;
++ reg = <0x001d0000 0x0010000>;
+ };
+ partition@8 {
+ label = "QSPI.kernel";
+- reg = <0x00170000 0x0800000>;
++ reg = <0x001e0000 0x0800000>;
+ };
+ partition@9 {
+ label = "QSPI.file-system";
+- reg = <0x00970000 0x01690000>;
++ reg = <0x009e0000 0x01620000>;
+ };
+ };
+ };
+diff --git a/arch/arm/boot/dts/imx25.dtsi b/arch/arm/boot/dts/imx25.dtsi
+index 58d3c3cf2923..d238676a9107 100644
+--- a/arch/arm/boot/dts/imx25.dtsi
++++ b/arch/arm/boot/dts/imx25.dtsi
+@@ -162,7 +162,7 @@
+ #size-cells = <0>;
+ compatible = "fsl,imx25-cspi", "fsl,imx35-cspi";
+ reg = <0x43fa4000 0x4000>;
+- clocks = <&clks 62>, <&clks 62>;
++ clocks = <&clks 78>, <&clks 78>;
+ clock-names = "ipg", "per";
+ interrupts = <14>;
+ status = "disabled";
+diff --git a/arch/arm/boot/dts/imx51-babbage.dts b/arch/arm/boot/dts/imx51-babbage.dts
+index 56569cecaa78..649befeb2cf9 100644
+--- a/arch/arm/boot/dts/imx51-babbage.dts
++++ b/arch/arm/boot/dts/imx51-babbage.dts
+@@ -127,24 +127,12 @@
+ #address-cells = <1>;
+ #size-cells = <0>;
+
+- reg_usbh1_vbus: regulator@0 {
+- compatible = "regulator-fixed";
+- pinctrl-names = "default";
+- pinctrl-0 = <&pinctrl_usbh1reg>;
+- reg = <0>;
+- regulator-name = "usbh1_vbus";
+- regulator-min-microvolt = <5000000>;
+- regulator-max-microvolt = <5000000>;
+- gpio = <&gpio2 5 GPIO_ACTIVE_HIGH>;
+- enable-active-high;
+- };
+-
+- reg_usbotg_vbus: regulator@1 {
++ reg_hub_reset: regulator@0 {
+ compatible = "regulator-fixed";
+ pinctrl-names = "default";
+ pinctrl-0 = <&pinctrl_usbotgreg>;
+- reg = <1>;
+- regulator-name = "usbotg_vbus";
++ reg = <0>;
++ regulator-name = "hub_reset";
+ regulator-min-microvolt = <5000000>;
+ regulator-max-microvolt = <5000000>;
+ gpio = <&gpio1 7 GPIO_ACTIVE_HIGH>;
+@@ -176,6 +164,7 @@
+ reg = <0>;
+ clocks = <&clks IMX5_CLK_DUMMY>;
+ clock-names = "main_clk";
++ reset-gpios = <&gpio2 5 GPIO_ACTIVE_LOW>;
+ };
+ };
+ };
+@@ -419,7 +408,7 @@
+ &usbh1 {
+ pinctrl-names = "default";
+ pinctrl-0 = <&pinctrl_usbh1>;
+- vbus-supply = <®_usbh1_vbus>;
++ vbus-supply = <®_hub_reset>;
+ fsl,usbphy = <&usbh1phy>;
+ phy_type = "ulpi";
+ status = "okay";
+@@ -429,7 +418,6 @@
+ dr_mode = "otg";
+ disable-over-current;
+ phy_type = "utmi_wide";
+- vbus-supply = <®_usbotg_vbus>;
+ status = "okay";
+ };
+
+diff --git a/arch/arm/configs/omap2plus_defconfig b/arch/arm/configs/omap2plus_defconfig
+index b3f86670d2eb..a0e51bb68b2d 100644
+--- a/arch/arm/configs/omap2plus_defconfig
++++ b/arch/arm/configs/omap2plus_defconfig
+@@ -68,7 +68,7 @@ CONFIG_CPU_FREQ_DEFAULT_GOV_ONDEMAND=y
+ CONFIG_CPU_FREQ_GOV_POWERSAVE=y
+ CONFIG_CPU_FREQ_GOV_USERSPACE=y
+ CONFIG_CPU_FREQ_GOV_CONSERVATIVE=y
+-CONFIG_GENERIC_CPUFREQ_CPU0=y
++CONFIG_CPUFREQ_DT=y
+ # CONFIG_ARM_OMAP2PLUS_CPUFREQ is not set
+ CONFIG_CPU_IDLE=y
+ CONFIG_BINFMT_MISC=y
+diff --git a/arch/arm/mach-imx/clk-imx6q.c b/arch/arm/mach-imx/clk-imx6q.c
+index 4e79da7c5e30..2daef619d053 100644
+--- a/arch/arm/mach-imx/clk-imx6q.c
++++ b/arch/arm/mach-imx/clk-imx6q.c
+@@ -144,8 +144,8 @@ static void __init imx6q_clocks_init(struct device_node *ccm_node)
+ post_div_table[1].div = 1;
+ post_div_table[2].div = 1;
+ video_div_table[1].div = 1;
+- video_div_table[2].div = 1;
+- };
++ video_div_table[3].div = 1;
++ }
+
+ clk[IMX6QDL_PLL1_BYPASS_SRC] = imx_clk_mux("pll1_bypass_src", base + 0x00, 14, 2, pll_bypass_src_sels, ARRAY_SIZE(pll_bypass_src_sels));
+ clk[IMX6QDL_PLL2_BYPASS_SRC] = imx_clk_mux("pll2_bypass_src", base + 0x30, 14, 2, pll_bypass_src_sels, ARRAY_SIZE(pll_bypass_src_sels));
+diff --git a/arch/arm/mach-imx/clk-imx6sx.c b/arch/arm/mach-imx/clk-imx6sx.c
+index 17354a11356f..5a3e5a159e70 100644
+--- a/arch/arm/mach-imx/clk-imx6sx.c
++++ b/arch/arm/mach-imx/clk-imx6sx.c
+@@ -558,6 +558,9 @@ static void __init imx6sx_clocks_init(struct device_node *ccm_node)
+ clk_set_parent(clks[IMX6SX_CLK_GPU_CORE_SEL], clks[IMX6SX_CLK_PLL3_PFD0]);
+ clk_set_parent(clks[IMX6SX_CLK_GPU_AXI_SEL], clks[IMX6SX_CLK_PLL3_PFD0]);
+
++ clk_set_parent(clks[IMX6SX_CLK_QSPI1_SEL], clks[IMX6SX_CLK_PLL2_BUS]);
++ clk_set_parent(clks[IMX6SX_CLK_QSPI2_SEL], clks[IMX6SX_CLK_PLL2_BUS]);
++
+ /* Set initial power mode */
+ imx6q_set_lpm(WAIT_CLOCKED);
+ }
+diff --git a/arch/arm/mach-omap2/common.h b/arch/arm/mach-omap2/common.h
+index 377eea849e7b..db57741c9c8a 100644
+--- a/arch/arm/mach-omap2/common.h
++++ b/arch/arm/mach-omap2/common.h
+@@ -249,6 +249,7 @@ extern void omap4_cpu_die(unsigned int cpu);
+ extern struct smp_operations omap4_smp_ops;
+
+ extern void omap5_secondary_startup(void);
++extern void omap5_secondary_hyp_startup(void);
+ #endif
+
+ #if defined(CONFIG_SMP) && defined(CONFIG_PM)
+diff --git a/arch/arm/mach-omap2/omap-headsmp.S b/arch/arm/mach-omap2/omap-headsmp.S
+index 4993d4bfe9b2..6d1dffca6c7b 100644
+--- a/arch/arm/mach-omap2/omap-headsmp.S
++++ b/arch/arm/mach-omap2/omap-headsmp.S
+@@ -22,6 +22,7 @@
+
+ /* Physical address needed since MMU not enabled yet on secondary core */
+ #define AUX_CORE_BOOT0_PA 0x48281800
++#define API_HYP_ENTRY 0x102
+
+ /*
+ * OMAP5 specific entry point for secondary CPU to jump from ROM
+@@ -41,6 +42,26 @@ wait: ldr r2, =AUX_CORE_BOOT0_PA @ read from AuxCoreBoot0
+ b secondary_startup
+ ENDPROC(omap5_secondary_startup)
+ /*
++ * Same as omap5_secondary_startup except we call into the ROM to
++ * enable HYP mode first. This is called instead of
++ * omap5_secondary_startup if the primary CPU was put into HYP mode by
++ * the boot loader.
++ */
++ENTRY(omap5_secondary_hyp_startup)
++wait_2: ldr r2, =AUX_CORE_BOOT0_PA @ read from AuxCoreBoot0
++ ldr r0, [r2]
++ mov r0, r0, lsr #5
++ mrc p15, 0, r4, c0, c0, 5
++ and r4, r4, #0x0f
++ cmp r0, r4
++ bne wait_2
++ ldr r12, =API_HYP_ENTRY
++ adr r0, hyp_boot
++ smc #0
++hyp_boot:
++ b secondary_startup
++ENDPROC(omap5_secondary_hyp_startup)
++/*
+ * OMAP4 specific entry point for secondary CPU to jump from ROM
+ * code. This routine also provides a holding flag into which
+ * secondary core is held until we're ready for it to initialise.
+diff --git a/arch/arm/mach-omap2/omap-smp.c b/arch/arm/mach-omap2/omap-smp.c
+index 256e84ef0f67..5305ec7341ec 100644
+--- a/arch/arm/mach-omap2/omap-smp.c
++++ b/arch/arm/mach-omap2/omap-smp.c
+@@ -22,6 +22,7 @@
+ #include <linux/irqchip/arm-gic.h>
+
+ #include <asm/smp_scu.h>
++#include <asm/virt.h>
+
+ #include "omap-secure.h"
+ #include "omap-wakeupgen.h"
+@@ -227,8 +228,16 @@ static void __init omap4_smp_prepare_cpus(unsigned int max_cpus)
+ if (omap_secure_apis_support())
+ omap_auxcoreboot_addr(virt_to_phys(startup_addr));
+ else
+- writel_relaxed(virt_to_phys(omap5_secondary_startup),
+- base + OMAP_AUX_CORE_BOOT_1);
++ /*
++ * If the boot CPU is in HYP mode then start secondary
++ * CPU in HYP mode as well.
++ */
++ if ((__boot_cpu_mode & MODE_MASK) == HYP_MODE)
++ writel_relaxed(virt_to_phys(omap5_secondary_hyp_startup),
++ base + OMAP_AUX_CORE_BOOT_1);
++ else
++ writel_relaxed(virt_to_phys(omap5_secondary_startup),
++ base + OMAP_AUX_CORE_BOOT_1);
+
+ }
+
+diff --git a/arch/arm/mach-omap2/timer.c b/arch/arm/mach-omap2/timer.c
+index 4f61148ec168..fb0cb2b817a9 100644
+--- a/arch/arm/mach-omap2/timer.c
++++ b/arch/arm/mach-omap2/timer.c
+@@ -513,11 +513,11 @@ static void __init realtime_counter_init(void)
+ rate = clk_get_rate(sys_clk);
+ /* Numerator/denumerator values refer TRM Realtime Counter section */
+ switch (rate) {
+- case 1200000:
++ case 12000000:
+ num = 64;
+ den = 125;
+ break;
+- case 1300000:
++ case 13000000:
+ num = 768;
+ den = 1625;
+ break;
+@@ -529,11 +529,11 @@ static void __init realtime_counter_init(void)
+ num = 192;
+ den = 625;
+ break;
+- case 2600000:
++ case 26000000:
+ num = 384;
+ den = 1625;
+ break;
+- case 2700000:
++ case 27000000:
+ num = 256;
+ den = 1125;
+ break;
+diff --git a/arch/arm/mach-shmobile/setup-sh73a0.c b/arch/arm/mach-shmobile/setup-sh73a0.c
+index 328657d011d5..1ba4f6357843 100644
+--- a/arch/arm/mach-shmobile/setup-sh73a0.c
++++ b/arch/arm/mach-shmobile/setup-sh73a0.c
+@@ -598,6 +598,7 @@ static struct platform_device ipmmu_device = {
+
+ static struct renesas_intc_irqpin_config irqpin0_platform_data = {
+ .irq_base = irq_pin(0), /* IRQ0 -> IRQ7 */
++ .control_parent = true,
+ };
+
+ static struct resource irqpin0_resources[] = {
+@@ -659,6 +660,7 @@ static struct platform_device irqpin1_device = {
+
+ static struct renesas_intc_irqpin_config irqpin2_platform_data = {
+ .irq_base = irq_pin(16), /* IRQ16 -> IRQ23 */
++ .control_parent = true,
+ };
+
+ static struct resource irqpin2_resources[] = {
+@@ -689,6 +691,7 @@ static struct platform_device irqpin2_device = {
+
+ static struct renesas_intc_irqpin_config irqpin3_platform_data = {
+ .irq_base = irq_pin(24), /* IRQ24 -> IRQ31 */
++ .control_parent = true,
+ };
+
+ static struct resource irqpin3_resources[] = {
+diff --git a/arch/arm64/mm/init.c b/arch/arm64/mm/init.c
+index 494297c698ca..fff81f02251c 100644
+--- a/arch/arm64/mm/init.c
++++ b/arch/arm64/mm/init.c
+@@ -333,14 +333,8 @@ static int keep_initrd;
+
+ void free_initrd_mem(unsigned long start, unsigned long end)
+ {
+- if (!keep_initrd) {
+- if (start == initrd_start)
+- start = round_down(start, PAGE_SIZE);
+- if (end == initrd_end)
+- end = round_up(end, PAGE_SIZE);
+-
++ if (!keep_initrd)
+ free_reserved_area((void *)start, (void *)end, 0, "initrd");
+- }
+ }
+
+ static int __init keepinitrd_setup(char *__unused)
+diff --git a/arch/parisc/include/asm/ldcw.h b/arch/parisc/include/asm/ldcw.h
+index d2d11b7055ba..8121aa6db2ff 100644
+--- a/arch/parisc/include/asm/ldcw.h
++++ b/arch/parisc/include/asm/ldcw.h
+@@ -33,11 +33,18 @@
+
+ #endif /*!CONFIG_PA20*/
+
+-/* LDCW, the only atomic read-write operation PA-RISC has. *sigh*. */
++/* LDCW, the only atomic read-write operation PA-RISC has. *sigh*.
++ We don't explicitly expose that "*a" may be written as reload
++ fails to find a register in class R1_REGS when "a" needs to be
++ reloaded when generating 64-bit PIC code. Instead, we clobber
++ memory to indicate to the compiler that the assembly code reads
++ or writes to items other than those listed in the input and output
++ operands. This may pessimize the code somewhat but __ldcw is
++ usually used within code blocks surrounded by memory barriors. */
+ #define __ldcw(a) ({ \
+ unsigned __ret; \
+- __asm__ __volatile__(__LDCW " 0(%2),%0" \
+- : "=r" (__ret), "+m" (*(a)) : "r" (a)); \
++ __asm__ __volatile__(__LDCW " 0(%1),%0" \
++ : "=r" (__ret) : "r" (a) : "memory"); \
+ __ret; \
+ })
+
+diff --git a/arch/powerpc/platforms/powernv/opal-wrappers.S b/arch/powerpc/platforms/powernv/opal-wrappers.S
+index feb549aa3eea..b67ea67eb71b 100644
+--- a/arch/powerpc/platforms/powernv/opal-wrappers.S
++++ b/arch/powerpc/platforms/powernv/opal-wrappers.S
+@@ -40,7 +40,6 @@ BEGIN_FTR_SECTION; \
+ b 1f; \
+ END_FTR_SECTION(0, 1); \
+ ld r12,opal_tracepoint_refcount@toc(r2); \
+- std r12,32(r1); \
+ cmpdi r12,0; \
+ bne- LABEL; \
+ 1:
+diff --git a/arch/um/Kconfig.common b/arch/um/Kconfig.common
+index 87bc86821bc9..d195a87ca542 100644
+--- a/arch/um/Kconfig.common
++++ b/arch/um/Kconfig.common
+@@ -3,6 +3,7 @@ config UML
+ default y
+ select HAVE_ARCH_AUDITSYSCALL
+ select HAVE_UID16
++ select HAVE_FUTEX_CMPXCHG if FUTEX
+ select GENERIC_IRQ_SHOW
+ select GENERIC_CPU_DEVICES
+ select GENERIC_IO
+diff --git a/arch/x86/boot/Makefile b/arch/x86/boot/Makefile
+index 5b016e2498f3..3db07f30636f 100644
+--- a/arch/x86/boot/Makefile
++++ b/arch/x86/boot/Makefile
+@@ -51,6 +51,7 @@ targets += cpustr.h
+ $(obj)/cpustr.h: $(obj)/mkcpustr FORCE
+ $(call if_changed,cpustr)
+ endif
++clean-files += cpustr.h
+
+ # ---------------------------------------------------------------------------
+
+diff --git a/arch/x86/kernel/cpu/Makefile b/arch/x86/kernel/cpu/Makefile
+index e27b49d7c922..80091ae54c2b 100644
+--- a/arch/x86/kernel/cpu/Makefile
++++ b/arch/x86/kernel/cpu/Makefile
+@@ -66,3 +66,4 @@ targets += capflags.c
+ $(obj)/capflags.c: $(cpufeature) $(src)/mkcapflags.sh FORCE
+ $(call if_changed,mkcapflags)
+ endif
++clean-files += capflags.c
+diff --git a/arch/x86/kernel/kprobes/core.c b/arch/x86/kernel/kprobes/core.c
+index 67e6d19ef1be..93d2c04c6f8f 100644
+--- a/arch/x86/kernel/kprobes/core.c
++++ b/arch/x86/kernel/kprobes/core.c
+@@ -1018,6 +1018,15 @@ int setjmp_pre_handler(struct kprobe *p, struct pt_regs *regs)
+ regs->flags &= ~X86_EFLAGS_IF;
+ trace_hardirqs_off();
+ regs->ip = (unsigned long)(jp->entry);
++
++ /*
++ * jprobes use jprobe_return() which skips the normal return
++ * path of the function, and this messes up the accounting of the
++ * function graph tracer to get messed up.
++ *
++ * Pause function graph tracing while performing the jprobe function.
++ */
++ pause_graph_tracing();
+ return 1;
+ }
+ NOKPROBE_SYMBOL(setjmp_pre_handler);
+@@ -1046,24 +1055,25 @@ int longjmp_break_handler(struct kprobe *p, struct pt_regs *regs)
+ struct kprobe_ctlblk *kcb = get_kprobe_ctlblk();
+ u8 *addr = (u8 *) (regs->ip - 1);
+ struct jprobe *jp = container_of(p, struct jprobe, kp);
++ void *saved_sp = kcb->jprobe_saved_sp;
+
+ if ((addr > (u8 *) jprobe_return) &&
+ (addr < (u8 *) jprobe_return_end)) {
+- if (stack_addr(regs) != kcb->jprobe_saved_sp) {
++ if (stack_addr(regs) != saved_sp) {
+ struct pt_regs *saved_regs = &kcb->jprobe_saved_regs;
+ printk(KERN_ERR
+ "current sp %p does not match saved sp %p\n",
+- stack_addr(regs), kcb->jprobe_saved_sp);
++ stack_addr(regs), saved_sp);
+ printk(KERN_ERR "Saved registers for jprobe %p\n", jp);
+ show_regs(saved_regs);
+ printk(KERN_ERR "Current registers\n");
+ show_regs(regs);
+ BUG();
+ }
++ /* It's OK to start function graph tracing again */
++ unpause_graph_tracing();
+ *regs = kcb->jprobe_saved_regs;
+- memcpy((kprobe_opcode_t *)(kcb->jprobe_saved_sp),
+- kcb->jprobes_stack,
+- MIN_STACK_SIZE(kcb->jprobe_saved_sp));
++ memcpy(saved_sp, kcb->jprobes_stack, MIN_STACK_SIZE(saved_sp));
+ preempt_enable_no_resched();
+ return 1;
+ }
+diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
+index 3e556c68351b..ed7039465f16 100644
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -2377,12 +2377,12 @@ static __init void nested_vmx_setup_ctls_msrs(void)
+ nested_vmx_secondary_ctls_low = 0;
+ nested_vmx_secondary_ctls_high &=
+ SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES |
+- SECONDARY_EXEC_UNRESTRICTED_GUEST |
+ SECONDARY_EXEC_WBINVD_EXITING;
+
+ if (enable_ept) {
+ /* nested EPT: emulate EPT also to L1 */
+- nested_vmx_secondary_ctls_high |= SECONDARY_EXEC_ENABLE_EPT;
++ nested_vmx_secondary_ctls_high |= SECONDARY_EXEC_ENABLE_EPT |
++ SECONDARY_EXEC_UNRESTRICTED_GUEST;
+ nested_vmx_ept_caps = VMX_EPT_PAGE_WALK_4_BIT |
+ VMX_EPTP_WB_BIT | VMX_EPT_2MB_PAGE_BIT |
+ VMX_EPT_INVEPT_BIT;
+diff --git a/arch/x86/um/sys_call_table_32.c b/arch/x86/um/sys_call_table_32.c
+index 531d4269e2e3..bd16d6c370ec 100644
+--- a/arch/x86/um/sys_call_table_32.c
++++ b/arch/x86/um/sys_call_table_32.c
+@@ -34,7 +34,7 @@ typedef asmlinkage void (*sys_call_ptr_t)(void);
+
+ extern asmlinkage void sys_ni_syscall(void);
+
+-const sys_call_ptr_t sys_call_table[] __cacheline_aligned = {
++const sys_call_ptr_t sys_call_table[] ____cacheline_aligned = {
+ /*
+ * Smells like a compiler bug -- it doesn't work
+ * when the & below is removed.
+diff --git a/arch/x86/um/sys_call_table_64.c b/arch/x86/um/sys_call_table_64.c
+index f2f0723070ca..95783087f0d3 100644
+--- a/arch/x86/um/sys_call_table_64.c
++++ b/arch/x86/um/sys_call_table_64.c
+@@ -46,7 +46,7 @@ typedef void (*sys_call_ptr_t)(void);
+
+ extern void sys_ni_syscall(void);
+
+-const sys_call_ptr_t sys_call_table[] __cacheline_aligned = {
++const sys_call_ptr_t sys_call_table[] ____cacheline_aligned = {
+ /*
+ * Smells like a compiler bug -- it doesn't work
+ * when the & below is removed.
+diff --git a/drivers/bus/omap_l3_noc.c b/drivers/bus/omap_l3_noc.c
+index 531ae591783b..17d86595951c 100644
+--- a/drivers/bus/omap_l3_noc.c
++++ b/drivers/bus/omap_l3_noc.c
+@@ -222,10 +222,14 @@ static irqreturn_t l3_interrupt_handler(int irq, void *_l3)
+ }
+
+ /* Error found so break the for loop */
+- break;
++ return IRQ_HANDLED;
+ }
+ }
+- return IRQ_HANDLED;
++
++ dev_err(l3->dev, "L3 %s IRQ not handled!!\n",
++ inttype ? "debug" : "application");
++
++ return IRQ_NONE;
+ }
+
+ static const struct of_device_id l3_noc_match[] = {
+@@ -296,11 +300,66 @@ static int omap_l3_probe(struct platform_device *pdev)
+ return ret;
+ }
+
++#ifdef CONFIG_PM
++
++/**
++ * l3_resume_noirq() - resume function for l3_noc
++ * @dev: pointer to l3_noc device structure
++ *
++ * We only have the resume handler only since we
++ * have already maintained the delta register
++ * configuration as part of configuring the system
++ */
++static int l3_resume_noirq(struct device *dev)
++{
++ struct omap_l3 *l3 = dev_get_drvdata(dev);
++ int i;
++ struct l3_flagmux_data *flag_mux;
++ void __iomem *base, *mask_regx = NULL;
++ u32 mask_val;
++
++ for (i = 0; i < l3->num_modules; i++) {
++ base = l3->l3_base[i];
++ flag_mux = l3->l3_flagmux[i];
++ if (!flag_mux->mask_app_bits && !flag_mux->mask_dbg_bits)
++ continue;
++
++ mask_regx = base + flag_mux->offset + L3_FLAGMUX_MASK0 +
++ (L3_APPLICATION_ERROR << 3);
++ mask_val = readl_relaxed(mask_regx);
++ mask_val &= ~(flag_mux->mask_app_bits);
++
++ writel_relaxed(mask_val, mask_regx);
++ mask_regx = base + flag_mux->offset + L3_FLAGMUX_MASK0 +
++ (L3_DEBUG_ERROR << 3);
++ mask_val = readl_relaxed(mask_regx);
++ mask_val &= ~(flag_mux->mask_dbg_bits);
++
++ writel_relaxed(mask_val, mask_regx);
++ }
++
++ /* Dummy read to force OCP barrier */
++ if (mask_regx)
++ (void)readl(mask_regx);
++
++ return 0;
++}
++
++static const struct dev_pm_ops l3_dev_pm_ops = {
++ .resume_noirq = l3_resume_noirq,
++};
++
++#define L3_DEV_PM_OPS (&l3_dev_pm_ops)
++#else
++#define L3_DEV_PM_OPS NULL
++#endif
++
+ static struct platform_driver omap_l3_driver = {
+ .probe = omap_l3_probe,
+ .driver = {
+ .name = "omap_l3_noc",
+ .owner = THIS_MODULE,
++ .pm = L3_DEV_PM_OPS,
+ .of_match_table = of_match_ptr(l3_noc_match),
+ },
+ };
+diff --git a/drivers/clk/at91/clk-slow.c b/drivers/clk/at91/clk-slow.c
+index 32f7c1b36204..2f13bd5246b5 100644
+--- a/drivers/clk/at91/clk-slow.c
++++ b/drivers/clk/at91/clk-slow.c
+@@ -70,6 +70,7 @@ struct clk_sam9x5_slow {
+
+ #define to_clk_sam9x5_slow(hw) container_of(hw, struct clk_sam9x5_slow, hw)
+
++static struct clk *slow_clk;
+
+ static int clk_slow_osc_prepare(struct clk_hw *hw)
+ {
+@@ -357,6 +358,8 @@ at91_clk_register_sam9x5_slow(void __iomem *sckcr,
+ clk = clk_register(NULL, &slowck->hw);
+ if (IS_ERR(clk))
+ kfree(slowck);
++ else
++ slow_clk = clk;
+
+ return clk;
+ }
+@@ -433,6 +436,8 @@ at91_clk_register_sam9260_slow(struct at91_pmc *pmc,
+ clk = clk_register(NULL, &slowck->hw);
+ if (IS_ERR(clk))
+ kfree(slowck);
++ else
++ slow_clk = clk;
+
+ return clk;
+ }
+@@ -465,3 +470,25 @@ void __init of_at91sam9260_clk_slow_setup(struct device_node *np,
+
+ of_clk_add_provider(np, of_clk_src_simple_get, clk);
+ }
++
++/*
++ * FIXME: All slow clk users are not properly claiming it (get + prepare +
++ * enable) before using it.
++ * If all users properly claiming this clock decide that they don't need it
++ * anymore (or are removed), it is disabled while faulty users are still
++ * requiring it, and the system hangs.
++ * Prevent this clock from being disabled until all users are properly
++ * requesting it.
++ * Once this is done we should remove this function and the slow_clk variable.
++ */
++static int __init of_at91_clk_slow_retain(void)
++{
++ if (!slow_clk)
++ return 0;
++
++ __clk_get(slow_clk);
++ clk_prepare_enable(slow_clk);
++
++ return 0;
++}
++arch_initcall(of_at91_clk_slow_retain);
+diff --git a/drivers/clk/berlin/bg2q.c b/drivers/clk/berlin/bg2q.c
+index 21784e4eb3f0..440ef81ab15c 100644
+--- a/drivers/clk/berlin/bg2q.c
++++ b/drivers/clk/berlin/bg2q.c
+@@ -285,7 +285,6 @@ static const struct berlin2_gate_data bg2q_gates[] __initconst = {
+ { "pbridge", "perif", 15, CLK_IGNORE_UNUSED },
+ { "sdio", "perif", 16, CLK_IGNORE_UNUSED },
+ { "nfc", "perif", 18 },
+- { "smemc", "perif", 19 },
+ { "pcie", "perif", 22 },
+ };
+
+diff --git a/drivers/clk/clk-ppc-corenet.c b/drivers/clk/clk-ppc-corenet.c
+index 8e58edfeeb37..8b284be4efa4 100644
+--- a/drivers/clk/clk-ppc-corenet.c
++++ b/drivers/clk/clk-ppc-corenet.c
+@@ -291,7 +291,7 @@ static const struct of_device_id ppc_clk_ids[] __initconst = {
+ {}
+ };
+
+-static struct platform_driver ppc_corenet_clk_driver __initdata = {
++static struct platform_driver ppc_corenet_clk_driver = {
+ .driver = {
+ .name = "ppc_corenet_clock",
+ .owner = THIS_MODULE,
+diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c
+index 4896ae9e23da..26bed0889e97 100644
+--- a/drivers/clk/clk.c
++++ b/drivers/clk/clk.c
+@@ -240,7 +240,6 @@ static const struct file_operations clk_dump_fops = {
+ .release = single_release,
+ };
+
+-/* caller must hold prepare_lock */
+ static int clk_debug_create_one(struct clk *clk, struct dentry *pdentry)
+ {
+ struct dentry *d;
+@@ -1944,7 +1943,6 @@ int __clk_init(struct device *dev, struct clk *clk)
+ else
+ clk->rate = 0;
+
+- clk_debug_register(clk);
+ /*
+ * walk the list of orphan clocks and reparent any that are children of
+ * this clock
+@@ -1979,6 +1977,9 @@ int __clk_init(struct device *dev, struct clk *clk)
+ out:
+ clk_prepare_unlock();
+
++ if (!ret)
++ clk_debug_register(clk);
++
+ return ret;
+ }
+
+@@ -2273,14 +2274,17 @@ int __clk_get(struct clk *clk)
+
+ void __clk_put(struct clk *clk)
+ {
++ struct module *owner;
++
+ if (!clk || WARN_ON_ONCE(IS_ERR(clk)))
+ return;
+
+ clk_prepare_lock();
++ owner = clk->owner;
+ kref_put(&clk->ref, __clk_release);
+ clk_prepare_unlock();
+
+- module_put(clk->owner);
++ module_put(owner);
+ }
+
+ /*** clk rate change notifiers ***/
+diff --git a/drivers/clk/rockchip/clk-rk3188.c b/drivers/clk/rockchip/clk-rk3188.c
+index beed49c79126..8088b384ce6e 100644
+--- a/drivers/clk/rockchip/clk-rk3188.c
++++ b/drivers/clk/rockchip/clk-rk3188.c
+@@ -210,6 +210,17 @@ PNAME(mux_sclk_hsadc_p) = { "hsadc_src", "hsadc_frac", "ext_hsadc" };
+ PNAME(mux_mac_p) = { "gpll", "dpll" };
+ PNAME(mux_sclk_macref_p) = { "mac_src", "ext_rmii" };
+
++static struct rockchip_pll_clock rk3066_pll_clks[] __initdata = {
++ [apll] = PLL(pll_rk3066, PLL_APLL, "apll", mux_pll_p, 0, RK2928_PLL_CON(0),
++ RK2928_MODE_CON, 0, 5, rk3188_pll_rates),
++ [dpll] = PLL(pll_rk3066, PLL_DPLL, "dpll", mux_pll_p, 0, RK2928_PLL_CON(4),
++ RK2928_MODE_CON, 4, 4, NULL),
++ [cpll] = PLL(pll_rk3066, PLL_CPLL, "cpll", mux_pll_p, 0, RK2928_PLL_CON(8),
++ RK2928_MODE_CON, 8, 6, rk3188_pll_rates),
++ [gpll] = PLL(pll_rk3066, PLL_GPLL, "gpll", mux_pll_p, 0, RK2928_PLL_CON(12),
++ RK2928_MODE_CON, 12, 7, rk3188_pll_rates),
++};
++
+ static struct rockchip_pll_clock rk3188_pll_clks[] __initdata = {
+ [apll] = PLL(pll_rk3066, PLL_APLL, "apll", mux_pll_p, 0, RK2928_PLL_CON(0),
+ RK2928_MODE_CON, 0, 6, rk3188_pll_rates),
+@@ -742,8 +753,8 @@ static void __init rk3188_common_clk_init(struct device_node *np)
+ static void __init rk3066a_clk_init(struct device_node *np)
+ {
+ rk3188_common_clk_init(np);
+- rockchip_clk_register_plls(rk3188_pll_clks,
+- ARRAY_SIZE(rk3188_pll_clks),
++ rockchip_clk_register_plls(rk3066_pll_clks,
++ ARRAY_SIZE(rk3066_pll_clks),
+ RK3066_GRF_SOC_STATUS);
+ rockchip_clk_register_branches(rk3066a_clk_branches,
+ ARRAY_SIZE(rk3066a_clk_branches));
+diff --git a/drivers/clk/rockchip/clk-rk3288.c b/drivers/clk/rockchip/clk-rk3288.c
+index 23278291da44..6dbc64759a58 100644
+--- a/drivers/clk/rockchip/clk-rk3288.c
++++ b/drivers/clk/rockchip/clk-rk3288.c
+@@ -142,20 +142,20 @@ struct rockchip_pll_rate_table rk3288_pll_rates[] = {
+ }
+
+ static struct rockchip_cpuclk_rate_table rk3288_cpuclk_rates[] __initdata = {
+- RK3288_CPUCLK_RATE(1800000000, 2, 4, 2, 4, 4),
+- RK3288_CPUCLK_RATE(1704000000, 2, 4, 2, 4, 4),
+- RK3288_CPUCLK_RATE(1608000000, 2, 4, 2, 4, 4),
+- RK3288_CPUCLK_RATE(1512000000, 2, 4, 2, 4, 4),
+- RK3288_CPUCLK_RATE(1416000000, 2, 4, 2, 4, 4),
+- RK3288_CPUCLK_RATE(1200000000, 2, 4, 2, 4, 4),
+- RK3288_CPUCLK_RATE(1008000000, 2, 4, 2, 4, 4),
+- RK3288_CPUCLK_RATE( 816000000, 2, 4, 2, 4, 4),
+- RK3288_CPUCLK_RATE( 696000000, 2, 4, 2, 4, 4),
+- RK3288_CPUCLK_RATE( 600000000, 2, 4, 2, 4, 4),
+- RK3288_CPUCLK_RATE( 408000000, 2, 4, 2, 4, 4),
+- RK3288_CPUCLK_RATE( 312000000, 2, 4, 2, 4, 4),
+- RK3288_CPUCLK_RATE( 216000000, 2, 4, 2, 4, 4),
+- RK3288_CPUCLK_RATE( 126000000, 2, 4, 2, 4, 4),
++ RK3288_CPUCLK_RATE(1800000000, 1, 3, 1, 3, 3),
++ RK3288_CPUCLK_RATE(1704000000, 1, 3, 1, 3, 3),
++ RK3288_CPUCLK_RATE(1608000000, 1, 3, 1, 3, 3),
++ RK3288_CPUCLK_RATE(1512000000, 1, 3, 1, 3, 3),
++ RK3288_CPUCLK_RATE(1416000000, 1, 3, 1, 3, 3),
++ RK3288_CPUCLK_RATE(1200000000, 1, 3, 1, 3, 3),
++ RK3288_CPUCLK_RATE(1008000000, 1, 3, 1, 3, 3),
++ RK3288_CPUCLK_RATE( 816000000, 1, 3, 1, 3, 3),
++ RK3288_CPUCLK_RATE( 696000000, 1, 3, 1, 3, 3),
++ RK3288_CPUCLK_RATE( 600000000, 1, 3, 1, 3, 3),
++ RK3288_CPUCLK_RATE( 408000000, 1, 3, 1, 3, 3),
++ RK3288_CPUCLK_RATE( 312000000, 1, 3, 1, 3, 3),
++ RK3288_CPUCLK_RATE( 216000000, 1, 3, 1, 3, 3),
++ RK3288_CPUCLK_RATE( 126000000, 1, 3, 1, 3, 3),
+ };
+
+ static const struct rockchip_cpuclk_reg_data rk3288_cpuclk_data = {
+diff --git a/drivers/clk/samsung/clk-exynos-audss.c b/drivers/clk/samsung/clk-exynos-audss.c
+index 13eae14c2cc2..b50469faf70c 100644
+--- a/drivers/clk/samsung/clk-exynos-audss.c
++++ b/drivers/clk/samsung/clk-exynos-audss.c
+@@ -210,6 +210,10 @@ static int exynos_audss_clk_remove(struct platform_device *pdev)
+ {
+ int i;
+
++#ifdef CONFIG_PM_SLEEP
++ unregister_syscore_ops(&exynos_audss_clk_syscore_ops);
++#endif
++
+ of_clk_del_provider(pdev->dev.of_node);
+
+ for (i = 0; i < clk_data.clk_num; i++) {
+diff --git a/drivers/gpio/gpio-crystalcove.c b/drivers/gpio/gpio-crystalcove.c
+index bbfe7f508502..a7cf0c193ba8 100644
+--- a/drivers/gpio/gpio-crystalcove.c
++++ b/drivers/gpio/gpio-crystalcove.c
+@@ -272,7 +272,7 @@ static irqreturn_t crystalcove_gpio_irq_handler(int irq, void *data)
+ for (gpio = 0; gpio < CRYSTALCOVE_GPIO_NUM; gpio++) {
+ if (pending & BIT(gpio)) {
+ virq = irq_find_mapping(cg->chip.irqdomain, gpio);
+- generic_handle_irq(virq);
++ handle_nested_irq(virq);
+ }
+ }
+
+diff --git a/drivers/gpio/gpiolib-of.c b/drivers/gpio/gpiolib-of.c
+index 604dbe60bdee..08261f2b3a82 100644
+--- a/drivers/gpio/gpiolib-of.c
++++ b/drivers/gpio/gpiolib-of.c
+@@ -45,8 +45,14 @@ static int of_gpiochip_find_and_xlate(struct gpio_chip *gc, void *data)
+ return false;
+
+ ret = gc->of_xlate(gc, &gg_data->gpiospec, gg_data->flags);
+- if (ret < 0)
+- return false;
++ if (ret < 0) {
++ /* We've found the gpio chip, but the translation failed.
++ * Return true to stop looking and return the translation
++ * error via out_gpio
++ */
++ gg_data->out_gpio = ERR_PTR(ret);
++ return true;
++ }
+
+ gg_data->out_gpio = gpiochip_get_desc(gc, ret);
+ return true;
+diff --git a/drivers/gpio/gpiolib-sysfs.c b/drivers/gpio/gpiolib-sysfs.c
+index 5f2150b619a7..0d21396f961d 100644
+--- a/drivers/gpio/gpiolib-sysfs.c
++++ b/drivers/gpio/gpiolib-sysfs.c
+@@ -128,7 +128,7 @@ static ssize_t gpio_value_store(struct device *dev,
+ return status;
+ }
+
+-static const DEVICE_ATTR(value, 0644,
++static DEVICE_ATTR(value, 0644,
+ gpio_value_show, gpio_value_store);
+
+ static irqreturn_t gpio_sysfs_irq(int irq, void *priv)
+@@ -353,18 +353,15 @@ static ssize_t gpio_active_low_store(struct device *dev,
+ return status ? : size;
+ }
+
+-static const DEVICE_ATTR(active_low, 0644,
++static DEVICE_ATTR(active_low, 0644,
+ gpio_active_low_show, gpio_active_low_store);
+
+-static const struct attribute *gpio_attrs[] = {
++static struct attribute *gpio_attrs[] = {
+ &dev_attr_value.attr,
+ &dev_attr_active_low.attr,
+ NULL,
+ };
+-
+-static const struct attribute_group gpio_attr_group = {
+- .attrs = (struct attribute **) gpio_attrs,
+-};
++ATTRIBUTE_GROUPS(gpio);
+
+ /*
+ * /sys/class/gpio/gpiochipN/
+@@ -400,16 +397,13 @@ static ssize_t chip_ngpio_show(struct device *dev,
+ }
+ static DEVICE_ATTR(ngpio, 0444, chip_ngpio_show, NULL);
+
+-static const struct attribute *gpiochip_attrs[] = {
++static struct attribute *gpiochip_attrs[] = {
+ &dev_attr_base.attr,
+ &dev_attr_label.attr,
+ &dev_attr_ngpio.attr,
+ NULL,
+ };
+-
+-static const struct attribute_group gpiochip_attr_group = {
+- .attrs = (struct attribute **) gpiochip_attrs,
+-};
++ATTRIBUTE_GROUPS(gpiochip);
+
+ /*
+ * /sys/class/gpio/export ... write-only
+@@ -564,18 +558,15 @@ int gpiod_export(struct gpio_desc *desc, bool direction_may_change)
+ if (desc->chip->names && desc->chip->names[offset])
+ ioname = desc->chip->names[offset];
+
+- dev = device_create(&gpio_class, desc->chip->dev, MKDEV(0, 0),
+- desc, ioname ? ioname : "gpio%u",
+- desc_to_gpio(desc));
++ dev = device_create_with_groups(&gpio_class, desc->chip->dev,
++ MKDEV(0, 0), desc, gpio_groups,
++ ioname ? ioname : "gpio%u",
++ desc_to_gpio(desc));
+ if (IS_ERR(dev)) {
+ status = PTR_ERR(dev);
+ goto fail_unlock;
+ }
+
+- status = sysfs_create_group(&dev->kobj, &gpio_attr_group);
+- if (status)
+- goto fail_unregister_device;
+-
+ if (direction_may_change) {
+ status = device_create_file(dev, &dev_attr_direction);
+ if (status)
+@@ -586,13 +577,15 @@ int gpiod_export(struct gpio_desc *desc, bool direction_may_change)
+ !test_bit(FLAG_IS_OUT, &desc->flags))) {
+ status = device_create_file(dev, &dev_attr_edge);
+ if (status)
+- goto fail_unregister_device;
++ goto fail_remove_attr_direction;
+ }
+
+ set_bit(FLAG_EXPORT, &desc->flags);
+ mutex_unlock(&sysfs_lock);
+ return 0;
+
++fail_remove_attr_direction:
++ device_remove_file(dev, &dev_attr_direction);
+ fail_unregister_device:
+ device_unregister(dev);
+ fail_unlock:
+@@ -726,6 +719,8 @@ void gpiod_unexport(struct gpio_desc *desc)
+ mutex_unlock(&sysfs_lock);
+
+ if (dev) {
++ device_remove_file(dev, &dev_attr_edge);
++ device_remove_file(dev, &dev_attr_direction);
+ device_unregister(dev);
+ put_device(dev);
+ }
+@@ -750,13 +745,13 @@ int gpiochip_export(struct gpio_chip *chip)
+
+ /* use chip->base for the ID; it's already known to be unique */
+ mutex_lock(&sysfs_lock);
+- dev = device_create(&gpio_class, chip->dev, MKDEV(0, 0), chip,
+- "gpiochip%d", chip->base);
+- if (!IS_ERR(dev)) {
+- status = sysfs_create_group(&dev->kobj,
+- &gpiochip_attr_group);
+- } else
++ dev = device_create_with_groups(&gpio_class, chip->dev, MKDEV(0, 0),
++ chip, gpiochip_groups,
++ "gpiochip%d", chip->base);
++ if (IS_ERR(dev))
+ status = PTR_ERR(dev);
++ else
++ status = 0;
+ chip->exported = (status == 0);
+ mutex_unlock(&sysfs_lock);
+
+diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
+index e8e98ca25ec7..c81bda0ec2cf 100644
+--- a/drivers/gpio/gpiolib.c
++++ b/drivers/gpio/gpiolib.c
+@@ -268,6 +268,9 @@ int gpiochip_add(struct gpio_chip *chip)
+
+ spin_unlock_irqrestore(&gpio_lock, flags);
+
++ if (status)
++ goto fail;
++
+ #ifdef CONFIG_PINCTRL
+ INIT_LIST_HEAD(&chip->pin_ranges);
+ #endif
+@@ -275,12 +278,12 @@ int gpiochip_add(struct gpio_chip *chip)
+ of_gpiochip_add(chip);
+ acpi_gpiochip_add(chip);
+
+- if (status)
+- goto fail;
+-
+ status = gpiochip_export(chip);
+- if (status)
++ if (status) {
++ acpi_gpiochip_remove(chip);
++ of_gpiochip_remove(chip);
+ goto fail;
++ }
+
+ pr_debug("%s: registered GPIOs %d to %d on device: %s\n", __func__,
+ chip->base, chip->base + chip->ngpio - 1,
+@@ -313,14 +316,13 @@ void gpiochip_remove(struct gpio_chip *chip)
+ unsigned long flags;
+ unsigned id;
+
+- acpi_gpiochip_remove(chip);
+-
+- spin_lock_irqsave(&gpio_lock, flags);
+-
+ gpiochip_irqchip_remove(chip);
++
++ acpi_gpiochip_remove(chip);
+ gpiochip_remove_pin_ranges(chip);
+ of_gpiochip_remove(chip);
+
++ spin_lock_irqsave(&gpio_lock, flags);
+ for (id = 0; id < chip->ngpio; id++) {
+ if (test_bit(FLAG_REQUESTED, &chip->desc[id].flags))
+ dev_crit(chip->dev, "REMOVING GPIOCHIP WITH GPIOS STILL REQUESTED\n");
+diff --git a/drivers/gpu/drm/drm_dp_helper.c b/drivers/gpu/drm/drm_dp_helper.c
+index 08e33b8b13a4..9f59c9027ebe 100644
+--- a/drivers/gpu/drm/drm_dp_helper.c
++++ b/drivers/gpu/drm/drm_dp_helper.c
+@@ -378,10 +378,11 @@ static int drm_dp_dpcd_access(struct drm_dp_aux *aux, u8 request,
+
+ /*
+ * The specification doesn't give any recommendation on how often to
+- * retry native transactions, so retry 7 times like for I2C-over-AUX
+- * transactions.
++ * retry native transactions. We used to retry 7 times like for
++ * aux i2c transactions but real world devices this wasn't
++ * sufficient, bump to 32 which makes Dell 4k monitors happier.
+ */
+- for (retry = 0; retry < 7; retry++) {
++ for (retry = 0; retry < 32; retry++) {
+
+ mutex_lock(&aux->hw_mutex);
+ err = aux->transfer(aux, &msg);
+diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c
+index 070f913d2dba..f50d884b81cf 100644
+--- a/drivers/gpu/drm/drm_dp_mst_topology.c
++++ b/drivers/gpu/drm/drm_dp_mst_topology.c
+@@ -839,6 +839,8 @@ static void drm_dp_put_mst_branch_device(struct drm_dp_mst_branch *mstb)
+
+ static void drm_dp_port_teardown_pdt(struct drm_dp_mst_port *port, int old_pdt)
+ {
++ struct drm_dp_mst_branch *mstb;
++
+ switch (old_pdt) {
+ case DP_PEER_DEVICE_DP_LEGACY_CONV:
+ case DP_PEER_DEVICE_SST_SINK:
+@@ -846,8 +848,9 @@ static void drm_dp_port_teardown_pdt(struct drm_dp_mst_port *port, int old_pdt)
+ drm_dp_mst_unregister_i2c_bus(&port->aux);
+ break;
+ case DP_PEER_DEVICE_MST_BRANCHING:
+- drm_dp_put_mst_branch_device(port->mstb);
++ mstb = port->mstb;
+ port->mstb = NULL;
++ drm_dp_put_mst_branch_device(mstb);
+ break;
+ }
+ }
+diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c
+index 0c0c39bac23d..ef757f712a3d 100644
+--- a/drivers/gpu/drm/drm_fb_helper.c
++++ b/drivers/gpu/drm/drm_fb_helper.c
+@@ -347,9 +347,18 @@ bool drm_fb_helper_restore_fbdev_mode_unlocked(struct drm_fb_helper *fb_helper)
+ {
+ struct drm_device *dev = fb_helper->dev;
+ bool ret;
++ bool do_delayed = false;
++
+ drm_modeset_lock_all(dev);
+ ret = restore_fbdev_mode(fb_helper);
++
++ do_delayed = fb_helper->delayed_hotplug;
++ if (do_delayed)
++ fb_helper->delayed_hotplug = false;
+ drm_modeset_unlock_all(dev);
++
++ if (do_delayed)
++ drm_fb_helper_hotplug_event(fb_helper);
+ return ret;
+ }
+ EXPORT_SYMBOL(drm_fb_helper_restore_fbdev_mode_unlocked);
+@@ -888,10 +897,6 @@ int drm_fb_helper_set_par(struct fb_info *info)
+
+ drm_fb_helper_restore_fbdev_mode_unlocked(fb_helper);
+
+- if (fb_helper->delayed_hotplug) {
+- fb_helper->delayed_hotplug = false;
+- drm_fb_helper_hotplug_event(fb_helper);
+- }
+ return 0;
+ }
+ EXPORT_SYMBOL(drm_fb_helper_set_par);
+diff --git a/drivers/gpu/drm/drm_irq.c b/drivers/gpu/drm/drm_irq.c
+index 5ef03c216a27..c4edea907f8f 100644
+--- a/drivers/gpu/drm/drm_irq.c
++++ b/drivers/gpu/drm/drm_irq.c
+@@ -1029,7 +1029,8 @@ void drm_vblank_put(struct drm_device *dev, int crtc)
+ {
+ struct drm_vblank_crtc *vblank = &dev->vblank[crtc];
+
+- BUG_ON(atomic_read(&vblank->refcount) == 0);
++ if (WARN_ON(atomic_read(&vblank->refcount) == 0))
++ return;
+
+ if (WARN_ON(crtc >= dev->num_crtcs))
+ return;
+diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
+index 2318b4c7a8f8..925697320949 100644
+--- a/drivers/gpu/drm/i915/i915_drv.c
++++ b/drivers/gpu/drm/i915/i915_drv.c
+@@ -692,11 +692,12 @@ static int __i915_drm_thaw(struct drm_device *dev, bool restore_gtt_mappings)
+ spin_unlock_irqrestore(&dev_priv->irq_lock, irqflags);
+ }
+
+- intel_dp_mst_resume(dev);
+ drm_modeset_lock_all(dev);
+ intel_modeset_setup_hw_state(dev, true);
+ drm_modeset_unlock_all(dev);
+
++ intel_dp_mst_resume(dev);
++
+ /*
+ * ... but also need to make sure that hotplug processing
+ * doesn't cause havoc. Like in the driver load code we don't
+diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
+index 16a6f6d187a1..346aee828dc3 100644
+--- a/drivers/gpu/drm/i915/i915_drv.h
++++ b/drivers/gpu/drm/i915/i915_drv.h
+@@ -877,6 +877,7 @@ struct i915_suspend_saved_registers {
+ u32 savePIPEB_LINK_N1;
+ u32 saveMCHBAR_RENDER_STANDBY;
+ u32 savePCH_PORT_HOTPLUG;
++ u16 saveGCDGMBUS;
+ };
+
+ struct vlv_s0ix_state {
+@@ -1665,8 +1666,6 @@ struct drm_i915_private {
+ */
+ struct workqueue_struct *dp_wq;
+
+- uint32_t bios_vgacntr;
+-
+ /* Old dri1 support infrastructure, beware the dragons ya fools entering
+ * here! */
+ struct i915_dri1_state dri1;
+diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
+index 28f91df2604d..2de5f5f4ba45 100644
+--- a/drivers/gpu/drm/i915/i915_gem.c
++++ b/drivers/gpu/drm/i915/i915_gem.c
+@@ -4193,7 +4193,7 @@ i915_gem_pin_ioctl(struct drm_device *dev, void *data,
+ struct drm_i915_gem_object *obj;
+ int ret;
+
+- if (INTEL_INFO(dev)->gen >= 6)
++ if (drm_core_check_feature(dev, DRIVER_MODESET))
+ return -ENODEV;
+
+ ret = i915_mutex_lock_interruptible(dev);
+@@ -4249,6 +4249,9 @@ i915_gem_unpin_ioctl(struct drm_device *dev, void *data,
+ struct drm_i915_gem_object *obj;
+ int ret;
+
++ if (drm_core_check_feature(dev, DRIVER_MODESET))
++ return -ENODEV;
++
+ ret = i915_mutex_lock_interruptible(dev);
+ if (ret)
+ return ret;
+diff --git a/drivers/gpu/drm/i915/i915_gem_context.c b/drivers/gpu/drm/i915/i915_gem_context.c
+index a5221d8f1580..c12f087d7a14 100644
+--- a/drivers/gpu/drm/i915/i915_gem_context.c
++++ b/drivers/gpu/drm/i915/i915_gem_context.c
+@@ -468,7 +468,12 @@ mi_set_context(struct intel_engine_cs *ring,
+ u32 hw_flags)
+ {
+ u32 flags = hw_flags | MI_MM_SPACE_GTT;
+- int ret;
++ const int num_rings =
++ /* Use an extended w/a on ivb+ if signalling from other rings */
++ i915_semaphore_is_enabled(ring->dev) ?
++ hweight32(INTEL_INFO(ring->dev)->ring_mask) - 1 :
++ 0;
++ int len, i, ret;
+
+ /* w/a: If Flush TLB Invalidation Mode is enabled, driver must do a TLB
+ * invalidation prior to MI_SET_CONTEXT. On GEN6 we don't set the value
+@@ -485,15 +490,31 @@ mi_set_context(struct intel_engine_cs *ring,
+ if (!IS_HASWELL(ring->dev) && INTEL_INFO(ring->dev)->gen < 8)
+ flags |= (MI_SAVE_EXT_STATE_EN | MI_RESTORE_EXT_STATE_EN);
+
+- ret = intel_ring_begin(ring, 6);
++
++ len = 4;
++ if (INTEL_INFO(ring->dev)->gen >= 7)
++ len += 2 + (num_rings ? 4*num_rings + 2 : 0);
++
++ ret = intel_ring_begin(ring, len);
+ if (ret)
+ return ret;
+
+ /* WaProgramMiArbOnOffAroundMiSetContext:ivb,vlv,hsw,bdw,chv */
+- if (INTEL_INFO(ring->dev)->gen >= 7)
++ if (INTEL_INFO(ring->dev)->gen >= 7) {
+ intel_ring_emit(ring, MI_ARB_ON_OFF | MI_ARB_DISABLE);
+- else
+- intel_ring_emit(ring, MI_NOOP);
++ if (num_rings) {
++ struct intel_engine_cs *signaller;
++
++ intel_ring_emit(ring, MI_LOAD_REGISTER_IMM(num_rings));
++ for_each_ring(signaller, to_i915(ring->dev), i) {
++ if (signaller == ring)
++ continue;
++
++ intel_ring_emit(ring, RING_PSMI_CTL(signaller->mmio_base));
++ intel_ring_emit(ring, _MASKED_BIT_ENABLE(GEN6_PSMI_SLEEP_MSG_DISABLE));
++ }
++ }
++ }
+
+ intel_ring_emit(ring, MI_NOOP);
+ intel_ring_emit(ring, MI_SET_CONTEXT);
+@@ -505,10 +526,21 @@ mi_set_context(struct intel_engine_cs *ring,
+ */
+ intel_ring_emit(ring, MI_NOOP);
+
+- if (INTEL_INFO(ring->dev)->gen >= 7)
++ if (INTEL_INFO(ring->dev)->gen >= 7) {
++ if (num_rings) {
++ struct intel_engine_cs *signaller;
++
++ intel_ring_emit(ring, MI_LOAD_REGISTER_IMM(num_rings));
++ for_each_ring(signaller, to_i915(ring->dev), i) {
++ if (signaller == ring)
++ continue;
++
++ intel_ring_emit(ring, RING_PSMI_CTL(signaller->mmio_base));
++ intel_ring_emit(ring, _MASKED_BIT_DISABLE(GEN6_PSMI_SLEEP_MSG_DISABLE));
++ }
++ }
+ intel_ring_emit(ring, MI_ARB_ON_OFF | MI_ARB_ENABLE);
+- else
+- intel_ring_emit(ring, MI_NOOP);
++ }
+
+ intel_ring_advance(ring);
+
+diff --git a/drivers/gpu/drm/i915/i915_gem_stolen.c b/drivers/gpu/drm/i915/i915_gem_stolen.c
+index 85fda6b803e4..0ee76b25204c 100644
+--- a/drivers/gpu/drm/i915/i915_gem_stolen.c
++++ b/drivers/gpu/drm/i915/i915_gem_stolen.c
+@@ -137,7 +137,11 @@ static unsigned long i915_stolen_to_physical(struct drm_device *dev)
+ r = devm_request_mem_region(dev->dev, base + 1,
+ dev_priv->gtt.stolen_size - 1,
+ "Graphics Stolen Memory");
+- if (r == NULL) {
++ /*
++ * GEN3 firmware likes to smash pci bridges into the stolen
++ * range. Apparently this works.
++ */
++ if (r == NULL && !IS_GEN3(dev)) {
+ DRM_ERROR("conflict detected with stolen region: [0x%08x - 0x%08x]\n",
+ base, base + (uint32_t)dev_priv->gtt.stolen_size);
+ base = 0;
+diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
+index f66392b6e287..9ba1177200b2 100644
+--- a/drivers/gpu/drm/i915/i915_irq.c
++++ b/drivers/gpu/drm/i915/i915_irq.c
+@@ -4022,8 +4022,6 @@ static bool i8xx_handle_vblank(struct drm_device *dev,
+ if ((iir & flip_pending) == 0)
+ goto check_page_flip;
+
+- intel_prepare_page_flip(dev, plane);
+-
+ /* We detect FlipDone by looking for the change in PendingFlip from '1'
+ * to '0' on the following vblank, i.e. IIR has the Pendingflip
+ * asserted following the MI_DISPLAY_FLIP, but ISR is deasserted, hence
+@@ -4033,6 +4031,7 @@ static bool i8xx_handle_vblank(struct drm_device *dev,
+ if (I915_READ16(ISR) & flip_pending)
+ goto check_page_flip;
+
++ intel_prepare_page_flip(dev, plane);
+ intel_finish_page_flip(dev, pipe);
+ return true;
+
+@@ -4210,8 +4209,6 @@ static bool i915_handle_vblank(struct drm_device *dev,
+ if ((iir & flip_pending) == 0)
+ goto check_page_flip;
+
+- intel_prepare_page_flip(dev, plane);
+-
+ /* We detect FlipDone by looking for the change in PendingFlip from '1'
+ * to '0' on the following vblank, i.e. IIR has the Pendingflip
+ * asserted following the MI_DISPLAY_FLIP, but ISR is deasserted, hence
+@@ -4221,6 +4218,7 @@ static bool i915_handle_vblank(struct drm_device *dev,
+ if (I915_READ(ISR) & flip_pending)
+ goto check_page_flip;
+
++ intel_prepare_page_flip(dev, plane);
+ intel_finish_page_flip(dev, pipe);
+ return true;
+
+diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
+index c01e5f31430e..3f1e54bfcddb 100644
+--- a/drivers/gpu/drm/i915/i915_reg.h
++++ b/drivers/gpu/drm/i915/i915_reg.h
+@@ -74,6 +74,7 @@
+ #define I915_GC_RENDER_CLOCK_166_MHZ (0 << 0)
+ #define I915_GC_RENDER_CLOCK_200_MHZ (1 << 0)
+ #define I915_GC_RENDER_CLOCK_333_MHZ (4 << 0)
++#define GCDGMBUS 0xcc
+ #define PCI_LBPC 0xf4 /* legacy/combination backlight modes, also called LBB */
+
+
+@@ -370,6 +371,7 @@
+ #define PIPE_CONTROL_STORE_DATA_INDEX (1<<21)
+ #define PIPE_CONTROL_CS_STALL (1<<20)
+ #define PIPE_CONTROL_TLB_INVALIDATE (1<<18)
++#define PIPE_CONTROL_MEDIA_STATE_CLEAR (1<<16)
+ #define PIPE_CONTROL_QW_WRITE (1<<14)
+ #define PIPE_CONTROL_POST_SYNC_OP_MASK (3<<14)
+ #define PIPE_CONTROL_DEPTH_STALL (1<<13)
+@@ -1071,6 +1073,7 @@ enum punit_power_well {
+ #define GEN6_VERSYNC (RING_SYNC_1(VEBOX_RING_BASE))
+ #define GEN6_VEVSYNC (RING_SYNC_2(VEBOX_RING_BASE))
+ #define GEN6_NOSYNC 0
++#define RING_PSMI_CTL(base) ((base)+0x50)
+ #define RING_MAX_IDLE(base) ((base)+0x54)
+ #define RING_HWS_PGA(base) ((base)+0x80)
+ #define RING_HWS_PGA_GEN6(base) ((base)+0x2080)
+@@ -1401,6 +1404,7 @@ enum punit_power_well {
+ #define GEN6_BLITTER_FBC_NOTIFY (1<<3)
+
+ #define GEN6_RC_SLEEP_PSMI_CONTROL 0x2050
++#define GEN6_PSMI_SLEEP_MSG_DISABLE (1 << 0)
+ #define GEN8_RC_SEMA_IDLE_MSG_DISABLE (1 << 12)
+ #define GEN8_FF_DOP_CLOCK_GATE_DISABLE (1<<10)
+
+diff --git a/drivers/gpu/drm/i915/i915_suspend.c b/drivers/gpu/drm/i915/i915_suspend.c
+index 043123c77a1f..e22b0e825de2 100644
+--- a/drivers/gpu/drm/i915/i915_suspend.c
++++ b/drivers/gpu/drm/i915/i915_suspend.c
+@@ -328,6 +328,10 @@ int i915_save_state(struct drm_device *dev)
+ }
+ }
+
++ if (IS_GEN4(dev))
++ pci_read_config_word(dev->pdev, GCDGMBUS,
++ &dev_priv->regfile.saveGCDGMBUS);
++
+ /* Cache mode state */
+ if (INTEL_INFO(dev)->gen < 7)
+ dev_priv->regfile.saveCACHE_MODE_0 = I915_READ(CACHE_MODE_0);
+@@ -356,6 +360,10 @@ int i915_restore_state(struct drm_device *dev)
+ mutex_lock(&dev->struct_mutex);
+
+ i915_gem_restore_fences(dev);
++
++ if (IS_GEN4(dev))
++ pci_write_config_word(dev->pdev, GCDGMBUS,
++ dev_priv->regfile.saveGCDGMBUS);
+ i915_restore_display(dev);
+
+ if (!drm_core_check_feature(dev, DRIVER_MODESET)) {
+diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
+index 9cb5c95d5898..cadc3bcf1de2 100644
+--- a/drivers/gpu/drm/i915/intel_display.c
++++ b/drivers/gpu/drm/i915/intel_display.c
+@@ -12933,11 +12933,7 @@ static void i915_disable_vga(struct drm_device *dev)
+ vga_put(dev->pdev, VGA_RSRC_LEGACY_IO);
+ udelay(300);
+
+- /*
+- * Fujitsu-Siemens Lifebook S6010 (830) has problems resuming
+- * from S3 without preserving (some of?) the other bits.
+- */
+- I915_WRITE(vga_reg, dev_priv->bios_vgacntr | VGA_DISP_DISABLE);
++ I915_WRITE(vga_reg, VGA_DISP_DISABLE);
+ POSTING_READ(vga_reg);
+ }
+
+@@ -13026,8 +13022,6 @@ void intel_modeset_init(struct drm_device *dev)
+
+ intel_shared_dpll_init(dev);
+
+- /* save the BIOS value before clobbering it */
+- dev_priv->bios_vgacntr = I915_READ(i915_vgacntrl_reg(dev));
+ /* Just disable it once at startup */
+ i915_disable_vga(dev);
+ intel_setup_outputs(dev);
+diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
+index ad2fd605f76b..83c7ecf2608a 100644
+--- a/drivers/gpu/drm/i915/intel_pm.c
++++ b/drivers/gpu/drm/i915/intel_pm.c
+@@ -6520,29 +6520,6 @@ static void chv_pipe_power_well_disable(struct drm_i915_private *dev_priv,
+ chv_set_pipe_power_well(dev_priv, power_well, false);
+ }
+
+-static void check_power_well_state(struct drm_i915_private *dev_priv,
+- struct i915_power_well *power_well)
+-{
+- bool enabled = power_well->ops->is_enabled(dev_priv, power_well);
+-
+- if (power_well->always_on || !i915.disable_power_well) {
+- if (!enabled)
+- goto mismatch;
+-
+- return;
+- }
+-
+- if (enabled != (power_well->count > 0))
+- goto mismatch;
+-
+- return;
+-
+-mismatch:
+- WARN(1, "state mismatch for '%s' (always_on %d hw state %d use-count %d disable_power_well %d\n",
+- power_well->name, power_well->always_on, enabled,
+- power_well->count, i915.disable_power_well);
+-}
+-
+ void intel_display_power_get(struct drm_i915_private *dev_priv,
+ enum intel_display_power_domain domain)
+ {
+@@ -6562,8 +6539,6 @@ void intel_display_power_get(struct drm_i915_private *dev_priv,
+ power_well->ops->enable(dev_priv, power_well);
+ power_well->hw_enabled = true;
+ }
+-
+- check_power_well_state(dev_priv, power_well);
+ }
+
+ power_domains->domain_use_count[domain]++;
+@@ -6593,8 +6568,6 @@ void intel_display_power_put(struct drm_i915_private *dev_priv,
+ power_well->hw_enabled = false;
+ power_well->ops->disable(dev_priv, power_well);
+ }
+-
+- check_power_well_state(dev_priv, power_well);
+ }
+
+ mutex_unlock(&power_domains->lock);
+diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.c b/drivers/gpu/drm/i915/intel_ringbuffer.c
+index 0a80e419b589..ae17e77dc08d 100644
+--- a/drivers/gpu/drm/i915/intel_ringbuffer.c
++++ b/drivers/gpu/drm/i915/intel_ringbuffer.c
+@@ -362,12 +362,15 @@ gen7_render_ring_flush(struct intel_engine_cs *ring,
+ flags |= PIPE_CONTROL_VF_CACHE_INVALIDATE;
+ flags |= PIPE_CONTROL_CONST_CACHE_INVALIDATE;
+ flags |= PIPE_CONTROL_STATE_CACHE_INVALIDATE;
++ flags |= PIPE_CONTROL_MEDIA_STATE_CLEAR;
+ /*
+ * TLB invalidate requires a post-sync write.
+ */
+ flags |= PIPE_CONTROL_QW_WRITE;
+ flags |= PIPE_CONTROL_GLOBAL_GTT_IVB;
+
++ flags |= PIPE_CONTROL_STALL_AT_SCOREBOARD;
++
+ /* Workaround: we must issue a pipe_control with CS-stall bit
+ * set before a pipe_control command that has the state cache
+ * invalidate bit set. */
+diff --git a/drivers/gpu/drm/i915/intel_uncore.c b/drivers/gpu/drm/i915/intel_uncore.c
+index 918b76163965..b29091b21a76 100644
+--- a/drivers/gpu/drm/i915/intel_uncore.c
++++ b/drivers/gpu/drm/i915/intel_uncore.c
+@@ -43,8 +43,8 @@
+ static void
+ assert_device_not_suspended(struct drm_i915_private *dev_priv)
+ {
+- WARN(HAS_RUNTIME_PM(dev_priv->dev) && dev_priv->pm.suspended,
+- "Device suspended\n");
++ WARN_ONCE(HAS_RUNTIME_PM(dev_priv->dev) && dev_priv->pm.suspended,
++ "Device suspended\n");
+ }
+
+ static void __gen6_gt_wait_for_thread_c0(struct drm_i915_private *dev_priv)
+diff --git a/drivers/gpu/drm/nouveau/core/subdev/mc/nv4c.c b/drivers/gpu/drm/nouveau/core/subdev/mc/nv4c.c
+index a75c35ccf25c..165401c4045c 100644
+--- a/drivers/gpu/drm/nouveau/core/subdev/mc/nv4c.c
++++ b/drivers/gpu/drm/nouveau/core/subdev/mc/nv4c.c
+@@ -24,13 +24,6 @@
+
+ #include "nv04.h"
+
+-static void
+-nv4c_mc_msi_rearm(struct nouveau_mc *pmc)
+-{
+- struct nv04_mc_priv *priv = (void *)pmc;
+- nv_wr08(priv, 0x088050, 0xff);
+-}
+-
+ struct nouveau_oclass *
+ nv4c_mc_oclass = &(struct nouveau_mc_oclass) {
+ .base.handle = NV_SUBDEV(MC, 0x4c),
+@@ -41,5 +34,4 @@ nv4c_mc_oclass = &(struct nouveau_mc_oclass) {
+ .fini = _nouveau_mc_fini,
+ },
+ .intr = nv04_mc_intr,
+- .msi_rearm = nv4c_mc_msi_rearm,
+ }.base;
+diff --git a/drivers/gpu/drm/radeon/atombios_crtc.c b/drivers/gpu/drm/radeon/atombios_crtc.c
+index 30d242b25078..dce0d3918fa7 100644
+--- a/drivers/gpu/drm/radeon/atombios_crtc.c
++++ b/drivers/gpu/drm/radeon/atombios_crtc.c
+@@ -1851,10 +1851,9 @@ static int radeon_atom_pick_pll(struct drm_crtc *crtc)
+ return pll;
+ }
+ /* otherwise, pick one of the plls */
+- if ((rdev->family == CHIP_KAVERI) ||
+- (rdev->family == CHIP_KABINI) ||
++ if ((rdev->family == CHIP_KABINI) ||
+ (rdev->family == CHIP_MULLINS)) {
+- /* KB/KV/ML has PPLL1 and PPLL2 */
++ /* KB/ML has PPLL1 and PPLL2 */
+ pll_in_use = radeon_get_pll_use_mask(crtc);
+ if (!(pll_in_use & (1 << ATOM_PPLL2)))
+ return ATOM_PPLL2;
+@@ -1863,7 +1862,7 @@ static int radeon_atom_pick_pll(struct drm_crtc *crtc)
+ DRM_ERROR("unable to allocate a PPLL\n");
+ return ATOM_PPLL_INVALID;
+ } else {
+- /* CI has PPLL0, PPLL1, and PPLL2 */
++ /* CI/KV has PPLL0, PPLL1, and PPLL2 */
+ pll_in_use = radeon_get_pll_use_mask(crtc);
+ if (!(pll_in_use & (1 << ATOM_PPLL2)))
+ return ATOM_PPLL2;
+@@ -2154,6 +2153,7 @@ static void atombios_crtc_disable(struct drm_crtc *crtc)
+ case ATOM_PPLL0:
+ /* disable the ppll */
+ if ((rdev->family == CHIP_ARUBA) ||
++ (rdev->family == CHIP_KAVERI) ||
+ (rdev->family == CHIP_BONAIRE) ||
+ (rdev->family == CHIP_HAWAII))
+ atombios_crtc_program_pll(crtc, radeon_crtc->crtc_id, radeon_crtc->pll_id,
+diff --git a/drivers/gpu/drm/radeon/atombios_dp.c b/drivers/gpu/drm/radeon/atombios_dp.c
+index 11ba9d21b89b..db42a670f995 100644
+--- a/drivers/gpu/drm/radeon/atombios_dp.c
++++ b/drivers/gpu/drm/radeon/atombios_dp.c
+@@ -492,6 +492,10 @@ int radeon_dp_mode_valid_helper(struct drm_connector *connector,
+ struct radeon_connector_atom_dig *dig_connector;
+ int dp_clock;
+
++ if ((mode->clock > 340000) &&
++ (!radeon_connector_is_dp12_capable(connector)))
++ return MODE_CLOCK_HIGH;
++
+ if (!radeon_connector->con_priv)
+ return MODE_CLOCK_HIGH;
+ dig_connector = radeon_connector->con_priv;
+diff --git a/drivers/gpu/drm/radeon/ci_dpm.c b/drivers/gpu/drm/radeon/ci_dpm.c
+index 11a55e9dad7f..c5699b593665 100644
+--- a/drivers/gpu/drm/radeon/ci_dpm.c
++++ b/drivers/gpu/drm/radeon/ci_dpm.c
+@@ -4729,7 +4729,7 @@ void ci_dpm_disable(struct radeon_device *rdev)
+ ci_enable_spread_spectrum(rdev, false);
+ ci_enable_auto_throttle_source(rdev, RADEON_DPM_AUTO_THROTTLE_SRC_THERMAL, false);
+ ci_stop_dpm(rdev);
+- ci_enable_ds_master_switch(rdev, true);
++ ci_enable_ds_master_switch(rdev, false);
+ ci_enable_ulv(rdev, false);
+ ci_clear_vc(rdev);
+ ci_reset_to_default(rdev);
+diff --git a/drivers/gpu/drm/radeon/cik.c b/drivers/gpu/drm/radeon/cik.c
+index 89c01fa6dd8e..9328fb3dcfce 100644
+--- a/drivers/gpu/drm/radeon/cik.c
++++ b/drivers/gpu/drm/radeon/cik.c
+@@ -6314,6 +6314,7 @@ static void cik_enable_mgcg(struct radeon_device *rdev, bool enable)
+ }
+
+ orig = data = RREG32(RLC_CGTT_MGCG_OVERRIDE);
++ data |= 0x00000001;
+ data &= 0xfffffffd;
+ if (orig != data)
+ WREG32(RLC_CGTT_MGCG_OVERRIDE, data);
+@@ -6345,7 +6346,7 @@ static void cik_enable_mgcg(struct radeon_device *rdev, bool enable)
+ }
+ } else {
+ orig = data = RREG32(RLC_CGTT_MGCG_OVERRIDE);
+- data |= 0x00000002;
++ data |= 0x00000003;
+ if (orig != data)
+ WREG32(RLC_CGTT_MGCG_OVERRIDE, data);
+
+diff --git a/drivers/gpu/drm/radeon/dce3_1_afmt.c b/drivers/gpu/drm/radeon/dce3_1_afmt.c
+index 2fe8cfc966d9..bafdf92a5732 100644
+--- a/drivers/gpu/drm/radeon/dce3_1_afmt.c
++++ b/drivers/gpu/drm/radeon/dce3_1_afmt.c
+@@ -103,7 +103,7 @@ static void dce3_2_afmt_write_sad_regs(struct drm_encoder *encoder)
+ }
+
+ sad_count = drm_edid_to_sad(radeon_connector->edid, &sads);
+- if (sad_count < 0) {
++ if (sad_count <= 0) {
+ DRM_ERROR("Couldn't read SADs: %d\n", sad_count);
+ return;
+ }
+diff --git a/drivers/gpu/drm/radeon/kv_dpm.c b/drivers/gpu/drm/radeon/kv_dpm.c
+index 9b42001295ba..e3e9c10cfba9 100644
+--- a/drivers/gpu/drm/radeon/kv_dpm.c
++++ b/drivers/gpu/drm/radeon/kv_dpm.c
+@@ -2745,13 +2745,11 @@ int kv_dpm_init(struct radeon_device *rdev)
+ pi->enable_auto_thermal_throttling = true;
+ pi->disable_nb_ps3_in_battery = false;
+ if (radeon_bapm == -1) {
+- /* There are stability issues reported on with
+- * bapm enabled on an asrock system.
+- */
+- if (rdev->pdev->subsystem_vendor == 0x1849)
+- pi->bapm_enable = false;
+- else
++ /* only enable bapm on KB, ML by default */
++ if (rdev->family == CHIP_KABINI || rdev->family == CHIP_MULLINS)
+ pi->bapm_enable = true;
++ else
++ pi->bapm_enable = false;
+ } else if (radeon_bapm == 0) {
+ pi->bapm_enable = false;
+ } else {
+diff --git a/drivers/gpu/drm/radeon/radeon_ttm.c b/drivers/gpu/drm/radeon/radeon_ttm.c
+index 8624979afb65..d2510cfd3fea 100644
+--- a/drivers/gpu/drm/radeon/radeon_ttm.c
++++ b/drivers/gpu/drm/radeon/radeon_ttm.c
+@@ -196,7 +196,7 @@ static void radeon_evict_flags(struct ttm_buffer_object *bo,
+ rbo = container_of(bo, struct radeon_bo, tbo);
+ switch (bo->mem.mem_type) {
+ case TTM_PL_VRAM:
+- if (rbo->rdev->ring[RADEON_RING_TYPE_GFX_INDEX].ready == false)
++ if (rbo->rdev->ring[radeon_copy_ring_index(rbo->rdev)].ready == false)
+ radeon_ttm_placement_from_domain(rbo, RADEON_GEM_DOMAIN_CPU);
+ else
+ radeon_ttm_placement_from_domain(rbo, RADEON_GEM_DOMAIN_GTT);
+diff --git a/drivers/gpu/drm/ttm/ttm_page_alloc.c b/drivers/gpu/drm/ttm/ttm_page_alloc.c
+index 09874d695188..025c429050c0 100644
+--- a/drivers/gpu/drm/ttm/ttm_page_alloc.c
++++ b/drivers/gpu/drm/ttm/ttm_page_alloc.c
+@@ -297,11 +297,12 @@ static void ttm_pool_update_free_locked(struct ttm_page_pool *pool,
+ *
+ * @pool: to free the pages from
+ * @free_all: If set to true will free all pages in pool
+- * @gfp: GFP flags.
++ * @use_static: Safe to use static buffer
+ **/
+ static int ttm_page_pool_free(struct ttm_page_pool *pool, unsigned nr_free,
+- gfp_t gfp)
++ bool use_static)
+ {
++ static struct page *static_buf[NUM_PAGES_TO_ALLOC];
+ unsigned long irq_flags;
+ struct page *p;
+ struct page **pages_to_free;
+@@ -311,7 +312,11 @@ static int ttm_page_pool_free(struct ttm_page_pool *pool, unsigned nr_free,
+ if (NUM_PAGES_TO_ALLOC < nr_free)
+ npages_to_free = NUM_PAGES_TO_ALLOC;
+
+- pages_to_free = kmalloc(npages_to_free * sizeof(struct page *), gfp);
++ if (use_static)
++ pages_to_free = static_buf;
++ else
++ pages_to_free = kmalloc(npages_to_free * sizeof(struct page *),
++ GFP_KERNEL);
+ if (!pages_to_free) {
+ pr_err("Failed to allocate memory for pool free operation\n");
+ return 0;
+@@ -374,7 +379,8 @@ restart:
+ if (freed_pages)
+ ttm_pages_put(pages_to_free, freed_pages);
+ out:
+- kfree(pages_to_free);
++ if (pages_to_free != static_buf)
++ kfree(pages_to_free);
+ return nr_free;
+ }
+
+@@ -383,8 +389,6 @@ out:
+ *
+ * XXX: (dchinner) Deadlock warning!
+ *
+- * We need to pass sc->gfp_mask to ttm_page_pool_free().
+- *
+ * This code is crying out for a shrinker per pool....
+ */
+ static unsigned long
+@@ -407,8 +411,8 @@ ttm_pool_shrink_scan(struct shrinker *shrink, struct shrink_control *sc)
+ if (shrink_pages == 0)
+ break;
+ pool = &_manager->pools[(i + pool_offset)%NUM_POOLS];
+- shrink_pages = ttm_page_pool_free(pool, nr_free,
+- sc->gfp_mask);
++ /* OK to use static buffer since global mutex is held. */
++ shrink_pages = ttm_page_pool_free(pool, nr_free, true);
+ freed += nr_free - shrink_pages;
+ }
+ mutex_unlock(&lock);
+@@ -710,7 +714,7 @@ static void ttm_put_pages(struct page **pages, unsigned npages, int flags,
+ }
+ spin_unlock_irqrestore(&pool->lock, irq_flags);
+ if (npages)
+- ttm_page_pool_free(pool, npages, GFP_KERNEL);
++ ttm_page_pool_free(pool, npages, false);
+ }
+
+ /*
+@@ -849,9 +853,9 @@ void ttm_page_alloc_fini(void)
+ pr_info("Finalizing pool allocator\n");
+ ttm_pool_mm_shrink_fini(_manager);
+
++ /* OK to use static buffer since global mutex is no longer used. */
+ for (i = 0; i < NUM_POOLS; ++i)
+- ttm_page_pool_free(&_manager->pools[i], FREE_ALL_PAGES,
+- GFP_KERNEL);
++ ttm_page_pool_free(&_manager->pools[i], FREE_ALL_PAGES, true);
+
+ kobject_put(&_manager->kobj);
+ _manager = NULL;
+diff --git a/drivers/gpu/drm/ttm/ttm_page_alloc_dma.c b/drivers/gpu/drm/ttm/ttm_page_alloc_dma.c
+index c96db433f8af..01e1d27eb078 100644
+--- a/drivers/gpu/drm/ttm/ttm_page_alloc_dma.c
++++ b/drivers/gpu/drm/ttm/ttm_page_alloc_dma.c
+@@ -411,11 +411,12 @@ static void ttm_dma_page_put(struct dma_pool *pool, struct dma_page *d_page)
+ *
+ * @pool: to free the pages from
+ * @nr_free: If set to true will free all pages in pool
+- * @gfp: GFP flags.
++ * @use_static: Safe to use static buffer
+ **/
+ static unsigned ttm_dma_page_pool_free(struct dma_pool *pool, unsigned nr_free,
+- gfp_t gfp)
++ bool use_static)
+ {
++ static struct page *static_buf[NUM_PAGES_TO_ALLOC];
+ unsigned long irq_flags;
+ struct dma_page *dma_p, *tmp;
+ struct page **pages_to_free;
+@@ -432,7 +433,11 @@ static unsigned ttm_dma_page_pool_free(struct dma_pool *pool, unsigned nr_free,
+ npages_to_free, nr_free);
+ }
+ #endif
+- pages_to_free = kmalloc(npages_to_free * sizeof(struct page *), gfp);
++ if (use_static)
++ pages_to_free = static_buf;
++ else
++ pages_to_free = kmalloc(npages_to_free * sizeof(struct page *),
++ GFP_KERNEL);
+
+ if (!pages_to_free) {
+ pr_err("%s: Failed to allocate memory for pool free operation\n",
+@@ -502,7 +507,8 @@ restart:
+ if (freed_pages)
+ ttm_dma_pages_put(pool, &d_pages, pages_to_free, freed_pages);
+ out:
+- kfree(pages_to_free);
++ if (pages_to_free != static_buf)
++ kfree(pages_to_free);
+ return nr_free;
+ }
+
+@@ -531,7 +537,8 @@ static void ttm_dma_free_pool(struct device *dev, enum pool_type type)
+ if (pool->type != type)
+ continue;
+ /* Takes a spinlock.. */
+- ttm_dma_page_pool_free(pool, FREE_ALL_PAGES, GFP_KERNEL);
++ /* OK to use static buffer since global mutex is held. */
++ ttm_dma_page_pool_free(pool, FREE_ALL_PAGES, true);
+ WARN_ON(((pool->npages_in_use + pool->npages_free) != 0));
+ /* This code path is called after _all_ references to the
+ * struct device has been dropped - so nobody should be
+@@ -986,7 +993,7 @@ void ttm_dma_unpopulate(struct ttm_dma_tt *ttm_dma, struct device *dev)
+
+ /* shrink pool if necessary (only on !is_cached pools)*/
+ if (npages)
+- ttm_dma_page_pool_free(pool, npages, GFP_KERNEL);
++ ttm_dma_page_pool_free(pool, npages, false);
+ ttm->state = tt_unpopulated;
+ }
+ EXPORT_SYMBOL_GPL(ttm_dma_unpopulate);
+@@ -996,8 +1003,6 @@ EXPORT_SYMBOL_GPL(ttm_dma_unpopulate);
+ *
+ * XXX: (dchinner) Deadlock warning!
+ *
+- * We need to pass sc->gfp_mask to ttm_dma_page_pool_free().
+- *
+ * I'm getting sadder as I hear more pathetical whimpers about needing per-pool
+ * shrinkers
+ */
+@@ -1030,8 +1035,8 @@ ttm_dma_pool_shrink_scan(struct shrinker *shrink, struct shrink_control *sc)
+ if (++idx < pool_offset)
+ continue;
+ nr_free = shrink_pages;
+- shrink_pages = ttm_dma_page_pool_free(p->pool, nr_free,
+- sc->gfp_mask);
++ /* OK to use static buffer since global mutex is held. */
++ shrink_pages = ttm_dma_page_pool_free(p->pool, nr_free, true);
+ freed += nr_free - shrink_pages;
+
+ pr_debug("%s: (%s:%d) Asked to shrink %d, have %d more to go\n",
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
+index 25f3c250fd98..daeca571b42f 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
+@@ -1063,8 +1063,12 @@ static long vmw_generic_ioctl(struct file *filp, unsigned int cmd,
+
+ vmaster = vmw_master_check(dev, file_priv, flags);
+ if (unlikely(IS_ERR(vmaster))) {
+- DRM_INFO("IOCTL ERROR %d\n", nr);
+- return PTR_ERR(vmaster);
++ ret = PTR_ERR(vmaster);
++
++ if (ret != -ERESTARTSYS)
++ DRM_INFO("IOCTL ERROR Command %d, Error %ld.\n",
++ nr, ret);
++ return ret;
+ }
+
+ ret = ioctl_func(filp, cmd, arg);
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c
+index 197164fd7803..b7594cb758af 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c
+@@ -545,35 +545,19 @@ void vmw_fence_obj_flush(struct vmw_fence_obj *fence)
+
+ static void vmw_fence_destroy(struct vmw_fence_obj *fence)
+ {
+- struct vmw_fence_manager *fman = fman_from_fence(fence);
+-
+ fence_free(&fence->base);
+-
+- /*
+- * Free kernel space accounting.
+- */
+- ttm_mem_global_free(vmw_mem_glob(fman->dev_priv),
+- fman->fence_size);
+ }
+
+ int vmw_fence_create(struct vmw_fence_manager *fman,
+ uint32_t seqno,
+ struct vmw_fence_obj **p_fence)
+ {
+- struct ttm_mem_global *mem_glob = vmw_mem_glob(fman->dev_priv);
+ struct vmw_fence_obj *fence;
+ int ret;
+
+- ret = ttm_mem_global_alloc(mem_glob, fman->fence_size,
+- false, false);
+- if (unlikely(ret != 0))
+- return ret;
+-
+ fence = kzalloc(sizeof(*fence), GFP_KERNEL);
+- if (unlikely(fence == NULL)) {
+- ret = -ENOMEM;
+- goto out_no_object;
+- }
++ if (unlikely(fence == NULL))
++ return -ENOMEM;
+
+ ret = vmw_fence_obj_init(fman, fence, seqno,
+ vmw_fence_destroy);
+@@ -585,8 +569,6 @@ int vmw_fence_create(struct vmw_fence_manager *fman,
+
+ out_err_init:
+ kfree(fence);
+-out_no_object:
+- ttm_mem_global_free(mem_glob, fman->fence_size);
+ return ret;
+ }
+
+@@ -1105,6 +1087,8 @@ static int vmw_event_fence_action_create(struct drm_file *file_priv,
+ if (ret != 0)
+ goto out_no_queue;
+
++ return 0;
++
+ out_no_queue:
+ event->base.destroy(&event->base);
+ out_no_event:
+@@ -1180,17 +1164,10 @@ int vmw_fence_event_ioctl(struct drm_device *dev, void *data,
+
+ BUG_ON(fence == NULL);
+
+- if (arg->flags & DRM_VMW_FE_FLAG_REQ_TIME)
+- ret = vmw_event_fence_action_create(file_priv, fence,
+- arg->flags,
+- arg->user_data,
+- true);
+- else
+- ret = vmw_event_fence_action_create(file_priv, fence,
+- arg->flags,
+- arg->user_data,
+- true);
+-
++ ret = vmw_event_fence_action_create(file_priv, fence,
++ arg->flags,
++ arg->user_data,
++ true);
+ if (unlikely(ret != 0)) {
+ if (ret != -ERESTARTSYS)
+ DRM_ERROR("Failed to attach event to fence.\n");
+diff --git a/drivers/iio/adc/ad799x.c b/drivers/iio/adc/ad799x.c
+index e37412da15f5..b99de00e57b8 100644
+--- a/drivers/iio/adc/ad799x.c
++++ b/drivers/iio/adc/ad799x.c
+@@ -143,9 +143,15 @@ static int ad799x_write_config(struct ad799x_state *st, u16 val)
+ case ad7998:
+ return i2c_smbus_write_word_swapped(st->client, AD7998_CONF_REG,
+ val);
+- default:
++ case ad7992:
++ case ad7993:
++ case ad7994:
+ return i2c_smbus_write_byte_data(st->client, AD7998_CONF_REG,
+ val);
++ default:
++ /* Will be written when doing a conversion */
++ st->config = val;
++ return 0;
+ }
+ }
+
+@@ -155,8 +161,13 @@ static int ad799x_read_config(struct ad799x_state *st)
+ case ad7997:
+ case ad7998:
+ return i2c_smbus_read_word_swapped(st->client, AD7998_CONF_REG);
+- default:
++ case ad7992:
++ case ad7993:
++ case ad7994:
+ return i2c_smbus_read_byte_data(st->client, AD7998_CONF_REG);
++ default:
++ /* No readback support */
++ return st->config;
+ }
+ }
+
+diff --git a/drivers/infiniband/ulp/iser/iscsi_iser.h b/drivers/infiniband/ulp/iser/iscsi_iser.h
+index cd4174ca9a76..f14c3849e568 100644
+--- a/drivers/infiniband/ulp/iser/iscsi_iser.h
++++ b/drivers/infiniband/ulp/iser/iscsi_iser.h
+@@ -432,6 +432,7 @@ struct fast_reg_descriptor {
+ * @cma_id: rdma_cm connection maneger handle
+ * @qp: Connection Queue-pair
+ * @post_recv_buf_count: post receive counter
++ * @sig_count: send work request signal count
+ * @rx_wr: receive work request for batch posts
+ * @device: reference to iser device
+ * @comp: iser completion context
+@@ -452,6 +453,7 @@ struct ib_conn {
+ struct rdma_cm_id *cma_id;
+ struct ib_qp *qp;
+ int post_recv_buf_count;
++ u8 sig_count;
+ struct ib_recv_wr rx_wr[ISER_MIN_POSTED_RX];
+ struct iser_device *device;
+ struct iser_comp *comp;
+diff --git a/drivers/infiniband/ulp/iser/iser_initiator.c b/drivers/infiniband/ulp/iser/iser_initiator.c
+index 5a489ea63732..3821633f1065 100644
+--- a/drivers/infiniband/ulp/iser/iser_initiator.c
++++ b/drivers/infiniband/ulp/iser/iser_initiator.c
+@@ -369,7 +369,7 @@ static int iser_post_rx_bufs(struct iscsi_conn *conn, struct iscsi_hdr *req)
+ return 0;
+ }
+
+-static inline bool iser_signal_comp(int sig_count)
++static inline bool iser_signal_comp(u8 sig_count)
+ {
+ return ((sig_count % ISER_SIGNAL_CMD_COUNT) == 0);
+ }
+@@ -388,7 +388,7 @@ int iser_send_command(struct iscsi_conn *conn,
+ struct iscsi_scsi_req *hdr = (struct iscsi_scsi_req *)task->hdr;
+ struct scsi_cmnd *sc = task->sc;
+ struct iser_tx_desc *tx_desc = &iser_task->desc;
+- static unsigned sig_count;
++ u8 sig_count = ++iser_conn->ib_conn.sig_count;
+
+ edtl = ntohl(hdr->data_length);
+
+@@ -435,7 +435,7 @@ int iser_send_command(struct iscsi_conn *conn,
+ iser_task->status = ISER_TASK_STATUS_STARTED;
+
+ err = iser_post_send(&iser_conn->ib_conn, tx_desc,
+- iser_signal_comp(++sig_count));
++ iser_signal_comp(sig_count));
+ if (!err)
+ return 0;
+
+diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c
+index 10641b7816f4..a6daabc70425 100644
+--- a/drivers/infiniband/ulp/isert/ib_isert.c
++++ b/drivers/infiniband/ulp/isert/ib_isert.c
+@@ -41,6 +41,7 @@ static DEFINE_MUTEX(device_list_mutex);
+ static LIST_HEAD(device_list);
+ static struct workqueue_struct *isert_rx_wq;
+ static struct workqueue_struct *isert_comp_wq;
++static struct workqueue_struct *isert_release_wq;
+
+ static void
+ isert_unmap_cmd(struct isert_cmd *isert_cmd, struct isert_conn *isert_conn);
+@@ -54,6 +55,19 @@ isert_reg_rdma(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
+ struct isert_rdma_wr *wr);
+ static int
+ isert_put_response(struct iscsi_conn *conn, struct iscsi_cmd *cmd);
++static int
++isert_rdma_post_recvl(struct isert_conn *isert_conn);
++static int
++isert_rdma_accept(struct isert_conn *isert_conn);
++struct rdma_cm_id *isert_setup_id(struct isert_np *isert_np);
++
++static inline bool
++isert_prot_cmd(struct isert_conn *conn, struct se_cmd *cmd)
++{
++ return (conn->pi_support &&
++ cmd->prot_op != TARGET_PROT_NORMAL);
++}
++
+
+ static void
+ isert_qp_event_callback(struct ib_event *e, void *context)
+@@ -90,8 +104,7 @@ isert_query_device(struct ib_device *ib_dev, struct ib_device_attr *devattr)
+ }
+
+ static int
+-isert_conn_setup_qp(struct isert_conn *isert_conn, struct rdma_cm_id *cma_id,
+- u8 protection)
++isert_conn_setup_qp(struct isert_conn *isert_conn, struct rdma_cm_id *cma_id)
+ {
+ struct isert_device *device = isert_conn->conn_device;
+ struct ib_qp_init_attr attr;
+@@ -126,7 +139,7 @@ isert_conn_setup_qp(struct isert_conn *isert_conn, struct rdma_cm_id *cma_id,
+ attr.cap.max_recv_sge = 1;
+ attr.sq_sig_type = IB_SIGNAL_REQ_WR;
+ attr.qp_type = IB_QPT_RC;
+- if (protection)
++ if (device->pi_capable)
+ attr.create_flags |= IB_QP_CREATE_SIGNATURE_EN;
+
+ pr_debug("isert_conn_setup_qp cma_id->device: %p\n",
+@@ -137,12 +150,18 @@ isert_conn_setup_qp(struct isert_conn *isert_conn, struct rdma_cm_id *cma_id,
+ ret = rdma_create_qp(cma_id, isert_conn->conn_pd, &attr);
+ if (ret) {
+ pr_err("rdma_create_qp failed for cma_id %d\n", ret);
+- return ret;
++ goto err;
+ }
+ isert_conn->conn_qp = cma_id->qp;
+ pr_debug("rdma_create_qp() returned success >>>>>>>>>>>>>>>>>>>>>>>>>.\n");
+
+ return 0;
++err:
++ mutex_lock(&device_list_mutex);
++ device->cq_active_qps[min_index]--;
++ mutex_unlock(&device_list_mutex);
++
++ return ret;
+ }
+
+ static void
+@@ -430,8 +449,68 @@ isert_conn_free_fastreg_pool(struct isert_conn *isert_conn)
+ }
+
+ static int
++isert_create_pi_ctx(struct fast_reg_descriptor *desc,
++ struct ib_device *device,
++ struct ib_pd *pd)
++{
++ struct ib_mr_init_attr mr_init_attr;
++ struct pi_context *pi_ctx;
++ int ret;
++
++ pi_ctx = kzalloc(sizeof(*desc->pi_ctx), GFP_KERNEL);
++ if (!pi_ctx) {
++ pr_err("Failed to allocate pi context\n");
++ return -ENOMEM;
++ }
++
++ pi_ctx->prot_frpl = ib_alloc_fast_reg_page_list(device,
++ ISCSI_ISER_SG_TABLESIZE);
++ if (IS_ERR(pi_ctx->prot_frpl)) {
++ pr_err("Failed to allocate prot frpl err=%ld\n",
++ PTR_ERR(pi_ctx->prot_frpl));
++ ret = PTR_ERR(pi_ctx->prot_frpl);
++ goto err_pi_ctx;
++ }
++
++ pi_ctx->prot_mr = ib_alloc_fast_reg_mr(pd, ISCSI_ISER_SG_TABLESIZE);
++ if (IS_ERR(pi_ctx->prot_mr)) {
++ pr_err("Failed to allocate prot frmr err=%ld\n",
++ PTR_ERR(pi_ctx->prot_mr));
++ ret = PTR_ERR(pi_ctx->prot_mr);
++ goto err_prot_frpl;
++ }
++ desc->ind |= ISERT_PROT_KEY_VALID;
++
++ memset(&mr_init_attr, 0, sizeof(mr_init_attr));
++ mr_init_attr.max_reg_descriptors = 2;
++ mr_init_attr.flags |= IB_MR_SIGNATURE_EN;
++ pi_ctx->sig_mr = ib_create_mr(pd, &mr_init_attr);
++ if (IS_ERR(pi_ctx->sig_mr)) {
++ pr_err("Failed to allocate signature enabled mr err=%ld\n",
++ PTR_ERR(pi_ctx->sig_mr));
++ ret = PTR_ERR(pi_ctx->sig_mr);
++ goto err_prot_mr;
++ }
++
++ desc->pi_ctx = pi_ctx;
++ desc->ind |= ISERT_SIG_KEY_VALID;
++ desc->ind &= ~ISERT_PROTECTED;
++
++ return 0;
++
++err_prot_mr:
++ ib_dereg_mr(desc->pi_ctx->prot_mr);
++err_prot_frpl:
++ ib_free_fast_reg_page_list(desc->pi_ctx->prot_frpl);
++err_pi_ctx:
++ kfree(desc->pi_ctx);
++
++ return ret;
++}
++
++static int
+ isert_create_fr_desc(struct ib_device *ib_device, struct ib_pd *pd,
+- struct fast_reg_descriptor *fr_desc, u8 protection)
++ struct fast_reg_descriptor *fr_desc)
+ {
+ int ret;
+
+@@ -450,62 +529,12 @@ isert_create_fr_desc(struct ib_device *ib_device, struct ib_pd *pd,
+ ret = PTR_ERR(fr_desc->data_mr);
+ goto err_data_frpl;
+ }
+- pr_debug("Create fr_desc %p page_list %p\n",
+- fr_desc, fr_desc->data_frpl->page_list);
+ fr_desc->ind |= ISERT_DATA_KEY_VALID;
+
+- if (protection) {
+- struct ib_mr_init_attr mr_init_attr = {0};
+- struct pi_context *pi_ctx;
+-
+- fr_desc->pi_ctx = kzalloc(sizeof(*fr_desc->pi_ctx), GFP_KERNEL);
+- if (!fr_desc->pi_ctx) {
+- pr_err("Failed to allocate pi context\n");
+- ret = -ENOMEM;
+- goto err_data_mr;
+- }
+- pi_ctx = fr_desc->pi_ctx;
+-
+- pi_ctx->prot_frpl = ib_alloc_fast_reg_page_list(ib_device,
+- ISCSI_ISER_SG_TABLESIZE);
+- if (IS_ERR(pi_ctx->prot_frpl)) {
+- pr_err("Failed to allocate prot frpl err=%ld\n",
+- PTR_ERR(pi_ctx->prot_frpl));
+- ret = PTR_ERR(pi_ctx->prot_frpl);
+- goto err_pi_ctx;
+- }
+-
+- pi_ctx->prot_mr = ib_alloc_fast_reg_mr(pd, ISCSI_ISER_SG_TABLESIZE);
+- if (IS_ERR(pi_ctx->prot_mr)) {
+- pr_err("Failed to allocate prot frmr err=%ld\n",
+- PTR_ERR(pi_ctx->prot_mr));
+- ret = PTR_ERR(pi_ctx->prot_mr);
+- goto err_prot_frpl;
+- }
+- fr_desc->ind |= ISERT_PROT_KEY_VALID;
+-
+- mr_init_attr.max_reg_descriptors = 2;
+- mr_init_attr.flags |= IB_MR_SIGNATURE_EN;
+- pi_ctx->sig_mr = ib_create_mr(pd, &mr_init_attr);
+- if (IS_ERR(pi_ctx->sig_mr)) {
+- pr_err("Failed to allocate signature enabled mr err=%ld\n",
+- PTR_ERR(pi_ctx->sig_mr));
+- ret = PTR_ERR(pi_ctx->sig_mr);
+- goto err_prot_mr;
+- }
+- fr_desc->ind |= ISERT_SIG_KEY_VALID;
+- }
+- fr_desc->ind &= ~ISERT_PROTECTED;
++ pr_debug("Created fr_desc %p\n", fr_desc);
+
+ return 0;
+-err_prot_mr:
+- ib_dereg_mr(fr_desc->pi_ctx->prot_mr);
+-err_prot_frpl:
+- ib_free_fast_reg_page_list(fr_desc->pi_ctx->prot_frpl);
+-err_pi_ctx:
+- kfree(fr_desc->pi_ctx);
+-err_data_mr:
+- ib_dereg_mr(fr_desc->data_mr);
++
+ err_data_frpl:
+ ib_free_fast_reg_page_list(fr_desc->data_frpl);
+
+@@ -513,7 +542,7 @@ err_data_frpl:
+ }
+
+ static int
+-isert_conn_create_fastreg_pool(struct isert_conn *isert_conn, u8 pi_support)
++isert_conn_create_fastreg_pool(struct isert_conn *isert_conn)
+ {
+ struct fast_reg_descriptor *fr_desc;
+ struct isert_device *device = isert_conn->conn_device;
+@@ -537,8 +566,7 @@ isert_conn_create_fastreg_pool(struct isert_conn *isert_conn, u8 pi_support)
+ }
+
+ ret = isert_create_fr_desc(device->ib_device,
+- isert_conn->conn_pd, fr_desc,
+- pi_support);
++ isert_conn->conn_pd, fr_desc);
+ if (ret) {
+ pr_err("Failed to create fastreg descriptor err=%d\n",
+ ret);
+@@ -563,13 +591,12 @@ err:
+ static int
+ isert_connect_request(struct rdma_cm_id *cma_id, struct rdma_cm_event *event)
+ {
+- struct iscsi_np *np = cma_id->context;
+- struct isert_np *isert_np = np->np_context;
++ struct isert_np *isert_np = cma_id->context;
++ struct iscsi_np *np = isert_np->np;
+ struct isert_conn *isert_conn;
+ struct isert_device *device;
+ struct ib_device *ib_dev = cma_id->device;
+ int ret = 0;
+- u8 pi_support;
+
+ spin_lock_bh(&np->np_thread_lock);
+ if (!np->enabled) {
+@@ -590,6 +617,7 @@ isert_connect_request(struct rdma_cm_id *cma_id, struct rdma_cm_event *event)
+ isert_conn->state = ISER_CONN_INIT;
+ INIT_LIST_HEAD(&isert_conn->conn_accept_node);
+ init_completion(&isert_conn->conn_login_comp);
++ init_completion(&isert_conn->login_req_comp);
+ init_completion(&isert_conn->conn_wait);
+ init_completion(&isert_conn->conn_wait_comp_err);
+ kref_init(&isert_conn->conn_kref);
+@@ -597,7 +625,6 @@ isert_connect_request(struct rdma_cm_id *cma_id, struct rdma_cm_event *event)
+ spin_lock_init(&isert_conn->conn_lock);
+ INIT_LIST_HEAD(&isert_conn->conn_fr_pool);
+
+- cma_id->context = isert_conn;
+ isert_conn->conn_cm_id = cma_id;
+
+ isert_conn->login_buf = kzalloc(ISCSI_DEF_MAX_RECV_SEG_LEN +
+@@ -669,15 +696,15 @@ isert_connect_request(struct rdma_cm_id *cma_id, struct rdma_cm_event *event)
+ goto out_mr;
+ }
+
+- pi_support = np->tpg_np->tpg->tpg_attrib.t10_pi;
+- if (pi_support && !device->pi_capable) {
+- pr_err("Protection information requested but not supported, "
+- "rejecting connect request\n");
+- ret = rdma_reject(cma_id, NULL, 0);
+- goto out_mr;
+- }
++ ret = isert_conn_setup_qp(isert_conn, cma_id);
++ if (ret)
++ goto out_conn_dev;
+
+- ret = isert_conn_setup_qp(isert_conn, cma_id, pi_support);
++ ret = isert_rdma_post_recvl(isert_conn);
++ if (ret)
++ goto out_conn_dev;
++
++ ret = isert_rdma_accept(isert_conn);
+ if (ret)
+ goto out_conn_dev;
+
+@@ -705,6 +732,7 @@ out_login_buf:
+ kfree(isert_conn->login_buf);
+ out:
+ kfree(isert_conn);
++ rdma_reject(cma_id, NULL, 0);
+ return ret;
+ }
+
+@@ -720,18 +748,20 @@ isert_connect_release(struct isert_conn *isert_conn)
+ if (device && device->use_fastreg)
+ isert_conn_free_fastreg_pool(isert_conn);
+
++ isert_free_rx_descriptors(isert_conn);
++ rdma_destroy_id(isert_conn->conn_cm_id);
++
+ if (isert_conn->conn_qp) {
+ cq_index = ((struct isert_cq_desc *)
+ isert_conn->conn_qp->recv_cq->cq_context)->cq_index;
+ pr_debug("isert_connect_release: cq_index: %d\n", cq_index);
++ mutex_lock(&device_list_mutex);
+ isert_conn->conn_device->cq_active_qps[cq_index]--;
++ mutex_unlock(&device_list_mutex);
+
+- rdma_destroy_qp(isert_conn->conn_cm_id);
++ ib_destroy_qp(isert_conn->conn_qp);
+ }
+
+- isert_free_rx_descriptors(isert_conn);
+- rdma_destroy_id(isert_conn->conn_cm_id);
+-
+ ib_dereg_mr(isert_conn->conn_mr);
+ ib_dealloc_pd(isert_conn->conn_pd);
+
+@@ -754,9 +784,19 @@ isert_connect_release(struct isert_conn *isert_conn)
+ static void
+ isert_connected_handler(struct rdma_cm_id *cma_id)
+ {
+- struct isert_conn *isert_conn = cma_id->context;
++ struct isert_conn *isert_conn = cma_id->qp->qp_context;
++
++ pr_info("conn %p\n", isert_conn);
+
+- kref_get(&isert_conn->conn_kref);
++ if (!kref_get_unless_zero(&isert_conn->conn_kref)) {
++ pr_warn("conn %p connect_release is running\n", isert_conn);
++ return;
++ }
++
++ mutex_lock(&isert_conn->conn_mutex);
++ if (isert_conn->state != ISER_CONN_FULL_FEATURE)
++ isert_conn->state = ISER_CONN_UP;
++ mutex_unlock(&isert_conn->conn_mutex);
+ }
+
+ static void
+@@ -777,65 +817,108 @@ isert_put_conn(struct isert_conn *isert_conn)
+ kref_put(&isert_conn->conn_kref, isert_release_conn_kref);
+ }
+
++/**
++ * isert_conn_terminate() - Initiate connection termination
++ * @isert_conn: isert connection struct
++ *
++ * Notes:
++ * In case the connection state is FULL_FEATURE, move state
++ * to TEMINATING and start teardown sequence (rdma_disconnect).
++ * In case the connection state is UP, complete flush as well.
++ *
++ * This routine must be called with conn_mutex held. Thus it is
++ * safe to call multiple times.
++ */
+ static void
+-isert_disconnect_work(struct work_struct *work)
++isert_conn_terminate(struct isert_conn *isert_conn)
+ {
+- struct isert_conn *isert_conn = container_of(work,
+- struct isert_conn, conn_logout_work);
++ int err;
+
+- pr_debug("isert_disconnect_work(): >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\n");
+- mutex_lock(&isert_conn->conn_mutex);
+- if (isert_conn->state == ISER_CONN_UP)
++ switch (isert_conn->state) {
++ case ISER_CONN_TERMINATING:
++ break;
++ case ISER_CONN_UP:
++ /*
++ * No flush completions will occur as we didn't
++ * get to ISER_CONN_FULL_FEATURE yet, complete
++ * to allow teardown progress.
++ */
++ complete(&isert_conn->conn_wait_comp_err);
++ case ISER_CONN_FULL_FEATURE: /* FALLTHRU */
++ pr_info("Terminating conn %p state %d\n",
++ isert_conn, isert_conn->state);
+ isert_conn->state = ISER_CONN_TERMINATING;
+-
+- if (isert_conn->post_recv_buf_count == 0 &&
+- atomic_read(&isert_conn->post_send_buf_count) == 0) {
+- mutex_unlock(&isert_conn->conn_mutex);
+- goto wake_up;
+- }
+- if (!isert_conn->conn_cm_id) {
+- mutex_unlock(&isert_conn->conn_mutex);
+- isert_put_conn(isert_conn);
+- return;
++ err = rdma_disconnect(isert_conn->conn_cm_id);
++ if (err)
++ pr_warn("Failed rdma_disconnect isert_conn %p\n",
++ isert_conn);
++ break;
++ default:
++ pr_warn("conn %p teminating in state %d\n",
++ isert_conn, isert_conn->state);
+ }
++}
+
+- if (isert_conn->disconnect) {
+- /* Send DREQ/DREP towards our initiator */
+- rdma_disconnect(isert_conn->conn_cm_id);
+- }
++static int
++isert_np_cma_handler(struct isert_np *isert_np,
++ enum rdma_cm_event_type event)
++{
++ pr_debug("isert np %p, handling event %d\n", isert_np, event);
+
+- mutex_unlock(&isert_conn->conn_mutex);
++ switch (event) {
++ case RDMA_CM_EVENT_DEVICE_REMOVAL:
++ isert_np->np_cm_id = NULL;
++ break;
++ case RDMA_CM_EVENT_ADDR_CHANGE:
++ isert_np->np_cm_id = isert_setup_id(isert_np);
++ if (IS_ERR(isert_np->np_cm_id)) {
++ pr_err("isert np %p setup id failed: %ld\n",
++ isert_np, PTR_ERR(isert_np->np_cm_id));
++ isert_np->np_cm_id = NULL;
++ }
++ break;
++ default:
++ pr_err("isert np %p Unexpected event %d\n",
++ isert_np, event);
++ }
+
+-wake_up:
+- complete(&isert_conn->conn_wait);
++ return -1;
+ }
+
+ static int
+-isert_disconnected_handler(struct rdma_cm_id *cma_id, bool disconnect)
++isert_disconnected_handler(struct rdma_cm_id *cma_id,
++ enum rdma_cm_event_type event)
+ {
++ struct isert_np *isert_np = cma_id->context;
+ struct isert_conn *isert_conn;
+
+- if (!cma_id->qp) {
+- struct isert_np *isert_np = cma_id->context;
++ if (isert_np->np_cm_id == cma_id)
++ return isert_np_cma_handler(cma_id->context, event);
+
+- isert_np->np_cm_id = NULL;
+- return -1;
+- }
++ isert_conn = cma_id->qp->qp_context;
+
+- isert_conn = (struct isert_conn *)cma_id->context;
++ mutex_lock(&isert_conn->conn_mutex);
++ isert_conn_terminate(isert_conn);
++ mutex_unlock(&isert_conn->conn_mutex);
+
+- isert_conn->disconnect = disconnect;
+- INIT_WORK(&isert_conn->conn_logout_work, isert_disconnect_work);
+- schedule_work(&isert_conn->conn_logout_work);
++ pr_info("conn %p completing conn_wait\n", isert_conn);
++ complete(&isert_conn->conn_wait);
+
+ return 0;
+ }
+
++static void
++isert_connect_error(struct rdma_cm_id *cma_id)
++{
++ struct isert_conn *isert_conn = cma_id->qp->qp_context;
++
++ isert_put_conn(isert_conn);
++}
++
+ static int
+ isert_cma_handler(struct rdma_cm_id *cma_id, struct rdma_cm_event *event)
+ {
+ int ret = 0;
+- bool disconnect = false;
+
+ pr_debug("isert_cma_handler: event %d status %d conn %p id %p\n",
+ event->event, event->status, cma_id->context, cma_id);
+@@ -853,11 +936,14 @@ isert_cma_handler(struct rdma_cm_id *cma_id, struct rdma_cm_event *event)
+ case RDMA_CM_EVENT_ADDR_CHANGE: /* FALLTHRU */
+ case RDMA_CM_EVENT_DISCONNECTED: /* FALLTHRU */
+ case RDMA_CM_EVENT_DEVICE_REMOVAL: /* FALLTHRU */
+- disconnect = true;
+ case RDMA_CM_EVENT_TIMEWAIT_EXIT: /* FALLTHRU */
+- ret = isert_disconnected_handler(cma_id, disconnect);
++ ret = isert_disconnected_handler(cma_id, event->event);
+ break;
++ case RDMA_CM_EVENT_REJECTED: /* FALLTHRU */
++ case RDMA_CM_EVENT_UNREACHABLE: /* FALLTHRU */
+ case RDMA_CM_EVENT_CONNECT_ERROR:
++ isert_connect_error(cma_id);
++ break;
+ default:
+ pr_err("Unhandled RDMA CMA event: %d\n", event->event);
+ break;
+@@ -991,7 +1077,7 @@ isert_init_send_wr(struct isert_conn *isert_conn, struct isert_cmd *isert_cmd,
+ * bit for every ISERT_COMP_BATCH_COUNT number of ib_post_send() calls.
+ */
+ mutex_lock(&isert_conn->conn_mutex);
+- if (coalesce && isert_conn->state == ISER_CONN_UP &&
++ if (coalesce && isert_conn->state == ISER_CONN_FULL_FEATURE &&
+ ++isert_conn->conn_comp_batch < ISERT_COMP_BATCH_COUNT) {
+ tx_desc->llnode_active = true;
+ llist_add(&tx_desc->comp_llnode, &isert_conn->conn_comp_llist);
+@@ -1072,11 +1158,7 @@ isert_put_login_tx(struct iscsi_conn *conn, struct iscsi_login *login,
+ if (login->login_complete) {
+ if (!conn->sess->sess_ops->SessionType &&
+ isert_conn->conn_device->use_fastreg) {
+- /* Normal Session and fastreg is used */
+- u8 pi_support = login->np->tpg_np->tpg->tpg_attrib.t10_pi;
+-
+- ret = isert_conn_create_fastreg_pool(isert_conn,
+- pi_support);
++ ret = isert_conn_create_fastreg_pool(isert_conn);
+ if (ret) {
+ pr_err("Conn: %p failed to create"
+ " fastreg pool\n", isert_conn);
+@@ -1092,7 +1174,10 @@ isert_put_login_tx(struct iscsi_conn *conn, struct iscsi_login *login,
+ if (ret)
+ return ret;
+
+- isert_conn->state = ISER_CONN_UP;
++ /* Now we are in FULL_FEATURE phase */
++ mutex_lock(&isert_conn->conn_mutex);
++ isert_conn->state = ISER_CONN_FULL_FEATURE;
++ mutex_unlock(&isert_conn->conn_mutex);
+ goto post_send;
+ }
+
+@@ -1109,18 +1194,17 @@ post_send:
+ }
+
+ static void
+-isert_rx_login_req(struct iser_rx_desc *rx_desc, int rx_buflen,
+- struct isert_conn *isert_conn)
++isert_rx_login_req(struct isert_conn *isert_conn)
+ {
++ struct iser_rx_desc *rx_desc = (void *)isert_conn->login_req_buf;
++ int rx_buflen = isert_conn->login_req_len;
+ struct iscsi_conn *conn = isert_conn->conn;
+ struct iscsi_login *login = conn->conn_login;
+ int size;
+
+- if (!login) {
+- pr_err("conn->conn_login is NULL\n");
+- dump_stack();
+- return;
+- }
++ pr_info("conn %p\n", isert_conn);
++
++ WARN_ON_ONCE(!login);
+
+ if (login->first_request) {
+ struct iscsi_login_req *login_req =
+@@ -1483,11 +1567,20 @@ isert_rx_completion(struct iser_rx_desc *desc, struct isert_conn *isert_conn,
+ hdr->opcode, hdr->itt, hdr->flags,
+ (int)(xfer_len - ISER_HEADERS_LEN));
+
+- if ((char *)desc == isert_conn->login_req_buf)
+- isert_rx_login_req(desc, xfer_len - ISER_HEADERS_LEN,
+- isert_conn);
+- else
++ if ((char *)desc == isert_conn->login_req_buf) {
++ isert_conn->login_req_len = xfer_len - ISER_HEADERS_LEN;
++ if (isert_conn->conn) {
++ struct iscsi_login *login = isert_conn->conn->conn_login;
++
++ if (login && !login->first_request)
++ isert_rx_login_req(isert_conn);
++ }
++ mutex_lock(&isert_conn->conn_mutex);
++ complete(&isert_conn->login_req_comp);
++ mutex_unlock(&isert_conn->conn_mutex);
++ } else {
+ isert_rx_do_work(desc, isert_conn);
++ }
+
+ ib_dma_sync_single_for_device(ib_dev, rx_dma, rx_buflen,
+ DMA_FROM_DEVICE);
+@@ -2046,7 +2139,7 @@ isert_cq_rx_comp_err(struct isert_conn *isert_conn)
+ msleep(3000);
+
+ mutex_lock(&isert_conn->conn_mutex);
+- isert_conn->state = ISER_CONN_DOWN;
++ isert_conn_terminate(isert_conn);
+ mutex_unlock(&isert_conn->conn_mutex);
+
+ iscsit_cause_connection_reinstatement(isert_conn->conn, 0);
+@@ -2231,8 +2324,16 @@ isert_get_sup_prot_ops(struct iscsi_conn *conn)
+ struct isert_conn *isert_conn = (struct isert_conn *)conn->context;
+ struct isert_device *device = isert_conn->conn_device;
+
+- if (device->pi_capable)
+- return TARGET_PROT_ALL;
++ if (conn->tpg->tpg_attrib.t10_pi) {
++ if (device->pi_capable) {
++ pr_info("conn %p PI offload enabled\n", isert_conn);
++ isert_conn->pi_support = true;
++ return TARGET_PROT_ALL;
++ }
++ }
++
++ pr_info("conn %p PI offload disabled\n", isert_conn);
++ isert_conn->pi_support = false;
+
+ return TARGET_PROT_NORMAL;
+ }
+@@ -2681,10 +2782,10 @@ isert_set_prot_checks(u8 prot_checks)
+ }
+
+ static int
+-isert_reg_sig_mr(struct isert_conn *isert_conn, struct se_cmd *se_cmd,
+- struct fast_reg_descriptor *fr_desc,
+- struct ib_sge *data_sge, struct ib_sge *prot_sge,
+- struct ib_sge *sig_sge)
++isert_reg_sig_mr(struct isert_conn *isert_conn,
++ struct se_cmd *se_cmd,
++ struct isert_rdma_wr *rdma_wr,
++ struct fast_reg_descriptor *fr_desc)
+ {
+ struct ib_send_wr sig_wr, inv_wr;
+ struct ib_send_wr *bad_wr, *wr = NULL;
+@@ -2714,13 +2815,13 @@ isert_reg_sig_mr(struct isert_conn *isert_conn, struct se_cmd *se_cmd,
+ memset(&sig_wr, 0, sizeof(sig_wr));
+ sig_wr.opcode = IB_WR_REG_SIG_MR;
+ sig_wr.wr_id = ISER_FASTREG_LI_WRID;
+- sig_wr.sg_list = data_sge;
++ sig_wr.sg_list = &rdma_wr->ib_sg[DATA];
+ sig_wr.num_sge = 1;
+ sig_wr.wr.sig_handover.access_flags = IB_ACCESS_LOCAL_WRITE;
+ sig_wr.wr.sig_handover.sig_attrs = &sig_attrs;
+ sig_wr.wr.sig_handover.sig_mr = pi_ctx->sig_mr;
+ if (se_cmd->t_prot_sg)
+- sig_wr.wr.sig_handover.prot = prot_sge;
++ sig_wr.wr.sig_handover.prot = &rdma_wr->ib_sg[PROT];
+
+ if (!wr)
+ wr = &sig_wr;
+@@ -2734,34 +2835,93 @@ isert_reg_sig_mr(struct isert_conn *isert_conn, struct se_cmd *se_cmd,
+ }
+ fr_desc->ind &= ~ISERT_SIG_KEY_VALID;
+
+- sig_sge->lkey = pi_ctx->sig_mr->lkey;
+- sig_sge->addr = 0;
+- sig_sge->length = se_cmd->data_length;
++ rdma_wr->ib_sg[SIG].lkey = pi_ctx->sig_mr->lkey;
++ rdma_wr->ib_sg[SIG].addr = 0;
++ rdma_wr->ib_sg[SIG].length = se_cmd->data_length;
+ if (se_cmd->prot_op != TARGET_PROT_DIN_STRIP &&
+ se_cmd->prot_op != TARGET_PROT_DOUT_INSERT)
+ /*
+ * We have protection guards on the wire
+ * so we need to set a larget transfer
+ */
+- sig_sge->length += se_cmd->prot_length;
++ rdma_wr->ib_sg[SIG].length += se_cmd->prot_length;
+
+ pr_debug("sig_sge: addr: 0x%llx length: %u lkey: %x\n",
+- sig_sge->addr, sig_sge->length,
+- sig_sge->lkey);
++ rdma_wr->ib_sg[SIG].addr, rdma_wr->ib_sg[SIG].length,
++ rdma_wr->ib_sg[SIG].lkey);
+ err:
+ return ret;
+ }
+
+ static int
++isert_handle_prot_cmd(struct isert_conn *isert_conn,
++ struct isert_cmd *isert_cmd,
++ struct isert_rdma_wr *wr)
++{
++ struct isert_device *device = isert_conn->conn_device;
++ struct se_cmd *se_cmd = &isert_cmd->iscsi_cmd->se_cmd;
++ int ret;
++
++ if (!wr->fr_desc->pi_ctx) {
++ ret = isert_create_pi_ctx(wr->fr_desc,
++ device->ib_device,
++ isert_conn->conn_pd);
++ if (ret) {
++ pr_err("conn %p failed to allocate pi_ctx\n",
++ isert_conn);
++ return ret;
++ }
++ }
++
++ if (se_cmd->t_prot_sg) {
++ ret = isert_map_data_buf(isert_conn, isert_cmd,
++ se_cmd->t_prot_sg,
++ se_cmd->t_prot_nents,
++ se_cmd->prot_length,
++ 0, wr->iser_ib_op, &wr->prot);
++ if (ret) {
++ pr_err("conn %p failed to map protection buffer\n",
++ isert_conn);
++ return ret;
++ }
++
++ memset(&wr->ib_sg[PROT], 0, sizeof(wr->ib_sg[PROT]));
++ ret = isert_fast_reg_mr(isert_conn, wr->fr_desc, &wr->prot,
++ ISERT_PROT_KEY_VALID, &wr->ib_sg[PROT]);
++ if (ret) {
++ pr_err("conn %p failed to fast reg mr\n",
++ isert_conn);
++ goto unmap_prot_cmd;
++ }
++ }
++
++ ret = isert_reg_sig_mr(isert_conn, se_cmd, wr, wr->fr_desc);
++ if (ret) {
++ pr_err("conn %p failed to fast reg mr\n",
++ isert_conn);
++ goto unmap_prot_cmd;
++ }
++ wr->fr_desc->ind |= ISERT_PROTECTED;
++
++ return 0;
++
++unmap_prot_cmd:
++ if (se_cmd->t_prot_sg)
++ isert_unmap_data_buf(isert_conn, &wr->prot);
++
++ return ret;
++}
++
++static int
+ isert_reg_rdma(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
+ struct isert_rdma_wr *wr)
+ {
+ struct se_cmd *se_cmd = &cmd->se_cmd;
+ struct isert_cmd *isert_cmd = iscsit_priv_cmd(cmd);
+ struct isert_conn *isert_conn = conn->context;
+- struct ib_sge data_sge;
+- struct ib_send_wr *send_wr;
+ struct fast_reg_descriptor *fr_desc = NULL;
++ struct ib_send_wr *send_wr;
++ struct ib_sge *ib_sg;
+ u32 offset;
+ int ret = 0;
+ unsigned long flags;
+@@ -2775,8 +2935,7 @@ isert_reg_rdma(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
+ if (ret)
+ return ret;
+
+- if (wr->data.dma_nents != 1 ||
+- se_cmd->prot_op != TARGET_PROT_NORMAL) {
++ if (wr->data.dma_nents != 1 || isert_prot_cmd(isert_conn, se_cmd)) {
+ spin_lock_irqsave(&isert_conn->conn_lock, flags);
+ fr_desc = list_first_entry(&isert_conn->conn_fr_pool,
+ struct fast_reg_descriptor, list);
+@@ -2786,38 +2945,21 @@ isert_reg_rdma(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
+ }
+
+ ret = isert_fast_reg_mr(isert_conn, fr_desc, &wr->data,
+- ISERT_DATA_KEY_VALID, &data_sge);
++ ISERT_DATA_KEY_VALID, &wr->ib_sg[DATA]);
+ if (ret)
+ goto unmap_cmd;
+
+- if (se_cmd->prot_op != TARGET_PROT_NORMAL) {
+- struct ib_sge prot_sge, sig_sge;
+-
+- if (se_cmd->t_prot_sg) {
+- ret = isert_map_data_buf(isert_conn, isert_cmd,
+- se_cmd->t_prot_sg,
+- se_cmd->t_prot_nents,
+- se_cmd->prot_length,
+- 0, wr->iser_ib_op, &wr->prot);
+- if (ret)
+- goto unmap_cmd;
+-
+- ret = isert_fast_reg_mr(isert_conn, fr_desc, &wr->prot,
+- ISERT_PROT_KEY_VALID, &prot_sge);
+- if (ret)
+- goto unmap_prot_cmd;
+- }
+-
+- ret = isert_reg_sig_mr(isert_conn, se_cmd, fr_desc,
+- &data_sge, &prot_sge, &sig_sge);
++ if (isert_prot_cmd(isert_conn, se_cmd)) {
++ ret = isert_handle_prot_cmd(isert_conn, isert_cmd, wr);
+ if (ret)
+- goto unmap_prot_cmd;
++ goto unmap_cmd;
+
+- fr_desc->ind |= ISERT_PROTECTED;
+- memcpy(&wr->s_ib_sge, &sig_sge, sizeof(sig_sge));
+- } else
+- memcpy(&wr->s_ib_sge, &data_sge, sizeof(data_sge));
++ ib_sg = &wr->ib_sg[SIG];
++ } else {
++ ib_sg = &wr->ib_sg[DATA];
++ }
+
++ memcpy(&wr->s_ib_sge, ib_sg, sizeof(*ib_sg));
+ wr->ib_sge = &wr->s_ib_sge;
+ wr->send_wr_num = 1;
+ memset(&wr->s_send_wr, 0, sizeof(*send_wr));
+@@ -2832,7 +2974,7 @@ isert_reg_rdma(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
+ send_wr->opcode = IB_WR_RDMA_WRITE;
+ send_wr->wr.rdma.remote_addr = isert_cmd->read_va;
+ send_wr->wr.rdma.rkey = isert_cmd->read_stag;
+- send_wr->send_flags = se_cmd->prot_op == TARGET_PROT_NORMAL ?
++ send_wr->send_flags = !isert_prot_cmd(isert_conn, se_cmd) ?
+ 0 : IB_SEND_SIGNALED;
+ } else {
+ send_wr->opcode = IB_WR_RDMA_READ;
+@@ -2842,9 +2984,7 @@ isert_reg_rdma(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
+ }
+
+ return 0;
+-unmap_prot_cmd:
+- if (se_cmd->t_prot_sg)
+- isert_unmap_data_buf(isert_conn, &wr->prot);
++
+ unmap_cmd:
+ if (fr_desc) {
+ spin_lock_irqsave(&isert_conn->conn_lock, flags);
+@@ -2876,7 +3016,7 @@ isert_put_datain(struct iscsi_conn *conn, struct iscsi_cmd *cmd)
+ return rc;
+ }
+
+- if (se_cmd->prot_op == TARGET_PROT_NORMAL) {
++ if (!isert_prot_cmd(isert_conn, se_cmd)) {
+ /*
+ * Build isert_conn->tx_desc for iSCSI response PDU and attach
+ */
+@@ -2899,7 +3039,7 @@ isert_put_datain(struct iscsi_conn *conn, struct iscsi_cmd *cmd)
+ atomic_sub(wr->send_wr_num, &isert_conn->post_send_buf_count);
+ }
+
+- if (se_cmd->prot_op == TARGET_PROT_NORMAL)
++ if (!isert_prot_cmd(isert_conn, se_cmd))
+ pr_debug("Cmd: %p posted RDMA_WRITE + Response for iSER Data "
+ "READ\n", isert_cmd);
+ else
+@@ -3001,13 +3141,51 @@ isert_response_queue(struct iscsi_conn *conn, struct iscsi_cmd *cmd, int state)
+ return ret;
+ }
+
++struct rdma_cm_id *
++isert_setup_id(struct isert_np *isert_np)
++{
++ struct iscsi_np *np = isert_np->np;
++ struct rdma_cm_id *id;
++ struct sockaddr *sa;
++ int ret;
++
++ sa = (struct sockaddr *)&np->np_sockaddr;
++ pr_debug("ksockaddr: %p, sa: %p\n", &np->np_sockaddr, sa);
++
++ id = rdma_create_id(isert_cma_handler, isert_np,
++ RDMA_PS_TCP, IB_QPT_RC);
++ if (IS_ERR(id)) {
++ pr_err("rdma_create_id() failed: %ld\n", PTR_ERR(id));
++ ret = PTR_ERR(id);
++ goto out;
++ }
++ pr_debug("id %p context %p\n", id, id->context);
++
++ ret = rdma_bind_addr(id, sa);
++ if (ret) {
++ pr_err("rdma_bind_addr() failed: %d\n", ret);
++ goto out_id;
++ }
++
++ ret = rdma_listen(id, ISERT_RDMA_LISTEN_BACKLOG);
++ if (ret) {
++ pr_err("rdma_listen() failed: %d\n", ret);
++ goto out_id;
++ }
++
++ return id;
++out_id:
++ rdma_destroy_id(id);
++out:
++ return ERR_PTR(ret);
++}
++
+ static int
+ isert_setup_np(struct iscsi_np *np,
+ struct __kernel_sockaddr_storage *ksockaddr)
+ {
+ struct isert_np *isert_np;
+ struct rdma_cm_id *isert_lid;
+- struct sockaddr *sa;
+ int ret;
+
+ isert_np = kzalloc(sizeof(struct isert_np), GFP_KERNEL);
+@@ -3019,9 +3197,8 @@ isert_setup_np(struct iscsi_np *np,
+ mutex_init(&isert_np->np_accept_mutex);
+ INIT_LIST_HEAD(&isert_np->np_accept_list);
+ init_completion(&isert_np->np_login_comp);
++ isert_np->np = np;
+
+- sa = (struct sockaddr *)ksockaddr;
+- pr_debug("ksockaddr: %p, sa: %p\n", ksockaddr, sa);
+ /*
+ * Setup the np->np_sockaddr from the passed sockaddr setup
+ * in iscsi_target_configfs.c code..
+@@ -3029,37 +3206,20 @@ isert_setup_np(struct iscsi_np *np,
+ memcpy(&np->np_sockaddr, ksockaddr,
+ sizeof(struct __kernel_sockaddr_storage));
+
+- isert_lid = rdma_create_id(isert_cma_handler, np, RDMA_PS_TCP,
+- IB_QPT_RC);
++ isert_lid = isert_setup_id(isert_np);
+ if (IS_ERR(isert_lid)) {
+- pr_err("rdma_create_id() for isert_listen_handler failed: %ld\n",
+- PTR_ERR(isert_lid));
+ ret = PTR_ERR(isert_lid);
+ goto out;
+ }
+
+- ret = rdma_bind_addr(isert_lid, sa);
+- if (ret) {
+- pr_err("rdma_bind_addr() for isert_lid failed: %d\n", ret);
+- goto out_lid;
+- }
+-
+- ret = rdma_listen(isert_lid, ISERT_RDMA_LISTEN_BACKLOG);
+- if (ret) {
+- pr_err("rdma_listen() for isert_lid failed: %d\n", ret);
+- goto out_lid;
+- }
+-
+ isert_np->np_cm_id = isert_lid;
+ np->np_context = isert_np;
+- pr_debug("Setup isert_lid->context: %p\n", isert_lid->context);
+
+ return 0;
+
+-out_lid:
+- rdma_destroy_id(isert_lid);
+ out:
+ kfree(isert_np);
++
+ return ret;
+ }
+
+@@ -3094,7 +3254,15 @@ isert_get_login_rx(struct iscsi_conn *conn, struct iscsi_login *login)
+ struct isert_conn *isert_conn = (struct isert_conn *)conn->context;
+ int ret;
+
+- pr_debug("isert_get_login_rx before conn_login_comp conn: %p\n", conn);
++ pr_info("before login_req comp conn: %p\n", isert_conn);
++ ret = wait_for_completion_interruptible(&isert_conn->login_req_comp);
++ if (ret) {
++ pr_err("isert_conn %p interrupted before got login req\n",
++ isert_conn);
++ return ret;
++ }
++ reinit_completion(&isert_conn->login_req_comp);
++
+ /*
+ * For login requests after the first PDU, isert_rx_login_req() will
+ * kick schedule_delayed_work(&conn->login_work) as the packet is
+@@ -3104,11 +3272,15 @@ isert_get_login_rx(struct iscsi_conn *conn, struct iscsi_login *login)
+ if (!login->first_request)
+ return 0;
+
++ isert_rx_login_req(isert_conn);
++
++ pr_info("before conn_login_comp conn: %p\n", conn);
+ ret = wait_for_completion_interruptible(&isert_conn->conn_login_comp);
+ if (ret)
+ return ret;
+
+- pr_debug("isert_get_login_rx processing login->req: %p\n", login->req);
++ pr_info("processing login->req: %p\n", login->req);
++
+ return 0;
+ }
+
+@@ -3186,17 +3358,10 @@ accept_wait:
+ isert_conn->conn = conn;
+ max_accept = 0;
+
+- ret = isert_rdma_post_recvl(isert_conn);
+- if (ret)
+- return ret;
+-
+- ret = isert_rdma_accept(isert_conn);
+- if (ret)
+- return ret;
+-
+ isert_set_conn_info(np, conn, isert_conn);
+
+- pr_debug("Processing isert_accept_np: isert_conn: %p\n", isert_conn);
++ pr_debug("Processing isert_conn: %p\n", isert_conn);
++
+ return 0;
+ }
+
+@@ -3212,6 +3377,24 @@ isert_free_np(struct iscsi_np *np)
+ kfree(isert_np);
+ }
+
++static void isert_release_work(struct work_struct *work)
++{
++ struct isert_conn *isert_conn = container_of(work,
++ struct isert_conn,
++ release_work);
++
++ pr_info("Starting release conn %p\n", isert_conn);
++
++ wait_for_completion(&isert_conn->conn_wait);
++
++ mutex_lock(&isert_conn->conn_mutex);
++ isert_conn->state = ISER_CONN_DOWN;
++ mutex_unlock(&isert_conn->conn_mutex);
++
++ pr_info("Destroying conn %p\n", isert_conn);
++ isert_put_conn(isert_conn);
++}
++
+ static void isert_wait_conn(struct iscsi_conn *conn)
+ {
+ struct isert_conn *isert_conn = conn->context;
+@@ -3219,10 +3402,6 @@ static void isert_wait_conn(struct iscsi_conn *conn)
+ pr_debug("isert_wait_conn: Starting \n");
+
+ mutex_lock(&isert_conn->conn_mutex);
+- if (isert_conn->conn_cm_id && !isert_conn->disconnect) {
+- pr_debug("Calling rdma_disconnect from isert_wait_conn\n");
+- rdma_disconnect(isert_conn->conn_cm_id);
+- }
+ /*
+ * Only wait for conn_wait_comp_err if the isert_conn made it
+ * into full feature phase..
+@@ -3231,14 +3410,13 @@ static void isert_wait_conn(struct iscsi_conn *conn)
+ mutex_unlock(&isert_conn->conn_mutex);
+ return;
+ }
+- if (isert_conn->state == ISER_CONN_UP)
+- isert_conn->state = ISER_CONN_TERMINATING;
++ isert_conn_terminate(isert_conn);
+ mutex_unlock(&isert_conn->conn_mutex);
+
+ wait_for_completion(&isert_conn->conn_wait_comp_err);
+
+- wait_for_completion(&isert_conn->conn_wait);
+- isert_put_conn(isert_conn);
++ INIT_WORK(&isert_conn->release_work, isert_release_work);
++ queue_work(isert_release_wq, &isert_conn->release_work);
+ }
+
+ static void isert_free_conn(struct iscsi_conn *conn)
+@@ -3286,10 +3464,21 @@ static int __init isert_init(void)
+ goto destroy_rx_wq;
+ }
+
++ isert_release_wq = alloc_workqueue("isert_release_wq", WQ_UNBOUND,
++ WQ_UNBOUND_MAX_ACTIVE);
++ if (!isert_release_wq) {
++ pr_err("Unable to allocate isert_release_wq\n");
++ ret = -ENOMEM;
++ goto destroy_comp_wq;
++ }
++
+ iscsit_register_transport(&iser_target_transport);
+- pr_debug("iSER_TARGET[0] - Loaded iser_target_transport\n");
++ pr_info("iSER_TARGET[0] - Loaded iser_target_transport\n");
++
+ return 0;
+
++destroy_comp_wq:
++ destroy_workqueue(isert_comp_wq);
+ destroy_rx_wq:
+ destroy_workqueue(isert_rx_wq);
+ return ret;
+@@ -3298,6 +3487,7 @@ destroy_rx_wq:
+ static void __exit isert_exit(void)
+ {
+ flush_scheduled_work();
++ destroy_workqueue(isert_release_wq);
+ destroy_workqueue(isert_comp_wq);
+ destroy_workqueue(isert_rx_wq);
+ iscsit_unregister_transport(&iser_target_transport);
+diff --git a/drivers/infiniband/ulp/isert/ib_isert.h b/drivers/infiniband/ulp/isert/ib_isert.h
+index 04f51f7bf614..141905f446dd 100644
+--- a/drivers/infiniband/ulp/isert/ib_isert.h
++++ b/drivers/infiniband/ulp/isert/ib_isert.h
+@@ -23,6 +23,7 @@ enum iser_ib_op_code {
+ enum iser_conn_state {
+ ISER_CONN_INIT,
+ ISER_CONN_UP,
++ ISER_CONN_FULL_FEATURE,
+ ISER_CONN_TERMINATING,
+ ISER_CONN_DOWN,
+ };
+@@ -81,6 +82,12 @@ struct isert_data_buf {
+ enum dma_data_direction dma_dir;
+ };
+
++enum {
++ DATA = 0,
++ PROT = 1,
++ SIG = 2,
++};
++
+ struct isert_rdma_wr {
+ struct list_head wr_list;
+ struct isert_cmd *isert_cmd;
+@@ -90,6 +97,7 @@ struct isert_rdma_wr {
+ int send_wr_num;
+ struct ib_send_wr *send_wr;
+ struct ib_send_wr s_send_wr;
++ struct ib_sge ib_sg[3];
+ struct isert_data_buf data;
+ struct isert_data_buf prot;
+ struct fast_reg_descriptor *fr_desc;
+@@ -120,11 +128,13 @@ struct isert_conn {
+ atomic_t post_send_buf_count;
+ u32 responder_resources;
+ u32 initiator_depth;
++ bool pi_support;
+ u32 max_sge;
+ char *login_buf;
+ char *login_req_buf;
+ char *login_rsp_buf;
+ u64 login_req_dma;
++ int login_req_len;
+ u64 login_rsp_dma;
+ unsigned int conn_rx_desc_head;
+ struct iser_rx_desc *conn_rx_descs;
+@@ -132,13 +142,13 @@ struct isert_conn {
+ struct iscsi_conn *conn;
+ struct list_head conn_accept_node;
+ struct completion conn_login_comp;
++ struct completion login_req_comp;
+ struct iser_tx_desc conn_login_tx_desc;
+ struct rdma_cm_id *conn_cm_id;
+ struct ib_pd *conn_pd;
+ struct ib_mr *conn_mr;
+ struct ib_qp *conn_qp;
+ struct isert_device *conn_device;
+- struct work_struct conn_logout_work;
+ struct mutex conn_mutex;
+ struct completion conn_wait;
+ struct completion conn_wait_comp_err;
+@@ -147,10 +157,10 @@ struct isert_conn {
+ int conn_fr_pool_size;
+ /* lock to protect fastreg pool */
+ spinlock_t conn_lock;
++ struct work_struct release_work;
+ #define ISERT_COMP_BATCH_COUNT 8
+ int conn_comp_batch;
+ struct llist_head conn_comp_llist;
+- bool disconnect;
+ };
+
+ #define ISERT_MAX_CQ 64
+@@ -182,6 +192,7 @@ struct isert_device {
+ };
+
+ struct isert_np {
++ struct iscsi_np *np;
+ struct semaphore np_sem;
+ struct rdma_cm_id *np_cm_id;
+ struct mutex np_accept_mutex;
+diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c
+index f2b978026407..77ecf6d32237 100644
+--- a/drivers/input/mouse/elantech.c
++++ b/drivers/input/mouse/elantech.c
+@@ -1520,6 +1520,8 @@ static int elantech_set_properties(struct elantech_data *etd)
+ case 7:
+ case 8:
+ case 9:
++ case 10:
++ case 13:
+ etd->hw_version = 4;
+ break;
+ default:
+diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h
+index faeeb1372462..1a858c86a72b 100644
+--- a/drivers/input/serio/i8042-x86ia64io.h
++++ b/drivers/input/serio/i8042-x86ia64io.h
+@@ -415,6 +415,13 @@ static const struct dmi_system_id __initconst i8042_dmi_nomux_table[] = {
+ },
+ },
+ {
++ /* Acer Aspire 7738 */
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 7738"),
++ },
++ },
++ {
+ /* Gericom Bellagio */
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Gericom"),
+@@ -735,6 +742,35 @@ static const struct dmi_system_id __initconst i8042_dmi_dritek_table[] = {
+ { }
+ };
+
++/*
++ * Some laptops need keyboard reset before probing for the trackpad to get
++ * it detected, initialised & finally work.
++ */
++static const struct dmi_system_id __initconst i8042_dmi_kbdreset_table[] = {
++ {
++ /* Gigabyte P35 v2 - Elantech touchpad */
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "GIGABYTE"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "P35V2"),
++ },
++ },
++ {
++ /* Aorus branded Gigabyte X3 Plus - Elantech touchpad */
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "GIGABYTE"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "X3"),
++ },
++ },
++ {
++ /* Gigabyte P34 - Elantech touchpad */
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "GIGABYTE"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "P34"),
++ },
++ },
++ { }
++};
++
+ #endif /* CONFIG_X86 */
+
+ #ifdef CONFIG_PNP
+@@ -1030,6 +1066,9 @@ static int __init i8042_platform_init(void)
+ if (dmi_check_system(i8042_dmi_dritek_table))
+ i8042_dritek = true;
+
++ if (dmi_check_system(i8042_dmi_kbdreset_table))
++ i8042_kbdreset = true;
++
+ /*
+ * A20 was already enabled during early kernel init. But some buggy
+ * BIOSes (in MSI Laptops) require A20 to be enabled using 8042 to
+diff --git a/drivers/input/serio/i8042.c b/drivers/input/serio/i8042.c
+index f5a98af3b325..804d2e02010a 100644
+--- a/drivers/input/serio/i8042.c
++++ b/drivers/input/serio/i8042.c
+@@ -67,6 +67,10 @@ static bool i8042_notimeout;
+ module_param_named(notimeout, i8042_notimeout, bool, 0);
+ MODULE_PARM_DESC(notimeout, "Ignore timeouts signalled by i8042");
+
++static bool i8042_kbdreset;
++module_param_named(kbdreset, i8042_kbdreset, bool, 0);
++MODULE_PARM_DESC(kbdreset, "Reset device connected to KBD port");
++
+ #ifdef CONFIG_X86
+ static bool i8042_dritek;
+ module_param_named(dritek, i8042_dritek, bool, 0);
+@@ -790,6 +794,16 @@ static int __init i8042_check_aux(void)
+ return -1;
+
+ /*
++ * Reset keyboard (needed on some laptops to successfully detect
++ * touchpad, e.g., some Gigabyte laptop models with Elantech
++ * touchpads).
++ */
++ if (i8042_kbdreset) {
++ pr_warn("Attempting to reset device connected to KBD port\n");
++ i8042_kbd_write(NULL, (unsigned char) 0xff);
++ }
++
++/*
+ * Test AUX IRQ delivery to make sure BIOS did not grab the IRQ and
+ * used it for a PCI card or somethig else.
+ */
+diff --git a/drivers/leds/leds-netxbig.c b/drivers/leds/leds-netxbig.c
+index 64fde485dcaa..4c794f15a57f 100644
+--- a/drivers/leds/leds-netxbig.c
++++ b/drivers/leds/leds-netxbig.c
+@@ -330,18 +330,18 @@ create_netxbig_led(struct platform_device *pdev,
+ led_dat->sata = 0;
+ led_dat->cdev.brightness = LED_OFF;
+ led_dat->cdev.flags |= LED_CORE_SUSPENDRESUME;
+- /*
+- * If available, expose the SATA activity blink capability through
+- * a "sata" sysfs attribute.
+- */
+- if (led_dat->mode_val[NETXBIG_LED_SATA] != NETXBIG_LED_INVALID_MODE)
+- led_dat->cdev.groups = netxbig_led_groups;
+ led_dat->mode_addr = template->mode_addr;
+ led_dat->mode_val = template->mode_val;
+ led_dat->bright_addr = template->bright_addr;
+ led_dat->bright_max = (1 << pdata->gpio_ext->num_data) - 1;
+ led_dat->timer = pdata->timer;
+ led_dat->num_timer = pdata->num_timer;
++ /*
++ * If available, expose the SATA activity blink capability through
++ * a "sata" sysfs attribute.
++ */
++ if (led_dat->mode_val[NETXBIG_LED_SATA] != NETXBIG_LED_INVALID_MODE)
++ led_dat->cdev.groups = netxbig_led_groups;
+
+ return led_classdev_register(&pdev->dev, &led_dat->cdev);
+ }
+diff --git a/drivers/md/dm.c b/drivers/md/dm.c
+index 58f3927fd7cc..62c51364cf9e 100644
+--- a/drivers/md/dm.c
++++ b/drivers/md/dm.c
+@@ -899,7 +899,7 @@ static void disable_write_same(struct mapped_device *md)
+
+ static void clone_endio(struct bio *bio, int error)
+ {
+- int r = 0;
++ int r = error;
+ struct dm_target_io *tio = container_of(bio, struct dm_target_io, clone);
+ struct dm_io *io = tio->io;
+ struct mapped_device *md = tio->io->md;
+diff --git a/drivers/media/i2c/smiapp-pll.c b/drivers/media/i2c/smiapp-pll.c
+index 2335529b195c..ab5d9a3adebf 100644
+--- a/drivers/media/i2c/smiapp-pll.c
++++ b/drivers/media/i2c/smiapp-pll.c
+@@ -67,7 +67,7 @@ static void print_pll(struct device *dev, struct smiapp_pll *pll)
+ {
+ dev_dbg(dev, "pre_pll_clk_div\t%d\n", pll->pre_pll_clk_div);
+ dev_dbg(dev, "pll_multiplier \t%d\n", pll->pll_multiplier);
+- if (pll->flags != SMIAPP_PLL_FLAG_NO_OP_CLOCKS) {
++ if (!(pll->flags & SMIAPP_PLL_FLAG_NO_OP_CLOCKS)) {
+ dev_dbg(dev, "op_sys_clk_div \t%d\n", pll->op_sys_clk_div);
+ dev_dbg(dev, "op_pix_clk_div \t%d\n", pll->op_pix_clk_div);
+ }
+@@ -77,7 +77,7 @@ static void print_pll(struct device *dev, struct smiapp_pll *pll)
+ dev_dbg(dev, "ext_clk_freq_hz \t%d\n", pll->ext_clk_freq_hz);
+ dev_dbg(dev, "pll_ip_clk_freq_hz \t%d\n", pll->pll_ip_clk_freq_hz);
+ dev_dbg(dev, "pll_op_clk_freq_hz \t%d\n", pll->pll_op_clk_freq_hz);
+- if (pll->flags & SMIAPP_PLL_FLAG_NO_OP_CLOCKS) {
++ if (!(pll->flags & SMIAPP_PLL_FLAG_NO_OP_CLOCKS)) {
+ dev_dbg(dev, "op_sys_clk_freq_hz \t%d\n",
+ pll->op_sys_clk_freq_hz);
+ dev_dbg(dev, "op_pix_clk_freq_hz \t%d\n",
+diff --git a/drivers/media/i2c/smiapp/smiapp-core.c b/drivers/media/i2c/smiapp/smiapp-core.c
+index b10aaeda2bb4..b49254e4ea0a 100644
+--- a/drivers/media/i2c/smiapp/smiapp-core.c
++++ b/drivers/media/i2c/smiapp/smiapp-core.c
+@@ -2677,7 +2677,9 @@ static int smiapp_registered(struct v4l2_subdev *subdev)
+ pll->flags |= SMIAPP_PLL_FLAG_NO_OP_CLOCKS;
+ pll->scale_n = sensor->limits[SMIAPP_LIMIT_SCALER_N_MIN];
+
++ mutex_lock(&sensor->mutex);
+ rval = smiapp_update_mode(sensor);
++ mutex_unlock(&sensor->mutex);
+ if (rval) {
+ dev_err(&client->dev, "update mode failed\n");
+ goto out_nvm_release;
+diff --git a/drivers/media/platform/vivid/vivid-vid-out.c b/drivers/media/platform/vivid/vivid-vid-out.c
+index 69c2dbd2d165..501d5ef682e5 100644
+--- a/drivers/media/platform/vivid/vivid-vid-out.c
++++ b/drivers/media/platform/vivid/vivid-vid-out.c
+@@ -612,7 +612,7 @@ int vivid_vid_out_g_selection(struct file *file, void *priv,
+ sel->r = dev->fmt_out_rect;
+ break;
+ case V4L2_SEL_TGT_CROP_BOUNDS:
+- if (!dev->has_compose_out)
++ if (!dev->has_crop_out)
+ return -EINVAL;
+ sel->r = vivid_max_rect;
+ break;
+diff --git a/drivers/media/rc/img-ir/img-ir-hw.c b/drivers/media/rc/img-ir/img-ir-hw.c
+index ec49f94425fc..2fd47c9bf5d8 100644
+--- a/drivers/media/rc/img-ir/img-ir-hw.c
++++ b/drivers/media/rc/img-ir/img-ir-hw.c
+@@ -530,6 +530,22 @@ static void img_ir_set_decoder(struct img_ir_priv *priv,
+ u32 ir_status, irq_en;
+ spin_lock_irq(&priv->lock);
+
++ /*
++ * First record that the protocol is being stopped so that the end timer
++ * isn't restarted while we're trying to stop it.
++ */
++ hw->stopping = true;
++
++ /*
++ * Release the lock to stop the end timer, since the end timer handler
++ * acquires the lock and we don't want to deadlock waiting for it.
++ */
++ spin_unlock_irq(&priv->lock);
++ del_timer_sync(&hw->end_timer);
++ spin_lock_irq(&priv->lock);
++
++ hw->stopping = false;
++
+ /* switch off and disable interrupts */
+ img_ir_write(priv, IMG_IR_CONTROL, 0);
+ irq_en = img_ir_read(priv, IMG_IR_IRQ_ENABLE);
+@@ -541,12 +557,13 @@ static void img_ir_set_decoder(struct img_ir_priv *priv,
+ if (ir_status & (IMG_IR_RXDVAL | IMG_IR_RXDVALD2)) {
+ ir_status &= ~(IMG_IR_RXDVAL | IMG_IR_RXDVALD2);
+ img_ir_write(priv, IMG_IR_STATUS, ir_status);
+- img_ir_read(priv, IMG_IR_DATA_LW);
+- img_ir_read(priv, IMG_IR_DATA_UP);
+ }
+
+- /* stop the end timer and switch back to normal mode */
+- del_timer_sync(&hw->end_timer);
++ /* always read data to clear buffer if IR wakes the device */
++ img_ir_read(priv, IMG_IR_DATA_LW);
++ img_ir_read(priv, IMG_IR_DATA_UP);
++
++ /* switch back to normal mode */
+ hw->mode = IMG_IR_M_NORMAL;
+
+ /* clear the wakeup scancode filter */
+@@ -817,7 +834,8 @@ static void img_ir_handle_data(struct img_ir_priv *priv, u32 len, u64 raw)
+ }
+
+
+- if (dec->repeat) {
++ /* we mustn't update the end timer while trying to stop it */
++ if (dec->repeat && !hw->stopping) {
+ unsigned long interval;
+
+ img_ir_begin_repeat(priv);
+diff --git a/drivers/media/rc/img-ir/img-ir-hw.h b/drivers/media/rc/img-ir/img-ir-hw.h
+index 8fcc16c32c5b..307ddcd1a99e 100644
+--- a/drivers/media/rc/img-ir/img-ir-hw.h
++++ b/drivers/media/rc/img-ir/img-ir-hw.h
+@@ -214,6 +214,8 @@ enum img_ir_mode {
+ * @flags: IMG_IR_F_*.
+ * @filters: HW filters (derived from scancode filters).
+ * @mode: Current decode mode.
++ * @stopping: Indicates that decoder is being taken down and timers
++ * should not be restarted.
+ * @suspend_irqen: Saved IRQ enable mask over suspend.
+ */
+ struct img_ir_priv_hw {
+@@ -229,6 +231,7 @@ struct img_ir_priv_hw {
+ struct img_ir_filter filters[RC_FILTER_MAX];
+
+ enum img_ir_mode mode;
++ bool stopping;
+ u32 suspend_irqen;
+ };
+
+diff --git a/drivers/media/usb/au0828/au0828-cards.c b/drivers/media/usb/au0828/au0828-cards.c
+index 9eb77ac2153b..da87f1cc31a9 100644
+--- a/drivers/media/usb/au0828/au0828-cards.c
++++ b/drivers/media/usb/au0828/au0828-cards.c
+@@ -36,6 +36,11 @@ static void hvr950q_cs5340_audio(void *priv, int enable)
+ au0828_clear(dev, REG_000, 0x10);
+ }
+
++/*
++ * WARNING: There's a quirks table at sound/usb/quirks-table.h
++ * that should also be updated every time a new device with V4L2 support
++ * is added here.
++ */
+ struct au0828_board au0828_boards[] = {
+ [AU0828_BOARD_UNKNOWN] = {
+ .name = "Unknown board",
+diff --git a/drivers/media/usb/dvb-usb/af9005.c b/drivers/media/usb/dvb-usb/af9005.c
+index 3f4361e48a32..efa782ed6e2d 100644
+--- a/drivers/media/usb/dvb-usb/af9005.c
++++ b/drivers/media/usb/dvb-usb/af9005.c
+@@ -1081,9 +1081,12 @@ static int __init af9005_usb_module_init(void)
+ err("usb_register failed. (%d)", result);
+ return result;
+ }
++#if IS_MODULE(CONFIG_DVB_USB_AF9005) || defined(CONFIG_DVB_USB_AF9005_REMOTE)
++ /* FIXME: convert to todays kernel IR infrastructure */
+ rc_decode = symbol_request(af9005_rc_decode);
+ rc_keys = symbol_request(rc_map_af9005_table);
+ rc_keys_size = symbol_request(rc_map_af9005_table_size);
++#endif
+ if (rc_decode == NULL || rc_keys == NULL || rc_keys_size == NULL) {
+ err("af9005_rc_decode function not found, disabling remote");
+ af9005_properties.rc.legacy.rc_query = NULL;
+diff --git a/drivers/media/usb/uvc/uvc_driver.c b/drivers/media/usb/uvc/uvc_driver.c
+index 7c8322d4fc63..3c07af96b30f 100644
+--- a/drivers/media/usb/uvc/uvc_driver.c
++++ b/drivers/media/usb/uvc/uvc_driver.c
+@@ -1623,12 +1623,12 @@ static void uvc_delete(struct uvc_device *dev)
+ {
+ struct list_head *p, *n;
+
+- usb_put_intf(dev->intf);
+- usb_put_dev(dev->udev);
+-
+ uvc_status_cleanup(dev);
+ uvc_ctrl_cleanup_device(dev);
+
++ usb_put_intf(dev->intf);
++ usb_put_dev(dev->udev);
++
+ if (dev->vdev.dev)
+ v4l2_device_unregister(&dev->vdev);
+ #ifdef CONFIG_MEDIA_CONTROLLER
+diff --git a/drivers/misc/cxl/context.c b/drivers/misc/cxl/context.c
+index cca472109135..51fd6b524371 100644
+--- a/drivers/misc/cxl/context.c
++++ b/drivers/misc/cxl/context.c
+@@ -34,7 +34,8 @@ struct cxl_context *cxl_context_alloc(void)
+ /*
+ * Initialises a CXL context.
+ */
+-int cxl_context_init(struct cxl_context *ctx, struct cxl_afu *afu, bool master)
++int cxl_context_init(struct cxl_context *ctx, struct cxl_afu *afu, bool master,
++ struct address_space *mapping)
+ {
+ int i;
+
+@@ -42,6 +43,8 @@ int cxl_context_init(struct cxl_context *ctx, struct cxl_afu *afu, bool master)
+ ctx->afu = afu;
+ ctx->master = master;
+ ctx->pid = NULL; /* Set in start work ioctl */
++ mutex_init(&ctx->mapping_lock);
++ ctx->mapping = mapping;
+
+ /*
+ * Allocate the segment table before we put it in the IDR so that we
+@@ -82,12 +85,12 @@ int cxl_context_init(struct cxl_context *ctx, struct cxl_afu *afu, bool master)
+ * Allocating IDR! We better make sure everything's setup that
+ * dereferences from it.
+ */
++ mutex_lock(&afu->contexts_lock);
+ idr_preload(GFP_KERNEL);
+- spin_lock(&afu->contexts_lock);
+ i = idr_alloc(&ctx->afu->contexts_idr, ctx, 0,
+ ctx->afu->num_procs, GFP_NOWAIT);
+- spin_unlock(&afu->contexts_lock);
+ idr_preload_end();
++ mutex_unlock(&afu->contexts_lock);
+ if (i < 0)
+ return i;
+
+@@ -147,6 +150,12 @@ static void __detach_context(struct cxl_context *ctx)
+ afu_release_irqs(ctx);
+ flush_work(&ctx->fault_work); /* Only needed for dedicated process */
+ wake_up_all(&ctx->wq);
++
++ /* Release Problem State Area mapping */
++ mutex_lock(&ctx->mapping_lock);
++ if (ctx->mapping)
++ unmap_mapping_range(ctx->mapping, 0, 0, 1);
++ mutex_unlock(&ctx->mapping_lock);
+ }
+
+ /*
+@@ -168,21 +177,22 @@ void cxl_context_detach_all(struct cxl_afu *afu)
+ struct cxl_context *ctx;
+ int tmp;
+
+- rcu_read_lock();
+- idr_for_each_entry(&afu->contexts_idr, ctx, tmp)
++ mutex_lock(&afu->contexts_lock);
++ idr_for_each_entry(&afu->contexts_idr, ctx, tmp) {
+ /*
+ * Anything done in here needs to be setup before the IDR is
+ * created and torn down after the IDR removed
+ */
+ __detach_context(ctx);
+- rcu_read_unlock();
++ }
++ mutex_unlock(&afu->contexts_lock);
+ }
+
+ void cxl_context_free(struct cxl_context *ctx)
+ {
+- spin_lock(&ctx->afu->contexts_lock);
++ mutex_lock(&ctx->afu->contexts_lock);
+ idr_remove(&ctx->afu->contexts_idr, ctx->pe);
+- spin_unlock(&ctx->afu->contexts_lock);
++ mutex_unlock(&ctx->afu->contexts_lock);
+ synchronize_rcu();
+
+ free_page((u64)ctx->sstp);
+diff --git a/drivers/misc/cxl/cxl.h b/drivers/misc/cxl/cxl.h
+index 3d2b8677ec8a..6ee785da574e 100644
+--- a/drivers/misc/cxl/cxl.h
++++ b/drivers/misc/cxl/cxl.h
+@@ -349,7 +349,7 @@ struct cxl_afu {
+ struct device *chardev_s, *chardev_m, *chardev_d;
+ struct idr contexts_idr;
+ struct dentry *debugfs;
+- spinlock_t contexts_lock;
++ struct mutex contexts_lock;
+ struct mutex spa_mutex;
+ spinlock_t afu_cntl_lock;
+
+@@ -390,6 +390,10 @@ struct cxl_context {
+ phys_addr_t psn_phys;
+ u64 psn_size;
+
++ /* Used to unmap any mmaps when force detaching */
++ struct address_space *mapping;
++ struct mutex mapping_lock;
++
+ spinlock_t sste_lock; /* Protects segment table entries */
+ struct cxl_sste *sstp;
+ u64 sstp0, sstp1;
+@@ -592,7 +596,8 @@ int cxl_alloc_sst(struct cxl_context *ctx);
+ void init_cxl_native(void);
+
+ struct cxl_context *cxl_context_alloc(void);
+-int cxl_context_init(struct cxl_context *ctx, struct cxl_afu *afu, bool master);
++int cxl_context_init(struct cxl_context *ctx, struct cxl_afu *afu, bool master,
++ struct address_space *mapping);
+ void cxl_context_free(struct cxl_context *ctx);
+ int cxl_context_iomap(struct cxl_context *ctx, struct vm_area_struct *vma);
+
+diff --git a/drivers/misc/cxl/file.c b/drivers/misc/cxl/file.c
+index 378b099e7c0b..e9f2f10dbb37 100644
+--- a/drivers/misc/cxl/file.c
++++ b/drivers/misc/cxl/file.c
+@@ -77,7 +77,7 @@ static int __afu_open(struct inode *inode, struct file *file, bool master)
+ goto err_put_afu;
+ }
+
+- if ((rc = cxl_context_init(ctx, afu, master)))
++ if ((rc = cxl_context_init(ctx, afu, master, inode->i_mapping)))
+ goto err_put_afu;
+
+ pr_devel("afu_open pe: %i\n", ctx->pe);
+@@ -113,6 +113,10 @@ static int afu_release(struct inode *inode, struct file *file)
+ __func__, ctx->pe);
+ cxl_context_detach(ctx);
+
++ mutex_lock(&ctx->mapping_lock);
++ ctx->mapping = NULL;
++ mutex_unlock(&ctx->mapping_lock);
++
+ put_device(&ctx->afu->dev);
+
+ /*
+diff --git a/drivers/misc/cxl/native.c b/drivers/misc/cxl/native.c
+index d47532e8f4f1..1d9717b4d67a 100644
+--- a/drivers/misc/cxl/native.c
++++ b/drivers/misc/cxl/native.c
+@@ -277,6 +277,7 @@ static int do_process_element_cmd(struct cxl_context *ctx,
+ u64 cmd, u64 pe_state)
+ {
+ u64 state;
++ unsigned long timeout = jiffies + (HZ * CXL_TIMEOUT);
+
+ WARN_ON(!ctx->afu->enabled);
+
+@@ -286,6 +287,10 @@ static int do_process_element_cmd(struct cxl_context *ctx,
+ smp_mb();
+ cxl_p1n_write(ctx->afu, CXL_PSL_LLCMD_An, cmd | ctx->pe);
+ while (1) {
++ if (time_after_eq(jiffies, timeout)) {
++ dev_warn(&ctx->afu->dev, "WARNING: Process Element Command timed out!\n");
++ return -EBUSY;
++ }
+ state = be64_to_cpup(ctx->afu->sw_command_status);
+ if (state == ~0ULL) {
+ pr_err("cxl: Error adding process element to AFU\n");
+@@ -610,13 +615,6 @@ static inline int detach_process_native_dedicated(struct cxl_context *ctx)
+ return 0;
+ }
+
+-/*
+- * TODO: handle case when this is called inside a rcu_read_lock() which may
+- * happen when we unbind the driver (ie. cxl_context_detach_all()) . Terminate
+- * & remove use a mutex lock and schedule which will not good with lock held.
+- * May need to write do_process_element_cmd() that handles outstanding page
+- * faults synchronously.
+- */
+ static inline int detach_process_native_afu_directed(struct cxl_context *ctx)
+ {
+ if (!ctx->pe_inserted)
+diff --git a/drivers/misc/cxl/pci.c b/drivers/misc/cxl/pci.c
+index 10c98ab7f46e..0f2cc9f8b4db 100644
+--- a/drivers/misc/cxl/pci.c
++++ b/drivers/misc/cxl/pci.c
+@@ -502,7 +502,7 @@ static struct cxl_afu *cxl_alloc_afu(struct cxl *adapter, int slice)
+ afu->dev.release = cxl_release_afu;
+ afu->slice = slice;
+ idr_init(&afu->contexts_idr);
+- spin_lock_init(&afu->contexts_lock);
++ mutex_init(&afu->contexts_lock);
+ spin_lock_init(&afu->afu_cntl_lock);
+ mutex_init(&afu->spa_mutex);
+
+diff --git a/drivers/misc/cxl/sysfs.c b/drivers/misc/cxl/sysfs.c
+index ce7ec06d87d1..461bdbd5d483 100644
+--- a/drivers/misc/cxl/sysfs.c
++++ b/drivers/misc/cxl/sysfs.c
+@@ -121,7 +121,7 @@ static ssize_t reset_store_afu(struct device *device,
+ int rc;
+
+ /* Not safe to reset if it is currently in use */
+- spin_lock(&afu->contexts_lock);
++ mutex_lock(&afu->contexts_lock);
+ if (!idr_is_empty(&afu->contexts_idr)) {
+ rc = -EBUSY;
+ goto err;
+@@ -132,7 +132,7 @@ static ssize_t reset_store_afu(struct device *device,
+
+ rc = count;
+ err:
+- spin_unlock(&afu->contexts_lock);
++ mutex_unlock(&afu->contexts_lock);
+ return rc;
+ }
+
+@@ -247,7 +247,7 @@ static ssize_t mode_store(struct device *device, struct device_attribute *attr,
+ int rc = -EBUSY;
+
+ /* can't change this if we have a user */
+- spin_lock(&afu->contexts_lock);
++ mutex_lock(&afu->contexts_lock);
+ if (!idr_is_empty(&afu->contexts_idr))
+ goto err;
+
+@@ -271,7 +271,7 @@ static ssize_t mode_store(struct device *device, struct device_attribute *attr,
+ afu->current_mode = 0;
+ afu->num_procs = 0;
+
+- spin_unlock(&afu->contexts_lock);
++ mutex_unlock(&afu->contexts_lock);
+
+ if ((rc = _cxl_afu_deactivate_mode(afu, old_mode)))
+ return rc;
+@@ -280,7 +280,7 @@ static ssize_t mode_store(struct device *device, struct device_attribute *attr,
+
+ return count;
+ err:
+- spin_unlock(&afu->contexts_lock);
++ mutex_unlock(&afu->contexts_lock);
+ return rc;
+ }
+
+diff --git a/drivers/misc/mei/hw-me.c b/drivers/misc/mei/hw-me.c
+index 4f2fd6fc1e23..432aec8dd3ce 100644
+--- a/drivers/misc/mei/hw-me.c
++++ b/drivers/misc/mei/hw-me.c
+@@ -234,6 +234,18 @@ static int mei_me_hw_reset(struct mei_device *dev, bool intr_enable)
+ struct mei_me_hw *hw = to_me_hw(dev);
+ u32 hcsr = mei_hcsr_read(hw);
+
++ /* H_RST may be found lit before reset is started,
++ * for example if preceding reset flow hasn't completed.
++ * In that case asserting H_RST will be ignored, therefore
++ * we need to clean H_RST bit to start a successful reset sequence.
++ */
++ if ((hcsr & H_RST) == H_RST) {
++ dev_warn(dev->dev, "H_RST is set = 0x%08X", hcsr);
++ hcsr &= ~H_RST;
++ mei_me_reg_write(hw, H_CSR, hcsr);
++ hcsr = mei_hcsr_read(hw);
++ }
++
+ hcsr |= H_RST | H_IG | H_IS;
+
+ if (intr_enable)
+diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c
+index 7625bd791fca..023c2010cd75 100644
+--- a/drivers/mmc/host/sdhci.c
++++ b/drivers/mmc/host/sdhci.c
+@@ -1239,6 +1239,12 @@ static void sdhci_set_power(struct sdhci_host *host, unsigned char mode,
+ spin_unlock_irq(&host->lock);
+ mmc_regulator_set_ocr(mmc, mmc->supply.vmmc, vdd);
+ spin_lock_irq(&host->lock);
++
++ if (mode != MMC_POWER_OFF)
++ sdhci_writeb(host, SDHCI_POWER_ON, SDHCI_POWER_CONTROL);
++ else
++ sdhci_writeb(host, 0, SDHCI_POWER_CONTROL);
++
+ return;
+ }
+
+diff --git a/drivers/net/can/usb/kvaser_usb.c b/drivers/net/can/usb/kvaser_usb.c
+index 541fb7a05625..cc7bfc0c0a71 100644
+--- a/drivers/net/can/usb/kvaser_usb.c
++++ b/drivers/net/can/usb/kvaser_usb.c
+@@ -1246,6 +1246,9 @@ static int kvaser_usb_close(struct net_device *netdev)
+ if (err)
+ netdev_warn(netdev, "Cannot stop device, error %d\n", err);
+
++ /* reset tx contexts */
++ kvaser_usb_unlink_tx_urbs(priv);
++
+ priv->can.state = CAN_STATE_STOPPED;
+ close_candev(priv->netdev);
+
+@@ -1294,12 +1297,14 @@ static netdev_tx_t kvaser_usb_start_xmit(struct sk_buff *skb,
+ if (!urb) {
+ netdev_err(netdev, "No memory left for URBs\n");
+ stats->tx_dropped++;
+- goto nourbmem;
++ dev_kfree_skb(skb);
++ return NETDEV_TX_OK;
+ }
+
+ buf = kmalloc(sizeof(struct kvaser_msg), GFP_ATOMIC);
+ if (!buf) {
+ stats->tx_dropped++;
++ dev_kfree_skb(skb);
+ goto nobufmem;
+ }
+
+@@ -1334,6 +1339,7 @@ static netdev_tx_t kvaser_usb_start_xmit(struct sk_buff *skb,
+ }
+ }
+
++ /* This should never happen; it implies a flow control bug */
+ if (!context) {
+ netdev_warn(netdev, "cannot find free context\n");
+ ret = NETDEV_TX_BUSY;
+@@ -1364,9 +1370,6 @@ static netdev_tx_t kvaser_usb_start_xmit(struct sk_buff *skb,
+ if (unlikely(err)) {
+ can_free_echo_skb(netdev, context->echo_index);
+
+- skb = NULL; /* set to NULL to avoid double free in
+- * dev_kfree_skb(skb) */
+-
+ atomic_dec(&priv->active_tx_urbs);
+ usb_unanchor_urb(urb);
+
+@@ -1388,8 +1391,6 @@ releasebuf:
+ kfree(buf);
+ nobufmem:
+ usb_free_urb(urb);
+-nourbmem:
+- dev_kfree_skb(skb);
+ return ret;
+ }
+
+@@ -1502,6 +1503,10 @@ static int kvaser_usb_init_one(struct usb_interface *intf,
+ struct kvaser_usb_net_priv *priv;
+ int i, err;
+
++ err = kvaser_usb_send_simple_msg(dev, CMD_RESET_CHIP, channel);
++ if (err)
++ return err;
++
+ netdev = alloc_candev(sizeof(*priv), MAX_TX_URBS);
+ if (!netdev) {
+ dev_err(&intf->dev, "Cannot alloc candev\n");
+@@ -1606,9 +1611,6 @@ static int kvaser_usb_probe(struct usb_interface *intf,
+
+ usb_set_intfdata(intf, dev);
+
+- for (i = 0; i < MAX_NET_DEVICES; i++)
+- kvaser_usb_send_simple_msg(dev, CMD_RESET_CHIP, i);
+-
+ err = kvaser_usb_get_software_info(dev);
+ if (err) {
+ dev_err(&intf->dev,
+diff --git a/drivers/net/ethernet/atheros/alx/main.c b/drivers/net/ethernet/atheros/alx/main.c
+index e398eda07298..c8af3ce3ea38 100644
+--- a/drivers/net/ethernet/atheros/alx/main.c
++++ b/drivers/net/ethernet/atheros/alx/main.c
+@@ -184,15 +184,16 @@ static void alx_schedule_reset(struct alx_priv *alx)
+ schedule_work(&alx->reset_wk);
+ }
+
+-static bool alx_clean_rx_irq(struct alx_priv *alx, int budget)
++static int alx_clean_rx_irq(struct alx_priv *alx, int budget)
+ {
+ struct alx_rx_queue *rxq = &alx->rxq;
+ struct alx_rrd *rrd;
+ struct alx_buffer *rxb;
+ struct sk_buff *skb;
+ u16 length, rfd_cleaned = 0;
++ int work = 0;
+
+- while (budget > 0) {
++ while (work < budget) {
+ rrd = &rxq->rrd[rxq->rrd_read_idx];
+ if (!(rrd->word3 & cpu_to_le32(1 << RRD_UPDATED_SHIFT)))
+ break;
+@@ -203,7 +204,7 @@ static bool alx_clean_rx_irq(struct alx_priv *alx, int budget)
+ ALX_GET_FIELD(le32_to_cpu(rrd->word0),
+ RRD_NOR) != 1) {
+ alx_schedule_reset(alx);
+- return 0;
++ return work;
+ }
+
+ rxb = &rxq->bufs[rxq->read_idx];
+@@ -243,7 +244,7 @@ static bool alx_clean_rx_irq(struct alx_priv *alx, int budget)
+ }
+
+ napi_gro_receive(&alx->napi, skb);
+- budget--;
++ work++;
+
+ next_pkt:
+ if (++rxq->read_idx == alx->rx_ringsz)
+@@ -258,21 +259,22 @@ next_pkt:
+ if (rfd_cleaned)
+ alx_refill_rx_ring(alx, GFP_ATOMIC);
+
+- return budget > 0;
++ return work;
+ }
+
+ static int alx_poll(struct napi_struct *napi, int budget)
+ {
+ struct alx_priv *alx = container_of(napi, struct alx_priv, napi);
+ struct alx_hw *hw = &alx->hw;
+- bool complete = true;
+ unsigned long flags;
++ bool tx_complete;
++ int work;
+
+- complete = alx_clean_tx_irq(alx) &&
+- alx_clean_rx_irq(alx, budget);
++ tx_complete = alx_clean_tx_irq(alx);
++ work = alx_clean_rx_irq(alx, budget);
+
+- if (!complete)
+- return 1;
++ if (!tx_complete || work == budget)
++ return budget;
+
+ napi_complete(&alx->napi);
+
+@@ -284,7 +286,7 @@ static int alx_poll(struct napi_struct *napi, int budget)
+
+ alx_post_write(hw);
+
+- return 0;
++ return work;
+ }
+
+ static irqreturn_t alx_intr_handle(struct alx_priv *alx, u32 intr)
+diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
+index 77f8f836cbbe..5748542f6717 100644
+--- a/drivers/net/ethernet/broadcom/tg3.c
++++ b/drivers/net/ethernet/broadcom/tg3.c
+@@ -17789,23 +17789,6 @@ static int tg3_init_one(struct pci_dev *pdev,
+ goto err_out_apeunmap;
+ }
+
+- /*
+- * Reset chip in case UNDI or EFI driver did not shutdown
+- * DMA self test will enable WDMAC and we'll see (spurious)
+- * pending DMA on the PCI bus at that point.
+- */
+- if ((tr32(HOSTCC_MODE) & HOSTCC_MODE_ENABLE) ||
+- (tr32(WDMAC_MODE) & WDMAC_MODE_ENABLE)) {
+- tw32(MEMARB_MODE, MEMARB_MODE_ENABLE);
+- tg3_halt(tp, RESET_KIND_SHUTDOWN, 1);
+- }
+-
+- err = tg3_test_dma(tp);
+- if (err) {
+- dev_err(&pdev->dev, "DMA engine test failed, aborting\n");
+- goto err_out_apeunmap;
+- }
+-
+ intmbx = MAILBOX_INTERRUPT_0 + TG3_64BIT_REG_LOW;
+ rcvmbx = MAILBOX_RCVRET_CON_IDX_0 + TG3_64BIT_REG_LOW;
+ sndmbx = MAILBOX_SNDHOST_PROD_IDX_0 + TG3_64BIT_REG_LOW;
+@@ -17850,6 +17833,23 @@ static int tg3_init_one(struct pci_dev *pdev,
+ sndmbx += 0xc;
+ }
+
++ /*
++ * Reset chip in case UNDI or EFI driver did not shutdown
++ * DMA self test will enable WDMAC and we'll see (spurious)
++ * pending DMA on the PCI bus at that point.
++ */
++ if ((tr32(HOSTCC_MODE) & HOSTCC_MODE_ENABLE) ||
++ (tr32(WDMAC_MODE) & WDMAC_MODE_ENABLE)) {
++ tw32(MEMARB_MODE, MEMARB_MODE_ENABLE);
++ tg3_halt(tp, RESET_KIND_SHUTDOWN, 1);
++ }
++
++ err = tg3_test_dma(tp);
++ if (err) {
++ dev_err(&pdev->dev, "DMA engine test failed, aborting\n");
++ goto err_out_apeunmap;
++ }
++
+ tg3_init_coal(tp);
+
+ pci_set_drvdata(pdev, dev);
+diff --git a/drivers/net/ethernet/cisco/enic/enic_main.c b/drivers/net/ethernet/cisco/enic/enic_main.c
+index 73cf1653a4a3..167cd8ede397 100644
+--- a/drivers/net/ethernet/cisco/enic/enic_main.c
++++ b/drivers/net/ethernet/cisco/enic/enic_main.c
+@@ -1059,10 +1059,14 @@ static void enic_rq_indicate_buf(struct vnic_rq *rq,
+ PKT_HASH_TYPE_L4 : PKT_HASH_TYPE_L3);
+ }
+
+- if ((netdev->features & NETIF_F_RXCSUM) && !csum_not_calc) {
+- skb->csum = htons(checksum);
+- skb->ip_summed = CHECKSUM_COMPLETE;
+- }
++ /* Hardware does not provide whole packet checksum. It only
++ * provides pseudo checksum. Since hw validates the packet
++ * checksum but not provide us the checksum value. use
++ * CHECSUM_UNNECESSARY.
++ */
++ if ((netdev->features & NETIF_F_RXCSUM) && tcp_udp_csum_ok &&
++ ipv4_csum_ok)
++ skb->ip_summed = CHECKSUM_UNNECESSARY;
+
+ if (vlan_stripped)
+ __vlan_hwaccel_put_tag(skb, htons(ETH_P_8021Q), vlan_tci);
+diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c
+index 597c463e384d..d2975fa7e549 100644
+--- a/drivers/net/ethernet/emulex/benet/be_main.c
++++ b/drivers/net/ethernet/emulex/benet/be_main.c
+@@ -4427,9 +4427,11 @@ static void be_del_vxlan_port(struct net_device *netdev, sa_family_t sa_family,
+ be16_to_cpu(port));
+ }
+
+-static bool be_gso_check(struct sk_buff *skb, struct net_device *dev)
++static netdev_features_t be_features_check(struct sk_buff *skb,
++ struct net_device *dev,
++ netdev_features_t features)
+ {
+- return vxlan_gso_check(skb);
++ return vxlan_features_check(skb, features);
+ }
+ #endif
+
+@@ -4460,7 +4462,7 @@ static const struct net_device_ops be_netdev_ops = {
+ #ifdef CONFIG_BE2NET_VXLAN
+ .ndo_add_vxlan_port = be_add_vxlan_port,
+ .ndo_del_vxlan_port = be_del_vxlan_port,
+- .ndo_gso_check = be_gso_check,
++ .ndo_features_check = be_features_check,
+ #endif
+ };
+
+diff --git a/drivers/net/ethernet/intel/Kconfig b/drivers/net/ethernet/intel/Kconfig
+index 5b8300a32bf5..4d61ef50b465 100644
+--- a/drivers/net/ethernet/intel/Kconfig
++++ b/drivers/net/ethernet/intel/Kconfig
+@@ -281,6 +281,17 @@ config I40E_DCB
+
+ If unsure, say N.
+
++config I40E_FCOE
++ bool "Fibre Channel over Ethernet (FCoE)"
++ default n
++ depends on I40E && DCB && FCOE
++ ---help---
++ Say Y here if you want to use Fibre Channel over Ethernet (FCoE)
++ in the driver. This will create new netdev for exclusive FCoE
++ use with XL710 FCoE offloads enabled.
++
++ If unsure, say N.
++
+ config I40EVF
+ tristate "Intel(R) XL710 X710 Virtual Function Ethernet support"
+ depends on PCI_MSI
+diff --git a/drivers/net/ethernet/intel/i40e/Makefile b/drivers/net/ethernet/intel/i40e/Makefile
+index 4b94ddb29c24..c40581999121 100644
+--- a/drivers/net/ethernet/intel/i40e/Makefile
++++ b/drivers/net/ethernet/intel/i40e/Makefile
+@@ -44,4 +44,4 @@ i40e-objs := i40e_main.o \
+ i40e_virtchnl_pf.o
+
+ i40e-$(CONFIG_I40E_DCB) += i40e_dcb.o i40e_dcb_nl.o
+-i40e-$(CONFIG_FCOE:m=y) += i40e_fcoe.o
++i40e-$(CONFIG_I40E_FCOE) += i40e_fcoe.o
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_osdep.h b/drivers/net/ethernet/intel/i40e/i40e_osdep.h
+index 045b5c4b98b3..ad802dd0f67a 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_osdep.h
++++ b/drivers/net/ethernet/intel/i40e/i40e_osdep.h
+@@ -78,7 +78,7 @@ do { \
+ } while (0)
+
+ typedef enum i40e_status_code i40e_status;
+-#if defined(CONFIG_FCOE) || defined(CONFIG_FCOE_MODULE)
++#ifdef CONFIG_I40E_FCOE
+ #define I40E_FCOE
+-#endif /* CONFIG_FCOE or CONFIG_FCOE_MODULE */
++#endif
+ #endif /* _I40E_OSDEP_H_ */
+diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+index 4d69e382b4e5..6bdaa313e7ea 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
++++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+@@ -1569,8 +1569,15 @@ int mlx4_en_start_port(struct net_device *dev)
+ mlx4_en_free_affinity_hint(priv, i);
+ goto cq_err;
+ }
+- for (j = 0; j < cq->size; j++)
+- cq->buf[j].owner_sr_opcode = MLX4_CQE_OWNER_MASK;
++
++ for (j = 0; j < cq->size; j++) {
++ struct mlx4_cqe *cqe = NULL;
++
++ cqe = mlx4_en_get_cqe(cq->buf, j, priv->cqe_size) +
++ priv->cqe_factor;
++ cqe->owner_sr_opcode = MLX4_CQE_OWNER_MASK;
++ }
++
+ err = mlx4_en_set_cq_moder(priv, cq);
+ if (err) {
+ en_err(priv, "Failed setting cq moderation parameters\n");
+@@ -2356,9 +2363,11 @@ static void mlx4_en_del_vxlan_port(struct net_device *dev,
+ queue_work(priv->mdev->workqueue, &priv->vxlan_del_task);
+ }
+
+-static bool mlx4_en_gso_check(struct sk_buff *skb, struct net_device *dev)
++static netdev_features_t mlx4_en_features_check(struct sk_buff *skb,
++ struct net_device *dev,
++ netdev_features_t features)
+ {
+- return vxlan_gso_check(skb);
++ return vxlan_features_check(skb, features);
+ }
+ #endif
+
+@@ -2391,7 +2400,7 @@ static const struct net_device_ops mlx4_netdev_ops = {
+ #ifdef CONFIG_MLX4_EN_VXLAN
+ .ndo_add_vxlan_port = mlx4_en_add_vxlan_port,
+ .ndo_del_vxlan_port = mlx4_en_del_vxlan_port,
+- .ndo_gso_check = mlx4_en_gso_check,
++ .ndo_features_check = mlx4_en_features_check,
+ #endif
+ };
+
+@@ -2425,7 +2434,7 @@ static const struct net_device_ops mlx4_netdev_ops_master = {
+ #ifdef CONFIG_MLX4_EN_VXLAN
+ .ndo_add_vxlan_port = mlx4_en_add_vxlan_port,
+ .ndo_del_vxlan_port = mlx4_en_del_vxlan_port,
+- .ndo_gso_check = mlx4_en_gso_check,
++ .ndo_features_check = mlx4_en_features_check,
+ #endif
+ };
+
+diff --git a/drivers/net/ethernet/mellanox/mlx4/en_tx.c b/drivers/net/ethernet/mellanox/mlx4/en_tx.c
+index 454d9fea640e..11ff28b5fca3 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/en_tx.c
++++ b/drivers/net/ethernet/mellanox/mlx4/en_tx.c
+@@ -954,7 +954,17 @@ netdev_tx_t mlx4_en_xmit(struct sk_buff *skb, struct net_device *dev)
+ tx_desc->ctrl.owner_opcode = op_own;
+ if (send_doorbell) {
+ wmb();
+- iowrite32(ring->doorbell_qpn,
++ /* Since there is no iowrite*_native() that writes the
++ * value as is, without byteswapping - using the one
++ * the doesn't do byteswapping in the relevant arch
++ * endianness.
++ */
++#if defined(__LITTLE_ENDIAN)
++ iowrite32(
++#else
++ iowrite32be(
++#endif
++ ring->doorbell_qpn,
+ ring->bf.uar->map + MLX4_SEND_DOORBELL);
+ } else {
+ ring->xmit_more++;
+diff --git a/drivers/net/ethernet/mellanox/mlx4/fw.c b/drivers/net/ethernet/mellanox/mlx4/fw.c
+index 2e88a235e26b..5f1228794328 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/fw.c
++++ b/drivers/net/ethernet/mellanox/mlx4/fw.c
+@@ -1647,8 +1647,8 @@ int mlx4_QUERY_HCA(struct mlx4_dev *dev,
+ /* CX3 is capable of extending CQEs\EQEs to strides larger than 64B */
+ MLX4_GET(byte_field, outbox, INIT_HCA_EQE_CQE_STRIDE_OFFSET);
+ if (byte_field) {
+- param->dev_cap_enabled |= MLX4_DEV_CAP_64B_EQE_ENABLED;
+- param->dev_cap_enabled |= MLX4_DEV_CAP_64B_CQE_ENABLED;
++ param->dev_cap_enabled |= MLX4_DEV_CAP_EQE_STRIDE_ENABLED;
++ param->dev_cap_enabled |= MLX4_DEV_CAP_CQE_STRIDE_ENABLED;
+ param->cqe_size = 1 << ((byte_field &
+ MLX4_CQE_SIZE_MASK_STRIDE) + 5);
+ param->eqe_size = 1 << (((byte_field &
+diff --git a/drivers/net/ethernet/mellanox/mlx4/mr.c b/drivers/net/ethernet/mellanox/mlx4/mr.c
+index 193a6adb5d04..b7cdef0aebd6 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/mr.c
++++ b/drivers/net/ethernet/mellanox/mlx4/mr.c
+@@ -590,6 +590,7 @@ EXPORT_SYMBOL_GPL(mlx4_mr_free);
+ void mlx4_mr_rereg_mem_cleanup(struct mlx4_dev *dev, struct mlx4_mr *mr)
+ {
+ mlx4_mtt_cleanup(dev, &mr->mtt);
++ mr->mtt.order = -1;
+ }
+ EXPORT_SYMBOL_GPL(mlx4_mr_rereg_mem_cleanup);
+
+@@ -599,14 +600,14 @@ int mlx4_mr_rereg_mem_write(struct mlx4_dev *dev, struct mlx4_mr *mr,
+ {
+ int err;
+
+- mpt_entry->start = cpu_to_be64(iova);
+- mpt_entry->length = cpu_to_be64(size);
+- mpt_entry->entity_size = cpu_to_be32(page_shift);
+-
+ err = mlx4_mtt_init(dev, npages, page_shift, &mr->mtt);
+ if (err)
+ return err;
+
++ mpt_entry->start = cpu_to_be64(mr->iova);
++ mpt_entry->length = cpu_to_be64(mr->size);
++ mpt_entry->entity_size = cpu_to_be32(mr->mtt.page_shift);
++
+ mpt_entry->pd_flags &= cpu_to_be32(MLX4_MPT_PD_MASK |
+ MLX4_MPT_PD_FLAG_EN_INV);
+ mpt_entry->flags &= cpu_to_be32(MLX4_MPT_FLAG_FREE |
+diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
+index a913b3ad2f89..477a5d33d79c 100644
+--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
+@@ -504,9 +504,11 @@ static void qlcnic_del_vxlan_port(struct net_device *netdev,
+ adapter->flags |= QLCNIC_DEL_VXLAN_PORT;
+ }
+
+-static bool qlcnic_gso_check(struct sk_buff *skb, struct net_device *dev)
++static netdev_features_t qlcnic_features_check(struct sk_buff *skb,
++ struct net_device *dev,
++ netdev_features_t features)
+ {
+- return vxlan_gso_check(skb);
++ return vxlan_features_check(skb, features);
+ }
+ #endif
+
+@@ -531,7 +533,7 @@ static const struct net_device_ops qlcnic_netdev_ops = {
+ #ifdef CONFIG_QLCNIC_VXLAN
+ .ndo_add_vxlan_port = qlcnic_add_vxlan_port,
+ .ndo_del_vxlan_port = qlcnic_del_vxlan_port,
+- .ndo_gso_check = qlcnic_gso_check,
++ .ndo_features_check = qlcnic_features_check,
+ #endif
+ #ifdef CONFIG_NET_POLL_CONTROLLER
+ .ndo_poll_controller = qlcnic_poll_controller,
+diff --git a/drivers/net/ethernet/ti/cpsw.c b/drivers/net/ethernet/ti/cpsw.c
+index c560f9aeb55d..64d1cef4cda1 100644
+--- a/drivers/net/ethernet/ti/cpsw.c
++++ b/drivers/net/ethernet/ti/cpsw.c
+@@ -610,7 +610,7 @@ static void cpsw_set_promiscious(struct net_device *ndev, bool enable)
+
+ /* Clear all mcast from ALE */
+ cpsw_ale_flush_multicast(ale, ALE_ALL_PORTS <<
+- priv->host_port);
++ priv->host_port, -1);
+
+ /* Flood All Unicast Packets to Host port */
+ cpsw_ale_control_set(ale, 0, ALE_P0_UNI_FLOOD, 1);
+@@ -634,6 +634,12 @@ static void cpsw_set_promiscious(struct net_device *ndev, bool enable)
+ static void cpsw_ndo_set_rx_mode(struct net_device *ndev)
+ {
+ struct cpsw_priv *priv = netdev_priv(ndev);
++ int vid;
++
++ if (priv->data.dual_emac)
++ vid = priv->slaves[priv->emac_port].port_vlan;
++ else
++ vid = priv->data.default_vlan;
+
+ if (ndev->flags & IFF_PROMISC) {
+ /* Enable promiscuous mode */
+@@ -649,7 +655,8 @@ static void cpsw_ndo_set_rx_mode(struct net_device *ndev)
+ cpsw_ale_set_allmulti(priv->ale, priv->ndev->flags & IFF_ALLMULTI);
+
+ /* Clear all mcast from ALE */
+- cpsw_ale_flush_multicast(priv->ale, ALE_ALL_PORTS << priv->host_port);
++ cpsw_ale_flush_multicast(priv->ale, ALE_ALL_PORTS << priv->host_port,
++ vid);
+
+ if (!netdev_mc_empty(ndev)) {
+ struct netdev_hw_addr *ha;
+@@ -757,6 +764,14 @@ requeue:
+ static irqreturn_t cpsw_interrupt(int irq, void *dev_id)
+ {
+ struct cpsw_priv *priv = dev_id;
++ int value = irq - priv->irqs_table[0];
++
++ /* NOTICE: Ending IRQ here. The trick with the 'value' variable above
++ * is to make sure we will always write the correct value to the EOI
++ * register. Namely 0 for RX_THRESH Interrupt, 1 for RX Interrupt, 2
++ * for TX Interrupt and 3 for MISC Interrupt.
++ */
++ cpdma_ctlr_eoi(priv->dma, value);
+
+ cpsw_intr_disable(priv);
+ if (priv->irq_enabled == true) {
+@@ -786,8 +801,6 @@ static int cpsw_poll(struct napi_struct *napi, int budget)
+ int num_tx, num_rx;
+
+ num_tx = cpdma_chan_process(priv->txch, 128);
+- if (num_tx)
+- cpdma_ctlr_eoi(priv->dma, CPDMA_EOI_TX);
+
+ num_rx = cpdma_chan_process(priv->rxch, budget);
+ if (num_rx < budget) {
+@@ -795,7 +808,6 @@ static int cpsw_poll(struct napi_struct *napi, int budget)
+
+ napi_complete(napi);
+ cpsw_intr_enable(priv);
+- cpdma_ctlr_eoi(priv->dma, CPDMA_EOI_RX);
+ prim_cpsw = cpsw_get_slave_priv(priv, 0);
+ if (prim_cpsw->irq_enabled == false) {
+ prim_cpsw->irq_enabled = true;
+@@ -1310,8 +1322,6 @@ static int cpsw_ndo_open(struct net_device *ndev)
+ napi_enable(&priv->napi);
+ cpdma_ctlr_start(priv->dma);
+ cpsw_intr_enable(priv);
+- cpdma_ctlr_eoi(priv->dma, CPDMA_EOI_RX);
+- cpdma_ctlr_eoi(priv->dma, CPDMA_EOI_TX);
+
+ prim_cpsw = cpsw_get_slave_priv(priv, 0);
+ if (prim_cpsw->irq_enabled == false) {
+@@ -1578,9 +1588,6 @@ static void cpsw_ndo_tx_timeout(struct net_device *ndev)
+ cpdma_chan_start(priv->txch);
+ cpdma_ctlr_int_ctrl(priv->dma, true);
+ cpsw_intr_enable(priv);
+- cpdma_ctlr_eoi(priv->dma, CPDMA_EOI_RX);
+- cpdma_ctlr_eoi(priv->dma, CPDMA_EOI_TX);
+-
+ }
+
+ static int cpsw_ndo_set_mac_address(struct net_device *ndev, void *p)
+@@ -1620,9 +1627,6 @@ static void cpsw_ndo_poll_controller(struct net_device *ndev)
+ cpsw_interrupt(ndev->irq, priv);
+ cpdma_ctlr_int_ctrl(priv->dma, true);
+ cpsw_intr_enable(priv);
+- cpdma_ctlr_eoi(priv->dma, CPDMA_EOI_RX);
+- cpdma_ctlr_eoi(priv->dma, CPDMA_EOI_TX);
+-
+ }
+ #endif
+
+diff --git a/drivers/net/ethernet/ti/cpsw_ale.c b/drivers/net/ethernet/ti/cpsw_ale.c
+index 097ebe7077ac..5246b3a18ff8 100644
+--- a/drivers/net/ethernet/ti/cpsw_ale.c
++++ b/drivers/net/ethernet/ti/cpsw_ale.c
+@@ -234,7 +234,7 @@ static void cpsw_ale_flush_mcast(struct cpsw_ale *ale, u32 *ale_entry,
+ cpsw_ale_set_entry_type(ale_entry, ALE_TYPE_FREE);
+ }
+
+-int cpsw_ale_flush_multicast(struct cpsw_ale *ale, int port_mask)
++int cpsw_ale_flush_multicast(struct cpsw_ale *ale, int port_mask, int vid)
+ {
+ u32 ale_entry[ALE_ENTRY_WORDS];
+ int ret, idx;
+@@ -245,6 +245,14 @@ int cpsw_ale_flush_multicast(struct cpsw_ale *ale, int port_mask)
+ if (ret != ALE_TYPE_ADDR && ret != ALE_TYPE_VLAN_ADDR)
+ continue;
+
++ /* if vid passed is -1 then remove all multicast entry from
++ * the table irrespective of vlan id, if a valid vlan id is
++ * passed then remove only multicast added to that vlan id.
++ * if vlan id doesn't match then move on to next entry.
++ */
++ if (vid != -1 && cpsw_ale_get_vlan_id(ale_entry) != vid)
++ continue;
++
+ if (cpsw_ale_get_mcast(ale_entry)) {
+ u8 addr[6];
+
+diff --git a/drivers/net/ethernet/ti/cpsw_ale.h b/drivers/net/ethernet/ti/cpsw_ale.h
+index c0d4127aa549..af1e7ecd87c6 100644
+--- a/drivers/net/ethernet/ti/cpsw_ale.h
++++ b/drivers/net/ethernet/ti/cpsw_ale.h
+@@ -92,7 +92,7 @@ void cpsw_ale_stop(struct cpsw_ale *ale);
+
+ int cpsw_ale_set_ageout(struct cpsw_ale *ale, int ageout);
+ int cpsw_ale_flush(struct cpsw_ale *ale, int port_mask);
+-int cpsw_ale_flush_multicast(struct cpsw_ale *ale, int port_mask);
++int cpsw_ale_flush_multicast(struct cpsw_ale *ale, int port_mask, int vid);
+ int cpsw_ale_add_ucast(struct cpsw_ale *ale, u8 *addr, int port,
+ int flags, u16 vid);
+ int cpsw_ale_del_ucast(struct cpsw_ale *ale, u8 *addr, int port,
+diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
+index 2368395d8ae5..9c505c4dbe04 100644
+--- a/drivers/net/team/team.c
++++ b/drivers/net/team/team.c
+@@ -629,6 +629,7 @@ static int team_change_mode(struct team *team, const char *kind)
+ static void team_notify_peers_work(struct work_struct *work)
+ {
+ struct team *team;
++ int val;
+
+ team = container_of(work, struct team, notify_peers.dw.work);
+
+@@ -636,9 +637,14 @@ static void team_notify_peers_work(struct work_struct *work)
+ schedule_delayed_work(&team->notify_peers.dw, 0);
+ return;
+ }
++ val = atomic_dec_if_positive(&team->notify_peers.count_pending);
++ if (val < 0) {
++ rtnl_unlock();
++ return;
++ }
+ call_netdevice_notifiers(NETDEV_NOTIFY_PEERS, team->dev);
+ rtnl_unlock();
+- if (!atomic_dec_and_test(&team->notify_peers.count_pending))
++ if (val)
+ schedule_delayed_work(&team->notify_peers.dw,
+ msecs_to_jiffies(team->notify_peers.interval));
+ }
+@@ -669,6 +675,7 @@ static void team_notify_peers_fini(struct team *team)
+ static void team_mcast_rejoin_work(struct work_struct *work)
+ {
+ struct team *team;
++ int val;
+
+ team = container_of(work, struct team, mcast_rejoin.dw.work);
+
+@@ -676,9 +683,14 @@ static void team_mcast_rejoin_work(struct work_struct *work)
+ schedule_delayed_work(&team->mcast_rejoin.dw, 0);
+ return;
+ }
++ val = atomic_dec_if_positive(&team->mcast_rejoin.count_pending);
++ if (val < 0) {
++ rtnl_unlock();
++ return;
++ }
+ call_netdevice_notifiers(NETDEV_RESEND_IGMP, team->dev);
+ rtnl_unlock();
+- if (!atomic_dec_and_test(&team->mcast_rejoin.count_pending))
++ if (val)
+ schedule_delayed_work(&team->mcast_rejoin.dw,
+ msecs_to_jiffies(team->mcast_rejoin.interval));
+ }
+diff --git a/drivers/net/wireless/iwlwifi/mvm/utils.c b/drivers/net/wireless/iwlwifi/mvm/utils.c
+index 8021f6eec27f..41ae16435300 100644
+--- a/drivers/net/wireless/iwlwifi/mvm/utils.c
++++ b/drivers/net/wireless/iwlwifi/mvm/utils.c
+@@ -665,7 +665,7 @@ bool iwl_mvm_rx_diversity_allowed(struct iwl_mvm *mvm)
+ if (num_of_ant(mvm->fw->valid_rx_ant) == 1)
+ return false;
+
+- if (!mvm->cfg->rx_with_siso_diversity)
++ if (mvm->cfg->rx_with_siso_diversity)
+ return false;
+
+ ieee80211_iterate_active_interfaces_atomic(
+diff --git a/drivers/net/wireless/rtlwifi/pci.c b/drivers/net/wireless/rtlwifi/pci.c
+index 846a2e6e34d8..c70efb9a6e78 100644
+--- a/drivers/net/wireless/rtlwifi/pci.c
++++ b/drivers/net/wireless/rtlwifi/pci.c
+@@ -666,7 +666,8 @@ tx_status_ok:
+ }
+
+ static int _rtl_pci_init_one_rxdesc(struct ieee80211_hw *hw,
+- u8 *entry, int rxring_idx, int desc_idx)
++ struct sk_buff *new_skb, u8 *entry,
++ int rxring_idx, int desc_idx)
+ {
+ struct rtl_priv *rtlpriv = rtl_priv(hw);
+ struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
+@@ -674,11 +675,15 @@ static int _rtl_pci_init_one_rxdesc(struct ieee80211_hw *hw,
+ u8 tmp_one = 1;
+ struct sk_buff *skb;
+
++ if (likely(new_skb)) {
++ skb = new_skb;
++ goto remap;
++ }
+ skb = dev_alloc_skb(rtlpci->rxbuffersize);
+ if (!skb)
+ return 0;
+- rtlpci->rx_ring[rxring_idx].rx_buf[desc_idx] = skb;
+
++remap:
+ /* just set skb->cb to mapping addr for pci_unmap_single use */
+ *((dma_addr_t *)skb->cb) =
+ pci_map_single(rtlpci->pdev, skb_tail_pointer(skb),
+@@ -686,6 +691,7 @@ static int _rtl_pci_init_one_rxdesc(struct ieee80211_hw *hw,
+ bufferaddress = *((dma_addr_t *)skb->cb);
+ if (pci_dma_mapping_error(rtlpci->pdev, bufferaddress))
+ return 0;
++ rtlpci->rx_ring[rxring_idx].rx_buf[desc_idx] = skb;
+ if (rtlpriv->use_new_trx_flow) {
+ rtlpriv->cfg->ops->set_desc(hw, (u8 *)entry, false,
+ HW_DESC_RX_PREPARE,
+@@ -781,6 +787,7 @@ static void _rtl_pci_rx_interrupt(struct ieee80211_hw *hw)
+ /*rx pkt */
+ struct sk_buff *skb = rtlpci->rx_ring[rxring_idx].rx_buf[
+ rtlpci->rx_ring[rxring_idx].idx];
++ struct sk_buff *new_skb;
+
+ if (rtlpriv->use_new_trx_flow) {
+ rx_remained_cnt =
+@@ -807,6 +814,13 @@ static void _rtl_pci_rx_interrupt(struct ieee80211_hw *hw)
+ pci_unmap_single(rtlpci->pdev, *((dma_addr_t *)skb->cb),
+ rtlpci->rxbuffersize, PCI_DMA_FROMDEVICE);
+
++ /* get a new skb - if fail, old one will be reused */
++ new_skb = dev_alloc_skb(rtlpci->rxbuffersize);
++ if (unlikely(!new_skb)) {
++ pr_err("Allocation of new skb failed in %s\n",
++ __func__);
++ goto no_new;
++ }
+ if (rtlpriv->use_new_trx_flow) {
+ buffer_desc =
+ &rtlpci->rx_ring[rxring_idx].buffer_desc
+@@ -911,14 +925,16 @@ static void _rtl_pci_rx_interrupt(struct ieee80211_hw *hw)
+ schedule_work(&rtlpriv->works.lps_change_work);
+ }
+ end:
++ skb = new_skb;
++no_new:
+ if (rtlpriv->use_new_trx_flow) {
+- _rtl_pci_init_one_rxdesc(hw, (u8 *)buffer_desc,
++ _rtl_pci_init_one_rxdesc(hw, skb, (u8 *)buffer_desc,
+ rxring_idx,
+- rtlpci->rx_ring[rxring_idx].idx);
++ rtlpci->rx_ring[rxring_idx].idx);
+ } else {
+- _rtl_pci_init_one_rxdesc(hw, (u8 *)pdesc, rxring_idx,
++ _rtl_pci_init_one_rxdesc(hw, skb, (u8 *)pdesc,
++ rxring_idx,
+ rtlpci->rx_ring[rxring_idx].idx);
+-
+ if (rtlpci->rx_ring[rxring_idx].idx ==
+ rtlpci->rxringcount - 1)
+ rtlpriv->cfg->ops->set_desc(hw, (u8 *)pdesc,
+@@ -1307,7 +1323,7 @@ static int _rtl_pci_init_rx_ring(struct ieee80211_hw *hw, int rxring_idx)
+ rtlpci->rx_ring[rxring_idx].idx = 0;
+ for (i = 0; i < rtlpci->rxringcount; i++) {
+ entry = &rtlpci->rx_ring[rxring_idx].buffer_desc[i];
+- if (!_rtl_pci_init_one_rxdesc(hw, (u8 *)entry,
++ if (!_rtl_pci_init_one_rxdesc(hw, NULL, (u8 *)entry,
+ rxring_idx, i))
+ return -ENOMEM;
+ }
+@@ -1332,7 +1348,7 @@ static int _rtl_pci_init_rx_ring(struct ieee80211_hw *hw, int rxring_idx)
+
+ for (i = 0; i < rtlpci->rxringcount; i++) {
+ entry = &rtlpci->rx_ring[rxring_idx].desc[i];
+- if (!_rtl_pci_init_one_rxdesc(hw, (u8 *)entry,
++ if (!_rtl_pci_init_one_rxdesc(hw, NULL, (u8 *)entry,
+ rxring_idx, i))
+ return -ENOMEM;
+ }
+diff --git a/drivers/net/wireless/rtlwifi/rtl8192ce/hw.c b/drivers/net/wireless/rtlwifi/rtl8192ce/hw.c
+index d2ec5160bbf0..5c646d5f7bb8 100644
+--- a/drivers/net/wireless/rtlwifi/rtl8192ce/hw.c
++++ b/drivers/net/wireless/rtlwifi/rtl8192ce/hw.c
+@@ -955,6 +955,7 @@ int rtl92ce_hw_init(struct ieee80211_hw *hw)
+ local_save_flags(flags);
+ local_irq_enable();
+
++ rtlhal->fw_ready = false;
+ rtlpriv->intf_ops->disable_aspm(hw);
+ rtstatus = _rtl92ce_init_mac(hw);
+ if (!rtstatus) {
+@@ -971,6 +972,7 @@ int rtl92ce_hw_init(struct ieee80211_hw *hw)
+ goto exit;
+ }
+
++ rtlhal->fw_ready = true;
+ rtlhal->last_hmeboxnum = 0;
+ rtl92c_phy_mac_config(hw);
+ /* because last function modify RCR, so we update
+diff --git a/drivers/net/xen-netback/common.h b/drivers/net/xen-netback/common.h
+index 083ecc93fe5e..5f1fda44882b 100644
+--- a/drivers/net/xen-netback/common.h
++++ b/drivers/net/xen-netback/common.h
+@@ -230,6 +230,8 @@ struct xenvif {
+ */
+ bool disabled;
+ unsigned long status;
++ unsigned long drain_timeout;
++ unsigned long stall_timeout;
+
+ /* Queues */
+ struct xenvif_queue *queues;
+@@ -328,7 +330,7 @@ irqreturn_t xenvif_interrupt(int irq, void *dev_id);
+ extern bool separate_tx_rx_irq;
+
+ extern unsigned int rx_drain_timeout_msecs;
+-extern unsigned int rx_drain_timeout_jiffies;
++extern unsigned int rx_stall_timeout_msecs;
+ extern unsigned int xenvif_max_queues;
+
+ #ifdef CONFIG_DEBUG_FS
+diff --git a/drivers/net/xen-netback/interface.c b/drivers/net/xen-netback/interface.c
+index 895fe84011e7..d752d1c5c8bd 100644
+--- a/drivers/net/xen-netback/interface.c
++++ b/drivers/net/xen-netback/interface.c
+@@ -166,7 +166,7 @@ static int xenvif_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ goto drop;
+
+ cb = XENVIF_RX_CB(skb);
+- cb->expires = jiffies + rx_drain_timeout_jiffies;
++ cb->expires = jiffies + vif->drain_timeout;
+
+ xenvif_rx_queue_tail(queue, skb);
+ xenvif_kick_thread(queue);
+@@ -414,6 +414,8 @@ struct xenvif *xenvif_alloc(struct device *parent, domid_t domid,
+ vif->ip_csum = 1;
+ vif->dev = dev;
+ vif->disabled = false;
++ vif->drain_timeout = msecs_to_jiffies(rx_drain_timeout_msecs);
++ vif->stall_timeout = msecs_to_jiffies(rx_stall_timeout_msecs);
+
+ /* Start out with no queues. */
+ vif->queues = NULL;
+diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c
+index 6563f0713fc0..c39aace4f642 100644
+--- a/drivers/net/xen-netback/netback.c
++++ b/drivers/net/xen-netback/netback.c
+@@ -60,14 +60,12 @@ module_param(separate_tx_rx_irq, bool, 0644);
+ */
+ unsigned int rx_drain_timeout_msecs = 10000;
+ module_param(rx_drain_timeout_msecs, uint, 0444);
+-unsigned int rx_drain_timeout_jiffies;
+
+ /* The length of time before the frontend is considered unresponsive
+ * because it isn't providing Rx slots.
+ */
+-static unsigned int rx_stall_timeout_msecs = 60000;
++unsigned int rx_stall_timeout_msecs = 60000;
+ module_param(rx_stall_timeout_msecs, uint, 0444);
+-static unsigned int rx_stall_timeout_jiffies;
+
+ unsigned int xenvif_max_queues;
+ module_param_named(max_queues, xenvif_max_queues, uint, 0644);
+@@ -2022,7 +2020,7 @@ static bool xenvif_rx_queue_stalled(struct xenvif_queue *queue)
+ return !queue->stalled
+ && prod - cons < XEN_NETBK_RX_SLOTS_MAX
+ && time_after(jiffies,
+- queue->last_rx_time + rx_stall_timeout_jiffies);
++ queue->last_rx_time + queue->vif->stall_timeout);
+ }
+
+ static bool xenvif_rx_queue_ready(struct xenvif_queue *queue)
+@@ -2040,8 +2038,9 @@ static bool xenvif_have_rx_work(struct xenvif_queue *queue)
+ {
+ return (!skb_queue_empty(&queue->rx_queue)
+ && xenvif_rx_ring_slots_available(queue, XEN_NETBK_RX_SLOTS_MAX))
+- || xenvif_rx_queue_stalled(queue)
+- || xenvif_rx_queue_ready(queue)
++ || (queue->vif->stall_timeout &&
++ (xenvif_rx_queue_stalled(queue)
++ || xenvif_rx_queue_ready(queue)))
+ || kthread_should_stop()
+ || queue->vif->disabled;
+ }
+@@ -2094,6 +2093,9 @@ int xenvif_kthread_guest_rx(void *data)
+ struct xenvif_queue *queue = data;
+ struct xenvif *vif = queue->vif;
+
++ if (!vif->stall_timeout)
++ xenvif_queue_carrier_on(queue);
++
+ for (;;) {
+ xenvif_wait_for_rx_work(queue);
+
+@@ -2120,10 +2122,12 @@ int xenvif_kthread_guest_rx(void *data)
+ * while it's probably not responsive, drop the
+ * carrier so packets are dropped earlier.
+ */
+- if (xenvif_rx_queue_stalled(queue))
+- xenvif_queue_carrier_off(queue);
+- else if (xenvif_rx_queue_ready(queue))
+- xenvif_queue_carrier_on(queue);
++ if (vif->stall_timeout) {
++ if (xenvif_rx_queue_stalled(queue))
++ xenvif_queue_carrier_off(queue);
++ else if (xenvif_rx_queue_ready(queue))
++ xenvif_queue_carrier_on(queue);
++ }
+
+ /* Queued packets may have foreign pages from other
+ * domains. These cannot be queued indefinitely as
+@@ -2194,9 +2198,6 @@ static int __init netback_init(void)
+ if (rc)
+ goto failed_init;
+
+- rx_drain_timeout_jiffies = msecs_to_jiffies(rx_drain_timeout_msecs);
+- rx_stall_timeout_jiffies = msecs_to_jiffies(rx_stall_timeout_msecs);
+-
+ #ifdef CONFIG_DEBUG_FS
+ xen_netback_dbg_root = debugfs_create_dir("xen-netback", NULL);
+ if (IS_ERR_OR_NULL(xen_netback_dbg_root))
+diff --git a/drivers/net/xen-netback/xenbus.c b/drivers/net/xen-netback/xenbus.c
+index fab0d4b42f58..c047282c4ee0 100644
+--- a/drivers/net/xen-netback/xenbus.c
++++ b/drivers/net/xen-netback/xenbus.c
+@@ -736,6 +736,7 @@ static void connect(struct backend_info *be)
+ }
+
+ queue->remaining_credit = credit_bytes;
++ queue->credit_usec = credit_usec;
+
+ err = connect_rings(be, queue);
+ if (err) {
+@@ -886,9 +887,15 @@ static int read_xenbus_vif_flags(struct backend_info *be)
+ return -EOPNOTSUPP;
+
+ if (xenbus_scanf(XBT_NIL, dev->otherend,
+- "feature-rx-notify", "%d", &val) < 0 || val == 0) {
+- xenbus_dev_fatal(dev, -EINVAL, "feature-rx-notify is mandatory");
+- return -EINVAL;
++ "feature-rx-notify", "%d", &val) < 0)
++ val = 0;
++ if (!val) {
++ /* - Reduce drain timeout to poll more frequently for
++ * Rx requests.
++ * - Disable Rx stall detection.
++ */
++ be->vif->drain_timeout = msecs_to_jiffies(30);
++ be->vif->stall_timeout = 0;
+ }
+
+ if (xenbus_scanf(XBT_NIL, dev->otherend, "feature-sg",
+diff --git a/drivers/pinctrl/pinctrl-xway.c b/drivers/pinctrl/pinctrl-xway.c
+index 37040ab42890..fdff39ff5021 100644
+--- a/drivers/pinctrl/pinctrl-xway.c
++++ b/drivers/pinctrl/pinctrl-xway.c
+@@ -798,10 +798,8 @@ static int pinmux_xway_probe(struct platform_device *pdev)
+
+ /* load the gpio chip */
+ xway_chip.dev = &pdev->dev;
+- of_gpiochip_add(&xway_chip);
+ ret = gpiochip_add(&xway_chip);
+ if (ret) {
+- of_gpiochip_remove(&xway_chip);
+ dev_err(&pdev->dev, "Failed to register gpio chip\n");
+ return ret;
+ }
+diff --git a/drivers/platform/x86/asus-nb-wmi.c b/drivers/platform/x86/asus-nb-wmi.c
+index c1a6cd66af42..abdaed34c728 100644
+--- a/drivers/platform/x86/asus-nb-wmi.c
++++ b/drivers/platform/x86/asus-nb-wmi.c
+@@ -191,6 +191,15 @@ static const struct dmi_system_id asus_quirks[] = {
+ },
+ {
+ .callback = dmi_matched,
++ .ident = "ASUSTeK COMPUTER INC. X551CA",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "X551CA"),
++ },
++ .driver_data = &quirk_asus_wapf4,
++ },
++ {
++ .callback = dmi_matched,
+ .ident = "ASUSTeK COMPUTER INC. X55A",
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
+diff --git a/drivers/platform/x86/hp_accel.c b/drivers/platform/x86/hp_accel.c
+index 6bec745b6b92..10ce6cba4455 100644
+--- a/drivers/platform/x86/hp_accel.c
++++ b/drivers/platform/x86/hp_accel.c
+@@ -246,6 +246,7 @@ static const struct dmi_system_id lis3lv02d_dmi_ids[] = {
+ AXIS_DMI_MATCH("HPB64xx", "HP ProBook 64", xy_swap),
+ AXIS_DMI_MATCH("HPB64xx", "HP EliteBook 84", xy_swap),
+ AXIS_DMI_MATCH("HPB65xx", "HP ProBook 65", x_inverted),
++ AXIS_DMI_MATCH("HPZBook15", "HP ZBook 15", x_inverted),
+ { NULL, }
+ /* Laptop models without axis info (yet):
+ * "NC6910" "HP Compaq 6910"
+diff --git a/drivers/reset/reset-sunxi.c b/drivers/reset/reset-sunxi.c
+index a94e7a7820b4..51272b5d7552 100644
+--- a/drivers/reset/reset-sunxi.c
++++ b/drivers/reset/reset-sunxi.c
+@@ -102,6 +102,8 @@ static int sunxi_reset_init(struct device_node *np)
+ goto err_alloc;
+ }
+
++ spin_lock_init(&data->lock);
++
+ data->rcdev.owner = THIS_MODULE;
+ data->rcdev.nr_resets = size * 32;
+ data->rcdev.ops = &sunxi_reset_ops;
+@@ -157,6 +159,8 @@ static int sunxi_reset_probe(struct platform_device *pdev)
+ if (IS_ERR(data->membase))
+ return PTR_ERR(data->membase);
+
++ spin_lock_init(&data->lock);
++
+ data->rcdev.owner = THIS_MODULE;
+ data->rcdev.nr_resets = resource_size(res) * 32;
+ data->rcdev.ops = &sunxi_reset_ops;
+diff --git a/drivers/scsi/mpt2sas/mpt2sas_transport.c b/drivers/scsi/mpt2sas/mpt2sas_transport.c
+index 0d1d06488a28..e689bf20a3ea 100644
+--- a/drivers/scsi/mpt2sas/mpt2sas_transport.c
++++ b/drivers/scsi/mpt2sas/mpt2sas_transport.c
+@@ -1006,12 +1006,9 @@ mpt2sas_transport_update_links(struct MPT2SAS_ADAPTER *ioc,
+ &mpt2sas_phy->remote_identify);
+ _transport_add_phy_to_an_existing_port(ioc, sas_node,
+ mpt2sas_phy, mpt2sas_phy->remote_identify.sas_address);
+- } else {
++ } else
+ memset(&mpt2sas_phy->remote_identify, 0 , sizeof(struct
+ sas_identify));
+- _transport_del_phy_from_an_existing_port(ioc, sas_node,
+- mpt2sas_phy);
+- }
+
+ if (mpt2sas_phy->phy)
+ mpt2sas_phy->phy->negotiated_linkrate =
+diff --git a/drivers/scsi/mpt3sas/mpt3sas_transport.c b/drivers/scsi/mpt3sas/mpt3sas_transport.c
+index d4bafaaebea9..3637ae6c0171 100644
+--- a/drivers/scsi/mpt3sas/mpt3sas_transport.c
++++ b/drivers/scsi/mpt3sas/mpt3sas_transport.c
+@@ -1003,12 +1003,9 @@ mpt3sas_transport_update_links(struct MPT3SAS_ADAPTER *ioc,
+ &mpt3sas_phy->remote_identify);
+ _transport_add_phy_to_an_existing_port(ioc, sas_node,
+ mpt3sas_phy, mpt3sas_phy->remote_identify.sas_address);
+- } else {
++ } else
+ memset(&mpt3sas_phy->remote_identify, 0 , sizeof(struct
+ sas_identify));
+- _transport_del_phy_from_an_existing_port(ioc, sas_node,
+- mpt3sas_phy);
+- }
+
+ if (mpt3sas_phy->phy)
+ mpt3sas_phy->phy->negotiated_linkrate =
+diff --git a/drivers/scsi/scsi_devinfo.c b/drivers/scsi/scsi_devinfo.c
+index c1d04d4d3c6c..262ab837a704 100644
+--- a/drivers/scsi/scsi_devinfo.c
++++ b/drivers/scsi/scsi_devinfo.c
+@@ -211,6 +211,7 @@ static struct {
+ {"Medion", "Flash XL MMC/SD", "2.6D", BLIST_FORCELUN},
+ {"MegaRAID", "LD", NULL, BLIST_FORCELUN},
+ {"MICROP", "4110", NULL, BLIST_NOTQ},
++ {"MSFT", "Virtual HD", NULL, BLIST_NO_RSOC},
+ {"MYLEX", "DACARMRB", "*", BLIST_REPORTLUN2},
+ {"nCipher", "Fastness Crypto", NULL, BLIST_FORCELUN},
+ {"NAKAMICH", "MJ-4.8S", NULL, BLIST_FORCELUN | BLIST_SINGLELUN},
+diff --git a/drivers/scsi/scsi_error.c b/drivers/scsi/scsi_error.c
+index bc5ff6ff9c79..01a79473350a 100644
+--- a/drivers/scsi/scsi_error.c
++++ b/drivers/scsi/scsi_error.c
+@@ -1027,7 +1027,7 @@ retry:
+ }
+ /* signal not to enter either branch of the if () below */
+ timeleft = 0;
+- rtn = NEEDS_RETRY;
++ rtn = FAILED;
+ } else {
+ timeleft = wait_for_completion_timeout(&done, timeout);
+ rtn = SUCCESS;
+@@ -1067,7 +1067,7 @@ retry:
+ rtn = FAILED;
+ break;
+ }
+- } else if (!rtn) {
++ } else if (rtn != FAILED) {
+ scsi_abort_eh_cmnd(scmd);
+ rtn = FAILED;
+ }
+diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
+index 50a6e1ac8d9c..17fb0518c9c1 100644
+--- a/drivers/scsi/scsi_lib.c
++++ b/drivers/scsi/scsi_lib.c
+@@ -1829,7 +1829,9 @@ static int scsi_mq_prep_fn(struct request *req)
+
+ if (scsi_host_get_prot(shost)) {
+ cmd->prot_sdb = (void *)sg +
+- shost->sg_tablesize * sizeof(struct scatterlist);
++ min_t(unsigned int,
++ shost->sg_tablesize, SCSI_MAX_SG_SEGMENTS) *
++ sizeof(struct scatterlist);
+ memset(cmd->prot_sdb, 0, sizeof(struct scsi_data_buffer));
+
+ cmd->prot_sdb->table.sgl =
+diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c
+index 733e5f759518..90af465359d6 100644
+--- a/drivers/scsi/storvsc_drv.c
++++ b/drivers/scsi/storvsc_drv.c
+@@ -1688,13 +1688,12 @@ static int storvsc_queuecommand(struct Scsi_Host *host, struct scsi_cmnd *scmnd)
+ if (ret == -EAGAIN) {
+ /* no more space */
+
+- if (cmd_request->bounce_sgl_count) {
++ if (cmd_request->bounce_sgl_count)
+ destroy_bounce_buffer(cmd_request->bounce_sgl,
+ cmd_request->bounce_sgl_count);
+
+- ret = SCSI_MLQUEUE_DEVICE_BUSY;
+- goto queue_error;
+- }
++ ret = SCSI_MLQUEUE_DEVICE_BUSY;
++ goto queue_error;
+ }
+
+ return 0;
+diff --git a/drivers/target/iscsi/iscsi_target_login.c b/drivers/target/iscsi/iscsi_target_login.c
+index 480f2e0ecc11..18e2601527df 100644
+--- a/drivers/target/iscsi/iscsi_target_login.c
++++ b/drivers/target/iscsi/iscsi_target_login.c
+@@ -281,7 +281,6 @@ static int iscsi_login_zero_tsih_s1(
+ {
+ struct iscsi_session *sess = NULL;
+ struct iscsi_login_req *pdu = (struct iscsi_login_req *)buf;
+- enum target_prot_op sup_pro_ops;
+ int ret;
+
+ sess = kzalloc(sizeof(struct iscsi_session), GFP_KERNEL);
+@@ -343,9 +342,8 @@ static int iscsi_login_zero_tsih_s1(
+ kfree(sess);
+ return -ENOMEM;
+ }
+- sup_pro_ops = conn->conn_transport->iscsit_get_sup_prot_ops(conn);
+
+- sess->se_sess = transport_init_session(sup_pro_ops);
++ sess->se_sess = transport_init_session(TARGET_PROT_NORMAL);
+ if (IS_ERR(sess->se_sess)) {
+ iscsit_tx_login_rsp(conn, ISCSI_STATUS_CLS_TARGET_ERR,
+ ISCSI_LOGIN_STATUS_NO_RESOURCES);
+@@ -1204,6 +1202,9 @@ old_sess_out:
+ conn->sock = NULL;
+ }
+
++ if (conn->conn_transport->iscsit_wait_conn)
++ conn->conn_transport->iscsit_wait_conn(conn);
++
+ if (conn->conn_transport->iscsit_free_conn)
+ conn->conn_transport->iscsit_free_conn(conn);
+
+@@ -1364,6 +1365,9 @@ static int __iscsi_target_login_thread(struct iscsi_np *np)
+ }
+ login->zero_tsih = zero_tsih;
+
++ conn->sess->se_sess->sup_prot_ops =
++ conn->conn_transport->iscsit_get_sup_prot_ops(conn);
++
+ tpg = conn->tpg;
+ if (!tpg) {
+ pr_err("Unable to locate struct iscsi_conn->tpg\n");
+diff --git a/drivers/target/iscsi/iscsi_target_util.c b/drivers/target/iscsi/iscsi_target_util.c
+index ce87ce9bdb9c..0b68c2ebce95 100644
+--- a/drivers/target/iscsi/iscsi_target_util.c
++++ b/drivers/target/iscsi/iscsi_target_util.c
+@@ -1358,15 +1358,15 @@ static int iscsit_do_tx_data(
+ struct iscsi_conn *conn,
+ struct iscsi_data_count *count)
+ {
+- int data = count->data_length, total_tx = 0, tx_loop = 0, iov_len;
++ int ret, iov_len;
+ struct kvec *iov_p;
+ struct msghdr msg;
+
+ if (!conn || !conn->sock || !conn->conn_ops)
+ return -1;
+
+- if (data <= 0) {
+- pr_err("Data length is: %d\n", data);
++ if (count->data_length <= 0) {
++ pr_err("Data length is: %d\n", count->data_length);
+ return -1;
+ }
+
+@@ -1375,20 +1375,16 @@ static int iscsit_do_tx_data(
+ iov_p = count->iov;
+ iov_len = count->iov_count;
+
+- while (total_tx < data) {
+- tx_loop = kernel_sendmsg(conn->sock, &msg, iov_p, iov_len,
+- (data - total_tx));
+- if (tx_loop <= 0) {
+- pr_debug("tx_loop: %d total_tx %d\n",
+- tx_loop, total_tx);
+- return tx_loop;
+- }
+- total_tx += tx_loop;
+- pr_debug("tx_loop: %d, total_tx: %d, data: %d\n",
+- tx_loop, total_tx, data);
++ ret = kernel_sendmsg(conn->sock, &msg, iov_p, iov_len,
++ count->data_length);
++ if (ret != count->data_length) {
++ pr_err("Unexpected ret: %d send data %d\n",
++ ret, count->data_length);
++ return -EPIPE;
+ }
++ pr_debug("ret: %d, sent data: %d\n", ret, count->data_length);
+
+- return total_tx;
++ return ret;
+ }
+
+ int rx_data(
+diff --git a/drivers/target/loopback/tcm_loop.c b/drivers/target/loopback/tcm_loop.c
+index ab3ab27d49b7..0be83e788df2 100644
+--- a/drivers/target/loopback/tcm_loop.c
++++ b/drivers/target/loopback/tcm_loop.c
+@@ -190,7 +190,7 @@ static void tcm_loop_submission_work(struct work_struct *work)
+ set_host_byte(sc, DID_TRANSPORT_DISRUPTED);
+ goto out_done;
+ }
+- tl_nexus = tl_hba->tl_nexus;
++ tl_nexus = tl_tpg->tl_nexus;
+ if (!tl_nexus) {
+ scmd_printk(KERN_ERR, sc, "TCM_Loop I_T Nexus"
+ " does not exist\n");
+@@ -270,16 +270,26 @@ static int tcm_loop_queuecommand(struct Scsi_Host *sh, struct scsi_cmnd *sc)
+ * to struct scsi_device
+ */
+ static int tcm_loop_issue_tmr(struct tcm_loop_tpg *tl_tpg,
+- struct tcm_loop_nexus *tl_nexus,
+ int lun, int task, enum tcm_tmreq_table tmr)
+ {
+ struct se_cmd *se_cmd = NULL;
+ struct se_session *se_sess;
+ struct se_portal_group *se_tpg;
++ struct tcm_loop_nexus *tl_nexus;
+ struct tcm_loop_cmd *tl_cmd = NULL;
+ struct tcm_loop_tmr *tl_tmr = NULL;
+ int ret = TMR_FUNCTION_FAILED, rc;
+
++ /*
++ * Locate the tl_nexus and se_sess pointers
++ */
++ tl_nexus = tl_tpg->tl_nexus;
++ if (!tl_nexus) {
++ pr_err("Unable to perform device reset without"
++ " active I_T Nexus\n");
++ return ret;
++ }
++
+ tl_cmd = kmem_cache_zalloc(tcm_loop_cmd_cache, GFP_KERNEL);
+ if (!tl_cmd) {
+ pr_err("Unable to allocate memory for tl_cmd\n");
+@@ -295,7 +305,7 @@ static int tcm_loop_issue_tmr(struct tcm_loop_tpg *tl_tpg,
+
+ se_cmd = &tl_cmd->tl_se_cmd;
+ se_tpg = &tl_tpg->tl_se_tpg;
+- se_sess = tl_nexus->se_sess;
++ se_sess = tl_tpg->tl_nexus->se_sess;
+ /*
+ * Initialize struct se_cmd descriptor from target_core_mod infrastructure
+ */
+@@ -340,7 +350,6 @@ release:
+ static int tcm_loop_abort_task(struct scsi_cmnd *sc)
+ {
+ struct tcm_loop_hba *tl_hba;
+- struct tcm_loop_nexus *tl_nexus;
+ struct tcm_loop_tpg *tl_tpg;
+ int ret = FAILED;
+
+@@ -348,21 +357,8 @@ static int tcm_loop_abort_task(struct scsi_cmnd *sc)
+ * Locate the tcm_loop_hba_t pointer
+ */
+ tl_hba = *(struct tcm_loop_hba **)shost_priv(sc->device->host);
+- /*
+- * Locate the tl_nexus and se_sess pointers
+- */
+- tl_nexus = tl_hba->tl_nexus;
+- if (!tl_nexus) {
+- pr_err("Unable to perform device reset without"
+- " active I_T Nexus\n");
+- return FAILED;
+- }
+-
+- /*
+- * Locate the tl_tpg pointer from TargetID in sc->device->id
+- */
+ tl_tpg = &tl_hba->tl_hba_tpgs[sc->device->id];
+- ret = tcm_loop_issue_tmr(tl_tpg, tl_nexus, sc->device->lun,
++ ret = tcm_loop_issue_tmr(tl_tpg, sc->device->lun,
+ sc->request->tag, TMR_ABORT_TASK);
+ return (ret == TMR_FUNCTION_COMPLETE) ? SUCCESS : FAILED;
+ }
+@@ -374,7 +370,6 @@ static int tcm_loop_abort_task(struct scsi_cmnd *sc)
+ static int tcm_loop_device_reset(struct scsi_cmnd *sc)
+ {
+ struct tcm_loop_hba *tl_hba;
+- struct tcm_loop_nexus *tl_nexus;
+ struct tcm_loop_tpg *tl_tpg;
+ int ret = FAILED;
+
+@@ -382,20 +377,9 @@ static int tcm_loop_device_reset(struct scsi_cmnd *sc)
+ * Locate the tcm_loop_hba_t pointer
+ */
+ tl_hba = *(struct tcm_loop_hba **)shost_priv(sc->device->host);
+- /*
+- * Locate the tl_nexus and se_sess pointers
+- */
+- tl_nexus = tl_hba->tl_nexus;
+- if (!tl_nexus) {
+- pr_err("Unable to perform device reset without"
+- " active I_T Nexus\n");
+- return FAILED;
+- }
+- /*
+- * Locate the tl_tpg pointer from TargetID in sc->device->id
+- */
+ tl_tpg = &tl_hba->tl_hba_tpgs[sc->device->id];
+- ret = tcm_loop_issue_tmr(tl_tpg, tl_nexus, sc->device->lun,
++
++ ret = tcm_loop_issue_tmr(tl_tpg, sc->device->lun,
+ 0, TMR_LUN_RESET);
+ return (ret == TMR_FUNCTION_COMPLETE) ? SUCCESS : FAILED;
+ }
+@@ -1005,8 +989,8 @@ static int tcm_loop_make_nexus(
+ struct tcm_loop_nexus *tl_nexus;
+ int ret = -ENOMEM;
+
+- if (tl_tpg->tl_hba->tl_nexus) {
+- pr_debug("tl_tpg->tl_hba->tl_nexus already exists\n");
++ if (tl_tpg->tl_nexus) {
++ pr_debug("tl_tpg->tl_nexus already exists\n");
+ return -EEXIST;
+ }
+ se_tpg = &tl_tpg->tl_se_tpg;
+@@ -1041,7 +1025,7 @@ static int tcm_loop_make_nexus(
+ */
+ __transport_register_session(se_tpg, tl_nexus->se_sess->se_node_acl,
+ tl_nexus->se_sess, tl_nexus);
+- tl_tpg->tl_hba->tl_nexus = tl_nexus;
++ tl_tpg->tl_nexus = tl_nexus;
+ pr_debug("TCM_Loop_ConfigFS: Established I_T Nexus to emulated"
+ " %s Initiator Port: %s\n", tcm_loop_dump_proto_id(tl_hba),
+ name);
+@@ -1057,12 +1041,8 @@ static int tcm_loop_drop_nexus(
+ {
+ struct se_session *se_sess;
+ struct tcm_loop_nexus *tl_nexus;
+- struct tcm_loop_hba *tl_hba = tpg->tl_hba;
+
+- if (!tl_hba)
+- return -ENODEV;
+-
+- tl_nexus = tl_hba->tl_nexus;
++ tl_nexus = tpg->tl_nexus;
+ if (!tl_nexus)
+ return -ENODEV;
+
+@@ -1078,13 +1058,13 @@ static int tcm_loop_drop_nexus(
+ }
+
+ pr_debug("TCM_Loop_ConfigFS: Removing I_T Nexus to emulated"
+- " %s Initiator Port: %s\n", tcm_loop_dump_proto_id(tl_hba),
++ " %s Initiator Port: %s\n", tcm_loop_dump_proto_id(tpg->tl_hba),
+ tl_nexus->se_sess->se_node_acl->initiatorname);
+ /*
+ * Release the SCSI I_T Nexus to the emulated SAS Target Port
+ */
+ transport_deregister_session(tl_nexus->se_sess);
+- tpg->tl_hba->tl_nexus = NULL;
++ tpg->tl_nexus = NULL;
+ kfree(tl_nexus);
+ return 0;
+ }
+@@ -1100,7 +1080,7 @@ static ssize_t tcm_loop_tpg_show_nexus(
+ struct tcm_loop_nexus *tl_nexus;
+ ssize_t ret;
+
+- tl_nexus = tl_tpg->tl_hba->tl_nexus;
++ tl_nexus = tl_tpg->tl_nexus;
+ if (!tl_nexus)
+ return -ENODEV;
+
+diff --git a/drivers/target/loopback/tcm_loop.h b/drivers/target/loopback/tcm_loop.h
+index 54c59d0b6608..6ae49f272ba6 100644
+--- a/drivers/target/loopback/tcm_loop.h
++++ b/drivers/target/loopback/tcm_loop.h
+@@ -27,11 +27,6 @@ struct tcm_loop_tmr {
+ };
+
+ struct tcm_loop_nexus {
+- int it_nexus_active;
+- /*
+- * Pointer to Linux/SCSI HBA from linux/include/scsi_host.h
+- */
+- struct scsi_host *sh;
+ /*
+ * Pointer to TCM session for I_T Nexus
+ */
+@@ -51,6 +46,7 @@ struct tcm_loop_tpg {
+ atomic_t tl_tpg_port_count;
+ struct se_portal_group tl_se_tpg;
+ struct tcm_loop_hba *tl_hba;
++ struct tcm_loop_nexus *tl_nexus;
+ };
+
+ struct tcm_loop_hba {
+@@ -59,7 +55,6 @@ struct tcm_loop_hba {
+ struct se_hba_s *se_hba;
+ struct se_lun *tl_hba_lun;
+ struct se_port *tl_hba_lun_sep;
+- struct tcm_loop_nexus *tl_nexus;
+ struct device dev;
+ struct Scsi_Host *sh;
+ struct tcm_loop_tpg tl_hba_tpgs[TL_TPGS_PER_HBA];
+diff --git a/drivers/target/target_core_device.c b/drivers/target/target_core_device.c
+index c45f9e907e44..24fa5d1999af 100644
+--- a/drivers/target/target_core_device.c
++++ b/drivers/target/target_core_device.c
+@@ -1169,10 +1169,10 @@ int se_dev_set_optimal_sectors(struct se_device *dev, u32 optimal_sectors)
+ " changed for TCM/pSCSI\n", dev);
+ return -EINVAL;
+ }
+- if (optimal_sectors > dev->dev_attrib.fabric_max_sectors) {
++ if (optimal_sectors > dev->dev_attrib.hw_max_sectors) {
+ pr_err("dev[%p]: Passed optimal_sectors %u cannot be"
+- " greater than fabric_max_sectors: %u\n", dev,
+- optimal_sectors, dev->dev_attrib.fabric_max_sectors);
++ " greater than hw_max_sectors: %u\n", dev,
++ optimal_sectors, dev->dev_attrib.hw_max_sectors);
+ return -EINVAL;
+ }
+
+@@ -1572,7 +1572,6 @@ struct se_device *target_alloc_device(struct se_hba *hba, const char *name)
+ DA_UNMAP_GRANULARITY_ALIGNMENT_DEFAULT;
+ dev->dev_attrib.max_write_same_len = DA_MAX_WRITE_SAME_LEN;
+ dev->dev_attrib.fabric_max_sectors = DA_FABRIC_MAX_SECTORS;
+- dev->dev_attrib.optimal_sectors = DA_FABRIC_MAX_SECTORS;
+
+ xcopy_lun = &dev->xcopy_lun;
+ xcopy_lun->lun_se_dev = dev;
+@@ -1613,6 +1612,7 @@ int target_configure_device(struct se_device *dev)
+ dev->dev_attrib.hw_max_sectors =
+ se_dev_align_max_sectors(dev->dev_attrib.hw_max_sectors,
+ dev->dev_attrib.hw_block_size);
++ dev->dev_attrib.optimal_sectors = dev->dev_attrib.hw_max_sectors;
+
+ dev->dev_index = scsi_get_new_index(SCSI_DEVICE_INDEX);
+ dev->creation_time = get_jiffies_64();
+diff --git a/drivers/target/target_core_file.c b/drivers/target/target_core_file.c
+index 72c83d98662b..f018b6a3ffbf 100644
+--- a/drivers/target/target_core_file.c
++++ b/drivers/target/target_core_file.c
+@@ -620,7 +620,16 @@ fd_execute_rw(struct se_cmd *cmd, struct scatterlist *sgl, u32 sgl_nents,
+ struct fd_prot fd_prot;
+ sense_reason_t rc;
+ int ret = 0;
+-
++ /*
++ * We are currently limited by the number of iovecs (2048) per
++ * single vfs_[writev,readv] call.
++ */
++ if (cmd->data_length > FD_MAX_BYTES) {
++ pr_err("FILEIO: Not able to process I/O of %u bytes due to"
++ "FD_MAX_BYTES: %u iovec count limitiation\n",
++ cmd->data_length, FD_MAX_BYTES);
++ return TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
++ }
+ /*
+ * Call vectorized fileio functions to map struct scatterlist
+ * physical memory addresses to struct iovec virtual memory.
+diff --git a/drivers/target/target_core_iblock.c b/drivers/target/target_core_iblock.c
+index 7e6b857c6b3f..be27773ab829 100644
+--- a/drivers/target/target_core_iblock.c
++++ b/drivers/target/target_core_iblock.c
+@@ -123,7 +123,7 @@ static int iblock_configure_device(struct se_device *dev)
+ q = bdev_get_queue(bd);
+
+ dev->dev_attrib.hw_block_size = bdev_logical_block_size(bd);
+- dev->dev_attrib.hw_max_sectors = UINT_MAX;
++ dev->dev_attrib.hw_max_sectors = queue_max_hw_sectors(q);
+ dev->dev_attrib.hw_queue_depth = q->nr_requests;
+
+ /*
+diff --git a/drivers/target/target_core_sbc.c b/drivers/target/target_core_sbc.c
+index ebe62afb957d..7a88af0e32d6 100644
+--- a/drivers/target/target_core_sbc.c
++++ b/drivers/target/target_core_sbc.c
+@@ -953,21 +953,6 @@ sbc_parse_cdb(struct se_cmd *cmd, struct sbc_ops *ops)
+
+ if (cmd->se_cmd_flags & SCF_SCSI_DATA_CDB) {
+ unsigned long long end_lba;
+-
+- if (sectors > dev->dev_attrib.fabric_max_sectors) {
+- printk_ratelimited(KERN_ERR "SCSI OP %02xh with too"
+- " big sectors %u exceeds fabric_max_sectors:"
+- " %u\n", cdb[0], sectors,
+- dev->dev_attrib.fabric_max_sectors);
+- return TCM_INVALID_CDB_FIELD;
+- }
+- if (sectors > dev->dev_attrib.hw_max_sectors) {
+- printk_ratelimited(KERN_ERR "SCSI OP %02xh with too"
+- " big sectors %u exceeds backend hw_max_sectors:"
+- " %u\n", cdb[0], sectors,
+- dev->dev_attrib.hw_max_sectors);
+- return TCM_INVALID_CDB_FIELD;
+- }
+ check_lba:
+ end_lba = dev->transport->get_blocks(dev) + 1;
+ if (cmd->t_task_lba + sectors > end_lba) {
+diff --git a/drivers/target/target_core_spc.c b/drivers/target/target_core_spc.c
+index bc286a67af7c..614005b6b08b 100644
+--- a/drivers/target/target_core_spc.c
++++ b/drivers/target/target_core_spc.c
+@@ -505,7 +505,6 @@ static sense_reason_t
+ spc_emulate_evpd_b0(struct se_cmd *cmd, unsigned char *buf)
+ {
+ struct se_device *dev = cmd->se_dev;
+- u32 max_sectors;
+ int have_tp = 0;
+ int opt, min;
+
+@@ -539,9 +538,7 @@ spc_emulate_evpd_b0(struct se_cmd *cmd, unsigned char *buf)
+ /*
+ * Set MAXIMUM TRANSFER LENGTH
+ */
+- max_sectors = min(dev->dev_attrib.fabric_max_sectors,
+- dev->dev_attrib.hw_max_sectors);
+- put_unaligned_be32(max_sectors, &buf[8]);
++ put_unaligned_be32(dev->dev_attrib.hw_max_sectors, &buf[8]);
+
+ /*
+ * Set OPTIMAL TRANSFER LENGTH
+diff --git a/drivers/thermal/intel_powerclamp.c b/drivers/thermal/intel_powerclamp.c
+index 95cb7fc20e17..6cb78497076a 100644
+--- a/drivers/thermal/intel_powerclamp.c
++++ b/drivers/thermal/intel_powerclamp.c
+@@ -435,7 +435,6 @@ static int clamp_thread(void *arg)
+ * allowed. thus jiffies are updated properly.
+ */
+ preempt_disable();
+- tick_nohz_idle_enter();
+ /* mwait until target jiffies is reached */
+ while (time_before(jiffies, target_jiffies)) {
+ unsigned long ecx = 1;
+@@ -451,7 +450,6 @@ static int clamp_thread(void *arg)
+ start_critical_timings();
+ atomic_inc(&idle_wakeup_counter);
+ }
+- tick_nohz_idle_exit();
+ preempt_enable();
+ }
+ del_timer_sync(&wakeup_timer);
+diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c
+index eaeb9a02c7fe..a28dee9d5017 100644
+--- a/drivers/tty/serial/serial_core.c
++++ b/drivers/tty/serial/serial_core.c
+@@ -2102,7 +2102,9 @@ uart_report_port(struct uart_driver *drv, struct uart_port *port)
+ break;
+ }
+
+- dev_info(port->dev, "%s%d at %s (irq = %d, base_baud = %d) is a %s\n",
++ printk(KERN_INFO "%s%s%s%d at %s (irq = %d, base_baud = %d) is a %s\n",
++ port->dev ? dev_name(port->dev) : "",
++ port->dev ? ": " : "",
+ drv->dev_name,
+ drv->tty_driver->name_base + port->line,
+ address, port->irq, port->uartclk / 16, uart_type(port));
+diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
+index 546ea5431b8c..272e0928736e 100644
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -882,8 +882,7 @@ static void dwc3_prepare_trbs(struct dwc3_ep *dep, bool starting)
+
+ if (i == (request->num_mapped_sgs - 1) ||
+ sg_is_last(s)) {
+- if (list_is_last(&req->list,
+- &dep->request_list))
++ if (list_empty(&dep->request_list))
+ last_one = true;
+ chain = false;
+ }
+@@ -901,6 +900,9 @@ static void dwc3_prepare_trbs(struct dwc3_ep *dep, bool starting)
+ if (last_one)
+ break;
+ }
++
++ if (last_one)
++ break;
+ } else {
+ dma = req->request.dma;
+ length = req->request.length;
+diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c
+index c744e4975d74..08048613eed6 100644
+--- a/drivers/usb/gadget/legacy/inode.c
++++ b/drivers/usb/gadget/legacy/inode.c
+@@ -449,6 +449,7 @@ ep_write (struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
+ data->name, len, (int) value);
+ free1:
+ mutex_unlock(&data->lock);
++ kfree (kbuf);
+ return value;
+ }
+
+diff --git a/drivers/usb/gadget/udc/atmel_usba_udc.c b/drivers/usb/gadget/udc/atmel_usba_udc.c
+index 1529926e20a0..840856ca3e66 100644
+--- a/drivers/usb/gadget/udc/atmel_usba_udc.c
++++ b/drivers/usb/gadget/udc/atmel_usba_udc.c
+@@ -716,10 +716,10 @@ static int queue_dma(struct usba_udc *udc, struct usba_ep *ep,
+ req->using_dma = 1;
+ req->ctrl = USBA_BF(DMA_BUF_LEN, req->req.length)
+ | USBA_DMA_CH_EN | USBA_DMA_END_BUF_IE
+- | USBA_DMA_END_TR_EN | USBA_DMA_END_TR_IE;
++ | USBA_DMA_END_BUF_EN;
+
+- if (ep->is_in)
+- req->ctrl |= USBA_DMA_END_BUF_EN;
++ if (!ep->is_in)
++ req->ctrl |= USBA_DMA_END_TR_EN | USBA_DMA_END_TR_IE;
+
+ /*
+ * Add this request to the queue and submit for DMA if
+@@ -828,7 +828,7 @@ static int usba_ep_dequeue(struct usb_ep *_ep, struct usb_request *_req)
+ {
+ struct usba_ep *ep = to_usba_ep(_ep);
+ struct usba_udc *udc = ep->udc;
+- struct usba_request *req = to_usba_req(_req);
++ struct usba_request *req;
+ unsigned long flags;
+ u32 status;
+
+@@ -837,6 +837,16 @@ static int usba_ep_dequeue(struct usb_ep *_ep, struct usb_request *_req)
+
+ spin_lock_irqsave(&udc->lock, flags);
+
++ list_for_each_entry(req, &ep->queue, queue) {
++ if (&req->req == _req)
++ break;
++ }
++
++ if (&req->req != _req) {
++ spin_unlock_irqrestore(&udc->lock, flags);
++ return -EINVAL;
++ }
++
+ if (req->using_dma) {
+ /*
+ * If this request is currently being transferred,
+@@ -1572,7 +1582,6 @@ static void usba_ep_irq(struct usba_udc *udc, struct usba_ep *ep)
+ if ((epstatus & epctrl) & USBA_RX_BK_RDY) {
+ DBG(DBG_BUS, "%s: RX data ready\n", ep->ep.name);
+ receive_data(ep);
+- usba_ep_writel(ep, CLR_STA, USBA_RX_BK_RDY);
+ }
+ }
+
+diff --git a/drivers/usb/host/ehci-sched.c b/drivers/usb/host/ehci-sched.c
+index e113fd73aeae..c399606f154e 100644
+--- a/drivers/usb/host/ehci-sched.c
++++ b/drivers/usb/host/ehci-sched.c
+@@ -1581,6 +1581,10 @@ iso_stream_schedule (
+ else
+ next = (now + 2 + 7) & ~0x07; /* full frame cache */
+
++ /* If needed, initialize last_iso_frame so that this URB will be seen */
++ if (ehci->isoc_count == 0)
++ ehci->last_iso_frame = now >> 3;
++
+ /*
+ * Use ehci->last_iso_frame as the base. There can't be any
+ * TDs scheduled for earlier than that.
+@@ -1671,10 +1675,6 @@ iso_stream_schedule (
+ urb->start_frame = start & (mod - 1);
+ if (!stream->highspeed)
+ urb->start_frame >>= 3;
+-
+- /* Make sure scan_isoc() sees these */
+- if (ehci->isoc_count == 0)
+- ehci->last_iso_frame = now >> 3;
+ return status;
+
+ fail:
+diff --git a/drivers/usb/host/pci-quirks.c b/drivers/usb/host/pci-quirks.c
+index 2f3acebb577a..f4e6b945136c 100644
+--- a/drivers/usb/host/pci-quirks.c
++++ b/drivers/usb/host/pci-quirks.c
+@@ -571,7 +571,8 @@ static void quirk_usb_handoff_ohci(struct pci_dev *pdev)
+ {
+ void __iomem *base;
+ u32 control;
+- u32 fminterval;
++ u32 fminterval = 0;
++ bool no_fminterval = false;
+ int cnt;
+
+ if (!mmio_resource_enabled(pdev, 0))
+@@ -581,6 +582,13 @@ static void quirk_usb_handoff_ohci(struct pci_dev *pdev)
+ if (base == NULL)
+ return;
+
++ /*
++ * ULi M5237 OHCI controller locks the whole system when accessing
++ * the OHCI_FMINTERVAL offset.
++ */
++ if (pdev->vendor == PCI_VENDOR_ID_AL && pdev->device == 0x5237)
++ no_fminterval = true;
++
+ control = readl(base + OHCI_CONTROL);
+
+ /* On PA-RISC, PDC can leave IR set incorrectly; ignore it there. */
+@@ -619,7 +627,9 @@ static void quirk_usb_handoff_ohci(struct pci_dev *pdev)
+ }
+
+ /* software reset of the controller, preserving HcFmInterval */
+- fminterval = readl(base + OHCI_FMINTERVAL);
++ if (!no_fminterval)
++ fminterval = readl(base + OHCI_FMINTERVAL);
++
+ writel(OHCI_HCR, base + OHCI_CMDSTATUS);
+
+ /* reset requires max 10 us delay */
+@@ -628,7 +638,9 @@ static void quirk_usb_handoff_ohci(struct pci_dev *pdev)
+ break;
+ udelay(1);
+ }
+- writel(fminterval, base + OHCI_FMINTERVAL);
++
++ if (!no_fminterval)
++ writel(fminterval, base + OHCI_FMINTERVAL);
+
+ /* Now the controller is safely in SUSPEND and nothing can wake it up */
+ iounmap(base);
+diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
+index 142b601f9563..7f76c8a12f89 100644
+--- a/drivers/usb/host/xhci-pci.c
++++ b/drivers/usb/host/xhci-pci.c
+@@ -82,6 +82,8 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
+ "must be suspended extra slowly",
+ pdev->revision);
+ }
++ if (pdev->device == PCI_DEVICE_ID_FRESCO_LOGIC_PDK)
++ xhci->quirks |= XHCI_BROKEN_STREAMS;
+ /* Fresco Logic confirms: all revisions of this chip do not
+ * support MSI, even though some of them claim to in their PCI
+ * capabilities.
+diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
+index 033b46c470bd..3bceabe109f7 100644
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -3803,6 +3803,15 @@ static int xhci_setup_device(struct usb_hcd *hcd, struct usb_device *udev,
+ return -EINVAL;
+ }
+
++ if (setup == SETUP_CONTEXT_ONLY) {
++ slot_ctx = xhci_get_slot_ctx(xhci, virt_dev->out_ctx);
++ if (GET_SLOT_STATE(le32_to_cpu(slot_ctx->dev_state)) ==
++ SLOT_STATE_DEFAULT) {
++ xhci_dbg(xhci, "Slot already in default state\n");
++ return 0;
++ }
++ }
++
+ command = xhci_alloc_command(xhci, false, false, GFP_KERNEL);
+ if (!command)
+ return -ENOMEM;
+diff --git a/drivers/usb/musb/musb_host.c b/drivers/usb/musb/musb_host.c
+index 855793d701bb..4500610356f2 100644
+--- a/drivers/usb/musb/musb_host.c
++++ b/drivers/usb/musb/musb_host.c
+@@ -2663,7 +2663,6 @@ void musb_host_cleanup(struct musb *musb)
+ if (musb->port_mode == MUSB_PORT_MODE_GADGET)
+ return;
+ usb_remove_hcd(musb->hcd);
+- musb->hcd = NULL;
+ }
+
+ void musb_host_free(struct musb *musb)
+diff --git a/drivers/usb/serial/console.c b/drivers/usb/serial/console.c
+index 8d7fc48b1f30..29fa1c3d0089 100644
+--- a/drivers/usb/serial/console.c
++++ b/drivers/usb/serial/console.c
+@@ -46,6 +46,8 @@ static struct console usbcons;
+ * ------------------------------------------------------------
+ */
+
++static const struct tty_operations usb_console_fake_tty_ops = {
++};
+
+ /*
+ * The parsing of the command line works exactly like the
+@@ -137,13 +139,17 @@ static int usb_console_setup(struct console *co, char *options)
+ goto reset_open_count;
+ }
+ kref_init(&tty->kref);
+- tty_port_tty_set(&port->port, tty);
+ tty->driver = usb_serial_tty_driver;
+ tty->index = co->index;
++ init_ldsem(&tty->ldisc_sem);
++ INIT_LIST_HEAD(&tty->tty_files);
++ kref_get(&tty->driver->kref);
++ tty->ops = &usb_console_fake_tty_ops;
+ if (tty_init_termios(tty)) {
+ retval = -ENOMEM;
+- goto free_tty;
++ goto put_tty;
+ }
++ tty_port_tty_set(&port->port, tty);
+ }
+
+ /* only call the device specific open if this
+@@ -161,7 +167,7 @@ static int usb_console_setup(struct console *co, char *options)
+ serial->type->set_termios(tty, port, &dummy);
+
+ tty_port_tty_set(&port->port, NULL);
+- kfree(tty);
++ tty_kref_put(tty);
+ }
+ set_bit(ASYNCB_INITIALIZED, &port->port.flags);
+ }
+@@ -177,8 +183,8 @@ static int usb_console_setup(struct console *co, char *options)
+
+ fail:
+ tty_port_tty_set(&port->port, NULL);
+- free_tty:
+- kfree(tty);
++ put_tty:
++ tty_kref_put(tty);
+ reset_open_count:
+ port->port.count = 0;
+ usb_autopm_put_interface(serial->interface);
+diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
+index 6c4eb3cf5efd..f4c56fc1a9f6 100644
+--- a/drivers/usb/serial/cp210x.c
++++ b/drivers/usb/serial/cp210x.c
+@@ -120,10 +120,12 @@ static const struct usb_device_id id_table[] = {
+ { USB_DEVICE(0x10C4, 0x85F8) }, /* Virtenio Preon32 */
+ { USB_DEVICE(0x10C4, 0x8664) }, /* AC-Services CAN-IF */
+ { USB_DEVICE(0x10C4, 0x8665) }, /* AC-Services OBD-IF */
+- { USB_DEVICE(0x10C4, 0x8875) }, /* CEL MeshConnect USB Stick */
++ { USB_DEVICE(0x10C4, 0x8856) }, /* CEL EM357 ZigBee USB Stick - LR */
++ { USB_DEVICE(0x10C4, 0x8857) }, /* CEL EM357 ZigBee USB Stick */
+ { USB_DEVICE(0x10C4, 0x88A4) }, /* MMB Networks ZigBee USB Device */
+ { USB_DEVICE(0x10C4, 0x88A5) }, /* Planet Innovation Ingeni ZigBee USB Device */
+ { USB_DEVICE(0x10C4, 0x8946) }, /* Ketra N1 Wireless Interface */
++ { USB_DEVICE(0x10C4, 0x8977) }, /* CEL MeshWorks DevKit Device */
+ { USB_DEVICE(0x10C4, 0xEA60) }, /* Silicon Labs factory default */
+ { USB_DEVICE(0x10C4, 0xEA61) }, /* Silicon Labs factory default */
+ { USB_DEVICE(0x10C4, 0xEA70) }, /* Silicon Labs factory default */
+diff --git a/drivers/usb/serial/keyspan.c b/drivers/usb/serial/keyspan.c
+index 077c714f1285..e07b15ed5814 100644
+--- a/drivers/usb/serial/keyspan.c
++++ b/drivers/usb/serial/keyspan.c
+@@ -410,6 +410,8 @@ static void usa26_instat_callback(struct urb *urb)
+ }
+ port = serial->port[msg->port];
+ p_priv = usb_get_serial_port_data(port);
++ if (!p_priv)
++ goto resubmit;
+
+ /* Update handshaking pin state information */
+ old_dcd_state = p_priv->dcd_state;
+@@ -420,7 +422,7 @@ static void usa26_instat_callback(struct urb *urb)
+
+ if (old_dcd_state != p_priv->dcd_state)
+ tty_port_tty_hangup(&port->port, true);
+-
++resubmit:
+ /* Resubmit urb so we continue receiving */
+ err = usb_submit_urb(urb, GFP_ATOMIC);
+ if (err != 0)
+@@ -527,6 +529,8 @@ static void usa28_instat_callback(struct urb *urb)
+ }
+ port = serial->port[msg->port];
+ p_priv = usb_get_serial_port_data(port);
++ if (!p_priv)
++ goto resubmit;
+
+ /* Update handshaking pin state information */
+ old_dcd_state = p_priv->dcd_state;
+@@ -537,7 +541,7 @@ static void usa28_instat_callback(struct urb *urb)
+
+ if (old_dcd_state != p_priv->dcd_state && old_dcd_state)
+ tty_port_tty_hangup(&port->port, true);
+-
++resubmit:
+ /* Resubmit urb so we continue receiving */
+ err = usb_submit_urb(urb, GFP_ATOMIC);
+ if (err != 0)
+@@ -607,6 +611,8 @@ static void usa49_instat_callback(struct urb *urb)
+ }
+ port = serial->port[msg->portNumber];
+ p_priv = usb_get_serial_port_data(port);
++ if (!p_priv)
++ goto resubmit;
+
+ /* Update handshaking pin state information */
+ old_dcd_state = p_priv->dcd_state;
+@@ -617,7 +623,7 @@ static void usa49_instat_callback(struct urb *urb)
+
+ if (old_dcd_state != p_priv->dcd_state && old_dcd_state)
+ tty_port_tty_hangup(&port->port, true);
+-
++resubmit:
+ /* Resubmit urb so we continue receiving */
+ err = usb_submit_urb(urb, GFP_ATOMIC);
+ if (err != 0)
+@@ -855,6 +861,8 @@ static void usa90_instat_callback(struct urb *urb)
+
+ port = serial->port[0];
+ p_priv = usb_get_serial_port_data(port);
++ if (!p_priv)
++ goto resubmit;
+
+ /* Update handshaking pin state information */
+ old_dcd_state = p_priv->dcd_state;
+@@ -865,7 +873,7 @@ static void usa90_instat_callback(struct urb *urb)
+
+ if (old_dcd_state != p_priv->dcd_state && old_dcd_state)
+ tty_port_tty_hangup(&port->port, true);
+-
++resubmit:
+ /* Resubmit urb so we continue receiving */
+ err = usb_submit_urb(urb, GFP_ATOMIC);
+ if (err != 0)
+@@ -926,6 +934,8 @@ static void usa67_instat_callback(struct urb *urb)
+
+ port = serial->port[msg->port];
+ p_priv = usb_get_serial_port_data(port);
++ if (!p_priv)
++ goto resubmit;
+
+ /* Update handshaking pin state information */
+ old_dcd_state = p_priv->dcd_state;
+@@ -934,7 +944,7 @@ static void usa67_instat_callback(struct urb *urb)
+
+ if (old_dcd_state != p_priv->dcd_state && old_dcd_state)
+ tty_port_tty_hangup(&port->port, true);
+-
++resubmit:
+ /* Resubmit urb so we continue receiving */
+ err = usb_submit_urb(urb, GFP_ATOMIC);
+ if (err != 0)
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index 7a4c21b4f676..efdcee15b520 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -234,6 +234,8 @@ static void option_instat_callback(struct urb *urb);
+
+ #define QUALCOMM_VENDOR_ID 0x05C6
+
++#define SIERRA_VENDOR_ID 0x1199
++
+ #define CMOTECH_VENDOR_ID 0x16d8
+ #define CMOTECH_PRODUCT_6001 0x6001
+ #define CMOTECH_PRODUCT_CMU_300 0x6002
+@@ -512,7 +514,7 @@ enum option_blacklist_reason {
+ OPTION_BLACKLIST_RESERVED_IF = 2
+ };
+
+-#define MAX_BL_NUM 8
++#define MAX_BL_NUM 11
+ struct option_blacklist_info {
+ /* bitfield of interface numbers for OPTION_BLACKLIST_SENDSETUP */
+ const unsigned long sendsetup;
+@@ -601,6 +603,11 @@ static const struct option_blacklist_info telit_le920_blacklist = {
+ .reserved = BIT(1) | BIT(5),
+ };
+
++static const struct option_blacklist_info sierra_mc73xx_blacklist = {
++ .sendsetup = BIT(0) | BIT(2),
++ .reserved = BIT(8) | BIT(10) | BIT(11),
++};
++
+ static const struct usb_device_id option_ids[] = {
+ { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_COLT) },
+ { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_RICOLA) },
+@@ -1098,6 +1105,8 @@ static const struct usb_device_id option_ids[] = {
+ { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x6613)}, /* Onda H600/ZTE MF330 */
+ { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x0023)}, /* ONYX 3G device */
+ { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x9000)}, /* SIMCom SIM5218 */
++ { USB_DEVICE_INTERFACE_CLASS(SIERRA_VENDOR_ID, 0x68c0, 0xff),
++ .driver_info = (kernel_ulong_t)&sierra_mc73xx_blacklist }, /* MC73xx */
+ { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6001) },
+ { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CMU_300) },
+ { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6003),
+diff --git a/drivers/usb/serial/qcserial.c b/drivers/usb/serial/qcserial.c
+index cb3e14780a7e..9c63897b3a56 100644
+--- a/drivers/usb/serial/qcserial.c
++++ b/drivers/usb/serial/qcserial.c
+@@ -142,7 +142,6 @@ static const struct usb_device_id id_table[] = {
+ {DEVICE_SWI(0x0f3d, 0x68a2)}, /* Sierra Wireless MC7700 */
+ {DEVICE_SWI(0x114f, 0x68a2)}, /* Sierra Wireless MC7750 */
+ {DEVICE_SWI(0x1199, 0x68a2)}, /* Sierra Wireless MC7710 */
+- {DEVICE_SWI(0x1199, 0x68c0)}, /* Sierra Wireless MC73xx */
+ {DEVICE_SWI(0x1199, 0x901c)}, /* Sierra Wireless EM7700 */
+ {DEVICE_SWI(0x1199, 0x901f)}, /* Sierra Wireless EM7355 */
+ {DEVICE_SWI(0x1199, 0x9040)}, /* Sierra Wireless Modem */
+diff --git a/drivers/usb/storage/unusual_uas.h b/drivers/usb/storage/unusual_uas.h
+index 18a283d6de1c..1f430bb02ca1 100644
+--- a/drivers/usb/storage/unusual_uas.h
++++ b/drivers/usb/storage/unusual_uas.h
+@@ -68,6 +68,20 @@ UNUSUAL_DEV(0x0bc2, 0xa003, 0x0000, 0x9999,
+ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+ US_FL_NO_ATA_1X),
+
++/* Reported-by: Marcin Zajączkowski <mszpak@wp.pl> */
++UNUSUAL_DEV(0x0bc2, 0xa013, 0x0000, 0x9999,
++ "Seagate",
++ "Backup Plus",
++ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
++ US_FL_NO_ATA_1X),
++
++/* Reported-by: Hans de Goede <hdegoede@redhat.com> */
++UNUSUAL_DEV(0x0bc2, 0xa0a4, 0x0000, 0x9999,
++ "Seagate",
++ "Backup Plus Desk",
++ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
++ US_FL_NO_ATA_1X),
++
+ /* https://bbs.archlinux.org/viewtopic.php?id=183190 */
+ UNUSUAL_DEV(0x0bc2, 0xab20, 0x0000, 0x9999,
+ "Seagate",
+@@ -82,6 +96,13 @@ UNUSUAL_DEV(0x0bc2, 0xab21, 0x0000, 0x9999,
+ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+ US_FL_NO_ATA_1X),
+
++/* Reported-by: G. Richard Bellamy <rbellamy@pteradigm.com> */
++UNUSUAL_DEV(0x0bc2, 0xab2a, 0x0000, 0x9999,
++ "Seagate",
++ "BUP Fast HDD",
++ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
++ US_FL_NO_ATA_1X),
++
+ /* Reported-by: Claudio Bizzarri <claudio.bizzarri@gmail.com> */
+ UNUSUAL_DEV(0x152d, 0x0567, 0x0000, 0x9999,
+ "JMicron",
+@@ -104,6 +125,13 @@ UNUSUAL_DEV(0x2109, 0x0711, 0x0000, 0x9999,
+ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+ US_FL_NO_ATA_1X),
+
++/* Reported-by: Takeo Nakayama <javhera@gmx.com> */
++UNUSUAL_DEV(0x357d, 0x7788, 0x0000, 0x9999,
++ "JMicron",
++ "JMS566",
++ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
++ US_FL_NO_REPORT_OPCODES),
++
+ /* Reported-by: Hans de Goede <hdegoede@redhat.com> */
+ UNUSUAL_DEV(0x4971, 0x1012, 0x0000, 0x9999,
+ "Hitachi",
+diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c
+index 9558da3f06a0..2f8a0552d020 100644
+--- a/drivers/vfio/pci/vfio_pci.c
++++ b/drivers/vfio/pci/vfio_pci.c
+@@ -839,13 +839,11 @@ static const struct vfio_device_ops vfio_pci_ops = {
+
+ static int vfio_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+ {
+- u8 type;
+ struct vfio_pci_device *vdev;
+ struct iommu_group *group;
+ int ret;
+
+- pci_read_config_byte(pdev, PCI_HEADER_TYPE, &type);
+- if ((type & PCI_HEADER_TYPE) != PCI_HEADER_TYPE_NORMAL)
++ if (pdev->hdr_type != PCI_HEADER_TYPE_NORMAL)
+ return -EINVAL;
+
+ group = iommu_group_get(&pdev->dev);
+diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c
+index a17f11850669..cb84f69f76ad 100644
+--- a/drivers/vhost/scsi.c
++++ b/drivers/vhost/scsi.c
+@@ -909,6 +909,23 @@ vhost_scsi_map_iov_to_prot(struct tcm_vhost_cmd *cmd,
+ return 0;
+ }
+
++static int vhost_scsi_to_tcm_attr(int attr)
++{
++ switch (attr) {
++ case VIRTIO_SCSI_S_SIMPLE:
++ return MSG_SIMPLE_TAG;
++ case VIRTIO_SCSI_S_ORDERED:
++ return MSG_ORDERED_TAG;
++ case VIRTIO_SCSI_S_HEAD:
++ return MSG_HEAD_TAG;
++ case VIRTIO_SCSI_S_ACA:
++ return MSG_ACA_TAG;
++ default:
++ break;
++ }
++ return MSG_SIMPLE_TAG;
++}
++
+ static void tcm_vhost_submission_work(struct work_struct *work)
+ {
+ struct tcm_vhost_cmd *cmd =
+@@ -934,9 +951,10 @@ static void tcm_vhost_submission_work(struct work_struct *work)
+ rc = target_submit_cmd_map_sgls(se_cmd, tv_nexus->tvn_se_sess,
+ cmd->tvc_cdb, &cmd->tvc_sense_buf[0],
+ cmd->tvc_lun, cmd->tvc_exp_data_len,
+- cmd->tvc_task_attr, cmd->tvc_data_direction,
+- TARGET_SCF_ACK_KREF, sg_ptr, cmd->tvc_sgl_count,
+- NULL, 0, sg_prot_ptr, cmd->tvc_prot_sgl_count);
++ vhost_scsi_to_tcm_attr(cmd->tvc_task_attr),
++ cmd->tvc_data_direction, TARGET_SCF_ACK_KREF,
++ sg_ptr, cmd->tvc_sgl_count, NULL, 0,
++ sg_prot_ptr, cmd->tvc_prot_sgl_count);
+ if (rc < 0) {
+ transport_send_check_condition_and_sense(se_cmd,
+ TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE, 0);
+diff --git a/drivers/video/fbdev/core/fb_defio.c b/drivers/video/fbdev/core/fb_defio.c
+index 900aa4ecd617..d6cab1fd9a47 100644
+--- a/drivers/video/fbdev/core/fb_defio.c
++++ b/drivers/video/fbdev/core/fb_defio.c
+@@ -83,9 +83,10 @@ int fb_deferred_io_fsync(struct file *file, loff_t start, loff_t end, int datasy
+ cancel_delayed_work_sync(&info->deferred_work);
+
+ /* Run it immediately */
+- err = schedule_delayed_work(&info->deferred_work, 0);
++ schedule_delayed_work(&info->deferred_work, 0);
+ mutex_unlock(&inode->i_mutex);
+- return err;
++
++ return 0;
+ }
+ EXPORT_SYMBOL_GPL(fb_deferred_io_fsync);
+
+diff --git a/drivers/video/logo/logo.c b/drivers/video/logo/logo.c
+index 940cd196eef5..10fbfd8ab963 100644
+--- a/drivers/video/logo/logo.c
++++ b/drivers/video/logo/logo.c
+@@ -21,6 +21,21 @@ static bool nologo;
+ module_param(nologo, bool, 0);
+ MODULE_PARM_DESC(nologo, "Disables startup logo");
+
++/*
++ * Logos are located in the initdata, and will be freed in kernel_init.
++ * Use late_init to mark the logos as freed to prevent any further use.
++ */
++
++static bool logos_freed;
++
++static int __init fb_logo_late_init(void)
++{
++ logos_freed = true;
++ return 0;
++}
++
++late_initcall(fb_logo_late_init);
++
+ /* logo's are marked __initdata. Use __init_refok to tell
+ * modpost that it is intended that this function uses data
+ * marked __initdata.
+@@ -29,7 +44,7 @@ const struct linux_logo * __init_refok fb_find_logo(int depth)
+ {
+ const struct linux_logo *logo = NULL;
+
+- if (nologo)
++ if (nologo || logos_freed)
+ return NULL;
+
+ if (depth >= 1) {
+diff --git a/fs/lockd/svc.c b/fs/lockd/svc.c
+index d1bb7ecfd201..61024987f97b 100644
+--- a/fs/lockd/svc.c
++++ b/fs/lockd/svc.c
+@@ -138,10 +138,6 @@ lockd(void *vrqstp)
+
+ dprintk("NFS locking service started (ver " LOCKD_VERSION ").\n");
+
+- if (!nlm_timeout)
+- nlm_timeout = LOCKD_DFLT_TIMEO;
+- nlmsvc_timeout = nlm_timeout * HZ;
+-
+ /*
+ * The main request loop. We don't terminate until the last
+ * NFS mount or NFS daemon has gone away.
+@@ -350,6 +346,10 @@ static struct svc_serv *lockd_create_svc(void)
+ printk(KERN_WARNING
+ "lockd_up: no pid, %d users??\n", nlmsvc_users);
+
++ if (!nlm_timeout)
++ nlm_timeout = LOCKD_DFLT_TIMEO;
++ nlmsvc_timeout = nlm_timeout * HZ;
++
+ serv = svc_create(&nlmsvc_program, LOCKD_BUFSIZE, NULL);
+ if (!serv) {
+ printk(KERN_WARNING "lockd_up: create service failed\n");
+diff --git a/fs/locks.c b/fs/locks.c
+index 735b8d3fa78c..59e2f905e4ff 100644
+--- a/fs/locks.c
++++ b/fs/locks.c
+@@ -1702,7 +1702,7 @@ static int generic_delete_lease(struct file *filp)
+ break;
+ }
+ trace_generic_delete_lease(inode, fl);
+- if (fl)
++ if (fl && IS_LEASE(fl))
+ error = fl->fl_lmops->lm_change(before, F_UNLCK, &dispose);
+ spin_unlock(&inode->i_lock);
+ locks_dispose_list(&dispose);
+diff --git a/fs/nfs/nfs4client.c b/fs/nfs/nfs4client.c
+index ffdb28d86cf8..9588873d4c46 100644
+--- a/fs/nfs/nfs4client.c
++++ b/fs/nfs/nfs4client.c
+@@ -572,20 +572,14 @@ static bool nfs4_match_clientids(struct nfs_client *a, struct nfs_client *b)
+ }
+
+ /*
+- * Returns true if the server owners match
++ * Returns true if the server major ids match
+ */
+ static bool
+-nfs4_match_serverowners(struct nfs_client *a, struct nfs_client *b)
++nfs4_check_clientid_trunking(struct nfs_client *a, struct nfs_client *b)
+ {
+ struct nfs41_server_owner *o1 = a->cl_serverowner;
+ struct nfs41_server_owner *o2 = b->cl_serverowner;
+
+- if (o1->minor_id != o2->minor_id) {
+- dprintk("NFS: --> %s server owner minor IDs do not match\n",
+- __func__);
+- return false;
+- }
+-
+ if (o1->major_id_sz != o2->major_id_sz)
+ goto out_major_mismatch;
+ if (memcmp(o1->major_id, o2->major_id, o1->major_id_sz) != 0)
+@@ -661,7 +655,12 @@ int nfs41_walk_client_list(struct nfs_client *new,
+ if (!nfs4_match_clientids(pos, new))
+ continue;
+
+- if (!nfs4_match_serverowners(pos, new))
++ /*
++ * Note that session trunking is just a special subcase of
++ * client id trunking. In either case, we want to fall back
++ * to using the existing nfs_client.
++ */
++ if (!nfs4_check_clientid_trunking(pos, new))
+ continue;
+
+ atomic_inc(&pos->cl_count);
+diff --git a/fs/proc/stat.c b/fs/proc/stat.c
+index bf2d03f8fd3e..510413eb25b8 100644
+--- a/fs/proc/stat.c
++++ b/fs/proc/stat.c
+@@ -159,7 +159,7 @@ static int show_stat(struct seq_file *p, void *v)
+
+ /* sum again ? it could be updated? */
+ for_each_irq_nr(j)
+- seq_put_decimal_ull(p, ' ', kstat_irqs(j));
++ seq_put_decimal_ull(p, ' ', kstat_irqs_usr(j));
+
+ seq_printf(p,
+ "\nctxt %llu\n"
+diff --git a/include/linux/kernel_stat.h b/include/linux/kernel_stat.h
+index b9376cd5a187..25a822f6f000 100644
+--- a/include/linux/kernel_stat.h
++++ b/include/linux/kernel_stat.h
+@@ -68,6 +68,7 @@ static inline unsigned int kstat_softirqs_cpu(unsigned int irq, int cpu)
+ * Number of interrupts per specific IRQ source, since bootup
+ */
+ extern unsigned int kstat_irqs(unsigned int irq);
++extern unsigned int kstat_irqs_usr(unsigned int irq);
+
+ /*
+ * Number of interrupts per cpu, since bootup
+diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
+index 74fd5d37f15a..22339b4b1c8c 100644
+--- a/include/linux/netdevice.h
++++ b/include/linux/netdevice.h
+@@ -998,12 +998,15 @@ typedef u16 (*select_queue_fallback_t)(struct net_device *dev,
+ * Callback to use for xmit over the accelerated station. This
+ * is used in place of ndo_start_xmit on accelerated net
+ * devices.
+- * bool (*ndo_gso_check) (struct sk_buff *skb,
+- * struct net_device *dev);
++ * netdev_features_t (*ndo_features_check) (struct sk_buff *skb,
++ * struct net_device *dev
++ * netdev_features_t features);
+ * Called by core transmit path to determine if device is capable of
+- * performing GSO on a packet. The device returns true if it is
+- * able to GSO the packet, false otherwise. If the return value is
+- * false the stack will do software GSO.
++ * performing offload operations on a given packet. This is to give
++ * the device an opportunity to implement any restrictions that cannot
++ * be otherwise expressed by feature flags. The check is called with
++ * the set of features that the stack has calculated and it returns
++ * those the driver believes to be appropriate.
+ */
+ struct net_device_ops {
+ int (*ndo_init)(struct net_device *dev);
+@@ -1153,8 +1156,9 @@ struct net_device_ops {
+ struct net_device *dev,
+ void *priv);
+ int (*ndo_get_lock_subclass)(struct net_device *dev);
+- bool (*ndo_gso_check) (struct sk_buff *skb,
+- struct net_device *dev);
++ netdev_features_t (*ndo_features_check) (struct sk_buff *skb,
++ struct net_device *dev,
++ netdev_features_t features);
+ };
+
+ /**
+@@ -3584,8 +3588,6 @@ static inline bool netif_needs_gso(struct net_device *dev, struct sk_buff *skb,
+ netdev_features_t features)
+ {
+ return skb_is_gso(skb) && (!skb_gso_ok(skb, features) ||
+- (dev->netdev_ops->ndo_gso_check &&
+- !dev->netdev_ops->ndo_gso_check(skb, dev)) ||
+ unlikely((skb->ip_summed != CHECKSUM_PARTIAL) &&
+ (skb->ip_summed != CHECKSUM_UNNECESSARY)));
+ }
+diff --git a/include/net/vxlan.h b/include/net/vxlan.h
+index 57cccd0052e5..903461aa5644 100644
+--- a/include/net/vxlan.h
++++ b/include/net/vxlan.h
+@@ -1,6 +1,9 @@
+ #ifndef __NET_VXLAN_H
+ #define __NET_VXLAN_H 1
+
++#include <linux/ip.h>
++#include <linux/ipv6.h>
++#include <linux/if_vlan.h>
+ #include <linux/skbuff.h>
+ #include <linux/netdevice.h>
+ #include <linux/udp.h>
+@@ -51,16 +54,33 @@ int vxlan_xmit_skb(struct vxlan_sock *vs,
+ __be32 src, __be32 dst, __u8 tos, __u8 ttl, __be16 df,
+ __be16 src_port, __be16 dst_port, __be32 vni, bool xnet);
+
+-static inline bool vxlan_gso_check(struct sk_buff *skb)
++static inline netdev_features_t vxlan_features_check(struct sk_buff *skb,
++ netdev_features_t features)
+ {
+- if ((skb_shinfo(skb)->gso_type & SKB_GSO_UDP_TUNNEL) &&
++ u8 l4_hdr = 0;
++
++ if (!skb->encapsulation)
++ return features;
++
++ switch (vlan_get_protocol(skb)) {
++ case htons(ETH_P_IP):
++ l4_hdr = ip_hdr(skb)->protocol;
++ break;
++ case htons(ETH_P_IPV6):
++ l4_hdr = ipv6_hdr(skb)->nexthdr;
++ break;
++ default:
++ return features;;
++ }
++
++ if ((l4_hdr == IPPROTO_UDP) &&
+ (skb->inner_protocol_type != ENCAP_TYPE_ETHER ||
+ skb->inner_protocol != htons(ETH_P_TEB) ||
+ (skb_inner_mac_header(skb) - skb_transport_header(skb) !=
+ sizeof(struct udphdr) + sizeof(struct vxlanhdr))))
+- return false;
++ return features & ~(NETIF_F_ALL_CSUM | NETIF_F_GSO_MASK);
+
+- return true;
++ return features;
+ }
+
+ /* IP header + UDP + VXLAN + Ethernet header */
+diff --git a/include/uapi/linux/in6.h b/include/uapi/linux/in6.h
+index 74a2a1773494..79b12b004ade 100644
+--- a/include/uapi/linux/in6.h
++++ b/include/uapi/linux/in6.h
+@@ -149,7 +149,7 @@ struct in6_flowlabel_req {
+ /*
+ * IPV6 socket options
+ */
+-
++#if __UAPI_DEF_IPV6_OPTIONS
+ #define IPV6_ADDRFORM 1
+ #define IPV6_2292PKTINFO 2
+ #define IPV6_2292HOPOPTS 3
+@@ -196,6 +196,7 @@ struct in6_flowlabel_req {
+
+ #define IPV6_IPSEC_POLICY 34
+ #define IPV6_XFRM_POLICY 35
++#endif
+
+ /*
+ * Multicast:
+diff --git a/include/uapi/linux/libc-compat.h b/include/uapi/linux/libc-compat.h
+index c140620dad92..e28807ad17fa 100644
+--- a/include/uapi/linux/libc-compat.h
++++ b/include/uapi/linux/libc-compat.h
+@@ -69,6 +69,7 @@
+ #define __UAPI_DEF_SOCKADDR_IN6 0
+ #define __UAPI_DEF_IPV6_MREQ 0
+ #define __UAPI_DEF_IPPROTO_V6 0
++#define __UAPI_DEF_IPV6_OPTIONS 0
+
+ #else
+
+@@ -82,6 +83,7 @@
+ #define __UAPI_DEF_SOCKADDR_IN6 1
+ #define __UAPI_DEF_IPV6_MREQ 1
+ #define __UAPI_DEF_IPPROTO_V6 1
++#define __UAPI_DEF_IPV6_OPTIONS 1
+
+ #endif /* _NETINET_IN_H */
+
+@@ -103,6 +105,7 @@
+ #define __UAPI_DEF_SOCKADDR_IN6 1
+ #define __UAPI_DEF_IPV6_MREQ 1
+ #define __UAPI_DEF_IPPROTO_V6 1
++#define __UAPI_DEF_IPV6_OPTIONS 1
+
+ /* Definitions for xattr.h */
+ #define __UAPI_DEF_XATTR 1
+diff --git a/include/uapi/linux/target_core_user.h b/include/uapi/linux/target_core_user.h
+index 7dcfbe6771b1..b483d1909d3e 100644
+--- a/include/uapi/linux/target_core_user.h
++++ b/include/uapi/linux/target_core_user.h
+@@ -6,10 +6,6 @@
+ #include <linux/types.h>
+ #include <linux/uio.h>
+
+-#ifndef __packed
+-#define __packed __attribute__((packed))
+-#endif
+-
+ #define TCMU_VERSION "1.0"
+
+ /*
+diff --git a/kernel/irq/internals.h b/kernel/irq/internals.h
+index 4332d766619d..df553b0af936 100644
+--- a/kernel/irq/internals.h
++++ b/kernel/irq/internals.h
+@@ -78,8 +78,12 @@ extern void unmask_threaded_irq(struct irq_desc *desc);
+
+ #ifdef CONFIG_SPARSE_IRQ
+ static inline void irq_mark_irq(unsigned int irq) { }
++extern void irq_lock_sparse(void);
++extern void irq_unlock_sparse(void);
+ #else
+ extern void irq_mark_irq(unsigned int irq);
++static inline void irq_lock_sparse(void) { }
++static inline void irq_unlock_sparse(void) { }
+ #endif
+
+ extern void init_kstat_irqs(struct irq_desc *desc, int node, int nr);
+diff --git a/kernel/irq/irqdesc.c b/kernel/irq/irqdesc.c
+index a1782f88f0af..99793b9b6d23 100644
+--- a/kernel/irq/irqdesc.c
++++ b/kernel/irq/irqdesc.c
+@@ -132,6 +132,16 @@ static void free_masks(struct irq_desc *desc)
+ static inline void free_masks(struct irq_desc *desc) { }
+ #endif
+
++void irq_lock_sparse(void)
++{
++ mutex_lock(&sparse_irq_lock);
++}
++
++void irq_unlock_sparse(void)
++{
++ mutex_unlock(&sparse_irq_lock);
++}
++
+ static struct irq_desc *alloc_desc(int irq, int node, struct module *owner)
+ {
+ struct irq_desc *desc;
+@@ -168,6 +178,12 @@ static void free_desc(unsigned int irq)
+
+ unregister_irq_proc(irq, desc);
+
++ /*
++ * sparse_irq_lock protects also show_interrupts() and
++ * kstat_irq_usr(). Once we deleted the descriptor from the
++ * sparse tree we can free it. Access in proc will fail to
++ * lookup the descriptor.
++ */
+ mutex_lock(&sparse_irq_lock);
+ delete_irq_desc(irq);
+ mutex_unlock(&sparse_irq_lock);
+@@ -574,6 +590,15 @@ void kstat_incr_irq_this_cpu(unsigned int irq)
+ kstat_incr_irqs_this_cpu(irq, irq_to_desc(irq));
+ }
+
++/**
++ * kstat_irqs_cpu - Get the statistics for an interrupt on a cpu
++ * @irq: The interrupt number
++ * @cpu: The cpu number
++ *
++ * Returns the sum of interrupt counts on @cpu since boot for
++ * @irq. The caller must ensure that the interrupt is not removed
++ * concurrently.
++ */
+ unsigned int kstat_irqs_cpu(unsigned int irq, int cpu)
+ {
+ struct irq_desc *desc = irq_to_desc(irq);
+@@ -582,6 +607,14 @@ unsigned int kstat_irqs_cpu(unsigned int irq, int cpu)
+ *per_cpu_ptr(desc->kstat_irqs, cpu) : 0;
+ }
+
++/**
++ * kstat_irqs - Get the statistics for an interrupt
++ * @irq: The interrupt number
++ *
++ * Returns the sum of interrupt counts on all cpus since boot for
++ * @irq. The caller must ensure that the interrupt is not removed
++ * concurrently.
++ */
+ unsigned int kstat_irqs(unsigned int irq)
+ {
+ struct irq_desc *desc = irq_to_desc(irq);
+@@ -594,3 +627,22 @@ unsigned int kstat_irqs(unsigned int irq)
+ sum += *per_cpu_ptr(desc->kstat_irqs, cpu);
+ return sum;
+ }
++
++/**
++ * kstat_irqs_usr - Get the statistics for an interrupt
++ * @irq: The interrupt number
++ *
++ * Returns the sum of interrupt counts on all cpus since boot for
++ * @irq. Contrary to kstat_irqs() this can be called from any
++ * preemptible context. It's protected against concurrent removal of
++ * an interrupt descriptor when sparse irqs are enabled.
++ */
++unsigned int kstat_irqs_usr(unsigned int irq)
++{
++ int sum;
++
++ irq_lock_sparse();
++ sum = kstat_irqs(irq);
++ irq_unlock_sparse();
++ return sum;
++}
+diff --git a/kernel/irq/proc.c b/kernel/irq/proc.c
+index ac1ba2f11032..9dc9bfd8a678 100644
+--- a/kernel/irq/proc.c
++++ b/kernel/irq/proc.c
+@@ -15,6 +15,23 @@
+
+ #include "internals.h"
+
++/*
++ * Access rules:
++ *
++ * procfs protects read/write of /proc/irq/N/ files against a
++ * concurrent free of the interrupt descriptor. remove_proc_entry()
++ * immediately prevents new read/writes to happen and waits for
++ * already running read/write functions to complete.
++ *
++ * We remove the proc entries first and then delete the interrupt
++ * descriptor from the radix tree and free it. So it is guaranteed
++ * that irq_to_desc(N) is valid as long as the read/writes are
++ * permitted by procfs.
++ *
++ * The read from /proc/interrupts is a different problem because there
++ * is no protection. So the lookup and the access to irqdesc
++ * information must be protected by sparse_irq_lock.
++ */
+ static struct proc_dir_entry *root_irq_dir;
+
+ #ifdef CONFIG_SMP
+@@ -437,9 +454,10 @@ int show_interrupts(struct seq_file *p, void *v)
+ seq_putc(p, '\n');
+ }
+
++ irq_lock_sparse();
+ desc = irq_to_desc(i);
+ if (!desc)
+- return 0;
++ goto outsparse;
+
+ raw_spin_lock_irqsave(&desc->lock, flags);
+ for_each_online_cpu(j)
+@@ -479,6 +497,8 @@ int show_interrupts(struct seq_file *p, void *v)
+ seq_putc(p, '\n');
+ out:
+ raw_spin_unlock_irqrestore(&desc->lock, flags);
++outsparse:
++ irq_unlock_sparse();
+ return 0;
+ }
+ #endif
+diff --git a/kernel/time/tick-sched.c b/kernel/time/tick-sched.c
+index 7b5741fc4110..8c30ef7a2b70 100644
+--- a/kernel/time/tick-sched.c
++++ b/kernel/time/tick-sched.c
+@@ -847,7 +847,6 @@ void tick_nohz_idle_enter(void)
+
+ local_irq_enable();
+ }
+-EXPORT_SYMBOL_GPL(tick_nohz_idle_enter);
+
+ /**
+ * tick_nohz_irq_exit - update next tick event from interrupt exit
+@@ -974,7 +973,6 @@ void tick_nohz_idle_exit(void)
+
+ local_irq_enable();
+ }
+-EXPORT_SYMBOL_GPL(tick_nohz_idle_exit);
+
+ static int tick_nohz_reprogram(struct tick_sched *ts, ktime_t now)
+ {
+diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
+index 31c90fec4158..124e2c702ead 100644
+--- a/kernel/trace/ftrace.c
++++ b/kernel/trace/ftrace.c
+@@ -2308,12 +2308,14 @@ static void ftrace_run_update_code(int command)
+ }
+
+ static void ftrace_run_modify_code(struct ftrace_ops *ops, int command,
+- struct ftrace_hash *old_hash)
++ struct ftrace_ops_hash *old_hash)
+ {
+ ops->flags |= FTRACE_OPS_FL_MODIFYING;
+- ops->old_hash.filter_hash = old_hash;
++ ops->old_hash.filter_hash = old_hash->filter_hash;
++ ops->old_hash.notrace_hash = old_hash->notrace_hash;
+ ftrace_run_update_code(command);
+ ops->old_hash.filter_hash = NULL;
++ ops->old_hash.notrace_hash = NULL;
+ ops->flags &= ~FTRACE_OPS_FL_MODIFYING;
+ }
+
+@@ -3357,7 +3359,7 @@ static struct ftrace_ops trace_probe_ops __read_mostly =
+
+ static int ftrace_probe_registered;
+
+-static void __enable_ftrace_function_probe(struct ftrace_hash *old_hash)
++static void __enable_ftrace_function_probe(struct ftrace_ops_hash *old_hash)
+ {
+ int ret;
+ int i;
+@@ -3415,6 +3417,7 @@ int
+ register_ftrace_function_probe(char *glob, struct ftrace_probe_ops *ops,
+ void *data)
+ {
++ struct ftrace_ops_hash old_hash_ops;
+ struct ftrace_func_probe *entry;
+ struct ftrace_hash **orig_hash = &trace_probe_ops.func_hash->filter_hash;
+ struct ftrace_hash *old_hash = *orig_hash;
+@@ -3436,6 +3439,10 @@ register_ftrace_function_probe(char *glob, struct ftrace_probe_ops *ops,
+
+ mutex_lock(&trace_probe_ops.func_hash->regex_lock);
+
++ old_hash_ops.filter_hash = old_hash;
++ /* Probes only have filters */
++ old_hash_ops.notrace_hash = NULL;
++
+ hash = alloc_and_copy_ftrace_hash(FTRACE_HASH_DEFAULT_BITS, old_hash);
+ if (!hash) {
+ count = -ENOMEM;
+@@ -3496,7 +3503,7 @@ register_ftrace_function_probe(char *glob, struct ftrace_probe_ops *ops,
+
+ ret = ftrace_hash_move(&trace_probe_ops, 1, orig_hash, hash);
+
+- __enable_ftrace_function_probe(old_hash);
++ __enable_ftrace_function_probe(&old_hash_ops);
+
+ if (!ret)
+ free_ftrace_hash_rcu(old_hash);
+@@ -3784,10 +3791,34 @@ ftrace_match_addr(struct ftrace_hash *hash, unsigned long ip, int remove)
+ }
+
+ static void ftrace_ops_update_code(struct ftrace_ops *ops,
+- struct ftrace_hash *old_hash)
++ struct ftrace_ops_hash *old_hash)
+ {
+- if (ops->flags & FTRACE_OPS_FL_ENABLED && ftrace_enabled)
++ struct ftrace_ops *op;
++
++ if (!ftrace_enabled)
++ return;
++
++ if (ops->flags & FTRACE_OPS_FL_ENABLED) {
+ ftrace_run_modify_code(ops, FTRACE_UPDATE_CALLS, old_hash);
++ return;
++ }
++
++ /*
++ * If this is the shared global_ops filter, then we need to
++ * check if there is another ops that shares it, is enabled.
++ * If so, we still need to run the modify code.
++ */
++ if (ops->func_hash != &global_ops.local_hash)
++ return;
++
++ do_for_each_ftrace_op(op, ftrace_ops_list) {
++ if (op->func_hash == &global_ops.local_hash &&
++ op->flags & FTRACE_OPS_FL_ENABLED) {
++ ftrace_run_modify_code(op, FTRACE_UPDATE_CALLS, old_hash);
++ /* Only need to do this once */
++ return;
++ }
++ } while_for_each_ftrace_op(op);
+ }
+
+ static int
+@@ -3795,6 +3826,7 @@ ftrace_set_hash(struct ftrace_ops *ops, unsigned char *buf, int len,
+ unsigned long ip, int remove, int reset, int enable)
+ {
+ struct ftrace_hash **orig_hash;
++ struct ftrace_ops_hash old_hash_ops;
+ struct ftrace_hash *old_hash;
+ struct ftrace_hash *hash;
+ int ret;
+@@ -3831,9 +3863,11 @@ ftrace_set_hash(struct ftrace_ops *ops, unsigned char *buf, int len,
+
+ mutex_lock(&ftrace_lock);
+ old_hash = *orig_hash;
++ old_hash_ops.filter_hash = ops->func_hash->filter_hash;
++ old_hash_ops.notrace_hash = ops->func_hash->notrace_hash;
+ ret = ftrace_hash_move(ops, enable, orig_hash, hash);
+ if (!ret) {
+- ftrace_ops_update_code(ops, old_hash);
++ ftrace_ops_update_code(ops, &old_hash_ops);
+ free_ftrace_hash_rcu(old_hash);
+ }
+ mutex_unlock(&ftrace_lock);
+@@ -4042,6 +4076,7 @@ static void __init set_ftrace_early_filters(void)
+ int ftrace_regex_release(struct inode *inode, struct file *file)
+ {
+ struct seq_file *m = (struct seq_file *)file->private_data;
++ struct ftrace_ops_hash old_hash_ops;
+ struct ftrace_iterator *iter;
+ struct ftrace_hash **orig_hash;
+ struct ftrace_hash *old_hash;
+@@ -4075,10 +4110,12 @@ int ftrace_regex_release(struct inode *inode, struct file *file)
+
+ mutex_lock(&ftrace_lock);
+ old_hash = *orig_hash;
++ old_hash_ops.filter_hash = iter->ops->func_hash->filter_hash;
++ old_hash_ops.notrace_hash = iter->ops->func_hash->notrace_hash;
+ ret = ftrace_hash_move(iter->ops, filter_hash,
+ orig_hash, iter->hash);
+ if (!ret) {
+- ftrace_ops_update_code(iter->ops, old_hash);
++ ftrace_ops_update_code(iter->ops, &old_hash_ops);
+ free_ftrace_hash_rcu(old_hash);
+ }
+ mutex_unlock(&ftrace_lock);
+diff --git a/lib/decompress_bunzip2.c b/lib/decompress_bunzip2.c
+index 8290e0bef7ea..6dd0335ea61b 100644
+--- a/lib/decompress_bunzip2.c
++++ b/lib/decompress_bunzip2.c
+@@ -184,7 +184,7 @@ static int INIT get_next_block(struct bunzip_data *bd)
+ if (get_bits(bd, 1))
+ return RETVAL_OBSOLETE_INPUT;
+ origPtr = get_bits(bd, 24);
+- if (origPtr > dbufSize)
++ if (origPtr >= dbufSize)
+ return RETVAL_DATA_ERROR;
+ /* mapping table: if some byte values are never used (encoding things
+ like ascii text), the compression code removes the gaps to have fewer
+diff --git a/net/batman-adv/fragmentation.c b/net/batman-adv/fragmentation.c
+index fc1835c6bb40..00f9e144cc97 100644
+--- a/net/batman-adv/fragmentation.c
++++ b/net/batman-adv/fragmentation.c
+@@ -251,7 +251,7 @@ batadv_frag_merge_packets(struct hlist_head *chain, struct sk_buff *skb)
+ kfree(entry);
+
+ /* Make room for the rest of the fragments. */
+- if (pskb_expand_head(skb_out, 0, size - skb->len, GFP_ATOMIC) < 0) {
++ if (pskb_expand_head(skb_out, 0, size - skb_out->len, GFP_ATOMIC) < 0) {
+ kfree_skb(skb_out);
+ skb_out = NULL;
+ goto free;
+@@ -434,7 +434,7 @@ bool batadv_frag_send_packet(struct sk_buff *skb,
+ * fragments larger than BATADV_FRAG_MAX_FRAG_SIZE
+ */
+ mtu = min_t(unsigned, mtu, BATADV_FRAG_MAX_FRAG_SIZE);
+- max_fragment_size = (mtu - header_size - ETH_HLEN);
++ max_fragment_size = mtu - header_size;
+ max_packet_size = max_fragment_size * BATADV_FRAG_MAX_FRAGMENTS;
+
+ /* Don't even try to fragment, if we need more than 16 fragments */
+diff --git a/net/batman-adv/gateway_client.c b/net/batman-adv/gateway_client.c
+index 90cff585b37d..e0bcf9e84273 100644
+--- a/net/batman-adv/gateway_client.c
++++ b/net/batman-adv/gateway_client.c
+@@ -810,7 +810,7 @@ bool batadv_gw_out_of_range(struct batadv_priv *bat_priv,
+ goto out;
+
+ gw_node = batadv_gw_node_get(bat_priv, orig_dst_node);
+- if (!gw_node->bandwidth_down == 0)
++ if (!gw_node)
+ goto out;
+
+ switch (atomic_read(&bat_priv->gw_mode)) {
+diff --git a/net/core/dev.c b/net/core/dev.c
+index 945bbd001359..84409688ff39 100644
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -1697,6 +1697,7 @@ int __dev_forward_skb(struct net_device *dev, struct sk_buff *skb)
+
+ skb_scrub_packet(skb, true);
+ skb->protocol = eth_type_trans(skb, dev);
++ skb_postpull_rcsum(skb, eth_hdr(skb), ETH_HLEN);
+
+ return 0;
+ }
+@@ -2565,7 +2566,7 @@ static netdev_features_t harmonize_features(struct sk_buff *skb,
+
+ netdev_features_t netif_skb_features(struct sk_buff *skb)
+ {
+- const struct net_device *dev = skb->dev;
++ struct net_device *dev = skb->dev;
+ netdev_features_t features = dev->features;
+ u16 gso_segs = skb_shinfo(skb)->gso_segs;
+ __be16 protocol = skb->protocol;
+@@ -2573,11 +2574,21 @@ netdev_features_t netif_skb_features(struct sk_buff *skb)
+ if (gso_segs > dev->gso_max_segs || gso_segs < dev->gso_min_segs)
+ features &= ~NETIF_F_GSO_MASK;
+
+- if (protocol == htons(ETH_P_8021Q) || protocol == htons(ETH_P_8021AD)) {
+- struct vlan_ethhdr *veh = (struct vlan_ethhdr *)skb->data;
+- protocol = veh->h_vlan_encapsulated_proto;
+- } else if (!vlan_tx_tag_present(skb)) {
+- return harmonize_features(skb, features);
++ /* If encapsulation offload request, verify we are testing
++ * hardware encapsulation features instead of standard
++ * features for the netdev
++ */
++ if (skb->encapsulation)
++ features &= dev->hw_enc_features;
++
++ if (!vlan_tx_tag_present(skb)) {
++ if (unlikely(protocol == htons(ETH_P_8021Q) ||
++ protocol == htons(ETH_P_8021AD))) {
++ struct vlan_ethhdr *veh = (struct vlan_ethhdr *)skb->data;
++ protocol = veh->h_vlan_encapsulated_proto;
++ } else {
++ goto finalize;
++ }
+ }
+
+ features = netdev_intersect_features(features,
+@@ -2594,6 +2605,11 @@ netdev_features_t netif_skb_features(struct sk_buff *skb)
+ NETIF_F_HW_VLAN_CTAG_TX |
+ NETIF_F_HW_VLAN_STAG_TX);
+
++finalize:
++ if (dev->netdev_ops->ndo_features_check)
++ features &= dev->netdev_ops->ndo_features_check(skb, dev,
++ features);
++
+ return harmonize_features(skb, features);
+ }
+ EXPORT_SYMBOL(netif_skb_features);
+@@ -2668,19 +2684,12 @@ static struct sk_buff *validate_xmit_skb(struct sk_buff *skb, struct net_device
+ if (unlikely(!skb))
+ goto out_null;
+
+- /* If encapsulation offload request, verify we are testing
+- * hardware encapsulation features instead of standard
+- * features for the netdev
+- */
+- if (skb->encapsulation)
+- features &= dev->hw_enc_features;
+-
+ if (netif_needs_gso(dev, skb, features)) {
+ struct sk_buff *segs;
+
+ segs = skb_gso_segment(skb, features);
+ if (IS_ERR(segs)) {
+- segs = NULL;
++ goto out_kfree_skb;
+ } else if (segs) {
+ consume_skb(skb);
+ skb = segs;
+diff --git a/net/core/skbuff.c b/net/core/skbuff.c
+index 32e31c299631..d7543d0fd744 100644
+--- a/net/core/skbuff.c
++++ b/net/core/skbuff.c
+@@ -4040,6 +4040,7 @@ void skb_scrub_packet(struct sk_buff *skb, bool xnet)
+ skb->ignore_df = 0;
+ skb_dst_drop(skb);
+ skb->mark = 0;
++ skb_init_secmark(skb);
+ secpath_reset(skb);
+ nf_reset(skb);
+ nf_reset_trace(skb);
+diff --git a/net/ipv4/geneve.c b/net/ipv4/geneve.c
+index dedb21e99914..2caa6ad965a6 100644
+--- a/net/ipv4/geneve.c
++++ b/net/ipv4/geneve.c
+@@ -165,6 +165,15 @@ static void geneve_notify_add_rx_port(struct geneve_sock *gs)
+ }
+ }
+
++static void geneve_notify_del_rx_port(struct geneve_sock *gs)
++{
++ struct sock *sk = gs->sock->sk;
++ sa_family_t sa_family = sk->sk_family;
++
++ if (sa_family == AF_INET)
++ udp_del_offload(&gs->udp_offloads);
++}
++
+ /* Callback from net/ipv4/udp.c to receive packets */
+ static int geneve_udp_encap_recv(struct sock *sk, struct sk_buff *skb)
+ {
+@@ -293,6 +302,7 @@ struct geneve_sock *geneve_sock_add(struct net *net, __be16 port,
+ geneve_rcv_t *rcv, void *data,
+ bool no_share, bool ipv6)
+ {
++ struct geneve_net *gn = net_generic(net, geneve_net_id);
+ struct geneve_sock *gs;
+
+ gs = geneve_socket_create(net, port, rcv, data, ipv6);
+@@ -302,15 +312,15 @@ struct geneve_sock *geneve_sock_add(struct net *net, __be16 port,
+ if (no_share) /* Return error if sharing is not allowed. */
+ return ERR_PTR(-EINVAL);
+
++ spin_lock(&gn->sock_lock);
+ gs = geneve_find_sock(net, port);
+- if (gs) {
+- if (gs->rcv == rcv)
+- atomic_inc(&gs->refcnt);
+- else
++ if (gs && ((gs->rcv != rcv) ||
++ !atomic_add_unless(&gs->refcnt, 1, 0)))
+ gs = ERR_PTR(-EBUSY);
+- } else {
++ spin_unlock(&gn->sock_lock);
++
++ if (!gs)
+ gs = ERR_PTR(-EINVAL);
+- }
+
+ return gs;
+ }
+@@ -318,9 +328,17 @@ EXPORT_SYMBOL_GPL(geneve_sock_add);
+
+ void geneve_sock_release(struct geneve_sock *gs)
+ {
++ struct net *net = sock_net(gs->sock->sk);
++ struct geneve_net *gn = net_generic(net, geneve_net_id);
++
+ if (!atomic_dec_and_test(&gs->refcnt))
+ return;
+
++ spin_lock(&gn->sock_lock);
++ hlist_del_rcu(&gs->hlist);
++ geneve_notify_del_rx_port(gs);
++ spin_unlock(&gn->sock_lock);
++
+ queue_work(geneve_wq, &gs->del_work);
+ }
+ EXPORT_SYMBOL_GPL(geneve_sock_release);
+diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
+index 12055fdbe716..69aaf0a2c424 100644
+--- a/net/ipv4/ip_gre.c
++++ b/net/ipv4/ip_gre.c
+@@ -252,10 +252,6 @@ static netdev_tx_t ipgre_xmit(struct sk_buff *skb,
+ struct ip_tunnel *tunnel = netdev_priv(dev);
+ const struct iphdr *tnl_params;
+
+- skb = gre_handle_offloads(skb, !!(tunnel->parms.o_flags&TUNNEL_CSUM));
+- if (IS_ERR(skb))
+- goto out;
+-
+ if (dev->header_ops) {
+ /* Need space for new headers */
+ if (skb_cow_head(skb, dev->needed_headroom -
+@@ -268,6 +264,7 @@ static netdev_tx_t ipgre_xmit(struct sk_buff *skb,
+ * to gre header.
+ */
+ skb_pull(skb, tunnel->hlen + sizeof(struct iphdr));
++ skb_reset_mac_header(skb);
+ } else {
+ if (skb_cow_head(skb, dev->needed_headroom))
+ goto free_skb;
+@@ -275,6 +272,10 @@ static netdev_tx_t ipgre_xmit(struct sk_buff *skb,
+ tnl_params = &tunnel->parms.iph;
+ }
+
++ skb = gre_handle_offloads(skb, !!(tunnel->parms.o_flags&TUNNEL_CSUM));
++ if (IS_ERR(skb))
++ goto out;
++
+ __gre_xmit(skb, dev, tnl_params, skb->protocol);
+
+ return NETDEV_TX_OK;
+diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
+index a3d453b94747..c2df40ba553f 100644
+--- a/net/ipv4/tcp_output.c
++++ b/net/ipv4/tcp_output.c
+@@ -1984,7 +1984,7 @@ static bool tcp_write_xmit(struct sock *sk, unsigned int mss_now, int nonagle,
+ if (unlikely(!tcp_snd_wnd_test(tp, skb, mss_now)))
+ break;
+
+- if (tso_segs == 1) {
++ if (tso_segs == 1 || !sk->sk_gso_max_segs) {
+ if (unlikely(!tcp_nagle_test(tp, skb, mss_now,
+ (tcp_skb_is_last(sk, skb) ?
+ nonagle : TCP_NAGLE_PUSH))))
+@@ -2020,7 +2020,7 @@ static bool tcp_write_xmit(struct sock *sk, unsigned int mss_now, int nonagle,
+ }
+
+ limit = mss_now;
+- if (tso_segs > 1 && !tcp_urg_mode(tp))
++ if (tso_segs > 1 && sk->sk_gso_max_segs && !tcp_urg_mode(tp))
+ limit = tcp_mss_split_point(sk, skb, mss_now,
+ min_t(unsigned int,
+ cwnd_quota,
+diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
+index c277951d783b..c1136022d8d9 100644
+--- a/net/ipv6/tcp_ipv6.c
++++ b/net/ipv6/tcp_ipv6.c
+@@ -1385,6 +1385,28 @@ ipv6_pktoptions:
+ return 0;
+ }
+
++static void tcp_v6_fill_cb(struct sk_buff *skb, const struct ipv6hdr *hdr,
++ const struct tcphdr *th)
++{
++ /* This is tricky: we move IP6CB at its correct location into
++ * TCP_SKB_CB(). It must be done after xfrm6_policy_check(), because
++ * _decode_session6() uses IP6CB().
++ * barrier() makes sure compiler won't play aliasing games.
++ */
++ memmove(&TCP_SKB_CB(skb)->header.h6, IP6CB(skb),
++ sizeof(struct inet6_skb_parm));
++ barrier();
++
++ TCP_SKB_CB(skb)->seq = ntohl(th->seq);
++ TCP_SKB_CB(skb)->end_seq = (TCP_SKB_CB(skb)->seq + th->syn + th->fin +
++ skb->len - th->doff*4);
++ TCP_SKB_CB(skb)->ack_seq = ntohl(th->ack_seq);
++ TCP_SKB_CB(skb)->tcp_flags = tcp_flag_byte(th);
++ TCP_SKB_CB(skb)->tcp_tw_isn = 0;
++ TCP_SKB_CB(skb)->ip_dsfield = ipv6_get_dsfield(hdr);
++ TCP_SKB_CB(skb)->sacked = 0;
++}
++
+ static int tcp_v6_rcv(struct sk_buff *skb)
+ {
+ const struct tcphdr *th;
+@@ -1416,24 +1438,9 @@ static int tcp_v6_rcv(struct sk_buff *skb)
+
+ th = tcp_hdr(skb);
+ hdr = ipv6_hdr(skb);
+- /* This is tricky : We move IPCB at its correct location into TCP_SKB_CB()
+- * barrier() makes sure compiler wont play fool^Waliasing games.
+- */
+- memmove(&TCP_SKB_CB(skb)->header.h6, IP6CB(skb),
+- sizeof(struct inet6_skb_parm));
+- barrier();
+-
+- TCP_SKB_CB(skb)->seq = ntohl(th->seq);
+- TCP_SKB_CB(skb)->end_seq = (TCP_SKB_CB(skb)->seq + th->syn + th->fin +
+- skb->len - th->doff*4);
+- TCP_SKB_CB(skb)->ack_seq = ntohl(th->ack_seq);
+- TCP_SKB_CB(skb)->tcp_flags = tcp_flag_byte(th);
+- TCP_SKB_CB(skb)->tcp_tw_isn = 0;
+- TCP_SKB_CB(skb)->ip_dsfield = ipv6_get_dsfield(hdr);
+- TCP_SKB_CB(skb)->sacked = 0;
+
+ sk = __inet6_lookup_skb(&tcp_hashinfo, skb, th->source, th->dest,
+- tcp_v6_iif(skb));
++ inet6_iif(skb));
+ if (!sk)
+ goto no_tcp_socket;
+
+@@ -1449,6 +1456,8 @@ process:
+ if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb))
+ goto discard_and_relse;
+
++ tcp_v6_fill_cb(skb, hdr, th);
++
+ #ifdef CONFIG_TCP_MD5SIG
+ if (tcp_v6_inbound_md5_hash(sk, skb))
+ goto discard_and_relse;
+@@ -1480,6 +1489,8 @@ no_tcp_socket:
+ if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb))
+ goto discard_it;
+
++ tcp_v6_fill_cb(skb, hdr, th);
++
+ if (skb->len < (th->doff<<2) || tcp_checksum_complete(skb)) {
+ csum_error:
+ TCP_INC_STATS_BH(net, TCP_MIB_CSUMERRORS);
+@@ -1503,6 +1514,8 @@ do_time_wait:
+ goto discard_it;
+ }
+
++ tcp_v6_fill_cb(skb, hdr, th);
++
+ if (skb->len < (th->doff<<2)) {
+ inet_twsk_put(inet_twsk(sk));
+ goto bad_packet;
+diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
+index b6bf8e8caec7..79c965a51ab2 100644
+--- a/net/netlink/af_netlink.c
++++ b/net/netlink/af_netlink.c
+@@ -526,14 +526,14 @@ out:
+ return err;
+ }
+
+-static void netlink_frame_flush_dcache(const struct nl_mmap_hdr *hdr)
++static void netlink_frame_flush_dcache(const struct nl_mmap_hdr *hdr, unsigned int nm_len)
+ {
+ #if ARCH_IMPLEMENTS_FLUSH_DCACHE_PAGE == 1
+ struct page *p_start, *p_end;
+
+ /* First page is flushed through netlink_{get,set}_status */
+ p_start = pgvec_to_page(hdr + PAGE_SIZE);
+- p_end = pgvec_to_page((void *)hdr + NL_MMAP_HDRLEN + hdr->nm_len - 1);
++ p_end = pgvec_to_page((void *)hdr + NL_MMAP_HDRLEN + nm_len - 1);
+ while (p_start <= p_end) {
+ flush_dcache_page(p_start);
+ p_start++;
+@@ -551,9 +551,9 @@ static enum nl_mmap_status netlink_get_status(const struct nl_mmap_hdr *hdr)
+ static void netlink_set_status(struct nl_mmap_hdr *hdr,
+ enum nl_mmap_status status)
+ {
++ smp_mb();
+ hdr->nm_status = status;
+ flush_dcache_page(pgvec_to_page(hdr));
+- smp_wmb();
+ }
+
+ static struct nl_mmap_hdr *
+@@ -715,24 +715,16 @@ static int netlink_mmap_sendmsg(struct sock *sk, struct msghdr *msg,
+ struct nl_mmap_hdr *hdr;
+ struct sk_buff *skb;
+ unsigned int maxlen;
+- bool excl = true;
+ int err = 0, len = 0;
+
+- /* Netlink messages are validated by the receiver before processing.
+- * In order to avoid userspace changing the contents of the message
+- * after validation, the socket and the ring may only be used by a
+- * single process, otherwise we fall back to copying.
+- */
+- if (atomic_long_read(&sk->sk_socket->file->f_count) > 1 ||
+- atomic_read(&nlk->mapped) > 1)
+- excl = false;
+-
+ mutex_lock(&nlk->pg_vec_lock);
+
+ ring = &nlk->tx_ring;
+ maxlen = ring->frame_size - NL_MMAP_HDRLEN;
+
+ do {
++ unsigned int nm_len;
++
+ hdr = netlink_current_frame(ring, NL_MMAP_STATUS_VALID);
+ if (hdr == NULL) {
+ if (!(msg->msg_flags & MSG_DONTWAIT) &&
+@@ -740,35 +732,23 @@ static int netlink_mmap_sendmsg(struct sock *sk, struct msghdr *msg,
+ schedule();
+ continue;
+ }
+- if (hdr->nm_len > maxlen) {
++
++ nm_len = ACCESS_ONCE(hdr->nm_len);
++ if (nm_len > maxlen) {
+ err = -EINVAL;
+ goto out;
+ }
+
+- netlink_frame_flush_dcache(hdr);
++ netlink_frame_flush_dcache(hdr, nm_len);
+
+- if (likely(dst_portid == 0 && dst_group == 0 && excl)) {
+- skb = alloc_skb_head(GFP_KERNEL);
+- if (skb == NULL) {
+- err = -ENOBUFS;
+- goto out;
+- }
+- sock_hold(sk);
+- netlink_ring_setup_skb(skb, sk, ring, hdr);
+- NETLINK_CB(skb).flags |= NETLINK_SKB_TX;
+- __skb_put(skb, hdr->nm_len);
+- netlink_set_status(hdr, NL_MMAP_STATUS_RESERVED);
+- atomic_inc(&ring->pending);
+- } else {
+- skb = alloc_skb(hdr->nm_len, GFP_KERNEL);
+- if (skb == NULL) {
+- err = -ENOBUFS;
+- goto out;
+- }
+- __skb_put(skb, hdr->nm_len);
+- memcpy(skb->data, (void *)hdr + NL_MMAP_HDRLEN, hdr->nm_len);
+- netlink_set_status(hdr, NL_MMAP_STATUS_UNUSED);
++ skb = alloc_skb(nm_len, GFP_KERNEL);
++ if (skb == NULL) {
++ err = -ENOBUFS;
++ goto out;
+ }
++ __skb_put(skb, nm_len);
++ memcpy(skb->data, (void *)hdr + NL_MMAP_HDRLEN, nm_len);
++ netlink_set_status(hdr, NL_MMAP_STATUS_UNUSED);
+
+ netlink_increment_head(ring);
+
+@@ -814,7 +794,7 @@ static void netlink_queue_mmaped_skb(struct sock *sk, struct sk_buff *skb)
+ hdr->nm_pid = NETLINK_CB(skb).creds.pid;
+ hdr->nm_uid = from_kuid(sk_user_ns(sk), NETLINK_CB(skb).creds.uid);
+ hdr->nm_gid = from_kgid(sk_user_ns(sk), NETLINK_CB(skb).creds.gid);
+- netlink_frame_flush_dcache(hdr);
++ netlink_frame_flush_dcache(hdr, hdr->nm_len);
+ netlink_set_status(hdr, NL_MMAP_STATUS_VALID);
+
+ NETLINK_CB(skb).flags |= NETLINK_SKB_DELIVERED;
+diff --git a/net/wireless/chan.c b/net/wireless/chan.c
+index 72d81e2154d5..92ae263ebbf3 100644
+--- a/net/wireless/chan.c
++++ b/net/wireless/chan.c
+@@ -602,7 +602,7 @@ bool cfg80211_chandef_usable(struct wiphy *wiphy,
+ {
+ struct ieee80211_sta_ht_cap *ht_cap;
+ struct ieee80211_sta_vht_cap *vht_cap;
+- u32 width, control_freq;
++ u32 width, control_freq, cap;
+
+ if (WARN_ON(!cfg80211_chandef_valid(chandef)))
+ return false;
+@@ -642,7 +642,8 @@ bool cfg80211_chandef_usable(struct wiphy *wiphy,
+ return false;
+ break;
+ case NL80211_CHAN_WIDTH_80P80:
+- if (!(vht_cap->cap & IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ))
++ cap = vht_cap->cap & IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK;
++ if (cap != IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ)
+ return false;
+ case NL80211_CHAN_WIDTH_80:
+ if (!vht_cap->vht_supported)
+@@ -653,7 +654,9 @@ bool cfg80211_chandef_usable(struct wiphy *wiphy,
+ case NL80211_CHAN_WIDTH_160:
+ if (!vht_cap->vht_supported)
+ return false;
+- if (!(vht_cap->cap & IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ))
++ cap = vht_cap->cap & IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK;
++ if (cap != IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ &&
++ cap != IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ)
+ return false;
+ prohibited_flags |= IEEE80211_CHAN_NO_160MHZ;
+ width = 160;
+diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
+index 5839c85075f1..ea558e07981f 100644
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -5799,7 +5799,7 @@ static int nl80211_start_sched_scan(struct sk_buff *skb,
+ }
+
+ /* there was no other matchset, so the RSSI one is alone */
+- if (i == 0)
++ if (i == 0 && n_match_sets)
+ request->match_sets[0].rssi_thold = default_match_rssi;
+
+ request->min_rssi_thold = INT_MAX;
+diff --git a/net/wireless/reg.c b/net/wireless/reg.c
+index b725a31a4751..6fd53ea30193 100644
+--- a/net/wireless/reg.c
++++ b/net/wireless/reg.c
+@@ -1760,7 +1760,7 @@ static enum reg_request_treatment
+ reg_process_hint_driver(struct wiphy *wiphy,
+ struct regulatory_request *driver_request)
+ {
+- const struct ieee80211_regdomain *regd;
++ const struct ieee80211_regdomain *regd, *tmp;
+ enum reg_request_treatment treatment;
+
+ treatment = __reg_process_hint_driver(driver_request);
+@@ -1780,7 +1780,10 @@ reg_process_hint_driver(struct wiphy *wiphy,
+ reg_free_request(driver_request);
+ return REG_REQ_IGNORE;
+ }
++
++ tmp = get_wiphy_regdom(wiphy);
+ rcu_assign_pointer(wiphy->regd, regd);
++ rcu_free_regdom(tmp);
+ }
+
+
+@@ -1839,11 +1842,8 @@ __reg_process_hint_country_ie(struct wiphy *wiphy,
+ return REG_REQ_IGNORE;
+ return REG_REQ_ALREADY_SET;
+ }
+- /*
+- * Two consecutive Country IE hints on the same wiphy.
+- * This should be picked up early by the driver/stack
+- */
+- if (WARN_ON(regdom_changes(country_ie_request->alpha2)))
++
++ if (regdom_changes(country_ie_request->alpha2))
+ return REG_REQ_OK;
+ return REG_REQ_ALREADY_SET;
+ }
+diff --git a/scripts/Makefile.clean b/scripts/Makefile.clean
+index b1c668dc6815..a609552a86dc 100644
+--- a/scripts/Makefile.clean
++++ b/scripts/Makefile.clean
+@@ -45,19 +45,19 @@ __clean-files := $(extra-y) $(extra-m) $(extra-) \
+
+ __clean-files := $(filter-out $(no-clean-files), $(__clean-files))
+
+-# as clean-files is given relative to the current directory, this adds
+-# a $(obj) prefix, except for absolute paths
++# clean-files is given relative to the current directory, unless it
++# starts with $(objtree)/ (which means "./", so do not add "./" unless
++# you want to delete a file from the toplevel object directory).
+
+ __clean-files := $(wildcard \
+- $(addprefix $(obj)/, $(filter-out /%, $(__clean-files))) \
+- $(filter /%, $(__clean-files)))
++ $(addprefix $(obj)/, $(filter-out $(objtree)/%, $(__clean-files))) \
++ $(filter $(objtree)/%, $(__clean-files)))
+
+-# as clean-dirs is given relative to the current directory, this adds
+-# a $(obj) prefix, except for absolute paths
++# same as clean-files
+
+ __clean-dirs := $(wildcard \
+- $(addprefix $(obj)/, $(filter-out /%, $(clean-dirs))) \
+- $(filter /%, $(clean-dirs)))
++ $(addprefix $(obj)/, $(filter-out $(objtree)/%, $(clean-dirs))) \
++ $(filter $(objtree)/%, $(clean-dirs)))
+
+ # ==========================================================================
+
+diff --git a/scripts/coccinelle/misc/bugon.cocci b/scripts/coccinelle/misc/bugon.cocci
+index 556456ca761c..3b7eec24fb5a 100644
+--- a/scripts/coccinelle/misc/bugon.cocci
++++ b/scripts/coccinelle/misc/bugon.cocci
+@@ -8,7 +8,7 @@
+ // Confidence: High
+ // Copyright: (C) 2014 Himangi Saraogi. GPLv2.
+ // Comments:
+-// Options: --no-includes, --include-headers
++// Options: --no-includes --include-headers
+
+ virtual patch
+ virtual context
+diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h
+index c657752a420c..83bddbdb90e9 100644
+--- a/sound/usb/quirks-table.h
++++ b/sound/usb/quirks-table.h
+@@ -2804,133 +2804,45 @@ YAMAHA_DEVICE(0x7010, "UB99"),
+ }
+ },
+
+-/* Hauppauge HVR-950Q and HVR-850 */
+-{
+- USB_DEVICE_VENDOR_SPEC(0x2040, 0x7200),
+- .match_flags = USB_DEVICE_ID_MATCH_DEVICE |
+- USB_DEVICE_ID_MATCH_INT_CLASS |
+- USB_DEVICE_ID_MATCH_INT_SUBCLASS,
+- .bInterfaceClass = USB_CLASS_AUDIO,
+- .bInterfaceSubClass = USB_SUBCLASS_AUDIOCONTROL,
+- .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) {
+- .vendor_name = "Hauppauge",
+- .product_name = "HVR-950Q",
+- .ifnum = QUIRK_ANY_INTERFACE,
+- .type = QUIRK_AUDIO_ALIGN_TRANSFER,
+- }
+-},
+-{
+- USB_DEVICE_VENDOR_SPEC(0x2040, 0x7210),
+- .match_flags = USB_DEVICE_ID_MATCH_DEVICE |
+- USB_DEVICE_ID_MATCH_INT_CLASS |
+- USB_DEVICE_ID_MATCH_INT_SUBCLASS,
+- .bInterfaceClass = USB_CLASS_AUDIO,
+- .bInterfaceSubClass = USB_SUBCLASS_AUDIOCONTROL,
+- .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) {
+- .vendor_name = "Hauppauge",
+- .product_name = "HVR-950Q",
+- .ifnum = QUIRK_ANY_INTERFACE,
+- .type = QUIRK_AUDIO_ALIGN_TRANSFER,
+- }
+-},
+-{
+- USB_DEVICE_VENDOR_SPEC(0x2040, 0x7217),
+- .match_flags = USB_DEVICE_ID_MATCH_DEVICE |
+- USB_DEVICE_ID_MATCH_INT_CLASS |
+- USB_DEVICE_ID_MATCH_INT_SUBCLASS,
+- .bInterfaceClass = USB_CLASS_AUDIO,
+- .bInterfaceSubClass = USB_SUBCLASS_AUDIOCONTROL,
+- .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) {
+- .vendor_name = "Hauppauge",
+- .product_name = "HVR-950Q",
+- .ifnum = QUIRK_ANY_INTERFACE,
+- .type = QUIRK_AUDIO_ALIGN_TRANSFER,
+- }
+-},
+-{
+- USB_DEVICE_VENDOR_SPEC(0x2040, 0x721b),
+- .match_flags = USB_DEVICE_ID_MATCH_DEVICE |
+- USB_DEVICE_ID_MATCH_INT_CLASS |
+- USB_DEVICE_ID_MATCH_INT_SUBCLASS,
+- .bInterfaceClass = USB_CLASS_AUDIO,
+- .bInterfaceSubClass = USB_SUBCLASS_AUDIOCONTROL,
+- .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) {
+- .vendor_name = "Hauppauge",
+- .product_name = "HVR-950Q",
+- .ifnum = QUIRK_ANY_INTERFACE,
+- .type = QUIRK_AUDIO_ALIGN_TRANSFER,
+- }
+-},
+-{
+- USB_DEVICE_VENDOR_SPEC(0x2040, 0x721e),
+- .match_flags = USB_DEVICE_ID_MATCH_DEVICE |
+- USB_DEVICE_ID_MATCH_INT_CLASS |
+- USB_DEVICE_ID_MATCH_INT_SUBCLASS,
+- .bInterfaceClass = USB_CLASS_AUDIO,
+- .bInterfaceSubClass = USB_SUBCLASS_AUDIOCONTROL,
+- .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) {
+- .vendor_name = "Hauppauge",
+- .product_name = "HVR-950Q",
+- .ifnum = QUIRK_ANY_INTERFACE,
+- .type = QUIRK_AUDIO_ALIGN_TRANSFER,
+- }
+-},
+-{
+- USB_DEVICE_VENDOR_SPEC(0x2040, 0x721f),
+- .match_flags = USB_DEVICE_ID_MATCH_DEVICE |
+- USB_DEVICE_ID_MATCH_INT_CLASS |
+- USB_DEVICE_ID_MATCH_INT_SUBCLASS,
+- .bInterfaceClass = USB_CLASS_AUDIO,
+- .bInterfaceSubClass = USB_SUBCLASS_AUDIOCONTROL,
+- .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) {
+- .vendor_name = "Hauppauge",
+- .product_name = "HVR-950Q",
+- .ifnum = QUIRK_ANY_INTERFACE,
+- .type = QUIRK_AUDIO_ALIGN_TRANSFER,
+- }
+-},
+-{
+- USB_DEVICE_VENDOR_SPEC(0x2040, 0x7240),
+- .match_flags = USB_DEVICE_ID_MATCH_DEVICE |
+- USB_DEVICE_ID_MATCH_INT_CLASS |
+- USB_DEVICE_ID_MATCH_INT_SUBCLASS,
+- .bInterfaceClass = USB_CLASS_AUDIO,
+- .bInterfaceSubClass = USB_SUBCLASS_AUDIOCONTROL,
+- .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) {
+- .vendor_name = "Hauppauge",
+- .product_name = "HVR-850",
+- .ifnum = QUIRK_ANY_INTERFACE,
+- .type = QUIRK_AUDIO_ALIGN_TRANSFER,
+- }
+-},
+-{
+- USB_DEVICE_VENDOR_SPEC(0x2040, 0x7280),
+- .match_flags = USB_DEVICE_ID_MATCH_DEVICE |
+- USB_DEVICE_ID_MATCH_INT_CLASS |
+- USB_DEVICE_ID_MATCH_INT_SUBCLASS,
+- .bInterfaceClass = USB_CLASS_AUDIO,
+- .bInterfaceSubClass = USB_SUBCLASS_AUDIOCONTROL,
+- .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) {
+- .vendor_name = "Hauppauge",
+- .product_name = "HVR-950Q",
+- .ifnum = QUIRK_ANY_INTERFACE,
+- .type = QUIRK_AUDIO_ALIGN_TRANSFER,
+- }
+-},
+-{
+- USB_DEVICE_VENDOR_SPEC(0x0fd9, 0x0008),
+- .match_flags = USB_DEVICE_ID_MATCH_DEVICE |
+- USB_DEVICE_ID_MATCH_INT_CLASS |
+- USB_DEVICE_ID_MATCH_INT_SUBCLASS,
+- .bInterfaceClass = USB_CLASS_AUDIO,
+- .bInterfaceSubClass = USB_SUBCLASS_AUDIOCONTROL,
+- .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) {
+- .vendor_name = "Hauppauge",
+- .product_name = "HVR-950Q",
+- .ifnum = QUIRK_ANY_INTERFACE,
+- .type = QUIRK_AUDIO_ALIGN_TRANSFER,
+- }
+-},
++/*
++ * Auvitek au0828 devices with audio interface.
++ * This should be kept in sync with drivers/media/usb/au0828/au0828-cards.c
++ * Please notice that some drivers are DVB only, and don't need to be
++ * here. That's the case, for example, of DVICO_FUSIONHDTV7.
++ */
++
++#define AU0828_DEVICE(vid, pid, vname, pname) { \
++ USB_DEVICE_VENDOR_SPEC(vid, pid), \
++ .match_flags = USB_DEVICE_ID_MATCH_DEVICE | \
++ USB_DEVICE_ID_MATCH_INT_CLASS | \
++ USB_DEVICE_ID_MATCH_INT_SUBCLASS, \
++ .bInterfaceClass = USB_CLASS_AUDIO, \
++ .bInterfaceSubClass = USB_SUBCLASS_AUDIOCONTROL, \
++ .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) { \
++ .vendor_name = vname, \
++ .product_name = pname, \
++ .ifnum = QUIRK_ANY_INTERFACE, \
++ .type = QUIRK_AUDIO_ALIGN_TRANSFER, \
++ } \
++}
++
++AU0828_DEVICE(0x2040, 0x7200, "Hauppauge", "HVR-950Q"),
++AU0828_DEVICE(0x2040, 0x7240, "Hauppauge", "HVR-850"),
++AU0828_DEVICE(0x2040, 0x7210, "Hauppauge", "HVR-950Q"),
++AU0828_DEVICE(0x2040, 0x7217, "Hauppauge", "HVR-950Q"),
++AU0828_DEVICE(0x2040, 0x721b, "Hauppauge", "HVR-950Q"),
++AU0828_DEVICE(0x2040, 0x721e, "Hauppauge", "HVR-950Q"),
++AU0828_DEVICE(0x2040, 0x721f, "Hauppauge", "HVR-950Q"),
++AU0828_DEVICE(0x2040, 0x7280, "Hauppauge", "HVR-950Q"),
++AU0828_DEVICE(0x0fd9, 0x0008, "Hauppauge", "HVR-950Q"),
++AU0828_DEVICE(0x2040, 0x7201, "Hauppauge", "HVR-950Q-MXL"),
++AU0828_DEVICE(0x2040, 0x7211, "Hauppauge", "HVR-950Q-MXL"),
++AU0828_DEVICE(0x2040, 0x7281, "Hauppauge", "HVR-950Q-MXL"),
++AU0828_DEVICE(0x05e1, 0x0480, "Hauppauge", "Woodbury"),
++AU0828_DEVICE(0x2040, 0x8200, "Hauppauge", "Woodbury"),
++AU0828_DEVICE(0x2040, 0x7260, "Hauppauge", "HVR-950Q"),
++AU0828_DEVICE(0x2040, 0x7213, "Hauppauge", "HVR-950Q"),
++AU0828_DEVICE(0x2040, 0x7270, "Hauppauge", "HVR-950Q"),
+
+ /* Digidesign Mbox */
+ {
^ permalink raw reply related [flat|nested] 67+ messages in thread
* [gentoo-commits] proj/linux-patches:3.18 commit in: /
@ 2015-01-28 23:55 Anthony G. Basile
0 siblings, 0 replies; 67+ messages in thread
From: Anthony G. Basile @ 2015-01-28 23:55 UTC (permalink / raw
To: gentoo-commits
commit: bdd559a0e1b3569f98c565cf7aa4f8ac72e5ca70
Author: Anthony G. Basile <blueness <AT> gentoo <DOT> org>
AuthorDate: Wed Jan 28 23:57:35 2015 +0000
Commit: Anthony G. Basile <blueness <AT> gentoo <DOT> org>
CommitDate: Wed Jan 28 23:57:35 2015 +0000
URL: http://sources.gentoo.org/gitweb/?p=proj/linux-patches.git;a=commit;h=bdd559a0
Removal of redundant patch for i915 drm
---
...15-drm-disallow-pin-ioctl-for-kms-drivers.patch | 76 ----------------------
1 file changed, 76 deletions(-)
diff --git a/2710_i915-drm-disallow-pin-ioctl-for-kms-drivers.patch b/2710_i915-drm-disallow-pin-ioctl-for-kms-drivers.patch
deleted file mode 100644
index f298aa4..0000000
--- a/2710_i915-drm-disallow-pin-ioctl-for-kms-drivers.patch
+++ /dev/null
@@ -1,76 +0,0 @@
-From d472fcc8379c062bd56a3876fc6ef22258f14a91 Mon Sep 17 00:00:00 2001
-From: Daniel Vetter <daniel.vetter@ffwll.ch>
-Date: Mon, 24 Nov 2014 11:12:42 +0100
-Subject: drm/i915: Disallow pin ioctl completely for kms drivers
-
-The problem here is that SNA pins batchbuffers to etch out a bit more
-performance. Iirc it started out as a w/a for i830M (which we've
-implemented in the kernel since a long time already). The problem is
-that the pin ioctl wasn't added in
-
-commit d23db88c3ab233daed18709e3a24d6c95344117f
-Author: Chris Wilson <chris@chris-wilson.co.uk>
-Date: Fri May 23 08:48:08 2014 +0200
-
- drm/i915: Prevent negative relocation deltas from wrapping
-
-Fix this by simply disallowing pinning from userspace so that the
-kernel is in full control of batch placement again. Especially since
-distros are moving towards running X as non-root, so most users won't
-even be able to see any benefits.
-
-UMS support is dead now, but we need this minimal patch for
-backporting. Follow-up patch will remove the pin ioctl code
-completely.
-
-Note to backporters: You must have both
-
-commit b45305fce5bb1abec263fcff9d81ebecd6306ede
-Author: Daniel Vetter <daniel.vetter@ffwll.ch>
-Date: Mon Dec 17 16:21:27 2012 +0100
-
- drm/i915: Implement workaround for broken CS tlb on i830/845
-
-which laned in 3.8 and
-
-commit c4d69da167fa967749aeb70bc0e94a457e5d00c1
-Author: Chris Wilson <chris@chris-wilson.co.uk>
-Date: Mon Sep 8 14:25:41 2014 +0100
-
- drm/i915: Evict CS TLBs between batches
-
-which is also marked cc: stable. Otherwise this could introduce a
-regression by disabling the userspace w/a without the kernel w/a being
-fully functional on i830/45.
-
-References: https://bugs.freedesktop.org/show_bug.cgi?id=76554#c116
-Cc: stable@vger.kernel.org # requires c4d69da167fa967749a and v3.8
-Cc: Chris Wilson <chris@chris-wilson.co.uk>
-Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
-
-diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
-index fd17cca..97b86a5 100644
---- a/drivers/gpu/drm/i915/i915_gem.c
-+++ b/drivers/gpu/drm/i915/i915_gem.c
-@@ -4263,7 +4263,7 @@ i915_gem_pin_ioctl(struct drm_device *dev, void *data,
- struct drm_i915_gem_object *obj;
- int ret;
-
-- if (INTEL_INFO(dev)->gen >= 6)
-+ if (drm_core_check_feature(dev, DRIVER_MODESET))
- return -ENODEV;
-
- ret = i915_mutex_lock_interruptible(dev);
-@@ -4319,6 +4319,9 @@ i915_gem_unpin_ioctl(struct drm_device *dev, void *data,
- struct drm_i915_gem_object *obj;
- int ret;
-
-+ if (drm_core_check_feature(dev, DRIVER_MODESET))
-+ return -ENODEV;
-+
- ret = i915_mutex_lock_interruptible(dev);
- if (ret)
- return ret;
---
-cgit v0.10.2
-
^ permalink raw reply related [flat|nested] 67+ messages in thread
* [gentoo-commits] proj/linux-patches:3.18 commit in: /
@ 2015-01-28 23:56 Anthony G. Basile
0 siblings, 0 replies; 67+ messages in thread
From: Anthony G. Basile @ 2015-01-28 23:56 UTC (permalink / raw
To: gentoo-commits
commit: 02dc582606fd493ac597591162ed08d4bb5927f7
Author: Anthony G. Basile <blueness <AT> gentoo <DOT> org>
AuthorDate: Wed Jan 28 23:58:33 2015 +0000
Commit: Anthony G. Basile <blueness <AT> gentoo <DOT> org>
CommitDate: Wed Jan 28 23:58:33 2015 +0000
URL: http://sources.gentoo.org/gitweb/?p=proj/linux-patches.git;a=commit;h=02dc5826
Fix 0000_README
---
0000_README | 4 ----
1 file changed, 4 deletions(-)
diff --git a/0000_README b/0000_README
index 6e4c6e3..52cb186 100644
--- a/0000_README
+++ b/0000_README
@@ -79,10 +79,6 @@ Patch: 2905_s2disk-resume-image-fix.patch
From: Al Viro <viro <at> ZenIV.linux.org.uk>
Desc: Do not lock when UMH is waiting on current thread spawned by linuxrc. (bug #481344.)
-Patch: 2710_i915-drm-disallow-pin-ioctl-for-kms-drivers.patch
-From: http://www.kernel.org
-Desc: drm/i915: Patch to disallow pin ioctl completely for kms drivers. See bug #532926.
-
Patch: 4200_fbcondecor-3.16.patch
From: http://www.mepiscommunity.org/fbcondecor
Desc: Bootsplash ported by Uladzimir Bely (bug #513334)
^ permalink raw reply related [flat|nested] 67+ messages in thread
* [gentoo-commits] proj/linux-patches:3.18 commit in: /
@ 2015-01-30 11:01 Mike Pagano
0 siblings, 0 replies; 67+ messages in thread
From: Mike Pagano @ 2015-01-30 11:01 UTC (permalink / raw
To: gentoo-commits
commit: c006e3c68a07765a9f1aa4d9a1a6b3df0e0a417c
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Fri Jan 30 11:01:48 2015 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Fri Jan 30 11:01:48 2015 +0000
URL: http://sources.gentoo.org/gitweb/?p=proj/linux-patches.git;a=commit;h=c006e3c6
Linux patch 3.18.5
---
0000_README | 4 +
1004_linux-3.18.5.patch | 3915 +++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 3919 insertions(+)
diff --git a/0000_README b/0000_README
index 52cb186..f8b4dcb 100644
--- a/0000_README
+++ b/0000_README
@@ -59,6 +59,10 @@ Patch: 1003_linux-3.18.4.patch
From: http://www.kernel.org
Desc: Linux 3.18.4
+Patch: 1004_linux-3.18.5.patch
+From: http://www.kernel.org
+Desc: Linux 3.18.5
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1004_linux-3.18.5.patch b/1004_linux-3.18.5.patch
new file mode 100644
index 0000000..2a470c7
--- /dev/null
+++ b/1004_linux-3.18.5.patch
@@ -0,0 +1,3915 @@
+diff --git a/Makefile b/Makefile
+index 4e9328491c1e..6276fcaabf21 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 18
+-SUBLEVEL = 4
++SUBLEVEL = 5
+ EXTRAVERSION =
+ NAME = Diseased Newt
+
+diff --git a/arch/arm/boot/dts/imx25.dtsi b/arch/arm/boot/dts/imx25.dtsi
+index d238676a9107..e4d3aecc4ed2 100644
+--- a/arch/arm/boot/dts/imx25.dtsi
++++ b/arch/arm/boot/dts/imx25.dtsi
+@@ -369,7 +369,7 @@
+ compatible = "fsl,imx25-pwm", "fsl,imx27-pwm";
+ #pwm-cells = <2>;
+ reg = <0x53fa0000 0x4000>;
+- clocks = <&clks 106>, <&clks 36>;
++ clocks = <&clks 106>, <&clks 52>;
+ clock-names = "ipg", "per";
+ interrupts = <36>;
+ };
+@@ -388,7 +388,7 @@
+ compatible = "fsl,imx25-pwm", "fsl,imx27-pwm";
+ #pwm-cells = <2>;
+ reg = <0x53fa8000 0x4000>;
+- clocks = <&clks 107>, <&clks 36>;
++ clocks = <&clks 107>, <&clks 52>;
+ clock-names = "ipg", "per";
+ interrupts = <41>;
+ };
+@@ -429,7 +429,7 @@
+ pwm4: pwm@53fc8000 {
+ compatible = "fsl,imx25-pwm", "fsl,imx27-pwm";
+ reg = <0x53fc8000 0x4000>;
+- clocks = <&clks 108>, <&clks 36>;
++ clocks = <&clks 108>, <&clks 52>;
+ clock-names = "ipg", "per";
+ interrupts = <42>;
+ };
+@@ -476,7 +476,7 @@
+ compatible = "fsl,imx25-pwm", "fsl,imx27-pwm";
+ #pwm-cells = <2>;
+ reg = <0x53fe0000 0x4000>;
+- clocks = <&clks 105>, <&clks 36>;
++ clocks = <&clks 105>, <&clks 52>;
+ clock-names = "ipg", "per";
+ interrupts = <26>;
+ };
+diff --git a/arch/arm/crypto/aes_glue.c b/arch/arm/crypto/aes_glue.c
+index 3003fa1f6fb4..0409b8f89782 100644
+--- a/arch/arm/crypto/aes_glue.c
++++ b/arch/arm/crypto/aes_glue.c
+@@ -93,6 +93,6 @@ module_exit(aes_fini);
+
+ MODULE_DESCRIPTION("Rijndael (AES) Cipher Algorithm (ASM)");
+ MODULE_LICENSE("GPL");
+-MODULE_ALIAS("aes");
+-MODULE_ALIAS("aes-asm");
++MODULE_ALIAS_CRYPTO("aes");
++MODULE_ALIAS_CRYPTO("aes-asm");
+ MODULE_AUTHOR("David McCullough <ucdevel@gmail.com>");
+diff --git a/arch/arm/crypto/sha1_glue.c b/arch/arm/crypto/sha1_glue.c
+index 84f2a756588b..e31b0440c613 100644
+--- a/arch/arm/crypto/sha1_glue.c
++++ b/arch/arm/crypto/sha1_glue.c
+@@ -171,5 +171,5 @@ module_exit(sha1_mod_fini);
+
+ MODULE_LICENSE("GPL");
+ MODULE_DESCRIPTION("SHA1 Secure Hash Algorithm (ARM)");
+-MODULE_ALIAS("sha1");
++MODULE_ALIAS_CRYPTO("sha1");
+ MODULE_AUTHOR("David McCullough <ucdevel@gmail.com>");
+diff --git a/arch/arm/crypto/sha1_neon_glue.c b/arch/arm/crypto/sha1_neon_glue.c
+index 6f1b411b1d55..0b0083757d47 100644
+--- a/arch/arm/crypto/sha1_neon_glue.c
++++ b/arch/arm/crypto/sha1_neon_glue.c
+@@ -194,4 +194,4 @@ module_exit(sha1_neon_mod_fini);
+
+ MODULE_LICENSE("GPL");
+ MODULE_DESCRIPTION("SHA1 Secure Hash Algorithm, NEON accelerated");
+-MODULE_ALIAS("sha1");
++MODULE_ALIAS_CRYPTO("sha1");
+diff --git a/arch/arm/crypto/sha512_neon_glue.c b/arch/arm/crypto/sha512_neon_glue.c
+index 0d2758ff5e12..f3452c66059d 100644
+--- a/arch/arm/crypto/sha512_neon_glue.c
++++ b/arch/arm/crypto/sha512_neon_glue.c
+@@ -301,5 +301,5 @@ module_exit(sha512_neon_mod_fini);
+ MODULE_LICENSE("GPL");
+ MODULE_DESCRIPTION("SHA512 Secure Hash Algorithm, NEON accelerated");
+
+-MODULE_ALIAS("sha512");
+-MODULE_ALIAS("sha384");
++MODULE_ALIAS_CRYPTO("sha512");
++MODULE_ALIAS_CRYPTO("sha384");
+diff --git a/arch/arm/mach-mvebu/coherency.c b/arch/arm/mach-mvebu/coherency.c
+index c31f4c00b1fc..1163a3e9accd 100644
+--- a/arch/arm/mach-mvebu/coherency.c
++++ b/arch/arm/mach-mvebu/coherency.c
+@@ -398,9 +398,14 @@ static int coherency_type(void)
+ return type;
+ }
+
++/*
++ * As a precaution, we currently completely disable hardware I/O
++ * coherency, until enough testing is done with automatic I/O
++ * synchronization barriers to validate that it is a proper solution.
++ */
+ int coherency_available(void)
+ {
+- return coherency_type() != COHERENCY_FABRIC_TYPE_NONE;
++ return false;
+ }
+
+ int __init coherency_init(void)
+diff --git a/arch/arm64/crypto/aes-ce-ccm-glue.c b/arch/arm64/crypto/aes-ce-ccm-glue.c
+index 9e6cdde9b43d..0156a268e163 100644
+--- a/arch/arm64/crypto/aes-ce-ccm-glue.c
++++ b/arch/arm64/crypto/aes-ce-ccm-glue.c
+@@ -294,4 +294,4 @@ module_exit(aes_mod_exit);
+ MODULE_DESCRIPTION("Synchronous AES in CCM mode using ARMv8 Crypto Extensions");
+ MODULE_AUTHOR("Ard Biesheuvel <ard.biesheuvel@linaro.org>");
+ MODULE_LICENSE("GPL v2");
+-MODULE_ALIAS("ccm(aes)");
++MODULE_ALIAS_CRYPTO("ccm(aes)");
+diff --git a/arch/arm64/crypto/aes-glue.c b/arch/arm64/crypto/aes-glue.c
+index 79cd911ef88c..5f63a791b2fb 100644
+--- a/arch/arm64/crypto/aes-glue.c
++++ b/arch/arm64/crypto/aes-glue.c
+@@ -38,10 +38,10 @@ MODULE_DESCRIPTION("AES-ECB/CBC/CTR/XTS using ARMv8 Crypto Extensions");
+ #define aes_xts_encrypt neon_aes_xts_encrypt
+ #define aes_xts_decrypt neon_aes_xts_decrypt
+ MODULE_DESCRIPTION("AES-ECB/CBC/CTR/XTS using ARMv8 NEON");
+-MODULE_ALIAS("ecb(aes)");
+-MODULE_ALIAS("cbc(aes)");
+-MODULE_ALIAS("ctr(aes)");
+-MODULE_ALIAS("xts(aes)");
++MODULE_ALIAS_CRYPTO("ecb(aes)");
++MODULE_ALIAS_CRYPTO("cbc(aes)");
++MODULE_ALIAS_CRYPTO("ctr(aes)");
++MODULE_ALIAS_CRYPTO("xts(aes)");
+ #endif
+
+ MODULE_AUTHOR("Ard Biesheuvel <ard.biesheuvel@linaro.org>");
+diff --git a/arch/powerpc/crypto/sha1.c b/arch/powerpc/crypto/sha1.c
+index f9e8b9491efc..b51da9132744 100644
+--- a/arch/powerpc/crypto/sha1.c
++++ b/arch/powerpc/crypto/sha1.c
+@@ -154,4 +154,5 @@ module_exit(sha1_powerpc_mod_fini);
+ MODULE_LICENSE("GPL");
+ MODULE_DESCRIPTION("SHA1 Secure Hash Algorithm");
+
+-MODULE_ALIAS("sha1-powerpc");
++MODULE_ALIAS_CRYPTO("sha1");
++MODULE_ALIAS_CRYPTO("sha1-powerpc");
+diff --git a/arch/s390/crypto/aes_s390.c b/arch/s390/crypto/aes_s390.c
+index 23223cd63e54..1f272b24fc0b 100644
+--- a/arch/s390/crypto/aes_s390.c
++++ b/arch/s390/crypto/aes_s390.c
+@@ -979,7 +979,7 @@ static void __exit aes_s390_fini(void)
+ module_init(aes_s390_init);
+ module_exit(aes_s390_fini);
+
+-MODULE_ALIAS("aes-all");
++MODULE_ALIAS_CRYPTO("aes-all");
+
+ MODULE_DESCRIPTION("Rijndael (AES) Cipher Algorithm");
+ MODULE_LICENSE("GPL");
+diff --git a/arch/s390/crypto/des_s390.c b/arch/s390/crypto/des_s390.c
+index 7acb77f7ef1a..9e05cc453a40 100644
+--- a/arch/s390/crypto/des_s390.c
++++ b/arch/s390/crypto/des_s390.c
+@@ -619,8 +619,8 @@ static void __exit des_s390_exit(void)
+ module_init(des_s390_init);
+ module_exit(des_s390_exit);
+
+-MODULE_ALIAS("des");
+-MODULE_ALIAS("des3_ede");
++MODULE_ALIAS_CRYPTO("des");
++MODULE_ALIAS_CRYPTO("des3_ede");
+
+ MODULE_LICENSE("GPL");
+ MODULE_DESCRIPTION("DES & Triple DES EDE Cipher Algorithms");
+diff --git a/arch/s390/crypto/ghash_s390.c b/arch/s390/crypto/ghash_s390.c
+index d43485d142e9..7940dc90e80b 100644
+--- a/arch/s390/crypto/ghash_s390.c
++++ b/arch/s390/crypto/ghash_s390.c
+@@ -160,7 +160,7 @@ static void __exit ghash_mod_exit(void)
+ module_init(ghash_mod_init);
+ module_exit(ghash_mod_exit);
+
+-MODULE_ALIAS("ghash");
++MODULE_ALIAS_CRYPTO("ghash");
+
+ MODULE_LICENSE("GPL");
+ MODULE_DESCRIPTION("GHASH Message Digest Algorithm, s390 implementation");
+diff --git a/arch/s390/crypto/sha1_s390.c b/arch/s390/crypto/sha1_s390.c
+index a1b3a9dc9d8a..5b2bee323694 100644
+--- a/arch/s390/crypto/sha1_s390.c
++++ b/arch/s390/crypto/sha1_s390.c
+@@ -103,6 +103,6 @@ static void __exit sha1_s390_fini(void)
+ module_init(sha1_s390_init);
+ module_exit(sha1_s390_fini);
+
+-MODULE_ALIAS("sha1");
++MODULE_ALIAS_CRYPTO("sha1");
+ MODULE_LICENSE("GPL");
+ MODULE_DESCRIPTION("SHA1 Secure Hash Algorithm");
+diff --git a/arch/s390/crypto/sha256_s390.c b/arch/s390/crypto/sha256_s390.c
+index 9b853809a492..b74ff158108c 100644
+--- a/arch/s390/crypto/sha256_s390.c
++++ b/arch/s390/crypto/sha256_s390.c
+@@ -143,7 +143,7 @@ static void __exit sha256_s390_fini(void)
+ module_init(sha256_s390_init);
+ module_exit(sha256_s390_fini);
+
+-MODULE_ALIAS("sha256");
+-MODULE_ALIAS("sha224");
++MODULE_ALIAS_CRYPTO("sha256");
++MODULE_ALIAS_CRYPTO("sha224");
+ MODULE_LICENSE("GPL");
+ MODULE_DESCRIPTION("SHA256 and SHA224 Secure Hash Algorithm");
+diff --git a/arch/s390/crypto/sha512_s390.c b/arch/s390/crypto/sha512_s390.c
+index 32a81383b69c..0c36989ba182 100644
+--- a/arch/s390/crypto/sha512_s390.c
++++ b/arch/s390/crypto/sha512_s390.c
+@@ -86,7 +86,7 @@ static struct shash_alg sha512_alg = {
+ }
+ };
+
+-MODULE_ALIAS("sha512");
++MODULE_ALIAS_CRYPTO("sha512");
+
+ static int sha384_init(struct shash_desc *desc)
+ {
+@@ -126,7 +126,7 @@ static struct shash_alg sha384_alg = {
+ }
+ };
+
+-MODULE_ALIAS("sha384");
++MODULE_ALIAS_CRYPTO("sha384");
+
+ static int __init init(void)
+ {
+diff --git a/arch/sparc/crypto/aes_glue.c b/arch/sparc/crypto/aes_glue.c
+index df922f52d76d..705408766ab0 100644
+--- a/arch/sparc/crypto/aes_glue.c
++++ b/arch/sparc/crypto/aes_glue.c
+@@ -499,6 +499,6 @@ module_exit(aes_sparc64_mod_fini);
+ MODULE_LICENSE("GPL");
+ MODULE_DESCRIPTION("AES Secure Hash Algorithm, sparc64 aes opcode accelerated");
+
+-MODULE_ALIAS("aes");
++MODULE_ALIAS_CRYPTO("aes");
+
+ #include "crop_devid.c"
+diff --git a/arch/sparc/crypto/camellia_glue.c b/arch/sparc/crypto/camellia_glue.c
+index 888f6260b4ec..641f55cb61c3 100644
+--- a/arch/sparc/crypto/camellia_glue.c
++++ b/arch/sparc/crypto/camellia_glue.c
+@@ -322,6 +322,6 @@ module_exit(camellia_sparc64_mod_fini);
+ MODULE_LICENSE("GPL");
+ MODULE_DESCRIPTION("Camellia Cipher Algorithm, sparc64 camellia opcode accelerated");
+
+-MODULE_ALIAS("aes");
++MODULE_ALIAS_CRYPTO("aes");
+
+ #include "crop_devid.c"
+diff --git a/arch/sparc/crypto/crc32c_glue.c b/arch/sparc/crypto/crc32c_glue.c
+index 5162fad912ce..d1064e46efe8 100644
+--- a/arch/sparc/crypto/crc32c_glue.c
++++ b/arch/sparc/crypto/crc32c_glue.c
+@@ -176,6 +176,6 @@ module_exit(crc32c_sparc64_mod_fini);
+ MODULE_LICENSE("GPL");
+ MODULE_DESCRIPTION("CRC32c (Castagnoli), sparc64 crc32c opcode accelerated");
+
+-MODULE_ALIAS("crc32c");
++MODULE_ALIAS_CRYPTO("crc32c");
+
+ #include "crop_devid.c"
+diff --git a/arch/sparc/crypto/des_glue.c b/arch/sparc/crypto/des_glue.c
+index 3065bc61f9d3..d11500972994 100644
+--- a/arch/sparc/crypto/des_glue.c
++++ b/arch/sparc/crypto/des_glue.c
+@@ -532,6 +532,6 @@ module_exit(des_sparc64_mod_fini);
+ MODULE_LICENSE("GPL");
+ MODULE_DESCRIPTION("DES & Triple DES EDE Cipher Algorithms, sparc64 des opcode accelerated");
+
+-MODULE_ALIAS("des");
++MODULE_ALIAS_CRYPTO("des");
+
+ #include "crop_devid.c"
+diff --git a/arch/sparc/crypto/md5_glue.c b/arch/sparc/crypto/md5_glue.c
+index 09a9ea1dfb69..64c7ff5f72a9 100644
+--- a/arch/sparc/crypto/md5_glue.c
++++ b/arch/sparc/crypto/md5_glue.c
+@@ -185,6 +185,6 @@ module_exit(md5_sparc64_mod_fini);
+ MODULE_LICENSE("GPL");
+ MODULE_DESCRIPTION("MD5 Secure Hash Algorithm, sparc64 md5 opcode accelerated");
+
+-MODULE_ALIAS("md5");
++MODULE_ALIAS_CRYPTO("md5");
+
+ #include "crop_devid.c"
+diff --git a/arch/sparc/crypto/sha1_glue.c b/arch/sparc/crypto/sha1_glue.c
+index 6cd5f29e1e0d..1b3e47accc74 100644
+--- a/arch/sparc/crypto/sha1_glue.c
++++ b/arch/sparc/crypto/sha1_glue.c
+@@ -180,6 +180,6 @@ module_exit(sha1_sparc64_mod_fini);
+ MODULE_LICENSE("GPL");
+ MODULE_DESCRIPTION("SHA1 Secure Hash Algorithm, sparc64 sha1 opcode accelerated");
+
+-MODULE_ALIAS("sha1");
++MODULE_ALIAS_CRYPTO("sha1");
+
+ #include "crop_devid.c"
+diff --git a/arch/sparc/crypto/sha256_glue.c b/arch/sparc/crypto/sha256_glue.c
+index 04f555ab2680..41f27cca2a22 100644
+--- a/arch/sparc/crypto/sha256_glue.c
++++ b/arch/sparc/crypto/sha256_glue.c
+@@ -237,7 +237,7 @@ module_exit(sha256_sparc64_mod_fini);
+ MODULE_LICENSE("GPL");
+ MODULE_DESCRIPTION("SHA-224 and SHA-256 Secure Hash Algorithm, sparc64 sha256 opcode accelerated");
+
+-MODULE_ALIAS("sha224");
+-MODULE_ALIAS("sha256");
++MODULE_ALIAS_CRYPTO("sha224");
++MODULE_ALIAS_CRYPTO("sha256");
+
+ #include "crop_devid.c"
+diff --git a/arch/sparc/crypto/sha512_glue.c b/arch/sparc/crypto/sha512_glue.c
+index f04d1994d19a..9fff88541b8c 100644
+--- a/arch/sparc/crypto/sha512_glue.c
++++ b/arch/sparc/crypto/sha512_glue.c
+@@ -222,7 +222,7 @@ module_exit(sha512_sparc64_mod_fini);
+ MODULE_LICENSE("GPL");
+ MODULE_DESCRIPTION("SHA-384 and SHA-512 Secure Hash Algorithm, sparc64 sha512 opcode accelerated");
+
+-MODULE_ALIAS("sha384");
+-MODULE_ALIAS("sha512");
++MODULE_ALIAS_CRYPTO("sha384");
++MODULE_ALIAS_CRYPTO("sha512");
+
+ #include "crop_devid.c"
+diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
+index 41a503c15862..3635fff7b32d 100644
+--- a/arch/x86/Kconfig
++++ b/arch/x86/Kconfig
+@@ -856,7 +856,7 @@ source "kernel/Kconfig.preempt"
+
+ config X86_UP_APIC
+ bool "Local APIC support on uniprocessors"
+- depends on X86_32 && !SMP && !X86_32_NON_STANDARD && !PCI_MSI
++ depends on X86_32 && !SMP && !X86_32_NON_STANDARD
+ ---help---
+ A local APIC (Advanced Programmable Interrupt Controller) is an
+ integrated interrupt controller in the CPU. If you have a single-CPU
+@@ -867,6 +867,10 @@ config X86_UP_APIC
+ performance counters), and the NMI watchdog which detects hard
+ lockups.
+
++config X86_UP_APIC_MSI
++ def_bool y
++ select X86_UP_APIC if X86_32 && !SMP && !X86_32_NON_STANDARD && PCI_MSI
++
+ config X86_UP_IOAPIC
+ bool "IO-APIC support on uniprocessors"
+ depends on X86_UP_APIC
+diff --git a/arch/x86/boot/compressed/misc.c b/arch/x86/boot/compressed/misc.c
+index 30dd59a9f0b4..0c33a7c67ea5 100644
+--- a/arch/x86/boot/compressed/misc.c
++++ b/arch/x86/boot/compressed/misc.c
+@@ -361,6 +361,8 @@ asmlinkage __visible void *decompress_kernel(void *rmode, memptr heap,
+ unsigned long output_len,
+ unsigned long run_size)
+ {
++ unsigned char *output_orig = output;
++
+ real_mode = rmode;
+
+ sanitize_boot_params(real_mode);
+@@ -409,7 +411,12 @@ asmlinkage __visible void *decompress_kernel(void *rmode, memptr heap,
+ debug_putstr("\nDecompressing Linux... ");
+ decompress(input_data, input_len, NULL, NULL, output, NULL, error);
+ parse_elf(output);
+- handle_relocations(output, output_len);
++ /*
++ * 32-bit always performs relocations. 64-bit relocations are only
++ * needed if kASLR has chosen a different load address.
++ */
++ if (!IS_ENABLED(CONFIG_X86_64) || output != output_orig)
++ handle_relocations(output, output_len);
+ debug_putstr("done.\nBooting the kernel.\n");
+ return output;
+ }
+diff --git a/arch/x86/crypto/aes_glue.c b/arch/x86/crypto/aes_glue.c
+index aafe8ce0d65d..e26984f7ab8d 100644
+--- a/arch/x86/crypto/aes_glue.c
++++ b/arch/x86/crypto/aes_glue.c
+@@ -66,5 +66,5 @@ module_exit(aes_fini);
+
+ MODULE_DESCRIPTION("Rijndael (AES) Cipher Algorithm, asm optimized");
+ MODULE_LICENSE("GPL");
+-MODULE_ALIAS("aes");
+-MODULE_ALIAS("aes-asm");
++MODULE_ALIAS_CRYPTO("aes");
++MODULE_ALIAS_CRYPTO("aes-asm");
+diff --git a/arch/x86/crypto/aesni-intel_glue.c b/arch/x86/crypto/aesni-intel_glue.c
+index 888950f29fd9..70fece226d17 100644
+--- a/arch/x86/crypto/aesni-intel_glue.c
++++ b/arch/x86/crypto/aesni-intel_glue.c
+@@ -1550,4 +1550,4 @@ module_exit(aesni_exit);
+
+ MODULE_DESCRIPTION("Rijndael (AES) Cipher Algorithm, Intel AES-NI instructions optimized");
+ MODULE_LICENSE("GPL");
+-MODULE_ALIAS("aes");
++MODULE_ALIAS_CRYPTO("aes");
+diff --git a/arch/x86/crypto/blowfish_glue.c b/arch/x86/crypto/blowfish_glue.c
+index 8af519ed73d1..17c05531dfd1 100644
+--- a/arch/x86/crypto/blowfish_glue.c
++++ b/arch/x86/crypto/blowfish_glue.c
+@@ -478,5 +478,5 @@ module_exit(fini);
+
+ MODULE_LICENSE("GPL");
+ MODULE_DESCRIPTION("Blowfish Cipher Algorithm, asm optimized");
+-MODULE_ALIAS("blowfish");
+-MODULE_ALIAS("blowfish-asm");
++MODULE_ALIAS_CRYPTO("blowfish");
++MODULE_ALIAS_CRYPTO("blowfish-asm");
+diff --git a/arch/x86/crypto/camellia_aesni_avx2_glue.c b/arch/x86/crypto/camellia_aesni_avx2_glue.c
+index 4209a76fcdaa..9a07fafe3831 100644
+--- a/arch/x86/crypto/camellia_aesni_avx2_glue.c
++++ b/arch/x86/crypto/camellia_aesni_avx2_glue.c
+@@ -582,5 +582,5 @@ module_exit(camellia_aesni_fini);
+
+ MODULE_LICENSE("GPL");
+ MODULE_DESCRIPTION("Camellia Cipher Algorithm, AES-NI/AVX2 optimized");
+-MODULE_ALIAS("camellia");
+-MODULE_ALIAS("camellia-asm");
++MODULE_ALIAS_CRYPTO("camellia");
++MODULE_ALIAS_CRYPTO("camellia-asm");
+diff --git a/arch/x86/crypto/camellia_aesni_avx_glue.c b/arch/x86/crypto/camellia_aesni_avx_glue.c
+index 87a041a10f4a..ed38d959add6 100644
+--- a/arch/x86/crypto/camellia_aesni_avx_glue.c
++++ b/arch/x86/crypto/camellia_aesni_avx_glue.c
+@@ -574,5 +574,5 @@ module_exit(camellia_aesni_fini);
+
+ MODULE_LICENSE("GPL");
+ MODULE_DESCRIPTION("Camellia Cipher Algorithm, AES-NI/AVX optimized");
+-MODULE_ALIAS("camellia");
+-MODULE_ALIAS("camellia-asm");
++MODULE_ALIAS_CRYPTO("camellia");
++MODULE_ALIAS_CRYPTO("camellia-asm");
+diff --git a/arch/x86/crypto/camellia_glue.c b/arch/x86/crypto/camellia_glue.c
+index c171dcbf192d..5c8b6266a394 100644
+--- a/arch/x86/crypto/camellia_glue.c
++++ b/arch/x86/crypto/camellia_glue.c
+@@ -1725,5 +1725,5 @@ module_exit(fini);
+
+ MODULE_LICENSE("GPL");
+ MODULE_DESCRIPTION("Camellia Cipher Algorithm, asm optimized");
+-MODULE_ALIAS("camellia");
+-MODULE_ALIAS("camellia-asm");
++MODULE_ALIAS_CRYPTO("camellia");
++MODULE_ALIAS_CRYPTO("camellia-asm");
+diff --git a/arch/x86/crypto/cast5_avx_glue.c b/arch/x86/crypto/cast5_avx_glue.c
+index e57e20ab5e0b..60ada677a928 100644
+--- a/arch/x86/crypto/cast5_avx_glue.c
++++ b/arch/x86/crypto/cast5_avx_glue.c
+@@ -491,4 +491,4 @@ module_exit(cast5_exit);
+
+ MODULE_DESCRIPTION("Cast5 Cipher Algorithm, AVX optimized");
+ MODULE_LICENSE("GPL");
+-MODULE_ALIAS("cast5");
++MODULE_ALIAS_CRYPTO("cast5");
+diff --git a/arch/x86/crypto/cast6_avx_glue.c b/arch/x86/crypto/cast6_avx_glue.c
+index 09f3677393e4..0160f68a57ff 100644
+--- a/arch/x86/crypto/cast6_avx_glue.c
++++ b/arch/x86/crypto/cast6_avx_glue.c
+@@ -611,4 +611,4 @@ module_exit(cast6_exit);
+
+ MODULE_DESCRIPTION("Cast6 Cipher Algorithm, AVX optimized");
+ MODULE_LICENSE("GPL");
+-MODULE_ALIAS("cast6");
++MODULE_ALIAS_CRYPTO("cast6");
+diff --git a/arch/x86/crypto/crc32-pclmul_glue.c b/arch/x86/crypto/crc32-pclmul_glue.c
+index 9d014a74ef96..1937fc1d8763 100644
+--- a/arch/x86/crypto/crc32-pclmul_glue.c
++++ b/arch/x86/crypto/crc32-pclmul_glue.c
+@@ -197,5 +197,5 @@ module_exit(crc32_pclmul_mod_fini);
+ MODULE_AUTHOR("Alexander Boyko <alexander_boyko@xyratex.com>");
+ MODULE_LICENSE("GPL");
+
+-MODULE_ALIAS("crc32");
+-MODULE_ALIAS("crc32-pclmul");
++MODULE_ALIAS_CRYPTO("crc32");
++MODULE_ALIAS_CRYPTO("crc32-pclmul");
+diff --git a/arch/x86/crypto/crc32c-intel_glue.c b/arch/x86/crypto/crc32c-intel_glue.c
+index 6812ad98355c..28640c3d6af7 100644
+--- a/arch/x86/crypto/crc32c-intel_glue.c
++++ b/arch/x86/crypto/crc32c-intel_glue.c
+@@ -280,5 +280,5 @@ MODULE_AUTHOR("Austin Zhang <austin.zhang@intel.com>, Kent Liu <kent.liu@intel.c
+ MODULE_DESCRIPTION("CRC32c (Castagnoli) optimization using Intel Hardware.");
+ MODULE_LICENSE("GPL");
+
+-MODULE_ALIAS("crc32c");
+-MODULE_ALIAS("crc32c-intel");
++MODULE_ALIAS_CRYPTO("crc32c");
++MODULE_ALIAS_CRYPTO("crc32c-intel");
+diff --git a/arch/x86/crypto/crct10dif-pclmul_glue.c b/arch/x86/crypto/crct10dif-pclmul_glue.c
+index 7845d7fd54c0..b6c67bf30fdf 100644
+--- a/arch/x86/crypto/crct10dif-pclmul_glue.c
++++ b/arch/x86/crypto/crct10dif-pclmul_glue.c
+@@ -147,5 +147,5 @@ MODULE_AUTHOR("Tim Chen <tim.c.chen@linux.intel.com>");
+ MODULE_DESCRIPTION("T10 DIF CRC calculation accelerated with PCLMULQDQ.");
+ MODULE_LICENSE("GPL");
+
+-MODULE_ALIAS("crct10dif");
+-MODULE_ALIAS("crct10dif-pclmul");
++MODULE_ALIAS_CRYPTO("crct10dif");
++MODULE_ALIAS_CRYPTO("crct10dif-pclmul");
+diff --git a/arch/x86/crypto/des3_ede_glue.c b/arch/x86/crypto/des3_ede_glue.c
+index 0e9c0668fe4e..38a14f818ef1 100644
+--- a/arch/x86/crypto/des3_ede_glue.c
++++ b/arch/x86/crypto/des3_ede_glue.c
+@@ -502,8 +502,8 @@ module_exit(des3_ede_x86_fini);
+
+ MODULE_LICENSE("GPL");
+ MODULE_DESCRIPTION("Triple DES EDE Cipher Algorithm, asm optimized");
+-MODULE_ALIAS("des3_ede");
+-MODULE_ALIAS("des3_ede-asm");
+-MODULE_ALIAS("des");
+-MODULE_ALIAS("des-asm");
++MODULE_ALIAS_CRYPTO("des3_ede");
++MODULE_ALIAS_CRYPTO("des3_ede-asm");
++MODULE_ALIAS_CRYPTO("des");
++MODULE_ALIAS_CRYPTO("des-asm");
+ MODULE_AUTHOR("Jussi Kivilinna <jussi.kivilinna@iki.fi>");
+diff --git a/arch/x86/crypto/fpu.c b/arch/x86/crypto/fpu.c
+index 98d7a188f46b..f368ba261739 100644
+--- a/arch/x86/crypto/fpu.c
++++ b/arch/x86/crypto/fpu.c
+@@ -17,6 +17,7 @@
+ #include <linux/kernel.h>
+ #include <linux/module.h>
+ #include <linux/slab.h>
++#include <linux/crypto.h>
+ #include <asm/i387.h>
+
+ struct crypto_fpu_ctx {
+@@ -159,3 +160,5 @@ void __exit crypto_fpu_exit(void)
+ {
+ crypto_unregister_template(&crypto_fpu_tmpl);
+ }
++
++MODULE_ALIAS_CRYPTO("fpu");
+diff --git a/arch/x86/crypto/ghash-clmulni-intel_glue.c b/arch/x86/crypto/ghash-clmulni-intel_glue.c
+index 88bb7ba8b175..8253d85aa165 100644
+--- a/arch/x86/crypto/ghash-clmulni-intel_glue.c
++++ b/arch/x86/crypto/ghash-clmulni-intel_glue.c
+@@ -341,4 +341,4 @@ module_exit(ghash_pclmulqdqni_mod_exit);
+ MODULE_LICENSE("GPL");
+ MODULE_DESCRIPTION("GHASH Message Digest Algorithm, "
+ "acclerated by PCLMULQDQ-NI");
+-MODULE_ALIAS("ghash");
++MODULE_ALIAS_CRYPTO("ghash");
+diff --git a/arch/x86/crypto/salsa20_glue.c b/arch/x86/crypto/salsa20_glue.c
+index 5e8e67739bb5..399a29d067d6 100644
+--- a/arch/x86/crypto/salsa20_glue.c
++++ b/arch/x86/crypto/salsa20_glue.c
+@@ -119,5 +119,5 @@ module_exit(fini);
+
+ MODULE_LICENSE("GPL");
+ MODULE_DESCRIPTION ("Salsa20 stream cipher algorithm (optimized assembly version)");
+-MODULE_ALIAS("salsa20");
+-MODULE_ALIAS("salsa20-asm");
++MODULE_ALIAS_CRYPTO("salsa20");
++MODULE_ALIAS_CRYPTO("salsa20-asm");
+diff --git a/arch/x86/crypto/serpent_avx2_glue.c b/arch/x86/crypto/serpent_avx2_glue.c
+index 2fae489b1524..437e47a4d302 100644
+--- a/arch/x86/crypto/serpent_avx2_glue.c
++++ b/arch/x86/crypto/serpent_avx2_glue.c
+@@ -558,5 +558,5 @@ module_exit(fini);
+
+ MODULE_LICENSE("GPL");
+ MODULE_DESCRIPTION("Serpent Cipher Algorithm, AVX2 optimized");
+-MODULE_ALIAS("serpent");
+-MODULE_ALIAS("serpent-asm");
++MODULE_ALIAS_CRYPTO("serpent");
++MODULE_ALIAS_CRYPTO("serpent-asm");
+diff --git a/arch/x86/crypto/serpent_avx_glue.c b/arch/x86/crypto/serpent_avx_glue.c
+index ff4870870972..7e217398b4eb 100644
+--- a/arch/x86/crypto/serpent_avx_glue.c
++++ b/arch/x86/crypto/serpent_avx_glue.c
+@@ -617,4 +617,4 @@ module_exit(serpent_exit);
+
+ MODULE_DESCRIPTION("Serpent Cipher Algorithm, AVX optimized");
+ MODULE_LICENSE("GPL");
+-MODULE_ALIAS("serpent");
++MODULE_ALIAS_CRYPTO("serpent");
+diff --git a/arch/x86/crypto/serpent_sse2_glue.c b/arch/x86/crypto/serpent_sse2_glue.c
+index 8c95f8637306..bf025adaea01 100644
+--- a/arch/x86/crypto/serpent_sse2_glue.c
++++ b/arch/x86/crypto/serpent_sse2_glue.c
+@@ -618,4 +618,4 @@ module_exit(serpent_sse2_exit);
+
+ MODULE_DESCRIPTION("Serpent Cipher Algorithm, SSE2 optimized");
+ MODULE_LICENSE("GPL");
+-MODULE_ALIAS("serpent");
++MODULE_ALIAS_CRYPTO("serpent");
+diff --git a/arch/x86/crypto/sha-mb/sha1_mb.c b/arch/x86/crypto/sha-mb/sha1_mb.c
+index 99eefd812958..d42c9b7fadcf 100644
+--- a/arch/x86/crypto/sha-mb/sha1_mb.c
++++ b/arch/x86/crypto/sha-mb/sha1_mb.c
+@@ -932,4 +932,4 @@ module_exit(sha1_mb_mod_fini);
+ MODULE_LICENSE("GPL");
+ MODULE_DESCRIPTION("SHA1 Secure Hash Algorithm, multi buffer accelerated");
+
+-MODULE_ALIAS("sha1");
++MODULE_ALIAS_CRYPTO("sha1");
+diff --git a/arch/x86/crypto/sha1_ssse3_glue.c b/arch/x86/crypto/sha1_ssse3_glue.c
+index 74d16ef707c7..6c20fe04a738 100644
+--- a/arch/x86/crypto/sha1_ssse3_glue.c
++++ b/arch/x86/crypto/sha1_ssse3_glue.c
+@@ -278,4 +278,4 @@ module_exit(sha1_ssse3_mod_fini);
+ MODULE_LICENSE("GPL");
+ MODULE_DESCRIPTION("SHA1 Secure Hash Algorithm, Supplemental SSE3 accelerated");
+
+-MODULE_ALIAS("sha1");
++MODULE_ALIAS_CRYPTO("sha1");
+diff --git a/arch/x86/crypto/sha256_ssse3_glue.c b/arch/x86/crypto/sha256_ssse3_glue.c
+index f248546da1ca..4dc100d82902 100644
+--- a/arch/x86/crypto/sha256_ssse3_glue.c
++++ b/arch/x86/crypto/sha256_ssse3_glue.c
+@@ -318,5 +318,5 @@ module_exit(sha256_ssse3_mod_fini);
+ MODULE_LICENSE("GPL");
+ MODULE_DESCRIPTION("SHA256 Secure Hash Algorithm, Supplemental SSE3 accelerated");
+
+-MODULE_ALIAS("sha256");
+-MODULE_ALIAS("sha224");
++MODULE_ALIAS_CRYPTO("sha256");
++MODULE_ALIAS_CRYPTO("sha224");
+diff --git a/arch/x86/crypto/sha512_ssse3_glue.c b/arch/x86/crypto/sha512_ssse3_glue.c
+index 8626b03e83b7..26a5898a6f26 100644
+--- a/arch/x86/crypto/sha512_ssse3_glue.c
++++ b/arch/x86/crypto/sha512_ssse3_glue.c
+@@ -326,5 +326,5 @@ module_exit(sha512_ssse3_mod_fini);
+ MODULE_LICENSE("GPL");
+ MODULE_DESCRIPTION("SHA512 Secure Hash Algorithm, Supplemental SSE3 accelerated");
+
+-MODULE_ALIAS("sha512");
+-MODULE_ALIAS("sha384");
++MODULE_ALIAS_CRYPTO("sha512");
++MODULE_ALIAS_CRYPTO("sha384");
+diff --git a/arch/x86/crypto/twofish_avx_glue.c b/arch/x86/crypto/twofish_avx_glue.c
+index 4e3c665be129..1ac531ea9bcc 100644
+--- a/arch/x86/crypto/twofish_avx_glue.c
++++ b/arch/x86/crypto/twofish_avx_glue.c
+@@ -579,4 +579,4 @@ module_exit(twofish_exit);
+
+ MODULE_DESCRIPTION("Twofish Cipher Algorithm, AVX optimized");
+ MODULE_LICENSE("GPL");
+-MODULE_ALIAS("twofish");
++MODULE_ALIAS_CRYPTO("twofish");
+diff --git a/arch/x86/crypto/twofish_glue.c b/arch/x86/crypto/twofish_glue.c
+index 0a5202303501..77e06c2da83d 100644
+--- a/arch/x86/crypto/twofish_glue.c
++++ b/arch/x86/crypto/twofish_glue.c
+@@ -96,5 +96,5 @@ module_exit(fini);
+
+ MODULE_LICENSE("GPL");
+ MODULE_DESCRIPTION ("Twofish Cipher Algorithm, asm optimized");
+-MODULE_ALIAS("twofish");
+-MODULE_ALIAS("twofish-asm");
++MODULE_ALIAS_CRYPTO("twofish");
++MODULE_ALIAS_CRYPTO("twofish-asm");
+diff --git a/arch/x86/crypto/twofish_glue_3way.c b/arch/x86/crypto/twofish_glue_3way.c
+index 13e63b3e1dfb..56d8a08ee479 100644
+--- a/arch/x86/crypto/twofish_glue_3way.c
++++ b/arch/x86/crypto/twofish_glue_3way.c
+@@ -495,5 +495,5 @@ module_exit(fini);
+
+ MODULE_LICENSE("GPL");
+ MODULE_DESCRIPTION("Twofish Cipher Algorithm, 3-way parallel asm optimized");
+-MODULE_ALIAS("twofish");
+-MODULE_ALIAS("twofish-asm");
++MODULE_ALIAS_CRYPTO("twofish");
++MODULE_ALIAS_CRYPTO("twofish-asm");
+diff --git a/arch/x86/include/asm/desc.h b/arch/x86/include/asm/desc.h
+index 50d033a8947d..a94b82e8f156 100644
+--- a/arch/x86/include/asm/desc.h
++++ b/arch/x86/include/asm/desc.h
+@@ -251,7 +251,8 @@ static inline void native_load_tls(struct thread_struct *t, unsigned int cpu)
+ gdt[GDT_ENTRY_TLS_MIN + i] = t->tls_array[i];
+ }
+
+-#define _LDT_empty(info) \
++/* This intentionally ignores lm, since 32-bit apps don't have that field. */
++#define LDT_empty(info) \
+ ((info)->base_addr == 0 && \
+ (info)->limit == 0 && \
+ (info)->contents == 0 && \
+@@ -261,11 +262,18 @@ static inline void native_load_tls(struct thread_struct *t, unsigned int cpu)
+ (info)->seg_not_present == 1 && \
+ (info)->useable == 0)
+
+-#ifdef CONFIG_X86_64
+-#define LDT_empty(info) (_LDT_empty(info) && ((info)->lm == 0))
+-#else
+-#define LDT_empty(info) (_LDT_empty(info))
+-#endif
++/* Lots of programs expect an all-zero user_desc to mean "no segment at all". */
++static inline bool LDT_zero(const struct user_desc *info)
++{
++ return (info->base_addr == 0 &&
++ info->limit == 0 &&
++ info->contents == 0 &&
++ info->read_exec_only == 0 &&
++ info->seg_32bit == 0 &&
++ info->limit_in_pages == 0 &&
++ info->seg_not_present == 0 &&
++ info->useable == 0);
++}
+
+ static inline void clear_LDT(void)
+ {
+diff --git a/arch/x86/kernel/cpu/mshyperv.c b/arch/x86/kernel/cpu/mshyperv.c
+index a450373e8e91..939155ffdece 100644
+--- a/arch/x86/kernel/cpu/mshyperv.c
++++ b/arch/x86/kernel/cpu/mshyperv.c
+@@ -107,6 +107,7 @@ static struct clocksource hyperv_cs = {
+ .rating = 400, /* use this when running on Hyperv*/
+ .read = read_hv_clock,
+ .mask = CLOCKSOURCE_MASK(64),
++ .flags = CLOCK_SOURCE_IS_CONTINUOUS,
+ };
+
+ static void __init ms_hyperv_init_platform(void)
+diff --git a/arch/x86/kernel/irq.c b/arch/x86/kernel/irq.c
+index 922d28581024..37907756fc41 100644
+--- a/arch/x86/kernel/irq.c
++++ b/arch/x86/kernel/irq.c
+@@ -127,7 +127,7 @@ int arch_show_interrupts(struct seq_file *p, int prec)
+ seq_printf(p, " Machine check polls\n");
+ #endif
+ #if IS_ENABLED(CONFIG_HYPERV) || defined(CONFIG_XEN)
+- seq_printf(p, "%*s: ", prec, "THR");
++ seq_printf(p, "%*s: ", prec, "HYP");
+ for_each_online_cpu(j)
+ seq_printf(p, "%10u ", irq_stats(j)->irq_hv_callback_count);
+ seq_printf(p, " Hypervisor callback interrupts\n");
+diff --git a/arch/x86/kernel/tls.c b/arch/x86/kernel/tls.c
+index 4e942f31b1a7..7fc5e843f247 100644
+--- a/arch/x86/kernel/tls.c
++++ b/arch/x86/kernel/tls.c
+@@ -29,7 +29,28 @@ static int get_free_idx(void)
+
+ static bool tls_desc_okay(const struct user_desc *info)
+ {
+- if (LDT_empty(info))
++ /*
++ * For historical reasons (i.e. no one ever documented how any
++ * of the segmentation APIs work), user programs can and do
++ * assume that a struct user_desc that's all zeros except for
++ * entry_number means "no segment at all". This never actually
++ * worked. In fact, up to Linux 3.19, a struct user_desc like
++ * this would create a 16-bit read-write segment with base and
++ * limit both equal to zero.
++ *
++ * That was close enough to "no segment at all" until we
++ * hardened this function to disallow 16-bit TLS segments. Fix
++ * it up by interpreting these zeroed segments the way that they
++ * were almost certainly intended to be interpreted.
++ *
++ * The correct way to ask for "no segment at all" is to specify
++ * a user_desc that satisfies LDT_empty. To keep everything
++ * working, we accept both.
++ *
++ * Note that there's a similar kludge in modify_ldt -- look at
++ * the distinction between modes 1 and 0x11.
++ */
++ if (LDT_empty(info) || LDT_zero(info))
+ return true;
+
+ /*
+@@ -71,7 +92,7 @@ static void set_tls_desc(struct task_struct *p, int idx,
+ cpu = get_cpu();
+
+ while (n-- > 0) {
+- if (LDT_empty(info))
++ if (LDT_empty(info) || LDT_zero(info))
+ desc->a = desc->b = 0;
+ else
+ fill_ldt(desc, info);
+diff --git a/arch/x86/kernel/tsc.c b/arch/x86/kernel/tsc.c
+index b7e50bba3bbb..505449700e0c 100644
+--- a/arch/x86/kernel/tsc.c
++++ b/arch/x86/kernel/tsc.c
+@@ -617,7 +617,7 @@ static unsigned long quick_pit_calibrate(void)
+ goto success;
+ }
+ }
+- pr_err("Fast TSC calibration failed\n");
++ pr_info("Fast TSC calibration failed\n");
+ return 0;
+
+ success:
+diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
+index 22e7ed9e6d8e..c7327a7761ca 100644
+--- a/arch/x86/kvm/emulate.c
++++ b/arch/x86/kvm/emulate.c
+@@ -2345,7 +2345,7 @@ static int em_sysenter(struct x86_emulate_ctxt *ctxt)
+ * Not recognized on AMD in compat mode (but is recognized in legacy
+ * mode).
+ */
+- if ((ctxt->mode == X86EMUL_MODE_PROT32) && (efer & EFER_LMA)
++ if ((ctxt->mode != X86EMUL_MODE_PROT64) && (efer & EFER_LMA)
+ && !vendor_intel(ctxt))
+ return emulate_ud(ctxt);
+
+@@ -2358,25 +2358,13 @@ static int em_sysenter(struct x86_emulate_ctxt *ctxt)
+ setup_syscalls_segments(ctxt, &cs, &ss);
+
+ ops->get_msr(ctxt, MSR_IA32_SYSENTER_CS, &msr_data);
+- switch (ctxt->mode) {
+- case X86EMUL_MODE_PROT32:
+- if ((msr_data & 0xfffc) == 0x0)
+- return emulate_gp(ctxt, 0);
+- break;
+- case X86EMUL_MODE_PROT64:
+- if (msr_data == 0x0)
+- return emulate_gp(ctxt, 0);
+- break;
+- default:
+- break;
+- }
++ if ((msr_data & 0xfffc) == 0x0)
++ return emulate_gp(ctxt, 0);
+
+ ctxt->eflags &= ~(EFLG_VM | EFLG_IF);
+- cs_sel = (u16)msr_data;
+- cs_sel &= ~SELECTOR_RPL_MASK;
++ cs_sel = (u16)msr_data & ~SELECTOR_RPL_MASK;
+ ss_sel = cs_sel + 8;
+- ss_sel &= ~SELECTOR_RPL_MASK;
+- if (ctxt->mode == X86EMUL_MODE_PROT64 || (efer & EFER_LMA)) {
++ if (efer & EFER_LMA) {
+ cs.d = 0;
+ cs.l = 1;
+ }
+@@ -2385,10 +2373,11 @@ static int em_sysenter(struct x86_emulate_ctxt *ctxt)
+ ops->set_segment(ctxt, ss_sel, &ss, 0, VCPU_SREG_SS);
+
+ ops->get_msr(ctxt, MSR_IA32_SYSENTER_EIP, &msr_data);
+- ctxt->_eip = msr_data;
++ ctxt->_eip = (efer & EFER_LMA) ? msr_data : (u32)msr_data;
+
+ ops->get_msr(ctxt, MSR_IA32_SYSENTER_ESP, &msr_data);
+- *reg_write(ctxt, VCPU_REGS_RSP) = msr_data;
++ *reg_write(ctxt, VCPU_REGS_RSP) = (efer & EFER_LMA) ? msr_data :
++ (u32)msr_data;
+
+ return X86EMUL_CONTINUE;
+ }
+@@ -3788,8 +3777,8 @@ static const struct opcode group5[] = {
+ };
+
+ static const struct opcode group6[] = {
+- DI(Prot, sldt),
+- DI(Prot, str),
++ DI(Prot | DstMem, sldt),
++ DI(Prot | DstMem, str),
+ II(Prot | Priv | SrcMem16, em_lldt, lldt),
+ II(Prot | Priv | SrcMem16, em_ltr, ltr),
+ N, N, N, N,
+diff --git a/arch/x86/pci/i386.c b/arch/x86/pci/i386.c
+index 37c1435889ce..d0583eb61a5d 100644
+--- a/arch/x86/pci/i386.c
++++ b/arch/x86/pci/i386.c
+@@ -216,7 +216,7 @@ static void pcibios_allocate_bridge_resources(struct pci_dev *dev)
+ continue;
+ if (r->parent) /* Already allocated */
+ continue;
+- if (!r->start || pci_claim_resource(dev, idx) < 0) {
++ if (!r->start || pci_claim_bridge_resource(dev, idx) < 0) {
+ /*
+ * Something is wrong with the region.
+ * Invalidate the resource to prevent
+diff --git a/crypto/842.c b/crypto/842.c
+index 65c7a89cfa09..b48f4f108c47 100644
+--- a/crypto/842.c
++++ b/crypto/842.c
+@@ -180,3 +180,4 @@ module_exit(nx842_mod_exit);
+
+ MODULE_LICENSE("GPL");
+ MODULE_DESCRIPTION("842 Compression Algorithm");
++MODULE_ALIAS_CRYPTO("842");
+diff --git a/crypto/aes_generic.c b/crypto/aes_generic.c
+index fd0d6b454975..3dd101144a58 100644
+--- a/crypto/aes_generic.c
++++ b/crypto/aes_generic.c
+@@ -1474,4 +1474,5 @@ module_exit(aes_fini);
+
+ MODULE_DESCRIPTION("Rijndael (AES) Cipher Algorithm");
+ MODULE_LICENSE("Dual BSD/GPL");
+-MODULE_ALIAS("aes");
++MODULE_ALIAS_CRYPTO("aes");
++MODULE_ALIAS_CRYPTO("aes-generic");
+diff --git a/crypto/algapi.c b/crypto/algapi.c
+index e8d3a7dca8c4..71a8143e23b1 100644
+--- a/crypto/algapi.c
++++ b/crypto/algapi.c
+@@ -509,8 +509,8 @@ static struct crypto_template *__crypto_lookup_template(const char *name)
+
+ struct crypto_template *crypto_lookup_template(const char *name)
+ {
+- return try_then_request_module(__crypto_lookup_template(name), "%s",
+- name);
++ return try_then_request_module(__crypto_lookup_template(name),
++ "crypto-%s", name);
+ }
+ EXPORT_SYMBOL_GPL(crypto_lookup_template);
+
+diff --git a/crypto/ansi_cprng.c b/crypto/ansi_cprng.c
+index 666f1962a160..6f5bebc9bf01 100644
+--- a/crypto/ansi_cprng.c
++++ b/crypto/ansi_cprng.c
+@@ -476,4 +476,5 @@ module_param(dbg, int, 0);
+ MODULE_PARM_DESC(dbg, "Boolean to enable debugging (0/1 == off/on)");
+ module_init(prng_mod_init);
+ module_exit(prng_mod_fini);
+-MODULE_ALIAS("stdrng");
++MODULE_ALIAS_CRYPTO("stdrng");
++MODULE_ALIAS_CRYPTO("ansi_cprng");
+diff --git a/crypto/anubis.c b/crypto/anubis.c
+index 008c8a4fb67c..4bb187c2a902 100644
+--- a/crypto/anubis.c
++++ b/crypto/anubis.c
+@@ -704,3 +704,4 @@ module_exit(anubis_mod_fini);
+
+ MODULE_LICENSE("GPL");
+ MODULE_DESCRIPTION("Anubis Cryptographic Algorithm");
++MODULE_ALIAS_CRYPTO("anubis");
+diff --git a/crypto/api.c b/crypto/api.c
+index a2b39c5f3649..2a81e98a0021 100644
+--- a/crypto/api.c
++++ b/crypto/api.c
+@@ -216,11 +216,11 @@ struct crypto_alg *crypto_larval_lookup(const char *name, u32 type, u32 mask)
+
+ alg = crypto_alg_lookup(name, type, mask);
+ if (!alg) {
+- request_module("%s", name);
++ request_module("crypto-%s", name);
+
+ if (!((type ^ CRYPTO_ALG_NEED_FALLBACK) & mask &
+ CRYPTO_ALG_NEED_FALLBACK))
+- request_module("%s-all", name);
++ request_module("crypto-%s-all", name);
+
+ alg = crypto_alg_lookup(name, type, mask);
+ }
+diff --git a/crypto/arc4.c b/crypto/arc4.c
+index 5a772c3657d5..f1a81925558f 100644
+--- a/crypto/arc4.c
++++ b/crypto/arc4.c
+@@ -166,3 +166,4 @@ module_exit(arc4_exit);
+ MODULE_LICENSE("GPL");
+ MODULE_DESCRIPTION("ARC4 Cipher Algorithm");
+ MODULE_AUTHOR("Jon Oberheide <jon@oberheide.org>");
++MODULE_ALIAS_CRYPTO("arc4");
+diff --git a/crypto/authenc.c b/crypto/authenc.c
+index e1223559d5df..78fb16cab13f 100644
+--- a/crypto/authenc.c
++++ b/crypto/authenc.c
+@@ -721,3 +721,4 @@ module_exit(crypto_authenc_module_exit);
+
+ MODULE_LICENSE("GPL");
+ MODULE_DESCRIPTION("Simple AEAD wrapper for IPsec");
++MODULE_ALIAS_CRYPTO("authenc");
+diff --git a/crypto/authencesn.c b/crypto/authencesn.c
+index 4be0dd4373a9..024bff2344fc 100644
+--- a/crypto/authencesn.c
++++ b/crypto/authencesn.c
+@@ -814,3 +814,4 @@ module_exit(crypto_authenc_esn_module_exit);
+ MODULE_LICENSE("GPL");
+ MODULE_AUTHOR("Steffen Klassert <steffen.klassert@secunet.com>");
+ MODULE_DESCRIPTION("AEAD wrapper for IPsec with extended sequence numbers");
++MODULE_ALIAS_CRYPTO("authencesn");
+diff --git a/crypto/blowfish_generic.c b/crypto/blowfish_generic.c
+index 8baf5447d35b..87b392a77a93 100644
+--- a/crypto/blowfish_generic.c
++++ b/crypto/blowfish_generic.c
+@@ -138,4 +138,5 @@ module_exit(blowfish_mod_fini);
+
+ MODULE_LICENSE("GPL");
+ MODULE_DESCRIPTION("Blowfish Cipher Algorithm");
+-MODULE_ALIAS("blowfish");
++MODULE_ALIAS_CRYPTO("blowfish");
++MODULE_ALIAS_CRYPTO("blowfish-generic");
+diff --git a/crypto/camellia_generic.c b/crypto/camellia_generic.c
+index 26bcd7a2d6b4..a02286bf319e 100644
+--- a/crypto/camellia_generic.c
++++ b/crypto/camellia_generic.c
+@@ -1098,4 +1098,5 @@ module_exit(camellia_fini);
+
+ MODULE_DESCRIPTION("Camellia Cipher Algorithm");
+ MODULE_LICENSE("GPL");
+-MODULE_ALIAS("camellia");
++MODULE_ALIAS_CRYPTO("camellia");
++MODULE_ALIAS_CRYPTO("camellia-generic");
+diff --git a/crypto/cast5_generic.c b/crypto/cast5_generic.c
+index 5558f630a0eb..df5c72629383 100644
+--- a/crypto/cast5_generic.c
++++ b/crypto/cast5_generic.c
+@@ -549,4 +549,5 @@ module_exit(cast5_mod_fini);
+
+ MODULE_LICENSE("GPL");
+ MODULE_DESCRIPTION("Cast5 Cipher Algorithm");
+-MODULE_ALIAS("cast5");
++MODULE_ALIAS_CRYPTO("cast5");
++MODULE_ALIAS_CRYPTO("cast5-generic");
+diff --git a/crypto/cast6_generic.c b/crypto/cast6_generic.c
+index de732528a430..058c8d755d03 100644
+--- a/crypto/cast6_generic.c
++++ b/crypto/cast6_generic.c
+@@ -291,4 +291,5 @@ module_exit(cast6_mod_fini);
+
+ MODULE_LICENSE("GPL");
+ MODULE_DESCRIPTION("Cast6 Cipher Algorithm");
+-MODULE_ALIAS("cast6");
++MODULE_ALIAS_CRYPTO("cast6");
++MODULE_ALIAS_CRYPTO("cast6-generic");
+diff --git a/crypto/cbc.c b/crypto/cbc.c
+index 61ac42e1e32b..780ee27b2d43 100644
+--- a/crypto/cbc.c
++++ b/crypto/cbc.c
+@@ -289,3 +289,4 @@ module_exit(crypto_cbc_module_exit);
+
+ MODULE_LICENSE("GPL");
+ MODULE_DESCRIPTION("CBC block cipher algorithm");
++MODULE_ALIAS_CRYPTO("cbc");
+diff --git a/crypto/ccm.c b/crypto/ccm.c
+index 1df84217f7c9..003bbbd21a2b 100644
+--- a/crypto/ccm.c
++++ b/crypto/ccm.c
+@@ -879,5 +879,6 @@ module_exit(crypto_ccm_module_exit);
+
+ MODULE_LICENSE("GPL");
+ MODULE_DESCRIPTION("Counter with CBC MAC");
+-MODULE_ALIAS("ccm_base");
+-MODULE_ALIAS("rfc4309");
++MODULE_ALIAS_CRYPTO("ccm_base");
++MODULE_ALIAS_CRYPTO("rfc4309");
++MODULE_ALIAS_CRYPTO("ccm");
+diff --git a/crypto/chainiv.c b/crypto/chainiv.c
+index 9c294c8f9a07..63c17d5992f7 100644
+--- a/crypto/chainiv.c
++++ b/crypto/chainiv.c
+@@ -359,3 +359,4 @@ module_exit(chainiv_module_exit);
+
+ MODULE_LICENSE("GPL");
+ MODULE_DESCRIPTION("Chain IV Generator");
++MODULE_ALIAS_CRYPTO("chainiv");
+diff --git a/crypto/cmac.c b/crypto/cmac.c
+index 50880cf17fad..7a8bfbd548f6 100644
+--- a/crypto/cmac.c
++++ b/crypto/cmac.c
+@@ -313,3 +313,4 @@ module_exit(crypto_cmac_module_exit);
+
+ MODULE_LICENSE("GPL");
+ MODULE_DESCRIPTION("CMAC keyed hash algorithm");
++MODULE_ALIAS_CRYPTO("cmac");
+diff --git a/crypto/crc32.c b/crypto/crc32.c
+index 9d1c41569898..187ded28cb0b 100644
+--- a/crypto/crc32.c
++++ b/crypto/crc32.c
+@@ -156,3 +156,4 @@ module_exit(crc32_mod_fini);
+ MODULE_AUTHOR("Alexander Boyko <alexander_boyko@xyratex.com>");
+ MODULE_DESCRIPTION("CRC32 calculations wrapper for lib/crc32");
+ MODULE_LICENSE("GPL");
++MODULE_ALIAS_CRYPTO("crc32");
+diff --git a/crypto/crc32c_generic.c b/crypto/crc32c_generic.c
+index d9c7beba8e50..06f1b60f02b2 100644
+--- a/crypto/crc32c_generic.c
++++ b/crypto/crc32c_generic.c
+@@ -170,5 +170,6 @@ module_exit(crc32c_mod_fini);
+ MODULE_AUTHOR("Clay Haapala <chaapala@cisco.com>");
+ MODULE_DESCRIPTION("CRC32c (Castagnoli) calculations wrapper for lib/crc32c");
+ MODULE_LICENSE("GPL");
+-MODULE_ALIAS("crc32c");
++MODULE_ALIAS_CRYPTO("crc32c");
++MODULE_ALIAS_CRYPTO("crc32c-generic");
+ MODULE_SOFTDEP("pre: crc32c");
+diff --git a/crypto/crct10dif_generic.c b/crypto/crct10dif_generic.c
+index 877e7114ec5c..c1229614c7e3 100644
+--- a/crypto/crct10dif_generic.c
++++ b/crypto/crct10dif_generic.c
+@@ -124,4 +124,5 @@ module_exit(crct10dif_mod_fini);
+ MODULE_AUTHOR("Tim Chen <tim.c.chen@linux.intel.com>");
+ MODULE_DESCRIPTION("T10 DIF CRC calculation.");
+ MODULE_LICENSE("GPL");
+-MODULE_ALIAS("crct10dif");
++MODULE_ALIAS_CRYPTO("crct10dif");
++MODULE_ALIAS_CRYPTO("crct10dif-generic");
+diff --git a/crypto/cryptd.c b/crypto/cryptd.c
+index e592c90abebb..650afac10fd7 100644
+--- a/crypto/cryptd.c
++++ b/crypto/cryptd.c
+@@ -955,3 +955,4 @@ module_exit(cryptd_exit);
+
+ MODULE_LICENSE("GPL");
+ MODULE_DESCRIPTION("Software async crypto daemon");
++MODULE_ALIAS_CRYPTO("cryptd");
+diff --git a/crypto/crypto_null.c b/crypto/crypto_null.c
+index 1dc54bb95a87..a20319132e33 100644
+--- a/crypto/crypto_null.c
++++ b/crypto/crypto_null.c
+@@ -145,9 +145,9 @@ static struct crypto_alg null_algs[3] = { {
+ .coa_decompress = null_compress } }
+ } };
+
+-MODULE_ALIAS("compress_null");
+-MODULE_ALIAS("digest_null");
+-MODULE_ALIAS("cipher_null");
++MODULE_ALIAS_CRYPTO("compress_null");
++MODULE_ALIAS_CRYPTO("digest_null");
++MODULE_ALIAS_CRYPTO("cipher_null");
+
+ static int __init crypto_null_mod_init(void)
+ {
+diff --git a/crypto/ctr.c b/crypto/ctr.c
+index f2b94f27bb2c..2386f7313952 100644
+--- a/crypto/ctr.c
++++ b/crypto/ctr.c
+@@ -466,4 +466,5 @@ module_exit(crypto_ctr_module_exit);
+
+ MODULE_LICENSE("GPL");
+ MODULE_DESCRIPTION("CTR Counter block mode");
+-MODULE_ALIAS("rfc3686");
++MODULE_ALIAS_CRYPTO("rfc3686");
++MODULE_ALIAS_CRYPTO("ctr");
+diff --git a/crypto/cts.c b/crypto/cts.c
+index 133f0874c95e..bd9405820e8a 100644
+--- a/crypto/cts.c
++++ b/crypto/cts.c
+@@ -351,3 +351,4 @@ module_exit(crypto_cts_module_exit);
+
+ MODULE_LICENSE("Dual BSD/GPL");
+ MODULE_DESCRIPTION("CTS-CBC CipherText Stealing for CBC");
++MODULE_ALIAS_CRYPTO("cts");
+diff --git a/crypto/deflate.c b/crypto/deflate.c
+index b57d70eb156b..95d8d37c5021 100644
+--- a/crypto/deflate.c
++++ b/crypto/deflate.c
+@@ -222,4 +222,4 @@ module_exit(deflate_mod_fini);
+ MODULE_LICENSE("GPL");
+ MODULE_DESCRIPTION("Deflate Compression Algorithm for IPCOMP");
+ MODULE_AUTHOR("James Morris <jmorris@intercode.com.au>");
+-
++MODULE_ALIAS_CRYPTO("deflate");
+diff --git a/crypto/des_generic.c b/crypto/des_generic.c
+index 298d464ab7d2..a71720544d11 100644
+--- a/crypto/des_generic.c
++++ b/crypto/des_generic.c
+@@ -983,8 +983,6 @@ static struct crypto_alg des_algs[2] = { {
+ .cia_decrypt = des3_ede_decrypt } }
+ } };
+
+-MODULE_ALIAS("des3_ede");
+-
+ static int __init des_generic_mod_init(void)
+ {
+ return crypto_register_algs(des_algs, ARRAY_SIZE(des_algs));
+@@ -1001,4 +999,7 @@ module_exit(des_generic_mod_fini);
+ MODULE_LICENSE("GPL");
+ MODULE_DESCRIPTION("DES & Triple DES EDE Cipher Algorithms");
+ MODULE_AUTHOR("Dag Arne Osvik <da@osvik.no>");
+-MODULE_ALIAS("des");
++MODULE_ALIAS_CRYPTO("des");
++MODULE_ALIAS_CRYPTO("des-generic");
++MODULE_ALIAS_CRYPTO("des3_ede");
++MODULE_ALIAS_CRYPTO("des3_ede-generic");
+diff --git a/crypto/ecb.c b/crypto/ecb.c
+index 935cfef4aa84..12011aff0971 100644
+--- a/crypto/ecb.c
++++ b/crypto/ecb.c
+@@ -185,3 +185,4 @@ module_exit(crypto_ecb_module_exit);
+
+ MODULE_LICENSE("GPL");
+ MODULE_DESCRIPTION("ECB block cipher algorithm");
++MODULE_ALIAS_CRYPTO("ecb");
+diff --git a/crypto/eseqiv.c b/crypto/eseqiv.c
+index bf7ab4a89493..f116fae766f8 100644
+--- a/crypto/eseqiv.c
++++ b/crypto/eseqiv.c
+@@ -267,3 +267,4 @@ module_exit(eseqiv_module_exit);
+
+ MODULE_LICENSE("GPL");
+ MODULE_DESCRIPTION("Encrypted Sequence Number IV Generator");
++MODULE_ALIAS_CRYPTO("eseqiv");
+diff --git a/crypto/fcrypt.c b/crypto/fcrypt.c
+index 021d7fec6bc8..77286ea28865 100644
+--- a/crypto/fcrypt.c
++++ b/crypto/fcrypt.c
+@@ -420,3 +420,4 @@ module_exit(fcrypt_mod_fini);
+ MODULE_LICENSE("Dual BSD/GPL");
+ MODULE_DESCRIPTION("FCrypt Cipher Algorithm");
+ MODULE_AUTHOR("David Howells <dhowells@redhat.com>");
++MODULE_ALIAS_CRYPTO("fcrypt");
+diff --git a/crypto/gcm.c b/crypto/gcm.c
+index 276cdac567b6..2e403f6138c1 100644
+--- a/crypto/gcm.c
++++ b/crypto/gcm.c
+@@ -1441,6 +1441,7 @@ module_exit(crypto_gcm_module_exit);
+ MODULE_LICENSE("GPL");
+ MODULE_DESCRIPTION("Galois/Counter Mode");
+ MODULE_AUTHOR("Mikko Herranen <mh1@iki.fi>");
+-MODULE_ALIAS("gcm_base");
+-MODULE_ALIAS("rfc4106");
+-MODULE_ALIAS("rfc4543");
++MODULE_ALIAS_CRYPTO("gcm_base");
++MODULE_ALIAS_CRYPTO("rfc4106");
++MODULE_ALIAS_CRYPTO("rfc4543");
++MODULE_ALIAS_CRYPTO("gcm");
+diff --git a/crypto/ghash-generic.c b/crypto/ghash-generic.c
+index 9d3f0c69a86f..bac70995e064 100644
+--- a/crypto/ghash-generic.c
++++ b/crypto/ghash-generic.c
+@@ -172,4 +172,5 @@ module_exit(ghash_mod_exit);
+
+ MODULE_LICENSE("GPL");
+ MODULE_DESCRIPTION("GHASH Message Digest Algorithm");
+-MODULE_ALIAS("ghash");
++MODULE_ALIAS_CRYPTO("ghash");
++MODULE_ALIAS_CRYPTO("ghash-generic");
+diff --git a/crypto/hmac.c b/crypto/hmac.c
+index e392219ddc61..72e38c098bb3 100644
+--- a/crypto/hmac.c
++++ b/crypto/hmac.c
+@@ -268,3 +268,4 @@ module_exit(hmac_module_exit);
+
+ MODULE_LICENSE("GPL");
+ MODULE_DESCRIPTION("HMAC hash algorithm");
++MODULE_ALIAS_CRYPTO("hmac");
+diff --git a/crypto/khazad.c b/crypto/khazad.c
+index 60e7cd66facc..873eb5ded6d7 100644
+--- a/crypto/khazad.c
++++ b/crypto/khazad.c
+@@ -880,3 +880,4 @@ module_exit(khazad_mod_fini);
+
+ MODULE_LICENSE("GPL");
+ MODULE_DESCRIPTION("Khazad Cryptographic Algorithm");
++MODULE_ALIAS_CRYPTO("khazad");
+diff --git a/crypto/krng.c b/crypto/krng.c
+index a2d2b72fc135..0224841b6579 100644
+--- a/crypto/krng.c
++++ b/crypto/krng.c
+@@ -62,4 +62,5 @@ module_exit(krng_mod_fini);
+
+ MODULE_LICENSE("GPL");
+ MODULE_DESCRIPTION("Kernel Random Number Generator");
+-MODULE_ALIAS("stdrng");
++MODULE_ALIAS_CRYPTO("stdrng");
++MODULE_ALIAS_CRYPTO("krng");
+diff --git a/crypto/lrw.c b/crypto/lrw.c
+index ba42acc4deba..6f9908a7ebcb 100644
+--- a/crypto/lrw.c
++++ b/crypto/lrw.c
+@@ -400,3 +400,4 @@ module_exit(crypto_module_exit);
+
+ MODULE_LICENSE("GPL");
+ MODULE_DESCRIPTION("LRW block cipher mode");
++MODULE_ALIAS_CRYPTO("lrw");
+diff --git a/crypto/lz4.c b/crypto/lz4.c
+index 34d072b72a73..aefbceaf3104 100644
+--- a/crypto/lz4.c
++++ b/crypto/lz4.c
+@@ -104,3 +104,4 @@ module_exit(lz4_mod_fini);
+
+ MODULE_LICENSE("GPL");
+ MODULE_DESCRIPTION("LZ4 Compression Algorithm");
++MODULE_ALIAS_CRYPTO("lz4");
+diff --git a/crypto/lz4hc.c b/crypto/lz4hc.c
+index 9218b3fed5e3..a1d3b5bd3d85 100644
+--- a/crypto/lz4hc.c
++++ b/crypto/lz4hc.c
+@@ -104,3 +104,4 @@ module_exit(lz4hc_mod_fini);
+
+ MODULE_LICENSE("GPL");
+ MODULE_DESCRIPTION("LZ4HC Compression Algorithm");
++MODULE_ALIAS_CRYPTO("lz4hc");
+diff --git a/crypto/lzo.c b/crypto/lzo.c
+index a8ff2f778dc4..4b3e92525dac 100644
+--- a/crypto/lzo.c
++++ b/crypto/lzo.c
+@@ -107,3 +107,4 @@ module_exit(lzo_mod_fini);
+
+ MODULE_LICENSE("GPL");
+ MODULE_DESCRIPTION("LZO Compression Algorithm");
++MODULE_ALIAS_CRYPTO("lzo");
+diff --git a/crypto/mcryptd.c b/crypto/mcryptd.c
+index b39fbd530102..a8e870444ea9 100644
+--- a/crypto/mcryptd.c
++++ b/crypto/mcryptd.c
+@@ -703,3 +703,4 @@ module_exit(mcryptd_exit);
+
+ MODULE_LICENSE("GPL");
+ MODULE_DESCRIPTION("Software async multibuffer crypto daemon");
++MODULE_ALIAS_CRYPTO("mcryptd");
+diff --git a/crypto/md4.c b/crypto/md4.c
+index 0477a6a01d58..3515af425cc9 100644
+--- a/crypto/md4.c
++++ b/crypto/md4.c
+@@ -255,4 +255,4 @@ module_exit(md4_mod_fini);
+
+ MODULE_LICENSE("GPL");
+ MODULE_DESCRIPTION("MD4 Message Digest Algorithm");
+-
++MODULE_ALIAS_CRYPTO("md4");
+diff --git a/crypto/md5.c b/crypto/md5.c
+index 7febeaab923b..36f5e5b103f3 100644
+--- a/crypto/md5.c
++++ b/crypto/md5.c
+@@ -168,3 +168,4 @@ module_exit(md5_mod_fini);
+
+ MODULE_LICENSE("GPL");
+ MODULE_DESCRIPTION("MD5 Message Digest Algorithm");
++MODULE_ALIAS_CRYPTO("md5");
+diff --git a/crypto/michael_mic.c b/crypto/michael_mic.c
+index 079b761bc70d..46195e0d0f4d 100644
+--- a/crypto/michael_mic.c
++++ b/crypto/michael_mic.c
+@@ -184,3 +184,4 @@ module_exit(michael_mic_exit);
+ MODULE_LICENSE("GPL v2");
+ MODULE_DESCRIPTION("Michael MIC");
+ MODULE_AUTHOR("Jouni Malinen <j@w1.fi>");
++MODULE_ALIAS_CRYPTO("michael_mic");
+diff --git a/crypto/pcbc.c b/crypto/pcbc.c
+index d1b8bdfb5855..f654965f0933 100644
+--- a/crypto/pcbc.c
++++ b/crypto/pcbc.c
+@@ -295,3 +295,4 @@ module_exit(crypto_pcbc_module_exit);
+
+ MODULE_LICENSE("GPL");
+ MODULE_DESCRIPTION("PCBC block cipher algorithm");
++MODULE_ALIAS_CRYPTO("pcbc");
+diff --git a/crypto/pcrypt.c b/crypto/pcrypt.c
+index 309d345ead95..c305d4112735 100644
+--- a/crypto/pcrypt.c
++++ b/crypto/pcrypt.c
+@@ -565,3 +565,4 @@ module_exit(pcrypt_exit);
+ MODULE_LICENSE("GPL");
+ MODULE_AUTHOR("Steffen Klassert <steffen.klassert@secunet.com>");
+ MODULE_DESCRIPTION("Parallel crypto wrapper");
++MODULE_ALIAS_CRYPTO("pcrypt");
+diff --git a/crypto/rmd128.c b/crypto/rmd128.c
+index 8a0f68b7f257..049486ede938 100644
+--- a/crypto/rmd128.c
++++ b/crypto/rmd128.c
+@@ -327,3 +327,4 @@ module_exit(rmd128_mod_fini);
+ MODULE_LICENSE("GPL");
+ MODULE_AUTHOR("Adrian-Ken Rueegsegger <ken@codelabs.ch>");
+ MODULE_DESCRIPTION("RIPEMD-128 Message Digest");
++MODULE_ALIAS_CRYPTO("rmd128");
+diff --git a/crypto/rmd160.c b/crypto/rmd160.c
+index 525d7bb752cf..de585e51d455 100644
+--- a/crypto/rmd160.c
++++ b/crypto/rmd160.c
+@@ -371,3 +371,4 @@ module_exit(rmd160_mod_fini);
+ MODULE_LICENSE("GPL");
+ MODULE_AUTHOR("Adrian-Ken Rueegsegger <ken@codelabs.ch>");
+ MODULE_DESCRIPTION("RIPEMD-160 Message Digest");
++MODULE_ALIAS_CRYPTO("rmd160");
+diff --git a/crypto/rmd256.c b/crypto/rmd256.c
+index 69293d9b56e0..4ec02a754e09 100644
+--- a/crypto/rmd256.c
++++ b/crypto/rmd256.c
+@@ -346,3 +346,4 @@ module_exit(rmd256_mod_fini);
+ MODULE_LICENSE("GPL");
+ MODULE_AUTHOR("Adrian-Ken Rueegsegger <ken@codelabs.ch>");
+ MODULE_DESCRIPTION("RIPEMD-256 Message Digest");
++MODULE_ALIAS_CRYPTO("rmd256");
+diff --git a/crypto/rmd320.c b/crypto/rmd320.c
+index 09f97dfdfbba..770f2cb369f8 100644
+--- a/crypto/rmd320.c
++++ b/crypto/rmd320.c
+@@ -395,3 +395,4 @@ module_exit(rmd320_mod_fini);
+ MODULE_LICENSE("GPL");
+ MODULE_AUTHOR("Adrian-Ken Rueegsegger <ken@codelabs.ch>");
+ MODULE_DESCRIPTION("RIPEMD-320 Message Digest");
++MODULE_ALIAS_CRYPTO("rmd320");
+diff --git a/crypto/salsa20_generic.c b/crypto/salsa20_generic.c
+index 9a4770c02284..f550b5d94630 100644
+--- a/crypto/salsa20_generic.c
++++ b/crypto/salsa20_generic.c
+@@ -248,4 +248,5 @@ module_exit(salsa20_generic_mod_fini);
+
+ MODULE_LICENSE("GPL");
+ MODULE_DESCRIPTION ("Salsa20 stream cipher algorithm");
+-MODULE_ALIAS("salsa20");
++MODULE_ALIAS_CRYPTO("salsa20");
++MODULE_ALIAS_CRYPTO("salsa20-generic");
+diff --git a/crypto/seed.c b/crypto/seed.c
+index 9c904d6d2151..c6ba8438be43 100644
+--- a/crypto/seed.c
++++ b/crypto/seed.c
+@@ -476,3 +476,4 @@ module_exit(seed_fini);
+ MODULE_DESCRIPTION("SEED Cipher Algorithm");
+ MODULE_LICENSE("GPL");
+ MODULE_AUTHOR("Hye-Shik Chang <perky@FreeBSD.org>, Kim Hyun <hkim@kisa.or.kr>");
++MODULE_ALIAS_CRYPTO("seed");
+diff --git a/crypto/seqiv.c b/crypto/seqiv.c
+index ee190fcedcd2..9daa854cc485 100644
+--- a/crypto/seqiv.c
++++ b/crypto/seqiv.c
+@@ -362,3 +362,4 @@ module_exit(seqiv_module_exit);
+
+ MODULE_LICENSE("GPL");
+ MODULE_DESCRIPTION("Sequence Number IV Generator");
++MODULE_ALIAS_CRYPTO("seqiv");
+diff --git a/crypto/serpent_generic.c b/crypto/serpent_generic.c
+index 7ddbd7e88859..94970a794975 100644
+--- a/crypto/serpent_generic.c
++++ b/crypto/serpent_generic.c
+@@ -665,5 +665,6 @@ module_exit(serpent_mod_fini);
+ MODULE_LICENSE("GPL");
+ MODULE_DESCRIPTION("Serpent and tnepres (kerneli compatible serpent reversed) Cipher Algorithm");
+ MODULE_AUTHOR("Dag Arne Osvik <osvik@ii.uib.no>");
+-MODULE_ALIAS("tnepres");
+-MODULE_ALIAS("serpent");
++MODULE_ALIAS_CRYPTO("tnepres");
++MODULE_ALIAS_CRYPTO("serpent");
++MODULE_ALIAS_CRYPTO("serpent-generic");
+diff --git a/crypto/sha1_generic.c b/crypto/sha1_generic.c
+index 7bb047432782..a3e50c37eb6f 100644
+--- a/crypto/sha1_generic.c
++++ b/crypto/sha1_generic.c
+@@ -153,4 +153,5 @@ module_exit(sha1_generic_mod_fini);
+ MODULE_LICENSE("GPL");
+ MODULE_DESCRIPTION("SHA1 Secure Hash Algorithm");
+
+-MODULE_ALIAS("sha1");
++MODULE_ALIAS_CRYPTO("sha1");
++MODULE_ALIAS_CRYPTO("sha1-generic");
+diff --git a/crypto/sha256_generic.c b/crypto/sha256_generic.c
+index 65e7b76b057f..b001ff5c2efc 100644
+--- a/crypto/sha256_generic.c
++++ b/crypto/sha256_generic.c
+@@ -384,5 +384,7 @@ module_exit(sha256_generic_mod_fini);
+ MODULE_LICENSE("GPL");
+ MODULE_DESCRIPTION("SHA-224 and SHA-256 Secure Hash Algorithm");
+
+-MODULE_ALIAS("sha224");
+-MODULE_ALIAS("sha256");
++MODULE_ALIAS_CRYPTO("sha224");
++MODULE_ALIAS_CRYPTO("sha224-generic");
++MODULE_ALIAS_CRYPTO("sha256");
++MODULE_ALIAS_CRYPTO("sha256-generic");
+diff --git a/crypto/sha512_generic.c b/crypto/sha512_generic.c
+index 95db67197cd9..1c3c3767e079 100644
+--- a/crypto/sha512_generic.c
++++ b/crypto/sha512_generic.c
+@@ -288,5 +288,7 @@ module_exit(sha512_generic_mod_fini);
+ MODULE_LICENSE("GPL");
+ MODULE_DESCRIPTION("SHA-512 and SHA-384 Secure Hash Algorithms");
+
+-MODULE_ALIAS("sha384");
+-MODULE_ALIAS("sha512");
++MODULE_ALIAS_CRYPTO("sha384");
++MODULE_ALIAS_CRYPTO("sha384-generic");
++MODULE_ALIAS_CRYPTO("sha512");
++MODULE_ALIAS_CRYPTO("sha512-generic");
+diff --git a/crypto/tea.c b/crypto/tea.c
+index 0a572323ee4a..b70b441c7d1e 100644
+--- a/crypto/tea.c
++++ b/crypto/tea.c
+@@ -270,8 +270,9 @@ static void __exit tea_mod_fini(void)
+ crypto_unregister_algs(tea_algs, ARRAY_SIZE(tea_algs));
+ }
+
+-MODULE_ALIAS("xtea");
+-MODULE_ALIAS("xeta");
++MODULE_ALIAS_CRYPTO("tea");
++MODULE_ALIAS_CRYPTO("xtea");
++MODULE_ALIAS_CRYPTO("xeta");
+
+ module_init(tea_mod_init);
+ module_exit(tea_mod_fini);
+diff --git a/crypto/tgr192.c b/crypto/tgr192.c
+index 3c7af0d1ff7a..321bc6ff2a9d 100644
+--- a/crypto/tgr192.c
++++ b/crypto/tgr192.c
+@@ -676,8 +676,9 @@ static void __exit tgr192_mod_fini(void)
+ crypto_unregister_shashes(tgr_algs, ARRAY_SIZE(tgr_algs));
+ }
+
+-MODULE_ALIAS("tgr160");
+-MODULE_ALIAS("tgr128");
++MODULE_ALIAS_CRYPTO("tgr192");
++MODULE_ALIAS_CRYPTO("tgr160");
++MODULE_ALIAS_CRYPTO("tgr128");
+
+ module_init(tgr192_mod_init);
+ module_exit(tgr192_mod_fini);
+diff --git a/crypto/twofish_generic.c b/crypto/twofish_generic.c
+index 2d5000552d0f..ebf7a3efb572 100644
+--- a/crypto/twofish_generic.c
++++ b/crypto/twofish_generic.c
+@@ -211,4 +211,5 @@ module_exit(twofish_mod_fini);
+
+ MODULE_LICENSE("GPL");
+ MODULE_DESCRIPTION ("Twofish Cipher Algorithm");
+-MODULE_ALIAS("twofish");
++MODULE_ALIAS_CRYPTO("twofish");
++MODULE_ALIAS_CRYPTO("twofish-generic");
+diff --git a/crypto/vmac.c b/crypto/vmac.c
+index d84c24bd7ff7..df76a816cfb2 100644
+--- a/crypto/vmac.c
++++ b/crypto/vmac.c
+@@ -713,3 +713,4 @@ module_exit(vmac_module_exit);
+
+ MODULE_LICENSE("GPL");
+ MODULE_DESCRIPTION("VMAC hash algorithm");
++MODULE_ALIAS_CRYPTO("vmac");
+diff --git a/crypto/wp512.c b/crypto/wp512.c
+index ec64e7762fbb..7ee5a043a988 100644
+--- a/crypto/wp512.c
++++ b/crypto/wp512.c
+@@ -1167,8 +1167,9 @@ static void __exit wp512_mod_fini(void)
+ crypto_unregister_shashes(wp_algs, ARRAY_SIZE(wp_algs));
+ }
+
+-MODULE_ALIAS("wp384");
+-MODULE_ALIAS("wp256");
++MODULE_ALIAS_CRYPTO("wp512");
++MODULE_ALIAS_CRYPTO("wp384");
++MODULE_ALIAS_CRYPTO("wp256");
+
+ module_init(wp512_mod_init);
+ module_exit(wp512_mod_fini);
+diff --git a/crypto/xcbc.c b/crypto/xcbc.c
+index a5fbdf3738cf..df90b332554c 100644
+--- a/crypto/xcbc.c
++++ b/crypto/xcbc.c
+@@ -286,3 +286,4 @@ module_exit(crypto_xcbc_module_exit);
+
+ MODULE_LICENSE("GPL");
+ MODULE_DESCRIPTION("XCBC keyed hash algorithm");
++MODULE_ALIAS_CRYPTO("xcbc");
+diff --git a/crypto/xts.c b/crypto/xts.c
+index ca1608f44cb5..f6fd43f100c8 100644
+--- a/crypto/xts.c
++++ b/crypto/xts.c
+@@ -362,3 +362,4 @@ module_exit(crypto_module_exit);
+
+ MODULE_LICENSE("GPL");
+ MODULE_DESCRIPTION("XTS block cipher mode");
++MODULE_ALIAS_CRYPTO("xts");
+diff --git a/crypto/zlib.c b/crypto/zlib.c
+index c9ee681d57fd..0eefa9d237ac 100644
+--- a/crypto/zlib.c
++++ b/crypto/zlib.c
+@@ -378,3 +378,4 @@ module_exit(zlib_mod_fini);
+ MODULE_LICENSE("GPL");
+ MODULE_DESCRIPTION("Zlib Compression Algorithm");
+ MODULE_AUTHOR("Sony Corporation");
++MODULE_ALIAS_CRYPTO("zlib");
+diff --git a/drivers/acpi/device_pm.c b/drivers/acpi/device_pm.c
+index 93b71420a046..6341e668f362 100644
+--- a/drivers/acpi/device_pm.c
++++ b/drivers/acpi/device_pm.c
+@@ -680,13 +680,21 @@ static int acpi_device_wakeup(struct acpi_device *adev, u32 target_state,
+ if (error)
+ return error;
+
++ if (adev->wakeup.flags.enabled)
++ return 0;
++
+ res = acpi_enable_gpe(wakeup->gpe_device, wakeup->gpe_number);
+- if (ACPI_FAILURE(res)) {
++ if (ACPI_SUCCESS(res)) {
++ adev->wakeup.flags.enabled = 1;
++ } else {
+ acpi_disable_wakeup_device_power(adev);
+ return -EIO;
+ }
+ } else {
+- acpi_disable_gpe(wakeup->gpe_device, wakeup->gpe_number);
++ if (adev->wakeup.flags.enabled) {
++ acpi_disable_gpe(wakeup->gpe_device, wakeup->gpe_number);
++ adev->wakeup.flags.enabled = 0;
++ }
+ acpi_disable_wakeup_device_power(adev);
+ }
+ return 0;
+diff --git a/drivers/ata/ahci_xgene.c b/drivers/ata/ahci_xgene.c
+index 0f8538f238b6..0ffd3c930bed 100644
+--- a/drivers/ata/ahci_xgene.c
++++ b/drivers/ata/ahci_xgene.c
+@@ -188,7 +188,7 @@ static unsigned int xgene_ahci_read_id(struct ata_device *dev,
+ *
+ * Clear reserved bit 8 (DEVSLP bit) as we don't support DEVSLP
+ */
+- id[ATA_ID_FEATURE_SUPP] &= ~(1 << 8);
++ id[ATA_ID_FEATURE_SUPP] &= cpu_to_le16(~(1 << 8));
+
+ return 0;
+ }
+diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
+index c5ba15af87d3..485f7eab0d4b 100644
+--- a/drivers/ata/libata-core.c
++++ b/drivers/ata/libata-core.c
+@@ -4740,7 +4740,10 @@ static struct ata_queued_cmd *ata_qc_new(struct ata_port *ap)
+ return NULL;
+
+ for (i = 0, tag = ap->last_tag + 1; i < max_queue; i++, tag++) {
+- tag = tag < max_queue ? tag : 0;
++ if (ap->flags & ATA_FLAG_LOWTAG)
++ tag = i;
++ else
++ tag = tag < max_queue ? tag : 0;
+
+ /* the last tag is reserved for internal command. */
+ if (tag == ATA_TAG_INTERNAL)
+diff --git a/drivers/ata/libata-sff.c b/drivers/ata/libata-sff.c
+index db90aa35cb71..2e86e3b85266 100644
+--- a/drivers/ata/libata-sff.c
++++ b/drivers/ata/libata-sff.c
+@@ -1333,7 +1333,19 @@ void ata_sff_flush_pio_task(struct ata_port *ap)
+ DPRINTK("ENTER\n");
+
+ cancel_delayed_work_sync(&ap->sff_pio_task);
++
++ /*
++ * We wanna reset the HSM state to IDLE. If we do so without
++ * grabbing the port lock, critical sections protected by it which
++ * expect the HSM state to stay stable may get surprised. For
++ * example, we may set IDLE in between the time
++ * __ata_sff_port_intr() checks for HSM_ST_IDLE and before it calls
++ * ata_sff_hsm_move() causing ata_sff_hsm_move() to BUG().
++ */
++ spin_lock_irq(ap->lock);
+ ap->hsm_task_state = HSM_ST_IDLE;
++ spin_unlock_irq(ap->lock);
++
+ ap->sff_pio_task_link = NULL;
+
+ if (ata_msg_ctl(ap))
+diff --git a/drivers/ata/sata_dwc_460ex.c b/drivers/ata/sata_dwc_460ex.c
+index 0bb2cabd2197..4ebaa1e7b2d3 100644
+--- a/drivers/ata/sata_dwc_460ex.c
++++ b/drivers/ata/sata_dwc_460ex.c
+@@ -797,7 +797,7 @@ static int dma_dwc_init(struct sata_dwc_device *hsdev, int irq)
+ if (err) {
+ dev_err(host_pvt.dwc_dev, "%s: dma_request_interrupts returns"
+ " %d\n", __func__, err);
+- goto error_out;
++ return err;
+ }
+
+ /* Enabe DMA */
+@@ -808,11 +808,6 @@ static int dma_dwc_init(struct sata_dwc_device *hsdev, int irq)
+ sata_dma_regs);
+
+ return 0;
+-
+-error_out:
+- dma_dwc_exit(hsdev);
+-
+- return err;
+ }
+
+ static int sata_dwc_scr_read(struct ata_link *link, unsigned int scr, u32 *val)
+@@ -1662,7 +1657,7 @@ static int sata_dwc_probe(struct platform_device *ofdev)
+ char *ver = (char *)&versionr;
+ u8 *base = NULL;
+ int err = 0;
+- int irq, rc;
++ int irq;
+ struct ata_host *host;
+ struct ata_port_info pi = sata_dwc_port_info[0];
+ const struct ata_port_info *ppi[] = { &pi, NULL };
+@@ -1725,7 +1720,7 @@ static int sata_dwc_probe(struct platform_device *ofdev)
+ if (irq == NO_IRQ) {
+ dev_err(&ofdev->dev, "no SATA DMA irq\n");
+ err = -ENODEV;
+- goto error_out;
++ goto error_iomap;
+ }
+
+ /* Get physical SATA DMA register base address */
+@@ -1734,14 +1729,16 @@ static int sata_dwc_probe(struct platform_device *ofdev)
+ dev_err(&ofdev->dev, "ioremap failed for AHBDMA register"
+ " address\n");
+ err = -ENODEV;
+- goto error_out;
++ goto error_iomap;
+ }
+
+ /* Save dev for later use in dev_xxx() routines */
+ host_pvt.dwc_dev = &ofdev->dev;
+
+ /* Initialize AHB DMAC */
+- dma_dwc_init(hsdev, irq);
++ err = dma_dwc_init(hsdev, irq);
++ if (err)
++ goto error_dma_iomap;
+
+ /* Enable SATA Interrupts */
+ sata_dwc_enable_interrupts(hsdev);
+@@ -1759,9 +1756,8 @@ static int sata_dwc_probe(struct platform_device *ofdev)
+ * device discovery process, invoking our port_start() handler &
+ * error_handler() to execute a dummy Softreset EH session
+ */
+- rc = ata_host_activate(host, irq, sata_dwc_isr, 0, &sata_dwc_sht);
+-
+- if (rc != 0)
++ err = ata_host_activate(host, irq, sata_dwc_isr, 0, &sata_dwc_sht);
++ if (err)
+ dev_err(&ofdev->dev, "failed to activate host");
+
+ dev_set_drvdata(&ofdev->dev, host);
+@@ -1770,7 +1766,8 @@ static int sata_dwc_probe(struct platform_device *ofdev)
+ error_out:
+ /* Free SATA DMA resources */
+ dma_dwc_exit(hsdev);
+-
++error_dma_iomap:
++ iounmap((void __iomem *)host_pvt.sata_dma_regs);
+ error_iomap:
+ iounmap(base);
+ error_kmalloc:
+@@ -1791,6 +1788,7 @@ static int sata_dwc_remove(struct platform_device *ofdev)
+ /* Free SATA DMA resources */
+ dma_dwc_exit(hsdev);
+
++ iounmap((void __iomem *)host_pvt.sata_dma_regs);
+ iounmap(hsdev->reg_base);
+ kfree(hsdev);
+ kfree(host);
+diff --git a/drivers/ata/sata_sil24.c b/drivers/ata/sata_sil24.c
+index d81b20ddb527..ea655949023f 100644
+--- a/drivers/ata/sata_sil24.c
++++ b/drivers/ata/sata_sil24.c
+@@ -246,7 +246,7 @@ enum {
+ /* host flags */
+ SIL24_COMMON_FLAGS = ATA_FLAG_SATA | ATA_FLAG_PIO_DMA |
+ ATA_FLAG_NCQ | ATA_FLAG_ACPI_SATA |
+- ATA_FLAG_AN | ATA_FLAG_PMP,
++ ATA_FLAG_AN | ATA_FLAG_PMP | ATA_FLAG_LOWTAG,
+ SIL24_FLAG_PCIX_IRQ_WOC = (1 << 24), /* IRQ loss errata on PCI-X */
+
+ IRQ_STAT_4PORTS = 0xf,
+diff --git a/drivers/bus/mvebu-mbus.c b/drivers/bus/mvebu-mbus.c
+index 26c3779d871d..d29f5ffdb0f4 100644
+--- a/drivers/bus/mvebu-mbus.c
++++ b/drivers/bus/mvebu-mbus.c
+@@ -182,12 +182,25 @@ static void mvebu_mbus_disable_window(struct mvebu_mbus_state *mbus,
+ }
+
+ /* Checks whether the given window number is available */
++
++/* On Armada XP, 375 and 38x the MBus window 13 has the remap
++ * capability, like windows 0 to 7. However, the mvebu-mbus driver
++ * isn't currently taking into account this special case, which means
++ * that when window 13 is actually used, the remap registers are left
++ * to 0, making the device using this MBus window unavailable. The
++ * quick fix for stable is to not use window 13. A follow up patch
++ * will correctly handle this window.
++*/
+ static int mvebu_mbus_window_is_free(struct mvebu_mbus_state *mbus,
+ const int win)
+ {
+ void __iomem *addr = mbus->mbuswins_base +
+ mbus->soc->win_cfg_offset(win);
+ u32 ctrl = readl(addr + WIN_CTRL_OFF);
++
++ if (win == 13)
++ return false;
++
+ return !(ctrl & WIN_CTRL_ENABLE);
+ }
+
+diff --git a/drivers/clocksource/exynos_mct.c b/drivers/clocksource/exynos_mct.c
+index 9403061a2acc..83564c9cfdbe 100644
+--- a/drivers/clocksource/exynos_mct.c
++++ b/drivers/clocksource/exynos_mct.c
+@@ -97,8 +97,8 @@ static void exynos4_mct_write(unsigned int value, unsigned long offset)
+ writel_relaxed(value, reg_base + offset);
+
+ if (likely(offset >= EXYNOS4_MCT_L_BASE(0))) {
+- stat_addr = (offset & ~EXYNOS4_MCT_L_MASK) + MCT_L_WSTAT_OFFSET;
+- switch (offset & EXYNOS4_MCT_L_MASK) {
++ stat_addr = (offset & EXYNOS4_MCT_L_MASK) + MCT_L_WSTAT_OFFSET;
++ switch (offset & ~EXYNOS4_MCT_L_MASK) {
+ case MCT_L_TCON_OFFSET:
+ mask = 1 << 3; /* L_TCON write status */
+ break;
+diff --git a/drivers/crypto/padlock-aes.c b/drivers/crypto/padlock-aes.c
+index 633ba945e153..c178ed8c3908 100644
+--- a/drivers/crypto/padlock-aes.c
++++ b/drivers/crypto/padlock-aes.c
+@@ -563,4 +563,4 @@ MODULE_DESCRIPTION("VIA PadLock AES algorithm support");
+ MODULE_LICENSE("GPL");
+ MODULE_AUTHOR("Michal Ludvig");
+
+-MODULE_ALIAS("aes");
++MODULE_ALIAS_CRYPTO("aes");
+diff --git a/drivers/crypto/padlock-sha.c b/drivers/crypto/padlock-sha.c
+index bace885634f2..95f7d27ce491 100644
+--- a/drivers/crypto/padlock-sha.c
++++ b/drivers/crypto/padlock-sha.c
+@@ -593,7 +593,7 @@ MODULE_DESCRIPTION("VIA PadLock SHA1/SHA256 algorithms support.");
+ MODULE_LICENSE("GPL");
+ MODULE_AUTHOR("Michal Ludvig");
+
+-MODULE_ALIAS("sha1-all");
+-MODULE_ALIAS("sha256-all");
+-MODULE_ALIAS("sha1-padlock");
+-MODULE_ALIAS("sha256-padlock");
++MODULE_ALIAS_CRYPTO("sha1-all");
++MODULE_ALIAS_CRYPTO("sha256-all");
++MODULE_ALIAS_CRYPTO("sha1-padlock");
++MODULE_ALIAS_CRYPTO("sha256-padlock");
+diff --git a/drivers/crypto/qat/qat_common/adf_ctl_drv.c b/drivers/crypto/qat/qat_common/adf_ctl_drv.c
+index 244d73378f0e..7ee93f881db6 100644
+--- a/drivers/crypto/qat/qat_common/adf_ctl_drv.c
++++ b/drivers/crypto/qat/qat_common/adf_ctl_drv.c
+@@ -52,6 +52,7 @@
+ #include <linux/pci.h>
+ #include <linux/cdev.h>
+ #include <linux/uaccess.h>
++#include <linux/crypto.h>
+
+ #include "adf_accel_devices.h"
+ #include "adf_common_drv.h"
+@@ -487,4 +488,4 @@ module_exit(adf_unregister_ctl_device_driver);
+ MODULE_LICENSE("Dual BSD/GPL");
+ MODULE_AUTHOR("Intel");
+ MODULE_DESCRIPTION("Intel(R) QuickAssist Technology");
+-MODULE_ALIAS("intel_qat");
++MODULE_ALIAS_CRYPTO("intel_qat");
+diff --git a/drivers/crypto/ux500/cryp/cryp_core.c b/drivers/crypto/ux500/cryp/cryp_core.c
+index 92105f3dc8e0..e4cea7c45142 100644
+--- a/drivers/crypto/ux500/cryp/cryp_core.c
++++ b/drivers/crypto/ux500/cryp/cryp_core.c
+@@ -1810,7 +1810,7 @@ module_exit(ux500_cryp_mod_fini);
+ module_param(cryp_mode, int, 0);
+
+ MODULE_DESCRIPTION("Driver for ST-Ericsson UX500 CRYP crypto engine.");
+-MODULE_ALIAS("aes-all");
+-MODULE_ALIAS("des-all");
++MODULE_ALIAS_CRYPTO("aes-all");
++MODULE_ALIAS_CRYPTO("des-all");
+
+ MODULE_LICENSE("GPL");
+diff --git a/drivers/crypto/ux500/hash/hash_core.c b/drivers/crypto/ux500/hash/hash_core.c
+index 1c73f4fbc252..8e5e0187506f 100644
+--- a/drivers/crypto/ux500/hash/hash_core.c
++++ b/drivers/crypto/ux500/hash/hash_core.c
+@@ -1995,7 +1995,7 @@ module_exit(ux500_hash_mod_fini);
+ MODULE_DESCRIPTION("Driver for ST-Ericsson UX500 HASH engine.");
+ MODULE_LICENSE("GPL");
+
+-MODULE_ALIAS("sha1-all");
+-MODULE_ALIAS("sha256-all");
+-MODULE_ALIAS("hmac-sha1-all");
+-MODULE_ALIAS("hmac-sha256-all");
++MODULE_ALIAS_CRYPTO("sha1-all");
++MODULE_ALIAS_CRYPTO("sha256-all");
++MODULE_ALIAS_CRYPTO("hmac-sha1-all");
++MODULE_ALIAS_CRYPTO("hmac-sha256-all");
+diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
+index 2de5f5f4ba45..fd76933eed04 100644
+--- a/drivers/gpu/drm/i915/i915_gem.c
++++ b/drivers/gpu/drm/i915/i915_gem.c
+@@ -5144,7 +5144,7 @@ static bool mutex_is_locked_by(struct mutex *mutex, struct task_struct *task)
+ if (!mutex_is_locked(mutex))
+ return false;
+
+-#if defined(CONFIG_SMP) || defined(CONFIG_DEBUG_MUTEXES)
++#if defined(CONFIG_SMP) && !defined(CONFIG_DEBUG_MUTEXES)
+ return mutex->owner == task;
+ #else
+ /* Since UP may be pre-empted, we cannot assume that we own the lock */
+diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
+index cadc3bcf1de2..31b96643b59c 100644
+--- a/drivers/gpu/drm/i915/intel_display.c
++++ b/drivers/gpu/drm/i915/intel_display.c
+@@ -10019,7 +10019,7 @@ static int intel_crtc_page_flip(struct drm_crtc *crtc,
+ if (obj->tiling_mode != work->old_fb_obj->tiling_mode)
+ /* vlv: DISPLAY_FLIP fails to change tiling */
+ ring = NULL;
+- } else if (IS_IVYBRIDGE(dev)) {
++ } else if (IS_IVYBRIDGE(dev) || IS_HASWELL(dev)) {
+ ring = &dev_priv->ring[BCS];
+ } else if (INTEL_INFO(dev)->gen >= 7) {
+ ring = obj->ring;
+diff --git a/drivers/gpu/drm/radeon/radeon_asic.c b/drivers/gpu/drm/radeon/radeon_asic.c
+index 850de57069be..121aff6a3b41 100644
+--- a/drivers/gpu/drm/radeon/radeon_asic.c
++++ b/drivers/gpu/drm/radeon/radeon_asic.c
+@@ -333,6 +333,20 @@ static struct radeon_asic_ring r300_gfx_ring = {
+ .set_wptr = &r100_gfx_set_wptr,
+ };
+
++static struct radeon_asic_ring rv515_gfx_ring = {
++ .ib_execute = &r100_ring_ib_execute,
++ .emit_fence = &r300_fence_ring_emit,
++ .emit_semaphore = &r100_semaphore_ring_emit,
++ .cs_parse = &r300_cs_parse,
++ .ring_start = &rv515_ring_start,
++ .ring_test = &r100_ring_test,
++ .ib_test = &r100_ib_test,
++ .is_lockup = &r100_gpu_is_lockup,
++ .get_rptr = &r100_gfx_get_rptr,
++ .get_wptr = &r100_gfx_get_wptr,
++ .set_wptr = &r100_gfx_set_wptr,
++};
++
+ static struct radeon_asic r300_asic = {
+ .init = &r300_init,
+ .fini = &r300_fini,
+@@ -748,7 +762,7 @@ static struct radeon_asic rv515_asic = {
+ .set_page = &rv370_pcie_gart_set_page,
+ },
+ .ring = {
+- [RADEON_RING_TYPE_GFX_INDEX] = &r300_gfx_ring
++ [RADEON_RING_TYPE_GFX_INDEX] = &rv515_gfx_ring
+ },
+ .irq = {
+ .set = &rs600_irq_set,
+@@ -814,7 +828,7 @@ static struct radeon_asic r520_asic = {
+ .set_page = &rv370_pcie_gart_set_page,
+ },
+ .ring = {
+- [RADEON_RING_TYPE_GFX_INDEX] = &r300_gfx_ring
++ [RADEON_RING_TYPE_GFX_INDEX] = &rv515_gfx_ring
+ },
+ .irq = {
+ .set = &rs600_irq_set,
+diff --git a/drivers/gpu/drm/radeon/radeon_pm.c b/drivers/gpu/drm/radeon/radeon_pm.c
+index 32522cc940a1..f7da8fe96a66 100644
+--- a/drivers/gpu/drm/radeon/radeon_pm.c
++++ b/drivers/gpu/drm/radeon/radeon_pm.c
+@@ -1287,8 +1287,39 @@ dpm_failed:
+ return ret;
+ }
+
++struct radeon_dpm_quirk {
++ u32 chip_vendor;
++ u32 chip_device;
++ u32 subsys_vendor;
++ u32 subsys_device;
++};
++
++/* cards with dpm stability problems */
++static struct radeon_dpm_quirk radeon_dpm_quirk_list[] = {
++ /* TURKS - https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1386534 */
++ { PCI_VENDOR_ID_ATI, 0x6759, 0x1682, 0x3195 },
++ /* TURKS - https://bugzilla.kernel.org/show_bug.cgi?id=83731 */
++ { PCI_VENDOR_ID_ATI, 0x6840, 0x1179, 0xfb81 },
++ { 0, 0, 0, 0 },
++};
++
+ int radeon_pm_init(struct radeon_device *rdev)
+ {
++ struct radeon_dpm_quirk *p = radeon_dpm_quirk_list;
++ bool disable_dpm = false;
++
++ /* Apply dpm quirks */
++ while (p && p->chip_device != 0) {
++ if (rdev->pdev->vendor == p->chip_vendor &&
++ rdev->pdev->device == p->chip_device &&
++ rdev->pdev->subsystem_vendor == p->subsys_vendor &&
++ rdev->pdev->subsystem_device == p->subsys_device) {
++ disable_dpm = true;
++ break;
++ }
++ ++p;
++ }
++
+ /* enable dpm on rv6xx+ */
+ switch (rdev->family) {
+ case CHIP_RV610:
+@@ -1344,6 +1375,8 @@ int radeon_pm_init(struct radeon_device *rdev)
+ (!(rdev->flags & RADEON_IS_IGP)) &&
+ (!rdev->smc_fw))
+ rdev->pm.pm_method = PM_METHOD_PROFILE;
++ else if (disable_dpm && (radeon_dpm == -1))
++ rdev->pm.pm_method = PM_METHOD_PROFILE;
+ else if (radeon_dpm == 0)
+ rdev->pm.pm_method = PM_METHOD_PROFILE;
+ else
+diff --git a/drivers/gpu/drm/radeon/si_dpm.c b/drivers/gpu/drm/radeon/si_dpm.c
+index 676e6c2ba90a..2b70d3eca8fd 100644
+--- a/drivers/gpu/drm/radeon/si_dpm.c
++++ b/drivers/gpu/drm/radeon/si_dpm.c
+@@ -2908,6 +2908,22 @@ static int si_init_smc_spll_table(struct radeon_device *rdev)
+ return ret;
+ }
+
++struct si_dpm_quirk {
++ u32 chip_vendor;
++ u32 chip_device;
++ u32 subsys_vendor;
++ u32 subsys_device;
++ u32 max_sclk;
++ u32 max_mclk;
++};
++
++/* cards with dpm stability problems */
++static struct si_dpm_quirk si_dpm_quirk_list[] = {
++ /* PITCAIRN - https://bugs.freedesktop.org/show_bug.cgi?id=76490 */
++ { PCI_VENDOR_ID_ATI, 0x6810, 0x1462, 0x3036, 0, 120000 },
++ { 0, 0, 0, 0 },
++};
++
+ static void si_apply_state_adjust_rules(struct radeon_device *rdev,
+ struct radeon_ps *rps)
+ {
+@@ -2918,7 +2934,22 @@ static void si_apply_state_adjust_rules(struct radeon_device *rdev,
+ u32 mclk, sclk;
+ u16 vddc, vddci;
+ u32 max_sclk_vddc, max_mclk_vddci, max_mclk_vddc;
++ u32 max_sclk = 0, max_mclk = 0;
+ int i;
++ struct si_dpm_quirk *p = si_dpm_quirk_list;
++
++ /* Apply dpm quirks */
++ while (p && p->chip_device != 0) {
++ if (rdev->pdev->vendor == p->chip_vendor &&
++ rdev->pdev->device == p->chip_device &&
++ rdev->pdev->subsystem_vendor == p->subsys_vendor &&
++ rdev->pdev->subsystem_device == p->subsys_device) {
++ max_sclk = p->max_sclk;
++ max_mclk = p->max_mclk;
++ break;
++ }
++ ++p;
++ }
+
+ if ((rdev->pm.dpm.new_active_crtc_count > 1) ||
+ ni_dpm_vblank_too_short(rdev))
+@@ -2972,6 +3003,14 @@ static void si_apply_state_adjust_rules(struct radeon_device *rdev,
+ if (ps->performance_levels[i].mclk > max_mclk_vddc)
+ ps->performance_levels[i].mclk = max_mclk_vddc;
+ }
++ if (max_mclk) {
++ if (ps->performance_levels[i].mclk > max_mclk)
++ ps->performance_levels[i].mclk = max_mclk;
++ }
++ if (max_sclk) {
++ if (ps->performance_levels[i].sclk > max_sclk)
++ ps->performance_levels[i].sclk = max_sclk;
++ }
+ }
+
+ /* XXX validate the min clocks required for display */
+diff --git a/drivers/irqchip/irq-atmel-aic-common.c b/drivers/irqchip/irq-atmel-aic-common.c
+index cc4f9d80122e..fa22e5ba3d33 100644
+--- a/drivers/irqchip/irq-atmel-aic-common.c
++++ b/drivers/irqchip/irq-atmel-aic-common.c
+@@ -28,7 +28,7 @@
+ #define AT91_AIC_IRQ_MIN_PRIORITY 0
+ #define AT91_AIC_IRQ_MAX_PRIORITY 7
+
+-#define AT91_AIC_SRCTYPE GENMASK(7, 6)
++#define AT91_AIC_SRCTYPE GENMASK(6, 5)
+ #define AT91_AIC_SRCTYPE_LOW (0 << 5)
+ #define AT91_AIC_SRCTYPE_FALLING (1 << 5)
+ #define AT91_AIC_SRCTYPE_HIGH (2 << 5)
+@@ -74,7 +74,7 @@ int aic_common_set_type(struct irq_data *d, unsigned type, unsigned *val)
+ return -EINVAL;
+ }
+
+- *val &= AT91_AIC_SRCTYPE;
++ *val &= ~AT91_AIC_SRCTYPE;
+ *val |= aic_type;
+
+ return 0;
+diff --git a/drivers/irqchip/irq-omap-intc.c b/drivers/irqchip/irq-omap-intc.c
+index 28718d3e8281..c03f140acbae 100644
+--- a/drivers/irqchip/irq-omap-intc.c
++++ b/drivers/irqchip/irq-omap-intc.c
+@@ -263,7 +263,7 @@ static int __init omap_init_irq_of(struct device_node *node)
+ return ret;
+ }
+
+-static int __init omap_init_irq_legacy(u32 base)
++static int __init omap_init_irq_legacy(u32 base, struct device_node *node)
+ {
+ int j, irq_base;
+
+@@ -277,7 +277,7 @@ static int __init omap_init_irq_legacy(u32 base)
+ irq_base = 0;
+ }
+
+- domain = irq_domain_add_legacy(NULL, omap_nr_irqs, irq_base, 0,
++ domain = irq_domain_add_legacy(node, omap_nr_irqs, irq_base, 0,
+ &irq_domain_simple_ops, NULL);
+
+ omap_irq_soft_reset();
+@@ -301,10 +301,26 @@ static int __init omap_init_irq(u32 base, struct device_node *node)
+ {
+ int ret;
+
+- if (node)
++ /*
++ * FIXME legacy OMAP DMA driver sitting under arch/arm/plat-omap/dma.c
++ * depends is still not ready for linear IRQ domains; because of that
++ * we need to temporarily "blacklist" OMAP2 and OMAP3 devices from using
++ * linear IRQ Domain until that driver is finally fixed.
++ */
++ if (of_device_is_compatible(node, "ti,omap2-intc") ||
++ of_device_is_compatible(node, "ti,omap3-intc")) {
++ struct resource res;
++
++ if (of_address_to_resource(node, 0, &res))
++ return -ENOMEM;
++
++ base = res.start;
++ ret = omap_init_irq_legacy(base, node);
++ } else if (node) {
+ ret = omap_init_irq_of(node);
+- else
+- ret = omap_init_irq_legacy(base);
++ } else {
++ ret = omap_init_irq_legacy(base, NULL);
++ }
+
+ if (ret == 0)
+ omap_irq_enable_protection();
+diff --git a/drivers/md/dm-cache-metadata.c b/drivers/md/dm-cache-metadata.c
+index 06709257adde..97e3a6c07e31 100644
+--- a/drivers/md/dm-cache-metadata.c
++++ b/drivers/md/dm-cache-metadata.c
+@@ -94,6 +94,9 @@ struct cache_disk_superblock {
+ } __packed;
+
+ struct dm_cache_metadata {
++ atomic_t ref_count;
++ struct list_head list;
++
+ struct block_device *bdev;
+ struct dm_block_manager *bm;
+ struct dm_space_map *metadata_sm;
+@@ -669,10 +672,10 @@ static void unpack_value(__le64 value_le, dm_oblock_t *block, unsigned *flags)
+
+ /*----------------------------------------------------------------*/
+
+-struct dm_cache_metadata *dm_cache_metadata_open(struct block_device *bdev,
+- sector_t data_block_size,
+- bool may_format_device,
+- size_t policy_hint_size)
++static struct dm_cache_metadata *metadata_open(struct block_device *bdev,
++ sector_t data_block_size,
++ bool may_format_device,
++ size_t policy_hint_size)
+ {
+ int r;
+ struct dm_cache_metadata *cmd;
+@@ -683,6 +686,7 @@ struct dm_cache_metadata *dm_cache_metadata_open(struct block_device *bdev,
+ return NULL;
+ }
+
++ atomic_set(&cmd->ref_count, 1);
+ init_rwsem(&cmd->root_lock);
+ cmd->bdev = bdev;
+ cmd->data_block_size = data_block_size;
+@@ -705,10 +709,95 @@ struct dm_cache_metadata *dm_cache_metadata_open(struct block_device *bdev,
+ return cmd;
+ }
+
++/*
++ * We keep a little list of ref counted metadata objects to prevent two
++ * different target instances creating separate bufio instances. This is
++ * an issue if a table is reloaded before the suspend.
++ */
++static DEFINE_MUTEX(table_lock);
++static LIST_HEAD(table);
++
++static struct dm_cache_metadata *lookup(struct block_device *bdev)
++{
++ struct dm_cache_metadata *cmd;
++
++ list_for_each_entry(cmd, &table, list)
++ if (cmd->bdev == bdev) {
++ atomic_inc(&cmd->ref_count);
++ return cmd;
++ }
++
++ return NULL;
++}
++
++static struct dm_cache_metadata *lookup_or_open(struct block_device *bdev,
++ sector_t data_block_size,
++ bool may_format_device,
++ size_t policy_hint_size)
++{
++ struct dm_cache_metadata *cmd, *cmd2;
++
++ mutex_lock(&table_lock);
++ cmd = lookup(bdev);
++ mutex_unlock(&table_lock);
++
++ if (cmd)
++ return cmd;
++
++ cmd = metadata_open(bdev, data_block_size, may_format_device, policy_hint_size);
++ if (cmd) {
++ mutex_lock(&table_lock);
++ cmd2 = lookup(bdev);
++ if (cmd2) {
++ mutex_unlock(&table_lock);
++ __destroy_persistent_data_objects(cmd);
++ kfree(cmd);
++ return cmd2;
++ }
++ list_add(&cmd->list, &table);
++ mutex_unlock(&table_lock);
++ }
++
++ return cmd;
++}
++
++static bool same_params(struct dm_cache_metadata *cmd, sector_t data_block_size)
++{
++ if (cmd->data_block_size != data_block_size) {
++ DMERR("data_block_size (%llu) different from that in metadata (%llu)\n",
++ (unsigned long long) data_block_size,
++ (unsigned long long) cmd->data_block_size);
++ return false;
++ }
++
++ return true;
++}
++
++struct dm_cache_metadata *dm_cache_metadata_open(struct block_device *bdev,
++ sector_t data_block_size,
++ bool may_format_device,
++ size_t policy_hint_size)
++{
++ struct dm_cache_metadata *cmd = lookup_or_open(bdev, data_block_size,
++ may_format_device, policy_hint_size);
++ if (cmd && !same_params(cmd, data_block_size)) {
++ dm_cache_metadata_close(cmd);
++ return NULL;
++ }
++
++ return cmd;
++}
++
+ void dm_cache_metadata_close(struct dm_cache_metadata *cmd)
+ {
+- __destroy_persistent_data_objects(cmd);
+- kfree(cmd);
++ if (atomic_dec_and_test(&cmd->ref_count)) {
++ mutex_lock(&table_lock);
++ list_del(&cmd->list);
++ mutex_unlock(&table_lock);
++
++ __destroy_persistent_data_objects(cmd);
++ kfree(cmd);
++ }
+ }
+
+ /*
+diff --git a/drivers/md/dm-cache-target.c b/drivers/md/dm-cache-target.c
+index da496cfb458d..3baed67cf26f 100644
+--- a/drivers/md/dm-cache-target.c
++++ b/drivers/md/dm-cache-target.c
+@@ -222,7 +222,13 @@ struct cache {
+ struct list_head need_commit_migrations;
+ sector_t migration_threshold;
+ wait_queue_head_t migration_wait;
+- atomic_t nr_migrations;
++ atomic_t nr_allocated_migrations;
++
++ /*
++ * The number of in flight migrations that are performing
++ * background io. eg, promotion, writeback.
++ */
++ atomic_t nr_io_migrations;
+
+ wait_queue_head_t quiescing_wait;
+ atomic_t quiescing;
+@@ -258,7 +264,6 @@ struct cache {
+ struct dm_deferred_set *all_io_ds;
+
+ mempool_t *migration_pool;
+- struct dm_cache_migration *next_migration;
+
+ struct dm_cache_policy *policy;
+ unsigned policy_nr_args;
+@@ -349,10 +354,31 @@ static void free_prison_cell(struct cache *cache, struct dm_bio_prison_cell *cel
+ dm_bio_prison_free_cell(cache->prison, cell);
+ }
+
++static struct dm_cache_migration *alloc_migration(struct cache *cache)
++{
++ struct dm_cache_migration *mg;
++
++ mg = mempool_alloc(cache->migration_pool, GFP_NOWAIT);
++ if (mg) {
++ mg->cache = cache;
++ atomic_inc(&mg->cache->nr_allocated_migrations);
++ }
++
++ return mg;
++}
++
++static void free_migration(struct dm_cache_migration *mg)
++{
++ if (atomic_dec_and_test(&mg->cache->nr_allocated_migrations))
++ wake_up(&mg->cache->migration_wait);
++
++ mempool_free(mg, mg->cache->migration_pool);
++}
++
+ static int prealloc_data_structs(struct cache *cache, struct prealloc *p)
+ {
+ if (!p->mg) {
+- p->mg = mempool_alloc(cache->migration_pool, GFP_NOWAIT);
++ p->mg = alloc_migration(cache);
+ if (!p->mg)
+ return -ENOMEM;
+ }
+@@ -381,7 +407,7 @@ static void prealloc_free_structs(struct cache *cache, struct prealloc *p)
+ free_prison_cell(cache, p->cell1);
+
+ if (p->mg)
+- mempool_free(p->mg, cache->migration_pool);
++ free_migration(p->mg);
+ }
+
+ static struct dm_cache_migration *prealloc_get_migration(struct prealloc *p)
+@@ -817,24 +843,14 @@ static void remap_to_origin_then_cache(struct cache *cache, struct bio *bio,
+ * Migration covers moving data from the origin device to the cache, or
+ * vice versa.
+ *--------------------------------------------------------------*/
+-static void free_migration(struct dm_cache_migration *mg)
+-{
+- mempool_free(mg, mg->cache->migration_pool);
+-}
+-
+-static void inc_nr_migrations(struct cache *cache)
++static void inc_io_migrations(struct cache *cache)
+ {
+- atomic_inc(&cache->nr_migrations);
++ atomic_inc(&cache->nr_io_migrations);
+ }
+
+-static void dec_nr_migrations(struct cache *cache)
++static void dec_io_migrations(struct cache *cache)
+ {
+- atomic_dec(&cache->nr_migrations);
+-
+- /*
+- * Wake the worker in case we're suspending the target.
+- */
+- wake_up(&cache->migration_wait);
++ atomic_dec(&cache->nr_io_migrations);
+ }
+
+ static void __cell_defer(struct cache *cache, struct dm_bio_prison_cell *cell,
+@@ -857,11 +873,10 @@ static void cell_defer(struct cache *cache, struct dm_bio_prison_cell *cell,
+ wake_worker(cache);
+ }
+
+-static void cleanup_migration(struct dm_cache_migration *mg)
++static void free_io_migration(struct dm_cache_migration *mg)
+ {
+- struct cache *cache = mg->cache;
++ dec_io_migrations(mg->cache);
+ free_migration(mg);
+- dec_nr_migrations(cache);
+ }
+
+ static void migration_failure(struct dm_cache_migration *mg)
+@@ -886,7 +901,7 @@ static void migration_failure(struct dm_cache_migration *mg)
+ cell_defer(cache, mg->new_ocell, true);
+ }
+
+- cleanup_migration(mg);
++ free_io_migration(mg);
+ }
+
+ static void migration_success_pre_commit(struct dm_cache_migration *mg)
+@@ -897,7 +912,7 @@ static void migration_success_pre_commit(struct dm_cache_migration *mg)
+ if (mg->writeback) {
+ clear_dirty(cache, mg->old_oblock, mg->cblock);
+ cell_defer(cache, mg->old_ocell, false);
+- cleanup_migration(mg);
++ free_io_migration(mg);
+ return;
+
+ } else if (mg->demote) {
+@@ -907,14 +922,14 @@ static void migration_success_pre_commit(struct dm_cache_migration *mg)
+ mg->old_oblock);
+ if (mg->promote)
+ cell_defer(cache, mg->new_ocell, true);
+- cleanup_migration(mg);
++ free_io_migration(mg);
+ return;
+ }
+ } else {
+ if (dm_cache_insert_mapping(cache->cmd, mg->cblock, mg->new_oblock)) {
+ DMWARN_LIMIT("promotion failed; couldn't update on disk metadata");
+ policy_remove_mapping(cache->policy, mg->new_oblock);
+- cleanup_migration(mg);
++ free_io_migration(mg);
+ return;
+ }
+ }
+@@ -947,7 +962,7 @@ static void migration_success_post_commit(struct dm_cache_migration *mg)
+ } else {
+ if (mg->invalidate)
+ policy_remove_mapping(cache->policy, mg->old_oblock);
+- cleanup_migration(mg);
++ free_io_migration(mg);
+ }
+
+ } else {
+@@ -962,7 +977,7 @@ static void migration_success_post_commit(struct dm_cache_migration *mg)
+ bio_endio(mg->new_ocell->holder, 0);
+ cell_defer(cache, mg->new_ocell, false);
+ }
+- cleanup_migration(mg);
++ free_io_migration(mg);
+ }
+ }
+
+@@ -1178,7 +1193,7 @@ static void promote(struct cache *cache, struct prealloc *structs,
+ mg->new_ocell = cell;
+ mg->start_jiffies = jiffies;
+
+- inc_nr_migrations(cache);
++ inc_io_migrations(cache);
+ quiesce_migration(mg);
+ }
+
+@@ -1201,7 +1216,7 @@ static void writeback(struct cache *cache, struct prealloc *structs,
+ mg->new_ocell = NULL;
+ mg->start_jiffies = jiffies;
+
+- inc_nr_migrations(cache);
++ inc_io_migrations(cache);
+ quiesce_migration(mg);
+ }
+
+@@ -1227,7 +1242,7 @@ static void demote_then_promote(struct cache *cache, struct prealloc *structs,
+ mg->new_ocell = new_ocell;
+ mg->start_jiffies = jiffies;
+
+- inc_nr_migrations(cache);
++ inc_io_migrations(cache);
+ quiesce_migration(mg);
+ }
+
+@@ -1254,7 +1269,7 @@ static void invalidate(struct cache *cache, struct prealloc *structs,
+ mg->new_ocell = NULL;
+ mg->start_jiffies = jiffies;
+
+- inc_nr_migrations(cache);
++ inc_io_migrations(cache);
+ quiesce_migration(mg);
+ }
+
+@@ -1320,7 +1335,7 @@ static void process_discard_bio(struct cache *cache, struct bio *bio)
+
+ static bool spare_migration_bandwidth(struct cache *cache)
+ {
+- sector_t current_volume = (atomic_read(&cache->nr_migrations) + 1) *
++ sector_t current_volume = (atomic_read(&cache->nr_io_migrations) + 1) *
+ cache->sectors_per_block;
+ return current_volume < cache->migration_threshold;
+ }
+@@ -1670,7 +1685,7 @@ static void stop_quiescing(struct cache *cache)
+
+ static void wait_for_migrations(struct cache *cache)
+ {
+- wait_event(cache->migration_wait, !atomic_read(&cache->nr_migrations));
++ wait_event(cache->migration_wait, !atomic_read(&cache->nr_allocated_migrations));
+ }
+
+ static void stop_worker(struct cache *cache)
+@@ -1782,9 +1797,6 @@ static void destroy(struct cache *cache)
+ {
+ unsigned i;
+
+- if (cache->next_migration)
+- mempool_free(cache->next_migration, cache->migration_pool);
+-
+ if (cache->migration_pool)
+ mempool_destroy(cache->migration_pool);
+
+@@ -2292,7 +2304,8 @@ static int cache_create(struct cache_args *ca, struct cache **result)
+ INIT_LIST_HEAD(&cache->quiesced_migrations);
+ INIT_LIST_HEAD(&cache->completed_migrations);
+ INIT_LIST_HEAD(&cache->need_commit_migrations);
+- atomic_set(&cache->nr_migrations, 0);
++ atomic_set(&cache->nr_allocated_migrations, 0);
++ atomic_set(&cache->nr_io_migrations, 0);
+ init_waitqueue_head(&cache->migration_wait);
+
+ init_waitqueue_head(&cache->quiescing_wait);
+@@ -2351,8 +2364,6 @@ static int cache_create(struct cache_args *ca, struct cache **result)
+ goto bad;
+ }
+
+- cache->next_migration = NULL;
+-
+ cache->need_tick_bio = true;
+ cache->sized = false;
+ cache->invalidate = false;
+diff --git a/drivers/media/pci/cx23885/cx23885-cards.c b/drivers/media/pci/cx23885/cx23885-cards.c
+index 88c257d1161b..377818887ed2 100644
+--- a/drivers/media/pci/cx23885/cx23885-cards.c
++++ b/drivers/media/pci/cx23885/cx23885-cards.c
+@@ -614,7 +614,7 @@ struct cx23885_board cx23885_boards[] = {
+ .portb = CX23885_MPEG_DVB,
+ },
+ [CX23885_BOARD_HAUPPAUGE_HVR4400] = {
+- .name = "Hauppauge WinTV-HVR4400",
++ .name = "Hauppauge WinTV-HVR4400/HVR5500",
+ .porta = CX23885_ANALOG_VIDEO,
+ .portb = CX23885_MPEG_DVB,
+ .portc = CX23885_MPEG_DVB,
+@@ -622,6 +622,10 @@ struct cx23885_board cx23885_boards[] = {
+ .tuner_addr = 0x60, /* 0xc0 >> 1 */
+ .tuner_bus = 1,
+ },
++ [CX23885_BOARD_HAUPPAUGE_STARBURST] = {
++ .name = "Hauppauge WinTV Starburst",
++ .portb = CX23885_MPEG_DVB,
++ },
+ [CX23885_BOARD_AVERMEDIA_HC81R] = {
+ .name = "AVerTV Hybrid Express Slim HC81R",
+ .tuner_type = TUNER_XC2028,
+@@ -910,19 +914,19 @@ struct cx23885_subid cx23885_subids[] = {
+ }, {
+ .subvendor = 0x0070,
+ .subdevice = 0xc108,
+- .card = CX23885_BOARD_HAUPPAUGE_HVR4400,
++ .card = CX23885_BOARD_HAUPPAUGE_HVR4400, /* Hauppauge WinTV HVR-4400 (Model 121xxx, Hybrid DVB-T/S2, IR) */
+ }, {
+ .subvendor = 0x0070,
+ .subdevice = 0xc138,
+- .card = CX23885_BOARD_HAUPPAUGE_HVR4400,
++ .card = CX23885_BOARD_HAUPPAUGE_HVR4400, /* Hauppauge WinTV HVR-5500 (Model 121xxx, Hybrid DVB-T/C/S2, IR) */
+ }, {
+ .subvendor = 0x0070,
+ .subdevice = 0xc12a,
+- .card = CX23885_BOARD_HAUPPAUGE_HVR4400,
++ .card = CX23885_BOARD_HAUPPAUGE_STARBURST, /* Hauppauge WinTV Starburst (Model 121x00, DVB-S2, IR) */
+ }, {
+ .subvendor = 0x0070,
+ .subdevice = 0xc1f8,
+- .card = CX23885_BOARD_HAUPPAUGE_HVR4400,
++ .card = CX23885_BOARD_HAUPPAUGE_HVR4400, /* Hauppauge WinTV HVR-5500 (Model 121xxx, Hybrid DVB-T/C/S2, IR) */
+ }, {
+ .subvendor = 0x1461,
+ .subdevice = 0xd939,
+@@ -1495,8 +1499,9 @@ void cx23885_gpio_setup(struct cx23885_dev *dev)
+ cx_write(GPIO_ISM, 0x00000000);/* INTERRUPTS active low*/
+ break;
+ case CX23885_BOARD_HAUPPAUGE_HVR4400:
++ case CX23885_BOARD_HAUPPAUGE_STARBURST:
+ /* GPIO-8 tda10071 demod reset */
+- /* GPIO-9 si2165 demod reset */
++ /* GPIO-9 si2165 demod reset (only HVR4400/HVR5500)*/
+
+ /* Put the parts into reset and back */
+ cx23885_gpio_enable(dev, GPIO_8 | GPIO_9, 1);
+@@ -1760,6 +1765,7 @@ void cx23885_card_setup(struct cx23885_dev *dev)
+ case CX23885_BOARD_HAUPPAUGE_HVR1850:
+ case CX23885_BOARD_HAUPPAUGE_HVR1290:
+ case CX23885_BOARD_HAUPPAUGE_HVR4400:
++ case CX23885_BOARD_HAUPPAUGE_STARBURST:
+ case CX23885_BOARD_HAUPPAUGE_IMPACTVCBE:
+ if (dev->i2c_bus[0].i2c_rc == 0)
+ hauppauge_eeprom(dev, eeprom+0xc0);
+@@ -1864,6 +1870,11 @@ void cx23885_card_setup(struct cx23885_dev *dev)
+ ts2->ts_clk_en_val = 0x1; /* Enable TS_CLK */
+ ts2->src_sel_val = CX23885_SRC_SEL_PARALLEL_MPEG_VIDEO;
+ break;
++ case CX23885_BOARD_HAUPPAUGE_STARBURST:
++ ts1->gen_ctrl_val = 0xc; /* Serial bus + punctured clock */
++ ts1->ts_clk_en_val = 0x1; /* Enable TS_CLK */
++ ts1->src_sel_val = CX23885_SRC_SEL_PARALLEL_MPEG_VIDEO;
++ break;
+ case CX23885_BOARD_DVBSKY_T9580:
+ ts1->gen_ctrl_val = 0x5; /* Parallel */
+ ts1->ts_clk_en_val = 0x1; /* Enable TS_CLK */
+diff --git a/drivers/media/pci/cx23885/cx23885-dvb.c b/drivers/media/pci/cx23885/cx23885-dvb.c
+index 4cb90317ff45..a8d207929295 100644
+--- a/drivers/media/pci/cx23885/cx23885-dvb.c
++++ b/drivers/media/pci/cx23885/cx23885-dvb.c
+@@ -1586,6 +1586,17 @@ static int dvb_register(struct cx23885_tsport *port)
+ break;
+ }
+ break;
++ case CX23885_BOARD_HAUPPAUGE_STARBURST:
++ i2c_bus = &dev->i2c_bus[0];
++ fe0->dvb.frontend = dvb_attach(tda10071_attach,
++ &hauppauge_tda10071_config,
++ &i2c_bus->i2c_adap);
++ if (fe0->dvb.frontend != NULL) {
++ dvb_attach(a8293_attach, fe0->dvb.frontend,
++ &i2c_bus->i2c_adap,
++ &hauppauge_a8293_config);
++ }
++ break;
+ case CX23885_BOARD_DVBSKY_T9580:
+ i2c_bus = &dev->i2c_bus[0];
+ i2c_bus2 = &dev->i2c_bus[1];
+diff --git a/drivers/media/pci/cx23885/cx23885.h b/drivers/media/pci/cx23885/cx23885.h
+index 6c35e6115969..a33bead82ecc 100644
+--- a/drivers/media/pci/cx23885/cx23885.h
++++ b/drivers/media/pci/cx23885/cx23885.h
+@@ -93,6 +93,7 @@
+ #define CX23885_BOARD_HAUPPAUGE_IMPACTVCBE 43
+ #define CX23885_BOARD_DVICO_FUSIONHDTV_DVB_T_DUAL_EXP2 44
+ #define CX23885_BOARD_DVBSKY_T9580 45
++#define CX23885_BOARD_HAUPPAUGE_STARBURST 52
+
+ #define GPIO_0 0x00000001
+ #define GPIO_1 0x00000002
+diff --git a/drivers/media/v4l2-core/videobuf2-core.c b/drivers/media/v4l2-core/videobuf2-core.c
+index f2e43de3dd87..ea36447c74f9 100644
+--- a/drivers/media/v4l2-core/videobuf2-core.c
++++ b/drivers/media/v4l2-core/videobuf2-core.c
+@@ -3142,27 +3142,26 @@ static int vb2_thread(void *data)
+ prequeue--;
+ } else {
+ call_void_qop(q, wait_finish, q);
+- ret = vb2_internal_dqbuf(q, &fileio->b, 0);
++ if (!threadio->stop)
++ ret = vb2_internal_dqbuf(q, &fileio->b, 0);
+ call_void_qop(q, wait_prepare, q);
+ dprintk(5, "file io: vb2_dqbuf result: %d\n", ret);
+ }
+- if (threadio->stop)
+- break;
+- if (ret)
++ if (ret || threadio->stop)
+ break;
+ try_to_freeze();
+
+ vb = q->bufs[fileio->b.index];
+ if (!(fileio->b.flags & V4L2_BUF_FLAG_ERROR))
+- ret = threadio->fnc(vb, threadio->priv);
+- if (ret)
+- break;
++ if (threadio->fnc(vb, threadio->priv))
++ break;
+ call_void_qop(q, wait_finish, q);
+ if (set_timestamp)
+ v4l2_get_timestamp(&fileio->b.timestamp);
+- ret = vb2_internal_qbuf(q, &fileio->b);
++ if (!threadio->stop)
++ ret = vb2_internal_qbuf(q, &fileio->b);
+ call_void_qop(q, wait_prepare, q);
+- if (ret)
++ if (ret || threadio->stop)
+ break;
+ }
+
+@@ -3231,11 +3230,11 @@ int vb2_thread_stop(struct vb2_queue *q)
+ threadio->stop = true;
+ vb2_internal_streamoff(q, q->type);
+ call_void_qop(q, wait_prepare, q);
++ err = kthread_stop(threadio->thread);
+ q->fileio = NULL;
+ fileio->req.count = 0;
+ vb2_reqbufs(q, &fileio->req);
+ kfree(fileio);
+- err = kthread_stop(threadio->thread);
+ threadio->thread = NULL;
+ kfree(threadio);
+ q->fileio = NULL;
+diff --git a/drivers/mfd/rtsx_usb.c b/drivers/mfd/rtsx_usb.c
+index 9cf98d142d9a..c2474cf6bfef 100644
+--- a/drivers/mfd/rtsx_usb.c
++++ b/drivers/mfd/rtsx_usb.c
+@@ -681,21 +681,9 @@ static void rtsx_usb_disconnect(struct usb_interface *intf)
+ #ifdef CONFIG_PM
+ static int rtsx_usb_suspend(struct usb_interface *intf, pm_message_t message)
+ {
+- struct rtsx_ucr *ucr =
+- (struct rtsx_ucr *)usb_get_intfdata(intf);
+-
+ dev_dbg(&intf->dev, "%s called with pm message 0x%04x\n",
+ __func__, message.event);
+
+- /*
+- * Call to make sure LED is off during suspend to save more power.
+- * It is NOT a permanent state and could be turned on anytime later.
+- * Thus no need to call turn_on when resunming.
+- */
+- mutex_lock(&ucr->dev_mutex);
+- rtsx_usb_turn_off_led(ucr);
+- mutex_unlock(&ucr->dev_mutex);
+-
+ return 0;
+ }
+
+diff --git a/drivers/mfd/tps65218.c b/drivers/mfd/tps65218.c
+index 0d256cb002eb..d6b764349f9d 100644
+--- a/drivers/mfd/tps65218.c
++++ b/drivers/mfd/tps65218.c
+@@ -125,10 +125,21 @@ int tps65218_clear_bits(struct tps65218 *tps, unsigned int reg,
+ }
+ EXPORT_SYMBOL_GPL(tps65218_clear_bits);
+
++static const struct regmap_range tps65218_yes_ranges[] = {
++ regmap_reg_range(TPS65218_REG_INT1, TPS65218_REG_INT2),
++ regmap_reg_range(TPS65218_REG_STATUS, TPS65218_REG_STATUS),
++};
++
++static const struct regmap_access_table tps65218_volatile_table = {
++ .yes_ranges = tps65218_yes_ranges,
++ .n_yes_ranges = ARRAY_SIZE(tps65218_yes_ranges),
++};
++
+ static struct regmap_config tps65218_regmap_config = {
+ .reg_bits = 8,
+ .val_bits = 8,
+ .cache_type = REGCACHE_RBTREE,
++ .volatile_table = &tps65218_volatile_table,
+ };
+
+ static const struct regmap_irq tps65218_irqs[] = {
+@@ -193,6 +204,7 @@ static struct regmap_irq_chip tps65218_irq_chip = {
+
+ .num_regs = 2,
+ .mask_base = TPS65218_REG_INT_MASK1,
++ .status_base = TPS65218_REG_INT1,
+ };
+
+ static const struct of_device_id of_tps65218_match_table[] = {
+diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c
+index 2cfe5012e4e5..4b008c9c738d 100644
+--- a/drivers/net/can/dev.c
++++ b/drivers/net/can/dev.c
+@@ -729,10 +729,14 @@ static int can_changelink(struct net_device *dev,
+ if (dev->flags & IFF_UP)
+ return -EBUSY;
+ cm = nla_data(data[IFLA_CAN_CTRLMODE]);
+- if (cm->flags & ~priv->ctrlmode_supported)
++
++ /* check whether changed bits are allowed to be modified */
++ if (cm->mask & ~priv->ctrlmode_supported)
+ return -EOPNOTSUPP;
++
++ /* clear bits to be modified and copy the flag values */
+ priv->ctrlmode &= ~cm->mask;
+- priv->ctrlmode |= cm->flags;
++ priv->ctrlmode |= (cm->flags & cm->mask);
+
+ /* CAN_CTRLMODE_FD can only be set when driver supports FD */
+ if (priv->ctrlmode & CAN_CTRLMODE_FD)
+diff --git a/drivers/net/can/m_can/m_can.c b/drivers/net/can/m_can/m_can.c
+index d7bc462aafdc..244529881be9 100644
+--- a/drivers/net/can/m_can/m_can.c
++++ b/drivers/net/can/m_can/m_can.c
+@@ -955,6 +955,11 @@ static struct net_device *alloc_m_can_dev(void)
+ priv->can.data_bittiming_const = &m_can_data_bittiming_const;
+ priv->can.do_set_mode = m_can_set_mode;
+ priv->can.do_get_berr_counter = m_can_get_berr_counter;
++
++ /* CAN_CTRLMODE_FD_NON_ISO is fixed with M_CAN IP v3.0.1 */
++ priv->can.ctrlmode = CAN_CTRLMODE_FD_NON_ISO;
++
++ /* CAN_CTRLMODE_FD_NON_ISO can not be changed with M_CAN IP v3.0.1 */
+ priv->can.ctrlmode_supported = CAN_CTRLMODE_LOOPBACK |
+ CAN_CTRLMODE_LISTENONLY |
+ CAN_CTRLMODE_BERR_REPORTING |
+diff --git a/drivers/net/wireless/iwlwifi/mvm/fw-api-scan.h b/drivers/net/wireless/iwlwifi/mvm/fw-api-scan.h
+index 1354c68f6468..be0527734170 100644
+--- a/drivers/net/wireless/iwlwifi/mvm/fw-api-scan.h
++++ b/drivers/net/wireless/iwlwifi/mvm/fw-api-scan.h
+@@ -672,6 +672,7 @@ struct iwl_scan_channel_opt {
+ * @IWL_MVM_LMAC_SCAN_FLAG_FRAGMENTED: all passive scans will be fragmented
+ * @IWL_MVM_LMAC_SCAN_FLAGS_RRM_ENABLED: insert WFA vendor-specific TPC report
+ * and DS parameter set IEs into probe requests.
++ * @IWL_MVM_LMAC_SCAN_FLAG_MATCH: Send match found notification on matches
+ */
+ enum iwl_mvm_lmac_scan_flags {
+ IWL_MVM_LMAC_SCAN_FLAG_PASS_ALL = BIT(0),
+@@ -681,6 +682,7 @@ enum iwl_mvm_lmac_scan_flags {
+ IWL_MVM_LMAC_SCAN_FLAG_MULTIPLE_SSIDS = BIT(4),
+ IWL_MVM_LMAC_SCAN_FLAG_FRAGMENTED = BIT(5),
+ IWL_MVM_LMAC_SCAN_FLAGS_RRM_ENABLED = BIT(6),
++ IWL_MVM_LMAC_SCAN_FLAG_MATCH = BIT(9),
+ };
+
+ enum iwl_scan_priority {
+diff --git a/drivers/net/wireless/iwlwifi/mvm/scan.c b/drivers/net/wireless/iwlwifi/mvm/scan.c
+index 7554f7053830..886b64710443 100644
+--- a/drivers/net/wireless/iwlwifi/mvm/scan.c
++++ b/drivers/net/wireless/iwlwifi/mvm/scan.c
+@@ -1334,6 +1334,7 @@ int iwl_mvm_unified_sched_scan_lmac(struct iwl_mvm *mvm,
+ IWL_DEBUG_SCAN(mvm,
+ "Sending scheduled scan with filtering, n_match_sets %d\n",
+ req->n_match_sets);
++ flags |= IWL_MVM_LMAC_SCAN_FLAG_MATCH;
+ } else {
+ IWL_DEBUG_SCAN(mvm,
+ "Sending Scheduled scan without filtering\n");
+diff --git a/drivers/pci/bus.c b/drivers/pci/bus.c
+index 73aef51a28f0..8fb16188cd82 100644
+--- a/drivers/pci/bus.c
++++ b/drivers/pci/bus.c
+@@ -228,6 +228,49 @@ int pci_bus_alloc_resource(struct pci_bus *bus, struct resource *res,
+ }
+ EXPORT_SYMBOL(pci_bus_alloc_resource);
+
++/*
++ * The @idx resource of @dev should be a PCI-PCI bridge window. If this
++ * resource fits inside a window of an upstream bridge, do nothing. If it
++ * overlaps an upstream window but extends outside it, clip the resource so
++ * it fits completely inside.
++ */
++bool pci_bus_clip_resource(struct pci_dev *dev, int idx)
++{
++ struct pci_bus *bus = dev->bus;
++ struct resource *res = &dev->resource[idx];
++ struct resource orig_res = *res;
++ struct resource *r;
++ int i;
++
++ pci_bus_for_each_resource(bus, r, i) {
++ resource_size_t start, end;
++
++ if (!r)
++ continue;
++
++ if (resource_type(res) != resource_type(r))
++ continue;
++
++ start = max(r->start, res->start);
++ end = min(r->end, res->end);
++
++ if (start > end)
++ continue; /* no overlap */
++
++ if (res->start == start && res->end == end)
++ return false; /* no change */
++
++ res->start = start;
++ res->end = end;
++ dev_printk(KERN_DEBUG, &dev->dev, "%pR clipped to %pR\n",
++ &orig_res, res);
++
++ return true;
++ }
++
++ return false;
++}
++
+ void __weak pcibios_resource_survey_bus(struct pci_bus *bus) { }
+
+ /**
+diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
+index 625a4ace10b4..0190d1ee36b7 100644
+--- a/drivers/pci/pci.c
++++ b/drivers/pci/pci.c
+@@ -3280,7 +3280,8 @@ static int pci_parent_bus_reset(struct pci_dev *dev, int probe)
+ {
+ struct pci_dev *pdev;
+
+- if (pci_is_root_bus(dev->bus) || dev->subordinate || !dev->bus->self)
++ if (pci_is_root_bus(dev->bus) || dev->subordinate ||
++ !dev->bus->self || dev->dev_flags & PCI_DEV_FLAGS_NO_BUS_RESET)
+ return -ENOTTY;
+
+ list_for_each_entry(pdev, &dev->bus->devices, bus_list)
+@@ -3314,7 +3315,8 @@ static int pci_dev_reset_slot_function(struct pci_dev *dev, int probe)
+ {
+ struct pci_dev *pdev;
+
+- if (dev->subordinate || !dev->slot)
++ if (dev->subordinate || !dev->slot ||
++ dev->dev_flags & PCI_DEV_FLAGS_NO_BUS_RESET)
+ return -ENOTTY;
+
+ list_for_each_entry(pdev, &dev->bus->devices, bus_list)
+@@ -3566,6 +3568,20 @@ int pci_try_reset_function(struct pci_dev *dev)
+ }
+ EXPORT_SYMBOL_GPL(pci_try_reset_function);
+
++/* Do any devices on or below this bus prevent a bus reset? */
++static bool pci_bus_resetable(struct pci_bus *bus)
++{
++ struct pci_dev *dev;
++
++ list_for_each_entry(dev, &bus->devices, bus_list) {
++ if (dev->dev_flags & PCI_DEV_FLAGS_NO_BUS_RESET ||
++ (dev->subordinate && !pci_bus_resetable(dev->subordinate)))
++ return false;
++ }
++
++ return true;
++}
++
+ /* Lock devices from the top of the tree down */
+ static void pci_bus_lock(struct pci_bus *bus)
+ {
+@@ -3616,6 +3632,22 @@ unlock:
+ return 0;
+ }
+
++/* Do any devices on or below this slot prevent a bus reset? */
++static bool pci_slot_resetable(struct pci_slot *slot)
++{
++ struct pci_dev *dev;
++
++ list_for_each_entry(dev, &slot->bus->devices, bus_list) {
++ if (!dev->slot || dev->slot != slot)
++ continue;
++ if (dev->dev_flags & PCI_DEV_FLAGS_NO_BUS_RESET ||
++ (dev->subordinate && !pci_bus_resetable(dev->subordinate)))
++ return false;
++ }
++
++ return true;
++}
++
+ /* Lock devices from the top of the tree down */
+ static void pci_slot_lock(struct pci_slot *slot)
+ {
+@@ -3737,7 +3769,7 @@ static int pci_slot_reset(struct pci_slot *slot, int probe)
+ {
+ int rc;
+
+- if (!slot)
++ if (!slot || !pci_slot_resetable(slot))
+ return -ENOTTY;
+
+ if (!probe)
+@@ -3829,7 +3861,7 @@ EXPORT_SYMBOL_GPL(pci_try_reset_slot);
+
+ static int pci_bus_reset(struct pci_bus *bus, int probe)
+ {
+- if (!bus->self)
++ if (!bus->self || !pci_bus_resetable(bus))
+ return -ENOTTY;
+
+ if (probe)
+diff --git a/drivers/pci/pci.h b/drivers/pci/pci.h
+index 4a3902d8e6fe..b5defca86795 100644
+--- a/drivers/pci/pci.h
++++ b/drivers/pci/pci.h
+@@ -208,6 +208,7 @@ void __pci_bus_size_bridges(struct pci_bus *bus,
+ void __pci_bus_assign_resources(const struct pci_bus *bus,
+ struct list_head *realloc_head,
+ struct list_head *fail_head);
++bool pci_bus_clip_resource(struct pci_dev *dev, int idx);
+
+ /**
+ * pci_ari_enabled - query ARI forwarding status
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index 90acb32c85b1..b72e2cdfd59a 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -3008,6 +3008,20 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_REALTEK, 0x8169,
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MELLANOX, PCI_ANY_ID,
+ quirk_broken_intx_masking);
+
++static void quirk_no_bus_reset(struct pci_dev *dev)
++{
++ dev->dev_flags |= PCI_DEV_FLAGS_NO_BUS_RESET;
++}
++
++/*
++ * Atheros AR93xx chips do not behave after a bus reset. The device will
++ * throw a Link Down error on AER-capable systems and regardless of AER,
++ * config space of the device is never accessible again and typically
++ * causes the system to hang or reset when access is attempted.
++ * http://www.spinics.net/lists/linux-pci/msg34797.html
++ */
++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATHEROS, 0x0030, quirk_no_bus_reset);
++
+ #ifdef CONFIG_ACPI
+ /*
+ * Apple: Shutdown Cactus Ridge Thunderbolt controller.
+diff --git a/drivers/pci/setup-bus.c b/drivers/pci/setup-bus.c
+index 0482235eee92..e3e17f3c0f0f 100644
+--- a/drivers/pci/setup-bus.c
++++ b/drivers/pci/setup-bus.c
+@@ -530,9 +530,8 @@ EXPORT_SYMBOL(pci_setup_cardbus);
+ config space writes, so it's quite possible that an I/O window of
+ the bridge will have some undesirable address (e.g. 0) after the
+ first write. Ditto 64-bit prefetchable MMIO. */
+-static void pci_setup_bridge_io(struct pci_bus *bus)
++static void pci_setup_bridge_io(struct pci_dev *bridge)
+ {
+- struct pci_dev *bridge = bus->self;
+ struct resource *res;
+ struct pci_bus_region region;
+ unsigned long io_mask;
+@@ -545,7 +544,7 @@ static void pci_setup_bridge_io(struct pci_bus *bus)
+ io_mask = PCI_IO_1K_RANGE_MASK;
+
+ /* Set up the top and bottom of the PCI I/O segment for this bus. */
+- res = bus->resource[0];
++ res = &bridge->resource[PCI_BRIDGE_RESOURCES + 0];
+ pcibios_resource_to_bus(bridge->bus, ®ion, res);
+ if (res->flags & IORESOURCE_IO) {
+ pci_read_config_word(bridge, PCI_IO_BASE, &l);
+@@ -568,15 +567,14 @@ static void pci_setup_bridge_io(struct pci_bus *bus)
+ pci_write_config_dword(bridge, PCI_IO_BASE_UPPER16, io_upper16);
+ }
+
+-static void pci_setup_bridge_mmio(struct pci_bus *bus)
++static void pci_setup_bridge_mmio(struct pci_dev *bridge)
+ {
+- struct pci_dev *bridge = bus->self;
+ struct resource *res;
+ struct pci_bus_region region;
+ u32 l;
+
+ /* Set up the top and bottom of the PCI Memory segment for this bus. */
+- res = bus->resource[1];
++ res = &bridge->resource[PCI_BRIDGE_RESOURCES + 1];
+ pcibios_resource_to_bus(bridge->bus, ®ion, res);
+ if (res->flags & IORESOURCE_MEM) {
+ l = (region.start >> 16) & 0xfff0;
+@@ -588,9 +586,8 @@ static void pci_setup_bridge_mmio(struct pci_bus *bus)
+ pci_write_config_dword(bridge, PCI_MEMORY_BASE, l);
+ }
+
+-static void pci_setup_bridge_mmio_pref(struct pci_bus *bus)
++static void pci_setup_bridge_mmio_pref(struct pci_dev *bridge)
+ {
+- struct pci_dev *bridge = bus->self;
+ struct resource *res;
+ struct pci_bus_region region;
+ u32 l, bu, lu;
+@@ -602,7 +599,7 @@ static void pci_setup_bridge_mmio_pref(struct pci_bus *bus)
+
+ /* Set up PREF base/limit. */
+ bu = lu = 0;
+- res = bus->resource[2];
++ res = &bridge->resource[PCI_BRIDGE_RESOURCES + 2];
+ pcibios_resource_to_bus(bridge->bus, ®ion, res);
+ if (res->flags & IORESOURCE_PREFETCH) {
+ l = (region.start >> 16) & 0xfff0;
+@@ -630,13 +627,13 @@ static void __pci_setup_bridge(struct pci_bus *bus, unsigned long type)
+ &bus->busn_res);
+
+ if (type & IORESOURCE_IO)
+- pci_setup_bridge_io(bus);
++ pci_setup_bridge_io(bridge);
+
+ if (type & IORESOURCE_MEM)
+- pci_setup_bridge_mmio(bus);
++ pci_setup_bridge_mmio(bridge);
+
+ if (type & IORESOURCE_PREFETCH)
+- pci_setup_bridge_mmio_pref(bus);
++ pci_setup_bridge_mmio_pref(bridge);
+
+ pci_write_config_word(bridge, PCI_BRIDGE_CONTROL, bus->bridge_ctl);
+ }
+@@ -649,6 +646,41 @@ void pci_setup_bridge(struct pci_bus *bus)
+ __pci_setup_bridge(bus, type);
+ }
+
++
++int pci_claim_bridge_resource(struct pci_dev *bridge, int i)
++{
++ if (i < PCI_BRIDGE_RESOURCES || i > PCI_BRIDGE_RESOURCE_END)
++ return 0;
++
++ if (pci_claim_resource(bridge, i) == 0)
++ return 0; /* claimed the window */
++
++ if ((bridge->class >> 8) != PCI_CLASS_BRIDGE_PCI)
++ return 0;
++
++ if (!pci_bus_clip_resource(bridge, i))
++ return -EINVAL; /* clipping didn't change anything */
++
++ switch (i - PCI_BRIDGE_RESOURCES) {
++ case 0:
++ pci_setup_bridge_io(bridge);
++ break;
++ case 1:
++ pci_setup_bridge_mmio(bridge);
++ break;
++ case 2:
++ pci_setup_bridge_mmio_pref(bridge);
++ break;
++ default:
++ return -EINVAL;
++ }
++
++ if (pci_claim_resource(bridge, i) == 0)
++ return 0; /* claimed a smaller window */
++
++ return -EINVAL;
++}
++
+ /* Check whether the bridge supports optional I/O and
+ prefetchable memory ranges. If not, the respective
+ base/limit registers must be read-only and read as 0. */
+diff --git a/drivers/pinctrl/core.c b/drivers/pinctrl/core.c
+index e4f65510c87e..89dca77ca038 100644
+--- a/drivers/pinctrl/core.c
++++ b/drivers/pinctrl/core.c
+@@ -1801,14 +1801,15 @@ void pinctrl_unregister(struct pinctrl_dev *pctldev)
+ if (pctldev == NULL)
+ return;
+
+- mutex_lock(&pinctrldev_list_mutex);
+ mutex_lock(&pctldev->mutex);
+-
+ pinctrl_remove_device_debugfs(pctldev);
++ mutex_unlock(&pctldev->mutex);
+
+ if (!IS_ERR(pctldev->p))
+ pinctrl_put(pctldev->p);
+
++ mutex_lock(&pinctrldev_list_mutex);
++ mutex_lock(&pctldev->mutex);
+ /* TODO: check that no pinmuxes are still active? */
+ list_del(&pctldev->node);
+ /* Destroy descriptor tree */
+diff --git a/drivers/pinctrl/qcom/pinctrl-msm.c b/drivers/pinctrl/qcom/pinctrl-msm.c
+index e730935fa457..ed7017df065d 100644
+--- a/drivers/pinctrl/qcom/pinctrl-msm.c
++++ b/drivers/pinctrl/qcom/pinctrl-msm.c
+@@ -865,10 +865,10 @@ static int msm_ps_hold_restart(struct notifier_block *nb, unsigned long action,
+
+ static void msm_pinctrl_setup_pm_reset(struct msm_pinctrl *pctrl)
+ {
+- int i = 0;
++ int i;
+ const struct msm_function *func = pctrl->soc->functions;
+
+- for (; i <= pctrl->soc->nfunctions; i++)
++ for (i = 0; i < pctrl->soc->nfunctions; i++)
+ if (!strcmp(func[i].name, "ps_hold")) {
+ pctrl->restart_nb.notifier_call = msm_ps_hold_restart;
+ pctrl->restart_nb.priority = 128;
+diff --git a/drivers/s390/crypto/ap_bus.c b/drivers/s390/crypto/ap_bus.c
+index 99485415dcc2..91e97ec01418 100644
+--- a/drivers/s390/crypto/ap_bus.c
++++ b/drivers/s390/crypto/ap_bus.c
+@@ -44,6 +44,7 @@
+ #include <linux/hrtimer.h>
+ #include <linux/ktime.h>
+ #include <asm/facility.h>
++#include <linux/crypto.h>
+
+ #include "ap_bus.h"
+
+@@ -71,7 +72,7 @@ MODULE_AUTHOR("IBM Corporation");
+ MODULE_DESCRIPTION("Adjunct Processor Bus driver, " \
+ "Copyright IBM Corp. 2006, 2012");
+ MODULE_LICENSE("GPL");
+-MODULE_ALIAS("z90crypt");
++MODULE_ALIAS_CRYPTO("z90crypt");
+
+ /*
+ * Module parameter
+diff --git a/drivers/scsi/ipr.c b/drivers/scsi/ipr.c
+index 2a9578c116b7..c3bdca7bf1e9 100644
+--- a/drivers/scsi/ipr.c
++++ b/drivers/scsi/ipr.c
+@@ -683,6 +683,7 @@ static void ipr_init_ipr_cmnd(struct ipr_cmnd *ipr_cmd,
+ ipr_reinit_ipr_cmnd(ipr_cmd);
+ ipr_cmd->u.scratch = 0;
+ ipr_cmd->sibling = NULL;
++ ipr_cmd->eh_comp = NULL;
+ ipr_cmd->fast_done = fast_done;
+ init_timer(&ipr_cmd->timer);
+ }
+@@ -848,6 +849,8 @@ static void ipr_scsi_eh_done(struct ipr_cmnd *ipr_cmd)
+
+ scsi_dma_unmap(ipr_cmd->scsi_cmd);
+ scsi_cmd->scsi_done(scsi_cmd);
++ if (ipr_cmd->eh_comp)
++ complete(ipr_cmd->eh_comp);
+ list_add_tail(&ipr_cmd->queue, &ipr_cmd->hrrq->hrrq_free_q);
+ }
+
+@@ -4853,6 +4856,84 @@ static int ipr_slave_alloc(struct scsi_device *sdev)
+ return rc;
+ }
+
++/**
++ * ipr_match_lun - Match function for specified LUN
++ * @ipr_cmd: ipr command struct
++ * @device: device to match (sdev)
++ *
++ * Returns:
++ * 1 if command matches sdev / 0 if command does not match sdev
++ **/
++static int ipr_match_lun(struct ipr_cmnd *ipr_cmd, void *device)
++{
++ if (ipr_cmd->scsi_cmd && ipr_cmd->scsi_cmd->device == device)
++ return 1;
++ return 0;
++}
++
++/**
++ * ipr_wait_for_ops - Wait for matching commands to complete
++ * @ipr_cmd: ipr command struct
++ * @device: device to match (sdev)
++ * @match: match function to use
++ *
++ * Returns:
++ * SUCCESS / FAILED
++ **/
++static int ipr_wait_for_ops(struct ipr_ioa_cfg *ioa_cfg, void *device,
++ int (*match)(struct ipr_cmnd *, void *))
++{
++ struct ipr_cmnd *ipr_cmd;
++ int wait;
++ unsigned long flags;
++ struct ipr_hrr_queue *hrrq;
++ signed long timeout = IPR_ABORT_TASK_TIMEOUT;
++ DECLARE_COMPLETION_ONSTACK(comp);
++
++ ENTER;
++ do {
++ wait = 0;
++
++ for_each_hrrq(hrrq, ioa_cfg) {
++ spin_lock_irqsave(hrrq->lock, flags);
++ list_for_each_entry(ipr_cmd, &hrrq->hrrq_pending_q, queue) {
++ if (match(ipr_cmd, device)) {
++ ipr_cmd->eh_comp = ∁
++ wait++;
++ }
++ }
++ spin_unlock_irqrestore(hrrq->lock, flags);
++ }
++
++ if (wait) {
++ timeout = wait_for_completion_timeout(&comp, timeout);
++
++ if (!timeout) {
++ wait = 0;
++
++ for_each_hrrq(hrrq, ioa_cfg) {
++ spin_lock_irqsave(hrrq->lock, flags);
++ list_for_each_entry(ipr_cmd, &hrrq->hrrq_pending_q, queue) {
++ if (match(ipr_cmd, device)) {
++ ipr_cmd->eh_comp = NULL;
++ wait++;
++ }
++ }
++ spin_unlock_irqrestore(hrrq->lock, flags);
++ }
++
++ if (wait)
++ dev_err(&ioa_cfg->pdev->dev, "Timed out waiting for aborted commands\n");
++ LEAVE;
++ return wait ? FAILED : SUCCESS;
++ }
++ }
++ } while (wait);
++
++ LEAVE;
++ return SUCCESS;
++}
++
+ static int ipr_eh_host_reset(struct scsi_cmnd *cmd)
+ {
+ struct ipr_ioa_cfg *ioa_cfg;
+@@ -5072,11 +5153,17 @@ static int __ipr_eh_dev_reset(struct scsi_cmnd *scsi_cmd)
+ static int ipr_eh_dev_reset(struct scsi_cmnd *cmd)
+ {
+ int rc;
++ struct ipr_ioa_cfg *ioa_cfg;
++
++ ioa_cfg = (struct ipr_ioa_cfg *) cmd->device->host->hostdata;
+
+ spin_lock_irq(cmd->device->host->host_lock);
+ rc = __ipr_eh_dev_reset(cmd);
+ spin_unlock_irq(cmd->device->host->host_lock);
+
++ if (rc == SUCCESS)
++ rc = ipr_wait_for_ops(ioa_cfg, cmd->device, ipr_match_lun);
++
+ return rc;
+ }
+
+@@ -5254,13 +5341,18 @@ static int ipr_eh_abort(struct scsi_cmnd *scsi_cmd)
+ {
+ unsigned long flags;
+ int rc;
++ struct ipr_ioa_cfg *ioa_cfg;
+
+ ENTER;
+
++ ioa_cfg = (struct ipr_ioa_cfg *) scsi_cmd->device->host->hostdata;
++
+ spin_lock_irqsave(scsi_cmd->device->host->host_lock, flags);
+ rc = ipr_cancel_op(scsi_cmd);
+ spin_unlock_irqrestore(scsi_cmd->device->host->host_lock, flags);
+
++ if (rc == SUCCESS)
++ rc = ipr_wait_for_ops(ioa_cfg, scsi_cmd->device, ipr_match_lun);
+ LEAVE;
+ return rc;
+ }
+diff --git a/drivers/scsi/ipr.h b/drivers/scsi/ipr.h
+index d0201ceb4aac..fa82c003bc32 100644
+--- a/drivers/scsi/ipr.h
++++ b/drivers/scsi/ipr.h
+@@ -1608,6 +1608,7 @@ struct ipr_cmnd {
+ struct scsi_device *sdev;
+ } u;
+
++ struct completion *eh_comp;
+ struct ipr_hrr_queue *hrrq;
+ struct ipr_ioa_cfg *ioa_cfg;
+ };
+diff --git a/drivers/xen/swiotlb-xen.c b/drivers/xen/swiotlb-xen.c
+index 9df5d6ec7eec..f3a9d831d0f9 100644
+--- a/drivers/xen/swiotlb-xen.c
++++ b/drivers/xen/swiotlb-xen.c
+@@ -449,7 +449,7 @@ static void xen_unmap_single(struct device *hwdev, dma_addr_t dev_addr,
+
+ /* NOTE: We use dev_addr here, not paddr! */
+ if (is_xen_swiotlb_buffer(dev_addr)) {
+- swiotlb_tbl_unmap_single(hwdev, dev_addr, size, dir);
++ swiotlb_tbl_unmap_single(hwdev, paddr, size, dir);
+ return;
+ }
+
+diff --git a/fs/cifs/ioctl.c b/fs/cifs/ioctl.c
+index 45cb59bcc791..8b7898b7670f 100644
+--- a/fs/cifs/ioctl.c
++++ b/fs/cifs/ioctl.c
+@@ -86,21 +86,16 @@ static long cifs_ioctl_clone(unsigned int xid, struct file *dst_file,
+ }
+
+ src_inode = file_inode(src_file.file);
++ rc = -EINVAL;
++ if (S_ISDIR(src_inode->i_mode))
++ goto out_fput;
+
+ /*
+ * Note: cifs case is easier than btrfs since server responsible for
+ * checks for proper open modes and file type and if it wants
+ * server could even support copy of range where source = target
+ */
+-
+- /* so we do not deadlock racing two ioctls on same files */
+- if (target_inode < src_inode) {
+- mutex_lock_nested(&target_inode->i_mutex, I_MUTEX_PARENT);
+- mutex_lock_nested(&src_inode->i_mutex, I_MUTEX_CHILD);
+- } else {
+- mutex_lock_nested(&src_inode->i_mutex, I_MUTEX_PARENT);
+- mutex_lock_nested(&target_inode->i_mutex, I_MUTEX_CHILD);
+- }
++ lock_two_nondirectories(target_inode, src_inode);
+
+ /* determine range to clone */
+ rc = -EINVAL;
+@@ -124,13 +119,7 @@ static long cifs_ioctl_clone(unsigned int xid, struct file *dst_file,
+ out_unlock:
+ /* although unlocking in the reverse order from locking is not
+ strictly necessary here it is a little cleaner to be consistent */
+- if (target_inode < src_inode) {
+- mutex_unlock(&src_inode->i_mutex);
+- mutex_unlock(&target_inode->i_mutex);
+- } else {
+- mutex_unlock(&target_inode->i_mutex);
+- mutex_unlock(&src_inode->i_mutex);
+- }
++ unlock_two_nondirectories(src_inode, target_inode);
+ out_fput:
+ fdput(src_file);
+ out_drop_write:
+diff --git a/include/acpi/acpi_bus.h b/include/acpi/acpi_bus.h
+index f34a0835aa4f..8de31d472fad 100644
+--- a/include/acpi/acpi_bus.h
++++ b/include/acpi/acpi_bus.h
+@@ -312,6 +312,7 @@ struct acpi_device_wakeup_flags {
+ u8 valid:1; /* Can successfully enable wakeup? */
+ u8 run_wake:1; /* Run-Wake GPE devices */
+ u8 notifier_present:1; /* Wake-up notify handler has been installed */
++ u8 enabled:1; /* Enabled for wakeup */
+ };
+
+ struct acpi_device_wakeup_context {
+diff --git a/include/linux/crypto.h b/include/linux/crypto.h
+index d45e949699ea..dc34dfc766b5 100644
+--- a/include/linux/crypto.h
++++ b/include/linux/crypto.h
+@@ -26,6 +26,19 @@
+ #include <linux/uaccess.h>
+
+ /*
++ * Autoloaded crypto modules should only use a prefixed name to avoid allowing
++ * arbitrary modules to be loaded. Loading from userspace may still need the
++ * unprefixed names, so retains those aliases as well.
++ * This uses __MODULE_INFO directly instead of MODULE_ALIAS because pre-4.3
++ * gcc (e.g. avr32 toolchain) uses __LINE__ for uniqueness, and this macro
++ * expands twice on the same line. Instead, use a separate base name for the
++ * alias.
++ */
++#define MODULE_ALIAS_CRYPTO(name) \
++ __MODULE_INFO(alias, alias_userspace, name); \
++ __MODULE_INFO(alias, alias_crypto, "crypto-" name)
++
++/*
+ * Algorithm masks and types.
+ */
+ #define CRYPTO_ALG_TYPE_MASK 0x0000000f
+diff --git a/include/linux/libata.h b/include/linux/libata.h
+index bd5fefeaf548..fe0bf8dc83bb 100644
+--- a/include/linux/libata.h
++++ b/include/linux/libata.h
+@@ -230,6 +230,7 @@ enum {
+ ATA_FLAG_SW_ACTIVITY = (1 << 22), /* driver supports sw activity
+ * led */
+ ATA_FLAG_NO_DIPM = (1 << 23), /* host not happy with DIPM */
++ ATA_FLAG_LOWTAG = (1 << 24), /* host wants lowest available tag */
+
+ /* bits 24:31 of ap->flags are reserved for LLD specific flags */
+
+diff --git a/include/linux/pagemap.h b/include/linux/pagemap.h
+index 7ea069cd3257..4b3736f7065c 100644
+--- a/include/linux/pagemap.h
++++ b/include/linux/pagemap.h
+@@ -251,7 +251,7 @@ pgoff_t page_cache_prev_hole(struct address_space *mapping,
+ #define FGP_NOWAIT 0x00000020
+
+ struct page *pagecache_get_page(struct address_space *mapping, pgoff_t offset,
+- int fgp_flags, gfp_t cache_gfp_mask, gfp_t radix_gfp_mask);
++ int fgp_flags, gfp_t cache_gfp_mask);
+
+ /**
+ * find_get_page - find and get a page reference
+@@ -266,13 +266,13 @@ struct page *pagecache_get_page(struct address_space *mapping, pgoff_t offset,
+ static inline struct page *find_get_page(struct address_space *mapping,
+ pgoff_t offset)
+ {
+- return pagecache_get_page(mapping, offset, 0, 0, 0);
++ return pagecache_get_page(mapping, offset, 0, 0);
+ }
+
+ static inline struct page *find_get_page_flags(struct address_space *mapping,
+ pgoff_t offset, int fgp_flags)
+ {
+- return pagecache_get_page(mapping, offset, fgp_flags, 0, 0);
++ return pagecache_get_page(mapping, offset, fgp_flags, 0);
+ }
+
+ /**
+@@ -292,7 +292,7 @@ static inline struct page *find_get_page_flags(struct address_space *mapping,
+ static inline struct page *find_lock_page(struct address_space *mapping,
+ pgoff_t offset)
+ {
+- return pagecache_get_page(mapping, offset, FGP_LOCK, 0, 0);
++ return pagecache_get_page(mapping, offset, FGP_LOCK, 0);
+ }
+
+ /**
+@@ -319,7 +319,7 @@ static inline struct page *find_or_create_page(struct address_space *mapping,
+ {
+ return pagecache_get_page(mapping, offset,
+ FGP_LOCK|FGP_ACCESSED|FGP_CREAT,
+- gfp_mask, gfp_mask & GFP_RECLAIM_MASK);
++ gfp_mask);
+ }
+
+ /**
+@@ -340,8 +340,7 @@ static inline struct page *grab_cache_page_nowait(struct address_space *mapping,
+ {
+ return pagecache_get_page(mapping, index,
+ FGP_LOCK|FGP_CREAT|FGP_NOFS|FGP_NOWAIT,
+- mapping_gfp_mask(mapping),
+- GFP_NOFS);
++ mapping_gfp_mask(mapping));
+ }
+
+ struct page *find_get_entry(struct address_space *mapping, pgoff_t offset);
+diff --git a/include/linux/pci.h b/include/linux/pci.h
+index 4c8ac5fcc224..2882c13c6391 100644
+--- a/include/linux/pci.h
++++ b/include/linux/pci.h
+@@ -175,6 +175,8 @@ enum pci_dev_flags {
+ PCI_DEV_FLAGS_DMA_ALIAS_DEVFN = (__force pci_dev_flags_t) (1 << 4),
+ /* Use a PCIe-to-PCI bridge alias even if !pci_is_pcie */
+ PCI_DEV_FLAG_PCIE_BRIDGE_ALIAS = (__force pci_dev_flags_t) (1 << 5),
++ /* Do not use bus resets for device */
++ PCI_DEV_FLAGS_NO_BUS_RESET = (__force pci_dev_flags_t) (1 << 6),
+ };
+
+ enum pci_irq_reroute_variant {
+@@ -1062,6 +1064,7 @@ resource_size_t pcibios_retrieve_fw_addr(struct pci_dev *dev, int idx);
+ void pci_bus_assign_resources(const struct pci_bus *bus);
+ void pci_bus_size_bridges(struct pci_bus *bus);
+ int pci_claim_resource(struct pci_dev *, int);
++int pci_claim_bridge_resource(struct pci_dev *bridge, int i);
+ void pci_assign_unassigned_resources(void);
+ void pci_assign_unassigned_bridge_resources(struct pci_dev *bridge);
+ void pci_assign_unassigned_bus_resources(struct pci_bus *bus);
+diff --git a/include/linux/time.h b/include/linux/time.h
+index 8c42cf8d2444..5989b0ead1ec 100644
+--- a/include/linux/time.h
++++ b/include/linux/time.h
+@@ -99,6 +99,19 @@ static inline bool timespec_valid_strict(const struct timespec *ts)
+ return true;
+ }
+
++static inline bool timeval_valid(const struct timeval *tv)
++{
++ /* Dates before 1970 are bogus */
++ if (tv->tv_sec < 0)
++ return false;
++
++ /* Can't have more microseconds then a second */
++ if (tv->tv_usec < 0 || tv->tv_usec >= USEC_PER_SEC)
++ return false;
++
++ return true;
++}
++
+ extern struct timespec timespec_trunc(struct timespec t, unsigned gran);
+
+ #define CURRENT_TIME (current_kernel_time())
+diff --git a/include/uapi/linux/can/netlink.h b/include/uapi/linux/can/netlink.h
+index 3e4323a3918d..94ffe0c83ce7 100644
+--- a/include/uapi/linux/can/netlink.h
++++ b/include/uapi/linux/can/netlink.h
+@@ -98,6 +98,7 @@ struct can_ctrlmode {
+ #define CAN_CTRLMODE_BERR_REPORTING 0x10 /* Bus-error reporting */
+ #define CAN_CTRLMODE_FD 0x20 /* CAN FD mode */
+ #define CAN_CTRLMODE_PRESUME_ACK 0x40 /* Ignore missing CAN ACKs */
++#define CAN_CTRLMODE_FD_NON_ISO 0x80 /* CAN FD in non-ISO mode */
+
+ /*
+ * CAN device statistics
+diff --git a/kernel/time/ntp.c b/kernel/time/ntp.c
+index 87a346fd6d61..28bf91c60a0b 100644
+--- a/kernel/time/ntp.c
++++ b/kernel/time/ntp.c
+@@ -633,6 +633,13 @@ int ntp_validate_timex(struct timex *txc)
+ if ((txc->modes & ADJ_SETOFFSET) && (!capable(CAP_SYS_TIME)))
+ return -EPERM;
+
++ if (txc->modes & ADJ_FREQUENCY) {
++ if (LONG_MIN / PPM_SCALE > txc->freq)
++ return -EINVAL;
++ if (LONG_MAX / PPM_SCALE < txc->freq)
++ return -EINVAL;
++ }
++
+ return 0;
+ }
+
+diff --git a/kernel/time/time.c b/kernel/time/time.c
+index a9ae20fb0b11..22d5d3b73970 100644
+--- a/kernel/time/time.c
++++ b/kernel/time/time.c
+@@ -196,6 +196,10 @@ SYSCALL_DEFINE2(settimeofday, struct timeval __user *, tv,
+ if (tv) {
+ if (copy_from_user(&user_tv, tv, sizeof(*tv)))
+ return -EFAULT;
++
++ if (!timeval_valid(&user_tv))
++ return -EINVAL;
++
+ new_ts.tv_sec = user_tv.tv_sec;
+ new_ts.tv_nsec = user_tv.tv_usec * NSEC_PER_USEC;
+ }
+diff --git a/kernel/workqueue.c b/kernel/workqueue.c
+index 09b685daee3d..66940a53d128 100644
+--- a/kernel/workqueue.c
++++ b/kernel/workqueue.c
+@@ -1841,17 +1841,11 @@ static void pool_mayday_timeout(unsigned long __pool)
+ * spin_lock_irq(pool->lock) which may be released and regrabbed
+ * multiple times. Does GFP_KERNEL allocations. Called only from
+ * manager.
+- *
+- * Return:
+- * %false if no action was taken and pool->lock stayed locked, %true
+- * otherwise.
+ */
+-static bool maybe_create_worker(struct worker_pool *pool)
++static void maybe_create_worker(struct worker_pool *pool)
+ __releases(&pool->lock)
+ __acquires(&pool->lock)
+ {
+- if (!need_to_create_worker(pool))
+- return false;
+ restart:
+ spin_unlock_irq(&pool->lock);
+
+@@ -1877,7 +1871,6 @@ restart:
+ */
+ if (need_to_create_worker(pool))
+ goto restart;
+- return true;
+ }
+
+ /**
+@@ -1897,16 +1890,14 @@ restart:
+ * multiple times. Does GFP_KERNEL allocations.
+ *
+ * Return:
+- * %false if the pool don't need management and the caller can safely start
+- * processing works, %true indicates that the function released pool->lock
+- * and reacquired it to perform some management function and that the
+- * conditions that the caller verified while holding the lock before
+- * calling the function might no longer be true.
++ * %false if the pool doesn't need management and the caller can safely
++ * start processing works, %true if management function was performed and
++ * the conditions that the caller verified before calling the function may
++ * no longer be true.
+ */
+ static bool manage_workers(struct worker *worker)
+ {
+ struct worker_pool *pool = worker->pool;
+- bool ret = false;
+
+ /*
+ * Anyone who successfully grabs manager_arb wins the arbitration
+@@ -1919,12 +1910,12 @@ static bool manage_workers(struct worker *worker)
+ * actual management, the pool may stall indefinitely.
+ */
+ if (!mutex_trylock(&pool->manager_arb))
+- return ret;
++ return false;
+
+- ret |= maybe_create_worker(pool);
++ maybe_create_worker(pool);
+
+ mutex_unlock(&pool->manager_arb);
+- return ret;
++ return true;
+ }
+
+ /**
+diff --git a/mm/filemap.c b/mm/filemap.c
+index 14b4642279f1..37beab98b416 100644
+--- a/mm/filemap.c
++++ b/mm/filemap.c
+@@ -1046,8 +1046,7 @@ EXPORT_SYMBOL(find_lock_entry);
+ * @mapping: the address_space to search
+ * @offset: the page index
+ * @fgp_flags: PCG flags
+- * @cache_gfp_mask: gfp mask to use for the page cache data page allocation
+- * @radix_gfp_mask: gfp mask to use for radix tree node allocation
++ * @gfp_mask: gfp mask to use for the page cache data page allocation
+ *
+ * Looks up the page cache slot at @mapping & @offset.
+ *
+@@ -1056,11 +1055,9 @@ EXPORT_SYMBOL(find_lock_entry);
+ * FGP_ACCESSED: the page will be marked accessed
+ * FGP_LOCK: Page is return locked
+ * FGP_CREAT: If page is not present then a new page is allocated using
+- * @cache_gfp_mask and added to the page cache and the VM's LRU
+- * list. If radix tree nodes are allocated during page cache
+- * insertion then @radix_gfp_mask is used. The page is returned
+- * locked and with an increased refcount. Otherwise, %NULL is
+- * returned.
++ * @gfp_mask and added to the page cache and the VM's LRU
++ * list. The page is returned locked and with an increased
++ * refcount. Otherwise, %NULL is returned.
+ *
+ * If FGP_LOCK or FGP_CREAT are specified then the function may sleep even
+ * if the GFP flags specified for FGP_CREAT are atomic.
+@@ -1068,7 +1065,7 @@ EXPORT_SYMBOL(find_lock_entry);
+ * If there is a page cache page, it is returned with an increased refcount.
+ */
+ struct page *pagecache_get_page(struct address_space *mapping, pgoff_t offset,
+- int fgp_flags, gfp_t cache_gfp_mask, gfp_t radix_gfp_mask)
++ int fgp_flags, gfp_t gfp_mask)
+ {
+ struct page *page;
+
+@@ -1105,13 +1102,11 @@ no_page:
+ if (!page && (fgp_flags & FGP_CREAT)) {
+ int err;
+ if ((fgp_flags & FGP_WRITE) && mapping_cap_account_dirty(mapping))
+- cache_gfp_mask |= __GFP_WRITE;
+- if (fgp_flags & FGP_NOFS) {
+- cache_gfp_mask &= ~__GFP_FS;
+- radix_gfp_mask &= ~__GFP_FS;
+- }
++ gfp_mask |= __GFP_WRITE;
++ if (fgp_flags & FGP_NOFS)
++ gfp_mask &= ~__GFP_FS;
+
+- page = __page_cache_alloc(cache_gfp_mask);
++ page = __page_cache_alloc(gfp_mask);
+ if (!page)
+ return NULL;
+
+@@ -1122,7 +1117,8 @@ no_page:
+ if (fgp_flags & FGP_ACCESSED)
+ __SetPageReferenced(page);
+
+- err = add_to_page_cache_lru(page, mapping, offset, radix_gfp_mask);
++ err = add_to_page_cache_lru(page, mapping, offset,
++ gfp_mask & GFP_RECLAIM_MASK);
+ if (unlikely(err)) {
+ page_cache_release(page);
+ page = NULL;
+@@ -2443,8 +2439,7 @@ struct page *grab_cache_page_write_begin(struct address_space *mapping,
+ fgp_flags |= FGP_NOFS;
+
+ page = pagecache_get_page(mapping, index, fgp_flags,
+- mapping_gfp_mask(mapping),
+- GFP_KERNEL);
++ mapping_gfp_mask(mapping));
+ if (page)
+ wait_for_stable_page(page);
+
+diff --git a/net/netfilter/ipvs/ip_vs_ftp.c b/net/netfilter/ipvs/ip_vs_ftp.c
+index 1d5341f3761d..5d3daae98bf0 100644
+--- a/net/netfilter/ipvs/ip_vs_ftp.c
++++ b/net/netfilter/ipvs/ip_vs_ftp.c
+@@ -183,6 +183,8 @@ static int ip_vs_ftp_out(struct ip_vs_app *app, struct ip_vs_conn *cp,
+ struct nf_conn *ct;
+ struct net *net;
+
++ *diff = 0;
++
+ #ifdef CONFIG_IP_VS_IPV6
+ /* This application helper doesn't work with IPv6 yet,
+ * so turn this into a no-op for IPv6 packets
+@@ -191,8 +193,6 @@ static int ip_vs_ftp_out(struct ip_vs_app *app, struct ip_vs_conn *cp,
+ return 1;
+ #endif
+
+- *diff = 0;
+-
+ /* Only useful for established sessions */
+ if (cp->state != IP_VS_TCP_S_ESTABLISHED)
+ return 1;
+@@ -322,6 +322,9 @@ static int ip_vs_ftp_in(struct ip_vs_app *app, struct ip_vs_conn *cp,
+ struct ip_vs_conn *n_cp;
+ struct net *net;
+
++ /* no diff required for incoming packets */
++ *diff = 0;
++
+ #ifdef CONFIG_IP_VS_IPV6
+ /* This application helper doesn't work with IPv6 yet,
+ * so turn this into a no-op for IPv6 packets
+@@ -330,9 +333,6 @@ static int ip_vs_ftp_in(struct ip_vs_app *app, struct ip_vs_conn *cp,
+ return 1;
+ #endif
+
+- /* no diff required for incoming packets */
+- *diff = 0;
+-
+ /* Only useful for established sessions */
+ if (cp->state != IP_VS_TCP_S_ESTABLISHED)
+ return 1;
+diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
+index 5016a6929085..c5880124ec0d 100644
+--- a/net/netfilter/nf_conntrack_core.c
++++ b/net/netfilter/nf_conntrack_core.c
+@@ -611,16 +611,15 @@ __nf_conntrack_confirm(struct sk_buff *skb)
+ */
+ NF_CT_ASSERT(!nf_ct_is_confirmed(ct));
+ pr_debug("Confirming conntrack %p\n", ct);
+- /* We have to check the DYING flag inside the lock to prevent
+- a race against nf_ct_get_next_corpse() possibly called from
+- user context, else we insert an already 'dead' hash, blocking
+- further use of that particular connection -JM */
++ /* We have to check the DYING flag after unlink to prevent
++ * a race against nf_ct_get_next_corpse() possibly called from
++ * user context, else we insert an already 'dead' hash, blocking
++ * further use of that particular connection -JM.
++ */
++ nf_ct_del_from_dying_or_unconfirmed_list(ct);
+
+- if (unlikely(nf_ct_is_dying(ct))) {
+- nf_conntrack_double_unlock(hash, reply_hash);
+- local_bh_enable();
+- return NF_ACCEPT;
+- }
++ if (unlikely(nf_ct_is_dying(ct)))
++ goto out;
+
+ /* See if there's one in the list already, including reverse:
+ NAT could have grabbed it without realizing, since we're
+@@ -636,8 +635,6 @@ __nf_conntrack_confirm(struct sk_buff *skb)
+ zone == nf_ct_zone(nf_ct_tuplehash_to_ctrack(h)))
+ goto out;
+
+- nf_ct_del_from_dying_or_unconfirmed_list(ct);
+-
+ /* Timer relative to confirmation time, not original
+ setting time, otherwise we'd get timer wrap in
+ weird delay cases. */
+@@ -673,6 +670,7 @@ __nf_conntrack_confirm(struct sk_buff *skb)
+ return NF_ACCEPT;
+
+ out:
++ nf_ct_add_to_dying_list(ct);
+ nf_conntrack_double_unlock(hash, reply_hash);
+ NF_CT_STAT_INC(net, insert_failed);
+ local_bh_enable();
+diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
+index 66e8425dbfe7..71b574c7bde9 100644
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -713,16 +713,12 @@ static int nft_flush_table(struct nft_ctx *ctx)
+ struct nft_chain *chain, *nc;
+ struct nft_set *set, *ns;
+
+- list_for_each_entry_safe(chain, nc, &ctx->table->chains, list) {
++ list_for_each_entry(chain, &ctx->table->chains, list) {
+ ctx->chain = chain;
+
+ err = nft_delrule_by_chain(ctx);
+ if (err < 0)
+ goto out;
+-
+- err = nft_delchain(ctx);
+- if (err < 0)
+- goto out;
+ }
+
+ list_for_each_entry_safe(set, ns, &ctx->table->sets, list) {
+@@ -735,6 +731,14 @@ static int nft_flush_table(struct nft_ctx *ctx)
+ goto out;
+ }
+
++ list_for_each_entry_safe(chain, nc, &ctx->table->chains, list) {
++ ctx->chain = chain;
++
++ err = nft_delchain(ctx);
++ if (err < 0)
++ goto out;
++ }
++
+ err = nft_deltable(ctx);
+ out:
+ return err;
+diff --git a/net/netfilter/nfnetlink.c b/net/netfilter/nfnetlink.c
+index 13c2e17bbe27..1aa7049c93f5 100644
+--- a/net/netfilter/nfnetlink.c
++++ b/net/netfilter/nfnetlink.c
+@@ -321,7 +321,8 @@ replay:
+ nlh = nlmsg_hdr(skb);
+ err = 0;
+
+- if (nlh->nlmsg_len < NLMSG_HDRLEN) {
++ if (nlmsg_len(nlh) < sizeof(struct nfgenmsg) ||
++ skb->len < nlh->nlmsg_len) {
+ err = -EINVAL;
+ goto ack;
+ }
+@@ -469,7 +470,7 @@ static int nfnetlink_bind(int group)
+ int type;
+
+ if (group <= NFNLGRP_NONE || group > NFNLGRP_MAX)
+- return -EINVAL;
++ return 0;
+
+ type = nfnl_group2type[group];
+
+diff --git a/scripts/recordmcount.pl b/scripts/recordmcount.pl
+index d4b665610d67..1f9f08ae60c1 100755
+--- a/scripts/recordmcount.pl
++++ b/scripts/recordmcount.pl
+@@ -255,7 +255,6 @@ if ($arch eq "x86_64") {
+ # force flags for this arch
+ $ld .= " -m shlelf_linux";
+ $objcopy .= " -O elf32-sh-linux";
+- $cc .= " -m32";
+
+ } elsif ($arch eq "powerpc") {
+ $local_regex = "^[0-9a-fA-F]+\\s+t\\s+(\\.?\\S+)";
+diff --git a/security/keys/gc.c b/security/keys/gc.c
+index 9609a7f0faea..c7952375ac53 100644
+--- a/security/keys/gc.c
++++ b/security/keys/gc.c
+@@ -148,12 +148,12 @@ static noinline void key_gc_unused_keys(struct list_head *keys)
+ if (test_bit(KEY_FLAG_INSTANTIATED, &key->flags))
+ atomic_dec(&key->user->nikeys);
+
+- key_user_put(key->user);
+-
+ /* now throw away the key memory */
+ if (key->type->destroy)
+ key->type->destroy(key);
+
++ key_user_put(key->user);
++
+ kfree(key->description);
+
+ #ifdef KEY_DEBUGGING
+diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
+index 6e354d326858..a712d754431c 100644
+--- a/sound/usb/mixer.c
++++ b/sound/usb/mixer.c
+@@ -909,6 +909,7 @@ static void volume_control_quirks(struct usb_mixer_elem_info *cval,
+ case USB_ID(0x046d, 0x0807): /* Logitech Webcam C500 */
+ case USB_ID(0x046d, 0x0808):
+ case USB_ID(0x046d, 0x0809):
++ case USB_ID(0x046d, 0x0819): /* Logitech Webcam C210 */
+ case USB_ID(0x046d, 0x081b): /* HD Webcam c310 */
+ case USB_ID(0x046d, 0x081d): /* HD Webcam c510 */
+ case USB_ID(0x046d, 0x0825): /* HD Webcam c270 */
^ permalink raw reply related [flat|nested] 67+ messages in thread
* [gentoo-commits] proj/linux-patches:3.18 commit in: /
@ 2015-02-07 1:07 Mike Pagano
0 siblings, 0 replies; 67+ messages in thread
From: Mike Pagano @ 2015-02-07 1:07 UTC (permalink / raw
To: gentoo-commits
commit: a7f210d59ff1a55ddbfcec02749239de6ba95528
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Sat Feb 7 01:07:31 2015 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Sat Feb 7 01:07:31 2015 +0000
URL: http://sources.gentoo.org/gitweb/?p=proj/linux-patches.git;a=commit;h=a7f210d5
Linux patch 3.18.6
---
0000_README | 4 +
1005_linux-3.18.6.patch | 4030 +++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 4034 insertions(+)
diff --git a/0000_README b/0000_README
index f8b4dcb..626b2f5 100644
--- a/0000_README
+++ b/0000_README
@@ -63,6 +63,10 @@ Patch: 1004_linux-3.18.5.patch
From: http://www.kernel.org
Desc: Linux 3.18.5
+Patch: 1005_linux-3.18.6.patch
+From: http://www.kernel.org
+Desc: Linux 3.18.6
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1005_linux-3.18.6.patch b/1005_linux-3.18.6.patch
new file mode 100644
index 0000000..b20fb1d
--- /dev/null
+++ b/1005_linux-3.18.6.patch
@@ -0,0 +1,4030 @@
+diff --git a/Makefile b/Makefile
+index 6276fcaabf21..d2bff2d5ae25 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 18
+-SUBLEVEL = 5
++SUBLEVEL = 6
+ EXTRAVERSION =
+ NAME = Diseased Newt
+
+diff --git a/arch/alpha/mm/fault.c b/arch/alpha/mm/fault.c
+index 98838a05ba6d..9d0ac091a52a 100644
+--- a/arch/alpha/mm/fault.c
++++ b/arch/alpha/mm/fault.c
+@@ -156,6 +156,8 @@ retry:
+ if (unlikely(fault & VM_FAULT_ERROR)) {
+ if (fault & VM_FAULT_OOM)
+ goto out_of_memory;
++ else if (fault & VM_FAULT_SIGSEGV)
++ goto bad_area;
+ else if (fault & VM_FAULT_SIGBUS)
+ goto do_sigbus;
+ BUG();
+diff --git a/arch/arc/mm/fault.c b/arch/arc/mm/fault.c
+index 6f7e3a68803a..563cb27e37f5 100644
+--- a/arch/arc/mm/fault.c
++++ b/arch/arc/mm/fault.c
+@@ -161,6 +161,8 @@ good_area:
+
+ if (fault & VM_FAULT_OOM)
+ goto out_of_memory;
++ else if (fault & VM_FAULT_SIGSEGV)
++ goto bad_area;
+ else if (fault & VM_FAULT_SIGBUS)
+ goto do_sigbus;
+
+diff --git a/arch/arm/include/asm/xen/page.h b/arch/arm/include/asm/xen/page.h
+index 135c24a5ba26..68c739b3fdf4 100644
+--- a/arch/arm/include/asm/xen/page.h
++++ b/arch/arm/include/asm/xen/page.h
+@@ -107,4 +107,8 @@ static inline bool set_phys_to_machine(unsigned long pfn, unsigned long mfn)
+ #define xen_remap(cookie, size) ioremap_cache((cookie), (size))
+ #define xen_unmap(cookie) iounmap((cookie))
+
++bool xen_arch_need_swiotlb(struct device *dev,
++ unsigned long pfn,
++ unsigned long mfn);
++
+ #endif /* _ASM_ARM_XEN_PAGE_H */
+diff --git a/arch/arm/mach-mvebu/coherency.c b/arch/arm/mach-mvebu/coherency.c
+index 1163a3e9accd..2ffccd4eb084 100644
+--- a/arch/arm/mach-mvebu/coherency.c
++++ b/arch/arm/mach-mvebu/coherency.c
+@@ -342,6 +342,13 @@ static void __init armada_375_380_coherency_init(struct device_node *np)
+ arch_ioremap_caller = armada_pcie_wa_ioremap_caller;
+
+ /*
++ * We should switch the PL310 to I/O coherency mode only if
++ * I/O coherency is actually enabled.
++ */
++ if (!coherency_available())
++ return;
++
++ /*
+ * Add the PL310 property "arm,io-coherent". This makes sure the
+ * outer sync operation is not used, which allows to
+ * workaround the system erratum that causes deadlocks when
+diff --git a/arch/arm/xen/mm.c b/arch/arm/xen/mm.c
+index b0e77de99148..f8a576b1d9bb 100644
+--- a/arch/arm/xen/mm.c
++++ b/arch/arm/xen/mm.c
+@@ -16,6 +16,13 @@
+ #include <asm/xen/hypercall.h>
+ #include <asm/xen/interface.h>
+
++bool xen_arch_need_swiotlb(struct device *dev,
++ unsigned long pfn,
++ unsigned long mfn)
++{
++ return (pfn != mfn);
++}
++
+ int xen_create_contiguous_region(phys_addr_t pstart, unsigned int order,
+ unsigned int address_bits,
+ dma_addr_t *dma_handle)
+diff --git a/arch/avr32/mm/fault.c b/arch/avr32/mm/fault.c
+index 0eca93327195..d223a8b57c1e 100644
+--- a/arch/avr32/mm/fault.c
++++ b/arch/avr32/mm/fault.c
+@@ -142,6 +142,8 @@ good_area:
+ if (unlikely(fault & VM_FAULT_ERROR)) {
+ if (fault & VM_FAULT_OOM)
+ goto out_of_memory;
++ else if (fault & VM_FAULT_SIGSEGV)
++ goto bad_area;
+ else if (fault & VM_FAULT_SIGBUS)
+ goto do_sigbus;
+ BUG();
+diff --git a/arch/cris/mm/fault.c b/arch/cris/mm/fault.c
+index 1790f22e71a2..2686a7aa8ec8 100644
+--- a/arch/cris/mm/fault.c
++++ b/arch/cris/mm/fault.c
+@@ -176,6 +176,8 @@ retry:
+ if (unlikely(fault & VM_FAULT_ERROR)) {
+ if (fault & VM_FAULT_OOM)
+ goto out_of_memory;
++ else if (fault & VM_FAULT_SIGSEGV)
++ goto bad_area;
+ else if (fault & VM_FAULT_SIGBUS)
+ goto do_sigbus;
+ BUG();
+diff --git a/arch/frv/mm/fault.c b/arch/frv/mm/fault.c
+index 9a66372fc7c7..ec4917ddf678 100644
+--- a/arch/frv/mm/fault.c
++++ b/arch/frv/mm/fault.c
+@@ -168,6 +168,8 @@ asmlinkage void do_page_fault(int datammu, unsigned long esr0, unsigned long ear
+ if (unlikely(fault & VM_FAULT_ERROR)) {
+ if (fault & VM_FAULT_OOM)
+ goto out_of_memory;
++ else if (fault & VM_FAULT_SIGSEGV)
++ goto bad_area;
+ else if (fault & VM_FAULT_SIGBUS)
+ goto do_sigbus;
+ BUG();
+diff --git a/arch/ia64/mm/fault.c b/arch/ia64/mm/fault.c
+index 7225dad87094..ba5ba7accd0d 100644
+--- a/arch/ia64/mm/fault.c
++++ b/arch/ia64/mm/fault.c
+@@ -172,6 +172,8 @@ retry:
+ */
+ if (fault & VM_FAULT_OOM) {
+ goto out_of_memory;
++ } else if (fault & VM_FAULT_SIGSEGV) {
++ goto bad_area;
+ } else if (fault & VM_FAULT_SIGBUS) {
+ signal = SIGBUS;
+ goto bad_area;
+diff --git a/arch/m32r/mm/fault.c b/arch/m32r/mm/fault.c
+index e9c6a8014bd6..e3d4d4890104 100644
+--- a/arch/m32r/mm/fault.c
++++ b/arch/m32r/mm/fault.c
+@@ -200,6 +200,8 @@ good_area:
+ if (unlikely(fault & VM_FAULT_ERROR)) {
+ if (fault & VM_FAULT_OOM)
+ goto out_of_memory;
++ else if (fault & VM_FAULT_SIGSEGV)
++ goto bad_area;
+ else if (fault & VM_FAULT_SIGBUS)
+ goto do_sigbus;
+ BUG();
+diff --git a/arch/m68k/mm/fault.c b/arch/m68k/mm/fault.c
+index 2bd7487440c4..b2f04aee46ec 100644
+--- a/arch/m68k/mm/fault.c
++++ b/arch/m68k/mm/fault.c
+@@ -145,6 +145,8 @@ good_area:
+ if (unlikely(fault & VM_FAULT_ERROR)) {
+ if (fault & VM_FAULT_OOM)
+ goto out_of_memory;
++ else if (fault & VM_FAULT_SIGSEGV)
++ goto map_err;
+ else if (fault & VM_FAULT_SIGBUS)
+ goto bus_err;
+ BUG();
+diff --git a/arch/metag/mm/fault.c b/arch/metag/mm/fault.c
+index 332680e5ebf2..2de5dc695a87 100644
+--- a/arch/metag/mm/fault.c
++++ b/arch/metag/mm/fault.c
+@@ -141,6 +141,8 @@ good_area:
+ if (unlikely(fault & VM_FAULT_ERROR)) {
+ if (fault & VM_FAULT_OOM)
+ goto out_of_memory;
++ else if (fault & VM_FAULT_SIGSEGV)
++ goto bad_area;
+ else if (fault & VM_FAULT_SIGBUS)
+ goto do_sigbus;
+ BUG();
+diff --git a/arch/microblaze/mm/fault.c b/arch/microblaze/mm/fault.c
+index fa4cf52aa7a6..d46a5ebb7570 100644
+--- a/arch/microblaze/mm/fault.c
++++ b/arch/microblaze/mm/fault.c
+@@ -224,6 +224,8 @@ good_area:
+ if (unlikely(fault & VM_FAULT_ERROR)) {
+ if (fault & VM_FAULT_OOM)
+ goto out_of_memory;
++ else if (fault & VM_FAULT_SIGSEGV)
++ goto bad_area;
+ else if (fault & VM_FAULT_SIGBUS)
+ goto do_sigbus;
+ BUG();
+diff --git a/arch/mips/mm/fault.c b/arch/mips/mm/fault.c
+index becc42bb1849..70ab5d664332 100644
+--- a/arch/mips/mm/fault.c
++++ b/arch/mips/mm/fault.c
+@@ -158,6 +158,8 @@ good_area:
+ if (unlikely(fault & VM_FAULT_ERROR)) {
+ if (fault & VM_FAULT_OOM)
+ goto out_of_memory;
++ else if (fault & VM_FAULT_SIGSEGV)
++ goto bad_area;
+ else if (fault & VM_FAULT_SIGBUS)
+ goto do_sigbus;
+ BUG();
+diff --git a/arch/mn10300/mm/fault.c b/arch/mn10300/mm/fault.c
+index 3516cbdf1ee9..0c2cc5d39c8e 100644
+--- a/arch/mn10300/mm/fault.c
++++ b/arch/mn10300/mm/fault.c
+@@ -262,6 +262,8 @@ good_area:
+ if (unlikely(fault & VM_FAULT_ERROR)) {
+ if (fault & VM_FAULT_OOM)
+ goto out_of_memory;
++ else if (fault & VM_FAULT_SIGSEGV)
++ goto bad_area;
+ else if (fault & VM_FAULT_SIGBUS)
+ goto do_sigbus;
+ BUG();
+diff --git a/arch/openrisc/mm/fault.c b/arch/openrisc/mm/fault.c
+index 0703acf7d327..230ac20ae794 100644
+--- a/arch/openrisc/mm/fault.c
++++ b/arch/openrisc/mm/fault.c
+@@ -171,6 +171,8 @@ good_area:
+ if (unlikely(fault & VM_FAULT_ERROR)) {
+ if (fault & VM_FAULT_OOM)
+ goto out_of_memory;
++ else if (fault & VM_FAULT_SIGSEGV)
++ goto bad_area;
+ else if (fault & VM_FAULT_SIGBUS)
+ goto do_sigbus;
+ BUG();
+diff --git a/arch/parisc/mm/fault.c b/arch/parisc/mm/fault.c
+index 3ca9c1131cfe..e5120e653240 100644
+--- a/arch/parisc/mm/fault.c
++++ b/arch/parisc/mm/fault.c
+@@ -256,6 +256,8 @@ good_area:
+ */
+ if (fault & VM_FAULT_OOM)
+ goto out_of_memory;
++ else if (fault & VM_FAULT_SIGSEGV)
++ goto bad_area;
+ else if (fault & VM_FAULT_SIGBUS)
+ goto bad_area;
+ BUG();
+diff --git a/arch/powerpc/mm/copro_fault.c b/arch/powerpc/mm/copro_fault.c
+index 5a236f082c78..1b5305d4bdab 100644
+--- a/arch/powerpc/mm/copro_fault.c
++++ b/arch/powerpc/mm/copro_fault.c
+@@ -76,7 +76,7 @@ int copro_handle_mm_fault(struct mm_struct *mm, unsigned long ea,
+ if (*flt & VM_FAULT_OOM) {
+ ret = -ENOMEM;
+ goto out_unlock;
+- } else if (*flt & VM_FAULT_SIGBUS) {
++ } else if (*flt & (VM_FAULT_SIGBUS | VM_FAULT_SIGSEGV)) {
+ ret = -EFAULT;
+ goto out_unlock;
+ }
+diff --git a/arch/powerpc/mm/fault.c b/arch/powerpc/mm/fault.c
+index 08d659a9fcdb..f06b56baf0b3 100644
+--- a/arch/powerpc/mm/fault.c
++++ b/arch/powerpc/mm/fault.c
+@@ -444,6 +444,8 @@ good_area:
+ */
+ fault = handle_mm_fault(mm, vma, address, flags);
+ if (unlikely(fault & (VM_FAULT_RETRY|VM_FAULT_ERROR))) {
++ if (fault & VM_FAULT_SIGSEGV)
++ goto bad_area;
+ rc = mm_fault_error(regs, address, fault);
+ if (rc >= MM_FAULT_RETURN)
+ goto bail;
+diff --git a/arch/powerpc/xmon/xmon.c b/arch/powerpc/xmon/xmon.c
+index c8efbb37d6e0..e23f559faa47 100644
+--- a/arch/powerpc/xmon/xmon.c
++++ b/arch/powerpc/xmon/xmon.c
+@@ -293,6 +293,7 @@ static inline void disable_surveillance(void)
+ args.token = rtas_token("set-indicator");
+ if (args.token == RTAS_UNKNOWN_SERVICE)
+ return;
++ args.token = cpu_to_be32(args.token);
+ args.nargs = cpu_to_be32(3);
+ args.nret = cpu_to_be32(1);
+ args.rets = &args.args[3];
+diff --git a/arch/s390/mm/fault.c b/arch/s390/mm/fault.c
+index a2b81d6ce8a5..fbe8f2cf9245 100644
+--- a/arch/s390/mm/fault.c
++++ b/arch/s390/mm/fault.c
+@@ -374,6 +374,12 @@ static noinline void do_fault_error(struct pt_regs *regs, int fault)
+ do_no_context(regs);
+ else
+ pagefault_out_of_memory();
++ } else if (fault & VM_FAULT_SIGSEGV) {
++ /* Kernel mode? Handle exceptions or die */
++ if (!user_mode(regs))
++ do_no_context(regs);
++ else
++ do_sigsegv(regs, SEGV_MAPERR);
+ } else if (fault & VM_FAULT_SIGBUS) {
+ /* Kernel mode? Handle exceptions or die */
+ if (!user_mode(regs))
+diff --git a/arch/score/mm/fault.c b/arch/score/mm/fault.c
+index 52238983527d..6860beb2a280 100644
+--- a/arch/score/mm/fault.c
++++ b/arch/score/mm/fault.c
+@@ -114,6 +114,8 @@ good_area:
+ if (unlikely(fault & VM_FAULT_ERROR)) {
+ if (fault & VM_FAULT_OOM)
+ goto out_of_memory;
++ else if (fault & VM_FAULT_SIGSEGV)
++ goto bad_area;
+ else if (fault & VM_FAULT_SIGBUS)
+ goto do_sigbus;
+ BUG();
+diff --git a/arch/sh/mm/fault.c b/arch/sh/mm/fault.c
+index 541dc6101508..a58fec9b55e0 100644
+--- a/arch/sh/mm/fault.c
++++ b/arch/sh/mm/fault.c
+@@ -353,6 +353,8 @@ mm_fault_error(struct pt_regs *regs, unsigned long error_code,
+ } else {
+ if (fault & VM_FAULT_SIGBUS)
+ do_sigbus(regs, error_code, address);
++ else if (fault & VM_FAULT_SIGSEGV)
++ bad_area(regs, error_code, address);
+ else
+ BUG();
+ }
+diff --git a/arch/sparc/mm/fault_32.c b/arch/sparc/mm/fault_32.c
+index 908e8c17c902..70d817154fe8 100644
+--- a/arch/sparc/mm/fault_32.c
++++ b/arch/sparc/mm/fault_32.c
+@@ -249,6 +249,8 @@ good_area:
+ if (unlikely(fault & VM_FAULT_ERROR)) {
+ if (fault & VM_FAULT_OOM)
+ goto out_of_memory;
++ else if (fault & VM_FAULT_SIGSEGV)
++ goto bad_area;
+ else if (fault & VM_FAULT_SIGBUS)
+ goto do_sigbus;
+ BUG();
+diff --git a/arch/sparc/mm/fault_64.c b/arch/sparc/mm/fault_64.c
+index 18fcd7167095..479823249429 100644
+--- a/arch/sparc/mm/fault_64.c
++++ b/arch/sparc/mm/fault_64.c
+@@ -446,6 +446,8 @@ good_area:
+ if (unlikely(fault & VM_FAULT_ERROR)) {
+ if (fault & VM_FAULT_OOM)
+ goto out_of_memory;
++ else if (fault & VM_FAULT_SIGSEGV)
++ goto bad_area;
+ else if (fault & VM_FAULT_SIGBUS)
+ goto do_sigbus;
+ BUG();
+diff --git a/arch/tile/mm/fault.c b/arch/tile/mm/fault.c
+index 6c0571216a9d..c6d2a76d91a8 100644
+--- a/arch/tile/mm/fault.c
++++ b/arch/tile/mm/fault.c
+@@ -444,6 +444,8 @@ good_area:
+ if (unlikely(fault & VM_FAULT_ERROR)) {
+ if (fault & VM_FAULT_OOM)
+ goto out_of_memory;
++ else if (fault & VM_FAULT_SIGSEGV)
++ goto bad_area;
+ else if (fault & VM_FAULT_SIGBUS)
+ goto do_sigbus;
+ BUG();
+diff --git a/arch/um/kernel/trap.c b/arch/um/kernel/trap.c
+index 5678c3571e7c..209617302df8 100644
+--- a/arch/um/kernel/trap.c
++++ b/arch/um/kernel/trap.c
+@@ -80,6 +80,8 @@ good_area:
+ if (unlikely(fault & VM_FAULT_ERROR)) {
+ if (fault & VM_FAULT_OOM) {
+ goto out_of_memory;
++ } else if (fault & VM_FAULT_SIGSEGV) {
++ goto out;
+ } else if (fault & VM_FAULT_SIGBUS) {
+ err = -EACCES;
+ goto out;
+diff --git a/arch/x86/boot/compressed/Makefile b/arch/x86/boot/compressed/Makefile
+index 45abc363dd3e..6a1a8458c042 100644
+--- a/arch/x86/boot/compressed/Makefile
++++ b/arch/x86/boot/compressed/Makefile
+@@ -77,7 +77,7 @@ suffix-$(CONFIG_KERNEL_LZO) := lzo
+ suffix-$(CONFIG_KERNEL_LZ4) := lz4
+
+ RUN_SIZE = $(shell $(OBJDUMP) -h vmlinux | \
+- perl $(srctree)/arch/x86/tools/calc_run_size.pl)
++ $(CONFIG_SHELL) $(srctree)/arch/x86/tools/calc_run_size.sh)
+ quiet_cmd_mkpiggy = MKPIGGY $@
+ cmd_mkpiggy = $(obj)/mkpiggy $< $(RUN_SIZE) > $@ || ( rm -f $@ ; false )
+
+diff --git a/arch/x86/include/asm/xen/page.h b/arch/x86/include/asm/xen/page.h
+index c949923a5668..f58ef6c0613b 100644
+--- a/arch/x86/include/asm/xen/page.h
++++ b/arch/x86/include/asm/xen/page.h
+@@ -236,4 +236,11 @@ void make_lowmem_page_readwrite(void *vaddr);
+ #define xen_remap(cookie, size) ioremap((cookie), (size));
+ #define xen_unmap(cookie) iounmap((cookie))
+
++static inline bool xen_arch_need_swiotlb(struct device *dev,
++ unsigned long pfn,
++ unsigned long mfn)
++{
++ return false;
++}
++
+ #endif /* _ASM_X86_XEN_PAGE_H */
+diff --git a/arch/x86/kernel/cpu/perf_event_intel.c b/arch/x86/kernel/cpu/perf_event_intel.c
+index 944bf019b74f..498b6d967138 100644
+--- a/arch/x86/kernel/cpu/perf_event_intel.c
++++ b/arch/x86/kernel/cpu/perf_event_intel.c
+@@ -2431,6 +2431,7 @@ __init int intel_pmu_init(void)
+ break;
+
+ case 55: /* 22nm Atom "Silvermont" */
++ case 76: /* 14nm Atom "Airmont" */
+ case 77: /* 22nm Atom "Silvermont Avoton/Rangely" */
+ memcpy(hw_cache_event_ids, slm_hw_cache_event_ids,
+ sizeof(hw_cache_event_ids));
+diff --git a/arch/x86/kernel/cpu/perf_event_intel_rapl.c b/arch/x86/kernel/cpu/perf_event_intel_rapl.c
+index d64f275fe274..8c256749882c 100644
+--- a/arch/x86/kernel/cpu/perf_event_intel_rapl.c
++++ b/arch/x86/kernel/cpu/perf_event_intel_rapl.c
+@@ -135,7 +135,7 @@ static inline u64 rapl_scale(u64 v)
+ * or use ldexp(count, -32).
+ * Watts = Joules/Time delta
+ */
+- return v << (32 - __this_cpu_read(rapl_pmu->hw_unit));
++ return v << (32 - __this_cpu_read(rapl_pmu)->hw_unit);
+ }
+
+ static u64 rapl_event_update(struct perf_event *event)
+diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c
+index d973e61e450d..a8612aafeca1 100644
+--- a/arch/x86/mm/fault.c
++++ b/arch/x86/mm/fault.c
+@@ -905,6 +905,8 @@ mm_fault_error(struct pt_regs *regs, unsigned long error_code,
+ if (fault & (VM_FAULT_SIGBUS|VM_FAULT_HWPOISON|
+ VM_FAULT_HWPOISON_LARGE))
+ do_sigbus(regs, error_code, address, fault);
++ else if (fault & VM_FAULT_SIGSEGV)
++ bad_area_nosemaphore(regs, error_code, address);
+ else
+ BUG();
+ }
+diff --git a/arch/x86/tools/calc_run_size.pl b/arch/x86/tools/calc_run_size.pl
+deleted file mode 100644
+index 23210baade2d..000000000000
+--- a/arch/x86/tools/calc_run_size.pl
++++ /dev/null
+@@ -1,39 +0,0 @@
+-#!/usr/bin/perl
+-#
+-# Calculate the amount of space needed to run the kernel, including room for
+-# the .bss and .brk sections.
+-#
+-# Usage:
+-# objdump -h a.out | perl calc_run_size.pl
+-use strict;
+-
+-my $mem_size = 0;
+-my $file_offset = 0;
+-
+-my $sections=" *[0-9]+ \.(?:bss|brk) +";
+-while (<>) {
+- if (/^$sections([0-9a-f]+) +(?:[0-9a-f]+ +){2}([0-9a-f]+)/) {
+- my $size = hex($1);
+- my $offset = hex($2);
+- $mem_size += $size;
+- if ($file_offset == 0) {
+- $file_offset = $offset;
+- } elsif ($file_offset != $offset) {
+- # BFD linker shows the same file offset in ELF.
+- # Gold linker shows them as consecutive.
+- next if ($file_offset + $mem_size == $offset + $size);
+-
+- printf STDERR "file_offset: 0x%lx\n", $file_offset;
+- printf STDERR "mem_size: 0x%lx\n", $mem_size;
+- printf STDERR "offset: 0x%lx\n", $offset;
+- printf STDERR "size: 0x%lx\n", $size;
+-
+- die ".bss and .brk are non-contiguous\n";
+- }
+- }
+-}
+-
+-if ($file_offset == 0) {
+- die "Never found .bss or .brk file offset\n";
+-}
+-printf("%d\n", $mem_size + $file_offset);
+diff --git a/arch/x86/tools/calc_run_size.sh b/arch/x86/tools/calc_run_size.sh
+new file mode 100644
+index 000000000000..1a4c17bb3910
+--- /dev/null
++++ b/arch/x86/tools/calc_run_size.sh
+@@ -0,0 +1,42 @@
++#!/bin/sh
++#
++# Calculate the amount of space needed to run the kernel, including room for
++# the .bss and .brk sections.
++#
++# Usage:
++# objdump -h a.out | sh calc_run_size.sh
++
++NUM='\([0-9a-fA-F]*[ \t]*\)'
++OUT=$(sed -n 's/^[ \t0-9]*.b[sr][sk][ \t]*'"$NUM$NUM$NUM$NUM"'.*/\1\4/p')
++if [ -z "$OUT" ] ; then
++ echo "Never found .bss or .brk file offset" >&2
++ exit 1
++fi
++
++OUT=$(echo ${OUT# })
++sizeA=$(printf "%d" 0x${OUT%% *})
++OUT=${OUT#* }
++offsetA=$(printf "%d" 0x${OUT%% *})
++OUT=${OUT#* }
++sizeB=$(printf "%d" 0x${OUT%% *})
++OUT=${OUT#* }
++offsetB=$(printf "%d" 0x${OUT%% *})
++
++run_size=$(( $offsetA + $sizeA + $sizeB ))
++
++# BFD linker shows the same file offset in ELF.
++if [ "$offsetA" -ne "$offsetB" ] ; then
++ # Gold linker shows them as consecutive.
++ endB=$(( $offsetB + $sizeB ))
++ if [ "$endB" != "$run_size" ] ; then
++ printf "sizeA: 0x%x\n" $sizeA >&2
++ printf "offsetA: 0x%x\n" $offsetA >&2
++ printf "sizeB: 0x%x\n" $sizeB >&2
++ printf "offsetB: 0x%x\n" $offsetB >&2
++ echo ".bss and .brk are non-contiguous" >&2
++ exit 1
++ fi
++fi
++
++printf "%d\n" $run_size
++exit 0
+diff --git a/arch/xtensa/mm/fault.c b/arch/xtensa/mm/fault.c
+index b57c4f91f487..9e3571a6535c 100644
+--- a/arch/xtensa/mm/fault.c
++++ b/arch/xtensa/mm/fault.c
+@@ -117,6 +117,8 @@ good_area:
+ if (unlikely(fault & VM_FAULT_ERROR)) {
+ if (fault & VM_FAULT_OOM)
+ goto out_of_memory;
++ else if (fault & VM_FAULT_SIGSEGV)
++ goto bad_area;
+ else if (fault & VM_FAULT_SIGBUS)
+ goto do_sigbus;
+ BUG();
+diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c
+index 27b71a0b72d0..76b5be937de6 100644
+--- a/drivers/block/rbd.c
++++ b/drivers/block/rbd.c
+@@ -2098,32 +2098,26 @@ static void rbd_dev_parent_put(struct rbd_device *rbd_dev)
+ * If an image has a non-zero parent overlap, get a reference to its
+ * parent.
+ *
+- * We must get the reference before checking for the overlap to
+- * coordinate properly with zeroing the parent overlap in
+- * rbd_dev_v2_parent_info() when an image gets flattened. We
+- * drop it again if there is no overlap.
+- *
+ * Returns true if the rbd device has a parent with a non-zero
+ * overlap and a reference for it was successfully taken, or
+ * false otherwise.
+ */
+ static bool rbd_dev_parent_get(struct rbd_device *rbd_dev)
+ {
+- int counter;
++ int counter = 0;
+
+ if (!rbd_dev->parent_spec)
+ return false;
+
+- counter = atomic_inc_return_safe(&rbd_dev->parent_ref);
+- if (counter > 0 && rbd_dev->parent_overlap)
+- return true;
+-
+- /* Image was flattened, but parent is not yet torn down */
++ down_read(&rbd_dev->header_rwsem);
++ if (rbd_dev->parent_overlap)
++ counter = atomic_inc_return_safe(&rbd_dev->parent_ref);
++ up_read(&rbd_dev->header_rwsem);
+
+ if (counter < 0)
+ rbd_warn(rbd_dev, "parent reference overflow");
+
+- return false;
++ return counter > 0;
+ }
+
+ /*
+@@ -4236,7 +4230,6 @@ static int rbd_dev_v2_parent_info(struct rbd_device *rbd_dev)
+ */
+ if (rbd_dev->parent_overlap) {
+ rbd_dev->parent_overlap = 0;
+- smp_mb();
+ rbd_dev_parent_put(rbd_dev);
+ pr_info("%s: clone image has been flattened\n",
+ rbd_dev->disk->disk_name);
+@@ -4282,7 +4275,6 @@ static int rbd_dev_v2_parent_info(struct rbd_device *rbd_dev)
+ * treat it specially.
+ */
+ rbd_dev->parent_overlap = overlap;
+- smp_mb();
+ if (!overlap) {
+
+ /* A null parent_spec indicates it's the initial probe */
+@@ -5111,10 +5103,7 @@ static void rbd_dev_unprobe(struct rbd_device *rbd_dev)
+ {
+ struct rbd_image_header *header;
+
+- /* Drop parent reference unless it's already been done (or none) */
+-
+- if (rbd_dev->parent_overlap)
+- rbd_dev_parent_put(rbd_dev);
++ rbd_dev_parent_put(rbd_dev);
+
+ /* Free dynamic fields from the header, then zero it out */
+
+diff --git a/drivers/clocksource/arm_arch_timer.c b/drivers/clocksource/arm_arch_timer.c
+index 1fa2af957b18..84b4c8b7fbd1 100644
+--- a/drivers/clocksource/arm_arch_timer.c
++++ b/drivers/clocksource/arm_arch_timer.c
+@@ -462,7 +462,7 @@ static void __init arch_counter_register(unsigned type)
+
+ /* Register the CP15 based counter if we have one */
+ if (type & ARCH_CP15_TIMER) {
+- if (arch_timer_use_virtual)
++ if (IS_ENABLED(CONFIG_ARM64) || arch_timer_use_virtual)
+ arch_timer_read_counter = arch_counter_get_cntvct;
+ else
+ arch_timer_read_counter = arch_counter_get_cntpct;
+diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c
+index ef757f712a3d..e9a2827ad1c4 100644
+--- a/drivers/gpu/drm/drm_fb_helper.c
++++ b/drivers/gpu/drm/drm_fb_helper.c
+@@ -145,6 +145,31 @@ int drm_fb_helper_add_one_connector(struct drm_fb_helper *fb_helper, struct drm_
+ }
+ EXPORT_SYMBOL(drm_fb_helper_add_one_connector);
+
++static void remove_from_modeset(struct drm_mode_set *set,
++ struct drm_connector *connector)
++{
++ int i, j;
++
++ for (i = 0; i < set->num_connectors; i++) {
++ if (set->connectors[i] == connector)
++ break;
++ }
++
++ if (i == set->num_connectors)
++ return;
++
++ for (j = i + 1; j < set->num_connectors; j++) {
++ set->connectors[j - 1] = set->connectors[j];
++ }
++ set->num_connectors--;
++
++ /* because i915 is pissy about this..
++ * TODO maybe need to makes sure we set it back to !=NULL somewhere?
++ */
++ if (set->num_connectors == 0)
++ set->fb = NULL;
++}
++
+ int drm_fb_helper_remove_one_connector(struct drm_fb_helper *fb_helper,
+ struct drm_connector *connector)
+ {
+@@ -167,6 +192,11 @@ int drm_fb_helper_remove_one_connector(struct drm_fb_helper *fb_helper,
+ }
+ fb_helper->connector_count--;
+ kfree(fb_helper_connector);
++
++ /* also cleanup dangling references to the connector: */
++ for (i = 0; i < fb_helper->crtc_count; i++)
++ remove_from_modeset(&fb_helper->crtc_info[i].mode_set, connector);
++
+ return 0;
+ }
+ EXPORT_SYMBOL(drm_fb_helper_remove_one_connector);
+diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
+index 346aee828dc3..c33327d5c543 100644
+--- a/drivers/gpu/drm/i915/i915_drv.h
++++ b/drivers/gpu/drm/i915/i915_drv.h
+@@ -2076,8 +2076,7 @@ struct drm_i915_cmd_table {
+ #define IS_HSW_EARLY_SDV(dev) (IS_HASWELL(dev) && \
+ (INTEL_DEVID(dev) & 0xFF00) == 0x0C00)
+ #define IS_BDW_ULT(dev) (IS_BROADWELL(dev) && \
+- ((INTEL_DEVID(dev) & 0xf) == 0x2 || \
+- (INTEL_DEVID(dev) & 0xf) == 0x6 || \
++ ((INTEL_DEVID(dev) & 0xf) == 0x6 || \
+ (INTEL_DEVID(dev) & 0xf) == 0xe))
+ #define IS_HSW_ULT(dev) (IS_HASWELL(dev) && \
+ (INTEL_DEVID(dev) & 0xFF00) == 0x0A00)
+diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
+index fd76933eed04..d88dbedeaa77 100644
+--- a/drivers/gpu/drm/i915/i915_gem.c
++++ b/drivers/gpu/drm/i915/i915_gem.c
+@@ -3050,6 +3050,13 @@ static void i965_write_fence_reg(struct drm_device *dev, int reg,
+ u32 size = i915_gem_obj_ggtt_size(obj);
+ uint64_t val;
+
++ /* Adjust fence size to match tiled area */
++ if (obj->tiling_mode != I915_TILING_NONE) {
++ uint32_t row_size = obj->stride *
++ (obj->tiling_mode == I915_TILING_Y ? 32 : 8);
++ size = (size / row_size) * row_size;
++ }
++
+ val = (uint64_t)((i915_gem_obj_ggtt_offset(obj) + size - 4096) &
+ 0xfffff000) << 32;
+ val |= i915_gem_obj_ggtt_offset(obj) & 0xfffff000;
+@@ -4811,25 +4818,18 @@ i915_gem_init_hw(struct drm_device *dev)
+ for (i = 0; i < NUM_L3_SLICES(dev); i++)
+ i915_gem_l3_remap(&dev_priv->ring[RCS], i);
+
+- /*
+- * XXX: Contexts should only be initialized once. Doing a switch to the
+- * default context switch however is something we'd like to do after
+- * reset or thaw (the latter may not actually be necessary for HW, but
+- * goes with our code better). Context switching requires rings (for
+- * the do_switch), but before enabling PPGTT. So don't move this.
+- */
+- ret = i915_gem_context_enable(dev_priv);
++ ret = i915_ppgtt_init_hw(dev);
+ if (ret && ret != -EIO) {
+- DRM_ERROR("Context enable failed %d\n", ret);
++ DRM_ERROR("PPGTT enable failed %d\n", ret);
+ i915_gem_cleanup_ringbuffer(dev);
+-
+- return ret;
+ }
+
+- ret = i915_ppgtt_init_hw(dev);
++ ret = i915_gem_context_enable(dev_priv);
+ if (ret && ret != -EIO) {
+- DRM_ERROR("PPGTT enable failed %d\n", ret);
++ DRM_ERROR("Context enable failed %d\n", ret);
+ i915_gem_cleanup_ringbuffer(dev);
++
++ return ret;
+ }
+
+ return ret;
+diff --git a/drivers/gpu/drm/i915/intel_panel.c b/drivers/gpu/drm/i915/intel_panel.c
+index 41b3be217493..8bc193f81333 100644
+--- a/drivers/gpu/drm/i915/intel_panel.c
++++ b/drivers/gpu/drm/i915/intel_panel.c
+@@ -947,7 +947,7 @@ void intel_panel_enable_backlight(struct intel_connector *connector)
+
+ WARN_ON(panel->backlight.max == 0);
+
+- if (panel->backlight.level == 0) {
++ if (panel->backlight.level <= panel->backlight.min) {
+ panel->backlight.level = panel->backlight.max;
+ if (panel->backlight.device)
+ panel->backlight.device->props.brightness =
+diff --git a/drivers/gpu/drm/radeon/r100.c b/drivers/gpu/drm/radeon/r100.c
+index b53b31a7b76f..cdf6e2149539 100644
+--- a/drivers/gpu/drm/radeon/r100.c
++++ b/drivers/gpu/drm/radeon/r100.c
+@@ -644,6 +644,7 @@ int r100_pci_gart_init(struct radeon_device *rdev)
+ return r;
+ rdev->gart.table_size = rdev->gart.num_gpu_pages * 4;
+ rdev->asic->gart.tlb_flush = &r100_pci_gart_tlb_flush;
++ rdev->asic->gart.get_page_entry = &r100_pci_gart_get_page_entry;
+ rdev->asic->gart.set_page = &r100_pci_gart_set_page;
+ return radeon_gart_table_ram_alloc(rdev);
+ }
+@@ -681,11 +682,16 @@ void r100_pci_gart_disable(struct radeon_device *rdev)
+ WREG32(RADEON_AIC_HI_ADDR, 0);
+ }
+
++uint64_t r100_pci_gart_get_page_entry(uint64_t addr, uint32_t flags)
++{
++ return addr;
++}
++
+ void r100_pci_gart_set_page(struct radeon_device *rdev, unsigned i,
+- uint64_t addr, uint32_t flags)
++ uint64_t entry)
+ {
+ u32 *gtt = rdev->gart.ptr;
+- gtt[i] = cpu_to_le32(lower_32_bits(addr));
++ gtt[i] = cpu_to_le32(lower_32_bits(entry));
+ }
+
+ void r100_pci_gart_fini(struct radeon_device *rdev)
+diff --git a/drivers/gpu/drm/radeon/r300.c b/drivers/gpu/drm/radeon/r300.c
+index 1bc4704034ce..f3ef6257d669 100644
+--- a/drivers/gpu/drm/radeon/r300.c
++++ b/drivers/gpu/drm/radeon/r300.c
+@@ -73,11 +73,8 @@ void rv370_pcie_gart_tlb_flush(struct radeon_device *rdev)
+ #define R300_PTE_WRITEABLE (1 << 2)
+ #define R300_PTE_READABLE (1 << 3)
+
+-void rv370_pcie_gart_set_page(struct radeon_device *rdev, unsigned i,
+- uint64_t addr, uint32_t flags)
++uint64_t rv370_pcie_gart_get_page_entry(uint64_t addr, uint32_t flags)
+ {
+- void __iomem *ptr = rdev->gart.ptr;
+-
+ addr = (lower_32_bits(addr) >> 8) |
+ ((upper_32_bits(addr) & 0xff) << 24);
+ if (flags & RADEON_GART_PAGE_READ)
+@@ -86,10 +83,18 @@ void rv370_pcie_gart_set_page(struct radeon_device *rdev, unsigned i,
+ addr |= R300_PTE_WRITEABLE;
+ if (!(flags & RADEON_GART_PAGE_SNOOP))
+ addr |= R300_PTE_UNSNOOPED;
++ return addr;
++}
++
++void rv370_pcie_gart_set_page(struct radeon_device *rdev, unsigned i,
++ uint64_t entry)
++{
++ void __iomem *ptr = rdev->gart.ptr;
++
+ /* on x86 we want this to be CPU endian, on powerpc
+ * on powerpc without HW swappers, it'll get swapped on way
+ * into VRAM - so no need for cpu_to_le32 on VRAM tables */
+- writel(addr, ((void __iomem *)ptr) + (i * 4));
++ writel(entry, ((void __iomem *)ptr) + (i * 4));
+ }
+
+ int rv370_pcie_gart_init(struct radeon_device *rdev)
+@@ -109,6 +114,7 @@ int rv370_pcie_gart_init(struct radeon_device *rdev)
+ DRM_ERROR("Failed to register debugfs file for PCIE gart !\n");
+ rdev->gart.table_size = rdev->gart.num_gpu_pages * 4;
+ rdev->asic->gart.tlb_flush = &rv370_pcie_gart_tlb_flush;
++ rdev->asic->gart.get_page_entry = &rv370_pcie_gart_get_page_entry;
+ rdev->asic->gart.set_page = &rv370_pcie_gart_set_page;
+ return radeon_gart_table_vram_alloc(rdev);
+ }
+diff --git a/drivers/gpu/drm/radeon/radeon.h b/drivers/gpu/drm/radeon/radeon.h
+index a9717b3fbf1b..dbe51bfe3ef4 100644
+--- a/drivers/gpu/drm/radeon/radeon.h
++++ b/drivers/gpu/drm/radeon/radeon.h
+@@ -245,6 +245,7 @@ bool radeon_get_bios(struct radeon_device *rdev);
+ * Dummy page
+ */
+ struct radeon_dummy_page {
++ uint64_t entry;
+ struct page *page;
+ dma_addr_t addr;
+ };
+@@ -626,6 +627,7 @@ struct radeon_gart {
+ unsigned table_size;
+ struct page **pages;
+ dma_addr_t *pages_addr;
++ uint64_t *pages_entry;
+ bool ready;
+ };
+
+@@ -1819,8 +1821,9 @@ struct radeon_asic {
+ /* gart */
+ struct {
+ void (*tlb_flush)(struct radeon_device *rdev);
++ uint64_t (*get_page_entry)(uint64_t addr, uint32_t flags);
+ void (*set_page)(struct radeon_device *rdev, unsigned i,
+- uint64_t addr, uint32_t flags);
++ uint64_t entry);
+ } gart;
+ struct {
+ int (*init)(struct radeon_device *rdev);
+@@ -2818,7 +2821,8 @@ static inline void radeon_ring_write(struct radeon_ring *ring, uint32_t v)
+ #define radeon_vga_set_state(rdev, state) (rdev)->asic->vga_set_state((rdev), (state))
+ #define radeon_asic_reset(rdev) (rdev)->asic->asic_reset((rdev))
+ #define radeon_gart_tlb_flush(rdev) (rdev)->asic->gart.tlb_flush((rdev))
+-#define radeon_gart_set_page(rdev, i, p, f) (rdev)->asic->gart.set_page((rdev), (i), (p), (f))
++#define radeon_gart_get_page_entry(a, f) (rdev)->asic->gart.get_page_entry((a), (f))
++#define radeon_gart_set_page(rdev, i, e) (rdev)->asic->gart.set_page((rdev), (i), (e))
+ #define radeon_asic_vm_init(rdev) (rdev)->asic->vm.init((rdev))
+ #define radeon_asic_vm_fini(rdev) (rdev)->asic->vm.fini((rdev))
+ #define radeon_asic_vm_copy_pages(rdev, ib, pe, src, count) ((rdev)->asic->vm.copy_pages((rdev), (ib), (pe), (src), (count)))
+diff --git a/drivers/gpu/drm/radeon/radeon_asic.c b/drivers/gpu/drm/radeon/radeon_asic.c
+index 121aff6a3b41..ed0e10eee2dc 100644
+--- a/drivers/gpu/drm/radeon/radeon_asic.c
++++ b/drivers/gpu/drm/radeon/radeon_asic.c
+@@ -159,11 +159,13 @@ void radeon_agp_disable(struct radeon_device *rdev)
+ DRM_INFO("Forcing AGP to PCIE mode\n");
+ rdev->flags |= RADEON_IS_PCIE;
+ rdev->asic->gart.tlb_flush = &rv370_pcie_gart_tlb_flush;
++ rdev->asic->gart.get_page_entry = &rv370_pcie_gart_get_page_entry;
+ rdev->asic->gart.set_page = &rv370_pcie_gart_set_page;
+ } else {
+ DRM_INFO("Forcing AGP to PCI mode\n");
+ rdev->flags |= RADEON_IS_PCI;
+ rdev->asic->gart.tlb_flush = &r100_pci_gart_tlb_flush;
++ rdev->asic->gart.get_page_entry = &r100_pci_gart_get_page_entry;
+ rdev->asic->gart.set_page = &r100_pci_gart_set_page;
+ }
+ rdev->mc.gtt_size = radeon_gart_size * 1024 * 1024;
+@@ -199,6 +201,7 @@ static struct radeon_asic r100_asic = {
+ .mc_wait_for_idle = &r100_mc_wait_for_idle,
+ .gart = {
+ .tlb_flush = &r100_pci_gart_tlb_flush,
++ .get_page_entry = &r100_pci_gart_get_page_entry,
+ .set_page = &r100_pci_gart_set_page,
+ },
+ .ring = {
+@@ -265,6 +268,7 @@ static struct radeon_asic r200_asic = {
+ .mc_wait_for_idle = &r100_mc_wait_for_idle,
+ .gart = {
+ .tlb_flush = &r100_pci_gart_tlb_flush,
++ .get_page_entry = &r100_pci_gart_get_page_entry,
+ .set_page = &r100_pci_gart_set_page,
+ },
+ .ring = {
+@@ -359,6 +363,7 @@ static struct radeon_asic r300_asic = {
+ .mc_wait_for_idle = &r300_mc_wait_for_idle,
+ .gart = {
+ .tlb_flush = &r100_pci_gart_tlb_flush,
++ .get_page_entry = &r100_pci_gart_get_page_entry,
+ .set_page = &r100_pci_gart_set_page,
+ },
+ .ring = {
+@@ -425,6 +430,7 @@ static struct radeon_asic r300_asic_pcie = {
+ .mc_wait_for_idle = &r300_mc_wait_for_idle,
+ .gart = {
+ .tlb_flush = &rv370_pcie_gart_tlb_flush,
++ .get_page_entry = &rv370_pcie_gart_get_page_entry,
+ .set_page = &rv370_pcie_gart_set_page,
+ },
+ .ring = {
+@@ -491,6 +497,7 @@ static struct radeon_asic r420_asic = {
+ .mc_wait_for_idle = &r300_mc_wait_for_idle,
+ .gart = {
+ .tlb_flush = &rv370_pcie_gart_tlb_flush,
++ .get_page_entry = &rv370_pcie_gart_get_page_entry,
+ .set_page = &rv370_pcie_gart_set_page,
+ },
+ .ring = {
+@@ -557,6 +564,7 @@ static struct radeon_asic rs400_asic = {
+ .mc_wait_for_idle = &rs400_mc_wait_for_idle,
+ .gart = {
+ .tlb_flush = &rs400_gart_tlb_flush,
++ .get_page_entry = &rs400_gart_get_page_entry,
+ .set_page = &rs400_gart_set_page,
+ },
+ .ring = {
+@@ -623,6 +631,7 @@ static struct radeon_asic rs600_asic = {
+ .mc_wait_for_idle = &rs600_mc_wait_for_idle,
+ .gart = {
+ .tlb_flush = &rs600_gart_tlb_flush,
++ .get_page_entry = &rs600_gart_get_page_entry,
+ .set_page = &rs600_gart_set_page,
+ },
+ .ring = {
+@@ -691,6 +700,7 @@ static struct radeon_asic rs690_asic = {
+ .mc_wait_for_idle = &rs690_mc_wait_for_idle,
+ .gart = {
+ .tlb_flush = &rs400_gart_tlb_flush,
++ .get_page_entry = &rs400_gart_get_page_entry,
+ .set_page = &rs400_gart_set_page,
+ },
+ .ring = {
+@@ -759,6 +769,7 @@ static struct radeon_asic rv515_asic = {
+ .mc_wait_for_idle = &rv515_mc_wait_for_idle,
+ .gart = {
+ .tlb_flush = &rv370_pcie_gart_tlb_flush,
++ .get_page_entry = &rv370_pcie_gart_get_page_entry,
+ .set_page = &rv370_pcie_gart_set_page,
+ },
+ .ring = {
+@@ -825,6 +836,7 @@ static struct radeon_asic r520_asic = {
+ .mc_wait_for_idle = &r520_mc_wait_for_idle,
+ .gart = {
+ .tlb_flush = &rv370_pcie_gart_tlb_flush,
++ .get_page_entry = &rv370_pcie_gart_get_page_entry,
+ .set_page = &rv370_pcie_gart_set_page,
+ },
+ .ring = {
+@@ -919,6 +931,7 @@ static struct radeon_asic r600_asic = {
+ .get_gpu_clock_counter = &r600_get_gpu_clock_counter,
+ .gart = {
+ .tlb_flush = &r600_pcie_gart_tlb_flush,
++ .get_page_entry = &rs600_gart_get_page_entry,
+ .set_page = &rs600_gart_set_page,
+ },
+ .ring = {
+@@ -1004,6 +1017,7 @@ static struct radeon_asic rv6xx_asic = {
+ .get_gpu_clock_counter = &r600_get_gpu_clock_counter,
+ .gart = {
+ .tlb_flush = &r600_pcie_gart_tlb_flush,
++ .get_page_entry = &rs600_gart_get_page_entry,
+ .set_page = &rs600_gart_set_page,
+ },
+ .ring = {
+@@ -1095,6 +1109,7 @@ static struct radeon_asic rs780_asic = {
+ .get_gpu_clock_counter = &r600_get_gpu_clock_counter,
+ .gart = {
+ .tlb_flush = &r600_pcie_gart_tlb_flush,
++ .get_page_entry = &rs600_gart_get_page_entry,
+ .set_page = &rs600_gart_set_page,
+ },
+ .ring = {
+@@ -1199,6 +1214,7 @@ static struct radeon_asic rv770_asic = {
+ .get_gpu_clock_counter = &r600_get_gpu_clock_counter,
+ .gart = {
+ .tlb_flush = &r600_pcie_gart_tlb_flush,
++ .get_page_entry = &rs600_gart_get_page_entry,
+ .set_page = &rs600_gart_set_page,
+ },
+ .ring = {
+@@ -1317,6 +1333,7 @@ static struct radeon_asic evergreen_asic = {
+ .get_gpu_clock_counter = &r600_get_gpu_clock_counter,
+ .gart = {
+ .tlb_flush = &evergreen_pcie_gart_tlb_flush,
++ .get_page_entry = &rs600_gart_get_page_entry,
+ .set_page = &rs600_gart_set_page,
+ },
+ .ring = {
+@@ -1409,6 +1426,7 @@ static struct radeon_asic sumo_asic = {
+ .get_gpu_clock_counter = &r600_get_gpu_clock_counter,
+ .gart = {
+ .tlb_flush = &evergreen_pcie_gart_tlb_flush,
++ .get_page_entry = &rs600_gart_get_page_entry,
+ .set_page = &rs600_gart_set_page,
+ },
+ .ring = {
+@@ -1500,6 +1518,7 @@ static struct radeon_asic btc_asic = {
+ .get_gpu_clock_counter = &r600_get_gpu_clock_counter,
+ .gart = {
+ .tlb_flush = &evergreen_pcie_gart_tlb_flush,
++ .get_page_entry = &rs600_gart_get_page_entry,
+ .set_page = &rs600_gart_set_page,
+ },
+ .ring = {
+@@ -1635,6 +1654,7 @@ static struct radeon_asic cayman_asic = {
+ .get_gpu_clock_counter = &r600_get_gpu_clock_counter,
+ .gart = {
+ .tlb_flush = &cayman_pcie_gart_tlb_flush,
++ .get_page_entry = &rs600_gart_get_page_entry,
+ .set_page = &rs600_gart_set_page,
+ },
+ .vm = {
+@@ -1738,6 +1758,7 @@ static struct radeon_asic trinity_asic = {
+ .get_gpu_clock_counter = &r600_get_gpu_clock_counter,
+ .gart = {
+ .tlb_flush = &cayman_pcie_gart_tlb_flush,
++ .get_page_entry = &rs600_gart_get_page_entry,
+ .set_page = &rs600_gart_set_page,
+ },
+ .vm = {
+@@ -1871,6 +1892,7 @@ static struct radeon_asic si_asic = {
+ .get_gpu_clock_counter = &si_get_gpu_clock_counter,
+ .gart = {
+ .tlb_flush = &si_pcie_gart_tlb_flush,
++ .get_page_entry = &rs600_gart_get_page_entry,
+ .set_page = &rs600_gart_set_page,
+ },
+ .vm = {
+@@ -2032,6 +2054,7 @@ static struct radeon_asic ci_asic = {
+ .get_gpu_clock_counter = &cik_get_gpu_clock_counter,
+ .gart = {
+ .tlb_flush = &cik_pcie_gart_tlb_flush,
++ .get_page_entry = &rs600_gart_get_page_entry,
+ .set_page = &rs600_gart_set_page,
+ },
+ .vm = {
+@@ -2139,6 +2162,7 @@ static struct radeon_asic kv_asic = {
+ .get_gpu_clock_counter = &cik_get_gpu_clock_counter,
+ .gart = {
+ .tlb_flush = &cik_pcie_gart_tlb_flush,
++ .get_page_entry = &rs600_gart_get_page_entry,
+ .set_page = &rs600_gart_set_page,
+ },
+ .vm = {
+diff --git a/drivers/gpu/drm/radeon/radeon_asic.h b/drivers/gpu/drm/radeon/radeon_asic.h
+index d8ace5b28a5b..0c1da2bf1fb4 100644
+--- a/drivers/gpu/drm/radeon/radeon_asic.h
++++ b/drivers/gpu/drm/radeon/radeon_asic.h
+@@ -67,8 +67,9 @@ bool r100_gpu_is_lockup(struct radeon_device *rdev, struct radeon_ring *cp);
+ int r100_asic_reset(struct radeon_device *rdev);
+ u32 r100_get_vblank_counter(struct radeon_device *rdev, int crtc);
+ void r100_pci_gart_tlb_flush(struct radeon_device *rdev);
++uint64_t r100_pci_gart_get_page_entry(uint64_t addr, uint32_t flags);
+ void r100_pci_gart_set_page(struct radeon_device *rdev, unsigned i,
+- uint64_t addr, uint32_t flags);
++ uint64_t entry);
+ void r100_ring_start(struct radeon_device *rdev, struct radeon_ring *ring);
+ int r100_irq_set(struct radeon_device *rdev);
+ int r100_irq_process(struct radeon_device *rdev);
+@@ -172,8 +173,9 @@ extern void r300_fence_ring_emit(struct radeon_device *rdev,
+ struct radeon_fence *fence);
+ extern int r300_cs_parse(struct radeon_cs_parser *p);
+ extern void rv370_pcie_gart_tlb_flush(struct radeon_device *rdev);
++extern uint64_t rv370_pcie_gart_get_page_entry(uint64_t addr, uint32_t flags);
+ extern void rv370_pcie_gart_set_page(struct radeon_device *rdev, unsigned i,
+- uint64_t addr, uint32_t flags);
++ uint64_t entry);
+ extern void rv370_set_pcie_lanes(struct radeon_device *rdev, int lanes);
+ extern int rv370_get_pcie_lanes(struct radeon_device *rdev);
+ extern void r300_set_reg_safe(struct radeon_device *rdev);
+@@ -208,8 +210,9 @@ extern void rs400_fini(struct radeon_device *rdev);
+ extern int rs400_suspend(struct radeon_device *rdev);
+ extern int rs400_resume(struct radeon_device *rdev);
+ void rs400_gart_tlb_flush(struct radeon_device *rdev);
++uint64_t rs400_gart_get_page_entry(uint64_t addr, uint32_t flags);
+ void rs400_gart_set_page(struct radeon_device *rdev, unsigned i,
+- uint64_t addr, uint32_t flags);
++ uint64_t entry);
+ uint32_t rs400_mc_rreg(struct radeon_device *rdev, uint32_t reg);
+ void rs400_mc_wreg(struct radeon_device *rdev, uint32_t reg, uint32_t v);
+ int rs400_gart_init(struct radeon_device *rdev);
+@@ -232,8 +235,9 @@ int rs600_irq_process(struct radeon_device *rdev);
+ void rs600_irq_disable(struct radeon_device *rdev);
+ u32 rs600_get_vblank_counter(struct radeon_device *rdev, int crtc);
+ void rs600_gart_tlb_flush(struct radeon_device *rdev);
++uint64_t rs600_gart_get_page_entry(uint64_t addr, uint32_t flags);
+ void rs600_gart_set_page(struct radeon_device *rdev, unsigned i,
+- uint64_t addr, uint32_t flags);
++ uint64_t entry);
+ uint32_t rs600_mc_rreg(struct radeon_device *rdev, uint32_t reg);
+ void rs600_mc_wreg(struct radeon_device *rdev, uint32_t reg, uint32_t v);
+ void rs600_bandwidth_update(struct radeon_device *rdev);
+diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
+index 995a8b1770dd..bdf263a4a67c 100644
+--- a/drivers/gpu/drm/radeon/radeon_device.c
++++ b/drivers/gpu/drm/radeon/radeon_device.c
+@@ -743,6 +743,8 @@ int radeon_dummy_page_init(struct radeon_device *rdev)
+ rdev->dummy_page.page = NULL;
+ return -ENOMEM;
+ }
++ rdev->dummy_page.entry = radeon_gart_get_page_entry(rdev->dummy_page.addr,
++ RADEON_GART_PAGE_DUMMY);
+ return 0;
+ }
+
+diff --git a/drivers/gpu/drm/radeon/radeon_gart.c b/drivers/gpu/drm/radeon/radeon_gart.c
+index 84146d5901aa..c7be612b60c9 100644
+--- a/drivers/gpu/drm/radeon/radeon_gart.c
++++ b/drivers/gpu/drm/radeon/radeon_gart.c
+@@ -165,6 +165,19 @@ int radeon_gart_table_vram_pin(struct radeon_device *rdev)
+ radeon_bo_unpin(rdev->gart.robj);
+ radeon_bo_unreserve(rdev->gart.robj);
+ rdev->gart.table_addr = gpu_addr;
++
++ if (!r) {
++ int i;
++
++ /* We might have dropped some GART table updates while it wasn't
++ * mapped, restore all entries
++ */
++ for (i = 0; i < rdev->gart.num_gpu_pages; i++)
++ radeon_gart_set_page(rdev, i, rdev->gart.pages_entry[i]);
++ mb();
++ radeon_gart_tlb_flush(rdev);
++ }
++
+ return r;
+ }
+
+@@ -228,7 +241,6 @@ void radeon_gart_unbind(struct radeon_device *rdev, unsigned offset,
+ unsigned t;
+ unsigned p;
+ int i, j;
+- u64 page_base;
+
+ if (!rdev->gart.ready) {
+ WARN(1, "trying to unbind memory from uninitialized GART !\n");
+@@ -240,13 +252,12 @@ void radeon_gart_unbind(struct radeon_device *rdev, unsigned offset,
+ if (rdev->gart.pages[p]) {
+ rdev->gart.pages[p] = NULL;
+ rdev->gart.pages_addr[p] = rdev->dummy_page.addr;
+- page_base = rdev->gart.pages_addr[p];
+ for (j = 0; j < (PAGE_SIZE / RADEON_GPU_PAGE_SIZE); j++, t++) {
++ rdev->gart.pages_entry[t] = rdev->dummy_page.entry;
+ if (rdev->gart.ptr) {
+- radeon_gart_set_page(rdev, t, page_base,
+- RADEON_GART_PAGE_DUMMY);
++ radeon_gart_set_page(rdev, t,
++ rdev->dummy_page.entry);
+ }
+- page_base += RADEON_GPU_PAGE_SIZE;
+ }
+ }
+ }
+@@ -274,7 +285,7 @@ int radeon_gart_bind(struct radeon_device *rdev, unsigned offset,
+ {
+ unsigned t;
+ unsigned p;
+- uint64_t page_base;
++ uint64_t page_base, page_entry;
+ int i, j;
+
+ if (!rdev->gart.ready) {
+@@ -287,12 +298,14 @@ int radeon_gart_bind(struct radeon_device *rdev, unsigned offset,
+ for (i = 0; i < pages; i++, p++) {
+ rdev->gart.pages_addr[p] = dma_addr[i];
+ rdev->gart.pages[p] = pagelist[i];
+- if (rdev->gart.ptr) {
+- page_base = rdev->gart.pages_addr[p];
+- for (j = 0; j < (PAGE_SIZE / RADEON_GPU_PAGE_SIZE); j++, t++) {
+- radeon_gart_set_page(rdev, t, page_base, flags);
+- page_base += RADEON_GPU_PAGE_SIZE;
++ page_base = dma_addr[i];
++ for (j = 0; j < (PAGE_SIZE / RADEON_GPU_PAGE_SIZE); j++, t++) {
++ page_entry = radeon_gart_get_page_entry(page_base, flags);
++ rdev->gart.pages_entry[t] = page_entry;
++ if (rdev->gart.ptr) {
++ radeon_gart_set_page(rdev, t, page_entry);
+ }
++ page_base += RADEON_GPU_PAGE_SIZE;
+ }
+ }
+ mb();
+@@ -340,10 +353,17 @@ int radeon_gart_init(struct radeon_device *rdev)
+ radeon_gart_fini(rdev);
+ return -ENOMEM;
+ }
++ rdev->gart.pages_entry = vmalloc(sizeof(uint64_t) *
++ rdev->gart.num_gpu_pages);
++ if (rdev->gart.pages_entry == NULL) {
++ radeon_gart_fini(rdev);
++ return -ENOMEM;
++ }
+ /* set GART entry to point to the dummy page by default */
+- for (i = 0; i < rdev->gart.num_cpu_pages; i++) {
++ for (i = 0; i < rdev->gart.num_cpu_pages; i++)
+ rdev->gart.pages_addr[i] = rdev->dummy_page.addr;
+- }
++ for (i = 0; i < rdev->gart.num_gpu_pages; i++)
++ rdev->gart.pages_entry[i] = rdev->dummy_page.entry;
+ return 0;
+ }
+
+@@ -356,15 +376,17 @@ int radeon_gart_init(struct radeon_device *rdev)
+ */
+ void radeon_gart_fini(struct radeon_device *rdev)
+ {
+- if (rdev->gart.pages && rdev->gart.pages_addr && rdev->gart.ready) {
++ if (rdev->gart.ready) {
+ /* unbind pages */
+ radeon_gart_unbind(rdev, 0, rdev->gart.num_cpu_pages);
+ }
+ rdev->gart.ready = false;
+ vfree(rdev->gart.pages);
+ vfree(rdev->gart.pages_addr);
++ vfree(rdev->gart.pages_entry);
+ rdev->gart.pages = NULL;
+ rdev->gart.pages_addr = NULL;
++ rdev->gart.pages_entry = NULL;
+
+ radeon_dummy_page_fini(rdev);
+ }
+diff --git a/drivers/gpu/drm/radeon/rs400.c b/drivers/gpu/drm/radeon/rs400.c
+index c5799f16aa4b..34e3235f41d2 100644
+--- a/drivers/gpu/drm/radeon/rs400.c
++++ b/drivers/gpu/drm/radeon/rs400.c
+@@ -212,11 +212,9 @@ void rs400_gart_fini(struct radeon_device *rdev)
+ #define RS400_PTE_WRITEABLE (1 << 2)
+ #define RS400_PTE_READABLE (1 << 3)
+
+-void rs400_gart_set_page(struct radeon_device *rdev, unsigned i,
+- uint64_t addr, uint32_t flags)
++uint64_t rs400_gart_get_page_entry(uint64_t addr, uint32_t flags)
+ {
+ uint32_t entry;
+- u32 *gtt = rdev->gart.ptr;
+
+ entry = (lower_32_bits(addr) & PAGE_MASK) |
+ ((upper_32_bits(addr) & 0xff) << 4);
+@@ -226,8 +224,14 @@ void rs400_gart_set_page(struct radeon_device *rdev, unsigned i,
+ entry |= RS400_PTE_WRITEABLE;
+ if (!(flags & RADEON_GART_PAGE_SNOOP))
+ entry |= RS400_PTE_UNSNOOPED;
+- entry = cpu_to_le32(entry);
+- gtt[i] = entry;
++ return entry;
++}
++
++void rs400_gart_set_page(struct radeon_device *rdev, unsigned i,
++ uint64_t entry)
++{
++ u32 *gtt = rdev->gart.ptr;
++ gtt[i] = cpu_to_le32(lower_32_bits(entry));
+ }
+
+ int rs400_mc_wait_for_idle(struct radeon_device *rdev)
+diff --git a/drivers/gpu/drm/radeon/rs600.c b/drivers/gpu/drm/radeon/rs600.c
+index 9acb1c3c005b..74bce91aecc1 100644
+--- a/drivers/gpu/drm/radeon/rs600.c
++++ b/drivers/gpu/drm/radeon/rs600.c
+@@ -625,11 +625,8 @@ static void rs600_gart_fini(struct radeon_device *rdev)
+ radeon_gart_table_vram_free(rdev);
+ }
+
+-void rs600_gart_set_page(struct radeon_device *rdev, unsigned i,
+- uint64_t addr, uint32_t flags)
++uint64_t rs600_gart_get_page_entry(uint64_t addr, uint32_t flags)
+ {
+- void __iomem *ptr = (void *)rdev->gart.ptr;
+-
+ addr = addr & 0xFFFFFFFFFFFFF000ULL;
+ addr |= R600_PTE_SYSTEM;
+ if (flags & RADEON_GART_PAGE_VALID)
+@@ -640,7 +637,14 @@ void rs600_gart_set_page(struct radeon_device *rdev, unsigned i,
+ addr |= R600_PTE_WRITEABLE;
+ if (flags & RADEON_GART_PAGE_SNOOP)
+ addr |= R600_PTE_SNOOPED;
+- writeq(addr, ptr + (i * 8));
++ return addr;
++}
++
++void rs600_gart_set_page(struct radeon_device *rdev, unsigned i,
++ uint64_t entry)
++{
++ void __iomem *ptr = (void *)rdev->gart.ptr;
++ writeq(entry, ptr + (i * 8));
+ }
+
+ int rs600_irq_set(struct radeon_device *rdev)
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
+index daeca571b42f..810dac80179c 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
+@@ -406,11 +406,9 @@ int vmw_3d_resource_inc(struct vmw_private *dev_priv,
+ if (unlikely(ret != 0))
+ --dev_priv->num_3d_resources;
+ } else if (unhide_svga) {
+- mutex_lock(&dev_priv->hw_mutex);
+ vmw_write(dev_priv, SVGA_REG_ENABLE,
+ vmw_read(dev_priv, SVGA_REG_ENABLE) &
+ ~SVGA_REG_ENABLE_HIDE);
+- mutex_unlock(&dev_priv->hw_mutex);
+ }
+
+ mutex_unlock(&dev_priv->release_mutex);
+@@ -433,13 +431,10 @@ void vmw_3d_resource_dec(struct vmw_private *dev_priv,
+ mutex_lock(&dev_priv->release_mutex);
+ if (unlikely(--dev_priv->num_3d_resources == 0))
+ vmw_release_device(dev_priv);
+- else if (hide_svga) {
+- mutex_lock(&dev_priv->hw_mutex);
++ else if (hide_svga)
+ vmw_write(dev_priv, SVGA_REG_ENABLE,
+ vmw_read(dev_priv, SVGA_REG_ENABLE) |
+ SVGA_REG_ENABLE_HIDE);
+- mutex_unlock(&dev_priv->hw_mutex);
+- }
+
+ n3d = (int32_t) dev_priv->num_3d_resources;
+ mutex_unlock(&dev_priv->release_mutex);
+@@ -600,12 +595,14 @@ static int vmw_driver_load(struct drm_device *dev, unsigned long chipset)
+ dev_priv->dev = dev;
+ dev_priv->vmw_chipset = chipset;
+ dev_priv->last_read_seqno = (uint32_t) -100;
+- mutex_init(&dev_priv->hw_mutex);
+ mutex_init(&dev_priv->cmdbuf_mutex);
+ mutex_init(&dev_priv->release_mutex);
+ mutex_init(&dev_priv->binding_mutex);
+ rwlock_init(&dev_priv->resource_lock);
+ ttm_lock_init(&dev_priv->reservation_sem);
++ spin_lock_init(&dev_priv->hw_lock);
++ spin_lock_init(&dev_priv->waiter_lock);
++ spin_lock_init(&dev_priv->cap_lock);
+
+ for (i = vmw_res_context; i < vmw_res_max; ++i) {
+ idr_init(&dev_priv->res_idr[i]);
+@@ -626,14 +623,11 @@ static int vmw_driver_load(struct drm_device *dev, unsigned long chipset)
+
+ dev_priv->enable_fb = enable_fbdev;
+
+- mutex_lock(&dev_priv->hw_mutex);
+-
+ vmw_write(dev_priv, SVGA_REG_ID, SVGA_ID_2);
+ svga_id = vmw_read(dev_priv, SVGA_REG_ID);
+ if (svga_id != SVGA_ID_2) {
+ ret = -ENOSYS;
+ DRM_ERROR("Unsupported SVGA ID 0x%x\n", svga_id);
+- mutex_unlock(&dev_priv->hw_mutex);
+ goto out_err0;
+ }
+
+@@ -683,10 +677,8 @@ static int vmw_driver_load(struct drm_device *dev, unsigned long chipset)
+ dev_priv->prim_bb_mem = dev_priv->vram_size;
+
+ ret = vmw_dma_masks(dev_priv);
+- if (unlikely(ret != 0)) {
+- mutex_unlock(&dev_priv->hw_mutex);
++ if (unlikely(ret != 0))
+ goto out_err0;
+- }
+
+ /*
+ * Limit back buffer size to VRAM size. Remove this once
+@@ -695,8 +687,6 @@ static int vmw_driver_load(struct drm_device *dev, unsigned long chipset)
+ if (dev_priv->prim_bb_mem > dev_priv->vram_size)
+ dev_priv->prim_bb_mem = dev_priv->vram_size;
+
+- mutex_unlock(&dev_priv->hw_mutex);
+-
+ vmw_print_capabilities(dev_priv->capabilities);
+
+ if (dev_priv->capabilities & SVGA_CAP_GMR2) {
+@@ -1161,9 +1151,7 @@ static int vmw_master_set(struct drm_device *dev,
+ if (unlikely(ret != 0))
+ return ret;
+ vmw_kms_save_vga(dev_priv);
+- mutex_lock(&dev_priv->hw_mutex);
+ vmw_write(dev_priv, SVGA_REG_TRACES, 0);
+- mutex_unlock(&dev_priv->hw_mutex);
+ }
+
+ if (active) {
+@@ -1197,9 +1185,7 @@ out_no_active_lock:
+ if (!dev_priv->enable_fb) {
+ vmw_kms_restore_vga(dev_priv);
+ vmw_3d_resource_dec(dev_priv, true);
+- mutex_lock(&dev_priv->hw_mutex);
+ vmw_write(dev_priv, SVGA_REG_TRACES, 1);
+- mutex_unlock(&dev_priv->hw_mutex);
+ }
+ return ret;
+ }
+@@ -1234,9 +1220,7 @@ static void vmw_master_drop(struct drm_device *dev,
+ DRM_ERROR("Unable to clean VRAM on master drop.\n");
+ vmw_kms_restore_vga(dev_priv);
+ vmw_3d_resource_dec(dev_priv, true);
+- mutex_lock(&dev_priv->hw_mutex);
+ vmw_write(dev_priv, SVGA_REG_TRACES, 1);
+- mutex_unlock(&dev_priv->hw_mutex);
+ }
+
+ dev_priv->active_master = &dev_priv->fbdev_master;
+@@ -1368,10 +1352,8 @@ static void vmw_pm_complete(struct device *kdev)
+ struct drm_device *dev = pci_get_drvdata(pdev);
+ struct vmw_private *dev_priv = vmw_priv(dev);
+
+- mutex_lock(&dev_priv->hw_mutex);
+ vmw_write(dev_priv, SVGA_REG_ID, SVGA_ID_2);
+ (void) vmw_read(dev_priv, SVGA_REG_ID);
+- mutex_unlock(&dev_priv->hw_mutex);
+
+ /**
+ * Reclaim 3d reference held by fbdev and potentially
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
+index 4ee799b43d5d..d26a6daa9719 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
+@@ -399,7 +399,8 @@ struct vmw_private {
+ uint32_t memory_size;
+ bool has_gmr;
+ bool has_mob;
+- struct mutex hw_mutex;
++ spinlock_t hw_lock;
++ spinlock_t cap_lock;
+
+ /*
+ * VGA registers.
+@@ -449,8 +450,9 @@ struct vmw_private {
+ atomic_t marker_seq;
+ wait_queue_head_t fence_queue;
+ wait_queue_head_t fifo_queue;
+- int fence_queue_waiters; /* Protected by hw_mutex */
+- int goal_queue_waiters; /* Protected by hw_mutex */
++ spinlock_t waiter_lock;
++ int fence_queue_waiters; /* Protected by waiter_lock */
++ int goal_queue_waiters; /* Protected by waiter_lock */
+ atomic_t fifo_queue_waiters;
+ uint32_t last_read_seqno;
+ spinlock_t irq_lock;
+@@ -553,20 +555,35 @@ static inline struct vmw_master *vmw_master(struct drm_master *master)
+ return (struct vmw_master *) master->driver_priv;
+ }
+
++/*
++ * The locking here is fine-grained, so that it is performed once
++ * for every read- and write operation. This is of course costly, but we
++ * don't perform much register access in the timing critical paths anyway.
++ * Instead we have the extra benefit of being sure that we don't forget
++ * the hw lock around register accesses.
++ */
+ static inline void vmw_write(struct vmw_private *dev_priv,
+ unsigned int offset, uint32_t value)
+ {
++ unsigned long irq_flags;
++
++ spin_lock_irqsave(&dev_priv->hw_lock, irq_flags);
+ outl(offset, dev_priv->io_start + VMWGFX_INDEX_PORT);
+ outl(value, dev_priv->io_start + VMWGFX_VALUE_PORT);
++ spin_unlock_irqrestore(&dev_priv->hw_lock, irq_flags);
+ }
+
+ static inline uint32_t vmw_read(struct vmw_private *dev_priv,
+ unsigned int offset)
+ {
+- uint32_t val;
++ unsigned long irq_flags;
++ u32 val;
+
++ spin_lock_irqsave(&dev_priv->hw_lock, irq_flags);
+ outl(offset, dev_priv->io_start + VMWGFX_INDEX_PORT);
+ val = inl(dev_priv->io_start + VMWGFX_VALUE_PORT);
++ spin_unlock_irqrestore(&dev_priv->hw_lock, irq_flags);
++
+ return val;
+ }
+
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c
+index b7594cb758af..945f1e0dad92 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c
+@@ -35,7 +35,7 @@ struct vmw_fence_manager {
+ struct vmw_private *dev_priv;
+ spinlock_t lock;
+ struct list_head fence_list;
+- struct work_struct work, ping_work;
++ struct work_struct work;
+ u32 user_fence_size;
+ u32 fence_size;
+ u32 event_fence_action_size;
+@@ -134,14 +134,6 @@ static const char *vmw_fence_get_timeline_name(struct fence *f)
+ return "svga";
+ }
+
+-static void vmw_fence_ping_func(struct work_struct *work)
+-{
+- struct vmw_fence_manager *fman =
+- container_of(work, struct vmw_fence_manager, ping_work);
+-
+- vmw_fifo_ping_host(fman->dev_priv, SVGA_SYNC_GENERIC);
+-}
+-
+ static bool vmw_fence_enable_signaling(struct fence *f)
+ {
+ struct vmw_fence_obj *fence =
+@@ -155,11 +147,7 @@ static bool vmw_fence_enable_signaling(struct fence *f)
+ if (seqno - fence->base.seqno < VMW_FENCE_WRAP)
+ return false;
+
+- if (mutex_trylock(&dev_priv->hw_mutex)) {
+- vmw_fifo_ping_host_locked(dev_priv, SVGA_SYNC_GENERIC);
+- mutex_unlock(&dev_priv->hw_mutex);
+- } else
+- schedule_work(&fman->ping_work);
++ vmw_fifo_ping_host(dev_priv, SVGA_SYNC_GENERIC);
+
+ return true;
+ }
+@@ -305,7 +293,6 @@ struct vmw_fence_manager *vmw_fence_manager_init(struct vmw_private *dev_priv)
+ INIT_LIST_HEAD(&fman->fence_list);
+ INIT_LIST_HEAD(&fman->cleanup_list);
+ INIT_WORK(&fman->work, &vmw_fence_work_func);
+- INIT_WORK(&fman->ping_work, &vmw_fence_ping_func);
+ fman->fifo_down = true;
+ fman->user_fence_size = ttm_round_pot(sizeof(struct vmw_user_fence));
+ fman->fence_size = ttm_round_pot(sizeof(struct vmw_fence_obj));
+@@ -323,7 +310,6 @@ void vmw_fence_manager_takedown(struct vmw_fence_manager *fman)
+ bool lists_empty;
+
+ (void) cancel_work_sync(&fman->work);
+- (void) cancel_work_sync(&fman->ping_work);
+
+ spin_lock_irqsave(&fman->lock, irq_flags);
+ lists_empty = list_empty(&fman->fence_list) &&
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c
+index 09e10aefcd8e..39f2b03888e7 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c
+@@ -44,10 +44,10 @@ bool vmw_fifo_have_3d(struct vmw_private *dev_priv)
+ if (!dev_priv->has_mob)
+ return false;
+
+- mutex_lock(&dev_priv->hw_mutex);
++ spin_lock(&dev_priv->cap_lock);
+ vmw_write(dev_priv, SVGA_REG_DEV_CAP, SVGA3D_DEVCAP_3D);
+ result = vmw_read(dev_priv, SVGA_REG_DEV_CAP);
+- mutex_unlock(&dev_priv->hw_mutex);
++ spin_unlock(&dev_priv->cap_lock);
+
+ return (result != 0);
+ }
+@@ -120,7 +120,6 @@ int vmw_fifo_init(struct vmw_private *dev_priv, struct vmw_fifo_state *fifo)
+ DRM_INFO("height %d\n", vmw_read(dev_priv, SVGA_REG_HEIGHT));
+ DRM_INFO("bpp %d\n", vmw_read(dev_priv, SVGA_REG_BITS_PER_PIXEL));
+
+- mutex_lock(&dev_priv->hw_mutex);
+ dev_priv->enable_state = vmw_read(dev_priv, SVGA_REG_ENABLE);
+ dev_priv->config_done_state = vmw_read(dev_priv, SVGA_REG_CONFIG_DONE);
+ dev_priv->traces_state = vmw_read(dev_priv, SVGA_REG_TRACES);
+@@ -143,7 +142,6 @@ int vmw_fifo_init(struct vmw_private *dev_priv, struct vmw_fifo_state *fifo)
+ mb();
+
+ vmw_write(dev_priv, SVGA_REG_CONFIG_DONE, 1);
+- mutex_unlock(&dev_priv->hw_mutex);
+
+ max = ioread32(fifo_mem + SVGA_FIFO_MAX);
+ min = ioread32(fifo_mem + SVGA_FIFO_MIN);
+@@ -160,31 +158,28 @@ int vmw_fifo_init(struct vmw_private *dev_priv, struct vmw_fifo_state *fifo)
+ return vmw_fifo_send_fence(dev_priv, &dummy);
+ }
+
+-void vmw_fifo_ping_host_locked(struct vmw_private *dev_priv, uint32_t reason)
++void vmw_fifo_ping_host(struct vmw_private *dev_priv, uint32_t reason)
+ {
+ __le32 __iomem *fifo_mem = dev_priv->mmio_virt;
++ static DEFINE_SPINLOCK(ping_lock);
++ unsigned long irq_flags;
+
++ /*
++ * The ping_lock is needed because we don't have an atomic
++ * test-and-set of the SVGA_FIFO_BUSY register.
++ */
++ spin_lock_irqsave(&ping_lock, irq_flags);
+ if (unlikely(ioread32(fifo_mem + SVGA_FIFO_BUSY) == 0)) {
+ iowrite32(1, fifo_mem + SVGA_FIFO_BUSY);
+ vmw_write(dev_priv, SVGA_REG_SYNC, reason);
+ }
+-}
+-
+-void vmw_fifo_ping_host(struct vmw_private *dev_priv, uint32_t reason)
+-{
+- mutex_lock(&dev_priv->hw_mutex);
+-
+- vmw_fifo_ping_host_locked(dev_priv, reason);
+-
+- mutex_unlock(&dev_priv->hw_mutex);
++ spin_unlock_irqrestore(&ping_lock, irq_flags);
+ }
+
+ void vmw_fifo_release(struct vmw_private *dev_priv, struct vmw_fifo_state *fifo)
+ {
+ __le32 __iomem *fifo_mem = dev_priv->mmio_virt;
+
+- mutex_lock(&dev_priv->hw_mutex);
+-
+ vmw_write(dev_priv, SVGA_REG_SYNC, SVGA_SYNC_GENERIC);
+ while (vmw_read(dev_priv, SVGA_REG_BUSY) != 0)
+ ;
+@@ -198,7 +193,6 @@ void vmw_fifo_release(struct vmw_private *dev_priv, struct vmw_fifo_state *fifo)
+ vmw_write(dev_priv, SVGA_REG_TRACES,
+ dev_priv->traces_state);
+
+- mutex_unlock(&dev_priv->hw_mutex);
+ vmw_marker_queue_takedown(&fifo->marker_queue);
+
+ if (likely(fifo->static_buffer != NULL)) {
+@@ -271,7 +265,7 @@ static int vmw_fifo_wait(struct vmw_private *dev_priv,
+ return vmw_fifo_wait_noirq(dev_priv, bytes,
+ interruptible, timeout);
+
+- mutex_lock(&dev_priv->hw_mutex);
++ spin_lock(&dev_priv->waiter_lock);
+ if (atomic_add_return(1, &dev_priv->fifo_queue_waiters) > 0) {
+ spin_lock_irqsave(&dev_priv->irq_lock, irq_flags);
+ outl(SVGA_IRQFLAG_FIFO_PROGRESS,
+@@ -280,7 +274,7 @@ static int vmw_fifo_wait(struct vmw_private *dev_priv,
+ vmw_write(dev_priv, SVGA_REG_IRQMASK, dev_priv->irq_mask);
+ spin_unlock_irqrestore(&dev_priv->irq_lock, irq_flags);
+ }
+- mutex_unlock(&dev_priv->hw_mutex);
++ spin_unlock(&dev_priv->waiter_lock);
+
+ if (interruptible)
+ ret = wait_event_interruptible_timeout
+@@ -296,14 +290,14 @@ static int vmw_fifo_wait(struct vmw_private *dev_priv,
+ else if (likely(ret > 0))
+ ret = 0;
+
+- mutex_lock(&dev_priv->hw_mutex);
++ spin_lock(&dev_priv->waiter_lock);
+ if (atomic_dec_and_test(&dev_priv->fifo_queue_waiters)) {
+ spin_lock_irqsave(&dev_priv->irq_lock, irq_flags);
+ dev_priv->irq_mask &= ~SVGA_IRQFLAG_FIFO_PROGRESS;
+ vmw_write(dev_priv, SVGA_REG_IRQMASK, dev_priv->irq_mask);
+ spin_unlock_irqrestore(&dev_priv->irq_lock, irq_flags);
+ }
+- mutex_unlock(&dev_priv->hw_mutex);
++ spin_unlock(&dev_priv->waiter_lock);
+
+ return ret;
+ }
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c b/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c
+index 37881ecf5d7a..69c8ce23123c 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c
+@@ -135,13 +135,13 @@ static int vmw_fill_compat_cap(struct vmw_private *dev_priv, void *bounce,
+ (pair_offset + max_size * sizeof(SVGA3dCapPair)) / sizeof(u32);
+ compat_cap->header.type = SVGA3DCAPS_RECORD_DEVCAPS;
+
+- mutex_lock(&dev_priv->hw_mutex);
++ spin_lock(&dev_priv->cap_lock);
+ for (i = 0; i < max_size; ++i) {
+ vmw_write(dev_priv, SVGA_REG_DEV_CAP, i);
+ compat_cap->pairs[i][0] = i;
+ compat_cap->pairs[i][1] = vmw_read(dev_priv, SVGA_REG_DEV_CAP);
+ }
+- mutex_unlock(&dev_priv->hw_mutex);
++ spin_unlock(&dev_priv->cap_lock);
+
+ return 0;
+ }
+@@ -191,12 +191,12 @@ int vmw_get_cap_3d_ioctl(struct drm_device *dev, void *data,
+ if (num > SVGA3D_DEVCAP_MAX)
+ num = SVGA3D_DEVCAP_MAX;
+
+- mutex_lock(&dev_priv->hw_mutex);
++ spin_lock(&dev_priv->cap_lock);
+ for (i = 0; i < num; ++i) {
+ vmw_write(dev_priv, SVGA_REG_DEV_CAP, i);
+ *bounce32++ = vmw_read(dev_priv, SVGA_REG_DEV_CAP);
+ }
+- mutex_unlock(&dev_priv->hw_mutex);
++ spin_unlock(&dev_priv->cap_lock);
+ } else if (gb_objects) {
+ ret = vmw_fill_compat_cap(dev_priv, bounce, size);
+ if (unlikely(ret != 0))
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_irq.c b/drivers/gpu/drm/vmwgfx/vmwgfx_irq.c
+index 0c423766c441..9fe9827ee499 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_irq.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_irq.c
+@@ -62,13 +62,8 @@ irqreturn_t vmw_irq_handler(int irq, void *arg)
+
+ static bool vmw_fifo_idle(struct vmw_private *dev_priv, uint32_t seqno)
+ {
+- uint32_t busy;
+
+- mutex_lock(&dev_priv->hw_mutex);
+- busy = vmw_read(dev_priv, SVGA_REG_BUSY);
+- mutex_unlock(&dev_priv->hw_mutex);
+-
+- return (busy == 0);
++ return (vmw_read(dev_priv, SVGA_REG_BUSY) == 0);
+ }
+
+ void vmw_update_seqno(struct vmw_private *dev_priv,
+@@ -184,7 +179,7 @@ int vmw_fallback_wait(struct vmw_private *dev_priv,
+
+ void vmw_seqno_waiter_add(struct vmw_private *dev_priv)
+ {
+- mutex_lock(&dev_priv->hw_mutex);
++ spin_lock(&dev_priv->waiter_lock);
+ if (dev_priv->fence_queue_waiters++ == 0) {
+ unsigned long irq_flags;
+
+@@ -195,12 +190,12 @@ void vmw_seqno_waiter_add(struct vmw_private *dev_priv)
+ vmw_write(dev_priv, SVGA_REG_IRQMASK, dev_priv->irq_mask);
+ spin_unlock_irqrestore(&dev_priv->irq_lock, irq_flags);
+ }
+- mutex_unlock(&dev_priv->hw_mutex);
++ spin_unlock(&dev_priv->waiter_lock);
+ }
+
+ void vmw_seqno_waiter_remove(struct vmw_private *dev_priv)
+ {
+- mutex_lock(&dev_priv->hw_mutex);
++ spin_lock(&dev_priv->waiter_lock);
+ if (--dev_priv->fence_queue_waiters == 0) {
+ unsigned long irq_flags;
+
+@@ -209,13 +204,13 @@ void vmw_seqno_waiter_remove(struct vmw_private *dev_priv)
+ vmw_write(dev_priv, SVGA_REG_IRQMASK, dev_priv->irq_mask);
+ spin_unlock_irqrestore(&dev_priv->irq_lock, irq_flags);
+ }
+- mutex_unlock(&dev_priv->hw_mutex);
++ spin_unlock(&dev_priv->waiter_lock);
+ }
+
+
+ void vmw_goal_waiter_add(struct vmw_private *dev_priv)
+ {
+- mutex_lock(&dev_priv->hw_mutex);
++ spin_lock(&dev_priv->waiter_lock);
+ if (dev_priv->goal_queue_waiters++ == 0) {
+ unsigned long irq_flags;
+
+@@ -226,12 +221,12 @@ void vmw_goal_waiter_add(struct vmw_private *dev_priv)
+ vmw_write(dev_priv, SVGA_REG_IRQMASK, dev_priv->irq_mask);
+ spin_unlock_irqrestore(&dev_priv->irq_lock, irq_flags);
+ }
+- mutex_unlock(&dev_priv->hw_mutex);
++ spin_unlock(&dev_priv->waiter_lock);
+ }
+
+ void vmw_goal_waiter_remove(struct vmw_private *dev_priv)
+ {
+- mutex_lock(&dev_priv->hw_mutex);
++ spin_lock(&dev_priv->waiter_lock);
+ if (--dev_priv->goal_queue_waiters == 0) {
+ unsigned long irq_flags;
+
+@@ -240,7 +235,7 @@ void vmw_goal_waiter_remove(struct vmw_private *dev_priv)
+ vmw_write(dev_priv, SVGA_REG_IRQMASK, dev_priv->irq_mask);
+ spin_unlock_irqrestore(&dev_priv->irq_lock, irq_flags);
+ }
+- mutex_unlock(&dev_priv->hw_mutex);
++ spin_unlock(&dev_priv->waiter_lock);
+ }
+
+ int vmw_wait_seqno(struct vmw_private *dev_priv,
+@@ -315,9 +310,7 @@ void vmw_irq_uninstall(struct drm_device *dev)
+ if (!(dev_priv->capabilities & SVGA_CAP_IRQMASK))
+ return;
+
+- mutex_lock(&dev_priv->hw_mutex);
+ vmw_write(dev_priv, SVGA_REG_IRQMASK, 0);
+- mutex_unlock(&dev_priv->hw_mutex);
+
+ status = inl(dev_priv->io_start + VMWGFX_IRQSTATUS_PORT);
+ outl(status, dev_priv->io_start + VMWGFX_IRQSTATUS_PORT);
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
+index 941a7bc0b791..fddd53335237 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
+@@ -1828,9 +1828,7 @@ vmw_du_connector_detect(struct drm_connector *connector, bool force)
+ struct vmw_private *dev_priv = vmw_priv(dev);
+ struct vmw_display_unit *du = vmw_connector_to_du(connector);
+
+- mutex_lock(&dev_priv->hw_mutex);
+ num_displays = vmw_read(dev_priv, SVGA_REG_NUM_DISPLAYS);
+- mutex_unlock(&dev_priv->hw_mutex);
+
+ return ((vmw_connector_to_du(connector)->unit < num_displays &&
+ du->pref_active) ?
+diff --git a/drivers/hid/hid-rmi.c b/drivers/hid/hid-rmi.c
+index 3cccff73b9b9..a994477bd25a 100644
+--- a/drivers/hid/hid-rmi.c
++++ b/drivers/hid/hid-rmi.c
+@@ -584,11 +584,15 @@ static int rmi_populate_f11(struct hid_device *hdev)
+ bool has_query10 = false;
+ bool has_query11;
+ bool has_query12;
++ bool has_query27;
++ bool has_query28;
++ bool has_query36 = false;
+ bool has_physical_props;
+ bool has_gestures;
+ bool has_rel;
++ bool has_data40 = false;
+ unsigned x_size, y_size;
+- u16 query12_offset;
++ u16 query_offset;
+
+ if (!data->f11.query_base_addr) {
+ hid_err(hdev, "No 2D sensor found, giving up.\n");
+@@ -604,6 +608,8 @@ static int rmi_populate_f11(struct hid_device *hdev)
+ has_query9 = !!(buf[0] & BIT(3));
+ has_query11 = !!(buf[0] & BIT(4));
+ has_query12 = !!(buf[0] & BIT(5));
++ has_query27 = !!(buf[0] & BIT(6));
++ has_query28 = !!(buf[0] & BIT(7));
+
+ /* query 1 to get the max number of fingers */
+ ret = rmi_read(hdev, data->f11.query_base_addr + 1, buf);
+@@ -642,27 +648,27 @@ static int rmi_populate_f11(struct hid_device *hdev)
+ * +1 for query 5 which is present since absolute events are
+ * reported and +1 for query 12.
+ */
+- query12_offset = 6;
++ query_offset = 6;
+
+ if (has_rel)
+- ++query12_offset; /* query 6 is present */
++ ++query_offset; /* query 6 is present */
+
+ if (has_gestures)
+- query12_offset += 2; /* query 7 and 8 are present */
++ query_offset += 2; /* query 7 and 8 are present */
+
+ if (has_query9)
+- ++query12_offset;
++ ++query_offset;
+
+ if (has_query10)
+- ++query12_offset;
++ ++query_offset;
+
+ if (has_query11)
+- ++query12_offset;
++ ++query_offset;
+
+ /* query 12 to know if the physical properties are reported */
+ if (has_query12) {
+ ret = rmi_read(hdev, data->f11.query_base_addr
+- + query12_offset, buf);
++ + query_offset, buf);
+ if (ret) {
+ hid_err(hdev, "can not get query 12: %d.\n", ret);
+ return ret;
+@@ -670,9 +676,10 @@ static int rmi_populate_f11(struct hid_device *hdev)
+ has_physical_props = !!(buf[0] & BIT(5));
+
+ if (has_physical_props) {
++ query_offset += 1;
+ ret = rmi_read_block(hdev,
+ data->f11.query_base_addr
+- + query12_offset + 1, buf, 4);
++ + query_offset, buf, 4);
+ if (ret) {
+ hid_err(hdev, "can not read query 15-18: %d.\n",
+ ret);
+@@ -687,9 +694,45 @@ static int rmi_populate_f11(struct hid_device *hdev)
+
+ hid_info(hdev, "%s: size in mm: %d x %d\n",
+ __func__, data->x_size_mm, data->y_size_mm);
++
++ /*
++ * query 15 - 18 contain the size of the sensor
++ * and query 19 - 26 contain bezel dimensions
++ */
++ query_offset += 12;
++ }
++ }
++
++ if (has_query27)
++ ++query_offset;
++
++ if (has_query28) {
++ ret = rmi_read(hdev, data->f11.query_base_addr
++ + query_offset, buf);
++ if (ret) {
++ hid_err(hdev, "can not get query 28: %d.\n", ret);
++ return ret;
++ }
++
++ has_query36 = !!(buf[0] & BIT(6));
++ }
++
++ if (has_query36) {
++ query_offset += 2;
++ ret = rmi_read(hdev, data->f11.query_base_addr
++ + query_offset, buf);
++ if (ret) {
++ hid_err(hdev, "can not get query 36: %d.\n", ret);
++ return ret;
+ }
++
++ has_data40 = !!(buf[0] & BIT(5));
+ }
+
++
++ if (has_data40)
++ data->f11.report_size += data->max_fingers * 2;
++
+ /*
+ * retrieve the ctrl registers
+ * the ctrl register has a size of 20 but a fw bug split it into 16 + 4,
+diff --git a/drivers/i2c/busses/i2c-s3c2410.c b/drivers/i2c/busses/i2c-s3c2410.c
+index 65244774bfa3..c127af99a0e0 100644
+--- a/drivers/i2c/busses/i2c-s3c2410.c
++++ b/drivers/i2c/busses/i2c-s3c2410.c
+@@ -778,14 +778,16 @@ static int s3c24xx_i2c_xfer(struct i2c_adapter *adap,
+ int ret;
+
+ pm_runtime_get_sync(&adap->dev);
+- clk_prepare_enable(i2c->clk);
++ ret = clk_enable(i2c->clk);
++ if (ret)
++ return ret;
+
+ for (retry = 0; retry < adap->retries; retry++) {
+
+ ret = s3c24xx_i2c_doxfer(i2c, msgs, num);
+
+ if (ret != -EAGAIN) {
+- clk_disable_unprepare(i2c->clk);
++ clk_disable(i2c->clk);
+ pm_runtime_put(&adap->dev);
+ return ret;
+ }
+@@ -795,7 +797,7 @@ static int s3c24xx_i2c_xfer(struct i2c_adapter *adap,
+ udelay(100);
+ }
+
+- clk_disable_unprepare(i2c->clk);
++ clk_disable(i2c->clk);
+ pm_runtime_put(&adap->dev);
+ return -EREMOTEIO;
+ }
+@@ -1174,7 +1176,7 @@ static int s3c24xx_i2c_probe(struct platform_device *pdev)
+
+ clk_prepare_enable(i2c->clk);
+ ret = s3c24xx_i2c_init(i2c);
+- clk_disable_unprepare(i2c->clk);
++ clk_disable(i2c->clk);
+ if (ret != 0) {
+ dev_err(&pdev->dev, "I2C controller init failed\n");
+ return ret;
+@@ -1187,6 +1189,7 @@ static int s3c24xx_i2c_probe(struct platform_device *pdev)
+ i2c->irq = ret = platform_get_irq(pdev, 0);
+ if (ret <= 0) {
+ dev_err(&pdev->dev, "cannot find IRQ\n");
++ clk_unprepare(i2c->clk);
+ return ret;
+ }
+
+@@ -1195,6 +1198,7 @@ static int s3c24xx_i2c_probe(struct platform_device *pdev)
+
+ if (ret != 0) {
+ dev_err(&pdev->dev, "cannot claim IRQ %d\n", i2c->irq);
++ clk_unprepare(i2c->clk);
+ return ret;
+ }
+ }
+@@ -1202,6 +1206,7 @@ static int s3c24xx_i2c_probe(struct platform_device *pdev)
+ ret = s3c24xx_i2c_register_cpufreq(i2c);
+ if (ret < 0) {
+ dev_err(&pdev->dev, "failed to register cpufreq notifier\n");
++ clk_unprepare(i2c->clk);
+ return ret;
+ }
+
+@@ -1218,6 +1223,7 @@ static int s3c24xx_i2c_probe(struct platform_device *pdev)
+ if (ret < 0) {
+ dev_err(&pdev->dev, "failed to add bus to i2c core\n");
+ s3c24xx_i2c_deregister_cpufreq(i2c);
++ clk_unprepare(i2c->clk);
+ return ret;
+ }
+
+@@ -1239,6 +1245,8 @@ static int s3c24xx_i2c_remove(struct platform_device *pdev)
+ {
+ struct s3c24xx_i2c *i2c = platform_get_drvdata(pdev);
+
++ clk_unprepare(i2c->clk);
++
+ pm_runtime_disable(&i2c->adap.dev);
+ pm_runtime_disable(&pdev->dev);
+
+@@ -1267,10 +1275,13 @@ static int s3c24xx_i2c_resume_noirq(struct device *dev)
+ {
+ struct platform_device *pdev = to_platform_device(dev);
+ struct s3c24xx_i2c *i2c = platform_get_drvdata(pdev);
++ int ret;
+
+- clk_prepare_enable(i2c->clk);
++ ret = clk_enable(i2c->clk);
++ if (ret)
++ return ret;
+ s3c24xx_i2c_init(i2c);
+- clk_disable_unprepare(i2c->clk);
++ clk_disable(i2c->clk);
+ i2c->suspended = 0;
+
+ return 0;
+diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c
+index 77ecf6d32237..6e22682c8255 100644
+--- a/drivers/input/mouse/elantech.c
++++ b/drivers/input/mouse/elantech.c
+@@ -1097,6 +1097,8 @@ static int elantech_get_resolution_v4(struct psmouse *psmouse,
+ * Asus UX31 0x361f00 20, 15, 0e clickpad
+ * Asus UX32VD 0x361f02 00, 15, 0e clickpad
+ * Avatar AVIU-145A2 0x361f00 ? clickpad
++ * Fujitsu LIFEBOOK E544 0x470f00 d0, 12, 09 2 hw buttons
++ * Fujitsu LIFEBOOK E554 0x570f01 40, 14, 0c 2 hw buttons
+ * Fujitsu H730 0x570f00 c0, 14, 0c 3 hw buttons (**)
+ * Gigabyte U2442 0x450f01 58, 17, 0c 2 hw buttons
+ * Lenovo L430 0x350f02 b9, 15, 0c 2 hw buttons (*)
+@@ -1475,6 +1477,20 @@ static const struct dmi_system_id elantech_dmi_force_crc_enabled[] = {
+ DMI_MATCH(DMI_PRODUCT_NAME, "CELSIUS H730"),
+ },
+ },
++ {
++ /* Fujitsu LIFEBOOK E554 does not work with crc_enabled == 0 */
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK E554"),
++ },
++ },
++ {
++ /* Fujitsu LIFEBOOK E544 does not work with crc_enabled == 0 */
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK E544"),
++ },
++ },
+ #endif
+ { }
+ };
+diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
+index f9472920d986..23e26e0768b5 100644
+--- a/drivers/input/mouse/synaptics.c
++++ b/drivers/input/mouse/synaptics.c
+@@ -135,8 +135,9 @@ static const struct min_max_quirk min_max_pnpid_table[] = {
+ 1232, 5710, 1156, 4696
+ },
+ {
+- (const char * const []){"LEN0034", "LEN0036", "LEN0039",
+- "LEN2002", "LEN2004", NULL},
++ (const char * const []){"LEN0034", "LEN0036", "LEN0037",
++ "LEN0039", "LEN2002", "LEN2004",
++ NULL},
+ 1024, 5112, 2024, 4832
+ },
+ {
+@@ -165,7 +166,7 @@ static const char * const topbuttonpad_pnp_ids[] = {
+ "LEN0034", /* T431s, L440, L540, T540, W540, X1 Carbon 2nd */
+ "LEN0035", /* X240 */
+ "LEN0036", /* T440 */
+- "LEN0037",
++ "LEN0037", /* X1 Carbon 2nd */
+ "LEN0038",
+ "LEN0039", /* T440s */
+ "LEN0041",
+diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h
+index 1a858c86a72b..39bec4715f2c 100644
+--- a/drivers/input/serio/i8042-x86ia64io.h
++++ b/drivers/input/serio/i8042-x86ia64io.h
+@@ -152,6 +152,14 @@ static const struct dmi_system_id __initconst i8042_dmi_noloop_table[] = {
+ },
+ },
+ {
++ /* Medion Akoya E7225 */
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Medion"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Akoya E7225"),
++ DMI_MATCH(DMI_PRODUCT_VERSION, "1.0"),
++ },
++ },
++ {
+ /* Blue FB5601 */
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "blue"),
+diff --git a/drivers/md/dm-cache-metadata.c b/drivers/md/dm-cache-metadata.c
+index 97e3a6c07e31..1e64e9c50d85 100644
+--- a/drivers/md/dm-cache-metadata.c
++++ b/drivers/md/dm-cache-metadata.c
+@@ -683,7 +683,7 @@ static struct dm_cache_metadata *metadata_open(struct block_device *bdev,
+ cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
+ if (!cmd) {
+ DMERR("could not allocate metadata struct");
+- return NULL;
++ return ERR_PTR(-ENOMEM);
+ }
+
+ atomic_set(&cmd->ref_count, 1);
+@@ -745,7 +745,7 @@ static struct dm_cache_metadata *lookup_or_open(struct block_device *bdev,
+ return cmd;
+
+ cmd = metadata_open(bdev, data_block_size, may_format_device, policy_hint_size);
+- if (cmd) {
++ if (!IS_ERR(cmd)) {
+ mutex_lock(&table_lock);
+ cmd2 = lookup(bdev);
+ if (cmd2) {
+@@ -780,9 +780,10 @@ struct dm_cache_metadata *dm_cache_metadata_open(struct block_device *bdev,
+ {
+ struct dm_cache_metadata *cmd = lookup_or_open(bdev, data_block_size,
+ may_format_device, policy_hint_size);
+- if (cmd && !same_params(cmd, data_block_size)) {
++
++ if (!IS_ERR(cmd) && !same_params(cmd, data_block_size)) {
+ dm_cache_metadata_close(cmd);
+- return NULL;
++ return ERR_PTR(-EINVAL);
+ }
+
+ return cmd;
+diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c
+index aae19133cfac..ac6b0ff161ea 100644
+--- a/drivers/md/dm-thin.c
++++ b/drivers/md/dm-thin.c
+@@ -2978,6 +2978,12 @@ static int pool_message(struct dm_target *ti, unsigned argc, char **argv)
+ struct pool_c *pt = ti->private;
+ struct pool *pool = pt->pool;
+
++ if (get_pool_mode(pool) >= PM_READ_ONLY) {
++ DMERR("%s: unable to service pool target messages in READ_ONLY or FAIL mode",
++ dm_device_name(pool->pool_md));
++ return -EINVAL;
++ }
++
+ if (!strcasecmp(argv[0], "create_thin"))
+ r = process_create_thin_mesg(argc, argv, pool);
+
+diff --git a/drivers/net/can/c_can/c_can.c b/drivers/net/can/c_can/c_can.c
+index 8e78bb48f5a4..60285820f7b4 100644
+--- a/drivers/net/can/c_can/c_can.c
++++ b/drivers/net/can/c_can/c_can.c
+@@ -611,6 +611,10 @@ static void c_can_stop(struct net_device *dev)
+ struct c_can_priv *priv = netdev_priv(dev);
+
+ c_can_irq_control(priv, false);
++
++ /* put ctrl to init on stop to end ongoing transmission */
++ priv->write_reg(priv, C_CAN_CTRL_REG, CONTROL_INIT);
++
+ priv->can.state = CAN_STATE_STOPPED;
+ }
+
+diff --git a/drivers/net/can/usb/kvaser_usb.c b/drivers/net/can/usb/kvaser_usb.c
+index cc7bfc0c0a71..8b255e777cc7 100644
+--- a/drivers/net/can/usb/kvaser_usb.c
++++ b/drivers/net/can/usb/kvaser_usb.c
+@@ -587,7 +587,7 @@ static int kvaser_usb_simple_msg_async(struct kvaser_usb_net_priv *priv,
+ usb_sndbulkpipe(dev->udev,
+ dev->bulk_out->bEndpointAddress),
+ buf, msg->len,
+- kvaser_usb_simple_msg_callback, priv);
++ kvaser_usb_simple_msg_callback, netdev);
+ usb_anchor_urb(urb, &priv->tx_submitted);
+
+ err = usb_submit_urb(urb, GFP_ATOMIC);
+@@ -662,11 +662,6 @@ static void kvaser_usb_rx_error(const struct kvaser_usb *dev,
+ priv = dev->nets[channel];
+ stats = &priv->netdev->stats;
+
+- if (status & M16C_STATE_BUS_RESET) {
+- kvaser_usb_unlink_tx_urbs(priv);
+- return;
+- }
+-
+ skb = alloc_can_err_skb(priv->netdev, &cf);
+ if (!skb) {
+ stats->rx_dropped++;
+@@ -677,7 +672,7 @@ static void kvaser_usb_rx_error(const struct kvaser_usb *dev,
+
+ netdev_dbg(priv->netdev, "Error status: 0x%02x\n", status);
+
+- if (status & M16C_STATE_BUS_OFF) {
++ if (status & (M16C_STATE_BUS_OFF | M16C_STATE_BUS_RESET)) {
+ cf->can_id |= CAN_ERR_BUSOFF;
+
+ priv->can.can_stats.bus_off++;
+@@ -703,9 +698,7 @@ static void kvaser_usb_rx_error(const struct kvaser_usb *dev,
+ }
+
+ new_state = CAN_STATE_ERROR_PASSIVE;
+- }
+-
+- if (status == M16C_STATE_BUS_ERROR) {
++ } else if (status & M16C_STATE_BUS_ERROR) {
+ if ((priv->can.state < CAN_STATE_ERROR_WARNING) &&
+ ((txerr >= 96) || (rxerr >= 96))) {
+ cf->can_id |= CAN_ERR_CRTL;
+@@ -715,7 +708,8 @@ static void kvaser_usb_rx_error(const struct kvaser_usb *dev,
+
+ priv->can.can_stats.error_warning++;
+ new_state = CAN_STATE_ERROR_WARNING;
+- } else if (priv->can.state > CAN_STATE_ERROR_ACTIVE) {
++ } else if ((priv->can.state > CAN_STATE_ERROR_ACTIVE) &&
++ ((txerr < 96) && (rxerr < 96))) {
+ cf->can_id |= CAN_ERR_PROT;
+ cf->data[2] = CAN_ERR_PROT_ACTIVE;
+
+@@ -1593,7 +1587,7 @@ static int kvaser_usb_probe(struct usb_interface *intf,
+ {
+ struct kvaser_usb *dev;
+ int err = -ENOMEM;
+- int i;
++ int i, retry = 3;
+
+ dev = devm_kzalloc(&intf->dev, sizeof(*dev), GFP_KERNEL);
+ if (!dev)
+@@ -1611,7 +1605,15 @@ static int kvaser_usb_probe(struct usb_interface *intf,
+
+ usb_set_intfdata(intf, dev);
+
+- err = kvaser_usb_get_software_info(dev);
++ /* On some x86 laptops, plugging a Kvaser device again after
++ * an unplug makes the firmware always ignore the very first
++ * command. For such a case, provide some room for retries
++ * instead of completely exiting the driver.
++ */
++ do {
++ err = kvaser_usb_get_software_info(dev);
++ } while (--retry && err == -ETIMEDOUT);
++
+ if (err) {
+ dev_err(&intf->dev,
+ "Cannot get software infos, error %d\n", err);
+diff --git a/drivers/net/ethernet/ti/cpsw.c b/drivers/net/ethernet/ti/cpsw.c
+index 64d1cef4cda1..48645504106e 100644
+--- a/drivers/net/ethernet/ti/cpsw.c
++++ b/drivers/net/ethernet/ti/cpsw.c
+@@ -1676,6 +1676,19 @@ static int cpsw_ndo_vlan_rx_add_vid(struct net_device *ndev,
+ if (vid == priv->data.default_vlan)
+ return 0;
+
++ if (priv->data.dual_emac) {
++ /* In dual EMAC, reserved VLAN id should not be used for
++ * creating VLAN interfaces as this can break the dual
++ * EMAC port separation
++ */
++ int i;
++
++ for (i = 0; i < priv->data.slaves; i++) {
++ if (vid == priv->slaves[i].port_vlan)
++ return -EINVAL;
++ }
++ }
++
+ dev_info(priv->dev, "Adding vlanid %d to vlan filter\n", vid);
+ return cpsw_add_vlan_ale_entry(priv, vid);
+ }
+@@ -1689,6 +1702,15 @@ static int cpsw_ndo_vlan_rx_kill_vid(struct net_device *ndev,
+ if (vid == priv->data.default_vlan)
+ return 0;
+
++ if (priv->data.dual_emac) {
++ int i;
++
++ for (i = 0; i < priv->data.slaves; i++) {
++ if (vid == priv->slaves[i].port_vlan)
++ return -EINVAL;
++ }
++ }
++
+ dev_info(priv->dev, "removing vlanid %d from vlan filter\n", vid);
+ ret = cpsw_ale_del_vlan(priv->ale, vid, 0);
+ if (ret != 0)
+diff --git a/drivers/pinctrl/pinctrl-at91.c b/drivers/pinctrl/pinctrl-at91.c
+index 354a81d40925..d6380c187db6 100644
+--- a/drivers/pinctrl/pinctrl-at91.c
++++ b/drivers/pinctrl/pinctrl-at91.c
+@@ -179,7 +179,7 @@ struct at91_pinctrl {
+ struct device *dev;
+ struct pinctrl_dev *pctl;
+
+- int nbanks;
++ int nactive_banks;
+
+ uint32_t *mux_mask;
+ int nmux;
+@@ -655,12 +655,18 @@ static int pin_check_config(struct at91_pinctrl *info, const char *name,
+ int mux;
+
+ /* check if it's a valid config */
+- if (pin->bank >= info->nbanks) {
++ if (pin->bank >= gpio_banks) {
+ dev_err(info->dev, "%s: pin conf %d bank_id %d >= nbanks %d\n",
+- name, index, pin->bank, info->nbanks);
++ name, index, pin->bank, gpio_banks);
+ return -EINVAL;
+ }
+
++ if (!gpio_chips[pin->bank]) {
++ dev_err(info->dev, "%s: pin conf %d bank_id %d not enabled\n",
++ name, index, pin->bank);
++ return -ENXIO;
++ }
++
+ if (pin->pin >= MAX_NB_GPIO_PER_BANK) {
+ dev_err(info->dev, "%s: pin conf %d pin_bank_id %d >= %d\n",
+ name, index, pin->pin, MAX_NB_GPIO_PER_BANK);
+@@ -983,7 +989,8 @@ static void at91_pinctrl_child_count(struct at91_pinctrl *info,
+
+ for_each_child_of_node(np, child) {
+ if (of_device_is_compatible(child, gpio_compat)) {
+- info->nbanks++;
++ if (of_device_is_available(child))
++ info->nactive_banks++;
+ } else {
+ info->nfunctions++;
+ info->ngroups += of_get_child_count(child);
+@@ -1005,11 +1012,11 @@ static int at91_pinctrl_mux_mask(struct at91_pinctrl *info,
+ }
+
+ size /= sizeof(*list);
+- if (!size || size % info->nbanks) {
+- dev_err(info->dev, "wrong mux mask array should be by %d\n", info->nbanks);
++ if (!size || size % gpio_banks) {
++ dev_err(info->dev, "wrong mux mask array should be by %d\n", gpio_banks);
+ return -EINVAL;
+ }
+- info->nmux = size / info->nbanks;
++ info->nmux = size / gpio_banks;
+
+ info->mux_mask = devm_kzalloc(info->dev, sizeof(u32) * size, GFP_KERNEL);
+ if (!info->mux_mask) {
+@@ -1133,7 +1140,7 @@ static int at91_pinctrl_probe_dt(struct platform_device *pdev,
+ of_match_device(at91_pinctrl_of_match, &pdev->dev)->data;
+ at91_pinctrl_child_count(info, np);
+
+- if (info->nbanks < 1) {
++ if (gpio_banks < 1) {
+ dev_err(&pdev->dev, "you need to specify at least one gpio-controller\n");
+ return -EINVAL;
+ }
+@@ -1146,7 +1153,7 @@ static int at91_pinctrl_probe_dt(struct platform_device *pdev,
+
+ dev_dbg(&pdev->dev, "mux-mask\n");
+ tmp = info->mux_mask;
+- for (i = 0; i < info->nbanks; i++) {
++ for (i = 0; i < gpio_banks; i++) {
+ for (j = 0; j < info->nmux; j++, tmp++) {
+ dev_dbg(&pdev->dev, "%d:%d\t0x%x\n", i, j, tmp[0]);
+ }
+@@ -1164,7 +1171,7 @@ static int at91_pinctrl_probe_dt(struct platform_device *pdev,
+ if (!info->groups)
+ return -ENOMEM;
+
+- dev_dbg(&pdev->dev, "nbanks = %d\n", info->nbanks);
++ dev_dbg(&pdev->dev, "nbanks = %d\n", gpio_banks);
+ dev_dbg(&pdev->dev, "nfunctions = %d\n", info->nfunctions);
+ dev_dbg(&pdev->dev, "ngroups = %d\n", info->ngroups);
+
+@@ -1187,7 +1194,7 @@ static int at91_pinctrl_probe(struct platform_device *pdev)
+ {
+ struct at91_pinctrl *info;
+ struct pinctrl_pin_desc *pdesc;
+- int ret, i, j, k;
++ int ret, i, j, k, ngpio_chips_enabled = 0;
+
+ info = devm_kzalloc(&pdev->dev, sizeof(*info), GFP_KERNEL);
+ if (!info)
+@@ -1202,23 +1209,27 @@ static int at91_pinctrl_probe(struct platform_device *pdev)
+ * to obtain references to the struct gpio_chip * for them, and we
+ * need this to proceed.
+ */
+- for (i = 0; i < info->nbanks; i++) {
+- if (!gpio_chips[i]) {
+- dev_warn(&pdev->dev, "GPIO chip %d not registered yet\n", i);
+- devm_kfree(&pdev->dev, info);
+- return -EPROBE_DEFER;
+- }
++ for (i = 0; i < gpio_banks; i++)
++ if (gpio_chips[i])
++ ngpio_chips_enabled++;
++
++ if (ngpio_chips_enabled < info->nactive_banks) {
++ dev_warn(&pdev->dev,
++ "All GPIO chips are not registered yet (%d/%d)\n",
++ ngpio_chips_enabled, info->nactive_banks);
++ devm_kfree(&pdev->dev, info);
++ return -EPROBE_DEFER;
+ }
+
+ at91_pinctrl_desc.name = dev_name(&pdev->dev);
+- at91_pinctrl_desc.npins = info->nbanks * MAX_NB_GPIO_PER_BANK;
++ at91_pinctrl_desc.npins = gpio_banks * MAX_NB_GPIO_PER_BANK;
+ at91_pinctrl_desc.pins = pdesc =
+ devm_kzalloc(&pdev->dev, sizeof(*pdesc) * at91_pinctrl_desc.npins, GFP_KERNEL);
+
+ if (!at91_pinctrl_desc.pins)
+ return -ENOMEM;
+
+- for (i = 0 , k = 0; i < info->nbanks; i++) {
++ for (i = 0, k = 0; i < gpio_banks; i++) {
+ for (j = 0; j < MAX_NB_GPIO_PER_BANK; j++, k++) {
+ pdesc->number = k;
+ pdesc->name = kasprintf(GFP_KERNEL, "pio%c%d", i + 'A', j);
+@@ -1236,8 +1247,9 @@ static int at91_pinctrl_probe(struct platform_device *pdev)
+ }
+
+ /* We will handle a range of GPIO pins */
+- for (i = 0; i < info->nbanks; i++)
+- pinctrl_add_gpio_range(info->pctl, &gpio_chips[i]->range);
++ for (i = 0; i < gpio_banks; i++)
++ if (gpio_chips[i])
++ pinctrl_add_gpio_range(info->pctl, &gpio_chips[i]->range);
+
+ dev_info(&pdev->dev, "initialized AT91 pinctrl driver\n");
+
+@@ -1614,9 +1626,10 @@ static void gpio_irq_handler(unsigned irq, struct irq_desc *desc)
+ static int at91_gpio_of_irq_setup(struct platform_device *pdev,
+ struct at91_gpio_chip *at91_gpio)
+ {
++ struct gpio_chip *gpiochip_prev = NULL;
+ struct at91_gpio_chip *prev = NULL;
+ struct irq_data *d = irq_get_irq_data(at91_gpio->pioc_virq);
+- int ret;
++ int ret, i;
+
+ at91_gpio->pioc_hwirq = irqd_to_hwirq(d);
+
+@@ -1642,24 +1655,33 @@ static int at91_gpio_of_irq_setup(struct platform_device *pdev,
+ return ret;
+ }
+
+- /* Setup chained handler */
+- if (at91_gpio->pioc_idx)
+- prev = gpio_chips[at91_gpio->pioc_idx - 1];
+-
+ /* The top level handler handles one bank of GPIOs, except
+ * on some SoC it can handle up to three...
+ * We only set up the handler for the first of the list.
+ */
+- if (prev && prev->next == at91_gpio)
++ gpiochip_prev = irq_get_handler_data(at91_gpio->pioc_virq);
++ if (!gpiochip_prev) {
++ /* Then register the chain on the parent IRQ */
++ gpiochip_set_chained_irqchip(&at91_gpio->chip,
++ &gpio_irqchip,
++ at91_gpio->pioc_virq,
++ gpio_irq_handler);
+ return 0;
++ }
+
+- /* Then register the chain on the parent IRQ */
+- gpiochip_set_chained_irqchip(&at91_gpio->chip,
+- &gpio_irqchip,
+- at91_gpio->pioc_virq,
+- gpio_irq_handler);
++ prev = container_of(gpiochip_prev, struct at91_gpio_chip, chip);
+
+- return 0;
++ /* we can only have 2 banks before */
++ for (i = 0; i < 2; i++) {
++ if (prev->next) {
++ prev = prev->next;
++ } else {
++ prev->next = at91_gpio;
++ return 0;
++ }
++ }
++
++ return -EINVAL;
+ }
+
+ /* This structure is replicated for each GPIO block allocated at probe time */
+@@ -1676,24 +1698,6 @@ static struct gpio_chip at91_gpio_template = {
+ .ngpio = MAX_NB_GPIO_PER_BANK,
+ };
+
+-static void at91_gpio_probe_fixup(void)
+-{
+- unsigned i;
+- struct at91_gpio_chip *at91_gpio, *last = NULL;
+-
+- for (i = 0; i < gpio_banks; i++) {
+- at91_gpio = gpio_chips[i];
+-
+- /*
+- * GPIO controller are grouped on some SoC:
+- * PIOC, PIOD and PIOE can share the same IRQ line
+- */
+- if (last && last->pioc_virq == at91_gpio->pioc_virq)
+- last->next = at91_gpio;
+- last = at91_gpio;
+- }
+-}
+-
+ static struct of_device_id at91_gpio_of_match[] = {
+ { .compatible = "atmel,at91sam9x5-gpio", .data = &at91sam9x5_ops, },
+ { .compatible = "atmel,at91rm9200-gpio", .data = &at91rm9200_ops },
+@@ -1806,8 +1810,6 @@ static int at91_gpio_probe(struct platform_device *pdev)
+ gpio_chips[alias_idx] = at91_chip;
+ gpio_banks = max(gpio_banks, alias_idx + 1);
+
+- at91_gpio_probe_fixup();
+-
+ ret = at91_gpio_of_irq_setup(pdev, at91_chip);
+ if (ret)
+ goto irq_setup_err;
+diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
+index cd87c0c37034..fc6fb5422b6f 100644
+--- a/drivers/regulator/core.c
++++ b/drivers/regulator/core.c
+@@ -1488,7 +1488,7 @@ struct regulator *regulator_get_optional(struct device *dev, const char *id)
+ }
+ EXPORT_SYMBOL_GPL(regulator_get_optional);
+
+-/* Locks held by regulator_put() */
++/* regulator_list_mutex lock held by regulator_put() */
+ static void _regulator_put(struct regulator *regulator)
+ {
+ struct regulator_dev *rdev;
+@@ -1503,12 +1503,14 @@ static void _regulator_put(struct regulator *regulator)
+ /* remove any sysfs entries */
+ if (regulator->dev)
+ sysfs_remove_link(&rdev->dev.kobj, regulator->supply_name);
++ mutex_lock(&rdev->mutex);
+ kfree(regulator->supply_name);
+ list_del(®ulator->list);
+ kfree(regulator);
+
+ rdev->open_count--;
+ rdev->exclusive = 0;
++ mutex_unlock(&rdev->mutex);
+
+ module_put(rdev->owner);
+ }
+diff --git a/drivers/rtc/rtc-s5m.c b/drivers/rtc/rtc-s5m.c
+index 8754c33361e8..28799d39db8e 100644
+--- a/drivers/rtc/rtc-s5m.c
++++ b/drivers/rtc/rtc-s5m.c
+@@ -832,6 +832,7 @@ static SIMPLE_DEV_PM_OPS(s5m_rtc_pm_ops, s5m_rtc_suspend, s5m_rtc_resume);
+ static const struct platform_device_id s5m_rtc_id[] = {
+ { "s5m-rtc", S5M8767X },
+ { "s2mps14-rtc", S2MPS14X },
++ { },
+ };
+
+ static struct platform_driver s5m_rtc_driver = {
+diff --git a/drivers/spi/spi-dw-mid.c b/drivers/spi/spi-dw-mid.c
+index 46c6d58e1fda..efff55537d8a 100644
+--- a/drivers/spi/spi-dw-mid.c
++++ b/drivers/spi/spi-dw-mid.c
+@@ -219,7 +219,6 @@ int dw_spi_mid_init(struct dw_spi *dws)
+ iounmap(clk_reg);
+
+ dws->num_cs = 16;
+- dws->fifo_len = 40; /* FIFO has 40 words buffer */
+
+ #ifdef CONFIG_SPI_DW_MID_DMA
+ dws->dma_priv = kzalloc(sizeof(struct mid_dma), GFP_KERNEL);
+diff --git a/drivers/spi/spi-dw.c b/drivers/spi/spi-dw.c
+index d0d5542efc06..1a0f266c4268 100644
+--- a/drivers/spi/spi-dw.c
++++ b/drivers/spi/spi-dw.c
+@@ -621,13 +621,13 @@ static void spi_hw_init(struct dw_spi *dws)
+ if (!dws->fifo_len) {
+ u32 fifo;
+
+- for (fifo = 2; fifo <= 257; fifo++) {
++ for (fifo = 2; fifo <= 256; fifo++) {
+ dw_writew(dws, DW_SPI_TXFLTR, fifo);
+ if (fifo != dw_readw(dws, DW_SPI_TXFLTR))
+ break;
+ }
+
+- dws->fifo_len = (fifo == 257) ? 0 : fifo;
++ dws->fifo_len = (fifo == 2) ? 0 : fifo - 1;
+ dw_writew(dws, DW_SPI_TXFLTR, 0);
+ }
+ }
+diff --git a/drivers/spi/spi-pxa2xx.c b/drivers/spi/spi-pxa2xx.c
+index 9e9e0f971e6c..d95656d05eb6 100644
+--- a/drivers/spi/spi-pxa2xx.c
++++ b/drivers/spi/spi-pxa2xx.c
+@@ -402,8 +402,8 @@ static void giveback(struct driver_data *drv_data)
+ cs_deassert(drv_data);
+ }
+
+- spi_finalize_current_message(drv_data->master);
+ drv_data->cur_chip = NULL;
++ spi_finalize_current_message(drv_data->master);
+ }
+
+ static void reset_sccr1(struct driver_data *drv_data)
+diff --git a/drivers/staging/lustre/lustre/llite/vvp_io.c b/drivers/staging/lustre/lustre/llite/vvp_io.c
+index d3f967a78138..1f453b275dbc 100644
+--- a/drivers/staging/lustre/lustre/llite/vvp_io.c
++++ b/drivers/staging/lustre/lustre/llite/vvp_io.c
+@@ -632,7 +632,7 @@ static int vvp_io_kernel_fault(struct vvp_fault_io *cfio)
+ return 0;
+ }
+
+- if (cfio->fault.ft_flags & VM_FAULT_SIGBUS) {
++ if (cfio->fault.ft_flags & (VM_FAULT_SIGBUS | VM_FAULT_SIGSEGV)) {
+ CDEBUG(D_PAGE, "got addr %p - SIGBUS\n", vmf->virtual_address);
+ return -EFAULT;
+ }
+diff --git a/drivers/usb/core/otg_whitelist.h b/drivers/usb/core/otg_whitelist.h
+index de0c9c9d7091..a6315abe7b7c 100644
+--- a/drivers/usb/core/otg_whitelist.h
++++ b/drivers/usb/core/otg_whitelist.h
+@@ -55,6 +55,11 @@ static int is_targeted(struct usb_device *dev)
+ le16_to_cpu(dev->descriptor.idProduct) == 0xbadd))
+ return 0;
+
++ /* OTG PET device is always targeted (see OTG 2.0 ECN 6.4.2) */
++ if ((le16_to_cpu(dev->descriptor.idVendor) == 0x1a0a &&
++ le16_to_cpu(dev->descriptor.idProduct) == 0x0200))
++ return 1;
++
+ /* NOTE: can't use usb_match_id() since interface caches
+ * aren't set up yet. this is cut/paste from that code.
+ */
+diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
+index 0ffb4ed0a945..41e510ae8c83 100644
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -179,6 +179,10 @@ static const struct usb_device_id usb_quirk_list[] = {
+ { USB_DEVICE(0x0b05, 0x17e0), .driver_info =
+ USB_QUIRK_IGNORE_REMOTE_WAKEUP },
+
++ /* Protocol and OTG Electrical Test Device */
++ { USB_DEVICE(0x1a0a, 0x0200), .driver_info =
++ USB_QUIRK_LINEAR_UFRAME_INTR_BINTERVAL },
++
+ { } /* terminating entry must be last */
+ };
+
+diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
+index 11c7a9676441..8adb53044079 100644
+--- a/drivers/usb/storage/unusual_devs.h
++++ b/drivers/usb/storage/unusual_devs.h
+@@ -1995,6 +1995,13 @@ UNUSUAL_DEV( 0x152d, 0x2329, 0x0100, 0x0100,
+ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+ US_FL_IGNORE_RESIDUE | US_FL_SANE_SENSE ),
+
++/* Reported by Dmitry Nezhevenko <dion@dion.org.ua> */
++UNUSUAL_DEV( 0x152d, 0x2566, 0x0114, 0x0114,
++ "JMicron",
++ "USB to ATA/ATAPI Bridge",
++ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
++ US_FL_BROKEN_FUA ),
++
+ /* Entrega Technologies U1-SC25 (later Xircom PortGear PGSCSI)
+ * and Mac USB Dock USB-SCSI */
+ UNUSUAL_DEV( 0x1645, 0x0007, 0x0100, 0x0133,
+diff --git a/drivers/usb/storage/unusual_uas.h b/drivers/usb/storage/unusual_uas.h
+index 1f430bb02ca1..2706a434fdbb 100644
+--- a/drivers/usb/storage/unusual_uas.h
++++ b/drivers/usb/storage/unusual_uas.h
+@@ -138,3 +138,10 @@ UNUSUAL_DEV(0x4971, 0x1012, 0x0000, 0x9999,
+ "External HDD",
+ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+ US_FL_IGNORE_UAS),
++
++/* Reported-by: Richard Henderson <rth@redhat.com> */
++UNUSUAL_DEV(0x4971, 0x8017, 0x0000, 0x9999,
++ "SimpleTech",
++ "External HDD",
++ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
++ US_FL_NO_REPORT_OPCODES),
+diff --git a/drivers/xen/swiotlb-xen.c b/drivers/xen/swiotlb-xen.c
+index f3a9d831d0f9..c9d0d5a0e662 100644
+--- a/drivers/xen/swiotlb-xen.c
++++ b/drivers/xen/swiotlb-xen.c
+@@ -397,7 +397,9 @@ dma_addr_t xen_swiotlb_map_page(struct device *dev, struct page *page,
+ * buffering it.
+ */
+ if (dma_capable(dev, dev_addr, size) &&
+- !range_straddles_page_boundary(phys, size) && !swiotlb_force) {
++ !range_straddles_page_boundary(phys, size) &&
++ !xen_arch_need_swiotlb(dev, PFN_DOWN(phys), PFN_DOWN(dev_addr)) &&
++ !swiotlb_force) {
+ /* we are not interested in the dma_addr returned by
+ * xen_dma_map_page, only in the potential cache flushes executed
+ * by the function. */
+@@ -555,6 +557,7 @@ xen_swiotlb_map_sg_attrs(struct device *hwdev, struct scatterlist *sgl,
+ dma_addr_t dev_addr = xen_phys_to_bus(paddr);
+
+ if (swiotlb_force ||
++ xen_arch_need_swiotlb(hwdev, PFN_DOWN(paddr), PFN_DOWN(dev_addr)) ||
+ !dma_capable(hwdev, dev_addr, sg->length) ||
+ range_straddles_page_boundary(paddr, sg->length)) {
+ phys_addr_t map = swiotlb_tbl_map_single(hwdev,
+diff --git a/fs/gfs2/quota.c b/fs/gfs2/quota.c
+index 64b29f7f6b4c..dc482ffff659 100644
+--- a/fs/gfs2/quota.c
++++ b/fs/gfs2/quota.c
+@@ -667,7 +667,7 @@ static void do_qc(struct gfs2_quota_data *qd, s64 change)
+
+ static int gfs2_adjust_quota(struct gfs2_inode *ip, loff_t loc,
+ s64 change, struct gfs2_quota_data *qd,
+- struct fs_disk_quota *fdq)
++ struct qc_dqblk *fdq)
+ {
+ struct inode *inode = &ip->i_inode;
+ struct gfs2_sbd *sdp = GFS2_SB(inode);
+@@ -697,16 +697,16 @@ static int gfs2_adjust_quota(struct gfs2_inode *ip, loff_t loc,
+ be64_add_cpu(&q.qu_value, change);
+ qd->qd_qb.qb_value = q.qu_value;
+ if (fdq) {
+- if (fdq->d_fieldmask & FS_DQ_BSOFT) {
+- q.qu_warn = cpu_to_be64(fdq->d_blk_softlimit >> sdp->sd_fsb2bb_shift);
++ if (fdq->d_fieldmask & QC_SPC_SOFT) {
++ q.qu_warn = cpu_to_be64(fdq->d_spc_softlimit >> sdp->sd_sb.sb_bsize_shift);
+ qd->qd_qb.qb_warn = q.qu_warn;
+ }
+- if (fdq->d_fieldmask & FS_DQ_BHARD) {
+- q.qu_limit = cpu_to_be64(fdq->d_blk_hardlimit >> sdp->sd_fsb2bb_shift);
++ if (fdq->d_fieldmask & QC_SPC_HARD) {
++ q.qu_limit = cpu_to_be64(fdq->d_spc_hardlimit >> sdp->sd_sb.sb_bsize_shift);
+ qd->qd_qb.qb_limit = q.qu_limit;
+ }
+- if (fdq->d_fieldmask & FS_DQ_BCOUNT) {
+- q.qu_value = cpu_to_be64(fdq->d_bcount >> sdp->sd_fsb2bb_shift);
++ if (fdq->d_fieldmask & QC_SPACE) {
++ q.qu_value = cpu_to_be64(fdq->d_space >> sdp->sd_sb.sb_bsize_shift);
+ qd->qd_qb.qb_value = q.qu_value;
+ }
+ }
+@@ -1502,7 +1502,7 @@ static int gfs2_quota_get_xstate(struct super_block *sb,
+ }
+
+ static int gfs2_get_dqblk(struct super_block *sb, struct kqid qid,
+- struct fs_disk_quota *fdq)
++ struct qc_dqblk *fdq)
+ {
+ struct gfs2_sbd *sdp = sb->s_fs_info;
+ struct gfs2_quota_lvb *qlvb;
+@@ -1510,7 +1510,7 @@ static int gfs2_get_dqblk(struct super_block *sb, struct kqid qid,
+ struct gfs2_holder q_gh;
+ int error;
+
+- memset(fdq, 0, sizeof(struct fs_disk_quota));
++ memset(fdq, 0, sizeof(*fdq));
+
+ if (sdp->sd_args.ar_quota == GFS2_QUOTA_OFF)
+ return -ESRCH; /* Crazy XFS error code */
+@@ -1527,12 +1527,9 @@ static int gfs2_get_dqblk(struct super_block *sb, struct kqid qid,
+ goto out;
+
+ qlvb = (struct gfs2_quota_lvb *)qd->qd_gl->gl_lksb.sb_lvbptr;
+- fdq->d_version = FS_DQUOT_VERSION;
+- fdq->d_flags = (qid.type == USRQUOTA) ? FS_USER_QUOTA : FS_GROUP_QUOTA;
+- fdq->d_id = from_kqid_munged(current_user_ns(), qid);
+- fdq->d_blk_hardlimit = be64_to_cpu(qlvb->qb_limit) << sdp->sd_fsb2bb_shift;
+- fdq->d_blk_softlimit = be64_to_cpu(qlvb->qb_warn) << sdp->sd_fsb2bb_shift;
+- fdq->d_bcount = be64_to_cpu(qlvb->qb_value) << sdp->sd_fsb2bb_shift;
++ fdq->d_spc_hardlimit = be64_to_cpu(qlvb->qb_limit) << sdp->sd_sb.sb_bsize_shift;
++ fdq->d_spc_softlimit = be64_to_cpu(qlvb->qb_warn) << sdp->sd_sb.sb_bsize_shift;
++ fdq->d_space = be64_to_cpu(qlvb->qb_value) << sdp->sd_sb.sb_bsize_shift;
+
+ gfs2_glock_dq_uninit(&q_gh);
+ out:
+@@ -1541,10 +1538,10 @@ out:
+ }
+
+ /* GFS2 only supports a subset of the XFS fields */
+-#define GFS2_FIELDMASK (FS_DQ_BSOFT|FS_DQ_BHARD|FS_DQ_BCOUNT)
++#define GFS2_FIELDMASK (QC_SPC_SOFT|QC_SPC_HARD|QC_SPACE)
+
+ static int gfs2_set_dqblk(struct super_block *sb, struct kqid qid,
+- struct fs_disk_quota *fdq)
++ struct qc_dqblk *fdq)
+ {
+ struct gfs2_sbd *sdp = sb->s_fs_info;
+ struct gfs2_inode *ip = GFS2_I(sdp->sd_quota_inode);
+@@ -1588,17 +1585,17 @@ static int gfs2_set_dqblk(struct super_block *sb, struct kqid qid,
+ goto out_i;
+
+ /* If nothing has changed, this is a no-op */
+- if ((fdq->d_fieldmask & FS_DQ_BSOFT) &&
+- ((fdq->d_blk_softlimit >> sdp->sd_fsb2bb_shift) == be64_to_cpu(qd->qd_qb.qb_warn)))
+- fdq->d_fieldmask ^= FS_DQ_BSOFT;
++ if ((fdq->d_fieldmask & QC_SPC_SOFT) &&
++ ((fdq->d_spc_softlimit >> sdp->sd_sb.sb_bsize_shift) == be64_to_cpu(qd->qd_qb.qb_warn)))
++ fdq->d_fieldmask ^= QC_SPC_SOFT;
+
+- if ((fdq->d_fieldmask & FS_DQ_BHARD) &&
+- ((fdq->d_blk_hardlimit >> sdp->sd_fsb2bb_shift) == be64_to_cpu(qd->qd_qb.qb_limit)))
+- fdq->d_fieldmask ^= FS_DQ_BHARD;
++ if ((fdq->d_fieldmask & QC_SPC_HARD) &&
++ ((fdq->d_spc_hardlimit >> sdp->sd_sb.sb_bsize_shift) == be64_to_cpu(qd->qd_qb.qb_limit)))
++ fdq->d_fieldmask ^= QC_SPC_HARD;
+
+- if ((fdq->d_fieldmask & FS_DQ_BCOUNT) &&
+- ((fdq->d_bcount >> sdp->sd_fsb2bb_shift) == be64_to_cpu(qd->qd_qb.qb_value)))
+- fdq->d_fieldmask ^= FS_DQ_BCOUNT;
++ if ((fdq->d_fieldmask & QC_SPACE) &&
++ ((fdq->d_space >> sdp->sd_sb.sb_bsize_shift) == be64_to_cpu(qd->qd_qb.qb_value)))
++ fdq->d_fieldmask ^= QC_SPACE;
+
+ if (fdq->d_fieldmask == 0)
+ goto out_i;
+diff --git a/fs/nfs/direct.c b/fs/nfs/direct.c
+index 10bf07280f4a..294692ff83b1 100644
+--- a/fs/nfs/direct.c
++++ b/fs/nfs/direct.c
+@@ -212,6 +212,12 @@ static int nfs_direct_cmp_commit_data_verf(struct nfs_direct_req *dreq,
+ */
+ ssize_t nfs_direct_IO(int rw, struct kiocb *iocb, struct iov_iter *iter, loff_t pos)
+ {
++ struct inode *inode = iocb->ki_filp->f_mapping->host;
++
++ /* we only support swap file calling nfs_direct_IO */
++ if (!IS_SWAPFILE(inode))
++ return 0;
++
+ #ifndef CONFIG_NFS_SWAP
+ dprintk("NFS: nfs_direct_IO (%pD) off/no(%Ld/%lu) EINVAL\n",
+ iocb->ki_filp, (long long) pos, iter->nr_segs);
+diff --git a/fs/nfs/nfs4client.c b/fs/nfs/nfs4client.c
+index 9588873d4c46..368a6b72290c 100644
+--- a/fs/nfs/nfs4client.c
++++ b/fs/nfs/nfs4client.c
+@@ -640,7 +640,7 @@ int nfs41_walk_client_list(struct nfs_client *new,
+ prev = pos;
+
+ status = nfs_wait_client_init_complete(pos);
+- if (status == 0) {
++ if (pos->cl_cons_state == NFS_CS_SESSION_INITING) {
+ nfs4_schedule_lease_recovery(pos);
+ status = nfs4_wait_clnt_recover(pos);
+ }
+diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c
+index 6b4527216a7f..9340228aff6e 100644
+--- a/fs/quota/dquot.c
++++ b/fs/quota/dquot.c
+@@ -2391,30 +2391,25 @@ static inline qsize_t stoqb(qsize_t space)
+ }
+
+ /* Generic routine for getting common part of quota structure */
+-static void do_get_dqblk(struct dquot *dquot, struct fs_disk_quota *di)
++static void do_get_dqblk(struct dquot *dquot, struct qc_dqblk *di)
+ {
+ struct mem_dqblk *dm = &dquot->dq_dqb;
+
+ memset(di, 0, sizeof(*di));
+- di->d_version = FS_DQUOT_VERSION;
+- di->d_flags = dquot->dq_id.type == USRQUOTA ?
+- FS_USER_QUOTA : FS_GROUP_QUOTA;
+- di->d_id = from_kqid_munged(current_user_ns(), dquot->dq_id);
+-
+ spin_lock(&dq_data_lock);
+- di->d_blk_hardlimit = stoqb(dm->dqb_bhardlimit);
+- di->d_blk_softlimit = stoqb(dm->dqb_bsoftlimit);
++ di->d_spc_hardlimit = dm->dqb_bhardlimit;
++ di->d_spc_softlimit = dm->dqb_bsoftlimit;
+ di->d_ino_hardlimit = dm->dqb_ihardlimit;
+ di->d_ino_softlimit = dm->dqb_isoftlimit;
+- di->d_bcount = dm->dqb_curspace + dm->dqb_rsvspace;
+- di->d_icount = dm->dqb_curinodes;
+- di->d_btimer = dm->dqb_btime;
+- di->d_itimer = dm->dqb_itime;
++ di->d_space = dm->dqb_curspace + dm->dqb_rsvspace;
++ di->d_ino_count = dm->dqb_curinodes;
++ di->d_spc_timer = dm->dqb_btime;
++ di->d_ino_timer = dm->dqb_itime;
+ spin_unlock(&dq_data_lock);
+ }
+
+ int dquot_get_dqblk(struct super_block *sb, struct kqid qid,
+- struct fs_disk_quota *di)
++ struct qc_dqblk *di)
+ {
+ struct dquot *dquot;
+
+@@ -2428,70 +2423,70 @@ int dquot_get_dqblk(struct super_block *sb, struct kqid qid,
+ }
+ EXPORT_SYMBOL(dquot_get_dqblk);
+
+-#define VFS_FS_DQ_MASK \
+- (FS_DQ_BCOUNT | FS_DQ_BSOFT | FS_DQ_BHARD | \
+- FS_DQ_ICOUNT | FS_DQ_ISOFT | FS_DQ_IHARD | \
+- FS_DQ_BTIMER | FS_DQ_ITIMER)
++#define VFS_QC_MASK \
++ (QC_SPACE | QC_SPC_SOFT | QC_SPC_HARD | \
++ QC_INO_COUNT | QC_INO_SOFT | QC_INO_HARD | \
++ QC_SPC_TIMER | QC_INO_TIMER)
+
+ /* Generic routine for setting common part of quota structure */
+-static int do_set_dqblk(struct dquot *dquot, struct fs_disk_quota *di)
++static int do_set_dqblk(struct dquot *dquot, struct qc_dqblk *di)
+ {
+ struct mem_dqblk *dm = &dquot->dq_dqb;
+ int check_blim = 0, check_ilim = 0;
+ struct mem_dqinfo *dqi = &sb_dqopt(dquot->dq_sb)->info[dquot->dq_id.type];
+
+- if (di->d_fieldmask & ~VFS_FS_DQ_MASK)
++ if (di->d_fieldmask & ~VFS_QC_MASK)
+ return -EINVAL;
+
+- if (((di->d_fieldmask & FS_DQ_BSOFT) &&
+- (di->d_blk_softlimit > dqi->dqi_maxblimit)) ||
+- ((di->d_fieldmask & FS_DQ_BHARD) &&
+- (di->d_blk_hardlimit > dqi->dqi_maxblimit)) ||
+- ((di->d_fieldmask & FS_DQ_ISOFT) &&
++ if (((di->d_fieldmask & QC_SPC_SOFT) &&
++ stoqb(di->d_spc_softlimit) > dqi->dqi_maxblimit) ||
++ ((di->d_fieldmask & QC_SPC_HARD) &&
++ stoqb(di->d_spc_hardlimit) > dqi->dqi_maxblimit) ||
++ ((di->d_fieldmask & QC_INO_SOFT) &&
+ (di->d_ino_softlimit > dqi->dqi_maxilimit)) ||
+- ((di->d_fieldmask & FS_DQ_IHARD) &&
++ ((di->d_fieldmask & QC_INO_HARD) &&
+ (di->d_ino_hardlimit > dqi->dqi_maxilimit)))
+ return -ERANGE;
+
+ spin_lock(&dq_data_lock);
+- if (di->d_fieldmask & FS_DQ_BCOUNT) {
+- dm->dqb_curspace = di->d_bcount - dm->dqb_rsvspace;
++ if (di->d_fieldmask & QC_SPACE) {
++ dm->dqb_curspace = di->d_space - dm->dqb_rsvspace;
+ check_blim = 1;
+ set_bit(DQ_LASTSET_B + QIF_SPACE_B, &dquot->dq_flags);
+ }
+
+- if (di->d_fieldmask & FS_DQ_BSOFT)
+- dm->dqb_bsoftlimit = qbtos(di->d_blk_softlimit);
+- if (di->d_fieldmask & FS_DQ_BHARD)
+- dm->dqb_bhardlimit = qbtos(di->d_blk_hardlimit);
+- if (di->d_fieldmask & (FS_DQ_BSOFT | FS_DQ_BHARD)) {
++ if (di->d_fieldmask & QC_SPC_SOFT)
++ dm->dqb_bsoftlimit = di->d_spc_softlimit;
++ if (di->d_fieldmask & QC_SPC_HARD)
++ dm->dqb_bhardlimit = di->d_spc_hardlimit;
++ if (di->d_fieldmask & (QC_SPC_SOFT | QC_SPC_HARD)) {
+ check_blim = 1;
+ set_bit(DQ_LASTSET_B + QIF_BLIMITS_B, &dquot->dq_flags);
+ }
+
+- if (di->d_fieldmask & FS_DQ_ICOUNT) {
+- dm->dqb_curinodes = di->d_icount;
++ if (di->d_fieldmask & QC_INO_COUNT) {
++ dm->dqb_curinodes = di->d_ino_count;
+ check_ilim = 1;
+ set_bit(DQ_LASTSET_B + QIF_INODES_B, &dquot->dq_flags);
+ }
+
+- if (di->d_fieldmask & FS_DQ_ISOFT)
++ if (di->d_fieldmask & QC_INO_SOFT)
+ dm->dqb_isoftlimit = di->d_ino_softlimit;
+- if (di->d_fieldmask & FS_DQ_IHARD)
++ if (di->d_fieldmask & QC_INO_HARD)
+ dm->dqb_ihardlimit = di->d_ino_hardlimit;
+- if (di->d_fieldmask & (FS_DQ_ISOFT | FS_DQ_IHARD)) {
++ if (di->d_fieldmask & (QC_INO_SOFT | QC_INO_HARD)) {
+ check_ilim = 1;
+ set_bit(DQ_LASTSET_B + QIF_ILIMITS_B, &dquot->dq_flags);
+ }
+
+- if (di->d_fieldmask & FS_DQ_BTIMER) {
+- dm->dqb_btime = di->d_btimer;
++ if (di->d_fieldmask & QC_SPC_TIMER) {
++ dm->dqb_btime = di->d_spc_timer;
+ check_blim = 1;
+ set_bit(DQ_LASTSET_B + QIF_BTIME_B, &dquot->dq_flags);
+ }
+
+- if (di->d_fieldmask & FS_DQ_ITIMER) {
+- dm->dqb_itime = di->d_itimer;
++ if (di->d_fieldmask & QC_INO_TIMER) {
++ dm->dqb_itime = di->d_ino_timer;
+ check_ilim = 1;
+ set_bit(DQ_LASTSET_B + QIF_ITIME_B, &dquot->dq_flags);
+ }
+@@ -2501,7 +2496,7 @@ static int do_set_dqblk(struct dquot *dquot, struct fs_disk_quota *di)
+ dm->dqb_curspace < dm->dqb_bsoftlimit) {
+ dm->dqb_btime = 0;
+ clear_bit(DQ_BLKS_B, &dquot->dq_flags);
+- } else if (!(di->d_fieldmask & FS_DQ_BTIMER))
++ } else if (!(di->d_fieldmask & QC_SPC_TIMER))
+ /* Set grace only if user hasn't provided his own... */
+ dm->dqb_btime = get_seconds() + dqi->dqi_bgrace;
+ }
+@@ -2510,7 +2505,7 @@ static int do_set_dqblk(struct dquot *dquot, struct fs_disk_quota *di)
+ dm->dqb_curinodes < dm->dqb_isoftlimit) {
+ dm->dqb_itime = 0;
+ clear_bit(DQ_INODES_B, &dquot->dq_flags);
+- } else if (!(di->d_fieldmask & FS_DQ_ITIMER))
++ } else if (!(di->d_fieldmask & QC_INO_TIMER))
+ /* Set grace only if user hasn't provided his own... */
+ dm->dqb_itime = get_seconds() + dqi->dqi_igrace;
+ }
+@@ -2526,7 +2521,7 @@ static int do_set_dqblk(struct dquot *dquot, struct fs_disk_quota *di)
+ }
+
+ int dquot_set_dqblk(struct super_block *sb, struct kqid qid,
+- struct fs_disk_quota *di)
++ struct qc_dqblk *di)
+ {
+ struct dquot *dquot;
+ int rc;
+diff --git a/fs/quota/quota.c b/fs/quota/quota.c
+index 75621649dbd7..2ce66201c366 100644
+--- a/fs/quota/quota.c
++++ b/fs/quota/quota.c
+@@ -115,17 +115,27 @@ static int quota_setinfo(struct super_block *sb, int type, void __user *addr)
+ return sb->s_qcop->set_info(sb, type, &info);
+ }
+
+-static void copy_to_if_dqblk(struct if_dqblk *dst, struct fs_disk_quota *src)
++static inline qsize_t qbtos(qsize_t blocks)
++{
++ return blocks << QIF_DQBLKSIZE_BITS;
++}
++
++static inline qsize_t stoqb(qsize_t space)
++{
++ return (space + QIF_DQBLKSIZE - 1) >> QIF_DQBLKSIZE_BITS;
++}
++
++static void copy_to_if_dqblk(struct if_dqblk *dst, struct qc_dqblk *src)
+ {
+ memset(dst, 0, sizeof(*dst));
+- dst->dqb_bhardlimit = src->d_blk_hardlimit;
+- dst->dqb_bsoftlimit = src->d_blk_softlimit;
+- dst->dqb_curspace = src->d_bcount;
++ dst->dqb_bhardlimit = stoqb(src->d_spc_hardlimit);
++ dst->dqb_bsoftlimit = stoqb(src->d_spc_softlimit);
++ dst->dqb_curspace = src->d_space;
+ dst->dqb_ihardlimit = src->d_ino_hardlimit;
+ dst->dqb_isoftlimit = src->d_ino_softlimit;
+- dst->dqb_curinodes = src->d_icount;
+- dst->dqb_btime = src->d_btimer;
+- dst->dqb_itime = src->d_itimer;
++ dst->dqb_curinodes = src->d_ino_count;
++ dst->dqb_btime = src->d_spc_timer;
++ dst->dqb_itime = src->d_ino_timer;
+ dst->dqb_valid = QIF_ALL;
+ }
+
+@@ -133,7 +143,7 @@ static int quota_getquota(struct super_block *sb, int type, qid_t id,
+ void __user *addr)
+ {
+ struct kqid qid;
+- struct fs_disk_quota fdq;
++ struct qc_dqblk fdq;
+ struct if_dqblk idq;
+ int ret;
+
+@@ -151,36 +161,36 @@ static int quota_getquota(struct super_block *sb, int type, qid_t id,
+ return 0;
+ }
+
+-static void copy_from_if_dqblk(struct fs_disk_quota *dst, struct if_dqblk *src)
++static void copy_from_if_dqblk(struct qc_dqblk *dst, struct if_dqblk *src)
+ {
+- dst->d_blk_hardlimit = src->dqb_bhardlimit;
+- dst->d_blk_softlimit = src->dqb_bsoftlimit;
+- dst->d_bcount = src->dqb_curspace;
++ dst->d_spc_hardlimit = qbtos(src->dqb_bhardlimit);
++ dst->d_spc_softlimit = qbtos(src->dqb_bsoftlimit);
++ dst->d_space = src->dqb_curspace;
+ dst->d_ino_hardlimit = src->dqb_ihardlimit;
+ dst->d_ino_softlimit = src->dqb_isoftlimit;
+- dst->d_icount = src->dqb_curinodes;
+- dst->d_btimer = src->dqb_btime;
+- dst->d_itimer = src->dqb_itime;
++ dst->d_ino_count = src->dqb_curinodes;
++ dst->d_spc_timer = src->dqb_btime;
++ dst->d_ino_timer = src->dqb_itime;
+
+ dst->d_fieldmask = 0;
+ if (src->dqb_valid & QIF_BLIMITS)
+- dst->d_fieldmask |= FS_DQ_BSOFT | FS_DQ_BHARD;
++ dst->d_fieldmask |= QC_SPC_SOFT | QC_SPC_HARD;
+ if (src->dqb_valid & QIF_SPACE)
+- dst->d_fieldmask |= FS_DQ_BCOUNT;
++ dst->d_fieldmask |= QC_SPACE;
+ if (src->dqb_valid & QIF_ILIMITS)
+- dst->d_fieldmask |= FS_DQ_ISOFT | FS_DQ_IHARD;
++ dst->d_fieldmask |= QC_INO_SOFT | QC_INO_HARD;
+ if (src->dqb_valid & QIF_INODES)
+- dst->d_fieldmask |= FS_DQ_ICOUNT;
++ dst->d_fieldmask |= QC_INO_COUNT;
+ if (src->dqb_valid & QIF_BTIME)
+- dst->d_fieldmask |= FS_DQ_BTIMER;
++ dst->d_fieldmask |= QC_SPC_TIMER;
+ if (src->dqb_valid & QIF_ITIME)
+- dst->d_fieldmask |= FS_DQ_ITIMER;
++ dst->d_fieldmask |= QC_INO_TIMER;
+ }
+
+ static int quota_setquota(struct super_block *sb, int type, qid_t id,
+ void __user *addr)
+ {
+- struct fs_disk_quota fdq;
++ struct qc_dqblk fdq;
+ struct if_dqblk idq;
+ struct kqid qid;
+
+@@ -244,10 +254,78 @@ static int quota_getxstatev(struct super_block *sb, void __user *addr)
+ return ret;
+ }
+
++/*
++ * XFS defines BBTOB and BTOBB macros inside fs/xfs/ and we cannot move them
++ * out of there as xfsprogs rely on definitions being in that header file. So
++ * just define same functions here for quota purposes.
++ */
++#define XFS_BB_SHIFT 9
++
++static inline u64 quota_bbtob(u64 blocks)
++{
++ return blocks << XFS_BB_SHIFT;
++}
++
++static inline u64 quota_btobb(u64 bytes)
++{
++ return (bytes + (1 << XFS_BB_SHIFT) - 1) >> XFS_BB_SHIFT;
++}
++
++static void copy_from_xfs_dqblk(struct qc_dqblk *dst, struct fs_disk_quota *src)
++{
++ dst->d_spc_hardlimit = quota_bbtob(src->d_blk_hardlimit);
++ dst->d_spc_softlimit = quota_bbtob(src->d_blk_softlimit);
++ dst->d_ino_hardlimit = src->d_ino_hardlimit;
++ dst->d_ino_softlimit = src->d_ino_softlimit;
++ dst->d_space = quota_bbtob(src->d_bcount);
++ dst->d_ino_count = src->d_icount;
++ dst->d_ino_timer = src->d_itimer;
++ dst->d_spc_timer = src->d_btimer;
++ dst->d_ino_warns = src->d_iwarns;
++ dst->d_spc_warns = src->d_bwarns;
++ dst->d_rt_spc_hardlimit = quota_bbtob(src->d_rtb_hardlimit);
++ dst->d_rt_spc_softlimit = quota_bbtob(src->d_rtb_softlimit);
++ dst->d_rt_space = quota_bbtob(src->d_rtbcount);
++ dst->d_rt_spc_timer = src->d_rtbtimer;
++ dst->d_rt_spc_warns = src->d_rtbwarns;
++ dst->d_fieldmask = 0;
++ if (src->d_fieldmask & FS_DQ_ISOFT)
++ dst->d_fieldmask |= QC_INO_SOFT;
++ if (src->d_fieldmask & FS_DQ_IHARD)
++ dst->d_fieldmask |= QC_INO_HARD;
++ if (src->d_fieldmask & FS_DQ_BSOFT)
++ dst->d_fieldmask |= QC_SPC_SOFT;
++ if (src->d_fieldmask & FS_DQ_BHARD)
++ dst->d_fieldmask |= QC_SPC_HARD;
++ if (src->d_fieldmask & FS_DQ_RTBSOFT)
++ dst->d_fieldmask |= QC_RT_SPC_SOFT;
++ if (src->d_fieldmask & FS_DQ_RTBHARD)
++ dst->d_fieldmask |= QC_RT_SPC_HARD;
++ if (src->d_fieldmask & FS_DQ_BTIMER)
++ dst->d_fieldmask |= QC_SPC_TIMER;
++ if (src->d_fieldmask & FS_DQ_ITIMER)
++ dst->d_fieldmask |= QC_INO_TIMER;
++ if (src->d_fieldmask & FS_DQ_RTBTIMER)
++ dst->d_fieldmask |= QC_RT_SPC_TIMER;
++ if (src->d_fieldmask & FS_DQ_BWARNS)
++ dst->d_fieldmask |= QC_SPC_WARNS;
++ if (src->d_fieldmask & FS_DQ_IWARNS)
++ dst->d_fieldmask |= QC_INO_WARNS;
++ if (src->d_fieldmask & FS_DQ_RTBWARNS)
++ dst->d_fieldmask |= QC_RT_SPC_WARNS;
++ if (src->d_fieldmask & FS_DQ_BCOUNT)
++ dst->d_fieldmask |= QC_SPACE;
++ if (src->d_fieldmask & FS_DQ_ICOUNT)
++ dst->d_fieldmask |= QC_INO_COUNT;
++ if (src->d_fieldmask & FS_DQ_RTBCOUNT)
++ dst->d_fieldmask |= QC_RT_SPACE;
++}
++
+ static int quota_setxquota(struct super_block *sb, int type, qid_t id,
+ void __user *addr)
+ {
+ struct fs_disk_quota fdq;
++ struct qc_dqblk qdq;
+ struct kqid qid;
+
+ if (copy_from_user(&fdq, addr, sizeof(fdq)))
+@@ -257,13 +335,44 @@ static int quota_setxquota(struct super_block *sb, int type, qid_t id,
+ qid = make_kqid(current_user_ns(), type, id);
+ if (!qid_valid(qid))
+ return -EINVAL;
+- return sb->s_qcop->set_dqblk(sb, qid, &fdq);
++ copy_from_xfs_dqblk(&qdq, &fdq);
++ return sb->s_qcop->set_dqblk(sb, qid, &qdq);
++}
++
++static void copy_to_xfs_dqblk(struct fs_disk_quota *dst, struct qc_dqblk *src,
++ int type, qid_t id)
++{
++ memset(dst, 0, sizeof(*dst));
++ dst->d_version = FS_DQUOT_VERSION;
++ dst->d_id = id;
++ if (type == USRQUOTA)
++ dst->d_flags = FS_USER_QUOTA;
++ else if (type == PRJQUOTA)
++ dst->d_flags = FS_PROJ_QUOTA;
++ else
++ dst->d_flags = FS_GROUP_QUOTA;
++ dst->d_blk_hardlimit = quota_btobb(src->d_spc_hardlimit);
++ dst->d_blk_softlimit = quota_btobb(src->d_spc_softlimit);
++ dst->d_ino_hardlimit = src->d_ino_hardlimit;
++ dst->d_ino_softlimit = src->d_ino_softlimit;
++ dst->d_bcount = quota_btobb(src->d_space);
++ dst->d_icount = src->d_ino_count;
++ dst->d_itimer = src->d_ino_timer;
++ dst->d_btimer = src->d_spc_timer;
++ dst->d_iwarns = src->d_ino_warns;
++ dst->d_bwarns = src->d_spc_warns;
++ dst->d_rtb_hardlimit = quota_btobb(src->d_rt_spc_hardlimit);
++ dst->d_rtb_softlimit = quota_btobb(src->d_rt_spc_softlimit);
++ dst->d_rtbcount = quota_btobb(src->d_rt_space);
++ dst->d_rtbtimer = src->d_rt_spc_timer;
++ dst->d_rtbwarns = src->d_rt_spc_warns;
+ }
+
+ static int quota_getxquota(struct super_block *sb, int type, qid_t id,
+ void __user *addr)
+ {
+ struct fs_disk_quota fdq;
++ struct qc_dqblk qdq;
+ struct kqid qid;
+ int ret;
+
+@@ -272,8 +381,11 @@ static int quota_getxquota(struct super_block *sb, int type, qid_t id,
+ qid = make_kqid(current_user_ns(), type, id);
+ if (!qid_valid(qid))
+ return -EINVAL;
+- ret = sb->s_qcop->get_dqblk(sb, qid, &fdq);
+- if (!ret && copy_to_user(addr, &fdq, sizeof(fdq)))
++ ret = sb->s_qcop->get_dqblk(sb, qid, &qdq);
++ if (ret)
++ return ret;
++ copy_to_xfs_dqblk(&fdq, &qdq, type, id);
++ if (copy_to_user(addr, &fdq, sizeof(fdq)))
+ return -EFAULT;
+ return ret;
+ }
+diff --git a/fs/udf/file.c b/fs/udf/file.c
+index bb15771b92ae..08f3555fbeac 100644
+--- a/fs/udf/file.c
++++ b/fs/udf/file.c
+@@ -224,7 +224,7 @@ out:
+ static int udf_release_file(struct inode *inode, struct file *filp)
+ {
+ if (filp->f_mode & FMODE_WRITE &&
+- atomic_read(&inode->i_writecount) > 1) {
++ atomic_read(&inode->i_writecount) == 1) {
+ /*
+ * Grab i_mutex to avoid races with writes changing i_size
+ * while we are running.
+diff --git a/fs/xfs/xfs_qm.h b/fs/xfs/xfs_qm.h
+index 3a07a937e232..41f6c0b9d51c 100644
+--- a/fs/xfs/xfs_qm.h
++++ b/fs/xfs/xfs_qm.h
+@@ -166,9 +166,9 @@ extern void xfs_qm_dqrele_all_inodes(struct xfs_mount *, uint);
+ /* quota ops */
+ extern int xfs_qm_scall_trunc_qfiles(struct xfs_mount *, uint);
+ extern int xfs_qm_scall_getquota(struct xfs_mount *, xfs_dqid_t,
+- uint, struct fs_disk_quota *);
++ uint, struct qc_dqblk *);
+ extern int xfs_qm_scall_setqlim(struct xfs_mount *, xfs_dqid_t, uint,
+- struct fs_disk_quota *);
++ struct qc_dqblk *);
+ extern int xfs_qm_scall_getqstat(struct xfs_mount *,
+ struct fs_quota_stat *);
+ extern int xfs_qm_scall_getqstatv(struct xfs_mount *,
+diff --git a/fs/xfs/xfs_qm_syscalls.c b/fs/xfs/xfs_qm_syscalls.c
+index 80f2d77d929a..327f85abbea8 100644
+--- a/fs/xfs/xfs_qm_syscalls.c
++++ b/fs/xfs/xfs_qm_syscalls.c
+@@ -40,7 +40,6 @@ STATIC int xfs_qm_log_quotaoff(xfs_mount_t *, xfs_qoff_logitem_t **, uint);
+ STATIC int xfs_qm_log_quotaoff_end(xfs_mount_t *, xfs_qoff_logitem_t *,
+ uint);
+ STATIC uint xfs_qm_export_flags(uint);
+-STATIC uint xfs_qm_export_qtype_flags(uint);
+
+ /*
+ * Turn off quota accounting and/or enforcement for all udquots and/or
+@@ -574,8 +573,8 @@ xfs_qm_scall_getqstatv(
+ return 0;
+ }
+
+-#define XFS_DQ_MASK \
+- (FS_DQ_LIMIT_MASK | FS_DQ_TIMER_MASK | FS_DQ_WARNS_MASK)
++#define XFS_QC_MASK \
++ (QC_LIMIT_MASK | QC_TIMER_MASK | QC_WARNS_MASK)
+
+ /*
+ * Adjust quota limits, and start/stop timers accordingly.
+@@ -585,7 +584,7 @@ xfs_qm_scall_setqlim(
+ struct xfs_mount *mp,
+ xfs_dqid_t id,
+ uint type,
+- fs_disk_quota_t *newlim)
++ struct qc_dqblk *newlim)
+ {
+ struct xfs_quotainfo *q = mp->m_quotainfo;
+ struct xfs_disk_dquot *ddq;
+@@ -594,9 +593,9 @@ xfs_qm_scall_setqlim(
+ int error;
+ xfs_qcnt_t hard, soft;
+
+- if (newlim->d_fieldmask & ~XFS_DQ_MASK)
++ if (newlim->d_fieldmask & ~XFS_QC_MASK)
+ return -EINVAL;
+- if ((newlim->d_fieldmask & XFS_DQ_MASK) == 0)
++ if ((newlim->d_fieldmask & XFS_QC_MASK) == 0)
+ return 0;
+
+ /*
+@@ -634,11 +633,11 @@ xfs_qm_scall_setqlim(
+ /*
+ * Make sure that hardlimits are >= soft limits before changing.
+ */
+- hard = (newlim->d_fieldmask & FS_DQ_BHARD) ?
+- (xfs_qcnt_t) XFS_BB_TO_FSB(mp, newlim->d_blk_hardlimit) :
++ hard = (newlim->d_fieldmask & QC_SPC_HARD) ?
++ (xfs_qcnt_t) XFS_B_TO_FSB(mp, newlim->d_spc_hardlimit) :
+ be64_to_cpu(ddq->d_blk_hardlimit);
+- soft = (newlim->d_fieldmask & FS_DQ_BSOFT) ?
+- (xfs_qcnt_t) XFS_BB_TO_FSB(mp, newlim->d_blk_softlimit) :
++ soft = (newlim->d_fieldmask & QC_SPC_SOFT) ?
++ (xfs_qcnt_t) XFS_B_TO_FSB(mp, newlim->d_spc_softlimit) :
+ be64_to_cpu(ddq->d_blk_softlimit);
+ if (hard == 0 || hard >= soft) {
+ ddq->d_blk_hardlimit = cpu_to_be64(hard);
+@@ -651,11 +650,11 @@ xfs_qm_scall_setqlim(
+ } else {
+ xfs_debug(mp, "blkhard %Ld < blksoft %Ld", hard, soft);
+ }
+- hard = (newlim->d_fieldmask & FS_DQ_RTBHARD) ?
+- (xfs_qcnt_t) XFS_BB_TO_FSB(mp, newlim->d_rtb_hardlimit) :
++ hard = (newlim->d_fieldmask & QC_RT_SPC_HARD) ?
++ (xfs_qcnt_t) XFS_B_TO_FSB(mp, newlim->d_rt_spc_hardlimit) :
+ be64_to_cpu(ddq->d_rtb_hardlimit);
+- soft = (newlim->d_fieldmask & FS_DQ_RTBSOFT) ?
+- (xfs_qcnt_t) XFS_BB_TO_FSB(mp, newlim->d_rtb_softlimit) :
++ soft = (newlim->d_fieldmask & QC_RT_SPC_SOFT) ?
++ (xfs_qcnt_t) XFS_B_TO_FSB(mp, newlim->d_rt_spc_softlimit) :
+ be64_to_cpu(ddq->d_rtb_softlimit);
+ if (hard == 0 || hard >= soft) {
+ ddq->d_rtb_hardlimit = cpu_to_be64(hard);
+@@ -668,10 +667,10 @@ xfs_qm_scall_setqlim(
+ xfs_debug(mp, "rtbhard %Ld < rtbsoft %Ld", hard, soft);
+ }
+
+- hard = (newlim->d_fieldmask & FS_DQ_IHARD) ?
++ hard = (newlim->d_fieldmask & QC_INO_HARD) ?
+ (xfs_qcnt_t) newlim->d_ino_hardlimit :
+ be64_to_cpu(ddq->d_ino_hardlimit);
+- soft = (newlim->d_fieldmask & FS_DQ_ISOFT) ?
++ soft = (newlim->d_fieldmask & QC_INO_SOFT) ?
+ (xfs_qcnt_t) newlim->d_ino_softlimit :
+ be64_to_cpu(ddq->d_ino_softlimit);
+ if (hard == 0 || hard >= soft) {
+@@ -688,12 +687,12 @@ xfs_qm_scall_setqlim(
+ /*
+ * Update warnings counter(s) if requested
+ */
+- if (newlim->d_fieldmask & FS_DQ_BWARNS)
+- ddq->d_bwarns = cpu_to_be16(newlim->d_bwarns);
+- if (newlim->d_fieldmask & FS_DQ_IWARNS)
+- ddq->d_iwarns = cpu_to_be16(newlim->d_iwarns);
+- if (newlim->d_fieldmask & FS_DQ_RTBWARNS)
+- ddq->d_rtbwarns = cpu_to_be16(newlim->d_rtbwarns);
++ if (newlim->d_fieldmask & QC_SPC_WARNS)
++ ddq->d_bwarns = cpu_to_be16(newlim->d_spc_warns);
++ if (newlim->d_fieldmask & QC_INO_WARNS)
++ ddq->d_iwarns = cpu_to_be16(newlim->d_ino_warns);
++ if (newlim->d_fieldmask & QC_RT_SPC_WARNS)
++ ddq->d_rtbwarns = cpu_to_be16(newlim->d_rt_spc_warns);
+
+ if (id == 0) {
+ /*
+@@ -703,24 +702,24 @@ xfs_qm_scall_setqlim(
+ * soft and hard limit values (already done, above), and
+ * for warnings.
+ */
+- if (newlim->d_fieldmask & FS_DQ_BTIMER) {
+- q->qi_btimelimit = newlim->d_btimer;
+- ddq->d_btimer = cpu_to_be32(newlim->d_btimer);
++ if (newlim->d_fieldmask & QC_SPC_TIMER) {
++ q->qi_btimelimit = newlim->d_spc_timer;
++ ddq->d_btimer = cpu_to_be32(newlim->d_spc_timer);
+ }
+- if (newlim->d_fieldmask & FS_DQ_ITIMER) {
+- q->qi_itimelimit = newlim->d_itimer;
+- ddq->d_itimer = cpu_to_be32(newlim->d_itimer);
++ if (newlim->d_fieldmask & QC_INO_TIMER) {
++ q->qi_itimelimit = newlim->d_ino_timer;
++ ddq->d_itimer = cpu_to_be32(newlim->d_ino_timer);
+ }
+- if (newlim->d_fieldmask & FS_DQ_RTBTIMER) {
+- q->qi_rtbtimelimit = newlim->d_rtbtimer;
+- ddq->d_rtbtimer = cpu_to_be32(newlim->d_rtbtimer);
++ if (newlim->d_fieldmask & QC_RT_SPC_TIMER) {
++ q->qi_rtbtimelimit = newlim->d_rt_spc_timer;
++ ddq->d_rtbtimer = cpu_to_be32(newlim->d_rt_spc_timer);
+ }
+- if (newlim->d_fieldmask & FS_DQ_BWARNS)
+- q->qi_bwarnlimit = newlim->d_bwarns;
+- if (newlim->d_fieldmask & FS_DQ_IWARNS)
+- q->qi_iwarnlimit = newlim->d_iwarns;
+- if (newlim->d_fieldmask & FS_DQ_RTBWARNS)
+- q->qi_rtbwarnlimit = newlim->d_rtbwarns;
++ if (newlim->d_fieldmask & QC_SPC_WARNS)
++ q->qi_bwarnlimit = newlim->d_spc_warns;
++ if (newlim->d_fieldmask & QC_INO_WARNS)
++ q->qi_iwarnlimit = newlim->d_ino_warns;
++ if (newlim->d_fieldmask & QC_RT_SPC_WARNS)
++ q->qi_rtbwarnlimit = newlim->d_rt_spc_warns;
+ } else {
+ /*
+ * If the user is now over quota, start the timelimit.
+@@ -831,7 +830,7 @@ xfs_qm_scall_getquota(
+ struct xfs_mount *mp,
+ xfs_dqid_t id,
+ uint type,
+- struct fs_disk_quota *dst)
++ struct qc_dqblk *dst)
+ {
+ struct xfs_dquot *dqp;
+ int error;
+@@ -855,28 +854,25 @@ xfs_qm_scall_getquota(
+ }
+
+ memset(dst, 0, sizeof(*dst));
+- dst->d_version = FS_DQUOT_VERSION;
+- dst->d_flags = xfs_qm_export_qtype_flags(dqp->q_core.d_flags);
+- dst->d_id = be32_to_cpu(dqp->q_core.d_id);
+- dst->d_blk_hardlimit =
+- XFS_FSB_TO_BB(mp, be64_to_cpu(dqp->q_core.d_blk_hardlimit));
+- dst->d_blk_softlimit =
+- XFS_FSB_TO_BB(mp, be64_to_cpu(dqp->q_core.d_blk_softlimit));
++ dst->d_spc_hardlimit =
++ XFS_FSB_TO_B(mp, be64_to_cpu(dqp->q_core.d_blk_hardlimit));
++ dst->d_spc_softlimit =
++ XFS_FSB_TO_B(mp, be64_to_cpu(dqp->q_core.d_blk_softlimit));
+ dst->d_ino_hardlimit = be64_to_cpu(dqp->q_core.d_ino_hardlimit);
+ dst->d_ino_softlimit = be64_to_cpu(dqp->q_core.d_ino_softlimit);
+- dst->d_bcount = XFS_FSB_TO_BB(mp, dqp->q_res_bcount);
+- dst->d_icount = dqp->q_res_icount;
+- dst->d_btimer = be32_to_cpu(dqp->q_core.d_btimer);
+- dst->d_itimer = be32_to_cpu(dqp->q_core.d_itimer);
+- dst->d_iwarns = be16_to_cpu(dqp->q_core.d_iwarns);
+- dst->d_bwarns = be16_to_cpu(dqp->q_core.d_bwarns);
+- dst->d_rtb_hardlimit =
+- XFS_FSB_TO_BB(mp, be64_to_cpu(dqp->q_core.d_rtb_hardlimit));
+- dst->d_rtb_softlimit =
+- XFS_FSB_TO_BB(mp, be64_to_cpu(dqp->q_core.d_rtb_softlimit));
+- dst->d_rtbcount = XFS_FSB_TO_BB(mp, dqp->q_res_rtbcount);
+- dst->d_rtbtimer = be32_to_cpu(dqp->q_core.d_rtbtimer);
+- dst->d_rtbwarns = be16_to_cpu(dqp->q_core.d_rtbwarns);
++ dst->d_space = XFS_FSB_TO_B(mp, dqp->q_res_bcount);
++ dst->d_ino_count = dqp->q_res_icount;
++ dst->d_spc_timer = be32_to_cpu(dqp->q_core.d_btimer);
++ dst->d_ino_timer = be32_to_cpu(dqp->q_core.d_itimer);
++ dst->d_ino_warns = be16_to_cpu(dqp->q_core.d_iwarns);
++ dst->d_spc_warns = be16_to_cpu(dqp->q_core.d_bwarns);
++ dst->d_rt_spc_hardlimit =
++ XFS_FSB_TO_B(mp, be64_to_cpu(dqp->q_core.d_rtb_hardlimit));
++ dst->d_rt_spc_softlimit =
++ XFS_FSB_TO_B(mp, be64_to_cpu(dqp->q_core.d_rtb_softlimit));
++ dst->d_rt_space = XFS_FSB_TO_B(mp, dqp->q_res_rtbcount);
++ dst->d_rt_spc_timer = be32_to_cpu(dqp->q_core.d_rtbtimer);
++ dst->d_rt_spc_warns = be16_to_cpu(dqp->q_core.d_rtbwarns);
+
+ /*
+ * Internally, we don't reset all the timers when quota enforcement
+@@ -889,23 +885,23 @@ xfs_qm_scall_getquota(
+ dqp->q_core.d_flags == XFS_DQ_GROUP) ||
+ (!XFS_IS_PQUOTA_ENFORCED(mp) &&
+ dqp->q_core.d_flags == XFS_DQ_PROJ)) {
+- dst->d_btimer = 0;
+- dst->d_itimer = 0;
+- dst->d_rtbtimer = 0;
++ dst->d_spc_timer = 0;
++ dst->d_ino_timer = 0;
++ dst->d_rt_spc_timer = 0;
+ }
+
+ #ifdef DEBUG
+- if (((XFS_IS_UQUOTA_ENFORCED(mp) && dst->d_flags == FS_USER_QUOTA) ||
+- (XFS_IS_GQUOTA_ENFORCED(mp) && dst->d_flags == FS_GROUP_QUOTA) ||
+- (XFS_IS_PQUOTA_ENFORCED(mp) && dst->d_flags == FS_PROJ_QUOTA)) &&
+- dst->d_id != 0) {
+- if ((dst->d_bcount > dst->d_blk_softlimit) &&
+- (dst->d_blk_softlimit > 0)) {
+- ASSERT(dst->d_btimer != 0);
++ if (((XFS_IS_UQUOTA_ENFORCED(mp) && type == XFS_DQ_USER) ||
++ (XFS_IS_GQUOTA_ENFORCED(mp) && type == XFS_DQ_GROUP) ||
++ (XFS_IS_PQUOTA_ENFORCED(mp) && type == XFS_DQ_PROJ)) &&
++ id != 0) {
++ if ((dst->d_space > dst->d_spc_softlimit) &&
++ (dst->d_spc_softlimit > 0)) {
++ ASSERT(dst->d_spc_timer != 0);
+ }
+- if ((dst->d_icount > dst->d_ino_softlimit) &&
++ if ((dst->d_ino_count > dst->d_ino_softlimit) &&
+ (dst->d_ino_softlimit > 0)) {
+- ASSERT(dst->d_itimer != 0);
++ ASSERT(dst->d_ino_timer != 0);
+ }
+ }
+ #endif
+@@ -915,26 +911,6 @@ out_put:
+ }
+
+ STATIC uint
+-xfs_qm_export_qtype_flags(
+- uint flags)
+-{
+- /*
+- * Can't be more than one, or none.
+- */
+- ASSERT((flags & (FS_PROJ_QUOTA | FS_USER_QUOTA)) !=
+- (FS_PROJ_QUOTA | FS_USER_QUOTA));
+- ASSERT((flags & (FS_PROJ_QUOTA | FS_GROUP_QUOTA)) !=
+- (FS_PROJ_QUOTA | FS_GROUP_QUOTA));
+- ASSERT((flags & (FS_USER_QUOTA | FS_GROUP_QUOTA)) !=
+- (FS_USER_QUOTA | FS_GROUP_QUOTA));
+- ASSERT((flags & (FS_PROJ_QUOTA|FS_USER_QUOTA|FS_GROUP_QUOTA)) != 0);
+-
+- return (flags & XFS_DQ_USER) ?
+- FS_USER_QUOTA : (flags & XFS_DQ_PROJ) ?
+- FS_PROJ_QUOTA : FS_GROUP_QUOTA;
+-}
+-
+-STATIC uint
+ xfs_qm_export_flags(
+ uint flags)
+ {
+diff --git a/fs/xfs/xfs_quotaops.c b/fs/xfs/xfs_quotaops.c
+index b238027df987..320c814bb9a5 100644
+--- a/fs/xfs/xfs_quotaops.c
++++ b/fs/xfs/xfs_quotaops.c
+@@ -133,7 +133,7 @@ STATIC int
+ xfs_fs_get_dqblk(
+ struct super_block *sb,
+ struct kqid qid,
+- struct fs_disk_quota *fdq)
++ struct qc_dqblk *qdq)
+ {
+ struct xfs_mount *mp = XFS_M(sb);
+
+@@ -143,14 +143,14 @@ xfs_fs_get_dqblk(
+ return -ESRCH;
+
+ return xfs_qm_scall_getquota(mp, from_kqid(&init_user_ns, qid),
+- xfs_quota_type(qid.type), fdq);
++ xfs_quota_type(qid.type), qdq);
+ }
+
+ STATIC int
+ xfs_fs_set_dqblk(
+ struct super_block *sb,
+ struct kqid qid,
+- struct fs_disk_quota *fdq)
++ struct qc_dqblk *qdq)
+ {
+ struct xfs_mount *mp = XFS_M(sb);
+
+@@ -162,7 +162,7 @@ xfs_fs_set_dqblk(
+ return -ESRCH;
+
+ return xfs_qm_scall_setqlim(mp, from_kqid(&init_user_ns, qid),
+- xfs_quota_type(qid.type), fdq);
++ xfs_quota_type(qid.type), qdq);
+ }
+
+ const struct quotactl_ops xfs_quotactl_operations = {
+diff --git a/include/linux/mm.h b/include/linux/mm.h
+index 5ab2da9811c1..86a977bf4f79 100644
+--- a/include/linux/mm.h
++++ b/include/linux/mm.h
+@@ -1054,6 +1054,7 @@ static inline int page_mapped(struct page *page)
+ #define VM_FAULT_WRITE 0x0008 /* Special case for get_user_pages */
+ #define VM_FAULT_HWPOISON 0x0010 /* Hit poisoned small page */
+ #define VM_FAULT_HWPOISON_LARGE 0x0020 /* Hit poisoned large page. Index encoded in upper bits */
++#define VM_FAULT_SIGSEGV 0x0040
+
+ #define VM_FAULT_NOPAGE 0x0100 /* ->fault installed the pte, not return page */
+ #define VM_FAULT_LOCKED 0x0200 /* ->fault locked the returned page */
+@@ -1062,8 +1063,9 @@ static inline int page_mapped(struct page *page)
+
+ #define VM_FAULT_HWPOISON_LARGE_MASK 0xf000 /* encodes hpage index for large hwpoison */
+
+-#define VM_FAULT_ERROR (VM_FAULT_OOM | VM_FAULT_SIGBUS | VM_FAULT_HWPOISON | \
+- VM_FAULT_FALLBACK | VM_FAULT_HWPOISON_LARGE)
++#define VM_FAULT_ERROR (VM_FAULT_OOM | VM_FAULT_SIGBUS | VM_FAULT_SIGSEGV | \
++ VM_FAULT_HWPOISON | VM_FAULT_HWPOISON_LARGE | \
++ VM_FAULT_FALLBACK)
+
+ /* Encode hstate index for a hwpoisoned large page */
+ #define VM_FAULT_SET_HINDEX(x) ((x) << 12)
+diff --git a/include/linux/quota.h b/include/linux/quota.h
+index 80d345a3524c..224fb8154f8f 100644
+--- a/include/linux/quota.h
++++ b/include/linux/quota.h
+@@ -316,6 +316,49 @@ struct dquot_operations {
+
+ struct path;
+
++/* Structure for communicating via ->get_dqblk() & ->set_dqblk() */
++struct qc_dqblk {
++ int d_fieldmask; /* mask of fields to change in ->set_dqblk() */
++ u64 d_spc_hardlimit; /* absolute limit on used space */
++ u64 d_spc_softlimit; /* preferred limit on used space */
++ u64 d_ino_hardlimit; /* maximum # allocated inodes */
++ u64 d_ino_softlimit; /* preferred inode limit */
++ u64 d_space; /* Space owned by the user */
++ u64 d_ino_count; /* # inodes owned by the user */
++ s64 d_ino_timer; /* zero if within inode limits */
++ /* if not, we refuse service */
++ s64 d_spc_timer; /* similar to above; for space */
++ int d_ino_warns; /* # warnings issued wrt num inodes */
++ int d_spc_warns; /* # warnings issued wrt used space */
++ u64 d_rt_spc_hardlimit; /* absolute limit on realtime space */
++ u64 d_rt_spc_softlimit; /* preferred limit on RT space */
++ u64 d_rt_space; /* realtime space owned */
++ s64 d_rt_spc_timer; /* similar to above; for RT space */
++ int d_rt_spc_warns; /* # warnings issued wrt RT space */
++};
++
++/* Field specifiers for ->set_dqblk() in struct qc_dqblk */
++#define QC_INO_SOFT (1<<0)
++#define QC_INO_HARD (1<<1)
++#define QC_SPC_SOFT (1<<2)
++#define QC_SPC_HARD (1<<3)
++#define QC_RT_SPC_SOFT (1<<4)
++#define QC_RT_SPC_HARD (1<<5)
++#define QC_LIMIT_MASK (QC_INO_SOFT | QC_INO_HARD | QC_SPC_SOFT | QC_SPC_HARD | \
++ QC_RT_SPC_SOFT | QC_RT_SPC_HARD)
++#define QC_SPC_TIMER (1<<6)
++#define QC_INO_TIMER (1<<7)
++#define QC_RT_SPC_TIMER (1<<8)
++#define QC_TIMER_MASK (QC_SPC_TIMER | QC_INO_TIMER | QC_RT_SPC_TIMER)
++#define QC_SPC_WARNS (1<<9)
++#define QC_INO_WARNS (1<<10)
++#define QC_RT_SPC_WARNS (1<<11)
++#define QC_WARNS_MASK (QC_SPC_WARNS | QC_INO_WARNS | QC_RT_SPC_WARNS)
++#define QC_SPACE (1<<12)
++#define QC_INO_COUNT (1<<13)
++#define QC_RT_SPACE (1<<14)
++#define QC_ACCT_MASK (QC_SPACE | QC_INO_COUNT | QC_RT_SPACE)
++
+ /* Operations handling requests from userspace */
+ struct quotactl_ops {
+ int (*quota_on)(struct super_block *, int, int, struct path *);
+@@ -324,8 +367,8 @@ struct quotactl_ops {
+ int (*quota_sync)(struct super_block *, int);
+ int (*get_info)(struct super_block *, int, struct if_dqinfo *);
+ int (*set_info)(struct super_block *, int, struct if_dqinfo *);
+- int (*get_dqblk)(struct super_block *, struct kqid, struct fs_disk_quota *);
+- int (*set_dqblk)(struct super_block *, struct kqid, struct fs_disk_quota *);
++ int (*get_dqblk)(struct super_block *, struct kqid, struct qc_dqblk *);
++ int (*set_dqblk)(struct super_block *, struct kqid, struct qc_dqblk *);
+ int (*get_xstate)(struct super_block *, struct fs_quota_stat *);
+ int (*set_xstate)(struct super_block *, unsigned int, int);
+ int (*get_xstatev)(struct super_block *, struct fs_quota_statv *);
+diff --git a/include/linux/quotaops.h b/include/linux/quotaops.h
+index 1d3eee594cd6..bfaf7138d5ee 100644
+--- a/include/linux/quotaops.h
++++ b/include/linux/quotaops.h
+@@ -98,9 +98,9 @@ int dquot_quota_sync(struct super_block *sb, int type);
+ int dquot_get_dqinfo(struct super_block *sb, int type, struct if_dqinfo *ii);
+ int dquot_set_dqinfo(struct super_block *sb, int type, struct if_dqinfo *ii);
+ int dquot_get_dqblk(struct super_block *sb, struct kqid id,
+- struct fs_disk_quota *di);
++ struct qc_dqblk *di);
+ int dquot_set_dqblk(struct super_block *sb, struct kqid id,
+- struct fs_disk_quota *di);
++ struct qc_dqblk *di);
+
+ int __dquot_transfer(struct inode *inode, struct dquot **transfer_to);
+ int dquot_transfer(struct inode *inode, struct iattr *iattr);
+diff --git a/mm/gup.c b/mm/gup.c
+index cd62c8c90d4a..a0d57ec05510 100644
+--- a/mm/gup.c
++++ b/mm/gup.c
+@@ -296,7 +296,7 @@ static int faultin_page(struct task_struct *tsk, struct vm_area_struct *vma,
+ return -ENOMEM;
+ if (ret & (VM_FAULT_HWPOISON | VM_FAULT_HWPOISON_LARGE))
+ return *flags & FOLL_HWPOISON ? -EHWPOISON : -EFAULT;
+- if (ret & VM_FAULT_SIGBUS)
++ if (ret & (VM_FAULT_SIGBUS | VM_FAULT_SIGSEGV))
+ return -EFAULT;
+ BUG();
+ }
+@@ -571,7 +571,7 @@ int fixup_user_fault(struct task_struct *tsk, struct mm_struct *mm,
+ return -ENOMEM;
+ if (ret & (VM_FAULT_HWPOISON | VM_FAULT_HWPOISON_LARGE))
+ return -EHWPOISON;
+- if (ret & VM_FAULT_SIGBUS)
++ if (ret & (VM_FAULT_SIGBUS | VM_FAULT_SIGSEGV))
+ return -EFAULT;
+ BUG();
+ }
+diff --git a/mm/ksm.c b/mm/ksm.c
+index 6b2e337bc03c..a0ed043a1096 100644
+--- a/mm/ksm.c
++++ b/mm/ksm.c
+@@ -376,7 +376,7 @@ static int break_ksm(struct vm_area_struct *vma, unsigned long addr)
+ else
+ ret = VM_FAULT_WRITE;
+ put_page(page);
+- } while (!(ret & (VM_FAULT_WRITE | VM_FAULT_SIGBUS | VM_FAULT_OOM)));
++ } while (!(ret & (VM_FAULT_WRITE | VM_FAULT_SIGBUS | VM_FAULT_SIGSEGV | VM_FAULT_OOM)));
+ /*
+ * We must loop because handle_mm_fault() may back out if there's
+ * any difficulty e.g. if pte accessed bit gets updated concurrently.
+diff --git a/mm/memcontrol.c b/mm/memcontrol.c
+index d6ac0e33e150..4918b6eefae2 100644
+--- a/mm/memcontrol.c
++++ b/mm/memcontrol.c
+@@ -1638,9 +1638,9 @@ void mem_cgroup_print_oom_info(struct mem_cgroup *memcg, struct task_struct *p)
+
+ pr_info("Task in ");
+ pr_cont_cgroup_path(task_cgroup(p, memory_cgrp_id));
+- pr_info(" killed as a result of limit of ");
++ pr_cont(" killed as a result of limit of ");
+ pr_cont_cgroup_path(memcg->css.cgroup);
+- pr_info("\n");
++ pr_cont("\n");
+
+ rcu_read_unlock();
+
+diff --git a/mm/memory.c b/mm/memory.c
+index 7f86cf6252bd..d442584fd281 100644
+--- a/mm/memory.c
++++ b/mm/memory.c
+@@ -2645,7 +2645,7 @@ static int do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma,
+
+ /* Check if we need to add a guard page to the stack */
+ if (check_stack_guard_page(vma, address) < 0)
+- return VM_FAULT_SIGBUS;
++ return VM_FAULT_SIGSEGV;
+
+ /* Use the zero-page for reads */
+ if (!(flags & FAULT_FLAG_WRITE)) {
+diff --git a/net/mac80211/pm.c b/net/mac80211/pm.c
+index 4c5192e0d66c..4a95fe3cffbc 100644
+--- a/net/mac80211/pm.c
++++ b/net/mac80211/pm.c
+@@ -86,20 +86,6 @@ int __ieee80211_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan)
+ }
+ }
+
+- /* tear down aggregation sessions and remove STAs */
+- mutex_lock(&local->sta_mtx);
+- list_for_each_entry(sta, &local->sta_list, list) {
+- if (sta->uploaded) {
+- enum ieee80211_sta_state state;
+-
+- state = sta->sta_state;
+- for (; state > IEEE80211_STA_NOTEXIST; state--)
+- WARN_ON(drv_sta_state(local, sta->sdata, sta,
+- state, state - 1));
+- }
+- }
+- mutex_unlock(&local->sta_mtx);
+-
+ /* remove all interfaces that were created in the driver */
+ list_for_each_entry(sdata, &local->interfaces, list) {
+ if (!ieee80211_sdata_running(sdata))
+@@ -111,6 +97,21 @@ int __ieee80211_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan)
+ case NL80211_IFTYPE_STATION:
+ ieee80211_mgd_quiesce(sdata);
+ break;
++ case NL80211_IFTYPE_WDS:
++ /* tear down aggregation sessions and remove STAs */
++ mutex_lock(&local->sta_mtx);
++ sta = sdata->u.wds.sta;
++ if (sta && sta->uploaded) {
++ enum ieee80211_sta_state state;
++
++ state = sta->sta_state;
++ for (; state > IEEE80211_STA_NOTEXIST; state--)
++ WARN_ON(drv_sta_state(local, sta->sdata,
++ sta, state,
++ state - 1));
++ }
++ mutex_unlock(&local->sta_mtx);
++ break;
+ default:
+ break;
+ }
+diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
+index e60da9a062c2..7d6379bd2cb8 100644
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -235,7 +235,7 @@ ieee80211_add_rx_radiotap_header(struct ieee80211_local *local,
+ else if (rate && rate->flags & IEEE80211_RATE_ERP_G)
+ channel_flags |= IEEE80211_CHAN_OFDM | IEEE80211_CHAN_2GHZ;
+ else if (rate)
+- channel_flags |= IEEE80211_CHAN_OFDM | IEEE80211_CHAN_2GHZ;
++ channel_flags |= IEEE80211_CHAN_CCK | IEEE80211_CHAN_2GHZ;
+ else
+ channel_flags |= IEEE80211_CHAN_2GHZ;
+ put_unaligned_le16(channel_flags, pos);
+diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
+index ea558e07981f..213048ad31c7 100644
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -2805,6 +2805,9 @@ static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
+ if (!rdev->ops->get_key)
+ return -EOPNOTSUPP;
+
++ if (!pairwise && mac_addr && !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
++ return -ENOENT;
++
+ msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
+ if (!msg)
+ return -ENOMEM;
+@@ -2824,10 +2827,6 @@ static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
+ nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
+ goto nla_put_failure;
+
+- if (pairwise && mac_addr &&
+- !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
+- return -ENOENT;
+-
+ err = rdev_get_key(rdev, dev, key_idx, pairwise, mac_addr, &cookie,
+ get_key_callback);
+
+@@ -2998,7 +2997,7 @@ static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
+ wdev_lock(dev->ieee80211_ptr);
+ err = nl80211_key_allowed(dev->ieee80211_ptr);
+
+- if (key.type == NL80211_KEYTYPE_PAIRWISE && mac_addr &&
++ if (key.type == NL80211_KEYTYPE_GROUP && mac_addr &&
+ !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
+ err = -ENOENT;
+
+diff --git a/sound/core/seq/seq_dummy.c b/sound/core/seq/seq_dummy.c
+index ec667f158f19..5d905d90d504 100644
+--- a/sound/core/seq/seq_dummy.c
++++ b/sound/core/seq/seq_dummy.c
+@@ -82,36 +82,6 @@ struct snd_seq_dummy_port {
+ static int my_client = -1;
+
+ /*
+- * unuse callback - send ALL_SOUNDS_OFF and RESET_CONTROLLERS events
+- * to subscribers.
+- * Note: this callback is called only after all subscribers are removed.
+- */
+-static int
+-dummy_unuse(void *private_data, struct snd_seq_port_subscribe *info)
+-{
+- struct snd_seq_dummy_port *p;
+- int i;
+- struct snd_seq_event ev;
+-
+- p = private_data;
+- memset(&ev, 0, sizeof(ev));
+- if (p->duplex)
+- ev.source.port = p->connect;
+- else
+- ev.source.port = p->port;
+- ev.dest.client = SNDRV_SEQ_ADDRESS_SUBSCRIBERS;
+- ev.type = SNDRV_SEQ_EVENT_CONTROLLER;
+- for (i = 0; i < 16; i++) {
+- ev.data.control.channel = i;
+- ev.data.control.param = MIDI_CTL_ALL_SOUNDS_OFF;
+- snd_seq_kernel_client_dispatch(p->client, &ev, 0, 0);
+- ev.data.control.param = MIDI_CTL_RESET_CONTROLLERS;
+- snd_seq_kernel_client_dispatch(p->client, &ev, 0, 0);
+- }
+- return 0;
+-}
+-
+-/*
+ * event input callback - just redirect events to subscribers
+ */
+ static int
+@@ -175,7 +145,6 @@ create_port(int idx, int type)
+ | SNDRV_SEQ_PORT_TYPE_PORT;
+ memset(&pcb, 0, sizeof(pcb));
+ pcb.owner = THIS_MODULE;
+- pcb.unuse = dummy_unuse;
+ pcb.event_input = dummy_input;
+ pcb.private_free = dummy_free;
+ pcb.private_data = rec;
+diff --git a/sound/soc/codecs/pcm512x.c b/sound/soc/codecs/pcm512x.c
+index 0c8aefab404c..640c99198cda 100644
+--- a/sound/soc/codecs/pcm512x.c
++++ b/sound/soc/codecs/pcm512x.c
+@@ -188,8 +188,8 @@ static const DECLARE_TLV_DB_SCALE(boost_tlv, 0, 80, 0);
+ static const char * const pcm512x_dsp_program_texts[] = {
+ "FIR interpolation with de-emphasis",
+ "Low latency IIR with de-emphasis",
+- "Fixed process flow",
+ "High attenuation with de-emphasis",
++ "Fixed process flow",
+ "Ringing-less low latency FIR",
+ };
+
+diff --git a/sound/soc/codecs/wm8960.c b/sound/soc/codecs/wm8960.c
+index 4dc4e85116cd..641f940c138d 100644
+--- a/sound/soc/codecs/wm8960.c
++++ b/sound/soc/codecs/wm8960.c
+@@ -555,7 +555,7 @@ static struct {
+ { 22050, 2 },
+ { 24000, 2 },
+ { 16000, 3 },
+- { 11250, 4 },
++ { 11025, 4 },
+ { 12000, 4 },
+ { 8000, 5 },
+ };
+diff --git a/sound/soc/fsl/fsl_esai.h b/sound/soc/fsl/fsl_esai.h
+index 91a550f4a10d..5e793bbb6b02 100644
+--- a/sound/soc/fsl/fsl_esai.h
++++ b/sound/soc/fsl/fsl_esai.h
+@@ -302,7 +302,7 @@
+ #define ESAI_xCCR_xFP_MASK (((1 << ESAI_xCCR_xFP_WIDTH) - 1) << ESAI_xCCR_xFP_SHIFT)
+ #define ESAI_xCCR_xFP(v) ((((v) - 1) << ESAI_xCCR_xFP_SHIFT) & ESAI_xCCR_xFP_MASK)
+ #define ESAI_xCCR_xDC_SHIFT 9
+-#define ESAI_xCCR_xDC_WIDTH 4
++#define ESAI_xCCR_xDC_WIDTH 5
+ #define ESAI_xCCR_xDC_MASK (((1 << ESAI_xCCR_xDC_WIDTH) - 1) << ESAI_xCCR_xDC_SHIFT)
+ #define ESAI_xCCR_xDC(v) ((((v) - 1) << ESAI_xCCR_xDC_SHIFT) & ESAI_xCCR_xDC_MASK)
+ #define ESAI_xCCR_xPSR_SHIFT 8
+diff --git a/sound/soc/generic/simple-card.c b/sound/soc/generic/simple-card.c
+index d1b7293c133e..c6a6693bbfc9 100644
+--- a/sound/soc/generic/simple-card.c
++++ b/sound/soc/generic/simple-card.c
+@@ -453,9 +453,8 @@ static int asoc_simple_card_parse_of(struct device_node *node,
+ }
+
+ /* Decrease the reference count of the device nodes */
+-static int asoc_simple_card_unref(struct platform_device *pdev)
++static int asoc_simple_card_unref(struct snd_soc_card *card)
+ {
+- struct snd_soc_card *card = platform_get_drvdata(pdev);
+ struct snd_soc_dai_link *dai_link;
+ struct device_node *np;
+ int num_links;
+@@ -562,7 +561,7 @@ static int asoc_simple_card_probe(struct platform_device *pdev)
+ return ret;
+
+ err:
+- asoc_simple_card_unref(pdev);
++ asoc_simple_card_unref(&priv->snd_card);
+ return ret;
+ }
+
+@@ -578,7 +577,7 @@ static int asoc_simple_card_remove(struct platform_device *pdev)
+ snd_soc_jack_free_gpios(&simple_card_mic_jack, 1,
+ &simple_card_mic_jack_gpio);
+
+- return asoc_simple_card_unref(pdev);
++ return asoc_simple_card_unref(card);
+ }
+
+ static const struct of_device_id asoc_simple_of_match[] = {
+diff --git a/sound/soc/omap/omap-mcbsp.c b/sound/soc/omap/omap-mcbsp.c
+index bd3ef2a88be0..aafc0686ab22 100644
+--- a/sound/soc/omap/omap-mcbsp.c
++++ b/sound/soc/omap/omap-mcbsp.c
+@@ -434,7 +434,7 @@ static int omap_mcbsp_dai_set_dai_fmt(struct snd_soc_dai *cpu_dai,
+ case SND_SOC_DAIFMT_CBM_CFS:
+ /* McBSP slave. FS clock as output */
+ regs->srgr2 |= FSGM;
+- regs->pcr0 |= FSXM;
++ regs->pcr0 |= FSXM | FSRM;
+ break;
+ case SND_SOC_DAIFMT_CBM_CFM:
+ /* McBSP slave */
+diff --git a/sound/soc/soc-compress.c b/sound/soc/soc-compress.c
+index cecfab3cc948..08e430d664cd 100644
+--- a/sound/soc/soc-compress.c
++++ b/sound/soc/soc-compress.c
+@@ -666,7 +666,8 @@ int soc_new_compress(struct snd_soc_pcm_runtime *rtd, int num)
+ rtd->dai_link->stream_name);
+
+ ret = snd_pcm_new_internal(rtd->card->snd_card, new_name, num,
+- 1, 0, &be_pcm);
++ rtd->dai_link->dpcm_playback,
++ rtd->dai_link->dpcm_capture, &be_pcm);
+ if (ret < 0) {
+ dev_err(rtd->card->dev, "ASoC: can't create compressed for %s\n",
+ rtd->dai_link->name);
+@@ -675,8 +676,10 @@ int soc_new_compress(struct snd_soc_pcm_runtime *rtd, int num)
+
+ rtd->pcm = be_pcm;
+ rtd->fe_compr = 1;
+- be_pcm->streams[SNDRV_PCM_STREAM_PLAYBACK].substream->private_data = rtd;
+- be_pcm->streams[SNDRV_PCM_STREAM_CAPTURE].substream->private_data = rtd;
++ if (rtd->dai_link->dpcm_playback)
++ be_pcm->streams[SNDRV_PCM_STREAM_PLAYBACK].substream->private_data = rtd;
++ else if (rtd->dai_link->dpcm_capture)
++ be_pcm->streams[SNDRV_PCM_STREAM_CAPTURE].substream->private_data = rtd;
+ memcpy(compr->ops, &soc_compr_dyn_ops, sizeof(soc_compr_dyn_ops));
+ } else
+ memcpy(compr->ops, &soc_compr_ops, sizeof(soc_compr_ops));
^ permalink raw reply related [flat|nested] 67+ messages in thread
* [gentoo-commits] proj/linux-patches:3.18 commit in: /
@ 2015-02-11 14:35 Mike Pagano
0 siblings, 0 replies; 67+ messages in thread
From: Mike Pagano @ 2015-02-11 14:35 UTC (permalink / raw
To: gentoo-commits
commit: 12b7e98443115d5b6de4d34d90afc490d3a4fecf
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed Feb 11 14:35:42 2015 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed Feb 11 14:35:42 2015 +0000
URL: http://sources.gentoo.org/gitweb/?p=proj/linux-patches.git;a=commit;h=12b7e984
Linux patch 3.18.7
---
0000_README | 4 +
1006_linux-3.18.7.patch | 1358 +++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 1362 insertions(+)
diff --git a/0000_README b/0000_README
index 626b2f5..d897d2e 100644
--- a/0000_README
+++ b/0000_README
@@ -67,6 +67,10 @@ Patch: 1005_linux-3.18.6.patch
From: http://www.kernel.org
Desc: Linux 3.18.6
+Patch: 1006_linux-3.18.7.patch
+From: http://www.kernel.org
+Desc: Linux 3.18.7
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1006_linux-3.18.7.patch b/1006_linux-3.18.7.patch
new file mode 100644
index 0000000..d5ed161
--- /dev/null
+++ b/1006_linux-3.18.7.patch
@@ -0,0 +1,1358 @@
+diff --git a/Makefile b/Makefile
+index d2bff2d5ae25..0efae2279fbe 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 18
+-SUBLEVEL = 6
++SUBLEVEL = 7
+ EXTRAVERSION =
+ NAME = Diseased Newt
+
+diff --git a/arch/arm/boot/dts/exynos4.dtsi b/arch/arm/boot/dts/exynos4.dtsi
+index e0278ecbc816..98960b7bc518 100644
+--- a/arch/arm/boot/dts/exynos4.dtsi
++++ b/arch/arm/boot/dts/exynos4.dtsi
+@@ -368,7 +368,7 @@
+ };
+
+ i2s1: i2s@13960000 {
+- compatible = "samsung,s5pv210-i2s";
++ compatible = "samsung,s3c6410-i2s";
+ reg = <0x13960000 0x100>;
+ clocks = <&clock CLK_I2S1>;
+ clock-names = "iis";
+@@ -378,7 +378,7 @@
+ };
+
+ i2s2: i2s@13970000 {
+- compatible = "samsung,s5pv210-i2s";
++ compatible = "samsung,s3c6410-i2s";
+ reg = <0x13970000 0x100>;
+ clocks = <&clock CLK_I2S2>;
+ clock-names = "iis";
+diff --git a/arch/arm/mm/context.c b/arch/arm/mm/context.c
+index 6eb97b3a7481..4370933f16cd 100644
+--- a/arch/arm/mm/context.c
++++ b/arch/arm/mm/context.c
+@@ -144,21 +144,17 @@ static void flush_context(unsigned int cpu)
+ /* Update the list of reserved ASIDs and the ASID bitmap. */
+ bitmap_clear(asid_map, 0, NUM_USER_ASIDS);
+ for_each_possible_cpu(i) {
+- if (i == cpu) {
+- asid = 0;
+- } else {
+- asid = atomic64_xchg(&per_cpu(active_asids, i), 0);
+- /*
+- * If this CPU has already been through a
+- * rollover, but hasn't run another task in
+- * the meantime, we must preserve its reserved
+- * ASID, as this is the only trace we have of
+- * the process it is still running.
+- */
+- if (asid == 0)
+- asid = per_cpu(reserved_asids, i);
+- __set_bit(asid & ~ASID_MASK, asid_map);
+- }
++ asid = atomic64_xchg(&per_cpu(active_asids, i), 0);
++ /*
++ * If this CPU has already been through a
++ * rollover, but hasn't run another task in
++ * the meantime, we must preserve its reserved
++ * ASID, as this is the only trace we have of
++ * the process it is still running.
++ */
++ if (asid == 0)
++ asid = per_cpu(reserved_asids, i);
++ __set_bit(asid & ~ASID_MASK, asid_map);
+ per_cpu(reserved_asids, i) = asid;
+ }
+
+diff --git a/arch/arm64/kernel/setup.c b/arch/arm64/kernel/setup.c
+index 64c4f0800ee3..38eead12f35b 100644
+--- a/arch/arm64/kernel/setup.c
++++ b/arch/arm64/kernel/setup.c
+@@ -43,6 +43,7 @@
+ #include <linux/of_fdt.h>
+ #include <linux/of_platform.h>
+ #include <linux/efi.h>
++#include <linux/personality.h>
+
+ #include <asm/fixmap.h>
+ #include <asm/cpu.h>
+@@ -79,7 +80,6 @@ unsigned int compat_elf_hwcap2 __read_mostly;
+ #endif
+
+ static const char *cpu_name;
+-static const char *machine_name;
+ phys_addr_t __fdt_pointer __initdata;
+
+ /*
+@@ -311,8 +311,6 @@ static void __init setup_machine_fdt(phys_addr_t dt_phys)
+ while (true)
+ cpu_relax();
+ }
+-
+- machine_name = of_flat_dt_get_machine_name();
+ }
+
+ /*
+@@ -449,14 +447,50 @@ static const char *hwcap_str[] = {
+ NULL
+ };
+
++#ifdef CONFIG_COMPAT
++static const char *compat_hwcap_str[] = {
++ "swp",
++ "half",
++ "thumb",
++ "26bit",
++ "fastmult",
++ "fpa",
++ "vfp",
++ "edsp",
++ "java",
++ "iwmmxt",
++ "crunch",
++ "thumbee",
++ "neon",
++ "vfpv3",
++ "vfpv3d16",
++ "tls",
++ "vfpv4",
++ "idiva",
++ "idivt",
++ "vfpd32",
++ "lpae",
++ "evtstrm"
++};
++
++static const char *compat_hwcap2_str[] = {
++ "aes",
++ "pmull",
++ "sha1",
++ "sha2",
++ "crc32",
++ NULL
++};
++#endif /* CONFIG_COMPAT */
++
+ static int c_show(struct seq_file *m, void *v)
+ {
+- int i;
+-
+- seq_printf(m, "Processor\t: %s rev %d (%s)\n",
+- cpu_name, read_cpuid_id() & 15, ELF_PLATFORM);
++ int i, j;
+
+ for_each_online_cpu(i) {
++ struct cpuinfo_arm64 *cpuinfo = &per_cpu(cpu_data, i);
++ u32 midr = cpuinfo->reg_midr;
++
+ /*
+ * glibc reads /proc/cpuinfo to determine the number of
+ * online processors, looking for lines beginning with
+@@ -465,24 +499,38 @@ static int c_show(struct seq_file *m, void *v)
+ #ifdef CONFIG_SMP
+ seq_printf(m, "processor\t: %d\n", i);
+ #endif
+- }
+-
+- /* dump out the processor features */
+- seq_puts(m, "Features\t: ");
+-
+- for (i = 0; hwcap_str[i]; i++)
+- if (elf_hwcap & (1 << i))
+- seq_printf(m, "%s ", hwcap_str[i]);
+-
+- seq_printf(m, "\nCPU implementer\t: 0x%02x\n", read_cpuid_id() >> 24);
+- seq_printf(m, "CPU architecture: AArch64\n");
+- seq_printf(m, "CPU variant\t: 0x%x\n", (read_cpuid_id() >> 20) & 15);
+- seq_printf(m, "CPU part\t: 0x%03x\n", (read_cpuid_id() >> 4) & 0xfff);
+- seq_printf(m, "CPU revision\t: %d\n", read_cpuid_id() & 15);
+
+- seq_puts(m, "\n");
+-
+- seq_printf(m, "Hardware\t: %s\n", machine_name);
++ /*
++ * Dump out the common processor features in a single line.
++ * Userspace should read the hwcaps with getauxval(AT_HWCAP)
++ * rather than attempting to parse this, but there's a body of
++ * software which does already (at least for 32-bit).
++ */
++ seq_puts(m, "Features\t:");
++ if (personality(current->personality) == PER_LINUX32) {
++#ifdef CONFIG_COMPAT
++ for (j = 0; compat_hwcap_str[j]; j++)
++ if (compat_elf_hwcap & (1 << j))
++ seq_printf(m, " %s", compat_hwcap_str[j]);
++
++ for (j = 0; compat_hwcap2_str[j]; j++)
++ if (compat_elf_hwcap2 & (1 << j))
++ seq_printf(m, " %s", compat_hwcap2_str[j]);
++#endif /* CONFIG_COMPAT */
++ } else {
++ for (j = 0; hwcap_str[j]; j++)
++ if (elf_hwcap & (1 << j))
++ seq_printf(m, " %s", hwcap_str[j]);
++ }
++ seq_puts(m, "\n");
++
++ seq_printf(m, "CPU implementer\t: 0x%02x\n",
++ MIDR_IMPLEMENTOR(midr));
++ seq_printf(m, "CPU architecture: 8\n");
++ seq_printf(m, "CPU variant\t: 0x%x\n", MIDR_VARIANT(midr));
++ seq_printf(m, "CPU part\t: 0x%03x\n", MIDR_PARTNUM(midr));
++ seq_printf(m, "CPU revision\t: %d\n\n", MIDR_REVISION(midr));
++ }
+
+ return 0;
+ }
+diff --git a/arch/mips/cavium-octeon/smp.c b/arch/mips/cavium-octeon/smp.c
+index ecd903dd1c45..8b1eeffa12ed 100644
+--- a/arch/mips/cavium-octeon/smp.c
++++ b/arch/mips/cavium-octeon/smp.c
+@@ -240,9 +240,7 @@ static int octeon_cpu_disable(void)
+
+ set_cpu_online(cpu, false);
+ cpu_clear(cpu, cpu_callin_map);
+- local_irq_disable();
+ octeon_fixup_irqs();
+- local_irq_enable();
+
+ flush_cache_all();
+ local_flush_tlb_all();
+diff --git a/arch/mips/include/asm/mipsregs.h b/arch/mips/include/asm/mipsregs.h
+index 22a135ac91de..f38ca68285ea 100644
+--- a/arch/mips/include/asm/mipsregs.h
++++ b/arch/mips/include/asm/mipsregs.h
+@@ -1343,12 +1343,27 @@ do { \
+ __res; \
+ })
+
++#define _write_32bit_cp1_register(dest, val, gas_hardfloat) \
++do { \
++ __asm__ __volatile__( \
++ " .set push \n" \
++ " .set reorder \n" \
++ " "STR(gas_hardfloat)" \n" \
++ " ctc1 %0,"STR(dest)" \n" \
++ " .set pop \n" \
++ : : "r" (val)); \
++} while (0)
++
+ #ifdef GAS_HAS_SET_HARDFLOAT
+ #define read_32bit_cp1_register(source) \
+ _read_32bit_cp1_register(source, .set hardfloat)
++#define write_32bit_cp1_register(dest, val) \
++ _write_32bit_cp1_register(dest, val, .set hardfloat)
+ #else
+ #define read_32bit_cp1_register(source) \
+ _read_32bit_cp1_register(source, )
++#define write_32bit_cp1_register(dest, val) \
++ _write_32bit_cp1_register(dest, val, )
+ #endif
+
+ #ifdef HAVE_AS_DSP
+diff --git a/arch/mips/kernel/irq_cpu.c b/arch/mips/kernel/irq_cpu.c
+index e498f2b3646a..f5598e25e906 100644
+--- a/arch/mips/kernel/irq_cpu.c
++++ b/arch/mips/kernel/irq_cpu.c
+@@ -56,6 +56,8 @@ static struct irq_chip mips_cpu_irq_controller = {
+ .irq_mask_ack = mask_mips_irq,
+ .irq_unmask = unmask_mips_irq,
+ .irq_eoi = unmask_mips_irq,
++ .irq_disable = mask_mips_irq,
++ .irq_enable = unmask_mips_irq,
+ };
+
+ /*
+@@ -92,6 +94,8 @@ static struct irq_chip mips_mt_cpu_irq_controller = {
+ .irq_mask_ack = mips_mt_cpu_irq_ack,
+ .irq_unmask = unmask_mips_irq,
+ .irq_eoi = unmask_mips_irq,
++ .irq_disable = mask_mips_irq,
++ .irq_enable = unmask_mips_irq,
+ };
+
+ void __init mips_cpu_irq_init(void)
+diff --git a/arch/mips/kernel/smp.c b/arch/mips/kernel/smp.c
+index c94c4e92e17d..1c0d8c50b7e1 100644
+--- a/arch/mips/kernel/smp.c
++++ b/arch/mips/kernel/smp.c
+@@ -123,10 +123,10 @@ asmlinkage void start_secondary(void)
+ unsigned int cpu;
+
+ cpu_probe();
+- cpu_report();
+ per_cpu_trap_init(false);
+ mips_clockevent_init();
+ mp_ops->init_secondary();
++ cpu_report();
+
+ /*
+ * XXX parity protection should be folded in here when it's converted
+diff --git a/arch/mips/kernel/traps.c b/arch/mips/kernel/traps.c
+index 22b19c275044..d255a2a1837a 100644
+--- a/arch/mips/kernel/traps.c
++++ b/arch/mips/kernel/traps.c
+@@ -1184,7 +1184,8 @@ static int enable_restore_fp_context(int msa)
+
+ /* Restore the scalar FP control & status register */
+ if (!was_fpu_owner)
+- asm volatile("ctc1 %0, $31" : : "r"(current->thread.fpu.fcr31));
++ write_32bit_cp1_register(CP1_STATUS,
++ current->thread.fpu.fcr31);
+ }
+
+ out:
+diff --git a/arch/mips/mm/tlb-r4k.c b/arch/mips/mm/tlb-r4k.c
+index c3917e251f59..11688e50e3ee 100644
+--- a/arch/mips/mm/tlb-r4k.c
++++ b/arch/mips/mm/tlb-r4k.c
+@@ -489,6 +489,8 @@ static void r4k_tlb_configure(void)
+ #ifdef CONFIG_64BIT
+ pg |= PG_ELPA;
+ #endif
++ if (cpu_has_rixiex)
++ pg |= PG_IEC;
+ write_c0_pagegrain(pg);
+ }
+
+diff --git a/arch/x86/kernel/cpu/microcode/core.c b/arch/x86/kernel/cpu/microcode/core.c
+index 15c29096136b..36a83617eb21 100644
+--- a/arch/x86/kernel/cpu/microcode/core.c
++++ b/arch/x86/kernel/cpu/microcode/core.c
+@@ -552,7 +552,7 @@ static int __init microcode_init(void)
+ int error;
+
+ if (paravirt_enabled() || dis_ucode_ldr)
+- return 0;
++ return -EINVAL;
+
+ if (c->x86_vendor == X86_VENDOR_INTEL)
+ microcode_ops = init_intel_microcode();
+diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c
+index a8612aafeca1..4d8ee827cb14 100644
+--- a/arch/x86/mm/fault.c
++++ b/arch/x86/mm/fault.c
+@@ -844,11 +844,8 @@ do_sigbus(struct pt_regs *regs, unsigned long error_code, unsigned long address,
+ unsigned int fault)
+ {
+ struct task_struct *tsk = current;
+- struct mm_struct *mm = tsk->mm;
+ int code = BUS_ADRERR;
+
+- up_read(&mm->mmap_sem);
+-
+ /* Kernel mode? Handle exceptions or die: */
+ if (!(error_code & PF_USER)) {
+ no_context(regs, error_code, address, SIGBUS, BUS_ADRERR);
+@@ -879,7 +876,6 @@ mm_fault_error(struct pt_regs *regs, unsigned long error_code,
+ unsigned long address, unsigned int fault)
+ {
+ if (fatal_signal_pending(current) && !(error_code & PF_USER)) {
+- up_read(¤t->mm->mmap_sem);
+ no_context(regs, error_code, address, 0, 0);
+ return;
+ }
+@@ -887,14 +883,11 @@ mm_fault_error(struct pt_regs *regs, unsigned long error_code,
+ if (fault & VM_FAULT_OOM) {
+ /* Kernel mode? Handle exceptions or die: */
+ if (!(error_code & PF_USER)) {
+- up_read(¤t->mm->mmap_sem);
+ no_context(regs, error_code, address,
+ SIGSEGV, SEGV_MAPERR);
+ return;
+ }
+
+- up_read(¤t->mm->mmap_sem);
+-
+ /*
+ * We ran out of memory, call the OOM killer, and return the
+ * userspace (which will retry the fault, or kill us if we got
+@@ -1249,6 +1242,7 @@ good_area:
+ return;
+
+ if (unlikely(fault & VM_FAULT_ERROR)) {
++ up_read(&mm->mmap_sem);
+ mm_fault_error(regs, error_code, address, fault);
+ return;
+ }
+diff --git a/arch/x86/pci/common.c b/arch/x86/pci/common.c
+index 7b20bccf3648..2fb384724ebb 100644
+--- a/arch/x86/pci/common.c
++++ b/arch/x86/pci/common.c
+@@ -448,6 +448,22 @@ static const struct dmi_system_id pciprobe_dmi_table[] __initconst = {
+ DMI_MATCH(DMI_PRODUCT_NAME, "ftServer"),
+ },
+ },
++ {
++ .callback = set_scan_all,
++ .ident = "Stratus/NEC ftServer",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "NEC"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Express5800/R32"),
++ },
++ },
++ {
++ .callback = set_scan_all,
++ .ident = "Stratus/NEC ftServer",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "NEC"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Express5800/R31"),
++ },
++ },
+ {}
+ };
+
+diff --git a/drivers/gpio/gpio-mcp23s08.c b/drivers/gpio/gpio-mcp23s08.c
+index 8488e2fd307c..36bc42942e89 100644
+--- a/drivers/gpio/gpio-mcp23s08.c
++++ b/drivers/gpio/gpio-mcp23s08.c
+@@ -785,9 +785,11 @@ static int mcp230xx_probe(struct i2c_client *client,
+ client->irq = irq_of_parse_and_map(client->dev.of_node, 0);
+ } else {
+ pdata = dev_get_platdata(&client->dev);
+- if (!pdata || !gpio_is_valid(pdata->base)) {
+- dev_dbg(&client->dev, "invalid platform data\n");
+- return -EINVAL;
++ if (!pdata) {
++ pdata = devm_kzalloc(&client->dev,
++ sizeof(struct mcp23s08_platform_data),
++ GFP_KERNEL);
++ pdata->base = -1;
+ }
+ }
+
+@@ -908,10 +910,11 @@ static int mcp23s08_probe(struct spi_device *spi)
+ } else {
+ type = spi_get_device_id(spi)->driver_data;
+ pdata = dev_get_platdata(&spi->dev);
+- if (!pdata || !gpio_is_valid(pdata->base)) {
+- dev_dbg(&spi->dev,
+- "invalid or missing platform data\n");
+- return -EINVAL;
++ if (!pdata) {
++ pdata = devm_kzalloc(&spi->dev,
++ sizeof(struct mcp23s08_platform_data),
++ GFP_KERNEL);
++ pdata->base = -1;
+ }
+
+ for (addr = 0; addr < ARRAY_SIZE(pdata->chip); addr++) {
+diff --git a/drivers/gpio/gpiolib-sysfs.c b/drivers/gpio/gpiolib-sysfs.c
+index 0d21396f961d..aed7dd6e9dca 100644
+--- a/drivers/gpio/gpiolib-sysfs.c
++++ b/drivers/gpio/gpiolib-sysfs.c
+@@ -630,6 +630,7 @@ int gpiod_export_link(struct device *dev, const char *name,
+ if (tdev != NULL) {
+ status = sysfs_create_link(&dev->kobj, &tdev->kobj,
+ name);
++ put_device(tdev);
+ } else {
+ status = -ENODEV;
+ }
+@@ -677,7 +678,7 @@ int gpiod_sysfs_set_active_low(struct gpio_desc *desc, int value)
+ }
+
+ status = sysfs_set_active_low(desc, dev, value);
+-
++ put_device(dev);
+ unlock:
+ mutex_unlock(&sysfs_lock);
+
+diff --git a/drivers/gpu/drm/radeon/radeon_benchmark.c b/drivers/gpu/drm/radeon/radeon_benchmark.c
+index 9e7f23dd14bd..87d5fb21cb61 100644
+--- a/drivers/gpu/drm/radeon/radeon_benchmark.c
++++ b/drivers/gpu/drm/radeon/radeon_benchmark.c
+@@ -34,7 +34,8 @@
+
+ static int radeon_benchmark_do_move(struct radeon_device *rdev, unsigned size,
+ uint64_t saddr, uint64_t daddr,
+- int flag, int n)
++ int flag, int n,
++ struct reservation_object *resv)
+ {
+ unsigned long start_jiffies;
+ unsigned long end_jiffies;
+@@ -47,12 +48,12 @@ static int radeon_benchmark_do_move(struct radeon_device *rdev, unsigned size,
+ case RADEON_BENCHMARK_COPY_DMA:
+ fence = radeon_copy_dma(rdev, saddr, daddr,
+ size / RADEON_GPU_PAGE_SIZE,
+- NULL);
++ resv);
+ break;
+ case RADEON_BENCHMARK_COPY_BLIT:
+ fence = radeon_copy_blit(rdev, saddr, daddr,
+ size / RADEON_GPU_PAGE_SIZE,
+- NULL);
++ resv);
+ break;
+ default:
+ DRM_ERROR("Unknown copy method\n");
+@@ -120,7 +121,8 @@ static void radeon_benchmark_move(struct radeon_device *rdev, unsigned size,
+
+ if (rdev->asic->copy.dma) {
+ time = radeon_benchmark_do_move(rdev, size, saddr, daddr,
+- RADEON_BENCHMARK_COPY_DMA, n);
++ RADEON_BENCHMARK_COPY_DMA, n,
++ dobj->tbo.resv);
+ if (time < 0)
+ goto out_cleanup;
+ if (time > 0)
+@@ -130,7 +132,8 @@ static void radeon_benchmark_move(struct radeon_device *rdev, unsigned size,
+
+ if (rdev->asic->copy.blit) {
+ time = radeon_benchmark_do_move(rdev, size, saddr, daddr,
+- RADEON_BENCHMARK_COPY_BLIT, n);
++ RADEON_BENCHMARK_COPY_BLIT, n,
++ dobj->tbo.resv);
+ if (time < 0)
+ goto out_cleanup;
+ if (time > 0)
+diff --git a/drivers/gpu/drm/radeon/radeon_display.c b/drivers/gpu/drm/radeon/radeon_display.c
+index 00ead8c2758a..2e1e9aa79cea 100644
+--- a/drivers/gpu/drm/radeon/radeon_display.c
++++ b/drivers/gpu/drm/radeon/radeon_display.c
+@@ -959,6 +959,9 @@ void radeon_compute_pll_avivo(struct radeon_pll *pll,
+ if (pll->flags & RADEON_PLL_USE_FRAC_FB_DIV &&
+ pll->flags & RADEON_PLL_USE_REF_DIV)
+ ref_div_max = pll->reference_div;
++ else if (pll->flags & RADEON_PLL_PREFER_MINM_OVER_MAXP)
++ /* fix for problems on RS880 */
++ ref_div_max = min(pll->max_ref_div, 7u);
+ else
+ ref_div_max = pll->max_ref_div;
+
+diff --git a/drivers/gpu/drm/radeon/radeon_gem.c b/drivers/gpu/drm/radeon/radeon_gem.c
+index c194497aa586..b4abff67c63f 100644
+--- a/drivers/gpu/drm/radeon/radeon_gem.c
++++ b/drivers/gpu/drm/radeon/radeon_gem.c
+@@ -146,7 +146,8 @@ int radeon_gem_object_open(struct drm_gem_object *obj, struct drm_file *file_pri
+ struct radeon_bo_va *bo_va;
+ int r;
+
+- if (rdev->family < CHIP_CAYMAN) {
++ if ((rdev->family < CHIP_CAYMAN) ||
++ (!rdev->accel_working)) {
+ return 0;
+ }
+
+@@ -176,7 +177,8 @@ void radeon_gem_object_close(struct drm_gem_object *obj,
+ struct radeon_bo_va *bo_va;
+ int r;
+
+- if (rdev->family < CHIP_CAYMAN) {
++ if ((rdev->family < CHIP_CAYMAN) ||
++ (!rdev->accel_working)) {
+ return;
+ }
+
+diff --git a/drivers/gpu/drm/radeon/radeon_kms.c b/drivers/gpu/drm/radeon/radeon_kms.c
+index 03586763ee86..8ec652722e4f 100644
+--- a/drivers/gpu/drm/radeon/radeon_kms.c
++++ b/drivers/gpu/drm/radeon/radeon_kms.c
+@@ -598,14 +598,14 @@ int radeon_driver_open_kms(struct drm_device *dev, struct drm_file *file_priv)
+ return -ENOMEM;
+ }
+
+- vm = &fpriv->vm;
+- r = radeon_vm_init(rdev, vm);
+- if (r) {
+- kfree(fpriv);
+- return r;
+- }
+-
+ if (rdev->accel_working) {
++ vm = &fpriv->vm;
++ r = radeon_vm_init(rdev, vm);
++ if (r) {
++ kfree(fpriv);
++ return r;
++ }
++
+ r = radeon_bo_reserve(rdev->ring_tmp_bo.bo, false);
+ if (r) {
+ radeon_vm_fini(rdev, vm);
+@@ -663,9 +663,9 @@ void radeon_driver_postclose_kms(struct drm_device *dev,
+ radeon_vm_bo_rmv(rdev, vm->ib_bo_va);
+ radeon_bo_unreserve(rdev->ring_tmp_bo.bo);
+ }
++ radeon_vm_fini(rdev, vm);
+ }
+
+- radeon_vm_fini(rdev, vm);
+ kfree(fpriv);
+ file_priv->driver_priv = NULL;
+ }
+diff --git a/drivers/gpu/drm/radeon/radeon_test.c b/drivers/gpu/drm/radeon/radeon_test.c
+index 07b506b41008..791818165c76 100644
+--- a/drivers/gpu/drm/radeon/radeon_test.c
++++ b/drivers/gpu/drm/radeon/radeon_test.c
+@@ -119,11 +119,11 @@ static void radeon_do_test_moves(struct radeon_device *rdev, int flag)
+ if (ring == R600_RING_TYPE_DMA_INDEX)
+ fence = radeon_copy_dma(rdev, gtt_addr, vram_addr,
+ size / RADEON_GPU_PAGE_SIZE,
+- NULL);
++ vram_obj->tbo.resv);
+ else
+ fence = radeon_copy_blit(rdev, gtt_addr, vram_addr,
+ size / RADEON_GPU_PAGE_SIZE,
+- NULL);
++ vram_obj->tbo.resv);
+ if (IS_ERR(fence)) {
+ DRM_ERROR("Failed GTT->VRAM copy %d\n", i);
+ r = PTR_ERR(fence);
+@@ -170,11 +170,11 @@ static void radeon_do_test_moves(struct radeon_device *rdev, int flag)
+ if (ring == R600_RING_TYPE_DMA_INDEX)
+ fence = radeon_copy_dma(rdev, vram_addr, gtt_addr,
+ size / RADEON_GPU_PAGE_SIZE,
+- NULL);
++ vram_obj->tbo.resv);
+ else
+ fence = radeon_copy_blit(rdev, vram_addr, gtt_addr,
+ size / RADEON_GPU_PAGE_SIZE,
+- NULL);
++ vram_obj->tbo.resv);
+ if (IS_ERR(fence)) {
+ DRM_ERROR("Failed VRAM->GTT copy %d\n", i);
+ r = PTR_ERR(fence);
+diff --git a/drivers/gpu/drm/radeon/radeon_vm.c b/drivers/gpu/drm/radeon/radeon_vm.c
+index dfde266529e2..afbdf9e685d1 100644
+--- a/drivers/gpu/drm/radeon/radeon_vm.c
++++ b/drivers/gpu/drm/radeon/radeon_vm.c
+@@ -753,9 +753,11 @@ static void radeon_vm_frag_ptes(struct radeon_device *rdev,
+ */
+
+ /* NI is optimized for 256KB fragments, SI and newer for 64KB */
+- uint64_t frag_flags = rdev->family == CHIP_CAYMAN ?
++ uint64_t frag_flags = ((rdev->family == CHIP_CAYMAN) ||
++ (rdev->family == CHIP_ARUBA)) ?
+ R600_PTE_FRAG_256KB : R600_PTE_FRAG_64KB;
+- uint64_t frag_align = rdev->family == CHIP_CAYMAN ? 0x200 : 0x80;
++ uint64_t frag_align = ((rdev->family == CHIP_CAYMAN) ||
++ (rdev->family == CHIP_ARUBA)) ? 0x200 : 0x80;
+
+ uint64_t frag_start = ALIGN(pe_start, frag_align);
+ uint64_t frag_end = pe_end & ~(frag_align - 1);
+diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
+index c1b0d52bfcb0..b98765f6f77f 100644
+--- a/drivers/md/raid5.c
++++ b/drivers/md/raid5.c
+@@ -3195,6 +3195,11 @@ static void handle_stripe_dirtying(struct r5conf *conf,
+ (unsigned long long)sh->sector,
+ rcw, qread, test_bit(STRIPE_DELAYED, &sh->state));
+ }
++
++ if (rcw > disks && rmw > disks &&
++ !test_bit(STRIPE_PREREAD_ACTIVE, &sh->state))
++ set_bit(STRIPE_DELAYED, &sh->state);
++
+ /* now if nothing is locked, and if we have enough data,
+ * we can start a write request
+ */
+diff --git a/drivers/pci/host/pcie-designware.c b/drivers/pci/host/pcie-designware.c
+index dfed00aa3ac0..f0fcbceee209 100644
+--- a/drivers/pci/host/pcie-designware.c
++++ b/drivers/pci/host/pcie-designware.c
+@@ -283,6 +283,9 @@ static int dw_msi_setup_irq(struct msi_chip *chip, struct pci_dev *pdev,
+ struct msi_msg msg;
+ struct pcie_port *pp = sys_to_pcie(pdev->bus->sysdata);
+
++ if (desc->msi_attrib.is_msix)
++ return -EINVAL;
++
+ irq = assign_irq(1, desc, &pos);
+ if (irq < 0)
+ return irq;
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index b72e2cdfd59a..04ea682ab2aa 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -324,18 +324,52 @@ static void quirk_s3_64M(struct pci_dev *dev)
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_S3, PCI_DEVICE_ID_S3_868, quirk_s3_64M);
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_S3, PCI_DEVICE_ID_S3_968, quirk_s3_64M);
+
++static void quirk_io(struct pci_dev *dev, int pos, unsigned size,
++ const char *name)
++{
++ u32 region;
++ struct pci_bus_region bus_region;
++ struct resource *res = dev->resource + pos;
++
++ pci_read_config_dword(dev, PCI_BASE_ADDRESS_0 + (pos << 2), ®ion);
++
++ if (!region)
++ return;
++
++ res->name = pci_name(dev);
++ res->flags = region & ~PCI_BASE_ADDRESS_IO_MASK;
++ res->flags |=
++ (IORESOURCE_IO | IORESOURCE_PCI_FIXED | IORESOURCE_SIZEALIGN);
++ region &= ~(size - 1);
++
++ /* Convert from PCI bus to resource space */
++ bus_region.start = region;
++ bus_region.end = region + size - 1;
++ pcibios_bus_to_resource(dev->bus, res, &bus_region);
++
++ dev_info(&dev->dev, FW_BUG "%s quirk: reg 0x%x: %pR\n",
++ name, PCI_BASE_ADDRESS_0 + (pos << 2), res);
++}
++
+ /*
+ * Some CS5536 BIOSes (for example, the Soekris NET5501 board w/ comBIOS
+ * ver. 1.33 20070103) don't set the correct ISA PCI region header info.
+ * BAR0 should be 8 bytes; instead, it may be set to something like 8k
+ * (which conflicts w/ BAR1's memory range).
++ *
++ * CS553x's ISA PCI BARs may also be read-only (ref:
++ * https://bugzilla.kernel.org/show_bug.cgi?id=85991 - Comment #4 forward).
+ */
+ static void quirk_cs5536_vsa(struct pci_dev *dev)
+ {
++ static char *name = "CS5536 ISA bridge";
++
+ if (pci_resource_len(dev, 0) != 8) {
+- struct resource *res = &dev->resource[0];
+- res->end = res->start + 8 - 1;
+- dev_info(&dev->dev, "CS5536 ISA bridge bug detected (incorrect header); workaround applied\n");
++ quirk_io(dev, 0, 8, name); /* SMB */
++ quirk_io(dev, 1, 256, name); /* GPIO */
++ quirk_io(dev, 2, 64, name); /* MFGPT */
++ dev_info(&dev->dev, "%s bug detected (incorrect header); workaround applied\n",
++ name);
+ }
+ }
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_CS5536_ISA, quirk_cs5536_vsa);
+diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
+index cfba74cd8e8b..dd8c8d690763 100644
+--- a/drivers/scsi/sd.c
++++ b/drivers/scsi/sd.c
+@@ -2818,9 +2818,11 @@ static int sd_revalidate_disk(struct gendisk *disk)
+ */
+ sd_set_flush_flag(sdkp);
+
+- max_xfer = min_not_zero(queue_max_hw_sectors(sdkp->disk->queue),
+- sdkp->max_xfer_blocks);
++ max_xfer = sdkp->max_xfer_blocks;
+ max_xfer <<= ilog2(sdp->sector_size) - 9;
++
++ max_xfer = min_not_zero(queue_max_hw_sectors(sdkp->disk->queue),
++ max_xfer);
+ blk_queue_max_hw_sectors(sdkp->disk->queue, max_xfer);
+ set_capacity(disk, sdkp->capacity);
+ sd_config_write_same(sdkp);
+diff --git a/drivers/spi/spi-fsl-dspi.c b/drivers/spi/spi-fsl-dspi.c
+index 831ceb4a91f6..276a3cf864d7 100644
+--- a/drivers/spi/spi-fsl-dspi.c
++++ b/drivers/spi/spi-fsl-dspi.c
+@@ -342,8 +342,7 @@ static int dspi_setup_transfer(struct spi_device *spi, struct spi_transfer *t)
+ /* Only alloc on first setup */
+ chip = spi_get_ctldata(spi);
+ if (chip == NULL) {
+- chip = devm_kzalloc(&spi->dev, sizeof(struct chip_data),
+- GFP_KERNEL);
++ chip = kzalloc(sizeof(struct chip_data), GFP_KERNEL);
+ if (!chip)
+ return -ENOMEM;
+ }
+@@ -382,6 +381,16 @@ static int dspi_setup(struct spi_device *spi)
+ return dspi_setup_transfer(spi, NULL);
+ }
+
++static void dspi_cleanup(struct spi_device *spi)
++{
++ struct chip_data *chip = spi_get_ctldata((struct spi_device *)spi);
++
++ dev_dbg(&spi->dev, "spi_device %u.%u cleanup\n",
++ spi->master->bus_num, spi->chip_select);
++
++ kfree(chip);
++}
++
+ static irqreturn_t dspi_interrupt(int irq, void *dev_id)
+ {
+ struct fsl_dspi *dspi = (struct fsl_dspi *)dev_id;
+@@ -467,6 +476,7 @@ static int dspi_probe(struct platform_device *pdev)
+ dspi->bitbang.master->setup = dspi_setup;
+ dspi->bitbang.master->dev.of_node = pdev->dev.of_node;
+
++ master->cleanup = dspi_cleanup;
+ master->mode_bits = SPI_CPOL | SPI_CPHA;
+ master->bits_per_word_mask = SPI_BPW_MASK(4) | SPI_BPW_MASK(8) |
+ SPI_BPW_MASK(16);
+diff --git a/drivers/spi/spi-imx.c b/drivers/spi/spi-imx.c
+index 3637847b5370..82269a86fd7a 100644
+--- a/drivers/spi/spi-imx.c
++++ b/drivers/spi/spi-imx.c
+@@ -823,6 +823,10 @@ static int spi_imx_sdma_init(struct device *dev, struct spi_imx_data *spi_imx,
+ struct dma_slave_config slave_config = {};
+ int ret;
+
++ /* use pio mode for i.mx6dl chip TKT238285 */
++ if (of_machine_is_compatible("fsl,imx6dl"))
++ return 0;
++
+ /* Prepare for TX DMA: */
+ master->dma_tx = dma_request_slave_channel(dev, "tx");
+ if (!master->dma_tx) {
+diff --git a/fs/cifs/file.c b/fs/cifs/file.c
+index 3e4d00a06c44..9a7b6947874a 100644
+--- a/fs/cifs/file.c
++++ b/fs/cifs/file.c
+@@ -366,6 +366,7 @@ void cifsFileInfo_put(struct cifsFileInfo *cifs_file)
+ struct cifsLockInfo *li, *tmp;
+ struct cifs_fid fid;
+ struct cifs_pending_open open;
++ bool oplock_break_cancelled;
+
+ spin_lock(&cifs_file_list_lock);
+ if (--cifs_file->count > 0) {
+@@ -397,7 +398,7 @@ void cifsFileInfo_put(struct cifsFileInfo *cifs_file)
+ }
+ spin_unlock(&cifs_file_list_lock);
+
+- cancel_work_sync(&cifs_file->oplock_break);
++ oplock_break_cancelled = cancel_work_sync(&cifs_file->oplock_break);
+
+ if (!tcon->need_reconnect && !cifs_file->invalidHandle) {
+ struct TCP_Server_Info *server = tcon->ses->server;
+@@ -409,6 +410,9 @@ void cifsFileInfo_put(struct cifsFileInfo *cifs_file)
+ _free_xid(xid);
+ }
+
++ if (oplock_break_cancelled)
++ cifs_done_oplock_break(cifsi);
++
+ cifs_del_pending_open(&open);
+
+ /*
+diff --git a/fs/nilfs2/nilfs.h b/fs/nilfs2/nilfs.h
+index 91093cd74f0d..385704027575 100644
+--- a/fs/nilfs2/nilfs.h
++++ b/fs/nilfs2/nilfs.h
+@@ -141,7 +141,6 @@ enum {
+ * @ti_save: Backup of journal_info field of task_struct
+ * @ti_flags: Flags
+ * @ti_count: Nest level
+- * @ti_garbage: List of inode to be put when releasing semaphore
+ */
+ struct nilfs_transaction_info {
+ u32 ti_magic;
+@@ -150,7 +149,6 @@ struct nilfs_transaction_info {
+ one of other filesystems has a bug. */
+ unsigned short ti_flags;
+ unsigned short ti_count;
+- struct list_head ti_garbage;
+ };
+
+ /* ti_magic */
+diff --git a/fs/nilfs2/segment.c b/fs/nilfs2/segment.c
+index 7ef18fc656c2..469086b9f99b 100644
+--- a/fs/nilfs2/segment.c
++++ b/fs/nilfs2/segment.c
+@@ -305,7 +305,6 @@ static void nilfs_transaction_lock(struct super_block *sb,
+ ti->ti_count = 0;
+ ti->ti_save = cur_ti;
+ ti->ti_magic = NILFS_TI_MAGIC;
+- INIT_LIST_HEAD(&ti->ti_garbage);
+ current->journal_info = ti;
+
+ for (;;) {
+@@ -332,8 +331,6 @@ static void nilfs_transaction_unlock(struct super_block *sb)
+
+ up_write(&nilfs->ns_segctor_sem);
+ current->journal_info = ti->ti_save;
+- if (!list_empty(&ti->ti_garbage))
+- nilfs_dispose_list(nilfs, &ti->ti_garbage, 0);
+ }
+
+ static void *nilfs_segctor_map_segsum_entry(struct nilfs_sc_info *sci,
+@@ -746,6 +743,15 @@ static void nilfs_dispose_list(struct the_nilfs *nilfs,
+ }
+ }
+
++static void nilfs_iput_work_func(struct work_struct *work)
++{
++ struct nilfs_sc_info *sci = container_of(work, struct nilfs_sc_info,
++ sc_iput_work);
++ struct the_nilfs *nilfs = sci->sc_super->s_fs_info;
++
++ nilfs_dispose_list(nilfs, &sci->sc_iput_queue, 0);
++}
++
+ static int nilfs_test_metadata_dirty(struct the_nilfs *nilfs,
+ struct nilfs_root *root)
+ {
+@@ -1900,8 +1906,8 @@ static int nilfs_segctor_collect_dirty_files(struct nilfs_sc_info *sci,
+ static void nilfs_segctor_drop_written_files(struct nilfs_sc_info *sci,
+ struct the_nilfs *nilfs)
+ {
+- struct nilfs_transaction_info *ti = current->journal_info;
+ struct nilfs_inode_info *ii, *n;
++ int defer_iput = false;
+
+ spin_lock(&nilfs->ns_inode_lock);
+ list_for_each_entry_safe(ii, n, &sci->sc_dirty_files, i_dirty) {
+@@ -1912,9 +1918,24 @@ static void nilfs_segctor_drop_written_files(struct nilfs_sc_info *sci,
+ clear_bit(NILFS_I_BUSY, &ii->i_state);
+ brelse(ii->i_bh);
+ ii->i_bh = NULL;
+- list_move_tail(&ii->i_dirty, &ti->ti_garbage);
++ list_del_init(&ii->i_dirty);
++ if (!ii->vfs_inode.i_nlink) {
++ /*
++ * Defer calling iput() to avoid a deadlock
++ * over I_SYNC flag for inodes with i_nlink == 0
++ */
++ list_add_tail(&ii->i_dirty, &sci->sc_iput_queue);
++ defer_iput = true;
++ } else {
++ spin_unlock(&nilfs->ns_inode_lock);
++ iput(&ii->vfs_inode);
++ spin_lock(&nilfs->ns_inode_lock);
++ }
+ }
+ spin_unlock(&nilfs->ns_inode_lock);
++
++ if (defer_iput)
++ schedule_work(&sci->sc_iput_work);
+ }
+
+ /*
+@@ -2583,6 +2604,8 @@ static struct nilfs_sc_info *nilfs_segctor_new(struct super_block *sb,
+ INIT_LIST_HEAD(&sci->sc_segbufs);
+ INIT_LIST_HEAD(&sci->sc_write_logs);
+ INIT_LIST_HEAD(&sci->sc_gc_inodes);
++ INIT_LIST_HEAD(&sci->sc_iput_queue);
++ INIT_WORK(&sci->sc_iput_work, nilfs_iput_work_func);
+ init_timer(&sci->sc_timer);
+
+ sci->sc_interval = HZ * NILFS_SC_DEFAULT_TIMEOUT;
+@@ -2609,6 +2632,8 @@ static void nilfs_segctor_write_out(struct nilfs_sc_info *sci)
+ ret = nilfs_segctor_construct(sci, SC_LSEG_SR);
+ nilfs_transaction_unlock(sci->sc_super);
+
++ flush_work(&sci->sc_iput_work);
++
+ } while (ret && retrycount-- > 0);
+ }
+
+@@ -2633,6 +2658,9 @@ static void nilfs_segctor_destroy(struct nilfs_sc_info *sci)
+ || sci->sc_seq_request != sci->sc_seq_done);
+ spin_unlock(&sci->sc_state_lock);
+
++ if (flush_work(&sci->sc_iput_work))
++ flag = true;
++
+ if (flag || !nilfs_segctor_confirm(sci))
+ nilfs_segctor_write_out(sci);
+
+@@ -2642,6 +2670,12 @@ static void nilfs_segctor_destroy(struct nilfs_sc_info *sci)
+ nilfs_dispose_list(nilfs, &sci->sc_dirty_files, 1);
+ }
+
++ if (!list_empty(&sci->sc_iput_queue)) {
++ nilfs_warning(sci->sc_super, __func__,
++ "iput queue is not empty\n");
++ nilfs_dispose_list(nilfs, &sci->sc_iput_queue, 1);
++ }
++
+ WARN_ON(!list_empty(&sci->sc_segbufs));
+ WARN_ON(!list_empty(&sci->sc_write_logs));
+
+diff --git a/fs/nilfs2/segment.h b/fs/nilfs2/segment.h
+index 38a1d0013314..a48d6de1e02c 100644
+--- a/fs/nilfs2/segment.h
++++ b/fs/nilfs2/segment.h
+@@ -26,6 +26,7 @@
+ #include <linux/types.h>
+ #include <linux/fs.h>
+ #include <linux/buffer_head.h>
++#include <linux/workqueue.h>
+ #include <linux/nilfs2_fs.h>
+ #include "nilfs.h"
+
+@@ -92,6 +93,8 @@ struct nilfs_segsum_pointer {
+ * @sc_nblk_inc: Block count of current generation
+ * @sc_dirty_files: List of files to be written
+ * @sc_gc_inodes: List of GC inodes having blocks to be written
++ * @sc_iput_queue: list of inodes for which iput should be done
++ * @sc_iput_work: work struct to defer iput call
+ * @sc_freesegs: array of segment numbers to be freed
+ * @sc_nfreesegs: number of segments on @sc_freesegs
+ * @sc_dsync_inode: inode whose data pages are written for a sync operation
+@@ -135,6 +138,8 @@ struct nilfs_sc_info {
+
+ struct list_head sc_dirty_files;
+ struct list_head sc_gc_inodes;
++ struct list_head sc_iput_queue;
++ struct work_struct sc_iput_work;
+
+ __u64 *sc_freesegs;
+ size_t sc_nfreesegs;
+diff --git a/include/linux/tracepoint.h b/include/linux/tracepoint.h
+index e08e21e5f601..c72851328ca9 100644
+--- a/include/linux/tracepoint.h
++++ b/include/linux/tracepoint.h
+@@ -173,7 +173,7 @@ extern void syscall_unregfunc(void);
+ TP_PROTO(data_proto), \
+ TP_ARGS(data_args), \
+ TP_CONDITION(cond),,); \
+- if (IS_ENABLED(CONFIG_LOCKDEP)) { \
++ if (IS_ENABLED(CONFIG_LOCKDEP) && (cond)) { \
+ rcu_read_lock_sched_notrace(); \
+ rcu_dereference_sched(__tracepoint_##name.funcs);\
+ rcu_read_unlock_sched_notrace(); \
+diff --git a/include/sound/ak4113.h b/include/sound/ak4113.h
+index 2609048c1d44..3a34f6edc2d1 100644
+--- a/include/sound/ak4113.h
++++ b/include/sound/ak4113.h
+@@ -286,7 +286,7 @@ struct ak4113 {
+ ak4113_write_t *write;
+ ak4113_read_t *read;
+ void *private_data;
+- unsigned int init:1;
++ atomic_t wq_processing;
+ spinlock_t lock;
+ unsigned char regmap[AK4113_WRITABLE_REGS];
+ struct snd_kcontrol *kctls[AK4113_CONTROLS];
+diff --git a/include/sound/ak4114.h b/include/sound/ak4114.h
+index 52f02a60dba7..069299a88915 100644
+--- a/include/sound/ak4114.h
++++ b/include/sound/ak4114.h
+@@ -168,7 +168,7 @@ struct ak4114 {
+ ak4114_write_t * write;
+ ak4114_read_t * read;
+ void * private_data;
+- unsigned int init: 1;
++ atomic_t wq_processing;
+ spinlock_t lock;
+ unsigned char regmap[6];
+ unsigned char txcsb[5];
+diff --git a/include/trace/events/tlb.h b/include/trace/events/tlb.h
+index 13391d288107..0e7635765153 100644
+--- a/include/trace/events/tlb.h
++++ b/include/trace/events/tlb.h
+@@ -13,11 +13,13 @@
+ { TLB_LOCAL_SHOOTDOWN, "local shootdown" }, \
+ { TLB_LOCAL_MM_SHOOTDOWN, "local mm shootdown" }
+
+-TRACE_EVENT(tlb_flush,
++TRACE_EVENT_CONDITION(tlb_flush,
+
+ TP_PROTO(int reason, unsigned long pages),
+ TP_ARGS(reason, pages),
+
++ TP_CONDITION(cpu_online(smp_processor_id())),
++
+ TP_STRUCT__entry(
+ __field( int, reason)
+ __field(unsigned long, pages)
+diff --git a/kernel/smpboot.c b/kernel/smpboot.c
+index eb89e1807408..60d35ac5d3f1 100644
+--- a/kernel/smpboot.c
++++ b/kernel/smpboot.c
+@@ -279,6 +279,7 @@ int smpboot_register_percpu_thread(struct smp_hotplug_thread *plug_thread)
+ unsigned int cpu;
+ int ret = 0;
+
++ get_online_cpus();
+ mutex_lock(&smpboot_threads_lock);
+ for_each_online_cpu(cpu) {
+ ret = __smpboot_create_thread(plug_thread, cpu);
+@@ -291,6 +292,7 @@ int smpboot_register_percpu_thread(struct smp_hotplug_thread *plug_thread)
+ list_add(&plug_thread->list, &hotplug_threads);
+ out:
+ mutex_unlock(&smpboot_threads_lock);
++ put_online_cpus();
+ return ret;
+ }
+ EXPORT_SYMBOL_GPL(smpboot_register_percpu_thread);
+diff --git a/kernel/time/hrtimer.c b/kernel/time/hrtimer.c
+index 37e50aadd471..d8c724cda37b 100644
+--- a/kernel/time/hrtimer.c
++++ b/kernel/time/hrtimer.c
+@@ -122,7 +122,7 @@ static void hrtimer_get_softirq_time(struct hrtimer_cpu_base *base)
+ mono = ktime_get_update_offsets_tick(&off_real, &off_boot, &off_tai);
+ boot = ktime_add(mono, off_boot);
+ xtim = ktime_add(mono, off_real);
+- tai = ktime_add(xtim, off_tai);
++ tai = ktime_add(mono, off_tai);
+
+ base->clock_base[HRTIMER_BASE_REALTIME].softirq_time = xtim;
+ base->clock_base[HRTIMER_BASE_MONOTONIC].softirq_time = mono;
+diff --git a/lib/checksum.c b/lib/checksum.c
+index 129775eb6de6..8b39e86dbab5 100644
+--- a/lib/checksum.c
++++ b/lib/checksum.c
+@@ -181,6 +181,15 @@ csum_partial_copy(const void *src, void *dst, int len, __wsum sum)
+ EXPORT_SYMBOL(csum_partial_copy);
+
+ #ifndef csum_tcpudp_nofold
++static inline u32 from64to32(u64 x)
++{
++ /* add up 32-bit and 32-bit for 32+c bit */
++ x = (x & 0xffffffff) + (x >> 32);
++ /* add up carry.. */
++ x = (x & 0xffffffff) + (x >> 32);
++ return (u32)x;
++}
++
+ __wsum csum_tcpudp_nofold(__be32 saddr, __be32 daddr,
+ unsigned short len,
+ unsigned short proto,
+@@ -195,8 +204,7 @@ __wsum csum_tcpudp_nofold(__be32 saddr, __be32 daddr,
+ #else
+ s += (proto + len) << 8;
+ #endif
+- s += (s >> 32);
+- return (__force __wsum)s;
++ return (__force __wsum)from64to32(s);
+ }
+ EXPORT_SYMBOL(csum_tcpudp_nofold);
+ #endif
+diff --git a/mm/memcontrol.c b/mm/memcontrol.c
+index 4918b6eefae2..d72bdc3ca09b 100644
+--- a/mm/memcontrol.c
++++ b/mm/memcontrol.c
+@@ -6589,7 +6589,7 @@ void mem_cgroup_uncharge_list(struct list_head *page_list)
+ * mem_cgroup_migrate - migrate a charge to another page
+ * @oldpage: currently charged page
+ * @newpage: page to transfer the charge to
+- * @lrucare: both pages might be on the LRU already
++ * @lrucare: either or both pages might be on the LRU already
+ *
+ * Migrate the charge from @oldpage to @newpage.
+ *
+diff --git a/mm/pagewalk.c b/mm/pagewalk.c
+index ad83195521f2..b264bda46e1b 100644
+--- a/mm/pagewalk.c
++++ b/mm/pagewalk.c
+@@ -199,7 +199,10 @@ int walk_page_range(unsigned long addr, unsigned long end,
+ */
+ if ((vma->vm_start <= addr) &&
+ (vma->vm_flags & VM_PFNMAP)) {
+- next = vma->vm_end;
++ if (walk->pte_hole)
++ err = walk->pte_hole(addr, next, walk);
++ if (err)
++ break;
+ pgd = pgd_offset(walk->mm, next);
+ continue;
+ }
+diff --git a/mm/shmem.c b/mm/shmem.c
+index 185836ba53ef..0b4ba556703a 100644
+--- a/mm/shmem.c
++++ b/mm/shmem.c
+@@ -1013,7 +1013,7 @@ static int shmem_replace_page(struct page **pagep, gfp_t gfp,
+ */
+ oldpage = newpage;
+ } else {
+- mem_cgroup_migrate(oldpage, newpage, false);
++ mem_cgroup_migrate(oldpage, newpage, true);
+ lru_cache_add_anon(newpage);
+ *pagep = newpage;
+ }
+diff --git a/scripts/kconfig/menu.c b/scripts/kconfig/menu.c
+index a26cc5d2a9b0..72c9dba84c5d 100644
+--- a/scripts/kconfig/menu.c
++++ b/scripts/kconfig/menu.c
+@@ -548,7 +548,7 @@ static void get_prompt_str(struct gstr *r, struct property *prop,
+ {
+ int i, j;
+ struct menu *submenu[8], *menu, *location = NULL;
+- struct jump_key *jump;
++ struct jump_key *jump = NULL;
+
+ str_printf(r, _("Prompt: %s\n"), _(prop->text));
+ menu = prop->menu->parent;
+@@ -586,7 +586,7 @@ static void get_prompt_str(struct gstr *r, struct property *prop,
+ str_printf(r, _(" Location:\n"));
+ for (j = 4; --i >= 0; j += 2) {
+ menu = submenu[i];
+- if (head && location && menu == location)
++ if (jump && menu == location)
+ jump->offset = strlen(r->s);
+ str_printf(r, "%*c-> %s", j, ' ',
+ _(menu_get_prompt(menu)));
+diff --git a/sound/i2c/other/ak4113.c b/sound/i2c/other/ak4113.c
+index 1a3a6fa27158..c6bba99a90b2 100644
+--- a/sound/i2c/other/ak4113.c
++++ b/sound/i2c/other/ak4113.c
+@@ -56,8 +56,7 @@ static inline unsigned char reg_read(struct ak4113 *ak4113, unsigned char reg)
+
+ static void snd_ak4113_free(struct ak4113 *chip)
+ {
+- chip->init = 1; /* don't schedule new work */
+- mb();
++ atomic_inc(&chip->wq_processing); /* don't schedule new work */
+ cancel_delayed_work_sync(&chip->work);
+ kfree(chip);
+ }
+@@ -89,6 +88,7 @@ int snd_ak4113_create(struct snd_card *card, ak4113_read_t *read,
+ chip->write = write;
+ chip->private_data = private_data;
+ INIT_DELAYED_WORK(&chip->work, ak4113_stats);
++ atomic_set(&chip->wq_processing, 0);
+
+ for (reg = 0; reg < AK4113_WRITABLE_REGS ; reg++)
+ chip->regmap[reg] = pgm[reg];
+@@ -139,13 +139,11 @@ static void ak4113_init_regs(struct ak4113 *chip)
+
+ void snd_ak4113_reinit(struct ak4113 *chip)
+ {
+- chip->init = 1;
+- mb();
+- flush_delayed_work(&chip->work);
++ if (atomic_inc_return(&chip->wq_processing) == 1)
++ cancel_delayed_work_sync(&chip->work);
+ ak4113_init_regs(chip);
+ /* bring up statistics / event queing */
+- chip->init = 0;
+- if (chip->kctls[0])
++ if (atomic_dec_and_test(&chip->wq_processing))
+ schedule_delayed_work(&chip->work, HZ / 10);
+ }
+ EXPORT_SYMBOL_GPL(snd_ak4113_reinit);
+@@ -632,8 +630,9 @@ static void ak4113_stats(struct work_struct *work)
+ {
+ struct ak4113 *chip = container_of(work, struct ak4113, work.work);
+
+- if (!chip->init)
++ if (atomic_inc_return(&chip->wq_processing) == 1)
+ snd_ak4113_check_rate_and_errors(chip, chip->check_flags);
+
+- schedule_delayed_work(&chip->work, HZ / 10);
++ if (atomic_dec_and_test(&chip->wq_processing))
++ schedule_delayed_work(&chip->work, HZ / 10);
+ }
+diff --git a/sound/i2c/other/ak4114.c b/sound/i2c/other/ak4114.c
+index c7f56339415d..b70e6eccbd03 100644
+--- a/sound/i2c/other/ak4114.c
++++ b/sound/i2c/other/ak4114.c
+@@ -66,8 +66,7 @@ static void reg_dump(struct ak4114 *ak4114)
+
+ static void snd_ak4114_free(struct ak4114 *chip)
+ {
+- chip->init = 1; /* don't schedule new work */
+- mb();
++ atomic_inc(&chip->wq_processing); /* don't schedule new work */
+ cancel_delayed_work_sync(&chip->work);
+ kfree(chip);
+ }
+@@ -100,6 +99,7 @@ int snd_ak4114_create(struct snd_card *card,
+ chip->write = write;
+ chip->private_data = private_data;
+ INIT_DELAYED_WORK(&chip->work, ak4114_stats);
++ atomic_set(&chip->wq_processing, 0);
+
+ for (reg = 0; reg < 6; reg++)
+ chip->regmap[reg] = pgm[reg];
+@@ -152,13 +152,11 @@ static void ak4114_init_regs(struct ak4114 *chip)
+
+ void snd_ak4114_reinit(struct ak4114 *chip)
+ {
+- chip->init = 1;
+- mb();
+- flush_delayed_work(&chip->work);
++ if (atomic_inc_return(&chip->wq_processing) == 1)
++ cancel_delayed_work_sync(&chip->work);
+ ak4114_init_regs(chip);
+ /* bring up statistics / event queing */
+- chip->init = 0;
+- if (chip->kctls[0])
++ if (atomic_dec_and_test(&chip->wq_processing))
+ schedule_delayed_work(&chip->work, HZ / 10);
+ }
+
+@@ -612,10 +610,10 @@ static void ak4114_stats(struct work_struct *work)
+ {
+ struct ak4114 *chip = container_of(work, struct ak4114, work.work);
+
+- if (!chip->init)
++ if (atomic_inc_return(&chip->wq_processing) == 1)
+ snd_ak4114_check_rate_and_errors(chip, chip->check_flags);
+-
+- schedule_delayed_work(&chip->work, HZ / 10);
++ if (atomic_dec_and_test(&chip->wq_processing))
++ schedule_delayed_work(&chip->work, HZ / 10);
+ }
+
+ EXPORT_SYMBOL(snd_ak4114_create);
+diff --git a/sound/soc/atmel/atmel_ssc_dai.c b/sound/soc/atmel/atmel_ssc_dai.c
+index f403f399808a..51413e239cc3 100644
+--- a/sound/soc/atmel/atmel_ssc_dai.c
++++ b/sound/soc/atmel/atmel_ssc_dai.c
+@@ -345,7 +345,6 @@ static int atmel_ssc_hw_params(struct snd_pcm_substream *substream,
+ struct atmel_pcm_dma_params *dma_params;
+ int dir, channels, bits;
+ u32 tfmr, rfmr, tcmr, rcmr;
+- int start_event;
+ int ret;
+ int fslen, fslen_ext;
+
+@@ -454,19 +453,10 @@ static int atmel_ssc_hw_params(struct snd_pcm_substream *substream,
+ * The SSC transmit clock is obtained from the BCLK signal on
+ * on the TK line, and the SSC receive clock is
+ * generated from the transmit clock.
+- *
+- * For single channel data, one sample is transferred
+- * on the falling edge of the LRC clock.
+- * For two channel data, one sample is
+- * transferred on both edges of the LRC clock.
+ */
+- start_event = ((channels == 1)
+- ? SSC_START_FALLING_RF
+- : SSC_START_EDGE_RF);
+-
+ rcmr = SSC_BF(RCMR_PERIOD, 0)
+ | SSC_BF(RCMR_STTDLY, START_DELAY)
+- | SSC_BF(RCMR_START, start_event)
++ | SSC_BF(RCMR_START, SSC_START_FALLING_RF)
+ | SSC_BF(RCMR_CKI, SSC_CKI_RISING)
+ | SSC_BF(RCMR_CKO, SSC_CKO_NONE)
+ | SSC_BF(RCMR_CKS, ssc->clk_from_rk_pin ?
+@@ -475,14 +465,14 @@ static int atmel_ssc_hw_params(struct snd_pcm_substream *substream,
+ rfmr = SSC_BF(RFMR_FSEDGE, SSC_FSEDGE_POSITIVE)
+ | SSC_BF(RFMR_FSOS, SSC_FSOS_NONE)
+ | SSC_BF(RFMR_FSLEN, 0)
+- | SSC_BF(RFMR_DATNB, 0)
++ | SSC_BF(RFMR_DATNB, (channels - 1))
+ | SSC_BIT(RFMR_MSBF)
+ | SSC_BF(RFMR_LOOP, 0)
+ | SSC_BF(RFMR_DATLEN, (bits - 1));
+
+ tcmr = SSC_BF(TCMR_PERIOD, 0)
+ | SSC_BF(TCMR_STTDLY, START_DELAY)
+- | SSC_BF(TCMR_START, start_event)
++ | SSC_BF(TCMR_START, SSC_START_FALLING_RF)
+ | SSC_BF(TCMR_CKI, SSC_CKI_FALLING)
+ | SSC_BF(TCMR_CKO, SSC_CKO_NONE)
+ | SSC_BF(TCMR_CKS, ssc->clk_from_rk_pin ?
+@@ -492,7 +482,7 @@ static int atmel_ssc_hw_params(struct snd_pcm_substream *substream,
+ | SSC_BF(TFMR_FSDEN, 0)
+ | SSC_BF(TFMR_FSOS, SSC_FSOS_NONE)
+ | SSC_BF(TFMR_FSLEN, 0)
+- | SSC_BF(TFMR_DATNB, 0)
++ | SSC_BF(TFMR_DATNB, (channels - 1))
+ | SSC_BIT(TFMR_MSBF)
+ | SSC_BF(TFMR_DATDEF, 0)
+ | SSC_BF(TFMR_DATLEN, (bits - 1));
+diff --git a/sound/soc/codecs/sgtl5000.c b/sound/soc/codecs/sgtl5000.c
+index dab9b15304af..f1287ff8dd29 100644
+--- a/sound/soc/codecs/sgtl5000.c
++++ b/sound/soc/codecs/sgtl5000.c
+@@ -1452,6 +1452,9 @@ static int sgtl5000_i2c_probe(struct i2c_client *client,
+ if (ret)
+ return ret;
+
++ /* Need 8 clocks before I2C accesses */
++ udelay(1);
++
+ /* read chip information */
+ ret = regmap_read(sgtl5000->regmap, SGTL5000_CHIP_ID, ®);
+ if (ret)
^ permalink raw reply related [flat|nested] 67+ messages in thread
* [gentoo-commits] proj/linux-patches:3.18 commit in: /
@ 2015-02-13 1:35 Mike Pagano
0 siblings, 0 replies; 67+ messages in thread
From: Mike Pagano @ 2015-02-13 1:35 UTC (permalink / raw
To: gentoo-commits
commit: 90f12d61a417b874e654af1f28271d95ca0e1c6d
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Fri Feb 13 01:35:43 2015 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Fri Feb 13 01:35:43 2015 +0000
URL: http://sources.gentoo.org/gitweb/?p=proj/linux-patches.git;a=commit;h=90f12d61
Kernel patch enables gcc >= v4.9 optimizations for additional CPUs.
---
0000_README | 5 +
...-additional-cpu-optimizations-for-gcc-4.9.patch | 387 +++++++++++++++++++++
2 files changed, 392 insertions(+)
diff --git a/0000_README b/0000_README
index d897d2e..116cf1b 100644
--- a/0000_README
+++ b/0000_README
@@ -114,3 +114,8 @@ Desc: BFQ v7r7 patch 2 for 3.17: BFQ Scheduler
Patch: 5003_block-bfq-add-Early-Queue-Merge-EQM-to-BFQ-v7r7-for-3.18.0.patch
From: http://algo.ing.unimo.it/people/paolo/disk_sched/
Desc: BFQ v7r7 patch 3 for 3.17: Early Queue Merge (EQM)
+
+Patch: 5010_enable-additional-cpu-optimizations-for-gcc-4.9.patch
+From: https://github.com/graysky2/kernel_gcc_patch/
+Desc: Kernel patch enables gcc >= v4.9 optimizations for additional CPUs.
+
diff --git a/5010_enable-additional-cpu-optimizations-for-gcc-4.9.patch b/5010_enable-additional-cpu-optimizations-for-gcc-4.9.patch
new file mode 100644
index 0000000..f931f75
--- /dev/null
+++ b/5010_enable-additional-cpu-optimizations-for-gcc-4.9.patch
@@ -0,0 +1,387 @@
+WARNING - this version of the patch works with version 4.9+ of gcc and with
+kernel version 3.15.x+ and should NOT be applied when compiling on older
+versions due to name changes of the flags with the 4.9 release of gcc.
+Use the older version of this patch hosted on the same github for older
+versions of gcc. For example:
+
+corei7 --> nehalem
+corei7-avx --> sandybridge
+core-avx-i --> ivybridge
+core-avx2 --> haswell
+
+For more, see: https://gcc.gnu.org/gcc-4.9/changes.html
+
+It also changes 'atom' to 'bonnell' in accordance with the gcc v4.9 changes.
+Note that upstream is using the deprecated 'match=atom' flags when I believe it
+should use the newer 'march=bonnell' flag for atom processors.
+
+I have made that change to this patch set as well. See the following kernel
+bug report to see if I'm right: https://bugzilla.kernel.org/show_bug.cgi?id=77461
+
+This patch will expand the number of microarchitectures to include new
+processors including: AMD K10-family, AMD Family 10h (Barcelona), AMD Family
+14h (Bobcat), AMD Family 15h (Bulldozer), AMD Family 15h (Piledriver), AMD
+Family 16h (Jaguar), Intel 1st Gen Core i3/i5/i7 (Nehalem), Intel 1.5 Gen Core
+i3/i5/i7 (Westmere), Intel 2nd Gen Core i3/i5/i7 (Sandybridge), Intel 3rd Gen
+Core i3/i5/i7 (Ivybridge), Intel 4th Gen Core i3/i5/i7 (Haswell), and Intel 5th
+Gen Core i3/i5/i7 (Broadwell). It also offers the compiler the 'native' flag.
+
+Small but real speed increases are measurable using a make endpoint comparing
+a generic kernel to one built with one of the respective microarchs.
+
+See the following experimental evidence supporting this statement:
+https://github.com/graysky2/kernel_gcc_patch
+
+REQUIREMENTS
+linux version >=3.15
+gcc version >=4.9
+
+--- a/arch/x86/include/asm/module.h 2014-08-03 18:25:02.000000000 -0400
++++ b/arch/x86/include/asm/module.h 2014-09-13 09:37:16.721385247 -0400
+@@ -15,6 +15,20 @@
+ #define MODULE_PROC_FAMILY "586MMX "
+ #elif defined CONFIG_MCORE2
+ #define MODULE_PROC_FAMILY "CORE2 "
++#elif defined CONFIG_MNATIVE
++#define MODULE_PROC_FAMILY "NATIVE "
++#elif defined CONFIG_MNEHALEM
++#define MODULE_PROC_FAMILY "NEHALEM "
++#elif defined CONFIG_MWESTMERE
++#define MODULE_PROC_FAMILY "WESTMERE "
++#elif defined CONFIG_MSANDYBRIDGE
++#define MODULE_PROC_FAMILY "SANDYBRIDGE "
++#elif defined CONFIG_MIVYBRIDGE
++#define MODULE_PROC_FAMILY "IVYBRIDGE "
++#elif defined CONFIG_MHASWELL
++#define MODULE_PROC_FAMILY "HASWELL "
++#elif defined CONFIG_MBROADWELL
++#define MODULE_PROC_FAMILY "BROADWELL "
+ #elif defined CONFIG_MATOM
+ #define MODULE_PROC_FAMILY "ATOM "
+ #elif defined CONFIG_M686
+@@ -33,6 +47,20 @@
+ #define MODULE_PROC_FAMILY "K7 "
+ #elif defined CONFIG_MK8
+ #define MODULE_PROC_FAMILY "K8 "
++#elif defined CONFIG_MK8SSE3
++#define MODULE_PROC_FAMILY "K8SSE3 "
++#elif defined CONFIG_MK10
++#define MODULE_PROC_FAMILY "K10 "
++#elif defined CONFIG_MBARCELONA
++#define MODULE_PROC_FAMILY "BARCELONA "
++#elif defined CONFIG_MBOBCAT
++#define MODULE_PROC_FAMILY "BOBCAT "
++#elif defined CONFIG_MBULLDOZER
++#define MODULE_PROC_FAMILY "BULLDOZER "
++#elif defined CONFIG_MPILEDRIVER
++#define MODULE_PROC_FAMILY "PILEDRIVER "
++#elif defined CONFIG_MJAGUAR
++#define MODULE_PROC_FAMILY "JAGUAR "
+ #elif defined CONFIG_MELAN
+ #define MODULE_PROC_FAMILY "ELAN "
+ #elif defined CONFIG_MCRUSOE
+--- a/arch/x86/Kconfig.cpu 2014-08-03 18:25:02.000000000 -0400
++++ b/arch/x86/Kconfig.cpu 2014-09-13 09:37:16.721385247 -0400
+@@ -137,9 +137,8 @@ config MPENTIUM4
+ -Paxville
+ -Dempsey
+
+-
+ config MK6
+- bool "K6/K6-II/K6-III"
++ bool "AMD K6/K6-II/K6-III"
+ depends on X86_32
+ ---help---
+ Select this for an AMD K6-family processor. Enables use of
+@@ -147,7 +146,7 @@ config MK6
+ flags to GCC.
+
+ config MK7
+- bool "Athlon/Duron/K7"
++ bool "AMD Athlon/Duron/K7"
+ depends on X86_32
+ ---help---
+ Select this for an AMD Athlon K7-family processor. Enables use of
+@@ -155,12 +154,62 @@ config MK7
+ flags to GCC.
+
+ config MK8
+- bool "Opteron/Athlon64/Hammer/K8"
++ bool "AMD Opteron/Athlon64/Hammer/K8"
+ ---help---
+ Select this for an AMD Opteron or Athlon64 Hammer-family processor.
+ Enables use of some extended instructions, and passes appropriate
+ optimization flags to GCC.
+
++config MK8SSE3
++ bool "AMD Opteron/Athlon64/Hammer/K8 with SSE3"
++ ---help---
++ Select this for improved AMD Opteron or Athlon64 Hammer-family processors.
++ Enables use of some extended instructions, and passes appropriate
++ optimization flags to GCC.
++
++config MK10
++ bool "AMD 61xx/7x50/PhenomX3/X4/II/K10"
++ ---help---
++ Select this for an AMD 61xx Eight-Core Magny-Cours, Athlon X2 7x50,
++ Phenom X3/X4/II, Athlon II X2/X3/X4, or Turion II-family processor.
++ Enables use of some extended instructions, and passes appropriate
++ optimization flags to GCC.
++
++config MBARCELONA
++ bool "AMD Barcelona"
++ ---help---
++ Select this for AMD Barcelona and newer processors.
++
++ Enables -march=barcelona
++
++config MBOBCAT
++ bool "AMD Bobcat"
++ ---help---
++ Select this for AMD Bobcat processors.
++
++ Enables -march=btver1
++
++config MBULLDOZER
++ bool "AMD Bulldozer"
++ ---help---
++ Select this for AMD Bulldozer processors.
++
++ Enables -march=bdver1
++
++config MPILEDRIVER
++ bool "AMD Piledriver"
++ ---help---
++ Select this for AMD Piledriver processors.
++
++ Enables -march=bdver2
++
++config MJAGUAR
++ bool "AMD Jaguar"
++ ---help---
++ Select this for AMD Jaguar processors.
++
++ Enables -march=btver2
++
+ config MCRUSOE
+ bool "Crusoe"
+ depends on X86_32
+@@ -251,8 +300,17 @@ config MPSC
+ using the cpu family field
+ in /proc/cpuinfo. Family 15 is an older Xeon, Family 6 a newer one.
+
++config MATOM
++ bool "Intel Atom"
++ ---help---
++
++ Select this for the Intel Atom platform. Intel Atom CPUs have an
++ in-order pipelining architecture and thus can benefit from
++ accordingly optimized code. Use a recent GCC with specific Atom
++ support in order to fully benefit from selecting this option.
++
+ config MCORE2
+- bool "Core 2/newer Xeon"
++ bool "Intel Core 2"
+ ---help---
+
+ Select this for Intel Core 2 and newer Core 2 Xeons (Xeon 51xx and
+@@ -260,14 +318,55 @@ config MCORE2
+ family in /proc/cpuinfo. Newer ones have 6 and older ones 15
+ (not a typo)
+
+-config MATOM
+- bool "Intel Atom"
++ Enables -march=core2
++
++config MNEHALEM
++ bool "Intel Nehalem"
+ ---help---
+
+- Select this for the Intel Atom platform. Intel Atom CPUs have an
+- in-order pipelining architecture and thus can benefit from
+- accordingly optimized code. Use a recent GCC with specific Atom
+- support in order to fully benefit from selecting this option.
++ Select this for 1st Gen Core processors in the Nehalem family.
++
++ Enables -march=nehalem
++
++config MWESTMERE
++ bool "Intel Westmere"
++ ---help---
++
++ Select this for the Intel Westmere formerly Nehalem-C family.
++
++ Enables -march=westmere
++
++config MSANDYBRIDGE
++ bool "Intel Sandy Bridge"
++ ---help---
++
++ Select this for 2nd Gen Core processors in the Sandy Bridge family.
++
++ Enables -march=sandybridge
++
++config MIVYBRIDGE
++ bool "Intel Ivy Bridge"
++ ---help---
++
++ Select this for 3rd Gen Core processors in the Ivy Bridge family.
++
++ Enables -march=ivybridge
++
++config MHASWELL
++ bool "Intel Haswell"
++ ---help---
++
++ Select this for 4th Gen Core processors in the Haswell family.
++
++ Enables -march=haswell
++
++config MBROADWELL
++ bool "Intel Broadwell"
++ ---help---
++
++ Select this for 5th Gen Core processors in the Broadwell family.
++
++ Enables -march=broadwell
+
+ config GENERIC_CPU
+ bool "Generic-x86-64"
+@@ -276,6 +375,19 @@ config GENERIC_CPU
+ Generic x86-64 CPU.
+ Run equally well on all x86-64 CPUs.
+
++config MNATIVE
++ bool "Native optimizations autodetected by GCC"
++ ---help---
++
++ GCC 4.2 and above support -march=native, which automatically detects
++ the optimum settings to use based on your processor. -march=native
++ also detects and applies additional settings beyond -march specific
++ to your CPU, (eg. -msse4). Unless you have a specific reason not to
++ (e.g. distcc cross-compiling), you should probably be using
++ -march=native rather than anything listed below.
++
++ Enables -march=native
++
+ endchoice
+
+ config X86_GENERIC
+@@ -300,7 +412,7 @@ config X86_INTERNODE_CACHE_SHIFT
+ config X86_L1_CACHE_SHIFT
+ int
+ default "7" if MPENTIUM4 || MPSC
+- default "6" if MK7 || MK8 || MPENTIUMM || MCORE2 || MATOM || MVIAC7 || X86_GENERIC || GENERIC_CPU
++ default "6" if MK7 || MK8 || MK8SSE3 || MK10 || MBARCELONA || MBOBCAT || MBULLDOZER || MPILEDRIVER || MJAGUAR || MPENTIUMM || MCORE2 || MNEHALEM || MWESTMERE || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || BROADWELL || MNATIVE || MATOM || MVIAC7 || X86_GENERIC || GENERIC_CPU
+ default "4" if MELAN || M486 || MGEODEGX1
+ default "5" if MWINCHIP3D || MWINCHIPC6 || MCRUSOE || MEFFICEON || MCYRIXIII || MK6 || MPENTIUMIII || MPENTIUMII || M686 || M586MMX || M586TSC || M586 || MVIAC3_2 || MGEODE_LX
+
+@@ -331,11 +443,11 @@ config X86_ALIGNMENT_16
+
+ config X86_INTEL_USERCOPY
+ def_bool y
+- depends on MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M586MMX || X86_GENERIC || MK8 || MK7 || MEFFICEON || MCORE2
++ depends on MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M586MMX || X86_GENERIC || MK8 || MK8SSE3 || MK7 || MEFFICEON || MCORE2 || MK10 || MBARCELONA || MNEHALEM || MWESTMERE || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || MBROADWELL || MNATIVE
+
+ config X86_USE_PPRO_CHECKSUM
+ def_bool y
+- depends on MWINCHIP3D || MWINCHIPC6 || MCYRIXIII || MK7 || MK6 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MK8 || MVIAC3_2 || MVIAC7 || MEFFICEON || MGEODE_LX || MCORE2 || MATOM
++ depends on MWINCHIP3D || MWINCHIPC6 || MCYRIXIII || MK7 || MK6 || MK10 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MK8 || MK8SSE3 || MVIAC3_2 || MVIAC7 || MEFFICEON || MGEODE_LX || MCORE2 || MNEHALEM || MWESTMERE || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || MBROADWELL || MATOM || MNATIVE
+
+ config X86_USE_3DNOW
+ def_bool y
+@@ -359,17 +471,17 @@ config X86_P6_NOP
+
+ config X86_TSC
+ def_bool y
+- depends on (MWINCHIP3D || MCRUSOE || MEFFICEON || MCYRIXIII || MK7 || MK6 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || M586MMX || M586TSC || MK8 || MVIAC3_2 || MVIAC7 || MGEODEGX1 || MGEODE_LX || MCORE2 || MATOM) || X86_64
++ depends on (MWINCHIP3D || MCRUSOE || MEFFICEON || MCYRIXIII || MK7 || MK6 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || M586MMX || M586TSC || MK8 || MK8SSE3 || MVIAC3_2 || MVIAC7 || MGEODEGX1 || MGEODE_LX || MCORE2 || MNEHALEM || MWESTMERE || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || MBROADWELL || MNATIVE || MATOM) || X86_64
+
+ config X86_CMPXCHG64
+ def_bool y
+- depends on X86_PAE || X86_64 || MCORE2 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MATOM
++ depends on X86_PAE || X86_64 || MCORE2 || MNEHALEM || MWESTMERE || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || MBROADWELL || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MATOM || MNATIVE
+
+ # this should be set for all -march=.. options where the compiler
+ # generates cmov.
+ config X86_CMOV
+ def_bool y
+- depends on (MK8 || MK7 || MCORE2 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MVIAC3_2 || MVIAC7 || MCRUSOE || MEFFICEON || X86_64 || MATOM || MGEODE_LX)
++ depends on (MK8 || MK8SSE3 || MK10 || MBARCELONA || MBOBCAT || MBULLDOZER || MPILEDRIVER || MJAGUAR || MK7 || MCORE2 || MNEHALEM || MWESTMERE || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || MBROADWELL || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MVIAC3_2 || MVIAC7 || MCRUSOE || MEFFICEON || X86_64 || MNATIVE || MATOM || MGEODE_LX)
+
+ config X86_MINIMUM_CPU_FAMILY
+ int
+--- a/arch/x86/Makefile 2014-08-03 18:25:02.000000000 -0400
++++ b/arch/x86/Makefile 2014-09-13 09:37:16.721385247 -0400
+@@ -92,13 +92,33 @@ else
+ KBUILD_CFLAGS += $(call cc-option,-mpreferred-stack-boundary=3)
+
+ # FIXME - should be integrated in Makefile.cpu (Makefile_32.cpu)
++ cflags-$(CONFIG_MNATIVE) += $(call cc-option,-march=native)
+ cflags-$(CONFIG_MK8) += $(call cc-option,-march=k8)
++ cflags-$(CONFIG_MK8SSE3) += $(call cc-option,-march=k8-sse3,-mtune=k8)
++ cflags-$(CONFIG_MK10) += $(call cc-option,-march=amdfam10)
++ cflags-$(CONFIG_MBARCELONA) += $(call cc-option,-march=barcelona)
++ cflags-$(CONFIG_MBOBCAT) += $(call cc-option,-march=btver1)
++ cflags-$(CONFIG_MBULLDOZER) += $(call cc-option,-march=bdver1)
++ cflags-$(CONFIG_MPILEDRIVER) += $(call cc-option,-march=bdver2)
++ cflags-$(CONFIG_MJAGUAR) += $(call cc-option,-march=btver2)
+ cflags-$(CONFIG_MPSC) += $(call cc-option,-march=nocona)
+
+ cflags-$(CONFIG_MCORE2) += \
+- $(call cc-option,-march=core2,$(call cc-option,-mtune=generic))
+- cflags-$(CONFIG_MATOM) += $(call cc-option,-march=atom) \
+- $(call cc-option,-mtune=atom,$(call cc-option,-mtune=generic))
++ $(call cc-option,-march=core2,$(call cc-option,-mtune=core2))
++ cflags-$(CONFIG_MNEHALEM) += \
++ $(call cc-option,-march=nehalem,$(call cc-option,-mtune=nehalem))
++ cflags-$(CONFIG_MWESTMERE) += \
++ $(call cc-option,-march=westmere,$(call cc-option,-mtune=westmere))
++ cflags-$(CONFIG_MSANDYBRIDGE) += \
++ $(call cc-option,-march=sandybridge,$(call cc-option,-mtune=sandybridge))
++ cflags-$(CONFIG_MIVYBRIDGE) += \
++ $(call cc-option,-march=ivybridge,$(call cc-option,-mtune=ivybridge))
++ cflags-$(CONFIG_MHASWELL) += \
++ $(call cc-option,-march=haswell,$(call cc-option,-mtune=haswell))
++ cflags-$(CONFIG_MBROADWELL) += \
++ $(call cc-option,-march=broadwell,$(call cc-option,-mtune=broadwell))
++ cflags-$(CONFIG_MATOM) += $(call cc-option,-march=bonnell) \
++ $(call cc-option,-mtune=bonnell,$(call cc-option,-mtune=generic))
+ cflags-$(CONFIG_GENERIC_CPU) += $(call cc-option,-mtune=generic)
+ KBUILD_CFLAGS += $(cflags-y)
+
+--- a/arch/x86/Makefile_32.cpu 2014-08-03 18:25:02.000000000 -0400
++++ b/arch/x86/Makefile_32.cpu 2014-09-13 09:37:16.721385247 -0400
+@@ -23,7 +23,15 @@ cflags-$(CONFIG_MK6) += -march=k6
+ # Please note, that patches that add -march=athlon-xp and friends are pointless.
+ # They make zero difference whatsosever to performance at this time.
+ cflags-$(CONFIG_MK7) += -march=athlon
++cflags-$(CONFIG_MNATIVE) += $(call cc-option,-march=native)
+ cflags-$(CONFIG_MK8) += $(call cc-option,-march=k8,-march=athlon)
++cflags-$(CONFIG_MK8SSE3) += $(call cc-option,-march=k8-sse3,-march=athlon)
++cflags-$(CONFIG_MK10) += $(call cc-option,-march=amdfam10,-march=athlon)
++cflags-$(CONFIG_MBARCELONA) += $(call cc-option,-march=barcelona,-march=athlon)
++cflags-$(CONFIG_MBOBCAT) += $(call cc-option,-march=btver1,-march=athlon)
++cflags-$(CONFIG_MBULLDOZER) += $(call cc-option,-march=bdver1,-march=athlon)
++cflags-$(CONFIG_MPILEDRIVER) += $(call cc-option,-march=bdver2,-march=athlon)
++cflags-$(CONFIG_MJAGUAR) += $(call cc-option,-march=btver2,-march=athlon)
+ cflags-$(CONFIG_MCRUSOE) += -march=i686 $(align)-functions=0 $(align)-jumps=0 $(align)-loops=0
+ cflags-$(CONFIG_MEFFICEON) += -march=i686 $(call tune,pentium3) $(align)-functions=0 $(align)-jumps=0 $(align)-loops=0
+ cflags-$(CONFIG_MWINCHIPC6) += $(call cc-option,-march=winchip-c6,-march=i586)
+@@ -32,8 +40,14 @@ cflags-$(CONFIG_MCYRIXIII) += $(call cc-
+ cflags-$(CONFIG_MVIAC3_2) += $(call cc-option,-march=c3-2,-march=i686)
+ cflags-$(CONFIG_MVIAC7) += -march=i686
+ cflags-$(CONFIG_MCORE2) += -march=i686 $(call tune,core2)
+-cflags-$(CONFIG_MATOM) += $(call cc-option,-march=atom,$(call cc-option,-march=core2,-march=i686)) \
+- $(call cc-option,-mtune=atom,$(call cc-option,-mtune=generic))
++cflags-$(CONFIG_MNEHALEM) += -march=i686 $(call tune,nehalem)
++cflags-$(CONFIG_MWESTMERE) += -march=i686 $(call tune,westmere)
++cflags-$(CONFIG_MSANDYBRIDGE) += -march=i686 $(call tune,sandybridge)
++cflags-$(CONFIG_MIVYBRIDGE) += -march=i686 $(call tune,ivybridge)
++cflags-$(CONFIG_MHASWELL) += -march=i686 $(call tune,haswell)
++cflags-$(CONFIG_MBROADWELL) += -march=i686 $(call tune,broadwell)
++cflags-$(CONFIG_MATOM) += $(call cc-option,-march=bonnell,$(call cc-option,-march=core2,-march=i686)) \
++ $(call cc-option,-mtune=bonnell,$(call cc-option,-mtune=generic))
+
+ # AMD Elan support
+ cflags-$(CONFIG_MELAN) += -march=i486
^ permalink raw reply related [flat|nested] 67+ messages in thread
* [gentoo-commits] proj/linux-patches:3.18 commit in: /
@ 2015-02-14 20:32 Mike Pagano
0 siblings, 0 replies; 67+ messages in thread
From: Mike Pagano @ 2015-02-14 20:32 UTC (permalink / raw
To: gentoo-commits
commit: 206f9adb9c02b3dd0a37edc4d204a946c19c8f22
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Sat Feb 14 20:32:28 2015 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Sat Feb 14 20:32:28 2015 +0000
URL: http://sources.gentoo.org/gitweb/?p=proj/linux-patches.git;a=commit;h=206f9adb
Enable link security restrictions by default
---
0000_README | 4 ++++
...ble-link-security-restrictions-by-default.patch | 22 ++++++++++++++++++++++
2 files changed, 26 insertions(+)
diff --git a/0000_README b/0000_README
index 116cf1b..bfdd162 100644
--- a/0000_README
+++ b/0000_README
@@ -75,6 +75,10 @@ Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
+Patch: 1510_fs-enable-link-security-restrictions-by-default.patch
+From: http://sources.debian.net/src/linux/3.16.7-ckt4-3/debian/patches/debian/fs-enable-link-security-restrictions-by-default.patch/
+Desc: Enable link security restrictions by default
+
Patch: 1700_ARM-dts-patch-to-support-popoplug-e02.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=508248
Desc: ARM: dts: Add support for Pogoplug E02.
diff --git a/1510_fs-enable-link-security-restrictions-by-default.patch b/1510_fs-enable-link-security-restrictions-by-default.patch
new file mode 100644
index 0000000..639fb3c
--- /dev/null
+++ b/1510_fs-enable-link-security-restrictions-by-default.patch
@@ -0,0 +1,22 @@
+From: Ben Hutchings <ben@decadent.org.uk>
+Subject: fs: Enable link security restrictions by default
+Date: Fri, 02 Nov 2012 05:32:06 +0000
+Bug-Debian: https://bugs.debian.org/609455
+Forwarded: not-needed
+
+This reverts commit 561ec64ae67ef25cac8d72bb9c4bfc955edfd415
+('VFS: don't do protected {sym,hard}links by default').
+
+--- a/fs/namei.c
++++ b/fs/namei.c
+@@ -651,8 +651,8 @@ static inline void put_link(struct namei
+ path_put(link);
+ }
+
+-int sysctl_protected_symlinks __read_mostly = 0;
+-int sysctl_protected_hardlinks __read_mostly = 0;
++int sysctl_protected_symlinks __read_mostly = 1;
++int sysctl_protected_hardlinks __read_mostly = 1;
+
+ /**
+ * may_follow_link - Check symlink following for unsafe situations
^ permalink raw reply related [flat|nested] 67+ messages in thread
* [gentoo-commits] proj/linux-patches:3.18 commit in: /
@ 2015-02-27 13:26 Mike Pagano
0 siblings, 0 replies; 67+ messages in thread
From: Mike Pagano @ 2015-02-27 13:26 UTC (permalink / raw
To: gentoo-commits
commit: 92d71a68a84f1c78e69d17af7292951a881c1972
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Fri Feb 27 13:26:19 2015 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Fri Feb 27 13:26:19 2015 +0000
URL: http://sources.gentoo.org/gitweb/?p=proj/linux-patches.git;a=commit;h=92d71a68
Linux patch 3.18.8
---
0000_README | 4 +
1007_linux-3.18.8.patch | 668 ++++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 672 insertions(+)
diff --git a/0000_README b/0000_README
index bfdd162..7c4ea05 100644
--- a/0000_README
+++ b/0000_README
@@ -71,6 +71,10 @@ Patch: 1006_linux-3.18.7.patch
From: http://www.kernel.org
Desc: Linux 3.18.7
+Patch: 1007_linux-3.18.8.patch
+From: http://www.kernel.org
+Desc: Linux 3.18.8
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1007_linux-3.18.8.patch b/1007_linux-3.18.8.patch
new file mode 100644
index 0000000..7cc436c
--- /dev/null
+++ b/1007_linux-3.18.8.patch
@@ -0,0 +1,668 @@
+diff --git a/Makefile b/Makefile
+index 0efae2279fbe..0b3f8a1b3715 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 18
+-SUBLEVEL = 7
++SUBLEVEL = 8
+ EXTRAVERSION =
+ NAME = Diseased Newt
+
+diff --git a/drivers/media/rc/ir-lirc-codec.c b/drivers/media/rc/ir-lirc-codec.c
+index ed2c8a1ed8ca..98893a8332c7 100644
+--- a/drivers/media/rc/ir-lirc-codec.c
++++ b/drivers/media/rc/ir-lirc-codec.c
+@@ -42,11 +42,17 @@ static int ir_lirc_decode(struct rc_dev *dev, struct ir_raw_event ev)
+ return -EINVAL;
+
+ /* Packet start */
+- if (ev.reset)
+- return 0;
++ if (ev.reset) {
++ /* Userspace expects a long space event before the start of
++ * the signal to use as a sync. This may be done with repeat
++ * packets and normal samples. But if a reset has been sent
++ * then we assume that a long time has passed, so we send a
++ * space with the maximum time value. */
++ sample = LIRC_SPACE(LIRC_VALUE_MASK);
++ IR_dprintk(2, "delivering reset sync space to lirc_dev\n");
+
+ /* Carrier reports */
+- if (ev.carrier_report) {
++ } else if (ev.carrier_report) {
+ sample = LIRC_FREQUENCY(ev.carrier);
+ IR_dprintk(2, "carrier report (freq: %d)\n", sample);
+
+diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+index 40beef5bca88..ec4cebabff49 100644
+--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+@@ -3175,7 +3175,7 @@ static int bnx2x_poll(struct napi_struct *napi, int budget)
+ }
+ #endif
+ if (!bnx2x_fp_lock_napi(fp))
+- return work_done;
++ return budget;
+
+ for_each_cos_in_tx_queue(fp, cos)
+ if (bnx2x_tx_queue_has_work(fp->txdata_ptr[cos]))
+diff --git a/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c b/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c
+index 613037584d08..c531c8ae1be4 100644
+--- a/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c
++++ b/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c
+@@ -2388,7 +2388,10 @@ static int netxen_nic_poll(struct napi_struct *napi, int budget)
+
+ work_done = netxen_process_rcv_ring(sds_ring, budget);
+
+- if ((work_done < budget) && tx_complete) {
++ if (!tx_complete)
++ work_done = budget;
++
++ if (work_done < budget) {
+ napi_complete(&sds_ring->napi);
+ if (test_bit(__NX_DEV_UP, &adapter->state))
+ netxen_nic_enable_int(sds_ring);
+diff --git a/drivers/net/hyperv/netvsc.c b/drivers/net/hyperv/netvsc.c
+index 7d76c9523395..63d7a642733d 100644
+--- a/drivers/net/hyperv/netvsc.c
++++ b/drivers/net/hyperv/netvsc.c
+@@ -716,7 +716,7 @@ int netvsc_send(struct hv_device *device,
+ u64 req_id;
+ unsigned int section_index = NETVSC_INVALID_INDEX;
+ u32 msg_size = 0;
+- struct sk_buff *skb;
++ struct sk_buff *skb = NULL;
+ u16 q_idx = packet->q_idx;
+
+
+@@ -743,8 +743,6 @@ int netvsc_send(struct hv_device *device,
+ packet);
+ skb = (struct sk_buff *)
+ (unsigned long)packet->send_completion_tid;
+- if (skb)
+- dev_kfree_skb_any(skb);
+ packet->page_buf_cnt = 0;
+ }
+ }
+@@ -807,6 +805,13 @@ int netvsc_send(struct hv_device *device,
+ packet, ret);
+ }
+
++ if (ret != 0) {
++ if (section_index != NETVSC_INVALID_INDEX)
++ netvsc_free_send_slot(net_device, section_index);
++ } else if (skb) {
++ dev_kfree_skb_any(skb);
++ }
++
+ return ret;
+ }
+
+diff --git a/drivers/net/ppp/ppp_deflate.c b/drivers/net/ppp/ppp_deflate.c
+index 602c625d95d5..b5edc7f96a39 100644
+--- a/drivers/net/ppp/ppp_deflate.c
++++ b/drivers/net/ppp/ppp_deflate.c
+@@ -246,7 +246,7 @@ static int z_compress(void *arg, unsigned char *rptr, unsigned char *obuf,
+ /*
+ * See if we managed to reduce the size of the packet.
+ */
+- if (olen < isize) {
++ if (olen < isize && olen <= osize) {
+ state->stats.comp_bytes += olen;
+ state->stats.comp_packets++;
+ } else {
+diff --git a/fs/ext4/super.c b/fs/ext4/super.c
+index 2c9e6864abd9..fc7391e14c2a 100644
+--- a/fs/ext4/super.c
++++ b/fs/ext4/super.c
+@@ -4849,9 +4849,8 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data)
+ if ((old_opts.s_mount_opt & EXT4_MOUNT_JOURNAL_CHECKSUM) ^
+ test_opt(sb, JOURNAL_CHECKSUM)) {
+ ext4_msg(sb, KERN_ERR, "changing journal_checksum "
+- "during remount not supported");
+- err = -EINVAL;
+- goto restore_opts;
++ "during remount not supported; ignoring");
++ sbi->s_mount_opt ^= EXT4_MOUNT_JOURNAL_CHECKSUM;
+ }
+
+ if (test_opt(sb, DATA_FLAGS) == EXT4_MOUNT_JOURNAL_DATA) {
+diff --git a/include/net/ip.h b/include/net/ip.h
+index 0bb620702929..09cf5aebb283 100644
+--- a/include/net/ip.h
++++ b/include/net/ip.h
+@@ -39,11 +39,12 @@ struct inet_skb_parm {
+ struct ip_options opt; /* Compiled IP options */
+ unsigned char flags;
+
+-#define IPSKB_FORWARDED 1
+-#define IPSKB_XFRM_TUNNEL_SIZE 2
+-#define IPSKB_XFRM_TRANSFORMED 4
+-#define IPSKB_FRAG_COMPLETE 8
+-#define IPSKB_REROUTED 16
++#define IPSKB_FORWARDED BIT(0)
++#define IPSKB_XFRM_TUNNEL_SIZE BIT(1)
++#define IPSKB_XFRM_TRANSFORMED BIT(2)
++#define IPSKB_FRAG_COMPLETE BIT(3)
++#define IPSKB_REROUTED BIT(4)
++#define IPSKB_DOREDIRECT BIT(5)
+
+ u16 frag_max_size;
+ };
+@@ -180,7 +181,7 @@ static inline __u8 ip_reply_arg_flowi_flags(const struct ip_reply_arg *arg)
+ return (arg->flags & IP_REPLY_ARG_NOSRCCHECK) ? FLOWI_FLAG_ANYSRC : 0;
+ }
+
+-void ip_send_unicast_reply(struct net *net, struct sk_buff *skb,
++void ip_send_unicast_reply(struct sock *sk, struct sk_buff *skb,
+ const struct ip_options *sopt,
+ __be32 daddr, __be32 saddr,
+ const struct ip_reply_arg *arg,
+diff --git a/include/net/netns/ipv4.h b/include/net/netns/ipv4.h
+index 24945cefc4fd..0ffef1a38efc 100644
+--- a/include/net/netns/ipv4.h
++++ b/include/net/netns/ipv4.h
+@@ -52,6 +52,7 @@ struct netns_ipv4 {
+ struct inet_peer_base *peers;
+ struct tcpm_hash_bucket *tcp_metrics_hash;
+ unsigned int tcp_metrics_hash_log;
++ struct sock * __percpu *tcp_sk;
+ struct netns_frags frags;
+ #ifdef CONFIG_NETFILTER
+ struct xt_table *iptable_filter;
+diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h
+index d17ed6fb2f70..5ccfe161f359 100644
+--- a/include/net/sch_generic.h
++++ b/include/net/sch_generic.h
+@@ -79,6 +79,9 @@ struct Qdisc {
+ struct netdev_queue *dev_queue;
+
+ struct gnet_stats_rate_est64 rate_est;
++ struct gnet_stats_basic_cpu __percpu *cpu_bstats;
++ struct gnet_stats_queue __percpu *cpu_qstats;
++
+ struct Qdisc *next_sched;
+ struct sk_buff *gso_skb;
+ /*
+@@ -86,15 +89,9 @@ struct Qdisc {
+ */
+ unsigned long state;
+ struct sk_buff_head q;
+- union {
+- struct gnet_stats_basic_packed bstats;
+- struct gnet_stats_basic_cpu __percpu *cpu_bstats;
+- } __packed;
++ struct gnet_stats_basic_packed bstats;
+ unsigned int __state;
+- union {
+- struct gnet_stats_queue qstats;
+- struct gnet_stats_queue __percpu *cpu_qstats;
+- } __packed;
++ struct gnet_stats_queue qstats;
+ struct rcu_head rcu_head;
+ int padded;
+ atomic_t refcnt;
+diff --git a/net/core/dev.c b/net/core/dev.c
+index 84409688ff39..9704a5c1103e 100644
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -6990,10 +6990,20 @@ static int dev_cpu_callback(struct notifier_block *nfb,
+ oldsd->output_queue = NULL;
+ oldsd->output_queue_tailp = &oldsd->output_queue;
+ }
+- /* Append NAPI poll list from offline CPU. */
+- if (!list_empty(&oldsd->poll_list)) {
+- list_splice_init(&oldsd->poll_list, &sd->poll_list);
+- raise_softirq_irqoff(NET_RX_SOFTIRQ);
++ /* Append NAPI poll list from offline CPU, with one exception :
++ * process_backlog() must be called by cpu owning percpu backlog.
++ * We properly handle process_queue & input_pkt_queue later.
++ */
++ while (!list_empty(&oldsd->poll_list)) {
++ struct napi_struct *napi = list_first_entry(&oldsd->poll_list,
++ struct napi_struct,
++ poll_list);
++
++ list_del_init(&napi->poll_list);
++ if (napi->poll == process_backlog)
++ napi->state = 0;
++ else
++ ____napi_schedule(sd, napi);
+ }
+
+ raise_softirq_irqoff(NET_TX_SOFTIRQ);
+@@ -7004,7 +7014,7 @@ static int dev_cpu_callback(struct notifier_block *nfb,
+ netif_rx_internal(skb);
+ input_queue_head_incr(oldsd);
+ }
+- while ((skb = __skb_dequeue(&oldsd->input_pkt_queue))) {
++ while ((skb = skb_dequeue(&oldsd->input_pkt_queue))) {
+ netif_rx_internal(skb);
+ input_queue_head_incr(oldsd);
+ }
+diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
+index 76321ea442c3..ca82629de0b2 100644
+--- a/net/core/rtnetlink.c
++++ b/net/core/rtnetlink.c
+@@ -2770,12 +2770,16 @@ static int rtnl_bridge_notify(struct net_device *dev, u16 flags)
+ goto errout;
+ }
+
++ if (!skb->len)
++ goto errout;
++
+ rtnl_notify(skb, net, 0, RTNLGRP_LINK, NULL, GFP_ATOMIC);
+ return 0;
+ errout:
+ WARN_ON(err == -EMSGSIZE);
+ kfree_skb(skb);
+- rtnl_set_sk_err(net, RTNLGRP_LINK, err);
++ if (err)
++ rtnl_set_sk_err(net, RTNLGRP_LINK, err);
+ return err;
+ }
+
+diff --git a/net/ipv4/ip_forward.c b/net/ipv4/ip_forward.c
+index 3a83ce5efa80..787b3c294ce6 100644
+--- a/net/ipv4/ip_forward.c
++++ b/net/ipv4/ip_forward.c
+@@ -129,7 +129,8 @@ int ip_forward(struct sk_buff *skb)
+ * We now generate an ICMP HOST REDIRECT giving the route
+ * we calculated.
+ */
+- if (rt->rt_flags&RTCF_DOREDIRECT && !opt->srr && !skb_sec_path(skb))
++ if (IPCB(skb)->flags & IPSKB_DOREDIRECT && !opt->srr &&
++ !skb_sec_path(skb))
+ ip_rt_send_redirect(skb);
+
+ skb->priority = rt_tos2priority(iph->tos);
+diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
+index bc6471d4abcd..4a2a074bfb4a 100644
+--- a/net/ipv4/ip_output.c
++++ b/net/ipv4/ip_output.c
+@@ -1506,23 +1506,8 @@ static int ip_reply_glue_bits(void *dptr, char *to, int offset,
+ /*
+ * Generic function to send a packet as reply to another packet.
+ * Used to send some TCP resets/acks so far.
+- *
+- * Use a fake percpu inet socket to avoid false sharing and contention.
+ */
+-static DEFINE_PER_CPU(struct inet_sock, unicast_sock) = {
+- .sk = {
+- .__sk_common = {
+- .skc_refcnt = ATOMIC_INIT(1),
+- },
+- .sk_wmem_alloc = ATOMIC_INIT(1),
+- .sk_allocation = GFP_ATOMIC,
+- .sk_flags = (1UL << SOCK_USE_WRITE_QUEUE),
+- },
+- .pmtudisc = IP_PMTUDISC_WANT,
+- .uc_ttl = -1,
+-};
+-
+-void ip_send_unicast_reply(struct net *net, struct sk_buff *skb,
++void ip_send_unicast_reply(struct sock *sk, struct sk_buff *skb,
+ const struct ip_options *sopt,
+ __be32 daddr, __be32 saddr,
+ const struct ip_reply_arg *arg,
+@@ -1532,9 +1517,8 @@ void ip_send_unicast_reply(struct net *net, struct sk_buff *skb,
+ struct ipcm_cookie ipc;
+ struct flowi4 fl4;
+ struct rtable *rt = skb_rtable(skb);
++ struct net *net = sock_net(sk);
+ struct sk_buff *nskb;
+- struct sock *sk;
+- struct inet_sock *inet;
+ int err;
+
+ if (__ip_options_echo(&replyopts.opt.opt, skb, sopt))
+@@ -1565,15 +1549,11 @@ void ip_send_unicast_reply(struct net *net, struct sk_buff *skb,
+ if (IS_ERR(rt))
+ return;
+
+- inet = &get_cpu_var(unicast_sock);
++ inet_sk(sk)->tos = arg->tos;
+
+- inet->tos = arg->tos;
+- sk = &inet->sk;
+ sk->sk_priority = skb->priority;
+ sk->sk_protocol = ip_hdr(skb)->protocol;
+ sk->sk_bound_dev_if = arg->bound_dev_if;
+- sock_net_set(sk, net);
+- __skb_queue_head_init(&sk->sk_write_queue);
+ sk->sk_sndbuf = sysctl_wmem_default;
+ err = ip_append_data(sk, &fl4, ip_reply_glue_bits, arg->iov->iov_base,
+ len, 0, &ipc, &rt, MSG_DONTWAIT);
+@@ -1589,13 +1569,10 @@ void ip_send_unicast_reply(struct net *net, struct sk_buff *skb,
+ arg->csumoffset) = csum_fold(csum_add(nskb->csum,
+ arg->csum));
+ nskb->ip_summed = CHECKSUM_NONE;
+- skb_orphan(nskb);
+ skb_set_queue_mapping(nskb, skb_get_queue_mapping(skb));
+ ip_push_pending_frames(sk, &fl4);
+ }
+ out:
+- put_cpu_var(unicast_sock);
+-
+ ip_rt_put(rt);
+ }
+
+diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
+index 9daf2177dc00..046fce012da5 100644
+--- a/net/ipv4/ip_sockglue.c
++++ b/net/ipv4/ip_sockglue.c
+@@ -443,15 +443,11 @@ int ip_recv_error(struct sock *sk, struct msghdr *msg, int len, int *addr_len)
+
+ memcpy(&errhdr.ee, &serr->ee, sizeof(struct sock_extended_err));
+ sin = &errhdr.offender;
+- sin->sin_family = AF_UNSPEC;
++ memset(sin, 0, sizeof(*sin));
+ if (serr->ee.ee_origin == SO_EE_ORIGIN_ICMP) {
+- struct inet_sock *inet = inet_sk(sk);
+-
+ sin->sin_family = AF_INET;
+ sin->sin_addr.s_addr = ip_hdr(skb)->saddr;
+- sin->sin_port = 0;
+- memset(&sin->sin_zero, 0, sizeof(sin->sin_zero));
+- if (inet->cmsg_flags)
++ if (inet_sk(sk)->cmsg_flags)
+ ip_cmsg_recv(msg, skb);
+ }
+
+diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
+index 5d740cccf69e..5638b179b355 100644
+--- a/net/ipv4/ping.c
++++ b/net/ipv4/ping.c
+@@ -965,8 +965,11 @@ void ping_rcv(struct sk_buff *skb)
+
+ sk = ping_lookup(net, skb, ntohs(icmph->un.echo.id));
+ if (sk != NULL) {
++ struct sk_buff *skb2 = skb_clone(skb, GFP_ATOMIC);
++
+ pr_debug("rcv on socket %p\n", sk);
+- ping_queue_rcv_skb(sk, skb_get(skb));
++ if (skb2)
++ ping_queue_rcv_skb(sk, skb2);
+ sock_put(sk);
+ return;
+ }
+diff --git a/net/ipv4/route.c b/net/ipv4/route.c
+index 6a2155b02602..d58dd0ec3e53 100644
+--- a/net/ipv4/route.c
++++ b/net/ipv4/route.c
+@@ -1554,11 +1554,10 @@ static int __mkroute_input(struct sk_buff *skb,
+
+ do_cache = res->fi && !itag;
+ if (out_dev == in_dev && err && IN_DEV_TX_REDIRECTS(out_dev) &&
++ skb->protocol == htons(ETH_P_IP) &&
+ (IN_DEV_SHARED_MEDIA(out_dev) ||
+- inet_addr_onlink(out_dev, saddr, FIB_RES_GW(*res)))) {
+- flags |= RTCF_DOREDIRECT;
+- do_cache = false;
+- }
++ inet_addr_onlink(out_dev, saddr, FIB_RES_GW(*res))))
++ IPCB(skb)->flags |= IPSKB_DOREDIRECT;
+
+ if (skb->protocol != htons(ETH_P_IP)) {
+ /* Not IP (i.e. ARP). Do not create route, if it is
+@@ -2303,6 +2302,8 @@ static int rt_fill_info(struct net *net, __be32 dst, __be32 src,
+ r->rtm_flags = (rt->rt_flags & ~0xFFFF) | RTM_F_CLONED;
+ if (rt->rt_flags & RTCF_NOTIFY)
+ r->rtm_flags |= RTM_F_NOTIFY;
++ if (IPCB(skb)->flags & IPSKB_DOREDIRECT)
++ r->rtm_flags |= RTCF_DOREDIRECT;
+
+ if (nla_put_be32(skb, RTA_DST, dst))
+ goto nla_put_failure;
+diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
+index ef7089ca86e2..944ce5edbfb7 100644
+--- a/net/ipv4/tcp_ipv4.c
++++ b/net/ipv4/tcp_ipv4.c
+@@ -683,7 +683,8 @@ static void tcp_v4_send_reset(struct sock *sk, struct sk_buff *skb)
+ arg.bound_dev_if = sk->sk_bound_dev_if;
+
+ arg.tos = ip_hdr(skb)->tos;
+- ip_send_unicast_reply(net, skb, &TCP_SKB_CB(skb)->header.h4.opt,
++ ip_send_unicast_reply(*this_cpu_ptr(net->ipv4.tcp_sk),
++ skb, &TCP_SKB_CB(skb)->header.h4.opt,
+ ip_hdr(skb)->saddr, ip_hdr(skb)->daddr,
+ &arg, arg.iov[0].iov_len);
+
+@@ -767,7 +768,8 @@ static void tcp_v4_send_ack(struct sk_buff *skb, u32 seq, u32 ack,
+ if (oif)
+ arg.bound_dev_if = oif;
+ arg.tos = tos;
+- ip_send_unicast_reply(net, skb, &TCP_SKB_CB(skb)->header.h4.opt,
++ ip_send_unicast_reply(*this_cpu_ptr(net->ipv4.tcp_sk),
++ skb, &TCP_SKB_CB(skb)->header.h4.opt,
+ ip_hdr(skb)->saddr, ip_hdr(skb)->daddr,
+ &arg, arg.iov[0].iov_len);
+
+@@ -2426,14 +2428,39 @@ struct proto tcp_prot = {
+ };
+ EXPORT_SYMBOL(tcp_prot);
+
++static void __net_exit tcp_sk_exit(struct net *net)
++{
++ int cpu;
++
++ for_each_possible_cpu(cpu)
++ inet_ctl_sock_destroy(*per_cpu_ptr(net->ipv4.tcp_sk, cpu));
++ free_percpu(net->ipv4.tcp_sk);
++}
++
+ static int __net_init tcp_sk_init(struct net *net)
+ {
++ int res, cpu;
++
++ net->ipv4.tcp_sk = alloc_percpu(struct sock *);
++ if (!net->ipv4.tcp_sk)
++ return -ENOMEM;
++
++ for_each_possible_cpu(cpu) {
++ struct sock *sk;
++
++ res = inet_ctl_sock_create(&sk, PF_INET, SOCK_RAW,
++ IPPROTO_TCP, net);
++ if (res)
++ goto fail;
++ *per_cpu_ptr(net->ipv4.tcp_sk, cpu) = sk;
++ }
+ net->ipv4.sysctl_tcp_ecn = 2;
+ return 0;
+-}
+
+-static void __net_exit tcp_sk_exit(struct net *net)
+-{
++fail:
++ tcp_sk_exit(net);
++
++ return res;
+ }
+
+ static void __net_exit tcp_sk_exit_batch(struct list_head *net_exit_list)
+diff --git a/net/ipv4/udp_diag.c b/net/ipv4/udp_diag.c
+index 7927db0a9279..4a000f1dd757 100644
+--- a/net/ipv4/udp_diag.c
++++ b/net/ipv4/udp_diag.c
+@@ -99,11 +99,13 @@ static void udp_dump(struct udp_table *table, struct sk_buff *skb, struct netlin
+ s_slot = cb->args[0];
+ num = s_num = cb->args[1];
+
+- for (slot = s_slot; slot <= table->mask; num = s_num = 0, slot++) {
++ for (slot = s_slot; slot <= table->mask; s_num = 0, slot++) {
+ struct sock *sk;
+ struct hlist_nulls_node *node;
+ struct udp_hslot *hslot = &table->hash[slot];
+
++ num = 0;
++
+ if (hlist_nulls_empty(&hslot->head))
+ continue;
+
+diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c
+index 2cdc38338be3..11e3945eeac7 100644
+--- a/net/ipv6/datagram.c
++++ b/net/ipv6/datagram.c
+@@ -383,11 +383,10 @@ int ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len, int *addr_len)
+
+ memcpy(&errhdr.ee, &serr->ee, sizeof(struct sock_extended_err));
+ sin = &errhdr.offender;
+- sin->sin6_family = AF_UNSPEC;
++ memset(sin, 0, sizeof(*sin));
++
+ if (serr->ee.ee_origin != SO_EE_ORIGIN_LOCAL) {
+ sin->sin6_family = AF_INET6;
+- sin->sin6_flowinfo = 0;
+- sin->sin6_port = 0;
+ if (np->rxopt.all)
+ ip6_datagram_recv_common_ctl(sk, msg, skb);
+ if (skb->protocol == htons(ETH_P_IPV6)) {
+@@ -398,12 +397,9 @@ int ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len, int *addr_len)
+ ipv6_iface_scope_id(&sin->sin6_addr,
+ IP6CB(skb)->iif);
+ } else {
+- struct inet_sock *inet = inet_sk(sk);
+-
+ ipv6_addr_set_v4mapped(ip_hdr(skb)->saddr,
+ &sin->sin6_addr);
+- sin->sin6_scope_id = 0;
+- if (inet->cmsg_flags)
++ if (inet_sk(sk)->cmsg_flags)
+ ip_cmsg_recv(msg, skb);
+ }
+ }
+diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
+index b2d1838897c9..f1c6d5e98322 100644
+--- a/net/ipv6/ip6_fib.c
++++ b/net/ipv6/ip6_fib.c
+@@ -659,6 +659,29 @@ static int fib6_commit_metrics(struct dst_entry *dst,
+ return 0;
+ }
+
++static void fib6_purge_rt(struct rt6_info *rt, struct fib6_node *fn,
++ struct net *net)
++{
++ if (atomic_read(&rt->rt6i_ref) != 1) {
++ /* This route is used as dummy address holder in some split
++ * nodes. It is not leaked, but it still holds other resources,
++ * which must be released in time. So, scan ascendant nodes
++ * and replace dummy references to this route with references
++ * to still alive ones.
++ */
++ while (fn) {
++ if (!(fn->fn_flags & RTN_RTINFO) && fn->leaf == rt) {
++ fn->leaf = fib6_find_prefix(net, fn);
++ atomic_inc(&fn->leaf->rt6i_ref);
++ rt6_release(rt);
++ }
++ fn = fn->parent;
++ }
++ /* No more references are possible at this point. */
++ BUG_ON(atomic_read(&rt->rt6i_ref) != 1);
++ }
++}
++
+ /*
+ * Insert routing information in a node.
+ */
+@@ -807,11 +830,12 @@ add:
+ rt->dst.rt6_next = iter->dst.rt6_next;
+ atomic_inc(&rt->rt6i_ref);
+ inet6_rt_notify(RTM_NEWROUTE, rt, info);
+- rt6_release(iter);
+ if (!(fn->fn_flags & RTN_RTINFO)) {
+ info->nl_net->ipv6.rt6_stats->fib_route_nodes++;
+ fn->fn_flags |= RTN_RTINFO;
+ }
++ fib6_purge_rt(iter, fn, info->nl_net);
++ rt6_release(iter);
+ }
+
+ return 0;
+@@ -1322,24 +1346,7 @@ static void fib6_del_route(struct fib6_node *fn, struct rt6_info **rtp,
+ fn = fib6_repair_tree(net, fn);
+ }
+
+- if (atomic_read(&rt->rt6i_ref) != 1) {
+- /* This route is used as dummy address holder in some split
+- * nodes. It is not leaked, but it still holds other resources,
+- * which must be released in time. So, scan ascendant nodes
+- * and replace dummy references to this route with references
+- * to still alive ones.
+- */
+- while (fn) {
+- if (!(fn->fn_flags & RTN_RTINFO) && fn->leaf == rt) {
+- fn->leaf = fib6_find_prefix(net, fn);
+- atomic_inc(&fn->leaf->rt6i_ref);
+- rt6_release(rt);
+- }
+- fn = fn->parent;
+- }
+- /* No more references are possible at this point. */
+- BUG_ON(atomic_read(&rt->rt6i_ref) != 1);
+- }
++ fib6_purge_rt(rt, fn, net);
+
+ inet6_rt_notify(RTM_DELROUTE, rt, info);
+ rt6_release(rt);
+diff --git a/net/ipv6/route.c b/net/ipv6/route.c
+index a318dd89b6d9..d02ee019382e 100644
+--- a/net/ipv6/route.c
++++ b/net/ipv6/route.c
+@@ -1150,12 +1150,9 @@ static void ip6_rt_update_pmtu(struct dst_entry *dst, struct sock *sk,
+ struct net *net = dev_net(dst->dev);
+
+ rt6->rt6i_flags |= RTF_MODIFIED;
+- if (mtu < IPV6_MIN_MTU) {
+- u32 features = dst_metric(dst, RTAX_FEATURES);
++ if (mtu < IPV6_MIN_MTU)
+ mtu = IPV6_MIN_MTU;
+- features |= RTAX_FEATURE_ALLFRAG;
+- dst_metric_set(dst, RTAX_FEATURES, features);
+- }
++
+ dst_metric_set(dst, RTAX_MTU, mtu);
+ rt6_update_expires(rt6, net->ipv6.sysctl.ip6_rt_mtu_expires);
+ }
+diff --git a/net/sctp/associola.c b/net/sctp/associola.c
+index f791edd64d6c..26d06dbcc1c8 100644
+--- a/net/sctp/associola.c
++++ b/net/sctp/associola.c
+@@ -1182,7 +1182,6 @@ void sctp_assoc_update(struct sctp_association *asoc,
+ asoc->peer.peer_hmacs = new->peer.peer_hmacs;
+ new->peer.peer_hmacs = NULL;
+
+- sctp_auth_key_put(asoc->asoc_shared_key);
+ sctp_auth_asoc_init_active_key(asoc, GFP_ATOMIC);
+ }
+
+diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
+index 9f32741abb1c..371a152d9759 100644
+--- a/net/sctp/sm_make_chunk.c
++++ b/net/sctp/sm_make_chunk.c
+@@ -2608,7 +2608,7 @@ do_addr_param:
+
+ addr_param = param.v + sizeof(sctp_addip_param_t);
+
+- af = sctp_get_af_specific(param_type2af(param.p->type));
++ af = sctp_get_af_specific(param_type2af(addr_param->p.type));
+ if (af == NULL)
+ break;
+
+diff --git a/net/socket.c b/net/socket.c
+index fe20c319a0bb..cf9ebf10c841 100644
+--- a/net/socket.c
++++ b/net/socket.c
+@@ -892,9 +892,6 @@ static ssize_t sock_splice_read(struct file *file, loff_t *ppos,
+ static struct sock_iocb *alloc_sock_iocb(struct kiocb *iocb,
+ struct sock_iocb *siocb)
+ {
+- if (!is_sync_kiocb(iocb))
+- BUG();
+-
+ siocb->kiocb = iocb;
+ iocb->private = siocb;
+ return siocb;
^ permalink raw reply related [flat|nested] 67+ messages in thread
* [gentoo-commits] proj/linux-patches:3.18 commit in: /
@ 2015-03-07 14:28 Mike Pagano
0 siblings, 0 replies; 67+ messages in thread
From: Mike Pagano @ 2015-03-07 14:28 UTC (permalink / raw
To: gentoo-commits
commit: 1298219e93424dd2f652e663db1e893f55d34646
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Sat Mar 7 14:28:02 2015 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Sat Mar 7 14:28:02 2015 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=1298219e
Linux patch 3.18.9
0000_README | 4 +
1008_linux-3.18.9.patch | 6044 +++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 6048 insertions(+)
diff --git a/0000_README b/0000_README
index 7c4ea05..8161304 100644
--- a/0000_README
+++ b/0000_README
@@ -75,6 +75,10 @@ Patch: 1007_linux-3.18.8.patch
From: http://www.kernel.org
Desc: Linux 3.18.8
+Patch: 1008_linux-3.18.9.patch
+From: http://www.kernel.org
+Desc: Linux 3.18.9
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1008_linux-3.18.9.patch b/1008_linux-3.18.9.patch
new file mode 100644
index 0000000..8888040
--- /dev/null
+++ b/1008_linux-3.18.9.patch
@@ -0,0 +1,6044 @@
+diff --git a/Makefile b/Makefile
+index 0b3f8a1b3715..62b333802a0e 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 18
+-SUBLEVEL = 8
++SUBLEVEL = 9
+ EXTRAVERSION =
+ NAME = Diseased Newt
+
+diff --git a/arch/arc/include/asm/pgtable.h b/arch/arc/include/asm/pgtable.h
+index 6b0b7f7ef783..7670f33b9ce2 100644
+--- a/arch/arc/include/asm/pgtable.h
++++ b/arch/arc/include/asm/pgtable.h
+@@ -259,7 +259,8 @@ static inline void pmd_set(pmd_t *pmdp, pte_t *ptep)
+ #define pmd_clear(xp) do { pmd_val(*(xp)) = 0; } while (0)
+
+ #define pte_page(x) (mem_map + \
+- (unsigned long)(((pte_val(x) - PAGE_OFFSET) >> PAGE_SHIFT)))
++ (unsigned long)(((pte_val(x) - CONFIG_LINUX_LINK_BASE) >> \
++ PAGE_SHIFT)))
+
+ #define mk_pte(page, pgprot) \
+ ({ \
+diff --git a/arch/arm/boot/dts/am335x-bone-common.dtsi b/arch/arm/boot/dts/am335x-bone-common.dtsi
+index 6cc25ed912ee..2c6248d9a9ef 100644
+--- a/arch/arm/boot/dts/am335x-bone-common.dtsi
++++ b/arch/arm/boot/dts/am335x-bone-common.dtsi
+@@ -195,6 +195,7 @@
+
+ &usb0 {
+ status = "okay";
++ dr_mode = "peripheral";
+ };
+
+ &usb1 {
+diff --git a/arch/arm/boot/dts/bcm63138.dtsi b/arch/arm/boot/dts/bcm63138.dtsi
+index f3bb2dd6269e..c97844cac4e7 100644
+--- a/arch/arm/boot/dts/bcm63138.dtsi
++++ b/arch/arm/boot/dts/bcm63138.dtsi
+@@ -66,8 +66,9 @@
+ reg = <0x1d000 0x1000>;
+ cache-unified;
+ cache-level = <2>;
+- cache-sets = <16>;
+- cache-size = <0x80000>;
++ cache-size = <524288>;
++ cache-sets = <1024>;
++ cache-line-size = <32>;
+ interrupts = <GIC_PPI 0 IRQ_TYPE_LEVEL_HIGH>;
+ };
+
+diff --git a/arch/arm/boot/dts/tegra20.dtsi b/arch/arm/boot/dts/tegra20.dtsi
+index 8acf5d85c99d..f76fe94267d6 100644
+--- a/arch/arm/boot/dts/tegra20.dtsi
++++ b/arch/arm/boot/dts/tegra20.dtsi
+@@ -68,9 +68,9 @@
+ reset-names = "2d";
+ };
+
+- gr3d@54140000 {
++ gr3d@54180000 {
+ compatible = "nvidia,tegra20-gr3d";
+- reg = <0x54140000 0x00040000>;
++ reg = <0x54180000 0x00040000>;
+ clocks = <&tegra_car TEGRA20_CLK_GR3D>;
+ resets = <&tegra_car 24>;
+ reset-names = "3d";
+@@ -130,9 +130,9 @@
+ status = "disabled";
+ };
+
+- dsi@542c0000 {
++ dsi@54300000 {
+ compatible = "nvidia,tegra20-dsi";
+- reg = <0x542c0000 0x00040000>;
++ reg = <0x54300000 0x00040000>;
+ clocks = <&tegra_car TEGRA20_CLK_DSI>;
+ resets = <&tegra_car 48>;
+ reset-names = "dsi";
+diff --git a/arch/arm/mach-mvebu/system-controller.c b/arch/arm/mach-mvebu/system-controller.c
+index a068cb5c2ce8..c6c132acd7a6 100644
+--- a/arch/arm/mach-mvebu/system-controller.c
++++ b/arch/arm/mach-mvebu/system-controller.c
+@@ -126,7 +126,7 @@ int mvebu_system_controller_get_soc_id(u32 *dev, u32 *rev)
+ return -ENODEV;
+ }
+
+-#ifdef CONFIG_SMP
++#if defined(CONFIG_SMP) && defined(CONFIG_MACH_MVEBU_V7)
+ void mvebu_armada375_smp_wa_init(void)
+ {
+ u32 dev, rev;
+diff --git a/arch/arm/mach-omap2/omap_hwmod_7xx_data.c b/arch/arm/mach-omap2/omap_hwmod_7xx_data.c
+index 5684f112654b..4e9d2a97c2cb 100644
+--- a/arch/arm/mach-omap2/omap_hwmod_7xx_data.c
++++ b/arch/arm/mach-omap2/omap_hwmod_7xx_data.c
+@@ -2017,7 +2017,7 @@ static struct omap_hwmod dra7xx_uart3_hwmod = {
+ .class = &dra7xx_uart_hwmod_class,
+ .clkdm_name = "l4per_clkdm",
+ .main_clk = "uart3_gfclk_mux",
+- .flags = HWMOD_SWSUP_SIDLE_ACT,
++ .flags = HWMOD_SWSUP_SIDLE_ACT | DEBUG_OMAP4UART3_FLAGS,
+ .prcm = {
+ .omap4 = {
+ .clkctrl_offs = DRA7XX_CM_L4PER_UART3_CLKCTRL_OFFSET,
+diff --git a/arch/arm/mach-pxa/corgi.c b/arch/arm/mach-pxa/corgi.c
+index 06022b235730..89f790dda93e 100644
+--- a/arch/arm/mach-pxa/corgi.c
++++ b/arch/arm/mach-pxa/corgi.c
+@@ -26,6 +26,7 @@
+ #include <linux/i2c.h>
+ #include <linux/i2c/pxa-i2c.h>
+ #include <linux/io.h>
++#include <linux/regulator/machine.h>
+ #include <linux/spi/spi.h>
+ #include <linux/spi/ads7846.h>
+ #include <linux/spi/corgi_lcd.h>
+@@ -752,6 +753,8 @@ static void __init corgi_init(void)
+ sharpsl_nand_partitions[1].size = 53 * 1024 * 1024;
+
+ platform_add_devices(devices, ARRAY_SIZE(devices));
++
++ regulator_has_full_constraints();
+ }
+
+ static void __init fixup_corgi(struct tag *tags, char **cmdline)
+diff --git a/arch/arm/mach-pxa/hx4700.c b/arch/arm/mach-pxa/hx4700.c
+index c66ad4edc5e3..5fb41ad6e3bc 100644
+--- a/arch/arm/mach-pxa/hx4700.c
++++ b/arch/arm/mach-pxa/hx4700.c
+@@ -893,6 +893,8 @@ static void __init hx4700_init(void)
+ mdelay(10);
+ gpio_set_value(GPIO71_HX4700_ASIC3_nRESET, 1);
+ mdelay(10);
++
++ regulator_has_full_constraints();
+ }
+
+ MACHINE_START(H4700, "HP iPAQ HX4700")
+diff --git a/arch/arm/mach-pxa/poodle.c b/arch/arm/mach-pxa/poodle.c
+index 131991629116..e81d216b05e4 100644
+--- a/arch/arm/mach-pxa/poodle.c
++++ b/arch/arm/mach-pxa/poodle.c
+@@ -25,6 +25,7 @@
+ #include <linux/gpio.h>
+ #include <linux/i2c.h>
+ #include <linux/i2c/pxa-i2c.h>
++#include <linux/regulator/machine.h>
+ #include <linux/spi/spi.h>
+ #include <linux/spi/ads7846.h>
+ #include <linux/spi/pxa2xx_spi.h>
+@@ -455,6 +456,7 @@ static void __init poodle_init(void)
+ pxa_set_i2c_info(NULL);
+ i2c_register_board_info(0, ARRAY_AND_SIZE(poodle_i2c_devices));
+ poodle_init_spi();
++ regulator_has_full_constraints();
+ }
+
+ static void __init fixup_poodle(struct tag *tags, char **cmdline)
+diff --git a/arch/arm/mach-sa1100/pm.c b/arch/arm/mach-sa1100/pm.c
+index 6645d1e31f14..34853d5dfda2 100644
+--- a/arch/arm/mach-sa1100/pm.c
++++ b/arch/arm/mach-sa1100/pm.c
+@@ -81,6 +81,7 @@ static int sa11x0_pm_enter(suspend_state_t state)
+ /*
+ * Ensure not to come back here if it wasn't intended
+ */
++ RCSR = RCSR_SMR;
+ PSPR = 0;
+
+ /*
+diff --git a/arch/arm/mach-vexpress/Kconfig b/arch/arm/mach-vexpress/Kconfig
+index b2cfba16c4e8..18865136156f 100644
+--- a/arch/arm/mach-vexpress/Kconfig
++++ b/arch/arm/mach-vexpress/Kconfig
+@@ -75,6 +75,7 @@ config ARCH_VEXPRESS_TC2_PM
+ depends on MCPM
+ select ARM_CCI
+ select ARCH_VEXPRESS_SPC
++ select ARM_CPU_SUSPEND
+ help
+ Support for CPU and cluster power management on Versatile Express
+ with a TC2 (A15x2 A7x3) big.LITTLE core tile.
+diff --git a/arch/arm64/kernel/signal32.c b/arch/arm64/kernel/signal32.c
+index 1b9ad02837cf..76920d4040d4 100644
+--- a/arch/arm64/kernel/signal32.c
++++ b/arch/arm64/kernel/signal32.c
+@@ -154,8 +154,7 @@ int copy_siginfo_to_user32(compat_siginfo_t __user *to, const siginfo_t *from)
+ case __SI_TIMER:
+ err |= __put_user(from->si_tid, &to->si_tid);
+ err |= __put_user(from->si_overrun, &to->si_overrun);
+- err |= __put_user((compat_uptr_t)(unsigned long)from->si_ptr,
+- &to->si_ptr);
++ err |= __put_user(from->si_int, &to->si_int);
+ break;
+ case __SI_POLL:
+ err |= __put_user(from->si_band, &to->si_band);
+@@ -184,7 +183,7 @@ int copy_siginfo_to_user32(compat_siginfo_t __user *to, const siginfo_t *from)
+ case __SI_MESGQ: /* But this is */
+ err |= __put_user(from->si_pid, &to->si_pid);
+ err |= __put_user(from->si_uid, &to->si_uid);
+- err |= __put_user((compat_uptr_t)(unsigned long)from->si_ptr, &to->si_ptr);
++ err |= __put_user(from->si_int, &to->si_int);
+ break;
+ default: /* this is just in case for now ... */
+ err |= __put_user(from->si_pid, &to->si_pid);
+diff --git a/arch/metag/include/asm/processor.h b/arch/metag/include/asm/processor.h
+index 881071c07942..13272fd5a5ba 100644
+--- a/arch/metag/include/asm/processor.h
++++ b/arch/metag/include/asm/processor.h
+@@ -149,8 +149,8 @@ extern void exit_thread(void);
+
+ unsigned long get_wchan(struct task_struct *p);
+
+-#define KSTK_EIP(tsk) ((tsk)->thread.kernel_context->CurrPC)
+-#define KSTK_ESP(tsk) ((tsk)->thread.kernel_context->AX[0].U0)
++#define KSTK_EIP(tsk) (task_pt_regs(tsk)->ctx.CurrPC)
++#define KSTK_ESP(tsk) (task_pt_regs(tsk)->ctx.AX[0].U0)
+
+ #define user_stack_pointer(regs) ((regs)->ctx.AX[0].U0)
+
+diff --git a/arch/mips/alchemy/common/clock.c b/arch/mips/alchemy/common/clock.c
+index d7557cde271a..3fff11ec7dc0 100644
+--- a/arch/mips/alchemy/common/clock.c
++++ b/arch/mips/alchemy/common/clock.c
+@@ -128,6 +128,8 @@ static unsigned long alchemy_clk_cpu_recalc(struct clk_hw *hw,
+ t = 396000000;
+ else {
+ t = alchemy_rdsys(AU1000_SYS_CPUPLL) & 0x7f;
++ if (alchemy_get_cputype() < ALCHEMY_CPU_AU1300)
++ t &= 0x3f;
+ t *= parent_rate;
+ }
+
+diff --git a/arch/mips/include/asm/asmmacro.h b/arch/mips/include/asm/asmmacro.h
+index 6caf8766b80f..71fef0af9c9a 100644
+--- a/arch/mips/include/asm/asmmacro.h
++++ b/arch/mips/include/asm/asmmacro.h
+@@ -304,7 +304,7 @@
+ .set push
+ .set noat
+ SET_HARDFLOAT
+- add $1, \base, \off
++ addu $1, \base, \off
+ .word LDD_MSA_INSN | (\wd << 6)
+ .set pop
+ .endm
+@@ -313,7 +313,7 @@
+ .set push
+ .set noat
+ SET_HARDFLOAT
+- add $1, \base, \off
++ addu $1, \base, \off
+ .word STD_MSA_INSN | (\wd << 6)
+ .set pop
+ .endm
+diff --git a/arch/mips/include/asm/cpu-info.h b/arch/mips/include/asm/cpu-info.h
+index a6c9ccb33c5c..c3f4f2d2e108 100644
+--- a/arch/mips/include/asm/cpu-info.h
++++ b/arch/mips/include/asm/cpu-info.h
+@@ -84,6 +84,11 @@ struct cpuinfo_mips {
+ * (shifted by _CACHE_SHIFT)
+ */
+ unsigned int writecombine;
++ /*
++ * Simple counter to prevent enabling HTW in nested
++ * htw_start/htw_stop calls
++ */
++ unsigned int htw_seq;
+ } __attribute__((aligned(SMP_CACHE_BYTES)));
+
+ extern struct cpuinfo_mips cpu_data[];
+diff --git a/arch/mips/include/asm/mmu_context.h b/arch/mips/include/asm/mmu_context.h
+index 2f82568a3ee4..bc01579a907a 100644
+--- a/arch/mips/include/asm/mmu_context.h
++++ b/arch/mips/include/asm/mmu_context.h
+@@ -25,7 +25,6 @@ do { \
+ if (cpu_has_htw) { \
+ write_c0_pwbase(pgd); \
+ back_to_back_c0_hazard(); \
+- htw_reset(); \
+ } \
+ } while (0)
+
+@@ -142,6 +141,7 @@ static inline void switch_mm(struct mm_struct *prev, struct mm_struct *next,
+ unsigned long flags;
+ local_irq_save(flags);
+
++ htw_stop();
+ /* Check if our ASID is of an older version and thus invalid */
+ if ((cpu_context(cpu, next) ^ asid_cache(cpu)) & ASID_VERSION_MASK)
+ get_new_mmu_context(next, cpu);
+@@ -154,6 +154,7 @@ static inline void switch_mm(struct mm_struct *prev, struct mm_struct *next,
+ */
+ cpumask_clear_cpu(cpu, mm_cpumask(prev));
+ cpumask_set_cpu(cpu, mm_cpumask(next));
++ htw_start();
+
+ local_irq_restore(flags);
+ }
+@@ -180,6 +181,7 @@ activate_mm(struct mm_struct *prev, struct mm_struct *next)
+
+ local_irq_save(flags);
+
++ htw_stop();
+ /* Unconditionally get a new ASID. */
+ get_new_mmu_context(next, cpu);
+
+@@ -189,6 +191,7 @@ activate_mm(struct mm_struct *prev, struct mm_struct *next)
+ /* mark mmu ownership change */
+ cpumask_clear_cpu(cpu, mm_cpumask(prev));
+ cpumask_set_cpu(cpu, mm_cpumask(next));
++ htw_start();
+
+ local_irq_restore(flags);
+ }
+@@ -203,6 +206,7 @@ drop_mmu_context(struct mm_struct *mm, unsigned cpu)
+ unsigned long flags;
+
+ local_irq_save(flags);
++ htw_stop();
+
+ if (cpumask_test_cpu(cpu, mm_cpumask(mm))) {
+ get_new_mmu_context(mm, cpu);
+@@ -211,6 +215,7 @@ drop_mmu_context(struct mm_struct *mm, unsigned cpu)
+ /* will get a new context next time */
+ cpu_context(cpu, mm) = 0;
+ }
++ htw_start();
+ local_irq_restore(flags);
+ }
+
+diff --git a/arch/mips/include/asm/pgtable.h b/arch/mips/include/asm/pgtable.h
+index d6d1928539b1..bc3fc4fdc9ab 100644
+--- a/arch/mips/include/asm/pgtable.h
++++ b/arch/mips/include/asm/pgtable.h
+@@ -99,29 +99,35 @@ extern void paging_init(void);
+
+ #define htw_stop() \
+ do { \
+- if (cpu_has_htw) \
+- write_c0_pwctl(read_c0_pwctl() & \
+- ~(1 << MIPS_PWCTL_PWEN_SHIFT)); \
++ unsigned long flags; \
++ \
++ if (cpu_has_htw) { \
++ local_irq_save(flags); \
++ if(!raw_current_cpu_data.htw_seq++) { \
++ write_c0_pwctl(read_c0_pwctl() & \
++ ~(1 << MIPS_PWCTL_PWEN_SHIFT)); \
++ back_to_back_c0_hazard(); \
++ } \
++ local_irq_restore(flags); \
++ } \
+ } while(0)
+
+ #define htw_start() \
+ do { \
+- if (cpu_has_htw) \
+- write_c0_pwctl(read_c0_pwctl() | \
+- (1 << MIPS_PWCTL_PWEN_SHIFT)); \
+-} while(0)
+-
+-
+-#define htw_reset() \
+-do { \
++ unsigned long flags; \
++ \
+ if (cpu_has_htw) { \
+- htw_stop(); \
+- back_to_back_c0_hazard(); \
+- htw_start(); \
+- back_to_back_c0_hazard(); \
++ local_irq_save(flags); \
++ if (!--raw_current_cpu_data.htw_seq) { \
++ write_c0_pwctl(read_c0_pwctl() | \
++ (1 << MIPS_PWCTL_PWEN_SHIFT)); \
++ back_to_back_c0_hazard(); \
++ } \
++ local_irq_restore(flags); \
+ } \
+ } while(0)
+
++
+ extern void set_pte_at(struct mm_struct *mm, unsigned long addr, pte_t *ptep,
+ pte_t pteval);
+
+@@ -153,12 +159,13 @@ static inline void pte_clear(struct mm_struct *mm, unsigned long addr, pte_t *pt
+ {
+ pte_t null = __pte(0);
+
++ htw_stop();
+ /* Preserve global status for the pair */
+ if (ptep_buddy(ptep)->pte_low & _PAGE_GLOBAL)
+ null.pte_low = null.pte_high = _PAGE_GLOBAL;
+
+ set_pte_at(mm, addr, ptep, null);
+- htw_reset();
++ htw_start();
+ }
+ #else
+
+@@ -188,6 +195,7 @@ static inline void set_pte(pte_t *ptep, pte_t pteval)
+
+ static inline void pte_clear(struct mm_struct *mm, unsigned long addr, pte_t *ptep)
+ {
++ htw_stop();
+ #if !defined(CONFIG_CPU_R3000) && !defined(CONFIG_CPU_TX39XX)
+ /* Preserve global status for the pair */
+ if (pte_val(*ptep_buddy(ptep)) & _PAGE_GLOBAL)
+@@ -195,7 +203,7 @@ static inline void pte_clear(struct mm_struct *mm, unsigned long addr, pte_t *pt
+ else
+ #endif
+ set_pte_at(mm, addr, ptep, __pte(0));
+- htw_reset();
++ htw_start();
+ }
+ #endif
+
+diff --git a/arch/mips/kernel/cps-vec.S b/arch/mips/kernel/cps-vec.S
+index 0384b05ab5a0..55b759a0019e 100644
+--- a/arch/mips/kernel/cps-vec.S
++++ b/arch/mips/kernel/cps-vec.S
+@@ -99,11 +99,11 @@ not_nmi:
+ xori t2, t1, 0x7
+ beqz t2, 1f
+ li t3, 32
+- addi t1, t1, 1
++ addiu t1, t1, 1
+ sllv t1, t3, t1
+ 1: /* At this point t1 == I-cache sets per way */
+ _EXT t2, v0, MIPS_CONF1_IA_SHF, MIPS_CONF1_IA_SZ
+- addi t2, t2, 1
++ addiu t2, t2, 1
+ mul t1, t1, t0
+ mul t1, t1, t2
+
+@@ -126,11 +126,11 @@ icache_done:
+ xori t2, t1, 0x7
+ beqz t2, 1f
+ li t3, 32
+- addi t1, t1, 1
++ addiu t1, t1, 1
+ sllv t1, t3, t1
+ 1: /* At this point t1 == D-cache sets per way */
+ _EXT t2, v0, MIPS_CONF1_DA_SHF, MIPS_CONF1_DA_SZ
+- addi t2, t2, 1
++ addiu t2, t2, 1
+ mul t1, t1, t0
+ mul t1, t1, t2
+
+@@ -250,7 +250,7 @@ LEAF(mips_cps_core_init)
+ mfc0 t0, CP0_MVPCONF0
+ srl t0, t0, MVPCONF0_PVPE_SHIFT
+ andi t0, t0, (MVPCONF0_PVPE >> MVPCONF0_PVPE_SHIFT)
+- addi t7, t0, 1
++ addiu t7, t0, 1
+
+ /* If there's only 1, we're done */
+ beqz t0, 2f
+@@ -280,7 +280,7 @@ LEAF(mips_cps_core_init)
+ mttc0 t0, CP0_TCHALT
+
+ /* Next VPE */
+- addi t5, t5, 1
++ addiu t5, t5, 1
+ slt t0, t5, t7
+ bnez t0, 1b
+ nop
+@@ -317,7 +317,7 @@ LEAF(mips_cps_boot_vpes)
+ mfc0 t1, CP0_MVPCONF0
+ srl t1, t1, MVPCONF0_PVPE_SHIFT
+ andi t1, t1, MVPCONF0_PVPE >> MVPCONF0_PVPE_SHIFT
+- addi t1, t1, 1
++ addiu t1, t1, 1
+
+ /* Calculate a mask for the VPE ID from EBase.CPUNum */
+ clz t1, t1
+@@ -424,7 +424,7 @@ LEAF(mips_cps_boot_vpes)
+
+ /* Next VPE */
+ 2: srl t6, t6, 1
+- addi t5, t5, 1
++ addiu t5, t5, 1
+ bnez t6, 1b
+ nop
+
+diff --git a/arch/mips/kernel/cpu-probe.c b/arch/mips/kernel/cpu-probe.c
+index dc49cf30c2db..5d6e59f20750 100644
+--- a/arch/mips/kernel/cpu-probe.c
++++ b/arch/mips/kernel/cpu-probe.c
+@@ -367,8 +367,10 @@ static inline unsigned int decode_config3(struct cpuinfo_mips *c)
+ if (config3 & MIPS_CONF3_MSA)
+ c->ases |= MIPS_ASE_MSA;
+ /* Only tested on 32-bit cores */
+- if ((config3 & MIPS_CONF3_PW) && config_enabled(CONFIG_32BIT))
++ if ((config3 & MIPS_CONF3_PW) && config_enabled(CONFIG_32BIT)) {
++ c->htw_seq = 0;
+ c->options |= MIPS_CPU_HTW;
++ }
+
+ return config3 & MIPS_CONF_M;
+ }
+diff --git a/arch/mips/kernel/mips_ksyms.c b/arch/mips/kernel/mips_ksyms.c
+index 2607c3a4ff7e..1b2452e2be67 100644
+--- a/arch/mips/kernel/mips_ksyms.c
++++ b/arch/mips/kernel/mips_ksyms.c
+@@ -14,6 +14,8 @@
+ #include <linux/mm.h>
+ #include <asm/uaccess.h>
+ #include <asm/ftrace.h>
++#include <asm/fpu.h>
++#include <asm/msa.h>
+
+ extern void *__bzero(void *__s, size_t __count);
+ extern long __strncpy_from_kernel_nocheck_asm(char *__to,
+@@ -34,6 +36,14 @@ extern long __strnlen_user_nocheck_asm(const char *s);
+ extern long __strnlen_user_asm(const char *s);
+
+ /*
++ * Core architecture code
++ */
++EXPORT_SYMBOL_GPL(_save_fp);
++#ifdef CONFIG_CPU_HAS_MSA
++EXPORT_SYMBOL_GPL(_save_msa);
++#endif
++
++/*
+ * String functions
+ */
+ EXPORT_SYMBOL(memset);
+diff --git a/arch/mips/kvm/locore.S b/arch/mips/kvm/locore.S
+index d7279c03c517..4a68b176d6e4 100644
+--- a/arch/mips/kvm/locore.S
++++ b/arch/mips/kvm/locore.S
+@@ -434,7 +434,7 @@ __kvm_mips_return_to_guest:
+ /* Setup status register for running guest in UM */
+ .set at
+ or v1, v1, (ST0_EXL | KSU_USER | ST0_IE)
+- and v1, v1, ~ST0_CU0
++ and v1, v1, ~(ST0_CU0 | ST0_MX)
+ .set noat
+ mtc0 v1, CP0_STATUS
+ ehb
+diff --git a/arch/mips/kvm/mips.c b/arch/mips/kvm/mips.c
+index e3b21e51ff7e..270bbd41769e 100644
+--- a/arch/mips/kvm/mips.c
++++ b/arch/mips/kvm/mips.c
+@@ -15,9 +15,11 @@
+ #include <linux/vmalloc.h>
+ #include <linux/fs.h>
+ #include <linux/bootmem.h>
++#include <asm/fpu.h>
+ #include <asm/page.h>
+ #include <asm/cacheflush.h>
+ #include <asm/mmu_context.h>
++#include <asm/pgtable.h>
+
+ #include <linux/kvm_host.h>
+
+@@ -378,6 +380,8 @@ int kvm_arch_vcpu_ioctl_run(struct kvm_vcpu *vcpu, struct kvm_run *run)
+ vcpu->mmio_needed = 0;
+ }
+
++ lose_fpu(1);
++
+ local_irq_disable();
+ /* Check if we have any exceptions/interrupts pending */
+ kvm_mips_deliver_interrupts(vcpu,
+@@ -385,8 +389,14 @@ int kvm_arch_vcpu_ioctl_run(struct kvm_vcpu *vcpu, struct kvm_run *run)
+
+ kvm_guest_enter();
+
++ /* Disable hardware page table walking while in guest */
++ htw_stop();
++
+ r = __kvm_mips_vcpu_run(run, vcpu);
+
++ /* Re-enable HTW before enabling interrupts */
++ htw_start();
++
+ kvm_guest_exit();
+ local_irq_enable();
+
+@@ -980,9 +990,6 @@ static void kvm_mips_set_c0_status(void)
+ {
+ uint32_t status = read_c0_status();
+
+- if (cpu_has_fpu)
+- status |= (ST0_CU1);
+-
+ if (cpu_has_dsp)
+ status |= (ST0_MX);
+
+@@ -1002,6 +1009,9 @@ int kvm_mips_handle_exit(struct kvm_run *run, struct kvm_vcpu *vcpu)
+ enum emulation_result er = EMULATE_DONE;
+ int ret = RESUME_GUEST;
+
++ /* re-enable HTW before enabling interrupts */
++ htw_start();
++
+ /* Set a default exit reason */
+ run->exit_reason = KVM_EXIT_UNKNOWN;
+ run->ready_for_interrupt_injection = 1;
+@@ -1136,6 +1146,9 @@ skip_emul:
+ }
+ }
+
++ /* Disable HTW before returning to guest or host */
++ htw_stop();
++
+ return ret;
+ }
+
+diff --git a/arch/powerpc/sysdev/axonram.c b/arch/powerpc/sysdev/axonram.c
+index ad56edc39919..e8bb33b2d3cc 100644
+--- a/arch/powerpc/sysdev/axonram.c
++++ b/arch/powerpc/sysdev/axonram.c
+@@ -156,7 +156,7 @@ axon_ram_direct_access(struct block_device *device, sector_t sector,
+ }
+
+ *kaddr = (void *)(bank->ph_addr + offset);
+- *pfn = virt_to_phys(kaddr) >> PAGE_SHIFT;
++ *pfn = virt_to_phys(*kaddr) >> PAGE_SHIFT;
+
+ return 0;
+ }
+diff --git a/arch/s390/kvm/interrupt.c b/arch/s390/kvm/interrupt.c
+index 4fc3fed636dc..29e2e5aa2111 100644
+--- a/arch/s390/kvm/interrupt.c
++++ b/arch/s390/kvm/interrupt.c
+@@ -613,7 +613,7 @@ no_timer:
+ __unset_cpu_idle(vcpu);
+ vcpu->srcu_idx = srcu_read_lock(&vcpu->kvm->srcu);
+
+- hrtimer_try_to_cancel(&vcpu->arch.ckc_timer);
++ hrtimer_cancel(&vcpu->arch.ckc_timer);
+ return 0;
+ }
+
+@@ -633,10 +633,20 @@ void kvm_s390_vcpu_wakeup(struct kvm_vcpu *vcpu)
+ enum hrtimer_restart kvm_s390_idle_wakeup(struct hrtimer *timer)
+ {
+ struct kvm_vcpu *vcpu;
++ u64 now, sltime;
+
+ vcpu = container_of(timer, struct kvm_vcpu, arch.ckc_timer);
+- kvm_s390_vcpu_wakeup(vcpu);
++ now = get_tod_clock_fast() + vcpu->arch.sie_block->epoch;
++ sltime = tod_to_ns(vcpu->arch.sie_block->ckc - now);
+
++ /*
++ * If the monotonic clock runs faster than the tod clock we might be
++ * woken up too early and have to go back to sleep to avoid deadlocks.
++ */
++ if (vcpu->arch.sie_block->ckc > now &&
++ hrtimer_forward_now(timer, ns_to_ktime(sltime)))
++ return HRTIMER_RESTART;
++ kvm_s390_vcpu_wakeup(vcpu);
+ return HRTIMER_NORESTART;
+ }
+
+@@ -840,6 +850,8 @@ static int __inject_vm(struct kvm *kvm, struct kvm_s390_interrupt_info *inti)
+ list_add_tail(&inti->list, &iter->list);
+ }
+ atomic_set(&fi->active, 1);
++ if (atomic_read(&kvm->online_vcpus) == 0)
++ goto unlock_fi;
+ sigcpu = find_first_bit(fi->idle_mask, KVM_MAX_VCPUS);
+ if (sigcpu == KVM_MAX_VCPUS) {
+ do {
+@@ -864,6 +876,7 @@ int kvm_s390_inject_vm(struct kvm *kvm,
+ struct kvm_s390_interrupt *s390int)
+ {
+ struct kvm_s390_interrupt_info *inti;
++ int rc;
+
+ inti = kzalloc(sizeof(*inti), GFP_KERNEL);
+ if (!inti)
+@@ -911,7 +924,10 @@ int kvm_s390_inject_vm(struct kvm *kvm,
+ trace_kvm_s390_inject_vm(s390int->type, s390int->parm, s390int->parm64,
+ 2);
+
+- return __inject_vm(kvm, inti);
++ rc = __inject_vm(kvm, inti);
++ if (rc)
++ kfree(inti);
++ return rc;
+ }
+
+ void kvm_s390_reinject_io_int(struct kvm *kvm,
+diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c
+index 55aade49b6d1..ced09d8738b4 100644
+--- a/arch/s390/kvm/kvm-s390.c
++++ b/arch/s390/kvm/kvm-s390.c
+@@ -662,7 +662,7 @@ int kvm_arch_vcpu_setup(struct kvm_vcpu *vcpu)
+ if (rc)
+ return rc;
+ }
+- hrtimer_init(&vcpu->arch.ckc_timer, CLOCK_REALTIME, HRTIMER_MODE_ABS);
++ hrtimer_init(&vcpu->arch.ckc_timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
+ vcpu->arch.ckc_timer.function = kvm_s390_idle_wakeup;
+ get_cpu_id(&vcpu->arch.cpu_id);
+ vcpu->arch.cpu_id.version = 0xff;
+diff --git a/arch/x86/boot/compressed/Makefile b/arch/x86/boot/compressed/Makefile
+index 6a1a8458c042..30c0acf4ea6c 100644
+--- a/arch/x86/boot/compressed/Makefile
++++ b/arch/x86/boot/compressed/Makefile
+@@ -36,6 +36,7 @@ vmlinux-objs-$(CONFIG_RANDOMIZE_BASE) += $(obj)/aslr.o
+ $(obj)/eboot.o: KBUILD_CFLAGS += -fshort-wchar -mno-red-zone
+
+ vmlinux-objs-$(CONFIG_EFI_STUB) += $(obj)/eboot.o $(obj)/efi_stub_$(BITS).o
++vmlinux-objs-$(CONFIG_EFI_MIXED) += $(obj)/efi_thunk_$(BITS).o
+
+ $(obj)/vmlinux: $(vmlinux-objs-y) FORCE
+ $(call if_changed,ld)
+diff --git a/arch/x86/boot/compressed/efi_stub_64.S b/arch/x86/boot/compressed/efi_stub_64.S
+index 7ff3632806b1..99494dff2113 100644
+--- a/arch/x86/boot/compressed/efi_stub_64.S
++++ b/arch/x86/boot/compressed/efi_stub_64.S
+@@ -3,28 +3,3 @@
+ #include <asm/processor-flags.h>
+
+ #include "../../platform/efi/efi_stub_64.S"
+-
+-#ifdef CONFIG_EFI_MIXED
+- .code64
+- .text
+-ENTRY(efi64_thunk)
+- push %rbp
+- push %rbx
+-
+- subq $16, %rsp
+- leaq efi_exit32(%rip), %rax
+- movl %eax, 8(%rsp)
+- leaq efi_gdt64(%rip), %rax
+- movl %eax, 4(%rsp)
+- movl %eax, 2(%rax) /* Fixup the gdt base address */
+- leaq efi32_boot_gdt(%rip), %rax
+- movl %eax, (%rsp)
+-
+- call __efi64_thunk
+-
+- addq $16, %rsp
+- pop %rbx
+- pop %rbp
+- ret
+-ENDPROC(efi64_thunk)
+-#endif /* CONFIG_EFI_MIXED */
+diff --git a/arch/x86/boot/compressed/efi_thunk_64.S b/arch/x86/boot/compressed/efi_thunk_64.S
+new file mode 100644
+index 000000000000..630384a4c14a
+--- /dev/null
++++ b/arch/x86/boot/compressed/efi_thunk_64.S
+@@ -0,0 +1,196 @@
++/*
++ * Copyright (C) 2014, 2015 Intel Corporation; author Matt Fleming
++ *
++ * Early support for invoking 32-bit EFI services from a 64-bit kernel.
++ *
++ * Because this thunking occurs before ExitBootServices() we have to
++ * restore the firmware's 32-bit GDT before we make EFI serivce calls,
++ * since the firmware's 32-bit IDT is still currently installed and it
++ * needs to be able to service interrupts.
++ *
++ * On the plus side, we don't have to worry about mangling 64-bit
++ * addresses into 32-bits because we're executing with an identify
++ * mapped pagetable and haven't transitioned to 64-bit virtual addresses
++ * yet.
++ */
++
++#include <linux/linkage.h>
++#include <asm/msr.h>
++#include <asm/page_types.h>
++#include <asm/processor-flags.h>
++#include <asm/segment.h>
++
++ .code64
++ .text
++ENTRY(efi64_thunk)
++ push %rbp
++ push %rbx
++
++ subq $8, %rsp
++ leaq efi_exit32(%rip), %rax
++ movl %eax, 4(%rsp)
++ leaq efi_gdt64(%rip), %rax
++ movl %eax, (%rsp)
++ movl %eax, 2(%rax) /* Fixup the gdt base address */
++
++ movl %ds, %eax
++ push %rax
++ movl %es, %eax
++ push %rax
++ movl %ss, %eax
++ push %rax
++
++ /*
++ * Convert x86-64 ABI params to i386 ABI
++ */
++ subq $32, %rsp
++ movl %esi, 0x0(%rsp)
++ movl %edx, 0x4(%rsp)
++ movl %ecx, 0x8(%rsp)
++ movq %r8, %rsi
++ movl %esi, 0xc(%rsp)
++ movq %r9, %rsi
++ movl %esi, 0x10(%rsp)
++
++ sgdt save_gdt(%rip)
++
++ leaq 1f(%rip), %rbx
++ movq %rbx, func_rt_ptr(%rip)
++
++ /*
++ * Switch to gdt with 32-bit segments. This is the firmware GDT
++ * that was installed when the kernel started executing. This
++ * pointer was saved at the EFI stub entry point in head_64.S.
++ */
++ leaq efi32_boot_gdt(%rip), %rax
++ lgdt (%rax)
++
++ pushq $__KERNEL_CS
++ leaq efi_enter32(%rip), %rax
++ pushq %rax
++ lretq
++
++1: addq $32, %rsp
++
++ lgdt save_gdt(%rip)
++
++ pop %rbx
++ movl %ebx, %ss
++ pop %rbx
++ movl %ebx, %es
++ pop %rbx
++ movl %ebx, %ds
++
++ /*
++ * Convert 32-bit status code into 64-bit.
++ */
++ test %rax, %rax
++ jz 1f
++ movl %eax, %ecx
++ andl $0x0fffffff, %ecx
++ andl $0xf0000000, %eax
++ shl $32, %rax
++ or %rcx, %rax
++1:
++ addq $8, %rsp
++ pop %rbx
++ pop %rbp
++ ret
++ENDPROC(efi64_thunk)
++
++ENTRY(efi_exit32)
++ movq func_rt_ptr(%rip), %rax
++ push %rax
++ mov %rdi, %rax
++ ret
++ENDPROC(efi_exit32)
++
++ .code32
++/*
++ * EFI service pointer must be in %edi.
++ *
++ * The stack should represent the 32-bit calling convention.
++ */
++ENTRY(efi_enter32)
++ movl $__KERNEL_DS, %eax
++ movl %eax, %ds
++ movl %eax, %es
++ movl %eax, %ss
++
++ /* Reload pgtables */
++ movl %cr3, %eax
++ movl %eax, %cr3
++
++ /* Disable paging */
++ movl %cr0, %eax
++ btrl $X86_CR0_PG_BIT, %eax
++ movl %eax, %cr0
++
++ /* Disable long mode via EFER */
++ movl $MSR_EFER, %ecx
++ rdmsr
++ btrl $_EFER_LME, %eax
++ wrmsr
++
++ call *%edi
++
++ /* We must preserve return value */
++ movl %eax, %edi
++
++ /*
++ * Some firmware will return with interrupts enabled. Be sure to
++ * disable them before we switch GDTs.
++ */
++ cli
++
++ movl 56(%esp), %eax
++ movl %eax, 2(%eax)
++ lgdtl (%eax)
++
++ movl %cr4, %eax
++ btsl $(X86_CR4_PAE_BIT), %eax
++ movl %eax, %cr4
++
++ movl %cr3, %eax
++ movl %eax, %cr3
++
++ movl $MSR_EFER, %ecx
++ rdmsr
++ btsl $_EFER_LME, %eax
++ wrmsr
++
++ xorl %eax, %eax
++ lldt %ax
++
++ movl 60(%esp), %eax
++ pushl $__KERNEL_CS
++ pushl %eax
++
++ /* Enable paging */
++ movl %cr0, %eax
++ btsl $X86_CR0_PG_BIT, %eax
++ movl %eax, %cr0
++ lret
++ENDPROC(efi_enter32)
++
++ .data
++ .balign 8
++ .global efi32_boot_gdt
++efi32_boot_gdt: .word 0
++ .quad 0
++
++save_gdt: .word 0
++ .quad 0
++func_rt_ptr: .quad 0
++
++ .global efi_gdt64
++efi_gdt64:
++ .word efi_gdt64_end - efi_gdt64
++ .long 0 /* Filled out by user */
++ .word 0
++ .quad 0x0000000000000000 /* NULL descriptor */
++ .quad 0x00af9a000000ffff /* __KERNEL_CS */
++ .quad 0x00cf92000000ffff /* __KERNEL_DS */
++ .quad 0x0080890000000000 /* TS descriptor */
++ .quad 0x0000000000000000 /* TS continued */
++efi_gdt64_end:
+diff --git a/arch/x86/kernel/acpi/boot.c b/arch/x86/kernel/acpi/boot.c
+index a142e77693e1..a3eadfdc3e04 100644
+--- a/arch/x86/kernel/acpi/boot.c
++++ b/arch/x86/kernel/acpi/boot.c
+@@ -604,18 +604,24 @@ void __init acpi_pic_sci_set_trigger(unsigned int irq, u16 trigger)
+
+ int acpi_gsi_to_irq(u32 gsi, unsigned int *irqp)
+ {
+- int irq;
++ int rc, irq, trigger, polarity;
+
+ if (acpi_irq_model == ACPI_IRQ_MODEL_PIC) {
+ *irqp = gsi;
+- } else {
+- irq = mp_map_gsi_to_irq(gsi,
+- IOAPIC_MAP_ALLOC | IOAPIC_MAP_CHECK);
+- if (irq < 0)
+- return -1;
+- *irqp = irq;
++ return 0;
+ }
+- return 0;
++
++ rc = acpi_get_override_irq(gsi, &trigger, &polarity);
++ if (rc == 0) {
++ trigger = trigger ? ACPI_LEVEL_SENSITIVE : ACPI_EDGE_SENSITIVE;
++ polarity = polarity ? ACPI_ACTIVE_LOW : ACPI_ACTIVE_HIGH;
++ irq = acpi_register_gsi(NULL, gsi, trigger, polarity);
++ if (irq >= 0) {
++ *irqp = irq;
++ return 0;
++ }
++ }
++ return -1;
+ }
+ EXPORT_SYMBOL_GPL(acpi_gsi_to_irq);
+
+diff --git a/arch/x86/kernel/pmc_atom.c b/arch/x86/kernel/pmc_atom.c
+index 0ee5025e0fa4..8bb9a611ca23 100644
+--- a/arch/x86/kernel/pmc_atom.c
++++ b/arch/x86/kernel/pmc_atom.c
+@@ -217,6 +217,8 @@ static int pmc_dbgfs_register(struct pmc_dev *pmc, struct pci_dev *pdev)
+ if (!dir)
+ return -ENOMEM;
+
++ pmc->dbgfs_dir = dir;
++
+ f = debugfs_create_file("dev_state", S_IFREG | S_IRUGO,
+ dir, pmc, &pmc_dev_state_ops);
+ if (!f) {
+@@ -229,7 +231,7 @@ static int pmc_dbgfs_register(struct pmc_dev *pmc, struct pci_dev *pdev)
+ dev_err(&pdev->dev, "sleep_state register failed\n");
+ goto err;
+ }
+- pmc->dbgfs_dir = dir;
++
+ return 0;
+ err:
+ pmc_dbgfs_unregister(pmc);
+diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
+index 506488cfa385..8b92cf4b165a 100644
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -1237,21 +1237,22 @@ void kvm_track_tsc_matching(struct kvm_vcpu *vcpu)
+ {
+ #ifdef CONFIG_X86_64
+ bool vcpus_matched;
+- bool do_request = false;
+ struct kvm_arch *ka = &vcpu->kvm->arch;
+ struct pvclock_gtod_data *gtod = &pvclock_gtod_data;
+
+ vcpus_matched = (ka->nr_vcpus_matched_tsc + 1 ==
+ atomic_read(&vcpu->kvm->online_vcpus));
+
+- if (vcpus_matched && gtod->clock.vclock_mode == VCLOCK_TSC)
+- if (!ka->use_master_clock)
+- do_request = 1;
+-
+- if (!vcpus_matched && ka->use_master_clock)
+- do_request = 1;
+-
+- if (do_request)
++ /*
++ * Once the masterclock is enabled, always perform request in
++ * order to update it.
++ *
++ * In order to enable masterclock, the host clocksource must be TSC
++ * and the vcpus need to have matched TSCs. When that happens,
++ * perform request to enable masterclock.
++ */
++ if (ka->use_master_clock ||
++ (gtod->clock.vclock_mode == VCLOCK_TSC && vcpus_matched))
+ kvm_make_request(KVM_REQ_MASTERCLOCK_UPDATE, vcpu);
+
+ trace_kvm_track_tsc(vcpu->vcpu_id, ka->nr_vcpus_matched_tsc,
+diff --git a/arch/x86/mm/gup.c b/arch/x86/mm/gup.c
+index 207d9aef662d..448ee8912d9b 100644
+--- a/arch/x86/mm/gup.c
++++ b/arch/x86/mm/gup.c
+@@ -172,7 +172,7 @@ static int gup_pmd_range(pud_t pud, unsigned long addr, unsigned long end,
+ */
+ if (pmd_none(pmd) || pmd_trans_splitting(pmd))
+ return 0;
+- if (unlikely(pmd_large(pmd))) {
++ if (unlikely(pmd_large(pmd) || !pmd_present(pmd))) {
+ /*
+ * NUMA hinting faults need to be handled in the GUP
+ * slowpath for accounting purposes and so that they
+diff --git a/arch/x86/mm/hugetlbpage.c b/arch/x86/mm/hugetlbpage.c
+index 8b977ebf9388..006cc914994b 100644
+--- a/arch/x86/mm/hugetlbpage.c
++++ b/arch/x86/mm/hugetlbpage.c
+@@ -66,9 +66,15 @@ follow_huge_addr(struct mm_struct *mm, unsigned long address, int write)
+ return ERR_PTR(-EINVAL);
+ }
+
++/*
++ * pmd_huge() returns 1 if @pmd is hugetlb related entry, that is normal
++ * hugetlb entry or non-present (migration or hwpoisoned) hugetlb entry.
++ * Otherwise, returns 0.
++ */
+ int pmd_huge(pmd_t pmd)
+ {
+- return !!(pmd_val(pmd) & _PAGE_PSE);
++ return !pmd_none(pmd) &&
++ (pmd_val(pmd) & (_PAGE_PRESENT|_PAGE_PSE)) != _PAGE_PRESENT;
+ }
+
+ int pud_huge(pud_t pud)
+diff --git a/arch/x86/mm/mmap.c b/arch/x86/mm/mmap.c
+index 919b91205cd4..df4552bd239e 100644
+--- a/arch/x86/mm/mmap.c
++++ b/arch/x86/mm/mmap.c
+@@ -35,12 +35,12 @@ struct va_alignment __read_mostly va_align = {
+ .flags = -1,
+ };
+
+-static unsigned int stack_maxrandom_size(void)
++static unsigned long stack_maxrandom_size(void)
+ {
+- unsigned int max = 0;
++ unsigned long max = 0;
+ if ((current->flags & PF_RANDOMIZE) &&
+ !(current->personality & ADDR_NO_RANDOMIZE)) {
+- max = ((-1U) & STACK_RND_MASK) << PAGE_SHIFT;
++ max = ((-1UL) & STACK_RND_MASK) << PAGE_SHIFT;
+ }
+
+ return max;
+diff --git a/arch/x86/pci/xen.c b/arch/x86/pci/xen.c
+index 093f5f4272d3..6b3cf7c4e5c2 100644
+--- a/arch/x86/pci/xen.c
++++ b/arch/x86/pci/xen.c
+@@ -452,52 +452,6 @@ int __init pci_xen_hvm_init(void)
+ }
+
+ #ifdef CONFIG_XEN_DOM0
+-static __init void xen_setup_acpi_sci(void)
+-{
+- int rc;
+- int trigger, polarity;
+- int gsi = acpi_sci_override_gsi;
+- int irq = -1;
+- int gsi_override = -1;
+-
+- if (!gsi)
+- return;
+-
+- rc = acpi_get_override_irq(gsi, &trigger, &polarity);
+- if (rc) {
+- printk(KERN_WARNING "xen: acpi_get_override_irq failed for acpi"
+- " sci, rc=%d\n", rc);
+- return;
+- }
+- trigger = trigger ? ACPI_LEVEL_SENSITIVE : ACPI_EDGE_SENSITIVE;
+- polarity = polarity ? ACPI_ACTIVE_LOW : ACPI_ACTIVE_HIGH;
+-
+- printk(KERN_INFO "xen: sci override: global_irq=%d trigger=%d "
+- "polarity=%d\n", gsi, trigger, polarity);
+-
+- /* Before we bind the GSI to a Linux IRQ, check whether
+- * we need to override it with bus_irq (IRQ) value. Usually for
+- * IRQs below IRQ_LEGACY_IRQ this holds IRQ == GSI, as so:
+- * ACPI: INT_SRC_OVR (bus 0 bus_irq 9 global_irq 9 low level)
+- * but there are oddballs where the IRQ != GSI:
+- * ACPI: INT_SRC_OVR (bus 0 bus_irq 9 global_irq 20 low level)
+- * which ends up being: gsi_to_irq[9] == 20
+- * (which is what acpi_gsi_to_irq ends up calling when starting the
+- * the ACPI interpreter and keels over since IRQ 9 has not been
+- * setup as we had setup IRQ 20 for it).
+- */
+- if (acpi_gsi_to_irq(gsi, &irq) == 0) {
+- /* Use the provided value if it's valid. */
+- if (irq >= 0)
+- gsi_override = irq;
+- }
+-
+- gsi = xen_register_gsi(gsi, gsi_override, trigger, polarity);
+- printk(KERN_INFO "xen: acpi sci %d\n", gsi);
+-
+- return;
+-}
+-
+ int __init pci_xen_initial_domain(void)
+ {
+ int irq;
+@@ -509,7 +463,6 @@ int __init pci_xen_initial_domain(void)
+ x86_msi.msi_mask_irq = xen_nop_msi_mask_irq;
+ x86_msi.msix_mask_irq = xen_nop_msix_mask_irq;
+ #endif
+- xen_setup_acpi_sci();
+ __acpi_register_gsi = acpi_register_gsi_xen;
+ /* Pre-allocate legacy irqs */
+ for (irq = 0; irq < nr_legacy_irqs(); irq++) {
+diff --git a/arch/x86/platform/efi/efi_stub_64.S b/arch/x86/platform/efi/efi_stub_64.S
+index 5fcda7272550..86d0f9e08dd9 100644
+--- a/arch/x86/platform/efi/efi_stub_64.S
++++ b/arch/x86/platform/efi/efi_stub_64.S
+@@ -91,167 +91,6 @@ ENTRY(efi_call)
+ ret
+ ENDPROC(efi_call)
+
+-#ifdef CONFIG_EFI_MIXED
+-
+-/*
+- * We run this function from the 1:1 mapping.
+- *
+- * This function must be invoked with a 1:1 mapped stack.
+- */
+-ENTRY(__efi64_thunk)
+- movl %ds, %eax
+- push %rax
+- movl %es, %eax
+- push %rax
+- movl %ss, %eax
+- push %rax
+-
+- subq $32, %rsp
+- movl %esi, 0x0(%rsp)
+- movl %edx, 0x4(%rsp)
+- movl %ecx, 0x8(%rsp)
+- movq %r8, %rsi
+- movl %esi, 0xc(%rsp)
+- movq %r9, %rsi
+- movl %esi, 0x10(%rsp)
+-
+- sgdt save_gdt(%rip)
+-
+- leaq 1f(%rip), %rbx
+- movq %rbx, func_rt_ptr(%rip)
+-
+- /* Switch to gdt with 32-bit segments */
+- movl 64(%rsp), %eax
+- lgdt (%rax)
+-
+- leaq efi_enter32(%rip), %rax
+- pushq $__KERNEL_CS
+- pushq %rax
+- lretq
+-
+-1: addq $32, %rsp
+-
+- lgdt save_gdt(%rip)
+-
+- pop %rbx
+- movl %ebx, %ss
+- pop %rbx
+- movl %ebx, %es
+- pop %rbx
+- movl %ebx, %ds
+-
+- /*
+- * Convert 32-bit status code into 64-bit.
+- */
+- test %rax, %rax
+- jz 1f
+- movl %eax, %ecx
+- andl $0x0fffffff, %ecx
+- andl $0xf0000000, %eax
+- shl $32, %rax
+- or %rcx, %rax
+-1:
+- ret
+-ENDPROC(__efi64_thunk)
+-
+-ENTRY(efi_exit32)
+- movq func_rt_ptr(%rip), %rax
+- push %rax
+- mov %rdi, %rax
+- ret
+-ENDPROC(efi_exit32)
+-
+- .code32
+-/*
+- * EFI service pointer must be in %edi.
+- *
+- * The stack should represent the 32-bit calling convention.
+- */
+-ENTRY(efi_enter32)
+- movl $__KERNEL_DS, %eax
+- movl %eax, %ds
+- movl %eax, %es
+- movl %eax, %ss
+-
+- /* Reload pgtables */
+- movl %cr3, %eax
+- movl %eax, %cr3
+-
+- /* Disable paging */
+- movl %cr0, %eax
+- btrl $X86_CR0_PG_BIT, %eax
+- movl %eax, %cr0
+-
+- /* Disable long mode via EFER */
+- movl $MSR_EFER, %ecx
+- rdmsr
+- btrl $_EFER_LME, %eax
+- wrmsr
+-
+- call *%edi
+-
+- /* We must preserve return value */
+- movl %eax, %edi
+-
+- /*
+- * Some firmware will return with interrupts enabled. Be sure to
+- * disable them before we switch GDTs.
+- */
+- cli
+-
+- movl 68(%esp), %eax
+- movl %eax, 2(%eax)
+- lgdtl (%eax)
+-
+- movl %cr4, %eax
+- btsl $(X86_CR4_PAE_BIT), %eax
+- movl %eax, %cr4
+-
+- movl %cr3, %eax
+- movl %eax, %cr3
+-
+- movl $MSR_EFER, %ecx
+- rdmsr
+- btsl $_EFER_LME, %eax
+- wrmsr
+-
+- xorl %eax, %eax
+- lldt %ax
+-
+- movl 72(%esp), %eax
+- pushl $__KERNEL_CS
+- pushl %eax
+-
+- /* Enable paging */
+- movl %cr0, %eax
+- btsl $X86_CR0_PG_BIT, %eax
+- movl %eax, %cr0
+- lret
+-ENDPROC(efi_enter32)
+-
+- .data
+- .balign 8
+- .global efi32_boot_gdt
+-efi32_boot_gdt: .word 0
+- .quad 0
+-
+-save_gdt: .word 0
+- .quad 0
+-func_rt_ptr: .quad 0
+-
+- .global efi_gdt64
+-efi_gdt64:
+- .word efi_gdt64_end - efi_gdt64
+- .long 0 /* Filled out by user */
+- .word 0
+- .quad 0x0000000000000000 /* NULL descriptor */
+- .quad 0x00af9a000000ffff /* __KERNEL_CS */
+- .quad 0x00cf92000000ffff /* __KERNEL_DS */
+- .quad 0x0080890000000000 /* TS descriptor */
+- .quad 0x0000000000000000 /* TS continued */
+-efi_gdt64_end:
+-#endif /* CONFIG_EFI_MIXED */
+-
+ .data
+ ENTRY(efi_scratch)
+ .fill 3,8,0
+diff --git a/arch/x86/platform/efi/efi_thunk_64.S b/arch/x86/platform/efi/efi_thunk_64.S
+index 8806fa73e6e6..ff85d28c50f2 100644
+--- a/arch/x86/platform/efi/efi_thunk_64.S
++++ b/arch/x86/platform/efi/efi_thunk_64.S
+@@ -1,9 +1,26 @@
+ /*
+ * Copyright (C) 2014 Intel Corporation; author Matt Fleming
++ *
++ * Support for invoking 32-bit EFI runtime services from a 64-bit
++ * kernel.
++ *
++ * The below thunking functions are only used after ExitBootServices()
++ * has been called. This simplifies things considerably as compared with
++ * the early EFI thunking because we can leave all the kernel state
++ * intact (GDT, IDT, etc) and simply invoke the the 32-bit EFI runtime
++ * services from __KERNEL32_CS. This means we can continue to service
++ * interrupts across an EFI mixed mode call.
++ *
++ * We do however, need to handle the fact that we're running in a full
++ * 64-bit virtual address space. Things like the stack and instruction
++ * addresses need to be accessible by the 32-bit firmware, so we rely on
++ * using the identity mappings in the EFI page table to access the stack
++ * and kernel text (see efi_setup_page_tables()).
+ */
+
+ #include <linux/linkage.h>
+ #include <asm/page_types.h>
++#include <asm/segment.h>
+
+ .text
+ .code64
+@@ -33,14 +50,6 @@ ENTRY(efi64_thunk)
+ leaq efi_exit32(%rip), %rbx
+ subq %rax, %rbx
+ movl %ebx, 8(%rsp)
+- leaq efi_gdt64(%rip), %rbx
+- subq %rax, %rbx
+- movl %ebx, 2(%ebx)
+- movl %ebx, 4(%rsp)
+- leaq efi_gdt32(%rip), %rbx
+- subq %rax, %rbx
+- movl %ebx, 2(%ebx)
+- movl %ebx, (%rsp)
+
+ leaq __efi64_thunk(%rip), %rbx
+ subq %rax, %rbx
+@@ -52,14 +61,92 @@ ENTRY(efi64_thunk)
+ retq
+ ENDPROC(efi64_thunk)
+
+- .data
+-efi_gdt32:
+- .word efi_gdt32_end - efi_gdt32
+- .long 0 /* Filled out above */
+- .word 0
+- .quad 0x0000000000000000 /* NULL descriptor */
+- .quad 0x00cf9a000000ffff /* __KERNEL_CS */
+- .quad 0x00cf93000000ffff /* __KERNEL_DS */
+-efi_gdt32_end:
++/*
++ * We run this function from the 1:1 mapping.
++ *
++ * This function must be invoked with a 1:1 mapped stack.
++ */
++ENTRY(__efi64_thunk)
++ movl %ds, %eax
++ push %rax
++ movl %es, %eax
++ push %rax
++ movl %ss, %eax
++ push %rax
++
++ subq $32, %rsp
++ movl %esi, 0x0(%rsp)
++ movl %edx, 0x4(%rsp)
++ movl %ecx, 0x8(%rsp)
++ movq %r8, %rsi
++ movl %esi, 0xc(%rsp)
++ movq %r9, %rsi
++ movl %esi, 0x10(%rsp)
++
++ leaq 1f(%rip), %rbx
++ movq %rbx, func_rt_ptr(%rip)
++
++ /* Switch to 32-bit descriptor */
++ pushq $__KERNEL32_CS
++ leaq efi_enter32(%rip), %rax
++ pushq %rax
++ lretq
++
++1: addq $32, %rsp
++
++ pop %rbx
++ movl %ebx, %ss
++ pop %rbx
++ movl %ebx, %es
++ pop %rbx
++ movl %ebx, %ds
+
++ /*
++ * Convert 32-bit status code into 64-bit.
++ */
++ test %rax, %rax
++ jz 1f
++ movl %eax, %ecx
++ andl $0x0fffffff, %ecx
++ andl $0xf0000000, %eax
++ shl $32, %rax
++ or %rcx, %rax
++1:
++ ret
++ENDPROC(__efi64_thunk)
++
++ENTRY(efi_exit32)
++ movq func_rt_ptr(%rip), %rax
++ push %rax
++ mov %rdi, %rax
++ ret
++ENDPROC(efi_exit32)
++
++ .code32
++/*
++ * EFI service pointer must be in %edi.
++ *
++ * The stack should represent the 32-bit calling convention.
++ */
++ENTRY(efi_enter32)
++ movl $__KERNEL_DS, %eax
++ movl %eax, %ds
++ movl %eax, %es
++ movl %eax, %ss
++
++ call *%edi
++
++ /* We must preserve return value */
++ movl %eax, %edi
++
++ movl 72(%esp), %eax
++ pushl $__KERNEL_CS
++ pushl %eax
++
++ lret
++ENDPROC(efi_enter32)
++
++ .data
++ .balign 8
++func_rt_ptr: .quad 0
+ efi_saved_sp: .quad 0
+diff --git a/block/blk-mq-tag.c b/block/blk-mq-tag.c
+index ff18dab6b585..702ae29b8d90 100644
+--- a/block/blk-mq-tag.c
++++ b/block/blk-mq-tag.c
+@@ -500,6 +500,7 @@ static int bt_alloc(struct blk_mq_bitmap_tags *bt, unsigned int depth,
+ bt->bs = kzalloc(BT_WAIT_QUEUES * sizeof(*bt->bs), GFP_KERNEL);
+ if (!bt->bs) {
+ kfree(bt->map);
++ bt->map = NULL;
+ return -ENOMEM;
+ }
+
+diff --git a/block/blk-throttle.c b/block/blk-throttle.c
+index 9273d0969ebd..5b9c6d5c3636 100644
+--- a/block/blk-throttle.c
++++ b/block/blk-throttle.c
+@@ -1292,6 +1292,9 @@ static u64 tg_prfill_cpu_rwstat(struct seq_file *sf,
+ struct blkg_rwstat rwstat = { }, tmp;
+ int i, cpu;
+
++ if (tg->stats_cpu == NULL)
++ return 0;
++
+ for_each_possible_cpu(cpu) {
+ struct tg_stats_cpu *sc = per_cpu_ptr(tg->stats_cpu, cpu);
+
+diff --git a/block/cfq-iosched.c b/block/cfq-iosched.c
+index 6f2751d305de..5da8e6e9ab4b 100644
+--- a/block/cfq-iosched.c
++++ b/block/cfq-iosched.c
+@@ -3590,6 +3590,11 @@ retry:
+
+ blkcg = bio_blkcg(bio);
+ cfqg = cfq_lookup_create_cfqg(cfqd, blkcg);
++ if (!cfqg) {
++ cfqq = &cfqd->oom_cfqq;
++ goto out;
++ }
++
+ cfqq = cic_to_cfqq(cic, is_sync);
+
+ /*
+@@ -3626,7 +3631,7 @@ retry:
+ } else
+ cfqq = &cfqd->oom_cfqq;
+ }
+-
++out:
+ if (new_cfqq)
+ kmem_cache_free(cfq_pool, new_cfqq);
+
+@@ -3656,12 +3661,17 @@ static struct cfq_queue *
+ cfq_get_queue(struct cfq_data *cfqd, bool is_sync, struct cfq_io_cq *cic,
+ struct bio *bio, gfp_t gfp_mask)
+ {
+- const int ioprio_class = IOPRIO_PRIO_CLASS(cic->ioprio);
+- const int ioprio = IOPRIO_PRIO_DATA(cic->ioprio);
++ int ioprio_class = IOPRIO_PRIO_CLASS(cic->ioprio);
++ int ioprio = IOPRIO_PRIO_DATA(cic->ioprio);
+ struct cfq_queue **async_cfqq = NULL;
+ struct cfq_queue *cfqq = NULL;
+
+ if (!is_sync) {
++ if (!ioprio_valid(cic->ioprio)) {
++ struct task_struct *tsk = current;
++ ioprio = task_nice_ioprio(tsk);
++ ioprio_class = task_nice_ioclass(tsk);
++ }
+ async_cfqq = cfq_async_queue_prio(cfqd, ioprio_class, ioprio);
+ cfqq = *async_cfqq;
+ }
+diff --git a/drivers/acpi/acpi_lpss.c b/drivers/acpi/acpi_lpss.c
+index 93d160661f4c..41e9c199e874 100644
+--- a/drivers/acpi/acpi_lpss.c
++++ b/drivers/acpi/acpi_lpss.c
+@@ -105,7 +105,7 @@ static void lpss_uart_setup(struct lpss_private_data *pdata)
+ }
+ }
+
+-static void byt_i2c_setup(struct lpss_private_data *pdata)
++static void lpss_deassert_reset(struct lpss_private_data *pdata)
+ {
+ unsigned int offset;
+ u32 val;
+@@ -114,9 +114,18 @@ static void byt_i2c_setup(struct lpss_private_data *pdata)
+ val = readl(pdata->mmio_base + offset);
+ val |= LPSS_RESETS_RESET_APB | LPSS_RESETS_RESET_FUNC;
+ writel(val, pdata->mmio_base + offset);
++}
++
++#define LPSS_I2C_ENABLE 0x6c
++
++static void byt_i2c_setup(struct lpss_private_data *pdata)
++{
++ lpss_deassert_reset(pdata);
+
+ if (readl(pdata->mmio_base + pdata->dev_desc->prv_offset))
+ pdata->fixed_clk_rate = 133000000;
++
++ writel(0, pdata->mmio_base + LPSS_I2C_ENABLE);
+ }
+
+ static struct lpss_device_desc lpt_dev_desc = {
+@@ -166,6 +175,12 @@ static struct lpss_device_desc byt_i2c_dev_desc = {
+ .setup = byt_i2c_setup,
+ };
+
++static struct lpss_device_desc bsw_spi_dev_desc = {
++ .flags = LPSS_CLK | LPSS_CLK_GATE | LPSS_CLK_DIVIDER | LPSS_SAVE_CTX,
++ .prv_offset = 0x400,
++ .setup = lpss_deassert_reset,
++};
++
+ #else
+
+ #define LPSS_ADDR(desc) (0UL)
+@@ -198,7 +213,7 @@ static const struct acpi_device_id acpi_lpss_device_ids[] = {
+ /* Braswell LPSS devices */
+ { "80862288", LPSS_ADDR(byt_pwm_dev_desc) },
+ { "8086228A", LPSS_ADDR(byt_uart_dev_desc) },
+- { "8086228E", LPSS_ADDR(byt_spi_dev_desc) },
++ { "8086228E", LPSS_ADDR(bsw_spi_dev_desc) },
+ { "808622C1", LPSS_ADDR(byt_i2c_dev_desc) },
+
+ { "INT3430", LPSS_ADDR(lpt_dev_desc) },
+diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c
+index 086240cd29c3..fe1678c4ff89 100644
+--- a/drivers/bluetooth/ath3k.c
++++ b/drivers/bluetooth/ath3k.c
+@@ -106,6 +106,7 @@ static const struct usb_device_id ath3k_table[] = {
+ { USB_DEVICE(0x13d3, 0x3393) },
+ { USB_DEVICE(0x13d3, 0x3402) },
+ { USB_DEVICE(0x13d3, 0x3408) },
++ { USB_DEVICE(0x13d3, 0x3423) },
+ { USB_DEVICE(0x13d3, 0x3432) },
+
+ /* Atheros AR5BBU12 with sflash firmware */
+@@ -158,6 +159,7 @@ static const struct usb_device_id ath3k_blist_tbl[] = {
+ { USB_DEVICE(0x13d3, 0x3393), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x13d3, 0x3402), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x13d3, 0x3408), .driver_info = BTUSB_ATH3012 },
++ { USB_DEVICE(0x13d3, 0x3423), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x13d3, 0x3432), .driver_info = BTUSB_ATH3012 },
+
+ /* Atheros AR5BBU22 with sflash firmware */
+@@ -170,6 +172,8 @@ static const struct usb_device_id ath3k_blist_tbl[] = {
+ #define USB_REQ_DFU_DNLOAD 1
+ #define BULK_SIZE 4096
+ #define FW_HDR_SIZE 20
++#define TIMEGAP_USEC_MIN 50
++#define TIMEGAP_USEC_MAX 100
+
+ static int ath3k_load_firmware(struct usb_device *udev,
+ const struct firmware *firmware)
+@@ -201,6 +205,9 @@ static int ath3k_load_firmware(struct usb_device *udev,
+ pipe = usb_sndbulkpipe(udev, 0x02);
+
+ while (count) {
++ /* workaround the compatibility issue with xHCI controller*/
++ usleep_range(TIMEGAP_USEC_MIN, TIMEGAP_USEC_MAX);
++
+ size = min_t(uint, count, BULK_SIZE);
+ memcpy(send_buf, firmware->data + sent, size);
+
+@@ -298,6 +305,9 @@ static int ath3k_load_fwfile(struct usb_device *udev,
+ pipe = usb_sndbulkpipe(udev, 0x02);
+
+ while (count) {
++ /* workaround the compatibility issue with xHCI controller*/
++ usleep_range(TIMEGAP_USEC_MIN, TIMEGAP_USEC_MAX);
++
+ size = min_t(uint, count, BULK_SIZE);
+ memcpy(send_buf, firmware->data + sent, size);
+
+diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
+index 091c813df8e9..f0e2f721c8ce 100644
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -107,15 +107,23 @@ static const struct usb_device_id btusb_table[] = {
+ { USB_DEVICE(0x0b05, 0x17cb) },
+ { USB_DEVICE(0x413c, 0x8197) },
+
++ /* Broadcom BCM20702B0 (Dynex/Insignia) */
++ { USB_DEVICE(0x19ff, 0x0239), .driver_info = BTUSB_BCM_PATCHRAM },
++
+ /* Foxconn - Hon Hai */
+ { USB_VENDOR_AND_INTERFACE_INFO(0x0489, 0xff, 0x01, 0x01) },
+
++ /* Lite-On Technology - Broadcom based */
++ { USB_VENDOR_AND_INTERFACE_INFO(0x04ca, 0xff, 0x01, 0x01),
++ .driver_info = BTUSB_BCM_PATCHRAM },
++
+ /* Broadcom devices with vendor specific id */
+ { USB_VENDOR_AND_INTERFACE_INFO(0x0a5c, 0xff, 0x01, 0x01),
+ .driver_info = BTUSB_BCM_PATCHRAM },
+
+ /* ASUSTek Computer - Broadcom based */
+- { USB_VENDOR_AND_INTERFACE_INFO(0x0b05, 0xff, 0x01, 0x01) },
++ { USB_VENDOR_AND_INTERFACE_INFO(0x0b05, 0xff, 0x01, 0x01),
++ .driver_info = BTUSB_BCM_PATCHRAM },
+
+ /* Belkin F8065bf - Broadcom based */
+ { USB_VENDOR_AND_INTERFACE_INFO(0x050d, 0xff, 0x01, 0x01) },
+@@ -183,6 +191,7 @@ static const struct usb_device_id blacklist_table[] = {
+ { USB_DEVICE(0x13d3, 0x3393), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x13d3, 0x3402), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x13d3, 0x3408), .driver_info = BTUSB_ATH3012 },
++ { USB_DEVICE(0x13d3, 0x3423), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x13d3, 0x3432), .driver_info = BTUSB_ATH3012 },
+
+ /* Atheros AR5BBU12 with sflash firmware */
+diff --git a/drivers/char/random.c b/drivers/char/random.c
+index 04645c09fe5e..9cd6968e2f92 100644
+--- a/drivers/char/random.c
++++ b/drivers/char/random.c
+@@ -569,19 +569,19 @@ static void fast_mix(struct fast_pool *f)
+ __u32 c = f->pool[2], d = f->pool[3];
+
+ a += b; c += d;
+- b = rol32(a, 6); d = rol32(c, 27);
++ b = rol32(b, 6); d = rol32(d, 27);
+ d ^= a; b ^= c;
+
+ a += b; c += d;
+- b = rol32(a, 16); d = rol32(c, 14);
++ b = rol32(b, 16); d = rol32(d, 14);
+ d ^= a; b ^= c;
+
+ a += b; c += d;
+- b = rol32(a, 6); d = rol32(c, 27);
++ b = rol32(b, 6); d = rol32(d, 27);
+ d ^= a; b ^= c;
+
+ a += b; c += d;
+- b = rol32(a, 16); d = rol32(c, 14);
++ b = rol32(b, 16); d = rol32(d, 14);
+ d ^= a; b ^= c;
+
+ f->pool[0] = a; f->pool[1] = b;
+diff --git a/drivers/char/tpm/tpm-interface.c b/drivers/char/tpm/tpm-interface.c
+index 6af17002a115..cfb9089887bd 100644
+--- a/drivers/char/tpm/tpm-interface.c
++++ b/drivers/char/tpm/tpm-interface.c
+@@ -1122,7 +1122,7 @@ struct tpm_chip *tpm_register_hardware(struct device *dev,
+
+ /* Make chip available */
+ spin_lock(&driver_lock);
+- list_add_rcu(&chip->list, &tpm_chip_list);
++ list_add_tail_rcu(&chip->list, &tpm_chip_list);
+ spin_unlock(&driver_lock);
+
+ return chip;
+diff --git a/drivers/char/tpm/tpm_i2c_atmel.c b/drivers/char/tpm/tpm_i2c_atmel.c
+index 77272925dee6..503a85ae176c 100644
+--- a/drivers/char/tpm/tpm_i2c_atmel.c
++++ b/drivers/char/tpm/tpm_i2c_atmel.c
+@@ -168,6 +168,10 @@ static int i2c_atmel_probe(struct i2c_client *client,
+
+ chip->vendor.priv = devm_kzalloc(dev, sizeof(struct priv_data),
+ GFP_KERNEL);
++ if (!chip->vendor.priv) {
++ rc = -ENOMEM;
++ goto out_err;
++ }
+
+ /* Default timeouts */
+ chip->vendor.timeout_a = msecs_to_jiffies(TPM_I2C_SHORT_TIMEOUT);
+diff --git a/drivers/char/tpm/tpm_i2c_nuvoton.c b/drivers/char/tpm/tpm_i2c_nuvoton.c
+index 7b158efd49f7..23c7b137a7fd 100644
+--- a/drivers/char/tpm/tpm_i2c_nuvoton.c
++++ b/drivers/char/tpm/tpm_i2c_nuvoton.c
+@@ -538,6 +538,11 @@ static int i2c_nuvoton_probe(struct i2c_client *client,
+
+ chip->vendor.priv = devm_kzalloc(dev, sizeof(struct priv_data),
+ GFP_KERNEL);
++ if (!chip->vendor.priv) {
++ rc = -ENOMEM;
++ goto out_err;
++ }
++
+ init_waitqueue_head(&chip->vendor.read_queue);
+ init_waitqueue_head(&chip->vendor.int_queue);
+
+diff --git a/drivers/char/tpm/tpm_i2c_stm_st33.c b/drivers/char/tpm/tpm_i2c_stm_st33.c
+index 4669e3713428..7d1c540fa26a 100644
+--- a/drivers/char/tpm/tpm_i2c_stm_st33.c
++++ b/drivers/char/tpm/tpm_i2c_stm_st33.c
+@@ -487,7 +487,7 @@ static int tpm_stm_i2c_send(struct tpm_chip *chip, unsigned char *buf,
+ if (burstcnt < 0)
+ return burstcnt;
+ size = min_t(int, len - i - 1, burstcnt);
+- ret = I2C_WRITE_DATA(client, TPM_DATA_FIFO, buf, size);
++ ret = I2C_WRITE_DATA(client, TPM_DATA_FIFO, buf + i, size);
+ if (ret < 0)
+ goto out_err;
+
+diff --git a/drivers/char/tpm/tpm_ibmvtpm.c b/drivers/char/tpm/tpm_ibmvtpm.c
+index af74c57e5090..eff9d5870034 100644
+--- a/drivers/char/tpm/tpm_ibmvtpm.c
++++ b/drivers/char/tpm/tpm_ibmvtpm.c
+@@ -148,7 +148,8 @@ static int tpm_ibmvtpm_send(struct tpm_chip *chip, u8 *buf, size_t count)
+ crq.len = (u16)count;
+ crq.data = ibmvtpm->rtce_dma_handle;
+
+- rc = ibmvtpm_send_crq(ibmvtpm->vdev, word[0], word[1]);
++ rc = ibmvtpm_send_crq(ibmvtpm->vdev, cpu_to_be64(word[0]),
++ cpu_to_be64(word[1]));
+ if (rc != H_SUCCESS) {
+ dev_err(ibmvtpm->dev, "tpm_ibmvtpm_send failed rc=%d\n", rc);
+ rc = 0;
+@@ -186,7 +187,8 @@ static int ibmvtpm_crq_get_rtce_size(struct ibmvtpm_dev *ibmvtpm)
+ crq.valid = (u8)IBMVTPM_VALID_CMD;
+ crq.msg = (u8)VTPM_GET_RTCE_BUFFER_SIZE;
+
+- rc = ibmvtpm_send_crq(ibmvtpm->vdev, buf[0], buf[1]);
++ rc = ibmvtpm_send_crq(ibmvtpm->vdev, cpu_to_be64(buf[0]),
++ cpu_to_be64(buf[1]));
+ if (rc != H_SUCCESS)
+ dev_err(ibmvtpm->dev,
+ "ibmvtpm_crq_get_rtce_size failed rc=%d\n", rc);
+@@ -212,7 +214,8 @@ static int ibmvtpm_crq_get_version(struct ibmvtpm_dev *ibmvtpm)
+ crq.valid = (u8)IBMVTPM_VALID_CMD;
+ crq.msg = (u8)VTPM_GET_VERSION;
+
+- rc = ibmvtpm_send_crq(ibmvtpm->vdev, buf[0], buf[1]);
++ rc = ibmvtpm_send_crq(ibmvtpm->vdev, cpu_to_be64(buf[0]),
++ cpu_to_be64(buf[1]));
+ if (rc != H_SUCCESS)
+ dev_err(ibmvtpm->dev,
+ "ibmvtpm_crq_get_version failed rc=%d\n", rc);
+@@ -307,6 +310,14 @@ static int tpm_ibmvtpm_remove(struct vio_dev *vdev)
+ static unsigned long tpm_ibmvtpm_get_desired_dma(struct vio_dev *vdev)
+ {
+ struct ibmvtpm_dev *ibmvtpm = ibmvtpm_get_data(&vdev->dev);
++
++ /* ibmvtpm initializes at probe time, so the data we are
++ * asking for may not be set yet. Estimate that 4K required
++ * for TCE-mapped buffer in addition to CRQ.
++ */
++ if (!ibmvtpm)
++ return CRQ_RES_BUF_SIZE + PAGE_SIZE;
++
+ return CRQ_RES_BUF_SIZE + ibmvtpm->rtce_size;
+ }
+
+@@ -327,7 +338,8 @@ static int tpm_ibmvtpm_suspend(struct device *dev)
+ crq.valid = (u8)IBMVTPM_VALID_CMD;
+ crq.msg = (u8)VTPM_PREPARE_TO_SUSPEND;
+
+- rc = ibmvtpm_send_crq(ibmvtpm->vdev, buf[0], buf[1]);
++ rc = ibmvtpm_send_crq(ibmvtpm->vdev, cpu_to_be64(buf[0]),
++ cpu_to_be64(buf[1]));
+ if (rc != H_SUCCESS)
+ dev_err(ibmvtpm->dev,
+ "tpm_ibmvtpm_suspend failed rc=%d\n", rc);
+@@ -472,11 +484,11 @@ static void ibmvtpm_crq_process(struct ibmvtpm_crq *crq,
+ case IBMVTPM_VALID_CMD:
+ switch (crq->msg) {
+ case VTPM_GET_RTCE_BUFFER_SIZE_RES:
+- if (crq->len <= 0) {
++ if (be16_to_cpu(crq->len) <= 0) {
+ dev_err(ibmvtpm->dev, "Invalid rtce size\n");
+ return;
+ }
+- ibmvtpm->rtce_size = crq->len;
++ ibmvtpm->rtce_size = be16_to_cpu(crq->len);
+ ibmvtpm->rtce_buf = kmalloc(ibmvtpm->rtce_size,
+ GFP_KERNEL);
+ if (!ibmvtpm->rtce_buf) {
+@@ -497,11 +509,11 @@ static void ibmvtpm_crq_process(struct ibmvtpm_crq *crq,
+
+ return;
+ case VTPM_GET_VERSION_RES:
+- ibmvtpm->vtpm_version = crq->data;
++ ibmvtpm->vtpm_version = be32_to_cpu(crq->data);
+ return;
+ case VTPM_TPM_COMMAND_RES:
+ /* len of the data in rtce buffer */
+- ibmvtpm->res_len = crq->len;
++ ibmvtpm->res_len = be16_to_cpu(crq->len);
+ wake_up_interruptible(&ibmvtpm->wq);
+ return;
+ default:
+diff --git a/drivers/char/tpm/tpm_tis.c b/drivers/char/tpm/tpm_tis.c
+index 2c46734b266d..51350cd0847e 100644
+--- a/drivers/char/tpm/tpm_tis.c
++++ b/drivers/char/tpm/tpm_tis.c
+@@ -75,6 +75,10 @@ enum tis_defaults {
+ #define TPM_DID_VID(l) (0x0F00 | ((l) << 12))
+ #define TPM_RID(l) (0x0F04 | ((l) << 12))
+
++struct priv_data {
++ bool irq_tested;
++};
++
+ static LIST_HEAD(tis_chips);
+ static DEFINE_MUTEX(tis_lock);
+
+@@ -338,12 +342,27 @@ out_err:
+ return rc;
+ }
+
++static void disable_interrupts(struct tpm_chip *chip)
++{
++ u32 intmask;
++
++ intmask =
++ ioread32(chip->vendor.iobase +
++ TPM_INT_ENABLE(chip->vendor.locality));
++ intmask &= ~TPM_GLOBAL_INT_ENABLE;
++ iowrite32(intmask,
++ chip->vendor.iobase +
++ TPM_INT_ENABLE(chip->vendor.locality));
++ free_irq(chip->vendor.irq, chip);
++ chip->vendor.irq = 0;
++}
++
+ /*
+ * If interrupts are used (signaled by an irq set in the vendor structure)
+ * tpm.c can skip polling for the data to be available as the interrupt is
+ * waited for here
+ */
+-static int tpm_tis_send(struct tpm_chip *chip, u8 *buf, size_t len)
++static int tpm_tis_send_main(struct tpm_chip *chip, u8 *buf, size_t len)
+ {
+ int rc;
+ u32 ordinal;
+@@ -373,6 +392,30 @@ out_err:
+ return rc;
+ }
+
++static int tpm_tis_send(struct tpm_chip *chip, u8 *buf, size_t len)
++{
++ int rc, irq;
++ struct priv_data *priv = chip->vendor.priv;
++
++ if (!chip->vendor.irq || priv->irq_tested)
++ return tpm_tis_send_main(chip, buf, len);
++
++ /* Verify receipt of the expected IRQ */
++ irq = chip->vendor.irq;
++ chip->vendor.irq = 0;
++ rc = tpm_tis_send_main(chip, buf, len);
++ chip->vendor.irq = irq;
++ if (!priv->irq_tested)
++ msleep(1);
++ if (!priv->irq_tested) {
++ disable_interrupts(chip);
++ dev_err(chip->dev,
++ FW_BUG "TPM interrupt not working, polling instead\n");
++ }
++ priv->irq_tested = true;
++ return rc;
++}
++
+ struct tis_vendor_timeout_override {
+ u32 did_vid;
+ unsigned long timeout_us[4];
+@@ -505,6 +548,7 @@ static irqreturn_t tis_int_handler(int dummy, void *dev_id)
+ if (interrupt == 0)
+ return IRQ_NONE;
+
++ ((struct priv_data *)chip->vendor.priv)->irq_tested = true;
+ if (interrupt & TPM_INTF_DATA_AVAIL_INT)
+ wake_up_interruptible(&chip->vendor.read_queue);
+ if (interrupt & TPM_INTF_LOCALITY_CHANGE_INT)
+@@ -534,9 +578,14 @@ static int tpm_tis_init(struct device *dev, resource_size_t start,
+ u32 vendor, intfcaps, intmask;
+ int rc, i, irq_s, irq_e, probe;
+ struct tpm_chip *chip;
++ struct priv_data *priv;
+
++ priv = devm_kzalloc(dev, sizeof(struct priv_data), GFP_KERNEL);
++ if (priv == NULL)
++ return -ENOMEM;
+ if (!(chip = tpm_register_hardware(dev, &tpm_tis)))
+ return -ENODEV;
++ chip->vendor.priv = priv;
+
+ chip->vendor.iobase = ioremap(start, len);
+ if (!chip->vendor.iobase) {
+@@ -605,19 +654,6 @@ static int tpm_tis_init(struct device *dev, resource_size_t start,
+ if (intfcaps & TPM_INTF_DATA_AVAIL_INT)
+ dev_dbg(dev, "\tData Avail Int Support\n");
+
+- /* get the timeouts before testing for irqs */
+- if (tpm_get_timeouts(chip)) {
+- dev_err(dev, "Could not get TPM timeouts and durations\n");
+- rc = -ENODEV;
+- goto out_err;
+- }
+-
+- if (tpm_do_selftest(chip)) {
+- dev_err(dev, "TPM self test failed\n");
+- rc = -ENODEV;
+- goto out_err;
+- }
+-
+ /* INTERRUPT Setup */
+ init_waitqueue_head(&chip->vendor.read_queue);
+ init_waitqueue_head(&chip->vendor.int_queue);
+@@ -719,6 +755,18 @@ static int tpm_tis_init(struct device *dev, resource_size_t start,
+ }
+ }
+
++ if (tpm_get_timeouts(chip)) {
++ dev_err(dev, "Could not get TPM timeouts and durations\n");
++ rc = -ENODEV;
++ goto out_err;
++ }
++
++ if (tpm_do_selftest(chip)) {
++ dev_err(dev, "TPM self test failed\n");
++ rc = -ENODEV;
++ goto out_err;
++ }
++
+ INIT_LIST_HEAD(&chip->vendor.list);
+ mutex_lock(&tis_lock);
+ list_add(&chip->vendor.list, &tis_chips);
+diff --git a/drivers/clocksource/mtk_timer.c b/drivers/clocksource/mtk_timer.c
+index 32a3d25795d3..68ab42356d0e 100644
+--- a/drivers/clocksource/mtk_timer.c
++++ b/drivers/clocksource/mtk_timer.c
+@@ -224,6 +224,8 @@ static void __init mtk_timer_init(struct device_node *node)
+ }
+ rate = clk_get_rate(clk);
+
++ mtk_timer_global_reset(evt);
++
+ if (request_irq(evt->dev.irq, mtk_timer_interrupt,
+ IRQF_TIMER | IRQF_IRQPOLL, "mtk_timer", evt)) {
+ pr_warn("failed to setup irq %d\n", evt->dev.irq);
+@@ -232,8 +234,6 @@ static void __init mtk_timer_init(struct device_node *node)
+
+ evt->ticks_per_jiffy = DIV_ROUND_UP(rate, HZ);
+
+- mtk_timer_global_reset(evt);
+-
+ /* Configure clock source */
+ mtk_timer_setup(evt, GPT_CLK_SRC, TIMER_CTRL_OP_FREERUN);
+ clocksource_mmio_init(evt->gpt_base + TIMER_CNT_REG(GPT_CLK_SRC),
+@@ -241,10 +241,11 @@ static void __init mtk_timer_init(struct device_node *node)
+
+ /* Configure clock event */
+ mtk_timer_setup(evt, GPT_CLK_EVT, TIMER_CTRL_OP_REPEAT);
+- mtk_timer_enable_irq(evt, GPT_CLK_EVT);
+-
+ clockevents_config_and_register(&evt->dev, rate, 0x3,
+ 0xffffffff);
++
++ mtk_timer_enable_irq(evt, GPT_CLK_EVT);
++
+ return;
+
+ err_clk_disable:
+diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
+index 4473eba1d6b0..e3bf702b5588 100644
+--- a/drivers/cpufreq/cpufreq.c
++++ b/drivers/cpufreq/cpufreq.c
+@@ -1409,9 +1409,10 @@ static int __cpufreq_remove_dev_finish(struct device *dev,
+ unsigned long flags;
+ struct cpufreq_policy *policy;
+
+- read_lock_irqsave(&cpufreq_driver_lock, flags);
++ write_lock_irqsave(&cpufreq_driver_lock, flags);
+ policy = per_cpu(cpufreq_cpu_data, cpu);
+- read_unlock_irqrestore(&cpufreq_driver_lock, flags);
++ per_cpu(cpufreq_cpu_data, cpu) = NULL;
++ write_unlock_irqrestore(&cpufreq_driver_lock, flags);
+
+ if (!policy) {
+ pr_debug("%s: No cpu_data found\n", __func__);
+@@ -1466,7 +1467,6 @@ static int __cpufreq_remove_dev_finish(struct device *dev,
+ }
+ }
+
+- per_cpu(cpufreq_cpu_data, cpu) = NULL;
+ return 0;
+ }
+
+diff --git a/drivers/cpufreq/s3c2416-cpufreq.c b/drivers/cpufreq/s3c2416-cpufreq.c
+index 2fd53eaaec20..d6d425773fa4 100644
+--- a/drivers/cpufreq/s3c2416-cpufreq.c
++++ b/drivers/cpufreq/s3c2416-cpufreq.c
+@@ -263,7 +263,7 @@ out:
+ }
+
+ #ifdef CONFIG_ARM_S3C2416_CPUFREQ_VCORESCALE
+-static void __init s3c2416_cpufreq_cfg_regulator(struct s3c2416_data *s3c_freq)
++static void s3c2416_cpufreq_cfg_regulator(struct s3c2416_data *s3c_freq)
+ {
+ int count, v, i, found;
+ struct cpufreq_frequency_table *pos;
+@@ -333,7 +333,7 @@ static struct notifier_block s3c2416_cpufreq_reboot_notifier = {
+ .notifier_call = s3c2416_cpufreq_reboot_notifier_evt,
+ };
+
+-static int __init s3c2416_cpufreq_driver_init(struct cpufreq_policy *policy)
++static int s3c2416_cpufreq_driver_init(struct cpufreq_policy *policy)
+ {
+ struct s3c2416_data *s3c_freq = &s3c2416_cpufreq;
+ struct cpufreq_frequency_table *pos;
+diff --git a/drivers/cpufreq/s3c24xx-cpufreq.c b/drivers/cpufreq/s3c24xx-cpufreq.c
+index d00f1cee4509..733aa5153e74 100644
+--- a/drivers/cpufreq/s3c24xx-cpufreq.c
++++ b/drivers/cpufreq/s3c24xx-cpufreq.c
+@@ -144,11 +144,6 @@ static void s3c_cpufreq_setfvco(struct s3c_cpufreq_config *cfg)
+ (cfg->info->set_fvco)(cfg);
+ }
+
+-static inline void s3c_cpufreq_resume_clocks(void)
+-{
+- cpu_cur.info->resume_clocks();
+-}
+-
+ static inline void s3c_cpufreq_updateclk(struct clk *clk,
+ unsigned int freq)
+ {
+@@ -417,9 +412,6 @@ static int s3c_cpufreq_resume(struct cpufreq_policy *policy)
+
+ last_target = ~0; /* invalidate last_target setting */
+
+- /* first, find out what speed we resumed at. */
+- s3c_cpufreq_resume_clocks();
+-
+ /* whilst we will be called later on, we try and re-set the
+ * cpu frequencies as soon as possible so that we do not end
+ * up resuming devices and then immediately having to re-set
+@@ -454,7 +446,7 @@ static struct cpufreq_driver s3c24xx_driver = {
+ };
+
+
+-int __init s3c_cpufreq_register(struct s3c_cpufreq_info *info)
++int s3c_cpufreq_register(struct s3c_cpufreq_info *info)
+ {
+ if (!info || !info->name) {
+ printk(KERN_ERR "%s: failed to pass valid information\n",
+diff --git a/drivers/cpufreq/speedstep-lib.c b/drivers/cpufreq/speedstep-lib.c
+index 7047821a7f8a..4ab7a2156672 100644
+--- a/drivers/cpufreq/speedstep-lib.c
++++ b/drivers/cpufreq/speedstep-lib.c
+@@ -400,6 +400,7 @@ unsigned int speedstep_get_freqs(enum speedstep_processor processor,
+
+ pr_debug("previous speed is %u\n", prev_speed);
+
++ preempt_disable();
+ local_irq_save(flags);
+
+ /* switch to low state */
+@@ -464,6 +465,8 @@ unsigned int speedstep_get_freqs(enum speedstep_processor processor,
+
+ out:
+ local_irq_restore(flags);
++ preempt_enable();
++
+ return ret;
+ }
+ EXPORT_SYMBOL_GPL(speedstep_get_freqs);
+diff --git a/drivers/cpufreq/speedstep-smi.c b/drivers/cpufreq/speedstep-smi.c
+index 5fc96d5d656b..819229e824fb 100644
+--- a/drivers/cpufreq/speedstep-smi.c
++++ b/drivers/cpufreq/speedstep-smi.c
+@@ -156,6 +156,7 @@ static void speedstep_set_state(unsigned int state)
+ return;
+
+ /* Disable IRQs */
++ preempt_disable();
+ local_irq_save(flags);
+
+ command = (smi_sig & 0xffffff00) | (smi_cmd & 0xff);
+@@ -166,9 +167,19 @@ static void speedstep_set_state(unsigned int state)
+
+ do {
+ if (retry) {
++ /*
++ * We need to enable interrupts, otherwise the blockage
++ * won't resolve.
++ *
++ * We disable preemption so that other processes don't
++ * run. If other processes were running, they could
++ * submit more DMA requests, making the blockage worse.
++ */
+ pr_debug("retry %u, previous result %u, waiting...\n",
+ retry, result);
++ local_irq_enable();
+ mdelay(retry * 50);
++ local_irq_disable();
+ }
+ retry++;
+ __asm__ __volatile__(
+@@ -185,6 +196,7 @@ static void speedstep_set_state(unsigned int state)
+
+ /* enable IRQs */
+ local_irq_restore(flags);
++ preempt_enable();
+
+ if (new_state == state)
+ pr_debug("change to %u MHz succeeded after %u tries "
+diff --git a/drivers/edac/amd64_edac.c b/drivers/edac/amd64_edac.c
+index bbd65149cdb2..c7236ba92b8e 100644
+--- a/drivers/edac/amd64_edac.c
++++ b/drivers/edac/amd64_edac.c
+@@ -2039,14 +2039,20 @@ static void __log_bus_error(struct mem_ctl_info *mci, struct err_info *err,
+
+ static inline void decode_bus_error(int node_id, struct mce *m)
+ {
+- struct mem_ctl_info *mci = mcis[node_id];
+- struct amd64_pvt *pvt = mci->pvt_info;
++ struct mem_ctl_info *mci;
++ struct amd64_pvt *pvt;
+ u8 ecc_type = (m->status >> 45) & 0x3;
+ u8 xec = XEC(m->status, 0x1f);
+ u16 ec = EC(m->status);
+ u64 sys_addr;
+ struct err_info err;
+
++ mci = edac_mc_find(node_id);
++ if (!mci)
++ return;
++
++ pvt = mci->pvt_info;
++
+ /* Bail out early if this was an 'observed' error */
+ if (PP(ec) == NBSL_PP_OBS)
+ return;
+diff --git a/drivers/edac/sb_edac.c b/drivers/edac/sb_edac.c
+index e9bb1af67c8d..3cdaac8944eb 100644
+--- a/drivers/edac/sb_edac.c
++++ b/drivers/edac/sb_edac.c
+@@ -2297,7 +2297,7 @@ static int sbridge_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+ rc = sbridge_get_all_devices(&num_mc, pci_dev_descr_ibridge_table);
+ type = IVY_BRIDGE;
+ break;
+- case PCI_DEVICE_ID_INTEL_SBRIDGE_IMC_TA:
++ case PCI_DEVICE_ID_INTEL_SBRIDGE_IMC_HA0:
+ rc = sbridge_get_all_devices(&num_mc, pci_dev_descr_sbridge_table);
+ type = SANDY_BRIDGE;
+ break;
+@@ -2306,8 +2306,11 @@ static int sbridge_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+ type = HASWELL;
+ break;
+ }
+- if (unlikely(rc < 0))
++ if (unlikely(rc < 0)) {
++ edac_dbg(0, "couldn't get all devices for 0x%x\n", pdev->device);
+ goto fail0;
++ }
++
+ mc = 0;
+
+ list_for_each_entry(sbridge_dev, &sbridge_edac_list, list) {
+@@ -2320,7 +2323,7 @@ static int sbridge_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+ goto fail1;
+ }
+
+- sbridge_printk(KERN_INFO, "Driver loaded.\n");
++ sbridge_printk(KERN_INFO, "%s\n", SBRIDGE_REVISION);
+
+ mutex_unlock(&sbridge_edac_lock);
+ return 0;
+diff --git a/drivers/gpio/gpio-tps65912.c b/drivers/gpio/gpio-tps65912.c
+index 22052d84c63b..a8c783099af9 100644
+--- a/drivers/gpio/gpio-tps65912.c
++++ b/drivers/gpio/gpio-tps65912.c
+@@ -26,9 +26,12 @@ struct tps65912_gpio_data {
+ struct gpio_chip gpio_chip;
+ };
+
++#define to_tgd(gc) container_of(gc, struct tps65912_gpio_data, gpio_chip)
++
+ static int tps65912_gpio_get(struct gpio_chip *gc, unsigned offset)
+ {
+- struct tps65912 *tps65912 = container_of(gc, struct tps65912, gpio);
++ struct tps65912_gpio_data *tps65912_gpio = to_tgd(gc);
++ struct tps65912 *tps65912 = tps65912_gpio->tps65912;
+ int val;
+
+ val = tps65912_reg_read(tps65912, TPS65912_GPIO1 + offset);
+@@ -42,7 +45,8 @@ static int tps65912_gpio_get(struct gpio_chip *gc, unsigned offset)
+ static void tps65912_gpio_set(struct gpio_chip *gc, unsigned offset,
+ int value)
+ {
+- struct tps65912 *tps65912 = container_of(gc, struct tps65912, gpio);
++ struct tps65912_gpio_data *tps65912_gpio = to_tgd(gc);
++ struct tps65912 *tps65912 = tps65912_gpio->tps65912;
+
+ if (value)
+ tps65912_set_bits(tps65912, TPS65912_GPIO1 + offset,
+@@ -55,7 +59,8 @@ static void tps65912_gpio_set(struct gpio_chip *gc, unsigned offset,
+ static int tps65912_gpio_output(struct gpio_chip *gc, unsigned offset,
+ int value)
+ {
+- struct tps65912 *tps65912 = container_of(gc, struct tps65912, gpio);
++ struct tps65912_gpio_data *tps65912_gpio = to_tgd(gc);
++ struct tps65912 *tps65912 = tps65912_gpio->tps65912;
+
+ /* Set the initial value */
+ tps65912_gpio_set(gc, offset, value);
+@@ -66,7 +71,8 @@ static int tps65912_gpio_output(struct gpio_chip *gc, unsigned offset,
+
+ static int tps65912_gpio_input(struct gpio_chip *gc, unsigned offset)
+ {
+- struct tps65912 *tps65912 = container_of(gc, struct tps65912, gpio);
++ struct tps65912_gpio_data *tps65912_gpio = to_tgd(gc);
++ struct tps65912 *tps65912 = tps65912_gpio->tps65912;
+
+ return tps65912_clear_bits(tps65912, TPS65912_GPIO1 + offset,
+ GPIO_CFG_MASK);
+diff --git a/drivers/gpio/gpiolib-of.c b/drivers/gpio/gpiolib-of.c
+index 08261f2b3a82..26645a847bb8 100644
+--- a/drivers/gpio/gpiolib-of.c
++++ b/drivers/gpio/gpiolib-of.c
+@@ -46,12 +46,13 @@ static int of_gpiochip_find_and_xlate(struct gpio_chip *gc, void *data)
+
+ ret = gc->of_xlate(gc, &gg_data->gpiospec, gg_data->flags);
+ if (ret < 0) {
+- /* We've found the gpio chip, but the translation failed.
+- * Return true to stop looking and return the translation
+- * error via out_gpio
++ /* We've found a gpio chip, but the translation failed.
++ * Store translation error in out_gpio.
++ * Return false to keep looking, as more than one gpio chip
++ * could be registered per of-node.
+ */
+ gg_data->out_gpio = ERR_PTR(ret);
+- return true;
++ return false;
+ }
+
+ gg_data->out_gpio = gpiochip_get_desc(gc, ret);
+diff --git a/drivers/hid/i2c-hid/i2c-hid.c b/drivers/hid/i2c-hid/i2c-hid.c
+index 80e33e0abc52..6d7c9c580ceb 100644
+--- a/drivers/hid/i2c-hid/i2c-hid.c
++++ b/drivers/hid/i2c-hid/i2c-hid.c
+@@ -370,7 +370,10 @@ static int i2c_hid_hwreset(struct i2c_client *client)
+ static void i2c_hid_get_input(struct i2c_hid *ihid)
+ {
+ int ret, ret_size;
+- int size = ihid->bufsize;
++ int size = le16_to_cpu(ihid->hdesc.wMaxInputLength);
++
++ if (size > ihid->bufsize)
++ size = ihid->bufsize;
+
+ ret = i2c_master_recv(ihid->client, ihid->inbuf, size);
+ if (ret != size) {
+diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
+index 40b35be34f8d..2f2f38f4d83c 100644
+--- a/drivers/md/raid1.c
++++ b/drivers/md/raid1.c
+@@ -560,7 +560,7 @@ static int read_balance(struct r1conf *conf, struct r1bio *r1_bio, int *max_sect
+ if (test_bit(WriteMostly, &rdev->flags)) {
+ /* Don't balance among write-mostly, just
+ * use the first as a last resort */
+- if (best_disk < 0) {
++ if (best_dist_disk < 0) {
+ if (is_badblock(rdev, this_sector, sectors,
+ &first_bad, &bad_sectors)) {
+ if (first_bad < this_sector)
+@@ -569,7 +569,8 @@ static int read_balance(struct r1conf *conf, struct r1bio *r1_bio, int *max_sect
+ best_good_sectors = first_bad - this_sector;
+ } else
+ best_good_sectors = sectors;
+- best_disk = disk;
++ best_dist_disk = disk;
++ best_pending_disk = disk;
+ }
+ continue;
+ }
+diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
+index b98765f6f77f..8577cc7db47e 100644
+--- a/drivers/md/raid5.c
++++ b/drivers/md/raid5.c
+@@ -3102,7 +3102,8 @@ static void handle_stripe_dirtying(struct r5conf *conf,
+ * generate correct data from the parity.
+ */
+ if (conf->max_degraded == 2 ||
+- (recovery_cp < MaxSector && sh->sector >= recovery_cp)) {
++ (recovery_cp < MaxSector && sh->sector >= recovery_cp &&
++ s->failed == 0)) {
+ /* Calculate the real rcw later - for now make it
+ * look like rcw is cheaper
+ */
+diff --git a/drivers/media/dvb-frontends/si2168.c b/drivers/media/dvb-frontends/si2168.c
+index 1cd93be281ed..64a759c017d4 100644
+--- a/drivers/media/dvb-frontends/si2168.c
++++ b/drivers/media/dvb-frontends/si2168.c
+@@ -605,6 +605,8 @@ static const struct dvb_frontend_ops si2168_ops = {
+ .delsys = {SYS_DVBT, SYS_DVBT2, SYS_DVBC_ANNEX_A},
+ .info = {
+ .name = "Silicon Labs Si2168",
++ .symbol_rate_min = 1000000,
++ .symbol_rate_max = 7200000,
+ .caps = FE_CAN_FEC_1_2 |
+ FE_CAN_FEC_2_3 |
+ FE_CAN_FEC_3_4 |
+diff --git a/drivers/media/platform/Kconfig b/drivers/media/platform/Kconfig
+index 3aac88f1d54a..736277236ba2 100644
+--- a/drivers/media/platform/Kconfig
++++ b/drivers/media/platform/Kconfig
+@@ -56,10 +56,8 @@ config VIDEO_VIU
+
+ config VIDEO_TIMBERDALE
+ tristate "Support for timberdale Video In/LogiWIN"
+- depends on VIDEO_V4L2 && I2C && DMADEVICES
+- depends on MFD_TIMBERDALE || COMPILE_TEST
+- select DMA_ENGINE
+- select TIMB_DMA
++ depends on VIDEO_V4L2 && I2C
++ depends on (MFD_TIMBERDALE && TIMB_DMA) || COMPILE_TEST
+ select VIDEO_ADV7180
+ select VIDEOBUF_DMA_CONTIG
+ ---help---
+diff --git a/drivers/media/rc/rc-main.c b/drivers/media/rc/rc-main.c
+index 8d3b74c5a717..fc369b033484 100644
+--- a/drivers/media/rc/rc-main.c
++++ b/drivers/media/rc/rc-main.c
+@@ -1021,16 +1021,16 @@ static ssize_t store_protocols(struct device *device,
+ goto out;
+ }
+
+- if (new_protocols == old_protocols) {
+- rc = len;
+- goto out;
++ if (new_protocols != old_protocols) {
++ *current_protocols = new_protocols;
++ IR_dprintk(1, "Protocols changed to 0x%llx\n",
++ (long long)new_protocols);
+ }
+
+- *current_protocols = new_protocols;
+- IR_dprintk(1, "Protocols changed to 0x%llx\n", (long long)new_protocols);
+-
+ /*
+- * If the protocol is changed the filter needs updating.
++ * If a protocol change was attempted the filter may need updating, even
++ * if the actual protocol mask hasn't changed (since the driver may have
++ * cleared the filter).
+ * Try setting the same filter with the new protocol (if any).
+ * Fall back to clearing the filter.
+ */
+diff --git a/drivers/media/usb/dvb-usb-v2/lmedm04.c b/drivers/media/usb/dvb-usb-v2/lmedm04.c
+index 9f2c5459b73a..2273ce78f5c8 100644
+--- a/drivers/media/usb/dvb-usb-v2/lmedm04.c
++++ b/drivers/media/usb/dvb-usb-v2/lmedm04.c
+@@ -344,15 +344,17 @@ static void lme2510_int_response(struct urb *lme_urb)
+
+ usb_submit_urb(lme_urb, GFP_ATOMIC);
+
+- /* interrupt urb is due every 48 msecs while streaming
+- * add 12msecs for system lag */
+- st->int_urb_due = jiffies + msecs_to_jiffies(60);
++ /* Interrupt urb is due every 48 msecs while streaming the buffer
++ * stores up to 4 periods if missed. Allow 200 msec for next interrupt.
++ */
++ st->int_urb_due = jiffies + msecs_to_jiffies(200);
+ }
+
+ static int lme2510_int_read(struct dvb_usb_adapter *adap)
+ {
+ struct dvb_usb_device *d = adap_to_d(adap);
+ struct lme2510_state *lme_int = adap_to_priv(adap);
++ struct usb_host_endpoint *ep;
+
+ lme_int->lme_urb = usb_alloc_urb(0, GFP_ATOMIC);
+
+@@ -374,6 +376,12 @@ static int lme2510_int_read(struct dvb_usb_adapter *adap)
+ adap,
+ 8);
+
++ /* Quirk of pipe reporting PIPE_BULK but behaves as interrupt */
++ ep = usb_pipe_endpoint(d->udev, lme_int->lme_urb->pipe);
++
++ if (usb_endpoint_type(&ep->desc) == USB_ENDPOINT_XFER_BULK)
++ lme_int->lme_urb->pipe = usb_rcvbulkpipe(d->udev, 0xa),
++
+ lme_int->lme_urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
+
+ usb_submit_urb(lme_int->lme_urb, GFP_ATOMIC);
+diff --git a/drivers/media/usb/em28xx/em28xx-audio.c b/drivers/media/usb/em28xx/em28xx-audio.c
+index 957c7ae30efe..1ead904a7043 100644
+--- a/drivers/media/usb/em28xx/em28xx-audio.c
++++ b/drivers/media/usb/em28xx/em28xx-audio.c
+@@ -821,7 +821,7 @@ static int em28xx_audio_urb_init(struct em28xx *dev)
+ if (urb_size > ep_size * npackets)
+ npackets = DIV_ROUND_UP(urb_size, ep_size);
+
+- em28xx_info("Number of URBs: %d, with %d packets and %d size",
++ em28xx_info("Number of URBs: %d, with %d packets and %d size\n",
+ num_urb, npackets, urb_size);
+
+ /* Estimate the bytes per period */
+@@ -982,7 +982,7 @@ static int em28xx_audio_fini(struct em28xx *dev)
+ return 0;
+ }
+
+- em28xx_info("Closing audio extension");
++ em28xx_info("Closing audio extension\n");
+
+ if (dev->adev.sndcard) {
+ snd_card_disconnect(dev->adev.sndcard);
+@@ -1006,7 +1006,7 @@ static int em28xx_audio_suspend(struct em28xx *dev)
+ if (dev->usb_audio_type != EM28XX_USB_AUDIO_VENDOR)
+ return 0;
+
+- em28xx_info("Suspending audio extension");
++ em28xx_info("Suspending audio extension\n");
+ em28xx_deinit_isoc_audio(dev);
+ atomic_set(&dev->adev.stream_started, 0);
+ return 0;
+@@ -1020,7 +1020,7 @@ static int em28xx_audio_resume(struct em28xx *dev)
+ if (dev->usb_audio_type != EM28XX_USB_AUDIO_VENDOR)
+ return 0;
+
+- em28xx_info("Resuming audio extension");
++ em28xx_info("Resuming audio extension\n");
+ /* Nothing to do other than schedule_work() ?? */
+ schedule_work(&dev->adev.wq_trigger);
+ return 0;
+diff --git a/drivers/media/usb/em28xx/em28xx-core.c b/drivers/media/usb/em28xx/em28xx-core.c
+index 901cf2b952d7..84dd4aec70fb 100644
+--- a/drivers/media/usb/em28xx/em28xx-core.c
++++ b/drivers/media/usb/em28xx/em28xx-core.c
+@@ -1122,7 +1122,7 @@ int em28xx_suspend_extension(struct em28xx *dev)
+ {
+ const struct em28xx_ops *ops = NULL;
+
+- em28xx_info("Suspending extensions");
++ em28xx_info("Suspending extensions\n");
+ mutex_lock(&em28xx_devlist_mutex);
+ list_for_each_entry(ops, &em28xx_extension_devlist, next) {
+ if (ops->suspend)
+@@ -1136,7 +1136,7 @@ int em28xx_resume_extension(struct em28xx *dev)
+ {
+ const struct em28xx_ops *ops = NULL;
+
+- em28xx_info("Resuming extensions");
++ em28xx_info("Resuming extensions\n");
+ mutex_lock(&em28xx_devlist_mutex);
+ list_for_each_entry(ops, &em28xx_extension_devlist, next) {
+ if (ops->resume)
+diff --git a/drivers/media/usb/em28xx/em28xx-dvb.c b/drivers/media/usb/em28xx/em28xx-dvb.c
+index 9682c52d67d1..41a6864ab8d2 100644
+--- a/drivers/media/usb/em28xx/em28xx-dvb.c
++++ b/drivers/media/usb/em28xx/em28xx-dvb.c
+@@ -1667,7 +1667,7 @@ static int em28xx_dvb_fini(struct em28xx *dev)
+ if (!dev->dvb)
+ return 0;
+
+- em28xx_info("Closing DVB extension");
++ em28xx_info("Closing DVB extension\n");
+
+ dvb = dev->dvb;
+ client = dvb->i2c_client_tuner;
+@@ -1718,17 +1718,17 @@ static int em28xx_dvb_suspend(struct em28xx *dev)
+ if (!dev->board.has_dvb)
+ return 0;
+
+- em28xx_info("Suspending DVB extension");
++ em28xx_info("Suspending DVB extension\n");
+ if (dev->dvb) {
+ struct em28xx_dvb *dvb = dev->dvb;
+
+ if (dvb->fe[0]) {
+ ret = dvb_frontend_suspend(dvb->fe[0]);
+- em28xx_info("fe0 suspend %d", ret);
++ em28xx_info("fe0 suspend %d\n", ret);
+ }
+ if (dvb->fe[1]) {
+ dvb_frontend_suspend(dvb->fe[1]);
+- em28xx_info("fe1 suspend %d", ret);
++ em28xx_info("fe1 suspend %d\n", ret);
+ }
+ }
+
+@@ -1745,18 +1745,18 @@ static int em28xx_dvb_resume(struct em28xx *dev)
+ if (!dev->board.has_dvb)
+ return 0;
+
+- em28xx_info("Resuming DVB extension");
++ em28xx_info("Resuming DVB extension\n");
+ if (dev->dvb) {
+ struct em28xx_dvb *dvb = dev->dvb;
+
+ if (dvb->fe[0]) {
+ ret = dvb_frontend_resume(dvb->fe[0]);
+- em28xx_info("fe0 resume %d", ret);
++ em28xx_info("fe0 resume %d\n", ret);
+ }
+
+ if (dvb->fe[1]) {
+ ret = dvb_frontend_resume(dvb->fe[1]);
+- em28xx_info("fe1 resume %d", ret);
++ em28xx_info("fe1 resume %d\n", ret);
+ }
+ }
+
+diff --git a/drivers/media/usb/em28xx/em28xx-input.c b/drivers/media/usb/em28xx/em28xx-input.c
+index 23f8f6afa2e0..b31e275faa2e 100644
+--- a/drivers/media/usb/em28xx/em28xx-input.c
++++ b/drivers/media/usb/em28xx/em28xx-input.c
+@@ -833,7 +833,7 @@ static int em28xx_ir_fini(struct em28xx *dev)
+ return 0;
+ }
+
+- em28xx_info("Closing input extension");
++ em28xx_info("Closing input extension\n");
+
+ em28xx_shutdown_buttons(dev);
+
+@@ -863,7 +863,7 @@ static int em28xx_ir_suspend(struct em28xx *dev)
+ if (dev->is_audio_only)
+ return 0;
+
+- em28xx_info("Suspending input extension");
++ em28xx_info("Suspending input extension\n");
+ if (ir)
+ cancel_delayed_work_sync(&ir->work);
+ cancel_delayed_work_sync(&dev->buttons_query_work);
+@@ -880,7 +880,7 @@ static int em28xx_ir_resume(struct em28xx *dev)
+ if (dev->is_audio_only)
+ return 0;
+
+- em28xx_info("Resuming input extension");
++ em28xx_info("Resuming input extension\n");
+ /* if suspend calls ir_raw_event_unregister(), the should call
+ ir_raw_event_register() */
+ if (ir)
+diff --git a/drivers/media/usb/em28xx/em28xx-video.c b/drivers/media/usb/em28xx/em28xx-video.c
+index 03d5ece0319c..e0f4be8c5a19 100644
+--- a/drivers/media/usb/em28xx/em28xx-video.c
++++ b/drivers/media/usb/em28xx/em28xx-video.c
+@@ -1956,7 +1956,7 @@ static int em28xx_v4l2_fini(struct em28xx *dev)
+ if (v4l2 == NULL)
+ return 0;
+
+- em28xx_info("Closing video extension");
++ em28xx_info("Closing video extension\n");
+
+ mutex_lock(&dev->lock);
+
+@@ -2005,7 +2005,7 @@ static int em28xx_v4l2_suspend(struct em28xx *dev)
+ if (!dev->has_video)
+ return 0;
+
+- em28xx_info("Suspending video extension");
++ em28xx_info("Suspending video extension\n");
+ em28xx_stop_urbs(dev);
+ return 0;
+ }
+@@ -2018,7 +2018,7 @@ static int em28xx_v4l2_resume(struct em28xx *dev)
+ if (!dev->has_video)
+ return 0;
+
+- em28xx_info("Resuming video extension");
++ em28xx_info("Resuming video extension\n");
+ /* what do we do here */
+ return 0;
+ }
+diff --git a/drivers/misc/mei/hw-me.c b/drivers/misc/mei/hw-me.c
+index 432aec8dd3ce..350a28af98aa 100644
+--- a/drivers/misc/mei/hw-me.c
++++ b/drivers/misc/mei/hw-me.c
+@@ -242,7 +242,7 @@ static int mei_me_hw_reset(struct mei_device *dev, bool intr_enable)
+ if ((hcsr & H_RST) == H_RST) {
+ dev_warn(dev->dev, "H_RST is set = 0x%08X", hcsr);
+ hcsr &= ~H_RST;
+- mei_me_reg_write(hw, H_CSR, hcsr);
++ mei_hcsr_set(hw, hcsr);
+ hcsr = mei_hcsr_read(hw);
+ }
+
+@@ -335,6 +335,7 @@ static int mei_me_hw_ready_wait(struct mei_device *dev)
+ return -ETIME;
+ }
+
++ mei_me_hw_reset_release(dev);
+ dev->recvd_hw_ready = false;
+ return 0;
+ }
+@@ -729,9 +730,7 @@ irqreturn_t mei_me_irq_thread_handler(int irq, void *dev_id)
+ /* check if we need to start the dev */
+ if (!mei_host_is_ready(dev)) {
+ if (mei_hw_is_ready(dev)) {
+- mei_me_hw_reset_release(dev);
+ dev_dbg(dev->dev, "we need to start the dev.\n");
+-
+ dev->recvd_hw_ready = true;
+ wake_up(&dev->wait_hw_ready);
+ } else {
+diff --git a/drivers/mmc/host/sdhci-pxav3.c b/drivers/mmc/host/sdhci-pxav3.c
+index 5036d7d39529..38251da7ba32 100644
+--- a/drivers/mmc/host/sdhci-pxav3.c
++++ b/drivers/mmc/host/sdhci-pxav3.c
+@@ -112,6 +112,38 @@ static int mv_conf_mbus_windows(struct platform_device *pdev,
+ return 0;
+ }
+
++static int armada_38x_quirks(struct platform_device *pdev,
++ struct sdhci_host *host)
++{
++ struct device_node *np = pdev->dev.of_node;
++
++ host->quirks |= SDHCI_QUIRK_MISSING_CAPS;
++ /*
++ * According to erratum 'FE-2946959' both SDR50 and DDR50
++ * modes require specific clock adjustments in SDIO3
++ * Configuration register, if the adjustment is not done,
++ * remove them from the capabilities.
++ */
++ host->caps1 = sdhci_readl(host, SDHCI_CAPABILITIES_1);
++ host->caps1 &= ~(SDHCI_SUPPORT_SDR50 | SDHCI_SUPPORT_DDR50);
++
++ /*
++ * According to erratum 'ERR-7878951' Armada 38x SDHCI
++ * controller has different capabilities than the ones shown
++ * in its registers
++ */
++ host->caps = sdhci_readl(host, SDHCI_CAPABILITIES);
++ if (of_property_read_bool(np, "no-1-8-v")) {
++ host->caps &= ~SDHCI_CAN_VDD_180;
++ host->mmc->caps &= ~MMC_CAP_1_8V_DDR;
++ } else {
++ host->caps &= ~SDHCI_CAN_VDD_330;
++ }
++ host->caps1 &= ~(SDHCI_SUPPORT_SDR104 | SDHCI_USE_SDR50_TUNING);
++
++ return 0;
++}
++
+ static void pxav3_reset(struct sdhci_host *host, u8 mask)
+ {
+ struct platform_device *pdev = to_platform_device(mmc_dev(host->mmc));
+@@ -261,8 +293,8 @@ static struct sdhci_pxa_platdata *pxav3_get_mmc_pdata(struct device *dev)
+ if (!pdata)
+ return NULL;
+
+- of_property_read_u32(np, "mrvl,clk-delay-cycles", &clk_delay_cycles);
+- if (clk_delay_cycles > 0)
++ if (!of_property_read_u32(np, "mrvl,clk-delay-cycles",
++ &clk_delay_cycles))
+ pdata->clk_delay_cycles = clk_delay_cycles;
+
+ return pdata;
+@@ -295,7 +327,13 @@ static int sdhci_pxav3_probe(struct platform_device *pdev)
+ if (IS_ERR(host))
+ return PTR_ERR(host);
+
++ /* enable 1/8V DDR capable */
++ host->mmc->caps |= MMC_CAP_1_8V_DDR;
++
+ if (of_device_is_compatible(np, "marvell,armada-380-sdhci")) {
++ ret = armada_38x_quirks(pdev, host);
++ if (ret < 0)
++ goto err_clk_get;
+ ret = mv_conf_mbus_windows(pdev, mv_mbus_dram_info());
+ if (ret < 0)
+ goto err_mbus_win;
+@@ -314,9 +352,6 @@ static int sdhci_pxav3_probe(struct platform_device *pdev)
+ pltfm_host->clk = clk;
+ clk_prepare_enable(clk);
+
+- /* enable 1/8V DDR capable */
+- host->mmc->caps |= MMC_CAP_1_8V_DDR;
+-
+ match = of_match_device(of_match_ptr(sdhci_pxav3_of_match), &pdev->dev);
+ if (match) {
+ ret = mmc_of_parse(host->mmc);
+@@ -355,10 +390,11 @@ static int sdhci_pxav3_probe(struct platform_device *pdev)
+ }
+ }
+
+- pm_runtime_enable(&pdev->dev);
+- pm_runtime_get_sync(&pdev->dev);
++ pm_runtime_get_noresume(&pdev->dev);
++ pm_runtime_set_active(&pdev->dev);
+ pm_runtime_set_autosuspend_delay(&pdev->dev, PXAV3_RPM_DELAY_MS);
+ pm_runtime_use_autosuspend(&pdev->dev);
++ pm_runtime_enable(&pdev->dev);
+ pm_suspend_ignore_children(&pdev->dev, 1);
+
+ ret = sdhci_add_host(host);
+@@ -381,8 +417,8 @@ static int sdhci_pxav3_probe(struct platform_device *pdev)
+ return 0;
+
+ err_add_host:
+- pm_runtime_put_sync(&pdev->dev);
+ pm_runtime_disable(&pdev->dev);
++ pm_runtime_put_noidle(&pdev->dev);
+ err_of_parse:
+ err_cd_req:
+ clk_disable_unprepare(clk);
+diff --git a/drivers/net/wireless/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
+index b6d2683da3a9..f71c22f8beea 100644
+--- a/drivers/net/wireless/iwlwifi/mvm/mac80211.c
++++ b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
+@@ -668,9 +668,6 @@ static void iwl_mvm_cleanup_iterator(void *data, u8 *mac,
+ mvmvif->uploaded = false;
+ mvmvif->ap_sta_id = IWL_MVM_STATION_COUNT;
+
+- /* does this make sense at all? */
+- mvmvif->color++;
+-
+ spin_lock_bh(&mvm->time_event_lock);
+ iwl_mvm_te_clear_data(mvm, &mvmvif->time_event_data);
+ spin_unlock_bh(&mvm->time_event_lock);
+@@ -1014,7 +1011,7 @@ static int iwl_mvm_mac_add_interface(struct ieee80211_hw *hw,
+
+ ret = iwl_mvm_power_update_mac(mvm);
+ if (ret)
+- goto out_release;
++ goto out_remove_mac;
+
+ /* beacon filtering */
+ ret = iwl_mvm_disable_beacon_filter(mvm, vif, 0);
+diff --git a/drivers/net/wireless/iwlwifi/mvm/tx.c b/drivers/net/wireless/iwlwifi/mvm/tx.c
+index c6a517c771df..5928c9db49ce 100644
+--- a/drivers/net/wireless/iwlwifi/mvm/tx.c
++++ b/drivers/net/wireless/iwlwifi/mvm/tx.c
+@@ -902,6 +902,11 @@ int iwl_mvm_rx_ba_notif(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb,
+ sta_id = ba_notif->sta_id;
+ tid = ba_notif->tid;
+
++ if (WARN_ONCE(sta_id >= IWL_MVM_STATION_COUNT ||
++ tid >= IWL_MAX_TID_COUNT,
++ "sta_id %d tid %d", sta_id, tid))
++ return 0;
++
+ rcu_read_lock();
+
+ sta = rcu_dereference(mvm->fw_id_to_mac_id[sta_id]);
+diff --git a/drivers/net/wireless/iwlwifi/pcie/tx.c b/drivers/net/wireless/iwlwifi/pcie/tx.c
+index eb8e2984c5e9..62ea2b550832 100644
+--- a/drivers/net/wireless/iwlwifi/pcie/tx.c
++++ b/drivers/net/wireless/iwlwifi/pcie/tx.c
+@@ -722,7 +722,12 @@ void iwl_trans_pcie_tx_reset(struct iwl_trans *trans)
+ iwl_write_direct32(trans, FH_KW_MEM_ADDR_REG,
+ trans_pcie->kw.dma >> 4);
+
+- iwl_pcie_tx_start(trans, trans_pcie->scd_base_addr);
++ /*
++ * Send 0 as the scd_base_addr since the device may have be reset
++ * while we were in WoWLAN in which case SCD_SRAM_BASE_ADDR will
++ * contain garbage.
++ */
++ iwl_pcie_tx_start(trans, 0);
+ }
+
+ /*
+diff --git a/drivers/net/wireless/rtlwifi/pci.c b/drivers/net/wireless/rtlwifi/pci.c
+index c70efb9a6e78..e25faacf58b7 100644
+--- a/drivers/net/wireless/rtlwifi/pci.c
++++ b/drivers/net/wireless/rtlwifi/pci.c
+@@ -816,11 +816,8 @@ static void _rtl_pci_rx_interrupt(struct ieee80211_hw *hw)
+
+ /* get a new skb - if fail, old one will be reused */
+ new_skb = dev_alloc_skb(rtlpci->rxbuffersize);
+- if (unlikely(!new_skb)) {
+- pr_err("Allocation of new skb failed in %s\n",
+- __func__);
++ if (unlikely(!new_skb))
+ goto no_new;
+- }
+ if (rtlpriv->use_new_trx_flow) {
+ buffer_desc =
+ &rtlpci->rx_ring[rxring_idx].buffer_desc
+diff --git a/drivers/net/wireless/rtlwifi/pci.h b/drivers/net/wireless/rtlwifi/pci.h
+index 5e832306dba9..d4567d12e07e 100644
+--- a/drivers/net/wireless/rtlwifi/pci.h
++++ b/drivers/net/wireless/rtlwifi/pci.h
+@@ -325,4 +325,11 @@ static inline void pci_write32_async(struct rtl_priv *rtlpriv,
+ writel(val, (u8 __iomem *) rtlpriv->io.pci_mem_start + addr);
+ }
+
++static inline u16 calc_fifo_space(u16 rp, u16 wp)
++{
++ if (rp <= wp)
++ return RTL_PCI_MAX_RX_COUNT - 1 + rp - wp;
++ return rp - wp - 1;
++}
++
+ #endif
+diff --git a/drivers/net/wireless/rtlwifi/rtl8192ee/fw.c b/drivers/net/wireless/rtlwifi/rtl8192ee/fw.c
+index 45c128b91f7f..c5d4b8013cde 100644
+--- a/drivers/net/wireless/rtlwifi/rtl8192ee/fw.c
++++ b/drivers/net/wireless/rtlwifi/rtl8192ee/fw.c
+@@ -666,7 +666,6 @@ void rtl92ee_set_fw_rsvdpagepkt(struct ieee80211_hw *hw, bool b_dl_finished)
+ struct sk_buff *skb = NULL;
+
+ u32 totalpacketlen;
+- bool rtstatus;
+ u8 u1rsvdpageloc[5] = { 0 };
+ bool b_dlok = false;
+
+@@ -728,10 +727,7 @@ void rtl92ee_set_fw_rsvdpagepkt(struct ieee80211_hw *hw, bool b_dl_finished)
+ memcpy((u8 *)skb_put(skb, totalpacketlen),
+ &reserved_page_packet, totalpacketlen);
+
+- rtstatus = rtl_cmd_send_packet(hw, skb);
+-
+- if (rtstatus)
+- b_dlok = true;
++ b_dlok = true;
+
+ if (b_dlok) {
+ RT_TRACE(rtlpriv, COMP_POWER, DBG_LOUD ,
+diff --git a/drivers/net/wireless/rtlwifi/rtl8192ee/hw.c b/drivers/net/wireless/rtlwifi/rtl8192ee/hw.c
+index 1a87edca2c3f..b461b3128da5 100644
+--- a/drivers/net/wireless/rtlwifi/rtl8192ee/hw.c
++++ b/drivers/net/wireless/rtlwifi/rtl8192ee/hw.c
+@@ -85,29 +85,6 @@ static void _rtl92ee_enable_bcn_sub_func(struct ieee80211_hw *hw)
+ _rtl92ee_set_bcn_ctrl_reg(hw, 0, BIT(1));
+ }
+
+-static void _rtl92ee_return_beacon_queue_skb(struct ieee80211_hw *hw)
+-{
+- struct rtl_priv *rtlpriv = rtl_priv(hw);
+- struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
+- struct rtl8192_tx_ring *ring = &rtlpci->tx_ring[BEACON_QUEUE];
+- unsigned long flags;
+-
+- spin_lock_irqsave(&rtlpriv->locks.irq_th_lock, flags);
+- while (skb_queue_len(&ring->queue)) {
+- struct rtl_tx_buffer_desc *entry =
+- &ring->buffer_desc[ring->idx];
+- struct sk_buff *skb = __skb_dequeue(&ring->queue);
+-
+- pci_unmap_single(rtlpci->pdev,
+- rtlpriv->cfg->ops->get_desc(
+- (u8 *)entry, true, HW_DESC_TXBUFF_ADDR),
+- skb->len, PCI_DMA_TODEVICE);
+- kfree_skb(skb);
+- ring->idx = (ring->idx + 1) % ring->entries;
+- }
+- spin_unlock_irqrestore(&rtlpriv->locks.irq_th_lock, flags);
+-}
+-
+ static void _rtl92ee_disable_bcn_sub_func(struct ieee80211_hw *hw)
+ {
+ _rtl92ee_set_bcn_ctrl_reg(hw, BIT(1), 0);
+@@ -403,9 +380,6 @@ static void _rtl92ee_download_rsvd_page(struct ieee80211_hw *hw)
+ rtl_write_byte(rtlpriv, REG_DWBCN0_CTRL + 2,
+ bcnvalid_reg | BIT(0));
+
+- /* Return Beacon TCB */
+- _rtl92ee_return_beacon_queue_skb(hw);
+-
+ /* download rsvd page */
+ rtl92ee_set_fw_rsvdpagepkt(hw, false);
+
+@@ -1163,6 +1137,139 @@ void rtl92ee_enable_hw_security_config(struct ieee80211_hw *hw)
+ rtlpriv->cfg->ops->set_hw_reg(hw, HW_VAR_WPA_CONFIG, &sec_reg_value);
+ }
+
++static bool _rtl8192ee_check_pcie_dma_hang(struct rtl_priv *rtlpriv)
++{
++ u8 tmp;
++
++ /* write reg 0x350 Bit[26]=1. Enable debug port. */
++ tmp = rtl_read_byte(rtlpriv, REG_BACKDOOR_DBI_DATA + 3);
++ if (!(tmp & BIT(2))) {
++ rtl_write_byte(rtlpriv, REG_BACKDOOR_DBI_DATA + 3,
++ tmp | BIT(2));
++ mdelay(100); /* Suggested by DD Justin_tsai. */
++ }
++
++ /* read reg 0x350 Bit[25] if 1 : RX hang
++ * read reg 0x350 Bit[24] if 1 : TX hang
++ */
++ tmp = rtl_read_byte(rtlpriv, REG_BACKDOOR_DBI_DATA + 3);
++ if ((tmp & BIT(0)) || (tmp & BIT(1))) {
++ RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
++ "CheckPcieDMAHang8192EE(): true!!\n");
++ return true;
++ }
++ return false;
++}
++
++static void _rtl8192ee_reset_pcie_interface_dma(struct rtl_priv *rtlpriv,
++ bool mac_power_on)
++{
++ u8 tmp;
++ bool release_mac_rx_pause;
++ u8 backup_pcie_dma_pause;
++
++ RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
++ "ResetPcieInterfaceDMA8192EE()\n");
++
++ /* Revise Note: Follow the document "PCIe RX DMA Hang Reset Flow_v03"
++ * released by SD1 Alan.
++ */
++
++ /* 1. disable register write lock
++ * write 0x1C bit[1:0] = 2'h0
++ * write 0xCC bit[2] = 1'b1
++ */
++ tmp = rtl_read_byte(rtlpriv, REG_RSV_CTRL);
++ tmp &= ~(BIT(1) | BIT(0));
++ rtl_write_byte(rtlpriv, REG_RSV_CTRL, tmp);
++ tmp = rtl_read_byte(rtlpriv, REG_PMC_DBG_CTRL2);
++ tmp |= BIT(2);
++ rtl_write_byte(rtlpriv, REG_PMC_DBG_CTRL2, tmp);
++
++ /* 2. Check and pause TRX DMA
++ * write 0x284 bit[18] = 1'b1
++ * write 0x301 = 0xFF
++ */
++ tmp = rtl_read_byte(rtlpriv, REG_RXDMA_CONTROL);
++ if (tmp & BIT(2)) {
++ /* Already pause before the function for another reason. */
++ release_mac_rx_pause = false;
++ } else {
++ rtl_write_byte(rtlpriv, REG_RXDMA_CONTROL, (tmp | BIT(2)));
++ release_mac_rx_pause = true;
++ }
++
++ backup_pcie_dma_pause = rtl_read_byte(rtlpriv, REG_PCIE_CTRL_REG + 1);
++ if (backup_pcie_dma_pause != 0xFF)
++ rtl_write_byte(rtlpriv, REG_PCIE_CTRL_REG + 1, 0xFF);
++
++ if (mac_power_on) {
++ /* 3. reset TRX function
++ * write 0x100 = 0x00
++ */
++ rtl_write_byte(rtlpriv, REG_CR, 0);
++ }
++
++ /* 4. Reset PCIe DMA
++ * write 0x003 bit[0] = 0
++ */
++ tmp = rtl_read_byte(rtlpriv, REG_SYS_FUNC_EN + 1);
++ tmp &= ~(BIT(0));
++ rtl_write_byte(rtlpriv, REG_SYS_FUNC_EN + 1, tmp);
++
++ /* 5. Enable PCIe DMA
++ * write 0x003 bit[0] = 1
++ */
++ tmp = rtl_read_byte(rtlpriv, REG_SYS_FUNC_EN + 1);
++ tmp |= BIT(0);
++ rtl_write_byte(rtlpriv, REG_SYS_FUNC_EN + 1, tmp);
++
++ if (mac_power_on) {
++ /* 6. enable TRX function
++ * write 0x100 = 0xFF
++ */
++ rtl_write_byte(rtlpriv, REG_CR, 0xFF);
++
++ /* We should init LLT & RQPN and
++ * prepare Tx/Rx descrptor address later
++ * because MAC function is reset.
++ */
++ }
++
++ /* 7. Restore PCIe autoload down bit
++ * write 0xF8 bit[17] = 1'b1
++ */
++ tmp = rtl_read_byte(rtlpriv, REG_MAC_PHY_CTRL_NORMAL + 2);
++ tmp |= BIT(1);
++ rtl_write_byte(rtlpriv, REG_MAC_PHY_CTRL_NORMAL + 2, tmp);
++
++ /* In MAC power on state, BB and RF maybe in ON state,
++ * if we release TRx DMA here
++ * it will cause packets to be started to Tx/Rx,
++ * so we release Tx/Rx DMA later.
++ */
++ if (!mac_power_on) {
++ /* 8. release TRX DMA
++ * write 0x284 bit[18] = 1'b0
++ * write 0x301 = 0x00
++ */
++ if (release_mac_rx_pause) {
++ tmp = rtl_read_byte(rtlpriv, REG_RXDMA_CONTROL);
++ rtl_write_byte(rtlpriv, REG_RXDMA_CONTROL,
++ (tmp & (~BIT(2))));
++ }
++ rtl_write_byte(rtlpriv, REG_PCIE_CTRL_REG + 1,
++ backup_pcie_dma_pause);
++ }
++
++ /* 9. lock system register
++ * write 0xCC bit[2] = 1'b0
++ */
++ tmp = rtl_read_byte(rtlpriv, REG_PMC_DBG_CTRL2);
++ tmp &= ~(BIT(2));
++ rtl_write_byte(rtlpriv, REG_PMC_DBG_CTRL2, tmp);
++}
++
+ int rtl92ee_hw_init(struct ieee80211_hw *hw)
+ {
+ struct rtl_priv *rtlpriv = rtl_priv(hw);
+@@ -1188,6 +1295,13 @@ int rtl92ee_hw_init(struct ieee80211_hw *hw)
+ rtlhal->fw_ps_state = FW_PS_STATE_ALL_ON_92E;
+ }
+
++ if (_rtl8192ee_check_pcie_dma_hang(rtlpriv)) {
++ RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG, "92ee dma hang!\n");
++ _rtl8192ee_reset_pcie_interface_dma(rtlpriv,
++ rtlhal->mac_func_enable);
++ rtlhal->mac_func_enable = false;
++ }
++
+ rtstatus = _rtl92ee_init_mac(hw);
+
+ rtl_write_byte(rtlpriv, 0x577, 0x03);
+diff --git a/drivers/net/wireless/rtlwifi/rtl8192ee/reg.h b/drivers/net/wireless/rtlwifi/rtl8192ee/reg.h
+index 3f2a9596e7cd..1eaa1fab550d 100644
+--- a/drivers/net/wireless/rtlwifi/rtl8192ee/reg.h
++++ b/drivers/net/wireless/rtlwifi/rtl8192ee/reg.h
+@@ -77,9 +77,11 @@
+ #define REG_HIMRE 0x00B8
+ #define REG_HISRE 0x00BC
+
++#define REG_PMC_DBG_CTRL2 0x00CC
+ #define REG_EFUSE_ACCESS 0x00CF
+ #define REG_HPON_FSM 0x00EC
+ #define REG_SYS_CFG1 0x00F0
++#define REG_MAC_PHY_CTRL_NORMAL 0x00F8
+ #define REG_SYS_CFG2 0x00FC
+
+ #define REG_CR 0x0100
+diff --git a/drivers/net/wireless/rtlwifi/rtl8192ee/trx.c b/drivers/net/wireless/rtlwifi/rtl8192ee/trx.c
+index 2fcbef1d029f..00690040be37 100644
+--- a/drivers/net/wireless/rtlwifi/rtl8192ee/trx.c
++++ b/drivers/net/wireless/rtlwifi/rtl8192ee/trx.c
+@@ -512,6 +512,10 @@ bool rtl92ee_rx_query_desc(struct ieee80211_hw *hw,
+ struct ieee80211_hdr *hdr;
+ u32 phystatus = GET_RX_DESC_PHYST(pdesc);
+
++ if (GET_RX_STATUS_DESC_RPT_SEL(pdesc) == 0)
++ status->packet_report_type = NORMAL_RX;
++ else
++ status->packet_report_type = C2H_PACKET;
+ status->length = (u16)GET_RX_DESC_PKT_LEN(pdesc);
+ status->rx_drvinfo_size = (u8)GET_RX_DESC_DRV_INFO_SIZE(pdesc) *
+ RX_DRV_INFO_SIZE_UNIT;
+@@ -654,14 +658,7 @@ u16 rtl92ee_rx_desc_buff_remained_cnt(struct ieee80211_hw *hw, u8 queue_index)
+ if (!start_rx)
+ return 0;
+
+- if ((last_read_point > (RX_DESC_NUM_92E / 2)) &&
+- (read_point <= (RX_DESC_NUM_92E / 2))) {
+- remind_cnt = RX_DESC_NUM_92E - write_point;
+- } else {
+- remind_cnt = (read_point >= write_point) ?
+- (read_point - write_point) :
+- (RX_DESC_NUM_92E - write_point + read_point);
+- }
++ remind_cnt = calc_fifo_space(read_point, write_point);
+
+ if (remind_cnt == 0)
+ return 0;
+@@ -1207,8 +1204,7 @@ bool rtl92ee_is_tx_desc_closed(struct ieee80211_hw *hw, u8 hw_queue, u16 index)
+ static u8 stop_report_cnt;
+ struct rtl8192_tx_ring *ring = &rtlpci->tx_ring[hw_queue];
+
+- /*checking Read/Write Point each interrupt wastes CPU */
+- if (stop_report_cnt > 15 || !rtlpriv->link_info.busytraffic) {
++ {
+ u16 point_diff = 0;
+ u16 cur_tx_rp, cur_tx_wp;
+ u32 tmpu32 = 0;
+diff --git a/drivers/net/wireless/rtlwifi/rtl8192ee/trx.h b/drivers/net/wireless/rtlwifi/rtl8192ee/trx.h
+index 6f9be1c7515c..8effef9b13dd 100644
+--- a/drivers/net/wireless/rtlwifi/rtl8192ee/trx.h
++++ b/drivers/net/wireless/rtlwifi/rtl8192ee/trx.h
+@@ -542,6 +542,8 @@
+ LE_BITS_TO_4BYTE(__pdesc+8, 12, 4)
+ #define GET_RX_DESC_RX_IS_QOS(__pdesc) \
+ LE_BITS_TO_4BYTE(__pdesc+8, 16, 1)
++#define GET_RX_STATUS_DESC_RPT_SEL(__pdesc) \
++ LE_BITS_TO_4BYTE(__pdesc+8, 28, 1)
+
+ #define GET_RX_DESC_RXMCS(__pdesc) \
+ LE_BITS_TO_4BYTE(__pdesc+12, 0, 7)
+diff --git a/drivers/pci/pci-driver.c b/drivers/pci/pci-driver.c
+index 2b3c89425bb5..b720e7816a72 100644
+--- a/drivers/pci/pci-driver.c
++++ b/drivers/pci/pci-driver.c
+@@ -1389,7 +1389,7 @@ static int pci_uevent(struct device *dev, struct kobj_uevent_env *env)
+ if (add_uevent_var(env, "PCI_SLOT_NAME=%s", pci_name(pdev)))
+ return -ENOMEM;
+
+- if (add_uevent_var(env, "MODALIAS=pci:v%08Xd%08Xsv%08Xsd%08Xbc%02Xsc%02Xi%02x",
++ if (add_uevent_var(env, "MODALIAS=pci:v%08Xd%08Xsv%08Xsd%08Xbc%02Xsc%02Xi%02X",
+ pdev->vendor, pdev->device,
+ pdev->subsystem_vendor, pdev->subsystem_device,
+ (u8)(pdev->class >> 16), (u8)(pdev->class >> 8),
+diff --git a/drivers/pci/rom.c b/drivers/pci/rom.c
+index f955edb9bea7..eb0ad530dc43 100644
+--- a/drivers/pci/rom.c
++++ b/drivers/pci/rom.c
+@@ -71,6 +71,7 @@ size_t pci_get_rom_size(struct pci_dev *pdev, void __iomem *rom, size_t size)
+ {
+ void __iomem *image;
+ int last_image;
++ unsigned length;
+
+ image = rom;
+ do {
+@@ -93,9 +94,9 @@ size_t pci_get_rom_size(struct pci_dev *pdev, void __iomem *rom, size_t size)
+ if (readb(pds + 3) != 'R')
+ break;
+ last_image = readb(pds + 21) & 0x80;
+- /* this length is reliable */
+- image += readw(pds + 16) * 512;
+- } while (!last_image);
++ length = readw(pds + 16);
++ image += length * 512;
++ } while (length && !last_image);
+
+ /* never return a size larger than the PCI resource window */
+ /* there are known ROMs that get the size wrong */
+diff --git a/drivers/platform/x86/samsung-laptop.c b/drivers/platform/x86/samsung-laptop.c
+index ff765d8e1a09..ce364a41842a 100644
+--- a/drivers/platform/x86/samsung-laptop.c
++++ b/drivers/platform/x86/samsung-laptop.c
+@@ -353,6 +353,7 @@ struct samsung_quirks {
+ bool broken_acpi_video;
+ bool four_kbd_backlight_levels;
+ bool enable_kbd_backlight;
++ bool use_native_backlight;
+ };
+
+ static struct samsung_quirks samsung_unknown = {};
+@@ -361,6 +362,10 @@ static struct samsung_quirks samsung_broken_acpi_video = {
+ .broken_acpi_video = true,
+ };
+
++static struct samsung_quirks samsung_use_native_backlight = {
++ .use_native_backlight = true,
++};
++
+ static struct samsung_quirks samsung_np740u3e = {
+ .four_kbd_backlight_levels = true,
+ .enable_kbd_backlight = true,
+@@ -1507,7 +1512,7 @@ static struct dmi_system_id __initdata samsung_dmi_table[] = {
+ DMI_MATCH(DMI_PRODUCT_NAME, "N150P"),
+ DMI_MATCH(DMI_BOARD_NAME, "N150P"),
+ },
+- .driver_data = &samsung_broken_acpi_video,
++ .driver_data = &samsung_use_native_backlight,
+ },
+ {
+ .callback = samsung_dmi_matched,
+@@ -1517,7 +1522,7 @@ static struct dmi_system_id __initdata samsung_dmi_table[] = {
+ DMI_MATCH(DMI_PRODUCT_NAME, "N145P/N250P/N260P"),
+ DMI_MATCH(DMI_BOARD_NAME, "N145P/N250P/N260P"),
+ },
+- .driver_data = &samsung_broken_acpi_video,
++ .driver_data = &samsung_use_native_backlight,
+ },
+ {
+ .callback = samsung_dmi_matched,
+@@ -1557,7 +1562,7 @@ static struct dmi_system_id __initdata samsung_dmi_table[] = {
+ DMI_MATCH(DMI_PRODUCT_NAME, "N250P"),
+ DMI_MATCH(DMI_BOARD_NAME, "N250P"),
+ },
+- .driver_data = &samsung_broken_acpi_video,
++ .driver_data = &samsung_use_native_backlight,
+ },
+ {
+ .callback = samsung_dmi_matched,
+@@ -1616,6 +1621,15 @@ static int __init samsung_init(void)
+ pr_info("Disabling ACPI video driver\n");
+ acpi_video_unregister();
+ }
++
++ if (samsung->quirks->use_native_backlight) {
++ pr_info("Using native backlight driver\n");
++ /* Tell acpi-video to not handle the backlight */
++ acpi_video_dmi_promote_vendor();
++ acpi_video_unregister();
++ /* And also do not handle it ourselves */
++ samsung->handle_backlight = false;
++ }
+ #endif
+
+ ret = samsung_platform_init(samsung);
+diff --git a/drivers/power/88pm860x_charger.c b/drivers/power/88pm860x_charger.c
+index de029bbc1cc1..5ccca8743ce6 100644
+--- a/drivers/power/88pm860x_charger.c
++++ b/drivers/power/88pm860x_charger.c
+@@ -711,6 +711,7 @@ static int pm860x_charger_probe(struct platform_device *pdev)
+ return 0;
+
+ out_irq:
++ power_supply_unregister(&info->usb);
+ while (--i >= 0)
+ free_irq(info->irq[i], info);
+ out:
+diff --git a/drivers/power/bq24190_charger.c b/drivers/power/bq24190_charger.c
+index ad3ff8fbfbbb..e4c95e1a6733 100644
+--- a/drivers/power/bq24190_charger.c
++++ b/drivers/power/bq24190_charger.c
+@@ -929,7 +929,7 @@ static void bq24190_charger_init(struct power_supply *charger)
+ charger->properties = bq24190_charger_properties;
+ charger->num_properties = ARRAY_SIZE(bq24190_charger_properties);
+ charger->supplied_to = bq24190_charger_supplied_to;
+- charger->num_supplies = ARRAY_SIZE(bq24190_charger_supplied_to);
++ charger->num_supplicants = ARRAY_SIZE(bq24190_charger_supplied_to);
+ charger->get_property = bq24190_charger_get_property;
+ charger->set_property = bq24190_charger_set_property;
+ charger->property_is_writeable = bq24190_charger_property_is_writeable;
+diff --git a/drivers/power/gpio-charger.c b/drivers/power/gpio-charger.c
+index 7536933d0ab9..e5deb11bf1d5 100644
+--- a/drivers/power/gpio-charger.c
++++ b/drivers/power/gpio-charger.c
+@@ -168,7 +168,7 @@ static int gpio_charger_suspend(struct device *dev)
+
+ if (device_may_wakeup(dev))
+ gpio_charger->wakeup_enabled =
+- enable_irq_wake(gpio_charger->irq);
++ !enable_irq_wake(gpio_charger->irq);
+
+ return 0;
+ }
+@@ -178,7 +178,7 @@ static int gpio_charger_resume(struct device *dev)
+ struct platform_device *pdev = to_platform_device(dev);
+ struct gpio_charger *gpio_charger = platform_get_drvdata(pdev);
+
+- if (gpio_charger->wakeup_enabled)
++ if (device_may_wakeup(dev) && gpio_charger->wakeup_enabled)
+ disable_irq_wake(gpio_charger->irq);
+ power_supply_changed(&gpio_charger->charger);
+
+diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c
+index 5e881e5e67b6..6e503802947a 100644
+--- a/drivers/scsi/megaraid/megaraid_sas_base.c
++++ b/drivers/scsi/megaraid/megaraid_sas_base.c
+@@ -3556,7 +3556,6 @@ static int megasas_create_frame_pool(struct megasas_instance *instance)
+ int i;
+ u32 max_cmd;
+ u32 sge_sz;
+- u32 sgl_sz;
+ u32 total_sz;
+ u32 frame_count;
+ struct megasas_cmd *cmd;
+@@ -3575,24 +3574,23 @@ static int megasas_create_frame_pool(struct megasas_instance *instance)
+ }
+
+ /*
+- * Calculated the number of 64byte frames required for SGL
+- */
+- sgl_sz = sge_sz * instance->max_num_sge;
+- frame_count = (sgl_sz + MEGAMFI_FRAME_SIZE - 1) / MEGAMFI_FRAME_SIZE;
+- frame_count = 15;
+-
+- /*
+- * We need one extra frame for the MFI command
++ * For MFI controllers.
++ * max_num_sge = 60
++ * max_sge_sz = 16 byte (sizeof megasas_sge_skinny)
++ * Total 960 byte (15 MFI frame of 64 byte)
++ *
++ * Fusion adapter require only 3 extra frame.
++ * max_num_sge = 16 (defined as MAX_IOCTL_SGE)
++ * max_sge_sz = 12 byte (sizeof megasas_sge64)
++ * Total 192 byte (3 MFI frame of 64 byte)
+ */
+- frame_count++;
+-
++ frame_count = instance->ctrl_context ? (3 + 1) : (15 + 1);
+ total_sz = MEGAMFI_FRAME_SIZE * frame_count;
+ /*
+ * Use DMA pool facility provided by PCI layer
+ */
+ instance->frame_dma_pool = pci_pool_create("megasas frame pool",
+- instance->pdev, total_sz, 64,
+- 0);
++ instance->pdev, total_sz, 256, 0);
+
+ if (!instance->frame_dma_pool) {
+ printk(KERN_DEBUG "megasas: failed to setup frame pool\n");
+diff --git a/drivers/scsi/megaraid/megaraid_sas_fp.c b/drivers/scsi/megaraid/megaraid_sas_fp.c
+index 0f66d0ef0b26..7d2d424bc8d0 100644
+--- a/drivers/scsi/megaraid/megaraid_sas_fp.c
++++ b/drivers/scsi/megaraid/megaraid_sas_fp.c
+@@ -170,6 +170,7 @@ void MR_PopulateDrvRaidMap(struct megasas_instance *instance)
+ struct MR_FW_RAID_MAP_ALL *fw_map_old = NULL;
+ struct MR_FW_RAID_MAP *pFwRaidMap = NULL;
+ int i;
++ u16 ld_count;
+
+
+ struct MR_DRV_RAID_MAP_ALL *drv_map =
+@@ -189,9 +190,10 @@ void MR_PopulateDrvRaidMap(struct megasas_instance *instance)
+ fw_map_old = (struct MR_FW_RAID_MAP_ALL *)
+ fusion->ld_map[(instance->map_id & 1)];
+ pFwRaidMap = &fw_map_old->raidMap;
++ ld_count = (u16)le32_to_cpu(pFwRaidMap->ldCount);
+
+ #if VD_EXT_DEBUG
+- for (i = 0; i < le16_to_cpu(pFwRaidMap->ldCount); i++) {
++ for (i = 0; i < ld_count; i++) {
+ dev_dbg(&instance->pdev->dev, "(%d) :Index 0x%x "
+ "Target Id 0x%x Seq Num 0x%x Size 0/%llx\n",
+ instance->unique_id, i,
+@@ -203,12 +205,15 @@ void MR_PopulateDrvRaidMap(struct megasas_instance *instance)
+
+ memset(drv_map, 0, fusion->drv_map_sz);
+ pDrvRaidMap->totalSize = pFwRaidMap->totalSize;
+- pDrvRaidMap->ldCount = (__le16)pFwRaidMap->ldCount;
++ pDrvRaidMap->ldCount = (__le16)cpu_to_le16(ld_count);
+ pDrvRaidMap->fpPdIoTimeoutSec = pFwRaidMap->fpPdIoTimeoutSec;
+ for (i = 0; i < MAX_RAIDMAP_LOGICAL_DRIVES + MAX_RAIDMAP_VIEWS; i++)
+ pDrvRaidMap->ldTgtIdToLd[i] =
+ (u8)pFwRaidMap->ldTgtIdToLd[i];
+- for (i = 0; i < le16_to_cpu(pDrvRaidMap->ldCount); i++) {
++ for (i = (MAX_RAIDMAP_LOGICAL_DRIVES + MAX_RAIDMAP_VIEWS);
++ i < MAX_LOGICAL_DRIVES_EXT; i++)
++ pDrvRaidMap->ldTgtIdToLd[i] = 0xff;
++ for (i = 0; i < ld_count; i++) {
+ pDrvRaidMap->ldSpanMap[i] = pFwRaidMap->ldSpanMap[i];
+ #if VD_EXT_DEBUG
+ dev_dbg(&instance->pdev->dev,
+@@ -250,7 +255,7 @@ u8 MR_ValidateMapInfo(struct megasas_instance *instance)
+ struct LD_LOAD_BALANCE_INFO *lbInfo;
+ PLD_SPAN_INFO ldSpanInfo;
+ struct MR_LD_RAID *raid;
+- int ldCount, num_lds;
++ u16 ldCount, num_lds;
+ u16 ld;
+ u32 expected_size;
+
+@@ -354,7 +359,7 @@ static int getSpanInfo(struct MR_DRV_RAID_MAP_ALL *map,
+
+ for (ldCount = 0; ldCount < MAX_LOGICAL_DRIVES_EXT; ldCount++) {
+ ld = MR_TargetIdToLdGet(ldCount, map);
+- if (ld >= MAX_LOGICAL_DRIVES_EXT)
++ if (ld >= (MAX_LOGICAL_DRIVES_EXT - 1))
+ continue;
+ raid = MR_LdRaidGet(ld, map);
+ dev_dbg(&instance->pdev->dev, "LD %x: span_depth=%x\n",
+@@ -1155,7 +1160,7 @@ void mr_update_span_set(struct MR_DRV_RAID_MAP_ALL *map,
+
+ for (ldCount = 0; ldCount < MAX_LOGICAL_DRIVES_EXT; ldCount++) {
+ ld = MR_TargetIdToLdGet(ldCount, map);
+- if (ld >= MAX_LOGICAL_DRIVES_EXT)
++ if (ld >= (MAX_LOGICAL_DRIVES_EXT - 1))
+ continue;
+ raid = MR_LdRaidGet(ld, map);
+ for (element = 0; element < MAX_QUAD_DEPTH; element++) {
+diff --git a/drivers/scsi/megaraid/megaraid_sas_fusion.c b/drivers/scsi/megaraid/megaraid_sas_fusion.c
+index 9d9c27cd4687..554395634592 100644
+--- a/drivers/scsi/megaraid/megaraid_sas_fusion.c
++++ b/drivers/scsi/megaraid/megaraid_sas_fusion.c
+@@ -101,6 +101,8 @@ megasas_enable_intr_fusion(struct megasas_instance *instance)
+ {
+ struct megasas_register_set __iomem *regs;
+ regs = instance->reg_set;
++
++ instance->mask_interrupts = 0;
+ /* For Thunderbolt/Invader also clear intr on enable */
+ writel(~0, ®s->outbound_intr_status);
+ readl(®s->outbound_intr_status);
+@@ -109,7 +111,6 @@ megasas_enable_intr_fusion(struct megasas_instance *instance)
+
+ /* Dummy readl to force pci flush */
+ readl(®s->outbound_intr_mask);
+- instance->mask_interrupts = 0;
+ }
+
+ /**
+@@ -696,12 +697,11 @@ megasas_ioc_init_fusion(struct megasas_instance *instance)
+ cpu_to_le32(lower_32_bits(ioc_init_handle));
+ init_frame->data_xfer_len = cpu_to_le32(sizeof(struct MPI2_IOC_INIT_REQUEST));
+
+- req_desc.Words = 0;
++ req_desc.u.low = cpu_to_le32(lower_32_bits(cmd->frame_phys_addr));
++ req_desc.u.high = cpu_to_le32(upper_32_bits(cmd->frame_phys_addr));
+ req_desc.MFAIo.RequestFlags =
+ (MEGASAS_REQ_DESCRIPT_FLAGS_MFA <<
+- MEGASAS_REQ_DESCRIPT_FLAGS_TYPE_SHIFT);
+- cpu_to_le32s((u32 *)&req_desc.MFAIo);
+- req_desc.Words |= cpu_to_le64(cmd->frame_phys_addr);
++ MEGASAS_REQ_DESCRIPT_FLAGS_TYPE_SHIFT);
+
+ /*
+ * disable the intr before firing the init frame
+@@ -1753,9 +1753,19 @@ megasas_build_dcdb_fusion(struct megasas_instance *instance,
+ if (scmd->device->channel < MEGASAS_MAX_PD_CHANNELS)
+ goto NonFastPath;
+
++ /*
++ * For older firmware, Driver should not access ldTgtIdToLd
++ * beyond index 127 and for Extended VD firmware, ldTgtIdToLd
++ * should not go beyond 255.
++ */
++
++ if ((!fusion->fast_path_io) ||
++ (device_id >= instance->fw_supported_vd_count))
++ goto NonFastPath;
++
+ ld = MR_TargetIdToLdGet(device_id, local_map_ptr);
+- if ((ld >= instance->fw_supported_vd_count) ||
+- (!fusion->fast_path_io))
++
++ if (ld >= instance->fw_supported_vd_count)
+ goto NonFastPath;
+
+ raid = MR_LdRaidGet(ld, local_map_ptr);
+diff --git a/drivers/scsi/megaraid/megaraid_sas_fusion.h b/drivers/scsi/megaraid/megaraid_sas_fusion.h
+index 0d183d521bdd..a7f216f27ae3 100644
+--- a/drivers/scsi/megaraid/megaraid_sas_fusion.h
++++ b/drivers/scsi/megaraid/megaraid_sas_fusion.h
+@@ -304,14 +304,9 @@ struct MPI2_RAID_SCSI_IO_REQUEST {
+ * MPT RAID MFA IO Descriptor.
+ */
+ struct MEGASAS_RAID_MFA_IO_REQUEST_DESCRIPTOR {
+-#if defined(__BIG_ENDIAN_BITFIELD)
+- u32 MessageAddress1:24; /* bits 31:8*/
+- u32 RequestFlags:8;
+-#else
+ u32 RequestFlags:8;
+- u32 MessageAddress1:24; /* bits 31:8*/
+-#endif
+- u32 MessageAddress2; /* bits 61:32 */
++ u32 MessageAddress1:24;
++ u32 MessageAddress2;
+ };
+
+ /* Default Request Descriptor */
+diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
+index 60354449d9ed..843594c2583d 100644
+--- a/drivers/scsi/sg.c
++++ b/drivers/scsi/sg.c
+@@ -1376,6 +1376,17 @@ sg_rq_end_io(struct request *rq, int uptodate)
+ }
+ /* Rely on write phase to clean out srp status values, so no "else" */
+
++ /*
++ * Free the request as soon as it is complete so that its resources
++ * can be reused without waiting for userspace to read() the
++ * result. But keep the associated bio (if any) around until
++ * blk_rq_unmap_user() can be called from user context.
++ */
++ srp->rq = NULL;
++ if (rq->cmd != rq->__cmd)
++ kfree(rq->cmd);
++ __blk_put_request(rq->q, rq);
++
+ write_lock_irqsave(&sfp->rq_list_lock, iflags);
+ if (unlikely(srp->orphan)) {
+ if (sfp->keep_orphan)
+@@ -1710,7 +1721,22 @@ sg_start_req(Sg_request *srp, unsigned char *cmd)
+ return -ENOMEM;
+ }
+
+- rq = blk_get_request(q, rw, GFP_ATOMIC);
++ /*
++ * NOTE
++ *
++ * With scsi-mq enabled, there are a fixed number of preallocated
++ * requests equal in number to shost->can_queue. If all of the
++ * preallocated requests are already in use, then using GFP_ATOMIC with
++ * blk_get_request() will return -EWOULDBLOCK, whereas using GFP_KERNEL
++ * will cause blk_get_request() to sleep until an active command
++ * completes, freeing up a request. Neither option is ideal, but
++ * GFP_KERNEL is the better choice to prevent userspace from getting an
++ * unexpected EWOULDBLOCK.
++ *
++ * With scsi-mq disabled, blk_get_request() with GFP_KERNEL usually
++ * does not sleep except under memory pressure.
++ */
++ rq = blk_get_request(q, rw, GFP_KERNEL);
+ if (IS_ERR(rq)) {
+ kfree(long_cmdp);
+ return PTR_ERR(rq);
+@@ -1803,10 +1829,10 @@ sg_finish_rem_req(Sg_request *srp)
+ SCSI_LOG_TIMEOUT(4, sg_printk(KERN_INFO, sfp->parentdp,
+ "sg_finish_rem_req: res_used=%d\n",
+ (int) srp->res_used));
+- if (srp->rq) {
+- if (srp->bio)
+- ret = blk_rq_unmap_user(srp->bio);
++ if (srp->bio)
++ ret = blk_rq_unmap_user(srp->bio);
+
++ if (srp->rq) {
+ if (srp->rq->cmd != srp->rq->__cmd)
+ kfree(srp->rq->cmd);
+ blk_put_request(srp->rq);
+diff --git a/drivers/target/iscsi/iscsi_target_tq.c b/drivers/target/iscsi/iscsi_target_tq.c
+index 601e9cc61e98..bb2890e79ca0 100644
+--- a/drivers/target/iscsi/iscsi_target_tq.c
++++ b/drivers/target/iscsi/iscsi_target_tq.c
+@@ -24,36 +24,22 @@
+ #include "iscsi_target_tq.h"
+ #include "iscsi_target.h"
+
+-static LIST_HEAD(active_ts_list);
+ static LIST_HEAD(inactive_ts_list);
+-static DEFINE_SPINLOCK(active_ts_lock);
+ static DEFINE_SPINLOCK(inactive_ts_lock);
+ static DEFINE_SPINLOCK(ts_bitmap_lock);
+
+-static void iscsi_add_ts_to_active_list(struct iscsi_thread_set *ts)
+-{
+- spin_lock(&active_ts_lock);
+- list_add_tail(&ts->ts_list, &active_ts_list);
+- iscsit_global->active_ts++;
+- spin_unlock(&active_ts_lock);
+-}
+-
+ static void iscsi_add_ts_to_inactive_list(struct iscsi_thread_set *ts)
+ {
++ if (!list_empty(&ts->ts_list)) {
++ WARN_ON(1);
++ return;
++ }
+ spin_lock(&inactive_ts_lock);
+ list_add_tail(&ts->ts_list, &inactive_ts_list);
+ iscsit_global->inactive_ts++;
+ spin_unlock(&inactive_ts_lock);
+ }
+
+-static void iscsi_del_ts_from_active_list(struct iscsi_thread_set *ts)
+-{
+- spin_lock(&active_ts_lock);
+- list_del(&ts->ts_list);
+- iscsit_global->active_ts--;
+- spin_unlock(&active_ts_lock);
+-}
+-
+ static struct iscsi_thread_set *iscsi_get_ts_from_inactive_list(void)
+ {
+ struct iscsi_thread_set *ts;
+@@ -66,7 +52,7 @@ static struct iscsi_thread_set *iscsi_get_ts_from_inactive_list(void)
+
+ ts = list_first_entry(&inactive_ts_list, struct iscsi_thread_set, ts_list);
+
+- list_del(&ts->ts_list);
++ list_del_init(&ts->ts_list);
+ iscsit_global->inactive_ts--;
+ spin_unlock(&inactive_ts_lock);
+
+@@ -204,8 +190,6 @@ static void iscsi_deallocate_extra_thread_sets(void)
+
+ void iscsi_activate_thread_set(struct iscsi_conn *conn, struct iscsi_thread_set *ts)
+ {
+- iscsi_add_ts_to_active_list(ts);
+-
+ spin_lock_bh(&ts->ts_state_lock);
+ conn->thread_set = ts;
+ ts->conn = conn;
+@@ -397,7 +381,6 @@ struct iscsi_conn *iscsi_rx_thread_pre_handler(struct iscsi_thread_set *ts)
+
+ if (ts->delay_inactive && (--ts->thread_count == 0)) {
+ spin_unlock_bh(&ts->ts_state_lock);
+- iscsi_del_ts_from_active_list(ts);
+
+ if (!iscsit_global->in_shutdown)
+ iscsi_deallocate_extra_thread_sets();
+@@ -452,7 +435,6 @@ struct iscsi_conn *iscsi_tx_thread_pre_handler(struct iscsi_thread_set *ts)
+
+ if (ts->delay_inactive && (--ts->thread_count == 0)) {
+ spin_unlock_bh(&ts->ts_state_lock);
+- iscsi_del_ts_from_active_list(ts);
+
+ if (!iscsit_global->in_shutdown)
+ iscsi_deallocate_extra_thread_sets();
+diff --git a/drivers/tty/pty.c b/drivers/tty/pty.c
+index 7c4447a5c0f4..082304dcbe8c 100644
+--- a/drivers/tty/pty.c
++++ b/drivers/tty/pty.c
+@@ -210,6 +210,9 @@ static int pty_signal(struct tty_struct *tty, int sig)
+ unsigned long flags;
+ struct pid *pgrp;
+
++ if (sig != SIGINT && sig != SIGQUIT && sig != SIGTSTP)
++ return -EINVAL;
++
+ if (tty->link) {
+ spin_lock_irqsave(&tty->link->ctrl_lock, flags);
+ pgrp = get_pid(tty->link->pgrp);
+diff --git a/drivers/tty/serial/atmel_serial.c b/drivers/tty/serial/atmel_serial.c
+index edde3eca055d..6ee5c6cefac0 100644
+--- a/drivers/tty/serial/atmel_serial.c
++++ b/drivers/tty/serial/atmel_serial.c
+@@ -2577,7 +2577,7 @@ static int atmel_serial_probe(struct platform_device *pdev)
+
+ ret = atmel_init_port(port, pdev);
+ if (ret)
+- goto err;
++ goto err_clear_bit;
+
+ if (!atmel_use_pdc_rx(&port->uart)) {
+ ret = -ENOMEM;
+@@ -2626,6 +2626,8 @@ err_alloc_ring:
+ clk_put(port->clk);
+ port->clk = NULL;
+ }
++err_clear_bit:
++ clear_bit(port->uart.line, atmel_ports_in_use);
+ err:
+ return ret;
+ }
+diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c
+index 6dd53af546a3..eb9bc7e1dbaa 100644
+--- a/drivers/tty/serial/fsl_lpuart.c
++++ b/drivers/tty/serial/fsl_lpuart.c
+@@ -506,9 +506,6 @@ static inline void lpuart_prepare_rx(struct lpuart_port *sport)
+
+ spin_lock_irqsave(&sport->port.lock, flags);
+
+- init_timer(&sport->lpuart_timer);
+- sport->lpuart_timer.function = lpuart_timer_func;
+- sport->lpuart_timer.data = (unsigned long)sport;
+ sport->lpuart_timer.expires = jiffies + sport->dma_rx_timeout;
+ add_timer(&sport->lpuart_timer);
+
+@@ -758,18 +755,18 @@ out:
+ static irqreturn_t lpuart_int(int irq, void *dev_id)
+ {
+ struct lpuart_port *sport = dev_id;
+- unsigned char sts;
++ unsigned char sts, crdma;
+
+ sts = readb(sport->port.membase + UARTSR1);
++ crdma = readb(sport->port.membase + UARTCR5);
+
+- if (sts & UARTSR1_RDRF) {
++ if (sts & UARTSR1_RDRF && !(crdma & UARTCR5_RDMAS)) {
+ if (sport->lpuart_dma_use)
+ lpuart_prepare_rx(sport);
+ else
+ lpuart_rxint(irq, dev_id);
+ }
+- if (sts & UARTSR1_TDRE &&
+- !(readb(sport->port.membase + UARTCR5) & UARTCR5_TDMAS)) {
++ if (sts & UARTSR1_TDRE && !(crdma & UARTCR5_TDMAS)) {
+ if (sport->lpuart_dma_use)
+ lpuart_pio_tx(sport);
+ else
+@@ -1106,7 +1103,10 @@ static int lpuart_startup(struct uart_port *port)
+ sport->lpuart_dma_use = false;
+ } else {
+ sport->lpuart_dma_use = true;
++ setup_timer(&sport->lpuart_timer, lpuart_timer_func,
++ (unsigned long)sport);
+ temp = readb(port->membase + UARTCR5);
++ temp &= ~UARTCR5_RDMAS;
+ writeb(temp | UARTCR5_TDMAS, port->membase + UARTCR5);
+ }
+
+@@ -1180,6 +1180,8 @@ static void lpuart_shutdown(struct uart_port *port)
+ devm_free_irq(port->dev, port->irq, sport);
+
+ if (sport->lpuart_dma_use) {
++ del_timer_sync(&sport->lpuart_timer);
++
+ lpuart_dma_tx_free(port);
+ lpuart_dma_rx_free(port);
+ }
+diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c
+index b33b00b386de..53c25bca7d05 100644
+--- a/drivers/tty/vt/vt.c
++++ b/drivers/tty/vt/vt.c
+@@ -498,6 +498,7 @@ void invert_screen(struct vc_data *vc, int offset, int count, int viewed)
+ #endif
+ if (DO_UPDATE(vc))
+ do_update_region(vc, (unsigned long) p, count);
++ notify_update(vc);
+ }
+
+ /* used by selection: complement pointer position */
+@@ -514,6 +515,7 @@ void complement_pos(struct vc_data *vc, int offset)
+ scr_writew(old, screenpos(vc, old_offset, 1));
+ if (DO_UPDATE(vc))
+ vc->vc_sw->con_putc(vc, old, oldy, oldx);
++ notify_update(vc);
+ }
+
+ old_offset = offset;
+@@ -531,8 +533,8 @@ void complement_pos(struct vc_data *vc, int offset)
+ oldy = (offset >> 1) / vc->vc_cols;
+ vc->vc_sw->con_putc(vc, new, oldy, oldx);
+ }
++ notify_update(vc);
+ }
+-
+ }
+
+ static void insert_char(struct vc_data *vc, unsigned int nr)
+diff --git a/drivers/usb/core/buffer.c b/drivers/usb/core/buffer.c
+index 684ef70dc09d..506b969ea7fd 100644
+--- a/drivers/usb/core/buffer.c
++++ b/drivers/usb/core/buffer.c
+@@ -22,17 +22,25 @@
+ */
+
+ /* FIXME tune these based on pool statistics ... */
+-static const size_t pool_max[HCD_BUFFER_POOLS] = {
+- /* platforms without dma-friendly caches might need to
+- * prevent cacheline sharing...
+- */
+- 32,
+- 128,
+- 512,
+- PAGE_SIZE / 2
+- /* bigger --> allocate pages */
++static size_t pool_max[HCD_BUFFER_POOLS] = {
++ 32, 128, 512, 2048,
+ };
+
++void __init usb_init_pool_max(void)
++{
++ /*
++ * The pool_max values must never be smaller than
++ * ARCH_KMALLOC_MINALIGN.
++ */
++ if (ARCH_KMALLOC_MINALIGN <= 32)
++ ; /* Original value is okay */
++ else if (ARCH_KMALLOC_MINALIGN <= 64)
++ pool_max[0] = 64;
++ else if (ARCH_KMALLOC_MINALIGN <= 128)
++ pool_max[0] = 0; /* Don't use this pool */
++ else
++ BUILD_BUG(); /* We don't allow this */
++}
+
+ /* SETUP primitives */
+
+diff --git a/drivers/usb/core/driver.c b/drivers/usb/core/driver.c
+index 9bffd26cea05..d7a6d8bc510b 100644
+--- a/drivers/usb/core/driver.c
++++ b/drivers/usb/core/driver.c
+@@ -275,21 +275,6 @@ static int usb_unbind_device(struct device *dev)
+ return 0;
+ }
+
+-/*
+- * Cancel any pending scheduled resets
+- *
+- * [see usb_queue_reset_device()]
+- *
+- * Called after unconfiguring / when releasing interfaces. See
+- * comments in __usb_queue_reset_device() regarding
+- * udev->reset_running.
+- */
+-static void usb_cancel_queued_reset(struct usb_interface *iface)
+-{
+- if (iface->reset_running == 0)
+- cancel_work_sync(&iface->reset_ws);
+-}
+-
+ /* called from driver core with dev locked */
+ static int usb_probe_interface(struct device *dev)
+ {
+@@ -380,7 +365,6 @@ static int usb_probe_interface(struct device *dev)
+ usb_set_intfdata(intf, NULL);
+ intf->needs_remote_wakeup = 0;
+ intf->condition = USB_INTERFACE_UNBOUND;
+- usb_cancel_queued_reset(intf);
+
+ /* If the LPM disable succeeded, balance the ref counts. */
+ if (!lpm_disable_error)
+@@ -425,7 +409,6 @@ static int usb_unbind_interface(struct device *dev)
+ usb_disable_interface(udev, intf, false);
+
+ driver->disconnect(intf);
+- usb_cancel_queued_reset(intf);
+
+ /* Free streams */
+ for (i = 0, j = 0; i < intf->cur_altsetting->desc.bNumEndpoints; i++) {
+@@ -1801,6 +1784,18 @@ static int autosuspend_check(struct usb_device *udev)
+ dev_dbg(&udev->dev, "remote wakeup needed for autosuspend\n");
+ return -EOPNOTSUPP;
+ }
++
++ /*
++ * If the device is a direct child of the root hub and the HCD
++ * doesn't handle wakeup requests, don't allow autosuspend when
++ * wakeup is needed.
++ */
++ if (w && udev->parent == udev->bus->root_hub &&
++ bus_to_hcd(udev->bus)->cant_recv_wakeups) {
++ dev_dbg(&udev->dev, "HCD doesn't handle wakeup requests\n");
++ return -EOPNOTSUPP;
++ }
++
+ udev->do_remote_wakeup = w;
+ return 0;
+ }
+diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c
+index a6efb4184f2b..0009fc847eee 100644
+--- a/drivers/usb/core/hcd.c
++++ b/drivers/usb/core/hcd.c
+@@ -1618,6 +1618,7 @@ static int unlink1(struct usb_hcd *hcd, struct urb *urb, int status)
+ int usb_hcd_unlink_urb (struct urb *urb, int status)
+ {
+ struct usb_hcd *hcd;
++ struct usb_device *udev = urb->dev;
+ int retval = -EIDRM;
+ unsigned long flags;
+
+@@ -1629,20 +1630,19 @@ int usb_hcd_unlink_urb (struct urb *urb, int status)
+ spin_lock_irqsave(&hcd_urb_unlink_lock, flags);
+ if (atomic_read(&urb->use_count) > 0) {
+ retval = 0;
+- usb_get_dev(urb->dev);
++ usb_get_dev(udev);
+ }
+ spin_unlock_irqrestore(&hcd_urb_unlink_lock, flags);
+ if (retval == 0) {
+ hcd = bus_to_hcd(urb->dev->bus);
+ retval = unlink1(hcd, urb, status);
+- usb_put_dev(urb->dev);
++ if (retval == 0)
++ retval = -EINPROGRESS;
++ else if (retval != -EIDRM && retval != -EBUSY)
++ dev_dbg(&udev->dev, "hcd_unlink_urb %p fail %d\n",
++ urb, retval);
++ usb_put_dev(udev);
+ }
+-
+- if (retval == 0)
+- retval = -EINPROGRESS;
+- else if (retval != -EIDRM && retval != -EBUSY)
+- dev_dbg(&urb->dev->dev, "hcd_unlink_urb %p fail %d\n",
+- urb, retval);
+ return retval;
+ }
+
+diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
+index b649fef2e35d..2246954d7df3 100644
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -5591,26 +5591,19 @@ EXPORT_SYMBOL_GPL(usb_reset_device);
+ * possible; depending on how the driver attached to each interface
+ * handles ->pre_reset(), the second reset might happen or not.
+ *
+- * - If a driver is unbound and it had a pending reset, the reset will
+- * be cancelled.
++ * - If the reset is delayed so long that the interface is unbound from
++ * its driver, the reset will be skipped.
+ *
+- * - This function can be called during .probe() or .disconnect()
+- * times. On return from .disconnect(), any pending resets will be
+- * cancelled.
+- *
+- * There is no no need to lock/unlock the @reset_ws as schedule_work()
+- * does its own.
+- *
+- * NOTE: We don't do any reference count tracking because it is not
+- * needed. The lifecycle of the work_struct is tied to the
+- * usb_interface. Before destroying the interface we cancel the
+- * work_struct, so the fact that work_struct is queued and or
+- * running means the interface (and thus, the device) exist and
+- * are referenced.
++ * - This function can be called during .probe(). It can also be called
++ * during .disconnect(), but doing so is pointless because the reset
++ * will not occur. If you really want to reset the device during
++ * .disconnect(), call usb_reset_device() directly -- but watch out
++ * for nested unbinding issues!
+ */
+ void usb_queue_reset_device(struct usb_interface *iface)
+ {
+- schedule_work(&iface->reset_ws);
++ if (schedule_work(&iface->reset_ws))
++ usb_get_intf(iface);
+ }
+ EXPORT_SYMBOL_GPL(usb_queue_reset_device);
+
+diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c
+index f7b7713cfb2a..f368d2053da5 100644
+--- a/drivers/usb/core/message.c
++++ b/drivers/usb/core/message.c
+@@ -1551,6 +1551,7 @@ static void usb_release_interface(struct device *dev)
+ altsetting_to_usb_interface_cache(intf->altsetting);
+
+ kref_put(&intfc->ref, usb_release_interface_cache);
++ usb_put_dev(interface_to_usbdev(intf));
+ kfree(intf);
+ }
+
+@@ -1626,24 +1627,6 @@ static struct usb_interface_assoc_descriptor *find_iad(struct usb_device *dev,
+
+ /*
+ * Internal function to queue a device reset
+- *
+- * This is initialized into the workstruct in 'struct
+- * usb_device->reset_ws' that is launched by
+- * message.c:usb_set_configuration() when initializing each 'struct
+- * usb_interface'.
+- *
+- * It is safe to get the USB device without reference counts because
+- * the life cycle of @iface is bound to the life cycle of @udev. Then,
+- * this function will be ran only if @iface is alive (and before
+- * freeing it any scheduled instances of it will have been cancelled).
+- *
+- * We need to set a flag (usb_dev->reset_running) because when we call
+- * the reset, the interfaces might be unbound. The current interface
+- * cannot try to remove the queued work as it would cause a deadlock
+- * (you cannot remove your work from within your executing
+- * workqueue). This flag lets it know, so that
+- * usb_cancel_queued_reset() doesn't try to do it.
+- *
+ * See usb_queue_reset_device() for more details
+ */
+ static void __usb_queue_reset_device(struct work_struct *ws)
+@@ -1655,11 +1638,10 @@ static void __usb_queue_reset_device(struct work_struct *ws)
+
+ rc = usb_lock_device_for_reset(udev, iface);
+ if (rc >= 0) {
+- iface->reset_running = 1;
+ usb_reset_device(udev);
+- iface->reset_running = 0;
+ usb_unlock_device(udev);
+ }
++ usb_put_intf(iface); /* Undo _get_ in usb_queue_reset_device() */
+ }
+
+
+@@ -1854,6 +1836,7 @@ free_interfaces:
+ dev_set_name(&intf->dev, "%d-%s:%d.%d",
+ dev->bus->busnum, dev->devpath,
+ configuration, alt->desc.bInterfaceNumber);
++ usb_get_dev(dev);
+ }
+ kfree(new_interfaces);
+
+diff --git a/drivers/usb/core/usb.c b/drivers/usb/core/usb.c
+index 2dd2362198d2..29ee9363faa5 100644
+--- a/drivers/usb/core/usb.c
++++ b/drivers/usb/core/usb.c
+@@ -1051,6 +1051,7 @@ static int __init usb_init(void)
+ pr_info("%s: USB support disabled\n", usbcore_name);
+ return 0;
+ }
++ usb_init_pool_max();
+
+ retval = usb_debugfs_init();
+ if (retval)
+diff --git a/drivers/usb/host/isp1760-hcd.c b/drivers/usb/host/isp1760-hcd.c
+index e752c3098f38..d2a856528471 100644
+--- a/drivers/usb/host/isp1760-hcd.c
++++ b/drivers/usb/host/isp1760-hcd.c
+@@ -2247,6 +2247,9 @@ struct usb_hcd *isp1760_register(phys_addr_t res_start, resource_size_t res_len,
+ hcd->rsrc_start = res_start;
+ hcd->rsrc_len = res_len;
+
++ /* This driver doesn't support wakeup requests */
++ hcd->cant_recv_wakeups = 1;
++
+ ret = usb_add_hcd(hcd, irq, irqflags);
+ if (ret)
+ goto err_unmap;
+diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
+index f4c56fc1a9f6..f40c856ff758 100644
+--- a/drivers/usb/serial/cp210x.c
++++ b/drivers/usb/serial/cp210x.c
+@@ -56,6 +56,7 @@ static const struct usb_device_id id_table[] = {
+ { USB_DEVICE(0x0846, 0x1100) }, /* NetGear Managed Switch M4100 series, M5300 series, M7100 series */
+ { USB_DEVICE(0x08e6, 0x5501) }, /* Gemalto Prox-PU/CU contactless smartcard reader */
+ { USB_DEVICE(0x08FD, 0x000A) }, /* Digianswer A/S , ZigBee/802.15.4 MAC Device */
++ { USB_DEVICE(0x0908, 0x01FF) }, /* Siemens RUGGEDCOM USB Serial Console */
+ { USB_DEVICE(0x0BED, 0x1100) }, /* MEI (TM) Cashflow-SC Bill/Voucher Acceptor */
+ { USB_DEVICE(0x0BED, 0x1101) }, /* MEI series 2000 Combo Acceptor */
+ { USB_DEVICE(0x0FCF, 0x1003) }, /* Dynastream ANT development board */
+diff --git a/drivers/xen/manage.c b/drivers/xen/manage.c
+index f8bb36f9d9ce..bf1940706422 100644
+--- a/drivers/xen/manage.c
++++ b/drivers/xen/manage.c
+@@ -105,10 +105,16 @@ static void do_suspend(void)
+
+ err = freeze_processes();
+ if (err) {
+- pr_err("%s: freeze failed %d\n", __func__, err);
++ pr_err("%s: freeze processes failed %d\n", __func__, err);
+ goto out;
+ }
+
++ err = freeze_kernel_threads();
++ if (err) {
++ pr_err("%s: freeze kernel threads failed %d\n", __func__, err);
++ goto out_thaw;
++ }
++
+ err = dpm_suspend_start(PMSG_FREEZE);
+ if (err) {
+ pr_err("%s: dpm_suspend_start %d\n", __func__, err);
+diff --git a/drivers/xen/xen-scsiback.c b/drivers/xen/xen-scsiback.c
+index 3e32146472a5..d30c6b246342 100644
+--- a/drivers/xen/xen-scsiback.c
++++ b/drivers/xen/xen-scsiback.c
+@@ -712,12 +712,11 @@ static int prepare_pending_reqs(struct vscsibk_info *info,
+ static int scsiback_do_cmd_fn(struct vscsibk_info *info)
+ {
+ struct vscsiif_back_ring *ring = &info->ring;
+- struct vscsiif_request *ring_req;
++ struct vscsiif_request ring_req;
+ struct vscsibk_pend *pending_req;
+ RING_IDX rc, rp;
+ int err, more_to_do;
+ uint32_t result;
+- uint8_t act;
+
+ rc = ring->req_cons;
+ rp = ring->sring->req_prod;
+@@ -738,11 +737,10 @@ static int scsiback_do_cmd_fn(struct vscsibk_info *info)
+ if (!pending_req)
+ return 1;
+
+- ring_req = RING_GET_REQUEST(ring, rc);
++ ring_req = *RING_GET_REQUEST(ring, rc);
+ ring->req_cons = ++rc;
+
+- act = ring_req->act;
+- err = prepare_pending_reqs(info, ring_req, pending_req);
++ err = prepare_pending_reqs(info, &ring_req, pending_req);
+ if (err) {
+ switch (err) {
+ case -ENODEV:
+@@ -758,9 +756,9 @@ static int scsiback_do_cmd_fn(struct vscsibk_info *info)
+ return 1;
+ }
+
+- switch (act) {
++ switch (ring_req.act) {
+ case VSCSIIF_ACT_SCSI_CDB:
+- if (scsiback_gnttab_data_map(ring_req, pending_req)) {
++ if (scsiback_gnttab_data_map(&ring_req, pending_req)) {
+ scsiback_fast_flush_area(pending_req);
+ scsiback_do_resp_with_sense(NULL,
+ DRIVER_ERROR << 24, 0, pending_req);
+@@ -771,7 +769,7 @@ static int scsiback_do_cmd_fn(struct vscsibk_info *info)
+ break;
+ case VSCSIIF_ACT_SCSI_ABORT:
+ scsiback_device_action(pending_req, TMR_ABORT_TASK,
+- ring_req->ref_rqid);
++ ring_req.ref_rqid);
+ break;
+ case VSCSIIF_ACT_SCSI_RESET:
+ scsiback_device_action(pending_req, TMR_LUN_RESET, 0);
+diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
+index d8fc0605b9d2..e1efcaa1b245 100644
+--- a/fs/binfmt_elf.c
++++ b/fs/binfmt_elf.c
+@@ -554,11 +554,12 @@ out:
+
+ static unsigned long randomize_stack_top(unsigned long stack_top)
+ {
+- unsigned int random_variable = 0;
++ unsigned long random_variable = 0;
+
+ if ((current->flags & PF_RANDOMIZE) &&
+ !(current->personality & ADDR_NO_RANDOMIZE)) {
+- random_variable = get_random_int() & STACK_RND_MASK;
++ random_variable = (unsigned long) get_random_int();
++ random_variable &= STACK_RND_MASK;
+ random_variable <<= PAGE_SHIFT;
+ }
+ #ifdef CONFIG_STACK_GROWSUP
+diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c
+index 150822ee0a0b..c81ce0c7c1a9 100644
+--- a/fs/btrfs/ctree.c
++++ b/fs/btrfs/ctree.c
+@@ -2609,32 +2609,23 @@ static int key_search(struct extent_buffer *b, struct btrfs_key *key,
+ return 0;
+ }
+
+-int btrfs_find_item(struct btrfs_root *fs_root, struct btrfs_path *found_path,
++int btrfs_find_item(struct btrfs_root *fs_root, struct btrfs_path *path,
+ u64 iobjectid, u64 ioff, u8 key_type,
+ struct btrfs_key *found_key)
+ {
+ int ret;
+ struct btrfs_key key;
+ struct extent_buffer *eb;
+- struct btrfs_path *path;
++
++ ASSERT(path);
+
+ key.type = key_type;
+ key.objectid = iobjectid;
+ key.offset = ioff;
+
+- if (found_path == NULL) {
+- path = btrfs_alloc_path();
+- if (!path)
+- return -ENOMEM;
+- } else
+- path = found_path;
+-
+ ret = btrfs_search_slot(NULL, fs_root, &key, path, 0, 0);
+- if ((ret < 0) || (found_key == NULL)) {
+- if (path != found_path)
+- btrfs_free_path(path);
++ if ((ret < 0) || (found_key == NULL))
+ return ret;
+- }
+
+ eb = path->nodes[0];
+ if (ret && path->slots[0] >= btrfs_header_nritems(eb)) {
+diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
+index 97676731190c..b1709831b1a1 100644
+--- a/fs/btrfs/disk-io.c
++++ b/fs/btrfs/disk-io.c
+@@ -1630,6 +1630,7 @@ struct btrfs_root *btrfs_get_fs_root(struct btrfs_fs_info *fs_info,
+ bool check_ref)
+ {
+ struct btrfs_root *root;
++ struct btrfs_path *path;
+ int ret;
+
+ if (location->objectid == BTRFS_ROOT_TREE_OBJECTID)
+@@ -1669,8 +1670,14 @@ again:
+ if (ret)
+ goto fail;
+
+- ret = btrfs_find_item(fs_info->tree_root, NULL, BTRFS_ORPHAN_OBJECTID,
++ path = btrfs_alloc_path();
++ if (!path) {
++ ret = -ENOMEM;
++ goto fail;
++ }
++ ret = btrfs_find_item(fs_info->tree_root, path, BTRFS_ORPHAN_OBJECTID,
+ location->objectid, BTRFS_ORPHAN_ITEM_KEY, NULL);
++ btrfs_free_path(path);
+ if (ret < 0)
+ goto fail;
+ if (ret == 0)
+@@ -2496,7 +2503,7 @@ int open_ctree(struct super_block *sb,
+ features |= BTRFS_FEATURE_INCOMPAT_COMPRESS_LZO;
+
+ if (features & BTRFS_FEATURE_INCOMPAT_SKINNY_METADATA)
+- printk(KERN_ERR "BTRFS: has skinny extents\n");
++ printk(KERN_INFO "BTRFS: has skinny extents\n");
+
+ /*
+ * flag our filesystem as having big metadata blocks if
+diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
+index 7d96cc961663..ee1c60454a5f 100644
+--- a/fs/btrfs/tree-log.c
++++ b/fs/btrfs/tree-log.c
+@@ -488,8 +488,20 @@ insert:
+ src_item = (struct btrfs_inode_item *)src_ptr;
+ dst_item = (struct btrfs_inode_item *)dst_ptr;
+
+- if (btrfs_inode_generation(eb, src_item) == 0)
++ if (btrfs_inode_generation(eb, src_item) == 0) {
++ struct extent_buffer *dst_eb = path->nodes[0];
++
++ if (S_ISREG(btrfs_inode_mode(eb, src_item)) &&
++ S_ISREG(btrfs_inode_mode(dst_eb, dst_item))) {
++ struct btrfs_map_token token;
++ u64 ino_size = btrfs_inode_size(eb, src_item);
++
++ btrfs_init_map_token(&token);
++ btrfs_set_token_inode_size(dst_eb, dst_item,
++ ino_size, &token);
++ }
+ goto no_copy;
++ }
+
+ if (overwrite_root &&
+ S_ISDIR(btrfs_inode_mode(eb, src_item)) &&
+@@ -1257,10 +1269,19 @@ static int insert_orphan_item(struct btrfs_trans_handle *trans,
+ struct btrfs_root *root, u64 offset)
+ {
+ int ret;
+- ret = btrfs_find_item(root, NULL, BTRFS_ORPHAN_OBJECTID,
++ struct btrfs_path *path;
++
++ path = btrfs_alloc_path();
++ if (!path)
++ return -ENOMEM;
++
++ ret = btrfs_find_item(root, path, BTRFS_ORPHAN_OBJECTID,
+ offset, BTRFS_ORPHAN_ITEM_KEY, NULL);
+ if (ret > 0)
+ ret = btrfs_insert_orphan_item(trans, root, offset);
++
++ btrfs_free_path(path);
++
+ return ret;
+ }
+
+@@ -3209,7 +3230,8 @@ static int drop_objectid_items(struct btrfs_trans_handle *trans,
+ static void fill_inode_item(struct btrfs_trans_handle *trans,
+ struct extent_buffer *leaf,
+ struct btrfs_inode_item *item,
+- struct inode *inode, int log_inode_only)
++ struct inode *inode, int log_inode_only,
++ u64 logged_isize)
+ {
+ struct btrfs_map_token token;
+
+@@ -3222,7 +3244,7 @@ static void fill_inode_item(struct btrfs_trans_handle *trans,
+ * to say 'update this inode with these values'
+ */
+ btrfs_set_token_inode_generation(leaf, item, 0, &token);
+- btrfs_set_token_inode_size(leaf, item, 0, &token);
++ btrfs_set_token_inode_size(leaf, item, logged_isize, &token);
+ } else {
+ btrfs_set_token_inode_generation(leaf, item,
+ BTRFS_I(inode)->generation,
+@@ -3274,7 +3296,7 @@ static int log_inode_item(struct btrfs_trans_handle *trans,
+ return ret;
+ inode_item = btrfs_item_ptr(path->nodes[0], path->slots[0],
+ struct btrfs_inode_item);
+- fill_inode_item(trans, path->nodes[0], inode_item, inode, 0);
++ fill_inode_item(trans, path->nodes[0], inode_item, inode, 0, 0);
+ btrfs_release_path(path);
+ return 0;
+ }
+@@ -3283,7 +3305,8 @@ static noinline int copy_items(struct btrfs_trans_handle *trans,
+ struct inode *inode,
+ struct btrfs_path *dst_path,
+ struct btrfs_path *src_path, u64 *last_extent,
+- int start_slot, int nr, int inode_only)
++ int start_slot, int nr, int inode_only,
++ u64 logged_isize)
+ {
+ unsigned long src_offset;
+ unsigned long dst_offset;
+@@ -3340,7 +3363,8 @@ static noinline int copy_items(struct btrfs_trans_handle *trans,
+ dst_path->slots[0],
+ struct btrfs_inode_item);
+ fill_inode_item(trans, dst_path->nodes[0], inode_item,
+- inode, inode_only == LOG_INODE_EXISTS);
++ inode, inode_only == LOG_INODE_EXISTS,
++ logged_isize);
+ } else {
+ copy_extent_buffer(dst_path->nodes[0], src, dst_offset,
+ src_offset, ins_sizes[i]);
+@@ -3886,6 +3910,33 @@ process:
+ return ret;
+ }
+
++static int logged_inode_size(struct btrfs_root *log, struct inode *inode,
++ struct btrfs_path *path, u64 *size_ret)
++{
++ struct btrfs_key key;
++ int ret;
++
++ key.objectid = btrfs_ino(inode);
++ key.type = BTRFS_INODE_ITEM_KEY;
++ key.offset = 0;
++
++ ret = btrfs_search_slot(NULL, log, &key, path, 0, 0);
++ if (ret < 0) {
++ return ret;
++ } else if (ret > 0) {
++ *size_ret = i_size_read(inode);
++ } else {
++ struct btrfs_inode_item *item;
++
++ item = btrfs_item_ptr(path->nodes[0], path->slots[0],
++ struct btrfs_inode_item);
++ *size_ret = btrfs_inode_size(path->nodes[0], item);
++ }
++
++ btrfs_release_path(path);
++ return 0;
++}
++
+ /* log a single inode in the tree log.
+ * At least one parent directory for this inode must exist in the tree
+ * or be logged already.
+@@ -3923,6 +3974,7 @@ static int btrfs_log_inode(struct btrfs_trans_handle *trans,
+ bool fast_search = false;
+ u64 ino = btrfs_ino(inode);
+ struct extent_map_tree *em_tree = &BTRFS_I(inode)->extent_tree;
++ u64 logged_isize = 0;
+
+ path = btrfs_alloc_path();
+ if (!path)
+@@ -3976,6 +4028,25 @@ static int btrfs_log_inode(struct btrfs_trans_handle *trans,
+ max_key_type = BTRFS_XATTR_ITEM_KEY;
+ ret = drop_objectid_items(trans, log, path, ino, max_key_type);
+ } else {
++ if (inode_only == LOG_INODE_EXISTS) {
++ /*
++ * Make sure the new inode item we write to the log has
++ * the same isize as the current one (if it exists).
++ * This is necessary to prevent data loss after log
++ * replay, and also to prevent doing a wrong expanding
++ * truncate - for e.g. create file, write 4K into offset
++ * 0, fsync, write 4K into offset 4096, add hard link,
++ * fsync some other file (to sync log), power fail - if
++ * we use the inode's current i_size, after log replay
++ * we get a 8Kb file, with the last 4Kb extent as a hole
++ * (zeroes), as if an expanding truncate happened,
++ * instead of getting a file of 4Kb only.
++ */
++ err = logged_inode_size(log, inode, path,
++ &logged_isize);
++ if (err)
++ goto out_unlock;
++ }
+ if (test_and_clear_bit(BTRFS_INODE_NEEDS_FULL_SYNC,
+ &BTRFS_I(inode)->runtime_flags)) {
+ clear_bit(BTRFS_INODE_COPY_EVERYTHING,
+@@ -4031,7 +4102,8 @@ again:
+ }
+
+ ret = copy_items(trans, inode, dst_path, path, &last_extent,
+- ins_start_slot, ins_nr, inode_only);
++ ins_start_slot, ins_nr, inode_only,
++ logged_isize);
+ if (ret < 0) {
+ err = ret;
+ goto out_unlock;
+@@ -4055,7 +4127,7 @@ next_slot:
+ if (ins_nr) {
+ ret = copy_items(trans, inode, dst_path, path,
+ &last_extent, ins_start_slot,
+- ins_nr, inode_only);
++ ins_nr, inode_only, logged_isize);
+ if (ret < 0) {
+ err = ret;
+ goto out_unlock;
+@@ -4076,7 +4148,8 @@ next_slot:
+ }
+ if (ins_nr) {
+ ret = copy_items(trans, inode, dst_path, path, &last_extent,
+- ins_start_slot, ins_nr, inode_only);
++ ins_start_slot, ins_nr, inode_only,
++ logged_isize);
+ if (ret < 0) {
+ err = ret;
+ goto out_unlock;
+diff --git a/fs/jffs2/scan.c b/fs/jffs2/scan.c
+index 7654e87b0428..9ad5ba4b299b 100644
+--- a/fs/jffs2/scan.c
++++ b/fs/jffs2/scan.c
+@@ -510,6 +510,10 @@ static int jffs2_scan_eraseblock (struct jffs2_sb_info *c, struct jffs2_eraseblo
+ sumlen = c->sector_size - je32_to_cpu(sm->offset);
+ sumptr = buf + buf_size - sumlen;
+
++ /* sm->offset maybe wrong but MAGIC maybe right */
++ if (sumlen > c->sector_size)
++ goto full_scan;
++
+ /* Now, make sure the summary itself is available */
+ if (sumlen > buf_size) {
+ /* Need to kmalloc for this. */
+@@ -544,6 +548,7 @@ static int jffs2_scan_eraseblock (struct jffs2_sb_info *c, struct jffs2_eraseblo
+ }
+ }
+
++full_scan:
+ buf_ofs = jeb->offset;
+
+ if (!buf_size) {
+diff --git a/fs/lockd/mon.c b/fs/lockd/mon.c
+index 9106f42c472c..67bdc0bb9aea 100644
+--- a/fs/lockd/mon.c
++++ b/fs/lockd/mon.c
+@@ -65,7 +65,7 @@ static inline struct sockaddr *nsm_addr(const struct nsm_handle *nsm)
+ return (struct sockaddr *)&nsm->sm_addr;
+ }
+
+-static struct rpc_clnt *nsm_create(struct net *net)
++static struct rpc_clnt *nsm_create(struct net *net, const char *nodename)
+ {
+ struct sockaddr_in sin = {
+ .sin_family = AF_INET,
+@@ -77,6 +77,7 @@ static struct rpc_clnt *nsm_create(struct net *net)
+ .address = (struct sockaddr *)&sin,
+ .addrsize = sizeof(sin),
+ .servername = "rpc.statd",
++ .nodename = nodename,
+ .program = &nsm_program,
+ .version = NSM_VERSION,
+ .authflavor = RPC_AUTH_NULL,
+@@ -102,7 +103,7 @@ out:
+ return clnt;
+ }
+
+-static struct rpc_clnt *nsm_client_get(struct net *net)
++static struct rpc_clnt *nsm_client_get(struct net *net, const char *nodename)
+ {
+ struct rpc_clnt *clnt, *new;
+ struct lockd_net *ln = net_generic(net, lockd_net_id);
+@@ -111,7 +112,7 @@ static struct rpc_clnt *nsm_client_get(struct net *net)
+ if (clnt != NULL)
+ goto out;
+
+- clnt = new = nsm_create(net);
++ clnt = new = nsm_create(net, nodename);
+ if (IS_ERR(clnt))
+ goto out;
+
+@@ -190,19 +191,23 @@ int nsm_monitor(const struct nlm_host *host)
+ struct nsm_res res;
+ int status;
+ struct rpc_clnt *clnt;
++ const char *nodename = NULL;
+
+ dprintk("lockd: nsm_monitor(%s)\n", nsm->sm_name);
+
+ if (nsm->sm_monitored)
+ return 0;
+
++ if (host->h_rpcclnt)
++ nodename = host->h_rpcclnt->cl_nodename;
++
+ /*
+ * Choose whether to record the caller_name or IP address of
+ * this peer in the local rpc.statd's database.
+ */
+ nsm->sm_mon_name = nsm_use_hostnames ? nsm->sm_name : nsm->sm_addrbuf;
+
+- clnt = nsm_client_get(host->net);
++ clnt = nsm_client_get(host->net, nodename);
+ if (IS_ERR(clnt)) {
+ status = PTR_ERR(clnt);
+ dprintk("lockd: failed to create NSM upcall transport, "
+diff --git a/fs/nfs/callback.c b/fs/nfs/callback.c
+index b8fb3a4ef649..351be9205bf8 100644
+--- a/fs/nfs/callback.c
++++ b/fs/nfs/callback.c
+@@ -128,22 +128,24 @@ nfs41_callback_svc(void *vrqstp)
+ if (try_to_freeze())
+ continue;
+
+- prepare_to_wait(&serv->sv_cb_waitq, &wq, TASK_INTERRUPTIBLE);
++ prepare_to_wait(&serv->sv_cb_waitq, &wq, TASK_UNINTERRUPTIBLE);
+ spin_lock_bh(&serv->sv_cb_lock);
+ if (!list_empty(&serv->sv_cb_list)) {
+ req = list_first_entry(&serv->sv_cb_list,
+ struct rpc_rqst, rq_bc_list);
+ list_del(&req->rq_bc_list);
+ spin_unlock_bh(&serv->sv_cb_lock);
++ finish_wait(&serv->sv_cb_waitq, &wq);
+ dprintk("Invoking bc_svc_process()\n");
+ error = bc_svc_process(serv, req, rqstp);
+ dprintk("bc_svc_process() returned w/ error code= %d\n",
+ error);
+ } else {
+ spin_unlock_bh(&serv->sv_cb_lock);
+- schedule();
++ /* schedule_timeout to game the hung task watchdog */
++ schedule_timeout(60 * HZ);
++ finish_wait(&serv->sv_cb_waitq, &wq);
+ }
+- finish_wait(&serv->sv_cb_waitq, &wq);
+ }
+ return 0;
+ }
+diff --git a/fs/nfs/callback_xdr.c b/fs/nfs/callback_xdr.c
+index f4ccfe6521ec..02f8d09e119f 100644
+--- a/fs/nfs/callback_xdr.c
++++ b/fs/nfs/callback_xdr.c
+@@ -464,8 +464,10 @@ static __be32 decode_cb_sequence_args(struct svc_rqst *rqstp,
+
+ for (i = 0; i < args->csa_nrclists; i++) {
+ status = decode_rc_list(xdr, &args->csa_rclists[i]);
+- if (status)
++ if (status) {
++ args->csa_nrclists = i;
+ goto out_free;
++ }
+ }
+ }
+ status = 0;
+diff --git a/fs/nfs/direct.c b/fs/nfs/direct.c
+index 294692ff83b1..a094b0c34ac3 100644
+--- a/fs/nfs/direct.c
++++ b/fs/nfs/direct.c
+@@ -242,7 +242,7 @@ static void nfs_direct_release_pages(struct page **pages, unsigned int npages)
+ void nfs_init_cinfo_from_dreq(struct nfs_commit_info *cinfo,
+ struct nfs_direct_req *dreq)
+ {
+- cinfo->lock = &dreq->lock;
++ cinfo->lock = &dreq->inode->i_lock;
+ cinfo->mds = &dreq->mds_cinfo;
+ cinfo->ds = &dreq->ds_cinfo;
+ cinfo->dreq = dreq;
+diff --git a/fs/nfs/internal.h b/fs/nfs/internal.h
+index efaa31c70fbe..e1acc1c4ce65 100644
+--- a/fs/nfs/internal.h
++++ b/fs/nfs/internal.h
+@@ -377,7 +377,7 @@ extern struct rpc_stat nfs_rpcstat;
+
+ extern int __init register_nfs_fs(void);
+ extern void __exit unregister_nfs_fs(void);
+-extern void nfs_sb_active(struct super_block *sb);
++extern bool nfs_sb_active(struct super_block *sb);
+ extern void nfs_sb_deactive(struct super_block *sb);
+
+ /* namespace.c */
+@@ -495,6 +495,26 @@ extern int nfs41_walk_client_list(struct nfs_client *clp,
+ struct nfs_client **result,
+ struct rpc_cred *cred);
+
++static inline struct inode *nfs_igrab_and_active(struct inode *inode)
++{
++ inode = igrab(inode);
++ if (inode != NULL && !nfs_sb_active(inode->i_sb)) {
++ iput(inode);
++ inode = NULL;
++ }
++ return inode;
++}
++
++static inline void nfs_iput_and_deactive(struct inode *inode)
++{
++ if (inode != NULL) {
++ struct super_block *sb = inode->i_sb;
++
++ iput(inode);
++ nfs_sb_deactive(sb);
++ }
++}
++
+ /*
+ * Determine the device name as a string
+ */
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index 83f3a7d7466e..cd617076aeca 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -5130,9 +5130,13 @@ static void nfs4_delegreturn_done(struct rpc_task *task, void *calldata)
+ static void nfs4_delegreturn_release(void *calldata)
+ {
+ struct nfs4_delegreturndata *data = calldata;
++ struct inode *inode = data->inode;
+
+- if (data->roc)
+- pnfs_roc_release(data->inode);
++ if (inode) {
++ if (data->roc)
++ pnfs_roc_release(inode);
++ nfs_iput_and_deactive(inode);
++ }
+ kfree(calldata);
+ }
+
+@@ -5189,9 +5193,9 @@ static int _nfs4_proc_delegreturn(struct inode *inode, struct rpc_cred *cred, co
+ nfs_fattr_init(data->res.fattr);
+ data->timestamp = jiffies;
+ data->rpc_status = 0;
+- data->inode = inode;
+- data->roc = list_empty(&NFS_I(inode)->open_files) ?
+- pnfs_roc(inode) : false;
++ data->inode = nfs_igrab_and_active(inode);
++ if (data->inode)
++ data->roc = nfs4_roc(inode);
+
+ task_setup_data.callback_data = data;
+ msg.rpc_argp = &data->args;
+diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c
+index 0a5dda4d85c2..883ee88e5f5e 100644
+--- a/fs/nfs/pnfs.c
++++ b/fs/nfs/pnfs.c
+@@ -1445,19 +1445,19 @@ pnfs_generic_pg_init_read(struct nfs_pageio_descriptor *pgio, struct nfs_page *r
+ {
+ u64 rd_size = req->wb_bytes;
+
+- WARN_ON_ONCE(pgio->pg_lseg != NULL);
+-
+- if (pgio->pg_dreq == NULL)
+- rd_size = i_size_read(pgio->pg_inode) - req_offset(req);
+- else
+- rd_size = nfs_dreq_bytes_left(pgio->pg_dreq);
+-
+- pgio->pg_lseg = pnfs_update_layout(pgio->pg_inode,
+- req->wb_context,
+- req_offset(req),
+- rd_size,
+- IOMODE_READ,
+- GFP_KERNEL);
++ if (pgio->pg_lseg == NULL) {
++ if (pgio->pg_dreq == NULL)
++ rd_size = i_size_read(pgio->pg_inode) - req_offset(req);
++ else
++ rd_size = nfs_dreq_bytes_left(pgio->pg_dreq);
++
++ pgio->pg_lseg = pnfs_update_layout(pgio->pg_inode,
++ req->wb_context,
++ req_offset(req),
++ rd_size,
++ IOMODE_READ,
++ GFP_KERNEL);
++ }
+ /* If no lseg, fall back to read through mds */
+ if (pgio->pg_lseg == NULL)
+ nfs_pageio_reset_read_mds(pgio);
+@@ -1469,14 +1469,13 @@ void
+ pnfs_generic_pg_init_write(struct nfs_pageio_descriptor *pgio,
+ struct nfs_page *req, u64 wb_size)
+ {
+- WARN_ON_ONCE(pgio->pg_lseg != NULL);
+-
+- pgio->pg_lseg = pnfs_update_layout(pgio->pg_inode,
+- req->wb_context,
+- req_offset(req),
+- wb_size,
+- IOMODE_RW,
+- GFP_NOFS);
++ if (pgio->pg_lseg == NULL)
++ pgio->pg_lseg = pnfs_update_layout(pgio->pg_inode,
++ req->wb_context,
++ req_offset(req),
++ wb_size,
++ IOMODE_RW,
++ GFP_NOFS);
+ /* If no lseg, fall back to write through mds */
+ if (pgio->pg_lseg == NULL)
+ nfs_pageio_reset_write_mds(pgio);
+diff --git a/fs/nfs/super.c b/fs/nfs/super.c
+index 31a11b0e885d..368d9395d2e7 100644
+--- a/fs/nfs/super.c
++++ b/fs/nfs/super.c
+@@ -405,12 +405,15 @@ void __exit unregister_nfs_fs(void)
+ unregister_filesystem(&nfs_fs_type);
+ }
+
+-void nfs_sb_active(struct super_block *sb)
++bool nfs_sb_active(struct super_block *sb)
+ {
+ struct nfs_server *server = NFS_SB(sb);
+
+- if (atomic_inc_return(&server->active) == 1)
+- atomic_inc(&sb->s_active);
++ if (!atomic_inc_not_zero(&sb->s_active))
++ return false;
++ if (atomic_inc_return(&server->active) != 1)
++ atomic_dec(&sb->s_active);
++ return true;
+ }
+ EXPORT_SYMBOL_GPL(nfs_sb_active);
+
+diff --git a/fs/ocfs2/quota_local.c b/fs/ocfs2/quota_local.c
+index 10b653930ee2..465223b7592e 100644
+--- a/fs/ocfs2/quota_local.c
++++ b/fs/ocfs2/quota_local.c
+@@ -701,8 +701,8 @@ static int ocfs2_local_read_info(struct super_block *sb, int type)
+ /* We don't need the lock and we have to acquire quota file locks
+ * which will later depend on this lock */
+ mutex_unlock(&sb_dqopt(sb)->dqio_mutex);
+- info->dqi_maxblimit = 0x7fffffffffffffffLL;
+- info->dqi_maxilimit = 0x7fffffffffffffffLL;
++ info->dqi_max_spc_limit = 0x7fffffffffffffffLL;
++ info->dqi_max_ino_limit = 0x7fffffffffffffffLL;
+ oinfo = kmalloc(sizeof(struct ocfs2_mem_dqinfo), GFP_NOFS);
+ if (!oinfo) {
+ mlog(ML_ERROR, "failed to allocate memory for ocfs2 quota"
+diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
+index 4e0388cffe3d..e8972bcddfb4 100644
+--- a/fs/proc/task_mmu.c
++++ b/fs/proc/task_mmu.c
+@@ -1034,7 +1034,7 @@ static int pagemap_pte_range(pmd_t *pmd, unsigned long addr, unsigned long end,
+ struct vm_area_struct *vma;
+ struct pagemapread *pm = walk->private;
+ spinlock_t *ptl;
+- pte_t *pte;
++ pte_t *pte, *orig_pte;
+ int err = 0;
+
+ /* find the first VMA at or above 'addr' */
+@@ -1095,15 +1095,19 @@ static int pagemap_pte_range(pmd_t *pmd, unsigned long addr, unsigned long end,
+ BUG_ON(is_vm_hugetlb_page(vma));
+
+ /* Addresses in the VMA. */
+- for (; addr < min(end, vma->vm_end); addr += PAGE_SIZE) {
++ orig_pte = pte = pte_offset_map_lock(walk->mm, pmd, addr, &ptl);
++ for (; addr < min(end, vma->vm_end); pte++, addr += PAGE_SIZE) {
+ pagemap_entry_t pme;
+- pte = pte_offset_map(pmd, addr);
++
+ pte_to_pagemap_entry(&pme, pm, vma, addr, *pte);
+- pte_unmap(pte);
+ err = add_to_pagemap(addr, &pme, pm);
+ if (err)
+- return err;
++ break;
+ }
++ pte_unmap_unlock(orig_pte, ptl);
++
++ if (err)
++ return err;
+
+ if (addr == end)
+ break;
+diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c
+index 9340228aff6e..05fea2ac116c 100644
+--- a/fs/quota/dquot.c
++++ b/fs/quota/dquot.c
+@@ -2380,16 +2380,6 @@ out:
+ }
+ EXPORT_SYMBOL(dquot_quota_on_mount);
+
+-static inline qsize_t qbtos(qsize_t blocks)
+-{
+- return blocks << QIF_DQBLKSIZE_BITS;
+-}
+-
+-static inline qsize_t stoqb(qsize_t space)
+-{
+- return (space + QIF_DQBLKSIZE - 1) >> QIF_DQBLKSIZE_BITS;
+-}
+-
+ /* Generic routine for getting common part of quota structure */
+ static void do_get_dqblk(struct dquot *dquot, struct qc_dqblk *di)
+ {
+@@ -2439,13 +2429,13 @@ static int do_set_dqblk(struct dquot *dquot, struct qc_dqblk *di)
+ return -EINVAL;
+
+ if (((di->d_fieldmask & QC_SPC_SOFT) &&
+- stoqb(di->d_spc_softlimit) > dqi->dqi_maxblimit) ||
++ di->d_spc_softlimit > dqi->dqi_max_spc_limit) ||
+ ((di->d_fieldmask & QC_SPC_HARD) &&
+- stoqb(di->d_spc_hardlimit) > dqi->dqi_maxblimit) ||
++ di->d_spc_hardlimit > dqi->dqi_max_spc_limit) ||
+ ((di->d_fieldmask & QC_INO_SOFT) &&
+- (di->d_ino_softlimit > dqi->dqi_maxilimit)) ||
++ (di->d_ino_softlimit > dqi->dqi_max_ino_limit)) ||
+ ((di->d_fieldmask & QC_INO_HARD) &&
+- (di->d_ino_hardlimit > dqi->dqi_maxilimit)))
++ (di->d_ino_hardlimit > dqi->dqi_max_ino_limit)))
+ return -ERANGE;
+
+ spin_lock(&dq_data_lock);
+diff --git a/fs/quota/quota_v1.c b/fs/quota/quota_v1.c
+index 469c6848b322..8fe79beced5c 100644
+--- a/fs/quota/quota_v1.c
++++ b/fs/quota/quota_v1.c
+@@ -169,8 +169,8 @@ static int v1_read_file_info(struct super_block *sb, int type)
+ }
+ ret = 0;
+ /* limits are stored as unsigned 32-bit data */
+- dqopt->info[type].dqi_maxblimit = 0xffffffff;
+- dqopt->info[type].dqi_maxilimit = 0xffffffff;
++ dqopt->info[type].dqi_max_spc_limit = 0xffffffffULL << QUOTABLOCK_BITS;
++ dqopt->info[type].dqi_max_ino_limit = 0xffffffff;
+ dqopt->info[type].dqi_igrace =
+ dqblk.dqb_itime ? dqblk.dqb_itime : MAX_IQ_TIME;
+ dqopt->info[type].dqi_bgrace =
+diff --git a/fs/quota/quota_v2.c b/fs/quota/quota_v2.c
+index 02751ec695c5..d1a8054bba9a 100644
+--- a/fs/quota/quota_v2.c
++++ b/fs/quota/quota_v2.c
+@@ -117,12 +117,12 @@ static int v2_read_file_info(struct super_block *sb, int type)
+ qinfo = info->dqi_priv;
+ if (version == 0) {
+ /* limits are stored as unsigned 32-bit data */
+- info->dqi_maxblimit = 0xffffffff;
+- info->dqi_maxilimit = 0xffffffff;
++ info->dqi_max_spc_limit = 0xffffffffULL << QUOTABLOCK_BITS;
++ info->dqi_max_ino_limit = 0xffffffff;
+ } else {
+- /* used space is stored as unsigned 64-bit value */
+- info->dqi_maxblimit = 0xffffffffffffffffULL; /* 2^64-1 */
+- info->dqi_maxilimit = 0xffffffffffffffffULL;
++ /* used space is stored as unsigned 64-bit value in bytes */
++ info->dqi_max_spc_limit = 0xffffffffffffffffULL; /* 2^64-1 */
++ info->dqi_max_ino_limit = 0xffffffffffffffffULL;
+ }
+ info->dqi_bgrace = le32_to_cpu(dinfo.dqi_bgrace);
+ info->dqi_igrace = le32_to_cpu(dinfo.dqi_igrace);
+diff --git a/fs/udf/inode.c b/fs/udf/inode.c
+index 5bc71d9a674a..7b72b7dd8906 100644
+--- a/fs/udf/inode.c
++++ b/fs/udf/inode.c
+@@ -1288,6 +1288,7 @@ static int udf_read_inode(struct inode *inode, bool hidden_inode)
+ struct kernel_lb_addr *iloc = &iinfo->i_location;
+ unsigned int link_count;
+ unsigned int indirections = 0;
++ int bs = inode->i_sb->s_blocksize;
+ int ret = -EIO;
+
+ reread:
+@@ -1374,38 +1375,35 @@ reread:
+ if (fe->descTag.tagIdent == cpu_to_le16(TAG_IDENT_EFE)) {
+ iinfo->i_efe = 1;
+ iinfo->i_use = 0;
+- ret = udf_alloc_i_data(inode, inode->i_sb->s_blocksize -
++ ret = udf_alloc_i_data(inode, bs -
+ sizeof(struct extendedFileEntry));
+ if (ret)
+ goto out;
+ memcpy(iinfo->i_ext.i_data,
+ bh->b_data + sizeof(struct extendedFileEntry),
+- inode->i_sb->s_blocksize -
+- sizeof(struct extendedFileEntry));
++ bs - sizeof(struct extendedFileEntry));
+ } else if (fe->descTag.tagIdent == cpu_to_le16(TAG_IDENT_FE)) {
+ iinfo->i_efe = 0;
+ iinfo->i_use = 0;
+- ret = udf_alloc_i_data(inode, inode->i_sb->s_blocksize -
+- sizeof(struct fileEntry));
++ ret = udf_alloc_i_data(inode, bs - sizeof(struct fileEntry));
+ if (ret)
+ goto out;
+ memcpy(iinfo->i_ext.i_data,
+ bh->b_data + sizeof(struct fileEntry),
+- inode->i_sb->s_blocksize - sizeof(struct fileEntry));
++ bs - sizeof(struct fileEntry));
+ } else if (fe->descTag.tagIdent == cpu_to_le16(TAG_IDENT_USE)) {
+ iinfo->i_efe = 0;
+ iinfo->i_use = 1;
+ iinfo->i_lenAlloc = le32_to_cpu(
+ ((struct unallocSpaceEntry *)bh->b_data)->
+ lengthAllocDescs);
+- ret = udf_alloc_i_data(inode, inode->i_sb->s_blocksize -
++ ret = udf_alloc_i_data(inode, bs -
+ sizeof(struct unallocSpaceEntry));
+ if (ret)
+ goto out;
+ memcpy(iinfo->i_ext.i_data,
+ bh->b_data + sizeof(struct unallocSpaceEntry),
+- inode->i_sb->s_blocksize -
+- sizeof(struct unallocSpaceEntry));
++ bs - sizeof(struct unallocSpaceEntry));
+ return 0;
+ }
+
+@@ -1489,6 +1487,15 @@ reread:
+ }
+ inode->i_generation = iinfo->i_unique;
+
++ /*
++ * Sanity check length of allocation descriptors and extended attrs to
++ * avoid integer overflows
++ */
++ if (iinfo->i_lenEAttr > bs || iinfo->i_lenAlloc > bs)
++ goto out;
++ /* Now do exact checks */
++ if (udf_file_entry_alloc_offset(inode) + iinfo->i_lenAlloc > bs)
++ goto out;
+ /* Sanity checks for files in ICB so that we don't get confused later */
+ if (iinfo->i_alloc_type == ICBTAG_FLAG_AD_IN_ICB) {
+ /*
+@@ -1498,8 +1505,7 @@ reread:
+ if (iinfo->i_lenAlloc != inode->i_size)
+ goto out;
+ /* File in ICB has to fit in there... */
+- if (inode->i_size > inode->i_sb->s_blocksize -
+- udf_file_entry_alloc_offset(inode))
++ if (inode->i_size > bs - udf_file_entry_alloc_offset(inode))
+ goto out;
+ }
+
+diff --git a/fs/xfs/libxfs/xfs_bmap.c b/fs/xfs/libxfs/xfs_bmap.c
+index 79c981984dca..661666ecac22 100644
+--- a/fs/xfs/libxfs/xfs_bmap.c
++++ b/fs/xfs/libxfs/xfs_bmap.c
+@@ -976,7 +976,11 @@ xfs_bmap_local_to_extents(
+ *firstblock = args.fsbno;
+ bp = xfs_btree_get_bufl(args.mp, tp, args.fsbno, 0);
+
+- /* initialise the block and copy the data */
++ /*
++ * Initialise the block and copy the data
++ *
++ * Note: init_fn must set the buffer log item type correctly!
++ */
+ init_fn(tp, bp, ip, ifp);
+
+ /* account for the change in fork size and log everything */
+diff --git a/fs/xfs/libxfs/xfs_symlink_remote.c b/fs/xfs/libxfs/xfs_symlink_remote.c
+index 5782f037eab4..a7dce9aea5b5 100644
+--- a/fs/xfs/libxfs/xfs_symlink_remote.c
++++ b/fs/xfs/libxfs/xfs_symlink_remote.c
+@@ -180,6 +180,8 @@ xfs_symlink_local_to_remote(
+ struct xfs_mount *mp = ip->i_mount;
+ char *buf;
+
++ xfs_trans_buf_set_type(tp, bp, XFS_BLFT_SYMLINK_BUF);
++
+ if (!xfs_sb_version_hascrc(&mp->m_sb)) {
+ bp->b_ops = NULL;
+ memcpy(bp->b_addr, ifp->if_u1.if_data, ifp->if_bytes);
+diff --git a/fs/xfs/xfs_buf_item.c b/fs/xfs/xfs_buf_item.c
+index f15969543326..1a6c9b936789 100644
+--- a/fs/xfs/xfs_buf_item.c
++++ b/fs/xfs/xfs_buf_item.c
+@@ -319,6 +319,10 @@ xfs_buf_item_format(
+ ASSERT(atomic_read(&bip->bli_refcount) > 0);
+ ASSERT((bip->bli_flags & XFS_BLI_LOGGED) ||
+ (bip->bli_flags & XFS_BLI_STALE));
++ ASSERT((bip->bli_flags & XFS_BLI_STALE) ||
++ (xfs_blft_from_flags(&bip->__bli_format) > XFS_BLFT_UNKNOWN_BUF
++ && xfs_blft_from_flags(&bip->__bli_format) < XFS_BLFT_MAX_BUF));
++
+
+ /*
+ * If it is an inode buffer, transfer the in-memory state to the
+diff --git a/fs/xfs/xfs_inode.c b/fs/xfs/xfs_inode.c
+index 8ed049d1e332..3cc309a19ea8 100644
+--- a/fs/xfs/xfs_inode.c
++++ b/fs/xfs/xfs_inode.c
+@@ -2000,6 +2000,7 @@ xfs_iunlink(
+ agi->agi_unlinked[bucket_index] = cpu_to_be32(agino);
+ offset = offsetof(xfs_agi_t, agi_unlinked) +
+ (sizeof(xfs_agino_t) * bucket_index);
++ xfs_trans_buf_set_type(tp, agibp, XFS_BLFT_AGI_BUF);
+ xfs_trans_log_buf(tp, agibp, offset,
+ (offset + sizeof(xfs_agino_t) - 1));
+ return 0;
+@@ -2091,6 +2092,7 @@ xfs_iunlink_remove(
+ agi->agi_unlinked[bucket_index] = cpu_to_be32(next_agino);
+ offset = offsetof(xfs_agi_t, agi_unlinked) +
+ (sizeof(xfs_agino_t) * bucket_index);
++ xfs_trans_buf_set_type(tp, agibp, XFS_BLFT_AGI_BUF);
+ xfs_trans_log_buf(tp, agibp, offset,
+ (offset + sizeof(xfs_agino_t) - 1));
+ } else {
+diff --git a/fs/xfs/xfs_qm.c b/fs/xfs/xfs_qm.c
+index d68f23021af3..cf2bc2dd702e 100644
+--- a/fs/xfs/xfs_qm.c
++++ b/fs/xfs/xfs_qm.c
+@@ -844,6 +844,11 @@ xfs_qm_reset_dqcounts(
+ */
+ xfs_dqcheck(mp, ddq, id+j, type, XFS_QMOPT_DQREPAIR,
+ "xfs_quotacheck");
++ /*
++ * Reset type in case we are reusing group quota file for
++ * project quotas or vice versa
++ */
++ ddq->d_flags = type;
+ ddq->d_bcount = 0;
+ ddq->d_icount = 0;
+ ddq->d_rtbcount = 0;
+diff --git a/fs/xfs/xfs_trans.c b/fs/xfs/xfs_trans.c
+index 30e8e3410955..32dfdb5d3e6b 100644
+--- a/fs/xfs/xfs_trans.c
++++ b/fs/xfs/xfs_trans.c
+@@ -474,6 +474,7 @@ xfs_trans_apply_sb_deltas(
+ whole = 1;
+ }
+
++ xfs_trans_buf_set_type(tp, bp, XFS_BLFT_SB_BUF);
+ if (whole)
+ /*
+ * Log the whole thing, the fields are noncontiguous.
+diff --git a/include/linux/fsnotify.h b/include/linux/fsnotify.h
+index 1c804b057fb1..7ee1774edee5 100644
+--- a/include/linux/fsnotify.h
++++ b/include/linux/fsnotify.h
+@@ -101,8 +101,10 @@ static inline void fsnotify_move(struct inode *old_dir, struct inode *new_dir,
+ new_dir_mask |= FS_ISDIR;
+ }
+
+- fsnotify(old_dir, old_dir_mask, old_dir, FSNOTIFY_EVENT_INODE, old_name, fs_cookie);
+- fsnotify(new_dir, new_dir_mask, new_dir, FSNOTIFY_EVENT_INODE, new_name, fs_cookie);
++ fsnotify(old_dir, old_dir_mask, source, FSNOTIFY_EVENT_INODE, old_name,
++ fs_cookie);
++ fsnotify(new_dir, new_dir_mask, source, FSNOTIFY_EVENT_INODE, new_name,
++ fs_cookie);
+
+ if (target)
+ fsnotify_link_count(target);
+diff --git a/include/linux/nfs_xdr.h b/include/linux/nfs_xdr.h
+index 47ebb4fafd87..d77a08d25223 100644
+--- a/include/linux/nfs_xdr.h
++++ b/include/linux/nfs_xdr.h
+@@ -1328,7 +1328,7 @@ struct nfs_commit_completion_ops {
+ };
+
+ struct nfs_commit_info {
+- spinlock_t *lock;
++ spinlock_t *lock; /* inode->i_lock */
+ struct nfs_mds_commit_info *mds;
+ struct pnfs_ds_commit_info *ds;
+ struct nfs_direct_req *dreq; /* O_DIRECT request */
+diff --git a/include/linux/quota.h b/include/linux/quota.h
+index 224fb8154f8f..8b0877faa7f5 100644
+--- a/include/linux/quota.h
++++ b/include/linux/quota.h
+@@ -211,8 +211,8 @@ struct mem_dqinfo {
+ unsigned long dqi_flags;
+ unsigned int dqi_bgrace;
+ unsigned int dqi_igrace;
+- qsize_t dqi_maxblimit;
+- qsize_t dqi_maxilimit;
++ qsize_t dqi_max_spc_limit;
++ qsize_t dqi_max_ino_limit;
+ void *dqi_priv;
+ };
+
+diff --git a/include/linux/sunrpc/clnt.h b/include/linux/sunrpc/clnt.h
+index 70736b98c721..b363a0f6dfe1 100644
+--- a/include/linux/sunrpc/clnt.h
++++ b/include/linux/sunrpc/clnt.h
+@@ -57,7 +57,7 @@ struct rpc_clnt {
+ const struct rpc_timeout *cl_timeout; /* Timeout strategy */
+
+ int cl_nodelen; /* nodename length */
+- char cl_nodename[UNX_MAXNODENAME];
++ char cl_nodename[UNX_MAXNODENAME+1];
+ struct rpc_pipe_dir_head cl_pipedir_objects;
+ struct rpc_clnt * cl_parent; /* Points to parent of clones */
+ struct rpc_rtt cl_rtt_default;
+@@ -109,6 +109,7 @@ struct rpc_create_args {
+ struct sockaddr *saddress;
+ const struct rpc_timeout *timeout;
+ const char *servername;
++ const char *nodename;
+ const struct rpc_program *program;
+ u32 prognumber; /* overrides program->number */
+ u32 version;
+diff --git a/include/linux/usb.h b/include/linux/usb.h
+index 447a7e2fc19b..3827bffc11a7 100644
+--- a/include/linux/usb.h
++++ b/include/linux/usb.h
+@@ -127,10 +127,6 @@ enum usb_interface_condition {
+ * to the sysfs representation for that device.
+ * @pm_usage_cnt: PM usage counter for this interface
+ * @reset_ws: Used for scheduling resets from atomic context.
+- * @reset_running: set to 1 if the interface is currently running a
+- * queued reset so that usb_cancel_queued_reset() doesn't try to
+- * remove from the workqueue when running inside the worker
+- * thread. See __usb_queue_reset_device().
+ * @resetting_device: USB core reset the device, so use alt setting 0 as
+ * current; needs bandwidth alloc after reset.
+ *
+@@ -181,7 +177,6 @@ struct usb_interface {
+ unsigned needs_remote_wakeup:1; /* driver requires remote wakeup */
+ unsigned needs_altsetting0:1; /* switch to altsetting 0 is pending */
+ unsigned needs_binding:1; /* needs delayed unbind/rebind */
+- unsigned reset_running:1;
+ unsigned resetting_device:1; /* true: bandwidth alloc after reset */
+
+ struct device dev; /* interface specific device info */
+diff --git a/include/linux/usb/hcd.h b/include/linux/usb/hcd.h
+index cd96a2bc3388..2f48e1756cbd 100644
+--- a/include/linux/usb/hcd.h
++++ b/include/linux/usb/hcd.h
+@@ -146,6 +146,8 @@ struct usb_hcd {
+ unsigned amd_resume_bug:1; /* AMD remote wakeup quirk */
+ unsigned can_do_streams:1; /* HC supports streams */
+ unsigned tpl_support:1; /* OTG & EH TPL support */
++ unsigned cant_recv_wakeups:1;
++ /* wakeup requests from downstream aren't received */
+
+ unsigned int irq; /* irq allocated */
+ void __iomem *regs; /* device memory/io */
+@@ -450,6 +452,7 @@ extern const struct dev_pm_ops usb_hcd_pci_pm_ops;
+ #endif /* CONFIG_PCI */
+
+ /* pci-ish (pdev null is ok) buffer alloc/mapping support */
++void usb_init_pool_max(void);
+ int hcd_buffer_create(struct usb_hcd *hcd);
+ void hcd_buffer_destroy(struct usb_hcd *hcd);
+
+diff --git a/include/net/cipso_ipv4.h b/include/net/cipso_ipv4.h
+index a6fd939f202d..3ebb168b9afc 100644
+--- a/include/net/cipso_ipv4.h
++++ b/include/net/cipso_ipv4.h
+@@ -121,13 +121,6 @@ extern int cipso_v4_rbm_strictvalid;
+ #endif
+
+ /*
+- * Helper Functions
+- */
+-
+-#define CIPSO_V4_OPTEXIST(x) (IPCB(x)->opt.cipso != 0)
+-#define CIPSO_V4_OPTPTR(x) (skb_network_header(x) + IPCB(x)->opt.cipso)
+-
+-/*
+ * DOI List Functions
+ */
+
+@@ -190,7 +183,7 @@ static inline int cipso_v4_doi_domhsh_remove(struct cipso_v4_doi *doi_def,
+
+ #ifdef CONFIG_NETLABEL
+ void cipso_v4_cache_invalidate(void);
+-int cipso_v4_cache_add(const struct sk_buff *skb,
++int cipso_v4_cache_add(const unsigned char *cipso_ptr,
+ const struct netlbl_lsm_secattr *secattr);
+ #else
+ static inline void cipso_v4_cache_invalidate(void)
+@@ -198,7 +191,7 @@ static inline void cipso_v4_cache_invalidate(void)
+ return;
+ }
+
+-static inline int cipso_v4_cache_add(const struct sk_buff *skb,
++static inline int cipso_v4_cache_add(const unsigned char *cipso_ptr,
+ const struct netlbl_lsm_secattr *secattr)
+ {
+ return 0;
+@@ -211,6 +204,8 @@ static inline int cipso_v4_cache_add(const struct sk_buff *skb,
+
+ #ifdef CONFIG_NETLABEL
+ void cipso_v4_error(struct sk_buff *skb, int error, u32 gateway);
++int cipso_v4_getattr(const unsigned char *cipso,
++ struct netlbl_lsm_secattr *secattr);
+ int cipso_v4_sock_setattr(struct sock *sk,
+ const struct cipso_v4_doi *doi_def,
+ const struct netlbl_lsm_secattr *secattr);
+@@ -226,6 +221,7 @@ int cipso_v4_skbuff_setattr(struct sk_buff *skb,
+ int cipso_v4_skbuff_delattr(struct sk_buff *skb);
+ int cipso_v4_skbuff_getattr(const struct sk_buff *skb,
+ struct netlbl_lsm_secattr *secattr);
++unsigned char *cipso_v4_optptr(const struct sk_buff *skb);
+ int cipso_v4_validate(const struct sk_buff *skb, unsigned char **option);
+ #else
+ static inline void cipso_v4_error(struct sk_buff *skb,
+@@ -235,6 +231,12 @@ static inline void cipso_v4_error(struct sk_buff *skb,
+ return;
+ }
+
++static inline int cipso_v4_getattr(const unsigned char *cipso,
++ struct netlbl_lsm_secattr *secattr)
++{
++ return -ENOSYS;
++}
++
+ static inline int cipso_v4_sock_setattr(struct sock *sk,
+ const struct cipso_v4_doi *doi_def,
+ const struct netlbl_lsm_secattr *secattr)
+@@ -282,6 +284,11 @@ static inline int cipso_v4_skbuff_getattr(const struct sk_buff *skb,
+ return -ENOSYS;
+ }
+
++static inline unsigned char *cipso_v4_optptr(const struct sk_buff *skb)
++{
++ return NULL;
++}
++
+ static inline int cipso_v4_validate(const struct sk_buff *skb,
+ unsigned char **option)
+ {
+diff --git a/kernel/debug/kdb/kdb_main.c b/kernel/debug/kdb/kdb_main.c
+index 379650b984f8..6ffdc96059a0 100644
+--- a/kernel/debug/kdb/kdb_main.c
++++ b/kernel/debug/kdb/kdb_main.c
+@@ -2535,7 +2535,7 @@ static int kdb_summary(int argc, const char **argv)
+ #define K(x) ((x) << (PAGE_SHIFT - 10))
+ kdb_printf("\nMemTotal: %8lu kB\nMemFree: %8lu kB\n"
+ "Buffers: %8lu kB\n",
+- val.totalram, val.freeram, val.bufferram);
++ K(val.totalram), K(val.freeram), K(val.bufferram));
+ return 0;
+ }
+
+diff --git a/kernel/time/ntp.c b/kernel/time/ntp.c
+index 28bf91c60a0b..85fb3d632bd8 100644
+--- a/kernel/time/ntp.c
++++ b/kernel/time/ntp.c
+@@ -633,10 +633,14 @@ int ntp_validate_timex(struct timex *txc)
+ if ((txc->modes & ADJ_SETOFFSET) && (!capable(CAP_SYS_TIME)))
+ return -EPERM;
+
+- if (txc->modes & ADJ_FREQUENCY) {
+- if (LONG_MIN / PPM_SCALE > txc->freq)
++ /*
++ * Check for potential multiplication overflows that can
++ * only happen on 64-bit systems:
++ */
++ if ((txc->modes & ADJ_FREQUENCY) && (BITS_PER_LONG == 64)) {
++ if (LLONG_MIN / PPM_SCALE > txc->freq)
+ return -EINVAL;
+- if (LONG_MAX / PPM_SCALE < txc->freq)
++ if (LLONG_MAX / PPM_SCALE < txc->freq)
+ return -EINVAL;
+ }
+
+diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
+index a56e07c8d15b..f4fbbfcdf399 100644
+--- a/kernel/trace/ring_buffer.c
++++ b/kernel/trace/ring_buffer.c
+@@ -450,7 +450,10 @@ int ring_buffer_print_page_header(struct trace_seq *s)
+ struct rb_irq_work {
+ struct irq_work work;
+ wait_queue_head_t waiters;
++ wait_queue_head_t full_waiters;
+ bool waiters_pending;
++ bool full_waiters_pending;
++ bool wakeup_full;
+ };
+
+ /*
+@@ -532,6 +535,10 @@ static void rb_wake_up_waiters(struct irq_work *work)
+ struct rb_irq_work *rbwork = container_of(work, struct rb_irq_work, work);
+
+ wake_up_all(&rbwork->waiters);
++ if (rbwork->wakeup_full) {
++ rbwork->wakeup_full = false;
++ wake_up_all(&rbwork->full_waiters);
++ }
+ }
+
+ /**
+@@ -556,9 +563,11 @@ int ring_buffer_wait(struct ring_buffer *buffer, int cpu, bool full)
+ * data in any cpu buffer, or a specific buffer, put the
+ * caller on the appropriate wait queue.
+ */
+- if (cpu == RING_BUFFER_ALL_CPUS)
++ if (cpu == RING_BUFFER_ALL_CPUS) {
+ work = &buffer->irq_work;
+- else {
++ /* Full only makes sense on per cpu reads */
++ full = false;
++ } else {
+ if (!cpumask_test_cpu(cpu, buffer->cpumask))
+ return -ENODEV;
+ cpu_buffer = buffer->buffers[cpu];
+@@ -567,7 +576,10 @@ int ring_buffer_wait(struct ring_buffer *buffer, int cpu, bool full)
+
+
+ while (true) {
+- prepare_to_wait(&work->waiters, &wait, TASK_INTERRUPTIBLE);
++ if (full)
++ prepare_to_wait(&work->full_waiters, &wait, TASK_INTERRUPTIBLE);
++ else
++ prepare_to_wait(&work->waiters, &wait, TASK_INTERRUPTIBLE);
+
+ /*
+ * The events can happen in critical sections where
+@@ -589,7 +601,10 @@ int ring_buffer_wait(struct ring_buffer *buffer, int cpu, bool full)
+ * that is necessary is that the wake up happens after
+ * a task has been queued. It's OK for spurious wake ups.
+ */
+- work->waiters_pending = true;
++ if (full)
++ work->full_waiters_pending = true;
++ else
++ work->waiters_pending = true;
+
+ if (signal_pending(current)) {
+ ret = -EINTR;
+@@ -618,7 +633,10 @@ int ring_buffer_wait(struct ring_buffer *buffer, int cpu, bool full)
+ schedule();
+ }
+
+- finish_wait(&work->waiters, &wait);
++ if (full)
++ finish_wait(&work->full_waiters, &wait);
++ else
++ finish_wait(&work->waiters, &wait);
+
+ return ret;
+ }
+@@ -1233,6 +1251,7 @@ rb_allocate_cpu_buffer(struct ring_buffer *buffer, int nr_pages, int cpu)
+ init_completion(&cpu_buffer->update_done);
+ init_irq_work(&cpu_buffer->irq_work.work, rb_wake_up_waiters);
+ init_waitqueue_head(&cpu_buffer->irq_work.waiters);
++ init_waitqueue_head(&cpu_buffer->irq_work.full_waiters);
+
+ bpage = kzalloc_node(ALIGN(sizeof(*bpage), cache_line_size()),
+ GFP_KERNEL, cpu_to_node(cpu));
+@@ -2804,6 +2823,8 @@ static void rb_commit(struct ring_buffer_per_cpu *cpu_buffer,
+ static __always_inline void
+ rb_wakeups(struct ring_buffer *buffer, struct ring_buffer_per_cpu *cpu_buffer)
+ {
++ bool pagebusy;
++
+ if (buffer->irq_work.waiters_pending) {
+ buffer->irq_work.waiters_pending = false;
+ /* irq_work_queue() supplies it's own memory barriers */
+@@ -2815,6 +2836,15 @@ rb_wakeups(struct ring_buffer *buffer, struct ring_buffer_per_cpu *cpu_buffer)
+ /* irq_work_queue() supplies it's own memory barriers */
+ irq_work_queue(&cpu_buffer->irq_work.work);
+ }
++
++ pagebusy = cpu_buffer->reader_page == cpu_buffer->commit_page;
++
++ if (!pagebusy && cpu_buffer->irq_work.full_waiters_pending) {
++ cpu_buffer->irq_work.wakeup_full = true;
++ cpu_buffer->irq_work.full_waiters_pending = false;
++ /* irq_work_queue() supplies it's own memory barriers */
++ irq_work_queue(&cpu_buffer->irq_work.work);
++ }
+ }
+
+ /**
+diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
+index 426962b04183..72c71345db81 100644
+--- a/kernel/trace/trace.c
++++ b/kernel/trace/trace.c
+@@ -4916,7 +4916,7 @@ tracing_mark_write(struct file *filp, const char __user *ubuf,
+ *fpos += written;
+
+ out_unlock:
+- for (i = 0; i < nr_pages; i++){
++ for (i = nr_pages - 1; i >= 0; i--) {
+ kunmap_atomic(map_page[i]);
+ put_page(pages[i]);
+ }
+diff --git a/mm/hugetlb.c b/mm/hugetlb.c
+index 9fd722769927..f08fec71ec5a 100644
+--- a/mm/hugetlb.c
++++ b/mm/hugetlb.c
+@@ -3659,6 +3659,8 @@ follow_huge_pmd(struct mm_struct *mm, unsigned long address,
+ {
+ struct page *page;
+
++ if (!pmd_present(*pmd))
++ return NULL;
+ page = pte_page(*(pte_t *)pmd);
+ if (page)
+ page += ((address & ~PMD_MASK) >> PAGE_SHIFT);
+diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c
+index f09b6b65cf6b..9ebc394ea5e5 100644
+--- a/net/bluetooth/smp.c
++++ b/net/bluetooth/smp.c
+@@ -1392,8 +1392,12 @@ static int smp_cmd_ident_addr_info(struct l2cap_conn *conn,
+ * implementations are not known of and in order to not over
+ * complicate our implementation, simply pretend that we never
+ * received an IRK for such a device.
++ *
++ * The Identity Address must also be a Static Random or Public
++ * Address, which hci_is_identity_address() checks for.
+ */
+- if (!bacmp(&info->bdaddr, BDADDR_ANY)) {
++ if (!bacmp(&info->bdaddr, BDADDR_ANY) ||
++ !hci_is_identity_address(&info->bdaddr, info->addr_type)) {
+ BT_ERR("Ignoring IRK with no identity address");
+ goto distribute;
+ }
+diff --git a/net/ceph/osd_client.c b/net/ceph/osd_client.c
+index 6f164289bde8..b0cf1f287aed 100644
+--- a/net/ceph/osd_client.c
++++ b/net/ceph/osd_client.c
+@@ -1006,14 +1006,24 @@ static void put_osd(struct ceph_osd *osd)
+ */
+ static void __remove_osd(struct ceph_osd_client *osdc, struct ceph_osd *osd)
+ {
+- dout("__remove_osd %p\n", osd);
++ dout("%s %p osd%d\n", __func__, osd, osd->o_osd);
+ WARN_ON(!list_empty(&osd->o_requests));
+ WARN_ON(!list_empty(&osd->o_linger_requests));
+
+- rb_erase(&osd->o_node, &osdc->osds);
+ list_del_init(&osd->o_osd_lru);
+- ceph_con_close(&osd->o_con);
+- put_osd(osd);
++ rb_erase(&osd->o_node, &osdc->osds);
++ RB_CLEAR_NODE(&osd->o_node);
++}
++
++static void remove_osd(struct ceph_osd_client *osdc, struct ceph_osd *osd)
++{
++ dout("%s %p osd%d\n", __func__, osd, osd->o_osd);
++
++ if (!RB_EMPTY_NODE(&osd->o_node)) {
++ ceph_con_close(&osd->o_con);
++ __remove_osd(osdc, osd);
++ put_osd(osd);
++ }
+ }
+
+ static void remove_all_osds(struct ceph_osd_client *osdc)
+@@ -1023,7 +1033,7 @@ static void remove_all_osds(struct ceph_osd_client *osdc)
+ while (!RB_EMPTY_ROOT(&osdc->osds)) {
+ struct ceph_osd *osd = rb_entry(rb_first(&osdc->osds),
+ struct ceph_osd, o_node);
+- __remove_osd(osdc, osd);
++ remove_osd(osdc, osd);
+ }
+ mutex_unlock(&osdc->request_mutex);
+ }
+@@ -1064,7 +1074,7 @@ static void remove_old_osds(struct ceph_osd_client *osdc)
+ list_for_each_entry_safe(osd, nosd, &osdc->osd_lru, o_osd_lru) {
+ if (time_before(jiffies, osd->lru_ttl))
+ break;
+- __remove_osd(osdc, osd);
++ remove_osd(osdc, osd);
+ }
+ mutex_unlock(&osdc->request_mutex);
+ }
+@@ -1079,8 +1089,7 @@ static int __reset_osd(struct ceph_osd_client *osdc, struct ceph_osd *osd)
+ dout("__reset_osd %p osd%d\n", osd, osd->o_osd);
+ if (list_empty(&osd->o_requests) &&
+ list_empty(&osd->o_linger_requests)) {
+- __remove_osd(osdc, osd);
+-
++ remove_osd(osdc, osd);
+ return -ENODEV;
+ }
+
+@@ -1884,6 +1893,7 @@ static void reset_changed_osds(struct ceph_osd_client *osdc)
+ {
+ struct rb_node *p, *n;
+
++ dout("%s %p\n", __func__, osdc);
+ for (p = rb_first(&osdc->osds); p; p = n) {
+ struct ceph_osd *osd = rb_entry(p, struct ceph_osd, o_node);
+
+diff --git a/net/ipv4/cipso_ipv4.c b/net/ipv4/cipso_ipv4.c
+index 4715f25dfe03..bc7c9662a904 100644
+--- a/net/ipv4/cipso_ipv4.c
++++ b/net/ipv4/cipso_ipv4.c
+@@ -376,20 +376,18 @@ static int cipso_v4_cache_check(const unsigned char *key,
+ * negative values on failure.
+ *
+ */
+-int cipso_v4_cache_add(const struct sk_buff *skb,
++int cipso_v4_cache_add(const unsigned char *cipso_ptr,
+ const struct netlbl_lsm_secattr *secattr)
+ {
+ int ret_val = -EPERM;
+ u32 bkt;
+ struct cipso_v4_map_cache_entry *entry = NULL;
+ struct cipso_v4_map_cache_entry *old_entry = NULL;
+- unsigned char *cipso_ptr;
+ u32 cipso_ptr_len;
+
+ if (!cipso_v4_cache_enabled || cipso_v4_cache_bucketsize <= 0)
+ return 0;
+
+- cipso_ptr = CIPSO_V4_OPTPTR(skb);
+ cipso_ptr_len = cipso_ptr[1];
+
+ entry = kzalloc(sizeof(*entry), GFP_ATOMIC);
+@@ -1577,6 +1575,33 @@ static int cipso_v4_parsetag_loc(const struct cipso_v4_doi *doi_def,
+ }
+
+ /**
++ * cipso_v4_optptr - Find the CIPSO option in the packet
++ * @skb: the packet
++ *
++ * Description:
++ * Parse the packet's IP header looking for a CIPSO option. Returns a pointer
++ * to the start of the CIPSO option on success, NULL if one if not found.
++ *
++ */
++unsigned char *cipso_v4_optptr(const struct sk_buff *skb)
++{
++ const struct iphdr *iph = ip_hdr(skb);
++ unsigned char *optptr = (unsigned char *)&(ip_hdr(skb)[1]);
++ int optlen;
++ int taglen;
++
++ for (optlen = iph->ihl*4 - sizeof(struct iphdr); optlen > 0; ) {
++ if (optptr[0] == IPOPT_CIPSO)
++ return optptr;
++ taglen = optptr[1];
++ optlen -= taglen;
++ optptr += taglen;
++ }
++
++ return NULL;
++}
++
++/**
+ * cipso_v4_validate - Validate a CIPSO option
+ * @option: the start of the option, on error it is set to point to the error
+ *
+@@ -2117,8 +2142,8 @@ void cipso_v4_req_delattr(struct request_sock *req)
+ * on success and negative values on failure.
+ *
+ */
+-static int cipso_v4_getattr(const unsigned char *cipso,
+- struct netlbl_lsm_secattr *secattr)
++int cipso_v4_getattr(const unsigned char *cipso,
++ struct netlbl_lsm_secattr *secattr)
+ {
+ int ret_val = -ENOMSG;
+ u32 doi;
+@@ -2303,22 +2328,6 @@ int cipso_v4_skbuff_delattr(struct sk_buff *skb)
+ return 0;
+ }
+
+-/**
+- * cipso_v4_skbuff_getattr - Get the security attributes from the CIPSO option
+- * @skb: the packet
+- * @secattr: the security attributes
+- *
+- * Description:
+- * Parse the given packet's CIPSO option and return the security attributes.
+- * Returns zero on success and negative values on failure.
+- *
+- */
+-int cipso_v4_skbuff_getattr(const struct sk_buff *skb,
+- struct netlbl_lsm_secattr *secattr)
+-{
+- return cipso_v4_getattr(CIPSO_V4_OPTPTR(skb), secattr);
+-}
+-
+ /*
+ * Setup Functions
+ */
+diff --git a/net/netlabel/netlabel_kapi.c b/net/netlabel/netlabel_kapi.c
+index a845cd4cf21e..28cddc85b700 100644
+--- a/net/netlabel/netlabel_kapi.c
++++ b/net/netlabel/netlabel_kapi.c
+@@ -1065,10 +1065,12 @@ int netlbl_skbuff_getattr(const struct sk_buff *skb,
+ u16 family,
+ struct netlbl_lsm_secattr *secattr)
+ {
++ unsigned char *ptr;
++
+ switch (family) {
+ case AF_INET:
+- if (CIPSO_V4_OPTEXIST(skb) &&
+- cipso_v4_skbuff_getattr(skb, secattr) == 0)
++ ptr = cipso_v4_optptr(skb);
++ if (ptr && cipso_v4_getattr(ptr, secattr) == 0)
+ return 0;
+ break;
+ #if IS_ENABLED(CONFIG_IPV6)
+@@ -1094,7 +1096,7 @@ int netlbl_skbuff_getattr(const struct sk_buff *skb,
+ */
+ void netlbl_skbuff_err(struct sk_buff *skb, int error, int gateway)
+ {
+- if (CIPSO_V4_OPTEXIST(skb))
++ if (cipso_v4_optptr(skb))
+ cipso_v4_error(skb, error, gateway);
+ }
+
+@@ -1126,11 +1128,14 @@ void netlbl_cache_invalidate(void)
+ int netlbl_cache_add(const struct sk_buff *skb,
+ const struct netlbl_lsm_secattr *secattr)
+ {
++ unsigned char *ptr;
++
+ if ((secattr->flags & NETLBL_SECATTR_CACHE) == 0)
+ return -ENOMSG;
+
+- if (CIPSO_V4_OPTEXIST(skb))
+- return cipso_v4_cache_add(skb, secattr);
++ ptr = cipso_v4_optptr(skb);
++ if (ptr)
++ return cipso_v4_cache_add(ptr, secattr);
+
+ return -ENOMSG;
+ }
+diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
+index 9acd6ce88db7..ae46f0198608 100644
+--- a/net/sunrpc/clnt.c
++++ b/net/sunrpc/clnt.c
+@@ -286,10 +286,8 @@ static struct rpc_xprt *rpc_clnt_set_transport(struct rpc_clnt *clnt,
+
+ static void rpc_clnt_set_nodename(struct rpc_clnt *clnt, const char *nodename)
+ {
+- clnt->cl_nodelen = strlen(nodename);
+- if (clnt->cl_nodelen > UNX_MAXNODENAME)
+- clnt->cl_nodelen = UNX_MAXNODENAME;
+- memcpy(clnt->cl_nodename, nodename, clnt->cl_nodelen);
++ clnt->cl_nodelen = strlcpy(clnt->cl_nodename,
++ nodename, sizeof(clnt->cl_nodename));
+ }
+
+ static int rpc_client_register(struct rpc_clnt *clnt,
+@@ -360,6 +358,7 @@ static struct rpc_clnt * rpc_new_client(const struct rpc_create_args *args,
+ const struct rpc_version *version;
+ struct rpc_clnt *clnt = NULL;
+ const struct rpc_timeout *timeout;
++ const char *nodename = args->nodename;
+ int err;
+
+ /* sanity check the name before trying to print it */
+@@ -415,8 +414,10 @@ static struct rpc_clnt * rpc_new_client(const struct rpc_create_args *args,
+
+ atomic_set(&clnt->cl_count, 1);
+
++ if (nodename == NULL)
++ nodename = utsname()->nodename;
+ /* save the nodename */
+- rpc_clnt_set_nodename(clnt, utsname()->nodename);
++ rpc_clnt_set_nodename(clnt, nodename);
+
+ err = rpc_client_register(clnt, args->authflavor, args->client_name);
+ if (err)
+@@ -571,6 +572,7 @@ static struct rpc_clnt *__rpc_clone_client(struct rpc_create_args *args,
+ if (xprt == NULL)
+ goto out_err;
+ args->servername = xprt->servername;
++ args->nodename = clnt->cl_nodename;
+
+ new = rpc_new_client(args, xprt, clnt);
+ if (IS_ERR(new)) {
+diff --git a/net/sunrpc/rpcb_clnt.c b/net/sunrpc/rpcb_clnt.c
+index 1891a1022c17..74b75c3ce39d 100644
+--- a/net/sunrpc/rpcb_clnt.c
++++ b/net/sunrpc/rpcb_clnt.c
+@@ -355,7 +355,8 @@ out:
+ return result;
+ }
+
+-static struct rpc_clnt *rpcb_create(struct net *net, const char *hostname,
++static struct rpc_clnt *rpcb_create(struct net *net, const char *nodename,
++ const char *hostname,
+ struct sockaddr *srvaddr, size_t salen,
+ int proto, u32 version)
+ {
+@@ -365,6 +366,7 @@ static struct rpc_clnt *rpcb_create(struct net *net, const char *hostname,
+ .address = srvaddr,
+ .addrsize = salen,
+ .servername = hostname,
++ .nodename = nodename,
+ .program = &rpcb_program,
+ .version = version,
+ .authflavor = RPC_AUTH_UNIX,
+@@ -740,7 +742,9 @@ void rpcb_getport_async(struct rpc_task *task)
+ dprintk("RPC: %5u %s: trying rpcbind version %u\n",
+ task->tk_pid, __func__, bind_version);
+
+- rpcb_clnt = rpcb_create(xprt->xprt_net, xprt->servername, sap, salen,
++ rpcb_clnt = rpcb_create(xprt->xprt_net,
++ clnt->cl_nodename,
++ xprt->servername, sap, salen,
+ xprt->prot, bind_version);
+ if (IS_ERR(rpcb_clnt)) {
+ status = PTR_ERR(rpcb_clnt);
+diff --git a/security/smack/smack.h b/security/smack/smack.h
+index b828a379377c..b48359c0da32 100644
+--- a/security/smack/smack.h
++++ b/security/smack/smack.h
+@@ -298,6 +298,16 @@ static inline struct smack_known *smk_of_task(const struct task_smack *tsp)
+ return tsp->smk_task;
+ }
+
++static inline struct smack_known *smk_of_task_struct(const struct task_struct *t)
++{
++ struct smack_known *skp;
++
++ rcu_read_lock();
++ skp = smk_of_task(__task_cred(t)->security);
++ rcu_read_unlock();
++ return skp;
++}
++
+ /*
+ * Present a pointer to the forked smack label entry in an task blob.
+ */
+diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
+index d515ec25ae9f..9d3c64af1ca9 100644
+--- a/security/smack/smack_lsm.c
++++ b/security/smack/smack_lsm.c
+@@ -43,8 +43,6 @@
+ #include <linux/binfmts.h>
+ #include "smack.h"
+
+-#define task_security(task) (task_cred_xxx((task), security))
+-
+ #define TRANS_TRUE "TRUE"
+ #define TRANS_TRUE_SIZE 4
+
+@@ -119,7 +117,7 @@ static int smk_bu_current(char *note, struct smack_known *oskp,
+ static int smk_bu_task(struct task_struct *otp, int mode, int rc)
+ {
+ struct task_smack *tsp = current_security();
+- struct task_smack *otsp = task_security(otp);
++ struct smack_known *smk_task = smk_of_task_struct(otp);
+ char acc[SMK_NUM_ACCESS_TYPE + 1];
+
+ if (rc <= 0)
+@@ -127,7 +125,7 @@ static int smk_bu_task(struct task_struct *otp, int mode, int rc)
+
+ smk_bu_mode(mode, acc);
+ pr_info("Smack Bringup: (%s %s %s) %s to %s\n",
+- tsp->smk_task->smk_known, otsp->smk_task->smk_known, acc,
++ tsp->smk_task->smk_known, smk_task->smk_known, acc,
+ current->comm, otp->comm);
+ return 0;
+ }
+@@ -344,7 +342,8 @@ static int smk_ptrace_rule_check(struct task_struct *tracer,
+ saip = &ad;
+ }
+
+- tsp = task_security(tracer);
++ rcu_read_lock();
++ tsp = __task_cred(tracer)->security;
+ tracer_known = smk_of_task(tsp);
+
+ if ((mode & PTRACE_MODE_ATTACH) &&
+@@ -364,11 +363,14 @@ static int smk_ptrace_rule_check(struct task_struct *tracer,
+ tracee_known->smk_known,
+ 0, rc, saip);
+
++ rcu_read_unlock();
+ return rc;
+ }
+
+ /* In case of rule==SMACK_PTRACE_DEFAULT or mode==PTRACE_MODE_READ */
+ rc = smk_tskacc(tsp, tracee_known, smk_ptrace_mode(mode), saip);
++
++ rcu_read_unlock();
+ return rc;
+ }
+
+@@ -395,7 +397,7 @@ static int smack_ptrace_access_check(struct task_struct *ctp, unsigned int mode)
+ if (rc != 0)
+ return rc;
+
+- skp = smk_of_task(task_security(ctp));
++ skp = smk_of_task_struct(ctp);
+
+ rc = smk_ptrace_rule_check(current, skp, mode, __func__);
+ return rc;
+@@ -1825,7 +1827,7 @@ static int smk_curacc_on_task(struct task_struct *p, int access,
+ const char *caller)
+ {
+ struct smk_audit_info ad;
+- struct smack_known *skp = smk_of_task(task_security(p));
++ struct smack_known *skp = smk_of_task_struct(p);
+ int rc;
+
+ smk_ad_init(&ad, caller, LSM_AUDIT_DATA_TASK);
+@@ -1878,7 +1880,7 @@ static int smack_task_getsid(struct task_struct *p)
+ */
+ static void smack_task_getsecid(struct task_struct *p, u32 *secid)
+ {
+- struct smack_known *skp = smk_of_task(task_security(p));
++ struct smack_known *skp = smk_of_task_struct(p);
+
+ *secid = skp->smk_secid;
+ }
+@@ -1985,7 +1987,7 @@ static int smack_task_kill(struct task_struct *p, struct siginfo *info,
+ {
+ struct smk_audit_info ad;
+ struct smack_known *skp;
+- struct smack_known *tkp = smk_of_task(task_security(p));
++ struct smack_known *tkp = smk_of_task_struct(p);
+ int rc;
+
+ smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_TASK);
+@@ -2039,7 +2041,7 @@ static int smack_task_wait(struct task_struct *p)
+ static void smack_task_to_inode(struct task_struct *p, struct inode *inode)
+ {
+ struct inode_smack *isp = inode->i_security;
+- struct smack_known *skp = smk_of_task(task_security(p));
++ struct smack_known *skp = smk_of_task_struct(p);
+
+ isp->smk_inode = skp;
+ }
+@@ -3199,7 +3201,7 @@ unlockandout:
+ */
+ static int smack_getprocattr(struct task_struct *p, char *name, char **value)
+ {
+- struct smack_known *skp = smk_of_task(task_security(p));
++ struct smack_known *skp = smk_of_task_struct(p);
+ char *cp;
+ int slen;
+
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index c879c3709eae..50762cf62b2d 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -4805,6 +4805,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x103c, 0x18e6, "HP", ALC269_FIXUP_HP_GPIO_LED),
+ SND_PCI_QUIRK(0x103c, 0x218b, "HP", ALC269_FIXUP_LIMIT_INT_MIC_BOOST_MUTE_LED),
+ /* ALC282 */
++ SND_PCI_QUIRK(0x103c, 0x21f9, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+ SND_PCI_QUIRK(0x103c, 0x2210, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+ SND_PCI_QUIRK(0x103c, 0x2214, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+ SND_PCI_QUIRK(0x103c, 0x2236, "HP", ALC269_FIXUP_HP_LINE1_MIC1_LED),
+diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
+index 605d14003d25..6d36c5b78805 100644
+--- a/sound/pci/hda/patch_sigmatel.c
++++ b/sound/pci/hda/patch_sigmatel.c
+@@ -99,6 +99,7 @@ enum {
+ STAC_HP_ENVY_BASS,
+ STAC_HP_BNB13_EQ,
+ STAC_HP_ENVY_TS_BASS,
++ STAC_92HD83XXX_GPIO10_EAPD,
+ STAC_92HD83XXX_MODELS
+ };
+
+@@ -2141,6 +2142,19 @@ static void stac92hd83xxx_fixup_headset_jack(struct hda_codec *codec,
+ spec->headset_jack = 1;
+ }
+
++static void stac92hd83xxx_fixup_gpio10_eapd(struct hda_codec *codec,
++ const struct hda_fixup *fix,
++ int action)
++{
++ struct sigmatel_spec *spec = codec->spec;
++
++ if (action != HDA_FIXUP_ACT_PRE_PROBE)
++ return;
++ spec->eapd_mask = spec->gpio_mask = spec->gpio_dir =
++ spec->gpio_data = 0x10;
++ spec->eapd_switch = 0;
++}
++
+ static const struct hda_verb hp_bnb13_eq_verbs[] = {
+ /* 44.1KHz base */
+ { 0x22, 0x7A6, 0x3E },
+@@ -2656,6 +2670,10 @@ static const struct hda_fixup stac92hd83xxx_fixups[] = {
+ {}
+ },
+ },
++ [STAC_92HD83XXX_GPIO10_EAPD] = {
++ .type = HDA_FIXUP_FUNC,
++ .v.func = stac92hd83xxx_fixup_gpio10_eapd,
++ },
+ };
+
+ static const struct hda_model_fixup stac92hd83xxx_models[] = {
+@@ -2861,6 +2879,8 @@ static const struct snd_pci_quirk stac92hd83xxx_fixup_tbl[] = {
+ SND_PCI_QUIRK(PCI_VENDOR_ID_HP, 0x148a,
+ "HP Mini", STAC_92HD83XXX_HP_LED),
+ SND_PCI_QUIRK_VENDOR(PCI_VENDOR_ID_HP, "HP", STAC_92HD83XXX_HP),
++ SND_PCI_QUIRK(PCI_VENDOR_ID_TOSHIBA, 0xfa91,
++ "Toshiba Satellite S50D", STAC_92HD83XXX_GPIO10_EAPD),
+ {} /* terminator */
+ };
+
+diff --git a/sound/pci/riptide/riptide.c b/sound/pci/riptide/riptide.c
+index 6abc2ac8fffb..e76857277695 100644
+--- a/sound/pci/riptide/riptide.c
++++ b/sound/pci/riptide/riptide.c
+@@ -2030,32 +2030,43 @@ snd_riptide_joystick_probe(struct pci_dev *pci, const struct pci_device_id *id)
+ {
+ static int dev;
+ struct gameport *gameport;
++ int ret;
+
+ if (dev >= SNDRV_CARDS)
+ return -ENODEV;
++
+ if (!enable[dev]) {
+- dev++;
+- return -ENOENT;
++ ret = -ENOENT;
++ goto inc_dev;
+ }
+
+- if (!joystick_port[dev++])
+- return 0;
++ if (!joystick_port[dev]) {
++ ret = 0;
++ goto inc_dev;
++ }
+
+ gameport = gameport_allocate_port();
+- if (!gameport)
+- return -ENOMEM;
++ if (!gameport) {
++ ret = -ENOMEM;
++ goto inc_dev;
++ }
+ if (!request_region(joystick_port[dev], 8, "Riptide gameport")) {
+ snd_printk(KERN_WARNING
+ "Riptide: cannot grab gameport 0x%x\n",
+ joystick_port[dev]);
+ gameport_free_port(gameport);
+- return -EBUSY;
++ ret = -EBUSY;
++ goto inc_dev;
+ }
+
+ gameport->io = joystick_port[dev];
+ gameport_register_port(gameport);
+ pci_set_drvdata(pci, gameport);
+- return 0;
++
++ ret = 0;
++inc_dev:
++ dev++;
++ return ret;
+ }
+
+ static void snd_riptide_joystick_remove(struct pci_dev *pci)
+diff --git a/sound/pci/rme9652/hdspm.c b/sound/pci/rme9652/hdspm.c
+index 52d86af3ef2d..fcf91ee0328d 100644
+--- a/sound/pci/rme9652/hdspm.c
++++ b/sound/pci/rme9652/hdspm.c
+@@ -6114,6 +6114,9 @@ static int snd_hdspm_playback_open(struct snd_pcm_substream *substream)
+ snd_pcm_hw_constraint_minmax(runtime,
+ SNDRV_PCM_HW_PARAM_PERIOD_SIZE,
+ 64, 8192);
++ snd_pcm_hw_constraint_minmax(runtime,
++ SNDRV_PCM_HW_PARAM_PERIODS,
++ 2, 2);
+ break;
+ }
+
+@@ -6188,6 +6191,9 @@ static int snd_hdspm_capture_open(struct snd_pcm_substream *substream)
+ snd_pcm_hw_constraint_minmax(runtime,
+ SNDRV_PCM_HW_PARAM_PERIOD_SIZE,
+ 64, 8192);
++ snd_pcm_hw_constraint_minmax(runtime,
++ SNDRV_PCM_HW_PARAM_PERIODS,
++ 2, 2);
+ break;
+ }
+
+diff --git a/sound/soc/codecs/rt5670.c b/sound/soc/codecs/rt5670.c
+index 9bd8b4f63303..7134f9ebf2f3 100644
+--- a/sound/soc/codecs/rt5670.c
++++ b/sound/soc/codecs/rt5670.c
+@@ -2439,6 +2439,7 @@ static struct snd_soc_codec_driver soc_codec_dev_rt5670 = {
+ static const struct regmap_config rt5670_regmap = {
+ .reg_bits = 8,
+ .val_bits = 16,
++ .use_single_rw = true,
+ .max_register = RT5670_VENDOR_ID2 + 1 + (ARRAY_SIZE(rt5670_ranges) *
+ RT5670_PR_SPACING),
+ .volatile_reg = rt5670_volatile_register,
+diff --git a/sound/soc/davinci/Kconfig b/sound/soc/davinci/Kconfig
+index 8e948c63f3d9..2b81ca418d2a 100644
+--- a/sound/soc/davinci/Kconfig
++++ b/sound/soc/davinci/Kconfig
+@@ -58,13 +58,12 @@ choice
+ depends on MACH_DAVINCI_DM365_EVM
+
+ config SND_DM365_AIC3X_CODEC
+- bool "Audio Codec - AIC3101"
++ tristate "Audio Codec - AIC3101"
+ help
+ Say Y if you want to add support for AIC3101 audio codec
+
+ config SND_DM365_VOICE_CODEC
+ tristate "Voice Codec - CQ93VC"
+- depends on SND_DAVINCI_SOC
+ select MFD_DAVINCI_VOICECODEC
+ select SND_DAVINCI_SOC_VCIF
+ select SND_SOC_CQ0093VC
+diff --git a/sound/soc/pxa/mioa701_wm9713.c b/sound/soc/pxa/mioa701_wm9713.c
+index 595eee341e90..a08a877fc10c 100644
+--- a/sound/soc/pxa/mioa701_wm9713.c
++++ b/sound/soc/pxa/mioa701_wm9713.c
+@@ -81,7 +81,7 @@ static int rear_amp_power(struct snd_soc_codec *codec, int power)
+ static int rear_amp_event(struct snd_soc_dapm_widget *widget,
+ struct snd_kcontrol *kctl, int event)
+ {
+- struct snd_soc_codec *codec = widget->codec;
++ struct snd_soc_codec *codec = widget->dapm->card->rtd[0].codec;
+
+ return rear_amp_power(codec, SND_SOC_DAPM_EVENT_ON(event));
+ }
+diff --git a/tools/perf/util/cloexec.c b/tools/perf/util/cloexec.c
+index 47b78b3f0325..6da965bdbc2c 100644
+--- a/tools/perf/util/cloexec.c
++++ b/tools/perf/util/cloexec.c
+@@ -25,6 +25,10 @@ static int perf_flag_probe(void)
+ if (cpu < 0)
+ cpu = 0;
+
++ /*
++ * Using -1 for the pid is a workaround to avoid gratuitous jump label
++ * changes.
++ */
+ while (1) {
+ /* check cloexec flag */
+ fd = sys_perf_event_open(&attr, pid, cpu, -1,
+@@ -47,16 +51,24 @@ static int perf_flag_probe(void)
+ err, strerror_r(err, sbuf, sizeof(sbuf)));
+
+ /* not supported, confirm error related to PERF_FLAG_FD_CLOEXEC */
+- fd = sys_perf_event_open(&attr, pid, cpu, -1, 0);
++ while (1) {
++ fd = sys_perf_event_open(&attr, pid, cpu, -1, 0);
++ if (fd < 0 && pid == -1 && errno == EACCES) {
++ pid = 0;
++ continue;
++ }
++ break;
++ }
+ err = errno;
+
++ if (fd >= 0)
++ close(fd);
++
+ if (WARN_ONCE(fd < 0 && err != EBUSY,
+ "perf_event_open(..., 0) failed unexpectedly with error %d (%s)\n",
+ err, strerror_r(err, sbuf, sizeof(sbuf))))
+ return -1;
+
+- close(fd);
+-
+ return 0;
+ }
+
^ permalink raw reply related [flat|nested] 67+ messages in thread
* [gentoo-commits] proj/linux-patches:3.18 commit in: /
@ 2015-03-21 20:02 Mike Pagano
0 siblings, 0 replies; 67+ messages in thread
From: Mike Pagano @ 2015-03-21 20:02 UTC (permalink / raw
To: gentoo-commits
commit: f43b9706f180d5e95a5c2772dfc0915600a302da
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Sat Mar 21 20:02:56 2015 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Sat Mar 21 20:02:56 2015 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=f43b9706
Update gcc >= 4.9 optimization patch. See bug #544028.
...-additional-cpu-optimizations-for-gcc-4.9.patch | 67 +++++++++++++---------
1 file changed, 41 insertions(+), 26 deletions(-)
diff --git a/5010_enable-additional-cpu-optimizations-for-gcc-4.9.patch b/5010_enable-additional-cpu-optimizations-for-gcc-4.9.patch
index f931f75..c4efd06 100644
--- a/5010_enable-additional-cpu-optimizations-for-gcc-4.9.patch
+++ b/5010_enable-additional-cpu-optimizations-for-gcc-4.9.patch
@@ -18,13 +18,14 @@ should use the newer 'march=bonnell' flag for atom processors.
I have made that change to this patch set as well. See the following kernel
bug report to see if I'm right: https://bugzilla.kernel.org/show_bug.cgi?id=77461
-This patch will expand the number of microarchitectures to include new
+This patch will expand the number of microarchitectures to include newer
processors including: AMD K10-family, AMD Family 10h (Barcelona), AMD Family
14h (Bobcat), AMD Family 15h (Bulldozer), AMD Family 15h (Piledriver), AMD
Family 16h (Jaguar), Intel 1st Gen Core i3/i5/i7 (Nehalem), Intel 1.5 Gen Core
i3/i5/i7 (Westmere), Intel 2nd Gen Core i3/i5/i7 (Sandybridge), Intel 3rd Gen
-Core i3/i5/i7 (Ivybridge), Intel 4th Gen Core i3/i5/i7 (Haswell), and Intel 5th
-Gen Core i3/i5/i7 (Broadwell). It also offers the compiler the 'native' flag.
+Core i3/i5/i7 (Ivybridge), Intel 4th Gen Core i3/i5/i7 (Haswell), Intel 5th
+Gen Core i3/i5/i7 (Broadwell), and the low power Silvermont series of Atom
+processors (Silvermont). It also offers the compiler the 'native' flag.
Small but real speed increases are measurable using a make endpoint comparing
a generic kernel to one built with one of the respective microarchs.
@@ -36,9 +37,9 @@ REQUIREMENTS
linux version >=3.15
gcc version >=4.9
---- a/arch/x86/include/asm/module.h 2014-08-03 18:25:02.000000000 -0400
-+++ b/arch/x86/include/asm/module.h 2014-09-13 09:37:16.721385247 -0400
-@@ -15,6 +15,20 @@
+--- a/arch/x86/include/asm/module.h 2014-06-16 16:44:27.000000000 -0400
++++ b/arch/x86/include/asm/module.h 2015-03-07 03:27:32.556672424 -0500
+@@ -15,6 +15,22 @@
#define MODULE_PROC_FAMILY "586MMX "
#elif defined CONFIG_MCORE2
#define MODULE_PROC_FAMILY "CORE2 "
@@ -48,6 +49,8 @@ gcc version >=4.9
+#define MODULE_PROC_FAMILY "NEHALEM "
+#elif defined CONFIG_MWESTMERE
+#define MODULE_PROC_FAMILY "WESTMERE "
++#elif defined CONFIG_MSILVERMONT
++#define MODULE_PROC_FAMILY "SILVERMONT "
+#elif defined CONFIG_MSANDYBRIDGE
+#define MODULE_PROC_FAMILY "SANDYBRIDGE "
+#elif defined CONFIG_MIVYBRIDGE
@@ -59,7 +62,7 @@ gcc version >=4.9
#elif defined CONFIG_MATOM
#define MODULE_PROC_FAMILY "ATOM "
#elif defined CONFIG_M686
-@@ -33,6 +47,20 @@
+@@ -33,6 +49,20 @@
#define MODULE_PROC_FAMILY "K7 "
#elif defined CONFIG_MK8
#define MODULE_PROC_FAMILY "K8 "
@@ -80,8 +83,8 @@ gcc version >=4.9
#elif defined CONFIG_MELAN
#define MODULE_PROC_FAMILY "ELAN "
#elif defined CONFIG_MCRUSOE
---- a/arch/x86/Kconfig.cpu 2014-08-03 18:25:02.000000000 -0400
-+++ b/arch/x86/Kconfig.cpu 2014-09-13 09:37:16.721385247 -0400
+--- a/arch/x86/Kconfig.cpu 2014-06-16 16:44:27.000000000 -0400
++++ b/arch/x86/Kconfig.cpu 2015-03-07 03:32:14.337713226 -0500
@@ -137,9 +137,8 @@ config MPENTIUM4
-Paxville
-Dempsey
@@ -185,7 +188,7 @@ gcc version >=4.9
---help---
Select this for Intel Core 2 and newer Core 2 Xeons (Xeon 51xx and
-@@ -260,14 +318,55 @@ config MCORE2
+@@ -260,14 +318,63 @@ config MCORE2
family in /proc/cpuinfo. Newer ones have 6 and older ones 15
(not a typo)
@@ -213,6 +216,14 @@ gcc version >=4.9
+
+ Enables -march=westmere
+
++config MSILVERMONT
++ bool "Intel Silvermont"
++ ---help---
++
++ Select this for the Intel Silvermont platform.
++
++ Enables -march=silvermont
++
+config MSANDYBRIDGE
+ bool "Intel Sandy Bridge"
+ ---help---
@@ -247,7 +258,7 @@ gcc version >=4.9
config GENERIC_CPU
bool "Generic-x86-64"
-@@ -276,6 +375,19 @@ config GENERIC_CPU
+@@ -276,6 +383,19 @@ config GENERIC_CPU
Generic x86-64 CPU.
Run equally well on all x86-64 CPUs.
@@ -267,53 +278,53 @@ gcc version >=4.9
endchoice
config X86_GENERIC
-@@ -300,7 +412,7 @@ config X86_INTERNODE_CACHE_SHIFT
+@@ -300,7 +420,7 @@ config X86_INTERNODE_CACHE_SHIFT
config X86_L1_CACHE_SHIFT
int
default "7" if MPENTIUM4 || MPSC
- default "6" if MK7 || MK8 || MPENTIUMM || MCORE2 || MATOM || MVIAC7 || X86_GENERIC || GENERIC_CPU
-+ default "6" if MK7 || MK8 || MK8SSE3 || MK10 || MBARCELONA || MBOBCAT || MBULLDOZER || MPILEDRIVER || MJAGUAR || MPENTIUMM || MCORE2 || MNEHALEM || MWESTMERE || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || BROADWELL || MNATIVE || MATOM || MVIAC7 || X86_GENERIC || GENERIC_CPU
++ default "6" if MK7 || MK8 || MK8SSE3 || MK10 || MBARCELONA || MBOBCAT || MBULLDOZER || MPILEDRIVER || MJAGUAR || MPENTIUMM || MCORE2 || MNEHALEM || MWESTMERE || MSILVERMONT || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || BROADWELL || MNATIVE || MATOM || MVIAC7 || X86_GENERIC || GENERIC_CPU
default "4" if MELAN || M486 || MGEODEGX1
default "5" if MWINCHIP3D || MWINCHIPC6 || MCRUSOE || MEFFICEON || MCYRIXIII || MK6 || MPENTIUMIII || MPENTIUMII || M686 || M586MMX || M586TSC || M586 || MVIAC3_2 || MGEODE_LX
-@@ -331,11 +443,11 @@ config X86_ALIGNMENT_16
+@@ -331,11 +451,11 @@ config X86_ALIGNMENT_16
config X86_INTEL_USERCOPY
def_bool y
- depends on MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M586MMX || X86_GENERIC || MK8 || MK7 || MEFFICEON || MCORE2
-+ depends on MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M586MMX || X86_GENERIC || MK8 || MK8SSE3 || MK7 || MEFFICEON || MCORE2 || MK10 || MBARCELONA || MNEHALEM || MWESTMERE || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || MBROADWELL || MNATIVE
++ depends on MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M586MMX || X86_GENERIC || MK8 || MK8SSE3 || MK7 || MEFFICEON || MCORE2 || MK10 || MBARCELONA || MNEHALEM || MWESTMERE || MSILVERMONT || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || MBROADWELL || MNATIVE
config X86_USE_PPRO_CHECKSUM
def_bool y
- depends on MWINCHIP3D || MWINCHIPC6 || MCYRIXIII || MK7 || MK6 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MK8 || MVIAC3_2 || MVIAC7 || MEFFICEON || MGEODE_LX || MCORE2 || MATOM
-+ depends on MWINCHIP3D || MWINCHIPC6 || MCYRIXIII || MK7 || MK6 || MK10 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MK8 || MK8SSE3 || MVIAC3_2 || MVIAC7 || MEFFICEON || MGEODE_LX || MCORE2 || MNEHALEM || MWESTMERE || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || MBROADWELL || MATOM || MNATIVE
++ depends on MWINCHIP3D || MWINCHIPC6 || MCYRIXIII || MK7 || MK6 || MK10 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MK8 || MK8SSE3 || MVIAC3_2 || MVIAC7 || MEFFICEON || MGEODE_LX || MCORE2 || MNEHALEM || MWESTMERE || MSILVERMONT || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || MBROADWELL || MATOM || MNATIVE
config X86_USE_3DNOW
def_bool y
-@@ -359,17 +471,17 @@ config X86_P6_NOP
+@@ -359,17 +479,17 @@ config X86_P6_NOP
config X86_TSC
def_bool y
- depends on (MWINCHIP3D || MCRUSOE || MEFFICEON || MCYRIXIII || MK7 || MK6 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || M586MMX || M586TSC || MK8 || MVIAC3_2 || MVIAC7 || MGEODEGX1 || MGEODE_LX || MCORE2 || MATOM) || X86_64
-+ depends on (MWINCHIP3D || MCRUSOE || MEFFICEON || MCYRIXIII || MK7 || MK6 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || M586MMX || M586TSC || MK8 || MK8SSE3 || MVIAC3_2 || MVIAC7 || MGEODEGX1 || MGEODE_LX || MCORE2 || MNEHALEM || MWESTMERE || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || MBROADWELL || MNATIVE || MATOM) || X86_64
++ depends on (MWINCHIP3D || MCRUSOE || MEFFICEON || MCYRIXIII || MK7 || MK6 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || M586MMX || M586TSC || MK8 || MK8SSE3 || MVIAC3_2 || MVIAC7 || MGEODEGX1 || MGEODE_LX || MCORE2 || MNEHALEM || MWESTMERE || MSILVERMONT || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || MBROADWELL || MNATIVE || MATOM) || X86_64
config X86_CMPXCHG64
def_bool y
- depends on X86_PAE || X86_64 || MCORE2 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MATOM
-+ depends on X86_PAE || X86_64 || MCORE2 || MNEHALEM || MWESTMERE || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || MBROADWELL || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MATOM || MNATIVE
++ depends on X86_PAE || X86_64 || MCORE2 || MNEHALEM || MWESTMERE || MSILVERMONT || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || MBROADWELL || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MATOM || MNATIVE
# this should be set for all -march=.. options where the compiler
# generates cmov.
config X86_CMOV
def_bool y
- depends on (MK8 || MK7 || MCORE2 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MVIAC3_2 || MVIAC7 || MCRUSOE || MEFFICEON || X86_64 || MATOM || MGEODE_LX)
-+ depends on (MK8 || MK8SSE3 || MK10 || MBARCELONA || MBOBCAT || MBULLDOZER || MPILEDRIVER || MJAGUAR || MK7 || MCORE2 || MNEHALEM || MWESTMERE || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || MBROADWELL || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MVIAC3_2 || MVIAC7 || MCRUSOE || MEFFICEON || X86_64 || MNATIVE || MATOM || MGEODE_LX)
++ depends on (MK8 || MK8SSE3 || MK10 || MBARCELONA || MBOBCAT || MBULLDOZER || MPILEDRIVER || MJAGUAR || MK7 || MCORE2 || MNEHALEM || MWESTMERE || MSILVERMONT || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || MBROADWELL || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MVIAC3_2 || MVIAC7 || MCRUSOE || MEFFICEON || X86_64 || MNATIVE || MATOM || MGEODE_LX)
config X86_MINIMUM_CPU_FAMILY
int
---- a/arch/x86/Makefile 2014-08-03 18:25:02.000000000 -0400
-+++ b/arch/x86/Makefile 2014-09-13 09:37:16.721385247 -0400
-@@ -92,13 +92,33 @@ else
+--- a/arch/x86/Makefile 2014-06-16 16:44:27.000000000 -0400
++++ b/arch/x86/Makefile 2015-03-07 03:33:27.650843211 -0500
+@@ -92,13 +92,35 @@ else
KBUILD_CFLAGS += $(call cc-option,-mpreferred-stack-boundary=3)
# FIXME - should be integrated in Makefile.cpu (Makefile_32.cpu)
@@ -337,6 +348,8 @@ gcc version >=4.9
+ $(call cc-option,-march=nehalem,$(call cc-option,-mtune=nehalem))
+ cflags-$(CONFIG_MWESTMERE) += \
+ $(call cc-option,-march=westmere,$(call cc-option,-mtune=westmere))
++ cflags-$(CONFIG_MSILVERMONT) += \
++ $(call cc-option,-march=silvermont,$(call cc-option,-mtune=silvermont))
+ cflags-$(CONFIG_MSANDYBRIDGE) += \
+ $(call cc-option,-march=sandybridge,$(call cc-option,-mtune=sandybridge))
+ cflags-$(CONFIG_MIVYBRIDGE) += \
@@ -350,8 +363,8 @@ gcc version >=4.9
cflags-$(CONFIG_GENERIC_CPU) += $(call cc-option,-mtune=generic)
KBUILD_CFLAGS += $(cflags-y)
---- a/arch/x86/Makefile_32.cpu 2014-08-03 18:25:02.000000000 -0400
-+++ b/arch/x86/Makefile_32.cpu 2014-09-13 09:37:16.721385247 -0400
+--- a/arch/x86/Makefile_32.cpu 2014-06-16 16:44:27.000000000 -0400
++++ b/arch/x86/Makefile_32.cpu 2015-03-07 03:34:15.203586024 -0500
@@ -23,7 +23,15 @@ cflags-$(CONFIG_MK6) += -march=k6
# Please note, that patches that add -march=athlon-xp and friends are pointless.
# They make zero difference whatsosever to performance at this time.
@@ -368,7 +381,7 @@ gcc version >=4.9
cflags-$(CONFIG_MCRUSOE) += -march=i686 $(align)-functions=0 $(align)-jumps=0 $(align)-loops=0
cflags-$(CONFIG_MEFFICEON) += -march=i686 $(call tune,pentium3) $(align)-functions=0 $(align)-jumps=0 $(align)-loops=0
cflags-$(CONFIG_MWINCHIPC6) += $(call cc-option,-march=winchip-c6,-march=i586)
-@@ -32,8 +40,14 @@ cflags-$(CONFIG_MCYRIXIII) += $(call cc-
+@@ -32,8 +40,15 @@ cflags-$(CONFIG_MCYRIXIII) += $(call cc-
cflags-$(CONFIG_MVIAC3_2) += $(call cc-option,-march=c3-2,-march=i686)
cflags-$(CONFIG_MVIAC7) += -march=i686
cflags-$(CONFIG_MCORE2) += -march=i686 $(call tune,core2)
@@ -376,6 +389,7 @@ gcc version >=4.9
- $(call cc-option,-mtune=atom,$(call cc-option,-mtune=generic))
+cflags-$(CONFIG_MNEHALEM) += -march=i686 $(call tune,nehalem)
+cflags-$(CONFIG_MWESTMERE) += -march=i686 $(call tune,westmere)
++cflags-$(CONFIG_MSILVERMONT) += -march=i686 $(call tune,silvermont)
+cflags-$(CONFIG_MSANDYBRIDGE) += -march=i686 $(call tune,sandybridge)
+cflags-$(CONFIG_MIVYBRIDGE) += -march=i686 $(call tune,ivybridge)
+cflags-$(CONFIG_MHASWELL) += -march=i686 $(call tune,haswell)
@@ -385,3 +399,4 @@ gcc version >=4.9
# AMD Elan support
cflags-$(CONFIG_MELAN) += -march=i486
+
^ permalink raw reply related [flat|nested] 67+ messages in thread
* [gentoo-commits] proj/linux-patches:3.18 commit in: /
@ 2015-03-24 23:19 Mike Pagano
0 siblings, 0 replies; 67+ messages in thread
From: Mike Pagano @ 2015-03-24 23:19 UTC (permalink / raw
To: gentoo-commits
commit: 2c07eb276f5dc53f6200006e696e9af2077bfecc
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Tue Mar 24 23:19:25 2015 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Tue Mar 24 23:19:25 2015 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=2c07eb27
Linux patch 3.18.10
0000_README | 4 +
1009_linux-3.18.10.patch | 6057 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 6061 insertions(+)
diff --git a/0000_README b/0000_README
index 8161304..ab13f61 100644
--- a/0000_README
+++ b/0000_README
@@ -79,6 +79,10 @@ Patch: 1008_linux-3.18.9.patch
From: http://www.kernel.org
Desc: Linux 3.18.9
+Patch: 1009_linux-3.18.10.patch
+From: http://www.kernel.org
+Desc: Linux 3.18.10
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1009_linux-3.18.10.patch b/1009_linux-3.18.10.patch
new file mode 100644
index 0000000..7a9284f
--- /dev/null
+++ b/1009_linux-3.18.10.patch
@@ -0,0 +1,6057 @@
+diff --git a/Documentation/stable_kernel_rules.txt b/Documentation/stable_kernel_rules.txt
+index aee73e78c7d4..02f8331edb8b 100644
+--- a/Documentation/stable_kernel_rules.txt
++++ b/Documentation/stable_kernel_rules.txt
+@@ -32,18 +32,42 @@ Procedure for submitting patches to the -stable tree:
+ - If the patch covers files in net/ or drivers/net please follow netdev stable
+ submission guidelines as described in
+ Documentation/networking/netdev-FAQ.txt
+- - Send the patch, after verifying that it follows the above rules, to
+- stable@vger.kernel.org. You must note the upstream commit ID in the
+- changelog of your submission, as well as the kernel version you wish
+- it to be applied to.
+- - To have the patch automatically included in the stable tree, add the tag
++ - Security patches should not be handled (solely) by the -stable review
++ process but should follow the procedures in Documentation/SecurityBugs.
++
++For all other submissions, choose one of the following procedures:
++
++ --- Option 1 ---
++
++ To have the patch automatically included in the stable tree, add the tag
+ Cc: stable@vger.kernel.org
+ in the sign-off area. Once the patch is merged it will be applied to
+ the stable tree without anything else needing to be done by the author
+ or subsystem maintainer.
+- - If the patch requires other patches as prerequisites which can be
+- cherry-picked, then this can be specified in the following format in
+- the sign-off area:
++
++ --- Option 2 ---
++
++ After the patch has been merged to Linus' tree, send an email to
++ stable@vger.kernel.org containing the subject of the patch, the commit ID,
++ why you think it should be applied, and what kernel version you wish it to
++ be applied to.
++
++ --- Option 3 ---
++
++ Send the patch, after verifying that it follows the above rules, to
++ stable@vger.kernel.org. You must note the upstream commit ID in the
++ changelog of your submission, as well as the kernel version you wish
++ it to be applied to.
++
++Option 1 is probably the easiest and most common. Options 2 and 3 are more
++useful if the patch isn't deemed worthy at the time it is applied to a public
++git tree (for instance, because it deserves more regression testing first).
++Option 3 is especially useful if the patch needs some special handling to apply
++to an older kernel (e.g., if API's have changed in the meantime).
++
++Additionally, some patches submitted via Option 1 may have additional patch
++prerequisites which can be cherry-picked. This can be specified in the following
++format in the sign-off area:
+
+ Cc: <stable@vger.kernel.org> # 3.3.x: a1f84a3: sched: Check for idle
+ Cc: <stable@vger.kernel.org> # 3.3.x: 1b9508f: sched: Rate-limit newidle
+@@ -57,13 +81,13 @@ Procedure for submitting patches to the -stable tree:
+ git cherry-pick fd21073
+ git cherry-pick <this commit>
+
++Following the submission:
++
+ - The sender will receive an ACK when the patch has been accepted into the
+ queue, or a NAK if the patch is rejected. This response might take a few
+ days, according to the developer's schedules.
+ - If accepted, the patch will be added to the -stable queue, for review by
+ other developers and by the relevant subsystem maintainer.
+- - Security patches should not be sent to this alias, but instead to the
+- documented security@kernel.org address.
+
+
+ Review cycle:
+diff --git a/Makefile b/Makefile
+index 62b333802a0e..d4ce2cb674c8 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 18
+-SUBLEVEL = 9
++SUBLEVEL = 10
+ EXTRAVERSION =
+ NAME = Diseased Newt
+
+diff --git a/arch/arc/include/asm/processor.h b/arch/arc/include/asm/processor.h
+index 210fe97464c3..c750af161979 100644
+--- a/arch/arc/include/asm/processor.h
++++ b/arch/arc/include/asm/processor.h
+@@ -75,18 +75,19 @@ unsigned long thread_saved_pc(struct task_struct *t);
+ #define release_segments(mm) do { } while (0)
+
+ #define KSTK_EIP(tsk) (task_pt_regs(tsk)->ret)
++#define KSTK_ESP(tsk) (task_pt_regs(tsk)->sp)
+
+ /*
+ * Where abouts of Task's sp, fp, blink when it was last seen in kernel mode.
+ * Look in process.c for details of kernel stack layout
+ */
+-#define KSTK_ESP(tsk) (tsk->thread.ksp)
++#define TSK_K_ESP(tsk) (tsk->thread.ksp)
+
+-#define KSTK_REG(tsk, off) (*((unsigned int *)(KSTK_ESP(tsk) + \
++#define TSK_K_REG(tsk, off) (*((unsigned int *)(TSK_K_ESP(tsk) + \
+ sizeof(struct callee_regs) + off)))
+
+-#define KSTK_BLINK(tsk) KSTK_REG(tsk, 4)
+-#define KSTK_FP(tsk) KSTK_REG(tsk, 0)
++#define TSK_K_BLINK(tsk) TSK_K_REG(tsk, 4)
++#define TSK_K_FP(tsk) TSK_K_REG(tsk, 0)
+
+ extern void start_thread(struct pt_regs * regs, unsigned long pc,
+ unsigned long usp);
+diff --git a/arch/arc/kernel/stacktrace.c b/arch/arc/kernel/stacktrace.c
+index 9ce47cfe2303..fb98769b6a98 100644
+--- a/arch/arc/kernel/stacktrace.c
++++ b/arch/arc/kernel/stacktrace.c
+@@ -64,9 +64,9 @@ static void seed_unwind_frame_info(struct task_struct *tsk,
+
+ frame_info->task = tsk;
+
+- frame_info->regs.r27 = KSTK_FP(tsk);
+- frame_info->regs.r28 = KSTK_ESP(tsk);
+- frame_info->regs.r31 = KSTK_BLINK(tsk);
++ frame_info->regs.r27 = TSK_K_FP(tsk);
++ frame_info->regs.r28 = TSK_K_ESP(tsk);
++ frame_info->regs.r31 = TSK_K_BLINK(tsk);
+ frame_info->regs.r63 = (unsigned int)__switch_to;
+
+ /* In the prologue of __switch_to, first FP is saved on stack
+diff --git a/arch/mips/kvm/trace.h b/arch/mips/kvm/trace.h
+index c1388d40663b..bd6437f67dc0 100644
+--- a/arch/mips/kvm/trace.h
++++ b/arch/mips/kvm/trace.h
+@@ -24,18 +24,18 @@ TRACE_EVENT(kvm_exit,
+ TP_PROTO(struct kvm_vcpu *vcpu, unsigned int reason),
+ TP_ARGS(vcpu, reason),
+ TP_STRUCT__entry(
+- __field(struct kvm_vcpu *, vcpu)
++ __field(unsigned long, pc)
+ __field(unsigned int, reason)
+ ),
+
+ TP_fast_assign(
+- __entry->vcpu = vcpu;
++ __entry->pc = vcpu->arch.pc;
+ __entry->reason = reason;
+ ),
+
+ TP_printk("[%s]PC: 0x%08lx",
+ kvm_mips_exit_types_str[__entry->reason],
+- __entry->vcpu->arch.pc)
++ __entry->pc)
+ );
+
+ #endif /* _TRACE_KVM_H */
+diff --git a/arch/powerpc/include/asm/pnv-pci.h b/arch/powerpc/include/asm/pnv-pci.h
+index f09a22fa1bd7..bfa8f8ac51fa 100644
+--- a/arch/powerpc/include/asm/pnv-pci.h
++++ b/arch/powerpc/include/asm/pnv-pci.h
+@@ -19,7 +19,7 @@ int pnv_cxl_ioda_msi_setup(struct pci_dev *dev, unsigned int hwirq,
+ int pnv_cxl_alloc_hwirqs(struct pci_dev *dev, int num);
+ void pnv_cxl_release_hwirqs(struct pci_dev *dev, int hwirq, int num);
+ int pnv_cxl_get_irq_count(struct pci_dev *dev);
+-struct device_node *pnv_pci_to_phb_node(struct pci_dev *dev);
++struct device_node *pnv_pci_get_phb_node(struct pci_dev *dev);
+
+ #ifdef CONFIG_CXL_BASE
+ int pnv_cxl_alloc_hwirq_ranges(struct cxl_irq_ranges *irqs,
+diff --git a/arch/powerpc/platforms/powernv/pci-ioda.c b/arch/powerpc/platforms/powernv/pci-ioda.c
+index 3ba435ec3dcd..3f596706a5b7 100644
+--- a/arch/powerpc/platforms/powernv/pci-ioda.c
++++ b/arch/powerpc/platforms/powernv/pci-ioda.c
+@@ -1355,13 +1355,13 @@ static void set_msi_irq_chip(struct pnv_phb *phb, unsigned int virq)
+
+ #ifdef CONFIG_CXL_BASE
+
+-struct device_node *pnv_pci_to_phb_node(struct pci_dev *dev)
++struct device_node *pnv_pci_get_phb_node(struct pci_dev *dev)
+ {
+ struct pci_controller *hose = pci_bus_to_host(dev->bus);
+
+- return hose->dn;
++ return of_node_get(hose->dn);
+ }
+-EXPORT_SYMBOL(pnv_pci_to_phb_node);
++EXPORT_SYMBOL(pnv_pci_get_phb_node);
+
+ int pnv_phb_to_cxl(struct pci_dev *dev)
+ {
+diff --git a/arch/x86/include/asm/xsave.h b/arch/x86/include/asm/xsave.h
+index 7e7a79ada658..d82b80405e45 100644
+--- a/arch/x86/include/asm/xsave.h
++++ b/arch/x86/include/asm/xsave.h
+@@ -81,18 +81,15 @@ static inline int xsave_state_booting(struct xsave_struct *fx, u64 mask)
+ if (boot_cpu_has(X86_FEATURE_XSAVES))
+ asm volatile("1:"XSAVES"\n\t"
+ "2:\n\t"
+- : : "D" (fx), "m" (*fx), "a" (lmask), "d" (hmask)
++ xstate_fault
++ : "D" (fx), "m" (*fx), "a" (lmask), "d" (hmask)
+ : "memory");
+ else
+ asm volatile("1:"XSAVE"\n\t"
+ "2:\n\t"
+- : : "D" (fx), "m" (*fx), "a" (lmask), "d" (hmask)
++ xstate_fault
++ : "D" (fx), "m" (*fx), "a" (lmask), "d" (hmask)
+ : "memory");
+-
+- asm volatile(xstate_fault
+- : "0" (0)
+- : "memory");
+-
+ return err;
+ }
+
+@@ -111,18 +108,15 @@ static inline int xrstor_state_booting(struct xsave_struct *fx, u64 mask)
+ if (boot_cpu_has(X86_FEATURE_XSAVES))
+ asm volatile("1:"XRSTORS"\n\t"
+ "2:\n\t"
+- : : "D" (fx), "m" (*fx), "a" (lmask), "d" (hmask)
++ xstate_fault
++ : "D" (fx), "m" (*fx), "a" (lmask), "d" (hmask)
+ : "memory");
+ else
+ asm volatile("1:"XRSTOR"\n\t"
+ "2:\n\t"
+- : : "D" (fx), "m" (*fx), "a" (lmask), "d" (hmask)
++ xstate_fault
++ : "D" (fx), "m" (*fx), "a" (lmask), "d" (hmask)
+ : "memory");
+-
+- asm volatile(xstate_fault
+- : "0" (0)
+- : "memory");
+-
+ return err;
+ }
+
+@@ -148,9 +142,9 @@ static inline int xsave_state(struct xsave_struct *fx, u64 mask)
+ */
+ alternative_input_2(
+ "1:"XSAVE,
+- "1:"XSAVEOPT,
++ XSAVEOPT,
+ X86_FEATURE_XSAVEOPT,
+- "1:"XSAVES,
++ XSAVES,
+ X86_FEATURE_XSAVES,
+ [fx] "D" (fx), "a" (lmask), "d" (hmask) :
+ "memory");
+@@ -177,7 +171,7 @@ static inline int xrstor_state(struct xsave_struct *fx, u64 mask)
+ */
+ alternative_input(
+ "1: " XRSTOR,
+- "1: " XRSTORS,
++ XRSTORS,
+ X86_FEATURE_XSAVES,
+ "D" (fx), "m" (*fx), "a" (lmask), "d" (hmask)
+ : "memory");
+diff --git a/arch/x86/kernel/entry_64.S b/arch/x86/kernel/entry_64.S
+index c0226ab54106..f1dc27f457f1 100644
+--- a/arch/x86/kernel/entry_64.S
++++ b/arch/x86/kernel/entry_64.S
+@@ -334,11 +334,14 @@ ENTRY(ret_from_fork)
+ testl $3, CS-ARGOFFSET(%rsp) # from kernel_thread?
+ jz 1f
+
+- testl $_TIF_IA32, TI_flags(%rcx) # 32-bit compat task needs IRET
+- jnz int_ret_from_sys_call
+-
+- RESTORE_TOP_OF_STACK %rdi, -ARGOFFSET
+- jmp ret_from_sys_call # go to the SYSRET fastpath
++ /*
++ * By the time we get here, we have no idea whether our pt_regs,
++ * ti flags, and ti status came from the 64-bit SYSCALL fast path,
++ * the slow path, or one of the ia32entry paths.
++ * Use int_ret_from_sys_call to return, since it can safely handle
++ * all of the above.
++ */
++ jmp int_ret_from_sys_call
+
+ 1:
+ subq $REST_SKIP, %rsp # leave space for volatiles
+diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
+index c7327a7761ca..974e4d98ed29 100644
+--- a/arch/x86/kvm/emulate.c
++++ b/arch/x86/kvm/emulate.c
+@@ -4829,7 +4829,8 @@ int x86_emulate_insn(struct x86_emulate_ctxt *ctxt)
+ if (rc != X86EMUL_CONTINUE)
+ goto done;
+ }
+- ctxt->dst.orig_val = ctxt->dst.val;
++ /* Copy full 64-bit value for CMPXCHG8B. */
++ ctxt->dst.orig_val64 = ctxt->dst.val64;
+
+ special_insn:
+
+diff --git a/drivers/acpi/acpi_lpss.c b/drivers/acpi/acpi_lpss.c
+index 41e9c199e874..fdb5701bed75 100644
+--- a/drivers/acpi/acpi_lpss.c
++++ b/drivers/acpi/acpi_lpss.c
+@@ -65,6 +65,7 @@ struct lpss_private_data;
+
+ struct lpss_device_desc {
+ unsigned int flags;
++ const char *clk_con_id;
+ unsigned int prv_offset;
+ size_t prv_size_override;
+ void (*setup)(struct lpss_private_data *pdata);
+@@ -140,6 +141,7 @@ static struct lpss_device_desc lpt_i2c_dev_desc = {
+
+ static struct lpss_device_desc lpt_uart_dev_desc = {
+ .flags = LPSS_CLK | LPSS_CLK_GATE | LPSS_CLK_DIVIDER | LPSS_LTR,
++ .clk_con_id = "baudclk",
+ .prv_offset = 0x800,
+ .setup = lpss_uart_setup,
+ };
+@@ -156,6 +158,7 @@ static struct lpss_device_desc byt_pwm_dev_desc = {
+
+ static struct lpss_device_desc byt_uart_dev_desc = {
+ .flags = LPSS_CLK | LPSS_CLK_GATE | LPSS_CLK_DIVIDER | LPSS_SAVE_CTX,
++ .clk_con_id = "baudclk",
+ .prv_offset = 0x800,
+ .setup = lpss_uart_setup,
+ };
+@@ -313,7 +316,7 @@ out:
+ return PTR_ERR(clk);
+
+ pdata->clk = clk;
+- clk_register_clkdev(clk, NULL, devname);
++ clk_register_clkdev(clk, dev_desc->clk_con_id, devname);
+ return 0;
+ }
+
+diff --git a/drivers/acpi/video.c b/drivers/acpi/video.c
+index 41322591fb43..ff7bc22b6135 100644
+--- a/drivers/acpi/video.c
++++ b/drivers/acpi/video.c
+@@ -2124,6 +2124,17 @@ EXPORT_SYMBOL(acpi_video_unregister_backlight);
+
+ static int __init acpi_video_init(void)
+ {
++ /*
++ * Let the module load even if ACPI is disabled (e.g. due to
++ * a broken BIOS) so that i915.ko can still be loaded on such
++ * old systems without an AcpiOpRegion.
++ *
++ * acpi_video_register() will report -ENODEV later as well due
++ * to acpi_disabled when i915.ko tries to register itself afterwards.
++ */
++ if (acpi_disabled)
++ return 0;
++
+ dmi_check_system(video_dmi_table);
+
+ if (intel_opregion_present())
+diff --git a/drivers/clk/clk-gate.c b/drivers/clk/clk-gate.c
+index 51fd87fb7ba6..da00eeb95dad 100644
+--- a/drivers/clk/clk-gate.c
++++ b/drivers/clk/clk-gate.c
+@@ -128,7 +128,7 @@ struct clk *clk_register_gate(struct device *dev, const char *name,
+ struct clk_init_data init;
+
+ if (clk_gate_flags & CLK_GATE_HIWORD_MASK) {
+- if (bit_idx > 16) {
++ if (bit_idx > 15) {
+ pr_err("gate bit exceeds LOWORD field\n");
+ return ERR_PTR(-EINVAL);
+ }
+diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c
+index 26bed0889e97..7d74830e2ced 100644
+--- a/drivers/clk/clk.c
++++ b/drivers/clk/clk.c
+@@ -343,13 +343,9 @@ unlock:
+ static void clk_debug_unregister(struct clk *clk)
+ {
+ mutex_lock(&clk_debug_lock);
+- if (!clk->dentry)
+- goto out;
+-
+ hlist_del_init(&clk->debug_node);
+ debugfs_remove_recursive(clk->dentry);
+ clk->dentry = NULL;
+-out:
+ mutex_unlock(&clk_debug_lock);
+ }
+
+diff --git a/drivers/clk/sunxi/clk-sunxi.c b/drivers/clk/sunxi/clk-sunxi.c
+index d5dc951264ca..b18e22fb25a6 100644
+--- a/drivers/clk/sunxi/clk-sunxi.c
++++ b/drivers/clk/sunxi/clk-sunxi.c
+@@ -419,6 +419,7 @@ static struct clk_factors_config sun6i_a31_pll1_config = {
+ .kwidth = 2,
+ .mshift = 0,
+ .mwidth = 2,
++ .n_start = 1,
+ };
+
+ static struct clk_factors_config sun8i_a23_pll1_config = {
+diff --git a/drivers/clk/zynq/clkc.c b/drivers/clk/zynq/clkc.c
+index 9037bebd69f7..f870aad57711 100644
+--- a/drivers/clk/zynq/clkc.c
++++ b/drivers/clk/zynq/clkc.c
+@@ -303,6 +303,7 @@ static void __init zynq_clk_setup(struct device_node *np)
+ clks[cpu_2x] = clk_register_gate(NULL, clk_output_name[cpu_2x],
+ "cpu_2x_div", CLK_IGNORE_UNUSED, SLCR_ARM_CLK_CTRL,
+ 26, 0, &armclk_lock);
++ clk_prepare_enable(clks[cpu_2x]);
+
+ clk = clk_register_fixed_factor(NULL, "cpu_1x_div", "cpu_div", 0, 1,
+ 4 + 2 * tmp);
+diff --git a/drivers/dma-buf/reservation.c b/drivers/dma-buf/reservation.c
+index 3c97c8fa8d02..8a37af923094 100644
+--- a/drivers/dma-buf/reservation.c
++++ b/drivers/dma-buf/reservation.c
+@@ -402,8 +402,6 @@ reservation_object_test_signaled_single(struct fence *passed_fence)
+ int ret = 1;
+
+ if (!test_bit(FENCE_FLAG_SIGNALED_BIT, &lfence->flags)) {
+- int ret;
+-
+ fence = fence_get_rcu(lfence);
+ if (!fence)
+ return -1;
+diff --git a/drivers/firmware/efi/libstub/efi-stub-helper.c b/drivers/firmware/efi/libstub/efi-stub-helper.c
+index a920fec8fe88..5186eb01945a 100644
+--- a/drivers/firmware/efi/libstub/efi-stub-helper.c
++++ b/drivers/firmware/efi/libstub/efi-stub-helper.c
+@@ -170,12 +170,12 @@ again:
+ start = desc->phys_addr;
+ end = start + desc->num_pages * (1UL << EFI_PAGE_SHIFT);
+
+- if ((start + size) > end || (start + size) > max)
+- continue;
+-
+- if (end - size > max)
++ if (end > max)
+ end = max;
+
++ if ((start + size) > end)
++ continue;
++
+ if (round_down(end - size, align) < start)
+ continue;
+
+diff --git a/drivers/firmware/efi/runtime-map.c b/drivers/firmware/efi/runtime-map.c
+index 018c29a26615..87b8e3b900d2 100644
+--- a/drivers/firmware/efi/runtime-map.c
++++ b/drivers/firmware/efi/runtime-map.c
+@@ -191,7 +191,7 @@ int __init efi_runtime_map_init(struct kobject *efi_kobj)
+
+ return 0;
+ out_add_entry:
+- for (j = i - 1; j > 0; j--) {
++ for (j = i - 1; j >= 0; j--) {
+ entry = *(map_entries + j);
+ kobject_put(&entry->kobj);
+ }
+diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
+index c33327d5c543..45434333b289 100644
+--- a/drivers/gpu/drm/i915/i915_drv.h
++++ b/drivers/gpu/drm/i915/i915_drv.h
+@@ -2077,6 +2077,7 @@ struct drm_i915_cmd_table {
+ (INTEL_DEVID(dev) & 0xFF00) == 0x0C00)
+ #define IS_BDW_ULT(dev) (IS_BROADWELL(dev) && \
+ ((INTEL_DEVID(dev) & 0xf) == 0x6 || \
++ (INTEL_DEVID(dev) & 0xf) == 0xb || \
+ (INTEL_DEVID(dev) & 0xf) == 0xe))
+ #define IS_HSW_ULT(dev) (IS_HASWELL(dev) && \
+ (INTEL_DEVID(dev) & 0xFF00) == 0x0A00)
+diff --git a/drivers/gpu/drm/i915/i915_gem_tiling.c b/drivers/gpu/drm/i915/i915_gem_tiling.c
+index 2b1eaa29ada4..6765148ea5bc 100644
+--- a/drivers/gpu/drm/i915/i915_gem_tiling.c
++++ b/drivers/gpu/drm/i915/i915_gem_tiling.c
+@@ -315,9 +315,10 @@ i915_gem_set_tiling(struct drm_device *dev, void *data,
+ return -EINVAL;
+ }
+
++ mutex_lock(&dev->struct_mutex);
+ if (i915_gem_obj_is_pinned(obj) || obj->framebuffer_references) {
+- drm_gem_object_unreference_unlocked(&obj->base);
+- return -EBUSY;
++ ret = -EBUSY;
++ goto err;
+ }
+
+ if (args->tiling_mode == I915_TILING_NONE) {
+@@ -349,7 +350,6 @@ i915_gem_set_tiling(struct drm_device *dev, void *data,
+ }
+ }
+
+- mutex_lock(&dev->struct_mutex);
+ if (args->tiling_mode != obj->tiling_mode ||
+ args->stride != obj->stride) {
+ /* We need to rebind the object if its current allocation
+@@ -395,6 +395,7 @@ i915_gem_set_tiling(struct drm_device *dev, void *data,
+ obj->bit_17 = NULL;
+ }
+
++err:
+ drm_gem_object_unreference(&obj->base);
+ mutex_unlock(&dev->struct_mutex);
+
+diff --git a/drivers/gpu/drm/i915/i915_gem_userptr.c b/drivers/gpu/drm/i915/i915_gem_userptr.c
+index d182058383a9..1719078c763a 100644
+--- a/drivers/gpu/drm/i915/i915_gem_userptr.c
++++ b/drivers/gpu/drm/i915/i915_gem_userptr.c
+@@ -113,7 +113,10 @@ restart:
+ continue;
+
+ obj = mo->obj;
+- drm_gem_object_reference(&obj->base);
++
++ if (!kref_get_unless_zero(&obj->base.refcount))
++ continue;
++
+ spin_unlock(&mn->lock);
+
+ cancel_userptr(obj);
+@@ -149,7 +152,20 @@ static void i915_gem_userptr_mn_invalidate_range_start(struct mmu_notifier *_mn,
+ it = interval_tree_iter_first(&mn->objects, start, end);
+ if (it != NULL) {
+ obj = container_of(it, struct i915_mmu_object, it)->obj;
+- drm_gem_object_reference(&obj->base);
++
++ /* The mmu_object is released late when destroying the
++ * GEM object so it is entirely possible to gain a
++ * reference on an object in the process of being freed
++ * since our serialisation is via the spinlock and not
++ * the struct_mutex - and consequently use it after it
++ * is freed and then double free it.
++ */
++ if (!kref_get_unless_zero(&obj->base.refcount)) {
++ spin_unlock(&mn->lock);
++ serial = 0;
++ continue;
++ }
++
+ serial = mn->serial;
+ }
+ spin_unlock(&mn->lock);
+diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
+index 9ba1177200b2..0ab77f319cef 100644
+--- a/drivers/gpu/drm/i915/i915_irq.c
++++ b/drivers/gpu/drm/i915/i915_irq.c
+@@ -2123,6 +2123,9 @@ static irqreturn_t valleyview_irq_handler(int irq, void *arg)
+ u32 iir, gt_iir, pm_iir;
+ irqreturn_t ret = IRQ_NONE;
+
++ if (!intel_irqs_enabled(dev_priv))
++ return IRQ_NONE;
++
+ while (true) {
+ /* Find, clear, then process each source of interrupt */
+
+@@ -2167,6 +2170,9 @@ static irqreturn_t cherryview_irq_handler(int irq, void *arg)
+ u32 master_ctl, iir;
+ irqreturn_t ret = IRQ_NONE;
+
++ if (!intel_irqs_enabled(dev_priv))
++ return IRQ_NONE;
++
+ for (;;) {
+ master_ctl = I915_READ(GEN8_MASTER_IRQ) & ~GEN8_MASTER_IRQ_CONTROL;
+ iir = I915_READ(VLV_IIR);
+@@ -2455,6 +2461,9 @@ static irqreturn_t ironlake_irq_handler(int irq, void *arg)
+ u32 de_iir, gt_iir, de_ier, sde_ier = 0;
+ irqreturn_t ret = IRQ_NONE;
+
++ if (!intel_irqs_enabled(dev_priv))
++ return IRQ_NONE;
++
+ /* We get interrupts on unclaimed registers, so check for this before we
+ * do any I915_{READ,WRITE}. */
+ intel_uncore_check_errors(dev);
+@@ -2525,6 +2534,9 @@ static irqreturn_t gen8_irq_handler(int irq, void *arg)
+ uint32_t tmp = 0;
+ enum pipe pipe;
+
++ if (!intel_irqs_enabled(dev_priv))
++ return IRQ_NONE;
++
+ master_ctl = I915_READ(GEN8_MASTER_IRQ);
+ master_ctl &= ~GEN8_MASTER_IRQ_CONTROL;
+ if (!master_ctl)
+@@ -4052,6 +4064,9 @@ static irqreturn_t i8xx_irq_handler(int irq, void *arg)
+ I915_DISPLAY_PLANE_A_FLIP_PENDING_INTERRUPT |
+ I915_DISPLAY_PLANE_B_FLIP_PENDING_INTERRUPT;
+
++ if (!intel_irqs_enabled(dev_priv))
++ return IRQ_NONE;
++
+ iir = I915_READ16(IIR);
+ if (iir == 0)
+ return IRQ_NONE;
+@@ -4238,6 +4253,9 @@ static irqreturn_t i915_irq_handler(int irq, void *arg)
+ I915_DISPLAY_PLANE_B_FLIP_PENDING_INTERRUPT;
+ int pipe, ret = IRQ_NONE;
+
++ if (!intel_irqs_enabled(dev_priv))
++ return IRQ_NONE;
++
+ iir = I915_READ(IIR);
+ do {
+ bool irq_received = (iir & ~flip_mask) != 0;
+@@ -4466,6 +4484,9 @@ static irqreturn_t i965_irq_handler(int irq, void *arg)
+ I915_DISPLAY_PLANE_A_FLIP_PENDING_INTERRUPT |
+ I915_DISPLAY_PLANE_B_FLIP_PENDING_INTERRUPT;
+
++ if (!intel_irqs_enabled(dev_priv))
++ return IRQ_NONE;
++
+ iir = I915_READ(IIR);
+
+ for (;;) {
+@@ -4777,4 +4798,5 @@ void intel_runtime_pm_restore_interrupts(struct drm_device *dev)
+ dev_priv->pm._irqs_disabled = false;
+ dev->driver->irq_preinstall(dev);
+ dev->driver->irq_postinstall(dev);
++ synchronize_irq(dev_priv->dev->irq);
+ }
+diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
+index 31b96643b59c..7a7c445b07b4 100644
+--- a/drivers/gpu/drm/i915/intel_display.c
++++ b/drivers/gpu/drm/i915/intel_display.c
+@@ -12895,6 +12895,9 @@ static struct intel_quirk intel_quirks[] = {
+
+ /* HP Chromebook 14 (Celeron 2955U) */
+ { 0x0a06, 0x103c, 0x21ed, quirk_backlight_present },
++
++ /* Dell Chromebook 11 */
++ { 0x0a06, 0x1028, 0x0a35, quirk_backlight_present },
+ };
+
+ static void intel_init_quirks(struct drm_device *dev)
+diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
+index 4bcd91757321..740d9ebbebde 100644
+--- a/drivers/gpu/drm/i915/intel_dp.c
++++ b/drivers/gpu/drm/i915/intel_dp.c
+@@ -3645,8 +3645,6 @@ intel_dp_link_down(struct intel_dp *intel_dp)
+ enum port port = intel_dig_port->port;
+ struct drm_device *dev = intel_dig_port->base.base.dev;
+ struct drm_i915_private *dev_priv = dev->dev_private;
+- struct intel_crtc *intel_crtc =
+- to_intel_crtc(intel_dig_port->base.base.crtc);
+ uint32_t DP = intel_dp->DP;
+
+ if (WARN_ON(HAS_DDI(dev)))
+@@ -3671,8 +3669,6 @@ intel_dp_link_down(struct intel_dp *intel_dp)
+
+ if (HAS_PCH_IBX(dev) &&
+ I915_READ(intel_dp->output_reg) & DP_PIPEB_SELECT) {
+- struct drm_crtc *crtc = intel_dig_port->base.base.crtc;
+-
+ /* Hardware workaround: leaving our transcoder select
+ * set to transcoder B while it's off will prevent the
+ * corresponding HDMI output on transcoder A.
+@@ -3683,18 +3679,7 @@ intel_dp_link_down(struct intel_dp *intel_dp)
+ */
+ DP &= ~DP_PIPEB_SELECT;
+ I915_WRITE(intel_dp->output_reg, DP);
+-
+- /* Changes to enable or select take place the vblank
+- * after being written.
+- */
+- if (WARN_ON(crtc == NULL)) {
+- /* We should never try to disable a port without a crtc
+- * attached. For paranoia keep the code around for a
+- * bit. */
+- POSTING_READ(intel_dp->output_reg);
+- msleep(50);
+- } else
+- intel_wait_for_vblank(dev, intel_crtc->pipe);
++ POSTING_READ(intel_dp->output_reg);
+ }
+
+ DP &= ~DP_AUDIO_OUTPUT_ENABLE;
+diff --git a/drivers/gpu/drm/i915/intel_lrc.c b/drivers/gpu/drm/i915/intel_lrc.c
+index bafd38b5703e..a97b83b78ae7 100644
+--- a/drivers/gpu/drm/i915/intel_lrc.c
++++ b/drivers/gpu/drm/i915/intel_lrc.c
+@@ -1106,15 +1106,17 @@ static int gen8_emit_flush(struct intel_ringbuffer *ringbuf,
+
+ cmd = MI_FLUSH_DW + 1;
+
+- if (ring == &dev_priv->ring[VCS]) {
+- if (invalidate_domains & I915_GEM_GPU_DOMAINS)
+- cmd |= MI_INVALIDATE_TLB | MI_INVALIDATE_BSD |
+- MI_FLUSH_DW_STORE_INDEX |
+- MI_FLUSH_DW_OP_STOREDW;
+- } else {
+- if (invalidate_domains & I915_GEM_DOMAIN_RENDER)
+- cmd |= MI_INVALIDATE_TLB | MI_FLUSH_DW_STORE_INDEX |
+- MI_FLUSH_DW_OP_STOREDW;
++ /* We always require a command barrier so that subsequent
++ * commands, such as breadcrumb interrupts, are strictly ordered
++ * wrt the contents of the write cache being flushed to memory
++ * (and thus being coherent from the CPU).
++ */
++ cmd |= MI_FLUSH_DW_STORE_INDEX | MI_FLUSH_DW_OP_STOREDW;
++
++ if (invalidate_domains & I915_GEM_GPU_DOMAINS) {
++ cmd |= MI_INVALIDATE_TLB;
++ if (ring == &dev_priv->ring[VCS])
++ cmd |= MI_INVALIDATE_BSD;
+ }
+
+ intel_logical_ring_emit(ringbuf, cmd);
+diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.c b/drivers/gpu/drm/i915/intel_ringbuffer.c
+index ae17e77dc08d..9f10b771319f 100644
+--- a/drivers/gpu/drm/i915/intel_ringbuffer.c
++++ b/drivers/gpu/drm/i915/intel_ringbuffer.c
+@@ -2139,6 +2139,14 @@ static int gen6_bsd_ring_flush(struct intel_engine_cs *ring,
+ cmd = MI_FLUSH_DW;
+ if (INTEL_INFO(ring->dev)->gen >= 8)
+ cmd += 1;
++
++ /* We always require a command barrier so that subsequent
++ * commands, such as breadcrumb interrupts, are strictly ordered
++ * wrt the contents of the write cache being flushed to memory
++ * (and thus being coherent from the CPU).
++ */
++ cmd |= MI_FLUSH_DW_STORE_INDEX | MI_FLUSH_DW_OP_STOREDW;
++
+ /*
+ * Bspec vol 1c.5 - video engine command streamer:
+ * "If ENABLED, all TLBs will be invalidated once the flush
+@@ -2146,8 +2154,8 @@ static int gen6_bsd_ring_flush(struct intel_engine_cs *ring,
+ * Post-Sync Operation field is a value of 1h or 3h."
+ */
+ if (invalidate & I915_GEM_GPU_DOMAINS)
+- cmd |= MI_INVALIDATE_TLB | MI_INVALIDATE_BSD |
+- MI_FLUSH_DW_STORE_INDEX | MI_FLUSH_DW_OP_STOREDW;
++ cmd |= MI_INVALIDATE_TLB | MI_INVALIDATE_BSD;
++
+ intel_ring_emit(ring, cmd);
+ intel_ring_emit(ring, I915_GEM_HWS_SCRATCH_ADDR | MI_FLUSH_DW_USE_GTT);
+ if (INTEL_INFO(ring->dev)->gen >= 8) {
+@@ -2242,6 +2250,14 @@ static int gen6_ring_flush(struct intel_engine_cs *ring,
+ cmd = MI_FLUSH_DW;
+ if (INTEL_INFO(ring->dev)->gen >= 8)
+ cmd += 1;
++
++ /* We always require a command barrier so that subsequent
++ * commands, such as breadcrumb interrupts, are strictly ordered
++ * wrt the contents of the write cache being flushed to memory
++ * (and thus being coherent from the CPU).
++ */
++ cmd |= MI_FLUSH_DW_STORE_INDEX | MI_FLUSH_DW_OP_STOREDW;
++
+ /*
+ * Bspec vol 1c.3 - blitter engine command streamer:
+ * "If ENABLED, all TLBs will be invalidated once the flush
+@@ -2249,8 +2265,7 @@ static int gen6_ring_flush(struct intel_engine_cs *ring,
+ * Post-Sync Operation field is a value of 1h or 3h."
+ */
+ if (invalidate & I915_GEM_DOMAIN_RENDER)
+- cmd |= MI_INVALIDATE_TLB | MI_FLUSH_DW_STORE_INDEX |
+- MI_FLUSH_DW_OP_STOREDW;
++ cmd |= MI_INVALIDATE_TLB;
+ intel_ring_emit(ring, cmd);
+ intel_ring_emit(ring, I915_GEM_HWS_SCRATCH_ADDR | MI_FLUSH_DW_USE_GTT);
+ if (INTEL_INFO(ring->dev)->gen >= 8) {
+diff --git a/drivers/gpu/drm/i915/intel_sideband.c b/drivers/gpu/drm/i915/intel_sideband.c
+index 01d841ea3140..731b10a09aa0 100644
+--- a/drivers/gpu/drm/i915/intel_sideband.c
++++ b/drivers/gpu/drm/i915/intel_sideband.c
+@@ -82,7 +82,7 @@ u32 vlv_punit_read(struct drm_i915_private *dev_priv, u8 addr)
+ WARN_ON(!mutex_is_locked(&dev_priv->rps.hw_lock));
+
+ mutex_lock(&dev_priv->dpio_lock);
+- vlv_sideband_rw(dev_priv, PCI_DEVFN(2, 0), IOSF_PORT_PUNIT,
++ vlv_sideband_rw(dev_priv, PCI_DEVFN(0, 0), IOSF_PORT_PUNIT,
+ SB_CRRDDA_NP, addr, &val);
+ mutex_unlock(&dev_priv->dpio_lock);
+
+@@ -94,7 +94,7 @@ void vlv_punit_write(struct drm_i915_private *dev_priv, u8 addr, u32 val)
+ WARN_ON(!mutex_is_locked(&dev_priv->rps.hw_lock));
+
+ mutex_lock(&dev_priv->dpio_lock);
+- vlv_sideband_rw(dev_priv, PCI_DEVFN(2, 0), IOSF_PORT_PUNIT,
++ vlv_sideband_rw(dev_priv, PCI_DEVFN(0, 0), IOSF_PORT_PUNIT,
+ SB_CRWRDA_NP, addr, &val);
+ mutex_unlock(&dev_priv->dpio_lock);
+ }
+@@ -103,7 +103,7 @@ u32 vlv_bunit_read(struct drm_i915_private *dev_priv, u32 reg)
+ {
+ u32 val = 0;
+
+- vlv_sideband_rw(dev_priv, PCI_DEVFN(2, 0), IOSF_PORT_BUNIT,
++ vlv_sideband_rw(dev_priv, PCI_DEVFN(0, 0), IOSF_PORT_BUNIT,
+ SB_CRRDDA_NP, reg, &val);
+
+ return val;
+@@ -111,7 +111,7 @@ u32 vlv_bunit_read(struct drm_i915_private *dev_priv, u32 reg)
+
+ void vlv_bunit_write(struct drm_i915_private *dev_priv, u32 reg, u32 val)
+ {
+- vlv_sideband_rw(dev_priv, PCI_DEVFN(2, 0), IOSF_PORT_BUNIT,
++ vlv_sideband_rw(dev_priv, PCI_DEVFN(0, 0), IOSF_PORT_BUNIT,
+ SB_CRWRDA_NP, reg, &val);
+ }
+
+@@ -122,7 +122,7 @@ u32 vlv_nc_read(struct drm_i915_private *dev_priv, u8 addr)
+ WARN_ON(!mutex_is_locked(&dev_priv->rps.hw_lock));
+
+ mutex_lock(&dev_priv->dpio_lock);
+- vlv_sideband_rw(dev_priv, PCI_DEVFN(2, 0), IOSF_PORT_NC,
++ vlv_sideband_rw(dev_priv, PCI_DEVFN(0, 0), IOSF_PORT_NC,
+ SB_CRRDDA_NP, addr, &val);
+ mutex_unlock(&dev_priv->dpio_lock);
+
+@@ -132,56 +132,56 @@ u32 vlv_nc_read(struct drm_i915_private *dev_priv, u8 addr)
+ u32 vlv_gpio_nc_read(struct drm_i915_private *dev_priv, u32 reg)
+ {
+ u32 val = 0;
+- vlv_sideband_rw(dev_priv, PCI_DEVFN(2, 0), IOSF_PORT_GPIO_NC,
++ vlv_sideband_rw(dev_priv, PCI_DEVFN(0, 0), IOSF_PORT_GPIO_NC,
+ SB_CRRDDA_NP, reg, &val);
+ return val;
+ }
+
+ void vlv_gpio_nc_write(struct drm_i915_private *dev_priv, u32 reg, u32 val)
+ {
+- vlv_sideband_rw(dev_priv, PCI_DEVFN(2, 0), IOSF_PORT_GPIO_NC,
++ vlv_sideband_rw(dev_priv, PCI_DEVFN(0, 0), IOSF_PORT_GPIO_NC,
+ SB_CRWRDA_NP, reg, &val);
+ }
+
+ u32 vlv_cck_read(struct drm_i915_private *dev_priv, u32 reg)
+ {
+ u32 val = 0;
+- vlv_sideband_rw(dev_priv, PCI_DEVFN(2, 0), IOSF_PORT_CCK,
++ vlv_sideband_rw(dev_priv, PCI_DEVFN(0, 0), IOSF_PORT_CCK,
+ SB_CRRDDA_NP, reg, &val);
+ return val;
+ }
+
+ void vlv_cck_write(struct drm_i915_private *dev_priv, u32 reg, u32 val)
+ {
+- vlv_sideband_rw(dev_priv, PCI_DEVFN(2, 0), IOSF_PORT_CCK,
++ vlv_sideband_rw(dev_priv, PCI_DEVFN(0, 0), IOSF_PORT_CCK,
+ SB_CRWRDA_NP, reg, &val);
+ }
+
+ u32 vlv_ccu_read(struct drm_i915_private *dev_priv, u32 reg)
+ {
+ u32 val = 0;
+- vlv_sideband_rw(dev_priv, PCI_DEVFN(2, 0), IOSF_PORT_CCU,
++ vlv_sideband_rw(dev_priv, PCI_DEVFN(0, 0), IOSF_PORT_CCU,
+ SB_CRRDDA_NP, reg, &val);
+ return val;
+ }
+
+ void vlv_ccu_write(struct drm_i915_private *dev_priv, u32 reg, u32 val)
+ {
+- vlv_sideband_rw(dev_priv, PCI_DEVFN(2, 0), IOSF_PORT_CCU,
++ vlv_sideband_rw(dev_priv, PCI_DEVFN(0, 0), IOSF_PORT_CCU,
+ SB_CRWRDA_NP, reg, &val);
+ }
+
+ u32 vlv_gps_core_read(struct drm_i915_private *dev_priv, u32 reg)
+ {
+ u32 val = 0;
+- vlv_sideband_rw(dev_priv, PCI_DEVFN(2, 0), IOSF_PORT_GPS_CORE,
++ vlv_sideband_rw(dev_priv, PCI_DEVFN(0, 0), IOSF_PORT_GPS_CORE,
+ SB_CRRDDA_NP, reg, &val);
+ return val;
+ }
+
+ void vlv_gps_core_write(struct drm_i915_private *dev_priv, u32 reg, u32 val)
+ {
+- vlv_sideband_rw(dev_priv, PCI_DEVFN(2, 0), IOSF_PORT_GPS_CORE,
++ vlv_sideband_rw(dev_priv, PCI_DEVFN(0, 0), IOSF_PORT_GPS_CORE,
+ SB_CRWRDA_NP, reg, &val);
+ }
+
+diff --git a/drivers/gpu/drm/radeon/atombios_dp.c b/drivers/gpu/drm/radeon/atombios_dp.c
+index db42a670f995..5bf825dfaa09 100644
+--- a/drivers/gpu/drm/radeon/atombios_dp.c
++++ b/drivers/gpu/drm/radeon/atombios_dp.c
+@@ -623,10 +623,8 @@ static int radeon_dp_link_train_init(struct radeon_dp_link_train_info *dp_info)
+ drm_dp_dpcd_writeb(dp_info->aux,
+ DP_DOWNSPREAD_CTRL, 0);
+
+- if ((dp_info->connector->connector_type == DRM_MODE_CONNECTOR_eDP) &&
+- (dig->panel_mode == DP_PANEL_MODE_INTERNAL_DP2_MODE)) {
++ if (dig->panel_mode == DP_PANEL_MODE_INTERNAL_DP2_MODE)
+ drm_dp_dpcd_writeb(dp_info->aux, DP_EDP_CONFIGURATION_SET, 1);
+- }
+
+ /* set the lane count on the sink */
+ tmp = dp_info->dp_lane_count;
+diff --git a/drivers/gpu/drm/radeon/cik.c b/drivers/gpu/drm/radeon/cik.c
+index 9328fb3dcfce..5f395be9b3e3 100644
+--- a/drivers/gpu/drm/radeon/cik.c
++++ b/drivers/gpu/drm/radeon/cik.c
+@@ -3880,7 +3880,21 @@ void cik_fence_gfx_ring_emit(struct radeon_device *rdev,
+ struct radeon_ring *ring = &rdev->ring[fence->ring];
+ u64 addr = rdev->fence_drv[fence->ring].gpu_addr;
+
+- /* EVENT_WRITE_EOP - flush caches, send int */
++ /* Workaround for cache flush problems. First send a dummy EOP
++ * event down the pipe with seq one below.
++ */
++ radeon_ring_write(ring, PACKET3(PACKET3_EVENT_WRITE_EOP, 4));
++ radeon_ring_write(ring, (EOP_TCL1_ACTION_EN |
++ EOP_TC_ACTION_EN |
++ EVENT_TYPE(CACHE_FLUSH_AND_INV_TS_EVENT) |
++ EVENT_INDEX(5)));
++ radeon_ring_write(ring, addr & 0xfffffffc);
++ radeon_ring_write(ring, (upper_32_bits(addr) & 0xffff) |
++ DATA_SEL(1) | INT_SEL(0));
++ radeon_ring_write(ring, fence->seq - 1);
++ radeon_ring_write(ring, 0);
++
++ /* Then send the real EOP event down the pipe. */
+ radeon_ring_write(ring, PACKET3(PACKET3_EVENT_WRITE_EOP, 4));
+ radeon_ring_write(ring, (EOP_TCL1_ACTION_EN |
+ EOP_TC_ACTION_EN |
+@@ -7295,7 +7309,6 @@ int cik_irq_set(struct radeon_device *rdev)
+ u32 hpd1, hpd2, hpd3, hpd4, hpd5, hpd6;
+ u32 grbm_int_cntl = 0;
+ u32 dma_cntl, dma_cntl1;
+- u32 thermal_int;
+
+ if (!rdev->irq.installed) {
+ WARN(1, "Can't enable IRQ/MSI because no handler is installed\n");
+@@ -7332,13 +7345,6 @@ int cik_irq_set(struct radeon_device *rdev)
+ cp_m2p2 = RREG32(CP_ME2_PIPE2_INT_CNTL) & ~TIME_STAMP_INT_ENABLE;
+ cp_m2p3 = RREG32(CP_ME2_PIPE3_INT_CNTL) & ~TIME_STAMP_INT_ENABLE;
+
+- if (rdev->flags & RADEON_IS_IGP)
+- thermal_int = RREG32_SMC(CG_THERMAL_INT_CTRL) &
+- ~(THERM_INTH_MASK | THERM_INTL_MASK);
+- else
+- thermal_int = RREG32_SMC(CG_THERMAL_INT) &
+- ~(THERM_INT_MASK_HIGH | THERM_INT_MASK_LOW);
+-
+ /* enable CP interrupts on all rings */
+ if (atomic_read(&rdev->irq.ring_int[RADEON_RING_TYPE_GFX_INDEX])) {
+ DRM_DEBUG("cik_irq_set: sw int gfx\n");
+@@ -7496,14 +7502,6 @@ int cik_irq_set(struct radeon_device *rdev)
+ hpd6 |= DC_HPDx_INT_EN;
+ }
+
+- if (rdev->irq.dpm_thermal) {
+- DRM_DEBUG("dpm thermal\n");
+- if (rdev->flags & RADEON_IS_IGP)
+- thermal_int |= THERM_INTH_MASK | THERM_INTL_MASK;
+- else
+- thermal_int |= THERM_INT_MASK_HIGH | THERM_INT_MASK_LOW;
+- }
+-
+ WREG32(CP_INT_CNTL_RING0, cp_int_cntl);
+
+ WREG32(SDMA0_CNTL + SDMA0_REGISTER_OFFSET, dma_cntl);
+@@ -7557,11 +7555,6 @@ int cik_irq_set(struct radeon_device *rdev)
+ WREG32(DC_HPD5_INT_CONTROL, hpd5);
+ WREG32(DC_HPD6_INT_CONTROL, hpd6);
+
+- if (rdev->flags & RADEON_IS_IGP)
+- WREG32_SMC(CG_THERMAL_INT_CTRL, thermal_int);
+- else
+- WREG32_SMC(CG_THERMAL_INT, thermal_int);
+-
+ return 0;
+ }
+
+diff --git a/drivers/gpu/drm/radeon/kv_dpm.c b/drivers/gpu/drm/radeon/kv_dpm.c
+index e3e9c10cfba9..85a109e1e56b 100644
+--- a/drivers/gpu/drm/radeon/kv_dpm.c
++++ b/drivers/gpu/drm/radeon/kv_dpm.c
+@@ -1169,6 +1169,19 @@ void kv_dpm_enable_bapm(struct radeon_device *rdev, bool enable)
+ }
+ }
+
++static void kv_enable_thermal_int(struct radeon_device *rdev, bool enable)
++{
++ u32 thermal_int;
++
++ thermal_int = RREG32_SMC(CG_THERMAL_INT_CTRL);
++ if (enable)
++ thermal_int |= THERM_INTH_MASK | THERM_INTL_MASK;
++ else
++ thermal_int &= ~(THERM_INTH_MASK | THERM_INTL_MASK);
++ WREG32_SMC(CG_THERMAL_INT_CTRL, thermal_int);
++
++}
++
+ int kv_dpm_enable(struct radeon_device *rdev)
+ {
+ struct kv_power_info *pi = kv_get_pi(rdev);
+@@ -1280,8 +1293,7 @@ int kv_dpm_late_enable(struct radeon_device *rdev)
+ DRM_ERROR("kv_set_thermal_temperature_range failed\n");
+ return ret;
+ }
+- rdev->irq.dpm_thermal = true;
+- radeon_irq_set(rdev);
++ kv_enable_thermal_int(rdev, true);
+ }
+
+ /* powerdown unused blocks for now */
+@@ -1312,6 +1324,7 @@ void kv_dpm_disable(struct radeon_device *rdev)
+ kv_stop_dpm(rdev);
+ kv_enable_ulv(rdev, false);
+ kv_reset_am(rdev);
++ kv_enable_thermal_int(rdev, false);
+
+ kv_update_current_ps(rdev, rdev->pm.dpm.boot_ps);
+ }
+diff --git a/drivers/gpu/drm/radeon/ni.c b/drivers/gpu/drm/radeon/ni.c
+index 3faee58946dd..8a83c917cf53 100644
+--- a/drivers/gpu/drm/radeon/ni.c
++++ b/drivers/gpu/drm/radeon/ni.c
+@@ -1085,12 +1085,12 @@ static void cayman_gpu_init(struct radeon_device *rdev)
+
+ if ((rdev->config.cayman.max_backends_per_se == 1) &&
+ (rdev->flags & RADEON_IS_IGP)) {
+- if ((disabled_rb_mask & 3) == 1) {
+- /* RB0 disabled, RB1 enabled */
+- tmp = 0x11111111;
+- } else {
++ if ((disabled_rb_mask & 3) == 2) {
+ /* RB1 disabled, RB0 enabled */
+ tmp = 0x00000000;
++ } else {
++ /* RB0 disabled, RB1 enabled */
++ tmp = 0x11111111;
+ }
+ } else {
+ tmp = gb_addr_config & NUM_PIPES_MASK;
+diff --git a/drivers/gpu/drm/radeon/r600_dpm.c b/drivers/gpu/drm/radeon/r600_dpm.c
+index b5c73df8e202..65a0c1c03c69 100644
+--- a/drivers/gpu/drm/radeon/r600_dpm.c
++++ b/drivers/gpu/drm/radeon/r600_dpm.c
+@@ -188,7 +188,7 @@ u32 r600_dpm_get_vrefresh(struct radeon_device *rdev)
+ list_for_each_entry(crtc, &dev->mode_config.crtc_list, head) {
+ radeon_crtc = to_radeon_crtc(crtc);
+ if (crtc->enabled && radeon_crtc->enabled && radeon_crtc->hw_mode.clock) {
+- vrefresh = radeon_crtc->hw_mode.vrefresh;
++ vrefresh = drm_mode_vrefresh(&radeon_crtc->hw_mode);
+ break;
+ }
+ }
+diff --git a/drivers/gpu/drm/radeon/radeon_atombios.c b/drivers/gpu/drm/radeon/radeon_atombios.c
+index df69b92ba164..d79e892093b5 100644
+--- a/drivers/gpu/drm/radeon/radeon_atombios.c
++++ b/drivers/gpu/drm/radeon/radeon_atombios.c
+@@ -3280,6 +3280,7 @@ int radeon_atom_get_voltage_evv(struct radeon_device *rdev,
+
+ args.in.ucVoltageType = VOLTAGE_TYPE_VDDC;
+ args.in.ucVoltageMode = ATOM_GET_VOLTAGE_EVV_VOLTAGE;
++ args.in.usVoltageLevel = cpu_to_le16(virtual_voltage_id);
+ args.in.ulSCLKFreq =
+ cpu_to_le32(rdev->pm.dpm.dyn_state.vddc_dependency_on_sclk.entries[entry_id].clk);
+
+diff --git a/drivers/gpu/drm/radeon/radeon_encoders.c b/drivers/gpu/drm/radeon/radeon_encoders.c
+index 6b670b0bc47b..3a297037cc17 100644
+--- a/drivers/gpu/drm/radeon/radeon_encoders.c
++++ b/drivers/gpu/drm/radeon/radeon_encoders.c
+@@ -179,9 +179,12 @@ static void radeon_encoder_add_backlight(struct radeon_encoder *radeon_encoder,
+ (rdev->pdev->subsystem_vendor == 0x1734) &&
+ (rdev->pdev->subsystem_device == 0x1107))
+ use_bl = false;
++/* Older PPC macs use on-GPU backlight controller */
++#ifndef CONFIG_PPC_PMAC
+ /* disable native backlight control on older asics */
+ else if (rdev->family < CHIP_R600)
+ use_bl = false;
++#endif
+ else
+ use_bl = true;
+ }
+diff --git a/drivers/gpu/drm/radeon/radeon_object.c b/drivers/gpu/drm/radeon/radeon_object.c
+index 4c0d786d5c7a..194f6245c379 100644
+--- a/drivers/gpu/drm/radeon/radeon_object.c
++++ b/drivers/gpu/drm/radeon/radeon_object.c
+@@ -218,6 +218,18 @@ int radeon_bo_create(struct radeon_device *rdev,
+ * See https://bugs.freedesktop.org/show_bug.cgi?id=84627
+ */
+ bo->flags &= ~RADEON_GEM_GTT_WC;
++#elif defined(CONFIG_X86) && !defined(CONFIG_X86_PAT)
++ /* Don't try to enable write-combining when it can't work, or things
++ * may be slow
++ * See https://bugs.freedesktop.org/show_bug.cgi?id=88758
++ */
++
++#warning Please enable CONFIG_MTRR and CONFIG_X86_PAT for better performance \
++ thanks to write-combining
++
++ DRM_INFO_ONCE("Please enable CONFIG_MTRR and CONFIG_X86_PAT for "
++ "better performance thanks to write-combining\n");
++ bo->flags &= ~RADEON_GEM_GTT_WC;
+ #endif
+
+ radeon_ttm_placement_from_domain(bo, domain);
+diff --git a/drivers/gpu/drm/tegra/drm.c b/drivers/gpu/drm/tegra/drm.c
+index 59736bb810cd..1218419c12f6 100644
+--- a/drivers/gpu/drm/tegra/drm.c
++++ b/drivers/gpu/drm/tegra/drm.c
+@@ -152,7 +152,7 @@ static int host1x_reloc_copy_from_user(struct host1x_reloc *dest,
+ if (err < 0)
+ return err;
+
+- err = get_user(dest->target.offset, &src->cmdbuf.offset);
++ err = get_user(dest->target.offset, &src->target.offset);
+ if (err < 0)
+ return err;
+
+diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
+index 8df8ceb47659..01c7a08a66e1 100644
+--- a/drivers/hid/hid-input.c
++++ b/drivers/hid/hid-input.c
+@@ -1104,6 +1104,23 @@ void hidinput_hid_event(struct hid_device *hid, struct hid_field *field, struct
+ return;
+ }
+
++ /*
++ * Ignore reports for absolute data if the data didn't change. This is
++ * not only an optimization but also fixes 'dead' key reports. Some
++ * RollOver implementations for localized keys (like BACKSLASH/PIPE; HID
++ * 0x31 and 0x32) report multiple keys, even though a localized keyboard
++ * can only have one of them physically available. The 'dead' keys
++ * report constant 0. As all map to the same keycode, they'd confuse
++ * the input layer. If we filter the 'dead' keys on the HID level, we
++ * skip the keycode translation and only forward real events.
++ */
++ if (!(field->flags & (HID_MAIN_ITEM_RELATIVE |
++ HID_MAIN_ITEM_BUFFERED_BYTE)) &&
++ (field->flags & HID_MAIN_ITEM_VARIABLE) &&
++ usage->usage_index < field->maxusage &&
++ value == field->value[usage->usage_index])
++ return;
++
+ /* report the usage code as scancode if the key status has changed */
+ if (usage->type == EV_KEY && !!test_bit(usage->code, input->key) != value)
+ input_event(input, EV_MSC, MSC_SCAN, usage->hid);
+diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c
+index 7cf998cdd011..c673eda71460 100644
+--- a/drivers/hid/wacom_wac.c
++++ b/drivers/hid/wacom_wac.c
+@@ -756,6 +756,12 @@ static int wacom_intuos_irq(struct wacom_wac *wacom)
+ input_report_key(input, BTN_7, (data[4] & 0x40)); /* Left */
+ input_report_key(input, BTN_8, (data[4] & 0x80)); /* Down */
+ input_report_key(input, BTN_0, (data[3] & 0x01)); /* Center */
++
++ if (data[4] | (data[3] & 0x01)) {
++ input_report_abs(input, ABS_MISC, PAD_DEVICE_ID);
++ } else {
++ input_report_abs(input, ABS_MISC, 0);
++ }
+ } else if (features->type >= INTUOS5S && features->type <= INTUOSPL) {
+ int i;
+
+diff --git a/drivers/iio/adc/mcp3422.c b/drivers/iio/adc/mcp3422.c
+index 51672256072b..b96c636470ef 100644
+--- a/drivers/iio/adc/mcp3422.c
++++ b/drivers/iio/adc/mcp3422.c
+@@ -58,20 +58,11 @@
+ .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SAMP_FREQ), \
+ }
+
+-/* LSB is in nV to eliminate floating point */
+-static const u32 rates_to_lsb[] = {1000000, 250000, 62500, 15625};
+-
+-/*
+- * scales calculated as:
+- * rates_to_lsb[sample_rate] / (1 << pga);
+- * pga is 1 for 0, 2
+- */
+-
+ static const int mcp3422_scales[4][4] = {
+- { 1000000, 250000, 62500, 15625 },
+- { 500000 , 125000, 31250, 7812 },
+- { 250000 , 62500 , 15625, 3906 },
+- { 125000 , 31250 , 7812 , 1953 } };
++ { 1000000, 500000, 250000, 125000 },
++ { 250000 , 125000, 62500 , 31250 },
++ { 62500 , 31250 , 15625 , 7812 },
++ { 15625 , 7812 , 3906 , 1953 } };
+
+ /* Constant msleep times for data acquisitions */
+ static const int mcp3422_read_times[4] = {
+diff --git a/drivers/iio/dac/ad5686.c b/drivers/iio/dac/ad5686.c
+index f57562aa396f..15c73e20272d 100644
+--- a/drivers/iio/dac/ad5686.c
++++ b/drivers/iio/dac/ad5686.c
+@@ -322,7 +322,7 @@ static int ad5686_probe(struct spi_device *spi)
+ st = iio_priv(indio_dev);
+ spi_set_drvdata(spi, indio_dev);
+
+- st->reg = devm_regulator_get(&spi->dev, "vcc");
++ st->reg = devm_regulator_get_optional(&spi->dev, "vcc");
+ if (!IS_ERR(st->reg)) {
+ ret = regulator_enable(st->reg);
+ if (ret)
+diff --git a/drivers/iio/imu/adis16400_core.c b/drivers/iio/imu/adis16400_core.c
+index b70873de04ea..fa795dcd5f75 100644
+--- a/drivers/iio/imu/adis16400_core.c
++++ b/drivers/iio/imu/adis16400_core.c
+@@ -26,6 +26,7 @@
+ #include <linux/list.h>
+ #include <linux/module.h>
+ #include <linux/debugfs.h>
++#include <linux/bitops.h>
+
+ #include <linux/iio/iio.h>
+ #include <linux/iio/sysfs.h>
+@@ -414,7 +415,7 @@ static int adis16400_read_raw(struct iio_dev *indio_dev,
+ mutex_unlock(&indio_dev->mlock);
+ if (ret)
+ return ret;
+- val16 = ((val16 & 0xFFF) << 4) >> 4;
++ val16 = sign_extend32(val16, 11);
+ *val = val16;
+ return IIO_VAL_INT;
+ case IIO_CHAN_INFO_OFFSET:
+diff --git a/drivers/infiniband/core/ucma.c b/drivers/infiniband/core/ucma.c
+index 56a4b7ca7ee3..45d67e9228d7 100644
+--- a/drivers/infiniband/core/ucma.c
++++ b/drivers/infiniband/core/ucma.c
+@@ -1124,6 +1124,9 @@ static int ucma_set_ib_path(struct ucma_context *ctx,
+ if (!optlen)
+ return -EINVAL;
+
++ memset(&sa_path, 0, sizeof(sa_path));
++ sa_path.vlan_id = 0xffff;
++
+ ib_sa_unpack_path(path_data->path_rec, &sa_path);
+ ret = rdma_set_ib_paths(ctx->cm_id, &sa_path, 1);
+ if (ret)
+diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c
+index 5ba2a86aab6a..63a9f04bdb6c 100644
+--- a/drivers/infiniband/core/uverbs_cmd.c
++++ b/drivers/infiniband/core/uverbs_cmd.c
+@@ -2057,20 +2057,21 @@ ssize_t ib_uverbs_modify_qp(struct ib_uverbs_file *file,
+ if (qp->real_qp == qp) {
+ ret = ib_resolve_eth_l2_attrs(qp, attr, &cmd.attr_mask);
+ if (ret)
+- goto out;
++ goto release_qp;
+ ret = qp->device->modify_qp(qp, attr,
+ modify_qp_mask(qp->qp_type, cmd.attr_mask), &udata);
+ } else {
+ ret = ib_modify_qp(qp, attr, modify_qp_mask(qp->qp_type, cmd.attr_mask));
+ }
+
+- put_qp_read(qp);
+-
+ if (ret)
+- goto out;
++ goto release_qp;
+
+ ret = in_len;
+
++release_qp:
++ put_qp_read(qp);
++
+ out:
+ kfree(attr);
+
+diff --git a/drivers/infiniband/hw/mlx4/main.c b/drivers/infiniband/hw/mlx4/main.c
+index 8b72cf392b34..3b619b10a372 100644
+--- a/drivers/infiniband/hw/mlx4/main.c
++++ b/drivers/infiniband/hw/mlx4/main.c
+@@ -1221,8 +1221,7 @@ static int mlx4_ib_mcg_attach(struct ib_qp *ibqp, union ib_gid *gid, u16 lid)
+ struct mlx4_ib_qp *mqp = to_mqp(ibqp);
+ u64 reg_id;
+ struct mlx4_ib_steering *ib_steering = NULL;
+- enum mlx4_protocol prot = (gid->raw[1] == 0x0e) ?
+- MLX4_PROT_IB_IPV4 : MLX4_PROT_IB_IPV6;
++ enum mlx4_protocol prot = MLX4_PROT_IB_IPV6;
+
+ if (mdev->dev->caps.steering_mode ==
+ MLX4_STEERING_MODE_DEVICE_MANAGED) {
+@@ -1235,8 +1234,10 @@ static int mlx4_ib_mcg_attach(struct ib_qp *ibqp, union ib_gid *gid, u16 lid)
+ !!(mqp->flags &
+ MLX4_IB_QP_BLOCK_MULTICAST_LOOPBACK),
+ prot, ®_id);
+- if (err)
++ if (err) {
++ pr_err("multicast attach op failed, err %d\n", err);
+ goto err_malloc;
++ }
+
+ err = add_gid_entry(ibqp, gid);
+ if (err)
+@@ -1284,8 +1285,7 @@ static int mlx4_ib_mcg_detach(struct ib_qp *ibqp, union ib_gid *gid, u16 lid)
+ struct net_device *ndev;
+ struct mlx4_ib_gid_entry *ge;
+ u64 reg_id = 0;
+- enum mlx4_protocol prot = (gid->raw[1] == 0x0e) ?
+- MLX4_PROT_IB_IPV4 : MLX4_PROT_IB_IPV6;
++ enum mlx4_protocol prot = MLX4_PROT_IB_IPV6;
+
+ if (mdev->dev->caps.steering_mode ==
+ MLX4_STEERING_MODE_DEVICE_MANAGED) {
+diff --git a/drivers/infiniband/hw/mlx4/qp.c b/drivers/infiniband/hw/mlx4/qp.c
+index 9c5150c3cb31..03045dd9e5de 100644
+--- a/drivers/infiniband/hw/mlx4/qp.c
++++ b/drivers/infiniband/hw/mlx4/qp.c
+@@ -1669,8 +1669,10 @@ static int __mlx4_ib_modify_qp(struct ib_qp *ibqp,
+ qp->mlx4_ib_qp_type == MLX4_IB_QPT_PROXY_GSI ||
+ qp->mlx4_ib_qp_type == MLX4_IB_QPT_TUN_GSI) {
+ err = handle_eth_ud_smac_index(dev, qp, (u8 *)attr->smac, context);
+- if (err)
+- return -EINVAL;
++ if (err) {
++ err = -EINVAL;
++ goto out;
++ }
+ if (qp->mlx4_ib_qp_type == MLX4_IB_QPT_PROXY_GSI)
+ dev->qp1_proxy[qp->port - 1] = qp;
+ }
+diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
+index 1ba6c42e4df8..820fb8009ed7 100644
+--- a/drivers/infiniband/hw/mlx5/main.c
++++ b/drivers/infiniband/hw/mlx5/main.c
+@@ -987,7 +987,7 @@ static int get_port_caps(struct mlx5_ib_dev *dev)
+ struct ib_device_attr *dprops = NULL;
+ struct ib_port_attr *pprops = NULL;
+ struct mlx5_general_caps *gen;
+- int err = 0;
++ int err = -ENOMEM;
+ int port;
+
+ gen = &dev->mdev->caps.gen;
+diff --git a/drivers/infiniband/hw/qib/qib.h b/drivers/infiniband/hw/qib/qib.h
+index c00ae093b6f8..b218254ee41b 100644
+--- a/drivers/infiniband/hw/qib/qib.h
++++ b/drivers/infiniband/hw/qib/qib.h
+@@ -1082,12 +1082,6 @@ struct qib_devdata {
+ /* control high-level access to EEPROM */
+ struct mutex eep_lock;
+ uint64_t traffic_wds;
+- /* active time is kept in seconds, but logged in hours */
+- atomic_t active_time;
+- /* Below are nominal shadow of EEPROM, new since last EEPROM update */
+- uint8_t eep_st_errs[QIB_EEP_LOG_CNT];
+- uint8_t eep_st_new_errs[QIB_EEP_LOG_CNT];
+- uint16_t eep_hrs;
+ /*
+ * masks for which bits of errs, hwerrs that cause
+ * each of the counters to increment.
+@@ -1309,8 +1303,7 @@ int qib_twsi_blk_rd(struct qib_devdata *dd, int dev, int addr, void *buffer,
+ int qib_twsi_blk_wr(struct qib_devdata *dd, int dev, int addr,
+ const void *buffer, int len);
+ void qib_get_eeprom_info(struct qib_devdata *);
+-int qib_update_eeprom_log(struct qib_devdata *dd);
+-void qib_inc_eeprom_err(struct qib_devdata *dd, u32 eidx, u32 incr);
++#define qib_inc_eeprom_err(dd, eidx, incr)
+ void qib_dump_lookup_output_queue(struct qib_devdata *);
+ void qib_force_pio_avail_update(struct qib_devdata *);
+ void qib_clear_symerror_on_linkup(unsigned long opaque);
+diff --git a/drivers/infiniband/hw/qib/qib_eeprom.c b/drivers/infiniband/hw/qib/qib_eeprom.c
+index 4d5d71aaa2b4..e2280b07df02 100644
+--- a/drivers/infiniband/hw/qib/qib_eeprom.c
++++ b/drivers/infiniband/hw/qib/qib_eeprom.c
+@@ -267,190 +267,9 @@ void qib_get_eeprom_info(struct qib_devdata *dd)
+ "Board SN %s did not pass functional test: %s\n",
+ dd->serial, ifp->if_comment);
+
+- memcpy(&dd->eep_st_errs, &ifp->if_errcntp, QIB_EEP_LOG_CNT);
+- /*
+- * Power-on (actually "active") hours are kept as little-endian value
+- * in EEPROM, but as seconds in a (possibly as small as 24-bit)
+- * atomic_t while running.
+- */
+- atomic_set(&dd->active_time, 0);
+- dd->eep_hrs = ifp->if_powerhour[0] | (ifp->if_powerhour[1] << 8);
+-
+ done:
+ vfree(buf);
+
+ bail:;
+ }
+
+-/**
+- * qib_update_eeprom_log - copy active-time and error counters to eeprom
+- * @dd: the qlogic_ib device
+- *
+- * Although the time is kept as seconds in the qib_devdata struct, it is
+- * rounded to hours for re-write, as we have only 16 bits in EEPROM.
+- * First-cut code reads whole (expected) struct qib_flash, modifies,
+- * re-writes. Future direction: read/write only what we need, assuming
+- * that the EEPROM had to have been "good enough" for driver init, and
+- * if not, we aren't making it worse.
+- *
+- */
+-int qib_update_eeprom_log(struct qib_devdata *dd)
+-{
+- void *buf;
+- struct qib_flash *ifp;
+- int len, hi_water;
+- uint32_t new_time, new_hrs;
+- u8 csum;
+- int ret, idx;
+- unsigned long flags;
+-
+- /* first, check if we actually need to do anything. */
+- ret = 0;
+- for (idx = 0; idx < QIB_EEP_LOG_CNT; ++idx) {
+- if (dd->eep_st_new_errs[idx]) {
+- ret = 1;
+- break;
+- }
+- }
+- new_time = atomic_read(&dd->active_time);
+-
+- if (ret == 0 && new_time < 3600)
+- goto bail;
+-
+- /*
+- * The quick-check above determined that there is something worthy
+- * of logging, so get current contents and do a more detailed idea.
+- * read full flash, not just currently used part, since it may have
+- * been written with a newer definition
+- */
+- len = sizeof(struct qib_flash);
+- buf = vmalloc(len);
+- ret = 1;
+- if (!buf) {
+- qib_dev_err(dd,
+- "Couldn't allocate memory to read %u bytes from eeprom for logging\n",
+- len);
+- goto bail;
+- }
+-
+- /* Grab semaphore and read current EEPROM. If we get an
+- * error, let go, but if not, keep it until we finish write.
+- */
+- ret = mutex_lock_interruptible(&dd->eep_lock);
+- if (ret) {
+- qib_dev_err(dd, "Unable to acquire EEPROM for logging\n");
+- goto free_bail;
+- }
+- ret = qib_twsi_blk_rd(dd, dd->twsi_eeprom_dev, 0, buf, len);
+- if (ret) {
+- mutex_unlock(&dd->eep_lock);
+- qib_dev_err(dd, "Unable read EEPROM for logging\n");
+- goto free_bail;
+- }
+- ifp = (struct qib_flash *)buf;
+-
+- csum = flash_csum(ifp, 0);
+- if (csum != ifp->if_csum) {
+- mutex_unlock(&dd->eep_lock);
+- qib_dev_err(dd, "EEPROM cks err (0x%02X, S/B 0x%02X)\n",
+- csum, ifp->if_csum);
+- ret = 1;
+- goto free_bail;
+- }
+- hi_water = 0;
+- spin_lock_irqsave(&dd->eep_st_lock, flags);
+- for (idx = 0; idx < QIB_EEP_LOG_CNT; ++idx) {
+- int new_val = dd->eep_st_new_errs[idx];
+- if (new_val) {
+- /*
+- * If we have seen any errors, add to EEPROM values
+- * We need to saturate at 0xFF (255) and we also
+- * would need to adjust the checksum if we were
+- * trying to minimize EEPROM traffic
+- * Note that we add to actual current count in EEPROM,
+- * in case it was altered while we were running.
+- */
+- new_val += ifp->if_errcntp[idx];
+- if (new_val > 0xFF)
+- new_val = 0xFF;
+- if (ifp->if_errcntp[idx] != new_val) {
+- ifp->if_errcntp[idx] = new_val;
+- hi_water = offsetof(struct qib_flash,
+- if_errcntp) + idx;
+- }
+- /*
+- * update our shadow (used to minimize EEPROM
+- * traffic), to match what we are about to write.
+- */
+- dd->eep_st_errs[idx] = new_val;
+- dd->eep_st_new_errs[idx] = 0;
+- }
+- }
+- /*
+- * Now update active-time. We would like to round to the nearest hour
+- * but unless atomic_t are sure to be proper signed ints we cannot,
+- * because we need to account for what we "transfer" to EEPROM and
+- * if we log an hour at 31 minutes, then we would need to set
+- * active_time to -29 to accurately count the _next_ hour.
+- */
+- if (new_time >= 3600) {
+- new_hrs = new_time / 3600;
+- atomic_sub((new_hrs * 3600), &dd->active_time);
+- new_hrs += dd->eep_hrs;
+- if (new_hrs > 0xFFFF)
+- new_hrs = 0xFFFF;
+- dd->eep_hrs = new_hrs;
+- if ((new_hrs & 0xFF) != ifp->if_powerhour[0]) {
+- ifp->if_powerhour[0] = new_hrs & 0xFF;
+- hi_water = offsetof(struct qib_flash, if_powerhour);
+- }
+- if ((new_hrs >> 8) != ifp->if_powerhour[1]) {
+- ifp->if_powerhour[1] = new_hrs >> 8;
+- hi_water = offsetof(struct qib_flash, if_powerhour) + 1;
+- }
+- }
+- /*
+- * There is a tiny possibility that we could somehow fail to write
+- * the EEPROM after updating our shadows, but problems from holding
+- * the spinlock too long are a much bigger issue.
+- */
+- spin_unlock_irqrestore(&dd->eep_st_lock, flags);
+- if (hi_water) {
+- /* we made some change to the data, uopdate cksum and write */
+- csum = flash_csum(ifp, 1);
+- ret = eeprom_write_with_enable(dd, 0, buf, hi_water + 1);
+- }
+- mutex_unlock(&dd->eep_lock);
+- if (ret)
+- qib_dev_err(dd, "Failed updating EEPROM\n");
+-
+-free_bail:
+- vfree(buf);
+-bail:
+- return ret;
+-}
+-
+-/**
+- * qib_inc_eeprom_err - increment one of the four error counters
+- * that are logged to EEPROM.
+- * @dd: the qlogic_ib device
+- * @eidx: 0..3, the counter to increment
+- * @incr: how much to add
+- *
+- * Each counter is 8-bits, and saturates at 255 (0xFF). They
+- * are copied to the EEPROM (aka flash) whenever qib_update_eeprom_log()
+- * is called, but it can only be called in a context that allows sleep.
+- * This function can be called even at interrupt level.
+- */
+-void qib_inc_eeprom_err(struct qib_devdata *dd, u32 eidx, u32 incr)
+-{
+- uint new_val;
+- unsigned long flags;
+-
+- spin_lock_irqsave(&dd->eep_st_lock, flags);
+- new_val = dd->eep_st_new_errs[eidx] + incr;
+- if (new_val > 255)
+- new_val = 255;
+- dd->eep_st_new_errs[eidx] = new_val;
+- spin_unlock_irqrestore(&dd->eep_st_lock, flags);
+-}
+diff --git a/drivers/infiniband/hw/qib/qib_iba6120.c b/drivers/infiniband/hw/qib/qib_iba6120.c
+index d68266ac7619..f7f49a6c34b0 100644
+--- a/drivers/infiniband/hw/qib/qib_iba6120.c
++++ b/drivers/infiniband/hw/qib/qib_iba6120.c
+@@ -2681,8 +2681,6 @@ static void qib_get_6120_faststats(unsigned long opaque)
+ spin_lock_irqsave(&dd->eep_st_lock, flags);
+ traffic_wds -= dd->traffic_wds;
+ dd->traffic_wds += traffic_wds;
+- if (traffic_wds >= QIB_TRAFFIC_ACTIVE_THRESHOLD)
+- atomic_add(5, &dd->active_time); /* S/B #define */
+ spin_unlock_irqrestore(&dd->eep_st_lock, flags);
+
+ qib_chk_6120_errormask(dd);
+diff --git a/drivers/infiniband/hw/qib/qib_iba7220.c b/drivers/infiniband/hw/qib/qib_iba7220.c
+index 7dec89fdc124..f5fa106e1992 100644
+--- a/drivers/infiniband/hw/qib/qib_iba7220.c
++++ b/drivers/infiniband/hw/qib/qib_iba7220.c
+@@ -3297,8 +3297,6 @@ static void qib_get_7220_faststats(unsigned long opaque)
+ spin_lock_irqsave(&dd->eep_st_lock, flags);
+ traffic_wds -= dd->traffic_wds;
+ dd->traffic_wds += traffic_wds;
+- if (traffic_wds >= QIB_TRAFFIC_ACTIVE_THRESHOLD)
+- atomic_add(5, &dd->active_time); /* S/B #define */
+ spin_unlock_irqrestore(&dd->eep_st_lock, flags);
+ done:
+ mod_timer(&dd->stats_timer, jiffies + HZ * ACTIVITY_TIMER);
+diff --git a/drivers/infiniband/hw/qib/qib_iba7322.c b/drivers/infiniband/hw/qib/qib_iba7322.c
+index a7eb32517a04..23ca2aca1ad6 100644
+--- a/drivers/infiniband/hw/qib/qib_iba7322.c
++++ b/drivers/infiniband/hw/qib/qib_iba7322.c
+@@ -5178,8 +5178,6 @@ static void qib_get_7322_faststats(unsigned long opaque)
+ spin_lock_irqsave(&ppd->dd->eep_st_lock, flags);
+ traffic_wds -= ppd->dd->traffic_wds;
+ ppd->dd->traffic_wds += traffic_wds;
+- if (traffic_wds >= QIB_TRAFFIC_ACTIVE_THRESHOLD)
+- atomic_add(ACTIVITY_TIMER, &ppd->dd->active_time);
+ spin_unlock_irqrestore(&ppd->dd->eep_st_lock, flags);
+ if (ppd->cpspec->qdr_dfe_on && (ppd->link_speed_active &
+ QIB_IB_QDR) &&
+diff --git a/drivers/infiniband/hw/qib/qib_init.c b/drivers/infiniband/hw/qib/qib_init.c
+index 729da39c49ed..738269b46d83 100644
+--- a/drivers/infiniband/hw/qib/qib_init.c
++++ b/drivers/infiniband/hw/qib/qib_init.c
+@@ -931,7 +931,6 @@ static void qib_shutdown_device(struct qib_devdata *dd)
+ qib_free_pportdata(ppd);
+ }
+
+- qib_update_eeprom_log(dd);
+ }
+
+ /**
+diff --git a/drivers/infiniband/hw/qib/qib_sysfs.c b/drivers/infiniband/hw/qib/qib_sysfs.c
+index 3c8e4e3caca6..b9ccbda7817d 100644
+--- a/drivers/infiniband/hw/qib/qib_sysfs.c
++++ b/drivers/infiniband/hw/qib/qib_sysfs.c
+@@ -611,28 +611,6 @@ bail:
+ return ret < 0 ? ret : count;
+ }
+
+-static ssize_t show_logged_errs(struct device *device,
+- struct device_attribute *attr, char *buf)
+-{
+- struct qib_ibdev *dev =
+- container_of(device, struct qib_ibdev, ibdev.dev);
+- struct qib_devdata *dd = dd_from_dev(dev);
+- int idx, count;
+-
+- /* force consistency with actual EEPROM */
+- if (qib_update_eeprom_log(dd) != 0)
+- return -ENXIO;
+-
+- count = 0;
+- for (idx = 0; idx < QIB_EEP_LOG_CNT; ++idx) {
+- count += scnprintf(buf + count, PAGE_SIZE - count, "%d%c",
+- dd->eep_st_errs[idx],
+- idx == (QIB_EEP_LOG_CNT - 1) ? '\n' : ' ');
+- }
+-
+- return count;
+-}
+-
+ /*
+ * Dump tempsense regs. in decimal, to ease shell-scripts.
+ */
+@@ -679,7 +657,6 @@ static DEVICE_ATTR(nctxts, S_IRUGO, show_nctxts, NULL);
+ static DEVICE_ATTR(nfreectxts, S_IRUGO, show_nfreectxts, NULL);
+ static DEVICE_ATTR(serial, S_IRUGO, show_serial, NULL);
+ static DEVICE_ATTR(boardversion, S_IRUGO, show_boardversion, NULL);
+-static DEVICE_ATTR(logged_errors, S_IRUGO, show_logged_errs, NULL);
+ static DEVICE_ATTR(tempsense, S_IRUGO, show_tempsense, NULL);
+ static DEVICE_ATTR(localbus_info, S_IRUGO, show_localbus_info, NULL);
+ static DEVICE_ATTR(chip_reset, S_IWUSR, NULL, store_chip_reset);
+@@ -693,7 +670,6 @@ static struct device_attribute *qib_attributes[] = {
+ &dev_attr_nfreectxts,
+ &dev_attr_serial,
+ &dev_attr_boardversion,
+- &dev_attr_logged_errors,
+ &dev_attr_tempsense,
+ &dev_attr_localbus_info,
+ &dev_attr_chip_reset,
+diff --git a/drivers/infiniband/ulp/iser/iscsi_iser.h b/drivers/infiniband/ulp/iser/iscsi_iser.h
+index f14c3849e568..e4bc9409243f 100644
+--- a/drivers/infiniband/ulp/iser/iscsi_iser.h
++++ b/drivers/infiniband/ulp/iser/iscsi_iser.h
+@@ -654,7 +654,9 @@ int iser_dma_map_task_data(struct iscsi_iser_task *iser_task,
+ enum dma_data_direction dma_dir);
+
+ void iser_dma_unmap_task_data(struct iscsi_iser_task *iser_task,
+- struct iser_data_buf *data);
++ struct iser_data_buf *data,
++ enum dma_data_direction dir);
++
+ int iser_initialize_task_headers(struct iscsi_task *task,
+ struct iser_tx_desc *tx_desc);
+ int iser_alloc_rx_descriptors(struct iser_conn *iser_conn,
+diff --git a/drivers/infiniband/ulp/iser/iser_initiator.c b/drivers/infiniband/ulp/iser/iser_initiator.c
+index 3821633f1065..20e859a6f1a6 100644
+--- a/drivers/infiniband/ulp/iser/iser_initiator.c
++++ b/drivers/infiniband/ulp/iser/iser_initiator.c
+@@ -320,9 +320,6 @@ void iser_free_rx_descriptors(struct iser_conn *iser_conn)
+ struct ib_conn *ib_conn = &iser_conn->ib_conn;
+ struct iser_device *device = ib_conn->device;
+
+- if (!iser_conn->rx_descs)
+- goto free_login_buf;
+-
+ if (device->iser_free_rdma_reg_res)
+ device->iser_free_rdma_reg_res(ib_conn);
+
+@@ -334,7 +331,6 @@ void iser_free_rx_descriptors(struct iser_conn *iser_conn)
+ /* make sure we never redo any unmapping */
+ iser_conn->rx_descs = NULL;
+
+-free_login_buf:
+ iser_free_login_buf(iser_conn);
+ }
+
+@@ -714,19 +710,23 @@ void iser_task_rdma_finalize(struct iscsi_iser_task *iser_task)
+ device->iser_unreg_rdma_mem(iser_task, ISER_DIR_IN);
+ if (is_rdma_data_aligned)
+ iser_dma_unmap_task_data(iser_task,
+- &iser_task->data[ISER_DIR_IN]);
++ &iser_task->data[ISER_DIR_IN],
++ DMA_FROM_DEVICE);
+ if (prot_count && is_rdma_prot_aligned)
+ iser_dma_unmap_task_data(iser_task,
+- &iser_task->prot[ISER_DIR_IN]);
++ &iser_task->prot[ISER_DIR_IN],
++ DMA_FROM_DEVICE);
+ }
+
+ if (iser_task->dir[ISER_DIR_OUT]) {
+ device->iser_unreg_rdma_mem(iser_task, ISER_DIR_OUT);
+ if (is_rdma_data_aligned)
+ iser_dma_unmap_task_data(iser_task,
+- &iser_task->data[ISER_DIR_OUT]);
++ &iser_task->data[ISER_DIR_OUT],
++ DMA_TO_DEVICE);
+ if (prot_count && is_rdma_prot_aligned)
+ iser_dma_unmap_task_data(iser_task,
+- &iser_task->prot[ISER_DIR_OUT]);
++ &iser_task->prot[ISER_DIR_OUT],
++ DMA_TO_DEVICE);
+ }
+ }
+diff --git a/drivers/infiniband/ulp/iser/iser_memory.c b/drivers/infiniband/ulp/iser/iser_memory.c
+index 6c5ce357fba6..424783f3e0af 100644
+--- a/drivers/infiniband/ulp/iser/iser_memory.c
++++ b/drivers/infiniband/ulp/iser/iser_memory.c
+@@ -333,12 +333,13 @@ int iser_dma_map_task_data(struct iscsi_iser_task *iser_task,
+ }
+
+ void iser_dma_unmap_task_data(struct iscsi_iser_task *iser_task,
+- struct iser_data_buf *data)
++ struct iser_data_buf *data,
++ enum dma_data_direction dir)
+ {
+ struct ib_device *dev;
+
+ dev = iser_task->iser_conn->ib_conn.device->ib_device;
+- ib_dma_unmap_sg(dev, data->buf, data->size, DMA_FROM_DEVICE);
++ ib_dma_unmap_sg(dev, data->buf, data->size, dir);
+ }
+
+ static int fall_to_bounce_buf(struct iscsi_iser_task *iser_task,
+@@ -358,7 +359,9 @@ static int fall_to_bounce_buf(struct iscsi_iser_task *iser_task,
+ iser_data_buf_dump(mem, ibdev);
+
+ /* unmap the command data before accessing it */
+- iser_dma_unmap_task_data(iser_task, mem);
++ iser_dma_unmap_task_data(iser_task, mem,
++ (cmd_dir == ISER_DIR_OUT) ?
++ DMA_TO_DEVICE : DMA_FROM_DEVICE);
+
+ /* allocate copy buf, if we are writing, copy the */
+ /* unaligned scatterlist, dma map the copy */
+diff --git a/drivers/infiniband/ulp/iser/iser_verbs.c b/drivers/infiniband/ulp/iser/iser_verbs.c
+index 67225bb82bb5..d004d6ee2c1a 100644
+--- a/drivers/infiniband/ulp/iser/iser_verbs.c
++++ b/drivers/infiniband/ulp/iser/iser_verbs.c
+@@ -567,16 +567,16 @@ void iser_release_work(struct work_struct *work)
+ /**
+ * iser_free_ib_conn_res - release IB related resources
+ * @iser_conn: iser connection struct
+- * @destroy_device: indicator if we need to try to release
+- * the iser device (only iscsi shutdown and DEVICE_REMOVAL
+- * will use this.
++ * @destroy: indicator if we need to try to release the
++ * iser device and memory regoins pool (only iscsi
++ * shutdown and DEVICE_REMOVAL will use this).
+ *
+ * This routine is called with the iser state mutex held
+ * so the cm_id removal is out of here. It is Safe to
+ * be invoked multiple times.
+ */
+ static void iser_free_ib_conn_res(struct iser_conn *iser_conn,
+- bool destroy_device)
++ bool destroy)
+ {
+ struct ib_conn *ib_conn = &iser_conn->ib_conn;
+ struct iser_device *device = ib_conn->device;
+@@ -584,17 +584,20 @@ static void iser_free_ib_conn_res(struct iser_conn *iser_conn,
+ iser_info("freeing conn %p cma_id %p qp %p\n",
+ iser_conn, ib_conn->cma_id, ib_conn->qp);
+
+- iser_free_rx_descriptors(iser_conn);
+-
+ if (ib_conn->qp != NULL) {
+ ib_conn->comp->active_qps--;
+ rdma_destroy_qp(ib_conn->cma_id);
+ ib_conn->qp = NULL;
+ }
+
+- if (destroy_device && device != NULL) {
+- iser_device_try_release(device);
+- ib_conn->device = NULL;
++ if (destroy) {
++ if (iser_conn->rx_descs)
++ iser_free_rx_descriptors(iser_conn);
++
++ if (device != NULL) {
++ iser_device_try_release(device);
++ ib_conn->device = NULL;
++ }
+ }
+ }
+
+@@ -803,7 +806,7 @@ static void iser_disconnected_handler(struct rdma_cm_id *cma_id)
+ }
+
+ static void iser_cleanup_handler(struct rdma_cm_id *cma_id,
+- bool destroy_device)
++ bool destroy)
+ {
+ struct iser_conn *iser_conn = (struct iser_conn *)cma_id->context;
+
+@@ -813,7 +816,7 @@ static void iser_cleanup_handler(struct rdma_cm_id *cma_id,
+ * and flush errors.
+ */
+ iser_disconnected_handler(cma_id);
+- iser_free_ib_conn_res(iser_conn, destroy_device);
++ iser_free_ib_conn_res(iser_conn, destroy);
+ complete(&iser_conn->ib_completion);
+ };
+
+diff --git a/drivers/md/dm-io.c b/drivers/md/dm-io.c
+index c09359db3a90..37de0173b6d2 100644
+--- a/drivers/md/dm-io.c
++++ b/drivers/md/dm-io.c
+@@ -290,6 +290,12 @@ static void do_region(int rw, unsigned region, struct dm_io_region *where,
+ unsigned short logical_block_size = queue_logical_block_size(q);
+ sector_t num_sectors;
+
++ /* Reject unsupported discard requests */
++ if ((rw & REQ_DISCARD) && !blk_queue_discard(q)) {
++ dec_count(io, region, -EOPNOTSUPP);
++ return;
++ }
++
+ /*
+ * where->count may be zero if rw holds a flush and we need to
+ * send a zero-sized flush.
+diff --git a/drivers/md/dm-raid1.c b/drivers/md/dm-raid1.c
+index 7dfdb5c746d6..089d62751f7f 100644
+--- a/drivers/md/dm-raid1.c
++++ b/drivers/md/dm-raid1.c
+@@ -604,6 +604,15 @@ static void write_callback(unsigned long error, void *context)
+ return;
+ }
+
++ /*
++ * If the bio is discard, return an error, but do not
++ * degrade the array.
++ */
++ if (bio->bi_rw & REQ_DISCARD) {
++ bio_endio(bio, -EOPNOTSUPP);
++ return;
++ }
++
+ for (i = 0; i < ms->nr_mirrors; i++)
+ if (test_bit(i, &error))
+ fail_mirror(ms->mirror + i, DM_RAID1_WRITE_ERROR);
+diff --git a/drivers/md/dm-snap.c b/drivers/md/dm-snap.c
+index 864b03f47727..8b204ae216ab 100644
+--- a/drivers/md/dm-snap.c
++++ b/drivers/md/dm-snap.c
+@@ -1432,8 +1432,6 @@ out:
+ full_bio->bi_private = pe->full_bio_private;
+ atomic_inc(&full_bio->bi_remaining);
+ }
+- free_pending_exception(pe);
+-
+ increment_pending_exceptions_done_count();
+
+ up_write(&s->lock);
+@@ -1450,6 +1448,8 @@ out:
+ }
+
+ retry_origin_bios(s, origin_bios);
++
++ free_pending_exception(pe);
+ }
+
+ static void commit_callback(void *context, int success)
+diff --git a/drivers/md/dm.c b/drivers/md/dm.c
+index 62c51364cf9e..cec85c5bae9e 100644
+--- a/drivers/md/dm.c
++++ b/drivers/md/dm.c
+@@ -2462,7 +2462,7 @@ int dm_setup_md_queue(struct mapped_device *md)
+ return 0;
+ }
+
+-static struct mapped_device *dm_find_md(dev_t dev)
++struct mapped_device *dm_get_md(dev_t dev)
+ {
+ struct mapped_device *md;
+ unsigned minor = MINOR(dev);
+@@ -2473,12 +2473,15 @@ static struct mapped_device *dm_find_md(dev_t dev)
+ spin_lock(&_minor_lock);
+
+ md = idr_find(&_minor_idr, minor);
+- if (md && (md == MINOR_ALLOCED ||
+- (MINOR(disk_devt(dm_disk(md))) != minor) ||
+- dm_deleting_md(md) ||
+- test_bit(DMF_FREEING, &md->flags))) {
+- md = NULL;
+- goto out;
++ if (md) {
++ if ((md == MINOR_ALLOCED ||
++ (MINOR(disk_devt(dm_disk(md))) != minor) ||
++ dm_deleting_md(md) ||
++ test_bit(DMF_FREEING, &md->flags))) {
++ md = NULL;
++ goto out;
++ }
++ dm_get(md);
+ }
+
+ out:
+@@ -2486,16 +2489,6 @@ out:
+
+ return md;
+ }
+-
+-struct mapped_device *dm_get_md(dev_t dev)
+-{
+- struct mapped_device *md = dm_find_md(dev);
+-
+- if (md)
+- dm_get(md);
+-
+- return md;
+-}
+ EXPORT_SYMBOL_GPL(dm_get_md);
+
+ void *dm_get_mdptr(struct mapped_device *md)
+diff --git a/drivers/misc/cxl/cxl.h b/drivers/misc/cxl/cxl.h
+index 6ee785da574e..9ff67b1e1d39 100644
+--- a/drivers/misc/cxl/cxl.h
++++ b/drivers/misc/cxl/cxl.h
+@@ -471,6 +471,7 @@ void cxl_release_one_irq(struct cxl *adapter, int hwirq);
+ int cxl_alloc_irq_ranges(struct cxl_irq_ranges *irqs, struct cxl *adapter, unsigned int num);
+ void cxl_release_irq_ranges(struct cxl_irq_ranges *irqs, struct cxl *adapter);
+ int cxl_setup_irq(struct cxl *adapter, unsigned int hwirq, unsigned int virq);
++int cxl_update_image_control(struct cxl *adapter);
+
+ /* common == phyp + powernv */
+ struct cxl_process_element_common {
+diff --git a/drivers/misc/cxl/irq.c b/drivers/misc/cxl/irq.c
+index 336020c8e1af..6fe4027feb7d 100644
+--- a/drivers/misc/cxl/irq.c
++++ b/drivers/misc/cxl/irq.c
+@@ -174,6 +174,7 @@ static irqreturn_t cxl_irq(int irq, void *data)
+ }
+
+ cxl_ack_irq(ctx, CXL_PSL_TFC_An_A, 0);
++ return IRQ_HANDLED;
+ }
+ if (dsisr & CXL_PSL_DSISR_An_OC)
+ pr_devel("CXL interrupt: OS Context Warning\n");
+diff --git a/drivers/misc/cxl/pci.c b/drivers/misc/cxl/pci.c
+index 0f2cc9f8b4db..eee4fd606dc1 100644
+--- a/drivers/misc/cxl/pci.c
++++ b/drivers/misc/cxl/pci.c
+@@ -316,7 +316,7 @@ static int init_implementation_adapter_regs(struct cxl *adapter, struct pci_dev
+ u64 psl_dsnctl;
+ u64 chipid;
+
+- if (!(np = pnv_pci_to_phb_node(dev)))
++ if (!(np = pnv_pci_get_phb_node(dev)))
+ return -ENODEV;
+
+ while (np && !(prop = of_get_property(np, "ibm,chip-id", NULL)))
+@@ -361,6 +361,41 @@ int cxl_setup_irq(struct cxl *adapter, unsigned int hwirq,
+ return pnv_cxl_ioda_msi_setup(dev, hwirq, virq);
+ }
+
++int cxl_update_image_control(struct cxl *adapter)
++{
++ struct pci_dev *dev = to_pci_dev(adapter->dev.parent);
++ int rc;
++ int vsec;
++ u8 image_state;
++
++ if (!(vsec = find_cxl_vsec(dev))) {
++ dev_err(&dev->dev, "ABORTING: CXL VSEC not found!\n");
++ return -ENODEV;
++ }
++
++ if ((rc = CXL_READ_VSEC_IMAGE_STATE(dev, vsec, &image_state))) {
++ dev_err(&dev->dev, "failed to read image state: %i\n", rc);
++ return rc;
++ }
++
++ if (adapter->perst_loads_image)
++ image_state |= CXL_VSEC_PERST_LOADS_IMAGE;
++ else
++ image_state &= ~CXL_VSEC_PERST_LOADS_IMAGE;
++
++ if (adapter->perst_select_user)
++ image_state |= CXL_VSEC_PERST_SELECT_USER;
++ else
++ image_state &= ~CXL_VSEC_PERST_SELECT_USER;
++
++ if ((rc = CXL_WRITE_VSEC_IMAGE_STATE(dev, vsec, image_state))) {
++ dev_err(&dev->dev, "failed to update image control: %i\n", rc);
++ return rc;
++ }
++
++ return 0;
++}
++
+ int cxl_alloc_one_irq(struct cxl *adapter)
+ {
+ struct pci_dev *dev = to_pci_dev(adapter->dev.parent);
+@@ -770,8 +805,8 @@ static int cxl_read_vsec(struct cxl *adapter, struct pci_dev *dev)
+ CXL_READ_VSEC_BASE_IMAGE(dev, vsec, &adapter->base_image);
+ CXL_READ_VSEC_IMAGE_STATE(dev, vsec, &image_state);
+ adapter->user_image_loaded = !!(image_state & CXL_VSEC_USER_IMAGE_LOADED);
+- adapter->perst_loads_image = !!(image_state & CXL_VSEC_PERST_LOADS_IMAGE);
+- adapter->perst_select_user = !!(image_state & CXL_VSEC_PERST_SELECT_USER);
++ adapter->perst_loads_image = true;
++ adapter->perst_select_user = !!(image_state & CXL_VSEC_USER_IMAGE_LOADED);
+
+ CXL_READ_VSEC_NAFUS(dev, vsec, &adapter->slices);
+ CXL_READ_VSEC_AFU_DESC_OFF(dev, vsec, &afu_desc_off);
+@@ -879,6 +914,9 @@ static struct cxl *cxl_init_adapter(struct pci_dev *dev)
+ if ((rc = cxl_vsec_looks_ok(adapter, dev)))
+ goto err2;
+
++ if ((rc = cxl_update_image_control(adapter)))
++ goto err2;
++
+ if ((rc = cxl_map_adapter_regs(adapter, dev)))
+ goto err2;
+
+diff --git a/drivers/misc/mei/init.c b/drivers/misc/mei/init.c
+index 7901d076c127..6c267162f151 100644
+--- a/drivers/misc/mei/init.c
++++ b/drivers/misc/mei/init.c
+@@ -313,6 +313,8 @@ void mei_stop(struct mei_device *dev)
+
+ dev->dev_state = MEI_DEV_POWER_DOWN;
+ mei_reset(dev);
++ /* move device to disabled state unconditionally */
++ dev->dev_state = MEI_DEV_DISABLED;
+
+ mutex_unlock(&dev->device_lock);
+
+diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+index da1a2500c91c..bb27028d392b 100644
+--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c
++++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+@@ -872,13 +872,14 @@ static inline void bcmgenet_tx_ring_int_disable(struct bcmgenet_priv *priv,
+ }
+
+ /* Unlocked version of the reclaim routine */
+-static void __bcmgenet_tx_reclaim(struct net_device *dev,
+- struct bcmgenet_tx_ring *ring)
++static unsigned int __bcmgenet_tx_reclaim(struct net_device *dev,
++ struct bcmgenet_tx_ring *ring)
+ {
+ struct bcmgenet_priv *priv = netdev_priv(dev);
+ int last_tx_cn, last_c_index, num_tx_bds;
+ struct enet_cb *tx_cb_ptr;
+ struct netdev_queue *txq;
++ unsigned int pkts_compl = 0;
+ unsigned int bds_compl;
+ unsigned int c_index;
+
+@@ -906,6 +907,7 @@ static void __bcmgenet_tx_reclaim(struct net_device *dev,
+ tx_cb_ptr = ring->cbs + last_c_index;
+ bds_compl = 0;
+ if (tx_cb_ptr->skb) {
++ pkts_compl++;
+ bds_compl = skb_shinfo(tx_cb_ptr->skb)->nr_frags + 1;
+ dev->stats.tx_bytes += tx_cb_ptr->skb->len;
+ dma_unmap_single(&dev->dev,
+@@ -929,23 +931,45 @@ static void __bcmgenet_tx_reclaim(struct net_device *dev,
+ last_c_index &= (num_tx_bds - 1);
+ }
+
+- if (ring->free_bds > (MAX_SKB_FRAGS + 1))
+- ring->int_disable(priv, ring);
+-
+- if (netif_tx_queue_stopped(txq))
+- netif_tx_wake_queue(txq);
++ if (ring->free_bds > (MAX_SKB_FRAGS + 1)) {
++ if (netif_tx_queue_stopped(txq))
++ netif_tx_wake_queue(txq);
++ }
+
+ ring->c_index = c_index;
++
++ return pkts_compl;
+ }
+
+-static void bcmgenet_tx_reclaim(struct net_device *dev,
++static unsigned int bcmgenet_tx_reclaim(struct net_device *dev,
+ struct bcmgenet_tx_ring *ring)
+ {
++ unsigned int released;
+ unsigned long flags;
+
+ spin_lock_irqsave(&ring->lock, flags);
+- __bcmgenet_tx_reclaim(dev, ring);
++ released = __bcmgenet_tx_reclaim(dev, ring);
+ spin_unlock_irqrestore(&ring->lock, flags);
++
++ return released;
++}
++
++static int bcmgenet_tx_poll(struct napi_struct *napi, int budget)
++{
++ struct bcmgenet_tx_ring *ring =
++ container_of(napi, struct bcmgenet_tx_ring, napi);
++ unsigned int work_done = 0;
++
++ work_done = bcmgenet_tx_reclaim(ring->priv->dev, ring);
++
++ if (work_done == 0) {
++ napi_complete(napi);
++ ring->int_enable(ring->priv, ring);
++
++ return 0;
++ }
++
++ return budget;
+ }
+
+ static void bcmgenet_tx_reclaim_all(struct net_device *dev)
+@@ -1201,10 +1225,8 @@ static netdev_tx_t bcmgenet_xmit(struct sk_buff *skb, struct net_device *dev)
+ bcmgenet_tdma_ring_writel(priv, ring->index,
+ ring->prod_index, TDMA_PROD_INDEX);
+
+- if (ring->free_bds <= (MAX_SKB_FRAGS + 1)) {
++ if (ring->free_bds <= (MAX_SKB_FRAGS + 1))
+ netif_tx_stop_queue(txq);
+- ring->int_enable(priv, ring);
+- }
+
+ out:
+ spin_unlock_irqrestore(&ring->lock, flags);
+@@ -1517,6 +1539,7 @@ static int init_umac(struct bcmgenet_priv *priv)
+ struct device *kdev = &priv->pdev->dev;
+ int ret;
+ u32 reg, cpu_mask_clear;
++ int index;
+
+ dev_dbg(&priv->pdev->dev, "bcmgenet: init_umac\n");
+
+@@ -1543,7 +1566,7 @@ static int init_umac(struct bcmgenet_priv *priv)
+
+ bcmgenet_intr_disable(priv);
+
+- cpu_mask_clear = UMAC_IRQ_RXDMA_BDONE;
++ cpu_mask_clear = UMAC_IRQ_RXDMA_BDONE | UMAC_IRQ_TXDMA_BDONE;
+
+ dev_dbg(kdev, "%s:Enabling RXDMA_BDONE interrupt\n", __func__);
+
+@@ -1570,6 +1593,10 @@ static int init_umac(struct bcmgenet_priv *priv)
+
+ bcmgenet_intrl2_0_writel(priv, cpu_mask_clear, INTRL2_CPU_MASK_CLEAR);
+
++ for (index = 0; index < priv->hw_params->tx_queues; index++)
++ bcmgenet_intrl2_1_writel(priv, (1 << index),
++ INTRL2_CPU_MASK_CLEAR);
++
+ /* Enable rx/tx engine.*/
+ dev_dbg(kdev, "done init umac\n");
+
+@@ -1589,6 +1616,8 @@ static void bcmgenet_init_tx_ring(struct bcmgenet_priv *priv,
+ unsigned int first_bd;
+
+ spin_lock_init(&ring->lock);
++ ring->priv = priv;
++ netif_napi_add(priv->dev, &ring->napi, bcmgenet_tx_poll, 64);
+ ring->index = index;
+ if (index == DESC_INDEX) {
+ ring->queue = 0;
+@@ -1634,6 +1663,17 @@ static void bcmgenet_init_tx_ring(struct bcmgenet_priv *priv,
+ TDMA_WRITE_PTR);
+ bcmgenet_tdma_ring_writel(priv, index, end_ptr * words_per_bd - 1,
+ DMA_END_ADDR);
++
++ napi_enable(&ring->napi);
++}
++
++static void bcmgenet_fini_tx_ring(struct bcmgenet_priv *priv,
++ unsigned int index)
++{
++ struct bcmgenet_tx_ring *ring = &priv->tx_rings[index];
++
++ napi_disable(&ring->napi);
++ netif_napi_del(&ring->napi);
+ }
+
+ /* Initialize a RDMA ring */
+@@ -1803,7 +1843,7 @@ static int bcmgenet_dma_teardown(struct bcmgenet_priv *priv)
+ return ret;
+ }
+
+-static void bcmgenet_fini_dma(struct bcmgenet_priv *priv)
++static void __bcmgenet_fini_dma(struct bcmgenet_priv *priv)
+ {
+ int i;
+
+@@ -1822,6 +1862,18 @@ static void bcmgenet_fini_dma(struct bcmgenet_priv *priv)
+ kfree(priv->tx_cbs);
+ }
+
++static void bcmgenet_fini_dma(struct bcmgenet_priv *priv)
++{
++ int i;
++
++ bcmgenet_fini_tx_ring(priv, DESC_INDEX);
++
++ for (i = 0; i < priv->hw_params->tx_queues; i++)
++ bcmgenet_fini_tx_ring(priv, i);
++
++ __bcmgenet_fini_dma(priv);
++}
++
+ /* init_edma: Initialize DMA control register */
+ static int bcmgenet_init_dma(struct bcmgenet_priv *priv)
+ {
+@@ -1848,7 +1900,7 @@ static int bcmgenet_init_dma(struct bcmgenet_priv *priv)
+ priv->tx_cbs = kcalloc(priv->num_tx_bds, sizeof(struct enet_cb),
+ GFP_KERNEL);
+ if (!priv->tx_cbs) {
+- bcmgenet_fini_dma(priv);
++ __bcmgenet_fini_dma(priv);
+ return -ENOMEM;
+ }
+
+@@ -1871,9 +1923,6 @@ static int bcmgenet_poll(struct napi_struct *napi, int budget)
+ struct bcmgenet_priv, napi);
+ unsigned int work_done;
+
+- /* tx reclaim */
+- bcmgenet_tx_reclaim(priv->dev, &priv->tx_rings[DESC_INDEX]);
+-
+ work_done = bcmgenet_desc_rx(priv, budget);
+
+ /* Advancing our consumer index*/
+@@ -1918,28 +1967,34 @@ static void bcmgenet_irq_task(struct work_struct *work)
+ static irqreturn_t bcmgenet_isr1(int irq, void *dev_id)
+ {
+ struct bcmgenet_priv *priv = dev_id;
++ struct bcmgenet_tx_ring *ring;
+ unsigned int index;
+
+ /* Save irq status for bottom-half processing. */
+ priv->irq1_stat =
+ bcmgenet_intrl2_1_readl(priv, INTRL2_CPU_STAT) &
+- ~priv->int1_mask;
++ ~bcmgenet_intrl2_1_readl(priv, INTRL2_CPU_MASK_STATUS);
+ /* clear interrupts */
+ bcmgenet_intrl2_1_writel(priv, priv->irq1_stat, INTRL2_CPU_CLEAR);
+
+ netif_dbg(priv, intr, priv->dev,
+ "%s: IRQ=0x%x\n", __func__, priv->irq1_stat);
++
+ /* Check the MBDONE interrupts.
+ * packet is done, reclaim descriptors
+ */
+- if (priv->irq1_stat & 0x0000ffff) {
+- index = 0;
+- for (index = 0; index < 16; index++) {
+- if (priv->irq1_stat & (1 << index))
+- bcmgenet_tx_reclaim(priv->dev,
+- &priv->tx_rings[index]);
++ for (index = 0; index < priv->hw_params->tx_queues; index++) {
++ if (!(priv->irq1_stat & BIT(index)))
++ continue;
++
++ ring = &priv->tx_rings[index];
++
++ if (likely(napi_schedule_prep(&ring->napi))) {
++ ring->int_disable(priv, ring);
++ __napi_schedule(&ring->napi);
+ }
+ }
++
+ return IRQ_HANDLED;
+ }
+
+@@ -1971,8 +2026,12 @@ static irqreturn_t bcmgenet_isr0(int irq, void *dev_id)
+ }
+ if (priv->irq0_stat &
+ (UMAC_IRQ_TXDMA_BDONE | UMAC_IRQ_TXDMA_PDONE)) {
+- /* Tx reclaim */
+- bcmgenet_tx_reclaim(priv->dev, &priv->tx_rings[DESC_INDEX]);
++ struct bcmgenet_tx_ring *ring = &priv->tx_rings[DESC_INDEX];
++
++ if (likely(napi_schedule_prep(&ring->napi))) {
++ ring->int_disable(priv, ring);
++ __napi_schedule(&ring->napi);
++ }
+ }
+ if (priv->irq0_stat & (UMAC_IRQ_PHY_DET_R |
+ UMAC_IRQ_PHY_DET_F |
+diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.h b/drivers/net/ethernet/broadcom/genet/bcmgenet.h
+index 31b2da5f9b82..eeda0281c684 100644
+--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.h
++++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.h
+@@ -495,6 +495,7 @@ struct bcmgenet_hw_params {
+
+ struct bcmgenet_tx_ring {
+ spinlock_t lock; /* ring lock */
++ struct napi_struct napi; /* NAPI per tx queue */
+ unsigned int index; /* ring index */
+ unsigned int queue; /* queue index */
+ struct enet_cb *cbs; /* tx ring buffer control block*/
+@@ -509,6 +510,7 @@ struct bcmgenet_tx_ring {
+ struct bcmgenet_tx_ring *);
+ void (*int_disable)(struct bcmgenet_priv *priv,
+ struct bcmgenet_tx_ring *);
++ struct bcmgenet_priv *priv;
+ };
+
+ /* device context */
+diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
+index cf154f74cba1..54390b3e0344 100644
+--- a/drivers/net/ethernet/realtek/r8169.c
++++ b/drivers/net/ethernet/realtek/r8169.c
+@@ -5062,8 +5062,6 @@ static void rtl_hw_reset(struct rtl8169_private *tp)
+ RTL_W8(ChipCmd, CmdReset);
+
+ rtl_udelay_loop_wait_low(tp, &rtl_chipcmd_cond, 100, 100);
+-
+- netdev_reset_queue(tp->dev);
+ }
+
+ static void rtl_request_uncached_firmware(struct rtl8169_private *tp)
+@@ -7073,8 +7071,6 @@ static netdev_tx_t rtl8169_start_xmit(struct sk_buff *skb,
+
+ txd->opts2 = cpu_to_le32(opts[1]);
+
+- netdev_sent_queue(dev, skb->len);
+-
+ skb_tx_timestamp(skb);
+
+ wmb();
+@@ -7174,7 +7170,6 @@ static void rtl8169_pcierr_interrupt(struct net_device *dev)
+ static void rtl_tx(struct net_device *dev, struct rtl8169_private *tp)
+ {
+ unsigned int dirty_tx, tx_left;
+- unsigned int bytes_compl = 0, pkts_compl = 0;
+
+ dirty_tx = tp->dirty_tx;
+ smp_rmb();
+@@ -7193,8 +7188,10 @@ static void rtl_tx(struct net_device *dev, struct rtl8169_private *tp)
+ rtl8169_unmap_tx_skb(&tp->pci_dev->dev, tx_skb,
+ tp->TxDescArray + entry);
+ if (status & LastFrag) {
+- pkts_compl++;
+- bytes_compl += tx_skb->skb->len;
++ u64_stats_update_begin(&tp->tx_stats.syncp);
++ tp->tx_stats.packets++;
++ tp->tx_stats.bytes += tx_skb->skb->len;
++ u64_stats_update_end(&tp->tx_stats.syncp);
+ dev_kfree_skb_any(tx_skb->skb);
+ tx_skb->skb = NULL;
+ }
+@@ -7203,13 +7200,6 @@ static void rtl_tx(struct net_device *dev, struct rtl8169_private *tp)
+ }
+
+ if (tp->dirty_tx != dirty_tx) {
+- netdev_completed_queue(tp->dev, pkts_compl, bytes_compl);
+-
+- u64_stats_update_begin(&tp->tx_stats.syncp);
+- tp->tx_stats.packets += pkts_compl;
+- tp->tx_stats.bytes += bytes_compl;
+- u64_stats_update_end(&tp->tx_stats.syncp);
+-
+ tp->dirty_tx = dirty_tx;
+ /* Sync with rtl8169_start_xmit:
+ * - publish dirty_tx ring index (write barrier)
+diff --git a/drivers/net/macvtap.c b/drivers/net/macvtap.c
+index 880cc090dc44..91d0c6a86e37 100644
+--- a/drivers/net/macvtap.c
++++ b/drivers/net/macvtap.c
+@@ -637,12 +637,15 @@ static void macvtap_skb_to_vnet_hdr(const struct sk_buff *skb,
+ } /* else everything is zero */
+ }
+
++/* Neighbour code has some assumptions on HH_DATA_MOD alignment */
++#define MACVTAP_RESERVE HH_DATA_OFF(ETH_HLEN)
++
+ /* Get packet from user space buffer */
+ static ssize_t macvtap_get_user(struct macvtap_queue *q, struct msghdr *m,
+ const struct iovec *iv, unsigned long total_len,
+ size_t count, int noblock)
+ {
+- int good_linear = SKB_MAX_HEAD(NET_IP_ALIGN);
++ int good_linear = SKB_MAX_HEAD(MACVTAP_RESERVE);
+ struct sk_buff *skb;
+ struct macvlan_dev *vlan;
+ unsigned long len = total_len;
+@@ -701,7 +704,7 @@ static ssize_t macvtap_get_user(struct macvtap_queue *q, struct msghdr *m,
+ linear = vnet_hdr.hdr_len;
+ }
+
+- skb = macvtap_alloc_skb(&q->sk, NET_IP_ALIGN, copylen,
++ skb = macvtap_alloc_skb(&q->sk, MACVTAP_RESERVE, copylen,
+ linear, noblock, &err);
+ if (!skb)
+ goto err;
+diff --git a/drivers/net/phy/phy.c b/drivers/net/phy/phy.c
+index 767cd110f496..dc1f6f07326a 100644
+--- a/drivers/net/phy/phy.c
++++ b/drivers/net/phy/phy.c
+@@ -236,6 +236,25 @@ static inline unsigned int phy_find_valid(unsigned int idx, u32 features)
+ }
+
+ /**
++ * phy_check_valid - check if there is a valid PHY setting which matches
++ * speed, duplex, and feature mask
++ * @speed: speed to match
++ * @duplex: duplex to match
++ * @features: A mask of the valid settings
++ *
++ * Description: Returns true if there is a valid setting, false otherwise.
++ */
++static inline bool phy_check_valid(int speed, int duplex, u32 features)
++{
++ unsigned int idx;
++
++ idx = phy_find_valid(phy_find_setting(speed, duplex), features);
++
++ return settings[idx].speed == speed && settings[idx].duplex == duplex &&
++ (settings[idx].setting & features);
++}
++
++/**
+ * phy_sanitize_settings - make sure the PHY is set to supported speed and duplex
+ * @phydev: the target phy_device struct
+ *
+@@ -1042,7 +1061,6 @@ int phy_init_eee(struct phy_device *phydev, bool clk_stop_enable)
+ int eee_lp, eee_cap, eee_adv;
+ u32 lp, cap, adv;
+ int status;
+- unsigned int idx;
+
+ /* Read phy status to properly get the right settings */
+ status = phy_read_status(phydev);
+@@ -1074,8 +1092,7 @@ int phy_init_eee(struct phy_device *phydev, bool clk_stop_enable)
+
+ adv = mmd_eee_adv_to_ethtool_adv_t(eee_adv);
+ lp = mmd_eee_adv_to_ethtool_adv_t(eee_lp);
+- idx = phy_find_setting(phydev->speed, phydev->duplex);
+- if (!(lp & adv & settings[idx].setting))
++ if (!phy_check_valid(phydev->speed, phydev->duplex, lp & adv))
+ goto eee_exit_err;
+
+ if (clk_stop_enable) {
+diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
+index 9c505c4dbe04..ebc95a3771a4 100644
+--- a/drivers/net/team/team.c
++++ b/drivers/net/team/team.c
+@@ -42,9 +42,7 @@
+
+ static struct team_port *team_port_get_rcu(const struct net_device *dev)
+ {
+- struct team_port *port = rcu_dereference(dev->rx_handler_data);
+-
+- return team_port_exists(dev) ? port : NULL;
++ return rcu_dereference(dev->rx_handler_data);
+ }
+
+ static struct team_port *team_port_get_rtnl(const struct net_device *dev)
+@@ -1735,11 +1733,11 @@ static int team_set_mac_address(struct net_device *dev, void *p)
+ if (dev->type == ARPHRD_ETHER && !is_valid_ether_addr(addr->sa_data))
+ return -EADDRNOTAVAIL;
+ memcpy(dev->dev_addr, addr->sa_data, dev->addr_len);
+- rcu_read_lock();
+- list_for_each_entry_rcu(port, &team->port_list, list)
++ mutex_lock(&team->lock);
++ list_for_each_entry(port, &team->port_list, list)
+ if (team->ops.port_change_dev_addr)
+ team->ops.port_change_dev_addr(team, port);
+- rcu_read_unlock();
++ mutex_unlock(&team->lock);
+ return 0;
+ }
+
+diff --git a/drivers/net/usb/plusb.c b/drivers/net/usb/plusb.c
+index 3d18bb0eee85..1bfe0fcaccf5 100644
+--- a/drivers/net/usb/plusb.c
++++ b/drivers/net/usb/plusb.c
+@@ -134,6 +134,11 @@ static const struct usb_device_id products [] = {
+ }, {
+ USB_DEVICE(0x050d, 0x258a), /* Belkin F5U258/F5U279 (PL-25A1) */
+ .driver_info = (unsigned long) &prolific_info,
++}, {
++ USB_DEVICE(0x3923, 0x7825), /* National Instruments USB
++ * Host-to-Host Cable
++ */
++ .driver_info = (unsigned long) &prolific_info,
+ },
+
+ { }, // END
+diff --git a/drivers/net/wireless/ath/ath5k/reset.c b/drivers/net/wireless/ath/ath5k/reset.c
+index a3399c4f13a9..b9b651ea9851 100644
+--- a/drivers/net/wireless/ath/ath5k/reset.c
++++ b/drivers/net/wireless/ath/ath5k/reset.c
+@@ -478,7 +478,7 @@ ath5k_hw_wisoc_reset(struct ath5k_hw *ah, u32 flags)
+ regval = ioread32(reg);
+ iowrite32(regval | val, reg);
+ regval = ioread32(reg);
+- usleep_range(100, 150);
++ udelay(100); /* NB: should be atomic */
+
+ /* Bring BB/MAC out of reset */
+ iowrite32(regval & ~val, reg);
+diff --git a/drivers/of/of_pci.c b/drivers/of/of_pci.c
+index 8882b467be95..ecc5fa5640d2 100644
+--- a/drivers/of/of_pci.c
++++ b/drivers/of/of_pci.c
+@@ -140,6 +140,7 @@ int of_pci_get_host_bridge_resources(struct device_node *dev,
+ unsigned char busno, unsigned char bus_max,
+ struct list_head *resources, resource_size_t *io_base)
+ {
++ struct pci_host_bridge_window *window;
+ struct resource *res;
+ struct resource *bus_range;
+ struct of_pci_range range;
+@@ -225,7 +226,10 @@ int of_pci_get_host_bridge_resources(struct device_node *dev,
+ conversion_failed:
+ kfree(res);
+ parse_failed:
++ list_for_each_entry(window, resources, list)
++ kfree(window->res);
+ pci_free_resource_list(resources);
++ kfree(bus_range);
+ return err;
+ }
+ EXPORT_SYMBOL_GPL(of_pci_get_host_bridge_resources);
+diff --git a/drivers/pinctrl/freescale/pinctrl-imx.c b/drivers/pinctrl/freescale/pinctrl-imx.c
+index f2446769247f..6f806f93662a 100644
+--- a/drivers/pinctrl/freescale/pinctrl-imx.c
++++ b/drivers/pinctrl/freescale/pinctrl-imx.c
+@@ -365,7 +365,7 @@ static void imx_pinconf_dbg_show(struct pinctrl_dev *pctldev,
+ const struct imx_pin_reg *pin_reg = &info->pin_regs[pin_id];
+ unsigned long config;
+
+- if (!pin_reg || !pin_reg->conf_reg) {
++ if (!pin_reg || pin_reg->conf_reg == -1) {
+ seq_printf(s, "N/A");
+ return;
+ }
+diff --git a/drivers/pinctrl/freescale/pinctrl-imx25.c b/drivers/pinctrl/freescale/pinctrl-imx25.c
+index 550e6d77ac2b..b5fabf684632 100644
+--- a/drivers/pinctrl/freescale/pinctrl-imx25.c
++++ b/drivers/pinctrl/freescale/pinctrl-imx25.c
+@@ -27,150 +27,148 @@
+
+ enum imx25_pads {
+ MX25_PAD_RESERVE0 = 1,
+- MX25_PAD_RESERVE1 = 2,
+- MX25_PAD_A10 = 3,
+- MX25_PAD_A13 = 4,
+- MX25_PAD_A14 = 5,
+- MX25_PAD_A15 = 6,
+- MX25_PAD_A16 = 7,
+- MX25_PAD_A17 = 8,
+- MX25_PAD_A18 = 9,
+- MX25_PAD_A19 = 10,
+- MX25_PAD_A20 = 11,
+- MX25_PAD_A21 = 12,
+- MX25_PAD_A22 = 13,
+- MX25_PAD_A23 = 14,
+- MX25_PAD_A24 = 15,
+- MX25_PAD_A25 = 16,
+- MX25_PAD_EB0 = 17,
+- MX25_PAD_EB1 = 18,
+- MX25_PAD_OE = 19,
+- MX25_PAD_CS0 = 20,
+- MX25_PAD_CS1 = 21,
+- MX25_PAD_CS4 = 22,
+- MX25_PAD_CS5 = 23,
+- MX25_PAD_NF_CE0 = 24,
+- MX25_PAD_ECB = 25,
+- MX25_PAD_LBA = 26,
+- MX25_PAD_BCLK = 27,
+- MX25_PAD_RW = 28,
+- MX25_PAD_NFWE_B = 29,
+- MX25_PAD_NFRE_B = 30,
+- MX25_PAD_NFALE = 31,
+- MX25_PAD_NFCLE = 32,
+- MX25_PAD_NFWP_B = 33,
+- MX25_PAD_NFRB = 34,
+- MX25_PAD_D15 = 35,
+- MX25_PAD_D14 = 36,
+- MX25_PAD_D13 = 37,
+- MX25_PAD_D12 = 38,
+- MX25_PAD_D11 = 39,
+- MX25_PAD_D10 = 40,
+- MX25_PAD_D9 = 41,
+- MX25_PAD_D8 = 42,
+- MX25_PAD_D7 = 43,
+- MX25_PAD_D6 = 44,
+- MX25_PAD_D5 = 45,
+- MX25_PAD_D4 = 46,
+- MX25_PAD_D3 = 47,
+- MX25_PAD_D2 = 48,
+- MX25_PAD_D1 = 49,
+- MX25_PAD_D0 = 50,
+- MX25_PAD_LD0 = 51,
+- MX25_PAD_LD1 = 52,
+- MX25_PAD_LD2 = 53,
+- MX25_PAD_LD3 = 54,
+- MX25_PAD_LD4 = 55,
+- MX25_PAD_LD5 = 56,
+- MX25_PAD_LD6 = 57,
+- MX25_PAD_LD7 = 58,
+- MX25_PAD_LD8 = 59,
+- MX25_PAD_LD9 = 60,
+- MX25_PAD_LD10 = 61,
+- MX25_PAD_LD11 = 62,
+- MX25_PAD_LD12 = 63,
+- MX25_PAD_LD13 = 64,
+- MX25_PAD_LD14 = 65,
+- MX25_PAD_LD15 = 66,
+- MX25_PAD_HSYNC = 67,
+- MX25_PAD_VSYNC = 68,
+- MX25_PAD_LSCLK = 69,
+- MX25_PAD_OE_ACD = 70,
+- MX25_PAD_CONTRAST = 71,
+- MX25_PAD_PWM = 72,
+- MX25_PAD_CSI_D2 = 73,
+- MX25_PAD_CSI_D3 = 74,
+- MX25_PAD_CSI_D4 = 75,
+- MX25_PAD_CSI_D5 = 76,
+- MX25_PAD_CSI_D6 = 77,
+- MX25_PAD_CSI_D7 = 78,
+- MX25_PAD_CSI_D8 = 79,
+- MX25_PAD_CSI_D9 = 80,
+- MX25_PAD_CSI_MCLK = 81,
+- MX25_PAD_CSI_VSYNC = 82,
+- MX25_PAD_CSI_HSYNC = 83,
+- MX25_PAD_CSI_PIXCLK = 84,
+- MX25_PAD_I2C1_CLK = 85,
+- MX25_PAD_I2C1_DAT = 86,
+- MX25_PAD_CSPI1_MOSI = 87,
+- MX25_PAD_CSPI1_MISO = 88,
+- MX25_PAD_CSPI1_SS0 = 89,
+- MX25_PAD_CSPI1_SS1 = 90,
+- MX25_PAD_CSPI1_SCLK = 91,
+- MX25_PAD_CSPI1_RDY = 92,
+- MX25_PAD_UART1_RXD = 93,
+- MX25_PAD_UART1_TXD = 94,
+- MX25_PAD_UART1_RTS = 95,
+- MX25_PAD_UART1_CTS = 96,
+- MX25_PAD_UART2_RXD = 97,
+- MX25_PAD_UART2_TXD = 98,
+- MX25_PAD_UART2_RTS = 99,
+- MX25_PAD_UART2_CTS = 100,
+- MX25_PAD_SD1_CMD = 101,
+- MX25_PAD_SD1_CLK = 102,
+- MX25_PAD_SD1_DATA0 = 103,
+- MX25_PAD_SD1_DATA1 = 104,
+- MX25_PAD_SD1_DATA2 = 105,
+- MX25_PAD_SD1_DATA3 = 106,
+- MX25_PAD_KPP_ROW0 = 107,
+- MX25_PAD_KPP_ROW1 = 108,
+- MX25_PAD_KPP_ROW2 = 109,
+- MX25_PAD_KPP_ROW3 = 110,
+- MX25_PAD_KPP_COL0 = 111,
+- MX25_PAD_KPP_COL1 = 112,
+- MX25_PAD_KPP_COL2 = 113,
+- MX25_PAD_KPP_COL3 = 114,
+- MX25_PAD_FEC_MDC = 115,
+- MX25_PAD_FEC_MDIO = 116,
+- MX25_PAD_FEC_TDATA0 = 117,
+- MX25_PAD_FEC_TDATA1 = 118,
+- MX25_PAD_FEC_TX_EN = 119,
+- MX25_PAD_FEC_RDATA0 = 120,
+- MX25_PAD_FEC_RDATA1 = 121,
+- MX25_PAD_FEC_RX_DV = 122,
+- MX25_PAD_FEC_TX_CLK = 123,
+- MX25_PAD_RTCK = 124,
+- MX25_PAD_DE_B = 125,
+- MX25_PAD_GPIO_A = 126,
+- MX25_PAD_GPIO_B = 127,
+- MX25_PAD_GPIO_C = 128,
+- MX25_PAD_GPIO_D = 129,
+- MX25_PAD_GPIO_E = 130,
+- MX25_PAD_GPIO_F = 131,
+- MX25_PAD_EXT_ARMCLK = 132,
+- MX25_PAD_UPLL_BYPCLK = 133,
+- MX25_PAD_VSTBY_REQ = 134,
+- MX25_PAD_VSTBY_ACK = 135,
+- MX25_PAD_POWER_FAIL = 136,
+- MX25_PAD_CLKO = 137,
+- MX25_PAD_BOOT_MODE0 = 138,
+- MX25_PAD_BOOT_MODE1 = 139,
++ MX25_PAD_A10 = 2,
++ MX25_PAD_A13 = 3,
++ MX25_PAD_A14 = 4,
++ MX25_PAD_A15 = 5,
++ MX25_PAD_A16 = 6,
++ MX25_PAD_A17 = 7,
++ MX25_PAD_A18 = 8,
++ MX25_PAD_A19 = 9,
++ MX25_PAD_A20 = 10,
++ MX25_PAD_A21 = 11,
++ MX25_PAD_A22 = 12,
++ MX25_PAD_A23 = 13,
++ MX25_PAD_A24 = 14,
++ MX25_PAD_A25 = 15,
++ MX25_PAD_EB0 = 16,
++ MX25_PAD_EB1 = 17,
++ MX25_PAD_OE = 18,
++ MX25_PAD_CS0 = 19,
++ MX25_PAD_CS1 = 20,
++ MX25_PAD_CS4 = 21,
++ MX25_PAD_CS5 = 22,
++ MX25_PAD_NF_CE0 = 23,
++ MX25_PAD_ECB = 24,
++ MX25_PAD_LBA = 25,
++ MX25_PAD_BCLK = 26,
++ MX25_PAD_RW = 27,
++ MX25_PAD_NFWE_B = 28,
++ MX25_PAD_NFRE_B = 29,
++ MX25_PAD_NFALE = 30,
++ MX25_PAD_NFCLE = 31,
++ MX25_PAD_NFWP_B = 32,
++ MX25_PAD_NFRB = 33,
++ MX25_PAD_D15 = 34,
++ MX25_PAD_D14 = 35,
++ MX25_PAD_D13 = 36,
++ MX25_PAD_D12 = 37,
++ MX25_PAD_D11 = 38,
++ MX25_PAD_D10 = 39,
++ MX25_PAD_D9 = 40,
++ MX25_PAD_D8 = 41,
++ MX25_PAD_D7 = 42,
++ MX25_PAD_D6 = 43,
++ MX25_PAD_D5 = 44,
++ MX25_PAD_D4 = 45,
++ MX25_PAD_D3 = 46,
++ MX25_PAD_D2 = 47,
++ MX25_PAD_D1 = 48,
++ MX25_PAD_D0 = 49,
++ MX25_PAD_LD0 = 50,
++ MX25_PAD_LD1 = 51,
++ MX25_PAD_LD2 = 52,
++ MX25_PAD_LD3 = 53,
++ MX25_PAD_LD4 = 54,
++ MX25_PAD_LD5 = 55,
++ MX25_PAD_LD6 = 56,
++ MX25_PAD_LD7 = 57,
++ MX25_PAD_LD8 = 58,
++ MX25_PAD_LD9 = 59,
++ MX25_PAD_LD10 = 60,
++ MX25_PAD_LD11 = 61,
++ MX25_PAD_LD12 = 62,
++ MX25_PAD_LD13 = 63,
++ MX25_PAD_LD14 = 64,
++ MX25_PAD_LD15 = 65,
++ MX25_PAD_HSYNC = 66,
++ MX25_PAD_VSYNC = 67,
++ MX25_PAD_LSCLK = 68,
++ MX25_PAD_OE_ACD = 69,
++ MX25_PAD_CONTRAST = 70,
++ MX25_PAD_PWM = 71,
++ MX25_PAD_CSI_D2 = 72,
++ MX25_PAD_CSI_D3 = 73,
++ MX25_PAD_CSI_D4 = 74,
++ MX25_PAD_CSI_D5 = 75,
++ MX25_PAD_CSI_D6 = 76,
++ MX25_PAD_CSI_D7 = 77,
++ MX25_PAD_CSI_D8 = 78,
++ MX25_PAD_CSI_D9 = 79,
++ MX25_PAD_CSI_MCLK = 80,
++ MX25_PAD_CSI_VSYNC = 81,
++ MX25_PAD_CSI_HSYNC = 82,
++ MX25_PAD_CSI_PIXCLK = 83,
++ MX25_PAD_I2C1_CLK = 84,
++ MX25_PAD_I2C1_DAT = 85,
++ MX25_PAD_CSPI1_MOSI = 86,
++ MX25_PAD_CSPI1_MISO = 87,
++ MX25_PAD_CSPI1_SS0 = 88,
++ MX25_PAD_CSPI1_SS1 = 89,
++ MX25_PAD_CSPI1_SCLK = 90,
++ MX25_PAD_CSPI1_RDY = 91,
++ MX25_PAD_UART1_RXD = 92,
++ MX25_PAD_UART1_TXD = 93,
++ MX25_PAD_UART1_RTS = 94,
++ MX25_PAD_UART1_CTS = 95,
++ MX25_PAD_UART2_RXD = 96,
++ MX25_PAD_UART2_TXD = 97,
++ MX25_PAD_UART2_RTS = 98,
++ MX25_PAD_UART2_CTS = 99,
++ MX25_PAD_SD1_CMD = 100,
++ MX25_PAD_SD1_CLK = 101,
++ MX25_PAD_SD1_DATA0 = 102,
++ MX25_PAD_SD1_DATA1 = 103,
++ MX25_PAD_SD1_DATA2 = 104,
++ MX25_PAD_SD1_DATA3 = 105,
++ MX25_PAD_KPP_ROW0 = 106,
++ MX25_PAD_KPP_ROW1 = 107,
++ MX25_PAD_KPP_ROW2 = 108,
++ MX25_PAD_KPP_ROW3 = 109,
++ MX25_PAD_KPP_COL0 = 110,
++ MX25_PAD_KPP_COL1 = 111,
++ MX25_PAD_KPP_COL2 = 112,
++ MX25_PAD_KPP_COL3 = 113,
++ MX25_PAD_FEC_MDC = 114,
++ MX25_PAD_FEC_MDIO = 115,
++ MX25_PAD_FEC_TDATA0 = 116,
++ MX25_PAD_FEC_TDATA1 = 117,
++ MX25_PAD_FEC_TX_EN = 118,
++ MX25_PAD_FEC_RDATA0 = 119,
++ MX25_PAD_FEC_RDATA1 = 120,
++ MX25_PAD_FEC_RX_DV = 121,
++ MX25_PAD_FEC_TX_CLK = 122,
++ MX25_PAD_RTCK = 123,
++ MX25_PAD_DE_B = 124,
++ MX25_PAD_GPIO_A = 125,
++ MX25_PAD_GPIO_B = 126,
++ MX25_PAD_GPIO_C = 127,
++ MX25_PAD_GPIO_D = 128,
++ MX25_PAD_GPIO_E = 129,
++ MX25_PAD_GPIO_F = 130,
++ MX25_PAD_EXT_ARMCLK = 131,
++ MX25_PAD_UPLL_BYPCLK = 132,
++ MX25_PAD_VSTBY_REQ = 133,
++ MX25_PAD_VSTBY_ACK = 134,
++ MX25_PAD_POWER_FAIL = 135,
++ MX25_PAD_CLKO = 136,
++ MX25_PAD_BOOT_MODE0 = 137,
++ MX25_PAD_BOOT_MODE1 = 138,
+ };
+
+ /* Pad names for the pinmux subsystem */
+ static const struct pinctrl_pin_desc imx25_pinctrl_pads[] = {
+ IMX_PINCTRL_PIN(MX25_PAD_RESERVE0),
+- IMX_PINCTRL_PIN(MX25_PAD_RESERVE1),
+ IMX_PINCTRL_PIN(MX25_PAD_A10),
+ IMX_PINCTRL_PIN(MX25_PAD_A13),
+ IMX_PINCTRL_PIN(MX25_PAD_A14),
+diff --git a/drivers/scsi/be2iscsi/be_main.c b/drivers/scsi/be2iscsi/be_main.c
+index 30d74a06b993..15a8998bd161 100644
+--- a/drivers/scsi/be2iscsi/be_main.c
++++ b/drivers/scsi/be2iscsi/be_main.c
+@@ -586,7 +586,6 @@ static struct beiscsi_hba *beiscsi_hba_alloc(struct pci_dev *pcidev)
+ "beiscsi_hba_alloc - iscsi_host_alloc failed\n");
+ return NULL;
+ }
+- shost->dma_boundary = pcidev->dma_mask;
+ shost->max_id = BE2_MAX_SESSIONS;
+ shost->max_channel = 0;
+ shost->max_cmd_len = BEISCSI_MAX_CMD_LEN;
+diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
+index 843594c2583d..07b2ea1fbf0d 100644
+--- a/drivers/scsi/sg.c
++++ b/drivers/scsi/sg.c
+@@ -546,7 +546,7 @@ static ssize_t
+ sg_new_read(Sg_fd * sfp, char __user *buf, size_t count, Sg_request * srp)
+ {
+ sg_io_hdr_t *hp = &srp->header;
+- int err = 0;
++ int err = 0, err2;
+ int len;
+
+ if (count < SZ_SG_IO_HDR) {
+@@ -575,8 +575,8 @@ sg_new_read(Sg_fd * sfp, char __user *buf, size_t count, Sg_request * srp)
+ goto err_out;
+ }
+ err_out:
+- err = sg_finish_rem_req(srp);
+- return (0 == err) ? count : err;
++ err2 = sg_finish_rem_req(srp);
++ return err ? : err2 ? : count;
+ }
+
+ static ssize_t
+diff --git a/drivers/staging/comedi/comedi_compat32.c b/drivers/staging/comedi/comedi_compat32.c
+index 9b6f96f1591c..25e0b40881ca 100644
+--- a/drivers/staging/comedi/comedi_compat32.c
++++ b/drivers/staging/comedi/comedi_compat32.c
+@@ -262,7 +262,7 @@ static int compat_cmd(struct file *file, unsigned long arg)
+ {
+ struct comedi_cmd __user *cmd;
+ struct comedi32_cmd_struct __user *cmd32;
+- int rc;
++ int rc, err;
+
+ cmd32 = compat_ptr(arg);
+ cmd = compat_alloc_user_space(sizeof(*cmd));
+@@ -271,7 +271,15 @@ static int compat_cmd(struct file *file, unsigned long arg)
+ if (rc)
+ return rc;
+
+- return translated_ioctl(file, COMEDI_CMD, (unsigned long)cmd);
++ rc = translated_ioctl(file, COMEDI_CMD, (unsigned long)cmd);
++ if (rc == -EAGAIN) {
++ /* Special case: copy cmd back to user. */
++ err = put_compat_cmd(cmd32, cmd);
++ if (err)
++ rc = err;
++ }
++
++ return rc;
+ }
+
+ /* Handle 32-bit COMEDI_CMDTEST ioctl. */
+diff --git a/drivers/staging/comedi/drivers/cb_pcidas64.c b/drivers/staging/comedi/drivers/cb_pcidas64.c
+index 3b6bffc66918..1eb13b134b32 100644
+--- a/drivers/staging/comedi/drivers/cb_pcidas64.c
++++ b/drivers/staging/comedi/drivers/cb_pcidas64.c
+@@ -439,6 +439,29 @@ static const struct comedi_lrange ai_ranges_64xx = {
+ }
+ };
+
++static const uint8_t ai_range_code_64xx[8] = {
++ 0x0, 0x1, 0x2, 0x3, /* bipolar 10, 5, 2,5, 1.25 */
++ 0x8, 0x9, 0xa, 0xb /* unipolar 10, 5, 2.5, 1.25 */
++};
++
++/* analog input ranges for 64-Mx boards */
++static const struct comedi_lrange ai_ranges_64_mx = {
++ 7, {
++ BIP_RANGE(5),
++ BIP_RANGE(2.5),
++ BIP_RANGE(1.25),
++ BIP_RANGE(0.625),
++ UNI_RANGE(5),
++ UNI_RANGE(2.5),
++ UNI_RANGE(1.25)
++ }
++};
++
++static const uint8_t ai_range_code_64_mx[7] = {
++ 0x0, 0x1, 0x2, 0x3, /* bipolar 5, 2.5, 1.25, 0.625 */
++ 0x9, 0xa, 0xb /* unipolar 5, 2.5, 1.25 */
++};
++
+ /* analog input ranges for 60xx boards */
+ static const struct comedi_lrange ai_ranges_60xx = {
+ 4, {
+@@ -449,6 +472,10 @@ static const struct comedi_lrange ai_ranges_60xx = {
+ }
+ };
+
++static const uint8_t ai_range_code_60xx[4] = {
++ 0x0, 0x1, 0x4, 0x7 /* bipolar 10, 5, 0.5, 0.05 */
++};
++
+ /* analog input ranges for 6030, etc boards */
+ static const struct comedi_lrange ai_ranges_6030 = {
+ 14, {
+@@ -469,6 +496,11 @@ static const struct comedi_lrange ai_ranges_6030 = {
+ }
+ };
+
++static const uint8_t ai_range_code_6030[14] = {
++ 0x0, 0x1, 0x2, 0x3, 0x4, 0x5, 0x6, /* bip 10, 5, 2, 1, 0.5, 0.2, 0.1 */
++ 0x9, 0xa, 0xb, 0xc, 0xd, 0xe, 0xf /* uni 10, 5, 2, 1, 0.5, 0.2, 0.1 */
++};
++
+ /* analog input ranges for 6052, etc boards */
+ static const struct comedi_lrange ai_ranges_6052 = {
+ 15, {
+@@ -490,6 +522,11 @@ static const struct comedi_lrange ai_ranges_6052 = {
+ }
+ };
+
++static const uint8_t ai_range_code_6052[15] = {
++ 0x0, 0x1, 0x2, 0x3, 0x4, 0x5, 0x6, 0x7, /* bipolar 10 ... 0.05 */
++ 0x9, 0xa, 0xb, 0xc, 0xd, 0xe, 0xf /* unipolar 10 ... 0.1 */
++};
++
+ /* analog input ranges for 4020 board */
+ static const struct comedi_lrange ai_ranges_4020 = {
+ 2, {
+@@ -593,6 +630,7 @@ struct pcidas64_board {
+ int ai_bits; /* analog input resolution */
+ int ai_speed; /* fastest conversion period in ns */
+ const struct comedi_lrange *ai_range_table;
++ const uint8_t *ai_range_code;
+ int ao_nchan; /* number of analog out channels */
+ int ao_bits; /* analog output resolution */
+ int ao_scan_speed; /* analog output scan speed */
+@@ -651,6 +689,7 @@ static const struct pcidas64_board pcidas64_boards[] = {
+ .ao_scan_speed = 10000,
+ .layout = LAYOUT_64XX,
+ .ai_range_table = &ai_ranges_64xx,
++ .ai_range_code = ai_range_code_64xx,
+ .ao_range_table = &ao_ranges_64xx,
+ .ao_range_code = ao_range_code_64xx,
+ .ai_fifo = &ai_fifo_64xx,
+@@ -666,6 +705,7 @@ static const struct pcidas64_board pcidas64_boards[] = {
+ .ao_scan_speed = 10000,
+ .layout = LAYOUT_64XX,
+ .ai_range_table = &ai_ranges_64xx,
++ .ai_range_code = ai_range_code_64xx,
+ .ao_range_table = &ao_ranges_64xx,
+ .ao_range_code = ao_range_code_64xx,
+ .ai_fifo = &ai_fifo_64xx,
+@@ -680,7 +720,8 @@ static const struct pcidas64_board pcidas64_boards[] = {
+ .ao_bits = 16,
+ .ao_scan_speed = 10000,
+ .layout = LAYOUT_64XX,
+- .ai_range_table = &ai_ranges_64xx,
++ .ai_range_table = &ai_ranges_64_mx,
++ .ai_range_code = ai_range_code_64_mx,
+ .ao_range_table = &ao_ranges_64xx,
+ .ao_range_code = ao_range_code_64xx,
+ .ai_fifo = &ai_fifo_64xx,
+@@ -695,7 +736,8 @@ static const struct pcidas64_board pcidas64_boards[] = {
+ .ao_bits = 16,
+ .ao_scan_speed = 10000,
+ .layout = LAYOUT_64XX,
+- .ai_range_table = &ai_ranges_64xx,
++ .ai_range_table = &ai_ranges_64_mx,
++ .ai_range_code = ai_range_code_64_mx,
+ .ao_range_table = &ao_ranges_64xx,
+ .ao_range_code = ao_range_code_64xx,
+ .ai_fifo = &ai_fifo_64xx,
+@@ -710,7 +752,8 @@ static const struct pcidas64_board pcidas64_boards[] = {
+ .ao_bits = 16,
+ .ao_scan_speed = 10000,
+ .layout = LAYOUT_64XX,
+- .ai_range_table = &ai_ranges_64xx,
++ .ai_range_table = &ai_ranges_64_mx,
++ .ai_range_code = ai_range_code_64_mx,
+ .ao_range_table = &ao_ranges_64xx,
+ .ao_range_code = ao_range_code_64xx,
+ .ai_fifo = &ai_fifo_64xx,
+@@ -725,6 +768,7 @@ static const struct pcidas64_board pcidas64_boards[] = {
+ .ao_bits = 16,
+ .layout = LAYOUT_60XX,
+ .ai_range_table = &ai_ranges_60xx,
++ .ai_range_code = ai_range_code_60xx,
+ .ao_range_table = &range_bipolar10,
+ .ao_range_code = ao_range_code_60xx,
+ .ai_fifo = &ai_fifo_60xx,
+@@ -740,6 +784,7 @@ static const struct pcidas64_board pcidas64_boards[] = {
+ .ao_scan_speed = 100000,
+ .layout = LAYOUT_60XX,
+ .ai_range_table = &ai_ranges_60xx,
++ .ai_range_code = ai_range_code_60xx,
+ .ao_range_table = &range_bipolar10,
+ .ao_range_code = ao_range_code_60xx,
+ .ai_fifo = &ai_fifo_60xx,
+@@ -754,6 +799,7 @@ static const struct pcidas64_board pcidas64_boards[] = {
+ .ao_scan_speed = 100000,
+ .layout = LAYOUT_60XX,
+ .ai_range_table = &ai_ranges_60xx,
++ .ai_range_code = ai_range_code_60xx,
+ .ao_range_table = &range_bipolar10,
+ .ao_range_code = ao_range_code_60xx,
+ .ai_fifo = &ai_fifo_60xx,
+@@ -769,6 +815,7 @@ static const struct pcidas64_board pcidas64_boards[] = {
+ .ao_scan_speed = 100000,
+ .layout = LAYOUT_60XX,
+ .ai_range_table = &ai_ranges_60xx,
++ .ai_range_code = ai_range_code_60xx,
+ .ao_range_table = &range_bipolar10,
+ .ao_range_code = ao_range_code_60xx,
+ .ai_fifo = &ai_fifo_60xx,
+@@ -784,6 +831,7 @@ static const struct pcidas64_board pcidas64_boards[] = {
+ .ao_scan_speed = 10000,
+ .layout = LAYOUT_60XX,
+ .ai_range_table = &ai_ranges_6030,
++ .ai_range_code = ai_range_code_6030,
+ .ao_range_table = &ao_ranges_6030,
+ .ao_range_code = ao_range_code_6030,
+ .ai_fifo = &ai_fifo_60xx,
+@@ -799,6 +847,7 @@ static const struct pcidas64_board pcidas64_boards[] = {
+ .ao_scan_speed = 10000,
+ .layout = LAYOUT_60XX,
+ .ai_range_table = &ai_ranges_6030,
++ .ai_range_code = ai_range_code_6030,
+ .ao_range_table = &ao_ranges_6030,
+ .ao_range_code = ao_range_code_6030,
+ .ai_fifo = &ai_fifo_60xx,
+@@ -812,6 +861,7 @@ static const struct pcidas64_board pcidas64_boards[] = {
+ .ao_nchan = 0,
+ .layout = LAYOUT_60XX,
+ .ai_range_table = &ai_ranges_6030,
++ .ai_range_code = ai_range_code_6030,
+ .ai_fifo = &ai_fifo_60xx,
+ .has_8255 = 0,
+ },
+@@ -823,6 +873,7 @@ static const struct pcidas64_board pcidas64_boards[] = {
+ .ao_nchan = 0,
+ .layout = LAYOUT_60XX,
+ .ai_range_table = &ai_ranges_6030,
++ .ai_range_code = ai_range_code_6030,
+ .ai_fifo = &ai_fifo_60xx,
+ .has_8255 = 0,
+ },
+@@ -835,6 +886,7 @@ static const struct pcidas64_board pcidas64_boards[] = {
+ .ao_scan_speed = 0,
+ .layout = LAYOUT_60XX,
+ .ai_range_table = &ai_ranges_60xx,
++ .ai_range_code = ai_range_code_60xx,
+ .ai_fifo = &ai_fifo_60xx,
+ .has_8255 = 0,
+ },
+@@ -848,6 +900,7 @@ static const struct pcidas64_board pcidas64_boards[] = {
+ .ao_scan_speed = 100000,
+ .layout = LAYOUT_60XX,
+ .ai_range_table = &ai_ranges_60xx,
++ .ai_range_code = ai_range_code_60xx,
+ .ao_range_table = &range_bipolar10,
+ .ao_range_code = ao_range_code_60xx,
+ .ai_fifo = &ai_fifo_60xx,
+@@ -863,6 +916,7 @@ static const struct pcidas64_board pcidas64_boards[] = {
+ .ao_scan_speed = 100000,
+ .layout = LAYOUT_60XX,
+ .ai_range_table = &ai_ranges_60xx,
++ .ai_range_code = ai_range_code_60xx,
+ .ao_range_table = &range_bipolar10,
+ .ao_range_code = ao_range_code_60xx,
+ .ai_fifo = &ai_fifo_60xx,
+@@ -878,6 +932,7 @@ static const struct pcidas64_board pcidas64_boards[] = {
+ .ao_scan_speed = 1000,
+ .layout = LAYOUT_60XX,
+ .ai_range_table = &ai_ranges_6052,
++ .ai_range_code = ai_range_code_6052,
+ .ao_range_table = &ao_ranges_6030,
+ .ao_range_code = ao_range_code_6030,
+ .ai_fifo = &ai_fifo_60xx,
+@@ -893,6 +948,7 @@ static const struct pcidas64_board pcidas64_boards[] = {
+ .ao_scan_speed = 3333,
+ .layout = LAYOUT_60XX,
+ .ai_range_table = &ai_ranges_6052,
++ .ai_range_code = ai_range_code_6052,
+ .ao_range_table = &ao_ranges_6030,
+ .ao_range_code = ao_range_code_6030,
+ .ai_fifo = &ai_fifo_60xx,
+@@ -908,6 +964,7 @@ static const struct pcidas64_board pcidas64_boards[] = {
+ .ao_scan_speed = 1000,
+ .layout = LAYOUT_60XX,
+ .ai_range_table = &ai_ranges_6052,
++ .ai_range_code = ai_range_code_6052,
+ .ao_range_table = &ao_ranges_6030,
+ .ao_range_code = ao_range_code_6030,
+ .ai_fifo = &ai_fifo_60xx,
+@@ -923,6 +980,7 @@ static const struct pcidas64_board pcidas64_boards[] = {
+ .ao_scan_speed = 1000,
+ .layout = LAYOUT_60XX,
+ .ai_range_table = &ai_ranges_6052,
++ .ai_range_code = ai_range_code_6052,
+ .ao_range_table = &ao_ranges_6030,
+ .ao_range_code = ao_range_code_6030,
+ .ai_fifo = &ai_fifo_60xx,
+@@ -957,6 +1015,7 @@ static const struct pcidas64_board pcidas64_boards[] = {
+ .ao_scan_speed = 10000,
+ .layout = LAYOUT_64XX,
+ .ai_range_table = &ai_ranges_64xx,
++ .ai_range_code = ai_range_code_64xx,
+ .ai_fifo = ai_fifo_64xx,
+ .has_8255 = 1,
+ },
+@@ -968,7 +1027,8 @@ static const struct pcidas64_board pcidas64_boards[] = {
+ .ao_nchan = 0,
+ .ao_scan_speed = 10000,
+ .layout = LAYOUT_64XX,
+- .ai_range_table = &ai_ranges_64xx,
++ .ai_range_table = &ai_ranges_64_mx,
++ .ai_range_code = ai_range_code_64_mx,
+ .ai_fifo = ai_fifo_64xx,
+ .has_8255 = 1,
+ },
+@@ -980,7 +1040,8 @@ static const struct pcidas64_board pcidas64_boards[] = {
+ .ao_nchan = 0,
+ .ao_scan_speed = 10000,
+ .layout = LAYOUT_64XX,
+- .ai_range_table = &ai_ranges_64xx,
++ .ai_range_table = &ai_ranges_64_mx,
++ .ai_range_code = ai_range_code_64_mx,
+ .ai_fifo = ai_fifo_64xx,
+ .has_8255 = 1,
+ },
+@@ -992,7 +1053,8 @@ static const struct pcidas64_board pcidas64_boards[] = {
+ .ao_nchan = 0,
+ .ao_scan_speed = 10000,
+ .layout = LAYOUT_64XX,
+- .ai_range_table = &ai_ranges_64xx,
++ .ai_range_table = &ai_ranges_64_mx,
++ .ai_range_code = ai_range_code_64_mx,
+ .ai_fifo = ai_fifo_64xx,
+ .has_8255 = 1,
+ },
+@@ -1004,7 +1066,8 @@ static const struct pcidas64_board pcidas64_boards[] = {
+ .ao_nchan = 2,
+ .ao_scan_speed = 10000,
+ .layout = LAYOUT_64XX,
+- .ai_range_table = &ai_ranges_64xx,
++ .ai_range_table = &ai_ranges_64_mx,
++ .ai_range_code = ai_range_code_64_mx,
+ .ai_fifo = ai_fifo_64xx,
+ .has_8255 = 1,
+ },
+@@ -1016,7 +1079,8 @@ static const struct pcidas64_board pcidas64_boards[] = {
+ .ao_nchan = 2,
+ .ao_scan_speed = 10000,
+ .layout = LAYOUT_64XX,
+- .ai_range_table = &ai_ranges_64xx,
++ .ai_range_table = &ai_ranges_64_mx,
++ .ai_range_code = ai_range_code_64_mx,
+ .ai_fifo = ai_fifo_64xx,
+ .has_8255 = 1,
+ },
+@@ -1028,7 +1092,8 @@ static const struct pcidas64_board pcidas64_boards[] = {
+ .ao_nchan = 2,
+ .ao_scan_speed = 10000,
+ .layout = LAYOUT_64XX,
+- .ai_range_table = &ai_ranges_64xx,
++ .ai_range_table = &ai_ranges_64_mx,
++ .ai_range_code = ai_range_code_64_mx,
+ .ai_fifo = ai_fifo_64xx,
+ .has_8255 = 1,
+ },
+@@ -1122,45 +1187,8 @@ static unsigned int ai_range_bits_6xxx(const struct comedi_device *dev,
+ unsigned int range_index)
+ {
+ const struct pcidas64_board *thisboard = dev->board_ptr;
+- const struct comedi_krange *range =
+- &thisboard->ai_range_table->range[range_index];
+- unsigned int bits = 0;
+
+- switch (range->max) {
+- case 10000000:
+- bits = 0x000;
+- break;
+- case 5000000:
+- bits = 0x100;
+- break;
+- case 2000000:
+- case 2500000:
+- bits = 0x200;
+- break;
+- case 1000000:
+- case 1250000:
+- bits = 0x300;
+- break;
+- case 500000:
+- bits = 0x400;
+- break;
+- case 200000:
+- case 250000:
+- bits = 0x500;
+- break;
+- case 100000:
+- bits = 0x600;
+- break;
+- case 50000:
+- bits = 0x700;
+- break;
+- default:
+- dev_err(dev->class_dev, "bug! in %s\n", __func__);
+- break;
+- }
+- if (range->min == 0)
+- bits += 0x900;
+- return bits;
++ return thisboard->ai_range_code[range_index] << 8;
+ }
+
+ static unsigned int hw_revision(const struct comedi_device *dev,
+diff --git a/drivers/staging/iio/adc/mxs-lradc.c b/drivers/staging/iio/adc/mxs-lradc.c
+index 2a29b9baec0d..ffd42071a12e 100644
+--- a/drivers/staging/iio/adc/mxs-lradc.c
++++ b/drivers/staging/iio/adc/mxs-lradc.c
+@@ -214,11 +214,17 @@ struct mxs_lradc {
+ unsigned long is_divided;
+
+ /*
+- * Touchscreen LRADC channels receives a private slot in the CTRL4
+- * register, the slot #7. Therefore only 7 slots instead of 8 in the
+- * CTRL4 register can be mapped to LRADC channels when using the
+- * touchscreen.
+- *
++ * When the touchscreen is enabled, we give it two private virtual
++ * channels: #6 and #7. This means that only 6 virtual channels (instead
++ * of 8) will be available for buffered capture.
++ */
++#define TOUCHSCREEN_VCHANNEL1 7
++#define TOUCHSCREEN_VCHANNEL2 6
++#define BUFFER_VCHANS_LIMITED 0x3f
++#define BUFFER_VCHANS_ALL 0xff
++ u8 buffer_vchans;
++
++ /*
+ * Furthermore, certain LRADC channels are shared between touchscreen
+ * and/or touch-buttons and generic LRADC block. Therefore when using
+ * either of these, these channels are not available for the regular
+@@ -342,6 +348,9 @@ struct mxs_lradc {
+ #define LRADC_CTRL4 0x140
+ #define LRADC_CTRL4_LRADCSELECT_MASK(n) (0xf << ((n) * 4))
+ #define LRADC_CTRL4_LRADCSELECT_OFFSET(n) ((n) * 4)
++#define LRADC_CTRL4_LRADCSELECT(n, x) \
++ (((x) << LRADC_CTRL4_LRADCSELECT_OFFSET(n)) & \
++ LRADC_CTRL4_LRADCSELECT_MASK(n))
+
+ #define LRADC_RESOLUTION 12
+ #define LRADC_SINGLE_SAMPLE_MASK ((1 << LRADC_RESOLUTION) - 1)
+@@ -416,6 +425,14 @@ static bool mxs_lradc_check_touch_event(struct mxs_lradc *lradc)
+ LRADC_STATUS_TOUCH_DETECT_RAW);
+ }
+
++static void mxs_lradc_map_channel(struct mxs_lradc *lradc, unsigned vch,
++ unsigned ch)
++{
++ mxs_lradc_reg_clear(lradc, LRADC_CTRL4_LRADCSELECT_MASK(vch),
++ LRADC_CTRL4);
++ mxs_lradc_reg_set(lradc, LRADC_CTRL4_LRADCSELECT(vch, ch), LRADC_CTRL4);
++}
++
+ static void mxs_lradc_setup_ts_channel(struct mxs_lradc *lradc, unsigned ch)
+ {
+ /*
+@@ -443,12 +460,8 @@ static void mxs_lradc_setup_ts_channel(struct mxs_lradc *lradc, unsigned ch)
+ LRADC_DELAY_DELAY(lradc->over_sample_delay - 1),
+ LRADC_DELAY(3));
+
+- mxs_lradc_reg_clear(lradc, LRADC_CTRL1_LRADC_IRQ(2) |
+- LRADC_CTRL1_LRADC_IRQ(3) | LRADC_CTRL1_LRADC_IRQ(4) |
+- LRADC_CTRL1_LRADC_IRQ(5), LRADC_CTRL1);
++ mxs_lradc_reg_clear(lradc, LRADC_CTRL1_LRADC_IRQ(ch), LRADC_CTRL1);
+
+- /* wake us again, when the complete conversion is done */
+- mxs_lradc_reg_set(lradc, LRADC_CTRL1_LRADC_IRQ_EN(ch), LRADC_CTRL1);
+ /*
+ * after changing the touchscreen plates setting
+ * the signals need some initial time to settle. Start the
+@@ -501,12 +514,8 @@ static void mxs_lradc_setup_ts_pressure(struct mxs_lradc *lradc, unsigned ch1,
+ LRADC_DELAY_DELAY(lradc->over_sample_delay - 1),
+ LRADC_DELAY(3));
+
+- mxs_lradc_reg_clear(lradc, LRADC_CTRL1_LRADC_IRQ(2) |
+- LRADC_CTRL1_LRADC_IRQ(3) | LRADC_CTRL1_LRADC_IRQ(4) |
+- LRADC_CTRL1_LRADC_IRQ(5), LRADC_CTRL1);
++ mxs_lradc_reg_clear(lradc, LRADC_CTRL1_LRADC_IRQ(ch2), LRADC_CTRL1);
+
+- /* wake us again, when the conversions are done */
+- mxs_lradc_reg_set(lradc, LRADC_CTRL1_LRADC_IRQ_EN(ch2), LRADC_CTRL1);
+ /*
+ * after changing the touchscreen plates setting
+ * the signals need some initial time to settle. Start the
+@@ -571,36 +580,6 @@ static unsigned mxs_lradc_read_ts_pressure(struct mxs_lradc *lradc,
+ #define TS_CH_XM 4
+ #define TS_CH_YM 5
+
+-static int mxs_lradc_read_ts_channel(struct mxs_lradc *lradc)
+-{
+- u32 reg;
+- int val;
+-
+- reg = readl(lradc->base + LRADC_CTRL1);
+-
+- /* only channels 3 to 5 are of interest here */
+- if (reg & LRADC_CTRL1_LRADC_IRQ(TS_CH_YP)) {
+- mxs_lradc_reg_clear(lradc, LRADC_CTRL1_LRADC_IRQ_EN(TS_CH_YP) |
+- LRADC_CTRL1_LRADC_IRQ(TS_CH_YP), LRADC_CTRL1);
+- val = mxs_lradc_read_raw_channel(lradc, TS_CH_YP);
+- } else if (reg & LRADC_CTRL1_LRADC_IRQ(TS_CH_XM)) {
+- mxs_lradc_reg_clear(lradc, LRADC_CTRL1_LRADC_IRQ_EN(TS_CH_XM) |
+- LRADC_CTRL1_LRADC_IRQ(TS_CH_XM), LRADC_CTRL1);
+- val = mxs_lradc_read_raw_channel(lradc, TS_CH_XM);
+- } else if (reg & LRADC_CTRL1_LRADC_IRQ(TS_CH_YM)) {
+- mxs_lradc_reg_clear(lradc, LRADC_CTRL1_LRADC_IRQ_EN(TS_CH_YM) |
+- LRADC_CTRL1_LRADC_IRQ(TS_CH_YM), LRADC_CTRL1);
+- val = mxs_lradc_read_raw_channel(lradc, TS_CH_YM);
+- } else {
+- return -EIO;
+- }
+-
+- mxs_lradc_reg_wrt(lradc, 0, LRADC_DELAY(2));
+- mxs_lradc_reg_wrt(lradc, 0, LRADC_DELAY(3));
+-
+- return val;
+-}
+-
+ /*
+ * YP(open)--+-------------+
+ * | |--+
+@@ -644,7 +623,8 @@ static void mxs_lradc_prepare_x_pos(struct mxs_lradc *lradc)
+ mxs_lradc_reg_set(lradc, mxs_lradc_drive_x_plate(lradc), LRADC_CTRL0);
+
+ lradc->cur_plate = LRADC_SAMPLE_X;
+- mxs_lradc_setup_ts_channel(lradc, TS_CH_YP);
++ mxs_lradc_map_channel(lradc, TOUCHSCREEN_VCHANNEL1, TS_CH_YP);
++ mxs_lradc_setup_ts_channel(lradc, TOUCHSCREEN_VCHANNEL1);
+ }
+
+ /*
+@@ -665,7 +645,8 @@ static void mxs_lradc_prepare_y_pos(struct mxs_lradc *lradc)
+ mxs_lradc_reg_set(lradc, mxs_lradc_drive_y_plate(lradc), LRADC_CTRL0);
+
+ lradc->cur_plate = LRADC_SAMPLE_Y;
+- mxs_lradc_setup_ts_channel(lradc, TS_CH_XM);
++ mxs_lradc_map_channel(lradc, TOUCHSCREEN_VCHANNEL1, TS_CH_XM);
++ mxs_lradc_setup_ts_channel(lradc, TOUCHSCREEN_VCHANNEL1);
+ }
+
+ /*
+@@ -686,7 +667,10 @@ static void mxs_lradc_prepare_pressure(struct mxs_lradc *lradc)
+ mxs_lradc_reg_set(lradc, mxs_lradc_drive_pressure(lradc), LRADC_CTRL0);
+
+ lradc->cur_plate = LRADC_SAMPLE_PRESSURE;
+- mxs_lradc_setup_ts_pressure(lradc, TS_CH_XP, TS_CH_YM);
++ mxs_lradc_map_channel(lradc, TOUCHSCREEN_VCHANNEL1, TS_CH_YM);
++ mxs_lradc_map_channel(lradc, TOUCHSCREEN_VCHANNEL2, TS_CH_XP);
++ mxs_lradc_setup_ts_pressure(lradc, TOUCHSCREEN_VCHANNEL2,
++ TOUCHSCREEN_VCHANNEL1);
+ }
+
+ static void mxs_lradc_enable_touch_detection(struct mxs_lradc *lradc)
+@@ -699,6 +683,19 @@ static void mxs_lradc_enable_touch_detection(struct mxs_lradc *lradc)
+ mxs_lradc_reg_set(lradc, LRADC_CTRL1_TOUCH_DETECT_IRQ_EN, LRADC_CTRL1);
+ }
+
++static void mxs_lradc_start_touch_event(struct mxs_lradc *lradc)
++{
++ mxs_lradc_reg_clear(lradc, LRADC_CTRL1_TOUCH_DETECT_IRQ_EN,
++ LRADC_CTRL1);
++ mxs_lradc_reg_set(lradc,
++ LRADC_CTRL1_LRADC_IRQ_EN(TOUCHSCREEN_VCHANNEL1), LRADC_CTRL1);
++ /*
++ * start with the Y-pos, because it uses nearly the same plate
++ * settings like the touch detection
++ */
++ mxs_lradc_prepare_y_pos(lradc);
++}
++
+ static void mxs_lradc_report_ts_event(struct mxs_lradc *lradc)
+ {
+ input_report_abs(lradc->ts_input, ABS_X, lradc->ts_x_pos);
+@@ -716,10 +713,12 @@ static void mxs_lradc_complete_touch_event(struct mxs_lradc *lradc)
+ * start a dummy conversion to burn time to settle the signals
+ * note: we are not interested in the conversion's value
+ */
+- mxs_lradc_reg_wrt(lradc, 0, LRADC_CH(5));
+- mxs_lradc_reg_clear(lradc, LRADC_CTRL1_LRADC_IRQ(5), LRADC_CTRL1);
+- mxs_lradc_reg_set(lradc, LRADC_CTRL1_LRADC_IRQ_EN(5), LRADC_CTRL1);
+- mxs_lradc_reg_wrt(lradc, LRADC_DELAY_TRIGGER(1 << 5) |
++ mxs_lradc_reg_wrt(lradc, 0, LRADC_CH(TOUCHSCREEN_VCHANNEL1));
++ mxs_lradc_reg_clear(lradc,
++ LRADC_CTRL1_LRADC_IRQ(TOUCHSCREEN_VCHANNEL1) |
++ LRADC_CTRL1_LRADC_IRQ(TOUCHSCREEN_VCHANNEL2), LRADC_CTRL1);
++ mxs_lradc_reg_wrt(lradc,
++ LRADC_DELAY_TRIGGER(1 << TOUCHSCREEN_VCHANNEL1) |
+ LRADC_DELAY_KICK | LRADC_DELAY_DELAY(10), /* waste 5 ms */
+ LRADC_DELAY(2));
+ }
+@@ -751,59 +750,45 @@ static void mxs_lradc_finish_touch_event(struct mxs_lradc *lradc, bool valid)
+
+ /* if it is released, wait for the next touch via IRQ */
+ lradc->cur_plate = LRADC_TOUCH;
+- mxs_lradc_reg_clear(lradc, LRADC_CTRL1_TOUCH_DETECT_IRQ, LRADC_CTRL1);
++ mxs_lradc_reg_wrt(lradc, 0, LRADC_DELAY(2));
++ mxs_lradc_reg_wrt(lradc, 0, LRADC_DELAY(3));
++ mxs_lradc_reg_clear(lradc, LRADC_CTRL1_TOUCH_DETECT_IRQ |
++ LRADC_CTRL1_LRADC_IRQ_EN(TOUCHSCREEN_VCHANNEL1) |
++ LRADC_CTRL1_LRADC_IRQ(TOUCHSCREEN_VCHANNEL1), LRADC_CTRL1);
+ mxs_lradc_reg_set(lradc, LRADC_CTRL1_TOUCH_DETECT_IRQ_EN, LRADC_CTRL1);
+ }
+
+ /* touchscreen's state machine */
+ static void mxs_lradc_handle_touch(struct mxs_lradc *lradc)
+ {
+- int val;
+-
+ switch (lradc->cur_plate) {
+ case LRADC_TOUCH:
+- /*
+- * start with the Y-pos, because it uses nearly the same plate
+- * settings like the touch detection
+- */
+- if (mxs_lradc_check_touch_event(lradc)) {
+- mxs_lradc_reg_clear(lradc,
+- LRADC_CTRL1_TOUCH_DETECT_IRQ_EN,
+- LRADC_CTRL1);
+- mxs_lradc_prepare_y_pos(lradc);
+- }
++ if (mxs_lradc_check_touch_event(lradc))
++ mxs_lradc_start_touch_event(lradc);
+ mxs_lradc_reg_clear(lradc, LRADC_CTRL1_TOUCH_DETECT_IRQ,
+ LRADC_CTRL1);
+ return;
+
+ case LRADC_SAMPLE_Y:
+- val = mxs_lradc_read_ts_channel(lradc);
+- if (val < 0) {
+- mxs_lradc_enable_touch_detection(lradc); /* re-start */
+- return;
+- }
+- lradc->ts_y_pos = val;
++ lradc->ts_y_pos = mxs_lradc_read_raw_channel(lradc,
++ TOUCHSCREEN_VCHANNEL1);
+ mxs_lradc_prepare_x_pos(lradc);
+ return;
+
+ case LRADC_SAMPLE_X:
+- val = mxs_lradc_read_ts_channel(lradc);
+- if (val < 0) {
+- mxs_lradc_enable_touch_detection(lradc); /* re-start */
+- return;
+- }
+- lradc->ts_x_pos = val;
++ lradc->ts_x_pos = mxs_lradc_read_raw_channel(lradc,
++ TOUCHSCREEN_VCHANNEL1);
+ mxs_lradc_prepare_pressure(lradc);
+ return;
+
+ case LRADC_SAMPLE_PRESSURE:
+- lradc->ts_pressure =
+- mxs_lradc_read_ts_pressure(lradc, TS_CH_XP, TS_CH_YM);
++ lradc->ts_pressure = mxs_lradc_read_ts_pressure(lradc,
++ TOUCHSCREEN_VCHANNEL2,
++ TOUCHSCREEN_VCHANNEL1);
+ mxs_lradc_complete_touch_event(lradc);
+ return;
+
+ case LRADC_SAMPLE_VALID:
+- val = mxs_lradc_read_ts_channel(lradc); /* ignore the value */
+ mxs_lradc_finish_touch_event(lradc, 1);
+ break;
+ }
+@@ -835,9 +820,9 @@ static int mxs_lradc_read_single(struct iio_dev *iio_dev, int chan, int *val)
+ * used if doing raw sampling.
+ */
+ if (lradc->soc == IMX28_LRADC)
+- mxs_lradc_reg_clear(lradc, LRADC_CTRL1_MX28_LRADC_IRQ_EN_MASK,
++ mxs_lradc_reg_clear(lradc, LRADC_CTRL1_LRADC_IRQ_EN(0),
+ LRADC_CTRL1);
+- mxs_lradc_reg_clear(lradc, 0xff, LRADC_CTRL0);
++ mxs_lradc_reg_clear(lradc, 0x1, LRADC_CTRL0);
+
+ /* Enable / disable the divider per requirement */
+ if (test_bit(chan, &lradc->is_divided))
+@@ -1081,9 +1066,8 @@ static void mxs_lradc_disable_ts(struct mxs_lradc *lradc)
+ {
+ /* stop all interrupts from firing */
+ mxs_lradc_reg_clear(lradc, LRADC_CTRL1_TOUCH_DETECT_IRQ_EN |
+- LRADC_CTRL1_LRADC_IRQ_EN(2) | LRADC_CTRL1_LRADC_IRQ_EN(3) |
+- LRADC_CTRL1_LRADC_IRQ_EN(4) | LRADC_CTRL1_LRADC_IRQ_EN(5),
+- LRADC_CTRL1);
++ LRADC_CTRL1_LRADC_IRQ_EN(TOUCHSCREEN_VCHANNEL1) |
++ LRADC_CTRL1_LRADC_IRQ_EN(TOUCHSCREEN_VCHANNEL2), LRADC_CTRL1);
+
+ /* Power-down touchscreen touch-detect circuitry. */
+ mxs_lradc_reg_clear(lradc, mxs_lradc_plate_mask(lradc), LRADC_CTRL0);
+@@ -1149,26 +1133,31 @@ static irqreturn_t mxs_lradc_handle_irq(int irq, void *data)
+ struct iio_dev *iio = data;
+ struct mxs_lradc *lradc = iio_priv(iio);
+ unsigned long reg = readl(lradc->base + LRADC_CTRL1);
++ uint32_t clr_irq = mxs_lradc_irq_mask(lradc);
+ const uint32_t ts_irq_mask =
+ LRADC_CTRL1_TOUCH_DETECT_IRQ |
+- LRADC_CTRL1_LRADC_IRQ(2) |
+- LRADC_CTRL1_LRADC_IRQ(3) |
+- LRADC_CTRL1_LRADC_IRQ(4) |
+- LRADC_CTRL1_LRADC_IRQ(5);
++ LRADC_CTRL1_LRADC_IRQ(TOUCHSCREEN_VCHANNEL1) |
++ LRADC_CTRL1_LRADC_IRQ(TOUCHSCREEN_VCHANNEL2);
+
+ if (!(reg & mxs_lradc_irq_mask(lradc)))
+ return IRQ_NONE;
+
+- if (lradc->use_touchscreen && (reg & ts_irq_mask))
++ if (lradc->use_touchscreen && (reg & ts_irq_mask)) {
+ mxs_lradc_handle_touch(lradc);
+
+- if (iio_buffer_enabled(iio))
+- iio_trigger_poll(iio->trig);
+- else if (reg & LRADC_CTRL1_LRADC_IRQ(0))
++ /* Make sure we don't clear the next conversion's interrupt. */
++ clr_irq &= ~(LRADC_CTRL1_LRADC_IRQ(TOUCHSCREEN_VCHANNEL1) |
++ LRADC_CTRL1_LRADC_IRQ(TOUCHSCREEN_VCHANNEL2));
++ }
++
++ if (iio_buffer_enabled(iio)) {
++ if (reg & lradc->buffer_vchans)
++ iio_trigger_poll(iio->trig);
++ } else if (reg & LRADC_CTRL1_LRADC_IRQ(0)) {
+ complete(&lradc->completion);
++ }
+
+- mxs_lradc_reg_clear(lradc, reg & mxs_lradc_irq_mask(lradc),
+- LRADC_CTRL1);
++ mxs_lradc_reg_clear(lradc, reg & clr_irq, LRADC_CTRL1);
+
+ return IRQ_HANDLED;
+ }
+@@ -1280,9 +1269,10 @@ static int mxs_lradc_buffer_preenable(struct iio_dev *iio)
+ }
+
+ if (lradc->soc == IMX28_LRADC)
+- mxs_lradc_reg_clear(lradc, LRADC_CTRL1_MX28_LRADC_IRQ_EN_MASK,
+- LRADC_CTRL1);
+- mxs_lradc_reg_clear(lradc, 0xff, LRADC_CTRL0);
++ mxs_lradc_reg_clear(lradc,
++ lradc->buffer_vchans << LRADC_CTRL1_LRADC_IRQ_EN_OFFSET,
++ LRADC_CTRL1);
++ mxs_lradc_reg_clear(lradc, lradc->buffer_vchans, LRADC_CTRL0);
+
+ for_each_set_bit(chan, iio->active_scan_mask, LRADC_MAX_TOTAL_CHANS) {
+ ctrl4_set |= chan << LRADC_CTRL4_LRADCSELECT_OFFSET(ofs);
+@@ -1315,10 +1305,11 @@ static int mxs_lradc_buffer_postdisable(struct iio_dev *iio)
+ mxs_lradc_reg_clear(lradc, LRADC_DELAY_TRIGGER_LRADCS_MASK |
+ LRADC_DELAY_KICK, LRADC_DELAY(0));
+
+- mxs_lradc_reg_clear(lradc, 0xff, LRADC_CTRL0);
++ mxs_lradc_reg_clear(lradc, lradc->buffer_vchans, LRADC_CTRL0);
+ if (lradc->soc == IMX28_LRADC)
+- mxs_lradc_reg_clear(lradc, LRADC_CTRL1_MX28_LRADC_IRQ_EN_MASK,
+- LRADC_CTRL1);
++ mxs_lradc_reg_clear(lradc,
++ lradc->buffer_vchans << LRADC_CTRL1_LRADC_IRQ_EN_OFFSET,
++ LRADC_CTRL1);
+
+ kfree(lradc->buffer);
+ mutex_unlock(&lradc->lock);
+@@ -1344,7 +1335,7 @@ static bool mxs_lradc_validate_scan_mask(struct iio_dev *iio,
+ if (lradc->use_touchbutton)
+ rsvd_chans++;
+ if (lradc->use_touchscreen)
+- rsvd_chans++;
++ rsvd_chans += 2;
+
+ /* Test for attempts to map channels with special mode of operation. */
+ if (bitmap_intersects(mask, &rsvd_mask, LRADC_MAX_TOTAL_CHANS))
+@@ -1404,6 +1395,13 @@ static const struct iio_chan_spec mxs_lradc_chan_spec[] = {
+ .channel = 8,
+ .scan_type = {.sign = 'u', .realbits = 18, .storagebits = 32,},
+ },
++ /* Hidden channel to keep indexes */
++ {
++ .type = IIO_TEMP,
++ .indexed = 1,
++ .scan_index = -1,
++ .channel = 9,
++ },
+ MXS_ADC_CHAN(10, IIO_VOLTAGE), /* VDDIO */
+ MXS_ADC_CHAN(11, IIO_VOLTAGE), /* VTH */
+ MXS_ADC_CHAN(12, IIO_VOLTAGE), /* VDDA */
+@@ -1556,6 +1554,11 @@ static int mxs_lradc_probe(struct platform_device *pdev)
+
+ touch_ret = mxs_lradc_probe_touchscreen(lradc, node);
+
++ if (touch_ret == 0)
++ lradc->buffer_vchans = BUFFER_VCHANS_LIMITED;
++ else
++ lradc->buffer_vchans = BUFFER_VCHANS_ALL;
++
+ /* Grab all IRQ sources */
+ for (i = 0; i < of_cfg->irq_count; i++) {
+ lradc->irq[i] = platform_get_irq(pdev, i);
+diff --git a/drivers/target/target_core_pr.c b/drivers/target/target_core_pr.c
+index 9f93b8234095..45837a4e950d 100644
+--- a/drivers/target/target_core_pr.c
++++ b/drivers/target/target_core_pr.c
+@@ -1857,8 +1857,8 @@ static int core_scsi3_update_aptpl_buf(
+ }
+
+ if ((len + strlen(tmp) >= pr_aptpl_buf_len)) {
+- pr_err("Unable to update renaming"
+- " APTPL metadata\n");
++ pr_err("Unable to update renaming APTPL metadata,"
++ " reallocating larger buffer\n");
+ ret = -EMSGSIZE;
+ goto out;
+ }
+@@ -1875,8 +1875,8 @@ static int core_scsi3_update_aptpl_buf(
+ lun->lun_sep->sep_rtpi, lun->unpacked_lun, reg_count);
+
+ if ((len + strlen(tmp) >= pr_aptpl_buf_len)) {
+- pr_err("Unable to update renaming"
+- " APTPL metadata\n");
++ pr_err("Unable to update renaming APTPL metadata,"
++ " reallocating larger buffer\n");
+ ret = -EMSGSIZE;
+ goto out;
+ }
+@@ -1939,7 +1939,7 @@ static int __core_scsi3_write_aptpl_to_file(
+ static sense_reason_t core_scsi3_update_and_write_aptpl(struct se_device *dev, bool aptpl)
+ {
+ unsigned char *buf;
+- int rc;
++ int rc, len = PR_APTPL_BUF_LEN;
+
+ if (!aptpl) {
+ char *null_buf = "No Registrations or Reservations\n";
+@@ -1953,25 +1953,26 @@ static sense_reason_t core_scsi3_update_and_write_aptpl(struct se_device *dev, b
+
+ return 0;
+ }
+-
+- buf = kzalloc(PR_APTPL_BUF_LEN, GFP_KERNEL);
++retry:
++ buf = vzalloc(len);
+ if (!buf)
+ return TCM_OUT_OF_RESOURCES;
+
+- rc = core_scsi3_update_aptpl_buf(dev, buf, PR_APTPL_BUF_LEN);
++ rc = core_scsi3_update_aptpl_buf(dev, buf, len);
+ if (rc < 0) {
+- kfree(buf);
+- return TCM_OUT_OF_RESOURCES;
++ vfree(buf);
++ len *= 2;
++ goto retry;
+ }
+
+ rc = __core_scsi3_write_aptpl_to_file(dev, buf);
+ if (rc != 0) {
+ pr_err("SPC-3 PR: Could not update APTPL\n");
+- kfree(buf);
++ vfree(buf);
+ return TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
+ }
+ dev->t10_pr.pr_aptpl_active = 1;
+- kfree(buf);
++ vfree(buf);
+ pr_debug("SPC-3 PR: Set APTPL Bit Activated\n");
+ return 0;
+ }
+diff --git a/drivers/target/target_core_sbc.c b/drivers/target/target_core_sbc.c
+index 7a88af0e32d6..565c0da9d99d 100644
+--- a/drivers/target/target_core_sbc.c
++++ b/drivers/target/target_core_sbc.c
+@@ -251,6 +251,8 @@ static inline unsigned long long transport_lba_64_ext(unsigned char *cdb)
+ static sense_reason_t
+ sbc_setup_write_same(struct se_cmd *cmd, unsigned char *flags, struct sbc_ops *ops)
+ {
++ struct se_device *dev = cmd->se_dev;
++ sector_t end_lba = dev->transport->get_blocks(dev) + 1;
+ unsigned int sectors = sbc_get_write_same_sectors(cmd);
+
+ if ((flags[0] & 0x04) || (flags[0] & 0x02)) {
+@@ -264,6 +266,16 @@ sbc_setup_write_same(struct se_cmd *cmd, unsigned char *flags, struct sbc_ops *o
+ sectors, cmd->se_dev->dev_attrib.max_write_same_len);
+ return TCM_INVALID_CDB_FIELD;
+ }
++ /*
++ * Sanity check for LBA wrap and request past end of device.
++ */
++ if (((cmd->t_task_lba + sectors) < cmd->t_task_lba) ||
++ ((cmd->t_task_lba + sectors) > end_lba)) {
++ pr_err("WRITE_SAME exceeds last lba %llu (lba %llu, sectors %u)\n",
++ (unsigned long long)end_lba, cmd->t_task_lba, sectors);
++ return TCM_ADDRESS_OUT_OF_RANGE;
++ }
++
+ /* We always have ANC_SUP == 0 so setting ANCHOR is always an error */
+ if (flags[0] & 0x10) {
+ pr_warn("WRITE SAME with ANCHOR not supported\n");
+@@ -955,7 +967,8 @@ sbc_parse_cdb(struct se_cmd *cmd, struct sbc_ops *ops)
+ unsigned long long end_lba;
+ check_lba:
+ end_lba = dev->transport->get_blocks(dev) + 1;
+- if (cmd->t_task_lba + sectors > end_lba) {
++ if (((cmd->t_task_lba + sectors) < cmd->t_task_lba) ||
++ ((cmd->t_task_lba + sectors) > end_lba)) {
+ pr_err("cmd exceeds last lba %llu "
+ "(lba %llu, sectors %u)\n",
+ end_lba, cmd->t_task_lba, sectors);
+diff --git a/drivers/tty/serial/8250/8250_core.c b/drivers/tty/serial/8250/8250_core.c
+index ca5cfdc1459a..e5c31eadb0ac 100644
+--- a/drivers/tty/serial/8250/8250_core.c
++++ b/drivers/tty/serial/8250/8250_core.c
+@@ -2088,8 +2088,8 @@ int serial8250_do_startup(struct uart_port *port)
+ /*
+ * Clear the interrupt registers.
+ */
+- if (serial_port_in(port, UART_LSR) & UART_LSR_DR)
+- serial_port_in(port, UART_RX);
++ serial_port_in(port, UART_LSR);
++ serial_port_in(port, UART_RX);
+ serial_port_in(port, UART_IIR);
+ serial_port_in(port, UART_MSR);
+
+@@ -2250,8 +2250,8 @@ dont_test_tx_en:
+ * saved flags to avoid getting false values from polling
+ * routines or the previous session.
+ */
+- if (serial_port_in(port, UART_LSR) & UART_LSR_DR)
+- serial_port_in(port, UART_RX);
++ serial_port_in(port, UART_LSR);
++ serial_port_in(port, UART_RX);
+ serial_port_in(port, UART_IIR);
+ serial_port_in(port, UART_MSR);
+ up->lsr_saved_flags = 0;
+@@ -2344,8 +2344,7 @@ void serial8250_do_shutdown(struct uart_port *port)
+ * Read data port to reset things, and then unlink from
+ * the IRQ chain.
+ */
+- if (serial_port_in(port, UART_LSR) & UART_LSR_DR)
+- serial_port_in(port, UART_RX);
++ serial_port_in(port, UART_RX);
+ serial8250_rpm_put(up);
+
+ del_timer_sync(&up->timer);
+diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
+index 0508a1d8e4cd..0a0a6305c511 100644
+--- a/drivers/tty/tty_io.c
++++ b/drivers/tty/tty_io.c
+@@ -975,8 +975,8 @@ EXPORT_SYMBOL(start_tty);
+ /* We limit tty time update visibility to every 8 seconds or so. */
+ static void tty_update_time(struct timespec *time)
+ {
+- unsigned long sec = get_seconds() & ~7;
+- if ((long)(sec - time->tv_sec) > 0)
++ unsigned long sec = get_seconds();
++ if (abs(sec - time->tv_sec) & ~7)
+ time->tv_sec = sec;
+ }
+
+diff --git a/drivers/tty/tty_ioctl.c b/drivers/tty/tty_ioctl.c
+index 62380ccf70fb..e43b6e559b3d 100644
+--- a/drivers/tty/tty_ioctl.c
++++ b/drivers/tty/tty_ioctl.c
+@@ -217,11 +217,17 @@ void tty_wait_until_sent(struct tty_struct *tty, long timeout)
+ #endif
+ if (!timeout)
+ timeout = MAX_SCHEDULE_TIMEOUT;
++
+ if (wait_event_interruptible_timeout(tty->write_wait,
+- !tty_chars_in_buffer(tty), timeout) >= 0) {
+- if (tty->ops->wait_until_sent)
+- tty->ops->wait_until_sent(tty, timeout);
++ !tty_chars_in_buffer(tty), timeout) < 0) {
++ return;
+ }
++
++ if (timeout == MAX_SCHEDULE_TIMEOUT)
++ timeout = 0;
++
++ if (tty->ops->wait_until_sent)
++ tty->ops->wait_until_sent(tty, timeout);
+ }
+ EXPORT_SYMBOL(tty_wait_until_sent);
+
+diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
+index 0b59731c3021..e500243803d8 100644
+--- a/drivers/usb/core/devio.c
++++ b/drivers/usb/core/devio.c
+@@ -501,6 +501,7 @@ static void async_completed(struct urb *urb)
+ as->status = urb->status;
+ signr = as->signr;
+ if (signr) {
++ memset(&sinfo, 0, sizeof(sinfo));
+ sinfo.si_signo = as->signr;
+ sinfo.si_errno = as->status;
+ sinfo.si_code = SI_ASYNCIO;
+@@ -2371,6 +2372,7 @@ static void usbdev_remove(struct usb_device *udev)
+ wake_up_all(&ps->wait);
+ list_del_init(&ps->list);
+ if (ps->discsignr) {
++ memset(&sinfo, 0, sizeof(sinfo));
+ sinfo.si_signo = ps->discsignr;
+ sinfo.si_errno = EPIPE;
+ sinfo.si_code = SI_ASYNCIO;
+diff --git a/drivers/usb/dwc3/dwc3-omap.c b/drivers/usb/dwc3/dwc3-omap.c
+index a0aa9f3da441..3eb0f5eace79 100644
+--- a/drivers/usb/dwc3/dwc3-omap.c
++++ b/drivers/usb/dwc3/dwc3-omap.c
+@@ -205,6 +205,18 @@ static void dwc3_omap_write_irq0_set(struct dwc3_omap *omap, u32 value)
+ omap->irq0_offset, value);
+ }
+
++static void dwc3_omap_write_irqmisc_clr(struct dwc3_omap *omap, u32 value)
++{
++ dwc3_omap_writel(omap->base, USBOTGSS_IRQENABLE_CLR_MISC +
++ omap->irqmisc_offset, value);
++}
++
++static void dwc3_omap_write_irq0_clr(struct dwc3_omap *omap, u32 value)
++{
++ dwc3_omap_writel(omap->base, USBOTGSS_IRQENABLE_CLR_0 -
++ omap->irq0_offset, value);
++}
++
+ static void dwc3_omap_set_mailbox(struct dwc3_omap *omap,
+ enum omap_dwc3_vbus_id_status status)
+ {
+@@ -345,9 +357,23 @@ static void dwc3_omap_enable_irqs(struct dwc3_omap *omap)
+
+ static void dwc3_omap_disable_irqs(struct dwc3_omap *omap)
+ {
++ u32 reg;
++
+ /* disable all IRQs */
+- dwc3_omap_write_irqmisc_set(omap, 0x00);
+- dwc3_omap_write_irq0_set(omap, 0x00);
++ reg = USBOTGSS_IRQO_COREIRQ_ST;
++ dwc3_omap_write_irq0_clr(omap, reg);
++
++ reg = (USBOTGSS_IRQMISC_OEVT |
++ USBOTGSS_IRQMISC_DRVVBUS_RISE |
++ USBOTGSS_IRQMISC_CHRGVBUS_RISE |
++ USBOTGSS_IRQMISC_DISCHRGVBUS_RISE |
++ USBOTGSS_IRQMISC_IDPULLUP_RISE |
++ USBOTGSS_IRQMISC_DRVVBUS_FALL |
++ USBOTGSS_IRQMISC_CHRGVBUS_FALL |
++ USBOTGSS_IRQMISC_DISCHRGVBUS_FALL |
++ USBOTGSS_IRQMISC_IDPULLUP_FALL);
++
++ dwc3_omap_write_irqmisc_clr(omap, reg);
+ }
+
+ static u64 dwc3_omap_dma_mask = DMA_BIT_MASK(32);
+diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c
+index 34034333f7f6..28d3dd3637b3 100644
+--- a/drivers/usb/gadget/configfs.c
++++ b/drivers/usb/gadget/configfs.c
+@@ -1161,7 +1161,6 @@ static ssize_t interf_grp_compatible_id_store(struct usb_os_desc *desc,
+ if (desc->opts_mutex)
+ mutex_lock(desc->opts_mutex);
+ memcpy(desc->ext_compat_id, page, l);
+- desc->ext_compat_id[l] = '\0';
+
+ if (desc->opts_mutex)
+ mutex_unlock(desc->opts_mutex);
+@@ -1192,7 +1191,6 @@ static ssize_t interf_grp_sub_compatible_id_store(struct usb_os_desc *desc,
+ if (desc->opts_mutex)
+ mutex_lock(desc->opts_mutex);
+ memcpy(desc->ext_compat_id + 8, page, l);
+- desc->ext_compat_id[l + 8] = '\0';
+
+ if (desc->opts_mutex)
+ mutex_unlock(desc->opts_mutex);
+diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
+index 7f76c8a12f89..fd53c9ebd662 100644
+--- a/drivers/usb/host/xhci-pci.c
++++ b/drivers/usb/host/xhci-pci.c
+@@ -37,6 +37,9 @@
+
+ #define PCI_DEVICE_ID_INTEL_LYNXPOINT_XHCI 0x8c31
+ #define PCI_DEVICE_ID_INTEL_LYNXPOINT_LP_XHCI 0x9c31
++#define PCI_DEVICE_ID_INTEL_CHERRYVIEW_XHCI 0x22b5
++#define PCI_DEVICE_ID_INTEL_SUNRISEPOINT_H_XHCI 0xa12f
++#define PCI_DEVICE_ID_INTEL_SUNRISEPOINT_LP_XHCI 0x9d2f
+
+ static const char hcd_name[] = "xhci_hcd";
+
+@@ -133,6 +136,12 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
+ pdev->device == PCI_DEVICE_ID_INTEL_LYNXPOINT_LP_XHCI) {
+ xhci->quirks |= XHCI_SPURIOUS_REBOOT;
+ }
++ if (pdev->vendor == PCI_VENDOR_ID_INTEL &&
++ (pdev->device == PCI_DEVICE_ID_INTEL_SUNRISEPOINT_LP_XHCI ||
++ pdev->device == PCI_DEVICE_ID_INTEL_SUNRISEPOINT_H_XHCI ||
++ pdev->device == PCI_DEVICE_ID_INTEL_CHERRYVIEW_XHCI)) {
++ xhci->quirks |= XHCI_PME_STUCK_QUIRK;
++ }
+ if (pdev->vendor == PCI_VENDOR_ID_ETRON &&
+ pdev->device == PCI_DEVICE_ID_EJ168) {
+ xhci->quirks |= XHCI_RESET_ON_RESUME;
+@@ -159,6 +168,21 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
+ "QUIRK: Resetting on resume");
+ }
+
++/*
++ * Make sure PME works on some Intel xHCI controllers by writing 1 to clear
++ * the Internal PME flag bit in vendor specific PMCTRL register at offset 0x80a4
++ */
++static void xhci_pme_quirk(struct xhci_hcd *xhci)
++{
++ u32 val;
++ void __iomem *reg;
++
++ reg = (void __iomem *) xhci->cap_regs + 0x80a4;
++ val = readl(reg);
++ writel(val | BIT(28), reg);
++ readl(reg);
++}
++
+ /* called during probe() after chip reset completes */
+ static int xhci_pci_setup(struct usb_hcd *hcd)
+ {
+@@ -283,6 +307,9 @@ static int xhci_pci_suspend(struct usb_hcd *hcd, bool do_wakeup)
+ if (xhci->quirks & XHCI_COMP_MODE_QUIRK)
+ pdev->no_d3cold = true;
+
++ if (xhci->quirks & XHCI_PME_STUCK_QUIRK)
++ xhci_pme_quirk(xhci);
++
+ return xhci_suspend(xhci, do_wakeup);
+ }
+
+@@ -313,6 +340,9 @@ static int xhci_pci_resume(struct usb_hcd *hcd, bool hibernated)
+ if (pdev->vendor == PCI_VENDOR_ID_INTEL)
+ usb_enable_intel_xhci_ports(pdev);
+
++ if (xhci->quirks & XHCI_PME_STUCK_QUIRK)
++ xhci_pme_quirk(xhci);
++
+ retval = xhci_resume(xhci, hibernated);
+ return retval;
+ }
+diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c
+index 646300cbe5f7..22516f41c6f4 100644
+--- a/drivers/usb/host/xhci-plat.c
++++ b/drivers/usb/host/xhci-plat.c
+@@ -87,15 +87,6 @@ static int xhci_plat_probe(struct platform_device *pdev)
+ if (!res)
+ return -ENODEV;
+
+- if (of_device_is_compatible(pdev->dev.of_node,
+- "marvell,armada-375-xhci") ||
+- of_device_is_compatible(pdev->dev.of_node,
+- "marvell,armada-380-xhci")) {
+- ret = xhci_mvebu_mbus_init_quirk(pdev);
+- if (ret)
+- return ret;
+- }
+-
+ /* Initialize dma_mask and coherent_dma_mask to 32-bits */
+ ret = dma_set_coherent_mask(&pdev->dev, DMA_BIT_MASK(32));
+ if (ret)
+@@ -129,6 +120,15 @@ static int xhci_plat_probe(struct platform_device *pdev)
+ goto put_hcd;
+ }
+
++ if (of_device_is_compatible(pdev->dev.of_node,
++ "marvell,armada-375-xhci") ||
++ of_device_is_compatible(pdev->dev.of_node,
++ "marvell,armada-380-xhci")) {
++ ret = xhci_mvebu_mbus_init_quirk(pdev);
++ if (ret)
++ goto disable_clk;
++ }
++
+ ret = usb_add_hcd(hcd, irq, IRQF_SHARED);
+ if (ret)
+ goto disable_clk;
+diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
+index 06433aec81d7..338f19cc0973 100644
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -1957,7 +1957,7 @@ static int process_ctrl_td(struct xhci_hcd *xhci, struct xhci_td *td,
+ if (event_trb != ep_ring->dequeue) {
+ /* The event was for the status stage */
+ if (event_trb == td->last_trb) {
+- if (td->urb->actual_length != 0) {
++ if (td->urb_length_set) {
+ /* Don't overwrite a previously set error code
+ */
+ if ((*status == -EINPROGRESS || *status == 0) &&
+@@ -1971,7 +1971,13 @@ static int process_ctrl_td(struct xhci_hcd *xhci, struct xhci_td *td,
+ td->urb->transfer_buffer_length;
+ }
+ } else {
+- /* Maybe the event was for the data stage? */
++ /*
++ * Maybe the event was for the data stage? If so, update
++ * already the actual_length of the URB and flag it as
++ * set, so that it is not overwritten in the event for
++ * the last TRB.
++ */
++ td->urb_length_set = true;
+ td->urb->actual_length =
+ td->urb->transfer_buffer_length -
+ EVENT_TRB_LEN(le32_to_cpu(event->transfer_len));
+diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
+index d745715a1e2f..94251141adae 100644
+--- a/drivers/usb/host/xhci.h
++++ b/drivers/usb/host/xhci.h
+@@ -1,3 +1,4 @@
++
+ /*
+ * xHCI host controller driver
+ *
+@@ -88,9 +89,10 @@ struct xhci_cap_regs {
+ #define HCS_IST(p) (((p) >> 0) & 0xf)
+ /* bits 4:7, max number of Event Ring segments */
+ #define HCS_ERST_MAX(p) (((p) >> 4) & 0xf)
++/* bits 21:25 Hi 5 bits of Scratchpad buffers SW must allocate for the HW */
+ /* bit 26 Scratchpad restore - for save/restore HW state - not used yet */
+-/* bits 27:31 number of Scratchpad buffers SW must allocate for the HW */
+-#define HCS_MAX_SCRATCHPAD(p) (((p) >> 27) & 0x1f)
++/* bits 27:31 Lo 5 bits of Scratchpad buffers SW must allocate for the HW */
++#define HCS_MAX_SCRATCHPAD(p) ((((p) >> 16) & 0x3e0) | (((p) >> 27) & 0x1f))
+
+ /* HCSPARAMS3 - hcs_params3 - bitmasks */
+ /* bits 0:7, Max U1 to U0 latency for the roothub ports */
+@@ -1288,6 +1290,8 @@ struct xhci_td {
+ struct xhci_segment *start_seg;
+ union xhci_trb *first_trb;
+ union xhci_trb *last_trb;
++ /* actual_length of the URB has already been set */
++ bool urb_length_set;
+ };
+
+ /* xHCI command default timeout value */
+@@ -1560,6 +1564,7 @@ struct xhci_hcd {
+ #define XHCI_SPURIOUS_WAKEUP (1 << 18)
+ /* For controllers with a broken beyond repair streams implementation */
+ #define XHCI_BROKEN_STREAMS (1 << 19)
++#define XHCI_PME_STUCK_QUIRK (1 << 20)
+ unsigned int num_active_eps;
+ unsigned int limit_active_eps;
+ /* There are two roothubs to keep track of bus suspend info for */
+diff --git a/drivers/usb/serial/bus.c b/drivers/usb/serial/bus.c
+index 9374bd2aba20..6f91eb9ae81a 100644
+--- a/drivers/usb/serial/bus.c
++++ b/drivers/usb/serial/bus.c
+@@ -51,6 +51,7 @@ static int usb_serial_device_probe(struct device *dev)
+ {
+ struct usb_serial_driver *driver;
+ struct usb_serial_port *port;
++ struct device *tty_dev;
+ int retval = 0;
+ int minor;
+
+@@ -75,12 +76,20 @@ static int usb_serial_device_probe(struct device *dev)
+ retval = device_create_file(dev, &dev_attr_port_number);
+ if (retval) {
+ if (driver->port_remove)
+- retval = driver->port_remove(port);
++ driver->port_remove(port);
+ goto exit_with_autopm;
+ }
+
+ minor = port->minor;
+- tty_register_device(usb_serial_tty_driver, minor, dev);
++ tty_dev = tty_register_device(usb_serial_tty_driver, minor, dev);
++ if (IS_ERR(tty_dev)) {
++ retval = PTR_ERR(tty_dev);
++ device_remove_file(dev, &dev_attr_port_number);
++ if (driver->port_remove)
++ driver->port_remove(port);
++ goto exit_with_autopm;
++ }
++
+ dev_info(&port->serial->dev->dev,
+ "%s converter now attached to ttyUSB%d\n",
+ driver->description, minor);
+diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
+index f40c856ff758..84ce2d74894c 100644
+--- a/drivers/usb/serial/cp210x.c
++++ b/drivers/usb/serial/cp210x.c
+@@ -147,6 +147,8 @@ static const struct usb_device_id id_table[] = {
+ { USB_DEVICE(0x166A, 0x0305) }, /* Clipsal C-5000CT2 C-Bus Spectrum Colour Touchscreen */
+ { USB_DEVICE(0x166A, 0x0401) }, /* Clipsal L51xx C-Bus Architectural Dimmer */
+ { USB_DEVICE(0x166A, 0x0101) }, /* Clipsal 5560884 C-Bus Multi-room Audio Matrix Switcher */
++ { USB_DEVICE(0x16C0, 0x09B0) }, /* Lunatico Seletek */
++ { USB_DEVICE(0x16C0, 0x09B1) }, /* Lunatico Seletek */
+ { USB_DEVICE(0x16D6, 0x0001) }, /* Jablotron serial interface */
+ { USB_DEVICE(0x16DC, 0x0010) }, /* W-IE-NE-R Plein & Baus GmbH PL512 Power Supply */
+ { USB_DEVICE(0x16DC, 0x0011) }, /* W-IE-NE-R Plein & Baus GmbH RCM Remote Control for MARATON Power Supply */
+diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
+index 1ebb351b9e9a..3086dec0ef53 100644
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -799,6 +799,8 @@ static const struct usb_device_id id_table_combined[] = {
+ { USB_DEVICE(FTDI_VID, FTDI_ELSTER_UNICOM_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_PROPOX_JTAGCABLEII_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_PROPOX_ISPCABLEIII_PID) },
++ { USB_DEVICE(FTDI_VID, CYBER_CORTEX_AV_PID),
++ .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
+ { USB_DEVICE(OLIMEX_VID, OLIMEX_ARM_USB_OCD_PID),
+ .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
+ { USB_DEVICE(OLIMEX_VID, OLIMEX_ARM_USB_OCD_H_PID),
+@@ -978,6 +980,23 @@ static const struct usb_device_id id_table_combined[] = {
+ { USB_DEVICE_INTERFACE_NUMBER(INFINEON_VID, INFINEON_TRIBOARD_PID, 1) },
+ /* GE Healthcare devices */
+ { USB_DEVICE(GE_HEALTHCARE_VID, GE_HEALTHCARE_NEMO_TRACKER_PID) },
++ /* Active Research (Actisense) devices */
++ { USB_DEVICE(FTDI_VID, ACTISENSE_NDC_PID) },
++ { USB_DEVICE(FTDI_VID, ACTISENSE_USG_PID) },
++ { USB_DEVICE(FTDI_VID, ACTISENSE_NGT_PID) },
++ { USB_DEVICE(FTDI_VID, ACTISENSE_NGW_PID) },
++ { USB_DEVICE(FTDI_VID, ACTISENSE_D9AC_PID) },
++ { USB_DEVICE(FTDI_VID, ACTISENSE_D9AD_PID) },
++ { USB_DEVICE(FTDI_VID, ACTISENSE_D9AE_PID) },
++ { USB_DEVICE(FTDI_VID, ACTISENSE_D9AF_PID) },
++ { USB_DEVICE(FTDI_VID, CHETCO_SEAGAUGE_PID) },
++ { USB_DEVICE(FTDI_VID, CHETCO_SEASWITCH_PID) },
++ { USB_DEVICE(FTDI_VID, CHETCO_SEASMART_NMEA2000_PID) },
++ { USB_DEVICE(FTDI_VID, CHETCO_SEASMART_ETHERNET_PID) },
++ { USB_DEVICE(FTDI_VID, CHETCO_SEASMART_WIFI_PID) },
++ { USB_DEVICE(FTDI_VID, CHETCO_SEASMART_DISPLAY_PID) },
++ { USB_DEVICE(FTDI_VID, CHETCO_SEASMART_LITE_PID) },
++ { USB_DEVICE(FTDI_VID, CHETCO_SEASMART_ANALOG_PID) },
+ { } /* Terminating entry */
+ };
+
+diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
+index e52409c9be99..56b1b55c4751 100644
+--- a/drivers/usb/serial/ftdi_sio_ids.h
++++ b/drivers/usb/serial/ftdi_sio_ids.h
+@@ -38,6 +38,9 @@
+
+ #define FTDI_LUMEL_PD12_PID 0x6002
+
++/* Cyber Cortex AV by Fabulous Silicon (http://fabuloussilicon.com) */
++#define CYBER_CORTEX_AV_PID 0x8698
++
+ /*
+ * Marvell OpenRD Base, Client
+ * http://www.open-rd.org
+@@ -1438,3 +1441,23 @@
+ */
+ #define GE_HEALTHCARE_VID 0x1901
+ #define GE_HEALTHCARE_NEMO_TRACKER_PID 0x0015
++
++/*
++ * Active Research (Actisense) devices
++ */
++#define ACTISENSE_NDC_PID 0xD9A8 /* NDC USB Serial Adapter */
++#define ACTISENSE_USG_PID 0xD9A9 /* USG USB Serial Adapter */
++#define ACTISENSE_NGT_PID 0xD9AA /* NGT NMEA2000 Interface */
++#define ACTISENSE_NGW_PID 0xD9AB /* NGW NMEA2000 Gateway */
++#define ACTISENSE_D9AC_PID 0xD9AC /* Actisense Reserved */
++#define ACTISENSE_D9AD_PID 0xD9AD /* Actisense Reserved */
++#define ACTISENSE_D9AE_PID 0xD9AE /* Actisense Reserved */
++#define ACTISENSE_D9AF_PID 0xD9AF /* Actisense Reserved */
++#define CHETCO_SEAGAUGE_PID 0xA548 /* SeaGauge USB Adapter */
++#define CHETCO_SEASWITCH_PID 0xA549 /* SeaSwitch USB Adapter */
++#define CHETCO_SEASMART_NMEA2000_PID 0xA54A /* SeaSmart NMEA2000 Gateway */
++#define CHETCO_SEASMART_ETHERNET_PID 0xA54B /* SeaSmart Ethernet Gateway */
++#define CHETCO_SEASMART_WIFI_PID 0xA5AC /* SeaSmart Wifi Gateway */
++#define CHETCO_SEASMART_DISPLAY_PID 0xA5AD /* SeaSmart NMEA2000 Display */
++#define CHETCO_SEASMART_LITE_PID 0xA5AE /* SeaSmart Lite USB Adapter */
++#define CHETCO_SEASMART_ANALOG_PID 0xA5AF /* SeaSmart Analog Adapter */
+diff --git a/drivers/usb/serial/generic.c b/drivers/usb/serial/generic.c
+index 1bd192290b08..904ab353ecf2 100644
+--- a/drivers/usb/serial/generic.c
++++ b/drivers/usb/serial/generic.c
+@@ -258,7 +258,8 @@ void usb_serial_generic_wait_until_sent(struct tty_struct *tty, long timeout)
+ * character or at least one jiffy.
+ */
+ period = max_t(unsigned long, (10 * HZ / bps), 1);
+- period = min_t(unsigned long, period, timeout);
++ if (timeout)
++ period = min_t(unsigned long, period, timeout);
+
+ dev_dbg(&port->dev, "%s - timeout = %u ms, period = %u ms\n",
+ __func__, jiffies_to_msecs(timeout),
+@@ -268,7 +269,7 @@ void usb_serial_generic_wait_until_sent(struct tty_struct *tty, long timeout)
+ schedule_timeout_interruptible(period);
+ if (signal_pending(current))
+ break;
+- if (time_after(jiffies, expire))
++ if (timeout && time_after(jiffies, expire))
+ break;
+ }
+ }
+diff --git a/drivers/usb/serial/mxuport.c b/drivers/usb/serial/mxuport.c
+index ab1d690274ae..460a40669967 100644
+--- a/drivers/usb/serial/mxuport.c
++++ b/drivers/usb/serial/mxuport.c
+@@ -1284,7 +1284,8 @@ static int mxuport_open(struct tty_struct *tty, struct usb_serial_port *port)
+ }
+
+ /* Initial port termios */
+- mxuport_set_termios(tty, port, NULL);
++ if (tty)
++ mxuport_set_termios(tty, port, NULL);
+
+ /*
+ * TODO: use RQ_VENDOR_GET_MSR, once we know what it
+diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c
+index 475723c006f9..19842370a07f 100644
+--- a/drivers/usb/serial/usb-serial.c
++++ b/drivers/usb/serial/usb-serial.c
+@@ -940,8 +940,9 @@ static int usb_serial_probe(struct usb_interface *interface,
+ port = serial->port[i];
+ if (kfifo_alloc(&port->write_fifo, PAGE_SIZE, GFP_KERNEL))
+ goto probe_error;
+- buffer_size = max_t(int, serial->type->bulk_out_size,
+- usb_endpoint_maxp(endpoint));
++ buffer_size = serial->type->bulk_out_size;
++ if (!buffer_size)
++ buffer_size = usb_endpoint_maxp(endpoint);
+ port->bulk_out_size = buffer_size;
+ port->bulk_out_endpointAddress = endpoint->bEndpointAddress;
+
+diff --git a/drivers/usb/storage/unusual_uas.h b/drivers/usb/storage/unusual_uas.h
+index 2706a434fdbb..cd047d0cc7a6 100644
+--- a/drivers/usb/storage/unusual_uas.h
++++ b/drivers/usb/storage/unusual_uas.h
+@@ -103,6 +103,13 @@ UNUSUAL_DEV(0x0bc2, 0xab2a, 0x0000, 0x9999,
+ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+ US_FL_NO_ATA_1X),
+
++/* Reported-by: Tom Arild Naess <tanaess@gmail.com> */
++UNUSUAL_DEV(0x152d, 0x0539, 0x0000, 0x9999,
++ "JMicron",
++ "JMS539",
++ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
++ US_FL_NO_REPORT_OPCODES),
++
+ /* Reported-by: Claudio Bizzarri <claudio.bizzarri@gmail.com> */
+ UNUSUAL_DEV(0x152d, 0x0567, 0x0000, 0x9999,
+ "JMicron",
+diff --git a/fs/autofs4/dev-ioctl.c b/fs/autofs4/dev-ioctl.c
+index aaf96cb25452..ac7d921ed984 100644
+--- a/fs/autofs4/dev-ioctl.c
++++ b/fs/autofs4/dev-ioctl.c
+@@ -95,7 +95,7 @@ static int check_dev_ioctl_version(int cmd, struct autofs_dev_ioctl *param)
+ */
+ static struct autofs_dev_ioctl *copy_dev_ioctl(struct autofs_dev_ioctl __user *in)
+ {
+- struct autofs_dev_ioctl tmp;
++ struct autofs_dev_ioctl tmp, *res;
+
+ if (copy_from_user(&tmp, in, sizeof(tmp)))
+ return ERR_PTR(-EFAULT);
+@@ -106,7 +106,11 @@ static struct autofs_dev_ioctl *copy_dev_ioctl(struct autofs_dev_ioctl __user *i
+ if (tmp.size > (PATH_MAX + sizeof(tmp)))
+ return ERR_PTR(-ENAMETOOLONG);
+
+- return memdup_user(in, tmp.size);
++ res = memdup_user(in, tmp.size);
++ if (!IS_ERR(res))
++ res->size = tmp.size;
++
++ return res;
+ }
+
+ static inline void free_dev_ioctl(struct autofs_dev_ioctl *param)
+diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c
+index a18ceabd99a8..5193c7844315 100644
+--- a/fs/btrfs/file.c
++++ b/fs/btrfs/file.c
+@@ -1803,22 +1803,10 @@ static ssize_t btrfs_file_write_iter(struct kiocb *iocb,
+ mutex_unlock(&inode->i_mutex);
+
+ /*
+- * we want to make sure fsync finds this change
+- * but we haven't joined a transaction running right now.
+- *
+- * Later on, someone is sure to update the inode and get the
+- * real transid recorded.
+- *
+- * We set last_trans now to the fs_info generation + 1,
+- * this will either be one more than the running transaction
+- * or the generation used for the next transaction if there isn't
+- * one running right now.
+- *
+ * We also have to set last_sub_trans to the current log transid,
+ * otherwise subsequent syncs to a file that's been synced in this
+ * transaction will appear to have already occured.
+ */
+- BTRFS_I(inode)->last_trans = root->fs_info->generation + 1;
+ BTRFS_I(inode)->last_sub_trans = root->log_transid;
+ if (num_written > 0) {
+ err = generic_write_sync(file, pos, num_written);
+@@ -1954,25 +1942,37 @@ int btrfs_sync_file(struct file *file, loff_t start, loff_t end, int datasync)
+ atomic_inc(&root->log_batch);
+
+ /*
+- * check the transaction that last modified this inode
+- * and see if its already been committed
+- */
+- if (!BTRFS_I(inode)->last_trans) {
+- mutex_unlock(&inode->i_mutex);
+- goto out;
+- }
+-
+- /*
+- * if the last transaction that changed this file was before
+- * the current transaction, we can bail out now without any
+- * syncing
++ * If the last transaction that changed this file was before the current
++ * transaction and we have the full sync flag set in our inode, we can
++ * bail out now without any syncing.
++ *
++ * Note that we can't bail out if the full sync flag isn't set. This is
++ * because when the full sync flag is set we start all ordered extents
++ * and wait for them to fully complete - when they complete they update
++ * the inode's last_trans field through:
++ *
++ * btrfs_finish_ordered_io() ->
++ * btrfs_update_inode_fallback() ->
++ * btrfs_update_inode() ->
++ * btrfs_set_inode_last_trans()
++ *
++ * So we are sure that last_trans is up to date and can do this check to
++ * bail out safely. For the fast path, when the full sync flag is not
++ * set in our inode, we can not do it because we start only our ordered
++ * extents and don't wait for them to complete (that is when
++ * btrfs_finish_ordered_io runs), so here at this point their last_trans
++ * value might be less than or equals to fs_info->last_trans_committed,
++ * and setting a speculative last_trans for an inode when a buffered
++ * write is made (such as fs_info->generation + 1 for example) would not
++ * be reliable since after setting the value and before fsync is called
++ * any number of transactions can start and commit (transaction kthread
++ * commits the current transaction periodically), and a transaction
++ * commit does not start nor waits for ordered extents to complete.
+ */
+ smp_mb();
+ if (btrfs_inode_in_log(inode, root->fs_info->generation) ||
+- BTRFS_I(inode)->last_trans <=
+- root->fs_info->last_trans_committed) {
+- BTRFS_I(inode)->last_trans = 0;
+-
++ (full_sync && BTRFS_I(inode)->last_trans <=
++ root->fs_info->last_trans_committed)) {
+ /*
+ * We'v had everything committed since the last time we were
+ * modified so clear this flag in case it was set for whatever
+diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
+index d23362f4464e..edaa6178b4ec 100644
+--- a/fs/btrfs/inode.c
++++ b/fs/btrfs/inode.c
+@@ -7151,7 +7151,6 @@ static int btrfs_get_blocks_direct(struct inode *inode, sector_t iblock,
+ ((BTRFS_I(inode)->flags & BTRFS_INODE_NODATACOW) &&
+ em->block_start != EXTENT_MAP_HOLE)) {
+ int type;
+- int ret;
+ u64 block_start, orig_start, orig_block_len, ram_bytes;
+
+ if (test_bit(EXTENT_FLAG_PREALLOC, &em->flags))
+diff --git a/fs/btrfs/ordered-data.c b/fs/btrfs/ordered-data.c
+index 269e21dd1506..b23d024c0234 100644
+--- a/fs/btrfs/ordered-data.c
++++ b/fs/btrfs/ordered-data.c
+@@ -442,9 +442,7 @@ void btrfs_get_logged_extents(struct inode *inode,
+ spin_lock_irq(&tree->lock);
+ for (n = rb_first(&tree->tree); n; n = rb_next(n)) {
+ ordered = rb_entry(n, struct btrfs_ordered_extent, rb_node);
+- if (!list_empty(&ordered->log_list))
+- continue;
+- if (test_bit(BTRFS_ORDERED_LOGGED, &ordered->flags))
++ if (test_and_set_bit(BTRFS_ORDERED_LOGGED, &ordered->flags))
+ continue;
+ list_add_tail(&ordered->log_list, logged_list);
+ atomic_inc(&ordered->refs);
+@@ -501,8 +499,7 @@ void btrfs_wait_logged_extents(struct btrfs_trans_handle *trans,
+ wait_event(ordered->wait, test_bit(BTRFS_ORDERED_IO_DONE,
+ &ordered->flags));
+
+- if (!test_and_set_bit(BTRFS_ORDERED_LOGGED, &ordered->flags))
+- list_add_tail(&ordered->trans_list, &trans->ordered);
++ list_add_tail(&ordered->trans_list, &trans->ordered);
+ spin_lock_irq(&log->log_extents_lock[index]);
+ }
+ spin_unlock_irq(&log->log_extents_lock[index]);
+diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
+index ee1c60454a5f..8b40b35e5e0e 100644
+--- a/fs/btrfs/tree-log.c
++++ b/fs/btrfs/tree-log.c
+@@ -1010,7 +1010,7 @@ again:
+ base = btrfs_item_ptr_offset(leaf, path->slots[0]);
+
+ while (cur_offset < item_size) {
+- extref = (struct btrfs_inode_extref *)base + cur_offset;
++ extref = (struct btrfs_inode_extref *)(base + cur_offset);
+
+ victim_name_len = btrfs_inode_extref_name_len(leaf, extref);
+
+diff --git a/fs/debugfs/inode.c b/fs/debugfs/inode.c
+index 05f2960ed7c3..6f0ce531e221 100644
+--- a/fs/debugfs/inode.c
++++ b/fs/debugfs/inode.c
+@@ -246,10 +246,19 @@ static int debugfs_show_options(struct seq_file *m, struct dentry *root)
+ return 0;
+ }
+
++static void debugfs_evict_inode(struct inode *inode)
++{
++ truncate_inode_pages_final(&inode->i_data);
++ clear_inode(inode);
++ if (S_ISLNK(inode->i_mode))
++ kfree(inode->i_private);
++}
++
+ static const struct super_operations debugfs_super_operations = {
+ .statfs = simple_statfs,
+ .remount_fs = debugfs_remount,
+ .show_options = debugfs_show_options,
++ .evict_inode = debugfs_evict_inode,
+ };
+
+ static int debug_fill_super(struct super_block *sb, void *data, int silent)
+@@ -466,23 +475,14 @@ static int __debugfs_remove(struct dentry *dentry, struct dentry *parent)
+ int ret = 0;
+
+ if (debugfs_positive(dentry)) {
+- if (dentry->d_inode) {
+- dget(dentry);
+- switch (dentry->d_inode->i_mode & S_IFMT) {
+- case S_IFDIR:
+- ret = simple_rmdir(parent->d_inode, dentry);
+- break;
+- case S_IFLNK:
+- kfree(dentry->d_inode->i_private);
+- /* fall through */
+- default:
+- simple_unlink(parent->d_inode, dentry);
+- break;
+- }
+- if (!ret)
+- d_delete(dentry);
+- dput(dentry);
+- }
++ dget(dentry);
++ if (S_ISDIR(dentry->d_inode->i_mode))
++ ret = simple_rmdir(parent->d_inode, dentry);
++ else
++ simple_unlink(parent->d_inode, dentry);
++ if (!ret)
++ d_delete(dentry);
++ dput(dentry);
+ }
+ return ret;
+ }
+diff --git a/fs/ecryptfs/file.c b/fs/ecryptfs/file.c
+index 54742f9a67a8..77a3db3791c7 100644
+--- a/fs/ecryptfs/file.c
++++ b/fs/ecryptfs/file.c
+@@ -303,9 +303,22 @@ ecryptfs_unlocked_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
+ struct file *lower_file = ecryptfs_file_to_lower(file);
+ long rc = -ENOTTY;
+
+- if (lower_file->f_op->unlocked_ioctl)
++ if (!lower_file->f_op->unlocked_ioctl)
++ return rc;
++
++ switch (cmd) {
++ case FITRIM:
++ case FS_IOC_GETFLAGS:
++ case FS_IOC_SETFLAGS:
++ case FS_IOC_GETVERSION:
++ case FS_IOC_SETVERSION:
+ rc = lower_file->f_op->unlocked_ioctl(lower_file, cmd, arg);
+- return rc;
++ fsstack_copy_attr_all(file_inode(file), file_inode(lower_file));
++
++ return rc;
++ default:
++ return rc;
++ }
+ }
+
+ #ifdef CONFIG_COMPAT
+@@ -315,9 +328,22 @@ ecryptfs_compat_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
+ struct file *lower_file = ecryptfs_file_to_lower(file);
+ long rc = -ENOIOCTLCMD;
+
+- if (lower_file->f_op->compat_ioctl)
++ if (!lower_file->f_op->compat_ioctl)
++ return rc;
++
++ switch (cmd) {
++ case FITRIM:
++ case FS_IOC32_GETFLAGS:
++ case FS_IOC32_SETFLAGS:
++ case FS_IOC32_GETVERSION:
++ case FS_IOC32_SETVERSION:
+ rc = lower_file->f_op->compat_ioctl(lower_file, cmd, arg);
+- return rc;
++ fsstack_copy_attr_all(file_inode(file), file_inode(lower_file));
++
++ return rc;
++ default:
++ return rc;
++ }
+ }
+ #endif
+
+diff --git a/fs/gfs2/acl.c b/fs/gfs2/acl.c
+index 3088e2a38e30..7b3143064af1 100644
+--- a/fs/gfs2/acl.c
++++ b/fs/gfs2/acl.c
+@@ -73,7 +73,7 @@ int gfs2_set_acl(struct inode *inode, struct posix_acl *acl, int type)
+
+ BUG_ON(name == NULL);
+
+- if (acl->a_count > GFS2_ACL_MAX_ENTRIES(GFS2_SB(inode)))
++ if (acl && acl->a_count > GFS2_ACL_MAX_ENTRIES(GFS2_SB(inode)))
+ return -E2BIG;
+
+ if (type == ACL_TYPE_ACCESS) {
+diff --git a/fs/nfs/delegation.c b/fs/nfs/delegation.c
+index 7f3f60641344..4030b558b07e 100644
+--- a/fs/nfs/delegation.c
++++ b/fs/nfs/delegation.c
+@@ -177,8 +177,8 @@ void nfs_inode_reclaim_delegation(struct inode *inode, struct rpc_cred *cred,
+ &delegation->flags);
+ NFS_I(inode)->delegation_state = delegation->type;
+ spin_unlock(&delegation->lock);
+- put_rpccred(oldcred);
+ rcu_read_unlock();
++ put_rpccred(oldcred);
+ trace_nfs4_reclaim_delegation(inode, res->delegation_type);
+ } else {
+ /* We appear to have raced with a delegation return. */
+diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c
+index 6e62155abf26..7a8d67cd823d 100644
+--- a/fs/nfs/dir.c
++++ b/fs/nfs/dir.c
+@@ -469,6 +469,8 @@ void nfs_prime_dcache(struct dentry *parent, struct nfs_entry *entry)
+ struct inode *inode;
+ int status;
+
++ if (!(entry->fattr->valid & NFS_ATTR_FATTR_FSID))
++ return;
+ if (filename.name[0] == '.') {
+ if (filename.len == 1)
+ return;
+@@ -479,6 +481,10 @@ void nfs_prime_dcache(struct dentry *parent, struct nfs_entry *entry)
+
+ dentry = d_lookup(parent, &filename);
+ if (dentry != NULL) {
++ /* Is there a mountpoint here? If so, just exit */
++ if (!nfs_fsid_equal(&NFS_SB(dentry->d_sb)->fsid,
++ &entry->fattr->fsid))
++ goto out;
+ if (nfs_same_file(dentry, entry)) {
+ nfs_set_verifier(dentry, nfs_save_change_attribute(dir));
+ status = nfs_refresh_inode(dentry->d_inode, entry->fattr);
+diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
+index d66e3ad1de48..5c9c13ee72f9 100644
+--- a/fs/nfsd/nfs4state.c
++++ b/fs/nfsd/nfs4state.c
+@@ -1650,7 +1650,7 @@ __destroy_client(struct nfs4_client *clp)
+ nfs4_put_stid(&dp->dl_stid);
+ }
+ while (!list_empty(&clp->cl_revoked)) {
+- dp = list_entry(reaplist.next, struct nfs4_delegation, dl_recall_lru);
++ dp = list_entry(clp->cl_revoked.next, struct nfs4_delegation, dl_recall_lru);
+ list_del_init(&dp->dl_recall_lru);
+ nfs4_put_stid(&dp->dl_stid);
+ }
+diff --git a/fs/nilfs2/btree.c b/fs/nilfs2/btree.c
+index b2e3ff347620..ecdbae19a766 100644
+--- a/fs/nilfs2/btree.c
++++ b/fs/nilfs2/btree.c
+@@ -31,6 +31,8 @@
+ #include "alloc.h"
+ #include "dat.h"
+
++static void __nilfs_btree_init(struct nilfs_bmap *bmap);
++
+ static struct nilfs_btree_path *nilfs_btree_alloc_path(void)
+ {
+ struct nilfs_btree_path *path;
+@@ -368,6 +370,34 @@ static int nilfs_btree_node_broken(const struct nilfs_btree_node *node,
+ return ret;
+ }
+
++/**
++ * nilfs_btree_root_broken - verify consistency of btree root node
++ * @node: btree root node to be examined
++ * @ino: inode number
++ *
++ * Return Value: If node is broken, 1 is returned. Otherwise, 0 is returned.
++ */
++static int nilfs_btree_root_broken(const struct nilfs_btree_node *node,
++ unsigned long ino)
++{
++ int level, flags, nchildren;
++ int ret = 0;
++
++ level = nilfs_btree_node_get_level(node);
++ flags = nilfs_btree_node_get_flags(node);
++ nchildren = nilfs_btree_node_get_nchildren(node);
++
++ if (unlikely(level < NILFS_BTREE_LEVEL_NODE_MIN ||
++ level > NILFS_BTREE_LEVEL_MAX ||
++ nchildren < 0 ||
++ nchildren > NILFS_BTREE_ROOT_NCHILDREN_MAX)) {
++ pr_crit("NILFS: bad btree root (inode number=%lu): level = %d, flags = 0x%x, nchildren = %d\n",
++ ino, level, flags, nchildren);
++ ret = 1;
++ }
++ return ret;
++}
++
+ int nilfs_btree_broken_node_block(struct buffer_head *bh)
+ {
+ int ret;
+@@ -1713,7 +1743,7 @@ nilfs_btree_commit_convert_and_insert(struct nilfs_bmap *btree,
+
+ /* convert and insert */
+ dat = NILFS_BMAP_USE_VBN(btree) ? nilfs_bmap_get_dat(btree) : NULL;
+- nilfs_btree_init(btree);
++ __nilfs_btree_init(btree);
+ if (nreq != NULL) {
+ nilfs_bmap_commit_alloc_ptr(btree, dreq, dat);
+ nilfs_bmap_commit_alloc_ptr(btree, nreq, dat);
+@@ -2294,12 +2324,23 @@ static const struct nilfs_bmap_operations nilfs_btree_ops_gc = {
+ .bop_gather_data = NULL,
+ };
+
+-int nilfs_btree_init(struct nilfs_bmap *bmap)
++static void __nilfs_btree_init(struct nilfs_bmap *bmap)
+ {
+ bmap->b_ops = &nilfs_btree_ops;
+ bmap->b_nchildren_per_block =
+ NILFS_BTREE_NODE_NCHILDREN_MAX(nilfs_btree_node_size(bmap));
+- return 0;
++}
++
++int nilfs_btree_init(struct nilfs_bmap *bmap)
++{
++ int ret = 0;
++
++ __nilfs_btree_init(bmap);
++
++ if (nilfs_btree_root_broken(nilfs_btree_get_root(bmap),
++ bmap->b_inode->i_ino))
++ ret = -EIO;
++ return ret;
+ }
+
+ void nilfs_btree_init_gc(struct nilfs_bmap *bmap)
+diff --git a/fs/proc/generic.c b/fs/proc/generic.c
+index 317b72641ebf..228cc4eeeb4a 100644
+--- a/fs/proc/generic.c
++++ b/fs/proc/generic.c
+@@ -19,7 +19,6 @@
+ #include <linux/mount.h>
+ #include <linux/init.h>
+ #include <linux/idr.h>
+-#include <linux/namei.h>
+ #include <linux/bitops.h>
+ #include <linux/spinlock.h>
+ #include <linux/completion.h>
+@@ -162,17 +161,6 @@ void proc_free_inum(unsigned int inum)
+ spin_unlock_irqrestore(&proc_inum_lock, flags);
+ }
+
+-static void *proc_follow_link(struct dentry *dentry, struct nameidata *nd)
+-{
+- nd_set_link(nd, __PDE_DATA(dentry->d_inode));
+- return NULL;
+-}
+-
+-static const struct inode_operations proc_link_inode_operations = {
+- .readlink = generic_readlink,
+- .follow_link = proc_follow_link,
+-};
+-
+ /*
+ * Don't create negative dentries here, return -ENOENT by hand
+ * instead.
+diff --git a/fs/proc/inode.c b/fs/proc/inode.c
+index 333080d7a671..54ed31cfb398 100644
+--- a/fs/proc/inode.c
++++ b/fs/proc/inode.c
+@@ -23,6 +23,7 @@
+ #include <linux/slab.h>
+ #include <linux/mount.h>
+ #include <linux/magic.h>
++#include <linux/namei.h>
+
+ #include <asm/uaccess.h>
+
+@@ -401,6 +402,26 @@ static const struct file_operations proc_reg_file_ops_no_compat = {
+ };
+ #endif
+
++static void *proc_follow_link(struct dentry *dentry, struct nameidata *nd)
++{
++ struct proc_dir_entry *pde = PDE(dentry->d_inode);
++ if (unlikely(!use_pde(pde)))
++ return ERR_PTR(-EINVAL);
++ nd_set_link(nd, pde->data);
++ return pde;
++}
++
++static void proc_put_link(struct dentry *dentry, struct nameidata *nd, void *p)
++{
++ unuse_pde(p);
++}
++
++const struct inode_operations proc_link_inode_operations = {
++ .readlink = generic_readlink,
++ .follow_link = proc_follow_link,
++ .put_link = proc_put_link,
++};
++
+ struct inode *proc_get_inode(struct super_block *sb, struct proc_dir_entry *de)
+ {
+ struct inode *inode = new_inode_pseudo(sb);
+diff --git a/fs/proc/internal.h b/fs/proc/internal.h
+index aa7a0ee182e1..73f8190de795 100644
+--- a/fs/proc/internal.h
++++ b/fs/proc/internal.h
+@@ -199,6 +199,7 @@ struct pde_opener {
+ int closing;
+ struct completion *c;
+ };
++extern const struct inode_operations proc_link_inode_operations;
+
+ extern const struct inode_operations proc_pid_link_inode_operations;
+
+diff --git a/include/drm/i915_pciids.h b/include/drm/i915_pciids.h
+index a70d45647898..47116c87ab10 100644
+--- a/include/drm/i915_pciids.h
++++ b/include/drm/i915_pciids.h
+@@ -214,9 +214,9 @@
+ INTEL_VGA_DEVICE((((gt) - 1) << 4) | (id), info)
+
+ #define _INTEL_BDW_M_IDS(gt, info) \
+- _INTEL_BDW_M(gt, 0x1602, info), /* ULT */ \
++ _INTEL_BDW_M(gt, 0x1602, info), /* Halo */ \
+ _INTEL_BDW_M(gt, 0x1606, info), /* ULT */ \
+- _INTEL_BDW_M(gt, 0x160B, info), /* Iris */ \
++ _INTEL_BDW_M(gt, 0x160B, info), /* ULT */ \
+ _INTEL_BDW_M(gt, 0x160E, info) /* ULX */
+
+ #define _INTEL_BDW_D_IDS(gt, info) \
+diff --git a/include/linux/usb/serial.h b/include/linux/usb/serial.h
+index 9bb547c7bce7..704a1ab8240c 100644
+--- a/include/linux/usb/serial.h
++++ b/include/linux/usb/serial.h
+@@ -190,8 +190,7 @@ static inline void usb_set_serial_data(struct usb_serial *serial, void *data)
+ * @num_ports: the number of different ports this device will have.
+ * @bulk_in_size: minimum number of bytes to allocate for bulk-in buffer
+ * (0 = end-point size)
+- * @bulk_out_size: minimum number of bytes to allocate for bulk-out buffer
+- * (0 = end-point size)
++ * @bulk_out_size: bytes to allocate for bulk-out buffer (0 = end-point size)
+ * @calc_num_ports: pointer to a function to determine how many ports this
+ * device has dynamically. It will be called after the probe()
+ * callback is called, but before attach()
+diff --git a/include/target/target_core_base.h b/include/target/target_core_base.h
+index 23c518a0340c..1fbd69cfd0b7 100644
+--- a/include/target/target_core_base.h
++++ b/include/target/target_core_base.h
+@@ -409,7 +409,7 @@ struct t10_reservation {
+ /* Activate Persistence across Target Power Loss enabled
+ * for SCSI device */
+ int pr_aptpl_active;
+-#define PR_APTPL_BUF_LEN 8192
++#define PR_APTPL_BUF_LEN 262144
+ u32 pr_generation;
+ spinlock_t registration_lock;
+ spinlock_t aptpl_reg_lock;
+diff --git a/include/trace/events/kmem.h b/include/trace/events/kmem.h
+index aece1346ceb7..4ad10baecd4d 100644
+--- a/include/trace/events/kmem.h
++++ b/include/trace/events/kmem.h
+@@ -268,11 +268,11 @@ TRACE_EVENT(mm_page_alloc_extfrag,
+
+ TP_PROTO(struct page *page,
+ int alloc_order, int fallback_order,
+- int alloc_migratetype, int fallback_migratetype, int new_migratetype),
++ int alloc_migratetype, int fallback_migratetype),
+
+ TP_ARGS(page,
+ alloc_order, fallback_order,
+- alloc_migratetype, fallback_migratetype, new_migratetype),
++ alloc_migratetype, fallback_migratetype),
+
+ TP_STRUCT__entry(
+ __field( struct page *, page )
+@@ -289,7 +289,8 @@ TRACE_EVENT(mm_page_alloc_extfrag,
+ __entry->fallback_order = fallback_order;
+ __entry->alloc_migratetype = alloc_migratetype;
+ __entry->fallback_migratetype = fallback_migratetype;
+- __entry->change_ownership = (new_migratetype == alloc_migratetype);
++ __entry->change_ownership = (alloc_migratetype ==
++ get_pageblock_migratetype(page));
+ ),
+
+ TP_printk("page=%p pfn=%lu alloc_order=%d fallback_order=%d pageblock_order=%d alloc_migratetype=%d fallback_migratetype=%d fragmenting=%d change_ownership=%d",
+diff --git a/kernel/locking/rtmutex.c b/kernel/locking/rtmutex.c
+index 7c98873a3077..41d53e515914 100644
+--- a/kernel/locking/rtmutex.c
++++ b/kernel/locking/rtmutex.c
+@@ -1193,7 +1193,8 @@ rt_mutex_slowlock(struct rt_mutex *lock, int state,
+ set_current_state(TASK_RUNNING);
+
+ if (unlikely(ret)) {
+- remove_waiter(lock, &waiter);
++ if (rt_mutex_has_waiters(lock))
++ remove_waiter(lock, &waiter);
+ rt_mutex_handle_deadlock(ret, chwalk, &waiter);
+ }
+
+diff --git a/kernel/sched/auto_group.c b/kernel/sched/auto_group.c
+index 8a2e230fb86a..eae160dd669d 100644
+--- a/kernel/sched/auto_group.c
++++ b/kernel/sched/auto_group.c
+@@ -87,8 +87,7 @@ static inline struct autogroup *autogroup_create(void)
+ * so we don't have to move tasks around upon policy change,
+ * or flail around trying to allocate bandwidth on the fly.
+ * A bandwidth exception in __sched_setscheduler() allows
+- * the policy change to proceed. Thereafter, task_group()
+- * returns &root_task_group, so zero bandwidth is required.
++ * the policy change to proceed.
+ */
+ free_rt_sched_group(tg);
+ tg->rt_se = root_task_group.rt_se;
+@@ -115,9 +114,6 @@ bool task_wants_autogroup(struct task_struct *p, struct task_group *tg)
+ if (tg != &root_task_group)
+ return false;
+
+- if (p->sched_class != &fair_sched_class)
+- return false;
+-
+ /*
+ * We can only assume the task group can't go away on us if
+ * autogroup_move_group() can see us on ->thread_group list.
+diff --git a/kernel/sched/core.c b/kernel/sched/core.c
+index efdca2f08222..9f5ed5e70eaa 100644
+--- a/kernel/sched/core.c
++++ b/kernel/sched/core.c
+@@ -490,6 +490,11 @@ static __init void init_hrtick(void)
+ */
+ void hrtick_start(struct rq *rq, u64 delay)
+ {
++ /*
++ * Don't schedule slices shorter than 10000ns, that just
++ * doesn't make sense. Rely on vruntime for fairness.
++ */
++ delay = max_t(u64, delay, 10000LL);
+ __hrtimer_start_range_ns(&rq->hrtick_timer, ns_to_ktime(delay), 0,
+ HRTIMER_MODE_REL_PINNED, 0);
+ }
+@@ -7465,6 +7470,12 @@ static inline int tg_has_rt_tasks(struct task_group *tg)
+ {
+ struct task_struct *g, *p;
+
++ /*
++ * Autogroups do not have RT tasks; see autogroup_create().
++ */
++ if (task_group_is_autogroup(tg))
++ return 0;
++
+ for_each_process_thread(g, p) {
+ if (rt_task(p) && task_group(p) == tg)
+ return 1;
+diff --git a/kernel/sysctl.c b/kernel/sysctl.c
+index 15f2511a1b7c..cd0e835ecb85 100644
+--- a/kernel/sysctl.c
++++ b/kernel/sysctl.c
+@@ -1232,7 +1232,6 @@ static struct ctl_table vm_table[] = {
+ .maxlen = sizeof(unsigned long),
+ .mode = 0644,
+ .proc_handler = hugetlb_sysctl_handler,
+- .extra1 = &zero,
+ },
+ #ifdef CONFIG_NUMA
+ {
+@@ -1241,7 +1240,6 @@ static struct ctl_table vm_table[] = {
+ .maxlen = sizeof(unsigned long),
+ .mode = 0644,
+ .proc_handler = &hugetlb_mempolicy_sysctl_handler,
+- .extra1 = &zero,
+ },
+ #endif
+ {
+@@ -1264,7 +1262,6 @@ static struct ctl_table vm_table[] = {
+ .maxlen = sizeof(unsigned long),
+ .mode = 0644,
+ .proc_handler = hugetlb_overcommit_handler,
+- .extra1 = &zero,
+ },
+ #endif
+ {
+diff --git a/mm/compaction.c b/mm/compaction.c
+index f9792ba3537c..b47f08e159d4 100644
+--- a/mm/compaction.c
++++ b/mm/compaction.c
+@@ -1027,8 +1027,10 @@ static isolate_migrate_t isolate_migratepages(struct zone *zone,
+ low_pfn = isolate_migratepages_block(cc, low_pfn, end_pfn,
+ isolate_mode);
+
+- if (!low_pfn || cc->contended)
++ if (!low_pfn || cc->contended) {
++ acct_isolated(zone, cc);
+ return ISOLATE_ABORT;
++ }
+
+ /*
+ * Either we isolated something and proceed with migration. Or
+@@ -1100,7 +1102,7 @@ static int compact_finished(struct zone *zone, struct compact_control *cc,
+ return COMPACT_PARTIAL;
+
+ /* Job done if allocation would set block type */
+- if (cc->order >= pageblock_order && area->nr_free)
++ if (order >= pageblock_order && area->nr_free)
+ return COMPACT_PARTIAL;
+ }
+
+diff --git a/mm/hugetlb.c b/mm/hugetlb.c
+index f08fec71ec5a..4cacc6a8a6c1 100644
+--- a/mm/hugetlb.c
++++ b/mm/hugetlb.c
+@@ -2653,9 +2653,10 @@ again:
+ goto unlock;
+
+ /*
+- * HWPoisoned hugepage is already unmapped and dropped reference
++ * Migrating hugepage or HWPoisoned hugepage is already
++ * unmapped and its refcount is dropped, so just clear pte here.
+ */
+- if (unlikely(is_hugetlb_entry_hwpoisoned(pte))) {
++ if (unlikely(!pte_present(pte))) {
+ huge_pte_clear(mm, address, ptep);
+ goto unlock;
+ }
+@@ -3128,6 +3129,7 @@ int hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma,
+ struct page *pagecache_page = NULL;
+ struct hstate *h = hstate_vma(vma);
+ struct address_space *mapping;
++ int need_wait_lock = 0;
+
+ address &= huge_page_mask(h);
+
+@@ -3166,6 +3168,16 @@ int hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma,
+ ret = 0;
+
+ /*
++ * entry could be a migration/hwpoison entry at this point, so this
++ * check prevents the kernel from going below assuming that we have
++ * a active hugepage in pagecache. This goto expects the 2nd page fault,
++ * and is_hugetlb_entry_(migration|hwpoisoned) check will properly
++ * handle it.
++ */
++ if (!pte_present(entry))
++ goto out_mutex;
++
++ /*
+ * If we are going to COW the mapping later, we examine the pending
+ * reservations for this page now. This will ensure that any
+ * allocations necessary to record that reservation occur outside the
+@@ -3184,30 +3196,31 @@ int hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma,
+ vma, address);
+ }
+
++ ptl = huge_pte_lock(h, mm, ptep);
++
++ /* Check for a racing update before calling hugetlb_cow */
++ if (unlikely(!pte_same(entry, huge_ptep_get(ptep))))
++ goto out_ptl;
++
+ /*
+ * hugetlb_cow() requires page locks of pte_page(entry) and
+ * pagecache_page, so here we need take the former one
+ * when page != pagecache_page or !pagecache_page.
+- * Note that locking order is always pagecache_page -> page,
+- * so no worry about deadlock.
+ */
+ page = pte_page(entry);
+- get_page(page);
+ if (page != pagecache_page)
+- lock_page(page);
+-
+- ptl = huge_pte_lockptr(h, mm, ptep);
+- spin_lock(ptl);
+- /* Check for a racing update before calling hugetlb_cow */
+- if (unlikely(!pte_same(entry, huge_ptep_get(ptep))))
+- goto out_ptl;
++ if (!trylock_page(page)) {
++ need_wait_lock = 1;
++ goto out_ptl;
++ }
+
++ get_page(page);
+
+ if (flags & FAULT_FLAG_WRITE) {
+ if (!huge_pte_write(entry)) {
+ ret = hugetlb_cow(mm, vma, address, ptep, entry,
+ pagecache_page, ptl);
+- goto out_ptl;
++ goto out_put_page;
+ }
+ entry = huge_pte_mkdirty(entry);
+ }
+@@ -3215,7 +3228,10 @@ int hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma,
+ if (huge_ptep_set_access_flags(vma, address, ptep, entry,
+ flags & FAULT_FLAG_WRITE))
+ update_mmu_cache(vma, address, ptep);
+-
++out_put_page:
++ if (page != pagecache_page)
++ unlock_page(page);
++ put_page(page);
+ out_ptl:
+ spin_unlock(ptl);
+
+@@ -3223,12 +3239,17 @@ out_ptl:
+ unlock_page(pagecache_page);
+ put_page(pagecache_page);
+ }
+- if (page != pagecache_page)
+- unlock_page(page);
+- put_page(page);
+-
+ out_mutex:
+ mutex_unlock(&htlb_fault_mutex_table[hash]);
++ /*
++ * Generally it's safe to hold refcount during waiting page lock. But
++ * here we just wait to defer the next page fault to avoid busy loop and
++ * the page is not used after unlocked before returning from the current
++ * page fault. So we are safe from accessing freed page, even if we wait
++ * here without taking refcount.
++ */
++ if (need_wait_lock)
++ wait_on_page_locked(page);
+ return ret;
+ }
+
+@@ -3358,7 +3379,26 @@ unsigned long hugetlb_change_protection(struct vm_area_struct *vma,
+ spin_unlock(ptl);
+ continue;
+ }
+- if (!huge_pte_none(huge_ptep_get(ptep))) {
++ pte = huge_ptep_get(ptep);
++ if (unlikely(is_hugetlb_entry_hwpoisoned(pte))) {
++ spin_unlock(ptl);
++ continue;
++ }
++ if (unlikely(is_hugetlb_entry_migration(pte))) {
++ swp_entry_t entry = pte_to_swp_entry(pte);
++
++ if (is_write_migration_entry(entry)) {
++ pte_t newpte;
++
++ make_migration_entry_read(&entry);
++ newpte = swp_entry_to_pte(entry);
++ set_huge_pte_at(mm, address, ptep, newpte);
++ pages++;
++ }
++ spin_unlock(ptl);
++ continue;
++ }
++ if (!huge_pte_none(pte)) {
+ pte = huge_ptep_get_and_clear(mm, address, ptep);
+ pte = pte_mkhuge(huge_pte_modify(pte, newprot));
+ pte = arch_make_huge_pte(pte, vma, NULL, 0);
+diff --git a/mm/memory.c b/mm/memory.c
+index d442584fd281..4ffa7b571fb8 100644
+--- a/mm/memory.c
++++ b/mm/memory.c
+@@ -3558,7 +3558,7 @@ int generic_access_phys(struct vm_area_struct *vma, unsigned long addr,
+ if (follow_phys(vma, addr, write, &prot, &phys_addr))
+ return -EINVAL;
+
+- maddr = ioremap_prot(phys_addr, PAGE_SIZE, prot);
++ maddr = ioremap_prot(phys_addr, PAGE_ALIGN(len + offset), prot);
+ if (write)
+ memcpy_toio(maddr + offset, buf, len);
+ else
+diff --git a/mm/mmap.c b/mm/mmap.c
+index 1620adbbd77f..3c83bec2274c 100644
+--- a/mm/mmap.c
++++ b/mm/mmap.c
+@@ -152,7 +152,7 @@ EXPORT_SYMBOL_GPL(vm_memory_committed);
+ */
+ int __vm_enough_memory(struct mm_struct *mm, long pages, int cap_sys_admin)
+ {
+- unsigned long free, allowed, reserve;
++ long free, allowed, reserve;
+
+ VM_WARN_ONCE(percpu_counter_read(&vm_committed_as) <
+ -(s64)vm_committed_as_batch * num_online_cpus(),
+@@ -220,7 +220,7 @@ int __vm_enough_memory(struct mm_struct *mm, long pages, int cap_sys_admin)
+ */
+ if (mm) {
+ reserve = sysctl_user_reserve_kbytes >> (PAGE_SHIFT - 10);
+- allowed -= min(mm->total_vm / 32, reserve);
++ allowed -= min_t(long, mm->total_vm / 32, reserve);
+ }
+
+ if (percpu_counter_read_positive(&vm_committed_as) < allowed)
+diff --git a/mm/nommu.c b/mm/nommu.c
+index bd1808e194a7..b5ba5bc02e4b 100644
+--- a/mm/nommu.c
++++ b/mm/nommu.c
+@@ -1905,7 +1905,7 @@ EXPORT_SYMBOL(unmap_mapping_range);
+ */
+ int __vm_enough_memory(struct mm_struct *mm, long pages, int cap_sys_admin)
+ {
+- unsigned long free, allowed, reserve;
++ long free, allowed, reserve;
+
+ vm_acct_memory(pages);
+
+@@ -1969,7 +1969,7 @@ int __vm_enough_memory(struct mm_struct *mm, long pages, int cap_sys_admin)
+ */
+ if (mm) {
+ reserve = sysctl_user_reserve_kbytes >> (PAGE_SHIFT - 10);
+- allowed -= min(mm->total_vm / 32, reserve);
++ allowed -= min_t(long, mm->total_vm / 32, reserve);
+ }
+
+ if (percpu_counter_read_positive(&vm_committed_as) < allowed)
+diff --git a/mm/page_alloc.c b/mm/page_alloc.c
+index 616a2c956b4b..c32cb64a1277 100644
+--- a/mm/page_alloc.c
++++ b/mm/page_alloc.c
+@@ -1073,8 +1073,8 @@ static void change_pageblock_range(struct page *pageblock_page,
+ * nor move CMA pages to different free lists. We don't want unmovable pages
+ * to be allocated from MIGRATE_CMA areas.
+ *
+- * Returns the new migratetype of the pageblock (or the same old migratetype
+- * if it was unchanged).
++ * Returns the allocation migratetype if free pages were stolen, or the
++ * fallback migratetype if it was decided not to steal.
+ */
+ static int try_to_steal_freepages(struct zone *zone, struct page *page,
+ int start_type, int fallback_type)
+@@ -1105,12 +1105,10 @@ static int try_to_steal_freepages(struct zone *zone, struct page *page,
+
+ /* Claim the whole block if over half of it is free */
+ if (pages >= (1 << (pageblock_order-1)) ||
+- page_group_by_mobility_disabled) {
+-
++ page_group_by_mobility_disabled)
+ set_pageblock_migratetype(page, start_type);
+- return start_type;
+- }
+
++ return start_type;
+ }
+
+ return fallback_type;
+@@ -1162,7 +1160,7 @@ __rmqueue_fallback(struct zone *zone, unsigned int order, int start_migratetype)
+ set_freepage_migratetype(page, new_type);
+
+ trace_mm_page_alloc_extfrag(page, order, current_order,
+- start_migratetype, migratetype, new_type);
++ start_migratetype, migratetype);
+
+ return page;
+ }
+diff --git a/mm/vmstat.c b/mm/vmstat.c
+index 1b12d390dc68..4590aa42b6cd 100644
+--- a/mm/vmstat.c
++++ b/mm/vmstat.c
+@@ -1348,7 +1348,7 @@ static void __init start_shepherd_timer(void)
+ int cpu;
+
+ for_each_possible_cpu(cpu)
+- INIT_DEFERRABLE_WORK(per_cpu_ptr(&vmstat_work, cpu),
++ INIT_DELAYED_WORK(per_cpu_ptr(&vmstat_work, cpu),
+ vmstat_update);
+
+ if (!alloc_cpumask_var(&cpu_stat_off, GFP_KERNEL))
+diff --git a/net/compat.c b/net/compat.c
+index bc8aeefddf3f..c48930373e65 100644
+--- a/net/compat.c
++++ b/net/compat.c
+@@ -738,24 +738,18 @@ static unsigned char nas[21] = {
+
+ COMPAT_SYSCALL_DEFINE3(sendmsg, int, fd, struct compat_msghdr __user *, msg, unsigned int, flags)
+ {
+- if (flags & MSG_CMSG_COMPAT)
+- return -EINVAL;
+ return __sys_sendmsg(fd, (struct msghdr __user *)msg, flags | MSG_CMSG_COMPAT);
+ }
+
+ COMPAT_SYSCALL_DEFINE4(sendmmsg, int, fd, struct compat_mmsghdr __user *, mmsg,
+ unsigned int, vlen, unsigned int, flags)
+ {
+- if (flags & MSG_CMSG_COMPAT)
+- return -EINVAL;
+ return __sys_sendmmsg(fd, (struct mmsghdr __user *)mmsg, vlen,
+ flags | MSG_CMSG_COMPAT);
+ }
+
+ COMPAT_SYSCALL_DEFINE3(recvmsg, int, fd, struct compat_msghdr __user *, msg, unsigned int, flags)
+ {
+- if (flags & MSG_CMSG_COMPAT)
+- return -EINVAL;
+ return __sys_recvmsg(fd, (struct msghdr __user *)msg, flags | MSG_CMSG_COMPAT);
+ }
+
+@@ -778,9 +772,6 @@ COMPAT_SYSCALL_DEFINE5(recvmmsg, int, fd, struct compat_mmsghdr __user *, mmsg,
+ int datagrams;
+ struct timespec ktspec;
+
+- if (flags & MSG_CMSG_COMPAT)
+- return -EINVAL;
+-
+ if (timeout == NULL)
+ return __sys_recvmmsg(fd, (struct mmsghdr __user *)mmsg, vlen,
+ flags | MSG_CMSG_COMPAT, NULL);
+diff --git a/net/core/dev.c b/net/core/dev.c
+index 9704a5c1103e..5db3a3f96198 100644
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -943,7 +943,7 @@ bool dev_valid_name(const char *name)
+ return false;
+
+ while (*name) {
+- if (*name == '/' || isspace(*name))
++ if (*name == '/' || *name == ':' || isspace(*name))
+ return false;
+ name++;
+ }
+diff --git a/net/core/flow.c b/net/core/flow.c
+index a0348fde1fdf..1033725be40b 100644
+--- a/net/core/flow.c
++++ b/net/core/flow.c
+@@ -379,7 +379,7 @@ done:
+ static void flow_cache_flush_task(struct work_struct *work)
+ {
+ struct netns_xfrm *xfrm = container_of(work, struct netns_xfrm,
+- flow_cache_gc_work);
++ flow_cache_flush_work);
+ struct net *net = container_of(xfrm, struct net, xfrm);
+
+ flow_cache_flush(net);
+diff --git a/net/core/gen_stats.c b/net/core/gen_stats.c
+index 0c08062d1796..1e2f46a69d50 100644
+--- a/net/core/gen_stats.c
++++ b/net/core/gen_stats.c
+@@ -32,6 +32,9 @@ gnet_stats_copy(struct gnet_dump *d, int type, void *buf, int size)
+ return 0;
+
+ nla_put_failure:
++ kfree(d->xstats);
++ d->xstats = NULL;
++ d->xstats_len = 0;
+ spin_unlock_bh(d->lock);
+ return -1;
+ }
+@@ -305,7 +308,9 @@ int
+ gnet_stats_copy_app(struct gnet_dump *d, void *st, int len)
+ {
+ if (d->compat_xstats) {
+- d->xstats = st;
++ d->xstats = kmemdup(st, len, GFP_ATOMIC);
++ if (!d->xstats)
++ goto err_out;
+ d->xstats_len = len;
+ }
+
+@@ -313,6 +318,11 @@ gnet_stats_copy_app(struct gnet_dump *d, void *st, int len)
+ return gnet_stats_copy(d, TCA_STATS_APP, st, len);
+
+ return 0;
++
++err_out:
++ d->xstats_len = 0;
++ spin_unlock_bh(d->lock);
++ return -1;
+ }
+ EXPORT_SYMBOL(gnet_stats_copy_app);
+
+@@ -345,6 +355,9 @@ gnet_stats_finish_copy(struct gnet_dump *d)
+ return -1;
+ }
+
++ kfree(d->xstats);
++ d->xstats = NULL;
++ d->xstats_len = 0;
+ spin_unlock_bh(d->lock);
+ return 0;
+ }
+diff --git a/net/core/pktgen.c b/net/core/pktgen.c
+index 443256bdcddc..0b320d93fb56 100644
+--- a/net/core/pktgen.c
++++ b/net/core/pktgen.c
+@@ -1134,6 +1134,9 @@ static ssize_t pktgen_if_write(struct file *file,
+ return len;
+
+ i += len;
++ if ((value > 1) &&
++ (!(pkt_dev->odev->priv_flags & IFF_TX_SKB_SHARING)))
++ return -ENOTSUPP;
+ pkt_dev->burst = value < 1 ? 1 : value;
+ sprintf(pg_result, "OK: burst=%d", pkt_dev->burst);
+ return count;
+@@ -2842,25 +2845,25 @@ static struct sk_buff *fill_packet_ipv4(struct net_device *odev,
+ skb->dev = odev;
+ skb->pkt_type = PACKET_HOST;
+
++ pktgen_finalize_skb(pkt_dev, skb, datalen);
++
+ if (!(pkt_dev->flags & F_UDPCSUM)) {
+ skb->ip_summed = CHECKSUM_NONE;
+ } else if (odev->features & NETIF_F_V4_CSUM) {
+ skb->ip_summed = CHECKSUM_PARTIAL;
+ skb->csum = 0;
+- udp4_hwcsum(skb, udph->source, udph->dest);
++ udp4_hwcsum(skb, iph->saddr, iph->daddr);
+ } else {
+- __wsum csum = udp_csum(skb);
++ __wsum csum = skb_checksum(skb, skb_transport_offset(skb), datalen + 8, 0);
+
+ /* add protocol-dependent pseudo-header */
+- udph->check = csum_tcpudp_magic(udph->source, udph->dest,
++ udph->check = csum_tcpudp_magic(iph->saddr, iph->daddr,
+ datalen + 8, IPPROTO_UDP, csum);
+
+ if (udph->check == 0)
+ udph->check = CSUM_MANGLED_0;
+ }
+
+- pktgen_finalize_skb(pkt_dev, skb, datalen);
+-
+ #ifdef CONFIG_XFRM
+ if (!process_ipsec(pkt_dev, skb, protocol))
+ return NULL;
+@@ -2976,6 +2979,8 @@ static struct sk_buff *fill_packet_ipv6(struct net_device *odev,
+ skb->dev = odev;
+ skb->pkt_type = PACKET_HOST;
+
++ pktgen_finalize_skb(pkt_dev, skb, datalen);
++
+ if (!(pkt_dev->flags & F_UDPCSUM)) {
+ skb->ip_summed = CHECKSUM_NONE;
+ } else if (odev->features & NETIF_F_V6_CSUM) {
+@@ -2984,7 +2989,7 @@ static struct sk_buff *fill_packet_ipv6(struct net_device *odev,
+ skb->csum_offset = offsetof(struct udphdr, check);
+ udph->check = ~csum_ipv6_magic(&iph->saddr, &iph->daddr, udplen, IPPROTO_UDP, 0);
+ } else {
+- __wsum csum = udp_csum(skb);
++ __wsum csum = skb_checksum(skb, skb_transport_offset(skb), udplen, 0);
+
+ /* add protocol-dependent pseudo-header */
+ udph->check = csum_ipv6_magic(&iph->saddr, &iph->daddr, udplen, IPPROTO_UDP, csum);
+@@ -2993,8 +2998,6 @@ static struct sk_buff *fill_packet_ipv6(struct net_device *odev,
+ udph->check = CSUM_MANGLED_0;
+ }
+
+- pktgen_finalize_skb(pkt_dev, skb, datalen);
+-
+ return skb;
+ }
+
+diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
+index ca82629de0b2..c522f7a00eab 100644
+--- a/net/core/rtnetlink.c
++++ b/net/core/rtnetlink.c
+@@ -1212,18 +1212,12 @@ static const struct nla_policy ifla_vfinfo_policy[IFLA_VF_INFO_MAX+1] = {
+ };
+
+ static const struct nla_policy ifla_vf_policy[IFLA_VF_MAX+1] = {
+- [IFLA_VF_MAC] = { .type = NLA_BINARY,
+- .len = sizeof(struct ifla_vf_mac) },
+- [IFLA_VF_VLAN] = { .type = NLA_BINARY,
+- .len = sizeof(struct ifla_vf_vlan) },
+- [IFLA_VF_TX_RATE] = { .type = NLA_BINARY,
+- .len = sizeof(struct ifla_vf_tx_rate) },
+- [IFLA_VF_SPOOFCHK] = { .type = NLA_BINARY,
+- .len = sizeof(struct ifla_vf_spoofchk) },
+- [IFLA_VF_RATE] = { .type = NLA_BINARY,
+- .len = sizeof(struct ifla_vf_rate) },
+- [IFLA_VF_LINK_STATE] = { .type = NLA_BINARY,
+- .len = sizeof(struct ifla_vf_link_state) },
++ [IFLA_VF_MAC] = { .len = sizeof(struct ifla_vf_mac) },
++ [IFLA_VF_VLAN] = { .len = sizeof(struct ifla_vf_vlan) },
++ [IFLA_VF_TX_RATE] = { .len = sizeof(struct ifla_vf_tx_rate) },
++ [IFLA_VF_SPOOFCHK] = { .len = sizeof(struct ifla_vf_spoofchk) },
++ [IFLA_VF_RATE] = { .len = sizeof(struct ifla_vf_rate) },
++ [IFLA_VF_LINK_STATE] = { .len = sizeof(struct ifla_vf_link_state) },
+ };
+
+ static const struct nla_policy ifla_port_policy[IFLA_PORT_MAX+1] = {
+@@ -1255,7 +1249,6 @@ static int rtnl_dump_ifinfo(struct sk_buff *skb, struct netlink_callback *cb)
+ s_h = cb->args[0];
+ s_idx = cb->args[1];
+
+- rcu_read_lock();
+ cb->seq = net->dev_base_seq;
+
+ /* A hack to preserve kernel<->userspace interface.
+@@ -1277,7 +1270,7 @@ static int rtnl_dump_ifinfo(struct sk_buff *skb, struct netlink_callback *cb)
+ for (h = s_h; h < NETDEV_HASHENTRIES; h++, s_idx = 0) {
+ idx = 0;
+ head = &net->dev_index_head[h];
+- hlist_for_each_entry_rcu(dev, head, index_hlist) {
++ hlist_for_each_entry(dev, head, index_hlist) {
+ if (idx < s_idx)
+ goto cont;
+ err = rtnl_fill_ifinfo(skb, dev, RTM_NEWLINK,
+@@ -1299,7 +1292,6 @@ cont:
+ }
+ }
+ out:
+- rcu_read_unlock();
+ cb->args[1] = idx;
+ cb->args[0] = h;
+
+@@ -2105,8 +2097,16 @@ replay:
+ }
+ }
+ err = rtnl_configure_link(dev, ifm);
+- if (err < 0)
+- unregister_netdevice(dev);
++ if (err < 0) {
++ if (ops->newlink) {
++ LIST_HEAD(list_kill);
++
++ ops->dellink(dev, &list_kill);
++ unregister_netdevice_many(&list_kill);
++ } else {
++ unregister_netdevice(dev);
++ }
++ }
+ out:
+ put_net(dest_net);
+ return err;
+diff --git a/net/core/skbuff.c b/net/core/skbuff.c
+index d7543d0fd744..79589ae84a5d 100644
+--- a/net/core/skbuff.c
++++ b/net/core/skbuff.c
+@@ -3515,13 +3515,14 @@ struct sk_buff *sock_dequeue_err_skb(struct sock *sk)
+ {
+ struct sk_buff_head *q = &sk->sk_error_queue;
+ struct sk_buff *skb, *skb_next;
++ unsigned long flags;
+ int err = 0;
+
+- spin_lock_bh(&q->lock);
++ spin_lock_irqsave(&q->lock, flags);
+ skb = __skb_dequeue(q);
+ if (skb && (skb_next = skb_peek(q)))
+ err = SKB_EXT_ERR(skb_next)->ee.ee_errno;
+- spin_unlock_bh(&q->lock);
++ spin_unlock_irqrestore(&q->lock, flags);
+
+ sk->sk_err = err;
+ if (err)
+diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c
+index 2811cc18701a..b48e03cd6656 100644
+--- a/net/ipv4/ip_fragment.c
++++ b/net/ipv4/ip_fragment.c
+@@ -660,27 +660,30 @@ EXPORT_SYMBOL(ip_defrag);
+ struct sk_buff *ip_check_defrag(struct sk_buff *skb, u32 user)
+ {
+ struct iphdr iph;
++ int netoff;
+ u32 len;
+
+ if (skb->protocol != htons(ETH_P_IP))
+ return skb;
+
+- if (!skb_copy_bits(skb, 0, &iph, sizeof(iph)))
++ netoff = skb_network_offset(skb);
++
++ if (skb_copy_bits(skb, netoff, &iph, sizeof(iph)) < 0)
+ return skb;
+
+ if (iph.ihl < 5 || iph.version != 4)
+ return skb;
+
+ len = ntohs(iph.tot_len);
+- if (skb->len < len || len < (iph.ihl * 4))
++ if (skb->len < netoff + len || len < (iph.ihl * 4))
+ return skb;
+
+ if (ip_is_fragment(&iph)) {
+ skb = skb_share_check(skb, GFP_ATOMIC);
+ if (skb) {
+- if (!pskb_may_pull(skb, iph.ihl*4))
++ if (!pskb_may_pull(skb, netoff + iph.ihl * 4))
+ return skb;
+- if (pskb_trim_rcsum(skb, len))
++ if (pskb_trim_rcsum(skb, netoff + len))
+ return skb;
+ memset(IPCB(skb), 0, sizeof(struct inet_skb_parm));
+ if (ip_defrag(skb, user))
+diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
+index 4a2a074bfb4a..357c2a914e77 100644
+--- a/net/ipv4/ip_output.c
++++ b/net/ipv4/ip_output.c
+@@ -890,7 +890,8 @@ static int __ip_append_data(struct sock *sk,
+ cork->length += length;
+ if (((length > mtu) || (skb && skb_is_gso(skb))) &&
+ (sk->sk_protocol == IPPROTO_UDP) &&
+- (rt->dst.dev->features & NETIF_F_UFO) && !rt->dst.header_len) {
++ (rt->dst.dev->features & NETIF_F_UFO) && !rt->dst.header_len &&
++ (sk->sk_type == SOCK_DGRAM)) {
+ err = ip_ufo_append_data(sk, queue, getfrag, from, length,
+ hh_len, fragheaderlen, transhdrlen,
+ maxfraglen, flags);
+diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
+index 5638b179b355..a5c49d657ab1 100644
+--- a/net/ipv4/ping.c
++++ b/net/ipv4/ping.c
+@@ -259,6 +259,9 @@ int ping_init_sock(struct sock *sk)
+ kgid_t low, high;
+ int ret = 0;
+
++ if (sk->sk_family == AF_INET6)
++ sk->sk_ipv6only = 1;
++
+ inet_get_ping_group_range_net(net, &low, &high);
+ if (gid_lte(low, group) && gid_lte(group, high))
+ return 0;
+@@ -305,6 +308,11 @@ static int ping_check_bind_addr(struct sock *sk, struct inet_sock *isk,
+ if (addr_len < sizeof(*addr))
+ return -EINVAL;
+
++ if (addr->sin_family != AF_INET &&
++ !(addr->sin_family == AF_UNSPEC &&
++ addr->sin_addr.s_addr == htonl(INADDR_ANY)))
++ return -EAFNOSUPPORT;
++
+ pr_debug("ping_check_bind_addr(sk=%p,addr=%pI4,port=%d)\n",
+ sk, &addr->sin_addr.s_addr, ntohs(addr->sin_port));
+
+@@ -330,7 +338,7 @@ static int ping_check_bind_addr(struct sock *sk, struct inet_sock *isk,
+ return -EINVAL;
+
+ if (addr->sin6_family != AF_INET6)
+- return -EINVAL;
++ return -EAFNOSUPPORT;
+
+ pr_debug("ping_check_bind_addr(sk=%p,addr=%pI6c,port=%d)\n",
+ sk, addr->sin6_addr.s6_addr, ntohs(addr->sin6_port));
+@@ -716,7 +724,7 @@ static int ping_v4_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *m
+ if (msg->msg_namelen < sizeof(*usin))
+ return -EINVAL;
+ if (usin->sin_family != AF_INET)
+- return -EINVAL;
++ return -EAFNOSUPPORT;
+ daddr = usin->sin_addr.s_addr;
+ /* no remote port */
+ } else {
+diff --git a/net/ipv4/tcp_fastopen.c b/net/ipv4/tcp_fastopen.c
+index 815c85e3b1e0..c73077280ad4 100644
+--- a/net/ipv4/tcp_fastopen.c
++++ b/net/ipv4/tcp_fastopen.c
+@@ -134,6 +134,7 @@ static bool tcp_fastopen_create_child(struct sock *sk,
+ struct tcp_sock *tp;
+ struct request_sock_queue *queue = &inet_csk(sk)->icsk_accept_queue;
+ struct sock *child;
++ u32 end_seq;
+
+ req->num_retrans = 0;
+ req->num_timeout = 0;
+@@ -185,20 +186,35 @@ static bool tcp_fastopen_create_child(struct sock *sk,
+
+ /* Queue the data carried in the SYN packet. We need to first
+ * bump skb's refcnt because the caller will attempt to free it.
++ * Note that IPv6 might also have used skb_get() trick
++ * in tcp_v6_conn_request() to keep this SYN around (treq->pktopts)
++ * So we need to eventually get a clone of the packet,
++ * before inserting it in sk_receive_queue.
+ *
+ * XXX (TFO) - we honor a zero-payload TFO request for now,
+ * (any reason not to?) but no need to queue the skb since
+ * there is no data. How about SYN+FIN?
+ */
+- if (TCP_SKB_CB(skb)->end_seq != TCP_SKB_CB(skb)->seq + 1) {
+- skb = skb_get(skb);
+- skb_dst_drop(skb);
+- __skb_pull(skb, tcp_hdr(skb)->doff * 4);
+- skb_set_owner_r(skb, child);
+- __skb_queue_tail(&child->sk_receive_queue, skb);
+- tp->syn_data_acked = 1;
++ end_seq = TCP_SKB_CB(skb)->end_seq;
++ if (end_seq != TCP_SKB_CB(skb)->seq + 1) {
++ struct sk_buff *skb2;
++
++ if (unlikely(skb_shared(skb)))
++ skb2 = skb_clone(skb, GFP_ATOMIC);
++ else
++ skb2 = skb_get(skb);
++
++ if (likely(skb2)) {
++ skb_dst_drop(skb2);
++ __skb_pull(skb2, tcp_hdrlen(skb));
++ skb_set_owner_r(skb2, child);
++ __skb_queue_tail(&child->sk_receive_queue, skb2);
++ tp->syn_data_acked = 1;
++ } else {
++ end_seq = TCP_SKB_CB(skb)->seq + 1;
++ }
+ }
+- tcp_rsk(req)->rcv_nxt = tp->rcv_nxt = TCP_SKB_CB(skb)->end_seq;
++ tcp_rsk(req)->rcv_nxt = tp->rcv_nxt = end_seq;
+ sk->sk_data_ready(sk);
+ bh_unlock_sock(child);
+ sock_put(child);
+diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
+index 0169ccf5aa4f..17a025847999 100644
+--- a/net/ipv6/addrconf.c
++++ b/net/ipv6/addrconf.c
+@@ -4536,6 +4536,22 @@ static int inet6_set_iftoken(struct inet6_dev *idev, struct in6_addr *token)
+ return 0;
+ }
+
++static const struct nla_policy inet6_af_policy[IFLA_INET6_MAX + 1] = {
++ [IFLA_INET6_ADDR_GEN_MODE] = { .type = NLA_U8 },
++ [IFLA_INET6_TOKEN] = { .len = sizeof(struct in6_addr) },
++};
++
++static int inet6_validate_link_af(const struct net_device *dev,
++ const struct nlattr *nla)
++{
++ struct nlattr *tb[IFLA_INET6_MAX + 1];
++
++ if (dev && !__in6_dev_get(dev))
++ return -EAFNOSUPPORT;
++
++ return nla_parse_nested(tb, IFLA_INET6_MAX, nla, inet6_af_policy);
++}
++
+ static int inet6_set_link_af(struct net_device *dev, const struct nlattr *nla)
+ {
+ int err = -EINVAL;
+@@ -5351,6 +5367,7 @@ static struct rtnl_af_ops inet6_ops = {
+ .family = AF_INET6,
+ .fill_link_af = inet6_fill_link_af,
+ .get_link_af_size = inet6_get_link_af_size,
++ .validate_link_af = inet6_validate_link_af,
+ .set_link_af = inet6_set_link_af,
+ };
+
+diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
+index 8e950c250ada..51add023b723 100644
+--- a/net/ipv6/ip6_output.c
++++ b/net/ipv6/ip6_output.c
+@@ -1296,7 +1296,8 @@ emsgsize:
+ if (((length > mtu) ||
+ (skb && skb_is_gso(skb))) &&
+ (sk->sk_protocol == IPPROTO_UDP) &&
+- (rt->dst.dev->features & NETIF_F_UFO)) {
++ (rt->dst.dev->features & NETIF_F_UFO) &&
++ (sk->sk_type == SOCK_DGRAM)) {
+ err = ip6_ufo_append_data(sk, getfrag, from, length,
+ hh_len, fragheaderlen,
+ transhdrlen, mtu, flags, rt);
+diff --git a/net/ipv6/ping.c b/net/ipv6/ping.c
+index 5b7a1ed2aba9..2d452a382128 100644
+--- a/net/ipv6/ping.c
++++ b/net/ipv6/ping.c
+@@ -102,9 +102,10 @@ int ping_v6_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
+
+ if (msg->msg_name) {
+ DECLARE_SOCKADDR(struct sockaddr_in6 *, u, msg->msg_name);
+- if (msg->msg_namelen < sizeof(struct sockaddr_in6) ||
+- u->sin6_family != AF_INET6) {
++ if (msg->msg_namelen < sizeof(*u))
+ return -EINVAL;
++ if (u->sin6_family != AF_INET6) {
++ return -EAFNOSUPPORT;
+ }
+ if (sk->sk_bound_dev_if &&
+ sk->sk_bound_dev_if != u->sin6_scope_id) {
+diff --git a/net/ipv6/route.c b/net/ipv6/route.c
+index d02ee019382e..2d9aca57e7c7 100644
+--- a/net/ipv6/route.c
++++ b/net/ipv6/route.c
+@@ -141,7 +141,7 @@ static u32 *ipv6_cow_metrics(struct dst_entry *dst, unsigned long old)
+ u32 *p = NULL;
+
+ if (!(rt->dst.flags & DST_HOST))
+- return NULL;
++ return dst_cow_metrics_generic(dst, old);
+
+ peer = rt6_get_peer_create(rt);
+ if (peer) {
+diff --git a/net/irda/ircomm/ircomm_tty.c b/net/irda/ircomm/ircomm_tty.c
+index 61ceb4cdb4a2..23ad419361fb 100644
+--- a/net/irda/ircomm/ircomm_tty.c
++++ b/net/irda/ircomm/ircomm_tty.c
+@@ -816,7 +816,9 @@ static void ircomm_tty_wait_until_sent(struct tty_struct *tty, int timeout)
+ orig_jiffies = jiffies;
+
+ /* Set poll time to 200 ms */
+- poll_time = IRDA_MIN(timeout, msecs_to_jiffies(200));
++ poll_time = msecs_to_jiffies(200);
++ if (timeout)
++ poll_time = min_t(unsigned long, timeout, poll_time);
+
+ spin_lock_irqsave(&self->spinlock, flags);
+ while (self->tx_skb && self->tx_skb->len) {
+diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
+index 900632a250ec..80ce44f6693d 100644
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -563,6 +563,7 @@ ieee80211_tx_h_check_control_port_protocol(struct ieee80211_tx_data *tx)
+ if (tx->sdata->control_port_no_encrypt)
+ info->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
+ info->control.flags |= IEEE80211_TX_CTRL_PORT_CTRL_PROTO;
++ info->flags |= IEEE80211_TX_CTL_USE_MINRATE;
+ }
+
+ return TX_CONTINUE;
+diff --git a/net/openvswitch/datapath.c b/net/openvswitch/datapath.c
+index f9e556b56086..68ccddb5e2c4 100644
+--- a/net/openvswitch/datapath.c
++++ b/net/openvswitch/datapath.c
+@@ -2060,14 +2060,55 @@ static int __net_init ovs_init_net(struct net *net)
+ return 0;
+ }
+
+-static void __net_exit ovs_exit_net(struct net *net)
++static void __net_exit list_vports_from_net(struct net *net, struct net *dnet,
++ struct list_head *head)
+ {
+- struct datapath *dp, *dp_next;
+ struct ovs_net *ovs_net = net_generic(net, ovs_net_id);
++ struct datapath *dp;
++
++ list_for_each_entry(dp, &ovs_net->dps, list_node) {
++ int i;
++
++ for (i = 0; i < DP_VPORT_HASH_BUCKETS; i++) {
++ struct vport *vport;
++
++ hlist_for_each_entry(vport, &dp->ports[i], dp_hash_node) {
++ struct netdev_vport *netdev_vport;
++
++ if (vport->ops->type != OVS_VPORT_TYPE_INTERNAL)
++ continue;
++
++ netdev_vport = netdev_vport_priv(vport);
++ if (dev_net(netdev_vport->dev) == dnet)
++ list_add(&vport->detach_list, head);
++ }
++ }
++ }
++}
++
++static void __net_exit ovs_exit_net(struct net *dnet)
++{
++ struct datapath *dp, *dp_next;
++ struct ovs_net *ovs_net = net_generic(dnet, ovs_net_id);
++ struct vport *vport, *vport_next;
++ struct net *net;
++ LIST_HEAD(head);
+
+ ovs_lock();
+ list_for_each_entry_safe(dp, dp_next, &ovs_net->dps, list_node)
+ __dp_destroy(dp);
++
++ rtnl_lock();
++ for_each_net(net)
++ list_vports_from_net(net, dnet, &head);
++ rtnl_unlock();
++
++ /* Detach all vports from given namespace. */
++ list_for_each_entry_safe(vport, vport_next, &head, detach_list) {
++ list_del(&vport->detach_list);
++ ovs_dp_detach_port(vport);
++ }
++
+ ovs_unlock();
+
+ cancel_work_sync(&ovs_net->dp_notify_work);
+diff --git a/net/openvswitch/vport.h b/net/openvswitch/vport.h
+index 8942125de3a6..ab01c65fb3de 100644
+--- a/net/openvswitch/vport.h
++++ b/net/openvswitch/vport.h
+@@ -93,6 +93,7 @@ struct vport_portids {
+ * @ops: Class structure.
+ * @percpu_stats: Points to per-CPU statistics used and maintained by vport
+ * @err_stats: Points to error statistics used and maintained by vport
++ * @detach_list: list used for detaching vport in net-exit call.
+ */
+ struct vport {
+ struct rcu_head rcu;
+@@ -107,6 +108,7 @@ struct vport {
+ struct pcpu_sw_netstats __percpu *percpu_stats;
+
+ struct vport_err_stats err_stats;
++ struct list_head detach_list;
+ };
+
+ /**
+diff --git a/net/sched/ematch.c b/net/sched/ematch.c
+index 6742200b1307..fbb7ebfc58c6 100644
+--- a/net/sched/ematch.c
++++ b/net/sched/ematch.c
+@@ -228,6 +228,7 @@ static int tcf_em_validate(struct tcf_proto *tp,
+ * to replay the request.
+ */
+ module_put(em->ops->owner);
++ em->ops = NULL;
+ err = -EAGAIN;
+ }
+ #endif
+diff --git a/net/sunrpc/backchannel_rqst.c b/net/sunrpc/backchannel_rqst.c
+index 9761a0da964d..1bb4d26fbd6b 100644
+--- a/net/sunrpc/backchannel_rqst.c
++++ b/net/sunrpc/backchannel_rqst.c
+@@ -309,12 +309,15 @@ void xprt_complete_bc_request(struct rpc_rqst *req, uint32_t copied)
+ struct rpc_xprt *xprt = req->rq_xprt;
+ struct svc_serv *bc_serv = xprt->bc_serv;
+
++ spin_lock(&xprt->bc_pa_lock);
++ list_del(&req->rq_bc_pa_list);
++ spin_unlock(&xprt->bc_pa_lock);
++
+ req->rq_private_buf.len = copied;
+ set_bit(RPC_BC_PA_IN_USE, &req->rq_bc_pa_state);
+
+ dprintk("RPC: add callback request to list\n");
+ spin_lock(&bc_serv->sv_cb_lock);
+- list_del(&req->rq_bc_pa_list);
+ list_add(&req->rq_bc_list, &bc_serv->sv_cb_list);
+ wake_up(&bc_serv->sv_cb_waitq);
+ spin_unlock(&bc_serv->sv_cb_lock);
+diff --git a/net/sunrpc/cache.c b/net/sunrpc/cache.c
+index 066362141133..48f14003af10 100644
+--- a/net/sunrpc/cache.c
++++ b/net/sunrpc/cache.c
+@@ -920,7 +920,7 @@ static unsigned int cache_poll(struct file *filp, poll_table *wait,
+ poll_wait(filp, &queue_wait, wait);
+
+ /* alway allow write */
+- mask = POLL_OUT | POLLWRNORM;
++ mask = POLLOUT | POLLWRNORM;
+
+ if (!rp)
+ return mask;
+diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c
+index 166d59cdc86b..9c823cfdfff0 100644
+--- a/sound/core/pcm_native.c
++++ b/sound/core/pcm_native.c
+@@ -1523,6 +1523,8 @@ static int snd_pcm_do_drain_init(struct snd_pcm_substream *substream, int state)
+ if (! snd_pcm_playback_empty(substream)) {
+ snd_pcm_do_start(substream, SNDRV_PCM_STATE_DRAINING);
+ snd_pcm_post_start(substream, SNDRV_PCM_STATE_DRAINING);
++ } else {
++ runtime->status->state = SNDRV_PCM_STATE_SETUP;
+ }
+ break;
+ case SNDRV_PCM_STATE_RUNNING:
+diff --git a/sound/pci/hda/hda_controller.c b/sound/pci/hda/hda_controller.c
+index 8337645aa7a5..84c94301bfaf 100644
+--- a/sound/pci/hda/hda_controller.c
++++ b/sound/pci/hda/hda_controller.c
+@@ -957,7 +957,6 @@ static int azx_alloc_cmd_io(struct azx *chip)
+ dev_err(chip->card->dev, "cannot allocate CORB/RIRB\n");
+ return err;
+ }
+-EXPORT_SYMBOL_GPL(azx_alloc_cmd_io);
+
+ static void azx_init_cmd_io(struct azx *chip)
+ {
+@@ -1022,7 +1021,6 @@ static void azx_init_cmd_io(struct azx *chip)
+ azx_writeb(chip, RIRBCTL, AZX_RBCTL_DMA_EN | AZX_RBCTL_IRQ_EN);
+ spin_unlock_irq(&chip->reg_lock);
+ }
+-EXPORT_SYMBOL_GPL(azx_init_cmd_io);
+
+ static void azx_free_cmd_io(struct azx *chip)
+ {
+@@ -1032,7 +1030,6 @@ static void azx_free_cmd_io(struct azx *chip)
+ azx_writeb(chip, CORBCTL, 0);
+ spin_unlock_irq(&chip->reg_lock);
+ }
+-EXPORT_SYMBOL_GPL(azx_free_cmd_io);
+
+ static unsigned int azx_command_addr(u32 cmd)
+ {
+@@ -1312,7 +1309,6 @@ static int azx_send_cmd(struct hda_bus *bus, unsigned int val)
+ else
+ return azx_corb_send_cmd(bus, val);
+ }
+-EXPORT_SYMBOL_GPL(azx_send_cmd);
+
+ /* get a response */
+ static unsigned int azx_get_response(struct hda_bus *bus,
+@@ -1326,7 +1322,6 @@ static unsigned int azx_get_response(struct hda_bus *bus,
+ else
+ return azx_rirb_get_response(bus, addr);
+ }
+-EXPORT_SYMBOL_GPL(azx_get_response);
+
+ #ifdef CONFIG_SND_HDA_DSP_LOADER
+ /*
+diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
+index 48b6c5a3884f..8413797ba38d 100644
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -1995,7 +1995,7 @@ static const struct pci_device_id azx_ids[] = {
+ .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_PCH_NOPM },
+ /* Panther Point */
+ { PCI_DEVICE(0x8086, 0x1e20),
+- .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_PCH },
++ .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_PCH_NOPM },
+ /* Lynx Point */
+ { PCI_DEVICE(0x8086, 0x8c20),
+ .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_PCH },
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 50762cf62b2d..8375bc424e2d 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -5074,6 +5074,13 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = {
+ {0x17, 0x40000000},
+ {0x1d, 0x40700001},
+ {0x21, 0x02211040}),
++ SND_HDA_PIN_QUIRK(0x10ec0255, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
++ ALC255_STANDARD_PINS,
++ {0x12, 0x90a60170},
++ {0x14, 0x90170140},
++ {0x17, 0x40000000},
++ {0x1d, 0x40700001},
++ {0x21, 0x02211050}),
+ SND_HDA_PIN_QUIRK(0x10ec0280, 0x103c, "HP", ALC280_FIXUP_HP_GPIO4,
+ {0x12, 0x90a60130},
+ {0x13, 0x40000000},
+diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
+index 6d36c5b78805..87eff3173ce9 100644
+--- a/sound/pci/hda/patch_sigmatel.c
++++ b/sound/pci/hda/patch_sigmatel.c
+@@ -79,6 +79,7 @@ enum {
+ STAC_ALIENWARE_M17X,
+ STAC_92HD89XX_HP_FRONT_JACK,
+ STAC_92HD89XX_HP_Z1_G2_RIGHT_MIC_JACK,
++ STAC_92HD73XX_ASUS_MOBO,
+ STAC_92HD73XX_MODELS
+ };
+
+@@ -1911,7 +1912,18 @@ static const struct hda_fixup stac92hd73xx_fixups[] = {
+ [STAC_92HD89XX_HP_Z1_G2_RIGHT_MIC_JACK] = {
+ .type = HDA_FIXUP_PINS,
+ .v.pins = stac92hd89xx_hp_z1_g2_right_mic_jack_pin_configs,
+- }
++ },
++ [STAC_92HD73XX_ASUS_MOBO] = {
++ .type = HDA_FIXUP_PINS,
++ .v.pins = (const struct hda_pintbl[]) {
++ /* enable 5.1 and SPDIF out */
++ { 0x0c, 0x01014411 },
++ { 0x0d, 0x01014410 },
++ { 0x0e, 0x01014412 },
++ { 0x22, 0x014b1180 },
++ { }
++ }
++ },
+ };
+
+ static const struct hda_model_fixup stac92hd73xx_models[] = {
+@@ -1923,6 +1935,7 @@ static const struct hda_model_fixup stac92hd73xx_models[] = {
+ { .id = STAC_DELL_M6_BOTH, .name = "dell-m6" },
+ { .id = STAC_DELL_EQ, .name = "dell-eq" },
+ { .id = STAC_ALIENWARE_M17X, .name = "alienware" },
++ { .id = STAC_92HD73XX_ASUS_MOBO, .name = "asus-mobo" },
+ {}
+ };
+
+@@ -1975,6 +1988,8 @@ static const struct snd_pci_quirk stac92hd73xx_fixup_tbl[] = {
+ "HP Z1 G2", STAC_92HD89XX_HP_Z1_G2_RIGHT_MIC_JACK),
+ SND_PCI_QUIRK(PCI_VENDOR_ID_HP, 0x2b17,
+ "unknown HP", STAC_92HD89XX_HP_FRONT_JACK),
++ SND_PCI_QUIRK(PCI_VENDOR_ID_ASUSTEK, 0x83f8, "ASUS AT4NM10",
++ STAC_92HD73XX_ASUS_MOBO),
+ {} /* terminator */
+ };
+
+diff --git a/sound/soc/codecs/rt5670.c b/sound/soc/codecs/rt5670.c
+index 7134f9ebf2f3..a8a9c1f36b2e 100644
+--- a/sound/soc/codecs/rt5670.c
++++ b/sound/soc/codecs/rt5670.c
+@@ -222,7 +222,6 @@ static bool rt5670_volatile_register(struct device *dev, unsigned int reg)
+ case RT5670_ADC_EQ_CTRL1:
+ case RT5670_EQ_CTRL1:
+ case RT5670_ALC_CTRL_1:
+- case RT5670_IRQ_CTRL1:
+ case RT5670_IRQ_CTRL2:
+ case RT5670_INT_IRQ_ST:
+ case RT5670_IL_CMD:
+diff --git a/sound/soc/omap/omap-pcm.c b/sound/soc/omap/omap-pcm.c
+index f4b05bc23e4b..1343ecbf0bd5 100644
+--- a/sound/soc/omap/omap-pcm.c
++++ b/sound/soc/omap/omap-pcm.c
+@@ -201,7 +201,7 @@ static int omap_pcm_new(struct snd_soc_pcm_runtime *rtd)
+ struct snd_pcm *pcm = rtd->pcm;
+ int ret;
+
+- ret = dma_coerce_mask_and_coherent(card->dev, DMA_BIT_MASK(64));
++ ret = dma_coerce_mask_and_coherent(card->dev, DMA_BIT_MASK(32));
+ if (ret)
+ return ret;
+
^ permalink raw reply related [flat|nested] 67+ messages in thread
* [gentoo-commits] proj/linux-patches:3.18 commit in: /
@ 2015-03-28 19:46 Mike Pagano
0 siblings, 0 replies; 67+ messages in thread
From: Mike Pagano @ 2015-03-28 19:46 UTC (permalink / raw
To: gentoo-commits
commit: f6c3a6c5c3db66d698c0aa726dac52387ac1c8d4
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Sat Mar 28 19:46:03 2015 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Sat Mar 28 19:46:03 2015 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=f6c3a6c5
Add check to saved_root_name for supported filesystem path naming.
2900_dev-root-proc-mount-fix.patch | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/2900_dev-root-proc-mount-fix.patch b/2900_dev-root-proc-mount-fix.patch
index 6ea86e2..aa6fa19 100644
--- a/2900_dev-root-proc-mount-fix.patch
+++ b/2900_dev-root-proc-mount-fix.patch
@@ -1,6 +1,6 @@
---- a/init/do_mounts.c 2014-08-26 08:03:30.000013100 -0400
-+++ b/init/do_mounts.c 2014-08-26 08:11:19.720014712 -0400
-@@ -484,7 +484,10 @@ void __init change_floppy(char *fmt, ...
+--- a/init/do_mounts.c 2015-03-28 15:38:01.750855358 -0400
++++ b/init/do_mounts.c 2015-03-28 15:41:47.873853202 -0400
+@@ -485,7 +485,10 @@ void __init change_floppy(char *fmt, ...
va_start(args, fmt);
vsprintf(buf, fmt, args);
va_end(args);
@@ -12,13 +12,13 @@
if (fd >= 0) {
sys_ioctl(fd, FDEJECT, 0);
sys_close(fd);
-@@ -527,8 +530,13 @@ void __init mount_root(void)
+@@ -528,8 +531,13 @@ void __init mount_root(void)
}
#endif
#ifdef CONFIG_BLOCK
- create_dev("/dev/root", ROOT_DEV);
- mount_block_root("/dev/root", root_mountflags);
-+ if (saved_root_name[0]) {
++ if (saved_root_name[0] == '/') {
+ create_dev(saved_root_name, ROOT_DEV);
+ mount_block_root(saved_root_name, root_mountflags);
+ } else {
^ permalink raw reply related [flat|nested] 67+ messages in thread
* [gentoo-commits] proj/linux-patches:3.18 commit in: /
@ 2015-04-05 0:05 Mike Pagano
0 siblings, 0 replies; 67+ messages in thread
From: Mike Pagano @ 2015-04-05 0:05 UTC (permalink / raw
To: gentoo-commits
commit: 910ecd3eef3cf941070f0586d5de977a58c16ba7
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Sat Apr 4 23:53:54 2015 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Sat Apr 4 23:53:54 2015 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=910ecd3e
Linux patch 3.18.11
0000_README | 4 +
1010_linux-3.18.11.patch | 3765 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 3769 insertions(+)
diff --git a/0000_README b/0000_README
index ab13f61..7616ed8 100644
--- a/0000_README
+++ b/0000_README
@@ -83,6 +83,10 @@ Patch: 1009_linux-3.18.10.patch
From: http://www.kernel.org
Desc: Linux 3.18.10
+Patch: 1010_linux-3.18.11.patch
+From: http://www.kernel.org
+Desc: Linux 3.18.11
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1010_linux-3.18.11.patch b/1010_linux-3.18.11.patch
new file mode 100644
index 0000000..ed524c8
--- /dev/null
+++ b/1010_linux-3.18.11.patch
@@ -0,0 +1,3765 @@
+diff --git a/Makefile b/Makefile
+index d4ce2cb674c8..da8dc1350de3 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 18
+-SUBLEVEL = 10
++SUBLEVEL = 11
+ EXTRAVERSION =
+ NAME = Diseased Newt
+
+diff --git a/arch/arm/boot/dts/am33xx-clocks.dtsi b/arch/arm/boot/dts/am33xx-clocks.dtsi
+index 712edce7d6fb..071b56aa0c7e 100644
+--- a/arch/arm/boot/dts/am33xx-clocks.dtsi
++++ b/arch/arm/boot/dts/am33xx-clocks.dtsi
+@@ -99,7 +99,7 @@
+ ehrpwm0_tbclk: ehrpwm0_tbclk@44e10664 {
+ #clock-cells = <0>;
+ compatible = "ti,gate-clock";
+- clocks = <&dpll_per_m2_ck>;
++ clocks = <&l4ls_gclk>;
+ ti,bit-shift = <0>;
+ reg = <0x0664>;
+ };
+@@ -107,7 +107,7 @@
+ ehrpwm1_tbclk: ehrpwm1_tbclk@44e10664 {
+ #clock-cells = <0>;
+ compatible = "ti,gate-clock";
+- clocks = <&dpll_per_m2_ck>;
++ clocks = <&l4ls_gclk>;
+ ti,bit-shift = <1>;
+ reg = <0x0664>;
+ };
+@@ -115,7 +115,7 @@
+ ehrpwm2_tbclk: ehrpwm2_tbclk@44e10664 {
+ #clock-cells = <0>;
+ compatible = "ti,gate-clock";
+- clocks = <&dpll_per_m2_ck>;
++ clocks = <&l4ls_gclk>;
+ ti,bit-shift = <2>;
+ reg = <0x0664>;
+ };
+diff --git a/arch/arm/boot/dts/am43xx-clocks.dtsi b/arch/arm/boot/dts/am43xx-clocks.dtsi
+index c7dc9dab93a4..cfb49686ab6a 100644
+--- a/arch/arm/boot/dts/am43xx-clocks.dtsi
++++ b/arch/arm/boot/dts/am43xx-clocks.dtsi
+@@ -107,7 +107,7 @@
+ ehrpwm0_tbclk: ehrpwm0_tbclk {
+ #clock-cells = <0>;
+ compatible = "ti,gate-clock";
+- clocks = <&dpll_per_m2_ck>;
++ clocks = <&l4ls_gclk>;
+ ti,bit-shift = <0>;
+ reg = <0x0664>;
+ };
+@@ -115,7 +115,7 @@
+ ehrpwm1_tbclk: ehrpwm1_tbclk {
+ #clock-cells = <0>;
+ compatible = "ti,gate-clock";
+- clocks = <&dpll_per_m2_ck>;
++ clocks = <&l4ls_gclk>;
+ ti,bit-shift = <1>;
+ reg = <0x0664>;
+ };
+@@ -123,7 +123,7 @@
+ ehrpwm2_tbclk: ehrpwm2_tbclk {
+ #clock-cells = <0>;
+ compatible = "ti,gate-clock";
+- clocks = <&dpll_per_m2_ck>;
++ clocks = <&l4ls_gclk>;
+ ti,bit-shift = <2>;
+ reg = <0x0664>;
+ };
+@@ -131,7 +131,7 @@
+ ehrpwm3_tbclk: ehrpwm3_tbclk {
+ #clock-cells = <0>;
+ compatible = "ti,gate-clock";
+- clocks = <&dpll_per_m2_ck>;
++ clocks = <&l4ls_gclk>;
+ ti,bit-shift = <4>;
+ reg = <0x0664>;
+ };
+@@ -139,7 +139,7 @@
+ ehrpwm4_tbclk: ehrpwm4_tbclk {
+ #clock-cells = <0>;
+ compatible = "ti,gate-clock";
+- clocks = <&dpll_per_m2_ck>;
++ clocks = <&l4ls_gclk>;
+ ti,bit-shift = <5>;
+ reg = <0x0664>;
+ };
+@@ -147,7 +147,7 @@
+ ehrpwm5_tbclk: ehrpwm5_tbclk {
+ #clock-cells = <0>;
+ compatible = "ti,gate-clock";
+- clocks = <&dpll_per_m2_ck>;
++ clocks = <&l4ls_gclk>;
+ ti,bit-shift = <6>;
+ reg = <0x0664>;
+ };
+diff --git a/arch/arm/boot/dts/dra7xx-clocks.dtsi b/arch/arm/boot/dts/dra7xx-clocks.dtsi
+index 2c05b3f017fa..64c0f75b5444 100644
+--- a/arch/arm/boot/dts/dra7xx-clocks.dtsi
++++ b/arch/arm/boot/dts/dra7xx-clocks.dtsi
+@@ -243,10 +243,18 @@
+ ti,invert-autoidle-bit;
+ };
+
++ dpll_core_byp_mux: dpll_core_byp_mux {
++ #clock-cells = <0>;
++ compatible = "ti,mux-clock";
++ clocks = <&sys_clkin1>, <&dpll_abe_m3x2_ck>;
++ ti,bit-shift = <23>;
++ reg = <0x012c>;
++ };
++
+ dpll_core_ck: dpll_core_ck {
+ #clock-cells = <0>;
+ compatible = "ti,omap4-dpll-core-clock";
+- clocks = <&sys_clkin1>, <&dpll_abe_m3x2_ck>;
++ clocks = <&sys_clkin1>, <&dpll_core_byp_mux>;
+ reg = <0x0120>, <0x0124>, <0x012c>, <0x0128>;
+ };
+
+@@ -309,10 +317,18 @@
+ clock-div = <1>;
+ };
+
++ dpll_dsp_byp_mux: dpll_dsp_byp_mux {
++ #clock-cells = <0>;
++ compatible = "ti,mux-clock";
++ clocks = <&sys_clkin1>, <&dsp_dpll_hs_clk_div>;
++ ti,bit-shift = <23>;
++ reg = <0x0240>;
++ };
++
+ dpll_dsp_ck: dpll_dsp_ck {
+ #clock-cells = <0>;
+ compatible = "ti,omap4-dpll-clock";
+- clocks = <&sys_clkin1>, <&dsp_dpll_hs_clk_div>;
++ clocks = <&sys_clkin1>, <&dpll_dsp_byp_mux>;
+ reg = <0x0234>, <0x0238>, <0x0240>, <0x023c>;
+ };
+
+@@ -335,10 +351,18 @@
+ clock-div = <1>;
+ };
+
++ dpll_iva_byp_mux: dpll_iva_byp_mux {
++ #clock-cells = <0>;
++ compatible = "ti,mux-clock";
++ clocks = <&sys_clkin1>, <&iva_dpll_hs_clk_div>;
++ ti,bit-shift = <23>;
++ reg = <0x01ac>;
++ };
++
+ dpll_iva_ck: dpll_iva_ck {
+ #clock-cells = <0>;
+ compatible = "ti,omap4-dpll-clock";
+- clocks = <&sys_clkin1>, <&iva_dpll_hs_clk_div>;
++ clocks = <&sys_clkin1>, <&dpll_iva_byp_mux>;
+ reg = <0x01a0>, <0x01a4>, <0x01ac>, <0x01a8>;
+ };
+
+@@ -361,10 +385,18 @@
+ clock-div = <1>;
+ };
+
++ dpll_gpu_byp_mux: dpll_gpu_byp_mux {
++ #clock-cells = <0>;
++ compatible = "ti,mux-clock";
++ clocks = <&sys_clkin1>, <&dpll_abe_m3x2_ck>;
++ ti,bit-shift = <23>;
++ reg = <0x02e4>;
++ };
++
+ dpll_gpu_ck: dpll_gpu_ck {
+ #clock-cells = <0>;
+ compatible = "ti,omap4-dpll-clock";
+- clocks = <&sys_clkin1>, <&dpll_abe_m3x2_ck>;
++ clocks = <&sys_clkin1>, <&dpll_gpu_byp_mux>;
+ reg = <0x02d8>, <0x02dc>, <0x02e4>, <0x02e0>;
+ };
+
+@@ -398,10 +430,18 @@
+ clock-div = <1>;
+ };
+
++ dpll_ddr_byp_mux: dpll_ddr_byp_mux {
++ #clock-cells = <0>;
++ compatible = "ti,mux-clock";
++ clocks = <&sys_clkin1>, <&dpll_abe_m3x2_ck>;
++ ti,bit-shift = <23>;
++ reg = <0x021c>;
++ };
++
+ dpll_ddr_ck: dpll_ddr_ck {
+ #clock-cells = <0>;
+ compatible = "ti,omap4-dpll-clock";
+- clocks = <&sys_clkin1>, <&dpll_abe_m3x2_ck>;
++ clocks = <&sys_clkin1>, <&dpll_ddr_byp_mux>;
+ reg = <0x0210>, <0x0214>, <0x021c>, <0x0218>;
+ };
+
+@@ -416,10 +456,18 @@
+ ti,invert-autoidle-bit;
+ };
+
++ dpll_gmac_byp_mux: dpll_gmac_byp_mux {
++ #clock-cells = <0>;
++ compatible = "ti,mux-clock";
++ clocks = <&sys_clkin1>, <&dpll_abe_m3x2_ck>;
++ ti,bit-shift = <23>;
++ reg = <0x02b4>;
++ };
++
+ dpll_gmac_ck: dpll_gmac_ck {
+ #clock-cells = <0>;
+ compatible = "ti,omap4-dpll-clock";
+- clocks = <&sys_clkin1>, <&dpll_abe_m3x2_ck>;
++ clocks = <&sys_clkin1>, <&dpll_gmac_byp_mux>;
+ reg = <0x02a8>, <0x02ac>, <0x02b4>, <0x02b0>;
+ };
+
+@@ -482,10 +530,18 @@
+ clock-div = <1>;
+ };
+
++ dpll_eve_byp_mux: dpll_eve_byp_mux {
++ #clock-cells = <0>;
++ compatible = "ti,mux-clock";
++ clocks = <&sys_clkin1>, <&eve_dpll_hs_clk_div>;
++ ti,bit-shift = <23>;
++ reg = <0x0290>;
++ };
++
+ dpll_eve_ck: dpll_eve_ck {
+ #clock-cells = <0>;
+ compatible = "ti,omap4-dpll-clock";
+- clocks = <&sys_clkin1>, <&eve_dpll_hs_clk_div>;
++ clocks = <&sys_clkin1>, <&dpll_eve_byp_mux>;
+ reg = <0x0284>, <0x0288>, <0x0290>, <0x028c>;
+ };
+
+@@ -1249,10 +1305,18 @@
+ clock-div = <1>;
+ };
+
++ dpll_per_byp_mux: dpll_per_byp_mux {
++ #clock-cells = <0>;
++ compatible = "ti,mux-clock";
++ clocks = <&sys_clkin1>, <&per_dpll_hs_clk_div>;
++ ti,bit-shift = <23>;
++ reg = <0x014c>;
++ };
++
+ dpll_per_ck: dpll_per_ck {
+ #clock-cells = <0>;
+ compatible = "ti,omap4-dpll-clock";
+- clocks = <&sys_clkin1>, <&per_dpll_hs_clk_div>;
++ clocks = <&sys_clkin1>, <&dpll_per_byp_mux>;
+ reg = <0x0140>, <0x0144>, <0x014c>, <0x0148>;
+ };
+
+@@ -1275,10 +1339,18 @@
+ clock-div = <1>;
+ };
+
++ dpll_usb_byp_mux: dpll_usb_byp_mux {
++ #clock-cells = <0>;
++ compatible = "ti,mux-clock";
++ clocks = <&sys_clkin1>, <&usb_dpll_hs_clk_div>;
++ ti,bit-shift = <23>;
++ reg = <0x018c>;
++ };
++
+ dpll_usb_ck: dpll_usb_ck {
+ #clock-cells = <0>;
+ compatible = "ti,omap4-dpll-j-type-clock";
+- clocks = <&sys_clkin1>, <&usb_dpll_hs_clk_div>;
++ clocks = <&sys_clkin1>, <&dpll_usb_byp_mux>;
+ reg = <0x0180>, <0x0184>, <0x018c>, <0x0188>;
+ };
+
+diff --git a/arch/arm/boot/dts/imx6qdl-sabresd.dtsi b/arch/arm/boot/dts/imx6qdl-sabresd.dtsi
+index baf2f00d519a..b57e554dba4e 100644
+--- a/arch/arm/boot/dts/imx6qdl-sabresd.dtsi
++++ b/arch/arm/boot/dts/imx6qdl-sabresd.dtsi
+@@ -35,6 +35,7 @@
+ regulator-max-microvolt = <5000000>;
+ gpio = <&gpio3 22 0>;
+ enable-active-high;
++ vin-supply = <&swbst_reg>;
+ };
+
+ reg_usb_h1_vbus: regulator@1 {
+@@ -45,6 +46,7 @@
+ regulator-max-microvolt = <5000000>;
+ gpio = <&gpio1 29 0>;
+ enable-active-high;
++ vin-supply = <&swbst_reg>;
+ };
+
+ reg_audio: regulator@2 {
+diff --git a/arch/arm/crypto/aesbs-core.S_shipped b/arch/arm/crypto/aesbs-core.S_shipped
+index 71e5fc7cfb18..1d1800f71c5b 100644
+--- a/arch/arm/crypto/aesbs-core.S_shipped
++++ b/arch/arm/crypto/aesbs-core.S_shipped
+@@ -58,14 +58,18 @@
+ # define VFP_ABI_FRAME 0
+ # define BSAES_ASM_EXTENDED_KEY
+ # define XTS_CHAIN_TWEAK
+-# define __ARM_ARCH__ 7
++# define __ARM_ARCH__ __LINUX_ARM_ARCH__
++# define __ARM_MAX_ARCH__ 7
+ #endif
+
+ #ifdef __thumb__
+ # define adrl adr
+ #endif
+
+-#if __ARM_ARCH__>=7
++#if __ARM_MAX_ARCH__>=7
++.arch armv7-a
++.fpu neon
++
+ .text
+ .syntax unified @ ARMv7-capable assembler is expected to handle this
+ #ifdef __thumb2__
+@@ -74,8 +78,6 @@
+ .code 32
+ #endif
+
+-.fpu neon
+-
+ .type _bsaes_decrypt8,%function
+ .align 4
+ _bsaes_decrypt8:
+@@ -2095,9 +2097,11 @@ bsaes_xts_decrypt:
+ vld1.8 {q8}, [r0] @ initial tweak
+ adr r2, .Lxts_magic
+
++#ifndef XTS_CHAIN_TWEAK
+ tst r9, #0xf @ if not multiple of 16
+ it ne @ Thumb2 thing, sanity check in ARM
+ subne r9, #0x10 @ subtract another 16 bytes
++#endif
+ subs r9, #0x80
+
+ blo .Lxts_dec_short
+diff --git a/arch/arm/crypto/bsaes-armv7.pl b/arch/arm/crypto/bsaes-armv7.pl
+index be068db960ee..a4d3856e7d24 100644
+--- a/arch/arm/crypto/bsaes-armv7.pl
++++ b/arch/arm/crypto/bsaes-armv7.pl
+@@ -701,14 +701,18 @@ $code.=<<___;
+ # define VFP_ABI_FRAME 0
+ # define BSAES_ASM_EXTENDED_KEY
+ # define XTS_CHAIN_TWEAK
+-# define __ARM_ARCH__ 7
++# define __ARM_ARCH__ __LINUX_ARM_ARCH__
++# define __ARM_MAX_ARCH__ 7
+ #endif
+
+ #ifdef __thumb__
+ # define adrl adr
+ #endif
+
+-#if __ARM_ARCH__>=7
++#if __ARM_MAX_ARCH__>=7
++.arch armv7-a
++.fpu neon
++
+ .text
+ .syntax unified @ ARMv7-capable assembler is expected to handle this
+ #ifdef __thumb2__
+@@ -717,8 +721,6 @@ $code.=<<___;
+ .code 32
+ #endif
+
+-.fpu neon
+-
+ .type _bsaes_decrypt8,%function
+ .align 4
+ _bsaes_decrypt8:
+@@ -2076,9 +2078,11 @@ bsaes_xts_decrypt:
+ vld1.8 {@XMM[8]}, [r0] @ initial tweak
+ adr $magic, .Lxts_magic
+
++#ifndef XTS_CHAIN_TWEAK
+ tst $len, #0xf @ if not multiple of 16
+ it ne @ Thumb2 thing, sanity check in ARM
+ subne $len, #0x10 @ subtract another 16 bytes
++#endif
+ subs $len, #0x80
+
+ blo .Lxts_dec_short
+diff --git a/arch/arm/mach-at91/pm.h b/arch/arm/mach-at91/pm.h
+index c5101dcb4fb0..1d4df3b70ebc 100644
+--- a/arch/arm/mach-at91/pm.h
++++ b/arch/arm/mach-at91/pm.h
+@@ -45,7 +45,7 @@ static inline void at91rm9200_standby(void)
+ " mcr p15, 0, %0, c7, c0, 4\n\t"
+ " str %5, [%1, %2]"
+ :
+- : "r" (0), "r" (AT91_BASE_SYS), "r" (AT91RM9200_SDRAMC_LPR),
++ : "r" (0), "r" (at91_ramc_base[0]), "r" (AT91RM9200_SDRAMC_LPR),
+ "r" (1), "r" (AT91RM9200_SDRAMC_SRR),
+ "r" (lpr));
+ }
+diff --git a/arch/arm64/include/asm/tlb.h b/arch/arm64/include/asm/tlb.h
+index a82c0c5c8b52..53d9c354219f 100644
+--- a/arch/arm64/include/asm/tlb.h
++++ b/arch/arm64/include/asm/tlb.h
+@@ -19,10 +19,6 @@
+ #ifndef __ASM_TLB_H
+ #define __ASM_TLB_H
+
+-#define __tlb_remove_pmd_tlb_entry __tlb_remove_pmd_tlb_entry
+-
+-#include <asm-generic/tlb.h>
+-
+ #include <linux/pagemap.h>
+ #include <linux/swap.h>
+
+@@ -37,71 +33,23 @@ static inline void __tlb_remove_table(void *_table)
+ #define tlb_remove_entry(tlb, entry) tlb_remove_page(tlb, entry)
+ #endif /* CONFIG_HAVE_RCU_TABLE_FREE */
+
+-/*
+- * There's three ways the TLB shootdown code is used:
+- * 1. Unmapping a range of vmas. See zap_page_range(), unmap_region().
+- * tlb->fullmm = 0, and tlb_start_vma/tlb_end_vma will be called.
+- * 2. Unmapping all vmas. See exit_mmap().
+- * tlb->fullmm = 1, and tlb_start_vma/tlb_end_vma will be called.
+- * Page tables will be freed.
+- * 3. Unmapping argument pages. See shift_arg_pages().
+- * tlb->fullmm = 0, but tlb_start_vma/tlb_end_vma will not be called.
+- */
++#include <asm-generic/tlb.h>
++
+ static inline void tlb_flush(struct mmu_gather *tlb)
+ {
+ if (tlb->fullmm) {
+ flush_tlb_mm(tlb->mm);
+- } else if (tlb->end > 0) {
++ } else {
+ struct vm_area_struct vma = { .vm_mm = tlb->mm, };
+ flush_tlb_range(&vma, tlb->start, tlb->end);
+- tlb->start = TASK_SIZE;
+- tlb->end = 0;
+- }
+-}
+-
+-static inline void tlb_add_flush(struct mmu_gather *tlb, unsigned long addr)
+-{
+- if (!tlb->fullmm) {
+- tlb->start = min(tlb->start, addr);
+- tlb->end = max(tlb->end, addr + PAGE_SIZE);
+- }
+-}
+-
+-/*
+- * Memorize the range for the TLB flush.
+- */
+-static inline void __tlb_remove_tlb_entry(struct mmu_gather *tlb, pte_t *ptep,
+- unsigned long addr)
+-{
+- tlb_add_flush(tlb, addr);
+-}
+-
+-/*
+- * In the case of tlb vma handling, we can optimise these away in the
+- * case where we're doing a full MM flush. When we're doing a munmap,
+- * the vmas are adjusted to only cover the region to be torn down.
+- */
+-static inline void tlb_start_vma(struct mmu_gather *tlb,
+- struct vm_area_struct *vma)
+-{
+- if (!tlb->fullmm) {
+- tlb->start = TASK_SIZE;
+- tlb->end = 0;
+ }
+ }
+
+-static inline void tlb_end_vma(struct mmu_gather *tlb,
+- struct vm_area_struct *vma)
+-{
+- if (!tlb->fullmm)
+- tlb_flush(tlb);
+-}
+-
+ static inline void __pte_free_tlb(struct mmu_gather *tlb, pgtable_t pte,
+ unsigned long addr)
+ {
++ __flush_tlb_pgtable(tlb->mm, addr);
+ pgtable_page_dtor(pte);
+- tlb_add_flush(tlb, addr);
+ tlb_remove_entry(tlb, pte);
+ }
+
+@@ -109,7 +57,7 @@ static inline void __pte_free_tlb(struct mmu_gather *tlb, pgtable_t pte,
+ static inline void __pmd_free_tlb(struct mmu_gather *tlb, pmd_t *pmdp,
+ unsigned long addr)
+ {
+- tlb_add_flush(tlb, addr);
++ __flush_tlb_pgtable(tlb->mm, addr);
+ tlb_remove_entry(tlb, virt_to_page(pmdp));
+ }
+ #endif
+@@ -118,15 +66,9 @@ static inline void __pmd_free_tlb(struct mmu_gather *tlb, pmd_t *pmdp,
+ static inline void __pud_free_tlb(struct mmu_gather *tlb, pud_t *pudp,
+ unsigned long addr)
+ {
+- tlb_add_flush(tlb, addr);
++ __flush_tlb_pgtable(tlb->mm, addr);
+ tlb_remove_entry(tlb, virt_to_page(pudp));
+ }
+ #endif
+
+-static inline void __tlb_remove_pmd_tlb_entry(struct mmu_gather *tlb, pmd_t *pmdp,
+- unsigned long address)
+-{
+- tlb_add_flush(tlb, address);
+-}
+-
+ #endif
+diff --git a/arch/arm64/include/asm/tlbflush.h b/arch/arm64/include/asm/tlbflush.h
+index 73f0ce570fb3..8b8d8cb46e01 100644
+--- a/arch/arm64/include/asm/tlbflush.h
++++ b/arch/arm64/include/asm/tlbflush.h
+@@ -149,6 +149,19 @@ static inline void flush_tlb_kernel_range(unsigned long start, unsigned long end
+ }
+
+ /*
++ * Used to invalidate the TLB (walk caches) corresponding to intermediate page
++ * table levels (pgd/pud/pmd).
++ */
++static inline void __flush_tlb_pgtable(struct mm_struct *mm,
++ unsigned long uaddr)
++{
++ unsigned long addr = uaddr >> 12 | ((unsigned long)ASID(mm) << 48);
++
++ dsb(ishst);
++ asm("tlbi vae1is, %0" : : "r" (addr));
++ dsb(ish);
++}
++/*
+ * On AArch64, the cache coherency is handled via the set_pte_at() function.
+ */
+ static inline void update_mmu_cache(struct vm_area_struct *vma,
+diff --git a/arch/arm64/mm/dma-mapping.c b/arch/arm64/mm/dma-mapping.c
+index d92094203913..df34a70caca1 100644
+--- a/arch/arm64/mm/dma-mapping.c
++++ b/arch/arm64/mm/dma-mapping.c
+@@ -51,7 +51,7 @@ static int __init early_coherent_pool(char *p)
+ }
+ early_param("coherent_pool", early_coherent_pool);
+
+-static void *__alloc_from_pool(size_t size, struct page **ret_page)
++static void *__alloc_from_pool(size_t size, struct page **ret_page, gfp_t flags)
+ {
+ unsigned long val;
+ void *ptr = NULL;
+@@ -67,6 +67,8 @@ static void *__alloc_from_pool(size_t size, struct page **ret_page)
+
+ *ret_page = phys_to_page(phys);
+ ptr = (void *)val;
++ if (flags & __GFP_ZERO)
++ memset(ptr, 0, size);
+ }
+
+ return ptr;
+@@ -101,6 +103,7 @@ static void *__dma_alloc_coherent(struct device *dev, size_t size,
+ flags |= GFP_DMA;
+ if (IS_ENABLED(CONFIG_DMA_CMA) && (flags & __GFP_WAIT)) {
+ struct page *page;
++ void *addr;
+
+ size = PAGE_ALIGN(size);
+ page = dma_alloc_from_contiguous(dev, size >> PAGE_SHIFT,
+@@ -109,7 +112,10 @@ static void *__dma_alloc_coherent(struct device *dev, size_t size,
+ return NULL;
+
+ *dma_handle = phys_to_dma(dev, page_to_phys(page));
+- return page_address(page);
++ addr = page_address(page);
++ if (flags & __GFP_ZERO)
++ memset(addr, 0, size);
++ return addr;
+ } else {
+ return swiotlb_alloc_coherent(dev, size, dma_handle, flags);
+ }
+@@ -145,7 +151,7 @@ static void *__dma_alloc_noncoherent(struct device *dev, size_t size,
+
+ if (!(flags & __GFP_WAIT)) {
+ struct page *page = NULL;
+- void *addr = __alloc_from_pool(size, &page);
++ void *addr = __alloc_from_pool(size, &page, flags);
+
+ if (addr)
+ *dma_handle = phys_to_dma(dev, page_to_phys(page));
+diff --git a/arch/microblaze/include/asm/tlb.h b/arch/microblaze/include/asm/tlb.h
+index 8aa97817cc8c..99b6ded54849 100644
+--- a/arch/microblaze/include/asm/tlb.h
++++ b/arch/microblaze/include/asm/tlb.h
+@@ -14,7 +14,6 @@
+ #define tlb_flush(tlb) flush_tlb_mm((tlb)->mm)
+
+ #include <linux/pagemap.h>
+-#include <asm-generic/tlb.h>
+
+ #ifdef CONFIG_MMU
+ #define tlb_start_vma(tlb, vma) do { } while (0)
+@@ -22,4 +21,6 @@
+ #define __tlb_remove_tlb_entry(tlb, pte, address) do { } while (0)
+ #endif
+
++#include <asm-generic/tlb.h>
++
+ #endif /* _ASM_MICROBLAZE_TLB_H */
+diff --git a/arch/powerpc/include/asm/pgalloc.h b/arch/powerpc/include/asm/pgalloc.h
+index e9a9f60e596d..fc3ee06eab87 100644
+--- a/arch/powerpc/include/asm/pgalloc.h
++++ b/arch/powerpc/include/asm/pgalloc.h
+@@ -3,7 +3,6 @@
+ #ifdef __KERNEL__
+
+ #include <linux/mm.h>
+-#include <asm-generic/tlb.h>
+
+ #ifdef CONFIG_PPC_BOOK3E
+ extern void tlb_flush_pgtable(struct mmu_gather *tlb, unsigned long address);
+@@ -14,6 +13,8 @@ static inline void tlb_flush_pgtable(struct mmu_gather *tlb,
+ }
+ #endif /* !CONFIG_PPC_BOOK3E */
+
++extern void tlb_remove_table(struct mmu_gather *tlb, void *table);
++
+ #ifdef CONFIG_PPC64
+ #include <asm/pgalloc-64.h>
+ #else
+diff --git a/arch/powerpc/include/asm/tlb.h b/arch/powerpc/include/asm/tlb.h
+index e2b428b0f7ba..20733fa518ae 100644
+--- a/arch/powerpc/include/asm/tlb.h
++++ b/arch/powerpc/include/asm/tlb.h
+@@ -27,6 +27,7 @@
+
+ #define tlb_start_vma(tlb, vma) do { } while (0)
+ #define tlb_end_vma(tlb, vma) do { } while (0)
++#define __tlb_remove_tlb_entry __tlb_remove_tlb_entry
+
+ extern void tlb_flush(struct mmu_gather *tlb);
+
+diff --git a/arch/powerpc/mm/hugetlbpage.c b/arch/powerpc/mm/hugetlbpage.c
+index 7e70ae968e5f..6a4a5fcb9730 100644
+--- a/arch/powerpc/mm/hugetlbpage.c
++++ b/arch/powerpc/mm/hugetlbpage.c
+@@ -517,8 +517,6 @@ static void free_hugepd_range(struct mmu_gather *tlb, hugepd_t *hpdp, int pdshif
+ for (i = 0; i < num_hugepd; i++, hpdp++)
+ hpdp->pd = 0;
+
+- tlb->need_flush = 1;
+-
+ #ifdef CONFIG_PPC_FSL_BOOK3E
+ hugepd_free(tlb, hugepte);
+ #else
+diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c
+index ced09d8738b4..49e4d64ff74d 100644
+--- a/arch/s390/kvm/kvm-s390.c
++++ b/arch/s390/kvm/kvm-s390.c
+@@ -152,7 +152,6 @@ int kvm_vm_ioctl_check_extension(struct kvm *kvm, long ext)
+ case KVM_CAP_ONE_REG:
+ case KVM_CAP_ENABLE_CAP:
+ case KVM_CAP_S390_CSS_SUPPORT:
+- case KVM_CAP_IRQFD:
+ case KVM_CAP_IOEVENTFD:
+ case KVM_CAP_DEVICE_CTRL:
+ case KVM_CAP_ENABLE_CAP_VM:
+diff --git a/arch/sparc/kernel/perf_event.c b/arch/sparc/kernel/perf_event.c
+index 46a5e4508752..af53c25da2e7 100644
+--- a/arch/sparc/kernel/perf_event.c
++++ b/arch/sparc/kernel/perf_event.c
+@@ -960,6 +960,8 @@ out:
+ cpuc->pcr[0] |= cpuc->event[0]->hw.config_base;
+ }
+
++static void sparc_pmu_start(struct perf_event *event, int flags);
++
+ /* On this PMU each PIC has it's own PCR control register. */
+ static void calculate_multiple_pcrs(struct cpu_hw_events *cpuc)
+ {
+@@ -972,20 +974,13 @@ static void calculate_multiple_pcrs(struct cpu_hw_events *cpuc)
+ struct perf_event *cp = cpuc->event[i];
+ struct hw_perf_event *hwc = &cp->hw;
+ int idx = hwc->idx;
+- u64 enc;
+
+ if (cpuc->current_idx[i] != PIC_NO_INDEX)
+ continue;
+
+- sparc_perf_event_set_period(cp, hwc, idx);
+ cpuc->current_idx[i] = idx;
+
+- enc = perf_event_get_enc(cpuc->events[i]);
+- cpuc->pcr[idx] &= ~mask_for_index(idx);
+- if (hwc->state & PERF_HES_STOPPED)
+- cpuc->pcr[idx] |= nop_for_index(idx);
+- else
+- cpuc->pcr[idx] |= event_encoding(enc, idx);
++ sparc_pmu_start(cp, PERF_EF_RELOAD);
+ }
+ out:
+ for (i = 0; i < cpuc->n_events; i++) {
+@@ -1101,7 +1096,6 @@ static void sparc_pmu_del(struct perf_event *event, int _flags)
+ int i;
+
+ local_irq_save(flags);
+- perf_pmu_disable(event->pmu);
+
+ for (i = 0; i < cpuc->n_events; i++) {
+ if (event == cpuc->event[i]) {
+@@ -1127,7 +1121,6 @@ static void sparc_pmu_del(struct perf_event *event, int _flags)
+ }
+ }
+
+- perf_pmu_enable(event->pmu);
+ local_irq_restore(flags);
+ }
+
+@@ -1361,7 +1354,6 @@ static int sparc_pmu_add(struct perf_event *event, int ef_flags)
+ unsigned long flags;
+
+ local_irq_save(flags);
+- perf_pmu_disable(event->pmu);
+
+ n0 = cpuc->n_events;
+ if (n0 >= sparc_pmu->max_hw_events)
+@@ -1394,7 +1386,6 @@ nocheck:
+
+ ret = 0;
+ out:
+- perf_pmu_enable(event->pmu);
+ local_irq_restore(flags);
+ return ret;
+ }
+diff --git a/arch/sparc/kernel/process_64.c b/arch/sparc/kernel/process_64.c
+index 0be7bf978cb1..46a59643bb1c 100644
+--- a/arch/sparc/kernel/process_64.c
++++ b/arch/sparc/kernel/process_64.c
+@@ -287,6 +287,8 @@ void arch_trigger_all_cpu_backtrace(bool include_self)
+ printk(" TPC[%lx] O7[%lx] I7[%lx] RPC[%lx]\n",
+ gp->tpc, gp->o7, gp->i7, gp->rpc);
+ }
++
++ touch_nmi_watchdog();
+ }
+
+ memset(global_cpu_snapshot, 0, sizeof(global_cpu_snapshot));
+@@ -362,6 +364,8 @@ static void pmu_snapshot_all_cpus(void)
+ (cpu == this_cpu ? '*' : ' '), cpu,
+ pp->pcr[0], pp->pcr[1], pp->pcr[2], pp->pcr[3],
+ pp->pic[0], pp->pic[1], pp->pic[2], pp->pic[3]);
++
++ touch_nmi_watchdog();
+ }
+
+ memset(global_cpu_snapshot, 0, sizeof(global_cpu_snapshot));
+diff --git a/arch/sparc/kernel/sys_sparc_64.c b/arch/sparc/kernel/sys_sparc_64.c
+index c85403d0496c..30e7ddb27a3a 100644
+--- a/arch/sparc/kernel/sys_sparc_64.c
++++ b/arch/sparc/kernel/sys_sparc_64.c
+@@ -333,7 +333,7 @@ SYSCALL_DEFINE6(sparc_ipc, unsigned int, call, int, first, unsigned long, second
+ long err;
+
+ /* No need for backward compatibility. We can start fresh... */
+- if (call <= SEMCTL) {
++ if (call <= SEMTIMEDOP) {
+ switch (call) {
+ case SEMOP:
+ err = sys_semtimedop(first, ptr,
+diff --git a/arch/sparc/lib/memmove.S b/arch/sparc/lib/memmove.S
+index b7f6334e159f..857ad4f8905f 100644
+--- a/arch/sparc/lib/memmove.S
++++ b/arch/sparc/lib/memmove.S
+@@ -8,9 +8,11 @@
+
+ .text
+ ENTRY(memmove) /* o0=dst o1=src o2=len */
+- mov %o0, %g1
++ brz,pn %o2, 99f
++ mov %o0, %g1
++
+ cmp %o0, %o1
+- bleu,pt %xcc, memcpy
++ bleu,pt %xcc, 2f
+ add %o1, %o2, %g7
+ cmp %g7, %o0
+ bleu,pt %xcc, memcpy
+@@ -24,7 +26,34 @@ ENTRY(memmove) /* o0=dst o1=src o2=len */
+ stb %g7, [%o0]
+ bne,pt %icc, 1b
+ sub %o0, 1, %o0
+-
++99:
+ retl
+ mov %g1, %o0
++
++ /* We can't just call memcpy for these memmove cases. On some
++ * chips the memcpy uses cache initializing stores and when dst
++ * and src are close enough, those can clobber the source data
++ * before we've loaded it in.
++ */
++2: or %o0, %o1, %g7
++ or %o2, %g7, %g7
++ andcc %g7, 0x7, %g0
++ bne,pn %xcc, 4f
++ nop
++
++3: ldx [%o1], %g7
++ add %o1, 8, %o1
++ subcc %o2, 8, %o2
++ add %o0, 8, %o0
++ bne,pt %icc, 3b
++ stx %g7, [%o0 - 0x8]
++ ba,a,pt %xcc, 99b
++
++4: ldub [%o1], %g7
++ add %o1, 1, %o1
++ subcc %o2, 1, %o2
++ add %o0, 1, %o0
++ bne,pt %icc, 4b
++ stb %g7, [%o0 - 0x1]
++ ba,a,pt %xcc, 99b
+ ENDPROC(memmove)
+diff --git a/arch/sparc/mm/srmmu.c b/arch/sparc/mm/srmmu.c
+index be65f035d18a..5cbc96d801ff 100644
+--- a/arch/sparc/mm/srmmu.c
++++ b/arch/sparc/mm/srmmu.c
+@@ -460,10 +460,12 @@ static void __init sparc_context_init(int numctx)
+ void switch_mm(struct mm_struct *old_mm, struct mm_struct *mm,
+ struct task_struct *tsk)
+ {
++ unsigned long flags;
++
+ if (mm->context == NO_CONTEXT) {
+- spin_lock(&srmmu_context_spinlock);
++ spin_lock_irqsave(&srmmu_context_spinlock, flags);
+ alloc_context(old_mm, mm);
+- spin_unlock(&srmmu_context_spinlock);
++ spin_unlock_irqrestore(&srmmu_context_spinlock, flags);
+ srmmu_ctxd_set(&srmmu_context_table[mm->context], mm->pgd);
+ }
+
+@@ -986,14 +988,15 @@ int init_new_context(struct task_struct *tsk, struct mm_struct *mm)
+
+ void destroy_context(struct mm_struct *mm)
+ {
++ unsigned long flags;
+
+ if (mm->context != NO_CONTEXT) {
+ flush_cache_mm(mm);
+ srmmu_ctxd_set(&srmmu_context_table[mm->context], srmmu_swapper_pg_dir);
+ flush_tlb_mm(mm);
+- spin_lock(&srmmu_context_spinlock);
++ spin_lock_irqsave(&srmmu_context_spinlock, flags);
+ free_context(mm->context);
+- spin_unlock(&srmmu_context_spinlock);
++ spin_unlock_irqrestore(&srmmu_context_spinlock, flags);
+ mm->context = NO_CONTEXT;
+ }
+ }
+diff --git a/arch/x86/crypto/aesni-intel_glue.c b/arch/x86/crypto/aesni-intel_glue.c
+index 70fece226d17..5a93783a8a0d 100644
+--- a/arch/x86/crypto/aesni-intel_glue.c
++++ b/arch/x86/crypto/aesni-intel_glue.c
+@@ -1137,7 +1137,7 @@ static int __driver_rfc4106_decrypt(struct aead_request *req)
+ src = kmalloc(req->cryptlen + req->assoclen, GFP_ATOMIC);
+ if (!src)
+ return -ENOMEM;
+- assoc = (src + req->cryptlen + auth_tag_len);
++ assoc = (src + req->cryptlen);
+ scatterwalk_map_and_copy(src, req->src, 0, req->cryptlen, 0);
+ scatterwalk_map_and_copy(assoc, req->assoc, 0,
+ req->assoclen, 0);
+@@ -1162,7 +1162,7 @@ static int __driver_rfc4106_decrypt(struct aead_request *req)
+ scatterwalk_done(&src_sg_walk, 0, 0);
+ scatterwalk_done(&assoc_sg_walk, 0, 0);
+ } else {
+- scatterwalk_map_and_copy(dst, req->dst, 0, req->cryptlen, 1);
++ scatterwalk_map_and_copy(dst, req->dst, 0, tempCipherLen, 1);
+ kfree(src);
+ }
+ return retval;
+diff --git a/arch/x86/include/asm/fpu-internal.h b/arch/x86/include/asm/fpu-internal.h
+index e97622f57722..f895358db0ab 100644
+--- a/arch/x86/include/asm/fpu-internal.h
++++ b/arch/x86/include/asm/fpu-internal.h
+@@ -368,7 +368,7 @@ static inline void drop_fpu(struct task_struct *tsk)
+ preempt_disable();
+ tsk->thread.fpu_counter = 0;
+ __drop_fpu(tsk);
+- clear_used_math();
++ clear_stopped_child_used_math(tsk);
+ preempt_enable();
+ }
+
+diff --git a/arch/x86/kernel/apic/apic_numachip.c b/arch/x86/kernel/apic/apic_numachip.c
+index 4128b5fcb559..2aaee79fb129 100644
+--- a/arch/x86/kernel/apic/apic_numachip.c
++++ b/arch/x86/kernel/apic/apic_numachip.c
+@@ -40,7 +40,7 @@ static unsigned int get_apic_id(unsigned long x)
+ unsigned int id;
+
+ rdmsrl(MSR_FAM10H_NODE_ID, value);
+- id = ((x >> 24) & 0xffU) | ((value << 2) & 0x3f00U);
++ id = ((x >> 24) & 0xffU) | ((value << 2) & 0xff00U);
+
+ return id;
+ }
+diff --git a/arch/x86/kernel/xsave.c b/arch/x86/kernel/xsave.c
+index 0de1fae2bdf0..8be1e1711203 100644
+--- a/arch/x86/kernel/xsave.c
++++ b/arch/x86/kernel/xsave.c
+@@ -378,7 +378,7 @@ int __restore_xstate_sig(void __user *buf, void __user *buf_fx, int size)
+ * thread's fpu state, reconstruct fxstate from the fsave
+ * header. Sanitize the copied state etc.
+ */
+- struct xsave_struct *xsave = &tsk->thread.fpu.state->xsave;
++ struct fpu *fpu = &tsk->thread.fpu;
+ struct user_i387_ia32_struct env;
+ int err = 0;
+
+@@ -392,14 +392,15 @@ int __restore_xstate_sig(void __user *buf, void __user *buf_fx, int size)
+ */
+ drop_fpu(tsk);
+
+- if (__copy_from_user(xsave, buf_fx, state_size) ||
++ if (__copy_from_user(&fpu->state->xsave, buf_fx, state_size) ||
+ __copy_from_user(&env, buf, sizeof(env))) {
++ fpu_finit(fpu);
+ err = -1;
+ } else {
+ sanitize_restored_xstate(tsk, &env, xstate_bv, fx_only);
+- set_used_math();
+ }
+
++ set_used_math();
+ if (use_eager_fpu()) {
+ preempt_disable();
+ math_state_restore();
+diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
+index 8b92cf4b165a..a38dd816015b 100644
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -2713,7 +2713,6 @@ int kvm_vm_ioctl_check_extension(struct kvm *kvm, long ext)
+ case KVM_CAP_USER_NMI:
+ case KVM_CAP_REINJECT_CONTROL:
+ case KVM_CAP_IRQ_INJECT_STATUS:
+- case KVM_CAP_IRQFD:
+ case KVM_CAP_IOEVENTFD:
+ case KVM_CAP_IOEVENTFD_NO_LENGTH:
+ case KVM_CAP_PIT2:
+diff --git a/arch/x86/vdso/vdso32/sigreturn.S b/arch/x86/vdso/vdso32/sigreturn.S
+index 31776d0efc8c..d7ec4e251c0a 100644
+--- a/arch/x86/vdso/vdso32/sigreturn.S
++++ b/arch/x86/vdso/vdso32/sigreturn.S
+@@ -17,6 +17,7 @@
+ .text
+ .globl __kernel_sigreturn
+ .type __kernel_sigreturn,@function
++ nop /* this guy is needed for .LSTARTFDEDLSI1 below (watch for HACK) */
+ ALIGN
+ __kernel_sigreturn:
+ .LSTART_sigreturn:
+diff --git a/drivers/char/tpm/tpm_i2c_stm_st33.c b/drivers/char/tpm/tpm_i2c_stm_st33.c
+index 7d1c540fa26a..3f187a529e92 100644
+--- a/drivers/char/tpm/tpm_i2c_stm_st33.c
++++ b/drivers/char/tpm/tpm_i2c_stm_st33.c
+@@ -397,7 +397,7 @@ static int wait_for_stat(struct tpm_chip *chip, u8 mask, unsigned long timeout,
+ */
+ static int recv_data(struct tpm_chip *chip, u8 *buf, size_t count)
+ {
+- int size = 0, burstcnt, len;
++ int size = 0, burstcnt, len, ret;
+ struct i2c_client *client;
+
+ client = (struct i2c_client *)TPM_VPRIV(chip);
+@@ -406,13 +406,15 @@ static int recv_data(struct tpm_chip *chip, u8 *buf, size_t count)
+ wait_for_stat(chip,
+ TPM_STS_DATA_AVAIL | TPM_STS_VALID,
+ chip->vendor.timeout_c,
+- &chip->vendor.read_queue)
+- == 0) {
++ &chip->vendor.read_queue) == 0) {
+ burstcnt = get_burstcount(chip);
+ if (burstcnt < 0)
+ return burstcnt;
+ len = min_t(int, burstcnt, count - size);
+- I2C_READ_DATA(client, TPM_DATA_FIFO, buf + size, len);
++ ret = I2C_READ_DATA(client, TPM_DATA_FIFO, buf + size, len);
++ if (ret < 0)
++ return ret;
++
+ size += len;
+ }
+ return size;
+diff --git a/drivers/char/tpm/tpm_ibmvtpm.c b/drivers/char/tpm/tpm_ibmvtpm.c
+index eff9d5870034..102463ba745d 100644
+--- a/drivers/char/tpm/tpm_ibmvtpm.c
++++ b/drivers/char/tpm/tpm_ibmvtpm.c
+@@ -124,7 +124,7 @@ static int tpm_ibmvtpm_send(struct tpm_chip *chip, u8 *buf, size_t count)
+ {
+ struct ibmvtpm_dev *ibmvtpm;
+ struct ibmvtpm_crq crq;
+- u64 *word = (u64 *) &crq;
++ __be64 *word = (__be64 *)&crq;
+ int rc;
+
+ ibmvtpm = (struct ibmvtpm_dev *)TPM_VPRIV(chip);
+@@ -145,11 +145,11 @@ static int tpm_ibmvtpm_send(struct tpm_chip *chip, u8 *buf, size_t count)
+ memcpy((void *)ibmvtpm->rtce_buf, (void *)buf, count);
+ crq.valid = (u8)IBMVTPM_VALID_CMD;
+ crq.msg = (u8)VTPM_TPM_COMMAND;
+- crq.len = (u16)count;
+- crq.data = ibmvtpm->rtce_dma_handle;
++ crq.len = cpu_to_be16(count);
++ crq.data = cpu_to_be32(ibmvtpm->rtce_dma_handle);
+
+- rc = ibmvtpm_send_crq(ibmvtpm->vdev, cpu_to_be64(word[0]),
+- cpu_to_be64(word[1]));
++ rc = ibmvtpm_send_crq(ibmvtpm->vdev, be64_to_cpu(word[0]),
++ be64_to_cpu(word[1]));
+ if (rc != H_SUCCESS) {
+ dev_err(ibmvtpm->dev, "tpm_ibmvtpm_send failed rc=%d\n", rc);
+ rc = 0;
+diff --git a/drivers/char/tpm/tpm_ibmvtpm.h b/drivers/char/tpm/tpm_ibmvtpm.h
+index bd82a791f995..b2c231b1beec 100644
+--- a/drivers/char/tpm/tpm_ibmvtpm.h
++++ b/drivers/char/tpm/tpm_ibmvtpm.h
+@@ -22,9 +22,9 @@
+ struct ibmvtpm_crq {
+ u8 valid;
+ u8 msg;
+- u16 len;
+- u32 data;
+- u64 reserved;
++ __be16 len;
++ __be32 data;
++ __be64 reserved;
+ } __attribute__((packed, aligned(8)));
+
+ struct ibmvtpm_crq_queue {
+diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
+index cf7a561fad7c..6e09c1dac2b7 100644
+--- a/drivers/char/virtio_console.c
++++ b/drivers/char/virtio_console.c
+@@ -142,6 +142,7 @@ struct ports_device {
+ * notification
+ */
+ struct work_struct control_work;
++ struct work_struct config_work;
+
+ struct list_head ports;
+
+@@ -1832,10 +1833,21 @@ static void config_intr(struct virtio_device *vdev)
+
+ portdev = vdev->priv;
+
++ if (!use_multiport(portdev))
++ schedule_work(&portdev->config_work);
++}
++
++static void config_work_handler(struct work_struct *work)
++{
++ struct ports_device *portdev;
++
++ portdev = container_of(work, struct ports_device, control_work);
+ if (!use_multiport(portdev)) {
++ struct virtio_device *vdev;
+ struct port *port;
+ u16 rows, cols;
+
++ vdev = portdev->vdev;
+ virtio_cread(vdev, struct virtio_console_config, cols, &cols);
+ virtio_cread(vdev, struct virtio_console_config, rows, &rows);
+
+@@ -2026,12 +2038,14 @@ static int virtcons_probe(struct virtio_device *vdev)
+
+ virtio_device_ready(portdev->vdev);
+
++ INIT_WORK(&portdev->config_work, &config_work_handler);
++ INIT_WORK(&portdev->control_work, &control_work_handler);
++
+ if (multiport) {
+ unsigned int nr_added_bufs;
+
+ spin_lock_init(&portdev->c_ivq_lock);
+ spin_lock_init(&portdev->c_ovq_lock);
+- INIT_WORK(&portdev->control_work, &control_work_handler);
+
+ nr_added_bufs = fill_queue(portdev->c_ivq,
+ &portdev->c_ivq_lock);
+@@ -2099,6 +2113,8 @@ static void virtcons_remove(struct virtio_device *vdev)
+ /* Finish up work that's lined up */
+ if (use_multiport(portdev))
+ cancel_work_sync(&portdev->control_work);
++ else
++ cancel_work_sync(&portdev->config_work);
+
+ list_for_each_entry_safe(port, port2, &portdev->ports, list)
+ unplug_port(port);
+@@ -2150,6 +2166,7 @@ static int virtcons_freeze(struct virtio_device *vdev)
+
+ virtqueue_disable_cb(portdev->c_ivq);
+ cancel_work_sync(&portdev->control_work);
++ cancel_work_sync(&portdev->config_work);
+ /*
+ * Once more: if control_work_handler() was running, it would
+ * enable the cb as the last step.
+diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c
+index e79c8d3700d8..da41ad42d3a6 100644
+--- a/drivers/gpu/drm/drm_crtc.c
++++ b/drivers/gpu/drm/drm_crtc.c
+@@ -42,9 +42,10 @@
+ #include "drm_crtc_internal.h"
+ #include "drm_internal.h"
+
+-static struct drm_framebuffer *add_framebuffer_internal(struct drm_device *dev,
+- struct drm_mode_fb_cmd2 *r,
+- struct drm_file *file_priv);
++static struct drm_framebuffer *
++internal_framebuffer_create(struct drm_device *dev,
++ struct drm_mode_fb_cmd2 *r,
++ struct drm_file *file_priv);
+
+ /* Avoid boilerplate. I'm tired of typing. */
+ #define DRM_ENUM_NAME_FN(fnname, list) \
+@@ -2739,13 +2740,11 @@ static int drm_mode_cursor_universal(struct drm_crtc *crtc,
+ */
+ if (req->flags & DRM_MODE_CURSOR_BO) {
+ if (req->handle) {
+- fb = add_framebuffer_internal(dev, &fbreq, file_priv);
++ fb = internal_framebuffer_create(dev, &fbreq, file_priv);
+ if (IS_ERR(fb)) {
+ DRM_DEBUG_KMS("failed to wrap cursor buffer in drm framebuffer\n");
+ return PTR_ERR(fb);
+ }
+-
+- drm_framebuffer_reference(fb);
+ } else {
+ fb = NULL;
+ }
+@@ -3114,9 +3113,10 @@ static int framebuffer_check(const struct drm_mode_fb_cmd2 *r)
+ return 0;
+ }
+
+-static struct drm_framebuffer *add_framebuffer_internal(struct drm_device *dev,
+- struct drm_mode_fb_cmd2 *r,
+- struct drm_file *file_priv)
++static struct drm_framebuffer *
++internal_framebuffer_create(struct drm_device *dev,
++ struct drm_mode_fb_cmd2 *r,
++ struct drm_file *file_priv)
+ {
+ struct drm_mode_config *config = &dev->mode_config;
+ struct drm_framebuffer *fb;
+@@ -3148,12 +3148,6 @@ static struct drm_framebuffer *add_framebuffer_internal(struct drm_device *dev,
+ return fb;
+ }
+
+- mutex_lock(&file_priv->fbs_lock);
+- r->fb_id = fb->base.id;
+- list_add(&fb->filp_head, &file_priv->fbs);
+- DRM_DEBUG_KMS("[FB:%d]\n", fb->base.id);
+- mutex_unlock(&file_priv->fbs_lock);
+-
+ return fb;
+ }
+
+@@ -3175,15 +3169,24 @@ static struct drm_framebuffer *add_framebuffer_internal(struct drm_device *dev,
+ int drm_mode_addfb2(struct drm_device *dev,
+ void *data, struct drm_file *file_priv)
+ {
++ struct drm_mode_fb_cmd2 *r = data;
+ struct drm_framebuffer *fb;
+
+ if (!drm_core_check_feature(dev, DRIVER_MODESET))
+ return -EINVAL;
+
+- fb = add_framebuffer_internal(dev, data, file_priv);
++ fb = internal_framebuffer_create(dev, r, file_priv);
+ if (IS_ERR(fb))
+ return PTR_ERR(fb);
+
++ /* Transfer ownership to the filp for reaping on close */
++
++ DRM_DEBUG_KMS("[FB:%d]\n", fb->base.id);
++ mutex_lock(&file_priv->fbs_lock);
++ r->fb_id = fb->base.id;
++ list_add(&fb->filp_head, &file_priv->fbs);
++ mutex_unlock(&file_priv->fbs_lock);
++
+ return 0;
+ }
+
+diff --git a/drivers/gpu/drm/radeon/atombios_crtc.c b/drivers/gpu/drm/radeon/atombios_crtc.c
+index dce0d3918fa7..9f0e62529c46 100644
+--- a/drivers/gpu/drm/radeon/atombios_crtc.c
++++ b/drivers/gpu/drm/radeon/atombios_crtc.c
+@@ -1405,6 +1405,9 @@ static int dce4_crtc_do_set_base(struct drm_crtc *crtc,
+ (x << 16) | y);
+ viewport_w = crtc->mode.hdisplay;
+ viewport_h = (crtc->mode.vdisplay + 1) & ~1;
++ if ((rdev->family >= CHIP_BONAIRE) &&
++ (crtc->mode.flags & DRM_MODE_FLAG_INTERLACE))
++ viewport_h *= 2;
+ WREG32(EVERGREEN_VIEWPORT_SIZE + radeon_crtc->crtc_offset,
+ (viewport_w << 16) | viewport_h);
+
+diff --git a/drivers/gpu/drm/radeon/cik.c b/drivers/gpu/drm/radeon/cik.c
+index 5f395be9b3e3..0c6fbc0198a5 100644
+--- a/drivers/gpu/drm/radeon/cik.c
++++ b/drivers/gpu/drm/radeon/cik.c
+@@ -7555,6 +7555,9 @@ int cik_irq_set(struct radeon_device *rdev)
+ WREG32(DC_HPD5_INT_CONTROL, hpd5);
+ WREG32(DC_HPD6_INT_CONTROL, hpd6);
+
++ /* posting read */
++ RREG32(SRBM_STATUS);
++
+ return 0;
+ }
+
+diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c
+index 85995b4e3338..c674f63d7f14 100644
+--- a/drivers/gpu/drm/radeon/evergreen.c
++++ b/drivers/gpu/drm/radeon/evergreen.c
+@@ -4589,6 +4589,9 @@ int evergreen_irq_set(struct radeon_device *rdev)
+ WREG32(AFMT_AUDIO_PACKET_CONTROL + EVERGREEN_CRTC4_REGISTER_OFFSET, afmt5);
+ WREG32(AFMT_AUDIO_PACKET_CONTROL + EVERGREEN_CRTC5_REGISTER_OFFSET, afmt6);
+
++ /* posting read */
++ RREG32(SRBM_STATUS);
++
+ return 0;
+ }
+
+diff --git a/drivers/gpu/drm/radeon/r100.c b/drivers/gpu/drm/radeon/r100.c
+index cdf6e2149539..a959cc1e7c8e 100644
+--- a/drivers/gpu/drm/radeon/r100.c
++++ b/drivers/gpu/drm/radeon/r100.c
+@@ -728,6 +728,10 @@ int r100_irq_set(struct radeon_device *rdev)
+ tmp |= RADEON_FP2_DETECT_MASK;
+ }
+ WREG32(RADEON_GEN_INT_CNTL, tmp);
++
++ /* read back to post the write */
++ RREG32(RADEON_GEN_INT_CNTL);
++
+ return 0;
+ }
+
+diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c
+index 56b02927cd3d..ee0868dec2f4 100644
+--- a/drivers/gpu/drm/radeon/r600.c
++++ b/drivers/gpu/drm/radeon/r600.c
+@@ -3787,6 +3787,9 @@ int r600_irq_set(struct radeon_device *rdev)
+ WREG32(RV770_CG_THERMAL_INT, thermal_int);
+ }
+
++ /* posting read */
++ RREG32(R_000E50_SRBM_STATUS);
++
+ return 0;
+ }
+
+diff --git a/drivers/gpu/drm/radeon/radeon_cs.c b/drivers/gpu/drm/radeon/radeon_cs.c
+index 6f377de099f9..a5b7f6f98f5f 100644
+--- a/drivers/gpu/drm/radeon/radeon_cs.c
++++ b/drivers/gpu/drm/radeon/radeon_cs.c
+@@ -275,11 +275,13 @@ int radeon_cs_parser_init(struct radeon_cs_parser *p, void *data)
+ u32 ring = RADEON_CS_RING_GFX;
+ s32 priority = 0;
+
++ INIT_LIST_HEAD(&p->validated);
++
+ if (!cs->num_chunks) {
+ return 0;
+ }
++
+ /* get chunks */
+- INIT_LIST_HEAD(&p->validated);
+ p->idx = 0;
+ p->ib.sa_bo = NULL;
+ p->ib.semaphore = NULL;
+diff --git a/drivers/gpu/drm/radeon/radeon_fence.c b/drivers/gpu/drm/radeon/radeon_fence.c
+index 995167025282..8569afaba688 100644
+--- a/drivers/gpu/drm/radeon/radeon_fence.c
++++ b/drivers/gpu/drm/radeon/radeon_fence.c
+@@ -1029,37 +1029,59 @@ static inline bool radeon_test_signaled(struct radeon_fence *fence)
+ return test_bit(FENCE_FLAG_SIGNALED_BIT, &fence->base.flags);
+ }
+
++struct radeon_wait_cb {
++ struct fence_cb base;
++ struct task_struct *task;
++};
++
++static void
++radeon_fence_wait_cb(struct fence *fence, struct fence_cb *cb)
++{
++ struct radeon_wait_cb *wait =
++ container_of(cb, struct radeon_wait_cb, base);
++
++ wake_up_process(wait->task);
++}
++
+ static signed long radeon_fence_default_wait(struct fence *f, bool intr,
+ signed long t)
+ {
+ struct radeon_fence *fence = to_radeon_fence(f);
+ struct radeon_device *rdev = fence->rdev;
+- bool signaled;
++ struct radeon_wait_cb cb;
+
+- fence_enable_sw_signaling(&fence->base);
++ cb.task = current;
+
+- /*
+- * This function has to return -EDEADLK, but cannot hold
+- * exclusive_lock during the wait because some callers
+- * may already hold it. This means checking needs_reset without
+- * lock, and not fiddling with any gpu internals.
+- *
+- * The callback installed with fence_enable_sw_signaling will
+- * run before our wait_event_*timeout call, so we will see
+- * both the signaled fence and the changes to needs_reset.
+- */
++ if (fence_add_callback(f, &cb.base, radeon_fence_wait_cb))
++ return t;
++
++ while (t > 0) {
++ if (intr)
++ set_current_state(TASK_INTERRUPTIBLE);
++ else
++ set_current_state(TASK_UNINTERRUPTIBLE);
++
++ /*
++ * radeon_test_signaled must be called after
++ * set_current_state to prevent a race with wake_up_process
++ */
++ if (radeon_test_signaled(fence))
++ break;
++
++ if (rdev->needs_reset) {
++ t = -EDEADLK;
++ break;
++ }
++
++ t = schedule_timeout(t);
++
++ if (t > 0 && intr && signal_pending(current))
++ t = -ERESTARTSYS;
++ }
++
++ __set_current_state(TASK_RUNNING);
++ fence_remove_callback(f, &cb.base);
+
+- if (intr)
+- t = wait_event_interruptible_timeout(rdev->fence_queue,
+- ((signaled = radeon_test_signaled(fence)) ||
+- rdev->needs_reset), t);
+- else
+- t = wait_event_timeout(rdev->fence_queue,
+- ((signaled = radeon_test_signaled(fence)) ||
+- rdev->needs_reset), t);
+-
+- if (t > 0 && !signaled)
+- return -EDEADLK;
+ return t;
+ }
+
+diff --git a/drivers/gpu/drm/radeon/radeon_object.c b/drivers/gpu/drm/radeon/radeon_object.c
+index 194f6245c379..2a7ba30165c7 100644
+--- a/drivers/gpu/drm/radeon/radeon_object.c
++++ b/drivers/gpu/drm/radeon/radeon_object.c
+@@ -151,19 +151,6 @@ void radeon_ttm_placement_from_domain(struct radeon_bo *rbo, u32 domain)
+ else
+ rbo->placements[i].lpfn = 0;
+ }
+-
+- /*
+- * Use two-ended allocation depending on the buffer size to
+- * improve fragmentation quality.
+- * 512kb was measured as the most optimal number.
+- */
+- if (!((rbo->flags & RADEON_GEM_CPU_ACCESS) &&
+- (rbo->placements[i].flags & TTM_PL_FLAG_VRAM)) &&
+- rbo->tbo.mem.size > 512 * 1024) {
+- for (i = 0; i < c; i++) {
+- rbo->placements[i].flags |= TTM_PL_FLAG_TOPDOWN;
+- }
+- }
+ }
+
+ int radeon_bo_create(struct radeon_device *rdev,
+diff --git a/drivers/gpu/drm/radeon/rs600.c b/drivers/gpu/drm/radeon/rs600.c
+index 74bce91aecc1..039660662ee8 100644
+--- a/drivers/gpu/drm/radeon/rs600.c
++++ b/drivers/gpu/drm/radeon/rs600.c
+@@ -693,6 +693,10 @@ int rs600_irq_set(struct radeon_device *rdev)
+ WREG32(R_007D18_DC_HOT_PLUG_DETECT2_INT_CONTROL, hpd2);
+ if (ASIC_IS_DCE2(rdev))
+ WREG32(R_007408_HDMI0_AUDIO_PACKET_CONTROL, hdmi0);
++
++ /* posting read */
++ RREG32(R_000040_GEN_INT_CNTL);
++
+ return 0;
+ }
+
+diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c
+index 7d5083dc4acb..1c3d90c17cb3 100644
+--- a/drivers/gpu/drm/radeon/si.c
++++ b/drivers/gpu/drm/radeon/si.c
+@@ -6192,6 +6192,9 @@ int si_irq_set(struct radeon_device *rdev)
+
+ WREG32(CG_THERMAL_INT, thermal_int);
+
++ /* posting read */
++ RREG32(SRBM_STATUS);
++
+ return 0;
+ }
+
+@@ -7112,8 +7115,7 @@ int si_set_uvd_clocks(struct radeon_device *rdev, u32 vclk, u32 dclk)
+ WREG32_P(CG_UPLL_FUNC_CNTL, UPLL_BYPASS_EN_MASK, ~UPLL_BYPASS_EN_MASK);
+
+ if (!vclk || !dclk) {
+- /* keep the Bypass mode, put PLL to sleep */
+- WREG32_P(CG_UPLL_FUNC_CNTL, UPLL_SLEEP_MASK, ~UPLL_SLEEP_MASK);
++ /* keep the Bypass mode */
+ return 0;
+ }
+
+@@ -7129,8 +7131,7 @@ int si_set_uvd_clocks(struct radeon_device *rdev, u32 vclk, u32 dclk)
+ /* set VCO_MODE to 1 */
+ WREG32_P(CG_UPLL_FUNC_CNTL, UPLL_VCO_MODE_MASK, ~UPLL_VCO_MODE_MASK);
+
+- /* toggle UPLL_SLEEP to 1 then back to 0 */
+- WREG32_P(CG_UPLL_FUNC_CNTL, UPLL_SLEEP_MASK, ~UPLL_SLEEP_MASK);
++ /* disable sleep mode */
+ WREG32_P(CG_UPLL_FUNC_CNTL, 0, ~UPLL_SLEEP_MASK);
+
+ /* deassert UPLL_RESET */
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
+index 810dac80179c..0426b5bed8fc 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
+@@ -725,32 +725,6 @@ static int vmw_driver_load(struct drm_device *dev, unsigned long chipset)
+ goto out_err1;
+ }
+
+- ret = ttm_bo_init_mm(&dev_priv->bdev, TTM_PL_VRAM,
+- (dev_priv->vram_size >> PAGE_SHIFT));
+- if (unlikely(ret != 0)) {
+- DRM_ERROR("Failed initializing memory manager for VRAM.\n");
+- goto out_err2;
+- }
+-
+- dev_priv->has_gmr = true;
+- if (((dev_priv->capabilities & (SVGA_CAP_GMR | SVGA_CAP_GMR2)) == 0) ||
+- refuse_dma || ttm_bo_init_mm(&dev_priv->bdev, VMW_PL_GMR,
+- VMW_PL_GMR) != 0) {
+- DRM_INFO("No GMR memory available. "
+- "Graphics memory resources are very limited.\n");
+- dev_priv->has_gmr = false;
+- }
+-
+- if (dev_priv->capabilities & SVGA_CAP_GBOBJECTS) {
+- dev_priv->has_mob = true;
+- if (ttm_bo_init_mm(&dev_priv->bdev, VMW_PL_MOB,
+- VMW_PL_MOB) != 0) {
+- DRM_INFO("No MOB memory available. "
+- "3D will be disabled.\n");
+- dev_priv->has_mob = false;
+- }
+- }
+-
+ dev_priv->mmio_mtrr = arch_phys_wc_add(dev_priv->mmio_start,
+ dev_priv->mmio_size);
+
+@@ -813,6 +787,33 @@ static int vmw_driver_load(struct drm_device *dev, unsigned long chipset)
+ goto out_no_fman;
+ }
+
++
++ ret = ttm_bo_init_mm(&dev_priv->bdev, TTM_PL_VRAM,
++ (dev_priv->vram_size >> PAGE_SHIFT));
++ if (unlikely(ret != 0)) {
++ DRM_ERROR("Failed initializing memory manager for VRAM.\n");
++ goto out_no_vram;
++ }
++
++ dev_priv->has_gmr = true;
++ if (((dev_priv->capabilities & (SVGA_CAP_GMR | SVGA_CAP_GMR2)) == 0) ||
++ refuse_dma || ttm_bo_init_mm(&dev_priv->bdev, VMW_PL_GMR,
++ VMW_PL_GMR) != 0) {
++ DRM_INFO("No GMR memory available. "
++ "Graphics memory resources are very limited.\n");
++ dev_priv->has_gmr = false;
++ }
++
++ if (dev_priv->capabilities & SVGA_CAP_GBOBJECTS) {
++ dev_priv->has_mob = true;
++ if (ttm_bo_init_mm(&dev_priv->bdev, VMW_PL_MOB,
++ VMW_PL_MOB) != 0) {
++ DRM_INFO("No MOB memory available. "
++ "3D will be disabled.\n");
++ dev_priv->has_mob = false;
++ }
++ }
++
+ vmw_kms_save_vga(dev_priv);
+
+ /* Start kms and overlay systems, needs fifo. */
+@@ -838,6 +839,12 @@ out_no_fifo:
+ vmw_kms_close(dev_priv);
+ out_no_kms:
+ vmw_kms_restore_vga(dev_priv);
++ if (dev_priv->has_mob)
++ (void) ttm_bo_clean_mm(&dev_priv->bdev, VMW_PL_MOB);
++ if (dev_priv->has_gmr)
++ (void) ttm_bo_clean_mm(&dev_priv->bdev, VMW_PL_GMR);
++ (void)ttm_bo_clean_mm(&dev_priv->bdev, TTM_PL_VRAM);
++out_no_vram:
+ vmw_fence_manager_takedown(dev_priv->fman);
+ out_no_fman:
+ if (dev_priv->capabilities & SVGA_CAP_IRQMASK)
+@@ -853,12 +860,6 @@ out_err4:
+ iounmap(dev_priv->mmio_virt);
+ out_err3:
+ arch_phys_wc_del(dev_priv->mmio_mtrr);
+- if (dev_priv->has_mob)
+- (void) ttm_bo_clean_mm(&dev_priv->bdev, VMW_PL_MOB);
+- if (dev_priv->has_gmr)
+- (void) ttm_bo_clean_mm(&dev_priv->bdev, VMW_PL_GMR);
+- (void)ttm_bo_clean_mm(&dev_priv->bdev, TTM_PL_VRAM);
+-out_err2:
+ (void)ttm_bo_device_release(&dev_priv->bdev);
+ out_err1:
+ vmw_ttm_global_release(dev_priv);
+@@ -888,6 +889,13 @@ static int vmw_driver_unload(struct drm_device *dev)
+ }
+ vmw_kms_close(dev_priv);
+ vmw_overlay_close(dev_priv);
++
++ if (dev_priv->has_mob)
++ (void) ttm_bo_clean_mm(&dev_priv->bdev, VMW_PL_MOB);
++ if (dev_priv->has_gmr)
++ (void)ttm_bo_clean_mm(&dev_priv->bdev, VMW_PL_GMR);
++ (void)ttm_bo_clean_mm(&dev_priv->bdev, TTM_PL_VRAM);
++
+ vmw_fence_manager_takedown(dev_priv->fman);
+ if (dev_priv->capabilities & SVGA_CAP_IRQMASK)
+ drm_irq_uninstall(dev_priv->dev);
+@@ -899,11 +907,6 @@ static int vmw_driver_unload(struct drm_device *dev)
+ ttm_object_device_release(&dev_priv->tdev);
+ iounmap(dev_priv->mmio_virt);
+ arch_phys_wc_del(dev_priv->mmio_mtrr);
+- if (dev_priv->has_mob)
+- (void) ttm_bo_clean_mm(&dev_priv->bdev, VMW_PL_MOB);
+- if (dev_priv->has_gmr)
+- (void)ttm_bo_clean_mm(&dev_priv->bdev, VMW_PL_GMR);
+- (void)ttm_bo_clean_mm(&dev_priv->bdev, TTM_PL_VRAM);
+ (void)ttm_bo_device_release(&dev_priv->bdev);
+ vmw_ttm_global_release(dev_priv);
+
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
+index 596cd6dafd33..50b52802f470 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
+@@ -2778,13 +2778,11 @@ int vmw_execbuf_ioctl(struct drm_device *dev, void *data,
+ NULL, arg->command_size, arg->throttle_us,
+ (void __user *)(unsigned long)arg->fence_rep,
+ NULL);
+-
++ ttm_read_unlock(&dev_priv->reservation_sem);
+ if (unlikely(ret != 0))
+- goto out_unlock;
++ return ret;
+
+ vmw_kms_cursor_post_execbuf(dev_priv);
+
+-out_unlock:
+- ttm_read_unlock(&dev_priv->reservation_sem);
+- return ret;
++ return 0;
+ }
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
+index fddd53335237..173ec3377e4f 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
+@@ -2033,23 +2033,17 @@ int vmw_kms_update_layout_ioctl(struct drm_device *dev, void *data,
+ int i;
+ struct drm_mode_config *mode_config = &dev->mode_config;
+
+- ret = ttm_read_lock(&dev_priv->reservation_sem, true);
+- if (unlikely(ret != 0))
+- return ret;
+-
+ if (!arg->num_outputs) {
+ struct drm_vmw_rect def_rect = {0, 0, 800, 600};
+ vmw_du_update_layout(dev_priv, 1, &def_rect);
+- goto out_unlock;
++ return 0;
+ }
+
+ rects_size = arg->num_outputs * sizeof(struct drm_vmw_rect);
+ rects = kcalloc(arg->num_outputs, sizeof(struct drm_vmw_rect),
+ GFP_KERNEL);
+- if (unlikely(!rects)) {
+- ret = -ENOMEM;
+- goto out_unlock;
+- }
++ if (unlikely(!rects))
++ return -ENOMEM;
+
+ user_rects = (void __user *)(unsigned long)arg->rects;
+ ret = copy_from_user(rects, user_rects, rects_size);
+@@ -2074,7 +2068,5 @@ int vmw_kms_update_layout_ioctl(struct drm_device *dev, void *data,
+
+ out_free:
+ kfree(rects);
+-out_unlock:
+- ttm_read_unlock(&dev_priv->reservation_sem);
+ return ret;
+ }
+diff --git a/drivers/i2c/i2c-core.c b/drivers/i2c/i2c-core.c
+index f43b4e11647a..17a1853c6c2f 100644
+--- a/drivers/i2c/i2c-core.c
++++ b/drivers/i2c/i2c-core.c
+@@ -665,9 +665,6 @@ static int i2c_device_remove(struct device *dev)
+ status = driver->remove(client);
+ }
+
+- if (dev->of_node)
+- irq_dispose_mapping(client->irq);
+-
+ dev_pm_domain_detach(&client->dev, true);
+ return status;
+ }
+diff --git a/drivers/irqchip/irq-armada-370-xp.c b/drivers/irqchip/irq-armada-370-xp.c
+index 6a2e168c3ab0..41ac85af043e 100644
+--- a/drivers/irqchip/irq-armada-370-xp.c
++++ b/drivers/irqchip/irq-armada-370-xp.c
+@@ -67,6 +67,7 @@
+ static void __iomem *per_cpu_int_base;
+ static void __iomem *main_int_base;
+ static struct irq_domain *armada_370_xp_mpic_domain;
++static int parent_irq;
+ #ifdef CONFIG_PCI_MSI
+ static struct irq_domain *armada_370_xp_msi_domain;
+ static DECLARE_BITMAP(msi_used, PCI_MSI_DOORBELL_NR);
+@@ -354,6 +355,7 @@ static int armada_xp_mpic_secondary_init(struct notifier_block *nfb,
+ {
+ if (action == CPU_STARTING || action == CPU_STARTING_FROZEN)
+ armada_xp_mpic_smp_cpu_init();
++
+ return NOTIFY_OK;
+ }
+
+@@ -362,6 +364,20 @@ static struct notifier_block armada_370_xp_mpic_cpu_notifier = {
+ .priority = 100,
+ };
+
++static int mpic_cascaded_secondary_init(struct notifier_block *nfb,
++ unsigned long action, void *hcpu)
++{
++ if (action == CPU_STARTING || action == CPU_STARTING_FROZEN)
++ enable_percpu_irq(parent_irq, IRQ_TYPE_NONE);
++
++ return NOTIFY_OK;
++}
++
++static struct notifier_block mpic_cascaded_cpu_notifier = {
++ .notifier_call = mpic_cascaded_secondary_init,
++ .priority = 100,
++};
++
+ #endif /* CONFIG_SMP */
+
+ static struct irq_domain_ops armada_370_xp_mpic_irq_ops = {
+@@ -489,7 +505,7 @@ static int __init armada_370_xp_mpic_of_init(struct device_node *node,
+ struct device_node *parent)
+ {
+ struct resource main_int_res, per_cpu_int_res;
+- int parent_irq, nr_irqs, i;
++ int nr_irqs, i;
+ u32 control;
+
+ BUG_ON(of_address_to_resource(node, 0, &main_int_res));
+@@ -537,6 +553,9 @@ static int __init armada_370_xp_mpic_of_init(struct device_node *node,
+ register_cpu_notifier(&armada_370_xp_mpic_cpu_notifier);
+ #endif
+ } else {
++#ifdef CONFIG_SMP
++ register_cpu_notifier(&mpic_cascaded_cpu_notifier);
++#endif
+ irq_set_chained_handler(parent_irq,
+ armada_370_xp_mpic_handle_cascade_irq);
+ }
+diff --git a/drivers/mtd/nand/pxa3xx_nand.c b/drivers/mtd/nand/pxa3xx_nand.c
+index 96b0b1d27df1..bc677362bc73 100644
+--- a/drivers/mtd/nand/pxa3xx_nand.c
++++ b/drivers/mtd/nand/pxa3xx_nand.c
+@@ -480,6 +480,42 @@ static void disable_int(struct pxa3xx_nand_info *info, uint32_t int_mask)
+ nand_writel(info, NDCR, ndcr | int_mask);
+ }
+
++static void drain_fifo(struct pxa3xx_nand_info *info, void *data, int len)
++{
++ if (info->ecc_bch) {
++ int timeout;
++
++ /*
++ * According to the datasheet, when reading from NDDB
++ * with BCH enabled, after each 32 bytes reads, we
++ * have to make sure that the NDSR.RDDREQ bit is set.
++ *
++ * Drain the FIFO 8 32 bits reads at a time, and skip
++ * the polling on the last read.
++ */
++ while (len > 8) {
++ __raw_readsl(info->mmio_base + NDDB, data, 8);
++
++ for (timeout = 0;
++ !(nand_readl(info, NDSR) & NDSR_RDDREQ);
++ timeout++) {
++ if (timeout >= 5) {
++ dev_err(&info->pdev->dev,
++ "Timeout on RDDREQ while draining the FIFO\n");
++ return;
++ }
++
++ mdelay(1);
++ }
++
++ data += 32;
++ len -= 8;
++ }
++ }
++
++ __raw_readsl(info->mmio_base + NDDB, data, len);
++}
++
+ static void handle_data_pio(struct pxa3xx_nand_info *info)
+ {
+ unsigned int do_bytes = min(info->data_size, info->chunk_size);
+@@ -496,14 +532,14 @@ static void handle_data_pio(struct pxa3xx_nand_info *info)
+ DIV_ROUND_UP(info->oob_size, 4));
+ break;
+ case STATE_PIO_READING:
+- __raw_readsl(info->mmio_base + NDDB,
+- info->data_buff + info->data_buff_pos,
+- DIV_ROUND_UP(do_bytes, 4));
++ drain_fifo(info,
++ info->data_buff + info->data_buff_pos,
++ DIV_ROUND_UP(do_bytes, 4));
+
+ if (info->oob_size > 0)
+- __raw_readsl(info->mmio_base + NDDB,
+- info->oob_buff + info->oob_buff_pos,
+- DIV_ROUND_UP(info->oob_size, 4));
++ drain_fifo(info,
++ info->oob_buff + info->oob_buff_pos,
++ DIV_ROUND_UP(info->oob_size, 4));
+ break;
+ default:
+ dev_err(&info->pdev->dev, "%s: invalid state %d\n", __func__,
+diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c
+index 4b008c9c738d..573b53b38af4 100644
+--- a/drivers/net/can/dev.c
++++ b/drivers/net/can/dev.c
+@@ -500,6 +500,10 @@ struct sk_buff *alloc_can_skb(struct net_device *dev, struct can_frame **cf)
+ skb->pkt_type = PACKET_BROADCAST;
+ skb->ip_summed = CHECKSUM_UNNECESSARY;
+
++ skb_reset_mac_header(skb);
++ skb_reset_network_header(skb);
++ skb_reset_transport_header(skb);
++
+ can_skb_reserve(skb);
+ can_skb_prv(skb)->ifindex = dev->ifindex;
+
+@@ -524,6 +528,10 @@ struct sk_buff *alloc_canfd_skb(struct net_device *dev,
+ skb->pkt_type = PACKET_BROADCAST;
+ skb->ip_summed = CHECKSUM_UNNECESSARY;
+
++ skb_reset_mac_header(skb);
++ skb_reset_network_header(skb);
++ skb_reset_transport_header(skb);
++
+ can_skb_reserve(skb);
+ can_skb_prv(skb)->ifindex = dev->ifindex;
+
+diff --git a/drivers/net/can/usb/kvaser_usb.c b/drivers/net/can/usb/kvaser_usb.c
+index 8b255e777cc7..5d777956ae1f 100644
+--- a/drivers/net/can/usb/kvaser_usb.c
++++ b/drivers/net/can/usb/kvaser_usb.c
+@@ -12,6 +12,7 @@
+ * Copyright (C) 2012 Olivier Sobrie <olivier@sobrie.be>
+ */
+
++#include <linux/kernel.h>
+ #include <linux/completion.h>
+ #include <linux/module.h>
+ #include <linux/netdevice.h>
+@@ -403,8 +404,15 @@ static int kvaser_usb_wait_msg(const struct kvaser_usb *dev, u8 id,
+ while (pos <= actual_len - MSG_HEADER_LEN) {
+ tmp = buf + pos;
+
+- if (!tmp->len)
+- break;
++ /* Handle messages crossing the USB endpoint max packet
++ * size boundary. Check kvaser_usb_read_bulk_callback()
++ * for further details.
++ */
++ if (tmp->len == 0) {
++ pos = round_up(pos,
++ dev->bulk_in->wMaxPacketSize);
++ continue;
++ }
+
+ if (pos + tmp->len > actual_len) {
+ dev_err(dev->udev->dev.parent,
+@@ -983,8 +991,19 @@ static void kvaser_usb_read_bulk_callback(struct urb *urb)
+ while (pos <= urb->actual_length - MSG_HEADER_LEN) {
+ msg = urb->transfer_buffer + pos;
+
+- if (!msg->len)
+- break;
++ /* The Kvaser firmware can only read and write messages that
++ * does not cross the USB's endpoint wMaxPacketSize boundary.
++ * If a follow-up command crosses such boundary, firmware puts
++ * a placeholder zero-length command in its place then aligns
++ * the real command to the next max packet size.
++ *
++ * Handle such cases or we're going to miss a significant
++ * number of events in case of a heavy rx load on the bus.
++ */
++ if (msg->len == 0) {
++ pos = round_up(pos, dev->bulk_in->wMaxPacketSize);
++ continue;
++ }
+
+ if (pos + msg->len > urb->actual_length) {
+ dev_err(dev->udev->dev.parent, "Format error\n");
+@@ -992,7 +1011,6 @@ static void kvaser_usb_read_bulk_callback(struct urb *urb)
+ }
+
+ kvaser_usb_handle_message(dev, msg);
+-
+ pos += msg->len;
+ }
+
+diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+index 74fbf9ea7bd8..710eb5793eb3 100644
+--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+@@ -12711,6 +12711,9 @@ static int bnx2x_init_dev(struct bnx2x *bp, struct pci_dev *pdev,
+ pci_write_config_dword(bp->pdev, PCICFG_GRC_ADDRESS,
+ PCICFG_VENDOR_ID_OFFSET);
+
++ /* Set PCIe reset type to fundamental for EEH recovery */
++ pdev->needs_freset = 1;
++
+ /* AER (Advanced Error reporting) configuration */
+ rc = pci_enable_pcie_error_reporting(pdev);
+ if (!rc)
+diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
+index 3dca494797bd..96ba23e90111 100644
+--- a/drivers/net/ethernet/freescale/fec_main.c
++++ b/drivers/net/ethernet/freescale/fec_main.c
+@@ -1464,8 +1464,7 @@ fec_enet_rx_queue(struct net_device *ndev, int budget, u16 queue_id)
+
+ vlan_packet_rcvd = true;
+
+- skb_copy_to_linear_data_offset(skb, VLAN_HLEN,
+- data, (2 * ETH_ALEN));
++ memmove(skb->data + VLAN_HLEN, data, ETH_ALEN * 2);
+ skb_pull(skb, VLAN_HLEN);
+ }
+
+diff --git a/drivers/net/usb/cx82310_eth.c b/drivers/net/usb/cx82310_eth.c
+index 3eed708a6182..fe48f4c51373 100644
+--- a/drivers/net/usb/cx82310_eth.c
++++ b/drivers/net/usb/cx82310_eth.c
+@@ -300,9 +300,18 @@ static const struct driver_info cx82310_info = {
+ .tx_fixup = cx82310_tx_fixup,
+ };
+
++#define USB_DEVICE_CLASS(vend, prod, cl, sc, pr) \
++ .match_flags = USB_DEVICE_ID_MATCH_DEVICE | \
++ USB_DEVICE_ID_MATCH_DEV_INFO, \
++ .idVendor = (vend), \
++ .idProduct = (prod), \
++ .bDeviceClass = (cl), \
++ .bDeviceSubClass = (sc), \
++ .bDeviceProtocol = (pr)
++
+ static const struct usb_device_id products[] = {
+ {
+- USB_DEVICE_AND_INTERFACE_INFO(0x0572, 0xcb01, 0xff, 0, 0),
++ USB_DEVICE_CLASS(0x0572, 0xcb01, 0xff, 0, 0),
+ .driver_info = (unsigned long) &cx82310_info
+ },
+ { },
+diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
+index b0bc8ead47de..484ecce78025 100644
+--- a/drivers/net/virtio_net.c
++++ b/drivers/net/virtio_net.c
+@@ -1452,8 +1452,10 @@ static void virtnet_free_queues(struct virtnet_info *vi)
+ {
+ int i;
+
+- for (i = 0; i < vi->max_queue_pairs; i++)
++ for (i = 0; i < vi->max_queue_pairs; i++) {
++ napi_hash_del(&vi->rq[i].napi);
+ netif_napi_del(&vi->rq[i].napi);
++ }
+
+ kfree(vi->rq);
+ kfree(vi->sq);
+@@ -1939,11 +1941,8 @@ static int virtnet_freeze(struct virtio_device *vdev)
+ cancel_delayed_work_sync(&vi->refill);
+
+ if (netif_running(vi->dev)) {
+- for (i = 0; i < vi->max_queue_pairs; i++) {
++ for (i = 0; i < vi->max_queue_pairs; i++)
+ napi_disable(&vi->rq[i].napi);
+- napi_hash_del(&vi->rq[i].napi);
+- netif_napi_del(&vi->rq[i].napi);
+- }
+ }
+
+ remove_vq_common(vi);
+diff --git a/drivers/pci/pci-sysfs.c b/drivers/pci/pci-sysfs.c
+index 2c6643fdc0cf..eb1543841e39 100644
+--- a/drivers/pci/pci-sysfs.c
++++ b/drivers/pci/pci-sysfs.c
+@@ -515,7 +515,8 @@ static ssize_t driver_override_store(struct device *dev,
+ struct pci_dev *pdev = to_pci_dev(dev);
+ char *driver_override, *old = pdev->driver_override, *cp;
+
+- if (count > PATH_MAX)
++ /* We need to keep extra room for a newline */
++ if (count >= (PAGE_SIZE - 1))
+ return -EINVAL;
+
+ driver_override = kstrndup(buf, count, GFP_KERNEL);
+@@ -543,7 +544,7 @@ static ssize_t driver_override_show(struct device *dev,
+ {
+ struct pci_dev *pdev = to_pci_dev(dev);
+
+- return sprintf(buf, "%s\n", pdev->driver_override);
++ return snprintf(buf, PAGE_SIZE, "%s\n", pdev->driver_override);
+ }
+ static DEVICE_ATTR_RW(driver_override);
+
+diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
+index fc6fb5422b6f..d92612c51657 100644
+--- a/drivers/regulator/core.c
++++ b/drivers/regulator/core.c
+@@ -1841,10 +1841,12 @@ static int _regulator_do_enable(struct regulator_dev *rdev)
+ }
+
+ if (rdev->ena_pin) {
+- ret = regulator_ena_gpio_ctrl(rdev, true);
+- if (ret < 0)
+- return ret;
+- rdev->ena_gpio_state = 1;
++ if (!rdev->ena_gpio_state) {
++ ret = regulator_ena_gpio_ctrl(rdev, true);
++ if (ret < 0)
++ return ret;
++ rdev->ena_gpio_state = 1;
++ }
+ } else if (rdev->desc->ops->enable) {
+ ret = rdev->desc->ops->enable(rdev);
+ if (ret < 0)
+@@ -1941,10 +1943,12 @@ static int _regulator_do_disable(struct regulator_dev *rdev)
+ trace_regulator_disable(rdev_get_name(rdev));
+
+ if (rdev->ena_pin) {
+- ret = regulator_ena_gpio_ctrl(rdev, false);
+- if (ret < 0)
+- return ret;
+- rdev->ena_gpio_state = 0;
++ if (rdev->ena_gpio_state) {
++ ret = regulator_ena_gpio_ctrl(rdev, false);
++ if (ret < 0)
++ return ret;
++ rdev->ena_gpio_state = 0;
++ }
+
+ } else if (rdev->desc->ops->disable) {
+ ret = rdev->desc->ops->disable(rdev);
+@@ -3659,12 +3663,6 @@ regulator_register(const struct regulator_desc *regulator_desc,
+ config->ena_gpio, ret);
+ goto wash;
+ }
+-
+- if (config->ena_gpio_flags & GPIOF_OUT_INIT_HIGH)
+- rdev->ena_gpio_state = 1;
+-
+- if (config->ena_gpio_invert)
+- rdev->ena_gpio_state = !rdev->ena_gpio_state;
+ }
+
+ /* set regulator constraints */
+@@ -3837,9 +3835,11 @@ int regulator_suspend_finish(void)
+ list_for_each_entry(rdev, ®ulator_list, list) {
+ mutex_lock(&rdev->mutex);
+ if (rdev->use_count > 0 || rdev->constraints->always_on) {
+- error = _regulator_do_enable(rdev);
+- if (error)
+- ret = error;
++ if (!_regulator_is_enabled(rdev)) {
++ error = _regulator_do_enable(rdev);
++ if (error)
++ ret = error;
++ }
+ } else {
+ if (!have_full_constraints())
+ goto unlock;
+diff --git a/drivers/regulator/rk808-regulator.c b/drivers/regulator/rk808-regulator.c
+index 196a5c8838c4..b019956ba5dd 100644
+--- a/drivers/regulator/rk808-regulator.c
++++ b/drivers/regulator/rk808-regulator.c
+@@ -184,6 +184,7 @@ static const struct regulator_desc rk808_reg[] = {
+ .vsel_mask = RK808_LDO_VSEL_MASK,
+ .enable_reg = RK808_LDO_EN_REG,
+ .enable_mask = BIT(0),
++ .enable_time = 400,
+ .owner = THIS_MODULE,
+ }, {
+ .name = "LDO_REG2",
+@@ -198,6 +199,7 @@ static const struct regulator_desc rk808_reg[] = {
+ .vsel_mask = RK808_LDO_VSEL_MASK,
+ .enable_reg = RK808_LDO_EN_REG,
+ .enable_mask = BIT(1),
++ .enable_time = 400,
+ .owner = THIS_MODULE,
+ }, {
+ .name = "LDO_REG3",
+@@ -212,6 +214,7 @@ static const struct regulator_desc rk808_reg[] = {
+ .vsel_mask = RK808_BUCK4_VSEL_MASK,
+ .enable_reg = RK808_LDO_EN_REG,
+ .enable_mask = BIT(2),
++ .enable_time = 400,
+ .owner = THIS_MODULE,
+ }, {
+ .name = "LDO_REG4",
+@@ -226,6 +229,7 @@ static const struct regulator_desc rk808_reg[] = {
+ .vsel_mask = RK808_LDO_VSEL_MASK,
+ .enable_reg = RK808_LDO_EN_REG,
+ .enable_mask = BIT(3),
++ .enable_time = 400,
+ .owner = THIS_MODULE,
+ }, {
+ .name = "LDO_REG5",
+@@ -240,6 +244,7 @@ static const struct regulator_desc rk808_reg[] = {
+ .vsel_mask = RK808_LDO_VSEL_MASK,
+ .enable_reg = RK808_LDO_EN_REG,
+ .enable_mask = BIT(4),
++ .enable_time = 400,
+ .owner = THIS_MODULE,
+ }, {
+ .name = "LDO_REG6",
+@@ -254,6 +259,7 @@ static const struct regulator_desc rk808_reg[] = {
+ .vsel_mask = RK808_LDO_VSEL_MASK,
+ .enable_reg = RK808_LDO_EN_REG,
+ .enable_mask = BIT(5),
++ .enable_time = 400,
+ .owner = THIS_MODULE,
+ }, {
+ .name = "LDO_REG7",
+@@ -268,6 +274,7 @@ static const struct regulator_desc rk808_reg[] = {
+ .vsel_mask = RK808_LDO_VSEL_MASK,
+ .enable_reg = RK808_LDO_EN_REG,
+ .enable_mask = BIT(6),
++ .enable_time = 400,
+ .owner = THIS_MODULE,
+ }, {
+ .name = "LDO_REG8",
+@@ -282,6 +289,7 @@ static const struct regulator_desc rk808_reg[] = {
+ .vsel_mask = RK808_LDO_VSEL_MASK,
+ .enable_reg = RK808_LDO_EN_REG,
+ .enable_mask = BIT(7),
++ .enable_time = 400,
+ .owner = THIS_MODULE,
+ }, {
+ .name = "SWITCH_REG1",
+diff --git a/drivers/rtc/rtc-s3c.c b/drivers/rtc/rtc-s3c.c
+index 806072238c00..22a612b06742 100644
+--- a/drivers/rtc/rtc-s3c.c
++++ b/drivers/rtc/rtc-s3c.c
+@@ -849,6 +849,7 @@ static struct s3c_rtc_data const s3c2443_rtc_data = {
+
+ static struct s3c_rtc_data const s3c6410_rtc_data = {
+ .max_user_freq = 32768,
++ .needs_src_clk = true,
+ .irq_handler = s3c6410_rtc_irq,
+ .set_freq = s3c6410_rtc_setfreq,
+ .enable_tick = s3c6410_rtc_enable_tick,
+diff --git a/drivers/scsi/libsas/sas_discover.c b/drivers/scsi/libsas/sas_discover.c
+index 62b58d38ce2e..60de66252fa2 100644
+--- a/drivers/scsi/libsas/sas_discover.c
++++ b/drivers/scsi/libsas/sas_discover.c
+@@ -500,6 +500,7 @@ static void sas_revalidate_domain(struct work_struct *work)
+ struct sas_discovery_event *ev = to_sas_discovery_event(work);
+ struct asd_sas_port *port = ev->port;
+ struct sas_ha_struct *ha = port->ha;
++ struct domain_device *ddev = port->port_dev;
+
+ /* prevent revalidation from finding sata links in recovery */
+ mutex_lock(&ha->disco_mutex);
+@@ -514,8 +515,9 @@ static void sas_revalidate_domain(struct work_struct *work)
+ SAS_DPRINTK("REVALIDATING DOMAIN on port %d, pid:%d\n", port->id,
+ task_pid_nr(current));
+
+- if (port->port_dev)
+- res = sas_ex_revalidate_domain(port->port_dev);
++ if (ddev && (ddev->dev_type == SAS_FANOUT_EXPANDER_DEVICE ||
++ ddev->dev_type == SAS_EDGE_EXPANDER_DEVICE))
++ res = sas_ex_revalidate_domain(ddev);
+
+ SAS_DPRINTK("done REVALIDATING DOMAIN on port %d, pid:%d, res 0x%x\n",
+ port->id, task_pid_nr(current), res);
+diff --git a/drivers/spi/spi-atmel.c b/drivers/spi/spi-atmel.c
+index 113c83f44b5c..4bf337aa4fd5 100644
+--- a/drivers/spi/spi-atmel.c
++++ b/drivers/spi/spi-atmel.c
+@@ -775,17 +775,17 @@ static void atmel_spi_pdc_next_xfer(struct spi_master *master,
+ (unsigned long long)xfer->rx_dma);
+ }
+
+- /* REVISIT: We're waiting for ENDRX before we start the next
++ /* REVISIT: We're waiting for RXBUFF before we start the next
+ * transfer because we need to handle some difficult timing
+- * issues otherwise. If we wait for ENDTX in one transfer and
+- * then starts waiting for ENDRX in the next, it's difficult
+- * to tell the difference between the ENDRX interrupt we're
+- * actually waiting for and the ENDRX interrupt of the
++ * issues otherwise. If we wait for TXBUFE in one transfer and
++ * then starts waiting for RXBUFF in the next, it's difficult
++ * to tell the difference between the RXBUFF interrupt we're
++ * actually waiting for and the RXBUFF interrupt of the
+ * previous transfer.
+ *
+ * It should be doable, though. Just not now...
+ */
+- spi_writel(as, IER, SPI_BIT(ENDRX) | SPI_BIT(OVRES));
++ spi_writel(as, IER, SPI_BIT(RXBUFF) | SPI_BIT(OVRES));
+ spi_writel(as, PTCR, SPI_BIT(TXTEN) | SPI_BIT(RXTEN));
+ }
+
+diff --git a/drivers/spi/spi-dw-mid.c b/drivers/spi/spi-dw-mid.c
+index efff55537d8a..1417f96546ce 100644
+--- a/drivers/spi/spi-dw-mid.c
++++ b/drivers/spi/spi-dw-mid.c
+@@ -151,6 +151,9 @@ static int mid_spi_dma_transfer(struct dw_spi *dws, int cs_change)
+ 1,
+ DMA_MEM_TO_DEV,
+ DMA_PREP_INTERRUPT | DMA_CTRL_ACK);
++ if (!txdesc)
++ return NULL;
++
+ txdesc->callback = dw_spi_dma_done;
+ txdesc->callback_param = dws;
+
+@@ -173,6 +176,9 @@ static int mid_spi_dma_transfer(struct dw_spi *dws, int cs_change)
+ 1,
+ DMA_DEV_TO_MEM,
+ DMA_PREP_INTERRUPT | DMA_CTRL_ACK);
++ if (!rxdesc)
++ return NULL;
++
+ rxdesc->callback = dw_spi_dma_done;
+ rxdesc->callback_param = dws;
+
+diff --git a/drivers/spi/spi-pl022.c b/drivers/spi/spi-pl022.c
+index fc2dd8441608..11e18342bc4f 100644
+--- a/drivers/spi/spi-pl022.c
++++ b/drivers/spi/spi-pl022.c
+@@ -534,12 +534,12 @@ static void giveback(struct pl022 *pl022)
+ pl022->cur_msg = NULL;
+ pl022->cur_transfer = NULL;
+ pl022->cur_chip = NULL;
+- spi_finalize_current_message(pl022->master);
+
+ /* disable the SPI/SSP operation */
+ writew((readw(SSP_CR1(pl022->virtbase)) &
+ (~SSP_CR1_MASK_SSE)), SSP_CR1(pl022->virtbase));
+
++ spi_finalize_current_message(pl022->master);
+ }
+
+ /**
+diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
+index 73e58d22e325..6446490854cb 100644
+--- a/drivers/target/iscsi/iscsi_target.c
++++ b/drivers/target/iscsi/iscsi_target.c
+@@ -4220,11 +4220,17 @@ int iscsit_close_connection(
+ pr_debug("Closing iSCSI connection CID %hu on SID:"
+ " %u\n", conn->cid, sess->sid);
+ /*
+- * Always up conn_logout_comp just in case the RX Thread is sleeping
+- * and the logout response never got sent because the connection
+- * failed.
++ * Always up conn_logout_comp for the traditional TCP case just in case
++ * the RX Thread in iscsi_target_rx_opcode() is sleeping and the logout
++ * response never got sent because the connection failed.
++ *
++ * However for iser-target, isert_wait4logout() is using conn_logout_comp
++ * to signal logout response TX interrupt completion. Go ahead and skip
++ * this for iser since isert_rx_opcode() does not wait on logout failure,
++ * and to avoid iscsi_conn pointer dereference in iser-target code.
+ */
+- complete(&conn->conn_logout_comp);
++ if (conn->conn_transport->transport_type == ISCSI_TCP)
++ complete(&conn->conn_logout_comp);
+
+ iscsi_release_thread_set(conn);
+
+diff --git a/drivers/target/target_core_device.c b/drivers/target/target_core_device.c
+index 24fa5d1999af..9e0f5d3b3ebf 100644
+--- a/drivers/target/target_core_device.c
++++ b/drivers/target/target_core_device.c
+@@ -1598,8 +1598,6 @@ int target_configure_device(struct se_device *dev)
+ ret = dev->transport->configure_device(dev);
+ if (ret)
+ goto out;
+- dev->dev_flags |= DF_CONFIGURED;
+-
+ /*
+ * XXX: there is not much point to have two different values here..
+ */
+@@ -1661,6 +1659,8 @@ int target_configure_device(struct se_device *dev)
+ list_add_tail(&dev->g_dev_node, &g_device_list);
+ mutex_unlock(&g_device_mutex);
+
++ dev->dev_flags |= DF_CONFIGURED;
++
+ return 0;
+
+ out_free_alua:
+diff --git a/drivers/target/target_core_pscsi.c b/drivers/target/target_core_pscsi.c
+index 7c8291f0bbbc..9a54381e23c6 100644
+--- a/drivers/target/target_core_pscsi.c
++++ b/drivers/target/target_core_pscsi.c
+@@ -1120,7 +1120,7 @@ static u32 pscsi_get_device_type(struct se_device *dev)
+ struct pscsi_dev_virt *pdv = PSCSI_DEV(dev);
+ struct scsi_device *sd = pdv->pdv_sd;
+
+- return sd->type;
++ return (sd) ? sd->type : TYPE_NO_LUN;
+ }
+
+ static sector_t pscsi_get_blocks(struct se_device *dev)
+diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
+index be877bf6f730..2e0998420254 100644
+--- a/drivers/target/target_core_transport.c
++++ b/drivers/target/target_core_transport.c
+@@ -2389,6 +2389,10 @@ int target_get_sess_cmd(struct se_session *se_sess, struct se_cmd *se_cmd,
+ list_add_tail(&se_cmd->se_cmd_list, &se_sess->sess_cmd_list);
+ out:
+ spin_unlock_irqrestore(&se_sess->sess_cmd_lock, flags);
++
++ if (ret && ack_kref)
++ target_put_sess_cmd(se_sess, se_cmd);
++
+ return ret;
+ }
+ EXPORT_SYMBOL(target_get_sess_cmd);
+diff --git a/drivers/tty/serial/8250/8250_dw.c b/drivers/tty/serial/8250/8250_dw.c
+index beea6ca73ee5..a69e31e3410f 100644
+--- a/drivers/tty/serial/8250/8250_dw.c
++++ b/drivers/tty/serial/8250/8250_dw.c
+@@ -111,7 +111,10 @@ static void dw8250_serial_out(struct uart_port *p, int offset, int value)
+ dw8250_force_idle(p);
+ writeb(value, p->membase + (UART_LCR << p->regshift));
+ }
+- dev_err(p->dev, "Couldn't set LCR to %d\n", value);
++ /*
++ * FIXME: this deadlocks if port->lock is already held
++ * dev_err(p->dev, "Couldn't set LCR to %d\n", value);
++ */
+ }
+ }
+
+@@ -148,7 +151,10 @@ static void dw8250_serial_out32(struct uart_port *p, int offset, int value)
+ dw8250_force_idle(p);
+ writel(value, p->membase + (UART_LCR << p->regshift));
+ }
+- dev_err(p->dev, "Couldn't set LCR to %d\n", value);
++ /*
++ * FIXME: this deadlocks if port->lock is already held
++ * dev_err(p->dev, "Couldn't set LCR to %d\n", value);
++ */
+ }
+ }
+
+diff --git a/drivers/tty/serial/8250/8250_pci.c b/drivers/tty/serial/8250/8250_pci.c
+index beb9d71cd47a..439bd1a5d00c 100644
+--- a/drivers/tty/serial/8250/8250_pci.c
++++ b/drivers/tty/serial/8250/8250_pci.c
+@@ -69,7 +69,7 @@ static void moan_device(const char *str, struct pci_dev *dev)
+ "Please send the output of lspci -vv, this\n"
+ "message (0x%04x,0x%04x,0x%04x,0x%04x), the\n"
+ "manufacturer and name of serial board or\n"
+- "modem board to rmk+serial@arm.linux.org.uk.\n",
++ "modem board to <linux-serial@vger.kernel.org>.\n",
+ pci_name(dev), str, dev->vendor, dev->device,
+ dev->subsystem_vendor, dev->subsystem_device);
+ }
+diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c
+index 08048613eed6..db2becd31a51 100644
+--- a/drivers/usb/gadget/legacy/inode.c
++++ b/drivers/usb/gadget/legacy/inode.c
+@@ -565,7 +565,6 @@ static ssize_t ep_copy_to_user(struct kiocb_priv *priv)
+ if (total == 0)
+ break;
+ }
+-
+ return len;
+ }
+
+@@ -584,6 +583,7 @@ static void ep_user_copy_worker(struct work_struct *work)
+ aio_complete(iocb, ret, ret);
+
+ kfree(priv->buf);
++ kfree(priv->iv);
+ kfree(priv);
+ }
+
+@@ -604,6 +604,7 @@ static void ep_aio_complete(struct usb_ep *ep, struct usb_request *req)
+ */
+ if (priv->iv == NULL || unlikely(req->actual == 0)) {
+ kfree(req->buf);
++ kfree(priv->iv);
+ kfree(priv);
+ iocb->private = NULL;
+ /* aio_complete() reports bytes-transferred _and_ faults */
+@@ -639,7 +640,7 @@ ep_aio_rwtail(
+ struct usb_request *req;
+ ssize_t value;
+
+- priv = kmalloc(sizeof *priv, GFP_KERNEL);
++ priv = kzalloc(sizeof *priv, GFP_KERNEL);
+ if (!priv) {
+ value = -ENOMEM;
+ fail:
+@@ -648,7 +649,14 @@ fail:
+ }
+ iocb->private = priv;
+ priv->iocb = iocb;
+- priv->iv = iv;
++ if (iv) {
++ priv->iv = kmemdup(iv, nr_segs * sizeof(struct iovec),
++ GFP_KERNEL);
++ if (!priv->iv) {
++ kfree(priv);
++ goto fail;
++ }
++ }
+ priv->nr_segs = nr_segs;
+ INIT_WORK(&priv->work, ep_user_copy_worker);
+
+@@ -688,6 +696,7 @@ fail:
+ mutex_unlock(&epdata->lock);
+
+ if (unlikely(value)) {
++ kfree(priv->iv);
+ kfree(priv);
+ put_ep(epdata);
+ } else
+diff --git a/drivers/xen/events/events_base.c b/drivers/xen/events/events_base.c
+index b4bca2d4a7e5..70fba973a107 100644
+--- a/drivers/xen/events/events_base.c
++++ b/drivers/xen/events/events_base.c
+@@ -526,20 +526,26 @@ static unsigned int __startup_pirq(unsigned int irq)
+ pirq_query_unmask(irq);
+
+ rc = set_evtchn_to_irq(evtchn, irq);
+- if (rc != 0) {
+- pr_err("irq%d: Failed to set port to irq mapping (%d)\n",
+- irq, rc);
+- xen_evtchn_close(evtchn);
+- return 0;
+- }
++ if (rc)
++ goto err;
++
+ bind_evtchn_to_cpu(evtchn, 0);
+ info->evtchn = evtchn;
+
++ rc = xen_evtchn_port_setup(info);
++ if (rc)
++ goto err;
++
+ out:
+ unmask_evtchn(evtchn);
+ eoi_pirq(irq_get_irq_data(irq));
+
+ return 0;
++
++err:
++ pr_err("irq%d: Failed to set port to irq mapping (%d)\n", irq, rc);
++ xen_evtchn_close(evtchn);
++ return 0;
+ }
+
+ static unsigned int startup_pirq(struct irq_data *data)
+diff --git a/drivers/xen/xen-pciback/conf_space.c b/drivers/xen/xen-pciback/conf_space.c
+index 46ae0f9f02ad..75fe3d466515 100644
+--- a/drivers/xen/xen-pciback/conf_space.c
++++ b/drivers/xen/xen-pciback/conf_space.c
+@@ -16,7 +16,7 @@
+ #include "conf_space.h"
+ #include "conf_space_quirks.h"
+
+-static bool permissive;
++bool permissive;
+ module_param(permissive, bool, 0644);
+
+ /* This is where xen_pcibk_read_config_byte, xen_pcibk_read_config_word,
+diff --git a/drivers/xen/xen-pciback/conf_space.h b/drivers/xen/xen-pciback/conf_space.h
+index e56c934ad137..2e1d73d1d5d0 100644
+--- a/drivers/xen/xen-pciback/conf_space.h
++++ b/drivers/xen/xen-pciback/conf_space.h
+@@ -64,6 +64,8 @@ struct config_field_entry {
+ void *data;
+ };
+
++extern bool permissive;
++
+ #define OFFSET(cfg_entry) ((cfg_entry)->base_offset+(cfg_entry)->field->offset)
+
+ /* Add fields to a device - the add_fields macro expects to get a pointer to
+diff --git a/drivers/xen/xen-pciback/conf_space_header.c b/drivers/xen/xen-pciback/conf_space_header.c
+index c5ee82587e8c..2d7369391472 100644
+--- a/drivers/xen/xen-pciback/conf_space_header.c
++++ b/drivers/xen/xen-pciback/conf_space_header.c
+@@ -11,6 +11,10 @@
+ #include "pciback.h"
+ #include "conf_space.h"
+
++struct pci_cmd_info {
++ u16 val;
++};
++
+ struct pci_bar_info {
+ u32 val;
+ u32 len_val;
+@@ -20,22 +24,36 @@ struct pci_bar_info {
+ #define is_enable_cmd(value) ((value)&(PCI_COMMAND_MEMORY|PCI_COMMAND_IO))
+ #define is_master_cmd(value) ((value)&PCI_COMMAND_MASTER)
+
+-static int command_read(struct pci_dev *dev, int offset, u16 *value, void *data)
++/* Bits guests are allowed to control in permissive mode. */
++#define PCI_COMMAND_GUEST (PCI_COMMAND_MASTER|PCI_COMMAND_SPECIAL| \
++ PCI_COMMAND_INVALIDATE|PCI_COMMAND_VGA_PALETTE| \
++ PCI_COMMAND_WAIT|PCI_COMMAND_FAST_BACK)
++
++static void *command_init(struct pci_dev *dev, int offset)
+ {
+- int i;
+- int ret;
+-
+- ret = xen_pcibk_read_config_word(dev, offset, value, data);
+- if (!pci_is_enabled(dev))
+- return ret;
+-
+- for (i = 0; i < PCI_ROM_RESOURCE; i++) {
+- if (dev->resource[i].flags & IORESOURCE_IO)
+- *value |= PCI_COMMAND_IO;
+- if (dev->resource[i].flags & IORESOURCE_MEM)
+- *value |= PCI_COMMAND_MEMORY;
++ struct pci_cmd_info *cmd = kmalloc(sizeof(*cmd), GFP_KERNEL);
++ int err;
++
++ if (!cmd)
++ return ERR_PTR(-ENOMEM);
++
++ err = pci_read_config_word(dev, PCI_COMMAND, &cmd->val);
++ if (err) {
++ kfree(cmd);
++ return ERR_PTR(err);
+ }
+
++ return cmd;
++}
++
++static int command_read(struct pci_dev *dev, int offset, u16 *value, void *data)
++{
++ int ret = pci_read_config_word(dev, offset, value);
++ const struct pci_cmd_info *cmd = data;
++
++ *value &= PCI_COMMAND_GUEST;
++ *value |= cmd->val & ~PCI_COMMAND_GUEST;
++
+ return ret;
+ }
+
+@@ -43,6 +61,8 @@ static int command_write(struct pci_dev *dev, int offset, u16 value, void *data)
+ {
+ struct xen_pcibk_dev_data *dev_data;
+ int err;
++ u16 val;
++ struct pci_cmd_info *cmd = data;
+
+ dev_data = pci_get_drvdata(dev);
+ if (!pci_is_enabled(dev) && is_enable_cmd(value)) {
+@@ -83,6 +103,19 @@ static int command_write(struct pci_dev *dev, int offset, u16 value, void *data)
+ }
+ }
+
++ cmd->val = value;
++
++ if (!permissive && (!dev_data || !dev_data->permissive))
++ return 0;
++
++ /* Only allow the guest to control certain bits. */
++ err = pci_read_config_word(dev, offset, &val);
++ if (err || val == value)
++ return err;
++
++ value &= PCI_COMMAND_GUEST;
++ value |= val & ~PCI_COMMAND_GUEST;
++
+ return pci_write_config_word(dev, offset, value);
+ }
+
+@@ -282,6 +315,8 @@ static const struct config_field header_common[] = {
+ {
+ .offset = PCI_COMMAND,
+ .size = 2,
++ .init = command_init,
++ .release = bar_release,
+ .u.w.read = command_read,
+ .u.w.write = command_write,
+ },
+diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
+index ca887314aba9..f2bbb8513360 100644
+--- a/fs/fuse/dev.c
++++ b/fs/fuse/dev.c
+@@ -814,8 +814,8 @@ static int fuse_try_move_page(struct fuse_copy_state *cs, struct page **pagep)
+
+ newpage = buf->page;
+
+- if (WARN_ON(!PageUptodate(newpage)))
+- return -EIO;
++ if (!PageUptodate(newpage))
++ SetPageUptodate(newpage);
+
+ ClearPageMappedToDisk(newpage);
+
+@@ -1721,6 +1721,9 @@ copy_finish:
+ static int fuse_notify(struct fuse_conn *fc, enum fuse_notify_code code,
+ unsigned int size, struct fuse_copy_state *cs)
+ {
++ /* Don't try to move pages (yet) */
++ cs->move_pages = 0;
++
+ switch (code) {
+ case FUSE_NOTIFY_POLL:
+ return fuse_notify_poll(fc, size, cs);
+diff --git a/fs/nilfs2/segment.c b/fs/nilfs2/segment.c
+index 469086b9f99b..0c3f303baf32 100644
+--- a/fs/nilfs2/segment.c
++++ b/fs/nilfs2/segment.c
+@@ -1907,6 +1907,7 @@ static void nilfs_segctor_drop_written_files(struct nilfs_sc_info *sci,
+ struct the_nilfs *nilfs)
+ {
+ struct nilfs_inode_info *ii, *n;
++ int during_mount = !(sci->sc_super->s_flags & MS_ACTIVE);
+ int defer_iput = false;
+
+ spin_lock(&nilfs->ns_inode_lock);
+@@ -1919,10 +1920,10 @@ static void nilfs_segctor_drop_written_files(struct nilfs_sc_info *sci,
+ brelse(ii->i_bh);
+ ii->i_bh = NULL;
+ list_del_init(&ii->i_dirty);
+- if (!ii->vfs_inode.i_nlink) {
++ if (!ii->vfs_inode.i_nlink || during_mount) {
+ /*
+- * Defer calling iput() to avoid a deadlock
+- * over I_SYNC flag for inodes with i_nlink == 0
++ * Defer calling iput() to avoid deadlocks if
++ * i_nlink == 0 or mount is not yet finished.
+ */
+ list_add_tail(&ii->i_dirty, &sci->sc_iput_queue);
+ defer_iput = true;
+diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
+index e8972bcddfb4..69aa378e60d9 100644
+--- a/fs/proc/task_mmu.c
++++ b/fs/proc/task_mmu.c
+@@ -1291,6 +1291,9 @@ out:
+
+ static int pagemap_open(struct inode *inode, struct file *file)
+ {
++ /* do not disclose physical addresses: attack vector */
++ if (!capable(CAP_SYS_ADMIN))
++ return -EPERM;
+ pr_warn_once("Bits 55-60 of /proc/PID/pagemap entries are about "
+ "to stop being page-shift some time soon. See the "
+ "linux/Documentation/vm/pagemap.txt for details.\n");
+diff --git a/include/asm-generic/tlb.h b/include/asm-generic/tlb.h
+index 5672d7ea1fa0..08848050922e 100644
+--- a/include/asm-generic/tlb.h
++++ b/include/asm-generic/tlb.h
+@@ -96,10 +96,9 @@ struct mmu_gather {
+ #endif
+ unsigned long start;
+ unsigned long end;
+- unsigned int need_flush : 1, /* Did free PTEs */
+ /* we are in the middle of an operation to clear
+ * a full mm and can make some optimizations */
+- fullmm : 1,
++ unsigned int fullmm : 1,
+ /* we have performed an operation which
+ * requires a complete flush of the tlb */
+ need_flush_all : 1;
+@@ -128,16 +127,54 @@ static inline void tlb_remove_page(struct mmu_gather *tlb, struct page *page)
+ tlb_flush_mmu(tlb);
+ }
+
++static inline void __tlb_adjust_range(struct mmu_gather *tlb,
++ unsigned long address)
++{
++ tlb->start = min(tlb->start, address);
++ tlb->end = max(tlb->end, address + PAGE_SIZE);
++}
++
++static inline void __tlb_reset_range(struct mmu_gather *tlb)
++{
++ tlb->start = TASK_SIZE;
++ tlb->end = 0;
++}
++
++/*
++ * In the case of tlb vma handling, we can optimise these away in the
++ * case where we're doing a full MM flush. When we're doing a munmap,
++ * the vmas are adjusted to only cover the region to be torn down.
++ */
++#ifndef tlb_start_vma
++#define tlb_start_vma(tlb, vma) do { } while (0)
++#endif
++
++#define __tlb_end_vma(tlb, vma) \
++ do { \
++ if (!tlb->fullmm && tlb->end) { \
++ tlb_flush(tlb); \
++ __tlb_reset_range(tlb); \
++ } \
++ } while (0)
++
++#ifndef tlb_end_vma
++#define tlb_end_vma __tlb_end_vma
++#endif
++
++#ifndef __tlb_remove_tlb_entry
++#define __tlb_remove_tlb_entry(tlb, ptep, address) do { } while (0)
++#endif
++
+ /**
+ * tlb_remove_tlb_entry - remember a pte unmapping for later tlb invalidation.
+ *
+- * Record the fact that pte's were really umapped in ->need_flush, so we can
+- * later optimise away the tlb invalidate. This helps when userspace is
+- * unmapping already-unmapped pages, which happens quite a lot.
++ * Record the fact that pte's were really unmapped by updating the range,
++ * so we can later optimise away the tlb invalidate. This helps when
++ * userspace is unmapping already-unmapped pages, which happens quite a lot.
+ */
+ #define tlb_remove_tlb_entry(tlb, ptep, address) \
+ do { \
+- tlb->need_flush = 1; \
++ __tlb_adjust_range(tlb, address); \
+ __tlb_remove_tlb_entry(tlb, ptep, address); \
+ } while (0)
+
+@@ -151,27 +188,27 @@ static inline void tlb_remove_page(struct mmu_gather *tlb, struct page *page)
+
+ #define tlb_remove_pmd_tlb_entry(tlb, pmdp, address) \
+ do { \
+- tlb->need_flush = 1; \
++ __tlb_adjust_range(tlb, address); \
+ __tlb_remove_pmd_tlb_entry(tlb, pmdp, address); \
+ } while (0)
+
+ #define pte_free_tlb(tlb, ptep, address) \
+ do { \
+- tlb->need_flush = 1; \
++ __tlb_adjust_range(tlb, address); \
+ __pte_free_tlb(tlb, ptep, address); \
+ } while (0)
+
+ #ifndef __ARCH_HAS_4LEVEL_HACK
+ #define pud_free_tlb(tlb, pudp, address) \
+ do { \
+- tlb->need_flush = 1; \
++ __tlb_adjust_range(tlb, address); \
+ __pud_free_tlb(tlb, pudp, address); \
+ } while (0)
+ #endif
+
+ #define pmd_free_tlb(tlb, pmdp, address) \
+ do { \
+- tlb->need_flush = 1; \
++ __tlb_adjust_range(tlb, address); \
+ __pmd_free_tlb(tlb, pmdp, address); \
+ } while (0)
+
+diff --git a/include/linux/workqueue.h b/include/linux/workqueue.h
+index b996e6cde6bb..9eb54f41623e 100644
+--- a/include/linux/workqueue.h
++++ b/include/linux/workqueue.h
+@@ -70,7 +70,8 @@ enum {
+ /* data contains off-queue information when !WORK_STRUCT_PWQ */
+ WORK_OFFQ_FLAG_BASE = WORK_STRUCT_COLOR_SHIFT,
+
+- WORK_OFFQ_CANCELING = (1 << WORK_OFFQ_FLAG_BASE),
++ __WORK_OFFQ_CANCELING = WORK_OFFQ_FLAG_BASE,
++ WORK_OFFQ_CANCELING = (1 << __WORK_OFFQ_CANCELING),
+
+ /*
+ * When a work item is off queue, its high bits point to the last
+diff --git a/kernel/cpuset.c b/kernel/cpuset.c
+index 1f107c74087b..672310e1597e 100644
+--- a/kernel/cpuset.c
++++ b/kernel/cpuset.c
+@@ -538,9 +538,6 @@ static void update_domain_attr_tree(struct sched_domain_attr *dattr,
+
+ rcu_read_lock();
+ cpuset_for_each_descendant_pre(cp, pos_css, root_cs) {
+- if (cp == root_cs)
+- continue;
+-
+ /* skip the whole subtree if @cp doesn't have any CPU */
+ if (cpumask_empty(cp->cpus_allowed)) {
+ pos_css = css_rightmost_descendant(pos_css);
+@@ -863,7 +860,7 @@ static void update_cpumasks_hier(struct cpuset *cs, struct cpumask *new_cpus)
+ * If it becomes empty, inherit the effective mask of the
+ * parent, which is guaranteed to have some CPUs.
+ */
+- if (cpumask_empty(new_cpus))
++ if (cgroup_on_dfl(cp->css.cgroup) && cpumask_empty(new_cpus))
+ cpumask_copy(new_cpus, parent->effective_cpus);
+
+ /* Skip the whole subtree if the cpumask remains the same. */
+@@ -1119,7 +1116,7 @@ static void update_nodemasks_hier(struct cpuset *cs, nodemask_t *new_mems)
+ * If it becomes empty, inherit the effective mask of the
+ * parent, which is guaranteed to have some MEMs.
+ */
+- if (nodes_empty(*new_mems))
++ if (cgroup_on_dfl(cp->css.cgroup) && nodes_empty(*new_mems))
+ *new_mems = parent->effective_mems;
+
+ /* Skip the whole subtree if the nodemask remains the same. */
+@@ -1991,7 +1988,9 @@ static int cpuset_css_online(struct cgroup_subsys_state *css)
+
+ mutex_lock(&callback_mutex);
+ cs->mems_allowed = parent->mems_allowed;
++ cs->effective_mems = parent->mems_allowed;
+ cpumask_copy(cs->cpus_allowed, parent->cpus_allowed);
++ cpumask_copy(cs->effective_cpus, parent->cpus_allowed);
+ mutex_unlock(&callback_mutex);
+ out_unlock:
+ mutex_unlock(&cpuset_mutex);
+diff --git a/kernel/printk/console_cmdline.h b/kernel/printk/console_cmdline.h
+index cbd69d842341..2ca4a8b5fe57 100644
+--- a/kernel/printk/console_cmdline.h
++++ b/kernel/printk/console_cmdline.h
+@@ -3,7 +3,7 @@
+
+ struct console_cmdline
+ {
+- char name[8]; /* Name of the driver */
++ char name[16]; /* Name of the driver */
+ int index; /* Minor dev. to use */
+ char *options; /* Options for the driver */
+ #ifdef CONFIG_A11Y_BRAILLE_CONSOLE
+diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c
+index ced2b84b1cb7..bf95fdad4d96 100644
+--- a/kernel/printk/printk.c
++++ b/kernel/printk/printk.c
+@@ -2440,6 +2440,7 @@ void register_console(struct console *newcon)
+ for (i = 0, c = console_cmdline;
+ i < MAX_CMDLINECONSOLES && c->name[0];
+ i++, c++) {
++ BUILD_BUG_ON(sizeof(c->name) != sizeof(newcon->name));
+ if (strcmp(c->name, newcon->name) != 0)
+ continue;
+ if (newcon->index >= 0 &&
+diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
+index 124e2c702ead..d1eff3dd8a02 100644
+--- a/kernel/trace/ftrace.c
++++ b/kernel/trace/ftrace.c
+@@ -1053,6 +1053,12 @@ static __init void ftrace_profile_debugfs(struct dentry *d_tracer)
+
+ static struct pid * const ftrace_swapper_pid = &init_struct_pid;
+
++#ifdef CONFIG_FUNCTION_GRAPH_TRACER
++static int ftrace_graph_active;
++#else
++# define ftrace_graph_active 0
++#endif
++
+ #ifdef CONFIG_DYNAMIC_FTRACE
+
+ static struct ftrace_ops *removed_ops;
+@@ -1849,8 +1855,12 @@ static int ftrace_check_record(struct dyn_ftrace *rec, int enable, int update)
+ if (!ftrace_rec_count(rec))
+ rec->flags = 0;
+ else
+- /* Just disable the record (keep REGS state) */
+- rec->flags &= ~FTRACE_FL_ENABLED;
++ /*
++ * Just disable the record, but keep the ops TRAMP
++ * and REGS states. The _EN flags must be disabled though.
++ */
++ rec->flags &= ~(FTRACE_FL_ENABLED | FTRACE_FL_TRAMP_EN |
++ FTRACE_FL_REGS_EN);
+ }
+
+ return FTRACE_UPDATE_MAKE_NOP;
+@@ -2482,24 +2492,36 @@ static int ftrace_shutdown(struct ftrace_ops *ops, int command)
+
+ static void ftrace_startup_sysctl(void)
+ {
++ int command;
++
+ if (unlikely(ftrace_disabled))
+ return;
+
+ /* Force update next time */
+ saved_ftrace_func = NULL;
+ /* ftrace_start_up is true if we want ftrace running */
+- if (ftrace_start_up)
+- ftrace_run_update_code(FTRACE_UPDATE_CALLS);
++ if (ftrace_start_up) {
++ command = FTRACE_UPDATE_CALLS;
++ if (ftrace_graph_active)
++ command |= FTRACE_START_FUNC_RET;
++ ftrace_startup_enable(command);
++ }
+ }
+
+ static void ftrace_shutdown_sysctl(void)
+ {
++ int command;
++
+ if (unlikely(ftrace_disabled))
+ return;
+
+ /* ftrace_start_up is true if ftrace is running */
+- if (ftrace_start_up)
+- ftrace_run_update_code(FTRACE_DISABLE_CALLS);
++ if (ftrace_start_up) {
++ command = FTRACE_DISABLE_CALLS;
++ if (ftrace_graph_active)
++ command |= FTRACE_STOP_FUNC_RET;
++ ftrace_run_update_code(command);
++ }
+ }
+
+ static cycle_t ftrace_update_time;
+@@ -5303,12 +5325,12 @@ ftrace_enable_sysctl(struct ctl_table *table, int write,
+
+ if (ftrace_enabled) {
+
+- ftrace_startup_sysctl();
+-
+ /* we are starting ftrace again */
+ if (ftrace_ops_list != &ftrace_list_end)
+ update_ftrace_function();
+
++ ftrace_startup_sysctl();
++
+ } else {
+ /* stopping ftrace calls (just send to ftrace_stub) */
+ ftrace_trace_function = ftrace_stub;
+@@ -5334,8 +5356,6 @@ static struct ftrace_ops graph_ops = {
+ ASSIGN_OPS_HASH(graph_ops, &global_ops.local_hash)
+ };
+
+-static int ftrace_graph_active;
+-
+ int ftrace_graph_entry_stub(struct ftrace_graph_ent *trace)
+ {
+ return 0;
+diff --git a/kernel/workqueue.c b/kernel/workqueue.c
+index 66940a53d128..2273f534b01a 100644
+--- a/kernel/workqueue.c
++++ b/kernel/workqueue.c
+@@ -2710,19 +2710,57 @@ bool flush_work(struct work_struct *work)
+ }
+ EXPORT_SYMBOL_GPL(flush_work);
+
++struct cwt_wait {
++ wait_queue_t wait;
++ struct work_struct *work;
++};
++
++static int cwt_wakefn(wait_queue_t *wait, unsigned mode, int sync, void *key)
++{
++ struct cwt_wait *cwait = container_of(wait, struct cwt_wait, wait);
++
++ if (cwait->work != key)
++ return 0;
++ return autoremove_wake_function(wait, mode, sync, key);
++}
++
+ static bool __cancel_work_timer(struct work_struct *work, bool is_dwork)
+ {
++ static DECLARE_WAIT_QUEUE_HEAD(cancel_waitq);
+ unsigned long flags;
+ int ret;
+
+ do {
+ ret = try_to_grab_pending(work, is_dwork, &flags);
+ /*
+- * If someone else is canceling, wait for the same event it
+- * would be waiting for before retrying.
++ * If someone else is already canceling, wait for it to
++ * finish. flush_work() doesn't work for PREEMPT_NONE
++ * because we may get scheduled between @work's completion
++ * and the other canceling task resuming and clearing
++ * CANCELING - flush_work() will return false immediately
++ * as @work is no longer busy, try_to_grab_pending() will
++ * return -ENOENT as @work is still being canceled and the
++ * other canceling task won't be able to clear CANCELING as
++ * we're hogging the CPU.
++ *
++ * Let's wait for completion using a waitqueue. As this
++ * may lead to the thundering herd problem, use a custom
++ * wake function which matches @work along with exclusive
++ * wait and wakeup.
+ */
+- if (unlikely(ret == -ENOENT))
+- flush_work(work);
++ if (unlikely(ret == -ENOENT)) {
++ struct cwt_wait cwait;
++
++ init_wait(&cwait.wait);
++ cwait.wait.func = cwt_wakefn;
++ cwait.work = work;
++
++ prepare_to_wait_exclusive(&cancel_waitq, &cwait.wait,
++ TASK_UNINTERRUPTIBLE);
++ if (work_is_canceling(work))
++ schedule();
++ finish_wait(&cancel_waitq, &cwait.wait);
++ }
+ } while (unlikely(ret < 0));
+
+ /* tell other tasks trying to grab @work to back off */
+@@ -2731,6 +2769,16 @@ static bool __cancel_work_timer(struct work_struct *work, bool is_dwork)
+
+ flush_work(work);
+ clear_work_data(work);
++
++ /*
++ * Paired with prepare_to_wait() above so that either
++ * waitqueue_active() is visible here or !work_is_canceling() is
++ * visible there.
++ */
++ smp_mb();
++ if (waitqueue_active(&cancel_waitq))
++ __wake_up(&cancel_waitq, TASK_NORMAL, 1, work);
++
+ return ret;
+ }
+
+diff --git a/lib/lz4/lz4_decompress.c b/lib/lz4/lz4_decompress.c
+index 7a85967060a5..f0f5c5c3de12 100644
+--- a/lib/lz4/lz4_decompress.c
++++ b/lib/lz4/lz4_decompress.c
+@@ -139,6 +139,9 @@ static int lz4_uncompress(const char *source, char *dest, int osize)
+ /* Error: request to write beyond destination buffer */
+ if (cpy > oend)
+ goto _output_error;
++ if ((ref + COPYLENGTH) > oend ||
++ (op + COPYLENGTH) > oend)
++ goto _output_error;
+ LZ4_SECURECOPY(ref, op, (oend - COPYLENGTH));
+ while (op < cpy)
+ *op++ = *ref++;
+diff --git a/mm/memory.c b/mm/memory.c
+index 4ffa7b571fb8..90fb265b32b6 100644
+--- a/mm/memory.c
++++ b/mm/memory.c
+@@ -220,9 +220,6 @@ void tlb_gather_mmu(struct mmu_gather *tlb, struct mm_struct *mm, unsigned long
+ /* Is it from 0 to ~0? */
+ tlb->fullmm = !(start | (end+1));
+ tlb->need_flush_all = 0;
+- tlb->start = start;
+- tlb->end = end;
+- tlb->need_flush = 0;
+ tlb->local.next = NULL;
+ tlb->local.nr = 0;
+ tlb->local.max = ARRAY_SIZE(tlb->__pages);
+@@ -232,15 +229,20 @@ void tlb_gather_mmu(struct mmu_gather *tlb, struct mm_struct *mm, unsigned long
+ #ifdef CONFIG_HAVE_RCU_TABLE_FREE
+ tlb->batch = NULL;
+ #endif
++
++ __tlb_reset_range(tlb);
+ }
+
+ static void tlb_flush_mmu_tlbonly(struct mmu_gather *tlb)
+ {
+- tlb->need_flush = 0;
++ if (!tlb->end)
++ return;
++
+ tlb_flush(tlb);
+ #ifdef CONFIG_HAVE_RCU_TABLE_FREE
+ tlb_table_flush(tlb);
+ #endif
++ __tlb_reset_range(tlb);
+ }
+
+ static void tlb_flush_mmu_free(struct mmu_gather *tlb)
+@@ -256,8 +258,6 @@ static void tlb_flush_mmu_free(struct mmu_gather *tlb)
+
+ void tlb_flush_mmu(struct mmu_gather *tlb)
+ {
+- if (!tlb->need_flush)
+- return;
+ tlb_flush_mmu_tlbonly(tlb);
+ tlb_flush_mmu_free(tlb);
+ }
+@@ -292,7 +292,7 @@ int __tlb_remove_page(struct mmu_gather *tlb, struct page *page)
+ {
+ struct mmu_gather_batch *batch;
+
+- VM_BUG_ON(!tlb->need_flush);
++ VM_BUG_ON(!tlb->end);
+
+ batch = tlb->active;
+ batch->pages[batch->nr++] = page;
+@@ -359,8 +359,6 @@ void tlb_remove_table(struct mmu_gather *tlb, void *table)
+ {
+ struct mmu_table_batch **batch = &tlb->batch;
+
+- tlb->need_flush = 1;
+-
+ /*
+ * When there's less then two users of this mm there cannot be a
+ * concurrent page-table walk.
+@@ -1186,20 +1184,8 @@ again:
+ arch_leave_lazy_mmu_mode();
+
+ /* Do the actual TLB flush before dropping ptl */
+- if (force_flush) {
+- unsigned long old_end;
+-
+- /*
+- * Flush the TLB just for the previous segment,
+- * then update the range to be the remaining
+- * TLB range.
+- */
+- old_end = tlb->end;
+- tlb->end = addr;
++ if (force_flush)
+ tlb_flush_mmu_tlbonly(tlb);
+- tlb->start = addr;
+- tlb->end = old_end;
+- }
+ pte_unmap_unlock(start_pte, ptl);
+
+ /*
+diff --git a/net/caif/caif_socket.c b/net/caif/caif_socket.c
+index 43f750e88e19..765c78110fa8 100644
+--- a/net/caif/caif_socket.c
++++ b/net/caif/caif_socket.c
+@@ -281,7 +281,7 @@ static int caif_seqpkt_recvmsg(struct kiocb *iocb, struct socket *sock,
+ int copylen;
+
+ ret = -EOPNOTSUPP;
+- if (m->msg_flags&MSG_OOB)
++ if (flags & MSG_OOB)
+ goto read_error;
+
+ skb = skb_recv_datagram(sk, flags, 0 , &ret);
+diff --git a/net/can/af_can.c b/net/can/af_can.c
+index ce82337521f6..d6030d6949df 100644
+--- a/net/can/af_can.c
++++ b/net/can/af_can.c
+@@ -262,6 +262,9 @@ int can_send(struct sk_buff *skb, int loop)
+ goto inval_skb;
+ }
+
++ skb->ip_summed = CHECKSUM_UNNECESSARY;
++
++ skb_reset_mac_header(skb);
+ skb_reset_network_header(skb);
+ skb_reset_transport_header(skb);
+
+diff --git a/net/compat.c b/net/compat.c
+index c48930373e65..53e933eb78b8 100644
+--- a/net/compat.c
++++ b/net/compat.c
+@@ -71,6 +71,13 @@ int get_compat_msghdr(struct msghdr *kmsg, struct compat_msghdr __user *umsg)
+ __get_user(kmsg->msg_controllen, &umsg->msg_controllen) ||
+ __get_user(kmsg->msg_flags, &umsg->msg_flags))
+ return -EFAULT;
++
++ if (!tmp1)
++ kmsg->msg_namelen = 0;
++
++ if (kmsg->msg_namelen < 0)
++ return -EINVAL;
++
+ if (kmsg->msg_namelen > sizeof(struct sockaddr_storage))
+ kmsg->msg_namelen = sizeof(struct sockaddr_storage);
+ kmsg->msg_name = compat_ptr(tmp1);
+diff --git a/net/core/sysctl_net_core.c b/net/core/sysctl_net_core.c
+index cf9cd13509a7..e731c96eac4b 100644
+--- a/net/core/sysctl_net_core.c
++++ b/net/core/sysctl_net_core.c
+@@ -25,6 +25,8 @@
+ static int zero = 0;
+ static int one = 1;
+ static int ushort_max = USHRT_MAX;
++static int min_sndbuf = SOCK_MIN_SNDBUF;
++static int min_rcvbuf = SOCK_MIN_RCVBUF;
+
+ #ifdef CONFIG_RPS
+ static int rps_sock_flow_sysctl(struct ctl_table *table, int write,
+@@ -223,7 +225,7 @@ static struct ctl_table net_core_table[] = {
+ .maxlen = sizeof(int),
+ .mode = 0644,
+ .proc_handler = proc_dointvec_minmax,
+- .extra1 = &one,
++ .extra1 = &min_sndbuf,
+ },
+ {
+ .procname = "rmem_max",
+@@ -231,7 +233,7 @@ static struct ctl_table net_core_table[] = {
+ .maxlen = sizeof(int),
+ .mode = 0644,
+ .proc_handler = proc_dointvec_minmax,
+- .extra1 = &one,
++ .extra1 = &min_rcvbuf,
+ },
+ {
+ .procname = "wmem_default",
+@@ -239,7 +241,7 @@ static struct ctl_table net_core_table[] = {
+ .maxlen = sizeof(int),
+ .mode = 0644,
+ .proc_handler = proc_dointvec_minmax,
+- .extra1 = &one,
++ .extra1 = &min_sndbuf,
+ },
+ {
+ .procname = "rmem_default",
+@@ -247,7 +249,7 @@ static struct ctl_table net_core_table[] = {
+ .maxlen = sizeof(int),
+ .mode = 0644,
+ .proc_handler = proc_dointvec_minmax,
+- .extra1 = &one,
++ .extra1 = &min_rcvbuf,
+ },
+ {
+ .procname = "dev_weight",
+diff --git a/net/ipv4/inet_diag.c b/net/ipv4/inet_diag.c
+index e34dccbc4d70..4eeba4e497a0 100644
+--- a/net/ipv4/inet_diag.c
++++ b/net/ipv4/inet_diag.c
+@@ -71,6 +71,20 @@ static inline void inet_diag_unlock_handler(
+ mutex_unlock(&inet_diag_table_mutex);
+ }
+
++static size_t inet_sk_attr_size(void)
++{
++ return nla_total_size(sizeof(struct tcp_info))
++ + nla_total_size(1) /* INET_DIAG_SHUTDOWN */
++ + nla_total_size(1) /* INET_DIAG_TOS */
++ + nla_total_size(1) /* INET_DIAG_TCLASS */
++ + nla_total_size(sizeof(struct inet_diag_meminfo))
++ + nla_total_size(sizeof(struct inet_diag_msg))
++ + nla_total_size(SK_MEMINFO_VARS * sizeof(u32))
++ + nla_total_size(TCP_CA_NAME_MAX)
++ + nla_total_size(sizeof(struct tcpvegas_info))
++ + 64;
++}
++
+ int inet_sk_diag_fill(struct sock *sk, struct inet_connection_sock *icsk,
+ struct sk_buff *skb, struct inet_diag_req_v2 *req,
+ struct user_namespace *user_ns,
+@@ -324,9 +338,7 @@ int inet_diag_dump_one_icsk(struct inet_hashinfo *hashinfo, struct sk_buff *in_s
+ if (err)
+ goto out;
+
+- rep = nlmsg_new(sizeof(struct inet_diag_msg) +
+- sizeof(struct inet_diag_meminfo) +
+- sizeof(struct tcp_info) + 64, GFP_KERNEL);
++ rep = nlmsg_new(inet_sk_attr_size(), GFP_KERNEL);
+ if (!rep) {
+ err = -ENOMEM;
+ goto out;
+diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
+index c2df40ba553f..022ecbc9322d 100644
+--- a/net/ipv4/tcp_output.c
++++ b/net/ipv4/tcp_output.c
+@@ -2739,15 +2739,11 @@ void tcp_send_fin(struct sock *sk)
+ } else {
+ /* Socket is locked, keep trying until memory is available. */
+ for (;;) {
+- skb = alloc_skb_fclone(MAX_TCP_HEADER,
+- sk->sk_allocation);
++ skb = sk_stream_alloc_skb(sk, 0, sk->sk_allocation);
+ if (skb)
+ break;
+ yield();
+ }
+-
+- /* Reserve space for headers and prepare control bits. */
+- skb_reserve(skb, MAX_TCP_HEADER);
+ /* FIN eats a sequence byte, write_seq advanced by tcp_queue_skb(). */
+ tcp_init_nondata_skb(skb, tp->write_seq,
+ TCPHDR_ACK | TCPHDR_FIN);
+@@ -2998,9 +2994,9 @@ static int tcp_send_syn_data(struct sock *sk, struct sk_buff *syn)
+ {
+ struct tcp_sock *tp = tcp_sk(sk);
+ struct tcp_fastopen_request *fo = tp->fastopen_req;
+- int syn_loss = 0, space, i, err = 0, iovlen = fo->data->msg_iovlen;
+- struct sk_buff *syn_data = NULL, *data;
++ int syn_loss = 0, space, err = 0;
+ unsigned long last_syn_loss = 0;
++ struct sk_buff *syn_data;
+
+ tp->rx_opt.mss_clamp = tp->advmss; /* If MSS is not cached */
+ tcp_fastopen_cache_get(sk, &tp->rx_opt.mss_clamp, &fo->cookie,
+@@ -3031,48 +3027,40 @@ static int tcp_send_syn_data(struct sock *sk, struct sk_buff *syn)
+ /* limit to order-0 allocations */
+ space = min_t(size_t, space, SKB_MAX_HEAD(MAX_TCP_HEADER));
+
+- syn_data = skb_copy_expand(syn, MAX_TCP_HEADER, space,
+- sk->sk_allocation);
+- if (syn_data == NULL)
++ syn_data = sk_stream_alloc_skb(sk, space, sk->sk_allocation);
++ if (!syn_data)
++ goto fallback;
++ syn_data->ip_summed = CHECKSUM_PARTIAL;
++ memcpy(syn_data->cb, syn->cb, sizeof(syn->cb));
++ if (unlikely(memcpy_fromiovecend(skb_put(syn_data, space),
++ fo->data->msg_iov, 0, space))) {
++ kfree_skb(syn_data);
+ goto fallback;
++ }
+
+- for (i = 0; i < iovlen && syn_data->len < space; ++i) {
+- struct iovec *iov = &fo->data->msg_iov[i];
+- unsigned char __user *from = iov->iov_base;
+- int len = iov->iov_len;
++ /* No more data pending in inet_wait_for_connect() */
++ if (space == fo->size)
++ fo->data = NULL;
++ fo->copied = space;
+
+- if (syn_data->len + len > space)
+- len = space - syn_data->len;
+- else if (i + 1 == iovlen)
+- /* No more data pending in inet_wait_for_connect() */
+- fo->data = NULL;
++ tcp_connect_queue_skb(sk, syn_data);
+
+- if (skb_add_data(syn_data, from, len))
+- goto fallback;
+- }
++ err = tcp_transmit_skb(sk, syn_data, 1, sk->sk_allocation);
+
+- /* Queue a data-only packet after the regular SYN for retransmission */
+- data = pskb_copy(syn_data, sk->sk_allocation);
+- if (data == NULL)
+- goto fallback;
+- TCP_SKB_CB(data)->seq++;
+- TCP_SKB_CB(data)->tcp_flags &= ~TCPHDR_SYN;
+- TCP_SKB_CB(data)->tcp_flags = (TCPHDR_ACK|TCPHDR_PSH);
+- tcp_connect_queue_skb(sk, data);
+- fo->copied = data->len;
+-
+- /* syn_data is about to be sent, we need to take current time stamps
+- * for the packets that are in write queue : SYN packet and DATA
+- */
+- skb_mstamp_get(&syn->skb_mstamp);
+- data->skb_mstamp = syn->skb_mstamp;
++ syn->skb_mstamp = syn_data->skb_mstamp;
+
+- if (tcp_transmit_skb(sk, syn_data, 0, sk->sk_allocation) == 0) {
++ /* Now full SYN+DATA was cloned and sent (or not),
++ * remove the SYN from the original skb (syn_data)
++ * we keep in write queue in case of a retransmit, as we
++ * also have the SYN packet (with no data) in the same queue.
++ */
++ TCP_SKB_CB(syn_data)->seq++;
++ TCP_SKB_CB(syn_data)->tcp_flags = TCPHDR_ACK | TCPHDR_PSH;
++ if (!err) {
+ tp->syn_data = (fo->copied > 0);
+ NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPORIGDATASENT);
+ goto done;
+ }
+- syn_data = NULL;
+
+ fallback:
+ /* Send a regular SYN with Fast Open cookie request option */
+@@ -3081,7 +3069,6 @@ fallback:
+ err = tcp_transmit_skb(sk, syn, 1, sk->sk_allocation);
+ if (err)
+ tp->syn_fastopen = 0;
+- kfree_skb(syn_data);
+ done:
+ fo->cookie.len = -1; /* Exclude Fast Open option for SYN retries */
+ return err;
+@@ -3101,13 +3088,10 @@ int tcp_connect(struct sock *sk)
+ return 0;
+ }
+
+- buff = alloc_skb_fclone(MAX_TCP_HEADER + 15, sk->sk_allocation);
+- if (unlikely(buff == NULL))
++ buff = sk_stream_alloc_skb(sk, 0, sk->sk_allocation);
++ if (unlikely(!buff))
+ return -ENOBUFS;
+
+- /* Reserve space for headers. */
+- skb_reserve(buff, MAX_TCP_HEADER);
+-
+ tcp_init_nondata_skb(buff, tp->write_seq++, TCPHDR_SYN);
+ tp->retrans_stamp = tcp_time_stamp;
+ tcp_connect_queue_skb(sk, buff);
+diff --git a/net/ipv6/fib6_rules.c b/net/ipv6/fib6_rules.c
+index b4d5e1d97c1b..27ca79682efb 100644
+--- a/net/ipv6/fib6_rules.c
++++ b/net/ipv6/fib6_rules.c
+@@ -104,6 +104,7 @@ static int fib6_rule_action(struct fib_rule *rule, struct flowi *flp,
+ goto again;
+ flp6->saddr = saddr;
+ }
++ err = rt->dst.error;
+ goto out;
+ }
+ again:
+diff --git a/net/rds/iw_rdma.c b/net/rds/iw_rdma.c
+index a817705ce2d0..dba8d0864f18 100644
+--- a/net/rds/iw_rdma.c
++++ b/net/rds/iw_rdma.c
+@@ -88,7 +88,9 @@ static unsigned int rds_iw_unmap_fastreg_list(struct rds_iw_mr_pool *pool,
+ int *unpinned);
+ static void rds_iw_destroy_fastreg(struct rds_iw_mr_pool *pool, struct rds_iw_mr *ibmr);
+
+-static int rds_iw_get_device(struct rds_sock *rs, struct rds_iw_device **rds_iwdev, struct rdma_cm_id **cm_id)
++static int rds_iw_get_device(struct sockaddr_in *src, struct sockaddr_in *dst,
++ struct rds_iw_device **rds_iwdev,
++ struct rdma_cm_id **cm_id)
+ {
+ struct rds_iw_device *iwdev;
+ struct rds_iw_cm_id *i_cm_id;
+@@ -112,15 +114,15 @@ static int rds_iw_get_device(struct rds_sock *rs, struct rds_iw_device **rds_iwd
+ src_addr->sin_port,
+ dst_addr->sin_addr.s_addr,
+ dst_addr->sin_port,
+- rs->rs_bound_addr,
+- rs->rs_bound_port,
+- rs->rs_conn_addr,
+- rs->rs_conn_port);
++ src->sin_addr.s_addr,
++ src->sin_port,
++ dst->sin_addr.s_addr,
++ dst->sin_port);
+ #ifdef WORKING_TUPLE_DETECTION
+- if (src_addr->sin_addr.s_addr == rs->rs_bound_addr &&
+- src_addr->sin_port == rs->rs_bound_port &&
+- dst_addr->sin_addr.s_addr == rs->rs_conn_addr &&
+- dst_addr->sin_port == rs->rs_conn_port) {
++ if (src_addr->sin_addr.s_addr == src->sin_addr.s_addr &&
++ src_addr->sin_port == src->sin_port &&
++ dst_addr->sin_addr.s_addr == dst->sin_addr.s_addr &&
++ dst_addr->sin_port == dst->sin_port) {
+ #else
+ /* FIXME - needs to compare the local and remote
+ * ipaddr/port tuple, but the ipaddr is the only
+@@ -128,7 +130,7 @@ static int rds_iw_get_device(struct rds_sock *rs, struct rds_iw_device **rds_iwd
+ * zero'ed. It doesn't appear to be properly populated
+ * during connection setup...
+ */
+- if (src_addr->sin_addr.s_addr == rs->rs_bound_addr) {
++ if (src_addr->sin_addr.s_addr == src->sin_addr.s_addr) {
+ #endif
+ spin_unlock_irq(&iwdev->spinlock);
+ *rds_iwdev = iwdev;
+@@ -180,19 +182,13 @@ int rds_iw_update_cm_id(struct rds_iw_device *rds_iwdev, struct rdma_cm_id *cm_i
+ {
+ struct sockaddr_in *src_addr, *dst_addr;
+ struct rds_iw_device *rds_iwdev_old;
+- struct rds_sock rs;
+ struct rdma_cm_id *pcm_id;
+ int rc;
+
+ src_addr = (struct sockaddr_in *)&cm_id->route.addr.src_addr;
+ dst_addr = (struct sockaddr_in *)&cm_id->route.addr.dst_addr;
+
+- rs.rs_bound_addr = src_addr->sin_addr.s_addr;
+- rs.rs_bound_port = src_addr->sin_port;
+- rs.rs_conn_addr = dst_addr->sin_addr.s_addr;
+- rs.rs_conn_port = dst_addr->sin_port;
+-
+- rc = rds_iw_get_device(&rs, &rds_iwdev_old, &pcm_id);
++ rc = rds_iw_get_device(src_addr, dst_addr, &rds_iwdev_old, &pcm_id);
+ if (rc)
+ rds_iw_remove_cm_id(rds_iwdev, cm_id);
+
+@@ -598,9 +594,17 @@ void *rds_iw_get_mr(struct scatterlist *sg, unsigned long nents,
+ struct rds_iw_device *rds_iwdev;
+ struct rds_iw_mr *ibmr = NULL;
+ struct rdma_cm_id *cm_id;
++ struct sockaddr_in src = {
++ .sin_addr.s_addr = rs->rs_bound_addr,
++ .sin_port = rs->rs_bound_port,
++ };
++ struct sockaddr_in dst = {
++ .sin_addr.s_addr = rs->rs_conn_addr,
++ .sin_port = rs->rs_conn_port,
++ };
+ int ret;
+
+- ret = rds_iw_get_device(rs, &rds_iwdev, &cm_id);
++ ret = rds_iw_get_device(&src, &dst, &rds_iwdev, &cm_id);
+ if (ret || !cm_id) {
+ ret = -ENODEV;
+ goto out;
+diff --git a/net/rxrpc/ar-recvmsg.c b/net/rxrpc/ar-recvmsg.c
+index e9aaa65c0778..0df95463c650 100644
+--- a/net/rxrpc/ar-recvmsg.c
++++ b/net/rxrpc/ar-recvmsg.c
+@@ -87,7 +87,7 @@ int rxrpc_recvmsg(struct kiocb *iocb, struct socket *sock,
+ if (!skb) {
+ /* nothing remains on the queue */
+ if (copied &&
+- (msg->msg_flags & MSG_PEEK || timeo == 0))
++ (flags & MSG_PEEK || timeo == 0))
+ goto out;
+
+ /* wait for a message to turn up */
+diff --git a/net/sched/cls_u32.c b/net/sched/cls_u32.c
+index 0472909bb014..b78d81f5ffda 100644
+--- a/net/sched/cls_u32.c
++++ b/net/sched/cls_u32.c
+@@ -78,8 +78,11 @@ struct tc_u_hnode {
+ struct tc_u_common *tp_c;
+ int refcnt;
+ unsigned int divisor;
+- struct tc_u_knode __rcu *ht[1];
+ struct rcu_head rcu;
++ /* The 'ht' field MUST be the last field in structure to allow for
++ * more entries allocated at end of structure.
++ */
++ struct tc_u_knode __rcu *ht[1];
+ };
+
+ struct tc_u_common {
+diff --git a/sound/core/control.c b/sound/core/control.c
+index b9611344ff9e..82a638a01b24 100644
+--- a/sound/core/control.c
++++ b/sound/core/control.c
+@@ -1167,6 +1167,10 @@ static int snd_ctl_elem_add(struct snd_ctl_file *file,
+
+ if (info->count < 1)
+ return -EINVAL;
++ if (!*info->id.name)
++ return -EINVAL;
++ if (strnlen(info->id.name, sizeof(info->id.name)) >= sizeof(info->id.name))
++ return -EINVAL;
+ access = info->access == 0 ? SNDRV_CTL_ELEM_ACCESS_READWRITE :
+ (info->access & (SNDRV_CTL_ELEM_ACCESS_READWRITE|
+ SNDRV_CTL_ELEM_ACCESS_INACTIVE|
+diff --git a/sound/pci/hda/hda_controller.c b/sound/pci/hda/hda_controller.c
+index 84c94301bfaf..20aa52b14b84 100644
+--- a/sound/pci/hda/hda_controller.c
++++ b/sound/pci/hda/hda_controller.c
+@@ -1160,7 +1160,7 @@ static unsigned int azx_rirb_get_response(struct hda_bus *bus,
+ }
+ }
+
+- if (!bus->no_response_fallback)
++ if (bus->no_response_fallback)
+ return -1;
+
+ if (!chip->polling_mode && chip->poll_count < 2) {
+diff --git a/sound/pci/hda/hda_generic.c b/sound/pci/hda/hda_generic.c
+index 64220c08bd98..6c6e35aba989 100644
+--- a/sound/pci/hda/hda_generic.c
++++ b/sound/pci/hda/hda_generic.c
+@@ -637,12 +637,45 @@ static int get_amp_val_to_activate(struct hda_codec *codec, hda_nid_t nid,
+ return val;
+ }
+
++/* is this a stereo widget or a stereo-to-mono mix? */
++static bool is_stereo_amps(struct hda_codec *codec, hda_nid_t nid, int dir)
++{
++ unsigned int wcaps = get_wcaps(codec, nid);
++ hda_nid_t conn;
++
++ if (wcaps & AC_WCAP_STEREO)
++ return true;
++ if (dir != HDA_INPUT || get_wcaps_type(wcaps) != AC_WID_AUD_MIX)
++ return false;
++ if (snd_hda_get_num_conns(codec, nid) != 1)
++ return false;
++ if (snd_hda_get_connections(codec, nid, &conn, 1) < 0)
++ return false;
++ return !!(get_wcaps(codec, conn) & AC_WCAP_STEREO);
++}
++
+ /* initialize the amp value (only at the first time) */
+ static void init_amp(struct hda_codec *codec, hda_nid_t nid, int dir, int idx)
+ {
+ unsigned int caps = query_amp_caps(codec, nid, dir);
+ int val = get_amp_val_to_activate(codec, nid, dir, caps, false);
+- snd_hda_codec_amp_init_stereo(codec, nid, dir, idx, 0xff, val);
++
++ if (is_stereo_amps(codec, nid, dir))
++ snd_hda_codec_amp_init_stereo(codec, nid, dir, idx, 0xff, val);
++ else
++ snd_hda_codec_amp_init(codec, nid, 0, dir, idx, 0xff, val);
++}
++
++/* update the amp, doing in stereo or mono depending on NID */
++static int update_amp(struct hda_codec *codec, hda_nid_t nid, int dir, int idx,
++ unsigned int mask, unsigned int val)
++{
++ if (is_stereo_amps(codec, nid, dir))
++ return snd_hda_codec_amp_stereo(codec, nid, dir, idx,
++ mask, val);
++ else
++ return snd_hda_codec_amp_update(codec, nid, 0, dir, idx,
++ mask, val);
+ }
+
+ /* calculate amp value mask we can modify;
+@@ -682,7 +715,7 @@ static void activate_amp(struct hda_codec *codec, hda_nid_t nid, int dir,
+ return;
+
+ val &= mask;
+- snd_hda_codec_amp_stereo(codec, nid, dir, idx, mask, val);
++ update_amp(codec, nid, dir, idx, mask, val);
+ }
+
+ static void activate_amp_out(struct hda_codec *codec, struct nid_path *path,
+@@ -4331,13 +4364,11 @@ static void mute_all_mixer_nid(struct hda_codec *codec, hda_nid_t mix)
+ has_amp = nid_has_mute(codec, mix, HDA_INPUT);
+ for (i = 0; i < nums; i++) {
+ if (has_amp)
+- snd_hda_codec_amp_stereo(codec, mix,
+- HDA_INPUT, i,
+- 0xff, HDA_AMP_MUTE);
++ update_amp(codec, mix, HDA_INPUT, i,
++ 0xff, HDA_AMP_MUTE);
+ else if (nid_has_volume(codec, conn[i], HDA_OUTPUT))
+- snd_hda_codec_amp_stereo(codec, conn[i],
+- HDA_OUTPUT, 0,
+- 0xff, HDA_AMP_MUTE);
++ update_amp(codec, conn[i], HDA_OUTPUT, 0,
++ 0xff, HDA_AMP_MUTE);
+ }
+ }
+
+diff --git a/sound/pci/hda/hda_proc.c b/sound/pci/hda/hda_proc.c
+index ce5a6da83419..05e19f78b4cb 100644
+--- a/sound/pci/hda/hda_proc.c
++++ b/sound/pci/hda/hda_proc.c
+@@ -134,13 +134,38 @@ static void print_amp_caps(struct snd_info_buffer *buffer,
+ (caps & AC_AMPCAP_MUTE) >> AC_AMPCAP_MUTE_SHIFT);
+ }
+
++/* is this a stereo widget or a stereo-to-mono mix? */
++static bool is_stereo_amps(struct hda_codec *codec, hda_nid_t nid,
++ int dir, unsigned int wcaps, int indices)
++{
++ hda_nid_t conn;
++
++ if (wcaps & AC_WCAP_STEREO)
++ return true;
++ /* check for a stereo-to-mono mix; it must be:
++ * only a single connection, only for input, and only a mixer widget
++ */
++ if (indices != 1 || dir != HDA_INPUT ||
++ get_wcaps_type(wcaps) != AC_WID_AUD_MIX)
++ return false;
++
++ if (snd_hda_get_raw_connections(codec, nid, &conn, 1) < 0)
++ return false;
++ /* the connection source is a stereo? */
++ wcaps = snd_hda_param_read(codec, conn, AC_PAR_AUDIO_WIDGET_CAP);
++ return !!(wcaps & AC_WCAP_STEREO);
++}
++
+ static void print_amp_vals(struct snd_info_buffer *buffer,
+ struct hda_codec *codec, hda_nid_t nid,
+- int dir, int stereo, int indices)
++ int dir, unsigned int wcaps, int indices)
+ {
+ unsigned int val;
++ bool stereo;
+ int i;
+
++ stereo = is_stereo_amps(codec, nid, dir, wcaps, indices);
++
+ dir = dir == HDA_OUTPUT ? AC_AMP_GET_OUTPUT : AC_AMP_GET_INPUT;
+ for (i = 0; i < indices; i++) {
+ snd_iprintf(buffer, " [");
+@@ -757,12 +782,10 @@ static void print_codec_info(struct snd_info_entry *entry,
+ (codec->single_adc_amp &&
+ wid_type == AC_WID_AUD_IN))
+ print_amp_vals(buffer, codec, nid, HDA_INPUT,
+- wid_caps & AC_WCAP_STEREO,
+- 1);
++ wid_caps, 1);
+ else
+ print_amp_vals(buffer, codec, nid, HDA_INPUT,
+- wid_caps & AC_WCAP_STEREO,
+- conn_len);
++ wid_caps, conn_len);
+ }
+ if (wid_caps & AC_WCAP_OUT_AMP) {
+ snd_iprintf(buffer, " Amp-Out caps: ");
+@@ -771,11 +794,10 @@ static void print_codec_info(struct snd_info_entry *entry,
+ if (wid_type == AC_WID_PIN &&
+ codec->pin_amp_workaround)
+ print_amp_vals(buffer, codec, nid, HDA_OUTPUT,
+- wid_caps & AC_WCAP_STEREO,
+- conn_len);
++ wid_caps, conn_len);
+ else
+ print_amp_vals(buffer, codec, nid, HDA_OUTPUT,
+- wid_caps & AC_WCAP_STEREO, 1);
++ wid_caps, 1);
+ }
+
+ switch (wid_type) {
+diff --git a/sound/pci/hda/patch_cirrus.c b/sound/pci/hda/patch_cirrus.c
+index 1589c9bcce3e..dd2b3d92071f 100644
+--- a/sound/pci/hda/patch_cirrus.c
++++ b/sound/pci/hda/patch_cirrus.c
+@@ -393,6 +393,7 @@ static const struct snd_pci_quirk cs420x_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x106b, 0x1c00, "MacBookPro 8,1", CS420X_MBP81),
+ SND_PCI_QUIRK(0x106b, 0x2000, "iMac 12,2", CS420X_IMAC27_122),
+ SND_PCI_QUIRK(0x106b, 0x2800, "MacBookPro 10,1", CS420X_MBP101),
++ SND_PCI_QUIRK(0x106b, 0x5600, "MacBookAir 5,2", CS420X_MBP81),
+ SND_PCI_QUIRK(0x106b, 0x5b00, "MacBookAir 4,2", CS420X_MBA42),
+ SND_PCI_QUIRK_VENDOR(0x106b, "Apple", CS420X_APPLE),
+ {} /* terminator */
+@@ -584,6 +585,7 @@ static int patch_cs420x(struct hda_codec *codec)
+ return -ENOMEM;
+
+ spec->gen.automute_hook = cs_automute;
++ codec->single_adc_amp = 1;
+
+ snd_hda_pick_fixup(codec, cs420x_models, cs420x_fixup_tbl,
+ cs420x_fixups);
+diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
+index e9ebc7bd752c..1b1e8c68edd6 100644
+--- a/sound/pci/hda/patch_conexant.c
++++ b/sound/pci/hda/patch_conexant.c
+@@ -223,6 +223,7 @@ enum {
+ CXT_PINCFG_LENOVO_TP410,
+ CXT_PINCFG_LEMOTE_A1004,
+ CXT_PINCFG_LEMOTE_A1205,
++ CXT_PINCFG_COMPAQ_CQ60,
+ CXT_FIXUP_STEREO_DMIC,
+ CXT_FIXUP_INC_MIC_BOOST,
+ CXT_FIXUP_HEADPHONE_MIC_PIN,
+@@ -660,6 +661,15 @@ static const struct hda_fixup cxt_fixups[] = {
+ .type = HDA_FIXUP_PINS,
+ .v.pins = cxt_pincfg_lemote,
+ },
++ [CXT_PINCFG_COMPAQ_CQ60] = {
++ .type = HDA_FIXUP_PINS,
++ .v.pins = (const struct hda_pintbl[]) {
++ /* 0x17 was falsely set up as a mic, it should 0x1d */
++ { 0x17, 0x400001f0 },
++ { 0x1d, 0x97a70120 },
++ { }
++ }
++ },
+ [CXT_FIXUP_STEREO_DMIC] = {
+ .type = HDA_FIXUP_FUNC,
+ .v.func = cxt_fixup_stereo_dmic,
+@@ -769,6 +779,7 @@ static const struct hda_model_fixup cxt5047_fixup_models[] = {
+ };
+
+ static const struct snd_pci_quirk cxt5051_fixups[] = {
++ SND_PCI_QUIRK(0x103c, 0x360b, "Compaq CQ60", CXT_PINCFG_COMPAQ_CQ60),
+ SND_PCI_QUIRK(0x17aa, 0x20f2, "Lenovo X200", CXT_PINCFG_LENOVO_X200),
+ {}
+ };
+diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h
+index 83bddbdb90e9..5293b5ac8b9d 100644
+--- a/sound/usb/quirks-table.h
++++ b/sound/usb/quirks-table.h
+@@ -1773,6 +1773,36 @@ YAMAHA_DEVICE(0x7010, "UB99"),
+ }
+ }
+ },
++{
++ USB_DEVICE(0x0582, 0x0159),
++ .driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
++ /* .vendor_name = "Roland", */
++ /* .product_name = "UA-22", */
++ .ifnum = QUIRK_ANY_INTERFACE,
++ .type = QUIRK_COMPOSITE,
++ .data = (const struct snd_usb_audio_quirk[]) {
++ {
++ .ifnum = 0,
++ .type = QUIRK_AUDIO_STANDARD_INTERFACE
++ },
++ {
++ .ifnum = 1,
++ .type = QUIRK_AUDIO_STANDARD_INTERFACE
++ },
++ {
++ .ifnum = 2,
++ .type = QUIRK_MIDI_FIXED_ENDPOINT,
++ .data = & (const struct snd_usb_midi_endpoint_info) {
++ .out_cables = 0x0001,
++ .in_cables = 0x0001
++ }
++ },
++ {
++ .ifnum = -1
++ }
++ }
++ }
++},
+ /* this catches most recent vendor-specific Roland devices */
+ {
+ .match_flags = USB_DEVICE_ID_MATCH_VENDOR |
+diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
+index 3cee7b167052..cfbe0e7d1c45 100644
+--- a/virt/kvm/kvm_main.c
++++ b/virt/kvm/kvm_main.c
+@@ -2417,6 +2417,7 @@ static long kvm_vm_ioctl_check_extension_generic(struct kvm *kvm, long arg)
+ case KVM_CAP_SIGNAL_MSI:
+ #endif
+ #ifdef CONFIG_HAVE_KVM_IRQFD
++ case KVM_CAP_IRQFD:
+ case KVM_CAP_IRQFD_RESAMPLE:
+ #endif
+ case KVM_CAP_CHECK_EXTENSION_VM:
^ permalink raw reply related [flat|nested] 67+ messages in thread
* [gentoo-commits] proj/linux-patches:3.18 commit in: /
@ 2015-04-27 17:18 Mike Pagano
0 siblings, 0 replies; 67+ messages in thread
From: Mike Pagano @ 2015-04-27 17:18 UTC (permalink / raw
To: gentoo-commits
commit: 7aba46559287bc51c362786a611c31b910e0934b
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Mon Apr 27 17:18:01 2015 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Mon Apr 27 17:18:01 2015 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=7aba4655
Linux patch 3.18.12
0000_README | 4 +
1011_linux-3.18.12.patch | 2634 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 2638 insertions(+)
diff --git a/0000_README b/0000_README
index 7616ed8..8dd852f 100644
--- a/0000_README
+++ b/0000_README
@@ -87,6 +87,10 @@ Patch: 1010_linux-3.18.11.patch
From: http://www.kernel.org
Desc: Linux 3.18.11
+Patch: 1011_linux-3.18.12.patch
+From: http://www.kernel.org
+Desc: Linux 3.18.12
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1011_linux-3.18.12.patch b/1011_linux-3.18.12.patch
new file mode 100644
index 0000000..182f8ae
--- /dev/null
+++ b/1011_linux-3.18.12.patch
@@ -0,0 +1,2634 @@
+diff --git a/Makefile b/Makefile
+index da8dc1350de3..d64f6bf7cd55 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 18
+-SUBLEVEL = 11
++SUBLEVEL = 12
+ EXTRAVERSION =
+ NAME = Diseased Newt
+
+diff --git a/arch/arm64/include/asm/mmu_context.h b/arch/arm64/include/asm/mmu_context.h
+index a9eee33dfa62..101a42bde728 100644
+--- a/arch/arm64/include/asm/mmu_context.h
++++ b/arch/arm64/include/asm/mmu_context.h
+@@ -151,6 +151,15 @@ switch_mm(struct mm_struct *prev, struct mm_struct *next,
+ {
+ unsigned int cpu = smp_processor_id();
+
++ /*
++ * init_mm.pgd does not contain any user mappings and it is always
++ * active for kernel addresses in TTBR1. Just set the reserved TTBR0.
++ */
++ if (next == &init_mm) {
++ cpu_set_reserved_ttbr0();
++ return;
++ }
++
+ if (!cpumask_test_and_set_cpu(cpu, mm_cpumask(next)) || prev != next)
+ check_and_switch_context(next, tsk);
+ }
+diff --git a/arch/powerpc/boot/dts/fsl/pq3-etsec2-0.dtsi b/arch/powerpc/boot/dts/fsl/pq3-etsec2-0.dtsi
+index 1382fec9e8c5..7fcb1ac0f232 100644
+--- a/arch/powerpc/boot/dts/fsl/pq3-etsec2-0.dtsi
++++ b/arch/powerpc/boot/dts/fsl/pq3-etsec2-0.dtsi
+@@ -50,6 +50,7 @@ ethernet@b0000 {
+ fsl,num_tx_queues = <0x8>;
+ fsl,magic-packet;
+ local-mac-address = [ 00 00 00 00 00 00 ];
++ ranges;
+
+ queue-group@b0000 {
+ #address-cells = <1>;
+diff --git a/arch/powerpc/boot/dts/fsl/pq3-etsec2-1.dtsi b/arch/powerpc/boot/dts/fsl/pq3-etsec2-1.dtsi
+index 221cd2ea5b31..9f25427c1527 100644
+--- a/arch/powerpc/boot/dts/fsl/pq3-etsec2-1.dtsi
++++ b/arch/powerpc/boot/dts/fsl/pq3-etsec2-1.dtsi
+@@ -50,6 +50,7 @@ ethernet@b1000 {
+ fsl,num_tx_queues = <0x8>;
+ fsl,magic-packet;
+ local-mac-address = [ 00 00 00 00 00 00 ];
++ ranges;
+
+ queue-group@b1000 {
+ #address-cells = <1>;
+diff --git a/arch/powerpc/boot/dts/fsl/pq3-etsec2-2.dtsi b/arch/powerpc/boot/dts/fsl/pq3-etsec2-2.dtsi
+index 61456c317609..cd7c318ab131 100644
+--- a/arch/powerpc/boot/dts/fsl/pq3-etsec2-2.dtsi
++++ b/arch/powerpc/boot/dts/fsl/pq3-etsec2-2.dtsi
+@@ -49,6 +49,7 @@ ethernet@b2000 {
+ fsl,num_tx_queues = <0x8>;
+ fsl,magic-packet;
+ local-mac-address = [ 00 00 00 00 00 00 ];
++ ranges;
+
+ queue-group@b2000 {
+ #address-cells = <1>;
+diff --git a/arch/powerpc/kernel/exceptions-64s.S b/arch/powerpc/kernel/exceptions-64s.S
+index 72e783ea0681..5e0198425194 100644
+--- a/arch/powerpc/kernel/exceptions-64s.S
++++ b/arch/powerpc/kernel/exceptions-64s.S
+@@ -1399,7 +1399,7 @@ machine_check_handle_early:
+ bne 9f /* continue in V mode if we are. */
+
+ 5:
+-#ifdef CONFIG_KVM_BOOK3S_64_HV
++#ifdef CONFIG_KVM_BOOK3S_64_HANDLER
+ /*
+ * We are coming from kernel context. Check if we are coming from
+ * guest. if yes, then we can continue. We will fall through
+diff --git a/arch/powerpc/platforms/pseries/mobility.c b/arch/powerpc/platforms/pseries/mobility.c
+index e7cb6d4a871a..f8c9ff7886e1 100644
+--- a/arch/powerpc/platforms/pseries/mobility.c
++++ b/arch/powerpc/platforms/pseries/mobility.c
+@@ -25,10 +25,10 @@
+ static struct kobject *mobility_kobj;
+
+ struct update_props_workarea {
+- u32 phandle;
+- u32 state;
+- u64 reserved;
+- u32 nprops;
++ __be32 phandle;
++ __be32 state;
++ __be64 reserved;
++ __be32 nprops;
+ } __packed;
+
+ #define NODE_ACTION_MASK 0xff000000
+@@ -54,11 +54,11 @@ static int mobility_rtas_call(int token, char *buf, s32 scope)
+ return rc;
+ }
+
+-static int delete_dt_node(u32 phandle)
++static int delete_dt_node(__be32 phandle)
+ {
+ struct device_node *dn;
+
+- dn = of_find_node_by_phandle(phandle);
++ dn = of_find_node_by_phandle(be32_to_cpu(phandle));
+ if (!dn)
+ return -ENOENT;
+
+@@ -127,7 +127,7 @@ static int update_dt_property(struct device_node *dn, struct property **prop,
+ return 0;
+ }
+
+-static int update_dt_node(u32 phandle, s32 scope)
++static int update_dt_node(__be32 phandle, s32 scope)
+ {
+ struct update_props_workarea *upwa;
+ struct device_node *dn;
+@@ -136,6 +136,7 @@ static int update_dt_node(u32 phandle, s32 scope)
+ char *prop_data;
+ char *rtas_buf;
+ int update_properties_token;
++ u32 nprops;
+ u32 vd;
+
+ update_properties_token = rtas_token("ibm,update-properties");
+@@ -146,7 +147,7 @@ static int update_dt_node(u32 phandle, s32 scope)
+ if (!rtas_buf)
+ return -ENOMEM;
+
+- dn = of_find_node_by_phandle(phandle);
++ dn = of_find_node_by_phandle(be32_to_cpu(phandle));
+ if (!dn) {
+ kfree(rtas_buf);
+ return -ENOENT;
+@@ -162,6 +163,7 @@ static int update_dt_node(u32 phandle, s32 scope)
+ break;
+
+ prop_data = rtas_buf + sizeof(*upwa);
++ nprops = be32_to_cpu(upwa->nprops);
+
+ /* On the first call to ibm,update-properties for a node the
+ * the first property value descriptor contains an empty
+@@ -170,17 +172,17 @@ static int update_dt_node(u32 phandle, s32 scope)
+ */
+ if (*prop_data == 0) {
+ prop_data++;
+- vd = *(u32 *)prop_data;
++ vd = be32_to_cpu(*(__be32 *)prop_data);
+ prop_data += vd + sizeof(vd);
+- upwa->nprops--;
++ nprops--;
+ }
+
+- for (i = 0; i < upwa->nprops; i++) {
++ for (i = 0; i < nprops; i++) {
+ char *prop_name;
+
+ prop_name = prop_data;
+ prop_data += strlen(prop_name) + 1;
+- vd = *(u32 *)prop_data;
++ vd = be32_to_cpu(*(__be32 *)prop_data);
+ prop_data += sizeof(vd);
+
+ switch (vd) {
+@@ -212,13 +214,13 @@ static int update_dt_node(u32 phandle, s32 scope)
+ return 0;
+ }
+
+-static int add_dt_node(u32 parent_phandle, u32 drc_index)
++static int add_dt_node(__be32 parent_phandle, __be32 drc_index)
+ {
+ struct device_node *dn;
+ struct device_node *parent_dn;
+ int rc;
+
+- parent_dn = of_find_node_by_phandle(parent_phandle);
++ parent_dn = of_find_node_by_phandle(be32_to_cpu(parent_phandle));
+ if (!parent_dn)
+ return -ENOENT;
+
+@@ -237,7 +239,7 @@ static int add_dt_node(u32 parent_phandle, u32 drc_index)
+ int pseries_devicetree_update(s32 scope)
+ {
+ char *rtas_buf;
+- u32 *data;
++ __be32 *data;
+ int update_nodes_token;
+ int rc;
+
+@@ -254,17 +256,17 @@ int pseries_devicetree_update(s32 scope)
+ if (rc && rc != 1)
+ break;
+
+- data = (u32 *)rtas_buf + 4;
+- while (*data & NODE_ACTION_MASK) {
++ data = (__be32 *)rtas_buf + 4;
++ while (be32_to_cpu(*data) & NODE_ACTION_MASK) {
+ int i;
+- u32 action = *data & NODE_ACTION_MASK;
+- int node_count = *data & NODE_COUNT_MASK;
++ u32 action = be32_to_cpu(*data) & NODE_ACTION_MASK;
++ u32 node_count = be32_to_cpu(*data) & NODE_COUNT_MASK;
+
+ data++;
+
+ for (i = 0; i < node_count; i++) {
+- u32 phandle = *data++;
+- u32 drc_index;
++ __be32 phandle = *data++;
++ __be32 drc_index;
+
+ switch (action) {
+ case DELETE_DT_NODE:
+diff --git a/drivers/base/regmap/internal.h b/drivers/base/regmap/internal.h
+index 0da5865df5b1..8e1f5f67e25f 100644
+--- a/drivers/base/regmap/internal.h
++++ b/drivers/base/regmap/internal.h
+@@ -237,4 +237,12 @@ extern struct regcache_ops regcache_rbtree_ops;
+ extern struct regcache_ops regcache_lzo_ops;
+ extern struct regcache_ops regcache_flat_ops;
+
++static inline const char *regmap_name(const struct regmap *map)
++{
++ if (map->dev)
++ return dev_name(map->dev);
++
++ return map->name;
++}
++
+ #endif
+diff --git a/drivers/base/regmap/regcache-rbtree.c b/drivers/base/regmap/regcache-rbtree.c
+index f3e8fe0cc650..9d09c5bb5874 100644
+--- a/drivers/base/regmap/regcache-rbtree.c
++++ b/drivers/base/regmap/regcache-rbtree.c
+@@ -307,7 +307,7 @@ static int regcache_rbtree_insert_to_block(struct regmap *map,
+ if (pos == 0) {
+ memmove(blk + offset * map->cache_word_size,
+ blk, rbnode->blklen * map->cache_word_size);
+- bitmap_shift_right(present, present, offset, blklen);
++ bitmap_shift_left(present, present, offset, blklen);
+ }
+
+ /* update the rbnode block, its size and the base register */
+diff --git a/drivers/base/regmap/regcache.c b/drivers/base/regmap/regcache.c
+index f1280dc356d0..e5c1eda6a4c1 100644
+--- a/drivers/base/regmap/regcache.c
++++ b/drivers/base/regmap/regcache.c
+@@ -213,7 +213,7 @@ int regcache_read(struct regmap *map,
+ ret = map->cache_ops->read(map, reg, value);
+
+ if (ret == 0)
+- trace_regmap_reg_read_cache(map->dev, reg, *value);
++ trace_regmap_reg_read_cache(map, reg, *value);
+
+ return ret;
+ }
+@@ -306,7 +306,7 @@ int regcache_sync(struct regmap *map)
+ dev_dbg(map->dev, "Syncing %s cache\n",
+ map->cache_ops->name);
+ name = map->cache_ops->name;
+- trace_regcache_sync(map->dev, name, "start");
++ trace_regcache_sync(map, name, "start");
+
+ if (!map->cache_dirty)
+ goto out;
+@@ -341,7 +341,7 @@ out:
+
+ regmap_async_complete(map);
+
+- trace_regcache_sync(map->dev, name, "stop");
++ trace_regcache_sync(map, name, "stop");
+
+ return ret;
+ }
+@@ -376,7 +376,7 @@ int regcache_sync_region(struct regmap *map, unsigned int min,
+ name = map->cache_ops->name;
+ dev_dbg(map->dev, "Syncing %s cache from %d-%d\n", name, min, max);
+
+- trace_regcache_sync(map->dev, name, "start region");
++ trace_regcache_sync(map, name, "start region");
+
+ if (!map->cache_dirty)
+ goto out;
+@@ -396,7 +396,7 @@ out:
+
+ regmap_async_complete(map);
+
+- trace_regcache_sync(map->dev, name, "stop region");
++ trace_regcache_sync(map, name, "stop region");
+
+ return ret;
+ }
+@@ -423,7 +423,7 @@ int regcache_drop_region(struct regmap *map, unsigned int min,
+
+ map->lock(map->lock_arg);
+
+- trace_regcache_drop_region(map->dev, min, max);
++ trace_regcache_drop_region(map, min, max);
+
+ ret = map->cache_ops->drop(map, min, max);
+
+@@ -450,7 +450,7 @@ void regcache_cache_only(struct regmap *map, bool enable)
+ map->lock(map->lock_arg);
+ WARN_ON(map->cache_bypass && enable);
+ map->cache_only = enable;
+- trace_regmap_cache_only(map->dev, enable);
++ trace_regmap_cache_only(map, enable);
+ map->unlock(map->lock_arg);
+ }
+ EXPORT_SYMBOL_GPL(regcache_cache_only);
+@@ -488,7 +488,7 @@ void regcache_cache_bypass(struct regmap *map, bool enable)
+ map->lock(map->lock_arg);
+ WARN_ON(map->cache_only && enable);
+ map->cache_bypass = enable;
+- trace_regmap_cache_bypass(map->dev, enable);
++ trace_regmap_cache_bypass(map, enable);
+ map->unlock(map->lock_arg);
+ }
+ EXPORT_SYMBOL_GPL(regcache_cache_bypass);
+diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c
+index d2f8a818d200..ee731bb7d957 100644
+--- a/drivers/base/regmap/regmap.c
++++ b/drivers/base/regmap/regmap.c
+@@ -1280,7 +1280,7 @@ int _regmap_raw_write(struct regmap *map, unsigned int reg,
+ if (map->async && map->bus->async_write) {
+ struct regmap_async *async;
+
+- trace_regmap_async_write_start(map->dev, reg, val_len);
++ trace_regmap_async_write_start(map, reg, val_len);
+
+ spin_lock_irqsave(&map->async_lock, flags);
+ async = list_first_entry_or_null(&map->async_free,
+@@ -1338,8 +1338,7 @@ int _regmap_raw_write(struct regmap *map, unsigned int reg,
+ return ret;
+ }
+
+- trace_regmap_hw_write_start(map->dev, reg,
+- val_len / map->format.val_bytes);
++ trace_regmap_hw_write_start(map, reg, val_len / map->format.val_bytes);
+
+ /* If we're doing a single register write we can probably just
+ * send the work_buf directly, otherwise try to do a gather
+@@ -1371,8 +1370,7 @@ int _regmap_raw_write(struct regmap *map, unsigned int reg,
+ kfree(buf);
+ }
+
+- trace_regmap_hw_write_done(map->dev, reg,
+- val_len / map->format.val_bytes);
++ trace_regmap_hw_write_done(map, reg, val_len / map->format.val_bytes);
+
+ return ret;
+ }
+@@ -1406,12 +1404,12 @@ static int _regmap_bus_formatted_write(void *context, unsigned int reg,
+
+ map->format.format_write(map, reg, val);
+
+- trace_regmap_hw_write_start(map->dev, reg, 1);
++ trace_regmap_hw_write_start(map, reg, 1);
+
+ ret = map->bus->write(map->bus_context, map->work_buf,
+ map->format.buf_size);
+
+- trace_regmap_hw_write_done(map->dev, reg, 1);
++ trace_regmap_hw_write_done(map, reg, 1);
+
+ return ret;
+ }
+@@ -1469,7 +1467,7 @@ int _regmap_write(struct regmap *map, unsigned int reg,
+ dev_info(map->dev, "%x <= %x\n", reg, val);
+ #endif
+
+- trace_regmap_reg_write(map->dev, reg, val);
++ trace_regmap_reg_write(map, reg, val);
+
+ return map->reg_write(context, reg, val);
+ }
+@@ -1772,7 +1770,7 @@ static int _regmap_raw_multi_reg_write(struct regmap *map,
+ for (i = 0; i < num_regs; i++) {
+ int reg = regs[i].reg;
+ int val = regs[i].def;
+- trace_regmap_hw_write_start(map->dev, reg, 1);
++ trace_regmap_hw_write_start(map, reg, 1);
+ map->format.format_reg(u8, reg, map->reg_shift);
+ u8 += reg_bytes + pad_bytes;
+ map->format.format_val(u8, val, 0);
+@@ -1787,7 +1785,7 @@ static int _regmap_raw_multi_reg_write(struct regmap *map,
+
+ for (i = 0; i < num_regs; i++) {
+ int reg = regs[i].reg;
+- trace_regmap_hw_write_done(map->dev, reg, 1);
++ trace_regmap_hw_write_done(map, reg, 1);
+ }
+ return ret;
+ }
+@@ -2058,15 +2056,13 @@ static int _regmap_raw_read(struct regmap *map, unsigned int reg, void *val,
+ */
+ u8[0] |= map->read_flag_mask;
+
+- trace_regmap_hw_read_start(map->dev, reg,
+- val_len / map->format.val_bytes);
++ trace_regmap_hw_read_start(map, reg, val_len / map->format.val_bytes);
+
+ ret = map->bus->read(map->bus_context, map->work_buf,
+ map->format.reg_bytes + map->format.pad_bytes,
+ val, val_len);
+
+- trace_regmap_hw_read_done(map->dev, reg,
+- val_len / map->format.val_bytes);
++ trace_regmap_hw_read_done(map, reg, val_len / map->format.val_bytes);
+
+ return ret;
+ }
+@@ -2122,7 +2118,7 @@ static int _regmap_read(struct regmap *map, unsigned int reg,
+ dev_info(map->dev, "%x => %x\n", reg, *val);
+ #endif
+
+- trace_regmap_reg_read(map->dev, reg, *val);
++ trace_regmap_reg_read(map, reg, *val);
+
+ if (!map->cache_bypass)
+ regcache_write(map, reg, *val);
+@@ -2479,7 +2475,7 @@ void regmap_async_complete_cb(struct regmap_async *async, int ret)
+ struct regmap *map = async->map;
+ bool wake;
+
+- trace_regmap_async_io_complete(map->dev);
++ trace_regmap_async_io_complete(map);
+
+ spin_lock(&map->async_lock);
+ list_move(&async->list, &map->async_free);
+@@ -2524,7 +2520,7 @@ int regmap_async_complete(struct regmap *map)
+ if (!map->bus || !map->bus->async_write)
+ return 0;
+
+- trace_regmap_async_complete_start(map->dev);
++ trace_regmap_async_complete_start(map);
+
+ wait_event(map->async_waitq, regmap_async_is_done(map));
+
+@@ -2533,7 +2529,7 @@ int regmap_async_complete(struct regmap *map)
+ map->async_ret = 0;
+ spin_unlock_irqrestore(&map->async_lock, flags);
+
+- trace_regmap_async_complete_done(map->dev);
++ trace_regmap_async_complete_done(map);
+
+ return ret;
+ }
+diff --git a/drivers/clocksource/time-efm32.c b/drivers/clocksource/time-efm32.c
+index bba62f9deefb..ec57ba2bbd87 100644
+--- a/drivers/clocksource/time-efm32.c
++++ b/drivers/clocksource/time-efm32.c
+@@ -225,12 +225,12 @@ static int __init efm32_clockevent_init(struct device_node *np)
+ clock_event_ddata.base = base;
+ clock_event_ddata.periodic_top = DIV_ROUND_CLOSEST(rate, 1024 * HZ);
+
+- setup_irq(irq, &efm32_clock_event_irq);
+-
+ clockevents_config_and_register(&clock_event_ddata.evtdev,
+ DIV_ROUND_CLOSEST(rate, 1024),
+ 0xf, 0xffff);
+
++ setup_irq(irq, &efm32_clock_event_irq);
++
+ return 0;
+
+ err_get_irq:
+diff --git a/drivers/clocksource/timer-sun5i.c b/drivers/clocksource/timer-sun5i.c
+index 02268448dc85..5dcbf90b8015 100644
+--- a/drivers/clocksource/timer-sun5i.c
++++ b/drivers/clocksource/timer-sun5i.c
+@@ -178,10 +178,6 @@ static void __init sun5i_timer_init(struct device_node *node)
+
+ ticks_per_jiffy = DIV_ROUND_UP(rate, HZ);
+
+- ret = setup_irq(irq, &sun5i_timer_irq);
+- if (ret)
+- pr_warn("failed to setup irq %d\n", irq);
+-
+ /* Enable timer0 interrupt */
+ val = readl(timer_base + TIMER_IRQ_EN_REG);
+ writel(val | TIMER_IRQ_EN(0), timer_base + TIMER_IRQ_EN_REG);
+@@ -191,6 +187,10 @@ static void __init sun5i_timer_init(struct device_node *node)
+
+ clockevents_config_and_register(&sun5i_clockevent, rate,
+ TIMER_SYNC_TICKS, 0xffffffff);
++
++ ret = setup_irq(irq, &sun5i_timer_irq);
++ if (ret)
++ pr_warn("failed to setup irq %d\n", irq);
+ }
+ CLOCKSOURCE_OF_DECLARE(sun5i_a13, "allwinner,sun5i-a13-hstimer",
+ sun5i_timer_init);
+diff --git a/drivers/cpuidle/cpuidle-mvebu-v7.c b/drivers/cpuidle/cpuidle-mvebu-v7.c
+index 45371bb16214..6066d790fd0e 100644
+--- a/drivers/cpuidle/cpuidle-mvebu-v7.c
++++ b/drivers/cpuidle/cpuidle-mvebu-v7.c
+@@ -37,11 +37,11 @@ static int mvebu_v7_enter_idle(struct cpuidle_device *dev,
+ deepidle = true;
+
+ ret = mvebu_v7_cpu_suspend(deepidle);
++ cpu_pm_exit();
++
+ if (ret)
+ return ret;
+
+- cpu_pm_exit();
+-
+ return index;
+ }
+
+diff --git a/drivers/dma/dw/platform.c b/drivers/dma/dw/platform.c
+index a630161473a4..c396e1b69d93 100644
+--- a/drivers/dma/dw/platform.c
++++ b/drivers/dma/dw/platform.c
+@@ -25,6 +25,8 @@
+
+ #include "internal.h"
+
++#define DRV_NAME "dw_dmac"
++
+ static struct dma_chan *dw_dma_of_xlate(struct of_phandle_args *dma_spec,
+ struct of_dma *ofdma)
+ {
+@@ -279,7 +281,7 @@ static struct platform_driver dw_driver = {
+ .remove = dw_remove,
+ .shutdown = dw_shutdown,
+ .driver = {
+- .name = "dw_dmac",
++ .name = DRV_NAME,
+ .pm = &dw_dev_pm_ops,
+ .of_match_table = of_match_ptr(dw_dma_of_id_table),
+ .acpi_match_table = ACPI_PTR(dw_dma_acpi_id_table),
+@@ -300,3 +302,4 @@ module_exit(dw_exit);
+
+ MODULE_LICENSE("GPL v2");
+ MODULE_DESCRIPTION("Synopsys DesignWare DMA Controller platform driver");
++MODULE_ALIAS("platform:" DRV_NAME);
+diff --git a/drivers/edac/sb_edac.c b/drivers/edac/sb_edac.c
+index 3cdaac8944eb..a46c4af2ac98 100644
+--- a/drivers/edac/sb_edac.c
++++ b/drivers/edac/sb_edac.c
+@@ -135,6 +135,7 @@ static inline int sad_pkg(const struct interleave_pkg *table, u32 reg,
+
+ #define TOLM 0x80
+ #define TOHM 0x84
++#define HASWELL_TOLM 0xd0
+ #define HASWELL_TOHM_0 0xd4
+ #define HASWELL_TOHM_1 0xd8
+
+@@ -706,8 +707,8 @@ static u64 haswell_get_tolm(struct sbridge_pvt *pvt)
+ {
+ u32 reg;
+
+- pci_read_config_dword(pvt->info.pci_vtd, TOLM, ®);
+- return (GET_BITFIELD(reg, 26, 31) << 26) | 0x1ffffff;
++ pci_read_config_dword(pvt->info.pci_vtd, HASWELL_TOLM, ®);
++ return (GET_BITFIELD(reg, 26, 31) << 26) | 0x3ffffff;
+ }
+
+ static u64 haswell_get_tohm(struct sbridge_pvt *pvt)
+@@ -848,7 +849,7 @@ static int get_dimm_config(struct mem_ctl_info *mci)
+ else
+ edac_dbg(0, "Memory is unregistered\n");
+
+- if (mtype == MEM_DDR4 || MEM_RDDR4)
++ if (mtype == MEM_DDR4 || mtype == MEM_RDDR4)
+ banks = 16;
+ else
+ banks = 8;
+diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
+index 23e26e0768b5..2176874a41b1 100644
+--- a/drivers/input/mouse/synaptics.c
++++ b/drivers/input/mouse/synaptics.c
+@@ -120,32 +120,41 @@ void synaptics_reset(struct psmouse *psmouse)
+
+ static bool cr48_profile_sensor;
+
++#define ANY_BOARD_ID 0
+ struct min_max_quirk {
+ const char * const *pnp_ids;
++ struct {
++ unsigned long int min, max;
++ } board_id;
+ int x_min, x_max, y_min, y_max;
+ };
+
+ static const struct min_max_quirk min_max_pnpid_table[] = {
+ {
+ (const char * const []){"LEN0033", NULL},
++ {ANY_BOARD_ID, ANY_BOARD_ID},
+ 1024, 5052, 2258, 4832
+ },
+ {
+- (const char * const []){"LEN0035", "LEN0042", NULL},
++ (const char * const []){"LEN0042", NULL},
++ {ANY_BOARD_ID, ANY_BOARD_ID},
+ 1232, 5710, 1156, 4696
+ },
+ {
+ (const char * const []){"LEN0034", "LEN0036", "LEN0037",
+ "LEN0039", "LEN2002", "LEN2004",
+ NULL},
++ {ANY_BOARD_ID, 2961},
+ 1024, 5112, 2024, 4832
+ },
+ {
+ (const char * const []){"LEN2001", NULL},
++ {ANY_BOARD_ID, ANY_BOARD_ID},
+ 1024, 5022, 2508, 4832
+ },
+ {
+ (const char * const []){"LEN2006", NULL},
++ {ANY_BOARD_ID, ANY_BOARD_ID},
+ 1264, 5675, 1171, 4688
+ },
+ { }
+@@ -241,6 +250,10 @@ static int synaptics_board_id(struct psmouse *psmouse)
+ struct synaptics_data *priv = psmouse->private;
+ unsigned char bid[3];
+
++ /* firmwares prior 7.5 have no board_id encoded */
++ if (SYN_ID_FULL(priv->identity) < 0x705)
++ return 0;
++
+ if (synaptics_send_cmd(psmouse, SYN_QUE_MODES, bid))
+ return -1;
+ priv->board_id = ((bid[0] & 0xfc) << 6) | bid[1];
+@@ -343,7 +356,6 @@ static int synaptics_resolution(struct psmouse *psmouse)
+ {
+ struct synaptics_data *priv = psmouse->private;
+ unsigned char resp[3];
+- int i;
+
+ if (SYN_ID_MAJOR(priv->identity) < 4)
+ return 0;
+@@ -355,17 +367,6 @@ static int synaptics_resolution(struct psmouse *psmouse)
+ }
+ }
+
+- for (i = 0; min_max_pnpid_table[i].pnp_ids; i++) {
+- if (psmouse_matches_pnp_id(psmouse,
+- min_max_pnpid_table[i].pnp_ids)) {
+- priv->x_min = min_max_pnpid_table[i].x_min;
+- priv->x_max = min_max_pnpid_table[i].x_max;
+- priv->y_min = min_max_pnpid_table[i].y_min;
+- priv->y_max = min_max_pnpid_table[i].y_max;
+- return 0;
+- }
+- }
+-
+ if (SYN_EXT_CAP_REQUESTS(priv->capabilities) >= 5 &&
+ SYN_CAP_MAX_DIMENSIONS(priv->ext_cap_0c)) {
+ if (synaptics_send_cmd(psmouse, SYN_QUE_EXT_MAX_COORDS, resp)) {
+@@ -374,23 +375,69 @@ static int synaptics_resolution(struct psmouse *psmouse)
+ } else {
+ priv->x_max = (resp[0] << 5) | ((resp[1] & 0x0f) << 1);
+ priv->y_max = (resp[2] << 5) | ((resp[1] & 0xf0) >> 3);
++ psmouse_info(psmouse,
++ "queried max coordinates: x [..%d], y [..%d]\n",
++ priv->x_max, priv->y_max);
+ }
+ }
+
+- if (SYN_EXT_CAP_REQUESTS(priv->capabilities) >= 7 &&
+- SYN_CAP_MIN_DIMENSIONS(priv->ext_cap_0c)) {
++ if (SYN_CAP_MIN_DIMENSIONS(priv->ext_cap_0c) &&
++ (SYN_EXT_CAP_REQUESTS(priv->capabilities) >= 7 ||
++ /*
++ * Firmware v8.1 does not report proper number of extended
++ * capabilities, but has been proven to report correct min
++ * coordinates.
++ */
++ SYN_ID_FULL(priv->identity) == 0x801)) {
+ if (synaptics_send_cmd(psmouse, SYN_QUE_EXT_MIN_COORDS, resp)) {
+ psmouse_warn(psmouse,
+ "device claims to have min coordinates query, but I'm not able to read it.\n");
+ } else {
+ priv->x_min = (resp[0] << 5) | ((resp[1] & 0x0f) << 1);
+ priv->y_min = (resp[2] << 5) | ((resp[1] & 0xf0) >> 3);
++ psmouse_info(psmouse,
++ "queried min coordinates: x [%d..], y [%d..]\n",
++ priv->x_min, priv->y_min);
+ }
+ }
+
+ return 0;
+ }
+
++/*
++ * Apply quirk(s) if the hardware matches
++ */
++
++static void synaptics_apply_quirks(struct psmouse *psmouse)
++{
++ struct synaptics_data *priv = psmouse->private;
++ int i;
++
++ for (i = 0; min_max_pnpid_table[i].pnp_ids; i++) {
++ if (!psmouse_matches_pnp_id(psmouse,
++ min_max_pnpid_table[i].pnp_ids))
++ continue;
++
++ if (min_max_pnpid_table[i].board_id.min != ANY_BOARD_ID &&
++ priv->board_id < min_max_pnpid_table[i].board_id.min)
++ continue;
++
++ if (min_max_pnpid_table[i].board_id.max != ANY_BOARD_ID &&
++ priv->board_id > min_max_pnpid_table[i].board_id.max)
++ continue;
++
++ priv->x_min = min_max_pnpid_table[i].x_min;
++ priv->x_max = min_max_pnpid_table[i].x_max;
++ priv->y_min = min_max_pnpid_table[i].y_min;
++ priv->y_max = min_max_pnpid_table[i].y_max;
++ psmouse_info(psmouse,
++ "quirked min/max coordinates: x [%d..%d], y [%d..%d]\n",
++ priv->x_min, priv->x_max,
++ priv->y_min, priv->y_max);
++ break;
++ }
++}
++
+ static int synaptics_query_hardware(struct psmouse *psmouse)
+ {
+ if (synaptics_identify(psmouse))
+@@ -406,6 +453,8 @@ static int synaptics_query_hardware(struct psmouse *psmouse)
+ if (synaptics_resolution(psmouse))
+ return -1;
+
++ synaptics_apply_quirks(psmouse);
++
+ return 0;
+ }
+
+@@ -613,6 +662,18 @@ static void synaptics_parse_agm(const unsigned char buf[],
+ priv->agm_pending = true;
+ }
+
++static void synaptics_parse_ext_buttons(const unsigned char buf[],
++ struct synaptics_data *priv,
++ struct synaptics_hw_state *hw)
++{
++ unsigned int ext_bits =
++ (SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap) + 1) >> 1;
++ unsigned int ext_mask = GENMASK(ext_bits - 1, 0);
++
++ hw->ext_buttons = buf[4] & ext_mask;
++ hw->ext_buttons |= (buf[5] & ext_mask) << ext_bits;
++}
++
+ static bool is_forcepad;
+
+ static int synaptics_parse_hw_state(const unsigned char buf[],
+@@ -699,28 +760,9 @@ static int synaptics_parse_hw_state(const unsigned char buf[],
+ hw->down = ((buf[0] ^ buf[3]) & 0x02) ? 1 : 0;
+ }
+
+- if (SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap) &&
++ if (SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap) > 0 &&
+ ((buf[0] ^ buf[3]) & 0x02)) {
+- switch (SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap) & ~0x01) {
+- default:
+- /*
+- * if nExtBtn is greater than 8 it should be
+- * considered invalid and treated as 0
+- */
+- break;
+- case 8:
+- hw->ext_buttons |= ((buf[5] & 0x08)) ? 0x80 : 0;
+- hw->ext_buttons |= ((buf[4] & 0x08)) ? 0x40 : 0;
+- case 6:
+- hw->ext_buttons |= ((buf[5] & 0x04)) ? 0x20 : 0;
+- hw->ext_buttons |= ((buf[4] & 0x04)) ? 0x10 : 0;
+- case 4:
+- hw->ext_buttons |= ((buf[5] & 0x02)) ? 0x08 : 0;
+- hw->ext_buttons |= ((buf[4] & 0x02)) ? 0x04 : 0;
+- case 2:
+- hw->ext_buttons |= ((buf[5] & 0x01)) ? 0x02 : 0;
+- hw->ext_buttons |= ((buf[4] & 0x01)) ? 0x01 : 0;
+- }
++ synaptics_parse_ext_buttons(buf, priv, hw);
+ }
+ } else {
+ hw->x = (((buf[1] & 0x1f) << 8) | buf[2]);
+@@ -782,12 +824,35 @@ static void synaptics_report_semi_mt_data(struct input_dev *dev,
+ }
+ }
+
++static void synaptics_report_ext_buttons(struct psmouse *psmouse,
++ const struct synaptics_hw_state *hw)
++{
++ struct input_dev *dev = psmouse->dev;
++ struct synaptics_data *priv = psmouse->private;
++ int ext_bits = (SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap) + 1) >> 1;
++ int i;
++
++ if (!SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap))
++ return;
++
++ /* Bug in FW 8.1, buttons are reported only when ExtBit is 1 */
++ if (SYN_ID_FULL(priv->identity) == 0x801 &&
++ !((psmouse->packet[0] ^ psmouse->packet[3]) & 0x02))
++ return;
++
++ for (i = 0; i < ext_bits; i++) {
++ input_report_key(dev, BTN_0 + 2 * i,
++ hw->ext_buttons & (1 << i));
++ input_report_key(dev, BTN_1 + 2 * i,
++ hw->ext_buttons & (1 << (i + ext_bits)));
++ }
++}
++
+ static void synaptics_report_buttons(struct psmouse *psmouse,
+ const struct synaptics_hw_state *hw)
+ {
+ struct input_dev *dev = psmouse->dev;
+ struct synaptics_data *priv = psmouse->private;
+- int i;
+
+ input_report_key(dev, BTN_LEFT, hw->left);
+ input_report_key(dev, BTN_RIGHT, hw->right);
+@@ -800,8 +865,7 @@ static void synaptics_report_buttons(struct psmouse *psmouse,
+ input_report_key(dev, BTN_BACK, hw->down);
+ }
+
+- for (i = 0; i < SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap); i++)
+- input_report_key(dev, BTN_0 + i, hw->ext_buttons & (1 << i));
++ synaptics_report_ext_buttons(psmouse, hw);
+ }
+
+ static void synaptics_report_slot(struct input_dev *dev, int slot,
+diff --git a/drivers/md/dm-io.c b/drivers/md/dm-io.c
+index 37de0173b6d2..74adcd2c967e 100644
+--- a/drivers/md/dm-io.c
++++ b/drivers/md/dm-io.c
+@@ -289,9 +289,16 @@ static void do_region(int rw, unsigned region, struct dm_io_region *where,
+ struct request_queue *q = bdev_get_queue(where->bdev);
+ unsigned short logical_block_size = queue_logical_block_size(q);
+ sector_t num_sectors;
++ unsigned int uninitialized_var(special_cmd_max_sectors);
+
+- /* Reject unsupported discard requests */
+- if ((rw & REQ_DISCARD) && !blk_queue_discard(q)) {
++ /*
++ * Reject unsupported discard and write same requests.
++ */
++ if (rw & REQ_DISCARD)
++ special_cmd_max_sectors = q->limits.max_discard_sectors;
++ else if (rw & REQ_WRITE_SAME)
++ special_cmd_max_sectors = q->limits.max_write_same_sectors;
++ if ((rw & (REQ_DISCARD | REQ_WRITE_SAME)) && special_cmd_max_sectors == 0) {
+ dec_count(io, region, -EOPNOTSUPP);
+ return;
+ }
+@@ -317,7 +324,7 @@ static void do_region(int rw, unsigned region, struct dm_io_region *where,
+ store_io_and_region_in_bio(bio, io, region);
+
+ if (rw & REQ_DISCARD) {
+- num_sectors = min_t(sector_t, q->limits.max_discard_sectors, remaining);
++ num_sectors = min_t(sector_t, special_cmd_max_sectors, remaining);
+ bio->bi_iter.bi_size = num_sectors << SECTOR_SHIFT;
+ remaining -= num_sectors;
+ } else if (rw & REQ_WRITE_SAME) {
+@@ -326,7 +333,7 @@ static void do_region(int rw, unsigned region, struct dm_io_region *where,
+ */
+ dp->get_page(dp, &page, &len, &offset);
+ bio_add_page(bio, page, logical_block_size, offset);
+- num_sectors = min_t(sector_t, q->limits.max_write_same_sectors, remaining);
++ num_sectors = min_t(sector_t, special_cmd_max_sectors, remaining);
+ bio->bi_iter.bi_size = num_sectors << SECTOR_SHIFT;
+
+ offset = 0;
+diff --git a/drivers/md/dm-snap.c b/drivers/md/dm-snap.c
+index 8b204ae216ab..33de9f7a7180 100644
+--- a/drivers/md/dm-snap.c
++++ b/drivers/md/dm-snap.c
+@@ -20,6 +20,8 @@
+ #include <linux/log2.h>
+ #include <linux/dm-kcopyd.h>
+
++#include "dm.h"
++
+ #include "dm-exception-store.h"
+
+ #define DM_MSG_PREFIX "snapshots"
+@@ -291,12 +293,23 @@ struct origin {
+ };
+
+ /*
++ * This structure is allocated for each origin target
++ */
++struct dm_origin {
++ struct dm_dev *dev;
++ struct dm_target *ti;
++ unsigned split_boundary;
++ struct list_head hash_list;
++};
++
++/*
+ * Size of the hash table for origin volumes. If we make this
+ * the size of the minors list then it should be nearly perfect
+ */
+ #define ORIGIN_HASH_SIZE 256
+ #define ORIGIN_MASK 0xFF
+ static struct list_head *_origins;
++static struct list_head *_dm_origins;
+ static struct rw_semaphore _origins_lock;
+
+ static DECLARE_WAIT_QUEUE_HEAD(_pending_exceptions_done);
+@@ -310,12 +323,22 @@ static int init_origin_hash(void)
+ _origins = kmalloc(ORIGIN_HASH_SIZE * sizeof(struct list_head),
+ GFP_KERNEL);
+ if (!_origins) {
+- DMERR("unable to allocate memory");
++ DMERR("unable to allocate memory for _origins");
+ return -ENOMEM;
+ }
+-
+ for (i = 0; i < ORIGIN_HASH_SIZE; i++)
+ INIT_LIST_HEAD(_origins + i);
++
++ _dm_origins = kmalloc(ORIGIN_HASH_SIZE * sizeof(struct list_head),
++ GFP_KERNEL);
++ if (!_dm_origins) {
++ DMERR("unable to allocate memory for _dm_origins");
++ kfree(_origins);
++ return -ENOMEM;
++ }
++ for (i = 0; i < ORIGIN_HASH_SIZE; i++)
++ INIT_LIST_HEAD(_dm_origins + i);
++
+ init_rwsem(&_origins_lock);
+
+ return 0;
+@@ -324,6 +347,7 @@ static int init_origin_hash(void)
+ static void exit_origin_hash(void)
+ {
+ kfree(_origins);
++ kfree(_dm_origins);
+ }
+
+ static unsigned origin_hash(struct block_device *bdev)
+@@ -350,6 +374,30 @@ static void __insert_origin(struct origin *o)
+ list_add_tail(&o->hash_list, sl);
+ }
+
++static struct dm_origin *__lookup_dm_origin(struct block_device *origin)
++{
++ struct list_head *ol;
++ struct dm_origin *o;
++
++ ol = &_dm_origins[origin_hash(origin)];
++ list_for_each_entry (o, ol, hash_list)
++ if (bdev_equal(o->dev->bdev, origin))
++ return o;
++
++ return NULL;
++}
++
++static void __insert_dm_origin(struct dm_origin *o)
++{
++ struct list_head *sl = &_dm_origins[origin_hash(o->dev->bdev)];
++ list_add_tail(&o->hash_list, sl);
++}
++
++static void __remove_dm_origin(struct dm_origin *o)
++{
++ list_del(&o->hash_list);
++}
++
+ /*
+ * _origins_lock must be held when calling this function.
+ * Returns number of snapshots registered using the supplied cow device, plus:
+@@ -1840,9 +1888,40 @@ static int snapshot_preresume(struct dm_target *ti)
+ static void snapshot_resume(struct dm_target *ti)
+ {
+ struct dm_snapshot *s = ti->private;
+- struct dm_snapshot *snap_src = NULL, *snap_dest = NULL;
++ struct dm_snapshot *snap_src = NULL, *snap_dest = NULL, *snap_merging = NULL;
++ struct dm_origin *o;
++ struct mapped_device *origin_md = NULL;
++ bool must_restart_merging = false;
+
+ down_read(&_origins_lock);
++
++ o = __lookup_dm_origin(s->origin->bdev);
++ if (o)
++ origin_md = dm_table_get_md(o->ti->table);
++ if (!origin_md) {
++ (void) __find_snapshots_sharing_cow(s, NULL, NULL, &snap_merging);
++ if (snap_merging)
++ origin_md = dm_table_get_md(snap_merging->ti->table);
++ }
++ if (origin_md == dm_table_get_md(ti->table))
++ origin_md = NULL;
++ if (origin_md) {
++ if (dm_hold(origin_md))
++ origin_md = NULL;
++ }
++
++ up_read(&_origins_lock);
++
++ if (origin_md) {
++ dm_internal_suspend(origin_md);
++ if (snap_merging && test_bit(RUNNING_MERGE, &snap_merging->state_bits)) {
++ must_restart_merging = true;
++ stop_merge(snap_merging);
++ }
++ }
++
++ down_read(&_origins_lock);
++
+ (void) __find_snapshots_sharing_cow(s, &snap_src, &snap_dest, NULL);
+ if (snap_src && snap_dest) {
+ down_write(&snap_src->lock);
+@@ -1851,8 +1930,16 @@ static void snapshot_resume(struct dm_target *ti)
+ up_write(&snap_dest->lock);
+ up_write(&snap_src->lock);
+ }
++
+ up_read(&_origins_lock);
+
++ if (origin_md) {
++ if (must_restart_merging)
++ start_merge(snap_merging);
++ dm_internal_resume(origin_md);
++ dm_put(origin_md);
++ }
++
+ /* Now we have correct chunk size, reregister */
+ reregister_snapshot(s);
+
+@@ -2133,11 +2220,6 @@ static int origin_write_extent(struct dm_snapshot *merging_snap,
+ * Origin: maps a linear range of a device, with hooks for snapshotting.
+ */
+
+-struct dm_origin {
+- struct dm_dev *dev;
+- unsigned split_boundary;
+-};
+-
+ /*
+ * Construct an origin mapping: <dev_path>
+ * The context for an origin is merely a 'struct dm_dev *'
+@@ -2166,6 +2248,7 @@ static int origin_ctr(struct dm_target *ti, unsigned int argc, char **argv)
+ goto bad_open;
+ }
+
++ o->ti = ti;
+ ti->private = o;
+ ti->num_flush_bios = 1;
+
+@@ -2180,6 +2263,7 @@ bad_alloc:
+ static void origin_dtr(struct dm_target *ti)
+ {
+ struct dm_origin *o = ti->private;
++
+ dm_put_device(ti, o->dev);
+ kfree(o);
+ }
+@@ -2216,6 +2300,19 @@ static void origin_resume(struct dm_target *ti)
+ struct dm_origin *o = ti->private;
+
+ o->split_boundary = get_origin_minimum_chunksize(o->dev->bdev);
++
++ down_write(&_origins_lock);
++ __insert_dm_origin(o);
++ up_write(&_origins_lock);
++}
++
++static void origin_postsuspend(struct dm_target *ti)
++{
++ struct dm_origin *o = ti->private;
++
++ down_write(&_origins_lock);
++ __remove_dm_origin(o);
++ up_write(&_origins_lock);
+ }
+
+ static void origin_status(struct dm_target *ti, status_type_t type,
+@@ -2258,12 +2355,13 @@ static int origin_iterate_devices(struct dm_target *ti,
+
+ static struct target_type origin_target = {
+ .name = "snapshot-origin",
+- .version = {1, 8, 1},
++ .version = {1, 9, 0},
+ .module = THIS_MODULE,
+ .ctr = origin_ctr,
+ .dtr = origin_dtr,
+ .map = origin_map,
+ .resume = origin_resume,
++ .postsuspend = origin_postsuspend,
+ .status = origin_status,
+ .merge = origin_merge,
+ .iterate_devices = origin_iterate_devices,
+@@ -2271,7 +2369,7 @@ static struct target_type origin_target = {
+
+ static struct target_type snapshot_target = {
+ .name = "snapshot",
+- .version = {1, 12, 0},
++ .version = {1, 13, 0},
+ .module = THIS_MODULE,
+ .ctr = snapshot_ctr,
+ .dtr = snapshot_dtr,
+@@ -2285,7 +2383,7 @@ static struct target_type snapshot_target = {
+
+ static struct target_type merge_target = {
+ .name = dm_snapshot_merge_target_name,
+- .version = {1, 2, 0},
++ .version = {1, 3, 0},
+ .module = THIS_MODULE,
+ .ctr = snapshot_ctr,
+ .dtr = snapshot_dtr,
+diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c
+index ac6b0ff161ea..0801e35b9940 100644
+--- a/drivers/md/dm-thin.c
++++ b/drivers/md/dm-thin.c
+@@ -2003,17 +2003,6 @@ static int thin_bio_map(struct dm_target *ti, struct bio *bio)
+ return DM_MAPIO_REMAPPED;
+
+ case -ENODATA:
+- if (get_pool_mode(tc->pool) == PM_READ_ONLY) {
+- /*
+- * This block isn't provisioned, and we have no way
+- * of doing so.
+- */
+- handle_unserviceable_bio(tc->pool, bio);
+- cell_defer_no_holder_no_free(tc, &cell1);
+- return DM_MAPIO_SUBMITTED;
+- }
+- /* fall through */
+-
+ case -EWOULDBLOCK:
+ /*
+ * In future, the failed dm_thin_find_block above could
+diff --git a/drivers/md/dm.c b/drivers/md/dm.c
+index cec85c5bae9e..042114fbd200 100644
+--- a/drivers/md/dm.c
++++ b/drivers/md/dm.c
+@@ -2507,6 +2507,19 @@ void dm_get(struct mapped_device *md)
+ BUG_ON(test_bit(DMF_FREEING, &md->flags));
+ }
+
++int dm_hold(struct mapped_device *md)
++{
++ spin_lock(&_minor_lock);
++ if (test_bit(DMF_FREEING, &md->flags)) {
++ spin_unlock(&_minor_lock);
++ return -EBUSY;
++ }
++ dm_get(md);
++ spin_unlock(&_minor_lock);
++ return 0;
++}
++EXPORT_SYMBOL_GPL(dm_hold);
++
+ const char *dm_device_name(struct mapped_device *md)
+ {
+ return md->name;
+@@ -2526,10 +2539,16 @@ static void __dm_destroy(struct mapped_device *md, bool wait)
+ set_bit(DMF_FREEING, &md->flags);
+ spin_unlock(&_minor_lock);
+
++ /*
++ * Take suspend_lock so that presuspend and postsuspend methods
++ * do not race with internal suspend.
++ */
++ mutex_lock(&md->suspend_lock);
+ if (!dm_suspended_md(md)) {
+ dm_table_presuspend_targets(map);
+ dm_table_postsuspend_targets(map);
+ }
++ mutex_unlock(&md->suspend_lock);
+
+ /* dm_put_live_table must be before msleep, otherwise deadlock is possible */
+ dm_put_live_table(md, srcu_idx);
+@@ -2881,6 +2900,7 @@ void dm_internal_suspend(struct mapped_device *md)
+ flush_workqueue(md->wq);
+ dm_wait_for_completion(md, TASK_UNINTERRUPTIBLE);
+ }
++EXPORT_SYMBOL_GPL(dm_internal_suspend);
+
+ void dm_internal_resume(struct mapped_device *md)
+ {
+@@ -2892,6 +2912,7 @@ void dm_internal_resume(struct mapped_device *md)
+ done:
+ mutex_unlock(&md->suspend_lock);
+ }
++EXPORT_SYMBOL_GPL(dm_internal_resume);
+
+ /*-----------------------------------------------------------------
+ * Event notification.
+diff --git a/drivers/mfd/kempld-core.c b/drivers/mfd/kempld-core.c
+index bd2696136eee..177fa31e5aad 100644
+--- a/drivers/mfd/kempld-core.c
++++ b/drivers/mfd/kempld-core.c
+@@ -740,7 +740,7 @@ static int __init kempld_init(void)
+ for (id = kempld_dmi_table;
+ id->matches[0].slot != DMI_NONE; id++)
+ if (strstr(id->ident, force_device_id))
+- if (id->callback && id->callback(id))
++ if (id->callback && !id->callback(id))
+ break;
+ if (id->matches[0].slot == DMI_NONE)
+ return -ENODEV;
+diff --git a/drivers/net/ethernet/amd/pcnet32.c b/drivers/net/ethernet/amd/pcnet32.c
+index e2e3aaf501a2..30f088be6a1a 100644
+--- a/drivers/net/ethernet/amd/pcnet32.c
++++ b/drivers/net/ethernet/amd/pcnet32.c
+@@ -1543,7 +1543,7 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
+ {
+ struct pcnet32_private *lp;
+ int i, media;
+- int fdx, mii, fset, dxsuflo;
++ int fdx, mii, fset, dxsuflo, sram;
+ int chip_version;
+ char *chipname;
+ struct net_device *dev;
+@@ -1580,7 +1580,7 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
+ }
+
+ /* initialize variables */
+- fdx = mii = fset = dxsuflo = 0;
++ fdx = mii = fset = dxsuflo = sram = 0;
+ chip_version = (chip_version >> 12) & 0xffff;
+
+ switch (chip_version) {
+@@ -1613,6 +1613,7 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
+ chipname = "PCnet/FAST III 79C973"; /* PCI */
+ fdx = 1;
+ mii = 1;
++ sram = 1;
+ break;
+ case 0x2626:
+ chipname = "PCnet/Home 79C978"; /* PCI */
+@@ -1636,6 +1637,7 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
+ chipname = "PCnet/FAST III 79C975"; /* PCI */
+ fdx = 1;
+ mii = 1;
++ sram = 1;
+ break;
+ case 0x2628:
+ chipname = "PCnet/PRO 79C976";
+@@ -1664,6 +1666,31 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
+ dxsuflo = 1;
+ }
+
++ /*
++ * The Am79C973/Am79C975 controllers come with 12K of SRAM
++ * which we can use for the Tx/Rx buffers but most importantly,
++ * the use of SRAM allow us to use the BCR18:NOUFLO bit to avoid
++ * Tx fifo underflows.
++ */
++ if (sram) {
++ /*
++ * The SRAM is being configured in two steps. First we
++ * set the SRAM size in the BCR25:SRAM_SIZE bits. According
++ * to the datasheet, each bit corresponds to a 512-byte
++ * page so we can have at most 24 pages. The SRAM_SIZE
++ * holds the value of the upper 8 bits of the 16-bit SRAM size.
++ * The low 8-bits start at 0x00 and end at 0xff. So the
++ * address range is from 0x0000 up to 0x17ff. Therefore,
++ * the SRAM_SIZE is set to 0x17. The next step is to set
++ * the BCR26:SRAM_BND midway through so the Tx and Rx
++ * buffers can share the SRAM equally.
++ */
++ a->write_bcr(ioaddr, 25, 0x17);
++ a->write_bcr(ioaddr, 26, 0xc);
++ /* And finally enable the NOUFLO bit */
++ a->write_bcr(ioaddr, 18, a->read_bcr(ioaddr, 18) | (1 << 11));
++ }
++
+ dev = alloc_etherdev(sizeof(*lp));
+ if (!dev) {
+ ret = -ENOMEM;
+diff --git a/drivers/net/wireless/rtlwifi/base.c b/drivers/net/wireless/rtlwifi/base.c
+index 40b6d1d006d7..af2486965782 100644
+--- a/drivers/net/wireless/rtlwifi/base.c
++++ b/drivers/net/wireless/rtlwifi/base.c
+@@ -1314,8 +1314,11 @@ u8 rtl_is_special_data(struct ieee80211_hw *hw, struct sk_buff *skb, u8 is_tx)
+ }
+
+ return true;
+- } else if (0x86DD == ether_type) {
+- return true;
++ } else if (ETH_P_IPV6 == ether_type) {
++ /* TODO: Handle any IPv6 cases that need special handling.
++ * For now, always return false
++ */
++ goto end;
+ }
+
+ end:
+diff --git a/drivers/of/irq.c b/drivers/of/irq.c
+index 1471e0a223a5..b97363adca0b 100644
+--- a/drivers/of/irq.c
++++ b/drivers/of/irq.c
+@@ -290,7 +290,7 @@ int of_irq_parse_one(struct device_node *device, int index, struct of_phandle_ar
+ struct device_node *p;
+ const __be32 *intspec, *tmp, *addr;
+ u32 intsize, intlen;
+- int i, res = -EINVAL;
++ int i, res;
+
+ pr_debug("of_irq_parse_one: dev=%s, index=%d\n", of_node_full_name(device), index);
+
+@@ -323,15 +323,19 @@ int of_irq_parse_one(struct device_node *device, int index, struct of_phandle_ar
+
+ /* Get size of interrupt specifier */
+ tmp = of_get_property(p, "#interrupt-cells", NULL);
+- if (tmp == NULL)
++ if (tmp == NULL) {
++ res = -EINVAL;
+ goto out;
++ }
+ intsize = be32_to_cpu(*tmp);
+
+ pr_debug(" intsize=%d intlen=%d\n", intsize, intlen);
+
+ /* Check index */
+- if ((index + 1) * intsize > intlen)
++ if ((index + 1) * intsize > intlen) {
++ res = -EINVAL;
+ goto out;
++ }
+
+ /* Copy intspec into irq structure */
+ intspec += index * intsize;
+diff --git a/drivers/phy/phy-core.c b/drivers/phy/phy-core.c
+index ff5eec5af817..2733112b3527 100644
+--- a/drivers/phy/phy-core.c
++++ b/drivers/phy/phy-core.c
+@@ -51,7 +51,9 @@ static void devm_phy_consume(struct device *dev, void *res)
+
+ static int devm_phy_match(struct device *dev, void *res, void *match_data)
+ {
+- return res == match_data;
++ struct phy **phy = res;
++
++ return *phy == match_data;
+ }
+
+ static struct phy *phy_lookup(struct device *device, const char *port)
+diff --git a/drivers/regulator/palmas-regulator.c b/drivers/regulator/palmas-regulator.c
+index 1878e5b567ef..1a7f5fc11623 100644
+--- a/drivers/regulator/palmas-regulator.c
++++ b/drivers/regulator/palmas-regulator.c
+@@ -1572,6 +1572,10 @@ static int palmas_regulators_probe(struct platform_device *pdev)
+ if (!pmic)
+ return -ENOMEM;
+
++ if (of_device_is_compatible(node, "ti,tps659038-pmic"))
++ palmas_generic_regs_info[PALMAS_REG_REGEN2].ctrl_addr =
++ TPS659038_REGEN2_CTRL;
++
+ pmic->dev = &pdev->dev;
+ pmic->palmas = palmas;
+ palmas->pmic = pmic;
+diff --git a/drivers/scsi/qla2xxx/tcm_qla2xxx.c b/drivers/scsi/qla2xxx/tcm_qla2xxx.c
+index 73f9feecda72..272a2646a759 100644
+--- a/drivers/scsi/qla2xxx/tcm_qla2xxx.c
++++ b/drivers/scsi/qla2xxx/tcm_qla2xxx.c
+@@ -1598,7 +1598,7 @@ static int tcm_qla2xxx_check_initiator_node_acl(
+ /*
+ * Finally register the new FC Nexus with TCM
+ */
+- __transport_register_session(se_nacl->se_tpg, se_nacl, se_sess, sess);
++ transport_register_session(se_nacl->se_tpg, se_nacl, se_sess, sess);
+
+ return 0;
+ }
+diff --git a/drivers/spi/spi-qup.c b/drivers/spi/spi-qup.c
+index 9f83d2950748..6976f8aa8562 100644
+--- a/drivers/spi/spi-qup.c
++++ b/drivers/spi/spi-qup.c
+@@ -489,7 +489,7 @@ static int spi_qup_probe(struct platform_device *pdev)
+ struct resource *res;
+ struct device *dev;
+ void __iomem *base;
+- u32 max_freq, iomode;
++ u32 max_freq, iomode, num_cs;
+ int ret, irq, size;
+
+ dev = &pdev->dev;
+@@ -541,10 +541,11 @@ static int spi_qup_probe(struct platform_device *pdev)
+ }
+
+ /* use num-cs unless not present or out of range */
+- if (of_property_read_u16(dev->of_node, "num-cs",
+- &master->num_chipselect) ||
+- (master->num_chipselect > SPI_NUM_CHIPSELECTS))
++ if (of_property_read_u32(dev->of_node, "num-cs", &num_cs) ||
++ num_cs > SPI_NUM_CHIPSELECTS)
+ master->num_chipselect = SPI_NUM_CHIPSELECTS;
++ else
++ master->num_chipselect = num_cs;
+
+ master->bus_num = pdev->id;
+ master->mode_bits = SPI_CPOL | SPI_CPHA | SPI_CS_HIGH | SPI_LOOP;
+diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
+index 50f20f243981..1c72be19e70e 100644
+--- a/drivers/spi/spi.c
++++ b/drivers/spi/spi.c
+@@ -1073,13 +1073,14 @@ void spi_finalize_current_message(struct spi_master *master)
+ "failed to unprepare message: %d\n", ret);
+ }
+ }
++
++ trace_spi_message_done(mesg);
++
+ master->cur_msg_prepared = false;
+
+ mesg->state = NULL;
+ if (mesg->complete)
+ mesg->complete(mesg->context);
+-
+- trace_spi_message_done(mesg);
+ }
+ EXPORT_SYMBOL_GPL(spi_finalize_current_message);
+
+diff --git a/drivers/staging/vt6655/rf.c b/drivers/staging/vt6655/rf.c
+index e505af91bfd0..fb62e8dd11ba 100644
+--- a/drivers/staging/vt6655/rf.c
++++ b/drivers/staging/vt6655/rf.c
+@@ -923,6 +923,7 @@ bool RFbSetPower(
+ break;
+ case RATE_6M:
+ case RATE_9M:
++ case RATE_12M:
+ case RATE_18M:
+ byPwr = pDevice->abyOFDMPwrTbl[uCH];
+ if (pDevice->byRFType == RF_UW2452)
+diff --git a/drivers/staging/vt6656/rf.c b/drivers/staging/vt6656/rf.c
+index c42cde59f598..c4286ccac320 100644
+--- a/drivers/staging/vt6656/rf.c
++++ b/drivers/staging/vt6656/rf.c
+@@ -640,6 +640,7 @@ int vnt_rf_setpower(struct vnt_private *priv, u32 rate, u32 channel)
+ break;
+ case RATE_6M:
+ case RATE_9M:
++ case RATE_12M:
+ case RATE_18M:
+ case RATE_24M:
+ case RATE_36M:
+diff --git a/drivers/target/tcm_fc/tfc_io.c b/drivers/target/tcm_fc/tfc_io.c
+index 97b486c3dda1..583e755d8091 100644
+--- a/drivers/target/tcm_fc/tfc_io.c
++++ b/drivers/target/tcm_fc/tfc_io.c
+@@ -359,7 +359,7 @@ void ft_invl_hw_context(struct ft_cmd *cmd)
+ ep = fc_seq_exch(seq);
+ if (ep) {
+ lport = ep->lp;
+- if (lport && (ep->xid <= lport->lro_xid))
++ if (lport && (ep->xid <= lport->lro_xid)) {
+ /*
+ * "ddp_done" trigger invalidation of HW
+ * specific DDP context
+@@ -374,6 +374,7 @@ void ft_invl_hw_context(struct ft_cmd *cmd)
+ * identified using ep->xid)
+ */
+ cmd->was_ddp_setup = 0;
++ }
+ }
+ }
+ }
+diff --git a/drivers/usb/chipidea/udc.c b/drivers/usb/chipidea/udc.c
+index 0444d3f8971a..c42bf8da56db 100644
+--- a/drivers/usb/chipidea/udc.c
++++ b/drivers/usb/chipidea/udc.c
+@@ -933,6 +933,13 @@ __acquires(hwep->lock)
+ return retval;
+ }
+
++static int otg_a_alt_hnp_support(struct ci_hdrc *ci)
++{
++ dev_warn(&ci->gadget.dev,
++ "connect the device to an alternate port if you want HNP\n");
++ return isr_setup_status_phase(ci);
++}
++
+ /**
+ * isr_setup_packet_handler: setup packet handler
+ * @ci: UDC descriptor
+@@ -1065,6 +1072,10 @@ __acquires(ci->lock)
+ ci);
+ }
+ break;
++ case USB_DEVICE_A_ALT_HNP_SUPPORT:
++ if (ci_otg_is_fsm_mode(ci))
++ err = otg_a_alt_hnp_support(ci);
++ break;
+ default:
+ goto delegate;
+ }
+diff --git a/drivers/usb/common/usb-otg-fsm.c b/drivers/usb/common/usb-otg-fsm.c
+index 98e8340a5bb1..c812fefe0e50 100644
+--- a/drivers/usb/common/usb-otg-fsm.c
++++ b/drivers/usb/common/usb-otg-fsm.c
+@@ -150,9 +150,9 @@ static int otg_set_state(struct otg_fsm *fsm, enum usb_otg_state new_state)
+ break;
+ case OTG_STATE_B_PERIPHERAL:
+ otg_chrg_vbus(fsm, 0);
+- otg_loc_conn(fsm, 1);
+ otg_loc_sof(fsm, 0);
+ otg_set_protocol(fsm, PROTO_GADGET);
++ otg_loc_conn(fsm, 1);
+ break;
+ case OTG_STATE_B_WAIT_ACON:
+ otg_chrg_vbus(fsm, 0);
+@@ -213,10 +213,10 @@ static int otg_set_state(struct otg_fsm *fsm, enum usb_otg_state new_state)
+
+ break;
+ case OTG_STATE_A_PERIPHERAL:
+- otg_loc_conn(fsm, 1);
+ otg_loc_sof(fsm, 0);
+ otg_set_protocol(fsm, PROTO_GADGET);
+ otg_drv_vbus(fsm, 1);
++ otg_loc_conn(fsm, 1);
+ otg_add_timer(fsm, A_BIDL_ADIS);
+ break;
+ case OTG_STATE_A_WAIT_VFALL:
+diff --git a/drivers/usb/phy/phy-am335x-control.c b/drivers/usb/phy/phy-am335x-control.c
+index 35b6083b7999..d5eca7b9c555 100644
+--- a/drivers/usb/phy/phy-am335x-control.c
++++ b/drivers/usb/phy/phy-am335x-control.c
+@@ -126,6 +126,9 @@ struct phy_control *am335x_get_phy_control(struct device *dev)
+ return NULL;
+
+ dev = bus_find_device(&platform_bus_type, NULL, node, match);
++ if (!dev)
++ return NULL;
++
+ ctrl_usb = dev_get_drvdata(dev);
+ if (!ctrl_usb)
+ return NULL;
+diff --git a/drivers/usb/storage/unusual_uas.h b/drivers/usb/storage/unusual_uas.h
+index cd047d0cc7a6..cd4ba61330c8 100644
+--- a/drivers/usb/storage/unusual_uas.h
++++ b/drivers/usb/storage/unusual_uas.h
+@@ -103,6 +103,13 @@ UNUSUAL_DEV(0x0bc2, 0xab2a, 0x0000, 0x9999,
+ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+ US_FL_NO_ATA_1X),
+
++/* Reported-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> */
++UNUSUAL_DEV(0x13fd, 0x3940, 0x0000, 0x9999,
++ "Initio Corporation",
++ "",
++ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
++ US_FL_NO_ATA_1X),
++
+ /* Reported-by: Tom Arild Naess <tanaess@gmail.com> */
+ UNUSUAL_DEV(0x152d, 0x0539, 0x0000, 0x9999,
+ "JMicron",
+diff --git a/drivers/virtio/virtio_balloon.c b/drivers/virtio/virtio_balloon.c
+index c9703d4d6f67..440d78f39c01 100644
+--- a/drivers/virtio/virtio_balloon.c
++++ b/drivers/virtio/virtio_balloon.c
+@@ -28,6 +28,7 @@
+ #include <linux/slab.h>
+ #include <linux/module.h>
+ #include <linux/balloon_compaction.h>
++#include <linux/wait.h>
+
+ /*
+ * Balloon device works in 4K page units. So each page is pointed to by
+@@ -290,17 +291,25 @@ static void update_balloon_size(struct virtio_balloon *vb)
+ static int balloon(void *_vballoon)
+ {
+ struct virtio_balloon *vb = _vballoon;
++ DEFINE_WAIT_FUNC(wait, woken_wake_function);
+
+ set_freezable();
+ while (!kthread_should_stop()) {
+ s64 diff;
+
+ try_to_freeze();
+- wait_event_interruptible(vb->config_change,
+- (diff = towards_target(vb)) != 0
+- || vb->need_stats_update
+- || kthread_should_stop()
+- || freezing(current));
++
++ add_wait_queue(&vb->config_change, &wait);
++ for (;;) {
++ if ((diff = towards_target(vb)) != 0 ||
++ vb->need_stats_update ||
++ kthread_should_stop() ||
++ freezing(current))
++ break;
++ wait_woken(&wait, TASK_INTERRUPTIBLE, MAX_SCHEDULE_TIMEOUT);
++ }
++ remove_wait_queue(&vb->config_change, &wait);
++
+ if (vb->need_stats_update)
+ stats_handle_request(vb);
+ if (diff > 0)
+@@ -443,6 +452,8 @@ static int virtballoon_probe(struct virtio_device *vdev)
+ if (err)
+ goto out_free_vb;
+
++ virtio_device_ready(vdev);
++
+ vb->thread = kthread_run(balloon, vb, "vballoon");
+ if (IS_ERR(vb->thread)) {
+ err = PTR_ERR(vb->thread);
+diff --git a/fs/hfsplus/brec.c b/fs/hfsplus/brec.c
+index 6e560d56094b..754fdf8c6356 100644
+--- a/fs/hfsplus/brec.c
++++ b/fs/hfsplus/brec.c
+@@ -131,13 +131,16 @@ skip:
+ hfs_bnode_write(node, entry, data_off + key_len, entry_len);
+ hfs_bnode_dump(node);
+
+- if (new_node) {
+- /* update parent key if we inserted a key
+- * at the start of the first node
+- */
+- if (!rec && new_node != node)
+- hfs_brec_update_parent(fd);
++ /*
++ * update parent key if we inserted a key
++ * at the start of the node and it is not the new node
++ */
++ if (!rec && new_node != node) {
++ hfs_bnode_read_key(node, fd->search_key, data_off + size);
++ hfs_brec_update_parent(fd);
++ }
+
++ if (new_node) {
+ hfs_bnode_put(fd->bnode);
+ if (!new_node->parent) {
+ hfs_btree_inc_height(tree);
+@@ -168,9 +171,6 @@ skip:
+ goto again;
+ }
+
+- if (!rec)
+- hfs_brec_update_parent(fd);
+-
+ return 0;
+ }
+
+@@ -370,6 +370,8 @@ again:
+ if (IS_ERR(parent))
+ return PTR_ERR(parent);
+ __hfs_brec_find(parent, fd, hfs_find_rec_by_key);
++ if (fd->record < 0)
++ return -ENOENT;
+ hfs_bnode_dump(parent);
+ rec = fd->record;
+
+diff --git a/include/linux/device-mapper.h b/include/linux/device-mapper.h
+index e1707de043ae..c51706b7a36e 100644
+--- a/include/linux/device-mapper.h
++++ b/include/linux/device-mapper.h
+@@ -366,6 +366,7 @@ int dm_create(int minor, struct mapped_device **md);
+ */
+ struct mapped_device *dm_get_md(dev_t dev);
+ void dm_get(struct mapped_device *md);
++int dm_hold(struct mapped_device *md);
+ void dm_put(struct mapped_device *md);
+
+ /*
+diff --git a/include/linux/mfd/palmas.h b/include/linux/mfd/palmas.h
+index fb0390a1a498..ee7b1ce7a6f8 100644
+--- a/include/linux/mfd/palmas.h
++++ b/include/linux/mfd/palmas.h
+@@ -2999,6 +2999,9 @@ enum usb_irq_events {
+ #define PALMAS_GPADC_TRIM15 0x0E
+ #define PALMAS_GPADC_TRIM16 0x0F
+
++/* TPS659038 regen2_ctrl offset iss different from palmas */
++#define TPS659038_REGEN2_CTRL 0x12
++
+ /* TPS65917 Interrupt registers */
+
+ /* Registers for function INTERRUPT */
+diff --git a/include/linux/wait.h b/include/linux/wait.h
+index e4a8eb9312ea..fc0e99395fbb 100644
+--- a/include/linux/wait.h
++++ b/include/linux/wait.h
+@@ -13,9 +13,12 @@ typedef struct __wait_queue wait_queue_t;
+ typedef int (*wait_queue_func_t)(wait_queue_t *wait, unsigned mode, int flags, void *key);
+ int default_wake_function(wait_queue_t *wait, unsigned mode, int flags, void *key);
+
++/* __wait_queue::flags */
++#define WQ_FLAG_EXCLUSIVE 0x01
++#define WQ_FLAG_WOKEN 0x02
++
+ struct __wait_queue {
+ unsigned int flags;
+-#define WQ_FLAG_EXCLUSIVE 0x01
+ void *private;
+ wait_queue_func_t func;
+ struct list_head task_list;
+@@ -830,6 +833,8 @@ void prepare_to_wait_exclusive(wait_queue_head_t *q, wait_queue_t *wait, int sta
+ long prepare_to_wait_event(wait_queue_head_t *q, wait_queue_t *wait, int state);
+ void finish_wait(wait_queue_head_t *q, wait_queue_t *wait);
+ void abort_exclusive_wait(wait_queue_head_t *q, wait_queue_t *wait, unsigned int mode, void *key);
++long wait_woken(wait_queue_t *wait, unsigned mode, long timeout);
++int woken_wake_function(wait_queue_t *wait, unsigned mode, int sync, void *key);
+ int autoremove_wake_function(wait_queue_t *wait, unsigned mode, int sync, void *key);
+ int wake_bit_function(wait_queue_t *wait, unsigned mode, int sync, void *key);
+
+diff --git a/include/trace/events/regmap.h b/include/trace/events/regmap.h
+index 23d561512f64..22317d2b52ab 100644
+--- a/include/trace/events/regmap.h
++++ b/include/trace/events/regmap.h
+@@ -7,27 +7,26 @@
+ #include <linux/ktime.h>
+ #include <linux/tracepoint.h>
+
+-struct device;
+-struct regmap;
++#include "../../../drivers/base/regmap/internal.h"
+
+ /*
+ * Log register events
+ */
+ DECLARE_EVENT_CLASS(regmap_reg,
+
+- TP_PROTO(struct device *dev, unsigned int reg,
++ TP_PROTO(struct regmap *map, unsigned int reg,
+ unsigned int val),
+
+- TP_ARGS(dev, reg, val),
++ TP_ARGS(map, reg, val),
+
+ TP_STRUCT__entry(
+- __string( name, dev_name(dev) )
+- __field( unsigned int, reg )
+- __field( unsigned int, val )
++ __string( name, regmap_name(map) )
++ __field( unsigned int, reg )
++ __field( unsigned int, val )
+ ),
+
+ TP_fast_assign(
+- __assign_str(name, dev_name(dev));
++ __assign_str(name, regmap_name(map));
+ __entry->reg = reg;
+ __entry->val = val;
+ ),
+@@ -39,45 +38,45 @@ DECLARE_EVENT_CLASS(regmap_reg,
+
+ DEFINE_EVENT(regmap_reg, regmap_reg_write,
+
+- TP_PROTO(struct device *dev, unsigned int reg,
++ TP_PROTO(struct regmap *map, unsigned int reg,
+ unsigned int val),
+
+- TP_ARGS(dev, reg, val)
++ TP_ARGS(map, reg, val)
+
+ );
+
+ DEFINE_EVENT(regmap_reg, regmap_reg_read,
+
+- TP_PROTO(struct device *dev, unsigned int reg,
++ TP_PROTO(struct regmap *map, unsigned int reg,
+ unsigned int val),
+
+- TP_ARGS(dev, reg, val)
++ TP_ARGS(map, reg, val)
+
+ );
+
+ DEFINE_EVENT(regmap_reg, regmap_reg_read_cache,
+
+- TP_PROTO(struct device *dev, unsigned int reg,
++ TP_PROTO(struct regmap *map, unsigned int reg,
+ unsigned int val),
+
+- TP_ARGS(dev, reg, val)
++ TP_ARGS(map, reg, val)
+
+ );
+
+ DECLARE_EVENT_CLASS(regmap_block,
+
+- TP_PROTO(struct device *dev, unsigned int reg, int count),
++ TP_PROTO(struct regmap *map, unsigned int reg, int count),
+
+- TP_ARGS(dev, reg, count),
++ TP_ARGS(map, reg, count),
+
+ TP_STRUCT__entry(
+- __string( name, dev_name(dev) )
+- __field( unsigned int, reg )
+- __field( int, count )
++ __string( name, regmap_name(map) )
++ __field( unsigned int, reg )
++ __field( int, count )
+ ),
+
+ TP_fast_assign(
+- __assign_str(name, dev_name(dev));
++ __assign_str(name, regmap_name(map));
+ __entry->reg = reg;
+ __entry->count = count;
+ ),
+@@ -89,48 +88,48 @@ DECLARE_EVENT_CLASS(regmap_block,
+
+ DEFINE_EVENT(regmap_block, regmap_hw_read_start,
+
+- TP_PROTO(struct device *dev, unsigned int reg, int count),
++ TP_PROTO(struct regmap *map, unsigned int reg, int count),
+
+- TP_ARGS(dev, reg, count)
++ TP_ARGS(map, reg, count)
+ );
+
+ DEFINE_EVENT(regmap_block, regmap_hw_read_done,
+
+- TP_PROTO(struct device *dev, unsigned int reg, int count),
++ TP_PROTO(struct regmap *map, unsigned int reg, int count),
+
+- TP_ARGS(dev, reg, count)
++ TP_ARGS(map, reg, count)
+ );
+
+ DEFINE_EVENT(regmap_block, regmap_hw_write_start,
+
+- TP_PROTO(struct device *dev, unsigned int reg, int count),
++ TP_PROTO(struct regmap *map, unsigned int reg, int count),
+
+- TP_ARGS(dev, reg, count)
++ TP_ARGS(map, reg, count)
+ );
+
+ DEFINE_EVENT(regmap_block, regmap_hw_write_done,
+
+- TP_PROTO(struct device *dev, unsigned int reg, int count),
++ TP_PROTO(struct regmap *map, unsigned int reg, int count),
+
+- TP_ARGS(dev, reg, count)
++ TP_ARGS(map, reg, count)
+ );
+
+ TRACE_EVENT(regcache_sync,
+
+- TP_PROTO(struct device *dev, const char *type,
++ TP_PROTO(struct regmap *map, const char *type,
+ const char *status),
+
+- TP_ARGS(dev, type, status),
++ TP_ARGS(map, type, status),
+
+ TP_STRUCT__entry(
+- __string( name, dev_name(dev) )
+- __string( status, status )
+- __string( type, type )
+- __field( int, type )
++ __string( name, regmap_name(map) )
++ __string( status, status )
++ __string( type, type )
++ __field( int, type )
+ ),
+
+ TP_fast_assign(
+- __assign_str(name, dev_name(dev));
++ __assign_str(name, regmap_name(map));
+ __assign_str(status, status);
+ __assign_str(type, type);
+ ),
+@@ -141,17 +140,17 @@ TRACE_EVENT(regcache_sync,
+
+ DECLARE_EVENT_CLASS(regmap_bool,
+
+- TP_PROTO(struct device *dev, bool flag),
++ TP_PROTO(struct regmap *map, bool flag),
+
+- TP_ARGS(dev, flag),
++ TP_ARGS(map, flag),
+
+ TP_STRUCT__entry(
+- __string( name, dev_name(dev) )
+- __field( int, flag )
++ __string( name, regmap_name(map) )
++ __field( int, flag )
+ ),
+
+ TP_fast_assign(
+- __assign_str(name, dev_name(dev));
++ __assign_str(name, regmap_name(map));
+ __entry->flag = flag;
+ ),
+
+@@ -161,32 +160,32 @@ DECLARE_EVENT_CLASS(regmap_bool,
+
+ DEFINE_EVENT(regmap_bool, regmap_cache_only,
+
+- TP_PROTO(struct device *dev, bool flag),
++ TP_PROTO(struct regmap *map, bool flag),
+
+- TP_ARGS(dev, flag)
++ TP_ARGS(map, flag)
+
+ );
+
+ DEFINE_EVENT(regmap_bool, regmap_cache_bypass,
+
+- TP_PROTO(struct device *dev, bool flag),
++ TP_PROTO(struct regmap *map, bool flag),
+
+- TP_ARGS(dev, flag)
++ TP_ARGS(map, flag)
+
+ );
+
+ DECLARE_EVENT_CLASS(regmap_async,
+
+- TP_PROTO(struct device *dev),
++ TP_PROTO(struct regmap *map),
+
+- TP_ARGS(dev),
++ TP_ARGS(map),
+
+ TP_STRUCT__entry(
+- __string( name, dev_name(dev) )
++ __string( name, regmap_name(map) )
+ ),
+
+ TP_fast_assign(
+- __assign_str(name, dev_name(dev));
++ __assign_str(name, regmap_name(map));
+ ),
+
+ TP_printk("%s", __get_str(name))
+@@ -194,50 +193,50 @@ DECLARE_EVENT_CLASS(regmap_async,
+
+ DEFINE_EVENT(regmap_block, regmap_async_write_start,
+
+- TP_PROTO(struct device *dev, unsigned int reg, int count),
++ TP_PROTO(struct regmap *map, unsigned int reg, int count),
+
+- TP_ARGS(dev, reg, count)
++ TP_ARGS(map, reg, count)
+ );
+
+ DEFINE_EVENT(regmap_async, regmap_async_io_complete,
+
+- TP_PROTO(struct device *dev),
++ TP_PROTO(struct regmap *map),
+
+- TP_ARGS(dev)
++ TP_ARGS(map)
+
+ );
+
+ DEFINE_EVENT(regmap_async, regmap_async_complete_start,
+
+- TP_PROTO(struct device *dev),
++ TP_PROTO(struct regmap *map),
+
+- TP_ARGS(dev)
++ TP_ARGS(map)
+
+ );
+
+ DEFINE_EVENT(regmap_async, regmap_async_complete_done,
+
+- TP_PROTO(struct device *dev),
++ TP_PROTO(struct regmap *map),
+
+- TP_ARGS(dev)
++ TP_ARGS(map)
+
+ );
+
+ TRACE_EVENT(regcache_drop_region,
+
+- TP_PROTO(struct device *dev, unsigned int from,
++ TP_PROTO(struct regmap *map, unsigned int from,
+ unsigned int to),
+
+- TP_ARGS(dev, from, to),
++ TP_ARGS(map, from, to),
+
+ TP_STRUCT__entry(
+- __string( name, dev_name(dev) )
+- __field( unsigned int, from )
+- __field( unsigned int, to )
++ __string( name, regmap_name(map) )
++ __field( unsigned int, from )
++ __field( unsigned int, to )
+ ),
+
+ TP_fast_assign(
+- __assign_str(name, dev_name(dev));
++ __assign_str(name, regmap_name(map));
+ __entry->from = from;
+ __entry->to = to;
+ ),
+diff --git a/kernel/events/core.c b/kernel/events/core.c
+index 2ab023803945..e631dacdb165 100644
+--- a/kernel/events/core.c
++++ b/kernel/events/core.c
+@@ -4412,6 +4412,13 @@ static void perf_pending_event(struct irq_work *entry)
+ {
+ struct perf_event *event = container_of(entry,
+ struct perf_event, pending);
++ int rctx;
++
++ rctx = perf_swevent_get_recursion_context();
++ /*
++ * If we 'fail' here, that's OK, it means recursion is already disabled
++ * and we won't recurse 'further'.
++ */
+
+ if (event->pending_disable) {
+ event->pending_disable = 0;
+@@ -4422,6 +4429,9 @@ static void perf_pending_event(struct irq_work *entry)
+ event->pending_wakeup = 0;
+ perf_event_wakeup(event);
+ }
++
++ if (rctx >= 0)
++ perf_swevent_put_recursion_context(rctx);
+ }
+
+ /*
+diff --git a/kernel/sched/wait.c b/kernel/sched/wait.c
+index 5a62915f47a8..4dae1885db6f 100644
+--- a/kernel/sched/wait.c
++++ b/kernel/sched/wait.c
+@@ -297,6 +297,67 @@ int autoremove_wake_function(wait_queue_t *wait, unsigned mode, int sync, void *
+ }
+ EXPORT_SYMBOL(autoremove_wake_function);
+
++
++/*
++ * DEFINE_WAIT_FUNC(wait, woken_wake_func);
++ *
++ * add_wait_queue(&wq, &wait);
++ * for (;;) {
++ * if (condition)
++ * break;
++ *
++ * p->state = mode; condition = true;
++ * smp_mb(); // A smp_wmb(); // C
++ * if (!wait->flags & WQ_FLAG_WOKEN) wait->flags |= WQ_FLAG_WOKEN;
++ * schedule() try_to_wake_up();
++ * p->state = TASK_RUNNING; ~~~~~~~~~~~~~~~~~~
++ * wait->flags &= ~WQ_FLAG_WOKEN; condition = true;
++ * smp_mb() // B smp_wmb(); // C
++ * wait->flags |= WQ_FLAG_WOKEN;
++ * }
++ * remove_wait_queue(&wq, &wait);
++ *
++ */
++long wait_woken(wait_queue_t *wait, unsigned mode, long timeout)
++{
++ set_current_state(mode); /* A */
++ /*
++ * The above implies an smp_mb(), which matches with the smp_wmb() from
++ * woken_wake_function() such that if we observe WQ_FLAG_WOKEN we must
++ * also observe all state before the wakeup.
++ */
++ if (!(wait->flags & WQ_FLAG_WOKEN))
++ timeout = schedule_timeout(timeout);
++ __set_current_state(TASK_RUNNING);
++
++ /*
++ * The below implies an smp_mb(), it too pairs with the smp_wmb() from
++ * woken_wake_function() such that we must either observe the wait
++ * condition being true _OR_ WQ_FLAG_WOKEN such that we will not miss
++ * an event.
++ */
++ set_mb(wait->flags, wait->flags & ~WQ_FLAG_WOKEN); /* B */
++
++ return timeout;
++}
++EXPORT_SYMBOL(wait_woken);
++
++int woken_wake_function(wait_queue_t *wait, unsigned mode, int sync, void *key)
++{
++ /*
++ * Although this function is called under waitqueue lock, LOCK
++ * doesn't imply write barrier and the users expects write
++ * barrier semantics on wakeup functions. The following
++ * smp_wmb() is equivalent to smp_wmb() in try_to_wake_up()
++ * and is paired with set_mb() in wait_woken().
++ */
++ smp_wmb(); /* C */
++ wait->flags |= WQ_FLAG_WOKEN;
++
++ return default_wake_function(wait, mode, sync, key);
++}
++EXPORT_SYMBOL(woken_wake_function);
++
+ int wake_bit_function(wait_queue_t *wait, unsigned mode, int sync, void *arg)
+ {
+ struct wait_bit_key *key = arg;
+diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c
+index 8d1653caffdb..56a65536c8f1 100644
+--- a/net/ceph/messenger.c
++++ b/net/ceph/messenger.c
+@@ -484,7 +484,7 @@ static int ceph_tcp_connect(struct ceph_connection *con)
+ IPPROTO_TCP, &sock);
+ if (ret)
+ return ret;
+- sock->sk->sk_allocation = GFP_NOFS | __GFP_MEMALLOC;
++ sock->sk->sk_allocation = GFP_NOFS;
+
+ #ifdef CONFIG_LOCKDEP
+ lockdep_set_class(&sock->sk->sk_lock, &socket_class);
+@@ -510,8 +510,6 @@ static int ceph_tcp_connect(struct ceph_connection *con)
+ return ret;
+ }
+
+- sk_set_memalloc(sock->sk);
+-
+ con->sock = sock;
+ return 0;
+ }
+@@ -2772,11 +2770,8 @@ static void con_work(struct work_struct *work)
+ {
+ struct ceph_connection *con = container_of(work, struct ceph_connection,
+ work.work);
+- unsigned long pflags = current->flags;
+ bool fault;
+
+- current->flags |= PF_MEMALLOC;
+-
+ mutex_lock(&con->mutex);
+ while (true) {
+ int ret;
+@@ -2830,8 +2825,6 @@ static void con_work(struct work_struct *work)
+ con_fault_finish(con);
+
+ con->ops->put(con);
+-
+- tsk_restore_flags(current, pflags, PF_MEMALLOC);
+ }
+
+ /*
+diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
+index 8c68da30595d..91c1aca65ae9 100644
+--- a/net/mac80211/ieee80211_i.h
++++ b/net/mac80211/ieee80211_i.h
+@@ -58,13 +58,24 @@ struct ieee80211_local;
+ #define IEEE80211_UNSET_POWER_LEVEL INT_MIN
+
+ /*
+- * Some APs experience problems when working with U-APSD. Decrease the
+- * probability of that happening by using legacy mode for all ACs but VO.
+- * The AP that caused us trouble was a Cisco 4410N. It ignores our
+- * setting, and always treats non-VO ACs as legacy.
++ * Some APs experience problems when working with U-APSD. Decreasing the
++ * probability of that happening by using legacy mode for all ACs but VO isn't
++ * enough.
++ *
++ * Cisco 4410N originally forced us to enable VO by default only because it
++ * treated non-VO ACs as legacy.
++ *
++ * However some APs (notably Netgear R7000) silently reclassify packets to
++ * different ACs. Since u-APSD ACs require trigger frames for frame retrieval
++ * clients would never see some frames (e.g. ARP responses) or would fetch them
++ * accidentally after a long time.
++ *
++ * It makes little sense to enable u-APSD queues by default because it needs
++ * userspace applications to be aware of it to actually take advantage of the
++ * possible additional powersavings. Implicitly depending on driver autotrigger
++ * frame support doesn't make much sense.
+ */
+-#define IEEE80211_DEFAULT_UAPSD_QUEUES \
+- IEEE80211_WMM_IE_STA_QOSINFO_AC_VO
++#define IEEE80211_DEFAULT_UAPSD_QUEUES 0
+
+ #define IEEE80211_DEFAULT_MAX_SP_LEN \
+ IEEE80211_WMM_IE_STA_QOSINFO_SP_ALL
+diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
+index 7d6379bd2cb8..bb77d6d7258a 100644
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -2108,6 +2108,9 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
+ hdr = (struct ieee80211_hdr *) skb->data;
+ mesh_hdr = (struct ieee80211s_hdr *) (skb->data + hdrlen);
+
++ if (ieee80211_drop_unencrypted(rx, hdr->frame_control))
++ return RX_DROP_MONITOR;
++
+ /* frame is in RMC, don't forward */
+ if (ieee80211_is_data(hdr->frame_control) &&
+ is_multicast_ether_addr(hdr->addr1) &&
+diff --git a/net/mac80211/util.c b/net/mac80211/util.c
+index 3c61060a4d2b..0043256df486 100644
+--- a/net/mac80211/util.c
++++ b/net/mac80211/util.c
+@@ -3050,7 +3050,7 @@ int ieee80211_check_combinations(struct ieee80211_sub_if_data *sdata,
+ wdev_iter = &sdata_iter->wdev;
+
+ if (sdata_iter == sdata ||
+- rcu_access_pointer(sdata_iter->vif.chanctx_conf) == NULL ||
++ !ieee80211_sdata_running(sdata_iter) ||
+ local->hw.wiphy->software_iftypes & BIT(wdev_iter->iftype))
+ continue;
+
+diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
+index 213048ad31c7..5fed79cfe45a 100644
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -4311,6 +4311,16 @@ static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
+ if (parse_station_flags(info, dev->ieee80211_ptr->iftype, ¶ms))
+ return -EINVAL;
+
++ /* HT/VHT requires QoS, but if we don't have that just ignore HT/VHT
++ * as userspace might just pass through the capabilities from the IEs
++ * directly, rather than enforcing this restriction and returning an
++ * error in this case.
++ */
++ if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME))) {
++ params.ht_capa = NULL;
++ params.vht_capa = NULL;
++ }
++
+ /* When you run into this, adjust the code below for the new flag */
+ BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
+
+diff --git a/sound/soc/codecs/adav80x.c b/sound/soc/codecs/adav80x.c
+index ce3cdca9fc62..01ab70a7f59f 100644
+--- a/sound/soc/codecs/adav80x.c
++++ b/sound/soc/codecs/adav80x.c
+@@ -317,7 +317,7 @@ static int adav80x_put_deemph(struct snd_kcontrol *kcontrol,
+ {
+ struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
+ struct adav80x *adav80x = snd_soc_codec_get_drvdata(codec);
+- unsigned int deemph = ucontrol->value.enumerated.item[0];
++ unsigned int deemph = ucontrol->value.integer.value[0];
+
+ if (deemph > 1)
+ return -EINVAL;
+@@ -333,7 +333,7 @@ static int adav80x_get_deemph(struct snd_kcontrol *kcontrol,
+ struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
+ struct adav80x *adav80x = snd_soc_codec_get_drvdata(codec);
+
+- ucontrol->value.enumerated.item[0] = adav80x->deemph;
++ ucontrol->value.integer.value[0] = adav80x->deemph;
+ return 0;
+ };
+
+diff --git a/sound/soc/codecs/ak4641.c b/sound/soc/codecs/ak4641.c
+index 7afe8f482088..570ec04fe411 100644
+--- a/sound/soc/codecs/ak4641.c
++++ b/sound/soc/codecs/ak4641.c
+@@ -76,7 +76,7 @@ static int ak4641_put_deemph(struct snd_kcontrol *kcontrol,
+ {
+ struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
+ struct ak4641_priv *ak4641 = snd_soc_codec_get_drvdata(codec);
+- int deemph = ucontrol->value.enumerated.item[0];
++ int deemph = ucontrol->value.integer.value[0];
+
+ if (deemph > 1)
+ return -EINVAL;
+@@ -92,7 +92,7 @@ static int ak4641_get_deemph(struct snd_kcontrol *kcontrol,
+ struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
+ struct ak4641_priv *ak4641 = snd_soc_codec_get_drvdata(codec);
+
+- ucontrol->value.enumerated.item[0] = ak4641->deemph;
++ ucontrol->value.integer.value[0] = ak4641->deemph;
+ return 0;
+ };
+
+diff --git a/sound/soc/codecs/ak4671.c b/sound/soc/codecs/ak4671.c
+index 998fa0c5a0b9..61a31802cf79 100644
+--- a/sound/soc/codecs/ak4671.c
++++ b/sound/soc/codecs/ak4671.c
+@@ -343,25 +343,25 @@ static const struct snd_soc_dapm_widget ak4671_dapm_widgets[] = {
+ };
+
+ static const struct snd_soc_dapm_route ak4671_intercon[] = {
+- {"DAC Left", "NULL", "PMPLL"},
+- {"DAC Right", "NULL", "PMPLL"},
+- {"ADC Left", "NULL", "PMPLL"},
+- {"ADC Right", "NULL", "PMPLL"},
++ {"DAC Left", NULL, "PMPLL"},
++ {"DAC Right", NULL, "PMPLL"},
++ {"ADC Left", NULL, "PMPLL"},
++ {"ADC Right", NULL, "PMPLL"},
+
+ /* Outputs */
+- {"LOUT1", "NULL", "LOUT1 Mixer"},
+- {"ROUT1", "NULL", "ROUT1 Mixer"},
+- {"LOUT2", "NULL", "LOUT2 Mix Amp"},
+- {"ROUT2", "NULL", "ROUT2 Mix Amp"},
+- {"LOUT3", "NULL", "LOUT3 Mixer"},
+- {"ROUT3", "NULL", "ROUT3 Mixer"},
++ {"LOUT1", NULL, "LOUT1 Mixer"},
++ {"ROUT1", NULL, "ROUT1 Mixer"},
++ {"LOUT2", NULL, "LOUT2 Mix Amp"},
++ {"ROUT2", NULL, "ROUT2 Mix Amp"},
++ {"LOUT3", NULL, "LOUT3 Mixer"},
++ {"ROUT3", NULL, "ROUT3 Mixer"},
+
+ {"LOUT1 Mixer", "DACL", "DAC Left"},
+ {"ROUT1 Mixer", "DACR", "DAC Right"},
+ {"LOUT2 Mixer", "DACHL", "DAC Left"},
+ {"ROUT2 Mixer", "DACHR", "DAC Right"},
+- {"LOUT2 Mix Amp", "NULL", "LOUT2 Mixer"},
+- {"ROUT2 Mix Amp", "NULL", "ROUT2 Mixer"},
++ {"LOUT2 Mix Amp", NULL, "LOUT2 Mixer"},
++ {"ROUT2 Mix Amp", NULL, "ROUT2 Mixer"},
+ {"LOUT3 Mixer", "DACSL", "DAC Left"},
+ {"ROUT3 Mixer", "DACSR", "DAC Right"},
+
+@@ -381,18 +381,18 @@ static const struct snd_soc_dapm_route ak4671_intercon[] = {
+ {"LIN2", NULL, "Mic Bias"},
+ {"RIN2", NULL, "Mic Bias"},
+
+- {"ADC Left", "NULL", "LIN MUX"},
+- {"ADC Right", "NULL", "RIN MUX"},
++ {"ADC Left", NULL, "LIN MUX"},
++ {"ADC Right", NULL, "RIN MUX"},
+
+ /* Analog Loops */
+- {"LIN1 Mixing Circuit", "NULL", "LIN1"},
+- {"RIN1 Mixing Circuit", "NULL", "RIN1"},
+- {"LIN2 Mixing Circuit", "NULL", "LIN2"},
+- {"RIN2 Mixing Circuit", "NULL", "RIN2"},
+- {"LIN3 Mixing Circuit", "NULL", "LIN3"},
+- {"RIN3 Mixing Circuit", "NULL", "RIN3"},
+- {"LIN4 Mixing Circuit", "NULL", "LIN4"},
+- {"RIN4 Mixing Circuit", "NULL", "RIN4"},
++ {"LIN1 Mixing Circuit", NULL, "LIN1"},
++ {"RIN1 Mixing Circuit", NULL, "RIN1"},
++ {"LIN2 Mixing Circuit", NULL, "LIN2"},
++ {"RIN2 Mixing Circuit", NULL, "RIN2"},
++ {"LIN3 Mixing Circuit", NULL, "LIN3"},
++ {"RIN3 Mixing Circuit", NULL, "RIN3"},
++ {"LIN4 Mixing Circuit", NULL, "LIN4"},
++ {"RIN4 Mixing Circuit", NULL, "RIN4"},
+
+ {"LOUT1 Mixer", "LINL1", "LIN1 Mixing Circuit"},
+ {"ROUT1 Mixer", "RINR1", "RIN1 Mixing Circuit"},
+diff --git a/sound/soc/codecs/cs4271.c b/sound/soc/codecs/cs4271.c
+index 93cec52f4733..6ec074fec068 100644
+--- a/sound/soc/codecs/cs4271.c
++++ b/sound/soc/codecs/cs4271.c
+@@ -287,7 +287,7 @@ static int cs4271_get_deemph(struct snd_kcontrol *kcontrol,
+ struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
+ struct cs4271_private *cs4271 = snd_soc_codec_get_drvdata(codec);
+
+- ucontrol->value.enumerated.item[0] = cs4271->deemph;
++ ucontrol->value.integer.value[0] = cs4271->deemph;
+ return 0;
+ }
+
+@@ -297,7 +297,7 @@ static int cs4271_put_deemph(struct snd_kcontrol *kcontrol,
+ struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
+ struct cs4271_private *cs4271 = snd_soc_codec_get_drvdata(codec);
+
+- cs4271->deemph = ucontrol->value.enumerated.item[0];
++ cs4271->deemph = ucontrol->value.integer.value[0];
+ return cs4271_set_deemph(codec);
+ }
+
+diff --git a/sound/soc/codecs/da732x.c b/sound/soc/codecs/da732x.c
+index 61b2f9a2eef1..e3110c67f3b2 100644
+--- a/sound/soc/codecs/da732x.c
++++ b/sound/soc/codecs/da732x.c
+@@ -876,11 +876,11 @@ static const struct snd_soc_dapm_widget da732x_dapm_widgets[] = {
+
+ static const struct snd_soc_dapm_route da732x_dapm_routes[] = {
+ /* Inputs */
+- {"AUX1L PGA", "NULL", "AUX1L"},
+- {"AUX1R PGA", "NULL", "AUX1R"},
++ {"AUX1L PGA", NULL, "AUX1L"},
++ {"AUX1R PGA", NULL, "AUX1R"},
+ {"MIC1 PGA", NULL, "MIC1"},
+- {"MIC2 PGA", "NULL", "MIC2"},
+- {"MIC3 PGA", "NULL", "MIC3"},
++ {"MIC2 PGA", NULL, "MIC2"},
++ {"MIC3 PGA", NULL, "MIC3"},
+
+ /* Capture Path */
+ {"ADC1 Left MUX", "MIC1", "MIC1 PGA"},
+diff --git a/sound/soc/codecs/es8328.c b/sound/soc/codecs/es8328.c
+index f27325155ace..c5f35a07e8e4 100644
+--- a/sound/soc/codecs/es8328.c
++++ b/sound/soc/codecs/es8328.c
+@@ -120,7 +120,7 @@ static int es8328_get_deemph(struct snd_kcontrol *kcontrol,
+ struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
+ struct es8328_priv *es8328 = snd_soc_codec_get_drvdata(codec);
+
+- ucontrol->value.enumerated.item[0] = es8328->deemph;
++ ucontrol->value.integer.value[0] = es8328->deemph;
+ return 0;
+ }
+
+@@ -129,7 +129,7 @@ static int es8328_put_deemph(struct snd_kcontrol *kcontrol,
+ {
+ struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
+ struct es8328_priv *es8328 = snd_soc_codec_get_drvdata(codec);
+- int deemph = ucontrol->value.enumerated.item[0];
++ int deemph = ucontrol->value.integer.value[0];
+ int ret;
+
+ if (deemph > 1)
+diff --git a/sound/soc/codecs/pcm1681.c b/sound/soc/codecs/pcm1681.c
+index a722a023c262..477e13d30971 100644
+--- a/sound/soc/codecs/pcm1681.c
++++ b/sound/soc/codecs/pcm1681.c
+@@ -118,7 +118,7 @@ static int pcm1681_get_deemph(struct snd_kcontrol *kcontrol,
+ struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
+ struct pcm1681_private *priv = snd_soc_codec_get_drvdata(codec);
+
+- ucontrol->value.enumerated.item[0] = priv->deemph;
++ ucontrol->value.integer.value[0] = priv->deemph;
+
+ return 0;
+ }
+@@ -129,7 +129,7 @@ static int pcm1681_put_deemph(struct snd_kcontrol *kcontrol,
+ struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
+ struct pcm1681_private *priv = snd_soc_codec_get_drvdata(codec);
+
+- priv->deemph = ucontrol->value.enumerated.item[0];
++ priv->deemph = ucontrol->value.integer.value[0];
+
+ return pcm1681_set_deemph(codec);
+ }
+diff --git a/sound/soc/codecs/sgtl5000.c b/sound/soc/codecs/sgtl5000.c
+index f1287ff8dd29..7de7431efcb3 100644
+--- a/sound/soc/codecs/sgtl5000.c
++++ b/sound/soc/codecs/sgtl5000.c
+@@ -1136,13 +1136,7 @@ static int sgtl5000_set_power_regs(struct snd_soc_codec *codec)
+ /* Enable VDDC charge pump */
+ ana_pwr |= SGTL5000_VDDC_CHRGPMP_POWERUP;
+ } else if (vddio >= 3100 && vdda >= 3100) {
+- /*
+- * if vddio and vddd > 3.1v,
+- * charge pump should be clean before set ana_pwr
+- */
+- snd_soc_update_bits(codec, SGTL5000_CHIP_ANA_POWER,
+- SGTL5000_VDDC_CHRGPMP_POWERUP, 0);
+-
++ ana_pwr &= ~SGTL5000_VDDC_CHRGPMP_POWERUP;
+ /* VDDC use VDDIO rail */
+ lreg_ctrl |= SGTL5000_VDDC_ASSN_OVRD;
+ lreg_ctrl |= SGTL5000_VDDC_MAN_ASSN_VDDIO <<
+diff --git a/sound/soc/codecs/sn95031.c b/sound/soc/codecs/sn95031.c
+index cf8fa40662f0..01af05172452 100644
+--- a/sound/soc/codecs/sn95031.c
++++ b/sound/soc/codecs/sn95031.c
+@@ -531,8 +531,8 @@ static const struct snd_soc_dapm_route sn95031_audio_map[] = {
+ /* speaker map */
+ { "IHFOUTL", NULL, "Speaker Rail"},
+ { "IHFOUTR", NULL, "Speaker Rail"},
+- { "IHFOUTL", "NULL", "Speaker Left Playback"},
+- { "IHFOUTR", "NULL", "Speaker Right Playback"},
++ { "IHFOUTL", NULL, "Speaker Left Playback"},
++ { "IHFOUTR", NULL, "Speaker Right Playback"},
+ { "Speaker Left Playback", NULL, "Speaker Left Filter"},
+ { "Speaker Right Playback", NULL, "Speaker Right Filter"},
+ { "Speaker Left Filter", NULL, "IHFDAC Left"},
+diff --git a/sound/soc/codecs/tas5086.c b/sound/soc/codecs/tas5086.c
+index 249ef5c4c762..32942bed34b1 100644
+--- a/sound/soc/codecs/tas5086.c
++++ b/sound/soc/codecs/tas5086.c
+@@ -281,7 +281,7 @@ static int tas5086_get_deemph(struct snd_kcontrol *kcontrol,
+ struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
+ struct tas5086_private *priv = snd_soc_codec_get_drvdata(codec);
+
+- ucontrol->value.enumerated.item[0] = priv->deemph;
++ ucontrol->value.integer.value[0] = priv->deemph;
+
+ return 0;
+ }
+@@ -292,7 +292,7 @@ static int tas5086_put_deemph(struct snd_kcontrol *kcontrol,
+ struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
+ struct tas5086_private *priv = snd_soc_codec_get_drvdata(codec);
+
+- priv->deemph = ucontrol->value.enumerated.item[0];
++ priv->deemph = ucontrol->value.integer.value[0];
+
+ return tas5086_set_deemph(codec);
+ }
+diff --git a/sound/soc/codecs/wm2000.c b/sound/soc/codecs/wm2000.c
+index 34ef65c52a7d..8eeab47a4235 100644
+--- a/sound/soc/codecs/wm2000.c
++++ b/sound/soc/codecs/wm2000.c
+@@ -610,7 +610,7 @@ static int wm2000_anc_mode_get(struct snd_kcontrol *kcontrol,
+ struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
+ struct wm2000_priv *wm2000 = dev_get_drvdata(codec->dev);
+
+- ucontrol->value.enumerated.item[0] = wm2000->anc_active;
++ ucontrol->value.integer.value[0] = wm2000->anc_active;
+
+ return 0;
+ }
+@@ -620,7 +620,7 @@ static int wm2000_anc_mode_put(struct snd_kcontrol *kcontrol,
+ {
+ struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
+ struct wm2000_priv *wm2000 = dev_get_drvdata(codec->dev);
+- int anc_active = ucontrol->value.enumerated.item[0];
++ int anc_active = ucontrol->value.integer.value[0];
+ int ret;
+
+ if (anc_active > 1)
+@@ -643,7 +643,7 @@ static int wm2000_speaker_get(struct snd_kcontrol *kcontrol,
+ struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
+ struct wm2000_priv *wm2000 = dev_get_drvdata(codec->dev);
+
+- ucontrol->value.enumerated.item[0] = wm2000->spk_ena;
++ ucontrol->value.integer.value[0] = wm2000->spk_ena;
+
+ return 0;
+ }
+@@ -653,7 +653,7 @@ static int wm2000_speaker_put(struct snd_kcontrol *kcontrol,
+ {
+ struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
+ struct wm2000_priv *wm2000 = dev_get_drvdata(codec->dev);
+- int val = ucontrol->value.enumerated.item[0];
++ int val = ucontrol->value.integer.value[0];
+ int ret;
+
+ if (val > 1)
+diff --git a/sound/soc/codecs/wm8731.c b/sound/soc/codecs/wm8731.c
+index eebb3280bfad..19a53dca3433 100644
+--- a/sound/soc/codecs/wm8731.c
++++ b/sound/soc/codecs/wm8731.c
+@@ -122,7 +122,7 @@ static int wm8731_get_deemph(struct snd_kcontrol *kcontrol,
+ struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
+ struct wm8731_priv *wm8731 = snd_soc_codec_get_drvdata(codec);
+
+- ucontrol->value.enumerated.item[0] = wm8731->deemph;
++ ucontrol->value.integer.value[0] = wm8731->deemph;
+
+ return 0;
+ }
+@@ -132,7 +132,7 @@ static int wm8731_put_deemph(struct snd_kcontrol *kcontrol,
+ {
+ struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
+ struct wm8731_priv *wm8731 = snd_soc_codec_get_drvdata(codec);
+- int deemph = ucontrol->value.enumerated.item[0];
++ int deemph = ucontrol->value.integer.value[0];
+ int ret = 0;
+
+ if (deemph > 1)
+diff --git a/sound/soc/codecs/wm8903.c b/sound/soc/codecs/wm8903.c
+index c038b3e04398..5b758756dd80 100644
+--- a/sound/soc/codecs/wm8903.c
++++ b/sound/soc/codecs/wm8903.c
+@@ -441,7 +441,7 @@ static int wm8903_get_deemph(struct snd_kcontrol *kcontrol,
+ struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
+ struct wm8903_priv *wm8903 = snd_soc_codec_get_drvdata(codec);
+
+- ucontrol->value.enumerated.item[0] = wm8903->deemph;
++ ucontrol->value.integer.value[0] = wm8903->deemph;
+
+ return 0;
+ }
+@@ -451,7 +451,7 @@ static int wm8903_put_deemph(struct snd_kcontrol *kcontrol,
+ {
+ struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
+ struct wm8903_priv *wm8903 = snd_soc_codec_get_drvdata(codec);
+- int deemph = ucontrol->value.enumerated.item[0];
++ int deemph = ucontrol->value.integer.value[0];
+ int ret = 0;
+
+ if (deemph > 1)
+diff --git a/sound/soc/codecs/wm8904.c b/sound/soc/codecs/wm8904.c
+index 4d2d2b1380d5..af2446f16cdd 100644
+--- a/sound/soc/codecs/wm8904.c
++++ b/sound/soc/codecs/wm8904.c
+@@ -525,7 +525,7 @@ static int wm8904_get_deemph(struct snd_kcontrol *kcontrol,
+ struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
+ struct wm8904_priv *wm8904 = snd_soc_codec_get_drvdata(codec);
+
+- ucontrol->value.enumerated.item[0] = wm8904->deemph;
++ ucontrol->value.integer.value[0] = wm8904->deemph;
+ return 0;
+ }
+
+@@ -534,7 +534,7 @@ static int wm8904_put_deemph(struct snd_kcontrol *kcontrol,
+ {
+ struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
+ struct wm8904_priv *wm8904 = snd_soc_codec_get_drvdata(codec);
+- int deemph = ucontrol->value.enumerated.item[0];
++ int deemph = ucontrol->value.integer.value[0];
+
+ if (deemph > 1)
+ return -EINVAL;
+diff --git a/sound/soc/codecs/wm8955.c b/sound/soc/codecs/wm8955.c
+index 09d91d9dc4ee..7d0b01bcab4b 100644
+--- a/sound/soc/codecs/wm8955.c
++++ b/sound/soc/codecs/wm8955.c
+@@ -393,7 +393,7 @@ static int wm8955_get_deemph(struct snd_kcontrol *kcontrol,
+ struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
+ struct wm8955_priv *wm8955 = snd_soc_codec_get_drvdata(codec);
+
+- ucontrol->value.enumerated.item[0] = wm8955->deemph;
++ ucontrol->value.integer.value[0] = wm8955->deemph;
+ return 0;
+ }
+
+@@ -402,7 +402,7 @@ static int wm8955_put_deemph(struct snd_kcontrol *kcontrol,
+ {
+ struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
+ struct wm8955_priv *wm8955 = snd_soc_codec_get_drvdata(codec);
+- int deemph = ucontrol->value.enumerated.item[0];
++ int deemph = ucontrol->value.integer.value[0];
+
+ if (deemph > 1)
+ return -EINVAL;
+diff --git a/sound/soc/codecs/wm8960.c b/sound/soc/codecs/wm8960.c
+index 641f940c138d..ab9931c280b2 100644
+--- a/sound/soc/codecs/wm8960.c
++++ b/sound/soc/codecs/wm8960.c
+@@ -181,7 +181,7 @@ static int wm8960_get_deemph(struct snd_kcontrol *kcontrol,
+ struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
+ struct wm8960_priv *wm8960 = snd_soc_codec_get_drvdata(codec);
+
+- ucontrol->value.enumerated.item[0] = wm8960->deemph;
++ ucontrol->value.integer.value[0] = wm8960->deemph;
+ return 0;
+ }
+
+@@ -190,7 +190,7 @@ static int wm8960_put_deemph(struct snd_kcontrol *kcontrol,
+ {
+ struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
+ struct wm8960_priv *wm8960 = snd_soc_codec_get_drvdata(codec);
+- int deemph = ucontrol->value.enumerated.item[0];
++ int deemph = ucontrol->value.integer.value[0];
+
+ if (deemph > 1)
+ return -EINVAL;
^ permalink raw reply related [flat|nested] 67+ messages in thread
* [gentoo-commits] proj/linux-patches:3.18 commit in: /
@ 2015-04-29 17:31 Mike Pagano
0 siblings, 0 replies; 67+ messages in thread
From: Mike Pagano @ 2015-04-29 17:31 UTC (permalink / raw
To: gentoo-commits
commit: 222b4c13d2ac52934cc4a22b01e3ae84ab3ab930
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed Apr 29 17:19:35 2015 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed Apr 29 17:19:35 2015 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=222b4c13
Fix BFQ descriptions.
0000_README | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/0000_README b/0000_README
index 8dd852f..7f90a3b 100644
--- a/0000_README
+++ b/0000_README
@@ -129,15 +129,15 @@ Desc: Kernel patch enables gcc optimizations for additional CPUs.
Patch: 5001_block-cgroups-kconfig-build-bits-for-BFQ-v7r7-3.18.patch
From: http://algo.ing.unimo.it/people/paolo/disk_sched/
-Desc: BFQ v7r7 patch 1 for 3.17: Build, cgroups and kconfig bits
+Desc: BFQ v7r7 patch 1 for 3.18: Build, cgroups and kconfig bits
Patch: 5002_block-introduce-the-BFQ-v7r7-I-O-sched-for-3.18.patch1
From: http://algo.ing.unimo.it/people/paolo/disk_sched/
-Desc: BFQ v7r7 patch 2 for 3.17: BFQ Scheduler
+Desc: BFQ v7r7 patch 2 for 3.18: BFQ Scheduler
Patch: 5003_block-bfq-add-Early-Queue-Merge-EQM-to-BFQ-v7r7-for-3.18.0.patch
From: http://algo.ing.unimo.it/people/paolo/disk_sched/
-Desc: BFQ v7r7 patch 3 for 3.17: Early Queue Merge (EQM)
+Desc: BFQ v7r7 patch 3 for 3.18: Early Queue Merge (EQM)
Patch: 5010_enable-additional-cpu-optimizations-for-gcc-4.9.patch
From: https://github.com/graysky2/kernel_gcc_patch/
^ permalink raw reply related [flat|nested] 67+ messages in thread
* [gentoo-commits] proj/linux-patches:3.18 commit in: /
@ 2015-05-13 14:27 Mike Pagano
0 siblings, 0 replies; 67+ messages in thread
From: Mike Pagano @ 2015-05-13 14:27 UTC (permalink / raw
To: gentoo-commits
commit: c2a377c2b66a927676eac6ead8b52ca3386c7fef
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed May 13 14:26:57 2015 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed May 13 14:26:57 2015 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=c2a377c2
Linux patch 3.18.13
0000_README | 4 +
1012_linux-3.18.13.patch | 4939 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 4943 insertions(+)
diff --git a/0000_README b/0000_README
index 7f90a3b..edbb9f6 100644
--- a/0000_README
+++ b/0000_README
@@ -91,6 +91,10 @@ Patch: 1011_linux-3.18.12.patch
From: http://www.kernel.org
Desc: Linux 3.18.12
+Patch: 1012_linux-3.18.13.patch
+From: http://www.kernel.org
+Desc: Linux 3.18.13
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1012_linux-3.18.13.patch b/1012_linux-3.18.13.patch
new file mode 100644
index 0000000..b4aaeef
--- /dev/null
+++ b/1012_linux-3.18.13.patch
@@ -0,0 +1,4939 @@
+diff --git a/Makefile b/Makefile
+index d64f6bf7cd55..9cd08d55f557 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 18
+-SUBLEVEL = 12
++SUBLEVEL = 13
+ EXTRAVERSION =
+ NAME = Diseased Newt
+
+diff --git a/arch/arc/kernel/signal.c b/arch/arc/kernel/signal.c
+index cb3142a2d40b..a86d567f6c70 100644
+--- a/arch/arc/kernel/signal.c
++++ b/arch/arc/kernel/signal.c
+@@ -67,7 +67,7 @@ stash_usr_regs(struct rt_sigframe __user *sf, struct pt_regs *regs,
+ sigset_t *set)
+ {
+ int err;
+- err = __copy_to_user(&(sf->uc.uc_mcontext.regs), regs,
++ err = __copy_to_user(&(sf->uc.uc_mcontext.regs.scratch), regs,
+ sizeof(sf->uc.uc_mcontext.regs.scratch));
+ err |= __copy_to_user(&sf->uc.uc_sigmask, set, sizeof(sigset_t));
+
+@@ -83,7 +83,7 @@ static int restore_usr_regs(struct pt_regs *regs, struct rt_sigframe __user *sf)
+ if (!err)
+ set_current_blocked(&set);
+
+- err |= __copy_from_user(regs, &(sf->uc.uc_mcontext.regs),
++ err |= __copy_from_user(regs, &(sf->uc.uc_mcontext.regs.scratch),
+ sizeof(sf->uc.uc_mcontext.regs.scratch));
+
+ return err;
+@@ -131,6 +131,15 @@ SYSCALL_DEFINE0(rt_sigreturn)
+ /* Don't restart from sigreturn */
+ syscall_wont_restart(regs);
+
++ /*
++ * Ensure that sigreturn always returns to user mode (in case the
++ * regs saved on user stack got fudged between save and sigreturn)
++ * Otherwise it is easy to panic the kernel with a custom
++ * signal handler and/or restorer which clobberes the status32/ret
++ * to return to a bogus location in kernel mode.
++ */
++ regs->status32 |= STATUS_U_MASK;
++
+ return regs->r0;
+
+ badframe:
+@@ -229,8 +238,11 @@ setup_rt_frame(struct ksignal *ksig, sigset_t *set, struct pt_regs *regs)
+
+ /*
+ * handler returns using sigreturn stub provided already by userpsace
++ * If not, nuke the process right away
+ */
+- BUG_ON(!(ksig->ka.sa.sa_flags & SA_RESTORER));
++ if(!(ksig->ka.sa.sa_flags & SA_RESTORER))
++ return 1;
++
+ regs->blink = (unsigned long)ksig->ka.sa.sa_restorer;
+
+ /* User Stack for signal handler will be above the frame just carved */
+@@ -296,12 +308,12 @@ static void
+ handle_signal(struct ksignal *ksig, struct pt_regs *regs)
+ {
+ sigset_t *oldset = sigmask_to_save();
+- int ret;
++ int failed;
+
+ /* Set up the stack frame */
+- ret = setup_rt_frame(ksig, oldset, regs);
++ failed = setup_rt_frame(ksig, oldset, regs);
+
+- signal_setup_done(ret, ksig, 0);
++ signal_setup_done(failed, ksig, 0);
+ }
+
+ void do_signal(struct pt_regs *regs)
+diff --git a/arch/arm/mach-sunxi/Kconfig b/arch/arm/mach-sunxi/Kconfig
+index 1aaa1e15ef70..d5fd511c1474 100644
+--- a/arch/arm/mach-sunxi/Kconfig
++++ b/arch/arm/mach-sunxi/Kconfig
+@@ -1,10 +1,12 @@
+ menuconfig ARCH_SUNXI
+ bool "Allwinner SoCs" if ARCH_MULTI_V7
+ select ARCH_REQUIRE_GPIOLIB
++ select ARCH_HAS_RESET_CONTROLLER
+ select CLKSRC_MMIO
+ select GENERIC_IRQ_CHIP
+ select PINCTRL
+ select SUN4I_TIMER
++ select RESET_CONTROLLER
+
+ if ARCH_SUNXI
+
+@@ -20,10 +22,8 @@ config MACH_SUN5I
+ config MACH_SUN6I
+ bool "Allwinner A31 (sun6i) SoCs support"
+ default ARCH_SUNXI
+- select ARCH_HAS_RESET_CONTROLLER
+ select ARM_GIC
+ select MFD_SUN6I_PRCM
+- select RESET_CONTROLLER
+ select SUN5I_HSTIMER
+
+ config MACH_SUN7I
+@@ -37,9 +37,7 @@ config MACH_SUN7I
+ config MACH_SUN8I
+ bool "Allwinner A23 (sun8i) SoCs support"
+ default ARCH_SUNXI
+- select ARCH_HAS_RESET_CONTROLLER
+ select ARM_GIC
+ select MFD_SUN6I_PRCM
+- select RESET_CONTROLLER
+
+ endif
+diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
+index 9532f8d5857e..dc2d66cdf311 100644
+--- a/arch/arm64/Kconfig
++++ b/arch/arm64/Kconfig
+@@ -193,6 +193,135 @@ endmenu
+
+ menu "Kernel Features"
+
++menu "ARM errata workarounds via the alternatives framework"
++
++config ARM64_ERRATUM_826319
++ bool "Cortex-A53: 826319: System might deadlock if a write cannot complete until read data is accepted"
++ default y
++ help
++ This option adds an alternative code sequence to work around ARM
++ erratum 826319 on Cortex-A53 parts up to r0p2 with an AMBA 4 ACE or
++ AXI master interface and an L2 cache.
++
++ If a Cortex-A53 uses an AMBA AXI4 ACE interface to other processors
++ and is unable to accept a certain write via this interface, it will
++ not progress on read data presented on the read data channel and the
++ system can deadlock.
++
++ The workaround promotes data cache clean instructions to
++ data cache clean-and-invalidate.
++ Please note that this does not necessarily enable the workaround,
++ as it depends on the alternative framework, which will only patch
++ the kernel if an affected CPU is detected.
++
++ If unsure, say Y.
++
++config ARM64_ERRATUM_827319
++ bool "Cortex-A53: 827319: Data cache clean instructions might cause overlapping transactions to the interconnect"
++ default y
++ help
++ This option adds an alternative code sequence to work around ARM
++ erratum 827319 on Cortex-A53 parts up to r0p2 with an AMBA 5 CHI
++ master interface and an L2 cache.
++
++ Under certain conditions this erratum can cause a clean line eviction
++ to occur at the same time as another transaction to the same address
++ on the AMBA 5 CHI interface, which can cause data corruption if the
++ interconnect reorders the two transactions.
++
++ The workaround promotes data cache clean instructions to
++ data cache clean-and-invalidate.
++ Please note that this does not necessarily enable the workaround,
++ as it depends on the alternative framework, which will only patch
++ the kernel if an affected CPU is detected.
++
++ If unsure, say Y.
++
++config ARM64_ERRATUM_824069
++ bool "Cortex-A53: 824069: Cache line might not be marked as clean after a CleanShared snoop"
++ default y
++ help
++ This option adds an alternative code sequence to work around ARM
++ erratum 824069 on Cortex-A53 parts up to r0p2 when it is connected
++ to a coherent interconnect.
++
++ If a Cortex-A53 processor is executing a store or prefetch for
++ write instruction at the same time as a processor in another
++ cluster is executing a cache maintenance operation to the same
++ address, then this erratum might cause a clean cache line to be
++ incorrectly marked as dirty.
++
++ The workaround promotes data cache clean instructions to
++ data cache clean-and-invalidate.
++ Please note that this option does not necessarily enable the
++ workaround, as it depends on the alternative framework, which will
++ only patch the kernel if an affected CPU is detected.
++
++ If unsure, say Y.
++
++config ARM64_ERRATUM_819472
++ bool "Cortex-A53: 819472: Store exclusive instructions might cause data corruption"
++ default y
++ help
++ This option adds an alternative code sequence to work around ARM
++ erratum 819472 on Cortex-A53 parts up to r0p1 with an L2 cache
++ present when it is connected to a coherent interconnect.
++
++ If the processor is executing a load and store exclusive sequence at
++ the same time as a processor in another cluster is executing a cache
++ maintenance operation to the same address, then this erratum might
++ cause data corruption.
++
++ The workaround promotes data cache clean instructions to
++ data cache clean-and-invalidate.
++ Please note that this does not necessarily enable the workaround,
++ as it depends on the alternative framework, which will only patch
++ the kernel if an affected CPU is detected.
++
++ If unsure, say Y.
++
++config ARM64_ERRATUM_832075
++ bool "Cortex-A57: 832075: possible deadlock on mixing exclusive memory accesses with device loads"
++ default y
++ help
++ This option adds an alternative code sequence to work around ARM
++ erratum 832075 on Cortex-A57 parts up to r1p2.
++
++ Affected Cortex-A57 parts might deadlock when exclusive load/store
++ instructions to Write-Back memory are mixed with Device loads.
++
++ The workaround is to promote device loads to use Load-Acquire
++ semantics.
++ Please note that this does not necessarily enable the workaround,
++ as it depends on the alternative framework, which will only patch
++ the kernel if an affected CPU is detected.
++
++ If unsure, say Y.
++
++config ARM64_ERRATUM_845719
++ bool "Cortex-A53: 845719: a load might read incorrect data"
++ depends on COMPAT
++ default y
++ help
++ This option adds an alternative code sequence to work around ARM
++ erratum 845719 on Cortex-A53 parts up to r0p4.
++
++ When running a compat (AArch32) userspace on an affected Cortex-A53
++ part, a load at EL0 from a virtual address that matches the bottom 32
++ bits of the virtual address used by a recent load at (AArch64) EL1
++ might return incorrect data.
++
++ The workaround is to write the contextidr_el1 register on exception
++ return to a 32-bit task.
++ Please note that this does not necessarily enable the workaround,
++ as it depends on the alternative framework, which will only patch
++ the kernel if an affected CPU is detected.
++
++ If unsure, say Y.
++
++endmenu
++
++
+ choice
+ prompt "Page size"
+ default ARM64_4K_PAGES
+diff --git a/arch/arm64/include/asm/alternative-asm.h b/arch/arm64/include/asm/alternative-asm.h
+new file mode 100644
+index 000000000000..919a67855b63
+--- /dev/null
++++ b/arch/arm64/include/asm/alternative-asm.h
+@@ -0,0 +1,29 @@
++#ifndef __ASM_ALTERNATIVE_ASM_H
++#define __ASM_ALTERNATIVE_ASM_H
++
++#ifdef __ASSEMBLY__
++
++.macro altinstruction_entry orig_offset alt_offset feature orig_len alt_len
++ .word \orig_offset - .
++ .word \alt_offset - .
++ .hword \feature
++ .byte \orig_len
++ .byte \alt_len
++.endm
++
++.macro alternative_insn insn1 insn2 cap
++661: \insn1
++662: .pushsection .altinstructions, "a"
++ altinstruction_entry 661b, 663f, \cap, 662b-661b, 664f-663f
++ .popsection
++ .pushsection .altinstr_replacement, "ax"
++663: \insn2
++664: .popsection
++ .if ((664b-663b) != (662b-661b))
++ .error "Alternatives instruction length mismatch"
++ .endif
++.endm
++
++#endif /* __ASSEMBLY__ */
++
++#endif /* __ASM_ALTERNATIVE_ASM_H */
+diff --git a/arch/arm64/include/asm/alternative.h b/arch/arm64/include/asm/alternative.h
+new file mode 100644
+index 000000000000..f6d206e7f9e9
+--- /dev/null
++++ b/arch/arm64/include/asm/alternative.h
+@@ -0,0 +1,43 @@
++#ifndef __ASM_ALTERNATIVE_H
++#define __ASM_ALTERNATIVE_H
++
++#include <linux/types.h>
++#include <linux/stddef.h>
++#include <linux/stringify.h>
++
++struct alt_instr {
++ s32 orig_offset; /* offset to original instruction */
++ s32 alt_offset; /* offset to replacement instruction */
++ u16 cpufeature; /* cpufeature bit set for replacement */
++ u8 orig_len; /* size of original instruction(s) */
++ u8 alt_len; /* size of new instruction(s), <= orig_len */
++};
++
++void apply_alternatives(void);
++void free_alternatives_memory(void);
++
++#define ALTINSTR_ENTRY(feature) \
++ " .word 661b - .\n" /* label */ \
++ " .word 663f - .\n" /* new instruction */ \
++ " .hword " __stringify(feature) "\n" /* feature bit */ \
++ " .byte 662b-661b\n" /* source len */ \
++ " .byte 664f-663f\n" /* replacement len */
++
++/* alternative assembly primitive: */
++#define ALTERNATIVE(oldinstr, newinstr, feature) \
++ "661:\n\t" \
++ oldinstr "\n" \
++ "662:\n" \
++ ".pushsection .altinstructions,\"a\"\n" \
++ ALTINSTR_ENTRY(feature) \
++ ".popsection\n" \
++ ".pushsection .altinstr_replacement, \"a\"\n" \
++ "663:\n\t" \
++ newinstr "\n" \
++ "664:\n\t" \
++ ".popsection\n\t" \
++ ".if ((664b-663b) != (662b-661b))\n\t" \
++ " .error \"Alternatives instruction length mismatch\"\n\t"\
++ ".endif\n"
++
++#endif /* __ASM_ALTERNATIVE_H */
+diff --git a/arch/arm64/include/asm/cpufeature.h b/arch/arm64/include/asm/cpufeature.h
+index cd4ac0516488..c008bae718eb 100644
+--- a/arch/arm64/include/asm/cpufeature.h
++++ b/arch/arm64/include/asm/cpufeature.h
+@@ -21,9 +21,39 @@
+ #define MAX_CPU_FEATURES (8 * sizeof(elf_hwcap))
+ #define cpu_feature(x) ilog2(HWCAP_ ## x)
+
++#define ARM64_WORKAROUND_CLEAN_CACHE 0
++#define ARM64_WORKAROUND_DEVICE_LOAD_ACQUIRE 1
++#define ARM64_WORKAROUND_845719 2
++
++#define NCAPS 3
++
++#ifndef __ASSEMBLY__
++
++extern DECLARE_BITMAP(cpu_hwcaps, NCAPS);
++
+ static inline bool cpu_have_feature(unsigned int num)
+ {
+ return elf_hwcap & (1UL << num);
+ }
+
++static inline bool cpus_have_cap(unsigned int num)
++{
++ if (num >= NCAPS)
++ return false;
++ return test_bit(num, cpu_hwcaps);
++}
++
++static inline void cpus_set_cap(unsigned int num)
++{
++ if (num >= NCAPS)
++ pr_warn("Attempt to set an illegal CPU capability (%d >= %d)\n",
++ num, NCAPS);
++ else
++ __set_bit(num, cpu_hwcaps);
++}
++
++void check_local_cpu_errata(void);
++
++#endif /* __ASSEMBLY__ */
++
+ #endif
+diff --git a/arch/arm64/include/asm/cputype.h b/arch/arm64/include/asm/cputype.h
+index 379d0b874328..8adb986a3086 100644
+--- a/arch/arm64/include/asm/cputype.h
++++ b/arch/arm64/include/asm/cputype.h
+@@ -57,6 +57,11 @@
+ #define MIDR_IMPLEMENTOR(midr) \
+ (((midr) & MIDR_IMPLEMENTOR_MASK) >> MIDR_IMPLEMENTOR_SHIFT)
+
++#define MIDR_CPU_PART(imp, partnum) \
++ (((imp) << MIDR_IMPLEMENTOR_SHIFT) | \
++ (0xf << MIDR_ARCHITECTURE_SHIFT) | \
++ ((partnum) << MIDR_PARTNUM_SHIFT))
++
+ #define ARM_CPU_IMP_ARM 0x41
+ #define ARM_CPU_IMP_APM 0x50
+
+diff --git a/arch/arm64/include/asm/io.h b/arch/arm64/include/asm/io.h
+index 79f1d519221f..75825b63464d 100644
+--- a/arch/arm64/include/asm/io.h
++++ b/arch/arm64/include/asm/io.h
+@@ -28,6 +28,8 @@
+ #include <asm/barrier.h>
+ #include <asm/pgtable.h>
+ #include <asm/early_ioremap.h>
++#include <asm/alternative.h>
++#include <asm/cpufeature.h>
+
+ #include <xen/xen.h>
+
+@@ -57,28 +59,41 @@ static inline void __raw_writeq(u64 val, volatile void __iomem *addr)
+ static inline u8 __raw_readb(const volatile void __iomem *addr)
+ {
+ u8 val;
+- asm volatile("ldrb %w0, [%1]" : "=r" (val) : "r" (addr));
++ asm volatile(ALTERNATIVE("ldrb %w0, [%1]",
++ "ldarb %w0, [%1]",
++ ARM64_WORKAROUND_DEVICE_LOAD_ACQUIRE)
++ : "=r" (val) : "r" (addr));
+ return val;
+ }
+
+ static inline u16 __raw_readw(const volatile void __iomem *addr)
+ {
+ u16 val;
+- asm volatile("ldrh %w0, [%1]" : "=r" (val) : "r" (addr));
++
++ asm volatile(ALTERNATIVE("ldrh %w0, [%1]",
++ "ldarh %w0, [%1]",
++ ARM64_WORKAROUND_DEVICE_LOAD_ACQUIRE)
++ : "=r" (val) : "r" (addr));
+ return val;
+ }
+
+ static inline u32 __raw_readl(const volatile void __iomem *addr)
+ {
+ u32 val;
+- asm volatile("ldr %w0, [%1]" : "=r" (val) : "r" (addr));
++ asm volatile(ALTERNATIVE("ldr %w0, [%1]",
++ "ldar %w0, [%1]",
++ ARM64_WORKAROUND_DEVICE_LOAD_ACQUIRE)
++ : "=r" (val) : "r" (addr));
+ return val;
+ }
+
+ static inline u64 __raw_readq(const volatile void __iomem *addr)
+ {
+ u64 val;
+- asm volatile("ldr %0, [%1]" : "=r" (val) : "r" (addr));
++ asm volatile(ALTERNATIVE("ldr %0, [%1]",
++ "ldar %0, [%1]",
++ ARM64_WORKAROUND_DEVICE_LOAD_ACQUIRE)
++ : "=r" (val) : "r" (addr));
+ return val;
+ }
+
+diff --git a/arch/arm64/kernel/Makefile b/arch/arm64/kernel/Makefile
+index 5bd029b43644..da2272811a31 100644
+--- a/arch/arm64/kernel/Makefile
++++ b/arch/arm64/kernel/Makefile
+@@ -15,7 +15,7 @@ arm64-obj-y := cputable.o debug-monitors.o entry.o irq.o fpsimd.o \
+ entry-fpsimd.o process.o ptrace.o setup.o signal.o \
+ sys.o stacktrace.o time.o traps.o io.o vdso.o \
+ hyp-stub.o psci.o cpu_ops.o insn.o return_address.o \
+- cpuinfo.o
++ cpuinfo.o cpu_errata.o alternative.o
+
+ arm64-obj-$(CONFIG_COMPAT) += sys32.o kuser32.o signal32.o \
+ sys_compat.o
+diff --git a/arch/arm64/kernel/alternative.c b/arch/arm64/kernel/alternative.c
+new file mode 100644
+index 000000000000..1a3badab800a
+--- /dev/null
++++ b/arch/arm64/kernel/alternative.c
+@@ -0,0 +1,64 @@
++/*
++ * alternative runtime patching
++ * inspired by the x86 version
++ *
++ * Copyright (C) 2014 ARM Ltd.
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 as
++ * published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
++ * GNU General Public License for more details.
++ *
++ * You should have received a copy of the GNU General Public License
++ * along with this program. If not, see <http://www.gnu.org/licenses/>.
++ */
++
++#define pr_fmt(fmt) "alternatives: " fmt
++
++#include <linux/init.h>
++#include <linux/cpu.h>
++#include <asm/cacheflush.h>
++#include <asm/alternative.h>
++#include <asm/cpufeature.h>
++#include <linux/stop_machine.h>
++
++extern struct alt_instr __alt_instructions[], __alt_instructions_end[];
++
++static int __apply_alternatives(void *dummy)
++{
++ struct alt_instr *alt;
++ u8 *origptr, *replptr;
++
++ for (alt = __alt_instructions; alt < __alt_instructions_end; alt++) {
++ if (!cpus_have_cap(alt->cpufeature))
++ continue;
++
++ BUG_ON(alt->alt_len > alt->orig_len);
++
++ pr_info_once("patching kernel code\n");
++
++ origptr = (u8 *)&alt->orig_offset + alt->orig_offset;
++ replptr = (u8 *)&alt->alt_offset + alt->alt_offset;
++ memcpy(origptr, replptr, alt->alt_len);
++ flush_icache_range((uintptr_t)origptr,
++ (uintptr_t)(origptr + alt->alt_len));
++ }
++
++ return 0;
++}
++
++void apply_alternatives(void)
++{
++ /* better not try code patching on a live SMP system */
++ stop_machine(__apply_alternatives, NULL, NULL);
++}
++
++void free_alternatives_memory(void)
++{
++ free_reserved_area(__alt_instructions, __alt_instructions_end,
++ 0, "alternatives");
++}
+diff --git a/arch/arm64/kernel/cpu_errata.c b/arch/arm64/kernel/cpu_errata.c
+new file mode 100644
+index 000000000000..bbc710aafb37
+--- /dev/null
++++ b/arch/arm64/kernel/cpu_errata.c
+@@ -0,0 +1,120 @@
++/*
++ * Contains CPU specific errata definitions
++ *
++ * Copyright (C) 2014 ARM Ltd.
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 as
++ * published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
++ * GNU General Public License for more details.
++ *
++ * You should have received a copy of the GNU General Public License
++ * along with this program. If not, see <http://www.gnu.org/licenses/>.
++ */
++
++#define pr_fmt(fmt) "alternative: " fmt
++
++#include <linux/types.h>
++#include <asm/cpu.h>
++#include <asm/cputype.h>
++#include <asm/cpufeature.h>
++
++#define MIDR_CORTEX_A53 MIDR_CPU_PART(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A53)
++#define MIDR_CORTEX_A57 MIDR_CPU_PART(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A57)
++
++/*
++ * Add a struct or another datatype to the union below if you need
++ * different means to detect an affected CPU.
++ */
++struct arm64_cpu_capabilities {
++ const char *desc;
++ u16 capability;
++ bool (*is_affected)(struct arm64_cpu_capabilities *);
++ union {
++ struct {
++ u32 midr_model;
++ u32 midr_range_min, midr_range_max;
++ };
++ };
++};
++
++#define CPU_MODEL_MASK (MIDR_IMPLEMENTOR_MASK | MIDR_PARTNUM_MASK | \
++ MIDR_ARCHITECTURE_MASK)
++
++static bool __maybe_unused
++is_affected_midr_range(struct arm64_cpu_capabilities *entry)
++{
++ u32 midr = read_cpuid_id();
++
++ if ((midr & CPU_MODEL_MASK) != entry->midr_model)
++ return false;
++
++ midr &= MIDR_REVISION_MASK | MIDR_VARIANT_MASK;
++
++ return (midr >= entry->midr_range_min && midr <= entry->midr_range_max);
++}
++
++#define MIDR_RANGE(model, min, max) \
++ .is_affected = is_affected_midr_range, \
++ .midr_model = model, \
++ .midr_range_min = min, \
++ .midr_range_max = max
++
++struct arm64_cpu_capabilities arm64_errata[] = {
++#if defined(CONFIG_ARM64_ERRATUM_826319) || \
++ defined(CONFIG_ARM64_ERRATUM_827319) || \
++ defined(CONFIG_ARM64_ERRATUM_824069)
++ {
++ /* Cortex-A53 r0p[012] */
++ .desc = "ARM errata 826319, 827319, 824069",
++ .capability = ARM64_WORKAROUND_CLEAN_CACHE,
++ MIDR_RANGE(MIDR_CORTEX_A53, 0x00, 0x02),
++ },
++#endif
++#ifdef CONFIG_ARM64_ERRATUM_819472
++ {
++ /* Cortex-A53 r0p[01] */
++ .desc = "ARM errata 819472",
++ .capability = ARM64_WORKAROUND_CLEAN_CACHE,
++ MIDR_RANGE(MIDR_CORTEX_A53, 0x00, 0x01),
++ },
++#endif
++#ifdef CONFIG_ARM64_ERRATUM_832075
++ {
++ /* Cortex-A57 r0p0 - r1p2 */
++ .desc = "ARM erratum 832075",
++ .capability = ARM64_WORKAROUND_DEVICE_LOAD_ACQUIRE,
++ MIDR_RANGE(MIDR_CORTEX_A57, 0x00,
++ (1 << MIDR_VARIANT_SHIFT) | 2),
++ },
++#endif
++#ifdef CONFIG_ARM64_ERRATUM_845719
++ {
++ /* Cortex-A53 r0p[01234] */
++ .desc = "ARM erratum 845719",
++ .capability = ARM64_WORKAROUND_845719,
++ MIDR_RANGE(MIDR_CORTEX_A53, 0x00, 0x04),
++ },
++#endif
++ {
++ }
++};
++
++void check_local_cpu_errata(void)
++{
++ struct arm64_cpu_capabilities *cpus = arm64_errata;
++ int i;
++
++ for (i = 0; cpus[i].desc; i++) {
++ if (!cpus[i].is_affected(&cpus[i]))
++ continue;
++
++ if (!cpus_have_cap(cpus[i].capability))
++ pr_info("enabling workaround for %s\n", cpus[i].desc);
++ cpus_set_cap(cpus[i].capability);
++ }
++}
+diff --git a/arch/arm64/kernel/cpuinfo.c b/arch/arm64/kernel/cpuinfo.c
+index 504fdaa8367e..16d6d032ecf1 100644
+--- a/arch/arm64/kernel/cpuinfo.c
++++ b/arch/arm64/kernel/cpuinfo.c
+@@ -18,6 +18,7 @@
+ #include <asm/cachetype.h>
+ #include <asm/cpu.h>
+ #include <asm/cputype.h>
++#include <asm/cpufeature.h>
+
+ #include <linux/bitops.h>
+ #include <linux/bug.h>
+@@ -186,6 +187,8 @@ static void __cpuinfo_store_cpu(struct cpuinfo_arm64 *info)
+ info->reg_id_pfr1 = read_cpuid(ID_PFR1_EL1);
+
+ cpuinfo_detect_icache_policy(info);
++
++ check_local_cpu_errata();
+ }
+
+ void cpuinfo_store_cpu(void)
+diff --git a/arch/arm64/kernel/entry.S b/arch/arm64/kernel/entry.S
+index 726b910fe6ec..2b0f3d5e11c7 100644
+--- a/arch/arm64/kernel/entry.S
++++ b/arch/arm64/kernel/entry.S
+@@ -21,8 +21,10 @@
+ #include <linux/init.h>
+ #include <linux/linkage.h>
+
++#include <asm/alternative-asm.h>
+ #include <asm/assembler.h>
+ #include <asm/asm-offsets.h>
++#include <asm/cpufeature.h>
+ #include <asm/errno.h>
+ #include <asm/esr.h>
+ #include <asm/thread_info.h>
+@@ -118,6 +120,24 @@
+ .if \el == 0
+ ct_user_enter
+ ldr x23, [sp, #S_SP] // load return stack pointer
++
++#ifdef CONFIG_ARM64_ERRATUM_845719
++ alternative_insn \
++ "nop", \
++ "tbz x22, #4, 1f", \
++ ARM64_WORKAROUND_845719
++#ifdef CONFIG_PID_IN_CONTEXTIDR
++ alternative_insn \
++ "nop; nop", \
++ "mrs x29, contextidr_el1; msr contextidr_el1, x29; 1:", \
++ ARM64_WORKAROUND_845719
++#else
++ alternative_insn \
++ "nop", \
++ "msr contextidr_el1, xzr; 1:", \
++ ARM64_WORKAROUND_845719
++#endif
++#endif
+ .endif
+ .if \ret
+ ldr x1, [sp, #S_X1] // preserve x0 (syscall return)
+diff --git a/arch/arm64/kernel/setup.c b/arch/arm64/kernel/setup.c
+index 38eead12f35b..d502a86bed9f 100644
+--- a/arch/arm64/kernel/setup.c
++++ b/arch/arm64/kernel/setup.c
+@@ -50,6 +50,7 @@
+ #include <asm/cputype.h>
+ #include <asm/elf.h>
+ #include <asm/cputable.h>
++#include <asm/cpufeature.h>
+ #include <asm/cpu_ops.h>
+ #include <asm/sections.h>
+ #include <asm/setup.h>
+@@ -79,6 +80,8 @@ unsigned int compat_elf_hwcap __read_mostly = COMPAT_ELF_HWCAP_DEFAULT;
+ unsigned int compat_elf_hwcap2 __read_mostly;
+ #endif
+
++DECLARE_BITMAP(cpu_hwcaps, NCAPS);
++
+ static const char *cpu_name;
+ phys_addr_t __fdt_pointer __initdata;
+
+diff --git a/arch/arm64/kernel/smp.c b/arch/arm64/kernel/smp.c
+index b06d1d90ee8c..0ef87896e4ae 100644
+--- a/arch/arm64/kernel/smp.c
++++ b/arch/arm64/kernel/smp.c
+@@ -37,6 +37,7 @@
+ #include <linux/of.h>
+ #include <linux/irq_work.h>
+
++#include <asm/alternative.h>
+ #include <asm/atomic.h>
+ #include <asm/cacheflush.h>
+ #include <asm/cpu.h>
+@@ -309,6 +310,7 @@ void cpu_die(void)
+ void __init smp_cpus_done(unsigned int max_cpus)
+ {
+ pr_info("SMP: Total of %d processors activated.\n", num_online_cpus());
++ apply_alternatives();
+ }
+
+ void __init smp_prepare_boot_cpu(void)
+diff --git a/arch/arm64/kernel/vmlinux.lds.S b/arch/arm64/kernel/vmlinux.lds.S
+index edf8715ba39b..2f600294e8ca 100644
+--- a/arch/arm64/kernel/vmlinux.lds.S
++++ b/arch/arm64/kernel/vmlinux.lds.S
+@@ -100,6 +100,17 @@ SECTIONS
+ . = ALIGN(PAGE_SIZE);
+ __init_end = .;
+
++ . = ALIGN(4);
++ .altinstructions : {
++ __alt_instructions = .;
++ *(.altinstructions)
++ __alt_instructions_end = .;
++ }
++ .altinstr_replacement : {
++ *(.altinstr_replacement)
++ }
++
++ . = ALIGN(PAGE_SIZE);
+ _data = .;
+ _sdata = .;
+ RW_DATA_SECTION(64, PAGE_SIZE, THREAD_SIZE)
+diff --git a/arch/arm64/mm/cache.S b/arch/arm64/mm/cache.S
+index 23663837acff..8eaf18577d71 100644
+--- a/arch/arm64/mm/cache.S
++++ b/arch/arm64/mm/cache.S
+@@ -20,6 +20,8 @@
+ #include <linux/linkage.h>
+ #include <linux/init.h>
+ #include <asm/assembler.h>
++#include <asm/cpufeature.h>
++#include <asm/alternative-asm.h>
+
+ #include "proc-macros.S"
+
+@@ -210,7 +212,7 @@ __dma_clean_range:
+ dcache_line_size x2, x3
+ sub x3, x2, #1
+ bic x0, x0, x3
+-1: dc cvac, x0 // clean D / U line
++1: alternative_insn "dc cvac, x0", "dc civac, x0", ARM64_WORKAROUND_CLEAN_CACHE
+ add x0, x0, x2
+ cmp x0, x1
+ b.lo 1b
+diff --git a/arch/arm64/mm/init.c b/arch/arm64/mm/init.c
+index fff81f02251c..c95464a33f36 100644
+--- a/arch/arm64/mm/init.c
++++ b/arch/arm64/mm/init.c
+@@ -39,6 +39,7 @@
+ #include <asm/setup.h>
+ #include <asm/sizes.h>
+ #include <asm/tlb.h>
++#include <asm/alternative.h>
+
+ #include "mm.h"
+
+@@ -325,6 +326,7 @@ void __init mem_init(void)
+ void free_initmem(void)
+ {
+ free_initmem_default(0);
++ free_alternatives_memory();
+ }
+
+ #ifdef CONFIG_BLK_DEV_INITRD
+diff --git a/arch/powerpc/include/asm/cputhreads.h b/arch/powerpc/include/asm/cputhreads.h
+index 2bf8e9307be9..4c8ad592ae33 100644
+--- a/arch/powerpc/include/asm/cputhreads.h
++++ b/arch/powerpc/include/asm/cputhreads.h
+@@ -55,7 +55,7 @@ static inline cpumask_t cpu_thread_mask_to_cores(const struct cpumask *threads)
+
+ static inline int cpu_nr_cores(void)
+ {
+- return NR_CPUS >> threads_shift;
++ return nr_cpu_ids >> threads_shift;
+ }
+
+ static inline cpumask_t cpu_online_cores_map(void)
+diff --git a/arch/powerpc/include/asm/irq_work.h b/arch/powerpc/include/asm/irq_work.h
+new file mode 100644
+index 000000000000..744fd54de374
+--- /dev/null
++++ b/arch/powerpc/include/asm/irq_work.h
+@@ -0,0 +1,9 @@
++#ifndef _ASM_POWERPC_IRQ_WORK_H
++#define _ASM_POWERPC_IRQ_WORK_H
++
++static inline bool arch_irq_work_has_interrupt(void)
++{
++ return true;
++}
++
++#endif /* _ASM_POWERPC_IRQ_WORK_H */
+diff --git a/arch/x86/kernel/reboot.c b/arch/x86/kernel/reboot.c
+index 17962e667a91..587be13be0be 100644
+--- a/arch/x86/kernel/reboot.c
++++ b/arch/x86/kernel/reboot.c
+@@ -182,6 +182,16 @@ static struct dmi_system_id __initdata reboot_dmi_table[] = {
+ },
+ },
+
++ /* ASRock */
++ { /* Handle problems with rebooting on ASRock Q1900DC-ITX */
++ .callback = set_pci_reboot,
++ .ident = "ASRock Q1900DC-ITX",
++ .matches = {
++ DMI_MATCH(DMI_BOARD_VENDOR, "ASRock"),
++ DMI_MATCH(DMI_BOARD_NAME, "Q1900DC-ITX"),
++ },
++ },
++
+ /* ASUS */
+ { /* Handle problems with rebooting on ASUS P4S800 */
+ .callback = set_bios_reboot,
+diff --git a/block/blk-merge.c b/block/blk-merge.c
+index 89b97b5e0881..2be75ff7f171 100644
+--- a/block/blk-merge.c
++++ b/block/blk-merge.c
+@@ -609,7 +609,7 @@ bool blk_rq_merge_ok(struct request *rq, struct bio *bio)
+ if (q->queue_flags & (1 << QUEUE_FLAG_SG_GAPS)) {
+ struct bio_vec *bprev;
+
+- bprev = &rq->biotail->bi_io_vec[bio->bi_vcnt - 1];
++ bprev = &rq->biotail->bi_io_vec[rq->biotail->bi_vcnt - 1];
+ if (bvec_gap_to_prev(bprev, bio->bi_io_vec[0].bv_offset))
+ return false;
+ }
+diff --git a/block/blk-mq.c b/block/blk-mq.c
+index 1d016fc9a8b6..849479debac3 100644
+--- a/block/blk-mq.c
++++ b/block/blk-mq.c
+@@ -1831,7 +1831,7 @@ struct request_queue *blk_mq_init_queue(struct blk_mq_tag_set *set)
+ */
+ if (percpu_ref_init(&q->mq_usage_counter, blk_mq_usage_counter_release,
+ PERCPU_REF_INIT_ATOMIC, GFP_KERNEL))
+- goto err_map;
++ goto err_mq_usage;
+
+ setup_timer(&q->timeout, blk_mq_rq_timer, (unsigned long) q);
+ blk_queue_rq_timeout(q, 30000);
+@@ -1874,7 +1874,7 @@ struct request_queue *blk_mq_init_queue(struct blk_mq_tag_set *set)
+ blk_mq_init_cpu_queues(q, set->nr_hw_queues);
+
+ if (blk_mq_init_hw_queues(q, set))
+- goto err_hw;
++ goto err_mq_usage;
+
+ mutex_lock(&all_q_mutex);
+ list_add_tail(&q->all_q_node, &all_q_list);
+@@ -1886,7 +1886,7 @@ struct request_queue *blk_mq_init_queue(struct blk_mq_tag_set *set)
+
+ return q;
+
+-err_hw:
++err_mq_usage:
+ blk_cleanup_queue(q);
+ err_hctxs:
+ kfree(map);
+diff --git a/drivers/acpi/processor_idle.c b/drivers/acpi/processor_idle.c
+index 17f9ec501972..fd8496a92b45 100644
+--- a/drivers/acpi/processor_idle.c
++++ b/drivers/acpi/processor_idle.c
+@@ -962,7 +962,7 @@ static int acpi_processor_setup_cpuidle_states(struct acpi_processor *pr)
+ return -EINVAL;
+
+ drv->safe_state_index = -1;
+- for (i = 0; i < CPUIDLE_STATE_MAX; i++) {
++ for (i = CPUIDLE_DRIVER_STATE_START; i < CPUIDLE_STATE_MAX; i++) {
+ drv->states[i].name[0] = '\0';
+ drv->states[i].desc[0] = '\0';
+ }
+diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
+index 4bc2a5cb9935..a98c41f72c63 100644
+--- a/drivers/block/nbd.c
++++ b/drivers/block/nbd.c
+@@ -803,10 +803,6 @@ static int __init nbd_init(void)
+ return -EINVAL;
+ }
+
+- nbd_dev = kcalloc(nbds_max, sizeof(*nbd_dev), GFP_KERNEL);
+- if (!nbd_dev)
+- return -ENOMEM;
+-
+ part_shift = 0;
+ if (max_part > 0) {
+ part_shift = fls(max_part);
+@@ -828,6 +824,10 @@ static int __init nbd_init(void)
+ if (nbds_max > 1UL << (MINORBITS - part_shift))
+ return -EINVAL;
+
++ nbd_dev = kcalloc(nbds_max, sizeof(*nbd_dev), GFP_KERNEL);
++ if (!nbd_dev)
++ return -ENOMEM;
++
+ for (i = 0; i < nbds_max; i++) {
+ struct gendisk *disk = alloc_disk(1 << part_shift);
+ if (!disk)
+diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c
+index fe1678c4ff89..de4c8499cbac 100644
+--- a/drivers/bluetooth/ath3k.c
++++ b/drivers/bluetooth/ath3k.c
+@@ -79,6 +79,7 @@ static const struct usb_device_id ath3k_table[] = {
+ { USB_DEVICE(0x0489, 0xe057) },
+ { USB_DEVICE(0x0489, 0xe056) },
+ { USB_DEVICE(0x0489, 0xe05f) },
++ { USB_DEVICE(0x0489, 0xe078) },
+ { USB_DEVICE(0x04c5, 0x1330) },
+ { USB_DEVICE(0x04CA, 0x3004) },
+ { USB_DEVICE(0x04CA, 0x3005) },
+@@ -86,6 +87,7 @@ static const struct usb_device_id ath3k_table[] = {
+ { USB_DEVICE(0x04CA, 0x3007) },
+ { USB_DEVICE(0x04CA, 0x3008) },
+ { USB_DEVICE(0x04CA, 0x300b) },
++ { USB_DEVICE(0x04CA, 0x3010) },
+ { USB_DEVICE(0x0930, 0x0219) },
+ { USB_DEVICE(0x0930, 0x0220) },
+ { USB_DEVICE(0x0930, 0x0227) },
+@@ -132,6 +134,7 @@ static const struct usb_device_id ath3k_blist_tbl[] = {
+ { USB_DEVICE(0x0489, 0xe056), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x0489, 0xe057), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x0489, 0xe05f), .driver_info = BTUSB_ATH3012 },
++ { USB_DEVICE(0x0489, 0xe078), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x04c5, 0x1330), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x04ca, 0x3004), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 },
+@@ -139,6 +142,7 @@ static const struct usb_device_id ath3k_blist_tbl[] = {
+ { USB_DEVICE(0x04ca, 0x3007), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x04ca, 0x3008), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x04ca, 0x300b), .driver_info = BTUSB_ATH3012 },
++ { USB_DEVICE(0x04ca, 0x3010), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x0930, 0x0220), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x0930, 0x0227), .driver_info = BTUSB_ATH3012 },
+diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
+index f0e2f721c8ce..9a7d24f95c5e 100644
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -125,6 +125,9 @@ static const struct usb_device_id btusb_table[] = {
+ { USB_VENDOR_AND_INTERFACE_INFO(0x0b05, 0xff, 0x01, 0x01),
+ .driver_info = BTUSB_BCM_PATCHRAM },
+
++ /* ASUSTek Computer - Broadcom based */
++ { USB_VENDOR_AND_INTERFACE_INFO(0x0b05, 0xff, 0x01, 0x01) },
++
+ /* Belkin F8065bf - Broadcom based */
+ { USB_VENDOR_AND_INTERFACE_INFO(0x050d, 0xff, 0x01, 0x01) },
+
+@@ -164,6 +167,7 @@ static const struct usb_device_id blacklist_table[] = {
+ { USB_DEVICE(0x0489, 0xe056), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x0489, 0xe057), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x0489, 0xe05f), .driver_info = BTUSB_ATH3012 },
++ { USB_DEVICE(0x0489, 0xe078), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x04c5, 0x1330), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x04ca, 0x3004), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 },
+@@ -171,6 +175,7 @@ static const struct usb_device_id blacklist_table[] = {
+ { USB_DEVICE(0x04ca, 0x3007), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x04ca, 0x3008), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x04ca, 0x300b), .driver_info = BTUSB_ATH3012 },
++ { USB_DEVICE(0x04ca, 0x3010), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x0930, 0x0220), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x0930, 0x0227), .driver_info = BTUSB_ATH3012 },
+diff --git a/drivers/clk/clk-divider.c b/drivers/clk/clk-divider.c
+index c0a842b335c5..a52154caf526 100644
+--- a/drivers/clk/clk-divider.c
++++ b/drivers/clk/clk-divider.c
+@@ -129,12 +129,6 @@ static unsigned long clk_divider_recalc_rate(struct clk_hw *hw,
+ return DIV_ROUND_UP(parent_rate, div);
+ }
+
+-/*
+- * The reverse of DIV_ROUND_UP: The maximum number which
+- * divided by m is r
+- */
+-#define MULT_ROUND_UP(r, m) ((r) * (m) + (m) - 1)
+-
+ static bool _is_valid_table_div(const struct clk_div_table *table,
+ unsigned int div)
+ {
+@@ -208,6 +202,7 @@ static int _div_round_closest(struct clk_divider *divider,
+ unsigned long parent_rate, unsigned long rate)
+ {
+ int up, down, div;
++ unsigned long up_rate, down_rate;
+
+ up = down = div = DIV_ROUND_CLOSEST(parent_rate, rate);
+
+@@ -219,7 +214,10 @@ static int _div_round_closest(struct clk_divider *divider,
+ down = _round_down_table(divider->table, div);
+ }
+
+- return (up - div) <= (div - down) ? up : down;
++ up_rate = DIV_ROUND_UP(parent_rate, up);
++ down_rate = DIV_ROUND_UP(parent_rate, down);
++
++ return (rate - up_rate) <= (down_rate - rate) ? up : down;
+ }
+
+ static int _div_round(struct clk_divider *divider, unsigned long parent_rate,
+@@ -300,7 +298,7 @@ static int clk_divider_bestdiv(struct clk_hw *hw, unsigned long rate,
+ return i;
+ }
+ parent_rate = __clk_round_rate(__clk_get_parent(hw->clk),
+- MULT_ROUND_UP(rate, i));
++ rate * i);
+ now = DIV_ROUND_UP(parent_rate, i);
+ if (_is_best_div(divider, rate, now, best)) {
+ bestdiv = i;
+diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
+index e3bf702b5588..90e8deb6c15e 100644
+--- a/drivers/cpufreq/cpufreq.c
++++ b/drivers/cpufreq/cpufreq.c
+@@ -1717,15 +1717,18 @@ void cpufreq_resume(void)
+ || __cpufreq_governor(policy, CPUFREQ_GOV_LIMITS))
+ pr_err("%s: Failed to start governor for policy: %p\n",
+ __func__, policy);
+-
+- /*
+- * schedule call cpufreq_update_policy() for boot CPU, i.e. last
+- * policy in list. It will verify that the current freq is in
+- * sync with what we believe it to be.
+- */
+- if (list_is_last(&policy->policy_list, &cpufreq_policy_list))
+- schedule_work(&policy->update);
+ }
++
++ /*
++ * schedule call cpufreq_update_policy() for first-online CPU, as that
++ * wouldn't be hotplugged-out on suspend. It will verify that the
++ * current freq is in sync with what we believe it to be.
++ */
++ policy = cpufreq_cpu_get_raw(cpumask_first(cpu_online_mask));
++ if (WARN_ON(!policy))
++ return;
++
++ schedule_work(&policy->update);
+ }
+
+ /**
+diff --git a/drivers/cpuidle/cpuidle.c b/drivers/cpuidle/cpuidle.c
+index 125150dc6e81..9ab99642ca7a 100644
+--- a/drivers/cpuidle/cpuidle.c
++++ b/drivers/cpuidle/cpuidle.c
+@@ -297,9 +297,6 @@ int cpuidle_enable_device(struct cpuidle_device *dev)
+ if (!dev->registered)
+ return -EINVAL;
+
+- if (!dev->state_count)
+- dev->state_count = drv->state_count;
+-
+ ret = cpuidle_add_device_sysfs(dev);
+ if (ret)
+ return ret;
+diff --git a/drivers/cpuidle/sysfs.c b/drivers/cpuidle/sysfs.c
+index 97c5903b4606..832a2c3f01ff 100644
+--- a/drivers/cpuidle/sysfs.c
++++ b/drivers/cpuidle/sysfs.c
+@@ -401,7 +401,7 @@ static int cpuidle_add_state_sysfs(struct cpuidle_device *device)
+ struct cpuidle_driver *drv = cpuidle_get_cpu_driver(device);
+
+ /* state statistics */
+- for (i = 0; i < device->state_count; i++) {
++ for (i = 0; i < drv->state_count; i++) {
+ kobj = kzalloc(sizeof(struct cpuidle_state_kobj), GFP_KERNEL);
+ if (!kobj)
+ goto error_state;
+@@ -433,9 +433,10 @@ error_state:
+ */
+ static void cpuidle_remove_state_sysfs(struct cpuidle_device *device)
+ {
++ struct cpuidle_driver *drv = cpuidle_get_cpu_driver(device);
+ int i;
+
+- for (i = 0; i < device->state_count; i++)
++ for (i = 0; i < drv->state_count; i++)
+ cpuidle_free_state_kobj(device, i);
+ }
+
+diff --git a/drivers/dma/edma.c b/drivers/dma/edma.c
+index 4cfaaa5a49be..abff66c18432 100644
+--- a/drivers/dma/edma.c
++++ b/drivers/dma/edma.c
+@@ -258,6 +258,13 @@ static int edma_terminate_all(struct edma_chan *echan)
+ */
+ if (echan->edesc) {
+ int cyclic = echan->edesc->cyclic;
++
++ /*
++ * free the running request descriptor
++ * since it is not in any of the vdesc lists
++ */
++ edma_desc_free(&echan->edesc->vdesc);
++
+ echan->edesc = NULL;
+ edma_stop(echan->ch_num);
+ /* Move the cyclic channel back to default queue */
+diff --git a/drivers/dma/omap-dma.c b/drivers/dma/omap-dma.c
+index bbea8243f9e8..f477f3ba223a 100644
+--- a/drivers/dma/omap-dma.c
++++ b/drivers/dma/omap-dma.c
+@@ -978,6 +978,7 @@ static int omap_dma_terminate_all(struct omap_chan *c)
+ * c->desc is NULL and exit.)
+ */
+ if (c->desc) {
++ omap_dma_desc_free(&c->desc->vd);
+ c->desc = NULL;
+ /* Avoid stopping the dma twice */
+ if (!c->paused)
+diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c
+index da41ad42d3a6..b7f101b52d81 100644
+--- a/drivers/gpu/drm/drm_crtc.c
++++ b/drivers/gpu/drm/drm_crtc.c
+@@ -531,17 +531,6 @@ void drm_framebuffer_reference(struct drm_framebuffer *fb)
+ }
+ EXPORT_SYMBOL(drm_framebuffer_reference);
+
+-static void drm_framebuffer_free_bug(struct kref *kref)
+-{
+- BUG();
+-}
+-
+-static void __drm_framebuffer_unreference(struct drm_framebuffer *fb)
+-{
+- DRM_DEBUG("%p: FB ID: %d (%d)\n", fb, fb->base.id, atomic_read(&fb->refcount.refcount));
+- kref_put(&fb->refcount, drm_framebuffer_free_bug);
+-}
+-
+ /**
+ * drm_framebuffer_unregister_private - unregister a private fb from the lookup idr
+ * @fb: fb to unregister
+@@ -1297,7 +1286,7 @@ void drm_plane_force_disable(struct drm_plane *plane)
+ return;
+ }
+ /* disconnect the plane from the fb and crtc: */
+- __drm_framebuffer_unreference(plane->old_fb);
++ drm_framebuffer_unreference(plane->old_fb);
+ plane->old_fb = NULL;
+ plane->fb = NULL;
+ plane->crtc = NULL;
+diff --git a/drivers/gpu/drm/drm_edid_load.c b/drivers/gpu/drm/drm_edid_load.c
+index 0a235fe61c9b..144a0368ccd0 100644
+--- a/drivers/gpu/drm/drm_edid_load.c
++++ b/drivers/gpu/drm/drm_edid_load.c
+@@ -288,6 +288,7 @@ int drm_load_edid_firmware(struct drm_connector *connector)
+
+ drm_mode_connector_update_edid_property(connector, edid);
+ ret = drm_add_edid_modes(connector, edid);
++ drm_edid_to_eld(connector, edid);
+ kfree(edid);
+
+ return ret;
+diff --git a/drivers/gpu/drm/drm_probe_helper.c b/drivers/gpu/drm/drm_probe_helper.c
+index 6857e9ad6339..5edc61f2f212 100644
+--- a/drivers/gpu/drm/drm_probe_helper.c
++++ b/drivers/gpu/drm/drm_probe_helper.c
+@@ -151,6 +151,7 @@ static int drm_helper_probe_single_connector_modes_merge_bits(struct drm_connect
+ struct edid *edid = (struct edid *) connector->edid_blob_ptr->data;
+
+ count = drm_add_edid_modes(connector, edid);
++ drm_edid_to_eld(connector, edid);
+ } else
+ count = (*connector_funcs->get_modes)(connector);
+ }
+diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
+index 925697320949..59f23fca0596 100644
+--- a/drivers/gpu/drm/i915/i915_drv.c
++++ b/drivers/gpu/drm/i915/i915_drv.c
+@@ -1141,6 +1141,7 @@ static void vlv_save_gunit_s0ix_state(struct drm_i915_private *dev_priv)
+ /* Gunit-Display CZ domain, 0x182028-0x1821CF */
+ s->gu_ctl0 = I915_READ(VLV_GU_CTL0);
+ s->gu_ctl1 = I915_READ(VLV_GU_CTL1);
++ s->pcbr = I915_READ(VLV_PCBR);
+ s->clock_gate_dis2 = I915_READ(VLV_GUNIT_CLOCK_GATE2);
+
+ /*
+@@ -1235,6 +1236,7 @@ static void vlv_restore_gunit_s0ix_state(struct drm_i915_private *dev_priv)
+ /* Gunit-Display CZ domain, 0x182028-0x1821CF */
+ I915_WRITE(VLV_GU_CTL0, s->gu_ctl0);
+ I915_WRITE(VLV_GU_CTL1, s->gu_ctl1);
++ I915_WRITE(VLV_PCBR, s->pcbr);
+ I915_WRITE(VLV_GUNIT_CLOCK_GATE2, s->clock_gate_dis2);
+ }
+
+@@ -1243,19 +1245,7 @@ int vlv_force_gfx_clock(struct drm_i915_private *dev_priv, bool force_on)
+ u32 val;
+ int err;
+
+- val = I915_READ(VLV_GTLC_SURVIVABILITY_REG);
+- WARN_ON(!!(val & VLV_GFX_CLK_FORCE_ON_BIT) == force_on);
+-
+ #define COND (I915_READ(VLV_GTLC_SURVIVABILITY_REG) & VLV_GFX_CLK_STATUS_BIT)
+- /* Wait for a previous force-off to settle */
+- if (force_on) {
+- err = wait_for(!COND, 20);
+- if (err) {
+- DRM_ERROR("timeout waiting for GFX clock force-off (%08x)\n",
+- I915_READ(VLV_GTLC_SURVIVABILITY_REG));
+- return err;
+- }
+- }
+
+ val = I915_READ(VLV_GTLC_SURVIVABILITY_REG);
+ val &= ~VLV_GFX_CLK_FORCE_ON_BIT;
+diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
+index 45434333b289..a84971351eee 100644
+--- a/drivers/gpu/drm/i915/i915_drv.h
++++ b/drivers/gpu/drm/i915/i915_drv.h
+@@ -938,6 +938,7 @@ struct vlv_s0ix_state {
+ /* Display 2 CZ domain */
+ u32 gu_ctl0;
+ u32 gu_ctl1;
++ u32 pcbr;
+ u32 clock_gate_dis2;
+ };
+
+diff --git a/drivers/gpu/drm/i915/i915_gem_stolen.c b/drivers/gpu/drm/i915/i915_gem_stolen.c
+index 0ee76b25204c..360087eb83fd 100644
+--- a/drivers/gpu/drm/i915/i915_gem_stolen.c
++++ b/drivers/gpu/drm/i915/i915_gem_stolen.c
+@@ -485,10 +485,7 @@ i915_gem_object_create_stolen_for_preallocated(struct drm_device *dev,
+ stolen_offset, gtt_offset, size);
+
+ /* KISS and expect everything to be page-aligned */
+- BUG_ON(stolen_offset & 4095);
+- BUG_ON(size & 4095);
+-
+- if (WARN_ON(size == 0))
++ if (WARN_ON(size == 0 || stolen_offset & 4095 || size & 4095))
+ return NULL;
+
+ stolen = kzalloc(sizeof(*stolen), GFP_KERNEL);
+diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
+index 7a7c445b07b4..448327fe4d85 100644
+--- a/drivers/gpu/drm/i915/intel_display.c
++++ b/drivers/gpu/drm/i915/intel_display.c
+@@ -2358,13 +2358,19 @@ static bool intel_alloc_plane_obj(struct intel_crtc *crtc,
+ struct drm_device *dev = crtc->base.dev;
+ struct drm_i915_gem_object *obj = NULL;
+ struct drm_mode_fb_cmd2 mode_cmd = { 0 };
+- u32 base = plane_config->base;
++ u32 base_aligned = round_down(plane_config->base, PAGE_SIZE);
++ u32 size_aligned = round_up(plane_config->base + plane_config->size,
++ PAGE_SIZE);
++
++ size_aligned -= base_aligned;
+
+ if (plane_config->size == 0)
+ return false;
+
+- obj = i915_gem_object_create_stolen_for_preallocated(dev, base, base,
+- plane_config->size);
++ obj = i915_gem_object_create_stolen_for_preallocated(dev,
++ base_aligned,
++ base_aligned,
++ size_aligned);
+ if (!obj)
+ return false;
+
+@@ -6383,8 +6389,7 @@ static void i9xx_get_plane_config(struct intel_crtc *crtc,
+ aligned_height = intel_align_height(dev, crtc->base.primary->fb->height,
+ plane_config->tiled);
+
+- plane_config->size = PAGE_ALIGN(crtc->base.primary->fb->pitches[0] *
+- aligned_height);
++ plane_config->size = crtc->base.primary->fb->pitches[0] * aligned_height;
+
+ DRM_DEBUG_KMS("pipe/plane %d/%d with fb: size=%dx%d@%d, offset=%x, pitch %d, size 0x%x\n",
+ pipe, plane, crtc->base.primary->fb->width,
+@@ -7424,8 +7429,7 @@ static void ironlake_get_plane_config(struct intel_crtc *crtc,
+ aligned_height = intel_align_height(dev, crtc->base.primary->fb->height,
+ plane_config->tiled);
+
+- plane_config->size = PAGE_ALIGN(crtc->base.primary->fb->pitches[0] *
+- aligned_height);
++ plane_config->size = crtc->base.primary->fb->pitches[0] * aligned_height;
+
+ DRM_DEBUG_KMS("pipe/plane %d/%d with fb: size=%dx%d@%d, offset=%x, pitch %d, size 0x%x\n",
+ pipe, plane, crtc->base.primary->fb->width,
+diff --git a/drivers/gpu/drm/i915/intel_sprite.c b/drivers/gpu/drm/i915/intel_sprite.c
+index 07a74ef589bd..4edebce7f213 100644
+--- a/drivers/gpu/drm/i915/intel_sprite.c
++++ b/drivers/gpu/drm/i915/intel_sprite.c
+@@ -1178,7 +1178,7 @@ int intel_sprite_set_colorkey(struct drm_device *dev, void *data,
+ drm_modeset_lock_all(dev);
+
+ plane = drm_plane_find(dev, set->plane_id);
+- if (!plane) {
++ if (!plane || plane->type != DRM_PLANE_TYPE_OVERLAY) {
+ ret = -ENOENT;
+ goto out_unlock;
+ }
+@@ -1205,7 +1205,7 @@ int intel_sprite_get_colorkey(struct drm_device *dev, void *data,
+ drm_modeset_lock_all(dev);
+
+ plane = drm_plane_find(dev, get->plane_id);
+- if (!plane) {
++ if (!plane || plane->type != DRM_PLANE_TYPE_OVERLAY) {
+ ret = -ENOENT;
+ goto out_unlock;
+ }
+diff --git a/drivers/gpu/drm/radeon/radeon.h b/drivers/gpu/drm/radeon/radeon.h
+index dbe51bfe3ef4..d6f0e40db81d 100644
+--- a/drivers/gpu/drm/radeon/radeon.h
++++ b/drivers/gpu/drm/radeon/radeon.h
+@@ -1544,6 +1544,7 @@ struct radeon_dpm {
+ int new_active_crtc_count;
+ u32 current_active_crtcs;
+ int current_active_crtc_count;
++ bool single_display;
+ struct radeon_dpm_dynamic_state dyn_state;
+ struct radeon_dpm_fan fan;
+ u32 tdp_limit;
+diff --git a/drivers/gpu/drm/radeon/radeon_bios.c b/drivers/gpu/drm/radeon/radeon_bios.c
+index 63ccb8fa799c..d27e4ccb848c 100644
+--- a/drivers/gpu/drm/radeon/radeon_bios.c
++++ b/drivers/gpu/drm/radeon/radeon_bios.c
+@@ -76,7 +76,7 @@ static bool igp_read_bios_from_vram(struct radeon_device *rdev)
+
+ static bool radeon_read_bios(struct radeon_device *rdev)
+ {
+- uint8_t __iomem *bios;
++ uint8_t __iomem *bios, val1, val2;
+ size_t size;
+
+ rdev->bios = NULL;
+@@ -86,15 +86,19 @@ static bool radeon_read_bios(struct radeon_device *rdev)
+ return false;
+ }
+
+- if (size == 0 || bios[0] != 0x55 || bios[1] != 0xaa) {
++ val1 = readb(&bios[0]);
++ val2 = readb(&bios[1]);
++
++ if (size == 0 || val1 != 0x55 || val2 != 0xaa) {
+ pci_unmap_rom(rdev->pdev, bios);
+ return false;
+ }
+- rdev->bios = kmemdup(bios, size, GFP_KERNEL);
++ rdev->bios = kzalloc(size, GFP_KERNEL);
+ if (rdev->bios == NULL) {
+ pci_unmap_rom(rdev->pdev, bios);
+ return false;
+ }
++ memcpy_fromio(rdev->bios, bios, size);
+ pci_unmap_rom(rdev->pdev, bios);
+ return true;
+ }
+diff --git a/drivers/gpu/drm/radeon/radeon_mn.c b/drivers/gpu/drm/radeon/radeon_mn.c
+index a69bd441dd2d..572b4dbec186 100644
+--- a/drivers/gpu/drm/radeon/radeon_mn.c
++++ b/drivers/gpu/drm/radeon/radeon_mn.c
+@@ -122,7 +122,6 @@ static void radeon_mn_invalidate_range_start(struct mmu_notifier *mn,
+ it = interval_tree_iter_first(&rmn->objects, start, end);
+ while (it) {
+ struct radeon_bo *bo;
+- struct fence *fence;
+ int r;
+
+ bo = container_of(it, struct radeon_bo, mn_it);
+@@ -134,12 +133,10 @@ static void radeon_mn_invalidate_range_start(struct mmu_notifier *mn,
+ continue;
+ }
+
+- fence = reservation_object_get_excl(bo->tbo.resv);
+- if (fence) {
+- r = radeon_fence_wait((struct radeon_fence *)fence, false);
+- if (r)
+- DRM_ERROR("(%d) failed to wait for user bo\n", r);
+- }
++ r = reservation_object_wait_timeout_rcu(bo->tbo.resv, true,
++ false, MAX_SCHEDULE_TIMEOUT);
++ if (r)
++ DRM_ERROR("(%d) failed to wait for user bo\n", r);
+
+ radeon_ttm_placement_from_domain(bo, RADEON_GEM_DOMAIN_CPU);
+ r = ttm_bo_validate(&bo->tbo, &bo->placement, false, false);
+diff --git a/drivers/gpu/drm/radeon/radeon_pm.c b/drivers/gpu/drm/radeon/radeon_pm.c
+index f7da8fe96a66..1d94b542cd82 100644
+--- a/drivers/gpu/drm/radeon/radeon_pm.c
++++ b/drivers/gpu/drm/radeon/radeon_pm.c
+@@ -704,12 +704,8 @@ static void radeon_dpm_thermal_work_handler(struct work_struct *work)
+ radeon_pm_compute_clocks(rdev);
+ }
+
+-static struct radeon_ps *radeon_dpm_pick_power_state(struct radeon_device *rdev,
+- enum radeon_pm_state_type dpm_state)
++static bool radeon_dpm_single_display(struct radeon_device *rdev)
+ {
+- int i;
+- struct radeon_ps *ps;
+- u32 ui_class;
+ bool single_display = (rdev->pm.dpm.new_active_crtc_count < 2) ?
+ true : false;
+
+@@ -719,6 +715,17 @@ static struct radeon_ps *radeon_dpm_pick_power_state(struct radeon_device *rdev,
+ single_display = false;
+ }
+
++ return single_display;
++}
++
++static struct radeon_ps *radeon_dpm_pick_power_state(struct radeon_device *rdev,
++ enum radeon_pm_state_type dpm_state)
++{
++ int i;
++ struct radeon_ps *ps;
++ u32 ui_class;
++ bool single_display = radeon_dpm_single_display(rdev);
++
+ /* certain older asics have a separare 3D performance state,
+ * so try that first if the user selected performance
+ */
+@@ -844,6 +851,7 @@ static void radeon_dpm_change_power_state_locked(struct radeon_device *rdev)
+ struct radeon_ps *ps;
+ enum radeon_pm_state_type dpm_state;
+ int ret;
++ bool single_display = radeon_dpm_single_display(rdev);
+
+ /* if dpm init failed */
+ if (!rdev->pm.dpm_enabled)
+@@ -868,6 +876,9 @@ static void radeon_dpm_change_power_state_locked(struct radeon_device *rdev)
+ /* vce just modifies an existing state so force a change */
+ if (ps->vce_active != rdev->pm.dpm.vce_active)
+ goto force;
++ /* user has made a display change (such as timing) */
++ if (rdev->pm.dpm.single_display != single_display)
++ goto force;
+ if ((rdev->family < CHIP_BARTS) || (rdev->flags & RADEON_IS_IGP)) {
+ /* for pre-BTC and APUs if the num crtcs changed but state is the same,
+ * all we need to do is update the display configuration.
+@@ -930,6 +941,7 @@ force:
+
+ rdev->pm.dpm.current_active_crtcs = rdev->pm.dpm.new_active_crtcs;
+ rdev->pm.dpm.current_active_crtc_count = rdev->pm.dpm.new_active_crtc_count;
++ rdev->pm.dpm.single_display = single_display;
+
+ /* wait for the rings to drain */
+ for (i = 0; i < RADEON_NUM_RINGS; i++) {
+diff --git a/drivers/gpu/drm/radeon/radeon_ttm.c b/drivers/gpu/drm/radeon/radeon_ttm.c
+index d2510cfd3fea..9ab8e2694602 100644
+--- a/drivers/gpu/drm/radeon/radeon_ttm.c
++++ b/drivers/gpu/drm/radeon/radeon_ttm.c
+@@ -575,6 +575,10 @@ static void radeon_ttm_tt_unpin_userptr(struct ttm_tt *ttm)
+ enum dma_data_direction direction = write ?
+ DMA_BIDIRECTIONAL : DMA_TO_DEVICE;
+
++ /* double check that we don't free the table twice */
++ if (!ttm->sg->sgl)
++ return;
++
+ /* free the sg table and pages again */
+ dma_unmap_sg(rdev->dev, ttm->sg->sgl, ttm->sg->nents, direction);
+
+diff --git a/drivers/iio/accel/bmc150-accel.c b/drivers/iio/accel/bmc150-accel.c
+index 513bd6d14293..eaf46ea31177 100644
+--- a/drivers/iio/accel/bmc150-accel.c
++++ b/drivers/iio/accel/bmc150-accel.c
+@@ -168,14 +168,14 @@ static const struct {
+ int val;
+ int val2;
+ u8 bw_bits;
+-} bmc150_accel_samp_freq_table[] = { {7, 810000, 0x08},
+- {15, 630000, 0x09},
+- {31, 250000, 0x0A},
+- {62, 500000, 0x0B},
+- {125, 0, 0x0C},
+- {250, 0, 0x0D},
+- {500, 0, 0x0E},
+- {1000, 0, 0x0F} };
++} bmc150_accel_samp_freq_table[] = { {15, 620000, 0x08},
++ {31, 260000, 0x09},
++ {62, 500000, 0x0A},
++ {125, 0, 0x0B},
++ {250, 0, 0x0C},
++ {500, 0, 0x0D},
++ {1000, 0, 0x0E},
++ {2000, 0, 0x0F} };
+
+ static const struct {
+ int bw_bits;
+@@ -840,7 +840,7 @@ static int bmc150_accel_validate_trigger(struct iio_dev *indio_dev,
+ }
+
+ static IIO_CONST_ATTR_SAMP_FREQ_AVAIL(
+- "7.810000 15.630000 31.250000 62.500000 125 250 500 1000");
++ "15.620000 31.260000 62.50000 125 250 500 1000 2000");
+
+ static struct attribute *bmc150_accel_attributes[] = {
+ &iio_const_attr_sampling_frequency_available.dev_attr.attr,
+diff --git a/drivers/iio/adc/vf610_adc.c b/drivers/iio/adc/vf610_adc.c
+index 4a10ae97dbf2..38e60860165d 100644
+--- a/drivers/iio/adc/vf610_adc.c
++++ b/drivers/iio/adc/vf610_adc.c
+@@ -141,9 +141,13 @@ struct vf610_adc {
+ struct regulator *vref;
+ struct vf610_adc_feature adc_feature;
+
++ u32 sample_freq_avail[5];
++
+ struct completion completion;
+ };
+
++static const u32 vf610_hw_avgs[] = { 1, 4, 8, 16, 32 };
++
+ #define VF610_ADC_CHAN(_idx, _chan_type) { \
+ .type = (_chan_type), \
+ .indexed = 1, \
+@@ -173,35 +177,47 @@ static const struct iio_chan_spec vf610_adc_iio_channels[] = {
+ /* sentinel */
+ };
+
+-/*
+- * ADC sample frequency, unit is ADCK cycles.
+- * ADC clk source is ipg clock, which is the same as bus clock.
+- *
+- * ADC conversion time = SFCAdder + AverageNum x (BCT + LSTAdder)
+- * SFCAdder: fixed to 6 ADCK cycles
+- * AverageNum: 1, 4, 8, 16, 32 samples for hardware average.
+- * BCT (Base Conversion Time): fixed to 25 ADCK cycles for 12 bit mode
+- * LSTAdder(Long Sample Time): fixed to 3 ADCK cycles
+- *
+- * By default, enable 12 bit resolution mode, clock source
+- * set to ipg clock, So get below frequency group:
+- */
+-static const u32 vf610_sample_freq_avail[5] =
+-{1941176, 559332, 286957, 145374, 73171};
++static inline void vf610_adc_calculate_rates(struct vf610_adc *info)
++{
++ unsigned long adck_rate, ipg_rate = clk_get_rate(info->clk);
++ int i;
++
++ /*
++ * Calculate ADC sample frequencies
++ * Sample time unit is ADCK cycles. ADCK clk source is ipg clock,
++ * which is the same as bus clock.
++ *
++ * ADC conversion time = SFCAdder + AverageNum x (BCT + LSTAdder)
++ * SFCAdder: fixed to 6 ADCK cycles
++ * AverageNum: 1, 4, 8, 16, 32 samples for hardware average.
++ * BCT (Base Conversion Time): fixed to 25 ADCK cycles for 12 bit mode
++ * LSTAdder(Long Sample Time): fixed to 3 ADCK cycles
++ */
++ adck_rate = ipg_rate / info->adc_feature.clk_div;
++ for (i = 0; i < ARRAY_SIZE(vf610_hw_avgs); i++)
++ info->sample_freq_avail[i] =
++ adck_rate / (6 + vf610_hw_avgs[i] * (25 + 3));
++}
+
+ static inline void vf610_adc_cfg_init(struct vf610_adc *info)
+ {
++ struct vf610_adc_feature *adc_feature = &info->adc_feature;
++
+ /* set default Configuration for ADC controller */
+- info->adc_feature.clk_sel = VF610_ADCIOC_BUSCLK_SET;
+- info->adc_feature.vol_ref = VF610_ADCIOC_VR_VREF_SET;
++ adc_feature->clk_sel = VF610_ADCIOC_BUSCLK_SET;
++ adc_feature->vol_ref = VF610_ADCIOC_VR_VREF_SET;
++
++ adc_feature->calibration = true;
++ adc_feature->ovwren = true;
++
++ adc_feature->res_mode = 12;
++ adc_feature->sample_rate = 1;
++ adc_feature->lpm = true;
+
+- info->adc_feature.calibration = true;
+- info->adc_feature.ovwren = true;
++ /* Use a save ADCK which is below 20MHz on all devices */
++ adc_feature->clk_div = 8;
+
+- info->adc_feature.clk_div = 1;
+- info->adc_feature.res_mode = 12;
+- info->adc_feature.sample_rate = 1;
+- info->adc_feature.lpm = true;
++ vf610_adc_calculate_rates(info);
+ }
+
+ static void vf610_adc_cfg_post_set(struct vf610_adc *info)
+@@ -283,12 +299,10 @@ static void vf610_adc_cfg_set(struct vf610_adc *info)
+
+ cfg_data = readl(info->regs + VF610_REG_ADC_CFG);
+
+- /* low power configuration */
+ cfg_data &= ~VF610_ADC_ADLPC_EN;
+ if (adc_feature->lpm)
+ cfg_data |= VF610_ADC_ADLPC_EN;
+
+- /* disable high speed */
+ cfg_data &= ~VF610_ADC_ADHSC_EN;
+
+ writel(cfg_data, info->regs + VF610_REG_ADC_CFG);
+@@ -428,10 +442,27 @@ static irqreturn_t vf610_adc_isr(int irq, void *dev_id)
+ return IRQ_HANDLED;
+ }
+
+-static IIO_CONST_ATTR_SAMP_FREQ_AVAIL("1941176, 559332, 286957, 145374, 73171");
++static ssize_t vf610_show_samp_freq_avail(struct device *dev,
++ struct device_attribute *attr, char *buf)
++{
++ struct vf610_adc *info = iio_priv(dev_to_iio_dev(dev));
++ size_t len = 0;
++ int i;
++
++ for (i = 0; i < ARRAY_SIZE(info->sample_freq_avail); i++)
++ len += scnprintf(buf + len, PAGE_SIZE - len,
++ "%u ", info->sample_freq_avail[i]);
++
++ /* replace trailing space by newline */
++ buf[len - 1] = '\n';
++
++ return len;
++}
++
++static IIO_DEV_ATTR_SAMP_FREQ_AVAIL(vf610_show_samp_freq_avail);
+
+ static struct attribute *vf610_attributes[] = {
+- &iio_const_attr_sampling_frequency_available.dev_attr.attr,
++ &iio_dev_attr_sampling_frequency_available.dev_attr.attr,
+ NULL
+ };
+
+@@ -478,7 +509,7 @@ static int vf610_read_raw(struct iio_dev *indio_dev,
+ return IIO_VAL_FRACTIONAL_LOG2;
+
+ case IIO_CHAN_INFO_SAMP_FREQ:
+- *val = vf610_sample_freq_avail[info->adc_feature.sample_rate];
++ *val = info->sample_freq_avail[info->adc_feature.sample_rate];
+ *val2 = 0;
+ return IIO_VAL_INT;
+
+@@ -501,9 +532,9 @@ static int vf610_write_raw(struct iio_dev *indio_dev,
+ switch (mask) {
+ case IIO_CHAN_INFO_SAMP_FREQ:
+ for (i = 0;
+- i < ARRAY_SIZE(vf610_sample_freq_avail);
++ i < ARRAY_SIZE(info->sample_freq_avail);
+ i++)
+- if (val == vf610_sample_freq_avail[i]) {
++ if (val == info->sample_freq_avail[i]) {
+ info->adc_feature.sample_rate = i;
+ vf610_adc_sample_set(info);
+ return 0;
+diff --git a/drivers/iio/imu/adis_trigger.c b/drivers/iio/imu/adis_trigger.c
+index e0017c22bb9c..f53e9a803a0e 100644
+--- a/drivers/iio/imu/adis_trigger.c
++++ b/drivers/iio/imu/adis_trigger.c
+@@ -60,7 +60,7 @@ int adis_probe_trigger(struct adis *adis, struct iio_dev *indio_dev)
+ iio_trigger_set_drvdata(adis->trig, adis);
+ ret = iio_trigger_register(adis->trig);
+
+- indio_dev->trig = adis->trig;
++ indio_dev->trig = iio_trigger_get(adis->trig);
+ if (ret)
+ goto error_free_irq;
+
+diff --git a/drivers/iio/imu/inv_mpu6050/inv_mpu_ring.c b/drivers/iio/imu/inv_mpu6050/inv_mpu_ring.c
+index 0cd306a72a6e..ba27e277511f 100644
+--- a/drivers/iio/imu/inv_mpu6050/inv_mpu_ring.c
++++ b/drivers/iio/imu/inv_mpu6050/inv_mpu_ring.c
+@@ -24,6 +24,16 @@
+ #include <linux/poll.h>
+ #include "inv_mpu_iio.h"
+
++static void inv_clear_kfifo(struct inv_mpu6050_state *st)
++{
++ unsigned long flags;
++
++ /* take the spin lock sem to avoid interrupt kick in */
++ spin_lock_irqsave(&st->time_stamp_lock, flags);
++ kfifo_reset(&st->timestamps);
++ spin_unlock_irqrestore(&st->time_stamp_lock, flags);
++}
++
+ int inv_reset_fifo(struct iio_dev *indio_dev)
+ {
+ int result;
+@@ -50,6 +60,10 @@ int inv_reset_fifo(struct iio_dev *indio_dev)
+ INV_MPU6050_BIT_FIFO_RST);
+ if (result)
+ goto reset_fifo_fail;
++
++ /* clear timestamps fifo */
++ inv_clear_kfifo(st);
++
+ /* enable interrupt */
+ if (st->chip_config.accl_fifo_enable ||
+ st->chip_config.gyro_fifo_enable) {
+@@ -83,16 +97,6 @@ reset_fifo_fail:
+ return result;
+ }
+
+-static void inv_clear_kfifo(struct inv_mpu6050_state *st)
+-{
+- unsigned long flags;
+-
+- /* take the spin lock sem to avoid interrupt kick in */
+- spin_lock_irqsave(&st->time_stamp_lock, flags);
+- kfifo_reset(&st->timestamps);
+- spin_unlock_irqrestore(&st->time_stamp_lock, flags);
+-}
+-
+ /**
+ * inv_mpu6050_irq_handler() - Cache a timestamp at each data ready interrupt.
+ */
+@@ -184,7 +188,6 @@ end_session:
+ flush_fifo:
+ /* Flush HW and SW FIFOs. */
+ inv_reset_fifo(indio_dev);
+- inv_clear_kfifo(st);
+ mutex_unlock(&indio_dev->mlock);
+ iio_trigger_notify_done(indio_dev->trig);
+
+diff --git a/drivers/iio/industrialio-core.c b/drivers/iio/industrialio-core.c
+index af3e76d652ba..f009d053384a 100644
+--- a/drivers/iio/industrialio-core.c
++++ b/drivers/iio/industrialio-core.c
+@@ -832,8 +832,7 @@ static int iio_device_add_channel_sysfs(struct iio_dev *indio_dev,
+ * @attr_list: List of IIO device attributes
+ *
+ * This function frees the memory allocated for each of the IIO device
+- * attributes in the list. Note: if you want to reuse the list after calling
+- * this function you have to reinitialize it using INIT_LIST_HEAD().
++ * attributes in the list.
+ */
+ void iio_free_chan_devattr_list(struct list_head *attr_list)
+ {
+@@ -841,6 +840,7 @@ void iio_free_chan_devattr_list(struct list_head *attr_list)
+
+ list_for_each_entry_safe(p, n, attr_list, l) {
+ kfree(p->dev_attr.attr.name);
++ list_del(&p->l);
+ kfree(p);
+ }
+ }
+@@ -921,6 +921,7 @@ static void iio_device_unregister_sysfs(struct iio_dev *indio_dev)
+
+ iio_free_chan_devattr_list(&indio_dev->channel_attr_list);
+ kfree(indio_dev->chan_attr_group.attrs);
++ indio_dev->chan_attr_group.attrs = NULL;
+ }
+
+ static void iio_dev_release(struct device *device)
+diff --git a/drivers/iio/industrialio-event.c b/drivers/iio/industrialio-event.c
+index 0c1e37e3120a..35c02aeec75e 100644
+--- a/drivers/iio/industrialio-event.c
++++ b/drivers/iio/industrialio-event.c
+@@ -493,6 +493,7 @@ int iio_device_register_eventset(struct iio_dev *indio_dev)
+ error_free_setup_event_lines:
+ iio_free_chan_devattr_list(&indio_dev->event_interface->dev_attr_list);
+ kfree(indio_dev->event_interface);
++ indio_dev->event_interface = NULL;
+ return ret;
+ }
+
+diff --git a/drivers/infiniband/core/umem.c b/drivers/infiniband/core/umem.c
+index df0c4f605a21..dfa4286f98a4 100644
+--- a/drivers/infiniband/core/umem.c
++++ b/drivers/infiniband/core/umem.c
+@@ -94,6 +94,14 @@ struct ib_umem *ib_umem_get(struct ib_ucontext *context, unsigned long addr,
+ if (dmasync)
+ dma_set_attr(DMA_ATTR_WRITE_BARRIER, &attrs);
+
++ /*
++ * If the combination of the addr and size requested for this memory
++ * region causes an integer overflow, return error.
++ */
++ if ((PAGE_ALIGN(addr + size) <= size) ||
++ (PAGE_ALIGN(addr + size) <= addr))
++ return ERR_PTR(-EINVAL);
++
+ if (!can_do_mlock())
+ return ERR_PTR(-EPERM);
+
+diff --git a/drivers/infiniband/hw/mlx4/mad.c b/drivers/infiniband/hw/mlx4/mad.c
+index 82a7dd87089b..729382c06c5e 100644
+--- a/drivers/infiniband/hw/mlx4/mad.c
++++ b/drivers/infiniband/hw/mlx4/mad.c
+@@ -64,6 +64,14 @@ enum {
+ #define GUID_TBL_BLK_NUM_ENTRIES 8
+ #define GUID_TBL_BLK_SIZE (GUID_TBL_ENTRY_SIZE * GUID_TBL_BLK_NUM_ENTRIES)
+
++/* Counters should be saturate once they reach their maximum value */
++#define ASSIGN_32BIT_COUNTER(counter, value) do {\
++ if ((value) > U32_MAX) \
++ counter = cpu_to_be32(U32_MAX); \
++ else \
++ counter = cpu_to_be32(value); \
++} while (0)
++
+ struct mlx4_mad_rcv_buf {
+ struct ib_grh grh;
+ u8 payload[256];
+@@ -806,10 +814,14 @@ static int ib_process_mad(struct ib_device *ibdev, int mad_flags, u8 port_num,
+ static void edit_counter(struct mlx4_counter *cnt,
+ struct ib_pma_portcounters *pma_cnt)
+ {
+- pma_cnt->port_xmit_data = cpu_to_be32((be64_to_cpu(cnt->tx_bytes)>>2));
+- pma_cnt->port_rcv_data = cpu_to_be32((be64_to_cpu(cnt->rx_bytes)>>2));
+- pma_cnt->port_xmit_packets = cpu_to_be32(be64_to_cpu(cnt->tx_frames));
+- pma_cnt->port_rcv_packets = cpu_to_be32(be64_to_cpu(cnt->rx_frames));
++ ASSIGN_32BIT_COUNTER(pma_cnt->port_xmit_data,
++ (be64_to_cpu(cnt->tx_bytes) >> 2));
++ ASSIGN_32BIT_COUNTER(pma_cnt->port_rcv_data,
++ (be64_to_cpu(cnt->rx_bytes) >> 2));
++ ASSIGN_32BIT_COUNTER(pma_cnt->port_xmit_packets,
++ be64_to_cpu(cnt->tx_frames));
++ ASSIGN_32BIT_COUNTER(pma_cnt->port_rcv_packets,
++ be64_to_cpu(cnt->rx_frames));
+ }
+
+ static int iboe_process_mad(struct ib_device *ibdev, int mad_flags, u8 port_num,
+diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
+index b2b9c9264131..0ff89b2ecdb5 100644
+--- a/drivers/iommu/intel-iommu.c
++++ b/drivers/iommu/intel-iommu.c
+@@ -1746,8 +1746,8 @@ static int domain_init(struct dmar_domain *domain, int guest_width)
+ static void domain_exit(struct dmar_domain *domain)
+ {
+ struct dmar_drhd_unit *drhd;
+- struct intel_iommu *iommu;
+ struct page *freelist = NULL;
++ int i;
+
+ /* Domain 0 is reserved, so dont process it */
+ if (!domain)
+@@ -1767,8 +1767,8 @@ static void domain_exit(struct dmar_domain *domain)
+
+ /* clear attached or cached domains */
+ rcu_read_lock();
+- for_each_active_iommu(iommu, drhd)
+- iommu_detach_domain(domain, iommu);
++ for_each_set_bit(i, domain->iommu_bmp, g_num_of_iommus)
++ iommu_detach_domain(domain, g_iommus[i]);
+ rcu_read_unlock();
+
+ dma_free_pagelist(freelist);
+diff --git a/drivers/media/platform/s5p-mfc/s5p_mfc_common.h b/drivers/media/platform/s5p-mfc/s5p_mfc_common.h
+index 3e41ca1293ed..6849c7e79bb5 100644
+--- a/drivers/media/platform/s5p-mfc/s5p_mfc_common.h
++++ b/drivers/media/platform/s5p-mfc/s5p_mfc_common.h
+@@ -29,7 +29,7 @@
+
+ /* Offset base used to differentiate between CAPTURE and OUTPUT
+ * while mmaping */
+-#define DST_QUEUE_OFF_BASE (TASK_SIZE / 2)
++#define DST_QUEUE_OFF_BASE (1 << 30)
+
+ #define MFC_BANK1_ALLOC_CTX 0
+ #define MFC_BANK2_ALLOC_CTX 1
+diff --git a/drivers/media/platform/sh_veu.c b/drivers/media/platform/sh_veu.c
+index be3b3bc71a0f..54cb88a39afc 100644
+--- a/drivers/media/platform/sh_veu.c
++++ b/drivers/media/platform/sh_veu.c
+@@ -1179,6 +1179,7 @@ static int sh_veu_probe(struct platform_device *pdev)
+ }
+
+ *vdev = sh_veu_videodev;
++ vdev->v4l2_dev = &veu->v4l2_dev;
+ spin_lock_init(&veu->lock);
+ mutex_init(&veu->fop_lock);
+ vdev->lock = &veu->fop_lock;
+diff --git a/drivers/media/platform/soc_camera/soc_camera.c b/drivers/media/platform/soc_camera/soc_camera.c
+index 8e61b976da19..139704727e34 100644
+--- a/drivers/media/platform/soc_camera/soc_camera.c
++++ b/drivers/media/platform/soc_camera/soc_camera.c
+@@ -1681,7 +1681,7 @@ eclkreg:
+ eaddpdev:
+ platform_device_put(sasc->pdev);
+ eallocpdev:
+- devm_kfree(ici->v4l2_dev.dev, sasc);
++ devm_kfree(ici->v4l2_dev.dev, info);
+ dev_err(ici->v4l2_dev.dev, "group probe failed: %d\n", ret);
+
+ return ret;
+diff --git a/drivers/media/v4l2-core/videobuf2-core.c b/drivers/media/v4l2-core/videobuf2-core.c
+index ea36447c74f9..cc9537ef4829 100644
+--- a/drivers/media/v4l2-core/videobuf2-core.c
++++ b/drivers/media/v4l2-core/videobuf2-core.c
+@@ -3226,18 +3226,13 @@ int vb2_thread_stop(struct vb2_queue *q)
+
+ if (threadio == NULL)
+ return 0;
+- call_void_qop(q, wait_finish, q);
+ threadio->stop = true;
+- vb2_internal_streamoff(q, q->type);
+- call_void_qop(q, wait_prepare, q);
++ /* Wake up all pending sleeps in the thread */
++ vb2_queue_error(q);
+ err = kthread_stop(threadio->thread);
+- q->fileio = NULL;
+- fileio->req.count = 0;
+- vb2_reqbufs(q, &fileio->req);
+- kfree(fileio);
++ __vb2_cleanup_fileio(q);
+ threadio->thread = NULL;
+ kfree(threadio);
+- q->fileio = NULL;
+ q->threadio = NULL;
+ return err;
+ }
+diff --git a/drivers/net/bonding/bond_alb.c b/drivers/net/bonding/bond_alb.c
+index d2eadab787c5..4a6928457015 100644
+--- a/drivers/net/bonding/bond_alb.c
++++ b/drivers/net/bonding/bond_alb.c
+@@ -475,12 +475,8 @@ static void rlb_update_client(struct rlb_client_info *client_info)
+ skb->dev = client_info->slave->dev;
+
+ if (client_info->vlan_id) {
+- skb = vlan_put_tag(skb, htons(ETH_P_8021Q), client_info->vlan_id);
+- if (!skb) {
+- netdev_err(client_info->slave->bond->dev,
+- "failed to insert VLAN tag\n");
+- continue;
+- }
++ __vlan_hwaccel_put_tag(skb, htons(ETH_P_8021Q),
++ client_info->vlan_id);
+ }
+
+ arp_xmit(skb);
+@@ -951,13 +947,8 @@ static void alb_send_lp_vid(struct slave *slave, u8 mac_addr[],
+ skb->priority = TC_PRIO_CONTROL;
+ skb->dev = slave->dev;
+
+- if (vid) {
+- skb = vlan_put_tag(skb, vlan_proto, vid);
+- if (!skb) {
+- netdev_err(slave->bond->dev, "failed to insert VLAN tag\n");
+- return;
+- }
+- }
++ if (vid)
++ __vlan_hwaccel_put_tag(skb, vlan_proto, vid);
+
+ dev_queue_xmit(skb);
+ }
+diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
+index a5115fb7cf33..1cc06c0e3e92 100644
+--- a/drivers/net/bonding/bond_main.c
++++ b/drivers/net/bonding/bond_main.c
+@@ -2143,8 +2143,8 @@ static void bond_arp_send(struct net_device *slave_dev, int arp_op,
+
+ netdev_dbg(slave_dev, "inner tag: proto %X vid %X\n",
+ ntohs(outer_tag->vlan_proto), tags->vlan_id);
+- skb = __vlan_put_tag(skb, tags->vlan_proto,
+- tags->vlan_id);
++ skb = vlan_insert_tag_set_proto(skb, tags->vlan_proto,
++ tags->vlan_id);
+ if (!skb) {
+ net_err_ratelimited("failed to insert inner VLAN tag\n");
+ return;
+@@ -2156,12 +2156,8 @@ static void bond_arp_send(struct net_device *slave_dev, int arp_op,
+ if (outer_tag->vlan_id) {
+ netdev_dbg(slave_dev, "outer tag: proto %X vid %X\n",
+ ntohs(outer_tag->vlan_proto), outer_tag->vlan_id);
+- skb = vlan_put_tag(skb, outer_tag->vlan_proto,
+- outer_tag->vlan_id);
+- if (!skb) {
+- net_err_ratelimited("failed to insert outer VLAN tag\n");
+- return;
+- }
++ __vlan_hwaccel_put_tag(skb, outer_tag->vlan_proto,
++ outer_tag->vlan_id);
+ }
+
+ xmit:
+@@ -3799,7 +3795,8 @@ static inline int bond_slave_override(struct bonding *bond,
+ /* Find out if any slaves have the same mapping as this skb. */
+ bond_for_each_slave_rcu(bond, slave, iter) {
+ if (slave->queue_id == skb->queue_mapping) {
+- if (bond_slave_can_tx(slave)) {
++ if (bond_slave_is_up(slave) &&
++ slave->link == BOND_LINK_UP) {
+ bond_dev_queue_xmit(bond, skb, slave->dev);
+ return 0;
+ }
+diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c
+index 60f86bd0434a..9768ba6387ad 100644
+--- a/drivers/net/can/flexcan.c
++++ b/drivers/net/can/flexcan.c
+@@ -1224,12 +1224,19 @@ static int flexcan_probe(struct platform_device *pdev)
+ const struct flexcan_devtype_data *devtype_data;
+ struct net_device *dev;
+ struct flexcan_priv *priv;
++ struct regulator *reg_xceiver;
+ struct resource *mem;
+ struct clk *clk_ipg = NULL, *clk_per = NULL;
+ void __iomem *base;
+ int err, irq;
+ u32 clock_freq = 0;
+
++ reg_xceiver = devm_regulator_get(&pdev->dev, "xceiver");
++ if (PTR_ERR(reg_xceiver) == -EPROBE_DEFER)
++ return -EPROBE_DEFER;
++ else if (IS_ERR(reg_xceiver))
++ reg_xceiver = NULL;
++
+ if (pdev->dev.of_node)
+ of_property_read_u32(pdev->dev.of_node,
+ "clock-frequency", &clock_freq);
+@@ -1291,9 +1298,7 @@ static int flexcan_probe(struct platform_device *pdev)
+ priv->pdata = dev_get_platdata(&pdev->dev);
+ priv->devtype_data = devtype_data;
+
+- priv->reg_xceiver = devm_regulator_get(&pdev->dev, "xceiver");
+- if (IS_ERR(priv->reg_xceiver))
+- priv->reg_xceiver = NULL;
++ priv->reg_xceiver = reg_xceiver;
+
+ netif_napi_add(dev, &priv->napi, flexcan_poll, FLEXCAN_NAPI_WEIGHT);
+
+diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
+index c3a6072134f5..2559206d8704 100644
+--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
+@@ -531,20 +531,8 @@ struct bnx2x_fastpath {
+ struct napi_struct napi;
+
+ #ifdef CONFIG_NET_RX_BUSY_POLL
+- unsigned int state;
+-#define BNX2X_FP_STATE_IDLE 0
+-#define BNX2X_FP_STATE_NAPI (1 << 0) /* NAPI owns this FP */
+-#define BNX2X_FP_STATE_POLL (1 << 1) /* poll owns this FP */
+-#define BNX2X_FP_STATE_DISABLED (1 << 2)
+-#define BNX2X_FP_STATE_NAPI_YIELD (1 << 3) /* NAPI yielded this FP */
+-#define BNX2X_FP_STATE_POLL_YIELD (1 << 4) /* poll yielded this FP */
+-#define BNX2X_FP_OWNED (BNX2X_FP_STATE_NAPI | BNX2X_FP_STATE_POLL)
+-#define BNX2X_FP_YIELD (BNX2X_FP_STATE_NAPI_YIELD | BNX2X_FP_STATE_POLL_YIELD)
+-#define BNX2X_FP_LOCKED (BNX2X_FP_OWNED | BNX2X_FP_STATE_DISABLED)
+-#define BNX2X_FP_USER_PEND (BNX2X_FP_STATE_POLL | BNX2X_FP_STATE_POLL_YIELD)
+- /* protect state */
+- spinlock_t lock;
+-#endif /* CONFIG_NET_RX_BUSY_POLL */
++ unsigned long busy_poll_state;
++#endif
+
+ union host_hc_status_block status_blk;
+ /* chip independent shortcuts into sb structure */
+@@ -619,104 +607,83 @@ struct bnx2x_fastpath {
+ #define bnx2x_fp_qstats(bp, fp) (&((bp)->fp_stats[(fp)->index].eth_q_stats))
+
+ #ifdef CONFIG_NET_RX_BUSY_POLL
+-static inline void bnx2x_fp_init_lock(struct bnx2x_fastpath *fp)
++
++enum bnx2x_fp_state {
++ BNX2X_STATE_FP_NAPI = BIT(0), /* NAPI handler owns the queue */
++
++ BNX2X_STATE_FP_NAPI_REQ_BIT = 1, /* NAPI would like to own the queue */
++ BNX2X_STATE_FP_NAPI_REQ = BIT(1),
++
++ BNX2X_STATE_FP_POLL_BIT = 2,
++ BNX2X_STATE_FP_POLL = BIT(2), /* busy_poll owns the queue */
++
++ BNX2X_STATE_FP_DISABLE_BIT = 3, /* queue is dismantled */
++};
++
++static inline void bnx2x_fp_busy_poll_init(struct bnx2x_fastpath *fp)
+ {
+- spin_lock_init(&fp->lock);
+- fp->state = BNX2X_FP_STATE_IDLE;
++ WRITE_ONCE(fp->busy_poll_state, 0);
+ }
+
+ /* called from the device poll routine to get ownership of a FP */
+ static inline bool bnx2x_fp_lock_napi(struct bnx2x_fastpath *fp)
+ {
+- bool rc = true;
+-
+- spin_lock_bh(&fp->lock);
+- if (fp->state & BNX2X_FP_LOCKED) {
+- WARN_ON(fp->state & BNX2X_FP_STATE_NAPI);
+- fp->state |= BNX2X_FP_STATE_NAPI_YIELD;
+- rc = false;
+- } else {
+- /* we don't care if someone yielded */
+- fp->state = BNX2X_FP_STATE_NAPI;
++ unsigned long prev, old = READ_ONCE(fp->busy_poll_state);
++
++ while (1) {
++ switch (old) {
++ case BNX2X_STATE_FP_POLL:
++ /* make sure bnx2x_fp_lock_poll() wont starve us */
++ set_bit(BNX2X_STATE_FP_NAPI_REQ_BIT,
++ &fp->busy_poll_state);
++ /* fallthrough */
++ case BNX2X_STATE_FP_POLL | BNX2X_STATE_FP_NAPI_REQ:
++ return false;
++ default:
++ break;
++ }
++ prev = cmpxchg(&fp->busy_poll_state, old, BNX2X_STATE_FP_NAPI);
++ if (unlikely(prev != old)) {
++ old = prev;
++ continue;
++ }
++ return true;
+ }
+- spin_unlock_bh(&fp->lock);
+- return rc;
+ }
+
+-/* returns true is someone tried to get the FP while napi had it */
+-static inline bool bnx2x_fp_unlock_napi(struct bnx2x_fastpath *fp)
++static inline void bnx2x_fp_unlock_napi(struct bnx2x_fastpath *fp)
+ {
+- bool rc = false;
+-
+- spin_lock_bh(&fp->lock);
+- WARN_ON(fp->state &
+- (BNX2X_FP_STATE_POLL | BNX2X_FP_STATE_NAPI_YIELD));
+-
+- if (fp->state & BNX2X_FP_STATE_POLL_YIELD)
+- rc = true;
+-
+- /* state ==> idle, unless currently disabled */
+- fp->state &= BNX2X_FP_STATE_DISABLED;
+- spin_unlock_bh(&fp->lock);
+- return rc;
++ smp_wmb();
++ fp->busy_poll_state = 0;
+ }
+
+ /* called from bnx2x_low_latency_poll() */
+ static inline bool bnx2x_fp_lock_poll(struct bnx2x_fastpath *fp)
+ {
+- bool rc = true;
+-
+- spin_lock_bh(&fp->lock);
+- if ((fp->state & BNX2X_FP_LOCKED)) {
+- fp->state |= BNX2X_FP_STATE_POLL_YIELD;
+- rc = false;
+- } else {
+- /* preserve yield marks */
+- fp->state |= BNX2X_FP_STATE_POLL;
+- }
+- spin_unlock_bh(&fp->lock);
+- return rc;
++ return cmpxchg(&fp->busy_poll_state, 0, BNX2X_STATE_FP_POLL) == 0;
+ }
+
+-/* returns true if someone tried to get the FP while it was locked */
+-static inline bool bnx2x_fp_unlock_poll(struct bnx2x_fastpath *fp)
++static inline void bnx2x_fp_unlock_poll(struct bnx2x_fastpath *fp)
+ {
+- bool rc = false;
+-
+- spin_lock_bh(&fp->lock);
+- WARN_ON(fp->state & BNX2X_FP_STATE_NAPI);
+-
+- if (fp->state & BNX2X_FP_STATE_POLL_YIELD)
+- rc = true;
+-
+- /* state ==> idle, unless currently disabled */
+- fp->state &= BNX2X_FP_STATE_DISABLED;
+- spin_unlock_bh(&fp->lock);
+- return rc;
++ smp_mb__before_atomic();
++ clear_bit(BNX2X_STATE_FP_POLL_BIT, &fp->busy_poll_state);
+ }
+
+-/* true if a socket is polling, even if it did not get the lock */
++/* true if a socket is polling */
+ static inline bool bnx2x_fp_ll_polling(struct bnx2x_fastpath *fp)
+ {
+- WARN_ON(!(fp->state & BNX2X_FP_OWNED));
+- return fp->state & BNX2X_FP_USER_PEND;
++ return READ_ONCE(fp->busy_poll_state) & BNX2X_STATE_FP_POLL;
+ }
+
+ /* false if fp is currently owned */
+ static inline bool bnx2x_fp_ll_disable(struct bnx2x_fastpath *fp)
+ {
+- int rc = true;
+-
+- spin_lock_bh(&fp->lock);
+- if (fp->state & BNX2X_FP_OWNED)
+- rc = false;
+- fp->state |= BNX2X_FP_STATE_DISABLED;
+- spin_unlock_bh(&fp->lock);
++ set_bit(BNX2X_STATE_FP_DISABLE_BIT, &fp->busy_poll_state);
++ return !bnx2x_fp_ll_polling(fp);
+
+- return rc;
+ }
+ #else
+-static inline void bnx2x_fp_init_lock(struct bnx2x_fastpath *fp)
++static inline void bnx2x_fp_busy_poll_init(struct bnx2x_fastpath *fp)
+ {
+ }
+
+@@ -725,9 +692,8 @@ static inline bool bnx2x_fp_lock_napi(struct bnx2x_fastpath *fp)
+ return true;
+ }
+
+-static inline bool bnx2x_fp_unlock_napi(struct bnx2x_fastpath *fp)
++static inline void bnx2x_fp_unlock_napi(struct bnx2x_fastpath *fp)
+ {
+- return false;
+ }
+
+ static inline bool bnx2x_fp_lock_poll(struct bnx2x_fastpath *fp)
+@@ -735,9 +701,8 @@ static inline bool bnx2x_fp_lock_poll(struct bnx2x_fastpath *fp)
+ return false;
+ }
+
+-static inline bool bnx2x_fp_unlock_poll(struct bnx2x_fastpath *fp)
++static inline void bnx2x_fp_unlock_poll(struct bnx2x_fastpath *fp)
+ {
+- return false;
+ }
+
+ static inline bool bnx2x_fp_ll_polling(struct bnx2x_fastpath *fp)
+diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+index ec4cebabff49..e36e3a50b342 100644
+--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+@@ -1849,7 +1849,7 @@ static void bnx2x_napi_enable_cnic(struct bnx2x *bp)
+ int i;
+
+ for_each_rx_queue_cnic(bp, i) {
+- bnx2x_fp_init_lock(&bp->fp[i]);
++ bnx2x_fp_busy_poll_init(&bp->fp[i]);
+ napi_enable(&bnx2x_fp(bp, i, napi));
+ }
+ }
+@@ -1859,7 +1859,7 @@ static void bnx2x_napi_enable(struct bnx2x *bp)
+ int i;
+
+ for_each_eth_queue(bp, i) {
+- bnx2x_fp_init_lock(&bp->fp[i]);
++ bnx2x_fp_busy_poll_init(&bp->fp[i]);
+ napi_enable(&bnx2x_fp(bp, i, napi));
+ }
+ }
+@@ -3191,9 +3191,10 @@ static int bnx2x_poll(struct napi_struct *napi, int budget)
+ }
+ }
+
++ bnx2x_fp_unlock_napi(fp);
++
+ /* Fall out from the NAPI loop if needed */
+- if (!bnx2x_fp_unlock_napi(fp) &&
+- !(bnx2x_has_rx_work(fp) || bnx2x_has_tx_work(fp))) {
++ if (!(bnx2x_has_rx_work(fp) || bnx2x_has_tx_work(fp))) {
+
+ /* No need to update SB for FCoE L2 ring as long as
+ * it's connected to the default SB and the SB
+diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
+index 5748542f6717..a37800ecb27c 100644
+--- a/drivers/net/ethernet/broadcom/tg3.c
++++ b/drivers/net/ethernet/broadcom/tg3.c
+@@ -17840,8 +17840,10 @@ static int tg3_init_one(struct pci_dev *pdev,
+ */
+ if ((tr32(HOSTCC_MODE) & HOSTCC_MODE_ENABLE) ||
+ (tr32(WDMAC_MODE) & WDMAC_MODE_ENABLE)) {
++ tg3_full_lock(tp, 0);
+ tw32(MEMARB_MODE, MEMARB_MODE_ENABLE);
+ tg3_halt(tp, RESET_KIND_SHUTDOWN, 1);
++ tg3_full_unlock(tp);
+ }
+
+ err = tg3_test_dma(tp);
+diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c
+index d2975fa7e549..e51faf0ca989 100644
+--- a/drivers/net/ethernet/emulex/benet/be_main.c
++++ b/drivers/net/ethernet/emulex/benet/be_main.c
+@@ -887,7 +887,8 @@ static struct sk_buff *be_insert_vlan_in_pkt(struct be_adapter *adapter,
+ }
+
+ if (vlan_tag) {
+- skb = __vlan_put_tag(skb, htons(ETH_P_8021Q), vlan_tag);
++ skb = vlan_insert_tag_set_proto(skb, htons(ETH_P_8021Q),
++ vlan_tag);
+ if (unlikely(!skb))
+ return skb;
+ skb->vlan_tci = 0;
+@@ -896,7 +897,8 @@ static struct sk_buff *be_insert_vlan_in_pkt(struct be_adapter *adapter,
+ /* Insert the outer VLAN, if any */
+ if (adapter->qnq_vid) {
+ vlan_tag = adapter->qnq_vid;
+- skb = __vlan_put_tag(skb, htons(ETH_P_8021Q), vlan_tag);
++ skb = vlan_insert_tag_set_proto(skb, htons(ETH_P_8021Q),
++ vlan_tag);
+ if (unlikely(!skb))
+ return skb;
+ if (skip_hw_vlan)
+diff --git a/drivers/net/ethernet/mellanox/mlx4/cmd.c b/drivers/net/ethernet/mellanox/mlx4/cmd.c
+index b16e1b95566f..61ebb038fb75 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/cmd.c
++++ b/drivers/net/ethernet/mellanox/mlx4/cmd.c
+@@ -585,7 +585,8 @@ static int mlx4_cmd_wait(struct mlx4_dev *dev, u64 in_param, u64 *out_param,
+ * on the host, we deprecate the error message for this
+ * specific command/input_mod/opcode_mod/fw-status to be debug.
+ */
+- if (op == MLX4_CMD_SET_PORT && in_modifier == 1 &&
++ if (op == MLX4_CMD_SET_PORT &&
++ (in_modifier == 1 || in_modifier == 2) &&
+ op_modifier == 0 && context->fw_status == CMD_STAT_BAD_SIZE)
+ mlx4_dbg(dev, "command 0x%x failed: fw status = 0x%x\n",
+ op, context->fw_status);
+diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+index 6bdaa313e7ea..0207044f6d57 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
++++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+@@ -2606,13 +2606,6 @@ int mlx4_en_init_netdev(struct mlx4_en_dev *mdev, int port,
+ netif_carrier_off(dev);
+ mlx4_en_set_default_moderation(priv);
+
+- err = register_netdev(dev);
+- if (err) {
+- en_err(priv, "Netdev registration failed for port %d\n", port);
+- goto out;
+- }
+- priv->registered = 1;
+-
+ en_warn(priv, "Using %d TX rings\n", prof->tx_ring_num);
+ en_warn(priv, "Using %d RX rings\n", prof->rx_ring_num);
+
+@@ -2652,6 +2645,14 @@ int mlx4_en_init_netdev(struct mlx4_en_dev *mdev, int port,
+ queue_delayed_work(mdev->workqueue, &priv->service_task,
+ SERVICE_TASK_DELAY);
+
++ err = register_netdev(dev);
++ if (err) {
++ en_err(priv, "Netdev registration failed for port %d\n", port);
++ goto out;
++ }
++
++ priv->registered = 1;
++
+ return 0;
+
+ out:
+diff --git a/drivers/net/usb/asix_common.c b/drivers/net/usb/asix_common.c
+index 5c55f11572ba..75d6f26729a3 100644
+--- a/drivers/net/usb/asix_common.c
++++ b/drivers/net/usb/asix_common.c
+@@ -188,6 +188,8 @@ struct sk_buff *asix_tx_fixup(struct usbnet *dev, struct sk_buff *skb,
+ memcpy(skb_tail_pointer(skb), &padbytes, sizeof(padbytes));
+ skb_put(skb, sizeof(padbytes));
+ }
++
++ usbnet_set_skb_tx_stats(skb, 1, 0);
+ return skb;
+ }
+
+diff --git a/drivers/net/usb/cdc_mbim.c b/drivers/net/usb/cdc_mbim.c
+index 5ee7a1dbc023..96fc8a5bde84 100644
+--- a/drivers/net/usb/cdc_mbim.c
++++ b/drivers/net/usb/cdc_mbim.c
+@@ -402,7 +402,7 @@ static struct sk_buff *cdc_mbim_process_dgram(struct usbnet *dev, u8 *buf, size_
+
+ /* map MBIM session to VLAN */
+ if (tci)
+- vlan_put_tag(skb, htons(ETH_P_8021Q), tci);
++ __vlan_hwaccel_put_tag(skb, htons(ETH_P_8021Q), tci);
+ err:
+ return skb;
+ }
+diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c
+index 80a844e0ae03..c3e4da9e79ca 100644
+--- a/drivers/net/usb/cdc_ncm.c
++++ b/drivers/net/usb/cdc_ncm.c
+@@ -1172,17 +1172,17 @@ cdc_ncm_fill_tx_frame(struct usbnet *dev, struct sk_buff *skb, __le32 sign)
+
+ /* return skb */
+ ctx->tx_curr_skb = NULL;
+- dev->net->stats.tx_packets += ctx->tx_curr_frame_num;
+
+ /* keep private stats: framing overhead and number of NTBs */
+ ctx->tx_overhead += skb_out->len - ctx->tx_curr_frame_payload;
+ ctx->tx_ntbs++;
+
+- /* usbnet has already counted all the framing overhead.
++ /* usbnet will count all the framing overhead by default.
+ * Adjust the stats so that the tx_bytes counter show real
+ * payload data instead.
+ */
+- dev->net->stats.tx_bytes -= skb_out->len - ctx->tx_curr_frame_payload;
++ usbnet_set_skb_tx_stats(skb_out, n,
++ ctx->tx_curr_frame_payload - skb_out->len);
+
+ return skb_out;
+
+diff --git a/drivers/net/usb/sr9800.c b/drivers/net/usb/sr9800.c
+index b94a0fbb8b3b..953de13267df 100644
+--- a/drivers/net/usb/sr9800.c
++++ b/drivers/net/usb/sr9800.c
+@@ -144,6 +144,7 @@ static struct sk_buff *sr_tx_fixup(struct usbnet *dev, struct sk_buff *skb,
+ skb_put(skb, sizeof(padbytes));
+ }
+
++ usbnet_set_skb_tx_stats(skb, 1, 0);
+ return skb;
+ }
+
+diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
+index 3a6770a65d78..e7ed2513b1d1 100644
+--- a/drivers/net/usb/usbnet.c
++++ b/drivers/net/usb/usbnet.c
+@@ -1189,8 +1189,7 @@ static void tx_complete (struct urb *urb)
+ struct usbnet *dev = entry->dev;
+
+ if (urb->status == 0) {
+- if (!(dev->driver_info->flags & FLAG_MULTI_PACKET))
+- dev->net->stats.tx_packets++;
++ dev->net->stats.tx_packets += entry->packets;
+ dev->net->stats.tx_bytes += entry->length;
+ } else {
+ dev->net->stats.tx_errors++;
+@@ -1348,7 +1347,19 @@ netdev_tx_t usbnet_start_xmit (struct sk_buff *skb,
+ } else
+ urb->transfer_flags |= URB_ZERO_PACKET;
+ }
+- entry->length = urb->transfer_buffer_length = length;
++ urb->transfer_buffer_length = length;
++
++ if (info->flags & FLAG_MULTI_PACKET) {
++ /* Driver has set number of packets and a length delta.
++ * Calculate the complete length and ensure that it's
++ * positive.
++ */
++ entry->length += length;
++ if (WARN_ON_ONCE(entry->length <= 0))
++ entry->length = length;
++ } else {
++ usbnet_set_skb_tx_stats(skb, 1, length);
++ }
+
+ spin_lock_irqsave(&dev->txq.lock, flags);
+ retval = usb_autopm_get_interface_async(dev->intf);
+diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
+index 42b2d6a56d05..2826c5508762 100644
+--- a/drivers/net/vxlan.c
++++ b/drivers/net/vxlan.c
+@@ -1578,10 +1578,6 @@ static int vxlan6_xmit_skb(struct vxlan_sock *vs,
+ int err;
+ bool udp_sum = !udp_get_no_check6_tx(vs->sock->sk);
+
+- skb = udp_tunnel_handle_offloads(skb, udp_sum);
+- if (IS_ERR(skb))
+- return -EINVAL;
+-
+ skb_scrub_packet(skb, xnet);
+
+ min_headroom = LL_RESERVED_SPACE(dst->dev) + dst->header_len
+@@ -1590,16 +1586,21 @@ static int vxlan6_xmit_skb(struct vxlan_sock *vs,
+
+ /* Need space for new headers (invalidates iph ptr) */
+ err = skb_cow_head(skb, min_headroom);
+- if (unlikely(err))
+- return err;
++ if (unlikely(err)) {
++ kfree_skb(skb);
++ goto err;
++ }
+
+- if (vlan_tx_tag_present(skb)) {
+- if (WARN_ON(!__vlan_put_tag(skb,
+- skb->vlan_proto,
+- vlan_tx_tag_get(skb))))
+- return -ENOMEM;
++ skb = vlan_hwaccel_push_inside(skb);
++ if (WARN_ON(!skb)) {
++ err = -ENOMEM;
++ goto err;
++ }
+
+- skb->vlan_tci = 0;
++ skb = udp_tunnel_handle_offloads(skb, udp_sum);
++ if (IS_ERR(skb)) {
++ err = -EINVAL;
++ goto err;
+ }
+
+ vxh = (struct vxlanhdr *) __skb_push(skb, sizeof(*vxh));
+@@ -1611,6 +1612,9 @@ static int vxlan6_xmit_skb(struct vxlan_sock *vs,
+ udp_tunnel6_xmit_skb(vs->sock, dst, skb, dev, saddr, daddr, prio,
+ ttl, src_port, dst_port);
+ return 0;
++err:
++ dst_release(dst);
++ return err;
+ }
+ #endif
+
+@@ -1624,27 +1628,24 @@ int vxlan_xmit_skb(struct vxlan_sock *vs,
+ int err;
+ bool udp_sum = !vs->sock->sk->sk_no_check_tx;
+
+- skb = udp_tunnel_handle_offloads(skb, udp_sum);
+- if (IS_ERR(skb))
+- return -EINVAL;
+-
+ min_headroom = LL_RESERVED_SPACE(rt->dst.dev) + rt->dst.header_len
+ + VXLAN_HLEN + sizeof(struct iphdr)
+ + (vlan_tx_tag_present(skb) ? VLAN_HLEN : 0);
+
+ /* Need space for new headers (invalidates iph ptr) */
+ err = skb_cow_head(skb, min_headroom);
+- if (unlikely(err))
++ if (unlikely(err)) {
++ kfree_skb(skb);
+ return err;
++ }
+
+- if (vlan_tx_tag_present(skb)) {
+- if (WARN_ON(!__vlan_put_tag(skb,
+- skb->vlan_proto,
+- vlan_tx_tag_get(skb))))
+- return -ENOMEM;
++ skb = vlan_hwaccel_push_inside(skb);
++ if (WARN_ON(!skb))
++ return -ENOMEM;
+
+- skb->vlan_tci = 0;
+- }
++ skb = udp_tunnel_handle_offloads(skb, udp_sum);
++ if (IS_ERR(skb))
++ return PTR_ERR(skb);
+
+ vxh = (struct vxlanhdr *) __skb_push(skb, sizeof(*vxh));
+ vxh->vx_flags = htonl(VXLAN_FLAGS);
+@@ -1786,9 +1787,12 @@ static void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev,
+ tos, ttl, df, src_port, dst_port,
+ htonl(vni << 8),
+ !net_eq(vxlan->net, dev_net(vxlan->dev)));
+-
+- if (err < 0)
++ if (err < 0) {
++ /* skb is already freed. */
++ skb = NULL;
+ goto rt_tx_error;
++ }
++
+ iptunnel_xmit_stats(err, &dev->stats, dev->tstats);
+ #if IS_ENABLED(CONFIG_IPV6)
+ } else {
+diff --git a/drivers/net/wireless/ath/ath9k/beacon.c b/drivers/net/wireless/ath/ath9k/beacon.c
+index ecb783beeec2..9ee8ed0ffb94 100644
+--- a/drivers/net/wireless/ath/ath9k/beacon.c
++++ b/drivers/net/wireless/ath/ath9k/beacon.c
+@@ -218,12 +218,15 @@ void ath9k_beacon_remove_slot(struct ath_softc *sc, struct ieee80211_vif *vif)
+ struct ath_common *common = ath9k_hw_common(sc->sc_ah);
+ struct ath_vif *avp = (void *)vif->drv_priv;
+ struct ath_buf *bf = avp->av_bcbuf;
++ struct ath_beacon_config *cur_conf = &sc->cur_chan->beacon;
+
+ ath_dbg(common, CONFIG, "Removing interface at beacon slot: %d\n",
+ avp->av_bslot);
+
+ tasklet_disable(&sc->bcon_tasklet);
+
++ cur_conf->enable_beacon &= ~BIT(avp->av_bslot);
++
+ if (bf && bf->bf_mpdu) {
+ struct sk_buff *skb = bf->bf_mpdu;
+ dma_unmap_single(sc->dev, bf->bf_buf_addr,
+@@ -520,8 +523,7 @@ static bool ath9k_allow_beacon_config(struct ath_softc *sc,
+ }
+
+ if (sc->sc_ah->opmode == NL80211_IFTYPE_AP) {
+- if ((vif->type != NL80211_IFTYPE_AP) ||
+- (sc->nbcnvifs > 1)) {
++ if (vif->type != NL80211_IFTYPE_AP) {
+ ath_dbg(common, CONFIG,
+ "An AP interface is already present !\n");
+ return false;
+@@ -615,12 +617,14 @@ void ath9k_beacon_config(struct ath_softc *sc, struct ieee80211_vif *vif,
+ * enabling/disabling SWBA.
+ */
+ if (changed & BSS_CHANGED_BEACON_ENABLED) {
+- if (!bss_conf->enable_beacon &&
+- (sc->nbcnvifs <= 1)) {
+- cur_conf->enable_beacon = false;
+- } else if (bss_conf->enable_beacon) {
+- cur_conf->enable_beacon = true;
+- ath9k_cache_beacon_config(sc, ctx, bss_conf);
++ bool enabled = cur_conf->enable_beacon;
++
++ if (!bss_conf->enable_beacon) {
++ cur_conf->enable_beacon &= ~BIT(avp->av_bslot);
++ } else {
++ cur_conf->enable_beacon |= BIT(avp->av_bslot);
++ if (!enabled)
++ ath9k_cache_beacon_config(sc, ctx, bss_conf);
+ }
+ }
+
+diff --git a/drivers/net/wireless/ath/ath9k/common.h b/drivers/net/wireless/ath/ath9k/common.h
+index ffc454b18637..81899e7e2a20 100644
+--- a/drivers/net/wireless/ath/ath9k/common.h
++++ b/drivers/net/wireless/ath/ath9k/common.h
+@@ -53,7 +53,7 @@ struct ath_beacon_config {
+ u16 dtim_period;
+ u16 bmiss_timeout;
+ u8 dtim_count;
+- bool enable_beacon;
++ u8 enable_beacon;
+ bool ibss_creator;
+ u32 nexttbtt;
+ u32 intval;
+diff --git a/drivers/net/wireless/iwlwifi/dvm/dev.h b/drivers/net/wireless/iwlwifi/dvm/dev.h
+index a6f22c32a279..3811878ab9cd 100644
+--- a/drivers/net/wireless/iwlwifi/dvm/dev.h
++++ b/drivers/net/wireless/iwlwifi/dvm/dev.h
+@@ -708,7 +708,6 @@ struct iwl_priv {
+ unsigned long reload_jiffies;
+ int reload_count;
+ bool ucode_loaded;
+- bool init_ucode_run; /* Don't run init uCode again */
+
+ u8 plcp_delta_threshold;
+
+diff --git a/drivers/net/wireless/iwlwifi/dvm/ucode.c b/drivers/net/wireless/iwlwifi/dvm/ucode.c
+index d5cee1530597..80b8094deed1 100644
+--- a/drivers/net/wireless/iwlwifi/dvm/ucode.c
++++ b/drivers/net/wireless/iwlwifi/dvm/ucode.c
+@@ -418,9 +418,6 @@ int iwl_run_init_ucode(struct iwl_priv *priv)
+ if (!priv->fw->img[IWL_UCODE_INIT].sec[0].len)
+ return 0;
+
+- if (priv->init_ucode_run)
+- return 0;
+-
+ iwl_init_notification_wait(&priv->notif_wait, &calib_wait,
+ calib_complete, ARRAY_SIZE(calib_complete),
+ iwlagn_wait_calib, priv);
+@@ -440,8 +437,6 @@ int iwl_run_init_ucode(struct iwl_priv *priv)
+ */
+ ret = iwl_wait_notification(&priv->notif_wait, &calib_wait,
+ UCODE_CALIB_TIMEOUT);
+- if (!ret)
+- priv->init_ucode_run = true;
+
+ goto out;
+
+diff --git a/drivers/net/wireless/rtlwifi/pci.c b/drivers/net/wireless/rtlwifi/pci.c
+index e25faacf58b7..a5186bb7c63e 100644
+--- a/drivers/net/wireless/rtlwifi/pci.c
++++ b/drivers/net/wireless/rtlwifi/pci.c
+@@ -1118,12 +1118,22 @@ static void _rtl_pci_prepare_bcn_tasklet(struct ieee80211_hw *hw)
+ /*This is for new trx flow*/
+ struct rtl_tx_buffer_desc *pbuffer_desc = NULL;
+ u8 temp_one = 1;
++ u8 *entry;
+
+ memset(&tcb_desc, 0, sizeof(struct rtl_tcb_desc));
+ ring = &rtlpci->tx_ring[BEACON_QUEUE];
+ pskb = __skb_dequeue(&ring->queue);
+- if (pskb)
++ if (rtlpriv->use_new_trx_flow)
++ entry = (u8 *)(&ring->buffer_desc[ring->idx]);
++ else
++ entry = (u8 *)(&ring->desc[ring->idx]);
++ if (pskb) {
++ pci_unmap_single(rtlpci->pdev,
++ rtlpriv->cfg->ops->get_desc(
++ (u8 *)entry, true, HW_DESC_TXBUFF_ADDR),
++ pskb->len, PCI_DMA_TODEVICE);
+ kfree_skb(pskb);
++ }
+
+ /*NB: the beacon data buffer must be 32-bit aligned. */
+ pskb = ieee80211_beacon_get(hw, mac->vif);
+diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
+index eeed0ce620f3..2b0b4e62f171 100644
+--- a/drivers/net/xen-netfront.c
++++ b/drivers/net/xen-netfront.c
+@@ -1098,8 +1098,7 @@ err:
+
+ static int xennet_change_mtu(struct net_device *dev, int mtu)
+ {
+- int max = xennet_can_sg(dev) ?
+- XEN_NETIF_MAX_TX_SIZE - MAX_TCP_HEADER : ETH_DATA_LEN;
++ int max = xennet_can_sg(dev) ? XEN_NETIF_MAX_TX_SIZE : ETH_DATA_LEN;
+
+ if (mtu > max)
+ return -EINVAL;
+@@ -1353,8 +1352,6 @@ static struct net_device *xennet_create_dev(struct xenbus_device *dev)
+ netdev->ethtool_ops = &xennet_ethtool_ops;
+ SET_NETDEV_DEV(netdev, &dev->dev);
+
+- netif_set_gso_max_size(netdev, XEN_NETIF_MAX_TX_SIZE - MAX_TCP_HEADER);
+-
+ np->netdev = netdev;
+
+ netif_carrier_off(netdev);
+diff --git a/drivers/of/address.c b/drivers/of/address.c
+index 06af494184d6..216b00d99bd8 100644
+--- a/drivers/of/address.c
++++ b/drivers/of/address.c
+@@ -450,12 +450,17 @@ static struct of_bus *of_match_bus(struct device_node *np)
+ return NULL;
+ }
+
+-static int of_empty_ranges_quirk(void)
++static int of_empty_ranges_quirk(struct device_node *np)
+ {
+ if (IS_ENABLED(CONFIG_PPC)) {
+- /* To save cycles, we cache the result */
++ /* To save cycles, we cache the result for global "Mac" setting */
+ static int quirk_state = -1;
+
++ /* PA-SEMI sdc DT bug */
++ if (of_device_is_compatible(np, "1682m-sdc"))
++ return true;
++
++ /* Make quirk cached */
+ if (quirk_state < 0)
+ quirk_state =
+ of_machine_is_compatible("Power Macintosh") ||
+@@ -490,7 +495,7 @@ static int of_translate_one(struct device_node *parent, struct of_bus *bus,
+ * This code is only enabled on powerpc. --gcl
+ */
+ ranges = of_get_property(parent, rprop, &rlen);
+- if (ranges == NULL && !of_empty_ranges_quirk()) {
++ if (ranges == NULL && !of_empty_ranges_quirk(parent)) {
+ pr_err("OF: no ranges; cannot translate\n");
+ return 1;
+ }
+diff --git a/drivers/pci/host/pcie-designware.c b/drivers/pci/host/pcie-designware.c
+index f0fcbceee209..f69b0d0a5ee1 100644
+--- a/drivers/pci/host/pcie-designware.c
++++ b/drivers/pci/host/pcie-designware.c
+@@ -342,7 +342,7 @@ static const struct irq_domain_ops msi_domain_ops = {
+ .map = dw_pcie_msi_map,
+ };
+
+-int __init dw_pcie_host_init(struct pcie_port *pp)
++int dw_pcie_host_init(struct pcie_port *pp)
+ {
+ struct device_node *np = pp->dev->of_node;
+ struct platform_device *pdev = to_platform_device(pp->dev);
+diff --git a/drivers/pci/host/pcie-spear13xx.c b/drivers/pci/host/pcie-spear13xx.c
+index 85f594e1708f..b4ba6ff56cf6 100644
+--- a/drivers/pci/host/pcie-spear13xx.c
++++ b/drivers/pci/host/pcie-spear13xx.c
+@@ -298,7 +298,7 @@ static int add_pcie_port(struct pcie_port *pp, struct platform_device *pdev)
+ return 0;
+ }
+
+-static int __init spear13xx_pcie_probe(struct platform_device *pdev)
++static int spear13xx_pcie_probe(struct platform_device *pdev)
+ {
+ struct spear13xx_pcie *spear13xx_pcie;
+ struct pcie_port *pp;
+@@ -371,7 +371,7 @@ static const struct of_device_id spear13xx_pcie_of_match[] = {
+ };
+ MODULE_DEVICE_TABLE(of, spear13xx_pcie_of_match);
+
+-static struct platform_driver spear13xx_pcie_driver __initdata = {
++static struct platform_driver spear13xx_pcie_driver = {
+ .probe = spear13xx_pcie_probe,
+ .driver = {
+ .name = "spear-pcie",
+diff --git a/drivers/pci/hotplug/cpci_hotplug_pci.c b/drivers/pci/hotplug/cpci_hotplug_pci.c
+index 7d48ecae6695..788db48dbbad 100644
+--- a/drivers/pci/hotplug/cpci_hotplug_pci.c
++++ b/drivers/pci/hotplug/cpci_hotplug_pci.c
+@@ -286,11 +286,12 @@ int cpci_configure_slot(struct slot *slot)
+ }
+ parent = slot->dev->bus;
+
+- list_for_each_entry(dev, &parent->devices, bus_list)
++ list_for_each_entry(dev, &parent->devices, bus_list) {
+ if (PCI_SLOT(dev->devfn) != PCI_SLOT(slot->devfn))
+ continue;
+ if (pci_is_bridge(dev))
+ pci_hp_add_bridge(dev);
++ }
+
+
+ pci_assign_unassigned_bridge_resources(parent->self);
+diff --git a/drivers/pci/pci-acpi.c b/drivers/pci/pci-acpi.c
+index 6ebf8edc5f3c..09499548d42a 100644
+--- a/drivers/pci/pci-acpi.c
++++ b/drivers/pci/pci-acpi.c
+@@ -248,6 +248,9 @@ int pci_get_hp_params(struct pci_dev *dev, struct hotplug_params *hpp)
+ acpi_handle handle, phandle;
+ struct pci_bus *pbus;
+
++ if (acpi_pci_disabled)
++ return -ENODEV;
++
+ handle = NULL;
+ for (pbus = dev->bus; pbus; pbus = pbus->parent) {
+ handle = acpi_pci_get_bridge_handle(pbus);
+diff --git a/drivers/pci/pcie/aer/aerdrv_errprint.c b/drivers/pci/pcie/aer/aerdrv_errprint.c
+index c6849d9e86ce..167fe411ce2e 100644
+--- a/drivers/pci/pcie/aer/aerdrv_errprint.c
++++ b/drivers/pci/pcie/aer/aerdrv_errprint.c
+@@ -132,16 +132,8 @@ static const char *aer_agent_string[] = {
+ static void __print_tlp_header(struct pci_dev *dev,
+ struct aer_header_log_regs *t)
+ {
+- unsigned char *tlp = (unsigned char *)&t;
+-
+- dev_err(&dev->dev, " TLP Header:"
+- " %02x%02x%02x%02x %02x%02x%02x%02x"
+- " %02x%02x%02x%02x %02x%02x%02x%02x\n",
+- *(tlp + 3), *(tlp + 2), *(tlp + 1), *tlp,
+- *(tlp + 7), *(tlp + 6), *(tlp + 5), *(tlp + 4),
+- *(tlp + 11), *(tlp + 10), *(tlp + 9),
+- *(tlp + 8), *(tlp + 15), *(tlp + 14),
+- *(tlp + 13), *(tlp + 12));
++ dev_err(&dev->dev, " TLP Header: %08x %08x %08x %08x\n",
++ t->dw0, t->dw1, t->dw2, t->dw3);
+ }
+
+ static void __aer_print_error(struct pci_dev *dev,
+diff --git a/drivers/scsi/be2iscsi/be_main.c b/drivers/scsi/be2iscsi/be_main.c
+index 15a8998bd161..be4586b788d1 100644
+--- a/drivers/scsi/be2iscsi/be_main.c
++++ b/drivers/scsi/be2iscsi/be_main.c
+@@ -5735,9 +5735,9 @@ free_port:
+ hba_free:
+ if (phba->msix_enabled)
+ pci_disable_msix(phba->pcidev);
+- iscsi_host_remove(phba->shost);
+ pci_dev_put(phba->pcidev);
+ iscsi_host_free(phba->shost);
++ pci_set_drvdata(pcidev, NULL);
+ disable_pci:
+ pci_disable_device(pcidev);
+ return ret;
+diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
+index 17fb0518c9c1..b1ab509d0e05 100644
+--- a/drivers/scsi/scsi_lib.c
++++ b/drivers/scsi/scsi_lib.c
+@@ -1299,9 +1299,11 @@ scsi_prep_state_check(struct scsi_device *sdev, struct request *req)
+ "rejecting I/O to dead device\n");
+ ret = BLKPREP_KILL;
+ break;
+- case SDEV_QUIESCE:
+ case SDEV_BLOCK:
+ case SDEV_CREATED_BLOCK:
++ ret = BLKPREP_DEFER;
++ break;
++ case SDEV_QUIESCE:
+ /*
+ * If the devices is blocked we defer normal commands.
+ */
+diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
+index 6446490854cb..2eb6fa8e645e 100644
+--- a/drivers/target/iscsi/iscsi_target.c
++++ b/drivers/target/iscsi/iscsi_target.c
+@@ -1184,7 +1184,7 @@ iscsit_handle_scsi_cmd(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
+ * traditional iSCSI block I/O.
+ */
+ if (iscsit_allocate_iovecs(cmd) < 0) {
+- return iscsit_add_reject_cmd(cmd,
++ return iscsit_reject_cmd(cmd,
+ ISCSI_REASON_BOOKMARK_NO_RESOURCES, buf);
+ }
+ immed_data = cmd->immediate_data;
+diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c
+index 47ca0f3b8c85..72824659f628 100644
+--- a/drivers/tty/n_tty.c
++++ b/drivers/tty/n_tty.c
+@@ -247,8 +247,6 @@ static void n_tty_write_wakeup(struct tty_struct *tty)
+
+ static void n_tty_check_throttle(struct tty_struct *tty)
+ {
+- if (tty->driver->type == TTY_DRIVER_TYPE_PTY)
+- return;
+ /*
+ * Check the remaining room for the input canonicalization
+ * mode. We don't want to throttle the driver if we're in
+@@ -1512,23 +1510,6 @@ n_tty_receive_char_lnext(struct tty_struct *tty, unsigned char c, char flag)
+ n_tty_receive_char_flagged(tty, c, flag);
+ }
+
+-/**
+- * n_tty_receive_buf - data receive
+- * @tty: terminal device
+- * @cp: buffer
+- * @fp: flag buffer
+- * @count: characters
+- *
+- * Called by the terminal driver when a block of characters has
+- * been received. This function must be called from soft contexts
+- * not from interrupt context. The driver is responsible for making
+- * calls one at a time and in order (or using flush_to_ldisc)
+- *
+- * n_tty_receive_buf()/producer path:
+- * claims non-exclusive termios_rwsem
+- * publishes read_head and canon_head
+- */
+-
+ static void
+ n_tty_receive_buf_real_raw(struct tty_struct *tty, const unsigned char *cp,
+ char *fp, int count)
+@@ -1684,24 +1665,85 @@ static void __receive_buf(struct tty_struct *tty, const unsigned char *cp,
+ }
+ }
+
++/**
++ * n_tty_receive_buf_common - process input
++ * @tty: device to receive input
++ * @cp: input chars
++ * @fp: flags for each char (if NULL, all chars are TTY_NORMAL)
++ * @count: number of input chars in @cp
++ *
++ * Called by the terminal driver when a block of characters has
++ * been received. This function must be called from soft contexts
++ * not from interrupt context. The driver is responsible for making
++ * calls one at a time and in order (or using flush_to_ldisc)
++ *
++ * Returns the # of input chars from @cp which were processed.
++ *
++ * In canonical mode, the maximum line length is 4096 chars (including
++ * the line termination char); lines longer than 4096 chars are
++ * truncated. After 4095 chars, input data is still processed but
++ * not stored. Overflow processing ensures the tty can always
++ * receive more input until at least one line can be read.
++ *
++ * In non-canonical mode, the read buffer will only accept 4095 chars;
++ * this provides the necessary space for a newline char if the input
++ * mode is switched to canonical.
++ *
++ * Note it is possible for the read buffer to _contain_ 4096 chars
++ * in non-canonical mode: the read buffer could already contain the
++ * maximum canon line of 4096 chars when the mode is switched to
++ * non-canonical.
++ *
++ * n_tty_receive_buf()/producer path:
++ * claims non-exclusive termios_rwsem
++ * publishes commit_head or canon_head
++ */
+ static int
+ n_tty_receive_buf_common(struct tty_struct *tty, const unsigned char *cp,
+ char *fp, int count, int flow)
+ {
+ struct n_tty_data *ldata = tty->disc_data;
+- int room, n, rcvd = 0;
++ int room, n, rcvd = 0, overflow;
+
+ down_read(&tty->termios_rwsem);
+
+ while (1) {
+- room = receive_room(tty);
++ /*
++ * When PARMRK is set, each input char may take up to 3 chars
++ * in the read buf; reduce the buffer space avail by 3x
++ *
++ * If we are doing input canonicalization, and there are no
++ * pending newlines, let characters through without limit, so
++ * that erase characters will be handled. Other excess
++ * characters will be beeped.
++ *
++ * paired with store in *_copy_from_read_buf() -- guarantees
++ * the consumer has loaded the data in read_buf up to the new
++ * read_tail (so this producer will not overwrite unread data)
++ */
++ size_t tail = ldata->read_tail;
++
++ room = N_TTY_BUF_SIZE - (ldata->read_head - tail);
++ if (I_PARMRK(tty))
++ room = (room + 2) / 3;
++ room--;
++ if (room <= 0) {
++ overflow = ldata->icanon && ldata->canon_head == tail;
++ if (overflow && room < 0)
++ ldata->read_head--;
++ room = overflow;
++ ldata->no_room = flow && !room;
++ } else
++ overflow = 0;
++
+ n = min(count, room);
+- if (!n) {
+- if (flow && !room)
+- ldata->no_room = 1;
++ if (!n)
+ break;
+- }
+- __receive_buf(tty, cp, fp, n);
++
++ /* ignore parity errors if handling overflow */
++ if (!overflow || !fp || *fp != TTY_PARITY)
++ __receive_buf(tty, cp, fp, n);
++
+ cp += n;
+ if (fp)
+ fp += n;
+@@ -1710,7 +1752,17 @@ n_tty_receive_buf_common(struct tty_struct *tty, const unsigned char *cp,
+ }
+
+ tty->receive_room = room;
+- n_tty_check_throttle(tty);
++
++ /* Unthrottle if handling overflow on pty */
++ if (tty->driver->type == TTY_DRIVER_TYPE_PTY) {
++ if (overflow) {
++ tty_set_flow_change(tty, TTY_UNTHROTTLE_SAFE);
++ tty_unthrottle_safe(tty);
++ __tty_set_flow_change(tty, 0);
++ }
++ } else
++ n_tty_check_throttle(tty);
++
+ up_read(&tty->termios_rwsem);
+
+ return rcvd;
+diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c
+index eb9bc7e1dbaa..1883478d6a8d 100644
+--- a/drivers/tty/serial/fsl_lpuart.c
++++ b/drivers/tty/serial/fsl_lpuart.c
+@@ -910,6 +910,9 @@ static void lpuart_setup_watermark(struct lpuart_port *sport)
+ writeb(val | UARTPFIFO_TXFE | UARTPFIFO_RXFE,
+ sport->port.membase + UARTPFIFO);
+
++ /* explicitly clear RDRF */
++ readb(sport->port.membase + UARTSR1);
++
+ /* flush Tx and Rx FIFO */
+ writeb(UARTCFIFO_TXFLUSH | UARTCFIFO_RXFLUSH,
+ sport->port.membase + UARTCFIFO);
+@@ -1095,6 +1098,8 @@ static int lpuart_startup(struct uart_port *port)
+ sport->txfifo_size = 0x1 << (((temp >> UARTPFIFO_TXSIZE_OFF) &
+ UARTPFIFO_FIFOSIZE_MASK) + 1);
+
++ sport->port.fifosize = sport->txfifo_size;
++
+ sport->rxfifo_size = 0x1 << (((temp >> UARTPFIFO_RXSIZE_OFF) &
+ UARTPFIFO_FIFOSIZE_MASK) + 1);
+
+diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
+index 388cfd83b6b6..7ff97c39c8b4 100644
+--- a/drivers/usb/host/xhci-hub.c
++++ b/drivers/usb/host/xhci-hub.c
+@@ -387,6 +387,10 @@ static void xhci_clear_port_change_bit(struct xhci_hcd *xhci, u16 wValue,
+ status = PORT_PLC;
+ port_change_bit = "link state";
+ break;
++ case USB_PORT_FEAT_C_PORT_CONFIG_ERROR:
++ status = PORT_CEC;
++ port_change_bit = "config error";
++ break;
+ default:
+ /* Should never happen */
+ return;
+@@ -588,6 +592,8 @@ static u32 xhci_get_port_status(struct usb_hcd *hcd,
+ status |= USB_PORT_STAT_C_LINK_STATE << 16;
+ if ((raw_port_status & PORT_WRC))
+ status |= USB_PORT_STAT_C_BH_RESET << 16;
++ if ((raw_port_status & PORT_CEC))
++ status |= USB_PORT_STAT_C_CONFIG_ERROR << 16;
+ }
+
+ if (hcd->speed != HCD_USB3) {
+@@ -1005,6 +1011,7 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
+ case USB_PORT_FEAT_C_OVER_CURRENT:
+ case USB_PORT_FEAT_C_ENABLE:
+ case USB_PORT_FEAT_C_PORT_LINK_STATE:
++ case USB_PORT_FEAT_C_PORT_CONFIG_ERROR:
+ xhci_clear_port_change_bit(xhci, wValue, wIndex,
+ port_array[wIndex], temp);
+ break;
+@@ -1069,7 +1076,7 @@ int xhci_hub_status_data(struct usb_hcd *hcd, char *buf)
+ */
+ status = bus_state->resuming_ports;
+
+- mask = PORT_CSC | PORT_PEC | PORT_OCC | PORT_PLC | PORT_WRC;
++ mask = PORT_CSC | PORT_PEC | PORT_OCC | PORT_PLC | PORT_WRC | PORT_CEC;
+
+ spin_lock_irqsave(&xhci->lock, flags);
+ /* For each port, did anything change? If so, set that bit in buf. */
+diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
+index fd53c9ebd662..2af32e26fafc 100644
+--- a/drivers/usb/host/xhci-pci.c
++++ b/drivers/usb/host/xhci-pci.c
+@@ -115,6 +115,7 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
+ if (pdev->vendor == PCI_VENDOR_ID_INTEL) {
+ xhci->quirks |= XHCI_LPM_SUPPORT;
+ xhci->quirks |= XHCI_INTEL_HOST;
++ xhci->quirks |= XHCI_AVOID_BEI;
+ }
+ if (pdev->vendor == PCI_VENDOR_ID_INTEL &&
+ pdev->device == PCI_DEVICE_ID_INTEL_PANTHERPOINT_XHCI) {
+@@ -130,7 +131,6 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
+ * PPT chipsets.
+ */
+ xhci->quirks |= XHCI_SPURIOUS_REBOOT;
+- xhci->quirks |= XHCI_AVOID_BEI;
+ }
+ if (pdev->vendor == PCI_VENDOR_ID_INTEL &&
+ pdev->device == PCI_DEVICE_ID_INTEL_LYNXPOINT_LP_XHCI) {
+diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
+index 3086dec0ef53..8eb68a31cab6 100644
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -604,6 +604,7 @@ static const struct usb_device_id id_table_combined[] = {
+ .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
+ { USB_DEVICE(FTDI_VID, FTDI_NT_ORIONLXM_PID),
+ .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
++ { USB_DEVICE(FTDI_VID, FTDI_SYNAPSE_SS200_PID) },
+ /*
+ * ELV devices:
+ */
+@@ -1883,8 +1884,12 @@ static int ftdi_8u2232c_probe(struct usb_serial *serial)
+ {
+ struct usb_device *udev = serial->dev;
+
+- if ((udev->manufacturer && !strcmp(udev->manufacturer, "CALAO Systems")) ||
+- (udev->product && !strcmp(udev->product, "BeagleBone/XDS100V2")))
++ if (udev->manufacturer && !strcmp(udev->manufacturer, "CALAO Systems"))
++ return ftdi_jtag_probe(serial);
++
++ if (udev->product &&
++ (!strcmp(udev->product, "BeagleBone/XDS100V2") ||
++ !strcmp(udev->product, "SNAP Connect E10")))
+ return ftdi_jtag_probe(serial);
+
+ return 0;
+diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
+index 56b1b55c4751..4e4f46f3c89c 100644
+--- a/drivers/usb/serial/ftdi_sio_ids.h
++++ b/drivers/usb/serial/ftdi_sio_ids.h
+@@ -561,6 +561,12 @@
+ */
+ #define FTDI_NT_ORIONLXM_PID 0x7c90 /* OrionLXm Substation Automation Platform */
+
++/*
++ * Synapse Wireless product ids (FTDI_VID)
++ * http://www.synapse-wireless.com
++ */
++#define FTDI_SYNAPSE_SS200_PID 0x9090 /* SS200 - SNAP Stick 200 */
++
+
+ /********************************/
+ /** third-party VID/PID combos **/
+diff --git a/drivers/usb/serial/generic.c b/drivers/usb/serial/generic.c
+index 904ab353ecf2..c44b911937e8 100644
+--- a/drivers/usb/serial/generic.c
++++ b/drivers/usb/serial/generic.c
+@@ -374,7 +374,7 @@ void usb_serial_generic_read_bulk_callback(struct urb *urb)
+ __func__, urb->status);
+ return;
+ default:
+- dev_err(&port->dev, "%s - nonzero urb status: %d\n",
++ dev_dbg(&port->dev, "%s - nonzero urb status: %d\n",
+ __func__, urb->status);
+ goto resubmit;
+ }
+diff --git a/drivers/usb/serial/keyspan_pda.c b/drivers/usb/serial/keyspan_pda.c
+index 742d827f876c..04a217af29b7 100644
+--- a/drivers/usb/serial/keyspan_pda.c
++++ b/drivers/usb/serial/keyspan_pda.c
+@@ -61,6 +61,7 @@ struct keyspan_pda_private {
+ /* For Xircom PGSDB9 and older Entregra version of the same device */
+ #define XIRCOM_VENDOR_ID 0x085a
+ #define XIRCOM_FAKE_ID 0x8027
++#define XIRCOM_FAKE_ID_2 0x8025 /* "PGMFHUB" serial */
+ #define ENTREGRA_VENDOR_ID 0x1645
+ #define ENTREGRA_FAKE_ID 0x8093
+
+@@ -70,6 +71,7 @@ static const struct usb_device_id id_table_combined[] = {
+ #endif
+ #ifdef XIRCOM
+ { USB_DEVICE(XIRCOM_VENDOR_ID, XIRCOM_FAKE_ID) },
++ { USB_DEVICE(XIRCOM_VENDOR_ID, XIRCOM_FAKE_ID_2) },
+ { USB_DEVICE(ENTREGRA_VENDOR_ID, ENTREGRA_FAKE_ID) },
+ #endif
+ { USB_DEVICE(KEYSPAN_VENDOR_ID, KEYSPAN_PDA_ID) },
+@@ -93,6 +95,7 @@ static const struct usb_device_id id_table_fake[] = {
+ #ifdef XIRCOM
+ static const struct usb_device_id id_table_fake_xircom[] = {
+ { USB_DEVICE(XIRCOM_VENDOR_ID, XIRCOM_FAKE_ID) },
++ { USB_DEVICE(XIRCOM_VENDOR_ID, XIRCOM_FAKE_ID_2) },
+ { USB_DEVICE(ENTREGRA_VENDOR_ID, ENTREGRA_FAKE_ID) },
+ { }
+ };
+diff --git a/drivers/xen/balloon.c b/drivers/xen/balloon.c
+index 3860d02729dc..a325814341b7 100644
+--- a/drivers/xen/balloon.c
++++ b/drivers/xen/balloon.c
+@@ -230,6 +230,29 @@ static enum bp_state reserve_additional_memory(long credit)
+ balloon_hotplug = round_up(balloon_hotplug, PAGES_PER_SECTION);
+ nid = memory_add_physaddr_to_nid(hotplug_start_paddr);
+
++#ifdef CONFIG_XEN_HAVE_PVMMU
++ /*
++ * add_memory() will build page tables for the new memory so
++ * the p2m must contain invalid entries so the correct
++ * non-present PTEs will be written.
++ *
++ * If a failure occurs, the original (identity) p2m entries
++ * are not restored since this region is now known not to
++ * conflict with any devices.
++ */
++ if (!xen_feature(XENFEAT_auto_translated_physmap)) {
++ unsigned long pfn, i;
++
++ pfn = PFN_DOWN(hotplug_start_paddr);
++ for (i = 0; i < balloon_hotplug; i++) {
++ if (!set_phys_to_machine(pfn + i, INVALID_P2M_ENTRY)) {
++ pr_warn("set_phys_to_machine() failed, no memory added\n");
++ return BP_ECANCELED;
++ }
++ }
++ }
++#endif
++
+ rc = add_memory(nid, hotplug_start_paddr, balloon_hotplug << PAGE_SHIFT);
+
+ if (rc) {
+diff --git a/fs/aio.c b/fs/aio.c
+index 14b93159ef83..58caa7e5d81c 100644
+--- a/fs/aio.c
++++ b/fs/aio.c
+@@ -715,6 +715,9 @@ static struct kioctx *ioctx_alloc(unsigned nr_events)
+ err_cleanup:
+ aio_nr_sub(ctx->max_reqs);
+ err_ctx:
++ atomic_set(&ctx->dead, 1);
++ if (ctx->mmap_size)
++ vm_munmap(ctx->mmap_base, ctx->mmap_size);
+ aio_free_ring(ctx);
+ err:
+ mutex_unlock(&ctx->ring_lock);
+diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
+index 8b40b35e5e0e..3b68c75eccea 100644
+--- a/fs/btrfs/tree-log.c
++++ b/fs/btrfs/tree-log.c
+@@ -1266,21 +1266,13 @@ out:
+ }
+
+ static int insert_orphan_item(struct btrfs_trans_handle *trans,
+- struct btrfs_root *root, u64 offset)
++ struct btrfs_root *root, u64 ino)
+ {
+ int ret;
+- struct btrfs_path *path;
+-
+- path = btrfs_alloc_path();
+- if (!path)
+- return -ENOMEM;
+
+- ret = btrfs_find_item(root, path, BTRFS_ORPHAN_OBJECTID,
+- offset, BTRFS_ORPHAN_ITEM_KEY, NULL);
+- if (ret > 0)
+- ret = btrfs_insert_orphan_item(trans, root, offset);
+-
+- btrfs_free_path(path);
++ ret = btrfs_insert_orphan_item(trans, root, ino);
++ if (ret == -EEXIST)
++ ret = 0;
+
+ return ret;
+ }
+diff --git a/fs/cifs/file.c b/fs/cifs/file.c
+index 9a7b6947874a..9431449a73ab 100644
+--- a/fs/cifs/file.c
++++ b/fs/cifs/file.c
+@@ -1829,6 +1829,7 @@ refind_writable:
+ cifsFileInfo_put(inv_file);
+ spin_lock(&cifs_file_list_lock);
+ ++refind;
++ inv_file = NULL;
+ goto refind_writable;
+ }
+ }
+diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c
+index c5f521bcdee2..cc93a7ffe8e4 100644
+--- a/fs/cifs/smb2ops.c
++++ b/fs/cifs/smb2ops.c
+@@ -683,7 +683,8 @@ smb2_clone_range(const unsigned int xid,
+
+ /* No need to change MaxChunks since already set to 1 */
+ chunk_sizes_updated = true;
+- }
++ } else
++ goto cchunk_out;
+ }
+
+ cchunk_out:
+diff --git a/fs/ext4/indirect.c b/fs/ext4/indirect.c
+index 36b369697a13..5e7af1c69577 100644
+--- a/fs/ext4/indirect.c
++++ b/fs/ext4/indirect.c
+@@ -1393,10 +1393,7 @@ end_range:
+ * to free. Everything was covered by the start
+ * of the range.
+ */
+- return 0;
+- } else {
+- /* Shared branch grows from an indirect block */
+- partial2--;
++ goto do_indirects;
+ }
+ } else {
+ /*
+@@ -1427,56 +1424,96 @@ end_range:
+ /* Punch happened within the same level (n == n2) */
+ partial = ext4_find_shared(inode, n, offsets, chain, &nr);
+ partial2 = ext4_find_shared(inode, n2, offsets2, chain2, &nr2);
+- /*
+- * ext4_find_shared returns Indirect structure which
+- * points to the last element which should not be
+- * removed by truncate. But this is end of the range
+- * in punch_hole so we need to point to the next element
+- */
+- partial2->p++;
+- while ((partial > chain) || (partial2 > chain2)) {
+- /* We're at the same block, so we're almost finished */
+- if ((partial->bh && partial2->bh) &&
+- (partial->bh->b_blocknr == partial2->bh->b_blocknr)) {
+- if ((partial > chain) && (partial2 > chain2)) {
++
++ /* Free top, but only if partial2 isn't its subtree. */
++ if (nr) {
++ int level = min(partial - chain, partial2 - chain2);
++ int i;
++ int subtree = 1;
++
++ for (i = 0; i <= level; i++) {
++ if (offsets[i] != offsets2[i]) {
++ subtree = 0;
++ break;
++ }
++ }
++
++ if (!subtree) {
++ if (partial == chain) {
++ /* Shared branch grows from the inode */
++ ext4_free_branches(handle, inode, NULL,
++ &nr, &nr+1,
++ (chain+n-1) - partial);
++ *partial->p = 0;
++ } else {
++ /* Shared branch grows from an indirect block */
++ BUFFER_TRACE(partial->bh, "get_write_access");
+ ext4_free_branches(handle, inode, partial->bh,
+- partial->p + 1,
+- partial2->p,
++ partial->p,
++ partial->p+1,
+ (chain+n-1) - partial);
+- BUFFER_TRACE(partial->bh, "call brelse");
+- brelse(partial->bh);
+- BUFFER_TRACE(partial2->bh, "call brelse");
+- brelse(partial2->bh);
+ }
+- return 0;
+ }
++ }
++
++ if (!nr2) {
+ /*
+- * Clear the ends of indirect blocks on the shared branch
+- * at the start of the range
++ * ext4_find_shared returns Indirect structure which
++ * points to the last element which should not be
++ * removed by truncate. But this is end of the range
++ * in punch_hole so we need to point to the next element
+ */
+- if (partial > chain) {
++ partial2->p++;
++ }
++
++ while (partial > chain || partial2 > chain2) {
++ int depth = (chain+n-1) - partial;
++ int depth2 = (chain2+n2-1) - partial2;
++
++ if (partial > chain && partial2 > chain2 &&
++ partial->bh->b_blocknr == partial2->bh->b_blocknr) {
++ /*
++ * We've converged on the same block. Clear the range,
++ * then we're done.
++ */
+ ext4_free_branches(handle, inode, partial->bh,
+- partial->p + 1,
+- (__le32 *)partial->bh->b_data+addr_per_block,
+- (chain+n-1) - partial);
++ partial->p + 1,
++ partial2->p,
++ (chain+n-1) - partial);
+ BUFFER_TRACE(partial->bh, "call brelse");
+ brelse(partial->bh);
+- partial--;
++ BUFFER_TRACE(partial2->bh, "call brelse");
++ brelse(partial2->bh);
++ return 0;
+ }
++
+ /*
+- * Clear the ends of indirect blocks on the shared branch
+- * at the end of the range
++ * The start and end partial branches may not be at the same
++ * level even though the punch happened within one level. So, we
++ * give them a chance to arrive at the same level, then walk
++ * them in step with each other until we converge on the same
++ * block.
+ */
+- if (partial2 > chain2) {
++ if (partial > chain && depth <= depth2) {
++ ext4_free_branches(handle, inode, partial->bh,
++ partial->p + 1,
++ (__le32 *)partial->bh->b_data+addr_per_block,
++ (chain+n-1) - partial);
++ BUFFER_TRACE(partial->bh, "call brelse");
++ brelse(partial->bh);
++ partial--;
++ }
++ if (partial2 > chain2 && depth2 <= depth) {
+ ext4_free_branches(handle, inode, partial2->bh,
+ (__le32 *)partial2->bh->b_data,
+ partial2->p,
+- (chain2+n-1) - partial2);
++ (chain2+n2-1) - partial2);
+ BUFFER_TRACE(partial2->bh, "call brelse");
+ brelse(partial2->bh);
+ partial2--;
+ }
+ }
++ return 0;
+
+ do_indirects:
+ /* Kill the remaining (whole) subtrees */
+diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
+index 5c9c13ee72f9..4460d45ae138 100644
+--- a/fs/nfsd/nfs4state.c
++++ b/fs/nfsd/nfs4state.c
+@@ -3226,7 +3226,7 @@ alloc_init_open_stateowner(unsigned int strhashval, struct nfsd4_open *open,
+ } else
+ nfs4_free_openowner(&oo->oo_owner);
+ spin_unlock(&clp->cl_lock);
+- return oo;
++ return ret;
+ }
+
+ static void init_open_stateid(struct nfs4_ol_stateid *stp, struct nfs4_file *fp, struct nfsd4_open *open) {
+@@ -5058,7 +5058,7 @@ alloc_init_lock_stateowner(unsigned int strhashval, struct nfs4_client *clp,
+ } else
+ nfs4_free_lockowner(&lo->lo_owner);
+ spin_unlock(&clp->cl_lock);
+- return lo;
++ return ret;
+ }
+
+ static void
+diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c
+index 324dc93ac896..e6e8d6449b47 100644
+--- a/fs/ocfs2/file.c
++++ b/fs/ocfs2/file.c
+@@ -2374,10 +2374,14 @@ out_dio:
+ /* buffered aio wouldn't have proper lock coverage today */
+ BUG_ON(ret == -EIOCBQUEUED && !(file->f_flags & O_DIRECT));
+
++ if (unlikely(written <= 0))
++ goto no_sync;
++
+ if (((file->f_flags & O_DSYNC) && !direct_io) || IS_SYNC(inode) ||
+ ((file->f_flags & O_DIRECT) && !direct_io)) {
+- ret = filemap_fdatawrite_range(file->f_mapping, *ppos,
+- *ppos + count - 1);
++ ret = filemap_fdatawrite_range(file->f_mapping,
++ iocb->ki_pos - written,
++ iocb->ki_pos - 1);
+ if (ret < 0)
+ written = ret;
+
+@@ -2390,10 +2394,12 @@ out_dio:
+ }
+
+ if (!ret)
+- ret = filemap_fdatawait_range(file->f_mapping, *ppos,
+- *ppos + count - 1);
++ ret = filemap_fdatawait_range(file->f_mapping,
++ iocb->ki_pos - written,
++ iocb->ki_pos - 1);
+ }
+
++no_sync:
+ /*
+ * deep in g_f_a_w_n()->ocfs2_direct_IO we pass in a ocfs2_dio_end_io
+ * function pointer which is called when o_direct io completes so that
+diff --git a/fs/xfs/xfs_file.c b/fs/xfs/xfs_file.c
+index eb596b419942..b28f0d680cb5 100644
+--- a/fs/xfs/xfs_file.c
++++ b/fs/xfs/xfs_file.c
+@@ -363,7 +363,8 @@ STATIC int /* error (positive) */
+ xfs_zero_last_block(
+ struct xfs_inode *ip,
+ xfs_fsize_t offset,
+- xfs_fsize_t isize)
++ xfs_fsize_t isize,
++ bool *did_zeroing)
+ {
+ struct xfs_mount *mp = ip->i_mount;
+ xfs_fileoff_t last_fsb = XFS_B_TO_FSBT(mp, isize);
+@@ -391,6 +392,7 @@ xfs_zero_last_block(
+ zero_len = mp->m_sb.sb_blocksize - zero_offset;
+ if (isize + zero_len > offset)
+ zero_len = offset - isize;
++ *did_zeroing = true;
+ return xfs_iozero(ip, isize, zero_len);
+ }
+
+@@ -409,7 +411,8 @@ int /* error (positive) */
+ xfs_zero_eof(
+ struct xfs_inode *ip,
+ xfs_off_t offset, /* starting I/O offset */
+- xfs_fsize_t isize) /* current inode size */
++ xfs_fsize_t isize, /* current inode size */
++ bool *did_zeroing)
+ {
+ struct xfs_mount *mp = ip->i_mount;
+ xfs_fileoff_t start_zero_fsb;
+@@ -431,7 +434,7 @@ xfs_zero_eof(
+ * We only zero a part of that block so it is handled specially.
+ */
+ if (XFS_B_FSB_OFFSET(mp, isize) != 0) {
+- error = xfs_zero_last_block(ip, offset, isize);
++ error = xfs_zero_last_block(ip, offset, isize, did_zeroing);
+ if (error)
+ return error;
+ }
+@@ -491,6 +494,7 @@ xfs_zero_eof(
+ if (error)
+ return error;
+
++ *did_zeroing = true;
+ start_zero_fsb = imap.br_startoff + imap.br_blockcount;
+ ASSERT(start_zero_fsb <= (end_zero_fsb + 1));
+ }
+@@ -529,13 +533,15 @@ restart:
+ * having to redo all checks before.
+ */
+ if (*pos > i_size_read(inode)) {
++ bool zero = false;
++
+ if (*iolock == XFS_IOLOCK_SHARED) {
+ xfs_rw_iunlock(ip, *iolock);
+ *iolock = XFS_IOLOCK_EXCL;
+ xfs_rw_ilock(ip, *iolock);
+ goto restart;
+ }
+- error = xfs_zero_eof(ip, *pos, i_size_read(inode));
++ error = xfs_zero_eof(ip, *pos, i_size_read(inode), &zero);
+ if (error)
+ return error;
+ }
+diff --git a/fs/xfs/xfs_inode.h b/fs/xfs/xfs_inode.h
+index 9af2882e1f4c..cb6ab0ad91a4 100644
+--- a/fs/xfs/xfs_inode.h
++++ b/fs/xfs/xfs_inode.h
+@@ -379,8 +379,9 @@ int xfs_droplink(struct xfs_trans *, struct xfs_inode *);
+ int xfs_bumplink(struct xfs_trans *, struct xfs_inode *);
+
+ /* from xfs_file.c */
+-int xfs_zero_eof(struct xfs_inode *, xfs_off_t, xfs_fsize_t);
+-int xfs_iozero(struct xfs_inode *, loff_t, size_t);
++int xfs_zero_eof(struct xfs_inode *ip, xfs_off_t offset,
++ xfs_fsize_t isize, bool *did_zeroing);
++int xfs_iozero(struct xfs_inode *ip, loff_t pos, size_t count);
+
+
+ #define IHOLD(ip) \
+diff --git a/fs/xfs/xfs_iops.c b/fs/xfs/xfs_iops.c
+index ec6dcdc181ee..d2273d243990 100644
+--- a/fs/xfs/xfs_iops.c
++++ b/fs/xfs/xfs_iops.c
+@@ -744,6 +744,7 @@ xfs_setattr_size(
+ int error;
+ uint lock_flags = 0;
+ uint commit_flags = 0;
++ bool did_zeroing = false;
+
+ trace_xfs_setattr(ip);
+
+@@ -787,20 +788,16 @@ xfs_setattr_size(
+ return error;
+
+ /*
+- * Now we can make the changes. Before we join the inode to the
+- * transaction, take care of the part of the truncation that must be
+- * done without the inode lock. This needs to be done before joining
+- * the inode to the transaction, because the inode cannot be unlocked
+- * once it is a part of the transaction.
++ * File data changes must be complete before we start the transaction to
++ * modify the inode. This needs to be done before joining the inode to
++ * the transaction because the inode cannot be unlocked once it is a
++ * part of the transaction.
++ *
++ * Start with zeroing any data block beyond EOF that we may expose on
++ * file extension.
+ */
+ if (newsize > oldsize) {
+- /*
+- * Do the first part of growing a file: zero any data in the
+- * last block that is beyond the old EOF. We need to do this
+- * before the inode is joined to the transaction to modify
+- * i_size.
+- */
+- error = xfs_zero_eof(ip, newsize, oldsize);
++ error = xfs_zero_eof(ip, newsize, oldsize, &did_zeroing);
+ if (error)
+ return error;
+ }
+@@ -810,23 +807,18 @@ xfs_setattr_size(
+ * any previous writes that are beyond the on disk EOF and the new
+ * EOF that have not been written out need to be written here. If we
+ * do not write the data out, we expose ourselves to the null files
+- * problem.
+- *
+- * Only flush from the on disk size to the smaller of the in memory
+- * file size or the new size as that's the range we really care about
+- * here and prevents waiting for other data not within the range we
+- * care about here.
++ * problem. Note that this includes any block zeroing we did above;
++ * otherwise those blocks may not be zeroed after a crash.
+ */
+- if (oldsize != ip->i_d.di_size && newsize > ip->i_d.di_size) {
++ if (newsize > ip->i_d.di_size &&
++ (oldsize != ip->i_d.di_size || did_zeroing)) {
+ error = filemap_write_and_wait_range(VFS_I(ip)->i_mapping,
+ ip->i_d.di_size, newsize);
+ if (error)
+ return error;
+ }
+
+- /*
+- * Wait for all direct I/O to complete.
+- */
++ /* Now wait for all direct I/O to complete. */
+ inode_dio_wait(inode);
+
+ /*
+diff --git a/include/linux/blk_types.h b/include/linux/blk_types.h
+index 445d59231bc4..c50182a4a949 100644
+--- a/include/linux/blk_types.h
++++ b/include/linux/blk_types.h
+@@ -181,7 +181,9 @@ enum rq_flag_bits {
+ __REQ_ELVPRIV, /* elevator private data attached */
+ __REQ_FAILED, /* set if the request failed */
+ __REQ_QUIET, /* don't worry about errors */
+- __REQ_PREEMPT, /* set for "ide_preempt" requests */
++ __REQ_PREEMPT, /* set for "ide_preempt" requests and also
++ for requests for which the SCSI "quiesce"
++ state must be ignored. */
+ __REQ_ALLOCED, /* request came from our alloc pool */
+ __REQ_COPY_USER, /* contains copies of user pages */
+ __REQ_FLUSH_SEQ, /* request for flush sequence */
+diff --git a/include/linux/compiler.h b/include/linux/compiler.h
+index d5ad7b1118fc..33063f872ee3 100644
+--- a/include/linux/compiler.h
++++ b/include/linux/compiler.h
+@@ -186,6 +186,80 @@ void ftrace_likely_update(struct ftrace_branch_data *f, int val, int expect);
+ # define __UNIQUE_ID(prefix) __PASTE(__PASTE(__UNIQUE_ID_, prefix), __LINE__)
+ #endif
+
++#include <uapi/linux/types.h>
++
++static __always_inline void data_access_exceeds_word_size(void)
++#ifdef __compiletime_warning
++__compiletime_warning("data access exceeds word size and won't be atomic")
++#endif
++;
++
++static __always_inline void data_access_exceeds_word_size(void)
++{
++}
++
++static __always_inline void __read_once_size(volatile void *p, void *res, int size)
++{
++ switch (size) {
++ case 1: *(__u8 *)res = *(volatile __u8 *)p; break;
++ case 2: *(__u16 *)res = *(volatile __u16 *)p; break;
++ case 4: *(__u32 *)res = *(volatile __u32 *)p; break;
++#ifdef CONFIG_64BIT
++ case 8: *(__u64 *)res = *(volatile __u64 *)p; break;
++#endif
++ default:
++ barrier();
++ __builtin_memcpy((void *)res, (const void *)p, size);
++ data_access_exceeds_word_size();
++ barrier();
++ }
++}
++
++static __always_inline void __write_once_size(volatile void *p, void *res, int size)
++{
++ switch (size) {
++ case 1: *(volatile __u8 *)p = *(__u8 *)res; break;
++ case 2: *(volatile __u16 *)p = *(__u16 *)res; break;
++ case 4: *(volatile __u32 *)p = *(__u32 *)res; break;
++#ifdef CONFIG_64BIT
++ case 8: *(volatile __u64 *)p = *(__u64 *)res; break;
++#endif
++ default:
++ barrier();
++ __builtin_memcpy((void *)p, (const void *)res, size);
++ data_access_exceeds_word_size();
++ barrier();
++ }
++}
++
++/*
++ * Prevent the compiler from merging or refetching reads or writes. The
++ * compiler is also forbidden from reordering successive instances of
++ * READ_ONCE, WRITE_ONCE and ACCESS_ONCE (see below), but only when the
++ * compiler is aware of some particular ordering. One way to make the
++ * compiler aware of ordering is to put the two invocations of READ_ONCE,
++ * WRITE_ONCE or ACCESS_ONCE() in different C statements.
++ *
++ * In contrast to ACCESS_ONCE these two macros will also work on aggregate
++ * data types like structs or unions. If the size of the accessed data
++ * type exceeds the word size of the machine (e.g., 32 bits or 64 bits)
++ * READ_ONCE() and WRITE_ONCE() will fall back to memcpy and print a
++ * compile-time warning.
++ *
++ * Their two major use cases are: (1) Mediating communication between
++ * process-level code and irq/NMI handlers, all running on the same CPU,
++ * and (2) Ensuring that the compiler does not fold, spindle, or otherwise
++ * mutilate accesses that either do not require ordering or that interact
++ * with an explicit memory barrier or atomic instruction that provides the
++ * required ordering.
++ */
++
++#define READ_ONCE(x) \
++ ({ typeof(x) __val; __read_once_size(&x, &__val, sizeof(__val)); __val; })
++
++#define WRITE_ONCE(x, val) \
++ ({ typeof(x) __val; __val = val; __write_once_size(&x, &__val, sizeof(__val)); __val; })
++
+ #endif /* __KERNEL__ */
+
+ #endif /* __ASSEMBLY__ */
+diff --git a/include/linux/cpuidle.h b/include/linux/cpuidle.h
+index 25e0df6155a4..575b7166cb08 100644
+--- a/include/linux/cpuidle.h
++++ b/include/linux/cpuidle.h
+@@ -69,7 +69,6 @@ struct cpuidle_device {
+ unsigned int cpu;
+
+ int last_residency;
+- int state_count;
+ struct cpuidle_state_usage states_usage[CPUIDLE_STATE_MAX];
+ struct cpuidle_state_kobj *kobjs[CPUIDLE_STATE_MAX];
+ struct cpuidle_driver_kobj *kobj_driver;
+diff --git a/include/linux/if_vlan.h b/include/linux/if_vlan.h
+index d69f0577a319..3a3c4fadcc64 100644
+--- a/include/linux/if_vlan.h
++++ b/include/linux/if_vlan.h
+@@ -320,8 +320,9 @@ static inline struct sk_buff *vlan_insert_tag(struct sk_buff *skb,
+ }
+
+ /**
+- * __vlan_put_tag - regular VLAN tag inserting
++ * vlan_insert_tag_set_proto - regular VLAN tag inserting
+ * @skb: skbuff to tag
++ * @vlan_proto: VLAN encapsulation protocol
+ * @vlan_tci: VLAN TCI to insert
+ *
+ * Inserts the VLAN tag into @skb as part of the payload
+@@ -330,8 +331,9 @@ static inline struct sk_buff *vlan_insert_tag(struct sk_buff *skb,
+ * Following the skb_unshare() example, in case of error, the calling function
+ * doesn't have to worry about freeing the original skb.
+ */
+-static inline struct sk_buff *__vlan_put_tag(struct sk_buff *skb,
+- __be16 vlan_proto, u16 vlan_tci)
++static inline struct sk_buff *vlan_insert_tag_set_proto(struct sk_buff *skb,
++ __be16 vlan_proto,
++ u16 vlan_tci)
+ {
+ skb = vlan_insert_tag(skb, vlan_proto, vlan_tci);
+ if (skb)
+@@ -339,6 +341,40 @@ static inline struct sk_buff *__vlan_put_tag(struct sk_buff *skb,
+ return skb;
+ }
+
++/*
++ * __vlan_hwaccel_push_inside - pushes vlan tag to the payload
++ * @skb: skbuff to tag
++ *
++ * Pushes the VLAN tag from @skb->vlan_tci inside to the payload.
++ *
++ * Following the skb_unshare() example, in case of error, the calling function
++ * doesn't have to worry about freeing the original skb.
++ */
++static inline struct sk_buff *__vlan_hwaccel_push_inside(struct sk_buff *skb)
++{
++ skb = vlan_insert_tag_set_proto(skb, skb->vlan_proto,
++ vlan_tx_tag_get(skb));
++ if (likely(skb))
++ skb->vlan_tci = 0;
++ return skb;
++}
++/*
++ * vlan_hwaccel_push_inside - pushes vlan tag to the payload
++ * @skb: skbuff to tag
++ *
++ * Checks is tag is present in @skb->vlan_tci and if it is, it pushes the
++ * VLAN tag from @skb->vlan_tci inside to the payload.
++ *
++ * Following the skb_unshare() example, in case of error, the calling function
++ * doesn't have to worry about freeing the original skb.
++ */
++static inline struct sk_buff *vlan_hwaccel_push_inside(struct sk_buff *skb)
++{
++ if (vlan_tx_tag_present(skb))
++ skb = __vlan_hwaccel_push_inside(skb);
++ return skb;
++}
++
+ /**
+ * __vlan_hwaccel_put_tag - hardware accelerated VLAN inserting
+ * @skb: skbuff to tag
+@@ -357,24 +393,6 @@ static inline struct sk_buff *__vlan_hwaccel_put_tag(struct sk_buff *skb,
+ }
+
+ /**
+- * vlan_put_tag - inserts VLAN tag according to device features
+- * @skb: skbuff to tag
+- * @vlan_tci: VLAN TCI to insert
+- *
+- * Assumes skb->dev is the target that will xmit this frame.
+- * Returns a VLAN tagged skb.
+- */
+-static inline struct sk_buff *vlan_put_tag(struct sk_buff *skb,
+- __be16 vlan_proto, u16 vlan_tci)
+-{
+- if (vlan_hw_offload_capable(skb->dev->features, vlan_proto)) {
+- return __vlan_hwaccel_put_tag(skb, vlan_proto, vlan_tci);
+- } else {
+- return __vlan_put_tag(skb, vlan_proto, vlan_tci);
+- }
+-}
+-
+-/**
+ * __vlan_get_tag - get the VLAN ID that is part of the payload
+ * @skb: skbuff to query
+ * @vlan_tci: buffer to store vlaue
+diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
+index 22339b4b1c8c..c3fd34da6c08 100644
+--- a/include/linux/netdevice.h
++++ b/include/linux/netdevice.h
+@@ -2122,6 +2122,12 @@ void netdev_freemem(struct net_device *dev);
+ void synchronize_net(void);
+ int init_dummy_netdev(struct net_device *dev);
+
++DECLARE_PER_CPU(int, xmit_recursion);
++static inline int dev_recursion_level(void)
++{
++ return this_cpu_read(xmit_recursion);
++}
++
+ struct net_device *dev_get_by_index(struct net *net, int ifindex);
+ struct net_device *__dev_get_by_index(struct net *net, int ifindex);
+ struct net_device *dev_get_by_index_rcu(struct net *net, int ifindex);
+diff --git a/include/linux/rmap.h b/include/linux/rmap.h
+index c0c2bce6b0b7..d9d7e7e56352 100644
+--- a/include/linux/rmap.h
++++ b/include/linux/rmap.h
+@@ -37,6 +37,16 @@ struct anon_vma {
+ atomic_t refcount;
+
+ /*
++ * Count of child anon_vmas and VMAs which points to this anon_vma.
++ *
++ * This counter is used for making decision about reusing anon_vma
++ * instead of forking new one. See comments in function anon_vma_clone.
++ */
++ unsigned degree;
++
++ struct anon_vma *parent; /* Parent of this anon_vma */
++
++ /*
+ * NOTE: the LSB of the rb_root.rb_node is set by
+ * mm_take_all_locks() _after_ taking the above lock. So the
+ * rb_root must only be read/written after taking the above lock
+diff --git a/include/linux/usb/usbnet.h b/include/linux/usb/usbnet.h
+index d9a4905e01d0..6e0ce8c7b8cb 100644
+--- a/include/linux/usb/usbnet.h
++++ b/include/linux/usb/usbnet.h
+@@ -227,9 +227,23 @@ struct skb_data { /* skb->cb is one of these */
+ struct urb *urb;
+ struct usbnet *dev;
+ enum skb_state state;
+- size_t length;
++ long length;
++ unsigned long packets;
+ };
+
++/* Drivers that set FLAG_MULTI_PACKET must call this in their
++ * tx_fixup method before returning an skb.
++ */
++static inline void
++usbnet_set_skb_tx_stats(struct sk_buff *skb,
++ unsigned long packets, long bytes_delta)
++{
++ struct skb_data *entry = (struct skb_data *) skb->cb;
++
++ entry->packets = packets;
++ entry->length = bytes_delta;
++}
++
+ extern int usbnet_open(struct net_device *net);
+ extern int usbnet_stop(struct net_device *net);
+ extern netdev_tx_t usbnet_start_xmit(struct sk_buff *skb,
+diff --git a/include/net/ip.h b/include/net/ip.h
+index 09cf5aebb283..c0c26c3deeb5 100644
+--- a/include/net/ip.h
++++ b/include/net/ip.h
+@@ -453,22 +453,6 @@ static __inline__ void inet_reset_saddr(struct sock *sk)
+
+ #endif
+
+-static inline int sk_mc_loop(struct sock *sk)
+-{
+- if (!sk)
+- return 1;
+- switch (sk->sk_family) {
+- case AF_INET:
+- return inet_sk(sk)->mc_loop;
+-#if IS_ENABLED(CONFIG_IPV6)
+- case AF_INET6:
+- return inet6_sk(sk)->mc_loop;
+-#endif
+- }
+- WARN_ON(1);
+- return 1;
+-}
+-
+ bool ip_call_ra_chain(struct sk_buff *skb);
+
+ /*
+diff --git a/include/net/ip6_route.h b/include/net/ip6_route.h
+index 1d09b46c1e48..eda131d179d9 100644
+--- a/include/net/ip6_route.h
++++ b/include/net/ip6_route.h
+@@ -174,7 +174,8 @@ int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *));
+
+ static inline int ip6_skb_dst_mtu(struct sk_buff *skb)
+ {
+- struct ipv6_pinfo *np = skb->sk ? inet6_sk(skb->sk) : NULL;
++ struct ipv6_pinfo *np = skb->sk && !dev_recursion_level() ?
++ inet6_sk(skb->sk) : NULL;
+
+ return (np && np->pmtudisc >= IPV6_PMTUDISC_PROBE) ?
+ skb_dst(skb)->dev->mtu : dst_mtu(skb_dst(skb));
+diff --git a/include/net/sock.h b/include/net/sock.h
+index 7db3db112baa..c8146ed9e66a 100644
+--- a/include/net/sock.h
++++ b/include/net/sock.h
+@@ -1806,6 +1806,8 @@ struct dst_entry *__sk_dst_check(struct sock *sk, u32 cookie);
+
+ struct dst_entry *sk_dst_check(struct sock *sk, u32 cookie);
+
++bool sk_mc_loop(struct sock *sk);
++
+ static inline bool sk_can_gso(const struct sock *sk)
+ {
+ return net_gso_ok(sk->sk_route_caps, sk->sk_gso_type);
+diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
+index 9f81818f2941..d8dcc80472c1 100644
+--- a/kernel/bpf/verifier.c
++++ b/kernel/bpf/verifier.c
+@@ -1324,7 +1324,8 @@ peek_stack:
+ /* tell verifier to check for equivalent states
+ * after every call and jump
+ */
+- env->explored_states[t + 1] = STATE_LIST_MARK;
++ if (t + 1 < insn_cnt)
++ env->explored_states[t + 1] = STATE_LIST_MARK;
+ } else {
+ /* conditional jump with two edges */
+ ret = push_insn(t, t + 1, FALLTHROUGH, env);
+diff --git a/kernel/power/snapshot.c b/kernel/power/snapshot.c
+index 791a61892bb5..7325e35403c3 100644
+--- a/kernel/power/snapshot.c
++++ b/kernel/power/snapshot.c
+@@ -954,25 +954,6 @@ static void mark_nosave_pages(struct memory_bitmap *bm)
+ }
+ }
+
+-static bool is_nosave_page(unsigned long pfn)
+-{
+- struct nosave_region *region;
+-
+- list_for_each_entry(region, &nosave_regions, list) {
+- if (pfn >= region->start_pfn && pfn < region->end_pfn) {
+- pr_err("PM: %#010llx in e820 nosave region: "
+- "[mem %#010llx-%#010llx]\n",
+- (unsigned long long) pfn << PAGE_SHIFT,
+- (unsigned long long) region->start_pfn << PAGE_SHIFT,
+- ((unsigned long long) region->end_pfn << PAGE_SHIFT)
+- - 1);
+- return true;
+- }
+- }
+-
+- return false;
+-}
+-
+ /**
+ * create_basic_memory_bitmaps - create bitmaps needed for marking page
+ * frames that should not be saved and free page frames. The pointers
+@@ -2038,7 +2019,7 @@ static int mark_unsafe_pages(struct memory_bitmap *bm)
+ do {
+ pfn = memory_bm_next_pfn(bm);
+ if (likely(pfn != BM_END_OF_MAP)) {
+- if (likely(pfn_valid(pfn)) && !is_nosave_page(pfn))
++ if (likely(pfn_valid(pfn)))
+ swsusp_set_page_free(pfn_to_page(pfn));
+ else
+ return -EFAULT;
+diff --git a/kernel/sched/core.c b/kernel/sched/core.c
+index 9f5ed5e70eaa..b794bde3f5e1 100644
+--- a/kernel/sched/core.c
++++ b/kernel/sched/core.c
+@@ -3097,6 +3097,8 @@ void rt_mutex_setprio(struct task_struct *p, int prio)
+ } else {
+ if (dl_prio(oldprio))
+ p->dl.dl_boosted = 0;
++ if (rt_prio(oldprio))
++ p->rt.timeout = 0;
+ p->sched_class = &fair_sched_class;
+ }
+
+diff --git a/kernel/time/tick-broadcast-hrtimer.c b/kernel/time/tick-broadcast-hrtimer.c
+index eb682d5c697c..6aac4beedbbe 100644
+--- a/kernel/time/tick-broadcast-hrtimer.c
++++ b/kernel/time/tick-broadcast-hrtimer.c
+@@ -49,6 +49,7 @@ static void bc_set_mode(enum clock_event_mode mode,
+ */
+ static int bc_set_next(ktime_t expires, struct clock_event_device *bc)
+ {
++ int bc_moved;
+ /*
+ * We try to cancel the timer first. If the callback is on
+ * flight on some other cpu then we let it handle it. If we
+@@ -60,9 +61,15 @@ static int bc_set_next(ktime_t expires, struct clock_event_device *bc)
+ * restart the timer because we are in the callback, but we
+ * can set the expiry time and let the callback return
+ * HRTIMER_RESTART.
++ *
++ * Since we are in the idle loop at this point and because
++ * hrtimer_{start/cancel} functions call into tracing,
++ * calls to these functions must be bound within RCU_NONIDLE.
+ */
+- if (hrtimer_try_to_cancel(&bctimer) >= 0) {
+- hrtimer_start(&bctimer, expires, HRTIMER_MODE_ABS_PINNED);
++ RCU_NONIDLE(bc_moved = (hrtimer_try_to_cancel(&bctimer) >= 0) ?
++ !hrtimer_start(&bctimer, expires, HRTIMER_MODE_ABS_PINNED) :
++ 0);
++ if (bc_moved) {
+ /* Bind the "device" to the cpu */
+ bc->bound_on = smp_processor_id();
+ } else if (bc->bound_on == smp_processor_id()) {
+diff --git a/mm/memory-failure.c b/mm/memory-failure.c
+index 8639f6b28746..3415e7ad3973 100644
+--- a/mm/memory-failure.c
++++ b/mm/memory-failure.c
+@@ -1659,8 +1659,6 @@ static int __soft_offline_page(struct page *page, int flags)
+ * setting PG_hwpoison.
+ */
+ if (!is_free_buddy_page(page))
+- lru_add_drain_all();
+- if (!is_free_buddy_page(page))
+ drain_all_pages();
+ SetPageHWPoison(page);
+ if (!is_free_buddy_page(page))
+diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c
+index 1bf4807cb21e..8c71654e261f 100644
+--- a/mm/memory_hotplug.c
++++ b/mm/memory_hotplug.c
+@@ -1092,6 +1092,10 @@ static pg_data_t __ref *hotadd_new_pgdat(int nid, u64 start)
+ return NULL;
+
+ arch_refresh_nodedata(nid, pgdat);
++ } else {
++ /* Reset the nr_zones and classzone_idx to 0 before reuse */
++ pgdat->nr_zones = 0;
++ pgdat->classzone_idx = 0;
+ }
+
+ /* we can use NODE_DATA(nid) from here */
+@@ -1977,15 +1981,6 @@ void try_offline_node(int nid)
+ if (is_vmalloc_addr(zone->wait_table))
+ vfree(zone->wait_table);
+ }
+-
+- /*
+- * Since there is no way to guarentee the address of pgdat/zone is not
+- * on stack of any kernel threads or used by other kernel objects
+- * without reference counting or other symchronizing method, do not
+- * reset node_data and free pgdat here. Just reset it to 0 and reuse
+- * the memory when the node is online again.
+- */
+- memset(pgdat, 0, sizeof(*pgdat));
+ }
+ EXPORT_SYMBOL(try_offline_node);
+
+diff --git a/mm/mmap.c b/mm/mmap.c
+index 3c83bec2274c..f88b4f940327 100644
+--- a/mm/mmap.c
++++ b/mm/mmap.c
+@@ -778,10 +778,10 @@ again: remove_next = 1 + (end > next->vm_end);
+ if (exporter && exporter->anon_vma && !importer->anon_vma) {
+ int error;
+
++ importer->anon_vma = exporter->anon_vma;
+ error = anon_vma_clone(importer, exporter);
+ if (error)
+ return error;
+- importer->anon_vma = exporter->anon_vma;
+ }
+ }
+
+diff --git a/mm/page-writeback.c b/mm/page-writeback.c
+index 437174a2aaa3..c8abd208432d 100644
+--- a/mm/page-writeback.c
++++ b/mm/page-writeback.c
+@@ -857,8 +857,11 @@ static void bdi_update_write_bandwidth(struct backing_dev_info *bdi,
+ * bw * elapsed + write_bandwidth * (period - elapsed)
+ * write_bandwidth = ---------------------------------------------------
+ * period
++ *
++ * @written may have decreased due to account_page_redirty().
++ * Avoid underflowing @bw calculation.
+ */
+- bw = written - bdi->written_stamp;
++ bw = written - min(written, bdi->written_stamp);
+ bw *= HZ;
+ if (unlikely(elapsed > period)) {
+ do_div(bw, elapsed);
+@@ -922,7 +925,7 @@ static void global_update_bandwidth(unsigned long thresh,
+ unsigned long now)
+ {
+ static DEFINE_SPINLOCK(dirty_lock);
+- static unsigned long update_time;
++ static unsigned long update_time = INITIAL_JIFFIES;
+
+ /*
+ * check locklessly first to optimize away locking for the most time
+diff --git a/mm/page_isolation.c b/mm/page_isolation.c
+index c8778f7e208e..ec66134fb2a5 100644
+--- a/mm/page_isolation.c
++++ b/mm/page_isolation.c
+@@ -103,6 +103,7 @@ void unset_migratetype_isolate(struct page *page, unsigned migratetype)
+
+ if (!is_migrate_isolate_page(buddy)) {
+ __isolate_free_page(page, order);
++ kernel_map_pages(page, (1 << order), 1);
+ set_page_refcounted(page);
+ isolated_page = page;
+ }
+diff --git a/mm/rmap.c b/mm/rmap.c
+index 3e4c7213210c..5fc824b7311a 100644
+--- a/mm/rmap.c
++++ b/mm/rmap.c
+@@ -72,6 +72,8 @@ static inline struct anon_vma *anon_vma_alloc(void)
+ anon_vma = kmem_cache_alloc(anon_vma_cachep, GFP_KERNEL);
+ if (anon_vma) {
+ atomic_set(&anon_vma->refcount, 1);
++ anon_vma->degree = 1; /* Reference for first vma */
++ anon_vma->parent = anon_vma;
+ /*
+ * Initialise the anon_vma root to point to itself. If called
+ * from fork, the root will be reset to the parents anon_vma.
+@@ -188,6 +190,8 @@ int anon_vma_prepare(struct vm_area_struct *vma)
+ if (likely(!vma->anon_vma)) {
+ vma->anon_vma = anon_vma;
+ anon_vma_chain_link(vma, avc, anon_vma);
++ /* vma reference or self-parent link for new root */
++ anon_vma->degree++;
+ allocated = NULL;
+ avc = NULL;
+ }
+@@ -236,6 +240,14 @@ static inline void unlock_anon_vma_root(struct anon_vma *root)
+ /*
+ * Attach the anon_vmas from src to dst.
+ * Returns 0 on success, -ENOMEM on failure.
++ *
++ * If dst->anon_vma is NULL this function tries to find and reuse existing
++ * anon_vma which has no vmas and only one child anon_vma. This prevents
++ * degradation of anon_vma hierarchy to endless linear chain in case of
++ * constantly forking task. On the other hand, an anon_vma with more than one
++ * child isn't reused even if there was no alive vma, thus rmap walker has a
++ * good chance of avoiding scanning the whole hierarchy when it searches where
++ * page is mapped.
+ */
+ int anon_vma_clone(struct vm_area_struct *dst, struct vm_area_struct *src)
+ {
+@@ -256,11 +268,32 @@ int anon_vma_clone(struct vm_area_struct *dst, struct vm_area_struct *src)
+ anon_vma = pavc->anon_vma;
+ root = lock_anon_vma_root(root, anon_vma);
+ anon_vma_chain_link(dst, avc, anon_vma);
++
++ /*
++ * Reuse existing anon_vma if its degree lower than two,
++ * that means it has no vma and only one anon_vma child.
++ *
++ * Do not chose parent anon_vma, otherwise first child
++ * will always reuse it. Root anon_vma is never reused:
++ * it has self-parent reference and at least one child.
++ */
++ if (!dst->anon_vma && anon_vma != src->anon_vma &&
++ anon_vma->degree < 2)
++ dst->anon_vma = anon_vma;
+ }
++ if (dst->anon_vma)
++ dst->anon_vma->degree++;
+ unlock_anon_vma_root(root);
+ return 0;
+
+ enomem_failure:
++ /*
++ * dst->anon_vma is dropped here otherwise its degree can be incorrectly
++ * decremented in unlink_anon_vmas().
++ * We can safely do this because callers of anon_vma_clone() don't care
++ * about dst->anon_vma if anon_vma_clone() failed.
++ */
++ dst->anon_vma = NULL;
+ unlink_anon_vmas(dst);
+ return -ENOMEM;
+ }
+@@ -280,6 +313,9 @@ int anon_vma_fork(struct vm_area_struct *vma, struct vm_area_struct *pvma)
+ if (!pvma->anon_vma)
+ return 0;
+
++ /* Drop inherited anon_vma, we'll reuse existing or allocate new. */
++ vma->anon_vma = NULL;
++
+ /*
+ * First, attach the new VMA to the parent VMA's anon_vmas,
+ * so rmap can find non-COWed pages in child processes.
+@@ -288,6 +324,10 @@ int anon_vma_fork(struct vm_area_struct *vma, struct vm_area_struct *pvma)
+ if (error)
+ return error;
+
++ /* An existing anon_vma has been reused, all done then. */
++ if (vma->anon_vma)
++ return 0;
++
+ /* Then add our own anon_vma. */
+ anon_vma = anon_vma_alloc();
+ if (!anon_vma)
+@@ -301,6 +341,7 @@ int anon_vma_fork(struct vm_area_struct *vma, struct vm_area_struct *pvma)
+ * lock any of the anon_vmas in this anon_vma tree.
+ */
+ anon_vma->root = pvma->anon_vma->root;
++ anon_vma->parent = pvma->anon_vma;
+ /*
+ * With refcounts, an anon_vma can stay around longer than the
+ * process it belongs to. The root anon_vma needs to be pinned until
+@@ -311,6 +352,7 @@ int anon_vma_fork(struct vm_area_struct *vma, struct vm_area_struct *pvma)
+ vma->anon_vma = anon_vma;
+ anon_vma_lock_write(anon_vma);
+ anon_vma_chain_link(vma, avc, anon_vma);
++ anon_vma->parent->degree++;
+ anon_vma_unlock_write(anon_vma);
+
+ return 0;
+@@ -341,12 +383,16 @@ void unlink_anon_vmas(struct vm_area_struct *vma)
+ * Leave empty anon_vmas on the list - we'll need
+ * to free them outside the lock.
+ */
+- if (RB_EMPTY_ROOT(&anon_vma->rb_root))
++ if (RB_EMPTY_ROOT(&anon_vma->rb_root)) {
++ anon_vma->parent->degree--;
+ continue;
++ }
+
+ list_del(&avc->same_vma);
+ anon_vma_chain_free(avc);
+ }
++ if (vma->anon_vma)
++ vma->anon_vma->degree--;
+ unlock_anon_vma_root(root);
+
+ /*
+@@ -357,6 +403,7 @@ void unlink_anon_vmas(struct vm_area_struct *vma)
+ list_for_each_entry_safe(avc, next, &vma->anon_vma_chain, same_vma) {
+ struct anon_vma *anon_vma = avc->anon_vma;
+
++ BUG_ON(anon_vma->degree);
+ put_anon_vma(anon_vma);
+
+ list_del(&avc->same_vma);
+diff --git a/net/bridge/br_vlan.c b/net/bridge/br_vlan.c
+index 150048fb99b0..97b8ddf57363 100644
+--- a/net/bridge/br_vlan.c
++++ b/net/bridge/br_vlan.c
+@@ -199,8 +199,8 @@ bool br_allowed_ingress(struct net_bridge *br, struct net_port_vlans *v,
+ if (skb->vlan_proto != proto) {
+ /* Protocol-mismatch, empty out vlan_tci for new tag */
+ skb_push(skb, ETH_HLEN);
+- skb = __vlan_put_tag(skb, skb->vlan_proto,
+- vlan_tx_tag_get(skb));
++ skb = vlan_insert_tag_set_proto(skb, skb->vlan_proto,
++ vlan_tx_tag_get(skb));
+ if (unlikely(!skb))
+ return false;
+
+diff --git a/net/core/dev.c b/net/core/dev.c
+index 5db3a3f96198..5cdbc1bd9783 100644
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -2663,12 +2663,8 @@ static struct sk_buff *validate_xmit_vlan(struct sk_buff *skb,
+ netdev_features_t features)
+ {
+ if (vlan_tx_tag_present(skb) &&
+- !vlan_hw_offload_capable(features, skb->vlan_proto)) {
+- skb = __vlan_put_tag(skb, skb->vlan_proto,
+- vlan_tx_tag_get(skb));
+- if (skb)
+- skb->vlan_tci = 0;
+- }
++ !vlan_hw_offload_capable(features, skb->vlan_proto))
++ skb = __vlan_hwaccel_push_inside(skb);
+ return skb;
+ }
+
+@@ -2857,7 +2853,9 @@ static void skb_update_prio(struct sk_buff *skb)
+ #define skb_update_prio(skb)
+ #endif
+
+-static DEFINE_PER_CPU(int, xmit_recursion);
++DEFINE_PER_CPU(int, xmit_recursion);
++EXPORT_SYMBOL(xmit_recursion);
++
+ #define RECURSION_LIMIT 10
+
+ /**
+diff --git a/net/core/netpoll.c b/net/core/netpoll.c
+index e6645b4f330a..e0ad5d16c9c5 100644
+--- a/net/core/netpoll.c
++++ b/net/core/netpoll.c
+@@ -79,8 +79,7 @@ static int netpoll_start_xmit(struct sk_buff *skb, struct net_device *dev,
+
+ if (vlan_tx_tag_present(skb) &&
+ !vlan_hw_offload_capable(features, skb->vlan_proto)) {
+- skb = __vlan_put_tag(skb, skb->vlan_proto,
+- vlan_tx_tag_get(skb));
++ skb = __vlan_hwaccel_push_inside(skb);
+ if (unlikely(!skb)) {
+ /* This is actually a packet drop, but we
+ * don't want the code that calls this
+@@ -88,7 +87,6 @@ static int netpoll_start_xmit(struct sk_buff *skb, struct net_device *dev,
+ */
+ goto out;
+ }
+- skb->vlan_tci = 0;
+ }
+
+ status = netdev_start_xmit(skb, dev, txq, false);
+diff --git a/net/core/skbuff.c b/net/core/skbuff.c
+index 79589ae84a5d..17fd8dca921e 100644
+--- a/net/core/skbuff.c
++++ b/net/core/skbuff.c
+@@ -4033,18 +4033,20 @@ EXPORT_SYMBOL(skb_try_coalesce);
+ */
+ void skb_scrub_packet(struct sk_buff *skb, bool xnet)
+ {
+- if (xnet)
+- skb_orphan(skb);
+ skb->tstamp.tv64 = 0;
+ skb->pkt_type = PACKET_HOST;
+ skb->skb_iif = 0;
+ skb->ignore_df = 0;
+ skb_dst_drop(skb);
+- skb->mark = 0;
+- skb_init_secmark(skb);
+ secpath_reset(skb);
+ nf_reset(skb);
+ nf_reset_trace(skb);
++
++ if (!xnet)
++ return;
++
++ skb_orphan(skb);
++ skb->mark = 0;
+ }
+ EXPORT_SYMBOL_GPL(skb_scrub_packet);
+
+diff --git a/net/core/sock.c b/net/core/sock.c
+index 15e0c67b1069..852acbc52f96 100644
+--- a/net/core/sock.c
++++ b/net/core/sock.c
+@@ -651,6 +651,25 @@ static inline void sock_valbool_flag(struct sock *sk, int bit, int valbool)
+ sock_reset_flag(sk, bit);
+ }
+
++bool sk_mc_loop(struct sock *sk)
++{
++ if (dev_recursion_level())
++ return false;
++ if (!sk)
++ return true;
++ switch (sk->sk_family) {
++ case AF_INET:
++ return inet_sk(sk)->mc_loop;
++#if IS_ENABLED(CONFIG_IPV6)
++ case AF_INET6:
++ return inet6_sk(sk)->mc_loop;
++#endif
++ }
++ WARN_ON(1);
++ return true;
++}
++EXPORT_SYMBOL(sk_mc_loop);
++
+ /*
+ * This is meant for all protocols to use and covers goings on
+ * at the socket level. Everything here is generic.
+diff --git a/net/ipv4/geneve.c b/net/ipv4/geneve.c
+index 2caa6ad965a6..d5423e33d32b 100644
+--- a/net/ipv4/geneve.c
++++ b/net/ipv4/geneve.c
+@@ -121,8 +121,6 @@ int geneve_xmit_skb(struct geneve_sock *gs, struct rtable *rt,
+ int min_headroom;
+ int err;
+
+- skb = udp_tunnel_handle_offloads(skb, !gs->sock->sk->sk_no_check_tx);
+-
+ min_headroom = LL_RESERVED_SPACE(rt->dst.dev) + rt->dst.header_len
+ + GENEVE_BASE_HLEN + opt_len + sizeof(struct iphdr)
+ + (vlan_tx_tag_present(skb) ? VLAN_HLEN : 0);
+@@ -131,15 +129,13 @@ int geneve_xmit_skb(struct geneve_sock *gs, struct rtable *rt,
+ if (unlikely(err))
+ return err;
+
+- if (vlan_tx_tag_present(skb)) {
+- if (unlikely(!__vlan_put_tag(skb,
+- skb->vlan_proto,
+- vlan_tx_tag_get(skb)))) {
+- err = -ENOMEM;
+- return err;
+- }
+- skb->vlan_tci = 0;
+- }
++ skb = vlan_hwaccel_push_inside(skb);
++ if (unlikely(!skb))
++ return -ENOMEM;
++
++ skb = udp_tunnel_handle_offloads(skb, !gs->sock->sk->sk_no_check_tx);
++ if (IS_ERR(skb))
++ return PTR_ERR(skb);
+
+ gnvh = (struct genevehdr *)__skb_push(skb, sizeof(*gnvh) + opt_len);
+ geneve_build_header(gnvh, tun_flags, vni, opt_len, opt);
+diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
+index d107ee246a1d..6f46cde58e54 100644
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -3103,10 +3103,11 @@ static int tcp_clean_rtx_queue(struct sock *sk, int prior_fackets,
+ if (!first_ackt.v64)
+ first_ackt = last_ackt;
+
+- if (!(sacked & TCPCB_SACKED_ACKED))
++ if (!(sacked & TCPCB_SACKED_ACKED)) {
+ reord = min(pkts_acked, reord);
+- if (!after(scb->end_seq, tp->high_seq))
+- flag |= FLAG_ORIG_SACK_ACKED;
++ if (!after(scb->end_seq, tp->high_seq))
++ flag |= FLAG_ORIG_SACK_ACKED;
++ }
+ }
+
+ if (sacked & TCPCB_SACKED_ACKED)
+diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
+index 944ce5edbfb7..a5fdfe9fa542 100644
+--- a/net/ipv4/tcp_ipv4.c
++++ b/net/ipv4/tcp_ipv4.c
+@@ -1514,7 +1514,7 @@ void tcp_v4_early_demux(struct sk_buff *skb)
+ skb->sk = sk;
+ skb->destructor = sock_edemux;
+ if (sk->sk_state != TCP_TIME_WAIT) {
+- struct dst_entry *dst = sk->sk_rx_dst;
++ struct dst_entry *dst = READ_ONCE(sk->sk_rx_dst);
+
+ if (dst)
+ dst = dst_check(dst, 0);
+diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
+index 022ecbc9322d..32dcb4e05b6b 100644
+--- a/net/ipv4/tcp_output.c
++++ b/net/ipv4/tcp_output.c
+@@ -2895,6 +2895,8 @@ struct sk_buff *tcp_make_synack(struct sock *sk, struct dst_entry *dst,
+ }
+ #endif
+
++ /* Do not fool tcpdump (if any), clean our debris */
++ skb->tstamp.tv64 = 0;
+ return skb;
+ }
+ EXPORT_SYMBOL(tcp_make_synack);
+diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
+index 51add023b723..7b5cb003ee22 100644
+--- a/net/ipv6/ip6_output.c
++++ b/net/ipv6/ip6_output.c
+@@ -555,7 +555,8 @@ int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
+ {
+ struct sk_buff *frag;
+ struct rt6_info *rt = (struct rt6_info *)skb_dst(skb);
+- struct ipv6_pinfo *np = skb->sk ? inet6_sk(skb->sk) : NULL;
++ struct ipv6_pinfo *np = skb->sk && !dev_recursion_level() ?
++ inet6_sk(skb->sk) : NULL;
+ struct ipv6hdr *tmp_hdr;
+ struct frag_hdr *fh;
+ unsigned int mtu, hlen, left, len;
+diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
+index 4cb45c1079a2..a46c50423aec 100644
+--- a/net/ipv6/ndisc.c
++++ b/net/ipv6/ndisc.c
+@@ -1215,7 +1215,14 @@ static void ndisc_router_discovery(struct sk_buff *skb)
+ if (rt)
+ rt6_set_expires(rt, jiffies + (HZ * lifetime));
+ if (ra_msg->icmph.icmp6_hop_limit) {
+- in6_dev->cnf.hop_limit = ra_msg->icmph.icmp6_hop_limit;
++ /* Only set hop_limit on the interface if it is higher than
++ * the current hop_limit.
++ */
++ if (in6_dev->cnf.hop_limit < ra_msg->icmph.icmp6_hop_limit) {
++ in6_dev->cnf.hop_limit = ra_msg->icmph.icmp6_hop_limit;
++ } else {
++ ND_PRINTK(2, warn, "RA: Got route advertisement with lower hop_limit than current\n");
++ }
+ if (rt)
+ dst_metric_set(&rt->dst, RTAX_HOPLIMIT,
+ ra_msg->icmph.icmp6_hop_limit);
+diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
+index c1136022d8d9..79fe58510ee8 100644
+--- a/net/ipv6/tcp_ipv6.c
++++ b/net/ipv6/tcp_ipv6.c
+@@ -1407,6 +1407,15 @@ static void tcp_v6_fill_cb(struct sk_buff *skb, const struct ipv6hdr *hdr,
+ TCP_SKB_CB(skb)->sacked = 0;
+ }
+
++static void tcp_v6_restore_cb(struct sk_buff *skb)
++{
++ /* We need to move header back to the beginning if xfrm6_policy_check()
++ * and tcp_v6_fill_cb() are going to be called again.
++ */
++ memmove(IP6CB(skb), &TCP_SKB_CB(skb)->header.h6,
++ sizeof(struct inet6_skb_parm));
++}
++
+ static int tcp_v6_rcv(struct sk_buff *skb)
+ {
+ const struct tcphdr *th;
+@@ -1539,6 +1548,7 @@ do_time_wait:
+ inet_twsk_deschedule(tw, &tcp_death_row);
+ inet_twsk_put(tw);
+ sk = sk2;
++ tcp_v6_restore_cb(skb);
+ goto process;
+ }
+ /* Fall through to ACK */
+@@ -1547,6 +1557,7 @@ do_time_wait:
+ tcp_v6_timewait_ack(sk, skb);
+ break;
+ case TCP_TW_RST:
++ tcp_v6_restore_cb(skb);
+ goto no_tcp_socket;
+ case TCP_TW_SUCCESS:
+ ;
+@@ -1581,7 +1592,7 @@ static void tcp_v6_early_demux(struct sk_buff *skb)
+ skb->sk = sk;
+ skb->destructor = sock_edemux;
+ if (sk->sk_state != TCP_TIME_WAIT) {
+- struct dst_entry *dst = sk->sk_rx_dst;
++ struct dst_entry *dst = READ_ONCE(sk->sk_rx_dst);
+
+ if (dst)
+ dst = dst_check(dst, inet6_sk(sk)->rx_dst_cookie);
+diff --git a/net/mac80211/agg-rx.c b/net/mac80211/agg-rx.c
+index a48bad468880..7702978a4c99 100644
+--- a/net/mac80211/agg-rx.c
++++ b/net/mac80211/agg-rx.c
+@@ -49,8 +49,6 @@ static void ieee80211_free_tid_rx(struct rcu_head *h)
+ container_of(h, struct tid_ampdu_rx, rcu_head);
+ int i;
+
+- del_timer_sync(&tid_rx->reorder_timer);
+-
+ for (i = 0; i < tid_rx->buf_size; i++)
+ __skb_queue_purge(&tid_rx->reorder_buf[i]);
+ kfree(tid_rx->reorder_buf);
+@@ -93,6 +91,12 @@ void ___ieee80211_stop_rx_ba_session(struct sta_info *sta, u16 tid,
+
+ del_timer_sync(&tid_rx->session_timer);
+
++ /* make sure ieee80211_sta_reorder_release() doesn't re-arm the timer */
++ spin_lock_bh(&tid_rx->reorder_lock);
++ tid_rx->removed = true;
++ spin_unlock_bh(&tid_rx->reorder_lock);
++ del_timer_sync(&tid_rx->reorder_timer);
++
+ call_rcu(&tid_rx->rcu_head, ieee80211_free_tid_rx);
+ }
+
+diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
+index bb77d6d7258a..631d59f540d1 100644
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -808,9 +808,10 @@ static void ieee80211_sta_reorder_release(struct ieee80211_sub_if_data *sdata,
+
+ set_release_timer:
+
+- mod_timer(&tid_agg_rx->reorder_timer,
+- tid_agg_rx->reorder_time[j] + 1 +
+- HT_RX_REORDER_BUF_TIMEOUT);
++ if (!tid_agg_rx->removed)
++ mod_timer(&tid_agg_rx->reorder_timer,
++ tid_agg_rx->reorder_time[j] + 1 +
++ HT_RX_REORDER_BUF_TIMEOUT);
+ } else {
+ del_timer(&tid_agg_rx->reorder_timer);
+ }
+diff --git a/net/mac80211/sta_info.h b/net/mac80211/sta_info.h
+index bcda2ac7d844..bdba4ca5e76a 100644
+--- a/net/mac80211/sta_info.h
++++ b/net/mac80211/sta_info.h
+@@ -170,6 +170,7 @@ struct tid_ampdu_tx {
+ * @reorder_lock: serializes access to reorder buffer, see below.
+ * @auto_seq: used for offloaded BA sessions to automatically pick head_seq_and
+ * and ssn.
++ * @removed: this session is removed (but might have been found due to RCU)
+ *
+ * This structure's lifetime is managed by RCU, assignments to
+ * the array holding it must hold the aggregation mutex.
+@@ -194,6 +195,7 @@ struct tid_ampdu_rx {
+ u16 timeout;
+ u8 dialog_token;
+ bool auto_seq;
++ bool removed;
+ };
+
+ /**
+diff --git a/net/openvswitch/actions.c b/net/openvswitch/actions.c
+index 8c4229b11c34..4107eae4f452 100644
+--- a/net/openvswitch/actions.c
++++ b/net/openvswitch/actions.c
+@@ -184,7 +184,9 @@ static int push_vlan(struct sk_buff *skb, const struct ovs_action_push_vlan *vla
+ /* push down current VLAN tag */
+ current_tag = vlan_tx_tag_get(skb);
+
+- if (!__vlan_put_tag(skb, skb->vlan_proto, current_tag))
++ skb = vlan_insert_tag_set_proto(skb, skb->vlan_proto,
++ current_tag);
++ if (!skb)
+ return -ENOMEM;
+
+ if (skb->ip_summed == CHECKSUM_COMPLETE)
+diff --git a/net/openvswitch/datapath.c b/net/openvswitch/datapath.c
+index 68ccddb5e2c4..28213dff723d 100644
+--- a/net/openvswitch/datapath.c
++++ b/net/openvswitch/datapath.c
+@@ -423,11 +423,10 @@ static int queue_userspace_packet(struct datapath *dp, struct sk_buff *skb,
+ if (!nskb)
+ return -ENOMEM;
+
+- nskb = __vlan_put_tag(nskb, nskb->vlan_proto, vlan_tx_tag_get(nskb));
++ nskb = __vlan_hwaccel_push_inside(nskb);
+ if (!nskb)
+ return -ENOMEM;
+
+- nskb->vlan_tci = 0;
+ skb = nskb;
+ }
+
+diff --git a/net/openvswitch/vport-gre.c b/net/openvswitch/vport-gre.c
+index 108b82da2fd9..e88fa34b0041 100644
+--- a/net/openvswitch/vport-gre.c
++++ b/net/openvswitch/vport-gre.c
+@@ -172,14 +172,10 @@ static int gre_tnl_send(struct vport *vport, struct sk_buff *skb)
+ goto err_free_rt;
+ }
+
+- if (vlan_tx_tag_present(skb)) {
+- if (unlikely(!__vlan_put_tag(skb,
+- skb->vlan_proto,
+- vlan_tx_tag_get(skb)))) {
+- err = -ENOMEM;
+- goto err_free_rt;
+- }
+- skb->vlan_tci = 0;
++ skb = vlan_hwaccel_push_inside(skb);
++ if (unlikely(!skb)) {
++ err = -ENOMEM;
++ goto err_free_rt;
+ }
+
+ /* Push Tunnel header. */
+diff --git a/security/selinux/selinuxfs.c b/security/selinux/selinuxfs.c
+index 33db1ad4fd10..138949a31eab 100644
+--- a/security/selinux/selinuxfs.c
++++ b/security/selinux/selinuxfs.c
+@@ -152,7 +152,7 @@ static ssize_t sel_write_enforce(struct file *file, const char __user *buf,
+ goto out;
+
+ /* No partial writes. */
+- length = EINVAL;
++ length = -EINVAL;
+ if (*ppos != 0)
+ goto out;
+
+diff --git a/sound/firewire/bebob/bebob_maudio.c b/sound/firewire/bebob/bebob_maudio.c
+index 70faa3a32526..0215a9194d88 100644
+--- a/sound/firewire/bebob/bebob_maudio.c
++++ b/sound/firewire/bebob/bebob_maudio.c
+@@ -96,10 +96,10 @@ int snd_bebob_maudio_load_firmware(struct fw_unit *unit)
+ struct fw_device *device = fw_parent_device(unit);
+ int err, rcode;
+ u64 date;
+- __be32 cues[3] = {
+- MAUDIO_BOOTLOADER_CUE1,
+- MAUDIO_BOOTLOADER_CUE2,
+- MAUDIO_BOOTLOADER_CUE3
++ __le32 cues[3] = {
++ cpu_to_le32(MAUDIO_BOOTLOADER_CUE1),
++ cpu_to_le32(MAUDIO_BOOTLOADER_CUE2),
++ cpu_to_le32(MAUDIO_BOOTLOADER_CUE3)
+ };
+
+ /* check date of software used to build */
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 8375bc424e2d..1783a3332984 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -392,7 +392,7 @@ static void alc_auto_setup_eapd(struct hda_codec *codec, bool on)
+ {
+ /* We currently only handle front, HP */
+ static hda_nid_t pins[] = {
+- 0x0f, 0x10, 0x14, 0x15, 0
++ 0x0f, 0x10, 0x14, 0x15, 0x17, 0
+ };
+ hda_nid_t *p;
+ for (p = pins; *p; p++)
+@@ -2908,6 +2908,8 @@ static void alc283_init(struct hda_codec *codec)
+
+ if (!hp_pin)
+ return;
++
++ msleep(30);
+ hp_pin_sense = snd_hda_jack_detect(codec, hp_pin);
+
+ /* Index 0x43 Direct Drive HP AMP LPM Control 1 */
+@@ -4255,6 +4257,7 @@ enum {
+ ALC269_FIXUP_QUANTA_MUTE,
+ ALC269_FIXUP_LIFEBOOK,
+ ALC269_FIXUP_LIFEBOOK_EXTMIC,
++ ALC269_FIXUP_LIFEBOOK_HP_PIN,
+ ALC269_FIXUP_AMIC,
+ ALC269_FIXUP_DMIC,
+ ALC269VB_FIXUP_AMIC,
+@@ -4405,6 +4408,13 @@ static const struct hda_fixup alc269_fixups[] = {
+ { }
+ },
+ },
++ [ALC269_FIXUP_LIFEBOOK_HP_PIN] = {
++ .type = HDA_FIXUP_PINS,
++ .v.pins = (const struct hda_pintbl[]) {
++ { 0x21, 0x0221102f }, /* HP out */
++ { }
++ },
++ },
+ [ALC269_FIXUP_AMIC] = {
+ .type = HDA_FIXUP_PINS,
+ .v.pins = (const struct hda_pintbl[]) {
+@@ -4875,6 +4885,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x104d, 0x9084, "Sony VAIO", ALC275_FIXUP_SONY_HWEQ),
+ SND_PCI_QUIRK(0x104d, 0x9099, "Sony VAIO S13", ALC275_FIXUP_SONY_DISABLE_AAMIX),
+ SND_PCI_QUIRK(0x10cf, 0x1475, "Lifebook", ALC269_FIXUP_LIFEBOOK),
++ SND_PCI_QUIRK(0x10cf, 0x15dc, "Lifebook T731", ALC269_FIXUP_LIFEBOOK_HP_PIN),
+ SND_PCI_QUIRK(0x10cf, 0x1845, "Lifebook U904", ALC269_FIXUP_LIFEBOOK_EXTMIC),
+ SND_PCI_QUIRK(0x144d, 0xc109, "Samsung Ativ book 9 (NP900X3G)", ALC269_FIXUP_INV_DMIC),
+ SND_PCI_QUIRK(0x1458, 0xfa53, "Gigabyte BXBT-2807", ALC283_FIXUP_BXBT2807_MIC),
+@@ -4901,6 +4912,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x17aa, 0x501a, "Thinkpad", ALC283_FIXUP_INT_MIC),
+ SND_PCI_QUIRK(0x17aa, 0x501e, "Thinkpad L440", ALC292_FIXUP_TPT440_DOCK),
+ SND_PCI_QUIRK(0x17aa, 0x5026, "Thinkpad", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
++ SND_PCI_QUIRK(0x17aa, 0x5036, "Thinkpad T450s", ALC292_FIXUP_TPT440_DOCK),
+ SND_PCI_QUIRK(0x17aa, 0x5109, "Thinkpad", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
+ SND_PCI_QUIRK(0x17aa, 0x3bf8, "Quanta FL1", ALC269_FIXUP_PCM_44K),
+ SND_PCI_QUIRK(0x17aa, 0x9e54, "LENOVO NB", ALC269_FIXUP_LENOVO_EAPD),
+diff --git a/sound/usb/mixer_quirks.c b/sound/usb/mixer_quirks.c
+index 8c9bf4b7aaf0..524366f9d32d 100644
+--- a/sound/usb/mixer_quirks.c
++++ b/sound/usb/mixer_quirks.c
+@@ -178,6 +178,7 @@ static const struct rc_config {
+ { USB_ID(0x041e, 0x3040), 2, 2, 6, 6, 2, 0x6e91 }, /* Live! 24-bit */
+ { USB_ID(0x041e, 0x3042), 0, 1, 1, 1, 1, 0x000d }, /* Usb X-Fi S51 */
+ { USB_ID(0x041e, 0x30df), 0, 1, 1, 1, 1, 0x000d }, /* Usb X-Fi S51 Pro */
++ { USB_ID(0x041e, 0x3237), 0, 1, 1, 1, 1, 0x000d }, /* Usb X-Fi S51 Pro */
+ { USB_ID(0x041e, 0x3048), 2, 2, 6, 6, 2, 0x6e91 }, /* Toshiba SB0500 */
+ };
+
+diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
+index cfbe0e7d1c45..272fee82f89e 100644
+--- a/virt/kvm/kvm_main.c
++++ b/virt/kvm/kvm_main.c
+@@ -478,7 +478,7 @@ static struct kvm *kvm_create_vm(unsigned long type)
+ BUILD_BUG_ON(KVM_MEM_SLOTS_NUM > SHRT_MAX);
+
+ r = -ENOMEM;
+- kvm->memslots = kzalloc(sizeof(struct kvm_memslots), GFP_KERNEL);
++ kvm->memslots = kvm_kvzalloc(sizeof(struct kvm_memslots));
+ if (!kvm->memslots)
+ goto out_err_no_srcu;
+
+@@ -529,7 +529,7 @@ out_err_no_srcu:
+ out_err_no_disable:
+ for (i = 0; i < KVM_NR_BUSES; i++)
+ kfree(kvm->buses[i]);
+- kfree(kvm->memslots);
++ kvfree(kvm->memslots);
+ kvm_arch_free_vm(kvm);
+ return ERR_PTR(r);
+ }
+@@ -585,7 +585,7 @@ static void kvm_free_physmem(struct kvm *kvm)
+ kvm_for_each_memslot(memslot, slots)
+ kvm_free_physmem_slot(kvm, memslot, NULL);
+
+- kfree(kvm->memslots);
++ kvfree(kvm->memslots);
+ }
+
+ static void kvm_destroy_devices(struct kvm *kvm)
+@@ -867,10 +867,11 @@ int __kvm_set_memory_region(struct kvm *kvm,
+ }
+
+ if ((change == KVM_MR_DELETE) || (change == KVM_MR_MOVE)) {
+- slots = kmemdup(kvm->memslots, sizeof(struct kvm_memslots),
+- GFP_KERNEL);
++ slots = kvm_kvzalloc(sizeof(struct kvm_memslots));
+ if (!slots)
+ goto out_free;
++ memcpy(slots, kvm->memslots, sizeof(struct kvm_memslots));
++
+ slot = id_to_memslot(slots, mem->slot);
+ slot->flags |= KVM_MEMSLOT_INVALID;
+
+@@ -900,10 +901,10 @@ int __kvm_set_memory_region(struct kvm *kvm,
+ * will get overwritten by update_memslots anyway.
+ */
+ if (!slots) {
+- slots = kmemdup(kvm->memslots, sizeof(struct kvm_memslots),
+- GFP_KERNEL);
++ slots = kvm_kvzalloc(sizeof(struct kvm_memslots));
+ if (!slots)
+ goto out_free;
++ memcpy(slots, kvm->memslots, sizeof(struct kvm_memslots));
+ }
+
+ /* actual memory is freed via old in kvm_free_physmem_slot below */
+@@ -917,7 +918,7 @@ int __kvm_set_memory_region(struct kvm *kvm,
+ kvm_arch_commit_memory_region(kvm, mem, &old, change);
+
+ kvm_free_physmem_slot(kvm, &old, &new);
+- kfree(old_memslots);
++ kvfree(old_memslots);
+
+ /*
+ * IOMMU mapping: New slots need to be mapped. Old slots need to be
+@@ -936,7 +937,7 @@ int __kvm_set_memory_region(struct kvm *kvm,
+ return 0;
+
+ out_slots:
+- kfree(slots);
++ kvfree(slots);
+ out_free:
+ kvm_free_physmem_slot(kvm, &new, &old);
+ out:
^ permalink raw reply related [flat|nested] 67+ messages in thread
* [gentoo-commits] proj/linux-patches:3.18 commit in: /
@ 2015-05-22 0:48 Mike Pagano
0 siblings, 0 replies; 67+ messages in thread
From: Mike Pagano @ 2015-05-22 0:48 UTC (permalink / raw
To: gentoo-commits
commit: a08b7c00ce818281035620da237352878da2184a
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Fri May 22 00:36:27 2015 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Fri May 22 00:36:27 2015 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=a08b7c00
Linux patch 3.18.14
0000_README | 4 +
1013_linux-3.18.14.patch | 8981 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 8985 insertions(+)
diff --git a/0000_README b/0000_README
index edbb9f6..ae90a46 100644
--- a/0000_README
+++ b/0000_README
@@ -95,6 +95,10 @@ Patch: 1012_linux-3.18.13.patch
From: http://www.kernel.org
Desc: Linux 3.18.13
+Patch: 1013_linux-3.18.14.patch
+From: http://www.kernel.org
+Desc: Linux 3.18.14
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1013_linux-3.18.14.patch b/1013_linux-3.18.14.patch
new file mode 100644
index 0000000..f9109c4
--- /dev/null
+++ b/1013_linux-3.18.14.patch
@@ -0,0 +1,8981 @@
+diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
+index f4c71d4a9ba3..61f9273d0c46 100644
+--- a/Documentation/kernel-parameters.txt
++++ b/Documentation/kernel-parameters.txt
+@@ -3644,6 +3644,8 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
+ READ_CAPACITY_16 command);
+ f = NO_REPORT_OPCODES (don't use report opcodes
+ command, uas only);
++ g = MAX_SECTORS_240 (don't transfer more than
++ 240 sectors at a time, uas only);
+ h = CAPACITY_HEURISTICS (decrease the
+ reported device capacity by one
+ sector if the number is odd);
+diff --git a/Documentation/virtual/kvm/api.txt b/Documentation/virtual/kvm/api.txt
+index 7610eaa4d491..702bb2557db8 100644
+--- a/Documentation/virtual/kvm/api.txt
++++ b/Documentation/virtual/kvm/api.txt
+@@ -2455,7 +2455,8 @@ should be created before this ioctl is invoked.
+
+ Possible features:
+ - KVM_ARM_VCPU_POWER_OFF: Starts the CPU in a power-off state.
+- Depends on KVM_CAP_ARM_PSCI.
++ Depends on KVM_CAP_ARM_PSCI. If not set, the CPU will be powered on
++ and execute guest code when KVM_RUN is called.
+ - KVM_ARM_VCPU_EL1_32BIT: Starts the CPU in a 32bit mode.
+ Depends on KVM_CAP_ARM_EL1_32BIT (arm64 only).
+ - KVM_ARM_VCPU_PSCI_0_2: Emulate PSCI v0.2 for the CPU.
+@@ -2951,6 +2952,15 @@ HVC instruction based PSCI call from the vcpu. The 'type' field describes
+ the system-level event type. The 'flags' field describes architecture
+ specific flags for the system-level event.
+
++Valid values for 'type' are:
++ KVM_SYSTEM_EVENT_SHUTDOWN -- the guest has requested a shutdown of the
++ VM. Userspace is not obliged to honour this, and if it does honour
++ this does not need to destroy the VM synchronously (ie it may call
++ KVM_RUN again before shutdown finally occurs).
++ KVM_SYSTEM_EVENT_RESET -- the guest has requested a reset of the VM.
++ As with SHUTDOWN, userspace can choose to ignore the request, or
++ to schedule the reset to occur in the future and may call KVM_RUN again.
++
+ /* Fix the size of the union. */
+ char padding[256];
+ };
+diff --git a/Documentation/virtual/kvm/devices/s390_flic.txt b/Documentation/virtual/kvm/devices/s390_flic.txt
+index 4ceef53164b0..d1ad9d5cae46 100644
+--- a/Documentation/virtual/kvm/devices/s390_flic.txt
++++ b/Documentation/virtual/kvm/devices/s390_flic.txt
+@@ -27,6 +27,9 @@ Groups:
+ Copies all floating interrupts into a buffer provided by userspace.
+ When the buffer is too small it returns -ENOMEM, which is the indication
+ for userspace to try again with a bigger buffer.
++ -ENOBUFS is returned when the allocation of a kernelspace buffer has
++ failed.
++ -EFAULT is returned when copying data to userspace failed.
+ All interrupts remain pending, i.e. are not deleted from the list of
+ currently pending interrupts.
+ attr->addr contains the userspace address of the buffer into which all
+diff --git a/Makefile b/Makefile
+index 9cd08d55f557..43377eb8a4e5 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 18
+-SUBLEVEL = 13
++SUBLEVEL = 14
+ EXTRAVERSION =
+ NAME = Diseased Newt
+
+diff --git a/arch/arm/boot/dts/dove.dtsi b/arch/arm/boot/dts/dove.dtsi
+index a5441d5482a6..3cc8b8320345 100644
+--- a/arch/arm/boot/dts/dove.dtsi
++++ b/arch/arm/boot/dts/dove.dtsi
+@@ -154,7 +154,7 @@
+
+ uart2: serial@12200 {
+ compatible = "ns16550a";
+- reg = <0x12000 0x100>;
++ reg = <0x12200 0x100>;
+ reg-shift = <2>;
+ interrupts = <9>;
+ clocks = <&core_clk 0>;
+@@ -163,7 +163,7 @@
+
+ uart3: serial@12300 {
+ compatible = "ns16550a";
+- reg = <0x12100 0x100>;
++ reg = <0x12300 0x100>;
+ reg-shift = <2>;
+ interrupts = <10>;
+ clocks = <&core_clk 0>;
+diff --git a/arch/arm/include/asm/elf.h b/arch/arm/include/asm/elf.h
+index afb9cafd3786..674d03f4ba15 100644
+--- a/arch/arm/include/asm/elf.h
++++ b/arch/arm/include/asm/elf.h
+@@ -115,7 +115,7 @@ int dump_task_regs(struct task_struct *t, elf_gregset_t *elfregs);
+ the loader. We need to make sure that it is out of the way of the program
+ that it will "exec", and that there is sufficient room for the brk. */
+
+-#define ELF_ET_DYN_BASE (2 * TASK_SIZE / 3)
++#define ELF_ET_DYN_BASE (TASK_SIZE / 3 * 2)
+
+ /* When the program starts, a1 contains a pointer to a function to be
+ registered with atexit, as per the SVR4 ABI. A value of 0 means we
+diff --git a/arch/arm/include/asm/kvm_emulate.h b/arch/arm/include/asm/kvm_emulate.h
+index b9db269c6e61..66ce17655bb9 100644
+--- a/arch/arm/include/asm/kvm_emulate.h
++++ b/arch/arm/include/asm/kvm_emulate.h
+@@ -33,6 +33,11 @@ void kvm_inject_undefined(struct kvm_vcpu *vcpu);
+ void kvm_inject_dabt(struct kvm_vcpu *vcpu, unsigned long addr);
+ void kvm_inject_pabt(struct kvm_vcpu *vcpu, unsigned long addr);
+
++static inline void vcpu_reset_hcr(struct kvm_vcpu *vcpu)
++{
++ vcpu->arch.hcr = HCR_GUEST_MASK;
++}
++
+ static inline bool vcpu_mode_is_32bit(struct kvm_vcpu *vcpu)
+ {
+ return 1;
+diff --git a/arch/arm/include/asm/kvm_mmu.h b/arch/arm/include/asm/kvm_mmu.h
+index acb0d5712716..16d9d788d0b8 100644
+--- a/arch/arm/include/asm/kvm_mmu.h
++++ b/arch/arm/include/asm/kvm_mmu.h
+@@ -44,6 +44,7 @@
+
+ #ifndef __ASSEMBLY__
+
++#include <linux/highmem.h>
+ #include <asm/cacheflush.h>
+ #include <asm/pgalloc.h>
+
+@@ -52,6 +53,7 @@ int create_hyp_io_mappings(void *from, void *to, phys_addr_t);
+ void free_boot_hyp_pgd(void);
+ void free_hyp_pgds(void);
+
++void stage2_unmap_vm(struct kvm *kvm);
+ int kvm_alloc_stage2_pgd(struct kvm *kvm);
+ void kvm_free_stage2_pgd(struct kvm *kvm);
+ int kvm_phys_addr_ioremap(struct kvm *kvm, phys_addr_t guest_ipa,
+@@ -126,29 +128,28 @@ static inline void kvm_set_s2pmd_writable(pmd_t *pmd)
+ (__boundary - 1 < (end) - 1)? __boundary: (end); \
+ })
+
++#define kvm_pgd_index(addr) pgd_index(addr)
++
+ static inline bool kvm_page_empty(void *ptr)
+ {
+ struct page *ptr_page = virt_to_page(ptr);
+ return page_count(ptr_page) == 1;
+ }
+
+-
+ #define kvm_pte_table_empty(kvm, ptep) kvm_page_empty(ptep)
+ #define kvm_pmd_table_empty(kvm, pmdp) kvm_page_empty(pmdp)
+ #define kvm_pud_table_empty(kvm, pudp) (0)
+
+ #define KVM_PREALLOC_LEVEL 0
+
+-static inline int kvm_prealloc_hwpgd(struct kvm *kvm, pgd_t *pgd)
++static inline void *kvm_get_hwpgd(struct kvm *kvm)
+ {
+- return 0;
++ return kvm->arch.pgd;
+ }
+
+-static inline void kvm_free_hwpgd(struct kvm *kvm) { }
+-
+-static inline void *kvm_get_hwpgd(struct kvm *kvm)
++static inline unsigned int kvm_get_hwpgd_size(void)
+ {
+- return kvm->arch.pgd;
++ return PTRS_PER_S2_PGD * sizeof(pgd_t);
+ }
+
+ struct kvm;
+@@ -160,12 +161,10 @@ static inline bool vcpu_has_cache_enabled(struct kvm_vcpu *vcpu)
+ return (vcpu->arch.cp15[c1_SCTLR] & 0b101) == 0b101;
+ }
+
+-static inline void coherent_cache_guest_page(struct kvm_vcpu *vcpu, hva_t hva,
+- unsigned long size)
++static inline void __coherent_cache_guest_page(struct kvm_vcpu *vcpu, pfn_t pfn,
++ unsigned long size,
++ bool ipa_uncached)
+ {
+- if (!vcpu_has_cache_enabled(vcpu))
+- kvm_flush_dcache_to_poc((void *)hva, size);
+-
+ /*
+ * If we are going to insert an instruction page and the icache is
+ * either VIPT or PIPT, there is a potential problem where the host
+@@ -177,15 +176,73 @@ static inline void coherent_cache_guest_page(struct kvm_vcpu *vcpu, hva_t hva,
+ *
+ * VIVT caches are tagged using both the ASID and the VMID and doesn't
+ * need any kind of flushing (DDI 0406C.b - Page B3-1392).
++ *
++ * We need to do this through a kernel mapping (using the
++ * user-space mapping has proved to be the wrong
++ * solution). For that, we need to kmap one page at a time,
++ * and iterate over the range.
+ */
+- if (icache_is_pipt()) {
+- __cpuc_coherent_user_range(hva, hva + size);
+- } else if (!icache_is_vivt_asid_tagged()) {
++
++ bool need_flush = !vcpu_has_cache_enabled(vcpu) || ipa_uncached;
++
++ VM_BUG_ON(size & ~PAGE_MASK);
++
++ if (!need_flush && !icache_is_pipt())
++ goto vipt_cache;
++
++ while (size) {
++ void *va = kmap_atomic_pfn(pfn);
++
++ if (need_flush)
++ kvm_flush_dcache_to_poc(va, PAGE_SIZE);
++
++ if (icache_is_pipt())
++ __cpuc_coherent_user_range((unsigned long)va,
++ (unsigned long)va + PAGE_SIZE);
++
++ size -= PAGE_SIZE;
++ pfn++;
++
++ kunmap_atomic(va);
++ }
++
++vipt_cache:
++ if (!icache_is_pipt() && !icache_is_vivt_asid_tagged()) {
+ /* any kind of VIPT cache */
+ __flush_icache_all();
+ }
+ }
+
++static inline void __kvm_flush_dcache_pte(pte_t pte)
++{
++ void *va = kmap_atomic(pte_page(pte));
++
++ kvm_flush_dcache_to_poc(va, PAGE_SIZE);
++
++ kunmap_atomic(va);
++}
++
++static inline void __kvm_flush_dcache_pmd(pmd_t pmd)
++{
++ unsigned long size = PMD_SIZE;
++ pfn_t pfn = pmd_pfn(pmd);
++
++ while (size) {
++ void *va = kmap_atomic_pfn(pfn);
++
++ kvm_flush_dcache_to_poc(va, PAGE_SIZE);
++
++ pfn++;
++ size -= PAGE_SIZE;
++
++ kunmap_atomic(va);
++ }
++}
++
++static inline void __kvm_flush_dcache_pud(pud_t pud)
++{
++}
++
+ #define kvm_virt_to_phys(x) virt_to_idmap((unsigned long)(x))
+
+ void stage2_flush_vm(struct kvm *kvm);
+diff --git a/arch/arm/include/uapi/asm/kvm.h b/arch/arm/include/uapi/asm/kvm.h
+index 09ee408c1a67..b404cf886029 100644
+--- a/arch/arm/include/uapi/asm/kvm.h
++++ b/arch/arm/include/uapi/asm/kvm.h
+@@ -193,8 +193,14 @@ struct kvm_arch_memory_slot {
+ #define KVM_ARM_IRQ_CPU_IRQ 0
+ #define KVM_ARM_IRQ_CPU_FIQ 1
+
+-/* Highest supported SPI, from VGIC_NR_IRQS */
++/*
++ * This used to hold the highest supported SPI, but it is now obsolete
++ * and only here to provide source code level compatibility with older
++ * userland. The highest SPI number can be set via KVM_DEV_ARM_VGIC_GRP_NR_IRQS.
++ */
++#ifndef __KERNEL__
+ #define KVM_ARM_IRQ_GIC_MAX 127
++#endif
+
+ /* PSCI interface */
+ #define KVM_PSCI_FN_BASE 0x95c1ba5e
+diff --git a/arch/arm/kernel/hibernate.c b/arch/arm/kernel/hibernate.c
+index c4cc50e58c13..cfb354ff2a60 100644
+--- a/arch/arm/kernel/hibernate.c
++++ b/arch/arm/kernel/hibernate.c
+@@ -22,6 +22,7 @@
+ #include <asm/suspend.h>
+ #include <asm/memory.h>
+ #include <asm/sections.h>
++#include "reboot.h"
+
+ int pfn_is_nosave(unsigned long pfn)
+ {
+@@ -61,7 +62,7 @@ static int notrace arch_save_image(unsigned long unused)
+
+ ret = swsusp_save();
+ if (ret == 0)
+- soft_restart(virt_to_phys(cpu_resume));
++ _soft_restart(virt_to_phys(cpu_resume), false);
+ return ret;
+ }
+
+@@ -86,7 +87,7 @@ static void notrace arch_restore_image(void *unused)
+ for (pbe = restore_pblist; pbe; pbe = pbe->next)
+ copy_page(pbe->orig_address, pbe->address);
+
+- soft_restart(virt_to_phys(cpu_resume));
++ _soft_restart(virt_to_phys(cpu_resume), false);
+ }
+
+ static u64 resume_stack[PAGE_SIZE/2/sizeof(u64)] __nosavedata;
+diff --git a/arch/arm/kernel/process.c b/arch/arm/kernel/process.c
+index fe972a2f3df3..ecefea4e2929 100644
+--- a/arch/arm/kernel/process.c
++++ b/arch/arm/kernel/process.c
+@@ -41,6 +41,7 @@
+ #include <asm/system_misc.h>
+ #include <asm/mach/time.h>
+ #include <asm/tls.h>
++#include "reboot.h"
+
+ #ifdef CONFIG_CC_STACKPROTECTOR
+ #include <linux/stackprotector.h>
+@@ -95,7 +96,7 @@ static void __soft_restart(void *addr)
+ BUG();
+ }
+
+-void soft_restart(unsigned long addr)
++void _soft_restart(unsigned long addr, bool disable_l2)
+ {
+ u64 *stack = soft_restart_stack + ARRAY_SIZE(soft_restart_stack);
+
+@@ -104,7 +105,7 @@ void soft_restart(unsigned long addr)
+ local_fiq_disable();
+
+ /* Disable the L2 if we're the last man standing. */
+- if (num_online_cpus() == 1)
++ if (disable_l2)
+ outer_disable();
+
+ /* Change to the new stack and continue with the reset. */
+@@ -114,6 +115,11 @@ void soft_restart(unsigned long addr)
+ BUG();
+ }
+
++void soft_restart(unsigned long addr)
++{
++ _soft_restart(addr, num_online_cpus() == 1);
++}
++
+ /*
+ * Function pointers to optional machine specific functions
+ */
+diff --git a/arch/arm/kernel/reboot.h b/arch/arm/kernel/reboot.h
+new file mode 100644
+index 000000000000..c87f05816d6b
+--- /dev/null
++++ b/arch/arm/kernel/reboot.h
+@@ -0,0 +1,6 @@
++#ifndef REBOOT_H
++#define REBOOT_H
++
++extern void _soft_restart(unsigned long addr, bool disable_l2);
++
++#endif
+diff --git a/arch/arm/kvm/arm.c b/arch/arm/kvm/arm.c
+index 9e193c8a959e..ed5834e8e2ac 100644
+--- a/arch/arm/kvm/arm.c
++++ b/arch/arm/kvm/arm.c
+@@ -213,6 +213,11 @@ struct kvm_vcpu *kvm_arch_vcpu_create(struct kvm *kvm, unsigned int id)
+ int err;
+ struct kvm_vcpu *vcpu;
+
++ if (irqchip_in_kernel(kvm) && vgic_initialized(kvm)) {
++ err = -EBUSY;
++ goto out;
++ }
++
+ vcpu = kmem_cache_zalloc(kvm_vcpu_cache, GFP_KERNEL);
+ if (!vcpu) {
+ err = -ENOMEM;
+@@ -419,6 +424,7 @@ static void update_vttbr(struct kvm *kvm)
+
+ static int kvm_vcpu_first_run_init(struct kvm_vcpu *vcpu)
+ {
++ struct kvm *kvm = vcpu->kvm;
+ int ret;
+
+ if (likely(vcpu->arch.has_run_once))
+@@ -427,15 +433,23 @@ static int kvm_vcpu_first_run_init(struct kvm_vcpu *vcpu)
+ vcpu->arch.has_run_once = true;
+
+ /*
+- * Initialize the VGIC before running a vcpu the first time on
+- * this VM.
++ * Map the VGIC hardware resources before running a vcpu the first
++ * time on this VM.
+ */
+- if (unlikely(!vgic_initialized(vcpu->kvm))) {
+- ret = kvm_vgic_init(vcpu->kvm);
++ if (unlikely(!vgic_initialized(kvm))) {
++ ret = kvm_vgic_map_resources(kvm);
+ if (ret)
+ return ret;
+ }
+
++ /*
++ * Enable the arch timers only if we have an in-kernel VGIC
++ * and it has been properly initialized, since we cannot handle
++ * interrupts from the virtual timer with a userspace gic.
++ */
++ if (irqchip_in_kernel(kvm) && vgic_initialized(kvm))
++ kvm_timer_enable(kvm);
++
+ return 0;
+ }
+
+@@ -639,8 +653,7 @@ int kvm_vm_ioctl_irq_line(struct kvm *kvm, struct kvm_irq_level *irq_level,
+ if (!irqchip_in_kernel(kvm))
+ return -ENXIO;
+
+- if (irq_num < VGIC_NR_PRIVATE_IRQS ||
+- irq_num > KVM_ARM_IRQ_GIC_MAX)
++ if (irq_num < VGIC_NR_PRIVATE_IRQS)
+ return -EINVAL;
+
+ return kvm_vgic_inject_irq(kvm, 0, irq_num, level);
+@@ -659,10 +672,21 @@ static int kvm_arch_vcpu_ioctl_vcpu_init(struct kvm_vcpu *vcpu,
+ return ret;
+
+ /*
++ * Ensure a rebooted VM will fault in RAM pages and detect if the
++ * guest MMU is turned off and flush the caches as needed.
++ */
++ if (vcpu->arch.has_run_once)
++ stage2_unmap_vm(vcpu->kvm);
++
++ vcpu_reset_hcr(vcpu);
++
++ /*
+ * Handle the "start in power-off" case by marking the VCPU as paused.
+ */
+- if (__test_and_clear_bit(KVM_ARM_VCPU_POWER_OFF, vcpu->arch.features))
++ if (test_bit(KVM_ARM_VCPU_POWER_OFF, vcpu->arch.features))
+ vcpu->arch.pause = true;
++ else
++ vcpu->arch.pause = false;
+
+ return 0;
+ }
+diff --git a/arch/arm/kvm/guest.c b/arch/arm/kvm/guest.c
+index cc0b78769bd8..8c97208b9b97 100644
+--- a/arch/arm/kvm/guest.c
++++ b/arch/arm/kvm/guest.c
+@@ -38,7 +38,6 @@ struct kvm_stats_debugfs_item debugfs_entries[] = {
+
+ int kvm_arch_vcpu_setup(struct kvm_vcpu *vcpu)
+ {
+- vcpu->arch.hcr = HCR_GUEST_MASK;
+ return 0;
+ }
+
+diff --git a/arch/arm/kvm/mmu.c b/arch/arm/kvm/mmu.c
+index 8664ff17cbbe..cba52cf6ed3f 100644
+--- a/arch/arm/kvm/mmu.c
++++ b/arch/arm/kvm/mmu.c
+@@ -58,6 +58,26 @@ static void kvm_tlb_flush_vmid_ipa(struct kvm *kvm, phys_addr_t ipa)
+ kvm_call_hyp(__kvm_tlb_flush_vmid_ipa, kvm, ipa);
+ }
+
++/*
++ * D-Cache management functions. They take the page table entries by
++ * value, as they are flushing the cache using the kernel mapping (or
++ * kmap on 32bit).
++ */
++static void kvm_flush_dcache_pte(pte_t pte)
++{
++ __kvm_flush_dcache_pte(pte);
++}
++
++static void kvm_flush_dcache_pmd(pmd_t pmd)
++{
++ __kvm_flush_dcache_pmd(pmd);
++}
++
++static void kvm_flush_dcache_pud(pud_t pud)
++{
++ __kvm_flush_dcache_pud(pud);
++}
++
+ static int mmu_topup_memory_cache(struct kvm_mmu_memory_cache *cache,
+ int min, int max)
+ {
+@@ -119,6 +139,26 @@ static void clear_pmd_entry(struct kvm *kvm, pmd_t *pmd, phys_addr_t addr)
+ put_page(virt_to_page(pmd));
+ }
+
++/*
++ * Unmapping vs dcache management:
++ *
++ * If a guest maps certain memory pages as uncached, all writes will
++ * bypass the data cache and go directly to RAM. However, the CPUs
++ * can still speculate reads (not writes) and fill cache lines with
++ * data.
++ *
++ * Those cache lines will be *clean* cache lines though, so a
++ * clean+invalidate operation is equivalent to an invalidate
++ * operation, because no cache lines are marked dirty.
++ *
++ * Those clean cache lines could be filled prior to an uncached write
++ * by the guest, and the cache coherent IO subsystem would therefore
++ * end up writing old data to disk.
++ *
++ * This is why right after unmapping a page/section and invalidating
++ * the corresponding TLBs, we call kvm_flush_dcache_p*() to make sure
++ * the IO subsystem will never hit in the cache.
++ */
+ static void unmap_ptes(struct kvm *kvm, pmd_t *pmd,
+ phys_addr_t addr, phys_addr_t end)
+ {
+@@ -128,9 +168,16 @@ static void unmap_ptes(struct kvm *kvm, pmd_t *pmd,
+ start_pte = pte = pte_offset_kernel(pmd, addr);
+ do {
+ if (!pte_none(*pte)) {
++ pte_t old_pte = *pte;
++
+ kvm_set_pte(pte, __pte(0));
+- put_page(virt_to_page(pte));
+ kvm_tlb_flush_vmid_ipa(kvm, addr);
++
++ /* No need to invalidate the cache for device mappings */
++ if ((pte_val(old_pte) & PAGE_S2_DEVICE) != PAGE_S2_DEVICE)
++ kvm_flush_dcache_pte(old_pte);
++
++ put_page(virt_to_page(pte));
+ }
+ } while (pte++, addr += PAGE_SIZE, addr != end);
+
+@@ -149,8 +196,13 @@ static void unmap_pmds(struct kvm *kvm, pud_t *pud,
+ next = kvm_pmd_addr_end(addr, end);
+ if (!pmd_none(*pmd)) {
+ if (kvm_pmd_huge(*pmd)) {
++ pmd_t old_pmd = *pmd;
++
+ pmd_clear(pmd);
+ kvm_tlb_flush_vmid_ipa(kvm, addr);
++
++ kvm_flush_dcache_pmd(old_pmd);
++
+ put_page(virt_to_page(pmd));
+ } else {
+ unmap_ptes(kvm, pmd, addr, next);
+@@ -173,8 +225,13 @@ static void unmap_puds(struct kvm *kvm, pgd_t *pgd,
+ next = kvm_pud_addr_end(addr, end);
+ if (!pud_none(*pud)) {
+ if (pud_huge(*pud)) {
++ pud_t old_pud = *pud;
++
+ pud_clear(pud);
+ kvm_tlb_flush_vmid_ipa(kvm, addr);
++
++ kvm_flush_dcache_pud(old_pud);
++
+ put_page(virt_to_page(pud));
+ } else {
+ unmap_pmds(kvm, pud, addr, next);
+@@ -194,7 +251,7 @@ static void unmap_range(struct kvm *kvm, pgd_t *pgdp,
+ phys_addr_t addr = start, end = start + size;
+ phys_addr_t next;
+
+- pgd = pgdp + pgd_index(addr);
++ pgd = pgdp + kvm_pgd_index(addr);
+ do {
+ next = kvm_pgd_addr_end(addr, end);
+ if (!pgd_none(*pgd))
+@@ -209,10 +266,9 @@ static void stage2_flush_ptes(struct kvm *kvm, pmd_t *pmd,
+
+ pte = pte_offset_kernel(pmd, addr);
+ do {
+- if (!pte_none(*pte)) {
+- hva_t hva = gfn_to_hva(kvm, addr >> PAGE_SHIFT);
+- kvm_flush_dcache_to_poc((void*)hva, PAGE_SIZE);
+- }
++ if (!pte_none(*pte) &&
++ (pte_val(*pte) & PAGE_S2_DEVICE) != PAGE_S2_DEVICE)
++ kvm_flush_dcache_pte(*pte);
+ } while (pte++, addr += PAGE_SIZE, addr != end);
+ }
+
+@@ -226,12 +282,10 @@ static void stage2_flush_pmds(struct kvm *kvm, pud_t *pud,
+ do {
+ next = kvm_pmd_addr_end(addr, end);
+ if (!pmd_none(*pmd)) {
+- if (kvm_pmd_huge(*pmd)) {
+- hva_t hva = gfn_to_hva(kvm, addr >> PAGE_SHIFT);
+- kvm_flush_dcache_to_poc((void*)hva, PMD_SIZE);
+- } else {
++ if (kvm_pmd_huge(*pmd))
++ kvm_flush_dcache_pmd(*pmd);
++ else
+ stage2_flush_ptes(kvm, pmd, addr, next);
+- }
+ }
+ } while (pmd++, addr = next, addr != end);
+ }
+@@ -246,12 +300,10 @@ static void stage2_flush_puds(struct kvm *kvm, pgd_t *pgd,
+ do {
+ next = kvm_pud_addr_end(addr, end);
+ if (!pud_none(*pud)) {
+- if (pud_huge(*pud)) {
+- hva_t hva = gfn_to_hva(kvm, addr >> PAGE_SHIFT);
+- kvm_flush_dcache_to_poc((void*)hva, PUD_SIZE);
+- } else {
++ if (pud_huge(*pud))
++ kvm_flush_dcache_pud(*pud);
++ else
+ stage2_flush_pmds(kvm, pud, addr, next);
+- }
+ }
+ } while (pud++, addr = next, addr != end);
+ }
+@@ -264,7 +316,7 @@ static void stage2_flush_memslot(struct kvm *kvm,
+ phys_addr_t next;
+ pgd_t *pgd;
+
+- pgd = kvm->arch.pgd + pgd_index(addr);
++ pgd = kvm->arch.pgd + kvm_pgd_index(addr);
+ do {
+ next = kvm_pgd_addr_end(addr, end);
+ stage2_flush_puds(kvm, pgd, addr, next);
+@@ -541,6 +593,20 @@ int create_hyp_io_mappings(void *from, void *to, phys_addr_t phys_addr)
+ __phys_to_pfn(phys_addr), PAGE_HYP_DEVICE);
+ }
+
++/* Free the HW pgd, one page at a time */
++static void kvm_free_hwpgd(void *hwpgd)
++{
++ free_pages_exact(hwpgd, kvm_get_hwpgd_size());
++}
++
++/* Allocate the HW PGD, making sure that each page gets its own refcount */
++static void *kvm_alloc_hwpgd(void)
++{
++ unsigned int size = kvm_get_hwpgd_size();
++
++ return alloc_pages_exact(size, GFP_KERNEL | __GFP_ZERO);
++}
++
+ /**
+ * kvm_alloc_stage2_pgd - allocate level-1 table for stage-2 translation.
+ * @kvm: The KVM struct pointer for the VM.
+@@ -554,15 +620,31 @@ int create_hyp_io_mappings(void *from, void *to, phys_addr_t phys_addr)
+ */
+ int kvm_alloc_stage2_pgd(struct kvm *kvm)
+ {
+- int ret;
+ pgd_t *pgd;
++ void *hwpgd;
+
+ if (kvm->arch.pgd != NULL) {
+ kvm_err("kvm_arch already initialized?\n");
+ return -EINVAL;
+ }
+
++ hwpgd = kvm_alloc_hwpgd();
++ if (!hwpgd)
++ return -ENOMEM;
++
++ /* When the kernel uses more levels of page tables than the
++ * guest, we allocate a fake PGD and pre-populate it to point
++ * to the next-level page table, which will be the real
++ * initial page table pointed to by the VTTBR.
++ *
++ * When KVM_PREALLOC_LEVEL==2, we allocate a single page for
++ * the PMD and the kernel will use folded pud.
++ * When KVM_PREALLOC_LEVEL==1, we allocate 2 consecutive PUD
++ * pages.
++ */
+ if (KVM_PREALLOC_LEVEL > 0) {
++ int i;
++
+ /*
+ * Allocate fake pgd for the page table manipulation macros to
+ * work. This is not used by the hardware and we have no
+@@ -570,30 +652,32 @@ int kvm_alloc_stage2_pgd(struct kvm *kvm)
+ */
+ pgd = (pgd_t *)kmalloc(PTRS_PER_S2_PGD * sizeof(pgd_t),
+ GFP_KERNEL | __GFP_ZERO);
++
++ if (!pgd) {
++ kvm_free_hwpgd(hwpgd);
++ return -ENOMEM;
++ }
++
++ /* Plug the HW PGD into the fake one. */
++ for (i = 0; i < PTRS_PER_S2_PGD; i++) {
++ if (KVM_PREALLOC_LEVEL == 1)
++ pgd_populate(NULL, pgd + i,
++ (pud_t *)hwpgd + i * PTRS_PER_PUD);
++ else if (KVM_PREALLOC_LEVEL == 2)
++ pud_populate(NULL, pud_offset(pgd, 0) + i,
++ (pmd_t *)hwpgd + i * PTRS_PER_PMD);
++ }
+ } else {
+ /*
+ * Allocate actual first-level Stage-2 page table used by the
+ * hardware for Stage-2 page table walks.
+ */
+- pgd = (pgd_t *)__get_free_pages(GFP_KERNEL | __GFP_ZERO, S2_PGD_ORDER);
++ pgd = (pgd_t *)hwpgd;
+ }
+
+- if (!pgd)
+- return -ENOMEM;
+-
+- ret = kvm_prealloc_hwpgd(kvm, pgd);
+- if (ret)
+- goto out_err;
+-
+ kvm_clean_pgd(pgd);
+ kvm->arch.pgd = pgd;
+ return 0;
+-out_err:
+- if (KVM_PREALLOC_LEVEL > 0)
+- kfree(pgd);
+- else
+- free_pages((unsigned long)pgd, S2_PGD_ORDER);
+- return ret;
+ }
+
+ /**
+@@ -612,6 +696,71 @@ static void unmap_stage2_range(struct kvm *kvm, phys_addr_t start, u64 size)
+ unmap_range(kvm, kvm->arch.pgd, start, size);
+ }
+
++static void stage2_unmap_memslot(struct kvm *kvm,
++ struct kvm_memory_slot *memslot)
++{
++ hva_t hva = memslot->userspace_addr;
++ phys_addr_t addr = memslot->base_gfn << PAGE_SHIFT;
++ phys_addr_t size = PAGE_SIZE * memslot->npages;
++ hva_t reg_end = hva + size;
++
++ /*
++ * A memory region could potentially cover multiple VMAs, and any holes
++ * between them, so iterate over all of them to find out if we should
++ * unmap any of them.
++ *
++ * +--------------------------------------------+
++ * +---------------+----------------+ +----------------+
++ * | : VMA 1 | VMA 2 | | VMA 3 : |
++ * +---------------+----------------+ +----------------+
++ * | memory region |
++ * +--------------------------------------------+
++ */
++ do {
++ struct vm_area_struct *vma = find_vma(current->mm, hva);
++ hva_t vm_start, vm_end;
++
++ if (!vma || vma->vm_start >= reg_end)
++ break;
++
++ /*
++ * Take the intersection of this VMA with the memory region
++ */
++ vm_start = max(hva, vma->vm_start);
++ vm_end = min(reg_end, vma->vm_end);
++
++ if (!(vma->vm_flags & VM_PFNMAP)) {
++ gpa_t gpa = addr + (vm_start - memslot->userspace_addr);
++ unmap_stage2_range(kvm, gpa, vm_end - vm_start);
++ }
++ hva = vm_end;
++ } while (hva < reg_end);
++}
++
++/**
++ * stage2_unmap_vm - Unmap Stage-2 RAM mappings
++ * @kvm: The struct kvm pointer
++ *
++ * Go through the memregions and unmap any reguler RAM
++ * backing memory already mapped to the VM.
++ */
++void stage2_unmap_vm(struct kvm *kvm)
++{
++ struct kvm_memslots *slots;
++ struct kvm_memory_slot *memslot;
++ int idx;
++
++ idx = srcu_read_lock(&kvm->srcu);
++ spin_lock(&kvm->mmu_lock);
++
++ slots = kvm_memslots(kvm);
++ kvm_for_each_memslot(memslot, slots)
++ stage2_unmap_memslot(kvm, memslot);
++
++ spin_unlock(&kvm->mmu_lock);
++ srcu_read_unlock(&kvm->srcu, idx);
++}
++
+ /**
+ * kvm_free_stage2_pgd - free all stage-2 tables
+ * @kvm: The KVM struct pointer for the VM.
+@@ -629,11 +778,10 @@ void kvm_free_stage2_pgd(struct kvm *kvm)
+ return;
+
+ unmap_stage2_range(kvm, 0, KVM_PHYS_SIZE);
+- kvm_free_hwpgd(kvm);
++ kvm_free_hwpgd(kvm_get_hwpgd(kvm));
+ if (KVM_PREALLOC_LEVEL > 0)
+ kfree(kvm->arch.pgd);
+- else
+- free_pages((unsigned long)kvm->arch.pgd, S2_PGD_ORDER);
++
+ kvm->arch.pgd = NULL;
+ }
+
+@@ -643,7 +791,7 @@ static pud_t *stage2_get_pud(struct kvm *kvm, struct kvm_mmu_memory_cache *cache
+ pgd_t *pgd;
+ pud_t *pud;
+
+- pgd = kvm->arch.pgd + pgd_index(addr);
++ pgd = kvm->arch.pgd + kvm_pgd_index(addr);
+ if (WARN_ON(pgd_none(*pgd))) {
+ if (!cache)
+ return NULL;
+@@ -840,6 +988,12 @@ static bool kvm_is_device_pfn(unsigned long pfn)
+ return !pfn_valid(pfn);
+ }
+
++static void coherent_cache_guest_page(struct kvm_vcpu *vcpu, pfn_t pfn,
++ unsigned long size, bool uncached)
++{
++ __coherent_cache_guest_page(vcpu, pfn, size, uncached);
++}
++
+ static int user_mem_abort(struct kvm_vcpu *vcpu, phys_addr_t fault_ipa,
+ struct kvm_memory_slot *memslot, unsigned long hva,
+ unsigned long fault_status)
+@@ -853,6 +1007,7 @@ static int user_mem_abort(struct kvm_vcpu *vcpu, phys_addr_t fault_ipa,
+ struct vm_area_struct *vma;
+ pfn_t pfn;
+ pgprot_t mem_type = PAGE_S2;
++ bool fault_ipa_uncached;
+
+ write_fault = kvm_is_write_fault(vcpu);
+ if (fault_status == FSC_PERM && !write_fault) {
+@@ -919,6 +1074,8 @@ static int user_mem_abort(struct kvm_vcpu *vcpu, phys_addr_t fault_ipa,
+ if (!hugetlb && !force_pte)
+ hugetlb = transparent_hugepage_adjust(&pfn, &fault_ipa);
+
++ fault_ipa_uncached = memslot->flags & KVM_MEMSLOT_INCOHERENT;
++
+ if (hugetlb) {
+ pmd_t new_pmd = pfn_pmd(pfn, mem_type);
+ new_pmd = pmd_mkhuge(new_pmd);
+@@ -926,7 +1083,7 @@ static int user_mem_abort(struct kvm_vcpu *vcpu, phys_addr_t fault_ipa,
+ kvm_set_s2pmd_writable(&new_pmd);
+ kvm_set_pfn_dirty(pfn);
+ }
+- coherent_cache_guest_page(vcpu, hva & PMD_MASK, PMD_SIZE);
++ coherent_cache_guest_page(vcpu, pfn, PMD_SIZE, fault_ipa_uncached);
+ ret = stage2_set_pmd_huge(kvm, memcache, fault_ipa, &new_pmd);
+ } else {
+ pte_t new_pte = pfn_pte(pfn, mem_type);
+@@ -934,7 +1091,7 @@ static int user_mem_abort(struct kvm_vcpu *vcpu, phys_addr_t fault_ipa,
+ kvm_set_s2pte_writable(&new_pte);
+ kvm_set_pfn_dirty(pfn);
+ }
+- coherent_cache_guest_page(vcpu, hva, PAGE_SIZE);
++ coherent_cache_guest_page(vcpu, pfn, PAGE_SIZE, fault_ipa_uncached);
+ ret = stage2_set_pte(kvm, memcache, fault_ipa, &new_pte,
+ pgprot_val(mem_type) == pgprot_val(PAGE_S2_DEVICE));
+ }
+@@ -1294,11 +1451,12 @@ int kvm_arch_prepare_memory_region(struct kvm *kvm,
+ hva = vm_end;
+ } while (hva < reg_end);
+
+- if (ret) {
+- spin_lock(&kvm->mmu_lock);
++ spin_lock(&kvm->mmu_lock);
++ if (ret)
+ unmap_stage2_range(kvm, mem->guest_phys_addr, mem->memory_size);
+- spin_unlock(&kvm->mmu_lock);
+- }
++ else
++ stage2_flush_memslot(kvm, memslot);
++ spin_unlock(&kvm->mmu_lock);
+ return ret;
+ }
+
+@@ -1310,6 +1468,15 @@ void kvm_arch_free_memslot(struct kvm *kvm, struct kvm_memory_slot *free,
+ int kvm_arch_create_memslot(struct kvm *kvm, struct kvm_memory_slot *slot,
+ unsigned long npages)
+ {
++ /*
++ * Readonly memslots are not incoherent with the caches by definition,
++ * but in practice, they are used mostly to emulate ROMs or NOR flashes
++ * that the guest may consider devices and hence map as uncached.
++ * To prevent incoherency issues in these cases, tag all readonly
++ * regions as incoherent.
++ */
++ if (slot->flags & KVM_MEM_READONLY)
++ slot->flags |= KVM_MEMSLOT_INCOHERENT;
+ return 0;
+ }
+
+diff --git a/arch/arm/kvm/psci.c b/arch/arm/kvm/psci.c
+index 09cf37737ee2..58cb3248d277 100644
+--- a/arch/arm/kvm/psci.c
++++ b/arch/arm/kvm/psci.c
+@@ -15,6 +15,7 @@
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ */
+
++#include <linux/preempt.h>
+ #include <linux/kvm_host.h>
+ #include <linux/wait.h>
+
+@@ -166,6 +167,23 @@ static unsigned long kvm_psci_vcpu_affinity_info(struct kvm_vcpu *vcpu)
+
+ static void kvm_prepare_system_event(struct kvm_vcpu *vcpu, u32 type)
+ {
++ int i;
++ struct kvm_vcpu *tmp;
++
++ /*
++ * The KVM ABI specifies that a system event exit may call KVM_RUN
++ * again and may perform shutdown/reboot at a later time that when the
++ * actual request is made. Since we are implementing PSCI and a
++ * caller of PSCI reboot and shutdown expects that the system shuts
++ * down or reboots immediately, let's make sure that VCPUs are not run
++ * after this call is handled and before the VCPUs have been
++ * re-initialized.
++ */
++ kvm_for_each_vcpu(i, tmp, vcpu->kvm) {
++ tmp->arch.pause = true;
++ kvm_vcpu_kick(tmp);
++ }
++
+ memset(&vcpu->run->system_event, 0, sizeof(vcpu->run->system_event));
+ vcpu->run->system_event.type = type;
+ vcpu->run->exit_reason = KVM_EXIT_SYSTEM_EVENT;
+diff --git a/arch/arm/mach-mvebu/pmsu.c b/arch/arm/mach-mvebu/pmsu.c
+index bbd8664d1bac..6f8a85c5965c 100644
+--- a/arch/arm/mach-mvebu/pmsu.c
++++ b/arch/arm/mach-mvebu/pmsu.c
+@@ -415,6 +415,9 @@ static __init int armada_38x_cpuidle_init(void)
+ void __iomem *mpsoc_base;
+ u32 reg;
+
++ pr_warn("CPU idle is currently broken on Armada 38x: disabling");
++ return 0;
++
+ np = of_find_compatible_node(NULL, NULL,
+ "marvell,armada-380-coherency-fabric");
+ if (!np)
+@@ -476,6 +479,16 @@ static int __init mvebu_v7_cpu_pm_init(void)
+ return 0;
+ of_node_put(np);
+
++ /*
++ * Currently the CPU idle support for Armada 38x is broken, as
++ * the CPU hotplug uses some of the CPU idle functions it is
++ * broken too, so let's disable it
++ */
++ if (of_machine_is_compatible("marvell,armada380")) {
++ cpu_hotplug_disable();
++ pr_warn("CPU hotplug support is currently broken on Armada 38x: disabling");
++ }
++
+ if (of_machine_is_compatible("marvell,armadaxp"))
+ ret = armada_xp_cpuidle_init();
+ else if (of_machine_is_compatible("marvell,armada370"))
+@@ -489,7 +502,8 @@ static int __init mvebu_v7_cpu_pm_init(void)
+ return ret;
+
+ mvebu_v7_pmsu_enable_l2_powerdown_onidle();
+- platform_device_register(&mvebu_v7_cpuidle_device);
++ if (mvebu_v7_cpuidle_device.name)
++ platform_device_register(&mvebu_v7_cpuidle_device);
+ cpu_pm_register_notifier(&mvebu_v7_cpu_pm_notifier);
+
+ return 0;
+diff --git a/arch/arm/mach-s3c64xx/crag6410.h b/arch/arm/mach-s3c64xx/crag6410.h
+index 7bc66682687e..dcbe17f5e5f8 100644
+--- a/arch/arm/mach-s3c64xx/crag6410.h
++++ b/arch/arm/mach-s3c64xx/crag6410.h
+@@ -14,6 +14,7 @@
+ #include <mach/gpio-samsung.h>
+
+ #define GLENFARCLAS_PMIC_IRQ_BASE IRQ_BOARD_START
++#define BANFF_PMIC_IRQ_BASE (IRQ_BOARD_START + 64)
+
+ #define PCA935X_GPIO_BASE GPIO_BOARD_START
+ #define CODEC_GPIO_BASE (GPIO_BOARD_START + 8)
+diff --git a/arch/arm/mach-s3c64xx/mach-crag6410.c b/arch/arm/mach-s3c64xx/mach-crag6410.c
+index 10b913baab28..65c426bc45f7 100644
+--- a/arch/arm/mach-s3c64xx/mach-crag6410.c
++++ b/arch/arm/mach-s3c64xx/mach-crag6410.c
+@@ -554,6 +554,7 @@ static struct wm831x_touch_pdata touch_pdata = {
+
+ static struct wm831x_pdata crag_pmic_pdata = {
+ .wm831x_num = 1,
++ .irq_base = BANFF_PMIC_IRQ_BASE,
+ .gpio_base = BANFF_PMIC_GPIO_BASE,
+ .soft_shutdown = true,
+
+diff --git a/arch/arm/mm/hugetlbpage.c b/arch/arm/mm/hugetlbpage.c
+index 66781bf34077..c72412415093 100644
+--- a/arch/arm/mm/hugetlbpage.c
++++ b/arch/arm/mm/hugetlbpage.c
+@@ -36,12 +36,6 @@
+ * of type casting from pmd_t * to pte_t *.
+ */
+
+-struct page *follow_huge_addr(struct mm_struct *mm, unsigned long address,
+- int write)
+-{
+- return ERR_PTR(-EINVAL);
+-}
+-
+ int pud_huge(pud_t pud)
+ {
+ return 0;
+diff --git a/arch/arm64/include/asm/kvm_emulate.h b/arch/arm64/include/asm/kvm_emulate.h
+index 5674a55b5518..865a7e28ea2d 100644
+--- a/arch/arm64/include/asm/kvm_emulate.h
++++ b/arch/arm64/include/asm/kvm_emulate.h
+@@ -38,6 +38,13 @@ void kvm_inject_undefined(struct kvm_vcpu *vcpu);
+ void kvm_inject_dabt(struct kvm_vcpu *vcpu, unsigned long addr);
+ void kvm_inject_pabt(struct kvm_vcpu *vcpu, unsigned long addr);
+
++static inline void vcpu_reset_hcr(struct kvm_vcpu *vcpu)
++{
++ vcpu->arch.hcr_el2 = HCR_GUEST_FLAGS;
++ if (test_bit(KVM_ARM_VCPU_EL1_32BIT, vcpu->arch.features))
++ vcpu->arch.hcr_el2 &= ~HCR_RW;
++}
++
+ static inline unsigned long *vcpu_pc(const struct kvm_vcpu *vcpu)
+ {
+ return (unsigned long *)&vcpu_gp_regs(vcpu)->regs.pc;
+diff --git a/arch/arm64/include/asm/kvm_host.h b/arch/arm64/include/asm/kvm_host.h
+index 2012c4ba8d67..dbd32127dbb6 100644
+--- a/arch/arm64/include/asm/kvm_host.h
++++ b/arch/arm64/include/asm/kvm_host.h
+@@ -200,6 +200,7 @@ struct kvm_vcpu *kvm_arm_get_running_vcpu(void);
+ struct kvm_vcpu * __percpu *kvm_get_running_vcpus(void);
+
+ u64 kvm_call_hyp(void *hypfn, ...);
++void force_vm_exit(const cpumask_t *mask);
+
+ int handle_exit(struct kvm_vcpu *vcpu, struct kvm_run *run,
+ int exception_index);
+diff --git a/arch/arm64/include/asm/kvm_mmu.h b/arch/arm64/include/asm/kvm_mmu.h
+index 0caf7a59f6a1..a205e957d5c4 100644
+--- a/arch/arm64/include/asm/kvm_mmu.h
++++ b/arch/arm64/include/asm/kvm_mmu.h
+@@ -83,6 +83,7 @@ int create_hyp_io_mappings(void *from, void *to, phys_addr_t);
+ void free_boot_hyp_pgd(void);
+ void free_hyp_pgds(void);
+
++void stage2_unmap_vm(struct kvm *kvm);
+ int kvm_alloc_stage2_pgd(struct kvm *kvm);
+ void kvm_free_stage2_pgd(struct kvm *kvm);
+ int kvm_phys_addr_ioremap(struct kvm *kvm, phys_addr_t guest_ipa,
+@@ -136,6 +137,8 @@ static inline void kvm_set_s2pmd_writable(pmd_t *pmd)
+ #define PTRS_PER_S2_PGD (1 << PTRS_PER_S2_PGD_SHIFT)
+ #define S2_PGD_ORDER get_order(PTRS_PER_S2_PGD * sizeof(pgd_t))
+
++#define kvm_pgd_index(addr) (((addr) >> PGDIR_SHIFT) & (PTRS_PER_S2_PGD - 1))
++
+ /*
+ * If we are concatenating first level stage-2 page tables, we would have less
+ * than or equal to 16 pointers in the fake PGD, because that's what the
+@@ -149,43 +152,6 @@ static inline void kvm_set_s2pmd_writable(pmd_t *pmd)
+ #define KVM_PREALLOC_LEVEL (0)
+ #endif
+
+-/**
+- * kvm_prealloc_hwpgd - allocate inital table for VTTBR
+- * @kvm: The KVM struct pointer for the VM.
+- * @pgd: The kernel pseudo pgd
+- *
+- * When the kernel uses more levels of page tables than the guest, we allocate
+- * a fake PGD and pre-populate it to point to the next-level page table, which
+- * will be the real initial page table pointed to by the VTTBR.
+- *
+- * When KVM_PREALLOC_LEVEL==2, we allocate a single page for the PMD and
+- * the kernel will use folded pud. When KVM_PREALLOC_LEVEL==1, we
+- * allocate 2 consecutive PUD pages.
+- */
+-static inline int kvm_prealloc_hwpgd(struct kvm *kvm, pgd_t *pgd)
+-{
+- unsigned int i;
+- unsigned long hwpgd;
+-
+- if (KVM_PREALLOC_LEVEL == 0)
+- return 0;
+-
+- hwpgd = __get_free_pages(GFP_KERNEL | __GFP_ZERO, PTRS_PER_S2_PGD_SHIFT);
+- if (!hwpgd)
+- return -ENOMEM;
+-
+- for (i = 0; i < PTRS_PER_S2_PGD; i++) {
+- if (KVM_PREALLOC_LEVEL == 1)
+- pgd_populate(NULL, pgd + i,
+- (pud_t *)hwpgd + i * PTRS_PER_PUD);
+- else if (KVM_PREALLOC_LEVEL == 2)
+- pud_populate(NULL, pud_offset(pgd, 0) + i,
+- (pmd_t *)hwpgd + i * PTRS_PER_PMD);
+- }
+-
+- return 0;
+-}
+-
+ static inline void *kvm_get_hwpgd(struct kvm *kvm)
+ {
+ pgd_t *pgd = kvm->arch.pgd;
+@@ -202,12 +168,11 @@ static inline void *kvm_get_hwpgd(struct kvm *kvm)
+ return pmd_offset(pud, 0);
+ }
+
+-static inline void kvm_free_hwpgd(struct kvm *kvm)
++static inline unsigned int kvm_get_hwpgd_size(void)
+ {
+- if (KVM_PREALLOC_LEVEL > 0) {
+- unsigned long hwpgd = (unsigned long)kvm_get_hwpgd(kvm);
+- free_pages(hwpgd, PTRS_PER_S2_PGD_SHIFT);
+- }
++ if (KVM_PREALLOC_LEVEL > 0)
++ return PTRS_PER_S2_PGD * PAGE_SIZE;
++ return PTRS_PER_S2_PGD * sizeof(pgd_t);
+ }
+
+ static inline bool kvm_page_empty(void *ptr)
+@@ -242,20 +207,42 @@ static inline bool vcpu_has_cache_enabled(struct kvm_vcpu *vcpu)
+ return (vcpu_sys_reg(vcpu, SCTLR_EL1) & 0b101) == 0b101;
+ }
+
+-static inline void coherent_cache_guest_page(struct kvm_vcpu *vcpu, hva_t hva,
+- unsigned long size)
++static inline void __coherent_cache_guest_page(struct kvm_vcpu *vcpu, pfn_t pfn,
++ unsigned long size,
++ bool ipa_uncached)
+ {
+- if (!vcpu_has_cache_enabled(vcpu))
+- kvm_flush_dcache_to_poc((void *)hva, size);
++ void *va = page_address(pfn_to_page(pfn));
++
++ if (!vcpu_has_cache_enabled(vcpu) || ipa_uncached)
++ kvm_flush_dcache_to_poc(va, size);
+
+ if (!icache_is_aliasing()) { /* PIPT */
+- flush_icache_range(hva, hva + size);
++ flush_icache_range((unsigned long)va,
++ (unsigned long)va + size);
+ } else if (!icache_is_aivivt()) { /* non ASID-tagged VIVT */
+ /* any kind of VIPT cache */
+ __flush_icache_all();
+ }
+ }
+
++static inline void __kvm_flush_dcache_pte(pte_t pte)
++{
++ struct page *page = pte_page(pte);
++ kvm_flush_dcache_to_poc(page_address(page), PAGE_SIZE);
++}
++
++static inline void __kvm_flush_dcache_pmd(pmd_t pmd)
++{
++ struct page *page = pmd_page(pmd);
++ kvm_flush_dcache_to_poc(page_address(page), PMD_SIZE);
++}
++
++static inline void __kvm_flush_dcache_pud(pud_t pud)
++{
++ struct page *page = pud_page(pud);
++ kvm_flush_dcache_to_poc(page_address(page), PUD_SIZE);
++}
++
+ #define kvm_virt_to_phys(x) __virt_to_phys((unsigned long)(x))
+
+ void stage2_flush_vm(struct kvm *kvm);
+diff --git a/arch/arm64/include/uapi/asm/kvm.h b/arch/arm64/include/uapi/asm/kvm.h
+index 8e38878c87c6..d9e9822efcee 100644
+--- a/arch/arm64/include/uapi/asm/kvm.h
++++ b/arch/arm64/include/uapi/asm/kvm.h
+@@ -179,8 +179,14 @@ struct kvm_arch_memory_slot {
+ #define KVM_ARM_IRQ_CPU_IRQ 0
+ #define KVM_ARM_IRQ_CPU_FIQ 1
+
+-/* Highest supported SPI, from VGIC_NR_IRQS */
++/*
++ * This used to hold the highest supported SPI, but it is now obsolete
++ * and only here to provide source code level compatibility with older
++ * userland. The highest SPI number can be set via KVM_DEV_ARM_VGIC_GRP_NR_IRQS.
++ */
++#ifndef __KERNEL__
+ #define KVM_ARM_IRQ_GIC_MAX 127
++#endif
+
+ /* PSCI interface */
+ #define KVM_PSCI_FN_BASE 0x95c1ba5e
+diff --git a/arch/arm64/kvm/guest.c b/arch/arm64/kvm/guest.c
+index 76794692c20b..84d5959ff874 100644
+--- a/arch/arm64/kvm/guest.c
++++ b/arch/arm64/kvm/guest.c
+@@ -38,7 +38,6 @@ struct kvm_stats_debugfs_item debugfs_entries[] = {
+
+ int kvm_arch_vcpu_setup(struct kvm_vcpu *vcpu)
+ {
+- vcpu->arch.hcr_el2 = HCR_GUEST_FLAGS;
+ return 0;
+ }
+
+diff --git a/arch/arm64/kvm/hyp.S b/arch/arm64/kvm/hyp.S
+index b72aa9f9215c..a767f6a4ce54 100644
+--- a/arch/arm64/kvm/hyp.S
++++ b/arch/arm64/kvm/hyp.S
+@@ -1014,6 +1014,7 @@ ENTRY(__kvm_tlb_flush_vmid_ipa)
+ * Instead, we invalidate Stage-2 for this IPA, and the
+ * whole of Stage-1. Weep...
+ */
++ lsr x1, x1, #12
+ tlbi ipas2e1is, x1
+ /*
+ * We have to ensure completion of the invalidation at Stage-2,
+diff --git a/arch/arm64/kvm/reset.c b/arch/arm64/kvm/reset.c
+index 70a7816535cd..0b4326578985 100644
+--- a/arch/arm64/kvm/reset.c
++++ b/arch/arm64/kvm/reset.c
+@@ -90,7 +90,6 @@ int kvm_reset_vcpu(struct kvm_vcpu *vcpu)
+ if (!cpu_has_32bit_el1())
+ return -EINVAL;
+ cpu_reset = &default_regs_reset32;
+- vcpu->arch.hcr_el2 &= ~HCR_RW;
+ } else {
+ cpu_reset = &default_regs_reset;
+ }
+diff --git a/arch/arm64/mm/dma-mapping.c b/arch/arm64/mm/dma-mapping.c
+index df34a70caca1..6efbb52cb92e 100644
+--- a/arch/arm64/mm/dma-mapping.c
++++ b/arch/arm64/mm/dma-mapping.c
+@@ -67,8 +67,7 @@ static void *__alloc_from_pool(size_t size, struct page **ret_page, gfp_t flags)
+
+ *ret_page = phys_to_page(phys);
+ ptr = (void *)val;
+- if (flags & __GFP_ZERO)
+- memset(ptr, 0, size);
++ memset(ptr, 0, size);
+ }
+
+ return ptr;
+@@ -113,8 +112,7 @@ static void *__dma_alloc_coherent(struct device *dev, size_t size,
+
+ *dma_handle = phys_to_dma(dev, page_to_phys(page));
+ addr = page_address(page);
+- if (flags & __GFP_ZERO)
+- memset(addr, 0, size);
++ memset(addr, 0, size);
+ return addr;
+ } else {
+ return swiotlb_alloc_coherent(dev, size, dma_handle, flags);
+diff --git a/arch/arm64/mm/hugetlbpage.c b/arch/arm64/mm/hugetlbpage.c
+index 023747bf4dd7..2de9d2e59d96 100644
+--- a/arch/arm64/mm/hugetlbpage.c
++++ b/arch/arm64/mm/hugetlbpage.c
+@@ -38,12 +38,6 @@ int huge_pmd_unshare(struct mm_struct *mm, unsigned long *addr, pte_t *ptep)
+ }
+ #endif
+
+-struct page *follow_huge_addr(struct mm_struct *mm, unsigned long address,
+- int write)
+-{
+- return ERR_PTR(-EINVAL);
+-}
+-
+ int pmd_huge(pmd_t pmd)
+ {
+ return !(pmd_val(pmd) & PMD_TABLE_BIT);
+diff --git a/arch/c6x/kernel/time.c b/arch/c6x/kernel/time.c
+index 356ee84cad95..04845aaf5985 100644
+--- a/arch/c6x/kernel/time.c
++++ b/arch/c6x/kernel/time.c
+@@ -49,7 +49,7 @@ u64 sched_clock(void)
+ return (tsc * sched_clock_multiplier) >> SCHED_CLOCK_SHIFT;
+ }
+
+-void time_init(void)
++void __init time_init(void)
+ {
+ u64 tmp = (u64)NSEC_PER_SEC << SCHED_CLOCK_SHIFT;
+
+diff --git a/arch/ia64/mm/hugetlbpage.c b/arch/ia64/mm/hugetlbpage.c
+index 76069c18ee42..52b7604b5215 100644
+--- a/arch/ia64/mm/hugetlbpage.c
++++ b/arch/ia64/mm/hugetlbpage.c
+@@ -114,12 +114,6 @@ int pud_huge(pud_t pud)
+ return 0;
+ }
+
+-struct page *
+-follow_huge_pmd(struct mm_struct *mm, unsigned long address, pmd_t *pmd, int write)
+-{
+- return NULL;
+-}
+-
+ void hugetlb_free_pgd_range(struct mmu_gather *tlb,
+ unsigned long addr, unsigned long end,
+ unsigned long floor, unsigned long ceiling)
+diff --git a/arch/metag/mm/hugetlbpage.c b/arch/metag/mm/hugetlbpage.c
+index 3c32075d2945..7ca80ac42ed5 100644
+--- a/arch/metag/mm/hugetlbpage.c
++++ b/arch/metag/mm/hugetlbpage.c
+@@ -94,12 +94,6 @@ int huge_pmd_unshare(struct mm_struct *mm, unsigned long *addr, pte_t *ptep)
+ return 0;
+ }
+
+-struct page *follow_huge_addr(struct mm_struct *mm,
+- unsigned long address, int write)
+-{
+- return ERR_PTR(-EINVAL);
+-}
+-
+ int pmd_huge(pmd_t pmd)
+ {
+ return pmd_page_shift(pmd) > PAGE_SHIFT;
+diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
+index 9536ef912f59..155bb7f5ad28 100644
+--- a/arch/mips/Kconfig
++++ b/arch/mips/Kconfig
+@@ -2048,7 +2048,7 @@ config MIPS_CMP
+
+ config MIPS_CPS
+ bool "MIPS Coherent Processing System support"
+- depends on SYS_SUPPORTS_MIPS_CPS
++ depends on SYS_SUPPORTS_MIPS_CPS && !64BIT
+ select MIPS_CM
+ select MIPS_CPC
+ select MIPS_CPS_PM if HOTPLUG_CPU
+diff --git a/arch/mips/bcm47xx/board.c b/arch/mips/bcm47xx/board.c
+index b3ae068ca4fa..3fd369d74444 100644
+--- a/arch/mips/bcm47xx/board.c
++++ b/arch/mips/bcm47xx/board.c
+@@ -247,8 +247,8 @@ static __init const struct bcm47xx_board_type *bcm47xx_board_get_nvram(void)
+ }
+
+ if (bcm47xx_nvram_getenv("hardware_version", buf1, sizeof(buf1)) >= 0 &&
+- bcm47xx_nvram_getenv("boardtype", buf2, sizeof(buf2)) >= 0) {
+- for (e2 = bcm47xx_board_list_boot_hw; e2->value1; e2++) {
++ bcm47xx_nvram_getenv("boardnum", buf2, sizeof(buf2)) >= 0) {
++ for (e2 = bcm47xx_board_list_hw_version_num; e2->value1; e2++) {
+ if (!strstarts(buf1, e2->value1) &&
+ !strcmp(buf2, e2->value2))
+ return &e2->board;
+diff --git a/arch/mips/bcm63xx/prom.c b/arch/mips/bcm63xx/prom.c
+index e1f27d653f60..7019e2967009 100644
+--- a/arch/mips/bcm63xx/prom.c
++++ b/arch/mips/bcm63xx/prom.c
+@@ -17,7 +17,6 @@
+ #include <bcm63xx_cpu.h>
+ #include <bcm63xx_io.h>
+ #include <bcm63xx_regs.h>
+-#include <bcm63xx_gpio.h>
+
+ void __init prom_init(void)
+ {
+@@ -53,9 +52,6 @@ void __init prom_init(void)
+ reg &= ~mask;
+ bcm_perf_writel(reg, PERF_CKCTL_REG);
+
+- /* register gpiochip */
+- bcm63xx_gpio_init();
+-
+ /* do low level board init */
+ board_prom_init();
+
+diff --git a/arch/mips/bcm63xx/setup.c b/arch/mips/bcm63xx/setup.c
+index 6660c7ddf87b..240fb4ffa55c 100644
+--- a/arch/mips/bcm63xx/setup.c
++++ b/arch/mips/bcm63xx/setup.c
+@@ -20,6 +20,7 @@
+ #include <bcm63xx_cpu.h>
+ #include <bcm63xx_regs.h>
+ #include <bcm63xx_io.h>
++#include <bcm63xx_gpio.h>
+
+ void bcm63xx_machine_halt(void)
+ {
+@@ -160,6 +161,9 @@ void __init plat_mem_setup(void)
+
+ int __init bcm63xx_register_devices(void)
+ {
++ /* register gpiochip */
++ bcm63xx_gpio_init();
++
+ return board_register_devices();
+ }
+
+diff --git a/arch/mips/cavium-octeon/dma-octeon.c b/arch/mips/cavium-octeon/dma-octeon.c
+index 02f244475207..c76a289b95b5 100644
+--- a/arch/mips/cavium-octeon/dma-octeon.c
++++ b/arch/mips/cavium-octeon/dma-octeon.c
+@@ -306,7 +306,7 @@ void __init plat_swiotlb_setup(void)
+ swiotlbsize = 64 * (1<<20);
+ }
+ #endif
+-#ifdef CONFIG_USB_OCTEON_OHCI
++#ifdef CONFIG_USB_OHCI_HCD_PLATFORM
+ /* OCTEON II ohci is only 32-bit. */
+ if (OCTEON_IS_MODEL(OCTEON_CN6XXX) && max_addr >= 0x100000000ul)
+ swiotlbsize = 64 * (1<<20);
+diff --git a/arch/mips/include/asm/asm-eva.h b/arch/mips/include/asm/asm-eva.h
+index e41c56e375b1..1e38f0e1ea3e 100644
+--- a/arch/mips/include/asm/asm-eva.h
++++ b/arch/mips/include/asm/asm-eva.h
+@@ -11,6 +11,36 @@
+ #define __ASM_ASM_EVA_H
+
+ #ifndef __ASSEMBLY__
++
++/* Kernel variants */
++
++#define kernel_cache(op, base) "cache " op ", " base "\n"
++#define kernel_ll(reg, addr) "ll " reg ", " addr "\n"
++#define kernel_sc(reg, addr) "sc " reg ", " addr "\n"
++#define kernel_lw(reg, addr) "lw " reg ", " addr "\n"
++#define kernel_lwl(reg, addr) "lwl " reg ", " addr "\n"
++#define kernel_lwr(reg, addr) "lwr " reg ", " addr "\n"
++#define kernel_lh(reg, addr) "lh " reg ", " addr "\n"
++#define kernel_lb(reg, addr) "lb " reg ", " addr "\n"
++#define kernel_lbu(reg, addr) "lbu " reg ", " addr "\n"
++#define kernel_sw(reg, addr) "sw " reg ", " addr "\n"
++#define kernel_swl(reg, addr) "swl " reg ", " addr "\n"
++#define kernel_swr(reg, addr) "swr " reg ", " addr "\n"
++#define kernel_sh(reg, addr) "sh " reg ", " addr "\n"
++#define kernel_sb(reg, addr) "sb " reg ", " addr "\n"
++
++#ifdef CONFIG_32BIT
++/*
++ * No 'sd' or 'ld' instructions in 32-bit but the code will
++ * do the correct thing
++ */
++#define kernel_sd(reg, addr) user_sw(reg, addr)
++#define kernel_ld(reg, addr) user_lw(reg, addr)
++#else
++#define kernel_sd(reg, addr) "sd " reg", " addr "\n"
++#define kernel_ld(reg, addr) "ld " reg", " addr "\n"
++#endif /* CONFIG_32BIT */
++
+ #ifdef CONFIG_EVA
+
+ #define __BUILD_EVA_INSN(insn, reg, addr) \
+@@ -41,37 +71,60 @@
+
+ #else
+
+-#define user_cache(op, base) "cache " op ", " base "\n"
+-#define user_ll(reg, addr) "ll " reg ", " addr "\n"
+-#define user_sc(reg, addr) "sc " reg ", " addr "\n"
+-#define user_lw(reg, addr) "lw " reg ", " addr "\n"
+-#define user_lwl(reg, addr) "lwl " reg ", " addr "\n"
+-#define user_lwr(reg, addr) "lwr " reg ", " addr "\n"
+-#define user_lh(reg, addr) "lh " reg ", " addr "\n"
+-#define user_lb(reg, addr) "lb " reg ", " addr "\n"
+-#define user_lbu(reg, addr) "lbu " reg ", " addr "\n"
+-#define user_sw(reg, addr) "sw " reg ", " addr "\n"
+-#define user_swl(reg, addr) "swl " reg ", " addr "\n"
+-#define user_swr(reg, addr) "swr " reg ", " addr "\n"
+-#define user_sh(reg, addr) "sh " reg ", " addr "\n"
+-#define user_sb(reg, addr) "sb " reg ", " addr "\n"
++#define user_cache(op, base) kernel_cache(op, base)
++#define user_ll(reg, addr) kernel_ll(reg, addr)
++#define user_sc(reg, addr) kernel_sc(reg, addr)
++#define user_lw(reg, addr) kernel_lw(reg, addr)
++#define user_lwl(reg, addr) kernel_lwl(reg, addr)
++#define user_lwr(reg, addr) kernel_lwr(reg, addr)
++#define user_lh(reg, addr) kernel_lh(reg, addr)
++#define user_lb(reg, addr) kernel_lb(reg, addr)
++#define user_lbu(reg, addr) kernel_lbu(reg, addr)
++#define user_sw(reg, addr) kernel_sw(reg, addr)
++#define user_swl(reg, addr) kernel_swl(reg, addr)
++#define user_swr(reg, addr) kernel_swr(reg, addr)
++#define user_sh(reg, addr) kernel_sh(reg, addr)
++#define user_sb(reg, addr) kernel_sb(reg, addr)
+
+ #ifdef CONFIG_32BIT
+-/*
+- * No 'sd' or 'ld' instructions in 32-bit but the code will
+- * do the correct thing
+- */
+-#define user_sd(reg, addr) user_sw(reg, addr)
+-#define user_ld(reg, addr) user_lw(reg, addr)
++#define user_sd(reg, addr) kernel_sw(reg, addr)
++#define user_ld(reg, addr) kernel_lw(reg, addr)
+ #else
+-#define user_sd(reg, addr) "sd " reg", " addr "\n"
+-#define user_ld(reg, addr) "ld " reg", " addr "\n"
++#define user_sd(reg, addr) kernel_sd(reg, addr)
++#define user_ld(reg, addr) kernel_ld(reg, addr)
+ #endif /* CONFIG_32BIT */
+
+ #endif /* CONFIG_EVA */
+
+ #else /* __ASSEMBLY__ */
+
++#define kernel_cache(op, base) cache op, base
++#define kernel_ll(reg, addr) ll reg, addr
++#define kernel_sc(reg, addr) sc reg, addr
++#define kernel_lw(reg, addr) lw reg, addr
++#define kernel_lwl(reg, addr) lwl reg, addr
++#define kernel_lwr(reg, addr) lwr reg, addr
++#define kernel_lh(reg, addr) lh reg, addr
++#define kernel_lb(reg, addr) lb reg, addr
++#define kernel_lbu(reg, addr) lbu reg, addr
++#define kernel_sw(reg, addr) sw reg, addr
++#define kernel_swl(reg, addr) swl reg, addr
++#define kernel_swr(reg, addr) swr reg, addr
++#define kernel_sh(reg, addr) sh reg, addr
++#define kernel_sb(reg, addr) sb reg, addr
++
++#ifdef CONFIG_32BIT
++/*
++ * No 'sd' or 'ld' instructions in 32-bit but the code will
++ * do the correct thing
++ */
++#define kernel_sd(reg, addr) user_sw(reg, addr)
++#define kernel_ld(reg, addr) user_lw(reg, addr)
++#else
++#define kernel_sd(reg, addr) sd reg, addr
++#define kernel_ld(reg, addr) ld reg, addr
++#endif /* CONFIG_32BIT */
++
+ #ifdef CONFIG_EVA
+
+ #define __BUILD_EVA_INSN(insn, reg, addr) \
+@@ -101,31 +154,27 @@
+ #define user_sd(reg, addr) user_sw(reg, addr)
+ #else
+
+-#define user_cache(op, base) cache op, base
+-#define user_ll(reg, addr) ll reg, addr
+-#define user_sc(reg, addr) sc reg, addr
+-#define user_lw(reg, addr) lw reg, addr
+-#define user_lwl(reg, addr) lwl reg, addr
+-#define user_lwr(reg, addr) lwr reg, addr
+-#define user_lh(reg, addr) lh reg, addr
+-#define user_lb(reg, addr) lb reg, addr
+-#define user_lbu(reg, addr) lbu reg, addr
+-#define user_sw(reg, addr) sw reg, addr
+-#define user_swl(reg, addr) swl reg, addr
+-#define user_swr(reg, addr) swr reg, addr
+-#define user_sh(reg, addr) sh reg, addr
+-#define user_sb(reg, addr) sb reg, addr
++#define user_cache(op, base) kernel_cache(op, base)
++#define user_ll(reg, addr) kernel_ll(reg, addr)
++#define user_sc(reg, addr) kernel_sc(reg, addr)
++#define user_lw(reg, addr) kernel_lw(reg, addr)
++#define user_lwl(reg, addr) kernel_lwl(reg, addr)
++#define user_lwr(reg, addr) kernel_lwr(reg, addr)
++#define user_lh(reg, addr) kernel_lh(reg, addr)
++#define user_lb(reg, addr) kernel_lb(reg, addr)
++#define user_lbu(reg, addr) kernel_lbu(reg, addr)
++#define user_sw(reg, addr) kernel_sw(reg, addr)
++#define user_swl(reg, addr) kernel_swl(reg, addr)
++#define user_swr(reg, addr) kernel_swr(reg, addr)
++#define user_sh(reg, addr) kernel_sh(reg, addr)
++#define user_sb(reg, addr) kernel_sb(reg, addr)
+
+ #ifdef CONFIG_32BIT
+-/*
+- * No 'sd' or 'ld' instructions in 32-bit but the code will
+- * do the correct thing
+- */
+-#define user_sd(reg, addr) user_sw(reg, addr)
+-#define user_ld(reg, addr) user_lw(reg, addr)
++#define user_sd(reg, addr) kernel_sw(reg, addr)
++#define user_ld(reg, addr) kernel_lw(reg, addr)
+ #else
+-#define user_sd(reg, addr) sd reg, addr
+-#define user_ld(reg, addr) ld reg, addr
++#define user_sd(reg, addr) kernel_sd(reg, addr)
++#define user_ld(reg, addr) kernel_sd(reg, addr)
+ #endif /* CONFIG_32BIT */
+
+ #endif /* CONFIG_EVA */
+diff --git a/arch/mips/include/asm/fpu.h b/arch/mips/include/asm/fpu.h
+index dd562414cd5e..99f71e87ce31 100644
+--- a/arch/mips/include/asm/fpu.h
++++ b/arch/mips/include/asm/fpu.h
+@@ -150,6 +150,7 @@ static inline void lose_fpu(int save)
+ }
+ disable_msa();
+ clear_thread_flag(TIF_USEDMSA);
++ __disable_fpu();
+ } else if (is_fpu_owner()) {
+ if (save)
+ _save_fp(current);
+diff --git a/arch/mips/include/asm/kvm_host.h b/arch/mips/include/asm/kvm_host.h
+index f2c249796ea8..4e3205a3bee2 100644
+--- a/arch/mips/include/asm/kvm_host.h
++++ b/arch/mips/include/asm/kvm_host.h
+@@ -321,6 +321,7 @@ enum mips_mmu_types {
+ #define T_TRAP 13 /* Trap instruction */
+ #define T_VCEI 14 /* Virtual coherency exception */
+ #define T_FPE 15 /* Floating point exception */
++#define T_MSADIS 21 /* MSA disabled exception */
+ #define T_WATCH 23 /* Watch address reference */
+ #define T_VCED 31 /* Virtual coherency data */
+
+@@ -577,6 +578,7 @@ struct kvm_mips_callbacks {
+ int (*handle_syscall)(struct kvm_vcpu *vcpu);
+ int (*handle_res_inst)(struct kvm_vcpu *vcpu);
+ int (*handle_break)(struct kvm_vcpu *vcpu);
++ int (*handle_msa_disabled)(struct kvm_vcpu *vcpu);
+ int (*vm_init)(struct kvm *kvm);
+ int (*vcpu_init)(struct kvm_vcpu *vcpu);
+ int (*vcpu_setup)(struct kvm_vcpu *vcpu);
+diff --git a/arch/mips/include/asm/mach-cavium-octeon/cpu-feature-overrides.h b/arch/mips/include/asm/mach-cavium-octeon/cpu-feature-overrides.h
+index fa1f3cfbae8d..d68e685cde60 100644
+--- a/arch/mips/include/asm/mach-cavium-octeon/cpu-feature-overrides.h
++++ b/arch/mips/include/asm/mach-cavium-octeon/cpu-feature-overrides.h
+@@ -50,7 +50,6 @@
+ #define cpu_has_mips32r2 0
+ #define cpu_has_mips64r1 0
+ #define cpu_has_mips64r2 1
+-#define cpu_has_mips_r2_exec_hazard 0
+ #define cpu_has_dsp 0
+ #define cpu_has_dsp2 0
+ #define cpu_has_mipsmt 0
+diff --git a/arch/mips/include/asm/octeon/pci-octeon.h b/arch/mips/include/asm/octeon/pci-octeon.h
+index 64ba56a02843..1884609741a8 100644
+--- a/arch/mips/include/asm/octeon/pci-octeon.h
++++ b/arch/mips/include/asm/octeon/pci-octeon.h
+@@ -11,9 +11,6 @@
+
+ #include <linux/pci.h>
+
+-/* Some PCI cards require delays when accessing config space. */
+-#define PCI_CONFIG_SPACE_DELAY 10000
+-
+ /*
+ * The physical memory base mapped by BAR1. 256MB at the end of the
+ * first 4GB.
+diff --git a/arch/mips/kernel/entry.S b/arch/mips/kernel/entry.S
+index 4353d323f017..39d682937d52 100644
+--- a/arch/mips/kernel/entry.S
++++ b/arch/mips/kernel/entry.S
+@@ -10,6 +10,7 @@
+
+ #include <asm/asm.h>
+ #include <asm/asmmacro.h>
++#include <asm/compiler.h>
+ #include <asm/regdef.h>
+ #include <asm/mipsregs.h>
+ #include <asm/stackframe.h>
+@@ -166,7 +167,7 @@ syscall_exit_work:
+ * For C code use the inline version named instruction_hazard().
+ */
+ LEAF(mips_ihb)
+- .set mips32r2
++ .set MIPS_ISA_LEVEL_RAW
+ jr.hb ra
+ nop
+ END(mips_ihb)
+diff --git a/arch/mips/kernel/smp-cps.c b/arch/mips/kernel/smp-cps.c
+index e6e16a1d4add..0854f17829f3 100644
+--- a/arch/mips/kernel/smp-cps.c
++++ b/arch/mips/kernel/smp-cps.c
+@@ -88,6 +88,12 @@ static void __init cps_smp_setup(void)
+
+ /* Make core 0 coherent with everything */
+ write_gcr_cl_coherence(0xff);
++
++#ifdef CONFIG_MIPS_MT_FPAFF
++ /* If we have an FPU, enroll ourselves in the FPU-full mask */
++ if (cpu_has_fpu)
++ cpu_set(0, mt_fpu_cpumask);
++#endif /* CONFIG_MIPS_MT_FPAFF */
+ }
+
+ static void __init cps_prepare_cpus(unsigned int max_cpus)
+diff --git a/arch/mips/kvm/emulate.c b/arch/mips/kvm/emulate.c
+index fb3e8dfd1ff6..838d3a6a5b7d 100644
+--- a/arch/mips/kvm/emulate.c
++++ b/arch/mips/kvm/emulate.c
+@@ -2176,6 +2176,7 @@ enum emulation_result kvm_mips_check_privilege(unsigned long cause,
+ case T_SYSCALL:
+ case T_BREAK:
+ case T_RES_INST:
++ case T_MSADIS:
+ break;
+
+ case T_COP_UNUSABLE:
+diff --git a/arch/mips/kvm/mips.c b/arch/mips/kvm/mips.c
+index 270bbd41769e..39074fb83bad 100644
+--- a/arch/mips/kvm/mips.c
++++ b/arch/mips/kvm/mips.c
+@@ -1119,6 +1119,10 @@ int kvm_mips_handle_exit(struct kvm_run *run, struct kvm_vcpu *vcpu)
+ ret = kvm_mips_callbacks->handle_break(vcpu);
+ break;
+
++ case T_MSADIS:
++ ret = kvm_mips_callbacks->handle_msa_disabled(vcpu);
++ break;
++
+ default:
+ kvm_err("Exception Code: %d, not yet handled, @ PC: %p, inst: 0x%08x BadVaddr: %#lx Status: %#lx\n",
+ exccode, opc, kvm_get_inst(opc, vcpu), badvaddr,
+diff --git a/arch/mips/kvm/trap_emul.c b/arch/mips/kvm/trap_emul.c
+index fd7257b70e65..4372cc86650c 100644
+--- a/arch/mips/kvm/trap_emul.c
++++ b/arch/mips/kvm/trap_emul.c
+@@ -330,6 +330,33 @@ static int kvm_trap_emul_handle_break(struct kvm_vcpu *vcpu)
+ return ret;
+ }
+
++static int kvm_trap_emul_handle_msa_disabled(struct kvm_vcpu *vcpu)
++{
++ struct kvm_run *run = vcpu->run;
++ uint32_t __user *opc = (uint32_t __user *) vcpu->arch.pc;
++ unsigned long cause = vcpu->arch.host_cp0_cause;
++ enum emulation_result er = EMULATE_DONE;
++ int ret = RESUME_GUEST;
++
++ /* No MSA supported in guest, guest reserved instruction exception */
++ er = kvm_mips_emulate_ri_exc(cause, opc, run, vcpu);
++
++ switch (er) {
++ case EMULATE_DONE:
++ ret = RESUME_GUEST;
++ break;
++
++ case EMULATE_FAIL:
++ run->exit_reason = KVM_EXIT_INTERNAL_ERROR;
++ ret = RESUME_HOST;
++ break;
++
++ default:
++ BUG();
++ }
++ return ret;
++}
++
+ static int kvm_trap_emul_vm_init(struct kvm *kvm)
+ {
+ return 0;
+@@ -470,6 +497,7 @@ static struct kvm_mips_callbacks kvm_trap_emul_callbacks = {
+ .handle_syscall = kvm_trap_emul_handle_syscall,
+ .handle_res_inst = kvm_trap_emul_handle_res_inst,
+ .handle_break = kvm_trap_emul_handle_break,
++ .handle_msa_disabled = kvm_trap_emul_handle_msa_disabled,
+
+ .vm_init = kvm_trap_emul_vm_init,
+ .vcpu_init = kvm_trap_emul_vcpu_init,
+diff --git a/arch/mips/loongson/loongson-3/irq.c b/arch/mips/loongson/loongson-3/irq.c
+index ca1c62af5188..8f5209aff01e 100644
+--- a/arch/mips/loongson/loongson-3/irq.c
++++ b/arch/mips/loongson/loongson-3/irq.c
+@@ -44,6 +44,7 @@ void mach_irq_dispatch(unsigned int pending)
+
+ static struct irqaction cascade_irqaction = {
+ .handler = no_action,
++ .flags = IRQF_NO_SUSPEND,
+ .name = "cascade",
+ };
+
+diff --git a/arch/mips/mm/hugetlbpage.c b/arch/mips/mm/hugetlbpage.c
+index 4ec8ee10d371..06e0f421b41b 100644
+--- a/arch/mips/mm/hugetlbpage.c
++++ b/arch/mips/mm/hugetlbpage.c
+@@ -68,12 +68,6 @@ int is_aligned_hugepage_range(unsigned long addr, unsigned long len)
+ return 0;
+ }
+
+-struct page *
+-follow_huge_addr(struct mm_struct *mm, unsigned long address, int write)
+-{
+- return ERR_PTR(-EINVAL);
+-}
+-
+ int pmd_huge(pmd_t pmd)
+ {
+ return (pmd_val(pmd) & _PAGE_HUGE) != 0;
+@@ -83,15 +77,3 @@ int pud_huge(pud_t pud)
+ {
+ return (pud_val(pud) & _PAGE_HUGE) != 0;
+ }
+-
+-struct page *
+-follow_huge_pmd(struct mm_struct *mm, unsigned long address,
+- pmd_t *pmd, int write)
+-{
+- struct page *page;
+-
+- page = pte_page(*(pte_t *)pmd);
+- if (page)
+- page += ((address & ~HPAGE_MASK) >> PAGE_SHIFT);
+- return page;
+-}
+diff --git a/arch/mips/mti-malta/malta-memory.c b/arch/mips/mti-malta/malta-memory.c
+index 8fddd2cdbff7..efe366d618b1 100644
+--- a/arch/mips/mti-malta/malta-memory.c
++++ b/arch/mips/mti-malta/malta-memory.c
+@@ -53,6 +53,12 @@ fw_memblock_t * __init fw_getmdesc(int eva)
+ pr_warn("memsize not set in YAMON, set to default (32Mb)\n");
+ physical_memsize = 0x02000000;
+ } else {
++ if (memsize > (256 << 20)) { /* memsize should be capped to 256M */
++ pr_warn("Unsupported memsize value (0x%lx) detected! "
++ "Using 0x10000000 (256M) instead\n",
++ memsize);
++ memsize = 256 << 20;
++ }
+ /* If ememsize is set, then set physical_memsize to that */
+ physical_memsize = ememsize ? : memsize;
+ }
+diff --git a/arch/mips/netlogic/xlp/ahci-init-xlp2.c b/arch/mips/netlogic/xlp/ahci-init-xlp2.c
+index c83dbf3689e2..7b066a44e679 100644
+--- a/arch/mips/netlogic/xlp/ahci-init-xlp2.c
++++ b/arch/mips/netlogic/xlp/ahci-init-xlp2.c
+@@ -203,6 +203,7 @@ static u8 read_phy_reg(u64 regbase, u32 addr, u32 physel)
+ static void config_sata_phy(u64 regbase)
+ {
+ u32 port, i, reg;
++ u8 val;
+
+ for (port = 0; port < 2; port++) {
+ for (i = 0, reg = RXCDRCALFOSC0; reg <= CALDUTY; reg++, i++)
+@@ -210,6 +211,18 @@ static void config_sata_phy(u64 regbase)
+
+ for (i = 0, reg = RXDPIF; reg <= PPMDRIFTMAX_HI; reg++, i++)
+ write_phy_reg(regbase, reg, port, sata_phy_config2[i]);
++
++ /* Fix for PHY link up failures at lower temperatures */
++ write_phy_reg(regbase, 0x800F, port, 0x1f);
++
++ val = read_phy_reg(regbase, 0x0029, port);
++ write_phy_reg(regbase, 0x0029, port, val | (0x7 << 1));
++
++ val = read_phy_reg(regbase, 0x0056, port);
++ write_phy_reg(regbase, 0x0056, port, val & ~(1 << 3));
++
++ val = read_phy_reg(regbase, 0x0018, port);
++ write_phy_reg(regbase, 0x0018, port, val & ~(0x7 << 0));
+ }
+ }
+
+diff --git a/arch/mips/pci/pci-octeon.c b/arch/mips/pci/pci-octeon.c
+index 59cccd95688b..14d3351227ef 100644
+--- a/arch/mips/pci/pci-octeon.c
++++ b/arch/mips/pci/pci-octeon.c
+@@ -214,6 +214,8 @@ const char *octeon_get_pci_interrupts(void)
+ return "AAABAAAAAAAAAAAAAAAAAAAAAAAAAAAA";
+ case CVMX_BOARD_TYPE_BBGW_REF:
+ return "AABCD";
++ case CVMX_BOARD_TYPE_CUST_DSR1000N:
++ return "CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC";
+ case CVMX_BOARD_TYPE_THUNDER:
+ case CVMX_BOARD_TYPE_EBH3000:
+ default:
+@@ -271,9 +273,6 @@ static int octeon_read_config(struct pci_bus *bus, unsigned int devfn,
+ pci_addr.s.func = devfn & 0x7;
+ pci_addr.s.reg = reg;
+
+-#if PCI_CONFIG_SPACE_DELAY
+- udelay(PCI_CONFIG_SPACE_DELAY);
+-#endif
+ switch (size) {
+ case 4:
+ *val = le32_to_cpu(cvmx_read64_uint32(pci_addr.u64));
+@@ -308,9 +307,6 @@ static int octeon_write_config(struct pci_bus *bus, unsigned int devfn,
+ pci_addr.s.func = devfn & 0x7;
+ pci_addr.s.reg = reg;
+
+-#if PCI_CONFIG_SPACE_DELAY
+- udelay(PCI_CONFIG_SPACE_DELAY);
+-#endif
+ switch (size) {
+ case 4:
+ cvmx_write64_uint32(pci_addr.u64, cpu_to_le32(val));
+diff --git a/arch/mips/pci/pcie-octeon.c b/arch/mips/pci/pcie-octeon.c
+index 5e36c33e5543..38335af0a7f3 100644
+--- a/arch/mips/pci/pcie-octeon.c
++++ b/arch/mips/pci/pcie-octeon.c
+@@ -1762,14 +1762,6 @@ static int octeon_pcie_write_config(unsigned int pcie_port, struct pci_bus *bus,
+ default:
+ return PCIBIOS_FUNC_NOT_SUPPORTED;
+ }
+-#if PCI_CONFIG_SPACE_DELAY
+- /*
+- * Delay on writes so that devices have time to come up. Some
+- * bridges need this to allow time for the secondary busses to
+- * work
+- */
+- udelay(PCI_CONFIG_SPACE_DELAY);
+-#endif
+ return PCIBIOS_SUCCESSFUL;
+ }
+
+diff --git a/arch/mips/power/hibernate.S b/arch/mips/power/hibernate.S
+index 32a7c828f073..e7567c8a9e79 100644
+--- a/arch/mips/power/hibernate.S
++++ b/arch/mips/power/hibernate.S
+@@ -30,6 +30,8 @@ LEAF(swsusp_arch_suspend)
+ END(swsusp_arch_suspend)
+
+ LEAF(swsusp_arch_resume)
++ /* Avoid TLB mismatch during and after kernel resume */
++ jal local_flush_tlb_all
+ PTR_L t0, restore_pblist
+ 0:
+ PTR_L t1, PBE_ADDRESS(t0) /* source */
+@@ -43,7 +45,6 @@ LEAF(swsusp_arch_resume)
+ bne t1, t3, 1b
+ PTR_L t0, PBE_NEXT(t0)
+ bnez t0, 0b
+- jal local_flush_tlb_all /* Avoid TLB mismatch after kernel resume */
+ PTR_LA t0, saved_regs
+ PTR_L ra, PT_R31(t0)
+ PTR_L sp, PT_R29(t0)
+diff --git a/arch/mips/ralink/Kconfig b/arch/mips/ralink/Kconfig
+index 77e8a9620e18..d50914d5191e 100644
+--- a/arch/mips/ralink/Kconfig
++++ b/arch/mips/ralink/Kconfig
+@@ -7,6 +7,11 @@ config CLKEVT_RT3352
+ select CLKSRC_OF
+ select CLKSRC_MMIO
+
++config RALINK_ILL_ACC
++ bool
++ depends on SOC_RT305X
++ default y
++
+ choice
+ prompt "Ralink SoC selection"
+ default SOC_RT305X
+diff --git a/arch/powerpc/kernel/cacheinfo.c b/arch/powerpc/kernel/cacheinfo.c
+index 40198d50b4c2..8005b79ecbcf 100644
+--- a/arch/powerpc/kernel/cacheinfo.c
++++ b/arch/powerpc/kernel/cacheinfo.c
+@@ -61,12 +61,22 @@ struct cache_type_info {
+ };
+
+ /* These are used to index the cache_type_info array. */
+-#define CACHE_TYPE_UNIFIED 0
+-#define CACHE_TYPE_INSTRUCTION 1
+-#define CACHE_TYPE_DATA 2
++#define CACHE_TYPE_UNIFIED 0 /* cache-size, cache-block-size, etc. */
++#define CACHE_TYPE_UNIFIED_D 1 /* d-cache-size, d-cache-block-size, etc */
++#define CACHE_TYPE_INSTRUCTION 2
++#define CACHE_TYPE_DATA 3
+
+ static const struct cache_type_info cache_type_info[] = {
+ {
++ /* Embedded systems that use cache-size, cache-block-size,
++ * etc. for the Unified (typically L2) cache. */
++ .name = "Unified",
++ .size_prop = "cache-size",
++ .line_size_props = { "cache-line-size",
++ "cache-block-size", },
++ .nr_sets_prop = "cache-sets",
++ },
++ {
+ /* PowerPC Processor binding says the [di]-cache-*
+ * must be equal on unified caches, so just use
+ * d-cache properties. */
+@@ -293,7 +303,8 @@ static struct cache *cache_find_first_sibling(struct cache *cache)
+ {
+ struct cache *iter;
+
+- if (cache->type == CACHE_TYPE_UNIFIED)
++ if (cache->type == CACHE_TYPE_UNIFIED ||
++ cache->type == CACHE_TYPE_UNIFIED_D)
+ return cache;
+
+ list_for_each_entry(iter, &cache_list, list)
+@@ -324,16 +335,29 @@ static bool cache_node_is_unified(const struct device_node *np)
+ return of_get_property(np, "cache-unified", NULL);
+ }
+
+-static struct cache *cache_do_one_devnode_unified(struct device_node *node,
+- int level)
++/*
++ * Unified caches can have two different sets of tags. Most embedded
++ * use cache-size, etc. for the unified cache size, but open firmware systems
++ * use d-cache-size, etc. Check on initialization for which type we have, and
++ * return the appropriate structure type. Assume it's embedded if it isn't
++ * open firmware. If it's yet a 3rd type, then there will be missing entries
++ * in /sys/devices/system/cpu/cpu0/cache/index2/, and this code will need
++ * to be extended further.
++ */
++static int cache_is_unified_d(const struct device_node *np)
+ {
+- struct cache *cache;
++ return of_get_property(np,
++ cache_type_info[CACHE_TYPE_UNIFIED_D].size_prop, NULL) ?
++ CACHE_TYPE_UNIFIED_D : CACHE_TYPE_UNIFIED;
++}
+
++/*
++ */
++static struct cache *cache_do_one_devnode_unified(struct device_node *node, int level)
++{
+ pr_debug("creating L%d ucache for %s\n", level, node->full_name);
+
+- cache = new_cache(CACHE_TYPE_UNIFIED, level, node);
+-
+- return cache;
++ return new_cache(cache_is_unified_d(node), level, node);
+ }
+
+ static struct cache *cache_do_one_devnode_split(struct device_node *node,
+diff --git a/arch/powerpc/mm/hugetlbpage.c b/arch/powerpc/mm/hugetlbpage.c
+index 6a4a5fcb9730..17e83a043bba 100644
+--- a/arch/powerpc/mm/hugetlbpage.c
++++ b/arch/powerpc/mm/hugetlbpage.c
+@@ -704,6 +704,14 @@ follow_huge_pmd(struct mm_struct *mm, unsigned long address,
+ return NULL;
+ }
+
++struct page *
++follow_huge_pud(struct mm_struct *mm, unsigned long address,
++ pud_t *pud, int write)
++{
++ BUG();
++ return NULL;
++}
++
+ static unsigned long hugepte_addr_end(unsigned long addr, unsigned long end,
+ unsigned long sz)
+ {
+diff --git a/arch/powerpc/perf/callchain.c b/arch/powerpc/perf/callchain.c
+index 2396dda282cd..ead55351b254 100644
+--- a/arch/powerpc/perf/callchain.c
++++ b/arch/powerpc/perf/callchain.c
+@@ -243,7 +243,7 @@ static void perf_callchain_user_64(struct perf_callchain_entry *entry,
+ sp = regs->gpr[1];
+ perf_callchain_store(entry, next_ip);
+
+- for (;;) {
++ while (entry->nr < PERF_MAX_STACK_DEPTH) {
+ fp = (unsigned long __user *) sp;
+ if (!valid_user_sp(sp, 1) || read_user_stack_64(fp, &next_sp))
+ return;
+diff --git a/arch/powerpc/platforms/cell/interrupt.c b/arch/powerpc/platforms/cell/interrupt.c
+index 8a106b4172e0..28e558d3316d 100644
+--- a/arch/powerpc/platforms/cell/interrupt.c
++++ b/arch/powerpc/platforms/cell/interrupt.c
+@@ -163,7 +163,7 @@ static unsigned int iic_get_irq(void)
+
+ void iic_setup_cpu(void)
+ {
+- out_be64(&__get_cpu_var(cpu_iic).regs->prio, 0xff);
++ out_be64(&this_cpu_ptr(&cpu_iic)->regs->prio, 0xff);
+ }
+
+ u8 iic_get_target_id(int cpu)
+diff --git a/arch/powerpc/platforms/cell/iommu.c b/arch/powerpc/platforms/cell/iommu.c
+index 2b90ff8a93be..59ef76c5f4f4 100644
+--- a/arch/powerpc/platforms/cell/iommu.c
++++ b/arch/powerpc/platforms/cell/iommu.c
+@@ -197,7 +197,7 @@ static int tce_build_cell(struct iommu_table *tbl, long index, long npages,
+
+ io_pte = (unsigned long *)tbl->it_base + (index - tbl->it_offset);
+
+- for (i = 0; i < npages; i++, uaddr += tbl->it_page_shift)
++ for (i = 0; i < npages; i++, uaddr += (1 << tbl->it_page_shift))
+ io_pte[i] = base_pte | (__pa(uaddr) & CBE_IOPTE_RPN_Mask);
+
+ mb();
+diff --git a/arch/powerpc/platforms/powernv/pci-ioda.c b/arch/powerpc/platforms/powernv/pci-ioda.c
+index 3f596706a5b7..86a7256d84e5 100644
+--- a/arch/powerpc/platforms/powernv/pci-ioda.c
++++ b/arch/powerpc/platforms/powernv/pci-ioda.c
+@@ -1645,7 +1645,8 @@ static void pnv_ioda_setup_pe_seg(struct pci_controller *hose,
+ region.start += phb->ioda.io_segsize;
+ index++;
+ }
+- } else if (res->flags & IORESOURCE_MEM) {
++ } else if ((res->flags & IORESOURCE_MEM) &&
++ !pnv_pci_is_mem_pref_64(res->flags)) {
+ region.start = res->start -
+ hose->mem_offset[0] -
+ phb->ioda.m32_pci_base;
+diff --git a/arch/s390/kernel/suspend.c b/arch/s390/kernel/suspend.c
+index 1c4c5accd220..d3236c9e226b 100644
+--- a/arch/s390/kernel/suspend.c
++++ b/arch/s390/kernel/suspend.c
+@@ -138,6 +138,8 @@ int pfn_is_nosave(unsigned long pfn)
+ {
+ unsigned long nosave_begin_pfn = PFN_DOWN(__pa(&__nosave_begin));
+ unsigned long nosave_end_pfn = PFN_DOWN(__pa(&__nosave_end));
++ unsigned long eshared_pfn = PFN_DOWN(__pa(&_eshared)) - 1;
++ unsigned long stext_pfn = PFN_DOWN(__pa(&_stext));
+
+ /* Always save lowcore pages (LC protection might be enabled). */
+ if (pfn <= LC_PAGES)
+@@ -145,6 +147,8 @@ int pfn_is_nosave(unsigned long pfn)
+ if (pfn >= nosave_begin_pfn && pfn < nosave_end_pfn)
+ return 1;
+ /* Skip memory holes and read-only pages (NSS, DCSS, ...). */
++ if (pfn >= stext_pfn && pfn <= eshared_pfn)
++ return ipl_info.type == IPL_TYPE_NSS ? 1 : 0;
+ if (tprot(PFN_PHYS(pfn)))
+ return 1;
+ return 0;
+diff --git a/arch/s390/kvm/interrupt.c b/arch/s390/kvm/interrupt.c
+index 29e2e5aa2111..cd6344d334cb 100644
+--- a/arch/s390/kvm/interrupt.c
++++ b/arch/s390/kvm/interrupt.c
+@@ -16,6 +16,7 @@
+ #include <linux/mmu_context.h>
+ #include <linux/signal.h>
+ #include <linux/slab.h>
++#include <linux/vmalloc.h>
+ #include <asm/asm-offsets.h>
+ #include <asm/uaccess.h>
+ #include "kvm-s390.h"
+@@ -784,7 +785,6 @@ struct kvm_s390_interrupt_info *kvm_s390_get_io_int(struct kvm *kvm,
+
+ if ((!schid && !cr6) || (schid && cr6))
+ return NULL;
+- mutex_lock(&kvm->lock);
+ fi = &kvm->arch.float_int;
+ spin_lock(&fi->lock);
+ inti = NULL;
+@@ -812,7 +812,6 @@ struct kvm_s390_interrupt_info *kvm_s390_get_io_int(struct kvm *kvm,
+ if (list_empty(&fi->list))
+ atomic_set(&fi->active, 0);
+ spin_unlock(&fi->lock);
+- mutex_unlock(&kvm->lock);
+ return inti;
+ }
+
+@@ -825,7 +824,6 @@ static int __inject_vm(struct kvm *kvm, struct kvm_s390_interrupt_info *inti)
+ int sigcpu;
+ int rc = 0;
+
+- mutex_lock(&kvm->lock);
+ fi = &kvm->arch.float_int;
+ spin_lock(&fi->lock);
+ if (fi->irq_count >= KVM_S390_MAX_FLOAT_IRQS) {
+@@ -868,7 +866,6 @@ static int __inject_vm(struct kvm *kvm, struct kvm_s390_interrupt_info *inti)
+ kvm_s390_vcpu_wakeup(kvm_get_vcpu(kvm, sigcpu));
+ unlock_fi:
+ spin_unlock(&fi->lock);
+- mutex_unlock(&kvm->lock);
+ return rc;
+ }
+
+@@ -930,10 +927,10 @@ int kvm_s390_inject_vm(struct kvm *kvm,
+ return rc;
+ }
+
+-void kvm_s390_reinject_io_int(struct kvm *kvm,
++int kvm_s390_reinject_io_int(struct kvm *kvm,
+ struct kvm_s390_interrupt_info *inti)
+ {
+- __inject_vm(kvm, inti);
++ return __inject_vm(kvm, inti);
+ }
+
+ int kvm_s390_inject_vcpu(struct kvm_vcpu *vcpu,
+@@ -1029,7 +1026,6 @@ void kvm_s390_clear_float_irqs(struct kvm *kvm)
+ struct kvm_s390_float_interrupt *fi;
+ struct kvm_s390_interrupt_info *n, *inti = NULL;
+
+- mutex_lock(&kvm->lock);
+ fi = &kvm->arch.float_int;
+ spin_lock(&fi->lock);
+ list_for_each_entry_safe(inti, n, &fi->list, list) {
+@@ -1039,66 +1035,68 @@ void kvm_s390_clear_float_irqs(struct kvm *kvm)
+ fi->irq_count = 0;
+ atomic_set(&fi->active, 0);
+ spin_unlock(&fi->lock);
+- mutex_unlock(&kvm->lock);
+ }
+
+-static inline int copy_irq_to_user(struct kvm_s390_interrupt_info *inti,
+- u8 *addr)
++static void inti_to_irq(struct kvm_s390_interrupt_info *inti,
++ struct kvm_s390_irq *irq)
+ {
+- struct kvm_s390_irq __user *uptr = (struct kvm_s390_irq __user *) addr;
+- struct kvm_s390_irq irq = {0};
+-
+- irq.type = inti->type;
++ irq->type = inti->type;
+ switch (inti->type) {
+ case KVM_S390_INT_PFAULT_INIT:
+ case KVM_S390_INT_PFAULT_DONE:
+ case KVM_S390_INT_VIRTIO:
+ case KVM_S390_INT_SERVICE:
+- irq.u.ext = inti->ext;
++ irq->u.ext = inti->ext;
+ break;
+ case KVM_S390_INT_IO_MIN...KVM_S390_INT_IO_MAX:
+- irq.u.io = inti->io;
++ irq->u.io = inti->io;
+ break;
+ case KVM_S390_MCHK:
+- irq.u.mchk = inti->mchk;
++ irq->u.mchk = inti->mchk;
+ break;
+- default:
+- return -EINVAL;
+ }
+-
+- if (copy_to_user(uptr, &irq, sizeof(irq)))
+- return -EFAULT;
+-
+- return 0;
+ }
+
+-static int get_all_floating_irqs(struct kvm *kvm, __u8 *buf, __u64 len)
++static int get_all_floating_irqs(struct kvm *kvm, u8 __user *usrbuf, u64 len)
+ {
+ struct kvm_s390_interrupt_info *inti;
+ struct kvm_s390_float_interrupt *fi;
++ struct kvm_s390_irq *buf;
++ int max_irqs;
+ int ret = 0;
+ int n = 0;
+
+- mutex_lock(&kvm->lock);
++ if (len > KVM_S390_FLIC_MAX_BUFFER || len == 0)
++ return -EINVAL;
++
++ /*
++ * We are already using -ENOMEM to signal
++ * userspace it may retry with a bigger buffer,
++ * so we need to use something else for this case
++ */
++ buf = vzalloc(len);
++ if (!buf)
++ return -ENOBUFS;
++
++ max_irqs = len / sizeof(struct kvm_s390_irq);
++
+ fi = &kvm->arch.float_int;
+ spin_lock(&fi->lock);
+-
+ list_for_each_entry(inti, &fi->list, list) {
+- if (len < sizeof(struct kvm_s390_irq)) {
++ if (n == max_irqs) {
+ /* signal userspace to try again */
+ ret = -ENOMEM;
+ break;
+ }
+- ret = copy_irq_to_user(inti, buf);
+- if (ret)
+- break;
+- buf += sizeof(struct kvm_s390_irq);
+- len -= sizeof(struct kvm_s390_irq);
++ inti_to_irq(inti, &buf[n]);
+ n++;
+ }
+-
+ spin_unlock(&fi->lock);
+- mutex_unlock(&kvm->lock);
++ if (!ret && n > 0) {
++ if (copy_to_user(usrbuf, buf, sizeof(struct kvm_s390_irq) * n))
++ ret = -EFAULT;
++ }
++ vfree(buf);
+
+ return ret < 0 ? ret : n;
+ }
+@@ -1109,7 +1107,7 @@ static int flic_get_attr(struct kvm_device *dev, struct kvm_device_attr *attr)
+
+ switch (attr->group) {
+ case KVM_DEV_FLIC_GET_ALL_IRQS:
+- r = get_all_floating_irqs(dev->kvm, (u8 *) attr->addr,
++ r = get_all_floating_irqs(dev->kvm, (u8 __user *) attr->addr,
+ attr->attr);
+ break;
+ default:
+diff --git a/arch/s390/kvm/kvm-s390.h b/arch/s390/kvm/kvm-s390.h
+index 244d02303182..4c173474ecfe 100644
+--- a/arch/s390/kvm/kvm-s390.h
++++ b/arch/s390/kvm/kvm-s390.h
+@@ -148,8 +148,8 @@ int __must_check kvm_s390_inject_vcpu(struct kvm_vcpu *vcpu,
+ int __must_check kvm_s390_inject_program_int(struct kvm_vcpu *vcpu, u16 code);
+ struct kvm_s390_interrupt_info *kvm_s390_get_io_int(struct kvm *kvm,
+ u64 cr6, u64 schid);
+-void kvm_s390_reinject_io_int(struct kvm *kvm,
+- struct kvm_s390_interrupt_info *inti);
++int kvm_s390_reinject_io_int(struct kvm *kvm,
++ struct kvm_s390_interrupt_info *inti);
+ int kvm_s390_mask_adapter(struct kvm *kvm, unsigned int id, bool masked);
+
+ /* implemented in priv.c */
+diff --git a/arch/s390/kvm/priv.c b/arch/s390/kvm/priv.c
+index 9c565b6b4ccb..a30102c4d707 100644
+--- a/arch/s390/kvm/priv.c
++++ b/arch/s390/kvm/priv.c
+@@ -228,18 +228,19 @@ static int handle_tpi(struct kvm_vcpu *vcpu)
+ struct kvm_s390_interrupt_info *inti;
+ unsigned long len;
+ u32 tpi_data[3];
+- int cc, rc;
++ int rc;
+ u64 addr;
+
+- rc = 0;
+ addr = kvm_s390_get_base_disp_s(vcpu);
+ if (addr & 3)
+ return kvm_s390_inject_program_int(vcpu, PGM_SPECIFICATION);
+- cc = 0;
++
+ inti = kvm_s390_get_io_int(vcpu->kvm, vcpu->arch.sie_block->gcr[6], 0);
+- if (!inti)
+- goto no_interrupt;
+- cc = 1;
++ if (!inti) {
++ kvm_s390_set_psw_cc(vcpu, 0);
++ return 0;
++ }
++
+ tpi_data[0] = inti->io.subchannel_id << 16 | inti->io.subchannel_nr;
+ tpi_data[1] = inti->io.io_int_parm;
+ tpi_data[2] = inti->io.io_int_word;
+@@ -250,30 +251,38 @@ static int handle_tpi(struct kvm_vcpu *vcpu)
+ */
+ len = sizeof(tpi_data) - 4;
+ rc = write_guest(vcpu, addr, &tpi_data, len);
+- if (rc)
+- return kvm_s390_inject_prog_cond(vcpu, rc);
++ if (rc) {
++ rc = kvm_s390_inject_prog_cond(vcpu, rc);
++ goto reinject_interrupt;
++ }
+ } else {
+ /*
+ * Store the three-word I/O interruption code into
+ * the appropriate lowcore area.
+ */
+ len = sizeof(tpi_data);
+- if (write_guest_lc(vcpu, __LC_SUBCHANNEL_ID, &tpi_data, len))
++ if (write_guest_lc(vcpu, __LC_SUBCHANNEL_ID, &tpi_data, len)) {
++ /* failed writes to the low core are not recoverable */
+ rc = -EFAULT;
++ goto reinject_interrupt;
++ }
+ }
++
++ /* irq was successfully handed to the guest */
++ kfree(inti);
++ kvm_s390_set_psw_cc(vcpu, 1);
++ return 0;
++reinject_interrupt:
+ /*
+ * If we encounter a problem storing the interruption code, the
+ * instruction is suppressed from the guest's view: reinject the
+ * interrupt.
+ */
+- if (!rc)
++ if (kvm_s390_reinject_io_int(vcpu->kvm, inti)) {
+ kfree(inti);
+- else
+- kvm_s390_reinject_io_int(vcpu->kvm, inti);
+-no_interrupt:
+- /* Set condition code and we're done. */
+- if (!rc)
+- kvm_s390_set_psw_cc(vcpu, cc);
++ rc = -EFAULT;
++ }
++ /* don't set the cc, a pgm irq was injected or we drop to user space */
+ return rc ? -EFAULT : 0;
+ }
+
+@@ -461,6 +470,7 @@ static void handle_stsi_3_2_2(struct kvm_vcpu *vcpu, struct sysinfo_3_2_2 *mem)
+ for (n = mem->count - 1; n > 0 ; n--)
+ memcpy(&mem->vm[n], &mem->vm[n - 1], sizeof(mem->vm[0]));
+
++ memset(&mem->vm[0], 0, sizeof(mem->vm[0]));
+ mem->vm[0].cpus_total = cpus;
+ mem->vm[0].cpus_configured = cpus;
+ mem->vm[0].cpus_standby = 0;
+diff --git a/arch/s390/mm/hugetlbpage.c b/arch/s390/mm/hugetlbpage.c
+index 3c80d2e38f03..210ffede0153 100644
+--- a/arch/s390/mm/hugetlbpage.c
++++ b/arch/s390/mm/hugetlbpage.c
+@@ -192,12 +192,6 @@ int huge_pmd_unshare(struct mm_struct *mm, unsigned long *addr, pte_t *ptep)
+ return 0;
+ }
+
+-struct page *follow_huge_addr(struct mm_struct *mm, unsigned long address,
+- int write)
+-{
+- return ERR_PTR(-EINVAL);
+-}
+-
+ int pmd_huge(pmd_t pmd)
+ {
+ if (!MACHINE_HAS_HPAGE)
+@@ -210,17 +204,3 @@ int pud_huge(pud_t pud)
+ {
+ return 0;
+ }
+-
+-struct page *follow_huge_pmd(struct mm_struct *mm, unsigned long address,
+- pmd_t *pmdp, int write)
+-{
+- struct page *page;
+-
+- if (!MACHINE_HAS_HPAGE)
+- return NULL;
+-
+- page = pmd_page(*pmdp);
+- if (page)
+- page += ((address & ~HPAGE_MASK) >> PAGE_SHIFT);
+- return page;
+-}
+diff --git a/arch/sh/mm/hugetlbpage.c b/arch/sh/mm/hugetlbpage.c
+index d7762349ea48..534bc978af8a 100644
+--- a/arch/sh/mm/hugetlbpage.c
++++ b/arch/sh/mm/hugetlbpage.c
+@@ -67,12 +67,6 @@ int huge_pmd_unshare(struct mm_struct *mm, unsigned long *addr, pte_t *ptep)
+ return 0;
+ }
+
+-struct page *follow_huge_addr(struct mm_struct *mm,
+- unsigned long address, int write)
+-{
+- return ERR_PTR(-EINVAL);
+-}
+-
+ int pmd_huge(pmd_t pmd)
+ {
+ return 0;
+@@ -82,9 +76,3 @@ int pud_huge(pud_t pud)
+ {
+ return 0;
+ }
+-
+-struct page *follow_huge_pmd(struct mm_struct *mm, unsigned long address,
+- pmd_t *pmd, int write)
+-{
+- return NULL;
+-}
+diff --git a/arch/sparc/mm/hugetlbpage.c b/arch/sparc/mm/hugetlbpage.c
+index d329537739c6..4242eab12e10 100644
+--- a/arch/sparc/mm/hugetlbpage.c
++++ b/arch/sparc/mm/hugetlbpage.c
+@@ -215,12 +215,6 @@ pte_t huge_ptep_get_and_clear(struct mm_struct *mm, unsigned long addr,
+ return entry;
+ }
+
+-struct page *follow_huge_addr(struct mm_struct *mm,
+- unsigned long address, int write)
+-{
+- return ERR_PTR(-EINVAL);
+-}
+-
+ int pmd_huge(pmd_t pmd)
+ {
+ return 0;
+@@ -230,9 +224,3 @@ int pud_huge(pud_t pud)
+ {
+ return 0;
+ }
+-
+-struct page *follow_huge_pmd(struct mm_struct *mm, unsigned long address,
+- pmd_t *pmd, int write)
+-{
+- return NULL;
+-}
+diff --git a/arch/tile/mm/hugetlbpage.c b/arch/tile/mm/hugetlbpage.c
+index e514899e1100..8a00c7b7b862 100644
+--- a/arch/tile/mm/hugetlbpage.c
++++ b/arch/tile/mm/hugetlbpage.c
+@@ -150,12 +150,6 @@ pte_t *huge_pte_offset(struct mm_struct *mm, unsigned long addr)
+ return NULL;
+ }
+
+-struct page *follow_huge_addr(struct mm_struct *mm, unsigned long address,
+- int write)
+-{
+- return ERR_PTR(-EINVAL);
+-}
+-
+ int pmd_huge(pmd_t pmd)
+ {
+ return !!(pmd_val(pmd) & _PAGE_HUGE_PAGE);
+@@ -166,28 +160,6 @@ int pud_huge(pud_t pud)
+ return !!(pud_val(pud) & _PAGE_HUGE_PAGE);
+ }
+
+-struct page *follow_huge_pmd(struct mm_struct *mm, unsigned long address,
+- pmd_t *pmd, int write)
+-{
+- struct page *page;
+-
+- page = pte_page(*(pte_t *)pmd);
+- if (page)
+- page += ((address & ~PMD_MASK) >> PAGE_SHIFT);
+- return page;
+-}
+-
+-struct page *follow_huge_pud(struct mm_struct *mm, unsigned long address,
+- pud_t *pud, int write)
+-{
+- struct page *page;
+-
+- page = pte_page(*(pte_t *)pud);
+- if (page)
+- page += ((address & ~PUD_MASK) >> PAGE_SHIFT);
+- return page;
+-}
+-
+ int huge_pmd_unshare(struct mm_struct *mm, unsigned long *addr, pte_t *ptep)
+ {
+ return 0;
+diff --git a/arch/x86/include/asm/mwait.h b/arch/x86/include/asm/mwait.h
+index a1410db38a1a..653dfa7662e1 100644
+--- a/arch/x86/include/asm/mwait.h
++++ b/arch/x86/include/asm/mwait.h
+@@ -30,6 +30,14 @@ static inline void __mwait(unsigned long eax, unsigned long ecx)
+ :: "a" (eax), "c" (ecx));
+ }
+
++static inline void __sti_mwait(unsigned long eax, unsigned long ecx)
++{
++ trace_hardirqs_on();
++ /* "mwait %eax, %ecx;" */
++ asm volatile("sti; .byte 0x0f, 0x01, 0xc9;"
++ :: "a" (eax), "c" (ecx));
++}
++
+ /*
+ * This uses new MONITOR/MWAIT instructions on P4 processors with PNI,
+ * which can obviate IPI to trigger checking of need_resched.
+diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c
+index e127ddaa2d5a..6ad8a6396b75 100644
+--- a/arch/x86/kernel/process.c
++++ b/arch/x86/kernel/process.c
+@@ -24,6 +24,7 @@
+ #include <asm/syscalls.h>
+ #include <asm/idle.h>
+ #include <asm/uaccess.h>
++#include <asm/mwait.h>
+ #include <asm/i387.h>
+ #include <asm/fpu-internal.h>
+ #include <asm/debugreg.h>
+@@ -398,6 +399,53 @@ static void amd_e400_idle(void)
+ default_idle();
+ }
+
++/*
++ * Intel Core2 and older machines prefer MWAIT over HALT for C1.
++ * We can't rely on cpuidle installing MWAIT, because it will not load
++ * on systems that support only C1 -- so the boot default must be MWAIT.
++ *
++ * Some AMD machines are the opposite, they depend on using HALT.
++ *
++ * So for default C1, which is used during boot until cpuidle loads,
++ * use MWAIT-C1 on Intel HW that has it, else use HALT.
++ */
++static int prefer_mwait_c1_over_halt(const struct cpuinfo_x86 *c)
++{
++ if (c->x86_vendor != X86_VENDOR_INTEL)
++ return 0;
++
++ if (!cpu_has(c, X86_FEATURE_MWAIT))
++ return 0;
++
++ return 1;
++}
++
++/*
++ * MONITOR/MWAIT with no hints, used for default default C1 state.
++ * This invokes MWAIT with interrutps enabled and no flags,
++ * which is backwards compatible with the original MWAIT implementation.
++ */
++
++static void mwait_idle(void)
++{
++ if (!current_set_polling_and_test()) {
++ if (this_cpu_has(X86_BUG_CLFLUSH_MONITOR)) {
++ smp_mb(); /* quirk */
++ clflush((void *)¤t_thread_info()->flags);
++ smp_mb(); /* quirk */
++ }
++
++ __monitor((void *)¤t_thread_info()->flags, 0, 0);
++ if (!need_resched())
++ __sti_mwait(0, 0);
++ else
++ local_irq_enable();
++ } else {
++ local_irq_enable();
++ }
++ __current_clr_polling();
++}
++
+ void select_idle_routine(const struct cpuinfo_x86 *c)
+ {
+ #ifdef CONFIG_SMP
+@@ -411,6 +459,9 @@ void select_idle_routine(const struct cpuinfo_x86 *c)
+ /* E400: APIC timer interrupt does not wake up CPU from C1e */
+ pr_info("using AMD E400 aware idle routine\n");
+ x86_idle = amd_e400_idle;
++ } else if (prefer_mwait_c1_over_halt(c)) {
++ pr_info("using mwait in idle threads\n");
++ x86_idle = mwait_idle;
+ } else
+ x86_idle = default_idle;
+ }
+diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
+index ed7039465f16..47843b04d60f 100644
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -2381,8 +2381,7 @@ static __init void nested_vmx_setup_ctls_msrs(void)
+
+ if (enable_ept) {
+ /* nested EPT: emulate EPT also to L1 */
+- nested_vmx_secondary_ctls_high |= SECONDARY_EXEC_ENABLE_EPT |
+- SECONDARY_EXEC_UNRESTRICTED_GUEST;
++ nested_vmx_secondary_ctls_high |= SECONDARY_EXEC_ENABLE_EPT;
+ nested_vmx_ept_caps = VMX_EPT_PAGE_WALK_4_BIT |
+ VMX_EPTP_WB_BIT | VMX_EPT_2MB_PAGE_BIT |
+ VMX_EPT_INVEPT_BIT;
+@@ -2396,6 +2395,10 @@ static __init void nested_vmx_setup_ctls_msrs(void)
+ } else
+ nested_vmx_ept_caps = 0;
+
++ if (enable_unrestricted_guest)
++ nested_vmx_secondary_ctls_high |=
++ SECONDARY_EXEC_UNRESTRICTED_GUEST;
++
+ /* miscellaneous data */
+ rdmsr(MSR_IA32_VMX_MISC, nested_vmx_misc_low, nested_vmx_misc_high);
+ nested_vmx_misc_low &= VMX_MISC_SAVE_EFER_LMA;
+diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
+index a38dd816015b..5369ec6a8094 100644
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -5779,7 +5779,6 @@ int kvm_arch_init(void *opaque)
+ kvm_set_mmio_spte_mask();
+
+ kvm_x86_ops = ops;
+- kvm_init_msr_list();
+
+ kvm_mmu_set_mask_ptes(PT_USER_MASK, PT_ACCESSED_MASK,
+ PT_DIRTY_MASK, PT64_NX_MASK, 0);
+@@ -7210,7 +7209,14 @@ void kvm_arch_hardware_disable(void)
+
+ int kvm_arch_hardware_setup(void)
+ {
+- return kvm_x86_ops->hardware_setup();
++ int r;
++
++ r = kvm_x86_ops->hardware_setup();
++ if (r != 0)
++ return r;
++
++ kvm_init_msr_list();
++ return 0;
+ }
+
+ void kvm_arch_hardware_unsetup(void)
+diff --git a/arch/x86/mm/hugetlbpage.c b/arch/x86/mm/hugetlbpage.c
+index 006cc914994b..9161f764121e 100644
+--- a/arch/x86/mm/hugetlbpage.c
++++ b/arch/x86/mm/hugetlbpage.c
+@@ -52,20 +52,8 @@ int pud_huge(pud_t pud)
+ return 0;
+ }
+
+-struct page *
+-follow_huge_pmd(struct mm_struct *mm, unsigned long address,
+- pmd_t *pmd, int write)
+-{
+- return NULL;
+-}
+ #else
+
+-struct page *
+-follow_huge_addr(struct mm_struct *mm, unsigned long address, int write)
+-{
+- return ERR_PTR(-EINVAL);
+-}
+-
+ /*
+ * pmd_huge() returns 1 if @pmd is hugetlb related entry, that is normal
+ * hugetlb entry or non-present (migration or hwpoisoned) hugetlb entry.
+diff --git a/arch/xtensa/Kconfig b/arch/xtensa/Kconfig
+index 81f57e8c8f1b..73d328f480e5 100644
+--- a/arch/xtensa/Kconfig
++++ b/arch/xtensa/Kconfig
+@@ -406,6 +406,36 @@ source "drivers/pcmcia/Kconfig"
+
+ source "drivers/pci/hotplug/Kconfig"
+
++config XTFPGA_LCD
++ bool "Enable XTFPGA LCD driver"
++ depends on XTENSA_PLATFORM_XTFPGA
++ default n
++ help
++ There's a 2x16 LCD on most of XTFPGA boards, kernel may output
++ progress messages there during bootup/shutdown. It may be useful
++ during board bringup.
++
++ If unsure, say N.
++
++config XTFPGA_LCD_BASE_ADDR
++ hex "XTFPGA LCD base address"
++ depends on XTFPGA_LCD
++ default "0x0d0c0000"
++ help
++ Base address of the LCD controller inside KIO region.
++ Different boards from XTFPGA family have LCD controller at different
++ addresses. Please consult prototyping user guide for your board for
++ the correct address. Wrong address here may lead to hardware lockup.
++
++config XTFPGA_LCD_8BIT_ACCESS
++ bool "Use 8-bit access to XTFPGA LCD"
++ depends on XTFPGA_LCD
++ default n
++ help
++ LCD may be connected with 4- or 8-bit interface, 8-bit access may
++ only be used with 8-bit interface. Please consult prototyping user
++ guide for your board for the correct interface width.
++
+ endmenu
+
+ menu "Executable file formats"
+diff --git a/arch/xtensa/include/uapi/asm/unistd.h b/arch/xtensa/include/uapi/asm/unistd.h
+index db5bb72e2f4e..62d84657c60b 100644
+--- a/arch/xtensa/include/uapi/asm/unistd.h
++++ b/arch/xtensa/include/uapi/asm/unistd.h
+@@ -715,7 +715,7 @@ __SYSCALL(323, sys_process_vm_writev, 6)
+ __SYSCALL(324, sys_name_to_handle_at, 5)
+ #define __NR_open_by_handle_at 325
+ __SYSCALL(325, sys_open_by_handle_at, 3)
+-#define __NR_sync_file_range 326
++#define __NR_sync_file_range2 326
+ __SYSCALL(326, sys_sync_file_range2, 6)
+ #define __NR_perf_event_open 327
+ __SYSCALL(327, sys_perf_event_open, 5)
+diff --git a/arch/xtensa/platforms/iss/network.c b/arch/xtensa/platforms/iss/network.c
+index d05f8feeb8d7..17b1ef3232e4 100644
+--- a/arch/xtensa/platforms/iss/network.c
++++ b/arch/xtensa/platforms/iss/network.c
+@@ -349,8 +349,8 @@ static void iss_net_timer(unsigned long priv)
+ {
+ struct iss_net_private *lp = (struct iss_net_private *)priv;
+
+- spin_lock(&lp->lock);
+ iss_net_poll();
++ spin_lock(&lp->lock);
+ mod_timer(&lp->timer, jiffies + lp->timer_val);
+ spin_unlock(&lp->lock);
+ }
+@@ -361,7 +361,7 @@ static int iss_net_open(struct net_device *dev)
+ struct iss_net_private *lp = netdev_priv(dev);
+ int err;
+
+- spin_lock(&lp->lock);
++ spin_lock_bh(&lp->lock);
+
+ err = lp->tp.open(lp);
+ if (err < 0)
+@@ -376,9 +376,11 @@ static int iss_net_open(struct net_device *dev)
+ while ((err = iss_net_rx(dev)) > 0)
+ ;
+
+- spin_lock(&opened_lock);
++ spin_unlock_bh(&lp->lock);
++ spin_lock_bh(&opened_lock);
+ list_add(&lp->opened_list, &opened);
+- spin_unlock(&opened_lock);
++ spin_unlock_bh(&opened_lock);
++ spin_lock_bh(&lp->lock);
+
+ init_timer(&lp->timer);
+ lp->timer_val = ISS_NET_TIMER_VALUE;
+@@ -387,7 +389,7 @@ static int iss_net_open(struct net_device *dev)
+ mod_timer(&lp->timer, jiffies + lp->timer_val);
+
+ out:
+- spin_unlock(&lp->lock);
++ spin_unlock_bh(&lp->lock);
+ return err;
+ }
+
+@@ -395,7 +397,7 @@ static int iss_net_close(struct net_device *dev)
+ {
+ struct iss_net_private *lp = netdev_priv(dev);
+ netif_stop_queue(dev);
+- spin_lock(&lp->lock);
++ spin_lock_bh(&lp->lock);
+
+ spin_lock(&opened_lock);
+ list_del(&opened);
+@@ -405,18 +407,17 @@ static int iss_net_close(struct net_device *dev)
+
+ lp->tp.close(lp);
+
+- spin_unlock(&lp->lock);
++ spin_unlock_bh(&lp->lock);
+ return 0;
+ }
+
+ static int iss_net_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct iss_net_private *lp = netdev_priv(dev);
+- unsigned long flags;
+ int len;
+
+ netif_stop_queue(dev);
+- spin_lock_irqsave(&lp->lock, flags);
++ spin_lock_bh(&lp->lock);
+
+ len = lp->tp.write(lp, &skb);
+
+@@ -438,7 +439,7 @@ static int iss_net_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ pr_err("%s: %s failed(%d)\n", dev->name, __func__, len);
+ }
+
+- spin_unlock_irqrestore(&lp->lock, flags);
++ spin_unlock_bh(&lp->lock);
+
+ dev_kfree_skb(skb);
+ return NETDEV_TX_OK;
+@@ -466,9 +467,9 @@ static int iss_net_set_mac(struct net_device *dev, void *addr)
+
+ if (!is_valid_ether_addr(hwaddr->sa_data))
+ return -EADDRNOTAVAIL;
+- spin_lock(&lp->lock);
++ spin_lock_bh(&lp->lock);
+ memcpy(dev->dev_addr, hwaddr->sa_data, ETH_ALEN);
+- spin_unlock(&lp->lock);
++ spin_unlock_bh(&lp->lock);
+ return 0;
+ }
+
+@@ -520,11 +521,11 @@ static int iss_net_configure(int index, char *init)
+ *lp = (struct iss_net_private) {
+ .device_list = LIST_HEAD_INIT(lp->device_list),
+ .opened_list = LIST_HEAD_INIT(lp->opened_list),
+- .lock = __SPIN_LOCK_UNLOCKED(lp.lock),
+ .dev = dev,
+ .index = index,
+- };
++ };
+
++ spin_lock_init(&lp->lock);
+ /*
+ * If this name ends up conflicting with an existing registered
+ * netdevice, that is OK, register_netdev{,ice}() will notice this
+diff --git a/arch/xtensa/platforms/xtfpga/Makefile b/arch/xtensa/platforms/xtfpga/Makefile
+index b9ae206340cd..7839d38b2337 100644
+--- a/arch/xtensa/platforms/xtfpga/Makefile
++++ b/arch/xtensa/platforms/xtfpga/Makefile
+@@ -6,4 +6,5 @@
+ #
+ # Note 2! The CFLAGS definitions are in the main makefile...
+
+-obj-y = setup.o lcd.o
++obj-y += setup.o
++obj-$(CONFIG_XTFPGA_LCD) += lcd.o
+diff --git a/arch/xtensa/platforms/xtfpga/include/platform/hardware.h b/arch/xtensa/platforms/xtfpga/include/platform/hardware.h
+index aeb316b7ff88..e8cc86fbba09 100644
+--- a/arch/xtensa/platforms/xtfpga/include/platform/hardware.h
++++ b/arch/xtensa/platforms/xtfpga/include/platform/hardware.h
+@@ -40,9 +40,6 @@
+
+ /* UART */
+ #define DUART16552_PADDR (XCHAL_KIO_PADDR + 0x0D050020)
+-/* LCD instruction and data addresses. */
+-#define LCD_INSTR_ADDR ((char *)IOADDR(0x0D040000))
+-#define LCD_DATA_ADDR ((char *)IOADDR(0x0D040004))
+
+ /* Misc. */
+ #define XTFPGA_FPGAREGS_VADDR IOADDR(0x0D020000)
+diff --git a/arch/xtensa/platforms/xtfpga/include/platform/lcd.h b/arch/xtensa/platforms/xtfpga/include/platform/lcd.h
+index 0e435645af5a..4c8541ed1139 100644
+--- a/arch/xtensa/platforms/xtfpga/include/platform/lcd.h
++++ b/arch/xtensa/platforms/xtfpga/include/platform/lcd.h
+@@ -11,10 +11,25 @@
+ #ifndef __XTENSA_XTAVNET_LCD_H
+ #define __XTENSA_XTAVNET_LCD_H
+
++#ifdef CONFIG_XTFPGA_LCD
+ /* Display string STR at position POS on the LCD. */
+ void lcd_disp_at_pos(char *str, unsigned char pos);
+
+ /* Shift the contents of the LCD display left or right. */
+ void lcd_shiftleft(void);
+ void lcd_shiftright(void);
++#else
++static inline void lcd_disp_at_pos(char *str, unsigned char pos)
++{
++}
++
++static inline void lcd_shiftleft(void)
++{
++}
++
++static inline void lcd_shiftright(void)
++{
++}
++#endif
++
+ #endif
+diff --git a/arch/xtensa/platforms/xtfpga/lcd.c b/arch/xtensa/platforms/xtfpga/lcd.c
+index 2872301598df..4dc0c1b43f4b 100644
+--- a/arch/xtensa/platforms/xtfpga/lcd.c
++++ b/arch/xtensa/platforms/xtfpga/lcd.c
+@@ -1,50 +1,63 @@
+ /*
+- * Driver for the LCD display on the Tensilica LX60 Board.
++ * Driver for the LCD display on the Tensilica XTFPGA board family.
++ * http://www.mytechcorp.com/cfdata/productFile/File1/MOC-16216B-B-A0A04.pdf
+ *
+ * This file is subject to the terms and conditions of the GNU General Public
+ * License. See the file "COPYING" in the main directory of this archive
+ * for more details.
+ *
+ * Copyright (C) 2001, 2006 Tensilica Inc.
++ * Copyright (C) 2015 Cadence Design Systems Inc.
+ */
+
+-/*
+- *
+- * FIXME: this code is from the examples from the LX60 user guide.
+- *
+- * The lcd_pause function does busy waiting, which is probably not
+- * great. Maybe the code could be changed to use kernel timers, or
+- * change the hardware to not need to wait.
+- */
+-
++#include <linux/delay.h>
+ #include <linux/init.h>
+ #include <linux/io.h>
+
+ #include <platform/hardware.h>
+ #include <platform/lcd.h>
+-#include <linux/delay.h>
+
+-#define LCD_PAUSE_ITERATIONS 4000
++/* LCD instruction and data addresses. */
++#define LCD_INSTR_ADDR ((char *)IOADDR(CONFIG_XTFPGA_LCD_BASE_ADDR))
++#define LCD_DATA_ADDR (LCD_INSTR_ADDR + 4)
++
+ #define LCD_CLEAR 0x1
+ #define LCD_DISPLAY_ON 0xc
+
+ /* 8bit and 2 lines display */
+ #define LCD_DISPLAY_MODE8BIT 0x38
++#define LCD_DISPLAY_MODE4BIT 0x28
+ #define LCD_DISPLAY_POS 0x80
+ #define LCD_SHIFT_LEFT 0x18
+ #define LCD_SHIFT_RIGHT 0x1c
+
++static void lcd_put_byte(u8 *addr, u8 data)
++{
++#ifdef CONFIG_XTFPGA_LCD_8BIT_ACCESS
++ ACCESS_ONCE(*addr) = data;
++#else
++ ACCESS_ONCE(*addr) = data & 0xf0;
++ ACCESS_ONCE(*addr) = (data << 4) & 0xf0;
++#endif
++}
++
+ static int __init lcd_init(void)
+ {
+- *LCD_INSTR_ADDR = LCD_DISPLAY_MODE8BIT;
++ ACCESS_ONCE(*LCD_INSTR_ADDR) = LCD_DISPLAY_MODE8BIT;
+ mdelay(5);
+- *LCD_INSTR_ADDR = LCD_DISPLAY_MODE8BIT;
++ ACCESS_ONCE(*LCD_INSTR_ADDR) = LCD_DISPLAY_MODE8BIT;
+ udelay(200);
+- *LCD_INSTR_ADDR = LCD_DISPLAY_MODE8BIT;
++ ACCESS_ONCE(*LCD_INSTR_ADDR) = LCD_DISPLAY_MODE8BIT;
++ udelay(50);
++#ifndef CONFIG_XTFPGA_LCD_8BIT_ACCESS
++ ACCESS_ONCE(*LCD_INSTR_ADDR) = LCD_DISPLAY_MODE4BIT;
++ udelay(50);
++ lcd_put_byte(LCD_INSTR_ADDR, LCD_DISPLAY_MODE4BIT);
+ udelay(50);
+- *LCD_INSTR_ADDR = LCD_DISPLAY_ON;
++#endif
++ lcd_put_byte(LCD_INSTR_ADDR, LCD_DISPLAY_ON);
+ udelay(50);
+- *LCD_INSTR_ADDR = LCD_CLEAR;
++ lcd_put_byte(LCD_INSTR_ADDR, LCD_CLEAR);
+ mdelay(10);
+ lcd_disp_at_pos("XTENSA LINUX", 0);
+ return 0;
+@@ -52,10 +65,10 @@ static int __init lcd_init(void)
+
+ void lcd_disp_at_pos(char *str, unsigned char pos)
+ {
+- *LCD_INSTR_ADDR = LCD_DISPLAY_POS | pos;
++ lcd_put_byte(LCD_INSTR_ADDR, LCD_DISPLAY_POS | pos);
+ udelay(100);
+ while (*str != 0) {
+- *LCD_DATA_ADDR = *str;
++ lcd_put_byte(LCD_DATA_ADDR, *str);
+ udelay(200);
+ str++;
+ }
+@@ -63,13 +76,13 @@ void lcd_disp_at_pos(char *str, unsigned char pos)
+
+ void lcd_shiftleft(void)
+ {
+- *LCD_INSTR_ADDR = LCD_SHIFT_LEFT;
++ lcd_put_byte(LCD_INSTR_ADDR, LCD_SHIFT_LEFT);
+ udelay(50);
+ }
+
+ void lcd_shiftright(void)
+ {
+- *LCD_INSTR_ADDR = LCD_SHIFT_RIGHT;
++ lcd_put_byte(LCD_INSTR_ADDR, LCD_SHIFT_RIGHT);
+ udelay(50);
+ }
+
+diff --git a/drivers/acpi/acpica/tbinstal.c b/drivers/acpi/acpica/tbinstal.c
+index 755b90c40ddf..c0b39f304ea3 100644
+--- a/drivers/acpi/acpica/tbinstal.c
++++ b/drivers/acpi/acpica/tbinstal.c
+@@ -346,7 +346,6 @@ acpi_tb_install_standard_table(acpi_physical_address address,
+ */
+ acpi_tb_uninstall_table(&new_table_desc);
+ *table_index = i;
+- (void)acpi_ut_release_mutex(ACPI_MTX_TABLES);
+ return_ACPI_STATUS(AE_OK);
+ }
+ }
+diff --git a/drivers/acpi/sbs.c b/drivers/acpi/sbs.c
+index a7a3edd28beb..f23179e84128 100644
+--- a/drivers/acpi/sbs.c
++++ b/drivers/acpi/sbs.c
+@@ -670,7 +670,7 @@ static int acpi_sbs_add(struct acpi_device *device)
+ if (!sbs_manager_broken) {
+ result = acpi_manager_get_info(sbs);
+ if (!result) {
+- sbs->manager_present = 0;
++ sbs->manager_present = 1;
+ for (id = 0; id < MAX_SBS_BAT; ++id)
+ if ((sbs->batteries_supported & (1 << id)))
+ acpi_battery_add(sbs, id);
+diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
+index c9ea3dfb4974..0446d0d5efa5 100644
+--- a/drivers/acpi/scan.c
++++ b/drivers/acpi/scan.c
+@@ -251,7 +251,11 @@ bool acpi_scan_is_offline(struct acpi_device *adev, bool uevent)
+ struct acpi_device_physical_node *pn;
+ bool offline = true;
+
+- mutex_lock(&adev->physical_node_lock);
++ /*
++ * acpi_container_offline() calls this for all of the container's
++ * children under the container's physical_node_lock lock.
++ */
++ mutex_lock_nested(&adev->physical_node_lock, SINGLE_DEPTH_NESTING);
+
+ list_for_each_entry(pn, &adev->physical_node_list, node)
+ if (device_supports_offline(pn->dev) && !pn->dev->offline) {
+diff --git a/drivers/base/bus.c b/drivers/base/bus.c
+index 876bae5ade33..79bc203f51ef 100644
+--- a/drivers/base/bus.c
++++ b/drivers/base/bus.c
+@@ -515,11 +515,11 @@ int bus_add_device(struct device *dev)
+ goto out_put;
+ error = device_add_groups(dev, bus->dev_groups);
+ if (error)
+- goto out_groups;
++ goto out_id;
+ error = sysfs_create_link(&bus->p->devices_kset->kobj,
+ &dev->kobj, dev_name(dev));
+ if (error)
+- goto out_id;
++ goto out_groups;
+ error = sysfs_create_link(&dev->kobj,
+ &dev->bus->p->subsys.kobj, "subsystem");
+ if (error)
+diff --git a/drivers/base/platform.c b/drivers/base/platform.c
+index b2afc29403f9..360272cd4549 100644
+--- a/drivers/base/platform.c
++++ b/drivers/base/platform.c
+@@ -101,6 +101,15 @@ int platform_get_irq(struct platform_device *dev, unsigned int num)
+ }
+
+ r = platform_get_resource(dev, IORESOURCE_IRQ, num);
++ /*
++ * The resources may pass trigger flags to the irqs that need
++ * to be set up. It so happens that the trigger flags for
++ * IORESOURCE_BITS correspond 1-to-1 to the IRQF_TRIGGER*
++ * settings.
++ */
++ if (r && r->flags & IORESOURCE_BITS)
++ irqd_set_trigger_type(irq_get_irq_data(r->start),
++ r->flags & IORESOURCE_BITS);
+
+ return r ? r->start : -ENXIO;
+ #endif
+diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c
+index 76b5be937de6..5d684d97dc6d 100644
+--- a/drivers/block/rbd.c
++++ b/drivers/block/rbd.c
+@@ -2261,6 +2261,11 @@ static bool rbd_img_obj_end_request(struct rbd_obj_request *obj_request)
+ result, xferred);
+ if (!img_request->result)
+ img_request->result = result;
++ /*
++ * Need to end I/O on the entire obj_request worth of
++ * bytes in case of error.
++ */
++ xferred = obj_request->length;
+ }
+
+ /* Image object requests don't own their page array */
+diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c
+index de4c8499cbac..288547a3c566 100644
+--- a/drivers/bluetooth/ath3k.c
++++ b/drivers/bluetooth/ath3k.c
+@@ -65,6 +65,7 @@ static const struct usb_device_id ath3k_table[] = {
+ /* Atheros AR3011 with sflash firmware*/
+ { USB_DEVICE(0x0489, 0xE027) },
+ { USB_DEVICE(0x0489, 0xE03D) },
++ { USB_DEVICE(0x04F2, 0xAFF1) },
+ { USB_DEVICE(0x0930, 0x0215) },
+ { USB_DEVICE(0x0CF3, 0x3002) },
+ { USB_DEVICE(0x0CF3, 0xE019) },
+diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
+index 9a7d24f95c5e..813bb06a8889 100644
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -153,6 +153,7 @@ static const struct usb_device_id blacklist_table[] = {
+ /* Atheros 3011 with sflash firmware */
+ { USB_DEVICE(0x0489, 0xe027), .driver_info = BTUSB_IGNORE },
+ { USB_DEVICE(0x0489, 0xe03d), .driver_info = BTUSB_IGNORE },
++ { USB_DEVICE(0x04f2, 0xaff1), .driver_info = BTUSB_IGNORE },
+ { USB_DEVICE(0x0930, 0x0215), .driver_info = BTUSB_IGNORE },
+ { USB_DEVICE(0x0cf3, 0x3002), .driver_info = BTUSB_IGNORE },
+ { USB_DEVICE(0x0cf3, 0xe019), .driver_info = BTUSB_IGNORE },
+diff --git a/drivers/clk/at91/clk-usb.c b/drivers/clk/at91/clk-usb.c
+index a23ac0c724f0..0283a5713d6c 100644
+--- a/drivers/clk/at91/clk-usb.c
++++ b/drivers/clk/at91/clk-usb.c
+@@ -56,22 +56,53 @@ static unsigned long at91sam9x5_clk_usb_recalc_rate(struct clk_hw *hw,
+ return DIV_ROUND_CLOSEST(parent_rate, (usbdiv + 1));
+ }
+
+-static long at91sam9x5_clk_usb_round_rate(struct clk_hw *hw, unsigned long rate,
+- unsigned long *parent_rate)
++static long at91sam9x5_clk_usb_determine_rate(struct clk_hw *hw,
++ unsigned long rate,
++ unsigned long *best_parent_rate,
++ struct clk_hw **best_parent_hw)
+ {
+- unsigned long div;
++ struct clk *parent = NULL;
++ long best_rate = -EINVAL;
++ unsigned long tmp_rate;
++ int best_diff = -1;
++ int tmp_diff;
++ int i;
+
+- if (!rate)
+- return -EINVAL;
++ for (i = 0; i < __clk_get_num_parents(hw->clk); i++) {
++ int div;
+
+- if (rate >= *parent_rate)
+- return *parent_rate;
++ parent = clk_get_parent_by_index(hw->clk, i);
++ if (!parent)
++ continue;
++
++ for (div = 1; div < SAM9X5_USB_MAX_DIV + 2; div++) {
++ unsigned long tmp_parent_rate;
++
++ tmp_parent_rate = rate * div;
++ tmp_parent_rate = __clk_round_rate(parent,
++ tmp_parent_rate);
++ tmp_rate = DIV_ROUND_CLOSEST(tmp_parent_rate, div);
++ if (tmp_rate < rate)
++ tmp_diff = rate - tmp_rate;
++ else
++ tmp_diff = tmp_rate - rate;
++
++ if (best_diff < 0 || best_diff > tmp_diff) {
++ best_rate = tmp_rate;
++ best_diff = tmp_diff;
++ *best_parent_rate = tmp_parent_rate;
++ *best_parent_hw = __clk_get_hw(parent);
++ }
++
++ if (!best_diff || tmp_rate < rate)
++ break;
++ }
+
+- div = DIV_ROUND_CLOSEST(*parent_rate, rate);
+- if (div > SAM9X5_USB_MAX_DIV + 1)
+- div = SAM9X5_USB_MAX_DIV + 1;
++ if (!best_diff)
++ break;
++ }
+
+- return DIV_ROUND_CLOSEST(*parent_rate, div);
++ return best_rate;
+ }
+
+ static int at91sam9x5_clk_usb_set_parent(struct clk_hw *hw, u8 index)
+@@ -121,7 +152,7 @@ static int at91sam9x5_clk_usb_set_rate(struct clk_hw *hw, unsigned long rate,
+
+ static const struct clk_ops at91sam9x5_usb_ops = {
+ .recalc_rate = at91sam9x5_clk_usb_recalc_rate,
+- .round_rate = at91sam9x5_clk_usb_round_rate,
++ .determine_rate = at91sam9x5_clk_usb_determine_rate,
+ .get_parent = at91sam9x5_clk_usb_get_parent,
+ .set_parent = at91sam9x5_clk_usb_set_parent,
+ .set_rate = at91sam9x5_clk_usb_set_rate,
+@@ -159,7 +190,7 @@ static const struct clk_ops at91sam9n12_usb_ops = {
+ .disable = at91sam9n12_clk_usb_disable,
+ .is_enabled = at91sam9n12_clk_usb_is_enabled,
+ .recalc_rate = at91sam9x5_clk_usb_recalc_rate,
+- .round_rate = at91sam9x5_clk_usb_round_rate,
++ .determine_rate = at91sam9x5_clk_usb_determine_rate,
+ .set_rate = at91sam9x5_clk_usb_set_rate,
+ };
+
+@@ -179,7 +210,8 @@ at91sam9x5_clk_register_usb(struct at91_pmc *pmc, const char *name,
+ init.ops = &at91sam9x5_usb_ops;
+ init.parent_names = parent_names;
+ init.num_parents = num_parents;
+- init.flags = CLK_SET_RATE_GATE | CLK_SET_PARENT_GATE;
++ init.flags = CLK_SET_RATE_GATE | CLK_SET_PARENT_GATE |
++ CLK_SET_RATE_PARENT;
+
+ usb->hw.init = &init;
+ usb->pmc = pmc;
+@@ -207,7 +239,7 @@ at91sam9n12_clk_register_usb(struct at91_pmc *pmc, const char *name,
+ init.ops = &at91sam9n12_usb_ops;
+ init.parent_names = &parent_name;
+ init.num_parents = 1;
+- init.flags = CLK_SET_RATE_GATE;
++ init.flags = CLK_SET_RATE_GATE | CLK_SET_RATE_PARENT;
+
+ usb->hw.init = &init;
+ usb->pmc = pmc;
+diff --git a/drivers/clk/qcom/clk-rcg2.c b/drivers/clk/qcom/clk-rcg2.c
+index cfa9eb4fe9ca..f76b6853b61c 100644
+--- a/drivers/clk/qcom/clk-rcg2.c
++++ b/drivers/clk/qcom/clk-rcg2.c
+@@ -240,7 +240,7 @@ static int clk_rcg2_configure(struct clk_rcg2 *rcg, const struct freq_tbl *f)
+ mask |= CFG_SRC_SEL_MASK | CFG_MODE_MASK;
+ cfg = f->pre_div << CFG_SRC_DIV_SHIFT;
+ cfg |= rcg->parent_map[f->src] << CFG_SRC_SEL_SHIFT;
+- if (rcg->mnd_width && f->n)
++ if (rcg->mnd_width && f->n && (f->m != f->n))
+ cfg |= CFG_MODE_DUAL_EDGE;
+ ret = regmap_update_bits(rcg->clkr.regmap,
+ rcg->cmd_rcgr + CFG_REG, mask, cfg);
+diff --git a/drivers/clk/qcom/gcc-ipq806x.c b/drivers/clk/qcom/gcc-ipq806x.c
+index 5cd62a709ac7..8c37d9c374eb 100644
+--- a/drivers/clk/qcom/gcc-ipq806x.c
++++ b/drivers/clk/qcom/gcc-ipq806x.c
+@@ -514,8 +514,8 @@ static struct freq_tbl clk_tbl_gsbi_qup[] = {
+ { 10800000, P_PXO, 1, 2, 5 },
+ { 15060000, P_PLL8, 1, 2, 51 },
+ { 24000000, P_PLL8, 4, 1, 4 },
++ { 25000000, P_PXO, 1, 0, 0 },
+ { 25600000, P_PLL8, 1, 1, 15 },
+- { 27000000, P_PXO, 1, 0, 0 },
+ { 48000000, P_PLL8, 4, 1, 2 },
+ { 51200000, P_PLL8, 1, 2, 15 },
+ { }
+diff --git a/drivers/clk/samsung/clk-exynos4.c b/drivers/clk/samsung/clk-exynos4.c
+index 940f02837b82..6197317ea2d7 100644
+--- a/drivers/clk/samsung/clk-exynos4.c
++++ b/drivers/clk/samsung/clk-exynos4.c
+@@ -1354,7 +1354,7 @@ static struct samsung_pll_clock exynos4x12_plls[nr_plls] __initdata = {
+ VPLL_LOCK, VPLL_CON0, NULL),
+ };
+
+-static void __init exynos4_core_down_clock(enum exynos4_soc soc)
++static void __init exynos4x12_core_down_clock(void)
+ {
+ unsigned int tmp;
+
+@@ -1373,11 +1373,9 @@ static void __init exynos4_core_down_clock(enum exynos4_soc soc)
+ __raw_writel(tmp, reg_base + PWR_CTRL1);
+
+ /*
+- * Disable the clock up feature on Exynos4x12, in case it was
+- * enabled by bootloader.
++ * Disable the clock up feature in case it was enabled by bootloader.
+ */
+- if (exynos4_soc == EXYNOS4X12)
+- __raw_writel(0x0, reg_base + E4X12_PWR_CTRL2);
++ __raw_writel(0x0, reg_base + E4X12_PWR_CTRL2);
+ }
+
+ /* register exynos4 clocks */
+@@ -1474,7 +1472,8 @@ static void __init exynos4_clk_init(struct device_node *np,
+ samsung_clk_register_alias(ctx, exynos4_aliases,
+ ARRAY_SIZE(exynos4_aliases));
+
+- exynos4_core_down_clock(soc);
++ if (soc == EXYNOS4X12)
++ exynos4x12_core_down_clock();
+ exynos4_clk_sleep_init();
+
+ samsung_clk_of_add_provider(np, ctx);
+diff --git a/drivers/clk/tegra/clk.c b/drivers/clk/tegra/clk.c
+index 97dc8595c3cd..c51f7c84c163 100644
+--- a/drivers/clk/tegra/clk.c
++++ b/drivers/clk/tegra/clk.c
+@@ -272,7 +272,7 @@ void __init tegra_add_of_provider(struct device_node *np)
+ of_clk_add_provider(np, of_clk_src_onecell_get, &clk_data);
+
+ rst_ctlr.of_node = np;
+- rst_ctlr.nr_resets = clk_num * 32;
++ rst_ctlr.nr_resets = periph_banks * 32;
+ reset_controller_register(&rst_ctlr);
+ }
+
+diff --git a/drivers/crypto/omap-aes.c b/drivers/crypto/omap-aes.c
+index cb98fa54573d..f7826ee3754b 100644
+--- a/drivers/crypto/omap-aes.c
++++ b/drivers/crypto/omap-aes.c
+@@ -554,15 +554,23 @@ static int omap_aes_crypt_dma_stop(struct omap_aes_dev *dd)
+ return err;
+ }
+
+-static int omap_aes_check_aligned(struct scatterlist *sg)
++static int omap_aes_check_aligned(struct scatterlist *sg, int total)
+ {
++ int len = 0;
++
+ while (sg) {
+ if (!IS_ALIGNED(sg->offset, 4))
+ return -1;
+ if (!IS_ALIGNED(sg->length, AES_BLOCK_SIZE))
+ return -1;
++
++ len += sg->length;
+ sg = sg_next(sg);
+ }
++
++ if (len != total)
++ return -1;
++
+ return 0;
+ }
+
+@@ -633,8 +641,8 @@ static int omap_aes_handle_queue(struct omap_aes_dev *dd,
+ dd->in_sg = req->src;
+ dd->out_sg = req->dst;
+
+- if (omap_aes_check_aligned(dd->in_sg) ||
+- omap_aes_check_aligned(dd->out_sg)) {
++ if (omap_aes_check_aligned(dd->in_sg, dd->total) ||
++ omap_aes_check_aligned(dd->out_sg, dd->total)) {
+ if (omap_aes_copy_sgs(dd))
+ pr_err("Failed to copy SGs for unaligned cases\n");
+ dd->sgs_copied = 1;
+diff --git a/drivers/gpio/gpio-mvebu.c b/drivers/gpio/gpio-mvebu.c
+index 418e38650363..a93ddbc1948e 100644
+--- a/drivers/gpio/gpio-mvebu.c
++++ b/drivers/gpio/gpio-mvebu.c
+@@ -305,11 +305,13 @@ static void mvebu_gpio_edge_irq_mask(struct irq_data *d)
+ {
+ struct irq_chip_generic *gc = irq_data_get_irq_chip_data(d);
+ struct mvebu_gpio_chip *mvchip = gc->private;
++ struct irq_chip_type *ct = irq_data_get_chip_type(d);
+ u32 mask = 1 << (d->irq - gc->irq_base);
+
+ irq_gc_lock(gc);
+- gc->mask_cache &= ~mask;
+- writel_relaxed(gc->mask_cache, mvebu_gpioreg_edge_mask(mvchip));
++ ct->mask_cache_priv &= ~mask;
++
++ writel_relaxed(ct->mask_cache_priv, mvebu_gpioreg_edge_mask(mvchip));
+ irq_gc_unlock(gc);
+ }
+
+@@ -317,11 +319,13 @@ static void mvebu_gpio_edge_irq_unmask(struct irq_data *d)
+ {
+ struct irq_chip_generic *gc = irq_data_get_irq_chip_data(d);
+ struct mvebu_gpio_chip *mvchip = gc->private;
++ struct irq_chip_type *ct = irq_data_get_chip_type(d);
++
+ u32 mask = 1 << (d->irq - gc->irq_base);
+
+ irq_gc_lock(gc);
+- gc->mask_cache |= mask;
+- writel_relaxed(gc->mask_cache, mvebu_gpioreg_edge_mask(mvchip));
++ ct->mask_cache_priv |= mask;
++ writel_relaxed(ct->mask_cache_priv, mvebu_gpioreg_edge_mask(mvchip));
+ irq_gc_unlock(gc);
+ }
+
+@@ -329,11 +333,13 @@ static void mvebu_gpio_level_irq_mask(struct irq_data *d)
+ {
+ struct irq_chip_generic *gc = irq_data_get_irq_chip_data(d);
+ struct mvebu_gpio_chip *mvchip = gc->private;
++ struct irq_chip_type *ct = irq_data_get_chip_type(d);
++
+ u32 mask = 1 << (d->irq - gc->irq_base);
+
+ irq_gc_lock(gc);
+- gc->mask_cache &= ~mask;
+- writel_relaxed(gc->mask_cache, mvebu_gpioreg_level_mask(mvchip));
++ ct->mask_cache_priv &= ~mask;
++ writel_relaxed(ct->mask_cache_priv, mvebu_gpioreg_level_mask(mvchip));
+ irq_gc_unlock(gc);
+ }
+
+@@ -341,11 +347,13 @@ static void mvebu_gpio_level_irq_unmask(struct irq_data *d)
+ {
+ struct irq_chip_generic *gc = irq_data_get_irq_chip_data(d);
+ struct mvebu_gpio_chip *mvchip = gc->private;
++ struct irq_chip_type *ct = irq_data_get_chip_type(d);
++
+ u32 mask = 1 << (d->irq - gc->irq_base);
+
+ irq_gc_lock(gc);
+- gc->mask_cache |= mask;
+- writel_relaxed(gc->mask_cache, mvebu_gpioreg_level_mask(mvchip));
++ ct->mask_cache_priv |= mask;
++ writel_relaxed(ct->mask_cache_priv, mvebu_gpioreg_level_mask(mvchip));
+ irq_gc_unlock(gc);
+ }
+
+diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
+index 59f23fca0596..b51f02758836 100644
+--- a/drivers/gpu/drm/i915/i915_drv.c
++++ b/drivers/gpu/drm/i915/i915_drv.c
+@@ -1088,7 +1088,7 @@ static void vlv_save_gunit_s0ix_state(struct drm_i915_private *dev_priv)
+ s->lra_limits[i] = I915_READ(GEN7_LRA_LIMITS_BASE + i * 4);
+
+ s->media_max_req_count = I915_READ(GEN7_MEDIA_MAX_REQ_COUNT);
+- s->gfx_max_req_count = I915_READ(GEN7_MEDIA_MAX_REQ_COUNT);
++ s->gfx_max_req_count = I915_READ(GEN7_GFX_MAX_REQ_COUNT);
+
+ s->render_hwsp = I915_READ(RENDER_HWS_PGA_GEN7);
+ s->ecochk = I915_READ(GAM_ECOCHK);
+@@ -1170,7 +1170,7 @@ static void vlv_restore_gunit_s0ix_state(struct drm_i915_private *dev_priv)
+ I915_WRITE(GEN7_LRA_LIMITS_BASE + i * 4, s->lra_limits[i]);
+
+ I915_WRITE(GEN7_MEDIA_MAX_REQ_COUNT, s->media_max_req_count);
+- I915_WRITE(GEN7_MEDIA_MAX_REQ_COUNT, s->gfx_max_req_count);
++ I915_WRITE(GEN7_GFX_MAX_REQ_COUNT, s->gfx_max_req_count);
+
+ I915_WRITE(RENDER_HWS_PGA_GEN7, s->render_hwsp);
+ I915_WRITE(GAM_ECOCHK, s->ecochk);
+diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
+index 0ab77f319cef..23329b48766f 100644
+--- a/drivers/gpu/drm/i915/i915_irq.c
++++ b/drivers/gpu/drm/i915/i915_irq.c
+@@ -3998,14 +3998,12 @@ static int i8xx_irq_postinstall(struct drm_device *dev)
+ ~(I915_DISPLAY_PIPE_A_EVENT_INTERRUPT |
+ I915_DISPLAY_PIPE_B_EVENT_INTERRUPT |
+ I915_DISPLAY_PLANE_A_FLIP_PENDING_INTERRUPT |
+- I915_DISPLAY_PLANE_B_FLIP_PENDING_INTERRUPT |
+- I915_RENDER_COMMAND_PARSER_ERROR_INTERRUPT);
++ I915_DISPLAY_PLANE_B_FLIP_PENDING_INTERRUPT);
+ I915_WRITE16(IMR, dev_priv->irq_mask);
+
+ I915_WRITE16(IER,
+ I915_DISPLAY_PIPE_A_EVENT_INTERRUPT |
+ I915_DISPLAY_PIPE_B_EVENT_INTERRUPT |
+- I915_RENDER_COMMAND_PARSER_ERROR_INTERRUPT |
+ I915_USER_INTERRUPT);
+ POSTING_READ16(IER);
+
+@@ -4173,14 +4171,12 @@ static int i915_irq_postinstall(struct drm_device *dev)
+ I915_DISPLAY_PIPE_A_EVENT_INTERRUPT |
+ I915_DISPLAY_PIPE_B_EVENT_INTERRUPT |
+ I915_DISPLAY_PLANE_A_FLIP_PENDING_INTERRUPT |
+- I915_DISPLAY_PLANE_B_FLIP_PENDING_INTERRUPT |
+- I915_RENDER_COMMAND_PARSER_ERROR_INTERRUPT);
++ I915_DISPLAY_PLANE_B_FLIP_PENDING_INTERRUPT);
+
+ enable_mask =
+ I915_ASLE_INTERRUPT |
+ I915_DISPLAY_PIPE_A_EVENT_INTERRUPT |
+ I915_DISPLAY_PIPE_B_EVENT_INTERRUPT |
+- I915_RENDER_COMMAND_PARSER_ERROR_INTERRUPT |
+ I915_USER_INTERRUPT;
+
+ if (I915_HAS_HOTPLUG(dev)) {
+diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
+index 3f1e54bfcddb..e08a4729596b 100644
+--- a/drivers/gpu/drm/i915/i915_reg.h
++++ b/drivers/gpu/drm/i915/i915_reg.h
+@@ -1657,6 +1657,7 @@ enum punit_power_well {
+ #define GMBUS_CYCLE_INDEX (2<<25)
+ #define GMBUS_CYCLE_STOP (4<<25)
+ #define GMBUS_BYTE_COUNT_SHIFT 16
++#define GMBUS_BYTE_COUNT_MAX 256U
+ #define GMBUS_SLAVE_INDEX_SHIFT 8
+ #define GMBUS_SLAVE_ADDR_SHIFT 1
+ #define GMBUS_SLAVE_READ (1<<0)
+diff --git a/drivers/gpu/drm/i915/intel_i2c.c b/drivers/gpu/drm/i915/intel_i2c.c
+index b31088a551f2..56e437e31580 100644
+--- a/drivers/gpu/drm/i915/intel_i2c.c
++++ b/drivers/gpu/drm/i915/intel_i2c.c
+@@ -270,18 +270,17 @@ gmbus_wait_idle(struct drm_i915_private *dev_priv)
+ }
+
+ static int
+-gmbus_xfer_read(struct drm_i915_private *dev_priv, struct i2c_msg *msg,
+- u32 gmbus1_index)
++gmbus_xfer_read_chunk(struct drm_i915_private *dev_priv,
++ unsigned short addr, u8 *buf, unsigned int len,
++ u32 gmbus1_index)
+ {
+ int reg_offset = dev_priv->gpio_mmio_base;
+- u16 len = msg->len;
+- u8 *buf = msg->buf;
+
+ I915_WRITE(GMBUS1 + reg_offset,
+ gmbus1_index |
+ GMBUS_CYCLE_WAIT |
+ (len << GMBUS_BYTE_COUNT_SHIFT) |
+- (msg->addr << GMBUS_SLAVE_ADDR_SHIFT) |
++ (addr << GMBUS_SLAVE_ADDR_SHIFT) |
+ GMBUS_SLAVE_READ | GMBUS_SW_RDY);
+ while (len) {
+ int ret;
+@@ -303,11 +302,35 @@ gmbus_xfer_read(struct drm_i915_private *dev_priv, struct i2c_msg *msg,
+ }
+
+ static int
+-gmbus_xfer_write(struct drm_i915_private *dev_priv, struct i2c_msg *msg)
++gmbus_xfer_read(struct drm_i915_private *dev_priv, struct i2c_msg *msg,
++ u32 gmbus1_index)
+ {
+- int reg_offset = dev_priv->gpio_mmio_base;
+- u16 len = msg->len;
+ u8 *buf = msg->buf;
++ unsigned int rx_size = msg->len;
++ unsigned int len;
++ int ret;
++
++ do {
++ len = min(rx_size, GMBUS_BYTE_COUNT_MAX);
++
++ ret = gmbus_xfer_read_chunk(dev_priv, msg->addr,
++ buf, len, gmbus1_index);
++ if (ret)
++ return ret;
++
++ rx_size -= len;
++ buf += len;
++ } while (rx_size != 0);
++
++ return 0;
++}
++
++static int
++gmbus_xfer_write_chunk(struct drm_i915_private *dev_priv,
++ unsigned short addr, u8 *buf, unsigned int len)
++{
++ int reg_offset = dev_priv->gpio_mmio_base;
++ unsigned int chunk_size = len;
+ u32 val, loop;
+
+ val = loop = 0;
+@@ -319,8 +342,8 @@ gmbus_xfer_write(struct drm_i915_private *dev_priv, struct i2c_msg *msg)
+ I915_WRITE(GMBUS3 + reg_offset, val);
+ I915_WRITE(GMBUS1 + reg_offset,
+ GMBUS_CYCLE_WAIT |
+- (msg->len << GMBUS_BYTE_COUNT_SHIFT) |
+- (msg->addr << GMBUS_SLAVE_ADDR_SHIFT) |
++ (chunk_size << GMBUS_BYTE_COUNT_SHIFT) |
++ (addr << GMBUS_SLAVE_ADDR_SHIFT) |
+ GMBUS_SLAVE_WRITE | GMBUS_SW_RDY);
+ while (len) {
+ int ret;
+@@ -337,6 +360,29 @@ gmbus_xfer_write(struct drm_i915_private *dev_priv, struct i2c_msg *msg)
+ if (ret)
+ return ret;
+ }
++
++ return 0;
++}
++
++static int
++gmbus_xfer_write(struct drm_i915_private *dev_priv, struct i2c_msg *msg)
++{
++ u8 *buf = msg->buf;
++ unsigned int tx_size = msg->len;
++ unsigned int len;
++ int ret;
++
++ do {
++ len = min(tx_size, GMBUS_BYTE_COUNT_MAX);
++
++ ret = gmbus_xfer_write_chunk(dev_priv, msg->addr, buf, len);
++ if (ret)
++ return ret;
++
++ buf += len;
++ tx_size -= len;
++ } while (tx_size != 0);
++
+ return 0;
+ }
+
+diff --git a/drivers/gpu/drm/radeon/atombios_crtc.c b/drivers/gpu/drm/radeon/atombios_crtc.c
+index 9f0e62529c46..5d73e5f3845d 100644
+--- a/drivers/gpu/drm/radeon/atombios_crtc.c
++++ b/drivers/gpu/drm/radeon/atombios_crtc.c
+@@ -330,8 +330,10 @@ atombios_set_crtc_dtd_timing(struct drm_crtc *crtc,
+ misc |= ATOM_COMPOSITESYNC;
+ if (mode->flags & DRM_MODE_FLAG_INTERLACE)
+ misc |= ATOM_INTERLACE;
+- if (mode->flags & DRM_MODE_FLAG_DBLSCAN)
++ if (mode->flags & DRM_MODE_FLAG_DBLCLK)
+ misc |= ATOM_DOUBLE_CLOCK_MODE;
++ if (mode->flags & DRM_MODE_FLAG_DBLSCAN)
++ misc |= ATOM_H_REPLICATIONBY2 | ATOM_V_REPLICATIONBY2;
+
+ args.susModeMiscInfo.usAccess = cpu_to_le16(misc);
+ args.ucCRTC = radeon_crtc->crtc_id;
+@@ -374,8 +376,10 @@ static void atombios_crtc_set_timing(struct drm_crtc *crtc,
+ misc |= ATOM_COMPOSITESYNC;
+ if (mode->flags & DRM_MODE_FLAG_INTERLACE)
+ misc |= ATOM_INTERLACE;
+- if (mode->flags & DRM_MODE_FLAG_DBLSCAN)
++ if (mode->flags & DRM_MODE_FLAG_DBLCLK)
+ misc |= ATOM_DOUBLE_CLOCK_MODE;
++ if (mode->flags & DRM_MODE_FLAG_DBLSCAN)
++ misc |= ATOM_H_REPLICATIONBY2 | ATOM_V_REPLICATIONBY2;
+
+ args.susModeMiscInfo.usAccess = cpu_to_le16(misc);
+ args.ucCRTC = radeon_crtc->crtc_id;
+@@ -576,6 +580,9 @@ static u32 atombios_adjust_pll(struct drm_crtc *crtc,
+ else
+ radeon_crtc->pll_flags |= RADEON_PLL_PREFER_LOW_REF_DIV;
+
++ /* if there is no audio, set MINM_OVER_MAXP */
++ if (!drm_detect_monitor_audio(radeon_connector_edid(connector)))
++ radeon_crtc->pll_flags |= RADEON_PLL_PREFER_MINM_OVER_MAXP;
+ if (rdev->family < CHIP_RV770)
+ radeon_crtc->pll_flags |= RADEON_PLL_PREFER_MINM_OVER_MAXP;
+ /* use frac fb div on APUs */
+diff --git a/drivers/gpu/drm/radeon/radeon_vm.c b/drivers/gpu/drm/radeon/radeon_vm.c
+index afbdf9e685d1..2ab80a5331a4 100644
+--- a/drivers/gpu/drm/radeon/radeon_vm.c
++++ b/drivers/gpu/drm/radeon/radeon_vm.c
+@@ -481,6 +481,23 @@ int radeon_vm_bo_set_addr(struct radeon_device *rdev,
+ }
+
+ mutex_lock(&vm->mutex);
++ soffset /= RADEON_GPU_PAGE_SIZE;
++ eoffset /= RADEON_GPU_PAGE_SIZE;
++ if (soffset || eoffset) {
++ struct interval_tree_node *it;
++ it = interval_tree_iter_first(&vm->va, soffset, eoffset - 1);
++ if (it && it != &bo_va->it) {
++ struct radeon_bo_va *tmp;
++ tmp = container_of(it, struct radeon_bo_va, it);
++ /* bo and tmp overlap, invalid offset */
++ dev_err(rdev->dev, "bo %p va 0x%010Lx conflict with "
++ "(bo %p 0x%010lx 0x%010lx)\n", bo_va->bo,
++ soffset, tmp->bo, tmp->it.start, tmp->it.last);
++ mutex_unlock(&vm->mutex);
++ return -EINVAL;
++ }
++ }
++
+ if (bo_va->it.start || bo_va->it.last) {
+ if (bo_va->addr) {
+ /* add a clone of the bo_va to clear the old address */
+@@ -503,21 +520,7 @@ int radeon_vm_bo_set_addr(struct radeon_device *rdev,
+ bo_va->it.last = 0;
+ }
+
+- soffset /= RADEON_GPU_PAGE_SIZE;
+- eoffset /= RADEON_GPU_PAGE_SIZE;
+ if (soffset || eoffset) {
+- struct interval_tree_node *it;
+- it = interval_tree_iter_first(&vm->va, soffset, eoffset - 1);
+- if (it) {
+- struct radeon_bo_va *tmp;
+- tmp = container_of(it, struct radeon_bo_va, it);
+- /* bo and tmp overlap, invalid offset */
+- dev_err(rdev->dev, "bo %p va 0x%010Lx conflict with "
+- "(bo %p 0x%010lx 0x%010lx)\n", bo_va->bo,
+- soffset, tmp->bo, tmp->it.start, tmp->it.last);
+- mutex_unlock(&vm->mutex);
+- return -EINVAL;
+- }
+ bo_va->it.start = soffset;
+ bo_va->it.last = eoffset - 1;
+ interval_tree_insert(&bo_va->it, &vm->va);
+diff --git a/drivers/gpu/drm/radeon/si_dpm.c b/drivers/gpu/drm/radeon/si_dpm.c
+index 2b70d3eca8fd..534edaa77940 100644
+--- a/drivers/gpu/drm/radeon/si_dpm.c
++++ b/drivers/gpu/drm/radeon/si_dpm.c
+@@ -2921,6 +2921,7 @@ struct si_dpm_quirk {
+ static struct si_dpm_quirk si_dpm_quirk_list[] = {
+ /* PITCAIRN - https://bugs.freedesktop.org/show_bug.cgi?id=76490 */
+ { PCI_VENDOR_ID_ATI, 0x6810, 0x1462, 0x3036, 0, 120000 },
++ { PCI_VENDOR_ID_ATI, 0x6811, 0x174b, 0xe271, 0, 120000 },
+ { 0, 0, 0, 0 },
+ };
+
+diff --git a/drivers/hv/channel.c b/drivers/hv/channel.c
+index 433f72a1c006..995e2a0cf096 100644
+--- a/drivers/hv/channel.c
++++ b/drivers/hv/channel.c
+@@ -135,7 +135,7 @@ int vmbus_open(struct vmbus_channel *newchannel, u32 send_ringbuffer_size,
+ GFP_KERNEL);
+ if (!open_info) {
+ err = -ENOMEM;
+- goto error0;
++ goto error_gpadl;
+ }
+
+ init_completion(&open_info->waitevent);
+@@ -151,7 +151,7 @@ int vmbus_open(struct vmbus_channel *newchannel, u32 send_ringbuffer_size,
+
+ if (userdatalen > MAX_USER_DEFINED_BYTES) {
+ err = -EINVAL;
+- goto error0;
++ goto error_gpadl;
+ }
+
+ if (userdatalen)
+@@ -195,6 +195,9 @@ error1:
+ list_del(&open_info->msglistentry);
+ spin_unlock_irqrestore(&vmbus_connection.channelmsg_lock, flags);
+
++error_gpadl:
++ vmbus_teardown_gpadl(newchannel, newchannel->ringbuffer_gpadlhandle);
++
+ error0:
+ free_pages((unsigned long)out,
+ get_order(send_ringbuffer_size + recv_ringbuffer_size));
+diff --git a/drivers/hv/channel_mgmt.c b/drivers/hv/channel_mgmt.c
+index d36ce6835fb7..08b58defdb95 100644
+--- a/drivers/hv/channel_mgmt.c
++++ b/drivers/hv/channel_mgmt.c
+@@ -767,7 +767,7 @@ int vmbus_request_offers(void)
+ {
+ struct vmbus_channel_message_header *msg;
+ struct vmbus_channel_msginfo *msginfo;
+- int ret, t;
++ int ret;
+
+ msginfo = kmalloc(sizeof(*msginfo) +
+ sizeof(struct vmbus_channel_message_header),
+@@ -775,8 +775,6 @@ int vmbus_request_offers(void)
+ if (!msginfo)
+ return -ENOMEM;
+
+- init_completion(&msginfo->waitevent);
+-
+ msg = (struct vmbus_channel_message_header *)msginfo->msg;
+
+ msg->msgtype = CHANNELMSG_REQUESTOFFERS;
+@@ -790,14 +788,6 @@ int vmbus_request_offers(void)
+ goto cleanup;
+ }
+
+- t = wait_for_completion_timeout(&msginfo->waitevent, 5*HZ);
+- if (t == 0) {
+- ret = -ETIMEDOUT;
+- goto cleanup;
+- }
+-
+-
+-
+ cleanup:
+ kfree(msginfo);
+
+diff --git a/drivers/i2c/busses/i2c-rk3x.c b/drivers/i2c/busses/i2c-rk3x.c
+index f486d0eac4d0..3ba933396c25 100644
+--- a/drivers/i2c/busses/i2c-rk3x.c
++++ b/drivers/i2c/busses/i2c-rk3x.c
+@@ -588,7 +588,7 @@ static int rk3x_i2c_xfer(struct i2c_adapter *adap,
+ clk_disable(i2c->clk);
+ spin_unlock_irqrestore(&i2c->lock, flags);
+
+- return ret;
++ return ret < 0 ? ret : num;
+ }
+
+ static u32 rk3x_i2c_func(struct i2c_adapter *adap)
+diff --git a/drivers/i2c/i2c-core.c b/drivers/i2c/i2c-core.c
+index 17a1853c6c2f..7bd1b5cfb8d1 100644
+--- a/drivers/i2c/i2c-core.c
++++ b/drivers/i2c/i2c-core.c
+@@ -593,6 +593,7 @@ int i2c_generic_scl_recovery(struct i2c_adapter *adap)
+ adap->bus_recovery_info->set_scl(adap, 1);
+ return i2c_generic_recovery(adap);
+ }
++EXPORT_SYMBOL_GPL(i2c_generic_scl_recovery);
+
+ int i2c_generic_gpio_recovery(struct i2c_adapter *adap)
+ {
+@@ -607,6 +608,7 @@ int i2c_generic_gpio_recovery(struct i2c_adapter *adap)
+
+ return ret;
+ }
++EXPORT_SYMBOL_GPL(i2c_generic_gpio_recovery);
+
+ int i2c_recover_bus(struct i2c_adapter *adap)
+ {
+@@ -616,6 +618,7 @@ int i2c_recover_bus(struct i2c_adapter *adap)
+ dev_dbg(&adap->dev, "Trying i2c bus recovery\n");
+ return adap->bus_recovery_info->recover_bus(adap);
+ }
++EXPORT_SYMBOL_GPL(i2c_recover_bus);
+
+ static int i2c_device_probe(struct device *dev)
+ {
+diff --git a/drivers/infiniband/core/umem.c b/drivers/infiniband/core/umem.c
+index dfa4286f98a4..49df6af0f03f 100644
+--- a/drivers/infiniband/core/umem.c
++++ b/drivers/infiniband/core/umem.c
+@@ -94,12 +94,15 @@ struct ib_umem *ib_umem_get(struct ib_ucontext *context, unsigned long addr,
+ if (dmasync)
+ dma_set_attr(DMA_ATTR_WRITE_BARRIER, &attrs);
+
++ if (!size)
++ return ERR_PTR(-EINVAL);
++
+ /*
+ * If the combination of the addr and size requested for this memory
+ * region causes an integer overflow, return error.
+ */
+- if ((PAGE_ALIGN(addr + size) <= size) ||
+- (PAGE_ALIGN(addr + size) <= addr))
++ if (((addr + size) < addr) ||
++ PAGE_ALIGN(addr + size) < (addr + size))
+ return ERR_PTR(-EINVAL);
+
+ if (!can_do_mlock())
+diff --git a/drivers/infiniband/hw/mlx4/qp.c b/drivers/infiniband/hw/mlx4/qp.c
+index 03045dd9e5de..33cbb7611d66 100644
+--- a/drivers/infiniband/hw/mlx4/qp.c
++++ b/drivers/infiniband/hw/mlx4/qp.c
+@@ -2559,8 +2559,7 @@ static int build_lso_seg(struct mlx4_wqe_lso_seg *wqe, struct ib_send_wr *wr,
+
+ memcpy(wqe->header, wr->wr.ud.header, wr->wr.ud.hlen);
+
+- *lso_hdr_sz = cpu_to_be32((wr->wr.ud.mss - wr->wr.ud.hlen) << 16 |
+- wr->wr.ud.hlen);
++ *lso_hdr_sz = cpu_to_be32(wr->wr.ud.mss << 16 | wr->wr.ud.hlen);
+ *lso_seg_len = halign;
+ return 0;
+ }
+diff --git a/drivers/infiniband/ulp/iser/iser_initiator.c b/drivers/infiniband/ulp/iser/iser_initiator.c
+index 20e859a6f1a6..76eb57b31a59 100644
+--- a/drivers/infiniband/ulp/iser/iser_initiator.c
++++ b/drivers/infiniband/ulp/iser/iser_initiator.c
+@@ -409,8 +409,8 @@ int iser_send_command(struct iscsi_conn *conn,
+ if (scsi_prot_sg_count(sc)) {
+ prot_buf->buf = scsi_prot_sglist(sc);
+ prot_buf->size = scsi_prot_sg_count(sc);
+- prot_buf->data_len = data_buf->data_len >>
+- ilog2(sc->device->sector_size) * 8;
++ prot_buf->data_len = (data_buf->data_len >>
++ ilog2(sc->device->sector_size)) * 8;
+ }
+
+ if (hdr->flags & ISCSI_FLAG_CMD_READ) {
+diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c
+index a6daabc70425..0618e407197d 100644
+--- a/drivers/infiniband/ulp/isert/ib_isert.c
++++ b/drivers/infiniband/ulp/isert/ib_isert.c
+@@ -1900,11 +1900,13 @@ isert_completion_rdma_read(struct iser_tx_desc *tx_desc,
+ cmd->i_state = ISTATE_RECEIVED_LAST_DATAOUT;
+ spin_unlock_bh(&cmd->istate_lock);
+
+- if (ret)
++ if (ret) {
++ target_put_sess_cmd(se_cmd->se_sess, se_cmd);
+ transport_send_check_condition_and_sense(se_cmd,
+ se_cmd->pi_err, 0);
+- else
++ } else {
+ target_execute_cmd(se_cmd);
++ }
+ }
+
+ static void
+diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c
+index 6e22682c8255..991dc6b20a58 100644
+--- a/drivers/input/mouse/elantech.c
++++ b/drivers/input/mouse/elantech.c
+@@ -893,6 +893,21 @@ static psmouse_ret_t elantech_process_byte(struct psmouse *psmouse)
+ }
+
+ /*
++ * This writes the reg_07 value again to the hardware at the end of every
++ * set_rate call because the register loses its value. reg_07 allows setting
++ * absolute mode on v4 hardware
++ */
++static void elantech_set_rate_restore_reg_07(struct psmouse *psmouse,
++ unsigned int rate)
++{
++ struct elantech_data *etd = psmouse->private;
++
++ etd->original_set_rate(psmouse, rate);
++ if (elantech_write_reg(psmouse, 0x07, etd->reg_07))
++ psmouse_err(psmouse, "restoring reg_07 failed\n");
++}
++
++/*
+ * Put the touchpad into absolute mode
+ */
+ static int elantech_set_absolute_mode(struct psmouse *psmouse)
+@@ -1094,6 +1109,8 @@ static int elantech_get_resolution_v4(struct psmouse *psmouse,
+ * Asus K53SV 0x450f01 78, 15, 0c 2 hw buttons
+ * Asus G46VW 0x460f02 00, 18, 0c 2 hw buttons
+ * Asus G750JX 0x360f00 00, 16, 0c 2 hw buttons
++ * Asus TP500LN 0x381f17 10, 14, 0e clickpad
++ * Asus X750JN 0x381f17 10, 14, 0e clickpad
+ * Asus UX31 0x361f00 20, 15, 0e clickpad
+ * Asus UX32VD 0x361f02 00, 15, 0e clickpad
+ * Avatar AVIU-145A2 0x361f00 ? clickpad
+@@ -1635,6 +1652,11 @@ int elantech_init(struct psmouse *psmouse)
+ goto init_fail;
+ }
+
++ if (etd->fw_version == 0x381f17) {
++ etd->original_set_rate = psmouse->set_rate;
++ psmouse->set_rate = elantech_set_rate_restore_reg_07;
++ }
++
+ if (elantech_set_input_params(psmouse)) {
+ psmouse_err(psmouse, "failed to query touchpad range.\n");
+ goto init_fail;
+diff --git a/drivers/input/mouse/elantech.h b/drivers/input/mouse/elantech.h
+index 6f3afec02f03..f965d1569cc3 100644
+--- a/drivers/input/mouse/elantech.h
++++ b/drivers/input/mouse/elantech.h
+@@ -142,6 +142,7 @@ struct elantech_data {
+ struct finger_pos mt[ETP_MAX_FINGERS];
+ unsigned char parity[256];
+ int (*send_cmd)(struct psmouse *psmouse, unsigned char c, unsigned char *param);
++ void (*original_set_rate)(struct psmouse *psmouse, unsigned int rate);
+ };
+
+ #ifdef CONFIG_MOUSE_PS2_ELANTECH
+diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c
+index 08981be7baa1..a9f2266049af 100644
+--- a/drivers/md/dm-crypt.c
++++ b/drivers/md/dm-crypt.c
+@@ -920,11 +920,10 @@ static int crypt_convert(struct crypt_config *cc,
+
+ switch (r) {
+ /* async */
++ case -EINPROGRESS:
+ case -EBUSY:
+ wait_for_completion(&ctx->restart);
+ reinit_completion(&ctx->restart);
+- /* fall through*/
+- case -EINPROGRESS:
+ ctx->req = NULL;
+ ctx->cc_sector++;
+ continue;
+@@ -1315,10 +1314,8 @@ static void kcryptd_async_done(struct crypto_async_request *async_req,
+ struct dm_crypt_io *io = container_of(ctx, struct dm_crypt_io, ctx);
+ struct crypt_config *cc = io->cc;
+
+- if (error == -EINPROGRESS) {
+- complete(&ctx->restart);
++ if (error == -EINPROGRESS)
+ return;
+- }
+
+ if (!error && cc->iv_gen_ops && cc->iv_gen_ops->post)
+ error = cc->iv_gen_ops->post(cc, iv_of_dmreq(cc, dmreq), dmreq);
+@@ -1329,12 +1326,15 @@ static void kcryptd_async_done(struct crypto_async_request *async_req,
+ crypt_free_req(cc, req_of_dmreq(cc, dmreq), io->base_bio);
+
+ if (!atomic_dec_and_test(&ctx->cc_pending))
+- return;
++ goto done;
+
+ if (bio_data_dir(io->base_bio) == READ)
+ kcryptd_crypt_read_done(io);
+ else
+ kcryptd_crypt_write_io_submit(io, 1);
++done:
++ if (!completion_done(&ctx->restart))
++ complete(&ctx->restart);
+ }
+
+ static void kcryptd_crypt(struct work_struct *work)
+diff --git a/drivers/md/raid0.c b/drivers/md/raid0.c
+index ba6b85de96d2..d5c12e5b6125 100644
+--- a/drivers/md/raid0.c
++++ b/drivers/md/raid0.c
+@@ -319,7 +319,7 @@ static struct strip_zone *find_zone(struct r0conf *conf,
+
+ /*
+ * remaps the bio to the target device. we separate two flows.
+- * power 2 flow and a general flow for the sake of perfromance
++ * power 2 flow and a general flow for the sake of performance
+ */
+ static struct md_rdev *map_sector(struct mddev *mddev, struct strip_zone *zone,
+ sector_t sector, sector_t *sector_offset)
+@@ -537,6 +537,7 @@ static void raid0_make_request(struct mddev *mddev, struct bio *bio)
+ split = bio;
+ }
+
++ sector = bio->bi_iter.bi_sector;
+ zone = find_zone(mddev->private, §or);
+ tmp_dev = map_sector(mddev, zone, sector, §or);
+ split->bi_bdev = tmp_dev->bdev;
+diff --git a/drivers/media/rc/img-ir/img-ir-core.c b/drivers/media/rc/img-ir/img-ir-core.c
+index a0cac2f09109..9971dda621f5 100644
+--- a/drivers/media/rc/img-ir/img-ir-core.c
++++ b/drivers/media/rc/img-ir/img-ir-core.c
+@@ -146,7 +146,7 @@ static int img_ir_remove(struct platform_device *pdev)
+ {
+ struct img_ir_priv *priv = platform_get_drvdata(pdev);
+
+- free_irq(priv->irq, img_ir_isr);
++ free_irq(priv->irq, priv);
+ img_ir_remove_hw(priv);
+ img_ir_remove_raw(priv);
+
+diff --git a/drivers/media/usb/stk1160/stk1160-v4l.c b/drivers/media/usb/stk1160/stk1160-v4l.c
+index 233054311a62..f6d0334f246e 100644
+--- a/drivers/media/usb/stk1160/stk1160-v4l.c
++++ b/drivers/media/usb/stk1160/stk1160-v4l.c
+@@ -244,6 +244,11 @@ static int stk1160_stop_streaming(struct stk1160 *dev)
+ if (mutex_lock_interruptible(&dev->v4l_lock))
+ return -ERESTARTSYS;
+
++ /*
++ * Once URBs are cancelled, the URB complete handler
++ * won't be running. This is required to safely release the
++ * current buffer (dev->isoc_ctl.buf).
++ */
+ stk1160_cancel_isoc(dev);
+
+ /*
+@@ -624,8 +629,16 @@ void stk1160_clear_queue(struct stk1160 *dev)
+ stk1160_info("buffer [%p/%d] aborted\n",
+ buf, buf->vb.v4l2_buf.index);
+ }
+- /* It's important to clear current buffer */
+- dev->isoc_ctl.buf = NULL;
++
++ /* It's important to release the current buffer */
++ if (dev->isoc_ctl.buf) {
++ buf = dev->isoc_ctl.buf;
++ dev->isoc_ctl.buf = NULL;
++
++ vb2_buffer_done(&buf->vb, VB2_BUF_STATE_ERROR);
++ stk1160_info("buffer [%p/%d] aborted\n",
++ buf, buf->vb.v4l2_buf.index);
++ }
+ spin_unlock_irqrestore(&dev->buf_lock, flags);
+ }
+
+diff --git a/drivers/memstick/core/mspro_block.c b/drivers/memstick/core/mspro_block.c
+index fc145d202c46..922a750640e8 100644
+--- a/drivers/memstick/core/mspro_block.c
++++ b/drivers/memstick/core/mspro_block.c
+@@ -758,7 +758,7 @@ static int mspro_block_complete_req(struct memstick_dev *card, int error)
+
+ if (error || (card->current_mrq.tpc == MSPRO_CMD_STOP)) {
+ if (msb->data_dir == READ) {
+- for (cnt = 0; cnt < msb->current_seg; cnt++)
++ for (cnt = 0; cnt < msb->current_seg; cnt++) {
+ t_len += msb->req_sg[cnt].length
+ / msb->page_size;
+
+@@ -766,6 +766,7 @@ static int mspro_block_complete_req(struct memstick_dev *card, int error)
+ t_len += msb->current_page - 1;
+
+ t_len *= msb->page_size;
++ }
+ }
+ } else
+ t_len = blk_rq_bytes(msb->block_req);
+diff --git a/drivers/mmc/host/sunxi-mmc.c b/drivers/mmc/host/sunxi-mmc.c
+index d1663b3c4143..aac659bdd08a 100644
+--- a/drivers/mmc/host/sunxi-mmc.c
++++ b/drivers/mmc/host/sunxi-mmc.c
+@@ -909,7 +909,9 @@ static int sunxi_mmc_resource_request(struct sunxi_mmc_host *host,
+ return PTR_ERR(host->clk_mmc);
+ }
+
+- host->reset = devm_reset_control_get(&pdev->dev, "ahb");
++ host->reset = devm_reset_control_get_optional(&pdev->dev, "ahb");
++ if (PTR_ERR(host->reset) == -EPROBE_DEFER)
++ return PTR_ERR(host->reset);
+
+ ret = clk_prepare_enable(host->clk_ahb);
+ if (ret) {
+diff --git a/drivers/mtd/ubi/attach.c b/drivers/mtd/ubi/attach.c
+index 6f27d9a1be3b..21841fe25ad3 100644
+--- a/drivers/mtd/ubi/attach.c
++++ b/drivers/mtd/ubi/attach.c
+@@ -408,7 +408,7 @@ int ubi_compare_lebs(struct ubi_device *ubi, const struct ubi_ainf_peb *aeb,
+ second_is_newer = !second_is_newer;
+ } else {
+ dbg_bld("PEB %d CRC is OK", pnum);
+- bitflips = !!err;
++ bitflips |= !!err;
+ }
+ mutex_unlock(&ubi->buf_mutex);
+
+diff --git a/drivers/mtd/ubi/cdev.c b/drivers/mtd/ubi/cdev.c
+index 59de69a24e40..3946d78e6a81 100644
+--- a/drivers/mtd/ubi/cdev.c
++++ b/drivers/mtd/ubi/cdev.c
+@@ -453,7 +453,7 @@ static long vol_cdev_ioctl(struct file *file, unsigned int cmd,
+ /* Validate the request */
+ err = -EINVAL;
+ if (req.lnum < 0 || req.lnum >= vol->reserved_pebs ||
+- req.bytes < 0 || req.lnum >= vol->usable_leb_size)
++ req.bytes < 0 || req.bytes > vol->usable_leb_size)
+ break;
+
+ err = get_exclusive(desc);
+diff --git a/drivers/mtd/ubi/eba.c b/drivers/mtd/ubi/eba.c
+index 2402d3b50171..493f7b3dbc33 100644
+--- a/drivers/mtd/ubi/eba.c
++++ b/drivers/mtd/ubi/eba.c
+@@ -1361,7 +1361,8 @@ int ubi_eba_init(struct ubi_device *ubi, struct ubi_attach_info *ai)
+ * during re-size.
+ */
+ ubi_move_aeb_to_list(av, aeb, &ai->erase);
+- vol->eba_tbl[aeb->lnum] = aeb->pnum;
++ else
++ vol->eba_tbl[aeb->lnum] = aeb->pnum;
+ }
+ }
+
+diff --git a/drivers/mtd/ubi/wl.c b/drivers/mtd/ubi/wl.c
+index b9686c1472d2..ef670560971e 100644
+--- a/drivers/mtd/ubi/wl.c
++++ b/drivers/mtd/ubi/wl.c
+@@ -1001,7 +1001,7 @@ static int wear_leveling_worker(struct ubi_device *ubi, struct ubi_work *wrk,
+ int shutdown)
+ {
+ int err, scrubbing = 0, torture = 0, protect = 0, erroneous = 0;
+- int vol_id = -1, uninitialized_var(lnum);
++ int vol_id = -1, lnum = -1;
+ #ifdef CONFIG_MTD_UBI_FASTMAP
+ int anchor = wrk->anchor;
+ #endif
+diff --git a/drivers/net/ethernet/intel/e1000/e1000_main.c b/drivers/net/ethernet/intel/e1000/e1000_main.c
+index 24f3986cfae2..3a06cae4ff68 100644
+--- a/drivers/net/ethernet/intel/e1000/e1000_main.c
++++ b/drivers/net/ethernet/intel/e1000/e1000_main.c
+@@ -144,6 +144,11 @@ static bool e1000_clean_rx_irq(struct e1000_adapter *adapter,
+ static bool e1000_clean_jumbo_rx_irq(struct e1000_adapter *adapter,
+ struct e1000_rx_ring *rx_ring,
+ int *work_done, int work_to_do);
++static void e1000_alloc_dummy_rx_buffers(struct e1000_adapter *adapter,
++ struct e1000_rx_ring *rx_ring,
++ int cleaned_count)
++{
++}
+ static void e1000_alloc_rx_buffers(struct e1000_adapter *adapter,
+ struct e1000_rx_ring *rx_ring,
+ int cleaned_count);
+@@ -3552,8 +3557,11 @@ static int e1000_change_mtu(struct net_device *netdev, int new_mtu)
+ msleep(1);
+ /* e1000_down has a dependency on max_frame_size */
+ hw->max_frame_size = max_frame;
+- if (netif_running(netdev))
++ if (netif_running(netdev)) {
++ /* prevent buffers from being reallocated */
++ adapter->alloc_rx_buf = e1000_alloc_dummy_rx_buffers;
+ e1000_down(adapter);
++ }
+
+ /* NOTE: netdev_alloc_skb reserves 16 bytes, and typically NET_IP_ALIGN
+ * means we reserve 2 more, this pushes us to allocate from the next
+diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+index 0207044f6d57..68fef1151dde 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
++++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+@@ -1466,6 +1466,7 @@ static void mlx4_en_service_task(struct work_struct *work)
+ if (mdev->dev->caps.flags2 & MLX4_DEV_CAP_FLAG2_TS)
+ mlx4_en_ptp_overflow_check(mdev);
+
++ mlx4_en_recover_from_oom(priv);
+ queue_delayed_work(mdev->workqueue, &priv->service_task,
+ SERVICE_TASK_DELAY);
+ }
+diff --git a/drivers/net/ethernet/mellanox/mlx4/en_rx.c b/drivers/net/ethernet/mellanox/mlx4/en_rx.c
+index 01660c595f5c..5bbb59dce4d5 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/en_rx.c
++++ b/drivers/net/ethernet/mellanox/mlx4/en_rx.c
+@@ -237,6 +237,12 @@ static int mlx4_en_prepare_rx_desc(struct mlx4_en_priv *priv,
+ return mlx4_en_alloc_frags(priv, rx_desc, frags, ring->page_alloc, gfp);
+ }
+
++static inline bool mlx4_en_is_ring_empty(struct mlx4_en_rx_ring *ring)
++{
++ BUG_ON((u32)(ring->prod - ring->cons) > ring->actual_size);
++ return ring->prod == ring->cons;
++}
++
+ static inline void mlx4_en_update_rx_prod_db(struct mlx4_en_rx_ring *ring)
+ {
+ *ring->wqres.db.db = cpu_to_be32(ring->prod & 0xffff);
+@@ -308,8 +314,7 @@ static void mlx4_en_free_rx_buf(struct mlx4_en_priv *priv,
+ ring->cons, ring->prod);
+
+ /* Unmap and free Rx buffers */
+- BUG_ON((u32) (ring->prod - ring->cons) > ring->actual_size);
+- while (ring->cons != ring->prod) {
++ while (!mlx4_en_is_ring_empty(ring)) {
+ index = ring->cons & ring->size_mask;
+ en_dbg(DRV, priv, "Processing descriptor:%d\n", index);
+ mlx4_en_free_rx_desc(priv, ring, index);
+@@ -484,6 +489,23 @@ err_allocator:
+ return err;
+ }
+
++/* We recover from out of memory by scheduling our napi poll
++ * function (mlx4_en_process_cq), which tries to allocate
++ * all missing RX buffers (call to mlx4_en_refill_rx_buffers).
++ */
++void mlx4_en_recover_from_oom(struct mlx4_en_priv *priv)
++{
++ int ring;
++
++ if (!priv->port_up)
++ return;
++
++ for (ring = 0; ring < priv->rx_ring_num; ring++) {
++ if (mlx4_en_is_ring_empty(priv->rx_ring[ring]))
++ napi_reschedule(&priv->rx_cq[ring]->napi);
++ }
++}
++
+ void mlx4_en_destroy_rx_ring(struct mlx4_en_priv *priv,
+ struct mlx4_en_rx_ring **pring,
+ u32 size, u16 stride)
+diff --git a/drivers/net/ethernet/mellanox/mlx4/en_tx.c b/drivers/net/ethernet/mellanox/mlx4/en_tx.c
+index 11ff28b5fca3..142ddd595e2e 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/en_tx.c
++++ b/drivers/net/ethernet/mellanox/mlx4/en_tx.c
+@@ -137,8 +137,10 @@ int mlx4_en_create_tx_ring(struct mlx4_en_priv *priv,
+ ring->hwtstamp_tx_type = priv->hwtstamp_config.tx_type;
+ ring->queue_index = queue_index;
+
+- if (queue_index < priv->num_tx_rings_p_up && cpu_online(queue_index))
+- cpumask_set_cpu(queue_index, &ring->affinity_mask);
++ if (queue_index < priv->num_tx_rings_p_up)
++ cpumask_set_cpu_local_first(queue_index,
++ priv->mdev->dev->numa_node,
++ &ring->affinity_mask);
+
+ *pring = ring;
+ return 0;
+@@ -205,7 +207,7 @@ int mlx4_en_activate_tx_ring(struct mlx4_en_priv *priv,
+
+ err = mlx4_qp_to_ready(mdev->dev, &ring->wqres.mtt, &ring->context,
+ &ring->qp, &ring->qp_state);
+- if (!user_prio && cpu_online(ring->queue_index))
++ if (!cpumask_empty(&ring->affinity_mask))
+ netif_set_xps_queue(priv->dev, &ring->affinity_mask,
+ ring->queue_index);
+
+diff --git a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
+index 8fef65840b3b..692bd4e8b21f 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
++++ b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
+@@ -779,6 +779,7 @@ int mlx4_en_activate_tx_ring(struct mlx4_en_priv *priv,
+ void mlx4_en_deactivate_tx_ring(struct mlx4_en_priv *priv,
+ struct mlx4_en_tx_ring *ring);
+ void mlx4_en_set_num_rx_rings(struct mlx4_en_dev *mdev);
++void mlx4_en_recover_from_oom(struct mlx4_en_priv *priv);
+ int mlx4_en_create_rx_ring(struct mlx4_en_priv *priv,
+ struct mlx4_en_rx_ring **pring,
+ u32 size, u16 stride, int node);
+diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c
+index 794a47329368..6d6c20c3ef7e 100644
+--- a/drivers/net/ppp/ppp_generic.c
++++ b/drivers/net/ppp/ppp_generic.c
+@@ -1714,6 +1714,7 @@ ppp_receive_frame(struct ppp *ppp, struct sk_buff *skb, struct channel *pch)
+ {
+ /* note: a 0-length skb is used as an error indication */
+ if (skb->len > 0) {
++ skb_checksum_complete_unset(skb);
+ #ifdef CONFIG_PPP_MULTILINK
+ /* XXX do channel-level decompression here */
+ if (PPP_PROTO(skb) == PPP_MP)
+diff --git a/drivers/net/wireless/rtlwifi/pci.c b/drivers/net/wireless/rtlwifi/pci.c
+index a5186bb7c63e..8c45cf44ce24 100644
+--- a/drivers/net/wireless/rtlwifi/pci.c
++++ b/drivers/net/wireless/rtlwifi/pci.c
+@@ -578,6 +578,13 @@ static void _rtl_pci_tx_isr(struct ieee80211_hw *hw, int prio)
+ else
+ entry = (u8 *)(&ring->desc[ring->idx]);
+
++ if (rtlpriv->cfg->ops->get_available_desc &&
++ rtlpriv->cfg->ops->get_available_desc(hw, prio) <= 1) {
++ RT_TRACE(rtlpriv, (COMP_INTR | COMP_SEND), DBG_DMESG,
++ "no available desc!\n");
++ return;
++ }
++
+ if (!rtlpriv->cfg->ops->is_tx_desc_closed(hw, prio, ring->idx))
+ return;
+ ring->idx = (ring->idx + 1) % ring->entries;
+@@ -641,10 +648,9 @@ static void _rtl_pci_tx_isr(struct ieee80211_hw *hw, int prio)
+
+ ieee80211_tx_status_irqsafe(hw, skb);
+
+- if ((ring->entries - skb_queue_len(&ring->queue))
+- == 2) {
++ if ((ring->entries - skb_queue_len(&ring->queue)) <= 4) {
+
+- RT_TRACE(rtlpriv, COMP_ERR, DBG_LOUD,
++ RT_TRACE(rtlpriv, COMP_ERR, DBG_DMESG,
+ "more desc left, wake skb_queue@%d, ring->idx = %d, skb_queue_len = 0x%x\n",
+ prio, ring->idx,
+ skb_queue_len(&ring->queue));
+@@ -793,7 +799,7 @@ static void _rtl_pci_rx_interrupt(struct ieee80211_hw *hw)
+ rx_remained_cnt =
+ rtlpriv->cfg->ops->rx_desc_buff_remained_cnt(hw,
+ hw_queue);
+- if (rx_remained_cnt < 1)
++ if (rx_remained_cnt == 0)
+ return;
+
+ } else { /* rx descriptor */
+@@ -845,18 +851,18 @@ static void _rtl_pci_rx_interrupt(struct ieee80211_hw *hw)
+ else
+ skb_reserve(skb, stats.rx_drvinfo_size +
+ stats.rx_bufshift);
+-
+ } else {
+ RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING,
+ "skb->end - skb->tail = %d, len is %d\n",
+ skb->end - skb->tail, len);
+- break;
++ dev_kfree_skb_any(skb);
++ goto new_trx_end;
+ }
+ /* handle command packet here */
+ if (rtlpriv->cfg->ops->rx_command_packet &&
+ rtlpriv->cfg->ops->rx_command_packet(hw, stats, skb)) {
+ dev_kfree_skb_any(skb);
+- goto end;
++ goto new_trx_end;
+ }
+
+ /*
+@@ -906,6 +912,7 @@ static void _rtl_pci_rx_interrupt(struct ieee80211_hw *hw)
+ } else {
+ dev_kfree_skb_any(skb);
+ }
++new_trx_end:
+ if (rtlpriv->use_new_trx_flow) {
+ rtlpci->rx_ring[hw_queue].next_rx_rp += 1;
+ rtlpci->rx_ring[hw_queue].next_rx_rp %=
+@@ -921,7 +928,6 @@ static void _rtl_pci_rx_interrupt(struct ieee80211_hw *hw)
+ rtlpriv->enter_ps = false;
+ schedule_work(&rtlpriv->works.lps_change_work);
+ }
+-end:
+ skb = new_skb;
+ no_new:
+ if (rtlpriv->use_new_trx_flow) {
+@@ -1695,6 +1701,15 @@ static int rtl_pci_tx(struct ieee80211_hw *hw,
+ }
+ }
+
++ if (rtlpriv->cfg->ops->get_available_desc &&
++ rtlpriv->cfg->ops->get_available_desc(hw, hw_queue) == 0) {
++ RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING,
++ "get_available_desc fail\n");
++ spin_unlock_irqrestore(&rtlpriv->locks.irq_th_lock,
++ flags);
++ return skb->len;
++ }
++
+ if (ieee80211_is_data_qos(fc)) {
+ tid = rtl_get_tid(skb);
+ if (sta) {
+diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
+index e06bafee37f9..5034660bf411 100644
+--- a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
++++ b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
+@@ -321,6 +321,7 @@ static struct usb_device_id rtl8192c_usb_ids[] = {
+ {RTL_USB_DEVICE(0x07b8, 0x8188, rtl92cu_hal_cfg)}, /*Abocom - Abocom*/
+ {RTL_USB_DEVICE(0x07b8, 0x8189, rtl92cu_hal_cfg)}, /*Funai - Abocom*/
+ {RTL_USB_DEVICE(0x0846, 0x9041, rtl92cu_hal_cfg)}, /*NetGear WNA1000M*/
++ {RTL_USB_DEVICE(0x0b05, 0x17ba, rtl92cu_hal_cfg)}, /*ASUS-Edimax*/
+ {RTL_USB_DEVICE(0x0bda, 0x5088, rtl92cu_hal_cfg)}, /*Thinkware-CC&C*/
+ {RTL_USB_DEVICE(0x0df6, 0x0052, rtl92cu_hal_cfg)}, /*Sitecom - Edimax*/
+ {RTL_USB_DEVICE(0x0df6, 0x005c, rtl92cu_hal_cfg)}, /*Sitecom - Edimax*/
+@@ -377,6 +378,7 @@ static struct usb_device_id rtl8192c_usb_ids[] = {
+ {RTL_USB_DEVICE(0x2001, 0x3307, rtl92cu_hal_cfg)}, /*D-Link-Cameo*/
+ {RTL_USB_DEVICE(0x2001, 0x3309, rtl92cu_hal_cfg)}, /*D-Link-Alpha*/
+ {RTL_USB_DEVICE(0x2001, 0x330a, rtl92cu_hal_cfg)}, /*D-Link-Alpha*/
++ {RTL_USB_DEVICE(0x2001, 0x330d, rtl92cu_hal_cfg)}, /*D-Link DWA-131 */
+ {RTL_USB_DEVICE(0x2019, 0xab2b, rtl92cu_hal_cfg)}, /*Planex -Abocom*/
+ {RTL_USB_DEVICE(0x20f4, 0x624d, rtl92cu_hal_cfg)}, /*TRENDNet*/
+ {RTL_USB_DEVICE(0x2357, 0x0100, rtl92cu_hal_cfg)}, /*TP-Link WN8200ND*/
+diff --git a/drivers/net/wireless/rtlwifi/rtl8192ee/sw.c b/drivers/net/wireless/rtlwifi/rtl8192ee/sw.c
+index 9b5a7d5be121..c31c6bfb536d 100644
+--- a/drivers/net/wireless/rtlwifi/rtl8192ee/sw.c
++++ b/drivers/net/wireless/rtlwifi/rtl8192ee/sw.c
+@@ -113,8 +113,6 @@ int rtl92ee_init_sw_vars(struct ieee80211_hw *hw)
+ RCR_HTC_LOC_CTRL |
+ RCR_AMF |
+ RCR_ACF |
+- RCR_ADF |
+- RCR_AICV |
+ RCR_ACRC32 |
+ RCR_AB |
+ RCR_AM |
+@@ -241,6 +239,7 @@ static struct rtl_hal_ops rtl8192ee_hal_ops = {
+ .set_desc = rtl92ee_set_desc,
+ .get_desc = rtl92ee_get_desc,
+ .is_tx_desc_closed = rtl92ee_is_tx_desc_closed,
++ .get_available_desc = rtl92ee_get_available_desc,
+ .tx_polling = rtl92ee_tx_polling,
+ .enable_hw_sec = rtl92ee_enable_hw_security_config,
+ .set_key = rtl92ee_set_key,
+diff --git a/drivers/net/wireless/rtlwifi/rtl8192ee/trx.c b/drivers/net/wireless/rtlwifi/rtl8192ee/trx.c
+index 00690040be37..1f6d160877e1 100644
+--- a/drivers/net/wireless/rtlwifi/rtl8192ee/trx.c
++++ b/drivers/net/wireless/rtlwifi/rtl8192ee/trx.c
+@@ -707,7 +707,7 @@ static u16 get_desc_addr_fr_q_idx(u16 queue_index)
+ return desc_address;
+ }
+
+-void rtl92ee_get_available_desc(struct ieee80211_hw *hw, u8 q_idx)
++u16 rtl92ee_get_available_desc(struct ieee80211_hw *hw, u8 q_idx)
+ {
+ struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
+ struct rtl_priv *rtlpriv = rtl_priv(hw);
+@@ -721,11 +721,12 @@ void rtl92ee_get_available_desc(struct ieee80211_hw *hw, u8 q_idx)
+ current_tx_write_point = (u16)((tmp_4byte) & 0x0fff);
+
+ point_diff = ((current_tx_read_point > current_tx_write_point) ?
+- (current_tx_read_point - current_tx_write_point) :
+- (TX_DESC_NUM_92E - current_tx_write_point +
++ (current_tx_read_point - current_tx_write_point - 1) :
++ (TX_DESC_NUM_92E - 1 - current_tx_write_point +
+ current_tx_read_point));
+
+ rtlpci->tx_ring[q_idx].avl_desc = point_diff;
++ return point_diff;
+ }
+
+ void rtl92ee_pre_fill_tx_bd_desc(struct ieee80211_hw *hw,
+diff --git a/drivers/net/wireless/rtlwifi/rtl8192ee/trx.h b/drivers/net/wireless/rtlwifi/rtl8192ee/trx.h
+index 8effef9b13dd..b489dd9c8401 100644
+--- a/drivers/net/wireless/rtlwifi/rtl8192ee/trx.h
++++ b/drivers/net/wireless/rtlwifi/rtl8192ee/trx.h
+@@ -831,7 +831,7 @@ void rtl92ee_rx_check_dma_ok(struct ieee80211_hw *hw, u8 *header_desc,
+ u8 queue_index);
+ u16 rtl92ee_rx_desc_buff_remained_cnt(struct ieee80211_hw *hw,
+ u8 queue_index);
+-void rtl92ee_get_available_desc(struct ieee80211_hw *hw, u8 queue_index);
++u16 rtl92ee_get_available_desc(struct ieee80211_hw *hw, u8 queue_index);
+ void rtl92ee_pre_fill_tx_bd_desc(struct ieee80211_hw *hw,
+ u8 *tx_bd_desc, u8 *desc, u8 queue_index,
+ struct sk_buff *skb, dma_addr_t addr);
+diff --git a/drivers/net/wireless/rtlwifi/wifi.h b/drivers/net/wireless/rtlwifi/wifi.h
+index 6866dcf24340..27822fe34d9a 100644
+--- a/drivers/net/wireless/rtlwifi/wifi.h
++++ b/drivers/net/wireless/rtlwifi/wifi.h
+@@ -2161,6 +2161,7 @@ struct rtl_hal_ops {
+ void (*add_wowlan_pattern)(struct ieee80211_hw *hw,
+ struct rtl_wow_pattern *rtl_pattern,
+ u8 index);
++ u16 (*get_available_desc)(struct ieee80211_hw *hw, u8 q_idx);
+ };
+
+ struct rtl_intf_ops {
+diff --git a/drivers/net/wireless/ti/wl18xx/debugfs.c b/drivers/net/wireless/ti/wl18xx/debugfs.c
+index 7f1669cdea09..779dc2b2ca75 100644
+--- a/drivers/net/wireless/ti/wl18xx/debugfs.c
++++ b/drivers/net/wireless/ti/wl18xx/debugfs.c
+@@ -136,7 +136,7 @@ WL18XX_DEBUGFS_FWSTATS_FILE(rx_filter, protection_filter, "%u");
+ WL18XX_DEBUGFS_FWSTATS_FILE(rx_filter, accum_arp_pend_requests, "%u");
+ WL18XX_DEBUGFS_FWSTATS_FILE(rx_filter, max_arp_queue_dep, "%u");
+
+-WL18XX_DEBUGFS_FWSTATS_FILE(rx_rate, rx_frames_per_rates, "%u");
++WL18XX_DEBUGFS_FWSTATS_FILE_ARRAY(rx_rate, rx_frames_per_rates, 50);
+
+ WL18XX_DEBUGFS_FWSTATS_FILE_ARRAY(aggr_size, tx_agg_vs_rate,
+ AGGR_STATS_TX_AGG*AGGR_STATS_TX_RATE);
+diff --git a/drivers/net/wireless/ti/wlcore/debugfs.h b/drivers/net/wireless/ti/wlcore/debugfs.h
+index 0f2cfb0d2a9e..bf14676e6515 100644
+--- a/drivers/net/wireless/ti/wlcore/debugfs.h
++++ b/drivers/net/wireless/ti/wlcore/debugfs.h
+@@ -26,8 +26,8 @@
+
+ #include "wlcore.h"
+
+-int wl1271_format_buffer(char __user *userbuf, size_t count,
+- loff_t *ppos, char *fmt, ...);
++__printf(4, 5) int wl1271_format_buffer(char __user *userbuf, size_t count,
++ loff_t *ppos, char *fmt, ...);
+
+ int wl1271_debugfs_init(struct wl1271 *wl);
+ void wl1271_debugfs_exit(struct wl1271 *wl);
+diff --git a/drivers/nfc/st21nfcb/i2c.c b/drivers/nfc/st21nfcb/i2c.c
+index c5d2427a3db2..2cf867b9796d 100644
+--- a/drivers/nfc/st21nfcb/i2c.c
++++ b/drivers/nfc/st21nfcb/i2c.c
+@@ -112,7 +112,7 @@ static int st21nfcb_nci_i2c_write(void *phy_id, struct sk_buff *skb)
+ return phy->ndlc->hard_fault;
+
+ r = i2c_master_send(client, skb->data, skb->len);
+- if (r == -EREMOTEIO) { /* Retry, chip was in standby */
++ if (r < 0) { /* Retry, chip was in standby */
+ usleep_range(1000, 4000);
+ r = i2c_master_send(client, skb->data, skb->len);
+ }
+@@ -151,7 +151,7 @@ static int st21nfcb_nci_i2c_read(struct st21nfcb_i2c_phy *phy,
+ struct i2c_client *client = phy->i2c_dev;
+
+ r = i2c_master_recv(client, buf, ST21NFCB_NCI_I2C_MIN_SIZE);
+- if (r == -EREMOTEIO) { /* Retry, chip was in standby */
++ if (r < 0) { /* Retry, chip was in standby */
+ usleep_range(1000, 4000);
+ r = i2c_master_recv(client, buf, ST21NFCB_NCI_I2C_MIN_SIZE);
+ }
+diff --git a/drivers/platform/x86/compal-laptop.c b/drivers/platform/x86/compal-laptop.c
+index 26bfd7bb5c13..034aa844a1b5 100644
+--- a/drivers/platform/x86/compal-laptop.c
++++ b/drivers/platform/x86/compal-laptop.c
+@@ -1027,9 +1027,9 @@ static int compal_probe(struct platform_device *pdev)
+ if (err)
+ return err;
+
+- hwmon_dev = hwmon_device_register_with_groups(&pdev->dev,
+- "compal", data,
+- compal_hwmon_groups);
++ hwmon_dev = devm_hwmon_device_register_with_groups(&pdev->dev,
++ "compal", data,
++ compal_hwmon_groups);
+ if (IS_ERR(hwmon_dev)) {
+ err = PTR_ERR(hwmon_dev);
+ goto remove;
+@@ -1037,7 +1037,9 @@ static int compal_probe(struct platform_device *pdev)
+
+ /* Power supply */
+ initialize_power_supply_data(data);
+- power_supply_register(&compal_device->dev, &data->psy);
++ err = power_supply_register(&compal_device->dev, &data->psy);
++ if (err < 0)
++ goto remove;
+
+ platform_set_drvdata(pdev, data);
+
+diff --git a/drivers/power/ipaq_micro_battery.c b/drivers/power/ipaq_micro_battery.c
+index 9d694605cdb7..96b15e003f3f 100644
+--- a/drivers/power/ipaq_micro_battery.c
++++ b/drivers/power/ipaq_micro_battery.c
+@@ -226,6 +226,7 @@ static struct power_supply micro_ac_power = {
+ static int micro_batt_probe(struct platform_device *pdev)
+ {
+ struct micro_battery *mb;
++ int ret;
+
+ mb = devm_kzalloc(&pdev->dev, sizeof(*mb), GFP_KERNEL);
+ if (!mb)
+@@ -233,14 +234,30 @@ static int micro_batt_probe(struct platform_device *pdev)
+
+ mb->micro = dev_get_drvdata(pdev->dev.parent);
+ mb->wq = create_singlethread_workqueue("ipaq-battery-wq");
++ if (!mb->wq)
++ return -ENOMEM;
++
+ INIT_DELAYED_WORK(&mb->update, micro_battery_work);
+ platform_set_drvdata(pdev, mb);
+ queue_delayed_work(mb->wq, &mb->update, 1);
+- power_supply_register(&pdev->dev, µ_batt_power);
+- power_supply_register(&pdev->dev, µ_ac_power);
++
++ ret = power_supply_register(&pdev->dev, µ_batt_power);
++ if (ret < 0)
++ goto batt_err;
++
++ ret = power_supply_register(&pdev->dev, µ_ac_power);
++ if (ret < 0)
++ goto ac_err;
+
+ dev_info(&pdev->dev, "iPAQ micro battery driver\n");
+ return 0;
++
++ac_err:
++ power_supply_unregister(µ_ac_power);
++batt_err:
++ cancel_delayed_work_sync(&mb->update);
++ destroy_workqueue(mb->wq);
++ return ret;
+ }
+
+ static int micro_batt_remove(struct platform_device *pdev)
+@@ -251,6 +268,7 @@ static int micro_batt_remove(struct platform_device *pdev)
+ power_supply_unregister(µ_ac_power);
+ power_supply_unregister(µ_batt_power);
+ cancel_delayed_work_sync(&mb->update);
++ destroy_workqueue(mb->wq);
+
+ return 0;
+ }
+diff --git a/drivers/power/lp8788-charger.c b/drivers/power/lp8788-charger.c
+index ed49b50b220b..72da2a6c22db 100644
+--- a/drivers/power/lp8788-charger.c
++++ b/drivers/power/lp8788-charger.c
+@@ -417,8 +417,10 @@ static int lp8788_psy_register(struct platform_device *pdev,
+ pchg->battery.num_properties = ARRAY_SIZE(lp8788_battery_prop);
+ pchg->battery.get_property = lp8788_battery_get_property;
+
+- if (power_supply_register(&pdev->dev, &pchg->battery))
++ if (power_supply_register(&pdev->dev, &pchg->battery)) {
++ power_supply_unregister(&pchg->charger);
+ return -EPERM;
++ }
+
+ return 0;
+ }
+diff --git a/drivers/power/twl4030_madc_battery.c b/drivers/power/twl4030_madc_battery.c
+index 7ef445a6cfa6..cf907609ec49 100644
+--- a/drivers/power/twl4030_madc_battery.c
++++ b/drivers/power/twl4030_madc_battery.c
+@@ -192,6 +192,7 @@ static int twl4030_madc_battery_probe(struct platform_device *pdev)
+ {
+ struct twl4030_madc_battery *twl4030_madc_bat;
+ struct twl4030_madc_bat_platform_data *pdata = pdev->dev.platform_data;
++ int ret = 0;
+
+ twl4030_madc_bat = kzalloc(sizeof(*twl4030_madc_bat), GFP_KERNEL);
+ if (!twl4030_madc_bat)
+@@ -216,9 +217,11 @@ static int twl4030_madc_battery_probe(struct platform_device *pdev)
+
+ twl4030_madc_bat->pdata = pdata;
+ platform_set_drvdata(pdev, twl4030_madc_bat);
+- power_supply_register(&pdev->dev, &twl4030_madc_bat->psy);
++ ret = power_supply_register(&pdev->dev, &twl4030_madc_bat->psy);
++ if (ret < 0)
++ kfree(twl4030_madc_bat);
+
+- return 0;
++ return ret;
+ }
+
+ static int twl4030_madc_battery_remove(struct platform_device *pdev)
+diff --git a/drivers/scsi/3w-9xxx.c b/drivers/scsi/3w-9xxx.c
+index 0a7325361d29..5f57e3d35e26 100644
+--- a/drivers/scsi/3w-9xxx.c
++++ b/drivers/scsi/3w-9xxx.c
+@@ -149,7 +149,6 @@ static int twa_reset_sequence(TW_Device_Extension *tw_dev, int soft_reset);
+ static int twa_scsiop_execute_scsi(TW_Device_Extension *tw_dev, int request_id, char *cdb, int use_sg, TW_SG_Entry *sglistarg);
+ static void twa_scsiop_execute_scsi_complete(TW_Device_Extension *tw_dev, int request_id);
+ static char *twa_string_lookup(twa_message_type *table, unsigned int aen_code);
+-static void twa_unmap_scsi_data(TW_Device_Extension *tw_dev, int request_id);
+
+ /* Functions */
+
+@@ -1352,11 +1351,11 @@ static irqreturn_t twa_interrupt(int irq, void *dev_instance)
+ }
+
+ /* Now complete the io */
++ scsi_dma_unmap(cmd);
++ cmd->scsi_done(cmd);
+ tw_dev->state[request_id] = TW_S_COMPLETED;
+ twa_free_request_id(tw_dev, request_id);
+ tw_dev->posted_request_count--;
+- tw_dev->srb[request_id]->scsi_done(tw_dev->srb[request_id]);
+- twa_unmap_scsi_data(tw_dev, request_id);
+ }
+
+ /* Check for valid status after each drain */
+@@ -1414,26 +1413,6 @@ static void twa_load_sgl(TW_Device_Extension *tw_dev, TW_Command_Full *full_comm
+ }
+ } /* End twa_load_sgl() */
+
+-/* This function will perform a pci-dma mapping for a scatter gather list */
+-static int twa_map_scsi_sg_data(TW_Device_Extension *tw_dev, int request_id)
+-{
+- int use_sg;
+- struct scsi_cmnd *cmd = tw_dev->srb[request_id];
+-
+- use_sg = scsi_dma_map(cmd);
+- if (!use_sg)
+- return 0;
+- else if (use_sg < 0) {
+- TW_PRINTK(tw_dev->host, TW_DRIVER, 0x1c, "Failed to map scatter gather list");
+- return 0;
+- }
+-
+- cmd->SCp.phase = TW_PHASE_SGLIST;
+- cmd->SCp.have_data_in = use_sg;
+-
+- return use_sg;
+-} /* End twa_map_scsi_sg_data() */
+-
+ /* This function will poll for a response interrupt of a request */
+ static int twa_poll_response(TW_Device_Extension *tw_dev, int request_id, int seconds)
+ {
+@@ -1612,9 +1591,11 @@ static int twa_reset_device_extension(TW_Device_Extension *tw_dev)
+ (tw_dev->state[i] != TW_S_INITIAL) &&
+ (tw_dev->state[i] != TW_S_COMPLETED)) {
+ if (tw_dev->srb[i]) {
+- tw_dev->srb[i]->result = (DID_RESET << 16);
+- tw_dev->srb[i]->scsi_done(tw_dev->srb[i]);
+- twa_unmap_scsi_data(tw_dev, i);
++ struct scsi_cmnd *cmd = tw_dev->srb[i];
++
++ cmd->result = (DID_RESET << 16);
++ scsi_dma_unmap(cmd);
++ cmd->scsi_done(cmd);
+ }
+ }
+ }
+@@ -1793,21 +1774,18 @@ static int twa_scsi_queue_lck(struct scsi_cmnd *SCpnt, void (*done)(struct scsi_
+ /* Save the scsi command for use by the ISR */
+ tw_dev->srb[request_id] = SCpnt;
+
+- /* Initialize phase to zero */
+- SCpnt->SCp.phase = TW_PHASE_INITIAL;
+-
+ retval = twa_scsiop_execute_scsi(tw_dev, request_id, NULL, 0, NULL);
+ switch (retval) {
+ case SCSI_MLQUEUE_HOST_BUSY:
++ scsi_dma_unmap(SCpnt);
+ twa_free_request_id(tw_dev, request_id);
+- twa_unmap_scsi_data(tw_dev, request_id);
+ break;
+ case 1:
+- tw_dev->state[request_id] = TW_S_COMPLETED;
+- twa_free_request_id(tw_dev, request_id);
+- twa_unmap_scsi_data(tw_dev, request_id);
+ SCpnt->result = (DID_ERROR << 16);
++ scsi_dma_unmap(SCpnt);
+ done(SCpnt);
++ tw_dev->state[request_id] = TW_S_COMPLETED;
++ twa_free_request_id(tw_dev, request_id);
+ retval = 0;
+ }
+ out:
+@@ -1875,8 +1853,8 @@ static int twa_scsiop_execute_scsi(TW_Device_Extension *tw_dev, int request_id,
+ command_packet->sg_list[0].address = TW_CPU_TO_SGL(tw_dev->generic_buffer_phys[request_id]);
+ command_packet->sg_list[0].length = cpu_to_le32(TW_MIN_SGL_LENGTH);
+ } else {
+- sg_count = twa_map_scsi_sg_data(tw_dev, request_id);
+- if (sg_count == 0)
++ sg_count = scsi_dma_map(srb);
++ if (sg_count < 0)
+ goto out;
+
+ scsi_for_each_sg(srb, sg, sg_count, i) {
+@@ -1991,15 +1969,6 @@ static char *twa_string_lookup(twa_message_type *table, unsigned int code)
+ return(table[index].text);
+ } /* End twa_string_lookup() */
+
+-/* This function will perform a pci-dma unmap */
+-static void twa_unmap_scsi_data(TW_Device_Extension *tw_dev, int request_id)
+-{
+- struct scsi_cmnd *cmd = tw_dev->srb[request_id];
+-
+- if (cmd->SCp.phase == TW_PHASE_SGLIST)
+- scsi_dma_unmap(cmd);
+-} /* End twa_unmap_scsi_data() */
+-
+ /* This function gets called when a disk is coming on-line */
+ static int twa_slave_configure(struct scsi_device *sdev)
+ {
+diff --git a/drivers/scsi/3w-9xxx.h b/drivers/scsi/3w-9xxx.h
+index 040f7214e5b7..0fdc83cfa0e1 100644
+--- a/drivers/scsi/3w-9xxx.h
++++ b/drivers/scsi/3w-9xxx.h
+@@ -324,11 +324,6 @@ static twa_message_type twa_error_table[] = {
+ #define TW_CURRENT_DRIVER_BUILD 0
+ #define TW_CURRENT_DRIVER_BRANCH 0
+
+-/* Phase defines */
+-#define TW_PHASE_INITIAL 0
+-#define TW_PHASE_SINGLE 1
+-#define TW_PHASE_SGLIST 2
+-
+ /* Misc defines */
+ #define TW_9550SX_DRAIN_COMPLETED 0xFFFF
+ #define TW_SECTOR_SIZE 512
+diff --git a/drivers/scsi/3w-sas.c b/drivers/scsi/3w-sas.c
+index 6da6cec9a651..2ee2e543ab73 100644
+--- a/drivers/scsi/3w-sas.c
++++ b/drivers/scsi/3w-sas.c
+@@ -303,26 +303,6 @@ static int twl_post_command_packet(TW_Device_Extension *tw_dev, int request_id)
+ return 0;
+ } /* End twl_post_command_packet() */
+
+-/* This function will perform a pci-dma mapping for a scatter gather list */
+-static int twl_map_scsi_sg_data(TW_Device_Extension *tw_dev, int request_id)
+-{
+- int use_sg;
+- struct scsi_cmnd *cmd = tw_dev->srb[request_id];
+-
+- use_sg = scsi_dma_map(cmd);
+- if (!use_sg)
+- return 0;
+- else if (use_sg < 0) {
+- TW_PRINTK(tw_dev->host, TW_DRIVER, 0x1, "Failed to map scatter gather list");
+- return 0;
+- }
+-
+- cmd->SCp.phase = TW_PHASE_SGLIST;
+- cmd->SCp.have_data_in = use_sg;
+-
+- return use_sg;
+-} /* End twl_map_scsi_sg_data() */
+-
+ /* This function hands scsi cdb's to the firmware */
+ static int twl_scsiop_execute_scsi(TW_Device_Extension *tw_dev, int request_id, char *cdb, int use_sg, TW_SG_Entry_ISO *sglistarg)
+ {
+@@ -370,8 +350,8 @@ static int twl_scsiop_execute_scsi(TW_Device_Extension *tw_dev, int request_id,
+ if (!sglistarg) {
+ /* Map sglist from scsi layer to cmd packet */
+ if (scsi_sg_count(srb)) {
+- sg_count = twl_map_scsi_sg_data(tw_dev, request_id);
+- if (sg_count == 0)
++ sg_count = scsi_dma_map(srb);
++ if (sg_count <= 0)
+ goto out;
+
+ scsi_for_each_sg(srb, sg, sg_count, i) {
+@@ -1115,15 +1095,6 @@ out:
+ return retval;
+ } /* End twl_initialize_device_extension() */
+
+-/* This function will perform a pci-dma unmap */
+-static void twl_unmap_scsi_data(TW_Device_Extension *tw_dev, int request_id)
+-{
+- struct scsi_cmnd *cmd = tw_dev->srb[request_id];
+-
+- if (cmd->SCp.phase == TW_PHASE_SGLIST)
+- scsi_dma_unmap(cmd);
+-} /* End twl_unmap_scsi_data() */
+-
+ /* This function will handle attention interrupts */
+ static int twl_handle_attention_interrupt(TW_Device_Extension *tw_dev)
+ {
+@@ -1264,11 +1235,11 @@ static irqreturn_t twl_interrupt(int irq, void *dev_instance)
+ }
+
+ /* Now complete the io */
++ scsi_dma_unmap(cmd);
++ cmd->scsi_done(cmd);
+ tw_dev->state[request_id] = TW_S_COMPLETED;
+ twl_free_request_id(tw_dev, request_id);
+ tw_dev->posted_request_count--;
+- tw_dev->srb[request_id]->scsi_done(tw_dev->srb[request_id]);
+- twl_unmap_scsi_data(tw_dev, request_id);
+ }
+
+ /* Check for another response interrupt */
+@@ -1413,10 +1384,12 @@ static int twl_reset_device_extension(TW_Device_Extension *tw_dev, int ioctl_res
+ if ((tw_dev->state[i] != TW_S_FINISHED) &&
+ (tw_dev->state[i] != TW_S_INITIAL) &&
+ (tw_dev->state[i] != TW_S_COMPLETED)) {
+- if (tw_dev->srb[i]) {
+- tw_dev->srb[i]->result = (DID_RESET << 16);
+- tw_dev->srb[i]->scsi_done(tw_dev->srb[i]);
+- twl_unmap_scsi_data(tw_dev, i);
++ struct scsi_cmnd *cmd = tw_dev->srb[i];
++
++ if (cmd) {
++ cmd->result = (DID_RESET << 16);
++ scsi_dma_unmap(cmd);
++ cmd->scsi_done(cmd);
+ }
+ }
+ }
+@@ -1520,9 +1493,6 @@ static int twl_scsi_queue_lck(struct scsi_cmnd *SCpnt, void (*done)(struct scsi_
+ /* Save the scsi command for use by the ISR */
+ tw_dev->srb[request_id] = SCpnt;
+
+- /* Initialize phase to zero */
+- SCpnt->SCp.phase = TW_PHASE_INITIAL;
+-
+ retval = twl_scsiop_execute_scsi(tw_dev, request_id, NULL, 0, NULL);
+ if (retval) {
+ tw_dev->state[request_id] = TW_S_COMPLETED;
+diff --git a/drivers/scsi/3w-sas.h b/drivers/scsi/3w-sas.h
+index d474892701d4..fec6449c7595 100644
+--- a/drivers/scsi/3w-sas.h
++++ b/drivers/scsi/3w-sas.h
+@@ -103,10 +103,6 @@ static char *twl_aen_severity_table[] =
+ #define TW_CURRENT_DRIVER_BUILD 0
+ #define TW_CURRENT_DRIVER_BRANCH 0
+
+-/* Phase defines */
+-#define TW_PHASE_INITIAL 0
+-#define TW_PHASE_SGLIST 2
+-
+ /* Misc defines */
+ #define TW_SECTOR_SIZE 512
+ #define TW_MAX_UNITS 32
+diff --git a/drivers/scsi/3w-xxxx.c b/drivers/scsi/3w-xxxx.c
+index 752624e6bc00..b327742b95ef 100644
+--- a/drivers/scsi/3w-xxxx.c
++++ b/drivers/scsi/3w-xxxx.c
+@@ -1284,32 +1284,6 @@ static int tw_initialize_device_extension(TW_Device_Extension *tw_dev)
+ return 0;
+ } /* End tw_initialize_device_extension() */
+
+-static int tw_map_scsi_sg_data(struct pci_dev *pdev, struct scsi_cmnd *cmd)
+-{
+- int use_sg;
+-
+- dprintk(KERN_WARNING "3w-xxxx: tw_map_scsi_sg_data()\n");
+-
+- use_sg = scsi_dma_map(cmd);
+- if (use_sg < 0) {
+- printk(KERN_WARNING "3w-xxxx: tw_map_scsi_sg_data(): pci_map_sg() failed.\n");
+- return 0;
+- }
+-
+- cmd->SCp.phase = TW_PHASE_SGLIST;
+- cmd->SCp.have_data_in = use_sg;
+-
+- return use_sg;
+-} /* End tw_map_scsi_sg_data() */
+-
+-static void tw_unmap_scsi_data(struct pci_dev *pdev, struct scsi_cmnd *cmd)
+-{
+- dprintk(KERN_WARNING "3w-xxxx: tw_unmap_scsi_data()\n");
+-
+- if (cmd->SCp.phase == TW_PHASE_SGLIST)
+- scsi_dma_unmap(cmd);
+-} /* End tw_unmap_scsi_data() */
+-
+ /* This function will reset a device extension */
+ static int tw_reset_device_extension(TW_Device_Extension *tw_dev)
+ {
+@@ -1332,8 +1306,8 @@ static int tw_reset_device_extension(TW_Device_Extension *tw_dev)
+ srb = tw_dev->srb[i];
+ if (srb != NULL) {
+ srb->result = (DID_RESET << 16);
+- tw_dev->srb[i]->scsi_done(tw_dev->srb[i]);
+- tw_unmap_scsi_data(tw_dev->tw_pci_dev, tw_dev->srb[i]);
++ scsi_dma_unmap(srb);
++ srb->scsi_done(srb);
+ }
+ }
+ }
+@@ -1780,8 +1754,8 @@ static int tw_scsiop_read_write(TW_Device_Extension *tw_dev, int request_id)
+ command_packet->byte8.io.lba = lba;
+ command_packet->byte6.block_count = num_sectors;
+
+- use_sg = tw_map_scsi_sg_data(tw_dev->tw_pci_dev, tw_dev->srb[request_id]);
+- if (!use_sg)
++ use_sg = scsi_dma_map(srb);
++ if (use_sg <= 0)
+ return 1;
+
+ scsi_for_each_sg(tw_dev->srb[request_id], sg, use_sg, i) {
+@@ -1968,9 +1942,6 @@ static int tw_scsi_queue_lck(struct scsi_cmnd *SCpnt, void (*done)(struct scsi_c
+ /* Save the scsi command for use by the ISR */
+ tw_dev->srb[request_id] = SCpnt;
+
+- /* Initialize phase to zero */
+- SCpnt->SCp.phase = TW_PHASE_INITIAL;
+-
+ switch (*command) {
+ case READ_10:
+ case READ_6:
+@@ -2198,12 +2169,11 @@ static irqreturn_t tw_interrupt(int irq, void *dev_instance)
+
+ /* Now complete the io */
+ if ((error != TW_ISR_DONT_COMPLETE)) {
++ scsi_dma_unmap(tw_dev->srb[request_id]);
++ tw_dev->srb[request_id]->scsi_done(tw_dev->srb[request_id]);
+ tw_dev->state[request_id] = TW_S_COMPLETED;
+ tw_state_request_finish(tw_dev, request_id);
+ tw_dev->posted_request_count--;
+- tw_dev->srb[request_id]->scsi_done(tw_dev->srb[request_id]);
+-
+- tw_unmap_scsi_data(tw_dev->tw_pci_dev, tw_dev->srb[request_id]);
+ }
+ }
+
+diff --git a/drivers/scsi/3w-xxxx.h b/drivers/scsi/3w-xxxx.h
+index 29b0b84ed69e..6f65e663d393 100644
+--- a/drivers/scsi/3w-xxxx.h
++++ b/drivers/scsi/3w-xxxx.h
+@@ -195,11 +195,6 @@ static unsigned char tw_sense_table[][4] =
+ #define TW_AEN_SMART_FAIL 0x000F
+ #define TW_AEN_SBUF_FAIL 0x0024
+
+-/* Phase defines */
+-#define TW_PHASE_INITIAL 0
+-#define TW_PHASE_SINGLE 1
+-#define TW_PHASE_SGLIST 2
+-
+ /* Misc defines */
+ #define TW_ALIGNMENT_6000 64 /* 64 bytes */
+ #define TW_ALIGNMENT_7000 4 /* 4 bytes */
+diff --git a/drivers/scsi/mvsas/mv_sas.c b/drivers/scsi/mvsas/mv_sas.c
+index ac52f7c99513..0eb2da8a696f 100644
+--- a/drivers/scsi/mvsas/mv_sas.c
++++ b/drivers/scsi/mvsas/mv_sas.c
+@@ -441,14 +441,11 @@ static u32 mvs_get_ncq_tag(struct sas_task *task, u32 *tag)
+ static int mvs_task_prep_ata(struct mvs_info *mvi,
+ struct mvs_task_exec_info *tei)
+ {
+- struct sas_ha_struct *sha = mvi->sas;
+ struct sas_task *task = tei->task;
+ struct domain_device *dev = task->dev;
+ struct mvs_device *mvi_dev = dev->lldd_dev;
+ struct mvs_cmd_hdr *hdr = tei->hdr;
+ struct asd_sas_port *sas_port = dev->port;
+- struct sas_phy *sphy = dev->phy;
+- struct asd_sas_phy *sas_phy = sha->sas_phy[sphy->number];
+ struct mvs_slot_info *slot;
+ void *buf_prd;
+ u32 tag = tei->tag, hdr_tag;
+@@ -468,7 +465,7 @@ static int mvs_task_prep_ata(struct mvs_info *mvi,
+ slot->tx = mvi->tx_prod;
+ del_q = TXQ_MODE_I | tag |
+ (TXQ_CMD_STP << TXQ_CMD_SHIFT) |
+- (MVS_PHY_ID << TXQ_PHY_SHIFT) |
++ ((sas_port->phy_mask & TXQ_PHY_MASK) << TXQ_PHY_SHIFT) |
+ (mvi_dev->taskfileset << TXQ_SRS_SHIFT);
+ mvi->tx[mvi->tx_prod] = cpu_to_le32(del_q);
+
+diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
+index dd8c8d690763..7a4d88c91069 100644
+--- a/drivers/scsi/sd.c
++++ b/drivers/scsi/sd.c
+@@ -3118,6 +3118,7 @@ static void scsi_disk_release(struct device *dev)
+ ida_remove(&sd_index_ida, sdkp->index);
+ spin_unlock(&sd_index_lock);
+
++ blk_integrity_unregister(disk);
+ disk->private_data = NULL;
+ put_disk(disk);
+ put_device(&sdkp->device->sdev_gendev);
+diff --git a/drivers/scsi/sd_dif.c b/drivers/scsi/sd_dif.c
+index 14c7d42a11c2..5c06d292b94c 100644
+--- a/drivers/scsi/sd_dif.c
++++ b/drivers/scsi/sd_dif.c
+@@ -77,7 +77,7 @@ void sd_dif_config_host(struct scsi_disk *sdkp)
+
+ disk->integrity->flags |= BLK_INTEGRITY_DEVICE_CAPABLE;
+
+- if (!sdkp)
++ if (!sdkp->ATO)
+ return;
+
+ if (type == SD_DIF_TYPE3_PROTECTION)
+diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c
+index 90af465359d6..4534d9debcdc 100644
+--- a/drivers/scsi/storvsc_drv.c
++++ b/drivers/scsi/storvsc_drv.c
+@@ -741,21 +741,22 @@ static unsigned int copy_to_bounce_buffer(struct scatterlist *orig_sgl,
+ if (bounce_sgl[j].length == PAGE_SIZE) {
+ /* full..move to next entry */
+ sg_kunmap_atomic(bounce_addr);
++ bounce_addr = 0;
+ j++;
++ }
+
+- /* if we need to use another bounce buffer */
+- if (srclen || i != orig_sgl_count - 1)
+- bounce_addr = sg_kmap_atomic(bounce_sgl,j);
++ /* if we need to use another bounce buffer */
++ if (srclen && bounce_addr == 0)
++ bounce_addr = sg_kmap_atomic(bounce_sgl, j);
+
+- } else if (srclen == 0 && i == orig_sgl_count - 1) {
+- /* unmap the last bounce that is < PAGE_SIZE */
+- sg_kunmap_atomic(bounce_addr);
+- }
+ }
+
+ sg_kunmap_atomic(src_addr - orig_sgl[i].offset);
+ }
+
++ if (bounce_addr)
++ sg_kunmap_atomic(bounce_addr);
++
+ local_irq_restore(flags);
+
+ return total_copied;
+diff --git a/drivers/spi/spi-imx.c b/drivers/spi/spi-imx.c
+index 82269a86fd7a..bf0effb86137 100644
+--- a/drivers/spi/spi-imx.c
++++ b/drivers/spi/spi-imx.c
+@@ -371,8 +371,6 @@ static int __maybe_unused mx51_ecspi_config(struct spi_imx_data *spi_imx,
+ if (spi_imx->dma_is_inited) {
+ dma = readl(spi_imx->base + MX51_ECSPI_DMA);
+
+- spi_imx->tx_wml = spi_imx_get_fifosize(spi_imx) / 2;
+- spi_imx->rx_wml = spi_imx_get_fifosize(spi_imx) / 2;
+ spi_imx->rxt_wml = spi_imx_get_fifosize(spi_imx) / 2;
+ rx_wml_cfg = spi_imx->rx_wml << MX51_ECSPI_DMA_RX_WML_OFFSET;
+ tx_wml_cfg = spi_imx->tx_wml << MX51_ECSPI_DMA_TX_WML_OFFSET;
+@@ -869,6 +867,8 @@ static int spi_imx_sdma_init(struct device *dev, struct spi_imx_data *spi_imx,
+ master->max_dma_len = MAX_SDMA_BD_BYTES;
+ spi_imx->bitbang.master->flags = SPI_MASTER_MUST_RX |
+ SPI_MASTER_MUST_TX;
++ spi_imx->tx_wml = spi_imx_get_fifosize(spi_imx) / 2;
++ spi_imx->rx_wml = spi_imx_get_fifosize(spi_imx) / 2;
+ spi_imx->dma_is_inited = 1;
+
+ return 0;
+diff --git a/drivers/spi/spidev.c b/drivers/spi/spidev.c
+index e50039fb1474..409a8c576c7a 100644
+--- a/drivers/spi/spidev.c
++++ b/drivers/spi/spidev.c
+@@ -246,7 +246,10 @@ static int spidev_message(struct spidev_data *spidev,
+ k_tmp->len = u_tmp->len;
+
+ total += k_tmp->len;
+- if (total > bufsiz) {
++ /* Check total length of transfers. Also check each
++ * transfer length to avoid arithmetic overflow.
++ */
++ if (total > bufsiz || k_tmp->len > bufsiz) {
+ status = -EMSGSIZE;
+ goto done;
+ }
+diff --git a/drivers/ssb/Kconfig b/drivers/ssb/Kconfig
+index 75b3603906c1..f0d22cdb51cd 100644
+--- a/drivers/ssb/Kconfig
++++ b/drivers/ssb/Kconfig
+@@ -130,6 +130,7 @@ config SSB_DRIVER_MIPS
+ bool "SSB Broadcom MIPS core driver"
+ depends on SSB && MIPS
+ select SSB_SERIAL
++ select SSB_SFLASH
+ help
+ Driver for the Sonics Silicon Backplane attached
+ Broadcom MIPS core.
+diff --git a/drivers/staging/android/sync.c b/drivers/staging/android/sync.c
+index 7bdb62bf6b40..f83e00c78051 100644
+--- a/drivers/staging/android/sync.c
++++ b/drivers/staging/android/sync.c
+@@ -114,7 +114,7 @@ void sync_timeline_signal(struct sync_timeline *obj)
+ list_for_each_entry_safe(pt, next, &obj->active_list_head,
+ active_list) {
+ if (fence_is_signaled_locked(&pt->base))
+- list_del(&pt->active_list);
++ list_del_init(&pt->active_list);
+ }
+
+ spin_unlock_irqrestore(&obj->child_list_lock, flags);
+diff --git a/drivers/staging/comedi/drivers/adv_pci1710.c b/drivers/staging/comedi/drivers/adv_pci1710.c
+index 5539bd294862..a65fa9f68f5e 100644
+--- a/drivers/staging/comedi/drivers/adv_pci1710.c
++++ b/drivers/staging/comedi/drivers/adv_pci1710.c
+@@ -456,7 +456,6 @@ static int pci171x_insn_read_ai(struct comedi_device *dev,
+ struct comedi_insn *insn, unsigned int *data)
+ {
+ struct pci1710_private *devpriv = dev->private;
+- unsigned int chan = CR_CHAN(insn->chanspec);
+ int ret = 0;
+ int i;
+
+@@ -478,7 +477,7 @@ static int pci171x_insn_read_ai(struct comedi_device *dev,
+ break;
+
+ val = inw(dev->iobase + PCI171x_AD_DATA);
+- ret = pci171x_ai_dropout(dev, s, chan, val);
++ ret = pci171x_ai_dropout(dev, s, 0, val);
+ if (ret)
+ break;
+
+diff --git a/drivers/staging/panel/panel.c b/drivers/staging/panel/panel.c
+index 6d1a32097d3c..2dee1757db79 100644
+--- a/drivers/staging/panel/panel.c
++++ b/drivers/staging/panel/panel.c
+@@ -275,11 +275,11 @@ static unsigned char lcd_bits[LCD_PORTS][LCD_BITS][BIT_STATES];
+ * LCD types
+ */
+ #define LCD_TYPE_NONE 0
+-#define LCD_TYPE_OLD 1
+-#define LCD_TYPE_KS0074 2
+-#define LCD_TYPE_HANTRONIX 3
+-#define LCD_TYPE_NEXCOM 4
+-#define LCD_TYPE_CUSTOM 5
++#define LCD_TYPE_CUSTOM 1
++#define LCD_TYPE_OLD 2
++#define LCD_TYPE_KS0074 3
++#define LCD_TYPE_HANTRONIX 4
++#define LCD_TYPE_NEXCOM 5
+
+ /*
+ * keypad types
+diff --git a/drivers/target/target_core_file.c b/drivers/target/target_core_file.c
+index f018b6a3ffbf..88c9179ab20f 100644
+--- a/drivers/target/target_core_file.c
++++ b/drivers/target/target_core_file.c
+@@ -263,40 +263,32 @@ static int fd_do_prot_rw(struct se_cmd *cmd, struct fd_prot *fd_prot,
+ struct se_device *se_dev = cmd->se_dev;
+ struct fd_dev *dev = FD_DEV(se_dev);
+ struct file *prot_fd = dev->fd_prot_file;
+- struct scatterlist *sg;
+ loff_t pos = (cmd->t_task_lba * se_dev->prot_length);
+ unsigned char *buf;
+- u32 prot_size, len, size;
+- int rc, ret = 1, i;
++ u32 prot_size;
++ int rc, ret = 1;
+
+ prot_size = (cmd->data_length / se_dev->dev_attrib.block_size) *
+ se_dev->prot_length;
+
+ if (!is_write) {
+- fd_prot->prot_buf = vzalloc(prot_size);
++ fd_prot->prot_buf = kzalloc(prot_size, GFP_KERNEL);
+ if (!fd_prot->prot_buf) {
+ pr_err("Unable to allocate fd_prot->prot_buf\n");
+ return -ENOMEM;
+ }
+ buf = fd_prot->prot_buf;
+
+- fd_prot->prot_sg_nents = cmd->t_prot_nents;
+- fd_prot->prot_sg = kzalloc(sizeof(struct scatterlist) *
+- fd_prot->prot_sg_nents, GFP_KERNEL);
++ fd_prot->prot_sg_nents = 1;
++ fd_prot->prot_sg = kzalloc(sizeof(struct scatterlist),
++ GFP_KERNEL);
+ if (!fd_prot->prot_sg) {
+ pr_err("Unable to allocate fd_prot->prot_sg\n");
+- vfree(fd_prot->prot_buf);
++ kfree(fd_prot->prot_buf);
+ return -ENOMEM;
+ }
+- size = prot_size;
+-
+- for_each_sg(fd_prot->prot_sg, sg, fd_prot->prot_sg_nents, i) {
+-
+- len = min_t(u32, PAGE_SIZE, size);
+- sg_set_buf(sg, buf, len);
+- size -= len;
+- buf += len;
+- }
++ sg_init_table(fd_prot->prot_sg, fd_prot->prot_sg_nents);
++ sg_set_buf(fd_prot->prot_sg, buf, prot_size);
+ }
+
+ if (is_write) {
+@@ -317,7 +309,7 @@ static int fd_do_prot_rw(struct se_cmd *cmd, struct fd_prot *fd_prot,
+
+ if (is_write || ret < 0) {
+ kfree(fd_prot->prot_sg);
+- vfree(fd_prot->prot_buf);
++ kfree(fd_prot->prot_buf);
+ }
+
+ return ret;
+@@ -543,6 +535,56 @@ fd_execute_write_same(struct se_cmd *cmd)
+ return 0;
+ }
+
++static int
++fd_do_prot_fill(struct se_device *se_dev, sector_t lba, sector_t nolb,
++ void *buf, size_t bufsize)
++{
++ struct fd_dev *fd_dev = FD_DEV(se_dev);
++ struct file *prot_fd = fd_dev->fd_prot_file;
++ sector_t prot_length, prot;
++ loff_t pos = lba * se_dev->prot_length;
++
++ if (!prot_fd) {
++ pr_err("Unable to locate fd_dev->fd_prot_file\n");
++ return -ENODEV;
++ }
++
++ prot_length = nolb * se_dev->prot_length;
++
++ for (prot = 0; prot < prot_length;) {
++ sector_t len = min_t(sector_t, bufsize, prot_length - prot);
++ ssize_t ret = kernel_write(prot_fd, buf, len, pos + prot);
++
++ if (ret != len) {
++ pr_err("vfs_write to prot file failed: %zd\n", ret);
++ return ret < 0 ? ret : -ENODEV;
++ }
++ prot += ret;
++ }
++
++ return 0;
++}
++
++static int
++fd_do_prot_unmap(struct se_cmd *cmd, sector_t lba, sector_t nolb)
++{
++ void *buf;
++ int rc;
++
++ buf = (void *)__get_free_page(GFP_KERNEL);
++ if (!buf) {
++ pr_err("Unable to allocate FILEIO prot buf\n");
++ return -ENOMEM;
++ }
++ memset(buf, 0xff, PAGE_SIZE);
++
++ rc = fd_do_prot_fill(cmd->se_dev, lba, nolb, buf, PAGE_SIZE);
++
++ free_page((unsigned long)buf);
++
++ return rc;
++}
++
+ static sense_reason_t
+ fd_do_unmap(struct se_cmd *cmd, void *priv, sector_t lba, sector_t nolb)
+ {
+@@ -550,6 +592,12 @@ fd_do_unmap(struct se_cmd *cmd, void *priv, sector_t lba, sector_t nolb)
+ struct inode *inode = file->f_mapping->host;
+ int ret;
+
++ if (cmd->se_dev->dev_attrib.pi_prot_type) {
++ ret = fd_do_prot_unmap(cmd, lba, nolb);
++ if (ret)
++ return TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
++ }
++
+ if (S_ISBLK(inode->i_mode)) {
+ /* The backend is block device, use discard */
+ struct block_device *bdev = inode->i_bdev;
+@@ -652,11 +700,11 @@ fd_execute_rw(struct se_cmd *cmd, struct scatterlist *sgl, u32 sgl_nents,
+ 0, fd_prot.prot_sg, 0);
+ if (rc) {
+ kfree(fd_prot.prot_sg);
+- vfree(fd_prot.prot_buf);
++ kfree(fd_prot.prot_buf);
+ return rc;
+ }
+ kfree(fd_prot.prot_sg);
+- vfree(fd_prot.prot_buf);
++ kfree(fd_prot.prot_buf);
+ }
+ } else {
+ memset(&fd_prot, 0, sizeof(struct fd_prot));
+@@ -672,7 +720,7 @@ fd_execute_rw(struct se_cmd *cmd, struct scatterlist *sgl, u32 sgl_nents,
+ 0, fd_prot.prot_sg, 0);
+ if (rc) {
+ kfree(fd_prot.prot_sg);
+- vfree(fd_prot.prot_buf);
++ kfree(fd_prot.prot_buf);
+ return rc;
+ }
+ }
+@@ -708,7 +756,7 @@ fd_execute_rw(struct se_cmd *cmd, struct scatterlist *sgl, u32 sgl_nents,
+
+ if (ret < 0) {
+ kfree(fd_prot.prot_sg);
+- vfree(fd_prot.prot_buf);
++ kfree(fd_prot.prot_buf);
+ return TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
+ }
+
+@@ -872,48 +920,28 @@ static int fd_init_prot(struct se_device *dev)
+
+ static int fd_format_prot(struct se_device *dev)
+ {
+- struct fd_dev *fd_dev = FD_DEV(dev);
+- struct file *prot_fd = fd_dev->fd_prot_file;
+- sector_t prot_length, prot;
+ unsigned char *buf;
+- loff_t pos = 0;
+ int unit_size = FDBD_FORMAT_UNIT_SIZE * dev->dev_attrib.block_size;
+- int rc, ret = 0, size, len;
++ int ret;
+
+ if (!dev->dev_attrib.pi_prot_type) {
+ pr_err("Unable to format_prot while pi_prot_type == 0\n");
+ return -ENODEV;
+ }
+- if (!prot_fd) {
+- pr_err("Unable to locate fd_dev->fd_prot_file\n");
+- return -ENODEV;
+- }
+
+ buf = vzalloc(unit_size);
+ if (!buf) {
+ pr_err("Unable to allocate FILEIO prot buf\n");
+ return -ENOMEM;
+ }
+- prot_length = (dev->transport->get_blocks(dev) + 1) * dev->prot_length;
+- size = prot_length;
+
+ pr_debug("Using FILEIO prot_length: %llu\n",
+- (unsigned long long)prot_length);
++ (unsigned long long)(dev->transport->get_blocks(dev) + 1) *
++ dev->prot_length);
+
+ memset(buf, 0xff, unit_size);
+- for (prot = 0; prot < prot_length; prot += unit_size) {
+- len = min(unit_size, size);
+- rc = kernel_write(prot_fd, buf, len, pos);
+- if (rc != len) {
+- pr_err("vfs_write to prot file failed: %d\n", rc);
+- ret = -ENODEV;
+- goto out;
+- }
+- pos += len;
+- size -= len;
+- }
+-
+-out:
++ ret = fd_do_prot_fill(dev, 0, dev->transport->get_blocks(dev) + 1,
++ buf, unit_size);
+ vfree(buf);
+ return ret;
+ }
+diff --git a/drivers/target/target_core_sbc.c b/drivers/target/target_core_sbc.c
+index 565c0da9d99d..fa89c2f105e6 100644
+--- a/drivers/target/target_core_sbc.c
++++ b/drivers/target/target_core_sbc.c
+@@ -299,7 +299,7 @@ sbc_setup_write_same(struct se_cmd *cmd, unsigned char *flags, struct sbc_ops *o
+ return 0;
+ }
+
+-static sense_reason_t xdreadwrite_callback(struct se_cmd *cmd)
++static sense_reason_t xdreadwrite_callback(struct se_cmd *cmd, bool success)
+ {
+ unsigned char *buf, *addr;
+ struct scatterlist *sg;
+@@ -363,7 +363,7 @@ sbc_execute_rw(struct se_cmd *cmd)
+ cmd->data_direction);
+ }
+
+-static sense_reason_t compare_and_write_post(struct se_cmd *cmd)
++static sense_reason_t compare_and_write_post(struct se_cmd *cmd, bool success)
+ {
+ struct se_device *dev = cmd->se_dev;
+
+@@ -386,7 +386,7 @@ static sense_reason_t compare_and_write_post(struct se_cmd *cmd)
+ return TCM_NO_SENSE;
+ }
+
+-static sense_reason_t compare_and_write_callback(struct se_cmd *cmd)
++static sense_reason_t compare_and_write_callback(struct se_cmd *cmd, bool success)
+ {
+ struct se_device *dev = cmd->se_dev;
+ struct scatterlist *write_sg = NULL, *sg;
+@@ -401,11 +401,16 @@ static sense_reason_t compare_and_write_callback(struct se_cmd *cmd)
+
+ /*
+ * Handle early failure in transport_generic_request_failure(),
+- * which will not have taken ->caw_mutex yet..
++ * which will not have taken ->caw_sem yet..
+ */
+- if (!cmd->t_data_sg || !cmd->t_bidi_data_sg)
++ if (!success && (!cmd->t_data_sg || !cmd->t_bidi_data_sg))
+ return TCM_NO_SENSE;
+ /*
++ * Handle special case for zero-length COMPARE_AND_WRITE
++ */
++ if (!cmd->data_length)
++ goto out;
++ /*
+ * Immediately exit + release dev->caw_sem if command has already
+ * been failed with a non-zero SCSI status.
+ */
+diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
+index 2e0998420254..e786e9104c41 100644
+--- a/drivers/target/target_core_transport.c
++++ b/drivers/target/target_core_transport.c
+@@ -1615,11 +1615,11 @@ void transport_generic_request_failure(struct se_cmd *cmd,
+ transport_complete_task_attr(cmd);
+ /*
+ * Handle special case for COMPARE_AND_WRITE failure, where the
+- * callback is expected to drop the per device ->caw_mutex.
++ * callback is expected to drop the per device ->caw_sem.
+ */
+ if ((cmd->se_cmd_flags & SCF_COMPARE_AND_WRITE) &&
+ cmd->transport_complete_callback)
+- cmd->transport_complete_callback(cmd);
++ cmd->transport_complete_callback(cmd, false);
+
+ switch (sense_reason) {
+ case TCM_NON_EXISTENT_LUN:
+@@ -1975,8 +1975,12 @@ static void target_complete_ok_work(struct work_struct *work)
+ if (cmd->transport_complete_callback) {
+ sense_reason_t rc;
+
+- rc = cmd->transport_complete_callback(cmd);
++ rc = cmd->transport_complete_callback(cmd, true);
+ if (!rc && !(cmd->se_cmd_flags & SCF_COMPARE_AND_WRITE_POST)) {
++ if ((cmd->se_cmd_flags & SCF_COMPARE_AND_WRITE) &&
++ !cmd->data_length)
++ goto queue_rsp;
++
+ return;
+ } else if (rc) {
+ ret = transport_send_check_condition_and_sense(cmd,
+@@ -1990,6 +1994,7 @@ static void target_complete_ok_work(struct work_struct *work)
+ }
+ }
+
++queue_rsp:
+ switch (cmd->data_direction) {
+ case DMA_FROM_DEVICE:
+ spin_lock(&cmd->se_lun->lun_sep_lock);
+@@ -2094,6 +2099,16 @@ static inline void transport_reset_sgl_orig(struct se_cmd *cmd)
+ static inline void transport_free_pages(struct se_cmd *cmd)
+ {
+ if (cmd->se_cmd_flags & SCF_PASSTHROUGH_SG_TO_MEM_NOALLOC) {
++ /*
++ * Release special case READ buffer payload required for
++ * SG_TO_MEM_NOALLOC to function with COMPARE_AND_WRITE
++ */
++ if (cmd->se_cmd_flags & SCF_COMPARE_AND_WRITE) {
++ transport_free_sgl(cmd->t_bidi_data_sg,
++ cmd->t_bidi_data_nents);
++ cmd->t_bidi_data_sg = NULL;
++ cmd->t_bidi_data_nents = 0;
++ }
+ transport_reset_sgl_orig(cmd);
+ return;
+ }
+@@ -2246,6 +2261,7 @@ sense_reason_t
+ transport_generic_new_cmd(struct se_cmd *cmd)
+ {
+ int ret = 0;
++ bool zero_flag = !(cmd->se_cmd_flags & SCF_SCSI_DATA_CDB);
+
+ /*
+ * Determine is the TCM fabric module has already allocated physical
+@@ -2254,7 +2270,6 @@ transport_generic_new_cmd(struct se_cmd *cmd)
+ */
+ if (!(cmd->se_cmd_flags & SCF_PASSTHROUGH_SG_TO_MEM_NOALLOC) &&
+ cmd->data_length) {
+- bool zero_flag = !(cmd->se_cmd_flags & SCF_SCSI_DATA_CDB);
+
+ if ((cmd->se_cmd_flags & SCF_BIDI) ||
+ (cmd->se_cmd_flags & SCF_COMPARE_AND_WRITE)) {
+@@ -2285,6 +2300,20 @@ transport_generic_new_cmd(struct se_cmd *cmd)
+ cmd->data_length, zero_flag);
+ if (ret < 0)
+ return TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
++ } else if ((cmd->se_cmd_flags & SCF_COMPARE_AND_WRITE) &&
++ cmd->data_length) {
++ /*
++ * Special case for COMPARE_AND_WRITE with fabrics
++ * using SCF_PASSTHROUGH_SG_TO_MEM_NOALLOC.
++ */
++ u32 caw_length = cmd->t_task_nolb *
++ cmd->se_dev->dev_attrib.block_size;
++
++ ret = target_alloc_sgl(&cmd->t_bidi_data_sg,
++ &cmd->t_bidi_data_nents,
++ caw_length, zero_flag);
++ if (ret < 0)
++ return TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
+ }
+ /*
+ * If this command is not a write we can execute it right here,
+diff --git a/drivers/tty/serial/atmel_serial.c b/drivers/tty/serial/atmel_serial.c
+index 6ee5c6cefac0..11300f7b49cb 100644
+--- a/drivers/tty/serial/atmel_serial.c
++++ b/drivers/tty/serial/atmel_serial.c
+@@ -861,6 +861,7 @@ static int atmel_prepare_tx_dma(struct uart_port *port)
+ config.direction = DMA_MEM_TO_DEV;
+ config.dst_addr_width = DMA_SLAVE_BUSWIDTH_1_BYTE;
+ config.dst_addr = port->mapbase + ATMEL_US_THR;
++ config.dst_maxburst = 1;
+
+ ret = dmaengine_device_control(atmel_port->chan_tx,
+ DMA_SLAVE_CONFIG,
+@@ -1025,6 +1026,7 @@ static int atmel_prepare_rx_dma(struct uart_port *port)
+ config.direction = DMA_DEV_TO_MEM;
+ config.src_addr_width = DMA_SLAVE_BUSWIDTH_1_BYTE;
+ config.src_addr = port->mapbase + ATMEL_US_RHR;
++ config.src_maxburst = 1;
+
+ ret = dmaengine_device_control(atmel_port->chan_rx,
+ DMA_SLAVE_CONFIG,
+diff --git a/drivers/tty/serial/of_serial.c b/drivers/tty/serial/of_serial.c
+index bf355050eab6..2e4b545f1823 100644
+--- a/drivers/tty/serial/of_serial.c
++++ b/drivers/tty/serial/of_serial.c
+@@ -262,7 +262,6 @@ static struct of_device_id of_platform_serial_table[] = {
+ { .compatible = "ibm,qpace-nwp-serial",
+ .data = (void *)PORT_NWPSERIAL, },
+ #endif
+- { .type = "serial", .data = (void *)PORT_UNKNOWN, },
+ { /* end of list */ },
+ };
+
+diff --git a/drivers/tty/serial/uartlite.c b/drivers/tty/serial/uartlite.c
+index 189f52e3111f..a0099a7f60d4 100644
+--- a/drivers/tty/serial/uartlite.c
++++ b/drivers/tty/serial/uartlite.c
+@@ -632,7 +632,8 @@ MODULE_DEVICE_TABLE(of, ulite_of_match);
+
+ static int ulite_probe(struct platform_device *pdev)
+ {
+- struct resource *res, *res2;
++ struct resource *res;
++ int irq;
+ int id = pdev->id;
+ #ifdef CONFIG_OF
+ const __be32 *prop;
+@@ -646,11 +647,11 @@ static int ulite_probe(struct platform_device *pdev)
+ if (!res)
+ return -ENODEV;
+
+- res2 = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
+- if (!res2)
+- return -ENODEV;
++ irq = platform_get_irq(pdev, 0);
++ if (irq <= 0)
++ return -ENXIO;
+
+- return ulite_assign(&pdev->dev, id, res->start, res2->start);
++ return ulite_assign(&pdev->dev, id, res->start, irq);
+ }
+
+ static int ulite_remove(struct platform_device *pdev)
+diff --git a/drivers/tty/serial/xilinx_uartps.c b/drivers/tty/serial/xilinx_uartps.c
+index 200c1af2141b..fabde0e878e0 100644
+--- a/drivers/tty/serial/xilinx_uartps.c
++++ b/drivers/tty/serial/xilinx_uartps.c
+@@ -1303,9 +1303,9 @@ static SIMPLE_DEV_PM_OPS(cdns_uart_dev_pm_ops, cdns_uart_suspend,
+ */
+ static int cdns_uart_probe(struct platform_device *pdev)
+ {
+- int rc, id;
++ int rc, id, irq;
+ struct uart_port *port;
+- struct resource *res, *res2;
++ struct resource *res;
+ struct cdns_uart *cdns_uart_data;
+
+ cdns_uart_data = devm_kzalloc(&pdev->dev, sizeof(*cdns_uart_data),
+@@ -1352,9 +1352,9 @@ static int cdns_uart_probe(struct platform_device *pdev)
+ goto err_out_clk_disable;
+ }
+
+- res2 = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
+- if (!res2) {
+- rc = -ENODEV;
++ irq = platform_get_irq(pdev, 0);
++ if (irq <= 0) {
++ rc = -ENXIO;
+ goto err_out_clk_disable;
+ }
+
+@@ -1383,7 +1383,7 @@ static int cdns_uart_probe(struct platform_device *pdev)
+ * and triggers invocation of the config_port() entry point.
+ */
+ port->mapbase = res->start;
+- port->irq = res2->start;
++ port->irq = irq;
+ port->dev = &pdev->dev;
+ port->uartclk = clk_get_rate(cdns_uart_data->uartclk);
+ port->private_data = cdns_uart_data;
+diff --git a/drivers/usb/chipidea/otg_fsm.c b/drivers/usb/chipidea/otg_fsm.c
+index caaabc58021e..34a52cd7bfb7 100644
+--- a/drivers/usb/chipidea/otg_fsm.c
++++ b/drivers/usb/chipidea/otg_fsm.c
+@@ -537,7 +537,6 @@ static int ci_otg_start_host(struct otg_fsm *fsm, int on)
+ {
+ struct ci_hdrc *ci = container_of(fsm, struct ci_hdrc, fsm);
+
+- mutex_unlock(&fsm->lock);
+ if (on) {
+ ci_role_stop(ci);
+ ci_role_start(ci, CI_ROLE_HOST);
+@@ -546,7 +545,6 @@ static int ci_otg_start_host(struct otg_fsm *fsm, int on)
+ hw_device_reset(ci, USBMODE_CM_DC);
+ ci_role_start(ci, CI_ROLE_GADGET);
+ }
+- mutex_lock(&fsm->lock);
+ return 0;
+ }
+
+@@ -554,12 +552,10 @@ static int ci_otg_start_gadget(struct otg_fsm *fsm, int on)
+ {
+ struct ci_hdrc *ci = container_of(fsm, struct ci_hdrc, fsm);
+
+- mutex_unlock(&fsm->lock);
+ if (on)
+ usb_gadget_vbus_connect(&ci->gadget);
+ else
+ usb_gadget_vbus_disconnect(&ci->gadget);
+- mutex_lock(&fsm->lock);
+
+ return 0;
+ }
+diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
+index 64d9c3daa856..12d37aedc66f 100644
+--- a/drivers/usb/class/cdc-acm.c
++++ b/drivers/usb/class/cdc-acm.c
+@@ -1091,6 +1091,7 @@ static int acm_probe(struct usb_interface *intf,
+ unsigned long quirks;
+ int num_rx_buf;
+ int i;
++ unsigned int elength = 0;
+ int combined_interfaces = 0;
+ struct device *tty_dev;
+ int rv = -ENOMEM;
+@@ -1132,13 +1133,22 @@ static int acm_probe(struct usb_interface *intf,
+ }
+
+ while (buflen > 0) {
++ elength = buffer[0];
++ if (!elength) {
++ dev_err(&intf->dev, "skipping garbage byte\n");
++ elength = 1;
++ goto next_desc;
++ }
+ if (buffer[1] != USB_DT_CS_INTERFACE) {
+ dev_err(&intf->dev, "skipping garbage\n");
+ goto next_desc;
+ }
++ elength = buffer[0];
+
+ switch (buffer[2]) {
+ case USB_CDC_UNION_TYPE: /* we've found it */
++ if (elength < sizeof(struct usb_cdc_union_desc))
++ goto next_desc;
+ if (union_header) {
+ dev_err(&intf->dev, "More than one "
+ "union descriptor, skipping ...\n");
+@@ -1147,31 +1157,38 @@ static int acm_probe(struct usb_interface *intf,
+ union_header = (struct usb_cdc_union_desc *)buffer;
+ break;
+ case USB_CDC_COUNTRY_TYPE: /* export through sysfs*/
++ if (elength < sizeof(struct usb_cdc_country_functional_desc))
++ goto next_desc;
+ cfd = (struct usb_cdc_country_functional_desc *)buffer;
+ break;
+ case USB_CDC_HEADER_TYPE: /* maybe check version */
+ break; /* for now we ignore it */
+ case USB_CDC_ACM_TYPE:
++ if (elength < 4)
++ goto next_desc;
+ ac_management_function = buffer[3];
+ break;
+ case USB_CDC_CALL_MANAGEMENT_TYPE:
++ if (elength < 5)
++ goto next_desc;
+ call_management_function = buffer[3];
+ call_interface_num = buffer[4];
+ if ((quirks & NOT_A_MODEM) == 0 && (call_management_function & 3) != 3)
+ dev_err(&intf->dev, "This device cannot do calls on its own. It is not a modem.\n");
+ break;
+ default:
+- /* there are LOTS more CDC descriptors that
++ /*
++ * there are LOTS more CDC descriptors that
+ * could legitimately be found here.
+ */
+ dev_dbg(&intf->dev, "Ignoring descriptor: "
+- "type %02x, length %d\n",
+- buffer[2], buffer[0]);
++ "type %02x, length %ud\n",
++ buffer[2], elength);
+ break;
+ }
+ next_desc:
+- buflen -= buffer[0];
+- buffer += buffer[0];
++ buflen -= elength;
++ buffer += elength;
+ }
+
+ if (!union_header) {
+diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c
+index a051a7a2b1bd..a81f9dd7ee97 100644
+--- a/drivers/usb/class/cdc-wdm.c
++++ b/drivers/usb/class/cdc-wdm.c
+@@ -245,7 +245,7 @@ static void wdm_int_callback(struct urb *urb)
+ case USB_CDC_NOTIFY_RESPONSE_AVAILABLE:
+ dev_dbg(&desc->intf->dev,
+ "NOTIFY_RESPONSE_AVAILABLE received: index %d len %d",
+- dr->wIndex, dr->wLength);
++ le16_to_cpu(dr->wIndex), le16_to_cpu(dr->wLength));
+ break;
+
+ case USB_CDC_NOTIFY_NETWORK_CONNECTION:
+@@ -262,7 +262,9 @@ static void wdm_int_callback(struct urb *urb)
+ clear_bit(WDM_POLL_RUNNING, &desc->flags);
+ dev_err(&desc->intf->dev,
+ "unknown notification %d received: index %d len %d\n",
+- dr->bNotificationType, dr->wIndex, dr->wLength);
++ dr->bNotificationType,
++ le16_to_cpu(dr->wIndex),
++ le16_to_cpu(dr->wLength));
+ goto exit;
+ }
+
+@@ -408,7 +410,7 @@ static ssize_t wdm_write
+ USB_RECIP_INTERFACE);
+ req->bRequest = USB_CDC_SEND_ENCAPSULATED_COMMAND;
+ req->wValue = 0;
+- req->wIndex = desc->inum;
++ req->wIndex = desc->inum; /* already converted */
+ req->wLength = cpu_to_le16(count);
+ set_bit(WDM_IN_USE, &desc->flags);
+ desc->outbuf = buf;
+@@ -422,7 +424,7 @@ static ssize_t wdm_write
+ rv = usb_translate_errors(rv);
+ } else {
+ dev_dbg(&desc->intf->dev, "Tx URB has been submitted index=%d",
+- req->wIndex);
++ le16_to_cpu(req->wIndex));
+ }
+ out:
+ usb_autopm_put_interface(desc->intf);
+@@ -820,7 +822,7 @@ static int wdm_create(struct usb_interface *intf, struct usb_endpoint_descriptor
+ desc->irq->bRequestType = (USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_INTERFACE);
+ desc->irq->bRequest = USB_CDC_GET_ENCAPSULATED_RESPONSE;
+ desc->irq->wValue = 0;
+- desc->irq->wIndex = desc->inum;
++ desc->irq->wIndex = desc->inum; /* already converted */
+ desc->irq->wLength = cpu_to_le16(desc->wMaxCommand);
+
+ usb_fill_control_urb(
+diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
+index 2246954d7df3..85e03cb0c418 100644
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -3394,10 +3394,10 @@ int usb_port_resume(struct usb_device *udev, pm_message_t msg)
+ if (status) {
+ dev_dbg(&port_dev->dev, "can't resume, status %d\n", status);
+ } else {
+- /* drive resume for at least 20 msec */
++ /* drive resume for USB_RESUME_TIMEOUT msec */
+ dev_dbg(&udev->dev, "usb %sresume\n",
+ (PMSG_IS_AUTO(msg) ? "auto-" : ""));
+- msleep(25);
++ msleep(USB_RESUME_TIMEOUT);
+
+ /* Virtual root hubs can trigger on GET_PORT_STATUS to
+ * stop resume signaling. Then finish the resume
+diff --git a/drivers/usb/gadget/legacy/printer.c b/drivers/usb/gadget/legacy/printer.c
+index 6474081dcbaf..c9c6dae75c13 100644
+--- a/drivers/usb/gadget/legacy/printer.c
++++ b/drivers/usb/gadget/legacy/printer.c
+@@ -980,6 +980,15 @@ unknown:
+ break;
+ }
+ /* host either stalls (value < 0) or reports success */
++ if (value >= 0) {
++ req->length = value;
++ req->zero = value < wLength;
++ value = usb_ep_queue(cdev->gadget->ep0, req, GFP_ATOMIC);
++ if (value < 0) {
++ ERROR(dev, "%s:%d Error!\n", __func__, __LINE__);
++ req->status = 0;
++ }
++ }
+ return value;
+ }
+
+diff --git a/drivers/usb/host/ehci-hcd.c b/drivers/usb/host/ehci-hcd.c
+index 15feaf924b71..3df32fa8c8ae 100644
+--- a/drivers/usb/host/ehci-hcd.c
++++ b/drivers/usb/host/ehci-hcd.c
+@@ -787,12 +787,12 @@ static irqreturn_t ehci_irq (struct usb_hcd *hcd)
+ ehci->reset_done[i] == 0))
+ continue;
+
+- /* start 20 msec resume signaling from this port,
+- * and make hub_wq collect PORT_STAT_C_SUSPEND to
+- * stop that signaling. Use 5 ms extra for safety,
+- * like usb_port_resume() does.
++ /* start USB_RESUME_TIMEOUT msec resume signaling from
++ * this port, and make hub_wq collect
++ * PORT_STAT_C_SUSPEND to stop that signaling.
+ */
+- ehci->reset_done[i] = jiffies + msecs_to_jiffies(25);
++ ehci->reset_done[i] = jiffies +
++ msecs_to_jiffies(USB_RESUME_TIMEOUT);
+ set_bit(i, &ehci->resuming_ports);
+ ehci_dbg (ehci, "port %d remote wakeup\n", i + 1);
+ usb_hcd_start_port_resume(&hcd->self, i);
+diff --git a/drivers/usb/host/ehci-hub.c b/drivers/usb/host/ehci-hub.c
+index 5728829cf6ef..ecd5d6a55ca3 100644
+--- a/drivers/usb/host/ehci-hub.c
++++ b/drivers/usb/host/ehci-hub.c
+@@ -473,10 +473,13 @@ static int ehci_bus_resume (struct usb_hcd *hcd)
+ ehci_writel(ehci, temp, &ehci->regs->port_status [i]);
+ }
+
+- /* msleep for 20ms only if code is trying to resume port */
++ /*
++ * msleep for USB_RESUME_TIMEOUT ms only if code is trying to resume
++ * port
++ */
+ if (resume_needed) {
+ spin_unlock_irq(&ehci->lock);
+- msleep(20);
++ msleep(USB_RESUME_TIMEOUT);
+ spin_lock_irq(&ehci->lock);
+ if (ehci->shutdown)
+ goto shutdown;
+@@ -944,7 +947,7 @@ int ehci_hub_control(
+ temp &= ~PORT_WAKE_BITS;
+ ehci_writel(ehci, temp | PORT_RESUME, status_reg);
+ ehci->reset_done[wIndex] = jiffies
+- + msecs_to_jiffies(20);
++ + msecs_to_jiffies(USB_RESUME_TIMEOUT);
+ set_bit(wIndex, &ehci->resuming_ports);
+ usb_hcd_start_port_resume(&hcd->self, wIndex);
+ break;
+diff --git a/drivers/usb/host/fotg210-hcd.c b/drivers/usb/host/fotg210-hcd.c
+index 3de1278677d0..a2fbb0b3db31 100644
+--- a/drivers/usb/host/fotg210-hcd.c
++++ b/drivers/usb/host/fotg210-hcd.c
+@@ -1595,7 +1595,7 @@ static int fotg210_hub_control(
+ /* resume signaling for 20 msec */
+ fotg210_writel(fotg210, temp | PORT_RESUME, status_reg);
+ fotg210->reset_done[wIndex] = jiffies
+- + msecs_to_jiffies(20);
++ + msecs_to_jiffies(USB_RESUME_TIMEOUT);
+ break;
+ case USB_PORT_FEAT_C_SUSPEND:
+ clear_bit(wIndex, &fotg210->port_c_suspend);
+diff --git a/drivers/usb/host/fusbh200-hcd.c b/drivers/usb/host/fusbh200-hcd.c
+index abe42f31559f..50fa8f2eabe3 100644
+--- a/drivers/usb/host/fusbh200-hcd.c
++++ b/drivers/usb/host/fusbh200-hcd.c
+@@ -1550,10 +1550,9 @@ static int fusbh200_hub_control (
+ if ((temp & PORT_PE) == 0)
+ goto error;
+
+- /* resume signaling for 20 msec */
+ fusbh200_writel(fusbh200, temp | PORT_RESUME, status_reg);
+ fusbh200->reset_done[wIndex] = jiffies
+- + msecs_to_jiffies(20);
++ + msecs_to_jiffies(USB_RESUME_TIMEOUT);
+ break;
+ case USB_PORT_FEAT_C_SUSPEND:
+ clear_bit(wIndex, &fusbh200->port_c_suspend);
+diff --git a/drivers/usb/host/isp116x-hcd.c b/drivers/usb/host/isp116x-hcd.c
+index 240e792c81a7..b62298fe0be8 100644
+--- a/drivers/usb/host/isp116x-hcd.c
++++ b/drivers/usb/host/isp116x-hcd.c
+@@ -1487,7 +1487,7 @@ static int isp116x_bus_resume(struct usb_hcd *hcd)
+ spin_unlock_irq(&isp116x->lock);
+
+ hcd->state = HC_STATE_RESUMING;
+- msleep(20);
++ msleep(USB_RESUME_TIMEOUT);
+
+ /* Go operational */
+ spin_lock_irq(&isp116x->lock);
+diff --git a/drivers/usb/host/oxu210hp-hcd.c b/drivers/usb/host/oxu210hp-hcd.c
+index 4fe79a2d71a9..c3d4074309f8 100644
+--- a/drivers/usb/host/oxu210hp-hcd.c
++++ b/drivers/usb/host/oxu210hp-hcd.c
+@@ -2500,11 +2500,12 @@ static irqreturn_t oxu210_hcd_irq(struct usb_hcd *hcd)
+ || oxu->reset_done[i] != 0)
+ continue;
+
+- /* start 20 msec resume signaling from this port,
+- * and make hub_wq collect PORT_STAT_C_SUSPEND to
++ /* start USB_RESUME_TIMEOUT resume signaling from this
++ * port, and make hub_wq collect PORT_STAT_C_SUSPEND to
+ * stop that signaling.
+ */
+- oxu->reset_done[i] = jiffies + msecs_to_jiffies(20);
++ oxu->reset_done[i] = jiffies +
++ msecs_to_jiffies(USB_RESUME_TIMEOUT);
+ oxu_dbg(oxu, "port %d remote wakeup\n", i + 1);
+ mod_timer(&hcd->rh_timer, oxu->reset_done[i]);
+ }
+diff --git a/drivers/usb/host/r8a66597-hcd.c b/drivers/usb/host/r8a66597-hcd.c
+index 110b4b9ebeaa..f130bb2f7bbe 100644
+--- a/drivers/usb/host/r8a66597-hcd.c
++++ b/drivers/usb/host/r8a66597-hcd.c
+@@ -2300,7 +2300,7 @@ static int r8a66597_bus_resume(struct usb_hcd *hcd)
+ rh->port &= ~USB_PORT_STAT_SUSPEND;
+ rh->port |= USB_PORT_STAT_C_SUSPEND << 16;
+ r8a66597_mdfy(r8a66597, RESUME, RESUME | UACT, dvstctr_reg);
+- msleep(50);
++ msleep(USB_RESUME_TIMEOUT);
+ r8a66597_mdfy(r8a66597, UACT, RESUME | UACT, dvstctr_reg);
+ }
+
+diff --git a/drivers/usb/host/sl811-hcd.c b/drivers/usb/host/sl811-hcd.c
+index ad0c348e68e9..17f97f999c38 100644
+--- a/drivers/usb/host/sl811-hcd.c
++++ b/drivers/usb/host/sl811-hcd.c
+@@ -1259,7 +1259,7 @@ sl811h_hub_control(
+ sl811_write(sl811, SL11H_CTLREG1, sl811->ctrl1);
+
+ mod_timer(&sl811->timer, jiffies
+- + msecs_to_jiffies(20));
++ + msecs_to_jiffies(USB_RESUME_TIMEOUT));
+ break;
+ case USB_PORT_FEAT_POWER:
+ port_power(sl811, 0);
+diff --git a/drivers/usb/host/uhci-hub.c b/drivers/usb/host/uhci-hub.c
+index 93e17b12fb33..98c66d88ebde 100644
+--- a/drivers/usb/host/uhci-hub.c
++++ b/drivers/usb/host/uhci-hub.c
+@@ -165,7 +165,7 @@ static void uhci_check_ports(struct uhci_hcd *uhci)
+ /* Port received a wakeup request */
+ set_bit(port, &uhci->resuming_ports);
+ uhci->ports_timeout = jiffies +
+- msecs_to_jiffies(25);
++ msecs_to_jiffies(USB_RESUME_TIMEOUT);
+ usb_hcd_start_port_resume(
+ &uhci_to_hcd(uhci)->self, port);
+
+@@ -337,7 +337,8 @@ static int uhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
+ uhci_finish_suspend(uhci, port, port_addr);
+
+ /* USB v2.0 7.1.7.5 */
+- uhci->ports_timeout = jiffies + msecs_to_jiffies(50);
++ uhci->ports_timeout = jiffies +
++ msecs_to_jiffies(USB_RESUME_TIMEOUT);
+ break;
+ case USB_PORT_FEAT_POWER:
+ /* UHCI has no power switching */
+diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
+index 338f19cc0973..3307e161c100 100644
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -1576,7 +1576,7 @@ static void handle_port_status(struct xhci_hcd *xhci,
+ } else {
+ xhci_dbg(xhci, "resume HS port %d\n", port_id);
+ bus_state->resume_done[faked_port_index] = jiffies +
+- msecs_to_jiffies(20);
++ msecs_to_jiffies(USB_RESUME_TIMEOUT);
+ set_bit(faked_port_index, &bus_state->resuming_ports);
+ mod_timer(&hcd->rh_timer,
+ bus_state->resume_done[faked_port_index]);
+diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c
+index b841ee0bff06..6d63efce3706 100644
+--- a/drivers/usb/musb/musb_core.c
++++ b/drivers/usb/musb/musb_core.c
+@@ -99,6 +99,7 @@
+ #include <linux/platform_device.h>
+ #include <linux/io.h>
+ #include <linux/dma-mapping.h>
++#include <linux/usb.h>
+
+ #include "musb_core.h"
+
+@@ -480,7 +481,7 @@ static irqreturn_t musb_stage0_irq(struct musb *musb, u8 int_usb,
+ + msecs_to_jiffies(20);
+ schedule_delayed_work(
+ &musb->finish_resume_work,
+- msecs_to_jiffies(20));
++ msecs_to_jiffies(USB_RESUME_TIMEOUT));
+
+ musb->xceiv->state = OTG_STATE_A_HOST;
+ musb->is_active = 1;
+@@ -1521,16 +1522,30 @@ irqreturn_t musb_interrupt(struct musb *musb)
+ is_host_active(musb) ? "host" : "peripheral",
+ musb->int_usb, musb->int_tx, musb->int_rx);
+
+- /* the core can interrupt us for multiple reasons; docs have
+- * a generic interrupt flowchart to follow
++ /**
++ * According to Mentor Graphics' documentation, flowchart on page 98,
++ * IRQ should be handled as follows:
++ *
++ * . Resume IRQ
++ * . Session Request IRQ
++ * . VBUS Error IRQ
++ * . Suspend IRQ
++ * . Connect IRQ
++ * . Disconnect IRQ
++ * . Reset/Babble IRQ
++ * . SOF IRQ (we're not using this one)
++ * . Endpoint 0 IRQ
++ * . TX Endpoints
++ * . RX Endpoints
++ *
++ * We will be following that flowchart in order to avoid any problems
++ * that might arise with internal Finite State Machine.
+ */
++
+ if (musb->int_usb)
+ retval |= musb_stage0_irq(musb, musb->int_usb,
+ devctl);
+
+- /* "stage 1" is handling endpoint irqs */
+-
+- /* handle endpoint 0 first */
+ if (musb->int_tx & 1) {
+ if (is_host_active(musb))
+ retval |= musb_h_ep0_irq(musb);
+@@ -1538,37 +1553,31 @@ irqreturn_t musb_interrupt(struct musb *musb)
+ retval |= musb_g_ep0_irq(musb);
+ }
+
+- /* RX on endpoints 1-15 */
+- reg = musb->int_rx >> 1;
++ reg = musb->int_tx >> 1;
+ ep_num = 1;
+ while (reg) {
+ if (reg & 1) {
+- /* musb_ep_select(musb->mregs, ep_num); */
+- /* REVISIT just retval = ep->rx_irq(...) */
+ retval = IRQ_HANDLED;
+ if (is_host_active(musb))
+- musb_host_rx(musb, ep_num);
++ musb_host_tx(musb, ep_num);
+ else
+- musb_g_rx(musb, ep_num);
++ musb_g_tx(musb, ep_num);
+ }
+-
+ reg >>= 1;
+ ep_num++;
+ }
+
+- /* TX on endpoints 1-15 */
+- reg = musb->int_tx >> 1;
++ reg = musb->int_rx >> 1;
+ ep_num = 1;
+ while (reg) {
+ if (reg & 1) {
+- /* musb_ep_select(musb->mregs, ep_num); */
+- /* REVISIT just retval |= ep->tx_irq(...) */
+ retval = IRQ_HANDLED;
+ if (is_host_active(musb))
+- musb_host_tx(musb, ep_num);
++ musb_host_rx(musb, ep_num);
+ else
+- musb_g_tx(musb, ep_num);
++ musb_g_rx(musb, ep_num);
+ }
++
+ reg >>= 1;
+ ep_num++;
+ }
+diff --git a/drivers/usb/musb/musb_virthub.c b/drivers/usb/musb/musb_virthub.c
+index e2d2d8c9891b..0241a3a0d63e 100644
+--- a/drivers/usb/musb/musb_virthub.c
++++ b/drivers/usb/musb/musb_virthub.c
+@@ -136,7 +136,7 @@ void musb_port_suspend(struct musb *musb, bool do_suspend)
+ /* later, GetPortStatus will stop RESUME signaling */
+ musb->port1_status |= MUSB_PORT_STAT_RESUME;
+ schedule_delayed_work(&musb->finish_resume_work,
+- msecs_to_jiffies(20));
++ msecs_to_jiffies(USB_RESUME_TIMEOUT));
+ }
+ }
+
+diff --git a/drivers/usb/phy/phy.c b/drivers/usb/phy/phy.c
+index 045cd309367a..7e8898d61dcd 100644
+--- a/drivers/usb/phy/phy.c
++++ b/drivers/usb/phy/phy.c
+@@ -78,7 +78,9 @@ static void devm_usb_phy_release(struct device *dev, void *res)
+
+ static int devm_usb_phy_match(struct device *dev, void *res, void *match_data)
+ {
+- return res == match_data;
++ struct usb_phy **phy = res;
++
++ return *phy == match_data;
+ }
+
+ /**
+diff --git a/drivers/usb/storage/uas-detect.h b/drivers/usb/storage/uas-detect.h
+index 8a6f371ed6e7..a451903a6857 100644
+--- a/drivers/usb/storage/uas-detect.h
++++ b/drivers/usb/storage/uas-detect.h
+@@ -51,7 +51,8 @@ static int uas_find_endpoints(struct usb_host_interface *alt,
+ }
+
+ static int uas_use_uas_driver(struct usb_interface *intf,
+- const struct usb_device_id *id)
++ const struct usb_device_id *id,
++ unsigned long *flags_ret)
+ {
+ struct usb_host_endpoint *eps[4] = { };
+ struct usb_device *udev = interface_to_usbdev(intf);
+@@ -80,6 +81,9 @@ static int uas_use_uas_driver(struct usb_interface *intf,
+ flags |= US_FL_IGNORE_UAS;
+ } else if (usb_ss_max_streams(&eps[1]->ss_ep_comp) == 32) {
+ flags |= US_FL_IGNORE_UAS;
++ } else {
++ /* ASM1053, these have issues with large transfers */
++ flags |= US_FL_MAX_SECTORS_240;
+ }
+ }
+
+@@ -109,5 +113,8 @@ static int uas_use_uas_driver(struct usb_interface *intf,
+ return 0;
+ }
+
++ if (flags_ret)
++ *flags_ret = flags;
++
+ return 1;
+ }
+diff --git a/drivers/usb/storage/uas.c b/drivers/usb/storage/uas.c
+index 89b24349269e..2ef0f0abe246 100644
+--- a/drivers/usb/storage/uas.c
++++ b/drivers/usb/storage/uas.c
+@@ -770,7 +770,10 @@ static int uas_eh_bus_reset_handler(struct scsi_cmnd *cmnd)
+
+ static int uas_slave_alloc(struct scsi_device *sdev)
+ {
+- sdev->hostdata = (void *)sdev->host->hostdata;
++ struct uas_dev_info *devinfo =
++ (struct uas_dev_info *)sdev->host->hostdata;
++
++ sdev->hostdata = devinfo;
+
+ /* USB has unusual DMA-alignment requirements: Although the
+ * starting address of each scatter-gather element doesn't matter,
+@@ -789,6 +792,11 @@ static int uas_slave_alloc(struct scsi_device *sdev)
+ */
+ blk_queue_update_dma_alignment(sdev->request_queue, (512 - 1));
+
++ if (devinfo->flags & US_FL_MAX_SECTORS_64)
++ blk_queue_max_hw_sectors(sdev->request_queue, 64);
++ else if (devinfo->flags & US_FL_MAX_SECTORS_240)
++ blk_queue_max_hw_sectors(sdev->request_queue, 240);
++
+ return 0;
+ }
+
+@@ -906,8 +914,9 @@ static int uas_probe(struct usb_interface *intf, const struct usb_device_id *id)
+ struct Scsi_Host *shost = NULL;
+ struct uas_dev_info *devinfo;
+ struct usb_device *udev = interface_to_usbdev(intf);
++ unsigned long dev_flags;
+
+- if (!uas_use_uas_driver(intf, id))
++ if (!uas_use_uas_driver(intf, id, &dev_flags))
+ return -ENODEV;
+
+ if (uas_switch_interface(udev, intf))
+@@ -929,8 +938,7 @@ static int uas_probe(struct usb_interface *intf, const struct usb_device_id *id)
+ devinfo->udev = udev;
+ devinfo->resetting = 0;
+ devinfo->shutdown = 0;
+- devinfo->flags = id->driver_info;
+- usb_stor_adjust_quirks(udev, &devinfo->flags);
++ devinfo->flags = dev_flags;
+ init_usb_anchor(&devinfo->cmd_urbs);
+ init_usb_anchor(&devinfo->sense_urbs);
+ init_usb_anchor(&devinfo->data_urbs);
+diff --git a/drivers/usb/storage/usb.c b/drivers/usb/storage/usb.c
+index 9d66ce62542e..cda42cf779a5 100644
+--- a/drivers/usb/storage/usb.c
++++ b/drivers/usb/storage/usb.c
+@@ -479,7 +479,8 @@ void usb_stor_adjust_quirks(struct usb_device *udev, unsigned long *fflags)
+ US_FL_SINGLE_LUN | US_FL_NO_WP_DETECT |
+ US_FL_NO_READ_DISC_INFO | US_FL_NO_READ_CAPACITY_16 |
+ US_FL_INITIAL_READ10 | US_FL_WRITE_CACHE |
+- US_FL_NO_ATA_1X | US_FL_NO_REPORT_OPCODES);
++ US_FL_NO_ATA_1X | US_FL_NO_REPORT_OPCODES |
++ US_FL_MAX_SECTORS_240);
+
+ p = quirks;
+ while (*p) {
+@@ -520,6 +521,9 @@ void usb_stor_adjust_quirks(struct usb_device *udev, unsigned long *fflags)
+ case 'f':
+ f |= US_FL_NO_REPORT_OPCODES;
+ break;
++ case 'g':
++ f |= US_FL_MAX_SECTORS_240;
++ break;
+ case 'h':
+ f |= US_FL_CAPACITY_HEURISTICS;
+ break;
+@@ -1062,7 +1066,7 @@ static int storage_probe(struct usb_interface *intf,
+
+ /* If uas is enabled and this device can do uas then ignore it. */
+ #if IS_ENABLED(CONFIG_USB_UAS)
+- if (uas_use_uas_driver(intf, id))
++ if (uas_use_uas_driver(intf, id, NULL))
+ return -ENXIO;
+ #endif
+
+diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
+index e1efcaa1b245..3dd249787b11 100644
+--- a/fs/binfmt_elf.c
++++ b/fs/binfmt_elf.c
+@@ -750,6 +750,7 @@ static int load_elf_binary(struct linux_binprm *bprm)
+ i < loc->elf_ex.e_phnum; i++, elf_ppnt++) {
+ int elf_prot = 0, elf_flags;
+ unsigned long k, vaddr;
++ unsigned long total_size = 0;
+
+ if (elf_ppnt->p_type != PT_LOAD)
+ continue;
+@@ -812,10 +813,16 @@ static int load_elf_binary(struct linux_binprm *bprm)
+ #else
+ load_bias = ELF_PAGESTART(ELF_ET_DYN_BASE - vaddr);
+ #endif
++ total_size = total_mapping_size(elf_phdata,
++ loc->elf_ex.e_phnum);
++ if (!total_size) {
++ error = -EINVAL;
++ goto out_free_dentry;
++ }
+ }
+
+ error = elf_map(bprm->file, load_bias + vaddr, elf_ppnt,
+- elf_prot, elf_flags, 0);
++ elf_prot, elf_flags, total_size);
+ if (BAD_ADDR(error)) {
+ retval = IS_ERR((void *)error) ?
+ PTR_ERR((void*)error) : -EINVAL;
+diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
+index 4bd5e06fa5ab..950479f2d337 100644
+--- a/fs/btrfs/extent-tree.c
++++ b/fs/btrfs/extent-tree.c
+@@ -6955,12 +6955,11 @@ static int __btrfs_free_reserved_extent(struct btrfs_root *root,
+ return -ENOSPC;
+ }
+
+- if (btrfs_test_opt(root, DISCARD))
+- ret = btrfs_discard_extent(root, start, len, NULL);
+-
+ if (pin)
+ pin_down_extent(root, cache, start, len, 1);
+ else {
++ if (btrfs_test_opt(root, DISCARD))
++ ret = btrfs_discard_extent(root, start, len, NULL);
+ btrfs_add_free_space(cache, start, len);
+ btrfs_update_reserved_bytes(cache, len, RESERVE_FREE, delalloc);
+ }
+diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
+index 4399f0c3a4ce..fce3b5b9a2bb 100644
+--- a/fs/btrfs/ioctl.c
++++ b/fs/btrfs/ioctl.c
+@@ -2431,7 +2431,7 @@ static noinline int btrfs_ioctl_snap_destroy(struct file *file,
+ "Attempt to delete subvolume %llu during send",
+ dest->root_key.objectid);
+ err = -EPERM;
+- goto out_dput;
++ goto out_unlock_inode;
+ }
+
+ d_invalidate(dentry);
+@@ -2526,6 +2526,7 @@ out_up_write:
+ root_flags & ~BTRFS_ROOT_SUBVOL_DEAD);
+ spin_unlock(&dest->root_item_lock);
+ }
++out_unlock_inode:
+ mutex_unlock(&inode->i_mutex);
+ if (!err) {
+ shrink_dcache_sb(root->fs_info->sb);
+@@ -2925,6 +2926,9 @@ static int btrfs_extent_same(struct inode *src, u64 loff, u64 len,
+ if (src == dst)
+ return -EINVAL;
+
++ if (len == 0)
++ return 0;
++
+ btrfs_double_lock(src, loff, dst, dst_loff, len);
+
+ ret = extent_same_check_offsets(src, loff, len);
+@@ -3654,6 +3658,11 @@ static noinline long btrfs_ioctl_clone(struct file *file, unsigned long srcfd,
+ if (off + len == src->i_size)
+ len = ALIGN(src->i_size, bs) - off;
+
++ if (len == 0) {
++ ret = 0;
++ goto out_unlock;
++ }
++
+ /* verify the end result is block aligned */
+ if (!IS_ALIGNED(off, bs) || !IS_ALIGNED(off + len, bs) ||
+ !IS_ALIGNED(destoff, bs))
+diff --git a/fs/btrfs/xattr.c b/fs/btrfs/xattr.c
+index dcf20131fbe4..00eacd83ce3d 100644
+--- a/fs/btrfs/xattr.c
++++ b/fs/btrfs/xattr.c
+@@ -324,22 +324,42 @@ const struct xattr_handler *btrfs_xattr_handlers[] = {
+ /*
+ * Check if the attribute is in a supported namespace.
+ *
+- * This applied after the check for the synthetic attributes in the system
++ * This is applied after the check for the synthetic attributes in the system
+ * namespace.
+ */
+-static bool btrfs_is_valid_xattr(const char *name)
++static int btrfs_is_valid_xattr(const char *name)
+ {
+- return !strncmp(name, XATTR_SECURITY_PREFIX,
+- XATTR_SECURITY_PREFIX_LEN) ||
+- !strncmp(name, XATTR_SYSTEM_PREFIX, XATTR_SYSTEM_PREFIX_LEN) ||
+- !strncmp(name, XATTR_TRUSTED_PREFIX, XATTR_TRUSTED_PREFIX_LEN) ||
+- !strncmp(name, XATTR_USER_PREFIX, XATTR_USER_PREFIX_LEN) ||
+- !strncmp(name, XATTR_BTRFS_PREFIX, XATTR_BTRFS_PREFIX_LEN);
++ int len = strlen(name);
++ int prefixlen = 0;
++
++ if (!strncmp(name, XATTR_SECURITY_PREFIX,
++ XATTR_SECURITY_PREFIX_LEN))
++ prefixlen = XATTR_SECURITY_PREFIX_LEN;
++ else if (!strncmp(name, XATTR_SYSTEM_PREFIX, XATTR_SYSTEM_PREFIX_LEN))
++ prefixlen = XATTR_SYSTEM_PREFIX_LEN;
++ else if (!strncmp(name, XATTR_TRUSTED_PREFIX, XATTR_TRUSTED_PREFIX_LEN))
++ prefixlen = XATTR_TRUSTED_PREFIX_LEN;
++ else if (!strncmp(name, XATTR_USER_PREFIX, XATTR_USER_PREFIX_LEN))
++ prefixlen = XATTR_USER_PREFIX_LEN;
++ else if (!strncmp(name, XATTR_BTRFS_PREFIX, XATTR_BTRFS_PREFIX_LEN))
++ prefixlen = XATTR_BTRFS_PREFIX_LEN;
++ else
++ return -EOPNOTSUPP;
++
++ /*
++ * The name cannot consist of just prefix
++ */
++ if (len <= prefixlen)
++ return -EINVAL;
++
++ return 0;
+ }
+
+ ssize_t btrfs_getxattr(struct dentry *dentry, const char *name,
+ void *buffer, size_t size)
+ {
++ int ret;
++
+ /*
+ * If this is a request for a synthetic attribute in the system.*
+ * namespace use the generic infrastructure to resolve a handler
+@@ -348,8 +368,9 @@ ssize_t btrfs_getxattr(struct dentry *dentry, const char *name,
+ if (!strncmp(name, XATTR_SYSTEM_PREFIX, XATTR_SYSTEM_PREFIX_LEN))
+ return generic_getxattr(dentry, name, buffer, size);
+
+- if (!btrfs_is_valid_xattr(name))
+- return -EOPNOTSUPP;
++ ret = btrfs_is_valid_xattr(name);
++ if (ret)
++ return ret;
+ return __btrfs_getxattr(dentry->d_inode, name, buffer, size);
+ }
+
+@@ -357,6 +378,7 @@ int btrfs_setxattr(struct dentry *dentry, const char *name, const void *value,
+ size_t size, int flags)
+ {
+ struct btrfs_root *root = BTRFS_I(dentry->d_inode)->root;
++ int ret;
+
+ /*
+ * The permission on security.* and system.* is not checked
+@@ -373,8 +395,9 @@ int btrfs_setxattr(struct dentry *dentry, const char *name, const void *value,
+ if (!strncmp(name, XATTR_SYSTEM_PREFIX, XATTR_SYSTEM_PREFIX_LEN))
+ return generic_setxattr(dentry, name, value, size, flags);
+
+- if (!btrfs_is_valid_xattr(name))
+- return -EOPNOTSUPP;
++ ret = btrfs_is_valid_xattr(name);
++ if (ret)
++ return ret;
+
+ if (!strncmp(name, XATTR_BTRFS_PREFIX, XATTR_BTRFS_PREFIX_LEN))
+ return btrfs_set_prop(dentry->d_inode, name,
+@@ -390,6 +413,7 @@ int btrfs_setxattr(struct dentry *dentry, const char *name, const void *value,
+ int btrfs_removexattr(struct dentry *dentry, const char *name)
+ {
+ struct btrfs_root *root = BTRFS_I(dentry->d_inode)->root;
++ int ret;
+
+ /*
+ * The permission on security.* and system.* is not checked
+@@ -406,8 +430,9 @@ int btrfs_removexattr(struct dentry *dentry, const char *name)
+ if (!strncmp(name, XATTR_SYSTEM_PREFIX, XATTR_SYSTEM_PREFIX_LEN))
+ return generic_removexattr(dentry, name);
+
+- if (!btrfs_is_valid_xattr(name))
+- return -EOPNOTSUPP;
++ ret = btrfs_is_valid_xattr(name);
++ if (ret)
++ return ret;
+
+ if (!strncmp(name, XATTR_BTRFS_PREFIX, XATTR_BTRFS_PREFIX_LEN))
+ return btrfs_set_prop(dentry->d_inode, name,
+diff --git a/fs/exec.c b/fs/exec.c
+index 7302b75a9820..2e83209016ec 100644
+--- a/fs/exec.c
++++ b/fs/exec.c
+@@ -1250,6 +1250,53 @@ static void check_unsafe_exec(struct linux_binprm *bprm)
+ spin_unlock(&p->fs->lock);
+ }
+
++static void bprm_fill_uid(struct linux_binprm *bprm)
++{
++ struct inode *inode;
++ unsigned int mode;
++ kuid_t uid;
++ kgid_t gid;
++
++ /* clear any previous set[ug]id data from a previous binary */
++ bprm->cred->euid = current_euid();
++ bprm->cred->egid = current_egid();
++
++ if (bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID)
++ return;
++
++ if (task_no_new_privs(current))
++ return;
++
++ inode = file_inode(bprm->file);
++ mode = READ_ONCE(inode->i_mode);
++ if (!(mode & (S_ISUID|S_ISGID)))
++ return;
++
++ /* Be careful if suid/sgid is set */
++ mutex_lock(&inode->i_mutex);
++
++ /* reload atomically mode/uid/gid now that lock held */
++ mode = inode->i_mode;
++ uid = inode->i_uid;
++ gid = inode->i_gid;
++ mutex_unlock(&inode->i_mutex);
++
++ /* We ignore suid/sgid if there are no mappings for them in the ns */
++ if (!kuid_has_mapping(bprm->cred->user_ns, uid) ||
++ !kgid_has_mapping(bprm->cred->user_ns, gid))
++ return;
++
++ if (mode & S_ISUID) {
++ bprm->per_clear |= PER_CLEAR_ON_SETID;
++ bprm->cred->euid = uid;
++ }
++
++ if ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP)) {
++ bprm->per_clear |= PER_CLEAR_ON_SETID;
++ bprm->cred->egid = gid;
++ }
++}
++
+ /*
+ * Fill the binprm structure from the inode.
+ * Check permissions, then read the first 128 (BINPRM_BUF_SIZE) bytes
+@@ -1258,36 +1305,9 @@ static void check_unsafe_exec(struct linux_binprm *bprm)
+ */
+ int prepare_binprm(struct linux_binprm *bprm)
+ {
+- struct inode *inode = file_inode(bprm->file);
+- umode_t mode = inode->i_mode;
+ int retval;
+
+-
+- /* clear any previous set[ug]id data from a previous binary */
+- bprm->cred->euid = current_euid();
+- bprm->cred->egid = current_egid();
+-
+- if (!(bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID) &&
+- !task_no_new_privs(current) &&
+- kuid_has_mapping(bprm->cred->user_ns, inode->i_uid) &&
+- kgid_has_mapping(bprm->cred->user_ns, inode->i_gid)) {
+- /* Set-uid? */
+- if (mode & S_ISUID) {
+- bprm->per_clear |= PER_CLEAR_ON_SETID;
+- bprm->cred->euid = inode->i_uid;
+- }
+-
+- /* Set-gid? */
+- /*
+- * If setgid is set but no group execute bit then this
+- * is a candidate for mandatory locking, not a setgid
+- * executable.
+- */
+- if ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP)) {
+- bprm->per_clear |= PER_CLEAR_ON_SETID;
+- bprm->cred->egid = inode->i_gid;
+- }
+- }
++ bprm_fill_uid(bprm);
+
+ /* fill in binprm security blob */
+ retval = security_bprm_set_creds(bprm);
+diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
+index 0b16fb4c06d3..6cfacbb0f928 100644
+--- a/fs/ext4/extents.c
++++ b/fs/ext4/extents.c
+@@ -4923,13 +4923,6 @@ long ext4_fallocate(struct file *file, int mode, loff_t offset, loff_t len)
+ if (ret)
+ return ret;
+
+- /*
+- * currently supporting (pre)allocate mode for extent-based
+- * files _only_
+- */
+- if (!(ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS)))
+- return -EOPNOTSUPP;
+-
+ if (mode & FALLOC_FL_COLLAPSE_RANGE)
+ return ext4_collapse_range(inode, offset, len);
+
+@@ -4951,6 +4944,14 @@ long ext4_fallocate(struct file *file, int mode, loff_t offset, loff_t len)
+
+ mutex_lock(&inode->i_mutex);
+
++ /*
++ * We only support preallocation for extent-based files only
++ */
++ if (!(ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS))) {
++ ret = -EOPNOTSUPP;
++ goto out;
++ }
++
+ if (!(mode & FALLOC_FL_KEEP_SIZE) &&
+ offset + len > i_size_read(inode)) {
+ new_size = offset + len;
+diff --git a/fs/ext4/extents_status.c b/fs/ext4/extents_status.c
+index 94e7855ae71b..b860603dac33 100644
+--- a/fs/ext4/extents_status.c
++++ b/fs/ext4/extents_status.c
+@@ -670,6 +670,14 @@ int ext4_es_insert_extent(struct inode *inode, ext4_lblk_t lblk,
+
+ BUG_ON(end < lblk);
+
++ if ((status & EXTENT_STATUS_DELAYED) &&
++ (status & EXTENT_STATUS_WRITTEN)) {
++ ext4_warning(inode->i_sb, "Inserting extent [%u/%u] as "
++ " delayed and written which can potentially "
++ " cause data loss.\n", lblk, len);
++ WARN_ON(1);
++ }
++
+ newes.es_lblk = lblk;
+ newes.es_len = len;
+ ext4_es_store_pblock_status(&newes, pblk, status);
+diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
+index 3356ab5395f4..842cdd153c20 100644
+--- a/fs/ext4/inode.c
++++ b/fs/ext4/inode.c
+@@ -540,6 +540,7 @@ int ext4_map_blocks(handle_t *handle, struct inode *inode,
+ status = map->m_flags & EXT4_MAP_UNWRITTEN ?
+ EXTENT_STATUS_UNWRITTEN : EXTENT_STATUS_WRITTEN;
+ if (!(flags & EXT4_GET_BLOCKS_DELALLOC_RESERVE) &&
++ !(status & EXTENT_STATUS_WRITTEN) &&
+ ext4_find_delalloc_range(inode, map->m_lblk,
+ map->m_lblk + map->m_len - 1))
+ status |= EXTENT_STATUS_DELAYED;
+@@ -644,6 +645,7 @@ found:
+ status = map->m_flags & EXT4_MAP_UNWRITTEN ?
+ EXTENT_STATUS_UNWRITTEN : EXTENT_STATUS_WRITTEN;
+ if (!(flags & EXT4_GET_BLOCKS_DELALLOC_RESERVE) &&
++ !(status & EXTENT_STATUS_WRITTEN) &&
+ ext4_find_delalloc_range(inode, map->m_lblk,
+ map->m_lblk + map->m_len - 1))
+ status |= EXTENT_STATUS_DELAYED;
+diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
+index 426211882f72..bada5a1fb695 100644
+--- a/fs/ext4/namei.c
++++ b/fs/ext4/namei.c
+@@ -1865,7 +1865,7 @@ static int ext4_add_entry(handle_t *handle, struct dentry *dentry,
+ struct inode *inode)
+ {
+ struct inode *dir = dentry->d_parent->d_inode;
+- struct buffer_head *bh;
++ struct buffer_head *bh = NULL;
+ struct ext4_dir_entry_2 *de;
+ struct ext4_dir_entry_tail *t;
+ struct super_block *sb;
+@@ -1889,14 +1889,14 @@ static int ext4_add_entry(handle_t *handle, struct dentry *dentry,
+ return retval;
+ if (retval == 1) {
+ retval = 0;
+- return retval;
++ goto out;
+ }
+ }
+
+ if (is_dx(dir)) {
+ retval = ext4_dx_add_entry(handle, dentry, inode);
+ if (!retval || (retval != ERR_BAD_DX_DIR))
+- return retval;
++ goto out;
+ ext4_clear_inode_flag(dir, EXT4_INODE_INDEX);
+ dx_fallback++;
+ ext4_mark_inode_dirty(handle, dir);
+@@ -1908,14 +1908,15 @@ static int ext4_add_entry(handle_t *handle, struct dentry *dentry,
+ return PTR_ERR(bh);
+
+ retval = add_dirent_to_buf(handle, dentry, inode, NULL, bh);
+- if (retval != -ENOSPC) {
+- brelse(bh);
+- return retval;
+- }
++ if (retval != -ENOSPC)
++ goto out;
+
+ if (blocks == 1 && !dx_fallback &&
+- EXT4_HAS_COMPAT_FEATURE(sb, EXT4_FEATURE_COMPAT_DIR_INDEX))
+- return make_indexed_dir(handle, dentry, inode, bh);
++ EXT4_HAS_COMPAT_FEATURE(sb, EXT4_FEATURE_COMPAT_DIR_INDEX)) {
++ retval = make_indexed_dir(handle, dentry, inode, bh);
++ bh = NULL; /* make_indexed_dir releases bh */
++ goto out;
++ }
+ brelse(bh);
+ }
+ bh = ext4_append(handle, dir, &block);
+@@ -1931,6 +1932,7 @@ static int ext4_add_entry(handle_t *handle, struct dentry *dentry,
+ }
+
+ retval = add_dirent_to_buf(handle, dentry, inode, de, bh);
++out:
+ brelse(bh);
+ if (retval == 0)
+ ext4_set_inode_state(inode, EXT4_STATE_NEWENTRY);
+diff --git a/fs/hfsplus/xattr.c b/fs/hfsplus/xattr.c
+index d98094a9f476..ff10f3decbc9 100644
+--- a/fs/hfsplus/xattr.c
++++ b/fs/hfsplus/xattr.c
+@@ -806,9 +806,6 @@ end_removexattr:
+ static int hfsplus_osx_getxattr(struct dentry *dentry, const char *name,
+ void *buffer, size_t size, int type)
+ {
+- char *xattr_name;
+- int res;
+-
+ if (!strcmp(name, ""))
+ return -EINVAL;
+
+@@ -818,24 +815,19 @@ static int hfsplus_osx_getxattr(struct dentry *dentry, const char *name,
+ */
+ if (is_known_namespace(name))
+ return -EOPNOTSUPP;
+- xattr_name = kmalloc(NLS_MAX_CHARSET_SIZE * HFSPLUS_ATTR_MAX_STRLEN
+- + XATTR_MAC_OSX_PREFIX_LEN + 1, GFP_KERNEL);
+- if (!xattr_name)
+- return -ENOMEM;
+- strcpy(xattr_name, XATTR_MAC_OSX_PREFIX);
+- strcpy(xattr_name + XATTR_MAC_OSX_PREFIX_LEN, name);
+
+- res = hfsplus_getxattr(dentry, xattr_name, buffer, size);
+- kfree(xattr_name);
+- return res;
++ /*
++ * osx is the namespace we use to indicate an unprefixed
++ * attribute on the filesystem (like the ones that OS X
++ * creates), so we pass the name through unmodified (after
++ * ensuring it doesn't conflict with another namespace).
++ */
++ return hfsplus_getxattr(dentry, name, buffer, size);
+ }
+
+ static int hfsplus_osx_setxattr(struct dentry *dentry, const char *name,
+ const void *buffer, size_t size, int flags, int type)
+ {
+- char *xattr_name;
+- int res;
+-
+ if (!strcmp(name, ""))
+ return -EINVAL;
+
+@@ -845,16 +837,14 @@ static int hfsplus_osx_setxattr(struct dentry *dentry, const char *name,
+ */
+ if (is_known_namespace(name))
+ return -EOPNOTSUPP;
+- xattr_name = kmalloc(NLS_MAX_CHARSET_SIZE * HFSPLUS_ATTR_MAX_STRLEN
+- + XATTR_MAC_OSX_PREFIX_LEN + 1, GFP_KERNEL);
+- if (!xattr_name)
+- return -ENOMEM;
+- strcpy(xattr_name, XATTR_MAC_OSX_PREFIX);
+- strcpy(xattr_name + XATTR_MAC_OSX_PREFIX_LEN, name);
+
+- res = hfsplus_setxattr(dentry, xattr_name, buffer, size, flags);
+- kfree(xattr_name);
+- return res;
++ /*
++ * osx is the namespace we use to indicate an unprefixed
++ * attribute on the filesystem (like the ones that OS X
++ * creates), so we pass the name through unmodified (after
++ * ensuring it doesn't conflict with another namespace).
++ */
++ return hfsplus_setxattr(dentry, name, buffer, size, flags);
+ }
+
+ static size_t hfsplus_osx_listxattr(struct dentry *dentry, char *list,
+diff --git a/fs/namei.c b/fs/namei.c
+index db5fe86319e6..890d3580bf0e 100644
+--- a/fs/namei.c
++++ b/fs/namei.c
+@@ -1560,7 +1560,8 @@ static inline int walk_component(struct nameidata *nd, struct path *path,
+
+ if (should_follow_link(path->dentry, follow)) {
+ if (nd->flags & LOOKUP_RCU) {
+- if (unlikely(unlazy_walk(nd, path->dentry))) {
++ if (unlikely(nd->path.mnt != path->mnt ||
++ unlazy_walk(nd, path->dentry))) {
+ err = -ECHILD;
+ goto out_err;
+ }
+@@ -3015,7 +3016,8 @@ finish_lookup:
+
+ if (should_follow_link(path->dentry, !symlink_ok)) {
+ if (nd->flags & LOOKUP_RCU) {
+- if (unlikely(unlazy_walk(nd, path->dentry))) {
++ if (unlikely(nd->path.mnt != path->mnt ||
++ unlazy_walk(nd, path->dentry))) {
+ error = -ECHILD;
+ goto out;
+ }
+diff --git a/fs/namespace.c b/fs/namespace.c
+index bbde14719655..07ba424181a5 100644
+--- a/fs/namespace.c
++++ b/fs/namespace.c
+@@ -1322,14 +1322,15 @@ static inline void namespace_lock(void)
+ down_write(&namespace_sem);
+ }
+
++enum umount_tree_flags {
++ UMOUNT_SYNC = 1,
++ UMOUNT_PROPAGATE = 2,
++};
+ /*
+ * mount_lock must be held
+ * namespace_sem must be held for write
+- * how = 0 => just this tree, don't propagate
+- * how = 1 => propagate; we know that nobody else has reference to any victims
+- * how = 2 => lazy umount
+ */
+-void umount_tree(struct mount *mnt, int how)
++static void umount_tree(struct mount *mnt, enum umount_tree_flags how)
+ {
+ HLIST_HEAD(tmp_list);
+ struct mount *p;
+@@ -1343,7 +1344,7 @@ void umount_tree(struct mount *mnt, int how)
+ hlist_for_each_entry(p, &tmp_list, mnt_hash)
+ list_del_init(&p->mnt_child);
+
+- if (how)
++ if (how & UMOUNT_PROPAGATE)
+ propagate_umount(&tmp_list);
+
+ hlist_for_each_entry(p, &tmp_list, mnt_hash) {
+@@ -1351,7 +1352,7 @@ void umount_tree(struct mount *mnt, int how)
+ list_del_init(&p->mnt_list);
+ __touch_mnt_namespace(p->mnt_ns);
+ p->mnt_ns = NULL;
+- if (how < 2)
++ if (how & UMOUNT_SYNC)
+ p->mnt.mnt_flags |= MNT_SYNC_UMOUNT;
+ if (mnt_has_parent(p)) {
+ hlist_del_init(&p->mnt_mp_list);
+@@ -1456,14 +1457,14 @@ static int do_umount(struct mount *mnt, int flags)
+
+ if (flags & MNT_DETACH) {
+ if (!list_empty(&mnt->mnt_list))
+- umount_tree(mnt, 2);
++ umount_tree(mnt, UMOUNT_PROPAGATE);
+ retval = 0;
+ } else {
+ shrink_submounts(mnt);
+ retval = -EBUSY;
+ if (!propagate_mount_busy(mnt, 2)) {
+ if (!list_empty(&mnt->mnt_list))
+- umount_tree(mnt, 1);
++ umount_tree(mnt, UMOUNT_PROPAGATE|UMOUNT_SYNC);
+ retval = 0;
+ }
+ }
+@@ -1495,7 +1496,7 @@ void __detach_mounts(struct dentry *dentry)
+ lock_mount_hash();
+ while (!hlist_empty(&mp->m_list)) {
+ mnt = hlist_entry(mp->m_list.first, struct mount, mnt_mp_list);
+- umount_tree(mnt, 2);
++ umount_tree(mnt, 0);
+ }
+ unlock_mount_hash();
+ put_mountpoint(mp);
+@@ -1662,7 +1663,7 @@ struct mount *copy_tree(struct mount *mnt, struct dentry *dentry,
+ out:
+ if (res) {
+ lock_mount_hash();
+- umount_tree(res, 0);
++ umount_tree(res, UMOUNT_SYNC);
+ unlock_mount_hash();
+ }
+ return q;
+@@ -1686,7 +1687,7 @@ void drop_collected_mounts(struct vfsmount *mnt)
+ {
+ namespace_lock();
+ lock_mount_hash();
+- umount_tree(real_mount(mnt), 0);
++ umount_tree(real_mount(mnt), UMOUNT_SYNC);
+ unlock_mount_hash();
+ namespace_unlock();
+ }
+@@ -1869,7 +1870,7 @@ static int attach_recursive_mnt(struct mount *source_mnt,
+ out_cleanup_ids:
+ while (!hlist_empty(&tree_list)) {
+ child = hlist_entry(tree_list.first, struct mount, mnt_hash);
+- umount_tree(child, 0);
++ umount_tree(child, UMOUNT_SYNC);
+ }
+ unlock_mount_hash();
+ cleanup_group_ids(source_mnt, NULL);
+@@ -2046,7 +2047,7 @@ static int do_loopback(struct path *path, const char *old_name,
+ err = graft_tree(mnt, parent, mp);
+ if (err) {
+ lock_mount_hash();
+- umount_tree(mnt, 0);
++ umount_tree(mnt, UMOUNT_SYNC);
+ unlock_mount_hash();
+ }
+ out2:
+@@ -2417,7 +2418,7 @@ void mark_mounts_for_expiry(struct list_head *mounts)
+ while (!list_empty(&graveyard)) {
+ mnt = list_first_entry(&graveyard, struct mount, mnt_expire);
+ touch_mnt_namespace(mnt->mnt_ns);
+- umount_tree(mnt, 1);
++ umount_tree(mnt, UMOUNT_PROPAGATE|UMOUNT_SYNC);
+ }
+ unlock_mount_hash();
+ namespace_unlock();
+@@ -2488,7 +2489,7 @@ static void shrink_submounts(struct mount *mnt)
+ m = list_first_entry(&graveyard, struct mount,
+ mnt_expire);
+ touch_mnt_namespace(m->mnt_ns);
+- umount_tree(m, 1);
++ umount_tree(m, UMOUNT_PROPAGATE|UMOUNT_SYNC);
+ }
+ }
+ }
+diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c
+index 206c08a60c7f..22bd1d612703 100644
+--- a/fs/nfs/nfs4xdr.c
++++ b/fs/nfs/nfs4xdr.c
+@@ -7336,6 +7336,11 @@ nfs4_stat_to_errno(int stat)
+ .p_name = #proc, \
+ }
+
++#define STUB(proc) \
++[NFSPROC4_CLNT_##proc] = { \
++ .p_name = #proc, \
++}
++
+ struct rpc_procinfo nfs4_procedures[] = {
+ PROC(READ, enc_read, dec_read),
+ PROC(WRITE, enc_write, dec_write),
+@@ -7388,6 +7393,7 @@ struct rpc_procinfo nfs4_procedures[] = {
+ PROC(SECINFO_NO_NAME, enc_secinfo_no_name, dec_secinfo_no_name),
+ PROC(TEST_STATEID, enc_test_stateid, dec_test_stateid),
+ PROC(FREE_STATEID, enc_free_stateid, dec_free_stateid),
++ STUB(GETDEVICELIST),
+ PROC(BIND_CONN_TO_SESSION,
+ enc_bind_conn_to_session, dec_bind_conn_to_session),
+ PROC(DESTROY_CLIENTID, enc_destroy_clientid, dec_destroy_clientid),
+diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
+index 0beb023f25ac..6ed585935d5e 100644
+--- a/fs/nfsd/nfs4proc.c
++++ b/fs/nfsd/nfs4proc.c
+@@ -1028,6 +1028,8 @@ nfsd4_seek(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
+ dprintk("NFSD: nfsd4_seek: couldn't process stateid!\n");
+ return status;
+ }
++ if (!file)
++ return nfserr_bad_stateid;
+
+ switch (seek->seek_whence) {
+ case NFS4_CONTENT_DATA:
+diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
+index 2a77603d7cfd..6abe96593225 100644
+--- a/fs/nfsd/nfs4xdr.c
++++ b/fs/nfsd/nfs4xdr.c
+@@ -3229,6 +3229,7 @@ nfsd4_encode_read(struct nfsd4_compoundres *resp, __be32 nfserr,
+ unsigned long maxcount;
+ struct xdr_stream *xdr = &resp->xdr;
+ struct file *file = read->rd_filp;
++ struct svc_fh *fhp = read->rd_fhp;
+ int starting_len = xdr->buf->len;
+ struct raparms *ra;
+ __be32 *p;
+@@ -3252,12 +3253,15 @@ nfsd4_encode_read(struct nfsd4_compoundres *resp, __be32 nfserr,
+ maxcount = min_t(unsigned long, maxcount, (xdr->buf->buflen - xdr->buf->len));
+ maxcount = min_t(unsigned long, maxcount, read->rd_length);
+
+- if (!read->rd_filp) {
++ if (read->rd_filp)
++ err = nfsd_permission(resp->rqstp, fhp->fh_export,
++ fhp->fh_dentry,
++ NFSD_MAY_READ|NFSD_MAY_OWNER_OVERRIDE);
++ else
+ err = nfsd_get_tmp_read_open(resp->rqstp, read->rd_fhp,
+ &file, &ra);
+- if (err)
+- goto err_truncate;
+- }
++ if (err)
++ goto err_truncate;
+
+ if (file->f_op->splice_read && resp->rqstp->rq_splice_ok)
+ err = nfsd4_encode_splice_read(resp, read, file, maxcount);
+diff --git a/fs/open.c b/fs/open.c
+index de92c13b58be..4a8a355ffab8 100644
+--- a/fs/open.c
++++ b/fs/open.c
+@@ -558,6 +558,7 @@ static int chown_common(struct path *path, uid_t user, gid_t group)
+ uid = make_kuid(current_user_ns(), user);
+ gid = make_kgid(current_user_ns(), group);
+
++retry_deleg:
+ newattrs.ia_valid = ATTR_CTIME;
+ if (user != (uid_t) -1) {
+ if (!uid_valid(uid))
+@@ -574,7 +575,6 @@ static int chown_common(struct path *path, uid_t user, gid_t group)
+ if (!S_ISDIR(inode->i_mode))
+ newattrs.ia_valid |=
+ ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_KILL_PRIV;
+-retry_deleg:
+ mutex_lock(&inode->i_mutex);
+ error = security_path_chown(path, uid, gid);
+ if (!error)
+diff --git a/fs/pnode.h b/fs/pnode.h
+index 4a246358b031..16afc3d6d2f2 100644
+--- a/fs/pnode.h
++++ b/fs/pnode.h
+@@ -47,7 +47,6 @@ int get_dominating_id(struct mount *mnt, const struct path *root);
+ unsigned int mnt_get_count(struct mount *mnt);
+ void mnt_set_mountpoint(struct mount *, struct mountpoint *,
+ struct mount *);
+-void umount_tree(struct mount *, int);
+ struct mount *copy_tree(struct mount *, struct dentry *, int);
+ bool is_path_reachable(struct mount *, struct dentry *,
+ const struct path *root);
+diff --git a/include/acpi/actypes.h b/include/acpi/actypes.h
+index 7000e66f768e..93ef42245647 100644
+--- a/include/acpi/actypes.h
++++ b/include/acpi/actypes.h
+@@ -199,9 +199,29 @@ typedef int s32;
+ typedef s32 acpi_native_int;
+
+ typedef u32 acpi_size;
++
++#ifdef ACPI_32BIT_PHYSICAL_ADDRESS
++
++/*
++ * OSPMs can define this to shrink the size of the structures for 32-bit
++ * none PAE environment. ASL compiler may always define this to generate
++ * 32-bit OSPM compliant tables.
++ */
+ typedef u32 acpi_io_address;
+ typedef u32 acpi_physical_address;
+
++#else /* ACPI_32BIT_PHYSICAL_ADDRESS */
++
++/*
++ * It is reported that, after some calculations, the physical addresses can
++ * wrap over the 32-bit boundary on 32-bit PAE environment.
++ * https://bugzilla.kernel.org/show_bug.cgi?id=87971
++ */
++typedef u64 acpi_io_address;
++typedef u64 acpi_physical_address;
++
++#endif /* ACPI_32BIT_PHYSICAL_ADDRESS */
++
+ #define ACPI_MAX_PTR ACPI_UINT32_MAX
+ #define ACPI_SIZE_MAX ACPI_UINT32_MAX
+
+diff --git a/include/acpi/platform/acenv.h b/include/acpi/platform/acenv.h
+index 5f8cc1fa3278..9e1ed2e380b6 100644
+--- a/include/acpi/platform/acenv.h
++++ b/include/acpi/platform/acenv.h
+@@ -76,6 +76,7 @@
+ #define ACPI_LARGE_NAMESPACE_NODE
+ #define ACPI_DATA_TABLE_DISASSEMBLY
+ #define ACPI_SINGLE_THREADED
++#define ACPI_32BIT_PHYSICAL_ADDRESS
+ #endif
+
+ /* acpi_exec configuration. Multithreaded with full AML debugger */
+diff --git a/include/kvm/arm_arch_timer.h b/include/kvm/arm_arch_timer.h
+index ad9db6045b2f..b3f45a578344 100644
+--- a/include/kvm/arm_arch_timer.h
++++ b/include/kvm/arm_arch_timer.h
+@@ -60,7 +60,8 @@ struct arch_timer_cpu {
+
+ #ifdef CONFIG_KVM_ARM_TIMER
+ int kvm_timer_hyp_init(void);
+-int kvm_timer_init(struct kvm *kvm);
++void kvm_timer_enable(struct kvm *kvm);
++void kvm_timer_init(struct kvm *kvm);
+ void kvm_timer_vcpu_reset(struct kvm_vcpu *vcpu,
+ const struct kvm_irq_level *irq);
+ void kvm_timer_vcpu_init(struct kvm_vcpu *vcpu);
+@@ -77,11 +78,8 @@ static inline int kvm_timer_hyp_init(void)
+ return 0;
+ };
+
+-static inline int kvm_timer_init(struct kvm *kvm)
+-{
+- return 0;
+-}
+-
++static inline void kvm_timer_enable(struct kvm *kvm) {}
++static inline void kvm_timer_init(struct kvm *kvm) {}
+ static inline void kvm_timer_vcpu_reset(struct kvm_vcpu *vcpu,
+ const struct kvm_irq_level *irq) {}
+ static inline void kvm_timer_vcpu_init(struct kvm_vcpu *vcpu) {}
+diff --git a/include/kvm/arm_vgic.h b/include/kvm/arm_vgic.h
+index 206dcc3b3f7a..3f73f6c48adb 100644
+--- a/include/kvm/arm_vgic.h
++++ b/include/kvm/arm_vgic.h
+@@ -113,6 +113,7 @@ struct vgic_ops {
+ void (*sync_lr_elrsr)(struct kvm_vcpu *, int, struct vgic_lr);
+ u64 (*get_elrsr)(const struct kvm_vcpu *vcpu);
+ u64 (*get_eisr)(const struct kvm_vcpu *vcpu);
++ void (*clear_eisr)(struct kvm_vcpu *vcpu);
+ u32 (*get_interrupt_status)(const struct kvm_vcpu *vcpu);
+ void (*enable_underflow)(struct kvm_vcpu *vcpu);
+ void (*disable_underflow)(struct kvm_vcpu *vcpu);
+@@ -274,7 +275,7 @@ struct kvm_exit_mmio;
+ #ifdef CONFIG_KVM_ARM_VGIC
+ int kvm_vgic_addr(struct kvm *kvm, unsigned long type, u64 *addr, bool write);
+ int kvm_vgic_hyp_init(void);
+-int kvm_vgic_init(struct kvm *kvm);
++int kvm_vgic_map_resources(struct kvm *kvm);
+ int kvm_vgic_create(struct kvm *kvm);
+ void kvm_vgic_destroy(struct kvm *kvm);
+ void kvm_vgic_vcpu_destroy(struct kvm_vcpu *vcpu);
+@@ -321,7 +322,7 @@ static inline int kvm_vgic_addr(struct kvm *kvm, unsigned long type, u64 *addr,
+ return -ENXIO;
+ }
+
+-static inline int kvm_vgic_init(struct kvm *kvm)
++static inline int kvm_vgic_map_resources(struct kvm *kvm)
+ {
+ return 0;
+ }
+diff --git a/include/linux/bpf.h b/include/linux/bpf.h
+index 3cf91754a957..cb4156a2c6bc 100644
+--- a/include/linux/bpf.h
++++ b/include/linux/bpf.h
+@@ -48,7 +48,7 @@ struct bpf_map *bpf_map_get(struct fd f);
+
+ /* function argument constraints */
+ enum bpf_arg_type {
+- ARG_ANYTHING = 0, /* any argument is ok */
++ ARG_DONTCARE = 0, /* unused argument in helper function */
+
+ /* the following constraints used to prototype
+ * bpf_map_lookup/update/delete_elem() functions
+@@ -62,6 +62,8 @@ enum bpf_arg_type {
+ */
+ ARG_PTR_TO_STACK, /* any pointer to eBPF program stack */
+ ARG_CONST_STACK_SIZE, /* number of bytes accessed from stack */
++
++ ARG_ANYTHING, /* any (initialized) argument is ok */
+ };
+
+ /* type of values returned from helper functions */
+diff --git a/include/linux/hugetlb.h b/include/linux/hugetlb.h
+index 6e6d338641fe..14020c7796af 100644
+--- a/include/linux/hugetlb.h
++++ b/include/linux/hugetlb.h
+@@ -99,9 +99,9 @@ int huge_pmd_unshare(struct mm_struct *mm, unsigned long *addr, pte_t *ptep);
+ struct page *follow_huge_addr(struct mm_struct *mm, unsigned long address,
+ int write);
+ struct page *follow_huge_pmd(struct mm_struct *mm, unsigned long address,
+- pmd_t *pmd, int write);
++ pmd_t *pmd, int flags);
+ struct page *follow_huge_pud(struct mm_struct *mm, unsigned long address,
+- pud_t *pud, int write);
++ pud_t *pud, int flags);
+ int pmd_huge(pmd_t pmd);
+ int pud_huge(pud_t pmd);
+ unsigned long hugetlb_change_protection(struct vm_area_struct *vma,
+@@ -133,8 +133,8 @@ static inline void hugetlb_report_meminfo(struct seq_file *m)
+ static inline void hugetlb_show_meminfo(void)
+ {
+ }
+-#define follow_huge_pmd(mm, addr, pmd, write) NULL
+-#define follow_huge_pud(mm, addr, pud, write) NULL
++#define follow_huge_pmd(mm, addr, pmd, flags) NULL
++#define follow_huge_pud(mm, addr, pud, flags) NULL
+ #define prepare_hugepage_range(file, addr, len) (-EINVAL)
+ #define pmd_huge(x) 0
+ #define pud_huge(x) 0
+diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
+index a6059bdf7b03..e4d8f705fecd 100644
+--- a/include/linux/kvm_host.h
++++ b/include/linux/kvm_host.h
+@@ -43,6 +43,7 @@
+ * include/linux/kvm_h.
+ */
+ #define KVM_MEMSLOT_INVALID (1UL << 16)
++#define KVM_MEMSLOT_INCOHERENT (1UL << 17)
+
+ /* Two fragments for cross MMIO pages. */
+ #define KVM_MAX_MMIO_FRAGMENTS 2
+diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
+index 6c8b6f604e76..522d83731709 100644
+--- a/include/linux/skbuff.h
++++ b/include/linux/skbuff.h
+@@ -772,6 +772,7 @@ bool skb_try_coalesce(struct sk_buff *to, struct sk_buff *from,
+
+ struct sk_buff *__alloc_skb(unsigned int size, gfp_t priority, int flags,
+ int node);
++struct sk_buff *__build_skb(void *data, unsigned int frag_size);
+ struct sk_buff *build_skb(void *data, unsigned int frag_size);
+ static inline struct sk_buff *alloc_skb(unsigned int size,
+ gfp_t priority)
+@@ -2958,6 +2959,18 @@ static inline bool __skb_checksum_validate_needed(struct sk_buff *skb,
+ */
+ #define CHECKSUM_BREAK 76
+
++/* Unset checksum-complete
++ *
++ * Unset checksum complete can be done when packet is being modified
++ * (uncompressed for instance) and checksum-complete value is
++ * invalidated.
++ */
++static inline void skb_checksum_complete_unset(struct sk_buff *skb)
++{
++ if (skb->ip_summed == CHECKSUM_COMPLETE)
++ skb->ip_summed = CHECKSUM_NONE;
++}
++
+ /* Validate (init) checksum based on checksum complete.
+ *
+ * Return values:
+diff --git a/include/linux/swapops.h b/include/linux/swapops.h
+index 6adfb7bfbf44..e288d5c016a7 100644
+--- a/include/linux/swapops.h
++++ b/include/linux/swapops.h
+@@ -137,6 +137,8 @@ static inline void make_migration_entry_read(swp_entry_t *entry)
+ *entry = swp_entry(SWP_MIGRATION_READ, swp_offset(*entry));
+ }
+
++extern void __migration_entry_wait(struct mm_struct *mm, pte_t *ptep,
++ spinlock_t *ptl);
+ extern void migration_entry_wait(struct mm_struct *mm, pmd_t *pmd,
+ unsigned long address);
+ extern void migration_entry_wait_huge(struct vm_area_struct *vma,
+@@ -150,6 +152,8 @@ static inline int is_migration_entry(swp_entry_t swp)
+ }
+ #define migration_entry_to_page(swp) NULL
+ static inline void make_migration_entry_read(swp_entry_t *entryp) { }
++static inline void __migration_entry_wait(struct mm_struct *mm, pte_t *ptep,
++ spinlock_t *ptl) { }
+ static inline void migration_entry_wait(struct mm_struct *mm, pmd_t *pmd,
+ unsigned long address) { }
+ static inline void migration_entry_wait_huge(struct vm_area_struct *vma,
+diff --git a/include/linux/usb.h b/include/linux/usb.h
+index 3827bffc11a7..bdbd19fb1ff8 100644
+--- a/include/linux/usb.h
++++ b/include/linux/usb.h
+@@ -205,6 +205,32 @@ void usb_put_intf(struct usb_interface *intf);
+ #define USB_MAXINTERFACES 32
+ #define USB_MAXIADS (USB_MAXINTERFACES/2)
+
++/*
++ * USB Resume Timer: Every Host controller driver should drive the resume
++ * signalling on the bus for the amount of time defined by this macro.
++ *
++ * That way we will have a 'stable' behavior among all HCDs supported by Linux.
++ *
++ * Note that the USB Specification states we should drive resume for *at least*
++ * 20 ms, but it doesn't give an upper bound. This creates two possible
++ * situations which we want to avoid:
++ *
++ * (a) sometimes an msleep(20) might expire slightly before 20 ms, which causes
++ * us to fail USB Electrical Tests, thus failing Certification
++ *
++ * (b) Some (many) devices actually need more than 20 ms of resume signalling,
++ * and while we can argue that's against the USB Specification, we don't have
++ * control over which devices a certification laboratory will be using for
++ * certification. If CertLab uses a device which was tested against Windows and
++ * that happens to have relaxed resume signalling rules, we might fall into
++ * situations where we fail interoperability and electrical tests.
++ *
++ * In order to avoid both conditions, we're using a 40 ms resume timeout, which
++ * should cope with both LPJ calibration errors and devices not following every
++ * detail of the USB Specification.
++ */
++#define USB_RESUME_TIMEOUT 40 /* ms */
++
+ /**
+ * struct usb_interface_cache - long-term representation of a device interface
+ * @num_altsetting: number of altsettings defined.
+diff --git a/include/linux/usb_usual.h b/include/linux/usb_usual.h
+index a7f2604c5f25..7f5f78bd15ad 100644
+--- a/include/linux/usb_usual.h
++++ b/include/linux/usb_usual.h
+@@ -77,6 +77,8 @@
+ /* Cannot handle ATA_12 or ATA_16 CDBs */ \
+ US_FLAG(NO_REPORT_OPCODES, 0x04000000) \
+ /* Cannot handle MI_REPORT_SUPPORTED_OPERATION_CODES */ \
++ US_FLAG(MAX_SECTORS_240, 0x08000000) \
++ /* Sets max_sectors to 240 */ \
+
+ #define US_FLAG(name, value) US_FL_##name = value ,
+ enum { US_DO_ALL_FLAGS };
+diff --git a/include/sound/emu10k1.h b/include/sound/emu10k1.h
+index c46908c1bb3f..8af2fff0eb08 100644
+--- a/include/sound/emu10k1.h
++++ b/include/sound/emu10k1.h
+@@ -41,7 +41,8 @@
+
+ #define EMUPAGESIZE 4096
+ #define MAXREQVOICES 8
+-#define MAXPAGES 8192
++#define MAXPAGES0 4096 /* 32 bit mode */
++#define MAXPAGES1 8192 /* 31 bit mode */
+ #define RESERVED 0
+ #define NUM_MIDI 16
+ #define NUM_G 64 /* use all channels */
+@@ -50,8 +51,7 @@
+
+ /* FIXME? - according to the OSS driver the EMU10K1 needs a 29 bit DMA mask */
+ #define EMU10K1_DMA_MASK 0x7fffffffUL /* 31bit */
+-#define AUDIGY_DMA_MASK 0x7fffffffUL /* 31bit FIXME - 32 should work? */
+- /* See ALSA bug #1276 - rlrevell */
++#define AUDIGY_DMA_MASK 0xffffffffUL /* 32bit mode */
+
+ #define TMEMSIZE 256*1024
+ #define TMEMSIZEREG 4
+@@ -466,8 +466,11 @@
+
+ #define MAPB 0x0d /* Cache map B */
+
+-#define MAP_PTE_MASK 0xffffe000 /* The 19 MSBs of the PTE indexed by the PTI */
+-#define MAP_PTI_MASK 0x00001fff /* The 13 bit index to one of the 8192 PTE dwords */
++#define MAP_PTE_MASK0 0xfffff000 /* The 20 MSBs of the PTE indexed by the PTI */
++#define MAP_PTI_MASK0 0x00000fff /* The 12 bit index to one of the 4096 PTE dwords */
++
++#define MAP_PTE_MASK1 0xffffe000 /* The 19 MSBs of the PTE indexed by the PTI */
++#define MAP_PTI_MASK1 0x00001fff /* The 13 bit index to one of the 8192 PTE dwords */
+
+ /* 0x0e, 0x0f: Not used */
+
+@@ -1704,6 +1707,7 @@ struct snd_emu10k1 {
+ unsigned short model; /* subsystem id */
+ unsigned int card_type; /* EMU10K1_CARD_* */
+ unsigned int ecard_ctrl; /* ecard control bits */
++ unsigned int address_mode; /* address mode */
+ unsigned long dma_mask; /* PCI DMA mask */
+ unsigned int delay_pcm_irq; /* in samples */
+ int max_cache_pages; /* max memory size / PAGE_SIZE */
+diff --git a/include/sound/soc-dapm.h b/include/sound/soc-dapm.h
+index 3a4d7da67b8d..525f313f9f41 100644
+--- a/include/sound/soc-dapm.h
++++ b/include/sound/soc-dapm.h
+@@ -287,7 +287,7 @@ struct device;
+ .access = SNDRV_CTL_ELEM_ACCESS_TLV_READ | SNDRV_CTL_ELEM_ACCESS_READWRITE,\
+ .tlv.p = (tlv_array), \
+ .get = snd_soc_dapm_get_volsw, .put = snd_soc_dapm_put_volsw, \
+- .private_value = SOC_SINGLE_VALUE(reg, shift, max, invert, 0) }
++ .private_value = SOC_SINGLE_VALUE(reg, shift, max, invert, 1) }
+ #define SOC_DAPM_SINGLE_TLV_VIRT(xname, max, tlv_array) \
+ SOC_DAPM_SINGLE(xname, SND_SOC_NOPM, 0, max, 0, tlv_array)
+ #define SOC_DAPM_ENUM(xname, xenum) \
+diff --git a/include/target/target_core_base.h b/include/target/target_core_base.h
+index 1fbd69cfd0b7..c4b85a5889ba 100644
+--- a/include/target/target_core_base.h
++++ b/include/target/target_core_base.h
+@@ -520,7 +520,7 @@ struct se_cmd {
+ sense_reason_t (*execute_cmd)(struct se_cmd *);
+ sense_reason_t (*execute_rw)(struct se_cmd *, struct scatterlist *,
+ u32, enum dma_data_direction);
+- sense_reason_t (*transport_complete_callback)(struct se_cmd *);
++ sense_reason_t (*transport_complete_callback)(struct se_cmd *, bool);
+
+ unsigned char *t_task_cdb;
+ unsigned char __t_task_cdb[TCM_MAX_COMMAND_SIZE];
+diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
+index d6594e457a25..71a9e5be6592 100644
+--- a/kernel/bpf/core.c
++++ b/kernel/bpf/core.c
+@@ -357,8 +357,8 @@ select_insn:
+ ALU64_MOD_X:
+ if (unlikely(SRC == 0))
+ return 0;
+- tmp = DST;
+- DST = do_div(tmp, SRC);
++ div64_u64_rem(DST, SRC, &tmp);
++ DST = tmp;
+ CONT;
+ ALU_MOD_X:
+ if (unlikely(SRC == 0))
+@@ -367,8 +367,8 @@ select_insn:
+ DST = do_div(tmp, (u32) SRC);
+ CONT;
+ ALU64_MOD_K:
+- tmp = DST;
+- DST = do_div(tmp, IMM);
++ div64_u64_rem(DST, IMM, &tmp);
++ DST = tmp;
+ CONT;
+ ALU_MOD_K:
+ tmp = (u32) DST;
+@@ -377,7 +377,7 @@ select_insn:
+ ALU64_DIV_X:
+ if (unlikely(SRC == 0))
+ return 0;
+- do_div(DST, SRC);
++ DST = div64_u64(DST, SRC);
+ CONT;
+ ALU_DIV_X:
+ if (unlikely(SRC == 0))
+@@ -387,7 +387,7 @@ select_insn:
+ DST = (u32) tmp;
+ CONT;
+ ALU64_DIV_K:
+- do_div(DST, IMM);
++ DST = div64_u64(DST, IMM);
+ CONT;
+ ALU_DIV_K:
+ tmp = (u32) DST;
+diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
+index d8dcc80472c1..055ae6ac0280 100644
+--- a/kernel/bpf/verifier.c
++++ b/kernel/bpf/verifier.c
+@@ -763,7 +763,7 @@ static int check_func_arg(struct verifier_env *env, u32 regno,
+ enum bpf_reg_type expected_type;
+ int err = 0;
+
+- if (arg_type == ARG_ANYTHING)
++ if (arg_type == ARG_DONTCARE)
+ return 0;
+
+ if (reg->type == NOT_INIT) {
+@@ -771,6 +771,9 @@ static int check_func_arg(struct verifier_env *env, u32 regno,
+ return -EACCES;
+ }
+
++ if (arg_type == ARG_ANYTHING)
++ return 0;
++
+ if (arg_type == ARG_PTR_TO_STACK || arg_type == ARG_PTR_TO_MAP_KEY ||
+ arg_type == ARG_PTR_TO_MAP_VALUE) {
+ expected_type = PTR_TO_STACK;
+diff --git a/kernel/ptrace.c b/kernel/ptrace.c
+index 54e75226c2c4..dcd968232d42 100644
+--- a/kernel/ptrace.c
++++ b/kernel/ptrace.c
+@@ -714,6 +714,8 @@ static int ptrace_peek_siginfo(struct task_struct *child,
+ static int ptrace_resume(struct task_struct *child, long request,
+ unsigned long data)
+ {
++ bool need_siglock;
++
+ if (!valid_signal(data))
+ return -EIO;
+
+@@ -741,8 +743,26 @@ static int ptrace_resume(struct task_struct *child, long request,
+ user_disable_single_step(child);
+ }
+
++ /*
++ * Change ->exit_code and ->state under siglock to avoid the race
++ * with wait_task_stopped() in between; a non-zero ->exit_code will
++ * wrongly look like another report from tracee.
++ *
++ * Note that we need siglock even if ->exit_code == data and/or this
++ * status was not reported yet, the new status must not be cleared by
++ * wait_task_stopped() after resume.
++ *
++ * If data == 0 we do not care if wait_task_stopped() reports the old
++ * status and clears the code too; this can't race with the tracee, it
++ * takes siglock after resume.
++ */
++ need_siglock = data && !thread_group_empty(current);
++ if (need_siglock)
++ spin_lock_irq(&child->sighand->siglock);
+ child->exit_code = data;
+ wake_up_state(child, __TASK_TRACED);
++ if (need_siglock)
++ spin_unlock_irq(&child->sighand->siglock);
+
+ return 0;
+ }
+diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
+index f4fbbfcdf399..0fc5cfedcc8c 100644
+--- a/kernel/trace/ring_buffer.c
++++ b/kernel/trace/ring_buffer.c
+@@ -2684,7 +2684,7 @@ static DEFINE_PER_CPU(unsigned int, current_context);
+
+ static __always_inline int trace_recursive_lock(void)
+ {
+- unsigned int val = this_cpu_read(current_context);
++ unsigned int val = __this_cpu_read(current_context);
+ int bit;
+
+ if (in_interrupt()) {
+@@ -2701,18 +2701,17 @@ static __always_inline int trace_recursive_lock(void)
+ return 1;
+
+ val |= (1 << bit);
+- this_cpu_write(current_context, val);
++ __this_cpu_write(current_context, val);
+
+ return 0;
+ }
+
+ static __always_inline void trace_recursive_unlock(void)
+ {
+- unsigned int val = this_cpu_read(current_context);
++ unsigned int val = __this_cpu_read(current_context);
+
+- val--;
+- val &= this_cpu_read(current_context);
+- this_cpu_write(current_context, val);
++ val &= val & (val - 1);
++ __this_cpu_write(current_context, val);
+ }
+
+ #else
+diff --git a/kernel/trace/trace_functions_graph.c b/kernel/trace/trace_functions_graph.c
+index f0a0c982cde3..2964333687dc 100644
+--- a/kernel/trace/trace_functions_graph.c
++++ b/kernel/trace/trace_functions_graph.c
+@@ -1462,15 +1462,19 @@ void graph_trace_open(struct trace_iterator *iter)
+ {
+ /* pid and depth on the last trace processed */
+ struct fgraph_data *data;
++ gfp_t gfpflags;
+ int cpu;
+
+ iter->private = NULL;
+
+- data = kzalloc(sizeof(*data), GFP_KERNEL);
++ /* We can be called in atomic context via ftrace_dump() */
++ gfpflags = (in_atomic() || irqs_disabled()) ? GFP_ATOMIC : GFP_KERNEL;
++
++ data = kzalloc(sizeof(*data), gfpflags);
+ if (!data)
+ goto out_err;
+
+- data->cpu_data = alloc_percpu(struct fgraph_cpu_data);
++ data->cpu_data = alloc_percpu_gfp(struct fgraph_cpu_data, gfpflags);
+ if (!data->cpu_data)
+ goto out_err_free;
+
+diff --git a/lib/string.c b/lib/string.c
+index 10063300b830..643b0a90802c 100644
+--- a/lib/string.c
++++ b/lib/string.c
+@@ -610,7 +610,7 @@ EXPORT_SYMBOL(memset);
+ void memzero_explicit(void *s, size_t count)
+ {
+ memset(s, 0, count);
+- OPTIMIZER_HIDE_VAR(s);
++ barrier();
+ }
+ EXPORT_SYMBOL(memzero_explicit);
+
+diff --git a/mm/gup.c b/mm/gup.c
+index a0d57ec05510..377a5a796242 100644
+--- a/mm/gup.c
++++ b/mm/gup.c
+@@ -167,10 +167,10 @@ struct page *follow_page_mask(struct vm_area_struct *vma,
+ if (pud_none(*pud))
+ return no_page_table(vma, flags);
+ if (pud_huge(*pud) && vma->vm_flags & VM_HUGETLB) {
+- if (flags & FOLL_GET)
+- return NULL;
+- page = follow_huge_pud(mm, address, pud, flags & FOLL_WRITE);
+- return page;
++ page = follow_huge_pud(mm, address, pud, flags);
++ if (page)
++ return page;
++ return no_page_table(vma, flags);
+ }
+ if (unlikely(pud_bad(*pud)))
+ return no_page_table(vma, flags);
+@@ -179,19 +179,10 @@ struct page *follow_page_mask(struct vm_area_struct *vma,
+ if (pmd_none(*pmd))
+ return no_page_table(vma, flags);
+ if (pmd_huge(*pmd) && vma->vm_flags & VM_HUGETLB) {
+- page = follow_huge_pmd(mm, address, pmd, flags & FOLL_WRITE);
+- if (flags & FOLL_GET) {
+- /*
+- * Refcount on tail pages are not well-defined and
+- * shouldn't be taken. The caller should handle a NULL
+- * return when trying to follow tail pages.
+- */
+- if (PageHead(page))
+- get_page(page);
+- else
+- page = NULL;
+- }
+- return page;
++ page = follow_huge_pmd(mm, address, pmd, flags);
++ if (page)
++ return page;
++ return no_page_table(vma, flags);
+ }
+ if ((flags & FOLL_NUMA) && pmd_numa(*pmd))
+ return no_page_table(vma, flags);
+diff --git a/mm/hugetlb.c b/mm/hugetlb.c
+index 4cacc6a8a6c1..da8fa4e4237c 100644
+--- a/mm/hugetlb.c
++++ b/mm/hugetlb.c
+@@ -3693,44 +3693,64 @@ pte_t *huge_pte_offset(struct mm_struct *mm, unsigned long addr)
+ return (pte_t *) pmd;
+ }
+
+-struct page *
+-follow_huge_pmd(struct mm_struct *mm, unsigned long address,
+- pmd_t *pmd, int write)
+-{
+- struct page *page;
++#endif /* CONFIG_ARCH_WANT_GENERAL_HUGETLB */
+
+- if (!pmd_present(*pmd))
+- return NULL;
+- page = pte_page(*(pte_t *)pmd);
+- if (page)
+- page += ((address & ~PMD_MASK) >> PAGE_SHIFT);
+- return page;
++/*
++ * These functions are overwritable if your architecture needs its own
++ * behavior.
++ */
++struct page * __weak
++follow_huge_addr(struct mm_struct *mm, unsigned long address,
++ int write)
++{
++ return ERR_PTR(-EINVAL);
+ }
+
+-struct page *
+-follow_huge_pud(struct mm_struct *mm, unsigned long address,
+- pud_t *pud, int write)
++struct page * __weak
++follow_huge_pmd(struct mm_struct *mm, unsigned long address,
++ pmd_t *pmd, int flags)
+ {
+- struct page *page;
+-
+- page = pte_page(*(pte_t *)pud);
+- if (page)
+- page += ((address & ~PUD_MASK) >> PAGE_SHIFT);
++ struct page *page = NULL;
++ spinlock_t *ptl;
++retry:
++ ptl = pmd_lockptr(mm, pmd);
++ spin_lock(ptl);
++ /*
++ * make sure that the address range covered by this pmd is not
++ * unmapped from other threads.
++ */
++ if (!pmd_huge(*pmd))
++ goto out;
++ if (pmd_present(*pmd)) {
++ page = pte_page(*(pte_t *)pmd) +
++ ((address & ~PMD_MASK) >> PAGE_SHIFT);
++ if (flags & FOLL_GET)
++ get_page(page);
++ } else {
++ if (is_hugetlb_entry_migration(huge_ptep_get((pte_t *)pmd))) {
++ spin_unlock(ptl);
++ __migration_entry_wait(mm, (pte_t *)pmd, ptl);
++ goto retry;
++ }
++ /*
++ * hwpoisoned entry is treated as no_page_table in
++ * follow_page_mask().
++ */
++ }
++out:
++ spin_unlock(ptl);
+ return page;
+ }
+
+-#else /* !CONFIG_ARCH_WANT_GENERAL_HUGETLB */
+-
+-/* Can be overriden by architectures */
+ struct page * __weak
+ follow_huge_pud(struct mm_struct *mm, unsigned long address,
+- pud_t *pud, int write)
++ pud_t *pud, int flags)
+ {
+- BUG();
+- return NULL;
+-}
++ if (flags & FOLL_GET)
++ return NULL;
+
+-#endif /* CONFIG_ARCH_WANT_GENERAL_HUGETLB */
++ return pte_page(*(pte_t *)pud) + ((address & ~PUD_MASK) >> PAGE_SHIFT);
++}
+
+ #ifdef CONFIG_MEMORY_FAILURE
+
+diff --git a/mm/migrate.c b/mm/migrate.c
+index 01439953abf5..cd4fd10c4ec3 100644
+--- a/mm/migrate.c
++++ b/mm/migrate.c
+@@ -229,7 +229,7 @@ static void remove_migration_ptes(struct page *old, struct page *new)
+ * get to the page and wait until migration is finished.
+ * When we return from this function the fault will be retried.
+ */
+-static void __migration_entry_wait(struct mm_struct *mm, pte_t *ptep,
++void __migration_entry_wait(struct mm_struct *mm, pte_t *ptep,
+ spinlock_t *ptl)
+ {
+ pte_t pte;
+@@ -1260,7 +1260,8 @@ static int do_move_page_to_node_array(struct mm_struct *mm,
+ goto put_and_set;
+
+ if (PageHuge(page)) {
+- isolate_huge_page(page, &pagelist);
++ if (PageHead(page))
++ isolate_huge_page(page, &pagelist);
+ goto put_and_set;
+ }
+
+diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c
+index 1a4f32c09ad5..f076a8ede00b 100644
+--- a/net/bridge/br_netfilter.c
++++ b/net/bridge/br_netfilter.c
+@@ -650,6 +650,13 @@ static int br_nf_forward_finish(struct sk_buff *skb)
+ struct net_device *in;
+
+ if (!IS_ARP(skb) && !IS_VLAN_ARP(skb)) {
++ int frag_max_size;
++
++ if (skb->protocol == htons(ETH_P_IP)) {
++ frag_max_size = IPCB(skb)->frag_max_size;
++ BR_INPUT_SKB_CB(skb)->frag_max_size = frag_max_size;
++ }
++
+ in = nf_bridge->physindev;
+ if (nf_bridge->mask & BRNF_PKT_TYPE) {
+ skb->pkt_type = PACKET_OTHERHOST;
+@@ -709,8 +716,14 @@ static unsigned int br_nf_forward_ip(const struct nf_hook_ops *ops,
+ nf_bridge->mask |= BRNF_PKT_TYPE;
+ }
+
+- if (pf == NFPROTO_IPV4 && br_parse_ip_options(skb))
+- return NF_DROP;
++ if (pf == NFPROTO_IPV4) {
++ int frag_max = BR_INPUT_SKB_CB(skb)->frag_max_size;
++
++ if (br_parse_ip_options(skb))
++ return NF_DROP;
++
++ IPCB(skb)->frag_max_size = frag_max;
++ }
+
+ /* The physdev module checks on this */
+ nf_bridge->mask |= BRNF_BRIDGED;
+diff --git a/net/core/skbuff.c b/net/core/skbuff.c
+index 17fd8dca921e..02ebb7133312 100644
+--- a/net/core/skbuff.c
++++ b/net/core/skbuff.c
+@@ -278,13 +278,14 @@ nodata:
+ EXPORT_SYMBOL(__alloc_skb);
+
+ /**
+- * build_skb - build a network buffer
++ * __build_skb - build a network buffer
+ * @data: data buffer provided by caller
+- * @frag_size: size of fragment, or 0 if head was kmalloced
++ * @frag_size: size of data, or 0 if head was kmalloced
+ *
+ * Allocate a new &sk_buff. Caller provides space holding head and
+ * skb_shared_info. @data must have been allocated by kmalloc() only if
+- * @frag_size is 0, otherwise data should come from the page allocator.
++ * @frag_size is 0, otherwise data should come from the page allocator
++ * or vmalloc()
+ * The return is the new skb buffer.
+ * On a failure the return is %NULL, and @data is not freed.
+ * Notes :
+@@ -295,7 +296,7 @@ EXPORT_SYMBOL(__alloc_skb);
+ * before giving packet to stack.
+ * RX rings only contains data buffers, not full skbs.
+ */
+-struct sk_buff *build_skb(void *data, unsigned int frag_size)
++struct sk_buff *__build_skb(void *data, unsigned int frag_size)
+ {
+ struct skb_shared_info *shinfo;
+ struct sk_buff *skb;
+@@ -309,7 +310,6 @@ struct sk_buff *build_skb(void *data, unsigned int frag_size)
+
+ memset(skb, 0, offsetof(struct sk_buff, tail));
+ skb->truesize = SKB_TRUESIZE(size);
+- skb->head_frag = frag_size != 0;
+ atomic_set(&skb->users, 1);
+ skb->head = data;
+ skb->data = data;
+@@ -326,6 +326,23 @@ struct sk_buff *build_skb(void *data, unsigned int frag_size)
+
+ return skb;
+ }
++
++/* build_skb() is wrapper over __build_skb(), that specifically
++ * takes care of skb->head and skb->pfmemalloc
++ * This means that if @frag_size is not zero, then @data must be backed
++ * by a page fragment, not kmalloc() or vmalloc()
++ */
++struct sk_buff *build_skb(void *data, unsigned int frag_size)
++{
++ struct sk_buff *skb = __build_skb(data, frag_size);
++
++ if (skb && frag_size) {
++ skb->head_frag = 1;
++ if (virt_to_head_page(data)->pfmemalloc)
++ skb->pfmemalloc = 1;
++ }
++ return skb;
++}
+ EXPORT_SYMBOL(build_skb);
+
+ struct netdev_alloc_cache {
+@@ -352,7 +369,8 @@ refill:
+ gfp_t gfp = gfp_mask;
+
+ if (order)
+- gfp |= __GFP_COMP | __GFP_NOWARN;
++ gfp |= __GFP_COMP | __GFP_NOWARN |
++ __GFP_NOMEMALLOC;
+ nc->frag.page = alloc_pages(gfp, order);
+ if (likely(nc->frag.page))
+ break;
+diff --git a/net/ipv4/ip_forward.c b/net/ipv4/ip_forward.c
+index 787b3c294ce6..d5410b57da19 100644
+--- a/net/ipv4/ip_forward.c
++++ b/net/ipv4/ip_forward.c
+@@ -81,6 +81,9 @@ int ip_forward(struct sk_buff *skb)
+ if (skb->pkt_type != PACKET_HOST)
+ goto drop;
+
++ if (unlikely(skb->sk))
++ goto drop;
++
+ if (skb_warn_if_lro(skb))
+ goto drop;
+
+diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
+index a5c49d657ab1..64f4edb2dbf9 100644
+--- a/net/ipv4/ping.c
++++ b/net/ipv4/ping.c
+@@ -158,6 +158,7 @@ void ping_unhash(struct sock *sk)
+ if (sk_hashed(sk)) {
+ write_lock_bh(&ping_table.lock);
+ hlist_nulls_del(&sk->sk_nulls_node);
++ sk_nulls_node_init(&sk->sk_nulls_node);
+ sock_put(sk);
+ isk->inet_num = 0;
+ isk->inet_sport = 0;
+diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
+index 32dcb4e05b6b..dc9f925b0cd5 100644
+--- a/net/ipv4/tcp_output.c
++++ b/net/ipv4/tcp_output.c
+@@ -2717,39 +2717,65 @@ begin_fwd:
+ }
+ }
+
+-/* Send a fin. The caller locks the socket for us. This cannot be
+- * allowed to fail queueing a FIN frame under any circumstances.
++/* We allow to exceed memory limits for FIN packets to expedite
++ * connection tear down and (memory) recovery.
++ * Otherwise tcp_send_fin() could be tempted to either delay FIN
++ * or even be forced to close flow without any FIN.
++ */
++static void sk_forced_wmem_schedule(struct sock *sk, int size)
++{
++ int amt, status;
++
++ if (size <= sk->sk_forward_alloc)
++ return;
++ amt = sk_mem_pages(size);
++ sk->sk_forward_alloc += amt * SK_MEM_QUANTUM;
++ sk_memory_allocated_add(sk, amt, &status);
++}
++
++/* Send a FIN. The caller locks the socket for us.
++ * We should try to send a FIN packet really hard, but eventually give up.
+ */
+ void tcp_send_fin(struct sock *sk)
+ {
++ struct sk_buff *skb, *tskb = tcp_write_queue_tail(sk);
+ struct tcp_sock *tp = tcp_sk(sk);
+- struct sk_buff *skb = tcp_write_queue_tail(sk);
+- int mss_now;
+
+- /* Optimization, tack on the FIN if we have a queue of
+- * unsent frames. But be careful about outgoing SACKS
+- * and IP options.
++ /* Optimization, tack on the FIN if we have one skb in write queue and
++ * this skb was not yet sent, or we are under memory pressure.
++ * Note: in the latter case, FIN packet will be sent after a timeout,
++ * as TCP stack thinks it has already been transmitted.
+ */
+- mss_now = tcp_current_mss(sk);
+-
+- if (tcp_send_head(sk) != NULL) {
+- TCP_SKB_CB(skb)->tcp_flags |= TCPHDR_FIN;
+- TCP_SKB_CB(skb)->end_seq++;
++ if (tskb && (tcp_send_head(sk) || sk_under_memory_pressure(sk))) {
++coalesce:
++ TCP_SKB_CB(tskb)->tcp_flags |= TCPHDR_FIN;
++ TCP_SKB_CB(tskb)->end_seq++;
+ tp->write_seq++;
++ if (!tcp_send_head(sk)) {
++ /* This means tskb was already sent.
++ * Pretend we included the FIN on previous transmit.
++ * We need to set tp->snd_nxt to the value it would have
++ * if FIN had been sent. This is because retransmit path
++ * does not change tp->snd_nxt.
++ */
++ tp->snd_nxt++;
++ return;
++ }
+ } else {
+- /* Socket is locked, keep trying until memory is available. */
+- for (;;) {
+- skb = sk_stream_alloc_skb(sk, 0, sk->sk_allocation);
+- if (skb)
+- break;
+- yield();
++ skb = alloc_skb_fclone(MAX_TCP_HEADER, sk->sk_allocation);
++ if (unlikely(!skb)) {
++ if (tskb)
++ goto coalesce;
++ return;
+ }
++ skb_reserve(skb, MAX_TCP_HEADER);
++ sk_forced_wmem_schedule(sk, skb->truesize);
+ /* FIN eats a sequence byte, write_seq advanced by tcp_queue_skb(). */
+ tcp_init_nondata_skb(skb, tp->write_seq,
+ TCPHDR_ACK | TCPHDR_FIN);
+ tcp_queue_skb(sk, skb);
+ }
+- __tcp_push_pending_frames(sk, mss_now, TCP_NAGLE_OFF);
++ __tcp_push_pending_frames(sk, tcp_current_mss(sk), TCP_NAGLE_OFF);
+ }
+
+ /* We get here when a process closes a file descriptor (either due to
+diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
+index 79c965a51ab2..c0a418766f9c 100644
+--- a/net/netlink/af_netlink.c
++++ b/net/netlink/af_netlink.c
+@@ -1599,13 +1599,11 @@ static struct sk_buff *netlink_alloc_large_skb(unsigned int size,
+ if (data == NULL)
+ return NULL;
+
+- skb = build_skb(data, size);
++ skb = __build_skb(data, size);
+ if (skb == NULL)
+ vfree(data);
+- else {
+- skb->head_frag = 0;
++ else
+ skb->destructor = netlink_skb_destructor;
+- }
+
+ return skb;
+ }
+diff --git a/sound/pci/emu10k1/emu10k1.c b/sound/pci/emu10k1/emu10k1.c
+index 4c171636efcd..a432b4c7869f 100644
+--- a/sound/pci/emu10k1/emu10k1.c
++++ b/sound/pci/emu10k1/emu10k1.c
+@@ -183,8 +183,10 @@ static int snd_card_emu10k1_probe(struct pci_dev *pci,
+ }
+ #endif
+
+- strcpy(card->driver, emu->card_capabilities->driver);
+- strcpy(card->shortname, emu->card_capabilities->name);
++ strlcpy(card->driver, emu->card_capabilities->driver,
++ sizeof(card->driver));
++ strlcpy(card->shortname, emu->card_capabilities->name,
++ sizeof(card->shortname));
+ snprintf(card->longname, sizeof(card->longname),
+ "%s (rev.%d, serial:0x%x) at 0x%lx, irq %i",
+ card->shortname, emu->revision, emu->serial, emu->port, emu->irq);
+diff --git a/sound/pci/emu10k1/emu10k1_callback.c b/sound/pci/emu10k1/emu10k1_callback.c
+index 874cd76c7b7f..d2c7ea3a7610 100644
+--- a/sound/pci/emu10k1/emu10k1_callback.c
++++ b/sound/pci/emu10k1/emu10k1_callback.c
+@@ -415,7 +415,7 @@ start_voice(struct snd_emux_voice *vp)
+ snd_emu10k1_ptr_write(hw, Z2, ch, 0);
+
+ /* invalidate maps */
+- temp = (hw->silent_page.addr << 1) | MAP_PTI_MASK;
++ temp = (hw->silent_page.addr << hw->address_mode) | (hw->address_mode ? MAP_PTI_MASK1 : MAP_PTI_MASK0);
+ snd_emu10k1_ptr_write(hw, MAPA, ch, temp);
+ snd_emu10k1_ptr_write(hw, MAPB, ch, temp);
+ #if 0
+@@ -436,7 +436,7 @@ start_voice(struct snd_emux_voice *vp)
+ snd_emu10k1_ptr_write(hw, CDF, ch, sample);
+
+ /* invalidate maps */
+- temp = ((unsigned int)hw->silent_page.addr << 1) | MAP_PTI_MASK;
++ temp = ((unsigned int)hw->silent_page.addr << hw_address_mode) | (hw->address_mode ? MAP_PTI_MASK1 : MAP_PTI_MASK0);
+ snd_emu10k1_ptr_write(hw, MAPA, ch, temp);
+ snd_emu10k1_ptr_write(hw, MAPB, ch, temp);
+
+diff --git a/sound/pci/emu10k1/emu10k1_main.c b/sound/pci/emu10k1/emu10k1_main.c
+index 229269788023..92f2371791a3 100644
+--- a/sound/pci/emu10k1/emu10k1_main.c
++++ b/sound/pci/emu10k1/emu10k1_main.c
+@@ -282,7 +282,7 @@ static int snd_emu10k1_init(struct snd_emu10k1 *emu, int enable_ir, int resume)
+ snd_emu10k1_ptr_write(emu, TCB, 0, 0); /* taken from original driver */
+ snd_emu10k1_ptr_write(emu, TCBS, 0, 4); /* taken from original driver */
+
+- silent_page = (emu->silent_page.addr << 1) | MAP_PTI_MASK;
++ silent_page = (emu->silent_page.addr << emu->address_mode) | (emu->address_mode ? MAP_PTI_MASK1 : MAP_PTI_MASK0);
+ for (ch = 0; ch < NUM_G; ch++) {
+ snd_emu10k1_ptr_write(emu, MAPA, ch, silent_page);
+ snd_emu10k1_ptr_write(emu, MAPB, ch, silent_page);
+@@ -348,6 +348,11 @@ static int snd_emu10k1_init(struct snd_emu10k1 *emu, int enable_ir, int resume)
+ outl(reg | A_IOCFG_GPOUT0, emu->port + A_IOCFG);
+ }
+
++ if (emu->address_mode == 0) {
++ /* use 16M in 4G */
++ outl(inl(emu->port + HCFG) | HCFG_EXPANDED_MEM, emu->port + HCFG);
++ }
++
+ return 0;
+ }
+
+@@ -1424,7 +1429,7 @@ static struct snd_emu_chip_details emu_chip_details[] = {
+ *
+ */
+ {.vendor = 0x1102, .device = 0x0008, .subsystem = 0x20011102,
+- .driver = "Audigy2", .name = "SB Audigy 2 ZS Notebook [SB0530]",
++ .driver = "Audigy2", .name = "Audigy 2 ZS Notebook [SB0530]",
+ .id = "Audigy2",
+ .emu10k2_chip = 1,
+ .ca0108_chip = 1,
+@@ -1574,7 +1579,7 @@ static struct snd_emu_chip_details emu_chip_details[] = {
+ .adc_1361t = 1, /* 24 bit capture instead of 16bit */
+ .ac97_chip = 1} ,
+ {.vendor = 0x1102, .device = 0x0004, .subsystem = 0x10051102,
+- .driver = "Audigy2", .name = "SB Audigy 2 Platinum EX [SB0280]",
++ .driver = "Audigy2", .name = "Audigy 2 Platinum EX [SB0280]",
+ .id = "Audigy2",
+ .emu10k2_chip = 1,
+ .ca0102_chip = 1,
+@@ -1880,8 +1885,10 @@ int snd_emu10k1_create(struct snd_card *card,
+
+ is_audigy = emu->audigy = c->emu10k2_chip;
+
++ /* set addressing mode */
++ emu->address_mode = is_audigy ? 0 : 1;
+ /* set the DMA transfer mask */
+- emu->dma_mask = is_audigy ? AUDIGY_DMA_MASK : EMU10K1_DMA_MASK;
++ emu->dma_mask = emu->address_mode ? EMU10K1_DMA_MASK : AUDIGY_DMA_MASK;
+ if (pci_set_dma_mask(pci, emu->dma_mask) < 0 ||
+ pci_set_consistent_dma_mask(pci, emu->dma_mask) < 0) {
+ dev_err(card->dev,
+@@ -1906,7 +1913,7 @@ int snd_emu10k1_create(struct snd_card *card,
+
+ emu->max_cache_pages = max_cache_bytes >> PAGE_SHIFT;
+ if (snd_dma_alloc_pages(SNDRV_DMA_TYPE_DEV, snd_dma_pci_data(pci),
+- 32 * 1024, &emu->ptb_pages) < 0) {
++ (emu->address_mode ? 32 : 16) * 1024, &emu->ptb_pages) < 0) {
+ err = -ENOMEM;
+ goto error;
+ }
+@@ -2005,8 +2012,8 @@ int snd_emu10k1_create(struct snd_card *card,
+
+ /* Clear silent pages and set up pointers */
+ memset(emu->silent_page.area, 0, PAGE_SIZE);
+- silent_page = emu->silent_page.addr << 1;
+- for (idx = 0; idx < MAXPAGES; idx++)
++ silent_page = emu->silent_page.addr << emu->address_mode;
++ for (idx = 0; idx < (emu->address_mode ? MAXPAGES1 : MAXPAGES0); idx++)
+ ((u32 *)emu->ptb_pages.area)[idx] = cpu_to_le32(silent_page | idx);
+
+ /* set up voice indices */
+diff --git a/sound/pci/emu10k1/emupcm.c b/sound/pci/emu10k1/emupcm.c
+index f82481bd2542..36f0b8646417 100644
+--- a/sound/pci/emu10k1/emupcm.c
++++ b/sound/pci/emu10k1/emupcm.c
+@@ -380,7 +380,7 @@ static void snd_emu10k1_pcm_init_voice(struct snd_emu10k1 *emu,
+ snd_emu10k1_ptr_write(emu, Z1, voice, 0);
+ snd_emu10k1_ptr_write(emu, Z2, voice, 0);
+ /* invalidate maps */
+- silent_page = ((unsigned int)emu->silent_page.addr << 1) | MAP_PTI_MASK;
++ silent_page = ((unsigned int)emu->silent_page.addr << emu->address_mode) | (emu->address_mode ? MAP_PTI_MASK1 : MAP_PTI_MASK0);
+ snd_emu10k1_ptr_write(emu, MAPA, voice, silent_page);
+ snd_emu10k1_ptr_write(emu, MAPB, voice, silent_page);
+ /* modulation envelope */
+diff --git a/sound/pci/emu10k1/emuproc.c b/sound/pci/emu10k1/emuproc.c
+index 2ca9f2e93139..53745f4c2bf5 100644
+--- a/sound/pci/emu10k1/emuproc.c
++++ b/sound/pci/emu10k1/emuproc.c
+@@ -241,31 +241,22 @@ static void snd_emu10k1_proc_spdif_read(struct snd_info_entry *entry,
+ struct snd_emu10k1 *emu = entry->private_data;
+ u32 value;
+ u32 value2;
+- unsigned long flags;
+ u32 rate;
+
+ if (emu->card_capabilities->emu_model) {
+- spin_lock_irqsave(&emu->emu_lock, flags);
+ snd_emu1010_fpga_read(emu, 0x38, &value);
+- spin_unlock_irqrestore(&emu->emu_lock, flags);
+ if ((value & 0x1) == 0) {
+- spin_lock_irqsave(&emu->emu_lock, flags);
+ snd_emu1010_fpga_read(emu, 0x2a, &value);
+ snd_emu1010_fpga_read(emu, 0x2b, &value2);
+- spin_unlock_irqrestore(&emu->emu_lock, flags);
+ rate = 0x1770000 / (((value << 5) | value2)+1);
+ snd_iprintf(buffer, "ADAT Locked : %u\n", rate);
+ } else {
+ snd_iprintf(buffer, "ADAT Unlocked\n");
+ }
+- spin_lock_irqsave(&emu->emu_lock, flags);
+ snd_emu1010_fpga_read(emu, 0x20, &value);
+- spin_unlock_irqrestore(&emu->emu_lock, flags);
+ if ((value & 0x4) == 0) {
+- spin_lock_irqsave(&emu->emu_lock, flags);
+ snd_emu1010_fpga_read(emu, 0x28, &value);
+ snd_emu1010_fpga_read(emu, 0x29, &value2);
+- spin_unlock_irqrestore(&emu->emu_lock, flags);
+ rate = 0x1770000 / (((value << 5) | value2)+1);
+ snd_iprintf(buffer, "SPDIF Locked : %d\n", rate);
+ } else {
+@@ -410,14 +401,11 @@ static void snd_emu_proc_emu1010_reg_read(struct snd_info_entry *entry,
+ {
+ struct snd_emu10k1 *emu = entry->private_data;
+ u32 value;
+- unsigned long flags;
+ int i;
+ snd_iprintf(buffer, "EMU1010 Registers:\n\n");
+
+ for(i = 0; i < 0x40; i+=1) {
+- spin_lock_irqsave(&emu->emu_lock, flags);
+ snd_emu1010_fpga_read(emu, i, &value);
+- spin_unlock_irqrestore(&emu->emu_lock, flags);
+ snd_iprintf(buffer, "%02X: %08X, %02X\n", i, value, (value >> 8) & 0x7f);
+ }
+ }
+diff --git a/sound/pci/emu10k1/memory.c b/sound/pci/emu10k1/memory.c
+index c68e6dd2fa67..4f1f69be1865 100644
+--- a/sound/pci/emu10k1/memory.c
++++ b/sound/pci/emu10k1/memory.c
+@@ -34,10 +34,11 @@
+ * aligned pages in others
+ */
+ #define __set_ptb_entry(emu,page,addr) \
+- (((u32 *)(emu)->ptb_pages.area)[page] = cpu_to_le32(((addr) << 1) | (page)))
++ (((u32 *)(emu)->ptb_pages.area)[page] = cpu_to_le32(((addr) << (emu->address_mode)) | (page)))
+
+ #define UNIT_PAGES (PAGE_SIZE / EMUPAGESIZE)
+-#define MAX_ALIGN_PAGES (MAXPAGES / UNIT_PAGES)
++#define MAX_ALIGN_PAGES0 (MAXPAGES0 / UNIT_PAGES)
++#define MAX_ALIGN_PAGES1 (MAXPAGES1 / UNIT_PAGES)
+ /* get aligned page from offset address */
+ #define get_aligned_page(offset) ((offset) >> PAGE_SHIFT)
+ /* get offset address from aligned page */
+@@ -124,7 +125,7 @@ static int search_empty_map_area(struct snd_emu10k1 *emu, int npages, struct lis
+ }
+ page = blk->mapped_page + blk->pages;
+ }
+- size = MAX_ALIGN_PAGES - page;
++ size = (emu->address_mode ? MAX_ALIGN_PAGES1 : MAX_ALIGN_PAGES0) - page;
+ if (size >= max_size) {
+ *nextp = pos;
+ return page;
+@@ -181,7 +182,7 @@ static int unmap_memblk(struct snd_emu10k1 *emu, struct snd_emu10k1_memblk *blk)
+ q = get_emu10k1_memblk(p, mapped_link);
+ end_page = q->mapped_page;
+ } else
+- end_page = MAX_ALIGN_PAGES;
++ end_page = (emu->address_mode ? MAX_ALIGN_PAGES1 : MAX_ALIGN_PAGES0);
+
+ /* remove links */
+ list_del(&blk->mapped_link);
+@@ -307,7 +308,7 @@ snd_emu10k1_alloc_pages(struct snd_emu10k1 *emu, struct snd_pcm_substream *subst
+ if (snd_BUG_ON(!emu))
+ return NULL;
+ if (snd_BUG_ON(runtime->dma_bytes <= 0 ||
+- runtime->dma_bytes >= MAXPAGES * EMUPAGESIZE))
++ runtime->dma_bytes >= (emu->address_mode ? MAXPAGES1 : MAXPAGES0) * EMUPAGESIZE))
+ return NULL;
+ hdr = emu->memhdr;
+ if (snd_BUG_ON(!hdr))
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 1783a3332984..e3ad4a4d8d14 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -4906,12 +4906,14 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x17aa, 0x2212, "Thinkpad T440", ALC292_FIXUP_TPT440_DOCK),
+ SND_PCI_QUIRK(0x17aa, 0x2214, "Thinkpad X240", ALC292_FIXUP_TPT440_DOCK),
+ SND_PCI_QUIRK(0x17aa, 0x2215, "Thinkpad", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
++ SND_PCI_QUIRK(0x17aa, 0x2226, "ThinkPad X250", ALC292_FIXUP_TPT440_DOCK),
+ SND_PCI_QUIRK(0x17aa, 0x3977, "IdeaPad S210", ALC283_FIXUP_INT_MIC),
+ SND_PCI_QUIRK(0x17aa, 0x3978, "IdeaPad Y410P", ALC269_FIXUP_NO_SHUTUP),
+ SND_PCI_QUIRK(0x17aa, 0x5013, "Thinkpad", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
+ SND_PCI_QUIRK(0x17aa, 0x501a, "Thinkpad", ALC283_FIXUP_INT_MIC),
+ SND_PCI_QUIRK(0x17aa, 0x501e, "Thinkpad L440", ALC292_FIXUP_TPT440_DOCK),
+ SND_PCI_QUIRK(0x17aa, 0x5026, "Thinkpad", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
++ SND_PCI_QUIRK(0x17aa, 0x5034, "Thinkpad T450", ALC292_FIXUP_TPT440_DOCK),
+ SND_PCI_QUIRK(0x17aa, 0x5036, "Thinkpad T450s", ALC292_FIXUP_TPT440_DOCK),
+ SND_PCI_QUIRK(0x17aa, 0x5109, "Thinkpad", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
+ SND_PCI_QUIRK(0x17aa, 0x3bf8, "Quanta FL1", ALC269_FIXUP_PCM_44K),
+@@ -5412,6 +5414,8 @@ static int patch_alc269(struct hda_codec *codec)
+ break;
+ case 0x10ec0256:
+ spec->codec_variant = ALC269_TYPE_ALC256;
++ spec->gen.mixer_nid = 0; /* ALC256 does not have any loopback mixer path */
++ alc_update_coef_idx(codec, 0x36, 1 << 13, 1 << 5); /* Switch pcbeep path to Line in path*/
+ break;
+ }
+
+@@ -5425,8 +5429,8 @@ static int patch_alc269(struct hda_codec *codec)
+ if (err < 0)
+ goto error;
+
+- if (!spec->gen.no_analog && spec->gen.beep_nid)
+- set_beep_amp(spec, 0x0b, 0x04, HDA_INPUT);
++ if (!spec->gen.no_analog && spec->gen.beep_nid && spec->gen.mixer_nid)
++ set_beep_amp(spec, spec->gen.mixer_nid, 0x04, HDA_INPUT);
+
+ codec->patch_ops = alc_patch_ops;
+ #ifdef CONFIG_PM
+diff --git a/sound/pci/hda/thinkpad_helper.c b/sound/pci/hda/thinkpad_helper.c
+index 6ba0b5517c40..2341fc334163 100644
+--- a/sound/pci/hda/thinkpad_helper.c
++++ b/sound/pci/hda/thinkpad_helper.c
+@@ -72,6 +72,7 @@ static void hda_fixup_thinkpad_acpi(struct hda_codec *codec,
+ if (led_set_func(TPACPI_LED_MUTE, false) >= 0) {
+ old_vmaster_hook = spec->vmaster_mute.hook;
+ spec->vmaster_mute.hook = update_tpacpi_mute_led;
++ spec->vmaster_mute_enum = 1;
+ removefunc = false;
+ }
+ if (led_set_func(TPACPI_LED_MICMUTE, false) >= 0) {
+diff --git a/sound/soc/codecs/cs4271.c b/sound/soc/codecs/cs4271.c
+index 6ec074fec068..38c2adc99770 100644
+--- a/sound/soc/codecs/cs4271.c
++++ b/sound/soc/codecs/cs4271.c
+@@ -561,10 +561,10 @@ static int cs4271_probe(struct snd_soc_codec *codec)
+ if (gpio_is_valid(cs4271->gpio_nreset)) {
+ /* Reset codec */
+ gpio_direction_output(cs4271->gpio_nreset, 0);
+- udelay(1);
++ mdelay(1);
+ gpio_set_value(cs4271->gpio_nreset, 1);
+ /* Give the codec time to wake up */
+- udelay(1);
++ mdelay(1);
+ }
+
+ ret = regmap_update_bits(cs4271->regmap, CS4271_MODE2,
+diff --git a/sound/soc/codecs/pcm512x.c b/sound/soc/codecs/pcm512x.c
+index 640c99198cda..28b77214d821 100644
+--- a/sound/soc/codecs/pcm512x.c
++++ b/sound/soc/codecs/pcm512x.c
+@@ -261,9 +261,9 @@ static const struct soc_enum pcm512x_veds =
+ static const struct snd_kcontrol_new pcm512x_controls[] = {
+ SOC_DOUBLE_R_TLV("Digital Playback Volume", PCM512x_DIGITAL_VOLUME_2,
+ PCM512x_DIGITAL_VOLUME_3, 0, 255, 1, digital_tlv),
+-SOC_DOUBLE_TLV("Playback Volume", PCM512x_ANALOG_GAIN_CTRL,
++SOC_DOUBLE_TLV("Analogue Playback Volume", PCM512x_ANALOG_GAIN_CTRL,
+ PCM512x_LAGN_SHIFT, PCM512x_RAGN_SHIFT, 1, 1, analog_tlv),
+-SOC_DOUBLE_TLV("Playback Boost Volume", PCM512x_ANALOG_GAIN_BOOST,
++SOC_DOUBLE_TLV("Analogue Playback Boost Volume", PCM512x_ANALOG_GAIN_BOOST,
+ PCM512x_AGBL_SHIFT, PCM512x_AGBR_SHIFT, 1, 0, boost_tlv),
+ SOC_DOUBLE("Digital Playback Switch", PCM512x_MUTE, PCM512x_RQML_SHIFT,
+ PCM512x_RQMR_SHIFT, 1, 1),
+diff --git a/sound/soc/codecs/rt5677.c b/sound/soc/codecs/rt5677.c
+index 16aa4d99a713..691237a3ab52 100644
+--- a/sound/soc/codecs/rt5677.c
++++ b/sound/soc/codecs/rt5677.c
+@@ -644,7 +644,7 @@ static int set_dmic_clk(struct snd_soc_dapm_widget *w,
+ {
+ struct snd_soc_codec *codec = w->codec;
+ struct rt5677_priv *rt5677 = snd_soc_codec_get_drvdata(codec);
+- int idx = rl6231_calc_dmic_clk(rt5677->sysclk);
++ int idx = rl6231_calc_dmic_clk(rt5677->lrck[RT5677_AIF1] << 8);
+
+ if (idx < 0)
+ dev_err(codec->dev, "Failed to set DMIC clock\n");
+diff --git a/sound/soc/codecs/wm8741.c b/sound/soc/codecs/wm8741.c
+index 31bb4801a005..9e71c768966f 100644
+--- a/sound/soc/codecs/wm8741.c
++++ b/sound/soc/codecs/wm8741.c
+@@ -123,7 +123,7 @@ static struct {
+ };
+
+ static const unsigned int rates_11289[] = {
+- 44100, 88235,
++ 44100, 88200,
+ };
+
+ static const struct snd_pcm_hw_constraint_list constraints_11289 = {
+@@ -150,7 +150,7 @@ static const struct snd_pcm_hw_constraint_list constraints_16384 = {
+ };
+
+ static const unsigned int rates_16934[] = {
+- 44100, 88235,
++ 44100, 88200,
+ };
+
+ static const struct snd_pcm_hw_constraint_list constraints_16934 = {
+@@ -168,7 +168,7 @@ static const struct snd_pcm_hw_constraint_list constraints_18432 = {
+ };
+
+ static const unsigned int rates_22579[] = {
+- 44100, 88235, 1764000
++ 44100, 88200, 176400
+ };
+
+ static const struct snd_pcm_hw_constraint_list constraints_22579 = {
+@@ -186,7 +186,7 @@ static const struct snd_pcm_hw_constraint_list constraints_24576 = {
+ };
+
+ static const unsigned int rates_36864[] = {
+- 48000, 96000, 19200
++ 48000, 96000, 192000
+ };
+
+ static const struct snd_pcm_hw_constraint_list constraints_36864 = {
+diff --git a/sound/soc/davinci/davinci-evm.c b/sound/soc/davinci/davinci-evm.c
+index a50010e2891f..82837e5e96ab 100644
+--- a/sound/soc/davinci/davinci-evm.c
++++ b/sound/soc/davinci/davinci-evm.c
+@@ -431,18 +431,8 @@ static int davinci_evm_probe(struct platform_device *pdev)
+ return ret;
+ }
+
+-static int davinci_evm_remove(struct platform_device *pdev)
+-{
+- struct snd_soc_card *card = platform_get_drvdata(pdev);
+-
+- snd_soc_unregister_card(card);
+-
+- return 0;
+-}
+-
+ static struct platform_driver davinci_evm_driver = {
+ .probe = davinci_evm_probe,
+- .remove = davinci_evm_remove,
+ .driver = {
+ .name = "davinci_evm",
+ .owner = THIS_MODULE,
+diff --git a/sound/soc/samsung/s3c24xx-i2s.c b/sound/soc/samsung/s3c24xx-i2s.c
+index e87d9a2053b8..fb1d39324a65 100644
+--- a/sound/soc/samsung/s3c24xx-i2s.c
++++ b/sound/soc/samsung/s3c24xx-i2s.c
+@@ -461,8 +461,8 @@ static int s3c24xx_iis_dev_probe(struct platform_device *pdev)
+ return -ENOENT;
+ }
+ s3c24xx_i2s.regs = devm_ioremap_resource(&pdev->dev, res);
+- if (s3c24xx_i2s.regs == NULL)
+- return -ENXIO;
++ if (IS_ERR(s3c24xx_i2s.regs))
++ return PTR_ERR(s3c24xx_i2s.regs);
+
+ s3c24xx_i2s_pcm_stereo_out.dma_addr = res->start + S3C2410_IISFIFO;
+ s3c24xx_i2s_pcm_stereo_in.dma_addr = res->start + S3C2410_IISFIFO;
+diff --git a/sound/synth/emux/emux_oss.c b/sound/synth/emux/emux_oss.c
+index 319754cf6208..daf61abc3670 100644
+--- a/sound/synth/emux/emux_oss.c
++++ b/sound/synth/emux/emux_oss.c
+@@ -118,12 +118,8 @@ snd_emux_open_seq_oss(struct snd_seq_oss_arg *arg, void *closure)
+ if (snd_BUG_ON(!arg || !emu))
+ return -ENXIO;
+
+- mutex_lock(&emu->register_mutex);
+-
+- if (!snd_emux_inc_count(emu)) {
+- mutex_unlock(&emu->register_mutex);
++ if (!snd_emux_inc_count(emu))
+ return -EFAULT;
+- }
+
+ memset(&callback, 0, sizeof(callback));
+ callback.owner = THIS_MODULE;
+@@ -135,7 +131,6 @@ snd_emux_open_seq_oss(struct snd_seq_oss_arg *arg, void *closure)
+ if (p == NULL) {
+ snd_printk(KERN_ERR "can't create port\n");
+ snd_emux_dec_count(emu);
+- mutex_unlock(&emu->register_mutex);
+ return -ENOMEM;
+ }
+
+@@ -148,8 +143,6 @@ snd_emux_open_seq_oss(struct snd_seq_oss_arg *arg, void *closure)
+ reset_port_mode(p, arg->seq_mode);
+
+ snd_emux_reset_port(p);
+-
+- mutex_unlock(&emu->register_mutex);
+ return 0;
+ }
+
+@@ -195,13 +188,11 @@ snd_emux_close_seq_oss(struct snd_seq_oss_arg *arg)
+ if (snd_BUG_ON(!emu))
+ return -ENXIO;
+
+- mutex_lock(&emu->register_mutex);
+ snd_emux_sounds_off_all(p);
+ snd_soundfont_close_check(emu->sflist, SF_CLIENT_NO(p->chset.port));
+ snd_seq_event_port_detach(p->chset.client, p->chset.port);
+ snd_emux_dec_count(emu);
+
+- mutex_unlock(&emu->register_mutex);
+ return 0;
+ }
+
+diff --git a/sound/synth/emux/emux_seq.c b/sound/synth/emux/emux_seq.c
+index 7778b8e19782..a0209204ae48 100644
+--- a/sound/synth/emux/emux_seq.c
++++ b/sound/synth/emux/emux_seq.c
+@@ -124,12 +124,10 @@ snd_emux_detach_seq(struct snd_emux *emu)
+ if (emu->voices)
+ snd_emux_terminate_all(emu);
+
+- mutex_lock(&emu->register_mutex);
+ if (emu->client >= 0) {
+ snd_seq_delete_kernel_client(emu->client);
+ emu->client = -1;
+ }
+- mutex_unlock(&emu->register_mutex);
+ }
+
+
+@@ -269,8 +267,8 @@ snd_emux_event_input(struct snd_seq_event *ev, int direct, void *private_data,
+ /*
+ * increment usage count
+ */
+-int
+-snd_emux_inc_count(struct snd_emux *emu)
++static int
++__snd_emux_inc_count(struct snd_emux *emu)
+ {
+ emu->used++;
+ if (!try_module_get(emu->ops.owner))
+@@ -284,12 +282,21 @@ snd_emux_inc_count(struct snd_emux *emu)
+ return 1;
+ }
+
++int snd_emux_inc_count(struct snd_emux *emu)
++{
++ int ret;
++
++ mutex_lock(&emu->register_mutex);
++ ret = __snd_emux_inc_count(emu);
++ mutex_unlock(&emu->register_mutex);
++ return ret;
++}
+
+ /*
+ * decrease usage count
+ */
+-void
+-snd_emux_dec_count(struct snd_emux *emu)
++static void
++__snd_emux_dec_count(struct snd_emux *emu)
+ {
+ module_put(emu->card->module);
+ emu->used--;
+@@ -298,6 +305,12 @@ snd_emux_dec_count(struct snd_emux *emu)
+ module_put(emu->ops.owner);
+ }
+
++void snd_emux_dec_count(struct snd_emux *emu)
++{
++ mutex_lock(&emu->register_mutex);
++ __snd_emux_dec_count(emu);
++ mutex_unlock(&emu->register_mutex);
++}
+
+ /*
+ * Routine that is called upon a first use of a particular port
+@@ -317,7 +330,7 @@ snd_emux_use(void *private_data, struct snd_seq_port_subscribe *info)
+
+ mutex_lock(&emu->register_mutex);
+ snd_emux_init_port(p);
+- snd_emux_inc_count(emu);
++ __snd_emux_inc_count(emu);
+ mutex_unlock(&emu->register_mutex);
+ return 0;
+ }
+@@ -340,7 +353,7 @@ snd_emux_unuse(void *private_data, struct snd_seq_port_subscribe *info)
+
+ mutex_lock(&emu->register_mutex);
+ snd_emux_sounds_off_all(p);
+- snd_emux_dec_count(emu);
++ __snd_emux_dec_count(emu);
+ mutex_unlock(&emu->register_mutex);
+ return 0;
+ }
+diff --git a/tools/lib/traceevent/kbuffer-parse.c b/tools/lib/traceevent/kbuffer-parse.c
+index dcc665228c71..deb3569ab004 100644
+--- a/tools/lib/traceevent/kbuffer-parse.c
++++ b/tools/lib/traceevent/kbuffer-parse.c
+@@ -372,7 +372,6 @@ translate_data(struct kbuffer *kbuf, void *data, void **rptr,
+ switch (type_len) {
+ case KBUFFER_TYPE_PADDING:
+ *length = read_4(kbuf, data);
+- data += *length;
+ break;
+
+ case KBUFFER_TYPE_TIME_EXTEND:
+diff --git a/tools/perf/util/cloexec.c b/tools/perf/util/cloexec.c
+index 6da965bdbc2c..85b523885f9d 100644
+--- a/tools/perf/util/cloexec.c
++++ b/tools/perf/util/cloexec.c
+@@ -7,6 +7,12 @@
+
+ static unsigned long flag = PERF_FLAG_FD_CLOEXEC;
+
++int __weak sched_getcpu(void)
++{
++ errno = ENOSYS;
++ return -1;
++}
++
+ static int perf_flag_probe(void)
+ {
+ /* use 'safest' configuration as used in perf_evsel__fallback() */
+diff --git a/tools/perf/util/cloexec.h b/tools/perf/util/cloexec.h
+index 94a5a7d829d5..68888c29b04a 100644
+--- a/tools/perf/util/cloexec.h
++++ b/tools/perf/util/cloexec.h
+@@ -3,4 +3,10 @@
+
+ unsigned long perf_event_open_cloexec_flag(void);
+
++#ifdef __GLIBC_PREREQ
++#if !__GLIBC_PREREQ(2, 6)
++extern int sched_getcpu(void) __THROW;
++#endif
++#endif
++
+ #endif /* __PERF_CLOEXEC_H */
+diff --git a/tools/perf/util/symbol-elf.c b/tools/perf/util/symbol-elf.c
+index 1e23a5bfb044..fcaf06b40558 100644
+--- a/tools/perf/util/symbol-elf.c
++++ b/tools/perf/util/symbol-elf.c
+@@ -48,6 +48,10 @@ static inline uint8_t elf_sym__type(const GElf_Sym *sym)
+ return GELF_ST_TYPE(sym->st_info);
+ }
+
++#ifndef STT_GNU_IFUNC
++#define STT_GNU_IFUNC 10
++#endif
++
+ static inline int elf_sym__is_function(const GElf_Sym *sym)
+ {
+ return (elf_sym__type(sym) == STT_FUNC ||
+diff --git a/tools/power/x86/turbostat/Makefile b/tools/power/x86/turbostat/Makefile
+index d1b3a361e526..4039854560d0 100644
+--- a/tools/power/x86/turbostat/Makefile
++++ b/tools/power/x86/turbostat/Makefile
+@@ -1,8 +1,12 @@
+ CC = $(CROSS_COMPILE)gcc
+-BUILD_OUTPUT := $(PWD)
++BUILD_OUTPUT := $(CURDIR)
+ PREFIX := /usr
+ DESTDIR :=
+
++ifeq ("$(origin O)", "command line")
++ BUILD_OUTPUT := $(O)
++endif
++
+ turbostat : turbostat.c
+ CFLAGS += -Wall
+ CFLAGS += -DMSRHEADER='"../../../../arch/x86/include/uapi/asm/msr-index.h"'
+diff --git a/virt/kvm/arm/arch_timer.c b/virt/kvm/arm/arch_timer.c
+index 22fa819a9b6a..1c0772b340d8 100644
+--- a/virt/kvm/arm/arch_timer.c
++++ b/virt/kvm/arm/arch_timer.c
+@@ -61,12 +61,14 @@ static void timer_disarm(struct arch_timer_cpu *timer)
+
+ static void kvm_timer_inject_irq(struct kvm_vcpu *vcpu)
+ {
++ int ret;
+ struct arch_timer_cpu *timer = &vcpu->arch.timer_cpu;
+
+ timer->cntv_ctl |= ARCH_TIMER_CTRL_IT_MASK;
+- kvm_vgic_inject_irq(vcpu->kvm, vcpu->vcpu_id,
+- timer->irq->irq,
+- timer->irq->level);
++ ret = kvm_vgic_inject_irq(vcpu->kvm, vcpu->vcpu_id,
++ timer->irq->irq,
++ timer->irq->level);
++ WARN_ON(ret);
+ }
+
+ static irqreturn_t kvm_arch_timer_handler(int irq, void *dev_id)
+@@ -307,12 +309,24 @@ void kvm_timer_vcpu_terminate(struct kvm_vcpu *vcpu)
+ timer_disarm(timer);
+ }
+
+-int kvm_timer_init(struct kvm *kvm)
++void kvm_timer_enable(struct kvm *kvm)
+ {
+- if (timecounter && wqueue) {
+- kvm->arch.timer.cntvoff = kvm_phys_timer_read();
++ if (kvm->arch.timer.enabled)
++ return;
++
++ /*
++ * There is a potential race here between VCPUs starting for the first
++ * time, which may be enabling the timer multiple times. That doesn't
++ * hurt though, because we're just setting a variable to the same
++ * variable that it already was. The important thing is that all
++ * VCPUs have the enabled variable set, before entering the guest, if
++ * the arch timers are enabled.
++ */
++ if (timecounter && wqueue)
+ kvm->arch.timer.enabled = 1;
+- }
++}
+
+- return 0;
++void kvm_timer_init(struct kvm *kvm)
++{
++ kvm->arch.timer.cntvoff = kvm_phys_timer_read();
+ }
+diff --git a/virt/kvm/arm/vgic-v2.c b/virt/kvm/arm/vgic-v2.c
+index 2935405ad22f..b9d48e8e1eb4 100644
+--- a/virt/kvm/arm/vgic-v2.c
++++ b/virt/kvm/arm/vgic-v2.c
+@@ -72,6 +72,8 @@ static void vgic_v2_sync_lr_elrsr(struct kvm_vcpu *vcpu, int lr,
+ {
+ if (!(lr_desc.state & LR_STATE_MASK))
+ vcpu->arch.vgic_cpu.vgic_v2.vgic_elrsr |= (1ULL << lr);
++ else
++ vcpu->arch.vgic_cpu.vgic_v2.vgic_elrsr &= ~(1ULL << lr);
+ }
+
+ static u64 vgic_v2_get_elrsr(const struct kvm_vcpu *vcpu)
+@@ -84,6 +86,11 @@ static u64 vgic_v2_get_eisr(const struct kvm_vcpu *vcpu)
+ return vcpu->arch.vgic_cpu.vgic_v2.vgic_eisr;
+ }
+
++static void vgic_v2_clear_eisr(struct kvm_vcpu *vcpu)
++{
++ vcpu->arch.vgic_cpu.vgic_v2.vgic_eisr = 0;
++}
++
+ static u32 vgic_v2_get_interrupt_status(const struct kvm_vcpu *vcpu)
+ {
+ u32 misr = vcpu->arch.vgic_cpu.vgic_v2.vgic_misr;
+@@ -148,6 +155,7 @@ static const struct vgic_ops vgic_v2_ops = {
+ .sync_lr_elrsr = vgic_v2_sync_lr_elrsr,
+ .get_elrsr = vgic_v2_get_elrsr,
+ .get_eisr = vgic_v2_get_eisr,
++ .clear_eisr = vgic_v2_clear_eisr,
+ .get_interrupt_status = vgic_v2_get_interrupt_status,
+ .enable_underflow = vgic_v2_enable_underflow,
+ .disable_underflow = vgic_v2_disable_underflow,
+diff --git a/virt/kvm/arm/vgic-v3.c b/virt/kvm/arm/vgic-v3.c
+index 1c2c8eef0599..58b8af00ee4c 100644
+--- a/virt/kvm/arm/vgic-v3.c
++++ b/virt/kvm/arm/vgic-v3.c
+@@ -86,6 +86,8 @@ static void vgic_v3_sync_lr_elrsr(struct kvm_vcpu *vcpu, int lr,
+ {
+ if (!(lr_desc.state & LR_STATE_MASK))
+ vcpu->arch.vgic_cpu.vgic_v3.vgic_elrsr |= (1U << lr);
++ else
++ vcpu->arch.vgic_cpu.vgic_v3.vgic_elrsr &= ~(1U << lr);
+ }
+
+ static u64 vgic_v3_get_elrsr(const struct kvm_vcpu *vcpu)
+@@ -98,6 +100,11 @@ static u64 vgic_v3_get_eisr(const struct kvm_vcpu *vcpu)
+ return vcpu->arch.vgic_cpu.vgic_v3.vgic_eisr;
+ }
+
++static void vgic_v3_clear_eisr(struct kvm_vcpu *vcpu)
++{
++ vcpu->arch.vgic_cpu.vgic_v3.vgic_eisr = 0;
++}
++
+ static u32 vgic_v3_get_interrupt_status(const struct kvm_vcpu *vcpu)
+ {
+ u32 misr = vcpu->arch.vgic_cpu.vgic_v3.vgic_misr;
+@@ -162,6 +169,7 @@ static const struct vgic_ops vgic_v3_ops = {
+ .sync_lr_elrsr = vgic_v3_sync_lr_elrsr,
+ .get_elrsr = vgic_v3_get_elrsr,
+ .get_eisr = vgic_v3_get_eisr,
++ .clear_eisr = vgic_v3_clear_eisr,
+ .get_interrupt_status = vgic_v3_get_interrupt_status,
+ .enable_underflow = vgic_v3_enable_underflow,
+ .disable_underflow = vgic_v3_disable_underflow,
+diff --git a/virt/kvm/arm/vgic.c b/virt/kvm/arm/vgic.c
+index aacdb59f30de..5f67fadfca65 100644
+--- a/virt/kvm/arm/vgic.c
++++ b/virt/kvm/arm/vgic.c
+@@ -91,6 +91,7 @@
+ #define ACCESS_WRITE_VALUE (3 << 1)
+ #define ACCESS_WRITE_MASK(x) ((x) & (3 << 1))
+
++static int vgic_init(struct kvm *kvm);
+ static void vgic_retire_disabled_irqs(struct kvm_vcpu *vcpu);
+ static void vgic_retire_lr(int lr_nr, int irq, struct kvm_vcpu *vcpu);
+ static void vgic_update_state(struct kvm *kvm);
+@@ -1218,6 +1219,11 @@ static inline u64 vgic_get_eisr(struct kvm_vcpu *vcpu)
+ return vgic_ops->get_eisr(vcpu);
+ }
+
++static inline void vgic_clear_eisr(struct kvm_vcpu *vcpu)
++{
++ vgic_ops->clear_eisr(vcpu);
++}
++
+ static inline u32 vgic_get_interrupt_status(struct kvm_vcpu *vcpu)
+ {
+ return vgic_ops->get_interrupt_status(vcpu);
+@@ -1257,6 +1263,7 @@ static void vgic_retire_lr(int lr_nr, int irq, struct kvm_vcpu *vcpu)
+ vgic_set_lr(vcpu, lr_nr, vlr);
+ clear_bit(lr_nr, vgic_cpu->lr_used);
+ vgic_cpu->vgic_irq_lr_map[irq] = LR_EMPTY;
++ vgic_sync_lr_elrsr(vcpu, lr_nr, vlr);
+ }
+
+ /*
+@@ -1312,6 +1319,7 @@ static bool vgic_queue_irq(struct kvm_vcpu *vcpu, u8 sgi_source_id, int irq)
+ BUG_ON(!test_bit(lr, vgic_cpu->lr_used));
+ vlr.state |= LR_STATE_PENDING;
+ vgic_set_lr(vcpu, lr, vlr);
++ vgic_sync_lr_elrsr(vcpu, lr, vlr);
+ return true;
+ }
+ }
+@@ -1333,6 +1341,7 @@ static bool vgic_queue_irq(struct kvm_vcpu *vcpu, u8 sgi_source_id, int irq)
+ vlr.state |= LR_EOI_INT;
+
+ vgic_set_lr(vcpu, lr, vlr);
++ vgic_sync_lr_elrsr(vcpu, lr, vlr);
+
+ return true;
+ }
+@@ -1501,6 +1510,14 @@ static bool vgic_process_maintenance(struct kvm_vcpu *vcpu)
+ if (status & INT_STATUS_UNDERFLOW)
+ vgic_disable_underflow(vcpu);
+
++ /*
++ * In the next iterations of the vcpu loop, if we sync the vgic state
++ * after flushing it, but before entering the guest (this happens for
++ * pending signals and vmid rollovers), then make sure we don't pick
++ * up any old maintenance interrupts here.
++ */
++ vgic_clear_eisr(vcpu);
++
+ return level_pending;
+ }
+
+@@ -1607,7 +1624,7 @@ static int vgic_validate_injection(struct kvm_vcpu *vcpu, int irq, int level)
+ }
+ }
+
+-static bool vgic_update_irq_pending(struct kvm *kvm, int cpuid,
++static int vgic_update_irq_pending(struct kvm *kvm, int cpuid,
+ unsigned int irq_num, bool level)
+ {
+ struct vgic_dist *dist = &kvm->arch.vgic;
+@@ -1672,7 +1689,7 @@ static bool vgic_update_irq_pending(struct kvm *kvm, int cpuid,
+ out:
+ spin_unlock(&dist->lock);
+
+- return ret;
++ return ret ? cpuid : -EINVAL;
+ }
+
+ /**
+@@ -1692,11 +1709,29 @@ out:
+ int kvm_vgic_inject_irq(struct kvm *kvm, int cpuid, unsigned int irq_num,
+ bool level)
+ {
+- if (likely(vgic_initialized(kvm)) &&
+- vgic_update_irq_pending(kvm, cpuid, irq_num, level))
+- vgic_kick_vcpus(kvm);
++ int ret = 0;
++ int vcpu_id;
+
+- return 0;
++ if (unlikely(!vgic_initialized(kvm))) {
++ mutex_lock(&kvm->lock);
++ ret = vgic_init(kvm);
++ mutex_unlock(&kvm->lock);
++
++ if (ret)
++ goto out;
++ }
++
++ if (irq_num >= kvm->arch.vgic.nr_irqs)
++ return -EINVAL;
++
++ vcpu_id = vgic_update_irq_pending(kvm, cpuid, irq_num, level);
++ if (vcpu_id >= 0) {
++ /* kick the specified vcpu */
++ kvm_vcpu_kick(kvm_get_vcpu(kvm, vcpu_id));
++ }
++
++out:
++ return ret;
+ }
+
+ static irqreturn_t vgic_maintenance_handler(int irq, void *data)
+@@ -1726,39 +1761,14 @@ static int vgic_vcpu_init_maps(struct kvm_vcpu *vcpu, int nr_irqs)
+
+ int sz = (nr_irqs - VGIC_NR_PRIVATE_IRQS) / 8;
+ vgic_cpu->pending_shared = kzalloc(sz, GFP_KERNEL);
+- vgic_cpu->vgic_irq_lr_map = kzalloc(nr_irqs, GFP_KERNEL);
++ vgic_cpu->vgic_irq_lr_map = kmalloc(nr_irqs, GFP_KERNEL);
+
+ if (!vgic_cpu->pending_shared || !vgic_cpu->vgic_irq_lr_map) {
+ kvm_vgic_vcpu_destroy(vcpu);
+ return -ENOMEM;
+ }
+
+- return 0;
+-}
+-
+-/**
+- * kvm_vgic_vcpu_init - Initialize per-vcpu VGIC state
+- * @vcpu: pointer to the vcpu struct
+- *
+- * Initialize the vgic_cpu struct and vgic_dist struct fields pertaining to
+- * this vcpu and enable the VGIC for this VCPU
+- */
+-static void kvm_vgic_vcpu_init(struct kvm_vcpu *vcpu)
+-{
+- struct vgic_cpu *vgic_cpu = &vcpu->arch.vgic_cpu;
+- struct vgic_dist *dist = &vcpu->kvm->arch.vgic;
+- int i;
+-
+- for (i = 0; i < dist->nr_irqs; i++) {
+- if (i < VGIC_NR_PPIS)
+- vgic_bitmap_set_irq_val(&dist->irq_enabled,
+- vcpu->vcpu_id, i, 1);
+- if (i < VGIC_NR_PRIVATE_IRQS)
+- vgic_bitmap_set_irq_val(&dist->irq_cfg,
+- vcpu->vcpu_id, i, VGIC_CFG_EDGE);
+-
+- vgic_cpu->vgic_irq_lr_map[i] = LR_EMPTY;
+- }
++ memset(vgic_cpu->vgic_irq_lr_map, LR_EMPTY, nr_irqs);
+
+ /*
+ * Store the number of LRs per vcpu, so we don't have to go
+@@ -1767,7 +1777,7 @@ static void kvm_vgic_vcpu_init(struct kvm_vcpu *vcpu)
+ */
+ vgic_cpu->nr_lr = vgic->nr_lr;
+
+- vgic_enable(vcpu);
++ return 0;
+ }
+
+ void kvm_vgic_destroy(struct kvm *kvm)
+@@ -1804,19 +1814,19 @@ void kvm_vgic_destroy(struct kvm *kvm)
+ * Allocate and initialize the various data structures. Must be called
+ * with kvm->lock held!
+ */
+-static int vgic_init_maps(struct kvm *kvm)
++static int vgic_init(struct kvm *kvm)
+ {
+ struct vgic_dist *dist = &kvm->arch.vgic;
+ struct kvm_vcpu *vcpu;
+ int nr_cpus, nr_irqs;
+- int ret, i;
++ int ret, i, vcpu_id;
+
+ if (dist->nr_cpus) /* Already allocated */
+ return 0;
+
+ nr_cpus = dist->nr_cpus = atomic_read(&kvm->online_vcpus);
+ if (!nr_cpus) /* No vcpus? Can't be good... */
+- return -EINVAL;
++ return -ENODEV;
+
+ /*
+ * If nobody configured the number of interrupts, use the
+@@ -1859,16 +1869,28 @@ static int vgic_init_maps(struct kvm *kvm)
+ if (ret)
+ goto out;
+
+- kvm_for_each_vcpu(i, vcpu, kvm) {
++ for (i = VGIC_NR_PRIVATE_IRQS; i < dist->nr_irqs; i += 4)
++ vgic_set_target_reg(kvm, 0, i);
++
++ kvm_for_each_vcpu(vcpu_id, vcpu, kvm) {
+ ret = vgic_vcpu_init_maps(vcpu, nr_irqs);
+ if (ret) {
+ kvm_err("VGIC: Failed to allocate vcpu memory\n");
+ break;
+ }
+- }
+
+- for (i = VGIC_NR_PRIVATE_IRQS; i < dist->nr_irqs; i += 4)
+- vgic_set_target_reg(kvm, 0, i);
++ for (i = 0; i < dist->nr_irqs; i++) {
++ if (i < VGIC_NR_PPIS)
++ vgic_bitmap_set_irq_val(&dist->irq_enabled,
++ vcpu->vcpu_id, i, 1);
++ if (i < VGIC_NR_PRIVATE_IRQS)
++ vgic_bitmap_set_irq_val(&dist->irq_cfg,
++ vcpu->vcpu_id, i,
++ VGIC_CFG_EDGE);
++ }
++
++ vgic_enable(vcpu);
++ }
+
+ out:
+ if (ret)
+@@ -1878,18 +1900,16 @@ out:
+ }
+
+ /**
+- * kvm_vgic_init - Initialize global VGIC state before running any VCPUs
++ * kvm_vgic_map_resources - Configure global VGIC state before running any VCPUs
+ * @kvm: pointer to the kvm struct
+ *
+ * Map the virtual CPU interface into the VM before running any VCPUs. We
+ * can't do this at creation time, because user space must first set the
+- * virtual CPU interface address in the guest physical address space. Also
+- * initialize the ITARGETSRn regs to 0 on the emulated distributor.
++ * virtual CPU interface address in the guest physical address space.
+ */
+-int kvm_vgic_init(struct kvm *kvm)
++int kvm_vgic_map_resources(struct kvm *kvm)
+ {
+- struct kvm_vcpu *vcpu;
+- int ret = 0, i;
++ int ret = 0;
+
+ if (!irqchip_in_kernel(kvm))
+ return 0;
+@@ -1906,7 +1926,11 @@ int kvm_vgic_init(struct kvm *kvm)
+ goto out;
+ }
+
+- ret = vgic_init_maps(kvm);
++ /*
++ * Initialize the vgic if this hasn't already been done on demand by
++ * accessing the vgic state from userspace.
++ */
++ ret = vgic_init(kvm);
+ if (ret) {
+ kvm_err("Unable to allocate maps\n");
+ goto out;
+@@ -1920,9 +1944,6 @@ int kvm_vgic_init(struct kvm *kvm)
+ goto out;
+ }
+
+- kvm_for_each_vcpu(i, vcpu, kvm)
+- kvm_vgic_vcpu_init(vcpu);
+-
+ kvm->arch.vgic.ready = true;
+ out:
+ if (ret)
+@@ -2167,7 +2188,7 @@ static int vgic_attr_regs_access(struct kvm_device *dev,
+
+ mutex_lock(&dev->kvm->lock);
+
+- ret = vgic_init_maps(dev->kvm);
++ ret = vgic_init(dev->kvm);
+ if (ret)
+ goto out;
+
+diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
+index 272fee82f89e..4e52bb926374 100644
+--- a/virt/kvm/kvm_main.c
++++ b/virt/kvm/kvm_main.c
+@@ -1615,8 +1615,8 @@ int kvm_gfn_to_hva_cache_init(struct kvm *kvm, struct gfn_to_hva_cache *ghc,
+ ghc->generation = slots->generation;
+ ghc->len = len;
+ ghc->memslot = gfn_to_memslot(kvm, start_gfn);
+- ghc->hva = gfn_to_hva_many(ghc->memslot, start_gfn, &nr_pages_avail);
+- if (!kvm_is_error_hva(ghc->hva) && nr_pages_avail >= nr_pages_needed) {
++ ghc->hva = gfn_to_hva_many(ghc->memslot, start_gfn, NULL);
++ if (!kvm_is_error_hva(ghc->hva) && nr_pages_needed <= 1) {
+ ghc->hva += offset;
+ } else {
+ /*
^ permalink raw reply related [flat|nested] 67+ messages in thread
* [gentoo-commits] proj/linux-patches:3.18 commit in: /
@ 2015-06-19 15:22 Mike Pagano
0 siblings, 0 replies; 67+ messages in thread
From: Mike Pagano @ 2015-06-19 15:22 UTC (permalink / raw
To: gentoo-commits
commit: 864427fd03253f5f3be589ea76c2800603aa16d3
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Fri Jun 19 15:09:55 2015 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Fri Jun 19 15:09:55 2015 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=864427fd
Linux patch 3.18.15. Linux patch 3.18.16.
0000_README | 8 +
1014_linux-3.18.15.patch | 6179 ++++++++++++++++++++++++++++++++++++++++++++++
1015_linux-3.18.16.patch | 59 +
3 files changed, 6246 insertions(+)
diff --git a/0000_README b/0000_README
index ae90a46..f5bcf7e 100644
--- a/0000_README
+++ b/0000_README
@@ -99,6 +99,14 @@ Patch: 1013_linux-3.18.14.patch
From: http://www.kernel.org
Desc: Linux 3.18.14
+Patch: 1014_linux-3.18.15.patch
+From: http://www.kernel.org
+Desc: Linux 3.18.15
+
+Patch: 1015_linux-3.18.16.patch
+From: http://www.kernel.org
+Desc: Linux 3.18.16
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1014_linux-3.18.15.patch b/1014_linux-3.18.15.patch
new file mode 100644
index 0000000..710fbbe
--- /dev/null
+++ b/1014_linux-3.18.15.patch
@@ -0,0 +1,6179 @@
+diff --git a/Documentation/devicetree/bindings/dma/fsl-mxs-dma.txt b/Documentation/devicetree/bindings/dma/fsl-mxs-dma.txt
+index a4873e5e3e36..e30e184f50c7 100644
+--- a/Documentation/devicetree/bindings/dma/fsl-mxs-dma.txt
++++ b/Documentation/devicetree/bindings/dma/fsl-mxs-dma.txt
+@@ -38,7 +38,7 @@ dma_apbx: dma-apbx@80024000 {
+ 80 81 68 69
+ 70 71 72 73
+ 74 75 76 77>;
+- interrupt-names = "auart4-rx", "aurat4-tx", "spdif-tx", "empty",
++ interrupt-names = "auart4-rx", "auart4-tx", "spdif-tx", "empty",
+ "saif0", "saif1", "i2c0", "i2c1",
+ "auart0-rx", "auart0-tx", "auart1-rx", "auart1-tx",
+ "auart2-rx", "auart2-tx", "auart3-rx", "auart3-tx";
+diff --git a/Documentation/virtual/kvm/mmu.txt b/Documentation/virtual/kvm/mmu.txt
+index 53838d9c6295..c59bd9bc41ef 100644
+--- a/Documentation/virtual/kvm/mmu.txt
++++ b/Documentation/virtual/kvm/mmu.txt
+@@ -169,6 +169,10 @@ Shadow pages contain the following information:
+ Contains the value of cr4.smep && !cr0.wp for which the page is valid
+ (pages for which this is true are different from other pages; see the
+ treatment of cr0.wp=0 below).
++ role.smap_andnot_wp:
++ Contains the value of cr4.smap && !cr0.wp for which the page is valid
++ (pages for which this is true are different from other pages; see the
++ treatment of cr0.wp=0 below).
+ gfn:
+ Either the guest page table containing the translations shadowed by this
+ page, or the base page frame for linear translations. See role.direct.
+@@ -344,10 +348,16 @@ on fault type:
+
+ (user write faults generate a #PF)
+
+-In the first case there is an additional complication if CR4.SMEP is
+-enabled: since we've turned the page into a kernel page, the kernel may now
+-execute it. We handle this by also setting spte.nx. If we get a user
+-fetch or read fault, we'll change spte.u=1 and spte.nx=gpte.nx back.
++In the first case there are two additional complications:
++- if CR4.SMEP is enabled: since we've turned the page into a kernel page,
++ the kernel may now execute it. We handle this by also setting spte.nx.
++ If we get a user fetch or read fault, we'll change spte.u=1 and
++ spte.nx=gpte.nx back.
++- if CR4.SMAP is disabled: since the page has been changed to a kernel
++ page, it can not be reused when CR4.SMAP is enabled. We set
++ CR4.SMAP && !CR0.WP into shadow page's role to avoid this case. Note,
++ here we do not care the case that CR4.SMAP is enabled since KVM will
++ directly inject #PF to guest due to failed permission check.
+
+ To prevent an spte that was converted into a kernel page with cr0.wp=0
+ from being written by the kernel after cr0.wp has changed to 1, we make
+diff --git a/Makefile b/Makefile
+index 43377eb8a4e5..cda98de8cd31 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 18
+-SUBLEVEL = 14
++SUBLEVEL = 15
+ EXTRAVERSION =
+ NAME = Diseased Newt
+
+diff --git a/arch/arc/include/asm/atomic.h b/arch/arc/include/asm/atomic.h
+index 067551b6920a..9917a45fc430 100644
+--- a/arch/arc/include/asm/atomic.h
++++ b/arch/arc/include/asm/atomic.h
+@@ -99,7 +99,7 @@ static inline void atomic_##op(int i, atomic_t *v) \
+ atomic_ops_unlock(flags); \
+ }
+
+-#define ATOMIC_OP_RETURN(op, c_op) \
++#define ATOMIC_OP_RETURN(op, c_op, asm_op) \
+ static inline int atomic_##op##_return(int i, atomic_t *v) \
+ { \
+ unsigned long flags; \
+diff --git a/arch/arm/boot/dts/armada-xp-openblocks-ax3-4.dts b/arch/arm/boot/dts/armada-xp-openblocks-ax3-4.dts
+index 4e5a59ee1501..db06fa397f79 100644
+--- a/arch/arm/boot/dts/armada-xp-openblocks-ax3-4.dts
++++ b/arch/arm/boot/dts/armada-xp-openblocks-ax3-4.dts
+@@ -71,6 +71,10 @@
+ };
+
+ internal-regs {
++ rtc@10300 {
++ /* No crystal connected to the internal RTC */
++ status = "disabled";
++ };
+ serial@12000 {
+ status = "okay";
+ };
+diff --git a/arch/arm/boot/dts/imx23-olinuxino.dts b/arch/arm/boot/dts/imx23-olinuxino.dts
+index 7e6eef2488e8..82045398bf1f 100644
+--- a/arch/arm/boot/dts/imx23-olinuxino.dts
++++ b/arch/arm/boot/dts/imx23-olinuxino.dts
+@@ -12,6 +12,7 @@
+ */
+
+ /dts-v1/;
++#include <dt-bindings/gpio/gpio.h>
+ #include "imx23.dtsi"
+
+ / {
+@@ -93,6 +94,7 @@
+
+ ahb@80080000 {
+ usb0: usb@80080000 {
++ dr_mode = "host";
+ vbus-supply = <®_usb0_vbus>;
+ status = "okay";
+ };
+@@ -122,7 +124,7 @@
+
+ user {
+ label = "green";
+- gpios = <&gpio2 1 1>;
++ gpios = <&gpio2 1 GPIO_ACTIVE_HIGH>;
+ };
+ };
+ };
+diff --git a/arch/arm/boot/dts/imx25.dtsi b/arch/arm/boot/dts/imx25.dtsi
+index e4d3aecc4ed2..677f81d9dcd5 100644
+--- a/arch/arm/boot/dts/imx25.dtsi
++++ b/arch/arm/boot/dts/imx25.dtsi
+@@ -428,6 +428,7 @@
+
+ pwm4: pwm@53fc8000 {
+ compatible = "fsl,imx25-pwm", "fsl,imx27-pwm";
++ #pwm-cells = <2>;
+ reg = <0x53fc8000 0x4000>;
+ clocks = <&clks 108>, <&clks 52>;
+ clock-names = "ipg", "per";
+diff --git a/arch/arm/boot/dts/imx27.dtsi b/arch/arm/boot/dts/imx27.dtsi
+index 107d713e1cbe..12ac5f7e0a2e 100644
+--- a/arch/arm/boot/dts/imx27.dtsi
++++ b/arch/arm/boot/dts/imx27.dtsi
+@@ -531,7 +531,7 @@
+
+ fec: ethernet@1002b000 {
+ compatible = "fsl,imx27-fec";
+- reg = <0x1002b000 0x4000>;
++ reg = <0x1002b000 0x1000>;
+ interrupts = <50>;
+ clocks = <&clks IMX27_CLK_FEC_IPG_GATE>,
+ <&clks IMX27_CLK_FEC_AHB_GATE>;
+diff --git a/arch/arm/boot/dts/imx28.dtsi b/arch/arm/boot/dts/imx28.dtsi
+index 47f68ac868d4..5ed245a3f9ac 100644
+--- a/arch/arm/boot/dts/imx28.dtsi
++++ b/arch/arm/boot/dts/imx28.dtsi
+@@ -900,7 +900,7 @@
+ 80 81 68 69
+ 70 71 72 73
+ 74 75 76 77>;
+- interrupt-names = "auart4-rx", "aurat4-tx", "spdif-tx", "empty",
++ interrupt-names = "auart4-rx", "auart4-tx", "spdif-tx", "empty",
+ "saif0", "saif1", "i2c0", "i2c1",
+ "auart0-rx", "auart0-tx", "auart1-rx", "auart1-tx",
+ "auart2-rx", "auart2-tx", "auart3-rx", "auart3-tx";
+diff --git a/arch/arm/boot/dts/imx6qdl-phytec-pfla02.dtsi b/arch/arm/boot/dts/imx6qdl-phytec-pfla02.dtsi
+index 0e50bb0a6b94..413569752422 100644
+--- a/arch/arm/boot/dts/imx6qdl-phytec-pfla02.dtsi
++++ b/arch/arm/boot/dts/imx6qdl-phytec-pfla02.dtsi
+@@ -31,6 +31,7 @@
+ regulator-min-microvolt = <5000000>;
+ regulator-max-microvolt = <5000000>;
+ gpio = <&gpio4 15 0>;
++ enable-active-high;
+ };
+
+ reg_usb_h1_vbus: regulator@1 {
+@@ -40,6 +41,7 @@
+ regulator-min-microvolt = <5000000>;
+ regulator-max-microvolt = <5000000>;
+ gpio = <&gpio1 0 0>;
++ enable-active-high;
+ };
+ };
+
+diff --git a/arch/arm/boot/dts/omap3-n900.dts b/arch/arm/boot/dts/omap3-n900.dts
+index bc82a12d4c2c..ae630a928acd 100644
+--- a/arch/arm/boot/dts/omap3-n900.dts
++++ b/arch/arm/boot/dts/omap3-n900.dts
+@@ -445,6 +445,8 @@
+ DRVDD-supply = <&vmmc2>;
+ IOVDD-supply = <&vio>;
+ DVDD-supply = <&vio>;
++
++ ai3x-micbias-vg = <1>;
+ };
+
+ tlv320aic3x_aux: tlv320aic3x@19 {
+@@ -456,6 +458,8 @@
+ DRVDD-supply = <&vmmc2>;
+ IOVDD-supply = <&vio>;
+ DVDD-supply = <&vio>;
++
++ ai3x-micbias-vg = <2>;
+ };
+
+ tsl2563: tsl2563@29 {
+diff --git a/arch/arm/boot/dts/ste-dbx5x0.dtsi b/arch/arm/boot/dts/ste-dbx5x0.dtsi
+index 9d2323020d34..563640f59a41 100644
+--- a/arch/arm/boot/dts/ste-dbx5x0.dtsi
++++ b/arch/arm/boot/dts/ste-dbx5x0.dtsi
+@@ -995,23 +995,6 @@
+ status = "disabled";
+ };
+
+- vmmci: regulator-gpio {
+- compatible = "regulator-gpio";
+-
+- regulator-min-microvolt = <1800000>;
+- regulator-max-microvolt = <2900000>;
+- regulator-name = "mmci-reg";
+- regulator-type = "voltage";
+-
+- startup-delay-us = <100>;
+- enable-active-high;
+-
+- states = <1800000 0x1
+- 2900000 0x0>;
+-
+- status = "disabled";
+- };
+-
+ mcde@a0350000 {
+ compatible = "stericsson,mcde";
+ reg = <0xa0350000 0x1000>, /* MCDE */
+diff --git a/arch/arm/boot/dts/ste-href.dtsi b/arch/arm/boot/dts/ste-href.dtsi
+index bf8f0eddc2c0..744c1e3a744d 100644
+--- a/arch/arm/boot/dts/ste-href.dtsi
++++ b/arch/arm/boot/dts/ste-href.dtsi
+@@ -111,6 +111,21 @@
+ pinctrl-1 = <&i2c3_sleep_mode>;
+ };
+
++ vmmci: regulator-gpio {
++ compatible = "regulator-gpio";
++
++ regulator-min-microvolt = <1800000>;
++ regulator-max-microvolt = <2900000>;
++ regulator-name = "mmci-reg";
++ regulator-type = "voltage";
++
++ startup-delay-us = <100>;
++ enable-active-high;
++
++ states = <1800000 0x1
++ 2900000 0x0>;
++ };
++
+ // External Micro SD slot
+ sdi0_per1@80126000 {
+ arm,primecell-periphid = <0x10480180>;
+diff --git a/arch/arm/boot/dts/ste-snowball.dts b/arch/arm/boot/dts/ste-snowball.dts
+index 3e97a669f15e..17c4422def0e 100644
+--- a/arch/arm/boot/dts/ste-snowball.dts
++++ b/arch/arm/boot/dts/ste-snowball.dts
+@@ -146,8 +146,21 @@
+ };
+
+ vmmci: regulator-gpio {
++ compatible = "regulator-gpio";
++
+ gpios = <&gpio7 4 0x4>;
+ enable-gpio = <&gpio6 25 0x4>;
++
++ regulator-min-microvolt = <1800000>;
++ regulator-max-microvolt = <2900000>;
++ regulator-name = "mmci-reg";
++ regulator-type = "voltage";
++
++ startup-delay-us = <100>;
++ enable-active-high;
++
++ states = <1800000 0x1
++ 2900000 0x0>;
+ };
+
+ // External Micro SD slot
+diff --git a/arch/arm/kernel/Makefile b/arch/arm/kernel/Makefile
+index 38ddd9f83d0e..03120e656aea 100644
+--- a/arch/arm/kernel/Makefile
++++ b/arch/arm/kernel/Makefile
+@@ -97,7 +97,7 @@ obj-$(CONFIG_EARLY_PRINTK) += early_printk.o
+
+ obj-$(CONFIG_ARM_VIRT_EXT) += hyp-stub.o
+ ifeq ($(CONFIG_ARM_PSCI),y)
+-obj-y += psci.o
++obj-y += psci.o psci-call.o
+ obj-$(CONFIG_SMP) += psci_smp.o
+ endif
+
+diff --git a/arch/arm/kernel/entry-common.S b/arch/arm/kernel/entry-common.S
+index 6bb09d4abdea..eb6f1927b2c7 100644
+--- a/arch/arm/kernel/entry-common.S
++++ b/arch/arm/kernel/entry-common.S
+@@ -33,7 +33,9 @@ ret_fast_syscall:
+ UNWIND(.fnstart )
+ UNWIND(.cantunwind )
+ disable_irq @ disable interrupts
+- ldr r1, [tsk, #TI_FLAGS]
++ ldr r1, [tsk, #TI_FLAGS] @ re-check for syscall tracing
++ tst r1, #_TIF_SYSCALL_WORK
++ bne __sys_trace_return
+ tst r1, #_TIF_WORK_MASK
+ bne fast_work_pending
+ asm_trace_hardirqs_on
+diff --git a/arch/arm/kernel/psci-call.S b/arch/arm/kernel/psci-call.S
+new file mode 100644
+index 000000000000..a78e9e1e206d
+--- /dev/null
++++ b/arch/arm/kernel/psci-call.S
+@@ -0,0 +1,31 @@
++/*
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 as
++ * published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
++ * GNU General Public License for more details.
++ *
++ * Copyright (C) 2015 ARM Limited
++ *
++ * Author: Mark Rutland <mark.rutland@arm.com>
++ */
++
++#include <linux/linkage.h>
++
++#include <asm/opcodes-sec.h>
++#include <asm/opcodes-virt.h>
++
++/* int __invoke_psci_fn_hvc(u32 function_id, u32 arg0, u32 arg1, u32 arg2) */
++ENTRY(__invoke_psci_fn_hvc)
++ __HVC(0)
++ bx lr
++ENDPROC(__invoke_psci_fn_hvc)
++
++/* int __invoke_psci_fn_smc(u32 function_id, u32 arg0, u32 arg1, u32 arg2) */
++ENTRY(__invoke_psci_fn_smc)
++ __SMC(0)
++ bx lr
++ENDPROC(__invoke_psci_fn_smc)
+diff --git a/arch/arm/kernel/psci.c b/arch/arm/kernel/psci.c
+index f73891b6b730..f90fdf4ce7c7 100644
+--- a/arch/arm/kernel/psci.c
++++ b/arch/arm/kernel/psci.c
+@@ -23,8 +23,6 @@
+
+ #include <asm/compiler.h>
+ #include <asm/errno.h>
+-#include <asm/opcodes-sec.h>
+-#include <asm/opcodes-virt.h>
+ #include <asm/psci.h>
+ #include <asm/system_misc.h>
+
+@@ -33,6 +31,9 @@ struct psci_operations psci_ops;
+ static int (*invoke_psci_fn)(u32, u32, u32, u32);
+ typedef int (*psci_initcall_t)(const struct device_node *);
+
++asmlinkage int __invoke_psci_fn_hvc(u32, u32, u32, u32);
++asmlinkage int __invoke_psci_fn_smc(u32, u32, u32, u32);
++
+ enum psci_function {
+ PSCI_FN_CPU_SUSPEND,
+ PSCI_FN_CPU_ON,
+@@ -71,40 +72,6 @@ static u32 psci_power_state_pack(struct psci_power_state state)
+ & PSCI_0_2_POWER_STATE_AFFL_MASK);
+ }
+
+-/*
+- * The following two functions are invoked via the invoke_psci_fn pointer
+- * and will not be inlined, allowing us to piggyback on the AAPCS.
+- */
+-static noinline int __invoke_psci_fn_hvc(u32 function_id, u32 arg0, u32 arg1,
+- u32 arg2)
+-{
+- asm volatile(
+- __asmeq("%0", "r0")
+- __asmeq("%1", "r1")
+- __asmeq("%2", "r2")
+- __asmeq("%3", "r3")
+- __HVC(0)
+- : "+r" (function_id)
+- : "r" (arg0), "r" (arg1), "r" (arg2));
+-
+- return function_id;
+-}
+-
+-static noinline int __invoke_psci_fn_smc(u32 function_id, u32 arg0, u32 arg1,
+- u32 arg2)
+-{
+- asm volatile(
+- __asmeq("%0", "r0")
+- __asmeq("%1", "r1")
+- __asmeq("%2", "r2")
+- __asmeq("%3", "r3")
+- __SMC(0)
+- : "+r" (function_id)
+- : "r" (arg0), "r" (arg1), "r" (arg2));
+-
+- return function_id;
+-}
+-
+ static int psci_get_version(void)
+ {
+ int err;
+diff --git a/arch/arm/mach-mvebu/coherency.c b/arch/arm/mach-mvebu/coherency.c
+index 2ffccd4eb084..01efe130912e 100644
+--- a/arch/arm/mach-mvebu/coherency.c
++++ b/arch/arm/mach-mvebu/coherency.c
+@@ -448,8 +448,9 @@ static int __init coherency_late_init(void)
+ armada_375_coherency_init_wa();
+ }
+
+- bus_register_notifier(&platform_bus_type,
+- &mvebu_hwcc_nb);
++ if (coherency_available())
++ bus_register_notifier(&platform_bus_type,
++ &mvebu_hwcc_nb);
+
+ return 0;
+ }
+diff --git a/arch/arm/mach-omap2/prm-regbits-34xx.h b/arch/arm/mach-omap2/prm-regbits-34xx.h
+index cbefbd7cfdb5..661d753df584 100644
+--- a/arch/arm/mach-omap2/prm-regbits-34xx.h
++++ b/arch/arm/mach-omap2/prm-regbits-34xx.h
+@@ -112,6 +112,7 @@
+ #define OMAP3430_VC_CMD_ONLP_SHIFT 16
+ #define OMAP3430_VC_CMD_RET_SHIFT 8
+ #define OMAP3430_VC_CMD_OFF_SHIFT 0
++#define OMAP3430_SREN_MASK (1 << 4)
+ #define OMAP3430_HSEN_MASK (1 << 3)
+ #define OMAP3430_MCODE_MASK (0x7 << 0)
+ #define OMAP3430_VALID_MASK (1 << 24)
+diff --git a/arch/arm/mach-omap2/prm-regbits-44xx.h b/arch/arm/mach-omap2/prm-regbits-44xx.h
+index b1c7a33e00e7..e794828dee55 100644
+--- a/arch/arm/mach-omap2/prm-regbits-44xx.h
++++ b/arch/arm/mach-omap2/prm-regbits-44xx.h
+@@ -35,6 +35,7 @@
+ #define OMAP4430_GLOBAL_WARM_SW_RST_SHIFT 1
+ #define OMAP4430_GLOBAL_WUEN_MASK (1 << 16)
+ #define OMAP4430_HSMCODE_MASK (0x7 << 0)
++#define OMAP4430_SRMODEEN_MASK (1 << 4)
+ #define OMAP4430_HSMODEEN_MASK (1 << 3)
+ #define OMAP4430_HSSCLL_SHIFT 24
+ #define OMAP4430_ICEPICK_RST_SHIFT 9
+diff --git a/arch/arm/mach-omap2/sleep34xx.S b/arch/arm/mach-omap2/sleep34xx.S
+index d1dedc8195ed..eafd120b53f1 100644
+--- a/arch/arm/mach-omap2/sleep34xx.S
++++ b/arch/arm/mach-omap2/sleep34xx.S
+@@ -203,23 +203,8 @@ save_context_wfi:
+ */
+ ldr r1, kernel_flush
+ blx r1
+- /*
+- * The kernel doesn't interwork: v7_flush_dcache_all in particluar will
+- * always return in Thumb state when CONFIG_THUMB2_KERNEL is enabled.
+- * This sequence switches back to ARM. Note that .align may insert a
+- * nop: bx pc needs to be word-aligned in order to work.
+- */
+- THUMB( .thumb )
+- THUMB( .align )
+- THUMB( bx pc )
+- THUMB( nop )
+- .arm
+-
+ b omap3_do_wfi
+-
+-/*
+- * Local variables
+- */
++ENDPROC(omap34xx_cpu_suspend)
+ omap3_do_wfi_sram_addr:
+ .word omap3_do_wfi_sram
+ kernel_flush:
+@@ -364,10 +349,7 @@ exit_nonoff_modes:
+ * ===================================
+ */
+ ldmfd sp!, {r4 - r11, pc} @ restore regs and return
+-
+-/*
+- * Local variables
+- */
++ENDPROC(omap3_do_wfi)
+ sdrc_power:
+ .word SDRC_POWER_V
+ cm_idlest1_core:
+diff --git a/arch/arm/mach-omap2/vc.c b/arch/arm/mach-omap2/vc.c
+index be9ef834fa81..076fd20d7e5a 100644
+--- a/arch/arm/mach-omap2/vc.c
++++ b/arch/arm/mach-omap2/vc.c
+@@ -316,7 +316,8 @@ static void __init omap3_vc_init_pmic_signaling(struct voltagedomain *voltdm)
+ * idle. And we can also scale voltages to zero for off-idle.
+ * Note that no actual voltage scaling during off-idle will
+ * happen unless the board specific twl4030 PMIC scripts are
+- * loaded.
++ * loaded. See also omap_vc_i2c_init for comments regarding
++ * erratum i531.
+ */
+ val = voltdm->read(OMAP3_PRM_VOLTCTRL_OFFSET);
+ if (!(val & OMAP3430_PRM_VOLTCTRL_SEL_OFF)) {
+@@ -704,9 +705,16 @@ static void __init omap_vc_i2c_init(struct voltagedomain *voltdm)
+ return;
+ }
+
++ /*
++ * Note that for omap3 OMAP3430_SREN_MASK clears SREN to work around
++ * erratum i531 "Extra Power Consumed When Repeated Start Operation
++ * Mode Is Enabled on I2C Interface Dedicated for Smart Reflex (I2C4)".
++ * Otherwise I2C4 eventually leads into about 23mW extra power being
++ * consumed even during off idle using VMODE.
++ */
+ i2c_high_speed = voltdm->pmic->i2c_high_speed;
+ if (i2c_high_speed)
+- voltdm->rmw(vc->common->i2c_cfg_hsen_mask,
++ voltdm->rmw(vc->common->i2c_cfg_clear_mask,
+ vc->common->i2c_cfg_hsen_mask,
+ vc->common->i2c_cfg_reg);
+
+diff --git a/arch/arm/mach-omap2/vc.h b/arch/arm/mach-omap2/vc.h
+index cdbdd78e755e..89b83b7ff3ec 100644
+--- a/arch/arm/mach-omap2/vc.h
++++ b/arch/arm/mach-omap2/vc.h
+@@ -34,6 +34,7 @@ struct voltagedomain;
+ * @cmd_ret_shift: RET field shift in PRM_VC_CMD_VAL_* register
+ * @cmd_off_shift: OFF field shift in PRM_VC_CMD_VAL_* register
+ * @i2c_cfg_reg: I2C configuration register offset
++ * @i2c_cfg_clear_mask: high-speed mode bit clear mask in I2C config register
+ * @i2c_cfg_hsen_mask: high-speed mode bit field mask in I2C config register
+ * @i2c_mcode_mask: MCODE field mask for I2C config register
+ *
+@@ -52,6 +53,7 @@ struct omap_vc_common {
+ u8 cmd_ret_shift;
+ u8 cmd_off_shift;
+ u8 i2c_cfg_reg;
++ u8 i2c_cfg_clear_mask;
+ u8 i2c_cfg_hsen_mask;
+ u8 i2c_mcode_mask;
+ };
+diff --git a/arch/arm/mach-omap2/vc3xxx_data.c b/arch/arm/mach-omap2/vc3xxx_data.c
+index 75bc4aa22b3a..71d74c9172c1 100644
+--- a/arch/arm/mach-omap2/vc3xxx_data.c
++++ b/arch/arm/mach-omap2/vc3xxx_data.c
+@@ -40,6 +40,7 @@ static struct omap_vc_common omap3_vc_common = {
+ .cmd_onlp_shift = OMAP3430_VC_CMD_ONLP_SHIFT,
+ .cmd_ret_shift = OMAP3430_VC_CMD_RET_SHIFT,
+ .cmd_off_shift = OMAP3430_VC_CMD_OFF_SHIFT,
++ .i2c_cfg_clear_mask = OMAP3430_SREN_MASK | OMAP3430_HSEN_MASK,
+ .i2c_cfg_hsen_mask = OMAP3430_HSEN_MASK,
+ .i2c_cfg_reg = OMAP3_PRM_VC_I2C_CFG_OFFSET,
+ .i2c_mcode_mask = OMAP3430_MCODE_MASK,
+diff --git a/arch/arm/mach-omap2/vc44xx_data.c b/arch/arm/mach-omap2/vc44xx_data.c
+index 085e5d6a04fd..2abd5fa8a697 100644
+--- a/arch/arm/mach-omap2/vc44xx_data.c
++++ b/arch/arm/mach-omap2/vc44xx_data.c
+@@ -42,6 +42,7 @@ static const struct omap_vc_common omap4_vc_common = {
+ .cmd_ret_shift = OMAP4430_RET_SHIFT,
+ .cmd_off_shift = OMAP4430_OFF_SHIFT,
+ .i2c_cfg_reg = OMAP4_PRM_VC_CFG_I2C_MODE_OFFSET,
++ .i2c_cfg_clear_mask = OMAP4430_SRMODEEN_MASK | OMAP4430_HSMODEEN_MASK,
+ .i2c_cfg_hsen_mask = OMAP4430_HSMODEEN_MASK,
+ .i2c_mcode_mask = OMAP4430_HSMCODE_MASK,
+ };
+diff --git a/arch/arm/mm/mmu.c b/arch/arm/mm/mmu.c
+index 9f98cec7fe1e..fb9d305c874b 100644
+--- a/arch/arm/mm/mmu.c
++++ b/arch/arm/mm/mmu.c
+@@ -1118,22 +1118,22 @@ void __init sanity_check_meminfo(void)
+ }
+
+ /*
+- * Find the first non-section-aligned page, and point
++ * Find the first non-pmd-aligned page, and point
+ * memblock_limit at it. This relies on rounding the
+- * limit down to be section-aligned, which happens at
+- * the end of this function.
++ * limit down to be pmd-aligned, which happens at the
++ * end of this function.
+ *
+ * With this algorithm, the start or end of almost any
+- * bank can be non-section-aligned. The only exception
+- * is that the start of the bank 0 must be section-
++ * bank can be non-pmd-aligned. The only exception is
++ * that the start of the bank 0 must be section-
+ * aligned, since otherwise memory would need to be
+ * allocated when mapping the start of bank 0, which
+ * occurs before any free memory is mapped.
+ */
+ if (!memblock_limit) {
+- if (!IS_ALIGNED(block_start, SECTION_SIZE))
++ if (!IS_ALIGNED(block_start, PMD_SIZE))
+ memblock_limit = block_start;
+- else if (!IS_ALIGNED(block_end, SECTION_SIZE))
++ else if (!IS_ALIGNED(block_end, PMD_SIZE))
+ memblock_limit = arm_lowmem_limit;
+ }
+
+@@ -1143,12 +1143,12 @@ void __init sanity_check_meminfo(void)
+ high_memory = __va(arm_lowmem_limit - 1) + 1;
+
+ /*
+- * Round the memblock limit down to a section size. This
++ * Round the memblock limit down to a pmd size. This
+ * helps to ensure that we will allocate memory from the
+- * last full section, which should be mapped.
++ * last full pmd, which should be mapped.
+ */
+ if (memblock_limit)
+- memblock_limit = round_down(memblock_limit, SECTION_SIZE);
++ memblock_limit = round_down(memblock_limit, PMD_SIZE);
+ if (!memblock_limit)
+ memblock_limit = arm_lowmem_limit;
+
+diff --git a/arch/arm/net/bpf_jit_32.c b/arch/arm/net/bpf_jit_32.c
+index e1268f905026..f412b53ed268 100644
+--- a/arch/arm/net/bpf_jit_32.c
++++ b/arch/arm/net/bpf_jit_32.c
+@@ -449,10 +449,21 @@ static inline void emit_udiv(u8 rd, u8 rm, u8 rn, struct jit_ctx *ctx)
+ return;
+ }
+ #endif
+- if (rm != ARM_R0)
+- emit(ARM_MOV_R(ARM_R0, rm), ctx);
++
++ /*
++ * For BPF_ALU | BPF_DIV | BPF_K instructions, rm is ARM_R4
++ * (r_A) and rn is ARM_R0 (r_scratch) so load rn first into
++ * ARM_R1 to avoid accidentally overwriting ARM_R0 with rm
++ * before using it as a source for ARM_R1.
++ *
++ * For BPF_ALU | BPF_DIV | BPF_X rm is ARM_R4 (r_A) and rn is
++ * ARM_R5 (r_X) so there is no particular register overlap
++ * issues.
++ */
+ if (rn != ARM_R1)
+ emit(ARM_MOV_R(ARM_R1, rn), ctx);
++ if (rm != ARM_R0)
++ emit(ARM_MOV_R(ARM_R0, rm), ctx);
+
+ ctx->seen |= SEEN_CALL;
+ emit_mov_i(ARM_R3, (u32)jit_udiv, ctx);
+diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c
+index edba042b2325..dc6a4842683a 100644
+--- a/arch/arm64/net/bpf_jit_comp.c
++++ b/arch/arm64/net/bpf_jit_comp.c
+@@ -487,7 +487,7 @@ emit_cond_jmp:
+ return -EINVAL;
+ }
+
+- imm64 = (u64)insn1.imm << 32 | imm;
++ imm64 = (u64)insn1.imm << 32 | (u32)imm;
+ emit_a64_mov_i64(dst, imm64, ctx);
+
+ return 1;
+diff --git a/arch/parisc/include/asm/elf.h b/arch/parisc/include/asm/elf.h
+index 3391d061eccc..78c9fd32c554 100644
+--- a/arch/parisc/include/asm/elf.h
++++ b/arch/parisc/include/asm/elf.h
+@@ -348,6 +348,10 @@ struct pt_regs; /* forward declaration... */
+
+ #define ELF_HWCAP 0
+
++#define STACK_RND_MASK (is_32bit_task() ? \
++ 0x7ff >> (PAGE_SHIFT - 12) : \
++ 0x3ffff >> (PAGE_SHIFT - 12))
++
+ struct mm_struct;
+ extern unsigned long arch_randomize_brk(struct mm_struct *);
+ #define arch_randomize_brk arch_randomize_brk
+diff --git a/arch/parisc/kernel/sys_parisc.c b/arch/parisc/kernel/sys_parisc.c
+index e1ffea2f9a0b..5aba01ac457f 100644
+--- a/arch/parisc/kernel/sys_parisc.c
++++ b/arch/parisc/kernel/sys_parisc.c
+@@ -77,6 +77,9 @@ static unsigned long mmap_upper_limit(void)
+ if (stack_base > STACK_SIZE_MAX)
+ stack_base = STACK_SIZE_MAX;
+
++ /* Add space for stack randomization. */
++ stack_base += (STACK_RND_MASK << PAGE_SHIFT);
++
+ return PAGE_ALIGN(STACK_TOP - stack_base);
+ }
+
+diff --git a/arch/powerpc/kernel/vmlinux.lds.S b/arch/powerpc/kernel/vmlinux.lds.S
+index f096e72262f4..1db685104ffc 100644
+--- a/arch/powerpc/kernel/vmlinux.lds.S
++++ b/arch/powerpc/kernel/vmlinux.lds.S
+@@ -213,6 +213,7 @@ SECTIONS
+ *(.opd)
+ }
+
++ . = ALIGN(256);
+ .got : AT(ADDR(.got) - LOAD_OFFSET) {
+ __toc_start = .;
+ #ifndef CONFIG_RELOCATABLE
+diff --git a/arch/s390/crypto/ghash_s390.c b/arch/s390/crypto/ghash_s390.c
+index 7940dc90e80b..b258110da952 100644
+--- a/arch/s390/crypto/ghash_s390.c
++++ b/arch/s390/crypto/ghash_s390.c
+@@ -16,11 +16,12 @@
+ #define GHASH_DIGEST_SIZE 16
+
+ struct ghash_ctx {
+- u8 icv[16];
+- u8 key[16];
++ u8 key[GHASH_BLOCK_SIZE];
+ };
+
+ struct ghash_desc_ctx {
++ u8 icv[GHASH_BLOCK_SIZE];
++ u8 key[GHASH_BLOCK_SIZE];
+ u8 buffer[GHASH_BLOCK_SIZE];
+ u32 bytes;
+ };
+@@ -28,8 +29,10 @@ struct ghash_desc_ctx {
+ static int ghash_init(struct shash_desc *desc)
+ {
+ struct ghash_desc_ctx *dctx = shash_desc_ctx(desc);
++ struct ghash_ctx *ctx = crypto_shash_ctx(desc->tfm);
+
+ memset(dctx, 0, sizeof(*dctx));
++ memcpy(dctx->key, ctx->key, GHASH_BLOCK_SIZE);
+
+ return 0;
+ }
+@@ -45,7 +48,6 @@ static int ghash_setkey(struct crypto_shash *tfm,
+ }
+
+ memcpy(ctx->key, key, GHASH_BLOCK_SIZE);
+- memset(ctx->icv, 0, GHASH_BLOCK_SIZE);
+
+ return 0;
+ }
+@@ -54,7 +56,6 @@ static int ghash_update(struct shash_desc *desc,
+ const u8 *src, unsigned int srclen)
+ {
+ struct ghash_desc_ctx *dctx = shash_desc_ctx(desc);
+- struct ghash_ctx *ctx = crypto_shash_ctx(desc->tfm);
+ unsigned int n;
+ u8 *buf = dctx->buffer;
+ int ret;
+@@ -70,7 +71,7 @@ static int ghash_update(struct shash_desc *desc,
+ src += n;
+
+ if (!dctx->bytes) {
+- ret = crypt_s390_kimd(KIMD_GHASH, ctx, buf,
++ ret = crypt_s390_kimd(KIMD_GHASH, dctx, buf,
+ GHASH_BLOCK_SIZE);
+ if (ret != GHASH_BLOCK_SIZE)
+ return -EIO;
+@@ -79,7 +80,7 @@ static int ghash_update(struct shash_desc *desc,
+
+ n = srclen & ~(GHASH_BLOCK_SIZE - 1);
+ if (n) {
+- ret = crypt_s390_kimd(KIMD_GHASH, ctx, src, n);
++ ret = crypt_s390_kimd(KIMD_GHASH, dctx, src, n);
+ if (ret != n)
+ return -EIO;
+ src += n;
+@@ -94,7 +95,7 @@ static int ghash_update(struct shash_desc *desc,
+ return 0;
+ }
+
+-static int ghash_flush(struct ghash_ctx *ctx, struct ghash_desc_ctx *dctx)
++static int ghash_flush(struct ghash_desc_ctx *dctx)
+ {
+ u8 *buf = dctx->buffer;
+ int ret;
+@@ -104,24 +105,24 @@ static int ghash_flush(struct ghash_ctx *ctx, struct ghash_desc_ctx *dctx)
+
+ memset(pos, 0, dctx->bytes);
+
+- ret = crypt_s390_kimd(KIMD_GHASH, ctx, buf, GHASH_BLOCK_SIZE);
++ ret = crypt_s390_kimd(KIMD_GHASH, dctx, buf, GHASH_BLOCK_SIZE);
+ if (ret != GHASH_BLOCK_SIZE)
+ return -EIO;
++
++ dctx->bytes = 0;
+ }
+
+- dctx->bytes = 0;
+ return 0;
+ }
+
+ static int ghash_final(struct shash_desc *desc, u8 *dst)
+ {
+ struct ghash_desc_ctx *dctx = shash_desc_ctx(desc);
+- struct ghash_ctx *ctx = crypto_shash_ctx(desc->tfm);
+ int ret;
+
+- ret = ghash_flush(ctx, dctx);
++ ret = ghash_flush(dctx);
+ if (!ret)
+- memcpy(dst, ctx->icv, GHASH_BLOCK_SIZE);
++ memcpy(dst, dctx->icv, GHASH_BLOCK_SIZE);
+ return ret;
+ }
+
+diff --git a/arch/s390/include/asm/pgtable.h b/arch/s390/include/asm/pgtable.h
+index 57c882761dea..b0373b44b320 100644
+--- a/arch/s390/include/asm/pgtable.h
++++ b/arch/s390/include/asm/pgtable.h
+@@ -582,7 +582,7 @@ static inline int pmd_large(pmd_t pmd)
+ return (pmd_val(pmd) & _SEGMENT_ENTRY_LARGE) != 0;
+ }
+
+-static inline int pmd_pfn(pmd_t pmd)
++static inline unsigned long pmd_pfn(pmd_t pmd)
+ {
+ unsigned long origin_mask;
+
+diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
+index 6ed0c30d6a0c..6c0709ff2f38 100644
+--- a/arch/x86/include/asm/kvm_host.h
++++ b/arch/x86/include/asm/kvm_host.h
+@@ -201,6 +201,7 @@ union kvm_mmu_page_role {
+ unsigned nxe:1;
+ unsigned cr0_wp:1;
+ unsigned smep_andnot_wp:1;
++ unsigned smap_andnot_wp:1;
+ };
+ };
+
+@@ -392,6 +393,7 @@ struct kvm_vcpu_arch {
+ struct kvm_mmu_memory_cache mmu_page_header_cache;
+
+ struct fpu guest_fpu;
++ bool eager_fpu;
+ u64 xcr0;
+ u64 guest_supported_xcr0;
+ u32 guest_xstate_size;
+@@ -707,6 +709,7 @@ struct kvm_x86_ops {
+ void (*cache_reg)(struct kvm_vcpu *vcpu, enum kvm_reg reg);
+ unsigned long (*get_rflags)(struct kvm_vcpu *vcpu);
+ void (*set_rflags)(struct kvm_vcpu *vcpu, unsigned long rflags);
++ void (*fpu_activate)(struct kvm_vcpu *vcpu);
+ void (*fpu_deactivate)(struct kvm_vcpu *vcpu);
+
+ void (*tlb_flush)(struct kvm_vcpu *vcpu);
+diff --git a/arch/x86/include/asm/mce.h b/arch/x86/include/asm/mce.h
+index 958b90f761e5..40b35a55ce8b 100644
+--- a/arch/x86/include/asm/mce.h
++++ b/arch/x86/include/asm/mce.h
+@@ -34,6 +34,10 @@
+ #define MCI_STATUS_S (1ULL<<56) /* Signaled machine check */
+ #define MCI_STATUS_AR (1ULL<<55) /* Action required */
+
++/* AMD-specific bits */
++#define MCI_STATUS_DEFERRED (1ULL<<44) /* declare an uncorrected error */
++#define MCI_STATUS_POISON (1ULL<<43) /* access poisonous data */
++
+ /*
+ * Note that the full MCACOD field of IA32_MCi_STATUS MSR is
+ * bits 15:0. But bit 12 is the 'F' bit, defined for corrected
+diff --git a/arch/x86/kernel/cpu/mcheck/mce-internal.h b/arch/x86/kernel/cpu/mcheck/mce-internal.h
+index 09edd0b65fef..10b46906767f 100644
+--- a/arch/x86/kernel/cpu/mcheck/mce-internal.h
++++ b/arch/x86/kernel/cpu/mcheck/mce-internal.h
+@@ -3,6 +3,8 @@
+
+ enum severity_level {
+ MCE_NO_SEVERITY,
++ MCE_DEFERRED_SEVERITY,
++ MCE_UCNA_SEVERITY = MCE_DEFERRED_SEVERITY,
+ MCE_KEEP_SEVERITY,
+ MCE_SOME_SEVERITY,
+ MCE_AO_SEVERITY,
+@@ -21,7 +23,7 @@ struct mce_bank {
+ char attrname[ATTR_LEN]; /* attribute name */
+ };
+
+-int mce_severity(struct mce *a, int tolerant, char **msg);
++int mce_severity(struct mce *a, int tolerant, char **msg, bool is_excp);
+ struct dentry *mce_get_debugfs_dir(void);
+
+ extern struct mce_bank *mce_banks;
+diff --git a/arch/x86/kernel/cpu/mcheck/mce-severity.c b/arch/x86/kernel/cpu/mcheck/mce-severity.c
+index c370e1c4468b..8bb433043a7f 100644
+--- a/arch/x86/kernel/cpu/mcheck/mce-severity.c
++++ b/arch/x86/kernel/cpu/mcheck/mce-severity.c
+@@ -31,6 +31,7 @@
+
+ enum context { IN_KERNEL = 1, IN_USER = 2 };
+ enum ser { SER_REQUIRED = 1, NO_SER = 2 };
++enum exception { EXCP_CONTEXT = 1, NO_EXCP = 2 };
+
+ static struct severity {
+ u64 mask;
+@@ -40,6 +41,7 @@ static struct severity {
+ unsigned char mcgres;
+ unsigned char ser;
+ unsigned char context;
++ unsigned char excp;
+ unsigned char covered;
+ char *msg;
+ } severities[] = {
+@@ -48,6 +50,8 @@ static struct severity {
+ #define USER .context = IN_USER
+ #define SER .ser = SER_REQUIRED
+ #define NOSER .ser = NO_SER
++#define EXCP .excp = EXCP_CONTEXT
++#define NOEXCP .excp = NO_EXCP
+ #define BITCLR(x) .mask = x, .result = 0
+ #define BITSET(x) .mask = x, .result = x
+ #define MCGMASK(x, y) .mcgmask = x, .mcgres = y
+@@ -62,7 +66,7 @@ static struct severity {
+ ),
+ MCESEV(
+ NO, "Not enabled",
+- BITCLR(MCI_STATUS_EN)
++ EXCP, BITCLR(MCI_STATUS_EN)
+ ),
+ MCESEV(
+ PANIC, "Processor context corrupt",
+@@ -71,16 +75,20 @@ static struct severity {
+ /* When MCIP is not set something is very confused */
+ MCESEV(
+ PANIC, "MCIP not set in MCA handler",
+- MCGMASK(MCG_STATUS_MCIP, 0)
++ EXCP, MCGMASK(MCG_STATUS_MCIP, 0)
+ ),
+ /* Neither return not error IP -- no chance to recover -> PANIC */
+ MCESEV(
+ PANIC, "Neither restart nor error IP",
+- MCGMASK(MCG_STATUS_RIPV|MCG_STATUS_EIPV, 0)
++ EXCP, MCGMASK(MCG_STATUS_RIPV|MCG_STATUS_EIPV, 0)
+ ),
+ MCESEV(
+ PANIC, "In kernel and no restart IP",
+- KERNEL, MCGMASK(MCG_STATUS_RIPV, 0)
++ EXCP, KERNEL, MCGMASK(MCG_STATUS_RIPV, 0)
++ ),
++ MCESEV(
++ DEFERRED, "Deferred error",
++ NOSER, MASK(MCI_STATUS_UC|MCI_STATUS_DEFERRED|MCI_STATUS_POISON, MCI_STATUS_DEFERRED)
+ ),
+ MCESEV(
+ KEEP, "Corrected error",
+@@ -89,7 +97,7 @@ static struct severity {
+
+ /* ignore OVER for UCNA */
+ MCESEV(
+- KEEP, "Uncorrected no action required",
++ UCNA, "Uncorrected no action required",
+ SER, MASK(MCI_UC_SAR, MCI_STATUS_UC)
+ ),
+ MCESEV(
+@@ -178,8 +186,9 @@ static int error_context(struct mce *m)
+ return ((m->cs & 3) == 3) ? IN_USER : IN_KERNEL;
+ }
+
+-int mce_severity(struct mce *m, int tolerant, char **msg)
++int mce_severity(struct mce *m, int tolerant, char **msg, bool is_excp)
+ {
++ enum exception excp = (is_excp ? EXCP_CONTEXT : NO_EXCP);
+ enum context ctx = error_context(m);
+ struct severity *s;
+
+@@ -194,6 +203,8 @@ int mce_severity(struct mce *m, int tolerant, char **msg)
+ continue;
+ if (s->context && ctx != s->context)
+ continue;
++ if (s->excp && excp != s->excp)
++ continue;
+ if (msg)
+ *msg = s->msg;
+ s->covered = 1;
+diff --git a/arch/x86/kernel/cpu/mcheck/mce.c b/arch/x86/kernel/cpu/mcheck/mce.c
+index 61a9668cebfd..b5c2276317e2 100644
+--- a/arch/x86/kernel/cpu/mcheck/mce.c
++++ b/arch/x86/kernel/cpu/mcheck/mce.c
+@@ -660,6 +660,7 @@ static int mce_no_way_out(struct mce *m, char **msg, unsigned long *validp,
+ struct pt_regs *regs)
+ {
+ int i, ret = 0;
++ char *tmp;
+
+ for (i = 0; i < mca_cfg.banks; i++) {
+ m->status = mce_rdmsrl(MSR_IA32_MCx_STATUS(i));
+@@ -668,8 +669,11 @@ static int mce_no_way_out(struct mce *m, char **msg, unsigned long *validp,
+ if (quirk_no_way_out)
+ quirk_no_way_out(i, m, regs);
+ }
+- if (mce_severity(m, mca_cfg.tolerant, msg) >= MCE_PANIC_SEVERITY)
++
++ if (mce_severity(m, mca_cfg.tolerant, &tmp, true) >= MCE_PANIC_SEVERITY) {
++ *msg = tmp;
+ ret = 1;
++ }
+ }
+ return ret;
+ }
+@@ -754,7 +758,7 @@ static void mce_reign(void)
+ for_each_possible_cpu(cpu) {
+ int severity = mce_severity(&per_cpu(mces_seen, cpu),
+ mca_cfg.tolerant,
+- &nmsg);
++ &nmsg, true);
+ if (severity > global_worst) {
+ msg = nmsg;
+ global_worst = severity;
+@@ -1095,13 +1099,14 @@ void do_machine_check(struct pt_regs *regs, long error_code)
+ */
+ add_taint(TAINT_MACHINE_CHECK, LOCKDEP_NOW_UNRELIABLE);
+
+- severity = mce_severity(&m, cfg->tolerant, NULL);
++ severity = mce_severity(&m, cfg->tolerant, NULL, true);
+
+ /*
+- * When machine check was for corrected handler don't touch,
+- * unless we're panicing.
++ * When machine check was for corrected/deferred handler don't
++ * touch, unless we're panicing.
+ */
+- if (severity == MCE_KEEP_SEVERITY && !no_way_out)
++ if ((severity == MCE_KEEP_SEVERITY ||
++ severity == MCE_UCNA_SEVERITY) && !no_way_out)
+ continue;
+ __set_bit(i, toclear);
+ if (severity == MCE_NO_SEVERITY) {
+diff --git a/arch/x86/kernel/cpu/perf_event_intel_rapl.c b/arch/x86/kernel/cpu/perf_event_intel_rapl.c
+index 8c256749882c..611d821eac1a 100644
+--- a/arch/x86/kernel/cpu/perf_event_intel_rapl.c
++++ b/arch/x86/kernel/cpu/perf_event_intel_rapl.c
+@@ -664,6 +664,7 @@ static int __init rapl_pmu_init(void)
+ break;
+ case 60: /* Haswell */
+ case 69: /* Haswell-Celeron */
++ case 61: /* Broadwell */
+ rapl_cntr_mask = RAPL_IDX_HSW;
+ rapl_pmu_events_group.attrs = rapl_events_hsw_attr;
+ break;
+diff --git a/arch/x86/kernel/i387.c b/arch/x86/kernel/i387.c
+index a9a4229f6161..ae0fdc86b7b6 100644
+--- a/arch/x86/kernel/i387.c
++++ b/arch/x86/kernel/i387.c
+@@ -155,6 +155,21 @@ static void init_thread_xstate(void)
+ xstate_size = sizeof(struct i387_fxsave_struct);
+ else
+ xstate_size = sizeof(struct i387_fsave_struct);
++
++ /*
++ * Quirk: we don't yet handle the XSAVES* instructions
++ * correctly, as we don't correctly convert between
++ * standard and compacted format when interfacing
++ * with user-space - so disable it for now.
++ *
++ * The difference is small: with recent CPUs the
++ * compacted format is only marginally smaller than
++ * the standard FPU state format.
++ *
++ * ( This is easy to backport while we are fixing
++ * XSAVES* support. )
++ */
++ setup_clear_cpu_cap(X86_FEATURE_XSAVES);
+ }
+
+ /*
+diff --git a/arch/x86/kvm/cpuid.c b/arch/x86/kvm/cpuid.c
+index 88f92014ba6b..81c6d541d98a 100644
+--- a/arch/x86/kvm/cpuid.c
++++ b/arch/x86/kvm/cpuid.c
+@@ -16,6 +16,8 @@
+ #include <linux/module.h>
+ #include <linux/vmalloc.h>
+ #include <linux/uaccess.h>
++#include <asm/i387.h> /* For use_eager_fpu. Ugh! */
++#include <asm/fpu-internal.h> /* For use_eager_fpu. Ugh! */
+ #include <asm/user.h>
+ #include <asm/xsave.h>
+ #include "cpuid.h"
+@@ -88,6 +90,8 @@ int kvm_update_cpuid(struct kvm_vcpu *vcpu)
+ xstate_required_size(vcpu->arch.xcr0);
+ }
+
++ vcpu->arch.eager_fpu = guest_cpuid_has_mpx(vcpu);
++
+ /*
+ * The existing code assumes virtual address is 48-bit in the canonical
+ * address checks; exit if it is ever changed.
+diff --git a/arch/x86/kvm/cpuid.h b/arch/x86/kvm/cpuid.h
+index 4452eedfaedd..9bec2b8cdced 100644
+--- a/arch/x86/kvm/cpuid.h
++++ b/arch/x86/kvm/cpuid.h
+@@ -111,4 +111,12 @@ static inline bool guest_cpuid_has_rtm(struct kvm_vcpu *vcpu)
+ best = kvm_find_cpuid_entry(vcpu, 7, 0);
+ return best && (best->ebx & bit(X86_FEATURE_RTM));
+ }
++
++static inline bool guest_cpuid_has_mpx(struct kvm_vcpu *vcpu)
++{
++ struct kvm_cpuid_entry2 *best;
++
++ best = kvm_find_cpuid_entry(vcpu, 7, 0);
++ return best && (best->ebx & bit(X86_FEATURE_MPX));
++}
+ #endif
+diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
+index 9c12e63c653f..8bd81f5a7e07 100644
+--- a/arch/x86/kvm/mmu.c
++++ b/arch/x86/kvm/mmu.c
+@@ -3625,8 +3625,8 @@ static void reset_rsvds_bits_mask_ept(struct kvm_vcpu *vcpu,
+ }
+ }
+
+-void update_permission_bitmask(struct kvm_vcpu *vcpu,
+- struct kvm_mmu *mmu, bool ept)
++static void update_permission_bitmask(struct kvm_vcpu *vcpu,
++ struct kvm_mmu *mmu, bool ept)
+ {
+ unsigned bit, byte, pfec;
+ u8 map;
+@@ -3807,6 +3807,7 @@ static void init_kvm_tdp_mmu(struct kvm_vcpu *vcpu)
+ void kvm_init_shadow_mmu(struct kvm_vcpu *vcpu, struct kvm_mmu *context)
+ {
+ bool smep = kvm_read_cr4_bits(vcpu, X86_CR4_SMEP);
++ bool smap = kvm_read_cr4_bits(vcpu, X86_CR4_SMAP);
+ ASSERT(vcpu);
+ ASSERT(!VALID_PAGE(vcpu->arch.mmu.root_hpa));
+
+@@ -3824,6 +3825,8 @@ void kvm_init_shadow_mmu(struct kvm_vcpu *vcpu, struct kvm_mmu *context)
+ vcpu->arch.mmu.base_role.cr0_wp = is_write_protection(vcpu);
+ vcpu->arch.mmu.base_role.smep_andnot_wp
+ = smep && !is_write_protection(vcpu);
++ context->base_role.smap_andnot_wp
++ = smap && !is_write_protection(vcpu);
+ }
+ EXPORT_SYMBOL_GPL(kvm_init_shadow_mmu);
+
+@@ -4095,12 +4098,18 @@ void kvm_mmu_pte_write(struct kvm_vcpu *vcpu, gpa_t gpa,
+ const u8 *new, int bytes)
+ {
+ gfn_t gfn = gpa >> PAGE_SHIFT;
+- union kvm_mmu_page_role mask = { .word = 0 };
+ struct kvm_mmu_page *sp;
+ LIST_HEAD(invalid_list);
+ u64 entry, gentry, *spte;
+ int npte;
+ bool remote_flush, local_flush, zap_page;
++ union kvm_mmu_page_role mask = (union kvm_mmu_page_role) {
++ .cr0_wp = 1,
++ .cr4_pae = 1,
++ .nxe = 1,
++ .smep_andnot_wp = 1,
++ .smap_andnot_wp = 1,
++ };
+
+ /*
+ * If we don't have indirect shadow pages, it means no page is
+@@ -4126,7 +4135,6 @@ void kvm_mmu_pte_write(struct kvm_vcpu *vcpu, gpa_t gpa,
+ ++vcpu->kvm->stat.mmu_pte_write;
+ kvm_mmu_audit(vcpu, AUDIT_PRE_PTE_WRITE);
+
+- mask.cr0_wp = mask.cr4_pae = mask.nxe = 1;
+ for_each_gfn_indirect_valid_sp(vcpu->kvm, sp, gfn) {
+ if (detect_write_misaligned(sp, gpa, bytes) ||
+ detect_write_flooding(sp)) {
+diff --git a/arch/x86/kvm/mmu.h b/arch/x86/kvm/mmu.h
+index bde8ee725754..a6b876443302 100644
+--- a/arch/x86/kvm/mmu.h
++++ b/arch/x86/kvm/mmu.h
+@@ -84,8 +84,6 @@ int handle_mmio_page_fault_common(struct kvm_vcpu *vcpu, u64 addr, bool direct);
+ void kvm_init_shadow_mmu(struct kvm_vcpu *vcpu, struct kvm_mmu *context);
+ void kvm_init_shadow_ept_mmu(struct kvm_vcpu *vcpu, struct kvm_mmu *context,
+ bool execonly);
+-void update_permission_bitmask(struct kvm_vcpu *vcpu, struct kvm_mmu *mmu,
+- bool ept);
+
+ static inline unsigned int kvm_mmu_available_pages(struct kvm *kvm)
+ {
+@@ -179,6 +177,8 @@ static inline bool permission_fault(struct kvm_vcpu *vcpu, struct kvm_mmu *mmu,
+ int index = (pfec >> 1) +
+ (smap >> (X86_EFLAGS_AC_BIT - PFERR_RSVD_BIT + 1));
+
++ WARN_ON(pfec & PFERR_RSVD_MASK);
++
+ return (mmu->permissions[index] >> pte_access) & 1;
+ }
+
+diff --git a/arch/x86/kvm/paging_tmpl.h b/arch/x86/kvm/paging_tmpl.h
+index fd49c867b25a..6e6d115fe9b5 100644
+--- a/arch/x86/kvm/paging_tmpl.h
++++ b/arch/x86/kvm/paging_tmpl.h
+@@ -718,6 +718,13 @@ static int FNAME(page_fault)(struct kvm_vcpu *vcpu, gva_t addr, u32 error_code,
+ mmu_is_nested(vcpu));
+ if (likely(r != RET_MMIO_PF_INVALID))
+ return r;
++
++ /*
++ * page fault with PFEC.RSVD = 1 is caused by shadow
++ * page fault, should not be used to walk guest page
++ * table.
++ */
++ error_code &= ~PFERR_RSVD_MASK;
+ };
+
+ r = mmu_topup_memory_caches(vcpu);
+diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
+index 7527cefc5a43..f7eaee1cbc54 100644
+--- a/arch/x86/kvm/svm.c
++++ b/arch/x86/kvm/svm.c
+@@ -4370,6 +4370,7 @@ static struct kvm_x86_ops svm_x86_ops = {
+ .cache_reg = svm_cache_reg,
+ .get_rflags = svm_get_rflags,
+ .set_rflags = svm_set_rflags,
++ .fpu_activate = svm_fpu_activate,
+ .fpu_deactivate = svm_fpu_deactivate,
+
+ .tlb_flush = svm_flush_tlb,
+diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
+index 47843b04d60f..54bda28e6a12 100644
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -9120,6 +9120,7 @@ static struct kvm_x86_ops vmx_x86_ops = {
+ .cache_reg = vmx_cache_reg,
+ .get_rflags = vmx_get_rflags,
+ .set_rflags = vmx_set_rflags,
++ .fpu_activate = vmx_fpu_activate,
+ .fpu_deactivate = vmx_fpu_deactivate,
+
+ .tlb_flush = vmx_flush_tlb,
+diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
+index 5369ec6a8094..0bb431c3f74e 100644
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -678,8 +678,9 @@ EXPORT_SYMBOL_GPL(kvm_set_xcr);
+ int kvm_set_cr4(struct kvm_vcpu *vcpu, unsigned long cr4)
+ {
+ unsigned long old_cr4 = kvm_read_cr4(vcpu);
+- unsigned long pdptr_bits = X86_CR4_PGE | X86_CR4_PSE |
+- X86_CR4_PAE | X86_CR4_SMEP;
++ unsigned long pdptr_bits = X86_CR4_PGE | X86_CR4_PSE | X86_CR4_PAE |
++ X86_CR4_SMEP | X86_CR4_SMAP;
++
+ if (cr4 & CR4_RESERVED_BITS)
+ return 1;
+
+@@ -720,9 +721,6 @@ int kvm_set_cr4(struct kvm_vcpu *vcpu, unsigned long cr4)
+ (!(cr4 & X86_CR4_PCIDE) && (old_cr4 & X86_CR4_PCIDE)))
+ kvm_mmu_reset_context(vcpu);
+
+- if ((cr4 ^ old_cr4) & X86_CR4_SMAP)
+- update_permission_bitmask(vcpu, vcpu->arch.walk_mmu, false);
+-
+ if ((cr4 ^ old_cr4) & X86_CR4_OSXSAVE)
+ kvm_update_cpuid(vcpu);
+
+@@ -6139,6 +6137,8 @@ void kvm_vcpu_reload_apic_access_page(struct kvm_vcpu *vcpu)
+ return;
+
+ page = gfn_to_page(vcpu->kvm, APIC_DEFAULT_PHYS_BASE >> PAGE_SHIFT);
++ if (is_error_page(page))
++ return;
+ kvm_x86_ops->set_apic_access_page_addr(vcpu, page_to_phys(page));
+
+ /*
+@@ -6993,7 +6993,9 @@ void kvm_put_guest_fpu(struct kvm_vcpu *vcpu)
+ fpu_save_init(&vcpu->arch.guest_fpu);
+ __kernel_fpu_end();
+ ++vcpu->stat.fpu_reload;
+- kvm_make_request(KVM_REQ_DEACTIVATE_FPU, vcpu);
++ if (!vcpu->arch.eager_fpu)
++ kvm_make_request(KVM_REQ_DEACTIVATE_FPU, vcpu);
++
+ trace_kvm_fpu(0);
+ }
+
+@@ -7009,11 +7011,21 @@ void kvm_arch_vcpu_free(struct kvm_vcpu *vcpu)
+ struct kvm_vcpu *kvm_arch_vcpu_create(struct kvm *kvm,
+ unsigned int id)
+ {
++ struct kvm_vcpu *vcpu;
++
+ if (check_tsc_unstable() && atomic_read(&kvm->online_vcpus) != 0)
+ printk_once(KERN_WARNING
+ "kvm: SMP vm created on host with unstable TSC; "
+ "guest TSC will not be reliable\n");
+- return kvm_x86_ops->vcpu_create(kvm, id);
++
++ vcpu = kvm_x86_ops->vcpu_create(kvm, id);
++
++ /*
++ * Activate fpu unconditionally in case the guest needs eager FPU. It will be
++ * deactivated soon if it doesn't.
++ */
++ kvm_x86_ops->fpu_activate(vcpu);
++ return vcpu;
+ }
+
+ int kvm_arch_vcpu_setup(struct kvm_vcpu *vcpu)
+diff --git a/drivers/acpi/acpi_pnp.c b/drivers/acpi/acpi_pnp.c
+index b193f8425999..ff6d8adc9cda 100644
+--- a/drivers/acpi/acpi_pnp.c
++++ b/drivers/acpi/acpi_pnp.c
+@@ -304,6 +304,8 @@ static const struct acpi_device_id acpi_pnp_device_ids[] = {
+ {"PNPb006"},
+ /* cs423x-pnpbios */
+ {"CSC0100"},
++ {"CSC0103"},
++ {"CSC0110"},
+ {"CSC0000"},
+ {"GIM0100"}, /* Guillemot Turtlebeach something appears to be cs4232 compatible */
+ /* es18xx-pnpbios */
+diff --git a/drivers/acpi/acpica/acmacros.h b/drivers/acpi/acpica/acmacros.h
+index 4bceb11c7380..624cbb3b5683 100644
+--- a/drivers/acpi/acpica/acmacros.h
++++ b/drivers/acpi/acpica/acmacros.h
+@@ -63,23 +63,12 @@
+ #define ACPI_SET64(ptr, val) (*ACPI_CAST64 (ptr) = (u64) (val))
+
+ /*
+- * printf() format helpers. These macros are workarounds for the difficulties
++ * printf() format helper. This macros is a workaround for the difficulties
+ * with emitting 64-bit integers and 64-bit pointers with the same code
+ * for both 32-bit and 64-bit hosts.
+ */
+ #define ACPI_FORMAT_UINT64(i) ACPI_HIDWORD(i), ACPI_LODWORD(i)
+
+-#if ACPI_MACHINE_WIDTH == 64
+-#define ACPI_FORMAT_NATIVE_UINT(i) ACPI_FORMAT_UINT64(i)
+-#define ACPI_FORMAT_TO_UINT(i) ACPI_FORMAT_UINT64(i)
+-#define ACPI_PRINTF_UINT "0x%8.8X%8.8X"
+-
+-#else
+-#define ACPI_FORMAT_NATIVE_UINT(i) 0, (u32) (i)
+-#define ACPI_FORMAT_TO_UINT(i) (u32) (i)
+-#define ACPI_PRINTF_UINT "0x%8.8X"
+-#endif
+-
+ /*
+ * Macros for moving data around to/from buffers that are possibly unaligned.
+ * If the hardware supports the transfer of unaligned data, just do the store.
+diff --git a/drivers/acpi/acpica/dsopcode.c b/drivers/acpi/acpica/dsopcode.c
+index 6c0759c0db47..5e7c7c301c5c 100644
+--- a/drivers/acpi/acpica/dsopcode.c
++++ b/drivers/acpi/acpica/dsopcode.c
+@@ -446,7 +446,7 @@ acpi_ds_eval_region_operands(struct acpi_walk_state *walk_state,
+
+ ACPI_DEBUG_PRINT((ACPI_DB_EXEC, "RgnObj %p Addr %8.8X%8.8X Len %X\n",
+ obj_desc,
+- ACPI_FORMAT_NATIVE_UINT(obj_desc->region.address),
++ ACPI_FORMAT_UINT64(obj_desc->region.address),
+ obj_desc->region.length));
+
+ /* Now the address and length are valid for this opregion */
+@@ -539,13 +539,12 @@ acpi_ds_eval_table_region_operands(struct acpi_walk_state *walk_state,
+ return_ACPI_STATUS(AE_NOT_EXIST);
+ }
+
+- obj_desc->region.address =
+- (acpi_physical_address) ACPI_TO_INTEGER(table);
++ obj_desc->region.address = ACPI_PTR_TO_PHYSADDR(table);
+ obj_desc->region.length = table->length;
+
+ ACPI_DEBUG_PRINT((ACPI_DB_EXEC, "RgnObj %p Addr %8.8X%8.8X Len %X\n",
+ obj_desc,
+- ACPI_FORMAT_NATIVE_UINT(obj_desc->region.address),
++ ACPI_FORMAT_UINT64(obj_desc->region.address),
+ obj_desc->region.length));
+
+ /* Now the address and length are valid for this opregion */
+diff --git a/drivers/acpi/acpica/evregion.c b/drivers/acpi/acpica/evregion.c
+index 8eb8575e8c16..9ce53980201c 100644
+--- a/drivers/acpi/acpica/evregion.c
++++ b/drivers/acpi/acpica/evregion.c
+@@ -272,7 +272,7 @@ acpi_ev_address_space_dispatch(union acpi_operand_object *region_obj,
+ ACPI_DEBUG_PRINT((ACPI_DB_OPREGION,
+ "Handler %p (@%p) Address %8.8X%8.8X [%s]\n",
+ ®ion_obj->region.handler->address_space, handler,
+- ACPI_FORMAT_NATIVE_UINT(address),
++ ACPI_FORMAT_UINT64(address),
+ acpi_ut_get_region_name(region_obj->region.
+ space_id)));
+
+diff --git a/drivers/acpi/acpica/exdump.c b/drivers/acpi/acpica/exdump.c
+index 0f23c3f2678e..16b4909a8b90 100644
+--- a/drivers/acpi/acpica/exdump.c
++++ b/drivers/acpi/acpica/exdump.c
+@@ -767,8 +767,8 @@ void acpi_ex_dump_operand(union acpi_operand_object *obj_desc, u32 depth)
+ acpi_os_printf("\n");
+ } else {
+ acpi_os_printf(" base %8.8X%8.8X Length %X\n",
+- ACPI_FORMAT_NATIVE_UINT(obj_desc->region.
+- address),
++ ACPI_FORMAT_UINT64(obj_desc->region.
++ address),
+ obj_desc->region.length);
+ }
+ break;
+diff --git a/drivers/acpi/acpica/exfldio.c b/drivers/acpi/acpica/exfldio.c
+index 1d1b27a96c5b..58ea85e42bfc 100644
+--- a/drivers/acpi/acpica/exfldio.c
++++ b/drivers/acpi/acpica/exfldio.c
+@@ -263,17 +263,15 @@ acpi_ex_access_region(union acpi_operand_object *obj_desc,
+ }
+
+ ACPI_DEBUG_PRINT_RAW((ACPI_DB_BFIELD,
+- " Region [%s:%X], Width %X, ByteBase %X, Offset %X at %p\n",
++ " Region [%s:%X], Width %X, ByteBase %X, Offset %X at %8.8X%8.8X\n",
+ acpi_ut_get_region_name(rgn_desc->region.
+ space_id),
+ rgn_desc->region.space_id,
+ obj_desc->common_field.access_byte_width,
+ obj_desc->common_field.base_byte_offset,
+- field_datum_byte_offset, ACPI_CAST_PTR(void,
+- (rgn_desc->
+- region.
+- address +
+- region_offset))));
++ field_datum_byte_offset,
++ ACPI_FORMAT_UINT64(rgn_desc->region.address +
++ region_offset)));
+
+ /* Invoke the appropriate address_space/op_region handler */
+
+diff --git a/drivers/acpi/acpica/exregion.c b/drivers/acpi/acpica/exregion.c
+index cd5288a257a9..be51d3ed4d0f 100644
+--- a/drivers/acpi/acpica/exregion.c
++++ b/drivers/acpi/acpica/exregion.c
+@@ -181,7 +181,7 @@ acpi_ex_system_memory_space_handler(u32 function,
+ if (!mem_info->mapped_logical_address) {
+ ACPI_ERROR((AE_INFO,
+ "Could not map memory at 0x%8.8X%8.8X, size %u",
+- ACPI_FORMAT_NATIVE_UINT(address),
++ ACPI_FORMAT_UINT64(address),
+ (u32) map_length));
+ mem_info->mapped_length = 0;
+ return_ACPI_STATUS(AE_NO_MEMORY);
+@@ -202,8 +202,7 @@ acpi_ex_system_memory_space_handler(u32 function,
+
+ ACPI_DEBUG_PRINT((ACPI_DB_INFO,
+ "System-Memory (width %u) R/W %u Address=%8.8X%8.8X\n",
+- bit_width, function,
+- ACPI_FORMAT_NATIVE_UINT(address)));
++ bit_width, function, ACPI_FORMAT_UINT64(address)));
+
+ /*
+ * Perform the memory read or write
+@@ -318,8 +317,7 @@ acpi_ex_system_io_space_handler(u32 function,
+
+ ACPI_DEBUG_PRINT((ACPI_DB_INFO,
+ "System-IO (width %u) R/W %u Address=%8.8X%8.8X\n",
+- bit_width, function,
+- ACPI_FORMAT_NATIVE_UINT(address)));
++ bit_width, function, ACPI_FORMAT_UINT64(address)));
+
+ /* Decode the function parameter */
+
+diff --git a/drivers/acpi/acpica/hwvalid.c b/drivers/acpi/acpica/hwvalid.c
+index 6b919127cd9d..dabf754ea4a4 100644
+--- a/drivers/acpi/acpica/hwvalid.c
++++ b/drivers/acpi/acpica/hwvalid.c
+@@ -142,17 +142,17 @@ acpi_hw_validate_io_request(acpi_io_address address, u32 bit_width)
+ byte_width = ACPI_DIV_8(bit_width);
+ last_address = address + byte_width - 1;
+
+- ACPI_DEBUG_PRINT((ACPI_DB_IO, "Address %p LastAddress %p Length %X",
+- ACPI_CAST_PTR(void, address), ACPI_CAST_PTR(void,
+- last_address),
+- byte_width));
++ ACPI_DEBUG_PRINT((ACPI_DB_IO,
++ "Address %8.8X%8.8X LastAddress %8.8X%8.8X Length %X",
++ ACPI_FORMAT_UINT64(address),
++ ACPI_FORMAT_UINT64(last_address), byte_width));
+
+ /* Maximum 16-bit address in I/O space */
+
+ if (last_address > ACPI_UINT16_MAX) {
+ ACPI_ERROR((AE_INFO,
+- "Illegal I/O port address/length above 64K: %p/0x%X",
+- ACPI_CAST_PTR(void, address), byte_width));
++ "Illegal I/O port address/length above 64K: %8.8X%8.8X/0x%X",
++ ACPI_FORMAT_UINT64(address), byte_width));
+ return_ACPI_STATUS(AE_LIMIT);
+ }
+
+@@ -181,8 +181,8 @@ acpi_hw_validate_io_request(acpi_io_address address, u32 bit_width)
+
+ if (acpi_gbl_osi_data >= port_info->osi_dependency) {
+ ACPI_DEBUG_PRINT((ACPI_DB_IO,
+- "Denied AML access to port 0x%p/%X (%s 0x%.4X-0x%.4X)",
+- ACPI_CAST_PTR(void, address),
++ "Denied AML access to port 0x%8.8X%8.8X/%X (%s 0x%.4X-0x%.4X)",
++ ACPI_FORMAT_UINT64(address),
+ byte_width, port_info->name,
+ port_info->start,
+ port_info->end));
+diff --git a/drivers/acpi/acpica/nsdump.c b/drivers/acpi/acpica/nsdump.c
+index 3d88ef4a3e0d..809ed52de9c8 100644
+--- a/drivers/acpi/acpica/nsdump.c
++++ b/drivers/acpi/acpica/nsdump.c
+@@ -271,12 +271,11 @@ acpi_ns_dump_one_object(acpi_handle obj_handle,
+ switch (type) {
+ case ACPI_TYPE_PROCESSOR:
+
+- acpi_os_printf("ID %02X Len %02X Addr %p\n",
++ acpi_os_printf("ID %02X Len %02X Addr %8.8X%8.8X\n",
+ obj_desc->processor.proc_id,
+ obj_desc->processor.length,
+- ACPI_CAST_PTR(void,
+- obj_desc->processor.
+- address));
++ ACPI_FORMAT_UINT64(obj_desc->processor.
++ address));
+ break;
+
+ case ACPI_TYPE_DEVICE:
+@@ -347,8 +346,9 @@ acpi_ns_dump_one_object(acpi_handle obj_handle,
+ space_id));
+ if (obj_desc->region.flags & AOPOBJ_DATA_VALID) {
+ acpi_os_printf(" Addr %8.8X%8.8X Len %.4X\n",
+- ACPI_FORMAT_NATIVE_UINT
+- (obj_desc->region.address),
++ ACPI_FORMAT_UINT64(obj_desc->
++ region.
++ address),
+ obj_desc->region.length);
+ } else {
+ acpi_os_printf
+diff --git a/drivers/acpi/acpica/tbdata.c b/drivers/acpi/acpica/tbdata.c
+index f499c10ceb4a..a078053ff473 100644
+--- a/drivers/acpi/acpica/tbdata.c
++++ b/drivers/acpi/acpica/tbdata.c
+@@ -113,9 +113,9 @@ acpi_tb_acquire_table(struct acpi_table_desc *table_desc,
+ case ACPI_TABLE_ORIGIN_INTERNAL_VIRTUAL:
+ case ACPI_TABLE_ORIGIN_EXTERNAL_VIRTUAL:
+
+- table =
+- ACPI_CAST_PTR(struct acpi_table_header,
+- table_desc->address);
++ table = ACPI_CAST_PTR(struct acpi_table_header,
++ ACPI_PHYSADDR_TO_PTR(table_desc->
++ address));
+ break;
+
+ default:
+@@ -214,7 +214,8 @@ acpi_tb_acquire_temp_table(struct acpi_table_desc *table_desc,
+ case ACPI_TABLE_ORIGIN_INTERNAL_VIRTUAL:
+ case ACPI_TABLE_ORIGIN_EXTERNAL_VIRTUAL:
+
+- table_header = ACPI_CAST_PTR(struct acpi_table_header, address);
++ table_header = ACPI_CAST_PTR(struct acpi_table_header,
++ ACPI_PHYSADDR_TO_PTR(address));
+ if (!table_header) {
+ return (AE_NO_MEMORY);
+ }
+@@ -398,14 +399,14 @@ acpi_tb_verify_temp_table(struct acpi_table_desc * table_desc, char *signature)
+ table_desc->length);
+ if (ACPI_FAILURE(status)) {
+ ACPI_EXCEPTION((AE_INFO, AE_NO_MEMORY,
+- "%4.4s " ACPI_PRINTF_UINT
++ "%4.4s 0x%8.8X%8.8X"
+ " Attempted table install failed",
+ acpi_ut_valid_acpi_name(table_desc->
+ signature.
+ ascii) ?
+ table_desc->signature.ascii : "????",
+- ACPI_FORMAT_TO_UINT(table_desc->
+- address)));
++ ACPI_FORMAT_UINT64(table_desc->
++ address)));
+ goto invalidate_and_exit;
+ }
+ }
+diff --git a/drivers/acpi/acpica/tbinstal.c b/drivers/acpi/acpica/tbinstal.c
+index c0b39f304ea3..8e1a43ae2f9b 100644
+--- a/drivers/acpi/acpica/tbinstal.c
++++ b/drivers/acpi/acpica/tbinstal.c
+@@ -187,8 +187,9 @@ acpi_tb_install_fixed_table(acpi_physical_address address,
+ status = acpi_tb_acquire_temp_table(&new_table_desc, address,
+ ACPI_TABLE_ORIGIN_INTERNAL_PHYSICAL);
+ if (ACPI_FAILURE(status)) {
+- ACPI_ERROR((AE_INFO, "Could not acquire table length at %p",
+- ACPI_CAST_PTR(void, address)));
++ ACPI_ERROR((AE_INFO,
++ "Could not acquire table length at %8.8X%8.8X",
++ ACPI_FORMAT_UINT64(address)));
+ return_ACPI_STATUS(status);
+ }
+
+@@ -246,8 +247,9 @@ acpi_tb_install_standard_table(acpi_physical_address address,
+
+ status = acpi_tb_acquire_temp_table(&new_table_desc, address, flags);
+ if (ACPI_FAILURE(status)) {
+- ACPI_ERROR((AE_INFO, "Could not acquire table length at %p",
+- ACPI_CAST_PTR(void, address)));
++ ACPI_ERROR((AE_INFO,
++ "Could not acquire table length at %8.8X%8.8X",
++ ACPI_FORMAT_UINT64(address)));
+ return_ACPI_STATUS(status);
+ }
+
+@@ -258,9 +260,10 @@ acpi_tb_install_standard_table(acpi_physical_address address,
+ if (!reload &&
+ acpi_gbl_disable_ssdt_table_install &&
+ ACPI_COMPARE_NAME(&new_table_desc.signature, ACPI_SIG_SSDT)) {
+- ACPI_INFO((AE_INFO, "Ignoring installation of %4.4s at %p",
+- new_table_desc.signature.ascii, ACPI_CAST_PTR(void,
+- address)));
++ ACPI_INFO((AE_INFO,
++ "Ignoring installation of %4.4s at %8.8X%8.8X",
++ new_table_desc.signature.ascii,
++ ACPI_FORMAT_UINT64(address)));
+ goto release_and_exit;
+ }
+
+@@ -428,11 +431,11 @@ finish_override:
+ return;
+ }
+
+- ACPI_INFO((AE_INFO, "%4.4s " ACPI_PRINTF_UINT
+- " %s table override, new table: " ACPI_PRINTF_UINT,
++ ACPI_INFO((AE_INFO, "%4.4s 0x%8.8X%8.8X"
++ " %s table override, new table: 0x%8.8X%8.8X",
+ old_table_desc->signature.ascii,
+- ACPI_FORMAT_TO_UINT(old_table_desc->address),
+- override_type, ACPI_FORMAT_TO_UINT(new_table_desc.address)));
++ ACPI_FORMAT_UINT64(old_table_desc->address),
++ override_type, ACPI_FORMAT_UINT64(new_table_desc.address)));
+
+ /* We can now uninstall the original table */
+
+@@ -516,7 +519,7 @@ void acpi_tb_uninstall_table(struct acpi_table_desc *table_desc)
+
+ if ((table_desc->flags & ACPI_TABLE_ORIGIN_MASK) ==
+ ACPI_TABLE_ORIGIN_INTERNAL_VIRTUAL) {
+- ACPI_FREE(ACPI_CAST_PTR(void, table_desc->address));
++ ACPI_FREE(ACPI_PHYSADDR_TO_PTR(table_desc->address));
+ }
+
+ table_desc->address = ACPI_PTR_TO_PHYSADDR(NULL);
+diff --git a/drivers/acpi/acpica/tbprint.c b/drivers/acpi/acpica/tbprint.c
+index df3bb20ea325..a23bdaec6040 100644
+--- a/drivers/acpi/acpica/tbprint.c
++++ b/drivers/acpi/acpica/tbprint.c
+@@ -127,18 +127,12 @@ acpi_tb_print_table_header(acpi_physical_address address,
+ {
+ struct acpi_table_header local_header;
+
+- /*
+- * The reason that we use ACPI_PRINTF_UINT and ACPI_FORMAT_TO_UINT is to
+- * support both 32-bit and 64-bit hosts/addresses in a consistent manner.
+- * The %p specifier does not emit uniform output on all hosts. On some,
+- * leading zeros are not supported.
+- */
+ if (ACPI_COMPARE_NAME(header->signature, ACPI_SIG_FACS)) {
+
+ /* FACS only has signature and length fields */
+
+- ACPI_INFO((AE_INFO, "%-4.4s " ACPI_PRINTF_UINT " %06X",
+- header->signature, ACPI_FORMAT_TO_UINT(address),
++ ACPI_INFO((AE_INFO, "%-4.4s 0x%8.8X%8.8X %06X",
++ header->signature, ACPI_FORMAT_UINT64(address),
+ header->length));
+ } else if (ACPI_VALIDATE_RSDP_SIG(header->signature)) {
+
+@@ -149,9 +143,8 @@ acpi_tb_print_table_header(acpi_physical_address address,
+ header)->oem_id, ACPI_OEM_ID_SIZE);
+ acpi_tb_fix_string(local_header.oem_id, ACPI_OEM_ID_SIZE);
+
+- ACPI_INFO((AE_INFO,
+- "RSDP " ACPI_PRINTF_UINT " %06X (v%.2d %-6.6s)",
+- ACPI_FORMAT_TO_UINT(address),
++ ACPI_INFO((AE_INFO, "RSDP 0x%8.8X%8.8X %06X (v%.2d %-6.6s)",
++ ACPI_FORMAT_UINT64(address),
+ (ACPI_CAST_PTR(struct acpi_table_rsdp, header)->
+ revision >
+ 0) ? ACPI_CAST_PTR(struct acpi_table_rsdp,
+@@ -165,9 +158,9 @@ acpi_tb_print_table_header(acpi_physical_address address,
+ acpi_tb_cleanup_table_header(&local_header, header);
+
+ ACPI_INFO((AE_INFO,
+- "%-4.4s " ACPI_PRINTF_UINT
++ "%-4.4s 0x%8.8X%8.8X"
+ " %06X (v%.2d %-6.6s %-8.8s %08X %-4.4s %08X)",
+- local_header.signature, ACPI_FORMAT_TO_UINT(address),
++ local_header.signature, ACPI_FORMAT_UINT64(address),
+ local_header.length, local_header.revision,
+ local_header.oem_id, local_header.oem_table_id,
+ local_header.oem_revision,
+diff --git a/drivers/acpi/acpica/tbxfroot.c b/drivers/acpi/acpica/tbxfroot.c
+index 43a54af2b548..89772b3fe55a 100644
+--- a/drivers/acpi/acpica/tbxfroot.c
++++ b/drivers/acpi/acpica/tbxfroot.c
+@@ -142,7 +142,7 @@ acpi_status acpi_tb_validate_rsdp(struct acpi_table_rsdp * rsdp)
+ *
+ ******************************************************************************/
+
+-acpi_status __init acpi_find_root_pointer(acpi_size *table_address)
++acpi_status __init acpi_find_root_pointer(acpi_physical_address * table_address)
+ {
+ u8 *table_ptr;
+ u8 *mem_rover;
+@@ -200,7 +200,8 @@ acpi_status __init acpi_find_root_pointer(acpi_size *table_address)
+ physical_address +=
+ (u32) ACPI_PTR_DIFF(mem_rover, table_ptr);
+
+- *table_address = physical_address;
++ *table_address =
++ (acpi_physical_address) physical_address;
+ return_ACPI_STATUS(AE_OK);
+ }
+ }
+@@ -233,7 +234,7 @@ acpi_status __init acpi_find_root_pointer(acpi_size *table_address)
+ (ACPI_HI_RSDP_WINDOW_BASE +
+ ACPI_PTR_DIFF(mem_rover, table_ptr));
+
+- *table_address = physical_address;
++ *table_address = (acpi_physical_address) physical_address;
+ return_ACPI_STATUS(AE_OK);
+ }
+
+diff --git a/drivers/acpi/acpica/utaddress.c b/drivers/acpi/acpica/utaddress.c
+index a1acec9d2ef3..65985036c5c3 100644
+--- a/drivers/acpi/acpica/utaddress.c
++++ b/drivers/acpi/acpica/utaddress.c
+@@ -107,10 +107,10 @@ acpi_ut_add_address_range(acpi_adr_space_type space_id,
+ acpi_gbl_address_range_list[space_id] = range_info;
+
+ ACPI_DEBUG_PRINT((ACPI_DB_NAMES,
+- "\nAdded [%4.4s] address range: 0x%p-0x%p\n",
++ "\nAdded [%4.4s] address range: 0x%8.8X%8.8X-0x%8.8X%8.8X\n",
+ acpi_ut_get_node_name(range_info->region_node),
+- ACPI_CAST_PTR(void, address),
+- ACPI_CAST_PTR(void, range_info->end_address)));
++ ACPI_FORMAT_UINT64(address),
++ ACPI_FORMAT_UINT64(range_info->end_address)));
+
+ (void)acpi_ut_release_mutex(ACPI_MTX_NAMESPACE);
+ return_ACPI_STATUS(AE_OK);
+@@ -160,15 +160,13 @@ acpi_ut_remove_address_range(acpi_adr_space_type space_id,
+ }
+
+ ACPI_DEBUG_PRINT((ACPI_DB_NAMES,
+- "\nRemoved [%4.4s] address range: 0x%p-0x%p\n",
++ "\nRemoved [%4.4s] address range: 0x%8.8X%8.8X-0x%8.8X%8.8X\n",
+ acpi_ut_get_node_name(range_info->
+ region_node),
+- ACPI_CAST_PTR(void,
+- range_info->
+- start_address),
+- ACPI_CAST_PTR(void,
+- range_info->
+- end_address)));
++ ACPI_FORMAT_UINT64(range_info->
++ start_address),
++ ACPI_FORMAT_UINT64(range_info->
++ end_address)));
+
+ ACPI_FREE(range_info);
+ return_VOID;
+@@ -245,16 +243,14 @@ acpi_ut_check_address_range(acpi_adr_space_type space_id,
+ region_node);
+
+ ACPI_WARNING((AE_INFO,
+- "%s range 0x%p-0x%p conflicts with OpRegion 0x%p-0x%p (%s)",
++ "%s range 0x%8.8X%8.8X-0x%8.8X%8.8X conflicts with OpRegion 0x%8.8X%8.8X-0x%8.8X%8.8X (%s)",
+ acpi_ut_get_region_name(space_id),
+- ACPI_CAST_PTR(void, address),
+- ACPI_CAST_PTR(void, end_address),
+- ACPI_CAST_PTR(void,
+- range_info->
+- start_address),
+- ACPI_CAST_PTR(void,
+- range_info->
+- end_address),
++ ACPI_FORMAT_UINT64(address),
++ ACPI_FORMAT_UINT64(end_address),
++ ACPI_FORMAT_UINT64(range_info->
++ start_address),
++ ACPI_FORMAT_UINT64(range_info->
++ end_address),
+ pathname));
+ ACPI_FREE(pathname);
+ }
+diff --git a/drivers/acpi/osl.c b/drivers/acpi/osl.c
+index 9964f70be98d..838359818228 100644
+--- a/drivers/acpi/osl.c
++++ b/drivers/acpi/osl.c
+@@ -182,7 +182,7 @@ static void __init acpi_request_region (struct acpi_generic_address *gas,
+ request_mem_region(addr, length, desc);
+ }
+
+-static int __init acpi_reserve_resources(void)
++static void __init acpi_reserve_resources(void)
+ {
+ acpi_request_region(&acpi_gbl_FADT.xpm1a_event_block, acpi_gbl_FADT.pm1_event_length,
+ "ACPI PM1a_EVT_BLK");
+@@ -211,10 +211,7 @@ static int __init acpi_reserve_resources(void)
+ if (!(acpi_gbl_FADT.gpe1_block_length & 0x1))
+ acpi_request_region(&acpi_gbl_FADT.xgpe1_block,
+ acpi_gbl_FADT.gpe1_block_length, "ACPI GPE1_BLK");
+-
+- return 0;
+ }
+-device_initcall(acpi_reserve_resources);
+
+ void acpi_os_printf(const char *fmt, ...)
+ {
+@@ -1839,6 +1836,7 @@ acpi_status __init acpi_os_initialize(void)
+
+ acpi_status __init acpi_os_initialize1(void)
+ {
++ acpi_reserve_resources();
+ kacpid_wq = alloc_workqueue("kacpid", 0, 1);
+ kacpi_notify_wq = alloc_workqueue("kacpi_notify", 0, 1);
+ kacpi_hotplug_wq = alloc_ordered_workqueue("kacpi_hotplug", 0);
+diff --git a/drivers/acpi/sbshc.c b/drivers/acpi/sbshc.c
+index 26e5b5060523..bf034f8b7c1a 100644
+--- a/drivers/acpi/sbshc.c
++++ b/drivers/acpi/sbshc.c
+@@ -14,6 +14,7 @@
+ #include <linux/delay.h>
+ #include <linux/module.h>
+ #include <linux/interrupt.h>
++#include <linux/dmi.h>
+ #include "sbshc.h"
+
+ #define PREFIX "ACPI: "
+@@ -87,6 +88,8 @@ enum acpi_smb_offset {
+ ACPI_SMB_ALARM_DATA = 0x26, /* 2 bytes alarm data */
+ };
+
++static bool macbook;
++
+ static inline int smb_hc_read(struct acpi_smb_hc *hc, u8 address, u8 *data)
+ {
+ return ec_read(hc->offset + address, data);
+@@ -132,6 +135,8 @@ static int acpi_smbus_transaction(struct acpi_smb_hc *hc, u8 protocol,
+ }
+
+ mutex_lock(&hc->lock);
++ if (macbook)
++ udelay(5);
+ if (smb_hc_read(hc, ACPI_SMB_PROTOCOL, &temp))
+ goto end;
+ if (temp) {
+@@ -257,12 +262,29 @@ extern int acpi_ec_add_query_handler(struct acpi_ec *ec, u8 query_bit,
+ acpi_handle handle, acpi_ec_query_func func,
+ void *data);
+
++static int macbook_dmi_match(const struct dmi_system_id *d)
++{
++ pr_debug("Detected MacBook, enabling workaround\n");
++ macbook = true;
++ return 0;
++}
++
++static struct dmi_system_id acpi_smbus_dmi_table[] = {
++ { macbook_dmi_match, "Apple MacBook", {
++ DMI_MATCH(DMI_BOARD_VENDOR, "Apple"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "MacBook") },
++ },
++ { },
++};
++
+ static int acpi_smbus_hc_add(struct acpi_device *device)
+ {
+ int status;
+ unsigned long long val;
+ struct acpi_smb_hc *hc;
+
++ dmi_check_system(acpi_smbus_dmi_table);
++
+ if (!device)
+ return -EINVAL;
+
+diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
+index 49f1e6890587..73187771836c 100644
+--- a/drivers/ata/ahci.c
++++ b/drivers/ata/ahci.c
+@@ -66,6 +66,7 @@ enum board_ids {
+ board_ahci_yes_fbs,
+
+ /* board IDs for specific chipsets in alphabetical order */
++ board_ahci_avn,
+ board_ahci_mcp65,
+ board_ahci_mcp77,
+ board_ahci_mcp89,
+@@ -84,6 +85,8 @@ enum board_ids {
+ static int ahci_init_one(struct pci_dev *pdev, const struct pci_device_id *ent);
+ static int ahci_vt8251_hardreset(struct ata_link *link, unsigned int *class,
+ unsigned long deadline);
++static int ahci_avn_hardreset(struct ata_link *link, unsigned int *class,
++ unsigned long deadline);
+ static void ahci_mcp89_apple_enable(struct pci_dev *pdev);
+ static bool is_mcp89_apple(struct pci_dev *pdev);
+ static int ahci_p5wdh_hardreset(struct ata_link *link, unsigned int *class,
+@@ -107,6 +110,11 @@ static struct ata_port_operations ahci_p5wdh_ops = {
+ .hardreset = ahci_p5wdh_hardreset,
+ };
+
++static struct ata_port_operations ahci_avn_ops = {
++ .inherits = &ahci_ops,
++ .hardreset = ahci_avn_hardreset,
++};
++
+ static const struct ata_port_info ahci_port_info[] = {
+ /* by features */
+ [board_ahci] = {
+@@ -151,6 +159,12 @@ static const struct ata_port_info ahci_port_info[] = {
+ .port_ops = &ahci_ops,
+ },
+ /* by chipsets */
++ [board_ahci_avn] = {
++ .flags = AHCI_FLAG_COMMON,
++ .pio_mask = ATA_PIO4,
++ .udma_mask = ATA_UDMA6,
++ .port_ops = &ahci_avn_ops,
++ },
+ [board_ahci_mcp65] = {
+ AHCI_HFLAGS (AHCI_HFLAG_NO_FPDMA_AA | AHCI_HFLAG_NO_PMP |
+ AHCI_HFLAG_YES_NCQ),
+@@ -290,14 +304,14 @@ static const struct pci_device_id ahci_pci_tbl[] = {
+ { PCI_VDEVICE(INTEL, 0x1f27), board_ahci }, /* Avoton RAID */
+ { PCI_VDEVICE(INTEL, 0x1f2e), board_ahci }, /* Avoton RAID */
+ { PCI_VDEVICE(INTEL, 0x1f2f), board_ahci }, /* Avoton RAID */
+- { PCI_VDEVICE(INTEL, 0x1f32), board_ahci }, /* Avoton AHCI */
+- { PCI_VDEVICE(INTEL, 0x1f33), board_ahci }, /* Avoton AHCI */
+- { PCI_VDEVICE(INTEL, 0x1f34), board_ahci }, /* Avoton RAID */
+- { PCI_VDEVICE(INTEL, 0x1f35), board_ahci }, /* Avoton RAID */
+- { PCI_VDEVICE(INTEL, 0x1f36), board_ahci }, /* Avoton RAID */
+- { PCI_VDEVICE(INTEL, 0x1f37), board_ahci }, /* Avoton RAID */
+- { PCI_VDEVICE(INTEL, 0x1f3e), board_ahci }, /* Avoton RAID */
+- { PCI_VDEVICE(INTEL, 0x1f3f), board_ahci }, /* Avoton RAID */
++ { PCI_VDEVICE(INTEL, 0x1f32), board_ahci_avn }, /* Avoton AHCI */
++ { PCI_VDEVICE(INTEL, 0x1f33), board_ahci_avn }, /* Avoton AHCI */
++ { PCI_VDEVICE(INTEL, 0x1f34), board_ahci_avn }, /* Avoton RAID */
++ { PCI_VDEVICE(INTEL, 0x1f35), board_ahci_avn }, /* Avoton RAID */
++ { PCI_VDEVICE(INTEL, 0x1f36), board_ahci_avn }, /* Avoton RAID */
++ { PCI_VDEVICE(INTEL, 0x1f37), board_ahci_avn }, /* Avoton RAID */
++ { PCI_VDEVICE(INTEL, 0x1f3e), board_ahci_avn }, /* Avoton RAID */
++ { PCI_VDEVICE(INTEL, 0x1f3f), board_ahci_avn }, /* Avoton RAID */
+ { PCI_VDEVICE(INTEL, 0x2823), board_ahci }, /* Wellsburg RAID */
+ { PCI_VDEVICE(INTEL, 0x2827), board_ahci }, /* Wellsburg RAID */
+ { PCI_VDEVICE(INTEL, 0x8d02), board_ahci }, /* Wellsburg AHCI */
+@@ -671,6 +685,79 @@ static int ahci_p5wdh_hardreset(struct ata_link *link, unsigned int *class,
+ return rc;
+ }
+
++/*
++ * ahci_avn_hardreset - attempt more aggressive recovery of Avoton ports.
++ *
++ * It has been observed with some SSDs that the timing of events in the
++ * link synchronization phase can leave the port in a state that can not
++ * be recovered by a SATA-hard-reset alone. The failing signature is
++ * SStatus.DET stuck at 1 ("Device presence detected but Phy
++ * communication not established"). It was found that unloading and
++ * reloading the driver when this problem occurs allows the drive
++ * connection to be recovered (DET advanced to 0x3). The critical
++ * component of reloading the driver is that the port state machines are
++ * reset by bouncing "port enable" in the AHCI PCS configuration
++ * register. So, reproduce that effect by bouncing a port whenever we
++ * see DET==1 after a reset.
++ */
++static int ahci_avn_hardreset(struct ata_link *link, unsigned int *class,
++ unsigned long deadline)
++{
++ const unsigned long *timing = sata_ehc_deb_timing(&link->eh_context);
++ struct ata_port *ap = link->ap;
++ struct ahci_port_priv *pp = ap->private_data;
++ struct ahci_host_priv *hpriv = ap->host->private_data;
++ u8 *d2h_fis = pp->rx_fis + RX_FIS_D2H_REG;
++ unsigned long tmo = deadline - jiffies;
++ struct ata_taskfile tf;
++ bool online;
++ int rc, i;
++
++ DPRINTK("ENTER\n");
++
++ ahci_stop_engine(ap);
++
++ for (i = 0; i < 2; i++) {
++ u16 val;
++ u32 sstatus;
++ int port = ap->port_no;
++ struct ata_host *host = ap->host;
++ struct pci_dev *pdev = to_pci_dev(host->dev);
++
++ /* clear D2H reception area to properly wait for D2H FIS */
++ ata_tf_init(link->device, &tf);
++ tf.command = ATA_BUSY;
++ ata_tf_to_fis(&tf, 0, 0, d2h_fis);
++
++ rc = sata_link_hardreset(link, timing, deadline, &online,
++ ahci_check_ready);
++
++ if (sata_scr_read(link, SCR_STATUS, &sstatus) != 0 ||
++ (sstatus & 0xf) != 1)
++ break;
++
++ ata_link_printk(link, KERN_INFO, "avn bounce port%d\n",
++ port);
++
++ pci_read_config_word(pdev, 0x92, &val);
++ val &= ~(1 << port);
++ pci_write_config_word(pdev, 0x92, val);
++ ata_msleep(ap, 1000);
++ val |= 1 << port;
++ pci_write_config_word(pdev, 0x92, val);
++ deadline += tmo;
++ }
++
++ hpriv->start_engine(ap);
++
++ if (online)
++ *class = ahci_dev_classify(ap);
++
++ DPRINTK("EXIT, rc=%d, class=%u\n", rc, *class);
++ return rc;
++}
++
++
+ #ifdef CONFIG_PM
+ static int ahci_pci_device_suspend(struct pci_dev *pdev, pm_message_t mesg)
+ {
+diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c
+index 97683e45ab04..de88999521b7 100644
+--- a/drivers/ata/libahci.c
++++ b/drivers/ata/libahci.c
+@@ -1707,8 +1707,7 @@ static void ahci_handle_port_interrupt(struct ata_port *ap,
+ if (unlikely(resetting))
+ status &= ~PORT_IRQ_BAD_PMP;
+
+- /* if LPM is enabled, PHYRDY doesn't mean anything */
+- if (ap->link.lpm_policy > ATA_LPM_MAX_POWER) {
++ if (sata_lpm_ignore_phy_events(&ap->link)) {
+ status &= ~PORT_IRQ_PHYRDY;
+ ahci_scr_write(&ap->link, SCR_ERROR, SERR_PHYRDY_CHG);
+ }
+diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
+index 485f7eab0d4b..64af3bf2b4c7 100644
+--- a/drivers/ata/libata-core.c
++++ b/drivers/ata/libata-core.c
+@@ -6747,6 +6747,38 @@ u32 ata_wait_register(struct ata_port *ap, void __iomem *reg, u32 mask, u32 val,
+ return tmp;
+ }
+
++/**
++ * sata_lpm_ignore_phy_events - test if PHY event should be ignored
++ * @link: Link receiving the event
++ *
++ * Test whether the received PHY event has to be ignored or not.
++ *
++ * LOCKING:
++ * None:
++ *
++ * RETURNS:
++ * True if the event has to be ignored.
++ */
++bool sata_lpm_ignore_phy_events(struct ata_link *link)
++{
++ unsigned long lpm_timeout = link->last_lpm_change +
++ msecs_to_jiffies(ATA_TMOUT_SPURIOUS_PHY);
++
++ /* if LPM is enabled, PHYRDY doesn't mean anything */
++ if (link->lpm_policy > ATA_LPM_MAX_POWER)
++ return true;
++
++ /* ignore the first PHY event after the LPM policy changed
++ * as it is might be spurious
++ */
++ if ((link->flags & ATA_LFLAG_CHANGED) &&
++ time_before(jiffies, lpm_timeout))
++ return true;
++
++ return false;
++}
++EXPORT_SYMBOL_GPL(sata_lpm_ignore_phy_events);
++
+ /*
+ * Dummy port_ops
+ */
+diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c
+index dad83df555c4..4ec95b76f6a1 100644
+--- a/drivers/ata/libata-eh.c
++++ b/drivers/ata/libata-eh.c
+@@ -3490,6 +3490,9 @@ static int ata_eh_set_lpm(struct ata_link *link, enum ata_lpm_policy policy,
+ }
+ }
+
++ link->last_lpm_change = jiffies;
++ link->flags |= ATA_LFLAG_CHANGED;
++
+ return 0;
+
+ fail:
+diff --git a/drivers/edac/mce_amd.h b/drivers/edac/mce_amd.h
+index 51b7e3a36e37..c2359a1ea6b3 100644
+--- a/drivers/edac/mce_amd.h
++++ b/drivers/edac/mce_amd.h
+@@ -32,9 +32,6 @@
+ #define R4(x) (((x) >> 4) & 0xf)
+ #define R4_MSG(x) ((R4(x) < 9) ? rrrr_msgs[R4(x)] : "Wrong R4!")
+
+-#define MCI_STATUS_DEFERRED BIT_64(44)
+-#define MCI_STATUS_POISON BIT_64(43)
+-
+ extern const char * const pp_msgs[];
+
+ enum tt_ids {
+diff --git a/drivers/firmware/dmi_scan.c b/drivers/firmware/dmi_scan.c
+index 17afc51f3054..35286fe52823 100644
+--- a/drivers/firmware/dmi_scan.c
++++ b/drivers/firmware/dmi_scan.c
+@@ -489,6 +489,10 @@ static int __init dmi_present(const u8 *buf)
+ buf += 16;
+
+ if (memcmp(buf, "_DMI_", 5) == 0 && dmi_checksum(buf, 15)) {
++ if (smbios_ver)
++ dmi_ver = smbios_ver;
++ else
++ dmi_ver = (buf[14] & 0xF0) << 4 | (buf[14] & 0x0F);
+ dmi_num = (buf[13] << 8) | buf[12];
+ dmi_len = (buf[7] << 8) | buf[6];
+ dmi_base = (buf[11] << 24) | (buf[10] << 16) |
+@@ -496,12 +500,9 @@ static int __init dmi_present(const u8 *buf)
+
+ if (dmi_walk_early(dmi_decode) == 0) {
+ if (smbios_ver) {
+- dmi_ver = smbios_ver;
+ pr_info("SMBIOS %d.%d present.\n",
+ dmi_ver >> 8, dmi_ver & 0xFF);
+ } else {
+- dmi_ver = (buf[14] & 0xF0) << 4 |
+- (buf[14] & 0x0F);
+ pr_info("Legacy DMI %d.%d present.\n",
+ dmi_ver >> 8, dmi_ver & 0xFF);
+ }
+diff --git a/drivers/gpio/gpio-kempld.c b/drivers/gpio/gpio-kempld.c
+index fd150adeebf9..86a60079d316 100644
+--- a/drivers/gpio/gpio-kempld.c
++++ b/drivers/gpio/gpio-kempld.c
+@@ -117,7 +117,7 @@ static int kempld_gpio_get_direction(struct gpio_chip *chip, unsigned offset)
+ = container_of(chip, struct kempld_gpio_data, chip);
+ struct kempld_device_data *pld = gpio->pld;
+
+- return kempld_gpio_get_bit(pld, KEMPLD_GPIO_DIR_NUM(offset), offset);
++ return !kempld_gpio_get_bit(pld, KEMPLD_GPIO_DIR_NUM(offset), offset);
+ }
+
+ static int kempld_gpio_pincount(struct kempld_device_data *pld)
+diff --git a/drivers/gpio/gpiolib-sysfs.c b/drivers/gpio/gpiolib-sysfs.c
+index aed7dd6e9dca..d9fa798560b2 100644
+--- a/drivers/gpio/gpiolib-sysfs.c
++++ b/drivers/gpio/gpiolib-sysfs.c
+@@ -519,6 +519,7 @@ static struct class gpio_class = {
+ */
+ int gpiod_export(struct gpio_desc *desc, bool direction_may_change)
+ {
++ struct gpio_chip *chip;
+ unsigned long flags;
+ int status;
+ const char *ioname = NULL;
+@@ -536,8 +537,16 @@ int gpiod_export(struct gpio_desc *desc, bool direction_may_change)
+ return -EINVAL;
+ }
+
++ chip = desc->chip;
++
+ mutex_lock(&sysfs_lock);
+
++ /* check if chip is being removed */
++ if (!chip || !chip->exported) {
++ status = -ENODEV;
++ goto fail_unlock;
++ }
++
+ spin_lock_irqsave(&gpio_lock, flags);
+ if (!test_bit(FLAG_REQUESTED, &desc->flags) ||
+ test_bit(FLAG_EXPORT, &desc->flags)) {
+@@ -766,12 +775,15 @@ void gpiochip_unexport(struct gpio_chip *chip)
+ {
+ int status;
+ struct device *dev;
++ struct gpio_desc *desc;
++ unsigned int i;
+
+ mutex_lock(&sysfs_lock);
+ dev = class_find_device(&gpio_class, NULL, chip, match_export);
+ if (dev) {
+ put_device(dev);
+ device_unregister(dev);
++ /* prevent further gpiod exports */
+ chip->exported = false;
+ status = 0;
+ } else
+@@ -780,6 +792,13 @@ void gpiochip_unexport(struct gpio_chip *chip)
+
+ if (status)
+ chip_dbg(chip, "%s: status %d\n", __func__, status);
++
++ /* unregister gpiod class devices owned by sysfs */
++ for (i = 0; i < chip->ngpio; i++) {
++ desc = &chip->desc[i];
++ if (test_and_clear_bit(FLAG_SYSFS, &desc->flags))
++ gpiod_free(desc);
++ }
+ }
+
+ static int __init gpiolib_sysfs_init(void)
+diff --git a/drivers/gpu/drm/drm_irq.c b/drivers/gpu/drm/drm_irq.c
+index c4edea907f8f..7d64d22486e9 100644
+--- a/drivers/gpu/drm/drm_irq.c
++++ b/drivers/gpu/drm/drm_irq.c
+@@ -131,12 +131,11 @@ static void drm_update_vblank_count(struct drm_device *dev, int crtc)
+
+ /* Reinitialize corresponding vblank timestamp if high-precision query
+ * available. Skip this step if query unsupported or failed. Will
+- * reinitialize delayed at next vblank interrupt in that case.
++ * reinitialize delayed at next vblank interrupt in that case and
++ * assign 0 for now, to mark the vblanktimestamp as invalid.
+ */
+- if (rc) {
+- tslot = atomic_read(&vblank->count) + diff;
+- vblanktimestamp(dev, crtc, tslot) = t_vblank;
+- }
++ tslot = atomic_read(&vblank->count) + diff;
++ vblanktimestamp(dev, crtc, tslot) = rc ? t_vblank : (struct timeval) {0, 0};
+
+ smp_mb__before_atomic();
+ atomic_add(diff, &vblank->count);
+diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
+index 740d9ebbebde..a29db0a1da42 100644
+--- a/drivers/gpu/drm/i915/intel_dp.c
++++ b/drivers/gpu/drm/i915/intel_dp.c
+@@ -1037,7 +1037,7 @@ intel_dp_compute_config(struct intel_encoder *encoder,
+
+ pipe_config->has_dp_encoder = true;
+ pipe_config->has_drrs = false;
+- pipe_config->has_audio = intel_dp->has_audio;
++ pipe_config->has_audio = intel_dp->has_audio && port != PORT_A;
+
+ if (is_edp(intel_dp) && intel_connector->panel.fixed_mode) {
+ intel_fixed_panel_mode(intel_connector->panel.fixed_mode,
+@@ -1879,8 +1879,8 @@ static void intel_dp_get_config(struct intel_encoder *encoder,
+ int dotclock;
+
+ tmp = I915_READ(intel_dp->output_reg);
+- if (tmp & DP_AUDIO_OUTPUT_ENABLE)
+- pipe_config->has_audio = true;
++
++ pipe_config->has_audio = tmp & DP_AUDIO_OUTPUT_ENABLE && port != PORT_A;
+
+ if ((port == PORT_A) || !HAS_PCH_CPT(dev)) {
+ if (tmp & DP_SYNC_HS_HIGH)
+diff --git a/drivers/gpu/drm/i915/intel_lvds.c b/drivers/gpu/drm/i915/intel_lvds.c
+index c0bbf2172446..b7e80bf190f8 100644
+--- a/drivers/gpu/drm/i915/intel_lvds.c
++++ b/drivers/gpu/drm/i915/intel_lvds.c
+@@ -809,12 +809,28 @@ static int intel_dual_link_lvds_callback(const struct dmi_system_id *id)
+ static const struct dmi_system_id intel_dual_link_lvds[] = {
+ {
+ .callback = intel_dual_link_lvds_callback,
+- .ident = "Apple MacBook Pro (Core i5/i7 Series)",
++ .ident = "Apple MacBook Pro 15\" (2010)",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro6,2"),
++ },
++ },
++ {
++ .callback = intel_dual_link_lvds_callback,
++ .ident = "Apple MacBook Pro 15\" (2011)",
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
+ DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro8,2"),
+ },
+ },
++ {
++ .callback = intel_dual_link_lvds_callback,
++ .ident = "Apple MacBook Pro 15\" (2012)",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro9,1"),
++ },
++ },
+ { } /* terminating entry */
+ };
+
+diff --git a/drivers/gpu/drm/radeon/atombios_crtc.c b/drivers/gpu/drm/radeon/atombios_crtc.c
+index 5d73e5f3845d..4f9ec36698f7 100644
+--- a/drivers/gpu/drm/radeon/atombios_crtc.c
++++ b/drivers/gpu/drm/radeon/atombios_crtc.c
+@@ -1789,7 +1789,9 @@ static int radeon_get_shared_nondp_ppll(struct drm_crtc *crtc)
+ if ((crtc->mode.clock == test_crtc->mode.clock) &&
+ (adjusted_clock == test_adjusted_clock) &&
+ (radeon_crtc->ss_enabled == test_radeon_crtc->ss_enabled) &&
+- (test_radeon_crtc->pll_id != ATOM_PPLL_INVALID))
++ (test_radeon_crtc->pll_id != ATOM_PPLL_INVALID) &&
++ (drm_detect_monitor_audio(radeon_connector_edid(test_radeon_crtc->connector)) ==
++ drm_detect_monitor_audio(radeon_connector_edid(radeon_crtc->connector))))
+ return test_radeon_crtc->pll_id;
+ }
+ }
+diff --git a/drivers/gpu/drm/radeon/atombios_dp.c b/drivers/gpu/drm/radeon/atombios_dp.c
+index 5bf825dfaa09..ceab25d54233 100644
+--- a/drivers/gpu/drm/radeon/atombios_dp.c
++++ b/drivers/gpu/drm/radeon/atombios_dp.c
+@@ -405,19 +405,21 @@ bool radeon_dp_getdpcd(struct radeon_connector *radeon_connector)
+ {
+ struct radeon_connector_atom_dig *dig_connector = radeon_connector->con_priv;
+ u8 msg[DP_DPCD_SIZE];
+- int ret;
++ int ret, i;
+
+- ret = drm_dp_dpcd_read(&radeon_connector->ddc_bus->aux, DP_DPCD_REV, msg,
+- DP_DPCD_SIZE);
+- if (ret > 0) {
+- memcpy(dig_connector->dpcd, msg, DP_DPCD_SIZE);
++ for (i = 0; i < 7; i++) {
++ ret = drm_dp_dpcd_read(&radeon_connector->ddc_bus->aux, DP_DPCD_REV, msg,
++ DP_DPCD_SIZE);
++ if (ret == DP_DPCD_SIZE) {
++ memcpy(dig_connector->dpcd, msg, DP_DPCD_SIZE);
+
+- DRM_DEBUG_KMS("DPCD: %*ph\n", (int)sizeof(dig_connector->dpcd),
+- dig_connector->dpcd);
++ DRM_DEBUG_KMS("DPCD: %*ph\n", (int)sizeof(dig_connector->dpcd),
++ dig_connector->dpcd);
+
+- radeon_dp_probe_oui(radeon_connector);
++ radeon_dp_probe_oui(radeon_connector);
+
+- return true;
++ return true;
++ }
+ }
+ dig_connector->dpcd[0] = 0;
+ return false;
+diff --git a/drivers/gpu/drm/radeon/cik.c b/drivers/gpu/drm/radeon/cik.c
+index 0c6fbc0198a5..63e8bff5d47a 100644
+--- a/drivers/gpu/drm/radeon/cik.c
++++ b/drivers/gpu/drm/radeon/cik.c
+@@ -5764,7 +5764,7 @@ static int cik_pcie_gart_enable(struct radeon_device *rdev)
+ /* restore context1-15 */
+ /* set vm size, must be a multiple of 4 */
+ WREG32(VM_CONTEXT1_PAGE_TABLE_START_ADDR, 0);
+- WREG32(VM_CONTEXT1_PAGE_TABLE_END_ADDR, rdev->vm_manager.max_pfn);
++ WREG32(VM_CONTEXT1_PAGE_TABLE_END_ADDR, rdev->vm_manager.max_pfn - 1);
+ for (i = 1; i < 16; i++) {
+ if (i < 8)
+ WREG32(VM_CONTEXT0_PAGE_TABLE_BASE_ADDR + (i << 2),
+diff --git a/drivers/gpu/drm/radeon/ni.c b/drivers/gpu/drm/radeon/ni.c
+index 8a83c917cf53..a019ba246e39 100644
+--- a/drivers/gpu/drm/radeon/ni.c
++++ b/drivers/gpu/drm/radeon/ni.c
+@@ -1269,7 +1269,8 @@ static int cayman_pcie_gart_enable(struct radeon_device *rdev)
+ */
+ for (i = 1; i < 8; i++) {
+ WREG32(VM_CONTEXT0_PAGE_TABLE_START_ADDR + (i << 2), 0);
+- WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR + (i << 2), rdev->vm_manager.max_pfn);
++ WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR + (i << 2),
++ rdev->vm_manager.max_pfn - 1);
+ WREG32(VM_CONTEXT0_PAGE_TABLE_BASE_ADDR + (i << 2),
+ rdev->vm_manager.saved_table_addr[i]);
+ }
+diff --git a/drivers/gpu/drm/radeon/radeon_asic.c b/drivers/gpu/drm/radeon/radeon_asic.c
+index ed0e10eee2dc..c34ceb8d3d27 100644
+--- a/drivers/gpu/drm/radeon/radeon_asic.c
++++ b/drivers/gpu/drm/radeon/radeon_asic.c
+@@ -1190,7 +1190,7 @@ static struct radeon_asic rs780_asic = {
+ static struct radeon_asic_ring rv770_uvd_ring = {
+ .ib_execute = &uvd_v1_0_ib_execute,
+ .emit_fence = &uvd_v2_2_fence_emit,
+- .emit_semaphore = &uvd_v1_0_semaphore_emit,
++ .emit_semaphore = &uvd_v2_2_semaphore_emit,
+ .cs_parse = &radeon_uvd_cs_parse,
+ .ring_test = &uvd_v1_0_ring_test,
+ .ib_test = &uvd_v1_0_ib_test,
+diff --git a/drivers/gpu/drm/radeon/radeon_asic.h b/drivers/gpu/drm/radeon/radeon_asic.h
+index 0c1da2bf1fb4..6dd68f663181 100644
+--- a/drivers/gpu/drm/radeon/radeon_asic.h
++++ b/drivers/gpu/drm/radeon/radeon_asic.h
+@@ -908,6 +908,10 @@ void uvd_v1_0_ib_execute(struct radeon_device *rdev, struct radeon_ib *ib);
+ int uvd_v2_2_resume(struct radeon_device *rdev);
+ void uvd_v2_2_fence_emit(struct radeon_device *rdev,
+ struct radeon_fence *fence);
++bool uvd_v2_2_semaphore_emit(struct radeon_device *rdev,
++ struct radeon_ring *ring,
++ struct radeon_semaphore *semaphore,
++ bool emit_wait);
+
+ /* uvd v3.1 */
+ bool uvd_v3_1_semaphore_emit(struct radeon_device *rdev,
+diff --git a/drivers/gpu/drm/radeon/radeon_ttm.c b/drivers/gpu/drm/radeon/radeon_ttm.c
+index 9ab8e2694602..13f69472e716 100644
+--- a/drivers/gpu/drm/radeon/radeon_ttm.c
++++ b/drivers/gpu/drm/radeon/radeon_ttm.c
+@@ -568,8 +568,7 @@ static void radeon_ttm_tt_unpin_userptr(struct ttm_tt *ttm)
+ {
+ struct radeon_device *rdev = radeon_get_rdev(ttm->bdev);
+ struct radeon_ttm_tt *gtt = (void *)ttm;
+- struct scatterlist *sg;
+- int i;
++ struct sg_page_iter sg_iter;
+
+ int write = !(gtt->userflags & RADEON_GEM_USERPTR_READONLY);
+ enum dma_data_direction direction = write ?
+@@ -582,9 +581,8 @@ static void radeon_ttm_tt_unpin_userptr(struct ttm_tt *ttm)
+ /* free the sg table and pages again */
+ dma_unmap_sg(rdev->dev, ttm->sg->sgl, ttm->sg->nents, direction);
+
+- for_each_sg(ttm->sg->sgl, sg, ttm->sg->nents, i) {
+- struct page *page = sg_page(sg);
+-
++ for_each_sg_page(ttm->sg->sgl, &sg_iter, ttm->sg->nents, 0) {
++ struct page *page = sg_page_iter_page(&sg_iter);
+ if (!(gtt->userflags & RADEON_GEM_USERPTR_READONLY))
+ set_page_dirty(page);
+
+diff --git a/drivers/gpu/drm/radeon/radeon_uvd.c b/drivers/gpu/drm/radeon/radeon_uvd.c
+index 11b662469253..db6536f722f2 100644
+--- a/drivers/gpu/drm/radeon/radeon_uvd.c
++++ b/drivers/gpu/drm/radeon/radeon_uvd.c
+@@ -396,6 +396,29 @@ static int radeon_uvd_cs_msg_decode(uint32_t *msg, unsigned buf_sizes[])
+ return 0;
+ }
+
++static int radeon_uvd_validate_codec(struct radeon_cs_parser *p,
++ unsigned stream_type)
++{
++ switch (stream_type) {
++ case 0: /* H264 */
++ case 1: /* VC1 */
++ /* always supported */
++ return 0;
++
++ case 3: /* MPEG2 */
++ case 4: /* MPEG4 */
++ /* only since UVD 3 */
++ if (p->rdev->family >= CHIP_PALM)
++ return 0;
++
++ /* fall through */
++ default:
++ DRM_ERROR("UVD codec not supported by hardware %d!\n",
++ stream_type);
++ return -EINVAL;
++ }
++}
++
+ static int radeon_uvd_cs_msg(struct radeon_cs_parser *p, struct radeon_bo *bo,
+ unsigned offset, unsigned buf_sizes[])
+ {
+@@ -436,50 +459,70 @@ static int radeon_uvd_cs_msg(struct radeon_cs_parser *p, struct radeon_bo *bo,
+ return -EINVAL;
+ }
+
+- if (msg_type == 1) {
+- /* it's a decode msg, calc buffer sizes */
+- r = radeon_uvd_cs_msg_decode(msg, buf_sizes);
+- /* calc image size (width * height) */
+- img_size = msg[6] * msg[7];
++ switch (msg_type) {
++ case 0:
++ /* it's a create msg, calc image size (width * height) */
++ img_size = msg[7] * msg[8];
++
++ r = radeon_uvd_validate_codec(p, msg[4]);
++ radeon_bo_kunmap(bo);
++ if (r)
++ return r;
++
++ /* try to alloc a new handle */
++ for (i = 0; i < RADEON_MAX_UVD_HANDLES; ++i) {
++ if (atomic_read(&p->rdev->uvd.handles[i]) == handle) {
++ DRM_ERROR("Handle 0x%x already in use!\n", handle);
++ return -EINVAL;
++ }
++
++ if (!atomic_cmpxchg(&p->rdev->uvd.handles[i], 0, handle)) {
++ p->rdev->uvd.filp[i] = p->filp;
++ p->rdev->uvd.img_size[i] = img_size;
++ return 0;
++ }
++ }
++
++ DRM_ERROR("No more free UVD handles!\n");
++ return -EINVAL;
++
++ case 1:
++ /* it's a decode msg, validate codec and calc buffer sizes */
++ r = radeon_uvd_validate_codec(p, msg[4]);
++ if (!r)
++ r = radeon_uvd_cs_msg_decode(msg, buf_sizes);
+ radeon_bo_kunmap(bo);
+ if (r)
+ return r;
+
+- } else if (msg_type == 2) {
++ /* validate the handle */
++ for (i = 0; i < RADEON_MAX_UVD_HANDLES; ++i) {
++ if (atomic_read(&p->rdev->uvd.handles[i]) == handle) {
++ if (p->rdev->uvd.filp[i] != p->filp) {
++ DRM_ERROR("UVD handle collision detected!\n");
++ return -EINVAL;
++ }
++ return 0;
++ }
++ }
++
++ DRM_ERROR("Invalid UVD handle 0x%x!\n", handle);
++ return -ENOENT;
++
++ case 2:
+ /* it's a destroy msg, free the handle */
+ for (i = 0; i < RADEON_MAX_UVD_HANDLES; ++i)
+ atomic_cmpxchg(&p->rdev->uvd.handles[i], handle, 0);
+ radeon_bo_kunmap(bo);
+ return 0;
+- } else {
+- /* it's a create msg, calc image size (width * height) */
+- img_size = msg[7] * msg[8];
+- radeon_bo_kunmap(bo);
+
+- if (msg_type != 0) {
+- DRM_ERROR("Illegal UVD message type (%d)!\n", msg_type);
+- return -EINVAL;
+- }
+-
+- /* it's a create msg, no special handling needed */
+- }
+-
+- /* create or decode, validate the handle */
+- for (i = 0; i < RADEON_MAX_UVD_HANDLES; ++i) {
+- if (atomic_read(&p->rdev->uvd.handles[i]) == handle)
+- return 0;
+- }
++ default:
+
+- /* handle not found try to alloc a new one */
+- for (i = 0; i < RADEON_MAX_UVD_HANDLES; ++i) {
+- if (!atomic_cmpxchg(&p->rdev->uvd.handles[i], 0, handle)) {
+- p->rdev->uvd.filp[i] = p->filp;
+- p->rdev->uvd.img_size[i] = img_size;
+- return 0;
+- }
++ DRM_ERROR("Illegal UVD message type (%d)!\n", msg_type);
++ return -EINVAL;
+ }
+
+- DRM_ERROR("No more free UVD handles!\n");
++ BUG();
+ return -EINVAL;
+ }
+
+diff --git a/drivers/gpu/drm/radeon/radeon_vce.c b/drivers/gpu/drm/radeon/radeon_vce.c
+index 9e85757d5599..1c0022a49486 100644
+--- a/drivers/gpu/drm/radeon/radeon_vce.c
++++ b/drivers/gpu/drm/radeon/radeon_vce.c
+@@ -493,18 +493,27 @@ int radeon_vce_cs_reloc(struct radeon_cs_parser *p, int lo, int hi,
+ *
+ * @p: parser context
+ * @handle: handle to validate
++ * @allocated: allocated a new handle?
+ *
+ * Validates the handle and return the found session index or -EINVAL
+ * we we don't have another free session index.
+ */
+-int radeon_vce_validate_handle(struct radeon_cs_parser *p, uint32_t handle)
++static int radeon_vce_validate_handle(struct radeon_cs_parser *p,
++ uint32_t handle, bool *allocated)
+ {
+ unsigned i;
+
++ *allocated = false;
++
+ /* validate the handle */
+ for (i = 0; i < RADEON_MAX_VCE_HANDLES; ++i) {
+- if (atomic_read(&p->rdev->vce.handles[i]) == handle)
++ if (atomic_read(&p->rdev->vce.handles[i]) == handle) {
++ if (p->rdev->vce.filp[i] != p->filp) {
++ DRM_ERROR("VCE handle collision detected!\n");
++ return -EINVAL;
++ }
+ return i;
++ }
+ }
+
+ /* handle not found try to alloc a new one */
+@@ -512,6 +521,7 @@ int radeon_vce_validate_handle(struct radeon_cs_parser *p, uint32_t handle)
+ if (!atomic_cmpxchg(&p->rdev->vce.handles[i], 0, handle)) {
+ p->rdev->vce.filp[i] = p->filp;
+ p->rdev->vce.img_size[i] = 0;
++ *allocated = true;
+ return i;
+ }
+ }
+@@ -529,10 +539,10 @@ int radeon_vce_validate_handle(struct radeon_cs_parser *p, uint32_t handle)
+ int radeon_vce_cs_parse(struct radeon_cs_parser *p)
+ {
+ int session_idx = -1;
+- bool destroyed = false;
++ bool destroyed = false, created = false, allocated = false;
+ uint32_t tmp, handle = 0;
+ uint32_t *size = &tmp;
+- int i, r;
++ int i, r = 0;
+
+ while (p->idx < p->chunks[p->chunk_ib_idx].length_dw) {
+ uint32_t len = radeon_get_ib_value(p, p->idx);
+@@ -540,18 +550,21 @@ int radeon_vce_cs_parse(struct radeon_cs_parser *p)
+
+ if ((len < 8) || (len & 3)) {
+ DRM_ERROR("invalid VCE command length (%d)!\n", len);
+- return -EINVAL;
++ r = -EINVAL;
++ goto out;
+ }
+
+ if (destroyed) {
+ DRM_ERROR("No other command allowed after destroy!\n");
+- return -EINVAL;
++ r = -EINVAL;
++ goto out;
+ }
+
+ switch (cmd) {
+ case 0x00000001: // session
+ handle = radeon_get_ib_value(p, p->idx + 2);
+- session_idx = radeon_vce_validate_handle(p, handle);
++ session_idx = radeon_vce_validate_handle(p, handle,
++ &allocated);
+ if (session_idx < 0)
+ return session_idx;
+ size = &p->rdev->vce.img_size[session_idx];
+@@ -561,6 +574,13 @@ int radeon_vce_cs_parse(struct radeon_cs_parser *p)
+ break;
+
+ case 0x01000001: // create
++ created = true;
++ if (!allocated) {
++ DRM_ERROR("Handle already in use!\n");
++ r = -EINVAL;
++ goto out;
++ }
++
+ *size = radeon_get_ib_value(p, p->idx + 8) *
+ radeon_get_ib_value(p, p->idx + 10) *
+ 8 * 3 / 2;
+@@ -577,12 +597,12 @@ int radeon_vce_cs_parse(struct radeon_cs_parser *p)
+ r = radeon_vce_cs_reloc(p, p->idx + 10, p->idx + 9,
+ *size);
+ if (r)
+- return r;
++ goto out;
+
+ r = radeon_vce_cs_reloc(p, p->idx + 12, p->idx + 11,
+ *size / 3);
+ if (r)
+- return r;
++ goto out;
+ break;
+
+ case 0x02000001: // destroy
+@@ -593,7 +613,7 @@ int radeon_vce_cs_parse(struct radeon_cs_parser *p)
+ r = radeon_vce_cs_reloc(p, p->idx + 3, p->idx + 2,
+ *size * 2);
+ if (r)
+- return r;
++ goto out;
+ break;
+
+ case 0x05000004: // video bitstream buffer
+@@ -601,36 +621,47 @@ int radeon_vce_cs_parse(struct radeon_cs_parser *p)
+ r = radeon_vce_cs_reloc(p, p->idx + 3, p->idx + 2,
+ tmp);
+ if (r)
+- return r;
++ goto out;
+ break;
+
+ case 0x05000005: // feedback buffer
+ r = radeon_vce_cs_reloc(p, p->idx + 3, p->idx + 2,
+ 4096);
+ if (r)
+- return r;
++ goto out;
+ break;
+
+ default:
+ DRM_ERROR("invalid VCE command (0x%x)!\n", cmd);
+- return -EINVAL;
++ r = -EINVAL;
++ goto out;
+ }
+
+ if (session_idx == -1) {
+ DRM_ERROR("no session command at start of IB\n");
+- return -EINVAL;
++ r = -EINVAL;
++ goto out;
+ }
+
+ p->idx += len / 4;
+ }
+
+- if (destroyed) {
+- /* IB contains a destroy msg, free the handle */
++ if (allocated && !created) {
++ DRM_ERROR("New session without create command!\n");
++ r = -ENOENT;
++ }
++
++out:
++ if ((!r && destroyed) || (r && allocated)) {
++ /*
++ * IB contains a destroy msg or we have allocated an
++ * handle and got an error, anyway free the handle
++ */
+ for (i = 0; i < RADEON_MAX_VCE_HANDLES; ++i)
+ atomic_cmpxchg(&p->rdev->vce.handles[i], handle, 0);
+ }
+
+- return 0;
++ return r;
+ }
+
+ /**
+diff --git a/drivers/gpu/drm/radeon/rv770d.h b/drivers/gpu/drm/radeon/rv770d.h
+index 3cf1e2921545..9ef2064b1c9c 100644
+--- a/drivers/gpu/drm/radeon/rv770d.h
++++ b/drivers/gpu/drm/radeon/rv770d.h
+@@ -989,6 +989,9 @@
+ ((n) & 0x3FFF) << 16)
+
+ /* UVD */
++#define UVD_SEMA_ADDR_LOW 0xef00
++#define UVD_SEMA_ADDR_HIGH 0xef04
++#define UVD_SEMA_CMD 0xef08
+ #define UVD_GPCOM_VCPU_CMD 0xef0c
+ #define UVD_GPCOM_VCPU_DATA0 0xef10
+ #define UVD_GPCOM_VCPU_DATA1 0xef14
+diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c
+index 1c3d90c17cb3..3ad2e07fb48e 100644
+--- a/drivers/gpu/drm/radeon/si.c
++++ b/drivers/gpu/drm/radeon/si.c
+@@ -4285,7 +4285,7 @@ static int si_pcie_gart_enable(struct radeon_device *rdev)
+ /* empty context1-15 */
+ /* set vm size, must be a multiple of 4 */
+ WREG32(VM_CONTEXT1_PAGE_TABLE_START_ADDR, 0);
+- WREG32(VM_CONTEXT1_PAGE_TABLE_END_ADDR, rdev->vm_manager.max_pfn);
++ WREG32(VM_CONTEXT1_PAGE_TABLE_END_ADDR, rdev->vm_manager.max_pfn - 1);
+ /* Assign the pt base to something valid for now; the pts used for
+ * the VMs are determined by the application and setup and assigned
+ * on the fly in the vm part of radeon_gart.c
+diff --git a/drivers/gpu/drm/radeon/uvd_v1_0.c b/drivers/gpu/drm/radeon/uvd_v1_0.c
+index e72b3cb59358..c6b1cbca47fc 100644
+--- a/drivers/gpu/drm/radeon/uvd_v1_0.c
++++ b/drivers/gpu/drm/radeon/uvd_v1_0.c
+@@ -466,18 +466,8 @@ bool uvd_v1_0_semaphore_emit(struct radeon_device *rdev,
+ struct radeon_semaphore *semaphore,
+ bool emit_wait)
+ {
+- uint64_t addr = semaphore->gpu_addr;
+-
+- radeon_ring_write(ring, PACKET0(UVD_SEMA_ADDR_LOW, 0));
+- radeon_ring_write(ring, (addr >> 3) & 0x000FFFFF);
+-
+- radeon_ring_write(ring, PACKET0(UVD_SEMA_ADDR_HIGH, 0));
+- radeon_ring_write(ring, (addr >> 23) & 0x000FFFFF);
+-
+- radeon_ring_write(ring, PACKET0(UVD_SEMA_CMD, 0));
+- radeon_ring_write(ring, emit_wait ? 1 : 0);
+-
+- return true;
++ /* disable semaphores for UVD V1 hardware */
++ return false;
+ }
+
+ /**
+diff --git a/drivers/gpu/drm/radeon/uvd_v2_2.c b/drivers/gpu/drm/radeon/uvd_v2_2.c
+index 89193519f8a1..7ed778cec7c6 100644
+--- a/drivers/gpu/drm/radeon/uvd_v2_2.c
++++ b/drivers/gpu/drm/radeon/uvd_v2_2.c
+@@ -60,6 +60,35 @@ void uvd_v2_2_fence_emit(struct radeon_device *rdev,
+ }
+
+ /**
++ * uvd_v2_2_semaphore_emit - emit semaphore command
++ *
++ * @rdev: radeon_device pointer
++ * @ring: radeon_ring pointer
++ * @semaphore: semaphore to emit commands for
++ * @emit_wait: true if we should emit a wait command
++ *
++ * Emit a semaphore command (either wait or signal) to the UVD ring.
++ */
++bool uvd_v2_2_semaphore_emit(struct radeon_device *rdev,
++ struct radeon_ring *ring,
++ struct radeon_semaphore *semaphore,
++ bool emit_wait)
++{
++ uint64_t addr = semaphore->gpu_addr;
++
++ radeon_ring_write(ring, PACKET0(UVD_SEMA_ADDR_LOW, 0));
++ radeon_ring_write(ring, (addr >> 3) & 0x000FFFFF);
++
++ radeon_ring_write(ring, PACKET0(UVD_SEMA_ADDR_HIGH, 0));
++ radeon_ring_write(ring, (addr >> 23) & 0x000FFFFF);
++
++ radeon_ring_write(ring, PACKET0(UVD_SEMA_CMD, 0));
++ radeon_ring_write(ring, emit_wait ? 1 : 0);
++
++ return true;
++}
++
++/**
+ * uvd_v2_2_resume - memory controller programming
+ *
+ * @rdev: radeon_device pointer
+diff --git a/drivers/hwmon/nct6683.c b/drivers/hwmon/nct6683.c
+index 7710f4694ba1..718953bb657f 100644
+--- a/drivers/hwmon/nct6683.c
++++ b/drivers/hwmon/nct6683.c
+@@ -439,6 +439,7 @@ nct6683_create_attr_group(struct device *dev, struct sensor_template_group *tg,
+ (*t)->dev_attr.attr.name, tg->base + i);
+ if ((*t)->s2) {
+ a2 = &su->u.a2;
++ sysfs_attr_init(&a2->dev_attr.attr);
+ a2->dev_attr.attr.name = su->name;
+ a2->nr = (*t)->u.s.nr + i;
+ a2->index = (*t)->u.s.index;
+@@ -449,6 +450,7 @@ nct6683_create_attr_group(struct device *dev, struct sensor_template_group *tg,
+ *attrs = &a2->dev_attr.attr;
+ } else {
+ a = &su->u.a1;
++ sysfs_attr_init(&a->dev_attr.attr);
+ a->dev_attr.attr.name = su->name;
+ a->index = (*t)->u.index + i;
+ a->dev_attr.attr.mode =
+diff --git a/drivers/hwmon/nct6775.c b/drivers/hwmon/nct6775.c
+index 504cbddbdd90..6461964f49a8 100644
+--- a/drivers/hwmon/nct6775.c
++++ b/drivers/hwmon/nct6775.c
+@@ -985,6 +985,7 @@ nct6775_create_attr_group(struct device *dev, struct sensor_template_group *tg,
+ (*t)->dev_attr.attr.name, tg->base + i);
+ if ((*t)->s2) {
+ a2 = &su->u.a2;
++ sysfs_attr_init(&a2->dev_attr.attr);
+ a2->dev_attr.attr.name = su->name;
+ a2->nr = (*t)->u.s.nr + i;
+ a2->index = (*t)->u.s.index;
+@@ -995,6 +996,7 @@ nct6775_create_attr_group(struct device *dev, struct sensor_template_group *tg,
+ *attrs = &a2->dev_attr.attr;
+ } else {
+ a = &su->u.a1;
++ sysfs_attr_init(&a->dev_attr.attr);
+ a->dev_attr.attr.name = su->name;
+ a->index = (*t)->u.index + i;
+ a->dev_attr.attr.mode =
+diff --git a/drivers/hwmon/ntc_thermistor.c b/drivers/hwmon/ntc_thermistor.c
+index 4ff89b2482e4..31597c504879 100644
+--- a/drivers/hwmon/ntc_thermistor.c
++++ b/drivers/hwmon/ntc_thermistor.c
+@@ -239,8 +239,10 @@ static struct ntc_thermistor_platform_data *
+ ntc_thermistor_parse_dt(struct platform_device *pdev)
+ {
+ struct iio_channel *chan;
++ enum iio_chan_type type;
+ struct device_node *np = pdev->dev.of_node;
+ struct ntc_thermistor_platform_data *pdata;
++ int ret;
+
+ if (!np)
+ return NULL;
+@@ -253,6 +255,13 @@ ntc_thermistor_parse_dt(struct platform_device *pdev)
+ if (IS_ERR(chan))
+ return ERR_CAST(chan);
+
++ ret = iio_get_channel_type(chan, &type);
++ if (ret < 0)
++ return ERR_PTR(ret);
++
++ if (type != IIO_VOLTAGE)
++ return ERR_PTR(-EINVAL);
++
+ if (of_property_read_u32(np, "pullup-uv", &pdata->pullup_uv))
+ return ERR_PTR(-ENODEV);
+ if (of_property_read_u32(np, "pullup-ohm", &pdata->pullup_ohm))
+diff --git a/drivers/iio/adc/xilinx-xadc-core.c b/drivers/iio/adc/xilinx-xadc-core.c
+index a221f7329b79..ce93bd8e3f68 100644
+--- a/drivers/iio/adc/xilinx-xadc-core.c
++++ b/drivers/iio/adc/xilinx-xadc-core.c
+@@ -856,6 +856,7 @@ static int xadc_read_raw(struct iio_dev *indio_dev,
+ switch (chan->address) {
+ case XADC_REG_VCCINT:
+ case XADC_REG_VCCAUX:
++ case XADC_REG_VREFP:
+ case XADC_REG_VCCBRAM:
+ case XADC_REG_VCCPINT:
+ case XADC_REG_VCCPAUX:
+@@ -996,7 +997,7 @@ static const struct iio_event_spec xadc_voltage_events[] = {
+ .num_event_specs = (_alarm) ? ARRAY_SIZE(xadc_voltage_events) : 0, \
+ .scan_index = (_scan_index), \
+ .scan_type = { \
+- .sign = 'u', \
++ .sign = ((_addr) == XADC_REG_VREFN) ? 's' : 'u', \
+ .realbits = 12, \
+ .storagebits = 16, \
+ .shift = 4, \
+@@ -1008,7 +1009,7 @@ static const struct iio_event_spec xadc_voltage_events[] = {
+ static const struct iio_chan_spec xadc_channels[] = {
+ XADC_CHAN_TEMP(0, 8, XADC_REG_TEMP),
+ XADC_CHAN_VOLTAGE(0, 9, XADC_REG_VCCINT, "vccint", true),
+- XADC_CHAN_VOLTAGE(1, 10, XADC_REG_VCCINT, "vccaux", true),
++ XADC_CHAN_VOLTAGE(1, 10, XADC_REG_VCCAUX, "vccaux", true),
+ XADC_CHAN_VOLTAGE(2, 14, XADC_REG_VCCBRAM, "vccbram", true),
+ XADC_CHAN_VOLTAGE(3, 5, XADC_REG_VCCPINT, "vccpint", true),
+ XADC_CHAN_VOLTAGE(4, 6, XADC_REG_VCCPAUX, "vccpaux", true),
+diff --git a/drivers/iio/adc/xilinx-xadc.h b/drivers/iio/adc/xilinx-xadc.h
+index c7487e8d7f80..54adc5087210 100644
+--- a/drivers/iio/adc/xilinx-xadc.h
++++ b/drivers/iio/adc/xilinx-xadc.h
+@@ -145,9 +145,9 @@ static inline int xadc_write_adc_reg(struct xadc *xadc, unsigned int reg,
+ #define XADC_REG_MAX_VCCPINT 0x28
+ #define XADC_REG_MAX_VCCPAUX 0x29
+ #define XADC_REG_MAX_VCCO_DDR 0x2a
+-#define XADC_REG_MIN_VCCPINT 0x2b
+-#define XADC_REG_MIN_VCCPAUX 0x2c
+-#define XADC_REG_MIN_VCCO_DDR 0x2d
++#define XADC_REG_MIN_VCCPINT 0x2c
++#define XADC_REG_MIN_VCCPAUX 0x2d
++#define XADC_REG_MIN_VCCO_DDR 0x2e
+
+ #define XADC_REG_CONF0 0x40
+ #define XADC_REG_CONF1 0x41
+diff --git a/drivers/iio/light/hid-sensor-prox.c b/drivers/iio/light/hid-sensor-prox.c
+index f5a514698fd8..d403c988463c 100644
+--- a/drivers/iio/light/hid-sensor-prox.c
++++ b/drivers/iio/light/hid-sensor-prox.c
+@@ -43,8 +43,6 @@ struct prox_state {
+ static const struct iio_chan_spec prox_channels[] = {
+ {
+ .type = IIO_PROXIMITY,
+- .modified = 1,
+- .channel2 = IIO_NO_MOD,
+ .info_mask_separate = BIT(IIO_CHAN_INFO_RAW),
+ .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_OFFSET) |
+ BIT(IIO_CHAN_INFO_SCALE) |
+diff --git a/drivers/iio/pressure/hid-sensor-press.c b/drivers/iio/pressure/hid-sensor-press.c
+index 764928682df2..127db532f35c 100644
+--- a/drivers/iio/pressure/hid-sensor-press.c
++++ b/drivers/iio/pressure/hid-sensor-press.c
+@@ -47,8 +47,6 @@ struct press_state {
+ static const struct iio_chan_spec press_channels[] = {
+ {
+ .type = IIO_PRESSURE,
+- .modified = 1,
+- .channel2 = IIO_NO_MOD,
+ .info_mask_separate = BIT(IIO_CHAN_INFO_RAW),
+ .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_OFFSET) |
+ BIT(IIO_CHAN_INFO_SCALE) |
+diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
+index d570030d899c..06441a43c3aa 100644
+--- a/drivers/infiniband/core/cma.c
++++ b/drivers/infiniband/core/cma.c
+@@ -859,19 +859,27 @@ static void cma_save_ib_info(struct rdma_cm_id *id, struct rdma_cm_id *listen_id
+ memcpy(&ib->sib_addr, &path->dgid, 16);
+ }
+
++static __be16 ss_get_port(const struct sockaddr_storage *ss)
++{
++ if (ss->ss_family == AF_INET)
++ return ((struct sockaddr_in *)ss)->sin_port;
++ else if (ss->ss_family == AF_INET6)
++ return ((struct sockaddr_in6 *)ss)->sin6_port;
++ BUG();
++}
++
+ static void cma_save_ip4_info(struct rdma_cm_id *id, struct rdma_cm_id *listen_id,
+ struct cma_hdr *hdr)
+ {
+- struct sockaddr_in *listen4, *ip4;
++ struct sockaddr_in *ip4;
+
+- listen4 = (struct sockaddr_in *) &listen_id->route.addr.src_addr;
+ ip4 = (struct sockaddr_in *) &id->route.addr.src_addr;
+- ip4->sin_family = listen4->sin_family;
++ ip4->sin_family = AF_INET;
+ ip4->sin_addr.s_addr = hdr->dst_addr.ip4.addr;
+- ip4->sin_port = listen4->sin_port;
++ ip4->sin_port = ss_get_port(&listen_id->route.addr.src_addr);
+
+ ip4 = (struct sockaddr_in *) &id->route.addr.dst_addr;
+- ip4->sin_family = listen4->sin_family;
++ ip4->sin_family = AF_INET;
+ ip4->sin_addr.s_addr = hdr->src_addr.ip4.addr;
+ ip4->sin_port = hdr->port;
+ }
+@@ -879,16 +887,15 @@ static void cma_save_ip4_info(struct rdma_cm_id *id, struct rdma_cm_id *listen_i
+ static void cma_save_ip6_info(struct rdma_cm_id *id, struct rdma_cm_id *listen_id,
+ struct cma_hdr *hdr)
+ {
+- struct sockaddr_in6 *listen6, *ip6;
++ struct sockaddr_in6 *ip6;
+
+- listen6 = (struct sockaddr_in6 *) &listen_id->route.addr.src_addr;
+ ip6 = (struct sockaddr_in6 *) &id->route.addr.src_addr;
+- ip6->sin6_family = listen6->sin6_family;
++ ip6->sin6_family = AF_INET6;
+ ip6->sin6_addr = hdr->dst_addr.ip6;
+- ip6->sin6_port = listen6->sin6_port;
++ ip6->sin6_port = ss_get_port(&listen_id->route.addr.src_addr);
+
+ ip6 = (struct sockaddr_in6 *) &id->route.addr.dst_addr;
+- ip6->sin6_family = listen6->sin6_family;
++ ip6->sin6_family = AF_INET6;
+ ip6->sin6_addr = hdr->src_addr.ip6;
+ ip6->sin6_port = hdr->port;
+ }
+diff --git a/drivers/infiniband/core/iwpm_msg.c b/drivers/infiniband/core/iwpm_msg.c
+index b85ddbc979e0..e5558b2660f2 100644
+--- a/drivers/infiniband/core/iwpm_msg.c
++++ b/drivers/infiniband/core/iwpm_msg.c
+@@ -33,7 +33,7 @@
+
+ #include "iwpm_util.h"
+
+-static const char iwpm_ulib_name[] = "iWarpPortMapperUser";
++static const char iwpm_ulib_name[IWPM_ULIBNAME_SIZE] = "iWarpPortMapperUser";
+ static int iwpm_ulib_version = 3;
+ static int iwpm_user_pid = IWPM_PID_UNDEFINED;
+ static atomic_t echo_nlmsg_seq;
+diff --git a/drivers/lguest/core.c b/drivers/lguest/core.c
+index 6590558d1d31..ed70f1e72b24 100644
+--- a/drivers/lguest/core.c
++++ b/drivers/lguest/core.c
+@@ -173,7 +173,7 @@ static void unmap_switcher(void)
+ bool lguest_address_ok(const struct lguest *lg,
+ unsigned long addr, unsigned long len)
+ {
+- return (addr+len) / PAGE_SIZE < lg->pfn_limit && (addr+len >= addr);
++ return addr+len <= lg->pfn_limit * PAGE_SIZE && (addr+len >= addr);
+ }
+
+ /*
+diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c
+index a9f2266049af..08981be7baa1 100644
+--- a/drivers/md/dm-crypt.c
++++ b/drivers/md/dm-crypt.c
+@@ -920,10 +920,11 @@ static int crypt_convert(struct crypt_config *cc,
+
+ switch (r) {
+ /* async */
+- case -EINPROGRESS:
+ case -EBUSY:
+ wait_for_completion(&ctx->restart);
+ reinit_completion(&ctx->restart);
++ /* fall through*/
++ case -EINPROGRESS:
+ ctx->req = NULL;
+ ctx->cc_sector++;
+ continue;
+@@ -1314,8 +1315,10 @@ static void kcryptd_async_done(struct crypto_async_request *async_req,
+ struct dm_crypt_io *io = container_of(ctx, struct dm_crypt_io, ctx);
+ struct crypt_config *cc = io->cc;
+
+- if (error == -EINPROGRESS)
++ if (error == -EINPROGRESS) {
++ complete(&ctx->restart);
+ return;
++ }
+
+ if (!error && cc->iv_gen_ops && cc->iv_gen_ops->post)
+ error = cc->iv_gen_ops->post(cc, iv_of_dmreq(cc, dmreq), dmreq);
+@@ -1326,15 +1329,12 @@ static void kcryptd_async_done(struct crypto_async_request *async_req,
+ crypt_free_req(cc, req_of_dmreq(cc, dmreq), io->base_bio);
+
+ if (!atomic_dec_and_test(&ctx->cc_pending))
+- goto done;
++ return;
+
+ if (bio_data_dir(io->base_bio) == READ)
+ kcryptd_crypt_read_done(io);
+ else
+ kcryptd_crypt_write_io_submit(io, 1);
+-done:
+- if (!completion_done(&ctx->restart))
+- complete(&ctx->restart);
+ }
+
+ static void kcryptd_crypt(struct work_struct *work)
+diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
+index 8577cc7db47e..e421016bab77 100644
+--- a/drivers/md/raid5.c
++++ b/drivers/md/raid5.c
+@@ -1936,7 +1936,8 @@ static int resize_stripes(struct r5conf *conf, int newsize)
+
+ conf->slab_cache = sc;
+ conf->active_name = 1-conf->active_name;
+- conf->pool_size = newsize;
++ if (!err)
++ conf->pool_size = newsize;
+ return err;
+ }
+
+diff --git a/drivers/mmc/card/block.c b/drivers/mmc/card/block.c
+index a11451f4f408..a19a18f0058a 100644
+--- a/drivers/mmc/card/block.c
++++ b/drivers/mmc/card/block.c
+@@ -1025,6 +1025,18 @@ static inline void mmc_blk_reset_success(struct mmc_blk_data *md, int type)
+ md->reset_done &= ~type;
+ }
+
++int mmc_access_rpmb(struct mmc_queue *mq)
++{
++ struct mmc_blk_data *md = mq->data;
++ /*
++ * If this is a RPMB partition access, return ture
++ */
++ if (md && md->part_type == EXT_CSD_PART_CONFIG_ACC_RPMB)
++ return true;
++
++ return false;
++}
++
+ static int mmc_blk_issue_discard_rq(struct mmc_queue *mq, struct request *req)
+ {
+ struct mmc_blk_data *md = mq->data;
+diff --git a/drivers/mmc/card/queue.c b/drivers/mmc/card/queue.c
+index cfa6110632c3..7a41a221d248 100644
+--- a/drivers/mmc/card/queue.c
++++ b/drivers/mmc/card/queue.c
+@@ -38,7 +38,7 @@ static int mmc_prep_request(struct request_queue *q, struct request *req)
+ return BLKPREP_KILL;
+ }
+
+- if (mq && mmc_card_removed(mq->card))
++ if (mq && (mmc_card_removed(mq->card) || mmc_access_rpmb(mq)))
+ return BLKPREP_KILL;
+
+ req->cmd_flags |= REQ_DONTPREP;
+diff --git a/drivers/mmc/card/queue.h b/drivers/mmc/card/queue.h
+index 5752d50049a3..99e6521e6169 100644
+--- a/drivers/mmc/card/queue.h
++++ b/drivers/mmc/card/queue.h
+@@ -73,4 +73,6 @@ extern void mmc_queue_bounce_post(struct mmc_queue_req *);
+ extern int mmc_packed_init(struct mmc_queue *, struct mmc_card *);
+ extern void mmc_packed_clean(struct mmc_queue *);
+
++extern int mmc_access_rpmb(struct mmc_queue *);
++
+ #endif
+diff --git a/drivers/mmc/core/core.c b/drivers/mmc/core/core.c
+index f26a5f1d926d..297b4f912c2d 100644
+--- a/drivers/mmc/core/core.c
++++ b/drivers/mmc/core/core.c
+@@ -2615,6 +2615,7 @@ int mmc_pm_notify(struct notifier_block *notify_block,
+ switch (mode) {
+ case PM_HIBERNATION_PREPARE:
+ case PM_SUSPEND_PREPARE:
++ case PM_RESTORE_PREPARE:
+ spin_lock_irqsave(&host->lock, flags);
+ host->rescan_disable = 1;
+ spin_unlock_irqrestore(&host->lock, flags);
+diff --git a/drivers/mmc/host/atmel-mci.c b/drivers/mmc/host/atmel-mci.c
+index 77250d4b1979..6423083c5238 100644
+--- a/drivers/mmc/host/atmel-mci.c
++++ b/drivers/mmc/host/atmel-mci.c
+@@ -1295,7 +1295,7 @@ static void atmci_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
+
+ if (ios->clock) {
+ unsigned int clock_min = ~0U;
+- u32 clkdiv;
++ int clkdiv;
+
+ clk_prepare(host->mck);
+ unprepare_clk = true;
+@@ -1324,7 +1324,12 @@ static void atmci_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
+ /* Calculate clock divider */
+ if (host->caps.has_odd_clk_div) {
+ clkdiv = DIV_ROUND_UP(host->bus_hz, clock_min) - 2;
+- if (clkdiv > 511) {
++ if (clkdiv < 0) {
++ dev_warn(&mmc->class_dev,
++ "clock %u too fast; using %lu\n",
++ clock_min, host->bus_hz / 2);
++ clkdiv = 0;
++ } else if (clkdiv > 511) {
+ dev_warn(&mmc->class_dev,
+ "clock %u too slow; using %lu\n",
+ clock_min, host->bus_hz / (511 + 2));
+diff --git a/drivers/mmc/host/sh_mmcif.c b/drivers/mmc/host/sh_mmcif.c
+index 7d9d6a321521..5165ae75d540 100644
+--- a/drivers/mmc/host/sh_mmcif.c
++++ b/drivers/mmc/host/sh_mmcif.c
+@@ -1402,7 +1402,7 @@ static int sh_mmcif_probe(struct platform_device *pdev)
+ host = mmc_priv(mmc);
+ host->mmc = mmc;
+ host->addr = reg;
+- host->timeout = msecs_to_jiffies(1000);
++ host->timeout = msecs_to_jiffies(10000);
+ host->ccs_enable = !pd || !pd->ccs_unsupported;
+ host->clk_ctrl2_enable = pd && pd->clk_ctrl2_present;
+
+diff --git a/drivers/net/wireless/iwlwifi/pcie/trans.c b/drivers/net/wireless/iwlwifi/pcie/trans.c
+index dd2f3f8baa9d..c943baa4e9f1 100644
+--- a/drivers/net/wireless/iwlwifi/pcie/trans.c
++++ b/drivers/net/wireless/iwlwifi/pcie/trans.c
+@@ -5,8 +5,8 @@
+ *
+ * GPL LICENSE SUMMARY
+ *
+- * Copyright(c) 2007 - 2014 Intel Corporation. All rights reserved.
+- * Copyright(c) 2013 - 2014 Intel Mobile Communications GmbH
++ * Copyright(c) 2007 - 2015 Intel Corporation. All rights reserved.
++ * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+@@ -31,8 +31,8 @@
+ *
+ * BSD LICENSE
+ *
+- * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
+- * Copyright(c) 2013 - 2014 Intel Mobile Communications GmbH
++ * Copyright(c) 2005 - 2015 Intel Corporation. All rights reserved.
++ * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+@@ -98,7 +98,7 @@ static void iwl_pcie_free_fw_monitor(struct iwl_trans *trans)
+ static void iwl_pcie_alloc_fw_monitor(struct iwl_trans *trans)
+ {
+ struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
+- struct page *page;
++ struct page *page = NULL;
+ dma_addr_t phys;
+ u32 size;
+ u8 power;
+@@ -125,6 +125,7 @@ static void iwl_pcie_alloc_fw_monitor(struct iwl_trans *trans)
+ DMA_FROM_DEVICE);
+ if (dma_mapping_error(trans->dev, phys)) {
+ __free_pages(page, order);
++ page = NULL;
+ continue;
+ }
+ IWL_INFO(trans,
+diff --git a/drivers/net/wireless/rt2x00/rt2800usb.c b/drivers/net/wireless/rt2x00/rt2800usb.c
+index 8444313eabe2..8694dddcce9a 100644
+--- a/drivers/net/wireless/rt2x00/rt2800usb.c
++++ b/drivers/net/wireless/rt2x00/rt2800usb.c
+@@ -1040,6 +1040,7 @@ static struct usb_device_id rt2800usb_device_table[] = {
+ { USB_DEVICE(0x07d1, 0x3c17) },
+ { USB_DEVICE(0x2001, 0x3317) },
+ { USB_DEVICE(0x2001, 0x3c1b) },
++ { USB_DEVICE(0x2001, 0x3c25) },
+ /* Draytek */
+ { USB_DEVICE(0x07fa, 0x7712) },
+ /* DVICO */
+diff --git a/drivers/net/wireless/rtlwifi/usb.c b/drivers/net/wireless/rtlwifi/usb.c
+index 46ee956d0235..27cd6cabf6c5 100644
+--- a/drivers/net/wireless/rtlwifi/usb.c
++++ b/drivers/net/wireless/rtlwifi/usb.c
+@@ -126,7 +126,7 @@ static int _usbctrl_vendorreq_sync_read(struct usb_device *udev, u8 request,
+
+ do {
+ status = usb_control_msg(udev, pipe, request, reqtype, value,
+- index, pdata, len, 0); /*max. timeout*/
++ index, pdata, len, 1000);
+ if (status < 0) {
+ /* firmware download is checksumed, don't retry */
+ if ((value >= FW_8192C_START_ADDRESS &&
+diff --git a/drivers/pinctrl/core.c b/drivers/pinctrl/core.c
+index 89dca77ca038..18ee2089df4a 100644
+--- a/drivers/pinctrl/core.c
++++ b/drivers/pinctrl/core.c
+@@ -1110,7 +1110,7 @@ void devm_pinctrl_put(struct pinctrl *p)
+ EXPORT_SYMBOL_GPL(devm_pinctrl_put);
+
+ int pinctrl_register_map(struct pinctrl_map const *maps, unsigned num_maps,
+- bool dup, bool locked)
++ bool dup)
+ {
+ int i, ret;
+ struct pinctrl_maps *maps_node;
+@@ -1178,11 +1178,9 @@ int pinctrl_register_map(struct pinctrl_map const *maps, unsigned num_maps,
+ maps_node->maps = maps;
+ }
+
+- if (!locked)
+- mutex_lock(&pinctrl_maps_mutex);
++ mutex_lock(&pinctrl_maps_mutex);
+ list_add_tail(&maps_node->node, &pinctrl_maps);
+- if (!locked)
+- mutex_unlock(&pinctrl_maps_mutex);
++ mutex_unlock(&pinctrl_maps_mutex);
+
+ return 0;
+ }
+@@ -1197,7 +1195,7 @@ int pinctrl_register_map(struct pinctrl_map const *maps, unsigned num_maps,
+ int pinctrl_register_mappings(struct pinctrl_map const *maps,
+ unsigned num_maps)
+ {
+- return pinctrl_register_map(maps, num_maps, true, false);
++ return pinctrl_register_map(maps, num_maps, true);
+ }
+
+ void pinctrl_unregister_map(struct pinctrl_map const *map)
+diff --git a/drivers/pinctrl/core.h b/drivers/pinctrl/core.h
+index 75476b3d87da..b24ea846c867 100644
+--- a/drivers/pinctrl/core.h
++++ b/drivers/pinctrl/core.h
+@@ -183,7 +183,7 @@ static inline struct pin_desc *pin_desc_get(struct pinctrl_dev *pctldev,
+ }
+
+ int pinctrl_register_map(struct pinctrl_map const *maps, unsigned num_maps,
+- bool dup, bool locked);
++ bool dup);
+ void pinctrl_unregister_map(struct pinctrl_map const *map);
+
+ extern int pinctrl_force_sleep(struct pinctrl_dev *pctldev);
+diff --git a/drivers/pinctrl/devicetree.c b/drivers/pinctrl/devicetree.c
+index eda13de2e7c0..0bbf7d71b281 100644
+--- a/drivers/pinctrl/devicetree.c
++++ b/drivers/pinctrl/devicetree.c
+@@ -92,7 +92,7 @@ static int dt_remember_or_free_map(struct pinctrl *p, const char *statename,
+ dt_map->num_maps = num_maps;
+ list_add_tail(&dt_map->node, &p->dt_maps);
+
+- return pinctrl_register_map(map, num_maps, false, true);
++ return pinctrl_register_map(map, num_maps, false);
+ }
+
+ struct pinctrl_dev *of_pinctrl_get(struct device_node *np)
+diff --git a/drivers/power/reset/at91-reset.c b/drivers/power/reset/at91-reset.c
+index 3cb36693343a..80d490da9a45 100644
+--- a/drivers/power/reset/at91-reset.c
++++ b/drivers/power/reset/at91-reset.c
+@@ -205,9 +205,9 @@ static int at91_reset_platform_probe(struct platform_device *pdev)
+ res = platform_get_resource(pdev, IORESOURCE_MEM, idx + 1 );
+ at91_ramc_base[idx] = devm_ioremap(&pdev->dev, res->start,
+ resource_size(res));
+- if (IS_ERR(at91_ramc_base[idx])) {
++ if (!at91_ramc_base[idx]) {
+ dev_err(&pdev->dev, "Could not map ram controller address\n");
+- return PTR_ERR(at91_ramc_base[idx]);
++ return -ENOMEM;
+ }
+ }
+
+diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
+index 7a4d88c91069..ce382e858452 100644
+--- a/drivers/scsi/sd.c
++++ b/drivers/scsi/sd.c
+@@ -1634,6 +1634,7 @@ static unsigned int sd_completed_bytes(struct scsi_cmnd *scmd)
+ {
+ u64 start_lba = blk_rq_pos(scmd->request);
+ u64 end_lba = blk_rq_pos(scmd->request) + (scsi_bufflen(scmd) / 512);
++ u64 factor = scmd->device->sector_size / 512;
+ u64 bad_lba;
+ int info_valid;
+ /*
+@@ -1655,16 +1656,9 @@ static unsigned int sd_completed_bytes(struct scsi_cmnd *scmd)
+ if (scsi_bufflen(scmd) <= scmd->device->sector_size)
+ return 0;
+
+- if (scmd->device->sector_size < 512) {
+- /* only legitimate sector_size here is 256 */
+- start_lba <<= 1;
+- end_lba <<= 1;
+- } else {
+- /* be careful ... don't want any overflows */
+- unsigned int factor = scmd->device->sector_size / 512;
+- do_div(start_lba, factor);
+- do_div(end_lba, factor);
+- }
++ /* be careful ... don't want any overflows */
++ do_div(start_lba, factor);
++ do_div(end_lba, factor);
+
+ /* The bad lba was reported incorrectly, we have no idea where
+ * the error is.
+@@ -2231,8 +2225,7 @@ got_data:
+ if (sector_size != 512 &&
+ sector_size != 1024 &&
+ sector_size != 2048 &&
+- sector_size != 4096 &&
+- sector_size != 256) {
++ sector_size != 4096) {
+ sd_printk(KERN_NOTICE, sdkp, "Unsupported sector size %d.\n",
+ sector_size);
+ /*
+@@ -2287,8 +2280,6 @@ got_data:
+ sdkp->capacity <<= 2;
+ else if (sector_size == 1024)
+ sdkp->capacity <<= 1;
+- else if (sector_size == 256)
+- sdkp->capacity >>= 1;
+
+ blk_queue_physical_block_size(sdp->request_queue,
+ sdkp->physical_block_size);
+diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c
+index 4534d9debcdc..e511e3406cfa 100644
+--- a/drivers/scsi/storvsc_drv.c
++++ b/drivers/scsi/storvsc_drv.c
+@@ -1623,8 +1623,7 @@ static int storvsc_queuecommand(struct Scsi_Host *host, struct scsi_cmnd *scmnd)
+ break;
+ default:
+ vm_srb->data_in = UNKNOWN_TYPE;
+- vm_srb->win8_extension.srb_flags |= (SRB_FLAGS_DATA_IN |
+- SRB_FLAGS_DATA_OUT);
++ vm_srb->win8_extension.srb_flags |= SRB_FLAGS_NO_DATA_TRANSFER;
+ break;
+ }
+
+diff --git a/drivers/staging/gdm724x/gdm_mux.c b/drivers/staging/gdm724x/gdm_mux.c
+index b5b063a738f8..fe410445a1af 100644
+--- a/drivers/staging/gdm724x/gdm_mux.c
++++ b/drivers/staging/gdm724x/gdm_mux.c
+@@ -158,7 +158,7 @@ static int up_to_host(struct mux_rx *r)
+ unsigned int start_flag;
+ unsigned int payload_size;
+ unsigned short packet_type;
+- int dummy_cnt;
++ int total_len;
+ u32 packet_size_sum = r->offset;
+ int index;
+ int ret = TO_HOST_INVALID_PACKET;
+@@ -176,10 +176,10 @@ static int up_to_host(struct mux_rx *r)
+ break;
+ }
+
+- dummy_cnt = ALIGN(MUX_HEADER_SIZE + payload_size, 4);
++ total_len = ALIGN(MUX_HEADER_SIZE + payload_size, 4);
+
+ if (len - packet_size_sum <
+- MUX_HEADER_SIZE + payload_size + dummy_cnt) {
++ total_len) {
+ pr_err("invalid payload : %d %d %04x\n",
+ payload_size, len, packet_type);
+ break;
+@@ -202,7 +202,7 @@ static int up_to_host(struct mux_rx *r)
+ break;
+ }
+
+- packet_size_sum += MUX_HEADER_SIZE + payload_size + dummy_cnt;
++ packet_size_sum += total_len;
+ if (len - packet_size_sum <= MUX_HEADER_SIZE + 2) {
+ ret = r->callback(NULL,
+ 0,
+@@ -361,7 +361,6 @@ static int gdm_mux_send(void *priv_dev, void *data, int len, int tty_index,
+ struct mux_pkt_header *mux_header;
+ struct mux_tx *t = NULL;
+ static u32 seq_num = 1;
+- int dummy_cnt;
+ int total_len;
+ int ret;
+ unsigned long flags;
+@@ -374,9 +373,7 @@ static int gdm_mux_send(void *priv_dev, void *data, int len, int tty_index,
+
+ spin_lock_irqsave(&mux_dev->write_lock, flags);
+
+- dummy_cnt = ALIGN(MUX_HEADER_SIZE + len, 4);
+-
+- total_len = len + MUX_HEADER_SIZE + dummy_cnt;
++ total_len = ALIGN(MUX_HEADER_SIZE + len, 4);
+
+ t = alloc_mux_tx(total_len);
+ if (!t) {
+@@ -392,7 +389,8 @@ static int gdm_mux_send(void *priv_dev, void *data, int len, int tty_index,
+ mux_header->packet_type = __cpu_to_le16(packet_type[tty_index]);
+
+ memcpy(t->buf+MUX_HEADER_SIZE, data, len);
+- memset(t->buf+MUX_HEADER_SIZE+len, 0, dummy_cnt);
++ memset(t->buf+MUX_HEADER_SIZE+len, 0, total_len - MUX_HEADER_SIZE -
++ len);
+
+ t->len = total_len;
+ t->callback = cb;
+diff --git a/drivers/staging/vt6656/rxtx.c b/drivers/staging/vt6656/rxtx.c
+index ea5140ab2b41..b3500fd31394 100644
+--- a/drivers/staging/vt6656/rxtx.c
++++ b/drivers/staging/vt6656/rxtx.c
+@@ -800,10 +800,18 @@ int vnt_tx_packet(struct vnt_private *priv, struct sk_buff *skb)
+ vnt_schedule_command(priv, WLAN_CMD_SETPOWER);
+ }
+
+- if (current_rate > RATE_11M)
+- pkt_type = priv->packet_type;
+- else
++ if (current_rate > RATE_11M) {
++ if (info->band == IEEE80211_BAND_5GHZ) {
++ pkt_type = PK_TYPE_11A;
++ } else {
++ if (tx_rate->flags & IEEE80211_TX_RC_USE_CTS_PROTECT)
++ pkt_type = PK_TYPE_11GB;
++ else
++ pkt_type = PK_TYPE_11GA;
++ }
++ } else {
+ pkt_type = PK_TYPE_11B;
++ }
+
+ spin_lock_irqsave(&priv->lock, flags);
+
+diff --git a/drivers/target/target_core_pscsi.c b/drivers/target/target_core_pscsi.c
+index 9a54381e23c6..3ee77db03cb7 100644
+--- a/drivers/target/target_core_pscsi.c
++++ b/drivers/target/target_core_pscsi.c
+@@ -520,6 +520,7 @@ static int pscsi_configure_device(struct se_device *dev)
+ " pdv_host_id: %d\n", pdv->pdv_host_id);
+ return -EINVAL;
+ }
++ pdv->pdv_lld_host = sh;
+ }
+ } else {
+ if (phv->phv_mode == PHV_VIRTUAL_HOST_ID) {
+@@ -602,6 +603,8 @@ static void pscsi_free_device(struct se_device *dev)
+ if ((phv->phv_mode == PHV_LLD_SCSI_HOST_NO) &&
+ (phv->phv_lld_host != NULL))
+ scsi_host_put(phv->phv_lld_host);
++ else if (pdv->pdv_lld_host)
++ scsi_host_put(pdv->pdv_lld_host);
+
+ if ((sd->type == TYPE_DISK) || (sd->type == TYPE_ROM))
+ scsi_device_put(sd);
+diff --git a/drivers/target/target_core_pscsi.h b/drivers/target/target_core_pscsi.h
+index 1bd757dff8ee..820d3052b775 100644
+--- a/drivers/target/target_core_pscsi.h
++++ b/drivers/target/target_core_pscsi.h
+@@ -45,6 +45,7 @@ struct pscsi_dev_virt {
+ int pdv_lun_id;
+ struct block_device *pdv_bd;
+ struct scsi_device *pdv_sd;
++ struct Scsi_Host *pdv_lld_host;
+ } ____cacheline_aligned;
+
+ typedef enum phv_modes {
+diff --git a/drivers/thermal/armada_thermal.c b/drivers/thermal/armada_thermal.c
+index 9d1420acb391..e6f1acc71996 100644
+--- a/drivers/thermal/armada_thermal.c
++++ b/drivers/thermal/armada_thermal.c
+@@ -240,9 +240,9 @@ static const struct armada_thermal_data armada380_data = {
+ .is_valid_shift = 10,
+ .temp_shift = 0,
+ .temp_mask = 0x3ff,
+- .coef_b = 1169498786UL,
+- .coef_m = 2000000UL,
+- .coef_div = 4289,
++ .coef_b = 2931108200UL,
++ .coef_m = 5000000UL,
++ .coef_div = 10502,
+ .inverted = true,
+ };
+
+diff --git a/drivers/tty/hvc/hvc_xen.c b/drivers/tty/hvc/hvc_xen.c
+index f1e57425e39f..7a3d146a5f0e 100644
+--- a/drivers/tty/hvc/hvc_xen.c
++++ b/drivers/tty/hvc/hvc_xen.c
+@@ -289,7 +289,7 @@ static int xen_initial_domain_console_init(void)
+ return -ENOMEM;
+ }
+
+- info->irq = bind_virq_to_irq(VIRQ_CONSOLE, 0);
++ info->irq = bind_virq_to_irq(VIRQ_CONSOLE, 0, false);
+ info->vtermno = HVC_COOKIE;
+
+ spin_lock(&xencons_lock);
+@@ -299,11 +299,27 @@ static int xen_initial_domain_console_init(void)
+ return 0;
+ }
+
++static void xen_console_update_evtchn(struct xencons_info *info)
++{
++ if (xen_hvm_domain()) {
++ uint64_t v;
++ int err;
++
++ err = hvm_get_parameter(HVM_PARAM_CONSOLE_EVTCHN, &v);
++ if (!err && v)
++ info->evtchn = v;
++ } else
++ info->evtchn = xen_start_info->console.domU.evtchn;
++}
++
+ void xen_console_resume(void)
+ {
+ struct xencons_info *info = vtermno_to_xencons(HVC_COOKIE);
+- if (info != NULL && info->irq)
++ if (info != NULL && info->irq) {
++ if (!xen_initial_domain())
++ xen_console_update_evtchn(info);
+ rebind_evtchn_irq(info->evtchn, info->irq);
++ }
+ }
+
+ static void xencons_disconnect_backend(struct xencons_info *info)
+diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c
+index c4343764cc5b..bce16e405d59 100644
+--- a/drivers/tty/n_gsm.c
++++ b/drivers/tty/n_gsm.c
+@@ -3170,7 +3170,7 @@ static int gsmtty_break_ctl(struct tty_struct *tty, int state)
+ return gsmtty_modem_update(dlci, encode);
+ }
+
+-static void gsmtty_remove(struct tty_driver *driver, struct tty_struct *tty)
++static void gsmtty_cleanup(struct tty_struct *tty)
+ {
+ struct gsm_dlci *dlci = tty->driver_data;
+ struct gsm_mux *gsm = dlci->gsm;
+@@ -3178,7 +3178,6 @@ static void gsmtty_remove(struct tty_driver *driver, struct tty_struct *tty)
+ dlci_put(dlci);
+ dlci_put(gsm->dlci[0]);
+ mux_put(gsm);
+- driver->ttys[tty->index] = NULL;
+ }
+
+ /* Virtual ttys for the demux */
+@@ -3199,7 +3198,7 @@ static const struct tty_operations gsmtty_ops = {
+ .tiocmget = gsmtty_tiocmget,
+ .tiocmset = gsmtty_tiocmset,
+ .break_ctl = gsmtty_break_ctl,
+- .remove = gsmtty_remove,
++ .cleanup = gsmtty_cleanup,
+ };
+
+
+diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c
+index 28d3dd3637b3..a7e1a96e69a5 100644
+--- a/drivers/usb/gadget/configfs.c
++++ b/drivers/usb/gadget/configfs.c
+@@ -1295,6 +1295,7 @@ static void purge_configs_funcs(struct gadget_info *gi)
+ }
+ }
+ c->next_interface_id = 0;
++ memset(c->interface, 0, sizeof(c->interface));
+ c->superspeed = 0;
+ c->highspeed = 0;
+ c->fullspeed = 0;
+diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
+index 3307e161c100..9848a67ddbbe 100644
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -2037,8 +2037,13 @@ static int process_isoc_td(struct xhci_hcd *xhci, struct xhci_td *td,
+ break;
+ case COMP_DEV_ERR:
+ case COMP_STALL:
++ frame->status = -EPROTO;
++ skip_td = true;
++ break;
+ case COMP_TX_ERR:
+ frame->status = -EPROTO;
++ if (event_trb != td->last_trb)
++ return 0;
+ skip_td = true;
+ break;
+ case COMP_STOP:
+@@ -2651,7 +2656,7 @@ irqreturn_t xhci_irq(struct usb_hcd *hcd)
+ xhci_halt(xhci);
+ hw_died:
+ spin_unlock(&xhci->lock);
+- return -ESHUTDOWN;
++ return IRQ_HANDLED;
+ }
+
+ /*
+diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
+index 94251141adae..54f386f80970 100644
+--- a/drivers/usb/host/xhci.h
++++ b/drivers/usb/host/xhci.h
+@@ -1267,7 +1267,7 @@ union xhci_trb {
+ * since the command ring is 64-byte aligned.
+ * It must also be greater than 16.
+ */
+-#define TRBS_PER_SEGMENT 64
++#define TRBS_PER_SEGMENT 256
+ /* Allow two commands + a link TRB, along with any reserved command TRBs */
+ #define MAX_RSVD_CMD_TRBS (TRBS_PER_SEGMENT - 3)
+ #define TRB_SEGMENT_SIZE (TRBS_PER_SEGMENT*16)
+diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
+index 84ce2d74894c..9031750e7404 100644
+--- a/drivers/usb/serial/cp210x.c
++++ b/drivers/usb/serial/cp210x.c
+@@ -127,6 +127,7 @@ static const struct usb_device_id id_table[] = {
+ { USB_DEVICE(0x10C4, 0x88A5) }, /* Planet Innovation Ingeni ZigBee USB Device */
+ { USB_DEVICE(0x10C4, 0x8946) }, /* Ketra N1 Wireless Interface */
+ { USB_DEVICE(0x10C4, 0x8977) }, /* CEL MeshWorks DevKit Device */
++ { USB_DEVICE(0x10C4, 0x8998) }, /* KCF Technologies PRN */
+ { USB_DEVICE(0x10C4, 0xEA60) }, /* Silicon Labs factory default */
+ { USB_DEVICE(0x10C4, 0xEA61) }, /* Silicon Labs factory default */
+ { USB_DEVICE(0x10C4, 0xEA70) }, /* Silicon Labs factory default */
+diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c
+index 0f872e6b2c87..534c308c6b33 100644
+--- a/drivers/usb/serial/pl2303.c
++++ b/drivers/usb/serial/pl2303.c
+@@ -61,7 +61,6 @@ static const struct usb_device_id id_table[] = {
+ { USB_DEVICE(DCU10_VENDOR_ID, DCU10_PRODUCT_ID) },
+ { USB_DEVICE(SITECOM_VENDOR_ID, SITECOM_PRODUCT_ID) },
+ { USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_ID) },
+- { USB_DEVICE(SAMSUNG_VENDOR_ID, SAMSUNG_PRODUCT_ID) },
+ { USB_DEVICE(SIEMENS_VENDOR_ID, SIEMENS_PRODUCT_ID_SX1),
+ .driver_info = PL2303_QUIRK_UART_STATE_IDX0 },
+ { USB_DEVICE(SIEMENS_VENDOR_ID, SIEMENS_PRODUCT_ID_X65),
+diff --git a/drivers/usb/serial/pl2303.h b/drivers/usb/serial/pl2303.h
+index 71fd9da1d6e7..e3b7af8adfb7 100644
+--- a/drivers/usb/serial/pl2303.h
++++ b/drivers/usb/serial/pl2303.h
+@@ -62,10 +62,6 @@
+ #define ALCATEL_VENDOR_ID 0x11f7
+ #define ALCATEL_PRODUCT_ID 0x02df
+
+-/* Samsung I330 phone cradle */
+-#define SAMSUNG_VENDOR_ID 0x04e8
+-#define SAMSUNG_PRODUCT_ID 0x8001
+-
+ #define SIEMENS_VENDOR_ID 0x11f5
+ #define SIEMENS_PRODUCT_ID_SX1 0x0001
+ #define SIEMENS_PRODUCT_ID_X65 0x0003
+diff --git a/drivers/usb/serial/visor.c b/drivers/usb/serial/visor.c
+index bf2bd40e5f2a..60afb39eb73c 100644
+--- a/drivers/usb/serial/visor.c
++++ b/drivers/usb/serial/visor.c
+@@ -95,7 +95,7 @@ static const struct usb_device_id id_table[] = {
+ .driver_info = (kernel_ulong_t)&palm_os_4_probe },
+ { USB_DEVICE(ACER_VENDOR_ID, ACER_S10_ID),
+ .driver_info = (kernel_ulong_t)&palm_os_4_probe },
+- { USB_DEVICE(SAMSUNG_VENDOR_ID, SAMSUNG_SCH_I330_ID),
++ { USB_DEVICE_INTERFACE_CLASS(SAMSUNG_VENDOR_ID, SAMSUNG_SCH_I330_ID, 0xff),
+ .driver_info = (kernel_ulong_t)&palm_os_4_probe },
+ { USB_DEVICE(SAMSUNG_VENDOR_ID, SAMSUNG_SPH_I500_ID),
+ .driver_info = (kernel_ulong_t)&palm_os_4_probe },
+diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
+index 8adb53044079..300ef9b817ed 100644
+--- a/drivers/usb/storage/unusual_devs.h
++++ b/drivers/usb/storage/unusual_devs.h
+@@ -766,6 +766,13 @@ UNUSUAL_DEV( 0x059f, 0x0643, 0x0000, 0x0000,
+ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+ US_FL_GO_SLOW ),
+
++/* Reported by Christian Schaller <cschalle@redhat.com> */
++UNUSUAL_DEV( 0x059f, 0x0651, 0x0000, 0x0000,
++ "LaCie",
++ "External HDD",
++ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
++ US_FL_NO_WP_DETECT ),
++
+ /* Submitted by Joel Bourquard <numlock@freesurf.ch>
+ * Some versions of this device need the SubClass and Protocol overrides
+ * while others don't.
+diff --git a/drivers/xen/events/events_2l.c b/drivers/xen/events/events_2l.c
+index 5db43fc100a4..7dd46312c180 100644
+--- a/drivers/xen/events/events_2l.c
++++ b/drivers/xen/events/events_2l.c
+@@ -345,6 +345,15 @@ irqreturn_t xen_debug_interrupt(int irq, void *dev_id)
+ return IRQ_HANDLED;
+ }
+
++static void evtchn_2l_resume(void)
++{
++ int i;
++
++ for_each_online_cpu(i)
++ memset(per_cpu(cpu_evtchn_mask, i), 0, sizeof(xen_ulong_t) *
++ EVTCHN_2L_NR_CHANNELS/BITS_PER_EVTCHN_WORD);
++}
++
+ static const struct evtchn_ops evtchn_ops_2l = {
+ .max_channels = evtchn_2l_max_channels,
+ .nr_channels = evtchn_2l_max_channels,
+@@ -356,6 +365,7 @@ static const struct evtchn_ops evtchn_ops_2l = {
+ .mask = evtchn_2l_mask,
+ .unmask = evtchn_2l_unmask,
+ .handle_events = evtchn_2l_handle_events,
++ .resume = evtchn_2l_resume,
+ };
+
+ void __init xen_evtchn_2l_init(void)
+diff --git a/drivers/xen/events/events_base.c b/drivers/xen/events/events_base.c
+index 70fba973a107..38387950490e 100644
+--- a/drivers/xen/events/events_base.c
++++ b/drivers/xen/events/events_base.c
+@@ -529,8 +529,8 @@ static unsigned int __startup_pirq(unsigned int irq)
+ if (rc)
+ goto err;
+
+- bind_evtchn_to_cpu(evtchn, 0);
+ info->evtchn = evtchn;
++ bind_evtchn_to_cpu(evtchn, 0);
+
+ rc = xen_evtchn_port_setup(info);
+ if (rc)
+@@ -957,7 +957,7 @@ unsigned xen_evtchn_nr_channels(void)
+ }
+ EXPORT_SYMBOL_GPL(xen_evtchn_nr_channels);
+
+-int bind_virq_to_irq(unsigned int virq, unsigned int cpu)
++int bind_virq_to_irq(unsigned int virq, unsigned int cpu, bool percpu)
+ {
+ struct evtchn_bind_virq bind_virq;
+ int evtchn, irq, ret;
+@@ -971,8 +971,12 @@ int bind_virq_to_irq(unsigned int virq, unsigned int cpu)
+ if (irq < 0)
+ goto out;
+
+- irq_set_chip_and_handler_name(irq, &xen_percpu_chip,
+- handle_percpu_irq, "virq");
++ if (percpu)
++ irq_set_chip_and_handler_name(irq, &xen_percpu_chip,
++ handle_percpu_irq, "virq");
++ else
++ irq_set_chip_and_handler_name(irq, &xen_dynamic_chip,
++ handle_edge_irq, "virq");
+
+ bind_virq.virq = virq;
+ bind_virq.vcpu = cpu;
+@@ -1062,7 +1066,7 @@ int bind_virq_to_irqhandler(unsigned int virq, unsigned int cpu,
+ {
+ int irq, retval;
+
+- irq = bind_virq_to_irq(virq, cpu);
++ irq = bind_virq_to_irq(virq, cpu, irqflags & IRQF_PERCPU);
+ if (irq < 0)
+ return irq;
+ retval = request_irq(irq, handler, irqflags, devname, dev_id);
+@@ -1279,8 +1283,9 @@ void rebind_evtchn_irq(int evtchn, int irq)
+
+ mutex_unlock(&irq_mapping_update_lock);
+
+- /* new event channels are always bound to cpu 0 */
+- irq_set_affinity(irq, cpumask_of(0));
++ bind_evtchn_to_cpu(evtchn, info->cpu);
++ /* This will be deferred until interrupt is processed */
++ irq_set_affinity(irq, cpumask_of(info->cpu));
+
+ /* Unmask the event channel. */
+ enable_irq(irq);
+diff --git a/drivers/xen/xen-pciback/conf_space.c b/drivers/xen/xen-pciback/conf_space.c
+index 75fe3d466515..9c234209d8b5 100644
+--- a/drivers/xen/xen-pciback/conf_space.c
++++ b/drivers/xen/xen-pciback/conf_space.c
+@@ -16,8 +16,8 @@
+ #include "conf_space.h"
+ #include "conf_space_quirks.h"
+
+-bool permissive;
+-module_param(permissive, bool, 0644);
++bool xen_pcibk_permissive;
++module_param_named(permissive, xen_pcibk_permissive, bool, 0644);
+
+ /* This is where xen_pcibk_read_config_byte, xen_pcibk_read_config_word,
+ * xen_pcibk_write_config_word, and xen_pcibk_write_config_byte are created. */
+@@ -262,7 +262,7 @@ int xen_pcibk_config_write(struct pci_dev *dev, int offset, int size, u32 value)
+ * This means that some fields may still be read-only because
+ * they have entries in the config_field list that intercept
+ * the write and do nothing. */
+- if (dev_data->permissive || permissive) {
++ if (dev_data->permissive || xen_pcibk_permissive) {
+ switch (size) {
+ case 1:
+ err = pci_write_config_byte(dev, offset,
+diff --git a/drivers/xen/xen-pciback/conf_space.h b/drivers/xen/xen-pciback/conf_space.h
+index 2e1d73d1d5d0..62461a8ba1d6 100644
+--- a/drivers/xen/xen-pciback/conf_space.h
++++ b/drivers/xen/xen-pciback/conf_space.h
+@@ -64,7 +64,7 @@ struct config_field_entry {
+ void *data;
+ };
+
+-extern bool permissive;
++extern bool xen_pcibk_permissive;
+
+ #define OFFSET(cfg_entry) ((cfg_entry)->base_offset+(cfg_entry)->field->offset)
+
+diff --git a/drivers/xen/xen-pciback/conf_space_header.c b/drivers/xen/xen-pciback/conf_space_header.c
+index 2d7369391472..f8baf463dd35 100644
+--- a/drivers/xen/xen-pciback/conf_space_header.c
++++ b/drivers/xen/xen-pciback/conf_space_header.c
+@@ -105,7 +105,7 @@ static int command_write(struct pci_dev *dev, int offset, u16 value, void *data)
+
+ cmd->val = value;
+
+- if (!permissive && (!dev_data || !dev_data->permissive))
++ if (!xen_pcibk_permissive && (!dev_data || !dev_data->permissive))
+ return 0;
+
+ /* Only allow the guest to control certain bits. */
+diff --git a/drivers/xen/xenbus/xenbus_probe.c b/drivers/xen/xenbus/xenbus_probe.c
+index 564b31584860..5390a674b5e3 100644
+--- a/drivers/xen/xenbus/xenbus_probe.c
++++ b/drivers/xen/xenbus/xenbus_probe.c
+@@ -57,6 +57,7 @@
+ #include <xen/xen.h>
+ #include <xen/xenbus.h>
+ #include <xen/events.h>
++#include <xen/xen-ops.h>
+ #include <xen/page.h>
+
+ #include <xen/hvm.h>
+@@ -735,6 +736,30 @@ static int __init xenstored_local_init(void)
+ return err;
+ }
+
++static int xenbus_resume_cb(struct notifier_block *nb,
++ unsigned long action, void *data)
++{
++ int err = 0;
++
++ if (xen_hvm_domain()) {
++ uint64_t v;
++
++ err = hvm_get_parameter(HVM_PARAM_STORE_EVTCHN, &v);
++ if (!err && v)
++ xen_store_evtchn = v;
++ else
++ pr_warn("Cannot update xenstore event channel: %d\n",
++ err);
++ } else
++ xen_store_evtchn = xen_start_info->store_evtchn;
++
++ return err;
++}
++
++static struct notifier_block xenbus_resume_nb = {
++ .notifier_call = xenbus_resume_cb,
++};
++
+ static int __init xenbus_init(void)
+ {
+ int err = 0;
+@@ -793,6 +818,10 @@ static int __init xenbus_init(void)
+ goto out_error;
+ }
+
++ if ((xen_store_domain_type != XS_LOCAL) &&
++ (xen_store_domain_type != XS_UNKNOWN))
++ xen_resume_notifier_register(&xenbus_resume_nb);
++
+ #ifdef CONFIG_XEN_COMPAT_XENFS
+ /*
+ * Create xenfs mountpoint in /proc for compatibility with
+diff --git a/fs/coredump.c b/fs/coredump.c
+index b5c86ffd5033..4c5866b948e7 100644
+--- a/fs/coredump.c
++++ b/fs/coredump.c
+@@ -657,7 +657,7 @@ void do_coredump(const siginfo_t *siginfo)
+ */
+ if (!uid_eq(inode->i_uid, current_fsuid()))
+ goto close_fail;
+- if (!cprm.file->f_op->write)
++ if (!(cprm.file->f_mode & FMODE_CAN_WRITE))
+ goto close_fail;
+ if (do_truncate(cprm.file->f_path.dentry, 0, 0, cprm.file))
+ goto close_fail;
+diff --git a/fs/dcache.c b/fs/dcache.c
+index 03dca3cad918..e0750b8f51aa 100644
+--- a/fs/dcache.c
++++ b/fs/dcache.c
+@@ -1094,13 +1094,13 @@ ascend:
+ /* might go back up the wrong parent if we have had a rename. */
+ if (need_seqretry(&rename_lock, seq))
+ goto rename_retry;
+- next = child->d_child.next;
+- while (unlikely(child->d_flags & DCACHE_DENTRY_KILLED)) {
++ /* go into the first sibling still alive */
++ do {
++ next = child->d_child.next;
+ if (next == &this_parent->d_subdirs)
+ goto ascend;
+ child = list_entry(next, struct dentry, d_child);
+- next = next->next;
+- }
++ } while (unlikely(child->d_flags & DCACHE_DENTRY_KILLED));
+ rcu_read_unlock();
+ goto resume;
+ }
+diff --git a/fs/exec.c b/fs/exec.c
+index 2e83209016ec..b7a5f46181b0 100644
+--- a/fs/exec.c
++++ b/fs/exec.c
+@@ -658,6 +658,9 @@ int setup_arg_pages(struct linux_binprm *bprm,
+ if (stack_base > STACK_SIZE_MAX)
+ stack_base = STACK_SIZE_MAX;
+
++ /* Add space for stack randomization. */
++ stack_base += (STACK_RND_MASK << PAGE_SHIFT);
++
+ /* Make sure we didn't let the argument array grow too large. */
+ if (vma->vm_end - vma->vm_start > stack_base)
+ return -ENOMEM;
+diff --git a/fs/ext4/ext4_jbd2.c b/fs/ext4/ext4_jbd2.c
+index 3445035c7e01..d41843181818 100644
+--- a/fs/ext4/ext4_jbd2.c
++++ b/fs/ext4/ext4_jbd2.c
+@@ -87,6 +87,12 @@ int __ext4_journal_stop(const char *where, unsigned int line, handle_t *handle)
+ ext4_put_nojournal(handle);
+ return 0;
+ }
++
++ if (!handle->h_transaction) {
++ err = jbd2_journal_stop(handle);
++ return handle->h_err ? handle->h_err : err;
++ }
++
+ sb = handle->h_transaction->t_journal->j_private;
+ err = handle->h_err;
+ rc = jbd2_journal_stop(handle);
+diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
+index 6cfacbb0f928..b5fcb1ac0dd7 100644
+--- a/fs/ext4/extents.c
++++ b/fs/ext4/extents.c
+@@ -377,7 +377,7 @@ static int ext4_valid_extent(struct inode *inode, struct ext4_extent *ext)
+ ext4_lblk_t lblock = le32_to_cpu(ext->ee_block);
+ ext4_lblk_t last = lblock + len - 1;
+
+- if (lblock > last)
++ if (len == 0 || lblock > last)
+ return 0;
+ return ext4_data_block_valid(EXT4_SB(inode->i_sb), block, len);
+ }
+diff --git a/fs/fhandle.c b/fs/fhandle.c
+index 999ff5c3cab0..d59712dfa3e7 100644
+--- a/fs/fhandle.c
++++ b/fs/fhandle.c
+@@ -195,8 +195,9 @@ static int handle_to_path(int mountdirfd, struct file_handle __user *ufh,
+ goto out_err;
+ }
+ /* copy the full handle */
+- if (copy_from_user(handle, ufh,
+- sizeof(struct file_handle) +
++ *handle = f_handle;
++ if (copy_from_user(&handle->f_handle,
++ &ufh->f_handle,
+ f_handle.handle_bytes)) {
+ retval = -EFAULT;
+ goto out_handle;
+diff --git a/fs/fs_pin.c b/fs/fs_pin.c
+index 9368236ca100..569bbd10e374 100644
+--- a/fs/fs_pin.c
++++ b/fs/fs_pin.c
+@@ -20,8 +20,8 @@ void pin_put(struct fs_pin *p)
+ void pin_remove(struct fs_pin *pin)
+ {
+ spin_lock(&pin_lock);
+- hlist_del(&pin->m_list);
+- hlist_del(&pin->s_list);
++ hlist_del_init(&pin->m_list);
++ hlist_del_init(&pin->s_list);
+ spin_unlock(&pin_lock);
+ }
+
+diff --git a/fs/jbd2/recovery.c b/fs/jbd2/recovery.c
+index bcbef08a4d8f..a5f72a36c6c8 100644
+--- a/fs/jbd2/recovery.c
++++ b/fs/jbd2/recovery.c
+@@ -839,15 +839,23 @@ static int scan_revoke_records(journal_t *journal, struct buffer_head *bh,
+ {
+ jbd2_journal_revoke_header_t *header;
+ int offset, max;
++ int csum_size = 0;
++ __u32 rcount;
+ int record_len = 4;
+
+ header = (jbd2_journal_revoke_header_t *) bh->b_data;
+ offset = sizeof(jbd2_journal_revoke_header_t);
+- max = be32_to_cpu(header->r_count);
++ rcount = be32_to_cpu(header->r_count);
+
+ if (!jbd2_revoke_block_csum_verify(journal, header))
+ return -EINVAL;
+
++ if (jbd2_journal_has_csum_v2or3(journal))
++ csum_size = sizeof(struct jbd2_journal_revoke_tail);
++ if (rcount > journal->j_blocksize - csum_size)
++ return -EINVAL;
++ max = rcount;
++
+ if (JBD2_HAS_INCOMPAT_FEATURE(journal, JBD2_FEATURE_INCOMPAT_64BIT))
+ record_len = 8;
+
+diff --git a/fs/jbd2/revoke.c b/fs/jbd2/revoke.c
+index c6cbaef2bda1..14214da80eb8 100644
+--- a/fs/jbd2/revoke.c
++++ b/fs/jbd2/revoke.c
+@@ -577,7 +577,7 @@ static void write_one_revoke_record(journal_t *journal,
+ {
+ int csum_size = 0;
+ struct buffer_head *descriptor;
+- int offset;
++ int sz, offset;
+ journal_header_t *header;
+
+ /* If we are already aborting, this all becomes a noop. We
+@@ -594,9 +594,14 @@ static void write_one_revoke_record(journal_t *journal,
+ if (jbd2_journal_has_csum_v2or3(journal))
+ csum_size = sizeof(struct jbd2_journal_revoke_tail);
+
++ if (JBD2_HAS_INCOMPAT_FEATURE(journal, JBD2_FEATURE_INCOMPAT_64BIT))
++ sz = 8;
++ else
++ sz = 4;
++
+ /* Make sure we have a descriptor with space left for the record */
+ if (descriptor) {
+- if (offset >= journal->j_blocksize - csum_size) {
++ if (offset + sz > journal->j_blocksize - csum_size) {
+ flush_descriptor(journal, descriptor, offset, write_op);
+ descriptor = NULL;
+ }
+@@ -619,16 +624,13 @@ static void write_one_revoke_record(journal_t *journal,
+ *descriptorp = descriptor;
+ }
+
+- if (JBD2_HAS_INCOMPAT_FEATURE(journal, JBD2_FEATURE_INCOMPAT_64BIT)) {
++ if (JBD2_HAS_INCOMPAT_FEATURE(journal, JBD2_FEATURE_INCOMPAT_64BIT))
+ * ((__be64 *)(&descriptor->b_data[offset])) =
+ cpu_to_be64(record->blocknr);
+- offset += 8;
+-
+- } else {
++ else
+ * ((__be32 *)(&descriptor->b_data[offset])) =
+ cpu_to_be32(record->blocknr);
+- offset += 4;
+- }
++ offset += sz;
+
+ *offsetp = offset;
+ }
+diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c
+index 5f09370c90a8..ff2f2e6ad311 100644
+--- a/fs/jbd2/transaction.c
++++ b/fs/jbd2/transaction.c
+@@ -551,7 +551,6 @@ int jbd2_journal_extend(handle_t *handle, int nblocks)
+ int result;
+ int wanted;
+
+- WARN_ON(!transaction);
+ if (is_handle_aborted(handle))
+ return -EROFS;
+ journal = transaction->t_journal;
+@@ -627,7 +626,6 @@ int jbd2__journal_restart(handle_t *handle, int nblocks, gfp_t gfp_mask)
+ tid_t tid;
+ int need_to_start, ret;
+
+- WARN_ON(!transaction);
+ /* If we've had an abort of any type, don't even think about
+ * actually doing the restart! */
+ if (is_handle_aborted(handle))
+@@ -785,7 +783,6 @@ do_get_write_access(handle_t *handle, struct journal_head *jh,
+ int need_copy = 0;
+ unsigned long start_lock, time_lock;
+
+- WARN_ON(!transaction);
+ if (is_handle_aborted(handle))
+ return -EROFS;
+ journal = transaction->t_journal;
+@@ -1051,7 +1048,6 @@ int jbd2_journal_get_create_access(handle_t *handle, struct buffer_head *bh)
+ int err;
+
+ jbd_debug(5, "journal_head %p\n", jh);
+- WARN_ON(!transaction);
+ err = -EROFS;
+ if (is_handle_aborted(handle))
+ goto out;
+@@ -1266,7 +1262,6 @@ int jbd2_journal_dirty_metadata(handle_t *handle, struct buffer_head *bh)
+ struct journal_head *jh;
+ int ret = 0;
+
+- WARN_ON(!transaction);
+ if (is_handle_aborted(handle))
+ return -EROFS;
+ journal = transaction->t_journal;
+@@ -1397,7 +1392,6 @@ int jbd2_journal_forget (handle_t *handle, struct buffer_head *bh)
+ int err = 0;
+ int was_modified = 0;
+
+- WARN_ON(!transaction);
+ if (is_handle_aborted(handle))
+ return -EROFS;
+ journal = transaction->t_journal;
+@@ -1530,8 +1524,22 @@ int jbd2_journal_stop(handle_t *handle)
+ tid_t tid;
+ pid_t pid;
+
+- if (!transaction)
+- goto free_and_exit;
++ if (!transaction) {
++ /*
++ * Handle is already detached from the transaction so
++ * there is nothing to do other than decrease a refcount,
++ * or free the handle if refcount drops to zero
++ */
++ if (--handle->h_ref > 0) {
++ jbd_debug(4, "h_ref %d -> %d\n", handle->h_ref + 1,
++ handle->h_ref);
++ return err;
++ } else {
++ if (handle->h_rsv_handle)
++ jbd2_free_handle(handle->h_rsv_handle);
++ goto free_and_exit;
++ }
++ }
+ journal = transaction->t_journal;
+
+ J_ASSERT(journal_current_handle() == handle);
+@@ -2373,7 +2381,6 @@ int jbd2_journal_file_inode(handle_t *handle, struct jbd2_inode *jinode)
+ transaction_t *transaction = handle->h_transaction;
+ journal_t *journal;
+
+- WARN_ON(!transaction);
+ if (is_handle_aborted(handle))
+ return -EROFS;
+ journal = transaction->t_journal;
+diff --git a/fs/namei.c b/fs/namei.c
+index 890d3580bf0e..d20f061cddd3 100644
+--- a/fs/namei.c
++++ b/fs/namei.c
+@@ -3197,7 +3197,7 @@ static struct file *path_openat(int dfd, struct filename *pathname,
+
+ if (unlikely(file->f_flags & __O_TMPFILE)) {
+ error = do_tmpfile(dfd, pathname, nd, flags, op, file, &opened);
+- goto out;
++ goto out2;
+ }
+
+ error = path_init(dfd, pathname->name, flags | LOOKUP_PARENT, nd, &base);
+@@ -3235,6 +3235,7 @@ out:
+ path_put(&nd->root);
+ if (base)
+ fput(base);
++out2:
+ if (!(opened & FILE_OPENED)) {
+ BUG_ON(!error);
+ put_filp(file);
+diff --git a/fs/namespace.c b/fs/namespace.c
+index 07ba424181a5..8b60287a488b 100644
+--- a/fs/namespace.c
++++ b/fs/namespace.c
+@@ -1675,8 +1675,11 @@ struct vfsmount *collect_mounts(struct path *path)
+ {
+ struct mount *tree;
+ namespace_lock();
+- tree = copy_tree(real_mount(path->mnt), path->dentry,
+- CL_COPY_ALL | CL_PRIVATE);
++ if (!check_mnt(real_mount(path->mnt)))
++ tree = ERR_PTR(-EINVAL);
++ else
++ tree = copy_tree(real_mount(path->mnt), path->dentry,
++ CL_COPY_ALL | CL_PRIVATE);
+ namespace_unlock();
+ if (IS_ERR(tree))
+ return ERR_CAST(tree);
+@@ -3137,6 +3140,12 @@ bool fs_fully_visible(struct file_system_type *type)
+ if (mnt->mnt.mnt_sb->s_type != type)
+ continue;
+
++ /* This mount is not fully visible if it's root directory
++ * is not the root directory of the filesystem.
++ */
++ if (mnt->mnt.mnt_root != mnt->mnt.mnt_sb->s_root)
++ continue;
++
+ /* This mount is not fully visible if there are any child mounts
+ * that cover anything except for empty directories.
+ */
+diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
+index 4460d45ae138..58f98ad93828 100644
+--- a/fs/nfsd/nfs4state.c
++++ b/fs/nfsd/nfs4state.c
+@@ -4385,10 +4385,17 @@ static __be32 check_stateid_generation(stateid_t *in, stateid_t *ref, bool has_s
+ return nfserr_old_stateid;
+ }
+
++static __be32 nfsd4_check_openowner_confirmed(struct nfs4_ol_stateid *ols)
++{
++ if (ols->st_stateowner->so_is_open_owner &&
++ !(openowner(ols->st_stateowner)->oo_flags & NFS4_OO_CONFIRMED))
++ return nfserr_bad_stateid;
++ return nfs_ok;
++}
++
+ static __be32 nfsd4_validate_stateid(struct nfs4_client *cl, stateid_t *stateid)
+ {
+ struct nfs4_stid *s;
+- struct nfs4_ol_stateid *ols;
+ __be32 status = nfserr_bad_stateid;
+
+ if (ZERO_STATEID(stateid) || ONE_STATEID(stateid))
+@@ -4418,13 +4425,7 @@ static __be32 nfsd4_validate_stateid(struct nfs4_client *cl, stateid_t *stateid)
+ break;
+ case NFS4_OPEN_STID:
+ case NFS4_LOCK_STID:
+- ols = openlockstateid(s);
+- if (ols->st_stateowner->so_is_open_owner
+- && !(openowner(ols->st_stateowner)->oo_flags
+- & NFS4_OO_CONFIRMED))
+- status = nfserr_bad_stateid;
+- else
+- status = nfs_ok;
++ status = nfsd4_check_openowner_confirmed(openlockstateid(s));
+ break;
+ default:
+ printk("unknown stateid type %x\n", s->sc_type);
+@@ -4516,8 +4517,8 @@ nfs4_preprocess_stateid_op(struct net *net, struct nfsd4_compound_state *cstate,
+ status = nfs4_check_fh(current_fh, stp);
+ if (status)
+ goto out;
+- if (stp->st_stateowner->so_is_open_owner
+- && !(openowner(stp->st_stateowner)->oo_flags & NFS4_OO_CONFIRMED))
++ status = nfsd4_check_openowner_confirmed(stp);
++ if (status)
+ goto out;
+ status = nfs4_check_openmode(stp, flags);
+ if (status)
+diff --git a/fs/nilfs2/btree.c b/fs/nilfs2/btree.c
+index ecdbae19a766..090d8ce25bd1 100644
+--- a/fs/nilfs2/btree.c
++++ b/fs/nilfs2/btree.c
+@@ -388,7 +388,7 @@ static int nilfs_btree_root_broken(const struct nilfs_btree_node *node,
+ nchildren = nilfs_btree_node_get_nchildren(node);
+
+ if (unlikely(level < NILFS_BTREE_LEVEL_NODE_MIN ||
+- level > NILFS_BTREE_LEVEL_MAX ||
++ level >= NILFS_BTREE_LEVEL_MAX ||
+ nchildren < 0 ||
+ nchildren > NILFS_BTREE_ROOT_NCHILDREN_MAX)) {
+ pr_crit("NILFS: bad btree root (inode number=%lu): level = %d, flags = 0x%x, nchildren = %d\n",
+diff --git a/fs/ocfs2/dlm/dlmmaster.c b/fs/ocfs2/dlm/dlmmaster.c
+index 215e41abf101..9ec1eea7c3a3 100644
+--- a/fs/ocfs2/dlm/dlmmaster.c
++++ b/fs/ocfs2/dlm/dlmmaster.c
+@@ -765,6 +765,19 @@ lookup:
+ if (tmpres) {
+ spin_unlock(&dlm->spinlock);
+ spin_lock(&tmpres->spinlock);
++
++ /*
++ * Right after dlm spinlock was released, dlm_thread could have
++ * purged the lockres. Check if lockres got unhashed. If so
++ * start over.
++ */
++ if (hlist_unhashed(&tmpres->hash_node)) {
++ spin_unlock(&tmpres->spinlock);
++ dlm_lockres_put(tmpres);
++ tmpres = NULL;
++ goto lookup;
++ }
++
+ /* Wait on the thread that is mastering the resource */
+ if (tmpres->owner == DLM_LOCK_RES_OWNER_UNKNOWN) {
+ __dlm_wait_on_lockres(tmpres);
+diff --git a/fs/omfs/inode.c b/fs/omfs/inode.c
+index 138321b0c6c2..454111a3308e 100644
+--- a/fs/omfs/inode.c
++++ b/fs/omfs/inode.c
+@@ -306,7 +306,8 @@ static const struct super_operations omfs_sops = {
+ */
+ static int omfs_get_imap(struct super_block *sb)
+ {
+- unsigned int bitmap_size, count, array_size;
++ unsigned int bitmap_size, array_size;
++ int count;
+ struct omfs_sb_info *sbi = OMFS_SB(sb);
+ struct buffer_head *bh;
+ unsigned long **ptr;
+@@ -359,7 +360,7 @@ nomem:
+ }
+
+ enum {
+- Opt_uid, Opt_gid, Opt_umask, Opt_dmask, Opt_fmask
++ Opt_uid, Opt_gid, Opt_umask, Opt_dmask, Opt_fmask, Opt_err
+ };
+
+ static const match_table_t tokens = {
+@@ -368,6 +369,7 @@ static const match_table_t tokens = {
+ {Opt_umask, "umask=%o"},
+ {Opt_dmask, "dmask=%o"},
+ {Opt_fmask, "fmask=%o"},
++ {Opt_err, NULL},
+ };
+
+ static int parse_options(char *options, struct omfs_sb_info *sbi)
+diff --git a/fs/xfs/libxfs/xfs_attr_leaf.c b/fs/xfs/libxfs/xfs_attr_leaf.c
+index b1f73dbbf3d8..b7cd0a0541af 100644
+--- a/fs/xfs/libxfs/xfs_attr_leaf.c
++++ b/fs/xfs/libxfs/xfs_attr_leaf.c
+@@ -500,8 +500,8 @@ xfs_attr_shortform_add(xfs_da_args_t *args, int forkoff)
+ * After the last attribute is removed revert to original inode format,
+ * making all literal area available to the data fork once more.
+ */
+-STATIC void
+-xfs_attr_fork_reset(
++void
++xfs_attr_fork_remove(
+ struct xfs_inode *ip,
+ struct xfs_trans *tp)
+ {
+@@ -567,7 +567,7 @@ xfs_attr_shortform_remove(xfs_da_args_t *args)
+ (mp->m_flags & XFS_MOUNT_ATTR2) &&
+ (dp->i_d.di_format != XFS_DINODE_FMT_BTREE) &&
+ !(args->op_flags & XFS_DA_OP_ADDNAME)) {
+- xfs_attr_fork_reset(dp, args->trans);
++ xfs_attr_fork_remove(dp, args->trans);
+ } else {
+ xfs_idata_realloc(dp, -size, XFS_ATTR_FORK);
+ dp->i_d.di_forkoff = xfs_attr_shortform_bytesfit(dp, totsize);
+@@ -830,7 +830,7 @@ xfs_attr3_leaf_to_shortform(
+ if (forkoff == -1) {
+ ASSERT(dp->i_mount->m_flags & XFS_MOUNT_ATTR2);
+ ASSERT(dp->i_d.di_format != XFS_DINODE_FMT_BTREE);
+- xfs_attr_fork_reset(dp, args->trans);
++ xfs_attr_fork_remove(dp, args->trans);
+ goto out;
+ }
+
+diff --git a/fs/xfs/libxfs/xfs_attr_leaf.h b/fs/xfs/libxfs/xfs_attr_leaf.h
+index e2929da7c3ba..4f3a60aa93d4 100644
+--- a/fs/xfs/libxfs/xfs_attr_leaf.h
++++ b/fs/xfs/libxfs/xfs_attr_leaf.h
+@@ -53,7 +53,7 @@ int xfs_attr_shortform_remove(struct xfs_da_args *args);
+ int xfs_attr_shortform_list(struct xfs_attr_list_context *context);
+ int xfs_attr_shortform_allfit(struct xfs_buf *bp, struct xfs_inode *dp);
+ int xfs_attr_shortform_bytesfit(xfs_inode_t *dp, int bytes);
+-
++void xfs_attr_fork_remove(struct xfs_inode *ip, struct xfs_trans *tp);
+
+ /*
+ * Internal routines when attribute fork size == XFS_LBSIZE(mp).
+diff --git a/fs/xfs/xfs_attr_inactive.c b/fs/xfs/xfs_attr_inactive.c
+index aa2a8b1838a2..0687b67741b7 100644
+--- a/fs/xfs/xfs_attr_inactive.c
++++ b/fs/xfs/xfs_attr_inactive.c
+@@ -382,23 +382,31 @@ xfs_attr3_root_inactive(
+ return error;
+ }
+
++/*
++ * xfs_attr_inactive kills all traces of an attribute fork on an inode. It
++ * removes both the on-disk and in-memory inode fork. Note that this also has to
++ * handle the condition of inodes without attributes but with an attribute fork
++ * configured, so we can't use xfs_inode_hasattr() here.
++ *
++ * The in-memory attribute fork is removed even on error.
++ */
+ int
+-xfs_attr_inactive(xfs_inode_t *dp)
++xfs_attr_inactive(
++ struct xfs_inode *dp)
+ {
+- xfs_trans_t *trans;
+- xfs_mount_t *mp;
+- int error;
++ struct xfs_trans *trans;
++ struct xfs_mount *mp;
++ int cancel_flags = 0;
++ int lock_mode = XFS_ILOCK_SHARED;
++ int error = 0;
+
+ mp = dp->i_mount;
+ ASSERT(! XFS_NOT_DQATTACHED(mp, dp));
+
+- xfs_ilock(dp, XFS_ILOCK_SHARED);
+- if (!xfs_inode_hasattr(dp) ||
+- dp->i_d.di_aformat == XFS_DINODE_FMT_LOCAL) {
+- xfs_iunlock(dp, XFS_ILOCK_SHARED);
+- return 0;
+- }
+- xfs_iunlock(dp, XFS_ILOCK_SHARED);
++ xfs_ilock(dp, lock_mode);
++ if (!XFS_IFORK_Q(dp))
++ goto out_destroy_fork;
++ xfs_iunlock(dp, lock_mode);
+
+ /*
+ * Start our first transaction of the day.
+@@ -410,13 +418,18 @@ xfs_attr_inactive(xfs_inode_t *dp)
+ * the inode in every transaction to let it float upward through
+ * the log.
+ */
++ lock_mode = 0;
+ trans = xfs_trans_alloc(mp, XFS_TRANS_ATTRINVAL);
+ error = xfs_trans_reserve(trans, &M_RES(mp)->tr_attrinval, 0, 0);
+- if (error) {
+- xfs_trans_cancel(trans, 0);
+- return error;
+- }
+- xfs_ilock(dp, XFS_ILOCK_EXCL);
++ if (error)
++ goto out_cancel;
++
++ lock_mode = XFS_ILOCK_EXCL;
++ cancel_flags = XFS_TRANS_RELEASE_LOG_RES | XFS_TRANS_ABORT;
++ xfs_ilock(dp, lock_mode);
++
++ if (!XFS_IFORK_Q(dp))
++ goto out_cancel;
+
+ /*
+ * No need to make quota reservations here. We expect to release some
+@@ -424,29 +437,31 @@ xfs_attr_inactive(xfs_inode_t *dp)
+ */
+ xfs_trans_ijoin(trans, dp, 0);
+
+- /*
+- * Decide on what work routines to call based on the inode size.
+- */
+- if (!xfs_inode_hasattr(dp) ||
+- dp->i_d.di_aformat == XFS_DINODE_FMT_LOCAL) {
+- error = 0;
+- goto out;
++ /* invalidate and truncate the attribute fork extents */
++ if (dp->i_d.di_aformat != XFS_DINODE_FMT_LOCAL) {
++ error = xfs_attr3_root_inactive(&trans, dp);
++ if (error)
++ goto out_cancel;
++
++ error = xfs_itruncate_extents(&trans, dp, XFS_ATTR_FORK, 0);
++ if (error)
++ goto out_cancel;
+ }
+- error = xfs_attr3_root_inactive(&trans, dp);
+- if (error)
+- goto out;
+
+- error = xfs_itruncate_extents(&trans, dp, XFS_ATTR_FORK, 0);
+- if (error)
+- goto out;
++ /* Reset the attribute fork - this also destroys the in-core fork */
++ xfs_attr_fork_remove(dp, trans);
+
+ error = xfs_trans_commit(trans, XFS_TRANS_RELEASE_LOG_RES);
+- xfs_iunlock(dp, XFS_ILOCK_EXCL);
+-
++ xfs_iunlock(dp, lock_mode);
+ return error;
+
+-out:
+- xfs_trans_cancel(trans, XFS_TRANS_RELEASE_LOG_RES|XFS_TRANS_ABORT);
+- xfs_iunlock(dp, XFS_ILOCK_EXCL);
++out_cancel:
++ xfs_trans_cancel(trans, cancel_flags);
++out_destroy_fork:
++ /* kill the in-core attr fork before we drop the inode lock */
++ if (dp->i_afp)
++ xfs_idestroy_fork(dp, XFS_ATTR_FORK);
++ if (lock_mode)
++ xfs_iunlock(dp, lock_mode);
+ return error;
+ }
+diff --git a/fs/xfs/xfs_file.c b/fs/xfs/xfs_file.c
+index b28f0d680cb5..ba8b158a618a 100644
+--- a/fs/xfs/xfs_file.c
++++ b/fs/xfs/xfs_file.c
+@@ -127,7 +127,7 @@ xfs_iozero(
+ status = 0;
+ } while (count);
+
+- return (-status);
++ return status;
+ }
+
+ /*
+diff --git a/fs/xfs/xfs_inode.c b/fs/xfs/xfs_inode.c
+index 3cc309a19ea8..32e95c76cbd0 100644
+--- a/fs/xfs/xfs_inode.c
++++ b/fs/xfs/xfs_inode.c
+@@ -1894,21 +1894,17 @@ xfs_inactive(
+ /*
+ * If there are attributes associated with the file then blow them away
+ * now. The code calls a routine that recursively deconstructs the
+- * attribute fork. We need to just commit the current transaction
+- * because we can't use it for xfs_attr_inactive().
++ * attribute fork. If also blows away the in-core attribute fork.
+ */
+- if (ip->i_d.di_anextents > 0) {
+- ASSERT(ip->i_d.di_forkoff != 0);
+-
++ if (XFS_IFORK_Q(ip)) {
+ error = xfs_attr_inactive(ip);
+ if (error)
+ return;
+ }
+
+- if (ip->i_afp)
+- xfs_idestroy_fork(ip, XFS_ATTR_FORK);
+-
++ ASSERT(!ip->i_afp);
+ ASSERT(ip->i_d.di_anextents == 0);
++ ASSERT(ip->i_d.di_forkoff == 0);
+
+ /*
+ * Free the inode.
+diff --git a/include/acpi/acpixf.h b/include/acpi/acpixf.h
+index ab2acf629a64..0747006ba2b0 100644
+--- a/include/acpi/acpixf.h
++++ b/include/acpi/acpixf.h
+@@ -431,13 +431,13 @@ ACPI_EXTERNAL_RETURN_STATUS(acpi_status __init acpi_load_tables(void))
+ ACPI_EXTERNAL_RETURN_STATUS(acpi_status __init acpi_reallocate_root_table(void))
+
+ ACPI_EXTERNAL_RETURN_STATUS(acpi_status __init
+- acpi_find_root_pointer(acpi_size * rsdp_address))
+-
++ acpi_find_root_pointer(acpi_physical_address *
++ rsdp_address))
+ ACPI_EXTERNAL_RETURN_STATUS(acpi_status
+- acpi_get_table_header(acpi_string signature,
+- u32 instance,
+- struct acpi_table_header
+- *out_table_header))
++ acpi_get_table_header(acpi_string signature,
++ u32 instance,
++ struct acpi_table_header
++ *out_table_header))
+ ACPI_EXTERNAL_RETURN_STATUS(acpi_status
+ acpi_get_table(acpi_string signature, u32 instance,
+ struct acpi_table_header
+diff --git a/include/drm/drm_pciids.h b/include/drm/drm_pciids.h
+index 2dd405c9be78..45c39a37f924 100644
+--- a/include/drm/drm_pciids.h
++++ b/include/drm/drm_pciids.h
+@@ -186,6 +186,7 @@
+ {0x1002, 0x6658, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_BONAIRE|RADEON_NEW_MEMMAP}, \
+ {0x1002, 0x665c, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_BONAIRE|RADEON_NEW_MEMMAP}, \
+ {0x1002, 0x665d, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_BONAIRE|RADEON_NEW_MEMMAP}, \
++ {0x1002, 0x665f, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_BONAIRE|RADEON_NEW_MEMMAP}, \
+ {0x1002, 0x6660, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_HAINAN|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
+ {0x1002, 0x6663, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_HAINAN|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
+ {0x1002, 0x6664, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_HAINAN|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
+diff --git a/include/linux/ktime.h b/include/linux/ktime.h
+index c9d645ad98ff..039bbe5f59df 100644
+--- a/include/linux/ktime.h
++++ b/include/linux/ktime.h
+@@ -166,9 +166,34 @@ static inline bool ktime_before(const ktime_t cmp1, const ktime_t cmp2)
+ }
+
+ #if BITS_PER_LONG < 64
+-extern u64 ktime_divns(const ktime_t kt, s64 div);
++extern s64 __ktime_divns(const ktime_t kt, s64 div);
++static inline s64 ktime_divns(const ktime_t kt, s64 div)
++{
++ /*
++ * Negative divisors could cause an inf loop,
++ * so bug out here.
++ */
++ BUG_ON(div < 0);
++ if (__builtin_constant_p(div) && !(div >> 32)) {
++ s64 ns = kt.tv64;
++ u64 tmp = ns < 0 ? -ns : ns;
++
++ do_div(tmp, div);
++ return ns < 0 ? -tmp : tmp;
++ } else {
++ return __ktime_divns(kt, div);
++ }
++}
+ #else /* BITS_PER_LONG < 64 */
+-# define ktime_divns(kt, div) (u64)((kt).tv64 / (div))
++static inline s64 ktime_divns(const ktime_t kt, s64 div)
++{
++ /*
++ * 32-bit implementation cannot handle negative divisors,
++ * so catch them on 64bit as well.
++ */
++ WARN_ON(div < 0);
++ return kt.tv64 / div;
++}
+ #endif
+
+ static inline s64 ktime_to_us(const ktime_t kt)
+diff --git a/include/linux/libata.h b/include/linux/libata.h
+index fe0bf8dc83bb..b3a816f4c0c4 100644
+--- a/include/linux/libata.h
++++ b/include/linux/libata.h
+@@ -204,6 +204,7 @@ enum {
+ ATA_LFLAG_SW_ACTIVITY = (1 << 7), /* keep activity stats */
+ ATA_LFLAG_NO_LPM = (1 << 8), /* disable LPM on this link */
+ ATA_LFLAG_RST_ONCE = (1 << 9), /* limit recovery to one reset */
++ ATA_LFLAG_CHANGED = (1 << 10), /* LPM state changed on this link */
+
+ /* struct ata_port flags */
+ ATA_FLAG_SLAVE_POSS = (1 << 0), /* host supports slave dev */
+@@ -308,6 +309,12 @@ enum {
+ */
+ ATA_TMOUT_PMP_SRST_WAIT = 5000,
+
++ /* When the LPM policy is set to ATA_LPM_MAX_POWER, there might
++ * be a spurious PHY event, so ignore the first PHY event that
++ * occurs within 10s after the policy change.
++ */
++ ATA_TMOUT_SPURIOUS_PHY = 10000,
++
+ /* ATA bus states */
+ BUS_UNKNOWN = 0,
+ BUS_DMA = 1,
+@@ -786,6 +793,8 @@ struct ata_link {
+ struct ata_eh_context eh_context;
+
+ struct ata_device device[ATA_MAX_DEVICES];
++
++ unsigned long last_lpm_change; /* when last LPM change happened */
+ };
+ #define ATA_LINK_CLEAR_BEGIN offsetof(struct ata_link, active_tag)
+ #define ATA_LINK_CLEAR_END offsetof(struct ata_link, device[0])
+@@ -1199,6 +1208,7 @@ extern struct ata_device *ata_dev_pair(struct ata_device *adev);
+ extern int ata_do_set_mode(struct ata_link *link, struct ata_device **r_failed_dev);
+ extern void ata_scsi_port_error_handler(struct Scsi_Host *host, struct ata_port *ap);
+ extern void ata_scsi_cmd_error_handler(struct Scsi_Host *host, struct ata_port *ap, struct list_head *eh_q);
++extern bool sata_lpm_ignore_phy_events(struct ata_link *link);
+
+ extern int ata_cable_40wire(struct ata_port *ap);
+ extern int ata_cable_80wire(struct ata_port *ap);
+diff --git a/include/linux/nilfs2_fs.h b/include/linux/nilfs2_fs.h
+index ff3fea3194c6..9abb763e4b86 100644
+--- a/include/linux/nilfs2_fs.h
++++ b/include/linux/nilfs2_fs.h
+@@ -460,7 +460,7 @@ struct nilfs_btree_node {
+ /* level */
+ #define NILFS_BTREE_LEVEL_DATA 0
+ #define NILFS_BTREE_LEVEL_NODE_MIN (NILFS_BTREE_LEVEL_DATA + 1)
+-#define NILFS_BTREE_LEVEL_MAX 14
++#define NILFS_BTREE_LEVEL_MAX 14 /* Max level (exclusive) */
+
+ /**
+ * struct nilfs_palloc_group_desc - block group descriptor
+diff --git a/include/linux/sched/rt.h b/include/linux/sched/rt.h
+index 6341f5be6e24..a30b172df6e1 100644
+--- a/include/linux/sched/rt.h
++++ b/include/linux/sched/rt.h
+@@ -18,7 +18,7 @@ static inline int rt_task(struct task_struct *p)
+ #ifdef CONFIG_RT_MUTEXES
+ extern int rt_mutex_getprio(struct task_struct *p);
+ extern void rt_mutex_setprio(struct task_struct *p, int prio);
+-extern int rt_mutex_check_prio(struct task_struct *task, int newprio);
++extern int rt_mutex_get_effective_prio(struct task_struct *task, int newprio);
+ extern struct task_struct *rt_mutex_get_top_task(struct task_struct *task);
+ extern void rt_mutex_adjust_pi(struct task_struct *p);
+ static inline bool tsk_is_pi_blocked(struct task_struct *tsk)
+@@ -31,9 +31,10 @@ static inline int rt_mutex_getprio(struct task_struct *p)
+ return p->normal_prio;
+ }
+
+-static inline int rt_mutex_check_prio(struct task_struct *task, int newprio)
++static inline int rt_mutex_get_effective_prio(struct task_struct *task,
++ int newprio)
+ {
+- return 0;
++ return newprio;
+ }
+
+ static inline struct task_struct *rt_mutex_get_top_task(struct task_struct *task)
+diff --git a/include/net/dst.h b/include/net/dst.h
+index a8ae4e760778..0fb99a26e973 100644
+--- a/include/net/dst.h
++++ b/include/net/dst.h
+@@ -481,6 +481,7 @@ void dst_init(void);
+ enum {
+ XFRM_LOOKUP_ICMP = 1 << 0,
+ XFRM_LOOKUP_QUEUE = 1 << 1,
++ XFRM_LOOKUP_KEEP_DST_REF = 1 << 2,
+ };
+
+ struct flowi;
+diff --git a/include/xen/events.h b/include/xen/events.h
+index 5321cd9636e6..7d95fdf9cf3e 100644
+--- a/include/xen/events.h
++++ b/include/xen/events.h
+@@ -17,7 +17,7 @@ int bind_evtchn_to_irqhandler(unsigned int evtchn,
+ irq_handler_t handler,
+ unsigned long irqflags, const char *devname,
+ void *dev_id);
+-int bind_virq_to_irq(unsigned int virq, unsigned int cpu);
++int bind_virq_to_irq(unsigned int virq, unsigned int cpu, bool percpu);
+ int bind_virq_to_irqhandler(unsigned int virq, unsigned int cpu,
+ irq_handler_t handler,
+ unsigned long irqflags, const char *devname,
+diff --git a/kernel/locking/rtmutex.c b/kernel/locking/rtmutex.c
+index 41d53e515914..1929ee2291f2 100644
+--- a/kernel/locking/rtmutex.c
++++ b/kernel/locking/rtmutex.c
+@@ -265,15 +265,17 @@ struct task_struct *rt_mutex_get_top_task(struct task_struct *task)
+ }
+
+ /*
+- * Called by sched_setscheduler() to check whether the priority change
+- * is overruled by a possible priority boosting.
++ * Called by sched_setscheduler() to get the priority which will be
++ * effective after the change.
+ */
+-int rt_mutex_check_prio(struct task_struct *task, int newprio)
++int rt_mutex_get_effective_prio(struct task_struct *task, int newprio)
+ {
+ if (!task_has_pi_waiters(task))
+- return 0;
++ return newprio;
+
+- return task_top_pi_waiter(task)->task->prio <= newprio;
++ if (task_top_pi_waiter(task)->task->prio <= newprio)
++ return task_top_pi_waiter(task)->task->prio;
++ return newprio;
+ }
+
+ /*
+diff --git a/kernel/module.c b/kernel/module.c
+index 88cec1ddb1e3..c353707bbbd5 100644
+--- a/kernel/module.c
++++ b/kernel/module.c
+@@ -3307,6 +3307,9 @@ static int load_module(struct load_info *info, const char __user *uargs,
+ module_bug_cleanup(mod);
+ mutex_unlock(&module_mutex);
+
++ blocking_notifier_call_chain(&module_notify_list,
++ MODULE_STATE_GOING, mod);
++
+ /* we can't deallocate the module until we clear memory protection */
+ unset_module_init_ro_nx(mod);
+ unset_module_core_ro_nx(mod);
+diff --git a/kernel/sched/core.c b/kernel/sched/core.c
+index b794bde3f5e1..6810e572eda5 100644
+--- a/kernel/sched/core.c
++++ b/kernel/sched/core.c
+@@ -3327,15 +3327,18 @@ static void __setscheduler_params(struct task_struct *p,
+
+ /* Actually do priority change: must hold pi & rq lock. */
+ static void __setscheduler(struct rq *rq, struct task_struct *p,
+- const struct sched_attr *attr)
++ const struct sched_attr *attr, bool keep_boost)
+ {
+ __setscheduler_params(p, attr);
+
+ /*
+- * If we get here, there was no pi waiters boosting the
+- * task. It is safe to use the normal prio.
++ * Keep a potential priority boosting if called from
++ * sched_setscheduler().
+ */
+- p->prio = normal_prio(p);
++ if (keep_boost)
++ p->prio = rt_mutex_get_effective_prio(p, normal_prio(p));
++ else
++ p->prio = normal_prio(p);
+
+ if (dl_prio(p->prio))
+ p->sched_class = &dl_sched_class;
+@@ -3421,7 +3424,7 @@ static int __sched_setscheduler(struct task_struct *p,
+ int newprio = dl_policy(attr->sched_policy) ? MAX_DL_PRIO - 1 :
+ MAX_RT_PRIO - 1 - attr->sched_priority;
+ int retval, oldprio, oldpolicy = -1, queued, running;
+- int policy = attr->sched_policy;
++ int new_effective_prio, policy = attr->sched_policy;
+ unsigned long flags;
+ const struct sched_class *prev_class;
+ struct rq *rq;
+@@ -3603,15 +3606,14 @@ change:
+ oldprio = p->prio;
+
+ /*
+- * Special case for priority boosted tasks.
+- *
+- * If the new priority is lower or equal (user space view)
+- * than the current (boosted) priority, we just store the new
++ * Take priority boosted tasks into account. If the new
++ * effective priority is unchanged, we just store the new
+ * normal parameters and do not touch the scheduler class and
+ * the runqueue. This will be done when the task deboost
+ * itself.
+ */
+- if (rt_mutex_check_prio(p, newprio)) {
++ new_effective_prio = rt_mutex_get_effective_prio(p, newprio);
++ if (new_effective_prio == oldprio) {
+ __setscheduler_params(p, attr);
+ task_rq_unlock(rq, p, &flags);
+ return 0;
+@@ -3625,7 +3627,7 @@ change:
+ put_prev_task(rq, p);
+
+ prev_class = p->sched_class;
+- __setscheduler(rq, p, attr);
++ __setscheduler(rq, p, attr, true);
+
+ if (running)
+ p->sched_class->set_curr_task(rq);
+@@ -7237,7 +7239,7 @@ static void normalize_task(struct rq *rq, struct task_struct *p)
+ queued = task_on_rq_queued(p);
+ if (queued)
+ dequeue_task(rq, p, 0);
+- __setscheduler(rq, p, &attr);
++ __setscheduler(rq, p, &attr, false);
+ if (queued) {
+ enqueue_task(rq, p, 0);
+ resched_curr(rq);
+diff --git a/kernel/time/hrtimer.c b/kernel/time/hrtimer.c
+index d8c724cda37b..210b84882935 100644
+--- a/kernel/time/hrtimer.c
++++ b/kernel/time/hrtimer.c
+@@ -266,23 +266,25 @@ lock_hrtimer_base(const struct hrtimer *timer, unsigned long *flags)
+ /*
+ * Divide a ktime value by a nanosecond value
+ */
+-u64 ktime_divns(const ktime_t kt, s64 div)
++s64 __ktime_divns(const ktime_t kt, s64 div)
+ {
+- u64 dclc;
+ int sft = 0;
++ s64 dclc;
++ u64 tmp;
+
+ dclc = ktime_to_ns(kt);
++ tmp = dclc < 0 ? -dclc : dclc;
++
+ /* Make sure the divisor is less than 2^32: */
+ while (div >> 32) {
+ sft++;
+ div >>= 1;
+ }
+- dclc >>= sft;
+- do_div(dclc, (unsigned long) div);
+-
+- return dclc;
++ tmp >>= sft;
++ do_div(tmp, (unsigned long) div);
++ return dclc < 0 ? -tmp : tmp;
+ }
+-EXPORT_SYMBOL_GPL(ktime_divns);
++EXPORT_SYMBOL_GPL(__ktime_divns);
+ #endif /* BITS_PER_LONG >= 64 */
+
+ /*
+diff --git a/lib/strnlen_user.c b/lib/strnlen_user.c
+index a28df5206d95..11649615c505 100644
+--- a/lib/strnlen_user.c
++++ b/lib/strnlen_user.c
+@@ -57,7 +57,8 @@ static inline long do_strnlen_user(const char __user *src, unsigned long count,
+ return res + find_zero(data) + 1 - align;
+ }
+ res += sizeof(unsigned long);
+- if (unlikely(max < sizeof(unsigned long)))
++ /* We already handled 'unsigned long' bytes. Did we do it all ? */
++ if (unlikely(max <= sizeof(unsigned long)))
+ break;
+ max -= sizeof(unsigned long);
+ if (unlikely(__get_user(c,(unsigned long __user *)(src+res))))
+diff --git a/mm/memory-failure.c b/mm/memory-failure.c
+index 3415e7ad3973..22f047fbaa33 100644
+--- a/mm/memory-failure.c
++++ b/mm/memory-failure.c
+@@ -1153,10 +1153,10 @@ int memory_failure(unsigned long pfn, int trapno, int flags)
+ * The check (unnecessarily) ignores LRU pages being isolated and
+ * walked by the page reclaim code, however that's not a big loss.
+ */
+- if (!PageHuge(p) && !PageTransTail(p)) {
+- if (!PageLRU(p))
+- shake_page(p, 0);
+- if (!PageLRU(p)) {
++ if (!PageHuge(p)) {
++ if (!PageLRU(hpage))
++ shake_page(hpage, 0);
++ if (!PageLRU(hpage)) {
+ /*
+ * shake_page could have turned it free.
+ */
+@@ -1733,12 +1733,12 @@ int soft_offline_page(struct page *page, int flags)
+ } else if (ret == 0) { /* for free pages */
+ if (PageHuge(page)) {
+ set_page_hwpoison_huge_page(hpage);
+- dequeue_hwpoisoned_huge_page(hpage);
+- atomic_long_add(1 << compound_order(hpage),
++ if (!dequeue_hwpoisoned_huge_page(hpage))
++ atomic_long_add(1 << compound_order(hpage),
+ &num_poisoned_pages);
+ } else {
+- SetPageHWPoison(page);
+- atomic_long_inc(&num_poisoned_pages);
++ if (!TestSetPageHWPoison(page))
++ atomic_long_inc(&num_poisoned_pages);
+ }
+ }
+ unset_migratetype_isolate(page, MIGRATE_MOVABLE);
+diff --git a/mm/mempolicy.c b/mm/mempolicy.c
+index e58725aff7e9..39198cb78c6f 100644
+--- a/mm/mempolicy.c
++++ b/mm/mempolicy.c
+@@ -2548,7 +2548,7 @@ static void __init check_numabalancing_enable(void)
+ if (numabalancing_override)
+ set_numabalancing_state(numabalancing_override == 1);
+
+- if (nr_node_ids > 1 && !numabalancing_override) {
++ if (num_online_nodes() > 1 && !numabalancing_override) {
+ pr_info("%s automatic NUMA balancing. "
+ "Configure with numa_balancing= or the "
+ "kernel.numa_balancing sysctl",
+diff --git a/mm/page-writeback.c b/mm/page-writeback.c
+index c8abd208432d..b9aaa16dcf85 100644
+--- a/mm/page-writeback.c
++++ b/mm/page-writeback.c
+@@ -580,7 +580,7 @@ static long long pos_ratio_polynom(unsigned long setpoint,
+ long x;
+
+ x = div64_s64(((s64)setpoint - (s64)dirty) << RATELIMIT_CALC_SHIFT,
+- limit - setpoint + 1);
++ (limit - setpoint) | 1);
+ pos_ratio = x;
+ pos_ratio = pos_ratio * x >> RATELIMIT_CALC_SHIFT;
+ pos_ratio = pos_ratio * x >> RATELIMIT_CALC_SHIFT;
+@@ -807,7 +807,7 @@ static unsigned long bdi_position_ratio(struct backing_dev_info *bdi,
+ * scale global setpoint to bdi's:
+ * bdi_setpoint = setpoint * bdi_thresh / thresh
+ */
+- x = div_u64((u64)bdi_thresh << 16, thresh + 1);
++ x = div_u64((u64)bdi_thresh << 16, thresh | 1);
+ bdi_setpoint = setpoint * (u64)x >> 16;
+ /*
+ * Use span=(8*write_bw) in single bdi case as indicated by
+@@ -822,7 +822,7 @@ static unsigned long bdi_position_ratio(struct backing_dev_info *bdi,
+
+ if (bdi_dirty < x_intercept - span / 4) {
+ pos_ratio = div64_u64(pos_ratio * (x_intercept - bdi_dirty),
+- x_intercept - bdi_setpoint + 1);
++ (x_intercept - bdi_setpoint) | 1);
+ } else
+ pos_ratio /= 4;
+
+diff --git a/net/ceph/osd_client.c b/net/ceph/osd_client.c
+index b0cf1f287aed..e242f96550bd 100644
+--- a/net/ceph/osd_client.c
++++ b/net/ceph/osd_client.c
+@@ -1263,8 +1263,6 @@ static void __unregister_linger_request(struct ceph_osd_client *osdc,
+ if (list_empty(&req->r_osd_item))
+ req->r_osd = NULL;
+ }
+-
+- list_del_init(&req->r_req_lru_item); /* can be on notarget */
+ ceph_osdc_put_request(req);
+ }
+
+@@ -1974,20 +1972,29 @@ static void kick_requests(struct ceph_osd_client *osdc, bool force_resend,
+ err = __map_request(osdc, req,
+ force_resend || force_resend_writes);
+ dout("__map_request returned %d\n", err);
+- if (err == 0)
+- continue; /* no change and no osd was specified */
+ if (err < 0)
+ continue; /* hrm! */
+- if (req->r_osd == NULL) {
+- dout("tid %llu maps to no valid osd\n", req->r_tid);
+- needmap++; /* request a newer map */
+- continue;
+- }
++ if (req->r_osd == NULL || err > 0) {
++ if (req->r_osd == NULL) {
++ dout("lingering %p tid %llu maps to no osd\n",
++ req, req->r_tid);
++ /*
++ * A homeless lingering request makes
++ * no sense, as it's job is to keep
++ * a particular OSD connection open.
++ * Request a newer map and kick the
++ * request, knowing that it won't be
++ * resent until we actually get a map
++ * that can tell us where to send it.
++ */
++ needmap++;
++ }
+
+- dout("kicking lingering %p tid %llu osd%d\n", req, req->r_tid,
+- req->r_osd ? req->r_osd->o_osd : -1);
+- __register_request(osdc, req);
+- __unregister_linger_request(osdc, req);
++ dout("kicking lingering %p tid %llu osd%d\n", req,
++ req->r_tid, req->r_osd ? req->r_osd->o_osd : -1);
++ __register_request(osdc, req);
++ __unregister_linger_request(osdc, req);
++ }
+ }
+ reset_changed_osds(osdc);
+ mutex_unlock(&osdc->request_mutex);
+diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
+index 91c1aca65ae9..aed656d18b23 100644
+--- a/net/mac80211/ieee80211_i.h
++++ b/net/mac80211/ieee80211_i.h
+@@ -204,6 +204,8 @@ enum ieee80211_packet_rx_flags {
+ * @IEEE80211_RX_CMNTR: received on cooked monitor already
+ * @IEEE80211_RX_BEACON_REPORTED: This frame was already reported
+ * to cfg80211_report_obss_beacon().
++ * @IEEE80211_RX_REORDER_TIMER: this frame is released by the
++ * reorder buffer timeout timer, not the normal RX path
+ *
+ * These flags are used across handling multiple interfaces
+ * for a single frame.
+@@ -211,6 +213,7 @@ enum ieee80211_packet_rx_flags {
+ enum ieee80211_rx_flags {
+ IEEE80211_RX_CMNTR = BIT(0),
+ IEEE80211_RX_BEACON_REPORTED = BIT(1),
++ IEEE80211_RX_REORDER_TIMER = BIT(2),
+ };
+
+ struct ieee80211_rx_data {
+diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
+index 631d59f540d1..a578c5717112 100644
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -2000,7 +2000,8 @@ ieee80211_deliver_skb(struct ieee80211_rx_data *rx)
+ /* deliver to local stack */
+ skb->protocol = eth_type_trans(skb, dev);
+ memset(skb->cb, 0, sizeof(skb->cb));
+- if (rx->local->napi)
++ if (!(rx->flags & IEEE80211_RX_REORDER_TIMER) &&
++ rx->local->napi)
+ napi_gro_receive(rx->local->napi, skb);
+ else
+ netif_receive_skb(skb);
+@@ -3070,7 +3071,7 @@ void ieee80211_release_reorder_timeout(struct sta_info *sta, int tid)
+ /* This is OK -- must be QoS data frame */
+ .security_idx = tid,
+ .seqno_idx = tid,
+- .flags = 0,
++ .flags = IEEE80211_RX_REORDER_TIMER,
+ };
+ struct tid_ampdu_rx *tid_agg_rx;
+
+diff --git a/net/mac80211/wep.c b/net/mac80211/wep.c
+index 9181fb6d6437..837b7b1bb310 100644
+--- a/net/mac80211/wep.c
++++ b/net/mac80211/wep.c
+@@ -98,8 +98,7 @@ static u8 *ieee80211_wep_add_iv(struct ieee80211_local *local,
+
+ hdr->frame_control |= cpu_to_le16(IEEE80211_FCTL_PROTECTED);
+
+- if (WARN_ON(skb_tailroom(skb) < IEEE80211_WEP_ICV_LEN ||
+- skb_headroom(skb) < IEEE80211_WEP_IV_LEN))
++ if (WARN_ON(skb_headroom(skb) < IEEE80211_WEP_IV_LEN))
+ return NULL;
+
+ hdrlen = ieee80211_hdrlen(hdr->frame_control);
+@@ -169,6 +168,9 @@ int ieee80211_wep_encrypt(struct ieee80211_local *local,
+ size_t len;
+ u8 rc4key[3 + WLAN_KEY_LEN_WEP104];
+
++ if (WARN_ON(skb_tailroom(skb) < IEEE80211_WEP_ICV_LEN))
++ return -1;
++
+ iv = ieee80211_wep_add_iv(local, skb, keylen, keyidx);
+ if (!iv)
+ return -1;
+diff --git a/net/sunrpc/auth_gss/gss_rpc_xdr.c b/net/sunrpc/auth_gss/gss_rpc_xdr.c
+index 1ec19f6f0c2b..eeeba5adee6d 100644
+--- a/net/sunrpc/auth_gss/gss_rpc_xdr.c
++++ b/net/sunrpc/auth_gss/gss_rpc_xdr.c
+@@ -793,20 +793,26 @@ int gssx_dec_accept_sec_context(struct rpc_rqst *rqstp,
+ {
+ u32 value_follows;
+ int err;
++ struct page *scratch;
++
++ scratch = alloc_page(GFP_KERNEL);
++ if (!scratch)
++ return -ENOMEM;
++ xdr_set_scratch_buffer(xdr, page_address(scratch), PAGE_SIZE);
+
+ /* res->status */
+ err = gssx_dec_status(xdr, &res->status);
+ if (err)
+- return err;
++ goto out_free;
+
+ /* res->context_handle */
+ err = gssx_dec_bool(xdr, &value_follows);
+ if (err)
+- return err;
++ goto out_free;
+ if (value_follows) {
+ err = gssx_dec_ctx(xdr, res->context_handle);
+ if (err)
+- return err;
++ goto out_free;
+ } else {
+ res->context_handle = NULL;
+ }
+@@ -814,11 +820,11 @@ int gssx_dec_accept_sec_context(struct rpc_rqst *rqstp,
+ /* res->output_token */
+ err = gssx_dec_bool(xdr, &value_follows);
+ if (err)
+- return err;
++ goto out_free;
+ if (value_follows) {
+ err = gssx_dec_buffer(xdr, res->output_token);
+ if (err)
+- return err;
++ goto out_free;
+ } else {
+ res->output_token = NULL;
+ }
+@@ -826,14 +832,17 @@ int gssx_dec_accept_sec_context(struct rpc_rqst *rqstp,
+ /* res->delegated_cred_handle */
+ err = gssx_dec_bool(xdr, &value_follows);
+ if (err)
+- return err;
++ goto out_free;
+ if (value_follows) {
+ /* we do not support upcall servers sending this data. */
+- return -EINVAL;
++ err = -EINVAL;
++ goto out_free;
+ }
+
+ /* res->options */
+ err = gssx_dec_option_array(xdr, &res->options);
+
++out_free:
++ __free_page(scratch);
+ return err;
+ }
+diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
+index 88bf289abdc9..f62fd2c5d836 100644
+--- a/net/xfrm/xfrm_policy.c
++++ b/net/xfrm/xfrm_policy.c
+@@ -2264,11 +2264,9 @@ struct dst_entry *xfrm_lookup(struct net *net, struct dst_entry *dst_orig,
+ * have the xfrm_state's. We need to wait for KM to
+ * negotiate new SA's or bail out with error.*/
+ if (net->xfrm.sysctl_larval_drop) {
+- dst_release(dst);
+- xfrm_pols_put(pols, drop_pols);
+ XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTNOSTATES);
+-
+- return ERR_PTR(-EREMOTE);
++ err = -EREMOTE;
++ goto error;
+ }
+
+ err = -EAGAIN;
+@@ -2319,7 +2317,8 @@ nopol:
+ error:
+ dst_release(dst);
+ dropdst:
+- dst_release(dst_orig);
++ if (!(flags & XFRM_LOOKUP_KEEP_DST_REF))
++ dst_release(dst_orig);
+ xfrm_pols_put(pols, drop_pols);
+ return ERR_PTR(err);
+ }
+@@ -2333,7 +2332,8 @@ struct dst_entry *xfrm_lookup_route(struct net *net, struct dst_entry *dst_orig,
+ struct sock *sk, int flags)
+ {
+ struct dst_entry *dst = xfrm_lookup(net, dst_orig, fl, sk,
+- flags | XFRM_LOOKUP_QUEUE);
++ flags | XFRM_LOOKUP_QUEUE |
++ XFRM_LOOKUP_KEEP_DST_REF);
+
+ if (IS_ERR(dst) && PTR_ERR(dst) == -EREMOTE)
+ return make_blackhole(net, dst_orig->ops->family, dst_orig);
+diff --git a/sound/oss/sequencer.c b/sound/oss/sequencer.c
+index c0eea1dfe90f..f19da4b47c1d 100644
+--- a/sound/oss/sequencer.c
++++ b/sound/oss/sequencer.c
+@@ -681,13 +681,8 @@ static int seq_timing_event(unsigned char *event_rec)
+ break;
+
+ case TMR_ECHO:
+- if (seq_mode == SEQ_2)
+- seq_copy_to_input(event_rec, 8);
+- else
+- {
+- parm = (parm << 8 | SEQ_ECHO);
+- seq_copy_to_input((unsigned char *) &parm, 4);
+- }
++ parm = (parm << 8 | SEQ_ECHO);
++ seq_copy_to_input((unsigned char *) &parm, 4);
+ break;
+
+ default:;
+@@ -1324,7 +1319,6 @@ int sequencer_ioctl(int dev, struct file *file, unsigned int cmd, void __user *a
+ int mode = translate_mode(file);
+ struct synth_info inf;
+ struct seq_event_rec event_rec;
+- unsigned long flags;
+ int __user *p = arg;
+
+ orig_dev = dev = dev >> 4;
+@@ -1479,9 +1473,7 @@ int sequencer_ioctl(int dev, struct file *file, unsigned int cmd, void __user *a
+ case SNDCTL_SEQ_OUTOFBAND:
+ if (copy_from_user(&event_rec, arg, sizeof(event_rec)))
+ return -EFAULT;
+- spin_lock_irqsave(&lock,flags);
+ play_event(event_rec.arr);
+- spin_unlock_irqrestore(&lock,flags);
+ return 0;
+
+ case SNDCTL_MIDI_INFO:
+diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
+index 8413797ba38d..ddfc8a891db4 100644
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -272,43 +272,52 @@ enum {
+ AZX_NUM_DRIVERS, /* keep this as last entry */
+ };
+
++#define azx_get_snoop_type(chip) \
++ (((chip)->driver_caps & AZX_DCAPS_SNOOP_MASK) >> 10)
++#define AZX_DCAPS_SNOOP_TYPE(type) ((AZX_SNOOP_TYPE_ ## type) << 10)
++
+ /* quirks for Intel PCH */
+ #define AZX_DCAPS_INTEL_PCH_NOPM \
+- (AZX_DCAPS_SCH_SNOOP | AZX_DCAPS_BUFSIZE | \
+- AZX_DCAPS_COUNT_LPIB_DELAY | AZX_DCAPS_REVERSE_ASSIGN)
++ (AZX_DCAPS_BUFSIZE | AZX_DCAPS_COUNT_LPIB_DELAY |\
++ AZX_DCAPS_REVERSE_ASSIGN | AZX_DCAPS_SNOOP_TYPE(SCH))
+
+ #define AZX_DCAPS_INTEL_PCH \
+ (AZX_DCAPS_INTEL_PCH_NOPM | AZX_DCAPS_PM_RUNTIME)
+
+ #define AZX_DCAPS_INTEL_HASWELL \
+- (AZX_DCAPS_SCH_SNOOP | AZX_DCAPS_ALIGN_BUFSIZE | \
+- AZX_DCAPS_COUNT_LPIB_DELAY | AZX_DCAPS_PM_RUNTIME | \
+- AZX_DCAPS_I915_POWERWELL)
++ (AZX_DCAPS_ALIGN_BUFSIZE | AZX_DCAPS_COUNT_LPIB_DELAY |\
++ AZX_DCAPS_PM_RUNTIME | AZX_DCAPS_I915_POWERWELL |\
++ AZX_DCAPS_SNOOP_TYPE(SCH))
+
+ /* Broadwell HDMI can't use position buffer reliably, force to use LPIB */
+ #define AZX_DCAPS_INTEL_BROADWELL \
+- (AZX_DCAPS_SCH_SNOOP | AZX_DCAPS_ALIGN_BUFSIZE | \
+- AZX_DCAPS_POSFIX_LPIB | AZX_DCAPS_PM_RUNTIME | \
+- AZX_DCAPS_I915_POWERWELL)
++ (AZX_DCAPS_ALIGN_BUFSIZE | AZX_DCAPS_POSFIX_LPIB |\
++ AZX_DCAPS_PM_RUNTIME | AZX_DCAPS_I915_POWERWELL |\
++ AZX_DCAPS_SNOOP_TYPE(SCH))
+
+ /* quirks for ATI SB / AMD Hudson */
+ #define AZX_DCAPS_PRESET_ATI_SB \
+- (AZX_DCAPS_ATI_SNOOP | AZX_DCAPS_NO_TCSEL | \
+- AZX_DCAPS_SYNC_WRITE | AZX_DCAPS_POSFIX_LPIB)
++ (AZX_DCAPS_NO_TCSEL | AZX_DCAPS_SYNC_WRITE | AZX_DCAPS_POSFIX_LPIB |\
++ AZX_DCAPS_SNOOP_TYPE(ATI))
+
+ /* quirks for ATI/AMD HDMI */
+ #define AZX_DCAPS_PRESET_ATI_HDMI \
+ (AZX_DCAPS_NO_TCSEL | AZX_DCAPS_SYNC_WRITE | AZX_DCAPS_POSFIX_LPIB|\
+ AZX_DCAPS_NO_MSI64)
+
++/* quirks for ATI HDMI with snoop off */
++#define AZX_DCAPS_PRESET_ATI_HDMI_NS \
++ (AZX_DCAPS_PRESET_ATI_HDMI | AZX_DCAPS_SNOOP_OFF)
++
+ /* quirks for Nvidia */
+ #define AZX_DCAPS_PRESET_NVIDIA \
+- (AZX_DCAPS_NVIDIA_SNOOP | AZX_DCAPS_RIRB_DELAY | AZX_DCAPS_NO_MSI |\
+- AZX_DCAPS_ALIGN_BUFSIZE | AZX_DCAPS_NO_64BIT |\
+- AZX_DCAPS_CORBRP_SELF_CLEAR)
++ (AZX_DCAPS_RIRB_DELAY | AZX_DCAPS_NO_MSI | AZX_DCAPS_ALIGN_BUFSIZE |\
++ AZX_DCAPS_NO_64BIT | AZX_DCAPS_CORBRP_SELF_CLEAR |\
++ AZX_DCAPS_SNOOP_TYPE(NVIDIA))
+
+ #define AZX_DCAPS_PRESET_CTHDA \
+- (AZX_DCAPS_NO_MSI | AZX_DCAPS_POSFIX_LPIB | AZX_DCAPS_4K_BDLE_BOUNDARY)
++ (AZX_DCAPS_NO_MSI | AZX_DCAPS_POSFIX_LPIB |\
++ AZX_DCAPS_4K_BDLE_BOUNDARY | AZX_DCAPS_SNOOP_OFF)
+
+ /*
+ * VGA-switcher support
+@@ -437,6 +446,8 @@ static void update_pci_byte(struct pci_dev *pci, unsigned int reg,
+
+ static void azx_init_pci(struct azx *chip)
+ {
++ int snoop_type = azx_get_snoop_type(chip);
++
+ /* Clear bits 0-2 of PCI register TCSEL (at offset 0x44)
+ * TCSEL == Traffic Class Select Register, which sets PCI express QOS
+ * Ensuring these bits are 0 clears playback static on some HD Audio
+@@ -451,7 +462,7 @@ static void azx_init_pci(struct azx *chip)
+ /* For ATI SB450/600/700/800/900 and AMD Hudson azalia HD audio,
+ * we need to enable snoop.
+ */
+- if (chip->driver_caps & AZX_DCAPS_ATI_SNOOP) {
++ if (snoop_type == AZX_SNOOP_TYPE_ATI) {
+ dev_dbg(chip->card->dev, "Setting ATI snoop: %d\n",
+ azx_snoop(chip));
+ update_pci_byte(chip->pci,
+@@ -460,7 +471,7 @@ static void azx_init_pci(struct azx *chip)
+ }
+
+ /* For NVIDIA HDA, enable snoop */
+- if (chip->driver_caps & AZX_DCAPS_NVIDIA_SNOOP) {
++ if (snoop_type == AZX_SNOOP_TYPE_NVIDIA) {
+ dev_dbg(chip->card->dev, "Setting Nvidia snoop: %d\n",
+ azx_snoop(chip));
+ update_pci_byte(chip->pci,
+@@ -475,7 +486,7 @@ static void azx_init_pci(struct azx *chip)
+ }
+
+ /* Enable SCH/PCH snoop if needed */
+- if (chip->driver_caps & AZX_DCAPS_SCH_SNOOP) {
++ if (snoop_type == AZX_SNOOP_TYPE_SCH) {
+ unsigned short snoop;
+ pci_read_config_word(chip->pci, INTEL_SCH_HDA_DEVC, &snoop);
+ if ((!azx_snoop(chip) && !(snoop & INTEL_SCH_HDA_DEVC_NOSNOOP)) ||
+@@ -1363,8 +1374,8 @@ static void azx_check_snoop_available(struct azx *chip)
+ {
+ bool snoop = chip->snoop;
+
+- switch (chip->driver_type) {
+- case AZX_DRIVER_VIA:
++ if (azx_get_snoop_type(chip) == AZX_SNOOP_TYPE_NONE &&
++ chip->driver_type == AZX_DRIVER_VIA) {
+ /* force to non-snoop mode for a new VIA controller
+ * when BIOS is set
+ */
+@@ -1374,17 +1385,11 @@ static void azx_check_snoop_available(struct azx *chip)
+ if (!(val & 0x80) && chip->pci->revision == 0x30)
+ snoop = false;
+ }
+- break;
+- case AZX_DRIVER_ATIHDMI_NS:
+- /* new ATI HDMI requires non-snoop */
+- snoop = false;
+- break;
+- case AZX_DRIVER_CTHDA:
+- case AZX_DRIVER_CMEDIA:
+- snoop = false;
+- break;
+ }
+
++ if (chip->driver_caps & AZX_DCAPS_SNOOP_OFF)
++ snoop = false;
++
+ if (snoop != chip->snoop) {
+ dev_info(chip->card->dev, "Force to %s mode\n",
+ snoop ? "snoop" : "non-snoop");
+@@ -2131,13 +2136,15 @@ static const struct pci_device_id azx_ids[] = {
+ { PCI_DEVICE(0x1002, 0xaa98),
+ .driver_data = AZX_DRIVER_ATIHDMI | AZX_DCAPS_PRESET_ATI_HDMI },
+ { PCI_DEVICE(0x1002, 0x9902),
+- .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI },
++ .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS },
+ { PCI_DEVICE(0x1002, 0xaaa0),
+- .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI },
++ .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS },
+ { PCI_DEVICE(0x1002, 0xaaa8),
+- .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI },
++ .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS },
+ { PCI_DEVICE(0x1002, 0xaab0),
+- .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI },
++ .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS },
++ { PCI_DEVICE(0x1002, 0xaac8),
++ .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS },
+ /* VIA VT8251/VT8237A */
+ { PCI_DEVICE(0x1106, 0x3288),
+ .driver_data = AZX_DRIVER_VIA | AZX_DCAPS_POSFIX_VIA },
+@@ -2184,7 +2191,7 @@ static const struct pci_device_id azx_ids[] = {
+ /* CM8888 */
+ { PCI_DEVICE(0x13f6, 0x5011),
+ .driver_data = AZX_DRIVER_CMEDIA |
+- AZX_DCAPS_NO_MSI | AZX_DCAPS_POSFIX_LPIB },
++ AZX_DCAPS_NO_MSI | AZX_DCAPS_POSFIX_LPIB | AZX_DCAPS_SNOOP_OFF },
+ /* Vortex86MX */
+ { PCI_DEVICE(0x17f3, 0x3010), .driver_data = AZX_DRIVER_GENERIC },
+ /* VMware HDAudio */
+diff --git a/sound/pci/hda/hda_priv.h b/sound/pci/hda/hda_priv.h
+index 5016014e57f2..a09703a2b2c1 100644
+--- a/sound/pci/hda/hda_priv.h
++++ b/sound/pci/hda/hda_priv.h
+@@ -152,9 +152,8 @@ enum { SDI0, SDI1, SDI2, SDI3, SDO0, SDO1, SDO2, SDO3 };
+ /* bits 0-7 are used for indicating driver type */
+ #define AZX_DCAPS_NO_TCSEL (1 << 8) /* No Intel TCSEL bit */
+ #define AZX_DCAPS_NO_MSI (1 << 9) /* No MSI support */
+-#define AZX_DCAPS_ATI_SNOOP (1 << 10) /* ATI snoop enable */
+-#define AZX_DCAPS_NVIDIA_SNOOP (1 << 11) /* Nvidia snoop enable */
+-#define AZX_DCAPS_SCH_SNOOP (1 << 12) /* SCH/PCH snoop enable */
++#define AZX_DCAPS_SNOOP_MASK (3 << 10) /* snoop type mask */
++#define AZX_DCAPS_SNOOP_OFF (1 << 12) /* snoop default off */
+ #define AZX_DCAPS_RIRB_DELAY (1 << 13) /* Long delay in read loop */
+ #define AZX_DCAPS_RIRB_PRE_DELAY (1 << 14) /* Put a delay before read */
+ #define AZX_DCAPS_CTX_WORKAROUND (1 << 15) /* X-Fi workaround */
+@@ -173,6 +172,13 @@ enum { SDI0, SDI1, SDI2, SDI3, SDO0, SDO1, SDO2, SDO3 };
+ #define AZX_DCAPS_CORBRP_SELF_CLEAR (1 << 28) /* CORBRP clears itself after reset */
+ #define AZX_DCAPS_NO_MSI64 (1 << 29) /* Stick to 32-bit MSIs */
+
++enum {
++ AZX_SNOOP_TYPE_NONE ,
++ AZX_SNOOP_TYPE_SCH,
++ AZX_SNOOP_TYPE_ATI,
++ AZX_SNOOP_TYPE_NVIDIA,
++};
++
+ /* HD Audio class code */
+ #define PCI_CLASS_MULTIMEDIA_HD_AUDIO 0x0403
+
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index e3ad4a4d8d14..fca6d06f4bec 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -880,6 +880,8 @@ static struct alc_codec_rename_pci_table rename_pci_tbl[] = {
+ { 0x10ec0668, 0x1028, 0, "ALC3661" },
+ { 0x10ec0275, 0x1028, 0, "ALC3260" },
+ { 0x10ec0899, 0x1028, 0, "ALC3861" },
++ { 0x10ec0298, 0x1028, 0, "ALC3266" },
++ { 0x10ec0256, 0x1028, 0, "ALC3246" },
+ { 0x10ec0670, 0x1025, 0, "ALC669X" },
+ { 0x10ec0676, 0x1025, 0, "ALC679X" },
+ { 0x10ec0282, 0x1043, 0, "ALC3229" },
+@@ -3476,6 +3478,14 @@ static void alc_headset_mode_unplugged(struct hda_codec *codec)
+ WRITE_COEF(0x32, 0x42a3),
+ {}
+ };
++ static struct coef_fw coef0288[] = {
++ UPDATE_COEF(0x4f, 0xfcc0, 0xc400),
++ UPDATE_COEF(0x50, 0x2000, 0x2000),
++ UPDATE_COEF(0x56, 0x0006, 0x0006),
++ UPDATE_COEF(0x66, 0x0008, 0),
++ UPDATE_COEF(0x67, 0x2000, 0),
++ {}
++ };
+ static struct coef_fw coef0292[] = {
+ WRITE_COEF(0x76, 0x000e),
+ WRITE_COEF(0x6c, 0x2400),
+@@ -3500,12 +3510,18 @@ static void alc_headset_mode_unplugged(struct hda_codec *codec)
+
+ switch (codec->vendor_id) {
+ case 0x10ec0255:
++ case 0x10ec0256:
+ alc_process_coef_fw(codec, coef0255);
+ break;
+ case 0x10ec0233:
+ case 0x10ec0283:
+ alc_process_coef_fw(codec, coef0233);
+ break;
++ case 0x10ec0286:
++ case 0x10ec0288:
++ case 0x10ec0298:
++ alc_process_coef_fw(codec, coef0288);
++ break;
+ case 0x10ec0292:
+ alc_process_coef_fw(codec, coef0292);
+ break;
+@@ -3535,6 +3551,14 @@ static void alc_headset_mode_mic_in(struct hda_codec *codec, hda_nid_t hp_pin,
+ WRITE_COEF(0x26, 0x008c),
+ {}
+ };
++ static struct coef_fw coef0288[] = {
++ UPDATE_COEF(0x50, 0x2000, 0),
++ UPDATE_COEF(0x56, 0x0006, 0),
++ UPDATE_COEF(0x4f, 0xfcc0, 0xc400),
++ UPDATE_COEF(0x66, 0x0008, 0x0008),
++ UPDATE_COEF(0x67, 0x2000, 0x2000),
++ {}
++ };
+ static struct coef_fw coef0292[] = {
+ WRITE_COEF(0x19, 0xa208),
+ WRITE_COEF(0x2e, 0xacf0),
+@@ -3555,6 +3579,7 @@ static void alc_headset_mode_mic_in(struct hda_codec *codec, hda_nid_t hp_pin,
+
+ switch (codec->vendor_id) {
+ case 0x10ec0255:
++ case 0x10ec0256:
+ alc_write_coef_idx(codec, 0x45, 0xc489);
+ snd_hda_set_pin_ctl_cache(codec, hp_pin, 0);
+ alc_process_coef_fw(codec, coef0255);
+@@ -3567,6 +3592,14 @@ static void alc_headset_mode_mic_in(struct hda_codec *codec, hda_nid_t hp_pin,
+ alc_process_coef_fw(codec, coef0233);
+ snd_hda_set_pin_ctl_cache(codec, mic_pin, PIN_VREF50);
+ break;
++ case 0x10ec0286:
++ case 0x10ec0288:
++ case 0x10ec0298:
++ alc_update_coef_idx(codec, 0x4f, 0x000c, 0);
++ snd_hda_set_pin_ctl_cache(codec, hp_pin, 0);
++ alc_process_coef_fw(codec, coef0288);
++ snd_hda_set_pin_ctl_cache(codec, mic_pin, PIN_VREF50);
++ break;
+ case 0x10ec0292:
+ snd_hda_set_pin_ctl_cache(codec, hp_pin, 0);
+ alc_process_coef_fw(codec, coef0292);
+@@ -3578,6 +3611,10 @@ static void alc_headset_mode_mic_in(struct hda_codec *codec, hda_nid_t hp_pin,
+ alc_process_coef_fw(codec, coef0293);
+ snd_hda_set_pin_ctl_cache(codec, mic_pin, PIN_VREF50);
+ break;
++ case 0x10ec0662:
++ snd_hda_set_pin_ctl_cache(codec, hp_pin, 0);
++ snd_hda_set_pin_ctl_cache(codec, mic_pin, PIN_VREF50);
++ break;
+ case 0x10ec0668:
+ alc_write_coef_idx(codec, 0x11, 0x0001);
+ snd_hda_set_pin_ctl_cache(codec, hp_pin, 0);
+@@ -3602,6 +3639,14 @@ static void alc_headset_mode_default(struct hda_codec *codec)
+ WRITE_COEF(0x32, 0x4ea3),
+ {}
+ };
++ static struct coef_fw coef0288[] = {
++ UPDATE_COEF(0x4f, 0xfcc0, 0xc400), /* Set to TRS type */
++ UPDATE_COEF(0x50, 0x2000, 0x2000),
++ UPDATE_COEF(0x56, 0x0006, 0x0006),
++ UPDATE_COEF(0x66, 0x0008, 0),
++ UPDATE_COEF(0x67, 0x2000, 0),
++ {}
++ };
+ static struct coef_fw coef0292[] = {
+ WRITE_COEF(0x76, 0x000e),
+ WRITE_COEF(0x6c, 0x2400),
+@@ -3624,12 +3669,18 @@ static void alc_headset_mode_default(struct hda_codec *codec)
+
+ switch (codec->vendor_id) {
+ case 0x10ec0255:
++ case 0x10ec0256:
+ alc_process_coef_fw(codec, coef0255);
+ break;
+ case 0x10ec0233:
+ case 0x10ec0283:
+ alc_process_coef_fw(codec, coef0233);
+ break;
++ case 0x10ec0286:
++ case 0x10ec0288:
++ case 0x10ec0298:
++ alc_process_coef_fw(codec, coef0288);
++ break;
+ case 0x10ec0292:
+ alc_process_coef_fw(codec, coef0292);
+ break;
+@@ -3658,6 +3709,13 @@ static void alc_headset_mode_ctia(struct hda_codec *codec)
+ WRITE_COEF(0x32, 0x4ea3),
+ {}
+ };
++ static struct coef_fw coef0288[] = {
++ UPDATE_COEF(0x50, 0x2000, 0x2000),
++ UPDATE_COEF(0x56, 0x0006, 0x0006),
++ UPDATE_COEF(0x66, 0x0008, 0),
++ UPDATE_COEF(0x67, 0x2000, 0),
++ {}
++ };
+ static struct coef_fw coef0292[] = {
+ WRITE_COEF(0x6b, 0xd429),
+ WRITE_COEF(0x76, 0x0008),
+@@ -3678,12 +3736,22 @@ static void alc_headset_mode_ctia(struct hda_codec *codec)
+
+ switch (codec->vendor_id) {
+ case 0x10ec0255:
++ case 0x10ec0256:
+ alc_process_coef_fw(codec, coef0255);
+ break;
+ case 0x10ec0233:
+ case 0x10ec0283:
+ alc_process_coef_fw(codec, coef0233);
+ break;
++ case 0x10ec0298:
++ alc_update_coef_idx(codec, 0x8e, 0x0070, 0x0020);/* Headset output enable */
++ /* ALC298 jack type setting is the same with ALC286/ALC288 */
++ case 0x10ec0286:
++ case 0x10ec0288:
++ alc_update_coef_idx(codec, 0x4f, 0xfcc0, 0xd400);
++ msleep(300);
++ alc_process_coef_fw(codec, coef0288);
++ break;
+ case 0x10ec0292:
+ alc_process_coef_fw(codec, coef0292);
+ break;
+@@ -3712,6 +3780,13 @@ static void alc_headset_mode_omtp(struct hda_codec *codec)
+ WRITE_COEF(0x32, 0x4ea3),
+ {}
+ };
++ static struct coef_fw coef0288[] = {
++ UPDATE_COEF(0x50, 0x2000, 0x2000),
++ UPDATE_COEF(0x56, 0x0006, 0x0006),
++ UPDATE_COEF(0x66, 0x0008, 0),
++ UPDATE_COEF(0x67, 0x2000, 0),
++ {}
++ };
+ static struct coef_fw coef0292[] = {
+ WRITE_COEF(0x6b, 0xe429),
+ WRITE_COEF(0x76, 0x0008),
+@@ -3732,12 +3807,22 @@ static void alc_headset_mode_omtp(struct hda_codec *codec)
+
+ switch (codec->vendor_id) {
+ case 0x10ec0255:
++ case 0x10ec0256:
+ alc_process_coef_fw(codec, coef0255);
+ break;
+ case 0x10ec0233:
+ case 0x10ec0283:
+ alc_process_coef_fw(codec, coef0233);
+ break;
++ case 0x10ec0298:
++ alc_update_coef_idx(codec, 0x8e, 0x0070, 0x0010);/* Headset output enable */
++ /* ALC298 jack type setting is the same with ALC286/ALC288 */
++ case 0x10ec0286:
++ case 0x10ec0288:
++ alc_update_coef_idx(codec, 0x4f, 0xfcc0, 0xe400);
++ msleep(300);
++ alc_process_coef_fw(codec, coef0288);
++ break;
+ case 0x10ec0292:
+ alc_process_coef_fw(codec, coef0292);
+ break;
+@@ -3762,6 +3847,10 @@ static void alc_determine_headset_type(struct hda_codec *codec)
+ conteol) */
+ {}
+ };
++ static struct coef_fw coef0288[] = {
++ UPDATE_COEF(0x4f, 0xfcc0, 0xd400), /* Check Type */
++ {}
++ };
+ static struct coef_fw coef0293[] = {
+ UPDATE_COEF(0x4a, 0x000f, 0x0008), /* Combo Jack auto detect */
+ WRITE_COEF(0x45, 0xD429), /* Set to ctia type */
+@@ -3777,6 +3866,7 @@ static void alc_determine_headset_type(struct hda_codec *codec)
+
+ switch (codec->vendor_id) {
+ case 0x10ec0255:
++ case 0x10ec0256:
+ alc_process_coef_fw(codec, coef0255);
+ msleep(300);
+ val = alc_read_coef_idx(codec, 0x46);
+@@ -3789,6 +3879,16 @@ static void alc_determine_headset_type(struct hda_codec *codec)
+ val = alc_read_coef_idx(codec, 0x46);
+ is_ctia = (val & 0x0070) == 0x0070;
+ break;
++ case 0x10ec0298:
++ alc_update_coef_idx(codec, 0x8e, 0x0070, 0x0020); /* Headset output enable */
++ /* ALC298 check jack type is the same with ALC286/ALC288 */
++ case 0x10ec0286:
++ case 0x10ec0288:
++ alc_process_coef_fw(codec, coef0288);
++ msleep(350);
++ val = alc_read_coef_idx(codec, 0x50);
++ is_ctia = (val & 0x0070) == 0x0070;
++ break;
+ case 0x10ec0292:
+ alc_write_coef_idx(codec, 0x6b, 0xd429);
+ msleep(300);
+@@ -3863,7 +3963,7 @@ static void alc_update_headset_mode(struct hda_codec *codec)
+ if (new_headset_mode != ALC_HEADSET_MODE_MIC) {
+ snd_hda_set_pin_ctl_cache(codec, hp_pin,
+ AC_PINCTL_OUT_EN | AC_PINCTL_HP_EN);
+- if (spec->headphone_mic_pin)
++ if (spec->headphone_mic_pin && spec->headphone_mic_pin != hp_pin)
+ snd_hda_set_pin_ctl_cache(codec, spec->headphone_mic_pin,
+ PIN_VREFHIZ);
+ }
+@@ -4038,6 +4138,23 @@ static void alc_fixup_dell_xps13(struct hda_codec *codec,
+ }
+ }
+
++static void alc_fixup_headset_mode_alc662(struct hda_codec *codec,
++ const struct hda_fixup *fix, int action)
++{
++ struct alc_spec *spec = codec->spec;
++
++ if (action == HDA_FIXUP_ACT_PRE_PROBE) {
++ spec->parse_flags |= HDA_PINCFG_HEADSET_MIC;
++ spec->gen.hp_mic = 1; /* Mic-in is same pin as headphone */
++
++ /* Disable boost for mic-in permanently. (This code is only called
++ from quirks that guarantee that the headphone is at NID 0x1b.) */
++ snd_hda_codec_write(codec, 0x1b, 0, AC_VERB_SET_AMP_GAIN_MUTE, 0x7000);
++ snd_hda_override_wcaps(codec, 0x1b, get_wcaps(codec, 0x1b) & ~AC_WCAP_IN_AMP);
++ } else
++ alc_fixup_headset_mode(codec, fix, action);
++}
++
+ static void alc_fixup_headset_mode_alc668(struct hda_codec *codec,
+ const struct hda_fixup *fix, int action)
+ {
+@@ -4886,6 +5003,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x104d, 0x9099, "Sony VAIO S13", ALC275_FIXUP_SONY_DISABLE_AAMIX),
+ SND_PCI_QUIRK(0x10cf, 0x1475, "Lifebook", ALC269_FIXUP_LIFEBOOK),
+ SND_PCI_QUIRK(0x10cf, 0x15dc, "Lifebook T731", ALC269_FIXUP_LIFEBOOK_HP_PIN),
++ SND_PCI_QUIRK(0x10cf, 0x1757, "Lifebook E752", ALC269_FIXUP_LIFEBOOK_HP_PIN),
+ SND_PCI_QUIRK(0x10cf, 0x1845, "Lifebook U904", ALC269_FIXUP_LIFEBOOK_EXTMIC),
+ SND_PCI_QUIRK(0x144d, 0xc109, "Samsung Ativ book 9 (NP900X3G)", ALC269_FIXUP_INV_DMIC),
+ SND_PCI_QUIRK(0x1458, 0xfa53, "Gigabyte BXBT-2807", ALC283_FIXUP_BXBT2807_MIC),
+@@ -4915,6 +5033,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x17aa, 0x5026, "Thinkpad", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
+ SND_PCI_QUIRK(0x17aa, 0x5034, "Thinkpad T450", ALC292_FIXUP_TPT440_DOCK),
+ SND_PCI_QUIRK(0x17aa, 0x5036, "Thinkpad T450s", ALC292_FIXUP_TPT440_DOCK),
++ SND_PCI_QUIRK(0x17aa, 0x503c, "Thinkpad L450", ALC292_FIXUP_TPT440_DOCK),
+ SND_PCI_QUIRK(0x17aa, 0x5109, "Thinkpad", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
+ SND_PCI_QUIRK(0x17aa, 0x3bf8, "Quanta FL1", ALC269_FIXUP_PCM_44K),
+ SND_PCI_QUIRK(0x17aa, 0x9e54, "LENOVO NB", ALC269_FIXUP_LENOVO_EAPD),
+@@ -5003,6 +5122,16 @@ static const struct hda_model_fixup alc269_fixup_models[] = {
+ {0x1b, 0x411111f0}, \
+ {0x1e, 0x411111f0}
+
++#define ALC256_STANDARD_PINS \
++ {0x12, 0x90a60140}, \
++ {0x14, 0x90170110}, \
++ {0x19, 0x411111f0}, \
++ {0x1a, 0x411111f0}, \
++ {0x1b, 0x411111f0}, \
++ {0x1d, 0x40700001}, \
++ {0x1e, 0x411111f0}, \
++ {0x21, 0x02211020}
++
+ #define ALC282_STANDARD_PINS \
+ {0x14, 0x90170110}, \
+ {0x18, 0x411111f0}, \
+@@ -5095,6 +5224,19 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = {
+ {0x17, 0x40000000},
+ {0x1d, 0x40700001},
+ {0x21, 0x02211050}),
++ SND_HDA_PIN_QUIRK(0x10ec0255, 0x1028, "Dell Inspiron 5548", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
++ ALC255_STANDARD_PINS,
++ {0x12, 0x90a60180},
++ {0x14, 0x90170130},
++ {0x17, 0x40000000},
++ {0x1d, 0x40700001},
++ {0x21, 0x02211040}),
++ SND_HDA_PIN_QUIRK(0x10ec0256, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
++ ALC256_STANDARD_PINS,
++ {0x13, 0x40000000}),
++ SND_HDA_PIN_QUIRK(0x10ec0256, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
++ ALC256_STANDARD_PINS,
++ {0x13, 0x411111f0}),
+ SND_HDA_PIN_QUIRK(0x10ec0280, 0x103c, "HP", ALC280_FIXUP_HP_GPIO4,
+ {0x12, 0x90a60130},
+ {0x13, 0x40000000},
+@@ -5828,7 +5970,9 @@ enum {
+ ALC662_FIXUP_NO_JACK_DETECT,
+ ALC662_FIXUP_ZOTAC_Z68,
+ ALC662_FIXUP_INV_DMIC,
++ ALC662_FIXUP_DELL_MIC_NO_PRESENCE,
+ ALC668_FIXUP_DELL_MIC_NO_PRESENCE,
++ ALC662_FIXUP_HEADSET_MODE,
+ ALC668_FIXUP_HEADSET_MODE,
+ ALC662_FIXUP_BASS_MODE4_CHMAP,
+ ALC662_FIXUP_BASS_16,
+@@ -6021,6 +6165,20 @@ static const struct hda_fixup alc662_fixups[] = {
+ .chained = true,
+ .chain_id = ALC668_FIXUP_DELL_MIC_NO_PRESENCE
+ },
++ [ALC662_FIXUP_DELL_MIC_NO_PRESENCE] = {
++ .type = HDA_FIXUP_PINS,
++ .v.pins = (const struct hda_pintbl[]) {
++ { 0x19, 0x03a1113c }, /* use as headset mic, without its own jack detect */
++ /* headphone mic by setting pin control of 0x1b (headphone out) to in + vref_50 */
++ { }
++ },
++ .chained = true,
++ .chain_id = ALC662_FIXUP_HEADSET_MODE
++ },
++ [ALC662_FIXUP_HEADSET_MODE] = {
++ .type = HDA_FIXUP_FUNC,
++ .v.func = alc_fixup_headset_mode_alc662,
++ },
+ [ALC668_FIXUP_DELL_MIC_NO_PRESENCE] = {
+ .type = HDA_FIXUP_PINS,
+ .v.pins = (const struct hda_pintbl[]) {
+@@ -6172,6 +6330,18 @@ static const struct hda_model_fixup alc662_fixup_models[] = {
+ };
+
+ static const struct snd_hda_pin_quirk alc662_pin_fixup_tbl[] = {
++ SND_HDA_PIN_QUIRK(0x10ec0662, 0x1028, "Dell", ALC662_FIXUP_DELL_MIC_NO_PRESENCE,
++ {0x12, 0x4004c000},
++ {0x14, 0x01014010},
++ {0x15, 0x411111f0},
++ {0x16, 0x411111f0},
++ {0x18, 0x01a19020},
++ {0x19, 0x411111f0},
++ {0x1a, 0x0181302f},
++ {0x1b, 0x0221401f},
++ {0x1c, 0x411111f0},
++ {0x1d, 0x4054c601},
++ {0x1e, 0x411111f0}),
+ SND_HDA_PIN_QUIRK(0x10ec0668, 0x1028, "Dell", ALC668_FIXUP_AUTO_MUTE,
+ {0x12, 0x99a30130},
+ {0x14, 0x90170110},
+diff --git a/sound/pci/hda/thinkpad_helper.c b/sound/pci/hda/thinkpad_helper.c
+index 2341fc334163..6ba0b5517c40 100644
+--- a/sound/pci/hda/thinkpad_helper.c
++++ b/sound/pci/hda/thinkpad_helper.c
+@@ -72,7 +72,6 @@ static void hda_fixup_thinkpad_acpi(struct hda_codec *codec,
+ if (led_set_func(TPACPI_LED_MUTE, false) >= 0) {
+ old_vmaster_hook = spec->vmaster_mute.hook;
+ spec->vmaster_mute.hook = update_tpacpi_mute_led;
+- spec->vmaster_mute_enum = 1;
+ removefunc = false;
+ }
+ if (led_set_func(TPACPI_LED_MICMUTE, false) >= 0) {
+diff --git a/sound/soc/codecs/mc13783.c b/sound/soc/codecs/mc13783.c
+index 71f775aad7c7..2f98417b16b7 100644
+--- a/sound/soc/codecs/mc13783.c
++++ b/sound/soc/codecs/mc13783.c
+@@ -623,14 +623,14 @@ static int mc13783_probe(struct snd_soc_codec *codec)
+ AUDIO_SSI_SEL, 0);
+ else
+ mc13xxx_reg_rmw(priv->mc13xxx, MC13783_AUDIO_CODEC,
+- 0, AUDIO_SSI_SEL);
++ AUDIO_SSI_SEL, AUDIO_SSI_SEL);
+
+ if (priv->dac_ssi_port == MC13783_SSI1_PORT)
+ mc13xxx_reg_rmw(priv->mc13xxx, MC13783_AUDIO_DAC,
+ AUDIO_SSI_SEL, 0);
+ else
+ mc13xxx_reg_rmw(priv->mc13xxx, MC13783_AUDIO_DAC,
+- 0, AUDIO_SSI_SEL);
++ AUDIO_SSI_SEL, AUDIO_SSI_SEL);
+
+ return 0;
+ }
+diff --git a/sound/soc/codecs/wm8960.c b/sound/soc/codecs/wm8960.c
+index ab9931c280b2..34a18a910113 100644
+--- a/sound/soc/codecs/wm8960.c
++++ b/sound/soc/codecs/wm8960.c
+@@ -392,7 +392,7 @@ static const struct snd_soc_dapm_route audio_paths[] = {
+ { "Right Input Mixer", "Boost Switch", "Right Boost Mixer", },
+ { "Right Input Mixer", NULL, "RINPUT1", }, /* Really Boost Switch */
+ { "Right Input Mixer", NULL, "RINPUT2" },
+- { "Right Input Mixer", NULL, "LINPUT3" },
++ { "Right Input Mixer", NULL, "RINPUT3" },
+
+ { "Left ADC", NULL, "Left Input Mixer" },
+ { "Right ADC", NULL, "Right Input Mixer" },
+diff --git a/sound/soc/codecs/wm8994.c b/sound/soc/codecs/wm8994.c
+index 1fcb9f3f3097..e5f14c878636 100644
+--- a/sound/soc/codecs/wm8994.c
++++ b/sound/soc/codecs/wm8994.c
+@@ -2753,7 +2753,7 @@ static struct {
+ };
+
+ static int fs_ratios[] = {
+- 64, 128, 192, 256, 348, 512, 768, 1024, 1408, 1536
++ 64, 128, 192, 256, 384, 512, 768, 1024, 1408, 1536
+ };
+
+ static int bclk_divs[] = {
+diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c
+index c61cb9cedbcd..943e6a9a6319 100644
+--- a/sound/soc/soc-dapm.c
++++ b/sound/soc/soc-dapm.c
+@@ -3076,11 +3076,16 @@ snd_soc_dapm_new_control(struct snd_soc_dapm_context *dapm,
+ }
+
+ prefix = soc_dapm_prefix(dapm);
+- if (prefix)
++ if (prefix) {
+ w->name = kasprintf(GFP_KERNEL, "%s %s", prefix, widget->name);
+- else
++ if (widget->sname)
++ w->sname = kasprintf(GFP_KERNEL, "%s %s", prefix,
++ widget->sname);
++ } else {
+ w->name = kasprintf(GFP_KERNEL, "%s", widget->name);
+-
++ if (widget->sname)
++ w->sname = kasprintf(GFP_KERNEL, "%s", widget->sname);
++ }
+ if (w->name == NULL) {
+ kfree(w);
+ return NULL;
+diff --git a/sound/usb/clock.c b/sound/usb/clock.c
+index 03fed6611d9e..2ed260b10f6d 100644
+--- a/sound/usb/clock.c
++++ b/sound/usb/clock.c
+@@ -303,6 +303,11 @@ static int set_sample_rate_v1(struct snd_usb_audio *chip, int iface,
+ return err;
+ }
+
++ /* Don't check the sample rate for devices which we know don't
++ * support reading */
++ if (snd_usb_get_sample_rate_quirk(chip))
++ return 0;
++
+ if ((err = snd_usb_ctl_msg(dev, usb_rcvctrlpipe(dev, 0), UAC_GET_CUR,
+ USB_TYPE_CLASS | USB_RECIP_ENDPOINT | USB_DIR_IN,
+ UAC_EP_CS_ATTR_SAMPLE_RATE << 8, ep,
+diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c
+index c62a1659106d..0d8aba5fe1a8 100644
+--- a/sound/usb/pcm.c
++++ b/sound/usb/pcm.c
+@@ -482,6 +482,11 @@ static int set_format(struct snd_usb_substream *subs, struct audioformat *fmt)
+ /* set interface */
+ if (subs->interface != fmt->iface ||
+ subs->altset_idx != fmt->altset_idx) {
++
++ err = snd_usb_select_mode_quirk(subs, fmt);
++ if (err < 0)
++ return -EIO;
++
+ err = usb_set_interface(dev, fmt->iface, fmt->altsetting);
+ if (err < 0) {
+ dev_err(&dev->dev,
+diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h
+index 5293b5ac8b9d..fde5b6e3c8e5 100644
+--- a/sound/usb/quirks-table.h
++++ b/sound/usb/quirks-table.h
+@@ -3145,6 +3145,46 @@ AU0828_DEVICE(0x2040, 0x7270, "Hauppauge", "HVR-950Q"),
+
+ {
+ /*
++ * ZOOM R16/24 in audio interface mode.
++ * Mixer descriptors are garbage, further quirks will be needed
++ * to make any of it functional, thus disabled for now.
++ * Playback stream appears to start and run fine but no sound
++ * is produced, so also disabled for now.
++ */
++ USB_DEVICE(0x1686, 0x00dd),
++ .driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
++ .ifnum = QUIRK_ANY_INTERFACE,
++ .type = QUIRK_COMPOSITE,
++ .data = (const struct snd_usb_audio_quirk[]) {
++ {
++ /* Mixer */
++ .ifnum = 0,
++ .type = QUIRK_IGNORE_INTERFACE,
++ },
++ {
++ /* Playback */
++ .ifnum = 1,
++ .type = QUIRK_IGNORE_INTERFACE,
++ },
++ {
++ /* Capture */
++ .ifnum = 2,
++ .type = QUIRK_AUDIO_STANDARD_INTERFACE,
++ },
++ {
++ /* Midi */
++ .ifnum = 3,
++ .type = QUIRK_MIDI_STANDARD_INTERFACE
++ },
++ {
++ .ifnum = -1
++ },
++ }
++ }
++},
++
++{
++ /*
+ * Some USB MIDI devices don't have an audio control interface,
+ * so we have to grab MIDI streaming interfaces here.
+ */
+diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
+index 60dfe0d28771..05ad944dc5c8 100644
+--- a/sound/usb/quirks.c
++++ b/sound/usb/quirks.c
+@@ -1102,6 +1102,65 @@ void snd_usb_set_format_quirk(struct snd_usb_substream *subs,
+ }
+ }
+
++bool snd_usb_get_sample_rate_quirk(struct snd_usb_audio *chip)
++{
++ /* devices which do not support reading the sample rate. */
++ switch (chip->usb_id) {
++ case USB_ID(0x045E, 0x075D): /* MS Lifecam Cinema */
++ case USB_ID(0x045E, 0x076D): /* MS Lifecam HD-5000 */
++ case USB_ID(0x045E, 0x0772): /* MS Lifecam Studio */
++ case USB_ID(0x045E, 0x0779): /* MS Lifecam HD-3000 */
++ case USB_ID(0x04D8, 0xFEEA): /* Benchmark DAC1 Pre */
++ return true;
++ }
++ return false;
++}
++
++/* Marantz/Denon USB DACs need a vendor cmd to switch
++ * between PCM and native DSD mode
++ */
++static bool is_marantz_denon_dac(unsigned int id)
++{
++ switch (id) {
++ case USB_ID(0x154e, 0x1003): /* Denon DA-300USB */
++ case USB_ID(0x154e, 0x3005): /* Marantz HD-DAC1 */
++ case USB_ID(0x154e, 0x3006): /* Marantz SA-14S1 */
++ return true;
++ }
++ return false;
++}
++
++int snd_usb_select_mode_quirk(struct snd_usb_substream *subs,
++ struct audioformat *fmt)
++{
++ struct usb_device *dev = subs->dev;
++ int err;
++
++ if (is_marantz_denon_dac(subs->stream->chip->usb_id)) {
++ /* First switch to alt set 0, otherwise the mode switch cmd
++ * will not be accepted by the DAC
++ */
++ err = usb_set_interface(dev, fmt->iface, 0);
++ if (err < 0)
++ return err;
++
++ mdelay(20); /* Delay needed after setting the interface */
++
++ switch (fmt->altsetting) {
++ case 2: /* DSD mode requested */
++ case 1: /* PCM mode requested */
++ err = snd_usb_ctl_msg(dev, usb_sndctrlpipe(dev, 0), 0,
++ USB_DIR_OUT|USB_TYPE_VENDOR|USB_RECIP_INTERFACE,
++ fmt->altsetting - 1, 1, NULL, 0);
++ if (err < 0)
++ return err;
++ break;
++ }
++ mdelay(20);
++ }
++ return 0;
++}
++
+ void snd_usb_endpoint_start_quirk(struct snd_usb_endpoint *ep)
+ {
+ /*
+@@ -1150,16 +1209,18 @@ void snd_usb_ctl_msg_quirk(struct usb_device *dev, unsigned int pipe,
+ /* Marantz/Denon devices with USB DAC functionality need a delay
+ * after each class compliant request
+ */
+- if ((le16_to_cpu(dev->descriptor.idVendor) == 0x154e) &&
+- (requesttype & USB_TYPE_MASK) == USB_TYPE_CLASS) {
++ if (is_marantz_denon_dac(USB_ID(le16_to_cpu(dev->descriptor.idVendor),
++ le16_to_cpu(dev->descriptor.idProduct)))
++ && (requesttype & USB_TYPE_MASK) == USB_TYPE_CLASS)
++ mdelay(20);
+
+- switch (le16_to_cpu(dev->descriptor.idProduct)) {
+- case 0x3005: /* Marantz HD-DAC1 */
+- case 0x3006: /* Marantz SA-14S1 */
+- mdelay(20);
+- break;
+- }
+- }
++ /* Zoom R16/24 needs a tiny delay here, otherwise requests like
++ * get/set frequency return as failed despite actually succeeding.
++ */
++ if ((le16_to_cpu(dev->descriptor.idVendor) == 0x1686) &&
++ (le16_to_cpu(dev->descriptor.idProduct) == 0x00dd) &&
++ (requesttype & USB_TYPE_MASK) == USB_TYPE_CLASS)
++ mdelay(1);
+ }
+
+ /*
+@@ -1190,8 +1251,9 @@ u64 snd_usb_interface_dsd_format_quirks(struct snd_usb_audio *chip,
+
+ /* XMOS based USB DACs */
+ switch (chip->usb_id) {
+- /* iFi Audio micro/nano iDSD */
+- case USB_ID(0x20b1, 0x3008):
++ case USB_ID(0x20b1, 0x3008): /* iFi Audio micro/nano iDSD */
++ case USB_ID(0x20b1, 0x2008): /* Matrix Audio X-Sabre */
++ case USB_ID(0x20b1, 0x300a): /* Matrix Audio Mini-i Pro */
+ if (fp->altsetting == 2)
+ return SNDRV_PCM_FMTBIT_DSD_U32_BE;
+ break;
+@@ -1204,5 +1266,11 @@ u64 snd_usb_interface_dsd_format_quirks(struct snd_usb_audio *chip,
+ break;
+ }
+
++ /* Denon/Marantz devices with USB DAC functionality */
++ if (is_marantz_denon_dac(chip->usb_id)) {
++ if (fp->altsetting == 2)
++ return SNDRV_PCM_FMTBIT_DSD_U32_BE;
++ }
++
+ return 0;
+ }
+diff --git a/sound/usb/quirks.h b/sound/usb/quirks.h
+index 665e972a1b40..2cd71ed1201f 100644
+--- a/sound/usb/quirks.h
++++ b/sound/usb/quirks.h
+@@ -21,6 +21,8 @@ int snd_usb_apply_boot_quirk(struct usb_device *dev,
+ void snd_usb_set_format_quirk(struct snd_usb_substream *subs,
+ struct audioformat *fmt);
+
++bool snd_usb_get_sample_rate_quirk(struct snd_usb_audio *chip);
++
+ int snd_usb_is_big_endian_format(struct snd_usb_audio *chip,
+ struct audioformat *fp);
+
+@@ -31,6 +33,9 @@ void snd_usb_ctl_msg_quirk(struct usb_device *dev, unsigned int pipe,
+ __u8 request, __u8 requesttype, __u16 value,
+ __u16 index, void *data, __u16 size);
+
++int snd_usb_select_mode_quirk(struct snd_usb_substream *subs,
++ struct audioformat *fmt);
++
+ u64 snd_usb_interface_dsd_format_quirks(struct snd_usb_audio *chip,
+ struct audioformat *fp,
+ unsigned int sample_bytes);
+diff --git a/tools/vm/Makefile b/tools/vm/Makefile
+index 3d907dacf2ac..c604f3ec628a 100644
+--- a/tools/vm/Makefile
++++ b/tools/vm/Makefile
+@@ -3,7 +3,7 @@
+ TARGETS=page-types slabinfo
+
+ LIB_DIR = ../lib/api
+-LIBS = $(LIB_DIR)/libapikfs.a
++LIBS = $(LIB_DIR)/libapi.a
+
+ CC = $(CROSS_COMPILE)gcc
+ CFLAGS = -Wall -Wextra -I../lib/
diff --git a/1015_linux-3.18.16.patch b/1015_linux-3.18.16.patch
new file mode 100644
index 0000000..bb1ed76
--- /dev/null
+++ b/1015_linux-3.18.16.patch
@@ -0,0 +1,59 @@
+diff --git a/Makefile b/Makefile
+index cda98de8cd31..d84fdc6d02f4 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 18
+-SUBLEVEL = 15
++SUBLEVEL = 16
+ EXTRAVERSION =
+ NAME = Diseased Newt
+
+diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
+index 8bd81f5a7e07..f696dedb0fa7 100644
+--- a/arch/x86/kvm/mmu.c
++++ b/arch/x86/kvm/mmu.c
+@@ -4103,13 +4103,13 @@ void kvm_mmu_pte_write(struct kvm_vcpu *vcpu, gpa_t gpa,
+ u64 entry, gentry, *spte;
+ int npte;
+ bool remote_flush, local_flush, zap_page;
+- union kvm_mmu_page_role mask = (union kvm_mmu_page_role) {
+- .cr0_wp = 1,
+- .cr4_pae = 1,
+- .nxe = 1,
+- .smep_andnot_wp = 1,
+- .smap_andnot_wp = 1,
+- };
++ union kvm_mmu_page_role mask = { };
++
++ mask.cr0_wp = 1;
++ mask.cr4_pae = 1;
++ mask.nxe = 1;
++ mask.smep_andnot_wp = 1;
++ mask.smap_andnot_wp = 1;
+
+ /*
+ * If we don't have indirect shadow pages, it means no page is
+diff --git a/drivers/md/raid0.c b/drivers/md/raid0.c
+index d5c12e5b6125..b974ff29b55c 100644
+--- a/drivers/md/raid0.c
++++ b/drivers/md/raid0.c
+@@ -530,6 +530,9 @@ static void raid0_make_request(struct mddev *mddev, struct bio *bio)
+ ? (sector & (chunk_sects-1))
+ : sector_div(sector, chunk_sects));
+
++ /* Restore due to sector_div */
++ sector = bio->bi_iter.bi_sector;
++
+ if (sectors < bio_sectors(bio)) {
+ split = bio_split(bio, sectors, GFP_NOIO, fs_bio_set);
+ bio_chain(split, bio);
+@@ -537,7 +540,6 @@ static void raid0_make_request(struct mddev *mddev, struct bio *bio)
+ split = bio;
+ }
+
+- sector = bio->bi_iter.bi_sector;
+ zone = find_zone(mddev->private, §or);
+ tmp_dev = map_sector(mddev, zone, sector, §or);
+ split->bi_bdev = tmp_dev->bdev;
^ permalink raw reply related [flat|nested] 67+ messages in thread
* [gentoo-commits] proj/linux-patches:3.18 commit in: /
@ 2015-07-10 23:44 Mike Pagano
0 siblings, 0 replies; 67+ messages in thread
From: Mike Pagano @ 2015-07-10 23:44 UTC (permalink / raw
To: gentoo-commits
commit: eca9bba5bf3e51ba12e0e092d5ae007773c4dcae
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Fri Jul 10 23:32:05 2015 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Fri Jul 10 23:32:05 2015 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=eca9bba5
Linux patches 3.18.17 and 3.18.18
0000_README | 8 +
1016_linux-3.18.17.patch | 6820 ++++++++++++++++++++++++++++++++++++++++++++
1017_linux-3.18.18.patch | 7034 ++++++++++++++++++++++++++++++++++++++++++++++
3 files changed, 13862 insertions(+)
diff --git a/0000_README b/0000_README
index f5bcf7e..4092093 100644
--- a/0000_README
+++ b/0000_README
@@ -107,6 +107,14 @@ Patch: 1015_linux-3.18.16.patch
From: http://www.kernel.org
Desc: Linux 3.18.16
+Patch: 1016_linux-3.18.17.patch
+From: http://www.kernel.org
+Desc: Linux 3.18.17
+
+Patch: 1017_linux-3.18.18.patch
+From: http://www.kernel.org
+Desc: Linux 3.18.18
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1016_linux-3.18.17.patch b/1016_linux-3.18.17.patch
new file mode 100644
index 0000000..530ca4b
--- /dev/null
+++ b/1016_linux-3.18.17.patch
@@ -0,0 +1,6820 @@
+diff --git a/Documentation/networking/rds.txt b/Documentation/networking/rds.txt
+index c67077cbeb80..e1a3d59bbe0f 100644
+--- a/Documentation/networking/rds.txt
++++ b/Documentation/networking/rds.txt
+@@ -62,11 +62,10 @@ Socket Interface
+ ================
+
+ AF_RDS, PF_RDS, SOL_RDS
+- These constants haven't been assigned yet, because RDS isn't in
+- mainline yet. Currently, the kernel module assigns some constant
+- and publishes it to user space through two sysctl files
+- /proc/sys/net/rds/pf_rds
+- /proc/sys/net/rds/sol_rds
++ AF_RDS and PF_RDS are the domain type to be used with socket(2)
++ to create RDS sockets. SOL_RDS is the socket-level to be used
++ with setsockopt(2) and getsockopt(2) for RDS specific socket
++ options.
+
+ fd = socket(PF_RDS, SOCK_SEQPACKET, 0);
+ This creates a new, unbound RDS socket.
+diff --git a/Documentation/pinctrl.txt b/Documentation/pinctrl.txt
+index b8f2147b96dd..0df872a41053 100644
+--- a/Documentation/pinctrl.txt
++++ b/Documentation/pinctrl.txt
+@@ -72,7 +72,6 @@ static struct pinctrl_desc foo_desc = {
+ .name = "foo",
+ .pins = foo_pins,
+ .npins = ARRAY_SIZE(foo_pins),
+- .maxpin = 63,
+ .owner = THIS_MODULE,
+ };
+
+@@ -164,8 +163,8 @@ static const char *foo_get_group_name(struct pinctrl_dev *pctldev,
+ }
+
+ static int foo_get_group_pins(struct pinctrl_dev *pctldev, unsigned selector,
+- unsigned ** const pins,
+- unsigned * const num_pins)
++ const unsigned **pins,
++ unsigned *num_pins)
+ {
+ *pins = (unsigned *) foo_groups[selector].pins;
+ *num_pins = foo_groups[selector].num_pins;
+@@ -570,9 +569,8 @@ is possible to perform the requested mux setting, poke the hardware so that
+ this happens.
+
+ Pinmux drivers are required to supply a few callback functions, some are
+-optional. Usually the enable() and disable() functions are implemented,
+-writing values into some certain registers to activate a certain mux setting
+-for a certain pin.
++optional. Usually the set_mux() function is implemented, writing values into
++some certain registers to activate a certain mux setting for a certain pin.
+
+ A simple driver for the above example will work by setting bits 0, 1, 2, 3 or 4
+ into some register named MUX to select a certain function with a certain
+@@ -1266,7 +1264,7 @@ The semantics of the pinctrl APIs are:
+
+ Usually the pin control core handled the get/put pair and call out to the
+ device drivers bookkeeping operations, like checking available functions and
+-the associated pins, whereas the enable/disable pass on to the pin controller
++the associated pins, whereas select_state pass on to the pin controller
+ driver which takes care of activating and/or deactivating the mux setting by
+ quickly poking some registers.
+
+@@ -1363,8 +1361,9 @@ function, but with different named in the mapping as described under
+ "Advanced mapping" above. So that for an SPI device, we have two states named
+ "pos-A" and "pos-B".
+
+-This snippet first muxes the function in the pins defined by group A, enables
+-it, disables and releases it, and muxes it in on the pins defined by group B:
++This snippet first initializes a state object for both groups (in foo_probe()),
++then muxes the function in the pins defined by group A, and finally muxes it in
++on the pins defined by group B:
+
+ #include <linux/pinctrl/consumer.h>
+
+diff --git a/Documentation/stable_kernel_rules.txt b/Documentation/stable_kernel_rules.txt
+index 02f8331edb8b..58d0ac4df946 100644
+--- a/Documentation/stable_kernel_rules.txt
++++ b/Documentation/stable_kernel_rules.txt
+@@ -81,6 +81,16 @@ format in the sign-off area:
+ git cherry-pick fd21073
+ git cherry-pick <this commit>
+
++Also, some patches may have kernel version prerequisites. This can be
++specified in the following format in the sign-off area:
++
++ Cc: <stable@vger.kernel.org> # 3.3.x-
++
++ The tag has the meaning of:
++ git cherry-pick <this commit>
++
++ For each "-stable" tree starting with the specified version.
++
+ Following the submission:
+
+ - The sender will receive an ACK when the patch has been accepted into the
+diff --git a/Makefile b/Makefile
+index d84fdc6d02f4..95ee52f9432e 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 18
+-SUBLEVEL = 16
++SUBLEVEL = 17
+ EXTRAVERSION =
+ NAME = Diseased Newt
+
+diff --git a/arch/arm/boot/dts/r8a7791.dtsi b/arch/arm/boot/dts/r8a7791.dtsi
+index e06c11fa8698..516d62ac25a9 100644
+--- a/arch/arm/boot/dts/r8a7791.dtsi
++++ b/arch/arm/boot/dts/r8a7791.dtsi
+@@ -695,19 +695,19 @@
+ };
+
+ /* Variable factor clocks */
+- sd1_clk: sd2_clk@e6150078 {
++ sd2_clk: sd2_clk@e6150078 {
+ compatible = "renesas,r8a7791-div6-clock", "renesas,cpg-div6-clock";
+ reg = <0 0xe6150078 0 4>;
+ clocks = <&pll1_div2_clk>;
+ #clock-cells = <0>;
+- clock-output-names = "sd1";
++ clock-output-names = "sd2";
+ };
+- sd2_clk: sd3_clk@e615026c {
++ sd3_clk: sd3_clk@e615026c {
+ compatible = "renesas,r8a7791-div6-clock", "renesas,cpg-div6-clock";
+ reg = <0 0xe615026c 0 4>;
+ clocks = <&pll1_div2_clk>;
+ #clock-cells = <0>;
+- clock-output-names = "sd2";
++ clock-output-names = "sd3";
+ };
+ mmc0_clk: mmc0_clk@e6150240 {
+ compatible = "renesas,r8a7791-div6-clock", "renesas,cpg-div6-clock";
+@@ -922,17 +922,20 @@
+ mstp3_clks: mstp3_clks@e615013c {
+ compatible = "renesas,r8a7791-mstp-clocks", "renesas,cpg-mstp-clocks";
+ reg = <0 0xe615013c 0 4>, <0 0xe6150048 0 4>;
+- clocks = <&cp_clk>, <&sd2_clk>, <&sd1_clk>, <&cpg_clocks R8A7791_CLK_SD0>,
+- <&mmc0_clk>, <&hp_clk>, <&mp_clk>, <&hp_clk>, <&mp_clk>, <&rclk_clk>;
++ clocks = <&cp_clk>, <&sd3_clk>, <&sd2_clk>, <&cpg_clocks R8A7791_CLK_SD0>,
++ <&mmc0_clk>, <&hp_clk>, <&mp_clk>, <&hp_clk>, <&mp_clk>, <&rclk_clk>,
++ <&hp_clk>, <&hp_clk>;
+ #clock-cells = <1>;
+ renesas,clock-indices = <
+ R8A7791_CLK_TPU0 R8A7791_CLK_SDHI2 R8A7791_CLK_SDHI1 R8A7791_CLK_SDHI0
+ R8A7791_CLK_MMCIF0 R8A7791_CLK_IIC0 R8A7791_CLK_PCIEC R8A7791_CLK_IIC1
+ R8A7791_CLK_SSUSB R8A7791_CLK_CMT1
++ R8A7791_CLK_USBDMAC0 R8A7791_CLK_USBDMAC1
+ >;
+ clock-output-names =
+ "tpu0", "sdhi2", "sdhi1", "sdhi0",
+- "mmcif0", "i2c7", "pciec", "i2c8", "ssusb", "cmt1";
++ "mmcif0", "i2c7", "pciec", "i2c8", "ssusb", "cmt1",
++ "usbdmac0", "usbdmac1";
+ };
+ mstp5_clks: mstp5_clks@e6150144 {
+ compatible = "renesas,r8a7791-mstp-clocks", "renesas,cpg-mstp-clocks";
+diff --git a/arch/arm/kernel/Makefile b/arch/arm/kernel/Makefile
+index 03120e656aea..2ecc7d15bc09 100644
+--- a/arch/arm/kernel/Makefile
++++ b/arch/arm/kernel/Makefile
+@@ -84,6 +84,7 @@ obj-$(CONFIG_CPU_PJ4B) += pj4-cp0.o
+ obj-$(CONFIG_IWMMXT) += iwmmxt.o
+ obj-$(CONFIG_PERF_EVENTS) += perf_regs.o
+ obj-$(CONFIG_HW_PERF_EVENTS) += perf_event.o perf_event_cpu.o
++CFLAGS_pj4-cp0.o := -marm
+ AFLAGS_iwmmxt.o := -Wa,-mcpu=iwmmxt
+ obj-$(CONFIG_ARM_CPU_TOPOLOGY) += topology.o
+
+diff --git a/arch/arm/kernel/iwmmxt.S b/arch/arm/kernel/iwmmxt.S
+index ad58e565fe98..49fadbda8c63 100644
+--- a/arch/arm/kernel/iwmmxt.S
++++ b/arch/arm/kernel/iwmmxt.S
+@@ -58,6 +58,7 @@
+ #define MMX_SIZE (0x98)
+
+ .text
++ .arm
+
+ /*
+ * Lazy switching of Concan coprocessor context
+@@ -182,6 +183,8 @@ concan_load:
+ tmcr wCon, r2
+ ret lr
+
++ENDPROC(iwmmxt_task_enable)
++
+ /*
+ * Back up Concan regs to save area and disable access to them
+ * (mainly for gdb or sleep mode usage)
+@@ -232,6 +235,8 @@ ENTRY(iwmmxt_task_disable)
+ 1: msr cpsr_c, ip @ restore interrupt mode
+ ldmfd sp!, {r4, pc}
+
++ENDPROC(iwmmxt_task_disable)
++
+ /*
+ * Copy Concan state to given memory address
+ *
+@@ -268,6 +273,8 @@ ENTRY(iwmmxt_task_copy)
+ msr cpsr_c, ip @ restore interrupt mode
+ ret r3
+
++ENDPROC(iwmmxt_task_copy)
++
+ /*
+ * Restore Concan state from given memory address
+ *
+@@ -304,6 +311,8 @@ ENTRY(iwmmxt_task_restore)
+ msr cpsr_c, ip @ restore interrupt mode
+ ret r3
+
++ENDPROC(iwmmxt_task_restore)
++
+ /*
+ * Concan handling on task switch
+ *
+@@ -335,6 +344,8 @@ ENTRY(iwmmxt_task_switch)
+ mrc p15, 0, r1, c2, c0, 0
+ sub pc, lr, r1, lsr #32 @ cpwait and return
+
++ENDPROC(iwmmxt_task_switch)
++
+ /*
+ * Remove Concan ownership of given task
+ *
+@@ -353,6 +364,8 @@ ENTRY(iwmmxt_task_release)
+ msr cpsr_c, r2 @ restore interrupts
+ ret lr
+
++ENDPROC(iwmmxt_task_release)
++
+ .data
+ concan_owner:
+ .word 0
+diff --git a/arch/arm/mach-shmobile/pm-r8a7790.c b/arch/arm/mach-shmobile/pm-r8a7790.c
+index 80e8d95e54d3..23b61f170c22 100644
+--- a/arch/arm/mach-shmobile/pm-r8a7790.c
++++ b/arch/arm/mach-shmobile/pm-r8a7790.c
+@@ -38,7 +38,7 @@ static void __init r8a7790_sysc_init(void)
+ void __iomem *base = rcar_sysc_init(0xe6180000);
+
+ /* enable all interrupt sources, but do not use interrupt handler */
+- iowrite32(0x0131000e, base + SYSCIER);
++ iowrite32(0x013111ef, base + SYSCIER);
+ iowrite32(0, base + SYSCIMR);
+ }
+
+diff --git a/arch/arm/mach-shmobile/pm-r8a7791.c b/arch/arm/mach-shmobile/pm-r8a7791.c
+index 25f107bb3657..f7cfb3b72574 100644
+--- a/arch/arm/mach-shmobile/pm-r8a7791.c
++++ b/arch/arm/mach-shmobile/pm-r8a7791.c
+@@ -33,7 +33,7 @@ static void __init r8a7791_sysc_init(void)
+ void __iomem *base = rcar_sysc_init(0xe6180000);
+
+ /* enable all interrupt sources, but do not use interrupt handler */
+- iowrite32(0x0131000e, base + SYSCIER);
++ iowrite32(0x00111003, base + SYSCIER);
+ iowrite32(0, base + SYSCIMR);
+ }
+
+diff --git a/arch/x86/boot/compressed/eboot.c b/arch/x86/boot/compressed/eboot.c
+index 1acf605a646d..3790a66d6898 100644
+--- a/arch/x86/boot/compressed/eboot.c
++++ b/arch/x86/boot/compressed/eboot.c
+@@ -1110,6 +1110,8 @@ struct boot_params *make_boot_params(struct efi_config *c)
+ if (!cmdline_ptr)
+ goto fail;
+ hdr->cmd_line_ptr = (unsigned long)cmdline_ptr;
++ /* Fill in upper bits of command line address, NOP on 32 bit */
++ boot_params->ext_cmd_line_ptr = (u64)(unsigned long)cmdline_ptr >> 32;
+
+ hdr->ramdisk_image = 0;
+ hdr->ramdisk_size = 0;
+diff --git a/arch/x86/include/asm/iommu_table.h b/arch/x86/include/asm/iommu_table.h
+index f42a04735a0a..e37d6b3ad983 100644
+--- a/arch/x86/include/asm/iommu_table.h
++++ b/arch/x86/include/asm/iommu_table.h
+@@ -79,11 +79,12 @@ struct iommu_table_entry {
+ * d). Similar to the 'init', except that this gets called from pci_iommu_init
+ * where we do have a memory allocator.
+ *
+- * The standard vs the _FINISH differs in that the _FINISH variant will
+- * continue detecting other IOMMUs in the call list after the
+- * the detection routine returns a positive number. The _FINISH will
+- * stop the execution chain. Both will still call the 'init' and
+- * 'late_init' functions if they are set.
++ * The standard IOMMU_INIT differs from the IOMMU_INIT_FINISH variant
++ * in that the former will continue detecting other IOMMUs in the call
++ * list after the detection routine returns a positive number, while the
++ * latter will stop the execution chain upon first successful detection.
++ * Both variants will still call the 'init' and 'late_init' functions if
++ * they are set.
+ */
+ #define IOMMU_INIT_FINISH(_detect, _depend, _init, _late_init) \
+ __IOMMU_INIT(_detect, _depend, _init, _late_init, 1)
+diff --git a/arch/x86/include/asm/paravirt.h b/arch/x86/include/asm/paravirt.h
+index cd6e1610e29e..a9d76e02301b 100644
+--- a/arch/x86/include/asm/paravirt.h
++++ b/arch/x86/include/asm/paravirt.h
+@@ -80,16 +80,16 @@ static inline void write_cr3(unsigned long x)
+ PVOP_VCALL1(pv_mmu_ops.write_cr3, x);
+ }
+
+-static inline unsigned long read_cr4(void)
++static inline unsigned long __read_cr4(void)
+ {
+ return PVOP_CALL0(unsigned long, pv_cpu_ops.read_cr4);
+ }
+-static inline unsigned long read_cr4_safe(void)
++static inline unsigned long __read_cr4_safe(void)
+ {
+ return PVOP_CALL0(unsigned long, pv_cpu_ops.read_cr4_safe);
+ }
+
+-static inline void write_cr4(unsigned long x)
++static inline void __write_cr4(unsigned long x)
+ {
+ PVOP_VCALL1(pv_cpu_ops.write_cr4, x);
+ }
+diff --git a/arch/x86/include/asm/processor.h b/arch/x86/include/asm/processor.h
+index eb71ec794732..ddd8d13a010f 100644
+--- a/arch/x86/include/asm/processor.h
++++ b/arch/x86/include/asm/processor.h
+@@ -578,39 +578,6 @@ static inline void load_sp0(struct tss_struct *tss,
+ #define set_iopl_mask native_set_iopl_mask
+ #endif /* CONFIG_PARAVIRT */
+
+-/*
+- * Save the cr4 feature set we're using (ie
+- * Pentium 4MB enable and PPro Global page
+- * enable), so that any CPU's that boot up
+- * after us can get the correct flags.
+- */
+-extern unsigned long mmu_cr4_features;
+-extern u32 *trampoline_cr4_features;
+-
+-static inline void set_in_cr4(unsigned long mask)
+-{
+- unsigned long cr4;
+-
+- mmu_cr4_features |= mask;
+- if (trampoline_cr4_features)
+- *trampoline_cr4_features = mmu_cr4_features;
+- cr4 = read_cr4();
+- cr4 |= mask;
+- write_cr4(cr4);
+-}
+-
+-static inline void clear_in_cr4(unsigned long mask)
+-{
+- unsigned long cr4;
+-
+- mmu_cr4_features &= ~mask;
+- if (trampoline_cr4_features)
+- *trampoline_cr4_features = mmu_cr4_features;
+- cr4 = read_cr4();
+- cr4 &= ~mask;
+- write_cr4(cr4);
+-}
+-
+ typedef struct {
+ unsigned long seg;
+ } mm_segment_t;
+diff --git a/arch/x86/include/asm/special_insns.h b/arch/x86/include/asm/special_insns.h
+index e820c080a4e9..6a4b00fafb00 100644
+--- a/arch/x86/include/asm/special_insns.h
++++ b/arch/x86/include/asm/special_insns.h
+@@ -137,17 +137,17 @@ static inline void write_cr3(unsigned long x)
+ native_write_cr3(x);
+ }
+
+-static inline unsigned long read_cr4(void)
++static inline unsigned long __read_cr4(void)
+ {
+ return native_read_cr4();
+ }
+
+-static inline unsigned long read_cr4_safe(void)
++static inline unsigned long __read_cr4_safe(void)
+ {
+ return native_read_cr4_safe();
+ }
+
+-static inline void write_cr4(unsigned long x)
++static inline void __write_cr4(unsigned long x)
+ {
+ native_write_cr4(x);
+ }
+diff --git a/arch/x86/include/asm/tlbflush.h b/arch/x86/include/asm/tlbflush.h
+index 04905bfc508b..cd791948b286 100644
+--- a/arch/x86/include/asm/tlbflush.h
++++ b/arch/x86/include/asm/tlbflush.h
+@@ -15,6 +15,75 @@
+ #define __flush_tlb_single(addr) __native_flush_tlb_single(addr)
+ #endif
+
++struct tlb_state {
++#ifdef CONFIG_SMP
++ struct mm_struct *active_mm;
++ int state;
++#endif
++
++ /*
++ * Access to this CR4 shadow and to H/W CR4 is protected by
++ * disabling interrupts when modifying either one.
++ */
++ unsigned long cr4;
++};
++DECLARE_PER_CPU_SHARED_ALIGNED(struct tlb_state, cpu_tlbstate);
++
++/* Initialize cr4 shadow for this CPU. */
++static inline void cr4_init_shadow(void)
++{
++ this_cpu_write(cpu_tlbstate.cr4, __read_cr4());
++}
++
++/* Set in this cpu's CR4. */
++static inline void cr4_set_bits(unsigned long mask)
++{
++ unsigned long cr4;
++
++ cr4 = this_cpu_read(cpu_tlbstate.cr4);
++ if ((cr4 | mask) != cr4) {
++ cr4 |= mask;
++ this_cpu_write(cpu_tlbstate.cr4, cr4);
++ __write_cr4(cr4);
++ }
++}
++
++/* Clear in this cpu's CR4. */
++static inline void cr4_clear_bits(unsigned long mask)
++{
++ unsigned long cr4;
++
++ cr4 = this_cpu_read(cpu_tlbstate.cr4);
++ if ((cr4 & ~mask) != cr4) {
++ cr4 &= ~mask;
++ this_cpu_write(cpu_tlbstate.cr4, cr4);
++ __write_cr4(cr4);
++ }
++}
++
++/* Read the CR4 shadow. */
++static inline unsigned long cr4_read_shadow(void)
++{
++ return this_cpu_read(cpu_tlbstate.cr4);
++}
++
++/*
++ * Save some of cr4 feature set we're using (e.g. Pentium 4MB
++ * enable and PPro Global page enable), so that any CPU's that boot
++ * up after us can get the correct flags. This should only be used
++ * during boot on the boot cpu.
++ */
++extern unsigned long mmu_cr4_features;
++extern u32 *trampoline_cr4_features;
++
++static inline void cr4_set_bits_and_update_boot(unsigned long mask)
++{
++ mmu_cr4_features |= mask;
++ if (trampoline_cr4_features)
++ *trampoline_cr4_features = mmu_cr4_features;
++ cr4_set_bits(mask);
++}
++
+ static inline void __native_flush_tlb(void)
+ {
+ native_write_cr3(native_read_cr3());
+@@ -24,7 +93,7 @@ static inline void __native_flush_tlb_global_irq_disabled(void)
+ {
+ unsigned long cr4;
+
+- cr4 = native_read_cr4();
++ cr4 = this_cpu_read(cpu_tlbstate.cr4);
+ /* clear PGE */
+ native_write_cr4(cr4 & ~X86_CR4_PGE);
+ /* write old PGE again and flush TLBs */
+@@ -184,12 +253,6 @@ void native_flush_tlb_others(const struct cpumask *cpumask,
+ #define TLBSTATE_OK 1
+ #define TLBSTATE_LAZY 2
+
+-struct tlb_state {
+- struct mm_struct *active_mm;
+- int state;
+-};
+-DECLARE_PER_CPU_SHARED_ALIGNED(struct tlb_state, cpu_tlbstate);
+-
+ static inline void reset_lazy_tlbstate(void)
+ {
+ this_cpu_write(cpu_tlbstate.state, 0);
+diff --git a/arch/x86/include/asm/virtext.h b/arch/x86/include/asm/virtext.h
+index 5da71c27cc59..cce9ee68e335 100644
+--- a/arch/x86/include/asm/virtext.h
++++ b/arch/x86/include/asm/virtext.h
+@@ -19,6 +19,7 @@
+
+ #include <asm/vmx.h>
+ #include <asm/svm.h>
++#include <asm/tlbflush.h>
+
+ /*
+ * VMX functions:
+@@ -40,12 +41,12 @@ static inline int cpu_has_vmx(void)
+ static inline void cpu_vmxoff(void)
+ {
+ asm volatile (ASM_VMX_VMXOFF : : : "cc");
+- write_cr4(read_cr4() & ~X86_CR4_VMXE);
++ cr4_clear_bits(X86_CR4_VMXE);
+ }
+
+ static inline int cpu_vmx_enabled(void)
+ {
+- return read_cr4() & X86_CR4_VMXE;
++ return __read_cr4() & X86_CR4_VMXE;
+ }
+
+ /** Disable VMX if it is enabled on the current CPU
+diff --git a/arch/x86/kernel/acpi/sleep.c b/arch/x86/kernel/acpi/sleep.c
+index 31368207837c..d1daead5fcdd 100644
+--- a/arch/x86/kernel/acpi/sleep.c
++++ b/arch/x86/kernel/acpi/sleep.c
+@@ -78,7 +78,7 @@ int x86_acpi_suspend_lowlevel(void)
+
+ header->pmode_cr0 = read_cr0();
+ if (__this_cpu_read(cpu_info.cpuid_level) >= 0) {
+- header->pmode_cr4 = read_cr4();
++ header->pmode_cr4 = __read_cr4();
+ header->pmode_behavior |= (1 << WAKEUP_BEHAVIOR_RESTORE_CR4);
+ }
+ if (!rdmsr_safe(MSR_IA32_MISC_ENABLE,
+diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
+index cfa9b5b2c27a..7bc49c3b9684 100644
+--- a/arch/x86/kernel/cpu/common.c
++++ b/arch/x86/kernel/cpu/common.c
+@@ -19,6 +19,7 @@
+ #include <asm/archrandom.h>
+ #include <asm/hypervisor.h>
+ #include <asm/processor.h>
++#include <asm/tlbflush.h>
+ #include <asm/debugreg.h>
+ #include <asm/sections.h>
+ #include <asm/vsyscall.h>
+@@ -278,7 +279,7 @@ __setup("nosmep", setup_disable_smep);
+ static __always_inline void setup_smep(struct cpuinfo_x86 *c)
+ {
+ if (cpu_has(c, X86_FEATURE_SMEP))
+- set_in_cr4(X86_CR4_SMEP);
++ cr4_set_bits(X86_CR4_SMEP);
+ }
+
+ static __init int setup_disable_smap(char *arg)
+@@ -298,9 +299,9 @@ static __always_inline void setup_smap(struct cpuinfo_x86 *c)
+
+ if (cpu_has(c, X86_FEATURE_SMAP)) {
+ #ifdef CONFIG_X86_SMAP
+- set_in_cr4(X86_CR4_SMAP);
++ cr4_set_bits(X86_CR4_SMAP);
+ #else
+- clear_in_cr4(X86_CR4_SMAP);
++ cr4_clear_bits(X86_CR4_SMAP);
+ #endif
+ }
+ }
+@@ -1304,6 +1305,12 @@ void cpu_init(void)
+ wait_for_master_cpu(cpu);
+
+ /*
++ * Initialize the CR4 shadow before doing anything that could
++ * try to read it.
++ */
++ cr4_init_shadow();
++
++ /*
+ * Load microcode on this cpu if a valid microcode is available.
+ * This is early microcode loading procedure.
+ */
+@@ -1322,7 +1329,7 @@ void cpu_init(void)
+
+ pr_debug("Initializing CPU#%d\n", cpu);
+
+- clear_in_cr4(X86_CR4_VME|X86_CR4_PVI|X86_CR4_TSD|X86_CR4_DE);
++ cr4_clear_bits(X86_CR4_VME|X86_CR4_PVI|X86_CR4_TSD|X86_CR4_DE);
+
+ /*
+ * Initialize the per-CPU GDT with the boot GDT,
+@@ -1403,7 +1410,7 @@ void cpu_init(void)
+ printk(KERN_INFO "Initializing CPU#%d\n", cpu);
+
+ if (cpu_feature_enabled(X86_FEATURE_VME) || cpu_has_tsc || cpu_has_de)
+- clear_in_cr4(X86_CR4_VME|X86_CR4_PVI|X86_CR4_TSD|X86_CR4_DE);
++ cr4_clear_bits(X86_CR4_VME|X86_CR4_PVI|X86_CR4_TSD|X86_CR4_DE);
+
+ load_current_idt();
+ switch_to_new_gdt(cpu);
+diff --git a/arch/x86/kernel/cpu/mcheck/mce.c b/arch/x86/kernel/cpu/mcheck/mce.c
+index b5c2276317e2..bf44e45a2a76 100644
+--- a/arch/x86/kernel/cpu/mcheck/mce.c
++++ b/arch/x86/kernel/cpu/mcheck/mce.c
+@@ -43,6 +43,7 @@
+ #include <linux/export.h>
+
+ #include <asm/processor.h>
++#include <asm/tlbflush.h>
+ #include <asm/mce.h>
+ #include <asm/msr.h>
+
+@@ -1460,7 +1461,7 @@ static void __mcheck_cpu_init_generic(void)
+ bitmap_fill(all_banks, MAX_NR_BANKS);
+ machine_check_poll(MCP_UC | m_fl, &all_banks);
+
+- set_in_cr4(X86_CR4_MCE);
++ cr4_set_bits(X86_CR4_MCE);
+
+ rdmsrl(MSR_IA32_MCG_CAP, cap);
+ if (cap & MCG_CTL_P)
+diff --git a/arch/x86/kernel/cpu/mcheck/p5.c b/arch/x86/kernel/cpu/mcheck/p5.c
+index a3042989398c..30692ac88d1e 100644
+--- a/arch/x86/kernel/cpu/mcheck/p5.c
++++ b/arch/x86/kernel/cpu/mcheck/p5.c
+@@ -8,6 +8,7 @@
+ #include <linux/smp.h>
+
+ #include <asm/processor.h>
++#include <asm/tlbflush.h>
+ #include <asm/mce.h>
+ #include <asm/msr.h>
+
+@@ -59,7 +60,7 @@ void intel_p5_mcheck_init(struct cpuinfo_x86 *c)
+ "Intel old style machine check architecture supported.\n");
+
+ /* Enable MCE: */
+- set_in_cr4(X86_CR4_MCE);
++ cr4_set_bits(X86_CR4_MCE);
+ printk(KERN_INFO
+ "Intel old style machine check reporting enabled on CPU#%d.\n",
+ smp_processor_id());
+diff --git a/arch/x86/kernel/cpu/mcheck/winchip.c b/arch/x86/kernel/cpu/mcheck/winchip.c
+index 7dc5564d0cdf..590cc753ba8f 100644
+--- a/arch/x86/kernel/cpu/mcheck/winchip.c
++++ b/arch/x86/kernel/cpu/mcheck/winchip.c
+@@ -7,6 +7,7 @@
+ #include <linux/types.h>
+
+ #include <asm/processor.h>
++#include <asm/tlbflush.h>
+ #include <asm/mce.h>
+ #include <asm/msr.h>
+
+@@ -31,7 +32,7 @@ void winchip_mcheck_init(struct cpuinfo_x86 *c)
+ lo &= ~(1<<4); /* Enable MCE */
+ wrmsr(MSR_IDT_FCR1, lo, hi);
+
+- set_in_cr4(X86_CR4_MCE);
++ cr4_set_bits(X86_CR4_MCE);
+
+ printk(KERN_INFO
+ "Winchip machine check reporting enabled on CPU#0.\n");
+diff --git a/arch/x86/kernel/cpu/mtrr/cyrix.c b/arch/x86/kernel/cpu/mtrr/cyrix.c
+index 9e451b0876b5..f8c81ba0b465 100644
+--- a/arch/x86/kernel/cpu/mtrr/cyrix.c
++++ b/arch/x86/kernel/cpu/mtrr/cyrix.c
+@@ -138,8 +138,8 @@ static void prepare_set(void)
+
+ /* Save value of CR4 and clear Page Global Enable (bit 7) */
+ if (cpu_has_pge) {
+- cr4 = read_cr4();
+- write_cr4(cr4 & ~X86_CR4_PGE);
++ cr4 = __read_cr4();
++ __write_cr4(cr4 & ~X86_CR4_PGE);
+ }
+
+ /*
+@@ -171,7 +171,7 @@ static void post_set(void)
+
+ /* Restore value of CR4 */
+ if (cpu_has_pge)
+- write_cr4(cr4);
++ __write_cr4(cr4);
+ }
+
+ static void cyrix_set_arr(unsigned int reg, unsigned long base,
+diff --git a/arch/x86/kernel/cpu/mtrr/generic.c b/arch/x86/kernel/cpu/mtrr/generic.c
+index 0e25a1bc5ab5..7d74f7b3c6ba 100644
+--- a/arch/x86/kernel/cpu/mtrr/generic.c
++++ b/arch/x86/kernel/cpu/mtrr/generic.c
+@@ -678,8 +678,8 @@ static void prepare_set(void) __acquires(set_atomicity_lock)
+
+ /* Save value of CR4 and clear Page Global Enable (bit 7) */
+ if (cpu_has_pge) {
+- cr4 = read_cr4();
+- write_cr4(cr4 & ~X86_CR4_PGE);
++ cr4 = __read_cr4();
++ __write_cr4(cr4 & ~X86_CR4_PGE);
+ }
+
+ /* Flush all TLBs via a mov %cr3, %reg; mov %reg, %cr3 */
+@@ -708,7 +708,7 @@ static void post_set(void) __releases(set_atomicity_lock)
+
+ /* Restore value of CR4 */
+ if (cpu_has_pge)
+- write_cr4(cr4);
++ __write_cr4(cr4);
+ raw_spin_unlock(&set_atomicity_lock);
+ }
+
+diff --git a/arch/x86/kernel/cpu/perf_event.c b/arch/x86/kernel/cpu/perf_event.c
+index 143e5f5dc855..6b5acd5f4a34 100644
+--- a/arch/x86/kernel/cpu/perf_event.c
++++ b/arch/x86/kernel/cpu/perf_event.c
+@@ -31,6 +31,7 @@
+ #include <asm/nmi.h>
+ #include <asm/smp.h>
+ #include <asm/alternative.h>
++#include <asm/tlbflush.h>
+ #include <asm/timer.h>
+ #include <asm/desc.h>
+ #include <asm/ldt.h>
+@@ -1328,7 +1329,7 @@ x86_pmu_notifier(struct notifier_block *self, unsigned long action, void *hcpu)
+
+ case CPU_STARTING:
+ if (x86_pmu.attr_rdpmc)
+- set_in_cr4(X86_CR4_PCE);
++ cr4_set_bits(X86_CR4_PCE);
+ if (x86_pmu.cpu_starting)
+ x86_pmu.cpu_starting(cpu);
+ break;
+@@ -1834,9 +1835,9 @@ static void change_rdpmc(void *info)
+ bool enable = !!(unsigned long)info;
+
+ if (enable)
+- set_in_cr4(X86_CR4_PCE);
++ cr4_set_bits(X86_CR4_PCE);
+ else
+- clear_in_cr4(X86_CR4_PCE);
++ cr4_clear_bits(X86_CR4_PCE);
+ }
+
+ static ssize_t set_attr_rdpmc(struct device *cdev,
+diff --git a/arch/x86/kernel/head32.c b/arch/x86/kernel/head32.c
+index d6c1b9836995..2911ef3a9f1c 100644
+--- a/arch/x86/kernel/head32.c
++++ b/arch/x86/kernel/head32.c
+@@ -31,6 +31,7 @@ static void __init i386_default_early_setup(void)
+
+ asmlinkage __visible void __init i386_start_kernel(void)
+ {
++ cr4_init_shadow();
+ sanitize_boot_params(&boot_params);
+
+ /* Call the subarch specific early setup function */
+diff --git a/arch/x86/kernel/head64.c b/arch/x86/kernel/head64.c
+index eda1a865641e..3b241f0ca005 100644
+--- a/arch/x86/kernel/head64.c
++++ b/arch/x86/kernel/head64.c
+@@ -155,6 +155,8 @@ asmlinkage __visible void __init x86_64_start_kernel(char * real_mode_data)
+ (__START_KERNEL & PGDIR_MASK)));
+ BUILD_BUG_ON(__fix_to_virt(__end_of_fixed_addresses) <= MODULES_END);
+
++ cr4_init_shadow();
++
+ /* Kill off the identity-map trampoline */
+ reset_early_page_tables();
+
+diff --git a/arch/x86/kernel/i387.c b/arch/x86/kernel/i387.c
+index ae0fdc86b7b6..8d6e954db2a7 100644
+--- a/arch/x86/kernel/i387.c
++++ b/arch/x86/kernel/i387.c
+@@ -13,6 +13,7 @@
+ #include <asm/sigcontext.h>
+ #include <asm/processor.h>
+ #include <asm/math_emu.h>
++#include <asm/tlbflush.h>
+ #include <asm/uaccess.h>
+ #include <asm/ptrace.h>
+ #include <asm/i387.h>
+@@ -195,7 +196,7 @@ void fpu_init(void)
+ if (cpu_has_xmm)
+ cr4_mask |= X86_CR4_OSXMMEXCPT;
+ if (cr4_mask)
+- set_in_cr4(cr4_mask);
++ cr4_set_bits(cr4_mask);
+
+ cr0 = read_cr0();
+ cr0 &= ~(X86_CR0_TS|X86_CR0_EM); /* clear TS and EM */
+diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c
+index 6ad8a6396b75..a388bb883128 100644
+--- a/arch/x86/kernel/process.c
++++ b/arch/x86/kernel/process.c
+@@ -29,6 +29,7 @@
+ #include <asm/fpu-internal.h>
+ #include <asm/debugreg.h>
+ #include <asm/nmi.h>
++#include <asm/tlbflush.h>
+
+ /*
+ * per-CPU TSS segments. Threads are completely 'soft' on Linux,
+@@ -142,7 +143,7 @@ void flush_thread(void)
+
+ static void hard_disable_TSC(void)
+ {
+- write_cr4(read_cr4() | X86_CR4_TSD);
++ cr4_set_bits(X86_CR4_TSD);
+ }
+
+ void disable_TSC(void)
+@@ -159,7 +160,7 @@ void disable_TSC(void)
+
+ static void hard_enable_TSC(void)
+ {
+- write_cr4(read_cr4() & ~X86_CR4_TSD);
++ cr4_clear_bits(X86_CR4_TSD);
+ }
+
+ static void enable_TSC(void)
+diff --git a/arch/x86/kernel/process_32.c b/arch/x86/kernel/process_32.c
+index 8f3ebfe710d0..603c4f99cb5a 100644
+--- a/arch/x86/kernel/process_32.c
++++ b/arch/x86/kernel/process_32.c
+@@ -101,7 +101,7 @@ void __show_regs(struct pt_regs *regs, int all)
+ cr0 = read_cr0();
+ cr2 = read_cr2();
+ cr3 = read_cr3();
+- cr4 = read_cr4_safe();
++ cr4 = __read_cr4_safe();
+ printk(KERN_DEFAULT "CR0: %08lx CR2: %08lx CR3: %08lx CR4: %08lx\n",
+ cr0, cr2, cr3, cr4);
+
+diff --git a/arch/x86/kernel/process_64.c b/arch/x86/kernel/process_64.c
+index 5a2c02913af3..67fcc43577d2 100644
+--- a/arch/x86/kernel/process_64.c
++++ b/arch/x86/kernel/process_64.c
+@@ -93,7 +93,7 @@ void __show_regs(struct pt_regs *regs, int all)
+ cr0 = read_cr0();
+ cr2 = read_cr2();
+ cr3 = read_cr3();
+- cr4 = read_cr4();
++ cr4 = __read_cr4();
+
+ printk(KERN_DEFAULT "FS: %016lx(%04x) GS:%016lx(%04x) knlGS:%016lx\n",
+ fs, fsindex, gs, gsindex, shadowgs);
+diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
+index ab08aa2276fb..87b6496a32f1 100644
+--- a/arch/x86/kernel/setup.c
++++ b/arch/x86/kernel/setup.c
+@@ -1176,7 +1176,7 @@ void __init setup_arch(char **cmdline_p)
+
+ if (boot_cpu_data.cpuid_level >= 0) {
+ /* A CPU has %cr4 if and only if it has CPUID */
+- mmu_cr4_features = read_cr4();
++ mmu_cr4_features = __read_cr4();
+ if (trampoline_cr4_features)
+ *trampoline_cr4_features = mmu_cr4_features;
+ }
+diff --git a/arch/x86/kernel/xsave.c b/arch/x86/kernel/xsave.c
+index 8be1e1711203..cdc6cf903078 100644
+--- a/arch/x86/kernel/xsave.c
++++ b/arch/x86/kernel/xsave.c
+@@ -12,6 +12,7 @@
+ #include <asm/i387.h>
+ #include <asm/fpu-internal.h>
+ #include <asm/sigframe.h>
++#include <asm/tlbflush.h>
+ #include <asm/xcr.h>
+
+ /*
+@@ -454,7 +455,7 @@ static void prepare_fx_sw_frame(void)
+ */
+ static inline void xstate_enable(void)
+ {
+- set_in_cr4(X86_CR4_OSXSAVE);
++ cr4_set_bits(X86_CR4_OSXSAVE);
+ xsetbv(XCR_XFEATURE_ENABLED_MASK, pcntxt_mask);
+ }
+
+diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
+index f7eaee1cbc54..170e7d49ba65 100644
+--- a/arch/x86/kvm/svm.c
++++ b/arch/x86/kvm/svm.c
+@@ -1581,7 +1581,7 @@ static void svm_set_cr0(struct kvm_vcpu *vcpu, unsigned long cr0)
+
+ static int svm_set_cr4(struct kvm_vcpu *vcpu, unsigned long cr4)
+ {
+- unsigned long host_cr4_mce = read_cr4() & X86_CR4_MCE;
++ unsigned long host_cr4_mce = cr4_read_shadow() & X86_CR4_MCE;
+ unsigned long old_cr4 = to_svm(vcpu)->vmcb->save.cr4;
+
+ if (cr4 & X86_CR4_VMXE)
+diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
+index 54bda28e6a12..0d7f1dcfcdac 100644
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -2744,7 +2744,7 @@ static int hardware_enable(void)
+ u64 phys_addr = __pa(per_cpu(vmxarea, cpu));
+ u64 old, test_bits;
+
+- if (read_cr4() & X86_CR4_VMXE)
++ if (cr4_read_shadow() & X86_CR4_VMXE)
+ return -EBUSY;
+
+ INIT_LIST_HEAD(&per_cpu(loaded_vmcss_on_cpu, cpu));
+@@ -2771,7 +2771,7 @@ static int hardware_enable(void)
+ /* enable and lock */
+ wrmsrl(MSR_IA32_FEATURE_CONTROL, old | test_bits);
+ }
+- write_cr4(read_cr4() | X86_CR4_VMXE); /* FIXME: not cpu hotplug safe */
++ cr4_set_bits(X86_CR4_VMXE);
+
+ if (vmm_exclusive) {
+ kvm_cpu_vmxon(phys_addr);
+@@ -2808,7 +2808,7 @@ static void hardware_disable(void)
+ vmclear_local_loaded_vmcss();
+ kvm_cpu_vmxoff();
+ }
+- write_cr4(read_cr4() & ~X86_CR4_VMXE);
++ cr4_clear_bits(X86_CR4_VMXE);
+ }
+
+ static __init int adjust_vmx_controls(u32 ctl_min, u32 ctl_opt,
+@@ -3553,8 +3553,16 @@ static void vmx_set_cr3(struct kvm_vcpu *vcpu, unsigned long cr3)
+
+ static int vmx_set_cr4(struct kvm_vcpu *vcpu, unsigned long cr4)
+ {
+- unsigned long hw_cr4 = cr4 | (to_vmx(vcpu)->rmode.vm86_active ?
+- KVM_RMODE_VM_CR4_ALWAYS_ON : KVM_PMODE_VM_CR4_ALWAYS_ON);
++ /*
++ * Pass through host's Machine Check Enable value to hw_cr4, which
++ * is in force while we are in guest mode. Do not let guests control
++ * this bit, even if host CR4.MCE == 0.
++ */
++ unsigned long hw_cr4 =
++ (cr4_read_shadow() & X86_CR4_MCE) |
++ (cr4 & ~X86_CR4_MCE) |
++ (to_vmx(vcpu)->rmode.vm86_active ?
++ KVM_RMODE_VM_CR4_ALWAYS_ON : KVM_PMODE_VM_CR4_ALWAYS_ON);
+
+ if (cr4 & X86_CR4_VMXE) {
+ /*
+@@ -4280,7 +4288,7 @@ static void vmx_set_constant_host_state(struct vcpu_vmx *vmx)
+ vmcs_writel(HOST_CR3, read_cr3()); /* 22.2.3 FIXME: shadow tables */
+
+ /* Save the most likely value for this task's CR4 in the VMCS. */
+- cr4 = read_cr4();
++ cr4 = cr4_read_shadow();
+ vmcs_writel(HOST_CR4, cr4); /* 22.2.3, 22.2.5 */
+ vmx->host_state.vmcs_host_cr4 = cr4;
+
+@@ -7563,7 +7571,7 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
+ if (test_bit(VCPU_REGS_RIP, (unsigned long *)&vcpu->arch.regs_dirty))
+ vmcs_writel(GUEST_RIP, vcpu->arch.regs[VCPU_REGS_RIP]);
+
+- cr4 = read_cr4();
++ cr4 = cr4_read_shadow();
+ if (unlikely(cr4 != vmx->host_state.vmcs_host_cr4)) {
+ vmcs_writel(HOST_CR4, cr4);
+ vmx->host_state.vmcs_host_cr4 = cr4;
+diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c
+index 4d8ee827cb14..6fa245ae52c5 100644
+--- a/arch/x86/mm/fault.c
++++ b/arch/x86/mm/fault.c
+@@ -600,7 +600,7 @@ show_fault_oops(struct pt_regs *regs, unsigned long error_code,
+ printk(nx_warning, from_kuid(&init_user_ns, current_uid()));
+ if (pte && pte_present(*pte) && pte_exec(*pte) &&
+ (pgd_flags(*pgd) & _PAGE_USER) &&
+- (read_cr4() & X86_CR4_SMEP))
++ (__read_cr4() & X86_CR4_SMEP))
+ printk(smep_warning, from_kuid(&init_user_ns, current_uid()));
+ }
+
+diff --git a/arch/x86/mm/init.c b/arch/x86/mm/init.c
+index 66dba36f2343..0a59a63bcdad 100644
+--- a/arch/x86/mm/init.c
++++ b/arch/x86/mm/init.c
+@@ -144,11 +144,11 @@ static void __init probe_page_size_mask(void)
+
+ /* Enable PSE if available */
+ if (cpu_has_pse)
+- set_in_cr4(X86_CR4_PSE);
++ cr4_set_bits_and_update_boot(X86_CR4_PSE);
+
+ /* Enable PGE if available */
+ if (cpu_has_pge) {
+- set_in_cr4(X86_CR4_PGE);
++ cr4_set_bits_and_update_boot(X86_CR4_PGE);
+ __supported_pte_mask |= _PAGE_GLOBAL;
+ }
+ }
+@@ -687,3 +687,11 @@ void __init zone_sizes_init(void)
+ free_area_init_nodes(max_zone_pfns);
+ }
+
++DEFINE_PER_CPU_SHARED_ALIGNED(struct tlb_state, cpu_tlbstate) = {
++#ifdef CONFIG_SMP
++ .active_mm = &init_mm,
++ .state = 0,
++#endif
++ .cr4 = ~0UL, /* fail hard if we screw up cr4 shadow initialization */
++};
++EXPORT_SYMBOL_GPL(cpu_tlbstate);
+diff --git a/arch/x86/mm/tlb.c b/arch/x86/mm/tlb.c
+index ee61c36d64f8..3250f2371aea 100644
+--- a/arch/x86/mm/tlb.c
++++ b/arch/x86/mm/tlb.c
+@@ -14,9 +14,6 @@
+ #include <asm/uv/uv.h>
+ #include <linux/debugfs.h>
+
+-DEFINE_PER_CPU_SHARED_ALIGNED(struct tlb_state, cpu_tlbstate)
+- = { &init_mm, 0, };
+-
+ /*
+ * Smarter SMP flushing macros.
+ * c/o Linus Torvalds.
+diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c
+index 3f627345d51c..82003a36ad96 100644
+--- a/arch/x86/net/bpf_jit_comp.c
++++ b/arch/x86/net/bpf_jit_comp.c
+@@ -558,6 +558,13 @@ static int do_jit(struct bpf_prog *bpf_prog, int *addrs, u8 *image,
+ if (is_ereg(dst_reg))
+ EMIT1(0x41);
+ EMIT3(0xC1, add_1reg(0xC8, dst_reg), 8);
++
++ /* emit 'movzwl eax, ax' */
++ if (is_ereg(dst_reg))
++ EMIT3(0x45, 0x0F, 0xB7);
++ else
++ EMIT2(0x0F, 0xB7);
++ EMIT1(add_2reg(0xC0, dst_reg, dst_reg));
+ break;
+ case 32:
+ /* emit 'bswap eax' to swap lower 4 bytes */
+@@ -576,6 +583,27 @@ static int do_jit(struct bpf_prog *bpf_prog, int *addrs, u8 *image,
+ break;
+
+ case BPF_ALU | BPF_END | BPF_FROM_LE:
++ switch (imm32) {
++ case 16:
++ /* emit 'movzwl eax, ax' to zero extend 16-bit
++ * into 64 bit
++ */
++ if (is_ereg(dst_reg))
++ EMIT3(0x45, 0x0F, 0xB7);
++ else
++ EMIT2(0x0F, 0xB7);
++ EMIT1(add_2reg(0xC0, dst_reg, dst_reg));
++ break;
++ case 32:
++ /* emit 'mov eax, eax' to clear upper 32-bits */
++ if (is_ereg(dst_reg))
++ EMIT1(0x45);
++ EMIT2(0x89, add_2reg(0xC0, dst_reg, dst_reg));
++ break;
++ case 64:
++ /* nop */
++ break;
++ }
+ break;
+
+ /* ST: *(u8*)(dst_reg + off) = imm */
+@@ -936,7 +964,12 @@ void bpf_int_jit_compile(struct bpf_prog *prog)
+ }
+ ctx.cleanup_addr = proglen;
+
+- for (pass = 0; pass < 10; pass++) {
++ /* JITed image shrinks with every pass and the loop iterates
++ * until the image stops shrinking. Very large bpf programs
++ * may converge on the last pass. In such case do one more
++ * pass to emit the final image
++ */
++ for (pass = 0; pass < 10 || image; pass++) {
+ proglen = do_jit(prog, addrs, image, oldproglen, &ctx);
+ if (proglen <= 0) {
+ image = NULL;
+diff --git a/arch/x86/power/cpu.c b/arch/x86/power/cpu.c
+index 6ec7910f59bf..3e32ed5648a0 100644
+--- a/arch/x86/power/cpu.c
++++ b/arch/x86/power/cpu.c
+@@ -105,11 +105,8 @@ static void __save_processor_state(struct saved_context *ctxt)
+ ctxt->cr0 = read_cr0();
+ ctxt->cr2 = read_cr2();
+ ctxt->cr3 = read_cr3();
+-#ifdef CONFIG_X86_32
+- ctxt->cr4 = read_cr4_safe();
+-#else
+-/* CONFIG_X86_64 */
+- ctxt->cr4 = read_cr4();
++ ctxt->cr4 = __read_cr4_safe();
++#ifdef CONFIG_X86_64
+ ctxt->cr8 = read_cr8();
+ #endif
+ ctxt->misc_enable_saved = !rdmsrl_safe(MSR_IA32_MISC_ENABLE,
+@@ -175,12 +172,12 @@ static void notrace __restore_processor_state(struct saved_context *ctxt)
+ /* cr4 was introduced in the Pentium CPU */
+ #ifdef CONFIG_X86_32
+ if (ctxt->cr4)
+- write_cr4(ctxt->cr4);
++ __write_cr4(ctxt->cr4);
+ #else
+ /* CONFIG X86_64 */
+ wrmsrl(MSR_EFER, ctxt->efer);
+ write_cr8(ctxt->cr8);
+- write_cr4(ctxt->cr4);
++ __write_cr4(ctxt->cr4);
+ #endif
+ write_cr3(ctxt->cr3);
+ write_cr2(ctxt->cr2);
+diff --git a/arch/x86/realmode/init.c b/arch/x86/realmode/init.c
+index bad628a620c4..0b7a63d98440 100644
+--- a/arch/x86/realmode/init.c
++++ b/arch/x86/realmode/init.c
+@@ -81,7 +81,7 @@ void __init setup_real_mode(void)
+
+ trampoline_header->start = (u64) secondary_startup_64;
+ trampoline_cr4_features = &trampoline_header->cr4;
+- *trampoline_cr4_features = read_cr4();
++ *trampoline_cr4_features = __read_cr4();
+
+ trampoline_pgd = (u64 *) __va(real_mode_header->trampoline_pgd);
+ trampoline_pgd[0] = init_level4_pgt[pgd_index(__PAGE_OFFSET)].pgd;
+diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
+index fac5e4f9607c..7d67146c3f87 100644
+--- a/arch/x86/xen/enlighten.c
++++ b/arch/x86/xen/enlighten.c
+@@ -1483,10 +1483,10 @@ static void xen_pvh_set_cr_flags(int cpu)
+ * set them here. For all, OSFXSR OSXMMEXCPT are set in fpu_init.
+ */
+ if (cpu_has_pse)
+- set_in_cr4(X86_CR4_PSE);
++ cr4_set_bits_and_update_boot(X86_CR4_PSE);
+
+ if (cpu_has_pge)
+- set_in_cr4(X86_CR4_PGE);
++ cr4_set_bits_and_update_boot(X86_CR4_PGE);
+ }
+
+ /*
+diff --git a/arch/xtensa/Kconfig b/arch/xtensa/Kconfig
+index 73d328f480e5..e28ef29b0b16 100644
+--- a/arch/xtensa/Kconfig
++++ b/arch/xtensa/Kconfig
+@@ -436,6 +436,36 @@ config XTFPGA_LCD_8BIT_ACCESS
+ only be used with 8-bit interface. Please consult prototyping user
+ guide for your board for the correct interface width.
+
++config XTFPGA_LCD
++ bool "Enable XTFPGA LCD driver"
++ depends on XTENSA_PLATFORM_XTFPGA
++ default n
++ help
++ There's a 2x16 LCD on most of XTFPGA boards, kernel may output
++ progress messages there during bootup/shutdown. It may be useful
++ during board bringup.
++
++ If unsure, say N.
++
++config XTFPGA_LCD_BASE_ADDR
++ hex "XTFPGA LCD base address"
++ depends on XTFPGA_LCD
++ default "0x0d0c0000"
++ help
++ Base address of the LCD controller inside KIO region.
++ Different boards from XTFPGA family have LCD controller at different
++ addresses. Please consult prototyping user guide for your board for
++ the correct address. Wrong address here may lead to hardware lockup.
++
++config XTFPGA_LCD_8BIT_ACCESS
++ bool "Use 8-bit access to XTFPGA LCD"
++ depends on XTFPGA_LCD
++ default n
++ help
++ LCD may be connected with 4- or 8-bit interface, 8-bit access may
++ only be used with 8-bit interface. Please consult prototyping user
++ guide for your board for the correct interface width.
++
+ endmenu
+
+ menu "Executable file formats"
+diff --git a/drivers/acpi/Makefile b/drivers/acpi/Makefile
+index c3b2fcb729f3..6d11522f0e48 100644
+--- a/drivers/acpi/Makefile
++++ b/drivers/acpi/Makefile
+@@ -47,6 +47,7 @@ acpi-y += int340x_thermal.o
+ acpi-y += power.o
+ acpi-y += event.o
+ acpi-y += sysfs.o
++acpi-y += property.o
+ acpi-$(CONFIG_X86) += acpi_cmos_rtc.o
+ acpi-$(CONFIG_DEBUG_FS) += debugfs.o
+ acpi-$(CONFIG_ACPI_NUMA) += numa.o
+diff --git a/drivers/acpi/internal.h b/drivers/acpi/internal.h
+index 447f6d679b29..163e82f536fa 100644
+--- a/drivers/acpi/internal.h
++++ b/drivers/acpi/internal.h
+@@ -173,4 +173,10 @@ static inline void suspend_nvs_restore(void) {}
+ bool acpi_osi_is_win8(void);
+ #endif
+
++/*--------------------------------------------------------------------------
++ Device properties
++ -------------------------------------------------------------------------- */
++void acpi_init_properties(struct acpi_device *adev);
++void acpi_free_properties(struct acpi_device *adev);
++
+ #endif /* _ACPI_INTERNAL_H_ */
+diff --git a/drivers/acpi/property.c b/drivers/acpi/property.c
+new file mode 100644
+index 000000000000..2541b1fd1fa5
+--- /dev/null
++++ b/drivers/acpi/property.c
+@@ -0,0 +1,542 @@
++/*
++ * ACPI device specific properties support.
++ *
++ * Copyright (C) 2014, Intel Corporation
++ * All rights reserved.
++ *
++ * Authors: Mika Westerberg <mika.westerberg@linux.intel.com>
++ * Darren Hart <dvhart@linux.intel.com>
++ * Rafael J. Wysocki <rafael.j.wysocki@intel.com>
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 as
++ * published by the Free Software Foundation.
++ */
++
++#include <linux/acpi.h>
++#include <linux/device.h>
++#include <linux/export.h>
++
++#include "internal.h"
++
++/* ACPI _DSD device properties UUID: daffd814-6eba-4d8c-8a91-bc9bbf4aa301 */
++static const u8 prp_uuid[16] = {
++ 0x14, 0xd8, 0xff, 0xda, 0xba, 0x6e, 0x8c, 0x4d,
++ 0x8a, 0x91, 0xbc, 0x9b, 0xbf, 0x4a, 0xa3, 0x01
++};
++
++static bool acpi_property_value_ok(const union acpi_object *value)
++{
++ int j;
++
++ /*
++ * The value must be an integer, a string, a reference, or a package
++ * whose every element must be an integer, a string, or a reference.
++ */
++ switch (value->type) {
++ case ACPI_TYPE_INTEGER:
++ case ACPI_TYPE_STRING:
++ case ACPI_TYPE_LOCAL_REFERENCE:
++ return true;
++
++ case ACPI_TYPE_PACKAGE:
++ for (j = 0; j < value->package.count; j++)
++ switch (value->package.elements[j].type) {
++ case ACPI_TYPE_INTEGER:
++ case ACPI_TYPE_STRING:
++ case ACPI_TYPE_LOCAL_REFERENCE:
++ continue;
++
++ default:
++ return false;
++ }
++
++ return true;
++ }
++ return false;
++}
++
++static bool acpi_properties_format_valid(const union acpi_object *properties)
++{
++ int i;
++
++ for (i = 0; i < properties->package.count; i++) {
++ const union acpi_object *property;
++
++ property = &properties->package.elements[i];
++ /*
++ * Only two elements allowed, the first one must be a string and
++ * the second one has to satisfy certain conditions.
++ */
++ if (property->package.count != 2
++ || property->package.elements[0].type != ACPI_TYPE_STRING
++ || !acpi_property_value_ok(&property->package.elements[1]))
++ return false;
++ }
++ return true;
++}
++
++void acpi_init_properties(struct acpi_device *adev)
++{
++ struct acpi_buffer buf = { ACPI_ALLOCATE_BUFFER };
++ const union acpi_object *desc;
++ acpi_status status;
++ int i;
++
++ status = acpi_evaluate_object_typed(adev->handle, "_DSD", NULL, &buf,
++ ACPI_TYPE_PACKAGE);
++ if (ACPI_FAILURE(status))
++ return;
++
++ desc = buf.pointer;
++ if (desc->package.count % 2)
++ goto fail;
++
++ /* Look for the device properties UUID. */
++ for (i = 0; i < desc->package.count; i += 2) {
++ const union acpi_object *uuid, *properties;
++
++ uuid = &desc->package.elements[i];
++ properties = &desc->package.elements[i + 1];
++
++ /*
++ * The first element must be a UUID and the second one must be
++ * a package.
++ */
++ if (uuid->type != ACPI_TYPE_BUFFER || uuid->buffer.length != 16
++ || properties->type != ACPI_TYPE_PACKAGE)
++ break;
++
++ if (memcmp(uuid->buffer.pointer, prp_uuid, sizeof(prp_uuid)))
++ continue;
++
++ /*
++ * We found the matching UUID. Now validate the format of the
++ * package immediately following it.
++ */
++ if (!acpi_properties_format_valid(properties))
++ break;
++
++ adev->data.pointer = buf.pointer;
++ adev->data.properties = properties;
++ return;
++ }
++
++ fail:
++ dev_warn(&adev->dev, "Returned _DSD data is not valid, skipping\n");
++ ACPI_FREE(buf.pointer);
++}
++
++void acpi_free_properties(struct acpi_device *adev)
++{
++ ACPI_FREE((void *)adev->data.pointer);
++ adev->data.pointer = NULL;
++ adev->data.properties = NULL;
++}
++
++/**
++ * acpi_dev_get_property - return an ACPI property with given name
++ * @adev: ACPI device to get property
++ * @name: Name of the property
++ * @type: Expected property type
++ * @obj: Location to store the property value (if not %NULL)
++ *
++ * Look up a property with @name and store a pointer to the resulting ACPI
++ * object at the location pointed to by @obj if found.
++ *
++ * Callers must not attempt to free the returned objects. These objects will be
++ * freed by the ACPI core automatically during the removal of @adev.
++ *
++ * Return: %0 if property with @name has been found (success),
++ * %-EINVAL if the arguments are invalid,
++ * %-ENODATA if the property doesn't exist,
++ * %-EPROTO if the property value type doesn't match @type.
++ */
++int acpi_dev_get_property(struct acpi_device *adev, const char *name,
++ acpi_object_type type, const union acpi_object **obj)
++{
++ const union acpi_object *properties;
++ int i;
++
++ if (!adev || !name)
++ return -EINVAL;
++
++ if (!adev->data.pointer || !adev->data.properties)
++ return -ENODATA;
++
++ properties = adev->data.properties;
++ for (i = 0; i < properties->package.count; i++) {
++ const union acpi_object *propname, *propvalue;
++ const union acpi_object *property;
++
++ property = &properties->package.elements[i];
++
++ propname = &property->package.elements[0];
++ propvalue = &property->package.elements[1];
++
++ if (!strcmp(name, propname->string.pointer)) {
++ if (type != ACPI_TYPE_ANY && propvalue->type != type)
++ return -EPROTO;
++ else if (obj)
++ *obj = propvalue;
++
++ return 0;
++ }
++ }
++ return -ENODATA;
++}
++EXPORT_SYMBOL_GPL(acpi_dev_get_property);
++
++/**
++ * acpi_dev_get_property_array - return an ACPI array property with given name
++ * @adev: ACPI device to get property
++ * @name: Name of the property
++ * @type: Expected type of array elements
++ * @obj: Location to store a pointer to the property value (if not NULL)
++ *
++ * Look up an array property with @name and store a pointer to the resulting
++ * ACPI object at the location pointed to by @obj if found.
++ *
++ * Callers must not attempt to free the returned objects. Those objects will be
++ * freed by the ACPI core automatically during the removal of @adev.
++ *
++ * Return: %0 if array property (package) with @name has been found (success),
++ * %-EINVAL if the arguments are invalid,
++ * %-ENODATA if the property doesn't exist,
++ * %-EPROTO if the property is not a package or the type of its elements
++ * doesn't match @type.
++ */
++int acpi_dev_get_property_array(struct acpi_device *adev, const char *name,
++ acpi_object_type type,
++ const union acpi_object **obj)
++{
++ const union acpi_object *prop;
++ int ret, i;
++
++ ret = acpi_dev_get_property(adev, name, ACPI_TYPE_PACKAGE, &prop);
++ if (ret)
++ return ret;
++
++ if (type != ACPI_TYPE_ANY) {
++ /* Check that all elements are of correct type. */
++ for (i = 0; i < prop->package.count; i++)
++ if (prop->package.elements[i].type != type)
++ return -EPROTO;
++ }
++ if (obj)
++ *obj = prop;
++
++ return 0;
++}
++EXPORT_SYMBOL_GPL(acpi_dev_get_property_array);
++
++/**
++ * acpi_dev_get_property_reference - returns handle to the referenced object
++ * @adev: ACPI device to get property
++ * @name: Name of the property
++ * @size_prop: Name of the "size" property in referenced object
++ * @index: Index of the reference to return
++ * @args: Location to store the returned reference with optional arguments
++ *
++ * Find property with @name, verifify that it is a package containing at least
++ * one object reference and if so, store the ACPI device object pointer to the
++ * target object in @args->adev.
++ *
++ * If the reference includes arguments (@size_prop is not %NULL) follow the
++ * reference and check whether or not there is an integer property @size_prop
++ * under the target object and if so, whether or not its value matches the
++ * number of arguments that follow the reference. If there's more than one
++ * reference in the property value package, @index is used to select the one to
++ * return.
++ *
++ * Return: %0 on success, negative error code on failure.
++ */
++int acpi_dev_get_property_reference(struct acpi_device *adev, const char *name,
++ const char *size_prop, size_t index,
++ struct acpi_reference_args *args)
++{
++ const union acpi_object *element, *end;
++ const union acpi_object *obj;
++ struct acpi_device *device;
++ int ret, idx = 0;
++
++ ret = acpi_dev_get_property(adev, name, ACPI_TYPE_ANY, &obj);
++ if (ret)
++ return ret;
++
++ /*
++ * The simplest case is when the value is a single reference. Just
++ * return that reference then.
++ */
++ if (obj->type == ACPI_TYPE_LOCAL_REFERENCE) {
++ if (size_prop || index)
++ return -EINVAL;
++
++ ret = acpi_bus_get_device(obj->reference.handle, &device);
++ if (ret)
++ return ret;
++
++ args->adev = device;
++ args->nargs = 0;
++ return 0;
++ }
++
++ /*
++ * If it is not a single reference, then it is a package of
++ * references followed by number of ints as follows:
++ *
++ * Package () { REF, INT, REF, INT, INT }
++ *
++ * The index argument is then used to determine which reference
++ * the caller wants (along with the arguments).
++ */
++ if (obj->type != ACPI_TYPE_PACKAGE || index >= obj->package.count)
++ return -EPROTO;
++
++ element = obj->package.elements;
++ end = element + obj->package.count;
++
++ while (element < end) {
++ u32 nargs, i;
++
++ if (element->type != ACPI_TYPE_LOCAL_REFERENCE)
++ return -EPROTO;
++
++ ret = acpi_bus_get_device(element->reference.handle, &device);
++ if (ret)
++ return -ENODEV;
++
++ element++;
++ nargs = 0;
++
++ if (size_prop) {
++ const union acpi_object *prop;
++
++ /*
++ * Find out how many arguments the refenced object
++ * expects by reading its size_prop property.
++ */
++ ret = acpi_dev_get_property(device, size_prop,
++ ACPI_TYPE_INTEGER, &prop);
++ if (ret)
++ return ret;
++
++ nargs = prop->integer.value;
++ if (nargs > MAX_ACPI_REFERENCE_ARGS
++ || element + nargs > end)
++ return -EPROTO;
++
++ /*
++ * Skip to the start of the arguments and verify
++ * that they all are in fact integers.
++ */
++ for (i = 0; i < nargs; i++)
++ if (element[i].type != ACPI_TYPE_INTEGER)
++ return -EPROTO;
++ } else {
++ /* assume following integer elements are all args */
++ for (i = 0; element + i < end; i++) {
++ int type = element[i].type;
++
++ if (type == ACPI_TYPE_INTEGER)
++ nargs++;
++ else if (type == ACPI_TYPE_LOCAL_REFERENCE)
++ break;
++ else
++ return -EPROTO;
++ }
++ }
++
++ if (idx++ == index) {
++ args->adev = device;
++ args->nargs = nargs;
++ for (i = 0; i < nargs; i++)
++ args->args[i] = element[i].integer.value;
++
++ return 0;
++ }
++
++ element += nargs;
++ }
++
++ return -EPROTO;
++}
++EXPORT_SYMBOL_GPL(acpi_dev_get_property_reference);
++
++int acpi_dev_prop_get(struct acpi_device *adev, const char *propname,
++ void **valptr)
++{
++ return acpi_dev_get_property(adev, propname, ACPI_TYPE_ANY,
++ (const union acpi_object **)valptr);
++}
++
++int acpi_dev_prop_read_single(struct acpi_device *adev, const char *propname,
++ enum dev_prop_type proptype, void *val)
++{
++ const union acpi_object *obj;
++ int ret;
++
++ if (!val)
++ return -EINVAL;
++
++ if (proptype >= DEV_PROP_U8 && proptype <= DEV_PROP_U64) {
++ ret = acpi_dev_get_property(adev, propname, ACPI_TYPE_INTEGER, &obj);
++ if (ret)
++ return ret;
++
++ switch (proptype) {
++ case DEV_PROP_U8:
++ if (obj->integer.value > U8_MAX)
++ return -EOVERFLOW;
++ *(u8 *)val = obj->integer.value;
++ break;
++ case DEV_PROP_U16:
++ if (obj->integer.value > U16_MAX)
++ return -EOVERFLOW;
++ *(u16 *)val = obj->integer.value;
++ break;
++ case DEV_PROP_U32:
++ if (obj->integer.value > U32_MAX)
++ return -EOVERFLOW;
++ *(u32 *)val = obj->integer.value;
++ break;
++ default:
++ *(u64 *)val = obj->integer.value;
++ break;
++ }
++ } else if (proptype == DEV_PROP_STRING) {
++ ret = acpi_dev_get_property(adev, propname, ACPI_TYPE_STRING, &obj);
++ if (ret)
++ return ret;
++
++ *(char **)val = obj->string.pointer;
++ } else {
++ ret = -EINVAL;
++ }
++ return ret;
++}
++
++static int acpi_copy_property_array_u8(const union acpi_object *items, u8 *val,
++ size_t nval)
++{
++ int i;
++
++ for (i = 0; i < nval; i++) {
++ if (items[i].type != ACPI_TYPE_INTEGER)
++ return -EPROTO;
++ if (items[i].integer.value > U8_MAX)
++ return -EOVERFLOW;
++
++ val[i] = items[i].integer.value;
++ }
++ return 0;
++}
++
++static int acpi_copy_property_array_u16(const union acpi_object *items,
++ u16 *val, size_t nval)
++{
++ int i;
++
++ for (i = 0; i < nval; i++) {
++ if (items[i].type != ACPI_TYPE_INTEGER)
++ return -EPROTO;
++ if (items[i].integer.value > U16_MAX)
++ return -EOVERFLOW;
++
++ val[i] = items[i].integer.value;
++ }
++ return 0;
++}
++
++static int acpi_copy_property_array_u32(const union acpi_object *items,
++ u32 *val, size_t nval)
++{
++ int i;
++
++ for (i = 0; i < nval; i++) {
++ if (items[i].type != ACPI_TYPE_INTEGER)
++ return -EPROTO;
++ if (items[i].integer.value > U32_MAX)
++ return -EOVERFLOW;
++
++ val[i] = items[i].integer.value;
++ }
++ return 0;
++}
++
++static int acpi_copy_property_array_u64(const union acpi_object *items,
++ u64 *val, size_t nval)
++{
++ int i;
++
++ for (i = 0; i < nval; i++) {
++ if (items[i].type != ACPI_TYPE_INTEGER)
++ return -EPROTO;
++
++ val[i] = items[i].integer.value;
++ }
++ return 0;
++}
++
++static int acpi_copy_property_array_string(const union acpi_object *items,
++ char **val, size_t nval)
++{
++ int i;
++
++ for (i = 0; i < nval; i++) {
++ if (items[i].type != ACPI_TYPE_STRING)
++ return -EPROTO;
++
++ val[i] = items[i].string.pointer;
++ }
++ return 0;
++}
++
++int acpi_dev_prop_read(struct acpi_device *adev, const char *propname,
++ enum dev_prop_type proptype, void *val, size_t nval)
++{
++ const union acpi_object *obj;
++ const union acpi_object *items;
++ int ret;
++
++ if (val && nval == 1) {
++ ret = acpi_dev_prop_read_single(adev, propname, proptype, val);
++ if (!ret)
++ return ret;
++ }
++
++ ret = acpi_dev_get_property_array(adev, propname, ACPI_TYPE_ANY, &obj);
++ if (ret)
++ return ret;
++
++ if (!val)
++ return obj->package.count;
++ else if (nval <= 0)
++ return -EINVAL;
++
++ if (nval > obj->package.count)
++ return -EOVERFLOW;
++
++ items = obj->package.elements;
++ switch (proptype) {
++ case DEV_PROP_U8:
++ ret = acpi_copy_property_array_u8(items, (u8 *)val, nval);
++ break;
++ case DEV_PROP_U16:
++ ret = acpi_copy_property_array_u16(items, (u16 *)val, nval);
++ break;
++ case DEV_PROP_U32:
++ ret = acpi_copy_property_array_u32(items, (u32 *)val, nval);
++ break;
++ case DEV_PROP_U64:
++ ret = acpi_copy_property_array_u64(items, (u64 *)val, nval);
++ break;
++ case DEV_PROP_STRING:
++ ret = acpi_copy_property_array_string(items, (char **)val, nval);
++ break;
++ default:
++ ret = -EINVAL;
++ break;
++ }
++ return ret;
++}
+diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
+index 0446d0d5efa5..01aa1c7f4e9c 100644
+--- a/drivers/acpi/scan.c
++++ b/drivers/acpi/scan.c
+@@ -926,6 +926,7 @@ static void acpi_device_release(struct device *dev)
+ {
+ struct acpi_device *acpi_dev = to_acpi_device(dev);
+
++ acpi_free_properties(acpi_dev);
+ acpi_free_pnp_ids(&acpi_dev->pnp);
+ acpi_free_power_resources_lists(acpi_dev);
+ kfree(acpi_dev);
+@@ -1928,6 +1929,7 @@ void acpi_init_device_object(struct acpi_device *device, acpi_handle handle,
+ acpi_set_device_status(device, sta);
+ acpi_device_get_busid(device);
+ acpi_set_pnp_ids(handle, &device->pnp, type);
++ acpi_init_properties(device);
+ acpi_bus_get_flags(device);
+ device->flags.match_driver = false;
+ device->flags.initialized = true;
+diff --git a/drivers/base/Makefile b/drivers/base/Makefile
+index 6922cd6850a2..53c3fe1aeb29 100644
+--- a/drivers/base/Makefile
++++ b/drivers/base/Makefile
+@@ -4,7 +4,7 @@ obj-y := component.o core.o bus.o dd.o syscore.o \
+ driver.o class.o platform.o \
+ cpu.o firmware.o init.o map.o devres.o \
+ attribute_container.o transport_class.o \
+- topology.o container.o
++ topology.o container.o property.o
+ obj-$(CONFIG_DEVTMPFS) += devtmpfs.o
+ obj-$(CONFIG_DMA_CMA) += dma-contiguous.o
+ obj-y += power/
+diff --git a/drivers/base/property.c b/drivers/base/property.c
+new file mode 100644
+index 000000000000..6a94ef6e83c9
+--- /dev/null
++++ b/drivers/base/property.c
+@@ -0,0 +1,185 @@
++/*
++ * property.c - Unified device property interface.
++ *
++ * Copyright (C) 2014, Intel Corporation
++ * Authors: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
++ * Mika Westerberg <mika.westerberg@linux.intel.com>
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 as
++ * published by the Free Software Foundation.
++ */
++
++#include <linux/property.h>
++#include <linux/export.h>
++#include <linux/acpi.h>
++#include <linux/of.h>
++
++/**
++ * device_property_present - check if a property of a device is present
++ * @dev: Device whose property is being checked
++ * @propname: Name of the property
++ *
++ * Check if property @propname is present in the device firmware description.
++ */
++bool device_property_present(struct device *dev, const char *propname)
++{
++ if (IS_ENABLED(CONFIG_OF) && dev->of_node)
++ return of_property_read_bool(dev->of_node, propname);
++
++ return !acpi_dev_prop_get(ACPI_COMPANION(dev), propname, NULL);
++}
++EXPORT_SYMBOL_GPL(device_property_present);
++
++#define OF_DEV_PROP_READ_ARRAY(node, propname, type, val, nval) \
++ (val) ? of_property_read_##type##_array((node), (propname), (val), (nval)) \
++ : of_property_count_elems_of_size((node), (propname), sizeof(type))
++
++#define DEV_PROP_READ_ARRAY(_dev_, _propname_, _type_, _proptype_, _val_, _nval_) \
++ IS_ENABLED(CONFIG_OF) && _dev_->of_node ? \
++ (OF_DEV_PROP_READ_ARRAY(_dev_->of_node, _propname_, _type_, \
++ _val_, _nval_)) : \
++ acpi_dev_prop_read(ACPI_COMPANION(_dev_), _propname_, \
++ _proptype_, _val_, _nval_)
++
++/**
++ * device_property_read_u8_array - return a u8 array property of a device
++ * @dev: Device to get the property of
++ * @propname: Name of the property
++ * @val: The values are stored here
++ * @nval: Size of the @val array
++ *
++ * Function reads an array of u8 properties with @propname from the device
++ * firmware description and stores them to @val if found.
++ *
++ * Return: %0 if the property was found (success),
++ * %-EINVAL if given arguments are not valid,
++ * %-ENODATA if the property does not have a value,
++ * %-EPROTO if the property is not an array of numbers,
++ * %-EOVERFLOW if the size of the property is not as expected.
++ */
++int device_property_read_u8_array(struct device *dev, const char *propname,
++ u8 *val, size_t nval)
++{
++ return DEV_PROP_READ_ARRAY(dev, propname, u8, DEV_PROP_U8, val, nval);
++}
++EXPORT_SYMBOL_GPL(device_property_read_u8_array);
++
++/**
++ * device_property_read_u16_array - return a u16 array property of a device
++ * @dev: Device to get the property of
++ * @propname: Name of the property
++ * @val: The values are stored here
++ * @nval: Size of the @val array
++ *
++ * Function reads an array of u16 properties with @propname from the device
++ * firmware description and stores them to @val if found.
++ *
++ * Return: %0 if the property was found (success),
++ * %-EINVAL if given arguments are not valid,
++ * %-ENODATA if the property does not have a value,
++ * %-EPROTO if the property is not an array of numbers,
++ * %-EOVERFLOW if the size of the property is not as expected.
++ */
++int device_property_read_u16_array(struct device *dev, const char *propname,
++ u16 *val, size_t nval)
++{
++ return DEV_PROP_READ_ARRAY(dev, propname, u16, DEV_PROP_U16, val, nval);
++}
++EXPORT_SYMBOL_GPL(device_property_read_u16_array);
++
++/**
++ * device_property_read_u32_array - return a u32 array property of a device
++ * @dev: Device to get the property of
++ * @propname: Name of the property
++ * @val: The values are stored here
++ * @nval: Size of the @val array
++ *
++ * Function reads an array of u32 properties with @propname from the device
++ * firmware description and stores them to @val if found.
++ *
++ * Return: %0 if the property was found (success),
++ * %-EINVAL if given arguments are not valid,
++ * %-ENODATA if the property does not have a value,
++ * %-EPROTO if the property is not an array of numbers,
++ * %-EOVERFLOW if the size of the property is not as expected.
++ */
++int device_property_read_u32_array(struct device *dev, const char *propname,
++ u32 *val, size_t nval)
++{
++ return DEV_PROP_READ_ARRAY(dev, propname, u32, DEV_PROP_U32, val, nval);
++}
++EXPORT_SYMBOL_GPL(device_property_read_u32_array);
++
++/**
++ * device_property_read_u64_array - return a u64 array property of a device
++ * @dev: Device to get the property of
++ * @propname: Name of the property
++ * @val: The values are stored here
++ * @nval: Size of the @val array
++ *
++ * Function reads an array of u64 properties with @propname from the device
++ * firmware description and stores them to @val if found.
++ *
++ * Return: %0 if the property was found (success),
++ * %-EINVAL if given arguments are not valid,
++ * %-ENODATA if the property does not have a value,
++ * %-EPROTO if the property is not an array of numbers,
++ * %-EOVERFLOW if the size of the property is not as expected.
++ */
++int device_property_read_u64_array(struct device *dev, const char *propname,
++ u64 *val, size_t nval)
++{
++ return DEV_PROP_READ_ARRAY(dev, propname, u64, DEV_PROP_U64, val, nval);
++}
++EXPORT_SYMBOL_GPL(device_property_read_u64_array);
++
++/**
++ * device_property_read_string_array - return a string array property of device
++ * @dev: Device to get the property of
++ * @propname: Name of the property
++ * @val: The values are stored here
++ * @nval: Size of the @val array
++ *
++ * Function reads an array of string properties with @propname from the device
++ * firmware description and stores them to @val if found.
++ *
++ * Return: %0 if the property was found (success),
++ * %-EINVAL if given arguments are not valid,
++ * %-ENODATA if the property does not have a value,
++ * %-EPROTO or %-EILSEQ if the property is not an array of strings,
++ * %-EOVERFLOW if the size of the property is not as expected.
++ */
++int device_property_read_string_array(struct device *dev, const char *propname,
++ const char **val, size_t nval)
++{
++ return IS_ENABLED(CONFIG_OF) && dev->of_node ?
++ of_property_read_string_array(dev->of_node, propname, val, nval) :
++ acpi_dev_prop_read(ACPI_COMPANION(dev), propname,
++ DEV_PROP_STRING, val, nval);
++}
++EXPORT_SYMBOL_GPL(device_property_read_string_array);
++
++/**
++ * device_property_read_string - return a string property of a device
++ * @dev: Device to get the property of
++ * @propname: Name of the property
++ * @val: The value is stored here
++ *
++ * Function reads property @propname from the device firmware description and
++ * stores the value into @val if found. The value is checked to be a string.
++ *
++ * Return: %0 if the property was found (success),
++ * %-EINVAL if given arguments are not valid,
++ * %-ENODATA if the property does not have a value,
++ * %-EPROTO or %-EILSEQ if the property type is not a string.
++ */
++int device_property_read_string(struct device *dev, const char *propname,
++ const char **val)
++{
++ return IS_ENABLED(CONFIG_OF) && dev->of_node ?
++ of_property_read_string(dev->of_node, propname, val) :
++ acpi_dev_prop_read(ACPI_COMPANION(dev), propname,
++ DEV_PROP_STRING, val, 1);
++}
++EXPORT_SYMBOL_GPL(device_property_read_string);
+diff --git a/drivers/dma/sh/shdmac.c b/drivers/dma/sh/shdmac.c
+index 58eb85770eba..8a083aa23748 100644
+--- a/drivers/dma/sh/shdmac.c
++++ b/drivers/dma/sh/shdmac.c
+@@ -443,7 +443,7 @@ static bool sh_dmae_reset(struct sh_dmae_device *shdev)
+ return ret;
+ }
+
+-#if defined(CONFIG_CPU_SH4) || defined(CONFIG_ARM)
++#if defined(CONFIG_CPU_SH4) || defined(CONFIG_ARCH_SHMOBILE)
+ static irqreturn_t sh_dmae_err(int irq, void *data)
+ {
+ struct sh_dmae_device *shdev = data;
+@@ -689,7 +689,7 @@ static int sh_dmae_probe(struct platform_device *pdev)
+ const struct sh_dmae_pdata *pdata;
+ unsigned long chan_flag[SH_DMAE_MAX_CHANNELS] = {};
+ int chan_irq[SH_DMAE_MAX_CHANNELS];
+-#if defined(CONFIG_CPU_SH4) || defined(CONFIG_ARM)
++#if defined(CONFIG_CPU_SH4) || defined(CONFIG_ARCH_SHMOBILE)
+ unsigned long irqflags = 0;
+ int errirq;
+ #endif
+diff --git a/drivers/hid/Kconfig b/drivers/hid/Kconfig
+index f42df4dd58d2..6f299cd54e6d 100644
+--- a/drivers/hid/Kconfig
++++ b/drivers/hid/Kconfig
+@@ -378,6 +378,17 @@ config HID_LOGITECH_DJ
+ generic USB_HID driver and all incoming events will be multiplexed
+ into a single mouse and a single keyboard device.
+
++config HID_LOGITECH_HIDPP
++ tristate "Logitech HID++ devices support"
++ depends on HID_LOGITECH
++ ---help---
++ Support for Logitech devices relyingon the HID++ Logitech specification
++
++ Say Y if you want support for Logitech devices relying on the HID++
++ specification. Such devices are the various Logitech Touchpads (T650,
++ T651, TK820), some mice (Zone Touch mouse), or even keyboards (Solar
++ Keayboard).
++
+ config LOGITECH_FF
+ bool "Logitech force feedback support"
+ depends on HID_LOGITECH
+diff --git a/drivers/hid/Makefile b/drivers/hid/Makefile
+index e2850d8af9ca..b102774b4e16 100644
+--- a/drivers/hid/Makefile
++++ b/drivers/hid/Makefile
+@@ -63,6 +63,7 @@ obj-$(CONFIG_HID_LCPOWER) += hid-lcpower.o
+ obj-$(CONFIG_HID_LENOVO) += hid-lenovo.o
+ obj-$(CONFIG_HID_LOGITECH) += hid-logitech.o
+ obj-$(CONFIG_HID_LOGITECH_DJ) += hid-logitech-dj.o
++obj-$(CONFIG_HID_LOGITECH_HIDPP) += hid-logitech-hidpp.o
+ obj-$(CONFIG_HID_MAGICMOUSE) += hid-magicmouse.o
+ obj-$(CONFIG_HID_MICROSOFT) += hid-microsoft.o
+ obj-$(CONFIG_HID_MONTEREY) += hid-monterey.o
+diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
+index dfaccfca0688..77ba023cab95 100644
+--- a/drivers/hid/hid-core.c
++++ b/drivers/hid/hid-core.c
+@@ -1811,6 +1811,7 @@ static const struct hid_device_id hid_have_special_driver[] = {
+ { HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_MOUSEPEN_I608X) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_MOUSEPEN_I608X_2) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_EASYPEN_M610X) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_PENSKETCH_M912) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_LABTEC, USB_DEVICE_ID_LABTEC_WIRELESS_KEYBOARD) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_LCPOWER, USB_DEVICE_ID_LCPOWER_LC1000 ) },
+ #if IS_ENABLED(CONFIG_HID_LENOVO)
+@@ -1823,6 +1824,7 @@ static const struct hid_device_id hid_have_special_driver[] = {
+ { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_S510_RECEIVER_2) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_RECEIVER) },
+ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_HARMONY_PS3) },
++ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_T651) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_DINOVO_DESKTOP) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_DINOVO_EDGE) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_DINOVO_MINI) },
+@@ -1858,6 +1860,7 @@ static const struct hid_device_id hid_have_special_driver[] = {
+ { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_SIDEWINDER_GV) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_NE4K) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_NE4K_JP) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_NE7K) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_LK6K) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_PRESENTER_8K_USB) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_DIGITAL_MEDIA_3K) },
+@@ -1909,6 +1912,7 @@ static const struct hid_device_id hid_have_special_driver[] = {
+ #endif
+ #if IS_ENABLED(CONFIG_HID_SAITEK)
+ { HID_USB_DEVICE(USB_VENDOR_ID_SAITEK, USB_DEVICE_ID_SAITEK_PS1000) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_SAITEK, USB_DEVICE_ID_SAITEK_RAT7_OLD) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_SAITEK, USB_DEVICE_ID_SAITEK_RAT7) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_SAITEK, USB_DEVICE_ID_SAITEK_MMO7) },
+ #endif
+@@ -1954,6 +1958,7 @@ static const struct hid_device_id hid_have_special_driver[] = {
+ { HID_USB_DEVICE(USB_VENDOR_ID_WISEGROUP_LTD, USB_DEVICE_ID_SUPER_JOY_BOX_3_PRO) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_WISEGROUP_LTD, USB_DEVICE_ID_SUPER_DUAL_BOX_PRO) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_WISEGROUP_LTD, USB_DEVICE_ID_SUPER_JOY_BOX_5_PRO) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_PLAYDOTCOM, USB_DEVICE_ID_PLAYDOTCOM_EMS_USBII) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_WALTOP, USB_DEVICE_ID_WALTOP_SLIM_TABLET_5_8_INCH) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_WALTOP, USB_DEVICE_ID_WALTOP_SLIM_TABLET_12_1_INCH) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_WALTOP, USB_DEVICE_ID_WALTOP_Q_PAD) },
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index 0e28190480d7..07e19295fad9 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -164,6 +164,7 @@
+ #define USB_DEVICE_ID_ATEN_2PORTKVM 0x2204
+ #define USB_DEVICE_ID_ATEN_4PORTKVM 0x2205
+ #define USB_DEVICE_ID_ATEN_4PORTKVMC 0x2208
++#define USB_DEVICE_ID_ATEN_CS682 0x2213
+
+ #define USB_VENDOR_ID_ATMEL 0x03eb
+ #define USB_DEVICE_ID_ATMEL_MULTITOUCH 0x211c
+@@ -454,6 +455,11 @@
+ #define USB_DEVICE_ID_UGCI_FLYING 0x0020
+ #define USB_DEVICE_ID_UGCI_FIGHTING 0x0030
+
++#define USB_VENDOR_ID_HP 0x03f0
++#define USB_PRODUCT_ID_HP_LOGITECH_OEM_USB_OPTICAL_MOUSE_0A4A 0x0a4a
++#define USB_PRODUCT_ID_HP_LOGITECH_OEM_USB_OPTICAL_MOUSE_0B4A 0x0b4a
++#define USB_PRODUCT_ID_HP_PIXART_OEM_USB_OPTICAL_MOUSE 0x134a
++
+ #define USB_VENDOR_ID_HUION 0x256c
+ #define USB_DEVICE_ID_HUION_TABLET 0x006e
+
+@@ -528,6 +534,7 @@
+ #define USB_DEVICE_ID_KYE_MOUSEPEN_I608X 0x5011
+ #define USB_DEVICE_ID_KYE_MOUSEPEN_I608X_2 0x501a
+ #define USB_DEVICE_ID_KYE_EASYPEN_M610X 0x5013
++#define USB_DEVICE_ID_KYE_PENSKETCH_M912 0x5015
+
+ #define USB_VENDOR_ID_LABTEC 0x1020
+ #define USB_DEVICE_ID_LABTEC_WIRELESS_KEYBOARD 0x0006
+@@ -580,10 +587,15 @@
+
+ #define USB_VENDOR_ID_LOGITECH 0x046d
+ #define USB_DEVICE_ID_LOGITECH_AUDIOHUB 0x0a0e
++#define USB_DEVICE_ID_LOGITECH_T651 0xb00c
++#define USB_DEVICE_ID_LOGITECH_C077 0xc007
+ #define USB_DEVICE_ID_LOGITECH_RECEIVER 0xc101
+ #define USB_DEVICE_ID_LOGITECH_HARMONY_FIRST 0xc110
+ #define USB_DEVICE_ID_LOGITECH_HARMONY_LAST 0xc14f
+ #define USB_DEVICE_ID_LOGITECH_HARMONY_PS3 0x0306
++#define USB_DEVICE_ID_LOGITECH_MOUSE_C01A 0xc01a
++#define USB_DEVICE_ID_LOGITECH_MOUSE_C05A 0xc05a
++#define USB_DEVICE_ID_LOGITECH_MOUSE_C06A 0xc06a
+ #define USB_DEVICE_ID_LOGITECH_RUMBLEPAD_CORD 0xc20a
+ #define USB_DEVICE_ID_LOGITECH_RUMBLEPAD 0xc211
+ #define USB_DEVICE_ID_LOGITECH_EXTREME_3D 0xc215
+@@ -646,6 +658,7 @@
+ #define USB_DEVICE_ID_MS_LK6K 0x00f9
+ #define USB_DEVICE_ID_MS_PRESENTER_8K_BT 0x0701
+ #define USB_DEVICE_ID_MS_PRESENTER_8K_USB 0x0713
++#define USB_DEVICE_ID_MS_NE7K 0x071d
+ #define USB_DEVICE_ID_MS_DIGITAL_MEDIA_3K 0x0730
+ #define USB_DEVICE_ID_MS_COMFORT_MOUSE_4500 0x076c
+ #define USB_DEVICE_ID_MS_SURFACE_PRO_2 0x0799
+@@ -787,6 +800,7 @@
+ #define USB_VENDOR_ID_SAITEK 0x06a3
+ #define USB_DEVICE_ID_SAITEK_RUMBLEPAD 0xff17
+ #define USB_DEVICE_ID_SAITEK_PS1000 0x0621
++#define USB_DEVICE_ID_SAITEK_RAT7_OLD 0x0ccb
+ #define USB_DEVICE_ID_SAITEK_RAT7 0x0cd7
+ #define USB_DEVICE_ID_SAITEK_MMO7 0x0cd0
+
+@@ -997,10 +1011,18 @@
+ #define USB_DEVICE_ID_ZYTRONIC_ZXY100 0x0005
+
+ #define USB_VENDOR_ID_PRIMAX 0x0461
++#define USB_DEVICE_ID_PRIMAX_MOUSE_4D22 0x4d22
+ #define USB_DEVICE_ID_PRIMAX_KEYBOARD 0x4e05
+
+
+ #define USB_VENDOR_ID_RISO_KAGAKU 0x1294 /* Riso Kagaku Corp. */
+ #define USB_DEVICE_ID_RI_KA_WEBMAIL 0x1320 /* Webmail Notifier */
+
++#define USB_VENDOR_ID_MULTIPLE_1781 0x1781
++#define USB_DEVICE_ID_RAPHNET_4NES4SNES_OLD 0x0a8d
++
++#define USB_VENDOR_ID_DRACAL_RAPHNET 0x289b
++#define USB_DEVICE_ID_RAPHNET_2NES2SNES 0x0002
++#define USB_DEVICE_ID_RAPHNET_4NES4SNES 0x0003
++
+ #endif
+diff --git a/drivers/hid/hid-kye.c b/drivers/hid/hid-kye.c
+index 158fcf577fae..32e6d8d9ded0 100644
+--- a/drivers/hid/hid-kye.c
++++ b/drivers/hid/hid-kye.c
+@@ -268,6 +268,137 @@ static __u8 easypen_m610x_rdesc_fixed[] = {
+ 0xC0 /* End Collection */
+ };
+
++
++/* Original PenSketch M912 report descriptor size */
++#define PENSKETCH_M912_RDESC_ORIG_SIZE 482
++
++/* Fixed PenSketch M912 report descriptor */
++static __u8 pensketch_m912_rdesc_fixed[] = {
++ 0x05, 0x01, /* Usage Page (Desktop), */
++ 0x08, /* Usage (00h), */
++ 0xA1, 0x01, /* Collection (Application), */
++ 0x85, 0x05, /* Report ID (5), */
++ 0x06, 0x00, 0xFF, /* Usage Page (FF00h), */
++ 0x09, 0x01, /* Usage (01h), */
++ 0x15, 0x81, /* Logical Minimum (-127), */
++ 0x25, 0x7F, /* Logical Maximum (127), */
++ 0x75, 0x08, /* Report Size (8), */
++ 0x95, 0x07, /* Report Count (7), */
++ 0xB1, 0x02, /* Feature (Variable), */
++ 0xC0, /* End Collection, */
++ 0x05, 0x0D, /* Usage Page (Digitizer), */
++ 0x09, 0x02, /* Usage (Pen), */
++ 0xA1, 0x01, /* Collection (Application), */
++ 0x85, 0x10, /* Report ID (16), */
++ 0x09, 0x20, /* Usage (Stylus), */
++ 0xA0, /* Collection (Physical), */
++ 0x09, 0x42, /* Usage (Tip Switch), */
++ 0x09, 0x44, /* Usage (Barrel Switch), */
++ 0x09, 0x46, /* Usage (Tablet Pick), */
++ 0x14, /* Logical Minimum (0), */
++ 0x25, 0x01, /* Logical Maximum (1), */
++ 0x75, 0x01, /* Report Size (1), */
++ 0x95, 0x03, /* Report Count (3), */
++ 0x81, 0x02, /* Input (Variable), */
++ 0x95, 0x04, /* Report Count (4), */
++ 0x81, 0x03, /* Input (Constant, Variable), */
++ 0x09, 0x32, /* Usage (In Range), */
++ 0x95, 0x01, /* Report Count (1), */
++ 0x81, 0x02, /* Input (Variable), */
++ 0x75, 0x10, /* Report Size (16), */
++ 0x95, 0x01, /* Report Count (1), */
++ 0xA4, /* Push, */
++ 0x05, 0x01, /* Usage Page (Desktop), */
++ 0x55, 0xFD, /* Unit Exponent (-3), */
++ 0x65, 0x13, /* Unit (Inch), */
++ 0x14, /* Logical Minimum (0), */
++ 0x34, /* Physical Minimum (0), */
++ 0x09, 0x30, /* Usage (X), */
++ 0x27, 0x00, 0xF0, 0x00, 0x00, /* Logical Maximum (61440), */
++ 0x46, 0xE0, 0x2E, /* Physical Maximum (12000), */
++ 0x81, 0x02, /* Input (Variable), */
++ 0x09, 0x31, /* Usage (Y), */
++ 0x27, 0x00, 0xB4, 0x00, 0x00, /* Logical Maximum (46080), */
++ 0x46, 0x28, 0x23, /* Physical Maximum (9000), */
++ 0x81, 0x02, /* Input (Variable), */
++ 0xB4, /* Pop, */
++ 0x09, 0x30, /* Usage (Tip Pressure), */
++ 0x14, /* Logical Minimum (0), */
++ 0x26, 0xFF, 0x07, /* Logical Maximum (2047), */
++ 0x81, 0x02, /* Input (Variable), */
++ 0xC0, /* End Collection, */
++ 0xC0, /* End Collection, */
++ 0x05, 0x0D, /* Usage Page (Digitizer), */
++ 0x09, 0x21, /* Usage (Puck), */
++ 0xA1, 0x01, /* Collection (Application), */
++ 0x85, 0x11, /* Report ID (17), */
++ 0x09, 0x21, /* Usage (Puck), */
++ 0xA0, /* Collection (Physical), */
++ 0x05, 0x09, /* Usage Page (Button), */
++ 0x75, 0x01, /* Report Size (1), */
++ 0x19, 0x01, /* Usage Minimum (01h), */
++ 0x29, 0x03, /* Usage Maximum (03h), */
++ 0x14, /* Logical Minimum (0), */
++ 0x25, 0x01, /* Logical Maximum (1), */
++ 0x95, 0x03, /* Report Count (3), */
++ 0x81, 0x02, /* Input (Variable), */
++ 0x95, 0x04, /* Report Count (4), */
++ 0x81, 0x01, /* Input (Constant), */
++ 0x95, 0x01, /* Report Count (1), */
++ 0x0B, 0x32, 0x00, 0x0D, 0x00, /* Usage (Digitizer In Range), */
++ 0x14, /* Logical Minimum (0), */
++ 0x25, 0x01, /* Logical Maximum (1), */
++ 0x81, 0x02, /* Input (Variable), */
++ 0xA4, /* Push, */
++ 0x05, 0x01, /* Usage Page (Desktop), */
++ 0x75, 0x10, /* Report Size (16), */
++ 0x95, 0x01, /* Report Count (1), */
++ 0x55, 0xFD, /* Unit Exponent (-3), */
++ 0x65, 0x13, /* Unit (Inch), */
++ 0x14, /* Logical Minimum (0), */
++ 0x34, /* Physical Minimum (0), */
++ 0x09, 0x30, /* Usage (X), */
++ 0x27, 0x00, 0xF0, 0x00, 0x00, /* Logical Maximum (61440), */
++ 0x46, 0xE0, 0x2E, /* Physical Maximum (12000), */
++ 0x81, 0x02, /* Input (Variable), */
++ 0x09, 0x31, /* Usage (Y), */
++ 0x27, 0x00, 0xB4, 0x00, 0x00, /* Logical Maximum (46080), */
++ 0x46, 0x28, 0x23, /* Physical Maximum (9000), */
++ 0x81, 0x02, /* Input (Variable), */
++ 0x09, 0x38, /* Usage (Wheel), */
++ 0x75, 0x08, /* Report Size (8), */
++ 0x95, 0x01, /* Report Count (1), */
++ 0x15, 0xFF, /* Logical Minimum (-1), */
++ 0x25, 0x01, /* Logical Maximum (1), */
++ 0x34, /* Physical Minimum (0), */
++ 0x44, /* Physical Maximum (0), */
++ 0x81, 0x06, /* Input (Variable, Relative), */
++ 0xB4, /* Pop, */
++ 0xC0, /* End Collection, */
++ 0xC0, /* End Collection, */
++ 0x05, 0x0C, /* Usage Page (Consumer), */
++ 0x09, 0x01, /* Usage (Consumer Control), */
++ 0xA1, 0x01, /* Collection (Application), */
++ 0x85, 0x12, /* Report ID (18), */
++ 0x14, /* Logical Minimum (0), */
++ 0x25, 0x01, /* Logical Maximum (1), */
++ 0x75, 0x01, /* Report Size (1), */
++ 0x95, 0x08, /* Report Count (8), */
++ 0x05, 0x0C, /* Usage Page (Consumer), */
++ 0x0A, 0x6A, 0x02, /* Usage (AC Delete), */
++ 0x0A, 0x1A, 0x02, /* Usage (AC Undo), */
++ 0x0A, 0x01, 0x02, /* Usage (AC New), */
++ 0x0A, 0x2F, 0x02, /* Usage (AC Zoom), */
++ 0x0A, 0x25, 0x02, /* Usage (AC Forward), */
++ 0x0A, 0x24, 0x02, /* Usage (AC Back), */
++ 0x0A, 0x2D, 0x02, /* Usage (AC Zoom In), */
++ 0x0A, 0x2E, 0x02, /* Usage (AC Zoom Out), */
++ 0x81, 0x02, /* Input (Variable), */
++ 0x95, 0x30, /* Report Count (48), */
++ 0x81, 0x03, /* Input (Constant, Variable), */
++ 0xC0 /* End Collection */
++};
++
+ static __u8 *kye_consumer_control_fixup(struct hid_device *hdev, __u8 *rdesc,
+ unsigned int *rsize, int offset, const char *device_name) {
+ /*
+@@ -335,6 +466,12 @@ static __u8 *kye_report_fixup(struct hid_device *hdev, __u8 *rdesc,
+ *rsize = sizeof(easypen_m610x_rdesc_fixed);
+ }
+ break;
++ case USB_DEVICE_ID_KYE_PENSKETCH_M912:
++ if (*rsize == PENSKETCH_M912_RDESC_ORIG_SIZE) {
++ rdesc = pensketch_m912_rdesc_fixed;
++ *rsize = sizeof(pensketch_m912_rdesc_fixed);
++ }
++ break;
+ case USB_DEVICE_ID_GENIUS_GILA_GAMING_MOUSE:
+ rdesc = kye_consumer_control_fixup(hdev, rdesc, rsize, 104,
+ "Genius Gila Gaming Mouse");
+@@ -418,6 +555,7 @@ static int kye_probe(struct hid_device *hdev, const struct hid_device_id *id)
+ case USB_DEVICE_ID_KYE_MOUSEPEN_I608X:
+ case USB_DEVICE_ID_KYE_MOUSEPEN_I608X_2:
+ case USB_DEVICE_ID_KYE_EASYPEN_M610X:
++ case USB_DEVICE_ID_KYE_PENSKETCH_M912:
+ ret = kye_tablet_enable(hdev);
+ if (ret) {
+ hid_err(hdev, "tablet enabling failed\n");
+@@ -457,6 +595,8 @@ static const struct hid_device_id kye_devices[] = {
+ USB_DEVICE_ID_GENIUS_GX_IMPERATOR) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_KYE,
+ USB_DEVICE_ID_GENIUS_MANTICORE) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_KYE,
++ USB_DEVICE_ID_KYE_PENSKETCH_M912) },
+ { }
+ };
+ MODULE_DEVICE_TABLE(hid, kye_devices);
+diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c
+new file mode 100644
+index 000000000000..7dd9163f7e03
+--- /dev/null
++++ b/drivers/hid/hid-logitech-hidpp.c
+@@ -0,0 +1,842 @@
++/*
++ * HIDPP protocol for Logitech Unifying receivers
++ *
++ * Copyright (c) 2011 Logitech (c)
++ * Copyright (c) 2012-2013 Google (c)
++ * Copyright (c) 2013-2014 Red Hat Inc.
++ */
++
++/*
++ * This program is free software; you can redistribute it and/or modify it
++ * under the terms of the GNU General Public License as published by the Free
++ * Software Foundation; version 2 of the License.
++ */
++
++#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
++
++#include <linux/device.h>
++#include <linux/hid.h>
++#include <linux/module.h>
++#include <linux/slab.h>
++#include <linux/sched.h>
++#include <linux/kfifo.h>
++#include <linux/input/mt.h>
++#include <asm/unaligned.h>
++#include "hid-ids.h"
++
++MODULE_LICENSE("GPL");
++MODULE_AUTHOR("Benjamin Tissoires <benjamin.tissoires@gmail.com>");
++MODULE_AUTHOR("Nestor Lopez Casado <nlopezcasad@logitech.com>");
++
++#define REPORT_ID_HIDPP_SHORT 0x10
++#define REPORT_ID_HIDPP_LONG 0x11
++
++#define HIDPP_REPORT_SHORT_LENGTH 7
++#define HIDPP_REPORT_LONG_LENGTH 20
++
++#define HIDPP_QUIRK_CLASS_WTP BIT(0)
++
++/*
++ * There are two hidpp protocols in use, the first version hidpp10 is known
++ * as register access protocol or RAP, the second version hidpp20 is known as
++ * feature access protocol or FAP
++ *
++ * Most older devices (including the Unifying usb receiver) use the RAP protocol
++ * where as most newer devices use the FAP protocol. Both protocols are
++ * compatible with the underlying transport, which could be usb, Unifiying, or
++ * bluetooth. The message lengths are defined by the hid vendor specific report
++ * descriptor for the HIDPP_SHORT report type (total message lenth 7 bytes) and
++ * the HIDPP_LONG report type (total message length 20 bytes)
++ *
++ * The RAP protocol uses both report types, whereas the FAP only uses HIDPP_LONG
++ * messages. The Unifying receiver itself responds to RAP messages (device index
++ * is 0xFF for the receiver), and all messages (short or long) with a device
++ * index between 1 and 6 are passed untouched to the corresponding paired
++ * Unifying device.
++ *
++ * The paired device can be RAP or FAP, it will receive the message untouched
++ * from the Unifiying receiver.
++ */
++
++struct fap {
++ u8 feature_index;
++ u8 funcindex_clientid;
++ u8 params[HIDPP_REPORT_LONG_LENGTH - 4U];
++};
++
++struct rap {
++ u8 sub_id;
++ u8 reg_address;
++ u8 params[HIDPP_REPORT_LONG_LENGTH - 4U];
++};
++
++struct hidpp_report {
++ u8 report_id;
++ u8 device_index;
++ union {
++ struct fap fap;
++ struct rap rap;
++ u8 rawbytes[sizeof(struct fap)];
++ };
++} __packed;
++
++struct hidpp_device {
++ struct hid_device *hid_dev;
++ struct mutex send_mutex;
++ void *send_receive_buf;
++ wait_queue_head_t wait;
++ bool answer_available;
++ u8 protocol_major;
++ u8 protocol_minor;
++
++ void *private_data;
++
++ unsigned long quirks;
++};
++
++
++#define HIDPP_ERROR 0x8f
++#define HIDPP_ERROR_SUCCESS 0x00
++#define HIDPP_ERROR_INVALID_SUBID 0x01
++#define HIDPP_ERROR_INVALID_ADRESS 0x02
++#define HIDPP_ERROR_INVALID_VALUE 0x03
++#define HIDPP_ERROR_CONNECT_FAIL 0x04
++#define HIDPP_ERROR_TOO_MANY_DEVICES 0x05
++#define HIDPP_ERROR_ALREADY_EXISTS 0x06
++#define HIDPP_ERROR_BUSY 0x07
++#define HIDPP_ERROR_UNKNOWN_DEVICE 0x08
++#define HIDPP_ERROR_RESOURCE_ERROR 0x09
++#define HIDPP_ERROR_REQUEST_UNAVAILABLE 0x0a
++#define HIDPP_ERROR_INVALID_PARAM_VALUE 0x0b
++#define HIDPP_ERROR_WRONG_PIN_CODE 0x0c
++
++static int __hidpp_send_report(struct hid_device *hdev,
++ struct hidpp_report *hidpp_report)
++{
++ int fields_count, ret;
++
++ switch (hidpp_report->report_id) {
++ case REPORT_ID_HIDPP_SHORT:
++ fields_count = HIDPP_REPORT_SHORT_LENGTH;
++ break;
++ case REPORT_ID_HIDPP_LONG:
++ fields_count = HIDPP_REPORT_LONG_LENGTH;
++ break;
++ default:
++ return -ENODEV;
++ }
++
++ /*
++ * set the device_index as the receiver, it will be overwritten by
++ * hid_hw_request if needed
++ */
++ hidpp_report->device_index = 0xff;
++
++ ret = hid_hw_raw_request(hdev, hidpp_report->report_id,
++ (u8 *)hidpp_report, fields_count, HID_OUTPUT_REPORT,
++ HID_REQ_SET_REPORT);
++
++ return ret == fields_count ? 0 : -1;
++}
++
++static int hidpp_send_message_sync(struct hidpp_device *hidpp,
++ struct hidpp_report *message,
++ struct hidpp_report *response)
++{
++ int ret;
++
++ mutex_lock(&hidpp->send_mutex);
++
++ hidpp->send_receive_buf = response;
++ hidpp->answer_available = false;
++
++ /*
++ * So that we can later validate the answer when it arrives
++ * in hidpp_raw_event
++ */
++ *response = *message;
++
++ ret = __hidpp_send_report(hidpp->hid_dev, message);
++
++ if (ret) {
++ dbg_hid("__hidpp_send_report returned err: %d\n", ret);
++ memset(response, 0, sizeof(struct hidpp_report));
++ goto exit;
++ }
++
++ if (!wait_event_timeout(hidpp->wait, hidpp->answer_available,
++ 5*HZ)) {
++ dbg_hid("%s:timeout waiting for response\n", __func__);
++ memset(response, 0, sizeof(struct hidpp_report));
++ ret = -ETIMEDOUT;
++ }
++
++ if (response->report_id == REPORT_ID_HIDPP_SHORT &&
++ response->fap.feature_index == HIDPP_ERROR) {
++ ret = response->fap.params[1];
++ dbg_hid("__hidpp_send_report got hidpp error %02X\n", ret);
++ goto exit;
++ }
++
++exit:
++ mutex_unlock(&hidpp->send_mutex);
++ return ret;
++
++}
++
++static int hidpp_send_fap_command_sync(struct hidpp_device *hidpp,
++ u8 feat_index, u8 funcindex_clientid, u8 *params, int param_count,
++ struct hidpp_report *response)
++{
++ struct hidpp_report *message = kzalloc(sizeof(struct hidpp_report),
++ GFP_KERNEL);
++ int ret;
++
++ if (param_count > sizeof(message->fap.params))
++ return -EINVAL;
++
++ message->report_id = REPORT_ID_HIDPP_LONG;
++ message->fap.feature_index = feat_index;
++ message->fap.funcindex_clientid = funcindex_clientid;
++ memcpy(&message->fap.params, params, param_count);
++
++ ret = hidpp_send_message_sync(hidpp, message, response);
++ kfree(message);
++ return ret;
++}
++
++static inline bool hidpp_match_answer(struct hidpp_report *question,
++ struct hidpp_report *answer)
++{
++ return (answer->fap.feature_index == question->fap.feature_index) &&
++ (answer->fap.funcindex_clientid == question->fap.funcindex_clientid);
++}
++
++static inline bool hidpp_match_error(struct hidpp_report *question,
++ struct hidpp_report *answer)
++{
++ return (answer->fap.feature_index == HIDPP_ERROR) &&
++ (answer->fap.funcindex_clientid == question->fap.feature_index) &&
++ (answer->fap.params[0] == question->fap.funcindex_clientid);
++}
++
++/* -------------------------------------------------------------------------- */
++/* 0x0000: Root */
++/* -------------------------------------------------------------------------- */
++
++#define HIDPP_PAGE_ROOT 0x0000
++#define HIDPP_PAGE_ROOT_IDX 0x00
++
++#define CMD_ROOT_GET_FEATURE 0x01
++#define CMD_ROOT_GET_PROTOCOL_VERSION 0x11
++
++static int hidpp_root_get_feature(struct hidpp_device *hidpp, u16 feature,
++ u8 *feature_index, u8 *feature_type)
++{
++ struct hidpp_report response;
++ int ret;
++ u8 params[2] = { feature >> 8, feature & 0x00FF };
++
++ ret = hidpp_send_fap_command_sync(hidpp,
++ HIDPP_PAGE_ROOT_IDX,
++ CMD_ROOT_GET_FEATURE,
++ params, 2, &response);
++ if (ret)
++ return ret;
++
++ *feature_index = response.fap.params[0];
++ *feature_type = response.fap.params[1];
++
++ return ret;
++}
++
++static int hidpp_root_get_protocol_version(struct hidpp_device *hidpp)
++{
++ struct hidpp_report response;
++ int ret;
++
++ ret = hidpp_send_fap_command_sync(hidpp,
++ HIDPP_PAGE_ROOT_IDX,
++ CMD_ROOT_GET_PROTOCOL_VERSION,
++ NULL, 0, &response);
++
++ if (ret == 1) {
++ hidpp->protocol_major = 1;
++ hidpp->protocol_minor = 0;
++ return 0;
++ }
++
++ if (ret)
++ return -ret;
++
++ hidpp->protocol_major = response.fap.params[0];
++ hidpp->protocol_minor = response.fap.params[1];
++
++ return ret;
++}
++
++static bool hidpp_is_connected(struct hidpp_device *hidpp)
++{
++ int ret;
++
++ ret = hidpp_root_get_protocol_version(hidpp);
++ if (!ret)
++ hid_dbg(hidpp->hid_dev, "HID++ %u.%u device connected.\n",
++ hidpp->protocol_major, hidpp->protocol_minor);
++ return ret == 0;
++}
++
++/* -------------------------------------------------------------------------- */
++/* 0x0005: GetDeviceNameType */
++/* -------------------------------------------------------------------------- */
++
++#define HIDPP_PAGE_GET_DEVICE_NAME_TYPE 0x0005
++
++#define CMD_GET_DEVICE_NAME_TYPE_GET_COUNT 0x01
++#define CMD_GET_DEVICE_NAME_TYPE_GET_DEVICE_NAME 0x11
++#define CMD_GET_DEVICE_NAME_TYPE_GET_TYPE 0x21
++
++static int hidpp_devicenametype_get_count(struct hidpp_device *hidpp,
++ u8 feature_index, u8 *nameLength)
++{
++ struct hidpp_report response;
++ int ret;
++
++ ret = hidpp_send_fap_command_sync(hidpp, feature_index,
++ CMD_GET_DEVICE_NAME_TYPE_GET_COUNT, NULL, 0, &response);
++
++ if (ret)
++ return -ret;
++
++ *nameLength = response.fap.params[0];
++
++ return ret;
++}
++
++static int hidpp_devicenametype_get_device_name(struct hidpp_device *hidpp,
++ u8 feature_index, u8 char_index, char *device_name, int len_buf)
++{
++ struct hidpp_report response;
++ int ret, i;
++ int count;
++
++ ret = hidpp_send_fap_command_sync(hidpp, feature_index,
++ CMD_GET_DEVICE_NAME_TYPE_GET_DEVICE_NAME, &char_index, 1,
++ &response);
++
++ if (ret)
++ return -ret;
++
++ if (response.report_id == REPORT_ID_HIDPP_LONG)
++ count = HIDPP_REPORT_LONG_LENGTH - 4;
++ else
++ count = HIDPP_REPORT_SHORT_LENGTH - 4;
++
++ if (len_buf < count)
++ count = len_buf;
++
++ for (i = 0; i < count; i++)
++ device_name[i] = response.fap.params[i];
++
++ return count;
++}
++
++static char *hidpp_get_device_name(struct hidpp_device *hidpp, u8 *name_length)
++{
++ u8 feature_type;
++ u8 feature_index;
++ u8 __name_length;
++ char *name;
++ unsigned index = 0;
++ int ret;
++
++ ret = hidpp_root_get_feature(hidpp, HIDPP_PAGE_GET_DEVICE_NAME_TYPE,
++ &feature_index, &feature_type);
++ if (ret)
++ goto out_err;
++
++ ret = hidpp_devicenametype_get_count(hidpp, feature_index,
++ &__name_length);
++ if (ret)
++ goto out_err;
++
++ name = kzalloc(__name_length + 1, GFP_KERNEL);
++ if (!name)
++ goto out_err;
++
++ *name_length = __name_length + 1;
++ while (index < __name_length)
++ index += hidpp_devicenametype_get_device_name(hidpp,
++ feature_index, index, name + index,
++ __name_length - index);
++
++ return name;
++
++out_err:
++ *name_length = 0;
++ return NULL;
++}
++
++/* -------------------------------------------------------------------------- */
++/* 0x6100: TouchPadRawXY */
++/* -------------------------------------------------------------------------- */
++
++#define HIDPP_PAGE_TOUCHPAD_RAW_XY 0x6100
++
++#define CMD_TOUCHPAD_GET_RAW_INFO 0x01
++
++#define TOUCHPAD_RAW_XY_ORIGIN_LOWER_LEFT 0x01
++#define TOUCHPAD_RAW_XY_ORIGIN_UPPER_LEFT 0x03
++
++struct hidpp_touchpad_raw_info {
++ u16 x_size;
++ u16 y_size;
++ u8 z_range;
++ u8 area_range;
++ u8 timestamp_unit;
++ u8 maxcontacts;
++ u8 origin;
++ u16 res;
++};
++
++struct hidpp_touchpad_raw_xy_finger {
++ u8 contact_type;
++ u8 contact_status;
++ u16 x;
++ u16 y;
++ u8 z;
++ u8 area;
++ u8 finger_id;
++};
++
++struct hidpp_touchpad_raw_xy {
++ u16 timestamp;
++ struct hidpp_touchpad_raw_xy_finger fingers[2];
++ u8 spurious_flag;
++ u8 end_of_frame;
++ u8 finger_count;
++ u8 button;
++};
++
++static int hidpp_touchpad_get_raw_info(struct hidpp_device *hidpp,
++ u8 feature_index, struct hidpp_touchpad_raw_info *raw_info)
++{
++ struct hidpp_report response;
++ int ret;
++ u8 *params = (u8 *)response.fap.params;
++
++ ret = hidpp_send_fap_command_sync(hidpp, feature_index,
++ CMD_TOUCHPAD_GET_RAW_INFO, NULL, 0, &response);
++
++ if (ret)
++ return -ret;
++
++ raw_info->x_size = get_unaligned_be16(¶ms[0]);
++ raw_info->y_size = get_unaligned_be16(¶ms[2]);
++ raw_info->z_range = params[4];
++ raw_info->area_range = params[5];
++ raw_info->maxcontacts = params[7];
++ raw_info->origin = params[8];
++ /* res is given in unit per inch */
++ raw_info->res = get_unaligned_be16(¶ms[13]) * 2 / 51;
++
++ return ret;
++}
++
++/* ************************************************************************** */
++/* */
++/* Device Support */
++/* */
++/* ************************************************************************** */
++
++/* -------------------------------------------------------------------------- */
++/* Touchpad HID++ devices */
++/* -------------------------------------------------------------------------- */
++
++struct wtp_data {
++ struct input_dev *input;
++ u16 x_size, y_size;
++ u8 finger_count;
++ u8 mt_feature_index;
++ u8 button_feature_index;
++ u8 maxcontacts;
++ bool flip_y;
++ unsigned int resolution;
++};
++
++static int wtp_input_mapping(struct hid_device *hdev, struct hid_input *hi,
++ struct hid_field *field, struct hid_usage *usage,
++ unsigned long **bit, int *max)
++{
++ return -1;
++}
++
++static void wtp_input_configured(struct hid_device *hdev,
++ struct hid_input *hidinput)
++{
++ struct hidpp_device *hidpp = hid_get_drvdata(hdev);
++ struct wtp_data *wd = hidpp->private_data;
++ struct input_dev *input_dev = hidinput->input;
++
++ __set_bit(EV_ABS, input_dev->evbit);
++ __set_bit(EV_KEY, input_dev->evbit);
++ __clear_bit(EV_REL, input_dev->evbit);
++ __clear_bit(EV_LED, input_dev->evbit);
++
++ input_set_abs_params(input_dev, ABS_MT_POSITION_X, 0, wd->x_size, 0, 0);
++ input_abs_set_res(input_dev, ABS_MT_POSITION_X, wd->resolution);
++ input_set_abs_params(input_dev, ABS_MT_POSITION_Y, 0, wd->y_size, 0, 0);
++ input_abs_set_res(input_dev, ABS_MT_POSITION_Y, wd->resolution);
++
++ /* Max pressure is not given by the devices, pick one */
++ input_set_abs_params(input_dev, ABS_MT_PRESSURE, 0, 50, 0, 0);
++
++ input_set_capability(input_dev, EV_KEY, BTN_LEFT);
++
++ __set_bit(INPUT_PROP_BUTTONPAD, input_dev->propbit);
++
++ input_mt_init_slots(input_dev, wd->maxcontacts, INPUT_MT_POINTER |
++ INPUT_MT_DROP_UNUSED);
++
++ wd->input = input_dev;
++}
++
++static void wtp_touch_event(struct wtp_data *wd,
++ struct hidpp_touchpad_raw_xy_finger *touch_report)
++{
++ int slot;
++
++ if (!touch_report->finger_id || touch_report->contact_type)
++ /* no actual data */
++ return;
++
++ slot = input_mt_get_slot_by_key(wd->input, touch_report->finger_id);
++
++ input_mt_slot(wd->input, slot);
++ input_mt_report_slot_state(wd->input, MT_TOOL_FINGER,
++ touch_report->contact_status);
++ if (touch_report->contact_status) {
++ input_event(wd->input, EV_ABS, ABS_MT_POSITION_X,
++ touch_report->x);
++ input_event(wd->input, EV_ABS, ABS_MT_POSITION_Y,
++ wd->flip_y ? wd->y_size - touch_report->y :
++ touch_report->y);
++ input_event(wd->input, EV_ABS, ABS_MT_PRESSURE,
++ touch_report->area);
++ }
++}
++
++static void wtp_send_raw_xy_event(struct hidpp_device *hidpp,
++ struct hidpp_touchpad_raw_xy *raw)
++{
++ struct wtp_data *wd = hidpp->private_data;
++ int i;
++
++ for (i = 0; i < 2; i++)
++ wtp_touch_event(wd, &(raw->fingers[i]));
++
++ if (raw->end_of_frame)
++ input_event(wd->input, EV_KEY, BTN_LEFT, raw->button);
++
++ if (raw->end_of_frame || raw->finger_count <= 2) {
++ input_mt_sync_frame(wd->input);
++ input_sync(wd->input);
++ }
++}
++
++static int wtp_mouse_raw_xy_event(struct hidpp_device *hidpp, u8 *data)
++{
++ struct wtp_data *wd = hidpp->private_data;
++ u8 c1_area = ((data[7] & 0xf) * (data[7] & 0xf) +
++ (data[7] >> 4) * (data[7] >> 4)) / 2;
++ u8 c2_area = ((data[13] & 0xf) * (data[13] & 0xf) +
++ (data[13] >> 4) * (data[13] >> 4)) / 2;
++ struct hidpp_touchpad_raw_xy raw = {
++ .timestamp = data[1],
++ .fingers = {
++ {
++ .contact_type = 0,
++ .contact_status = !!data[7],
++ .x = get_unaligned_le16(&data[3]),
++ .y = get_unaligned_le16(&data[5]),
++ .z = c1_area,
++ .area = c1_area,
++ .finger_id = data[2],
++ }, {
++ .contact_type = 0,
++ .contact_status = !!data[13],
++ .x = get_unaligned_le16(&data[9]),
++ .y = get_unaligned_le16(&data[11]),
++ .z = c2_area,
++ .area = c2_area,
++ .finger_id = data[8],
++ }
++ },
++ .finger_count = wd->maxcontacts,
++ .spurious_flag = 0,
++ .end_of_frame = (data[0] >> 7) == 0,
++ .button = data[0] & 0x01,
++ };
++
++ wtp_send_raw_xy_event(hidpp, &raw);
++
++ return 1;
++}
++
++static int wtp_raw_event(struct hid_device *hdev, u8 *data, int size)
++{
++ struct hidpp_device *hidpp = hid_get_drvdata(hdev);
++ struct wtp_data *wd = hidpp->private_data;
++
++ if (!wd || !wd->input || (data[0] != 0x02) || size < 21)
++ return 1;
++
++ return wtp_mouse_raw_xy_event(hidpp, &data[7]);
++}
++
++static int wtp_get_config(struct hidpp_device *hidpp)
++{
++ struct wtp_data *wd = hidpp->private_data;
++ struct hidpp_touchpad_raw_info raw_info = {0};
++ u8 feature_type;
++ int ret;
++
++ ret = hidpp_root_get_feature(hidpp, HIDPP_PAGE_TOUCHPAD_RAW_XY,
++ &wd->mt_feature_index, &feature_type);
++ if (ret)
++ /* means that the device is not powered up */
++ return ret;
++
++ ret = hidpp_touchpad_get_raw_info(hidpp, wd->mt_feature_index,
++ &raw_info);
++ if (ret)
++ return ret;
++
++ wd->x_size = raw_info.x_size;
++ wd->y_size = raw_info.y_size;
++ wd->maxcontacts = raw_info.maxcontacts;
++ wd->flip_y = raw_info.origin == TOUCHPAD_RAW_XY_ORIGIN_LOWER_LEFT;
++ wd->resolution = raw_info.res;
++
++ return 0;
++}
++
++static int wtp_allocate(struct hid_device *hdev, const struct hid_device_id *id)
++{
++ struct hidpp_device *hidpp = hid_get_drvdata(hdev);
++ struct wtp_data *wd;
++
++ wd = devm_kzalloc(&hdev->dev, sizeof(struct wtp_data),
++ GFP_KERNEL);
++ if (!wd)
++ return -ENOMEM;
++
++ hidpp->private_data = wd;
++
++ return 0;
++};
++
++/* -------------------------------------------------------------------------- */
++/* Generic HID++ devices */
++/* -------------------------------------------------------------------------- */
++
++static int hidpp_input_mapping(struct hid_device *hdev, struct hid_input *hi,
++ struct hid_field *field, struct hid_usage *usage,
++ unsigned long **bit, int *max)
++{
++ struct hidpp_device *hidpp = hid_get_drvdata(hdev);
++
++ if (hidpp->quirks & HIDPP_QUIRK_CLASS_WTP)
++ return wtp_input_mapping(hdev, hi, field, usage, bit, max);
++
++ return 0;
++}
++
++static void hidpp_input_configured(struct hid_device *hdev,
++ struct hid_input *hidinput)
++{
++ struct hidpp_device *hidpp = hid_get_drvdata(hdev);
++
++ if (hidpp->quirks & HIDPP_QUIRK_CLASS_WTP)
++ wtp_input_configured(hdev, hidinput);
++}
++
++static int hidpp_raw_hidpp_event(struct hidpp_device *hidpp, u8 *data,
++ int size)
++{
++ struct hidpp_report *question = hidpp->send_receive_buf;
++ struct hidpp_report *answer = hidpp->send_receive_buf;
++ struct hidpp_report *report = (struct hidpp_report *)data;
++
++ /*
++ * If the mutex is locked then we have a pending answer from a
++ * previoulsly sent command
++ */
++ if (unlikely(mutex_is_locked(&hidpp->send_mutex))) {
++ /*
++ * Check for a correct hidpp20 answer or the corresponding
++ * error
++ */
++ if (hidpp_match_answer(question, report) ||
++ hidpp_match_error(question, report)) {
++ *answer = *report;
++ hidpp->answer_available = true;
++ wake_up(&hidpp->wait);
++ /*
++ * This was an answer to a command that this driver sent
++ * We return 1 to hid-core to avoid forwarding the
++ * command upstream as it has been treated by the driver
++ */
++
++ return 1;
++ }
++ }
++
++ if (hidpp->quirks & HIDPP_QUIRK_CLASS_WTP)
++ return wtp_raw_event(hidpp->hid_dev, data, size);
++
++ return 0;
++}
++
++static int hidpp_raw_event(struct hid_device *hdev, struct hid_report *report,
++ u8 *data, int size)
++{
++ struct hidpp_device *hidpp = hid_get_drvdata(hdev);
++
++ switch (data[0]) {
++ case REPORT_ID_HIDPP_LONG:
++ if (size != HIDPP_REPORT_LONG_LENGTH) {
++ hid_err(hdev, "received hid++ report of bad size (%d)",
++ size);
++ return 1;
++ }
++ return hidpp_raw_hidpp_event(hidpp, data, size);
++ case REPORT_ID_HIDPP_SHORT:
++ if (size != HIDPP_REPORT_SHORT_LENGTH) {
++ hid_err(hdev, "received hid++ report of bad size (%d)",
++ size);
++ return 1;
++ }
++ return hidpp_raw_hidpp_event(hidpp, data, size);
++ }
++
++ if (hidpp->quirks & HIDPP_QUIRK_CLASS_WTP)
++ return wtp_raw_event(hdev, data, size);
++
++ return 0;
++}
++
++static void hidpp_overwrite_name(struct hid_device *hdev)
++{
++ struct hidpp_device *hidpp = hid_get_drvdata(hdev);
++ char *name;
++ u8 name_length;
++
++ name = hidpp_get_device_name(hidpp, &name_length);
++
++ if (!name)
++ hid_err(hdev, "unable to retrieve the name of the device");
++ else
++ snprintf(hdev->name, sizeof(hdev->name), "%s", name);
++
++ kfree(name);
++}
++
++static int hidpp_probe(struct hid_device *hdev, const struct hid_device_id *id)
++{
++ struct hidpp_device *hidpp;
++ int ret;
++ bool connected;
++
++ hidpp = devm_kzalloc(&hdev->dev, sizeof(struct hidpp_device),
++ GFP_KERNEL);
++ if (!hidpp)
++ return -ENOMEM;
++
++ hidpp->hid_dev = hdev;
++ hid_set_drvdata(hdev, hidpp);
++
++ hidpp->quirks = id->driver_data;
++
++ if (hidpp->quirks & HIDPP_QUIRK_CLASS_WTP) {
++ ret = wtp_allocate(hdev, id);
++ if (ret)
++ return ret;
++ }
++
++ mutex_init(&hidpp->send_mutex);
++ init_waitqueue_head(&hidpp->wait);
++
++ ret = hid_parse(hdev);
++ if (ret) {
++ hid_err(hdev, "%s:parse failed\n", __func__);
++ goto hid_parse_fail;
++ }
++
++ /* Allow incoming packets */
++ hid_device_io_start(hdev);
++
++ connected = hidpp_is_connected(hidpp);
++ if (!connected) {
++ hid_err(hdev, "Device not connected");
++ goto hid_parse_fail;
++ }
++
++ /* the device is connected, we can ask for its name */
++ hid_info(hdev, "HID++ %u.%u device connected.\n",
++ hidpp->protocol_major, hidpp->protocol_minor);
++ hidpp_overwrite_name(hdev);
++
++ if (hidpp->quirks & HIDPP_QUIRK_CLASS_WTP) {
++ ret = wtp_get_config(hidpp);
++ if (ret)
++ goto hid_parse_fail;
++ }
++
++ /* Block incoming packets */
++ hid_device_io_stop(hdev);
++
++ ret = hid_hw_start(hdev, HID_CONNECT_DEFAULT);
++ if (ret) {
++ hid_err(hdev, "%s:hid_hw_start returned error\n", __func__);
++ goto hid_hw_start_fail;
++ }
++
++ return ret;
++
++hid_hw_start_fail:
++hid_parse_fail:
++ mutex_destroy(&hidpp->send_mutex);
++ hid_set_drvdata(hdev, NULL);
++ return ret;
++}
++
++static void hidpp_remove(struct hid_device *hdev)
++{
++ struct hidpp_device *hidpp = hid_get_drvdata(hdev);
++
++ mutex_destroy(&hidpp->send_mutex);
++ hid_hw_stop(hdev);
++}
++
++static const struct hid_device_id hidpp_devices[] = {
++ { /* wireless touchpad T651 */
++ HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_LOGITECH,
++ USB_DEVICE_ID_LOGITECH_T651),
++ .driver_data = HIDPP_QUIRK_CLASS_WTP },
++ {}
++};
++
++MODULE_DEVICE_TABLE(hid, hidpp_devices);
++
++static struct hid_driver hidpp_driver = {
++ .name = "logitech-hidpp-device",
++ .id_table = hidpp_devices,
++ .probe = hidpp_probe,
++ .remove = hidpp_remove,
++ .raw_event = hidpp_raw_event,
++ .input_configured = hidpp_input_configured,
++ .input_mapping = hidpp_input_mapping,
++};
++
++module_hid_driver(hidpp_driver);
+diff --git a/drivers/hid/hid-microsoft.c b/drivers/hid/hid-microsoft.c
+index 8ba17a946f2a..0dbc2a0c25c0 100644
+--- a/drivers/hid/hid-microsoft.c
++++ b/drivers/hid/hid-microsoft.c
+@@ -264,6 +264,8 @@ static const struct hid_device_id ms_devices[] = {
+ .driver_data = MS_ERGONOMY },
+ { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_NE4K_JP),
+ .driver_data = MS_ERGONOMY },
++ { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_NE7K),
++ .driver_data = MS_ERGONOMY },
+ { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_LK6K),
+ .driver_data = MS_ERGONOMY | MS_RDESC },
+ { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_PRESENTER_8K_USB),
+diff --git a/drivers/hid/hid-saitek.c b/drivers/hid/hid-saitek.c
+index 69cca1476a0c..ccd14204861f 100644
+--- a/drivers/hid/hid-saitek.c
++++ b/drivers/hid/hid-saitek.c
+@@ -177,6 +177,8 @@ static int saitek_event(struct hid_device *hdev, struct hid_field *field,
+ static const struct hid_device_id saitek_devices[] = {
+ { HID_USB_DEVICE(USB_VENDOR_ID_SAITEK, USB_DEVICE_ID_SAITEK_PS1000),
+ .driver_data = SAITEK_FIX_PS1000 },
++ { HID_USB_DEVICE(USB_VENDOR_ID_SAITEK, USB_DEVICE_ID_SAITEK_RAT7_OLD),
++ .driver_data = SAITEK_RELEASE_MODE_RAT7 },
+ { HID_USB_DEVICE(USB_VENDOR_ID_SAITEK, USB_DEVICE_ID_SAITEK_RAT7),
+ .driver_data = SAITEK_RELEASE_MODE_RAT7 },
+ { HID_USB_DEVICE(USB_VENDOR_ID_SAITEK, USB_DEVICE_ID_SAITEK_MMO7),
+diff --git a/drivers/hid/hid-sjoy.c b/drivers/hid/hid-sjoy.c
+index 37845eccddb5..36b6470af947 100644
+--- a/drivers/hid/hid-sjoy.c
++++ b/drivers/hid/hid-sjoy.c
+@@ -166,6 +166,9 @@ static const struct hid_device_id sjoy_devices[] = {
+ { HID_USB_DEVICE(USB_VENDOR_ID_WISEGROUP, USB_DEVICE_ID_DUAL_USB_JOYPAD),
+ .driver_data = HID_QUIRK_MULTI_INPUT |
+ HID_QUIRK_SKIP_OUTPUT_REPORTS },
++ { HID_USB_DEVICE(USB_VENDOR_ID_PLAYDOTCOM, USB_DEVICE_ID_PLAYDOTCOM_EMS_USBII),
++ .driver_data = HID_QUIRK_MULTI_INPUT |
++ HID_QUIRK_SKIP_OUTPUT_REPORTS },
+ { }
+ };
+ MODULE_DEVICE_TABLE(hid, sjoy_devices);
+diff --git a/drivers/hid/hid-uclogic.c b/drivers/hid/hid-uclogic.c
+index fb8b516ff0ed..22dccce6a85c 100644
+--- a/drivers/hid/hid-uclogic.c
++++ b/drivers/hid/hid-uclogic.c
+@@ -626,6 +626,32 @@ static __u8 *uclogic_report_fixup(struct hid_device *hdev, __u8 *rdesc,
+ return rdesc;
+ }
+
++static int uclogic_probe(struct hid_device *hdev,
++ const struct hid_device_id *id)
++{
++ int rc;
++
++ /*
++ * libinput requires the pad interface to be on a different node
++ * than the pen, so use QUIRK_MULTI_INPUT for all tablets.
++ */
++ hdev->quirks |= HID_QUIRK_MULTI_INPUT;
++
++ rc = hid_parse(hdev);
++ if (rc) {
++ hid_err(hdev, "parse failed\n");
++ return rc;
++ }
++
++ rc = hid_hw_start(hdev, HID_CONNECT_DEFAULT);
++ if (rc) {
++ hid_err(hdev, "hw start failed\n");
++ return rc;
++ }
++
++ return 0;
++}
++
+ static const struct hid_device_id uclogic_devices[] = {
+ { HID_USB_DEVICE(USB_VENDOR_ID_UCLOGIC,
+ USB_DEVICE_ID_UCLOGIC_TABLET_PF1209) },
+@@ -648,6 +674,7 @@ MODULE_DEVICE_TABLE(hid, uclogic_devices);
+ static struct hid_driver uclogic_driver = {
+ .name = "uclogic",
+ .id_table = uclogic_devices,
++ .probe = uclogic_probe,
+ .report_fixup = uclogic_report_fixup,
+ };
+ module_hid_driver(uclogic_driver);
+diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c
+index 4477eb7457de..509dee2e9b72 100644
+--- a/drivers/hid/usbhid/hid-quirks.c
++++ b/drivers/hid/usbhid/hid-quirks.c
+@@ -52,7 +52,6 @@ static const struct hid_blacklist {
+ { USB_VENDOR_ID_ETURBOTOUCH, USB_DEVICE_ID_ETURBOTOUCH_2968, HID_QUIRK_MULTI_INPUT },
+ { USB_VENDOR_ID_GREENASIA, USB_DEVICE_ID_GREENASIA_DUAL_USB_JOYPAD, HID_QUIRK_MULTI_INPUT },
+ { USB_VENDOR_ID_PANTHERLORD, USB_DEVICE_ID_PANTHERLORD_TWIN_USB_JOYSTICK, HID_QUIRK_MULTI_INPUT | HID_QUIRK_SKIP_OUTPUT_REPORTS },
+- { USB_VENDOR_ID_PLAYDOTCOM, USB_DEVICE_ID_PLAYDOTCOM_EMS_USBII, HID_QUIRK_MULTI_INPUT },
+ { USB_VENDOR_ID_TOUCHPACK, USB_DEVICE_ID_TOUCHPACK_RTS, HID_QUIRK_MULTI_INPUT },
+
+ { USB_VENDOR_ID_AIREN, USB_DEVICE_ID_AIREN_SLIMPLUS, HID_QUIRK_NOGET },
+@@ -61,6 +60,7 @@ static const struct hid_blacklist {
+ { USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_2PORTKVM, HID_QUIRK_NOGET },
+ { USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_4PORTKVM, HID_QUIRK_NOGET },
+ { USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_4PORTKVMC, HID_QUIRK_NOGET },
++ { USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_CS682, HID_QUIRK_NOGET },
+ { USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_FIGHTERSTICK, HID_QUIRK_NOGET },
+ { USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_COMBATSTICK, HID_QUIRK_NOGET },
+ { USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_FLIGHT_SIM_ECLIPSE_YOKE, HID_QUIRK_NOGET },
+@@ -78,6 +78,13 @@ static const struct hid_blacklist {
+ { USB_VENDOR_ID_ELO, USB_DEVICE_ID_ELO_TS2700, HID_QUIRK_NOGET },
+ { USB_VENDOR_ID_FORMOSA, USB_DEVICE_ID_FORMOSA_IR_RECEIVER, HID_QUIRK_NO_INIT_REPORTS },
+ { USB_VENDOR_ID_FREESCALE, USB_DEVICE_ID_FREESCALE_MX28, HID_QUIRK_NOGET },
++ { USB_VENDOR_ID_HP, USB_PRODUCT_ID_HP_LOGITECH_OEM_USB_OPTICAL_MOUSE_0A4A, HID_QUIRK_ALWAYS_POLL },
++ { USB_VENDOR_ID_HP, USB_PRODUCT_ID_HP_LOGITECH_OEM_USB_OPTICAL_MOUSE_0B4A, HID_QUIRK_ALWAYS_POLL },
++ { USB_VENDOR_ID_HP, USB_PRODUCT_ID_HP_PIXART_OEM_USB_OPTICAL_MOUSE, HID_QUIRK_ALWAYS_POLL },
++ { USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_C077, HID_QUIRK_ALWAYS_POLL },
++ { USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_MOUSE_C01A, HID_QUIRK_ALWAYS_POLL },
++ { USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_MOUSE_C05A, HID_QUIRK_ALWAYS_POLL },
++ { USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_MOUSE_C06A, HID_QUIRK_ALWAYS_POLL },
+ { USB_VENDOR_ID_MGE, USB_DEVICE_ID_MGE_UPS, HID_QUIRK_NOGET },
+ { USB_VENDOR_ID_MSI, USB_DEVICE_ID_MSI_GT683R_LED_PANEL, HID_QUIRK_NO_INIT_REPORTS },
+ { USB_VENDOR_ID_NEXIO, USB_DEVICE_ID_NEXIO_MULTITOUCH_PTI0750, HID_QUIRK_NO_INIT_REPORTS },
+@@ -89,6 +96,7 @@ static const struct hid_blacklist {
+ { USB_VENDOR_ID_PIXART, USB_DEVICE_ID_PIXART_OPTICAL_TOUCH_SCREEN, HID_QUIRK_NO_INIT_REPORTS },
+ { USB_VENDOR_ID_PIXART, USB_DEVICE_ID_PIXART_OPTICAL_TOUCH_SCREEN1, HID_QUIRK_NO_INIT_REPORTS },
+ { USB_VENDOR_ID_PIXART, USB_DEVICE_ID_PIXART_OPTICAL_TOUCH_SCREEN2, HID_QUIRK_NO_INIT_REPORTS },
++ { USB_VENDOR_ID_PRIMAX, USB_DEVICE_ID_PRIMAX_MOUSE_4D22, HID_QUIRK_ALWAYS_POLL },
+ { USB_VENDOR_ID_PRODIGE, USB_DEVICE_ID_PRODIGE_CORDLESS, HID_QUIRK_NOGET },
+ { USB_VENDOR_ID_QUANTA, USB_DEVICE_ID_QUANTA_OPTICAL_TOUCH_3001, HID_QUIRK_NOGET },
+ { USB_VENDOR_ID_QUANTA, USB_DEVICE_ID_QUANTA_OPTICAL_TOUCH_3008, HID_QUIRK_NOGET },
+@@ -104,12 +112,8 @@ static const struct hid_blacklist {
+ { USB_VENDOR_ID_SYMBOL, USB_DEVICE_ID_SYMBOL_SCANNER_2, HID_QUIRK_NOGET },
+ { USB_VENDOR_ID_TPV, USB_DEVICE_ID_TPV_OPTICAL_TOUCHSCREEN, HID_QUIRK_NOGET },
+ { USB_VENDOR_ID_TURBOX, USB_DEVICE_ID_TURBOX_KEYBOARD, HID_QUIRK_NOGET },
+- { USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_UCLOGIC_TABLET_PF1209, HID_QUIRK_MULTI_INPUT },
+- { USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_UCLOGIC_TABLET_WP4030U, HID_QUIRK_MULTI_INPUT },
+ { USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_UCLOGIC_TABLET_KNA5, HID_QUIRK_MULTI_INPUT },
+ { USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_UCLOGIC_TABLET_TWA60, HID_QUIRK_MULTI_INPUT },
+- { USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_UCLOGIC_TABLET_WP5540U, HID_QUIRK_MULTI_INPUT },
+- { USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_UCLOGIC_TABLET_WP8060U, HID_QUIRK_MULTI_INPUT },
+ { USB_VENDOR_ID_WALTOP, USB_DEVICE_ID_WALTOP_MEDIA_TABLET_10_6_INCH, HID_QUIRK_MULTI_INPUT },
+ { USB_VENDOR_ID_WALTOP, USB_DEVICE_ID_WALTOP_MEDIA_TABLET_14_1_INCH, HID_QUIRK_MULTI_INPUT },
+ { USB_VENDOR_ID_WALTOP, USB_DEVICE_ID_WALTOP_SIRIUS_BATTERY_FREE_TABLET, HID_QUIRK_MULTI_INPUT },
+@@ -125,6 +129,7 @@ static const struct hid_blacklist {
+ { USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_MOUSEPEN_I608X, HID_QUIRK_MULTI_INPUT },
+ { USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_MOUSEPEN_I608X_2, HID_QUIRK_MULTI_INPUT },
+ { USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_EASYPEN_M610X, HID_QUIRK_MULTI_INPUT },
++ { USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_PENSKETCH_M912, HID_QUIRK_MULTI_INPUT },
+ { USB_VENDOR_ID_NTRIG, USB_DEVICE_ID_NTRIG_DUOSENSE, HID_QUIRK_NO_INIT_REPORTS },
+ { USB_VENDOR_ID_SEMICO, USB_DEVICE_ID_SEMICO_USB_KEYKOARD, HID_QUIRK_NO_INIT_REPORTS },
+ { USB_VENDOR_ID_SYNAPTICS, USB_DEVICE_ID_SYNAPTICS_LTS1, HID_QUIRK_NO_INIT_REPORTS },
+@@ -133,6 +138,9 @@ static const struct hid_blacklist {
+ { USB_VENDOR_ID_SYNAPTICS, USB_DEVICE_ID_SYNAPTICS_QUAD_HD, HID_QUIRK_NO_INIT_REPORTS },
+ { USB_VENDOR_ID_SYNAPTICS, USB_DEVICE_ID_SYNAPTICS_TP_V103, HID_QUIRK_NO_INIT_REPORTS },
+ { USB_VENDOR_ID_HOLTEK_ALT, USB_DEVICE_ID_HOLTEK_ALT_KEYBOARD_A096, HID_QUIRK_NO_INIT_INPUT_REPORTS },
++ { USB_VENDOR_ID_MULTIPLE_1781, USB_DEVICE_ID_RAPHNET_4NES4SNES_OLD, HID_QUIRK_MULTI_INPUT },
++ { USB_VENDOR_ID_DRACAL_RAPHNET, USB_DEVICE_ID_RAPHNET_2NES2SNES, HID_QUIRK_MULTI_INPUT },
++ { USB_VENDOR_ID_DRACAL_RAPHNET, USB_DEVICE_ID_RAPHNET_4NES4SNES, HID_QUIRK_MULTI_INPUT },
+
+ { 0, 0 }
+ };
+diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
+index 0ff89b2ecdb5..3d1fc736a420 100644
+--- a/drivers/iommu/intel-iommu.c
++++ b/drivers/iommu/intel-iommu.c
+@@ -50,6 +50,7 @@
+ #define CONTEXT_SIZE VTD_PAGE_SIZE
+
+ #define IS_GFX_DEVICE(pdev) ((pdev->class >> 16) == PCI_BASE_CLASS_DISPLAY)
++#define IS_USB_DEVICE(pdev) ((pdev->class >> 8) == PCI_CLASS_SERIAL_USB)
+ #define IS_ISA_DEVICE(pdev) ((pdev->class >> 8) == PCI_CLASS_BRIDGE_ISA)
+ #define IS_AZALIA(pdev) ((pdev)->vendor == 0x8086 && (pdev)->device == 0x3a3e)
+
+@@ -2558,6 +2559,10 @@ static bool device_has_rmrr(struct device *dev)
+ * In both cases we assume that PCI USB devices with RMRRs have them largely
+ * for historical reasons and that the RMRR space is not actively used post
+ * boot. This exclusion may change if vendors begin to abuse it.
++ *
++ * The same exception is made for graphics devices, with the requirement that
++ * any use of the RMRR regions will be torn down before assigning the device
++ * to a guest.
+ */
+ static bool device_is_rmrr_locked(struct device *dev)
+ {
+@@ -2567,7 +2572,7 @@ static bool device_is_rmrr_locked(struct device *dev)
+ if (dev_is_pci(dev)) {
+ struct pci_dev *pdev = to_pci_dev(dev);
+
+- if ((pdev->class >> 8) == PCI_CLASS_SERIAL_USB)
++ if (IS_USB_DEVICE(pdev) || IS_GFX_DEVICE(pdev))
+ return false;
+ }
+
+diff --git a/drivers/lguest/x86/core.c b/drivers/lguest/x86/core.c
+index 922a1acbf652..6adfd7ba4c97 100644
+--- a/drivers/lguest/x86/core.c
++++ b/drivers/lguest/x86/core.c
+@@ -47,6 +47,7 @@
+ #include <asm/lguest.h>
+ #include <asm/uaccess.h>
+ #include <asm/i387.h>
++#include <asm/tlbflush.h>
+ #include "../lg.h"
+
+ static int cpu_had_pge;
+@@ -452,9 +453,9 @@ void lguest_arch_handle_trap(struct lg_cpu *cpu)
+ static void adjust_pge(void *on)
+ {
+ if (on)
+- write_cr4(read_cr4() | X86_CR4_PGE);
++ cr4_set_bits(X86_CR4_PGE);
+ else
+- write_cr4(read_cr4() & ~X86_CR4_PGE);
++ cr4_clear_bits(X86_CR4_PGE);
+ }
+
+ /*H:020
+diff --git a/drivers/media/dvb-frontends/a8293.h b/drivers/media/dvb-frontends/a8293.h
+index b6ef6427cfa5..5f0411939ffc 100644
+--- a/drivers/media/dvb-frontends/a8293.h
++++ b/drivers/media/dvb-frontends/a8293.h
+@@ -27,7 +27,7 @@ struct a8293_config {
+ u8 i2c_addr;
+ };
+
+-#if IS_ENABLED(CONFIG_DVB_A8293)
++#if IS_REACHABLE(CONFIG_DVB_A8293)
+ extern struct dvb_frontend *a8293_attach(struct dvb_frontend *fe,
+ struct i2c_adapter *i2c, const struct a8293_config *cfg);
+ #else
+diff --git a/drivers/media/dvb-frontends/af9013.h b/drivers/media/dvb-frontends/af9013.h
+index 09273b2cd310..1dcc936e1661 100644
+--- a/drivers/media/dvb-frontends/af9013.h
++++ b/drivers/media/dvb-frontends/af9013.h
+@@ -103,7 +103,7 @@ struct af9013_config {
+ u8 gpio[4];
+ };
+
+-#if IS_ENABLED(CONFIG_DVB_AF9013)
++#if IS_REACHABLE(CONFIG_DVB_AF9013)
+ extern struct dvb_frontend *af9013_attach(const struct af9013_config *config,
+ struct i2c_adapter *i2c);
+ #else
+diff --git a/drivers/media/dvb-frontends/atbm8830.h b/drivers/media/dvb-frontends/atbm8830.h
+index 8e0ac98f8d08..5446d13fdfe8 100644
+--- a/drivers/media/dvb-frontends/atbm8830.h
++++ b/drivers/media/dvb-frontends/atbm8830.h
+@@ -61,7 +61,7 @@ struct atbm8830_config {
+ u8 agc_hold_loop;
+ };
+
+-#if IS_ENABLED(CONFIG_DVB_ATBM8830)
++#if IS_REACHABLE(CONFIG_DVB_ATBM8830)
+ extern struct dvb_frontend *atbm8830_attach(const struct atbm8830_config *config,
+ struct i2c_adapter *i2c);
+ #else
+diff --git a/drivers/media/dvb-frontends/au8522.h b/drivers/media/dvb-frontends/au8522.h
+index 83fe9a615619..5f48bd4fc51d 100644
+--- a/drivers/media/dvb-frontends/au8522.h
++++ b/drivers/media/dvb-frontends/au8522.h
+@@ -61,7 +61,7 @@ struct au8522_config {
+ enum au8522_if_freq qam_if;
+ };
+
+-#if IS_ENABLED(CONFIG_DVB_AU8522_DTV)
++#if IS_REACHABLE(CONFIG_DVB_AU8522_DTV)
+ extern struct dvb_frontend *au8522_attach(const struct au8522_config *config,
+ struct i2c_adapter *i2c);
+ #else
+diff --git a/drivers/media/dvb-frontends/bcm3510.h b/drivers/media/dvb-frontends/bcm3510.h
+index 5bd56b1623bf..ff66492fb940 100644
+--- a/drivers/media/dvb-frontends/bcm3510.h
++++ b/drivers/media/dvb-frontends/bcm3510.h
+@@ -34,7 +34,7 @@ struct bcm3510_config
+ int (*request_firmware)(struct dvb_frontend* fe, const struct firmware **fw, char* name);
+ };
+
+-#if IS_ENABLED(CONFIG_DVB_BCM3510)
++#if IS_REACHABLE(CONFIG_DVB_BCM3510)
+ extern struct dvb_frontend* bcm3510_attach(const struct bcm3510_config* config,
+ struct i2c_adapter* i2c);
+ #else
+diff --git a/drivers/media/dvb-frontends/cx22700.h b/drivers/media/dvb-frontends/cx22700.h
+index 382a7b1f3618..e0a764868e6f 100644
+--- a/drivers/media/dvb-frontends/cx22700.h
++++ b/drivers/media/dvb-frontends/cx22700.h
+@@ -31,7 +31,7 @@ struct cx22700_config
+ u8 demod_address;
+ };
+
+-#if IS_ENABLED(CONFIG_DVB_CX22700)
++#if IS_REACHABLE(CONFIG_DVB_CX22700)
+ extern struct dvb_frontend* cx22700_attach(const struct cx22700_config* config,
+ struct i2c_adapter* i2c);
+ #else
+diff --git a/drivers/media/dvb-frontends/cx22702.h b/drivers/media/dvb-frontends/cx22702.h
+index 0b1a6c2f9d5f..68b69a7660d2 100644
+--- a/drivers/media/dvb-frontends/cx22702.h
++++ b/drivers/media/dvb-frontends/cx22702.h
+@@ -41,7 +41,7 @@ struct cx22702_config {
+ u8 output_mode;
+ };
+
+-#if IS_ENABLED(CONFIG_DVB_CX22702)
++#if IS_REACHABLE(CONFIG_DVB_CX22702)
+ extern struct dvb_frontend *cx22702_attach(
+ const struct cx22702_config *config,
+ struct i2c_adapter *i2c);
+diff --git a/drivers/media/dvb-frontends/cx24110.h b/drivers/media/dvb-frontends/cx24110.h
+index 527aff1f2723..d5453ed20b28 100644
+--- a/drivers/media/dvb-frontends/cx24110.h
++++ b/drivers/media/dvb-frontends/cx24110.h
+@@ -46,7 +46,7 @@ static inline int cx24110_pll_write(struct dvb_frontend *fe, u32 val)
+ return 0;
+ }
+
+-#if IS_ENABLED(CONFIG_DVB_CX24110)
++#if IS_REACHABLE(CONFIG_DVB_CX24110)
+ extern struct dvb_frontend* cx24110_attach(const struct cx24110_config* config,
+ struct i2c_adapter* i2c);
+ #else
+diff --git a/drivers/media/dvb-frontends/cx24113.h b/drivers/media/dvb-frontends/cx24113.h
+index 782711ba1a32..962919b9b6e6 100644
+--- a/drivers/media/dvb-frontends/cx24113.h
++++ b/drivers/media/dvb-frontends/cx24113.h
+@@ -32,7 +32,7 @@ struct cx24113_config {
+ u32 xtal_khz;
+ };
+
+-#if IS_ENABLED(CONFIG_DVB_TUNER_CX24113)
++#if IS_REACHABLE(CONFIG_DVB_TUNER_CX24113)
+ extern struct dvb_frontend *cx24113_attach(struct dvb_frontend *,
+ const struct cx24113_config *config, struct i2c_adapter *i2c);
+
+diff --git a/drivers/media/dvb-frontends/cx24116.h b/drivers/media/dvb-frontends/cx24116.h
+index 2ec84fae3f9f..f6dbabc1d62b 100644
+--- a/drivers/media/dvb-frontends/cx24116.h
++++ b/drivers/media/dvb-frontends/cx24116.h
+@@ -41,7 +41,7 @@ struct cx24116_config {
+ u16 i2c_wr_max;
+ };
+
+-#if IS_ENABLED(CONFIG_DVB_CX24116)
++#if IS_REACHABLE(CONFIG_DVB_CX24116)
+ extern struct dvb_frontend *cx24116_attach(
+ const struct cx24116_config *config,
+ struct i2c_adapter *i2c);
+diff --git a/drivers/media/dvb-frontends/cx24117.h b/drivers/media/dvb-frontends/cx24117.h
+index 4e59e9574fa7..1648ab432168 100644
+--- a/drivers/media/dvb-frontends/cx24117.h
++++ b/drivers/media/dvb-frontends/cx24117.h
+@@ -30,7 +30,7 @@ struct cx24117_config {
+ u8 demod_address;
+ };
+
+-#if IS_ENABLED(CONFIG_DVB_CX24117)
++#if IS_REACHABLE(CONFIG_DVB_CX24117)
+ extern struct dvb_frontend *cx24117_attach(
+ const struct cx24117_config *config,
+ struct i2c_adapter *i2c);
+diff --git a/drivers/media/dvb-frontends/cx24123.h b/drivers/media/dvb-frontends/cx24123.h
+index 102e70d17c43..758aee5a072f 100644
+--- a/drivers/media/dvb-frontends/cx24123.h
++++ b/drivers/media/dvb-frontends/cx24123.h
+@@ -39,7 +39,7 @@ struct cx24123_config {
+ void (*agc_callback) (struct dvb_frontend *);
+ };
+
+-#if IS_ENABLED(CONFIG_DVB_CX24123)
++#if IS_REACHABLE(CONFIG_DVB_CX24123)
+ extern struct dvb_frontend *cx24123_attach(const struct cx24123_config *config,
+ struct i2c_adapter *i2c);
+ extern struct i2c_adapter *cx24123_get_tuner_i2c_adapter(struct dvb_frontend *);
+diff --git a/drivers/media/dvb-frontends/cxd2820r.h b/drivers/media/dvb-frontends/cxd2820r.h
+index 6095dbcf7850..56d42760263d 100644
+--- a/drivers/media/dvb-frontends/cxd2820r.h
++++ b/drivers/media/dvb-frontends/cxd2820r.h
+@@ -72,7 +72,7 @@ struct cxd2820r_config {
+ };
+
+
+-#if IS_ENABLED(CONFIG_DVB_CXD2820R)
++#if IS_REACHABLE(CONFIG_DVB_CXD2820R)
+ extern struct dvb_frontend *cxd2820r_attach(
+ const struct cxd2820r_config *config,
+ struct i2c_adapter *i2c,
+diff --git a/drivers/media/dvb-frontends/dib0070.h b/drivers/media/dvb-frontends/dib0070.h
+index 0c6befcc9143..6c0b6672b1d9 100644
+--- a/drivers/media/dvb-frontends/dib0070.h
++++ b/drivers/media/dvb-frontends/dib0070.h
+@@ -48,7 +48,7 @@ struct dib0070_config {
+ u8 vga_filter;
+ };
+
+-#if IS_ENABLED(CONFIG_DVB_TUNER_DIB0070)
++#if IS_REACHABLE(CONFIG_DVB_TUNER_DIB0070)
+ extern struct dvb_frontend *dib0070_attach(struct dvb_frontend *fe, struct i2c_adapter *i2c, struct dib0070_config *cfg);
+ extern u16 dib0070_wbd_offset(struct dvb_frontend *);
+ extern void dib0070_ctrl_agc_filter(struct dvb_frontend *, u8 open);
+diff --git a/drivers/media/dvb-frontends/dib0090.h b/drivers/media/dvb-frontends/dib0090.h
+index 6a090954fa10..ad74bc823f08 100644
+--- a/drivers/media/dvb-frontends/dib0090.h
++++ b/drivers/media/dvb-frontends/dib0090.h
+@@ -75,7 +75,7 @@ struct dib0090_config {
+ u8 force_crystal_mode;
+ };
+
+-#if IS_ENABLED(CONFIG_DVB_TUNER_DIB0090)
++#if IS_REACHABLE(CONFIG_DVB_TUNER_DIB0090)
+ extern struct dvb_frontend *dib0090_register(struct dvb_frontend *fe, struct i2c_adapter *i2c, const struct dib0090_config *config);
+ extern struct dvb_frontend *dib0090_fw_register(struct dvb_frontend *fe, struct i2c_adapter *i2c, const struct dib0090_config *config);
+ extern void dib0090_dcc_freq(struct dvb_frontend *fe, u8 fast);
+diff --git a/drivers/media/dvb-frontends/dib3000.h b/drivers/media/dvb-frontends/dib3000.h
+index 9b6c3bbc983a..6ae9899b5b45 100644
+--- a/drivers/media/dvb-frontends/dib3000.h
++++ b/drivers/media/dvb-frontends/dib3000.h
+@@ -41,7 +41,7 @@ struct dib_fe_xfer_ops
+ int (*tuner_pass_ctrl)(struct dvb_frontend *fe, int onoff, u8 pll_ctrl);
+ };
+
+-#if IS_ENABLED(CONFIG_DVB_DIB3000MB)
++#if IS_REACHABLE(CONFIG_DVB_DIB3000MB)
+ extern struct dvb_frontend* dib3000mb_attach(const struct dib3000_config* config,
+ struct i2c_adapter* i2c, struct dib_fe_xfer_ops *xfer_ops);
+ #else
+diff --git a/drivers/media/dvb-frontends/dib3000mc.h b/drivers/media/dvb-frontends/dib3000mc.h
+index 129d1425516a..74816f793611 100644
+--- a/drivers/media/dvb-frontends/dib3000mc.h
++++ b/drivers/media/dvb-frontends/dib3000mc.h
+@@ -41,7 +41,7 @@ struct dib3000mc_config {
+ #define DEFAULT_DIB3000MC_I2C_ADDRESS 16
+ #define DEFAULT_DIB3000P_I2C_ADDRESS 24
+
+-#if IS_ENABLED(CONFIG_DVB_DIB3000MC)
++#if IS_REACHABLE(CONFIG_DVB_DIB3000MC)
+ extern struct dvb_frontend *dib3000mc_attach(struct i2c_adapter *i2c_adap,
+ u8 i2c_addr,
+ struct dib3000mc_config *cfg);
+diff --git a/drivers/media/dvb-frontends/dib7000m.h b/drivers/media/dvb-frontends/dib7000m.h
+index b585413f9a29..6468c278cc4d 100644
+--- a/drivers/media/dvb-frontends/dib7000m.h
++++ b/drivers/media/dvb-frontends/dib7000m.h
+@@ -40,7 +40,7 @@ struct dib7000m_config {
+
+ #define DEFAULT_DIB7000M_I2C_ADDRESS 18
+
+-#if IS_ENABLED(CONFIG_DVB_DIB7000M)
++#if IS_REACHABLE(CONFIG_DVB_DIB7000M)
+ extern struct dvb_frontend *dib7000m_attach(struct i2c_adapter *i2c_adap,
+ u8 i2c_addr,
+ struct dib7000m_config *cfg);
+diff --git a/drivers/media/dvb-frontends/dib7000p.h b/drivers/media/dvb-frontends/dib7000p.h
+index 1fea0e972654..baa278928cf3 100644
+--- a/drivers/media/dvb-frontends/dib7000p.h
++++ b/drivers/media/dvb-frontends/dib7000p.h
+@@ -66,7 +66,7 @@ struct dib7000p_ops {
+ struct dvb_frontend *(*init)(struct i2c_adapter *i2c_adap, u8 i2c_addr, struct dib7000p_config *cfg);
+ };
+
+-#if IS_ENABLED(CONFIG_DVB_DIB7000P)
++#if IS_REACHABLE(CONFIG_DVB_DIB7000P)
+ void *dib7000p_attach(struct dib7000p_ops *ops);
+ #else
+ static inline void *dib7000p_attach(struct dib7000p_ops *ops)
+diff --git a/drivers/media/dvb-frontends/dib8000.h b/drivers/media/dvb-frontends/dib8000.h
+index 84cc10383dcd..780c37bdcb72 100644
+--- a/drivers/media/dvb-frontends/dib8000.h
++++ b/drivers/media/dvb-frontends/dib8000.h
+@@ -63,7 +63,7 @@ struct dib8000_ops {
+ struct dvb_frontend *(*init)(struct i2c_adapter *i2c_adap, u8 i2c_addr, struct dib8000_config *cfg);
+ };
+
+-#if IS_ENABLED(CONFIG_DVB_DIB8000)
++#if IS_REACHABLE(CONFIG_DVB_DIB8000)
+ void *dib8000_attach(struct dib8000_ops *ops);
+ #else
+ static inline int dib8000_attach(struct dib8000_ops *ops)
+diff --git a/drivers/media/dvb-frontends/dib9000.h b/drivers/media/dvb-frontends/dib9000.h
+index f3639f045ff0..b10a70aa7c9f 100644
+--- a/drivers/media/dvb-frontends/dib9000.h
++++ b/drivers/media/dvb-frontends/dib9000.h
+@@ -27,7 +27,7 @@ struct dib9000_config {
+
+ #define DEFAULT_DIB9000_I2C_ADDRESS 18
+
+-#if IS_ENABLED(CONFIG_DVB_DIB9000)
++#if IS_REACHABLE(CONFIG_DVB_DIB9000)
+ extern struct dvb_frontend *dib9000_attach(struct i2c_adapter *i2c_adap, u8 i2c_addr, const struct dib9000_config *cfg);
+ extern int dib9000_i2c_enumeration(struct i2c_adapter *host, int no_of_demods, u8 default_addr, u8 first_addr);
+ extern struct i2c_adapter *dib9000_get_tuner_interface(struct dvb_frontend *fe);
+diff --git a/drivers/media/dvb-frontends/drxd.h b/drivers/media/dvb-frontends/drxd.h
+index d998e4d5a7fc..a47c22d6667e 100644
+--- a/drivers/media/dvb-frontends/drxd.h
++++ b/drivers/media/dvb-frontends/drxd.h
+@@ -52,7 +52,7 @@ struct drxd_config {
+ s16(*osc_deviation) (void *priv, s16 dev, int flag);
+ };
+
+-#if IS_ENABLED(CONFIG_DVB_DRXD)
++#if IS_REACHABLE(CONFIG_DVB_DRXD)
+ extern
+ struct dvb_frontend *drxd_attach(const struct drxd_config *config,
+ void *priv, struct i2c_adapter *i2c,
+diff --git a/drivers/media/dvb-frontends/drxk.h b/drivers/media/dvb-frontends/drxk.h
+index f6cb34660327..8f0b9eec528f 100644
+--- a/drivers/media/dvb-frontends/drxk.h
++++ b/drivers/media/dvb-frontends/drxk.h
+@@ -51,7 +51,7 @@ struct drxk_config {
+ int qam_demod_parameter_count;
+ };
+
+-#if IS_ENABLED(CONFIG_DVB_DRXK)
++#if IS_REACHABLE(CONFIG_DVB_DRXK)
+ extern struct dvb_frontend *drxk_attach(const struct drxk_config *config,
+ struct i2c_adapter *i2c);
+ #else
+diff --git a/drivers/media/dvb-frontends/ds3000.h b/drivers/media/dvb-frontends/ds3000.h
+index f9c21fb7af13..153169da9017 100644
+--- a/drivers/media/dvb-frontends/ds3000.h
++++ b/drivers/media/dvb-frontends/ds3000.h
+@@ -35,7 +35,7 @@ struct ds3000_config {
+ void (*set_lock_led)(struct dvb_frontend *fe, int offon);
+ };
+
+-#if IS_ENABLED(CONFIG_DVB_DS3000)
++#if IS_REACHABLE(CONFIG_DVB_DS3000)
+ extern struct dvb_frontend *ds3000_attach(const struct ds3000_config *config,
+ struct i2c_adapter *i2c);
+ #else
+diff --git a/drivers/media/dvb-frontends/dvb-pll.h b/drivers/media/dvb-frontends/dvb-pll.h
+index f4b5a0601c3a..bf9602a88b6c 100644
+--- a/drivers/media/dvb-frontends/dvb-pll.h
++++ b/drivers/media/dvb-frontends/dvb-pll.h
+@@ -38,7 +38,7 @@
+ * @param pll_desc_id dvb_pll_desc to use.
+ * @return Frontend pointer on success, NULL on failure
+ */
+-#if IS_ENABLED(CONFIG_DVB_PLL)
++#if IS_REACHABLE(CONFIG_DVB_PLL)
+ extern struct dvb_frontend *dvb_pll_attach(struct dvb_frontend *fe,
+ int pll_addr,
+ struct i2c_adapter *i2c,
+diff --git a/drivers/media/dvb-frontends/dvb_dummy_fe.h b/drivers/media/dvb-frontends/dvb_dummy_fe.h
+index 0cbf96105631..15e4ceab869a 100644
+--- a/drivers/media/dvb-frontends/dvb_dummy_fe.h
++++ b/drivers/media/dvb-frontends/dvb_dummy_fe.h
+@@ -26,7 +26,7 @@
+ #include <linux/dvb/frontend.h>
+ #include "dvb_frontend.h"
+
+-#if IS_ENABLED(CONFIG_DVB_DUMMY_FE)
++#if IS_REACHABLE(CONFIG_DVB_DUMMY_FE)
+ extern struct dvb_frontend* dvb_dummy_fe_ofdm_attach(void);
+ extern struct dvb_frontend* dvb_dummy_fe_qpsk_attach(void);
+ extern struct dvb_frontend* dvb_dummy_fe_qam_attach(void);
+diff --git a/drivers/media/dvb-frontends/ec100.h b/drivers/media/dvb-frontends/ec100.h
+index 37558403068d..9544bab5cd1d 100644
+--- a/drivers/media/dvb-frontends/ec100.h
++++ b/drivers/media/dvb-frontends/ec100.h
+@@ -31,7 +31,7 @@ struct ec100_config {
+ };
+
+
+-#if IS_ENABLED(CONFIG_DVB_EC100)
++#if IS_REACHABLE(CONFIG_DVB_EC100)
+ extern struct dvb_frontend *ec100_attach(const struct ec100_config *config,
+ struct i2c_adapter *i2c);
+ #else
+diff --git a/drivers/media/dvb-frontends/hd29l2.h b/drivers/media/dvb-frontends/hd29l2.h
+index 05cd13028a91..48e9ab74c883 100644
+--- a/drivers/media/dvb-frontends/hd29l2.h
++++ b/drivers/media/dvb-frontends/hd29l2.h
+@@ -51,7 +51,7 @@ struct hd29l2_config {
+ };
+
+
+-#if IS_ENABLED(CONFIG_DVB_HD29L2)
++#if IS_REACHABLE(CONFIG_DVB_HD29L2)
+ extern struct dvb_frontend *hd29l2_attach(const struct hd29l2_config *config,
+ struct i2c_adapter *i2c);
+ #else
+diff --git a/drivers/media/dvb-frontends/isl6405.h b/drivers/media/dvb-frontends/isl6405.h
+index 8abb70c26fd9..3c148b830bd1 100644
+--- a/drivers/media/dvb-frontends/isl6405.h
++++ b/drivers/media/dvb-frontends/isl6405.h
+@@ -55,7 +55,7 @@
+ #define ISL6405_ENT2 0x20
+ #define ISL6405_ISEL2 0x40
+
+-#if IS_ENABLED(CONFIG_DVB_ISL6405)
++#if IS_REACHABLE(CONFIG_DVB_ISL6405)
+ /* override_set and override_clear control which system register bits (above)
+ * to always set & clear
+ */
+diff --git a/drivers/media/dvb-frontends/isl6421.h b/drivers/media/dvb-frontends/isl6421.h
+index 630e7f8a150e..3273597833fd 100644
+--- a/drivers/media/dvb-frontends/isl6421.h
++++ b/drivers/media/dvb-frontends/isl6421.h
+@@ -39,7 +39,7 @@
+ #define ISL6421_ISEL1 0x20
+ #define ISL6421_DCL 0x40
+
+-#if IS_ENABLED(CONFIG_DVB_ISL6421)
++#if IS_REACHABLE(CONFIG_DVB_ISL6421)
+ /* override_set and override_clear control which system register bits (above) to always set & clear */
+ extern struct dvb_frontend *isl6421_attach(struct dvb_frontend *fe, struct i2c_adapter *i2c, u8 i2c_addr,
+ u8 override_set, u8 override_clear, bool override_tone);
+diff --git a/drivers/media/dvb-frontends/isl6423.h b/drivers/media/dvb-frontends/isl6423.h
+index 80dfd9cc4f41..a64df0ee256b 100644
+--- a/drivers/media/dvb-frontends/isl6423.h
++++ b/drivers/media/dvb-frontends/isl6423.h
+@@ -42,7 +42,7 @@ struct isl6423_config {
+ u8 mod_extern;
+ };
+
+-#if IS_ENABLED(CONFIG_DVB_ISL6423)
++#if IS_REACHABLE(CONFIG_DVB_ISL6423)
+
+
+ extern struct dvb_frontend *isl6423_attach(struct dvb_frontend *fe,
+diff --git a/drivers/media/dvb-frontends/itd1000.h b/drivers/media/dvb-frontends/itd1000.h
+index edae0902f4fd..a691bb6f26de 100644
+--- a/drivers/media/dvb-frontends/itd1000.h
++++ b/drivers/media/dvb-frontends/itd1000.h
+@@ -29,7 +29,7 @@ struct itd1000_config {
+ u8 i2c_address;
+ };
+
+-#if IS_ENABLED(CONFIG_DVB_TUNER_ITD1000)
++#if IS_REACHABLE(CONFIG_DVB_TUNER_ITD1000)
+ extern struct dvb_frontend *itd1000_attach(struct dvb_frontend *fe, struct i2c_adapter *i2c, struct itd1000_config *cfg);
+ #else
+ static inline struct dvb_frontend *itd1000_attach(struct dvb_frontend *fe, struct i2c_adapter *i2c, struct itd1000_config *cfg)
+diff --git a/drivers/media/dvb-frontends/ix2505v.h b/drivers/media/dvb-frontends/ix2505v.h
+index 1a735a75aa98..af107a2dd357 100644
+--- a/drivers/media/dvb-frontends/ix2505v.h
++++ b/drivers/media/dvb-frontends/ix2505v.h
+@@ -49,7 +49,7 @@ struct ix2505v_config {
+
+ };
+
+-#if IS_ENABLED(CONFIG_DVB_IX2505V)
++#if IS_REACHABLE(CONFIG_DVB_IX2505V)
+ extern struct dvb_frontend *ix2505v_attach(struct dvb_frontend *fe,
+ const struct ix2505v_config *config, struct i2c_adapter *i2c);
+ #else
+diff --git a/drivers/media/dvb-frontends/l64781.h b/drivers/media/dvb-frontends/l64781.h
+index 6813b08a774d..8697e2c2ba36 100644
+--- a/drivers/media/dvb-frontends/l64781.h
++++ b/drivers/media/dvb-frontends/l64781.h
+@@ -31,7 +31,7 @@ struct l64781_config
+ u8 demod_address;
+ };
+
+-#if IS_ENABLED(CONFIG_DVB_L64781)
++#if IS_REACHABLE(CONFIG_DVB_L64781)
+ extern struct dvb_frontend* l64781_attach(const struct l64781_config* config,
+ struct i2c_adapter* i2c);
+ #else
+diff --git a/drivers/media/dvb-frontends/lg2160.h b/drivers/media/dvb-frontends/lg2160.h
+index 194a07a78dc1..d20bd909de39 100644
+--- a/drivers/media/dvb-frontends/lg2160.h
++++ b/drivers/media/dvb-frontends/lg2160.h
+@@ -67,7 +67,7 @@ struct lg2160_config {
+ enum lg_chip_type lg_chip;
+ };
+
+-#if IS_ENABLED(CONFIG_DVB_LG2160)
++#if IS_REACHABLE(CONFIG_DVB_LG2160)
+ extern
+ struct dvb_frontend *lg2160_attach(const struct lg2160_config *config,
+ struct i2c_adapter *i2c_adap);
+diff --git a/drivers/media/dvb-frontends/lgdt3305.h b/drivers/media/dvb-frontends/lgdt3305.h
+index d9ab556c1b27..d8666043b3d2 100644
+--- a/drivers/media/dvb-frontends/lgdt3305.h
++++ b/drivers/media/dvb-frontends/lgdt3305.h
+@@ -74,7 +74,7 @@ struct lgdt3305_config {
+ enum lgdt_demod_chip_type demod_chip;
+ };
+
+-#if IS_ENABLED(CONFIG_DVB_LGDT3305)
++#if IS_REACHABLE(CONFIG_DVB_LGDT3305)
+ extern
+ struct dvb_frontend *lgdt3305_attach(const struct lgdt3305_config *config,
+ struct i2c_adapter *i2c_adap);
+diff --git a/drivers/media/dvb-frontends/lgdt330x.h b/drivers/media/dvb-frontends/lgdt330x.h
+index ca0eab562e1e..b4ee363b6578 100644
+--- a/drivers/media/dvb-frontends/lgdt330x.h
++++ b/drivers/media/dvb-frontends/lgdt330x.h
+@@ -52,7 +52,7 @@ struct lgdt330x_config
+ int clock_polarity_flip;
+ };
+
+-#if IS_ENABLED(CONFIG_DVB_LGDT330X)
++#if IS_REACHABLE(CONFIG_DVB_LGDT330X)
+ extern struct dvb_frontend* lgdt330x_attach(const struct lgdt330x_config* config,
+ struct i2c_adapter* i2c);
+ #else
+diff --git a/drivers/media/dvb-frontends/lgs8gl5.h b/drivers/media/dvb-frontends/lgs8gl5.h
+index c2da59614727..a5b3faf121f0 100644
+--- a/drivers/media/dvb-frontends/lgs8gl5.h
++++ b/drivers/media/dvb-frontends/lgs8gl5.h
+@@ -31,7 +31,7 @@ struct lgs8gl5_config {
+ u8 demod_address;
+ };
+
+-#if IS_ENABLED(CONFIG_DVB_LGS8GL5)
++#if IS_REACHABLE(CONFIG_DVB_LGS8GL5)
+ extern struct dvb_frontend *lgs8gl5_attach(
+ const struct lgs8gl5_config *config, struct i2c_adapter *i2c);
+ #else
+diff --git a/drivers/media/dvb-frontends/lgs8gxx.h b/drivers/media/dvb-frontends/lgs8gxx.h
+index dadb78bf61a9..368c9928ef7f 100644
+--- a/drivers/media/dvb-frontends/lgs8gxx.h
++++ b/drivers/media/dvb-frontends/lgs8gxx.h
+@@ -80,7 +80,7 @@ struct lgs8gxx_config {
+ u8 tuner_address;
+ };
+
+-#if IS_ENABLED(CONFIG_DVB_LGS8GXX)
++#if IS_REACHABLE(CONFIG_DVB_LGS8GXX)
+ extern struct dvb_frontend *lgs8gxx_attach(const struct lgs8gxx_config *config,
+ struct i2c_adapter *i2c);
+ #else
+diff --git a/drivers/media/dvb-frontends/lnbh24.h b/drivers/media/dvb-frontends/lnbh24.h
+index b327a4f31d16..a088b8ec1e53 100644
+--- a/drivers/media/dvb-frontends/lnbh24.h
++++ b/drivers/media/dvb-frontends/lnbh24.h
+@@ -37,7 +37,7 @@
+
+ #include <linux/dvb/frontend.h>
+
+-#if IS_ENABLED(CONFIG_DVB_LNBP21)
++#if IS_REACHABLE(CONFIG_DVB_LNBP21)
+ /* override_set and override_clear control which
+ system register bits (above) to always set & clear */
+ extern struct dvb_frontend *lnbh24_attach(struct dvb_frontend *fe,
+diff --git a/drivers/media/dvb-frontends/lnbp21.h b/drivers/media/dvb-frontends/lnbp21.h
+index dbcbcc2f20a3..a9b530de62a6 100644
+--- a/drivers/media/dvb-frontends/lnbp21.h
++++ b/drivers/media/dvb-frontends/lnbp21.h
+@@ -57,7 +57,7 @@
+
+ #include <linux/dvb/frontend.h>
+
+-#if IS_ENABLED(CONFIG_DVB_LNBP21)
++#if IS_REACHABLE(CONFIG_DVB_LNBP21)
+ /* override_set and override_clear control which
+ system register bits (above) to always set & clear */
+ extern struct dvb_frontend *lnbp21_attach(struct dvb_frontend *fe,
+diff --git a/drivers/media/dvb-frontends/lnbp22.h b/drivers/media/dvb-frontends/lnbp22.h
+index 63861b311dd8..628148385182 100644
+--- a/drivers/media/dvb-frontends/lnbp22.h
++++ b/drivers/media/dvb-frontends/lnbp22.h
+@@ -39,7 +39,7 @@
+
+ #include <linux/dvb/frontend.h>
+
+-#if IS_ENABLED(CONFIG_DVB_LNBP22)
++#if IS_REACHABLE(CONFIG_DVB_LNBP22)
+ /*
+ * override_set and override_clear control which system register bits (above)
+ * to always set & clear
+diff --git a/drivers/media/dvb-frontends/m88rs2000.h b/drivers/media/dvb-frontends/m88rs2000.h
+index 0a50ea90736b..de7430178e9e 100644
+--- a/drivers/media/dvb-frontends/m88rs2000.h
++++ b/drivers/media/dvb-frontends/m88rs2000.h
+@@ -41,7 +41,7 @@ enum {
+ CALL_IS_READ,
+ };
+
+-#if IS_ENABLED(CONFIG_DVB_M88RS2000)
++#if IS_REACHABLE(CONFIG_DVB_M88RS2000)
+ extern struct dvb_frontend *m88rs2000_attach(
+ const struct m88rs2000_config *config, struct i2c_adapter *i2c);
+ #else
+diff --git a/drivers/media/dvb-frontends/mb86a16.h b/drivers/media/dvb-frontends/mb86a16.h
+index 277ce061acf9..e486dc0d8e60 100644
+--- a/drivers/media/dvb-frontends/mb86a16.h
++++ b/drivers/media/dvb-frontends/mb86a16.h
+@@ -33,7 +33,7 @@ struct mb86a16_config {
+
+
+
+-#if IS_ENABLED(CONFIG_DVB_MB86A16)
++#if IS_REACHABLE(CONFIG_DVB_MB86A16)
+
+ extern struct dvb_frontend *mb86a16_attach(const struct mb86a16_config *config,
+ struct i2c_adapter *i2c_adap);
+diff --git a/drivers/media/dvb-frontends/mb86a20s.h b/drivers/media/dvb-frontends/mb86a20s.h
+index cbeb941fba7c..f749c8ac5f39 100644
+--- a/drivers/media/dvb-frontends/mb86a20s.h
++++ b/drivers/media/dvb-frontends/mb86a20s.h
+@@ -34,7 +34,7 @@ struct mb86a20s_config {
+ bool is_serial;
+ };
+
+-#if IS_ENABLED(CONFIG_DVB_MB86A20S)
++#if IS_REACHABLE(CONFIG_DVB_MB86A20S)
+ extern struct dvb_frontend *mb86a20s_attach(const struct mb86a20s_config *config,
+ struct i2c_adapter *i2c);
+ extern struct i2c_adapter *mb86a20s_get_tuner_i2c_adapter(struct dvb_frontend *);
+diff --git a/drivers/media/dvb-frontends/mt312.h b/drivers/media/dvb-frontends/mt312.h
+index 5706621ad79d..386939a90555 100644
+--- a/drivers/media/dvb-frontends/mt312.h
++++ b/drivers/media/dvb-frontends/mt312.h
+@@ -36,7 +36,7 @@ struct mt312_config {
+ unsigned int voltage_inverted:1;
+ };
+
+-#if IS_ENABLED(CONFIG_DVB_MT312)
++#if IS_REACHABLE(CONFIG_DVB_MT312)
+ struct dvb_frontend *mt312_attach(const struct mt312_config *config,
+ struct i2c_adapter *i2c);
+ #else
+diff --git a/drivers/media/dvb-frontends/mt352.h b/drivers/media/dvb-frontends/mt352.h
+index 451d904e1500..5873263bd1af 100644
+--- a/drivers/media/dvb-frontends/mt352.h
++++ b/drivers/media/dvb-frontends/mt352.h
+@@ -51,7 +51,7 @@ struct mt352_config
+ int (*demod_init)(struct dvb_frontend* fe);
+ };
+
+-#if IS_ENABLED(CONFIG_DVB_MT352)
++#if IS_REACHABLE(CONFIG_DVB_MT352)
+ extern struct dvb_frontend* mt352_attach(const struct mt352_config* config,
+ struct i2c_adapter* i2c);
+ #else
+diff --git a/drivers/media/dvb-frontends/nxt200x.h b/drivers/media/dvb-frontends/nxt200x.h
+index b518d545609e..3b3d7a7fa591 100644
+--- a/drivers/media/dvb-frontends/nxt200x.h
++++ b/drivers/media/dvb-frontends/nxt200x.h
+@@ -42,7 +42,7 @@ struct nxt200x_config
+ int (*set_ts_params)(struct dvb_frontend* fe, int is_punctured);
+ };
+
+-#if IS_ENABLED(CONFIG_DVB_NXT200X)
++#if IS_REACHABLE(CONFIG_DVB_NXT200X)
+ extern struct dvb_frontend* nxt200x_attach(const struct nxt200x_config* config,
+ struct i2c_adapter* i2c);
+ #else
+diff --git a/drivers/media/dvb-frontends/nxt6000.h b/drivers/media/dvb-frontends/nxt6000.h
+index b5867c2ae681..a94cefcc6dfd 100644
+--- a/drivers/media/dvb-frontends/nxt6000.h
++++ b/drivers/media/dvb-frontends/nxt6000.h
+@@ -33,7 +33,7 @@ struct nxt6000_config
+ u8 clock_inversion:1;
+ };
+
+-#if IS_ENABLED(CONFIG_DVB_NXT6000)
++#if IS_REACHABLE(CONFIG_DVB_NXT6000)
+ extern struct dvb_frontend* nxt6000_attach(const struct nxt6000_config* config,
+ struct i2c_adapter* i2c);
+ #else
+diff --git a/drivers/media/dvb-frontends/or51132.h b/drivers/media/dvb-frontends/or51132.h
+index 938958386cb1..aeaaffc84c2e 100644
+--- a/drivers/media/dvb-frontends/or51132.h
++++ b/drivers/media/dvb-frontends/or51132.h
+@@ -34,7 +34,7 @@ struct or51132_config
+ int (*set_ts_params)(struct dvb_frontend* fe, int is_punctured);
+ };
+
+-#if IS_ENABLED(CONFIG_DVB_OR51132)
++#if IS_REACHABLE(CONFIG_DVB_OR51132)
+ extern struct dvb_frontend* or51132_attach(const struct or51132_config* config,
+ struct i2c_adapter* i2c);
+ #else
+diff --git a/drivers/media/dvb-frontends/or51211.h b/drivers/media/dvb-frontends/or51211.h
+index 9a8ae936b62d..cc6adab63249 100644
+--- a/drivers/media/dvb-frontends/or51211.h
++++ b/drivers/media/dvb-frontends/or51211.h
+@@ -37,7 +37,7 @@ struct or51211_config
+ void (*sleep)(struct dvb_frontend * fe);
+ };
+
+-#if IS_ENABLED(CONFIG_DVB_OR51211)
++#if IS_REACHABLE(CONFIG_DVB_OR51211)
+ extern struct dvb_frontend* or51211_attach(const struct or51211_config* config,
+ struct i2c_adapter* i2c);
+ #else
+diff --git a/drivers/media/dvb-frontends/s5h1409.h b/drivers/media/dvb-frontends/s5h1409.h
+index 63b1e0a34e4e..7749efbeba28 100644
+--- a/drivers/media/dvb-frontends/s5h1409.h
++++ b/drivers/media/dvb-frontends/s5h1409.h
+@@ -67,7 +67,7 @@ struct s5h1409_config {
+ u8 hvr1600_opt;
+ };
+
+-#if IS_ENABLED(CONFIG_DVB_S5H1409)
++#if IS_REACHABLE(CONFIG_DVB_S5H1409)
+ extern struct dvb_frontend *s5h1409_attach(const struct s5h1409_config *config,
+ struct i2c_adapter *i2c);
+ #else
+diff --git a/drivers/media/dvb-frontends/s5h1411.h b/drivers/media/dvb-frontends/s5h1411.h
+index e4f56871f982..d63b5b590abe 100644
+--- a/drivers/media/dvb-frontends/s5h1411.h
++++ b/drivers/media/dvb-frontends/s5h1411.h
+@@ -69,7 +69,7 @@ struct s5h1411_config {
+ u8 status_mode;
+ };
+
+-#if IS_ENABLED(CONFIG_DVB_S5H1411)
++#if IS_REACHABLE(CONFIG_DVB_S5H1411)
+ extern struct dvb_frontend *s5h1411_attach(const struct s5h1411_config *config,
+ struct i2c_adapter *i2c);
+ #else
+diff --git a/drivers/media/dvb-frontends/s5h1420.h b/drivers/media/dvb-frontends/s5h1420.h
+index 210049b5cf30..142d93e7d02b 100644
+--- a/drivers/media/dvb-frontends/s5h1420.h
++++ b/drivers/media/dvb-frontends/s5h1420.h
+@@ -40,7 +40,7 @@ struct s5h1420_config
+ u8 serial_mpeg:1;
+ };
+
+-#if IS_ENABLED(CONFIG_DVB_S5H1420)
++#if IS_REACHABLE(CONFIG_DVB_S5H1420)
+ extern struct dvb_frontend *s5h1420_attach(const struct s5h1420_config *config,
+ struct i2c_adapter *i2c);
+ extern struct i2c_adapter *s5h1420_get_tuner_i2c_adapter(struct dvb_frontend *fe);
+diff --git a/drivers/media/dvb-frontends/s5h1432.h b/drivers/media/dvb-frontends/s5h1432.h
+index 70917dd2533a..f490c5ee5801 100644
+--- a/drivers/media/dvb-frontends/s5h1432.h
++++ b/drivers/media/dvb-frontends/s5h1432.h
+@@ -75,7 +75,7 @@ struct s5h1432_config {
+ u8 status_mode;
+ };
+
+-#if IS_ENABLED(CONFIG_DVB_S5H1432)
++#if IS_REACHABLE(CONFIG_DVB_S5H1432)
+ extern struct dvb_frontend *s5h1432_attach(const struct s5h1432_config *config,
+ struct i2c_adapter *i2c);
+ #else
+diff --git a/drivers/media/dvb-frontends/s921.h b/drivers/media/dvb-frontends/s921.h
+index 9b20c9e0eb88..7d3999a4e974 100644
+--- a/drivers/media/dvb-frontends/s921.h
++++ b/drivers/media/dvb-frontends/s921.h
+@@ -25,7 +25,7 @@ struct s921_config {
+ u8 demod_address;
+ };
+
+-#if IS_ENABLED(CONFIG_DVB_S921)
++#if IS_REACHABLE(CONFIG_DVB_S921)
+ extern struct dvb_frontend *s921_attach(const struct s921_config *config,
+ struct i2c_adapter *i2c);
+ extern struct i2c_adapter *s921_get_tuner_i2c_adapter(struct dvb_frontend *);
+diff --git a/drivers/media/dvb-frontends/si21xx.h b/drivers/media/dvb-frontends/si21xx.h
+index 1509fed44a3a..ef5f351ca68e 100644
+--- a/drivers/media/dvb-frontends/si21xx.h
++++ b/drivers/media/dvb-frontends/si21xx.h
+@@ -13,7 +13,7 @@ struct si21xx_config {
+ int min_delay_ms;
+ };
+
+-#if IS_ENABLED(CONFIG_DVB_SI21XX)
++#if IS_REACHABLE(CONFIG_DVB_SI21XX)
+ extern struct dvb_frontend *si21xx_attach(const struct si21xx_config *config,
+ struct i2c_adapter *i2c);
+ #else
+diff --git a/drivers/media/dvb-frontends/sp8870.h b/drivers/media/dvb-frontends/sp8870.h
+index 065ec67d4e30..f507b9fd707b 100644
+--- a/drivers/media/dvb-frontends/sp8870.h
++++ b/drivers/media/dvb-frontends/sp8870.h
+@@ -35,7 +35,7 @@ struct sp8870_config
+ int (*request_firmware)(struct dvb_frontend* fe, const struct firmware **fw, char* name);
+ };
+
+-#if IS_ENABLED(CONFIG_DVB_SP8870)
++#if IS_REACHABLE(CONFIG_DVB_SP8870)
+ extern struct dvb_frontend* sp8870_attach(const struct sp8870_config* config,
+ struct i2c_adapter* i2c);
+ #else
+diff --git a/drivers/media/dvb-frontends/sp887x.h b/drivers/media/dvb-frontends/sp887x.h
+index 2cdc4e8bc9cd..412f011e6dfd 100644
+--- a/drivers/media/dvb-frontends/sp887x.h
++++ b/drivers/media/dvb-frontends/sp887x.h
+@@ -17,7 +17,7 @@ struct sp887x_config
+ int (*request_firmware)(struct dvb_frontend* fe, const struct firmware **fw, char* name);
+ };
+
+-#if IS_ENABLED(CONFIG_DVB_SP887X)
++#if IS_REACHABLE(CONFIG_DVB_SP887X)
+ extern struct dvb_frontend* sp887x_attach(const struct sp887x_config* config,
+ struct i2c_adapter* i2c);
+ #else
+diff --git a/drivers/media/dvb-frontends/stb0899_drv.h b/drivers/media/dvb-frontends/stb0899_drv.h
+index 139264d19263..0a72131a57db 100644
+--- a/drivers/media/dvb-frontends/stb0899_drv.h
++++ b/drivers/media/dvb-frontends/stb0899_drv.h
+@@ -141,7 +141,7 @@ struct stb0899_config {
+ int (*tuner_set_rfsiggain)(struct dvb_frontend *fe, u32 rf_gain);
+ };
+
+-#if IS_ENABLED(CONFIG_DVB_STB0899)
++#if IS_REACHABLE(CONFIG_DVB_STB0899)
+
+ extern struct dvb_frontend *stb0899_attach(struct stb0899_config *config,
+ struct i2c_adapter *i2c);
+diff --git a/drivers/media/dvb-frontends/stb6000.h b/drivers/media/dvb-frontends/stb6000.h
+index a768189bfaad..da581b652cb9 100644
+--- a/drivers/media/dvb-frontends/stb6000.h
++++ b/drivers/media/dvb-frontends/stb6000.h
+@@ -35,7 +35,7 @@
+ * @param i2c i2c adapter to use.
+ * @return FE pointer on success, NULL on failure.
+ */
+-#if IS_ENABLED(CONFIG_DVB_STB6000)
++#if IS_REACHABLE(CONFIG_DVB_STB6000)
+ extern struct dvb_frontend *stb6000_attach(struct dvb_frontend *fe, int addr,
+ struct i2c_adapter *i2c);
+ #else
+diff --git a/drivers/media/dvb-frontends/stb6100.h b/drivers/media/dvb-frontends/stb6100.h
+index 3a1e40f3b8be..218c8188865d 100644
+--- a/drivers/media/dvb-frontends/stb6100.h
++++ b/drivers/media/dvb-frontends/stb6100.h
+@@ -94,7 +94,7 @@ struct stb6100_state {
+ u32 reference;
+ };
+
+-#if IS_ENABLED(CONFIG_DVB_STB6100)
++#if IS_REACHABLE(CONFIG_DVB_STB6100)
+
+ extern struct dvb_frontend *stb6100_attach(struct dvb_frontend *fe,
+ const struct stb6100_config *config,
+diff --git a/drivers/media/dvb-frontends/stv0288.h b/drivers/media/dvb-frontends/stv0288.h
+index a0bd93107154..b58603c00c80 100644
+--- a/drivers/media/dvb-frontends/stv0288.h
++++ b/drivers/media/dvb-frontends/stv0288.h
+@@ -43,7 +43,7 @@ struct stv0288_config {
+ int (*set_ts_params)(struct dvb_frontend *fe, int is_punctured);
+ };
+
+-#if IS_ENABLED(CONFIG_DVB_STV0288)
++#if IS_REACHABLE(CONFIG_DVB_STV0288)
+ extern struct dvb_frontend *stv0288_attach(const struct stv0288_config *config,
+ struct i2c_adapter *i2c);
+ #else
+diff --git a/drivers/media/dvb-frontends/stv0297.h b/drivers/media/dvb-frontends/stv0297.h
+index c8ff3639ce00..b30632a67333 100644
+--- a/drivers/media/dvb-frontends/stv0297.h
++++ b/drivers/media/dvb-frontends/stv0297.h
+@@ -42,7 +42,7 @@ struct stv0297_config
+ u8 stop_during_read:1;
+ };
+
+-#if IS_ENABLED(CONFIG_DVB_STV0297)
++#if IS_REACHABLE(CONFIG_DVB_STV0297)
+ extern struct dvb_frontend* stv0297_attach(const struct stv0297_config* config,
+ struct i2c_adapter* i2c);
+ #else
+diff --git a/drivers/media/dvb-frontends/stv0299.h b/drivers/media/dvb-frontends/stv0299.h
+index 06f70fc8327b..0aca30a8ec25 100644
+--- a/drivers/media/dvb-frontends/stv0299.h
++++ b/drivers/media/dvb-frontends/stv0299.h
+@@ -95,7 +95,7 @@ struct stv0299_config
+ int (*set_ts_params)(struct dvb_frontend *fe, int is_punctured);
+ };
+
+-#if IS_ENABLED(CONFIG_DVB_STV0299)
++#if IS_REACHABLE(CONFIG_DVB_STV0299)
+ extern struct dvb_frontend *stv0299_attach(const struct stv0299_config *config,
+ struct i2c_adapter *i2c);
+ #else
+diff --git a/drivers/media/dvb-frontends/stv0367.h b/drivers/media/dvb-frontends/stv0367.h
+index ea80b341f094..92b3e85fb818 100644
+--- a/drivers/media/dvb-frontends/stv0367.h
++++ b/drivers/media/dvb-frontends/stv0367.h
+@@ -39,7 +39,7 @@ struct stv0367_config {
+ int clk_pol;
+ };
+
+-#if IS_ENABLED(CONFIG_DVB_STV0367)
++#if IS_REACHABLE(CONFIG_DVB_STV0367)
+ extern struct
+ dvb_frontend *stv0367ter_attach(const struct stv0367_config *config,
+ struct i2c_adapter *i2c);
+diff --git a/drivers/media/dvb-frontends/stv0900.h b/drivers/media/dvb-frontends/stv0900.h
+index e2a6dc69ecb4..c90bf00ea9ce 100644
+--- a/drivers/media/dvb-frontends/stv0900.h
++++ b/drivers/media/dvb-frontends/stv0900.h
+@@ -58,7 +58,7 @@ struct stv0900_config {
+ void (*set_lock_led)(struct dvb_frontend *fe, int offon);
+ };
+
+-#if IS_ENABLED(CONFIG_DVB_STV0900)
++#if IS_REACHABLE(CONFIG_DVB_STV0900)
+ extern struct dvb_frontend *stv0900_attach(const struct stv0900_config *config,
+ struct i2c_adapter *i2c, int demod);
+ #else
+diff --git a/drivers/media/dvb-frontends/stv090x.h b/drivers/media/dvb-frontends/stv090x.h
+index 0bd6adcfee8a..97ada6b246b7 100644
+--- a/drivers/media/dvb-frontends/stv090x.h
++++ b/drivers/media/dvb-frontends/stv090x.h
+@@ -103,7 +103,7 @@ struct stv090x_config {
+ void (*tuner_i2c_lock) (struct dvb_frontend *fe, int lock);
+ };
+
+-#if IS_ENABLED(CONFIG_DVB_STV090x)
++#if IS_REACHABLE(CONFIG_DVB_STV090x)
+
+ extern struct dvb_frontend *stv090x_attach(const struct stv090x_config *config,
+ struct i2c_adapter *i2c,
+diff --git a/drivers/media/dvb-frontends/stv6110.h b/drivers/media/dvb-frontends/stv6110.h
+index 8fa07e6a6745..f3c8a5c6b77d 100644
+--- a/drivers/media/dvb-frontends/stv6110.h
++++ b/drivers/media/dvb-frontends/stv6110.h
+@@ -46,7 +46,7 @@ struct stv6110_config {
+ u8 clk_div; /* divisor value for the output clock */
+ };
+
+-#if IS_ENABLED(CONFIG_DVB_STV6110)
++#if IS_REACHABLE(CONFIG_DVB_STV6110)
+ extern struct dvb_frontend *stv6110_attach(struct dvb_frontend *fe,
+ const struct stv6110_config *config,
+ struct i2c_adapter *i2c);
+diff --git a/drivers/media/dvb-frontends/stv6110x.h b/drivers/media/dvb-frontends/stv6110x.h
+index bc4766db29c5..9f7eb251aec3 100644
+--- a/drivers/media/dvb-frontends/stv6110x.h
++++ b/drivers/media/dvb-frontends/stv6110x.h
+@@ -53,7 +53,7 @@ struct stv6110x_devctl {
+ };
+
+
+-#if IS_ENABLED(CONFIG_DVB_STV6110x)
++#if IS_REACHABLE(CONFIG_DVB_STV6110x)
+
+ extern struct stv6110x_devctl *stv6110x_attach(struct dvb_frontend *fe,
+ const struct stv6110x_config *config,
+diff --git a/drivers/media/dvb-frontends/tda1002x.h b/drivers/media/dvb-frontends/tda1002x.h
+index e404b6e44802..0d334613de1b 100644
+--- a/drivers/media/dvb-frontends/tda1002x.h
++++ b/drivers/media/dvb-frontends/tda1002x.h
+@@ -57,7 +57,7 @@ struct tda10023_config {
+ u16 deltaf;
+ };
+
+-#if IS_ENABLED(CONFIG_DVB_TDA10021)
++#if IS_REACHABLE(CONFIG_DVB_TDA10021)
+ extern struct dvb_frontend* tda10021_attach(const struct tda1002x_config* config,
+ struct i2c_adapter* i2c, u8 pwm);
+ #else
+@@ -69,7 +69,7 @@ static inline struct dvb_frontend* tda10021_attach(const struct tda1002x_config*
+ }
+ #endif // CONFIG_DVB_TDA10021
+
+-#if IS_ENABLED(CONFIG_DVB_TDA10023)
++#if IS_REACHABLE(CONFIG_DVB_TDA10023)
+ extern struct dvb_frontend *tda10023_attach(
+ const struct tda10023_config *config,
+ struct i2c_adapter *i2c, u8 pwm);
+diff --git a/drivers/media/dvb-frontends/tda10048.h b/drivers/media/dvb-frontends/tda10048.h
+index 5e7bf4e47cb3..bc77a7311de1 100644
+--- a/drivers/media/dvb-frontends/tda10048.h
++++ b/drivers/media/dvb-frontends/tda10048.h
+@@ -73,7 +73,7 @@ struct tda10048_config {
+ u8 pll_n;
+ };
+
+-#if IS_ENABLED(CONFIG_DVB_TDA10048)
++#if IS_REACHABLE(CONFIG_DVB_TDA10048)
+ extern struct dvb_frontend *tda10048_attach(
+ const struct tda10048_config *config,
+ struct i2c_adapter *i2c);
+diff --git a/drivers/media/dvb-frontends/tda1004x.h b/drivers/media/dvb-frontends/tda1004x.h
+index dd283fbb61c0..efd7659dace9 100644
+--- a/drivers/media/dvb-frontends/tda1004x.h
++++ b/drivers/media/dvb-frontends/tda1004x.h
+@@ -117,7 +117,7 @@ struct tda1004x_state {
+ enum tda1004x_demod demod_type;
+ };
+
+-#if IS_ENABLED(CONFIG_DVB_TDA1004X)
++#if IS_REACHABLE(CONFIG_DVB_TDA1004X)
+ extern struct dvb_frontend* tda10045_attach(const struct tda1004x_config* config,
+ struct i2c_adapter* i2c);
+
+diff --git a/drivers/media/dvb-frontends/tda10071.h b/drivers/media/dvb-frontends/tda10071.h
+index 331b5a819383..da89f4249846 100644
+--- a/drivers/media/dvb-frontends/tda10071.h
++++ b/drivers/media/dvb-frontends/tda10071.h
+@@ -72,7 +72,7 @@ struct tda10071_config {
+ };
+
+
+-#if IS_ENABLED(CONFIG_DVB_TDA10071)
++#if IS_REACHABLE(CONFIG_DVB_TDA10071)
+ extern struct dvb_frontend *tda10071_attach(
+ const struct tda10071_config *config, struct i2c_adapter *i2c);
+ #else
+diff --git a/drivers/media/dvb-frontends/tda10086.h b/drivers/media/dvb-frontends/tda10086.h
+index 458fe91c1b88..690e469995b6 100644
+--- a/drivers/media/dvb-frontends/tda10086.h
++++ b/drivers/media/dvb-frontends/tda10086.h
+@@ -46,7 +46,7 @@ struct tda10086_config
+ enum tda10086_xtal xtal_freq;
+ };
+
+-#if IS_ENABLED(CONFIG_DVB_TDA10086)
++#if IS_REACHABLE(CONFIG_DVB_TDA10086)
+ extern struct dvb_frontend* tda10086_attach(const struct tda10086_config* config,
+ struct i2c_adapter* i2c);
+ #else
+diff --git a/drivers/media/dvb-frontends/tda18271c2dd.h b/drivers/media/dvb-frontends/tda18271c2dd.h
+index dd84f7b69bec..7ebd8eaff4eb 100644
+--- a/drivers/media/dvb-frontends/tda18271c2dd.h
++++ b/drivers/media/dvb-frontends/tda18271c2dd.h
+@@ -3,7 +3,7 @@
+
+ #include <linux/kconfig.h>
+
+-#if IS_ENABLED(CONFIG_DVB_TDA18271C2DD)
++#if IS_REACHABLE(CONFIG_DVB_TDA18271C2DD)
+ struct dvb_frontend *tda18271c2dd_attach(struct dvb_frontend *fe,
+ struct i2c_adapter *i2c, u8 adr);
+ #else
+diff --git a/drivers/media/dvb-frontends/tda665x.h b/drivers/media/dvb-frontends/tda665x.h
+index 03a0da6d5cf2..baf520baa42e 100644
+--- a/drivers/media/dvb-frontends/tda665x.h
++++ b/drivers/media/dvb-frontends/tda665x.h
+@@ -31,7 +31,7 @@ struct tda665x_config {
+ u32 ref_divider;
+ };
+
+-#if IS_ENABLED(CONFIG_DVB_TDA665x)
++#if IS_REACHABLE(CONFIG_DVB_TDA665x)
+
+ extern struct dvb_frontend *tda665x_attach(struct dvb_frontend *fe,
+ const struct tda665x_config *config,
+diff --git a/drivers/media/dvb-frontends/tda8083.h b/drivers/media/dvb-frontends/tda8083.h
+index de6b1860dfdd..46be06fa7e0d 100644
+--- a/drivers/media/dvb-frontends/tda8083.h
++++ b/drivers/media/dvb-frontends/tda8083.h
+@@ -35,7 +35,7 @@ struct tda8083_config
+ u8 demod_address;
+ };
+
+-#if IS_ENABLED(CONFIG_DVB_TDA8083)
++#if IS_REACHABLE(CONFIG_DVB_TDA8083)
+ extern struct dvb_frontend* tda8083_attach(const struct tda8083_config* config,
+ struct i2c_adapter* i2c);
+ #else
+diff --git a/drivers/media/dvb-frontends/tda8261.h b/drivers/media/dvb-frontends/tda8261.h
+index 55cf4ffcbfdf..9fa5b3076d5b 100644
+--- a/drivers/media/dvb-frontends/tda8261.h
++++ b/drivers/media/dvb-frontends/tda8261.h
+@@ -34,7 +34,7 @@ struct tda8261_config {
+ enum tda8261_step step_size;
+ };
+
+-#if IS_ENABLED(CONFIG_DVB_TDA8261)
++#if IS_REACHABLE(CONFIG_DVB_TDA8261)
+
+ extern struct dvb_frontend *tda8261_attach(struct dvb_frontend *fe,
+ const struct tda8261_config *config,
+diff --git a/drivers/media/dvb-frontends/tda826x.h b/drivers/media/dvb-frontends/tda826x.h
+index 5f0f20e7e4f8..81abe1aebe9f 100644
+--- a/drivers/media/dvb-frontends/tda826x.h
++++ b/drivers/media/dvb-frontends/tda826x.h
+@@ -35,7 +35,7 @@
+ * @param has_loopthrough Set to 1 if the card has a loopthrough RF connector.
+ * @return FE pointer on success, NULL on failure.
+ */
+-#if IS_ENABLED(CONFIG_DVB_TDA826X)
++#if IS_REACHABLE(CONFIG_DVB_TDA826X)
+ extern struct dvb_frontend* tda826x_attach(struct dvb_frontend *fe, int addr,
+ struct i2c_adapter *i2c,
+ int has_loopthrough);
+diff --git a/drivers/media/dvb-frontends/ts2020.h b/drivers/media/dvb-frontends/ts2020.h
+index b2fe6bb3a38b..595841def66d 100644
+--- a/drivers/media/dvb-frontends/ts2020.h
++++ b/drivers/media/dvb-frontends/ts2020.h
+@@ -31,7 +31,7 @@ struct ts2020_config {
+ u32 frequency_div;
+ };
+
+-#if IS_ENABLED(CONFIG_DVB_TS2020)
++#if IS_REACHABLE(CONFIG_DVB_TS2020)
+
+ extern struct dvb_frontend *ts2020_attach(
+ struct dvb_frontend *fe,
+diff --git a/drivers/media/dvb-frontends/tua6100.h b/drivers/media/dvb-frontends/tua6100.h
+index 83a9c30e67ca..52919e04e258 100644
+--- a/drivers/media/dvb-frontends/tua6100.h
++++ b/drivers/media/dvb-frontends/tua6100.h
+@@ -34,7 +34,7 @@
+ #include <linux/i2c.h>
+ #include "dvb_frontend.h"
+
+-#if IS_ENABLED(CONFIG_DVB_TUA6100)
++#if IS_REACHABLE(CONFIG_DVB_TUA6100)
+ extern struct dvb_frontend *tua6100_attach(struct dvb_frontend *fe, int addr, struct i2c_adapter *i2c);
+ #else
+ static inline struct dvb_frontend* tua6100_attach(struct dvb_frontend *fe, int addr, struct i2c_adapter *i2c)
+diff --git a/drivers/media/dvb-frontends/ves1820.h b/drivers/media/dvb-frontends/ves1820.h
+index c073f353ac38..ece46fdcd714 100644
+--- a/drivers/media/dvb-frontends/ves1820.h
++++ b/drivers/media/dvb-frontends/ves1820.h
+@@ -41,7 +41,7 @@ struct ves1820_config
+ u8 selagc:1;
+ };
+
+-#if IS_ENABLED(CONFIG_DVB_VES1820)
++#if IS_REACHABLE(CONFIG_DVB_VES1820)
+ extern struct dvb_frontend* ves1820_attach(const struct ves1820_config* config,
+ struct i2c_adapter* i2c, u8 pwm);
+ #else
+diff --git a/drivers/media/dvb-frontends/ves1x93.h b/drivers/media/dvb-frontends/ves1x93.h
+index 2307caea6aec..4510fe2f6676 100644
+--- a/drivers/media/dvb-frontends/ves1x93.h
++++ b/drivers/media/dvb-frontends/ves1x93.h
+@@ -40,7 +40,7 @@ struct ves1x93_config
+ u8 invert_pwm:1;
+ };
+
+-#if IS_ENABLED(CONFIG_DVB_VES1X93)
++#if IS_REACHABLE(CONFIG_DVB_VES1X93)
+ extern struct dvb_frontend* ves1x93_attach(const struct ves1x93_config* config,
+ struct i2c_adapter* i2c);
+ #else
+diff --git a/drivers/media/dvb-frontends/zl10036.h b/drivers/media/dvb-frontends/zl10036.h
+index 5f1e8217eeb6..670e76a654ee 100644
+--- a/drivers/media/dvb-frontends/zl10036.h
++++ b/drivers/media/dvb-frontends/zl10036.h
+@@ -38,7 +38,7 @@ struct zl10036_config {
+ int rf_loop_enable;
+ };
+
+-#if IS_ENABLED(CONFIG_DVB_ZL10036)
++#if IS_REACHABLE(CONFIG_DVB_ZL10036)
+ extern struct dvb_frontend *zl10036_attach(struct dvb_frontend *fe,
+ const struct zl10036_config *config, struct i2c_adapter *i2c);
+ #else
+diff --git a/drivers/media/dvb-frontends/zl10039.h b/drivers/media/dvb-frontends/zl10039.h
+index 750b9bca9d02..070929444e71 100644
+--- a/drivers/media/dvb-frontends/zl10039.h
++++ b/drivers/media/dvb-frontends/zl10039.h
+@@ -24,7 +24,7 @@
+
+ #include <linux/kconfig.h>
+
+-#if IS_ENABLED(CONFIG_DVB_ZL10039)
++#if IS_REACHABLE(CONFIG_DVB_ZL10039)
+ struct dvb_frontend *zl10039_attach(struct dvb_frontend *fe,
+ u8 i2c_addr,
+ struct i2c_adapter *i2c);
+diff --git a/drivers/media/dvb-frontends/zl10353.h b/drivers/media/dvb-frontends/zl10353.h
+index 50c1004aef36..37aa6e8f454a 100644
+--- a/drivers/media/dvb-frontends/zl10353.h
++++ b/drivers/media/dvb-frontends/zl10353.h
+@@ -47,7 +47,7 @@ struct zl10353_config
+ u8 pll_0; /* default: 0x15 */
+ };
+
+-#if IS_ENABLED(CONFIG_DVB_ZL10353)
++#if IS_REACHABLE(CONFIG_DVB_ZL10353)
+ extern struct dvb_frontend* zl10353_attach(const struct zl10353_config *config,
+ struct i2c_adapter *i2c);
+ #else
+diff --git a/drivers/media/pci/cx23885/altera-ci.h b/drivers/media/pci/cx23885/altera-ci.h
+index 5028f0cf83f4..6c511723fd1b 100644
+--- a/drivers/media/pci/cx23885/altera-ci.h
++++ b/drivers/media/pci/cx23885/altera-ci.h
+@@ -39,7 +39,7 @@ struct altera_ci_config {
+ int (*fpga_rw) (void *dev, int ad_rg, int val, int rw);
+ };
+
+-#if IS_ENABLED(CONFIG_MEDIA_ALTERA_CI)
++#if IS_REACHABLE(CONFIG_MEDIA_ALTERA_CI)
+
+ extern int altera_ci_init(struct altera_ci_config *config, int ci_nr);
+ extern void altera_ci_release(void *dev, int ci_nr);
+diff --git a/drivers/media/tuners/fc0011.h b/drivers/media/tuners/fc0011.h
+index 43ec893a6877..81bb568d6943 100644
+--- a/drivers/media/tuners/fc0011.h
++++ b/drivers/media/tuners/fc0011.h
+@@ -23,7 +23,7 @@ enum fc0011_fe_callback_commands {
+ FC0011_FE_CALLBACK_RESET,
+ };
+
+-#if IS_ENABLED(CONFIG_MEDIA_TUNER_FC0011)
++#if IS_REACHABLE(CONFIG_MEDIA_TUNER_FC0011)
+ struct dvb_frontend *fc0011_attach(struct dvb_frontend *fe,
+ struct i2c_adapter *i2c,
+ const struct fc0011_config *config);
+diff --git a/drivers/media/tuners/fc0012.h b/drivers/media/tuners/fc0012.h
+index 1d08057e3275..9ad32859bab0 100644
+--- a/drivers/media/tuners/fc0012.h
++++ b/drivers/media/tuners/fc0012.h
+@@ -49,7 +49,7 @@ struct fc0012_config {
+ bool clock_out;
+ };
+
+-#if IS_ENABLED(CONFIG_MEDIA_TUNER_FC0012)
++#if IS_REACHABLE(CONFIG_MEDIA_TUNER_FC0012)
+ extern struct dvb_frontend *fc0012_attach(struct dvb_frontend *fe,
+ struct i2c_adapter *i2c,
+ const struct fc0012_config *cfg);
+diff --git a/drivers/media/tuners/fc0013.h b/drivers/media/tuners/fc0013.h
+index d65d5b37f56e..e130bd7a3230 100644
+--- a/drivers/media/tuners/fc0013.h
++++ b/drivers/media/tuners/fc0013.h
+@@ -26,7 +26,7 @@
+ #include "dvb_frontend.h"
+ #include "fc001x-common.h"
+
+-#if IS_ENABLED(CONFIG_MEDIA_TUNER_FC0013)
++#if IS_REACHABLE(CONFIG_MEDIA_TUNER_FC0013)
+ extern struct dvb_frontend *fc0013_attach(struct dvb_frontend *fe,
+ struct i2c_adapter *i2c,
+ u8 i2c_address, int dual_master,
+diff --git a/drivers/media/tuners/fc2580.h b/drivers/media/tuners/fc2580.h
+index 9c43c1cc82d9..b1ce6770f88e 100644
+--- a/drivers/media/tuners/fc2580.h
++++ b/drivers/media/tuners/fc2580.h
+@@ -37,7 +37,7 @@ struct fc2580_config {
+ u32 clock;
+ };
+
+-#if IS_ENABLED(CONFIG_MEDIA_TUNER_FC2580)
++#if IS_REACHABLE(CONFIG_MEDIA_TUNER_FC2580)
+ extern struct dvb_frontend *fc2580_attach(struct dvb_frontend *fe,
+ struct i2c_adapter *i2c, const struct fc2580_config *cfg);
+ #else
+diff --git a/drivers/media/tuners/max2165.h b/drivers/media/tuners/max2165.h
+index 26e1dc64bb67..5054f01a78fb 100644
+--- a/drivers/media/tuners/max2165.h
++++ b/drivers/media/tuners/max2165.h
+@@ -32,7 +32,7 @@ struct max2165_config {
+ u8 osc_clk; /* in MHz, selectable values: 4,16,18,20,22,24,26,28 */
+ };
+
+-#if IS_ENABLED(CONFIG_MEDIA_TUNER_MAX2165)
++#if IS_REACHABLE(CONFIG_MEDIA_TUNER_MAX2165)
+ extern struct dvb_frontend *max2165_attach(struct dvb_frontend *fe,
+ struct i2c_adapter *i2c,
+ struct max2165_config *cfg);
+diff --git a/drivers/media/tuners/mc44s803.h b/drivers/media/tuners/mc44s803.h
+index 9aae50aca2b7..b3e614be657d 100644
+--- a/drivers/media/tuners/mc44s803.h
++++ b/drivers/media/tuners/mc44s803.h
+@@ -32,7 +32,7 @@ struct mc44s803_config {
+ u8 dig_out;
+ };
+
+-#if IS_ENABLED(CONFIG_MEDIA_TUNER_MC44S803)
++#if IS_REACHABLE(CONFIG_MEDIA_TUNER_MC44S803)
+ extern struct dvb_frontend *mc44s803_attach(struct dvb_frontend *fe,
+ struct i2c_adapter *i2c, struct mc44s803_config *cfg);
+ #else
+diff --git a/drivers/media/tuners/mt2060.h b/drivers/media/tuners/mt2060.h
+index c64fc19cb278..6efed359a24f 100644
+--- a/drivers/media/tuners/mt2060.h
++++ b/drivers/media/tuners/mt2060.h
+@@ -30,7 +30,7 @@ struct mt2060_config {
+ u8 clock_out; /* 0 = off, 1 = CLK/4, 2 = CLK/2, 3 = CLK/1 */
+ };
+
+-#if IS_ENABLED(CONFIG_MEDIA_TUNER_MT2060)
++#if IS_REACHABLE(CONFIG_MEDIA_TUNER_MT2060)
+ extern struct dvb_frontend * mt2060_attach(struct dvb_frontend *fe, struct i2c_adapter *i2c, struct mt2060_config *cfg, u16 if1);
+ #else
+ static inline struct dvb_frontend * mt2060_attach(struct dvb_frontend *fe, struct i2c_adapter *i2c, struct mt2060_config *cfg, u16 if1)
+diff --git a/drivers/media/tuners/mt2063.h b/drivers/media/tuners/mt2063.h
+index e1acfc8e7ae3..e55e0a6dd1be 100644
+--- a/drivers/media/tuners/mt2063.h
++++ b/drivers/media/tuners/mt2063.h
+@@ -8,7 +8,7 @@ struct mt2063_config {
+ u32 refclock;
+ };
+
+-#if IS_ENABLED(CONFIG_MEDIA_TUNER_MT2063)
++#if IS_REACHABLE(CONFIG_MEDIA_TUNER_MT2063)
+ struct dvb_frontend *mt2063_attach(struct dvb_frontend *fe,
+ struct mt2063_config *config,
+ struct i2c_adapter *i2c);
+diff --git a/drivers/media/tuners/mt20xx.h b/drivers/media/tuners/mt20xx.h
+index f56241ccaa00..9912362b415e 100644
+--- a/drivers/media/tuners/mt20xx.h
++++ b/drivers/media/tuners/mt20xx.h
+@@ -20,7 +20,7 @@
+ #include <linux/i2c.h>
+ #include "dvb_frontend.h"
+
+-#if IS_ENABLED(CONFIG_MEDIA_TUNER_MT20XX)
++#if IS_REACHABLE(CONFIG_MEDIA_TUNER_MT20XX)
+ extern struct dvb_frontend *microtune_attach(struct dvb_frontend *fe,
+ struct i2c_adapter* i2c_adap,
+ u8 i2c_addr);
+diff --git a/drivers/media/tuners/mt2131.h b/drivers/media/tuners/mt2131.h
+index 09ceaf68e47c..f5896c931979 100644
+--- a/drivers/media/tuners/mt2131.h
++++ b/drivers/media/tuners/mt2131.h
+@@ -30,7 +30,7 @@ struct mt2131_config {
+ u8 clock_out; /* 0 = off, 1 = CLK/4, 2 = CLK/2, 3 = CLK/1 */
+ };
+
+-#if IS_ENABLED(CONFIG_MEDIA_TUNER_MT2131)
++#if IS_REACHABLE(CONFIG_MEDIA_TUNER_MT2131)
+ extern struct dvb_frontend* mt2131_attach(struct dvb_frontend *fe,
+ struct i2c_adapter *i2c,
+ struct mt2131_config *cfg,
+diff --git a/drivers/media/tuners/mt2266.h b/drivers/media/tuners/mt2266.h
+index fad6dd657d77..69abefa18c37 100644
+--- a/drivers/media/tuners/mt2266.h
++++ b/drivers/media/tuners/mt2266.h
+@@ -24,7 +24,7 @@ struct mt2266_config {
+ u8 i2c_address;
+ };
+
+-#if IS_ENABLED(CONFIG_MEDIA_TUNER_MT2266)
++#if IS_REACHABLE(CONFIG_MEDIA_TUNER_MT2266)
+ extern struct dvb_frontend * mt2266_attach(struct dvb_frontend *fe, struct i2c_adapter *i2c, struct mt2266_config *cfg);
+ #else
+ static inline struct dvb_frontend * mt2266_attach(struct dvb_frontend *fe, struct i2c_adapter *i2c, struct mt2266_config *cfg)
+diff --git a/drivers/media/tuners/mxl5005s.h b/drivers/media/tuners/mxl5005s.h
+index ae8db885ad87..5764b12c5c7c 100644
+--- a/drivers/media/tuners/mxl5005s.h
++++ b/drivers/media/tuners/mxl5005s.h
+@@ -118,7 +118,7 @@ struct mxl5005s_config {
+ u8 AgcMasterByte;
+ };
+
+-#if IS_ENABLED(CONFIG_MEDIA_TUNER_MXL5005S)
++#if IS_REACHABLE(CONFIG_MEDIA_TUNER_MXL5005S)
+ extern struct dvb_frontend *mxl5005s_attach(struct dvb_frontend *fe,
+ struct i2c_adapter *i2c,
+ struct mxl5005s_config *config);
+diff --git a/drivers/media/tuners/mxl5007t.h b/drivers/media/tuners/mxl5007t.h
+index 37b0942e2385..d4861d74152b 100644
+--- a/drivers/media/tuners/mxl5007t.h
++++ b/drivers/media/tuners/mxl5007t.h
+@@ -77,7 +77,7 @@ struct mxl5007t_config {
+ unsigned int clk_out_enable:1;
+ };
+
+-#if IS_ENABLED(CONFIG_MEDIA_TUNER_MXL5007T)
++#if IS_REACHABLE(CONFIG_MEDIA_TUNER_MXL5007T)
+ extern struct dvb_frontend *mxl5007t_attach(struct dvb_frontend *fe,
+ struct i2c_adapter *i2c, u8 addr,
+ struct mxl5007t_config *cfg);
+diff --git a/drivers/media/tuners/qt1010.h b/drivers/media/tuners/qt1010.h
+index 8ab5d479749f..e3198f23437c 100644
+--- a/drivers/media/tuners/qt1010.h
++++ b/drivers/media/tuners/qt1010.h
+@@ -36,7 +36,7 @@ struct qt1010_config {
+ * @param cfg tuner hw based configuration
+ * @return fe pointer on success, NULL on failure
+ */
+-#if IS_ENABLED(CONFIG_MEDIA_TUNER_QT1010)
++#if IS_REACHABLE(CONFIG_MEDIA_TUNER_QT1010)
+ extern struct dvb_frontend *qt1010_attach(struct dvb_frontend *fe,
+ struct i2c_adapter *i2c,
+ struct qt1010_config *cfg);
+diff --git a/drivers/media/tuners/r820t.h b/drivers/media/tuners/r820t.h
+index 48af3548027d..b1e5661af1c7 100644
+--- a/drivers/media/tuners/r820t.h
++++ b/drivers/media/tuners/r820t.h
+@@ -42,7 +42,7 @@ struct r820t_config {
+ bool use_predetect;
+ };
+
+-#if IS_ENABLED(CONFIG_MEDIA_TUNER_R820T)
++#if IS_REACHABLE(CONFIG_MEDIA_TUNER_R820T)
+ struct dvb_frontend *r820t_attach(struct dvb_frontend *fe,
+ struct i2c_adapter *i2c,
+ const struct r820t_config *cfg);
+diff --git a/drivers/media/tuners/tda18218.h b/drivers/media/tuners/tda18218.h
+index 366410e0cc9a..1eacb4f84e93 100644
+--- a/drivers/media/tuners/tda18218.h
++++ b/drivers/media/tuners/tda18218.h
+@@ -30,7 +30,7 @@ struct tda18218_config {
+ u8 loop_through:1;
+ };
+
+-#if IS_ENABLED(CONFIG_MEDIA_TUNER_TDA18218)
++#if IS_REACHABLE(CONFIG_MEDIA_TUNER_TDA18218)
+ extern struct dvb_frontend *tda18218_attach(struct dvb_frontend *fe,
+ struct i2c_adapter *i2c, struct tda18218_config *cfg);
+ #else
+diff --git a/drivers/media/tuners/tda18271.h b/drivers/media/tuners/tda18271.h
+index 4c418d63f540..0a846333ce57 100644
+--- a/drivers/media/tuners/tda18271.h
++++ b/drivers/media/tuners/tda18271.h
+@@ -121,7 +121,7 @@ enum tda18271_mode {
+ TDA18271_DIGITAL,
+ };
+
+-#if IS_ENABLED(CONFIG_MEDIA_TUNER_TDA18271)
++#if IS_REACHABLE(CONFIG_MEDIA_TUNER_TDA18271)
+ extern struct dvb_frontend *tda18271_attach(struct dvb_frontend *fe, u8 addr,
+ struct i2c_adapter *i2c,
+ struct tda18271_config *cfg);
+diff --git a/drivers/media/tuners/tda827x.h b/drivers/media/tuners/tda827x.h
+index b64292152baf..abf2e2fe5350 100644
+--- a/drivers/media/tuners/tda827x.h
++++ b/drivers/media/tuners/tda827x.h
+@@ -51,7 +51,7 @@ struct tda827x_config
+ * @param cfg optional callback function pointers.
+ * @return FE pointer on success, NULL on failure.
+ */
+-#if IS_ENABLED(CONFIG_MEDIA_TUNER_TDA827X)
++#if IS_REACHABLE(CONFIG_MEDIA_TUNER_TDA827X)
+ extern struct dvb_frontend* tda827x_attach(struct dvb_frontend *fe, int addr,
+ struct i2c_adapter *i2c,
+ struct tda827x_config *cfg);
+diff --git a/drivers/media/tuners/tda8290.h b/drivers/media/tuners/tda8290.h
+index cf96e585785e..901b8cac7105 100644
+--- a/drivers/media/tuners/tda8290.h
++++ b/drivers/media/tuners/tda8290.h
+@@ -38,7 +38,7 @@ struct tda829x_config {
+ struct tda18271_std_map *tda18271_std_map;
+ };
+
+-#if IS_ENABLED(CONFIG_MEDIA_TUNER_TDA8290)
++#if IS_REACHABLE(CONFIG_MEDIA_TUNER_TDA8290)
+ extern int tda829x_probe(struct i2c_adapter *i2c_adap, u8 i2c_addr);
+
+ extern struct dvb_frontend *tda829x_attach(struct dvb_frontend *fe,
+diff --git a/drivers/media/tuners/tda9887.h b/drivers/media/tuners/tda9887.h
+index 37a4a1123e0c..95070eca02ca 100644
+--- a/drivers/media/tuners/tda9887.h
++++ b/drivers/media/tuners/tda9887.h
+@@ -21,7 +21,7 @@
+ #include "dvb_frontend.h"
+
+ /* ------------------------------------------------------------------------ */
+-#if IS_ENABLED(CONFIG_MEDIA_TUNER_TDA9887)
++#if IS_REACHABLE(CONFIG_MEDIA_TUNER_TDA9887)
+ extern struct dvb_frontend *tda9887_attach(struct dvb_frontend *fe,
+ struct i2c_adapter *i2c_adap,
+ u8 i2c_addr);
+diff --git a/drivers/media/tuners/tea5761.h b/drivers/media/tuners/tea5761.h
+index 933228ffb509..2d624d9919e3 100644
+--- a/drivers/media/tuners/tea5761.h
++++ b/drivers/media/tuners/tea5761.h
+@@ -20,7 +20,7 @@
+ #include <linux/i2c.h>
+ #include "dvb_frontend.h"
+
+-#if IS_ENABLED(CONFIG_MEDIA_TUNER_TEA5761)
++#if IS_REACHABLE(CONFIG_MEDIA_TUNER_TEA5761)
+ extern int tea5761_autodetection(struct i2c_adapter* i2c_adap, u8 i2c_addr);
+
+ extern struct dvb_frontend *tea5761_attach(struct dvb_frontend *fe,
+diff --git a/drivers/media/tuners/tea5767.h b/drivers/media/tuners/tea5767.h
+index c39101199383..4f6f6c92db78 100644
+--- a/drivers/media/tuners/tea5767.h
++++ b/drivers/media/tuners/tea5767.h
+@@ -39,7 +39,7 @@ struct tea5767_ctrl {
+ enum tea5767_xtal xtal_freq;
+ };
+
+-#if IS_ENABLED(CONFIG_MEDIA_TUNER_TEA5767)
++#if IS_REACHABLE(CONFIG_MEDIA_TUNER_TEA5767)
+ extern int tea5767_autodetection(struct i2c_adapter* i2c_adap, u8 i2c_addr);
+
+ extern struct dvb_frontend *tea5767_attach(struct dvb_frontend *fe,
+diff --git a/drivers/media/tuners/tua9001.h b/drivers/media/tuners/tua9001.h
+index 26358da1c100..2c3375c7aeb9 100644
+--- a/drivers/media/tuners/tua9001.h
++++ b/drivers/media/tuners/tua9001.h
+@@ -51,7 +51,7 @@ struct tua9001_config {
+ #define TUA9001_CMD_RESETN 1
+ #define TUA9001_CMD_RXEN 2
+
+-#if IS_ENABLED(CONFIG_MEDIA_TUNER_TUA9001)
++#if IS_REACHABLE(CONFIG_MEDIA_TUNER_TUA9001)
+ extern struct dvb_frontend *tua9001_attach(struct dvb_frontend *fe,
+ struct i2c_adapter *i2c, struct tua9001_config *cfg);
+ #else
+diff --git a/drivers/media/tuners/tuner-simple.h b/drivers/media/tuners/tuner-simple.h
+index ffd12cfe650b..6399b45b0590 100644
+--- a/drivers/media/tuners/tuner-simple.h
++++ b/drivers/media/tuners/tuner-simple.h
+@@ -20,7 +20,7 @@
+ #include <linux/i2c.h>
+ #include "dvb_frontend.h"
+
+-#if IS_ENABLED(CONFIG_MEDIA_TUNER_SIMPLE)
++#if IS_REACHABLE(CONFIG_MEDIA_TUNER_SIMPLE)
+ extern struct dvb_frontend *simple_tuner_attach(struct dvb_frontend *fe,
+ struct i2c_adapter *i2c_adap,
+ u8 i2c_addr,
+diff --git a/drivers/media/tuners/tuner-xc2028.h b/drivers/media/tuners/tuner-xc2028.h
+index 181d087faec4..98e4effca896 100644
+--- a/drivers/media/tuners/tuner-xc2028.h
++++ b/drivers/media/tuners/tuner-xc2028.h
+@@ -56,7 +56,7 @@ struct xc2028_config {
+ #define XC2028_RESET_CLK 1
+ #define XC2028_I2C_FLUSH 2
+
+-#if IS_ENABLED(CONFIG_MEDIA_TUNER_XC2028)
++#if IS_REACHABLE(CONFIG_MEDIA_TUNER_XC2028)
+ extern struct dvb_frontend *xc2028_attach(struct dvb_frontend *fe,
+ struct xc2028_config *cfg);
+ #else
+diff --git a/drivers/media/tuners/xc4000.h b/drivers/media/tuners/xc4000.h
+index 97c23de5296c..40517860cf67 100644
+--- a/drivers/media/tuners/xc4000.h
++++ b/drivers/media/tuners/xc4000.h
+@@ -50,7 +50,7 @@ struct xc4000_config {
+ * it's passed back to a bridge during tuner_callback().
+ */
+
+-#if IS_ENABLED(CONFIG_MEDIA_TUNER_XC4000)
++#if IS_REACHABLE(CONFIG_MEDIA_TUNER_XC4000)
+ extern struct dvb_frontend *xc4000_attach(struct dvb_frontend *fe,
+ struct i2c_adapter *i2c,
+ struct xc4000_config *cfg);
+diff --git a/drivers/media/tuners/xc5000.h b/drivers/media/tuners/xc5000.h
+index 7245cae19f0c..f746a97e90bb 100644
+--- a/drivers/media/tuners/xc5000.h
++++ b/drivers/media/tuners/xc5000.h
+@@ -57,7 +57,7 @@ struct xc5000_config {
+ * it's passed back to a bridge during tuner_callback().
+ */
+
+-#if IS_ENABLED(CONFIG_MEDIA_TUNER_XC5000)
++#if IS_REACHABLE(CONFIG_MEDIA_TUNER_XC5000)
+ extern struct dvb_frontend *xc5000_attach(struct dvb_frontend *fe,
+ struct i2c_adapter *i2c,
+ const struct xc5000_config *cfg);
+diff --git a/drivers/net/bonding/bond_options.c b/drivers/net/bonding/bond_options.c
+index b62697f4a3de..f1c53944a2c3 100644
+--- a/drivers/net/bonding/bond_options.c
++++ b/drivers/net/bonding/bond_options.c
+@@ -625,7 +625,7 @@ int __bond_opt_set(struct bonding *bond,
+ out:
+ if (ret)
+ bond_opt_error_interpret(bond, opt, ret, val);
+- else
++ else if (bond->dev->reg_state == NETREG_REGISTERED)
+ call_netdevice_notifiers(NETDEV_CHANGEINFODATA, bond->dev);
+
+ return ret;
+diff --git a/drivers/net/ethernet/emulex/benet/be_cmds.c b/drivers/net/ethernet/emulex/benet/be_cmds.c
+index fead5c65a4f0..9c827b7642e7 100644
+--- a/drivers/net/ethernet/emulex/benet/be_cmds.c
++++ b/drivers/net/ethernet/emulex/benet/be_cmds.c
+@@ -1705,9 +1705,9 @@ int be_cmd_get_regs(struct be_adapter *adapter, u32 buf_len, void *buf)
+ total_size = buf_len;
+
+ get_fat_cmd.size = sizeof(struct be_cmd_req_get_fat) + 60*1024;
+- get_fat_cmd.va = pci_alloc_consistent(adapter->pdev,
+- get_fat_cmd.size,
+- &get_fat_cmd.dma);
++ get_fat_cmd.va = dma_zalloc_coherent(&adapter->pdev->dev,
++ get_fat_cmd.size,
++ &get_fat_cmd.dma, GFP_ATOMIC);
+ if (!get_fat_cmd.va) {
+ dev_err(&adapter->pdev->dev,
+ "Memory allocation failure while reading FAT data\n");
+@@ -1752,8 +1752,8 @@ int be_cmd_get_regs(struct be_adapter *adapter, u32 buf_len, void *buf)
+ log_offset += buf_size;
+ }
+ err:
+- pci_free_consistent(adapter->pdev, get_fat_cmd.size,
+- get_fat_cmd.va, get_fat_cmd.dma);
++ dma_free_coherent(&adapter->pdev->dev, get_fat_cmd.size,
++ get_fat_cmd.va, get_fat_cmd.dma);
+ spin_unlock_bh(&adapter->mcc_lock);
+ return status;
+ }
+@@ -2223,12 +2223,12 @@ int be_cmd_read_port_transceiver_data(struct be_adapter *adapter,
+ return -EINVAL;
+
+ cmd.size = sizeof(struct be_cmd_resp_port_type);
+- cmd.va = pci_alloc_consistent(adapter->pdev, cmd.size, &cmd.dma);
++ cmd.va = dma_zalloc_coherent(&adapter->pdev->dev, cmd.size, &cmd.dma,
++ GFP_ATOMIC);
+ if (!cmd.va) {
+ dev_err(&adapter->pdev->dev, "Memory allocation failed\n");
+ return -ENOMEM;
+ }
+- memset(cmd.va, 0, cmd.size);
+
+ spin_lock_bh(&adapter->mcc_lock);
+
+@@ -2253,7 +2253,7 @@ int be_cmd_read_port_transceiver_data(struct be_adapter *adapter,
+ }
+ err:
+ spin_unlock_bh(&adapter->mcc_lock);
+- pci_free_consistent(adapter->pdev, cmd.size, cmd.va, cmd.dma);
++ dma_free_coherent(&adapter->pdev->dev, cmd.size, cmd.va, cmd.dma);
+ return status;
+ }
+
+@@ -2702,7 +2702,8 @@ int be_cmd_get_phy_info(struct be_adapter *adapter)
+ goto err;
+ }
+ cmd.size = sizeof(struct be_cmd_req_get_phy_info);
+- cmd.va = pci_alloc_consistent(adapter->pdev, cmd.size, &cmd.dma);
++ cmd.va = dma_zalloc_coherent(&adapter->pdev->dev, cmd.size, &cmd.dma,
++ GFP_ATOMIC);
+ if (!cmd.va) {
+ dev_err(&adapter->pdev->dev, "Memory alloc failure\n");
+ status = -ENOMEM;
+@@ -2736,7 +2737,7 @@ int be_cmd_get_phy_info(struct be_adapter *adapter)
+ BE_SUPPORTED_SPEED_1GBPS;
+ }
+ }
+- pci_free_consistent(adapter->pdev, cmd.size, cmd.va, cmd.dma);
++ dma_free_coherent(&adapter->pdev->dev, cmd.size, cmd.va, cmd.dma);
+ err:
+ spin_unlock_bh(&adapter->mcc_lock);
+ return status;
+@@ -2787,8 +2788,9 @@ int be_cmd_get_cntl_attributes(struct be_adapter *adapter)
+
+ memset(&attribs_cmd, 0, sizeof(struct be_dma_mem));
+ attribs_cmd.size = sizeof(struct be_cmd_resp_cntl_attribs);
+- attribs_cmd.va = pci_alloc_consistent(adapter->pdev, attribs_cmd.size,
+- &attribs_cmd.dma);
++ attribs_cmd.va = dma_zalloc_coherent(&adapter->pdev->dev,
++ attribs_cmd.size,
++ &attribs_cmd.dma, GFP_ATOMIC);
+ if (!attribs_cmd.va) {
+ dev_err(&adapter->pdev->dev, "Memory allocation failure\n");
+ status = -ENOMEM;
+@@ -2815,8 +2817,8 @@ int be_cmd_get_cntl_attributes(struct be_adapter *adapter)
+ err:
+ mutex_unlock(&adapter->mbox_lock);
+ if (attribs_cmd.va)
+- pci_free_consistent(adapter->pdev, attribs_cmd.size,
+- attribs_cmd.va, attribs_cmd.dma);
++ dma_free_coherent(&adapter->pdev->dev, attribs_cmd.size,
++ attribs_cmd.va, attribs_cmd.dma);
+ return status;
+ }
+
+@@ -2954,9 +2956,10 @@ int be_cmd_get_mac_from_list(struct be_adapter *adapter, u8 *mac,
+
+ memset(&get_mac_list_cmd, 0, sizeof(struct be_dma_mem));
+ get_mac_list_cmd.size = sizeof(struct be_cmd_resp_get_mac_list);
+- get_mac_list_cmd.va = pci_alloc_consistent(adapter->pdev,
+- get_mac_list_cmd.size,
+- &get_mac_list_cmd.dma);
++ get_mac_list_cmd.va = dma_zalloc_coherent(&adapter->pdev->dev,
++ get_mac_list_cmd.size,
++ &get_mac_list_cmd.dma,
++ GFP_ATOMIC);
+
+ if (!get_mac_list_cmd.va) {
+ dev_err(&adapter->pdev->dev,
+@@ -3029,8 +3032,8 @@ int be_cmd_get_mac_from_list(struct be_adapter *adapter, u8 *mac,
+
+ out:
+ spin_unlock_bh(&adapter->mcc_lock);
+- pci_free_consistent(adapter->pdev, get_mac_list_cmd.size,
+- get_mac_list_cmd.va, get_mac_list_cmd.dma);
++ dma_free_coherent(&adapter->pdev->dev, get_mac_list_cmd.size,
++ get_mac_list_cmd.va, get_mac_list_cmd.dma);
+ return status;
+ }
+
+@@ -3083,8 +3086,8 @@ int be_cmd_set_mac_list(struct be_adapter *adapter, u8 *mac_array,
+
+ memset(&cmd, 0, sizeof(struct be_dma_mem));
+ cmd.size = sizeof(struct be_cmd_req_set_mac_list);
+- cmd.va = dma_alloc_coherent(&adapter->pdev->dev, cmd.size,
+- &cmd.dma, GFP_KERNEL);
++ cmd.va = dma_zalloc_coherent(&adapter->pdev->dev, cmd.size, &cmd.dma,
++ GFP_KERNEL);
+ if (!cmd.va)
+ return -ENOMEM;
+
+@@ -3255,7 +3258,8 @@ int be_cmd_get_acpi_wol_cap(struct be_adapter *adapter)
+
+ memset(&cmd, 0, sizeof(struct be_dma_mem));
+ cmd.size = sizeof(struct be_cmd_resp_acpi_wol_magic_config_v1);
+- cmd.va = pci_alloc_consistent(adapter->pdev, cmd.size, &cmd.dma);
++ cmd.va = dma_zalloc_coherent(&adapter->pdev->dev, cmd.size, &cmd.dma,
++ GFP_ATOMIC);
+ if (!cmd.va) {
+ dev_err(&adapter->pdev->dev, "Memory allocation failure\n");
+ status = -ENOMEM;
+@@ -3290,7 +3294,8 @@ int be_cmd_get_acpi_wol_cap(struct be_adapter *adapter)
+ err:
+ mutex_unlock(&adapter->mbox_lock);
+ if (cmd.va)
+- pci_free_consistent(adapter->pdev, cmd.size, cmd.va, cmd.dma);
++ dma_free_coherent(&adapter->pdev->dev, cmd.size, cmd.va,
++ cmd.dma);
+ return status;
+
+ }
+@@ -3304,8 +3309,9 @@ int be_cmd_set_fw_log_level(struct be_adapter *adapter, u32 level)
+
+ memset(&extfat_cmd, 0, sizeof(struct be_dma_mem));
+ extfat_cmd.size = sizeof(struct be_cmd_resp_get_ext_fat_caps);
+- extfat_cmd.va = pci_alloc_consistent(adapter->pdev, extfat_cmd.size,
+- &extfat_cmd.dma);
++ extfat_cmd.va = dma_zalloc_coherent(&adapter->pdev->dev,
++ extfat_cmd.size, &extfat_cmd.dma,
++ GFP_ATOMIC);
+ if (!extfat_cmd.va)
+ return -ENOMEM;
+
+@@ -3327,8 +3333,8 @@ int be_cmd_set_fw_log_level(struct be_adapter *adapter, u32 level)
+
+ status = be_cmd_set_ext_fat_capabilites(adapter, &extfat_cmd, cfgs);
+ err:
+- pci_free_consistent(adapter->pdev, extfat_cmd.size, extfat_cmd.va,
+- extfat_cmd.dma);
++ dma_free_coherent(&adapter->pdev->dev, extfat_cmd.size, extfat_cmd.va,
++ extfat_cmd.dma);
+ return status;
+ }
+
+@@ -3341,8 +3347,9 @@ int be_cmd_get_fw_log_level(struct be_adapter *adapter)
+
+ memset(&extfat_cmd, 0, sizeof(struct be_dma_mem));
+ extfat_cmd.size = sizeof(struct be_cmd_resp_get_ext_fat_caps);
+- extfat_cmd.va = pci_alloc_consistent(adapter->pdev, extfat_cmd.size,
+- &extfat_cmd.dma);
++ extfat_cmd.va = dma_zalloc_coherent(&adapter->pdev->dev,
++ extfat_cmd.size, &extfat_cmd.dma,
++ GFP_ATOMIC);
+
+ if (!extfat_cmd.va) {
+ dev_err(&adapter->pdev->dev, "%s: Memory allocation failure\n",
+@@ -3360,8 +3367,8 @@ int be_cmd_get_fw_log_level(struct be_adapter *adapter)
+ level = cfgs->module[0].trace_lvl[j].dbg_lvl;
+ }
+ }
+- pci_free_consistent(adapter->pdev, extfat_cmd.size, extfat_cmd.va,
+- extfat_cmd.dma);
++ dma_free_coherent(&adapter->pdev->dev, extfat_cmd.size, extfat_cmd.va,
++ extfat_cmd.dma);
+ err:
+ return level;
+ }
+@@ -3567,7 +3574,8 @@ int be_cmd_get_func_config(struct be_adapter *adapter, struct be_resources *res)
+
+ memset(&cmd, 0, sizeof(struct be_dma_mem));
+ cmd.size = sizeof(struct be_cmd_resp_get_func_config);
+- cmd.va = pci_alloc_consistent(adapter->pdev, cmd.size, &cmd.dma);
++ cmd.va = dma_zalloc_coherent(&adapter->pdev->dev, cmd.size, &cmd.dma,
++ GFP_ATOMIC);
+ if (!cmd.va) {
+ dev_err(&adapter->pdev->dev, "Memory alloc failure\n");
+ status = -ENOMEM;
+@@ -3607,7 +3615,8 @@ int be_cmd_get_func_config(struct be_adapter *adapter, struct be_resources *res)
+ err:
+ mutex_unlock(&adapter->mbox_lock);
+ if (cmd.va)
+- pci_free_consistent(adapter->pdev, cmd.size, cmd.va, cmd.dma);
++ dma_free_coherent(&adapter->pdev->dev, cmd.size, cmd.va,
++ cmd.dma);
+ return status;
+ }
+
+@@ -3628,7 +3637,8 @@ int be_cmd_get_profile_config(struct be_adapter *adapter,
+
+ memset(&cmd, 0, sizeof(struct be_dma_mem));
+ cmd.size = sizeof(struct be_cmd_resp_get_profile_config);
+- cmd.va = pci_alloc_consistent(adapter->pdev, cmd.size, &cmd.dma);
++ cmd.va = dma_zalloc_coherent(&adapter->pdev->dev, cmd.size, &cmd.dma,
++ GFP_ATOMIC);
+ if (!cmd.va)
+ return -ENOMEM;
+
+@@ -3667,7 +3677,8 @@ int be_cmd_get_profile_config(struct be_adapter *adapter,
+ res->vf_if_cap_flags = vf_res->cap_flags;
+ err:
+ if (cmd.va)
+- pci_free_consistent(adapter->pdev, cmd.size, cmd.va, cmd.dma);
++ dma_free_coherent(&adapter->pdev->dev, cmd.size, cmd.va,
++ cmd.dma);
+ return status;
+ }
+
+@@ -3682,7 +3693,8 @@ static int be_cmd_set_profile_config(struct be_adapter *adapter, void *desc,
+
+ memset(&cmd, 0, sizeof(struct be_dma_mem));
+ cmd.size = sizeof(struct be_cmd_req_set_profile_config);
+- cmd.va = pci_alloc_consistent(adapter->pdev, cmd.size, &cmd.dma);
++ cmd.va = dma_zalloc_coherent(&adapter->pdev->dev, cmd.size, &cmd.dma,
++ GFP_ATOMIC);
+ if (!cmd.va)
+ return -ENOMEM;
+
+@@ -3698,7 +3710,8 @@ static int be_cmd_set_profile_config(struct be_adapter *adapter, void *desc,
+ status = be_cmd_notify_wait(adapter, &wrb);
+
+ if (cmd.va)
+- pci_free_consistent(adapter->pdev, cmd.size, cmd.va, cmd.dma);
++ dma_free_coherent(&adapter->pdev->dev, cmd.size, cmd.va,
++ cmd.dma);
+ return status;
+ }
+
+diff --git a/drivers/net/ethernet/emulex/benet/be_ethtool.c b/drivers/net/ethernet/emulex/benet/be_ethtool.c
+index e42a791c1835..a11c5e05634b 100644
+--- a/drivers/net/ethernet/emulex/benet/be_ethtool.c
++++ b/drivers/net/ethernet/emulex/benet/be_ethtool.c
+@@ -266,8 +266,8 @@ static int lancer_cmd_read_file(struct be_adapter *adapter, u8 *file_name,
+ int status = 0;
+
+ read_cmd.size = LANCER_READ_FILE_CHUNK;
+- read_cmd.va = pci_alloc_consistent(adapter->pdev, read_cmd.size,
+- &read_cmd.dma);
++ read_cmd.va = dma_zalloc_coherent(&adapter->pdev->dev, read_cmd.size,
++ &read_cmd.dma, GFP_ATOMIC);
+
+ if (!read_cmd.va) {
+ dev_err(&adapter->pdev->dev,
+@@ -291,8 +291,8 @@ static int lancer_cmd_read_file(struct be_adapter *adapter, u8 *file_name,
+ break;
+ }
+ }
+- pci_free_consistent(adapter->pdev, read_cmd.size, read_cmd.va,
+- read_cmd.dma);
++ dma_free_coherent(&adapter->pdev->dev, read_cmd.size, read_cmd.va,
++ read_cmd.dma);
+
+ return status;
+ }
+@@ -818,8 +818,9 @@ static int be_test_ddr_dma(struct be_adapter *adapter)
+ };
+
+ ddrdma_cmd.size = sizeof(struct be_cmd_req_ddrdma_test);
+- ddrdma_cmd.va = dma_alloc_coherent(&adapter->pdev->dev, ddrdma_cmd.size,
+- &ddrdma_cmd.dma, GFP_KERNEL);
++ ddrdma_cmd.va = dma_zalloc_coherent(&adapter->pdev->dev,
++ ddrdma_cmd.size, &ddrdma_cmd.dma,
++ GFP_KERNEL);
+ if (!ddrdma_cmd.va)
+ return -ENOMEM;
+
+@@ -941,8 +942,9 @@ static int be_read_eeprom(struct net_device *netdev,
+
+ memset(&eeprom_cmd, 0, sizeof(struct be_dma_mem));
+ eeprom_cmd.size = sizeof(struct be_cmd_req_seeprom_read);
+- eeprom_cmd.va = dma_alloc_coherent(&adapter->pdev->dev, eeprom_cmd.size,
+- &eeprom_cmd.dma, GFP_KERNEL);
++ eeprom_cmd.va = dma_zalloc_coherent(&adapter->pdev->dev,
++ eeprom_cmd.size, &eeprom_cmd.dma,
++ GFP_KERNEL);
+
+ if (!eeprom_cmd.va)
+ return -ENOMEM;
+diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c
+index e51faf0ca989..fdd36794c536 100644
+--- a/drivers/net/ethernet/emulex/benet/be_main.c
++++ b/drivers/net/ethernet/emulex/benet/be_main.c
+@@ -4113,8 +4113,8 @@ static int lancer_fw_download(struct be_adapter *adapter,
+
+ flash_cmd.size = sizeof(struct lancer_cmd_req_write_object)
+ + LANCER_FW_DOWNLOAD_CHUNK;
+- flash_cmd.va = dma_alloc_coherent(dev, flash_cmd.size,
+- &flash_cmd.dma, GFP_KERNEL);
++ flash_cmd.va = dma_zalloc_coherent(dev, flash_cmd.size,
++ &flash_cmd.dma, GFP_KERNEL);
+ if (!flash_cmd.va)
+ return -ENOMEM;
+
+@@ -4209,8 +4209,8 @@ static int be_fw_download(struct be_adapter *adapter, const struct firmware* fw)
+ int status = 0, i = 0, num_imgs = 0, ufi_type = 0;
+
+ flash_cmd.size = sizeof(struct be_cmd_write_flashrom);
+- flash_cmd.va = dma_alloc_coherent(&adapter->pdev->dev, flash_cmd.size,
+- &flash_cmd.dma, GFP_KERNEL);
++ flash_cmd.va = dma_zalloc_coherent(&adapter->pdev->dev, flash_cmd.size,
++ &flash_cmd.dma, GFP_KERNEL);
+ if (!flash_cmd.va) {
+ status = -ENOMEM;
+ goto be_fw_exit;
+@@ -4587,10 +4587,10 @@ static int be_ctrl_init(struct be_adapter *adapter)
+ goto done;
+
+ mbox_mem_alloc->size = sizeof(struct be_mcc_mailbox) + 16;
+- mbox_mem_alloc->va = dma_alloc_coherent(&adapter->pdev->dev,
+- mbox_mem_alloc->size,
+- &mbox_mem_alloc->dma,
+- GFP_KERNEL);
++ mbox_mem_alloc->va = dma_zalloc_coherent(&adapter->pdev->dev,
++ mbox_mem_alloc->size,
++ &mbox_mem_alloc->dma,
++ GFP_KERNEL);
+ if (!mbox_mem_alloc->va) {
+ status = -ENOMEM;
+ goto unmap_pci_bars;
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c b/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c
+index d476918ef269..aa78f07d3d5e 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c
+@@ -211,26 +211,28 @@ static int alloc_4k(struct mlx5_core_dev *dev, u64 *addr)
+ return 0;
+ }
+
++#define MLX5_U64_4K_PAGE_MASK ((~(u64)0U) << PAGE_SHIFT)
++
+ static void free_4k(struct mlx5_core_dev *dev, u64 addr)
+ {
+ struct fw_page *fwp;
+ int n;
+
+- fwp = find_fw_page(dev, addr & PAGE_MASK);
++ fwp = find_fw_page(dev, addr & MLX5_U64_4K_PAGE_MASK);
+ if (!fwp) {
+ mlx5_core_warn(dev, "page not found\n");
+ return;
+ }
+
+- n = (addr & ~PAGE_MASK) >> MLX5_ADAPTER_PAGE_SHIFT;
++ n = (addr & ~MLX5_U64_4K_PAGE_MASK) >> MLX5_ADAPTER_PAGE_SHIFT;
+ fwp->free_count++;
+ set_bit(n, &fwp->bitmask);
+ if (fwp->free_count == MLX5_NUM_4K_IN_PAGE) {
+ rb_erase(&fwp->rb_node, &dev->priv.page_root);
+ if (fwp->free_count != 1)
+ list_del(&fwp->list);
+- dma_unmap_page(&dev->pdev->dev, addr & PAGE_MASK, PAGE_SIZE,
+- DMA_BIDIRECTIONAL);
++ dma_unmap_page(&dev->pdev->dev, addr & MLX5_U64_4K_PAGE_MASK,
++ PAGE_SIZE, DMA_BIDIRECTIONAL);
+ __free_page(fwp->page);
+ kfree(fwp);
+ } else if (fwp->free_count == 1) {
+diff --git a/drivers/net/phy/dp83640.c b/drivers/net/phy/dp83640.c
+index e22e602beef3..c5789cdf7778 100644
+--- a/drivers/net/phy/dp83640.c
++++ b/drivers/net/phy/dp83640.c
+@@ -47,7 +47,7 @@
+ #define PSF_TX 0x1000
+ #define EXT_EVENT 1
+ #define CAL_EVENT 7
+-#define CAL_TRIGGER 7
++#define CAL_TRIGGER 1
+ #define DP83640_N_PINS 12
+
+ #define MII_DP83640_MICR 0x11
+@@ -495,7 +495,9 @@ static int ptp_dp83640_enable(struct ptp_clock_info *ptp,
+ else
+ evnt |= EVNT_RISE;
+ }
++ mutex_lock(&clock->extreg_lock);
+ ext_write(0, phydev, PAGE5, PTP_EVNT, evnt);
++ mutex_unlock(&clock->extreg_lock);
+ return 0;
+
+ case PTP_CLK_REQ_PEROUT:
+@@ -531,6 +533,8 @@ static u8 status_frame_src[6] = { 0x08, 0x00, 0x17, 0x0B, 0x6B, 0x0F };
+
+ static void enable_status_frames(struct phy_device *phydev, bool on)
+ {
++ struct dp83640_private *dp83640 = phydev->priv;
++ struct dp83640_clock *clock = dp83640->clock;
+ u16 cfg0 = 0, ver;
+
+ if (on)
+@@ -538,9 +542,13 @@ static void enable_status_frames(struct phy_device *phydev, bool on)
+
+ ver = (PSF_PTPVER & VERSIONPTP_MASK) << VERSIONPTP_SHIFT;
+
++ mutex_lock(&clock->extreg_lock);
++
+ ext_write(0, phydev, PAGE5, PSF_CFG0, cfg0);
+ ext_write(0, phydev, PAGE6, PSF_CFG1, ver);
+
++ mutex_unlock(&clock->extreg_lock);
++
+ if (!phydev->attached_dev) {
+ pr_warn("expected to find an attached netdevice\n");
+ return;
+@@ -837,7 +845,7 @@ static void decode_rxts(struct dp83640_private *dp83640,
+ list_del_init(&rxts->list);
+ phy2rxts(phy_rxts, rxts);
+
+- spin_lock_irqsave(&dp83640->rx_queue.lock, flags);
++ spin_lock(&dp83640->rx_queue.lock);
+ skb_queue_walk(&dp83640->rx_queue, skb) {
+ struct dp83640_skb_info *skb_info;
+
+@@ -852,7 +860,7 @@ static void decode_rxts(struct dp83640_private *dp83640,
+ break;
+ }
+ }
+- spin_unlock_irqrestore(&dp83640->rx_queue.lock, flags);
++ spin_unlock(&dp83640->rx_queue.lock);
+
+ if (!shhwtstamps)
+ list_add_tail(&rxts->list, &dp83640->rxts);
+@@ -1172,11 +1180,18 @@ static int dp83640_config_init(struct phy_device *phydev)
+
+ if (clock->chosen && !list_empty(&clock->phylist))
+ recalibrate(clock);
+- else
++ else {
++ mutex_lock(&clock->extreg_lock);
+ enable_broadcast(phydev, clock->page, 1);
++ mutex_unlock(&clock->extreg_lock);
++ }
+
+ enable_status_frames(phydev, true);
++
++ mutex_lock(&clock->extreg_lock);
+ ext_write(0, phydev, PAGE4, PTP_CTL, PTP_ENABLE);
++ mutex_unlock(&clock->extreg_lock);
++
+ return 0;
+ }
+
+diff --git a/drivers/net/phy/phy.c b/drivers/net/phy/phy.c
+index dc1f6f07326a..91d6d03da963 100644
+--- a/drivers/net/phy/phy.c
++++ b/drivers/net/phy/phy.c
+@@ -1050,13 +1050,14 @@ int phy_init_eee(struct phy_device *phydev, bool clk_stop_enable)
+ {
+ /* According to 802.3az,the EEE is supported only in full duplex-mode.
+ * Also EEE feature is active when core is operating with MII, GMII
+- * or RGMII. Internal PHYs are also allowed to proceed and should
+- * return an error if they do not support EEE.
++ * or RGMII (all kinds). Internal PHYs are also allowed to proceed and
++ * should return an error if they do not support EEE.
+ */
+ if ((phydev->duplex == DUPLEX_FULL) &&
+ ((phydev->interface == PHY_INTERFACE_MODE_MII) ||
+ (phydev->interface == PHY_INTERFACE_MODE_GMII) ||
+- (phydev->interface == PHY_INTERFACE_MODE_RGMII) ||
++ (phydev->interface >= PHY_INTERFACE_MODE_RGMII &&
++ phydev->interface <= PHY_INTERFACE_MODE_RGMII_TXID) ||
+ phy_is_internal(phydev))) {
+ int eee_lp, eee_cap, eee_adv;
+ u32 lp, cap, adv;
+diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c
+index c3e4da9e79ca..8067b8fbb0ee 100644
+--- a/drivers/net/usb/cdc_ncm.c
++++ b/drivers/net/usb/cdc_ncm.c
+@@ -1182,7 +1182,7 @@ cdc_ncm_fill_tx_frame(struct usbnet *dev, struct sk_buff *skb, __le32 sign)
+ * payload data instead.
+ */
+ usbnet_set_skb_tx_stats(skb_out, n,
+- ctx->tx_curr_frame_payload - skb_out->len);
++ (long)ctx->tx_curr_frame_payload - skb_out->len);
+
+ return skb_out;
+
+diff --git a/drivers/net/xen-netback/xenbus.c b/drivers/net/xen-netback/xenbus.c
+index c047282c4ee0..d9d1e2af50d0 100644
+--- a/drivers/net/xen-netback/xenbus.c
++++ b/drivers/net/xen-netback/xenbus.c
+@@ -34,6 +34,8 @@ struct backend_info {
+ enum xenbus_state frontend_state;
+ struct xenbus_watch hotplug_status_watch;
+ u8 have_hotplug_status_watch:1;
++
++ const char *hotplug_script;
+ };
+
+ static int connect_rings(struct backend_info *be, struct xenvif_queue *queue);
+@@ -236,6 +238,7 @@ static int netback_remove(struct xenbus_device *dev)
+ xenvif_free(be->vif);
+ be->vif = NULL;
+ }
++ kfree(be->hotplug_script);
+ kfree(be);
+ dev_set_drvdata(&dev->dev, NULL);
+ return 0;
+@@ -253,6 +256,7 @@ static int netback_probe(struct xenbus_device *dev,
+ struct xenbus_transaction xbt;
+ int err;
+ int sg;
++ const char *script;
+ struct backend_info *be = kzalloc(sizeof(struct backend_info),
+ GFP_KERNEL);
+ if (!be) {
+@@ -345,6 +349,15 @@ static int netback_probe(struct xenbus_device *dev,
+ if (err)
+ pr_debug("Error writing multi-queue-max-queues\n");
+
++ script = xenbus_read(XBT_NIL, dev->nodename, "script", NULL);
++ if (IS_ERR(script)) {
++ err = PTR_ERR(script);
++ xenbus_dev_fatal(dev, err, "reading script");
++ goto fail;
++ }
++
++ be->hotplug_script = script;
++
+ err = xenbus_switch_state(dev, XenbusStateInitWait);
+ if (err)
+ goto fail;
+@@ -377,22 +390,14 @@ static int netback_uevent(struct xenbus_device *xdev,
+ struct kobj_uevent_env *env)
+ {
+ struct backend_info *be = dev_get_drvdata(&xdev->dev);
+- char *val;
+
+- val = xenbus_read(XBT_NIL, xdev->nodename, "script", NULL);
+- if (IS_ERR(val)) {
+- int err = PTR_ERR(val);
+- xenbus_dev_fatal(xdev, err, "reading script");
+- return err;
+- } else {
+- if (add_uevent_var(env, "script=%s", val)) {
+- kfree(val);
+- return -ENOMEM;
+- }
+- kfree(val);
+- }
++ if (!be)
++ return 0;
++
++ if (add_uevent_var(env, "script=%s", be->hotplug_script))
++ return -ENOMEM;
+
+- if (!be || !be->vif)
++ if (!be->vif)
+ return 0;
+
+ return add_uevent_var(env, "vif=%s", be->vif->dev->name);
+@@ -735,6 +740,7 @@ static void connect(struct backend_info *be)
+ goto err;
+ }
+
++ queue->credit_bytes = credit_bytes;
+ queue->remaining_credit = credit_bytes;
+ queue->credit_usec = credit_usec;
+
+diff --git a/drivers/of/base.c b/drivers/of/base.c
+index 3823edf2d012..4c2ccde42427 100644
+--- a/drivers/of/base.c
++++ b/drivers/of/base.c
+@@ -1250,6 +1250,39 @@ int of_property_read_u64(const struct device_node *np, const char *propname,
+ EXPORT_SYMBOL_GPL(of_property_read_u64);
+
+ /**
++ * of_property_read_u64_array - Find and read an array of 64 bit integers
++ * from a property.
++ *
++ * @np: device node from which the property value is to be read.
++ * @propname: name of the property to be searched.
++ * @out_values: pointer to return value, modified only if return value is 0.
++ * @sz: number of array elements to read
++ *
++ * Search for a property in a device node and read 64-bit value(s) from
++ * it. Returns 0 on success, -EINVAL if the property does not exist,
++ * -ENODATA if property does not have a value, and -EOVERFLOW if the
++ * property data isn't large enough.
++ *
++ * The out_values is modified only if a valid u64 value can be decoded.
++ */
++int of_property_read_u64_array(const struct device_node *np,
++ const char *propname, u64 *out_values,
++ size_t sz)
++{
++ const __be32 *val = of_find_property_value_of_size(np, propname,
++ (sz * sizeof(*out_values)));
++
++ if (IS_ERR(val))
++ return PTR_ERR(val);
++
++ while (sz--) {
++ *out_values++ = of_read_number(val, 2);
++ val += 2;
++ }
++ return 0;
++}
++
++/**
+ * of_property_read_string - Find and read a string from a property
+ * @np: device node from which the property value is to be read.
+ * @propname: name of the property to be searched.
+diff --git a/drivers/spi/spi-bitbang.c b/drivers/spi/spi-bitbang.c
+index dc7d2c2d643e..fecdda270c5d 100644
+--- a/drivers/spi/spi-bitbang.c
++++ b/drivers/spi/spi-bitbang.c
+@@ -184,7 +184,6 @@ int spi_bitbang_setup(struct spi_device *spi)
+ {
+ struct spi_bitbang_cs *cs = spi->controller_state;
+ struct spi_bitbang *bitbang;
+- int retval;
+ unsigned long flags;
+
+ bitbang = spi_master_get_devdata(spi->master);
+@@ -201,9 +200,11 @@ int spi_bitbang_setup(struct spi_device *spi)
+ if (!cs->txrx_word)
+ return -EINVAL;
+
+- retval = bitbang->setup_transfer(spi, NULL);
+- if (retval < 0)
+- return retval;
++ if (bitbang->setup_transfer) {
++ int retval = bitbang->setup_transfer(spi, NULL);
++ if (retval < 0)
++ return retval;
++ }
+
+ dev_dbg(&spi->dev, "%s, %u nsec/bit\n", __func__, 2 * cs->nsecs);
+
+@@ -299,9 +300,11 @@ static int spi_bitbang_transfer_one(struct spi_master *master,
+
+ /* init (-1) or override (1) transfer params */
+ if (do_setup != 0) {
+- status = bitbang->setup_transfer(spi, t);
+- if (status < 0)
+- break;
++ if (bitbang->setup_transfer) {
++ status = bitbang->setup_transfer(spi, t);
++ if (status < 0)
++ break;
++ }
+ if (do_setup == -1)
+ do_setup = 0;
+ }
+diff --git a/drivers/tty/serial/8250/8250_dw.c b/drivers/tty/serial/8250/8250_dw.c
+index a69e31e3410f..5c247d7943aa 100644
+--- a/drivers/tty/serial/8250/8250_dw.c
++++ b/drivers/tty/serial/8250/8250_dw.c
+@@ -316,10 +316,20 @@ static int dw8250_probe_of(struct uart_port *p,
+ static int dw8250_probe_acpi(struct uart_8250_port *up,
+ struct dw8250_data *data)
+ {
++ const struct acpi_device_id *id;
+ struct uart_port *p = &up->port;
+
+ dw8250_setup_port(up);
+
++ id = acpi_match_device(p->dev->driver->acpi_match_table, p->dev);
++ if (!id)
++ return -ENODEV;
++
++ if (!p->uartclk)
++ if (device_property_read_u32(p->dev, "clock-frequency",
++ &p->uartclk))
++ return -EINVAL;
++
+ p->iotype = UPIO_MEM32;
+ p->serial_in = dw8250_serial_in32;
+ p->serial_out = dw8250_serial_out32;
+@@ -542,6 +552,8 @@ static const struct acpi_device_id dw8250_acpi_match[] = {
+ { "INT3435", 0 },
+ { "80860F0A", 0 },
+ { "8086228A", 0 },
++ { "APMC0D08", 0},
++ { "AMD0020", 0 },
+ { },
+ };
+ MODULE_DEVICE_TABLE(acpi, dw8250_acpi_match);
+diff --git a/drivers/tty/serial/imx.c b/drivers/tty/serial/imx.c
+index 8f62a3cec23e..369e18d9ab48 100644
+--- a/drivers/tty/serial/imx.c
++++ b/drivers/tty/serial/imx.c
+@@ -590,13 +590,6 @@ static void imx_start_tx(struct uart_port *port)
+ temp &= ~(UCR1_RRDYEN);
+ writel(temp, sport->port.membase + UCR1);
+ }
+- /* Clear any pending ORE flag before enabling interrupt */
+- temp = readl(sport->port.membase + USR2);
+- writel(temp | USR2_ORE, sport->port.membase + USR2);
+-
+- temp = readl(sport->port.membase + UCR4);
+- temp |= UCR4_OREN;
+- writel(temp, sport->port.membase + UCR4);
+
+ if (!sport->dma_is_enabled) {
+ temp = readl(sport->port.membase + UCR1);
+@@ -771,7 +764,7 @@ static irqreturn_t imx_int(int irq, void *dev_id)
+ if (sts2 & USR2_ORE) {
+ dev_err(sport->port.dev, "Rx FIFO overrun\n");
+ sport->port.icount.overrun++;
+- writel(sts2 | USR2_ORE, sport->port.membase + USR2);
++ writel(USR2_ORE, sport->port.membase + USR2);
+ }
+
+ return IRQ_HANDLED;
+@@ -1141,10 +1134,12 @@ static int imx_startup(struct uart_port *port)
+ }
+
+ spin_lock_irqsave(&sport->port.lock, flags);
++
+ /*
+ * Finally, clear and enable interrupts
+ */
+ writel(USR1_RTSD, sport->port.membase + USR1);
++ writel(USR2_ORE, sport->port.membase + USR2);
+
+ temp = readl(sport->port.membase + UCR1);
+ temp |= UCR1_RRDYEN | UCR1_RTSDEN | UCR1_UARTEN;
+@@ -1156,6 +1151,10 @@ static int imx_startup(struct uart_port *port)
+
+ writel(temp, sport->port.membase + UCR1);
+
++ temp = readl(sport->port.membase + UCR4);
++ temp |= UCR4_OREN;
++ writel(temp, sport->port.membase + UCR4);
++
+ temp = readl(sport->port.membase + UCR2);
+ temp |= (UCR2_RXEN | UCR2_TXEN);
+ if (!sport->have_rtscts)
+diff --git a/drivers/usb/dwc2/hcd.c b/drivers/usb/dwc2/hcd.c
+index 0a0e6f0ad15f..e749631d6a97 100644
+--- a/drivers/usb/dwc2/hcd.c
++++ b/drivers/usb/dwc2/hcd.c
+@@ -1517,7 +1517,7 @@ static int dwc2_hcd_hub_control(struct dwc2_hsotg *hsotg, u16 typereq,
+ dev_dbg(hsotg->dev,
+ "ClearPortFeature USB_PORT_FEAT_SUSPEND\n");
+ writel(0, hsotg->regs + PCGCTL);
+- usleep_range(20000, 40000);
++ msleep(USB_RESUME_TIMEOUT);
+
+ hprt0 = dwc2_read_hprt0(hsotg);
+ hprt0 |= HPRT0_RES;
+diff --git a/firmware/ihex2fw.c b/firmware/ihex2fw.c
+index cf38e159131a..08d90e25abf0 100644
+--- a/firmware/ihex2fw.c
++++ b/firmware/ihex2fw.c
+@@ -86,6 +86,7 @@ int main(int argc, char **argv)
+ case 'j':
+ include_jump = 1;
+ break;
++ default:
+ return usage();
+ }
+ }
+diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
+index 3dd249787b11..e39fe28f1ea0 100644
+--- a/fs/binfmt_elf.c
++++ b/fs/binfmt_elf.c
+@@ -816,7 +816,7 @@ static int load_elf_binary(struct linux_binprm *bprm)
+ total_size = total_mapping_size(elf_phdata,
+ loc->elf_ex.e_phnum);
+ if (!total_size) {
+- error = -EINVAL;
++ retval = -EINVAL;
+ goto out_free_dentry;
+ }
+ }
+diff --git a/fs/efivarfs/super.c b/fs/efivarfs/super.c
+index 0a48886e069c..c2f421c30ccd 100644
+--- a/fs/efivarfs/super.c
++++ b/fs/efivarfs/super.c
+@@ -121,7 +121,7 @@ static int efivarfs_callback(efi_char16_t *name16, efi_guid_t vendor,
+ int len, i;
+ int err = -ENOMEM;
+
+- entry = kmalloc(sizeof(*entry), GFP_KERNEL);
++ entry = kzalloc(sizeof(*entry), GFP_KERNEL);
+ if (!entry)
+ return err;
+
+diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
+index bada5a1fb695..447486425b8c 100644
+--- a/fs/ext4/namei.c
++++ b/fs/ext4/namei.c
+@@ -3261,12 +3261,18 @@ static int ext4_rename(struct inode *old_dir, struct dentry *old_dentry,
+ EXT4_INDEX_EXTRA_TRANS_BLOCKS + 2);
+ if (!(flags & RENAME_WHITEOUT)) {
+ handle = ext4_journal_start(old.dir, EXT4_HT_DIR, credits);
+- if (IS_ERR(handle))
+- return PTR_ERR(handle);
++ if (IS_ERR(handle)) {
++ retval = PTR_ERR(handle);
++ handle = NULL;
++ goto end_rename;
++ }
+ } else {
+ whiteout = ext4_whiteout_for_rename(&old, credits, &handle);
+- if (IS_ERR(whiteout))
+- return PTR_ERR(whiteout);
++ if (IS_ERR(whiteout)) {
++ retval = PTR_ERR(whiteout);
++ whiteout = NULL;
++ goto end_rename;
++ }
+ }
+
+ if (IS_DIRSYNC(old.dir) || IS_DIRSYNC(new.dir))
+@@ -3430,8 +3436,11 @@ static int ext4_cross_rename(struct inode *old_dir, struct dentry *old_dentry,
+ handle = ext4_journal_start(old.dir, EXT4_HT_DIR,
+ (2 * EXT4_DATA_TRANS_BLOCKS(old.dir->i_sb) +
+ 2 * EXT4_INDEX_EXTRA_TRANS_BLOCKS + 2));
+- if (IS_ERR(handle))
+- return PTR_ERR(handle);
++ if (IS_ERR(handle)) {
++ retval = PTR_ERR(handle);
++ handle = NULL;
++ goto end_rename;
++ }
+
+ if (IS_DIRSYNC(old.dir) || IS_DIRSYNC(new.dir))
+ ext4_handle_sync(handle);
+diff --git a/fs/namespace.c b/fs/namespace.c
+index 8b60287a488b..a19d05c4ebe5 100644
+--- a/fs/namespace.c
++++ b/fs/namespace.c
+@@ -1490,7 +1490,7 @@ void __detach_mounts(struct dentry *dentry)
+
+ namespace_lock();
+ mp = lookup_mountpoint(dentry);
+- if (!mp)
++ if (IS_ERR_OR_NULL(mp))
+ goto out_unlock;
+
+ lock_mount_hash();
+diff --git a/include/acpi/acpi_bus.h b/include/acpi/acpi_bus.h
+index 8de31d472fad..20c757cdd391 100644
+--- a/include/acpi/acpi_bus.h
++++ b/include/acpi/acpi_bus.h
+@@ -338,6 +338,12 @@ struct acpi_device_physical_node {
+ bool put_online:1;
+ };
+
++/* ACPI Device Specific Data (_DSD) */
++struct acpi_device_data {
++ const union acpi_object *pointer;
++ const union acpi_object *properties;
++};
++
+ /* Device */
+ struct acpi_device {
+ int device_type;
+@@ -354,6 +360,7 @@ struct acpi_device {
+ struct acpi_device_wakeup wakeup;
+ struct acpi_device_perf performance;
+ struct acpi_device_dir dir;
++ struct acpi_device_data data;
+ struct acpi_scan_handler *handler;
+ struct acpi_hotplug_context *hp;
+ struct acpi_driver *driver;
+diff --git a/include/linux/acpi.h b/include/linux/acpi.h
+index 407a12f663eb..76d64d6a903a 100644
+--- a/include/linux/acpi.h
++++ b/include/linux/acpi.h
+@@ -28,6 +28,7 @@
+ #include <linux/errno.h>
+ #include <linux/ioport.h> /* for struct resource */
+ #include <linux/device.h>
++#include <linux/property.h>
+
+ #ifndef _LINUX
+ #define _LINUX
+@@ -659,4 +660,75 @@ do { \
+ #endif
+ #endif
+
++/* Device properties */
++
++#define MAX_ACPI_REFERENCE_ARGS 8
++struct acpi_reference_args {
++ struct acpi_device *adev;
++ size_t nargs;
++ u64 args[MAX_ACPI_REFERENCE_ARGS];
++};
++
++#ifdef CONFIG_ACPI
++int acpi_dev_get_property(struct acpi_device *adev, const char *name,
++ acpi_object_type type, const union acpi_object **obj);
++int acpi_dev_get_property_array(struct acpi_device *adev, const char *name,
++ acpi_object_type type,
++ const union acpi_object **obj);
++int acpi_dev_get_property_reference(struct acpi_device *adev, const char *name,
++ const char *cells_name, size_t index,
++ struct acpi_reference_args *args);
++
++int acpi_dev_prop_get(struct acpi_device *adev, const char *propname,
++ void **valptr);
++int acpi_dev_prop_read_single(struct acpi_device *adev, const char *propname,
++ enum dev_prop_type proptype, void *val);
++int acpi_dev_prop_read(struct acpi_device *adev, const char *propname,
++ enum dev_prop_type proptype, void *val, size_t nval);
++#else
++static inline int acpi_dev_get_property(struct acpi_device *adev,
++ const char *name, acpi_object_type type,
++ const union acpi_object **obj)
++{
++ return -ENXIO;
++}
++static inline int acpi_dev_get_property_array(struct acpi_device *adev,
++ const char *name,
++ acpi_object_type type,
++ const union acpi_object **obj)
++{
++ return -ENXIO;
++}
++static inline int acpi_dev_get_property_reference(struct acpi_device *adev,
++ const char *name, const char *cells_name,
++ size_t index, struct acpi_reference_args *args)
++{
++ return -ENXIO;
++}
++
++static inline int acpi_dev_prop_get(struct acpi_device *adev,
++ const char *propname,
++ void **valptr)
++{
++ return -ENXIO;
++}
++
++static inline int acpi_dev_prop_read_single(struct acpi_device *adev,
++ const char *propname,
++ enum dev_prop_type proptype,
++ void *val)
++{
++ return -ENXIO;
++}
++
++static inline int acpi_dev_prop_read(struct acpi_device *adev,
++ const char *propname,
++ enum dev_prop_type proptype,
++ void *val, size_t nval)
++{
++ return -ENXIO;
++}
++
++#endif
++
+ #endif /*_LINUX_ACPI_H*/
+diff --git a/include/linux/compiler.h b/include/linux/compiler.h
+index 33063f872ee3..000c5f90f08c 100644
+--- a/include/linux/compiler.h
++++ b/include/linux/compiler.h
+@@ -198,7 +198,7 @@ static __always_inline void data_access_exceeds_word_size(void)
+ {
+ }
+
+-static __always_inline void __read_once_size(volatile void *p, void *res, int size)
++static __always_inline void __read_once_size(const volatile void *p, void *res, int size)
+ {
+ switch (size) {
+ case 1: *(__u8 *)res = *(volatile __u8 *)p; break;
+@@ -255,10 +255,10 @@ static __always_inline void __write_once_size(volatile void *p, void *res, int s
+ */
+
+ #define READ_ONCE(x) \
+- ({ typeof(x) __val; __read_once_size(&x, &__val, sizeof(__val)); __val; })
++ ({ union { typeof(x) __val; char __c[1]; } __u; __read_once_size(&(x), __u.__c, sizeof(x)); __u.__val; })
+
+ #define WRITE_ONCE(x, val) \
+- ({ typeof(x) __val; __val = val; __write_once_size(&x, &__val, sizeof(__val)); __val; })
++ ({ typeof(x) __val = (val); __write_once_size(&(x), &__val, sizeof(__val)); __val; })
+
+ #endif /* __KERNEL__ */
+
+diff --git a/include/linux/jhash.h b/include/linux/jhash.h
+index 47cb09edec1a..348c6f47e4cc 100644
+--- a/include/linux/jhash.h
++++ b/include/linux/jhash.h
+@@ -145,11 +145,11 @@ static inline u32 jhash2(const u32 *k, u32 length, u32 initval)
+ }
+
+
+-/* jhash_3words - hash exactly 3, 2 or 1 word(s) */
+-static inline u32 jhash_3words(u32 a, u32 b, u32 c, u32 initval)
++/* __jhash_nwords - hash exactly 3, 2 or 1 word(s) */
++static inline u32 __jhash_nwords(u32 a, u32 b, u32 c, u32 initval)
+ {
+- a += JHASH_INITVAL;
+- b += JHASH_INITVAL;
++ a += initval;
++ b += initval;
+ c += initval;
+
+ __jhash_final(a, b, c);
+@@ -157,14 +157,19 @@ static inline u32 jhash_3words(u32 a, u32 b, u32 c, u32 initval)
+ return c;
+ }
+
++static inline u32 jhash_3words(u32 a, u32 b, u32 c, u32 initval)
++{
++ return __jhash_nwords(a, b, c, initval + JHASH_INITVAL + (3 << 2));
++}
++
+ static inline u32 jhash_2words(u32 a, u32 b, u32 initval)
+ {
+- return jhash_3words(a, b, 0, initval);
++ return __jhash_nwords(a, b, 0, initval + JHASH_INITVAL + (2 << 2));
+ }
+
+ static inline u32 jhash_1word(u32 a, u32 initval)
+ {
+- return jhash_3words(a, 0, 0, initval);
++ return __jhash_nwords(a, 0, 0, initval + JHASH_INITVAL + (1 << 2));
+ }
+
+ #endif /* _LINUX_JHASH_H */
+diff --git a/include/linux/kconfig.h b/include/linux/kconfig.h
+index be342b94c640..16cfb3448568 100644
+--- a/include/linux/kconfig.h
++++ b/include/linux/kconfig.h
+@@ -43,4 +43,13 @@
+ */
+ #define IS_MODULE(option) config_enabled(option##_MODULE)
+
++/*
++ * IS_REACHABLE(CONFIG_FOO) evaluates to 1 if the currently compiled
++ * code can call a function defined in code compiled based on CONFIG_FOO.
++ * This is similar to IS_ENABLED(), but returns false when invoked from
++ * built-in code when CONFIG_FOO is set to 'm'.
++ */
++#define IS_REACHABLE(option) (config_enabled(option) || \
++ (config_enabled(option##_MODULE) && config_enabled(MODULE)))
++
+ #endif /* __LINUX_KCONFIG_H */
+diff --git a/include/linux/of.h b/include/linux/of.h
+index 29f0adc5f3e4..ce9f6a2b3532 100644
+--- a/include/linux/of.h
++++ b/include/linux/of.h
+@@ -23,6 +23,7 @@
+ #include <linux/spinlock.h>
+ #include <linux/topology.h>
+ #include <linux/notifier.h>
++#include <linux/property.h>
+
+ #include <asm/byteorder.h>
+ #include <asm/errno.h>
+@@ -263,6 +264,10 @@ extern int of_property_read_u32_array(const struct device_node *np,
+ size_t sz);
+ extern int of_property_read_u64(const struct device_node *np,
+ const char *propname, u64 *out_value);
++extern int of_property_read_u64_array(const struct device_node *np,
++ const char *propname,
++ u64 *out_values,
++ size_t sz);
+
+ extern int of_property_read_string(struct device_node *np,
+ const char *propname,
+@@ -477,6 +482,13 @@ static inline int of_property_read_u32_array(const struct device_node *np,
+ return -ENOSYS;
+ }
+
++static inline int of_property_read_u64_array(const struct device_node *np,
++ const char *propname,
++ u64 *out_values, size_t sz)
++{
++ return -ENOSYS;
++}
++
+ static inline int of_property_read_string(struct device_node *np,
+ const char *propname,
+ const char **out_string)
+diff --git a/include/linux/property.h b/include/linux/property.h
+new file mode 100644
+index 000000000000..9242fb0221ba
+--- /dev/null
++++ b/include/linux/property.h
+@@ -0,0 +1,73 @@
++/*
++ * property.h - Unified device property interface.
++ *
++ * Copyright (C) 2014, Intel Corporation
++ * Authors: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
++ * Mika Westerberg <mika.westerberg@linux.intel.com>
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 as
++ * published by the Free Software Foundation.
++ */
++
++#ifndef _LINUX_PROPERTY_H_
++#define _LINUX_PROPERTY_H_
++
++#include <linux/types.h>
++
++struct device;
++
++enum dev_prop_type {
++ DEV_PROP_U8,
++ DEV_PROP_U16,
++ DEV_PROP_U32,
++ DEV_PROP_U64,
++ DEV_PROP_STRING,
++ DEV_PROP_MAX,
++};
++
++bool device_property_present(struct device *dev, const char *propname);
++int device_property_read_u8_array(struct device *dev, const char *propname,
++ u8 *val, size_t nval);
++int device_property_read_u16_array(struct device *dev, const char *propname,
++ u16 *val, size_t nval);
++int device_property_read_u32_array(struct device *dev, const char *propname,
++ u32 *val, size_t nval);
++int device_property_read_u64_array(struct device *dev, const char *propname,
++ u64 *val, size_t nval);
++int device_property_read_string_array(struct device *dev, const char *propname,
++ const char **val, size_t nval);
++int device_property_read_string(struct device *dev, const char *propname,
++ const char **val);
++
++static inline bool device_property_read_bool(struct device *dev,
++ const char *propname)
++{
++ return device_property_present(dev, propname);
++}
++
++static inline int device_property_read_u8(struct device *dev,
++ const char *propname, u8 *val)
++{
++ return device_property_read_u8_array(dev, propname, val, 1);
++}
++
++static inline int device_property_read_u16(struct device *dev,
++ const char *propname, u16 *val)
++{
++ return device_property_read_u16_array(dev, propname, val, 1);
++}
++
++static inline int device_property_read_u32(struct device *dev,
++ const char *propname, u32 *val)
++{
++ return device_property_read_u32_array(dev, propname, val, 1);
++}
++
++static inline int device_property_read_u64(struct device *dev,
++ const char *propname, u64 *val)
++{
++ return device_property_read_u64_array(dev, propname, val, 1);
++}
++
++#endif /* _LINUX_PROPERTY_H_ */
+diff --git a/include/net/inet_connection_sock.h b/include/net/inet_connection_sock.h
+index 848e85cb5c61..24d5c099d3ac 100644
+--- a/include/net/inet_connection_sock.h
++++ b/include/net/inet_connection_sock.h
+@@ -98,7 +98,8 @@ struct inet_connection_sock {
+ const struct tcp_congestion_ops *icsk_ca_ops;
+ const struct inet_connection_sock_af_ops *icsk_af_ops;
+ unsigned int (*icsk_sync_mss)(struct sock *sk, u32 pmtu);
+- __u8 icsk_ca_state;
++ __u8 icsk_ca_state:7,
++ icsk_ca_setsockopt:1;
+ __u8 icsk_retransmits;
+ __u8 icsk_pending;
+ __u8 icsk_backoff;
+diff --git a/include/net/sctp/sctp.h b/include/net/sctp/sctp.h
+index 856f01cb51dd..230775f5952a 100644
+--- a/include/net/sctp/sctp.h
++++ b/include/net/sctp/sctp.h
+@@ -571,11 +571,14 @@ static inline void sctp_v6_map_v4(union sctp_addr *addr)
+ /* Map v4 address to v4-mapped v6 address */
+ static inline void sctp_v4_map_v6(union sctp_addr *addr)
+ {
++ __be16 port;
++
++ port = addr->v4.sin_port;
++ addr->v6.sin6_addr.s6_addr32[3] = addr->v4.sin_addr.s_addr;
++ addr->v6.sin6_port = port;
+ addr->v6.sin6_family = AF_INET6;
+ addr->v6.sin6_flowinfo = 0;
+ addr->v6.sin6_scope_id = 0;
+- addr->v6.sin6_port = addr->v4.sin_port;
+- addr->v6.sin6_addr.s6_addr32[3] = addr->v4.sin_addr.s_addr;
+ addr->v6.sin6_addr.s6_addr32[0] = 0;
+ addr->v6.sin6_addr.s6_addr32[1] = 0;
+ addr->v6.sin6_addr.s6_addr32[2] = htonl(0x0000ffff);
+diff --git a/include/net/sock.h b/include/net/sock.h
+index c8146ed9e66a..4406dbe491f0 100644
+--- a/include/net/sock.h
++++ b/include/net/sock.h
+@@ -67,6 +67,7 @@
+ #include <linux/atomic.h>
+ #include <net/dst.h>
+ #include <net/checksum.h>
++#include <net/tcp_states.h>
+ #include <linux/net_tstamp.h>
+
+ struct cgroup;
+@@ -2267,6 +2268,14 @@ static inline struct sock *skb_steal_sock(struct sk_buff *skb)
+ return NULL;
+ }
+
++/* This helper checks if a socket is a full socket,
++ * ie _not_ a timewait or request socket.
++ */
++static inline bool sk_fullsock(const struct sock *sk)
++{
++ return (1 << sk->sk_state) & ~(TCPF_TIME_WAIT | TCPF_NEW_SYN_RECV);
++}
++
+ void sock_enable_timestamp(struct sock *sk, int flag);
+ int sock_get_timestamp(struct sock *, struct timeval __user *);
+ int sock_get_timestampns(struct sock *, struct timespec __user *);
+diff --git a/include/net/tcp_states.h b/include/net/tcp_states.h
+index b0b645988bd8..50e78a74d0df 100644
+--- a/include/net/tcp_states.h
++++ b/include/net/tcp_states.h
+@@ -25,6 +25,7 @@ enum {
+ TCP_LAST_ACK,
+ TCP_LISTEN,
+ TCP_CLOSING, /* Now a valid state */
++ TCP_NEW_SYN_RECV,
+
+ TCP_MAX_STATES /* Leave at the end! */
+ };
+@@ -44,7 +45,8 @@ enum {
+ TCPF_CLOSE_WAIT = (1 << 8),
+ TCPF_LAST_ACK = (1 << 9),
+ TCPF_LISTEN = (1 << 10),
+- TCPF_CLOSING = (1 << 11)
++ TCPF_CLOSING = (1 << 11),
++ TCPF_NEW_SYN_RECV = (1 << 12),
+ };
+
+ #endif /* _LINUX_TCP_STATES_H */
+diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
+index ef2b104b254c..2246a36050f9 100644
+--- a/kernel/sched/fair.c
++++ b/kernel/sched/fair.c
+@@ -1979,8 +1979,10 @@ void task_numa_work(struct callback_head *work)
+ vma = mm->mmap;
+ }
+ for (; vma; vma = vma->vm_next) {
+- if (!vma_migratable(vma) || !vma_policy_mof(vma))
++ if (!vma_migratable(vma) || !vma_policy_mof(vma) ||
++ is_vm_hugetlb_page(vma) || (vma->vm_flags & VM_MIXEDMAP)) {
+ continue;
++ }
+
+ /*
+ * Shared library pages mapped by multiple processes are not
+diff --git a/net/bridge/br_fdb.c b/net/bridge/br_fdb.c
+index 6f6c95cfe8f2..eab8862d9f88 100644
+--- a/net/bridge/br_fdb.c
++++ b/net/bridge/br_fdb.c
+@@ -789,9 +789,11 @@ static int __br_fdb_add(struct ndmsg *ndm, struct net_bridge_port *p,
+ int err = 0;
+
+ if (ndm->ndm_flags & NTF_USE) {
++ local_bh_disable();
+ rcu_read_lock();
+ br_fdb_update(p->br, p, addr, vid, true);
+ rcu_read_unlock();
++ local_bh_enable();
+ } else {
+ spin_lock_bh(&p->br->hash_lock);
+ err = fdb_add_entry(p, addr, ndm->ndm_state,
+diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
+index c465876c7861..b0aee78dba41 100644
+--- a/net/bridge/br_multicast.c
++++ b/net/bridge/br_multicast.c
+@@ -1071,7 +1071,7 @@ static int br_ip6_multicast_mld2_report(struct net_bridge *br,
+
+ err = br_ip6_multicast_add_group(br, port, &grec->grec_mca,
+ vid);
+- if (!err)
++ if (err)
+ break;
+ }
+
+@@ -1821,7 +1821,7 @@ static void br_multicast_query_expired(struct net_bridge *br,
+ if (query->startup_sent < br->multicast_startup_query_count)
+ query->startup_sent++;
+
+- RCU_INIT_POINTER(querier, NULL);
++ RCU_INIT_POINTER(querier->port, NULL);
+ br_multicast_send_query(br, NULL, query);
+ spin_unlock(&br->multicast_lock);
+ }
+diff --git a/net/caif/caif_socket.c b/net/caif/caif_socket.c
+index 765c78110fa8..5e10ee0efffb 100644
+--- a/net/caif/caif_socket.c
++++ b/net/caif/caif_socket.c
+@@ -330,6 +330,10 @@ static long caif_stream_data_wait(struct sock *sk, long timeo)
+ release_sock(sk);
+ timeo = schedule_timeout(timeo);
+ lock_sock(sk);
++
++ if (sock_flag(sk, SOCK_DEAD))
++ break;
++
+ clear_bit(SOCK_ASYNC_WAITDATA, &sk->sk_socket->flags);
+ }
+
+@@ -374,6 +378,10 @@ static int caif_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
+ struct sk_buff *skb;
+
+ lock_sock(sk);
++ if (sock_flag(sk, SOCK_DEAD)) {
++ err = -ECONNRESET;
++ goto unlock;
++ }
+ skb = skb_dequeue(&sk->sk_receive_queue);
+ caif_check_flow_release(sk);
+
+diff --git a/net/ceph/crush/mapper.c b/net/ceph/crush/mapper.c
+index a1ef53c04415..b1f2d1f44d37 100644
+--- a/net/ceph/crush/mapper.c
++++ b/net/ceph/crush/mapper.c
+@@ -290,6 +290,7 @@ static int is_out(const struct crush_map *map,
+ * @type: the type of item to choose
+ * @out: pointer to output vector
+ * @outpos: our position in that vector
++ * @out_size: size of the out vector
+ * @tries: number of attempts to make
+ * @recurse_tries: number of attempts to have recursive chooseleaf make
+ * @local_retries: localized retries
+@@ -304,6 +305,7 @@ static int crush_choose_firstn(const struct crush_map *map,
+ const __u32 *weight, int weight_max,
+ int x, int numrep, int type,
+ int *out, int outpos,
++ int out_size,
+ unsigned int tries,
+ unsigned int recurse_tries,
+ unsigned int local_retries,
+@@ -322,6 +324,7 @@ static int crush_choose_firstn(const struct crush_map *map,
+ int item = 0;
+ int itemtype;
+ int collide, reject;
++ int count = out_size;
+
+ dprintk("CHOOSE%s bucket %d x %d outpos %d numrep %d tries %d recurse_tries %d local_retries %d local_fallback_retries %d parent_r %d\n",
+ recurse_to_leaf ? "_LEAF" : "",
+@@ -329,7 +332,7 @@ static int crush_choose_firstn(const struct crush_map *map,
+ tries, recurse_tries, local_retries, local_fallback_retries,
+ parent_r);
+
+- for (rep = outpos; rep < numrep; rep++) {
++ for (rep = outpos; rep < numrep && count > 0 ; rep++) {
+ /* keep trying until we get a non-out, non-colliding item */
+ ftotal = 0;
+ skip_rep = 0;
+@@ -403,7 +406,7 @@ static int crush_choose_firstn(const struct crush_map *map,
+ map->buckets[-1-item],
+ weight, weight_max,
+ x, outpos+1, 0,
+- out2, outpos,
++ out2, outpos, count,
+ recurse_tries, 0,
+ local_retries,
+ local_fallback_retries,
+@@ -463,6 +466,7 @@ reject:
+ dprintk("CHOOSE got %d\n", item);
+ out[outpos] = item;
+ outpos++;
++ count--;
+ }
+
+ dprintk("CHOOSE returns %d\n", outpos);
+@@ -654,6 +658,7 @@ int crush_do_rule(const struct crush_map *map,
+ __u32 step;
+ int i, j;
+ int numrep;
++ int out_size;
+ /*
+ * the original choose_total_tries value was off by one (it
+ * counted "retries" and not "tries"). add one.
+@@ -761,6 +766,7 @@ int crush_do_rule(const struct crush_map *map,
+ x, numrep,
+ curstep->arg2,
+ o+osize, j,
++ result_max-osize,
+ choose_tries,
+ recurse_tries,
+ choose_local_retries,
+@@ -770,11 +776,13 @@ int crush_do_rule(const struct crush_map *map,
+ c+osize,
+ 0);
+ } else {
++ out_size = ((numrep < (result_max-osize)) ?
++ numrep : (result_max-osize));
+ crush_choose_indep(
+ map,
+ map->buckets[-1-w[i]],
+ weight, weight_max,
+- x, numrep, numrep,
++ x, out_size, numrep,
+ curstep->arg2,
+ o+osize, j,
+ choose_tries,
+@@ -783,7 +791,7 @@ int crush_do_rule(const struct crush_map *map,
+ recurse_to_leaf,
+ c+osize,
+ 0);
+- osize += numrep;
++ osize += out_size;
+ }
+ }
+
+diff --git a/net/core/dev.c b/net/core/dev.c
+index 5cdbc1bd9783..fb9625874b3c 100644
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -5080,7 +5080,7 @@ static int __netdev_upper_dev_link(struct net_device *dev,
+ if (__netdev_find_adj(upper_dev, dev, &upper_dev->all_adj_list.upper))
+ return -EBUSY;
+
+- if (__netdev_find_adj(dev, upper_dev, &dev->all_adj_list.upper))
++ if (__netdev_find_adj(dev, upper_dev, &dev->adj_list.upper))
+ return -EEXIST;
+
+ if (master && netdev_master_upper_dev_get(dev))
+diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
+index c522f7a00eab..24d3242f0e01 100644
+--- a/net/core/rtnetlink.c
++++ b/net/core/rtnetlink.c
+@@ -2229,6 +2229,9 @@ void rtmsg_ifinfo(int type, struct net_device *dev, unsigned int change,
+ int err = -ENOBUFS;
+ size_t if_info_size;
+
++ if (dev->reg_state != NETREG_REGISTERED)
++ return;
++
+ skb = nlmsg_new((if_info_size = if_nlmsg_size(dev, 0)), flags);
+ if (skb == NULL)
+ goto errout;
+diff --git a/net/ipv4/route.c b/net/ipv4/route.c
+index d58dd0ec3e53..b7ac498fed5f 100644
+--- a/net/ipv4/route.c
++++ b/net/ipv4/route.c
+@@ -903,6 +903,10 @@ static int ip_error(struct sk_buff *skb)
+ bool send;
+ int code;
+
++ /* IP on this device is disabled. */
++ if (!in_dev)
++ goto out;
++
+ net = dev_net(rt->dst.dev);
+ if (!IN_DEV_FORWARD(in_dev)) {
+ switch (rt->dst.error) {
+diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
+index 38c2bcb8dd5d..de6195485b31 100644
+--- a/net/ipv4/tcp.c
++++ b/net/ipv4/tcp.c
+@@ -2639,6 +2639,7 @@ void tcp_get_info(const struct sock *sk, struct tcp_info *info)
+ const struct tcp_sock *tp = tcp_sk(sk);
+ const struct inet_connection_sock *icsk = inet_csk(sk);
+ u32 now = tcp_time_stamp;
++ u32 rate;
+
+ memset(info, 0, sizeof(*info));
+
+@@ -2699,10 +2700,11 @@ void tcp_get_info(const struct sock *sk, struct tcp_info *info)
+
+ info->tcpi_total_retrans = tp->total_retrans;
+
+- info->tcpi_pacing_rate = sk->sk_pacing_rate != ~0U ?
+- sk->sk_pacing_rate : ~0ULL;
+- info->tcpi_max_pacing_rate = sk->sk_max_pacing_rate != ~0U ?
+- sk->sk_max_pacing_rate : ~0ULL;
++ rate = READ_ONCE(sk->sk_pacing_rate);
++ info->tcpi_pacing_rate = rate != ~0U ? rate : ~0ULL;
++
++ rate = READ_ONCE(sk->sk_max_pacing_rate);
++ info->tcpi_max_pacing_rate = rate != ~0U ? rate : ~0ULL;
+ }
+ EXPORT_SYMBOL_GPL(tcp_get_info);
+
+diff --git a/net/ipv4/tcp_cong.c b/net/ipv4/tcp_cong.c
+index b1c5970d47a1..b3316c8279a0 100644
+--- a/net/ipv4/tcp_cong.c
++++ b/net/ipv4/tcp_cong.c
+@@ -248,9 +248,10 @@ int tcp_set_congestion_control(struct sock *sk, const char *name)
+ ca = tcp_ca_find(name);
+
+ /* no change asking for existing value */
+- if (ca == icsk->icsk_ca_ops)
++ if (ca == icsk->icsk_ca_ops) {
++ icsk->icsk_ca_setsockopt = 1;
+ goto out;
+-
++ }
+ #ifdef CONFIG_MODULES
+ /* not found attempt to autoload module */
+ if (!ca && capable(CAP_NET_ADMIN)) {
+@@ -273,6 +274,7 @@ int tcp_set_congestion_control(struct sock *sk, const char *name)
+ else {
+ tcp_cleanup_congestion_control(sk);
+ icsk->icsk_ca_ops = ca;
++ icsk->icsk_ca_setsockopt = 1;
+
+ if (sk->sk_state != TCP_CLOSE && icsk->icsk_ca_ops->init)
+ icsk->icsk_ca_ops->init(sk);
+diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c
+index 63d2680b65db..2f6667116e85 100644
+--- a/net/ipv4/tcp_minisocks.c
++++ b/net/ipv4/tcp_minisocks.c
+@@ -297,7 +297,7 @@ void tcp_time_wait(struct sock *sk, int state, int timeo)
+ tw->tw_v6_daddr = sk->sk_v6_daddr;
+ tw->tw_v6_rcv_saddr = sk->sk_v6_rcv_saddr;
+ tw->tw_tclass = np->tclass;
+- tw->tw_flowlabel = np->flow_label >> 12;
++ tw->tw_flowlabel = be32_to_cpu(np->flow_label & IPV6_FLOWLABEL_MASK);
+ tw->tw_ipv6only = sk->sk_ipv6only;
+ }
+ #endif
+@@ -451,7 +451,8 @@ struct sock *tcp_create_openreq_child(struct sock *sk, struct request_sock *req,
+ newtp->snd_cwnd = TCP_INIT_CWND;
+ newtp->snd_cwnd_cnt = 0;
+
+- if (!try_module_get(newicsk->icsk_ca_ops->owner))
++ if (!newicsk->icsk_ca_setsockopt ||
++ !try_module_get(newicsk->icsk_ca_ops->owner))
+ tcp_assign_congestion_control(newsk);
+
+ tcp_set_ca_state(newsk, TCP_CA_Open);
+diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
+index cd0db5471bb5..c5e3194fd9a5 100644
+--- a/net/ipv4/udp.c
++++ b/net/ipv4/udp.c
+@@ -90,6 +90,7 @@
+ #include <linux/socket.h>
+ #include <linux/sockios.h>
+ #include <linux/igmp.h>
++#include <linux/inetdevice.h>
+ #include <linux/in.h>
+ #include <linux/errno.h>
+ #include <linux/timer.h>
+@@ -1336,10 +1337,8 @@ csum_copy_err:
+ }
+ unlock_sock_fast(sk, slow);
+
+- if (noblock)
+- return -EAGAIN;
+-
+- /* starting over for a new packet */
++ /* starting over for a new packet, but check if we need to yield */
++ cond_resched();
+ msg->msg_flags &= ~MSG_TRUNC;
+ goto try_again;
+ }
+@@ -1950,6 +1949,7 @@ void udp_v4_early_demux(struct sk_buff *skb)
+ struct sock *sk;
+ struct dst_entry *dst;
+ int dif = skb->dev->ifindex;
++ int ours;
+
+ /* validate the packet */
+ if (!pskb_may_pull(skb, skb_transport_offset(skb) + sizeof(struct udphdr)))
+@@ -1959,14 +1959,24 @@ void udp_v4_early_demux(struct sk_buff *skb)
+ uh = udp_hdr(skb);
+
+ if (skb->pkt_type == PACKET_BROADCAST ||
+- skb->pkt_type == PACKET_MULTICAST)
++ skb->pkt_type == PACKET_MULTICAST) {
++ struct in_device *in_dev = __in_dev_get_rcu(skb->dev);
++
++ if (!in_dev)
++ return;
++
++ ours = ip_check_mc_rcu(in_dev, iph->daddr, iph->saddr,
++ iph->protocol);
++ if (!ours)
++ return;
+ sk = __udp4_lib_mcast_demux_lookup(net, uh->dest, iph->daddr,
+ uh->source, iph->saddr, dif);
+- else if (skb->pkt_type == PACKET_HOST)
++ } else if (skb->pkt_type == PACKET_HOST) {
+ sk = __udp4_lib_demux_lookup(net, uh->dest, iph->daddr,
+ uh->source, iph->saddr, dif);
+- else
++ } else {
+ return;
++ }
+
+ if (!sk)
+ return;
+diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c
+index bcda14de7f84..2459b7b0f705 100644
+--- a/net/ipv6/ip6_vti.c
++++ b/net/ipv6/ip6_vti.c
+@@ -271,8 +271,7 @@ static struct ip6_tnl *vti6_locate(struct net *net, struct __ip6_tnl_parm *p,
+ static void vti6_dev_uninit(struct net_device *dev)
+ {
+ struct ip6_tnl *t = netdev_priv(dev);
+- struct net *net = dev_net(dev);
+- struct vti6_net *ip6n = net_generic(net, vti6_net_id);
++ struct vti6_net *ip6n = net_generic(t->net, vti6_net_id);
+
+ if (dev == ip6n->fb_tnl_dev)
+ RCU_INIT_POINTER(ip6n->tnls_wc[0], NULL);
+diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
+index 79fe58510ee8..a3f9f11abf4c 100644
+--- a/net/ipv6/tcp_ipv6.c
++++ b/net/ipv6/tcp_ipv6.c
+@@ -975,7 +975,7 @@ static void tcp_v6_timewait_ack(struct sock *sk, struct sk_buff *skb)
+ tcptw->tw_rcv_wnd >> tw->tw_rcv_wscale,
+ tcp_time_stamp + tcptw->tw_ts_offset,
+ tcptw->tw_ts_recent, tw->tw_bound_dev_if, tcp_twsk_md5_key(tcptw),
+- tw->tw_tclass, (tw->tw_flowlabel << 12));
++ tw->tw_tclass, cpu_to_be32(tw->tw_flowlabel));
+
+ inet_twsk_put(tw);
+ }
+diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
+index f6ba535b6feb..dd530f0e5a8a 100644
+--- a/net/ipv6/udp.c
++++ b/net/ipv6/udp.c
+@@ -514,10 +514,8 @@ csum_copy_err:
+ }
+ unlock_sock_fast(sk, slow);
+
+- if (noblock)
+- return -EAGAIN;
+-
+- /* starting over for a new packet */
++ /* starting over for a new packet, but check if we need to yield */
++ cond_resched();
+ msg->msg_flags &= ~MSG_TRUNC;
+ goto try_again;
+ }
+@@ -721,7 +719,9 @@ static bool __udp_v6_is_mcast_sock(struct net *net, struct sock *sk,
+ (inet->inet_dport && inet->inet_dport != rmt_port) ||
+ (!ipv6_addr_any(&sk->sk_v6_daddr) &&
+ !ipv6_addr_equal(&sk->sk_v6_daddr, rmt_addr)) ||
+- (sk->sk_bound_dev_if && sk->sk_bound_dev_if != dif))
++ (sk->sk_bound_dev_if && sk->sk_bound_dev_if != dif) ||
++ (!ipv6_addr_any(&sk->sk_v6_rcv_saddr) &&
++ !ipv6_addr_equal(&sk->sk_v6_rcv_saddr, loc_addr)))
+ return false;
+ if (!inet6_mc_check(sk, loc_addr, rmt_addr))
+ return false;
+diff --git a/net/netfilter/xt_cgroup.c b/net/netfilter/xt_cgroup.c
+index 7198d660b4de..a1d126f29463 100644
+--- a/net/netfilter/xt_cgroup.c
++++ b/net/netfilter/xt_cgroup.c
+@@ -39,7 +39,7 @@ cgroup_mt(const struct sk_buff *skb, struct xt_action_param *par)
+ {
+ const struct xt_cgroup_info *info = par->matchinfo;
+
+- if (skb->sk == NULL)
++ if (skb->sk == NULL || !sk_fullsock(skb->sk))
+ return false;
+
+ return (info->id == skb->sk->sk_classid) ^ info->invert;
+diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c
+index aad6a679fb13..fae88709aaa2 100644
+--- a/net/sched/cls_api.c
++++ b/net/sched/cls_api.c
+@@ -81,6 +81,11 @@ int unregister_tcf_proto_ops(struct tcf_proto_ops *ops)
+ struct tcf_proto_ops *t;
+ int rc = -ENOENT;
+
++ /* Wait for outstanding call_rcu()s, if any, from a
++ * tcf_proto_ops's destroy() handler.
++ */
++ rcu_barrier();
++
+ write_lock(&cls_mod_lock);
+ list_for_each_entry(t, &tcf_proto_base, head) {
+ if (t == ops) {
+diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c
+index 76f402e05bd6..a25fae3c8ad6 100644
+--- a/net/sched/sch_api.c
++++ b/net/sched/sch_api.c
+@@ -815,10 +815,8 @@ static int qdisc_graft(struct net_device *dev, struct Qdisc *parent,
+ if (dev->flags & IFF_UP)
+ dev_deactivate(dev);
+
+- if (new && new->ops->attach) {
+- new->ops->attach(new);
+- num_q = 0;
+- }
++ if (new && new->ops->attach)
++ goto skip;
+
+ for (i = 0; i < num_q; i++) {
+ struct netdev_queue *dev_queue = dev_ingress_queue(dev);
+@@ -834,12 +832,16 @@ static int qdisc_graft(struct net_device *dev, struct Qdisc *parent,
+ qdisc_destroy(old);
+ }
+
++skip:
+ if (!ingress) {
+ notify_and_destroy(net, skb, n, classid,
+ dev->qdisc, new);
+ if (new && !new->ops->attach)
+ atomic_inc(&new->refcnt);
+ dev->qdisc = new ? : &noop_qdisc;
++
++ if (new && new->ops->attach)
++ new->ops->attach(new);
+ } else {
+ notify_and_destroy(net, skb, n, classid, old, new);
+ }
+diff --git a/net/sunrpc/xprtrdma/verbs.c b/net/sunrpc/xprtrdma/verbs.c
+index 61c41298b4ea..6e5d5034b0f8 100644
+--- a/net/sunrpc/xprtrdma/verbs.c
++++ b/net/sunrpc/xprtrdma/verbs.c
+@@ -511,8 +511,8 @@ int
+ rpcrdma_ia_open(struct rpcrdma_xprt *xprt, struct sockaddr *addr, int memreg)
+ {
+ int rc, mem_priv;
+- struct ib_device_attr devattr;
+ struct rpcrdma_ia *ia = &xprt->rx_ia;
++ struct ib_device_attr *devattr = &ia->ri_devattr;
+
+ ia->ri_id = rpcrdma_create_id(xprt, ia, addr);
+ if (IS_ERR(ia->ri_id)) {
+@@ -528,28 +528,24 @@ rpcrdma_ia_open(struct rpcrdma_xprt *xprt, struct sockaddr *addr, int memreg)
+ goto out2;
+ }
+
+- /*
+- * Query the device to determine if the requested memory
+- * registration strategy is supported. If it isn't, set the
+- * strategy to a globally supported model.
+- */
+- rc = ib_query_device(ia->ri_id->device, &devattr);
++ rc = ib_query_device(ia->ri_id->device, devattr);
+ if (rc) {
+ dprintk("RPC: %s: ib_query_device failed %d\n",
+ __func__, rc);
+ goto out2;
+ }
+
+- if (devattr.device_cap_flags & IB_DEVICE_LOCAL_DMA_LKEY) {
++ if (devattr->device_cap_flags & IB_DEVICE_LOCAL_DMA_LKEY) {
+ ia->ri_have_dma_lkey = 1;
+ ia->ri_dma_lkey = ia->ri_id->device->local_dma_lkey;
+ }
+
+ if (memreg == RPCRDMA_FRMR) {
+ /* Requires both frmr reg and local dma lkey */
+- if ((devattr.device_cap_flags &
++ if (((devattr->device_cap_flags &
+ (IB_DEVICE_MEM_MGT_EXTENSIONS|IB_DEVICE_LOCAL_DMA_LKEY)) !=
+- (IB_DEVICE_MEM_MGT_EXTENSIONS|IB_DEVICE_LOCAL_DMA_LKEY)) {
++ (IB_DEVICE_MEM_MGT_EXTENSIONS|IB_DEVICE_LOCAL_DMA_LKEY)) ||
++ (devattr->max_fast_reg_page_list_len == 0)) {
+ dprintk("RPC: %s: FRMR registration "
+ "not supported by HCA\n", __func__);
+ memreg = RPCRDMA_MTHCAFMR;
+@@ -557,7 +553,7 @@ rpcrdma_ia_open(struct rpcrdma_xprt *xprt, struct sockaddr *addr, int memreg)
+ /* Mind the ia limit on FRMR page list depth */
+ ia->ri_max_frmr_depth = min_t(unsigned int,
+ RPCRDMA_MAX_DATA_SEGS,
+- devattr.max_fast_reg_page_list_len);
++ devattr->max_fast_reg_page_list_len);
+ }
+ }
+ if (memreg == RPCRDMA_MTHCAFMR) {
+@@ -655,20 +651,13 @@ int
+ rpcrdma_ep_create(struct rpcrdma_ep *ep, struct rpcrdma_ia *ia,
+ struct rpcrdma_create_data_internal *cdata)
+ {
+- struct ib_device_attr devattr;
++ struct ib_device_attr *devattr = &ia->ri_devattr;
+ struct ib_cq *sendcq, *recvcq;
+ int rc, err;
+
+- rc = ib_query_device(ia->ri_id->device, &devattr);
+- if (rc) {
+- dprintk("RPC: %s: ib_query_device failed %d\n",
+- __func__, rc);
+- return rc;
+- }
+-
+ /* check provider's send/recv wr limits */
+- if (cdata->max_requests > devattr.max_qp_wr)
+- cdata->max_requests = devattr.max_qp_wr;
++ if (cdata->max_requests > devattr->max_qp_wr)
++ cdata->max_requests = devattr->max_qp_wr;
+
+ ep->rep_attr.event_handler = rpcrdma_qp_async_error_upcall;
+ ep->rep_attr.qp_context = ep;
+@@ -703,8 +692,8 @@ rpcrdma_ep_create(struct rpcrdma_ep *ep, struct rpcrdma_ia *ia,
+
+ }
+ ep->rep_attr.cap.max_send_wr *= depth;
+- if (ep->rep_attr.cap.max_send_wr > devattr.max_qp_wr) {
+- cdata->max_requests = devattr.max_qp_wr / depth;
++ if (ep->rep_attr.cap.max_send_wr > devattr->max_qp_wr) {
++ cdata->max_requests = devattr->max_qp_wr / depth;
+ if (!cdata->max_requests)
+ return -EINVAL;
+ ep->rep_attr.cap.max_send_wr = cdata->max_requests *
+@@ -786,10 +775,11 @@ rpcrdma_ep_create(struct rpcrdma_ep *ep, struct rpcrdma_ia *ia,
+
+ /* Client offers RDMA Read but does not initiate */
+ ep->rep_remote_cma.initiator_depth = 0;
+- if (devattr.max_qp_rd_atom > 32) /* arbitrary but <= 255 */
++ if (devattr->max_qp_rd_atom > 32) /* arbitrary but <= 255 */
+ ep->rep_remote_cma.responder_resources = 32;
+ else
+- ep->rep_remote_cma.responder_resources = devattr.max_qp_rd_atom;
++ ep->rep_remote_cma.responder_resources =
++ devattr->max_qp_rd_atom;
+
+ ep->rep_remote_cma.retry_count = 7;
+ ep->rep_remote_cma.flow_control = 0;
+diff --git a/net/sunrpc/xprtrdma/xprt_rdma.h b/net/sunrpc/xprtrdma/xprt_rdma.h
+index ac7fc9a31342..11f0e06f6623 100644
+--- a/net/sunrpc/xprtrdma/xprt_rdma.h
++++ b/net/sunrpc/xprtrdma/xprt_rdma.h
+@@ -70,6 +70,7 @@ struct rpcrdma_ia {
+ int ri_async_rc;
+ enum rpcrdma_memreg ri_memreg_strategy;
+ unsigned int ri_max_frmr_depth;
++ struct ib_device_attr ri_devattr;
+ };
+
+ /*
+diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
+index e96884380732..8232118b3f82 100644
+--- a/net/unix/af_unix.c
++++ b/net/unix/af_unix.c
+@@ -1899,6 +1899,10 @@ static long unix_stream_data_wait(struct sock *sk, long timeo,
+ unix_state_unlock(sk);
+ timeo = freezable_schedule_timeout(timeo);
+ unix_state_lock(sk);
++
++ if (sock_flag(sk, SOCK_DEAD))
++ break;
++
+ clear_bit(SOCK_ASYNC_WAITDATA, &sk->sk_socket->flags);
+ }
+
+@@ -1963,6 +1967,10 @@ static int unix_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
+ struct sk_buff *skb, *last;
+
+ unix_state_lock(sk);
++ if (sock_flag(sk, SOCK_DEAD)) {
++ err = -ECONNRESET;
++ goto unlock;
++ }
+ last = skb = skb_peek(&sk->sk_receive_queue);
+ again:
+ if (skb == NULL) {
+diff --git a/security/selinux/nlmsgtab.c b/security/selinux/nlmsgtab.c
+index 2df7b900e259..902b5e9cec7e 100644
+--- a/security/selinux/nlmsgtab.c
++++ b/security/selinux/nlmsgtab.c
+@@ -100,6 +100,13 @@ static struct nlmsg_perm nlmsg_xfrm_perms[] =
+ { XFRM_MSG_FLUSHPOLICY, NETLINK_XFRM_SOCKET__NLMSG_WRITE },
+ { XFRM_MSG_NEWAE, NETLINK_XFRM_SOCKET__NLMSG_WRITE },
+ { XFRM_MSG_GETAE, NETLINK_XFRM_SOCKET__NLMSG_READ },
++ { XFRM_MSG_REPORT, NETLINK_XFRM_SOCKET__NLMSG_READ },
++ { XFRM_MSG_MIGRATE, NETLINK_XFRM_SOCKET__NLMSG_WRITE },
++ { XFRM_MSG_NEWSADINFO, NETLINK_XFRM_SOCKET__NLMSG_READ },
++ { XFRM_MSG_GETSADINFO, NETLINK_XFRM_SOCKET__NLMSG_READ },
++ { XFRM_MSG_NEWSPDINFO, NETLINK_XFRM_SOCKET__NLMSG_WRITE },
++ { XFRM_MSG_GETSPDINFO, NETLINK_XFRM_SOCKET__NLMSG_READ },
++ { XFRM_MSG_MAPPING, NETLINK_XFRM_SOCKET__NLMSG_READ },
+ };
+
+ static struct nlmsg_perm nlmsg_audit_perms[] =
+diff --git a/tools/vm/Makefile b/tools/vm/Makefile
+index c604f3ec628a..3d907dacf2ac 100644
+--- a/tools/vm/Makefile
++++ b/tools/vm/Makefile
+@@ -3,7 +3,7 @@
+ TARGETS=page-types slabinfo
+
+ LIB_DIR = ../lib/api
+-LIBS = $(LIB_DIR)/libapi.a
++LIBS = $(LIB_DIR)/libapikfs.a
+
+ CC = $(CROSS_COMPILE)gcc
+ CFLAGS = -Wall -Wextra -I../lib/
diff --git a/1017_linux-3.18.18.patch b/1017_linux-3.18.18.patch
new file mode 100644
index 0000000..c4ae5d6
--- /dev/null
+++ b/1017_linux-3.18.18.patch
@@ -0,0 +1,7034 @@
+diff --git a/Documentation/devicetree/bindings/net/marvell-armada-370-neta.txt b/Documentation/devicetree/bindings/net/marvell-armada-370-neta.txt
+index 750d577e8083..f5a8ca29aff0 100644
+--- a/Documentation/devicetree/bindings/net/marvell-armada-370-neta.txt
++++ b/Documentation/devicetree/bindings/net/marvell-armada-370-neta.txt
+@@ -1,7 +1,7 @@
+ * Marvell Armada 370 / Armada XP Ethernet Controller (NETA)
+
+ Required properties:
+-- compatible: should be "marvell,armada-370-neta".
++- compatible: "marvell,armada-370-neta" or "marvell,armada-xp-neta".
+ - reg: address and length of the register set for the device.
+ - interrupts: interrupt for the device
+ - phy: See ethernet.txt file in the same directory.
+diff --git a/Documentation/devicetree/bindings/pinctrl/marvell,armada-370-pinctrl.txt b/Documentation/devicetree/bindings/pinctrl/marvell,armada-370-pinctrl.txt
+index adda2a8d1d52..e357b020861d 100644
+--- a/Documentation/devicetree/bindings/pinctrl/marvell,armada-370-pinctrl.txt
++++ b/Documentation/devicetree/bindings/pinctrl/marvell,armada-370-pinctrl.txt
+@@ -92,5 +92,5 @@ mpp61 61 gpo, dev(wen1), uart1(txd), audio(rclk)
+ mpp62 62 gpio, dev(a2), uart1(cts), tdm(drx), pcie(clkreq0),
+ audio(mclk), uart0(cts)
+ mpp63 63 gpo, spi0(sck), tclk
+-mpp64 64 gpio, spi0(miso), spi0-1(cs1)
+-mpp65 65 gpio, spi0(mosi), spi0-1(cs2)
++mpp64 64 gpio, spi0(miso), spi0(cs1)
++mpp65 65 gpio, spi0(mosi), spi0(cs2)
+diff --git a/Documentation/devicetree/bindings/pinctrl/marvell,armada-375-pinctrl.txt b/Documentation/devicetree/bindings/pinctrl/marvell,armada-375-pinctrl.txt
+index 7de0cda4a379..bedbe42c8c0a 100644
+--- a/Documentation/devicetree/bindings/pinctrl/marvell,armada-375-pinctrl.txt
++++ b/Documentation/devicetree/bindings/pinctrl/marvell,armada-375-pinctrl.txt
+@@ -22,8 +22,8 @@ mpp5 5 gpio, dev(ad7), spi0(cs2), spi1(cs2)
+ mpp6 6 gpio, dev(ad0), led(p1), audio(rclk)
+ mpp7 7 gpio, dev(ad1), ptp(clk), led(p2), audio(extclk)
+ mpp8 8 gpio, dev (bootcs), spi0(cs0), spi1(cs0)
+-mpp9 9 gpio, nf(wen), spi0(sck), spi1(sck)
+-mpp10 10 gpio, nf(ren), dram(vttctrl), led(c1)
++mpp9 9 gpio, spi0(sck), spi1(sck), nand(we)
++mpp10 10 gpio, dram(vttctrl), led(c1), nand(re)
+ mpp11 11 gpio, dev(a0), led(c2), audio(sdo)
+ mpp12 12 gpio, dev(a1), audio(bclk)
+ mpp13 13 gpio, dev(readyn), pcie0(rstoutn), pcie1(rstoutn)
+diff --git a/Documentation/devicetree/bindings/pinctrl/marvell,armada-38x-pinctrl.txt b/Documentation/devicetree/bindings/pinctrl/marvell,armada-38x-pinctrl.txt
+index b17c96849fc9..4ac138aaaf87 100644
+--- a/Documentation/devicetree/bindings/pinctrl/marvell,armada-38x-pinctrl.txt
++++ b/Documentation/devicetree/bindings/pinctrl/marvell,armada-38x-pinctrl.txt
+@@ -27,15 +27,15 @@ mpp8 8 gpio, ge0(txd1), dev(ad10)
+ mpp9 9 gpio, ge0(txd2), dev(ad11)
+ mpp10 10 gpio, ge0(txd3), dev(ad12)
+ mpp11 11 gpio, ge0(txctl), dev(ad13)
+-mpp12 12 gpio, ge0(rxd0), pcie0(rstout), pcie1(rstout) [1], spi0(cs1), dev(ad14)
+-mpp13 13 gpio, ge0(rxd1), pcie0(clkreq), pcie1(clkreq) [1], spi0(cs2), dev(ad15)
+-mpp14 14 gpio, ge0(rxd2), ptp(clk), m(vtt_ctrl), spi0(cs3), dev(wen1)
+-mpp15 15 gpio, ge0(rxd3), ge(mdc slave), pcie0(rstout), spi0(mosi), pcie1(rstout) [1]
+-mpp16 16 gpio, ge0(rxctl), ge(mdio slave), m(decc_err), spi0(miso), pcie0(clkreq)
++mpp12 12 gpio, ge0(rxd0), pcie0(rstout), spi0(cs1), dev(ad14), pcie3(clkreq)
++mpp13 13 gpio, ge0(rxd1), pcie0(clkreq), pcie1(clkreq) [1], spi0(cs2), dev(ad15), pcie2(clkreq)
++mpp14 14 gpio, ge0(rxd2), ptp(clk), m(vtt_ctrl), spi0(cs3), dev(wen1), pcie3(clkreq)
++mpp15 15 gpio, ge0(rxd3), ge(mdc slave), pcie0(rstout), spi0(mosi)
++mpp16 16 gpio, ge0(rxctl), ge(mdio slave), m(decc_err), spi0(miso), pcie0(clkreq), pcie1(clkreq) [1]
+ mpp17 17 gpio, ge0(rxclk), ptp(clk), ua1(rxd), spi0(sck), sata1(prsnt)
+-mpp18 18 gpio, ge0(rxerr), ptp(trig_gen), ua1(txd), spi0(cs0), pcie1(rstout) [1]
+-mpp19 19 gpio, ge0(col), ptp(event_req), pcie0(clkreq), sata1(prsnt), ua0(cts)
+-mpp20 20 gpio, ge0(txclk), ptp(clk), pcie1(rstout) [1], sata0(prsnt), ua0(rts)
++mpp18 18 gpio, ge0(rxerr), ptp(trig_gen), ua1(txd), spi0(cs0)
++mpp19 19 gpio, ge0(col), ptp(event_req), ge0(txerr), sata1(prsnt), ua0(cts)
++mpp20 20 gpio, ge0(txclk), ptp(clk), sata0(prsnt), ua0(rts)
+ mpp21 21 gpio, spi0(cs1), ge1(rxd0), sata0(prsnt), sd0(cmd), dev(bootcs)
+ mpp22 22 gpio, spi0(mosi), dev(ad0)
+ mpp23 23 gpio, spi0(sck), dev(ad2)
+@@ -58,23 +58,23 @@ mpp39 39 gpio, i2c1(sck), ge1(rxd2), ua0(cts), sd0(d1), dev(a2)
+ mpp40 40 gpio, i2c1(sda), ge1(rxd3), ua0(rts), sd0(d2), dev(ad6)
+ mpp41 41 gpio, ua1(rxd), ge1(rxctl), ua0(cts), spi1(cs3), dev(burst/last)
+ mpp42 42 gpio, ua1(txd), ua0(rts), dev(ad7)
+-mpp43 43 gpio, pcie0(clkreq), m(vtt_ctrl), m(decc_err), pcie0(rstout), dev(clkout)
+-mpp44 44 gpio, sata0(prsnt), sata1(prsnt), sata2(prsnt) [2], sata3(prsnt) [3], pcie0(rstout)
+-mpp45 45 gpio, ref(clk_out0), pcie0(rstout), pcie1(rstout) [1], pcie2(rstout), pcie3(rstout)
+-mpp46 46 gpio, ref(clk_out1), pcie0(rstout), pcie1(rstout) [1], pcie2(rstout), pcie3(rstout)
+-mpp47 47 gpio, sata0(prsnt), sata1(prsnt), sata2(prsnt) [2], spi1(cs2), sata3(prsnt) [2]
+-mpp48 48 gpio, sata0(prsnt), m(vtt_ctrl), tdm2c(pclk), audio(mclk), sd0(d4)
+-mpp49 49 gpio, sata2(prsnt) [2], sata3(prsnt) [2], tdm2c(fsync), audio(lrclk), sd0(d5)
+-mpp50 50 gpio, pcie0(rstout), pcie1(rstout) [1], tdm2c(drx), audio(extclk), sd0(cmd)
++mpp43 43 gpio, pcie0(clkreq), m(vtt_ctrl), m(decc_err), spi1(cs2), dev(clkout)
++mpp44 44 gpio, sata0(prsnt), sata1(prsnt), sata2(prsnt) [2], sata3(prsnt) [3]
++mpp45 45 gpio, ref(clk_out0), pcie0(rstout)
++mpp46 46 gpio, ref(clk_out1), pcie0(rstout)
++mpp47 47 gpio, sata0(prsnt), sata1(prsnt), sata2(prsnt) [2], sata3(prsnt) [2]
++mpp48 48 gpio, sata0(prsnt), m(vtt_ctrl), tdm2c(pclk), audio(mclk), sd0(d4), pcie0(clkreq)
++mpp49 49 gpio, sata2(prsnt) [2], sata3(prsnt) [2], tdm2c(fsync), audio(lrclk), sd0(d5), pcie1(clkreq)
++mpp50 50 gpio, pcie0(rstout), tdm2c(drx), audio(extclk), sd0(cmd)
+ mpp51 51 gpio, tdm2c(dtx), audio(sdo), m(decc_err)
+-mpp52 52 gpio, pcie0(rstout), pcie1(rstout) [1], tdm2c(intn), audio(sdi), sd0(d6)
++mpp52 52 gpio, pcie0(rstout), tdm2c(intn), audio(sdi), sd0(d6)
+ mpp53 53 gpio, sata1(prsnt), sata0(prsnt), tdm2c(rstn), audio(bclk), sd0(d7)
+-mpp54 54 gpio, sata0(prsnt), sata1(prsnt), pcie0(rstout), pcie1(rstout) [1], sd0(d3)
++mpp54 54 gpio, sata0(prsnt), sata1(prsnt), pcie0(rstout), ge0(txerr), sd0(d3)
+ mpp55 55 gpio, ua1(cts), ge(mdio), pcie1(clkreq) [1], spi1(cs1), sd0(d0)
+ mpp56 56 gpio, ua1(rts), ge(mdc), m(decc_err), spi1(mosi)
+ mpp57 57 gpio, spi1(sck), sd0(clk)
+ mpp58 58 gpio, pcie1(clkreq) [1], i2c1(sck), pcie2(clkreq), spi1(miso), sd0(d1)
+-mpp59 59 gpio, pcie0(rstout), i2c1(sda), pcie1(rstout) [1], spi1(cs0), sd0(d2)
++mpp59 59 gpio, pcie0(rstout), i2c1(sda), spi1(cs0), sd0(d2)
+
+ [1]: only available on 88F6820 and 88F6828
+ [2]: only available on 88F6828
+diff --git a/Documentation/devicetree/bindings/pinctrl/marvell,armada-xp-pinctrl.txt b/Documentation/devicetree/bindings/pinctrl/marvell,armada-xp-pinctrl.txt
+index 373dbccd7ab0..96e7744cab84 100644
+--- a/Documentation/devicetree/bindings/pinctrl/marvell,armada-xp-pinctrl.txt
++++ b/Documentation/devicetree/bindings/pinctrl/marvell,armada-xp-pinctrl.txt
+@@ -42,15 +42,15 @@ mpp20 20 gpio, ge0(rxd4), ge1(rxd2), lcd(d20), ptp(clk)
+ mpp21 21 gpio, ge0(rxd5), ge1(rxd3), lcd(d21), mem(bat)
+ mpp22 22 gpio, ge0(rxd6), ge1(rxctl), lcd(d22), sata0(prsnt)
+ mpp23 23 gpio, ge0(rxd7), ge1(rxclk), lcd(d23), sata1(prsnt)
+-mpp24 24 gpio, lcd(hsync), sata1(prsnt), nf(bootcs-re), tdm(rst)
+-mpp25 25 gpio, lcd(vsync), sata0(prsnt), nf(bootcs-we), tdm(pclk)
+-mpp26 26 gpio, lcd(clk), tdm(fsync), vdd(cpu1-pd)
++mpp24 24 gpio, lcd(hsync), sata1(prsnt), tdm(rst)
++mpp25 25 gpio, lcd(vsync), sata0(prsnt), tdm(pclk)
++mpp26 26 gpio, lcd(clk), tdm(fsync)
+ mpp27 27 gpio, lcd(e), tdm(dtx), ptp(trig)
+ mpp28 28 gpio, lcd(pwm), tdm(drx), ptp(evreq)
+-mpp29 29 gpio, lcd(ref-clk), tdm(int0), ptp(clk), vdd(cpu0-pd)
++mpp29 29 gpio, lcd(ref-clk), tdm(int0), ptp(clk)
+ mpp30 30 gpio, tdm(int1), sd0(clk)
+-mpp31 31 gpio, tdm(int2), sd0(cmd), vdd(cpu0-pd)
+-mpp32 32 gpio, tdm(int3), sd0(d0), vdd(cpu1-pd)
++mpp31 31 gpio, tdm(int2), sd0(cmd)
++mpp32 32 gpio, tdm(int3), sd0(d0)
+ mpp33 33 gpio, tdm(int4), sd0(d1), mem(bat)
+ mpp34 34 gpio, tdm(int5), sd0(d2), sata0(prsnt)
+ mpp35 35 gpio, tdm(int6), sd0(d3), sata1(prsnt)
+@@ -58,21 +58,18 @@ mpp36 36 gpio, spi(mosi)
+ mpp37 37 gpio, spi(miso)
+ mpp38 38 gpio, spi(sck)
+ mpp39 39 gpio, spi(cs0)
+-mpp40 40 gpio, spi(cs1), uart2(cts), lcd(vga-hsync), vdd(cpu1-pd),
+- pcie(clkreq0)
++mpp40 40 gpio, spi(cs1), uart2(cts), lcd(vga-hsync), pcie(clkreq0)
+ mpp41 41 gpio, spi(cs2), uart2(rts), lcd(vga-vsync), sata1(prsnt),
+ pcie(clkreq1)
+-mpp42 42 gpio, uart2(rxd), uart0(cts), tdm(int7), tdm-1(timer),
+- vdd(cpu0-pd)
+-mpp43 43 gpio, uart2(txd), uart0(rts), spi(cs3), pcie(rstout),
+- vdd(cpu2-3-pd){1}
++mpp42 42 gpio, uart2(rxd), uart0(cts), tdm(int7), tdm-1(timer)
++mpp43 43 gpio, uart2(txd), uart0(rts), spi(cs3), pcie(rstout)
+ mpp44 44 gpio, uart2(cts), uart3(rxd), spi(cs4), pcie(clkreq2),
+ mem(bat)
+ mpp45 45 gpio, uart2(rts), uart3(txd), spi(cs5), sata1(prsnt)
+ mpp46 46 gpio, uart3(rts), uart1(rts), spi(cs6), sata0(prsnt)
+ mpp47 47 gpio, uart3(cts), uart1(cts), spi(cs7), pcie(clkreq3),
+ ref(clkout)
+-mpp48 48 gpio, tclk, dev(burst/last)
++mpp48 48 gpio, dev(clkout), dev(burst/last)
+
+ * Marvell Armada XP (mv78260 and mv78460 only)
+
+@@ -84,9 +81,9 @@ mpp51 51 gpio, dev(ad16)
+ mpp52 52 gpio, dev(ad17)
+ mpp53 53 gpio, dev(ad18)
+ mpp54 54 gpio, dev(ad19)
+-mpp55 55 gpio, dev(ad20), vdd(cpu0-pd)
+-mpp56 56 gpio, dev(ad21), vdd(cpu1-pd)
+-mpp57 57 gpio, dev(ad22), vdd(cpu2-3-pd){1}
++mpp55 55 gpio, dev(ad20)
++mpp56 56 gpio, dev(ad21)
++mpp57 57 gpio, dev(ad22)
+ mpp58 58 gpio, dev(ad23)
+ mpp59 59 gpio, dev(ad24)
+ mpp60 60 gpio, dev(ad25)
+@@ -96,6 +93,3 @@ mpp63 63 gpio, dev(ad28)
+ mpp64 64 gpio, dev(ad29)
+ mpp65 65 gpio, dev(ad30)
+ mpp66 66 gpio, dev(ad31)
+-
+-Notes:
+-* {1} vdd(cpu2-3-pd) only available on mv78460.
+diff --git a/Documentation/stable_kernel_rules.txt b/Documentation/stable_kernel_rules.txt
+index 58d0ac4df946..3049a612291b 100644
+--- a/Documentation/stable_kernel_rules.txt
++++ b/Documentation/stable_kernel_rules.txt
+@@ -59,11 +59,20 @@ For all other submissions, choose one of the following procedures:
+ changelog of your submission, as well as the kernel version you wish
+ it to be applied to.
+
+-Option 1 is probably the easiest and most common. Options 2 and 3 are more
+-useful if the patch isn't deemed worthy at the time it is applied to a public
+-git tree (for instance, because it deserves more regression testing first).
+-Option 3 is especially useful if the patch needs some special handling to apply
+-to an older kernel (e.g., if API's have changed in the meantime).
++Option 1 is *strongly* preferred, is the easiest and most common. Options 2 and
++3 are more useful if the patch isn't deemed worthy at the time it is applied to
++a public git tree (for instance, because it deserves more regression testing
++first). Option 3 is especially useful if the patch needs some special handling
++to apply to an older kernel (e.g., if API's have changed in the meantime).
++
++Note that for Option 3, if the patch deviates from the original upstream patch
++(for example because it had to be backported) this must be very clearly
++documented and justified in the patch description.
++
++The upstream commit ID must be specified with a separate line above the commit
++text, like this:
++
++ commit <sha1> upstream.
+
+ Additionally, some patches submitted via Option 1 may have additional patch
+ prerequisites which can be cherry-picked. This can be specified in the following
+diff --git a/Makefile b/Makefile
+index 95ee52f9432e..35faaf8fb651 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 18
+-SUBLEVEL = 17
++SUBLEVEL = 18
+ EXTRAVERSION =
+ NAME = Diseased Newt
+
+diff --git a/arch/arc/include/asm/atomic.h b/arch/arc/include/asm/atomic.h
+index 9917a45fc430..20b7dc17979e 100644
+--- a/arch/arc/include/asm/atomic.h
++++ b/arch/arc/include/asm/atomic.h
+@@ -43,6 +43,12 @@ static inline int atomic_##op##_return(int i, atomic_t *v) \
+ { \
+ unsigned int temp; \
+ \
++ /* \
++ * Explicit full memory barrier needed before/after as \
++ * LLOCK/SCOND thmeselves don't provide any such semantics \
++ */ \
++ smp_mb(); \
++ \
+ __asm__ __volatile__( \
+ "1: llock %0, [%1] \n" \
+ " " #asm_op " %0, %0, %2 \n" \
+@@ -52,6 +58,8 @@ static inline int atomic_##op##_return(int i, atomic_t *v) \
+ : "r"(&v->counter), "ir"(i) \
+ : "cc"); \
+ \
++ smp_mb(); \
++ \
+ return temp; \
+ }
+
+@@ -105,6 +113,9 @@ static inline int atomic_##op##_return(int i, atomic_t *v) \
+ unsigned long flags; \
+ unsigned long temp; \
+ \
++ /* \
++ * spin lock/unlock provides the needed smp_mb() before/after \
++ */ \
+ atomic_ops_lock(flags); \
+ temp = v->counter; \
+ temp c_op i; \
+@@ -142,9 +153,19 @@ ATOMIC_OP(and, &=, and)
+ #define __atomic_add_unless(v, a, u) \
+ ({ \
+ int c, old; \
++ \
++ /* \
++ * Explicit full memory barrier needed before/after as \
++ * LLOCK/SCOND thmeselves don't provide any such semantics \
++ */ \
++ smp_mb(); \
++ \
+ c = atomic_read(v); \
+ while (c != (u) && (old = atomic_cmpxchg((v), c, c + (a))) != c)\
+ c = old; \
++ \
++ smp_mb(); \
++ \
+ c; \
+ })
+
+diff --git a/arch/arc/include/asm/bitops.h b/arch/arc/include/asm/bitops.h
+index 1a5bf07eefe2..89fbbb0db51b 100644
+--- a/arch/arc/include/asm/bitops.h
++++ b/arch/arc/include/asm/bitops.h
+@@ -103,6 +103,12 @@ static inline int test_and_set_bit(unsigned long nr, volatile unsigned long *m)
+ if (__builtin_constant_p(nr))
+ nr &= 0x1f;
+
++ /*
++ * Explicit full memory barrier needed before/after as
++ * LLOCK/SCOND themselves don't provide any such semantics
++ */
++ smp_mb();
++
+ __asm__ __volatile__(
+ "1: llock %0, [%2] \n"
+ " bset %1, %0, %3 \n"
+@@ -112,6 +118,8 @@ static inline int test_and_set_bit(unsigned long nr, volatile unsigned long *m)
+ : "r"(m), "ir"(nr)
+ : "cc");
+
++ smp_mb();
++
+ return (old & (1 << nr)) != 0;
+ }
+
+@@ -125,6 +133,8 @@ test_and_clear_bit(unsigned long nr, volatile unsigned long *m)
+ if (__builtin_constant_p(nr))
+ nr &= 0x1f;
+
++ smp_mb();
++
+ __asm__ __volatile__(
+ "1: llock %0, [%2] \n"
+ " bclr %1, %0, %3 \n"
+@@ -134,6 +144,8 @@ test_and_clear_bit(unsigned long nr, volatile unsigned long *m)
+ : "r"(m), "ir"(nr)
+ : "cc");
+
++ smp_mb();
++
+ return (old & (1 << nr)) != 0;
+ }
+
+@@ -147,6 +159,8 @@ test_and_change_bit(unsigned long nr, volatile unsigned long *m)
+ if (__builtin_constant_p(nr))
+ nr &= 0x1f;
+
++ smp_mb();
++
+ __asm__ __volatile__(
+ "1: llock %0, [%2] \n"
+ " bxor %1, %0, %3 \n"
+@@ -156,6 +170,8 @@ test_and_change_bit(unsigned long nr, volatile unsigned long *m)
+ : "r"(m), "ir"(nr)
+ : "cc");
+
++ smp_mb();
++
+ return (old & (1 << nr)) != 0;
+ }
+
+@@ -235,6 +251,9 @@ static inline int test_and_set_bit(unsigned long nr, volatile unsigned long *m)
+ if (__builtin_constant_p(nr))
+ nr &= 0x1f;
+
++ /*
++ * spin lock/unlock provide the needed smp_mb() before/after
++ */
+ bitops_lock(flags);
+
+ old = *m;
+diff --git a/arch/arc/include/asm/cmpxchg.h b/arch/arc/include/asm/cmpxchg.h
+index 03cd6894855d..44fd531f4d7b 100644
+--- a/arch/arc/include/asm/cmpxchg.h
++++ b/arch/arc/include/asm/cmpxchg.h
+@@ -10,6 +10,8 @@
+ #define __ASM_ARC_CMPXCHG_H
+
+ #include <linux/types.h>
++
++#include <asm/barrier.h>
+ #include <asm/smp.h>
+
+ #ifdef CONFIG_ARC_HAS_LLSC
+@@ -19,16 +21,25 @@ __cmpxchg(volatile void *ptr, unsigned long expected, unsigned long new)
+ {
+ unsigned long prev;
+
++ /*
++ * Explicit full memory barrier needed before/after as
++ * LLOCK/SCOND thmeselves don't provide any such semantics
++ */
++ smp_mb();
++
+ __asm__ __volatile__(
+ "1: llock %0, [%1] \n"
+ " brne %0, %2, 2f \n"
+ " scond %3, [%1] \n"
+ " bnz 1b \n"
+ "2: \n"
+- : "=&r"(prev)
+- : "r"(ptr), "ir"(expected),
+- "r"(new) /* can't be "ir". scond can't take limm for "b" */
+- : "cc");
++ : "=&r"(prev) /* Early clobber, to prevent reg reuse */
++ : "r"(ptr), /* Not "m": llock only supports reg direct addr mode */
++ "ir"(expected),
++ "r"(new) /* can't be "ir". scond can't take LIMM for "b" */
++ : "cc", "memory"); /* so that gcc knows memory is being written here */
++
++ smp_mb();
+
+ return prev;
+ }
+@@ -42,6 +53,9 @@ __cmpxchg(volatile void *ptr, unsigned long expected, unsigned long new)
+ int prev;
+ volatile unsigned long *p = ptr;
+
++ /*
++ * spin lock/unlock provide the needed smp_mb() before/after
++ */
+ atomic_ops_lock(flags);
+ prev = *p;
+ if (prev == expected)
+@@ -77,12 +91,16 @@ static inline unsigned long __xchg(unsigned long val, volatile void *ptr,
+
+ switch (size) {
+ case 4:
++ smp_mb();
++
+ __asm__ __volatile__(
+ " ex %0, [%1] \n"
+ : "+r"(val)
+ : "r"(ptr)
+ : "memory");
+
++ smp_mb();
++
+ return val;
+ }
+ return __xchg_bad_pointer();
+diff --git a/arch/arc/include/asm/spinlock.h b/arch/arc/include/asm/spinlock.h
+index b6a8c2dfbe6e..e1651df6a93d 100644
+--- a/arch/arc/include/asm/spinlock.h
++++ b/arch/arc/include/asm/spinlock.h
+@@ -22,24 +22,46 @@ static inline void arch_spin_lock(arch_spinlock_t *lock)
+ {
+ unsigned int tmp = __ARCH_SPIN_LOCK_LOCKED__;
+
++ /*
++ * This smp_mb() is technically superfluous, we only need the one
++ * after the lock for providing the ACQUIRE semantics.
++ * However doing the "right" thing was regressing hackbench
++ * so keeping this, pending further investigation
++ */
++ smp_mb();
++
+ __asm__ __volatile__(
+ "1: ex %0, [%1] \n"
+ " breq %0, %2, 1b \n"
+ : "+&r" (tmp)
+ : "r"(&(lock->slock)), "ir"(__ARCH_SPIN_LOCK_LOCKED__)
+ : "memory");
++
++ /*
++ * ACQUIRE barrier to ensure load/store after taking the lock
++ * don't "bleed-up" out of the critical section (leak-in is allowed)
++ * http://www.spinics.net/lists/kernel/msg2010409.html
++ *
++ * ARCv2 only has load-load, store-store and all-all barrier
++ * thus need the full all-all barrier
++ */
++ smp_mb();
+ }
+
+ static inline int arch_spin_trylock(arch_spinlock_t *lock)
+ {
+ unsigned int tmp = __ARCH_SPIN_LOCK_LOCKED__;
+
++ smp_mb();
++
+ __asm__ __volatile__(
+ "1: ex %0, [%1] \n"
+ : "+r" (tmp)
+ : "r"(&(lock->slock))
+ : "memory");
+
++ smp_mb();
++
+ return (tmp == __ARCH_SPIN_LOCK_UNLOCKED__);
+ }
+
+@@ -47,12 +69,22 @@ static inline void arch_spin_unlock(arch_spinlock_t *lock)
+ {
+ unsigned int tmp = __ARCH_SPIN_LOCK_UNLOCKED__;
+
++ /*
++ * RELEASE barrier: given the instructions avail on ARCv2, full barrier
++ * is the only option
++ */
++ smp_mb();
++
+ __asm__ __volatile__(
+ " ex %0, [%1] \n"
+ : "+r" (tmp)
+ : "r"(&(lock->slock))
+ : "memory");
+
++ /*
++ * superfluous, but keeping for now - see pairing version in
++ * arch_spin_lock above
++ */
+ smp_mb();
+ }
+
+diff --git a/arch/arm/boot/dts/armada-370-xp.dtsi b/arch/arm/boot/dts/armada-370-xp.dtsi
+index 83286ec9702c..84366cddaa8e 100644
+--- a/arch/arm/boot/dts/armada-370-xp.dtsi
++++ b/arch/arm/boot/dts/armada-370-xp.dtsi
+@@ -225,7 +225,6 @@
+ };
+
+ eth0: ethernet@70000 {
+- compatible = "marvell,armada-370-neta";
+ reg = <0x70000 0x4000>;
+ interrupts = <8>;
+ clocks = <&gateclk 4>;
+@@ -241,7 +240,6 @@
+ };
+
+ eth1: ethernet@74000 {
+- compatible = "marvell,armada-370-neta";
+ reg = <0x74000 0x4000>;
+ interrupts = <10>;
+ clocks = <&gateclk 3>;
+diff --git a/arch/arm/boot/dts/armada-370.dtsi b/arch/arm/boot/dts/armada-370.dtsi
+index 7513410f7b89..b6e02689c61b 100644
+--- a/arch/arm/boot/dts/armada-370.dtsi
++++ b/arch/arm/boot/dts/armada-370.dtsi
+@@ -302,6 +302,14 @@
+ dmacap,memset;
+ };
+ };
++
++ ethernet@70000 {
++ compatible = "marvell,armada-370-neta";
++ };
++
++ ethernet@74000 {
++ compatible = "marvell,armada-370-neta";
++ };
+ };
+ };
+ };
+diff --git a/arch/arm/boot/dts/armada-xp-mv78260.dtsi b/arch/arm/boot/dts/armada-xp-mv78260.dtsi
+index 480e237a870f..677160effbb0 100644
+--- a/arch/arm/boot/dts/armada-xp-mv78260.dtsi
++++ b/arch/arm/boot/dts/armada-xp-mv78260.dtsi
+@@ -296,7 +296,7 @@
+ };
+
+ eth3: ethernet@34000 {
+- compatible = "marvell,armada-370-neta";
++ compatible = "marvell,armada-xp-neta";
+ reg = <0x34000 0x4000>;
+ interrupts = <14>;
+ clocks = <&gateclk 1>;
+diff --git a/arch/arm/boot/dts/armada-xp-mv78460.dtsi b/arch/arm/boot/dts/armada-xp-mv78460.dtsi
+index 2c7b1fef4703..e143776b78ec 100644
+--- a/arch/arm/boot/dts/armada-xp-mv78460.dtsi
++++ b/arch/arm/boot/dts/armada-xp-mv78460.dtsi
+@@ -334,7 +334,7 @@
+ };
+
+ eth3: ethernet@34000 {
+- compatible = "marvell,armada-370-neta";
++ compatible = "marvell,armada-xp-neta";
+ reg = <0x34000 0x4000>;
+ interrupts = <14>;
+ clocks = <&gateclk 1>;
+diff --git a/arch/arm/boot/dts/armada-xp.dtsi b/arch/arm/boot/dts/armada-xp.dtsi
+index bff9f6c18db1..66d25b788067 100644
+--- a/arch/arm/boot/dts/armada-xp.dtsi
++++ b/arch/arm/boot/dts/armada-xp.dtsi
+@@ -125,7 +125,7 @@
+ };
+
+ eth2: ethernet@30000 {
+- compatible = "marvell,armada-370-neta";
++ compatible = "marvell,armada-xp-neta";
+ reg = <0x30000 0x4000>;
+ interrupts = <12>;
+ clocks = <&gateclk 2>;
+@@ -168,6 +168,14 @@
+ };
+ };
+
++ ethernet@70000 {
++ compatible = "marvell,armada-xp-neta";
++ };
++
++ ethernet@74000 {
++ compatible = "marvell,armada-xp-neta";
++ };
++
+ xor@f0900 {
+ compatible = "marvell,orion-xor";
+ reg = <0xF0900 0x100
+diff --git a/arch/arm/boot/dts/at91-sama5d4ek.dts b/arch/arm/boot/dts/at91-sama5d4ek.dts
+index b5b84006469e..d7f6ae4e5b98 100644
+--- a/arch/arm/boot/dts/at91-sama5d4ek.dts
++++ b/arch/arm/boot/dts/at91-sama5d4ek.dts
+@@ -108,8 +108,8 @@
+ mmc0: mmc@f8000000 {
+ pinctrl-names = "default";
+ pinctrl-0 = <&pinctrl_mmc0_clk_cmd_dat0 &pinctrl_mmc0_dat1_3 &pinctrl_mmc0_cd>;
+- slot@1 {
+- reg = <1>;
++ slot@0 {
++ reg = <0>;
+ bus-width = <4>;
+ cd-gpios = <&pioE 5 0>;
+ };
+diff --git a/arch/arm/kvm/psci.c b/arch/arm/kvm/psci.c
+index 58cb3248d277..4d0d89e342f9 100644
+--- a/arch/arm/kvm/psci.c
++++ b/arch/arm/kvm/psci.c
+@@ -237,10 +237,6 @@ static int kvm_psci_0_2_call(struct kvm_vcpu *vcpu)
+ case PSCI_0_2_FN64_AFFINITY_INFO:
+ val = kvm_psci_vcpu_affinity_info(vcpu);
+ break;
+- case PSCI_0_2_FN_MIGRATE:
+- case PSCI_0_2_FN64_MIGRATE:
+- val = PSCI_RET_NOT_SUPPORTED;
+- break;
+ case PSCI_0_2_FN_MIGRATE_INFO_TYPE:
+ /*
+ * Trusted OS is MP hence does not require migration
+@@ -249,10 +245,6 @@ static int kvm_psci_0_2_call(struct kvm_vcpu *vcpu)
+ */
+ val = PSCI_0_2_TOS_MP;
+ break;
+- case PSCI_0_2_FN_MIGRATE_INFO_UP_CPU:
+- case PSCI_0_2_FN64_MIGRATE_INFO_UP_CPU:
+- val = PSCI_RET_NOT_SUPPORTED;
+- break;
+ case PSCI_0_2_FN_SYSTEM_OFF:
+ kvm_psci_system_off(vcpu);
+ /*
+@@ -278,7 +270,8 @@ static int kvm_psci_0_2_call(struct kvm_vcpu *vcpu)
+ ret = 0;
+ break;
+ default:
+- return -EINVAL;
++ val = PSCI_RET_NOT_SUPPORTED;
++ break;
+ }
+
+ *vcpu_reg(vcpu, 0) = val;
+@@ -298,12 +291,9 @@ static int kvm_psci_0_1_call(struct kvm_vcpu *vcpu)
+ case KVM_PSCI_FN_CPU_ON:
+ val = kvm_psci_vcpu_on(vcpu);
+ break;
+- case KVM_PSCI_FN_CPU_SUSPEND:
+- case KVM_PSCI_FN_MIGRATE:
++ default:
+ val = PSCI_RET_NOT_SUPPORTED;
+ break;
+- default:
+- return -EINVAL;
+ }
+
+ *vcpu_reg(vcpu, 0) = val;
+diff --git a/arch/arm/mach-tegra/cpuidle-tegra20.c b/arch/arm/mach-tegra/cpuidle-tegra20.c
+index b30bf5cba65b..f209e9c507e2 100644
+--- a/arch/arm/mach-tegra/cpuidle-tegra20.c
++++ b/arch/arm/mach-tegra/cpuidle-tegra20.c
+@@ -35,6 +35,7 @@
+ #include "iomap.h"
+ #include "irq.h"
+ #include "pm.h"
++#include "reset.h"
+ #include "sleep.h"
+
+ #ifdef CONFIG_PM_SLEEP
+@@ -72,15 +73,13 @@ static struct cpuidle_driver tegra_idle_driver = {
+
+ #ifdef CONFIG_PM_SLEEP
+ #ifdef CONFIG_SMP
+-static void __iomem *pmc = IO_ADDRESS(TEGRA_PMC_BASE);
+-
+ static int tegra20_reset_sleeping_cpu_1(void)
+ {
+ int ret = 0;
+
+ tegra_pen_lock();
+
+- if (readl(pmc + PMC_SCRATCH41) == CPU_RESETTABLE)
++ if (readb(tegra20_cpu1_resettable_status) == CPU_RESETTABLE)
+ tegra20_cpu_shutdown(1);
+ else
+ ret = -EINVAL;
+diff --git a/arch/arm/mach-tegra/reset-handler.S b/arch/arm/mach-tegra/reset-handler.S
+index 71be4af5e975..e3070fdab80b 100644
+--- a/arch/arm/mach-tegra/reset-handler.S
++++ b/arch/arm/mach-tegra/reset-handler.S
+@@ -169,10 +169,10 @@ after_errata:
+ cmp r6, #TEGRA20
+ bne 1f
+ /* If not CPU0, don't let CPU0 reset CPU1 now that CPU1 is coming up. */
+- mov32 r5, TEGRA_PMC_BASE
+- mov r0, #0
++ mov32 r5, TEGRA_IRAM_BASE + TEGRA_IRAM_RESET_HANDLER_OFFSET
++ mov r0, #CPU_NOT_RESETTABLE
+ cmp r10, #0
+- strne r0, [r5, #PMC_SCRATCH41]
++ strneb r0, [r5, #__tegra20_cpu1_resettable_status_offset]
+ 1:
+ #endif
+
+@@ -281,6 +281,10 @@ __tegra_cpu_reset_handler_data:
+ .rept TEGRA_RESET_DATA_SIZE
+ .long 0
+ .endr
++ .globl __tegra20_cpu1_resettable_status_offset
++ .equ __tegra20_cpu1_resettable_status_offset, \
++ . - __tegra_cpu_reset_handler_start
++ .byte 0
+ .align L1_CACHE_SHIFT
+
+ ENTRY(__tegra_cpu_reset_handler_end)
+diff --git a/arch/arm/mach-tegra/reset.h b/arch/arm/mach-tegra/reset.h
+index 76a93434c6ee..29c3dec0126a 100644
+--- a/arch/arm/mach-tegra/reset.h
++++ b/arch/arm/mach-tegra/reset.h
+@@ -35,6 +35,7 @@ extern unsigned long __tegra_cpu_reset_handler_data[TEGRA_RESET_DATA_SIZE];
+
+ void __tegra_cpu_reset_handler_start(void);
+ void __tegra_cpu_reset_handler(void);
++void __tegra20_cpu1_resettable_status_offset(void);
+ void __tegra_cpu_reset_handler_end(void);
+ void tegra_secondary_startup(void);
+
+@@ -47,6 +48,9 @@ void tegra_secondary_startup(void);
+ (IO_ADDRESS(TEGRA_IRAM_BASE + TEGRA_IRAM_RESET_HANDLER_OFFSET + \
+ ((u32)&__tegra_cpu_reset_handler_data[TEGRA_RESET_MASK_LP2] - \
+ (u32)__tegra_cpu_reset_handler_start)))
++#define tegra20_cpu1_resettable_status \
++ (IO_ADDRESS(TEGRA_IRAM_BASE + TEGRA_IRAM_RESET_HANDLER_OFFSET + \
++ (u32)__tegra20_cpu1_resettable_status_offset))
+ #endif
+
+ #define tegra_cpu_reset_handler_offset \
+diff --git a/arch/arm/mach-tegra/sleep-tegra20.S b/arch/arm/mach-tegra/sleep-tegra20.S
+index be4bc5f853f5..e6b684e14322 100644
+--- a/arch/arm/mach-tegra/sleep-tegra20.S
++++ b/arch/arm/mach-tegra/sleep-tegra20.S
+@@ -97,9 +97,10 @@ ENDPROC(tegra20_hotplug_shutdown)
+ ENTRY(tegra20_cpu_shutdown)
+ cmp r0, #0
+ reteq lr @ must not be called for CPU 0
+- mov32 r1, TEGRA_PMC_VIRT + PMC_SCRATCH41
++ mov32 r1, TEGRA_IRAM_RESET_BASE_VIRT
++ ldr r2, =__tegra20_cpu1_resettable_status_offset
+ mov r12, #CPU_RESETTABLE
+- str r12, [r1]
++ strb r12, [r1, r2]
+
+ cpu_to_halt_reg r1, r0
+ ldr r3, =TEGRA_FLOW_CTRL_VIRT
+@@ -182,38 +183,41 @@ ENDPROC(tegra_pen_unlock)
+ /*
+ * tegra20_cpu_clear_resettable(void)
+ *
+- * Called to clear the "resettable soon" flag in PMC_SCRATCH41 when
++ * Called to clear the "resettable soon" flag in IRAM variable when
+ * it is expected that the secondary CPU will be idle soon.
+ */
+ ENTRY(tegra20_cpu_clear_resettable)
+- mov32 r1, TEGRA_PMC_VIRT + PMC_SCRATCH41
++ mov32 r1, TEGRA_IRAM_RESET_BASE_VIRT
++ ldr r2, =__tegra20_cpu1_resettable_status_offset
+ mov r12, #CPU_NOT_RESETTABLE
+- str r12, [r1]
++ strb r12, [r1, r2]
+ ret lr
+ ENDPROC(tegra20_cpu_clear_resettable)
+
+ /*
+ * tegra20_cpu_set_resettable_soon(void)
+ *
+- * Called to set the "resettable soon" flag in PMC_SCRATCH41 when
++ * Called to set the "resettable soon" flag in IRAM variable when
+ * it is expected that the secondary CPU will be idle soon.
+ */
+ ENTRY(tegra20_cpu_set_resettable_soon)
+- mov32 r1, TEGRA_PMC_VIRT + PMC_SCRATCH41
++ mov32 r1, TEGRA_IRAM_RESET_BASE_VIRT
++ ldr r2, =__tegra20_cpu1_resettable_status_offset
+ mov r12, #CPU_RESETTABLE_SOON
+- str r12, [r1]
++ strb r12, [r1, r2]
+ ret lr
+ ENDPROC(tegra20_cpu_set_resettable_soon)
+
+ /*
+ * tegra20_cpu_is_resettable_soon(void)
+ *
+- * Returns true if the "resettable soon" flag in PMC_SCRATCH41 has been
++ * Returns true if the "resettable soon" flag in IRAM variable has been
+ * set because it is expected that the secondary CPU will be idle soon.
+ */
+ ENTRY(tegra20_cpu_is_resettable_soon)
+- mov32 r1, TEGRA_PMC_VIRT + PMC_SCRATCH41
+- ldr r12, [r1]
++ mov32 r1, TEGRA_IRAM_RESET_BASE_VIRT
++ ldr r2, =__tegra20_cpu1_resettable_status_offset
++ ldrb r12, [r1, r2]
+ cmp r12, #CPU_RESETTABLE_SOON
+ moveq r0, #1
+ movne r0, #0
+@@ -256,9 +260,10 @@ ENTRY(tegra20_sleep_cpu_secondary_finish)
+ mov r0, #TEGRA_FLUSH_CACHE_LOUIS
+ bl tegra_disable_clean_inv_dcache
+
+- mov32 r0, TEGRA_PMC_VIRT + PMC_SCRATCH41
++ mov32 r0, TEGRA_IRAM_RESET_BASE_VIRT
++ ldr r4, =__tegra20_cpu1_resettable_status_offset
+ mov r3, #CPU_RESETTABLE
+- str r3, [r0]
++ strb r3, [r0, r4]
+
+ bl tegra_cpu_do_idle
+
+@@ -274,10 +279,10 @@ ENTRY(tegra20_sleep_cpu_secondary_finish)
+
+ bl tegra_pen_lock
+
+- mov32 r3, TEGRA_PMC_VIRT
+- add r0, r3, #PMC_SCRATCH41
++ mov32 r0, TEGRA_IRAM_RESET_BASE_VIRT
++ ldr r4, =__tegra20_cpu1_resettable_status_offset
+ mov r3, #CPU_NOT_RESETTABLE
+- str r3, [r0]
++ strb r3, [r0, r4]
+
+ bl tegra_pen_unlock
+
+diff --git a/arch/arm/mach-tegra/sleep.h b/arch/arm/mach-tegra/sleep.h
+index 92d46ec1361a..0d59360d891d 100644
+--- a/arch/arm/mach-tegra/sleep.h
++++ b/arch/arm/mach-tegra/sleep.h
+@@ -18,6 +18,7 @@
+ #define __MACH_TEGRA_SLEEP_H
+
+ #include "iomap.h"
++#include "irammap.h"
+
+ #define TEGRA_ARM_PERIF_VIRT (TEGRA_ARM_PERIF_BASE - IO_CPU_PHYS \
+ + IO_CPU_VIRT)
+@@ -29,6 +30,9 @@
+ + IO_APB_VIRT)
+ #define TEGRA_PMC_VIRT (TEGRA_PMC_BASE - IO_APB_PHYS + IO_APB_VIRT)
+
++#define TEGRA_IRAM_RESET_BASE_VIRT (IO_IRAM_VIRT + \
++ TEGRA_IRAM_RESET_HANDLER_OFFSET)
++
+ /* PMC_SCRATCH37-39 and 41 are used for tegra_pen_lock and idle */
+ #define PMC_SCRATCH37 0x130
+ #define PMC_SCRATCH38 0x134
+diff --git a/arch/arm64/kernel/entry.S b/arch/arm64/kernel/entry.S
+index 2b0f3d5e11c7..6c99b4664b40 100644
+--- a/arch/arm64/kernel/entry.S
++++ b/arch/arm64/kernel/entry.S
+@@ -517,6 +517,7 @@ el0_sp_pc:
+ mrs x26, far_el1
+ // enable interrupts before calling the main handler
+ enable_dbg_and_irq
++ ct_user_exit
+ mov x0, x26
+ mov x1, x25
+ mov x2, sp
+diff --git a/arch/arm64/kernel/vdso/Makefile b/arch/arm64/kernel/vdso/Makefile
+index ff3bddea482d..f6fe17d88da5 100644
+--- a/arch/arm64/kernel/vdso/Makefile
++++ b/arch/arm64/kernel/vdso/Makefile
+@@ -15,6 +15,10 @@ ccflags-y := -shared -fno-common -fno-builtin
+ ccflags-y += -nostdlib -Wl,-soname=linux-vdso.so.1 \
+ $(call cc-ldoption, -Wl$(comma)--hash-style=sysv)
+
++# Workaround for bare-metal (ELF) toolchains that neglect to pass -shared
++# down to collect2, resulting in silent corruption of the vDSO image.
++ccflags-y += -Wl,-shared
++
+ obj-y += vdso.o
+ extra-y += vdso.lds vdso-offsets.h
+ CPPFLAGS_vdso.lds += -P -C -U$(ARCH)
+diff --git a/arch/arm64/mm/context.c b/arch/arm64/mm/context.c
+index baa758d37021..76c1e6cd36fc 100644
+--- a/arch/arm64/mm/context.c
++++ b/arch/arm64/mm/context.c
+@@ -92,6 +92,14 @@ static void reset_context(void *info)
+ unsigned int cpu = smp_processor_id();
+ struct mm_struct *mm = current->active_mm;
+
++ /*
++ * current->active_mm could be init_mm for the idle thread immediately
++ * after secondary CPU boot or hotplug. TTBR0_EL1 is already set to
++ * the reserved value, so no need to reset any context.
++ */
++ if (mm == &init_mm)
++ return;
++
+ smp_rmb();
+ asid = cpu_last_asid + cpu;
+
+diff --git a/arch/arm64/mm/init.c b/arch/arm64/mm/init.c
+index c95464a33f36..f752943f75d2 100644
+--- a/arch/arm64/mm/init.c
++++ b/arch/arm64/mm/init.c
+@@ -238,7 +238,7 @@ static void __init free_unused_memmap(void)
+ * memmap entries are valid from the bank end aligned to
+ * MAX_ORDER_NR_PAGES.
+ */
+- prev_end = ALIGN(start + __phys_to_pfn(reg->size),
++ prev_end = ALIGN(__phys_to_pfn(reg->base + reg->size),
+ MAX_ORDER_NR_PAGES);
+ }
+
+diff --git a/arch/mips/include/asm/mach-generic/spaces.h b/arch/mips/include/asm/mach-generic/spaces.h
+index 9488fa5f8866..afc96ecb9004 100644
+--- a/arch/mips/include/asm/mach-generic/spaces.h
++++ b/arch/mips/include/asm/mach-generic/spaces.h
+@@ -94,7 +94,11 @@
+ #endif
+
+ #ifndef FIXADDR_TOP
++#ifdef CONFIG_KVM_GUEST
++#define FIXADDR_TOP ((unsigned long)(long)(int)0x7ffe0000)
++#else
+ #define FIXADDR_TOP ((unsigned long)(long)(int)0xfffe0000)
+ #endif
++#endif
+
+ #endif /* __ASM_MACH_GENERIC_SPACES_H */
+diff --git a/arch/mips/kernel/irq.c b/arch/mips/kernel/irq.c
+index d2bfbc2e8995..be15e52a47a0 100644
+--- a/arch/mips/kernel/irq.c
++++ b/arch/mips/kernel/irq.c
+@@ -109,7 +109,7 @@ void __init init_IRQ(void)
+ #endif
+ }
+
+-#ifdef DEBUG_STACKOVERFLOW
++#ifdef CONFIG_DEBUG_STACKOVERFLOW
+ static inline void check_stack_overflow(void)
+ {
+ unsigned long sp;
+diff --git a/arch/mips/kvm/mips.c b/arch/mips/kvm/mips.c
+index 39074fb83bad..a53eaf50c224 100644
+--- a/arch/mips/kvm/mips.c
++++ b/arch/mips/kvm/mips.c
+@@ -784,7 +784,7 @@ int kvm_vm_ioctl_get_dirty_log(struct kvm *kvm, struct kvm_dirty_log *log)
+
+ /* If nothing is dirty, don't bother messing with page tables. */
+ if (is_dirty) {
+- memslot = &kvm->memslots->memslots[log->slot];
++ memslot = id_to_memslot(kvm->memslots, log->slot);
+
+ ga = memslot->base_gfn << PAGE_SHIFT;
+ ga_end = ga + (memslot->npages << PAGE_SHIFT);
+diff --git a/arch/powerpc/perf/core-book3s.c b/arch/powerpc/perf/core-book3s.c
+index a6995d4e93d4..ffa07eb5fff0 100644
+--- a/arch/powerpc/perf/core-book3s.c
++++ b/arch/powerpc/perf/core-book3s.c
+@@ -131,7 +131,16 @@ static void pmao_restore_workaround(bool ebb) { }
+
+ static bool regs_use_siar(struct pt_regs *regs)
+ {
+- return !!regs->result;
++ /*
++ * When we take a performance monitor exception the regs are setup
++ * using perf_read_regs() which overloads some fields, in particular
++ * regs->result to tell us whether to use SIAR.
++ *
++ * However if the regs are from another exception, eg. a syscall, then
++ * they have not been setup using perf_read_regs() and so regs->result
++ * is something random.
++ */
++ return ((TRAP(regs) == 0xf00) && regs->result);
+ }
+
+ /*
+diff --git a/arch/s390/kernel/crash_dump.c b/arch/s390/kernel/crash_dump.c
+index 9f73c8059022..49b74454d7ee 100644
+--- a/arch/s390/kernel/crash_dump.c
++++ b/arch/s390/kernel/crash_dump.c
+@@ -415,7 +415,7 @@ static void *nt_s390_vx_low(void *ptr, __vector128 *vx_regs)
+ ptr += len;
+ /* Copy lower halves of SIMD registers 0-15 */
+ for (i = 0; i < 16; i++) {
+- memcpy(ptr, &vx_regs[i], 8);
++ memcpy(ptr, &vx_regs[i].u[2], 8);
+ ptr += 8;
+ }
+ return ptr;
+diff --git a/arch/sparc/kernel/ldc.c b/arch/sparc/kernel/ldc.c
+index 4310332872d4..71762565513e 100644
+--- a/arch/sparc/kernel/ldc.c
++++ b/arch/sparc/kernel/ldc.c
+@@ -2307,7 +2307,7 @@ void *ldc_alloc_exp_dring(struct ldc_channel *lp, unsigned int len,
+ if (len & (8UL - 1))
+ return ERR_PTR(-EINVAL);
+
+- buf = kzalloc(len, GFP_KERNEL);
++ buf = kzalloc(len, GFP_ATOMIC);
+ if (!buf)
+ return ERR_PTR(-ENOMEM);
+
+diff --git a/arch/x86/include/asm/segment.h b/arch/x86/include/asm/segment.h
+index 6f1c3a8a33ab..bcc9a2f46c62 100644
+--- a/arch/x86/include/asm/segment.h
++++ b/arch/x86/include/asm/segment.h
+@@ -212,10 +212,21 @@
+ #define TLS_SIZE (GDT_ENTRY_TLS_ENTRIES * 8)
+
+ #ifdef __KERNEL__
++
++/*
++ * early_idt_handler_array is an array of entry points referenced in the
++ * early IDT. For simplicity, it's a real array with one entry point
++ * every nine bytes. That leaves room for an optional 'push $0' if the
++ * vector has no error code (two bytes), a 'push $vector_number' (two
++ * bytes), and a jump to the common entry code (up to five bytes).
++ */
++#define EARLY_IDT_HANDLER_SIZE 9
++
+ #ifndef __ASSEMBLY__
+-extern const char early_idt_handlers[NUM_EXCEPTION_VECTORS][2+2+5];
++
++extern const char early_idt_handler_array[NUM_EXCEPTION_VECTORS][EARLY_IDT_HANDLER_SIZE];
+ #ifdef CONFIG_TRACING
+-#define trace_early_idt_handlers early_idt_handlers
++# define trace_early_idt_handler_array early_idt_handler_array
+ #endif
+
+ /*
+diff --git a/arch/x86/kernel/head64.c b/arch/x86/kernel/head64.c
+index 3b241f0ca005..957fdb5eb2e3 100644
+--- a/arch/x86/kernel/head64.c
++++ b/arch/x86/kernel/head64.c
+@@ -164,7 +164,7 @@ asmlinkage __visible void __init x86_64_start_kernel(char * real_mode_data)
+ clear_bss();
+
+ for (i = 0; i < NUM_EXCEPTION_VECTORS; i++)
+- set_intr_gate(i, early_idt_handlers[i]);
++ set_intr_gate(i, early_idt_handler_array[i]);
+ load_idt((const struct desc_ptr *)&idt_descr);
+
+ copy_bootdata(__va(real_mode_data));
+diff --git a/arch/x86/kernel/head_32.S b/arch/x86/kernel/head_32.S
+index f36bd42d6f0c..30a2aa3782fa 100644
+--- a/arch/x86/kernel/head_32.S
++++ b/arch/x86/kernel/head_32.S
+@@ -477,21 +477,22 @@ is486:
+ __INIT
+ setup_once:
+ /*
+- * Set up a idt with 256 entries pointing to ignore_int,
+- * interrupt gates. It doesn't actually load idt - that needs
+- * to be done on each CPU. Interrupts are enabled elsewhere,
+- * when we can be relatively sure everything is ok.
++ * Set up a idt with 256 interrupt gates that push zero if there
++ * is no error code and then jump to early_idt_handler_common.
++ * It doesn't actually load the idt - that needs to be done on
++ * each CPU. Interrupts are enabled elsewhere, when we can be
++ * relatively sure everything is ok.
+ */
+
+ movl $idt_table,%edi
+- movl $early_idt_handlers,%eax
++ movl $early_idt_handler_array,%eax
+ movl $NUM_EXCEPTION_VECTORS,%ecx
+ 1:
+ movl %eax,(%edi)
+ movl %eax,4(%edi)
+ /* interrupt gate, dpl=0, present */
+ movl $(0x8E000000 + __KERNEL_CS),2(%edi)
+- addl $9,%eax
++ addl $EARLY_IDT_HANDLER_SIZE,%eax
+ addl $8,%edi
+ loop 1b
+
+@@ -523,26 +524,28 @@ setup_once:
+ andl $0,setup_once_ref /* Once is enough, thanks */
+ ret
+
+-ENTRY(early_idt_handlers)
++ENTRY(early_idt_handler_array)
+ # 36(%esp) %eflags
+ # 32(%esp) %cs
+ # 28(%esp) %eip
+ # 24(%rsp) error code
+ i = 0
+ .rept NUM_EXCEPTION_VECTORS
+- .if (EXCEPTION_ERRCODE_MASK >> i) & 1
+- ASM_NOP2
+- .else
++ .ifeq (EXCEPTION_ERRCODE_MASK >> i) & 1
+ pushl $0 # Dummy error code, to make stack frame uniform
+ .endif
+ pushl $i # 20(%esp) Vector number
+- jmp early_idt_handler
++ jmp early_idt_handler_common
+ i = i + 1
++ .fill early_idt_handler_array + i*EARLY_IDT_HANDLER_SIZE - ., 1, 0xcc
+ .endr
+-ENDPROC(early_idt_handlers)
++ENDPROC(early_idt_handler_array)
+
+- /* This is global to keep gas from relaxing the jumps */
+-ENTRY(early_idt_handler)
++early_idt_handler_common:
++ /*
++ * The stack is the hardware frame, an error code or zero, and the
++ * vector number.
++ */
+ cld
+
+ cmpl $2,(%esp) # X86_TRAP_NMI
+@@ -602,7 +605,7 @@ ex_entry:
+ is_nmi:
+ addl $8,%esp /* drop vector number and error code */
+ iret
+-ENDPROC(early_idt_handler)
++ENDPROC(early_idt_handler_common)
+
+ /* This is the default interrupt "handler" :-) */
+ ALIGN
+diff --git a/arch/x86/kernel/head_64.S b/arch/x86/kernel/head_64.S
+index a468c0a65c42..a2dc0add72ed 100644
+--- a/arch/x86/kernel/head_64.S
++++ b/arch/x86/kernel/head_64.S
+@@ -321,26 +321,28 @@ bad_address:
+ jmp bad_address
+
+ __INIT
+- .globl early_idt_handlers
+-early_idt_handlers:
++ENTRY(early_idt_handler_array)
+ # 104(%rsp) %rflags
+ # 96(%rsp) %cs
+ # 88(%rsp) %rip
+ # 80(%rsp) error code
+ i = 0
+ .rept NUM_EXCEPTION_VECTORS
+- .if (EXCEPTION_ERRCODE_MASK >> i) & 1
+- ASM_NOP2
+- .else
++ .ifeq (EXCEPTION_ERRCODE_MASK >> i) & 1
+ pushq $0 # Dummy error code, to make stack frame uniform
+ .endif
+ pushq $i # 72(%rsp) Vector number
+- jmp early_idt_handler
++ jmp early_idt_handler_common
+ i = i + 1
++ .fill early_idt_handler_array + i*EARLY_IDT_HANDLER_SIZE - ., 1, 0xcc
+ .endr
++ENDPROC(early_idt_handler_array)
+
+-/* This is global to keep gas from relaxing the jumps */
+-ENTRY(early_idt_handler)
++early_idt_handler_common:
++ /*
++ * The stack is the hardware frame, an error code or zero, and the
++ * vector number.
++ */
+ cld
+
+ cmpl $2,(%rsp) # X86_TRAP_NMI
+@@ -412,7 +414,7 @@ ENTRY(early_idt_handler)
+ is_nmi:
+ addq $16,%rsp # drop vector number and error code
+ INTERRUPT_RETURN
+-ENDPROC(early_idt_handler)
++ENDPROC(early_idt_handler_common)
+
+ __INITDATA
+
+diff --git a/arch/x86/pci/acpi.c b/arch/x86/pci/acpi.c
+index cfd1b132b8e3..a3e94b4108bf 100644
+--- a/arch/x86/pci/acpi.c
++++ b/arch/x86/pci/acpi.c
+@@ -84,6 +84,17 @@ static const struct dmi_system_id pci_crs_quirks[] __initconst = {
+ DMI_MATCH(DMI_BIOS_VENDOR, "Phoenix Technologies, LTD"),
+ },
+ },
++ /* https://bugs.launchpad.net/ubuntu/+source/alsa-driver/+bug/931368 */
++ /* https://bugs.launchpad.net/ubuntu/+source/alsa-driver/+bug/1033299 */
++ {
++ .callback = set_use_crs,
++ .ident = "Foxconn K8M890-8237A",
++ .matches = {
++ DMI_MATCH(DMI_BOARD_VENDOR, "Foxconn"),
++ DMI_MATCH(DMI_BOARD_NAME, "K8M890-8237A"),
++ DMI_MATCH(DMI_BIOS_VENDOR, "Phoenix Technologies, LTD"),
++ },
++ },
+
+ /* Now for the blacklist.. */
+
+@@ -124,8 +135,10 @@ void __init pci_acpi_crs_quirks(void)
+ {
+ int year;
+
+- if (dmi_get_date(DMI_BIOS_DATE, &year, NULL, NULL) && year < 2008)
+- pci_use_crs = false;
++ if (dmi_get_date(DMI_BIOS_DATE, &year, NULL, NULL) && year < 2008) {
++ if (iomem_resource.end <= 0xffffffff)
++ pci_use_crs = false;
++ }
+
+ dmi_check_system(pci_crs_quirks);
+
+diff --git a/block/genhd.c b/block/genhd.c
+index 0a536dc05f3b..c2fb3f7bdec4 100644
+--- a/block/genhd.c
++++ b/block/genhd.c
+@@ -422,9 +422,9 @@ int blk_alloc_devt(struct hd_struct *part, dev_t *devt)
+ /* allocate ext devt */
+ idr_preload(GFP_KERNEL);
+
+- spin_lock(&ext_devt_lock);
++ spin_lock_bh(&ext_devt_lock);
+ idx = idr_alloc(&ext_devt_idr, part, 0, NR_EXT_DEVT, GFP_NOWAIT);
+- spin_unlock(&ext_devt_lock);
++ spin_unlock_bh(&ext_devt_lock);
+
+ idr_preload_end();
+ if (idx < 0)
+@@ -449,9 +449,9 @@ void blk_free_devt(dev_t devt)
+ return;
+
+ if (MAJOR(devt) == BLOCK_EXT_MAJOR) {
+- spin_lock(&ext_devt_lock);
++ spin_lock_bh(&ext_devt_lock);
+ idr_remove(&ext_devt_idr, blk_mangle_minor(MINOR(devt)));
+- spin_unlock(&ext_devt_lock);
++ spin_unlock_bh(&ext_devt_lock);
+ }
+ }
+
+@@ -691,13 +691,13 @@ struct gendisk *get_gendisk(dev_t devt, int *partno)
+ } else {
+ struct hd_struct *part;
+
+- spin_lock(&ext_devt_lock);
++ spin_lock_bh(&ext_devt_lock);
+ part = idr_find(&ext_devt_idr, blk_mangle_minor(MINOR(devt)));
+ if (part && get_disk(part_to_disk(part))) {
+ *partno = part->partno;
+ disk = part_to_disk(part);
+ }
+- spin_unlock(&ext_devt_lock);
++ spin_unlock_bh(&ext_devt_lock);
+ }
+
+ return disk;
+diff --git a/crypto/asymmetric_keys/asymmetric_keys.h b/crypto/asymmetric_keys/asymmetric_keys.h
+index f97330886d58..3f5b537ab33e 100644
+--- a/crypto/asymmetric_keys/asymmetric_keys.h
++++ b/crypto/asymmetric_keys/asymmetric_keys.h
+@@ -11,6 +11,9 @@
+
+ extern struct asymmetric_key_id *asymmetric_key_hex_to_key_id(const char *id);
+
++extern int __asymmetric_key_hex_to_key_id(const char *id,
++ struct asymmetric_key_id *match_id,
++ size_t hexlen);
+ static inline
+ const struct asymmetric_key_ids *asymmetric_key_ids(const struct key *key)
+ {
+diff --git a/crypto/asymmetric_keys/asymmetric_type.c b/crypto/asymmetric_keys/asymmetric_type.c
+index bcbbbd794e1d..b0e4ed23d668 100644
+--- a/crypto/asymmetric_keys/asymmetric_type.c
++++ b/crypto/asymmetric_keys/asymmetric_type.c
+@@ -104,6 +104,15 @@ static bool asymmetric_match_key_ids(
+ return false;
+ }
+
++/* helper function can be called directly with pre-allocated memory */
++inline int __asymmetric_key_hex_to_key_id(const char *id,
++ struct asymmetric_key_id *match_id,
++ size_t hexlen)
++{
++ match_id->len = hexlen;
++ return hex2bin(match_id->data, id, hexlen);
++}
++
+ /**
+ * asymmetric_key_hex_to_key_id - Convert a hex string into a key ID.
+ * @id: The ID as a hex string.
+@@ -111,21 +120,20 @@ static bool asymmetric_match_key_ids(
+ struct asymmetric_key_id *asymmetric_key_hex_to_key_id(const char *id)
+ {
+ struct asymmetric_key_id *match_id;
+- size_t hexlen;
++ size_t asciihexlen;
+ int ret;
+
+ if (!*id)
+ return ERR_PTR(-EINVAL);
+- hexlen = strlen(id);
+- if (hexlen & 1)
++ asciihexlen = strlen(id);
++ if (asciihexlen & 1)
+ return ERR_PTR(-EINVAL);
+
+- match_id = kmalloc(sizeof(struct asymmetric_key_id) + hexlen / 2,
++ match_id = kmalloc(sizeof(struct asymmetric_key_id) + asciihexlen / 2,
+ GFP_KERNEL);
+ if (!match_id)
+ return ERR_PTR(-ENOMEM);
+- match_id->len = hexlen / 2;
+- ret = hex2bin(match_id->data, id, hexlen / 2);
++ ret = __asymmetric_key_hex_to_key_id(id, match_id, asciihexlen / 2);
+ if (ret < 0) {
+ kfree(match_id);
+ return ERR_PTR(-EINVAL);
+diff --git a/crypto/asymmetric_keys/x509_public_key.c b/crypto/asymmetric_keys/x509_public_key.c
+index a6c42031628e..24f17e6c5904 100644
+--- a/crypto/asymmetric_keys/x509_public_key.c
++++ b/crypto/asymmetric_keys/x509_public_key.c
+@@ -28,17 +28,30 @@ static bool use_builtin_keys;
+ static struct asymmetric_key_id *ca_keyid;
+
+ #ifndef MODULE
++static struct {
++ struct asymmetric_key_id id;
++ unsigned char data[10];
++} cakey;
++
+ static int __init ca_keys_setup(char *str)
+ {
+ if (!str) /* default system keyring */
+ return 1;
+
+ if (strncmp(str, "id:", 3) == 0) {
+- struct asymmetric_key_id *p;
+- p = asymmetric_key_hex_to_key_id(str + 3);
+- if (p == ERR_PTR(-EINVAL))
+- pr_err("Unparsable hex string in ca_keys\n");
+- else if (!IS_ERR(p))
++ struct asymmetric_key_id *p = &cakey.id;
++ size_t hexlen = (strlen(str) - 3) / 2;
++ int ret;
++
++ if (hexlen == 0 || hexlen > sizeof(cakey.data)) {
++ pr_err("Missing or invalid ca_keys id\n");
++ return 1;
++ }
++
++ ret = __asymmetric_key_hex_to_key_id(str + 3, p, hexlen);
++ if (ret < 0)
++ pr_err("Unparsable ca_keys id hex string\n");
++ else
+ ca_keyid = p; /* owner key 'id:xxxxxx' */
+ } else if (strcmp(str, "builtin") == 0) {
+ use_builtin_keys = true;
+diff --git a/drivers/acpi/device_pm.c b/drivers/acpi/device_pm.c
+index 6341e668f362..813397a25594 100644
+--- a/drivers/acpi/device_pm.c
++++ b/drivers/acpi/device_pm.c
+@@ -957,6 +957,7 @@ EXPORT_SYMBOL_GPL(acpi_subsys_prepare);
+ */
+ void acpi_subsys_complete(struct device *dev)
+ {
++ pm_generic_complete(dev);
+ /*
+ * If the device had been runtime-suspended before the system went into
+ * the sleep state it is going out of and it has never been resumed till
+diff --git a/drivers/ata/ahci_mvebu.c b/drivers/ata/ahci_mvebu.c
+index 68672d2692ee..e3267b78b200 100644
+--- a/drivers/ata/ahci_mvebu.c
++++ b/drivers/ata/ahci_mvebu.c
+@@ -43,7 +43,7 @@ static void ahci_mvebu_mbus_config(struct ahci_host_priv *hpriv,
+ writel((cs->mbus_attr << 8) |
+ (dram->mbus_dram_target_id << 4) | 1,
+ hpriv->mmio + AHCI_WINDOW_CTRL(i));
+- writel(cs->base, hpriv->mmio + AHCI_WINDOW_BASE(i));
++ writel(cs->base >> 16, hpriv->mmio + AHCI_WINDOW_BASE(i));
+ writel(((cs->size - 1) & 0xffff0000),
+ hpriv->mmio + AHCI_WINDOW_SIZE(i));
+ }
+diff --git a/drivers/ata/pata_octeon_cf.c b/drivers/ata/pata_octeon_cf.c
+index 2a97d3a531ec..afc252f523f0 100644
+--- a/drivers/ata/pata_octeon_cf.c
++++ b/drivers/ata/pata_octeon_cf.c
+@@ -1053,7 +1053,7 @@ static struct of_device_id octeon_cf_match[] = {
+ },
+ {},
+ };
+-MODULE_DEVICE_TABLE(of, octeon_i2c_match);
++MODULE_DEVICE_TABLE(of, octeon_cf_match);
+
+ static struct platform_driver octeon_cf_driver = {
+ .probe = octeon_cf_probe,
+diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c
+index ee731bb7d957..b389c1dbcdf7 100644
+--- a/drivers/base/regmap/regmap.c
++++ b/drivers/base/regmap/regmap.c
+@@ -944,11 +944,10 @@ EXPORT_SYMBOL_GPL(devm_regmap_init);
+ static void regmap_field_init(struct regmap_field *rm_field,
+ struct regmap *regmap, struct reg_field reg_field)
+ {
+- int field_bits = reg_field.msb - reg_field.lsb + 1;
+ rm_field->regmap = regmap;
+ rm_field->reg = reg_field.reg;
+ rm_field->shift = reg_field.lsb;
+- rm_field->mask = ((BIT(field_bits) - 1) << reg_field.lsb);
++ rm_field->mask = GENMASK(reg_field.msb, reg_field.lsb);
+ rm_field->id_size = reg_field.id_size;
+ rm_field->id_offset = reg_field.id_offset;
+ }
+@@ -2317,7 +2316,7 @@ int regmap_bulk_read(struct regmap *map, unsigned int reg, void *val,
+ &ival);
+ if (ret != 0)
+ return ret;
+- memcpy(val + (i * val_bytes), &ival, val_bytes);
++ map->format.format_val(val + (i * val_bytes), ival, 0);
+ }
+ }
+
+diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c
+index 5d684d97dc6d..501a8ca662f4 100644
+--- a/drivers/block/rbd.c
++++ b/drivers/block/rbd.c
+@@ -1998,11 +1998,11 @@ static struct rbd_obj_request *rbd_obj_request_create(const char *object_name,
+ rbd_assert(obj_request_type_valid(type));
+
+ size = strlen(object_name) + 1;
+- name = kmalloc(size, GFP_KERNEL);
++ name = kmalloc(size, GFP_NOIO);
+ if (!name)
+ return NULL;
+
+- obj_request = kmem_cache_zalloc(rbd_obj_request_cache, GFP_KERNEL);
++ obj_request = kmem_cache_zalloc(rbd_obj_request_cache, GFP_NOIO);
+ if (!obj_request) {
+ kfree(name);
+ return NULL;
+diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c
+index 288547a3c566..8dc319dd3150 100644
+--- a/drivers/bluetooth/ath3k.c
++++ b/drivers/bluetooth/ath3k.c
+@@ -80,6 +80,7 @@ static const struct usb_device_id ath3k_table[] = {
+ { USB_DEVICE(0x0489, 0xe057) },
+ { USB_DEVICE(0x0489, 0xe056) },
+ { USB_DEVICE(0x0489, 0xe05f) },
++ { USB_DEVICE(0x0489, 0xe076) },
+ { USB_DEVICE(0x0489, 0xe078) },
+ { USB_DEVICE(0x04c5, 0x1330) },
+ { USB_DEVICE(0x04CA, 0x3004) },
+@@ -88,6 +89,8 @@ static const struct usb_device_id ath3k_table[] = {
+ { USB_DEVICE(0x04CA, 0x3007) },
+ { USB_DEVICE(0x04CA, 0x3008) },
+ { USB_DEVICE(0x04CA, 0x300b) },
++ { USB_DEVICE(0x04CA, 0x300d) },
++ { USB_DEVICE(0x04CA, 0x300f) },
+ { USB_DEVICE(0x04CA, 0x3010) },
+ { USB_DEVICE(0x0930, 0x0219) },
+ { USB_DEVICE(0x0930, 0x0220) },
+@@ -111,6 +114,7 @@ static const struct usb_device_id ath3k_table[] = {
+ { USB_DEVICE(0x13d3, 0x3408) },
+ { USB_DEVICE(0x13d3, 0x3423) },
+ { USB_DEVICE(0x13d3, 0x3432) },
++ { USB_DEVICE(0x13d3, 0x3474) },
+
+ /* Atheros AR5BBU12 with sflash firmware */
+ { USB_DEVICE(0x0489, 0xE02C) },
+@@ -135,6 +139,7 @@ static const struct usb_device_id ath3k_blist_tbl[] = {
+ { USB_DEVICE(0x0489, 0xe056), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x0489, 0xe057), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x0489, 0xe05f), .driver_info = BTUSB_ATH3012 },
++ { USB_DEVICE(0x0489, 0xe076), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x0489, 0xe078), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x04c5, 0x1330), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x04ca, 0x3004), .driver_info = BTUSB_ATH3012 },
+@@ -143,6 +148,8 @@ static const struct usb_device_id ath3k_blist_tbl[] = {
+ { USB_DEVICE(0x04ca, 0x3007), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x04ca, 0x3008), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x04ca, 0x300b), .driver_info = BTUSB_ATH3012 },
++ { USB_DEVICE(0x04ca, 0x300d), .driver_info = BTUSB_ATH3012 },
++ { USB_DEVICE(0x04ca, 0x300f), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x04ca, 0x3010), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x0930, 0x0220), .driver_info = BTUSB_ATH3012 },
+@@ -166,6 +173,7 @@ static const struct usb_device_id ath3k_blist_tbl[] = {
+ { USB_DEVICE(0x13d3, 0x3408), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x13d3, 0x3423), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x13d3, 0x3432), .driver_info = BTUSB_ATH3012 },
++ { USB_DEVICE(0x13d3, 0x3474), .driver_info = BTUSB_ATH3012 },
+
+ /* Atheros AR5BBU22 with sflash firmware */
+ { USB_DEVICE(0x0489, 0xE036), .driver_info = BTUSB_ATH3012 },
+diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
+index 813bb06a8889..c675e2bd9fd3 100644
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -168,6 +168,7 @@ static const struct usb_device_id blacklist_table[] = {
+ { USB_DEVICE(0x0489, 0xe056), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x0489, 0xe057), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x0489, 0xe05f), .driver_info = BTUSB_ATH3012 },
++ { USB_DEVICE(0x0489, 0xe076), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x0489, 0xe078), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x04c5, 0x1330), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x04ca, 0x3004), .driver_info = BTUSB_ATH3012 },
+@@ -176,6 +177,8 @@ static const struct usb_device_id blacklist_table[] = {
+ { USB_DEVICE(0x04ca, 0x3007), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x04ca, 0x3008), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x04ca, 0x300b), .driver_info = BTUSB_ATH3012 },
++ { USB_DEVICE(0x04ca, 0x300d), .driver_info = BTUSB_ATH3012 },
++ { USB_DEVICE(0x04ca, 0x300f), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x04ca, 0x3010), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x0930, 0x0220), .driver_info = BTUSB_ATH3012 },
+@@ -199,6 +202,7 @@ static const struct usb_device_id blacklist_table[] = {
+ { USB_DEVICE(0x13d3, 0x3408), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x13d3, 0x3423), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x13d3, 0x3432), .driver_info = BTUSB_ATH3012 },
++ { USB_DEVICE(0x13d3, 0x3474), .driver_info = BTUSB_ATH3012 },
+
+ /* Atheros AR5BBU12 with sflash firmware */
+ { USB_DEVICE(0x0489, 0xe02c), .driver_info = BTUSB_IGNORE },
+@@ -1589,6 +1593,8 @@ static int btusb_setup_intel(struct hci_dev *hdev)
+ }
+ fw_ptr = fw->data;
+
++ kfree_skb(skb);
++
+ /* This Intel specific command enables the manufacturer mode of the
+ * controller.
+ *
+diff --git a/drivers/bus/arm-ccn.c b/drivers/bus/arm-ccn.c
+index aaa0f2a87118..60397ec77ff7 100644
+--- a/drivers/bus/arm-ccn.c
++++ b/drivers/bus/arm-ccn.c
+@@ -212,7 +212,7 @@ static int arm_ccn_node_to_xp_port(int node)
+
+ static void arm_ccn_pmu_config_set(u64 *config, u32 node_xp, u32 type, u32 port)
+ {
+- *config &= ~((0xff << 0) | (0xff << 8) | (0xff << 24));
++ *config &= ~((0xff << 0) | (0xff << 8) | (0x3 << 24));
+ *config |= (node_xp << 0) | (type << 8) | (port << 24);
+ }
+
+diff --git a/drivers/char/agp/intel-gtt.c b/drivers/char/agp/intel-gtt.c
+index 9a024f899dd4..9a99d0a3ff08 100644
+--- a/drivers/char/agp/intel-gtt.c
++++ b/drivers/char/agp/intel-gtt.c
+@@ -585,7 +585,7 @@ static inline int needs_ilk_vtd_wa(void)
+ /* Query intel_iommu to see if we need the workaround. Presumably that
+ * was loaded first.
+ */
+- if ((gpu_devid == PCI_DEVICE_ID_INTEL_IRONLAKE_M_HB ||
++ if ((gpu_devid == PCI_DEVICE_ID_INTEL_IRONLAKE_D_IG ||
+ gpu_devid == PCI_DEVICE_ID_INTEL_IRONLAKE_M_IG) &&
+ intel_iommu_gfx_mapped)
+ return 1;
+diff --git a/drivers/char/tpm/tpm_ibmvtpm.c b/drivers/char/tpm/tpm_ibmvtpm.c
+index 102463ba745d..643bba7d6f81 100644
+--- a/drivers/char/tpm/tpm_ibmvtpm.c
++++ b/drivers/char/tpm/tpm_ibmvtpm.c
+@@ -579,6 +579,9 @@ static int tpm_ibmvtpm_probe(struct vio_dev *vio_dev,
+ goto cleanup;
+ }
+
++ ibmvtpm->dev = dev;
++ ibmvtpm->vdev = vio_dev;
++
+ crq_q = &ibmvtpm->crq_queue;
+ crq_q->crq_addr = (struct ibmvtpm_crq *)get_zeroed_page(GFP_KERNEL);
+ if (!crq_q->crq_addr) {
+@@ -623,8 +626,6 @@ static int tpm_ibmvtpm_probe(struct vio_dev *vio_dev,
+
+ crq_q->index = 0;
+
+- ibmvtpm->dev = dev;
+- ibmvtpm->vdev = vio_dev;
+ TPM_VPRIV(chip) = (void *)ibmvtpm;
+
+ spin_lock_init(&ibmvtpm->rtce_lock);
+diff --git a/drivers/clk/at91/clk-pll.c b/drivers/clk/at91/clk-pll.c
+index 6ec79dbc0840..cbbe40377ad6 100644
+--- a/drivers/clk/at91/clk-pll.c
++++ b/drivers/clk/at91/clk-pll.c
+@@ -173,8 +173,7 @@ static long clk_pll_get_best_div_mul(struct clk_pll *pll, unsigned long rate,
+ int i = 0;
+
+ /* Check if parent_rate is a valid input rate */
+- if (parent_rate < characteristics->input.min ||
+- parent_rate > characteristics->input.max)
++ if (parent_rate < characteristics->input.min)
+ return -ERANGE;
+
+ /*
+@@ -187,6 +186,15 @@ static long clk_pll_get_best_div_mul(struct clk_pll *pll, unsigned long rate,
+ if (!mindiv)
+ mindiv = 1;
+
++ if (parent_rate > characteristics->input.max) {
++ tmpdiv = DIV_ROUND_UP(parent_rate, characteristics->input.max);
++ if (tmpdiv > PLL_DIV_MAX)
++ return -ERANGE;
++
++ if (tmpdiv > mindiv)
++ mindiv = tmpdiv;
++ }
++
+ /*
+ * Calculate the maximum divider which is limited by PLL register
+ * layout (limited by the MUL or DIV field size).
+diff --git a/drivers/clk/at91/pmc.h b/drivers/clk/at91/pmc.h
+index 52d2041fa3f6..af2c99195541 100644
+--- a/drivers/clk/at91/pmc.h
++++ b/drivers/clk/at91/pmc.h
+@@ -120,7 +120,7 @@ extern void __init of_at91sam9x5_clk_smd_setup(struct device_node *np,
+ struct at91_pmc *pmc);
+ #endif
+
+-#if defined(CONFIG_HAVE_AT91_SMD)
++#if defined(CONFIG_HAVE_AT91_H32MX)
+ extern void __init of_sama5d4_clk_h32mx_setup(struct device_node *np,
+ struct at91_pmc *pmc);
+ #endif
+diff --git a/drivers/clocksource/exynos_mct.c b/drivers/clocksource/exynos_mct.c
+index 83564c9cfdbe..c844616028d2 100644
+--- a/drivers/clocksource/exynos_mct.c
++++ b/drivers/clocksource/exynos_mct.c
+@@ -466,15 +466,12 @@ static int exynos4_local_timer_setup(struct clock_event_device *evt)
+ exynos4_mct_write(TICK_BASE_CNT, mevt->base + MCT_L_TCNTB_OFFSET);
+
+ if (mct_int_type == MCT_INT_SPI) {
+- evt->irq = mct_irqs[MCT_L0_IRQ + cpu];
+- if (request_irq(evt->irq, exynos4_mct_tick_isr,
+- IRQF_TIMER | IRQF_NOBALANCING,
+- evt->name, mevt)) {
+- pr_err("exynos-mct: cannot register IRQ %d\n",
+- evt->irq);
++
++ if (evt->irq == -1)
+ return -EIO;
+- }
+- irq_force_affinity(mct_irqs[MCT_L0_IRQ + cpu], cpumask_of(cpu));
++
++ irq_force_affinity(evt->irq, cpumask_of(cpu));
++ enable_irq(evt->irq);
+ } else {
+ enable_percpu_irq(mct_irqs[MCT_L0_IRQ], 0);
+ }
+@@ -487,10 +484,12 @@ static int exynos4_local_timer_setup(struct clock_event_device *evt)
+ static void exynos4_local_timer_stop(struct clock_event_device *evt)
+ {
+ evt->set_mode(CLOCK_EVT_MODE_UNUSED, evt);
+- if (mct_int_type == MCT_INT_SPI)
+- free_irq(evt->irq, this_cpu_ptr(&percpu_mct_tick));
+- else
++ if (mct_int_type == MCT_INT_SPI) {
++ if (evt->irq != -1)
++ disable_irq_nosync(evt->irq);
++ } else {
+ disable_percpu_irq(mct_irqs[MCT_L0_IRQ]);
++ }
+ }
+
+ static int exynos4_mct_cpu_notify(struct notifier_block *self,
+@@ -522,7 +521,7 @@ static struct notifier_block exynos4_mct_cpu_nb = {
+
+ static void __init exynos4_timer_resources(struct device_node *np, void __iomem *base)
+ {
+- int err;
++ int err, cpu;
+ struct mct_clock_event_device *mevt = this_cpu_ptr(&percpu_mct_tick);
+ struct clk *mct_clk, *tick_clk;
+
+@@ -549,7 +548,25 @@ static void __init exynos4_timer_resources(struct device_node *np, void __iomem
+ WARN(err, "MCT: can't request IRQ %d (%d)\n",
+ mct_irqs[MCT_L0_IRQ], err);
+ } else {
+- irq_set_affinity(mct_irqs[MCT_L0_IRQ], cpumask_of(0));
++ for_each_possible_cpu(cpu) {
++ int mct_irq = mct_irqs[MCT_L0_IRQ + cpu];
++ struct mct_clock_event_device *pcpu_mevt =
++ per_cpu_ptr(&percpu_mct_tick, cpu);
++
++ pcpu_mevt->evt.irq = -1;
++
++ irq_set_status_flags(mct_irq, IRQ_NOAUTOEN);
++ if (request_irq(mct_irq,
++ exynos4_mct_tick_isr,
++ IRQF_TIMER | IRQF_NOBALANCING,
++ pcpu_mevt->name, pcpu_mevt)) {
++ pr_err("exynos-mct: cannot register IRQ (cpu%d)\n",
++ cpu);
++
++ continue;
++ }
++ pcpu_mevt->evt.irq = mct_irq;
++ }
+ }
+
+ err = register_cpu_notifier(&exynos4_mct_cpu_nb);
+diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
+index 27bb6d3877ed..d0d21363c63f 100644
+--- a/drivers/cpufreq/intel_pstate.c
++++ b/drivers/cpufreq/intel_pstate.c
+@@ -443,7 +443,7 @@ static void byt_set_pstate(struct cpudata *cpudata, int pstate)
+
+ val |= vid;
+
+- wrmsrl(MSR_IA32_PERF_CTL, val);
++ wrmsrl_on_cpu(cpudata->cpu, MSR_IA32_PERF_CTL, val);
+ }
+
+ #define BYT_BCLK_FREQS 5
+diff --git a/drivers/crypto/caam/caamhash.c b/drivers/crypto/caam/caamhash.c
+index f347ab7eea95..08b0da23c4ab 100644
+--- a/drivers/crypto/caam/caamhash.c
++++ b/drivers/crypto/caam/caamhash.c
+@@ -1543,6 +1543,8 @@ static int ahash_init(struct ahash_request *req)
+
+ state->current_buf = 0;
+ state->buf_dma = 0;
++ state->buflen_0 = 0;
++ state->buflen_1 = 0;
+
+ return 0;
+ }
+diff --git a/drivers/crypto/caam/caamrng.c b/drivers/crypto/caam/caamrng.c
+index ae31e555793c..a48dc251b14f 100644
+--- a/drivers/crypto/caam/caamrng.c
++++ b/drivers/crypto/caam/caamrng.c
+@@ -56,7 +56,7 @@
+
+ /* Buffer, its dma address and lock */
+ struct buf_data {
+- u8 buf[RN_BUF_SIZE];
++ u8 buf[RN_BUF_SIZE] ____cacheline_aligned;
+ dma_addr_t addr;
+ struct completion filled;
+ u32 hw_desc[DESC_JOB_O_LEN];
+diff --git a/drivers/crypto/talitos.c b/drivers/crypto/talitos.c
+index 624b8be0c365..307931528eb2 100644
+--- a/drivers/crypto/talitos.c
++++ b/drivers/crypto/talitos.c
+@@ -927,7 +927,8 @@ static int sg_to_link_tbl(struct scatterlist *sg, int sg_count,
+ sg_count--;
+ link_tbl_ptr--;
+ }
+- be16_add_cpu(&link_tbl_ptr->len, cryptlen);
++ link_tbl_ptr->len = cpu_to_be16(be16_to_cpu(link_tbl_ptr->len)
++ + cryptlen);
+
+ /* tag end of link table */
+ link_tbl_ptr->j_extent = DESC_PTR_LNKTBL_RETURN;
+@@ -2563,6 +2564,7 @@ static struct talitos_crypto_alg *talitos_alg_alloc(struct device *dev,
+ break;
+ default:
+ dev_err(dev, "unknown algorithm type %d\n", t_alg->algt.type);
++ kfree(t_alg);
+ return ERR_PTR(-EINVAL);
+ }
+
+diff --git a/drivers/dma/mv_xor.c b/drivers/dma/mv_xor.c
+index a63837ca1410..ede8e868016d 100644
+--- a/drivers/dma/mv_xor.c
++++ b/drivers/dma/mv_xor.c
+@@ -277,7 +277,8 @@ static void mv_xor_slot_cleanup(struct mv_xor_chan *mv_chan)
+ dma_cookie_t cookie = 0;
+ int busy = mv_chan_is_busy(mv_chan);
+ u32 current_desc = mv_chan_get_current_desc(mv_chan);
+- int seen_current = 0;
++ int current_cleaned = 0;
++ struct mv_xor_desc *hw_desc;
+
+ dev_dbg(mv_chan_to_devp(mv_chan), "%s %d\n", __func__, __LINE__);
+ dev_dbg(mv_chan_to_devp(mv_chan), "current_desc %x\n", current_desc);
+@@ -289,38 +290,57 @@ static void mv_xor_slot_cleanup(struct mv_xor_chan *mv_chan)
+
+ list_for_each_entry_safe(iter, _iter, &mv_chan->chain,
+ chain_node) {
+- prefetch(_iter);
+- prefetch(&_iter->async_tx);
+
+- /* do not advance past the current descriptor loaded into the
+- * hardware channel, subsequent descriptors are either in
+- * process or have not been submitted
+- */
+- if (seen_current)
+- break;
++ /* clean finished descriptors */
++ hw_desc = iter->hw_desc;
++ if (hw_desc->status & XOR_DESC_SUCCESS) {
++ cookie = mv_xor_run_tx_complete_actions(iter, mv_chan,
++ cookie);
+
+- /* stop the search if we reach the current descriptor and the
+- * channel is busy
+- */
+- if (iter->async_tx.phys == current_desc) {
+- seen_current = 1;
+- if (busy)
++ /* done processing desc, clean slot */
++ mv_xor_clean_slot(iter, mv_chan);
++
++ /* break if we did cleaned the current */
++ if (iter->async_tx.phys == current_desc) {
++ current_cleaned = 1;
++ break;
++ }
++ } else {
++ if (iter->async_tx.phys == current_desc) {
++ current_cleaned = 0;
+ break;
++ }
+ }
+-
+- cookie = mv_xor_run_tx_complete_actions(iter, mv_chan, cookie);
+-
+- if (mv_xor_clean_slot(iter, mv_chan))
+- break;
+ }
+
+ if ((busy == 0) && !list_empty(&mv_chan->chain)) {
+- struct mv_xor_desc_slot *chain_head;
+- chain_head = list_entry(mv_chan->chain.next,
+- struct mv_xor_desc_slot,
+- chain_node);
+-
+- mv_xor_start_new_chain(mv_chan, chain_head);
++ if (current_cleaned) {
++ /*
++ * current descriptor cleaned and removed, run
++ * from list head
++ */
++ iter = list_entry(mv_chan->chain.next,
++ struct mv_xor_desc_slot,
++ chain_node);
++ mv_xor_start_new_chain(mv_chan, iter);
++ } else {
++ if (!list_is_last(&iter->chain_node, &mv_chan->chain)) {
++ /*
++ * descriptors are still waiting after
++ * current, trigger them
++ */
++ iter = list_entry(iter->chain_node.next,
++ struct mv_xor_desc_slot,
++ chain_node);
++ mv_xor_start_new_chain(mv_chan, iter);
++ } else {
++ /*
++ * some descriptors are still waiting
++ * to be cleaned
++ */
++ tasklet_schedule(&mv_chan->irq_tasklet);
++ }
++ }
+ }
+
+ if (cookie > 0)
+diff --git a/drivers/dma/mv_xor.h b/drivers/dma/mv_xor.h
+index 78edc7e44569..4fa0fe2e2f08 100644
+--- a/drivers/dma/mv_xor.h
++++ b/drivers/dma/mv_xor.h
+@@ -35,6 +35,7 @@
+ #define XOR_OPERATION_MODE_XOR 0
+ #define XOR_OPERATION_MODE_MEMCPY 2
+ #define XOR_DESCRIPTOR_SWAP BIT(14)
++#define XOR_DESC_SUCCESS 0x40000000
+
+ #define XOR_DESC_DMA_OWNED BIT(31)
+ #define XOR_DESC_EOD_INT_EN BIT(31)
+diff --git a/drivers/gpio/gpio-crystalcove.c b/drivers/gpio/gpio-crystalcove.c
+index a7cf0c193ba8..2a8791cc138a 100644
+--- a/drivers/gpio/gpio-crystalcove.c
++++ b/drivers/gpio/gpio-crystalcove.c
+@@ -250,6 +250,7 @@ static struct irq_chip crystalcove_irqchip = {
+ .irq_set_type = crystalcove_irq_type,
+ .irq_bus_lock = crystalcove_bus_lock,
+ .irq_bus_sync_unlock = crystalcove_bus_sync_unlock,
++ .flags = IRQCHIP_SKIP_SET_WAKE,
+ };
+
+ static irqreturn_t crystalcove_gpio_irq_handler(int irq, void *data)
+diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c
+index f50d884b81cf..1f5e42a1f5b4 100644
+--- a/drivers/gpu/drm/drm_dp_mst_topology.c
++++ b/drivers/gpu/drm/drm_dp_mst_topology.c
+@@ -1152,6 +1152,8 @@ static struct drm_dp_mst_branch *drm_dp_get_mst_branch_device(struct drm_dp_mst_
+ struct drm_dp_mst_port *port;
+ int i;
+ /* find the port by iterating down */
++
++ mutex_lock(&mgr->lock);
+ mstb = mgr->mst_primary;
+
+ for (i = 0; i < lct - 1; i++) {
+@@ -1171,6 +1173,7 @@ static struct drm_dp_mst_branch *drm_dp_get_mst_branch_device(struct drm_dp_mst_
+ }
+ }
+ kref_get(&mstb->kref);
++ mutex_unlock(&mgr->lock);
+ return mstb;
+ }
+
+@@ -1178,7 +1181,7 @@ static void drm_dp_check_and_send_link_address(struct drm_dp_mst_topology_mgr *m
+ struct drm_dp_mst_branch *mstb)
+ {
+ struct drm_dp_mst_port *port;
+-
++ struct drm_dp_mst_branch *mstb_child;
+ if (!mstb->link_address_sent) {
+ drm_dp_send_link_address(mgr, mstb);
+ mstb->link_address_sent = true;
+@@ -1193,17 +1196,31 @@ static void drm_dp_check_and_send_link_address(struct drm_dp_mst_topology_mgr *m
+ if (!port->available_pbn)
+ drm_dp_send_enum_path_resources(mgr, mstb, port);
+
+- if (port->mstb)
+- drm_dp_check_and_send_link_address(mgr, port->mstb);
++ if (port->mstb) {
++ mstb_child = drm_dp_get_validated_mstb_ref(mgr, port->mstb);
++ if (mstb_child) {
++ drm_dp_check_and_send_link_address(mgr, mstb_child);
++ drm_dp_put_mst_branch_device(mstb_child);
++ }
++ }
+ }
+ }
+
+ static void drm_dp_mst_link_probe_work(struct work_struct *work)
+ {
+ struct drm_dp_mst_topology_mgr *mgr = container_of(work, struct drm_dp_mst_topology_mgr, work);
++ struct drm_dp_mst_branch *mstb;
+
+- drm_dp_check_and_send_link_address(mgr, mgr->mst_primary);
+-
++ mutex_lock(&mgr->lock);
++ mstb = mgr->mst_primary;
++ if (mstb) {
++ kref_get(&mstb->kref);
++ }
++ mutex_unlock(&mgr->lock);
++ if (mstb) {
++ drm_dp_check_and_send_link_address(mgr, mstb);
++ drm_dp_put_mst_branch_device(mstb);
++ }
+ }
+
+ static bool drm_dp_validate_guid(struct drm_dp_mst_topology_mgr *mgr,
+diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
+index e08a4729596b..9bf747f2a32b 100644
+--- a/drivers/gpu/drm/i915/i915_reg.h
++++ b/drivers/gpu/drm/i915/i915_reg.h
+@@ -5768,6 +5768,7 @@ enum punit_power_well {
+ #define HSW_ROW_CHICKEN3_L3_GLOBAL_ATOMICS_DISABLE (1 << 6)
+
+ #define HALF_SLICE_CHICKEN3 0xe184
++#define HSW_SAMPLE_C_PERFORMANCE (1<<9)
+ #define GEN8_CENTROID_PIXEL_OPT_DIS (1<<8)
+ #define GEN8_SAMPLER_POWER_BYPASS_DIS (1<<1)
+
+diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
+index a29db0a1da42..3104d06aa20c 100644
+--- a/drivers/gpu/drm/i915/intel_dp.c
++++ b/drivers/gpu/drm/i915/intel_dp.c
+@@ -778,10 +778,8 @@ intel_dp_aux_ch(struct intel_dp *intel_dp,
+ DP_AUX_CH_CTL_RECEIVE_ERROR))
+ continue;
+ if (status & DP_AUX_CH_CTL_DONE)
+- break;
++ goto done;
+ }
+- if (status & DP_AUX_CH_CTL_DONE)
+- break;
+ }
+
+ if ((status & DP_AUX_CH_CTL_DONE) == 0) {
+@@ -790,6 +788,7 @@ intel_dp_aux_ch(struct intel_dp *intel_dp,
+ goto out;
+ }
+
++done:
+ /* Check for timeout or receive error.
+ * Timeouts occur when the sink is not connected
+ */
+diff --git a/drivers/gpu/drm/i915/intel_i2c.c b/drivers/gpu/drm/i915/intel_i2c.c
+index 56e437e31580..ae628001fd97 100644
+--- a/drivers/gpu/drm/i915/intel_i2c.c
++++ b/drivers/gpu/drm/i915/intel_i2c.c
+@@ -435,7 +435,7 @@ gmbus_xfer(struct i2c_adapter *adapter,
+ struct intel_gmbus,
+ adapter);
+ struct drm_i915_private *dev_priv = bus->dev_priv;
+- int i, reg_offset;
++ int i = 0, inc, try = 0, reg_offset;
+ int ret = 0;
+
+ intel_aux_display_runtime_get(dev_priv);
+@@ -448,12 +448,14 @@ gmbus_xfer(struct i2c_adapter *adapter,
+
+ reg_offset = dev_priv->gpio_mmio_base;
+
++retry:
+ I915_WRITE(GMBUS0 + reg_offset, bus->reg0);
+
+- for (i = 0; i < num; i++) {
++ for (; i < num; i += inc) {
++ inc = 1;
+ if (gmbus_is_index_read(msgs, i, num)) {
+ ret = gmbus_xfer_index_read(dev_priv, &msgs[i]);
+- i += 1; /* set i to the index of the read xfer */
++ inc = 2; /* an index read is two msgs */
+ } else if (msgs[i].flags & I2C_M_RD) {
+ ret = gmbus_xfer_read(dev_priv, &msgs[i], 0);
+ } else {
+@@ -525,6 +527,18 @@ clear_err:
+ adapter->name, msgs[i].addr,
+ (msgs[i].flags & I2C_M_RD) ? 'r' : 'w', msgs[i].len);
+
++ /*
++ * Passive adapters sometimes NAK the first probe. Retry the first
++ * message once on -ENXIO for GMBUS transfers; the bit banging algorithm
++ * has retries internally. See also the retry loop in
++ * drm_do_probe_ddc_edid, which bails out on the first -ENXIO.
++ */
++ if (ret == -ENXIO && i == 0 && try++ == 0) {
++ DRM_DEBUG_KMS("GMBUS [%s] NAK on first message, retry\n",
++ adapter->name);
++ goto retry;
++ }
++
+ goto out;
+
+ timeout:
+diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
+index 83c7ecf2608a..c64f1942e8de 100644
+--- a/drivers/gpu/drm/i915/intel_pm.c
++++ b/drivers/gpu/drm/i915/intel_pm.c
+@@ -5691,6 +5691,10 @@ static void haswell_init_clock_gating(struct drm_device *dev)
+ I915_WRITE(GEN7_GT_MODE,
+ GEN6_WIZ_HASHING_MASK | GEN6_WIZ_HASHING_16x4);
+
++ /* WaSampleCChickenBitEnable:hsw */
++ I915_WRITE(HALF_SLICE_CHICKEN3,
++ _MASKED_BIT_ENABLE(HSW_SAMPLE_C_PERFORMANCE));
++
+ /* WaSwitchSolVfFArbitrationPriority:hsw */
+ I915_WRITE(GAM_ECOCHK, I915_READ(GAM_ECOCHK) | HSW_ECOCHK_ARB_PRIO_SOL);
+
+diff --git a/drivers/gpu/drm/mgag200/mgag200_mode.c b/drivers/gpu/drm/mgag200/mgag200_mode.c
+index 83485ab81ce8..d8e693d1f6d4 100644
+--- a/drivers/gpu/drm/mgag200/mgag200_mode.c
++++ b/drivers/gpu/drm/mgag200/mgag200_mode.c
+@@ -1525,6 +1525,11 @@ static int mga_vga_mode_valid(struct drm_connector *connector,
+ return MODE_BANDWIDTH;
+ }
+
++ if ((mode->hdisplay % 8) != 0 || (mode->hsync_start % 8) != 0 ||
++ (mode->hsync_end % 8) != 0 || (mode->htotal % 8) != 0) {
++ return MODE_H_ILLEGAL;
++ }
++
+ if (mode->crtc_hdisplay > 2048 || mode->crtc_hsync_start > 4096 ||
+ mode->crtc_hsync_end > 4096 || mode->crtc_htotal > 4096 ||
+ mode->crtc_vdisplay > 2048 || mode->crtc_vsync_start > 4096 ||
+diff --git a/drivers/gpu/drm/qxl/qxl_cmd.c b/drivers/gpu/drm/qxl/qxl_cmd.c
+index 97823644d347..f33251d67914 100644
+--- a/drivers/gpu/drm/qxl/qxl_cmd.c
++++ b/drivers/gpu/drm/qxl/qxl_cmd.c
+@@ -505,6 +505,7 @@ int qxl_hw_surface_alloc(struct qxl_device *qdev,
+
+ cmd = (struct qxl_surface_cmd *)qxl_release_map(qdev, release);
+ cmd->type = QXL_SURFACE_CMD_CREATE;
++ cmd->flags = QXL_SURF_FLAG_KEEP_DATA;
+ cmd->u.surface_create.format = surf->surf.format;
+ cmd->u.surface_create.width = surf->surf.width;
+ cmd->u.surface_create.height = surf->surf.height;
+diff --git a/drivers/gpu/drm/qxl/qxl_ioctl.c b/drivers/gpu/drm/qxl/qxl_ioctl.c
+index b110883f8253..7354a4cda59d 100644
+--- a/drivers/gpu/drm/qxl/qxl_ioctl.c
++++ b/drivers/gpu/drm/qxl/qxl_ioctl.c
+@@ -122,8 +122,10 @@ static struct qxl_bo *qxlhw_handle_to_bo(struct qxl_device *qdev,
+ qobj = gem_to_qxl_bo(gobj);
+
+ ret = qxl_release_list_add(release, qobj);
+- if (ret)
++ if (ret) {
++ drm_gem_object_unreference_unlocked(gobj);
+ return NULL;
++ }
+
+ return qobj;
+ }
+diff --git a/drivers/gpu/drm/radeon/atombios_crtc.c b/drivers/gpu/drm/radeon/atombios_crtc.c
+index 4f9ec36698f7..ce8cab52285b 100644
+--- a/drivers/gpu/drm/radeon/atombios_crtc.c
++++ b/drivers/gpu/drm/radeon/atombios_crtc.c
+@@ -580,9 +580,6 @@ static u32 atombios_adjust_pll(struct drm_crtc *crtc,
+ else
+ radeon_crtc->pll_flags |= RADEON_PLL_PREFER_LOW_REF_DIV;
+
+- /* if there is no audio, set MINM_OVER_MAXP */
+- if (!drm_detect_monitor_audio(radeon_connector_edid(connector)))
+- radeon_crtc->pll_flags |= RADEON_PLL_PREFER_MINM_OVER_MAXP;
+ if (rdev->family < CHIP_RV770)
+ radeon_crtc->pll_flags |= RADEON_PLL_PREFER_MINM_OVER_MAXP;
+ /* use frac fb div on APUs */
+@@ -1789,9 +1786,7 @@ static int radeon_get_shared_nondp_ppll(struct drm_crtc *crtc)
+ if ((crtc->mode.clock == test_crtc->mode.clock) &&
+ (adjusted_clock == test_adjusted_clock) &&
+ (radeon_crtc->ss_enabled == test_radeon_crtc->ss_enabled) &&
+- (test_radeon_crtc->pll_id != ATOM_PPLL_INVALID) &&
+- (drm_detect_monitor_audio(radeon_connector_edid(test_radeon_crtc->connector)) ==
+- drm_detect_monitor_audio(radeon_connector_edid(radeon_crtc->connector))))
++ (test_radeon_crtc->pll_id != ATOM_PPLL_INVALID))
+ return test_radeon_crtc->pll_id;
+ }
+ }
+diff --git a/drivers/gpu/drm/radeon/cik.c b/drivers/gpu/drm/radeon/cik.c
+index 63e8bff5d47a..87073e69fc0d 100644
+--- a/drivers/gpu/drm/radeon/cik.c
++++ b/drivers/gpu/drm/radeon/cik.c
+@@ -4523,6 +4523,31 @@ void cik_compute_set_wptr(struct radeon_device *rdev,
+ WDOORBELL32(ring->doorbell_index, ring->wptr);
+ }
+
++static void cik_compute_stop(struct radeon_device *rdev,
++ struct radeon_ring *ring)
++{
++ u32 j, tmp;
++
++ cik_srbm_select(rdev, ring->me, ring->pipe, ring->queue, 0);
++ /* Disable wptr polling. */
++ tmp = RREG32(CP_PQ_WPTR_POLL_CNTL);
++ tmp &= ~WPTR_POLL_EN;
++ WREG32(CP_PQ_WPTR_POLL_CNTL, tmp);
++ /* Disable HQD. */
++ if (RREG32(CP_HQD_ACTIVE) & 1) {
++ WREG32(CP_HQD_DEQUEUE_REQUEST, 1);
++ for (j = 0; j < rdev->usec_timeout; j++) {
++ if (!(RREG32(CP_HQD_ACTIVE) & 1))
++ break;
++ udelay(1);
++ }
++ WREG32(CP_HQD_DEQUEUE_REQUEST, 0);
++ WREG32(CP_HQD_PQ_RPTR, 0);
++ WREG32(CP_HQD_PQ_WPTR, 0);
++ }
++ cik_srbm_select(rdev, 0, 0, 0, 0);
++}
++
+ /**
+ * cik_cp_compute_enable - enable/disable the compute CP MEs
+ *
+@@ -4536,6 +4561,15 @@ static void cik_cp_compute_enable(struct radeon_device *rdev, bool enable)
+ if (enable)
+ WREG32(CP_MEC_CNTL, 0);
+ else {
++ /*
++ * To make hibernation reliable we need to clear compute ring
++ * configuration before halting the compute ring.
++ */
++ mutex_lock(&rdev->srbm_mutex);
++ cik_compute_stop(rdev,&rdev->ring[CAYMAN_RING_TYPE_CP1_INDEX]);
++ cik_compute_stop(rdev,&rdev->ring[CAYMAN_RING_TYPE_CP2_INDEX]);
++ mutex_unlock(&rdev->srbm_mutex);
++
+ WREG32(CP_MEC_CNTL, (MEC_ME1_HALT | MEC_ME2_HALT));
+ rdev->ring[CAYMAN_RING_TYPE_CP1_INDEX].ready = false;
+ rdev->ring[CAYMAN_RING_TYPE_CP2_INDEX].ready = false;
+diff --git a/drivers/gpu/drm/radeon/cik_sdma.c b/drivers/gpu/drm/radeon/cik_sdma.c
+index d748963af08b..02246acba36a 100644
+--- a/drivers/gpu/drm/radeon/cik_sdma.c
++++ b/drivers/gpu/drm/radeon/cik_sdma.c
+@@ -268,6 +268,17 @@ static void cik_sdma_gfx_stop(struct radeon_device *rdev)
+ }
+ rdev->ring[R600_RING_TYPE_DMA_INDEX].ready = false;
+ rdev->ring[CAYMAN_RING_TYPE_DMA1_INDEX].ready = false;
++
++ /* FIXME use something else than big hammer but after few days can not
++ * seem to find good combination so reset SDMA blocks as it seems we
++ * do not shut them down properly. This fix hibernation and does not
++ * affect suspend to ram.
++ */
++ WREG32(SRBM_SOFT_RESET, SOFT_RESET_SDMA | SOFT_RESET_SDMA1);
++ (void)RREG32(SRBM_SOFT_RESET);
++ udelay(50);
++ WREG32(SRBM_SOFT_RESET, 0);
++ (void)RREG32(SRBM_SOFT_RESET);
+ }
+
+ /**
+diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
+index bdf263a4a67c..5d54ab0fbe2b 100644
+--- a/drivers/gpu/drm/radeon/radeon_device.c
++++ b/drivers/gpu/drm/radeon/radeon_device.c
+@@ -1426,6 +1426,21 @@ int radeon_device_init(struct radeon_device *rdev,
+ if (r)
+ DRM_ERROR("ib ring test failed (%d).\n", r);
+
++ /*
++ * Turks/Thames GPU will freeze whole laptop if DPM is not restarted
++ * after the CP ring have chew one packet at least. Hence here we stop
++ * and restart DPM after the radeon_ib_ring_tests().
++ */
++ if (rdev->pm.dpm_enabled &&
++ (rdev->pm.pm_method == PM_METHOD_DPM) &&
++ (rdev->family == CHIP_TURKS) &&
++ (rdev->flags & RADEON_IS_MOBILITY)) {
++ mutex_lock(&rdev->pm.mutex);
++ radeon_dpm_disable(rdev);
++ radeon_dpm_enable(rdev);
++ mutex_unlock(&rdev->pm.mutex);
++ }
++
+ if ((radeon_testing & 1)) {
+ if (rdev->accel_working)
+ radeon_test_moves(rdev);
+diff --git a/drivers/gpu/drm/radeon/radeon_irq_kms.c b/drivers/gpu/drm/radeon/radeon_irq_kms.c
+index 00fc59762e0d..bbcd754dc7d0 100644
+--- a/drivers/gpu/drm/radeon/radeon_irq_kms.c
++++ b/drivers/gpu/drm/radeon/radeon_irq_kms.c
+@@ -79,10 +79,12 @@ static void radeon_hotplug_work_func(struct work_struct *work)
+ struct drm_mode_config *mode_config = &dev->mode_config;
+ struct drm_connector *connector;
+
++ mutex_lock(&mode_config->mutex);
+ if (mode_config->num_connector) {
+ list_for_each_entry(connector, &mode_config->connector_list, head)
+ radeon_connector_hotplug(connector);
+ }
++ mutex_unlock(&mode_config->mutex);
+ /* Just fire off a uevent and let userspace tell us what to do */
+ drm_helper_hpd_irq_event(dev);
+ }
+diff --git a/drivers/gpu/drm/radeon/radeon_kms.c b/drivers/gpu/drm/radeon/radeon_kms.c
+index 8ec652722e4f..46bcd5d38a1e 100644
+--- a/drivers/gpu/drm/radeon/radeon_kms.c
++++ b/drivers/gpu/drm/radeon/radeon_kms.c
+@@ -540,6 +540,9 @@ static int radeon_info_ioctl(struct drm_device *dev, void *data, struct drm_file
+ else
+ *value = 1;
+ break;
++ case RADEON_INFO_VA_UNMAP_WORKING:
++ *value = true;
++ break;
+ default:
+ DRM_DEBUG_KMS("Invalid request %d\n", info->request);
+ return -EINVAL;
+diff --git a/drivers/gpu/drm/radeon/radeon_vm.c b/drivers/gpu/drm/radeon/radeon_vm.c
+index 2ab80a5331a4..190eb5bee4eb 100644
+--- a/drivers/gpu/drm/radeon/radeon_vm.c
++++ b/drivers/gpu/drm/radeon/radeon_vm.c
+@@ -513,6 +513,8 @@ int radeon_vm_bo_set_addr(struct radeon_device *rdev,
+ tmp->addr = bo_va->addr;
+ tmp->bo = radeon_bo_ref(bo_va->bo);
+ list_add(&tmp->vm_status, &vm->freed);
++
++ bo_va->addr = 0;
+ }
+
+ interval_tree_remove(&bo_va->it, &vm->va);
+@@ -1058,7 +1060,8 @@ void radeon_vm_bo_rmv(struct radeon_device *rdev,
+ list_del(&bo_va->bo_list);
+
+ mutex_lock(&vm->mutex);
+- interval_tree_remove(&bo_va->it, &vm->va);
++ if (bo_va->it.start || bo_va->it.last)
++ interval_tree_remove(&bo_va->it, &vm->va);
+ list_del(&bo_va->vm_status);
+
+ if (bo_va->addr) {
+diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
+index 77ba023cab95..7eda03c13805 100644
+--- a/drivers/hid/hid-core.c
++++ b/drivers/hid/hid-core.c
+@@ -1919,6 +1919,7 @@ static const struct hid_device_id hid_have_special_driver[] = {
+ { HID_USB_DEVICE(USB_VENDOR_ID_SAMSUNG, USB_DEVICE_ID_SAMSUNG_IR_REMOTE) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_SAMSUNG, USB_DEVICE_ID_SAMSUNG_WIRELESS_KBD_MOUSE) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_SKYCABLE, USB_DEVICE_ID_SKYCABLE_WIRELESS_PRESENTER) },
++ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_SMK, USB_DEVICE_ID_SMK_PS3_BDREMOTE) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_SONY, USB_DEVICE_ID_SONY_BUZZ_CONTROLLER) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_SONY, USB_DEVICE_ID_SONY_WIRELESS_BUZZ_CONTROLLER) },
+ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_SONY, USB_DEVICE_ID_SONY_PS3_BDREMOTE) },
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index 07e19295fad9..252a7ed40f86 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -829,6 +829,9 @@
+ #define USB_VENDOR_ID_SKYCABLE 0x1223
+ #define USB_DEVICE_ID_SKYCABLE_WIRELESS_PRESENTER 0x3F07
+
++#define USB_VENDOR_ID_SMK 0x0609
++#define USB_DEVICE_ID_SMK_PS3_BDREMOTE 0x0306
++
+ #define USB_VENDOR_ID_SONY 0x054c
+ #define USB_DEVICE_ID_SONY_VAIO_VGX_MOUSE 0x024b
+ #define USB_DEVICE_ID_SONY_VAIO_VGP_MOUSE 0x0374
+diff --git a/drivers/hid/hid-sony.c b/drivers/hid/hid-sony.c
+index bc4269e559f1..15b3475e641d 100644
+--- a/drivers/hid/hid-sony.c
++++ b/drivers/hid/hid-sony.c
+@@ -2034,6 +2034,9 @@ static const struct hid_device_id sony_devices[] = {
+ /* Logitech Harmony Adapter for PS3 */
+ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_HARMONY_PS3),
+ .driver_data = PS3REMOTE },
++ /* SMK-Link PS3 BD Remote Control */
++ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_SMK, USB_DEVICE_ID_SMK_PS3_BDREMOTE),
++ .driver_data = PS3REMOTE },
+ /* Sony Dualshock 4 controllers for PS4 */
+ { HID_USB_DEVICE(USB_VENDOR_ID_SONY, USB_DEVICE_ID_SONY_PS4_CONTROLLER),
+ .driver_data = DUALSHOCK4_CONTROLLER_USB },
+diff --git a/drivers/hwmon/mcp3021.c b/drivers/hwmon/mcp3021.c
+index d219c06a857b..972444a14cca 100644
+--- a/drivers/hwmon/mcp3021.c
++++ b/drivers/hwmon/mcp3021.c
+@@ -31,14 +31,11 @@
+ /* output format */
+ #define MCP3021_SAR_SHIFT 2
+ #define MCP3021_SAR_MASK 0x3ff
+-
+ #define MCP3021_OUTPUT_RES 10 /* 10-bit resolution */
+-#define MCP3021_OUTPUT_SCALE 4
+
+ #define MCP3221_SAR_SHIFT 0
+ #define MCP3221_SAR_MASK 0xfff
+ #define MCP3221_OUTPUT_RES 12 /* 12-bit resolution */
+-#define MCP3221_OUTPUT_SCALE 1
+
+ enum chips {
+ mcp3021,
+@@ -54,7 +51,6 @@ struct mcp3021_data {
+ u16 sar_shift;
+ u16 sar_mask;
+ u8 output_res;
+- u8 output_scale;
+ };
+
+ static int mcp3021_read16(struct i2c_client *client)
+@@ -84,13 +80,7 @@ static int mcp3021_read16(struct i2c_client *client)
+
+ static inline u16 volts_from_reg(struct mcp3021_data *data, u16 val)
+ {
+- if (val == 0)
+- return 0;
+-
+- val = val * data->output_scale - data->output_scale / 2;
+-
+- return val * DIV_ROUND_CLOSEST(data->vdd,
+- (1 << data->output_res) * data->output_scale);
++ return DIV_ROUND_CLOSEST(data->vdd * val, 1 << data->output_res);
+ }
+
+ static ssize_t show_in_input(struct device *dev, struct device_attribute *attr,
+@@ -132,14 +122,12 @@ static int mcp3021_probe(struct i2c_client *client,
+ data->sar_shift = MCP3021_SAR_SHIFT;
+ data->sar_mask = MCP3021_SAR_MASK;
+ data->output_res = MCP3021_OUTPUT_RES;
+- data->output_scale = MCP3021_OUTPUT_SCALE;
+ break;
+
+ case mcp3221:
+ data->sar_shift = MCP3221_SAR_SHIFT;
+ data->sar_mask = MCP3221_SAR_MASK;
+ data->output_res = MCP3221_OUTPUT_RES;
+- data->output_scale = MCP3221_OUTPUT_SCALE;
+ break;
+ }
+
+diff --git a/drivers/i2c/busses/i2c-at91.c b/drivers/i2c/busses/i2c-at91.c
+index e05a672db3e5..85d2f6b51c3c 100644
+--- a/drivers/i2c/busses/i2c-at91.c
++++ b/drivers/i2c/busses/i2c-at91.c
+@@ -62,6 +62,9 @@
+ #define AT91_TWI_UNRE 0x0080 /* Underrun Error */
+ #define AT91_TWI_NACK 0x0100 /* Not Acknowledged */
+
++#define AT91_TWI_INT_MASK \
++ (AT91_TWI_TXCOMP | AT91_TWI_RXRDY | AT91_TWI_TXRDY | AT91_TWI_NACK)
++
+ #define AT91_TWI_IER 0x0024 /* Interrupt Enable Register */
+ #define AT91_TWI_IDR 0x0028 /* Interrupt Disable Register */
+ #define AT91_TWI_IMR 0x002c /* Interrupt Mask Register */
+@@ -117,13 +120,12 @@ static void at91_twi_write(struct at91_twi_dev *dev, unsigned reg, unsigned val)
+
+ static void at91_disable_twi_interrupts(struct at91_twi_dev *dev)
+ {
+- at91_twi_write(dev, AT91_TWI_IDR,
+- AT91_TWI_TXCOMP | AT91_TWI_RXRDY | AT91_TWI_TXRDY);
++ at91_twi_write(dev, AT91_TWI_IDR, AT91_TWI_INT_MASK);
+ }
+
+ static void at91_twi_irq_save(struct at91_twi_dev *dev)
+ {
+- dev->imr = at91_twi_read(dev, AT91_TWI_IMR) & 0x7;
++ dev->imr = at91_twi_read(dev, AT91_TWI_IMR) & AT91_TWI_INT_MASK;
+ at91_disable_twi_interrupts(dev);
+ }
+
+@@ -213,6 +215,14 @@ static void at91_twi_write_data_dma_callback(void *data)
+ dma_unmap_single(dev->dev, sg_dma_address(&dev->dma.sg),
+ dev->buf_len, DMA_TO_DEVICE);
+
++ /*
++ * When this callback is called, THR/TX FIFO is likely not to be empty
++ * yet. So we have to wait for TXCOMP or NACK bits to be set into the
++ * Status Register to be sure that the STOP bit has been sent and the
++ * transfer is completed. The NACK interrupt has already been enabled,
++ * we just have to enable TXCOMP one.
++ */
++ at91_twi_write(dev, AT91_TWI_IER, AT91_TWI_TXCOMP);
+ at91_twi_write(dev, AT91_TWI_CR, AT91_TWI_STOP);
+ }
+
+@@ -307,7 +317,7 @@ static void at91_twi_read_data_dma_callback(void *data)
+ /* The last two bytes have to be read without using dma */
+ dev->buf += dev->buf_len - 2;
+ dev->buf_len = 2;
+- at91_twi_write(dev, AT91_TWI_IER, AT91_TWI_RXRDY);
++ at91_twi_write(dev, AT91_TWI_IER, AT91_TWI_RXRDY | AT91_TWI_TXCOMP);
+ }
+
+ static void at91_twi_read_data_dma(struct at91_twi_dev *dev)
+@@ -368,7 +378,7 @@ static irqreturn_t atmel_twi_interrupt(int irq, void *dev_id)
+ /* catch error flags */
+ dev->transfer_status |= status;
+
+- if (irqstatus & AT91_TWI_TXCOMP) {
++ if (irqstatus & (AT91_TWI_TXCOMP | AT91_TWI_NACK)) {
+ at91_disable_twi_interrupts(dev);
+ complete(&dev->cmd_complete);
+ }
+@@ -381,6 +391,34 @@ static int at91_do_twi_transfer(struct at91_twi_dev *dev)
+ int ret;
+ bool has_unre_flag = dev->pdata->has_unre_flag;
+
++ /*
++ * WARNING: the TXCOMP bit in the Status Register is NOT a clear on
++ * read flag but shows the state of the transmission at the time the
++ * Status Register is read. According to the programmer datasheet,
++ * TXCOMP is set when both holding register and internal shifter are
++ * empty and STOP condition has been sent.
++ * Consequently, we should enable NACK interrupt rather than TXCOMP to
++ * detect transmission failure.
++ *
++ * Besides, the TXCOMP bit is already set before the i2c transaction
++ * has been started. For read transactions, this bit is cleared when
++ * writing the START bit into the Control Register. So the
++ * corresponding interrupt can safely be enabled just after.
++ * However for write transactions managed by the CPU, we first write
++ * into THR, so TXCOMP is cleared. Then we can safely enable TXCOMP
++ * interrupt. If TXCOMP interrupt were enabled before writing into THR,
++ * the interrupt handler would be called immediately and the i2c command
++ * would be reported as completed.
++ * Also when a write transaction is managed by the DMA controller,
++ * enabling the TXCOMP interrupt in this function may lead to a race
++ * condition since we don't know whether the TXCOMP interrupt is enabled
++ * before or after the DMA has started to write into THR. So the TXCOMP
++ * interrupt is enabled later by at91_twi_write_data_dma_callback().
++ * Immediately after in that DMA callback, we still need to send the
++ * STOP condition manually writing the corresponding bit into the
++ * Control Register.
++ */
++
+ dev_dbg(dev->dev, "transfer: %s %d bytes.\n",
+ (dev->msg->flags & I2C_M_RD) ? "read" : "write", dev->buf_len);
+
+@@ -411,26 +449,24 @@ static int at91_do_twi_transfer(struct at91_twi_dev *dev)
+ * seems to be the best solution.
+ */
+ if (dev->use_dma && (dev->buf_len > AT91_I2C_DMA_THRESHOLD)) {
++ at91_twi_write(dev, AT91_TWI_IER, AT91_TWI_NACK);
+ at91_twi_read_data_dma(dev);
+- /*
+- * It is important to enable TXCOMP irq here because
+- * doing it only when transferring the last two bytes
+- * will mask NACK errors since TXCOMP is set when a
+- * NACK occurs.
+- */
+- at91_twi_write(dev, AT91_TWI_IER,
+- AT91_TWI_TXCOMP);
+- } else
++ } else {
+ at91_twi_write(dev, AT91_TWI_IER,
+- AT91_TWI_TXCOMP | AT91_TWI_RXRDY);
++ AT91_TWI_TXCOMP |
++ AT91_TWI_NACK |
++ AT91_TWI_RXRDY);
++ }
+ } else {
+ if (dev->use_dma && (dev->buf_len > AT91_I2C_DMA_THRESHOLD)) {
++ at91_twi_write(dev, AT91_TWI_IER, AT91_TWI_NACK);
+ at91_twi_write_data_dma(dev);
+- at91_twi_write(dev, AT91_TWI_IER, AT91_TWI_TXCOMP);
+ } else {
+ at91_twi_write_next_byte(dev);
+ at91_twi_write(dev, AT91_TWI_IER,
+- AT91_TWI_TXCOMP | AT91_TWI_TXRDY);
++ AT91_TWI_TXCOMP |
++ AT91_TWI_NACK |
++ AT91_TWI_TXRDY);
+ }
+ }
+
+diff --git a/drivers/iio/imu/adis16400.h b/drivers/iio/imu/adis16400.h
+index 0916bf6b6c31..1e8fd2e81d45 100644
+--- a/drivers/iio/imu/adis16400.h
++++ b/drivers/iio/imu/adis16400.h
+@@ -165,6 +165,7 @@ struct adis16400_state {
+ int filt_int;
+
+ struct adis adis;
++ unsigned long avail_scan_mask[2];
+ };
+
+ /* At the moment triggers are only used for ring buffer
+diff --git a/drivers/iio/imu/adis16400_core.c b/drivers/iio/imu/adis16400_core.c
+index fa795dcd5f75..7b06e058b000 100644
+--- a/drivers/iio/imu/adis16400_core.c
++++ b/drivers/iio/imu/adis16400_core.c
+@@ -405,6 +405,11 @@ static int adis16400_read_raw(struct iio_dev *indio_dev,
+ *val = st->variant->temp_scale_nano / 1000000;
+ *val2 = (st->variant->temp_scale_nano % 1000000);
+ return IIO_VAL_INT_PLUS_MICRO;
++ case IIO_PRESSURE:
++ /* 20 uBar = 0.002kPascal */
++ *val = 0;
++ *val2 = 2000;
++ return IIO_VAL_INT_PLUS_MICRO;
+ default:
+ return -EINVAL;
+ }
+@@ -454,10 +459,10 @@ static int adis16400_read_raw(struct iio_dev *indio_dev,
+ }
+ }
+
+-#define ADIS16400_VOLTAGE_CHAN(addr, bits, name, si) { \
++#define ADIS16400_VOLTAGE_CHAN(addr, bits, name, si, chn) { \
+ .type = IIO_VOLTAGE, \
+ .indexed = 1, \
+- .channel = 0, \
++ .channel = chn, \
+ .extend_name = name, \
+ .info_mask_separate = BIT(IIO_CHAN_INFO_RAW) | \
+ BIT(IIO_CHAN_INFO_SCALE), \
+@@ -474,10 +479,10 @@ static int adis16400_read_raw(struct iio_dev *indio_dev,
+ }
+
+ #define ADIS16400_SUPPLY_CHAN(addr, bits) \
+- ADIS16400_VOLTAGE_CHAN(addr, bits, "supply", ADIS16400_SCAN_SUPPLY)
++ ADIS16400_VOLTAGE_CHAN(addr, bits, "supply", ADIS16400_SCAN_SUPPLY, 0)
+
+ #define ADIS16400_AUX_ADC_CHAN(addr, bits) \
+- ADIS16400_VOLTAGE_CHAN(addr, bits, NULL, ADIS16400_SCAN_ADC)
++ ADIS16400_VOLTAGE_CHAN(addr, bits, NULL, ADIS16400_SCAN_ADC, 1)
+
+ #define ADIS16400_GYRO_CHAN(mod, addr, bits) { \
+ .type = IIO_ANGL_VEL, \
+@@ -791,11 +796,6 @@ static const struct iio_info adis16400_info = {
+ .debugfs_reg_access = adis_debugfs_reg_access,
+ };
+
+-static const unsigned long adis16400_burst_scan_mask[] = {
+- ~0UL,
+- 0,
+-};
+-
+ static const char * const adis16400_status_error_msgs[] = {
+ [ADIS16400_DIAG_STAT_ZACCL_FAIL] = "Z-axis accelerometer self-test failure",
+ [ADIS16400_DIAG_STAT_YACCL_FAIL] = "Y-axis accelerometer self-test failure",
+@@ -843,6 +843,20 @@ static const struct adis_data adis16400_data = {
+ BIT(ADIS16400_DIAG_STAT_POWER_LOW),
+ };
+
++static void adis16400_setup_chan_mask(struct adis16400_state *st)
++{
++ const struct adis16400_chip_info *chip_info = st->variant;
++ unsigned i;
++
++ for (i = 0; i < chip_info->num_channels; i++) {
++ const struct iio_chan_spec *ch = &chip_info->channels[i];
++
++ if (ch->scan_index >= 0 &&
++ ch->scan_index != ADIS16400_SCAN_TIMESTAMP)
++ st->avail_scan_mask[0] |= BIT(ch->scan_index);
++ }
++}
++
+ static int adis16400_probe(struct spi_device *spi)
+ {
+ struct adis16400_state *st;
+@@ -866,8 +880,10 @@ static int adis16400_probe(struct spi_device *spi)
+ indio_dev->info = &adis16400_info;
+ indio_dev->modes = INDIO_DIRECT_MODE;
+
+- if (!(st->variant->flags & ADIS16400_NO_BURST))
+- indio_dev->available_scan_masks = adis16400_burst_scan_mask;
++ if (!(st->variant->flags & ADIS16400_NO_BURST)) {
++ adis16400_setup_chan_mask(st);
++ indio_dev->available_scan_masks = st->avail_scan_mask;
++ }
+
+ ret = adis_init(&st->adis, indio_dev, spi, &adis16400_data);
+ if (ret)
+diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c
+index 0618e407197d..02c494a8d111 100644
+--- a/drivers/infiniband/ulp/isert/ib_isert.c
++++ b/drivers/infiniband/ulp/isert/ib_isert.c
+@@ -61,6 +61,8 @@ static int
+ isert_rdma_accept(struct isert_conn *isert_conn);
+ struct rdma_cm_id *isert_setup_id(struct isert_np *isert_np);
+
++static void isert_release_work(struct work_struct *work);
++
+ static inline bool
+ isert_prot_cmd(struct isert_conn *conn, struct se_cmd *cmd)
+ {
+@@ -624,6 +626,7 @@ isert_connect_request(struct rdma_cm_id *cma_id, struct rdma_cm_event *event)
+ mutex_init(&isert_conn->conn_mutex);
+ spin_lock_init(&isert_conn->conn_lock);
+ INIT_LIST_HEAD(&isert_conn->conn_fr_pool);
++ INIT_WORK(&isert_conn->release_work, isert_release_work);
+
+ isert_conn->conn_cm_id = cma_id;
+
+@@ -891,6 +894,7 @@ isert_disconnected_handler(struct rdma_cm_id *cma_id,
+ {
+ struct isert_np *isert_np = cma_id->context;
+ struct isert_conn *isert_conn;
++ bool terminating = false;
+
+ if (isert_np->np_cm_id == cma_id)
+ return isert_np_cma_handler(cma_id->context, event);
+@@ -898,12 +902,25 @@ isert_disconnected_handler(struct rdma_cm_id *cma_id,
+ isert_conn = cma_id->qp->qp_context;
+
+ mutex_lock(&isert_conn->conn_mutex);
++ terminating = (isert_conn->state == ISER_CONN_TERMINATING);
+ isert_conn_terminate(isert_conn);
+ mutex_unlock(&isert_conn->conn_mutex);
+
+ pr_info("conn %p completing conn_wait\n", isert_conn);
+ complete(&isert_conn->conn_wait);
+
++ if (terminating)
++ goto out;
++
++ mutex_lock(&isert_np->np_accept_mutex);
++ if (!list_empty(&isert_conn->conn_accept_node)) {
++ list_del_init(&isert_conn->conn_accept_node);
++ isert_put_conn(isert_conn);
++ queue_work(isert_release_wq, &isert_conn->release_work);
++ }
++ mutex_unlock(&isert_np->np_accept_mutex);
++
++out:
+ return 0;
+ }
+
+@@ -2485,7 +2502,6 @@ isert_build_rdma_wr(struct isert_conn *isert_conn, struct isert_cmd *isert_cmd,
+ page_off = offset % PAGE_SIZE;
+
+ send_wr->sg_list = ib_sge;
+- send_wr->num_sge = sg_nents;
+ send_wr->wr_id = (unsigned long)&isert_cmd->tx_desc;
+ /*
+ * Perform mapping of TCM scatterlist memory ib_sge dma_addr.
+@@ -2504,14 +2520,17 @@ isert_build_rdma_wr(struct isert_conn *isert_conn, struct isert_cmd *isert_cmd,
+ ib_sge->addr, ib_sge->length, ib_sge->lkey);
+ page_off = 0;
+ data_left -= ib_sge->length;
++ if (!data_left)
++ break;
+ ib_sge++;
+ pr_debug("Incrementing ib_sge pointer to %p\n", ib_sge);
+ }
+
++ send_wr->num_sge = ++i;
+ pr_debug("Set outgoing sg_list: %p num_sg: %u from TCM SGLs\n",
+ send_wr->sg_list, send_wr->num_sge);
+
+- return sg_nents;
++ return send_wr->num_sge;
+ }
+
+ static int
+@@ -3417,7 +3436,6 @@ static void isert_wait_conn(struct iscsi_conn *conn)
+
+ wait_for_completion(&isert_conn->conn_wait_comp_err);
+
+- INIT_WORK(&isert_conn->release_work, isert_release_work);
+ queue_work(isert_release_wq, &isert_conn->release_work);
+ }
+
+diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c
+index 991dc6b20a58..aa7f9209ac6c 100644
+--- a/drivers/input/mouse/elantech.c
++++ b/drivers/input/mouse/elantech.c
+@@ -1376,10 +1376,11 @@ static bool elantech_is_signature_valid(const unsigned char *param)
+ return true;
+
+ /*
+- * Some models have a revision higher then 20. Meaning param[2] may
+- * be 10 or 20, skip the rates check for these.
++ * Some hw_version >= 4 models have a revision higher then 20. Meaning
++ * that param[2] may be 10 or 20, skip the rates check for these.
+ */
+- if (param[0] == 0x46 && (param[1] & 0xef) == 0x0f && param[2] < 40)
++ if ((param[0] & 0x0f) >= 0x06 && (param[1] & 0xaf) == 0x0f &&
++ param[2] < 40)
+ return true;
+
+ for (i = 0; i < ARRAY_SIZE(rates); i++)
+diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
+index 2176874a41b1..f599357e8392 100644
+--- a/drivers/input/mouse/synaptics.c
++++ b/drivers/input/mouse/synaptics.c
+@@ -148,6 +148,10 @@ static const struct min_max_quirk min_max_pnpid_table[] = {
+ 1024, 5112, 2024, 4832
+ },
+ {
++ (const char * const []){"LEN2000", NULL},
++ 1024, 5113, 2021, 4832
++ },
++ {
+ (const char * const []){"LEN2001", NULL},
+ {ANY_BOARD_ID, ANY_BOARD_ID},
+ 1024, 5022, 2508, 4832
+@@ -185,7 +189,7 @@ static const char * const topbuttonpad_pnp_ids[] = {
+ "LEN0047",
+ "LEN0048",
+ "LEN0049",
+- "LEN2000",
++ "LEN2000", /* S540 */
+ "LEN2001", /* Edge E431 */
+ "LEN2002", /* Edge E531 */
+ "LEN2003",
+diff --git a/drivers/input/touchscreen/pixcir_i2c_ts.c b/drivers/input/touchscreen/pixcir_i2c_ts.c
+index fc49c75317d1..9788a9b4a610 100644
+--- a/drivers/input/touchscreen/pixcir_i2c_ts.c
++++ b/drivers/input/touchscreen/pixcir_i2c_ts.c
+@@ -78,7 +78,7 @@ static void pixcir_ts_parse(struct pixcir_i2c_ts_data *tsdata,
+ }
+
+ ret = i2c_master_recv(tsdata->client, rdbuf, readsize);
+- if (ret != sizeof(rdbuf)) {
++ if (ret != readsize) {
+ dev_err(&tsdata->client->dev,
+ "%s: i2c_master_recv failed(), ret=%d\n",
+ __func__, ret);
+diff --git a/drivers/irqchip/irq-sunxi-nmi.c b/drivers/irqchip/irq-sunxi-nmi.c
+index 12f547a44ae4..eb9b59e8f122 100644
+--- a/drivers/irqchip/irq-sunxi-nmi.c
++++ b/drivers/irqchip/irq-sunxi-nmi.c
+@@ -104,7 +104,7 @@ static int sunxi_sc_nmi_set_type(struct irq_data *data, unsigned int flow_type)
+ irqd_set_trigger_type(data, flow_type);
+ irq_setup_alt_chip(data, flow_type);
+
+- for (i = 0; i <= gc->num_ct; i++, ct++)
++ for (i = 0; i < gc->num_ct; i++, ct++)
+ if (ct->type & flow_type)
+ ctrl_off = ct->regs.type;
+
+diff --git a/drivers/leds/led-class.c b/drivers/leds/led-class.c
+index 7440c58b8e6f..f5dfb8f7fe3b 100644
+--- a/drivers/leds/led-class.c
++++ b/drivers/leds/led-class.c
+@@ -173,6 +173,7 @@ void led_classdev_resume(struct led_classdev *led_cdev)
+ }
+ EXPORT_SYMBOL_GPL(led_classdev_resume);
+
++#ifdef CONFIG_PM_SLEEP
+ static int led_suspend(struct device *dev)
+ {
+ struct led_classdev *led_cdev = dev_get_drvdata(dev);
+@@ -192,11 +193,9 @@ static int led_resume(struct device *dev)
+
+ return 0;
+ }
++#endif
+
+-static const struct dev_pm_ops leds_class_dev_pm_ops = {
+- .suspend = led_suspend,
+- .resume = led_resume,
+-};
++static SIMPLE_DEV_PM_OPS(leds_class_dev_pm_ops, led_suspend, led_resume);
+
+ /**
+ * led_classdev_register - register a new object of led_classdev class.
+diff --git a/drivers/md/dm-stats.c b/drivers/md/dm-stats.c
+index 87f86c77b094..6f2a4ce413f7 100644
+--- a/drivers/md/dm-stats.c
++++ b/drivers/md/dm-stats.c
+@@ -795,6 +795,8 @@ static int message_stats_create(struct mapped_device *md,
+ return -EINVAL;
+
+ if (sscanf(argv[2], "/%u%c", &divisor, &dummy) == 1) {
++ if (!divisor)
++ return -EINVAL;
+ step = end - start;
+ if (do_div(step, divisor))
+ step++;
+diff --git a/drivers/md/persistent-data/dm-space-map-metadata.c b/drivers/md/persistent-data/dm-space-map-metadata.c
+index f4e22bcc7fb8..199c9ccd1f5d 100644
+--- a/drivers/md/persistent-data/dm-space-map-metadata.c
++++ b/drivers/md/persistent-data/dm-space-map-metadata.c
+@@ -204,6 +204,27 @@ static void in(struct sm_metadata *smm)
+ smm->recursion_count++;
+ }
+
++static int apply_bops(struct sm_metadata *smm)
++{
++ int r = 0;
++
++ while (!brb_empty(&smm->uncommitted)) {
++ struct block_op bop;
++
++ r = brb_pop(&smm->uncommitted, &bop);
++ if (r) {
++ DMERR("bug in bop ring buffer");
++ break;
++ }
++
++ r = commit_bop(smm, &bop);
++ if (r)
++ break;
++ }
++
++ return r;
++}
++
+ static int out(struct sm_metadata *smm)
+ {
+ int r = 0;
+@@ -216,21 +237,8 @@ static int out(struct sm_metadata *smm)
+ return -ENOMEM;
+ }
+
+- if (smm->recursion_count == 1) {
+- while (!brb_empty(&smm->uncommitted)) {
+- struct block_op bop;
+-
+- r = brb_pop(&smm->uncommitted, &bop);
+- if (r) {
+- DMERR("bug in bop ring buffer");
+- break;
+- }
+-
+- r = commit_bop(smm, &bop);
+- if (r)
+- break;
+- }
+- }
++ if (smm->recursion_count == 1)
++ apply_bops(smm);
+
+ smm->recursion_count--;
+
+@@ -702,6 +710,12 @@ static int sm_metadata_extend(struct dm_space_map *sm, dm_block_t extra_blocks)
+ }
+ old_len = smm->begin;
+
++ r = apply_bops(smm);
++ if (r) {
++ DMERR("%s: apply_bops failed", __func__);
++ goto out;
++ }
++
+ r = sm_ll_commit(&smm->ll);
+ if (r)
+ goto out;
+@@ -771,6 +785,12 @@ int dm_sm_metadata_create(struct dm_space_map *sm,
+ if (r)
+ return r;
+
++ r = apply_bops(smm);
++ if (r) {
++ DMERR("%s: apply_bops failed", __func__);
++ return r;
++ }
++
+ return sm_metadata_commit(sm);
+ }
+
+diff --git a/drivers/media/dvb-frontends/af9013.c b/drivers/media/dvb-frontends/af9013.c
+index 8001690d7576..ba6c8f6c42a1 100644
+--- a/drivers/media/dvb-frontends/af9013.c
++++ b/drivers/media/dvb-frontends/af9013.c
+@@ -605,6 +605,10 @@ static int af9013_set_frontend(struct dvb_frontend *fe)
+ }
+ }
+
++ /* Return an error if can't find bandwidth or the right clock */
++ if (i == ARRAY_SIZE(coeff_lut))
++ return -EINVAL;
++
+ ret = af9013_wr_regs(state, 0xae00, coeff_lut[i].val,
+ sizeof(coeff_lut[i].val));
+ }
+diff --git a/drivers/media/dvb-frontends/cx24116.c b/drivers/media/dvb-frontends/cx24116.c
+index 2916d7c74a1d..7bc68b355c0b 100644
+--- a/drivers/media/dvb-frontends/cx24116.c
++++ b/drivers/media/dvb-frontends/cx24116.c
+@@ -963,6 +963,10 @@ static int cx24116_send_diseqc_msg(struct dvb_frontend *fe,
+ struct cx24116_state *state = fe->demodulator_priv;
+ int i, ret;
+
++ /* Validate length */
++ if (d->msg_len > sizeof(d->msg))
++ return -EINVAL;
++
+ /* Dump DiSEqC message */
+ if (debug) {
+ printk(KERN_INFO "cx24116: %s(", __func__);
+@@ -974,10 +978,6 @@ static int cx24116_send_diseqc_msg(struct dvb_frontend *fe,
+ printk(") toneburst=%d\n", toneburst);
+ }
+
+- /* Validate length */
+- if (d->msg_len > (CX24116_ARGLEN - CX24116_DISEQC_MSGOFS))
+- return -EINVAL;
+-
+ /* DiSEqC message */
+ for (i = 0; i < d->msg_len; i++)
+ state->dsec_cmd.args[CX24116_DISEQC_MSGOFS + i] = d->msg[i];
+diff --git a/drivers/media/dvb-frontends/cx24117.c b/drivers/media/dvb-frontends/cx24117.c
+index a6c3c9e2e897..d2eab0676d30 100644
+--- a/drivers/media/dvb-frontends/cx24117.c
++++ b/drivers/media/dvb-frontends/cx24117.c
+@@ -1043,7 +1043,7 @@ static int cx24117_send_diseqc_msg(struct dvb_frontend *fe,
+ dev_dbg(&state->priv->i2c->dev, ")\n");
+
+ /* Validate length */
+- if (d->msg_len > 15)
++ if (d->msg_len > sizeof(d->msg))
+ return -EINVAL;
+
+ /* DiSEqC message */
+diff --git a/drivers/media/dvb-frontends/s5h1420.c b/drivers/media/dvb-frontends/s5h1420.c
+index 93eeaf7118fd..0b4f8fe6bf99 100644
+--- a/drivers/media/dvb-frontends/s5h1420.c
++++ b/drivers/media/dvb-frontends/s5h1420.c
+@@ -180,7 +180,7 @@ static int s5h1420_send_master_cmd (struct dvb_frontend* fe,
+ int result = 0;
+
+ dprintk("enter %s\n", __func__);
+- if (cmd->msg_len > 8)
++ if (cmd->msg_len > sizeof(cmd->msg))
+ return -EINVAL;
+
+ /* setup for DISEQC */
+diff --git a/drivers/media/usb/dvb-usb/dib0700_core.c b/drivers/media/usb/dvb-usb/dib0700_core.c
+index 50856dbf5496..605b090c618b 100644
+--- a/drivers/media/usb/dvb-usb/dib0700_core.c
++++ b/drivers/media/usb/dvb-usb/dib0700_core.c
+@@ -658,10 +658,20 @@ out:
+ struct dib0700_rc_response {
+ u8 report_id;
+ u8 data_state;
+- u8 system;
+- u8 not_system;
+- u8 data;
+- u8 not_data;
++ union {
++ struct {
++ u8 system;
++ u8 not_system;
++ u8 data;
++ u8 not_data;
++ } nec;
++ struct {
++ u8 not_used;
++ u8 system;
++ u8 data;
++ u8 not_data;
++ } rc5;
++ };
+ };
+ #define RC_MSG_SIZE_V1_20 6
+
+@@ -697,8 +707,8 @@ static void dib0700_rc_urb_completion(struct urb *purb)
+
+ deb_data("IR ID = %02X state = %02X System = %02X %02X Cmd = %02X %02X (len %d)\n",
+ poll_reply->report_id, poll_reply->data_state,
+- poll_reply->system, poll_reply->not_system,
+- poll_reply->data, poll_reply->not_data,
++ poll_reply->nec.system, poll_reply->nec.not_system,
++ poll_reply->nec.data, poll_reply->nec.not_data,
+ purb->actual_length);
+
+ switch (d->props.rc.core.protocol) {
+@@ -707,30 +717,30 @@ static void dib0700_rc_urb_completion(struct urb *purb)
+ toggle = 0;
+
+ /* NEC protocol sends repeat code as 0 0 0 FF */
+- if (poll_reply->system == 0x00 &&
+- poll_reply->not_system == 0x00 &&
+- poll_reply->data == 0x00 &&
+- poll_reply->not_data == 0xff) {
++ if (poll_reply->nec.system == 0x00 &&
++ poll_reply->nec.not_system == 0x00 &&
++ poll_reply->nec.data == 0x00 &&
++ poll_reply->nec.not_data == 0xff) {
+ poll_reply->data_state = 2;
+ break;
+ }
+
+- if ((poll_reply->data ^ poll_reply->not_data) != 0xff) {
++ if ((poll_reply->nec.data ^ poll_reply->nec.not_data) != 0xff) {
+ deb_data("NEC32 protocol\n");
+- keycode = RC_SCANCODE_NEC32(poll_reply->system << 24 |
+- poll_reply->not_system << 16 |
+- poll_reply->data << 8 |
+- poll_reply->not_data);
+- } else if ((poll_reply->system ^ poll_reply->not_system) != 0xff) {
++ keycode = RC_SCANCODE_NEC32(poll_reply->nec.system << 24 |
++ poll_reply->nec.not_system << 16 |
++ poll_reply->nec.data << 8 |
++ poll_reply->nec.not_data);
++ } else if ((poll_reply->nec.system ^ poll_reply->nec.not_system) != 0xff) {
+ deb_data("NEC extended protocol\n");
+- keycode = RC_SCANCODE_NECX(poll_reply->system << 8 |
+- poll_reply->not_system,
+- poll_reply->data);
++ keycode = RC_SCANCODE_NECX(poll_reply->nec.system << 8 |
++ poll_reply->nec.not_system,
++ poll_reply->nec.data);
+
+ } else {
+ deb_data("NEC normal protocol\n");
+- keycode = RC_SCANCODE_NEC(poll_reply->system,
+- poll_reply->data);
++ keycode = RC_SCANCODE_NEC(poll_reply->nec.system,
++ poll_reply->nec.data);
+ }
+
+ break;
+@@ -738,19 +748,19 @@ static void dib0700_rc_urb_completion(struct urb *purb)
+ deb_data("RC5 protocol\n");
+ protocol = RC_TYPE_RC5;
+ toggle = poll_reply->report_id;
+- keycode = RC_SCANCODE_RC5(poll_reply->system, poll_reply->data);
++ keycode = RC_SCANCODE_RC5(poll_reply->rc5.system, poll_reply->rc5.data);
++
++ if ((poll_reply->rc5.data ^ poll_reply->rc5.not_data) != 0xff) {
++ /* Key failed integrity check */
++ err("key failed integrity check: %02x %02x %02x %02x",
++ poll_reply->rc5.not_used, poll_reply->rc5.system,
++ poll_reply->rc5.data, poll_reply->rc5.not_data);
++ goto resubmit;
++ }
+
+ break;
+ }
+
+- if ((poll_reply->data + poll_reply->not_data) != 0xff) {
+- /* Key failed integrity check */
+- err("key failed integrity check: %02x %02x %02x %02x",
+- poll_reply->system, poll_reply->not_system,
+- poll_reply->data, poll_reply->not_data);
+- goto resubmit;
+- }
+-
+ rc_keydown(d->rc_dev, protocol, keycode, toggle);
+
+ resubmit:
+diff --git a/drivers/media/usb/dvb-usb/dib0700_devices.c b/drivers/media/usb/dvb-usb/dib0700_devices.c
+index e1757b8f5f5d..6aa4e9f4e441 100644
+--- a/drivers/media/usb/dvb-usb/dib0700_devices.c
++++ b/drivers/media/usb/dvb-usb/dib0700_devices.c
+@@ -3947,6 +3947,8 @@ struct dvb_usb_device_properties dib0700_devices[] = {
+
+ DIB0700_DEFAULT_STREAMING_CONFIG(0x02),
+ }},
++ .size_of_priv = sizeof(struct
++ dib0700_adapter_state),
+ }, {
+ .num_frontends = 1,
+ .fe = {{
+@@ -3959,6 +3961,8 @@ struct dvb_usb_device_properties dib0700_devices[] = {
+
+ DIB0700_DEFAULT_STREAMING_CONFIG(0x03),
+ }},
++ .size_of_priv = sizeof(struct
++ dib0700_adapter_state),
+ }
+ },
+
+@@ -4012,6 +4016,8 @@ struct dvb_usb_device_properties dib0700_devices[] = {
+
+ DIB0700_DEFAULT_STREAMING_CONFIG(0x02),
+ }},
++ .size_of_priv = sizeof(struct
++ dib0700_adapter_state),
+ },
+ },
+
+diff --git a/drivers/misc/mei/client.c b/drivers/misc/mei/client.c
+index bc9ba5359bc6..351e4bc07a51 100644
+--- a/drivers/misc/mei/client.c
++++ b/drivers/misc/mei/client.c
+@@ -478,7 +478,7 @@ void mei_host_client_init(struct work_struct *work)
+ bool mei_hbuf_acquire(struct mei_device *dev)
+ {
+ if (mei_pg_state(dev) == MEI_PG_ON ||
+- dev->pg_event == MEI_PG_EVENT_WAIT) {
++ mei_pg_in_transition(dev)) {
+ dev_dbg(dev->dev, "device is in pg\n");
+ return false;
+ }
+diff --git a/drivers/misc/mei/hw-me.c b/drivers/misc/mei/hw-me.c
+index 350a28af98aa..c1ef64c5e81e 100644
+--- a/drivers/misc/mei/hw-me.c
++++ b/drivers/misc/mei/hw-me.c
+@@ -627,11 +627,27 @@ int mei_me_pg_unset_sync(struct mei_device *dev)
+ mutex_lock(&dev->device_lock);
+
+ reply:
+- if (dev->pg_event == MEI_PG_EVENT_RECEIVED)
+- ret = mei_hbm_pg(dev, MEI_PG_ISOLATION_EXIT_RES_CMD);
++ if (dev->pg_event != MEI_PG_EVENT_RECEIVED) {
++ ret = -ETIME;
++ goto out;
++ }
++
++ dev->pg_event = MEI_PG_EVENT_INTR_WAIT;
++ ret = mei_hbm_pg(dev, MEI_PG_ISOLATION_EXIT_RES_CMD);
++ if (ret)
++ return ret;
++
++ mutex_unlock(&dev->device_lock);
++ wait_event_timeout(dev->wait_pg,
++ dev->pg_event == MEI_PG_EVENT_INTR_RECEIVED, timeout);
++ mutex_lock(&dev->device_lock);
++
++ if (dev->pg_event == MEI_PG_EVENT_INTR_RECEIVED)
++ ret = 0;
+ else
+ ret = -ETIME;
+
++out:
+ dev->pg_event = MEI_PG_EVENT_IDLE;
+ hw->pg_state = MEI_PG_OFF;
+
+@@ -639,6 +655,19 @@ reply:
+ }
+
+ /**
++ * mei_me_pg_in_transition - is device now in pg transition
++ *
++ * @dev: the device structure
++ *
++ * Return: true if in pg transition, false otherwise
++ */
++static bool mei_me_pg_in_transition(struct mei_device *dev)
++{
++ return dev->pg_event >= MEI_PG_EVENT_WAIT &&
++ dev->pg_event <= MEI_PG_EVENT_INTR_WAIT;
++}
++
++/**
+ * mei_me_pg_is_enabled - detect if PG is supported by HW
+ *
+ * @dev: the device structure
+@@ -670,6 +699,24 @@ notsupported:
+ }
+
+ /**
++ * mei_me_pg_intr - perform pg processing in interrupt thread handler
++ *
++ * @dev: the device structure
++ */
++static void mei_me_pg_intr(struct mei_device *dev)
++{
++ struct mei_me_hw *hw = to_me_hw(dev);
++
++ if (dev->pg_event != MEI_PG_EVENT_INTR_WAIT)
++ return;
++
++ dev->pg_event = MEI_PG_EVENT_INTR_RECEIVED;
++ hw->pg_state = MEI_PG_OFF;
++ if (waitqueue_active(&dev->wait_pg))
++ wake_up(&dev->wait_pg);
++}
++
++/**
+ * mei_me_irq_quick_handler - The ISR of the MEI device
+ *
+ * @irq: The irq number
+@@ -727,6 +774,8 @@ irqreturn_t mei_me_irq_thread_handler(int irq, void *dev_id)
+ goto end;
+ }
+
++ mei_me_pg_intr(dev);
++
+ /* check if we need to start the dev */
+ if (!mei_host_is_ready(dev)) {
+ if (mei_hw_is_ready(dev)) {
+@@ -763,9 +812,10 @@ irqreturn_t mei_me_irq_thread_handler(int irq, void *dev_id)
+ /*
+ * During PG handshake only allowed write is the replay to the
+ * PG exit message, so block calling write function
+- * if the pg state is not idle
++ * if the pg event is in PG handshake
+ */
+- if (dev->pg_event == MEI_PG_EVENT_IDLE) {
++ if (dev->pg_event != MEI_PG_EVENT_WAIT &&
++ dev->pg_event != MEI_PG_EVENT_RECEIVED) {
+ rets = mei_irq_write_handler(dev, &complete_list);
+ dev->hbuf_is_ready = mei_hbuf_is_ready(dev);
+ }
+@@ -790,6 +840,7 @@ static const struct mei_hw_ops mei_me_hw_ops = {
+ .hw_config = mei_me_hw_config,
+ .hw_start = mei_me_hw_start,
+
++ .pg_in_transition = mei_me_pg_in_transition,
+ .pg_is_enabled = mei_me_pg_is_enabled,
+
+ .intr_clear = mei_me_intr_clear,
+diff --git a/drivers/misc/mei/hw-txe.c b/drivers/misc/mei/hw-txe.c
+index c5e1902e493f..c11a01a1ec21 100644
+--- a/drivers/misc/mei/hw-txe.c
++++ b/drivers/misc/mei/hw-txe.c
+@@ -16,6 +16,7 @@
+
+ #include <linux/pci.h>
+ #include <linux/jiffies.h>
++#include <linux/ktime.h>
+ #include <linux/delay.h>
+ #include <linux/kthread.h>
+ #include <linux/irqreturn.h>
+@@ -218,26 +219,25 @@ static u32 mei_txe_aliveness_get(struct mei_device *dev)
+ *
+ * Polls for HICR_HOST_ALIVENESS_RESP.ALIVENESS_RESP to be set
+ *
+- * Return: > 0 if the expected value was received, -ETIME otherwise
++ * Return: 0 if the expected value was received, -ETIME otherwise
+ */
+ static int mei_txe_aliveness_poll(struct mei_device *dev, u32 expected)
+ {
+ struct mei_txe_hw *hw = to_txe_hw(dev);
+- int t = 0;
++ ktime_t stop, start;
+
++ start = ktime_get();
++ stop = ktime_add(start, ms_to_ktime(SEC_ALIVENESS_WAIT_TIMEOUT));
+ do {
+ hw->aliveness = mei_txe_aliveness_get(dev);
+ if (hw->aliveness == expected) {
+ dev->pg_event = MEI_PG_EVENT_IDLE;
+- dev_dbg(dev->dev,
+- "aliveness settled after %d msecs\n", t);
+- return t;
++ dev_dbg(dev->dev, "aliveness settled after %lld usecs\n",
++ ktime_to_us(ktime_sub(ktime_get(), start)));
++ return 0;
+ }
+- mutex_unlock(&dev->device_lock);
+- msleep(MSEC_PER_SEC / 5);
+- mutex_lock(&dev->device_lock);
+- t += MSEC_PER_SEC / 5;
+- } while (t < SEC_ALIVENESS_WAIT_TIMEOUT);
++ usleep_range(20, 50);
++ } while (ktime_before(ktime_get(), stop));
+
+ dev->pg_event = MEI_PG_EVENT_IDLE;
+ dev_err(dev->dev, "aliveness timed out\n");
+@@ -302,6 +302,18 @@ int mei_txe_aliveness_set_sync(struct mei_device *dev, u32 req)
+ }
+
+ /**
++ * mei_txe_pg_in_transition - is device now in pg transition
++ *
++ * @dev: the device structure
++ *
++ * Return: true if in pg transition, false otherwise
++ */
++static bool mei_txe_pg_in_transition(struct mei_device *dev)
++{
++ return dev->pg_event == MEI_PG_EVENT_WAIT;
++}
++
++/**
+ * mei_txe_pg_is_enabled - detect if PG is supported by HW
+ *
+ * @dev: the device structure
+@@ -1139,6 +1151,7 @@ static const struct mei_hw_ops mei_txe_hw_ops = {
+ .hw_config = mei_txe_hw_config,
+ .hw_start = mei_txe_hw_start,
+
++ .pg_in_transition = mei_txe_pg_in_transition,
+ .pg_is_enabled = mei_txe_pg_is_enabled,
+
+ .intr_clear = mei_txe_intr_clear,
+diff --git a/drivers/misc/mei/mei_dev.h b/drivers/misc/mei/mei_dev.h
+index 71744b16cc8c..909b2d81895b 100644
+--- a/drivers/misc/mei/mei_dev.h
++++ b/drivers/misc/mei/mei_dev.h
+@@ -264,6 +264,7 @@ struct mei_cl {
+
+ * @fw_status : get fw status registers
+ * @pg_state : power gating state of the device
++ * @pg_in_transition : is device now in pg transition
+ * @pg_is_enabled : is power gating enabled
+
+ * @intr_clear : clear pending interrupts
+@@ -293,6 +294,7 @@ struct mei_hw_ops {
+
+ int (*fw_status)(struct mei_device *dev, struct mei_fw_status *fw_sts);
+ enum mei_pg_state (*pg_state)(struct mei_device *dev);
++ bool (*pg_in_transition)(struct mei_device *dev);
+ bool (*pg_is_enabled)(struct mei_device *dev);
+
+ void (*intr_clear)(struct mei_device *dev);
+@@ -390,11 +392,15 @@ struct mei_cl_device {
+ * @MEI_PG_EVENT_IDLE: the driver is not in power gating transition
+ * @MEI_PG_EVENT_WAIT: the driver is waiting for a pg event to complete
+ * @MEI_PG_EVENT_RECEIVED: the driver received pg event
++ * @MEI_PG_EVENT_INTR_WAIT: the driver is waiting for a pg event interrupt
++ * @MEI_PG_EVENT_INTR_RECEIVED: the driver received pg event interrupt
+ */
+ enum mei_pg_event {
+ MEI_PG_EVENT_IDLE,
+ MEI_PG_EVENT_WAIT,
+ MEI_PG_EVENT_RECEIVED,
++ MEI_PG_EVENT_INTR_WAIT,
++ MEI_PG_EVENT_INTR_RECEIVED,
+ };
+
+ /**
+@@ -721,6 +727,11 @@ static inline enum mei_pg_state mei_pg_state(struct mei_device *dev)
+ return dev->ops->pg_state(dev);
+ }
+
++static inline bool mei_pg_in_transition(struct mei_device *dev)
++{
++ return dev->ops->pg_in_transition(dev);
++}
++
+ static inline bool mei_pg_is_enabled(struct mei_device *dev)
+ {
+ return dev->ops->pg_is_enabled(dev);
+diff --git a/drivers/mmc/host/sdhci-pxav3.c b/drivers/mmc/host/sdhci-pxav3.c
+index 38251da7ba32..29708b82ceef 100644
+--- a/drivers/mmc/host/sdhci-pxav3.c
++++ b/drivers/mmc/host/sdhci-pxav3.c
+@@ -330,16 +330,6 @@ static int sdhci_pxav3_probe(struct platform_device *pdev)
+ /* enable 1/8V DDR capable */
+ host->mmc->caps |= MMC_CAP_1_8V_DDR;
+
+- if (of_device_is_compatible(np, "marvell,armada-380-sdhci")) {
+- ret = armada_38x_quirks(pdev, host);
+- if (ret < 0)
+- goto err_clk_get;
+- ret = mv_conf_mbus_windows(pdev, mv_mbus_dram_info());
+- if (ret < 0)
+- goto err_mbus_win;
+- }
+-
+-
+ pltfm_host = sdhci_priv(host);
+ pltfm_host->priv = pxa;
+
+@@ -352,6 +342,15 @@ static int sdhci_pxav3_probe(struct platform_device *pdev)
+ pltfm_host->clk = clk;
+ clk_prepare_enable(clk);
+
++ if (of_device_is_compatible(np, "marvell,armada-380-sdhci")) {
++ ret = armada_38x_quirks(pdev, host);
++ if (ret < 0)
++ goto err_clk_get;
++ ret = mv_conf_mbus_windows(pdev, mv_mbus_dram_info());
++ if (ret < 0)
++ goto err_mbus_win;
++ }
++
+ match = of_match_device(of_match_ptr(sdhci_pxav3_of_match), &pdev->dev);
+ if (match) {
+ ret = mmc_of_parse(host->mmc);
+@@ -421,9 +420,9 @@ err_add_host:
+ pm_runtime_put_noidle(&pdev->dev);
+ err_of_parse:
+ err_cd_req:
++err_mbus_win:
+ clk_disable_unprepare(clk);
+ err_clk_get:
+-err_mbus_win:
+ sdhci_pltfm_free(pdev);
+ return ret;
+ }
+diff --git a/drivers/mtd/mtd_blkdevs.c b/drivers/mtd/mtd_blkdevs.c
+index d08229eb44d8..3a69b1e56908 100644
+--- a/drivers/mtd/mtd_blkdevs.c
++++ b/drivers/mtd/mtd_blkdevs.c
+@@ -200,6 +200,7 @@ static int blktrans_open(struct block_device *bdev, fmode_t mode)
+ return -ERESTARTSYS; /* FIXME: busy loop! -arnd*/
+
+ mutex_lock(&dev->lock);
++ mutex_lock(&mtd_table_mutex);
+
+ if (dev->open)
+ goto unlock;
+@@ -223,6 +224,7 @@ static int blktrans_open(struct block_device *bdev, fmode_t mode)
+
+ unlock:
+ dev->open++;
++ mutex_unlock(&mtd_table_mutex);
+ mutex_unlock(&dev->lock);
+ blktrans_dev_put(dev);
+ return ret;
+@@ -233,6 +235,7 @@ error_release:
+ error_put:
+ module_put(dev->tr->owner);
+ kref_put(&dev->ref, blktrans_dev_release);
++ mutex_unlock(&mtd_table_mutex);
+ mutex_unlock(&dev->lock);
+ blktrans_dev_put(dev);
+ return ret;
+@@ -246,6 +249,7 @@ static void blktrans_release(struct gendisk *disk, fmode_t mode)
+ return;
+
+ mutex_lock(&dev->lock);
++ mutex_lock(&mtd_table_mutex);
+
+ if (--dev->open)
+ goto unlock;
+@@ -259,6 +263,7 @@ static void blktrans_release(struct gendisk *disk, fmode_t mode)
+ __put_mtd_device(dev->mtd);
+ }
+ unlock:
++ mutex_unlock(&mtd_table_mutex);
+ mutex_unlock(&dev->lock);
+ blktrans_dev_put(dev);
+ }
+diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+index 710eb5793eb3..1217eafb61a4 100644
+--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+@@ -9307,7 +9307,8 @@ unload_error:
+ * function stop ramrod is sent, since as part of this ramrod FW access
+ * PTP registers.
+ */
+- bnx2x_stop_ptp(bp);
++ if (bp->flags & PTP_SUPPORTED)
++ bnx2x_stop_ptp(bp);
+
+ /* Disable HW interrupts, NAPI */
+ bnx2x_netif_stop(bp, 1);
+diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c
+index 67a84cfaefa1..fb34708aa5f4 100644
+--- a/drivers/net/ethernet/marvell/mvneta.c
++++ b/drivers/net/ethernet/marvell/mvneta.c
+@@ -304,6 +304,7 @@ struct mvneta_port {
+ unsigned int link;
+ unsigned int duplex;
+ unsigned int speed;
++ unsigned int tx_csum_limit;
+ };
+
+ /* The mvneta_tx_desc and mvneta_rx_desc structures describe the
+@@ -2441,8 +2442,10 @@ static int mvneta_change_mtu(struct net_device *dev, int mtu)
+
+ dev->mtu = mtu;
+
+- if (!netif_running(dev))
++ if (!netif_running(dev)) {
++ netdev_update_features(dev);
+ return 0;
++ }
+
+ /* The interface is running, so we have to force a
+ * reallocation of the queues
+@@ -2471,9 +2474,26 @@ static int mvneta_change_mtu(struct net_device *dev, int mtu)
+ mvneta_start_dev(pp);
+ mvneta_port_up(pp);
+
++ netdev_update_features(dev);
++
+ return 0;
+ }
+
++static netdev_features_t mvneta_fix_features(struct net_device *dev,
++ netdev_features_t features)
++{
++ struct mvneta_port *pp = netdev_priv(dev);
++
++ if (pp->tx_csum_limit && dev->mtu > pp->tx_csum_limit) {
++ features &= ~(NETIF_F_IP_CSUM | NETIF_F_TSO);
++ netdev_info(dev,
++ "Disable IP checksum for MTU greater than %dB\n",
++ pp->tx_csum_limit);
++ }
++
++ return features;
++}
++
+ /* Get mac address */
+ static void mvneta_get_mac_addr(struct mvneta_port *pp, unsigned char *addr)
+ {
+@@ -2791,6 +2811,7 @@ static const struct net_device_ops mvneta_netdev_ops = {
+ .ndo_set_rx_mode = mvneta_set_rx_mode,
+ .ndo_set_mac_address = mvneta_set_mac_addr,
+ .ndo_change_mtu = mvneta_change_mtu,
++ .ndo_fix_features = mvneta_fix_features,
+ .ndo_get_stats64 = mvneta_get_stats64,
+ .ndo_do_ioctl = mvneta_ioctl,
+ };
+@@ -3029,6 +3050,9 @@ static int mvneta_probe(struct platform_device *pdev)
+ }
+ }
+
++ if (of_device_is_compatible(dn, "marvell,armada-370-neta"))
++ pp->tx_csum_limit = 1600;
++
+ pp->tx_ring_size = MVNETA_MAX_TXD;
+ pp->rx_ring_size = MVNETA_MAX_RXD;
+
+@@ -3101,6 +3125,7 @@ static int mvneta_remove(struct platform_device *pdev)
+
+ static const struct of_device_id mvneta_match[] = {
+ { .compatible = "marvell,armada-370-neta" },
++ { .compatible = "marvell,armada-xp-neta" },
+ { }
+ };
+ MODULE_DEVICE_TABLE(of, mvneta_match);
+diff --git a/drivers/net/ethernet/mellanox/mlx4/en_tx.c b/drivers/net/ethernet/mellanox/mlx4/en_tx.c
+index 142ddd595e2e..5980d3fe597c 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/en_tx.c
++++ b/drivers/net/ethernet/mellanox/mlx4/en_tx.c
+@@ -66,6 +66,7 @@ int mlx4_en_create_tx_ring(struct mlx4_en_priv *priv,
+ ring->size = size;
+ ring->size_mask = size - 1;
+ ring->stride = stride;
++ ring->full_size = ring->size - HEADROOM - MAX_DESC_TXBBS;
+
+ tmp = size * sizeof(struct mlx4_en_tx_info);
+ ring->tx_info = kmalloc_node(tmp, GFP_KERNEL | __GFP_NOWARN, node);
+@@ -223,6 +224,11 @@ void mlx4_en_deactivate_tx_ring(struct mlx4_en_priv *priv,
+ MLX4_QP_STATE_RST, NULL, 0, 0, &ring->qp);
+ }
+
++static inline bool mlx4_en_is_tx_ring_full(struct mlx4_en_tx_ring *ring)
++{
++ return ring->prod - ring->cons > ring->full_size;
++}
++
+ static void mlx4_en_stamp_wqe(struct mlx4_en_priv *priv,
+ struct mlx4_en_tx_ring *ring, int index,
+ u8 owner)
+@@ -465,11 +471,10 @@ static bool mlx4_en_process_tx_cq(struct net_device *dev,
+
+ netdev_tx_completed_queue(ring->tx_queue, packets, bytes);
+
+- /*
+- * Wakeup Tx queue if this stopped, and at least 1 packet
+- * was completed
++ /* Wakeup Tx queue if this stopped, and ring is not full.
+ */
+- if (netif_tx_queue_stopped(ring->tx_queue) && txbbs_skipped > 0) {
++ if (netif_tx_queue_stopped(ring->tx_queue) &&
++ !mlx4_en_is_tx_ring_full(ring)) {
+ netif_tx_wake_queue(ring->tx_queue);
+ ring->wake_queue++;
+ }
+@@ -913,8 +918,7 @@ netdev_tx_t mlx4_en_xmit(struct sk_buff *skb, struct net_device *dev)
+ skb_tx_timestamp(skb);
+
+ /* Check available TXBBs And 2K spare for prefetch */
+- stop_queue = (int)(ring->prod - ring_cons) >
+- ring->size - HEADROOM - MAX_DESC_TXBBS;
++ stop_queue = mlx4_en_is_tx_ring_full(ring);
+ if (unlikely(stop_queue)) {
+ netif_tx_stop_queue(ring->tx_queue);
+ ring->queue_stopped++;
+@@ -983,8 +987,7 @@ netdev_tx_t mlx4_en_xmit(struct sk_buff *skb, struct net_device *dev)
+ smp_rmb();
+
+ ring_cons = ACCESS_ONCE(ring->cons);
+- if (unlikely(((int)(ring->prod - ring_cons)) <=
+- ring->size - HEADROOM - MAX_DESC_TXBBS)) {
++ if (unlikely(!mlx4_en_is_tx_ring_full(ring))) {
+ netif_tx_wake_queue(ring->tx_queue);
+ ring->wake_queue++;
+ }
+diff --git a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
+index 692bd4e8b21f..4f908065accf 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
++++ b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
+@@ -280,6 +280,7 @@ struct mlx4_en_tx_ring {
+ u32 size; /* number of TXBBs */
+ u32 size_mask;
+ u16 stride;
++ u32 full_size;
+ u16 cqn; /* index of port CQ associated with this ring */
+ u32 buf_size;
+ __be32 doorbell_qpn;
+diff --git a/drivers/net/ethernet/stmicro/stmmac/descs.h b/drivers/net/ethernet/stmicro/stmmac/descs.h
+index ad3996038018..799c2929c536 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/descs.h
++++ b/drivers/net/ethernet/stmicro/stmmac/descs.h
+@@ -158,6 +158,8 @@ struct dma_desc {
+ u32 buffer2_size:13;
+ u32 reserved4:3;
+ } etx; /* -- enhanced -- */
++
++ u64 all_flags;
+ } des01;
+ unsigned int des2;
+ unsigned int des3;
+diff --git a/drivers/net/ethernet/stmicro/stmmac/enh_desc.c b/drivers/net/ethernet/stmicro/stmmac/enh_desc.c
+index 1e2bcf5f89e1..7d944449f5ef 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/enh_desc.c
++++ b/drivers/net/ethernet/stmicro/stmmac/enh_desc.c
+@@ -240,6 +240,7 @@ static int enh_desc_get_rx_status(void *data, struct stmmac_extra_stats *x,
+ static void enh_desc_init_rx_desc(struct dma_desc *p, int disable_rx_ic,
+ int mode, int end)
+ {
++ p->des01.all_flags = 0;
+ p->des01.erx.own = 1;
+ p->des01.erx.buffer1_size = BUF_SIZE_8KiB - 1;
+
+@@ -254,7 +255,7 @@ static void enh_desc_init_rx_desc(struct dma_desc *p, int disable_rx_ic,
+
+ static void enh_desc_init_tx_desc(struct dma_desc *p, int mode, int end)
+ {
+- p->des01.etx.own = 0;
++ p->des01.all_flags = 0;
+ if (mode == STMMAC_CHAIN_MODE)
+ ehn_desc_tx_set_on_chain(p, end);
+ else
+diff --git a/drivers/net/ethernet/stmicro/stmmac/norm_desc.c b/drivers/net/ethernet/stmicro/stmmac/norm_desc.c
+index 35ad4f427ae2..48c3456445b2 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/norm_desc.c
++++ b/drivers/net/ethernet/stmicro/stmmac/norm_desc.c
+@@ -123,6 +123,7 @@ static int ndesc_get_rx_status(void *data, struct stmmac_extra_stats *x,
+ static void ndesc_init_rx_desc(struct dma_desc *p, int disable_rx_ic, int mode,
+ int end)
+ {
++ p->des01.all_flags = 0;
+ p->des01.rx.own = 1;
+ p->des01.rx.buffer1_size = BUF_SIZE_2KiB - 1;
+
+@@ -137,7 +138,7 @@ static void ndesc_init_rx_desc(struct dma_desc *p, int disable_rx_ic, int mode,
+
+ static void ndesc_init_tx_desc(struct dma_desc *p, int mode, int end)
+ {
+- p->des01.tx.own = 0;
++ p->des01.all_flags = 0;
+ if (mode == STMMAC_CHAIN_MODE)
+ ndesc_tx_set_on_chain(p, end);
+ else
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+index 18c46bb0f3bf..c769da8d6f3a 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+@@ -1172,41 +1172,41 @@ static int alloc_dma_desc_resources(struct stmmac_priv *priv)
+ goto err_tx_skbuff;
+
+ if (priv->extend_desc) {
+- priv->dma_erx = dma_alloc_coherent(priv->device, rxsize *
+- sizeof(struct
+- dma_extended_desc),
+- &priv->dma_rx_phy,
+- GFP_KERNEL);
++ priv->dma_erx = dma_zalloc_coherent(priv->device, rxsize *
++ sizeof(struct
++ dma_extended_desc),
++ &priv->dma_rx_phy,
++ GFP_KERNEL);
+ if (!priv->dma_erx)
+ goto err_dma;
+
+- priv->dma_etx = dma_alloc_coherent(priv->device, txsize *
+- sizeof(struct
+- dma_extended_desc),
+- &priv->dma_tx_phy,
+- GFP_KERNEL);
++ priv->dma_etx = dma_zalloc_coherent(priv->device, txsize *
++ sizeof(struct
++ dma_extended_desc),
++ &priv->dma_tx_phy,
++ GFP_KERNEL);
+ if (!priv->dma_etx) {
+ dma_free_coherent(priv->device, priv->dma_rx_size *
+- sizeof(struct dma_extended_desc),
+- priv->dma_erx, priv->dma_rx_phy);
++ sizeof(struct dma_extended_desc),
++ priv->dma_erx, priv->dma_rx_phy);
+ goto err_dma;
+ }
+ } else {
+- priv->dma_rx = dma_alloc_coherent(priv->device, rxsize *
+- sizeof(struct dma_desc),
+- &priv->dma_rx_phy,
+- GFP_KERNEL);
++ priv->dma_rx = dma_zalloc_coherent(priv->device, rxsize *
++ sizeof(struct dma_desc),
++ &priv->dma_rx_phy,
++ GFP_KERNEL);
+ if (!priv->dma_rx)
+ goto err_dma;
+
+- priv->dma_tx = dma_alloc_coherent(priv->device, txsize *
+- sizeof(struct dma_desc),
+- &priv->dma_tx_phy,
+- GFP_KERNEL);
++ priv->dma_tx = dma_zalloc_coherent(priv->device, txsize *
++ sizeof(struct dma_desc),
++ &priv->dma_tx_phy,
++ GFP_KERNEL);
+ if (!priv->dma_tx) {
+ dma_free_coherent(priv->device, priv->dma_rx_size *
+- sizeof(struct dma_desc),
+- priv->dma_rx, priv->dma_rx_phy);
++ sizeof(struct dma_desc),
++ priv->dma_rx, priv->dma_rx_phy);
+ goto err_dma;
+ }
+ }
+diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
+index 3fc91e89f5a5..70a0d88de654 100644
+--- a/drivers/net/phy/phy_device.c
++++ b/drivers/net/phy/phy_device.c
+@@ -782,10 +782,11 @@ static int genphy_config_advert(struct phy_device *phydev)
+ if (phydev->supported & (SUPPORTED_1000baseT_Half |
+ SUPPORTED_1000baseT_Full)) {
+ adv |= ethtool_adv_to_mii_ctrl1000_t(advertise);
+- if (adv != oldadv)
+- changed = 1;
+ }
+
++ if (adv != oldadv)
++ changed = 1;
++
+ err = phy_write(phydev, MII_CTRL1000, adv);
+ if (err < 0)
+ return err;
+diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
+index 4f18a6be0c7d..2cf58993da8b 100644
+--- a/drivers/net/wireless/ath/ath9k/main.c
++++ b/drivers/net/wireless/ath/ath9k/main.c
+@@ -212,11 +212,13 @@ static bool ath_prepare_reset(struct ath_softc *sc)
+ ath_stop_ani(sc);
+ ath9k_hw_disable_interrupts(ah);
+
+- if (!ath_drain_all_txq(sc))
+- ret = false;
+-
+- if (!ath_stoprecv(sc))
+- ret = false;
++ if (AR_SREV_9300_20_OR_LATER(ah)) {
++ ret &= ath_stoprecv(sc);
++ ret &= ath_drain_all_txq(sc);
++ } else {
++ ret &= ath_drain_all_txq(sc);
++ ret &= ath_stoprecv(sc);
++ }
+
+ return ret;
+ }
+diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c
+index 5d4173ee55bc..614d62ebc0ba 100644
+--- a/drivers/net/wireless/b43/main.c
++++ b/drivers/net/wireless/b43/main.c
+@@ -5314,6 +5314,10 @@ static void b43_supported_bands(struct b43_wldev *dev, bool *have_2ghz_phy,
+ *have_5ghz_phy = true;
+ return;
+ case 0x4321: /* BCM4306 */
++ /* There are 14e4:4321 PCI devs with 2.4 GHz BCM4321 (N-PHY) */
++ if (dev->phy.type != B43_PHYTYPE_G)
++ break;
++ /* fall through */
+ case 0x4313: /* BCM4311 */
+ case 0x431a: /* BCM4318 */
+ case 0x432a: /* BCM4321 */
+diff --git a/drivers/net/wireless/rtlwifi/rtl8188ee/hw.c b/drivers/net/wireless/rtlwifi/rtl8188ee/hw.c
+index f2b9713c456e..425ccb301705 100644
+--- a/drivers/net/wireless/rtlwifi/rtl8188ee/hw.c
++++ b/drivers/net/wireless/rtlwifi/rtl8188ee/hw.c
+@@ -1353,27 +1353,11 @@ void rtl88ee_set_qos(struct ieee80211_hw *hw, int aci)
+ }
+ }
+
+-static void rtl88ee_clear_interrupt(struct ieee80211_hw *hw)
+-{
+- struct rtl_priv *rtlpriv = rtl_priv(hw);
+- u32 tmp;
+-
+- tmp = rtl_read_dword(rtlpriv, REG_HISR);
+- rtl_write_dword(rtlpriv, REG_HISR, tmp);
+-
+- tmp = rtl_read_dword(rtlpriv, REG_HISRE);
+- rtl_write_dword(rtlpriv, REG_HISRE, tmp);
+-
+- tmp = rtl_read_dword(rtlpriv, REG_HSISR);
+- rtl_write_dword(rtlpriv, REG_HSISR, tmp);
+-}
+-
+ void rtl88ee_enable_interrupt(struct ieee80211_hw *hw)
+ {
+ struct rtl_priv *rtlpriv = rtl_priv(hw);
+ struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
+
+- rtl88ee_clear_interrupt(hw);/*clear it here first*/
+ rtl_write_dword(rtlpriv, REG_HIMR,
+ rtlpci->irq_mask[0] & 0xFFFFFFFF);
+ rtl_write_dword(rtlpriv, REG_HIMRE,
+diff --git a/drivers/net/wireless/rtlwifi/rtl8192ee/hw.c b/drivers/net/wireless/rtlwifi/rtl8192ee/hw.c
+index b461b3128da5..93624541e495 100644
+--- a/drivers/net/wireless/rtlwifi/rtl8192ee/hw.c
++++ b/drivers/net/wireless/rtlwifi/rtl8192ee/hw.c
+@@ -1584,28 +1584,11 @@ void rtl92ee_set_qos(struct ieee80211_hw *hw, int aci)
+ }
+ }
+
+-static void rtl92ee_clear_interrupt(struct ieee80211_hw *hw)
+-{
+- struct rtl_priv *rtlpriv = rtl_priv(hw);
+- u32 tmp;
+-
+- tmp = rtl_read_dword(rtlpriv, REG_HISR);
+- rtl_write_dword(rtlpriv, REG_HISR, tmp);
+-
+- tmp = rtl_read_dword(rtlpriv, REG_HISRE);
+- rtl_write_dword(rtlpriv, REG_HISRE, tmp);
+-
+- tmp = rtl_read_dword(rtlpriv, REG_HSISR);
+- rtl_write_dword(rtlpriv, REG_HSISR, tmp);
+-}
+-
+ void rtl92ee_enable_interrupt(struct ieee80211_hw *hw)
+ {
+ struct rtl_priv *rtlpriv = rtl_priv(hw);
+ struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
+
+- rtl92ee_clear_interrupt(hw);/*clear it here first*/
+-
+ rtl_write_dword(rtlpriv, REG_HIMR, rtlpci->irq_mask[0] & 0xFFFFFFFF);
+ rtl_write_dword(rtlpriv, REG_HIMRE, rtlpci->irq_mask[1] & 0xFFFFFFFF);
+ rtlpci->irq_enabled = true;
+diff --git a/drivers/net/wireless/rtlwifi/rtl8723ae/hw.c b/drivers/net/wireless/rtlwifi/rtl8723ae/hw.c
+index aa085462d0e9..5e1334082570 100644
+--- a/drivers/net/wireless/rtlwifi/rtl8723ae/hw.c
++++ b/drivers/net/wireless/rtlwifi/rtl8723ae/hw.c
+@@ -1258,18 +1258,6 @@ void rtl8723e_set_qos(struct ieee80211_hw *hw, int aci)
+ }
+ }
+
+-static void rtl8723e_clear_interrupt(struct ieee80211_hw *hw)
+-{
+- struct rtl_priv *rtlpriv = rtl_priv(hw);
+- u32 tmp;
+-
+- tmp = rtl_read_dword(rtlpriv, REG_HISR);
+- rtl_write_dword(rtlpriv, REG_HISR, tmp);
+-
+- tmp = rtl_read_dword(rtlpriv, REG_HISRE);
+- rtl_write_dword(rtlpriv, REG_HISRE, tmp);
+-}
+-
+ void rtl8723e_enable_interrupt(struct ieee80211_hw *hw)
+ {
+ struct rtl_priv *rtlpriv = rtl_priv(hw);
+@@ -1284,7 +1272,6 @@ void rtl8723e_disable_interrupt(struct ieee80211_hw *hw)
+ {
+ struct rtl_priv *rtlpriv = rtl_priv(hw);
+ struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
+- rtl8723e_clear_interrupt(hw);/*clear it here first*/
+ rtl_write_dword(rtlpriv, 0x3a8, IMR8190_DISABLED);
+ rtl_write_dword(rtlpriv, 0x3ac, IMR8190_DISABLED);
+ rtlpci->irq_enabled = false;
+diff --git a/drivers/net/wireless/rtlwifi/rtl8723be/hw.c b/drivers/net/wireless/rtlwifi/rtl8723be/hw.c
+index 6dad28e77bbb..cfe679963676 100644
+--- a/drivers/net/wireless/rtlwifi/rtl8723be/hw.c
++++ b/drivers/net/wireless/rtlwifi/rtl8723be/hw.c
+@@ -1634,28 +1634,11 @@ void rtl8723be_set_qos(struct ieee80211_hw *hw, int aci)
+ }
+ }
+
+-static void rtl8723be_clear_interrupt(struct ieee80211_hw *hw)
+-{
+- struct rtl_priv *rtlpriv = rtl_priv(hw);
+- u32 tmp;
+-
+- tmp = rtl_read_dword(rtlpriv, REG_HISR);
+- rtl_write_dword(rtlpriv, REG_HISR, tmp);
+-
+- tmp = rtl_read_dword(rtlpriv, REG_HISRE);
+- rtl_write_dword(rtlpriv, REG_HISRE, tmp);
+-
+- tmp = rtl_read_dword(rtlpriv, REG_HSISR);
+- rtl_write_dword(rtlpriv, REG_HSISR, tmp);
+-}
+-
+ void rtl8723be_enable_interrupt(struct ieee80211_hw *hw)
+ {
+ struct rtl_priv *rtlpriv = rtl_priv(hw);
+ struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
+
+- rtl8723be_clear_interrupt(hw);/*clear it here first*/
+-
+ rtl_write_dword(rtlpriv, REG_HIMR, rtlpci->irq_mask[0] & 0xFFFFFFFF);
+ rtl_write_dword(rtlpriv, REG_HIMRE, rtlpci->irq_mask[1] & 0xFFFFFFFF);
+ rtlpci->irq_enabled = true;
+diff --git a/drivers/net/wireless/rtlwifi/rtl8821ae/hw.c b/drivers/net/wireless/rtlwifi/rtl8821ae/hw.c
+index 8ec8200002c7..43c14d4da563 100644
+--- a/drivers/net/wireless/rtlwifi/rtl8821ae/hw.c
++++ b/drivers/net/wireless/rtlwifi/rtl8821ae/hw.c
+@@ -2253,31 +2253,11 @@ void rtl8821ae_set_qos(struct ieee80211_hw *hw, int aci)
+ }
+ }
+
+-static void rtl8821ae_clear_interrupt(struct ieee80211_hw *hw)
+-{
+- struct rtl_priv *rtlpriv = rtl_priv(hw);
+- u32 tmp;
+- tmp = rtl_read_dword(rtlpriv, REG_HISR);
+- /*printk("clear interrupt first:\n");
+- printk("0x%x = 0x%08x\n",REG_HISR, tmp);*/
+- rtl_write_dword(rtlpriv, REG_HISR, tmp);
+-
+- tmp = rtl_read_dword(rtlpriv, REG_HISRE);
+- /*printk("0x%x = 0x%08x\n",REG_HISRE, tmp);*/
+- rtl_write_dword(rtlpriv, REG_HISRE, tmp);
+-
+- tmp = rtl_read_dword(rtlpriv, REG_HSISR);
+- /*printk("0x%x = 0x%08x\n",REG_HSISR, tmp);*/
+- rtl_write_dword(rtlpriv, REG_HSISR, tmp);
+-}
+-
+ void rtl8821ae_enable_interrupt(struct ieee80211_hw *hw)
+ {
+ struct rtl_priv *rtlpriv = rtl_priv(hw);
+ struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
+
+- rtl8821ae_clear_interrupt(hw);/*clear it here first*/
+-
+ rtl_write_dword(rtlpriv, REG_HIMR, rtlpci->irq_mask[0] & 0xFFFFFFFF);
+ rtl_write_dword(rtlpriv, REG_HIMRE, rtlpci->irq_mask[1] & 0xFFFFFFFF);
+ rtlpci->irq_enabled = true;
+diff --git a/drivers/nfc/st21nfcb/i2c.c b/drivers/nfc/st21nfcb/i2c.c
+index 2cf867b9796d..157259d5fa26 100644
+--- a/drivers/nfc/st21nfcb/i2c.c
++++ b/drivers/nfc/st21nfcb/i2c.c
+@@ -90,11 +90,6 @@ static void st21nfcb_nci_i2c_disable(void *phy_id)
+ gpio_set_value(phy->gpio_reset, 1);
+ }
+
+-static void st21nfcb_nci_remove_header(struct sk_buff *skb)
+-{
+- skb_pull(skb, ST21NFCB_FRAME_HEADROOM);
+-}
+-
+ /*
+ * Writing a frame must not return the number of written bytes.
+ * It must return either zero for success, or <0 for error.
+@@ -124,8 +119,6 @@ static int st21nfcb_nci_i2c_write(void *phy_id, struct sk_buff *skb)
+ r = 0;
+ }
+
+- st21nfcb_nci_remove_header(skb);
+-
+ return r;
+ }
+
+@@ -395,9 +388,6 @@ static int st21nfcb_nci_i2c_remove(struct i2c_client *client)
+
+ ndlc_remove(phy->ndlc);
+
+- if (phy->powered)
+- st21nfcb_nci_i2c_disable(phy);
+-
+ return 0;
+ }
+
+diff --git a/drivers/nfc/st21nfcb/st21nfcb.c b/drivers/nfc/st21nfcb/st21nfcb.c
+index ea63d5877831..28b39143a830 100644
+--- a/drivers/nfc/st21nfcb/st21nfcb.c
++++ b/drivers/nfc/st21nfcb/st21nfcb.c
+@@ -122,11 +122,8 @@ EXPORT_SYMBOL_GPL(st21nfcb_nci_probe);
+
+ void st21nfcb_nci_remove(struct nci_dev *ndev)
+ {
+- struct st21nfcb_nci_info *info = nci_get_drvdata(ndev);
+-
+ nci_unregister_device(ndev);
+ nci_free_device(ndev);
+- kfree(info);
+ }
+ EXPORT_SYMBOL_GPL(st21nfcb_nci_remove);
+
+diff --git a/drivers/of/address.c b/drivers/of/address.c
+index 216b00d99bd8..1dba1a9c1fcf 100644
+--- a/drivers/of/address.c
++++ b/drivers/of/address.c
+@@ -712,7 +712,7 @@ int __weak pci_register_io_range(phys_addr_t addr, resource_size_t size)
+ }
+
+ /* add the range to the list */
+- range = kzalloc(sizeof(*range), GFP_KERNEL);
++ range = kzalloc(sizeof(*range), GFP_ATOMIC);
+ if (!range) {
+ err = -ENOMEM;
+ goto end_register;
+@@ -765,7 +765,7 @@ unsigned long __weak pci_address_to_pio(phys_addr_t address)
+ spin_lock(&io_range_lock);
+ list_for_each_entry(res, &io_range_list, list) {
+ if (address >= res->start && address < res->start + res->size) {
+- addr = res->start - address + offset;
++ addr = address - res->start + offset;
+ break;
+ }
+ offset += res->size;
+diff --git a/drivers/pci/hotplug/pciehp_hpc.c b/drivers/pci/hotplug/pciehp_hpc.c
+index 0ebf754fc177..6d6868811e56 100644
+--- a/drivers/pci/hotplug/pciehp_hpc.c
++++ b/drivers/pci/hotplug/pciehp_hpc.c
+@@ -176,20 +176,17 @@ static void pcie_wait_cmd(struct controller *ctrl)
+ jiffies_to_msecs(jiffies - ctrl->cmd_started));
+ }
+
+-/**
+- * pcie_write_cmd - Issue controller command
+- * @ctrl: controller to which the command is issued
+- * @cmd: command value written to slot control register
+- * @mask: bitmask of slot control register to be modified
+- */
+-static void pcie_write_cmd(struct controller *ctrl, u16 cmd, u16 mask)
++static void pcie_do_write_cmd(struct controller *ctrl, u16 cmd,
++ u16 mask, bool wait)
+ {
+ struct pci_dev *pdev = ctrl_dev(ctrl);
+ u16 slot_ctrl;
+
+ mutex_lock(&ctrl->ctrl_lock);
+
+- /* Wait for any previous command that might still be in progress */
++ /*
++ * Always wait for any previous command that might still be in progress
++ */
+ pcie_wait_cmd(ctrl);
+
+ pcie_capability_read_word(pdev, PCI_EXP_SLTCTL, &slot_ctrl);
+@@ -201,9 +198,33 @@ static void pcie_write_cmd(struct controller *ctrl, u16 cmd, u16 mask)
+ ctrl->cmd_started = jiffies;
+ ctrl->slot_ctrl = slot_ctrl;
+
++ /*
++ * Optionally wait for the hardware to be ready for a new command,
++ * indicating completion of the above issued command.
++ */
++ if (wait)
++ pcie_wait_cmd(ctrl);
++
+ mutex_unlock(&ctrl->ctrl_lock);
+ }
+
++/**
++ * pcie_write_cmd - Issue controller command
++ * @ctrl: controller to which the command is issued
++ * @cmd: command value written to slot control register
++ * @mask: bitmask of slot control register to be modified
++ */
++static void pcie_write_cmd(struct controller *ctrl, u16 cmd, u16 mask)
++{
++ pcie_do_write_cmd(ctrl, cmd, mask, true);
++}
++
++/* Same as above without waiting for the hardware to latch */
++static void pcie_write_cmd_nowait(struct controller *ctrl, u16 cmd, u16 mask)
++{
++ pcie_do_write_cmd(ctrl, cmd, mask, false);
++}
++
+ bool pciehp_check_link_active(struct controller *ctrl)
+ {
+ struct pci_dev *pdev = ctrl_dev(ctrl);
+@@ -422,7 +443,7 @@ void pciehp_set_attention_status(struct slot *slot, u8 value)
+ default:
+ return;
+ }
+- pcie_write_cmd(ctrl, slot_cmd, PCI_EXP_SLTCTL_AIC);
++ pcie_write_cmd_nowait(ctrl, slot_cmd, PCI_EXP_SLTCTL_AIC);
+ ctrl_dbg(ctrl, "%s: SLOTCTRL %x write cmd %x\n", __func__,
+ pci_pcie_cap(ctrl->pcie->port) + PCI_EXP_SLTCTL, slot_cmd);
+ }
+@@ -434,7 +455,8 @@ void pciehp_green_led_on(struct slot *slot)
+ if (!PWR_LED(ctrl))
+ return;
+
+- pcie_write_cmd(ctrl, PCI_EXP_SLTCTL_PWR_IND_ON, PCI_EXP_SLTCTL_PIC);
++ pcie_write_cmd_nowait(ctrl, PCI_EXP_SLTCTL_PWR_IND_ON,
++ PCI_EXP_SLTCTL_PIC);
+ ctrl_dbg(ctrl, "%s: SLOTCTRL %x write cmd %x\n", __func__,
+ pci_pcie_cap(ctrl->pcie->port) + PCI_EXP_SLTCTL,
+ PCI_EXP_SLTCTL_PWR_IND_ON);
+@@ -447,7 +469,8 @@ void pciehp_green_led_off(struct slot *slot)
+ if (!PWR_LED(ctrl))
+ return;
+
+- pcie_write_cmd(ctrl, PCI_EXP_SLTCTL_PWR_IND_OFF, PCI_EXP_SLTCTL_PIC);
++ pcie_write_cmd_nowait(ctrl, PCI_EXP_SLTCTL_PWR_IND_OFF,
++ PCI_EXP_SLTCTL_PIC);
+ ctrl_dbg(ctrl, "%s: SLOTCTRL %x write cmd %x\n", __func__,
+ pci_pcie_cap(ctrl->pcie->port) + PCI_EXP_SLTCTL,
+ PCI_EXP_SLTCTL_PWR_IND_OFF);
+@@ -460,7 +483,8 @@ void pciehp_green_led_blink(struct slot *slot)
+ if (!PWR_LED(ctrl))
+ return;
+
+- pcie_write_cmd(ctrl, PCI_EXP_SLTCTL_PWR_IND_BLINK, PCI_EXP_SLTCTL_PIC);
++ pcie_write_cmd_nowait(ctrl, PCI_EXP_SLTCTL_PWR_IND_BLINK,
++ PCI_EXP_SLTCTL_PIC);
+ ctrl_dbg(ctrl, "%s: SLOTCTRL %x write cmd %x\n", __func__,
+ pci_pcie_cap(ctrl->pcie->port) + PCI_EXP_SLTCTL,
+ PCI_EXP_SLTCTL_PWR_IND_BLINK);
+@@ -613,7 +637,7 @@ void pcie_enable_notification(struct controller *ctrl)
+ PCI_EXP_SLTCTL_HPIE | PCI_EXP_SLTCTL_CCIE |
+ PCI_EXP_SLTCTL_DLLSCE);
+
+- pcie_write_cmd(ctrl, cmd, mask);
++ pcie_write_cmd_nowait(ctrl, cmd, mask);
+ ctrl_dbg(ctrl, "%s: SLOTCTRL %x write cmd %x\n", __func__,
+ pci_pcie_cap(ctrl->pcie->port) + PCI_EXP_SLTCTL, cmd);
+ }
+@@ -664,7 +688,7 @@ int pciehp_reset_slot(struct slot *slot, int probe)
+ pci_reset_bridge_secondary_bus(ctrl->pcie->port);
+
+ pcie_capability_write_word(pdev, PCI_EXP_SLTSTA, stat_mask);
+- pcie_write_cmd(ctrl, ctrl_mask, ctrl_mask);
++ pcie_write_cmd_nowait(ctrl, ctrl_mask, ctrl_mask);
+ ctrl_dbg(ctrl, "%s: SLOTCTRL %x write cmd %x\n", __func__,
+ pci_pcie_cap(ctrl->pcie->port) + PCI_EXP_SLTCTL, ctrl_mask);
+ if (pciehp_poll_mode)
+diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
+index 0190d1ee36b7..ff7af33f2353 100644
+--- a/drivers/pci/pci.c
++++ b/drivers/pci/pci.c
+@@ -4299,6 +4299,17 @@ bool pci_device_is_present(struct pci_dev *pdev)
+ }
+ EXPORT_SYMBOL_GPL(pci_device_is_present);
+
++void pci_ignore_hotplug(struct pci_dev *dev)
++{
++ struct pci_dev *bridge = dev->bus->self;
++
++ dev->ignore_hotplug = 1;
++ /* Propagate the "ignore hotplug" setting to the parent bridge. */
++ if (bridge)
++ bridge->ignore_hotplug = 1;
++}
++EXPORT_SYMBOL_GPL(pci_ignore_hotplug);
++
+ #define RESOURCE_ALIGNMENT_PARAM_SIZE COMMAND_LINE_SIZE
+ static char resource_alignment_param[RESOURCE_ALIGNMENT_PARAM_SIZE] = {0};
+ static DEFINE_SPINLOCK(resource_alignment_lock);
+diff --git a/drivers/pcmcia/topic.h b/drivers/pcmcia/topic.h
+index 615a45a8fe86..582688fe7505 100644
+--- a/drivers/pcmcia/topic.h
++++ b/drivers/pcmcia/topic.h
+@@ -104,6 +104,9 @@
+ #define TOPIC_EXCA_IF_CONTROL 0x3e /* 8 bit */
+ #define TOPIC_EXCA_IFC_33V_ENA 0x01
+
++#define TOPIC_PCI_CFG_PPBCN 0x3e /* 16-bit */
++#define TOPIC_PCI_CFG_PPBCN_WBEN 0x0400
++
+ static void topic97_zoom_video(struct pcmcia_socket *sock, int onoff)
+ {
+ struct yenta_socket *socket = container_of(sock, struct yenta_socket, socket);
+@@ -138,6 +141,7 @@ static int topic97_override(struct yenta_socket *socket)
+ static int topic95_override(struct yenta_socket *socket)
+ {
+ u8 fctrl;
++ u16 ppbcn;
+
+ /* enable 3.3V support for 16bit cards */
+ fctrl = exca_readb(socket, TOPIC_EXCA_IF_CONTROL);
+@@ -146,6 +150,18 @@ static int topic95_override(struct yenta_socket *socket)
+ /* tell yenta to use exca registers to power 16bit cards */
+ socket->flags |= YENTA_16BIT_POWER_EXCA | YENTA_16BIT_POWER_DF;
+
++ /* Disable write buffers to prevent lockups under load with numerous
++ Cardbus cards, observed on Tecra 500CDT and reported elsewhere on the
++ net. This is not a power-on default according to the datasheet
++ but some BIOSes seem to set it. */
++ if (pci_read_config_word(socket->dev, TOPIC_PCI_CFG_PPBCN, &ppbcn) == 0
++ && socket->dev->revision <= 7
++ && (ppbcn & TOPIC_PCI_CFG_PPBCN_WBEN)) {
++ ppbcn &= ~TOPIC_PCI_CFG_PPBCN_WBEN;
++ pci_write_config_word(socket->dev, TOPIC_PCI_CFG_PPBCN, ppbcn);
++ dev_info(&socket->dev->dev, "Disabled ToPIC95 Cardbus write buffers.\n");
++ }
++
+ return 0;
+ }
+
+diff --git a/drivers/pinctrl/mvebu/pinctrl-armada-370.c b/drivers/pinctrl/mvebu/pinctrl-armada-370.c
+index 670e5b01c678..5e423e0b0cb2 100644
+--- a/drivers/pinctrl/mvebu/pinctrl-armada-370.c
++++ b/drivers/pinctrl/mvebu/pinctrl-armada-370.c
+@@ -370,11 +370,11 @@ static struct mvebu_mpp_mode mv88f6710_mpp_modes[] = {
+ MPP_MODE(64,
+ MPP_FUNCTION(0x0, "gpio", NULL),
+ MPP_FUNCTION(0x1, "spi0", "miso"),
+- MPP_FUNCTION(0x2, "spi0-1", "cs1")),
++ MPP_FUNCTION(0x2, "spi0", "cs1")),
+ MPP_MODE(65,
+ MPP_FUNCTION(0x0, "gpio", NULL),
+ MPP_FUNCTION(0x1, "spi0", "mosi"),
+- MPP_FUNCTION(0x2, "spi0-1", "cs2")),
++ MPP_FUNCTION(0x2, "spi0", "cs2")),
+ };
+
+ static struct mvebu_pinctrl_soc_info armada_370_pinctrl_info;
+diff --git a/drivers/pinctrl/mvebu/pinctrl-armada-375.c b/drivers/pinctrl/mvebu/pinctrl-armada-375.c
+index db078fe7ace6..64cc1184ecc2 100644
+--- a/drivers/pinctrl/mvebu/pinctrl-armada-375.c
++++ b/drivers/pinctrl/mvebu/pinctrl-armada-375.c
+@@ -92,19 +92,17 @@ static struct mvebu_mpp_mode mv88f6720_mpp_modes[] = {
+ MPP_FUNCTION(0x5, "nand", "io1")),
+ MPP_MODE(8,
+ MPP_FUNCTION(0x0, "gpio", NULL),
+- MPP_FUNCTION(0x1, "dev ", "bootcs"),
++ MPP_FUNCTION(0x1, "dev", "bootcs"),
+ MPP_FUNCTION(0x2, "spi0", "cs0"),
+ MPP_FUNCTION(0x3, "spi1", "cs0"),
+ MPP_FUNCTION(0x5, "nand", "ce")),
+ MPP_MODE(9,
+ MPP_FUNCTION(0x0, "gpio", NULL),
+- MPP_FUNCTION(0x1, "nf", "wen"),
+ MPP_FUNCTION(0x2, "spi0", "sck"),
+ MPP_FUNCTION(0x3, "spi1", "sck"),
+ MPP_FUNCTION(0x5, "nand", "we")),
+ MPP_MODE(10,
+ MPP_FUNCTION(0x0, "gpio", NULL),
+- MPP_FUNCTION(0x1, "nf", "ren"),
+ MPP_FUNCTION(0x2, "dram", "vttctrl"),
+ MPP_FUNCTION(0x3, "led", "c1"),
+ MPP_FUNCTION(0x5, "nand", "re"),
+diff --git a/drivers/pinctrl/mvebu/pinctrl-armada-38x.c b/drivers/pinctrl/mvebu/pinctrl-armada-38x.c
+index 1049f82fb62f..adb6c238f059 100644
+--- a/drivers/pinctrl/mvebu/pinctrl-armada-38x.c
++++ b/drivers/pinctrl/mvebu/pinctrl-armada-38x.c
+@@ -94,37 +94,39 @@ static struct mvebu_mpp_mode armada_38x_mpp_modes[] = {
+ MPP_VAR_FUNCTION(0, "gpio", NULL, V_88F6810_PLUS),
+ MPP_VAR_FUNCTION(1, "ge0", "rxd0", V_88F6810_PLUS),
+ MPP_VAR_FUNCTION(2, "pcie0", "rstout", V_88F6810_PLUS),
+- MPP_VAR_FUNCTION(3, "pcie1", "rstout", V_88F6820_PLUS),
+ MPP_VAR_FUNCTION(4, "spi0", "cs1", V_88F6810_PLUS),
+- MPP_VAR_FUNCTION(5, "dev", "ad14", V_88F6810_PLUS)),
++ MPP_VAR_FUNCTION(5, "dev", "ad14", V_88F6810_PLUS),
++ MPP_VAR_FUNCTION(6, "pcie3", "clkreq", V_88F6810_PLUS)),
+ MPP_MODE(13,
+ MPP_VAR_FUNCTION(0, "gpio", NULL, V_88F6810_PLUS),
+ MPP_VAR_FUNCTION(1, "ge0", "rxd1", V_88F6810_PLUS),
+ MPP_VAR_FUNCTION(2, "pcie0", "clkreq", V_88F6810_PLUS),
+ MPP_VAR_FUNCTION(3, "pcie1", "clkreq", V_88F6820_PLUS),
+ MPP_VAR_FUNCTION(4, "spi0", "cs2", V_88F6810_PLUS),
+- MPP_VAR_FUNCTION(5, "dev", "ad15", V_88F6810_PLUS)),
++ MPP_VAR_FUNCTION(5, "dev", "ad15", V_88F6810_PLUS),
++ MPP_VAR_FUNCTION(6, "pcie2", "clkreq", V_88F6810_PLUS)),
+ MPP_MODE(14,
+ MPP_VAR_FUNCTION(0, "gpio", NULL, V_88F6810_PLUS),
+ MPP_VAR_FUNCTION(1, "ge0", "rxd2", V_88F6810_PLUS),
+ MPP_VAR_FUNCTION(2, "ptp", "clk", V_88F6810_PLUS),
+ MPP_VAR_FUNCTION(3, "m", "vtt_ctrl", V_88F6810_PLUS),
+ MPP_VAR_FUNCTION(4, "spi0", "cs3", V_88F6810_PLUS),
+- MPP_VAR_FUNCTION(5, "dev", "wen1", V_88F6810_PLUS)),
++ MPP_VAR_FUNCTION(5, "dev", "wen1", V_88F6810_PLUS),
++ MPP_VAR_FUNCTION(6, "pcie3", "clkreq", V_88F6810_PLUS)),
+ MPP_MODE(15,
+ MPP_VAR_FUNCTION(0, "gpio", NULL, V_88F6810_PLUS),
+ MPP_VAR_FUNCTION(1, "ge0", "rxd3", V_88F6810_PLUS),
+ MPP_VAR_FUNCTION(2, "ge", "mdc slave", V_88F6810_PLUS),
+ MPP_VAR_FUNCTION(3, "pcie0", "rstout", V_88F6810_PLUS),
+- MPP_VAR_FUNCTION(4, "spi0", "mosi", V_88F6810_PLUS),
+- MPP_VAR_FUNCTION(5, "pcie1", "rstout", V_88F6820_PLUS)),
++ MPP_VAR_FUNCTION(4, "spi0", "mosi", V_88F6810_PLUS)),
+ MPP_MODE(16,
+ MPP_VAR_FUNCTION(0, "gpio", NULL, V_88F6810_PLUS),
+ MPP_VAR_FUNCTION(1, "ge0", "rxctl", V_88F6810_PLUS),
+ MPP_VAR_FUNCTION(2, "ge", "mdio slave", V_88F6810_PLUS),
+ MPP_VAR_FUNCTION(3, "m", "decc_err", V_88F6810_PLUS),
+ MPP_VAR_FUNCTION(4, "spi0", "miso", V_88F6810_PLUS),
+- MPP_VAR_FUNCTION(5, "pcie0", "clkreq", V_88F6810_PLUS)),
++ MPP_VAR_FUNCTION(5, "pcie0", "clkreq", V_88F6810_PLUS),
++ MPP_VAR_FUNCTION(6, "pcie1", "clkreq", V_88F6820_PLUS)),
+ MPP_MODE(17,
+ MPP_VAR_FUNCTION(0, "gpio", NULL, V_88F6810_PLUS),
+ MPP_VAR_FUNCTION(1, "ge0", "rxclk", V_88F6810_PLUS),
+@@ -137,20 +139,18 @@ static struct mvebu_mpp_mode armada_38x_mpp_modes[] = {
+ MPP_VAR_FUNCTION(1, "ge0", "rxerr", V_88F6810_PLUS),
+ MPP_VAR_FUNCTION(2, "ptp", "trig_gen", V_88F6810_PLUS),
+ MPP_VAR_FUNCTION(3, "ua1", "txd", V_88F6810_PLUS),
+- MPP_VAR_FUNCTION(4, "spi0", "cs0", V_88F6810_PLUS),
+- MPP_VAR_FUNCTION(5, "pcie1", "rstout", V_88F6820_PLUS)),
++ MPP_VAR_FUNCTION(4, "spi0", "cs0", V_88F6810_PLUS)),
+ MPP_MODE(19,
+ MPP_VAR_FUNCTION(0, "gpio", NULL, V_88F6810_PLUS),
+ MPP_VAR_FUNCTION(1, "ge0", "col", V_88F6810_PLUS),
+ MPP_VAR_FUNCTION(2, "ptp", "event_req", V_88F6810_PLUS),
+- MPP_VAR_FUNCTION(3, "pcie0", "clkreq", V_88F6810_PLUS),
++ MPP_VAR_FUNCTION(3, "ge0", "txerr", V_88F6810_PLUS),
+ MPP_VAR_FUNCTION(4, "sata1", "prsnt", V_88F6810_PLUS),
+ MPP_VAR_FUNCTION(5, "ua0", "cts", V_88F6810_PLUS)),
+ MPP_MODE(20,
+ MPP_VAR_FUNCTION(0, "gpio", NULL, V_88F6810_PLUS),
+ MPP_VAR_FUNCTION(1, "ge0", "txclk", V_88F6810_PLUS),
+ MPP_VAR_FUNCTION(2, "ptp", "clk", V_88F6810_PLUS),
+- MPP_VAR_FUNCTION(3, "pcie1", "rstout", V_88F6820_PLUS),
+ MPP_VAR_FUNCTION(4, "sata0", "prsnt", V_88F6810_PLUS),
+ MPP_VAR_FUNCTION(5, "ua0", "rts", V_88F6810_PLUS)),
+ MPP_MODE(21,
+@@ -275,35 +275,27 @@ static struct mvebu_mpp_mode armada_38x_mpp_modes[] = {
+ MPP_VAR_FUNCTION(1, "pcie0", "clkreq", V_88F6810_PLUS),
+ MPP_VAR_FUNCTION(2, "m", "vtt_ctrl", V_88F6810_PLUS),
+ MPP_VAR_FUNCTION(3, "m", "decc_err", V_88F6810_PLUS),
+- MPP_VAR_FUNCTION(4, "pcie0", "rstout", V_88F6810_PLUS),
++ MPP_VAR_FUNCTION(4, "spi1", "cs2", V_88F6810_PLUS),
+ MPP_VAR_FUNCTION(5, "dev", "clkout", V_88F6810_PLUS)),
+ MPP_MODE(44,
+ MPP_VAR_FUNCTION(0, "gpio", NULL, V_88F6810_PLUS),
+ MPP_VAR_FUNCTION(1, "sata0", "prsnt", V_88F6810_PLUS),
+ MPP_VAR_FUNCTION(2, "sata1", "prsnt", V_88F6810_PLUS),
+ MPP_VAR_FUNCTION(3, "sata2", "prsnt", V_88F6828),
+- MPP_VAR_FUNCTION(4, "sata3", "prsnt", V_88F6828),
+- MPP_VAR_FUNCTION(5, "pcie0", "rstout", V_88F6810_PLUS)),
++ MPP_VAR_FUNCTION(4, "sata3", "prsnt", V_88F6828)),
+ MPP_MODE(45,
+ MPP_VAR_FUNCTION(0, "gpio", NULL, V_88F6810_PLUS),
+ MPP_VAR_FUNCTION(1, "ref", "clk_out0", V_88F6810_PLUS),
+- MPP_VAR_FUNCTION(2, "pcie0", "rstout", V_88F6810_PLUS),
+- MPP_VAR_FUNCTION(3, "pcie1", "rstout", V_88F6820_PLUS),
+- MPP_VAR_FUNCTION(4, "pcie2", "rstout", V_88F6810_PLUS),
+- MPP_VAR_FUNCTION(5, "pcie3", "rstout", V_88F6810_PLUS)),
++ MPP_VAR_FUNCTION(2, "pcie0", "rstout", V_88F6810_PLUS)),
+ MPP_MODE(46,
+ MPP_VAR_FUNCTION(0, "gpio", NULL, V_88F6810_PLUS),
+ MPP_VAR_FUNCTION(1, "ref", "clk_out1", V_88F6810_PLUS),
+- MPP_VAR_FUNCTION(2, "pcie0", "rstout", V_88F6810_PLUS),
+- MPP_VAR_FUNCTION(3, "pcie1", "rstout", V_88F6820_PLUS),
+- MPP_VAR_FUNCTION(4, "pcie2", "rstout", V_88F6810_PLUS),
+- MPP_VAR_FUNCTION(5, "pcie3", "rstout", V_88F6810_PLUS)),
++ MPP_VAR_FUNCTION(2, "pcie0", "rstout", V_88F6810_PLUS)),
+ MPP_MODE(47,
+ MPP_VAR_FUNCTION(0, "gpio", NULL, V_88F6810_PLUS),
+ MPP_VAR_FUNCTION(1, "sata0", "prsnt", V_88F6810_PLUS),
+ MPP_VAR_FUNCTION(2, "sata1", "prsnt", V_88F6810_PLUS),
+ MPP_VAR_FUNCTION(3, "sata2", "prsnt", V_88F6828),
+- MPP_VAR_FUNCTION(4, "spi1", "cs2", V_88F6810_PLUS),
+ MPP_VAR_FUNCTION(5, "sata3", "prsnt", V_88F6828)),
+ MPP_MODE(48,
+ MPP_VAR_FUNCTION(0, "gpio", NULL, V_88F6810_PLUS),
+@@ -311,18 +303,19 @@ static struct mvebu_mpp_mode armada_38x_mpp_modes[] = {
+ MPP_VAR_FUNCTION(2, "m", "vtt_ctrl", V_88F6810_PLUS),
+ MPP_VAR_FUNCTION(3, "tdm2c", "pclk", V_88F6810_PLUS),
+ MPP_VAR_FUNCTION(4, "audio", "mclk", V_88F6810_PLUS),
+- MPP_VAR_FUNCTION(5, "sd0", "d4", V_88F6810_PLUS)),
++ MPP_VAR_FUNCTION(5, "sd0", "d4", V_88F6810_PLUS),
++ MPP_VAR_FUNCTION(6, "pcie0", "clkreq", V_88F6810_PLUS)),
+ MPP_MODE(49,
+ MPP_VAR_FUNCTION(0, "gpio", NULL, V_88F6810_PLUS),
+ MPP_VAR_FUNCTION(1, "sata2", "prsnt", V_88F6828),
+ MPP_VAR_FUNCTION(2, "sata3", "prsnt", V_88F6828),
+ MPP_VAR_FUNCTION(3, "tdm2c", "fsync", V_88F6810_PLUS),
+ MPP_VAR_FUNCTION(4, "audio", "lrclk", V_88F6810_PLUS),
+- MPP_VAR_FUNCTION(5, "sd0", "d5", V_88F6810_PLUS)),
++ MPP_VAR_FUNCTION(5, "sd0", "d5", V_88F6810_PLUS),
++ MPP_VAR_FUNCTION(6, "pcie1", "clkreq", V_88F6820_PLUS)),
+ MPP_MODE(50,
+ MPP_VAR_FUNCTION(0, "gpio", NULL, V_88F6810_PLUS),
+ MPP_VAR_FUNCTION(1, "pcie0", "rstout", V_88F6810_PLUS),
+- MPP_VAR_FUNCTION(2, "pcie1", "rstout", V_88F6820_PLUS),
+ MPP_VAR_FUNCTION(3, "tdm2c", "drx", V_88F6810_PLUS),
+ MPP_VAR_FUNCTION(4, "audio", "extclk", V_88F6810_PLUS),
+ MPP_VAR_FUNCTION(5, "sd0", "cmd", V_88F6810_PLUS)),
+@@ -334,7 +327,6 @@ static struct mvebu_mpp_mode armada_38x_mpp_modes[] = {
+ MPP_MODE(52,
+ MPP_VAR_FUNCTION(0, "gpio", NULL, V_88F6810_PLUS),
+ MPP_VAR_FUNCTION(1, "pcie0", "rstout", V_88F6810_PLUS),
+- MPP_VAR_FUNCTION(2, "pcie1", "rstout", V_88F6820_PLUS),
+ MPP_VAR_FUNCTION(3, "tdm2c", "intn", V_88F6810_PLUS),
+ MPP_VAR_FUNCTION(4, "audio", "sdi", V_88F6810_PLUS),
+ MPP_VAR_FUNCTION(5, "sd0", "d6", V_88F6810_PLUS)),
+@@ -350,7 +342,7 @@ static struct mvebu_mpp_mode armada_38x_mpp_modes[] = {
+ MPP_VAR_FUNCTION(1, "sata0", "prsnt", V_88F6810_PLUS),
+ MPP_VAR_FUNCTION(2, "sata1", "prsnt", V_88F6810_PLUS),
+ MPP_VAR_FUNCTION(3, "pcie0", "rstout", V_88F6810_PLUS),
+- MPP_VAR_FUNCTION(4, "pcie1", "rstout", V_88F6820_PLUS),
++ MPP_VAR_FUNCTION(4, "ge0", "txerr", V_88F6810_PLUS),
+ MPP_VAR_FUNCTION(5, "sd0", "d3", V_88F6810_PLUS)),
+ MPP_MODE(55,
+ MPP_VAR_FUNCTION(0, "gpio", NULL, V_88F6810_PLUS),
+@@ -380,7 +372,6 @@ static struct mvebu_mpp_mode armada_38x_mpp_modes[] = {
+ MPP_VAR_FUNCTION(0, "gpio", NULL, V_88F6810_PLUS),
+ MPP_VAR_FUNCTION(1, "pcie0", "rstout", V_88F6810_PLUS),
+ MPP_VAR_FUNCTION(2, "i2c1", "sda", V_88F6810_PLUS),
+- MPP_VAR_FUNCTION(3, "pcie1", "rstout", V_88F6820_PLUS),
+ MPP_VAR_FUNCTION(4, "spi1", "cs0", V_88F6810_PLUS),
+ MPP_VAR_FUNCTION(5, "sd0", "d2", V_88F6810_PLUS)),
+ };
+@@ -409,7 +400,7 @@ static struct mvebu_mpp_ctrl armada_38x_mpp_controls[] = {
+
+ static struct pinctrl_gpio_range armada_38x_mpp_gpio_ranges[] = {
+ MPP_GPIO_RANGE(0, 0, 0, 32),
+- MPP_GPIO_RANGE(1, 32, 32, 27),
++ MPP_GPIO_RANGE(1, 32, 32, 28),
+ };
+
+ static int armada_38x_pinctrl_probe(struct platform_device *pdev)
+diff --git a/drivers/pinctrl/mvebu/pinctrl-armada-xp.c b/drivers/pinctrl/mvebu/pinctrl-armada-xp.c
+index de311129f7a0..cb06fd293fd2 100644
+--- a/drivers/pinctrl/mvebu/pinctrl-armada-xp.c
++++ b/drivers/pinctrl/mvebu/pinctrl-armada-xp.c
+@@ -14,10 +14,7 @@
+ * available: mv78230, mv78260 and mv78460. From a pin muxing
+ * perspective, the mv78230 has 49 MPP pins. The mv78260 and mv78460
+ * both have 67 MPP pins (more GPIOs and address lines for the memory
+- * bus mainly). The only difference between the mv78260 and the
+- * mv78460 in terms of pin muxing is the addition of two functions on
+- * pins 43 and 56 to access the VDD of the CPU2 and 3 (mv78260 has two
+- * cores, mv78460 has four cores).
++ * bus mainly).
+ */
+
+ #include <linux/err.h>
+@@ -171,20 +168,17 @@ static struct mvebu_mpp_mode armada_xp_mpp_modes[] = {
+ MPP_MODE(24,
+ MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS),
+ MPP_VAR_FUNCTION(0x1, "sata1", "prsnt", V_MV78230_PLUS),
+- MPP_VAR_FUNCTION(0x2, "nf", "bootcs-re", V_MV78230_PLUS),
+ MPP_VAR_FUNCTION(0x3, "tdm", "rst", V_MV78230_PLUS),
+ MPP_VAR_FUNCTION(0x4, "lcd", "hsync", V_MV78230_PLUS)),
+ MPP_MODE(25,
+ MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS),
+ MPP_VAR_FUNCTION(0x1, "sata0", "prsnt", V_MV78230_PLUS),
+- MPP_VAR_FUNCTION(0x2, "nf", "bootcs-we", V_MV78230_PLUS),
+ MPP_VAR_FUNCTION(0x3, "tdm", "pclk", V_MV78230_PLUS),
+ MPP_VAR_FUNCTION(0x4, "lcd", "vsync", V_MV78230_PLUS)),
+ MPP_MODE(26,
+ MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS),
+ MPP_VAR_FUNCTION(0x3, "tdm", "fsync", V_MV78230_PLUS),
+- MPP_VAR_FUNCTION(0x4, "lcd", "clk", V_MV78230_PLUS),
+- MPP_VAR_FUNCTION(0x5, "vdd", "cpu1-pd", V_MV78230_PLUS)),
++ MPP_VAR_FUNCTION(0x4, "lcd", "clk", V_MV78230_PLUS)),
+ MPP_MODE(27,
+ MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS),
+ MPP_VAR_FUNCTION(0x1, "ptp", "trig", V_MV78230_PLUS),
+@@ -199,8 +193,7 @@ static struct mvebu_mpp_mode armada_xp_mpp_modes[] = {
+ MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS),
+ MPP_VAR_FUNCTION(0x1, "ptp", "clk", V_MV78230_PLUS),
+ MPP_VAR_FUNCTION(0x3, "tdm", "int0", V_MV78230_PLUS),
+- MPP_VAR_FUNCTION(0x4, "lcd", "ref-clk", V_MV78230_PLUS),
+- MPP_VAR_FUNCTION(0x5, "vdd", "cpu0-pd", V_MV78230_PLUS)),
++ MPP_VAR_FUNCTION(0x4, "lcd", "ref-clk", V_MV78230_PLUS)),
+ MPP_MODE(30,
+ MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS),
+ MPP_VAR_FUNCTION(0x1, "sd0", "clk", V_MV78230_PLUS),
+@@ -208,13 +201,11 @@ static struct mvebu_mpp_mode armada_xp_mpp_modes[] = {
+ MPP_MODE(31,
+ MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS),
+ MPP_VAR_FUNCTION(0x1, "sd0", "cmd", V_MV78230_PLUS),
+- MPP_VAR_FUNCTION(0x3, "tdm", "int2", V_MV78230_PLUS),
+- MPP_VAR_FUNCTION(0x5, "vdd", "cpu0-pd", V_MV78230_PLUS)),
++ MPP_VAR_FUNCTION(0x3, "tdm", "int2", V_MV78230_PLUS)),
+ MPP_MODE(32,
+ MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS),
+ MPP_VAR_FUNCTION(0x1, "sd0", "d0", V_MV78230_PLUS),
+- MPP_VAR_FUNCTION(0x3, "tdm", "int3", V_MV78230_PLUS),
+- MPP_VAR_FUNCTION(0x5, "vdd", "cpu1-pd", V_MV78230_PLUS)),
++ MPP_VAR_FUNCTION(0x3, "tdm", "int3", V_MV78230_PLUS)),
+ MPP_MODE(33,
+ MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS),
+ MPP_VAR_FUNCTION(0x1, "sd0", "d1", V_MV78230_PLUS),
+@@ -246,7 +237,6 @@ static struct mvebu_mpp_mode armada_xp_mpp_modes[] = {
+ MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS),
+ MPP_VAR_FUNCTION(0x1, "spi", "cs1", V_MV78230_PLUS),
+ MPP_VAR_FUNCTION(0x2, "uart2", "cts", V_MV78230_PLUS),
+- MPP_VAR_FUNCTION(0x3, "vdd", "cpu1-pd", V_MV78230_PLUS),
+ MPP_VAR_FUNCTION(0x4, "lcd", "vga-hsync", V_MV78230_PLUS),
+ MPP_VAR_FUNCTION(0x5, "pcie", "clkreq0", V_MV78230_PLUS)),
+ MPP_MODE(41,
+@@ -261,15 +251,13 @@ static struct mvebu_mpp_mode armada_xp_mpp_modes[] = {
+ MPP_VAR_FUNCTION(0x1, "uart2", "rxd", V_MV78230_PLUS),
+ MPP_VAR_FUNCTION(0x2, "uart0", "cts", V_MV78230_PLUS),
+ MPP_VAR_FUNCTION(0x3, "tdm", "int7", V_MV78230_PLUS),
+- MPP_VAR_FUNCTION(0x4, "tdm-1", "timer", V_MV78230_PLUS),
+- MPP_VAR_FUNCTION(0x5, "vdd", "cpu0-pd", V_MV78230_PLUS)),
++ MPP_VAR_FUNCTION(0x4, "tdm-1", "timer", V_MV78230_PLUS)),
+ MPP_MODE(43,
+ MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS),
+ MPP_VAR_FUNCTION(0x1, "uart2", "txd", V_MV78230_PLUS),
+ MPP_VAR_FUNCTION(0x2, "uart0", "rts", V_MV78230_PLUS),
+ MPP_VAR_FUNCTION(0x3, "spi", "cs3", V_MV78230_PLUS),
+- MPP_VAR_FUNCTION(0x4, "pcie", "rstout", V_MV78230_PLUS),
+- MPP_VAR_FUNCTION(0x5, "vdd", "cpu2-3-pd", V_MV78460)),
++ MPP_VAR_FUNCTION(0x4, "pcie", "rstout", V_MV78230_PLUS)),
+ MPP_MODE(44,
+ MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS),
+ MPP_VAR_FUNCTION(0x1, "uart2", "cts", V_MV78230_PLUS),
+@@ -298,7 +286,7 @@ static struct mvebu_mpp_mode armada_xp_mpp_modes[] = {
+ MPP_VAR_FUNCTION(0x5, "pcie", "clkreq3", V_MV78230_PLUS)),
+ MPP_MODE(48,
+ MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS),
+- MPP_VAR_FUNCTION(0x1, "tclk", NULL, V_MV78230_PLUS),
++ MPP_VAR_FUNCTION(0x1, "dev", "clkout", V_MV78230_PLUS),
+ MPP_VAR_FUNCTION(0x2, "dev", "burst/last", V_MV78230_PLUS)),
+ MPP_MODE(49,
+ MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78260_PLUS),
+@@ -320,16 +308,13 @@ static struct mvebu_mpp_mode armada_xp_mpp_modes[] = {
+ MPP_VAR_FUNCTION(0x1, "dev", "ad19", V_MV78260_PLUS)),
+ MPP_MODE(55,
+ MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78260_PLUS),
+- MPP_VAR_FUNCTION(0x1, "dev", "ad20", V_MV78260_PLUS),
+- MPP_VAR_FUNCTION(0x2, "vdd", "cpu0-pd", V_MV78260_PLUS)),
++ MPP_VAR_FUNCTION(0x1, "dev", "ad20", V_MV78260_PLUS)),
+ MPP_MODE(56,
+ MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78260_PLUS),
+- MPP_VAR_FUNCTION(0x1, "dev", "ad21", V_MV78260_PLUS),
+- MPP_VAR_FUNCTION(0x2, "vdd", "cpu1-pd", V_MV78260_PLUS)),
++ MPP_VAR_FUNCTION(0x1, "dev", "ad21", V_MV78260_PLUS)),
+ MPP_MODE(57,
+ MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78260_PLUS),
+- MPP_VAR_FUNCTION(0x1, "dev", "ad22", V_MV78260_PLUS),
+- MPP_VAR_FUNCTION(0x2, "vdd", "cpu2-3-pd", V_MV78460)),
++ MPP_VAR_FUNCTION(0x1, "dev", "ad22", V_MV78260_PLUS)),
+ MPP_MODE(58,
+ MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78260_PLUS),
+ MPP_VAR_FUNCTION(0x1, "dev", "ad23", V_MV78260_PLUS)),
+diff --git a/drivers/platform/x86/ideapad-laptop.c b/drivers/platform/x86/ideapad-laptop.c
+index ed494f37c40f..14ad4c28b0be 100644
+--- a/drivers/platform/x86/ideapad-laptop.c
++++ b/drivers/platform/x86/ideapad-laptop.c
+@@ -464,8 +464,9 @@ static const struct ideapad_rfk_data ideapad_rfk_data[] = {
+ static int ideapad_rfk_set(void *data, bool blocked)
+ {
+ struct ideapad_rfk_priv *priv = data;
++ int opcode = ideapad_rfk_data[priv->dev].opcode;
+
+- return write_ec_cmd(priv->priv->adev->handle, priv->dev, !blocked);
++ return write_ec_cmd(priv->priv->adev->handle, opcode, !blocked);
+ }
+
+ static struct rfkill_ops ideapad_rfk_ops = {
+@@ -831,6 +832,13 @@ static void ideapad_acpi_notify(acpi_handle handle, u32 event, void *data)
+ */
+ static const struct dmi_system_id no_hw_rfkill_list[] = {
+ {
++ .ident = "Lenovo G50-30",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_PRODUCT_VERSION, "Lenovo G50-30"),
++ },
++ },
++ {
+ .ident = "Lenovo Yoga 2 11 / 13 / Pro",
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
+index d92612c51657..bc3d80f9d5d6 100644
+--- a/drivers/regulator/core.c
++++ b/drivers/regulator/core.c
+@@ -774,7 +774,7 @@ static int suspend_prepare(struct regulator_dev *rdev, suspend_state_t state)
+ static void print_constraints(struct regulator_dev *rdev)
+ {
+ struct regulation_constraints *constraints = rdev->constraints;
+- char buf[80] = "";
++ char buf[160] = "";
+ int count = 0;
+ int ret;
+
+diff --git a/drivers/scsi/ipr.h b/drivers/scsi/ipr.h
+index fa82c003bc32..ae4626f64208 100644
+--- a/drivers/scsi/ipr.h
++++ b/drivers/scsi/ipr.h
+@@ -270,7 +270,7 @@
+ #define IPR_RUNTIME_RESET 0x40000000
+
+ #define IPR_IPL_INIT_MIN_STAGE_TIME 5
+-#define IPR_IPL_INIT_DEFAULT_STAGE_TIME 15
++#define IPR_IPL_INIT_DEFAULT_STAGE_TIME 30
+ #define IPR_IPL_INIT_STAGE_UNKNOWN 0x0
+ #define IPR_IPL_INIT_STAGE_TRANSOP 0xB0000000
+ #define IPR_IPL_INIT_STAGE_MASK 0xff000000
+diff --git a/drivers/scsi/scsi_transport_srp.c b/drivers/scsi/scsi_transport_srp.c
+index ae45bd99baed..e05cd7e2d6d3 100644
+--- a/drivers/scsi/scsi_transport_srp.c
++++ b/drivers/scsi/scsi_transport_srp.c
+@@ -396,6 +396,36 @@ static void srp_reconnect_work(struct work_struct *work)
+ }
+ }
+
++/**
++ * scsi_request_fn_active() - number of kernel threads inside scsi_request_fn()
++ * @shost: SCSI host for which to count the number of scsi_request_fn() callers.
++ *
++ * To do: add support for scsi-mq in this function.
++ */
++static int scsi_request_fn_active(struct Scsi_Host *shost)
++{
++ struct scsi_device *sdev;
++ struct request_queue *q;
++ int request_fn_active = 0;
++
++ shost_for_each_device(sdev, shost) {
++ q = sdev->request_queue;
++
++ spin_lock_irq(q->queue_lock);
++ request_fn_active += q->request_fn_active;
++ spin_unlock_irq(q->queue_lock);
++ }
++
++ return request_fn_active;
++}
++
++/* Wait until ongoing shost->hostt->queuecommand() calls have finished. */
++static void srp_wait_for_queuecommand(struct Scsi_Host *shost)
++{
++ while (scsi_request_fn_active(shost))
++ msleep(20);
++}
++
+ static void __rport_fail_io_fast(struct srp_rport *rport)
+ {
+ struct Scsi_Host *shost = rport_to_shost(rport);
+@@ -504,27 +534,6 @@ void srp_start_tl_fail_timers(struct srp_rport *rport)
+ EXPORT_SYMBOL(srp_start_tl_fail_timers);
+
+ /**
+- * scsi_request_fn_active() - number of kernel threads inside scsi_request_fn()
+- * @shost: SCSI host for which to count the number of scsi_request_fn() callers.
+- */
+-static int scsi_request_fn_active(struct Scsi_Host *shost)
+-{
+- struct scsi_device *sdev;
+- struct request_queue *q;
+- int request_fn_active = 0;
+-
+- shost_for_each_device(sdev, shost) {
+- q = sdev->request_queue;
+-
+- spin_lock_irq(q->queue_lock);
+- request_fn_active += q->request_fn_active;
+- spin_unlock_irq(q->queue_lock);
+- }
+-
+- return request_fn_active;
+-}
+-
+-/**
+ * srp_reconnect_rport() - reconnect to an SRP target port
+ * @rport: SRP target port.
+ *
+@@ -559,8 +568,7 @@ int srp_reconnect_rport(struct srp_rport *rport)
+ if (res)
+ goto out;
+ scsi_target_block(&shost->shost_gendev);
+- while (scsi_request_fn_active(shost))
+- msleep(20);
++ srp_wait_for_queuecommand(shost);
+ res = rport->state != SRP_RPORT_LOST ? i->f->reconnect(rport) : -ENODEV;
+ pr_debug("%s (state %d): transport.reconnect() returned %d\n",
+ dev_name(&shost->shost_gendev), rport->state, res);
+diff --git a/drivers/spi/spi-orion.c b/drivers/spi/spi-orion.c
+index c76b7d7879df..bd09807b6b05 100644
+--- a/drivers/spi/spi-orion.c
++++ b/drivers/spi/spi-orion.c
+@@ -52,6 +52,12 @@ enum orion_spi_type {
+
+ struct orion_spi_dev {
+ enum orion_spi_type typ;
++ /*
++ * min_divisor and max_hz should be exclusive, the only we can
++ * have both is for managing the armada-370-spi case with old
++ * device tree
++ */
++ unsigned long max_hz;
+ unsigned int min_divisor;
+ unsigned int max_divisor;
+ u32 prescale_mask;
+@@ -402,8 +408,9 @@ static const struct orion_spi_dev orion_spi_dev_data = {
+
+ static const struct orion_spi_dev armada_spi_dev_data = {
+ .typ = ARMADA_SPI,
+- .min_divisor = 1,
++ .min_divisor = 4,
+ .max_divisor = 1920,
++ .max_hz = 50000000,
+ .prescale_mask = ARMADA_SPI_CLK_PRESCALE_MASK,
+ };
+
+@@ -468,7 +475,21 @@ static int orion_spi_probe(struct platform_device *pdev)
+ goto out;
+
+ tclk_hz = clk_get_rate(spi->clk);
+- master->max_speed_hz = DIV_ROUND_UP(tclk_hz, devdata->min_divisor);
++
++ /*
++ * With old device tree, armada-370-spi could be used with
++ * Armada XP, however for this SoC the maximum frequency is
++ * 50MHz instead of tclk/4. On Armada 370, tclk cannot be
++ * higher than 200MHz. So, in order to be able to handle both
++ * SoCs, we can take the minimum of 50MHz and tclk/4.
++ */
++ if (of_device_is_compatible(pdev->dev.of_node,
++ "marvell,armada-370-spi"))
++ master->max_speed_hz = min(devdata->max_hz,
++ DIV_ROUND_UP(tclk_hz, devdata->min_divisor));
++ else
++ master->max_speed_hz =
++ DIV_ROUND_UP(tclk_hz, devdata->min_divisor);
+ master->min_speed_hz = DIV_ROUND_UP(tclk_hz, devdata->max_divisor);
+
+ r = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
+index 1c72be19e70e..115ad5dbc7c5 100644
+--- a/drivers/spi/spi.c
++++ b/drivers/spi/spi.c
+@@ -1059,9 +1059,6 @@ void spi_finalize_current_message(struct spi_master *master)
+
+ spin_lock_irqsave(&master->queue_lock, flags);
+ mesg = master->cur_msg;
+- master->cur_msg = NULL;
+-
+- queue_kthread_work(&master->kworker, &master->pump_messages);
+ spin_unlock_irqrestore(&master->queue_lock, flags);
+
+ spi_unmap_msg(master, mesg);
+@@ -1074,9 +1071,13 @@ void spi_finalize_current_message(struct spi_master *master)
+ }
+ }
+
+- trace_spi_message_done(mesg);
+-
++ spin_lock_irqsave(&master->queue_lock, flags);
++ master->cur_msg = NULL;
+ master->cur_msg_prepared = false;
++ queue_kthread_work(&master->kworker, &master->pump_messages);
++ spin_unlock_irqrestore(&master->queue_lock, flags);
++
++ trace_spi_message_done(mesg);
+
+ mesg->state = NULL;
+ if (mesg->complete)
+diff --git a/drivers/staging/ozwpan/ozusbsvc1.c b/drivers/staging/ozwpan/ozusbsvc1.c
+index be7ee01c50ab..0c6bea0b311c 100644
+--- a/drivers/staging/ozwpan/ozusbsvc1.c
++++ b/drivers/staging/ozwpan/ozusbsvc1.c
+@@ -326,7 +326,11 @@ static void oz_usb_handle_ep_data(struct oz_usb_ctx *usb_ctx,
+ struct oz_multiple_fixed *body =
+ (struct oz_multiple_fixed *)data_hdr;
+ u8 *data = body->data;
+- int n = (len - sizeof(struct oz_multiple_fixed)+1)
++ unsigned int n;
++ if (!body->unit_size ||
++ len < sizeof(struct oz_multiple_fixed) - 1)
++ break;
++ n = (len - (sizeof(struct oz_multiple_fixed) - 1))
+ / body->unit_size;
+ while (n--) {
+ oz_hcd_data_ind(usb_ctx->hport, body->endpoint,
+@@ -390,10 +394,15 @@ void oz_usb_rx(struct oz_pd *pd, struct oz_elt *elt)
+ case OZ_GET_DESC_RSP: {
+ struct oz_get_desc_rsp *body =
+ (struct oz_get_desc_rsp *)usb_hdr;
+- int data_len = elt->length -
+- sizeof(struct oz_get_desc_rsp) + 1;
+- u16 offs = le16_to_cpu(get_unaligned(&body->offset));
+- u16 total_size =
++ u16 offs, total_size;
++ u8 data_len;
++
++ if (elt->length < sizeof(struct oz_get_desc_rsp) - 1)
++ break;
++ data_len = elt->length -
++ (sizeof(struct oz_get_desc_rsp) - 1);
++ offs = le16_to_cpu(get_unaligned(&body->offset));
++ total_size =
+ le16_to_cpu(get_unaligned(&body->total_size));
+ oz_dbg(ON, "USB_REQ_GET_DESCRIPTOR - cnf\n");
+ oz_hcd_get_desc_cnf(usb_ctx->hport, body->req_id,
+diff --git a/drivers/staging/rtl8712/rtl8712_recv.c b/drivers/staging/rtl8712/rtl8712_recv.c
+index b27806209268..ff7583d97bf5 100644
+--- a/drivers/staging/rtl8712/rtl8712_recv.c
++++ b/drivers/staging/rtl8712/rtl8712_recv.c
+@@ -1068,7 +1068,8 @@ static int recvbuf2recvframe(struct _adapter *padapter, struct sk_buff *pskb)
+ /* for first fragment packet, driver need allocate 1536 +
+ * drvinfo_sz + RXDESC_SIZE to defrag packet. */
+ if ((mf == 1) && (frag == 0))
+- alloc_sz = 1658;/*1658+6=1664, 1664 is 128 alignment.*/
++ /*1658+6=1664, 1664 is 128 alignment.*/
++ alloc_sz = max_t(u16, tmp_len, 1658);
+ else
+ alloc_sz = tmp_len;
+ /* 2 is for IP header 4 bytes alignment in QoS packet case.
+diff --git a/drivers/staging/vt6655/device_main.c b/drivers/staging/vt6655/device_main.c
+index 54e16f40d8ed..ea240512cbbb 100644
+--- a/drivers/staging/vt6655/device_main.c
++++ b/drivers/staging/vt6655/device_main.c
+@@ -1340,6 +1340,10 @@ static int device_rx_srv(struct vnt_private *pDevice, unsigned int uIdx)
+ pRD = pRD->next) {
+ if (works++ > 15)
+ break;
++
++ if (!pRD->pRDInfo->skb)
++ break;
++
+ if (device_receive_frame(pDevice, pRD)) {
+ if (!device_alloc_rx_buf(pDevice, pRD)) {
+ dev_err(&pDevice->pcid->dev,
+diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c
+index 72824659f628..e3ebb674a693 100644
+--- a/drivers/tty/n_tty.c
++++ b/drivers/tty/n_tty.c
+@@ -186,6 +186,17 @@ static int receive_room(struct tty_struct *tty)
+ return left;
+ }
+
++static inline int tty_copy_to_user(struct tty_struct *tty,
++ void __user *to,
++ const void *from,
++ unsigned long n)
++{
++ struct n_tty_data *ldata = tty->disc_data;
++
++ tty_audit_add_data(tty, to, n, ldata->icanon);
++ return copy_to_user(to, from, n);
++}
++
+ /**
+ * n_tty_set_room - receive space
+ * @tty: terminal
+@@ -2081,12 +2092,12 @@ static int canon_copy_from_read_buf(struct tty_struct *tty,
+ __func__, eol, found, n, c, size, more);
+
+ if (n > size) {
+- ret = copy_to_user(*b, read_buf_addr(ldata, tail), size);
++ ret = tty_copy_to_user(tty, *b, read_buf_addr(ldata, tail), size);
+ if (ret)
+ return -EFAULT;
+- ret = copy_to_user(*b + size, ldata->read_buf, n - size);
++ ret = tty_copy_to_user(tty, *b + size, ldata->read_buf, n - size);
+ } else
+- ret = copy_to_user(*b, read_buf_addr(ldata, tail), n);
++ ret = tty_copy_to_user(tty, *b, read_buf_addr(ldata, tail), n);
+
+ if (ret)
+ return -EFAULT;
+diff --git a/drivers/tty/serial/imx.c b/drivers/tty/serial/imx.c
+index 369e18d9ab48..696d4b5af293 100644
+--- a/drivers/tty/serial/imx.c
++++ b/drivers/tty/serial/imx.c
+@@ -900,6 +900,14 @@ static void dma_rx_callback(void *data)
+
+ status = dmaengine_tx_status(chan, (dma_cookie_t)0, &state);
+ count = RX_BUF_SIZE - state.residue;
++
++ if (readl(sport->port.membase + USR2) & USR2_IDLE) {
++ /* In condition [3] the SDMA counted up too early */
++ count--;
++
++ writel(USR2_IDLE, sport->port.membase + USR2);
++ }
++
+ dev_dbg(sport->port.dev, "We get %d bytes.\n", count);
+
+ if (count) {
+diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
+index 12d37aedc66f..7d8c3d4ede20 100644
+--- a/drivers/usb/class/cdc-acm.c
++++ b/drivers/usb/class/cdc-acm.c
+@@ -1486,6 +1486,11 @@ skip_countries:
+ goto alloc_fail8;
+ }
+
++ if (quirks & CLEAR_HALT_CONDITIONS) {
++ usb_clear_halt(usb_dev, usb_rcvbulkpipe(usb_dev, epread->bEndpointAddress));
++ usb_clear_halt(usb_dev, usb_sndbulkpipe(usb_dev, epwrite->bEndpointAddress));
++ }
++
+ return 0;
+ alloc_fail8:
+ if (acm->country_codes) {
+@@ -1763,6 +1768,10 @@ static const struct usb_device_id acm_ids[] = {
+ .driver_info = NO_UNION_NORMAL, /* reports zero length descriptor */
+ },
+
++ { USB_DEVICE(0x2912, 0x0001), /* ATOL FPrint */
++ .driver_info = CLEAR_HALT_CONDITIONS,
++ },
++
+ /* Nokia S60 phones expose two ACM channels. The first is
+ * a modem and is picked up by the standard AT-command
+ * information below. The second is 'vendor-specific' but
+diff --git a/drivers/usb/class/cdc-acm.h b/drivers/usb/class/cdc-acm.h
+index d3251ebd09e2..9cca2e7280bb 100644
+--- a/drivers/usb/class/cdc-acm.h
++++ b/drivers/usb/class/cdc-acm.h
+@@ -134,3 +134,4 @@ struct acm {
+ #define NO_DATA_INTERFACE BIT(4)
+ #define IGNORE_DEVICE BIT(5)
+ #define QUIRK_CONTROL_LINE_STATE BIT(6)
++#define CLEAR_HALT_CONDITIONS BIT(7)
+diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
+index 85e03cb0c418..2222899c4b69 100644
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -2613,9 +2613,6 @@ static bool use_new_scheme(struct usb_device *udev, int retry)
+ return USE_NEW_SCHEME(retry);
+ }
+
+-static int hub_port_reset(struct usb_hub *hub, int port1,
+- struct usb_device *udev, unsigned int delay, bool warm);
+-
+ /* Is a USB 3.0 port in the Inactive or Compliance Mode state?
+ * Port worm reset is required to recover
+ */
+@@ -2703,44 +2700,6 @@ static int hub_port_wait_reset(struct usb_hub *hub, int port1,
+ return 0;
+ }
+
+-static void hub_port_finish_reset(struct usb_hub *hub, int port1,
+- struct usb_device *udev, int *status)
+-{
+- switch (*status) {
+- case 0:
+- /* TRSTRCY = 10 ms; plus some extra */
+- msleep(10 + 40);
+- if (udev) {
+- struct usb_hcd *hcd = bus_to_hcd(udev->bus);
+-
+- update_devnum(udev, 0);
+- /* The xHC may think the device is already reset,
+- * so ignore the status.
+- */
+- if (hcd->driver->reset_device)
+- hcd->driver->reset_device(hcd, udev);
+- }
+- /* FALL THROUGH */
+- case -ENOTCONN:
+- case -ENODEV:
+- usb_clear_port_feature(hub->hdev,
+- port1, USB_PORT_FEAT_C_RESET);
+- if (hub_is_superspeed(hub->hdev)) {
+- usb_clear_port_feature(hub->hdev, port1,
+- USB_PORT_FEAT_C_BH_PORT_RESET);
+- usb_clear_port_feature(hub->hdev, port1,
+- USB_PORT_FEAT_C_PORT_LINK_STATE);
+- usb_clear_port_feature(hub->hdev, port1,
+- USB_PORT_FEAT_C_CONNECTION);
+- }
+- if (udev)
+- usb_set_device_state(udev, *status
+- ? USB_STATE_NOTATTACHED
+- : USB_STATE_DEFAULT);
+- break;
+- }
+-}
+-
+ /* Handle port reset and port warm(BH) reset (for USB3 protocol ports) */
+ static int hub_port_reset(struct usb_hub *hub, int port1,
+ struct usb_device *udev, unsigned int delay, bool warm)
+@@ -2764,13 +2723,10 @@ static int hub_port_reset(struct usb_hub *hub, int port1,
+ * If the caller hasn't explicitly requested a warm reset,
+ * double check and see if one is needed.
+ */
+- status = hub_port_status(hub, port1,
+- &portstatus, &portchange);
+- if (status < 0)
+- goto done;
+-
+- if (hub_port_warm_reset_required(hub, port1, portstatus))
+- warm = true;
++ if (hub_port_status(hub, port1, &portstatus, &portchange) == 0)
++ if (hub_port_warm_reset_required(hub, port1,
++ portstatus))
++ warm = true;
+ }
+ clear_bit(port1, hub->warm_reset_bits);
+
+@@ -2796,11 +2752,19 @@ static int hub_port_reset(struct usb_hub *hub, int port1,
+
+ /* Check for disconnect or reset */
+ if (status == 0 || status == -ENOTCONN || status == -ENODEV) {
+- hub_port_finish_reset(hub, port1, udev, &status);
++ usb_clear_port_feature(hub->hdev, port1,
++ USB_PORT_FEAT_C_RESET);
+
+ if (!hub_is_superspeed(hub->hdev))
+ goto done;
+
++ usb_clear_port_feature(hub->hdev, port1,
++ USB_PORT_FEAT_C_BH_PORT_RESET);
++ usb_clear_port_feature(hub->hdev, port1,
++ USB_PORT_FEAT_C_PORT_LINK_STATE);
++ usb_clear_port_feature(hub->hdev, port1,
++ USB_PORT_FEAT_C_CONNECTION);
++
+ /*
+ * If a USB 3.0 device migrates from reset to an error
+ * state, re-issue the warm reset.
+@@ -2833,6 +2797,26 @@ static int hub_port_reset(struct usb_hub *hub, int port1,
+ dev_err(&port_dev->dev, "Cannot enable. Maybe the USB cable is bad?\n");
+
+ done:
++ if (status == 0) {
++ /* TRSTRCY = 10 ms; plus some extra */
++ msleep(10 + 40);
++ if (udev) {
++ struct usb_hcd *hcd = bus_to_hcd(udev->bus);
++
++ update_devnum(udev, 0);
++ /* The xHC may think the device is already reset,
++ * so ignore the status.
++ */
++ if (hcd->driver->reset_device)
++ hcd->driver->reset_device(hcd, udev);
++
++ usb_set_device_state(udev, USB_STATE_DEFAULT);
++ }
++ } else {
++ if (udev)
++ usb_set_device_state(udev, USB_STATE_NOTATTACHED);
++ }
++
+ if (!hub_is_superspeed(hub->hdev))
+ up_read(&ehci_cf_port_reset_rwsem);
+
+diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
+index 272e0928736e..d98faf73d6b2 100644
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -289,6 +289,8 @@ int dwc3_send_gadget_generic_command(struct dwc3 *dwc, unsigned cmd, u32 param)
+ if (!(reg & DWC3_DGCMD_CMDACT)) {
+ dev_vdbg(dwc->dev, "Command Complete --> %d\n",
+ DWC3_DGCMD_STATUS(reg));
++ if (DWC3_DGCMD_STATUS(reg))
++ return -EINVAL;
+ return 0;
+ }
+
+@@ -322,6 +324,8 @@ int dwc3_send_gadget_ep_cmd(struct dwc3 *dwc, unsigned ep,
+ if (!(reg & DWC3_DEPCMD_CMDACT)) {
+ dev_vdbg(dwc->dev, "Command Complete --> %d\n",
+ DWC3_DEPCMD_STATUS(reg));
++ if (DWC3_DEPCMD_STATUS(reg))
++ return -EINVAL;
+ return 0;
+ }
+
+@@ -1899,12 +1903,16 @@ static void dwc3_endpoint_transfer_complete(struct dwc3 *dwc,
+ {
+ unsigned status = 0;
+ int clean_busy;
++ u32 is_xfer_complete;
++
++ is_xfer_complete = (event->endpoint_event == DWC3_DEPEVT_XFERCOMPLETE);
+
+ if (event->status & DEPEVT_STATUS_BUSERR)
+ status = -ECONNRESET;
+
+ clean_busy = dwc3_cleanup_done_reqs(dwc, dep, event, status);
+- if (clean_busy)
++ if (clean_busy && (is_xfer_complete ||
++ usb_endpoint_xfer_isoc(dep->endpoint.desc)))
+ dep->flags &= ~DWC3_EP_BUSY;
+
+ /*
+diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
+index 9031750e7404..ffd739e31bfc 100644
+--- a/drivers/usb/serial/cp210x.c
++++ b/drivers/usb/serial/cp210x.c
+@@ -128,6 +128,7 @@ static const struct usb_device_id id_table[] = {
+ { USB_DEVICE(0x10C4, 0x8946) }, /* Ketra N1 Wireless Interface */
+ { USB_DEVICE(0x10C4, 0x8977) }, /* CEL MeshWorks DevKit Device */
+ { USB_DEVICE(0x10C4, 0x8998) }, /* KCF Technologies PRN */
++ { USB_DEVICE(0x10C4, 0x8A2A) }, /* HubZ dual ZigBee and Z-Wave dongle */
+ { USB_DEVICE(0x10C4, 0xEA60) }, /* Silicon Labs factory default */
+ { USB_DEVICE(0x10C4, 0xEA61) }, /* Silicon Labs factory default */
+ { USB_DEVICE(0x10C4, 0xEA70) }, /* Silicon Labs factory default */
+diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
+index 8eb68a31cab6..4c8b3b82103d 100644
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -699,6 +699,7 @@ static const struct usb_device_id id_table_combined[] = {
+ { USB_DEVICE(XSENS_VID, XSENS_AWINDA_DONGLE_PID) },
+ { USB_DEVICE(XSENS_VID, XSENS_AWINDA_STATION_PID) },
+ { USB_DEVICE(XSENS_VID, XSENS_CONVERTER_PID) },
++ { USB_DEVICE(XSENS_VID, XSENS_MTDEVBOARD_PID) },
+ { USB_DEVICE(XSENS_VID, XSENS_MTW_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_OMNI1509) },
+ { USB_DEVICE(MOBILITY_VID, MOBILITY_USB_SERIAL_PID) },
+diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
+index 4e4f46f3c89c..792e054126de 100644
+--- a/drivers/usb/serial/ftdi_sio_ids.h
++++ b/drivers/usb/serial/ftdi_sio_ids.h
+@@ -155,6 +155,7 @@
+ #define XSENS_AWINDA_STATION_PID 0x0101
+ #define XSENS_AWINDA_DONGLE_PID 0x0102
+ #define XSENS_MTW_PID 0x0200 /* Xsens MTw */
++#define XSENS_MTDEVBOARD_PID 0x0300 /* Motion Tracker Development Board */
+ #define XSENS_CONVERTER_PID 0xD00D /* Xsens USB-serial converter */
+
+ /* Xsens devices using FTDI VID */
+diff --git a/drivers/w1/slaves/w1_therm.c b/drivers/w1/slaves/w1_therm.c
+index 1f11a20a8ab9..55eb86c9e214 100644
+--- a/drivers/w1/slaves/w1_therm.c
++++ b/drivers/w1/slaves/w1_therm.c
+@@ -59,16 +59,32 @@ MODULE_ALIAS("w1-family-" __stringify(W1_THERM_DS28EA00));
+ static int w1_strong_pullup = 1;
+ module_param_named(strong_pullup, w1_strong_pullup, int, 0);
+
++struct w1_therm_family_data {
++ uint8_t rom[9];
++ atomic_t refcnt;
++};
++
++/* return the address of the refcnt in the family data */
++#define THERM_REFCNT(family_data) \
++ (&((struct w1_therm_family_data*)family_data)->refcnt)
++
+ static int w1_therm_add_slave(struct w1_slave *sl)
+ {
+- sl->family_data = kzalloc(9, GFP_KERNEL);
++ sl->family_data = kzalloc(sizeof(struct w1_therm_family_data),
++ GFP_KERNEL);
+ if (!sl->family_data)
+ return -ENOMEM;
++ atomic_set(THERM_REFCNT(sl->family_data), 1);
+ return 0;
+ }
+
+ static void w1_therm_remove_slave(struct w1_slave *sl)
+ {
++ int refcnt = atomic_sub_return(1, THERM_REFCNT(sl->family_data));
++ while(refcnt) {
++ msleep(1000);
++ refcnt = atomic_read(THERM_REFCNT(sl->family_data));
++ }
+ kfree(sl->family_data);
+ sl->family_data = NULL;
+ }
+@@ -194,13 +210,22 @@ static ssize_t w1_slave_show(struct device *device,
+ struct w1_slave *sl = dev_to_w1_slave(device);
+ struct w1_master *dev = sl->master;
+ u8 rom[9], crc, verdict, external_power;
+- int i, max_trying = 10;
++ int i, ret, max_trying = 10;
+ ssize_t c = PAGE_SIZE;
++ u8 *family_data = sl->family_data;
++
++ ret = mutex_lock_interruptible(&dev->bus_mutex);
++ if (ret != 0)
++ goto post_unlock;
+
+- i = mutex_lock_interruptible(&dev->bus_mutex);
+- if (i != 0)
+- return i;
++ if(!sl->family_data)
++ {
++ ret = -ENODEV;
++ goto pre_unlock;
++ }
+
++ /* prevent the slave from going away in sleep */
++ atomic_inc(THERM_REFCNT(family_data));
+ memset(rom, 0, sizeof(rom));
+
+ while (max_trying--) {
+@@ -230,17 +255,19 @@ static ssize_t w1_slave_show(struct device *device,
+ mutex_unlock(&dev->bus_mutex);
+
+ sleep_rem = msleep_interruptible(tm);
+- if (sleep_rem != 0)
+- return -EINTR;
++ if (sleep_rem != 0) {
++ ret = -EINTR;
++ goto post_unlock;
++ }
+
+- i = mutex_lock_interruptible(&dev->bus_mutex);
+- if (i != 0)
+- return i;
++ ret = mutex_lock_interruptible(&dev->bus_mutex);
++ if (ret != 0)
++ goto post_unlock;
+ } else if (!w1_strong_pullup) {
+ sleep_rem = msleep_interruptible(tm);
+ if (sleep_rem != 0) {
+- mutex_unlock(&dev->bus_mutex);
+- return -EINTR;
++ ret = -EINTR;
++ goto pre_unlock;
+ }
+ }
+
+@@ -269,19 +296,24 @@ static ssize_t w1_slave_show(struct device *device,
+ c -= snprintf(buf + PAGE_SIZE - c, c, ": crc=%02x %s\n",
+ crc, (verdict) ? "YES" : "NO");
+ if (verdict)
+- memcpy(sl->family_data, rom, sizeof(rom));
++ memcpy(family_data, rom, sizeof(rom));
+ else
+ dev_warn(device, "Read failed CRC check\n");
+
+ for (i = 0; i < 9; ++i)
+ c -= snprintf(buf + PAGE_SIZE - c, c, "%02x ",
+- ((u8 *)sl->family_data)[i]);
++ ((u8 *)family_data)[i]);
+
+ c -= snprintf(buf + PAGE_SIZE - c, c, "t=%d\n",
+ w1_convert_temp(rom, sl->family->fid));
++ ret = PAGE_SIZE - c;
++
++pre_unlock:
+ mutex_unlock(&dev->bus_mutex);
+
+- return PAGE_SIZE - c;
++post_unlock:
++ atomic_dec(THERM_REFCNT(family_data));
++ return ret;
+ }
+
+ static int __init w1_therm_init(void)
+diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
+index fce3b5b9a2bb..1cecf25fa14f 100644
+--- a/fs/btrfs/ioctl.c
++++ b/fs/btrfs/ioctl.c
+@@ -2434,8 +2434,6 @@ static noinline int btrfs_ioctl_snap_destroy(struct file *file,
+ goto out_unlock_inode;
+ }
+
+- d_invalidate(dentry);
+-
+ down_write(&root->fs_info->subvol_sem);
+
+ err = may_destroy_subvol(dest);
+@@ -2529,7 +2527,7 @@ out_up_write:
+ out_unlock_inode:
+ mutex_unlock(&inode->i_mutex);
+ if (!err) {
+- shrink_dcache_sb(root->fs_info->sb);
++ d_invalidate(dentry);
+ btrfs_invalidate_inodes(dest);
+ d_delete(dentry);
+ ASSERT(dest->send_in_progress == 0);
+diff --git a/fs/ext4/indirect.c b/fs/ext4/indirect.c
+index 5e7af1c69577..11368881477c 100644
+--- a/fs/ext4/indirect.c
++++ b/fs/ext4/indirect.c
+@@ -565,7 +565,7 @@ int ext4_ind_map_blocks(handle_t *handle, struct inode *inode,
+ EXT4_FEATURE_RO_COMPAT_BIGALLOC)) {
+ EXT4_ERROR_INODE(inode, "Can't allocate blocks for "
+ "non-extent mapped inodes with bigalloc");
+- return -ENOSPC;
++ return -EUCLEAN;
+ }
+
+ /* Set up for the direct block allocation */
+diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
+index 842cdd153c20..120824664d32 100644
+--- a/fs/ext4/inode.c
++++ b/fs/ext4/inode.c
+@@ -1606,19 +1606,32 @@ static int __ext4_journalled_writepage(struct page *page,
+ ext4_walk_page_buffers(handle, page_bufs, 0, len,
+ NULL, bget_one);
+ }
+- /* As soon as we unlock the page, it can go away, but we have
+- * references to buffers so we are safe */
++ /*
++ * We need to release the page lock before we start the
++ * journal, so grab a reference so the page won't disappear
++ * out from under us.
++ */
++ get_page(page);
+ unlock_page(page);
+
+ handle = ext4_journal_start(inode, EXT4_HT_WRITE_PAGE,
+ ext4_writepage_trans_blocks(inode));
+ if (IS_ERR(handle)) {
+ ret = PTR_ERR(handle);
+- goto out;
++ put_page(page);
++ goto out_no_pagelock;
+ }
+-
+ BUG_ON(!ext4_handle_valid(handle));
+
++ lock_page(page);
++ put_page(page);
++ if (page->mapping != mapping) {
++ /* The page got truncated from under us */
++ ext4_journal_stop(handle);
++ ret = 0;
++ goto out;
++ }
++
+ if (inline_data) {
+ BUFFER_TRACE(inode_bh, "get write access");
+ ret = ext4_journal_get_write_access(handle, inode_bh);
+@@ -1644,6 +1657,8 @@ static int __ext4_journalled_writepage(struct page *page,
+ NULL, bput_one);
+ ext4_set_inode_state(inode, EXT4_STATE_JDATA);
+ out:
++ unlock_page(page);
++out_no_pagelock:
+ brelse(inode_bh);
+ return ret;
+ }
+diff --git a/fs/ext4/super.c b/fs/ext4/super.c
+index fc7391e14c2a..bf038468d752 100644
+--- a/fs/ext4/super.c
++++ b/fs/ext4/super.c
+@@ -831,6 +831,7 @@ static void ext4_put_super(struct super_block *sb)
+ dump_orphan_list(sb, sbi);
+ J_ASSERT(list_empty(&sbi->s_orphan));
+
++ sync_blockdev(sb->s_bdev);
+ invalidate_bdev(sb->s_bdev);
+ if (sbi->journal_bdev && sbi->journal_bdev != sb->s_bdev) {
+ /*
+diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c
+index 03246cd9d47a..9e3f6cfee2fb 100644
+--- a/fs/fuse/inode.c
++++ b/fs/fuse/inode.c
+@@ -1049,6 +1049,7 @@ static int fuse_fill_super(struct super_block *sb, void *data, int silent)
+ goto err_fput;
+
+ fuse_conn_init(fc);
++ fc->release = fuse_free_conn;
+
+ fc->dev = sb->s_dev;
+ fc->sb = sb;
+@@ -1063,7 +1064,6 @@ static int fuse_fill_super(struct super_block *sb, void *data, int silent)
+ fc->dont_mask = 1;
+ sb->s_flags |= MS_POSIXACL;
+
+- fc->release = fuse_free_conn;
+ fc->flags = d.flags;
+ fc->user_id = d.user_id;
+ fc->group_id = d.group_id;
+diff --git a/fs/jbd2/checkpoint.c b/fs/jbd2/checkpoint.c
+index 988b32ed4c87..4227dc4f7437 100644
+--- a/fs/jbd2/checkpoint.c
++++ b/fs/jbd2/checkpoint.c
+@@ -390,7 +390,7 @@ int jbd2_cleanup_journal_tail(journal_t *journal)
+ unsigned long blocknr;
+
+ if (is_journal_aborted(journal))
+- return 1;
++ return -EIO;
+
+ if (!jbd2_journal_get_log_tail(journal, &first_tid, &blocknr))
+ return 1;
+@@ -405,10 +405,9 @@ int jbd2_cleanup_journal_tail(journal_t *journal)
+ * jbd2_cleanup_journal_tail() doesn't get called all that often.
+ */
+ if (journal->j_flags & JBD2_BARRIER)
+- blkdev_issue_flush(journal->j_fs_dev, GFP_KERNEL, NULL);
++ blkdev_issue_flush(journal->j_fs_dev, GFP_NOFS, NULL);
+
+- __jbd2_update_log_tail(journal, first_tid, blocknr);
+- return 0;
++ return __jbd2_update_log_tail(journal, first_tid, blocknr);
+ }
+
+
+diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c
+index 1df94fabe4eb..be6f7178d23a 100644
+--- a/fs/jbd2/journal.c
++++ b/fs/jbd2/journal.c
+@@ -885,9 +885,10 @@ int jbd2_journal_get_log_tail(journal_t *journal, tid_t *tid,
+ *
+ * Requires j_checkpoint_mutex
+ */
+-void __jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block)
++int __jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block)
+ {
+ unsigned long freed;
++ int ret;
+
+ BUG_ON(!mutex_is_locked(&journal->j_checkpoint_mutex));
+
+@@ -897,7 +898,10 @@ void __jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block)
+ * space and if we lose sb update during power failure we'd replay
+ * old transaction with possibly newly overwritten data.
+ */
+- jbd2_journal_update_sb_log_tail(journal, tid, block, WRITE_FUA);
++ ret = jbd2_journal_update_sb_log_tail(journal, tid, block, WRITE_FUA);
++ if (ret)
++ goto out;
++
+ write_lock(&journal->j_state_lock);
+ freed = block - journal->j_tail;
+ if (block < journal->j_tail)
+@@ -913,6 +917,9 @@ void __jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block)
+ journal->j_tail_sequence = tid;
+ journal->j_tail = block;
+ write_unlock(&journal->j_state_lock);
++
++out:
++ return ret;
+ }
+
+ /*
+@@ -1331,7 +1338,7 @@ static int journal_reset(journal_t *journal)
+ return jbd2_journal_start_thread(journal);
+ }
+
+-static void jbd2_write_superblock(journal_t *journal, int write_op)
++static int jbd2_write_superblock(journal_t *journal, int write_op)
+ {
+ struct buffer_head *bh = journal->j_sb_buffer;
+ journal_superblock_t *sb = journal->j_superblock;
+@@ -1370,7 +1377,10 @@ static void jbd2_write_superblock(journal_t *journal, int write_op)
+ printk(KERN_ERR "JBD2: Error %d detected when updating "
+ "journal superblock for %s.\n", ret,
+ journal->j_devname);
++ jbd2_journal_abort(journal, ret);
+ }
++
++ return ret;
+ }
+
+ /**
+@@ -1383,10 +1393,11 @@ static void jbd2_write_superblock(journal_t *journal, int write_op)
+ * Update a journal's superblock information about log tail and write it to
+ * disk, waiting for the IO to complete.
+ */
+-void jbd2_journal_update_sb_log_tail(journal_t *journal, tid_t tail_tid,
++int jbd2_journal_update_sb_log_tail(journal_t *journal, tid_t tail_tid,
+ unsigned long tail_block, int write_op)
+ {
+ journal_superblock_t *sb = journal->j_superblock;
++ int ret;
+
+ BUG_ON(!mutex_is_locked(&journal->j_checkpoint_mutex));
+ jbd_debug(1, "JBD2: updating superblock (start %lu, seq %u)\n",
+@@ -1395,13 +1406,18 @@ void jbd2_journal_update_sb_log_tail(journal_t *journal, tid_t tail_tid,
+ sb->s_sequence = cpu_to_be32(tail_tid);
+ sb->s_start = cpu_to_be32(tail_block);
+
+- jbd2_write_superblock(journal, write_op);
++ ret = jbd2_write_superblock(journal, write_op);
++ if (ret)
++ goto out;
+
+ /* Log is no longer empty */
+ write_lock(&journal->j_state_lock);
+ WARN_ON(!sb->s_sequence);
+ journal->j_flags &= ~JBD2_FLUSHED;
+ write_unlock(&journal->j_state_lock);
++
++out:
++ return ret;
+ }
+
+ /**
+@@ -1951,7 +1967,14 @@ int jbd2_journal_flush(journal_t *journal)
+ return -EIO;
+
+ mutex_lock(&journal->j_checkpoint_mutex);
+- jbd2_cleanup_journal_tail(journal);
++ if (!err) {
++ err = jbd2_cleanup_journal_tail(journal);
++ if (err < 0) {
++ mutex_unlock(&journal->j_checkpoint_mutex);
++ goto out;
++ }
++ err = 0;
++ }
+
+ /* Finally, mark the journal as really needing no recovery.
+ * This sets s_start==0 in the underlying superblock, which is
+@@ -1967,7 +1990,8 @@ int jbd2_journal_flush(journal_t *journal)
+ J_ASSERT(journal->j_head == journal->j_tail);
+ J_ASSERT(journal->j_tail_sequence == journal->j_transaction_sequence);
+ write_unlock(&journal->j_state_lock);
+- return 0;
++out:
++ return err;
+ }
+
+ /**
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index cd617076aeca..b13edc0865f7 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -38,6 +38,7 @@
+ #include <linux/mm.h>
+ #include <linux/delay.h>
+ #include <linux/errno.h>
++#include <linux/file.h>
+ #include <linux/string.h>
+ #include <linux/ratelimit.h>
+ #include <linux/printk.h>
+@@ -5355,6 +5356,7 @@ static struct nfs4_unlockdata *nfs4_alloc_unlockdata(struct file_lock *fl,
+ atomic_inc(&lsp->ls_count);
+ /* Ensure we don't close file until we're done freeing locks! */
+ p->ctx = get_nfs_open_context(ctx);
++ get_file(fl->fl_file);
+ memcpy(&p->fl, fl, sizeof(p->fl));
+ p->server = NFS_SERVER(inode);
+ return p;
+@@ -5366,6 +5368,7 @@ static void nfs4_locku_release_calldata(void *data)
+ nfs_free_seqid(calldata->arg.seqid);
+ nfs4_put_lock_state(calldata->lsp);
+ put_nfs_open_context(calldata->ctx);
++ fput(calldata->fl.fl_file);
+ kfree(calldata);
+ }
+
+@@ -5550,6 +5553,7 @@ static struct nfs4_lockdata *nfs4_alloc_lockdata(struct file_lock *fl,
+ p->server = server;
+ atomic_inc(&lsp->ls_count);
+ p->ctx = get_nfs_open_context(ctx);
++ get_file(fl->fl_file);
+ memcpy(&p->fl, fl, sizeof(p->fl));
+ return p;
+ out_free_seqid:
+@@ -5639,6 +5643,7 @@ static void nfs4_lock_release(void *calldata)
+ nfs_free_seqid(data->arg.lock_seqid);
+ nfs4_put_lock_state(data->lsp);
+ put_nfs_open_context(data->ctx);
++ fput(data->fl.fl_file);
+ kfree(data);
+ dprintk("%s: done!\n", __func__);
+ }
+diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
+index 5194933ed419..1f9d57ab8df4 100644
+--- a/fs/nfs/nfs4state.c
++++ b/fs/nfs/nfs4state.c
+@@ -1455,6 +1455,8 @@ restart:
+ spin_unlock(&state->state_lock);
+ }
+ nfs4_put_open_state(state);
++ clear_bit(NFS4CLNT_RECLAIM_NOGRACE,
++ &state->flags);
+ spin_lock(&sp->so_lock);
+ goto restart;
+ }
+diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c
+index 883ee88e5f5e..354f66609316 100644
+--- a/fs/nfs/pnfs.c
++++ b/fs/nfs/pnfs.c
+@@ -1535,6 +1535,7 @@ int pnfs_write_done_resend_to_mds(struct nfs_pgio_header *hdr)
+ /* Resend all requests through the MDS */
+ nfs_pageio_init_write(&pgio, hdr->inode, FLUSH_STABLE, true,
+ hdr->completion_ops);
++ set_bit(NFS_CONTEXT_RESEND_WRITES, &hdr->args.context->flags);
+ return nfs_pageio_resend(&pgio, hdr);
+ }
+ EXPORT_SYMBOL_GPL(pnfs_write_done_resend_to_mds);
+@@ -1576,6 +1577,7 @@ pnfs_write_through_mds(struct nfs_pageio_descriptor *desc,
+ desc->pg_recoalesce = 1;
+ }
+ nfs_pgio_data_destroy(hdr);
++ hdr->release(hdr);
+ }
+
+ static enum pnfs_try_status
+@@ -1692,6 +1694,7 @@ pnfs_read_through_mds(struct nfs_pageio_descriptor *desc,
+ desc->pg_recoalesce = 1;
+ }
+ nfs_pgio_data_destroy(hdr);
++ hdr->release(hdr);
+ }
+
+ /*
+diff --git a/fs/nfs/write.c b/fs/nfs/write.c
+index f83b02dc9166..6067f2a0b493 100644
+--- a/fs/nfs/write.c
++++ b/fs/nfs/write.c
+@@ -1252,6 +1252,7 @@ static void nfs_initiate_write(struct nfs_pgio_header *hdr,
+ static void nfs_redirty_request(struct nfs_page *req)
+ {
+ nfs_mark_request_dirty(req);
++ set_bit(NFS_CONTEXT_RESEND_WRITES, &req->wb_context->flags);
+ nfs_unlock_request(req);
+ nfs_end_page_writeback(req);
+ nfs_release_request(req);
+diff --git a/fs/xfs/xfs_symlink.c b/fs/xfs/xfs_symlink.c
+index 02ae62a998e0..6a93fd583ec0 100644
+--- a/fs/xfs/xfs_symlink.c
++++ b/fs/xfs/xfs_symlink.c
+@@ -107,7 +107,7 @@ xfs_readlink_bmap(
+ cur_chunk += sizeof(struct xfs_dsymlink_hdr);
+ }
+
+- memcpy(link + offset, bp->b_addr, byte_cnt);
++ memcpy(link + offset, cur_chunk, byte_cnt);
+
+ pathlen -= byte_cnt;
+ offset += byte_cnt;
+diff --git a/include/linux/jbd2.h b/include/linux/jbd2.h
+index 704b9a599b26..dadb42109dec 100644
+--- a/include/linux/jbd2.h
++++ b/include/linux/jbd2.h
+@@ -1035,7 +1035,7 @@ struct buffer_head *jbd2_journal_get_descriptor_buffer(journal_t *journal);
+ int jbd2_journal_next_log_block(journal_t *, unsigned long long *);
+ int jbd2_journal_get_log_tail(journal_t *journal, tid_t *tid,
+ unsigned long *block);
+-void __jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block);
++int __jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block);
+ void jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block);
+
+ /* Commit management */
+@@ -1157,7 +1157,7 @@ extern int jbd2_journal_recover (journal_t *journal);
+ extern int jbd2_journal_wipe (journal_t *, int);
+ extern int jbd2_journal_skip_recovery (journal_t *);
+ extern void jbd2_journal_update_sb_errno(journal_t *);
+-extern void jbd2_journal_update_sb_log_tail (journal_t *, tid_t,
++extern int jbd2_journal_update_sb_log_tail (journal_t *, tid_t,
+ unsigned long, int);
+ extern void __jbd2_journal_abort_hard (journal_t *);
+ extern void jbd2_journal_abort (journal_t *, int);
+diff --git a/include/linux/kmemleak.h b/include/linux/kmemleak.h
+index 057e95971014..19acfdc3828f 100644
+--- a/include/linux/kmemleak.h
++++ b/include/linux/kmemleak.h
+@@ -26,7 +26,8 @@
+ extern void kmemleak_init(void) __ref;
+ extern void kmemleak_alloc(const void *ptr, size_t size, int min_count,
+ gfp_t gfp) __ref;
+-extern void kmemleak_alloc_percpu(const void __percpu *ptr, size_t size) __ref;
++extern void kmemleak_alloc_percpu(const void __percpu *ptr, size_t size,
++ gfp_t gfp) __ref;
+ extern void kmemleak_free(const void *ptr) __ref;
+ extern void kmemleak_free_part(const void *ptr, size_t size) __ref;
+ extern void kmemleak_free_percpu(const void __percpu *ptr) __ref;
+@@ -69,7 +70,8 @@ static inline void kmemleak_alloc_recursive(const void *ptr, size_t size,
+ gfp_t gfp)
+ {
+ }
+-static inline void kmemleak_alloc_percpu(const void __percpu *ptr, size_t size)
++static inline void kmemleak_alloc_percpu(const void __percpu *ptr, size_t size,
++ gfp_t gfp)
+ {
+ }
+ static inline void kmemleak_free(const void *ptr)
+diff --git a/include/linux/nfs_xdr.h b/include/linux/nfs_xdr.h
+index d77a08d25223..d71682435f4a 100644
+--- a/include/linux/nfs_xdr.h
++++ b/include/linux/nfs_xdr.h
+@@ -1132,7 +1132,7 @@ struct nfs41_state_protection {
+ struct nfs4_op_map allow;
+ };
+
+-#define NFS4_EXCHANGE_ID_LEN (48)
++#define NFS4_EXCHANGE_ID_LEN (127)
+ struct nfs41_exchange_id_args {
+ struct nfs_client *client;
+ nfs4_verifier *verifier;
+diff --git a/include/linux/pci.h b/include/linux/pci.h
+index 2882c13c6391..e92cdad3240d 100644
+--- a/include/linux/pci.h
++++ b/include/linux/pci.h
+@@ -993,6 +993,7 @@ int __must_check pci_assign_resource(struct pci_dev *dev, int i);
+ int __must_check pci_reassign_resource(struct pci_dev *dev, int i, resource_size_t add_size, resource_size_t align);
+ int pci_select_bars(struct pci_dev *dev, unsigned long flags);
+ bool pci_device_is_present(struct pci_dev *pdev);
++void pci_ignore_hotplug(struct pci_dev *dev);
+
+ /* ROM control related routines */
+ int pci_enable_rom(struct pci_dev *pdev);
+@@ -1028,11 +1029,6 @@ bool pci_dev_run_wake(struct pci_dev *dev);
+ bool pci_check_pme_status(struct pci_dev *dev);
+ void pci_pme_wakeup_bus(struct pci_bus *bus);
+
+-static inline void pci_ignore_hotplug(struct pci_dev *dev)
+-{
+- dev->ignore_hotplug = 1;
+-}
+-
+ static inline int pci_enable_wake(struct pci_dev *dev, pci_power_t state,
+ bool enable)
+ {
+diff --git a/include/linux/rhashtable.h b/include/linux/rhashtable.h
+index fb298e9d6d3a..84056743780a 100644
+--- a/include/linux/rhashtable.h
++++ b/include/linux/rhashtable.h
+@@ -108,7 +108,7 @@ int rhashtable_expand(struct rhashtable *ht, gfp_t flags);
+ int rhashtable_shrink(struct rhashtable *ht, gfp_t flags);
+
+ void *rhashtable_lookup(const struct rhashtable *ht, const void *key);
+-void *rhashtable_lookup_compare(const struct rhashtable *ht, u32 hash,
++void *rhashtable_lookup_compare(const struct rhashtable *ht, void *key,
+ bool (*compare)(void *, void *), void *arg);
+
+ void rhashtable_destroy(const struct rhashtable *ht);
+diff --git a/include/net/netfilter/nf_queue.h b/include/net/netfilter/nf_queue.h
+index 84a53d780306..1a91f979160e 100644
+--- a/include/net/netfilter/nf_queue.h
++++ b/include/net/netfilter/nf_queue.h
+@@ -28,6 +28,8 @@ struct nf_queue_entry {
+ struct nf_queue_handler {
+ int (*outfn)(struct nf_queue_entry *entry,
+ unsigned int queuenum);
++ void (*nf_hook_drop)(struct net *net,
++ struct nf_hook_ops *ops);
+ };
+
+ void nf_register_queue_handler(const struct nf_queue_handler *qh);
+diff --git a/include/net/netns/sctp.h b/include/net/netns/sctp.h
+index 3573a81815ad..8ba379f9e467 100644
+--- a/include/net/netns/sctp.h
++++ b/include/net/netns/sctp.h
+@@ -31,6 +31,7 @@ struct netns_sctp {
+ struct list_head addr_waitq;
+ struct timer_list addr_wq_timer;
+ struct list_head auto_asconf_splist;
++ /* Lock that protects both addr_waitq and auto_asconf_splist */
+ spinlock_t addr_wq_lock;
+
+ /* Lock that protects the local_addr_list writers */
+diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h
+index 4ff3f67be62c..2ad3a7bc8385 100644
+--- a/include/net/sctp/structs.h
++++ b/include/net/sctp/structs.h
+@@ -223,6 +223,10 @@ struct sctp_sock {
+ atomic_t pd_mode;
+ /* Receive to here while partial delivery is in effect. */
+ struct sk_buff_head pd_lobby;
++
++ /* These must be the last fields, as they will skipped on copies,
++ * like on accept and peeloff operations
++ */
+ struct list_head auto_asconf_list;
+ int do_auto_asconf;
+ };
+diff --git a/include/uapi/drm/radeon_drm.h b/include/uapi/drm/radeon_drm.h
+index 50d0fb41a3bf..76d2edea5bd1 100644
+--- a/include/uapi/drm/radeon_drm.h
++++ b/include/uapi/drm/radeon_drm.h
+@@ -1034,6 +1034,7 @@ struct drm_radeon_cs {
+ #define RADEON_INFO_VRAM_USAGE 0x1e
+ #define RADEON_INFO_GTT_USAGE 0x1f
+ #define RADEON_INFO_ACTIVE_CU_COUNT 0x20
++#define RADEON_INFO_VA_UNMAP_WORKING 0x25
+
+ struct drm_radeon_info {
+ uint32_t request;
+diff --git a/kernel/irq/devres.c b/kernel/irq/devres.c
+index d5d0f7345c54..74d90a754268 100644
+--- a/kernel/irq/devres.c
++++ b/kernel/irq/devres.c
+@@ -104,7 +104,7 @@ int devm_request_any_context_irq(struct device *dev, unsigned int irq,
+ return -ENOMEM;
+
+ rc = request_any_context_irq(irq, handler, irqflags, devname, dev_id);
+- if (rc) {
++ if (rc < 0) {
+ devres_free(dr);
+ return rc;
+ }
+@@ -113,7 +113,7 @@ int devm_request_any_context_irq(struct device *dev, unsigned int irq,
+ dr->dev_id = dev_id;
+ devres_add(dev, dr);
+
+- return 0;
++ return rc;
+ }
+ EXPORT_SYMBOL(devm_request_any_context_irq);
+
+diff --git a/kernel/power/Kconfig b/kernel/power/Kconfig
+index bbef57f5bdfd..c2ae4618a159 100644
+--- a/kernel/power/Kconfig
++++ b/kernel/power/Kconfig
+@@ -191,7 +191,7 @@ config DPM_WATCHDOG
+ config DPM_WATCHDOG_TIMEOUT
+ int "Watchdog timeout in seconds"
+ range 1 120
+- default 12
++ default 60
+ depends on DPM_WATCHDOG
+
+ config PM_TRACE
+diff --git a/kernel/rcu/tiny.c b/kernel/rcu/tiny.c
+index c0623fc47125..da80f2f73b50 100644
+--- a/kernel/rcu/tiny.c
++++ b/kernel/rcu/tiny.c
+@@ -282,6 +282,11 @@ static void __rcu_process_callbacks(struct rcu_ctrlblk *rcp)
+
+ /* Move the ready-to-invoke callbacks to a local list. */
+ local_irq_save(flags);
++ if (rcp->donetail == &rcp->rcucblist) {
++ /* No callbacks ready, so just leave. */
++ local_irq_restore(flags);
++ return;
++ }
+ RCU_TRACE(trace_rcu_batch_start(rcp->name, 0, rcp->qlen, -1));
+ list = rcp->rcucblist;
+ rcp->rcucblist = *rcp->donetail;
+diff --git a/kernel/softirq.c b/kernel/softirq.c
+index 0699add19164..9e787d8311b5 100644
+--- a/kernel/softirq.c
++++ b/kernel/softirq.c
+@@ -656,9 +656,13 @@ static void run_ksoftirqd(unsigned int cpu)
+ * in the task stack here.
+ */
+ __do_softirq();
+- rcu_note_context_switch(cpu);
+ local_irq_enable();
+ cond_resched();
++
++ preempt_disable();
++ rcu_note_context_switch(cpu);
++ preempt_enable();
++
+ return;
+ }
+ local_irq_enable();
+diff --git a/kernel/trace/ring_buffer_benchmark.c b/kernel/trace/ring_buffer_benchmark.c
+index 3f9e328c30b5..728f99b4533d 100644
+--- a/kernel/trace/ring_buffer_benchmark.c
++++ b/kernel/trace/ring_buffer_benchmark.c
+@@ -452,7 +452,7 @@ static int __init ring_buffer_benchmark_init(void)
+
+ if (producer_fifo >= 0) {
+ struct sched_param param = {
+- .sched_priority = consumer_fifo
++ .sched_priority = producer_fifo
+ };
+ sched_setscheduler(producer, SCHED_FIFO, ¶m);
+ } else
+diff --git a/kernel/trace/trace_events_filter.c b/kernel/trace/trace_events_filter.c
+index 7a8c1528e141..bcb9145a7913 100644
+--- a/kernel/trace/trace_events_filter.c
++++ b/kernel/trace/trace_events_filter.c
+@@ -1050,6 +1050,9 @@ static void parse_init(struct filter_parse_state *ps,
+
+ static char infix_next(struct filter_parse_state *ps)
+ {
++ if (!ps->infix.cnt)
++ return 0;
++
+ ps->infix.cnt--;
+
+ return ps->infix.string[ps->infix.tail++];
+@@ -1065,6 +1068,9 @@ static char infix_peek(struct filter_parse_state *ps)
+
+ static void infix_advance(struct filter_parse_state *ps)
+ {
++ if (!ps->infix.cnt)
++ return;
++
+ ps->infix.cnt--;
+ ps->infix.tail++;
+ }
+diff --git a/lib/rhashtable.c b/lib/rhashtable.c
+index 624a0b7c05ef..cb22073fe687 100644
+--- a/lib/rhashtable.c
++++ b/lib/rhashtable.c
+@@ -61,6 +61,8 @@ static u32 __hashfn(const struct rhashtable *ht, const void *key,
+ * Computes the hash value using the hash function provided in the 'hashfn'
+ * of struct rhashtable_params. The returned value is guaranteed to be
+ * smaller than the number of buckets in the hash table.
++ *
++ * The caller must ensure that no concurrent table mutations occur.
+ */
+ u32 rhashtable_hashfn(const struct rhashtable *ht, const void *key, u32 len)
+ {
+@@ -92,6 +94,8 @@ static u32 obj_hashfn(const struct rhashtable *ht, const void *ptr, u32 hsize)
+ * 'obj_hashfn' depending on whether the hash table is set up to work with
+ * a fixed length key. The returned value is guaranteed to be smaller than
+ * the number of buckets in the hash table.
++ *
++ * The caller must ensure that no concurrent table mutations occur.
+ */
+ u32 rhashtable_obj_hashfn(const struct rhashtable *ht, void *ptr)
+ {
+@@ -474,7 +478,7 @@ EXPORT_SYMBOL_GPL(rhashtable_lookup);
+ /**
+ * rhashtable_lookup_compare - search hash table with compare function
+ * @ht: hash table
+- * @hash: hash value of desired entry
++ * @key: pointer to key
+ * @compare: compare function, must return true on match
+ * @arg: argument passed on to compare function
+ *
+@@ -486,14 +490,14 @@ EXPORT_SYMBOL_GPL(rhashtable_lookup);
+ *
+ * Returns the first entry on which the compare function returned true.
+ */
+-void *rhashtable_lookup_compare(const struct rhashtable *ht, u32 hash,
++void *rhashtable_lookup_compare(const struct rhashtable *ht, void *key,
+ bool (*compare)(void *, void *), void *arg)
+ {
+ const struct bucket_table *tbl = rht_dereference_rcu(ht->tbl, ht);
+ struct rhash_head *he;
++ u32 hash;
+
+- if (unlikely(hash >= tbl->size))
+- return NULL;
++ hash = __hashfn(ht, key, ht->p.key_len, tbl->size);
+
+ rht_for_each_rcu(he, tbl->buckets[hash], ht) {
+ if (!compare(rht_obj(ht, he), arg))
+diff --git a/mm/kmemleak.c b/mm/kmemleak.c
+index 3cda50c1e394..1f14ef68a5c8 100644
+--- a/mm/kmemleak.c
++++ b/mm/kmemleak.c
+@@ -193,6 +193,8 @@ static struct kmem_cache *scan_area_cache;
+
+ /* set if tracing memory operations is enabled */
+ static int kmemleak_enabled;
++/* same as above but only for the kmemleak_free() callback */
++static int kmemleak_free_enabled;
+ /* set in the late_initcall if there were no errors */
+ static int kmemleak_initialized;
+ /* enables or disables early logging of the memory operations */
+@@ -905,12 +907,13 @@ EXPORT_SYMBOL_GPL(kmemleak_alloc);
+ * kmemleak_alloc_percpu - register a newly allocated __percpu object
+ * @ptr: __percpu pointer to beginning of the object
+ * @size: size of the object
++ * @gfp: flags used for kmemleak internal memory allocations
+ *
+ * This function is called from the kernel percpu allocator when a new object
+- * (memory block) is allocated (alloc_percpu). It assumes GFP_KERNEL
+- * allocation.
++ * (memory block) is allocated (alloc_percpu).
+ */
+-void __ref kmemleak_alloc_percpu(const void __percpu *ptr, size_t size)
++void __ref kmemleak_alloc_percpu(const void __percpu *ptr, size_t size,
++ gfp_t gfp)
+ {
+ unsigned int cpu;
+
+@@ -923,7 +926,7 @@ void __ref kmemleak_alloc_percpu(const void __percpu *ptr, size_t size)
+ if (kmemleak_enabled && ptr && !IS_ERR(ptr))
+ for_each_possible_cpu(cpu)
+ create_object((unsigned long)per_cpu_ptr(ptr, cpu),
+- size, 0, GFP_KERNEL);
++ size, 0, gfp);
+ else if (kmemleak_early_log)
+ log_early(KMEMLEAK_ALLOC_PERCPU, ptr, size, 0);
+ }
+@@ -940,7 +943,7 @@ void __ref kmemleak_free(const void *ptr)
+ {
+ pr_debug("%s(0x%p)\n", __func__, ptr);
+
+- if (kmemleak_enabled && ptr && !IS_ERR(ptr))
++ if (kmemleak_free_enabled && ptr && !IS_ERR(ptr))
+ delete_object_full((unsigned long)ptr);
+ else if (kmemleak_early_log)
+ log_early(KMEMLEAK_FREE, ptr, 0, 0);
+@@ -980,7 +983,7 @@ void __ref kmemleak_free_percpu(const void __percpu *ptr)
+
+ pr_debug("%s(0x%p)\n", __func__, ptr);
+
+- if (kmemleak_enabled && ptr && !IS_ERR(ptr))
++ if (kmemleak_free_enabled && ptr && !IS_ERR(ptr))
+ for_each_possible_cpu(cpu)
+ delete_object_full((unsigned long)per_cpu_ptr(ptr,
+ cpu));
+@@ -1743,6 +1746,13 @@ static void kmemleak_do_cleanup(struct work_struct *work)
+ mutex_lock(&scan_mutex);
+ stop_scan_thread();
+
++ /*
++ * Once the scan thread has stopped, it is safe to no longer track
++ * object freeing. Ordering of the scan thread stopping and the memory
++ * accesses below is guaranteed by the kthread_stop() function.
++ */
++ kmemleak_free_enabled = 0;
++
+ if (!kmemleak_found_leaks)
+ __kmemleak_do_cleanup();
+ else
+@@ -1769,6 +1779,8 @@ static void kmemleak_disable(void)
+ /* check whether it is too early for a kernel thread */
+ if (kmemleak_initialized)
+ schedule_work(&cleanup_work);
++ else
++ kmemleak_free_enabled = 0;
+
+ pr_info("Kernel memory leak detector disabled\n");
+ }
+@@ -1833,8 +1845,10 @@ void __init kmemleak_init(void)
+ if (kmemleak_error) {
+ local_irq_restore(flags);
+ return;
+- } else
++ } else {
+ kmemleak_enabled = 1;
++ kmemleak_free_enabled = 1;
++ }
+ local_irq_restore(flags);
+
+ /*
+diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c
+index 8c71654e261f..05014e89efae 100644
+--- a/mm/memory_hotplug.c
++++ b/mm/memory_hotplug.c
+@@ -1978,8 +1978,10 @@ void try_offline_node(int nid)
+ * wait_table may be allocated from boot memory,
+ * here only free if it's allocated by vmalloc.
+ */
+- if (is_vmalloc_addr(zone->wait_table))
++ if (is_vmalloc_addr(zone->wait_table)) {
+ vfree(zone->wait_table);
++ zone->wait_table = NULL;
++ }
+ }
+ }
+ EXPORT_SYMBOL(try_offline_node);
+diff --git a/mm/percpu.c b/mm/percpu.c
+index 014bab65e0ff..88bb6c92d83a 100644
+--- a/mm/percpu.c
++++ b/mm/percpu.c
+@@ -1030,7 +1030,7 @@ area_found:
+ memset((void *)pcpu_chunk_addr(chunk, cpu, 0) + off, 0, size);
+
+ ptr = __addr_to_pcpu_ptr(chunk->base_addr + off);
+- kmemleak_alloc_percpu(ptr, size);
++ kmemleak_alloc_percpu(ptr, size, gfp);
+ return ptr;
+
+ fail_unlock:
+diff --git a/net/bridge/br_ioctl.c b/net/bridge/br_ioctl.c
+index a9a4a1b7863d..8d423bc649b9 100644
+--- a/net/bridge/br_ioctl.c
++++ b/net/bridge/br_ioctl.c
+@@ -247,9 +247,7 @@ static int old_dev_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
+ if (!ns_capable(dev_net(dev)->user_ns, CAP_NET_ADMIN))
+ return -EPERM;
+
+- spin_lock_bh(&br->lock);
+ br_stp_set_bridge_priority(br, args[1]);
+- spin_unlock_bh(&br->lock);
+ return 0;
+
+ case BRCTL_SET_PORT_PRIORITY:
+diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
+index b0aee78dba41..c08f510fce30 100644
+--- a/net/bridge/br_multicast.c
++++ b/net/bridge/br_multicast.c
+@@ -1166,6 +1166,9 @@ static void br_multicast_add_router(struct net_bridge *br,
+ struct net_bridge_port *p;
+ struct hlist_node *slot = NULL;
+
++ if (!hlist_unhashed(&port->rlist))
++ return;
++
+ hlist_for_each_entry(p, &br->router_list, rlist) {
+ if ((unsigned long) port >= (unsigned long) p)
+ break;
+@@ -1193,12 +1196,8 @@ static void br_multicast_mark_router(struct net_bridge *br,
+ if (port->multicast_router != 1)
+ return;
+
+- if (!hlist_unhashed(&port->rlist))
+- goto timer;
+-
+ br_multicast_add_router(br, port);
+
+-timer:
+ mod_timer(&port->multicast_router_timer,
+ now + br->multicast_querier_interval);
+ }
+diff --git a/net/bridge/br_stp_if.c b/net/bridge/br_stp_if.c
+index 41146872c1b4..7832d07f48f6 100644
+--- a/net/bridge/br_stp_if.c
++++ b/net/bridge/br_stp_if.c
+@@ -243,12 +243,13 @@ bool br_stp_recalculate_bridge_id(struct net_bridge *br)
+ return true;
+ }
+
+-/* called under bridge lock */
++/* Acquires and releases bridge lock */
+ void br_stp_set_bridge_priority(struct net_bridge *br, u16 newprio)
+ {
+ struct net_bridge_port *p;
+ int wasroot;
+
++ spin_lock_bh(&br->lock);
+ wasroot = br_is_root_bridge(br);
+
+ list_for_each_entry(p, &br->port_list, list) {
+@@ -266,6 +267,7 @@ void br_stp_set_bridge_priority(struct net_bridge *br, u16 newprio)
+ br_port_state_selection(br);
+ if (br_is_root_bridge(br) && !wasroot)
+ br_become_root_bridge(br);
++ spin_unlock_bh(&br->lock);
+ }
+
+ /* called under bridge lock */
+diff --git a/net/core/neighbour.c b/net/core/neighbour.c
+index ef31fef25e5a..2b0d99dad8be 100644
+--- a/net/core/neighbour.c
++++ b/net/core/neighbour.c
+@@ -977,6 +977,8 @@ int __neigh_event_send(struct neighbour *neigh, struct sk_buff *skb)
+ rc = 0;
+ if (neigh->nud_state & (NUD_CONNECTED | NUD_DELAY | NUD_PROBE))
+ goto out_unlock_bh;
++ if (neigh->dead)
++ goto out_dead;
+
+ if (!(neigh->nud_state & (NUD_STALE | NUD_INCOMPLETE))) {
+ if (NEIGH_VAR(neigh->parms, MCAST_PROBES) +
+@@ -1033,6 +1035,13 @@ out_unlock_bh:
+ write_unlock(&neigh->lock);
+ local_bh_enable();
+ return rc;
++
++out_dead:
++ if (neigh->nud_state & NUD_STALE)
++ goto out_unlock_bh;
++ write_unlock_bh(&neigh->lock);
++ kfree_skb(skb);
++ return 1;
+ }
+ EXPORT_SYMBOL(__neigh_event_send);
+
+@@ -1096,6 +1105,8 @@ int neigh_update(struct neighbour *neigh, const u8 *lladdr, u8 new,
+ if (!(flags & NEIGH_UPDATE_F_ADMIN) &&
+ (old & (NUD_NOARP | NUD_PERMANENT)))
+ goto out;
++ if (neigh->dead)
++ goto out;
+
+ if (!(new & NUD_VALID)) {
+ neigh_del_timer(neigh);
+@@ -1245,6 +1256,8 @@ EXPORT_SYMBOL(neigh_update);
+ */
+ void __neigh_set_probe_once(struct neighbour *neigh)
+ {
++ if (neigh->dead)
++ return;
+ neigh->updated = jiffies;
+ if (!(neigh->nud_state & NUD_FAILED))
+ return;
+diff --git a/net/core/skbuff.c b/net/core/skbuff.c
+index 02ebb7133312..72400a1bb439 100644
+--- a/net/core/skbuff.c
++++ b/net/core/skbuff.c
+@@ -4199,7 +4199,7 @@ struct sk_buff *alloc_skb_with_frags(unsigned long header_len,
+
+ while (order) {
+ if (npages >= 1 << order) {
+- page = alloc_pages(gfp_mask |
++ page = alloc_pages((gfp_mask & ~__GFP_WAIT) |
+ __GFP_COMP |
+ __GFP_NOWARN |
+ __GFP_NORETRY,
+diff --git a/net/core/sock.c b/net/core/sock.c
+index 852acbc52f96..1e5130de31b6 100644
+--- a/net/core/sock.c
++++ b/net/core/sock.c
+@@ -1854,7 +1854,7 @@ bool skb_page_frag_refill(unsigned int sz, struct page_frag *pfrag, gfp_t gfp)
+
+ pfrag->offset = 0;
+ if (SKB_FRAG_PAGE_ORDER) {
+- pfrag->page = alloc_pages(gfp | __GFP_COMP |
++ pfrag->page = alloc_pages((gfp & ~__GFP_WAIT) | __GFP_COMP |
+ __GFP_NOWARN | __GFP_NORETRY,
+ SKB_FRAG_PAGE_ORDER);
+ if (likely(pfrag->page)) {
+diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
+index e67da4e6c324..9a173577a790 100644
+--- a/net/ipv4/af_inet.c
++++ b/net/ipv4/af_inet.c
+@@ -228,6 +228,8 @@ int inet_listen(struct socket *sock, int backlog)
+ err = 0;
+ if (err)
+ goto out;
++
++ tcp_fastopen_init_key_once(true);
+ }
+ err = inet_csk_listen_start(sk, backlog);
+ if (err)
+diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
+index de6195485b31..32b25cc96fff 100644
+--- a/net/ipv4/tcp.c
++++ b/net/ipv4/tcp.c
+@@ -2585,10 +2585,13 @@ static int do_tcp_setsockopt(struct sock *sk, int level,
+
+ case TCP_FASTOPEN:
+ if (val >= 0 && ((1 << sk->sk_state) & (TCPF_CLOSE |
+- TCPF_LISTEN)))
++ TCPF_LISTEN))) {
++ tcp_fastopen_init_key_once(true);
++
+ err = fastopen_init_queue(sk, val);
+- else
++ } else {
+ err = -EINVAL;
++ }
+ break;
+ case TCP_TIMESTAMP:
+ if (!tp->repair)
+diff --git a/net/ipv4/tcp_fastopen.c b/net/ipv4/tcp_fastopen.c
+index c73077280ad4..b01d5bd6d6ca 100644
+--- a/net/ipv4/tcp_fastopen.c
++++ b/net/ipv4/tcp_fastopen.c
+@@ -78,8 +78,6 @@ static bool __tcp_fastopen_cookie_gen(const void *path,
+ struct tcp_fastopen_context *ctx;
+ bool ok = false;
+
+- tcp_fastopen_init_key_once(true);
+-
+ rcu_read_lock();
+ ctx = rcu_dereference(tcp_fastopen_ctx);
+ if (ctx) {
+diff --git a/net/netfilter/core.c b/net/netfilter/core.c
+index 024a2e25c8a4..d047a6679ff2 100644
+--- a/net/netfilter/core.c
++++ b/net/netfilter/core.c
+@@ -88,6 +88,7 @@ void nf_unregister_hook(struct nf_hook_ops *reg)
+ static_key_slow_dec(&nf_hooks_needed[reg->pf][reg->hooknum]);
+ #endif
+ synchronize_net();
++ nf_queue_nf_hook_drop(reg);
+ }
+ EXPORT_SYMBOL(nf_unregister_hook);
+
+diff --git a/net/netfilter/nf_internals.h b/net/netfilter/nf_internals.h
+index 61a3c927e63c..aba1d7dac17c 100644
+--- a/net/netfilter/nf_internals.h
++++ b/net/netfilter/nf_internals.h
+@@ -24,6 +24,7 @@ int nf_queue(struct sk_buff *skb, struct nf_hook_ops *elem, u_int8_t pf,
+ unsigned int hook, struct net_device *indev,
+ struct net_device *outdev, int (*okfn)(struct sk_buff *),
+ unsigned int queuenum);
++void nf_queue_nf_hook_drop(struct nf_hook_ops *ops);
+ int __init netfilter_queue_init(void);
+
+ /* nf_log.c */
+diff --git a/net/netfilter/nf_queue.c b/net/netfilter/nf_queue.c
+index 4c8b68e5fa16..77ee2d4d5046 100644
+--- a/net/netfilter/nf_queue.c
++++ b/net/netfilter/nf_queue.c
+@@ -95,6 +95,23 @@ bool nf_queue_entry_get_refs(struct nf_queue_entry *entry)
+ }
+ EXPORT_SYMBOL_GPL(nf_queue_entry_get_refs);
+
++void nf_queue_nf_hook_drop(struct nf_hook_ops *ops)
++{
++ const struct nf_queue_handler *qh;
++ struct net *net;
++
++ rtnl_lock();
++ rcu_read_lock();
++ qh = rcu_dereference(queue_handler);
++ if (qh) {
++ for_each_net(net) {
++ qh->nf_hook_drop(net, ops);
++ }
++ }
++ rcu_read_unlock();
++ rtnl_unlock();
++}
++
+ /*
+ * Any packet that leaves via this function must come back
+ * through nf_reinject().
+diff --git a/net/netfilter/nfnetlink_queue_core.c b/net/netfilter/nfnetlink_queue_core.c
+index 7c60ccd61a3e..8add272654f6 100644
+--- a/net/netfilter/nfnetlink_queue_core.c
++++ b/net/netfilter/nfnetlink_queue_core.c
+@@ -815,6 +815,27 @@ static struct notifier_block nfqnl_dev_notifier = {
+ .notifier_call = nfqnl_rcv_dev_event,
+ };
+
++static int nf_hook_cmp(struct nf_queue_entry *entry, unsigned long ops_ptr)
++{
++ return entry->elem == (struct nf_hook_ops *)ops_ptr;
++}
++
++static void nfqnl_nf_hook_drop(struct net *net, struct nf_hook_ops *hook)
++{
++ struct nfnl_queue_net *q = nfnl_queue_pernet(net);
++ int i;
++
++ rcu_read_lock();
++ for (i = 0; i < INSTANCE_BUCKETS; i++) {
++ struct nfqnl_instance *inst;
++ struct hlist_head *head = &q->instance_table[i];
++
++ hlist_for_each_entry_rcu(inst, head, hlist)
++ nfqnl_flush(inst, nf_hook_cmp, (unsigned long)hook);
++ }
++ rcu_read_unlock();
++}
++
+ static int
+ nfqnl_rcv_nl_event(struct notifier_block *this,
+ unsigned long event, void *ptr)
+@@ -1022,7 +1043,8 @@ static const struct nla_policy nfqa_cfg_policy[NFQA_CFG_MAX+1] = {
+ };
+
+ static const struct nf_queue_handler nfqh = {
+- .outfn = &nfqnl_enqueue_packet,
++ .outfn = &nfqnl_enqueue_packet,
++ .nf_hook_drop = &nfqnl_nf_hook_drop,
+ };
+
+ static int
+diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
+index c0a418766f9c..c82b2e37e652 100644
+--- a/net/netlink/af_netlink.c
++++ b/net/netlink/af_netlink.c
+@@ -1003,11 +1003,8 @@ static struct sock *__netlink_lookup(struct netlink_table *table, u32 portid,
+ .net = net,
+ .portid = portid,
+ };
+- u32 hash;
+
+- hash = rhashtable_hashfn(&table->hash, &portid, sizeof(portid));
+-
+- return rhashtable_lookup_compare(&table->hash, hash,
++ return rhashtable_lookup_compare(&table->hash, &portid,
+ &netlink_compare, &arg);
+ }
+
+diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
+index 07c04a841ba0..5dcfe05ea232 100644
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -1255,16 +1255,6 @@ static void packet_sock_destruct(struct sock *sk)
+ sk_refcnt_debug_dec(sk);
+ }
+
+-static int fanout_rr_next(struct packet_fanout *f, unsigned int num)
+-{
+- int x = atomic_read(&f->rr_cur) + 1;
+-
+- if (x >= num)
+- x = 0;
+-
+- return x;
+-}
+-
+ static unsigned int fanout_demux_hash(struct packet_fanout *f,
+ struct sk_buff *skb,
+ unsigned int num)
+@@ -1276,13 +1266,9 @@ static unsigned int fanout_demux_lb(struct packet_fanout *f,
+ struct sk_buff *skb,
+ unsigned int num)
+ {
+- int cur, old;
++ unsigned int val = atomic_inc_return(&f->rr_cur);
+
+- cur = atomic_read(&f->rr_cur);
+- while ((old = atomic_cmpxchg(&f->rr_cur, cur,
+- fanout_rr_next(f, num))) != cur)
+- cur = old;
+- return cur;
++ return val % num;
+ }
+
+ static unsigned int fanout_demux_cpu(struct packet_fanout *f,
+@@ -1336,7 +1322,7 @@ static int packet_rcv_fanout(struct sk_buff *skb, struct net_device *dev,
+ struct packet_type *pt, struct net_device *orig_dev)
+ {
+ struct packet_fanout *f = pt->af_packet_priv;
+- unsigned int num = f->num_members;
++ unsigned int num = READ_ONCE(f->num_members);
+ struct packet_sock *po;
+ unsigned int idx;
+
+diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c
+index a85c1a086ae4..67984fb42f14 100644
+--- a/net/rose/af_rose.c
++++ b/net/rose/af_rose.c
+@@ -192,7 +192,8 @@ static void rose_kill_by_device(struct net_device *dev)
+
+ if (rose->device == dev) {
+ rose_disconnect(s, ENETUNREACH, ROSE_OUT_OF_ORDER, 0);
+- rose->neighbour->use--;
++ if (rose->neighbour)
++ rose->neighbour->use--;
+ rose->device = NULL;
+ }
+ }
+diff --git a/net/sctp/output.c b/net/sctp/output.c
+index fc5e45b8a832..abe7c2db2412 100644
+--- a/net/sctp/output.c
++++ b/net/sctp/output.c
+@@ -599,7 +599,9 @@ out:
+ return err;
+ no_route:
+ kfree_skb(nskb);
+- IP_INC_STATS(sock_net(asoc->base.sk), IPSTATS_MIB_OUTNOROUTES);
++
++ if (asoc)
++ IP_INC_STATS(sock_net(asoc->base.sk), IPSTATS_MIB_OUTNOROUTES);
+
+ /* FIXME: Returning the 'err' will effect all the associations
+ * associated with a socket, although only one of the paths of the
+diff --git a/net/sctp/socket.c b/net/sctp/socket.c
+index 634a2abb5f3a..99e640c46ab2 100644
+--- a/net/sctp/socket.c
++++ b/net/sctp/socket.c
+@@ -1533,8 +1533,10 @@ static void sctp_close(struct sock *sk, long timeout)
+
+ /* Supposedly, no process has access to the socket, but
+ * the net layers still may.
++ * Also, sctp_destroy_sock() needs to be called with addr_wq_lock
++ * held and that should be grabbed before socket lock.
+ */
+- local_bh_disable();
++ spin_lock_bh(&net->sctp.addr_wq_lock);
+ bh_lock_sock(sk);
+
+ /* Hold the sock, since sk_common_release() will put sock_put()
+@@ -1544,7 +1546,7 @@ static void sctp_close(struct sock *sk, long timeout)
+ sk_common_release(sk);
+
+ bh_unlock_sock(sk);
+- local_bh_enable();
++ spin_unlock_bh(&net->sctp.addr_wq_lock);
+
+ sock_put(sk);
+
+@@ -3581,6 +3583,7 @@ static int sctp_setsockopt_auto_asconf(struct sock *sk, char __user *optval,
+ if ((val && sp->do_auto_asconf) || (!val && !sp->do_auto_asconf))
+ return 0;
+
++ spin_lock_bh(&sock_net(sk)->sctp.addr_wq_lock);
+ if (val == 0 && sp->do_auto_asconf) {
+ list_del(&sp->auto_asconf_list);
+ sp->do_auto_asconf = 0;
+@@ -3589,6 +3592,7 @@ static int sctp_setsockopt_auto_asconf(struct sock *sk, char __user *optval,
+ &sock_net(sk)->sctp.auto_asconf_splist);
+ sp->do_auto_asconf = 1;
+ }
++ spin_unlock_bh(&sock_net(sk)->sctp.addr_wq_lock);
+ return 0;
+ }
+
+@@ -4122,18 +4126,28 @@ static int sctp_init_sock(struct sock *sk)
+ local_bh_disable();
+ percpu_counter_inc(&sctp_sockets_allocated);
+ sock_prot_inuse_add(net, sk->sk_prot, 1);
++
++ /* Nothing can fail after this block, otherwise
++ * sctp_destroy_sock() will be called without addr_wq_lock held
++ */
+ if (net->sctp.default_auto_asconf) {
++ spin_lock(&sock_net(sk)->sctp.addr_wq_lock);
+ list_add_tail(&sp->auto_asconf_list,
+ &net->sctp.auto_asconf_splist);
+ sp->do_auto_asconf = 1;
+- } else
++ spin_unlock(&sock_net(sk)->sctp.addr_wq_lock);
++ } else {
+ sp->do_auto_asconf = 0;
++ }
++
+ local_bh_enable();
+
+ return 0;
+ }
+
+-/* Cleanup any SCTP per socket resources. */
++/* Cleanup any SCTP per socket resources. Must be called with
++ * sock_net(sk)->sctp.addr_wq_lock held if sp->do_auto_asconf is true
++ */
+ static void sctp_destroy_sock(struct sock *sk)
+ {
+ struct sctp_sock *sp;
+@@ -7201,6 +7215,19 @@ void sctp_copy_sock(struct sock *newsk, struct sock *sk,
+ newinet->mc_list = NULL;
+ }
+
++static inline void sctp_copy_descendant(struct sock *sk_to,
++ const struct sock *sk_from)
++{
++ int ancestor_size = sizeof(struct inet_sock) +
++ sizeof(struct sctp_sock) -
++ offsetof(struct sctp_sock, auto_asconf_list);
++
++ if (sk_from->sk_family == PF_INET6)
++ ancestor_size += sizeof(struct ipv6_pinfo);
++
++ __inet_sk_copy_descendant(sk_to, sk_from, ancestor_size);
++}
++
+ /* Populate the fields of the newsk from the oldsk and migrate the assoc
+ * and its messages to the newsk.
+ */
+@@ -7215,7 +7242,6 @@ static void sctp_sock_migrate(struct sock *oldsk, struct sock *newsk,
+ struct sk_buff *skb, *tmp;
+ struct sctp_ulpevent *event;
+ struct sctp_bind_hashbucket *head;
+- struct list_head tmplist;
+
+ /* Migrate socket buffer sizes and all the socket level options to the
+ * new socket.
+@@ -7223,12 +7249,7 @@ static void sctp_sock_migrate(struct sock *oldsk, struct sock *newsk,
+ newsk->sk_sndbuf = oldsk->sk_sndbuf;
+ newsk->sk_rcvbuf = oldsk->sk_rcvbuf;
+ /* Brute force copy old sctp opt. */
+- if (oldsp->do_auto_asconf) {
+- memcpy(&tmplist, &newsp->auto_asconf_list, sizeof(tmplist));
+- inet_sk_copy_descendant(newsk, oldsk);
+- memcpy(&newsp->auto_asconf_list, &tmplist, sizeof(tmplist));
+- } else
+- inet_sk_copy_descendant(newsk, oldsk);
++ sctp_copy_descendant(newsk, oldsk);
+
+ /* Restore the ep value that was overwritten with the above structure
+ * copy.
+diff --git a/net/socket.c b/net/socket.c
+index cf9ebf10c841..02fc7c8ea9ed 100644
+--- a/net/socket.c
++++ b/net/socket.c
+@@ -2017,14 +2017,12 @@ static int ___sys_sendmsg(struct socket *sock, struct msghdr __user *msg,
+ int err, ctl_len, total_len;
+
+ err = -EFAULT;
+- if (MSG_CMSG_COMPAT & flags) {
+- if (get_compat_msghdr(msg_sys, msg_compat))
+- return -EFAULT;
+- } else {
++ if (MSG_CMSG_COMPAT & flags)
++ err = get_compat_msghdr(msg_sys, msg_compat);
++ else
+ err = copy_msghdr_from_user(msg_sys, msg);
+- if (err)
+- return err;
+- }
++ if (err)
++ return err;
+
+ if (msg_sys->msg_iovlen > UIO_FASTIOV) {
+ err = -EMSGSIZE;
+@@ -2229,14 +2227,12 @@ static int ___sys_recvmsg(struct socket *sock, struct msghdr __user *msg,
+ struct sockaddr __user *uaddr;
+ int __user *uaddr_len;
+
+- if (MSG_CMSG_COMPAT & flags) {
+- if (get_compat_msghdr(msg_sys, msg_compat))
+- return -EFAULT;
+- } else {
++ if (MSG_CMSG_COMPAT & flags)
++ err = get_compat_msghdr(msg_sys, msg_compat);
++ else
+ err = copy_msghdr_from_user(msg_sys, msg);
+- if (err)
+- return err;
+- }
++ if (err)
++ return err;
+
+ if (msg_sys->msg_iovlen > UIO_FASTIOV) {
+ err = -EMSGSIZE;
+diff --git a/net/sunrpc/backchannel_rqst.c b/net/sunrpc/backchannel_rqst.c
+index 1bb4d26fbd6b..ca9ff71134f9 100644
+--- a/net/sunrpc/backchannel_rqst.c
++++ b/net/sunrpc/backchannel_rqst.c
+@@ -60,7 +60,7 @@ static void xprt_free_allocation(struct rpc_rqst *req)
+
+ dprintk("RPC: free allocations for req= %p\n", req);
+ WARN_ON_ONCE(test_bit(RPC_BC_PA_IN_USE, &req->rq_bc_pa_state));
+- xbufp = &req->rq_private_buf;
++ xbufp = &req->rq_rcv_buf;
+ free_page((unsigned long)xbufp->head[0].iov_base);
+ xbufp = &req->rq_snd_buf;
+ free_page((unsigned long)xbufp->head[0].iov_base);
+diff --git a/net/wireless/wext-compat.c b/net/wireless/wext-compat.c
+index 0f47948c572f..d2c77d5707b2 100644
+--- a/net/wireless/wext-compat.c
++++ b/net/wireless/wext-compat.c
+@@ -1333,6 +1333,8 @@ static struct iw_statistics *cfg80211_wireless_stats(struct net_device *dev)
+ memcpy(bssid, wdev->current_bss->pub.bssid, ETH_ALEN);
+ wdev_unlock(wdev);
+
++ memset(&sinfo, 0, sizeof(sinfo));
++
+ if (rdev_get_station(rdev, dev, bssid, &sinfo))
+ return NULL;
+
+diff --git a/security/integrity/ima/ima.h b/security/integrity/ima/ima.h
+index 8ee997dff139..fc56d4dfa954 100644
+--- a/security/integrity/ima/ima.h
++++ b/security/integrity/ima/ima.h
+@@ -106,7 +106,7 @@ void ima_add_violation(struct file *file, const unsigned char *filename,
+ const char *op, const char *cause);
+ int ima_init_crypto(void);
+ void ima_putc(struct seq_file *m, void *data, int datalen);
+-void ima_print_digest(struct seq_file *m, u8 *digest, int size);
++void ima_print_digest(struct seq_file *m, u8 *digest, u32 size);
+ struct ima_template_desc *ima_template_desc_current(void);
+ int ima_init_template(void);
+
+diff --git a/security/integrity/ima/ima_fs.c b/security/integrity/ima/ima_fs.c
+index da92fcc08d15..d30afe461070 100644
+--- a/security/integrity/ima/ima_fs.c
++++ b/security/integrity/ima/ima_fs.c
+@@ -186,9 +186,9 @@ static const struct file_operations ima_measurements_ops = {
+ .release = seq_release,
+ };
+
+-void ima_print_digest(struct seq_file *m, u8 *digest, int size)
++void ima_print_digest(struct seq_file *m, u8 *digest, u32 size)
+ {
+- int i;
++ u32 i;
+
+ for (i = 0; i < size; i++)
+ seq_printf(m, "%02x", *(digest + i));
+diff --git a/security/integrity/ima/ima_template_lib.c b/security/integrity/ima/ima_template_lib.c
+index 1506f0248572..1eb173ddefd6 100644
+--- a/security/integrity/ima/ima_template_lib.c
++++ b/security/integrity/ima/ima_template_lib.c
+@@ -70,7 +70,8 @@ static void ima_show_template_data_ascii(struct seq_file *m,
+ enum data_formats datafmt,
+ struct ima_field_data *field_data)
+ {
+- u8 *buf_ptr = field_data->data, buflen = field_data->len;
++ u8 *buf_ptr = field_data->data;
++ u32 buflen = field_data->len;
+
+ switch (datafmt) {
+ case DATA_FMT_DIGEST_WITH_ALGO:
+diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c
+index e708368d208f..6bd95f95e48f 100644
+--- a/sound/pci/hda/hda_codec.c
++++ b/sound/pci/hda/hda_codec.c
+@@ -2140,6 +2140,16 @@ static void put_vol_mute(struct hda_codec *codec, unsigned int amp_caps,
+ snd_hda_codec_write(codec, nid, 0, AC_VERB_SET_AMP_GAIN_MUTE, parm);
+ }
+
++/* meta hook to call each driver's vmaster hook */
++static void vmaster_hook(void *private_data, int enabled)
++{
++ struct hda_vmaster_mute_hook *hook = private_data;
++
++ if (hook->mute_mode != HDA_VMUTE_FOLLOW_MASTER)
++ enabled = hook->mute_mode;
++ hook->hook(hook->codec, enabled);
++}
++
+ /**
+ * snd_hda_codec_amp_read - Read AMP value
+ * @codec: HD-audio codec
+@@ -2985,9 +2995,9 @@ int snd_hda_add_vmaster_hook(struct hda_codec *codec,
+
+ if (!hook->hook || !hook->sw_kctl)
+ return 0;
+- snd_ctl_add_vmaster_hook(hook->sw_kctl, hook->hook, codec);
+ hook->codec = codec;
+ hook->mute_mode = HDA_VMUTE_FOLLOW_MASTER;
++ snd_ctl_add_vmaster_hook(hook->sw_kctl, vmaster_hook, hook);
+ if (!expose_enum_ctl)
+ return 0;
+ kctl = snd_ctl_new1(&vmaster_mute_mode, hook);
+@@ -3010,14 +3020,7 @@ void snd_hda_sync_vmaster_hook(struct hda_vmaster_mute_hook *hook)
+ */
+ if (hook->codec->bus->shutdown)
+ return;
+- switch (hook->mute_mode) {
+- case HDA_VMUTE_FOLLOW_MASTER:
+- snd_ctl_sync_vmaster_hook(hook->sw_kctl);
+- break;
+- default:
+- hook->hook(hook->codec, hook->mute_mode);
+- break;
+- }
++ snd_ctl_sync_vmaster_hook(hook->sw_kctl);
+ }
+ EXPORT_SYMBOL_GPL(snd_hda_sync_vmaster_hook);
+
+diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
+index ddfc8a891db4..58f82733c893 100644
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -2091,6 +2091,8 @@ static const struct pci_device_id azx_ids[] = {
+ { PCI_DEVICE(0x1022, 0x780d),
+ .driver_data = AZX_DRIVER_GENERIC | AZX_DCAPS_PRESET_ATI_SB },
+ /* ATI HDMI */
++ { PCI_DEVICE(0x1002, 0x1308),
++ .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS },
+ { PCI_DEVICE(0x1002, 0x793b),
+ .driver_data = AZX_DRIVER_ATIHDMI | AZX_DCAPS_PRESET_ATI_HDMI },
+ { PCI_DEVICE(0x1002, 0x7919),
+@@ -2099,6 +2101,8 @@ static const struct pci_device_id azx_ids[] = {
+ .driver_data = AZX_DRIVER_ATIHDMI | AZX_DCAPS_PRESET_ATI_HDMI },
+ { PCI_DEVICE(0x1002, 0x970f),
+ .driver_data = AZX_DRIVER_ATIHDMI | AZX_DCAPS_PRESET_ATI_HDMI },
++ { PCI_DEVICE(0x1002, 0x9840),
++ .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS },
+ { PCI_DEVICE(0x1002, 0xaa00),
+ .driver_data = AZX_DRIVER_ATIHDMI | AZX_DCAPS_PRESET_ATI_HDMI },
+ { PCI_DEVICE(0x1002, 0xaa08),
+diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
+index 1b1e8c68edd6..69c9d377e517 100644
+--- a/sound/pci/hda/patch_conexant.c
++++ b/sound/pci/hda/patch_conexant.c
+@@ -973,6 +973,14 @@ static const struct hda_codec_preset snd_hda_preset_conexant[] = {
+ .patch = patch_conexant_auto },
+ { .id = 0x14f150b9, .name = "CX20665",
+ .patch = patch_conexant_auto },
++ { .id = 0x14f150f1, .name = "CX20721",
++ .patch = patch_conexant_auto },
++ { .id = 0x14f150f2, .name = "CX20722",
++ .patch = patch_conexant_auto },
++ { .id = 0x14f150f3, .name = "CX20723",
++ .patch = patch_conexant_auto },
++ { .id = 0x14f150f4, .name = "CX20724",
++ .patch = patch_conexant_auto },
+ { .id = 0x14f1510f, .name = "CX20751/2",
+ .patch = patch_conexant_auto },
+ { .id = 0x14f15110, .name = "CX20751/2",
+@@ -1007,6 +1015,10 @@ MODULE_ALIAS("snd-hda-codec-id:14f150ab");
+ MODULE_ALIAS("snd-hda-codec-id:14f150ac");
+ MODULE_ALIAS("snd-hda-codec-id:14f150b8");
+ MODULE_ALIAS("snd-hda-codec-id:14f150b9");
++MODULE_ALIAS("snd-hda-codec-id:14f150f1");
++MODULE_ALIAS("snd-hda-codec-id:14f150f2");
++MODULE_ALIAS("snd-hda-codec-id:14f150f3");
++MODULE_ALIAS("snd-hda-codec-id:14f150f4");
+ MODULE_ALIAS("snd-hda-codec-id:14f1510f");
+ MODULE_ALIAS("snd-hda-codec-id:14f15110");
+ MODULE_ALIAS("snd-hda-codec-id:14f15111");
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index fca6d06f4bec..24cec17db1a4 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -2165,6 +2165,7 @@ static const struct hda_fixup alc882_fixups[] = {
+ static const struct snd_pci_quirk alc882_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1025, 0x006c, "Acer Aspire 9810", ALC883_FIXUP_ACER_EAPD),
+ SND_PCI_QUIRK(0x1025, 0x0090, "Acer Aspire", ALC883_FIXUP_ACER_EAPD),
++ SND_PCI_QUIRK(0x1025, 0x0107, "Acer Aspire", ALC883_FIXUP_ACER_EAPD),
+ SND_PCI_QUIRK(0x1025, 0x010a, "Acer Ferrari 5000", ALC883_FIXUP_ACER_EAPD),
+ SND_PCI_QUIRK(0x1025, 0x0110, "Acer Aspire", ALC883_FIXUP_ACER_EAPD),
+ SND_PCI_QUIRK(0x1025, 0x0112, "Acer Aspire 9303", ALC883_FIXUP_ACER_EAPD),
+@@ -4375,6 +4376,7 @@ enum {
+ ALC269_FIXUP_LIFEBOOK,
+ ALC269_FIXUP_LIFEBOOK_EXTMIC,
+ ALC269_FIXUP_LIFEBOOK_HP_PIN,
++ ALC269_FIXUP_LIFEBOOK_NO_HP_TO_LINEOUT,
+ ALC269_FIXUP_AMIC,
+ ALC269_FIXUP_DMIC,
+ ALC269VB_FIXUP_AMIC,
+@@ -4395,6 +4397,7 @@ enum {
+ ALC269_FIXUP_DELL3_MIC_NO_PRESENCE,
+ ALC269_FIXUP_HEADSET_MODE,
+ ALC269_FIXUP_HEADSET_MODE_NO_HP_MIC,
++ ALC269_FIXUP_ASPIRE_HEADSET_MIC,
+ ALC269_FIXUP_ASUS_X101_FUNC,
+ ALC269_FIXUP_ASUS_X101_VERB,
+ ALC269_FIXUP_ASUS_X101,
+@@ -4422,6 +4425,7 @@ enum {
+ ALC255_FIXUP_HEADSET_MODE_NO_HP_MIC,
+ ALC293_FIXUP_DELL1_MIC_NO_PRESENCE,
+ ALC292_FIXUP_TPT440_DOCK,
++ ALC292_FIXUP_TPT440_DOCK2,
+ ALC283_FIXUP_BXBT2807_MIC,
+ ALC255_FIXUP_DELL_WMI_MIC_MUTE_LED,
+ ALC282_FIXUP_ASPIRE_V5_PINS,
+@@ -4532,6 +4536,10 @@ static const struct hda_fixup alc269_fixups[] = {
+ { }
+ },
+ },
++ [ALC269_FIXUP_LIFEBOOK_NO_HP_TO_LINEOUT] = {
++ .type = HDA_FIXUP_FUNC,
++ .v.func = alc269_fixup_pincfg_no_hp_to_lineout,
++ },
+ [ALC269_FIXUP_AMIC] = {
+ .type = HDA_FIXUP_PINS,
+ .v.pins = (const struct hda_pintbl[]) {
+@@ -4660,6 +4668,15 @@ static const struct hda_fixup alc269_fixups[] = {
+ .type = HDA_FIXUP_FUNC,
+ .v.func = alc_fixup_headset_mode_no_hp_mic,
+ },
++ [ALC269_FIXUP_ASPIRE_HEADSET_MIC] = {
++ .type = HDA_FIXUP_PINS,
++ .v.pins = (const struct hda_pintbl[]) {
++ { 0x19, 0x01a1913c }, /* headset mic w/o jack detect */
++ { }
++ },
++ .chained = true,
++ .chain_id = ALC269_FIXUP_HEADSET_MODE,
++ },
+ [ALC286_FIXUP_SONY_MIC_NO_PRESENCE] = {
+ .type = HDA_FIXUP_PINS,
+ .v.pins = (const struct hda_pintbl[]) {
+@@ -4862,6 +4879,12 @@ static const struct hda_fixup alc269_fixups[] = {
+ .chain_id = ALC269_FIXUP_HEADSET_MODE
+ },
+ [ALC292_FIXUP_TPT440_DOCK] = {
++ .type = HDA_FIXUP_FUNC,
++ .v.func = alc269_fixup_pincfg_no_hp_to_lineout,
++ .chained = true,
++ .chain_id = ALC292_FIXUP_TPT440_DOCK2
++ },
++ [ALC292_FIXUP_TPT440_DOCK2] = {
+ .type = HDA_FIXUP_PINS,
+ .v.pins = (const struct hda_pintbl[]) {
+ { 0x16, 0x21211010 }, /* dock headphone */
+@@ -4909,6 +4932,8 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1025, 0x029b, "Acer 1810TZ", ALC269_FIXUP_INV_DMIC),
+ SND_PCI_QUIRK(0x1025, 0x0349, "Acer AOD260", ALC269_FIXUP_INV_DMIC),
+ SND_PCI_QUIRK(0x1025, 0x047c, "Acer AC700", ALC269_FIXUP_ACER_AC700),
++ SND_PCI_QUIRK(0x1025, 0x072d, "Acer Aspire V5-571G", ALC269_FIXUP_ASPIRE_HEADSET_MIC),
++ SND_PCI_QUIRK(0x1025, 0x080d, "Acer Aspire V5-122P", ALC269_FIXUP_ASPIRE_HEADSET_MIC),
+ SND_PCI_QUIRK(0x1025, 0x0740, "Acer AO725", ALC271_FIXUP_HP_GATE_MIC_JACK),
+ SND_PCI_QUIRK(0x1025, 0x0742, "Acer AO756", ALC271_FIXUP_HP_GATE_MIC_JACK),
+ SND_PCI_QUIRK(0x1025, 0x0775, "Acer Aspire E1-572", ALC271_FIXUP_HP_GATE_MIC_JACK_E1_572),
+@@ -5002,6 +5027,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x104d, 0x9084, "Sony VAIO", ALC275_FIXUP_SONY_HWEQ),
+ SND_PCI_QUIRK(0x104d, 0x9099, "Sony VAIO S13", ALC275_FIXUP_SONY_DISABLE_AAMIX),
+ SND_PCI_QUIRK(0x10cf, 0x1475, "Lifebook", ALC269_FIXUP_LIFEBOOK),
++ SND_PCI_QUIRK(0x10cf, 0x159f, "Lifebook E780", ALC269_FIXUP_LIFEBOOK_NO_HP_TO_LINEOUT),
+ SND_PCI_QUIRK(0x10cf, 0x15dc, "Lifebook T731", ALC269_FIXUP_LIFEBOOK_HP_PIN),
+ SND_PCI_QUIRK(0x10cf, 0x1757, "Lifebook E752", ALC269_FIXUP_LIFEBOOK_HP_PIN),
+ SND_PCI_QUIRK(0x10cf, 0x1845, "Lifebook U904", ALC269_FIXUP_LIFEBOOK_EXTMIC),
+diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
+index 87eff3173ce9..60b3100a2120 100644
+--- a/sound/pci/hda/patch_sigmatel.c
++++ b/sound/pci/hda/patch_sigmatel.c
+@@ -100,6 +100,7 @@ enum {
+ STAC_HP_ENVY_BASS,
+ STAC_HP_BNB13_EQ,
+ STAC_HP_ENVY_TS_BASS,
++ STAC_HP_ENVY_TS_DAC_BIND,
+ STAC_92HD83XXX_GPIO10_EAPD,
+ STAC_92HD83XXX_MODELS
+ };
+@@ -2170,6 +2171,22 @@ static void stac92hd83xxx_fixup_gpio10_eapd(struct hda_codec *codec,
+ spec->eapd_switch = 0;
+ }
+
++static void hp_envy_ts_fixup_dac_bind(struct hda_codec *codec,
++ const struct hda_fixup *fix,
++ int action)
++{
++ struct sigmatel_spec *spec = codec->spec;
++ static hda_nid_t preferred_pairs[] = {
++ 0xd, 0x13,
++ 0
++ };
++
++ if (action != HDA_FIXUP_ACT_PRE_PROBE)
++ return;
++
++ spec->gen.preferred_dacs = preferred_pairs;
++}
++
+ static const struct hda_verb hp_bnb13_eq_verbs[] = {
+ /* 44.1KHz base */
+ { 0x22, 0x7A6, 0x3E },
+@@ -2685,6 +2702,12 @@ static const struct hda_fixup stac92hd83xxx_fixups[] = {
+ {}
+ },
+ },
++ [STAC_HP_ENVY_TS_DAC_BIND] = {
++ .type = HDA_FIXUP_FUNC,
++ .v.func = hp_envy_ts_fixup_dac_bind,
++ .chained = true,
++ .chain_id = STAC_HP_ENVY_TS_BASS,
++ },
+ [STAC_92HD83XXX_GPIO10_EAPD] = {
+ .type = HDA_FIXUP_FUNC,
+ .v.func = stac92hd83xxx_fixup_gpio10_eapd,
+@@ -2763,6 +2786,8 @@ static const struct snd_pci_quirk stac92hd83xxx_fixup_tbl[] = {
+ "HP bNB13", STAC_HP_BNB13_EQ),
+ SND_PCI_QUIRK(PCI_VENDOR_ID_HP, 0x190e,
+ "HP ENVY TS", STAC_HP_ENVY_TS_BASS),
++ SND_PCI_QUIRK(PCI_VENDOR_ID_HP, 0x1967,
++ "HP ENVY TS", STAC_HP_ENVY_TS_DAC_BIND),
+ SND_PCI_QUIRK(PCI_VENDOR_ID_HP, 0x1940,
+ "HP bNB13", STAC_HP_BNB13_EQ),
+ SND_PCI_QUIRK(PCI_VENDOR_ID_HP, 0x1941,
+diff --git a/sound/soc/codecs/tas2552.c b/sound/soc/codecs/tas2552.c
+index f039dc825971..6dbfc4703a3a 100644
+--- a/sound/soc/codecs/tas2552.c
++++ b/sound/soc/codecs/tas2552.c
+@@ -120,6 +120,9 @@ static void tas2552_sw_shutdown(struct tas2552_data *tas_data, int sw_shutdown)
+ {
+ u8 cfg1_reg;
+
++ if (!tas_data->codec)
++ return;
++
+ if (sw_shutdown)
+ cfg1_reg = 0;
+ else
+@@ -335,7 +338,6 @@ static DECLARE_TLV_DB_SCALE(dac_tlv, -7, 100, 24);
+ static const struct snd_kcontrol_new tas2552_snd_controls[] = {
+ SOC_SINGLE_TLV("Speaker Driver Playback Volume",
+ TAS2552_PGA_GAIN, 0, 0x1f, 1, dac_tlv),
+- SOC_DAPM_SINGLE("Playback AMP", SND_SOC_NOPM, 0, 1, 0),
+ };
+
+ static const struct reg_default tas2552_init_regs[] = {
+diff --git a/sound/soc/codecs/wm5102.c b/sound/soc/codecs/wm5102.c
+index f60234962527..8fafff5fad4b 100644
+--- a/sound/soc/codecs/wm5102.c
++++ b/sound/soc/codecs/wm5102.c
+@@ -41,7 +41,7 @@ struct wm5102_priv {
+ static DECLARE_TLV_DB_SCALE(ana_tlv, 0, 100, 0);
+ static DECLARE_TLV_DB_SCALE(eq_tlv, -1200, 100, 0);
+ static DECLARE_TLV_DB_SCALE(digital_tlv, -6400, 50, 0);
+-static DECLARE_TLV_DB_SCALE(noise_tlv, 0, 600, 0);
++static DECLARE_TLV_DB_SCALE(noise_tlv, -13200, 600, 0);
+ static DECLARE_TLV_DB_SCALE(ng_tlv, -10200, 600, 0);
+
+ static const struct wm_adsp_region wm5102_dsp1_regions[] = {
+diff --git a/sound/soc/codecs/wm5110.c b/sound/soc/codecs/wm5110.c
+index 2f2ec26d831c..4cab08b43a53 100644
+--- a/sound/soc/codecs/wm5110.c
++++ b/sound/soc/codecs/wm5110.c
+@@ -167,7 +167,7 @@ static int wm5110_sysclk_ev(struct snd_soc_dapm_widget *w,
+ static DECLARE_TLV_DB_SCALE(ana_tlv, 0, 100, 0);
+ static DECLARE_TLV_DB_SCALE(eq_tlv, -1200, 100, 0);
+ static DECLARE_TLV_DB_SCALE(digital_tlv, -6400, 50, 0);
+-static DECLARE_TLV_DB_SCALE(noise_tlv, 0, 600, 0);
++static DECLARE_TLV_DB_SCALE(noise_tlv, -13200, 600, 0);
+ static DECLARE_TLV_DB_SCALE(ng_tlv, -10200, 600, 0);
+
+ #define WM5110_NG_SRC(name, base) \
+diff --git a/sound/soc/codecs/wm8737.c b/sound/soc/codecs/wm8737.c
+index 744a422ecb05..4be874c9dc91 100644
+--- a/sound/soc/codecs/wm8737.c
++++ b/sound/soc/codecs/wm8737.c
+@@ -494,7 +494,8 @@ static int wm8737_set_bias_level(struct snd_soc_codec *codec,
+
+ /* Fast VMID ramp at 2*2.5k */
+ snd_soc_update_bits(codec, WM8737_MISC_BIAS_CONTROL,
+- WM8737_VMIDSEL_MASK, 0x4);
++ WM8737_VMIDSEL_MASK,
++ 2 << WM8737_VMIDSEL_SHIFT);
+
+ /* Bring VMID up */
+ snd_soc_update_bits(codec, WM8737_POWER_MANAGEMENT,
+@@ -508,7 +509,8 @@ static int wm8737_set_bias_level(struct snd_soc_codec *codec,
+
+ /* VMID at 2*300k */
+ snd_soc_update_bits(codec, WM8737_MISC_BIAS_CONTROL,
+- WM8737_VMIDSEL_MASK, 2);
++ WM8737_VMIDSEL_MASK,
++ 1 << WM8737_VMIDSEL_SHIFT);
+
+ break;
+
+diff --git a/sound/soc/codecs/wm8903.h b/sound/soc/codecs/wm8903.h
+index db949311c0f2..0bb4a647755d 100644
+--- a/sound/soc/codecs/wm8903.h
++++ b/sound/soc/codecs/wm8903.h
+@@ -172,7 +172,7 @@ extern int wm8903_mic_detect(struct snd_soc_codec *codec,
+ #define WM8903_VMID_BUF_ENA_WIDTH 1 /* VMID_BUF_ENA */
+
+ #define WM8903_VMID_RES_50K 2
+-#define WM8903_VMID_RES_250K 3
++#define WM8903_VMID_RES_250K 4
+ #define WM8903_VMID_RES_5K 6
+
+ /*
+diff --git a/sound/soc/codecs/wm8955.c b/sound/soc/codecs/wm8955.c
+index 7d0b01bcab4b..d48ac712f624 100644
+--- a/sound/soc/codecs/wm8955.c
++++ b/sound/soc/codecs/wm8955.c
+@@ -298,7 +298,7 @@ static int wm8955_configure_clocking(struct snd_soc_codec *codec)
+ snd_soc_update_bits(codec, WM8955_PLL_CONTROL_2,
+ WM8955_K_17_9_MASK,
+ (pll.k >> 9) & WM8955_K_17_9_MASK);
+- snd_soc_update_bits(codec, WM8955_PLL_CONTROL_2,
++ snd_soc_update_bits(codec, WM8955_PLL_CONTROL_3,
+ WM8955_K_8_0_MASK,
+ pll.k & WM8955_K_8_0_MASK);
+ if (pll.k)
+diff --git a/sound/soc/codecs/wm8960.c b/sound/soc/codecs/wm8960.c
+index 34a18a910113..ab7fa7c9fa84 100644
+--- a/sound/soc/codecs/wm8960.c
++++ b/sound/soc/codecs/wm8960.c
+@@ -242,7 +242,7 @@ SOC_SINGLE("PCM Playback -6dB Switch", WM8960_DACCTL1, 7, 1, 0),
+ SOC_ENUM("ADC Polarity", wm8960_enum[0]),
+ SOC_SINGLE("ADC High Pass Filter Switch", WM8960_DACCTL1, 0, 1, 0),
+
+-SOC_ENUM("DAC Polarity", wm8960_enum[2]),
++SOC_ENUM("DAC Polarity", wm8960_enum[1]),
+ SOC_SINGLE_BOOL_EXT("DAC Deemphasis Switch", 0,
+ wm8960_get_deemph, wm8960_put_deemph),
+
+diff --git a/sound/soc/codecs/wm8997.c b/sound/soc/codecs/wm8997.c
+index ab33fe596519..dd1842527b30 100644
+--- a/sound/soc/codecs/wm8997.c
++++ b/sound/soc/codecs/wm8997.c
+@@ -40,7 +40,7 @@ struct wm8997_priv {
+ static DECLARE_TLV_DB_SCALE(ana_tlv, 0, 100, 0);
+ static DECLARE_TLV_DB_SCALE(eq_tlv, -1200, 100, 0);
+ static DECLARE_TLV_DB_SCALE(digital_tlv, -6400, 50, 0);
+-static DECLARE_TLV_DB_SCALE(noise_tlv, 0, 600, 0);
++static DECLARE_TLV_DB_SCALE(noise_tlv, -13200, 600, 0);
+ static DECLARE_TLV_DB_SCALE(ng_tlv, -10200, 600, 0);
+
+ static const struct reg_default wm8997_sysclk_reva_patch[] = {
+diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
+index a712d754431c..b4edae1d4f5d 100644
+--- a/sound/usb/mixer.c
++++ b/sound/usb/mixer.c
+@@ -914,6 +914,7 @@ static void volume_control_quirks(struct usb_mixer_elem_info *cval,
+ case USB_ID(0x046d, 0x081d): /* HD Webcam c510 */
+ case USB_ID(0x046d, 0x0825): /* HD Webcam c270 */
+ case USB_ID(0x046d, 0x0826): /* HD Webcam c525 */
++ case USB_ID(0x046d, 0x08ca): /* Logitech Quickcam Fusion */
+ case USB_ID(0x046d, 0x0991):
+ /* Most audio usb devices lie about volume resolution.
+ * Most Logitech webcams have res = 384.
+diff --git a/sound/usb/mixer_maps.c b/sound/usb/mixer_maps.c
+index 621bc9ebb55e..b16be3944213 100644
+--- a/sound/usb/mixer_maps.c
++++ b/sound/usb/mixer_maps.c
+@@ -428,6 +428,11 @@ static struct usbmix_ctl_map usbmix_ctl_maps[] = {
+ .map = ebox44_map,
+ },
+ {
++ /* MAYA44 USB+ */
++ .id = USB_ID(0x2573, 0x0008),
++ .map = maya44_map,
++ },
++ {
+ /* KEF X300A */
+ .id = USB_ID(0x27ac, 0x1000),
+ .map = scms_usb3318_map,
+diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
+index 05ad944dc5c8..9ff5050d513a 100644
+--- a/sound/usb/quirks.c
++++ b/sound/usb/quirks.c
+@@ -1257,8 +1257,9 @@ u64 snd_usb_interface_dsd_format_quirks(struct snd_usb_audio *chip,
+ if (fp->altsetting == 2)
+ return SNDRV_PCM_FMTBIT_DSD_U32_BE;
+ break;
+- /* DIYINHK DSD DXD 384kHz USB to I2S/DSD */
+- case USB_ID(0x20b1, 0x2009):
++
++ case USB_ID(0x20b1, 0x2009): /* DIYINHK DSD DXD 384kHz USB to I2S/DSD */
++ case USB_ID(0x20b1, 0x2023): /* JLsounds I2SoverUSB */
+ if (fp->altsetting == 3)
+ return SNDRV_PCM_FMTBIT_DSD_U32_BE;
+ break;
+diff --git a/virt/kvm/arm/vgic.c b/virt/kvm/arm/vgic.c
+index 5f67fadfca65..d7cf2ffc56e9 100644
+--- a/virt/kvm/arm/vgic.c
++++ b/virt/kvm/arm/vgic.c
+@@ -1721,7 +1721,7 @@ int kvm_vgic_inject_irq(struct kvm *kvm, int cpuid, unsigned int irq_num,
+ goto out;
+ }
+
+- if (irq_num >= kvm->arch.vgic.nr_irqs)
++ if (irq_num >= min(kvm->arch.vgic.nr_irqs, 1020))
+ return -EINVAL;
+
+ vcpu_id = vgic_update_irq_pending(kvm, cpuid, irq_num, level);
^ permalink raw reply related [flat|nested] 67+ messages in thread
* [gentoo-commits] proj/linux-patches:3.18 commit in: /
@ 2015-07-22 10:13 Mike Pagano
0 siblings, 0 replies; 67+ messages in thread
From: Mike Pagano @ 2015-07-22 10:13 UTC (permalink / raw
To: gentoo-commits
commit: f8c7c0cb868106263d4b863504609171d27c8d11
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed Jul 22 10:12:58 2015 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed Jul 22 10:12:58 2015 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=f8c7c0cb
Linux patch 3.18.19
0000_README | 4 +
1018_linux-3.18.19.patch | 1822 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 1826 insertions(+)
diff --git a/0000_README b/0000_README
index 4092093..61cb27a 100644
--- a/0000_README
+++ b/0000_README
@@ -115,6 +115,10 @@ Patch: 1017_linux-3.18.18.patch
From: http://www.kernel.org
Desc: Linux 3.18.18
+Patch: 1018_linux-3.18.19.patch
+From: http://www.kernel.org
+Desc: Linux 3.18.19
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1018_linux-3.18.19.patch b/1018_linux-3.18.19.patch
new file mode 100644
index 0000000..67377c5
--- /dev/null
+++ b/1018_linux-3.18.19.patch
@@ -0,0 +1,1822 @@
+diff --git a/Makefile b/Makefile
+index 35faaf8fb651..eab97c3d462d 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 18
+-SUBLEVEL = 18
++SUBLEVEL = 19
+ EXTRAVERSION =
+ NAME = Diseased Newt
+
+diff --git a/arch/arm/kvm/interrupts.S b/arch/arm/kvm/interrupts.S
+index 01dcb0e752d9..d66d608f7ce7 100644
+--- a/arch/arm/kvm/interrupts.S
++++ b/arch/arm/kvm/interrupts.S
+@@ -159,13 +159,9 @@ __kvm_vcpu_return:
+ @ Don't trap coprocessor accesses for host kernel
+ set_hstr vmexit
+ set_hdcr vmexit
+- set_hcptr vmexit, (HCPTR_TTA | HCPTR_TCP(10) | HCPTR_TCP(11))
++ set_hcptr vmexit, (HCPTR_TTA | HCPTR_TCP(10) | HCPTR_TCP(11)), after_vfp_restore
+
+ #ifdef CONFIG_VFPv3
+- @ Save floating point registers we if let guest use them.
+- tst r2, #(HCPTR_TCP(10) | HCPTR_TCP(11))
+- bne after_vfp_restore
+-
+ @ Switch VFP/NEON hardware state to the host's
+ add r7, vcpu, #VCPU_VFP_GUEST
+ store_vfp_state r7
+@@ -177,6 +173,8 @@ after_vfp_restore:
+ @ Restore FPEXC_EN which we clobbered on entry
+ pop {r2}
+ VFPFMXR FPEXC, r2
++#else
++after_vfp_restore:
+ #endif
+
+ @ Reset Hyp-role
+@@ -472,7 +470,7 @@ switch_to_guest_vfp:
+ push {r3-r7}
+
+ @ NEON/VFP used. Turn on VFP access.
+- set_hcptr vmexit, (HCPTR_TCP(10) | HCPTR_TCP(11))
++ set_hcptr vmtrap, (HCPTR_TCP(10) | HCPTR_TCP(11))
+
+ @ Switch VFP/NEON hardware state to the guest's
+ add r7, r0, #VCPU_VFP_HOST
+diff --git a/arch/arm/kvm/interrupts_head.S b/arch/arm/kvm/interrupts_head.S
+index 14d488388480..f6f14812d106 100644
+--- a/arch/arm/kvm/interrupts_head.S
++++ b/arch/arm/kvm/interrupts_head.S
+@@ -599,8 +599,13 @@ ARM_BE8(rev r6, r6 )
+ .endm
+
+ /* Configures the HCPTR (Hyp Coprocessor Trap Register) on entry/return
+- * (hardware reset value is 0). Keep previous value in r2. */
+-.macro set_hcptr operation, mask
++ * (hardware reset value is 0). Keep previous value in r2.
++ * An ISB is emited on vmexit/vmtrap, but executed on vmexit only if
++ * VFP wasn't already enabled (always executed on vmtrap).
++ * If a label is specified with vmexit, it is branched to if VFP wasn't
++ * enabled.
++ */
++.macro set_hcptr operation, mask, label = none
+ mrc p15, 4, r2, c1, c1, 2
+ ldr r3, =\mask
+ .if \operation == vmentry
+@@ -609,6 +614,17 @@ ARM_BE8(rev r6, r6 )
+ bic r3, r2, r3 @ Don't trap defined coproc-accesses
+ .endif
+ mcr p15, 4, r3, c1, c1, 2
++ .if \operation != vmentry
++ .if \operation == vmexit
++ tst r2, #(HCPTR_TCP(10) | HCPTR_TCP(11))
++ beq 1f
++ .endif
++ isb
++ .if \label != none
++ b \label
++ .endif
++1:
++ .endif
+ .endm
+
+ /* Configures the HDCR (Hyp Debug Configuration Register) on entry/return
+diff --git a/arch/arm/mach-imx/clk-imx6q.c b/arch/arm/mach-imx/clk-imx6q.c
+index 2daef619d053..5474a76803f0 100644
+--- a/arch/arm/mach-imx/clk-imx6q.c
++++ b/arch/arm/mach-imx/clk-imx6q.c
+@@ -439,7 +439,7 @@ static void __init imx6q_clocks_init(struct device_node *ccm_node)
+ clk[IMX6QDL_CLK_GPMI_IO] = imx_clk_gate2("gpmi_io", "enfc", base + 0x78, 28);
+ clk[IMX6QDL_CLK_GPMI_APB] = imx_clk_gate2("gpmi_apb", "usdhc3", base + 0x78, 30);
+ clk[IMX6QDL_CLK_ROM] = imx_clk_gate2("rom", "ahb", base + 0x7c, 0);
+- clk[IMX6QDL_CLK_SATA] = imx_clk_gate2("sata", "ipg", base + 0x7c, 4);
++ clk[IMX6QDL_CLK_SATA] = imx_clk_gate2("sata", "ahb", base + 0x7c, 4);
+ clk[IMX6QDL_CLK_SDMA] = imx_clk_gate2("sdma", "ahb", base + 0x7c, 6);
+ clk[IMX6QDL_CLK_SPBA] = imx_clk_gate2("spba", "ipg", base + 0x7c, 12);
+ clk[IMX6QDL_CLK_SPDIF] = imx_clk_gate2("spdif", "spdif_podf", base + 0x7c, 14);
+diff --git a/arch/arm64/include/asm/kvm_arm.h b/arch/arm64/include/asm/kvm_arm.h
+index 7fd3e27e3ccc..8afb863f5a9e 100644
+--- a/arch/arm64/include/asm/kvm_arm.h
++++ b/arch/arm64/include/asm/kvm_arm.h
+@@ -18,6 +18,7 @@
+ #ifndef __ARM64_KVM_ARM_H__
+ #define __ARM64_KVM_ARM_H__
+
++#include <asm/memory.h>
+ #include <asm/types.h>
+
+ /* Hyp Configuration Register (HCR) bits */
+@@ -160,9 +161,9 @@
+ #endif
+
+ #define VTTBR_BADDR_SHIFT (VTTBR_X - 1)
+-#define VTTBR_BADDR_MASK (((1LLU << (PHYS_MASK_SHIFT - VTTBR_X)) - 1) << VTTBR_BADDR_SHIFT)
+-#define VTTBR_VMID_SHIFT (48LLU)
+-#define VTTBR_VMID_MASK (0xffLLU << VTTBR_VMID_SHIFT)
++#define VTTBR_BADDR_MASK (((UL(1) << (PHYS_MASK_SHIFT - VTTBR_X)) - 1) << VTTBR_BADDR_SHIFT)
++#define VTTBR_VMID_SHIFT (UL(48))
++#define VTTBR_VMID_MASK (UL(0xFF) << VTTBR_VMID_SHIFT)
+
+ /* Hyp System Trap Register */
+ #define HSTR_EL2_TTEE (1 << 16)
+@@ -185,13 +186,13 @@
+
+ /* Exception Syndrome Register (ESR) bits */
+ #define ESR_EL2_EC_SHIFT (26)
+-#define ESR_EL2_EC (0x3fU << ESR_EL2_EC_SHIFT)
+-#define ESR_EL2_IL (1U << 25)
++#define ESR_EL2_EC (UL(0x3f) << ESR_EL2_EC_SHIFT)
++#define ESR_EL2_IL (UL(1) << 25)
+ #define ESR_EL2_ISS (ESR_EL2_IL - 1)
+ #define ESR_EL2_ISV_SHIFT (24)
+-#define ESR_EL2_ISV (1U << ESR_EL2_ISV_SHIFT)
++#define ESR_EL2_ISV (UL(1) << ESR_EL2_ISV_SHIFT)
+ #define ESR_EL2_SAS_SHIFT (22)
+-#define ESR_EL2_SAS (3U << ESR_EL2_SAS_SHIFT)
++#define ESR_EL2_SAS (UL(3) << ESR_EL2_SAS_SHIFT)
+ #define ESR_EL2_SSE (1 << 21)
+ #define ESR_EL2_SRT_SHIFT (16)
+ #define ESR_EL2_SRT_MASK (0x1f << ESR_EL2_SRT_SHIFT)
+@@ -205,16 +206,16 @@
+ #define ESR_EL2_FSC_TYPE (0x3c)
+
+ #define ESR_EL2_CV_SHIFT (24)
+-#define ESR_EL2_CV (1U << ESR_EL2_CV_SHIFT)
++#define ESR_EL2_CV (UL(1) << ESR_EL2_CV_SHIFT)
+ #define ESR_EL2_COND_SHIFT (20)
+-#define ESR_EL2_COND (0xfU << ESR_EL2_COND_SHIFT)
++#define ESR_EL2_COND (UL(0xf) << ESR_EL2_COND_SHIFT)
+
+
+ #define FSC_FAULT (0x04)
+ #define FSC_PERM (0x0c)
+
+ /* Hyp Prefetch Fault Address Register (HPFAR/HDFAR) */
+-#define HPFAR_MASK (~0xFUL)
++#define HPFAR_MASK (~UL(0xf))
+
+ #define ESR_EL2_EC_UNKNOWN (0x00)
+ #define ESR_EL2_EC_WFI (0x01)
+diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
+index 3635fff7b32d..c9148e268512 100644
+--- a/arch/x86/Kconfig
++++ b/arch/x86/Kconfig
+@@ -173,7 +173,7 @@ config SBUS
+
+ config NEED_DMA_MAP_STATE
+ def_bool y
+- depends on X86_64 || INTEL_IOMMU || DMA_API_DEBUG
++ depends on X86_64 || INTEL_IOMMU || DMA_API_DEBUG || SWIOTLB
+
+ config NEED_SG_DMA_LENGTH
+ def_bool y
+diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
+index 6c0709ff2f38..306d152336cd 100644
+--- a/arch/x86/include/asm/kvm_host.h
++++ b/arch/x86/include/asm/kvm_host.h
+@@ -571,7 +571,7 @@ struct kvm_arch {
+ struct kvm_pic *vpic;
+ struct kvm_ioapic *vioapic;
+ struct kvm_pit *vpit;
+- int vapics_in_nmi_mode;
++ atomic_t vapics_in_nmi_mode;
+ struct mutex apic_map_lock;
+ struct kvm_apic_map *apic_map;
+
+diff --git a/arch/x86/kernel/cpu/microcode/intel_early.c b/arch/x86/kernel/cpu/microcode/intel_early.c
+index ec9df6f9cd47..5e109a31f62b 100644
+--- a/arch/x86/kernel/cpu/microcode/intel_early.c
++++ b/arch/x86/kernel/cpu/microcode/intel_early.c
+@@ -321,7 +321,7 @@ get_matching_model_microcode(int cpu, unsigned long start,
+ unsigned int mc_saved_count = mc_saved_data->mc_saved_count;
+ int i;
+
+- while (leftover) {
++ while (leftover && mc_saved_count < ARRAY_SIZE(mc_saved_tmp)) {
+ mc_header = (struct microcode_header_intel *)ucode_ptr;
+
+ mc_size = get_totalsize(mc_header);
+diff --git a/arch/x86/kernel/cpu/perf_event_intel.c b/arch/x86/kernel/cpu/perf_event_intel.c
+index 498b6d967138..df11583a9041 100644
+--- a/arch/x86/kernel/cpu/perf_event_intel.c
++++ b/arch/x86/kernel/cpu/perf_event_intel.c
+@@ -2604,13 +2604,13 @@ __init int intel_pmu_init(void)
+ * counter, so do not extend mask to generic counters
+ */
+ for_each_event_constraint(c, x86_pmu.event_constraints) {
+- if (c->cmask != FIXED_EVENT_FLAGS
+- || c->idxmsk64 == INTEL_PMC_MSK_FIXED_REF_CYCLES) {
+- continue;
++ if (c->cmask == FIXED_EVENT_FLAGS
++ && c->idxmsk64 != INTEL_PMC_MSK_FIXED_REF_CYCLES) {
++ c->idxmsk64 |= (1ULL << x86_pmu.num_counters) - 1;
+ }
+-
+- c->idxmsk64 |= (1ULL << x86_pmu.num_counters) - 1;
+- c->weight += x86_pmu.num_counters;
++ c->idxmsk64 &=
++ ~(~0UL << (INTEL_PMC_IDX_FIXED + x86_pmu.num_counters_fixed));
++ c->weight = hweight64(c->idxmsk64);
+ }
+ }
+
+diff --git a/arch/x86/kernel/entry_32.S b/arch/x86/kernel/entry_32.S
+index 344b63f18d14..3dddb89ba320 100644
+--- a/arch/x86/kernel/entry_32.S
++++ b/arch/x86/kernel/entry_32.S
+@@ -982,6 +982,9 @@ ENTRY(xen_hypervisor_callback)
+ ENTRY(xen_do_upcall)
+ 1: mov %esp, %eax
+ call xen_evtchn_do_upcall
++#ifndef CONFIG_PREEMPT
++ call xen_maybe_preempt_hcall
++#endif
+ jmp ret_from_intr
+ CFI_ENDPROC
+ ENDPROC(xen_hypervisor_callback)
+diff --git a/arch/x86/kernel/entry_64.S b/arch/x86/kernel/entry_64.S
+index f1dc27f457f1..e36d9815ef56 100644
+--- a/arch/x86/kernel/entry_64.S
++++ b/arch/x86/kernel/entry_64.S
+@@ -1173,6 +1173,9 @@ ENTRY(xen_do_hypervisor_callback) # do_hypervisor_callback(struct *pt_regs)
+ popq %rsp
+ CFI_DEF_CFA_REGISTER rsp
+ decl PER_CPU_VAR(irq_count)
++#ifndef CONFIG_PREEMPT
++ call xen_maybe_preempt_hcall
++#endif
+ jmp error_exit
+ CFI_ENDPROC
+ END(xen_do_hypervisor_callback)
+diff --git a/arch/x86/kernel/head_32.S b/arch/x86/kernel/head_32.S
+index 30a2aa3782fa..e7be5290fe1f 100644
+--- a/arch/x86/kernel/head_32.S
++++ b/arch/x86/kernel/head_32.S
+@@ -61,9 +61,16 @@
+ #define PAGE_TABLE_SIZE(pages) ((pages) / PTRS_PER_PGD)
+ #endif
+
+-/* Number of possible pages in the lowmem region */
+-LOWMEM_PAGES = (((1<<32) - __PAGE_OFFSET) >> PAGE_SHIFT)
+-
++/*
++ * Number of possible pages in the lowmem region.
++ *
++ * We shift 2 by 31 instead of 1 by 32 to the left in order to avoid a
++ * gas warning about overflowing shift count when gas has been compiled
++ * with only a host target support using a 32-bit type for internal
++ * representation.
++ */
++LOWMEM_PAGES = (((2<<31) - __PAGE_OFFSET) >> PAGE_SHIFT)
++
+ /* Enough space to fit pagetables for the low memory linear map */
+ MAPPING_BEYOND_END = PAGE_TABLE_SIZE(LOWMEM_PAGES) << PAGE_SHIFT
+
+diff --git a/arch/x86/kernel/kprobes/core.c b/arch/x86/kernel/kprobes/core.c
+index 93d2c04c6f8f..f2e281cf8c19 100644
+--- a/arch/x86/kernel/kprobes/core.c
++++ b/arch/x86/kernel/kprobes/core.c
+@@ -330,13 +330,16 @@ int __copy_instruction(u8 *dest, u8 *src)
+ {
+ struct insn insn;
+ kprobe_opcode_t buf[MAX_INSN_SIZE];
++ int length;
+
+ kernel_insn_init(&insn, (void *)recover_probed_instruction(buf, (unsigned long)src));
+ insn_get_length(&insn);
++ length = insn.length;
++
+ /* Another subsystem puts a breakpoint, failed to recover */
+ if (insn.opcode.bytes[0] == BREAKPOINT_INSTRUCTION)
+ return 0;
+- memcpy(dest, insn.kaddr, insn.length);
++ memcpy(dest, insn.kaddr, length);
+
+ #ifdef CONFIG_X86_64
+ if (insn_rip_relative(&insn)) {
+@@ -366,7 +369,7 @@ int __copy_instruction(u8 *dest, u8 *src)
+ *(s32 *) disp = (s32) newdisp;
+ }
+ #endif
+- return insn.length;
++ return length;
+ }
+
+ static int arch_copy_kprobe(struct kprobe *p)
+diff --git a/arch/x86/kvm/i8254.c b/arch/x86/kvm/i8254.c
+index 298781d4cfb4..1406ffde3e35 100644
+--- a/arch/x86/kvm/i8254.c
++++ b/arch/x86/kvm/i8254.c
+@@ -305,7 +305,7 @@ static void pit_do_work(struct kthread_work *work)
+ * LVT0 to NMI delivery. Other PIC interrupts are just sent to
+ * VCPU0, and only if its LVT0 is in EXTINT mode.
+ */
+- if (kvm->arch.vapics_in_nmi_mode > 0)
++ if (atomic_read(&kvm->arch.vapics_in_nmi_mode) > 0)
+ kvm_for_each_vcpu(i, vcpu, kvm)
+ kvm_apic_nmi_wd_deliver(vcpu);
+ }
+diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
+index b8345dd41b25..de8e50040124 100644
+--- a/arch/x86/kvm/lapic.c
++++ b/arch/x86/kvm/lapic.c
+@@ -1112,10 +1112,10 @@ static void apic_manage_nmi_watchdog(struct kvm_lapic *apic, u32 lvt0_val)
+ if (!nmi_wd_enabled) {
+ apic_debug("Receive NMI setting on APIC_LVT0 "
+ "for cpu %d\n", apic->vcpu->vcpu_id);
+- apic->vcpu->kvm->arch.vapics_in_nmi_mode++;
++ atomic_inc(&apic->vcpu->kvm->arch.vapics_in_nmi_mode);
+ }
+ } else if (nmi_wd_enabled)
+- apic->vcpu->kvm->arch.vapics_in_nmi_mode--;
++ atomic_dec(&apic->vcpu->kvm->arch.vapics_in_nmi_mode);
+ }
+
+ static int apic_reg_write(struct kvm_lapic *apic, u32 reg, u32 val)
+@@ -1687,6 +1687,7 @@ void kvm_apic_post_state_restore(struct kvm_vcpu *vcpu,
+
+ apic_update_ppr(apic);
+ hrtimer_cancel(&apic->lapic_timer.timer);
++ apic_manage_nmi_watchdog(apic, kvm_apic_get_reg(apic, APIC_LVT0));
+ update_divide_count(apic);
+ start_apic_timer(apic);
+ apic->irr_pending = true;
+diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
+index 170e7d49ba65..b83bff87408f 100644
+--- a/arch/x86/kvm/svm.c
++++ b/arch/x86/kvm/svm.c
+@@ -511,8 +511,10 @@ static void skip_emulated_instruction(struct kvm_vcpu *vcpu)
+ {
+ struct vcpu_svm *svm = to_svm(vcpu);
+
+- if (svm->vmcb->control.next_rip != 0)
++ if (svm->vmcb->control.next_rip != 0) {
++ WARN_ON(!static_cpu_has(X86_FEATURE_NRIPS));
+ svm->next_rip = svm->vmcb->control.next_rip;
++ }
+
+ if (!svm->next_rip) {
+ if (emulate_instruction(vcpu, EMULTYPE_SKIP) !=
+@@ -4306,7 +4308,9 @@ static int svm_check_intercept(struct kvm_vcpu *vcpu,
+ break;
+ }
+
+- vmcb->control.next_rip = info->next_rip;
++ /* TODO: Advertise NRIPS to guest hypervisor unconditionally */
++ if (static_cpu_has(X86_FEATURE_NRIPS))
++ vmcb->control.next_rip = info->next_rip;
+ vmcb->control.exit_code = icpt_info.exit_code;
+ vmexit = nested_svm_exit_handled(svm);
+
+diff --git a/drivers/edac/sb_edac.c b/drivers/edac/sb_edac.c
+index a46c4af2ac98..15697c630139 100644
+--- a/drivers/edac/sb_edac.c
++++ b/drivers/edac/sb_edac.c
+@@ -910,7 +910,7 @@ static void get_memory_layout(const struct mem_ctl_info *mci)
+ u32 reg;
+ u64 limit, prv = 0;
+ u64 tmp_mb;
+- u32 mb, kb;
++ u32 gb, mb;
+ u32 rir_way;
+
+ /*
+@@ -920,15 +920,17 @@ static void get_memory_layout(const struct mem_ctl_info *mci)
+ pvt->tolm = pvt->info.get_tolm(pvt);
+ tmp_mb = (1 + pvt->tolm) >> 20;
+
+- mb = div_u64_rem(tmp_mb, 1000, &kb);
+- edac_dbg(0, "TOLM: %u.%03u GB (0x%016Lx)\n", mb, kb, (u64)pvt->tolm);
++ gb = div_u64_rem(tmp_mb, 1024, &mb);
++ edac_dbg(0, "TOLM: %u.%03u GB (0x%016Lx)\n",
++ gb, (mb*1000)/1024, (u64)pvt->tolm);
+
+ /* Address range is already 45:25 */
+ pvt->tohm = pvt->info.get_tohm(pvt);
+ tmp_mb = (1 + pvt->tohm) >> 20;
+
+- mb = div_u64_rem(tmp_mb, 1000, &kb);
+- edac_dbg(0, "TOHM: %u.%03u GB (0x%016Lx)\n", mb, kb, (u64)pvt->tohm);
++ gb = div_u64_rem(tmp_mb, 1024, &mb);
++ edac_dbg(0, "TOHM: %u.%03u GB (0x%016Lx)\n",
++ gb, (mb*1000)/1024, (u64)pvt->tohm);
+
+ /*
+ * Step 2) Get SAD range and SAD Interleave list
+@@ -950,11 +952,11 @@ static void get_memory_layout(const struct mem_ctl_info *mci)
+ break;
+
+ tmp_mb = (limit + 1) >> 20;
+- mb = div_u64_rem(tmp_mb, 1000, &kb);
++ gb = div_u64_rem(tmp_mb, 1024, &mb);
+ edac_dbg(0, "SAD#%d %s up to %u.%03u GB (0x%016Lx) Interleave: %s reg=0x%08x\n",
+ n_sads,
+ get_dram_attr(reg),
+- mb, kb,
++ gb, (mb*1000)/1024,
+ ((u64)tmp_mb) << 20L,
+ INTERLEAVE_MODE(reg) ? "8:6" : "[8:6]XOR[18:16]",
+ reg);
+@@ -985,9 +987,9 @@ static void get_memory_layout(const struct mem_ctl_info *mci)
+ break;
+ tmp_mb = (limit + 1) >> 20;
+
+- mb = div_u64_rem(tmp_mb, 1000, &kb);
++ gb = div_u64_rem(tmp_mb, 1024, &mb);
+ edac_dbg(0, "TAD#%d: up to %u.%03u GB (0x%016Lx), socket interleave %d, memory interleave %d, TGT: %d, %d, %d, %d, reg=0x%08x\n",
+- n_tads, mb, kb,
++ n_tads, gb, (mb*1000)/1024,
+ ((u64)tmp_mb) << 20L,
+ (u32)TAD_SOCK(reg),
+ (u32)TAD_CH(reg),
+@@ -1010,10 +1012,10 @@ static void get_memory_layout(const struct mem_ctl_info *mci)
+ tad_ch_nilv_offset[j],
+ ®);
+ tmp_mb = TAD_OFFSET(reg) >> 20;
+- mb = div_u64_rem(tmp_mb, 1000, &kb);
++ gb = div_u64_rem(tmp_mb, 1024, &mb);
+ edac_dbg(0, "TAD CH#%d, offset #%d: %u.%03u GB (0x%016Lx), reg=0x%08x\n",
+ i, j,
+- mb, kb,
++ gb, (mb*1000)/1024,
+ ((u64)tmp_mb) << 20L,
+ reg);
+ }
+@@ -1035,10 +1037,10 @@ static void get_memory_layout(const struct mem_ctl_info *mci)
+
+ tmp_mb = pvt->info.rir_limit(reg) >> 20;
+ rir_way = 1 << RIR_WAY(reg);
+- mb = div_u64_rem(tmp_mb, 1000, &kb);
++ gb = div_u64_rem(tmp_mb, 1024, &mb);
+ edac_dbg(0, "CH#%d RIR#%d, limit: %u.%03u GB (0x%016Lx), way: %d, reg=0x%08x\n",
+ i, j,
+- mb, kb,
++ gb, (mb*1000)/1024,
+ ((u64)tmp_mb) << 20L,
+ rir_way,
+ reg);
+@@ -1049,10 +1051,10 @@ static void get_memory_layout(const struct mem_ctl_info *mci)
+ ®);
+ tmp_mb = RIR_OFFSET(reg) << 6;
+
+- mb = div_u64_rem(tmp_mb, 1000, &kb);
++ gb = div_u64_rem(tmp_mb, 1024, &mb);
+ edac_dbg(0, "CH#%d RIR#%d INTL#%d, offset %u.%03u GB (0x%016Lx), tgt: %d, reg=0x%08x\n",
+ i, j, k,
+- mb, kb,
++ gb, (mb*1000)/1024,
+ ((u64)tmp_mb) << 20L,
+ (u32)RIR_RNK_TGT(reg),
+ reg);
+@@ -1090,7 +1092,7 @@ static int get_memory_error_data(struct mem_ctl_info *mci,
+ u8 ch_way, sck_way, pkg, sad_ha = 0;
+ u32 tad_offset;
+ u32 rir_way;
+- u32 mb, kb;
++ u32 mb, gb;
+ u64 ch_addr, offset, limit = 0, prv = 0;
+
+
+@@ -1359,10 +1361,10 @@ static int get_memory_error_data(struct mem_ctl_info *mci,
+ continue;
+
+ limit = pvt->info.rir_limit(reg);
+- mb = div_u64_rem(limit >> 20, 1000, &kb);
++ gb = div_u64_rem(limit >> 20, 1024, &mb);
+ edac_dbg(0, "RIR#%d, limit: %u.%03u GB (0x%016Lx), way: %d\n",
+ n_rir,
+- mb, kb,
++ gb, (mb*1000)/1024,
+ limit,
+ 1 << RIR_WAY(reg));
+ if (ch_addr <= limit)
+diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
+index f599357e8392..826ef3df2dc7 100644
+--- a/drivers/input/mouse/synaptics.c
++++ b/drivers/input/mouse/synaptics.c
+@@ -149,6 +149,7 @@ static const struct min_max_quirk min_max_pnpid_table[] = {
+ },
+ {
+ (const char * const []){"LEN2000", NULL},
++ {ANY_BOARD_ID, ANY_BOARD_ID},
+ 1024, 5113, 2021, 4832
+ },
+ {
+diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c
+index 505a9adac2d5..fab0ea1a46d1 100644
+--- a/drivers/iommu/amd_iommu.c
++++ b/drivers/iommu/amd_iommu.c
+@@ -1870,9 +1870,15 @@ static void free_pt_##LVL (unsigned long __pt) \
+ pt = (u64 *)__pt; \
+ \
+ for (i = 0; i < 512; ++i) { \
++ /* PTE present? */ \
+ if (!IOMMU_PTE_PRESENT(pt[i])) \
+ continue; \
+ \
++ /* Large PTE? */ \
++ if (PM_PTE_LEVEL(pt[i]) == 0 || \
++ PM_PTE_LEVEL(pt[i]) == 7) \
++ continue; \
++ \
+ p = (unsigned long)IOMMU_PTE_PAGE(pt[i]); \
+ FN(p); \
+ } \
+diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c
+index 573b53b38af4..bb686e15102c 100644
+--- a/drivers/net/can/dev.c
++++ b/drivers/net/can/dev.c
+@@ -360,6 +360,9 @@ unsigned int can_get_echo_skb(struct net_device *dev, unsigned int idx)
+ struct can_frame *cf = (struct can_frame *)skb->data;
+ u8 dlc = cf->can_dlc;
+
++ if (!(skb->tstamp.tv64))
++ __net_timestamp(skb);
++
+ netif_rx(priv->echo_skb[idx]);
+ priv->echo_skb[idx] = NULL;
+
+@@ -496,6 +499,7 @@ struct sk_buff *alloc_can_skb(struct net_device *dev, struct can_frame **cf)
+ if (unlikely(!skb))
+ return NULL;
+
++ __net_timestamp(skb);
+ skb->protocol = htons(ETH_P_CAN);
+ skb->pkt_type = PACKET_BROADCAST;
+ skb->ip_summed = CHECKSUM_UNNECESSARY;
+@@ -524,6 +528,7 @@ struct sk_buff *alloc_canfd_skb(struct net_device *dev,
+ if (unlikely(!skb))
+ return NULL;
+
++ __net_timestamp(skb);
+ skb->protocol = htons(ETH_P_CANFD);
+ skb->pkt_type = PACKET_BROADCAST;
+ skb->ip_summed = CHECKSUM_UNNECESSARY;
+diff --git a/drivers/net/can/slcan.c b/drivers/net/can/slcan.c
+index acb5b92ace92..cb6b4723af4a 100644
+--- a/drivers/net/can/slcan.c
++++ b/drivers/net/can/slcan.c
+@@ -210,6 +210,7 @@ static void slc_bump(struct slcan *sl)
+ if (!skb)
+ return;
+
++ __net_timestamp(skb);
+ skb->dev = sl->dev;
+ skb->protocol = htons(ETH_P_CAN);
+ skb->pkt_type = PACKET_BROADCAST;
+diff --git a/drivers/net/can/vcan.c b/drivers/net/can/vcan.c
+index 4e94057ef5cf..30e4627a0c01 100644
+--- a/drivers/net/can/vcan.c
++++ b/drivers/net/can/vcan.c
+@@ -81,6 +81,9 @@ static void vcan_rx(struct sk_buff *skb, struct net_device *dev)
+ skb->dev = dev;
+ skb->ip_summed = CHECKSUM_UNNECESSARY;
+
++ if (!(skb->tstamp.tv64))
++ __net_timestamp(skb);
++
+ netif_rx_ni(skb);
+ }
+
+diff --git a/drivers/s390/kvm/virtio_ccw.c b/drivers/s390/kvm/virtio_ccw.c
+index bda52f18e967..397e6b8b9656 100644
+--- a/drivers/s390/kvm/virtio_ccw.c
++++ b/drivers/s390/kvm/virtio_ccw.c
+@@ -64,6 +64,7 @@ struct virtio_ccw_device {
+ bool is_thinint;
+ bool going_away;
+ bool device_lost;
++ unsigned int config_ready;
+ void *airq_info;
+ };
+
+@@ -758,8 +759,11 @@ static void virtio_ccw_get_config(struct virtio_device *vdev,
+ if (ret)
+ goto out_free;
+
+- memcpy(vcdev->config, config_area, sizeof(vcdev->config));
+- memcpy(buf, &vcdev->config[offset], len);
++ memcpy(vcdev->config, config_area, offset + len);
++ if (buf)
++ memcpy(buf, &vcdev->config[offset], len);
++ if (vcdev->config_ready < offset + len)
++ vcdev->config_ready = offset + len;
+
+ out_free:
+ kfree(config_area);
+@@ -782,6 +786,9 @@ static void virtio_ccw_set_config(struct virtio_device *vdev,
+ if (!config_area)
+ goto out_free;
+
++ /* Make sure we don't overwrite fields. */
++ if (vcdev->config_ready < offset)
++ virtio_ccw_get_config(vdev, 0, NULL, offset);
+ memcpy(&vcdev->config[offset], buf, len);
+ /* Write the config area to the host. */
+ memcpy(config_area, vcdev->config, sizeof(vcdev->config));
+diff --git a/drivers/tty/serial/atmel_serial.c b/drivers/tty/serial/atmel_serial.c
+index 11300f7b49cb..daaed7c79e4f 100644
+--- a/drivers/tty/serial/atmel_serial.c
++++ b/drivers/tty/serial/atmel_serial.c
+@@ -311,8 +311,7 @@ void atmel_config_rs485(struct uart_port *port, struct serial_rs485 *rs485conf)
+ if (rs485conf->flags & SER_RS485_ENABLED) {
+ dev_dbg(port->dev, "Setting UART to RS485\n");
+ atmel_port->tx_done_mask = ATMEL_US_TXEMPTY;
+- if ((rs485conf->delay_rts_after_send) > 0)
+- UART_PUT_TTGR(port, rs485conf->delay_rts_after_send);
++ UART_PUT_TTGR(port, rs485conf->delay_rts_after_send);
+ mode |= ATMEL_US_USMODE_RS485;
+ } else {
+ dev_dbg(port->dev, "Setting UART to RS232\n");
+@@ -2016,9 +2015,7 @@ static void atmel_set_termios(struct uart_port *port, struct ktermios *termios,
+ mode &= ~ATMEL_US_USMODE;
+
+ if (atmel_port->rs485.flags & SER_RS485_ENABLED) {
+- if ((atmel_port->rs485.delay_rts_after_send) > 0)
+- UART_PUT_TTGR(port,
+- atmel_port->rs485.delay_rts_after_send);
++ UART_PUT_TTGR(port, atmel_port->rs485.delay_rts_after_send);
+ mode |= ATMEL_US_USMODE_RS485;
+ }
+
+diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
+index 63314ede7ba6..ab9b7ac63407 100644
+--- a/drivers/usb/gadget/function/f_fs.c
++++ b/drivers/usb/gadget/function/f_fs.c
+@@ -3400,6 +3400,7 @@ done:
+ static void ffs_closed(struct ffs_data *ffs)
+ {
+ struct ffs_dev *ffs_obj;
++ struct f_fs_opts *opts;
+
+ ENTER();
+ ffs_dev_lock();
+@@ -3413,8 +3414,13 @@ static void ffs_closed(struct ffs_data *ffs)
+ if (ffs_obj->ffs_closed_callback)
+ ffs_obj->ffs_closed_callback(ffs);
+
+- if (!ffs_obj->opts || ffs_obj->opts->no_configfs
+- || !ffs_obj->opts->func_inst.group.cg_item.ci_parent)
++ if (ffs_obj->opts)
++ opts = ffs_obj->opts;
++ else
++ goto done;
++
++ if (opts->no_configfs || !opts->func_inst.group.cg_item.ci_parent
++ || !atomic_read(&opts->func_inst.group.cg_item.ci_kref.refcount))
+ goto done;
+
+ unregister_gadget_item(ffs_obj->opts->
+diff --git a/drivers/xen/Makefile b/drivers/xen/Makefile
+index 2140398a2a8c..2ccd3592d41f 100644
+--- a/drivers/xen/Makefile
++++ b/drivers/xen/Makefile
+@@ -2,7 +2,7 @@ ifeq ($(filter y, $(CONFIG_ARM) $(CONFIG_ARM64)),)
+ obj-$(CONFIG_HOTPLUG_CPU) += cpu_hotplug.o
+ endif
+ obj-$(CONFIG_X86) += fallback.o
+-obj-y += grant-table.o features.o balloon.o manage.o
++obj-y += grant-table.o features.o balloon.o manage.o preempt.o
+ obj-y += events/
+ obj-y += xenbus/
+
+diff --git a/drivers/xen/preempt.c b/drivers/xen/preempt.c
+new file mode 100644
+index 000000000000..a1800c150839
+--- /dev/null
++++ b/drivers/xen/preempt.c
+@@ -0,0 +1,44 @@
++/*
++ * Preemptible hypercalls
++ *
++ * Copyright (C) 2014 Citrix Systems R&D ltd.
++ *
++ * This source code is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public License as
++ * published by the Free Software Foundation; either version 2 of the
++ * License, or (at your option) any later version.
++ */
++
++#include <linux/sched.h>
++#include <xen/xen-ops.h>
++
++#ifndef CONFIG_PREEMPT
++
++/*
++ * Some hypercalls issued by the toolstack can take many 10s of
++ * seconds. Allow tasks running hypercalls via the privcmd driver to
++ * be voluntarily preempted even if full kernel preemption is
++ * disabled.
++ *
++ * Such preemptible hypercalls are bracketed by
++ * xen_preemptible_hcall_begin() and xen_preemptible_hcall_end()
++ * calls.
++ */
++
++DEFINE_PER_CPU(bool, xen_in_preemptible_hcall);
++EXPORT_SYMBOL_GPL(xen_in_preemptible_hcall);
++
++asmlinkage __visible void xen_maybe_preempt_hcall(void)
++{
++ if (unlikely(__this_cpu_read(xen_in_preemptible_hcall)
++ && should_resched())) {
++ /*
++ * Clear flag as we may be rescheduled on a different
++ * cpu.
++ */
++ __this_cpu_write(xen_in_preemptible_hcall, false);
++ _cond_resched();
++ __this_cpu_write(xen_in_preemptible_hcall, true);
++ }
++}
++#endif /* CONFIG_PREEMPT */
+diff --git a/drivers/xen/privcmd.c b/drivers/xen/privcmd.c
+index 569a13b9e856..59ac71c4a043 100644
+--- a/drivers/xen/privcmd.c
++++ b/drivers/xen/privcmd.c
+@@ -56,10 +56,12 @@ static long privcmd_ioctl_hypercall(void __user *udata)
+ if (copy_from_user(&hypercall, udata, sizeof(hypercall)))
+ return -EFAULT;
+
++ xen_preemptible_hcall_begin();
+ ret = privcmd_call(hypercall.op,
+ hypercall.arg[0], hypercall.arg[1],
+ hypercall.arg[2], hypercall.arg[3],
+ hypercall.arg[4]);
++ xen_preemptible_hcall_end();
+
+ return ret;
+ }
+diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c
+index c81ce0c7c1a9..f54511dd287e 100644
+--- a/fs/btrfs/ctree.c
++++ b/fs/btrfs/ctree.c
+@@ -2920,7 +2920,7 @@ done:
+ */
+ if (!p->leave_spinning)
+ btrfs_set_path_blocking(p);
+- if (ret < 0)
++ if (ret < 0 && !p->skip_release_on_error)
+ btrfs_release_path(p);
+ return ret;
+ }
+diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
+index fe69edda11fb..ba5aec76e6f8 100644
+--- a/fs/btrfs/ctree.h
++++ b/fs/btrfs/ctree.h
+@@ -607,6 +607,7 @@ struct btrfs_path {
+ unsigned int leave_spinning:1;
+ unsigned int search_commit_root:1;
+ unsigned int need_commit_sem:1;
++ unsigned int skip_release_on_error:1;
+ };
+
+ /*
+@@ -3686,6 +3687,10 @@ struct btrfs_dir_item *btrfs_lookup_xattr(struct btrfs_trans_handle *trans,
+ int verify_dir_item(struct btrfs_root *root,
+ struct extent_buffer *leaf,
+ struct btrfs_dir_item *dir_item);
++struct btrfs_dir_item *btrfs_match_dir_item_name(struct btrfs_root *root,
++ struct btrfs_path *path,
++ const char *name,
++ int name_len);
+
+ /* orphan.c */
+ int btrfs_insert_orphan_item(struct btrfs_trans_handle *trans,
+diff --git a/fs/btrfs/dir-item.c b/fs/btrfs/dir-item.c
+index fc8df866e919..1752625fb4dd 100644
+--- a/fs/btrfs/dir-item.c
++++ b/fs/btrfs/dir-item.c
+@@ -21,10 +21,6 @@
+ #include "hash.h"
+ #include "transaction.h"
+
+-static struct btrfs_dir_item *btrfs_match_dir_item_name(struct btrfs_root *root,
+- struct btrfs_path *path,
+- const char *name, int name_len);
+-
+ /*
+ * insert a name into a directory, doing overflow properly if there is a hash
+ * collision. data_size indicates how big the item inserted should be. On
+@@ -383,9 +379,9 @@ struct btrfs_dir_item *btrfs_lookup_xattr(struct btrfs_trans_handle *trans,
+ * this walks through all the entries in a dir item and finds one
+ * for a specific name.
+ */
+-static struct btrfs_dir_item *btrfs_match_dir_item_name(struct btrfs_root *root,
+- struct btrfs_path *path,
+- const char *name, int name_len)
++struct btrfs_dir_item *btrfs_match_dir_item_name(struct btrfs_root *root,
++ struct btrfs_path *path,
++ const char *name, int name_len)
+ {
+ struct btrfs_dir_item *dir_item;
+ unsigned long name_ptr;
+diff --git a/fs/btrfs/xattr.c b/fs/btrfs/xattr.c
+index 00eacd83ce3d..01bad724b5f7 100644
+--- a/fs/btrfs/xattr.c
++++ b/fs/btrfs/xattr.c
+@@ -29,6 +29,7 @@
+ #include "xattr.h"
+ #include "disk-io.h"
+ #include "props.h"
++#include "locking.h"
+
+
+ ssize_t __btrfs_getxattr(struct inode *inode, const char *name,
+@@ -91,7 +92,7 @@ static int do_setxattr(struct btrfs_trans_handle *trans,
+ struct inode *inode, const char *name,
+ const void *value, size_t size, int flags)
+ {
+- struct btrfs_dir_item *di;
++ struct btrfs_dir_item *di = NULL;
+ struct btrfs_root *root = BTRFS_I(inode)->root;
+ struct btrfs_path *path;
+ size_t name_len = strlen(name);
+@@ -103,84 +104,119 @@ static int do_setxattr(struct btrfs_trans_handle *trans,
+ path = btrfs_alloc_path();
+ if (!path)
+ return -ENOMEM;
++ path->skip_release_on_error = 1;
++
++ if (!value) {
++ di = btrfs_lookup_xattr(trans, root, path, btrfs_ino(inode),
++ name, name_len, -1);
++ if (!di && (flags & XATTR_REPLACE))
++ ret = -ENODATA;
++ else if (di)
++ ret = btrfs_delete_one_dir_name(trans, root, path, di);
++ goto out;
++ }
+
++ /*
++ * For a replace we can't just do the insert blindly.
++ * Do a lookup first (read-only btrfs_search_slot), and return if xattr
++ * doesn't exist. If it exists, fall down below to the insert/replace
++ * path - we can't race with a concurrent xattr delete, because the VFS
++ * locks the inode's i_mutex before calling setxattr or removexattr.
++ */
+ if (flags & XATTR_REPLACE) {
+- di = btrfs_lookup_xattr(trans, root, path, btrfs_ino(inode), name,
+- name_len, -1);
+- if (IS_ERR(di)) {
+- ret = PTR_ERR(di);
+- goto out;
+- } else if (!di) {
++ ASSERT(mutex_is_locked(&inode->i_mutex));
++ di = btrfs_lookup_xattr(NULL, root, path, btrfs_ino(inode),
++ name, name_len, 0);
++ if (!di) {
+ ret = -ENODATA;
+ goto out;
+ }
+- ret = btrfs_delete_one_dir_name(trans, root, path, di);
+- if (ret)
+- goto out;
+ btrfs_release_path(path);
++ di = NULL;
++ }
+
++ ret = btrfs_insert_xattr_item(trans, root, path, btrfs_ino(inode),
++ name, name_len, value, size);
++ if (ret == -EOVERFLOW) {
+ /*
+- * remove the attribute
++ * We have an existing item in a leaf, split_leaf couldn't
++ * expand it. That item might have or not a dir_item that
++ * matches our target xattr, so lets check.
+ */
+- if (!value)
+- goto out;
+- } else {
+- di = btrfs_lookup_xattr(NULL, root, path, btrfs_ino(inode),
+- name, name_len, 0);
+- if (IS_ERR(di)) {
+- ret = PTR_ERR(di);
++ ret = 0;
++ btrfs_assert_tree_locked(path->nodes[0]);
++ di = btrfs_match_dir_item_name(root, path, name, name_len);
++ if (!di && !(flags & XATTR_REPLACE)) {
++ ret = -ENOSPC;
+ goto out;
+ }
+- if (!di && !value)
+- goto out;
+- btrfs_release_path(path);
++ } else if (ret == -EEXIST) {
++ ret = 0;
++ di = btrfs_match_dir_item_name(root, path, name, name_len);
++ ASSERT(di); /* logic error */
++ } else if (ret) {
++ goto out;
+ }
+
+-again:
+- ret = btrfs_insert_xattr_item(trans, root, path, btrfs_ino(inode),
+- name, name_len, value, size);
+- /*
+- * If we're setting an xattr to a new value but the new value is say
+- * exactly BTRFS_MAX_XATTR_SIZE, we could end up with EOVERFLOW getting
+- * back from split_leaf. This is because it thinks we'll be extending
+- * the existing item size, but we're asking for enough space to add the
+- * item itself. So if we get EOVERFLOW just set ret to EEXIST and let
+- * the rest of the function figure it out.
+- */
+- if (ret == -EOVERFLOW)
++ if (di && (flags & XATTR_CREATE)) {
+ ret = -EEXIST;
++ goto out;
++ }
+
+- if (ret == -EEXIST) {
+- if (flags & XATTR_CREATE)
+- goto out;
++ if (di) {
+ /*
+- * We can't use the path we already have since we won't have the
+- * proper locking for a delete, so release the path and
+- * re-lookup to delete the thing.
++ * We're doing a replace, and it must be atomic, that is, at
++ * any point in time we have either the old or the new xattr
++ * value in the tree. We don't want readers (getxattr and
++ * listxattrs) to miss a value, this is specially important
++ * for ACLs.
+ */
+- btrfs_release_path(path);
+- di = btrfs_lookup_xattr(trans, root, path, btrfs_ino(inode),
+- name, name_len, -1);
+- if (IS_ERR(di)) {
+- ret = PTR_ERR(di);
+- goto out;
+- } else if (!di) {
+- /* Shouldn't happen but just in case... */
+- btrfs_release_path(path);
+- goto again;
++ const int slot = path->slots[0];
++ struct extent_buffer *leaf = path->nodes[0];
++ const u16 old_data_len = btrfs_dir_data_len(leaf, di);
++ const u32 item_size = btrfs_item_size_nr(leaf, slot);
++ const u32 data_size = sizeof(*di) + name_len + size;
++ struct btrfs_item *item;
++ unsigned long data_ptr;
++ char *ptr;
++
++ if (size > old_data_len) {
++ if (btrfs_leaf_free_space(root, leaf) <
++ (size - old_data_len)) {
++ ret = -ENOSPC;
++ goto out;
++ }
+ }
+
+- ret = btrfs_delete_one_dir_name(trans, root, path, di);
+- if (ret)
+- goto out;
++ if (old_data_len + name_len + sizeof(*di) == item_size) {
++ /* No other xattrs packed in the same leaf item. */
++ if (size > old_data_len)
++ btrfs_extend_item(root, path,
++ size - old_data_len);
++ else if (size < old_data_len)
++ btrfs_truncate_item(root, path, data_size, 1);
++ } else {
++ /* There are other xattrs packed in the same item. */
++ ret = btrfs_delete_one_dir_name(trans, root, path, di);
++ if (ret)
++ goto out;
++ btrfs_extend_item(root, path, data_size);
++ }
+
++ item = btrfs_item_nr(slot);
++ ptr = btrfs_item_ptr(leaf, slot, char);
++ ptr += btrfs_item_size(leaf, item) - data_size;
++ di = (struct btrfs_dir_item *)ptr;
++ btrfs_set_dir_data_len(leaf, di, size);
++ data_ptr = ((unsigned long)(di + 1)) + name_len;
++ write_extent_buffer(leaf, value, data_ptr, size);
++ btrfs_mark_buffer_dirty(leaf);
++ } else {
+ /*
+- * We have a value to set, so go back and try to insert it now.
++ * Insert, and we had space for the xattr, so path->slots[0] is
++ * where our xattr dir_item is and btrfs_insert_xattr_item()
++ * filled it.
+ */
+- if (value) {
+- btrfs_release_path(path);
+- goto again;
+- }
+ }
+ out:
+ btrfs_free_path(path);
+diff --git a/fs/dcache.c b/fs/dcache.c
+index e0750b8f51aa..d0539a4a1ab1 100644
+--- a/fs/dcache.c
++++ b/fs/dcache.c
+@@ -2893,17 +2893,6 @@ restart:
+ vfsmnt = &mnt->mnt;
+ continue;
+ }
+- /*
+- * Filesystems needing to implement special "root names"
+- * should do so with ->d_dname()
+- */
+- if (IS_ROOT(dentry) &&
+- (dentry->d_name.len != 1 ||
+- dentry->d_name.name[0] != '/')) {
+- WARN(1, "Root dentry has weird name <%.*s>\n",
+- (int) dentry->d_name.len,
+- dentry->d_name.name);
+- }
+ if (!error)
+ error = is_mounted(vfsmnt) ? 1 : 2;
+ break;
+diff --git a/fs/inode.c b/fs/inode.c
+index 26753ba7b6d6..56d1d2b4bf31 100644
+--- a/fs/inode.c
++++ b/fs/inode.c
+@@ -1631,8 +1631,8 @@ int file_remove_suid(struct file *file)
+ error = security_inode_killpriv(dentry);
+ if (!error && killsuid)
+ error = __remove_suid(dentry, killsuid);
+- if (!error && (inode->i_sb->s_flags & MS_NOSEC))
+- inode->i_flags |= S_NOSEC;
++ if (!error)
++ inode_has_no_xattr(inode);
+
+ return error;
+ }
+diff --git a/fs/namespace.c b/fs/namespace.c
+index a19d05c4ebe5..da23ad8a2c85 100644
+--- a/fs/namespace.c
++++ b/fs/namespace.c
+@@ -2297,6 +2297,8 @@ unlock:
+ return err;
+ }
+
++static bool fs_fully_visible(struct file_system_type *fs_type, int *new_mnt_flags);
++
+ /*
+ * create a new mount for userspace and request it to be added into the
+ * namespace's tree
+@@ -2328,6 +2330,10 @@ static int do_new_mount(struct path *path, const char *fstype, int flags,
+ flags |= MS_NODEV;
+ mnt_flags |= MNT_NODEV | MNT_LOCK_NODEV;
+ }
++ if (type->fs_flags & FS_USERNS_VISIBLE) {
++ if (!fs_fully_visible(type, &mnt_flags))
++ return -EPERM;
++ }
+ }
+
+ mnt = vfs_kern_mount(type, flags, name, data);
+@@ -3125,9 +3131,10 @@ bool current_chrooted(void)
+ return chrooted;
+ }
+
+-bool fs_fully_visible(struct file_system_type *type)
++static bool fs_fully_visible(struct file_system_type *type, int *new_mnt_flags)
+ {
+ struct mnt_namespace *ns = current->nsproxy->mnt_ns;
++ int new_flags = *new_mnt_flags;
+ struct mount *mnt;
+ bool visible = false;
+
+@@ -3146,16 +3153,37 @@ bool fs_fully_visible(struct file_system_type *type)
+ if (mnt->mnt.mnt_root != mnt->mnt.mnt_sb->s_root)
+ continue;
+
+- /* This mount is not fully visible if there are any child mounts
+- * that cover anything except for empty directories.
++ /* Verify the mount flags are equal to or more permissive
++ * than the proposed new mount.
++ */
++ if ((mnt->mnt.mnt_flags & MNT_LOCK_READONLY) &&
++ !(new_flags & MNT_READONLY))
++ continue;
++ if ((mnt->mnt.mnt_flags & MNT_LOCK_NODEV) &&
++ !(new_flags & MNT_NODEV))
++ continue;
++ if ((mnt->mnt.mnt_flags & MNT_LOCK_ATIME) &&
++ ((mnt->mnt.mnt_flags & MNT_ATIME_MASK) != (new_flags & MNT_ATIME_MASK)))
++ continue;
++
++ /* This mount is not fully visible if there are any
++ * locked child mounts that cover anything except for
++ * empty directories.
+ */
+ list_for_each_entry(child, &mnt->mnt_mounts, mnt_child) {
+ struct inode *inode = child->mnt_mountpoint->d_inode;
++ /* Only worry about locked mounts */
++ if (!(mnt->mnt.mnt_flags & MNT_LOCKED))
++ continue;
+ if (!S_ISDIR(inode->i_mode))
+ goto next;
+ if (inode->i_nlink > 2)
+ goto next;
+ }
++ /* Preserve the locked attributes */
++ *new_mnt_flags |= mnt->mnt.mnt_flags & (MNT_LOCK_READONLY | \
++ MNT_LOCK_NODEV | \
++ MNT_LOCK_ATIME);
+ visible = true;
+ goto found;
+ next: ;
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index b13edc0865f7..c9ff4a176a25 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -5356,7 +5356,6 @@ static struct nfs4_unlockdata *nfs4_alloc_unlockdata(struct file_lock *fl,
+ atomic_inc(&lsp->ls_count);
+ /* Ensure we don't close file until we're done freeing locks! */
+ p->ctx = get_nfs_open_context(ctx);
+- get_file(fl->fl_file);
+ memcpy(&p->fl, fl, sizeof(p->fl));
+ p->server = NFS_SERVER(inode);
+ return p;
+@@ -5368,7 +5367,6 @@ static void nfs4_locku_release_calldata(void *data)
+ nfs_free_seqid(calldata->arg.seqid);
+ nfs4_put_lock_state(calldata->lsp);
+ put_nfs_open_context(calldata->ctx);
+- fput(calldata->fl.fl_file);
+ kfree(calldata);
+ }
+
+diff --git a/fs/proc/root.c b/fs/proc/root.c
+index 094e44d4a6be..9e772f1a5386 100644
+--- a/fs/proc/root.c
++++ b/fs/proc/root.c
+@@ -112,9 +112,6 @@ static struct dentry *proc_mount(struct file_system_type *fs_type,
+ ns = task_active_pid_ns(current);
+ options = data;
+
+- if (!capable(CAP_SYS_ADMIN) && !fs_fully_visible(fs_type))
+- return ERR_PTR(-EPERM);
+-
+ /* Does the mounter have privilege over the pid namespace? */
+ if (!ns_capable(ns->user_ns, CAP_SYS_ADMIN))
+ return ERR_PTR(-EPERM);
+@@ -159,7 +156,7 @@ static struct file_system_type proc_fs_type = {
+ .name = "proc",
+ .mount = proc_mount,
+ .kill_sb = proc_kill_sb,
+- .fs_flags = FS_USERNS_MOUNT,
++ .fs_flags = FS_USERNS_VISIBLE | FS_USERNS_MOUNT,
+ };
+
+ void __init proc_root_init(void)
+diff --git a/fs/sysfs/mount.c b/fs/sysfs/mount.c
+index 8a49486bf30c..1c6ac6fcee9f 100644
+--- a/fs/sysfs/mount.c
++++ b/fs/sysfs/mount.c
+@@ -31,9 +31,6 @@ static struct dentry *sysfs_mount(struct file_system_type *fs_type,
+ bool new_sb;
+
+ if (!(flags & MS_KERNMOUNT)) {
+- if (!capable(CAP_SYS_ADMIN) && !fs_fully_visible(fs_type))
+- return ERR_PTR(-EPERM);
+-
+ if (!kobj_ns_current_may_mount(KOBJ_NS_TYPE_NET))
+ return ERR_PTR(-EPERM);
+ }
+@@ -58,7 +55,7 @@ static struct file_system_type sysfs_fs_type = {
+ .name = "sysfs",
+ .mount = sysfs_mount,
+ .kill_sb = sysfs_kill_sb,
+- .fs_flags = FS_USERNS_MOUNT,
++ .fs_flags = FS_USERNS_VISIBLE | FS_USERNS_MOUNT,
+ };
+
+ int __init sysfs_init(void)
+diff --git a/fs/ufs/balloc.c b/fs/ufs/balloc.c
+index 2c1036080d52..a7106eda5024 100644
+--- a/fs/ufs/balloc.c
++++ b/fs/ufs/balloc.c
+@@ -51,8 +51,8 @@ void ufs_free_fragments(struct inode *inode, u64 fragment, unsigned count)
+
+ if (ufs_fragnum(fragment) + count > uspi->s_fpg)
+ ufs_error (sb, "ufs_free_fragments", "internal error");
+-
+- lock_ufs(sb);
++
++ mutex_lock(&UFS_SB(sb)->s_lock);
+
+ cgno = ufs_dtog(uspi, fragment);
+ bit = ufs_dtogd(uspi, fragment);
+@@ -115,13 +115,13 @@ void ufs_free_fragments(struct inode *inode, u64 fragment, unsigned count)
+ if (sb->s_flags & MS_SYNCHRONOUS)
+ ubh_sync_block(UCPI_UBH(ucpi));
+ ufs_mark_sb_dirty(sb);
+-
+- unlock_ufs(sb);
++
++ mutex_unlock(&UFS_SB(sb)->s_lock);
+ UFSD("EXIT\n");
+ return;
+
+ failed:
+- unlock_ufs(sb);
++ mutex_unlock(&UFS_SB(sb)->s_lock);
+ UFSD("EXIT (FAILED)\n");
+ return;
+ }
+@@ -151,7 +151,7 @@ void ufs_free_blocks(struct inode *inode, u64 fragment, unsigned count)
+ goto failed;
+ }
+
+- lock_ufs(sb);
++ mutex_lock(&UFS_SB(sb)->s_lock);
+
+ do_more:
+ overflow = 0;
+@@ -211,12 +211,12 @@ do_more:
+ }
+
+ ufs_mark_sb_dirty(sb);
+- unlock_ufs(sb);
++ mutex_unlock(&UFS_SB(sb)->s_lock);
+ UFSD("EXIT\n");
+ return;
+
+ failed_unlock:
+- unlock_ufs(sb);
++ mutex_unlock(&UFS_SB(sb)->s_lock);
+ failed:
+ UFSD("EXIT (FAILED)\n");
+ return;
+@@ -357,7 +357,7 @@ u64 ufs_new_fragments(struct inode *inode, void *p, u64 fragment,
+ usb1 = ubh_get_usb_first(uspi);
+ *err = -ENOSPC;
+
+- lock_ufs(sb);
++ mutex_lock(&UFS_SB(sb)->s_lock);
+ tmp = ufs_data_ptr_to_cpu(sb, p);
+
+ if (count + ufs_fragnum(fragment) > uspi->s_fpb) {
+@@ -378,19 +378,19 @@ u64 ufs_new_fragments(struct inode *inode, void *p, u64 fragment,
+ "fragment %llu, tmp %llu\n",
+ (unsigned long long)fragment,
+ (unsigned long long)tmp);
+- unlock_ufs(sb);
++ mutex_unlock(&UFS_SB(sb)->s_lock);
+ return INVBLOCK;
+ }
+ if (fragment < UFS_I(inode)->i_lastfrag) {
+ UFSD("EXIT (ALREADY ALLOCATED)\n");
+- unlock_ufs(sb);
++ mutex_unlock(&UFS_SB(sb)->s_lock);
+ return 0;
+ }
+ }
+ else {
+ if (tmp) {
+ UFSD("EXIT (ALREADY ALLOCATED)\n");
+- unlock_ufs(sb);
++ mutex_unlock(&UFS_SB(sb)->s_lock);
+ return 0;
+ }
+ }
+@@ -399,7 +399,7 @@ u64 ufs_new_fragments(struct inode *inode, void *p, u64 fragment,
+ * There is not enough space for user on the device
+ */
+ if (!capable(CAP_SYS_RESOURCE) && ufs_freespace(uspi, UFS_MINFREE) <= 0) {
+- unlock_ufs(sb);
++ mutex_unlock(&UFS_SB(sb)->s_lock);
+ UFSD("EXIT (FAILED)\n");
+ return 0;
+ }
+@@ -424,7 +424,7 @@ u64 ufs_new_fragments(struct inode *inode, void *p, u64 fragment,
+ ufs_clear_frags(inode, result + oldcount,
+ newcount - oldcount, locked_page != NULL);
+ }
+- unlock_ufs(sb);
++ mutex_unlock(&UFS_SB(sb)->s_lock);
+ UFSD("EXIT, result %llu\n", (unsigned long long)result);
+ return result;
+ }
+@@ -439,7 +439,7 @@ u64 ufs_new_fragments(struct inode *inode, void *p, u64 fragment,
+ fragment + count);
+ ufs_clear_frags(inode, result + oldcount, newcount - oldcount,
+ locked_page != NULL);
+- unlock_ufs(sb);
++ mutex_unlock(&UFS_SB(sb)->s_lock);
+ UFSD("EXIT, result %llu\n", (unsigned long long)result);
+ return result;
+ }
+@@ -477,7 +477,7 @@ u64 ufs_new_fragments(struct inode *inode, void *p, u64 fragment,
+ *err = 0;
+ UFS_I(inode)->i_lastfrag = max(UFS_I(inode)->i_lastfrag,
+ fragment + count);
+- unlock_ufs(sb);
++ mutex_unlock(&UFS_SB(sb)->s_lock);
+ if (newcount < request)
+ ufs_free_fragments (inode, result + newcount, request - newcount);
+ ufs_free_fragments (inode, tmp, oldcount);
+@@ -485,7 +485,7 @@ u64 ufs_new_fragments(struct inode *inode, void *p, u64 fragment,
+ return result;
+ }
+
+- unlock_ufs(sb);
++ mutex_unlock(&UFS_SB(sb)->s_lock);
+ UFSD("EXIT (FAILED)\n");
+ return 0;
+ }
+diff --git a/fs/ufs/ialloc.c b/fs/ufs/ialloc.c
+index 7caa01652888..fd0203ce1f7f 100644
+--- a/fs/ufs/ialloc.c
++++ b/fs/ufs/ialloc.c
+@@ -69,11 +69,11 @@ void ufs_free_inode (struct inode * inode)
+
+ ino = inode->i_ino;
+
+- lock_ufs(sb);
++ mutex_lock(&UFS_SB(sb)->s_lock);
+
+ if (!((ino > 1) && (ino < (uspi->s_ncg * uspi->s_ipg )))) {
+ ufs_warning(sb, "ufs_free_inode", "reserved inode or nonexistent inode %u\n", ino);
+- unlock_ufs(sb);
++ mutex_unlock(&UFS_SB(sb)->s_lock);
+ return;
+ }
+
+@@ -81,7 +81,7 @@ void ufs_free_inode (struct inode * inode)
+ bit = ufs_inotocgoff (ino);
+ ucpi = ufs_load_cylinder (sb, cg);
+ if (!ucpi) {
+- unlock_ufs(sb);
++ mutex_unlock(&UFS_SB(sb)->s_lock);
+ return;
+ }
+ ucg = ubh_get_ucg(UCPI_UBH(ucpi));
+@@ -115,7 +115,7 @@ void ufs_free_inode (struct inode * inode)
+ ubh_sync_block(UCPI_UBH(ucpi));
+
+ ufs_mark_sb_dirty(sb);
+- unlock_ufs(sb);
++ mutex_unlock(&UFS_SB(sb)->s_lock);
+ UFSD("EXIT\n");
+ }
+
+@@ -193,7 +193,7 @@ struct inode *ufs_new_inode(struct inode *dir, umode_t mode)
+ sbi = UFS_SB(sb);
+ uspi = sbi->s_uspi;
+
+- lock_ufs(sb);
++ mutex_lock(&sbi->s_lock);
+
+ /*
+ * Try to place the inode in its parent directory
+@@ -331,21 +331,21 @@ cg_found:
+ sync_dirty_buffer(bh);
+ brelse(bh);
+ }
+- unlock_ufs(sb);
++ mutex_unlock(&sbi->s_lock);
+
+ UFSD("allocating inode %lu\n", inode->i_ino);
+ UFSD("EXIT\n");
+ return inode;
+
+ fail_remove_inode:
+- unlock_ufs(sb);
++ mutex_unlock(&sbi->s_lock);
+ clear_nlink(inode);
+ unlock_new_inode(inode);
+ iput(inode);
+ UFSD("EXIT (FAILED): err %d\n", err);
+ return ERR_PTR(err);
+ failed:
+- unlock_ufs(sb);
++ mutex_unlock(&sbi->s_lock);
+ make_bad_inode(inode);
+ iput (inode);
+ UFSD("EXIT (FAILED): err %d\n", err);
+diff --git a/fs/ufs/inode.c b/fs/ufs/inode.c
+index be7d42c7d938..2d93ab07da8a 100644
+--- a/fs/ufs/inode.c
++++ b/fs/ufs/inode.c
+@@ -902,6 +902,9 @@ void ufs_evict_inode(struct inode * inode)
+ invalidate_inode_buffers(inode);
+ clear_inode(inode);
+
+- if (want_delete)
++ if (want_delete) {
++ lock_ufs(inode->i_sb);
+ ufs_free_inode(inode);
++ unlock_ufs(inode->i_sb);
++ }
+ }
+diff --git a/fs/ufs/namei.c b/fs/ufs/namei.c
+index fd65deb4b5f0..e8ee2985b068 100644
+--- a/fs/ufs/namei.c
++++ b/fs/ufs/namei.c
+@@ -128,12 +128,12 @@ static int ufs_symlink (struct inode * dir, struct dentry * dentry,
+ if (l > sb->s_blocksize)
+ goto out_notlocked;
+
++ lock_ufs(dir->i_sb);
+ inode = ufs_new_inode(dir, S_IFLNK | S_IRWXUGO);
+ err = PTR_ERR(inode);
+ if (IS_ERR(inode))
+- goto out_notlocked;
++ goto out;
+
+- lock_ufs(dir->i_sb);
+ if (l > UFS_SB(sb)->s_uspi->s_maxsymlinklen) {
+ /* slow symlink */
+ inode->i_op = &ufs_symlink_inode_operations;
+@@ -174,7 +174,12 @@ static int ufs_link (struct dentry * old_dentry, struct inode * dir,
+ inode_inc_link_count(inode);
+ ihold(inode);
+
+- error = ufs_add_nondir(dentry, inode);
++ error = ufs_add_link(dentry, inode);
++ if (error) {
++ inode_dec_link_count(inode);
++ iput(inode);
++ } else
++ d_instantiate(dentry, inode);
+ unlock_ufs(dir->i_sb);
+ return error;
+ }
+@@ -184,9 +189,13 @@ static int ufs_mkdir(struct inode * dir, struct dentry * dentry, umode_t mode)
+ struct inode * inode;
+ int err;
+
++ lock_ufs(dir->i_sb);
++ inode_inc_link_count(dir);
++
+ inode = ufs_new_inode(dir, S_IFDIR|mode);
++ err = PTR_ERR(inode);
+ if (IS_ERR(inode))
+- return PTR_ERR(inode);
++ goto out_dir;
+
+ inode->i_op = &ufs_dir_inode_operations;
+ inode->i_fop = &ufs_dir_operations;
+@@ -194,9 +203,6 @@ static int ufs_mkdir(struct inode * dir, struct dentry * dentry, umode_t mode)
+
+ inode_inc_link_count(inode);
+
+- lock_ufs(dir->i_sb);
+- inode_inc_link_count(dir);
+-
+ err = ufs_make_empty(inode, dir);
+ if (err)
+ goto out_fail;
+@@ -206,6 +212,7 @@ static int ufs_mkdir(struct inode * dir, struct dentry * dentry, umode_t mode)
+ goto out_fail;
+ unlock_ufs(dir->i_sb);
+
++ unlock_new_inode(inode);
+ d_instantiate(dentry, inode);
+ out:
+ return err;
+@@ -215,6 +222,7 @@ out_fail:
+ inode_dec_link_count(inode);
+ unlock_new_inode(inode);
+ iput (inode);
++out_dir:
+ inode_dec_link_count(dir);
+ unlock_ufs(dir->i_sb);
+ goto out;
+diff --git a/fs/ufs/super.c b/fs/ufs/super.c
+index da73801301d5..ce02dff5572f 100644
+--- a/fs/ufs/super.c
++++ b/fs/ufs/super.c
+@@ -698,6 +698,7 @@ static int ufs_sync_fs(struct super_block *sb, int wait)
+ unsigned flags;
+
+ lock_ufs(sb);
++ mutex_lock(&UFS_SB(sb)->s_lock);
+
+ UFSD("ENTER\n");
+
+@@ -715,6 +716,7 @@ static int ufs_sync_fs(struct super_block *sb, int wait)
+ ufs_put_cstotal(sb);
+
+ UFSD("EXIT\n");
++ mutex_unlock(&UFS_SB(sb)->s_lock);
+ unlock_ufs(sb);
+
+ return 0;
+@@ -803,6 +805,7 @@ static int ufs_fill_super(struct super_block *sb, void *data, int silent)
+ UFSD("flag %u\n", (int)(sb->s_flags & MS_RDONLY));
+
+ mutex_init(&sbi->mutex);
++ mutex_init(&sbi->s_lock);
+ spin_lock_init(&sbi->work_lock);
+ INIT_DELAYED_WORK(&sbi->sync_work, delayed_sync_fs);
+ /*
+@@ -1281,6 +1284,7 @@ static int ufs_remount (struct super_block *sb, int *mount_flags, char *data)
+
+ sync_filesystem(sb);
+ lock_ufs(sb);
++ mutex_lock(&UFS_SB(sb)->s_lock);
+ uspi = UFS_SB(sb)->s_uspi;
+ flags = UFS_SB(sb)->s_flags;
+ usb1 = ubh_get_usb_first(uspi);
+@@ -1294,6 +1298,7 @@ static int ufs_remount (struct super_block *sb, int *mount_flags, char *data)
+ new_mount_opt = 0;
+ ufs_set_opt (new_mount_opt, ONERROR_LOCK);
+ if (!ufs_parse_options (data, &new_mount_opt)) {
++ mutex_unlock(&UFS_SB(sb)->s_lock);
+ unlock_ufs(sb);
+ return -EINVAL;
+ }
+@@ -1301,12 +1306,14 @@ static int ufs_remount (struct super_block *sb, int *mount_flags, char *data)
+ new_mount_opt |= ufstype;
+ } else if ((new_mount_opt & UFS_MOUNT_UFSTYPE) != ufstype) {
+ pr_err("ufstype can't be changed during remount\n");
++ mutex_unlock(&UFS_SB(sb)->s_lock);
+ unlock_ufs(sb);
+ return -EINVAL;
+ }
+
+ if ((*mount_flags & MS_RDONLY) == (sb->s_flags & MS_RDONLY)) {
+ UFS_SB(sb)->s_mount_opt = new_mount_opt;
++ mutex_unlock(&UFS_SB(sb)->s_lock);
+ unlock_ufs(sb);
+ return 0;
+ }
+@@ -1330,6 +1337,7 @@ static int ufs_remount (struct super_block *sb, int *mount_flags, char *data)
+ */
+ #ifndef CONFIG_UFS_FS_WRITE
+ pr_err("ufs was compiled with read-only support, can't be mounted as read-write\n");
++ mutex_unlock(&UFS_SB(sb)->s_lock);
+ unlock_ufs(sb);
+ return -EINVAL;
+ #else
+@@ -1339,11 +1347,13 @@ static int ufs_remount (struct super_block *sb, int *mount_flags, char *data)
+ ufstype != UFS_MOUNT_UFSTYPE_SUNx86 &&
+ ufstype != UFS_MOUNT_UFSTYPE_UFS2) {
+ pr_err("this ufstype is read-only supported\n");
++ mutex_unlock(&UFS_SB(sb)->s_lock);
+ unlock_ufs(sb);
+ return -EINVAL;
+ }
+ if (!ufs_read_cylinder_structures(sb)) {
+ pr_err("failed during remounting\n");
++ mutex_unlock(&UFS_SB(sb)->s_lock);
+ unlock_ufs(sb);
+ return -EPERM;
+ }
+@@ -1351,6 +1361,7 @@ static int ufs_remount (struct super_block *sb, int *mount_flags, char *data)
+ #endif
+ }
+ UFS_SB(sb)->s_mount_opt = new_mount_opt;
++ mutex_unlock(&UFS_SB(sb)->s_lock);
+ unlock_ufs(sb);
+ return 0;
+ }
+diff --git a/fs/ufs/ufs.h b/fs/ufs/ufs.h
+index 2a07396d5f9e..cf6368d42d4a 100644
+--- a/fs/ufs/ufs.h
++++ b/fs/ufs/ufs.h
+@@ -30,6 +30,7 @@ struct ufs_sb_info {
+ int work_queued; /* non-zero if the delayed work is queued */
+ struct delayed_work sync_work; /* FS sync delayed work */
+ spinlock_t work_lock; /* protects sync_work and work_queued */
++ struct mutex s_lock;
+ };
+
+ struct ufs_inode_info {
+diff --git a/include/linux/fs.h b/include/linux/fs.h
+index 9ab779e8a63c..84d672914bd8 100644
+--- a/include/linux/fs.h
++++ b/include/linux/fs.h
+@@ -1791,6 +1791,7 @@ struct file_system_type {
+ #define FS_HAS_SUBTYPE 4
+ #define FS_USERNS_MOUNT 8 /* Can be mounted by userns root */
+ #define FS_USERNS_DEV_MOUNT 16 /* A userns mount does not imply MNT_NODEV */
++#define FS_USERNS_VISIBLE 32 /* FS must already be visible */
+ #define FS_RENAME_DOES_D_MOVE 32768 /* FS will handle d_move() during rename() internally. */
+ struct dentry *(*mount) (struct file_system_type *, int,
+ const char *, void *);
+@@ -1878,7 +1879,6 @@ extern int vfs_ustat(dev_t, struct kstatfs *);
+ extern int freeze_super(struct super_block *super);
+ extern int thaw_super(struct super_block *super);
+ extern bool our_mnt(struct vfsmount *mnt);
+-extern bool fs_fully_visible(struct file_system_type *);
+
+ extern int current_umask(void);
+
+diff --git a/include/xen/xen-ops.h b/include/xen/xen-ops.h
+index 7491ee5d8164..83338210ee04 100644
+--- a/include/xen/xen-ops.h
++++ b/include/xen/xen-ops.h
+@@ -46,4 +46,30 @@ static inline efi_system_table_t __init *xen_efi_probe(void)
+ }
+ #endif
+
++#ifdef CONFIG_PREEMPT
++
++static inline void xen_preemptible_hcall_begin(void)
++{
++}
++
++static inline void xen_preemptible_hcall_end(void)
++{
++}
++
++#else
++
++DECLARE_PER_CPU(bool, xen_in_preemptible_hcall);
++
++static inline void xen_preemptible_hcall_begin(void)
++{
++ __this_cpu_write(xen_in_preemptible_hcall, true);
++}
++
++static inline void xen_preemptible_hcall_end(void)
++{
++ __this_cpu_write(xen_in_preemptible_hcall, false);
++}
++
++#endif /* CONFIG_PREEMPT */
++
+ #endif /* INCLUDE_XEN_OPS_H */
+diff --git a/kernel/events/core.c b/kernel/events/core.c
+index e631dacdb165..cb86038cad47 100644
+--- a/kernel/events/core.c
++++ b/kernel/events/core.c
+@@ -4057,20 +4057,20 @@ static void ring_buffer_attach(struct perf_event *event,
+ WARN_ON_ONCE(event->rcu_pending);
+
+ old_rb = event->rb;
+- event->rcu_batches = get_state_synchronize_rcu();
+- event->rcu_pending = 1;
+-
+ spin_lock_irqsave(&old_rb->event_lock, flags);
+ list_del_rcu(&event->rb_entry);
+ spin_unlock_irqrestore(&old_rb->event_lock, flags);
+- }
+
+- if (event->rcu_pending && rb) {
+- cond_synchronize_rcu(event->rcu_batches);
+- event->rcu_pending = 0;
++ event->rcu_batches = get_state_synchronize_rcu();
++ event->rcu_pending = 1;
+ }
+
+ if (rb) {
++ if (event->rcu_pending) {
++ cond_synchronize_rcu(event->rcu_batches);
++ event->rcu_pending = 0;
++ }
++
+ spin_lock_irqsave(&rb->event_lock, flags);
+ list_add_rcu(&event->rb_entry, &rb->event_list);
+ spin_unlock_irqrestore(&rb->event_lock, flags);
+diff --git a/kernel/trace/trace_events_filter.c b/kernel/trace/trace_events_filter.c
+index bcb9145a7913..51afcb76d32b 100644
+--- a/kernel/trace/trace_events_filter.c
++++ b/kernel/trace/trace_events_filter.c
+@@ -1369,19 +1369,24 @@ static int check_preds(struct filter_parse_state *ps)
+ {
+ int n_normal_preds = 0, n_logical_preds = 0;
+ struct postfix_elt *elt;
++ int cnt = 0;
+
+ list_for_each_entry(elt, &ps->postfix, list) {
+- if (elt->op == OP_NONE)
++ if (elt->op == OP_NONE) {
++ cnt++;
+ continue;
++ }
+
++ cnt--;
+ if (elt->op == OP_AND || elt->op == OP_OR) {
+ n_logical_preds++;
+ continue;
+ }
+ n_normal_preds++;
++ WARN_ON_ONCE(cnt < 0);
+ }
+
+- if (!n_normal_preds || n_logical_preds >= n_normal_preds) {
++ if (cnt != 1 || !n_normal_preds || n_logical_preds >= n_normal_preds) {
+ parse_error(ps, FILT_ERR_INVALID_FILTER, 0);
+ return -EINVAL;
+ }
+diff --git a/net/can/af_can.c b/net/can/af_can.c
+index d6030d6949df..9a3244941a5c 100644
+--- a/net/can/af_can.c
++++ b/net/can/af_can.c
+@@ -313,8 +313,12 @@ int can_send(struct sk_buff *skb, int loop)
+ return err;
+ }
+
+- if (newskb)
++ if (newskb) {
++ if (!(newskb->tstamp.tv64))
++ __net_timestamp(newskb);
++
+ netif_rx_ni(newskb);
++ }
+
+ /* update statistics */
+ can_stats.tx_frames++;
+diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
+index 24d3242f0e01..c522f7a00eab 100644
+--- a/net/core/rtnetlink.c
++++ b/net/core/rtnetlink.c
+@@ -2229,9 +2229,6 @@ void rtmsg_ifinfo(int type, struct net_device *dev, unsigned int change,
+ int err = -ENOBUFS;
+ size_t if_info_size;
+
+- if (dev->reg_state != NETREG_REGISTERED)
+- return;
+-
+ skb = nlmsg_new((if_info_size = if_nlmsg_size(dev, 0)), flags);
+ if (skb == NULL)
+ goto errout;
+diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
+index 71b574c7bde9..9fe2baa01fbe 100644
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -1221,7 +1221,10 @@ static int nf_tables_newchain(struct sock *nlsk, struct sk_buff *skb,
+
+ if (nla[NFTA_CHAIN_POLICY]) {
+ if ((chain != NULL &&
+- !(chain->flags & NFT_BASE_CHAIN)) ||
++ !(chain->flags & NFT_BASE_CHAIN)))
++ return -EOPNOTSUPP;
++
++ if (chain == NULL &&
+ nla[NFTA_CHAIN_HOOK] == NULL)
+ return -EOPNOTSUPP;
+
+diff --git a/net/netfilter/nfnetlink_cthelper.c b/net/netfilter/nfnetlink_cthelper.c
+index 9e287cb56a04..54330fb5efaf 100644
+--- a/net/netfilter/nfnetlink_cthelper.c
++++ b/net/netfilter/nfnetlink_cthelper.c
+@@ -77,6 +77,9 @@ nfnl_cthelper_parse_tuple(struct nf_conntrack_tuple *tuple,
+ if (!tb[NFCTH_TUPLE_L3PROTONUM] || !tb[NFCTH_TUPLE_L4PROTONUM])
+ return -EINVAL;
+
++ /* Not all fields are initialized so first zero the tuple */
++ memset(tuple, 0, sizeof(struct nf_conntrack_tuple));
++
+ tuple->src.l3num = ntohs(nla_get_be16(tb[NFCTH_TUPLE_L3PROTONUM]));
+ tuple->dst.protonum = nla_get_u8(tb[NFCTH_TUPLE_L4PROTONUM]);
+
+@@ -86,7 +89,7 @@ nfnl_cthelper_parse_tuple(struct nf_conntrack_tuple *tuple,
+ static int
+ nfnl_cthelper_from_nlattr(struct nlattr *attr, struct nf_conn *ct)
+ {
+- const struct nf_conn_help *help = nfct_help(ct);
++ struct nf_conn_help *help = nfct_help(ct);
+
+ if (attr == NULL)
+ return -EINVAL;
+@@ -94,7 +97,7 @@ nfnl_cthelper_from_nlattr(struct nlattr *attr, struct nf_conn *ct)
+ if (help->helper->data_len == 0)
+ return -EINVAL;
+
+- memcpy(&help->data, nla_data(attr), help->helper->data_len);
++ memcpy(help->data, nla_data(attr), help->helper->data_len);
+ return 0;
+ }
+
+diff --git a/net/netfilter/nft_compat.c b/net/netfilter/nft_compat.c
+index 265e190f2218..e22a2961cc39 100644
+--- a/net/netfilter/nft_compat.c
++++ b/net/netfilter/nft_compat.c
+@@ -97,6 +97,9 @@ nft_target_set_tgchk_param(struct xt_tgchk_param *par,
+ entry->e4.ip.invflags = inv ? IPT_INV_PROTO : 0;
+ break;
+ case AF_INET6:
++ if (proto)
++ entry->e6.ipv6.flags |= IP6T_F_PROTO;
++
+ entry->e6.ipv6.proto = proto;
+ entry->e6.ipv6.invflags = inv ? IP6T_INV_PROTO : 0;
+ break;
+@@ -304,6 +307,9 @@ nft_match_set_mtchk_param(struct xt_mtchk_param *par, const struct nft_ctx *ctx,
+ entry->e4.ip.invflags = inv ? IPT_INV_PROTO : 0;
+ break;
+ case AF_INET6:
++ if (proto)
++ entry->e6.ipv6.flags |= IP6T_F_PROTO;
++
+ entry->e6.ipv6.proto = proto;
+ entry->e6.ipv6.invflags = inv ? IP6T_INV_PROTO : 0;
+ break;
+diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
+index c603b20356ad..b1e455b47b82 100644
+--- a/security/selinux/hooks.c
++++ b/security/selinux/hooks.c
+@@ -405,7 +405,8 @@ static int selinux_is_sblabel_mnt(struct super_block *sb)
+
+ if (sbsec->behavior == SECURITY_FS_USE_XATTR ||
+ sbsec->behavior == SECURITY_FS_USE_TRANS ||
+- sbsec->behavior == SECURITY_FS_USE_TASK)
++ sbsec->behavior == SECURITY_FS_USE_TASK ||
++ sbsec->behavior == SECURITY_FS_USE_NATIVE)
+ return 1;
+
+ /* Special handling for sysfs. Is genfs but also has setxattr handler*/
^ permalink raw reply related [flat|nested] 67+ messages in thread
* [gentoo-commits] proj/linux-patches:3.18 commit in: /
@ 2015-07-30 12:43 Mike Pagano
0 siblings, 0 replies; 67+ messages in thread
From: Mike Pagano @ 2015-07-30 12:43 UTC (permalink / raw
To: gentoo-commits
commit: 5e0dbb42f182a56251c6e532d2fe2b922305a021
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Thu Jul 30 12:43:15 2015 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Thu Jul 30 12:43:15 2015 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=5e0dbb42
BFQ v7r8
0000_README | 12 +-
...oups-kconfig-build-bits-for-BFQ-v7r8-3.18.patch | 8 +-
...ntroduce-the-BFQ-v7r8-I-O-sched-for-3.18.patch1 | 198 ++++++++++-----------
...arly-Queue-Merge-EQM-to-BFQ-v7r8-for-3.18.patch | 96 +++++-----
4 files changed, 149 insertions(+), 165 deletions(-)
diff --git a/0000_README b/0000_README
index 61cb27a..21802d2 100644
--- a/0000_README
+++ b/0000_README
@@ -155,17 +155,17 @@ Patch: 5000_enable-additional-cpu-optimizations-for-gcc.patch
From: https://github.com/graysky2/kernel_gcc_patch/
Desc: Kernel patch enables gcc optimizations for additional CPUs.
-Patch: 5001_block-cgroups-kconfig-build-bits-for-BFQ-v7r7-3.18.patch
+Patch: 5001_block-cgroups-kconfig-build-bits-for-BFQ-v7r8-3.18.patch
From: http://algo.ing.unimo.it/people/paolo/disk_sched/
-Desc: BFQ v7r7 patch 1 for 3.18: Build, cgroups and kconfig bits
+Desc: BFQ v7r8 patch 1 for 3.18: Build, cgroups and kconfig bits
-Patch: 5002_block-introduce-the-BFQ-v7r7-I-O-sched-for-3.18.patch1
+Patch: 5002_block-introduce-the-BFQ-v7r8-I-O-sched-for-3.18.patch1
From: http://algo.ing.unimo.it/people/paolo/disk_sched/
-Desc: BFQ v7r7 patch 2 for 3.18: BFQ Scheduler
+Desc: BFQ v7r8 patch 2 for 3.18: BFQ Scheduler
-Patch: 5003_block-bfq-add-Early-Queue-Merge-EQM-to-BFQ-v7r7-for-3.18.0.patch
+Patch: 5003_block-bfq-add-Early-Queue-Merge-EQM-to-BFQ-v7r8-for-3.18.0.patch
From: http://algo.ing.unimo.it/people/paolo/disk_sched/
-Desc: BFQ v7r7 patch 3 for 3.18: Early Queue Merge (EQM)
+Desc: BFQ v7r8 patch 3 for 3.18: Early Queue Merge (EQM)
Patch: 5010_enable-additional-cpu-optimizations-for-gcc-4.9.patch
From: https://github.com/graysky2/kernel_gcc_patch/
diff --git a/5001_block-cgroups-kconfig-build-bits-for-BFQ-v7r7-3.18.patch b/5001_block-cgroups-kconfig-build-bits-for-BFQ-v7r8-3.18.patch
similarity index 96%
rename from 5001_block-cgroups-kconfig-build-bits-for-BFQ-v7r7-3.18.patch
rename to 5001_block-cgroups-kconfig-build-bits-for-BFQ-v7r8-3.18.patch
index 9f0a7b3..f563b15 100644
--- a/5001_block-cgroups-kconfig-build-bits-for-BFQ-v7r7-3.18.patch
+++ b/5001_block-cgroups-kconfig-build-bits-for-BFQ-v7r8-3.18.patch
@@ -1,7 +1,7 @@
-From e5cfe6a861feffa55dda77cd60bdb571fc7c3065 Mon Sep 17 00:00:00 2001
+From cd515f7eea26e74f58a1f49562ff84cd115fce2e Mon Sep 17 00:00:00 2001
From: Paolo Valente <paolo.valente@unimore.it>
-Date: Mon, 8 Dec 2014 16:04:25 +0100
-Subject: [PATCH 1/3] block: cgroups, kconfig, build bits for BFQ-v7r7-3.18
+Date: Sat, 6 Jun 2015 17:56:31 +0200
+Subject: [PATCH 1/3] block: cgroups, kconfig, build bits for BFQ-v7r8-3.18.0
Update Kconfig.iosched and do the related Makefile changes to include
kernel configuration options for BFQ. Also add the bfqio controller
@@ -100,5 +100,5 @@ index 98c4f9b..13b010d 100644
SUBSYS(perf_event)
#endif
--
-2.1.3
+2.1.4
diff --git a/5002_block-introduce-the-BFQ-v7r7-I-O-sched-for-3.18.patch1 b/5002_block-introduce-the-BFQ-v7r8-I-O-sched-for-3.18.patch1
similarity index 98%
rename from 5002_block-introduce-the-BFQ-v7r7-I-O-sched-for-3.18.patch1
rename to 5002_block-introduce-the-BFQ-v7r8-I-O-sched-for-3.18.patch1
index dcd10f7..7cf1815 100644
--- a/5002_block-introduce-the-BFQ-v7r7-I-O-sched-for-3.18.patch1
+++ b/5002_block-introduce-the-BFQ-v7r8-I-O-sched-for-3.18.patch1
@@ -1,9 +1,9 @@
-From df04e0bc0d8b72775a74d45e355af9433f8e420e Mon Sep 17 00:00:00 2001
+From 4c8586fb29eb664cb379a179c0f851c693d49ce9 Mon Sep 17 00:00:00 2001
From: Paolo Valente <paolo.valente@unimore.it>
Date: Thu, 9 May 2013 19:10:02 +0200
-Subject: [PATCH 2/3] block: introduce the BFQ-v7r7 I/O sched for 3.18
+Subject: [PATCH 2/3] block: introduce the BFQ-v7r8 I/O sched for 3.18.0
-Add the BFQ-v7r7 I/O scheduler to 3.18.
+Add the BFQ-v7r8 I/O scheduler to 3.18.0.
The general structure is borrowed from CFQ, as much of the code for
handling I/O contexts. Over time, several useful features have been
ported from CFQ as well (details in the changelog in README.BFQ). A
@@ -56,12 +56,12 @@ until it expires.
Signed-off-by: Paolo Valente <paolo.valente@unimore.it>
Signed-off-by: Arianna Avanzini <avanzini.arianna@gmail.com>
---
- block/bfq-cgroup.c | 936 ++++++++++++
+ block/bfq-cgroup.c | 936 +++++++++++++
block/bfq-ioc.c | 36 +
- block/bfq-iosched.c | 3902 +++++++++++++++++++++++++++++++++++++++++++++++++++
- block/bfq-sched.c | 1214 ++++++++++++++++
- block/bfq.h | 775 ++++++++++
- 5 files changed, 6863 insertions(+)
+ block/bfq-iosched.c | 3898 +++++++++++++++++++++++++++++++++++++++++++++++++++
+ block/bfq-sched.c | 1208 ++++++++++++++++
+ block/bfq.h | 771 ++++++++++
+ 5 files changed, 6849 insertions(+)
create mode 100644 block/bfq-cgroup.c
create mode 100644 block/bfq-ioc.c
create mode 100644 block/bfq-iosched.c
@@ -1054,10 +1054,10 @@ index 0000000..7f6b000
+}
diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c
new file mode 100644
-index 0000000..97ee934
+index 0000000..773b2ee
--- /dev/null
+++ b/block/bfq-iosched.c
-@@ -0,0 +1,3902 @@
+@@ -0,0 +1,3898 @@
+/*
+ * Budget Fair Queueing (BFQ) disk scheduler.
+ *
@@ -1130,9 +1130,6 @@ index 0000000..97ee934
+#include "bfq.h"
+#include "blk.h"
+
-+/* Max number of dispatches in one round of service. */
-+static const int bfq_quantum = 4;
-+
+/* Expiration time of sync (0) and async (1) requests, in jiffies. */
+static const int bfq_fifo_expire[2] = { HZ / 4, HZ / 8 };
+
@@ -1240,6 +1237,20 @@ index 0000000..97ee934
+#define bfq_sample_valid(samples) ((samples) > 80)
+
+/*
++ * The following macro groups conditions that need to be evaluated when
++ * checking if existing queues and groups form a symmetric scenario
++ * and therefore idling can be reduced or disabled for some of the
++ * queues. See the comment to the function bfq_bfqq_must_not_expire()
++ * for further details.
++ */
++#ifdef CONFIG_CGROUP_BFQIO
++#define symmetric_scenario (!bfqd->active_numerous_groups && \
++ !bfq_differentiated_weights(bfqd))
++#else
++#define symmetric_scenario (!bfq_differentiated_weights(bfqd))
++#endif
++
++/*
+ * We regard a request as SYNC, if either it's a read or has the SYNC bit
+ * set (in which case it could also be a direct WRITE).
+ */
@@ -1429,7 +1440,6 @@ index 0000000..97ee934
+ */
+static inline bool bfq_differentiated_weights(struct bfq_data *bfqd)
+{
-+ BUG_ON(!bfqd->hw_tag);
+ /*
+ * For weights to differ, at least one of the trees must contain
+ * at least two nodes.
@@ -1466,19 +1476,19 @@ index 0000000..97ee934
+ struct rb_node **new = &(root->rb_node), *parent = NULL;
+
+ /*
-+ * Do not insert if:
-+ * - the device does not support queueing;
-+ * - the entity is already associated with a counter, which happens if:
-+ * 1) the entity is associated with a queue, 2) a request arrival
-+ * has caused the queue to become both non-weight-raised, and hence
-+ * change its weight, and backlogged; in this respect, each
-+ * of the two events causes an invocation of this function,
-+ * 3) this is the invocation of this function caused by the second
-+ * event. This second invocation is actually useless, and we handle
-+ * this fact by exiting immediately. More efficient or clearer
-+ * solutions might possibly be adopted.
++ * Do not insert if the entity is already associated with a
++ * counter, which happens if:
++ * 1) the entity is associated with a queue,
++ * 2) a request arrival has caused the queue to become both
++ * non-weight-raised, and hence change its weight, and
++ * backlogged; in this respect, each of the two events
++ * causes an invocation of this function,
++ * 3) this is the invocation of this function caused by the
++ * second event. This second invocation is actually useless,
++ * and we handle this fact by exiting immediately. More
++ * efficient or clearer solutions might possibly be adopted.
+ */
-+ if (!bfqd->hw_tag || entity->weight_counter)
++ if (entity->weight_counter)
+ return;
+
+ while (*new) {
@@ -1517,14 +1527,6 @@ index 0000000..97ee934
+ struct bfq_entity *entity,
+ struct rb_root *root)
+{
-+ /*
-+ * Check whether the entity is actually associated with a counter.
-+ * In fact, the device may not be considered NCQ-capable for a while,
-+ * which implies that no insertion in the weight trees is performed,
-+ * after which the device may start to be deemed NCQ-capable, and hence
-+ * this function may start to be invoked. This may cause the function
-+ * to be invoked for entities that are not associated with any counter.
-+ */
+ if (!entity->weight_counter)
+ return;
+
@@ -2084,7 +2086,8 @@ index 0000000..97ee934
+ bfq_updated_next_req(bfqd, bfqq);
+ }
+
-+ list_del_init(&rq->queuelist);
++ if (rq->queuelist.prev != &rq->queuelist)
++ list_del_init(&rq->queuelist);
+ BUG_ON(bfqq->queued[sync] == 0);
+ bfqq->queued[sync]--;
+ bfqd->queued--;
@@ -2159,14 +2162,22 @@ index 0000000..97ee934
+static void bfq_merged_requests(struct request_queue *q, struct request *rq,
+ struct request *next)
+{
-+ struct bfq_queue *bfqq = RQ_BFQQ(rq);
++ struct bfq_queue *bfqq = RQ_BFQQ(rq), *next_bfqq = RQ_BFQQ(next);
+
+ /*
-+ * Reposition in fifo if next is older than rq.
++ * If next and rq belong to the same bfq_queue and next is older
++ * than rq, then reposition rq in the fifo (by substituting next
++ * with rq). Otherwise, if next and rq belong to different
++ * bfq_queues, never reposition rq: in fact, we would have to
++ * reposition it with respect to next's position in its own fifo,
++ * which would most certainly be too expensive with respect to
++ * the benefits.
+ */
-+ if (!list_empty(&rq->queuelist) && !list_empty(&next->queuelist) &&
++ if (bfqq == next_bfqq &&
++ !list_empty(&rq->queuelist) && !list_empty(&next->queuelist) &&
+ time_before(next->fifo_time, rq->fifo_time)) {
-+ list_move(&rq->queuelist, &next->queuelist);
++ list_del_init(&rq->queuelist);
++ list_replace_init(&next->queuelist, &rq->queuelist);
+ rq->fifo_time = next->fifo_time;
+ }
+
@@ -2444,14 +2455,16 @@ index 0000000..97ee934
+ */
+ sl = bfqd->bfq_slice_idle;
+ /*
-+ * Unless the queue is being weight-raised, grant only minimum idle
-+ * time if the queue either has been seeky for long enough or has
-+ * already proved to be constantly seeky.
++ * Unless the queue is being weight-raised or the scenario is
++ * asymmetric, grant only minimum idle time if the queue either
++ * has been seeky for long enough or has already proved to be
++ * constantly seeky.
+ */
+ if (bfq_sample_valid(bfqq->seek_samples) &&
+ ((BFQQ_SEEKY(bfqq) && bfqq->entity.service >
+ bfq_max_budget(bfqq->bfqd) / 8) ||
-+ bfq_bfqq_constantly_seeky(bfqq)) && bfqq->wr_coeff == 1)
++ bfq_bfqq_constantly_seeky(bfqq)) && bfqq->wr_coeff == 1 &&
++ symmetric_scenario)
+ sl = min(sl, msecs_to_jiffies(BFQ_MIN_TT));
+ else if (bfqq->wr_coeff > 1)
+ sl = sl * 3;
@@ -3265,12 +3278,6 @@ index 0000000..97ee934
+static inline bool bfq_bfqq_must_not_expire(struct bfq_queue *bfqq)
+{
+ struct bfq_data *bfqd = bfqq->bfqd;
-+#ifdef CONFIG_CGROUP_BFQIO
-+#define symmetric_scenario (!bfqd->active_numerous_groups && \
-+ !bfq_differentiated_weights(bfqd))
-+#else
-+#define symmetric_scenario (!bfq_differentiated_weights(bfqd))
-+#endif
+#define cond_for_seeky_on_ncq_hdd (bfq_bfqq_constantly_seeky(bfqq) && \
+ bfqd->busy_in_flight_queues == \
+ bfqd->const_seeky_busy_in_flight_queues)
@@ -3286,13 +3293,12 @@ index 0000000..97ee934
+ */
+#define cond_for_expiring_non_wr (bfqd->hw_tag && \
+ (bfqd->wr_busy_queues > 0 || \
-+ (symmetric_scenario && \
-+ (blk_queue_nonrot(bfqd->queue) || \
-+ cond_for_seeky_on_ncq_hdd))))
++ (blk_queue_nonrot(bfqd->queue) || \
++ cond_for_seeky_on_ncq_hdd)))
+
+ return bfq_bfqq_sync(bfqq) &&
+ !cond_for_expiring_in_burst &&
-+ (bfqq->wr_coeff > 1 ||
++ (bfqq->wr_coeff > 1 || !symmetric_scenario ||
+ (bfq_bfqq_IO_bound(bfqq) && bfq_bfqq_idle_window(bfqq) &&
+ !cond_for_expiring_non_wr)
+ );
@@ -3390,9 +3396,9 @@ index 0000000..97ee934
+ }
+
+ /*
-+ * No requests pending. If the in-service queue still has requests
-+ * in flight (possibly waiting for a completion) or is idling for a
-+ * new request, then keep it.
++ * No requests pending. However, if the in-service queue is idling
++ * for a new request, or has requests waiting for a completion and
++ * may idle after their completion, then keep it anyway.
+ */
+ if (new_bfqq == NULL && (timer_pending(&bfqd->idle_slice_timer) ||
+ (bfqq->dispatched != 0 && bfq_bfqq_must_not_expire(bfqq)))) {
@@ -3595,14 +3601,13 @@ index 0000000..97ee934
+ if (bfqq == NULL)
+ return 0;
+
-+ max_dispatch = bfqd->bfq_quantum;
+ if (bfq_class_idle(bfqq))
+ max_dispatch = 1;
+
+ if (!bfq_bfqq_sync(bfqq))
+ max_dispatch = bfqd->bfq_max_budget_async_rq;
+
-+ if (bfqq->dispatched >= max_dispatch) {
++ if (!bfq_bfqq_sync(bfqq) && bfqq->dispatched >= max_dispatch) {
+ if (bfqd->busy_queues > 1)
+ return 0;
+ if (bfqq->dispatched >= 4 * max_dispatch)
@@ -3618,8 +3623,8 @@ index 0000000..97ee934
+ if (!bfq_dispatch_request(bfqd, bfqq))
+ return 0;
+
-+ bfq_log_bfqq(bfqd, bfqq, "dispatched one request of %d (max_disp %d)",
-+ bfqq->pid, max_dispatch);
++ bfq_log_bfqq(bfqd, bfqq, "dispatched %s request",
++ bfq_bfqq_sync(bfqq) ? "sync" : "async");
+
+ return 1;
+}
@@ -3724,14 +3729,11 @@ index 0000000..97ee934
+ * Update the entity prio values; note that the new values will not
+ * be used until the next (re)activation.
+ */
-+static void bfq_init_prio_data(struct bfq_queue *bfqq, struct bfq_io_cq *bic)
++static void bfq_set_next_ioprio_data(struct bfq_queue *bfqq, struct bfq_io_cq *bic)
+{
+ struct task_struct *tsk = current;
+ int ioprio_class;
+
-+ if (!bfq_bfqq_prio_changed(bfqq))
-+ return;
-+
+ ioprio_class = IOPRIO_PRIO_CLASS(bic->ioprio);
+ switch (ioprio_class) {
+ default:
@@ -3761,17 +3763,16 @@ index 0000000..97ee934
+
+ if (bfqq->entity.new_ioprio < 0 ||
+ bfqq->entity.new_ioprio >= IOPRIO_BE_NR) {
-+ printk(KERN_CRIT "bfq_init_prio_data: new_ioprio %d\n",
++ printk(KERN_CRIT "bfq_set_next_ioprio_data: new_ioprio %d\n",
+ bfqq->entity.new_ioprio);
+ BUG();
+ }
+
++ bfqq->entity.new_weight = bfq_ioprio_to_weight(bfqq->entity.new_ioprio);
+ bfqq->entity.ioprio_changed = 1;
-+
-+ bfq_clear_bfqq_prio_changed(bfqq);
+}
+
-+static void bfq_changed_ioprio(struct bfq_io_cq *bic)
++static void bfq_check_ioprio_change(struct bfq_io_cq *bic)
+{
+ struct bfq_data *bfqd;
+ struct bfq_queue *bfqq, *new_bfqq;
@@ -3788,6 +3789,8 @@ index 0000000..97ee934
+ if (unlikely(bfqd == NULL) || likely(bic->ioprio == ioprio))
+ goto out;
+
++ bic->ioprio = ioprio;
++
+ bfqq = bic->bfqq[BLK_RW_ASYNC];
+ if (bfqq != NULL) {
+ bfqg = container_of(bfqq->entity.sched_data, struct bfq_group,
@@ -3797,7 +3800,7 @@ index 0000000..97ee934
+ if (new_bfqq != NULL) {
+ bic->bfqq[BLK_RW_ASYNC] = new_bfqq;
+ bfq_log_bfqq(bfqd, bfqq,
-+ "changed_ioprio: bfqq %p %d",
++ "check_ioprio_change: bfqq %p %d",
+ bfqq, atomic_read(&bfqq->ref));
+ bfq_put_queue(bfqq);
+ }
@@ -3805,16 +3808,14 @@ index 0000000..97ee934
+
+ bfqq = bic->bfqq[BLK_RW_SYNC];
+ if (bfqq != NULL)
-+ bfq_mark_bfqq_prio_changed(bfqq);
-+
-+ bic->ioprio = ioprio;
++ bfq_set_next_ioprio_data(bfqq, bic);
+
+out:
+ bfq_put_bfqd_unlock(bfqd, &flags);
+}
+
+static void bfq_init_bfqq(struct bfq_data *bfqd, struct bfq_queue *bfqq,
-+ pid_t pid, int is_sync)
++ struct bfq_io_cq *bic, pid_t pid, int is_sync)
+{
+ RB_CLEAR_NODE(&bfqq->entity.rb_node);
+ INIT_LIST_HEAD(&bfqq->fifo);
@@ -3823,7 +3824,8 @@ index 0000000..97ee934
+ atomic_set(&bfqq->ref, 0);
+ bfqq->bfqd = bfqd;
+
-+ bfq_mark_bfqq_prio_changed(bfqq);
++ if (bic)
++ bfq_set_next_ioprio_data(bfqq, bic);
+
+ if (is_sync) {
+ if (!bfq_class_idle(bfqq))
@@ -3881,8 +3883,8 @@ index 0000000..97ee934
+ }
+
+ if (bfqq != NULL) {
-+ bfq_init_bfqq(bfqd, bfqq, current->pid, is_sync);
-+ bfq_init_prio_data(bfqq, bic);
++ bfq_init_bfqq(bfqd, bfqq, bic, current->pid,
++ is_sync);
+ bfq_init_entity(&bfqq->entity, bfqg);
+ bfq_log_bfqq(bfqd, bfqq, "allocated");
+ } else {
@@ -4120,7 +4122,6 @@ index 0000000..97ee934
+ struct bfq_queue *bfqq = RQ_BFQQ(rq);
+
+ assert_spin_locked(bfqd->queue->queue_lock);
-+ bfq_init_prio_data(bfqq, RQ_BIC(rq));
+
+ bfq_add_request(rq);
+
@@ -4257,11 +4258,8 @@ index 0000000..97ee934
+ return ELV_MQUEUE_MAY;
+
+ bfqq = bic_to_bfqq(bic, rw_is_sync(rw));
-+ if (bfqq != NULL) {
-+ bfq_init_prio_data(bfqq, bic);
-+
++ if (bfqq != NULL)
+ return __bfq_may_queue(bfqq);
-+ }
+
+ return ELV_MQUEUE_MAY;
+}
@@ -4339,7 +4337,7 @@ index 0000000..97ee934
+
+ might_sleep_if(gfp_mask & __GFP_WAIT);
+
-+ bfq_changed_ioprio(bic);
++ bfq_check_ioprio_change(bic);
+
+ spin_lock_irqsave(q->queue_lock, flags);
+
@@ -4543,10 +4541,12 @@ index 0000000..97ee934
+ * Grab a permanent reference to it, so that the normal code flow
+ * will not attempt to free it.
+ */
-+ bfq_init_bfqq(bfqd, &bfqd->oom_bfqq, 1, 0);
++ bfq_init_bfqq(bfqd, &bfqd->oom_bfqq, NULL, 1, 0);
+ atomic_inc(&bfqd->oom_bfqq.ref);
+ bfqd->oom_bfqq.entity.new_ioprio = BFQ_DEFAULT_QUEUE_IOPRIO;
+ bfqd->oom_bfqq.entity.new_ioprio_class = IOPRIO_CLASS_BE;
++ bfqd->oom_bfqq.entity.new_weight =
++ bfq_ioprio_to_weight(bfqd->oom_bfqq.entity.new_ioprio);
+ /*
+ * Trigger weight initialization, according to ioprio, at the
+ * oom_bfqq's first activation. The oom_bfqq's ioprio and ioprio
@@ -4591,7 +4591,6 @@ index 0000000..97ee934
+
+ bfqd->bfq_max_budget = bfq_default_max_budget;
+
-+ bfqd->bfq_quantum = bfq_quantum;
+ bfqd->bfq_fifo_expire[0] = bfq_fifo_expire[0];
+ bfqd->bfq_fifo_expire[1] = bfq_fifo_expire[1];
+ bfqd->bfq_back_max = bfq_back_max;
@@ -4725,7 +4724,6 @@ index 0000000..97ee934
+ __data = jiffies_to_msecs(__data); \
+ return bfq_var_show(__data, (page)); \
+}
-+SHOW_FUNCTION(bfq_quantum_show, bfqd->bfq_quantum, 0);
+SHOW_FUNCTION(bfq_fifo_expire_sync_show, bfqd->bfq_fifo_expire[1], 1);
+SHOW_FUNCTION(bfq_fifo_expire_async_show, bfqd->bfq_fifo_expire[0], 1);
+SHOW_FUNCTION(bfq_back_seek_max_show, bfqd->bfq_back_max, 0);
@@ -4762,7 +4760,6 @@ index 0000000..97ee934
+ *(__PTR) = __data; \
+ return ret; \
+}
-+STORE_FUNCTION(bfq_quantum_store, &bfqd->bfq_quantum, 1, INT_MAX, 0);
+STORE_FUNCTION(bfq_fifo_expire_sync_store, &bfqd->bfq_fifo_expire[1], 1,
+ INT_MAX, 1);
+STORE_FUNCTION(bfq_fifo_expire_async_store, &bfqd->bfq_fifo_expire[0], 1,
@@ -4863,7 +4860,6 @@ index 0000000..97ee934
+ __ATTR(name, S_IRUGO|S_IWUSR, bfq_##name##_show, bfq_##name##_store)
+
+static struct elv_fs_entry bfq_attrs[] = {
-+ BFQ_ATTR(quantum),
+ BFQ_ATTR(fifo_expire_sync),
+ BFQ_ATTR(fifo_expire_async),
+ BFQ_ATTR(back_seek_max),
@@ -4944,7 +4940,7 @@ index 0000000..97ee934
+ device_speed_thresh[1] = (R_fast[1] + R_slow[1]) / 2;
+
+ elv_register(&iosched_bfq);
-+ pr_info("BFQ I/O-scheduler version: v7r7");
++ pr_info("BFQ I/O-scheduler: v7r8");
+
+ return 0;
+}
@@ -4962,10 +4958,10 @@ index 0000000..97ee934
+MODULE_LICENSE("GPL");
diff --git a/block/bfq-sched.c b/block/bfq-sched.c
new file mode 100644
-index 0000000..2931563
+index 0000000..c343099
--- /dev/null
+++ b/block/bfq-sched.c
-@@ -0,0 +1,1214 @@
+@@ -0,0 +1,1208 @@
+/*
+ * BFQ: Hierarchical B-WF2Q+ scheduler.
+ *
@@ -5604,13 +5600,7 @@ index 0000000..2931563
+ entity->orig_weight = entity->new_weight;
+ entity->ioprio =
+ bfq_weight_to_ioprio(entity->orig_weight);
-+ } else if (entity->new_ioprio != entity->ioprio) {
-+ entity->ioprio = entity->new_ioprio;
-+ entity->orig_weight =
-+ bfq_ioprio_to_weight(entity->ioprio);
-+ } else
-+ entity->new_weight = entity->orig_weight =
-+ bfq_ioprio_to_weight(entity->ioprio);
++ }
+
+ entity->ioprio_class = entity->new_ioprio_class;
+ entity->ioprio_changed = 0;
@@ -6182,12 +6172,12 @@ index 0000000..2931563
+}
diff --git a/block/bfq.h b/block/bfq.h
new file mode 100644
-index 0000000..649afe9
+index 0000000..3173b35
--- /dev/null
+++ b/block/bfq.h
-@@ -0,0 +1,775 @@
+@@ -0,0 +1,771 @@
+/*
-+ * BFQ-v7r7 for 3.18.0: data structures and common functions prototypes.
++ * BFQ-v7r8 for 3.18.0: data structures and common functions prototypes.
+ *
+ * Based on ideas and code from CFQ:
+ * Copyright (C) 2003 Jens Axboe <axboe@kernel.dk>
@@ -6573,7 +6563,6 @@ index 0000000..649afe9
+ * @group_list: list of all the bfq_groups active on the device.
+ * @active_list: list of all the bfq_queues active on the device.
+ * @idle_list: list of all the bfq_queues idle on the device.
-+ * @bfq_quantum: max number of requests dispatched per dispatch round.
+ * @bfq_fifo_expire: timeout for async/sync requests; when it expires
+ * requests are served in fifo order.
+ * @bfq_back_penalty: weight of backward seeks wrt forward ones.
@@ -6681,7 +6670,6 @@ index 0000000..649afe9
+ struct list_head active_list;
+ struct list_head idle_list;
+
-+ unsigned int bfq_quantum;
+ unsigned int bfq_fifo_expire[2];
+ unsigned int bfq_back_penalty;
+ unsigned int bfq_back_max;
@@ -6724,7 +6712,6 @@ index 0000000..649afe9
+ BFQ_BFQQ_FLAG_must_alloc, /* must be allowed rq alloc */
+ BFQ_BFQQ_FLAG_fifo_expire, /* FIFO checked in this slice */
+ BFQ_BFQQ_FLAG_idle_window, /* slice idling enabled */
-+ BFQ_BFQQ_FLAG_prio_changed, /* task priority has changed */
+ BFQ_BFQQ_FLAG_sync, /* synchronous queue */
+ BFQ_BFQQ_FLAG_budget_new, /* no completion with this budget */
+ BFQ_BFQQ_FLAG_IO_bound, /*
@@ -6767,7 +6754,6 @@ index 0000000..649afe9
+BFQ_BFQQ_FNS(must_alloc);
+BFQ_BFQQ_FNS(fifo_expire);
+BFQ_BFQQ_FNS(idle_window);
-+BFQ_BFQQ_FNS(prio_changed);
+BFQ_BFQQ_FNS(sync);
+BFQ_BFQQ_FNS(budget_new);
+BFQ_BFQQ_FNS(IO_bound);
@@ -6949,7 +6935,7 @@ index 0000000..649afe9
+ spin_unlock_irqrestore(bfqd->queue->queue_lock, *flags);
+}
+
-+static void bfq_changed_ioprio(struct bfq_io_cq *bic);
++static void bfq_check_ioprio_change(struct bfq_io_cq *bic);
+static void bfq_put_queue(struct bfq_queue *bfqq);
+static void bfq_dispatch_insert(struct request_queue *q, struct request *rq);
+static struct bfq_queue *bfq_get_queue(struct bfq_data *bfqd,
@@ -6962,5 +6948,5 @@ index 0000000..649afe9
+
+#endif /* _BFQ_H */
--
-2.1.3
+2.1.4
diff --git a/5003_block-bfq-add-Early-Queue-Merge-EQM-to-BFQ-v7r7-for-3.18.0.patch b/5003_block-bfq-add-Early-Queue-Merge-EQM-to-BFQ-v7r8-for-3.18.patch
similarity index 94%
rename from 5003_block-bfq-add-Early-Queue-Merge-EQM-to-BFQ-v7r7-for-3.18.0.patch
rename to 5003_block-bfq-add-Early-Queue-Merge-EQM-to-BFQ-v7r8-for-3.18.patch
index 1292c2b..121fb5d 100644
--- a/5003_block-bfq-add-Early-Queue-Merge-EQM-to-BFQ-v7r7-for-3.18.0.patch
+++ b/5003_block-bfq-add-Early-Queue-Merge-EQM-to-BFQ-v7r8-for-3.18.patch
@@ -1,7 +1,7 @@
-From b941be79912544b39141eff175bc1964568a5b1b Mon Sep 17 00:00:00 2001
+From 957b7799fa08de8a84561c7c3299c05b695bb19d Mon Sep 17 00:00:00 2001
From: Mauro Andreolini <mauro.andreolini@unimore.it>
-Date: Thu, 18 Dec 2014 21:32:08 +0100
-Subject: [PATCH 3/3] block, bfq: add Early Queue Merge (EQM) to BFQ-v7r7 for
+Date: Fri, 5 Jun 2015 17:45:40 +0200
+Subject: [PATCH 3/3] block, bfq: add Early Queue Merge (EQM) to BFQ-v7r8 for
3.18.0
A set of processes may happen to perform interleaved reads, i.e.,requests
@@ -34,16 +34,16 @@ Signed-off-by: Mauro Andreolini <mauro.andreolini@unimore.it>
Signed-off-by: Arianna Avanzini <avanzini.arianna@gmail.com>
Signed-off-by: Paolo Valente <paolo.valente@unimore.it>
---
- block/bfq-iosched.c | 751 +++++++++++++++++++++++++++++++++++++---------------
+ block/bfq-iosched.c | 750 +++++++++++++++++++++++++++++++++++++---------------
block/bfq-sched.c | 28 --
block/bfq.h | 54 +++-
- 3 files changed, 581 insertions(+), 252 deletions(-)
+ 3 files changed, 580 insertions(+), 252 deletions(-)
diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c
-index 97ee934..328f33c 100644
+index 773b2ee..71b51c1 100644
--- a/block/bfq-iosched.c
+++ b/block/bfq-iosched.c
-@@ -571,6 +571,57 @@ static inline unsigned int bfq_wr_duration(struct bfq_data *bfqd)
+@@ -573,6 +573,57 @@ static inline unsigned int bfq_wr_duration(struct bfq_data *bfqd)
return dur;
}
@@ -101,7 +101,7 @@ index 97ee934..328f33c 100644
/* Empty burst list and add just bfqq (see comments to bfq_handle_burst) */
static inline void bfq_reset_burst_list(struct bfq_data *bfqd,
struct bfq_queue *bfqq)
-@@ -815,7 +866,7 @@ static void bfq_add_request(struct request *rq)
+@@ -817,7 +868,7 @@ static void bfq_add_request(struct request *rq)
bfq_rq_pos_tree_add(bfqd, bfqq);
if (!bfq_bfqq_busy(bfqq)) {
@@ -110,7 +110,7 @@ index 97ee934..328f33c 100644
idle_for_long_time = time_is_before_jiffies(
bfqq->budget_timeout +
bfqd->bfq_wr_min_idle_time);
-@@ -839,11 +890,12 @@ static void bfq_add_request(struct request *rq)
+@@ -841,11 +892,12 @@ static void bfq_add_request(struct request *rq)
bfqd->last_ins_in_burst = jiffies;
}
@@ -126,7 +126,7 @@ index 97ee934..328f33c 100644
entity->budget = max_t(unsigned long, bfqq->max_budget,
bfq_serv_to_charge(next_rq, bfqq));
-@@ -862,11 +914,20 @@ static void bfq_add_request(struct request *rq)
+@@ -864,11 +916,20 @@ static void bfq_add_request(struct request *rq)
if (!bfqd->low_latency)
goto add_bfqq_busy;
@@ -150,7 +150,7 @@ index 97ee934..328f33c 100644
bfqq->wr_coeff = bfqd->bfq_wr_coeff;
if (interactive)
bfqq->wr_cur_max_time = bfq_wr_duration(bfqd);
-@@ -880,7 +941,7 @@ static void bfq_add_request(struct request *rq)
+@@ -882,7 +943,7 @@ static void bfq_add_request(struct request *rq)
} else if (old_wr_coeff > 1) {
if (interactive)
bfqq->wr_cur_max_time = bfq_wr_duration(bfqd);
@@ -159,7 +159,7 @@ index 97ee934..328f33c 100644
(bfqq->wr_cur_max_time ==
bfqd->bfq_wr_rt_max_time &&
!soft_rt)) {
-@@ -899,18 +960,18 @@ static void bfq_add_request(struct request *rq)
+@@ -901,18 +962,18 @@ static void bfq_add_request(struct request *rq)
/*
*
* The remaining weight-raising time is lower
@@ -190,7 +190,7 @@ index 97ee934..328f33c 100644
*
* In addition, the application is now meeting
* the requirements for being deemed soft rt.
-@@ -945,6 +1006,7 @@ static void bfq_add_request(struct request *rq)
+@@ -947,6 +1008,7 @@ static void bfq_add_request(struct request *rq)
bfqd->bfq_wr_rt_max_time;
}
}
@@ -198,7 +198,7 @@ index 97ee934..328f33c 100644
if (old_wr_coeff != bfqq->wr_coeff)
entity->ioprio_changed = 1;
add_bfqq_busy:
-@@ -1156,90 +1218,35 @@ static void bfq_end_wr(struct bfq_data *bfqd)
+@@ -1167,90 +1229,35 @@ static void bfq_end_wr(struct bfq_data *bfqd)
spin_unlock_irq(bfqd->queue->queue_lock);
}
@@ -303,7 +303,7 @@ index 97ee934..328f33c 100644
if (RB_EMPTY_ROOT(root))
return NULL;
-@@ -1258,7 +1265,7 @@ static struct bfq_queue *bfqq_close(struct bfq_data *bfqd)
+@@ -1269,7 +1276,7 @@ static struct bfq_queue *bfqq_close(struct bfq_data *bfqd)
* next_request position).
*/
__bfqq = rb_entry(parent, struct bfq_queue, pos_node);
@@ -312,7 +312,7 @@ index 97ee934..328f33c 100644
return __bfqq;
if (blk_rq_pos(__bfqq->next_rq) < sector)
-@@ -1269,7 +1276,7 @@ static struct bfq_queue *bfqq_close(struct bfq_data *bfqd)
+@@ -1280,7 +1287,7 @@ static struct bfq_queue *bfqq_close(struct bfq_data *bfqd)
return NULL;
__bfqq = rb_entry(node, struct bfq_queue, pos_node);
@@ -321,7 +321,7 @@ index 97ee934..328f33c 100644
return __bfqq;
return NULL;
-@@ -1278,14 +1285,12 @@ static struct bfq_queue *bfqq_close(struct bfq_data *bfqd)
+@@ -1289,14 +1296,12 @@ static struct bfq_queue *bfqq_close(struct bfq_data *bfqd)
/*
* bfqd - obvious
* cur_bfqq - passed in so that we don't decide that the current queue
@@ -340,7 +340,7 @@ index 97ee934..328f33c 100644
{
struct bfq_queue *bfqq;
-@@ -1305,7 +1310,7 @@ static struct bfq_queue *bfq_close_cooperator(struct bfq_data *bfqd,
+@@ -1316,7 +1321,7 @@ static struct bfq_queue *bfq_close_cooperator(struct bfq_data *bfqd,
* working closely on the same area of the disk. In that case,
* we can group them together and don't waste time idling.
*/
@@ -349,7 +349,7 @@ index 97ee934..328f33c 100644
if (bfqq == NULL || bfqq == cur_bfqq)
return NULL;
-@@ -1332,6 +1337,315 @@ static struct bfq_queue *bfq_close_cooperator(struct bfq_data *bfqd,
+@@ -1343,6 +1348,315 @@ static struct bfq_queue *bfq_close_cooperator(struct bfq_data *bfqd,
return bfqq;
}
@@ -665,7 +665,7 @@ index 97ee934..328f33c 100644
/*
* If enough samples have been computed, return the current max budget
* stored in bfqd, which is dynamically updated according to the
-@@ -1475,61 +1789,6 @@ static struct request *bfq_check_fifo(struct bfq_queue *bfqq)
+@@ -1488,61 +1802,6 @@ static struct request *bfq_check_fifo(struct bfq_queue *bfqq)
return rq;
}
@@ -727,7 +727,7 @@ index 97ee934..328f33c 100644
static inline unsigned long bfq_bfqq_budget_left(struct bfq_queue *bfqq)
{
struct bfq_entity *entity = &bfqq->entity;
-@@ -2263,7 +2522,7 @@ static inline bool bfq_bfqq_must_idle(struct bfq_queue *bfqq)
+@@ -2269,7 +2528,7 @@ static inline bool bfq_bfqq_must_idle(struct bfq_queue *bfqq)
*/
static struct bfq_queue *bfq_select_queue(struct bfq_data *bfqd)
{
@@ -736,7 +736,7 @@ index 97ee934..328f33c 100644
struct request *next_rq;
enum bfqq_expiration reason = BFQ_BFQQ_BUDGET_TIMEOUT;
-@@ -2273,17 +2532,6 @@ static struct bfq_queue *bfq_select_queue(struct bfq_data *bfqd)
+@@ -2279,17 +2538,6 @@ static struct bfq_queue *bfq_select_queue(struct bfq_data *bfqd)
bfq_log_bfqq(bfqd, bfqq, "select_queue: already in-service queue");
@@ -754,7 +754,7 @@ index 97ee934..328f33c 100644
if (bfq_may_expire_for_budg_timeout(bfqq) &&
!timer_pending(&bfqd->idle_slice_timer) &&
!bfq_bfqq_must_idle(bfqq))
-@@ -2322,10 +2570,7 @@ static struct bfq_queue *bfq_select_queue(struct bfq_data *bfqd)
+@@ -2328,10 +2576,7 @@ static struct bfq_queue *bfq_select_queue(struct bfq_data *bfqd)
bfq_clear_bfqq_wait_request(bfqq);
del_timer(&bfqd->idle_slice_timer);
}
@@ -766,9 +766,9 @@ index 97ee934..328f33c 100644
}
}
-@@ -2334,40 +2579,30 @@ static struct bfq_queue *bfq_select_queue(struct bfq_data *bfqd)
- * in flight (possibly waiting for a completion) or is idling for a
- * new request, then keep it.
+@@ -2340,40 +2585,30 @@ static struct bfq_queue *bfq_select_queue(struct bfq_data *bfqd)
+ * for a new request, or has requests waiting for a completion and
+ * may idle after their completion, then keep it anyway.
*/
- if (new_bfqq == NULL && (timer_pending(&bfqd->idle_slice_timer) ||
- (bfqq->dispatched != 0 && bfq_bfqq_must_not_expire(bfqq)))) {
@@ -814,7 +814,7 @@ index 97ee934..328f33c 100644
jiffies_to_msecs(bfqq->wr_cur_max_time),
bfqq->wr_coeff,
bfqq->entity.weight, bfqq->entity.orig_weight);
-@@ -2376,12 +2611,16 @@ static void bfq_update_wr_data(struct bfq_data *bfqd,
+@@ -2382,12 +2617,16 @@ static void bfq_update_wr_data(struct bfq_data *bfqd,
entity->orig_weight * bfqq->wr_coeff);
if (entity->ioprio_changed)
bfq_log_bfqq(bfqd, bfqq, "WARN: pending prio change");
@@ -832,7 +832,7 @@ index 97ee934..328f33c 100644
time_is_before_jiffies(bfqq->last_wr_start_finish +
bfqq->wr_cur_max_time)) {
bfqq->last_wr_start_finish = jiffies;
-@@ -2390,11 +2629,13 @@ static void bfq_update_wr_data(struct bfq_data *bfqd,
+@@ -2396,11 +2635,13 @@ static void bfq_update_wr_data(struct bfq_data *bfqd,
bfqq->last_wr_start_finish,
jiffies_to_msecs(bfqq->wr_cur_max_time));
bfq_bfqq_end_wr(bfqq);
@@ -849,7 +849,7 @@ index 97ee934..328f33c 100644
}
/*
-@@ -2642,6 +2883,25 @@ static inline void bfq_init_icq(struct io_cq *icq)
+@@ -2647,6 +2888,25 @@ static inline void bfq_init_icq(struct io_cq *icq)
struct bfq_io_cq *bic = icq_to_bic(icq);
bic->ttime.last_end_request = jiffies;
@@ -875,7 +875,7 @@ index 97ee934..328f33c 100644
}
static void bfq_exit_icq(struct io_cq *icq)
-@@ -2655,6 +2915,13 @@ static void bfq_exit_icq(struct io_cq *icq)
+@@ -2660,6 +2920,13 @@ static void bfq_exit_icq(struct io_cq *icq)
}
if (bic->bfqq[BLK_RW_SYNC]) {
@@ -889,7 +889,7 @@ index 97ee934..328f33c 100644
bfq_exit_bfqq(bfqd, bic->bfqq[BLK_RW_SYNC]);
bic->bfqq[BLK_RW_SYNC] = NULL;
}
-@@ -2950,6 +3217,10 @@ static void bfq_update_idle_window(struct bfq_data *bfqd,
+@@ -2952,6 +3219,10 @@ static void bfq_update_idle_window(struct bfq_data *bfqd,
if (!bfq_bfqq_sync(bfqq) || bfq_class_idle(bfqq))
return;
@@ -900,7 +900,7 @@ index 97ee934..328f33c 100644
enable_idle = bfq_bfqq_idle_window(bfqq);
if (atomic_read(&bic->icq.ioc->active_ref) == 0 ||
-@@ -2997,6 +3268,7 @@ static void bfq_rq_enqueued(struct bfq_data *bfqd, struct bfq_queue *bfqq,
+@@ -2999,6 +3270,7 @@ static void bfq_rq_enqueued(struct bfq_data *bfqd, struct bfq_queue *bfqq,
if (bfqq->entity.service > bfq_max_budget(bfqd) / 8 ||
!BFQQ_SEEKY(bfqq))
bfq_update_idle_window(bfqd, bfqq, bic);
@@ -908,7 +908,7 @@ index 97ee934..328f33c 100644
bfq_log_bfqq(bfqd, bfqq,
"rq_enqueued: idle_window=%d (seeky %d, mean %llu)",
-@@ -3057,13 +3329,49 @@ static void bfq_rq_enqueued(struct bfq_data *bfqd, struct bfq_queue *bfqq,
+@@ -3059,12 +3331,47 @@ static void bfq_rq_enqueued(struct bfq_data *bfqd, struct bfq_queue *bfqq,
static void bfq_insert_request(struct request_queue *q, struct request *rq)
{
struct bfq_data *bfqd = q->elevator->elevator_data;
@@ -916,7 +916,7 @@ index 97ee934..328f33c 100644
+ struct bfq_queue *bfqq = RQ_BFQQ(rq), *new_bfqq;
assert_spin_locked(bfqd->queue->queue_lock);
-+
+
+ /*
+ * An unplug may trigger a requeue of a request from the device
+ * driver: make sure we are in process context while trying to
@@ -944,8 +944,6 @@ index 97ee934..328f33c 100644
+ bfq_bfqq_increase_failed_cooperations(bfqq);
+ }
+
- bfq_init_prio_data(bfqq, RQ_BIC(rq));
-
bfq_add_request(rq);
+ /*
@@ -959,7 +957,7 @@ index 97ee934..328f33c 100644
rq->fifo_time = jiffies + bfqd->bfq_fifo_expire[rq_is_sync(rq)];
list_add_tail(&rq->queuelist, &bfqq->fifo);
-@@ -3228,18 +3536,6 @@ static void bfq_put_request(struct request *rq)
+@@ -3226,18 +3533,6 @@ static void bfq_put_request(struct request *rq)
}
}
@@ -978,7 +976,7 @@ index 97ee934..328f33c 100644
/*
* Returns NULL if a new bfqq should be allocated, or the old bfqq if this
* was the last process referring to said bfqq.
-@@ -3248,6 +3544,9 @@ static struct bfq_queue *
+@@ -3246,6 +3541,9 @@ static struct bfq_queue *
bfq_split_bfqq(struct bfq_io_cq *bic, struct bfq_queue *bfqq)
{
bfq_log_bfqq(bfqq->bfqd, bfqq, "splitting queue");
@@ -988,7 +986,7 @@ index 97ee934..328f33c 100644
if (bfqq_process_refs(bfqq) == 1) {
bfqq->pid = current->pid;
bfq_clear_bfqq_coop(bfqq);
-@@ -3276,6 +3575,7 @@ static int bfq_set_request(struct request_queue *q, struct request *rq,
+@@ -3274,6 +3572,7 @@ static int bfq_set_request(struct request_queue *q, struct request *rq,
struct bfq_queue *bfqq;
struct bfq_group *bfqg;
unsigned long flags;
@@ -996,7 +994,7 @@ index 97ee934..328f33c 100644
might_sleep_if(gfp_mask & __GFP_WAIT);
-@@ -3293,25 +3593,26 @@ new_queue:
+@@ -3291,25 +3590,26 @@ new_queue:
if (bfqq == NULL || bfqq == &bfqd->oom_bfqq) {
bfqq = bfq_get_queue(bfqd, bfqg, is_sync, bic, gfp_mask);
bic_set_bfqq(bic, bfqq, is_sync);
@@ -1035,7 +1033,7 @@ index 97ee934..328f33c 100644
}
bfqq->allocated[rw]++;
-@@ -3322,6 +3623,26 @@ new_queue:
+@@ -3320,6 +3620,26 @@ new_queue:
rq->elv.priv[0] = bic;
rq->elv.priv[1] = bfqq;
@@ -1063,10 +1061,10 @@ index 97ee934..328f33c 100644
return 0;
diff --git a/block/bfq-sched.c b/block/bfq-sched.c
-index 2931563..6764a7e 100644
+index c343099..d0890c6 100644
--- a/block/bfq-sched.c
+++ b/block/bfq-sched.c
-@@ -1091,34 +1091,6 @@ static struct bfq_queue *bfq_get_next_queue(struct bfq_data *bfqd)
+@@ -1085,34 +1085,6 @@ static struct bfq_queue *bfq_get_next_queue(struct bfq_data *bfqd)
return bfqq;
}
@@ -1102,7 +1100,7 @@ index 2931563..6764a7e 100644
{
if (bfqd->in_service_bic != NULL) {
diff --git a/block/bfq.h b/block/bfq.h
-index 649afe9..0767d75 100644
+index 3173b35..629c413 100644
--- a/block/bfq.h
+++ b/block/bfq.h
@@ -218,18 +218,21 @@ struct bfq_group;
@@ -1184,8 +1182,8 @@ index 649afe9..0767d75 100644
};
enum bfq_device_speed {
-@@ -539,7 +573,7 @@ enum bfqq_state_flags {
- BFQ_BFQQ_FLAG_prio_changed, /* task priority has changed */
+@@ -536,7 +570,7 @@ enum bfqq_state_flags {
+ BFQ_BFQQ_FLAG_idle_window, /* slice idling enabled */
BFQ_BFQQ_FLAG_sync, /* synchronous queue */
BFQ_BFQQ_FLAG_budget_new, /* no completion with this budget */
- BFQ_BFQQ_FLAG_IO_bound, /*
@@ -1193,7 +1191,7 @@ index 649afe9..0767d75 100644
* bfqq has timed-out at least once
* having consumed at most 2/10 of
* its budget
-@@ -552,12 +586,13 @@ enum bfqq_state_flags {
+@@ -549,12 +583,13 @@ enum bfqq_state_flags {
* bfqq has proved to be slow and
* seeky until budget timeout
*/
@@ -1209,7 +1207,7 @@ index 649afe9..0767d75 100644
};
#define BFQ_BFQQ_FNS(name) \
-@@ -587,6 +622,7 @@ BFQ_BFQQ_FNS(in_large_burst);
+@@ -583,6 +618,7 @@ BFQ_BFQQ_FNS(in_large_burst);
BFQ_BFQQ_FNS(constantly_seeky);
BFQ_BFQQ_FNS(coop);
BFQ_BFQQ_FNS(split_coop);
@@ -1218,5 +1216,5 @@ index 649afe9..0767d75 100644
#undef BFQ_BFQQ_FNS
--
-2.1.3
+2.1.4
^ permalink raw reply related [flat|nested] 67+ messages in thread
* [gentoo-commits] proj/linux-patches:3.18 commit in: /
@ 2015-08-21 12:57 Mike Pagano
0 siblings, 0 replies; 67+ messages in thread
From: Mike Pagano @ 2015-08-21 12:57 UTC (permalink / raw
To: gentoo-commits
commit: 8fec14cd594bb552643f75756d5c9d13b0a9c0eb
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Fri Aug 21 12:57:03 2015 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Fri Aug 21 12:57:03 2015 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=8fec14cd
Linux patch 3.18.20
0000_README | 4 +
1019_linux-3.18.20.patch | 1847 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 1851 insertions(+)
diff --git a/0000_README b/0000_README
index 21802d2..78fbad8 100644
--- a/0000_README
+++ b/0000_README
@@ -119,6 +119,10 @@ Patch: 1018_linux-3.18.19.patch
From: http://www.kernel.org
Desc: Linux 3.18.19
+Patch: 1019_linux-3.18.20.patch
+From: http://www.kernel.org
+Desc: Linux 3.18.20
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1019_linux-3.18.20.patch b/1019_linux-3.18.20.patch
new file mode 100644
index 0000000..7f76c65
--- /dev/null
+++ b/1019_linux-3.18.20.patch
@@ -0,0 +1,1847 @@
+diff --git a/Documentation/devicetree/bindings/spi/spi_pl022.txt b/Documentation/devicetree/bindings/spi/spi_pl022.txt
+index 22ed6797216d..4d1673ca8cf8 100644
+--- a/Documentation/devicetree/bindings/spi/spi_pl022.txt
++++ b/Documentation/devicetree/bindings/spi/spi_pl022.txt
+@@ -4,9 +4,9 @@ Required properties:
+ - compatible : "arm,pl022", "arm,primecell"
+ - reg : Offset and length of the register set for the device
+ - interrupts : Should contain SPI controller interrupt
++- num-cs : total number of chipselects
+
+ Optional properties:
+-- num-cs : total number of chipselects
+ - cs-gpios : should specify GPIOs used for chipselects.
+ The gpios will be referred to as reg = <index> in the SPI child nodes.
+ If unspecified, a single SPI device without a chip select can be used.
+diff --git a/Makefile b/Makefile
+index eab97c3d462d..3ef589539cca 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 18
+-SUBLEVEL = 19
++SUBLEVEL = 20
+ EXTRAVERSION =
+ NAME = Diseased Newt
+
+diff --git a/arch/arm64/mm/hugetlbpage.c b/arch/arm64/mm/hugetlbpage.c
+index 2de9d2e59d96..0eeb4f0930a0 100644
+--- a/arch/arm64/mm/hugetlbpage.c
++++ b/arch/arm64/mm/hugetlbpage.c
+@@ -40,13 +40,13 @@ int huge_pmd_unshare(struct mm_struct *mm, unsigned long *addr, pte_t *ptep)
+
+ int pmd_huge(pmd_t pmd)
+ {
+- return !(pmd_val(pmd) & PMD_TABLE_BIT);
++ return pmd_val(pmd) && !(pmd_val(pmd) & PMD_TABLE_BIT);
+ }
+
+ int pud_huge(pud_t pud)
+ {
+ #ifndef __PAGETABLE_PMD_FOLDED
+- return !(pud_val(pud) & PUD_TABLE_BIT);
++ return pud_val(pud) && !(pud_val(pud) & PUD_TABLE_BIT);
+ #else
+ return 0;
+ #endif
+diff --git a/block/blk-mq.c b/block/blk-mq.c
+index 849479debac3..691959ecb80f 100644
+--- a/block/blk-mq.c
++++ b/block/blk-mq.c
+@@ -1473,22 +1473,6 @@ static int blk_mq_hctx_cpu_offline(struct blk_mq_hw_ctx *hctx, int cpu)
+ return NOTIFY_OK;
+ }
+
+-static int blk_mq_hctx_cpu_online(struct blk_mq_hw_ctx *hctx, int cpu)
+-{
+- struct request_queue *q = hctx->queue;
+- struct blk_mq_tag_set *set = q->tag_set;
+-
+- if (set->tags[hctx->queue_num])
+- return NOTIFY_OK;
+-
+- set->tags[hctx->queue_num] = blk_mq_init_rq_map(set, hctx->queue_num);
+- if (!set->tags[hctx->queue_num])
+- return NOTIFY_STOP;
+-
+- hctx->tags = set->tags[hctx->queue_num];
+- return NOTIFY_OK;
+-}
+-
+ static int blk_mq_hctx_notify(void *data, unsigned long action,
+ unsigned int cpu)
+ {
+@@ -1496,8 +1480,11 @@ static int blk_mq_hctx_notify(void *data, unsigned long action,
+
+ if (action == CPU_DEAD || action == CPU_DEAD_FROZEN)
+ return blk_mq_hctx_cpu_offline(hctx, cpu);
+- else if (action == CPU_ONLINE || action == CPU_ONLINE_FROZEN)
+- return blk_mq_hctx_cpu_online(hctx, cpu);
++
++ /*
++ * In case of CPU online, tags may be reallocated
++ * in blk_mq_map_swqueue() after mapping is updated.
++ */
+
+ return NOTIFY_OK;
+ }
+@@ -1682,6 +1669,7 @@ static void blk_mq_map_swqueue(struct request_queue *q)
+ unsigned int i;
+ struct blk_mq_hw_ctx *hctx;
+ struct blk_mq_ctx *ctx;
++ struct blk_mq_tag_set *set = q->tag_set;
+
+ queue_for_each_hw_ctx(q, hctx, i) {
+ cpumask_clear(hctx->cpumask);
+@@ -1708,16 +1696,20 @@ static void blk_mq_map_swqueue(struct request_queue *q)
+ * disable it and free the request entries.
+ */
+ if (!hctx->nr_ctx) {
+- struct blk_mq_tag_set *set = q->tag_set;
+-
+ if (set->tags[i]) {
+ blk_mq_free_rq_map(set, set->tags[i], i);
+ set->tags[i] = NULL;
+- hctx->tags = NULL;
+ }
++ hctx->tags = NULL;
+ continue;
+ }
+
++ /* unmapped hw queue can be remapped after CPU topo changed */
++ if (!set->tags[i])
++ set->tags[i] = blk_mq_init_rq_map(set, i);
++ hctx->tags = set->tags[i];
++ WARN_ON(!hctx->tags);
++
+ /*
+ * Initialize batch roundrobin counts
+ */
+diff --git a/drivers/acpi/acpica/utxfinit.c b/drivers/acpi/acpica/utxfinit.c
+index 13380d818462..64f8f307243b 100644
+--- a/drivers/acpi/acpica/utxfinit.c
++++ b/drivers/acpi/acpica/utxfinit.c
+@@ -175,10 +175,12 @@ acpi_status __init acpi_enable_subsystem(u32 flags)
+ * Obtain a permanent mapping for the FACS. This is required for the
+ * Global Lock and the Firmware Waking Vector
+ */
+- status = acpi_tb_initialize_facs();
+- if (ACPI_FAILURE(status)) {
+- ACPI_WARNING((AE_INFO, "Could not map the FACS table"));
+- return_ACPI_STATUS(status);
++ if (!(flags & ACPI_NO_FACS_INIT)) {
++ status = acpi_tb_initialize_facs();
++ if (ACPI_FAILURE(status)) {
++ ACPI_WARNING((AE_INFO, "Could not map the FACS table"));
++ return_ACPI_STATUS(status);
++ }
+ }
+ #endif /* !ACPI_REDUCED_HARDWARE */
+
+diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
+index 64af3bf2b4c7..98dc0dc605bc 100644
+--- a/drivers/ata/libata-core.c
++++ b/drivers/ata/libata-core.c
+@@ -4174,9 +4174,10 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
+ { "ST3320[68]13AS", "SD1[5-9]", ATA_HORKAGE_NONCQ |
+ ATA_HORKAGE_FIRMWARE_WARN },
+
+- /* Seagate Momentus SpinPoint M8 seem to have FPMDA_AA issues */
++ /* drives which fail FPDMA_AA activation (some may freeze afterwards) */
+ { "ST1000LM024 HN-M101MBB", "2AR10001", ATA_HORKAGE_BROKEN_FPDMA_AA },
+ { "ST1000LM024 HN-M101MBB", "2BA30001", ATA_HORKAGE_BROKEN_FPDMA_AA },
++ { "VB0250EAVER", "HPG7", ATA_HORKAGE_BROKEN_FPDMA_AA },
+
+ /* Blacklist entries taken from Silicon Image 3124/3132
+ Windows driver .inf file - also several Linux problem reports */
+@@ -4230,6 +4231,9 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
+ { "Micron_M550*", NULL, ATA_HORKAGE_NO_NCQ_TRIM, },
+ { "Crucial_CT*M550SSD*", NULL, ATA_HORKAGE_NO_NCQ_TRIM, },
+
++ /* devices that don't properly handle TRIM commands */
++ { "SuperSSpeed S238*", NULL, ATA_HORKAGE_NOTRIM, },
++
+ /*
+ * Some WD SATA-I drives spin up and down erratically when the link
+ * is put into the slumber mode. We don't have full list of the
+@@ -4467,7 +4471,8 @@ static unsigned int ata_dev_set_xfermode(struct ata_device *dev)
+ else /* In the ancient relic department - skip all of this */
+ return 0;
+
+- err_mask = ata_exec_internal(dev, &tf, NULL, DMA_NONE, NULL, 0, 0);
++ /* On some disks, this command causes spin-up, so we need longer timeout */
++ err_mask = ata_exec_internal(dev, &tf, NULL, DMA_NONE, NULL, 0, 15000);
+
+ DPRINTK("EXIT, err_mask=%x\n", err_mask);
+ return err_mask;
+diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
+index 0586f66d70fa..d6ff64248c23 100644
+--- a/drivers/ata/libata-scsi.c
++++ b/drivers/ata/libata-scsi.c
+@@ -2514,7 +2514,8 @@ static unsigned int ata_scsiop_read_cap(struct ata_scsi_args *args, u8 *rbuf)
+ rbuf[14] = (lowest_aligned >> 8) & 0x3f;
+ rbuf[15] = lowest_aligned;
+
+- if (ata_id_has_trim(args->id)) {
++ if (ata_id_has_trim(args->id) &&
++ !(dev->horkage & ATA_HORKAGE_NOTRIM)) {
+ rbuf[14] |= 0x80; /* TPE */
+
+ if (ata_id_has_zero_after_trim(args->id))
+diff --git a/drivers/base/firmware_class.c b/drivers/base/firmware_class.c
+index 3d785ebb48d3..50e8bd00e431 100644
+--- a/drivers/base/firmware_class.c
++++ b/drivers/base/firmware_class.c
+@@ -545,10 +545,8 @@ static void fw_dev_release(struct device *dev)
+ kfree(fw_priv);
+ }
+
+-static int firmware_uevent(struct device *dev, struct kobj_uevent_env *env)
++static int do_firmware_uevent(struct firmware_priv *fw_priv, struct kobj_uevent_env *env)
+ {
+- struct firmware_priv *fw_priv = to_firmware_priv(dev);
+-
+ if (add_uevent_var(env, "FIRMWARE=%s", fw_priv->buf->fw_id))
+ return -ENOMEM;
+ if (add_uevent_var(env, "TIMEOUT=%i", loading_timeout))
+@@ -559,6 +557,18 @@ static int firmware_uevent(struct device *dev, struct kobj_uevent_env *env)
+ return 0;
+ }
+
++static int firmware_uevent(struct device *dev, struct kobj_uevent_env *env)
++{
++ struct firmware_priv *fw_priv = to_firmware_priv(dev);
++ int err = 0;
++
++ mutex_lock(&fw_lock);
++ if (fw_priv->buf)
++ err = do_firmware_uevent(fw_priv, env);
++ mutex_unlock(&fw_lock);
++ return err;
++}
++
+ static struct class firmware_class = {
+ .name = "firmware",
+ .class_attrs = firmware_class_attrs,
+diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c
+index b7f101b52d81..0cd6e0d7dd1a 100644
+--- a/drivers/gpu/drm/drm_crtc.c
++++ b/drivers/gpu/drm/drm_crtc.c
+@@ -2555,8 +2555,11 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data,
+ if (!drm_core_check_feature(dev, DRIVER_MODESET))
+ return -EINVAL;
+
+- /* For some reason crtc x/y offsets are signed internally. */
+- if (crtc_req->x > INT_MAX || crtc_req->y > INT_MAX)
++ /*
++ * Universal plane src offsets are only 16.16, prevent havoc for
++ * drivers using universal plane code internally.
++ */
++ if (crtc_req->x & 0xffff0000 || crtc_req->y & 0xffff0000)
+ return -ERANGE;
+
+ drm_modeset_lock_all(dev);
+diff --git a/drivers/gpu/drm/radeon/si_dpm.c b/drivers/gpu/drm/radeon/si_dpm.c
+index 534edaa77940..c6ad8a9f1452 100644
+--- a/drivers/gpu/drm/radeon/si_dpm.c
++++ b/drivers/gpu/drm/radeon/si_dpm.c
+@@ -2922,6 +2922,7 @@ static struct si_dpm_quirk si_dpm_quirk_list[] = {
+ /* PITCAIRN - https://bugs.freedesktop.org/show_bug.cgi?id=76490 */
+ { PCI_VENDOR_ID_ATI, 0x6810, 0x1462, 0x3036, 0, 120000 },
+ { PCI_VENDOR_ID_ATI, 0x6811, 0x174b, 0xe271, 0, 120000 },
++ { PCI_VENDOR_ID_ATI, 0x6810, 0x174b, 0xe271, 85000, 90000 },
+ { 0, 0, 0, 0 },
+ };
+
+diff --git a/drivers/iio/adc/at91_adc.c b/drivers/iio/adc/at91_adc.c
+index ff61ae55dd3f..0047db49ee5e 100644
+--- a/drivers/iio/adc/at91_adc.c
++++ b/drivers/iio/adc/at91_adc.c
+@@ -182,7 +182,7 @@ struct at91_adc_caps {
+ u8 ts_pen_detect_sensitivity;
+
+ /* startup time calculate function */
+- u32 (*calc_startup_ticks)(u8 startup_time, u32 adc_clk_khz);
++ u32 (*calc_startup_ticks)(u32 startup_time, u32 adc_clk_khz);
+
+ u8 num_channels;
+ struct at91_adc_reg_desc registers;
+@@ -201,7 +201,7 @@ struct at91_adc_state {
+ u8 num_channels;
+ void __iomem *reg_base;
+ struct at91_adc_reg_desc *registers;
+- u8 startup_time;
++ u32 startup_time;
+ u8 sample_hold_time;
+ bool sleep_mode;
+ struct iio_trigger **trig;
+@@ -780,7 +780,7 @@ ret:
+ return ret;
+ }
+
+-static u32 calc_startup_ticks_9260(u8 startup_time, u32 adc_clk_khz)
++static u32 calc_startup_ticks_9260(u32 startup_time, u32 adc_clk_khz)
+ {
+ /*
+ * Number of ticks needed to cover the startup time of the ADC
+@@ -791,7 +791,7 @@ static u32 calc_startup_ticks_9260(u8 startup_time, u32 adc_clk_khz)
+ return round_up((startup_time * adc_clk_khz / 1000) - 1, 8) / 8;
+ }
+
+-static u32 calc_startup_ticks_9x5(u8 startup_time, u32 adc_clk_khz)
++static u32 calc_startup_ticks_9x5(u32 startup_time, u32 adc_clk_khz)
+ {
+ /*
+ * For sama5d3x and at91sam9x5, the formula changes to:
+diff --git a/drivers/iio/dac/ad5624r_spi.c b/drivers/iio/dac/ad5624r_spi.c
+index 61bb9d4239ea..e98428df0d44 100644
+--- a/drivers/iio/dac/ad5624r_spi.c
++++ b/drivers/iio/dac/ad5624r_spi.c
+@@ -22,7 +22,7 @@
+ #include "ad5624r.h"
+
+ static int ad5624r_spi_write(struct spi_device *spi,
+- u8 cmd, u8 addr, u16 val, u8 len)
++ u8 cmd, u8 addr, u16 val, u8 shift)
+ {
+ u32 data;
+ u8 msg[3];
+@@ -35,7 +35,7 @@ static int ad5624r_spi_write(struct spi_device *spi,
+ * 14-, 12-bit input code followed by 0, 2, or 4 don't care bits,
+ * for the AD5664R, AD5644R, and AD5624R, respectively.
+ */
+- data = (0 << 22) | (cmd << 19) | (addr << 16) | (val << (16 - len));
++ data = (0 << 22) | (cmd << 19) | (addr << 16) | (val << shift);
+ msg[0] = data >> 16;
+ msg[1] = data >> 8;
+ msg[2] = data;
+diff --git a/drivers/iio/temperature/tmp006.c b/drivers/iio/temperature/tmp006.c
+index 84a0789c3d96..7a8050996b4e 100644
+--- a/drivers/iio/temperature/tmp006.c
++++ b/drivers/iio/temperature/tmp006.c
+@@ -132,6 +132,9 @@ static int tmp006_write_raw(struct iio_dev *indio_dev,
+ struct tmp006_data *data = iio_priv(indio_dev);
+ int i;
+
++ if (mask != IIO_CHAN_INFO_SAMP_FREQ)
++ return -EINVAL;
++
+ for (i = 0; i < ARRAY_SIZE(tmp006_freqs); i++)
+ if ((val == tmp006_freqs[i][0]) &&
+ (val2 == tmp006_freqs[i][1])) {
+diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c
+index 02c494a8d111..7b8c29b295ac 100644
+--- a/drivers/infiniband/ulp/isert/ib_isert.c
++++ b/drivers/infiniband/ulp/isert/ib_isert.c
+@@ -220,7 +220,7 @@ fail:
+ static void
+ isert_free_rx_descriptors(struct isert_conn *isert_conn)
+ {
+- struct ib_device *ib_dev = isert_conn->conn_cm_id->device;
++ struct ib_device *ib_dev = isert_conn->conn_device->ib_device;
+ struct iser_rx_desc *rx_desc;
+ int i;
+
+@@ -742,9 +742,9 @@ out:
+ static void
+ isert_connect_release(struct isert_conn *isert_conn)
+ {
+- struct ib_device *ib_dev = isert_conn->conn_cm_id->device;
+ struct isert_device *device = isert_conn->conn_device;
+ int cq_index;
++ struct ib_device *ib_dev = device->ib_device;
+
+ pr_debug("Entering isert_connect_release(): >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\n");
+
+@@ -752,7 +752,8 @@ isert_connect_release(struct isert_conn *isert_conn)
+ isert_conn_free_fastreg_pool(isert_conn);
+
+ isert_free_rx_descriptors(isert_conn);
+- rdma_destroy_id(isert_conn->conn_cm_id);
++ if (isert_conn->conn_cm_id)
++ rdma_destroy_id(isert_conn->conn_cm_id);
+
+ if (isert_conn->conn_qp) {
+ cq_index = ((struct isert_cq_desc *)
+@@ -924,12 +925,15 @@ out:
+ return 0;
+ }
+
+-static void
++static int
+ isert_connect_error(struct rdma_cm_id *cma_id)
+ {
+ struct isert_conn *isert_conn = cma_id->qp->qp_context;
+
++ isert_conn->conn_cm_id = NULL;
+ isert_put_conn(isert_conn);
++
++ return -1;
+ }
+
+ static int
+@@ -959,7 +963,7 @@ isert_cma_handler(struct rdma_cm_id *cma_id, struct rdma_cm_event *event)
+ case RDMA_CM_EVENT_REJECTED: /* FALLTHRU */
+ case RDMA_CM_EVENT_UNREACHABLE: /* FALLTHRU */
+ case RDMA_CM_EVENT_CONNECT_ERROR:
+- isert_connect_error(cma_id);
++ ret = isert_connect_error(cma_id);
+ break;
+ default:
+ pr_err("Unhandled RDMA CMA event: %d\n", event->event);
+diff --git a/drivers/md/md.c b/drivers/md/md.c
+index 9233c71138f1..43390353d62f 100644
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -6031,7 +6031,7 @@ static int update_array_info(struct mddev *mddev, mdu_array_info_t *info)
+ mddev->ctime != info->ctime ||
+ mddev->level != info->level ||
+ /* mddev->layout != info->layout || */
+- !mddev->persistent != info->not_persistent||
++ mddev->persistent != !info->not_persistent ||
+ mddev->chunk_sectors != info->chunk_size >> 9 ||
+ /* ignore bottom 8 bits of state, and allow SB_BITMAP_PRESENT to change */
+ ((state^info->state) & 0xfffffe00)
+diff --git a/drivers/md/persistent-data/dm-btree-remove.c b/drivers/md/persistent-data/dm-btree-remove.c
+index b88757cd0d1d..a03178e91a79 100644
+--- a/drivers/md/persistent-data/dm-btree-remove.c
++++ b/drivers/md/persistent-data/dm-btree-remove.c
+@@ -309,8 +309,8 @@ static void redistribute3(struct dm_btree_info *info, struct btree_node *parent,
+
+ if (s < 0 && nr_center < -s) {
+ /* not enough in central node */
+- shift(left, center, nr_center);
+- s = nr_center - target;
++ shift(left, center, -nr_center);
++ s += nr_center;
+ shift(left, right, s);
+ nr_right += s;
+ } else
+@@ -323,7 +323,7 @@ static void redistribute3(struct dm_btree_info *info, struct btree_node *parent,
+ if (s > 0 && nr_center < s) {
+ /* not enough in central node */
+ shift(center, right, nr_center);
+- s = target - nr_center;
++ s -= nr_center;
+ shift(left, right, s);
+ nr_left -= s;
+ } else
+diff --git a/drivers/md/persistent-data/dm-btree.c b/drivers/md/persistent-data/dm-btree.c
+index 200ac12a1d40..fdd3793e22f9 100644
+--- a/drivers/md/persistent-data/dm-btree.c
++++ b/drivers/md/persistent-data/dm-btree.c
+@@ -255,7 +255,7 @@ int dm_btree_del(struct dm_btree_info *info, dm_block_t root)
+ int r;
+ struct del_stack *s;
+
+- s = kmalloc(sizeof(*s), GFP_KERNEL);
++ s = kmalloc(sizeof(*s), GFP_NOIO);
+ if (!s)
+ return -ENOMEM;
+ s->info = info;
+diff --git a/drivers/mmc/card/block.c b/drivers/mmc/card/block.c
+index a19a18f0058a..10ecc0a0112b 100644
+--- a/drivers/mmc/card/block.c
++++ b/drivers/mmc/card/block.c
+@@ -205,6 +205,8 @@ static ssize_t power_ro_lock_show(struct device *dev,
+
+ ret = snprintf(buf, PAGE_SIZE, "%d\n", locked);
+
++ mmc_blk_put(md);
++
+ return ret;
+ }
+
+@@ -1915,9 +1917,11 @@ static int mmc_blk_issue_rw_rq(struct mmc_queue *mq, struct request *rqc)
+ break;
+ case MMC_BLK_CMD_ERR:
+ ret = mmc_blk_cmd_err(md, card, brq, req, ret);
+- if (!mmc_blk_reset(md, card->host, type))
+- break;
+- goto cmd_abort;
++ if (mmc_blk_reset(md, card->host, type))
++ goto cmd_abort;
++ if (!ret)
++ goto start_new_req;
++ break;
+ case MMC_BLK_RETRY:
+ if (retry++ < 5)
+ break;
+diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c
+index bb686e15102c..573b53b38af4 100644
+--- a/drivers/net/can/dev.c
++++ b/drivers/net/can/dev.c
+@@ -360,9 +360,6 @@ unsigned int can_get_echo_skb(struct net_device *dev, unsigned int idx)
+ struct can_frame *cf = (struct can_frame *)skb->data;
+ u8 dlc = cf->can_dlc;
+
+- if (!(skb->tstamp.tv64))
+- __net_timestamp(skb);
+-
+ netif_rx(priv->echo_skb[idx]);
+ priv->echo_skb[idx] = NULL;
+
+@@ -499,7 +496,6 @@ struct sk_buff *alloc_can_skb(struct net_device *dev, struct can_frame **cf)
+ if (unlikely(!skb))
+ return NULL;
+
+- __net_timestamp(skb);
+ skb->protocol = htons(ETH_P_CAN);
+ skb->pkt_type = PACKET_BROADCAST;
+ skb->ip_summed = CHECKSUM_UNNECESSARY;
+@@ -528,7 +524,6 @@ struct sk_buff *alloc_canfd_skb(struct net_device *dev,
+ if (unlikely(!skb))
+ return NULL;
+
+- __net_timestamp(skb);
+ skb->protocol = htons(ETH_P_CANFD);
+ skb->pkt_type = PACKET_BROADCAST;
+ skb->ip_summed = CHECKSUM_UNNECESSARY;
+diff --git a/drivers/net/can/slcan.c b/drivers/net/can/slcan.c
+index cb6b4723af4a..acb5b92ace92 100644
+--- a/drivers/net/can/slcan.c
++++ b/drivers/net/can/slcan.c
+@@ -210,7 +210,6 @@ static void slc_bump(struct slcan *sl)
+ if (!skb)
+ return;
+
+- __net_timestamp(skb);
+ skb->dev = sl->dev;
+ skb->protocol = htons(ETH_P_CAN);
+ skb->pkt_type = PACKET_BROADCAST;
+diff --git a/drivers/net/can/vcan.c b/drivers/net/can/vcan.c
+index 30e4627a0c01..4e94057ef5cf 100644
+--- a/drivers/net/can/vcan.c
++++ b/drivers/net/can/vcan.c
+@@ -81,9 +81,6 @@ static void vcan_rx(struct sk_buff *skb, struct net_device *dev)
+ skb->dev = dev;
+ skb->ip_summed = CHECKSUM_UNNECESSARY;
+
+- if (!(skb->tstamp.tv64))
+- __net_timestamp(skb);
+-
+ netif_rx_ni(skb);
+ }
+
+diff --git a/drivers/of/base.c b/drivers/of/base.c
+index 4c2ccde42427..469d2b7f47eb 100644
+--- a/drivers/of/base.c
++++ b/drivers/of/base.c
+@@ -88,7 +88,7 @@ EXPORT_SYMBOL(of_n_size_cells);
+ #ifdef CONFIG_NUMA
+ int __weak of_node_to_nid(struct device_node *np)
+ {
+- return numa_node_id();
++ return NUMA_NO_NODE;
+ }
+ #endif
+
+diff --git a/drivers/platform/x86/dell-laptop.c b/drivers/platform/x86/dell-laptop.c
+index 233d2ee598a6..be945fff61c3 100644
+--- a/drivers/platform/x86/dell-laptop.c
++++ b/drivers/platform/x86/dell-laptop.c
+@@ -272,7 +272,6 @@ static const struct dmi_system_id dell_quirks[] __initconst = {
+ };
+
+ static struct calling_interface_buffer *buffer;
+-static struct page *bufferpage;
+ static DEFINE_MUTEX(buffer_mutex);
+
+ static int hwswitch_state;
+@@ -825,12 +824,11 @@ static int __init dell_init(void)
+ * Allocate buffer below 4GB for SMI data--only 32-bit physical addr
+ * is passed to SMI handler.
+ */
+- bufferpage = alloc_page(GFP_KERNEL | GFP_DMA32);
+- if (!bufferpage) {
++ buffer = (void *)__get_free_page(GFP_KERNEL | GFP_DMA32);
++ if (!buffer) {
+ ret = -ENOMEM;
+ goto fail_buffer;
+ }
+- buffer = page_address(bufferpage);
+
+ ret = dell_setup_rfkill();
+
+@@ -892,7 +890,7 @@ fail_backlight:
+ cancel_delayed_work_sync(&dell_rfkill_work);
+ dell_cleanup_rfkill();
+ fail_rfkill:
+- free_page((unsigned long)bufferpage);
++ free_page((unsigned long)buffer);
+ fail_buffer:
+ platform_device_del(platform_device);
+ fail_platform_device2:
+diff --git a/drivers/scsi/scsi_devinfo.c b/drivers/scsi/scsi_devinfo.c
+index 262ab837a704..9f77d23239a2 100644
+--- a/drivers/scsi/scsi_devinfo.c
++++ b/drivers/scsi/scsi_devinfo.c
+@@ -226,6 +226,7 @@ static struct {
+ {"PIONEER", "CD-ROM DRM-624X", NULL, BLIST_FORCELUN | BLIST_SINGLELUN},
+ {"Promise", "VTrak E610f", NULL, BLIST_SPARSELUN | BLIST_NO_RSOC},
+ {"Promise", "", NULL, BLIST_SPARSELUN},
++ {"QNAP", "iSCSI Storage", NULL, BLIST_MAX_1024},
+ {"QUANTUM", "XP34301", "1071", BLIST_NOTQ},
+ {"REGAL", "CDC-4X", NULL, BLIST_MAX5LUN | BLIST_SINGLELUN},
+ {"SanDisk", "ImageMate CF-SD1", NULL, BLIST_FORCELUN},
+diff --git a/drivers/scsi/scsi_scan.c b/drivers/scsi/scsi_scan.c
+index ba3f1e8d0d57..f49cb534a829 100644
+--- a/drivers/scsi/scsi_scan.c
++++ b/drivers/scsi/scsi_scan.c
+@@ -901,6 +901,12 @@ static int scsi_add_lun(struct scsi_device *sdev, unsigned char *inq_result,
+ */
+ if (*bflags & BLIST_MAX_512)
+ blk_queue_max_hw_sectors(sdev->request_queue, 512);
++ /*
++ * Max 1024 sector transfer length for targets that report incorrect
++ * max/optimal lengths and relied on the old block layer safe default
++ */
++ else if (*bflags & BLIST_MAX_1024)
++ blk_queue_max_hw_sectors(sdev->request_queue, 1024);
+
+ /*
+ * Some devices may not want to have a start command automatically
+diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
+index 2eb6fa8e645e..3c5dd9762476 100644
+--- a/drivers/target/iscsi/iscsi_target.c
++++ b/drivers/target/iscsi/iscsi_target.c
+@@ -537,7 +537,7 @@ static struct iscsit_transport iscsi_target_transport = {
+
+ static int __init iscsi_target_init_module(void)
+ {
+- int ret = 0;
++ int ret = 0, size;
+
+ pr_debug("iSCSI-Target "ISCSIT_VERSION"\n");
+
+@@ -546,6 +546,7 @@ static int __init iscsi_target_init_module(void)
+ pr_err("Unable to allocate memory for iscsit_global\n");
+ return -1;
+ }
++ spin_lock_init(&iscsit_global->ts_bitmap_lock);
+ mutex_init(&auth_id_lock);
+ spin_lock_init(&sess_idr_lock);
+ idr_init(&tiqn_idr);
+@@ -555,15 +556,11 @@ static int __init iscsi_target_init_module(void)
+ if (ret < 0)
+ goto out;
+
+- ret = iscsi_thread_set_init();
+- if (ret < 0)
++ size = BITS_TO_LONGS(ISCSIT_BITMAP_BITS) * sizeof(long);
++ iscsit_global->ts_bitmap = vzalloc(size);
++ if (!iscsit_global->ts_bitmap) {
++ pr_err("Unable to allocate iscsit_global->ts_bitmap\n");
+ goto configfs_out;
+-
+- if (iscsi_allocate_thread_sets(TARGET_THREAD_SET_COUNT) !=
+- TARGET_THREAD_SET_COUNT) {
+- pr_err("iscsi_allocate_thread_sets() returned"
+- " unexpected value!\n");
+- goto ts_out1;
+ }
+
+ lio_qr_cache = kmem_cache_create("lio_qr_cache",
+@@ -572,7 +569,7 @@ static int __init iscsi_target_init_module(void)
+ if (!lio_qr_cache) {
+ pr_err("nable to kmem_cache_create() for"
+ " lio_qr_cache\n");
+- goto ts_out2;
++ goto bitmap_out;
+ }
+
+ lio_dr_cache = kmem_cache_create("lio_dr_cache",
+@@ -616,10 +613,8 @@ dr_out:
+ kmem_cache_destroy(lio_dr_cache);
+ qr_out:
+ kmem_cache_destroy(lio_qr_cache);
+-ts_out2:
+- iscsi_deallocate_thread_sets();
+-ts_out1:
+- iscsi_thread_set_free();
++bitmap_out:
++ vfree(iscsit_global->ts_bitmap);
+ configfs_out:
+ iscsi_target_deregister_configfs();
+ out:
+@@ -629,8 +624,6 @@ out:
+
+ static void __exit iscsi_target_cleanup_module(void)
+ {
+- iscsi_deallocate_thread_sets();
+- iscsi_thread_set_free();
+ iscsit_release_discovery_tpg();
+ iscsit_unregister_transport(&iscsi_target_transport);
+ kmem_cache_destroy(lio_qr_cache);
+@@ -640,6 +633,7 @@ static void __exit iscsi_target_cleanup_module(void)
+
+ iscsi_target_deregister_configfs();
+
++ vfree(iscsit_global->ts_bitmap);
+ kfree(iscsit_global);
+ }
+
+@@ -3680,17 +3674,16 @@ static int iscsit_send_reject(
+
+ void iscsit_thread_get_cpumask(struct iscsi_conn *conn)
+ {
+- struct iscsi_thread_set *ts = conn->thread_set;
+ int ord, cpu;
+ /*
+- * thread_id is assigned from iscsit_global->ts_bitmap from
+- * within iscsi_thread_set.c:iscsi_allocate_thread_sets()
++ * bitmap_id is assigned from iscsit_global->ts_bitmap from
++ * within iscsit_start_kthreads()
+ *
+- * Here we use thread_id to determine which CPU that this
+- * iSCSI connection's iscsi_thread_set will be scheduled to
++ * Here we use bitmap_id to determine which CPU that this
++ * iSCSI connection's RX/TX threads will be scheduled to
+ * execute upon.
+ */
+- ord = ts->thread_id % cpumask_weight(cpu_online_mask);
++ ord = conn->bitmap_id % cpumask_weight(cpu_online_mask);
+ for_each_online_cpu(cpu) {
+ if (ord-- == 0) {
+ cpumask_set_cpu(cpu, conn->conn_cpumask);
+@@ -3879,7 +3872,7 @@ check_rsp_state:
+ switch (state) {
+ case ISTATE_SEND_LOGOUTRSP:
+ if (!iscsit_logout_post_handler(cmd, conn))
+- goto restart;
++ return -ECONNRESET;
+ /* fall through */
+ case ISTATE_SEND_STATUS:
+ case ISTATE_SEND_ASYNCMSG:
+@@ -3907,8 +3900,6 @@ check_rsp_state:
+
+ err:
+ return -1;
+-restart:
+- return -EAGAIN;
+ }
+
+ static int iscsit_handle_response_queue(struct iscsi_conn *conn)
+@@ -3935,21 +3926,13 @@ static int iscsit_handle_response_queue(struct iscsi_conn *conn)
+ int iscsi_target_tx_thread(void *arg)
+ {
+ int ret = 0;
+- struct iscsi_conn *conn;
+- struct iscsi_thread_set *ts = arg;
++ struct iscsi_conn *conn = arg;
+ /*
+ * Allow ourselves to be interrupted by SIGINT so that a
+ * connection recovery / failure event can be triggered externally.
+ */
+ allow_signal(SIGINT);
+
+-restart:
+- conn = iscsi_tx_thread_pre_handler(ts);
+- if (!conn)
+- goto out;
+-
+- ret = 0;
+-
+ while (!kthread_should_stop()) {
+ /*
+ * Ensure that both TX and RX per connection kthreads
+@@ -3958,11 +3941,9 @@ restart:
+ iscsit_thread_check_cpumask(conn, current, 1);
+
+ wait_event_interruptible(conn->queues_wq,
+- !iscsit_conn_all_queues_empty(conn) ||
+- ts->status == ISCSI_THREAD_SET_RESET);
++ !iscsit_conn_all_queues_empty(conn));
+
+- if ((ts->status == ISCSI_THREAD_SET_RESET) ||
+- signal_pending(current))
++ if (signal_pending(current))
+ goto transport_err;
+
+ get_immediate:
+@@ -3973,15 +3954,14 @@ get_immediate:
+ ret = iscsit_handle_response_queue(conn);
+ if (ret == 1)
+ goto get_immediate;
+- else if (ret == -EAGAIN)
+- goto restart;
++ else if (ret == -ECONNRESET)
++ goto out;
+ else if (ret < 0)
+ goto transport_err;
+ }
+
+ transport_err:
+ iscsit_take_action_for_connection_exit(conn);
+- goto restart;
+ out:
+ return 0;
+ }
+@@ -4070,8 +4050,7 @@ int iscsi_target_rx_thread(void *arg)
+ int ret;
+ u8 buffer[ISCSI_HDR_LEN], opcode;
+ u32 checksum = 0, digest = 0;
+- struct iscsi_conn *conn = NULL;
+- struct iscsi_thread_set *ts = arg;
++ struct iscsi_conn *conn = arg;
+ struct kvec iov;
+ /*
+ * Allow ourselves to be interrupted by SIGINT so that a
+@@ -4079,11 +4058,6 @@ int iscsi_target_rx_thread(void *arg)
+ */
+ allow_signal(SIGINT);
+
+-restart:
+- conn = iscsi_rx_thread_pre_handler(ts);
+- if (!conn)
+- goto out;
+-
+ if (conn->conn_transport->transport_type == ISCSI_INFINIBAND) {
+ struct completion comp;
+ int rc;
+@@ -4093,7 +4067,7 @@ restart:
+ if (rc < 0)
+ goto transport_err;
+
+- goto out;
++ goto transport_err;
+ }
+
+ while (!kthread_should_stop()) {
+@@ -4169,8 +4143,6 @@ transport_err:
+ if (!signal_pending(current))
+ atomic_set(&conn->transport_failed, 1);
+ iscsit_take_action_for_connection_exit(conn);
+- goto restart;
+-out:
+ return 0;
+ }
+
+@@ -4232,7 +4204,24 @@ int iscsit_close_connection(
+ if (conn->conn_transport->transport_type == ISCSI_TCP)
+ complete(&conn->conn_logout_comp);
+
+- iscsi_release_thread_set(conn);
++ if (!strcmp(current->comm, ISCSI_RX_THREAD_NAME)) {
++ if (conn->tx_thread &&
++ cmpxchg(&conn->tx_thread_active, true, false)) {
++ send_sig(SIGINT, conn->tx_thread, 1);
++ kthread_stop(conn->tx_thread);
++ }
++ } else if (!strcmp(current->comm, ISCSI_TX_THREAD_NAME)) {
++ if (conn->rx_thread &&
++ cmpxchg(&conn->rx_thread_active, true, false)) {
++ send_sig(SIGINT, conn->rx_thread, 1);
++ kthread_stop(conn->rx_thread);
++ }
++ }
++
++ spin_lock(&iscsit_global->ts_bitmap_lock);
++ bitmap_release_region(iscsit_global->ts_bitmap, conn->bitmap_id,
++ get_order(1));
++ spin_unlock(&iscsit_global->ts_bitmap_lock);
+
+ iscsit_stop_timers_for_cmds(conn);
+ iscsit_stop_nopin_response_timer(conn);
+@@ -4510,15 +4499,13 @@ static void iscsit_logout_post_handler_closesession(
+ struct iscsi_conn *conn)
+ {
+ struct iscsi_session *sess = conn->sess;
+-
+- iscsi_set_thread_clear(conn, ISCSI_CLEAR_TX_THREAD);
+- iscsi_set_thread_set_signal(conn, ISCSI_SIGNAL_TX_THREAD);
++ int sleep = cmpxchg(&conn->tx_thread_active, true, false);
+
+ atomic_set(&conn->conn_logout_remove, 0);
+ complete(&conn->conn_logout_comp);
+
+ iscsit_dec_conn_usage_count(conn);
+- iscsit_stop_session(sess, 1, 1);
++ iscsit_stop_session(sess, sleep, sleep);
+ iscsit_dec_session_usage_count(sess);
+ target_put_session(sess->se_sess);
+ }
+@@ -4526,13 +4513,12 @@ static void iscsit_logout_post_handler_closesession(
+ static void iscsit_logout_post_handler_samecid(
+ struct iscsi_conn *conn)
+ {
+- iscsi_set_thread_clear(conn, ISCSI_CLEAR_TX_THREAD);
+- iscsi_set_thread_set_signal(conn, ISCSI_SIGNAL_TX_THREAD);
++ int sleep = cmpxchg(&conn->tx_thread_active, true, false);
+
+ atomic_set(&conn->conn_logout_remove, 0);
+ complete(&conn->conn_logout_comp);
+
+- iscsit_cause_connection_reinstatement(conn, 1);
++ iscsit_cause_connection_reinstatement(conn, sleep);
+ iscsit_dec_conn_usage_count(conn);
+ }
+
+diff --git a/drivers/target/iscsi/iscsi_target_core.h b/drivers/target/iscsi/iscsi_target_core.h
+index 302eb3b78715..2423f27e4670 100644
+--- a/drivers/target/iscsi/iscsi_target_core.h
++++ b/drivers/target/iscsi/iscsi_target_core.h
+@@ -602,6 +602,11 @@ struct iscsi_conn {
+ struct iscsi_session *sess;
+ /* Pointer to thread_set in use for this conn's threads */
+ struct iscsi_thread_set *thread_set;
++ int bitmap_id;
++ int rx_thread_active;
++ struct task_struct *rx_thread;
++ int tx_thread_active;
++ struct task_struct *tx_thread;
+ /* list_head for session connection list */
+ struct list_head conn_list;
+ } ____cacheline_aligned;
+@@ -872,10 +877,12 @@ struct iscsit_global {
+ /* Unique identifier used for the authentication daemon */
+ u32 auth_id;
+ u32 inactive_ts;
++#define ISCSIT_BITMAP_BITS 262144
+ /* Thread Set bitmap count */
+ int ts_bitmap_count;
+ /* Thread Set bitmap pointer */
+ unsigned long *ts_bitmap;
++ spinlock_t ts_bitmap_lock;
+ /* Used for iSCSI discovery session authentication */
+ struct iscsi_node_acl discovery_acl;
+ struct iscsi_portal_group *discovery_tpg;
+diff --git a/drivers/target/iscsi/iscsi_target_erl0.c b/drivers/target/iscsi/iscsi_target_erl0.c
+index a0ae5fc0ad75..87f687258729 100644
+--- a/drivers/target/iscsi/iscsi_target_erl0.c
++++ b/drivers/target/iscsi/iscsi_target_erl0.c
+@@ -860,7 +860,10 @@ void iscsit_connection_reinstatement_rcfr(struct iscsi_conn *conn)
+ }
+ spin_unlock_bh(&conn->state_lock);
+
+- iscsi_thread_set_force_reinstatement(conn);
++ if (conn->tx_thread && conn->tx_thread_active)
++ send_sig(SIGINT, conn->tx_thread, 1);
++ if (conn->rx_thread && conn->rx_thread_active)
++ send_sig(SIGINT, conn->rx_thread, 1);
+
+ sleep:
+ wait_for_completion(&conn->conn_wait_rcfr_comp);
+@@ -885,10 +888,10 @@ void iscsit_cause_connection_reinstatement(struct iscsi_conn *conn, int sleep)
+ return;
+ }
+
+- if (iscsi_thread_set_force_reinstatement(conn) < 0) {
+- spin_unlock_bh(&conn->state_lock);
+- return;
+- }
++ if (conn->tx_thread && conn->tx_thread_active)
++ send_sig(SIGINT, conn->tx_thread, 1);
++ if (conn->rx_thread && conn->rx_thread_active)
++ send_sig(SIGINT, conn->rx_thread, 1);
+
+ atomic_set(&conn->connection_reinstatement, 1);
+ if (!sleep) {
+diff --git a/drivers/target/iscsi/iscsi_target_login.c b/drivers/target/iscsi/iscsi_target_login.c
+index 18e2601527df..2d87abc6b38c 100644
+--- a/drivers/target/iscsi/iscsi_target_login.c
++++ b/drivers/target/iscsi/iscsi_target_login.c
+@@ -699,6 +699,51 @@ static void iscsi_post_login_start_timers(struct iscsi_conn *conn)
+ iscsit_start_nopin_timer(conn);
+ }
+
++int iscsit_start_kthreads(struct iscsi_conn *conn)
++{
++ int ret = 0;
++
++ spin_lock(&iscsit_global->ts_bitmap_lock);
++ conn->bitmap_id = bitmap_find_free_region(iscsit_global->ts_bitmap,
++ ISCSIT_BITMAP_BITS, get_order(1));
++ spin_unlock(&iscsit_global->ts_bitmap_lock);
++
++ if (conn->bitmap_id < 0) {
++ pr_err("bitmap_find_free_region() failed for"
++ " iscsit_start_kthreads()\n");
++ return -ENOMEM;
++ }
++
++ conn->tx_thread = kthread_run(iscsi_target_tx_thread, conn,
++ "%s", ISCSI_TX_THREAD_NAME);
++ if (IS_ERR(conn->tx_thread)) {
++ pr_err("Unable to start iscsi_target_tx_thread\n");
++ ret = PTR_ERR(conn->tx_thread);
++ goto out_bitmap;
++ }
++ conn->tx_thread_active = true;
++
++ conn->rx_thread = kthread_run(iscsi_target_rx_thread, conn,
++ "%s", ISCSI_RX_THREAD_NAME);
++ if (IS_ERR(conn->rx_thread)) {
++ pr_err("Unable to start iscsi_target_rx_thread\n");
++ ret = PTR_ERR(conn->rx_thread);
++ goto out_tx;
++ }
++ conn->rx_thread_active = true;
++
++ return 0;
++out_tx:
++ kthread_stop(conn->tx_thread);
++ conn->tx_thread_active = false;
++out_bitmap:
++ spin_lock(&iscsit_global->ts_bitmap_lock);
++ bitmap_release_region(iscsit_global->ts_bitmap, conn->bitmap_id,
++ get_order(1));
++ spin_unlock(&iscsit_global->ts_bitmap_lock);
++ return ret;
++}
++
+ int iscsi_post_login_handler(
+ struct iscsi_np *np,
+ struct iscsi_conn *conn,
+@@ -709,7 +754,7 @@ int iscsi_post_login_handler(
+ struct se_session *se_sess = sess->se_sess;
+ struct iscsi_portal_group *tpg = sess->tpg;
+ struct se_portal_group *se_tpg = &tpg->tpg_se_tpg;
+- struct iscsi_thread_set *ts;
++ int rc;
+
+ iscsit_inc_conn_usage_count(conn);
+
+@@ -724,7 +769,6 @@ int iscsi_post_login_handler(
+ /*
+ * SCSI Initiator -> SCSI Target Port Mapping
+ */
+- ts = iscsi_get_thread_set();
+ if (!zero_tsih) {
+ iscsi_set_session_parameters(sess->sess_ops,
+ conn->param_list, 0);
+@@ -751,9 +795,11 @@ int iscsi_post_login_handler(
+ sess->sess_ops->InitiatorName);
+ spin_unlock_bh(&sess->conn_lock);
+
+- iscsi_post_login_start_timers(conn);
++ rc = iscsit_start_kthreads(conn);
++ if (rc)
++ return rc;
+
+- iscsi_activate_thread_set(conn, ts);
++ iscsi_post_login_start_timers(conn);
+ /*
+ * Determine CPU mask to ensure connection's RX and TX kthreads
+ * are scheduled on the same CPU.
+@@ -810,8 +856,11 @@ int iscsi_post_login_handler(
+ " iSCSI Target Portal Group: %hu\n", tpg->nsessions, tpg->tpgt);
+ spin_unlock_bh(&se_tpg->session_lock);
+
++ rc = iscsit_start_kthreads(conn);
++ if (rc)
++ return rc;
++
+ iscsi_post_login_start_timers(conn);
+- iscsi_activate_thread_set(conn, ts);
+ /*
+ * Determine CPU mask to ensure connection's RX and TX kthreads
+ * are scheduled on the same CPU.
+diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
+index e500243803d8..a85eadff6bea 100644
+--- a/drivers/usb/core/devio.c
++++ b/drivers/usb/core/devio.c
+@@ -513,7 +513,7 @@ static void async_completed(struct urb *urb)
+ snoop(&urb->dev->dev, "urb complete\n");
+ snoop_urb(urb->dev, as->userurb, urb->pipe, urb->actual_length,
+ as->status, COMPLETE, NULL, 0);
+- if ((urb->transfer_flags & URB_DIR_MASK) == USB_DIR_IN)
++ if ((urb->transfer_flags & URB_DIR_MASK) == URB_DIR_IN)
+ snoop_urb_data(urb, urb->actual_length);
+
+ if (as->status < 0 && as->bulk_addr && as->status != -ECONNRESET &&
+@@ -1690,7 +1690,7 @@ static struct async *reap_as(struct usb_dev_state *ps)
+ for (;;) {
+ __set_current_state(TASK_INTERRUPTIBLE);
+ as = async_getcompleted(ps);
+- if (as)
++ if (as || !connected(ps))
+ break;
+ if (signal_pending(current))
+ break;
+@@ -1713,7 +1713,7 @@ static int proc_reapurb(struct usb_dev_state *ps, void __user *arg)
+ }
+ if (signal_pending(current))
+ return -EINTR;
+- return -EIO;
++ return -ENODEV;
+ }
+
+ static int proc_reapurbnonblock(struct usb_dev_state *ps, void __user *arg)
+@@ -1722,10 +1722,11 @@ static int proc_reapurbnonblock(struct usb_dev_state *ps, void __user *arg)
+ struct async *as;
+
+ as = async_getcompleted(ps);
+- retval = -EAGAIN;
+ if (as) {
+ retval = processcompl(as, (void __user * __user *)arg);
+ free_async(as);
++ } else {
++ retval = (connected(ps) ? -EAGAIN : -ENODEV);
+ }
+ return retval;
+ }
+@@ -1855,7 +1856,7 @@ static int proc_reapurb_compat(struct usb_dev_state *ps, void __user *arg)
+ }
+ if (signal_pending(current))
+ return -EINTR;
+- return -EIO;
++ return -ENODEV;
+ }
+
+ static int proc_reapurbnonblock_compat(struct usb_dev_state *ps, void __user *arg)
+@@ -1863,11 +1864,12 @@ static int proc_reapurbnonblock_compat(struct usb_dev_state *ps, void __user *ar
+ int retval;
+ struct async *as;
+
+- retval = -EAGAIN;
+ as = async_getcompleted(ps);
+ if (as) {
+ retval = processcompl_compat(as, (void __user * __user *)arg);
+ free_async(as);
++ } else {
++ retval = (connected(ps) ? -EAGAIN : -ENODEV);
+ }
+ return retval;
+ }
+@@ -2039,7 +2041,8 @@ static int proc_get_capabilities(struct usb_dev_state *ps, void __user *arg)
+ {
+ __u32 caps;
+
+- caps = USBDEVFS_CAP_ZERO_PACKET | USBDEVFS_CAP_NO_PACKET_SIZE_LIM;
++ caps = USBDEVFS_CAP_ZERO_PACKET | USBDEVFS_CAP_NO_PACKET_SIZE_LIM |
++ USBDEVFS_CAP_REAP_AFTER_DISCONNECT;
+ if (!ps->dev->bus->no_stop_on_short)
+ caps |= USBDEVFS_CAP_BULK_CONTINUATION;
+ if (ps->dev->bus->sg_tablesize)
+@@ -2139,6 +2142,32 @@ static long usbdev_do_ioctl(struct file *file, unsigned int cmd,
+ return -EPERM;
+
+ usb_lock_device(dev);
++
++ /* Reap operations are allowed even after disconnection */
++ switch (cmd) {
++ case USBDEVFS_REAPURB:
++ snoop(&dev->dev, "%s: REAPURB\n", __func__);
++ ret = proc_reapurb(ps, p);
++ goto done;
++
++ case USBDEVFS_REAPURBNDELAY:
++ snoop(&dev->dev, "%s: REAPURBNDELAY\n", __func__);
++ ret = proc_reapurbnonblock(ps, p);
++ goto done;
++
++#ifdef CONFIG_COMPAT
++ case USBDEVFS_REAPURB32:
++ snoop(&dev->dev, "%s: REAPURB32\n", __func__);
++ ret = proc_reapurb_compat(ps, p);
++ goto done;
++
++ case USBDEVFS_REAPURBNDELAY32:
++ snoop(&dev->dev, "%s: REAPURBNDELAY32\n", __func__);
++ ret = proc_reapurbnonblock_compat(ps, p);
++ goto done;
++#endif
++ }
++
+ if (!connected(ps)) {
+ usb_unlock_device(dev);
+ return -ENODEV;
+@@ -2232,16 +2261,6 @@ static long usbdev_do_ioctl(struct file *file, unsigned int cmd,
+ inode->i_mtime = CURRENT_TIME;
+ break;
+
+- case USBDEVFS_REAPURB32:
+- snoop(&dev->dev, "%s: REAPURB32\n", __func__);
+- ret = proc_reapurb_compat(ps, p);
+- break;
+-
+- case USBDEVFS_REAPURBNDELAY32:
+- snoop(&dev->dev, "%s: REAPURBNDELAY32\n", __func__);
+- ret = proc_reapurbnonblock_compat(ps, p);
+- break;
+-
+ case USBDEVFS_IOCTL32:
+ snoop(&dev->dev, "%s: IOCTL32\n", __func__);
+ ret = proc_ioctl_compat(ps, ptr_to_compat(p));
+@@ -2253,16 +2272,6 @@ static long usbdev_do_ioctl(struct file *file, unsigned int cmd,
+ ret = proc_unlinkurb(ps, p);
+ break;
+
+- case USBDEVFS_REAPURB:
+- snoop(&dev->dev, "%s: REAPURB\n", __func__);
+- ret = proc_reapurb(ps, p);
+- break;
+-
+- case USBDEVFS_REAPURBNDELAY:
+- snoop(&dev->dev, "%s: REAPURBNDELAY\n", __func__);
+- ret = proc_reapurbnonblock(ps, p);
+- break;
+-
+ case USBDEVFS_DISCSIGNAL:
+ snoop(&dev->dev, "%s: DISCSIGNAL\n", __func__);
+ ret = proc_disconnectsignal(ps, p);
+@@ -2305,6 +2314,8 @@ static long usbdev_do_ioctl(struct file *file, unsigned int cmd,
+ ret = proc_free_streams(ps, p);
+ break;
+ }
++
++ done:
+ usb_unlock_device(dev);
+ if (ret >= 0)
+ inode->i_atime = CURRENT_TIME;
+diff --git a/drivers/usb/dwc3/ep0.c b/drivers/usb/dwc3/ep0.c
+index df38e7ef4976..bdc995da3420 100644
+--- a/drivers/usb/dwc3/ep0.c
++++ b/drivers/usb/dwc3/ep0.c
+@@ -727,6 +727,10 @@ static int dwc3_ep0_std_request(struct dwc3 *dwc, struct usb_ctrlrequest *ctrl)
+ dwc3_trace(trace_dwc3_ep0, "USB_REQ_SET_ISOCH_DELAY\n");
+ ret = dwc3_ep0_set_isoch_delay(dwc, ctrl);
+ break;
++ case USB_REQ_SET_INTERFACE:
++ dev_vdbg(dwc->dev, "USB_REQ_SET_INTERFACE\n");
++ dwc->start_config_issued = false;
++ /* Fall through */
+ default:
+ dwc3_trace(trace_dwc3_ep0, "Forwarding to gadget driver\n");
+ ret = dwc3_ep0_delegate_req(dwc, ctrl);
+diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
+index 5cb3d7a10017..a67018eddf41 100644
+--- a/drivers/usb/host/xhci-mem.c
++++ b/drivers/usb/host/xhci-mem.c
+@@ -1431,10 +1431,10 @@ int xhci_endpoint_init(struct xhci_hcd *xhci,
+ /* Attempt to use the ring cache */
+ if (virt_dev->num_rings_cached == 0)
+ return -ENOMEM;
++ virt_dev->num_rings_cached--;
+ virt_dev->eps[ep_index].new_ring =
+ virt_dev->ring_cache[virt_dev->num_rings_cached];
+ virt_dev->ring_cache[virt_dev->num_rings_cached] = NULL;
+- virt_dev->num_rings_cached--;
+ xhci_reinit_cached_ring(xhci, virt_dev->eps[ep_index].new_ring,
+ 1, type);
+ }
+diff --git a/drivers/usb/musb/musb_virthub.c b/drivers/usb/musb/musb_virthub.c
+index 0241a3a0d63e..1e9bde4fe785 100644
+--- a/drivers/usb/musb/musb_virthub.c
++++ b/drivers/usb/musb/musb_virthub.c
+@@ -273,9 +273,7 @@ static int musb_has_gadget(struct musb *musb)
+ #ifdef CONFIG_USB_MUSB_HOST
+ return 1;
+ #else
+- if (musb->port_mode == MUSB_PORT_MODE_HOST)
+- return 1;
+- return musb->g.dev.driver != NULL;
++ return musb->port_mode == MUSB_PORT_MODE_HOST;
+ #endif
+ }
+
+diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
+index ffd739e31bfc..eac7ccaa3c85 100644
+--- a/drivers/usb/serial/cp210x.c
++++ b/drivers/usb/serial/cp210x.c
+@@ -187,6 +187,7 @@ static const struct usb_device_id id_table[] = {
+ { USB_DEVICE(0x1FB9, 0x0602) }, /* Lake Shore Model 648 Magnet Power Supply */
+ { USB_DEVICE(0x1FB9, 0x0700) }, /* Lake Shore Model 737 VSM Controller */
+ { USB_DEVICE(0x1FB9, 0x0701) }, /* Lake Shore Model 776 Hall Matrix */
++ { USB_DEVICE(0x2626, 0xEA60) }, /* Aruba Networks 7xxx USB Serial Console */
+ { USB_DEVICE(0x3195, 0xF190) }, /* Link Instruments MSO-19 */
+ { USB_DEVICE(0x3195, 0xF280) }, /* Link Instruments MSO-28 */
+ { USB_DEVICE(0x3195, 0xF281) }, /* Link Instruments MSO-28 */
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index efdcee15b520..c8c4e50ffee1 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -1773,6 +1773,7 @@ static const struct usb_device_id option_ids[] = {
+ { USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x7d03, 0xff, 0x00, 0x00) },
+ { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) }, /* D-Link DWM-152/C1 */
+ { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e02, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/C1 */
++ { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x4000, 0xff) }, /* OLICARD300 - MT6225 */
+ { USB_DEVICE(INOVIA_VENDOR_ID, INOVIA_SEW858) },
+ { USB_DEVICE(VIATELECOM_VENDOR_ID, VIATELECOM_PRODUCT_CDS7) },
+ { } /* Terminating entry */
+diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c
+index 19842370a07f..6fbfc8fc2f5d 100644
+--- a/drivers/usb/serial/usb-serial.c
++++ b/drivers/usb/serial/usb-serial.c
+@@ -1290,6 +1290,7 @@ static void __exit usb_serial_exit(void)
+ tty_unregister_driver(usb_serial_tty_driver);
+ put_tty_driver(usb_serial_tty_driver);
+ bus_unregister(&usb_serial_bus_type);
++ idr_destroy(&serial_minors);
+ }
+
+
+diff --git a/drivers/watchdog/omap_wdt.c b/drivers/watchdog/omap_wdt.c
+index 3691b157516a..0c8868eceb4d 100644
+--- a/drivers/watchdog/omap_wdt.c
++++ b/drivers/watchdog/omap_wdt.c
+@@ -132,6 +132,13 @@ static int omap_wdt_start(struct watchdog_device *wdog)
+
+ pm_runtime_get_sync(wdev->dev);
+
++ /*
++ * Make sure the watchdog is disabled. This is unfortunately required
++ * because writing to various registers with the watchdog running has no
++ * effect.
++ */
++ omap_wdt_disable(wdev);
++
+ /* initialize prescaler */
+ while (readl_relaxed(base + OMAP_WATCHDOG_WPS) & 0x01)
+ cpu_relax();
+diff --git a/fs/9p/vfs_inode.c b/fs/9p/vfs_inode.c
+index 296482fc77a9..a2f6e9ae1a98 100644
+--- a/fs/9p/vfs_inode.c
++++ b/fs/9p/vfs_inode.c
+@@ -540,8 +540,7 @@ static struct inode *v9fs_qid_iget(struct super_block *sb,
+ unlock_new_inode(inode);
+ return inode;
+ error:
+- unlock_new_inode(inode);
+- iput(inode);
++ iget_failed(inode);
+ return ERR_PTR(retval);
+
+ }
+diff --git a/fs/9p/vfs_inode_dotl.c b/fs/9p/vfs_inode_dotl.c
+index 02b64f4e576a..092d20c643e5 100644
+--- a/fs/9p/vfs_inode_dotl.c
++++ b/fs/9p/vfs_inode_dotl.c
+@@ -149,8 +149,7 @@ static struct inode *v9fs_qid_iget_dotl(struct super_block *sb,
+ unlock_new_inode(inode);
+ return inode;
+ error:
+- unlock_new_inode(inode);
+- iput(inode);
++ iget_failed(inode);
+ return ERR_PTR(retval);
+
+ }
+diff --git a/fs/btrfs/inode-map.c b/fs/btrfs/inode-map.c
+index 83d646bd2e4b..ed2de833dd18 100644
+--- a/fs/btrfs/inode-map.c
++++ b/fs/btrfs/inode-map.c
+@@ -271,7 +271,7 @@ void btrfs_unpin_free_ino(struct btrfs_root *root)
+ __btrfs_add_free_space(ctl, info->offset, count);
+ free:
+ rb_erase(&info->offset_index, rbroot);
+- kfree(info);
++ kmem_cache_free(btrfs_free_space_cachep, info);
+ }
+ }
+
+diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
+index 1cecf25fa14f..3d50f1ee51ba 100644
+--- a/fs/btrfs/ioctl.c
++++ b/fs/btrfs/ioctl.c
+@@ -2959,7 +2959,7 @@ out_unlock:
+ static long btrfs_ioctl_file_extent_same(struct file *file,
+ struct btrfs_ioctl_same_args __user *argp)
+ {
+- struct btrfs_ioctl_same_args *same;
++ struct btrfs_ioctl_same_args *same = NULL;
+ struct btrfs_ioctl_same_extent_info *info;
+ struct inode *src = file_inode(file);
+ u64 off;
+@@ -2989,6 +2989,7 @@ static long btrfs_ioctl_file_extent_same(struct file *file,
+
+ if (IS_ERR(same)) {
+ ret = PTR_ERR(same);
++ same = NULL;
+ goto out;
+ }
+
+@@ -3059,6 +3060,7 @@ static long btrfs_ioctl_file_extent_same(struct file *file,
+
+ out:
+ mnt_drop_write_file(file);
++ kfree(same);
+ return ret;
+ }
+
+diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
+index 120824664d32..777f74370143 100644
+--- a/fs/ext4/inode.c
++++ b/fs/ext4/inode.c
+@@ -1230,7 +1230,7 @@ static void ext4_da_page_release_reservation(struct page *page,
+ unsigned int offset,
+ unsigned int length)
+ {
+- int to_release = 0;
++ int to_release = 0, contiguous_blks = 0;
+ struct buffer_head *head, *bh;
+ unsigned int curr_off = 0;
+ struct inode *inode = page->mapping->host;
+@@ -1251,14 +1251,23 @@ static void ext4_da_page_release_reservation(struct page *page,
+
+ if ((offset <= curr_off) && (buffer_delay(bh))) {
+ to_release++;
++ contiguous_blks++;
+ clear_buffer_delay(bh);
++ } else if (contiguous_blks) {
++ lblk = page->index <<
++ (PAGE_CACHE_SHIFT - inode->i_blkbits);
++ lblk += (curr_off >> inode->i_blkbits) -
++ contiguous_blks;
++ ext4_es_remove_extent(inode, lblk, contiguous_blks);
++ contiguous_blks = 0;
+ }
+ curr_off = next_off;
+ } while ((bh = bh->b_this_page) != head);
+
+- if (to_release) {
++ if (contiguous_blks) {
+ lblk = page->index << (PAGE_CACHE_SHIFT - inode->i_blkbits);
+- ext4_es_remove_extent(inode, lblk, to_release);
++ lblk += (curr_off >> inode->i_blkbits) - contiguous_blks;
++ ext4_es_remove_extent(inode, lblk, contiguous_blks);
+ }
+
+ /* If we have released all the blocks belonging to a cluster, then we
+diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
+index dbfe15c2533c..99c8e38ffb7b 100644
+--- a/fs/ext4/mballoc.c
++++ b/fs/ext4/mballoc.c
+@@ -4801,18 +4801,12 @@ do_more:
+ /*
+ * blocks being freed are metadata. these blocks shouldn't
+ * be used until this transaction is committed
++ *
++ * We use __GFP_NOFAIL because ext4_free_blocks() is not allowed
++ * to fail.
+ */
+- retry:
+- new_entry = kmem_cache_alloc(ext4_free_data_cachep, GFP_NOFS);
+- if (!new_entry) {
+- /*
+- * We use a retry loop because
+- * ext4_free_blocks() is not allowed to fail.
+- */
+- cond_resched();
+- congestion_wait(BLK_RW_ASYNC, HZ/50);
+- goto retry;
+- }
++ new_entry = kmem_cache_alloc(ext4_free_data_cachep,
++ GFP_NOFS|__GFP_NOFAIL);
+ new_entry->efd_start_cluster = bit;
+ new_entry->efd_group = block_group;
+ new_entry->efd_count = count_clusters;
+diff --git a/fs/ext4/migrate.c b/fs/ext4/migrate.c
+index a432634f2e6a..876b984f1a75 100644
+--- a/fs/ext4/migrate.c
++++ b/fs/ext4/migrate.c
+@@ -620,6 +620,7 @@ int ext4_ind_migrate(struct inode *inode)
+ struct ext4_inode_info *ei = EXT4_I(inode);
+ struct ext4_extent *ex;
+ unsigned int i, len;
++ ext4_lblk_t start, end;
+ ext4_fsblk_t blk;
+ handle_t *handle;
+ int ret;
+@@ -633,6 +634,14 @@ int ext4_ind_migrate(struct inode *inode)
+ EXT4_FEATURE_RO_COMPAT_BIGALLOC))
+ return -EOPNOTSUPP;
+
++ /*
++ * In order to get correct extent info, force all delayed allocation
++ * blocks to be allocated, otherwise delayed allocation blocks may not
++ * be reflected and bypass the checks on extent header.
++ */
++ if (test_opt(inode->i_sb, DELALLOC))
++ ext4_alloc_da_blocks(inode);
++
+ handle = ext4_journal_start(inode, EXT4_HT_MIGRATE, 1);
+ if (IS_ERR(handle))
+ return PTR_ERR(handle);
+@@ -650,11 +659,13 @@ int ext4_ind_migrate(struct inode *inode)
+ goto errout;
+ }
+ if (eh->eh_entries == 0)
+- blk = len = 0;
++ blk = len = start = end = 0;
+ else {
+ len = le16_to_cpu(ex->ee_len);
+ blk = ext4_ext_pblock(ex);
+- if (len > EXT4_NDIR_BLOCKS) {
++ start = le32_to_cpu(ex->ee_block);
++ end = start + len - 1;
++ if (end >= EXT4_NDIR_BLOCKS) {
+ ret = -EOPNOTSUPP;
+ goto errout;
+ }
+@@ -662,7 +673,7 @@ int ext4_ind_migrate(struct inode *inode)
+
+ ext4_clear_inode_flag(inode, EXT4_INODE_EXTENTS);
+ memset(ei->i_data, 0, sizeof(ei->i_data));
+- for (i=0; i < len; i++)
++ for (i = start; i <= end; i++)
+ ei->i_data[i] = cpu_to_le32(blk++);
+ ext4_mark_inode_dirty(handle, inode);
+ errout:
+diff --git a/fs/nfs/nfs3xdr.c b/fs/nfs/nfs3xdr.c
+index 8f4cbe7f4aa8..53853ca134e5 100644
+--- a/fs/nfs/nfs3xdr.c
++++ b/fs/nfs/nfs3xdr.c
+@@ -1342,7 +1342,7 @@ static void nfs3_xdr_enc_setacl3args(struct rpc_rqst *req,
+ if (args->npages != 0)
+ xdr_write_pages(xdr, args->pages, 0, args->len);
+ else
+- xdr_reserve_space(xdr, NFS_ACL_INLINE_BUFSIZE);
++ xdr_reserve_space(xdr, args->len);
+
+ error = nfsacl_encode(xdr->buf, base, args->inode,
+ (args->mask & NFS_ACL) ?
+diff --git a/include/acpi/actypes.h b/include/acpi/actypes.h
+index 93ef42245647..f6406e70ea4a 100644
+--- a/include/acpi/actypes.h
++++ b/include/acpi/actypes.h
+@@ -573,6 +573,7 @@ typedef u64 acpi_integer;
+ #define ACPI_NO_ACPI_ENABLE 0x10
+ #define ACPI_NO_DEVICE_INIT 0x20
+ #define ACPI_NO_OBJECT_INIT 0x40
++#define ACPI_NO_FACS_INIT 0x80
+
+ /*
+ * Initialization state
+diff --git a/include/linux/libata.h b/include/linux/libata.h
+index b3a816f4c0c4..8f6a07441b85 100644
+--- a/include/linux/libata.h
++++ b/include/linux/libata.h
+@@ -429,6 +429,7 @@ enum {
+ ATA_HORKAGE_NO_NCQ_TRIM = (1 << 19), /* don't use queued TRIM */
+ ATA_HORKAGE_NOLPM = (1 << 20), /* don't use LPM */
+ ATA_HORKAGE_WD_BROKEN_LPM = (1 << 21), /* some WDs have broken LPM */
++ ATA_HORKAGE_NOTRIM = (1 << 24), /* don't use TRIM */
+
+ /* DMA mask for user DMA control: User visible values; DO NOT
+ renumber */
+diff --git a/include/linux/of.h b/include/linux/of.h
+index ce9f6a2b3532..4a6a489a7506 100644
+--- a/include/linux/of.h
++++ b/include/linux/of.h
+@@ -593,7 +593,10 @@ static inline const char *of_prop_next_string(struct property *prop,
+ #if defined(CONFIG_OF) && defined(CONFIG_NUMA)
+ extern int of_node_to_nid(struct device_node *np);
+ #else
+-static inline int of_node_to_nid(struct device_node *device) { return 0; }
++static inline int of_node_to_nid(struct device_node *device)
++{
++ return NUMA_NO_NODE;
++}
+ #endif
+
+ static inline struct device_node *of_find_matching_node(
+diff --git a/include/scsi/scsi_devinfo.h b/include/scsi/scsi_devinfo.h
+index 183eaab7c380..96e3f56519e7 100644
+--- a/include/scsi/scsi_devinfo.h
++++ b/include/scsi/scsi_devinfo.h
+@@ -36,5 +36,6 @@
+ for sequential scan */
+ #define BLIST_TRY_VPD_PAGES 0x10000000 /* Attempt to read VPD pages */
+ #define BLIST_NO_RSOC 0x20000000 /* don't try to issue RSOC */
++#define BLIST_MAX_1024 0x40000000 /* maximum 1024 sector cdb length */
+
+ #endif
+diff --git a/include/uapi/linux/usbdevice_fs.h b/include/uapi/linux/usbdevice_fs.h
+index abe5f4bd4d82..019ba1e0799a 100644
+--- a/include/uapi/linux/usbdevice_fs.h
++++ b/include/uapi/linux/usbdevice_fs.h
+@@ -128,11 +128,12 @@ struct usbdevfs_hub_portinfo {
+ char port [127]; /* e.g. port 3 connects to device 27 */
+ };
+
+-/* Device capability flags */
++/* System and bus capability flags */
+ #define USBDEVFS_CAP_ZERO_PACKET 0x01
+ #define USBDEVFS_CAP_BULK_CONTINUATION 0x02
+ #define USBDEVFS_CAP_NO_PACKET_SIZE_LIM 0x04
+ #define USBDEVFS_CAP_BULK_SCATTER_GATHER 0x08
++#define USBDEVFS_CAP_REAP_AFTER_DISCONNECT 0x10
+
+ /* USBDEVFS_DISCONNECT_CLAIM flags & struct */
+
+diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c
+index bf95fdad4d96..3b9f01ba363a 100644
+--- a/kernel/printk/printk.c
++++ b/kernel/printk/printk.c
+@@ -487,11 +487,11 @@ static int check_syslog_permissions(int type, bool from_file)
+ * already done the capabilities checks at open time.
+ */
+ if (from_file && type != SYSLOG_ACTION_OPEN)
+- return 0;
++ goto ok;
+
+ if (syslog_action_restricted(type)) {
+ if (capable(CAP_SYSLOG))
+- return 0;
++ goto ok;
+ /*
+ * For historical reasons, accept CAP_SYS_ADMIN too, with
+ * a warning.
+@@ -501,10 +501,11 @@ static int check_syslog_permissions(int type, bool from_file)
+ "CAP_SYS_ADMIN but no CAP_SYSLOG "
+ "(deprecated).\n",
+ current->comm, task_pid_nr(current));
+- return 0;
++ goto ok;
+ }
+ return -EPERM;
+ }
++ok:
+ return security_syslog(type);
+ }
+
+@@ -1266,10 +1267,6 @@ int do_syslog(int type, char __user *buf, int len, bool from_file)
+ if (error)
+ goto out;
+
+- error = security_syslog(type);
+- if (error)
+- return error;
+-
+ switch (type) {
+ case SYSLOG_ACTION_CLOSE: /* Close log */
+ break;
+diff --git a/kernel/trace/trace.h b/kernel/trace/trace.h
+index 385391fb1d3b..5642436bf97e 100644
+--- a/kernel/trace/trace.h
++++ b/kernel/trace/trace.h
+@@ -442,6 +442,7 @@ enum {
+
+ TRACE_CONTROL_BIT,
+
++ TRACE_BRANCH_BIT,
+ /*
+ * Abuse of the trace_recursion.
+ * As we need a way to maintain state if we are tracing the function
+diff --git a/kernel/trace/trace_branch.c b/kernel/trace/trace_branch.c
+index 697fb9bac8f0..60850b4fcb04 100644
+--- a/kernel/trace/trace_branch.c
++++ b/kernel/trace/trace_branch.c
+@@ -37,9 +37,12 @@ probe_likely_condition(struct ftrace_branch_data *f, int val, int expect)
+ struct trace_branch *entry;
+ struct ring_buffer *buffer;
+ unsigned long flags;
+- int cpu, pc;
++ int pc;
+ const char *p;
+
++ if (current->trace_recursion & TRACE_BRANCH_BIT)
++ return;
++
+ /*
+ * I would love to save just the ftrace_likely_data pointer, but
+ * this code can also be used by modules. Ugly things can happen
+@@ -50,10 +53,10 @@ probe_likely_condition(struct ftrace_branch_data *f, int val, int expect)
+ if (unlikely(!tr))
+ return;
+
+- local_irq_save(flags);
+- cpu = raw_smp_processor_id();
+- data = per_cpu_ptr(tr->trace_buffer.data, cpu);
+- if (atomic_inc_return(&data->disabled) != 1)
++ raw_local_irq_save(flags);
++ current->trace_recursion |= TRACE_BRANCH_BIT;
++ data = this_cpu_ptr(tr->trace_buffer.data);
++ if (atomic_read(&data->disabled))
+ goto out;
+
+ pc = preempt_count();
+@@ -82,8 +85,8 @@ probe_likely_condition(struct ftrace_branch_data *f, int val, int expect)
+ __buffer_unlock_commit(buffer, event);
+
+ out:
+- atomic_dec(&data->disabled);
+- local_irq_restore(flags);
++ current->trace_recursion &= ~TRACE_BRANCH_BIT;
++ raw_local_irq_restore(flags);
+ }
+
+ static inline
+diff --git a/kernel/trace/trace_events_filter.c b/kernel/trace/trace_events_filter.c
+index 51afcb76d32b..357b1ddf088b 100644
+--- a/kernel/trace/trace_events_filter.c
++++ b/kernel/trace/trace_events_filter.c
+@@ -1383,7 +1383,9 @@ static int check_preds(struct filter_parse_state *ps)
+ continue;
+ }
+ n_normal_preds++;
+- WARN_ON_ONCE(cnt < 0);
++ /* all ops should have operands */
++ if (cnt < 0)
++ break;
+ }
+
+ if (cnt != 1 || !n_normal_preds || n_logical_preds >= n_normal_preds) {
+diff --git a/lib/bitmap.c b/lib/bitmap.c
+index b499ab6ada29..2ed91904e806 100644
+--- a/lib/bitmap.c
++++ b/lib/bitmap.c
+@@ -610,12 +610,12 @@ static int __bitmap_parselist(const char *buf, unsigned int buflen,
+ unsigned a, b;
+ int c, old_c, totaldigits;
+ const char __user __force *ubuf = (const char __user __force *)buf;
+- int exp_digit, in_range;
++ int at_start, in_range;
+
+ totaldigits = c = 0;
+ bitmap_zero(maskp, nmaskbits);
+ do {
+- exp_digit = 1;
++ at_start = 1;
+ in_range = 0;
+ a = b = 0;
+
+@@ -644,11 +644,10 @@ static int __bitmap_parselist(const char *buf, unsigned int buflen,
+ break;
+
+ if (c == '-') {
+- if (exp_digit || in_range)
++ if (at_start || in_range)
+ return -EINVAL;
+ b = 0;
+ in_range = 1;
+- exp_digit = 1;
+ continue;
+ }
+
+@@ -658,16 +657,18 @@ static int __bitmap_parselist(const char *buf, unsigned int buflen,
+ b = b * 10 + (c - '0');
+ if (!in_range)
+ a = b;
+- exp_digit = 0;
++ at_start = 0;
+ totaldigits++;
+ }
+ if (!(a <= b))
+ return -EINVAL;
+ if (b >= nmaskbits)
+ return -ERANGE;
+- while (a <= b) {
+- set_bit(a, maskp);
+- a++;
++ if (!at_start) {
++ while (a <= b) {
++ set_bit(a, maskp);
++ a++;
++ }
+ }
+ } while (buflen && c == ',');
+ return 0;
+diff --git a/net/9p/client.c b/net/9p/client.c
+index e86a9bea1d16..53fe98ee8a55 100644
+--- a/net/9p/client.c
++++ b/net/9p/client.c
+@@ -850,7 +850,8 @@ static struct p9_req_t *p9_client_zc_rpc(struct p9_client *c, int8_t type,
+ if (err < 0) {
+ if (err == -EIO)
+ c->status = Disconnected;
+- goto reterr;
++ if (err != -ERESTARTSYS)
++ goto reterr;
+ }
+ if (req->status == REQ_STATUS_ERROR) {
+ p9_debug(P9_DEBUG_ERROR, "req_status error %d\n", req->t_err);
+diff --git a/net/can/af_can.c b/net/can/af_can.c
+index 9a3244941a5c..d6030d6949df 100644
+--- a/net/can/af_can.c
++++ b/net/can/af_can.c
+@@ -313,12 +313,8 @@ int can_send(struct sk_buff *skb, int loop)
+ return err;
+ }
+
+- if (newskb) {
+- if (!(newskb->tstamp.tv64))
+- __net_timestamp(newskb);
+-
++ if (newskb)
+ netif_rx_ni(newskb);
+- }
+
+ /* update statistics */
+ can_stats.tx_frames++;
+diff --git a/net/mac80211/main.c b/net/mac80211/main.c
+index 0de7c93bf62b..67943cb5df8a 100644
+--- a/net/mac80211/main.c
++++ b/net/mac80211/main.c
+@@ -249,6 +249,7 @@ static void ieee80211_restart_work(struct work_struct *work)
+ {
+ struct ieee80211_local *local =
+ container_of(work, struct ieee80211_local, restart_work);
++ struct ieee80211_sub_if_data *sdata;
+
+ /* wait for scan work complete */
+ flush_workqueue(local->workqueue);
+@@ -257,6 +258,8 @@ static void ieee80211_restart_work(struct work_struct *work)
+ "%s called with hardware scan in progress\n", __func__);
+
+ rtnl_lock();
++ list_for_each_entry(sdata, &local->interfaces, list)
++ flush_delayed_work(&sdata->dec_tailroom_needed_wk);
+ ieee80211_scan_cancel(local);
+ ieee80211_reconfig(local);
+ rtnl_unlock();
+diff --git a/security/integrity/evm/evm_main.c b/security/integrity/evm/evm_main.c
+index c5ee1a7c5e8a..4ada1a97a60b 100644
+--- a/security/integrity/evm/evm_main.c
++++ b/security/integrity/evm/evm_main.c
+@@ -22,6 +22,7 @@
+ #include <linux/xattr.h>
+ #include <linux/integrity.h>
+ #include <linux/evm.h>
++#include <linux/magic.h>
+ #include <crypto/hash.h>
+ #include "evm.h"
+
+@@ -291,6 +292,17 @@ static int evm_protect_xattr(struct dentry *dentry, const char *xattr_name,
+ iint = integrity_iint_find(dentry->d_inode);
+ if (iint && (iint->flags & IMA_NEW_FILE))
+ return 0;
++
++ /* exception for pseudo filesystems */
++ if (dentry->d_inode->i_sb->s_magic == TMPFS_MAGIC
++ || dentry->d_inode->i_sb->s_magic == SYSFS_MAGIC)
++ return 0;
++
++ integrity_audit_msg(AUDIT_INTEGRITY_METADATA,
++ dentry->d_inode, dentry->d_name.name,
++ "update_metadata",
++ integrity_status_msg[evm_status],
++ -EPERM, 0);
+ }
+ out:
+ if (evm_status != INTEGRITY_PASS)
+diff --git a/security/keys/keyring.c b/security/keys/keyring.c
+index e72548b5897e..d33437007ad2 100644
+--- a/security/keys/keyring.c
++++ b/security/keys/keyring.c
+@@ -1181,9 +1181,11 @@ void __key_link_end(struct key *keyring,
+ if (index_key->type == &key_type_keyring)
+ up_write(&keyring_serialise_link_sem);
+
+- if (edit && !edit->dead_leaf) {
+- key_payload_reserve(keyring,
+- keyring->datalen - KEYQUOTA_LINK_BYTES);
++ if (edit) {
++ if (!edit->dead_leaf) {
++ key_payload_reserve(keyring,
++ keyring->datalen - KEYQUOTA_LINK_BYTES);
++ }
+ assoc_array_cancel_edit(edit);
+ }
+ up_write(&keyring->sem);
+diff --git a/sound/soc/fsl/imx-wm8962.c b/sound/soc/fsl/imx-wm8962.c
+index 3a3d17ce6ba4..664452599497 100644
+--- a/sound/soc/fsl/imx-wm8962.c
++++ b/sound/soc/fsl/imx-wm8962.c
+@@ -190,7 +190,7 @@ static int imx_wm8962_probe(struct platform_device *pdev)
+ dev_err(&pdev->dev, "audmux internal port setup failed\n");
+ return ret;
+ }
+- imx_audmux_v2_configure_port(ext_port,
++ ret = imx_audmux_v2_configure_port(ext_port,
+ IMX_AUDMUX_V2_PTCR_SYN,
+ IMX_AUDMUX_V2_PDCR_RXDSEL(int_port));
+ if (ret) {
^ permalink raw reply related [flat|nested] 67+ messages in thread
* [gentoo-commits] proj/linux-patches:3.18 commit in: /
@ 2015-09-10 0:15 Mike Pagano
0 siblings, 0 replies; 67+ messages in thread
From: Mike Pagano @ 2015-09-10 0:15 UTC (permalink / raw
To: gentoo-commits
commit: 04c03de7a2870462c939837225541746df9057ea
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Thu Sep 10 00:02:49 2015 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Thu Sep 10 00:02:49 2015 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=04c03de7
Linux patch 3.18.21.
0000_README | 4 +
1020_linux-3.18.21.patch | 4025 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 4029 insertions(+)
diff --git a/0000_README b/0000_README
index 78fbad8..558f14f 100644
--- a/0000_README
+++ b/0000_README
@@ -123,6 +123,10 @@ Patch: 1019_linux-3.18.20.patch
From: http://www.kernel.org
Desc: Linux 3.18.20
+Patch: 1020_linux-3.18.21.patch
+From: http://www.kernel.org
+Desc: Linux 3.18.21
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1020_linux-3.18.21.patch b/1020_linux-3.18.21.patch
new file mode 100644
index 0000000..46bb2db
--- /dev/null
+++ b/1020_linux-3.18.21.patch
@@ -0,0 +1,4025 @@
+diff --git a/Documentation/ABI/testing/ima_policy b/Documentation/ABI/testing/ima_policy
+index d0d0c578324c..724cd429eac6 100644
+--- a/Documentation/ABI/testing/ima_policy
++++ b/Documentation/ABI/testing/ima_policy
+@@ -20,17 +20,19 @@ Description:
+ action: measure | dont_measure | appraise | dont_appraise | audit
+ condition:= base | lsm [option]
+ base: [[func=] [mask=] [fsmagic=] [fsuuid=] [uid=]
+- [fowner]]
++ [euid=] [fowner=]]
+ lsm: [[subj_user=] [subj_role=] [subj_type=]
+ [obj_user=] [obj_role=] [obj_type=]]
+ option: [[appraise_type=]] [permit_directio]
+
+ base: func:= [BPRM_CHECK][MMAP_CHECK][FILE_CHECK][MODULE_CHECK]
+ [FIRMWARE_CHECK]
+- mask:= [MAY_READ] [MAY_WRITE] [MAY_APPEND] [MAY_EXEC]
++ mask:= [[^]MAY_READ] [[^]MAY_WRITE] [[^]MAY_APPEND]
++ [[^]MAY_EXEC]
+ fsmagic:= hex value
+ fsuuid:= file system UUID (e.g 8bcbe394-4f13-4144-be8e-5aa9ea2ce2f6)
+ uid:= decimal value
++ euid:= decimal value
+ fowner:=decimal value
+ lsm: are LSM specific
+ option: appraise_type:= [imasig]
+diff --git a/Documentation/ABI/testing/sysfs-ata b/Documentation/ABI/testing/sysfs-ata
+index 0a932155cbba..9231daef3813 100644
+--- a/Documentation/ABI/testing/sysfs-ata
++++ b/Documentation/ABI/testing/sysfs-ata
+@@ -90,6 +90,17 @@ gscr
+ 130: SATA_PMP_GSCR_SII_GPIO
+ Only valid if the device is a PM.
+
++trim
++
++ Shows the DSM TRIM mode currently used by the device. Valid
++ values are:
++ unsupported: Drive does not support DSM TRIM
++ unqueued: Drive supports unqueued DSM TRIM only
++ queued: Drive supports queued DSM TRIM
++ forced_unqueued: Drive's unqueued DSM support is known to be
++ buggy and only unqueued TRIM commands
++ are sent
++
+ spdn_cnt
+
+ Number of time libata decided to lower the speed of link due to errors.
+diff --git a/Documentation/devicetree/bindings/clock/keystone-pll.txt b/Documentation/devicetree/bindings/clock/keystone-pll.txt
+index 225990f79b7c..47570d207215 100644
+--- a/Documentation/devicetree/bindings/clock/keystone-pll.txt
++++ b/Documentation/devicetree/bindings/clock/keystone-pll.txt
+@@ -15,8 +15,8 @@ Required properties:
+ - compatible : shall be "ti,keystone,main-pll-clock" or "ti,keystone,pll-clock"
+ - clocks : parent clock phandle
+ - reg - pll control0 and pll multipler registers
+-- reg-names : control and multiplier. The multiplier is applicable only for
+- main pll clock
++- reg-names : control, multiplier and post-divider. The multiplier and
++ post-divider registers are applicable only for main pll clock
+ - fixed-postdiv : fixed post divider value. If absent, use clkod register bits
+ for postdiv
+
+@@ -25,8 +25,8 @@ Example:
+ #clock-cells = <0>;
+ compatible = "ti,keystone,main-pll-clock";
+ clocks = <&refclksys>;
+- reg = <0x02620350 4>, <0x02310110 4>;
+- reg-names = "control", "multiplier";
++ reg = <0x02620350 4>, <0x02310110 4>, <0x02310108 4>;
++ reg-names = "control", "multiplier", "post-divider";
+ fixed-postdiv = <2>;
+ };
+
+diff --git a/Documentation/i2c/busses/i2c-i801 b/Documentation/i2c/busses/i2c-i801
+index 793c83dac738..82f48f774afb 100644
+--- a/Documentation/i2c/busses/i2c-i801
++++ b/Documentation/i2c/busses/i2c-i801
+@@ -29,6 +29,7 @@ Supported adapters:
+ * Intel Wildcat Point-LP (PCH)
+ * Intel BayTrail (SOC)
+ * Intel Sunrise Point-H (PCH)
++ * Intel Sunrise Point-LP (PCH)
+ Datasheets: Publicly available at the Intel website
+
+ On Intel Patsburg and later chipsets, both the normal host SMBus controller
+diff --git a/Makefile b/Makefile
+index 3ef589539cca..6be90fab361b 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 18
+-SUBLEVEL = 20
++SUBLEVEL = 21
+ EXTRAVERSION =
+ NAME = Diseased Newt
+
+diff --git a/arch/arm/boot/dts/imx35.dtsi b/arch/arm/boot/dts/imx35.dtsi
+index 6932928f3b45..667eb6a45f59 100644
+--- a/arch/arm/boot/dts/imx35.dtsi
++++ b/arch/arm/boot/dts/imx35.dtsi
+@@ -286,8 +286,8 @@
+ can1: can@53fe4000 {
+ compatible = "fsl,imx35-flexcan", "fsl,p1010-flexcan";
+ reg = <0x53fe4000 0x1000>;
+- clocks = <&clks 33>;
+- clock-names = "ipg";
++ clocks = <&clks 33>, <&clks 33>;
++ clock-names = "ipg", "per";
+ interrupts = <43>;
+ status = "disabled";
+ };
+@@ -295,8 +295,8 @@
+ can2: can@53fe8000 {
+ compatible = "fsl,imx35-flexcan", "fsl,p1010-flexcan";
+ reg = <0x53fe8000 0x1000>;
+- clocks = <&clks 34>;
+- clock-names = "ipg";
++ clocks = <&clks 34>, <&clks 34>;
++ clock-names = "ipg", "per";
+ interrupts = <44>;
+ status = "disabled";
+ };
+diff --git a/arch/arm/boot/dts/k2e-clocks.dtsi b/arch/arm/boot/dts/k2e-clocks.dtsi
+index 4773d6af66a0..d56d68fe7ffc 100644
+--- a/arch/arm/boot/dts/k2e-clocks.dtsi
++++ b/arch/arm/boot/dts/k2e-clocks.dtsi
+@@ -13,9 +13,8 @@ clocks {
+ #clock-cells = <0>;
+ compatible = "ti,keystone,main-pll-clock";
+ clocks = <&refclksys>;
+- reg = <0x02620350 4>, <0x02310110 4>;
+- reg-names = "control", "multiplier";
+- fixed-postdiv = <2>;
++ reg = <0x02620350 4>, <0x02310110 4>, <0x02310108 4>;
++ reg-names = "control", "multiplier", "post-divider";
+ };
+
+ papllclk: papllclk@2620358 {
+diff --git a/arch/arm/boot/dts/k2hk-clocks.dtsi b/arch/arm/boot/dts/k2hk-clocks.dtsi
+index d5adee3c0067..af9b7190533a 100644
+--- a/arch/arm/boot/dts/k2hk-clocks.dtsi
++++ b/arch/arm/boot/dts/k2hk-clocks.dtsi
+@@ -22,9 +22,8 @@ clocks {
+ #clock-cells = <0>;
+ compatible = "ti,keystone,main-pll-clock";
+ clocks = <&refclksys>;
+- reg = <0x02620350 4>, <0x02310110 4>;
+- reg-names = "control", "multiplier";
+- fixed-postdiv = <2>;
++ reg = <0x02620350 4>, <0x02310110 4>, <0x02310108 4>;
++ reg-names = "control", "multiplier", "post-divider";
+ };
+
+ papllclk: papllclk@2620358 {
+diff --git a/arch/arm/boot/dts/k2l-clocks.dtsi b/arch/arm/boot/dts/k2l-clocks.dtsi
+index eb1e3e29f073..ef8464bb11ff 100644
+--- a/arch/arm/boot/dts/k2l-clocks.dtsi
++++ b/arch/arm/boot/dts/k2l-clocks.dtsi
+@@ -22,9 +22,8 @@ clocks {
+ #clock-cells = <0>;
+ compatible = "ti,keystone,main-pll-clock";
+ clocks = <&refclksys>;
+- reg = <0x02620350 4>, <0x02310110 4>;
+- reg-names = "control", "multiplier";
+- fixed-postdiv = <2>;
++ reg = <0x02620350 4>, <0x02310110 4>, <0x02310108 4>;
++ reg-names = "control", "multiplier", "post-divider";
+ };
+
+ papllclk: papllclk@2620358 {
+diff --git a/arch/arm/mach-omap2/omap_hwmod.c b/arch/arm/mach-omap2/omap_hwmod.c
+index 716247ed9e0c..bb9a148af8cc 100644
+--- a/arch/arm/mach-omap2/omap_hwmod.c
++++ b/arch/arm/mach-omap2/omap_hwmod.c
+@@ -2452,6 +2452,9 @@ static int of_dev_hwmod_lookup(struct device_node *np,
+ * registers. This address is needed early so the OCP registers that
+ * are part of the device's address space can be ioremapped properly.
+ *
++ * If SYSC access is not needed, the registers will not be remapped
++ * and non-availability of MPU access is not treated as an error.
++ *
+ * Returns 0 on success, -EINVAL if an invalid hwmod is passed, and
+ * -ENXIO on absent or invalid register target address space.
+ */
+@@ -2466,6 +2469,11 @@ static int __init _init_mpu_rt_base(struct omap_hwmod *oh, void *data,
+
+ _save_mpu_port_index(oh);
+
++ /* if we don't need sysc access we don't need to ioremap */
++ if (!oh->class->sysc)
++ return 0;
++
++ /* we can't continue without MPU PORT if we need sysc access */
+ if (oh->_int_flags & _HWMOD_NO_MPU_PORT)
+ return -ENXIO;
+
+@@ -2475,8 +2483,10 @@ static int __init _init_mpu_rt_base(struct omap_hwmod *oh, void *data,
+ oh->name);
+
+ /* Extract the IO space from device tree blob */
+- if (!np)
++ if (!np) {
++ pr_err("omap_hwmod: %s: no dt node\n", oh->name);
+ return -ENXIO;
++ }
+
+ va_start = of_iomap(np, index + oh->mpu_rt_idx);
+ } else {
+@@ -2535,13 +2545,11 @@ static int __init _init(struct omap_hwmod *oh, void *data)
+ oh->name, np->name);
+ }
+
+- if (oh->class->sysc) {
+- r = _init_mpu_rt_base(oh, NULL, index, np);
+- if (r < 0) {
+- WARN(1, "omap_hwmod: %s: doesn't have mpu register target base\n",
+- oh->name);
+- return 0;
+- }
++ r = _init_mpu_rt_base(oh, NULL, index, np);
++ if (r < 0) {
++ WARN(1, "omap_hwmod: %s: doesn't have mpu register target base\n",
++ oh->name);
++ return 0;
+ }
+
+ r = _init_clocks(oh, NULL);
+diff --git a/arch/arm64/kernel/signal32.c b/arch/arm64/kernel/signal32.c
+index 76920d4040d4..b4efc2e38336 100644
+--- a/arch/arm64/kernel/signal32.c
++++ b/arch/arm64/kernel/signal32.c
+@@ -168,7 +168,8 @@ int copy_siginfo_to_user32(compat_siginfo_t __user *to, const siginfo_t *from)
+ * Other callers might not initialize the si_lsb field,
+ * so check explicitely for the right codes here.
+ */
+- if (from->si_code == BUS_MCEERR_AR || from->si_code == BUS_MCEERR_AO)
++ if (from->si_signo == SIGBUS &&
++ (from->si_code == BUS_MCEERR_AR || from->si_code == BUS_MCEERR_AO))
+ err |= __put_user(from->si_addr_lsb, &to->si_addr_lsb);
+ #endif
+ break;
+@@ -195,8 +196,6 @@ int copy_siginfo_to_user32(compat_siginfo_t __user *to, const siginfo_t *from)
+
+ int copy_siginfo_from_user32(siginfo_t *to, compat_siginfo_t __user *from)
+ {
+- memset(to, 0, sizeof *to);
+-
+ if (copy_from_user(to, from, __ARCH_SI_PREAMBLE_SIZE) ||
+ copy_from_user(to->_sifields._pad,
+ from->_sifields._pad, SI_PAD_SIZE))
+diff --git a/arch/arm64/mm/mmap.c b/arch/arm64/mm/mmap.c
+index 1d73662f00ff..54922d1275b8 100644
+--- a/arch/arm64/mm/mmap.c
++++ b/arch/arm64/mm/mmap.c
+@@ -47,22 +47,14 @@ static int mmap_is_legacy(void)
+ return sysctl_legacy_va_layout;
+ }
+
+-/*
+- * Since get_random_int() returns the same value within a 1 jiffy window, we
+- * will almost always get the same randomisation for the stack and mmap
+- * region. This will mean the relative distance between stack and mmap will be
+- * the same.
+- *
+- * To avoid this we can shift the randomness by 1 bit.
+- */
+ static unsigned long mmap_rnd(void)
+ {
+ unsigned long rnd = 0;
+
+ if (current->flags & PF_RANDOMIZE)
+- rnd = (long)get_random_int() & (STACK_RND_MASK >> 1);
++ rnd = (long)get_random_int() & STACK_RND_MASK;
+
+- return rnd << (PAGE_SHIFT + 1);
++ return rnd << PAGE_SHIFT;
+ }
+
+ static unsigned long mmap_base(void)
+diff --git a/arch/avr32/mach-at32ap/clock.c b/arch/avr32/mach-at32ap/clock.c
+index 23b1a97fae7a..52c179bec0cc 100644
+--- a/arch/avr32/mach-at32ap/clock.c
++++ b/arch/avr32/mach-at32ap/clock.c
+@@ -80,6 +80,9 @@ int clk_enable(struct clk *clk)
+ {
+ unsigned long flags;
+
++ if (!clk)
++ return 0;
++
+ spin_lock_irqsave(&clk_lock, flags);
+ __clk_enable(clk);
+ spin_unlock_irqrestore(&clk_lock, flags);
+@@ -106,6 +109,9 @@ void clk_disable(struct clk *clk)
+ {
+ unsigned long flags;
+
++ if (IS_ERR_OR_NULL(clk))
++ return;
++
+ spin_lock_irqsave(&clk_lock, flags);
+ __clk_disable(clk);
+ spin_unlock_irqrestore(&clk_lock, flags);
+@@ -117,6 +123,9 @@ unsigned long clk_get_rate(struct clk *clk)
+ unsigned long flags;
+ unsigned long rate;
+
++ if (!clk)
++ return 0;
++
+ spin_lock_irqsave(&clk_lock, flags);
+ rate = clk->get_rate(clk);
+ spin_unlock_irqrestore(&clk_lock, flags);
+@@ -129,6 +138,9 @@ long clk_round_rate(struct clk *clk, unsigned long rate)
+ {
+ unsigned long flags, actual_rate;
+
++ if (!clk)
++ return 0;
++
+ if (!clk->set_rate)
+ return -ENOSYS;
+
+@@ -145,6 +157,9 @@ int clk_set_rate(struct clk *clk, unsigned long rate)
+ unsigned long flags;
+ long ret;
+
++ if (!clk)
++ return 0;
++
+ if (!clk->set_rate)
+ return -ENOSYS;
+
+@@ -161,6 +176,9 @@ int clk_set_parent(struct clk *clk, struct clk *parent)
+ unsigned long flags;
+ int ret;
+
++ if (!clk)
++ return 0;
++
+ if (!clk->set_parent)
+ return -ENOSYS;
+
+@@ -174,7 +192,7 @@ EXPORT_SYMBOL(clk_set_parent);
+
+ struct clk *clk_get_parent(struct clk *clk)
+ {
+- return clk->parent;
++ return !clk ? NULL : clk->parent;
+ }
+ EXPORT_SYMBOL(clk_get_parent);
+
+diff --git a/arch/mips/include/asm/pgtable.h b/arch/mips/include/asm/pgtable.h
+index bc3fc4fdc9ab..060fc2e50cd2 100644
+--- a/arch/mips/include/asm/pgtable.h
++++ b/arch/mips/include/asm/pgtable.h
+@@ -187,8 +187,39 @@ static inline void set_pte(pte_t *ptep, pte_t pteval)
+ * Make sure the buddy is global too (if it's !none,
+ * it better already be global)
+ */
++#ifdef CONFIG_SMP
++ /*
++ * For SMP, multiple CPUs can race, so we need to do
++ * this atomically.
++ */
++#ifdef CONFIG_64BIT
++#define LL_INSN "lld"
++#define SC_INSN "scd"
++#else /* CONFIG_32BIT */
++#define LL_INSN "ll"
++#define SC_INSN "sc"
++#endif
++ unsigned long page_global = _PAGE_GLOBAL;
++ unsigned long tmp;
++
++ __asm__ __volatile__ (
++ " .set push\n"
++ " .set noreorder\n"
++ "1: " LL_INSN " %[tmp], %[buddy]\n"
++ " bnez %[tmp], 2f\n"
++ " or %[tmp], %[tmp], %[global]\n"
++ " " SC_INSN " %[tmp], %[buddy]\n"
++ " beqz %[tmp], 1b\n"
++ " nop\n"
++ "2:\n"
++ " .set pop"
++ : [buddy] "+m" (buddy->pte),
++ [tmp] "=&r" (tmp)
++ : [global] "r" (page_global));
++#else /* !CONFIG_SMP */
+ if (pte_none(*buddy))
+ pte_val(*buddy) = pte_val(*buddy) | _PAGE_GLOBAL;
++#endif /* CONFIG_SMP */
+ }
+ #endif
+ }
+diff --git a/arch/mips/include/asm/stackframe.h b/arch/mips/include/asm/stackframe.h
+index b188c797565c..0562a24dc615 100644
+--- a/arch/mips/include/asm/stackframe.h
++++ b/arch/mips/include/asm/stackframe.h
+@@ -152,6 +152,31 @@
+ .set noreorder
+ bltz k0, 8f
+ move k1, sp
++#ifdef CONFIG_EVA
++ /*
++ * Flush interAptiv's Return Prediction Stack (RPS) by writing
++ * EntryHi. Toggling Config7.RPS is slower and less portable.
++ *
++ * The RPS isn't automatically flushed when exceptions are
++ * taken, which can result in kernel mode speculative accesses
++ * to user addresses if the RPS mispredicts. That's harmless
++ * when user and kernel share the same address space, but with
++ * EVA the same user segments may be unmapped to kernel mode,
++ * even containing sensitive MMIO regions or invalid memory.
++ *
++ * This can happen when the kernel sets the return address to
++ * ret_from_* and jr's to the exception handler, which looks
++ * more like a tail call than a function call. If nested calls
++ * don't evict the last user address in the RPS, it will
++ * mispredict the return and fetch from a user controlled
++ * address into the icache.
++ *
++ * More recent EVA-capable cores with MAAR to restrict
++ * speculative accesses aren't affected.
++ */
++ MFC0 k0, CP0_ENTRYHI
++ MTC0 k0, CP0_ENTRYHI
++#endif
+ .set reorder
+ /* Called from user mode, new stack. */
+ get_saved_sp
+diff --git a/arch/mips/kernel/mips-mt-fpaff.c b/arch/mips/kernel/mips-mt-fpaff.c
+index 362bb3707e62..116c67a5320a 100644
+--- a/arch/mips/kernel/mips-mt-fpaff.c
++++ b/arch/mips/kernel/mips-mt-fpaff.c
+@@ -154,7 +154,7 @@ asmlinkage long mipsmt_sys_sched_getaffinity(pid_t pid, unsigned int len,
+ unsigned long __user *user_mask_ptr)
+ {
+ unsigned int real_len;
+- cpumask_t mask;
++ cpumask_t allowed, mask;
+ int retval;
+ struct task_struct *p;
+
+@@ -173,7 +173,8 @@ asmlinkage long mipsmt_sys_sched_getaffinity(pid_t pid, unsigned int len,
+ if (retval)
+ goto out_unlock;
+
+- cpumask_and(&mask, &p->thread.user_cpus_allowed, cpu_possible_mask);
++ cpumask_or(&allowed, &p->thread.user_cpus_allowed, &p->cpus_allowed);
++ cpumask_and(&mask, &allowed, cpu_active_mask);
+
+ out_unlock:
+ read_unlock(&tasklist_lock);
+diff --git a/arch/mips/kernel/signal32.c b/arch/mips/kernel/signal32.c
+index d69179c0d49d..f019f100a4bd 100644
+--- a/arch/mips/kernel/signal32.c
++++ b/arch/mips/kernel/signal32.c
+@@ -409,8 +409,6 @@ int copy_siginfo_to_user32(compat_siginfo_t __user *to, const siginfo_t *from)
+
+ int copy_siginfo_from_user32(siginfo_t *to, compat_siginfo_t __user *from)
+ {
+- memset(to, 0, sizeof *to);
+-
+ if (copy_from_user(to, from, 3*sizeof(int)) ||
+ copy_from_user(to->_sifields._pad,
+ from->_sifields._pad, SI_PAD_SIZE32))
+diff --git a/arch/mips/kernel/traps.c b/arch/mips/kernel/traps.c
+index d255a2a1837a..f506c53cb4f5 100644
+--- a/arch/mips/kernel/traps.c
++++ b/arch/mips/kernel/traps.c
+@@ -190,6 +190,7 @@ static void show_stacktrace(struct task_struct *task,
+ void show_stack(struct task_struct *task, unsigned long *sp)
+ {
+ struct pt_regs regs;
++ mm_segment_t old_fs = get_fs();
+ if (sp) {
+ regs.regs[29] = (unsigned long)sp;
+ regs.regs[31] = 0;
+@@ -208,7 +209,13 @@ void show_stack(struct task_struct *task, unsigned long *sp)
+ prepare_frametrace(®s);
+ }
+ }
++ /*
++ * show_stack() deals exclusively with kernel mode, so be sure to access
++ * the stack in the kernel (not user) address space.
++ */
++ set_fs(KERNEL_DS);
+ show_stacktrace(task, ®s);
++ set_fs(old_fs);
+ }
+
+ static void show_code(unsigned int __user *pc)
+@@ -1376,6 +1383,7 @@ asmlinkage void do_mcheck(struct pt_regs *regs)
+ const int field = 2 * sizeof(unsigned long);
+ int multi_match = regs->cp0_status & ST0_TS;
+ enum ctx_state prev_state;
++ mm_segment_t old_fs = get_fs();
+
+ prev_state = exception_enter();
+ show_regs(regs);
+@@ -1390,8 +1398,13 @@ asmlinkage void do_mcheck(struct pt_regs *regs)
+ dump_tlb_all();
+ }
+
++ if (!user_mode(regs))
++ set_fs(KERNEL_DS);
++
+ show_code((unsigned int __user *) regs->cp0_epc);
+
++ set_fs(old_fs);
++
+ /*
+ * Some chips may have other causes of machine check (e.g. SB1
+ * graduation timer)
+diff --git a/arch/mips/mti-malta/malta-time.c b/arch/mips/mti-malta/malta-time.c
+index 3778a359f3ad..38748da2a9d6 100644
+--- a/arch/mips/mti-malta/malta-time.c
++++ b/arch/mips/mti-malta/malta-time.c
+@@ -158,14 +158,17 @@ unsigned int get_c0_compare_int(void)
+
+ static void __init init_rtc(void)
+ {
+- /* stop the clock whilst setting it up */
+- CMOS_WRITE(RTC_SET | RTC_24H, RTC_CONTROL);
++ unsigned char freq, ctrl;
+
+- /* 32KHz time base */
+- CMOS_WRITE(RTC_REF_CLCK_32KHZ, RTC_FREQ_SELECT);
++ /* Set 32KHz time base if not already set */
++ freq = CMOS_READ(RTC_FREQ_SELECT);
++ if ((freq & RTC_DIV_CTL) != RTC_REF_CLCK_32KHZ)
++ CMOS_WRITE(RTC_REF_CLCK_32KHZ, RTC_FREQ_SELECT);
+
+- /* start the clock */
+- CMOS_WRITE(RTC_24H, RTC_CONTROL);
++ /* Ensure SET bit is clear so RTC can run */
++ ctrl = CMOS_READ(RTC_CONTROL);
++ if (ctrl & RTC_SET)
++ CMOS_WRITE(ctrl & ~RTC_SET, RTC_CONTROL);
+ }
+
+ void __init plat_time_init(void)
+diff --git a/arch/powerpc/kernel/signal_32.c b/arch/powerpc/kernel/signal_32.c
+index b171001698ff..28f36b9c0e55 100644
+--- a/arch/powerpc/kernel/signal_32.c
++++ b/arch/powerpc/kernel/signal_32.c
+@@ -966,8 +966,6 @@ int copy_siginfo_to_user32(struct compat_siginfo __user *d, const siginfo_t *s)
+
+ int copy_siginfo_from_user32(siginfo_t *to, struct compat_siginfo __user *from)
+ {
+- memset(to, 0, sizeof *to);
+-
+ if (copy_from_user(to, from, 3*sizeof(int)) ||
+ copy_from_user(to->_sifields._pad,
+ from->_sifields._pad, SI_PAD_SIZE32))
+diff --git a/arch/s390/include/asm/kexec.h b/arch/s390/include/asm/kexec.h
+index 694bcd6bd927..2f924bc30e35 100644
+--- a/arch/s390/include/asm/kexec.h
++++ b/arch/s390/include/asm/kexec.h
+@@ -26,6 +26,9 @@
+ /* Not more than 2GB */
+ #define KEXEC_CONTROL_MEMORY_LIMIT (1UL<<31)
+
++/* Allocate control page with GFP_DMA */
++#define KEXEC_CONTROL_MEMORY_GFP GFP_DMA
++
+ /* Maximum address we can use for the crash control pages */
+ #define KEXEC_CRASH_CONTROL_MEMORY_LIMIT (-1UL)
+
+diff --git a/arch/s390/kernel/sclp.S b/arch/s390/kernel/sclp.S
+index a41f2c99dcc8..a0c4e7652647 100644
+--- a/arch/s390/kernel/sclp.S
++++ b/arch/s390/kernel/sclp.S
+@@ -277,6 +277,8 @@ ENTRY(_sclp_print_early)
+ jno .Lesa2
+ ahi %r15,-80
+ stmh %r6,%r15,96(%r15) # store upper register halves
++ basr %r13,0
++ lmh %r0,%r15,.Lzeroes-.(%r13) # clear upper register halves
+ .Lesa2:
+ #endif
+ lr %r10,%r2 # save string pointer
+@@ -300,6 +302,8 @@ ENTRY(_sclp_print_early)
+ #endif
+ lm %r6,%r15,120(%r15) # restore registers
+ br %r14
++.Lzeroes:
++ .fill 64,4,0
+
+ .LwritedataS4:
+ .long 0x00760005 # SCLP command for write data
+diff --git a/arch/sparc/include/asm/visasm.h b/arch/sparc/include/asm/visasm.h
+index 1f0aa2024e94..6424249d5f78 100644
+--- a/arch/sparc/include/asm/visasm.h
++++ b/arch/sparc/include/asm/visasm.h
+@@ -28,16 +28,10 @@
+ * Must preserve %o5 between VISEntryHalf and VISExitHalf */
+
+ #define VISEntryHalf \
+- rd %fprs, %o5; \
+- andcc %o5, FPRS_FEF, %g0; \
+- be,pt %icc, 297f; \
+- sethi %hi(298f), %g7; \
+- sethi %hi(VISenterhalf), %g1; \
+- jmpl %g1 + %lo(VISenterhalf), %g0; \
+- or %g7, %lo(298f), %g7; \
+- clr %o5; \
+-297: wr %o5, FPRS_FEF, %fprs; \
+-298:
++ VISEntry
++
++#define VISExitHalf \
++ VISExit
+
+ #define VISEntryHalfFast(fail_label) \
+ rd %fprs, %o5; \
+@@ -47,7 +41,7 @@
+ ba,a,pt %xcc, fail_label; \
+ 297: wr %o5, FPRS_FEF, %fprs;
+
+-#define VISExitHalf \
++#define VISExitHalfFast \
+ wr %o5, 0, %fprs;
+
+ #ifndef __ASSEMBLY__
+diff --git a/arch/sparc/lib/NG4memcpy.S b/arch/sparc/lib/NG4memcpy.S
+index 140527a20e7d..83aeeb1dffdb 100644
+--- a/arch/sparc/lib/NG4memcpy.S
++++ b/arch/sparc/lib/NG4memcpy.S
+@@ -240,8 +240,11 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */
+ add %o0, 0x40, %o0
+ bne,pt %icc, 1b
+ LOAD(prefetch, %g1 + 0x200, #n_reads_strong)
++#ifdef NON_USER_COPY
++ VISExitHalfFast
++#else
+ VISExitHalf
+-
++#endif
+ brz,pn %o2, .Lexit
+ cmp %o2, 19
+ ble,pn %icc, .Lsmall_unaligned
+diff --git a/arch/sparc/lib/VISsave.S b/arch/sparc/lib/VISsave.S
+index b320ae9e2e2e..a063d84336d6 100644
+--- a/arch/sparc/lib/VISsave.S
++++ b/arch/sparc/lib/VISsave.S
+@@ -44,9 +44,8 @@ vis1: ldub [%g6 + TI_FPSAVED], %g3
+
+ stx %g3, [%g6 + TI_GSR]
+ 2: add %g6, %g1, %g3
+- cmp %o5, FPRS_DU
+- be,pn %icc, 6f
+- sll %g1, 3, %g1
++ mov FPRS_DU | FPRS_DL | FPRS_FEF, %o5
++ sll %g1, 3, %g1
+ stb %o5, [%g3 + TI_FPSAVED]
+ rd %gsr, %g2
+ add %g6, %g1, %g3
+@@ -80,65 +79,3 @@ vis1: ldub [%g6 + TI_FPSAVED], %g3
+ .align 32
+ 80: jmpl %g7 + %g0, %g0
+ nop
+-
+-6: ldub [%g3 + TI_FPSAVED], %o5
+- or %o5, FPRS_DU, %o5
+- add %g6, TI_FPREGS+0x80, %g2
+- stb %o5, [%g3 + TI_FPSAVED]
+-
+- sll %g1, 5, %g1
+- add %g6, TI_FPREGS+0xc0, %g3
+- wr %g0, FPRS_FEF, %fprs
+- membar #Sync
+- stda %f32, [%g2 + %g1] ASI_BLK_P
+- stda %f48, [%g3 + %g1] ASI_BLK_P
+- membar #Sync
+- ba,pt %xcc, 80f
+- nop
+-
+- .align 32
+-80: jmpl %g7 + %g0, %g0
+- nop
+-
+- .align 32
+-VISenterhalf:
+- ldub [%g6 + TI_FPDEPTH], %g1
+- brnz,a,pn %g1, 1f
+- cmp %g1, 1
+- stb %g0, [%g6 + TI_FPSAVED]
+- stx %fsr, [%g6 + TI_XFSR]
+- clr %o5
+- jmpl %g7 + %g0, %g0
+- wr %g0, FPRS_FEF, %fprs
+-
+-1: bne,pn %icc, 2f
+- srl %g1, 1, %g1
+- ba,pt %xcc, vis1
+- sub %g7, 8, %g7
+-2: addcc %g6, %g1, %g3
+- sll %g1, 3, %g1
+- andn %o5, FPRS_DU, %g2
+- stb %g2, [%g3 + TI_FPSAVED]
+-
+- rd %gsr, %g2
+- add %g6, %g1, %g3
+- stx %g2, [%g3 + TI_GSR]
+- add %g6, %g1, %g2
+- stx %fsr, [%g2 + TI_XFSR]
+- sll %g1, 5, %g1
+-3: andcc %o5, FPRS_DL, %g0
+- be,pn %icc, 4f
+- add %g6, TI_FPREGS, %g2
+-
+- add %g6, TI_FPREGS+0x40, %g3
+- membar #Sync
+- stda %f0, [%g2 + %g1] ASI_BLK_P
+- stda %f16, [%g3 + %g1] ASI_BLK_P
+- membar #Sync
+- ba,pt %xcc, 4f
+- nop
+-
+- .align 32
+-4: and %o5, FPRS_DU, %o5
+- jmpl %g7 + %g0, %g0
+- wr %o5, FPRS_FEF, %fprs
+diff --git a/arch/sparc/lib/ksyms.c b/arch/sparc/lib/ksyms.c
+index 1d649a95660c..8069ce12f20b 100644
+--- a/arch/sparc/lib/ksyms.c
++++ b/arch/sparc/lib/ksyms.c
+@@ -135,10 +135,6 @@ EXPORT_SYMBOL(copy_user_page);
+ void VISenter(void);
+ EXPORT_SYMBOL(VISenter);
+
+-/* CRYPTO code needs this */
+-void VISenterhalf(void);
+-EXPORT_SYMBOL(VISenterhalf);
+-
+ extern void xor_vis_2(unsigned long, unsigned long *, unsigned long *);
+ extern void xor_vis_3(unsigned long, unsigned long *, unsigned long *,
+ unsigned long *);
+diff --git a/arch/tile/kernel/setup.c b/arch/tile/kernel/setup.c
+index b9736ded06f2..656224502dfc 100644
+--- a/arch/tile/kernel/setup.c
++++ b/arch/tile/kernel/setup.c
+@@ -1144,7 +1144,7 @@ static void __init load_hv_initrd(void)
+
+ void __init free_initrd_mem(unsigned long begin, unsigned long end)
+ {
+- free_bootmem(__pa(begin), end - begin);
++ free_bootmem_late(__pa(begin), end - begin);
+ }
+
+ static int __init setup_initrd(char *str)
+diff --git a/arch/x86/boot/compressed/eboot.c b/arch/x86/boot/compressed/eboot.c
+index 3790a66d6898..acdf06bc418b 100644
+--- a/arch/x86/boot/compressed/eboot.c
++++ b/arch/x86/boot/compressed/eboot.c
+@@ -1194,6 +1194,10 @@ static efi_status_t setup_e820(struct boot_params *params,
+ unsigned int e820_type = 0;
+ unsigned long m = efi->efi_memmap;
+
++#ifdef CONFIG_X86_64
++ m |= (u64)efi->efi_memmap_hi << 32;
++#endif
++
+ d = (efi_memory_desc_t *)(m + (i * efi->efi_memdesc_size));
+ switch (d->type) {
+ case EFI_RESERVED_TYPE:
+diff --git a/arch/x86/kvm/lapic.h b/arch/x86/kvm/lapic.h
+index 6a11845fd8b9..72051730caf1 100644
+--- a/arch/x86/kvm/lapic.h
++++ b/arch/x86/kvm/lapic.h
+@@ -165,7 +165,7 @@ static inline u16 apic_logical_id(struct kvm_apic_map *map, u32 ldr)
+
+ static inline bool kvm_apic_has_events(struct kvm_vcpu *vcpu)
+ {
+- return vcpu->arch.apic->pending_events;
++ return kvm_vcpu_has_lapic(vcpu) && vcpu->arch.apic->pending_events;
+ }
+
+ bool kvm_apic_pending_eoi(struct kvm_vcpu *vcpu, int vector);
+diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
+index 7d67146c3f87..e180e097a53a 100644
+--- a/arch/x86/xen/enlighten.c
++++ b/arch/x86/xen/enlighten.c
+@@ -481,6 +481,7 @@ static void set_aliased_prot(void *v, pgprot_t prot)
+ pte_t pte;
+ unsigned long pfn;
+ struct page *page;
++ unsigned char dummy;
+
+ ptep = lookup_address((unsigned long)v, &level);
+ BUG_ON(ptep == NULL);
+@@ -490,6 +491,32 @@ static void set_aliased_prot(void *v, pgprot_t prot)
+
+ pte = pfn_pte(pfn, prot);
+
++ /*
++ * Careful: update_va_mapping() will fail if the virtual address
++ * we're poking isn't populated in the page tables. We don't
++ * need to worry about the direct map (that's always in the page
++ * tables), but we need to be careful about vmap space. In
++ * particular, the top level page table can lazily propagate
++ * entries between processes, so if we've switched mms since we
++ * vmapped the target in the first place, we might not have the
++ * top-level page table entry populated.
++ *
++ * We disable preemption because we want the same mm active when
++ * we probe the target and when we issue the hypercall. We'll
++ * have the same nominal mm, but if we're a kernel thread, lazy
++ * mm dropping could change our pgd.
++ *
++ * Out of an abundance of caution, this uses __get_user() to fault
++ * in the target address just in case there's some obscure case
++ * in which the target address isn't readable.
++ */
++
++ preempt_disable();
++
++ pagefault_disable(); /* Avoid warnings due to being atomic. */
++ __get_user(dummy, (unsigned char __user __force *)v);
++ pagefault_enable();
++
+ if (HYPERVISOR_update_va_mapping((unsigned long)v, pte, 0))
+ BUG();
+
+@@ -501,6 +528,8 @@ static void set_aliased_prot(void *v, pgprot_t prot)
+ BUG();
+ } else
+ kmap_flush_unused();
++
++ preempt_enable();
+ }
+
+ static void xen_alloc_ldt(struct desc_struct *ldt, unsigned entries)
+@@ -508,6 +537,17 @@ static void xen_alloc_ldt(struct desc_struct *ldt, unsigned entries)
+ const unsigned entries_per_page = PAGE_SIZE / LDT_ENTRY_SIZE;
+ int i;
+
++ /*
++ * We need to mark the all aliases of the LDT pages RO. We
++ * don't need to call vm_flush_aliases(), though, since that's
++ * only responsible for flushing aliases out the TLBs, not the
++ * page tables, and Xen will flush the TLB for us if needed.
++ *
++ * To avoid confusing future readers: none of this is necessary
++ * to load the LDT. The hypervisor only checks this when the
++ * LDT is faulted in due to subsequent descriptor access.
++ */
++
+ for(i = 0; i < entries; i += entries_per_page)
+ set_aliased_prot(ldt + i, PAGE_KERNEL_RO);
+ }
+diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c
+index 0ac817b750db..6817e28960b7 100644
+--- a/block/blk-cgroup.c
++++ b/block/blk-cgroup.c
+@@ -716,8 +716,12 @@ int blkg_conf_prep(struct blkcg *blkcg, const struct blkcg_policy *pol,
+ return -EINVAL;
+
+ disk = get_gendisk(MKDEV(major, minor), &part);
+- if (!disk || part)
++ if (!disk)
+ return -EINVAL;
++ if (part) {
++ put_disk(disk);
++ return -EINVAL;
++ }
+
+ rcu_read_lock();
+ spin_lock_irq(disk->queue->queue_lock);
+diff --git a/drivers/acpi/bus.c b/drivers/acpi/bus.c
+index 8b67bd0f6bb5..cd4598b2038d 100644
+--- a/drivers/acpi/bus.c
++++ b/drivers/acpi/bus.c
+@@ -467,6 +467,16 @@ static int __init acpi_bus_init_irq(void)
+ return 0;
+ }
+
++/**
++ * acpi_early_init - Initialize ACPICA and populate the ACPI namespace.
++ *
++ * The ACPI tables are accessible after this, but the handling of events has not
++ * been initialized and the global lock is not available yet, so AML should not
++ * be executed at this point.
++ *
++ * Doing this before switching the EFI runtime services to virtual mode allows
++ * the EfiBootServices memory to be freed slightly earlier on boot.
++ */
+ void __init acpi_early_init(void)
+ {
+ acpi_status status;
+@@ -530,26 +540,42 @@ void __init acpi_early_init(void)
+ acpi_gbl_FADT.sci_interrupt = acpi_sci_override_gsi;
+ }
+ #endif
++ return;
++
++ error0:
++ disable_acpi();
++}
++
++/**
++ * acpi_subsystem_init - Finalize the early initialization of ACPI.
++ *
++ * Switch over the platform to the ACPI mode (if possible), initialize the
++ * handling of ACPI events, install the interrupt and global lock handlers.
++ *
++ * Doing this too early is generally unsafe, but at the same time it needs to be
++ * done before all things that really depend on ACPI. The right spot appears to
++ * be before finalizing the EFI initialization.
++ */
++void __init acpi_subsystem_init(void)
++{
++ acpi_status status;
++
++ if (acpi_disabled)
++ return;
+
+ status = acpi_enable_subsystem(~ACPI_NO_ACPI_ENABLE);
+ if (ACPI_FAILURE(status)) {
+ printk(KERN_ERR PREFIX "Unable to enable ACPI\n");
+- goto error0;
++ disable_acpi();
++ } else {
++ /*
++ * If the system is using ACPI then we can be reasonably
++ * confident that any regulators are managed by the firmware
++ * so tell the regulator core it has everything it needs to
++ * know.
++ */
++ regulator_has_full_constraints();
+ }
+-
+- /*
+- * If the system is using ACPI then we can be reasonably
+- * confident that any regulators are managed by the firmware
+- * so tell the regulator core it has everything it needs to
+- * know.
+- */
+- regulator_has_full_constraints();
+-
+- return;
+-
+- error0:
+- disable_acpi();
+- return;
+ }
+
+ static int __init acpi_bus_init(void)
+diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
+index 98dc0dc605bc..74e18e94bef2 100644
+--- a/drivers/ata/libata-core.c
++++ b/drivers/ata/libata-core.c
+@@ -4226,10 +4226,47 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
+ { "PIONEER DVD-RW DVR-216D", NULL, ATA_HORKAGE_NOSETXFER },
+
+ /* devices that don't properly handle queued TRIM commands */
+- { "Micron_M500*", NULL, ATA_HORKAGE_NO_NCQ_TRIM, },
+- { "Crucial_CT???M500SSD*", NULL, ATA_HORKAGE_NO_NCQ_TRIM, },
+- { "Micron_M550*", NULL, ATA_HORKAGE_NO_NCQ_TRIM, },
+- { "Crucial_CT*M550SSD*", NULL, ATA_HORKAGE_NO_NCQ_TRIM, },
++ { "Micron_M500_*", NULL, ATA_HORKAGE_NO_NCQ_TRIM |
++ ATA_HORKAGE_ZERO_AFTER_TRIM, },
++ { "Crucial_CT*M500*", NULL, ATA_HORKAGE_NO_NCQ_TRIM |
++ ATA_HORKAGE_ZERO_AFTER_TRIM, },
++ { "Micron_M5[15]0_*", "MU01", ATA_HORKAGE_NO_NCQ_TRIM |
++ ATA_HORKAGE_ZERO_AFTER_TRIM, },
++ { "Crucial_CT*M550*", "MU01", ATA_HORKAGE_NO_NCQ_TRIM |
++ ATA_HORKAGE_ZERO_AFTER_TRIM, },
++ { "Crucial_CT*MX100*", "MU01", ATA_HORKAGE_NO_NCQ_TRIM |
++ ATA_HORKAGE_ZERO_AFTER_TRIM, },
++ { "Samsung SSD 8*", NULL, ATA_HORKAGE_NO_NCQ_TRIM |
++ ATA_HORKAGE_ZERO_AFTER_TRIM, },
++
++ /* devices that don't properly handle TRIM commands */
++ { "SuperSSpeed S238*", NULL, ATA_HORKAGE_NOTRIM, },
++
++ /*
++ * As defined, the DRAT (Deterministic Read After Trim) and RZAT
++ * (Return Zero After Trim) flags in the ATA Command Set are
++ * unreliable in the sense that they only define what happens if
++ * the device successfully executed the DSM TRIM command. TRIM
++ * is only advisory, however, and the device is free to silently
++ * ignore all or parts of the request.
++ *
++ * Whitelist drives that are known to reliably return zeroes
++ * after TRIM.
++ */
++
++ /*
++ * The intel 510 drive has buggy DRAT/RZAT. Explicitly exclude
++ * that model before whitelisting all other intel SSDs.
++ */
++ { "INTEL*SSDSC2MH*", NULL, 0, },
++
++ { "Micron*", NULL, ATA_HORKAGE_ZERO_AFTER_TRIM, },
++ { "Crucial*", NULL, ATA_HORKAGE_ZERO_AFTER_TRIM, },
++ { "INTEL*SSD*", NULL, ATA_HORKAGE_ZERO_AFTER_TRIM, },
++ { "SSD*INTEL*", NULL, ATA_HORKAGE_ZERO_AFTER_TRIM, },
++ { "Samsung*SSD*", NULL, ATA_HORKAGE_ZERO_AFTER_TRIM, },
++ { "SAMSUNG*SSD*", NULL, ATA_HORKAGE_ZERO_AFTER_TRIM, },
++ { "ST[1248][0248]0[FH]*", NULL, ATA_HORKAGE_ZERO_AFTER_TRIM, },
+
+ /* devices that don't properly handle TRIM commands */
+ { "SuperSSpeed S238*", NULL, ATA_HORKAGE_NOTRIM, },
+diff --git a/drivers/ata/libata-pmp.c b/drivers/ata/libata-pmp.c
+index 7ccc084bf1df..85aa76116a30 100644
+--- a/drivers/ata/libata-pmp.c
++++ b/drivers/ata/libata-pmp.c
+@@ -460,6 +460,13 @@ static void sata_pmp_quirks(struct ata_port *ap)
+ ATA_LFLAG_NO_SRST |
+ ATA_LFLAG_ASSUME_ATA;
+ }
++ } else if (vendor == 0x11ab && devid == 0x4140) {
++ /* Marvell 4140 quirks */
++ ata_for_each_link(link, ap, EDGE) {
++ /* port 4 is for SEMB device and it doesn't like SRST */
++ if (link->pmp == 4)
++ link->flags |= ATA_LFLAG_DISABLED;
++ }
+ }
+ }
+
+diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
+index d6ff64248c23..78d56c9390cc 100644
+--- a/drivers/ata/libata-scsi.c
++++ b/drivers/ata/libata-scsi.c
+@@ -2516,13 +2516,15 @@ static unsigned int ata_scsiop_read_cap(struct ata_scsi_args *args, u8 *rbuf)
+
+ if (ata_id_has_trim(args->id) &&
+ !(dev->horkage & ATA_HORKAGE_NOTRIM)) {
+- rbuf[14] |= 0x80; /* TPE */
++ rbuf[14] |= 0x80; /* LBPME */
+
+- if (ata_id_has_zero_after_trim(args->id))
+- rbuf[14] |= 0x40; /* TPRZ */
++ if (ata_id_has_zero_after_trim(args->id) &&
++ dev->horkage & ATA_HORKAGE_ZERO_AFTER_TRIM) {
++ ata_dev_info(dev, "Enabling discard_zeroes_data\n");
++ rbuf[14] |= 0x40; /* LBPRZ */
++ }
+ }
+ }
+-
+ return 0;
+ }
+
+diff --git a/drivers/ata/libata-transport.c b/drivers/ata/libata-transport.c
+index e37413228228..fd29b7224082 100644
+--- a/drivers/ata/libata-transport.c
++++ b/drivers/ata/libata-transport.c
+@@ -559,6 +559,29 @@ show_ata_dev_gscr(struct device *dev,
+
+ static DEVICE_ATTR(gscr, S_IRUGO, show_ata_dev_gscr, NULL);
+
++static ssize_t
++show_ata_dev_trim(struct device *dev,
++ struct device_attribute *attr, char *buf)
++{
++ struct ata_device *ata_dev = transport_class_to_dev(dev);
++ unsigned char *mode;
++
++ if (!ata_id_has_trim(ata_dev->id))
++ mode = "unsupported";
++ else if (ata_dev->horkage & ATA_HORKAGE_NOTRIM)
++ mode = "forced_unsupported";
++ else if (ata_dev->horkage & ATA_HORKAGE_NO_NCQ_TRIM)
++ mode = "forced_unqueued";
++ else if (ata_fpdma_dsm_supported(ata_dev))
++ mode = "queued";
++ else
++ mode = "unqueued";
++
++ return snprintf(buf, 20, "%s\n", mode);
++}
++
++static DEVICE_ATTR(trim, S_IRUGO, show_ata_dev_trim, NULL);
++
+ static DECLARE_TRANSPORT_CLASS(ata_dev_class,
+ "ata_device", NULL, NULL, NULL);
+
+@@ -732,6 +755,7 @@ struct scsi_transport_template *ata_attach_transport(void)
+ SETUP_DEV_ATTRIBUTE(ering);
+ SETUP_DEV_ATTRIBUTE(id);
+ SETUP_DEV_ATTRIBUTE(gscr);
++ SETUP_DEV_ATTRIBUTE(trim);
+ BUG_ON(count > ATA_DEV_ATTRS);
+ i->dev_attrs[count] = NULL;
+
+diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c
+index 501a8ca662f4..dc1ca84e90f1 100644
+--- a/drivers/block/rbd.c
++++ b/drivers/block/rbd.c
+@@ -520,6 +520,7 @@ void rbd_warn(struct rbd_device *rbd_dev, const char *fmt, ...)
+ # define rbd_assert(expr) ((void) 0)
+ #endif /* !RBD_DEBUG */
+
++static void rbd_osd_copyup_callback(struct rbd_obj_request *obj_request);
+ static int rbd_img_obj_request_submit(struct rbd_obj_request *obj_request);
+ static void rbd_img_parent_read(struct rbd_obj_request *obj_request);
+ static void rbd_dev_remove_parent(struct rbd_device *rbd_dev);
+@@ -1795,6 +1796,16 @@ static void rbd_osd_stat_callback(struct rbd_obj_request *obj_request)
+ obj_request_done_set(obj_request);
+ }
+
++static void rbd_osd_call_callback(struct rbd_obj_request *obj_request)
++{
++ dout("%s: obj %p\n", __func__, obj_request);
++
++ if (obj_request_img_data_test(obj_request))
++ rbd_osd_copyup_callback(obj_request);
++ else
++ obj_request_done_set(obj_request);
++}
++
+ static void rbd_osd_req_callback(struct ceph_osd_request *osd_req,
+ struct ceph_msg *msg)
+ {
+@@ -1842,6 +1853,8 @@ static void rbd_osd_req_callback(struct ceph_osd_request *osd_req,
+ rbd_osd_discard_callback(obj_request);
+ break;
+ case CEPH_OSD_OP_CALL:
++ rbd_osd_call_callback(obj_request);
++ break;
+ case CEPH_OSD_OP_NOTIFY_ACK:
+ case CEPH_OSD_OP_WATCH:
+ rbd_osd_trivial_callback(obj_request);
+@@ -2499,13 +2512,15 @@ out_unwind:
+ }
+
+ static void
+-rbd_img_obj_copyup_callback(struct rbd_obj_request *obj_request)
++rbd_osd_copyup_callback(struct rbd_obj_request *obj_request)
+ {
+ struct rbd_img_request *img_request;
+ struct rbd_device *rbd_dev;
+ struct page **pages;
+ u32 page_count;
+
++ dout("%s: obj %p\n", __func__, obj_request);
++
+ rbd_assert(obj_request->type == OBJ_REQUEST_BIO ||
+ obj_request->type == OBJ_REQUEST_NODATA);
+ rbd_assert(obj_request_img_data_test(obj_request));
+@@ -2532,9 +2547,7 @@ rbd_img_obj_copyup_callback(struct rbd_obj_request *obj_request)
+ if (!obj_request->result)
+ obj_request->xferred = obj_request->length;
+
+- /* Finish up with the normal image object callback */
+-
+- rbd_img_obj_callback(obj_request);
++ obj_request_done_set(obj_request);
+ }
+
+ static void
+@@ -2619,7 +2632,6 @@ rbd_img_obj_parent_read_full_callback(struct rbd_img_request *img_request)
+
+ /* All set, send it off. */
+
+- orig_request->callback = rbd_img_obj_copyup_callback;
+ osdc = &rbd_dev->rbd_client->client->osdc;
+ img_result = rbd_obj_request_submit(osdc, orig_request);
+ if (!img_result)
+diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c
+index 8dc319dd3150..e527a3e13939 100644
+--- a/drivers/bluetooth/ath3k.c
++++ b/drivers/bluetooth/ath3k.c
+@@ -107,6 +107,7 @@ static const struct usb_device_id ath3k_table[] = {
+ { USB_DEVICE(0x0cf3, 0xe003) },
+ { USB_DEVICE(0x0CF3, 0xE004) },
+ { USB_DEVICE(0x0CF3, 0xE005) },
++ { USB_DEVICE(0x0CF3, 0xE006) },
+ { USB_DEVICE(0x13d3, 0x3362) },
+ { USB_DEVICE(0x13d3, 0x3375) },
+ { USB_DEVICE(0x13d3, 0x3393) },
+@@ -165,6 +166,7 @@ static const struct usb_device_id ath3k_blist_tbl[] = {
+ { USB_DEVICE(0x0CF3, 0x817a), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x0cf3, 0xe004), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x0cf3, 0xe005), .driver_info = BTUSB_ATH3012 },
++ { USB_DEVICE(0x0cf3, 0xe006), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x0cf3, 0xe003), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 },
+diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
+index c675e2bd9fd3..82360dd65a1f 100644
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -195,6 +195,7 @@ static const struct usb_device_id blacklist_table[] = {
+ { USB_DEVICE(0x0cf3, 0xe003), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x0cf3, 0xe004), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x0cf3, 0xe005), .driver_info = BTUSB_ATH3012 },
++ { USB_DEVICE(0x0cf3, 0xe006), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x13d3, 0x3393), .driver_info = BTUSB_ATH3012 },
+diff --git a/drivers/char/hw_random/core.c b/drivers/char/hw_random/core.c
+index aa30a25c8d49..7d52c0aafa7f 100644
+--- a/drivers/char/hw_random/core.c
++++ b/drivers/char/hw_random/core.c
+@@ -365,7 +365,7 @@ static int hwrng_fillfn(void *unused)
+ static void start_khwrngd(void)
+ {
+ hwrng_fill = kthread_run(hwrng_fillfn, NULL, "hwrng");
+- if (hwrng_fill == ERR_PTR(-ENOMEM)) {
++ if (IS_ERR(hwrng_fill)) {
+ pr_err("hwrng_fill thread creation failed");
+ hwrng_fill = NULL;
+ }
+diff --git a/drivers/char/i8k.c b/drivers/char/i8k.c
+index 471f985e38d2..26397bb7d826 100644
+--- a/drivers/char/i8k.c
++++ b/drivers/char/i8k.c
+@@ -796,6 +796,21 @@ static struct dmi_system_id i8k_dmi_table[] __initdata = {
+ { }
+ };
+
++static struct dmi_system_id i8k_blacklist_dmi_table[] __initdata = {
++ {
++ /*
++ * CPU fan speed going up and down on Dell Studio XPS 8100
++ * for unknown reasons.
++ */
++ .ident = "Dell Studio XPS 8100",
++ .matches = {
++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "Studio XPS 8100"),
++ },
++ },
++ { }
++};
++
+ /*
+ * Probe for the presence of a supported laptop.
+ */
+@@ -806,7 +821,8 @@ static int __init i8k_probe(void)
+ /*
+ * Get DMI information
+ */
+- if (!dmi_check_system(i8k_dmi_table)) {
++ if (!dmi_check_system(i8k_dmi_table) ||
++ dmi_check_system(i8k_blacklist_dmi_table)) {
+ if (!ignore_dmi && !force)
+ return -ENODEV;
+
+diff --git a/drivers/clk/keystone/pll.c b/drivers/clk/keystone/pll.c
+index 0dd8a4b12747..4a375ead70e9 100644
+--- a/drivers/clk/keystone/pll.c
++++ b/drivers/clk/keystone/pll.c
+@@ -37,7 +37,8 @@
+ * Main PLL or any other PLLs in the device such as ARM PLL, DDR PLL
+ * or PA PLL available on keystone2. These PLLs are controlled by
+ * this register. Main PLL is controlled by a PLL controller.
+- * @pllm: PLL register map address
++ * @pllm: PLL register map address for multiplier bits
++ * @pllod: PLL register map address for post divider bits
+ * @pll_ctl0: PLL controller map address
+ * @pllm_lower_mask: multiplier lower mask
+ * @pllm_upper_mask: multiplier upper mask
+@@ -53,6 +54,7 @@ struct clk_pll_data {
+ u32 phy_pllm;
+ u32 phy_pll_ctl0;
+ void __iomem *pllm;
++ void __iomem *pllod;
+ void __iomem *pll_ctl0;
+ u32 pllm_lower_mask;
+ u32 pllm_upper_mask;
+@@ -102,7 +104,11 @@ static unsigned long clk_pllclk_recalc(struct clk_hw *hw,
+ /* read post divider from od bits*/
+ postdiv = ((val & pll_data->clkod_mask) >>
+ pll_data->clkod_shift) + 1;
+- else
++ else if (pll_data->pllod) {
++ postdiv = readl(pll_data->pllod);
++ postdiv = ((postdiv & pll_data->clkod_mask) >>
++ pll_data->clkod_shift) + 1;
++ } else
+ postdiv = pll_data->postdiv;
+
+ rate /= (prediv + 1);
+@@ -172,12 +178,21 @@ static void __init _of_pll_clk_init(struct device_node *node, bool pllctrl)
+ /* assume the PLL has output divider register bits */
+ pll_data->clkod_mask = CLKOD_MASK;
+ pll_data->clkod_shift = CLKOD_SHIFT;
++
++ /*
++ * Check if there is an post-divider register. If not
++ * assume od bits are part of control register.
++ */
++ i = of_property_match_string(node, "reg-names",
++ "post-divider");
++ pll_data->pllod = of_iomap(node, i);
+ }
+
+ i = of_property_match_string(node, "reg-names", "control");
+ pll_data->pll_ctl0 = of_iomap(node, i);
+ if (!pll_data->pll_ctl0) {
+ pr_err("%s: ioremap failed\n", __func__);
++ iounmap(pll_data->pllod);
+ goto out;
+ }
+
+@@ -193,6 +208,7 @@ static void __init _of_pll_clk_init(struct device_node *node, bool pllctrl)
+ pll_data->pllm = of_iomap(node, i);
+ if (!pll_data->pllm) {
+ iounmap(pll_data->pll_ctl0);
++ iounmap(pll_data->pllod);
+ goto out;
+ }
+ }
+diff --git a/drivers/cpufreq/pcc-cpufreq.c b/drivers/cpufreq/pcc-cpufreq.c
+index 4d2c8e861089..2a0d58959acf 100644
+--- a/drivers/cpufreq/pcc-cpufreq.c
++++ b/drivers/cpufreq/pcc-cpufreq.c
+@@ -603,6 +603,13 @@ static void __exit pcc_cpufreq_exit(void)
+ free_percpu(pcc_cpu_info);
+ }
+
++static const struct acpi_device_id processor_device_ids[] = {
++ {ACPI_PROCESSOR_OBJECT_HID, },
++ {ACPI_PROCESSOR_DEVICE_HID, },
++ {},
++};
++MODULE_DEVICE_TABLE(acpi, processor_device_ids);
++
+ MODULE_AUTHOR("Matthew Garrett, Naga Chumbalkar");
+ MODULE_VERSION(PCC_VERSION);
+ MODULE_DESCRIPTION("Processor Clocking Control interface driver");
+diff --git a/drivers/crypto/ixp4xx_crypto.c b/drivers/crypto/ixp4xx_crypto.c
+index f757a0f428bd..3beed38d306a 100644
+--- a/drivers/crypto/ixp4xx_crypto.c
++++ b/drivers/crypto/ixp4xx_crypto.c
+@@ -904,7 +904,6 @@ static int ablk_perform(struct ablkcipher_request *req, int encrypt)
+ crypt->mode |= NPE_OP_NOT_IN_PLACE;
+ /* This was never tested by Intel
+ * for more than one dst buffer, I think. */
+- BUG_ON(req->dst->length < nbytes);
+ req_ctx->dst = NULL;
+ if (!chainup_buffers(dev, req->dst, nbytes, &dst_hook,
+ flags, DMA_FROM_DEVICE))
+diff --git a/drivers/crypto/qat/qat_common/qat_algs.c b/drivers/crypto/qat/qat_common/qat_algs.c
+index 9e9619cd4a79..5b35e5d2231d 100644
+--- a/drivers/crypto/qat/qat_common/qat_algs.c
++++ b/drivers/crypto/qat/qat_common/qat_algs.c
+@@ -73,7 +73,8 @@
+ ICP_QAT_HW_CIPHER_KEY_CONVERT, \
+ ICP_QAT_HW_CIPHER_DECRYPT)
+
+-static atomic_t active_dev;
++static DEFINE_MUTEX(algs_lock);
++static unsigned int active_devs;
+
+ struct qat_alg_buf {
+ uint32_t len;
+@@ -955,27 +956,34 @@ static struct crypto_alg qat_algs[] = { {
+
+ int qat_algs_register(void)
+ {
+- if (atomic_add_return(1, &active_dev) == 1) {
++ int ret = 0;
++
++ mutex_lock(&algs_lock);
++ if (++active_devs == 1) {
+ int i;
+
+ for (i = 0; i < ARRAY_SIZE(qat_algs); i++)
+ qat_algs[i].cra_flags = CRYPTO_ALG_TYPE_AEAD |
+ CRYPTO_ALG_ASYNC;
+- return crypto_register_algs(qat_algs, ARRAY_SIZE(qat_algs));
++ ret = crypto_register_algs(qat_algs, ARRAY_SIZE(qat_algs));
+ }
+- return 0;
++ mutex_unlock(&algs_lock);
++ return ret;
+ }
+
+ int qat_algs_unregister(void)
+ {
+- if (atomic_sub_return(1, &active_dev) == 0)
+- return crypto_unregister_algs(qat_algs, ARRAY_SIZE(qat_algs));
+- return 0;
++ int ret = 0;
++
++ mutex_lock(&algs_lock);
++ if (--active_devs == 0)
++ ret = crypto_unregister_algs(qat_algs, ARRAY_SIZE(qat_algs));
++ mutex_unlock(&algs_lock);
++ return ret;
+ }
+
+ int qat_algs_init(void)
+ {
+- atomic_set(&active_dev, 0);
+ crypto_get_default_rng();
+ return 0;
+ }
+diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c
+index 1f5e42a1f5b4..dea239c38134 100644
+--- a/drivers/gpu/drm/drm_dp_mst_topology.c
++++ b/drivers/gpu/drm/drm_dp_mst_topology.c
+@@ -1275,7 +1275,6 @@ retry:
+ goto retry;
+ }
+ DRM_DEBUG_KMS("failed to dpcd write %d %d\n", tosend, ret);
+- WARN(1, "fail\n");
+
+ return -EIO;
+ }
+diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
+index a84971351eee..c68e9f2947a6 100644
+--- a/drivers/gpu/drm/i915/i915_drv.h
++++ b/drivers/gpu/drm/i915/i915_drv.h
+@@ -2899,15 +2899,14 @@ int vlv_freq_opcode(struct drm_i915_private *dev_priv, int val);
+ #define I915_READ64(reg) dev_priv->uncore.funcs.mmio_readq(dev_priv, (reg), true)
+
+ #define I915_READ64_2x32(lower_reg, upper_reg) ({ \
+- u32 upper = I915_READ(upper_reg); \
+- u32 lower = I915_READ(lower_reg); \
+- u32 tmp = I915_READ(upper_reg); \
+- if (upper != tmp) { \
+- upper = tmp; \
+- lower = I915_READ(lower_reg); \
+- WARN_ON(I915_READ(upper_reg) != upper); \
+- } \
+- (u64)upper << 32 | lower; })
++ u32 upper, lower, tmp; \
++ tmp = I915_READ(upper_reg); \
++ do { \
++ upper = tmp; \
++ lower = I915_READ(lower_reg); \
++ tmp = I915_READ(upper_reg); \
++ } while (upper != tmp); \
++ (u64)upper << 32 | lower; })
+
+ #define POSTING_READ(reg) (void)I915_READ_NOTRACE(reg)
+ #define POSTING_READ16(reg) (void)I915_READ16_NOTRACE(reg)
+diff --git a/drivers/gpu/drm/radeon/radeon_combios.c b/drivers/gpu/drm/radeon/radeon_combios.c
+index 3e5f6b71f3ad..c097d3a82bda 100644
+--- a/drivers/gpu/drm/radeon/radeon_combios.c
++++ b/drivers/gpu/drm/radeon/radeon_combios.c
+@@ -1255,10 +1255,15 @@ struct radeon_encoder_lvds *radeon_combios_get_lvds_info(struct radeon_encoder
+
+ if ((RBIOS16(tmp) == lvds->native_mode.hdisplay) &&
+ (RBIOS16(tmp + 2) == lvds->native_mode.vdisplay)) {
++ u32 hss = (RBIOS16(tmp + 21) - RBIOS16(tmp + 19) - 1) * 8;
++
++ if (hss > lvds->native_mode.hdisplay)
++ hss = (10 - 1) * 8;
++
+ lvds->native_mode.htotal = lvds->native_mode.hdisplay +
+ (RBIOS16(tmp + 17) - RBIOS16(tmp + 19)) * 8;
+ lvds->native_mode.hsync_start = lvds->native_mode.hdisplay +
+- (RBIOS16(tmp + 21) - RBIOS16(tmp + 19) - 1) * 8;
++ hss;
+ lvds->native_mode.hsync_end = lvds->native_mode.hsync_start +
+ (RBIOS8(tmp + 23) * 8);
+
+diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
+index 7eda03c13805..737d18c924bc 100644
+--- a/drivers/hid/hid-core.c
++++ b/drivers/hid/hid-core.c
+@@ -1943,6 +1943,7 @@ static const struct hid_device_id hid_have_special_driver[] = {
+ { HID_USB_DEVICE(USB_VENDOR_ID_THRUSTMASTER, 0xb65a) },
+ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_TIVO, USB_DEVICE_ID_TIVO_SLIDE_BT) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_TIVO, USB_DEVICE_ID_TIVO_SLIDE) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_TIVO, USB_DEVICE_ID_TIVO_SLIDE_PRO) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_TOPSEED, USB_DEVICE_ID_TOPSEED_CYBERLINK) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_TOPSEED2, USB_DEVICE_ID_TOPSEED2_RF_COMBO) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_TWINHAN, USB_DEVICE_ID_TWINHAN_IR_REMOTE) },
+@@ -2333,6 +2334,7 @@ static const struct hid_device_id hid_ignore_list[] = {
+ { HID_USB_DEVICE(USB_VENDOR_ID_MCC, USB_DEVICE_ID_MCC_PMD1208LS) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_MICROCHIP, USB_DEVICE_ID_PICKIT1) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_MICROCHIP, USB_DEVICE_ID_PICKIT2) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_MICROCHIP, USB_DEVICE_ID_PICK16F1454) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_NATIONAL_SEMICONDUCTOR, USB_DEVICE_ID_N_S_HARMONY) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ONTRAK, USB_DEVICE_ID_ONTRAK_ADU100) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ONTRAK, USB_DEVICE_ID_ONTRAK_ADU100 + 20) },
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index 252a7ed40f86..3603d0cb25d9 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -250,6 +250,8 @@
+
+ #define USB_DEVICE_ID_CYGNAL_RADIO_SI4713 0x8244
+
++#define USB_DEVICE_ID_CYGNAL_RADIO_SI4713 0x8244
++
+ #define USB_VENDOR_ID_CYPRESS 0x04b4
+ #define USB_DEVICE_ID_CYPRESS_MOUSE 0x0001
+ #define USB_DEVICE_ID_CYPRESS_HIDCOM 0x5500
+@@ -648,6 +650,7 @@
+ #define USB_DEVICE_ID_PICKIT2 0x0033
+ #define USB_DEVICE_ID_PICOLCD 0xc002
+ #define USB_DEVICE_ID_PICOLCD_BOOTLOADER 0xf002
++#define USB_DEVICE_ID_PICK16F1454 0x0042
+
+ #define USB_VENDOR_ID_MICROSOFT 0x045e
+ #define USB_DEVICE_ID_SIDEWINDER_GV 0x003b
+@@ -895,6 +898,7 @@
+ #define USB_VENDOR_ID_TIVO 0x150a
+ #define USB_DEVICE_ID_TIVO_SLIDE_BT 0x1200
+ #define USB_DEVICE_ID_TIVO_SLIDE 0x1201
++#define USB_DEVICE_ID_TIVO_SLIDE_PRO 0x1203
+
+ #define USB_VENDOR_ID_TOPSEED 0x0766
+ #define USB_DEVICE_ID_TOPSEED_CYBERLINK 0x0204
+diff --git a/drivers/hid/hid-tivo.c b/drivers/hid/hid-tivo.c
+index d790d8d71f7f..d98696927453 100644
+--- a/drivers/hid/hid-tivo.c
++++ b/drivers/hid/hid-tivo.c
+@@ -64,6 +64,7 @@ static const struct hid_device_id tivo_devices[] = {
+ /* TiVo Slide Bluetooth remote, pairs with a Broadcom dongle */
+ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_TIVO, USB_DEVICE_ID_TIVO_SLIDE_BT) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_TIVO, USB_DEVICE_ID_TIVO_SLIDE) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_TIVO, USB_DEVICE_ID_TIVO_SLIDE_PRO) },
+ { }
+ };
+ MODULE_DEVICE_TABLE(hid, tivo_devices);
+diff --git a/drivers/i2c/busses/Kconfig b/drivers/i2c/busses/Kconfig
+index 917c3585f45b..06e99eb64295 100644
+--- a/drivers/i2c/busses/Kconfig
++++ b/drivers/i2c/busses/Kconfig
+@@ -123,6 +123,7 @@ config I2C_I801
+ Wildcat Point-LP (PCH)
+ BayTrail (SOC)
+ Sunrise Point-H (PCH)
++ Sunrise Point-LP (PCH)
+
+ This driver can also be built as a module. If so, the module
+ will be called i2c-i801.
+diff --git a/drivers/i2c/busses/i2c-i801.c b/drivers/i2c/busses/i2c-i801.c
+index 6ab4f1cb21f3..04d7d70ae32b 100644
+--- a/drivers/i2c/busses/i2c-i801.c
++++ b/drivers/i2c/busses/i2c-i801.c
+@@ -59,6 +59,7 @@
+ * Wildcat Point-LP (PCH) 0x9ca2 32 hard yes yes yes
+ * BayTrail (SOC) 0x0f12 32 hard yes yes yes
+ * Sunrise Point-H (PCH) 0xa123 32 hard yes yes yes
++ * Sunrise Point-LP (PCH) 0x9d23 32 hard yes yes yes
+ *
+ * Features supported by this driver:
+ * Software PEC no
+@@ -182,6 +183,7 @@
+ #define PCI_DEVICE_ID_INTEL_LYNXPOINT_LP_SMBUS 0x9c22
+ #define PCI_DEVICE_ID_INTEL_WILDCATPOINT_LP_SMBUS 0x9ca2
+ #define PCI_DEVICE_ID_INTEL_SUNRISEPOINT_H_SMBUS 0xa123
++#define PCI_DEVICE_ID_INTEL_SUNRISEPOINT_LP_SMBUS 0x9d23
+
+ struct i801_mux_config {
+ char *gpio_chip;
+@@ -829,6 +831,7 @@ static const struct pci_device_id i801_ids[] = {
+ { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_BAYTRAIL_SMBUS) },
+ { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_BRASWELL_SMBUS) },
+ { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_SUNRISEPOINT_H_SMBUS) },
++ { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_SUNRISEPOINT_LP_SMBUS) },
+ { 0, }
+ };
+
+diff --git a/drivers/idle/intel_idle.c b/drivers/idle/intel_idle.c
+index 9b7ee7e427df..4a8a1d922e0f 100644
+--- a/drivers/idle/intel_idle.c
++++ b/drivers/idle/intel_idle.c
+@@ -727,6 +727,7 @@ static const struct x86_cpu_id intel_idle_ids[] = {
+ ICPU(0x46, idle_cpu_hsw),
+ ICPU(0x4d, idle_cpu_avn),
+ ICPU(0x3d, idle_cpu_bdw),
++ ICPU(0x47, idle_cpu_bdw),
+ ICPU(0x4f, idle_cpu_bdw),
+ ICPU(0x56, idle_cpu_bdw),
+ {}
+diff --git a/drivers/iio/accel/hid-sensor-accel-3d.c b/drivers/iio/accel/hid-sensor-accel-3d.c
+index d5d95317003a..8ed7c0a70ed2 100644
+--- a/drivers/iio/accel/hid-sensor-accel-3d.c
++++ b/drivers/iio/accel/hid-sensor-accel-3d.c
+@@ -305,7 +305,6 @@ static int hid_accel_3d_probe(struct platform_device *pdev)
+ struct iio_dev *indio_dev;
+ struct accel_3d_state *accel_state;
+ struct hid_sensor_hub_device *hsdev = pdev->dev.platform_data;
+- struct iio_chan_spec *channels;
+
+ indio_dev = devm_iio_device_alloc(&pdev->dev,
+ sizeof(struct accel_3d_state));
+@@ -326,21 +325,21 @@ static int hid_accel_3d_probe(struct platform_device *pdev)
+ return ret;
+ }
+
+- channels = kmemdup(accel_3d_channels, sizeof(accel_3d_channels),
+- GFP_KERNEL);
+- if (!channels) {
++ indio_dev->channels = kmemdup(accel_3d_channels,
++ sizeof(accel_3d_channels), GFP_KERNEL);
++ if (!indio_dev->channels) {
+ dev_err(&pdev->dev, "failed to duplicate channels\n");
+ return -ENOMEM;
+ }
+
+- ret = accel_3d_parse_report(pdev, hsdev, channels,
+- HID_USAGE_SENSOR_ACCEL_3D, accel_state);
++ ret = accel_3d_parse_report(pdev, hsdev,
++ (struct iio_chan_spec *)indio_dev->channels,
++ HID_USAGE_SENSOR_ACCEL_3D, accel_state);
+ if (ret) {
+ dev_err(&pdev->dev, "failed to setup attributes\n");
+ goto error_free_dev_mem;
+ }
+
+- indio_dev->channels = channels;
+ indio_dev->num_channels = ARRAY_SIZE(accel_3d_channels);
+ indio_dev->dev.parent = &pdev->dev;
+ indio_dev->info = &accel_3d_info;
+diff --git a/drivers/iio/adc/twl6030-gpadc.c b/drivers/iio/adc/twl6030-gpadc.c
+index 89d8aa1d2818..df12c57e6ce0 100644
+--- a/drivers/iio/adc/twl6030-gpadc.c
++++ b/drivers/iio/adc/twl6030-gpadc.c
+@@ -1001,7 +1001,7 @@ static struct platform_driver twl6030_gpadc_driver = {
+
+ module_platform_driver(twl6030_gpadc_driver);
+
+-MODULE_ALIAS("platform: " DRIVER_NAME);
++MODULE_ALIAS("platform:" DRIVER_NAME);
+ MODULE_AUTHOR("Balaji T K <balajitk@ti.com>");
+ MODULE_AUTHOR("Graeme Gregory <gg@slimlogic.co.uk>");
+ MODULE_AUTHOR("Oleksandr Kozaruk <oleksandr.kozaruk@ti.com");
+diff --git a/drivers/iio/gyro/hid-sensor-gyro-3d.c b/drivers/iio/gyro/hid-sensor-gyro-3d.c
+index a3ea1e8785d7..c23c36bf99b5 100644
+--- a/drivers/iio/gyro/hid-sensor-gyro-3d.c
++++ b/drivers/iio/gyro/hid-sensor-gyro-3d.c
+@@ -304,7 +304,6 @@ static int hid_gyro_3d_probe(struct platform_device *pdev)
+ struct iio_dev *indio_dev;
+ struct gyro_3d_state *gyro_state;
+ struct hid_sensor_hub_device *hsdev = pdev->dev.platform_data;
+- struct iio_chan_spec *channels;
+
+ indio_dev = devm_iio_device_alloc(&pdev->dev, sizeof(*gyro_state));
+ if (!indio_dev)
+@@ -323,21 +322,21 @@ static int hid_gyro_3d_probe(struct platform_device *pdev)
+ return ret;
+ }
+
+- channels = kmemdup(gyro_3d_channels, sizeof(gyro_3d_channels),
+- GFP_KERNEL);
+- if (!channels) {
++ indio_dev->channels = kmemdup(gyro_3d_channels,
++ sizeof(gyro_3d_channels), GFP_KERNEL);
++ if (!indio_dev->channels) {
+ dev_err(&pdev->dev, "failed to duplicate channels\n");
+ return -ENOMEM;
+ }
+
+- ret = gyro_3d_parse_report(pdev, hsdev, channels,
+- HID_USAGE_SENSOR_GYRO_3D, gyro_state);
++ ret = gyro_3d_parse_report(pdev, hsdev,
++ (struct iio_chan_spec *)indio_dev->channels,
++ HID_USAGE_SENSOR_GYRO_3D, gyro_state);
+ if (ret) {
+ dev_err(&pdev->dev, "failed to setup attributes\n");
+ goto error_free_dev_mem;
+ }
+
+- indio_dev->channels = channels;
+ indio_dev->num_channels = ARRAY_SIZE(gyro_3d_channels);
+ indio_dev->dev.parent = &pdev->dev;
+ indio_dev->info = &gyro_3d_info;
+diff --git a/drivers/iio/light/hid-sensor-als.c b/drivers/iio/light/hid-sensor-als.c
+index a5283d75c096..9c44fe02e62e 100644
+--- a/drivers/iio/light/hid-sensor-als.c
++++ b/drivers/iio/light/hid-sensor-als.c
+@@ -270,7 +270,6 @@ static int hid_als_probe(struct platform_device *pdev)
+ struct iio_dev *indio_dev;
+ struct als_state *als_state;
+ struct hid_sensor_hub_device *hsdev = pdev->dev.platform_data;
+- struct iio_chan_spec *channels;
+
+ indio_dev = devm_iio_device_alloc(&pdev->dev, sizeof(struct als_state));
+ if (!indio_dev)
+@@ -288,20 +287,21 @@ static int hid_als_probe(struct platform_device *pdev)
+ return ret;
+ }
+
+- channels = kmemdup(als_channels, sizeof(als_channels), GFP_KERNEL);
+- if (!channels) {
++ indio_dev->channels = kmemdup(als_channels,
++ sizeof(als_channels), GFP_KERNEL);
++ if (!indio_dev->channels) {
+ dev_err(&pdev->dev, "failed to duplicate channels\n");
+ return -ENOMEM;
+ }
+
+- ret = als_parse_report(pdev, hsdev, channels,
+- HID_USAGE_SENSOR_ALS, als_state);
++ ret = als_parse_report(pdev, hsdev,
++ (struct iio_chan_spec *)indio_dev->channels,
++ HID_USAGE_SENSOR_ALS, als_state);
+ if (ret) {
+ dev_err(&pdev->dev, "failed to setup attributes\n");
+ goto error_free_dev_mem;
+ }
+
+- indio_dev->channels = channels;
+ indio_dev->num_channels =
+ ARRAY_SIZE(als_channels);
+ indio_dev->dev.parent = &pdev->dev;
+diff --git a/drivers/input/touchscreen/usbtouchscreen.c b/drivers/input/touchscreen/usbtouchscreen.c
+index a0966331a89b..c6f7e918b2b1 100644
+--- a/drivers/input/touchscreen/usbtouchscreen.c
++++ b/drivers/input/touchscreen/usbtouchscreen.c
+@@ -625,6 +625,9 @@ static int dmc_tsc10_init(struct usbtouch_usb *usbtouch)
+ goto err_out;
+ }
+
++ /* TSC-25 data sheet specifies a delay after the RESET command */
++ msleep(150);
++
+ /* set coordinate output rate */
+ buf[0] = buf[1] = 0xFF;
+ ret = usb_control_msg(dev, usb_rcvctrlpipe (dev, 0),
+diff --git a/drivers/md/bitmap.c b/drivers/md/bitmap.c
+index da3604e73e8a..cced062cab4b 100644
+--- a/drivers/md/bitmap.c
++++ b/drivers/md/bitmap.c
+@@ -564,6 +564,8 @@ static int bitmap_read_sb(struct bitmap *bitmap)
+ if (err)
+ return err;
+
++ err = -EINVAL;
++
+ sb = kmap_atomic(sb_page);
+
+ chunksize = le32_to_cpu(sb->chunksize);
+diff --git a/drivers/md/md.c b/drivers/md/md.c
+index 43390353d62f..dd7a3701b99c 100644
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -5432,8 +5432,7 @@ static int get_bitmap_file(struct mddev *mddev, void __user * arg)
+ char *ptr, *buf = NULL;
+ int err = -ENOMEM;
+
+- file = kmalloc(sizeof(*file), GFP_NOIO);
+-
++ file = kzalloc(sizeof(*file), GFP_NOIO);
+ if (!file)
+ goto out;
+
+diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
+index 2f2f38f4d83c..d24245c7b94a 100644
+--- a/drivers/md/raid1.c
++++ b/drivers/md/raid1.c
+@@ -336,7 +336,7 @@ static void raid1_end_read_request(struct bio *bio, int error)
+ spin_lock_irqsave(&conf->device_lock, flags);
+ if (r1_bio->mddev->degraded == conf->raid_disks ||
+ (r1_bio->mddev->degraded == conf->raid_disks-1 &&
+- !test_bit(Faulty, &conf->mirrors[mirror].rdev->flags)))
++ test_bit(In_sync, &conf->mirrors[mirror].rdev->flags)))
+ uptodate = 1;
+ spin_unlock_irqrestore(&conf->device_lock, flags);
+ }
+@@ -1474,6 +1474,7 @@ static void error(struct mddev *mddev, struct md_rdev *rdev)
+ {
+ char b[BDEVNAME_SIZE];
+ struct r1conf *conf = mddev->private;
++ unsigned long flags;
+
+ /*
+ * If it is not operational, then we have already marked it as dead
+@@ -1493,14 +1494,13 @@ static void error(struct mddev *mddev, struct md_rdev *rdev)
+ return;
+ }
+ set_bit(Blocked, &rdev->flags);
++ spin_lock_irqsave(&conf->device_lock, flags);
+ if (test_and_clear_bit(In_sync, &rdev->flags)) {
+- unsigned long flags;
+- spin_lock_irqsave(&conf->device_lock, flags);
+ mddev->degraded++;
+ set_bit(Faulty, &rdev->flags);
+- spin_unlock_irqrestore(&conf->device_lock, flags);
+ } else
+ set_bit(Faulty, &rdev->flags);
++ spin_unlock_irqrestore(&conf->device_lock, flags);
+ /*
+ * if recovery is running, make sure it aborts.
+ */
+@@ -1566,7 +1566,10 @@ static int raid1_spare_active(struct mddev *mddev)
+ * Find all failed disks within the RAID1 configuration
+ * and mark them readable.
+ * Called under mddev lock, so rcu protection not needed.
++ * device_lock used to avoid races with raid1_end_read_request
++ * which expects 'In_sync' flags and ->degraded to be consistent.
+ */
++ spin_lock_irqsave(&conf->device_lock, flags);
+ for (i = 0; i < conf->raid_disks; i++) {
+ struct md_rdev *rdev = conf->mirrors[i].rdev;
+ struct md_rdev *repl = conf->mirrors[conf->raid_disks + i].rdev;
+@@ -1596,7 +1599,6 @@ static int raid1_spare_active(struct mddev *mddev)
+ sysfs_notify_dirent_safe(rdev->sysfs_state);
+ }
+ }
+- spin_lock_irqsave(&conf->device_lock, flags);
+ mddev->degraded -= count;
+ spin_unlock_irqrestore(&conf->device_lock, flags);
+
+diff --git a/drivers/mmc/host/sdhci-esdhc.h b/drivers/mmc/host/sdhci-esdhc.h
+index 3497cfaf683c..a870c42731d7 100644
+--- a/drivers/mmc/host/sdhci-esdhc.h
++++ b/drivers/mmc/host/sdhci-esdhc.h
+@@ -45,6 +45,6 @@
+ #define ESDHC_DMA_SYSCTL 0x40c
+ #define ESDHC_DMA_SNOOP 0x00000040
+
+-#define ESDHC_HOST_CONTROL_RES 0x05
++#define ESDHC_HOST_CONTROL_RES 0x01
+
+ #endif /* _DRIVERS_MMC_SDHCI_ESDHC_H */
+diff --git a/drivers/phy/phy-twl4030-usb.c b/drivers/phy/phy-twl4030-usb.c
+index 7b04befd5271..13dd070a69da 100644
+--- a/drivers/phy/phy-twl4030-usb.c
++++ b/drivers/phy/phy-twl4030-usb.c
+@@ -144,6 +144,16 @@
+ #define PMBR1 0x0D
+ #define GPIO_USB_4PIN_ULPI_2430C (3 << 0)
+
++/*
++ * If VBUS is valid or ID is ground, then we know a
++ * cable is present and we need to be runtime-enabled
++ */
++static inline bool cable_present(enum omap_musb_vbus_id_status stat)
++{
++ return stat == OMAP_MUSB_VBUS_VALID ||
++ stat == OMAP_MUSB_ID_GROUND;
++}
++
+ struct twl4030_usb {
+ struct usb_phy phy;
+ struct device *dev;
+@@ -536,8 +546,10 @@ static irqreturn_t twl4030_usb_irq(int irq, void *_twl)
+
+ mutex_lock(&twl->lock);
+ if (status >= 0 && status != twl->linkstat) {
++ status_changed =
++ cable_present(twl->linkstat) !=
++ cable_present(status);
+ twl->linkstat = status;
+- status_changed = true;
+ }
+ mutex_unlock(&twl->lock);
+
+@@ -553,15 +565,11 @@ static irqreturn_t twl4030_usb_irq(int irq, void *_twl)
+ * USB_LINK_VBUS state. musb_hdrc won't care until it
+ * starts to handle softconnect right.
+ */
+- if ((status == OMAP_MUSB_VBUS_VALID) ||
+- (status == OMAP_MUSB_ID_GROUND)) {
+- if (pm_runtime_suspended(twl->dev))
+- pm_runtime_get_sync(twl->dev);
++ if (cable_present(status)) {
++ pm_runtime_get_sync(twl->dev);
+ } else {
+- if (pm_runtime_active(twl->dev)) {
+- pm_runtime_mark_last_busy(twl->dev);
+- pm_runtime_put_autosuspend(twl->dev);
+- }
++ pm_runtime_mark_last_busy(twl->dev);
++ pm_runtime_put_autosuspend(twl->dev);
+ }
+ omap_musb_mailbox(status);
+ }
+@@ -765,6 +773,9 @@ static int twl4030_usb_remove(struct platform_device *pdev)
+
+ /* disable complete OTG block */
+ twl4030_usb_clear_bits(twl, POWER_CTRL, POWER_CTRL_OTG_ENAB);
++
++ if (cable_present(twl->linkstat))
++ pm_runtime_put_noidle(twl->dev);
+ pm_runtime_mark_last_busy(twl->dev);
+ pm_runtime_put(twl->dev);
+
+diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c
+index cef5d49b59cd..b8311af7dda4 100644
+--- a/drivers/scsi/hpsa.c
++++ b/drivers/scsi/hpsa.c
+@@ -103,7 +103,6 @@ static const struct pci_device_id hpsa_pci_device_id[] = {
+ {PCI_VENDOR_ID_HP, PCI_DEVICE_ID_HP_CISSH, 0x103C, 0x1922},
+ {PCI_VENDOR_ID_HP, PCI_DEVICE_ID_HP_CISSH, 0x103C, 0x1923},
+ {PCI_VENDOR_ID_HP, PCI_DEVICE_ID_HP_CISSH, 0x103C, 0x1924},
+- {PCI_VENDOR_ID_HP, PCI_DEVICE_ID_HP_CISSH, 0x103C, 0x1925},
+ {PCI_VENDOR_ID_HP, PCI_DEVICE_ID_HP_CISSH, 0x103C, 0x1926},
+ {PCI_VENDOR_ID_HP, PCI_DEVICE_ID_HP_CISSH, 0x103C, 0x1928},
+ {PCI_VENDOR_ID_HP, PCI_DEVICE_ID_HP_CISSH, 0x103C, 0x1929},
+@@ -149,6 +148,7 @@ static struct board_type products[] = {
+ {0x3249103C, "Smart Array P812", &SA5_access},
+ {0x324A103C, "Smart Array P712m", &SA5_access},
+ {0x324B103C, "Smart Array P711m", &SA5_access},
++ {0x3233103C, "HP StorageWorks 1210m", &SA5_access}, /* alias of 333f */
+ {0x3350103C, "Smart Array P222", &SA5_access},
+ {0x3351103C, "Smart Array P420", &SA5_access},
+ {0x3352103C, "Smart Array P421", &SA5_access},
+diff --git a/drivers/scsi/ipr.c b/drivers/scsi/ipr.c
+index c3bdca7bf1e9..f2e1b92eb314 100644
+--- a/drivers/scsi/ipr.c
++++ b/drivers/scsi/ipr.c
+@@ -592,9 +592,10 @@ static void ipr_trc_hook(struct ipr_cmnd *ipr_cmd,
+ {
+ struct ipr_trace_entry *trace_entry;
+ struct ipr_ioa_cfg *ioa_cfg = ipr_cmd->ioa_cfg;
++ unsigned int trace_index;
+
+- trace_entry = &ioa_cfg->trace[atomic_add_return
+- (1, &ioa_cfg->trace_index)%IPR_NUM_TRACE_ENTRIES];
++ trace_index = atomic_add_return(1, &ioa_cfg->trace_index) & IPR_TRACE_INDEX_MASK;
++ trace_entry = &ioa_cfg->trace[trace_index];
+ trace_entry->time = jiffies;
+ trace_entry->op_code = ipr_cmd->ioarcb.cmd_pkt.cdb[0];
+ trace_entry->type = type;
+@@ -1044,10 +1045,15 @@ static void ipr_send_blocking_cmd(struct ipr_cmnd *ipr_cmd,
+
+ static int ipr_get_hrrq_index(struct ipr_ioa_cfg *ioa_cfg)
+ {
++ unsigned int hrrq;
++
+ if (ioa_cfg->hrrq_num == 1)
+- return 0;
+- else
+- return (atomic_add_return(1, &ioa_cfg->hrrq_index) % (ioa_cfg->hrrq_num - 1)) + 1;
++ hrrq = 0;
++ else {
++ hrrq = atomic_add_return(1, &ioa_cfg->hrrq_index);
++ hrrq = (hrrq % (ioa_cfg->hrrq_num - 1)) + 1;
++ }
++ return hrrq;
+ }
+
+ /**
+@@ -6227,21 +6233,23 @@ static void ipr_scsi_done(struct ipr_cmnd *ipr_cmd)
+ struct ipr_ioa_cfg *ioa_cfg = ipr_cmd->ioa_cfg;
+ struct scsi_cmnd *scsi_cmd = ipr_cmd->scsi_cmd;
+ u32 ioasc = be32_to_cpu(ipr_cmd->s.ioasa.hdr.ioasc);
+- unsigned long hrrq_flags;
++ unsigned long lock_flags;
+
+ scsi_set_resid(scsi_cmd, be32_to_cpu(ipr_cmd->s.ioasa.hdr.residual_data_len));
+
+ if (likely(IPR_IOASC_SENSE_KEY(ioasc) == 0)) {
+ scsi_dma_unmap(scsi_cmd);
+
+- spin_lock_irqsave(ipr_cmd->hrrq->lock, hrrq_flags);
++ spin_lock_irqsave(ipr_cmd->hrrq->lock, lock_flags);
+ list_add_tail(&ipr_cmd->queue, &ipr_cmd->hrrq->hrrq_free_q);
+ scsi_cmd->scsi_done(scsi_cmd);
+- spin_unlock_irqrestore(ipr_cmd->hrrq->lock, hrrq_flags);
++ spin_unlock_irqrestore(ipr_cmd->hrrq->lock, lock_flags);
+ } else {
+- spin_lock_irqsave(ipr_cmd->hrrq->lock, hrrq_flags);
++ spin_lock_irqsave(ioa_cfg->host->host_lock, lock_flags);
++ spin_lock(&ipr_cmd->hrrq->_lock);
+ ipr_erp_start(ioa_cfg, ipr_cmd);
+- spin_unlock_irqrestore(ipr_cmd->hrrq->lock, hrrq_flags);
++ spin_unlock(&ipr_cmd->hrrq->_lock);
++ spin_unlock_irqrestore(ioa_cfg->host->host_lock, lock_flags);
+ }
+ }
+
+diff --git a/drivers/scsi/ipr.h b/drivers/scsi/ipr.h
+index ae4626f64208..489487bdf230 100644
+--- a/drivers/scsi/ipr.h
++++ b/drivers/scsi/ipr.h
+@@ -1481,6 +1481,7 @@ struct ipr_ioa_cfg {
+
+ #define IPR_NUM_TRACE_INDEX_BITS 8
+ #define IPR_NUM_TRACE_ENTRIES (1 << IPR_NUM_TRACE_INDEX_BITS)
++#define IPR_TRACE_INDEX_MASK (IPR_NUM_TRACE_ENTRIES - 1)
+ #define IPR_TRACE_SIZE (sizeof(struct ipr_trace_entry) * IPR_NUM_TRACE_ENTRIES)
+ char trace_start[8];
+ #define IPR_TRACE_START_LABEL "trace"
+diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
+index 07b2ea1fbf0d..b3c8aabfd687 100644
+--- a/drivers/scsi/sg.c
++++ b/drivers/scsi/sg.c
+@@ -1785,6 +1785,9 @@ sg_start_req(Sg_request *srp, unsigned char *cmd)
+ md->from_user = 0;
+ }
+
++ if (unlikely(iov_count > UIO_MAXIOV))
++ return -EINVAL;
++
+ if (iov_count) {
+ int len, size = sizeof(struct sg_iovec) * iov_count;
+ struct iovec *iov;
+diff --git a/drivers/scsi/st.c b/drivers/scsi/st.c
+index 4daa372ed381..2f3c5f5cfe14 100644
+--- a/drivers/scsi/st.c
++++ b/drivers/scsi/st.c
+@@ -1266,9 +1266,9 @@ static int st_open(struct inode *inode, struct file *filp)
+ spin_lock(&st_use_lock);
+ STp->in_use = 0;
+ spin_unlock(&st_use_lock);
+- scsi_tape_put(STp);
+ if (resumed)
+ scsi_autopm_put_device(STp->device);
++ scsi_tape_put(STp);
+ return retval;
+
+ }
+diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
+index 3c5dd9762476..06ea1a113e45 100644
+--- a/drivers/target/iscsi/iscsi_target.c
++++ b/drivers/target/iscsi/iscsi_target.c
+@@ -3961,7 +3961,13 @@ get_immediate:
+ }
+
+ transport_err:
+- iscsit_take_action_for_connection_exit(conn);
++ /*
++ * Avoid the normal connection failure code-path if this connection
++ * is still within LOGIN mode, and iscsi_np process context is
++ * responsible for cleaning up the early connection failure.
++ */
++ if (conn->conn_state != TARG_CONN_STATE_IN_LOGIN)
++ iscsit_take_action_for_connection_exit(conn);
+ out:
+ return 0;
+ }
+@@ -4047,7 +4053,7 @@ reject:
+
+ int iscsi_target_rx_thread(void *arg)
+ {
+- int ret;
++ int ret, rc;
+ u8 buffer[ISCSI_HDR_LEN], opcode;
+ u32 checksum = 0, digest = 0;
+ struct iscsi_conn *conn = arg;
+@@ -4057,10 +4063,16 @@ int iscsi_target_rx_thread(void *arg)
+ * connection recovery / failure event can be triggered externally.
+ */
+ allow_signal(SIGINT);
++ /*
++ * Wait for iscsi_post_login_handler() to complete before allowing
++ * incoming iscsi/tcp socket I/O, and/or failing the connection.
++ */
++ rc = wait_for_completion_interruptible(&conn->rx_login_comp);
++ if (rc < 0)
++ return 0;
+
+ if (conn->conn_transport->transport_type == ISCSI_INFINIBAND) {
+ struct completion comp;
+- int rc;
+
+ init_completion(&comp);
+ rc = wait_for_completion_interruptible(&comp);
+@@ -4499,7 +4511,18 @@ static void iscsit_logout_post_handler_closesession(
+ struct iscsi_conn *conn)
+ {
+ struct iscsi_session *sess = conn->sess;
+- int sleep = cmpxchg(&conn->tx_thread_active, true, false);
++ int sleep = 1;
++ /*
++ * Traditional iscsi/tcp will invoke this logic from TX thread
++ * context during session logout, so clear tx_thread_active and
++ * sleep if iscsit_close_connection() has not already occured.
++ *
++ * Since iser-target invokes this logic from it's own workqueue,
++ * always sleep waiting for RX/TX thread shutdown to complete
++ * within iscsit_close_connection().
++ */
++ if (conn->conn_transport->transport_type == ISCSI_TCP)
++ sleep = cmpxchg(&conn->tx_thread_active, true, false);
+
+ atomic_set(&conn->conn_logout_remove, 0);
+ complete(&conn->conn_logout_comp);
+@@ -4513,7 +4536,10 @@ static void iscsit_logout_post_handler_closesession(
+ static void iscsit_logout_post_handler_samecid(
+ struct iscsi_conn *conn)
+ {
+- int sleep = cmpxchg(&conn->tx_thread_active, true, false);
++ int sleep = 1;
++
++ if (conn->conn_transport->transport_type == ISCSI_TCP)
++ sleep = cmpxchg(&conn->tx_thread_active, true, false);
+
+ atomic_set(&conn->conn_logout_remove, 0);
+ complete(&conn->conn_logout_comp);
+@@ -4732,6 +4758,7 @@ int iscsit_release_sessions_for_tpg(struct iscsi_portal_group *tpg, int force)
+ struct iscsi_session *sess;
+ struct se_portal_group *se_tpg = &tpg->tpg_se_tpg;
+ struct se_session *se_sess, *se_sess_tmp;
++ LIST_HEAD(free_list);
+ int session_count = 0;
+
+ spin_lock_bh(&se_tpg->session_lock);
+@@ -4753,14 +4780,17 @@ int iscsit_release_sessions_for_tpg(struct iscsi_portal_group *tpg, int force)
+ }
+ atomic_set(&sess->session_reinstatement, 1);
+ spin_unlock(&sess->conn_lock);
+- spin_unlock_bh(&se_tpg->session_lock);
+
+- iscsit_free_session(sess);
+- spin_lock_bh(&se_tpg->session_lock);
++ list_move_tail(&se_sess->sess_list, &free_list);
++ }
++ spin_unlock_bh(&se_tpg->session_lock);
++
++ list_for_each_entry_safe(se_sess, se_sess_tmp, &free_list, sess_list) {
++ sess = (struct iscsi_session *)se_sess->fabric_sess_ptr;
+
++ iscsit_free_session(sess);
+ session_count++;
+ }
+- spin_unlock_bh(&se_tpg->session_lock);
+
+ pr_debug("Released %d iSCSI Session(s) from Target Portal"
+ " Group: %hu\n", session_count, tpg->tpgt);
+diff --git a/drivers/target/iscsi/iscsi_target_core.h b/drivers/target/iscsi/iscsi_target_core.h
+index 2423f27e4670..62eb11329c71 100644
+--- a/drivers/target/iscsi/iscsi_target_core.h
++++ b/drivers/target/iscsi/iscsi_target_core.h
+@@ -605,6 +605,7 @@ struct iscsi_conn {
+ int bitmap_id;
+ int rx_thread_active;
+ struct task_struct *rx_thread;
++ struct completion rx_login_comp;
+ int tx_thread_active;
+ struct task_struct *tx_thread;
+ /* list_head for session connection list */
+diff --git a/drivers/target/iscsi/iscsi_target_login.c b/drivers/target/iscsi/iscsi_target_login.c
+index 2d87abc6b38c..719ec300cd24 100644
+--- a/drivers/target/iscsi/iscsi_target_login.c
++++ b/drivers/target/iscsi/iscsi_target_login.c
+@@ -83,6 +83,7 @@ static struct iscsi_login *iscsi_login_init_conn(struct iscsi_conn *conn)
+ init_completion(&conn->conn_logout_comp);
+ init_completion(&conn->rx_half_close_comp);
+ init_completion(&conn->tx_half_close_comp);
++ init_completion(&conn->rx_login_comp);
+ spin_lock_init(&conn->cmd_lock);
+ spin_lock_init(&conn->conn_usage_lock);
+ spin_lock_init(&conn->immed_queue_lock);
+@@ -734,6 +735,7 @@ int iscsit_start_kthreads(struct iscsi_conn *conn)
+
+ return 0;
+ out_tx:
++ send_sig(SIGINT, conn->tx_thread, 1);
+ kthread_stop(conn->tx_thread);
+ conn->tx_thread_active = false;
+ out_bitmap:
+@@ -744,7 +746,7 @@ out_bitmap:
+ return ret;
+ }
+
+-int iscsi_post_login_handler(
++void iscsi_post_login_handler(
+ struct iscsi_np *np,
+ struct iscsi_conn *conn,
+ u8 zero_tsih)
+@@ -754,7 +756,6 @@ int iscsi_post_login_handler(
+ struct se_session *se_sess = sess->se_sess;
+ struct iscsi_portal_group *tpg = sess->tpg;
+ struct se_portal_group *se_tpg = &tpg->tpg_se_tpg;
+- int rc;
+
+ iscsit_inc_conn_usage_count(conn);
+
+@@ -795,10 +796,6 @@ int iscsi_post_login_handler(
+ sess->sess_ops->InitiatorName);
+ spin_unlock_bh(&sess->conn_lock);
+
+- rc = iscsit_start_kthreads(conn);
+- if (rc)
+- return rc;
+-
+ iscsi_post_login_start_timers(conn);
+ /*
+ * Determine CPU mask to ensure connection's RX and TX kthreads
+@@ -807,15 +804,20 @@ int iscsi_post_login_handler(
+ iscsit_thread_get_cpumask(conn);
+ conn->conn_rx_reset_cpumask = 1;
+ conn->conn_tx_reset_cpumask = 1;
+-
++ /*
++ * Wakeup the sleeping iscsi_target_rx_thread() now that
++ * iscsi_conn is in TARG_CONN_STATE_LOGGED_IN state.
++ */
++ complete(&conn->rx_login_comp);
+ iscsit_dec_conn_usage_count(conn);
++
+ if (stop_timer) {
+ spin_lock_bh(&se_tpg->session_lock);
+ iscsit_stop_time2retain_timer(sess);
+ spin_unlock_bh(&se_tpg->session_lock);
+ }
+ iscsit_dec_session_usage_count(sess);
+- return 0;
++ return;
+ }
+
+ iscsi_set_session_parameters(sess->sess_ops, conn->param_list, 1);
+@@ -856,10 +858,6 @@ int iscsi_post_login_handler(
+ " iSCSI Target Portal Group: %hu\n", tpg->nsessions, tpg->tpgt);
+ spin_unlock_bh(&se_tpg->session_lock);
+
+- rc = iscsit_start_kthreads(conn);
+- if (rc)
+- return rc;
+-
+ iscsi_post_login_start_timers(conn);
+ /*
+ * Determine CPU mask to ensure connection's RX and TX kthreads
+@@ -868,10 +866,12 @@ int iscsi_post_login_handler(
+ iscsit_thread_get_cpumask(conn);
+ conn->conn_rx_reset_cpumask = 1;
+ conn->conn_tx_reset_cpumask = 1;
+-
++ /*
++ * Wakeup the sleeping iscsi_target_rx_thread() now that
++ * iscsi_conn is in TARG_CONN_STATE_LOGGED_IN state.
++ */
++ complete(&conn->rx_login_comp);
+ iscsit_dec_conn_usage_count(conn);
+-
+- return 0;
+ }
+
+ static void iscsi_handle_login_thread_timeout(unsigned long data)
+@@ -1435,23 +1435,12 @@ static int __iscsi_target_login_thread(struct iscsi_np *np)
+ if (ret < 0)
+ goto new_sess_out;
+
+- if (!conn->sess) {
+- pr_err("struct iscsi_conn session pointer is NULL!\n");
+- goto new_sess_out;
+- }
+-
+ iscsi_stop_login_thread_timer(np);
+
+- if (signal_pending(current))
+- goto new_sess_out;
+-
+ if (ret == 1) {
+ tpg_np = conn->tpg_np;
+
+- ret = iscsi_post_login_handler(np, conn, zero_tsih);
+- if (ret < 0)
+- goto new_sess_out;
+-
++ iscsi_post_login_handler(np, conn, zero_tsih);
+ iscsit_deaccess_np(np, tpg, tpg_np);
+ }
+
+diff --git a/drivers/target/iscsi/iscsi_target_login.h b/drivers/target/iscsi/iscsi_target_login.h
+index 29d098324b7f..55cbf4533544 100644
+--- a/drivers/target/iscsi/iscsi_target_login.h
++++ b/drivers/target/iscsi/iscsi_target_login.h
+@@ -12,7 +12,8 @@ extern int iscsit_accept_np(struct iscsi_np *, struct iscsi_conn *);
+ extern int iscsit_get_login_rx(struct iscsi_conn *, struct iscsi_login *);
+ extern int iscsit_put_login_tx(struct iscsi_conn *, struct iscsi_login *, u32);
+ extern void iscsit_free_conn(struct iscsi_np *, struct iscsi_conn *);
+-extern int iscsi_post_login_handler(struct iscsi_np *, struct iscsi_conn *, u8);
++extern int iscsit_start_kthreads(struct iscsi_conn *);
++extern void iscsi_post_login_handler(struct iscsi_np *, struct iscsi_conn *, u8);
+ extern void iscsi_target_login_sess_out(struct iscsi_conn *, struct iscsi_np *,
+ bool, bool);
+ extern int iscsi_target_login_thread(void *);
+diff --git a/drivers/target/iscsi/iscsi_target_nego.c b/drivers/target/iscsi/iscsi_target_nego.c
+index 62a095f36bf2..092112e5e1a6 100644
+--- a/drivers/target/iscsi/iscsi_target_nego.c
++++ b/drivers/target/iscsi/iscsi_target_nego.c
+@@ -17,6 +17,7 @@
+ ******************************************************************************/
+
+ #include <linux/ctype.h>
++#include <linux/kthread.h>
+ #include <scsi/iscsi_proto.h>
+ #include <target/target_core_base.h>
+ #include <target/target_core_fabric.h>
+@@ -361,10 +362,24 @@ static int iscsi_target_do_tx_login_io(struct iscsi_conn *conn, struct iscsi_log
+ ntohl(login_rsp->statsn), login->rsp_length);
+
+ padding = ((-login->rsp_length) & 3);
++ /*
++ * Before sending the last login response containing the transition
++ * bit for full-feature-phase, go ahead and start up TX/RX threads
++ * now to avoid potential resource allocation failures after the
++ * final login response has been sent.
++ */
++ if (login->login_complete) {
++ int rc = iscsit_start_kthreads(conn);
++ if (rc) {
++ iscsit_tx_login_rsp(conn, ISCSI_STATUS_CLS_TARGET_ERR,
++ ISCSI_LOGIN_STATUS_NO_RESOURCES);
++ return -1;
++ }
++ }
+
+ if (conn->conn_transport->iscsit_put_login_tx(conn, login,
+ login->rsp_length + padding) < 0)
+- return -1;
++ goto err;
+
+ login->rsp_length = 0;
+ mutex_lock(&sess->cmdsn_mutex);
+@@ -373,6 +388,23 @@ static int iscsi_target_do_tx_login_io(struct iscsi_conn *conn, struct iscsi_log
+ mutex_unlock(&sess->cmdsn_mutex);
+
+ return 0;
++
++err:
++ if (login->login_complete) {
++ if (conn->rx_thread && conn->rx_thread_active) {
++ send_sig(SIGINT, conn->rx_thread, 1);
++ kthread_stop(conn->rx_thread);
++ }
++ if (conn->tx_thread && conn->tx_thread_active) {
++ send_sig(SIGINT, conn->tx_thread, 1);
++ kthread_stop(conn->tx_thread);
++ }
++ spin_lock(&iscsit_global->ts_bitmap_lock);
++ bitmap_release_region(iscsit_global->ts_bitmap, conn->bitmap_id,
++ get_order(1));
++ spin_unlock(&iscsit_global->ts_bitmap_lock);
++ }
++ return -1;
+ }
+
+ static void iscsi_target_sk_data_ready(struct sock *sk)
+diff --git a/drivers/thermal/rcar_thermal.c b/drivers/thermal/rcar_thermal.c
+index 8803e693fe68..2f3b4ff5b9d1 100644
+--- a/drivers/thermal/rcar_thermal.c
++++ b/drivers/thermal/rcar_thermal.c
+@@ -372,6 +372,7 @@ static int rcar_thermal_probe(struct platform_device *pdev)
+ int i;
+ int ret = -ENODEV;
+ int idle = IDLE_INTERVAL;
++ u32 enr_bits = 0;
+
+ common = devm_kzalloc(dev, sizeof(*common), GFP_KERNEL);
+ if (!common)
+@@ -408,9 +409,6 @@ static int rcar_thermal_probe(struct platform_device *pdev)
+ if (IS_ERR(common->base))
+ return PTR_ERR(common->base);
+
+- /* enable temperature comparation */
+- rcar_thermal_common_write(common, ENR, 0x00030303);
+-
+ idle = 0; /* polling delay is not needed */
+ }
+
+@@ -452,8 +450,15 @@ static int rcar_thermal_probe(struct platform_device *pdev)
+ rcar_thermal_irq_enable(priv);
+
+ list_move_tail(&priv->list, &common->head);
++
++ /* update ENR bits */
++ enr_bits |= 3 << (i * 8);
+ }
+
++ /* enable temperature comparation */
++ if (irq)
++ rcar_thermal_common_write(common, ENR, enr_bits);
++
+ platform_set_drvdata(pdev, common);
+
+ dev_info(dev, "%d sensor probed\n", i);
+diff --git a/drivers/usb/gadget/function/f_uac2.c b/drivers/usb/gadget/function/f_uac2.c
+index 33e16658e5cf..df02947a77e3 100644
+--- a/drivers/usb/gadget/function/f_uac2.c
++++ b/drivers/usb/gadget/function/f_uac2.c
+@@ -1162,14 +1162,14 @@ afunc_set_alt(struct usb_function *fn, unsigned intf, unsigned alt)
+ factor = 1000;
+ } else {
+ ep_desc = &hs_epin_desc;
+- factor = 125;
++ factor = 8000;
+ }
+
+ /* pre-compute some values for iso_complete() */
+ uac2->p_framesize = opts->p_ssize *
+ num_channels(opts->p_chmask);
+ rate = opts->p_srate * uac2->p_framesize;
+- uac2->p_interval = (1 << (ep_desc->bInterval - 1)) * factor;
++ uac2->p_interval = factor / (1 << (ep_desc->bInterval - 1));
+ uac2->p_pktsize = min_t(unsigned int, rate / uac2->p_interval,
+ prm->max_psize);
+
+diff --git a/drivers/usb/gadget/udc/udc-core.c b/drivers/usb/gadget/udc/udc-core.c
+index f2054659f25b..5442febcd7af 100644
+--- a/drivers/usb/gadget/udc/udc-core.c
++++ b/drivers/usb/gadget/udc/udc-core.c
+@@ -301,6 +301,7 @@ err4:
+
+ err3:
+ put_device(&udc->dev);
++ device_del(&gadget->dev);
+
+ err2:
+ put_device(&gadget->dev);
+diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
+index 7ff97c39c8b4..8bdfb38782f8 100644
+--- a/drivers/usb/host/xhci-hub.c
++++ b/drivers/usb/host/xhci-hub.c
+@@ -484,10 +484,13 @@ static void xhci_hub_report_usb3_link_state(struct xhci_hcd *xhci,
+ u32 pls = status_reg & PORT_PLS_MASK;
+
+ /* resume state is a xHCI internal state.
+- * Do not report it to usb core.
++ * Do not report it to usb core, instead, pretend to be U3,
++ * thus usb core knows it's not ready for transfer
+ */
+- if (pls == XDEV_RESUME)
++ if (pls == XDEV_RESUME) {
++ *status |= USB_SS_PORT_LS_U3;
+ return;
++ }
+
+ /* When the CAS bit is set then warm reset
+ * should be performed on port
+@@ -588,7 +591,14 @@ static u32 xhci_get_port_status(struct usb_hcd *hcd,
+ status |= USB_PORT_STAT_C_RESET << 16;
+ /* USB3.0 only */
+ if (hcd->speed == HCD_USB3) {
+- if ((raw_port_status & PORT_PLC))
++ /* Port link change with port in resume state should not be
++ * reported to usbcore, as this is an internal state to be
++ * handled by xhci driver. Reporting PLC to usbcore may
++ * cause usbcore clearing PLC first and port change event
++ * irq won't be generated.
++ */
++ if ((raw_port_status & PORT_PLC) &&
++ (raw_port_status & PORT_PLS_MASK) != XDEV_RESUME)
+ status |= USB_PORT_STAT_C_LINK_STATE << 16;
+ if ((raw_port_status & PORT_WRC))
+ status |= USB_PORT_STAT_C_BH_RESET << 16;
+diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
+index a67018eddf41..d44c904df055 100644
+--- a/drivers/usb/host/xhci-mem.c
++++ b/drivers/usb/host/xhci-mem.c
+@@ -1796,7 +1796,8 @@ void xhci_mem_cleanup(struct xhci_hcd *xhci)
+ int size;
+ int i, j, num_ports;
+
+- del_timer_sync(&xhci->cmd_timer);
++ if (timer_pending(&xhci->cmd_timer))
++ del_timer_sync(&xhci->cmd_timer);
+
+ /* Free the Event Ring Segment Table and the actual Event Ring */
+ size = sizeof(struct xhci_erst_entry)*(xhci->erst.num_entries);
+diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
+index 9848a67ddbbe..c70291cffc27 100644
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -82,7 +82,7 @@ dma_addr_t xhci_trb_virt_to_dma(struct xhci_segment *seg,
+ return 0;
+ /* offset in TRBs */
+ segment_offset = trb - seg->trbs;
+- if (segment_offset > TRBS_PER_SEGMENT)
++ if (segment_offset >= TRBS_PER_SEGMENT)
+ return 0;
+ return seg->dma + (segment_offset * sizeof(*trb));
+ }
+diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
+index 3bceabe109f7..8e5f46082316 100644
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -3457,6 +3457,9 @@ int xhci_discover_or_reset_device(struct usb_hcd *hcd, struct usb_device *udev)
+ return -EINVAL;
+ }
+
++ if (virt_dev->tt_info)
++ old_active_eps = virt_dev->tt_info->active_eps;
++
+ if (virt_dev->udev != udev) {
+ /* If the virt_dev and the udev does not match, this virt_dev
+ * may belong to another udev.
+diff --git a/drivers/usb/renesas_usbhs/fifo.c b/drivers/usb/renesas_usbhs/fifo.c
+index b0c97a3f1bfe..634c14d022ce 100644
+--- a/drivers/usb/renesas_usbhs/fifo.c
++++ b/drivers/usb/renesas_usbhs/fifo.c
+@@ -621,6 +621,8 @@ struct usbhs_pkt_handle usbhs_fifo_pio_push_handler = {
+ static int usbhsf_prepare_pop(struct usbhs_pkt *pkt, int *is_done)
+ {
+ struct usbhs_pipe *pipe = pkt->pipe;
++ struct usbhs_priv *priv = usbhs_pipe_to_priv(pipe);
++ struct usbhs_fifo *fifo = usbhsf_get_cfifo(priv);
+
+ if (usbhs_pipe_is_busy(pipe))
+ return 0;
+@@ -634,6 +636,9 @@ static int usbhsf_prepare_pop(struct usbhs_pkt *pkt, int *is_done)
+ usbhs_pipe_data_sequence(pipe, pkt->sequence);
+ pkt->sequence = -1; /* -1 sequence will be ignored */
+
++ if (usbhs_pipe_is_dcp(pipe))
++ usbhsf_fifo_clear(pipe, fifo);
++
+ usbhs_pipe_set_trans_count_if_bulk(pipe, pkt->length);
+ usbhs_pipe_enable(pipe);
+ usbhs_pipe_running(pipe, 1);
+@@ -683,7 +688,14 @@ static int usbhsf_pio_try_pop(struct usbhs_pkt *pkt, int *is_done)
+ *is_done = 1;
+ usbhsf_rx_irq_ctrl(pipe, 0);
+ usbhs_pipe_running(pipe, 0);
+- usbhs_pipe_disable(pipe); /* disable pipe first */
++ /*
++ * If function mode, since this controller is possible to enter
++ * Control Write status stage at this timing, this driver
++ * should not disable the pipe. If such a case happens, this
++ * controller is not able to complete the status stage.
++ */
++ if (!usbhs_mod_is_host(priv) && !usbhs_pipe_is_dcp(pipe))
++ usbhs_pipe_disable(pipe); /* disable pipe first */
+ }
+
+ /*
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index c8c4e50ffee1..463feb836f20 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -1107,6 +1107,8 @@ static const struct usb_device_id option_ids[] = {
+ { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x9000)}, /* SIMCom SIM5218 */
+ { USB_DEVICE_INTERFACE_CLASS(SIERRA_VENDOR_ID, 0x68c0, 0xff),
+ .driver_info = (kernel_ulong_t)&sierra_mc73xx_blacklist }, /* MC73xx */
++ { USB_DEVICE_INTERFACE_CLASS(SIERRA_VENDOR_ID, 0x9041, 0xff),
++ .driver_info = (kernel_ulong_t)&sierra_mc73xx_blacklist }, /* MC7305/MC7355 */
+ { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6001) },
+ { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CMU_300) },
+ { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6003),
+diff --git a/drivers/usb/serial/qcserial.c b/drivers/usb/serial/qcserial.c
+index 9c63897b3a56..d156545728c2 100644
+--- a/drivers/usb/serial/qcserial.c
++++ b/drivers/usb/serial/qcserial.c
+@@ -145,7 +145,6 @@ static const struct usb_device_id id_table[] = {
+ {DEVICE_SWI(0x1199, 0x901c)}, /* Sierra Wireless EM7700 */
+ {DEVICE_SWI(0x1199, 0x901f)}, /* Sierra Wireless EM7355 */
+ {DEVICE_SWI(0x1199, 0x9040)}, /* Sierra Wireless Modem */
+- {DEVICE_SWI(0x1199, 0x9041)}, /* Sierra Wireless MC7305/MC7355 */
+ {DEVICE_SWI(0x1199, 0x9051)}, /* Netgear AirCard 340U */
+ {DEVICE_SWI(0x1199, 0x9053)}, /* Sierra Wireless Modem */
+ {DEVICE_SWI(0x1199, 0x9054)}, /* Sierra Wireless Modem */
+@@ -158,6 +157,7 @@ static const struct usb_device_id id_table[] = {
+ {DEVICE_SWI(0x413c, 0x81a4)}, /* Dell Wireless 5570e HSPA+ (42Mbps) Mobile Broadband Card */
+ {DEVICE_SWI(0x413c, 0x81a8)}, /* Dell Wireless 5808 Gobi(TM) 4G LTE Mobile Broadband Card */
+ {DEVICE_SWI(0x413c, 0x81a9)}, /* Dell Wireless 5808e Gobi(TM) 4G LTE Mobile Broadband Card */
++ {DEVICE_SWI(0x413c, 0x81b1)}, /* Dell Wireless 5809e Gobi(TM) 4G LTE Mobile Broadband Card */
+
+ /* Huawei devices */
+ {DEVICE_HWI(0x03f0, 0x581d)}, /* HP lt4112 LTE/HSPA+ Gobi 4G Modem (Huawei me906e) */
+diff --git a/drivers/usb/serial/sierra.c b/drivers/usb/serial/sierra.c
+index 46179a0828eb..07d1ecd564f7 100644
+--- a/drivers/usb/serial/sierra.c
++++ b/drivers/usb/serial/sierra.c
+@@ -289,6 +289,7 @@ static const struct usb_device_id id_table[] = {
+ { USB_DEVICE_AND_INTERFACE_INFO(0x1199, 0x68AA, 0xFF, 0xFF, 0xFF),
+ .driver_info = (kernel_ulong_t)&direct_ip_interface_blacklist
+ },
++ { USB_DEVICE(0x1199, 0x68AB) }, /* Sierra Wireless AR8550 */
+ /* AT&T Direct IP LTE modems */
+ { USB_DEVICE_AND_INTERFACE_INFO(0x0F3D, 0x68AA, 0xFF, 0xFF, 0xFF),
+ .driver_info = (kernel_ulong_t)&direct_ip_interface_blacklist
+diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
+index 300ef9b817ed..36584e1f15c5 100644
+--- a/drivers/usb/storage/unusual_devs.h
++++ b/drivers/usb/storage/unusual_devs.h
+@@ -2065,6 +2065,18 @@ UNUSUAL_DEV( 0x1908, 0x3335, 0x0200, 0x0200,
+ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+ US_FL_NO_READ_DISC_INFO ),
+
++/* Reported by Oliver Neukum <oneukum@suse.com>
++ * This device morphes spontaneously into another device if the access
++ * pattern of Windows isn't followed. Thus writable media would be dirty
++ * if the initial instance is used. So the device is limited to its
++ * virtual CD.
++ * And yes, the concept that BCD goes up to 9 is not heeded */
++UNUSUAL_DEV( 0x19d2, 0x1225, 0x0000, 0xffff,
++ "ZTE,Incorporated",
++ "ZTE WCDMA Technologies MSM",
++ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
++ US_FL_SINGLE_LUN ),
++
+ /* Reported by Sven Geggus <sven-usbst@geggus.net>
+ * This encrypted pen drive returns bogus data for the initial READ(10).
+ */
+diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
+index c90f4374442a..1fe2c8115be0 100644
+--- a/drivers/vhost/vhost.c
++++ b/drivers/vhost/vhost.c
+@@ -882,6 +882,7 @@ long vhost_dev_ioctl(struct vhost_dev *d, unsigned int ioctl, void __user *argp)
+ }
+ if (eventfp != d->log_file) {
+ filep = d->log_file;
++ d->log_file = eventfp;
+ ctx = d->log_ctx;
+ d->log_ctx = eventfp ?
+ eventfd_ctx_fileget(eventfp) : NULL;
+diff --git a/drivers/xen/gntdev.c b/drivers/xen/gntdev.c
+index 073b4a19a8b0..91cc44611062 100644
+--- a/drivers/xen/gntdev.c
++++ b/drivers/xen/gntdev.c
+@@ -67,7 +67,7 @@ struct gntdev_priv {
+ * Only populated if populate_freeable_maps == 1 */
+ struct list_head freeable_maps;
+ /* lock protects maps and freeable_maps */
+- spinlock_t lock;
++ struct mutex lock;
+ struct mm_struct *mm;
+ struct mmu_notifier mn;
+ };
+@@ -216,9 +216,9 @@ static void gntdev_put_map(struct gntdev_priv *priv, struct grant_map *map)
+ }
+
+ if (populate_freeable_maps && priv) {
+- spin_lock(&priv->lock);
++ mutex_lock(&priv->lock);
+ list_del(&map->next);
+- spin_unlock(&priv->lock);
++ mutex_unlock(&priv->lock);
+ }
+
+ if (map->pages && !use_ptemod)
+@@ -387,9 +387,9 @@ static void gntdev_vma_close(struct vm_area_struct *vma)
+ * not do any unmapping, since that has been done prior to
+ * closing the vma, but it may still iterate the unmap_ops list.
+ */
+- spin_lock(&priv->lock);
++ mutex_lock(&priv->lock);
+ map->vma = NULL;
+- spin_unlock(&priv->lock);
++ mutex_unlock(&priv->lock);
+ }
+ vma->vm_private_data = NULL;
+ gntdev_put_map(priv, map);
+@@ -433,14 +433,14 @@ static void mn_invl_range_start(struct mmu_notifier *mn,
+ struct gntdev_priv *priv = container_of(mn, struct gntdev_priv, mn);
+ struct grant_map *map;
+
+- spin_lock(&priv->lock);
++ mutex_lock(&priv->lock);
+ list_for_each_entry(map, &priv->maps, next) {
+ unmap_if_in_range(map, start, end);
+ }
+ list_for_each_entry(map, &priv->freeable_maps, next) {
+ unmap_if_in_range(map, start, end);
+ }
+- spin_unlock(&priv->lock);
++ mutex_unlock(&priv->lock);
+ }
+
+ static void mn_invl_page(struct mmu_notifier *mn,
+@@ -457,7 +457,7 @@ static void mn_release(struct mmu_notifier *mn,
+ struct grant_map *map;
+ int err;
+
+- spin_lock(&priv->lock);
++ mutex_lock(&priv->lock);
+ list_for_each_entry(map, &priv->maps, next) {
+ if (!map->vma)
+ continue;
+@@ -476,7 +476,7 @@ static void mn_release(struct mmu_notifier *mn,
+ err = unmap_grant_pages(map, /* offset */ 0, map->count);
+ WARN_ON(err);
+ }
+- spin_unlock(&priv->lock);
++ mutex_unlock(&priv->lock);
+ }
+
+ static struct mmu_notifier_ops gntdev_mmu_ops = {
+@@ -498,7 +498,7 @@ static int gntdev_open(struct inode *inode, struct file *flip)
+
+ INIT_LIST_HEAD(&priv->maps);
+ INIT_LIST_HEAD(&priv->freeable_maps);
+- spin_lock_init(&priv->lock);
++ mutex_init(&priv->lock);
+
+ if (use_ptemod) {
+ priv->mm = get_task_mm(current);
+@@ -529,12 +529,14 @@ static int gntdev_release(struct inode *inode, struct file *flip)
+
+ pr_debug("priv %p\n", priv);
+
++ mutex_lock(&priv->lock);
+ while (!list_empty(&priv->maps)) {
+ map = list_entry(priv->maps.next, struct grant_map, next);
+ list_del(&map->next);
+ gntdev_put_map(NULL /* already removed */, map);
+ }
+ WARN_ON(!list_empty(&priv->freeable_maps));
++ mutex_unlock(&priv->lock);
+
+ if (use_ptemod)
+ mmu_notifier_unregister(&priv->mn, priv->mm);
+@@ -572,10 +574,10 @@ static long gntdev_ioctl_map_grant_ref(struct gntdev_priv *priv,
+ return -EFAULT;
+ }
+
+- spin_lock(&priv->lock);
++ mutex_lock(&priv->lock);
+ gntdev_add_map(priv, map);
+ op.index = map->index << PAGE_SHIFT;
+- spin_unlock(&priv->lock);
++ mutex_unlock(&priv->lock);
+
+ if (copy_to_user(u, &op, sizeof(op)) != 0)
+ return -EFAULT;
+@@ -594,7 +596,7 @@ static long gntdev_ioctl_unmap_grant_ref(struct gntdev_priv *priv,
+ return -EFAULT;
+ pr_debug("priv %p, del %d+%d\n", priv, (int)op.index, (int)op.count);
+
+- spin_lock(&priv->lock);
++ mutex_lock(&priv->lock);
+ map = gntdev_find_map_index(priv, op.index >> PAGE_SHIFT, op.count);
+ if (map) {
+ list_del(&map->next);
+@@ -602,7 +604,7 @@ static long gntdev_ioctl_unmap_grant_ref(struct gntdev_priv *priv,
+ list_add_tail(&map->next, &priv->freeable_maps);
+ err = 0;
+ }
+- spin_unlock(&priv->lock);
++ mutex_unlock(&priv->lock);
+ if (map)
+ gntdev_put_map(priv, map);
+ return err;
+@@ -670,7 +672,7 @@ static long gntdev_ioctl_notify(struct gntdev_priv *priv, void __user *u)
+ out_flags = op.action;
+ out_event = op.event_channel_port;
+
+- spin_lock(&priv->lock);
++ mutex_lock(&priv->lock);
+
+ list_for_each_entry(map, &priv->maps, next) {
+ uint64_t begin = map->index << PAGE_SHIFT;
+@@ -698,7 +700,7 @@ static long gntdev_ioctl_notify(struct gntdev_priv *priv, void __user *u)
+ rc = 0;
+
+ unlock_out:
+- spin_unlock(&priv->lock);
++ mutex_unlock(&priv->lock);
+
+ /* Drop the reference to the event channel we did not save in the map */
+ if (out_flags & UNMAP_NOTIFY_SEND_EVENT)
+@@ -748,7 +750,7 @@ static int gntdev_mmap(struct file *flip, struct vm_area_struct *vma)
+ pr_debug("map %d+%d at %lx (pgoff %lx)\n",
+ index, count, vma->vm_start, vma->vm_pgoff);
+
+- spin_lock(&priv->lock);
++ mutex_lock(&priv->lock);
+ map = gntdev_find_map_index(priv, index, count);
+ if (!map)
+ goto unlock_out;
+@@ -783,7 +785,7 @@ static int gntdev_mmap(struct file *flip, struct vm_area_struct *vma)
+ map->flags |= GNTMAP_readonly;
+ }
+
+- spin_unlock(&priv->lock);
++ mutex_unlock(&priv->lock);
+
+ if (use_ptemod) {
+ err = apply_to_page_range(vma->vm_mm, vma->vm_start,
+@@ -811,11 +813,11 @@ static int gntdev_mmap(struct file *flip, struct vm_area_struct *vma)
+ return 0;
+
+ unlock_out:
+- spin_unlock(&priv->lock);
++ mutex_unlock(&priv->lock);
+ return err;
+
+ out_unlock_put:
+- spin_unlock(&priv->lock);
++ mutex_unlock(&priv->lock);
+ out_put_map:
+ if (use_ptemod)
+ map->vma = NULL;
+diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
+index bf3f424e0013..02391f3eb9b0 100644
+--- a/fs/btrfs/extent_io.c
++++ b/fs/btrfs/extent_io.c
+@@ -4484,8 +4484,11 @@ int extent_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo,
+ }
+ ret = fiemap_fill_next_extent(fieinfo, em_start, disko,
+ em_len, flags);
+- if (ret)
++ if (ret) {
++ if (ret == 1)
++ ret = 0;
+ goto out_free;
++ }
+ }
+ out_free:
+ free_extent_map(em);
+diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c
+index cde9c03e3913..2105555657fc 100644
+--- a/fs/btrfs/super.c
++++ b/fs/btrfs/super.c
+@@ -901,6 +901,15 @@ find_root:
+ if (IS_ERR(new_root))
+ return ERR_CAST(new_root);
+
++ if (!(sb->s_flags & MS_RDONLY)) {
++ int ret;
++ down_read(&fs_info->cleanup_work_sem);
++ ret = btrfs_orphan_cleanup(new_root);
++ up_read(&fs_info->cleanup_work_sem);
++ if (ret)
++ return ERR_PTR(ret);
++ }
++
+ dir_id = btrfs_root_dirid(&new_root->root_item);
+ setup_root:
+ location.objectid = dir_id;
+diff --git a/fs/dcache.c b/fs/dcache.c
+index d0539a4a1ab1..a66d6d80e2d9 100644
+--- a/fs/dcache.c
++++ b/fs/dcache.c
+@@ -629,6 +629,9 @@ repeat:
+ if (unlikely(d_unhashed(dentry)))
+ goto kill_it;
+
++ if (unlikely(dentry->d_flags & DCACHE_DISCONNECTED))
++ goto kill_it;
++
+ if (unlikely(dentry->d_flags & DCACHE_OP_DELETE)) {
+ if (dentry->d_op->d_delete(dentry))
+ goto kill_it;
+diff --git a/fs/hpfs/super.c b/fs/hpfs/super.c
+index 7cd00d3a7c9b..f445d155dfae 100644
+--- a/fs/hpfs/super.c
++++ b/fs/hpfs/super.c
+@@ -52,17 +52,20 @@ static void unmark_dirty(struct super_block *s)
+ }
+
+ /* Filesystem error... */
+-static char err_buf[1024];
+-
+ void hpfs_error(struct super_block *s, const char *fmt, ...)
+ {
++ struct va_format vaf;
+ va_list args;
+
+ va_start(args, fmt);
+- vsnprintf(err_buf, sizeof(err_buf), fmt, args);
++
++ vaf.fmt = fmt;
++ vaf.va = &args;
++
++ pr_err("filesystem error: %pV", &vaf);
++
+ va_end(args);
+
+- pr_err("filesystem error: %s", err_buf);
+ if (!hpfs_sb(s)->sb_was_error) {
+ if (hpfs_sb(s)->sb_err == 2) {
+ pr_cont("; crashing the system because you wanted it\n");
+diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
+index 58f98ad93828..eda99c8ec3ed 100644
+--- a/fs/nfsd/nfs4state.c
++++ b/fs/nfsd/nfs4state.c
+@@ -4285,9 +4285,9 @@ laundromat_main(struct work_struct *laundry)
+ queue_delayed_work(laundry_wq, &nn->laundromat_work, t*HZ);
+ }
+
+-static inline __be32 nfs4_check_fh(struct svc_fh *fhp, struct nfs4_ol_stateid *stp)
++static inline __be32 nfs4_check_fh(struct svc_fh *fhp, struct nfs4_stid *stp)
+ {
+- if (!nfsd_fh_match(&fhp->fh_handle, &stp->st_stid.sc_file->fi_fhandle))
++ if (!nfsd_fh_match(&fhp->fh_handle, &stp->sc_file->fi_fhandle))
+ return nfserr_bad_stateid;
+ return nfs_ok;
+ }
+@@ -4462,20 +4462,49 @@ nfsd4_lookup_stateid(struct nfsd4_compound_state *cstate,
+ return nfs_ok;
+ }
+
++static struct file *
++nfs4_find_file(struct nfs4_stid *s, int flags)
++{
++ switch (s->sc_type) {
++ case NFS4_DELEG_STID:
++ if (WARN_ON_ONCE(!s->sc_file->fi_deleg_file))
++ return NULL;
++ return get_file(s->sc_file->fi_deleg_file);
++ case NFS4_OPEN_STID:
++ case NFS4_LOCK_STID:
++ if (flags & RD_STATE)
++ return find_readable_file(s->sc_file);
++ else
++ return find_writeable_file(s->sc_file);
++ break;
++ }
++
++ return NULL;
++}
++
++static __be32
++nfs4_check_olstateid(struct svc_fh *fhp, struct nfs4_ol_stateid *ols, int flags)
++{
++ __be32 status;
++
++ status = nfsd4_check_openowner_confirmed(ols);
++ if (status)
++ return status;
++ return nfs4_check_openmode(ols, flags);
++}
++
+ /*
+-* Checks for stateid operations
+-*/
++ * Checks for stateid operations
++ */
+ __be32
+ nfs4_preprocess_stateid_op(struct net *net, struct nfsd4_compound_state *cstate,
+ stateid_t *stateid, int flags, struct file **filpp)
+ {
+- struct nfs4_stid *s;
+- struct nfs4_ol_stateid *stp = NULL;
+- struct nfs4_delegation *dp = NULL;
+- struct svc_fh *current_fh = &cstate->current_fh;
+- struct inode *ino = current_fh->fh_dentry->d_inode;
++ struct svc_fh *fhp = &cstate->current_fh;
++ struct inode *ino = fhp->fh_dentry->d_inode;
++
+ struct nfsd_net *nn = net_generic(net, nfsd_net_id);
+- struct file *file = NULL;
++ struct nfs4_stid *s;
+ __be32 status;
+
+ if (filpp)
+@@ -4485,60 +4514,39 @@ nfs4_preprocess_stateid_op(struct net *net, struct nfsd4_compound_state *cstate,
+ return nfserr_grace;
+
+ if (ZERO_STATEID(stateid) || ONE_STATEID(stateid))
+- return check_special_stateids(net, current_fh, stateid, flags);
++ return check_special_stateids(net, fhp, stateid, flags);
+
+ status = nfsd4_lookup_stateid(cstate, stateid,
+ NFS4_DELEG_STID|NFS4_OPEN_STID|NFS4_LOCK_STID,
+ &s, nn);
+ if (status)
+ return status;
+- status = check_stateid_generation(stateid, &s->sc_stateid, nfsd4_has_session(cstate));
++ status = check_stateid_generation(stateid, &s->sc_stateid,
++ nfsd4_has_session(cstate));
+ if (status)
+ goto out;
++
+ switch (s->sc_type) {
+ case NFS4_DELEG_STID:
+- dp = delegstateid(s);
+- status = nfs4_check_delegmode(dp, flags);
+- if (status)
+- goto out;
+- if (filpp) {
+- file = dp->dl_stid.sc_file->fi_deleg_file;
+- if (!file) {
+- WARN_ON_ONCE(1);
+- status = nfserr_serverfault;
+- goto out;
+- }
+- get_file(file);
+- }
++ status = nfs4_check_delegmode(delegstateid(s), flags);
+ break;
+ case NFS4_OPEN_STID:
+ case NFS4_LOCK_STID:
+- stp = openlockstateid(s);
+- status = nfs4_check_fh(current_fh, stp);
+- if (status)
+- goto out;
+- status = nfsd4_check_openowner_confirmed(stp);
+- if (status)
+- goto out;
+- status = nfs4_check_openmode(stp, flags);
+- if (status)
+- goto out;
+- if (filpp) {
+- struct nfs4_file *fp = stp->st_stid.sc_file;
+-
+- if (flags & RD_STATE)
+- file = find_readable_file(fp);
+- else
+- file = find_writeable_file(fp);
+- }
++ status = nfs4_check_olstateid(fhp, openlockstateid(s), flags);
+ break;
+ default:
+ status = nfserr_bad_stateid;
++ break;
++ }
++ if (status)
+ goto out;
++ status = nfs4_check_fh(fhp, s);
++
++ if (!status && filpp) {
++ *filpp = nfs4_find_file(s, flags);
++ if (!*filpp)
++ status = nfserr_serverfault;
+ }
+- status = nfs_ok;
+- if (file)
+- *filpp = file;
+ out:
+ nfs4_put_stid(s);
+ return status;
+@@ -4642,7 +4650,7 @@ static __be32 nfs4_seqid_op_checks(struct nfsd4_compound_state *cstate, stateid_
+ status = check_stateid_generation(stateid, &stp->st_stid.sc_stateid, nfsd4_has_session(cstate));
+ if (status)
+ return status;
+- return nfs4_check_fh(current_fh, stp);
++ return nfs4_check_fh(current_fh, &stp->st_stid);
+ }
+
+ /*
+diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
+index 6abe96593225..0fd2f1c76e60 100644
+--- a/fs/nfsd/nfs4xdr.c
++++ b/fs/nfsd/nfs4xdr.c
+@@ -1974,6 +1974,7 @@ nfsd4_encode_aclname(struct xdr_stream *xdr, struct svc_rqst *rqstp,
+ #define WORD0_ABSENT_FS_ATTRS (FATTR4_WORD0_FS_LOCATIONS | FATTR4_WORD0_FSID | \
+ FATTR4_WORD0_RDATTR_ERROR)
+ #define WORD1_ABSENT_FS_ATTRS FATTR4_WORD1_MOUNTED_ON_FILEID
++#define WORD2_ABSENT_FS_ATTRS 0
+
+ #ifdef CONFIG_NFSD_V4_SECURITY_LABEL
+ static inline __be32
+@@ -2002,7 +2003,7 @@ nfsd4_encode_security_label(struct xdr_stream *xdr, struct svc_rqst *rqstp,
+ { return 0; }
+ #endif
+
+-static __be32 fattr_handle_absent_fs(u32 *bmval0, u32 *bmval1, u32 *rdattr_err)
++static __be32 fattr_handle_absent_fs(u32 *bmval0, u32 *bmval1, u32 *bmval2, u32 *rdattr_err)
+ {
+ /* As per referral draft: */
+ if (*bmval0 & ~WORD0_ABSENT_FS_ATTRS ||
+@@ -2015,6 +2016,7 @@ static __be32 fattr_handle_absent_fs(u32 *bmval0, u32 *bmval1, u32 *rdattr_err)
+ }
+ *bmval0 &= WORD0_ABSENT_FS_ATTRS;
+ *bmval1 &= WORD1_ABSENT_FS_ATTRS;
++ *bmval2 &= WORD2_ABSENT_FS_ATTRS;
+ return 0;
+ }
+
+@@ -2078,8 +2080,7 @@ nfsd4_encode_fattr(struct xdr_stream *xdr, struct svc_fh *fhp,
+ BUG_ON(bmval2 & ~nfsd_suppattrs2(minorversion));
+
+ if (exp->ex_fslocs.migrated) {
+- BUG_ON(bmval[2]);
+- status = fattr_handle_absent_fs(&bmval0, &bmval1, &rdattr_err);
++ status = fattr_handle_absent_fs(&bmval0, &bmval1, &bmval2, &rdattr_err);
+ if (status)
+ goto out;
+ }
+@@ -2122,8 +2123,8 @@ nfsd4_encode_fattr(struct xdr_stream *xdr, struct svc_fh *fhp,
+ }
+
+ #ifdef CONFIG_NFSD_V4_SECURITY_LABEL
+- if ((bmval[2] & FATTR4_WORD2_SECURITY_LABEL) ||
+- bmval[0] & FATTR4_WORD0_SUPPORTED_ATTRS) {
++ if ((bmval2 & FATTR4_WORD2_SECURITY_LABEL) ||
++ bmval0 & FATTR4_WORD0_SUPPORTED_ATTRS) {
+ err = security_inode_getsecctx(dentry->d_inode,
+ &context, &contextlen);
+ contextsupport = (err == 0);
+diff --git a/fs/notify/mark.c b/fs/notify/mark.c
+index 34c38fabf514..28c90a6fcd6c 100644
+--- a/fs/notify/mark.c
++++ b/fs/notify/mark.c
+@@ -329,16 +329,36 @@ void fsnotify_clear_marks_by_group_flags(struct fsnotify_group *group,
+ unsigned int flags)
+ {
+ struct fsnotify_mark *lmark, *mark;
++ LIST_HEAD(to_free);
+
++ /*
++ * We have to be really careful here. Anytime we drop mark_mutex, e.g.
++ * fsnotify_clear_marks_by_inode() can come and free marks. Even in our
++ * to_free list so we have to use mark_mutex even when accessing that
++ * list. And freeing mark requires us to drop mark_mutex. So we can
++ * reliably free only the first mark in the list. That's why we first
++ * move marks to free to to_free list in one go and then free marks in
++ * to_free list one by one.
++ */
+ mutex_lock_nested(&group->mark_mutex, SINGLE_DEPTH_NESTING);
+ list_for_each_entry_safe(mark, lmark, &group->marks_list, g_list) {
+- if (mark->flags & flags) {
+- fsnotify_get_mark(mark);
+- fsnotify_destroy_mark_locked(mark, group);
+- fsnotify_put_mark(mark);
+- }
++ if (mark->flags & flags)
++ list_move(&mark->g_list, &to_free);
+ }
+ mutex_unlock(&group->mark_mutex);
++
++ while (1) {
++ mutex_lock_nested(&group->mark_mutex, SINGLE_DEPTH_NESTING);
++ if (list_empty(&to_free)) {
++ mutex_unlock(&group->mark_mutex);
++ break;
++ }
++ mark = list_first_entry(&to_free, struct fsnotify_mark, g_list);
++ fsnotify_get_mark(mark);
++ fsnotify_destroy_mark_locked(mark, group);
++ mutex_unlock(&group->mark_mutex);
++ fsnotify_put_mark(mark);
++ }
+ }
+
+ /*
+diff --git a/fs/ocfs2/dlmglue.c b/fs/ocfs2/dlmglue.c
+index 21262f2b1654..60d6fd9fb6ca 100644
+--- a/fs/ocfs2/dlmglue.c
++++ b/fs/ocfs2/dlmglue.c
+@@ -3993,9 +3993,13 @@ static void ocfs2_downconvert_thread_do_work(struct ocfs2_super *osb)
+ osb->dc_work_sequence = osb->dc_wake_sequence;
+
+ processed = osb->blocked_lock_count;
+- while (processed) {
+- BUG_ON(list_empty(&osb->blocked_lock_list));
+-
++ /*
++ * blocked lock processing in this loop might call iput which can
++ * remove items off osb->blocked_lock_list. Downconvert up to
++ * 'processed' number of locks, but stop short if we had some
++ * removed in ocfs2_mark_lockres_freeing when downconverting.
++ */
++ while (processed && !list_empty(&osb->blocked_lock_list)) {
+ lockres = list_entry(osb->blocked_lock_list.next,
+ struct ocfs2_lock_res, l_blocked_list);
+ list_del_init(&lockres->l_blocked_list);
+diff --git a/fs/signalfd.c b/fs/signalfd.c
+index 424b7b65321f..148f8e7af882 100644
+--- a/fs/signalfd.c
++++ b/fs/signalfd.c
+@@ -121,8 +121,9 @@ static int signalfd_copyinfo(struct signalfd_siginfo __user *uinfo,
+ * Other callers might not initialize the si_lsb field,
+ * so check explicitly for the right codes here.
+ */
+- if (kinfo->si_code == BUS_MCEERR_AR ||
+- kinfo->si_code == BUS_MCEERR_AO)
++ if (kinfo->si_signo == SIGBUS &&
++ (kinfo->si_code == BUS_MCEERR_AR ||
++ kinfo->si_code == BUS_MCEERR_AO))
+ err |= __put_user((short) kinfo->si_addr_lsb,
+ &uinfo->ssi_addr_lsb);
+ #endif
+diff --git a/include/linux/acpi.h b/include/linux/acpi.h
+index 76d64d6a903a..1c7eaa718e65 100644
+--- a/include/linux/acpi.h
++++ b/include/linux/acpi.h
+@@ -415,6 +415,7 @@ extern acpi_status acpi_pci_osc_control_set(acpi_handle handle,
+ #define ACPI_OST_SC_INSERT_NOT_SUPPORTED 0x82
+
+ extern void acpi_early_init(void);
++extern void acpi_subsystem_init(void);
+
+ extern int acpi_nvs_register(__u64 start, __u64 size);
+
+@@ -450,6 +451,7 @@ static inline const char *acpi_dev_name(struct acpi_device *adev)
+ }
+
+ static inline void acpi_early_init(void) { }
++static inline void acpi_subsystem_init(void) { }
+
+ static inline int early_acpi_boot_init(void)
+ {
+diff --git a/include/linux/kexec.h b/include/linux/kexec.h
+index 9d957b7ae095..9739607a6dfb 100644
+--- a/include/linux/kexec.h
++++ b/include/linux/kexec.h
+@@ -27,6 +27,10 @@
+ #error KEXEC_CONTROL_MEMORY_LIMIT not defined
+ #endif
+
++#ifndef KEXEC_CONTROL_MEMORY_GFP
++#define KEXEC_CONTROL_MEMORY_GFP GFP_KERNEL
++#endif
++
+ #ifndef KEXEC_CONTROL_PAGE_SIZE
+ #error KEXEC_CONTROL_PAGE_SIZE not defined
+ #endif
+diff --git a/include/linux/libata.h b/include/linux/libata.h
+index 8f6a07441b85..a60e04bcda0f 100644
+--- a/include/linux/libata.h
++++ b/include/linux/libata.h
+@@ -429,7 +429,9 @@ enum {
+ ATA_HORKAGE_NO_NCQ_TRIM = (1 << 19), /* don't use queued TRIM */
+ ATA_HORKAGE_NOLPM = (1 << 20), /* don't use LPM */
+ ATA_HORKAGE_WD_BROKEN_LPM = (1 << 21), /* some WDs have broken LPM */
+- ATA_HORKAGE_NOTRIM = (1 << 24), /* don't use TRIM */
++ ATA_HORKAGE_ZERO_AFTER_TRIM = (1 << 22),/* guarantees zero after trim */
++ ATA_HORKAGE_NOTRIM = (1 << 24), /* don't use TRIM */
++
+
+ /* DMA mask for user DMA control: User visible values; DO NOT
+ renumber */
+diff --git a/include/linux/mtd/nand.h b/include/linux/mtd/nand.h
+index e4d451e4600b..49141aa5de3f 100644
+--- a/include/linux/mtd/nand.h
++++ b/include/linux/mtd/nand.h
+@@ -176,17 +176,17 @@ typedef enum {
+ /* Chip may not exist, so silence any errors in scan */
+ #define NAND_SCAN_SILENT_NODEV 0x00040000
+ /*
+- * This option could be defined by controller drivers to protect against
+- * kmap'ed, vmalloc'ed highmem buffers being passed from upper layers
+- */
+-#define NAND_USE_BOUNCE_BUFFER 0x00080000
+-/*
+ * Autodetect nand buswidth with readid/onfi.
+ * This suppose the driver will configure the hardware in 8 bits mode
+ * when calling nand_scan_ident, and update its configuration
+ * before calling nand_scan_tail.
+ */
+ #define NAND_BUSWIDTH_AUTO 0x00080000
++/*
++ * This option could be defined by controller drivers to protect against
++ * kmap'ed, vmalloc'ed highmem buffers being passed from upper layers
++ */
++#define NAND_USE_BOUNCE_BUFFER 0x00100000
+
+ /* Options set by nand scan */
+ /* Nand scan has allocated controller struct */
+diff --git a/include/uapi/linux/pci_regs.h b/include/uapi/linux/pci_regs.h
+index 4a1d0cc38ff2..7dd8d80edfb6 100644
+--- a/include/uapi/linux/pci_regs.h
++++ b/include/uapi/linux/pci_regs.h
+@@ -319,6 +319,7 @@
+ #define PCI_MSIX_PBA 8 /* Pending Bit Array offset */
+ #define PCI_MSIX_PBA_BIR 0x00000007 /* BAR index */
+ #define PCI_MSIX_PBA_OFFSET 0xfffffff8 /* Offset into specified BAR */
++#define PCI_MSIX_FLAGS_BIRMASK PCI_MSIX_PBA_BIR /* deprecated */
+ #define PCI_CAP_MSIX_SIZEOF 12 /* size of MSIX registers */
+
+ /* MSI-X Table entry format */
+diff --git a/init/main.c b/init/main.c
+index 321d0ceb26d3..32940a68ea48 100644
+--- a/init/main.c
++++ b/init/main.c
+@@ -667,6 +667,7 @@ asmlinkage __visible void __init start_kernel(void)
+
+ check_bugs();
+
++ acpi_subsystem_init();
+ sfi_init_late();
+
+ if (efi_enabled(EFI_RUNTIME_SERVICES)) {
+diff --git a/ipc/mqueue.c b/ipc/mqueue.c
+index 4fcf39af1776..f65a044d66c5 100644
+--- a/ipc/mqueue.c
++++ b/ipc/mqueue.c
+@@ -143,7 +143,6 @@ static int msg_insert(struct msg_msg *msg, struct mqueue_inode_info *info)
+ if (!leaf)
+ return -ENOMEM;
+ INIT_LIST_HEAD(&leaf->msg_list);
+- info->qsize += sizeof(*leaf);
+ }
+ leaf->priority = msg->m_type;
+ rb_link_node(&leaf->rb_node, parent, p);
+@@ -188,7 +187,6 @@ try_again:
+ "lazy leaf delete!\n");
+ rb_erase(&leaf->rb_node, &info->msg_tree);
+ if (info->node_cache) {
+- info->qsize -= sizeof(*leaf);
+ kfree(leaf);
+ } else {
+ info->node_cache = leaf;
+@@ -201,7 +199,6 @@ try_again:
+ if (list_empty(&leaf->msg_list)) {
+ rb_erase(&leaf->rb_node, &info->msg_tree);
+ if (info->node_cache) {
+- info->qsize -= sizeof(*leaf);
+ kfree(leaf);
+ } else {
+ info->node_cache = leaf;
+@@ -1026,7 +1023,6 @@ SYSCALL_DEFINE5(mq_timedsend, mqd_t, mqdes, const char __user *, u_msg_ptr,
+ /* Save our speculative allocation into the cache */
+ INIT_LIST_HEAD(&new_leaf->msg_list);
+ info->node_cache = new_leaf;
+- info->qsize += sizeof(*new_leaf);
+ new_leaf = NULL;
+ } else {
+ kfree(new_leaf);
+@@ -1133,7 +1129,6 @@ SYSCALL_DEFINE5(mq_timedreceive, mqd_t, mqdes, char __user *, u_msg_ptr,
+ /* Save our speculative allocation into the cache */
+ INIT_LIST_HEAD(&new_leaf->msg_list);
+ info->node_cache = new_leaf;
+- info->qsize += sizeof(*new_leaf);
+ } else {
+ kfree(new_leaf);
+ }
+diff --git a/kernel/irq/resend.c b/kernel/irq/resend.c
+index 9065107f083e..7a5237a1bce5 100644
+--- a/kernel/irq/resend.c
++++ b/kernel/irq/resend.c
+@@ -75,13 +75,21 @@ void check_irq_resend(struct irq_desc *desc, unsigned int irq)
+ !desc->irq_data.chip->irq_retrigger(&desc->irq_data)) {
+ #ifdef CONFIG_HARDIRQS_SW_RESEND
+ /*
+- * If the interrupt has a parent irq and runs
+- * in the thread context of the parent irq,
+- * retrigger the parent.
++ * If the interrupt is running in the thread
++ * context of the parent irq we need to be
++ * careful, because we cannot trigger it
++ * directly.
+ */
+- if (desc->parent_irq &&
+- irq_settings_is_nested_thread(desc))
++ if (irq_settings_is_nested_thread(desc)) {
++ /*
++ * If the parent_irq is valid, we
++ * retrigger the parent, otherwise we
++ * do nothing.
++ */
++ if (!desc->parent_irq)
++ return;
+ irq = desc->parent_irq;
++ }
+ /* Set it pending and activate the softirq: */
+ set_bit(irq, irqs_resend);
+ tasklet_schedule(&resend_tasklet);
+diff --git a/kernel/kexec.c b/kernel/kexec.c
+index 2abf9f6e9a61..04eae03efe1e 100644
+--- a/kernel/kexec.c
++++ b/kernel/kexec.c
+@@ -707,7 +707,7 @@ static struct page *kimage_alloc_normal_control_pages(struct kimage *image,
+ do {
+ unsigned long pfn, epfn, addr, eaddr;
+
+- pages = kimage_alloc_pages(GFP_KERNEL, order);
++ pages = kimage_alloc_pages(KEXEC_CONTROL_MEMORY_GFP, order);
+ if (!pages)
+ break;
+ pfn = page_to_pfn(pages);
+diff --git a/kernel/signal.c b/kernel/signal.c
+index 8f0876f9f6dd..74083306403f 100644
+--- a/kernel/signal.c
++++ b/kernel/signal.c
+@@ -2745,7 +2745,8 @@ int copy_siginfo_to_user(siginfo_t __user *to, const siginfo_t *from)
+ * Other callers might not initialize the si_lsb field,
+ * so check explicitly for the right codes here.
+ */
+- if (from->si_code == BUS_MCEERR_AR || from->si_code == BUS_MCEERR_AO)
++ if (from->si_signo == SIGBUS &&
++ (from->si_code == BUS_MCEERR_AR || from->si_code == BUS_MCEERR_AO))
+ err |= __put_user(from->si_addr_lsb, &to->si_addr_lsb);
+ #endif
+ break;
+@@ -3012,7 +3013,7 @@ COMPAT_SYSCALL_DEFINE3(rt_sigqueueinfo,
+ int, sig,
+ struct compat_siginfo __user *, uinfo)
+ {
+- siginfo_t info;
++ siginfo_t info = {};
+ int ret = copy_siginfo_from_user32(&info, uinfo);
+ if (unlikely(ret))
+ return ret;
+@@ -3058,7 +3059,7 @@ COMPAT_SYSCALL_DEFINE4(rt_tgsigqueueinfo,
+ int, sig,
+ struct compat_siginfo __user *, uinfo)
+ {
+- siginfo_t info;
++ siginfo_t info = {};
+
+ if (copy_siginfo_from_user32(&info, uinfo))
+ return -EFAULT;
+diff --git a/mm/vmscan.c b/mm/vmscan.c
+index e3b0a54a44aa..e321fe20b979 100644
+--- a/mm/vmscan.c
++++ b/mm/vmscan.c
+@@ -895,21 +895,17 @@ static unsigned long shrink_page_list(struct list_head *page_list,
+ *
+ * 2) Global reclaim encounters a page, memcg encounters a
+ * page that is not marked for immediate reclaim or
+- * the caller does not have __GFP_IO. In this case mark
++ * the caller does not have __GFP_FS (or __GFP_IO if it's
++ * simply going to swap, not to fs). In this case mark
+ * the page for immediate reclaim and continue scanning.
+ *
+- * __GFP_IO is checked because a loop driver thread might
++ * Require may_enter_fs because we would wait on fs, which
++ * may not have submitted IO yet. And the loop driver might
+ * enter reclaim, and deadlock if it waits on a page for
+ * which it is needed to do the write (loop masks off
+ * __GFP_IO|__GFP_FS for this reason); but more thought
+ * would probably show more reasons.
+ *
+- * Don't require __GFP_FS, since we're not going into the
+- * FS, just waiting on its writeback completion. Worryingly,
+- * ext4 gfs2 and xfs allocate pages with
+- * grab_cache_page_write_begin(,,AOP_FLAG_NOFS), so testing
+- * may_enter_fs here is liable to OOM on them.
+- *
+ * 3) memcg encounters a page that is not already marked
+ * PageReclaim. memcg does not have any dirty pages
+ * throttling so we could easily OOM just because too many
+@@ -926,7 +922,7 @@ static unsigned long shrink_page_list(struct list_head *page_list,
+
+ /* Case 2 above */
+ } else if (global_reclaim(sc) ||
+- !PageReclaim(page) || !(sc->gfp_mask & __GFP_IO)) {
++ !PageReclaim(page) || !may_enter_fs) {
+ /*
+ * This is slightly racy - end_page_writeback()
+ * might have just cleared PageReclaim, then
+diff --git a/net/ipv4/ip_vti.c b/net/ipv4/ip_vti.c
+index 1a7e979e80ba..15046aec8484 100644
+--- a/net/ipv4/ip_vti.c
++++ b/net/ipv4/ip_vti.c
+@@ -65,7 +65,6 @@ static int vti_input(struct sk_buff *skb, int nexthdr, __be32 spi,
+ goto drop;
+
+ XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4 = tunnel;
+- skb->mark = be32_to_cpu(tunnel->parms.i_key);
+
+ return xfrm_input(skb, nexthdr, spi, encap_type);
+ }
+@@ -91,6 +90,8 @@ static int vti_rcv_cb(struct sk_buff *skb, int err)
+ struct pcpu_sw_netstats *tstats;
+ struct xfrm_state *x;
+ struct ip_tunnel *tunnel = XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4;
++ u32 orig_mark = skb->mark;
++ int ret;
+
+ if (!tunnel)
+ return 1;
+@@ -107,7 +108,11 @@ static int vti_rcv_cb(struct sk_buff *skb, int err)
+ x = xfrm_input_state(skb);
+ family = x->inner_mode->afinfo->family;
+
+- if (!xfrm_policy_check(NULL, XFRM_POLICY_IN, skb, family))
++ skb->mark = be32_to_cpu(tunnel->parms.i_key);
++ ret = xfrm_policy_check(NULL, XFRM_POLICY_IN, skb, family);
++ skb->mark = orig_mark;
++
++ if (!ret)
+ return -EPERM;
+
+ skb_scrub_packet(skb, !net_eq(tunnel->net, dev_net(skb->dev)));
+@@ -216,8 +221,6 @@ static netdev_tx_t vti_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
+
+ memset(&fl, 0, sizeof(fl));
+
+- skb->mark = be32_to_cpu(tunnel->parms.o_key);
+-
+ switch (skb->protocol) {
+ case htons(ETH_P_IP):
+ xfrm_decode_session(skb, &fl, AF_INET);
+@@ -233,6 +236,9 @@ static netdev_tx_t vti_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
+ return NETDEV_TX_OK;
+ }
+
++ /* override mark with tunnel output key */
++ fl.flowi_mark = be32_to_cpu(tunnel->parms.o_key);
++
+ return vti_xmit(skb, dev, &fl);
+ }
+
+diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c
+index 2459b7b0f705..1d67b37592d1 100644
+--- a/net/ipv6/ip6_vti.c
++++ b/net/ipv6/ip6_vti.c
+@@ -305,7 +305,6 @@ static int vti6_rcv(struct sk_buff *skb)
+ }
+
+ XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip6 = t;
+- skb->mark = be32_to_cpu(t->parms.i_key);
+
+ rcu_read_unlock();
+
+@@ -325,6 +324,8 @@ static int vti6_rcv_cb(struct sk_buff *skb, int err)
+ struct pcpu_sw_netstats *tstats;
+ struct xfrm_state *x;
+ struct ip6_tnl *t = XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip6;
++ u32 orig_mark = skb->mark;
++ int ret;
+
+ if (!t)
+ return 1;
+@@ -341,7 +342,11 @@ static int vti6_rcv_cb(struct sk_buff *skb, int err)
+ x = xfrm_input_state(skb);
+ family = x->inner_mode->afinfo->family;
+
+- if (!xfrm_policy_check(NULL, XFRM_POLICY_IN, skb, family))
++ skb->mark = be32_to_cpu(t->parms.i_key);
++ ret = xfrm_policy_check(NULL, XFRM_POLICY_IN, skb, family);
++ skb->mark = orig_mark;
++
++ if (!ret)
+ return -EPERM;
+
+ skb_scrub_packet(skb, !net_eq(t->net, dev_net(skb->dev)));
+@@ -472,7 +477,6 @@ vti6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
+ int ret;
+
+ memset(&fl, 0, sizeof(fl));
+- skb->mark = be32_to_cpu(t->parms.o_key);
+
+ switch (skb->protocol) {
+ case htons(ETH_P_IPV6):
+@@ -493,6 +497,9 @@ vti6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
+ goto tx_err;
+ }
+
++ /* override mark with tunnel output key */
++ fl.flowi_mark = be32_to_cpu(t->parms.o_key);
++
+ ret = vti6_xmit(skb, dev, &fl);
+ if (ret < 0)
+ goto tx_err;
+diff --git a/net/mac80211/debugfs_netdev.c b/net/mac80211/debugfs_netdev.c
+index c68896adfa96..2d19963e6d97 100644
+--- a/net/mac80211/debugfs_netdev.c
++++ b/net/mac80211/debugfs_netdev.c
+@@ -725,6 +725,7 @@ void ieee80211_debugfs_remove_netdev(struct ieee80211_sub_if_data *sdata)
+
+ debugfs_remove_recursive(sdata->vif.debugfs_dir);
+ sdata->vif.debugfs_dir = NULL;
++ sdata->debugfs.subdir_stations = NULL;
+ }
+
+ void ieee80211_debugfs_rename_netdev(struct ieee80211_sub_if_data *sdata)
+diff --git a/net/rds/ib_rdma.c b/net/rds/ib_rdma.c
+index 273b8bff6ba4..657ba9f5d308 100644
+--- a/net/rds/ib_rdma.c
++++ b/net/rds/ib_rdma.c
+@@ -759,8 +759,10 @@ void *rds_ib_get_mr(struct scatterlist *sg, unsigned long nents,
+ }
+
+ ibmr = rds_ib_alloc_fmr(rds_ibdev);
+- if (IS_ERR(ibmr))
++ if (IS_ERR(ibmr)) {
++ rds_ib_dev_put(rds_ibdev);
+ return ibmr;
++ }
+
+ ret = rds_ib_map_fmr(rds_ibdev, ibmr, sg, nents);
+ if (ret == 0)
+diff --git a/net/xfrm/xfrm_input.c b/net/xfrm/xfrm_input.c
+index 85d1d4764612..00977873300c 100644
+--- a/net/xfrm/xfrm_input.c
++++ b/net/xfrm/xfrm_input.c
+@@ -13,6 +13,8 @@
+ #include <net/dst.h>
+ #include <net/ip.h>
+ #include <net/xfrm.h>
++#include <net/ip_tunnels.h>
++#include <net/ip6_tunnel.h>
+
+ static struct kmem_cache *secpath_cachep __read_mostly;
+
+@@ -186,6 +188,7 @@ int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type)
+ struct xfrm_state *x = NULL;
+ xfrm_address_t *daddr;
+ struct xfrm_mode *inner_mode;
++ u32 mark = skb->mark;
+ unsigned int family;
+ int decaps = 0;
+ int async = 0;
+@@ -203,6 +206,18 @@ int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type)
+ XFRM_SPI_SKB_CB(skb)->daddroff);
+ family = XFRM_SPI_SKB_CB(skb)->family;
+
++ /* if tunnel is present override skb->mark value with tunnel i_key */
++ if (XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4) {
++ switch (family) {
++ case AF_INET:
++ mark = be32_to_cpu(XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4->parms.i_key);
++ break;
++ case AF_INET6:
++ mark = be32_to_cpu(XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip6->parms.i_key);
++ break;
++ }
++ }
++
+ /* Allocate new secpath or COW existing one. */
+ if (!skb->sp || atomic_read(&skb->sp->refcnt) != 1) {
+ struct sec_path *sp;
+@@ -229,7 +244,7 @@ int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type)
+ goto drop;
+ }
+
+- x = xfrm_state_lookup(net, skb->mark, daddr, spi, nexthdr, family);
++ x = xfrm_state_lookup(net, mark, daddr, spi, nexthdr, family);
+ if (x == NULL) {
+ XFRM_INC_STATS(net, LINUX_MIB_XFRMINNOSTATES);
+ xfrm_audit_state_notfound(skb, family, spi, seq);
+diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c
+index cdc620b2152f..7e4ad2943918 100644
+--- a/security/integrity/ima/ima_policy.c
++++ b/security/integrity/ima/ima_policy.c
+@@ -27,6 +27,8 @@
+ #define IMA_UID 0x0008
+ #define IMA_FOWNER 0x0010
+ #define IMA_FSUUID 0x0020
++#define IMA_INMASK 0x0040
++#define IMA_EUID 0x0080
+
+ #define UNKNOWN 0
+ #define MEASURE 0x0001 /* same as IMA_MEASURE */
+@@ -176,6 +178,9 @@ static bool ima_match_rules(struct ima_rule_entry *rule,
+ if ((rule->flags & IMA_MASK) &&
+ (rule->mask != mask && func != POST_SETATTR))
+ return false;
++ if ((rule->flags & IMA_INMASK) &&
++ (!(rule->mask & mask) && func != POST_SETATTR))
++ return false;
+ if ((rule->flags & IMA_FSMAGIC)
+ && rule->fsmagic != inode->i_sb->s_magic)
+ return false;
+@@ -184,6 +189,16 @@ static bool ima_match_rules(struct ima_rule_entry *rule,
+ return false;
+ if ((rule->flags & IMA_UID) && !uid_eq(rule->uid, cred->uid))
+ return false;
++ if (rule->flags & IMA_EUID) {
++ if (has_capability_noaudit(current, CAP_SETUID)) {
++ if (!uid_eq(rule->uid, cred->euid)
++ && !uid_eq(rule->uid, cred->suid)
++ && !uid_eq(rule->uid, cred->uid))
++ return false;
++ } else if (!uid_eq(rule->uid, cred->euid))
++ return false;
++ }
++
+ if ((rule->flags & IMA_FOWNER) && !uid_eq(rule->fowner, inode->i_uid))
+ return false;
+ for (i = 0; i < MAX_LSM_RULES; i++) {
+@@ -378,7 +393,8 @@ enum {
+ Opt_audit,
+ Opt_obj_user, Opt_obj_role, Opt_obj_type,
+ Opt_subj_user, Opt_subj_role, Opt_subj_type,
+- Opt_func, Opt_mask, Opt_fsmagic, Opt_uid, Opt_fowner,
++ Opt_func, Opt_mask, Opt_fsmagic,
++ Opt_uid, Opt_euid, Opt_fowner,
+ Opt_appraise_type, Opt_fsuuid, Opt_permit_directio
+ };
+
+@@ -399,6 +415,7 @@ static match_table_t policy_tokens = {
+ {Opt_fsmagic, "fsmagic=%s"},
+ {Opt_fsuuid, "fsuuid=%s"},
+ {Opt_uid, "uid=%s"},
++ {Opt_euid, "euid=%s"},
+ {Opt_fowner, "fowner=%s"},
+ {Opt_appraise_type, "appraise_type=%s"},
+ {Opt_permit_directio, "permit_directio"},
+@@ -440,6 +457,7 @@ static void ima_log_string(struct audit_buffer *ab, char *key, char *value)
+ static int ima_parse_rule(char *rule, struct ima_rule_entry *entry)
+ {
+ struct audit_buffer *ab;
++ char *from;
+ char *p;
+ int result = 0;
+
+@@ -530,18 +548,23 @@ static int ima_parse_rule(char *rule, struct ima_rule_entry *entry)
+ if (entry->mask)
+ result = -EINVAL;
+
+- if ((strcmp(args[0].from, "MAY_EXEC")) == 0)
++ from = args[0].from;
++ if (*from == '^')
++ from++;
++
++ if ((strcmp(from, "MAY_EXEC")) == 0)
+ entry->mask = MAY_EXEC;
+- else if (strcmp(args[0].from, "MAY_WRITE") == 0)
++ else if (strcmp(from, "MAY_WRITE") == 0)
+ entry->mask = MAY_WRITE;
+- else if (strcmp(args[0].from, "MAY_READ") == 0)
++ else if (strcmp(from, "MAY_READ") == 0)
+ entry->mask = MAY_READ;
+- else if (strcmp(args[0].from, "MAY_APPEND") == 0)
++ else if (strcmp(from, "MAY_APPEND") == 0)
+ entry->mask = MAY_APPEND;
+ else
+ result = -EINVAL;
+ if (!result)
+- entry->flags |= IMA_MASK;
++ entry->flags |= (*args[0].from == '^')
++ ? IMA_INMASK : IMA_MASK;
+ break;
+ case Opt_fsmagic:
+ ima_log_string(ab, "fsmagic", args[0].from);
+@@ -571,6 +594,9 @@ static int ima_parse_rule(char *rule, struct ima_rule_entry *entry)
+ break;
+ case Opt_uid:
+ ima_log_string(ab, "uid", args[0].from);
++ case Opt_euid:
++ if (token == Opt_euid)
++ ima_log_string(ab, "euid", args[0].from);
+
+ if (uid_valid(entry->uid)) {
+ result = -EINVAL;
+@@ -579,11 +605,14 @@ static int ima_parse_rule(char *rule, struct ima_rule_entry *entry)
+
+ result = kstrtoul(args[0].from, 10, &lnum);
+ if (!result) {
+- entry->uid = make_kuid(current_user_ns(), (uid_t)lnum);
+- if (!uid_valid(entry->uid) || (((uid_t)lnum) != lnum))
++ entry->uid = make_kuid(current_user_ns(),
++ (uid_t) lnum);
++ if (!uid_valid(entry->uid) ||
++ (uid_t)lnum != lnum)
+ result = -EINVAL;
+ else
+- entry->flags |= IMA_UID;
++ entry->flags |= (token == Opt_uid)
++ ? IMA_UID : IMA_EUID;
+ }
+ break;
+ case Opt_fowner:
+diff --git a/sound/firewire/amdtp.c b/sound/firewire/amdtp.c
+index 95fc2eaf11dc..b960b7f26664 100644
+--- a/sound/firewire/amdtp.c
++++ b/sound/firewire/amdtp.c
+@@ -678,8 +678,9 @@ static void handle_in_packet(struct amdtp_stream *s,
+ s->data_block_counter != UINT_MAX)
+ data_block_counter = s->data_block_counter;
+
+- if (((s->flags & CIP_SKIP_DBC_ZERO_CHECK) && data_block_counter == 0) ||
+- (s->data_block_counter == UINT_MAX)) {
++ if (((s->flags & CIP_SKIP_DBC_ZERO_CHECK) &&
++ data_block_counter == s->tx_first_dbc) ||
++ s->data_block_counter == UINT_MAX) {
+ lost = false;
+ } else if (!(s->flags & CIP_DBC_IS_END_EVENT)) {
+ lost = data_block_counter != s->data_block_counter;
+diff --git a/sound/firewire/amdtp.h b/sound/firewire/amdtp.h
+index 4823c08196ac..6ce95b05ba2e 100644
+--- a/sound/firewire/amdtp.h
++++ b/sound/firewire/amdtp.h
+@@ -131,6 +131,8 @@ struct amdtp_stream {
+
+ /* quirk: fixed interval of dbc between previos/current packets. */
+ unsigned int tx_dbc_interval;
++ /* quirk: indicate the value of dbc field in a first packet. */
++ unsigned int tx_first_dbc;
+
+ /* quirk: the first count of data blocks in an rx packet for MIDI */
+ unsigned int rx_blocks_for_midi;
+diff --git a/sound/firewire/fireworks/fireworks.c b/sound/firewire/fireworks/fireworks.c
+index 3e2ed8e82cbc..6813b0f6f185 100644
+--- a/sound/firewire/fireworks/fireworks.c
++++ b/sound/firewire/fireworks/fireworks.c
+@@ -237,8 +237,16 @@ efw_probe(struct fw_unit *unit,
+ err = get_hardware_info(efw);
+ if (err < 0)
+ goto error;
++ /* AudioFire8 (since 2009) and AudioFirePre8 */
+ if (entry->model_id == MODEL_ECHO_AUDIOFIRE_9)
+ efw->is_af9 = true;
++ /* These models uses the same firmware. */
++ if (entry->model_id == MODEL_ECHO_AUDIOFIRE_2 ||
++ entry->model_id == MODEL_ECHO_AUDIOFIRE_4 ||
++ entry->model_id == MODEL_ECHO_AUDIOFIRE_9 ||
++ entry->model_id == MODEL_GIBSON_RIP ||
++ entry->model_id == MODEL_GIBSON_GOLDTOP)
++ efw->is_fireworks3 = true;
+
+ snd_efw_proc_init(efw);
+
+diff --git a/sound/firewire/fireworks/fireworks.h b/sound/firewire/fireworks/fireworks.h
+index 4f0201a95222..084d414b228c 100644
+--- a/sound/firewire/fireworks/fireworks.h
++++ b/sound/firewire/fireworks/fireworks.h
+@@ -71,6 +71,7 @@ struct snd_efw {
+
+ /* for quirks */
+ bool is_af9;
++ bool is_fireworks3;
+ u32 firmware_version;
+
+ unsigned int midi_in_ports;
+diff --git a/sound/firewire/fireworks/fireworks_stream.c b/sound/firewire/fireworks/fireworks_stream.c
+index b985fc5ebdc6..30c4042524d0 100644
+--- a/sound/firewire/fireworks/fireworks_stream.c
++++ b/sound/firewire/fireworks/fireworks_stream.c
+@@ -167,6 +167,15 @@ int snd_efw_stream_init_duplex(struct snd_efw *efw)
+ efw->tx_stream.flags |= CIP_DBC_IS_END_EVENT;
+ /* Fireworks reset dbc at bus reset. */
+ efw->tx_stream.flags |= CIP_SKIP_DBC_ZERO_CHECK;
++ /*
++ * But Recent firmwares starts packets with non-zero dbc.
++ * Driver version 5.7.6 installs firmware version 5.7.3.
++ */
++ if (efw->is_fireworks3 &&
++ (efw->firmware_version == 0x5070000 ||
++ efw->firmware_version == 0x5070300 ||
++ efw->firmware_version == 0x5080000))
++ efw->tx_stream.tx_first_dbc = 0x02;
+ /* AudioFire9 always reports wrong dbs. */
+ if (efw->is_af9)
+ efw->tx_stream.flags |= CIP_WRONG_DBS;
+diff --git a/sound/pci/hda/patch_cirrus.c b/sound/pci/hda/patch_cirrus.c
+index dd2b3d92071f..e5dac8ea65e4 100644
+--- a/sound/pci/hda/patch_cirrus.c
++++ b/sound/pci/hda/patch_cirrus.c
+@@ -1001,9 +1001,7 @@ static void cs4210_spdif_automute(struct hda_codec *codec,
+
+ spec->spdif_present = spdif_present;
+ /* SPDIF TX on/off */
+- if (spdif_present)
+- snd_hda_set_pin_ctl(codec, spdif_pin,
+- spdif_present ? PIN_OUT : 0);
++ snd_hda_set_pin_ctl(codec, spdif_pin, spdif_present ? PIN_OUT : 0);
+
+ cs_automute(codec);
+ }
+diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
+index edb6e6124a23..b422e406a9cb 100644
+--- a/sound/pci/hda/patch_hdmi.c
++++ b/sound/pci/hda/patch_hdmi.c
+@@ -47,7 +47,9 @@ MODULE_PARM_DESC(static_hdmi_pcm, "Don't restrict PCM parameters per ELD info");
+
+ #define is_haswell(codec) ((codec)->vendor_id == 0x80862807)
+ #define is_broadwell(codec) ((codec)->vendor_id == 0x80862808)
+-#define is_haswell_plus(codec) (is_haswell(codec) || is_broadwell(codec))
++#define is_skylake(codec) ((codec)->vendor_id == 0x80862809)
++#define is_haswell_plus(codec) (is_haswell(codec) || is_broadwell(codec) \
++ || is_skylake(codec))
+
+ #define is_valleyview(codec) ((codec)->vendor_id == 0x80862882)
+ #define is_cherryview(codec) ((codec)->vendor_id == 0x80862883)
+@@ -3366,6 +3368,7 @@ static const struct hda_codec_preset snd_hda_preset_hdmi[] = {
+ { .id = 0x80862806, .name = "PantherPoint HDMI", .patch = patch_generic_hdmi },
+ { .id = 0x80862807, .name = "Haswell HDMI", .patch = patch_generic_hdmi },
+ { .id = 0x80862808, .name = "Broadwell HDMI", .patch = patch_generic_hdmi },
++{ .id = 0x80862809, .name = "Skylake HDMI", .patch = patch_generic_hdmi },
+ { .id = 0x80862880, .name = "CedarTrail HDMI", .patch = patch_generic_hdmi },
+ { .id = 0x80862882, .name = "Valleyview2 HDMI", .patch = patch_generic_hdmi },
+ { .id = 0x80862883, .name = "Braswell HDMI", .patch = patch_generic_hdmi },
+@@ -3427,6 +3430,7 @@ MODULE_ALIAS("snd-hda-codec-id:80862805");
+ MODULE_ALIAS("snd-hda-codec-id:80862806");
+ MODULE_ALIAS("snd-hda-codec-id:80862807");
+ MODULE_ALIAS("snd-hda-codec-id:80862808");
++MODULE_ALIAS("snd-hda-codec-id:80862809");
+ MODULE_ALIAS("snd-hda-codec-id:80862880");
+ MODULE_ALIAS("snd-hda-codec-id:80862882");
+ MODULE_ALIAS("snd-hda-codec-id:80862883");
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 24cec17db1a4..f979293b421a 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -2221,7 +2221,7 @@ static const struct snd_pci_quirk alc882_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x106b, 0x4300, "iMac 9,1", ALC889_FIXUP_IMAC91_VREF),
+ SND_PCI_QUIRK(0x106b, 0x4600, "MacbookPro 5,2", ALC889_FIXUP_IMAC91_VREF),
+ SND_PCI_QUIRK(0x106b, 0x4900, "iMac 9,1 Aluminum", ALC889_FIXUP_IMAC91_VREF),
+- SND_PCI_QUIRK(0x106b, 0x4a00, "Macbook 5,2", ALC889_FIXUP_IMAC91_VREF),
++ SND_PCI_QUIRK(0x106b, 0x4a00, "Macbook 5,2", ALC889_FIXUP_MBA11_VREF),
+
+ SND_PCI_QUIRK(0x1071, 0x8258, "Evesham Voyaeger", ALC882_FIXUP_EAPD),
+ SND_PCI_QUIRK(0x1462, 0x7350, "MSI-7350", ALC889_FIXUP_CD),
+diff --git a/sound/soc/codecs/pcm1681.c b/sound/soc/codecs/pcm1681.c
+index 477e13d30971..e7ba557979cb 100644
+--- a/sound/soc/codecs/pcm1681.c
++++ b/sound/soc/codecs/pcm1681.c
+@@ -102,7 +102,7 @@ static int pcm1681_set_deemph(struct snd_soc_codec *codec)
+
+ if (val != -1) {
+ regmap_update_bits(priv->regmap, PCM1681_DEEMPH_CONTROL,
+- PCM1681_DEEMPH_RATE_MASK, val);
++ PCM1681_DEEMPH_RATE_MASK, val << 3);
+ enable = 1;
+ } else
+ enable = 0;
+diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c
+index 943e6a9a6319..34e5d8253c24 100644
+--- a/sound/soc/soc-dapm.c
++++ b/sound/soc/soc-dapm.c
+@@ -1854,6 +1854,7 @@ static ssize_t dapm_widget_power_read_file(struct file *file,
+ size_t count, loff_t *ppos)
+ {
+ struct snd_soc_dapm_widget *w = file->private_data;
++ struct snd_soc_card *card = w->dapm->card;
+ char *buf;
+ int in, out;
+ ssize_t ret;
+@@ -1863,6 +1864,8 @@ static ssize_t dapm_widget_power_read_file(struct file *file,
+ if (!buf)
+ return -ENOMEM;
+
++ mutex_lock(&card->dapm_mutex);
++
+ in = is_connected_input_ep(w, NULL);
+ dapm_clear_walk_input(w->dapm, &w->sources);
+ out = is_connected_output_ep(w, NULL);
+@@ -1905,6 +1908,8 @@ static ssize_t dapm_widget_power_read_file(struct file *file,
+ p->sink->name);
+ }
+
++ mutex_unlock(&card->dapm_mutex);
++
+ ret = simple_read_from_buffer(user_buf, count, ppos, buf, ret);
+
+ kfree(buf);
+@@ -2165,11 +2170,15 @@ static ssize_t dapm_widget_show(struct device *dev,
+ struct snd_soc_pcm_runtime *rtd = dev_get_drvdata(dev);
+ int i, count = 0;
+
++ mutex_lock(&rtd->card->dapm_mutex);
++
+ for (i = 0; i < rtd->num_codecs; i++) {
+ struct snd_soc_codec *codec = rtd->codec_dais[i]->codec;
+ count += dapm_widget_show_codec(codec, buf + count);
+ }
+
++ mutex_unlock(&rtd->card->dapm_mutex);
++
+ return count;
+ }
+
+diff --git a/sound/usb/mixer_maps.c b/sound/usb/mixer_maps.c
+index b16be3944213..9a3e1076a5b1 100644
+--- a/sound/usb/mixer_maps.c
++++ b/sound/usb/mixer_maps.c
+@@ -336,6 +336,20 @@ static const struct usbmix_name_map scms_usb3318_map[] = {
+ { 0 }
+ };
+
++/* Bose companion 5, the dB conversion factor is 16 instead of 256 */
++static struct usbmix_dB_map bose_companion5_dB = {-5006, -6};
++static struct usbmix_name_map bose_companion5_map[] = {
++ { 3, NULL, .dB = &bose_companion5_dB },
++ { 0 } /* terminator */
++};
++
++/* Dragonfly DAC 1.2, the dB conversion factor is 1 instead of 256 */
++static struct usbmix_dB_map dragonfly_1_2_dB = {0, 5000};
++static struct usbmix_name_map dragonfly_1_2_map[] = {
++ { 7, NULL, .dB = &dragonfly_1_2_dB },
++ { 0 } /* terminator */
++};
++
+ /*
+ * Control map entries
+ */
+@@ -442,6 +456,16 @@ static struct usbmix_ctl_map usbmix_ctl_maps[] = {
+ .id = USB_ID(0x25c4, 0x0003),
+ .map = scms_usb3318_map,
+ },
++ {
++ /* Bose Companion 5 */
++ .id = USB_ID(0x05a7, 0x1020),
++ .map = bose_companion5_map,
++ },
++ {
++ /* Dragonfly DAC 1.2 */
++ .id = USB_ID(0x21b4, 0x0081),
++ .map = dragonfly_1_2_map,
++ },
+ { 0 } /* terminator */
+ };
+
+diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h
+index fde5b6e3c8e5..17e1fdabd456 100644
+--- a/sound/usb/quirks-table.h
++++ b/sound/usb/quirks-table.h
+@@ -2516,6 +2516,74 @@ YAMAHA_DEVICE(0x7010, "UB99"),
+ }
+ },
+
++/* Steinberg devices */
++{
++ /* Steinberg MI2 */
++ USB_DEVICE_VENDOR_SPEC(0x0a4e, 0x2040),
++ .driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
++ .ifnum = QUIRK_ANY_INTERFACE,
++ .type = QUIRK_COMPOSITE,
++ .data = & (const struct snd_usb_audio_quirk[]) {
++ {
++ .ifnum = 0,
++ .type = QUIRK_AUDIO_STANDARD_INTERFACE
++ },
++ {
++ .ifnum = 1,
++ .type = QUIRK_AUDIO_STANDARD_INTERFACE
++ },
++ {
++ .ifnum = 2,
++ .type = QUIRK_AUDIO_STANDARD_INTERFACE
++ },
++ {
++ .ifnum = 3,
++ .type = QUIRK_MIDI_FIXED_ENDPOINT,
++ .data = &(const struct snd_usb_midi_endpoint_info) {
++ .out_cables = 0x0001,
++ .in_cables = 0x0001
++ }
++ },
++ {
++ .ifnum = -1
++ }
++ }
++ }
++},
++{
++ /* Steinberg MI4 */
++ USB_DEVICE_VENDOR_SPEC(0x0a4e, 0x4040),
++ .driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
++ .ifnum = QUIRK_ANY_INTERFACE,
++ .type = QUIRK_COMPOSITE,
++ .data = & (const struct snd_usb_audio_quirk[]) {
++ {
++ .ifnum = 0,
++ .type = QUIRK_AUDIO_STANDARD_INTERFACE
++ },
++ {
++ .ifnum = 1,
++ .type = QUIRK_AUDIO_STANDARD_INTERFACE
++ },
++ {
++ .ifnum = 2,
++ .type = QUIRK_AUDIO_STANDARD_INTERFACE
++ },
++ {
++ .ifnum = 3,
++ .type = QUIRK_MIDI_FIXED_ENDPOINT,
++ .data = &(const struct snd_usb_midi_endpoint_info) {
++ .out_cables = 0x0001,
++ .in_cables = 0x0001
++ }
++ },
++ {
++ .ifnum = -1
++ }
++ }
++ }
++},
++
+ /* TerraTec devices */
+ {
+ USB_DEVICE_VENDOR_SPEC(0x0ccd, 0x0012),
^ permalink raw reply related [flat|nested] 67+ messages in thread
* [gentoo-commits] proj/linux-patches:3.18 commit in: /
@ 2015-10-03 17:45 Mike Pagano
0 siblings, 0 replies; 67+ messages in thread
From: Mike Pagano @ 2015-10-03 17:45 UTC (permalink / raw
To: gentoo-commits
commit: 3e36410423095c3ba385b2850ebad08d7a842228
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Sat Oct 3 17:45:26 2015 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Sat Oct 3 17:45:26 2015 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=3e364104
Linux patch 3.18.22
0000_README | 4 +
1021_linux-3.18.22.patch | 2622 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 2626 insertions(+)
diff --git a/0000_README b/0000_README
index 558f14f..7e934be 100644
--- a/0000_README
+++ b/0000_README
@@ -127,6 +127,10 @@ Patch: 1020_linux-3.18.21.patch
From: http://www.kernel.org
Desc: Linux 3.18.21
+Patch: 1021_linux-3.18.22.patch
+From: http://www.kernel.org
+Desc: Linux 3.18.22
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1021_linux-3.18.22.patch b/1021_linux-3.18.22.patch
new file mode 100644
index 0000000..0049146
--- /dev/null
+++ b/1021_linux-3.18.22.patch
@@ -0,0 +1,2622 @@
+diff --git a/Makefile b/Makefile
+index 6be90fab361b..7adbbbeeb421 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 18
+-SUBLEVEL = 21
++SUBLEVEL = 22
+ EXTRAVERSION =
+ NAME = Diseased Newt
+
+diff --git a/arch/arm64/kvm/inject_fault.c b/arch/arm64/kvm/inject_fault.c
+index 81a02a8762b0..86825f8883de 100644
+--- a/arch/arm64/kvm/inject_fault.c
++++ b/arch/arm64/kvm/inject_fault.c
+@@ -168,8 +168,8 @@ void kvm_inject_dabt(struct kvm_vcpu *vcpu, unsigned long addr)
+ {
+ if (!(vcpu->arch.hcr_el2 & HCR_RW))
+ inject_abt32(vcpu, false, addr);
+-
+- inject_abt64(vcpu, false, addr);
++ else
++ inject_abt64(vcpu, false, addr);
+ }
+
+ /**
+@@ -184,8 +184,8 @@ void kvm_inject_pabt(struct kvm_vcpu *vcpu, unsigned long addr)
+ {
+ if (!(vcpu->arch.hcr_el2 & HCR_RW))
+ inject_abt32(vcpu, true, addr);
+-
+- inject_abt64(vcpu, true, addr);
++ else
++ inject_abt64(vcpu, true, addr);
+ }
+
+ /**
+@@ -198,6 +198,6 @@ void kvm_inject_undefined(struct kvm_vcpu *vcpu)
+ {
+ if (!(vcpu->arch.hcr_el2 & HCR_RW))
+ inject_undef32(vcpu);
+-
+- inject_undef64(vcpu);
++ else
++ inject_undef64(vcpu);
+ }
+diff --git a/arch/mips/kernel/scall64-64.S b/arch/mips/kernel/scall64-64.S
+index 5251565e344b..a6576cf1e6d9 100644
+--- a/arch/mips/kernel/scall64-64.S
++++ b/arch/mips/kernel/scall64-64.S
+@@ -80,7 +80,7 @@ syscall_trace_entry:
+ SAVE_STATIC
+ move s0, t2
+ move a0, sp
+- daddiu a1, v0, __NR_64_Linux
++ move a1, v0
+ jal syscall_trace_enter
+
+ bltz v0, 2f # seccomp failed? Skip syscall
+diff --git a/arch/mips/kernel/scall64-n32.S b/arch/mips/kernel/scall64-n32.S
+index 77e74398b828..a8eb6575edc0 100644
+--- a/arch/mips/kernel/scall64-n32.S
++++ b/arch/mips/kernel/scall64-n32.S
+@@ -72,7 +72,7 @@ n32_syscall_trace_entry:
+ SAVE_STATIC
+ move s0, t2
+ move a0, sp
+- daddiu a1, v0, __NR_N32_Linux
++ move a1, v0
+ jal syscall_trace_enter
+
+ bltz v0, 2f # seccomp failed? Skip syscall
+diff --git a/arch/x86/include/asm/desc.h b/arch/x86/include/asm/desc.h
+index a94b82e8f156..69126184c609 100644
+--- a/arch/x86/include/asm/desc.h
++++ b/arch/x86/include/asm/desc.h
+@@ -280,21 +280,6 @@ static inline void clear_LDT(void)
+ set_ldt(NULL, 0);
+ }
+
+-/*
+- * load one particular LDT into the current CPU
+- */
+-static inline void load_LDT_nolock(mm_context_t *pc)
+-{
+- set_ldt(pc->ldt, pc->size);
+-}
+-
+-static inline void load_LDT(mm_context_t *pc)
+-{
+- preempt_disable();
+- load_LDT_nolock(pc);
+- preempt_enable();
+-}
+-
+ static inline unsigned long get_desc_base(const struct desc_struct *desc)
+ {
+ return (unsigned)(desc->base0 | ((desc->base1) << 16) | ((desc->base2) << 24));
+diff --git a/arch/x86/include/asm/mmu.h b/arch/x86/include/asm/mmu.h
+index 876e74e8eec7..b6b7bc3f5d26 100644
+--- a/arch/x86/include/asm/mmu.h
++++ b/arch/x86/include/asm/mmu.h
+@@ -9,8 +9,7 @@
+ * we put the segment information here.
+ */
+ typedef struct {
+- void *ldt;
+- int size;
++ struct ldt_struct *ldt;
+
+ #ifdef CONFIG_X86_64
+ /* True if mm supports a task running in 32 bit compatibility mode. */
+diff --git a/arch/x86/include/asm/mmu_context.h b/arch/x86/include/asm/mmu_context.h
+index 166af2a8e865..23e0625a6183 100644
+--- a/arch/x86/include/asm/mmu_context.h
++++ b/arch/x86/include/asm/mmu_context.h
+@@ -20,6 +20,50 @@ static inline void paravirt_activate_mm(struct mm_struct *prev,
+ #endif /* !CONFIG_PARAVIRT */
+
+ /*
++ * ldt_structs can be allocated, used, and freed, but they are never
++ * modified while live.
++ */
++struct ldt_struct {
++ /*
++ * Xen requires page-aligned LDTs with special permissions. This is
++ * needed to prevent us from installing evil descriptors such as
++ * call gates. On native, we could merge the ldt_struct and LDT
++ * allocations, but it's not worth trying to optimize.
++ */
++ struct desc_struct *entries;
++ int size;
++};
++
++static inline void load_mm_ldt(struct mm_struct *mm)
++{
++ struct ldt_struct *ldt;
++
++ /* lockless_dereference synchronizes with smp_store_release */
++ ldt = lockless_dereference(mm->context.ldt);
++
++ /*
++ * Any change to mm->context.ldt is followed by an IPI to all
++ * CPUs with the mm active. The LDT will not be freed until
++ * after the IPI is handled by all such CPUs. This means that,
++ * if the ldt_struct changes before we return, the values we see
++ * will be safe, and the new values will be loaded before we run
++ * any user code.
++ *
++ * NB: don't try to convert this to use RCU without extreme care.
++ * We would still need IRQs off, because we don't want to change
++ * the local LDT after an IPI loaded a newer value than the one
++ * that we can see.
++ */
++
++ if (unlikely(ldt))
++ set_ldt(ldt->entries, ldt->size);
++ else
++ clear_LDT();
++
++ DEBUG_LOCKS_WARN_ON(preemptible());
++}
++
++/*
+ * Used for LDT copy/destruction.
+ */
+ int init_new_context(struct task_struct *tsk, struct mm_struct *mm);
+@@ -55,7 +99,7 @@ static inline void switch_mm(struct mm_struct *prev, struct mm_struct *next,
+
+ /* Load the LDT, if the LDT is different: */
+ if (unlikely(prev->context.ldt != next->context.ldt))
+- load_LDT_nolock(&next->context);
++ load_mm_ldt(next);
+ }
+ #ifdef CONFIG_SMP
+ else {
+@@ -77,7 +121,7 @@ static inline void switch_mm(struct mm_struct *prev, struct mm_struct *next,
+ */
+ load_cr3(next->pgd);
+ trace_tlb_flush(TLB_FLUSH_ON_TASK_SWITCH, TLB_FLUSH_ALL);
+- load_LDT_nolock(&next->context);
++ load_mm_ldt(next);
+ }
+ }
+ #endif
+diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
+index 7bc49c3b9684..e757fcbe90db 100644
+--- a/arch/x86/kernel/cpu/common.c
++++ b/arch/x86/kernel/cpu/common.c
+@@ -1383,7 +1383,7 @@ void cpu_init(void)
+ load_sp0(t, ¤t->thread);
+ set_tss_desc(cpu, t);
+ load_TR_desc();
+- load_LDT(&init_mm.context);
++ load_mm_ldt(&init_mm);
+
+ clear_all_debug_regs();
+ dbg_restore_debug_regs();
+@@ -1426,7 +1426,7 @@ void cpu_init(void)
+ load_sp0(t, thread);
+ set_tss_desc(cpu, t);
+ load_TR_desc();
+- load_LDT(&init_mm.context);
++ load_mm_ldt(&init_mm);
+
+ t->x86_tss.io_bitmap_base = offsetof(struct tss_struct, io_bitmap);
+
+diff --git a/arch/x86/kernel/cpu/perf_event.c b/arch/x86/kernel/cpu/perf_event.c
+index 6b5acd5f4a34..c832e9f54cd6 100644
+--- a/arch/x86/kernel/cpu/perf_event.c
++++ b/arch/x86/kernel/cpu/perf_event.c
+@@ -32,6 +32,7 @@
+ #include <asm/smp.h>
+ #include <asm/alternative.h>
+ #include <asm/tlbflush.h>
++#include <asm/mmu_context.h>
+ #include <asm/timer.h>
+ #include <asm/desc.h>
+ #include <asm/ldt.h>
+@@ -1987,21 +1988,25 @@ static unsigned long get_segment_base(unsigned int segment)
+ int idx = segment >> 3;
+
+ if ((segment & SEGMENT_TI_MASK) == SEGMENT_LDT) {
++ struct ldt_struct *ldt;
++
+ if (idx > LDT_ENTRIES)
+ return 0;
+
+- if (idx > current->active_mm->context.size)
++ /* IRQs are off, so this synchronizes with smp_store_release */
++ ldt = lockless_dereference(current->active_mm->context.ldt);
++ if (!ldt || idx > ldt->size)
+ return 0;
+
+- desc = current->active_mm->context.ldt;
++ desc = &ldt->entries[idx];
+ } else {
+ if (idx > GDT_ENTRIES)
+ return 0;
+
+- desc = raw_cpu_ptr(gdt_page.gdt);
++ desc = raw_cpu_ptr(gdt_page.gdt) + idx;
+ }
+
+- return get_desc_base(desc + idx);
++ return get_desc_base(desc);
+ }
+
+ #ifdef CONFIG_COMPAT
+diff --git a/arch/x86/kernel/entry_64.S b/arch/x86/kernel/entry_64.S
+index e36d9815ef56..fad5cd9d7c4b 100644
+--- a/arch/x86/kernel/entry_64.S
++++ b/arch/x86/kernel/entry_64.S
+@@ -1459,20 +1459,77 @@ ENTRY(nmi)
+ * a nested NMI that updated the copy interrupt stack frame, a
+ * jump will be made to the repeat_nmi code that will handle the second
+ * NMI.
++ *
++ * However, espfix prevents us from directly returning to userspace
++ * with a single IRET instruction. Similarly, IRET to user mode
++ * can fault. We therefore handle NMIs from user space like
++ * other IST entries.
+ */
+
+ /* Use %rdx as out temp variable throughout */
+ pushq_cfi %rdx
+ CFI_REL_OFFSET rdx, 0
+
++ testb $3, CS-RIP+8(%rsp)
++ jz .Lnmi_from_kernel
++
++ /*
++ * NMI from user mode. We need to run on the thread stack, but we
++ * can't go through the normal entry paths: NMIs are masked, and
++ * we don't want to enable interrupts, because then we'll end
++ * up in an awkward situation in which IRQs are on but NMIs
++ * are off.
++ */
++
++ SWAPGS
++ cld
++ movq %rsp, %rdx
++ movq PER_CPU_VAR(kernel_stack), %rsp
++ addq $KERNEL_STACK_OFFSET, %rsp
++ pushq 5*8(%rdx) /* pt_regs->ss */
++ pushq 4*8(%rdx) /* pt_regs->rsp */
++ pushq 3*8(%rdx) /* pt_regs->flags */
++ pushq 2*8(%rdx) /* pt_regs->cs */
++ pushq 1*8(%rdx) /* pt_regs->rip */
++ pushq $-1 /* pt_regs->orig_ax */
++ pushq %rdi /* pt_regs->di */
++ pushq %rsi /* pt_regs->si */
++ pushq (%rdx) /* pt_regs->dx */
++ pushq %rcx /* pt_regs->cx */
++ pushq %rax /* pt_regs->ax */
++ pushq %r8 /* pt_regs->r8 */
++ pushq %r9 /* pt_regs->r9 */
++ pushq %r10 /* pt_regs->r10 */
++ pushq %r11 /* pt_regs->r11 */
++ pushq %rbx /* pt_regs->rbx */
++ pushq %rbp /* pt_regs->rbp */
++ pushq %r12 /* pt_regs->r12 */
++ pushq %r13 /* pt_regs->r13 */
++ pushq %r14 /* pt_regs->r14 */
++ pushq %r15 /* pt_regs->r15 */
++
+ /*
+- * If %cs was not the kernel segment, then the NMI triggered in user
+- * space, which means it is definitely not nested.
++ * At this point we no longer need to worry about stack damage
++ * due to nesting -- we're on the normal thread stack and we're
++ * done with the NMI stack.
+ */
+- cmpl $__KERNEL_CS, 16(%rsp)
+- jne first_nmi
++
++ movq %rsp, %rdi
++ movq $-1, %rsi
++ call do_nmi
+
+ /*
++ * Return back to user mode. We must *not* do the normal exit
++ * work, because we don't want to enable interrupts. Fortunately,
++ * do_nmi doesn't modify pt_regs.
++ */
++ SWAPGS
++
++ addq $6*8, %rsp /* skip bx, bp, and r12-r15 */
++ jmp restore_args
++
++.Lnmi_from_kernel:
++ /*
+ * Check the special variable on the stack to see if NMIs are
+ * executing.
+ */
+@@ -1629,29 +1686,11 @@ end_repeat_nmi:
+ call save_paranoid
+ DEFAULT_FRAME 0
+
+- /*
+- * Save off the CR2 register. If we take a page fault in the NMI then
+- * it could corrupt the CR2 value. If the NMI preempts a page fault
+- * handler before it was able to read the CR2 register, and then the
+- * NMI itself takes a page fault, the page fault that was preempted
+- * will read the information from the NMI page fault and not the
+- * origin fault. Save it off and restore it if it changes.
+- * Use the r12 callee-saved register.
+- */
+- movq %cr2, %r12
+-
+ /* paranoidentry do_nmi, 0; without TRACE_IRQS_OFF */
+ movq %rsp,%rdi
+ movq $-1,%rsi
+ call do_nmi
+
+- /* Did the NMI take a page fault? Restore cr2 if it did */
+- movq %cr2, %rcx
+- cmpq %rcx, %r12
+- je 1f
+- movq %r12, %cr2
+-1:
+-
+ testl %ebx,%ebx /* swapgs needed? */
+ jnz nmi_restore
+ nmi_swapgs:
+diff --git a/arch/x86/kernel/ldt.c b/arch/x86/kernel/ldt.c
+index c37886d759cc..2bcc0525f1c1 100644
+--- a/arch/x86/kernel/ldt.c
++++ b/arch/x86/kernel/ldt.c
+@@ -12,6 +12,7 @@
+ #include <linux/string.h>
+ #include <linux/mm.h>
+ #include <linux/smp.h>
++#include <linux/slab.h>
+ #include <linux/vmalloc.h>
+ #include <linux/uaccess.h>
+
+@@ -20,82 +21,82 @@
+ #include <asm/mmu_context.h>
+ #include <asm/syscalls.h>
+
+-#ifdef CONFIG_SMP
++/* context.lock is held for us, so we don't need any locking. */
+ static void flush_ldt(void *current_mm)
+ {
+- if (current->active_mm == current_mm)
+- load_LDT(¤t->active_mm->context);
++ mm_context_t *pc;
++
++ if (current->active_mm != current_mm)
++ return;
++
++ pc = ¤t->active_mm->context;
++ set_ldt(pc->ldt->entries, pc->ldt->size);
+ }
+-#endif
+
+-static int alloc_ldt(mm_context_t *pc, int mincount, int reload)
++/* The caller must call finalize_ldt_struct on the result. LDT starts zeroed. */
++static struct ldt_struct *alloc_ldt_struct(int size)
+ {
+- void *oldldt, *newldt;
+- int oldsize;
+-
+- if (mincount <= pc->size)
+- return 0;
+- oldsize = pc->size;
+- mincount = (mincount + (PAGE_SIZE / LDT_ENTRY_SIZE - 1)) &
+- (~(PAGE_SIZE / LDT_ENTRY_SIZE - 1));
+- if (mincount * LDT_ENTRY_SIZE > PAGE_SIZE)
+- newldt = vmalloc(mincount * LDT_ENTRY_SIZE);
++ struct ldt_struct *new_ldt;
++ int alloc_size;
++
++ if (size > LDT_ENTRIES)
++ return NULL;
++
++ new_ldt = kmalloc(sizeof(struct ldt_struct), GFP_KERNEL);
++ if (!new_ldt)
++ return NULL;
++
++ BUILD_BUG_ON(LDT_ENTRY_SIZE != sizeof(struct desc_struct));
++ alloc_size = size * LDT_ENTRY_SIZE;
++
++ /*
++ * Xen is very picky: it requires a page-aligned LDT that has no
++ * trailing nonzero bytes in any page that contains LDT descriptors.
++ * Keep it simple: zero the whole allocation and never allocate less
++ * than PAGE_SIZE.
++ */
++ if (alloc_size > PAGE_SIZE)
++ new_ldt->entries = vzalloc(alloc_size);
+ else
+- newldt = (void *)__get_free_page(GFP_KERNEL);
+-
+- if (!newldt)
+- return -ENOMEM;
++ new_ldt->entries = kzalloc(PAGE_SIZE, GFP_KERNEL);
+
+- if (oldsize)
+- memcpy(newldt, pc->ldt, oldsize * LDT_ENTRY_SIZE);
+- oldldt = pc->ldt;
+- memset(newldt + oldsize * LDT_ENTRY_SIZE, 0,
+- (mincount - oldsize) * LDT_ENTRY_SIZE);
++ if (!new_ldt->entries) {
++ kfree(new_ldt);
++ return NULL;
++ }
+
+- paravirt_alloc_ldt(newldt, mincount);
++ new_ldt->size = size;
++ return new_ldt;
++}
+
+-#ifdef CONFIG_X86_64
+- /* CHECKME: Do we really need this ? */
+- wmb();
+-#endif
+- pc->ldt = newldt;
+- wmb();
+- pc->size = mincount;
+- wmb();
+-
+- if (reload) {
+-#ifdef CONFIG_SMP
+- preempt_disable();
+- load_LDT(pc);
+- if (!cpumask_equal(mm_cpumask(current->mm),
+- cpumask_of(smp_processor_id())))
+- smp_call_function(flush_ldt, current->mm, 1);
+- preempt_enable();
+-#else
+- load_LDT(pc);
+-#endif
+- }
+- if (oldsize) {
+- paravirt_free_ldt(oldldt, oldsize);
+- if (oldsize * LDT_ENTRY_SIZE > PAGE_SIZE)
+- vfree(oldldt);
+- else
+- put_page(virt_to_page(oldldt));
+- }
+- return 0;
++/* After calling this, the LDT is immutable. */
++static void finalize_ldt_struct(struct ldt_struct *ldt)
++{
++ paravirt_alloc_ldt(ldt->entries, ldt->size);
+ }
+
+-static inline int copy_ldt(mm_context_t *new, mm_context_t *old)
++/* context.lock is held */
++static void install_ldt(struct mm_struct *current_mm,
++ struct ldt_struct *ldt)
+ {
+- int err = alloc_ldt(new, old->size, 0);
+- int i;
++ /* Synchronizes with lockless_dereference in load_mm_ldt. */
++ smp_store_release(¤t_mm->context.ldt, ldt);
++
++ /* Activate the LDT for all CPUs using current_mm. */
++ on_each_cpu_mask(mm_cpumask(current_mm), flush_ldt, current_mm, true);
++}
+
+- if (err < 0)
+- return err;
++static void free_ldt_struct(struct ldt_struct *ldt)
++{
++ if (likely(!ldt))
++ return;
+
+- for (i = 0; i < old->size; i++)
+- write_ldt_entry(new->ldt, i, old->ldt + i * LDT_ENTRY_SIZE);
+- return 0;
++ paravirt_free_ldt(ldt->entries, ldt->size);
++ if (ldt->size * LDT_ENTRY_SIZE > PAGE_SIZE)
++ vfree(ldt->entries);
++ else
++ kfree(ldt->entries);
++ kfree(ldt);
+ }
+
+ /*
+@@ -104,17 +105,37 @@ static inline int copy_ldt(mm_context_t *new, mm_context_t *old)
+ */
+ int init_new_context(struct task_struct *tsk, struct mm_struct *mm)
+ {
++ struct ldt_struct *new_ldt;
+ struct mm_struct *old_mm;
+ int retval = 0;
+
+ mutex_init(&mm->context.lock);
+- mm->context.size = 0;
+ old_mm = current->mm;
+- if (old_mm && old_mm->context.size > 0) {
+- mutex_lock(&old_mm->context.lock);
+- retval = copy_ldt(&mm->context, &old_mm->context);
+- mutex_unlock(&old_mm->context.lock);
++ if (!old_mm) {
++ mm->context.ldt = NULL;
++ return 0;
+ }
++
++ mutex_lock(&old_mm->context.lock);
++ if (!old_mm->context.ldt) {
++ mm->context.ldt = NULL;
++ goto out_unlock;
++ }
++
++ new_ldt = alloc_ldt_struct(old_mm->context.ldt->size);
++ if (!new_ldt) {
++ retval = -ENOMEM;
++ goto out_unlock;
++ }
++
++ memcpy(new_ldt->entries, old_mm->context.ldt->entries,
++ new_ldt->size * LDT_ENTRY_SIZE);
++ finalize_ldt_struct(new_ldt);
++
++ mm->context.ldt = new_ldt;
++
++out_unlock:
++ mutex_unlock(&old_mm->context.lock);
+ return retval;
+ }
+
+@@ -125,53 +146,47 @@ int init_new_context(struct task_struct *tsk, struct mm_struct *mm)
+ */
+ void destroy_context(struct mm_struct *mm)
+ {
+- if (mm->context.size) {
+-#ifdef CONFIG_X86_32
+- /* CHECKME: Can this ever happen ? */
+- if (mm == current->active_mm)
+- clear_LDT();
+-#endif
+- paravirt_free_ldt(mm->context.ldt, mm->context.size);
+- if (mm->context.size * LDT_ENTRY_SIZE > PAGE_SIZE)
+- vfree(mm->context.ldt);
+- else
+- put_page(virt_to_page(mm->context.ldt));
+- mm->context.size = 0;
+- }
++ free_ldt_struct(mm->context.ldt);
++ mm->context.ldt = NULL;
+ }
+
+ static int read_ldt(void __user *ptr, unsigned long bytecount)
+ {
+- int err;
++ int retval;
+ unsigned long size;
+ struct mm_struct *mm = current->mm;
+
+- if (!mm->context.size)
+- return 0;
++ mutex_lock(&mm->context.lock);
++
++ if (!mm->context.ldt) {
++ retval = 0;
++ goto out_unlock;
++ }
++
+ if (bytecount > LDT_ENTRY_SIZE * LDT_ENTRIES)
+ bytecount = LDT_ENTRY_SIZE * LDT_ENTRIES;
+
+- mutex_lock(&mm->context.lock);
+- size = mm->context.size * LDT_ENTRY_SIZE;
++ size = mm->context.ldt->size * LDT_ENTRY_SIZE;
+ if (size > bytecount)
+ size = bytecount;
+
+- err = 0;
+- if (copy_to_user(ptr, mm->context.ldt, size))
+- err = -EFAULT;
+- mutex_unlock(&mm->context.lock);
+- if (err < 0)
+- goto error_return;
++ if (copy_to_user(ptr, mm->context.ldt->entries, size)) {
++ retval = -EFAULT;
++ goto out_unlock;
++ }
++
+ if (size != bytecount) {
+- /* zero-fill the rest */
+- if (clear_user(ptr + size, bytecount - size) != 0) {
+- err = -EFAULT;
+- goto error_return;
++ /* Zero-fill the rest and pretend we read bytecount bytes. */
++ if (clear_user(ptr + size, bytecount - size)) {
++ retval = -EFAULT;
++ goto out_unlock;
+ }
+ }
+- return bytecount;
+-error_return:
+- return err;
++ retval = bytecount;
++
++out_unlock:
++ mutex_unlock(&mm->context.lock);
++ return retval;
+ }
+
+ static int read_default_ldt(void __user *ptr, unsigned long bytecount)
+@@ -195,6 +210,8 @@ static int write_ldt(void __user *ptr, unsigned long bytecount, int oldmode)
+ struct desc_struct ldt;
+ int error;
+ struct user_desc ldt_info;
++ int oldsize, newsize;
++ struct ldt_struct *new_ldt, *old_ldt;
+
+ error = -EINVAL;
+ if (bytecount != sizeof(ldt_info))
+@@ -213,34 +230,39 @@ static int write_ldt(void __user *ptr, unsigned long bytecount, int oldmode)
+ goto out;
+ }
+
+- mutex_lock(&mm->context.lock);
+- if (ldt_info.entry_number >= mm->context.size) {
+- error = alloc_ldt(¤t->mm->context,
+- ldt_info.entry_number + 1, 1);
+- if (error < 0)
+- goto out_unlock;
+- }
+-
+- /* Allow LDTs to be cleared by the user. */
+- if (ldt_info.base_addr == 0 && ldt_info.limit == 0) {
+- if (oldmode || LDT_empty(&ldt_info)) {
+- memset(&ldt, 0, sizeof(ldt));
+- goto install;
++ if ((oldmode && !ldt_info.base_addr && !ldt_info.limit) ||
++ LDT_empty(&ldt_info)) {
++ /* The user wants to clear the entry. */
++ memset(&ldt, 0, sizeof(ldt));
++ } else {
++ if (!IS_ENABLED(CONFIG_X86_16BIT) && !ldt_info.seg_32bit) {
++ error = -EINVAL;
++ goto out;
+ }
++
++ fill_ldt(&ldt, &ldt_info);
++ if (oldmode)
++ ldt.avl = 0;
+ }
+
+- if (!IS_ENABLED(CONFIG_X86_16BIT) && !ldt_info.seg_32bit) {
+- error = -EINVAL;
++ mutex_lock(&mm->context.lock);
++
++ old_ldt = mm->context.ldt;
++ oldsize = old_ldt ? old_ldt->size : 0;
++ newsize = max((int)(ldt_info.entry_number + 1), oldsize);
++
++ error = -ENOMEM;
++ new_ldt = alloc_ldt_struct(newsize);
++ if (!new_ldt)
+ goto out_unlock;
+- }
+
+- fill_ldt(&ldt, &ldt_info);
+- if (oldmode)
+- ldt.avl = 0;
++ if (old_ldt)
++ memcpy(new_ldt->entries, old_ldt->entries, oldsize * LDT_ENTRY_SIZE);
++ new_ldt->entries[ldt_info.entry_number] = ldt;
++ finalize_ldt_struct(new_ldt);
+
+- /* Install the new entry ... */
+-install:
+- write_ldt_entry(mm->context.ldt, ldt_info.entry_number, &ldt);
++ install_ldt(mm, new_ldt);
++ free_ldt_struct(old_ldt);
+ error = 0;
+
+ out_unlock:
+diff --git a/arch/x86/kernel/nmi.c b/arch/x86/kernel/nmi.c
+index c3e985d1751c..5c5ec7d28d9b 100644
+--- a/arch/x86/kernel/nmi.c
++++ b/arch/x86/kernel/nmi.c
+@@ -408,15 +408,15 @@ static void default_do_nmi(struct pt_regs *regs)
+ NOKPROBE_SYMBOL(default_do_nmi);
+
+ /*
+- * NMIs can hit breakpoints which will cause it to lose its
+- * NMI context with the CPU when the breakpoint does an iret.
+- */
+-#ifdef CONFIG_X86_32
+-/*
+- * For i386, NMIs use the same stack as the kernel, and we can
+- * add a workaround to the iret problem in C (preventing nested
+- * NMIs if an NMI takes a trap). Simply have 3 states the NMI
+- * can be in:
++ * NMIs can hit breakpoints which will cause it to lose its NMI context
++ * with the CPU when the breakpoint or page fault does an IRET.
++ *
++ * As a result, NMIs can nest if NMIs get unmasked due an IRET during
++ * NMI processing. On x86_64, the asm glue protects us from nested NMIs
++ * if the outer NMI came from kernel mode, but we can still nest if the
++ * outer NMI came from user mode.
++ *
++ * To handle these nested NMIs, we have three states:
+ *
+ * 1) not running
+ * 2) executing
+@@ -430,15 +430,14 @@ NOKPROBE_SYMBOL(default_do_nmi);
+ * (Note, the latch is binary, thus multiple NMIs triggering,
+ * when one is running, are ignored. Only one NMI is restarted.)
+ *
+- * If an NMI hits a breakpoint that executes an iret, another
+- * NMI can preempt it. We do not want to allow this new NMI
+- * to run, but we want to execute it when the first one finishes.
+- * We set the state to "latched", and the exit of the first NMI will
+- * perform a dec_return, if the result is zero (NOT_RUNNING), then
+- * it will simply exit the NMI handler. If not, the dec_return
+- * would have set the state to NMI_EXECUTING (what we want it to
+- * be when we are running). In this case, we simply jump back
+- * to rerun the NMI handler again, and restart the 'latched' NMI.
++ * If an NMI executes an iret, another NMI can preempt it. We do not
++ * want to allow this new NMI to run, but we want to execute it when the
++ * first one finishes. We set the state to "latched", and the exit of
++ * the first NMI will perform a dec_return, if the result is zero
++ * (NOT_RUNNING), then it will simply exit the NMI handler. If not, the
++ * dec_return would have set the state to NMI_EXECUTING (what we want it
++ * to be when we are running). In this case, we simply jump back to
++ * rerun the NMI handler again, and restart the 'latched' NMI.
+ *
+ * No trap (breakpoint or page fault) should be hit before nmi_restart,
+ * thus there is no race between the first check of state for NOT_RUNNING
+@@ -461,49 +460,36 @@ enum nmi_states {
+ static DEFINE_PER_CPU(enum nmi_states, nmi_state);
+ static DEFINE_PER_CPU(unsigned long, nmi_cr2);
+
+-#define nmi_nesting_preprocess(regs) \
+- do { \
+- if (this_cpu_read(nmi_state) != NMI_NOT_RUNNING) { \
+- this_cpu_write(nmi_state, NMI_LATCHED); \
+- return; \
+- } \
+- this_cpu_write(nmi_state, NMI_EXECUTING); \
+- this_cpu_write(nmi_cr2, read_cr2()); \
+- } while (0); \
+- nmi_restart:
+-
+-#define nmi_nesting_postprocess() \
+- do { \
+- if (unlikely(this_cpu_read(nmi_cr2) != read_cr2())) \
+- write_cr2(this_cpu_read(nmi_cr2)); \
+- if (this_cpu_dec_return(nmi_state)) \
+- goto nmi_restart; \
+- } while (0)
+-#else /* x86_64 */
++#ifdef CONFIG_X86_64
+ /*
+- * In x86_64 things are a bit more difficult. This has the same problem
+- * where an NMI hitting a breakpoint that calls iret will remove the
+- * NMI context, allowing a nested NMI to enter. What makes this more
+- * difficult is that both NMIs and breakpoints have their own stack.
+- * When a new NMI or breakpoint is executed, the stack is set to a fixed
+- * point. If an NMI is nested, it will have its stack set at that same
+- * fixed address that the first NMI had, and will start corrupting the
+- * stack. This is handled in entry_64.S, but the same problem exists with
+- * the breakpoint stack.
++ * In x86_64, we need to handle breakpoint -> NMI -> breakpoint. Without
++ * some care, the inner breakpoint will clobber the outer breakpoint's
++ * stack.
+ *
+- * If a breakpoint is being processed, and the debug stack is being used,
+- * if an NMI comes in and also hits a breakpoint, the stack pointer
+- * will be set to the same fixed address as the breakpoint that was
+- * interrupted, causing that stack to be corrupted. To handle this case,
+- * check if the stack that was interrupted is the debug stack, and if
+- * so, change the IDT so that new breakpoints will use the current stack
+- * and not switch to the fixed address. On return of the NMI, switch back
+- * to the original IDT.
++ * If a breakpoint is being processed, and the debug stack is being
++ * used, if an NMI comes in and also hits a breakpoint, the stack
++ * pointer will be set to the same fixed address as the breakpoint that
++ * was interrupted, causing that stack to be corrupted. To handle this
++ * case, check if the stack that was interrupted is the debug stack, and
++ * if so, change the IDT so that new breakpoints will use the current
++ * stack and not switch to the fixed address. On return of the NMI,
++ * switch back to the original IDT.
+ */
+ static DEFINE_PER_CPU(int, update_debug_stack);
++#endif
+
+-static inline void nmi_nesting_preprocess(struct pt_regs *regs)
++dotraplinkage notrace __kprobes void
++do_nmi(struct pt_regs *regs, long error_code)
+ {
++ if (this_cpu_read(nmi_state) != NMI_NOT_RUNNING) {
++ this_cpu_write(nmi_state, NMI_LATCHED);
++ return;
++ }
++ this_cpu_write(nmi_state, NMI_EXECUTING);
++ this_cpu_write(nmi_cr2, read_cr2());
++nmi_restart:
++
++#ifdef CONFIG_X86_64
+ /*
+ * If we interrupted a breakpoint, it is possible that
+ * the nmi handler will have breakpoints too. We need to
+@@ -514,22 +500,8 @@ static inline void nmi_nesting_preprocess(struct pt_regs *regs)
+ debug_stack_set_zero();
+ this_cpu_write(update_debug_stack, 1);
+ }
+-}
+-
+-static inline void nmi_nesting_postprocess(void)
+-{
+- if (unlikely(this_cpu_read(update_debug_stack))) {
+- debug_stack_reset();
+- this_cpu_write(update_debug_stack, 0);
+- }
+-}
+ #endif
+
+-dotraplinkage notrace void
+-do_nmi(struct pt_regs *regs, long error_code)
+-{
+- nmi_nesting_preprocess(regs);
+-
+ nmi_enter();
+
+ inc_irq_stat(__nmi_count);
+@@ -539,8 +511,17 @@ do_nmi(struct pt_regs *regs, long error_code)
+
+ nmi_exit();
+
+- /* On i386, may loop back to preprocess */
+- nmi_nesting_postprocess();
++#ifdef CONFIG_X86_64
++ if (unlikely(this_cpu_read(update_debug_stack))) {
++ debug_stack_reset();
++ this_cpu_write(update_debug_stack, 0);
++ }
++#endif
++
++ if (unlikely(this_cpu_read(nmi_cr2) != read_cr2()))
++ write_cr2(this_cpu_read(nmi_cr2));
++ if (this_cpu_dec_return(nmi_state))
++ goto nmi_restart;
+ }
+ NOKPROBE_SYMBOL(do_nmi);
+
+diff --git a/arch/x86/kernel/process_64.c b/arch/x86/kernel/process_64.c
+index 67fcc43577d2..63a4b5092203 100644
+--- a/arch/x86/kernel/process_64.c
++++ b/arch/x86/kernel/process_64.c
+@@ -122,11 +122,11 @@ void __show_regs(struct pt_regs *regs, int all)
+ void release_thread(struct task_struct *dead_task)
+ {
+ if (dead_task->mm) {
+- if (dead_task->mm->context.size) {
++ if (dead_task->mm->context.ldt) {
+ pr_warn("WARNING: dead process %s still has LDT? <%p/%d>\n",
+ dead_task->comm,
+ dead_task->mm->context.ldt,
+- dead_task->mm->context.size);
++ dead_task->mm->context.ldt->size);
+ BUG();
+ }
+ }
+diff --git a/arch/x86/kernel/step.c b/arch/x86/kernel/step.c
+index 9b4d51d0c0d0..0ccb53a9fcd9 100644
+--- a/arch/x86/kernel/step.c
++++ b/arch/x86/kernel/step.c
+@@ -5,6 +5,7 @@
+ #include <linux/mm.h>
+ #include <linux/ptrace.h>
+ #include <asm/desc.h>
++#include <asm/mmu_context.h>
+
+ unsigned long convert_ip_to_linear(struct task_struct *child, struct pt_regs *regs)
+ {
+@@ -27,13 +28,14 @@ unsigned long convert_ip_to_linear(struct task_struct *child, struct pt_regs *re
+ struct desc_struct *desc;
+ unsigned long base;
+
+- seg &= ~7UL;
++ seg >>= 3;
+
+ mutex_lock(&child->mm->context.lock);
+- if (unlikely((seg >> 3) >= child->mm->context.size))
++ if (unlikely(!child->mm->context.ldt ||
++ seg >= child->mm->context.ldt->size))
+ addr = -1L; /* bogus selector, access would fault */
+ else {
+- desc = child->mm->context.ldt + seg;
++ desc = &child->mm->context.ldt->entries[seg];
+ base = get_desc_base(desc);
+
+ /* 16-bit code segment? */
+diff --git a/arch/x86/power/cpu.c b/arch/x86/power/cpu.c
+index 3e32ed5648a0..a13a38830e76 100644
+--- a/arch/x86/power/cpu.c
++++ b/arch/x86/power/cpu.c
+@@ -23,6 +23,7 @@
+ #include <asm/debugreg.h>
+ #include <asm/fpu-internal.h> /* pcntxt_mask */
+ #include <asm/cpu.h>
++#include <asm/mmu_context.h>
+
+ #ifdef CONFIG_X86_32
+ __visible unsigned long saved_context_ebx;
+@@ -154,7 +155,7 @@ static void fix_processor_context(void)
+ syscall_init(); /* This sets MSR_*STAR and related */
+ #endif
+ load_TR_desc(); /* This does ltr */
+- load_LDT(¤t->active_mm->context); /* This does lldt */
++ load_mm_ldt(current->active_mm); /* This does lldt */
+ }
+
+ /**
+diff --git a/arch/x86/xen/Kconfig b/arch/x86/xen/Kconfig
+index e88fda867a33..484145368a24 100644
+--- a/arch/x86/xen/Kconfig
++++ b/arch/x86/xen/Kconfig
+@@ -8,7 +8,7 @@ config XEN
+ select PARAVIRT_CLOCK
+ select XEN_HAVE_PVMMU
+ depends on X86_64 || (X86_32 && X86_PAE)
+- depends on X86_TSC
++ depends on X86_LOCAL_APIC && X86_TSC
+ help
+ This is the Linux Xen port. Enabling this will allow the
+ kernel to boot in a paravirtualized environment under the
+@@ -17,7 +17,7 @@ config XEN
+ config XEN_DOM0
+ def_bool y
+ depends on XEN && PCI_XEN && SWIOTLB_XEN
+- depends on X86_LOCAL_APIC && X86_IO_APIC && ACPI && PCI
++ depends on X86_IO_APIC && ACPI && PCI
+
+ config XEN_PVHVM
+ def_bool y
+diff --git a/arch/x86/xen/Makefile b/arch/x86/xen/Makefile
+index 7322755f337a..4b6e29ac0968 100644
+--- a/arch/x86/xen/Makefile
++++ b/arch/x86/xen/Makefile
+@@ -13,13 +13,13 @@ CFLAGS_mmu.o := $(nostackp)
+ obj-y := enlighten.o setup.o multicalls.o mmu.o irq.o \
+ time.o xen-asm.o xen-asm_$(BITS).o \
+ grant-table.o suspend.o platform-pci-unplug.o \
+- p2m.o
++ p2m.o apic.o
+
+ obj-$(CONFIG_EVENT_TRACING) += trace.o
+
+ obj-$(CONFIG_SMP) += smp.o
+ obj-$(CONFIG_PARAVIRT_SPINLOCKS)+= spinlock.o
+ obj-$(CONFIG_XEN_DEBUG_FS) += debugfs.o
+-obj-$(CONFIG_XEN_DOM0) += apic.o vga.o
++obj-$(CONFIG_XEN_DOM0) += vga.o
+ obj-$(CONFIG_SWIOTLB_XEN) += pci-swiotlb-xen.o
+ obj-$(CONFIG_XEN_EFI) += efi.o
+diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
+index e180e097a53a..d8d81d1aa1d5 100644
+--- a/arch/x86/xen/enlighten.c
++++ b/arch/x86/xen/enlighten.c
+@@ -1772,6 +1772,7 @@ asmlinkage __visible void __init xen_start_kernel(void)
+ #ifdef CONFIG_X86_32
+ i386_start_kernel();
+ #else
++ cr4_init_shadow(); /* 32b kernel does this in i386_start_kernel() */
+ x86_64_start_reservations((char *)__pa_symbol(&boot_params));
+ #endif
+ }
+diff --git a/arch/x86/xen/xen-ops.h b/arch/x86/xen/xen-ops.h
+index 28c7e0be56e4..566004cc8a5b 100644
+--- a/arch/x86/xen/xen-ops.h
++++ b/arch/x86/xen/xen-ops.h
+@@ -94,17 +94,15 @@ struct dom0_vga_console_info;
+
+ #ifdef CONFIG_XEN_DOM0
+ void __init xen_init_vga(const struct dom0_vga_console_info *, size_t size);
+-void __init xen_init_apic(void);
+ #else
+ static inline void __init xen_init_vga(const struct dom0_vga_console_info *info,
+ size_t size)
+ {
+ }
+-static inline void __init xen_init_apic(void)
+-{
+-}
+ #endif
+
++void __init xen_init_apic(void);
++
+ #ifdef CONFIG_XEN_EFI
+ extern void xen_efi_init(void);
+ #else
+diff --git a/block/blk-settings.c b/block/blk-settings.c
+index aa02247d227e..d15c34a31633 100644
+--- a/block/blk-settings.c
++++ b/block/blk-settings.c
+@@ -241,8 +241,8 @@ EXPORT_SYMBOL(blk_queue_bounce_limit);
+ * Description:
+ * Enables a low level driver to set a hard upper limit,
+ * max_hw_sectors, on the size of requests. max_hw_sectors is set by
+- * the device driver based upon the combined capabilities of I/O
+- * controller and storage device.
++ * the device driver based upon the capabilities of the I/O
++ * controller.
+ *
+ * max_sectors is a soft limit imposed by the block layer for
+ * filesystem type requests. This value can be overridden on a
+diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
+index 74e18e94bef2..7f15707b4850 100644
+--- a/drivers/ata/libata-core.c
++++ b/drivers/ata/libata-core.c
+@@ -4238,6 +4238,8 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
+ ATA_HORKAGE_ZERO_AFTER_TRIM, },
+ { "Samsung SSD 8*", NULL, ATA_HORKAGE_NO_NCQ_TRIM |
+ ATA_HORKAGE_ZERO_AFTER_TRIM, },
++ { "FCCT*M500*", NULL, ATA_HORKAGE_NO_NCQ_TRIM |
++ ATA_HORKAGE_ZERO_AFTER_TRIM, },
+
+ /* devices that don't properly handle TRIM commands */
+ { "SuperSSpeed S238*", NULL, ATA_HORKAGE_NOTRIM, },
+diff --git a/drivers/base/regmap/regcache-rbtree.c b/drivers/base/regmap/regcache-rbtree.c
+index 9d09c5bb5874..bb39181e4c33 100644
+--- a/drivers/base/regmap/regcache-rbtree.c
++++ b/drivers/base/regmap/regcache-rbtree.c
+@@ -296,11 +296,20 @@ static int regcache_rbtree_insert_to_block(struct regmap *map,
+ if (!blk)
+ return -ENOMEM;
+
+- present = krealloc(rbnode->cache_present,
+- BITS_TO_LONGS(blklen) * sizeof(*present), GFP_KERNEL);
+- if (!present) {
+- kfree(blk);
+- return -ENOMEM;
++ if (BITS_TO_LONGS(blklen) > BITS_TO_LONGS(rbnode->blklen)) {
++ present = krealloc(rbnode->cache_present,
++ BITS_TO_LONGS(blklen) * sizeof(*present),
++ GFP_KERNEL);
++ if (!present) {
++ kfree(blk);
++ return -ENOMEM;
++ }
++
++ memset(present + BITS_TO_LONGS(rbnode->blklen), 0,
++ (BITS_TO_LONGS(blklen) - BITS_TO_LONGS(rbnode->blklen))
++ * sizeof(*present));
++ } else {
++ present = rbnode->cache_present;
+ }
+
+ /* insert the register value in the correct place in the rbnode block */
+diff --git a/drivers/block/xen-blkback/blkback.c b/drivers/block/xen-blkback/blkback.c
+index 63fc7f06a014..0c858a60dc40 100644
+--- a/drivers/block/xen-blkback/blkback.c
++++ b/drivers/block/xen-blkback/blkback.c
+@@ -350,7 +350,7 @@ static void purge_persistent_gnt(struct xen_blkif *blkif)
+ return;
+ }
+
+- if (work_pending(&blkif->persistent_purge_work)) {
++ if (work_busy(&blkif->persistent_purge_work)) {
+ pr_alert_ratelimited(DRV_PFX "Scheduled work from previous purge is still pending, cannot purge list\n");
+ return;
+ }
+diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c
+index 5ac312f6e0be..218c4858f494 100644
+--- a/drivers/block/xen-blkfront.c
++++ b/drivers/block/xen-blkfront.c
+@@ -1099,8 +1099,10 @@ static void blkif_completion(struct blk_shadow *s, struct blkfront_info *info,
+ * Add the used indirect page back to the list of
+ * available pages for indirect grefs.
+ */
+- indirect_page = pfn_to_page(s->indirect_grants[i]->pfn);
+- list_add(&indirect_page->lru, &info->indirect_pages);
++ if (!info->feature_persistent) {
++ indirect_page = pfn_to_page(s->indirect_grants[i]->pfn);
++ list_add(&indirect_page->lru, &info->indirect_pages);
++ }
+ s->indirect_grants[i]->gref = GRANT_INVALID_REF;
+ list_add_tail(&s->indirect_grants[i]->node, &info->grants);
+ }
+diff --git a/drivers/crypto/caam/caamhash.c b/drivers/crypto/caam/caamhash.c
+index 08b0da23c4ab..5408450204b0 100644
+--- a/drivers/crypto/caam/caamhash.c
++++ b/drivers/crypto/caam/caamhash.c
+@@ -909,13 +909,14 @@ static int ahash_final_ctx(struct ahash_request *req)
+ state->buflen_1;
+ u32 *sh_desc = ctx->sh_desc_fin, *desc;
+ dma_addr_t ptr = ctx->sh_desc_fin_dma;
+- int sec4_sg_bytes;
++ int sec4_sg_bytes, sec4_sg_src_index;
+ int digestsize = crypto_ahash_digestsize(ahash);
+ struct ahash_edesc *edesc;
+ int ret = 0;
+ int sh_len;
+
+- sec4_sg_bytes = (1 + (buflen ? 1 : 0)) * sizeof(struct sec4_sg_entry);
++ sec4_sg_src_index = 1 + (buflen ? 1 : 0);
++ sec4_sg_bytes = sec4_sg_src_index * sizeof(struct sec4_sg_entry);
+
+ /* allocate space for base edesc and hw desc commands, link tables */
+ edesc = kmalloc(sizeof(struct ahash_edesc) + DESC_JOB_IO_LEN +
+@@ -942,7 +943,7 @@ static int ahash_final_ctx(struct ahash_request *req)
+ state->buf_dma = try_buf_map_to_sec4_sg(jrdev, edesc->sec4_sg + 1,
+ buf, state->buf_dma, buflen,
+ last_buflen);
+- (edesc->sec4_sg + sec4_sg_bytes - 1)->len |= SEC4_SG_LEN_FIN;
++ (edesc->sec4_sg + sec4_sg_src_index - 1)->len |= SEC4_SG_LEN_FIN;
+
+ edesc->sec4_sg_dma = dma_map_single(jrdev, edesc->sec4_sg,
+ sec4_sg_bytes, DMA_TO_DEVICE);
+diff --git a/drivers/edac/ppc4xx_edac.c b/drivers/edac/ppc4xx_edac.c
+index 0f04d5ead521..4c1991d4ce8b 100644
+--- a/drivers/edac/ppc4xx_edac.c
++++ b/drivers/edac/ppc4xx_edac.c
+@@ -921,7 +921,7 @@ static int ppc4xx_edac_init_csrows(struct mem_ctl_info *mci, u32 mcopt1)
+ */
+
+ for (row = 0; row < mci->nr_csrows; row++) {
+- struct csrow_info *csi = &mci->csrows[row];
++ struct csrow_info *csi = mci->csrows[row];
+
+ /*
+ * Get the configuration settings for this
+diff --git a/drivers/gpu/drm/radeon/radeon_irq_kms.c b/drivers/gpu/drm/radeon/radeon_irq_kms.c
+index bbcd754dc7d0..ccedb17580f7 100644
+--- a/drivers/gpu/drm/radeon/radeon_irq_kms.c
++++ b/drivers/gpu/drm/radeon/radeon_irq_kms.c
+@@ -79,6 +79,11 @@ static void radeon_hotplug_work_func(struct work_struct *work)
+ struct drm_mode_config *mode_config = &dev->mode_config;
+ struct drm_connector *connector;
+
++ /* we can race here at startup, some boards seem to trigger
++ * hotplug irqs when they shouldn't. */
++ if (!rdev->mode_info.mode_config_initialized)
++ return;
++
+ mutex_lock(&mode_config->mutex);
+ if (mode_config->num_connector) {
+ list_for_each_entry(connector, &mode_config->connector_list, head)
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
+index 50b52802f470..8ad66bbd4f28 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
+@@ -2489,7 +2489,7 @@ int vmw_execbuf_process(struct drm_file *file_priv,
+
+ ret = ttm_eu_reserve_buffers(&ticket, &sw_context->validate_nodes, true);
+ if (unlikely(ret != 0))
+- goto out_err;
++ goto out_err_nores;
+
+ ret = vmw_validate_buffers(dev_priv, sw_context);
+ if (unlikely(ret != 0))
+@@ -2533,6 +2533,7 @@ int vmw_execbuf_process(struct drm_file *file_priv,
+ vmw_resource_relocations_free(&sw_context->res_relocations);
+
+ vmw_fifo_commit(dev_priv, command_size);
++ mutex_unlock(&dev_priv->binding_mutex);
+
+ vmw_query_bo_switch_commit(dev_priv, sw_context);
+ ret = vmw_execbuf_fence_commands(file_priv, dev_priv,
+@@ -2548,7 +2549,6 @@ int vmw_execbuf_process(struct drm_file *file_priv,
+ DRM_ERROR("Fence submission error. Syncing.\n");
+
+ vmw_resource_list_unreserve(&sw_context->resource_list, false);
+- mutex_unlock(&dev_priv->binding_mutex);
+
+ ttm_eu_fence_buffer_objects(&ticket, &sw_context->validate_nodes,
+ (void *) fence);
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index 3603d0cb25d9..ef984eba8396 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -222,6 +222,7 @@
+ #define USB_DEVICE_ID_CHICONY_TACTICAL_PAD 0x0418
+ #define USB_DEVICE_ID_CHICONY_MULTI_TOUCH 0xb19d
+ #define USB_DEVICE_ID_CHICONY_WIRELESS 0x0618
++#define USB_DEVICE_ID_CHICONY_PIXART_USB_OPTICAL_MOUSE 0x1053
+ #define USB_DEVICE_ID_CHICONY_WIRELESS2 0x1123
+ #define USB_DEVICE_ID_CHICONY_AK1D 0x1125
+
+diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c
+index 509dee2e9b72..a4d1fe64c925 100644
+--- a/drivers/hid/usbhid/hid-quirks.c
++++ b/drivers/hid/usbhid/hid-quirks.c
+@@ -69,6 +69,7 @@ static const struct hid_blacklist {
+ { USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_PRO_PEDALS, HID_QUIRK_NOGET },
+ { USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_3AXIS_5BUTTON_STICK, HID_QUIRK_NOGET },
+ { USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_AXIS_295, HID_QUIRK_NOGET },
++ { USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_PIXART_USB_OPTICAL_MOUSE, HID_QUIRK_ALWAYS_POLL },
+ { USB_VENDOR_ID_DMI, USB_DEVICE_ID_DMI_ENC, HID_QUIRK_NOGET },
+ { USB_VENDOR_ID_ELAN, USB_DEVICE_ID_ELAN_TOUCHSCREEN, HID_QUIRK_ALWAYS_POLL },
+ { USB_VENDOR_ID_ELAN, USB_DEVICE_ID_ELAN_TOUCHSCREEN_009B, HID_QUIRK_ALWAYS_POLL },
+diff --git a/drivers/isdn/gigaset/ser-gigaset.c b/drivers/isdn/gigaset/ser-gigaset.c
+index 8c91fd5eb6fd..3ac9c4194814 100644
+--- a/drivers/isdn/gigaset/ser-gigaset.c
++++ b/drivers/isdn/gigaset/ser-gigaset.c
+@@ -524,9 +524,18 @@ gigaset_tty_open(struct tty_struct *tty)
+ cs->hw.ser->tty = tty;
+ atomic_set(&cs->hw.ser->refcnt, 1);
+ init_completion(&cs->hw.ser->dead_cmp);
+-
+ tty->disc_data = cs;
+
++ /* Set the amount of data we're willing to receive per call
++ * from the hardware driver to half of the input buffer size
++ * to leave some reserve.
++ * Note: We don't do flow control towards the hardware driver.
++ * If more data is received than will fit into the input buffer,
++ * it will be dropped and an error will be logged. This should
++ * never happen as the device is slow and the buffer size ample.
++ */
++ tty->receive_room = RBUFSIZE/2;
++
+ /* OK.. Initialization of the datastructures and the HW is done.. Now
+ * startup system and notify the LL that we are ready to run
+ */
+diff --git a/drivers/md/dm-thin-metadata.c b/drivers/md/dm-thin-metadata.c
+index e9d33ad59df5..3412b86e79fd 100644
+--- a/drivers/md/dm-thin-metadata.c
++++ b/drivers/md/dm-thin-metadata.c
+@@ -1295,8 +1295,8 @@ static int __release_metadata_snap(struct dm_pool_metadata *pmd)
+ return r;
+
+ disk_super = dm_block_data(copy);
+- dm_sm_dec_block(pmd->metadata_sm, le64_to_cpu(disk_super->data_mapping_root));
+- dm_sm_dec_block(pmd->metadata_sm, le64_to_cpu(disk_super->device_details_root));
++ dm_btree_del(&pmd->info, le64_to_cpu(disk_super->data_mapping_root));
++ dm_btree_del(&pmd->details_info, le64_to_cpu(disk_super->device_details_root));
+ dm_sm_dec_block(pmd->metadata_sm, held_root);
+
+ return dm_tm_unlock(pmd->tm, copy);
+diff --git a/drivers/mfd/arizona-core.c b/drivers/mfd/arizona-core.c
+index bce7c0784b6b..633c63e7c32f 100644
+--- a/drivers/mfd/arizona-core.c
++++ b/drivers/mfd/arizona-core.c
+@@ -892,10 +892,6 @@ int arizona_dev_init(struct arizona *arizona)
+ arizona->pdata.gpio_defaults[i]);
+ }
+
+- pm_runtime_set_autosuspend_delay(arizona->dev, 100);
+- pm_runtime_use_autosuspend(arizona->dev);
+- pm_runtime_enable(arizona->dev);
+-
+ /* Chip default */
+ if (!arizona->pdata.clk32k_src)
+ arizona->pdata.clk32k_src = ARIZONA_32KZ_MCLK2;
+@@ -992,11 +988,17 @@ int arizona_dev_init(struct arizona *arizona)
+ arizona->pdata.spk_fmt[i]);
+ }
+
++ pm_runtime_set_active(arizona->dev);
++ pm_runtime_enable(arizona->dev);
++
+ /* Set up for interrupts */
+ ret = arizona_irq_init(arizona);
+ if (ret != 0)
+ goto err_reset;
+
++ pm_runtime_set_autosuspend_delay(arizona->dev, 100);
++ pm_runtime_use_autosuspend(arizona->dev);
++
+ arizona_request_irq(arizona, ARIZONA_IRQ_CLKGEN_ERR, "CLKGEN error",
+ arizona_clkgen_err, arizona);
+ arizona_request_irq(arizona, ARIZONA_IRQ_OVERCLOCKED, "Overclocked",
+@@ -1024,10 +1026,6 @@ int arizona_dev_init(struct arizona *arizona)
+ goto err_irq;
+ }
+
+-#ifdef CONFIG_PM_RUNTIME
+- regulator_disable(arizona->dcvdd);
+-#endif
+-
+ return 0;
+
+ err_irq:
+diff --git a/drivers/mfd/lpc_ich.c b/drivers/mfd/lpc_ich.c
+index f35d4280b2f7..c58fc62545a3 100644
+--- a/drivers/mfd/lpc_ich.c
++++ b/drivers/mfd/lpc_ich.c
+@@ -934,8 +934,8 @@ gpe0_done:
+ lpc_ich_enable_gpio_space(dev);
+
+ lpc_ich_finalize_cell(dev, &lpc_ich_cells[LPC_GPIO]);
+- ret = mfd_add_devices(&dev->dev, -1, &lpc_ich_cells[LPC_GPIO],
+- 1, NULL, 0, NULL);
++ ret = mfd_add_devices(&dev->dev, PLATFORM_DEVID_AUTO,
++ &lpc_ich_cells[LPC_GPIO], 1, NULL, 0, NULL);
+
+ gpio_done:
+ if (acpi_conflict)
+@@ -1008,8 +1008,8 @@ static int lpc_ich_init_wdt(struct pci_dev *dev)
+ }
+
+ lpc_ich_finalize_cell(dev, &lpc_ich_cells[LPC_WDT]);
+- ret = mfd_add_devices(&dev->dev, -1, &lpc_ich_cells[LPC_WDT],
+- 1, NULL, 0, NULL);
++ ret = mfd_add_devices(&dev->dev, PLATFORM_DEVID_AUTO,
++ &lpc_ich_cells[LPC_WDT], 1, NULL, 0, NULL);
+
+ wdt_done:
+ return ret;
+diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
+index 1cc06c0e3e92..081dd70813c8 100644
+--- a/drivers/net/bonding/bond_main.c
++++ b/drivers/net/bonding/bond_main.c
+@@ -622,6 +622,23 @@ static void bond_set_dev_addr(struct net_device *bond_dev,
+ call_netdevice_notifiers(NETDEV_CHANGEADDR, bond_dev);
+ }
+
++static struct slave *bond_get_old_active(struct bonding *bond,
++ struct slave *new_active)
++{
++ struct slave *slave;
++ struct list_head *iter;
++
++ bond_for_each_slave(bond, slave, iter) {
++ if (slave == new_active)
++ continue;
++
++ if (ether_addr_equal(bond->dev->dev_addr, slave->dev->dev_addr))
++ return slave;
++ }
++
++ return NULL;
++}
++
+ /* bond_do_fail_over_mac
+ *
+ * Perform special MAC address swapping for fail_over_mac settings
+@@ -649,6 +666,9 @@ static void bond_do_fail_over_mac(struct bonding *bond,
+ if (!new_active)
+ return;
+
++ if (!old_active)
++ old_active = bond_get_old_active(bond, new_active);
++
+ if (old_active) {
+ ether_addr_copy(tmp_mac, new_active->dev->dev_addr);
+ ether_addr_copy(saddr.sa_data,
+@@ -1805,6 +1825,7 @@ static int bond_release_and_destroy(struct net_device *bond_dev,
+ bond_dev->priv_flags |= IFF_DISABLE_NETPOLL;
+ netdev_info(bond_dev, "Destroying bond %s\n",
+ bond_dev->name);
++ bond_remove_proc_entry(bond);
+ unregister_netdevice(bond_dev);
+ }
+ return ret;
+diff --git a/drivers/net/ethernet/mellanox/mlx4/eq.c b/drivers/net/ethernet/mellanox/mlx4/eq.c
+index 49290a405903..af67e7d410eb 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/eq.c
++++ b/drivers/net/ethernet/mellanox/mlx4/eq.c
+@@ -568,7 +568,7 @@ static int mlx4_eq_int(struct mlx4_dev *dev, struct mlx4_eq *eq)
+ continue;
+ mlx4_dbg(dev, "%s: Sending MLX4_PORT_CHANGE_SUBTYPE_DOWN to slave: %d, port:%d\n",
+ __func__, i, port);
+- s_info = &priv->mfunc.master.vf_oper[slave].vport[port].state;
++ s_info = &priv->mfunc.master.vf_oper[i].vport[port].state;
+ if (IFLA_VF_LINK_STATE_AUTO == s_info->link_state) {
+ eqe->event.port_change.port =
+ cpu_to_be32(
+@@ -601,7 +601,7 @@ static int mlx4_eq_int(struct mlx4_dev *dev, struct mlx4_eq *eq)
+ continue;
+ if (i == mlx4_master_func_num(dev))
+ continue;
+- s_info = &priv->mfunc.master.vf_oper[slave].vport[port].state;
++ s_info = &priv->mfunc.master.vf_oper[i].vport[port].state;
+ if (IFLA_VF_LINK_STATE_AUTO == s_info->link_state) {
+ eqe->event.port_change.port =
+ cpu_to_be32(
+diff --git a/drivers/net/wireless/rtlwifi/rtl8723be/sw.c b/drivers/net/wireless/rtlwifi/rtl8723be/sw.c
+index 223eb42992bd..775e7bc292f2 100644
+--- a/drivers/net/wireless/rtlwifi/rtl8723be/sw.c
++++ b/drivers/net/wireless/rtlwifi/rtl8723be/sw.c
+@@ -385,6 +385,7 @@ module_param_named(debug, rtl8723be_mod_params.debug, int, 0444);
+ module_param_named(ips, rtl8723be_mod_params.inactiveps, bool, 0444);
+ module_param_named(swlps, rtl8723be_mod_params.swctrl_lps, bool, 0444);
+ module_param_named(fwlps, rtl8723be_mod_params.fwctrl_lps, bool, 0444);
++module_param_named(msi, rtl8723be_mod_params.msi_support, bool, 0444);
+ module_param_named(disable_watchdog, rtl8723be_mod_params.disable_watchdog,
+ bool, 0444);
+ MODULE_PARM_DESC(swenc, "using hardware crypto (default 0 [hardware])\n");
+diff --git a/drivers/scsi/libfc/fc_exch.c b/drivers/scsi/libfc/fc_exch.c
+index 1b3a09473452..30f9ef0c0d4f 100644
+--- a/drivers/scsi/libfc/fc_exch.c
++++ b/drivers/scsi/libfc/fc_exch.c
+@@ -733,8 +733,6 @@ static bool fc_invoke_resp(struct fc_exch *ep, struct fc_seq *sp,
+ if (resp) {
+ resp(sp, fp, arg);
+ res = true;
+- } else if (!IS_ERR(fp)) {
+- fc_frame_free(fp);
+ }
+
+ spin_lock_bh(&ep->ex_lock);
+@@ -1596,7 +1594,8 @@ static void fc_exch_recv_seq_resp(struct fc_exch_mgr *mp, struct fc_frame *fp)
+ * If new exch resp handler is valid then call that
+ * first.
+ */
+- fc_invoke_resp(ep, sp, fp);
++ if (!fc_invoke_resp(ep, sp, fp))
++ fc_frame_free(fp);
+
+ fc_exch_release(ep);
+ return;
+@@ -1695,7 +1694,8 @@ static void fc_exch_abts_resp(struct fc_exch *ep, struct fc_frame *fp)
+ fc_exch_hold(ep);
+ if (!rc)
+ fc_exch_delete(ep);
+- fc_invoke_resp(ep, sp, fp);
++ if (!fc_invoke_resp(ep, sp, fp))
++ fc_frame_free(fp);
+ if (has_rec)
+ fc_exch_timer_set(ep, ep->r_a_tov);
+ fc_exch_release(ep);
+diff --git a/drivers/scsi/libfc/fc_fcp.c b/drivers/scsi/libfc/fc_fcp.c
+index 1d7e76e8b447..ae6fc1a94568 100644
+--- a/drivers/scsi/libfc/fc_fcp.c
++++ b/drivers/scsi/libfc/fc_fcp.c
+@@ -1039,11 +1039,26 @@ restart:
+ fc_fcp_pkt_hold(fsp);
+ spin_unlock_irqrestore(&si->scsi_queue_lock, flags);
+
+- if (!fc_fcp_lock_pkt(fsp)) {
++ spin_lock_bh(&fsp->scsi_pkt_lock);
++ if (!(fsp->state & FC_SRB_COMPL)) {
++ fsp->state |= FC_SRB_COMPL;
++ /*
++ * TODO: dropping scsi_pkt_lock and then reacquiring
++ * again around fc_fcp_cleanup_cmd() is required,
++ * since fc_fcp_cleanup_cmd() calls into
++ * fc_seq_set_resp() and that func preempts cpu using
++ * schedule. May be schedule and related code should be
++ * removed instead of unlocking here to avoid scheduling
++ * while atomic bug.
++ */
++ spin_unlock_bh(&fsp->scsi_pkt_lock);
++
+ fc_fcp_cleanup_cmd(fsp, error);
++
++ spin_lock_bh(&fsp->scsi_pkt_lock);
+ fc_io_compl(fsp);
+- fc_fcp_unlock_pkt(fsp);
+ }
++ spin_unlock_bh(&fsp->scsi_pkt_lock);
+
+ fc_fcp_pkt_release(fsp);
+ spin_lock_irqsave(&si->scsi_queue_lock, flags);
+diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c
+index 0d8bc6c66650..7854584ebd59 100644
+--- a/drivers/scsi/libiscsi.c
++++ b/drivers/scsi/libiscsi.c
+@@ -2960,10 +2960,10 @@ void iscsi_conn_teardown(struct iscsi_cls_conn *cls_conn)
+ {
+ struct iscsi_conn *conn = cls_conn->dd_data;
+ struct iscsi_session *session = conn->session;
+- unsigned long flags;
+
+ del_timer_sync(&conn->transport_timer);
+
++ mutex_lock(&session->eh_mutex);
+ spin_lock_bh(&session->frwd_lock);
+ conn->c_stage = ISCSI_CONN_CLEANUP_WAIT;
+ if (session->leadconn == conn) {
+@@ -2975,28 +2975,6 @@ void iscsi_conn_teardown(struct iscsi_cls_conn *cls_conn)
+ }
+ spin_unlock_bh(&session->frwd_lock);
+
+- /*
+- * Block until all in-progress commands for this connection
+- * time out or fail.
+- */
+- for (;;) {
+- spin_lock_irqsave(session->host->host_lock, flags);
+- if (!atomic_read(&session->host->host_busy)) { /* OK for ERL == 0 */
+- spin_unlock_irqrestore(session->host->host_lock, flags);
+- break;
+- }
+- spin_unlock_irqrestore(session->host->host_lock, flags);
+- msleep_interruptible(500);
+- iscsi_conn_printk(KERN_INFO, conn, "iscsi conn_destroy(): "
+- "host_busy %d host_failed %d\n",
+- atomic_read(&session->host->host_busy),
+- session->host->host_failed);
+- /*
+- * force eh_abort() to unblock
+- */
+- wake_up(&conn->ehwait);
+- }
+-
+ /* flush queued up work because we free the connection below */
+ iscsi_suspend_tx(conn);
+
+@@ -3013,6 +2991,7 @@ void iscsi_conn_teardown(struct iscsi_cls_conn *cls_conn)
+ if (session->leadconn == conn)
+ session->leadconn = NULL;
+ spin_unlock_bh(&session->frwd_lock);
++ mutex_unlock(&session->eh_mutex);
+
+ iscsi_destroy_conn(cls_conn);
+ }
+diff --git a/drivers/scsi/lpfc/lpfc_scsi.c b/drivers/scsi/lpfc/lpfc_scsi.c
+index b99399fe2548..15acc808658f 100644
+--- a/drivers/scsi/lpfc/lpfc_scsi.c
++++ b/drivers/scsi/lpfc/lpfc_scsi.c
+@@ -3380,7 +3380,7 @@ lpfc_scsi_prep_dma_buf_s4(struct lpfc_hba *phba, struct lpfc_scsi_buf *lpfc_cmd)
+ */
+
+ nseg = scsi_dma_map(scsi_cmnd);
+- if (unlikely(!nseg))
++ if (unlikely(nseg <= 0))
+ return 1;
+ sgl += 1;
+ /* clear the last flag in the fcp_rsp map entry */
+diff --git a/drivers/scsi/scsi_pm.c b/drivers/scsi/scsi_pm.c
+index 7454498c4091..a2dcf6a54ec6 100644
+--- a/drivers/scsi/scsi_pm.c
++++ b/drivers/scsi/scsi_pm.c
+@@ -219,15 +219,15 @@ static int sdev_runtime_suspend(struct device *dev)
+ {
+ const struct dev_pm_ops *pm = dev->driver ? dev->driver->pm : NULL;
+ struct scsi_device *sdev = to_scsi_device(dev);
+- int err;
++ int err = 0;
+
+- err = blk_pre_runtime_suspend(sdev->request_queue);
+- if (err)
+- return err;
+- if (pm && pm->runtime_suspend)
++ if (pm && pm->runtime_suspend) {
++ err = blk_pre_runtime_suspend(sdev->request_queue);
++ if (err)
++ return err;
+ err = pm->runtime_suspend(dev);
+- blk_post_runtime_suspend(sdev->request_queue, err);
+-
++ blk_post_runtime_suspend(sdev->request_queue, err);
++ }
+ return err;
+ }
+
+@@ -250,11 +250,11 @@ static int sdev_runtime_resume(struct device *dev)
+ const struct dev_pm_ops *pm = dev->driver ? dev->driver->pm : NULL;
+ int err = 0;
+
+- blk_pre_runtime_resume(sdev->request_queue);
+- if (pm && pm->runtime_resume)
++ if (pm && pm->runtime_resume) {
++ blk_pre_runtime_resume(sdev->request_queue);
+ err = pm->runtime_resume(dev);
+- blk_post_runtime_resume(sdev->request_queue, err);
+-
++ blk_post_runtime_resume(sdev->request_queue, err);
++ }
+ return err;
+ }
+
+diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
+index ce382e858452..6d931d598d80 100644
+--- a/drivers/scsi/sd.c
++++ b/drivers/scsi/sd.c
+@@ -2812,9 +2812,9 @@ static int sd_revalidate_disk(struct gendisk *disk)
+ max_xfer = sdkp->max_xfer_blocks;
+ max_xfer <<= ilog2(sdp->sector_size) - 9;
+
+- max_xfer = min_not_zero(queue_max_hw_sectors(sdkp->disk->queue),
+- max_xfer);
+- blk_queue_max_hw_sectors(sdkp->disk->queue, max_xfer);
++ sdkp->disk->queue->limits.max_sectors =
++ min_not_zero(queue_max_hw_sectors(sdkp->disk->queue), max_xfer);
++
+ set_capacity(disk, sdkp->capacity);
+ sd_config_write_same(sdkp);
+ kfree(buffer);
+diff --git a/include/drm/drm_pciids.h b/include/drm/drm_pciids.h
+index 45c39a37f924..8bc073d297db 100644
+--- a/include/drm/drm_pciids.h
++++ b/include/drm/drm_pciids.h
+@@ -172,6 +172,7 @@
+ {0x1002, 0x6610, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_OLAND|RADEON_NEW_MEMMAP}, \
+ {0x1002, 0x6611, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_OLAND|RADEON_NEW_MEMMAP}, \
+ {0x1002, 0x6613, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_OLAND|RADEON_NEW_MEMMAP}, \
++ {0x1002, 0x6617, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_OLAND|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
+ {0x1002, 0x6620, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_OLAND|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
+ {0x1002, 0x6621, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_OLAND|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
+ {0x1002, 0x6623, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_OLAND|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
+diff --git a/include/linux/compiler.h b/include/linux/compiler.h
+index 000c5f90f08c..2bd394ed35f6 100644
+--- a/include/linux/compiler.h
++++ b/include/linux/compiler.h
+@@ -454,6 +454,21 @@ static __always_inline void __write_once_size(volatile void *p, void *res, int s
+ */
+ #define ACCESS_ONCE(x) (*(volatile typeof(x) *)&(x))
+
++/**
++ * lockless_dereference() - safely load a pointer for later dereference
++ * @p: The pointer to load
++ *
++ * Similar to rcu_dereference(), but for situations where the pointed-to
++ * object's lifetime is managed by something other than RCU. That
++ * "something other" might be reference counting or simple immortality.
++ */
++#define lockless_dereference(p) \
++({ \
++ typeof(p) _________p1 = ACCESS_ONCE(p); \
++ smp_read_barrier_depends(); /* Dependency order vs. p above. */ \
++ (_________p1); \
++})
++
+ /* Ignore/forbid kprobes attach on very low level functions marked by this attribute: */
+ #ifdef CONFIG_KPROBES
+ # define __kprobes __attribute__((__section__(".kprobes.text")))
+diff --git a/include/linux/rcupdate.h b/include/linux/rcupdate.h
+index 53ff1a752d7e..a4a819ffb2d1 100644
+--- a/include/linux/rcupdate.h
++++ b/include/linux/rcupdate.h
+@@ -617,21 +617,6 @@ static inline void rcu_preempt_sleep_check(void)
+ #define RCU_INITIALIZER(v) (typeof(*(v)) __force __rcu *)(v)
+
+ /**
+- * lockless_dereference() - safely load a pointer for later dereference
+- * @p: The pointer to load
+- *
+- * Similar to rcu_dereference(), but for situations where the pointed-to
+- * object's lifetime is managed by something other than RCU. That
+- * "something other" might be reference counting or simple immortality.
+- */
+-#define lockless_dereference(p) \
+-({ \
+- typeof(p) _________p1 = ACCESS_ONCE(p); \
+- smp_read_barrier_depends(); /* Dependency order vs. p above. */ \
+- (_________p1); \
+-})
+-
+-/**
+ * rcu_assign_pointer() - assign to RCU-protected pointer
+ * @p: pointer to assign to
+ * @v: value to assign (publish)
+diff --git a/include/net/ip.h b/include/net/ip.h
+index c0c26c3deeb5..d00ebdf14ca4 100644
+--- a/include/net/ip.h
++++ b/include/net/ip.h
+@@ -160,6 +160,7 @@ static inline __u8 get_rtconn_flags(struct ipcm_cookie* ipc, struct sock* sk)
+ }
+
+ /* datagram.c */
++int __ip4_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len);
+ int ip4_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len);
+
+ void ip4_datagram_release_cb(struct sock *sk);
+diff --git a/ipc/sem.c b/ipc/sem.c
+index 53c3310f41c6..85ad28aaf548 100644
+--- a/ipc/sem.c
++++ b/ipc/sem.c
+@@ -253,6 +253,16 @@ static void sem_rcu_free(struct rcu_head *head)
+ }
+
+ /*
++ * spin_unlock_wait() and !spin_is_locked() are not memory barriers, they
++ * are only control barriers.
++ * The code must pair with spin_unlock(&sem->lock) or
++ * spin_unlock(&sem_perm.lock), thus just the control barrier is insufficient.
++ *
++ * smp_rmb() is sufficient, as writes cannot pass the control barrier.
++ */
++#define ipc_smp_acquire__after_spin_is_unlocked() smp_rmb()
++
++/*
+ * Wait until all currently ongoing simple ops have completed.
+ * Caller must own sem_perm.lock.
+ * New simple ops cannot start, because simple ops first check
+@@ -275,6 +285,7 @@ static void sem_wait_array(struct sem_array *sma)
+ sem = sma->sem_base + i;
+ spin_unlock_wait(&sem->lock);
+ }
++ ipc_smp_acquire__after_spin_is_unlocked();
+ }
+
+ /*
+@@ -326,8 +337,13 @@ static inline int sem_lock(struct sem_array *sma, struct sembuf *sops,
+
+ /* Then check that the global lock is free */
+ if (!spin_is_locked(&sma->sem_perm.lock)) {
+- /* spin_is_locked() is not a memory barrier */
+- smp_mb();
++ /*
++ * We need a memory barrier with acquire semantics,
++ * otherwise we can race with another thread that does:
++ * complex_count++;
++ * spin_unlock(sem_perm.lock);
++ */
++ ipc_smp_acquire__after_spin_is_unlocked();
+
+ /* Now repeat the test of complex_count:
+ * It can't change anymore until we drop sem->lock.
+@@ -2067,17 +2083,28 @@ void exit_sem(struct task_struct *tsk)
+ rcu_read_lock();
+ un = list_entry_rcu(ulp->list_proc.next,
+ struct sem_undo, list_proc);
+- if (&un->list_proc == &ulp->list_proc)
+- semid = -1;
+- else
+- semid = un->semid;
++ if (&un->list_proc == &ulp->list_proc) {
++ /*
++ * We must wait for freeary() before freeing this ulp,
++ * in case we raced with last sem_undo. There is a small
++ * possibility where we exit while freeary() didn't
++ * finish unlocking sem_undo_list.
++ */
++ spin_unlock_wait(&ulp->lock);
++ rcu_read_unlock();
++ break;
++ }
++ spin_lock(&ulp->lock);
++ semid = un->semid;
++ spin_unlock(&ulp->lock);
+
++ /* exit_sem raced with IPC_RMID, nothing to do */
+ if (semid == -1) {
+ rcu_read_unlock();
+- break;
++ continue;
+ }
+
+- sma = sem_obtain_object_check(tsk->nsproxy->ipc_ns, un->semid);
++ sma = sem_obtain_object_check(tsk->nsproxy->ipc_ns, semid);
+ /* exit_sem raced with IPC_RMID, nothing to do */
+ if (IS_ERR(sma)) {
+ rcu_read_unlock();
+diff --git a/kernel/cpuset.c b/kernel/cpuset.c
+index 672310e1597e..71b52dd957de 100644
+--- a/kernel/cpuset.c
++++ b/kernel/cpuset.c
+@@ -1204,7 +1204,7 @@ static int update_nodemask(struct cpuset *cs, struct cpuset *trialcs,
+ mutex_unlock(&callback_mutex);
+
+ /* use trialcs->mems_allowed as a temp variable */
+- update_nodemasks_hier(cs, &cs->mems_allowed);
++ update_nodemasks_hier(cs, &trialcs->mems_allowed);
+ done:
+ return retval;
+ }
+diff --git a/kernel/events/core.c b/kernel/events/core.c
+index cb86038cad47..ff181a5a5562 100644
+--- a/kernel/events/core.c
++++ b/kernel/events/core.c
+@@ -3729,28 +3729,21 @@ static void perf_event_for_each(struct perf_event *event,
+ mutex_unlock(&ctx->mutex);
+ }
+
+-static int perf_event_period(struct perf_event *event, u64 __user *arg)
+-{
+- struct perf_event_context *ctx = event->ctx;
+- int ret = 0, active;
++struct period_event {
++ struct perf_event *event;
+ u64 value;
++};
+
+- if (!is_sampling_event(event))
+- return -EINVAL;
+-
+- if (copy_from_user(&value, arg, sizeof(value)))
+- return -EFAULT;
+-
+- if (!value)
+- return -EINVAL;
++static int __perf_event_period(void *info)
++{
++ struct period_event *pe = info;
++ struct perf_event *event = pe->event;
++ struct perf_event_context *ctx = event->ctx;
++ u64 value = pe->value;
++ bool active;
+
+- raw_spin_lock_irq(&ctx->lock);
++ raw_spin_lock(&ctx->lock);
+ if (event->attr.freq) {
+- if (value > sysctl_perf_event_sample_rate) {
+- ret = -EINVAL;
+- goto unlock;
+- }
+-
+ event->attr.sample_freq = value;
+ } else {
+ event->attr.sample_period = value;
+@@ -3769,11 +3762,53 @@ static int perf_event_period(struct perf_event *event, u64 __user *arg)
+ event->pmu->start(event, PERF_EF_RELOAD);
+ perf_pmu_enable(ctx->pmu);
+ }
++ raw_spin_unlock(&ctx->lock);
+
+-unlock:
++ return 0;
++}
++
++static int perf_event_period(struct perf_event *event, u64 __user *arg)
++{
++ struct period_event pe = { .event = event, };
++ struct perf_event_context *ctx = event->ctx;
++ struct task_struct *task;
++ u64 value;
++
++ if (!is_sampling_event(event))
++ return -EINVAL;
++
++ if (copy_from_user(&value, arg, sizeof(value)))
++ return -EFAULT;
++
++ if (!value)
++ return -EINVAL;
++
++ if (event->attr.freq && value > sysctl_perf_event_sample_rate)
++ return -EINVAL;
++
++ task = ctx->task;
++ pe.value = value;
++
++ if (!task) {
++ cpu_function_call(event->cpu, __perf_event_period, &pe);
++ return 0;
++ }
++
++retry:
++ if (!task_function_call(task, __perf_event_period, &pe))
++ return 0;
++
++ raw_spin_lock_irq(&ctx->lock);
++ if (ctx->is_active) {
++ raw_spin_unlock_irq(&ctx->lock);
++ task = ctx->task;
++ goto retry;
++ }
++
++ __perf_event_period(&pe);
+ raw_spin_unlock_irq(&ctx->lock);
+
+- return ret;
++ return 0;
+ }
+
+ static const struct file_operations perf_fops;
+@@ -4398,12 +4433,20 @@ static const struct file_operations perf_fops = {
+ * to user-space before waking everybody up.
+ */
+
++static inline struct fasync_struct **perf_event_fasync(struct perf_event *event)
++{
++ /* only the parent has fasync state */
++ if (event->parent)
++ event = event->parent;
++ return &event->fasync;
++}
++
+ void perf_event_wakeup(struct perf_event *event)
+ {
+ ring_buffer_wakeup(event);
+
+ if (event->pending_kill) {
+- kill_fasync(&event->fasync, SIGIO, event->pending_kill);
++ kill_fasync(perf_event_fasync(event), SIGIO, event->pending_kill);
+ event->pending_kill = 0;
+ }
+ }
+@@ -5638,7 +5681,7 @@ static int __perf_event_overflow(struct perf_event *event,
+ else
+ perf_event_output(event, data, regs);
+
+- if (event->fasync && event->pending_kill) {
++ if (*perf_event_fasync(event) && event->pending_kill) {
+ event->pending_wakeup = 1;
+ irq_work_queue(&event->pending);
+ }
+diff --git a/mm/hugetlb.c b/mm/hugetlb.c
+index da8fa4e4237c..a1d4dfa62023 100644
+--- a/mm/hugetlb.c
++++ b/mm/hugetlb.c
+@@ -855,6 +855,31 @@ struct hstate *size_to_hstate(unsigned long size)
+ return NULL;
+ }
+
++/*
++ * Test to determine whether the hugepage is "active/in-use" (i.e. being linked
++ * to hstate->hugepage_activelist.)
++ *
++ * This function can be called for tail pages, but never returns true for them.
++ */
++bool page_huge_active(struct page *page)
++{
++ VM_BUG_ON_PAGE(!PageHuge(page), page);
++ return PageHead(page) && PagePrivate(&page[1]);
++}
++
++/* never called for tail page */
++static void set_page_huge_active(struct page *page)
++{
++ VM_BUG_ON_PAGE(!PageHeadHuge(page), page);
++ SetPagePrivate(&page[1]);
++}
++
++static void clear_page_huge_active(struct page *page)
++{
++ VM_BUG_ON_PAGE(!PageHeadHuge(page), page);
++ ClearPagePrivate(&page[1]);
++}
++
+ void free_huge_page(struct page *page)
+ {
+ /*
+@@ -875,6 +900,7 @@ void free_huge_page(struct page *page)
+ ClearPagePrivate(page);
+
+ spin_lock(&hugetlb_lock);
++ clear_page_huge_active(page);
+ hugetlb_cgroup_uncharge_page(hstate_index(h),
+ pages_per_huge_page(h), page);
+ if (restore_reserve)
+@@ -2884,6 +2910,7 @@ retry_avoidcopy:
+ copy_user_huge_page(new_page, old_page, address, vma,
+ pages_per_huge_page(h));
+ __SetPageUptodate(new_page);
++ set_page_huge_active(new_page);
+
+ mmun_start = address & huge_page_mask(h);
+ mmun_end = mmun_start + huge_page_size(h);
+@@ -2995,6 +3022,7 @@ retry:
+ }
+ clear_huge_page(page, address, pages_per_huge_page(h));
+ __SetPageUptodate(page);
++ set_page_huge_active(page);
+
+ if (vma->vm_flags & VM_MAYSHARE) {
+ int err;
+@@ -3799,19 +3827,26 @@ int dequeue_hwpoisoned_huge_page(struct page *hpage)
+
+ bool isolate_huge_page(struct page *page, struct list_head *list)
+ {
++ bool ret = true;
++
+ VM_BUG_ON_PAGE(!PageHead(page), page);
+- if (!get_page_unless_zero(page))
+- return false;
+ spin_lock(&hugetlb_lock);
++ if (!page_huge_active(page) || !get_page_unless_zero(page)) {
++ ret = false;
++ goto unlock;
++ }
++ clear_page_huge_active(page);
+ list_move_tail(&page->lru, list);
++unlock:
+ spin_unlock(&hugetlb_lock);
+- return true;
++ return ret;
+ }
+
+ void putback_active_hugepage(struct page *page)
+ {
+ VM_BUG_ON_PAGE(!PageHead(page), page);
+ spin_lock(&hugetlb_lock);
++ set_page_huge_active(page);
+ list_move_tail(&page->lru, &(page_hstate(page))->hugepage_activelist);
+ spin_unlock(&hugetlb_lock);
+ put_page(page);
+diff --git a/mm/memory-failure.c b/mm/memory-failure.c
+index 22f047fbaa33..715bc57385b9 100644
+--- a/mm/memory-failure.c
++++ b/mm/memory-failure.c
+@@ -1524,6 +1524,8 @@ static int get_any_page(struct page *page, unsigned long pfn, int flags)
+ */
+ ret = __get_any_page(page, pfn, 0);
+ if (!PageLRU(page)) {
++ /* Drop page reference which is from __get_any_page() */
++ put_page(page);
+ pr_info("soft_offline: %#lx: unknown non LRU page type %lx\n",
+ pfn, page->flags);
+ return -EIO;
+@@ -1552,8 +1554,17 @@ static int soft_offline_huge_page(struct page *page, int flags)
+ }
+ unlock_page(hpage);
+
+- /* Keep page count to indicate a given hugepage is isolated. */
+- list_move(&hpage->lru, &pagelist);
++ ret = isolate_huge_page(hpage, &pagelist);
++ /*
++ * get_any_page() and isolate_huge_page() takes a refcount each,
++ * so need to drop one here.
++ */
++ put_page(hpage);
++ if (!ret) {
++ pr_info("soft offline: %#lx hugepage failed to isolate\n", pfn);
++ return -EBUSY;
++ }
++
+ ret = migrate_pages(&pagelist, new_page, NULL, MPOL_MF_MOVE_ALL,
+ MIGRATE_SYNC, MR_MEMORY_FAILURE);
+ if (ret) {
+diff --git a/net/bridge/br_mdb.c b/net/bridge/br_mdb.c
+index 5df05269d17a..cc641541d38f 100644
+--- a/net/bridge/br_mdb.c
++++ b/net/bridge/br_mdb.c
+@@ -347,7 +347,6 @@ static int br_mdb_add_group(struct net_bridge *br, struct net_bridge_port *port,
+ return -ENOMEM;
+ rcu_assign_pointer(*pp, p);
+
+- br_mdb_notify(br->dev, port, group, RTM_NEWMDB);
+ return 0;
+ }
+
+@@ -370,6 +369,7 @@ static int __br_mdb_add(struct net *net, struct net_bridge *br,
+ if (!p || p->br != br || p->state == BR_STATE_DISABLED)
+ return -EINVAL;
+
++ memset(&ip, 0, sizeof(ip));
+ ip.proto = entry->addr.proto;
+ if (ip.proto == htons(ETH_P_IP))
+ ip.u.ip4 = entry->addr.u.ip4;
+@@ -416,6 +416,7 @@ static int __br_mdb_del(struct net_bridge *br, struct br_mdb_entry *entry)
+ if (!netif_running(br->dev) || br->multicast_disabled)
+ return -EINVAL;
+
++ memset(&ip, 0, sizeof(ip));
+ ip.proto = entry->addr.proto;
+ if (ip.proto == htons(ETH_P_IP)) {
+ if (timer_pending(&br->ip4_other_query.timer))
+diff --git a/net/core/datagram.c b/net/core/datagram.c
+index fdbc9a81d4c2..3a402a7b20e9 100644
+--- a/net/core/datagram.c
++++ b/net/core/datagram.c
+@@ -744,7 +744,8 @@ __sum16 __skb_checksum_complete_head(struct sk_buff *skb, int len)
+ !skb->csum_complete_sw)
+ netdev_rx_csum_fault(skb->dev);
+ }
+- skb->csum_valid = !sum;
++ if (!skb_shared(skb))
++ skb->csum_valid = !sum;
+ return sum;
+ }
+ EXPORT_SYMBOL(__skb_checksum_complete_head);
+@@ -764,11 +765,13 @@ __sum16 __skb_checksum_complete(struct sk_buff *skb)
+ netdev_rx_csum_fault(skb->dev);
+ }
+
+- /* Save full packet checksum */
+- skb->csum = csum;
+- skb->ip_summed = CHECKSUM_COMPLETE;
+- skb->csum_complete_sw = 1;
+- skb->csum_valid = !sum;
++ if (!skb_shared(skb)) {
++ /* Save full packet checksum */
++ skb->csum = csum;
++ skb->ip_summed = CHECKSUM_COMPLETE;
++ skb->csum_complete_sw = 1;
++ skb->csum_valid = !sum;
++ }
+
+ return sum;
+ }
+diff --git a/net/core/dev.c b/net/core/dev.c
+index fb9625874b3c..93612b2e3bbf 100644
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -3309,6 +3309,8 @@ static int enqueue_to_backlog(struct sk_buff *skb, int cpu,
+ local_irq_save(flags);
+
+ rps_lock(sd);
++ if (!netif_running(skb->dev))
++ goto drop;
+ qlen = skb_queue_len(&sd->input_pkt_queue);
+ if (qlen <= netdev_max_backlog && !skb_flow_limit(skb, qlen)) {
+ if (skb_queue_len(&sd->input_pkt_queue)) {
+@@ -3330,6 +3332,7 @@ enqueue:
+ goto enqueue;
+ }
+
++drop:
+ sd->dropped++;
+ rps_unlock(sd);
+
+@@ -3638,8 +3641,6 @@ static int __netif_receive_skb_core(struct sk_buff *skb, bool pfmemalloc)
+
+ pt_prev = NULL;
+
+- rcu_read_lock();
+-
+ another_round:
+ skb->skb_iif = skb->dev->ifindex;
+
+@@ -3649,7 +3650,7 @@ another_round:
+ skb->protocol == cpu_to_be16(ETH_P_8021AD)) {
+ skb = skb_vlan_untag(skb);
+ if (unlikely(!skb))
+- goto unlock;
++ goto out;
+ }
+
+ #ifdef CONFIG_NET_CLS_ACT
+@@ -3674,7 +3675,7 @@ skip_taps:
+ #ifdef CONFIG_NET_CLS_ACT
+ skb = handle_ing(skb, &pt_prev, &ret, orig_dev);
+ if (!skb)
+- goto unlock;
++ goto out;
+ ncls:
+ #endif
+
+@@ -3689,7 +3690,7 @@ ncls:
+ if (vlan_do_receive(&skb))
+ goto another_round;
+ else if (unlikely(!skb))
+- goto unlock;
++ goto out;
+ }
+
+ rx_handler = rcu_dereference(skb->dev->rx_handler);
+@@ -3701,7 +3702,7 @@ ncls:
+ switch (rx_handler(&skb)) {
+ case RX_HANDLER_CONSUMED:
+ ret = NET_RX_SUCCESS;
+- goto unlock;
++ goto out;
+ case RX_HANDLER_ANOTHER:
+ goto another_round;
+ case RX_HANDLER_EXACT:
+@@ -3753,8 +3754,7 @@ drop:
+ ret = NET_RX_DROP;
+ }
+
+-unlock:
+- rcu_read_unlock();
++out:
+ return ret;
+ }
+
+@@ -3785,29 +3785,30 @@ static int __netif_receive_skb(struct sk_buff *skb)
+
+ static int netif_receive_skb_internal(struct sk_buff *skb)
+ {
++ int ret;
++
+ net_timestamp_check(netdev_tstamp_prequeue, skb);
+
+ if (skb_defer_rx_timestamp(skb))
+ return NET_RX_SUCCESS;
+
++ rcu_read_lock();
++
+ #ifdef CONFIG_RPS
+ if (static_key_false(&rps_needed)) {
+ struct rps_dev_flow voidflow, *rflow = &voidflow;
+- int cpu, ret;
+-
+- rcu_read_lock();
+-
+- cpu = get_rps_cpu(skb->dev, skb, &rflow);
++ int cpu = get_rps_cpu(skb->dev, skb, &rflow);
+
+ if (cpu >= 0) {
+ ret = enqueue_to_backlog(skb, cpu, &rflow->last_qtail);
+ rcu_read_unlock();
+ return ret;
+ }
+- rcu_read_unlock();
+ }
+ #endif
+- return __netif_receive_skb(skb);
++ ret = __netif_receive_skb(skb);
++ rcu_read_unlock();
++ return ret;
+ }
+
+ /**
+@@ -4343,8 +4344,10 @@ static int process_backlog(struct napi_struct *napi, int quota)
+ struct sk_buff *skb;
+
+ while ((skb = __skb_dequeue(&sd->process_queue))) {
++ rcu_read_lock();
+ local_irq_enable();
+ __netif_receive_skb(skb);
++ rcu_read_unlock();
+ local_irq_disable();
+ input_queue_head_incr(sd);
+ if (++work >= quota) {
+@@ -5867,6 +5870,7 @@ static void rollback_registered_many(struct list_head *head)
+ unlist_netdevice(dev);
+
+ dev->reg_state = NETREG_UNREGISTERING;
++ on_each_cpu(flush_backlog, dev, 1);
+ }
+
+ synchronize_net();
+@@ -6128,7 +6132,8 @@ static int netif_alloc_netdev_queues(struct net_device *dev)
+ struct netdev_queue *tx;
+ size_t sz = count * sizeof(*tx);
+
+- BUG_ON(count < 1 || count > 0xffff);
++ if (count < 1 || count > 0xffff)
++ return -EINVAL;
+
+ tx = kzalloc(sz, GFP_KERNEL | __GFP_NOWARN | __GFP_REPEAT);
+ if (!tx) {
+@@ -6486,8 +6491,6 @@ void netdev_run_todo(void)
+
+ dev->reg_state = NETREG_UNREGISTERED;
+
+- on_each_cpu(flush_backlog, dev, 1);
+-
+ netdev_wait_allrefs(dev);
+
+ /* paranoia */
+diff --git a/net/core/pktgen.c b/net/core/pktgen.c
+index 0b320d93fb56..4ff3eacc99f5 100644
+--- a/net/core/pktgen.c
++++ b/net/core/pktgen.c
+@@ -3490,8 +3490,10 @@ static int pktgen_thread_worker(void *arg)
+ pktgen_rem_thread(t);
+
+ /* Wait for kthread_stop */
+- while (!kthread_should_stop()) {
++ for (;;) {
+ set_current_state(TASK_INTERRUPTIBLE);
++ if (kthread_should_stop())
++ break;
+ schedule();
+ }
+ __set_current_state(TASK_RUNNING);
+diff --git a/net/ipv4/datagram.c b/net/ipv4/datagram.c
+index 90c0e8386116..574fad9cca05 100644
+--- a/net/ipv4/datagram.c
++++ b/net/ipv4/datagram.c
+@@ -20,7 +20,7 @@
+ #include <net/route.h>
+ #include <net/tcp_states.h>
+
+-int ip4_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
++int __ip4_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
+ {
+ struct inet_sock *inet = inet_sk(sk);
+ struct sockaddr_in *usin = (struct sockaddr_in *) uaddr;
+@@ -39,8 +39,6 @@ int ip4_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
+
+ sk_dst_reset(sk);
+
+- lock_sock(sk);
+-
+ oif = sk->sk_bound_dev_if;
+ saddr = inet->inet_saddr;
+ if (ipv4_is_multicast(usin->sin_addr.s_addr)) {
+@@ -82,9 +80,19 @@ int ip4_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
+ sk_dst_set(sk, &rt->dst);
+ err = 0;
+ out:
+- release_sock(sk);
+ return err;
+ }
++EXPORT_SYMBOL(__ip4_datagram_connect);
++
++int ip4_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
++{
++ int res;
++
++ lock_sock(sk);
++ res = __ip4_datagram_connect(sk, uaddr, addr_len);
++ release_sock(sk);
++ return res;
++}
+ EXPORT_SYMBOL(ip4_datagram_connect);
+
+ /* Because UDP xmit path can manipulate sk_dst_cache without holding
+diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c
+index b48e03cd6656..9516031847f1 100644
+--- a/net/ipv4/ip_fragment.c
++++ b/net/ipv4/ip_fragment.c
+@@ -342,7 +342,7 @@ static int ip_frag_queue(struct ipq *qp, struct sk_buff *skb)
+ ihl = ip_hdrlen(skb);
+
+ /* Determine the position of this fragment. */
+- end = offset + skb->len - ihl;
++ end = offset + skb->len - skb_network_offset(skb) - ihl;
+ err = -EINVAL;
+
+ /* Is this the final fragment? */
+@@ -372,7 +372,7 @@ static int ip_frag_queue(struct ipq *qp, struct sk_buff *skb)
+ goto err;
+
+ err = -ENOMEM;
+- if (pskb_pull(skb, ihl) == NULL)
++ if (!pskb_pull(skb, skb_network_offset(skb) + ihl))
+ goto err;
+
+ err = pskb_trim_rcsum(skb, end - offset);
+@@ -612,6 +612,9 @@ static int ip_frag_reasm(struct ipq *qp, struct sk_buff *prev,
+ iph->frag_off = qp->q.max_size ? htons(IP_DF) : 0;
+ iph->tot_len = htons(len);
+ iph->tos |= ecn;
++
++ ip_send_check(iph);
++
+ IP_INC_STATS_BH(net, IPSTATS_MIB_REASMOKS);
+ qp->q.fragments = NULL;
+ qp->q.fragments_tail = NULL;
+diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c
+index 0bb8e141eacc..682257242971 100644
+--- a/net/ipv4/ip_tunnel.c
++++ b/net/ipv4/ip_tunnel.c
+@@ -587,7 +587,8 @@ int ip_tunnel_encap(struct sk_buff *skb, struct ip_tunnel *t,
+ EXPORT_SYMBOL(ip_tunnel_encap);
+
+ static int tnl_update_pmtu(struct net_device *dev, struct sk_buff *skb,
+- struct rtable *rt, __be16 df)
++ struct rtable *rt, __be16 df,
++ const struct iphdr *inner_iph)
+ {
+ struct ip_tunnel *tunnel = netdev_priv(dev);
+ int pkt_size = skb->len - tunnel->hlen - dev->hard_header_len;
+@@ -604,7 +605,8 @@ static int tnl_update_pmtu(struct net_device *dev, struct sk_buff *skb,
+
+ if (skb->protocol == htons(ETH_P_IP)) {
+ if (!skb_is_gso(skb) &&
+- (df & htons(IP_DF)) && mtu < pkt_size) {
++ (inner_iph->frag_off & htons(IP_DF)) &&
++ mtu < pkt_size) {
+ memset(IPCB(skb), 0, sizeof(*IPCB(skb)));
+ icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED, htonl(mtu));
+ return -E2BIG;
+@@ -738,7 +740,7 @@ void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev,
+ goto tx_error;
+ }
+
+- if (tnl_update_pmtu(dev, skb, rt, tnl_params->frag_off)) {
++ if (tnl_update_pmtu(dev, skb, rt, tnl_params->frag_off, inner_iph)) {
+ ip_rt_put(rt);
+ goto tx_error;
+ }
+diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c
+index 11e3945eeac7..e069aeb2cf72 100644
+--- a/net/ipv6/datagram.c
++++ b/net/ipv6/datagram.c
+@@ -40,7 +40,7 @@ static bool ipv6_mapped_addr_any(const struct in6_addr *a)
+ return ipv6_addr_v4mapped(a) && (a->s6_addr32[3] == 0);
+ }
+
+-int ip6_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
++static int __ip6_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
+ {
+ struct sockaddr_in6 *usin = (struct sockaddr_in6 *) uaddr;
+ struct inet_sock *inet = inet_sk(sk);
+@@ -56,7 +56,7 @@ int ip6_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
+ if (usin->sin6_family == AF_INET) {
+ if (__ipv6_only_sock(sk))
+ return -EAFNOSUPPORT;
+- err = ip4_datagram_connect(sk, uaddr, addr_len);
++ err = __ip4_datagram_connect(sk, uaddr, addr_len);
+ goto ipv4_connected;
+ }
+
+@@ -98,9 +98,9 @@ int ip6_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
+ sin.sin_addr.s_addr = daddr->s6_addr32[3];
+ sin.sin_port = usin->sin6_port;
+
+- err = ip4_datagram_connect(sk,
+- (struct sockaddr *) &sin,
+- sizeof(sin));
++ err = __ip4_datagram_connect(sk,
++ (struct sockaddr *) &sin,
++ sizeof(sin));
+
+ ipv4_connected:
+ if (err)
+@@ -204,6 +204,16 @@ out:
+ fl6_sock_release(flowlabel);
+ return err;
+ }
++
++int ip6_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
++{
++ int res;
++
++ lock_sock(sk);
++ res = __ip6_datagram_connect(sk, uaddr, addr_len);
++ release_sock(sk);
++ return res;
++}
+ EXPORT_SYMBOL_GPL(ip6_datagram_connect);
+
+ int ip6_datagram_connect_v6_only(struct sock *sk, struct sockaddr *uaddr,
+diff --git a/net/ipv6/ip6_input.c b/net/ipv6/ip6_input.c
+index a3084ab5df6c..ac5e973e9eb5 100644
+--- a/net/ipv6/ip6_input.c
++++ b/net/ipv6/ip6_input.c
+@@ -329,10 +329,10 @@ int ip6_mc_input(struct sk_buff *skb)
+ if (offset < 0)
+ goto out;
+
+- if (!ipv6_is_mld(skb, nexthdr, offset))
+- goto out;
++ if (ipv6_is_mld(skb, nexthdr, offset))
++ deliver = true;
+
+- deliver = true;
++ goto out;
+ }
+ /* unknown RA - process it normally */
+ }
+diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
+index c82b2e37e652..6ffd1ebaba93 100644
+--- a/net/netlink/af_netlink.c
++++ b/net/netlink/af_netlink.c
+@@ -366,25 +366,52 @@ err1:
+ return NULL;
+ }
+
++
++static void
++__netlink_set_ring(struct sock *sk, struct nl_mmap_req *req, bool tx_ring, void **pg_vec,
++ unsigned int order)
++{
++ struct netlink_sock *nlk = nlk_sk(sk);
++ struct sk_buff_head *queue;
++ struct netlink_ring *ring;
++
++ queue = tx_ring ? &sk->sk_write_queue : &sk->sk_receive_queue;
++ ring = tx_ring ? &nlk->tx_ring : &nlk->rx_ring;
++
++ spin_lock_bh(&queue->lock);
++
++ ring->frame_max = req->nm_frame_nr - 1;
++ ring->head = 0;
++ ring->frame_size = req->nm_frame_size;
++ ring->pg_vec_pages = req->nm_block_size / PAGE_SIZE;
++
++ swap(ring->pg_vec_len, req->nm_block_nr);
++ swap(ring->pg_vec_order, order);
++ swap(ring->pg_vec, pg_vec);
++
++ __skb_queue_purge(queue);
++ spin_unlock_bh(&queue->lock);
++
++ WARN_ON(atomic_read(&nlk->mapped));
++
++ if (pg_vec)
++ free_pg_vec(pg_vec, order, req->nm_block_nr);
++}
++
+ static int netlink_set_ring(struct sock *sk, struct nl_mmap_req *req,
+- bool closing, bool tx_ring)
++ bool tx_ring)
+ {
+ struct netlink_sock *nlk = nlk_sk(sk);
+ struct netlink_ring *ring;
+- struct sk_buff_head *queue;
+ void **pg_vec = NULL;
+ unsigned int order = 0;
+- int err;
+
+ ring = tx_ring ? &nlk->tx_ring : &nlk->rx_ring;
+- queue = tx_ring ? &sk->sk_write_queue : &sk->sk_receive_queue;
+
+- if (!closing) {
+- if (atomic_read(&nlk->mapped))
+- return -EBUSY;
+- if (atomic_read(&ring->pending))
+- return -EBUSY;
+- }
++ if (atomic_read(&nlk->mapped))
++ return -EBUSY;
++ if (atomic_read(&ring->pending))
++ return -EBUSY;
+
+ if (req->nm_block_nr) {
+ if (ring->pg_vec != NULL)
+@@ -416,31 +443,19 @@ static int netlink_set_ring(struct sock *sk, struct nl_mmap_req *req,
+ return -EINVAL;
+ }
+
+- err = -EBUSY;
+ mutex_lock(&nlk->pg_vec_lock);
+- if (closing || atomic_read(&nlk->mapped) == 0) {
+- err = 0;
+- spin_lock_bh(&queue->lock);
+-
+- ring->frame_max = req->nm_frame_nr - 1;
+- ring->head = 0;
+- ring->frame_size = req->nm_frame_size;
+- ring->pg_vec_pages = req->nm_block_size / PAGE_SIZE;
+-
+- swap(ring->pg_vec_len, req->nm_block_nr);
+- swap(ring->pg_vec_order, order);
+- swap(ring->pg_vec, pg_vec);
+-
+- __skb_queue_purge(queue);
+- spin_unlock_bh(&queue->lock);
+-
+- WARN_ON(atomic_read(&nlk->mapped));
++ if (atomic_read(&nlk->mapped) == 0) {
++ __netlink_set_ring(sk, req, tx_ring, pg_vec, order);
++ mutex_unlock(&nlk->pg_vec_lock);
++ return 0;
+ }
++
+ mutex_unlock(&nlk->pg_vec_lock);
+
+ if (pg_vec)
+ free_pg_vec(pg_vec, order, req->nm_block_nr);
+- return err;
++
++ return -EBUSY;
+ }
+
+ static void netlink_mm_open(struct vm_area_struct *vma)
+@@ -909,10 +924,10 @@ static void netlink_sock_destruct(struct sock *sk)
+
+ memset(&req, 0, sizeof(req));
+ if (nlk->rx_ring.pg_vec)
+- netlink_set_ring(sk, &req, true, false);
++ __netlink_set_ring(sk, &req, false, NULL, 0);
+ memset(&req, 0, sizeof(req));
+ if (nlk->tx_ring.pg_vec)
+- netlink_set_ring(sk, &req, true, true);
++ __netlink_set_ring(sk, &req, true, NULL, 0);
+ }
+ #endif /* CONFIG_NETLINK_MMAP */
+
+@@ -2163,7 +2178,7 @@ static int netlink_setsockopt(struct socket *sock, int level, int optname,
+ return -EINVAL;
+ if (copy_from_user(&req, optval, sizeof(req)))
+ return -EFAULT;
+- err = netlink_set_ring(sk, &req, false,
++ err = netlink_set_ring(sk, &req,
+ optname == NETLINK_TX_RING);
+ break;
+ }
+diff --git a/net/rds/info.c b/net/rds/info.c
+index 9a6b4f66187c..140a44a5f7b7 100644
+--- a/net/rds/info.c
++++ b/net/rds/info.c
+@@ -176,7 +176,7 @@ int rds_info_getsockopt(struct socket *sock, int optname, char __user *optval,
+
+ /* check for all kinds of wrapping and the like */
+ start = (unsigned long)optval;
+- if (len < 0 || len + PAGE_SIZE - 1 < len || start + len < start) {
++ if (len < 0 || len > INT_MAX - PAGE_SIZE + 1 || start + len < start) {
+ ret = -EINVAL;
+ goto out;
+ }
+diff --git a/net/tipc/socket.c b/net/tipc/socket.c
+index 51bddc236a15..8224016ebd70 100644
+--- a/net/tipc/socket.c
++++ b/net/tipc/socket.c
+@@ -1996,6 +1996,7 @@ static int tipc_accept(struct socket *sock, struct socket *new_sock, int flags)
+ res = tipc_sk_create(sock_net(sock->sk), new_sock, 0, 1);
+ if (res)
+ goto exit;
++ security_sk_clone(sock->sk, new_sock->sk);
+
+ new_sk = new_sock->sk;
+ new_tsock = tipc_sk(new_sk);
+diff --git a/scripts/kconfig/streamline_config.pl b/scripts/kconfig/streamline_config.pl
+index 9cb8522d8d22..f3d3fb42b873 100755
+--- a/scripts/kconfig/streamline_config.pl
++++ b/scripts/kconfig/streamline_config.pl
+@@ -137,7 +137,7 @@ my $ksource = ($ARGV[0] ? $ARGV[0] : '.');
+ my $kconfig = $ARGV[1];
+ my $lsmod_file = $ENV{'LSMOD'};
+
+-my @makefiles = `find $ksource -name Makefile 2>/dev/null`;
++my @makefiles = `find $ksource -name Makefile -or -name Kbuild 2>/dev/null`;
+ chomp @makefiles;
+
+ my %depends;
+diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
+index 9ff5050d513a..2c10c9ee36a2 100644
+--- a/sound/usb/quirks.c
++++ b/sound/usb/quirks.c
+@@ -1258,6 +1258,7 @@ u64 snd_usb_interface_dsd_format_quirks(struct snd_usb_audio *chip,
+ return SNDRV_PCM_FMTBIT_DSD_U32_BE;
+ break;
+
++ case USB_ID(0x20b1, 0x000a): /* Gustard DAC-X20U */
+ case USB_ID(0x20b1, 0x2009): /* DIYINHK DSD DXD 384kHz USB to I2S/DSD */
+ case USB_ID(0x20b1, 0x2023): /* JLsounds I2SoverUSB */
+ if (fp->altsetting == 3)
^ permalink raw reply related [flat|nested] 67+ messages in thread
* [gentoo-commits] proj/linux-patches:3.18 commit in: /
@ 2015-10-30 18:38 Mike Pagano
0 siblings, 0 replies; 67+ messages in thread
From: Mike Pagano @ 2015-10-30 18:38 UTC (permalink / raw
To: gentoo-commits
commit: 3fcf680a3582b9ec58290902948953cd55bbc916
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Fri Oct 30 18:38:35 2015 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Fri Oct 30 18:38:35 2015 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=3fcf680a
Linux patch 3.18.23
0000_README | 4 +
1022_linux-3.18.23.patch | 10069 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 10073 insertions(+)
diff --git a/0000_README b/0000_README
index 7e934be..84e11a6 100644
--- a/0000_README
+++ b/0000_README
@@ -131,6 +131,10 @@ Patch: 1021_linux-3.18.22.patch
From: http://www.kernel.org
Desc: Linux 3.18.22
+Patch: 1022_linux-3.18.23.patch
+From: http://www.kernel.org
+Desc: Linux 3.18.23
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1022_linux-3.18.23.patch b/1022_linux-3.18.23.patch
new file mode 100644
index 0000000..2acbfc9
--- /dev/null
+++ b/1022_linux-3.18.23.patch
@@ -0,0 +1,10069 @@
+diff --git a/Documentation/ABI/testing/configfs-usb-gadget-loopback b/Documentation/ABI/testing/configfs-usb-gadget-loopback
+index 9aae5bfb9908..06beefbcf061 100644
+--- a/Documentation/ABI/testing/configfs-usb-gadget-loopback
++++ b/Documentation/ABI/testing/configfs-usb-gadget-loopback
+@@ -5,4 +5,4 @@ Description:
+ The attributes:
+
+ qlen - depth of loopback queue
+- bulk_buflen - buffer length
++ buflen - buffer length
+diff --git a/Documentation/ABI/testing/configfs-usb-gadget-sourcesink b/Documentation/ABI/testing/configfs-usb-gadget-sourcesink
+index 29477c319f61..bc7ff731aa0c 100644
+--- a/Documentation/ABI/testing/configfs-usb-gadget-sourcesink
++++ b/Documentation/ABI/testing/configfs-usb-gadget-sourcesink
+@@ -9,4 +9,4 @@ Description:
+ isoc_maxpacket - 0 - 1023 (fs), 0 - 1024 (hs/ss)
+ isoc_mult - 0..2 (hs/ss only)
+ isoc_maxburst - 0..15 (ss only)
+- qlen - buffer length
++ buflen - buffer length
+diff --git a/Documentation/HOWTO b/Documentation/HOWTO
+index 93aa8604630e..21152d397b88 100644
+--- a/Documentation/HOWTO
++++ b/Documentation/HOWTO
+@@ -218,16 +218,16 @@ The development process
+ Linux kernel development process currently consists of a few different
+ main kernel "branches" and lots of different subsystem-specific kernel
+ branches. These different branches are:
+- - main 3.x kernel tree
+- - 3.x.y -stable kernel tree
+- - 3.x -git kernel patches
++ - main 4.x kernel tree
++ - 4.x.y -stable kernel tree
++ - 4.x -git kernel patches
+ - subsystem specific kernel trees and patches
+- - the 3.x -next kernel tree for integration tests
++ - the 4.x -next kernel tree for integration tests
+
+-3.x kernel tree
++4.x kernel tree
+ -----------------
+-3.x kernels are maintained by Linus Torvalds, and can be found on
+-kernel.org in the pub/linux/kernel/v3.x/ directory. Its development
++4.x kernels are maintained by Linus Torvalds, and can be found on
++kernel.org in the pub/linux/kernel/v4.x/ directory. Its development
+ process is as follows:
+ - As soon as a new kernel is released a two weeks window is open,
+ during this period of time maintainers can submit big diffs to
+@@ -262,20 +262,20 @@ mailing list about kernel releases:
+ released according to perceived bug status, not according to a
+ preconceived timeline."
+
+-3.x.y -stable kernel tree
++4.x.y -stable kernel tree
+ ---------------------------
+ Kernels with 3-part versions are -stable kernels. They contain
+ relatively small and critical fixes for security problems or significant
+-regressions discovered in a given 3.x kernel.
++regressions discovered in a given 4.x kernel.
+
+ This is the recommended branch for users who want the most recent stable
+ kernel and are not interested in helping test development/experimental
+ versions.
+
+-If no 3.x.y kernel is available, then the highest numbered 3.x
++If no 4.x.y kernel is available, then the highest numbered 4.x
+ kernel is the current stable kernel.
+
+-3.x.y are maintained by the "stable" team <stable@vger.kernel.org>, and
++4.x.y are maintained by the "stable" team <stable@vger.kernel.org>, and
+ are released as needs dictate. The normal release period is approximately
+ two weeks, but it can be longer if there are no pressing problems. A
+ security-related problem, instead, can cause a release to happen almost
+@@ -285,7 +285,7 @@ The file Documentation/stable_kernel_rules.txt in the kernel tree
+ documents what kinds of changes are acceptable for the -stable tree, and
+ how the release process works.
+
+-3.x -git patches
++4.x -git patches
+ ------------------
+ These are daily snapshots of Linus' kernel tree which are managed in a
+ git repository (hence the name.) These patches are usually released
+@@ -317,9 +317,9 @@ revisions to it, and maintainers can mark patches as under review,
+ accepted, or rejected. Most of these patchwork sites are listed at
+ http://patchwork.kernel.org/.
+
+-3.x -next kernel tree for integration tests
++4.x -next kernel tree for integration tests
+ ---------------------------------------------
+-Before updates from subsystem trees are merged into the mainline 3.x
++Before updates from subsystem trees are merged into the mainline 4.x
+ tree, they need to be integration-tested. For this purpose, a special
+ testing repository exists into which virtually all subsystem trees are
+ pulled on an almost daily basis:
+diff --git a/Documentation/devicetree/bindings/net/ethernet.txt b/Documentation/devicetree/bindings/net/ethernet.txt
+index 3fc360523bc9..cb115a3b7e00 100644
+--- a/Documentation/devicetree/bindings/net/ethernet.txt
++++ b/Documentation/devicetree/bindings/net/ethernet.txt
+@@ -19,7 +19,11 @@ The following properties are common to the Ethernet controllers:
+ - phy: the same as "phy-handle" property, not recommended for new bindings.
+ - phy-device: the same as "phy-handle" property, not recommended for new
+ bindings.
++- managed: string, specifies the PHY management type. Supported values are:
++ "auto", "in-band-status". "auto" is the default, it usess MDIO for
++ management if fixed-link is not specified.
+
+ Child nodes of the Ethernet controller are typically the individual PHY devices
+ connected via the MDIO bus (sometimes the MDIO bus controller is separate).
+ They are described in the phy.txt file in this same directory.
++For non-MDIO PHY management see fixed-link.txt.
+diff --git a/Makefile b/Makefile
+index 7adbbbeeb421..2ebc49903d33 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 18
+-SUBLEVEL = 22
++SUBLEVEL = 23
+ EXTRAVERSION =
+ NAME = Diseased Newt
+
+diff --git a/arch/arm/Makefile b/arch/arm/Makefile
+index 034a94904d69..b5d79884b2af 100644
+--- a/arch/arm/Makefile
++++ b/arch/arm/Makefile
+@@ -50,6 +50,14 @@ AS += -EL
+ LD += -EL
+ endif
+
++#
++# The Scalar Replacement of Aggregates (SRA) optimization pass in GCC 4.9 and
++# later may result in code being generated that handles signed short and signed
++# char struct members incorrectly. So disable it.
++# (https://gcc.gnu.org/bugzilla/show_bug.cgi?id=65932)
++#
++KBUILD_CFLAGS += $(call cc-option,-fno-ipa-sra)
++
+ # This selects which instruction set is used.
+ # Note that GCC does not numerically define an architecture version
+ # macro, but instead defines a whole series of macros which makes
+diff --git a/arch/arm/boot/dts/imx25-pdk.dts b/arch/arm/boot/dts/imx25-pdk.dts
+index 9c21b1583762..300507fc722f 100644
+--- a/arch/arm/boot/dts/imx25-pdk.dts
++++ b/arch/arm/boot/dts/imx25-pdk.dts
+@@ -10,6 +10,7 @@
+ */
+
+ /dts-v1/;
++#include <dt-bindings/gpio/gpio.h>
+ #include <dt-bindings/input/input.h>
+ #include "imx25.dtsi"
+
+@@ -93,8 +94,8 @@
+ &esdhc1 {
+ pinctrl-names = "default";
+ pinctrl-0 = <&pinctrl_esdhc1>;
+- cd-gpios = <&gpio2 1 0>;
+- wp-gpios = <&gpio2 0 0>;
++ cd-gpios = <&gpio2 1 GPIO_ACTIVE_LOW>;
++ wp-gpios = <&gpio2 0 GPIO_ACTIVE_HIGH>;
+ status = "okay";
+ };
+
+diff --git a/arch/arm/boot/dts/imx51-apf51dev.dts b/arch/arm/boot/dts/imx51-apf51dev.dts
+index c5a9a24c280a..cdd72e0eb4d4 100644
+--- a/arch/arm/boot/dts/imx51-apf51dev.dts
++++ b/arch/arm/boot/dts/imx51-apf51dev.dts
+@@ -90,7 +90,7 @@
+ &esdhc1 {
+ pinctrl-names = "default";
+ pinctrl-0 = <&pinctrl_esdhc1>;
+- cd-gpios = <&gpio2 29 GPIO_ACTIVE_HIGH>;
++ cd-gpios = <&gpio2 29 GPIO_ACTIVE_LOW>;
+ bus-width = <4>;
+ status = "okay";
+ };
+diff --git a/arch/arm/boot/dts/imx53-ard.dts b/arch/arm/boot/dts/imx53-ard.dts
+index e9337ad52f59..3bc18835fb4b 100644
+--- a/arch/arm/boot/dts/imx53-ard.dts
++++ b/arch/arm/boot/dts/imx53-ard.dts
+@@ -103,8 +103,8 @@
+ &esdhc1 {
+ pinctrl-names = "default";
+ pinctrl-0 = <&pinctrl_esdhc1>;
+- cd-gpios = <&gpio1 1 0>;
+- wp-gpios = <&gpio1 9 0>;
++ cd-gpios = <&gpio1 1 GPIO_ACTIVE_LOW>;
++ wp-gpios = <&gpio1 9 GPIO_ACTIVE_HIGH>;
+ status = "okay";
+ };
+
+diff --git a/arch/arm/boot/dts/imx53-m53evk.dts b/arch/arm/boot/dts/imx53-m53evk.dts
+index d0e0f57eb432..53f40885c530 100644
+--- a/arch/arm/boot/dts/imx53-m53evk.dts
++++ b/arch/arm/boot/dts/imx53-m53evk.dts
+@@ -124,8 +124,8 @@
+ &esdhc1 {
+ pinctrl-names = "default";
+ pinctrl-0 = <&pinctrl_esdhc1>;
+- cd-gpios = <&gpio1 1 0>;
+- wp-gpios = <&gpio1 9 0>;
++ cd-gpios = <&gpio1 1 GPIO_ACTIVE_LOW>;
++ wp-gpios = <&gpio1 9 GPIO_ACTIVE_HIGH>;
+ status = "okay";
+ };
+
+diff --git a/arch/arm/boot/dts/imx53-qsb-common.dtsi b/arch/arm/boot/dts/imx53-qsb-common.dtsi
+index 181ae5ebf23f..1f55187ed9ce 100644
+--- a/arch/arm/boot/dts/imx53-qsb-common.dtsi
++++ b/arch/arm/boot/dts/imx53-qsb-common.dtsi
+@@ -147,8 +147,8 @@
+ &esdhc3 {
+ pinctrl-names = "default";
+ pinctrl-0 = <&pinctrl_esdhc3>;
+- cd-gpios = <&gpio3 11 0>;
+- wp-gpios = <&gpio3 12 0>;
++ cd-gpios = <&gpio3 11 GPIO_ACTIVE_LOW>;
++ wp-gpios = <&gpio3 12 GPIO_ACTIVE_HIGH>;
+ bus-width = <8>;
+ status = "okay";
+ };
+diff --git a/arch/arm/boot/dts/imx53-smd.dts b/arch/arm/boot/dts/imx53-smd.dts
+index 1d325576bcc0..fc89ce1e5763 100644
+--- a/arch/arm/boot/dts/imx53-smd.dts
++++ b/arch/arm/boot/dts/imx53-smd.dts
+@@ -41,8 +41,8 @@
+ &esdhc1 {
+ pinctrl-names = "default";
+ pinctrl-0 = <&pinctrl_esdhc1>;
+- cd-gpios = <&gpio3 13 0>;
+- wp-gpios = <&gpio4 11 0>;
++ cd-gpios = <&gpio3 13 GPIO_ACTIVE_LOW>;
++ wp-gpios = <&gpio4 11 GPIO_ACTIVE_HIGH>;
+ status = "okay";
+ };
+
+diff --git a/arch/arm/boot/dts/imx53-tqma53.dtsi b/arch/arm/boot/dts/imx53-tqma53.dtsi
+index 4f1f0e2868bf..e03373a58760 100644
+--- a/arch/arm/boot/dts/imx53-tqma53.dtsi
++++ b/arch/arm/boot/dts/imx53-tqma53.dtsi
+@@ -41,8 +41,8 @@
+ pinctrl-0 = <&pinctrl_esdhc2>,
+ <&pinctrl_esdhc2_cdwp>;
+ vmmc-supply = <®_3p3v>;
+- wp-gpios = <&gpio1 2 0>;
+- cd-gpios = <&gpio1 4 0>;
++ wp-gpios = <&gpio1 2 GPIO_ACTIVE_HIGH>;
++ cd-gpios = <&gpio1 4 GPIO_ACTIVE_LOW>;
+ status = "disabled";
+ };
+
+diff --git a/arch/arm/boot/dts/imx53-tx53.dtsi b/arch/arm/boot/dts/imx53-tx53.dtsi
+index 704bd72cbfec..d3e50b22064f 100644
+--- a/arch/arm/boot/dts/imx53-tx53.dtsi
++++ b/arch/arm/boot/dts/imx53-tx53.dtsi
+@@ -183,7 +183,7 @@
+ };
+
+ &esdhc1 {
+- cd-gpios = <&gpio3 24 GPIO_ACTIVE_HIGH>;
++ cd-gpios = <&gpio3 24 GPIO_ACTIVE_LOW>;
+ fsl,wp-controller;
+ pinctrl-names = "default";
+ pinctrl-0 = <&pinctrl_esdhc1>;
+@@ -191,7 +191,7 @@
+ };
+
+ &esdhc2 {
+- cd-gpios = <&gpio3 25 GPIO_ACTIVE_HIGH>;
++ cd-gpios = <&gpio3 25 GPIO_ACTIVE_LOW>;
+ fsl,wp-controller;
+ pinctrl-names = "default";
+ pinctrl-0 = <&pinctrl_esdhc2>;
+diff --git a/arch/arm/boot/dts/imx53-voipac-bsb.dts b/arch/arm/boot/dts/imx53-voipac-bsb.dts
+index c17d3ad6dba5..fc51b87ad208 100644
+--- a/arch/arm/boot/dts/imx53-voipac-bsb.dts
++++ b/arch/arm/boot/dts/imx53-voipac-bsb.dts
+@@ -119,8 +119,8 @@
+ &esdhc2 {
+ pinctrl-names = "default";
+ pinctrl-0 = <&pinctrl_esdhc2>;
+- cd-gpios = <&gpio3 25 0>;
+- wp-gpios = <&gpio2 19 0>;
++ cd-gpios = <&gpio3 25 GPIO_ACTIVE_LOW>;
++ wp-gpios = <&gpio2 19 GPIO_ACTIVE_HIGH>;
+ vmmc-supply = <®_3p3v>;
+ status = "okay";
+ };
+diff --git a/arch/arm/boot/dts/imx6qdl-rex.dtsi b/arch/arm/boot/dts/imx6qdl-rex.dtsi
+index df7bcf86c156..4b5e8c87e53f 100644
+--- a/arch/arm/boot/dts/imx6qdl-rex.dtsi
++++ b/arch/arm/boot/dts/imx6qdl-rex.dtsi
+@@ -35,7 +35,6 @@
+ compatible = "regulator-fixed";
+ reg = <1>;
+ pinctrl-names = "default";
+- pinctrl-0 = <&pinctrl_usbh1>;
+ regulator-name = "usbh1_vbus";
+ regulator-min-microvolt = <5000000>;
+ regulator-max-microvolt = <5000000>;
+@@ -47,7 +46,6 @@
+ compatible = "regulator-fixed";
+ reg = <2>;
+ pinctrl-names = "default";
+- pinctrl-0 = <&pinctrl_usbotg>;
+ regulator-name = "usb_otg_vbus";
+ regulator-min-microvolt = <5000000>;
+ regulator-max-microvolt = <5000000>;
+diff --git a/arch/arm/boot/dts/omap3-beagle.dts b/arch/arm/boot/dts/omap3-beagle.dts
+index a9aae88b74f5..bd603aa2cd82 100644
+--- a/arch/arm/boot/dts/omap3-beagle.dts
++++ b/arch/arm/boot/dts/omap3-beagle.dts
+@@ -176,7 +176,7 @@
+
+ tfp410_pins: pinmux_tfp410_pins {
+ pinctrl-single,pins = <
+- 0x194 (PIN_OUTPUT | MUX_MODE4) /* hdq_sio.gpio_170 */
++ 0x196 (PIN_OUTPUT | MUX_MODE4) /* hdq_sio.gpio_170 */
+ >;
+ };
+
+diff --git a/arch/arm/boot/dts/omap5-uevm.dts b/arch/arm/boot/dts/omap5-uevm.dts
+index 159720d6c956..ec23e86e7e4f 100644
+--- a/arch/arm/boot/dts/omap5-uevm.dts
++++ b/arch/arm/boot/dts/omap5-uevm.dts
+@@ -174,8 +174,8 @@
+
+ i2c5_pins: pinmux_i2c5_pins {
+ pinctrl-single,pins = <
+- 0x184 (PIN_INPUT | MUX_MODE0) /* i2c5_scl */
+- 0x186 (PIN_INPUT | MUX_MODE0) /* i2c5_sda */
++ 0x186 (PIN_INPUT | MUX_MODE0) /* i2c5_scl */
++ 0x188 (PIN_INPUT | MUX_MODE0) /* i2c5_sda */
+ >;
+ };
+
+diff --git a/arch/arm/kernel/signal.c b/arch/arm/kernel/signal.c
+index bd1983437205..ea6d69125dde 100644
+--- a/arch/arm/kernel/signal.c
++++ b/arch/arm/kernel/signal.c
+@@ -354,12 +354,17 @@ setup_return(struct pt_regs *regs, struct ksignal *ksig,
+ */
+ thumb = handler & 1;
+
+-#if __LINUX_ARM_ARCH__ >= 7
++#if __LINUX_ARM_ARCH__ >= 6
+ /*
+- * Clear the If-Then Thumb-2 execution state
+- * ARM spec requires this to be all 000s in ARM mode
+- * Snapdragon S4/Krait misbehaves on a Thumb=>ARM
+- * signal transition without this.
++ * Clear the If-Then Thumb-2 execution state. ARM spec
++ * requires this to be all 000s in ARM mode. Snapdragon
++ * S4/Krait misbehaves on a Thumb=>ARM signal transition
++ * without this.
++ *
++ * We must do this whenever we are running on a Thumb-2
++ * capable CPU, which includes ARMv6T2. However, we elect
++ * to do this whenever we're on an ARMv6 or later CPU for
++ * simplicity.
+ */
+ cpsr &= ~PSR_IT_MASK;
+ #endif
+diff --git a/arch/arm/kvm/mmu.c b/arch/arm/kvm/mmu.c
+index cba52cf6ed3f..3535480e0e6b 100644
+--- a/arch/arm/kvm/mmu.c
++++ b/arch/arm/kvm/mmu.c
+@@ -1439,8 +1439,10 @@ int kvm_arch_prepare_memory_region(struct kvm *kvm,
+ if (vma->vm_flags & VM_PFNMAP) {
+ gpa_t gpa = mem->guest_phys_addr +
+ (vm_start - mem->userspace_addr);
+- phys_addr_t pa = (vma->vm_pgoff << PAGE_SHIFT) +
+- vm_start - vma->vm_start;
++ phys_addr_t pa;
++
++ pa = (phys_addr_t)vma->vm_pgoff << PAGE_SHIFT;
++ pa += vm_start - vma->vm_start;
+
+ ret = kvm_phys_addr_ioremap(kvm, gpa, pa,
+ vm_end - vm_start,
+diff --git a/arch/arm/mach-omap2/clockdomains7xx_data.c b/arch/arm/mach-omap2/clockdomains7xx_data.c
+index 57d5df0c1fbd..7581e036bda6 100644
+--- a/arch/arm/mach-omap2/clockdomains7xx_data.c
++++ b/arch/arm/mach-omap2/clockdomains7xx_data.c
+@@ -331,7 +331,7 @@ static struct clockdomain l4per2_7xx_clkdm = {
+ .dep_bit = DRA7XX_L4PER2_STATDEP_SHIFT,
+ .wkdep_srcs = l4per2_wkup_sleep_deps,
+ .sleepdep_srcs = l4per2_wkup_sleep_deps,
+- .flags = CLKDM_CAN_HWSUP_SWSUP,
++ .flags = CLKDM_CAN_SWSUP,
+ };
+
+ static struct clockdomain mpu0_7xx_clkdm = {
+diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
+index dc2d66cdf311..00b9c4870230 100644
+--- a/arch/arm64/Kconfig
++++ b/arch/arm64/Kconfig
+@@ -91,6 +91,10 @@ config NO_IOPORT_MAP
+ config STACKTRACE_SUPPORT
+ def_bool y
+
++config ILLEGAL_POINTER_VALUE
++ hex
++ default 0xdead000000000000
++
+ config LOCKDEP_SUPPORT
+ def_bool y
+
+@@ -575,6 +579,22 @@ source "drivers/cpuidle/Kconfig"
+
+ source "drivers/cpufreq/Kconfig"
+
++config ARM64_ERRATUM_843419
++ bool "Cortex-A53: 843419: A load or store might access an incorrect address"
++ depends on MODULES
++ default y
++ help
++ This option builds kernel modules using the large memory model in
++ order to avoid the use of the ADRP instruction, which can cause
++ a subsequent memory access to use an incorrect address on Cortex-A53
++ parts up to r0p4.
++
++ Note that the kernel itself must be linked with a version of ld
++ which fixes potentially affected ADRP instructions through the
++ use of veneers.
++
++ If unsure, say Y.
++
+ endmenu
+
+ source "net/Kconfig"
+diff --git a/arch/arm64/Makefile b/arch/arm64/Makefile
+index 20901ffed182..e7391aef5433 100644
+--- a/arch/arm64/Makefile
++++ b/arch/arm64/Makefile
+@@ -32,6 +32,10 @@ endif
+
+ CHECKFLAGS += -D__aarch64__
+
++ifeq ($(CONFIG_ARM64_ERRATUM_843419), y)
++CFLAGS_MODULE += -mcmodel=large
++endif
++
+ # Default value
+ head-y := arch/arm64/kernel/head.o
+
+diff --git a/arch/arm64/kernel/entry-ftrace.S b/arch/arm64/kernel/entry-ftrace.S
+index 38e704e597f7..c85a02b6cca0 100644
+--- a/arch/arm64/kernel/entry-ftrace.S
++++ b/arch/arm64/kernel/entry-ftrace.S
+@@ -177,6 +177,24 @@ ENTRY(ftrace_stub)
+ ENDPROC(ftrace_stub)
+
+ #ifdef CONFIG_FUNCTION_GRAPH_TRACER
++ /* save return value regs*/
++ .macro save_return_regs
++ sub sp, sp, #64
++ stp x0, x1, [sp]
++ stp x2, x3, [sp, #16]
++ stp x4, x5, [sp, #32]
++ stp x6, x7, [sp, #48]
++ .endm
++
++ /* restore return value regs*/
++ .macro restore_return_regs
++ ldp x0, x1, [sp]
++ ldp x2, x3, [sp, #16]
++ ldp x4, x5, [sp, #32]
++ ldp x6, x7, [sp, #48]
++ add sp, sp, #64
++ .endm
++
+ /*
+ * void ftrace_graph_caller(void)
+ *
+@@ -203,11 +221,11 @@ ENDPROC(ftrace_graph_caller)
+ * only when CONFIG_HAVE_FUNCTION_GRAPH_FP_TEST is enabled.
+ */
+ ENTRY(return_to_handler)
+- str x0, [sp, #-16]!
++ save_return_regs
+ mov x0, x29 // parent's fp
+ bl ftrace_return_to_handler// addr = ftrace_return_to_hander(fp);
+ mov x30, x0 // restore the original return address
+- ldr x0, [sp], #16
++ restore_return_regs
+ ret
+ END(return_to_handler)
+ #endif /* CONFIG_FUNCTION_GRAPH_TRACER */
+diff --git a/arch/arm64/kernel/head.S b/arch/arm64/kernel/head.S
+index 0a6e4f924df8..2877dd818977 100644
+--- a/arch/arm64/kernel/head.S
++++ b/arch/arm64/kernel/head.S
+@@ -327,6 +327,11 @@ CPU_LE( movk x0, #0x30d0, lsl #16 ) // Clear EE and E0E on LE systems
+ msr hstr_el2, xzr // Disable CP15 traps to EL2
+ #endif
+
++ /* EL2 debug */
++ mrs x0, pmcr_el0 // Disable debug access traps
++ ubfx x0, x0, #11, #5 // to EL2 and allow access to
++ msr mdcr_el2, x0 // all PMU counters from EL1
++
+ /* Stage-2 translation */
+ msr vttbr_el2, xzr
+
+diff --git a/arch/arm64/kernel/module.c b/arch/arm64/kernel/module.c
+index 1eb1cc955139..e366329d96d8 100644
+--- a/arch/arm64/kernel/module.c
++++ b/arch/arm64/kernel/module.c
+@@ -330,12 +330,14 @@ int apply_relocate_add(Elf64_Shdr *sechdrs,
+ ovf = reloc_insn_imm(RELOC_OP_PREL, loc, val, 0, 21,
+ AARCH64_INSN_IMM_ADR);
+ break;
++#ifndef CONFIG_ARM64_ERRATUM_843419
+ case R_AARCH64_ADR_PREL_PG_HI21_NC:
+ overflow_check = false;
+ case R_AARCH64_ADR_PREL_PG_HI21:
+ ovf = reloc_insn_imm(RELOC_OP_PAGE, loc, val, 12, 21,
+ AARCH64_INSN_IMM_ADR);
+ break;
++#endif
+ case R_AARCH64_ADD_ABS_LO12_NC:
+ case R_AARCH64_LDST8_ABS_LO12_NC:
+ overflow_check = false;
+diff --git a/arch/arm64/kernel/signal32.c b/arch/arm64/kernel/signal32.c
+index b4efc2e38336..15dd021b0025 100644
+--- a/arch/arm64/kernel/signal32.c
++++ b/arch/arm64/kernel/signal32.c
+@@ -206,14 +206,32 @@ int copy_siginfo_from_user32(siginfo_t *to, compat_siginfo_t __user *from)
+
+ /*
+ * VFP save/restore code.
++ *
++ * We have to be careful with endianness, since the fpsimd context-switch
++ * code operates on 128-bit (Q) register values whereas the compat ABI
++ * uses an array of 64-bit (D) registers. Consequently, we need to swap
++ * the two halves of each Q register when running on a big-endian CPU.
+ */
++union __fpsimd_vreg {
++ __uint128_t raw;
++ struct {
++#ifdef __AARCH64EB__
++ u64 hi;
++ u64 lo;
++#else
++ u64 lo;
++ u64 hi;
++#endif
++ };
++};
++
+ static int compat_preserve_vfp_context(struct compat_vfp_sigframe __user *frame)
+ {
+ struct fpsimd_state *fpsimd = ¤t->thread.fpsimd_state;
+ compat_ulong_t magic = VFP_MAGIC;
+ compat_ulong_t size = VFP_STORAGE_SIZE;
+ compat_ulong_t fpscr, fpexc;
+- int err = 0;
++ int i, err = 0;
+
+ /*
+ * Save the hardware registers to the fpsimd_state structure.
+@@ -229,10 +247,15 @@ static int compat_preserve_vfp_context(struct compat_vfp_sigframe __user *frame)
+ /*
+ * Now copy the FP registers. Since the registers are packed,
+ * we can copy the prefix we want (V0-V15) as it is.
+- * FIXME: Won't work if big endian.
+ */
+- err |= __copy_to_user(&frame->ufp.fpregs, fpsimd->vregs,
+- sizeof(frame->ufp.fpregs));
++ for (i = 0; i < ARRAY_SIZE(frame->ufp.fpregs); i += 2) {
++ union __fpsimd_vreg vreg = {
++ .raw = fpsimd->vregs[i >> 1],
++ };
++
++ __put_user_error(vreg.lo, &frame->ufp.fpregs[i], err);
++ __put_user_error(vreg.hi, &frame->ufp.fpregs[i + 1], err);
++ }
+
+ /* Create an AArch32 fpscr from the fpsr and the fpcr. */
+ fpscr = (fpsimd->fpsr & VFP_FPSCR_STAT_MASK) |
+@@ -257,7 +280,7 @@ static int compat_restore_vfp_context(struct compat_vfp_sigframe __user *frame)
+ compat_ulong_t magic = VFP_MAGIC;
+ compat_ulong_t size = VFP_STORAGE_SIZE;
+ compat_ulong_t fpscr;
+- int err = 0;
++ int i, err = 0;
+
+ __get_user_error(magic, &frame->magic, err);
+ __get_user_error(size, &frame->size, err);
+@@ -267,12 +290,14 @@ static int compat_restore_vfp_context(struct compat_vfp_sigframe __user *frame)
+ if (magic != VFP_MAGIC || size != VFP_STORAGE_SIZE)
+ return -EINVAL;
+
+- /*
+- * Copy the FP registers into the start of the fpsimd_state.
+- * FIXME: Won't work if big endian.
+- */
+- err |= __copy_from_user(fpsimd.vregs, frame->ufp.fpregs,
+- sizeof(frame->ufp.fpregs));
++ /* Copy the FP registers into the start of the fpsimd_state. */
++ for (i = 0; i < ARRAY_SIZE(frame->ufp.fpregs); i += 2) {
++ union __fpsimd_vreg vreg;
++
++ __get_user_error(vreg.lo, &frame->ufp.fpregs[i], err);
++ __get_user_error(vreg.hi, &frame->ufp.fpregs[i + 1], err);
++ fpsimd.vregs[i >> 1] = vreg.raw;
++ }
+
+ /* Extract the fpsr and the fpcr from the fpscr */
+ __get_user_error(fpscr, &frame->ufp.fpscr, err);
+diff --git a/arch/arm64/kvm/hyp.S b/arch/arm64/kvm/hyp.S
+index a767f6a4ce54..566a457d1803 100644
+--- a/arch/arm64/kvm/hyp.S
++++ b/arch/arm64/kvm/hyp.S
+@@ -843,8 +843,6 @@
+ mrs x3, cntv_ctl_el0
+ and x3, x3, #3
+ str w3, [x0, #VCPU_TIMER_CNTV_CTL]
+- bic x3, x3, #1 // Clear Enable
+- msr cntv_ctl_el0, x3
+
+ isb
+
+@@ -852,6 +850,9 @@
+ str x3, [x0, #VCPU_TIMER_CNTV_CVAL]
+
+ 1:
++ // Disable the virtual timer
++ msr cntv_ctl_el0, xzr
++
+ // Allow physical timer/counter access for the host
+ mrs x2, cnthctl_el2
+ orr x2, x2, #3
+diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c
+index 41cb6d3d6075..6094c64b3380 100644
+--- a/arch/arm64/mm/fault.c
++++ b/arch/arm64/mm/fault.c
+@@ -279,6 +279,7 @@ retry:
+ * starvation.
+ */
+ mm_flags &= ~FAULT_FLAG_ALLOW_RETRY;
++ mm_flags |= FAULT_FLAG_TRIED;
+ goto retry;
+ }
+ }
+diff --git a/arch/m68k/include/asm/linkage.h b/arch/m68k/include/asm/linkage.h
+index 5a822bb790f7..066e74f666ae 100644
+--- a/arch/m68k/include/asm/linkage.h
++++ b/arch/m68k/include/asm/linkage.h
+@@ -4,4 +4,34 @@
+ #define __ALIGN .align 4
+ #define __ALIGN_STR ".align 4"
+
++/*
++ * Make sure the compiler doesn't do anything stupid with the
++ * arguments on the stack - they are owned by the *caller*, not
++ * the callee. This just fools gcc into not spilling into them,
++ * and keeps it from doing tailcall recursion and/or using the
++ * stack slots for temporaries, since they are live and "used"
++ * all the way to the end of the function.
++ */
++#define asmlinkage_protect(n, ret, args...) \
++ __asmlinkage_protect##n(ret, ##args)
++#define __asmlinkage_protect_n(ret, args...) \
++ __asm__ __volatile__ ("" : "=r" (ret) : "0" (ret), ##args)
++#define __asmlinkage_protect0(ret) \
++ __asmlinkage_protect_n(ret)
++#define __asmlinkage_protect1(ret, arg1) \
++ __asmlinkage_protect_n(ret, "m" (arg1))
++#define __asmlinkage_protect2(ret, arg1, arg2) \
++ __asmlinkage_protect_n(ret, "m" (arg1), "m" (arg2))
++#define __asmlinkage_protect3(ret, arg1, arg2, arg3) \
++ __asmlinkage_protect_n(ret, "m" (arg1), "m" (arg2), "m" (arg3))
++#define __asmlinkage_protect4(ret, arg1, arg2, arg3, arg4) \
++ __asmlinkage_protect_n(ret, "m" (arg1), "m" (arg2), "m" (arg3), \
++ "m" (arg4))
++#define __asmlinkage_protect5(ret, arg1, arg2, arg3, arg4, arg5) \
++ __asmlinkage_protect_n(ret, "m" (arg1), "m" (arg2), "m" (arg3), \
++ "m" (arg4), "m" (arg5))
++#define __asmlinkage_protect6(ret, arg1, arg2, arg3, arg4, arg5, arg6) \
++ __asmlinkage_protect_n(ret, "m" (arg1), "m" (arg2), "m" (arg3), \
++ "m" (arg4), "m" (arg5), "m" (arg6))
++
+ #endif
+diff --git a/arch/mips/mm/dma-default.c b/arch/mips/mm/dma-default.c
+index 33ba3c558fe4..027ad1f24e32 100644
+--- a/arch/mips/mm/dma-default.c
++++ b/arch/mips/mm/dma-default.c
+@@ -95,7 +95,7 @@ static gfp_t massage_gfp_flags(const struct device *dev, gfp_t gfp)
+ else
+ #endif
+ #if defined(CONFIG_ZONE_DMA) && !defined(CONFIG_ZONE_DMA32)
+- if (dev->coherent_dma_mask < DMA_BIT_MASK(64))
++ if (dev->coherent_dma_mask < DMA_BIT_MASK(sizeof(phys_addr_t) * 8))
+ dma_flag = __GFP_DMA;
+ else
+ #endif
+diff --git a/arch/parisc/kernel/irq.c b/arch/parisc/kernel/irq.c
+index cfe056fe7f5c..34f06be569d9 100644
+--- a/arch/parisc/kernel/irq.c
++++ b/arch/parisc/kernel/irq.c
+@@ -507,8 +507,8 @@ void do_cpu_irq_mask(struct pt_regs *regs)
+ struct pt_regs *old_regs;
+ unsigned long eirr_val;
+ int irq, cpu = smp_processor_id();
+-#ifdef CONFIG_SMP
+ struct irq_desc *desc;
++#ifdef CONFIG_SMP
+ cpumask_t dest;
+ #endif
+
+@@ -521,8 +521,12 @@ void do_cpu_irq_mask(struct pt_regs *regs)
+ goto set_out;
+ irq = eirr_to_irq(eirr_val);
+
+-#ifdef CONFIG_SMP
++ /* Filter out spurious interrupts, mostly from serial port at bootup */
+ desc = irq_to_desc(irq);
++ if (unlikely(!desc->action))
++ goto set_out;
++
++#ifdef CONFIG_SMP
+ cpumask_copy(&dest, desc->irq_data.affinity);
+ if (irqd_is_per_cpu(&desc->irq_data) &&
+ !cpu_isset(smp_processor_id(), dest)) {
+diff --git a/arch/parisc/kernel/syscall.S b/arch/parisc/kernel/syscall.S
+index 7ef22e3387e0..0b8d26d3ba43 100644
+--- a/arch/parisc/kernel/syscall.S
++++ b/arch/parisc/kernel/syscall.S
+@@ -821,7 +821,7 @@ cas2_action:
+ /* 64bit CAS */
+ #ifdef CONFIG_64BIT
+ 19: ldd,ma 0(%sr3,%r26), %r29
+- sub,= %r29, %r25, %r0
++ sub,*= %r29, %r25, %r0
+ b,n cas2_end
+ 20: std,ma %r24, 0(%sr3,%r26)
+ copy %r0, %r28
+diff --git a/arch/powerpc/include/asm/pgtable-ppc64.h b/arch/powerpc/include/asm/pgtable-ppc64.h
+index ae153c40ab7c..daf4add50743 100644
+--- a/arch/powerpc/include/asm/pgtable-ppc64.h
++++ b/arch/powerpc/include/asm/pgtable-ppc64.h
+@@ -135,7 +135,19 @@
+ #define pte_iterate_hashed_end() } while(0)
+
+ #ifdef CONFIG_PPC_HAS_HASH_64K
+-#define pte_pagesize_index(mm, addr, pte) get_slice_psize(mm, addr)
++/*
++ * We expect this to be called only for user addresses or kernel virtual
++ * addresses other than the linear mapping.
++ */
++#define pte_pagesize_index(mm, addr, pte) \
++ ({ \
++ unsigned int psize; \
++ if (is_kernel_addr(addr)) \
++ psize = MMU_PAGE_4K; \
++ else \
++ psize = get_slice_psize(mm, addr); \
++ psize; \
++ })
+ #else
+ #define pte_pagesize_index(mm, addr, pte) MMU_PAGE_4K
+ #endif
+diff --git a/arch/powerpc/include/asm/rtas.h b/arch/powerpc/include/asm/rtas.h
+index b390f55b0df1..af37e69b3b74 100644
+--- a/arch/powerpc/include/asm/rtas.h
++++ b/arch/powerpc/include/asm/rtas.h
+@@ -316,6 +316,7 @@ extern void rtas_power_off(void);
+ extern void rtas_halt(void);
+ extern void rtas_os_term(char *str);
+ extern int rtas_get_sensor(int sensor, int index, int *state);
++extern int rtas_get_sensor_fast(int sensor, int index, int *state);
+ extern int rtas_get_power_level(int powerdomain, int *level);
+ extern int rtas_set_power_level(int powerdomain, int level, int *setlevel);
+ extern bool rtas_indicator_present(int token, int *maxindex);
+diff --git a/arch/powerpc/kernel/rtas.c b/arch/powerpc/kernel/rtas.c
+index 8b4c857c1421..af0dafab5807 100644
+--- a/arch/powerpc/kernel/rtas.c
++++ b/arch/powerpc/kernel/rtas.c
+@@ -584,6 +584,23 @@ int rtas_get_sensor(int sensor, int index, int *state)
+ }
+ EXPORT_SYMBOL(rtas_get_sensor);
+
++int rtas_get_sensor_fast(int sensor, int index, int *state)
++{
++ int token = rtas_token("get-sensor-state");
++ int rc;
++
++ if (token == RTAS_UNKNOWN_SERVICE)
++ return -ENOENT;
++
++ rc = rtas_call(token, 2, 2, state, sensor, index);
++ WARN_ON(rc == RTAS_BUSY || (rc >= RTAS_EXTENDED_DELAY_MIN &&
++ rc <= RTAS_EXTENDED_DELAY_MAX));
++
++ if (rc < 0)
++ return rtas_error_rc(rc);
++ return rc;
++}
++
+ bool rtas_indicator_present(int token, int *maxindex)
+ {
+ int proplen, count, i;
+diff --git a/arch/powerpc/mm/hugepage-hash64.c b/arch/powerpc/mm/hugepage-hash64.c
+index 5f5e6328c21c..5061c6f676da 100644
+--- a/arch/powerpc/mm/hugepage-hash64.c
++++ b/arch/powerpc/mm/hugepage-hash64.c
+@@ -136,7 +136,6 @@ int __hash_page_thp(unsigned long ea, unsigned long access, unsigned long vsid,
+ BUG_ON(index >= 4096);
+
+ vpn = hpt_vpn(ea, vsid, ssize);
+- hash = hpt_hash(vpn, shift, ssize);
+ hpte_slot_array = get_hpte_slot_array(pmdp);
+ if (psize == MMU_PAGE_4K) {
+ /*
+@@ -151,6 +150,7 @@ int __hash_page_thp(unsigned long ea, unsigned long access, unsigned long vsid,
+ valid = hpte_valid(hpte_slot_array, index);
+ if (valid) {
+ /* update the hpte bits */
++ hash = hpt_hash(vpn, shift, ssize);
+ hidx = hpte_hash_index(hpte_slot_array, index);
+ if (hidx & _PTEIDX_SECONDARY)
+ hash = ~hash;
+@@ -176,6 +176,7 @@ int __hash_page_thp(unsigned long ea, unsigned long access, unsigned long vsid,
+ if (!valid) {
+ unsigned long hpte_group;
+
++ hash = hpt_hash(vpn, shift, ssize);
+ /* insert new entry */
+ pa = pmd_pfn(__pmd(old_pmd)) << PAGE_SHIFT;
+ new_pmd |= _PAGE_HASHPTE;
+diff --git a/arch/powerpc/platforms/powernv/pci.c b/arch/powerpc/platforms/powernv/pci.c
+index 4b20f2c6b3b2..9ff55d59ac76 100644
+--- a/arch/powerpc/platforms/powernv/pci.c
++++ b/arch/powerpc/platforms/powernv/pci.c
+@@ -100,6 +100,7 @@ static void pnv_teardown_msi_irqs(struct pci_dev *pdev)
+ struct pci_controller *hose = pci_bus_to_host(pdev->bus);
+ struct pnv_phb *phb = hose->private_data;
+ struct msi_desc *entry;
++ irq_hw_number_t hwirq;
+
+ if (WARN_ON(!phb))
+ return;
+@@ -107,10 +108,10 @@ static void pnv_teardown_msi_irqs(struct pci_dev *pdev)
+ list_for_each_entry(entry, &pdev->msi_list, list) {
+ if (entry->irq == NO_IRQ)
+ continue;
++ hwirq = virq_to_hw(entry->irq);
+ irq_set_msi_desc(entry->irq, NULL);
+- msi_bitmap_free_hwirqs(&phb->msi_bmp,
+- virq_to_hw(entry->irq) - phb->msi_base, 1);
+ irq_dispose_mapping(entry->irq);
++ msi_bitmap_free_hwirqs(&phb->msi_bmp, hwirq - phb->msi_base, 1);
+ }
+ }
+ #endif /* CONFIG_PCI_MSI */
+diff --git a/arch/powerpc/platforms/pseries/ras.c b/arch/powerpc/platforms/pseries/ras.c
+index 5a4d0fc03b03..d263f7bc80fc 100644
+--- a/arch/powerpc/platforms/pseries/ras.c
++++ b/arch/powerpc/platforms/pseries/ras.c
+@@ -187,7 +187,8 @@ static irqreturn_t ras_epow_interrupt(int irq, void *dev_id)
+ int state;
+ int critical;
+
+- status = rtas_get_sensor(EPOW_SENSOR_TOKEN, EPOW_SENSOR_INDEX, &state);
++ status = rtas_get_sensor_fast(EPOW_SENSOR_TOKEN, EPOW_SENSOR_INDEX,
++ &state);
+
+ if (state > 3)
+ critical = 1; /* Time Critical */
+diff --git a/arch/powerpc/sysdev/fsl_msi.c b/arch/powerpc/sysdev/fsl_msi.c
+index da08ed088157..ea6b3a1c79d8 100644
+--- a/arch/powerpc/sysdev/fsl_msi.c
++++ b/arch/powerpc/sysdev/fsl_msi.c
+@@ -129,15 +129,16 @@ static void fsl_teardown_msi_irqs(struct pci_dev *pdev)
+ {
+ struct msi_desc *entry;
+ struct fsl_msi *msi_data;
++ irq_hw_number_t hwirq;
+
+ list_for_each_entry(entry, &pdev->msi_list, list) {
+ if (entry->irq == NO_IRQ)
+ continue;
++ hwirq = virq_to_hw(entry->irq);
+ msi_data = irq_get_chip_data(entry->irq);
+ irq_set_msi_desc(entry->irq, NULL);
+- msi_bitmap_free_hwirqs(&msi_data->bitmap,
+- virq_to_hw(entry->irq), 1);
+ irq_dispose_mapping(entry->irq);
++ msi_bitmap_free_hwirqs(&msi_data->bitmap, hwirq, 1);
+ }
+
+ return;
+diff --git a/arch/powerpc/sysdev/mpic_pasemi_msi.c b/arch/powerpc/sysdev/mpic_pasemi_msi.c
+index 15dccd35fa11..a6add4ae6c5a 100644
+--- a/arch/powerpc/sysdev/mpic_pasemi_msi.c
++++ b/arch/powerpc/sysdev/mpic_pasemi_msi.c
+@@ -66,6 +66,7 @@ static struct irq_chip mpic_pasemi_msi_chip = {
+ static void pasemi_msi_teardown_msi_irqs(struct pci_dev *pdev)
+ {
+ struct msi_desc *entry;
++ irq_hw_number_t hwirq;
+
+ pr_debug("pasemi_msi_teardown_msi_irqs, pdev %p\n", pdev);
+
+@@ -73,10 +74,11 @@ static void pasemi_msi_teardown_msi_irqs(struct pci_dev *pdev)
+ if (entry->irq == NO_IRQ)
+ continue;
+
++ hwirq = virq_to_hw(entry->irq);
+ irq_set_msi_desc(entry->irq, NULL);
+- msi_bitmap_free_hwirqs(&msi_mpic->msi_bitmap,
+- virq_to_hw(entry->irq), ALLOC_CHUNK);
+ irq_dispose_mapping(entry->irq);
++ msi_bitmap_free_hwirqs(&msi_mpic->msi_bitmap,
++ hwirq, ALLOC_CHUNK);
+ }
+
+ return;
+diff --git a/arch/powerpc/sysdev/mpic_u3msi.c b/arch/powerpc/sysdev/mpic_u3msi.c
+index 623d7fba15b4..db35a4073127 100644
+--- a/arch/powerpc/sysdev/mpic_u3msi.c
++++ b/arch/powerpc/sysdev/mpic_u3msi.c
+@@ -108,15 +108,16 @@ static u64 find_u4_magic_addr(struct pci_dev *pdev, unsigned int hwirq)
+ static void u3msi_teardown_msi_irqs(struct pci_dev *pdev)
+ {
+ struct msi_desc *entry;
++ irq_hw_number_t hwirq;
+
+ list_for_each_entry(entry, &pdev->msi_list, list) {
+ if (entry->irq == NO_IRQ)
+ continue;
+
++ hwirq = virq_to_hw(entry->irq);
+ irq_set_msi_desc(entry->irq, NULL);
+- msi_bitmap_free_hwirqs(&msi_mpic->msi_bitmap,
+- virq_to_hw(entry->irq), 1);
+ irq_dispose_mapping(entry->irq);
++ msi_bitmap_free_hwirqs(&msi_mpic->msi_bitmap, hwirq, 1);
+ }
+
+ return;
+diff --git a/arch/powerpc/sysdev/ppc4xx_msi.c b/arch/powerpc/sysdev/ppc4xx_msi.c
+index 22b5200636e7..85d9c1852d19 100644
+--- a/arch/powerpc/sysdev/ppc4xx_msi.c
++++ b/arch/powerpc/sysdev/ppc4xx_msi.c
+@@ -125,16 +125,17 @@ void ppc4xx_teardown_msi_irqs(struct pci_dev *dev)
+ {
+ struct msi_desc *entry;
+ struct ppc4xx_msi *msi_data = &ppc4xx_msi;
++ irq_hw_number_t hwirq;
+
+ dev_dbg(&dev->dev, "PCIE-MSI: tearing down msi irqs\n");
+
+ list_for_each_entry(entry, &dev->msi_list, list) {
+ if (entry->irq == NO_IRQ)
+ continue;
++ hwirq = virq_to_hw(entry->irq);
+ irq_set_msi_desc(entry->irq, NULL);
+- msi_bitmap_free_hwirqs(&msi_data->bitmap,
+- virq_to_hw(entry->irq), 1);
+ irq_dispose_mapping(entry->irq);
++ msi_bitmap_free_hwirqs(&msi_data->bitmap, hwirq, 1);
+ }
+ }
+
+diff --git a/arch/s390/boot/compressed/Makefile b/arch/s390/boot/compressed/Makefile
+index f90d1fc6d603..f70b2321071e 100644
+--- a/arch/s390/boot/compressed/Makefile
++++ b/arch/s390/boot/compressed/Makefile
+@@ -12,7 +12,7 @@ targets += misc.o piggy.o sizes.h head$(BITS).o
+
+ KBUILD_CFLAGS := -m$(BITS) -D__KERNEL__ $(LINUX_INCLUDE) -O2
+ KBUILD_CFLAGS += -DDISABLE_BRANCH_PROFILING
+-KBUILD_CFLAGS += $(cflags-y) -fno-delete-null-pointer-checks
++KBUILD_CFLAGS += $(cflags-y) -fno-delete-null-pointer-checks -msoft-float
+ KBUILD_CFLAGS += $(call cc-option,-mpacked-stack)
+ KBUILD_CFLAGS += $(call cc-option,-ffreestanding)
+
+diff --git a/arch/s390/kernel/compat_signal.c b/arch/s390/kernel/compat_signal.c
+index 009f5eb11125..14c3e80e003a 100644
+--- a/arch/s390/kernel/compat_signal.c
++++ b/arch/s390/kernel/compat_signal.c
+@@ -48,6 +48,19 @@ typedef struct
+ struct ucontext32 uc;
+ } rt_sigframe32;
+
++static inline void sigset_to_sigset32(unsigned long *set64,
++ compat_sigset_word *set32)
++{
++ set32[0] = (compat_sigset_word) set64[0];
++ set32[1] = (compat_sigset_word)(set64[0] >> 32);
++}
++
++static inline void sigset32_to_sigset(compat_sigset_word *set32,
++ unsigned long *set64)
++{
++ set64[0] = (unsigned long) set32[0] | ((unsigned long) set32[1] << 32);
++}
++
+ int copy_siginfo_to_user32(compat_siginfo_t __user *to, const siginfo_t *from)
+ {
+ int err;
+@@ -303,10 +316,12 @@ COMPAT_SYSCALL_DEFINE0(sigreturn)
+ {
+ struct pt_regs *regs = task_pt_regs(current);
+ sigframe32 __user *frame = (sigframe32 __user *)regs->gprs[15];
++ compat_sigset_t cset;
+ sigset_t set;
+
+- if (__copy_from_user(&set.sig, &frame->sc.oldmask, _SIGMASK_COPY_SIZE32))
++ if (__copy_from_user(&cset.sig, &frame->sc.oldmask, _SIGMASK_COPY_SIZE32))
+ goto badframe;
++ sigset32_to_sigset(cset.sig, set.sig);
+ set_current_blocked(&set);
+ if (restore_sigregs32(regs, &frame->sregs))
+ goto badframe;
+@@ -323,10 +338,12 @@ COMPAT_SYSCALL_DEFINE0(rt_sigreturn)
+ {
+ struct pt_regs *regs = task_pt_regs(current);
+ rt_sigframe32 __user *frame = (rt_sigframe32 __user *)regs->gprs[15];
++ compat_sigset_t cset;
+ sigset_t set;
+
+- if (__copy_from_user(&set, &frame->uc.uc_sigmask, sizeof(set)))
++ if (__copy_from_user(&cset, &frame->uc.uc_sigmask, sizeof(cset)))
+ goto badframe;
++ sigset32_to_sigset(cset.sig, set.sig);
+ set_current_blocked(&set);
+ if (compat_restore_altstack(&frame->uc.uc_stack))
+ goto badframe;
+@@ -407,7 +424,7 @@ static int setup_frame32(struct ksignal *ksig, sigset_t *set,
+ return -EFAULT;
+
+ /* Create struct sigcontext32 on the signal stack */
+- memcpy(&sc.oldmask, &set->sig, _SIGMASK_COPY_SIZE32);
++ sigset_to_sigset32(set->sig, sc.oldmask);
+ sc.sregs = (__u32)(unsigned long __force) &frame->sregs;
+ if (__copy_to_user(&frame->sc, &sc, sizeof(frame->sc)))
+ return -EFAULT;
+@@ -468,6 +485,7 @@ static int setup_frame32(struct ksignal *ksig, sigset_t *set,
+ static int setup_rt_frame32(struct ksignal *ksig, sigset_t *set,
+ struct pt_regs *regs)
+ {
++ compat_sigset_t cset;
+ rt_sigframe32 __user *frame;
+ unsigned long restorer;
+ size_t frame_size;
+@@ -515,11 +533,12 @@ static int setup_rt_frame32(struct ksignal *ksig, sigset_t *set,
+ store_sigregs();
+
+ /* Create ucontext on the signal stack. */
++ sigset_to_sigset32(set->sig, cset.sig);
+ if (__put_user(uc_flags, &frame->uc.uc_flags) ||
+ __put_user(0, &frame->uc.uc_link) ||
+ __compat_save_altstack(&frame->uc.uc_stack, regs->gprs[15]) ||
+ save_sigregs32(regs, &frame->uc.uc_mcontext) ||
+- __copy_to_user(&frame->uc.uc_sigmask, set, sizeof(*set)) ||
++ __copy_to_user(&frame->uc.uc_sigmask, &cset, sizeof(cset)) ||
+ save_sigregs_ext32(regs, &frame->uc.uc_mcontext_ext))
+ return -EFAULT;
+
+diff --git a/arch/x86/crypto/ghash-clmulni-intel_glue.c b/arch/x86/crypto/ghash-clmulni-intel_glue.c
+index 8253d85aa165..de1d72e3ec59 100644
+--- a/arch/x86/crypto/ghash-clmulni-intel_glue.c
++++ b/arch/x86/crypto/ghash-clmulni-intel_glue.c
+@@ -291,6 +291,7 @@ static struct ahash_alg ghash_async_alg = {
+ .cra_name = "ghash",
+ .cra_driver_name = "ghash-clmulni",
+ .cra_priority = 400,
++ .cra_ctxsize = sizeof(struct ghash_async_ctx),
+ .cra_flags = CRYPTO_ALG_TYPE_AHASH | CRYPTO_ALG_ASYNC,
+ .cra_blocksize = GHASH_BLOCK_SIZE,
+ .cra_type = &crypto_ahash_type,
+diff --git a/arch/x86/include/asm/processor.h b/arch/x86/include/asm/processor.h
+index ddd8d13a010f..26d5e05a7def 100644
+--- a/arch/x86/include/asm/processor.h
++++ b/arch/x86/include/asm/processor.h
+@@ -852,7 +852,8 @@ extern unsigned long thread_saved_pc(struct task_struct *tsk);
+ #define task_pt_regs(task) \
+ ({ \
+ struct pt_regs *__regs__; \
+- __regs__ = (struct pt_regs *)(KSTK_TOP(task_stack_page(task))-8); \
++ __regs__ = (struct pt_regs *)(KSTK_TOP(task_stack_page(task)) - \
++ TOP_OF_KERNEL_STACK_PADDING); \
+ __regs__ - 1; \
+ })
+
+diff --git a/arch/x86/include/asm/thread_info.h b/arch/x86/include/asm/thread_info.h
+index 547e344a6dc6..c4d96943e666 100644
+--- a/arch/x86/include/asm/thread_info.h
++++ b/arch/x86/include/asm/thread_info.h
+@@ -13,6 +13,33 @@
+ #include <asm/types.h>
+
+ /*
++ * TOP_OF_KERNEL_STACK_PADDING is a number of unused bytes that we
++ * reserve at the top of the kernel stack. We do it because of a nasty
++ * 32-bit corner case. On x86_32, the hardware stack frame is
++ * variable-length. Except for vm86 mode, struct pt_regs assumes a
++ * maximum-length frame. If we enter from CPL 0, the top 8 bytes of
++ * pt_regs don't actually exist. Ordinarily this doesn't matter, but it
++ * does in at least one case:
++ *
++ * If we take an NMI early enough in SYSENTER, then we can end up with
++ * pt_regs that extends above sp0. On the way out, in the espfix code,
++ * we can read the saved SS value, but that value will be above sp0.
++ * Without this offset, that can result in a page fault. (We are
++ * careful that, in this case, the value we read doesn't matter.)
++ *
++ * In vm86 mode, the hardware frame is much longer still, but we neither
++ * access the extra members from NMI context, nor do we write such a
++ * frame at sp0 at all.
++ *
++ * x86_64 has a fixed-length stack frame.
++ */
++#ifdef CONFIG_X86_32
++# define TOP_OF_KERNEL_STACK_PADDING 8
++#else
++# define TOP_OF_KERNEL_STACK_PADDING 0
++#endif
++
++/*
+ * low level task data that entry.S needs immediate access to
+ * - this struct should fit entirely inside of one cache line
+ * - this struct shares the supervisor stack pages
+diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c
+index ba6cc041edb1..f7eef03fd4b3 100644
+--- a/arch/x86/kernel/apic/apic.c
++++ b/arch/x86/kernel/apic/apic.c
+@@ -366,6 +366,13 @@ static void __setup_APIC_LVTT(unsigned int clocks, int oneshot, int irqen)
+ apic_write(APIC_LVTT, lvtt_value);
+
+ if (lvtt_value & APIC_LVT_TIMER_TSCDEADLINE) {
++ /*
++ * See Intel SDM: TSC-Deadline Mode chapter. In xAPIC mode,
++ * writing to the APIC LVTT and TSC_DEADLINE MSR isn't serialized.
++ * According to Intel, MFENCE can do the serialization here.
++ */
++ asm volatile("mfence" : : : "memory");
++
+ printk_once(KERN_DEBUG "TSC deadline timer enabled\n");
+ return;
+ }
+diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
+index e757fcbe90db..88635b301694 100644
+--- a/arch/x86/kernel/cpu/common.c
++++ b/arch/x86/kernel/cpu/common.c
+@@ -1405,6 +1405,12 @@ void cpu_init(void)
+
+ wait_for_master_cpu(cpu);
+
++ /*
++ * Initialize the CR4 shadow before doing anything that could
++ * try to read it.
++ */
++ cr4_init_shadow();
++
+ show_ucode_info_early();
+
+ printk(KERN_INFO "Initializing CPU#%d\n", cpu);
+diff --git a/arch/x86/kernel/crash.c b/arch/x86/kernel/crash.c
+index f5ab56d14287..3af40315a127 100644
+--- a/arch/x86/kernel/crash.c
++++ b/arch/x86/kernel/crash.c
+@@ -183,10 +183,9 @@ void native_machine_crash_shutdown(struct pt_regs *regs)
+ }
+
+ #ifdef CONFIG_KEXEC_FILE
+-static int get_nr_ram_ranges_callback(unsigned long start_pfn,
+- unsigned long nr_pfn, void *arg)
++static int get_nr_ram_ranges_callback(u64 start, u64 end, void *arg)
+ {
+- int *nr_ranges = arg;
++ unsigned int *nr_ranges = arg;
+
+ (*nr_ranges)++;
+ return 0;
+@@ -212,7 +211,7 @@ static void fill_up_crash_elf_data(struct crash_elf_data *ced,
+
+ ced->image = image;
+
+- walk_system_ram_range(0, -1, &nr_ranges,
++ walk_system_ram_res(0, -1, &nr_ranges,
+ get_nr_ram_ranges_callback);
+
+ ced->max_nr_ranges = nr_ranges;
+diff --git a/arch/x86/kernel/entry_32.S b/arch/x86/kernel/entry_32.S
+index 3dddb89ba320..fe611c4ae3ff 100644
+--- a/arch/x86/kernel/entry_32.S
++++ b/arch/x86/kernel/entry_32.S
+@@ -398,7 +398,7 @@ sysenter_past_esp:
+ * A tiny bit of offset fixup is necessary - 4*4 means the 4 words
+ * pushed above; +8 corresponds to copy_thread's esp0 setting.
+ */
+- pushl_cfi ((TI_sysenter_return)-THREAD_SIZE+8+4*4)(%esp)
++ pushl_cfi ((TI_sysenter_return)-THREAD_SIZE+TOP_OF_KERNEL_STACK_PADDING+4*4)(%esp)
+ CFI_REL_OFFSET eip, 0
+
+ pushl_cfi %eax
+diff --git a/arch/x86/kernel/entry_64.S b/arch/x86/kernel/entry_64.S
+index fad5cd9d7c4b..a3255ca219ea 100644
+--- a/arch/x86/kernel/entry_64.S
++++ b/arch/x86/kernel/entry_64.S
+@@ -1428,7 +1428,18 @@ END(error_exit)
+ /* runs on exception stack */
+ ENTRY(nmi)
+ INTR_FRAME
++ /*
++ * Fix up the exception frame if we're on Xen.
++ * PARAVIRT_ADJUST_EXCEPTION_FRAME is guaranteed to push at most
++ * one value to the stack on native, so it may clobber the rdx
++ * scratch slot, but it won't clobber any of the important
++ * slots past it.
++ *
++ * Xen is a different story, because the Xen frame itself overlaps
++ * the "NMI executing" variable.
++ */
+ PARAVIRT_ADJUST_EXCEPTION_FRAME
++
+ /*
+ * We allow breakpoints in NMIs. If a breakpoint occurs, then
+ * the iretq it performs will take us out of NMI context.
+@@ -1446,11 +1457,12 @@ ENTRY(nmi)
+ * If the variable is not set and the stack is not the NMI
+ * stack then:
+ * o Set the special variable on the stack
+- * o Copy the interrupt frame into a "saved" location on the stack
+- * o Copy the interrupt frame into a "copy" location on the stack
++ * o Copy the interrupt frame into an "outermost" location on the
++ * stack
++ * o Copy the interrupt frame into an "iret" location on the stack
+ * o Continue processing the NMI
+ * If the variable is set or the previous stack is the NMI stack:
+- * o Modify the "copy" location to jump to the repeate_nmi
++ * o Modify the "iret" location to jump to the repeat_nmi
+ * o return back to the first NMI
+ *
+ * Now on exit of the first NMI, we first clear the stack variable
+@@ -1479,9 +1491,11 @@ ENTRY(nmi)
+ * we don't want to enable interrupts, because then we'll end
+ * up in an awkward situation in which IRQs are on but NMIs
+ * are off.
++ *
++ * We also must not push anything to the stack before switching
++ * stacks lest we corrupt the "NMI executing" variable.
+ */
+-
+- SWAPGS
++ SWAPGS_UNSAFE_STACK
+ cld
+ movq %rsp, %rdx
+ movq PER_CPU_VAR(kernel_stack), %rsp
+@@ -1530,38 +1544,101 @@ ENTRY(nmi)
+
+ .Lnmi_from_kernel:
+ /*
+- * Check the special variable on the stack to see if NMIs are
+- * executing.
++ * Here's what our stack frame will look like:
++ * +---------------------------------------------------------+
++ * | original SS |
++ * | original Return RSP |
++ * | original RFLAGS |
++ * | original CS |
++ * | original RIP |
++ * +---------------------------------------------------------+
++ * | temp storage for rdx |
++ * +---------------------------------------------------------+
++ * | "NMI executing" variable |
++ * +---------------------------------------------------------+
++ * | iret SS } Copied from "outermost" frame |
++ * | iret Return RSP } on each loop iteration; overwritten |
++ * | iret RFLAGS } by a nested NMI to force another |
++ * | iret CS } iteration if needed. |
++ * | iret RIP } |
++ * +---------------------------------------------------------+
++ * | outermost SS } initialized in first_nmi; |
++ * | outermost Return RSP } will not be changed before |
++ * | outermost RFLAGS } NMI processing is done. |
++ * | outermost CS } Copied to "iret" frame on each |
++ * | outermost RIP } iteration. |
++ * +---------------------------------------------------------+
++ * | pt_regs |
++ * +---------------------------------------------------------+
++ *
++ * The "original" frame is used by hardware. Before re-enabling
++ * NMIs, we need to be done with it, and we need to leave enough
++ * space for the asm code here.
++ *
++ * We return by executing IRET while RSP points to the "iret" frame.
++ * That will either return for real or it will loop back into NMI
++ * processing.
++ *
++ * The "outermost" frame is copied to the "iret" frame on each
++ * iteration of the loop, so each iteration starts with the "iret"
++ * frame pointing to the final return target.
++ */
++
++ /*
++ * Determine whether we're a nested NMI.
++ *
++ * If we interrupted kernel code between repeat_nmi and
++ * end_repeat_nmi, then we are a nested NMI. We must not
++ * modify the "iret" frame because it's being written by
++ * the outer NMI. That's okay; the outer NMI handler is
++ * about to about to call do_nmi anyway, so we can just
++ * resume the outer NMI.
++ */
++ movq $repeat_nmi, %rdx
++ cmpq 8(%rsp), %rdx
++ ja 1f
++ movq $end_repeat_nmi, %rdx
++ cmpq 8(%rsp), %rdx
++ ja nested_nmi_out
++1:
++
++ /*
++ * Now check "NMI executing". If it's set, then we're nested.
++ * This will not detect if we interrupted an outer NMI just
++ * before IRET.
+ */
+ cmpl $1, -8(%rsp)
+ je nested_nmi
+
+ /*
+- * Now test if the previous stack was an NMI stack.
+- * We need the double check. We check the NMI stack to satisfy the
+- * race when the first NMI clears the variable before returning.
+- * We check the variable because the first NMI could be in a
+- * breakpoint routine using a breakpoint stack.
++ * Now test if the previous stack was an NMI stack. This covers
++ * the case where we interrupt an outer NMI after it clears
++ * "NMI executing" but before IRET. We need to be careful, though:
++ * there is one case in which RSP could point to the NMI stack
++ * despite there being no NMI active: naughty userspace controls
++ * RSP at the very beginning of the SYSCALL targets. We can
++ * pull a fast one on naughty userspace, though: we program
++ * SYSCALL to mask DF, so userspace cannot cause DF to be set
++ * if it controls the kernel's RSP. We set DF before we clear
++ * "NMI executing".
+ */
+ lea 6*8(%rsp), %rdx
+ test_in_nmi rdx, 4*8(%rsp), nested_nmi, first_nmi
++
++ /* Ah, it is within the NMI stack. */
++
++ testb $(X86_EFLAGS_DF >> 8), (3*8 + 1)(%rsp)
++ jz first_nmi /* RSP was user controlled. */
++
++ /* This is a nested NMI. */
++
+ CFI_REMEMBER_STATE
+
+ nested_nmi:
+ /*
+- * Do nothing if we interrupted the fixup in repeat_nmi.
+- * It's about to repeat the NMI handler, so we are fine
+- * with ignoring this one.
++ * Modify the "iret" frame to point to repeat_nmi, forcing another
++ * iteration of NMI handling.
+ */
+- movq $repeat_nmi, %rdx
+- cmpq 8(%rsp), %rdx
+- ja 1f
+- movq $end_repeat_nmi, %rdx
+- cmpq 8(%rsp), %rdx
+- ja nested_nmi_out
+-
+-1:
+- /* Set up the interrupted NMIs stack to jump to repeat_nmi */
+ leaq -1*8(%rsp), %rdx
+ movq %rdx, %rsp
+ CFI_ADJUST_CFA_OFFSET 1*8
+@@ -1580,60 +1657,23 @@ nested_nmi_out:
+ popq_cfi %rdx
+ CFI_RESTORE rdx
+
+- /* No need to check faults here */
++ /* We are returning to kernel mode, so this cannot result in a fault. */
+ INTERRUPT_RETURN
+
+ CFI_RESTORE_STATE
+ first_nmi:
+- /*
+- * Because nested NMIs will use the pushed location that we
+- * stored in rdx, we must keep that space available.
+- * Here's what our stack frame will look like:
+- * +-------------------------+
+- * | original SS |
+- * | original Return RSP |
+- * | original RFLAGS |
+- * | original CS |
+- * | original RIP |
+- * +-------------------------+
+- * | temp storage for rdx |
+- * +-------------------------+
+- * | NMI executing variable |
+- * +-------------------------+
+- * | copied SS |
+- * | copied Return RSP |
+- * | copied RFLAGS |
+- * | copied CS |
+- * | copied RIP |
+- * +-------------------------+
+- * | Saved SS |
+- * | Saved Return RSP |
+- * | Saved RFLAGS |
+- * | Saved CS |
+- * | Saved RIP |
+- * +-------------------------+
+- * | pt_regs |
+- * +-------------------------+
+- *
+- * The saved stack frame is used to fix up the copied stack frame
+- * that a nested NMI may change to make the interrupted NMI iret jump
+- * to the repeat_nmi. The original stack frame and the temp storage
+- * is also used by nested NMIs and can not be trusted on exit.
+- */
+- /* Do not pop rdx, nested NMIs will corrupt that part of the stack */
++ /* Restore rdx. */
+ movq (%rsp), %rdx
+ CFI_RESTORE rdx
+
+- /* Set the NMI executing variable on the stack. */
++ /* Set "NMI executing" on the stack. */
+ pushq_cfi $1
+
+- /*
+- * Leave room for the "copied" frame
+- */
++ /* Leave room for the "iret" frame */
+ subq $(5*8), %rsp
+ CFI_ADJUST_CFA_OFFSET 5*8
+
+- /* Copy the stack frame to the Saved frame */
++ /* Copy the "original" frame to the "outermost" frame */
+ .rept 5
+ pushq_cfi 11*8(%rsp)
+ .endr
+@@ -1641,6 +1681,7 @@ first_nmi:
+
+ /* Everything up to here is safe from nested NMIs */
+
++repeat_nmi:
+ /*
+ * If there was a nested NMI, the first NMI's iret will return
+ * here. But NMIs are still enabled and we can take another
+@@ -1649,16 +1690,21 @@ first_nmi:
+ * it will just return, as we are about to repeat an NMI anyway.
+ * This makes it safe to copy to the stack frame that a nested
+ * NMI will update.
+- */
+-repeat_nmi:
+- /*
+- * Update the stack variable to say we are still in NMI (the update
+- * is benign for the non-repeat case, where 1 was pushed just above
+- * to this very stack slot).
++ *
++ * RSP is pointing to "outermost RIP". gsbase is unknown, but, if
++ * we're repeating an NMI, gsbase has the same value that it had on
++ * the first iteration. paranoid_entry will load the kernel
++ * gsbase if needed before we call do_nmi.
++ *
++ * Set "NMI executing" in case we came back here via IRET.
+ */
+ movq $1, 10*8(%rsp)
+
+- /* Make another copy, this one may be modified by nested NMIs */
++ /*
++ * Copy the "outermost" frame to the "iret" frame. NMIs that nest
++ * here must not modify the "iret" frame while we're writing to
++ * it or it will end up containing garbage.
++ */
+ addq $(10*8), %rsp
+ CFI_ADJUST_CFA_OFFSET -10*8
+ .rept 5
+@@ -1669,9 +1715,9 @@ repeat_nmi:
+ end_repeat_nmi:
+
+ /*
+- * Everything below this point can be preempted by a nested
+- * NMI if the first NMI took an exception and reset our iret stack
+- * so that we repeat another NMI.
++ * Everything below this point can be preempted by a nested NMI.
++ * If this happens, then the inner NMI will change the "iret"
++ * frame to point back to repeat_nmi.
+ */
+ pushq_cfi $-1 /* ORIG_RAX: no syscall to restart */
+ subq $ORIG_RAX-R15, %rsp
+@@ -1699,9 +1745,23 @@ nmi_restore:
+ /* Pop the extra iret frame at once */
+ RESTORE_ALL 6*8
+
+- /* Clear the NMI executing stack variable */
+- movq $0, 5*8(%rsp)
+- jmp irq_return
++ /*
++ * Clear "NMI executing". Set DF first so that we can easily
++ * distinguish the remaining code between here and IRET from
++ * the SYSCALL entry and exit paths. On a native kernel, we
++ * could just inspect RIP, but, on paravirt kernels,
++ * INTERRUPT_RETURN can translate into a jump into a
++ * hypercall page.
++ */
++ std
++ movq $0, 5*8(%rsp) /* clear "NMI executing" */
++
++ /*
++ * INTERRUPT_RETURN reads the "iret" frame and exits the NMI
++ * stack in a single instruction. We are returning to kernel
++ * mode, so this cannot result in a fault.
++ */
++ INTERRUPT_RETURN
+ CFI_ENDPROC
+ END(nmi)
+
+diff --git a/arch/x86/kernel/nmi.c b/arch/x86/kernel/nmi.c
+index 5c5ec7d28d9b..a701b49e8c87 100644
+--- a/arch/x86/kernel/nmi.c
++++ b/arch/x86/kernel/nmi.c
+@@ -408,8 +408,8 @@ static void default_do_nmi(struct pt_regs *regs)
+ NOKPROBE_SYMBOL(default_do_nmi);
+
+ /*
+- * NMIs can hit breakpoints which will cause it to lose its NMI context
+- * with the CPU when the breakpoint or page fault does an IRET.
++ * NMIs can page fault or hit breakpoints which will cause it to lose
++ * its NMI context with the CPU when the breakpoint or page fault does an IRET.
+ *
+ * As a result, NMIs can nest if NMIs get unmasked due an IRET during
+ * NMI processing. On x86_64, the asm glue protects us from nested NMIs
+diff --git a/arch/x86/kernel/paravirt.c b/arch/x86/kernel/paravirt.c
+index 548d25f00c90..8d12f0546dfc 100644
+--- a/arch/x86/kernel/paravirt.c
++++ b/arch/x86/kernel/paravirt.c
+@@ -41,10 +41,18 @@
+ #include <asm/timer.h>
+ #include <asm/special_insns.h>
+
+-/* nop stub */
+-void _paravirt_nop(void)
+-{
+-}
++/*
++ * nop stub, which must not clobber anything *including the stack* to
++ * avoid confusing the entry prologues.
++ */
++extern void _paravirt_nop(void);
++asm (".pushsection .entry.text, \"ax\"\n"
++ ".global _paravirt_nop\n"
++ "_paravirt_nop:\n\t"
++ "ret\n\t"
++ ".size _paravirt_nop, . - _paravirt_nop\n\t"
++ ".type _paravirt_nop, @function\n\t"
++ ".popsection");
+
+ /* identity function, which can be inlined */
+ u32 _paravirt_ident_32(u32 x)
+diff --git a/arch/x86/kernel/process_64.c b/arch/x86/kernel/process_64.c
+index 63a4b5092203..54cfd5ebd96c 100644
+--- a/arch/x86/kernel/process_64.c
++++ b/arch/x86/kernel/process_64.c
+@@ -476,27 +476,59 @@ void set_personality_ia32(bool x32)
+ }
+ EXPORT_SYMBOL_GPL(set_personality_ia32);
+
++/*
++ * Called from fs/proc with a reference on @p to find the function
++ * which called into schedule(). This needs to be done carefully
++ * because the task might wake up and we might look at a stack
++ * changing under us.
++ */
+ unsigned long get_wchan(struct task_struct *p)
+ {
+- unsigned long stack;
+- u64 fp, ip;
++ unsigned long start, bottom, top, sp, fp, ip;
+ int count = 0;
+
+ if (!p || p == current || p->state == TASK_RUNNING)
+ return 0;
+- stack = (unsigned long)task_stack_page(p);
+- if (p->thread.sp < stack || p->thread.sp >= stack+THREAD_SIZE)
++
++ start = (unsigned long)task_stack_page(p);
++ if (!start)
++ return 0;
++
++ /*
++ * Layout of the stack page:
++ *
++ * ----------- topmax = start + THREAD_SIZE - sizeof(unsigned long)
++ * PADDING
++ * ----------- top = topmax - TOP_OF_KERNEL_STACK_PADDING
++ * stack
++ * ----------- bottom = start + sizeof(thread_info)
++ * thread_info
++ * ----------- start
++ *
++ * The tasks stack pointer points at the location where the
++ * framepointer is stored. The data on the stack is:
++ * ... IP FP ... IP FP
++ *
++ * We need to read FP and IP, so we need to adjust the upper
++ * bound by another unsigned long.
++ */
++ top = start + THREAD_SIZE - TOP_OF_KERNEL_STACK_PADDING;
++ top -= 2 * sizeof(unsigned long);
++ bottom = start + sizeof(struct thread_info);
++
++ sp = READ_ONCE(p->thread.sp);
++ if (sp < bottom || sp > top)
+ return 0;
+- fp = *(u64 *)(p->thread.sp);
++
++ fp = READ_ONCE(*(unsigned long *)sp);
+ do {
+- if (fp < (unsigned long)stack ||
+- fp >= (unsigned long)stack+THREAD_SIZE)
++ if (fp < bottom || fp > top)
+ return 0;
+- ip = *(u64 *)(fp+8);
++ ip = READ_ONCE(*(unsigned long *)(fp + sizeof(unsigned long)));
+ if (!in_sched_functions(ip))
+ return ip;
+- fp = *(u64 *)fp;
+- } while (count++ < 16);
++ fp = READ_ONCE(*(unsigned long *)fp);
++ } while (count++ < 16 && p->state != TASK_RUNNING);
+ return 0;
+ }
+
+diff --git a/arch/x86/kernel/tsc.c b/arch/x86/kernel/tsc.c
+index 505449700e0c..21187ebee7d0 100644
+--- a/arch/x86/kernel/tsc.c
++++ b/arch/x86/kernel/tsc.c
+@@ -21,6 +21,7 @@
+ #include <asm/hypervisor.h>
+ #include <asm/nmi.h>
+ #include <asm/x86_init.h>
++#include <asm/geode.h>
+
+ unsigned int __read_mostly cpu_khz; /* TSC clocks / usec, not used here */
+ EXPORT_SYMBOL(cpu_khz);
+@@ -1004,15 +1005,17 @@ EXPORT_SYMBOL_GPL(mark_tsc_unstable);
+
+ static void __init check_system_tsc_reliable(void)
+ {
+-#ifdef CONFIG_MGEODE_LX
+- /* RTSC counts during suspend */
++#if defined(CONFIG_MGEODEGX1) || defined(CONFIG_MGEODE_LX) || defined(CONFIG_X86_GENERIC)
++ if (is_geode_lx()) {
++ /* RTSC counts during suspend */
+ #define RTSC_SUSP 0x100
+- unsigned long res_low, res_high;
++ unsigned long res_low, res_high;
+
+- rdmsr_safe(MSR_GEODE_BUSCONT_CONF0, &res_low, &res_high);
+- /* Geode_LX - the OLPC CPU has a very reliable TSC */
+- if (res_low & RTSC_SUSP)
+- tsc_clocksource_reliable = 1;
++ rdmsr_safe(MSR_GEODE_BUSCONT_CONF0, &res_low, &res_high);
++ /* Geode_LX - the OLPC CPU has a very reliable TSC */
++ if (res_low & RTSC_SUSP)
++ tsc_clocksource_reliable = 1;
++ }
+ #endif
+ if (boot_cpu_has(X86_FEATURE_TSC_RELIABLE))
+ tsc_clocksource_reliable = 1;
+diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
+index f696dedb0fa7..23875c26fb34 100644
+--- a/arch/x86/kvm/mmu.c
++++ b/arch/x86/kvm/mmu.c
+@@ -372,12 +372,6 @@ static u64 __get_spte_lockless(u64 *sptep)
+ {
+ return ACCESS_ONCE(*sptep);
+ }
+-
+-static bool __check_direct_spte_mmio_pf(u64 spte)
+-{
+- /* It is valid if the spte is zapped. */
+- return spte == 0ull;
+-}
+ #else
+ union split_spte {
+ struct {
+@@ -493,23 +487,6 @@ retry:
+
+ return spte.spte;
+ }
+-
+-static bool __check_direct_spte_mmio_pf(u64 spte)
+-{
+- union split_spte sspte = (union split_spte)spte;
+- u32 high_mmio_mask = shadow_mmio_mask >> 32;
+-
+- /* It is valid if the spte is zapped. */
+- if (spte == 0ull)
+- return true;
+-
+- /* It is valid if the spte is being zapped. */
+- if (sspte.spte_low == 0ull &&
+- (sspte.spte_high & high_mmio_mask) == high_mmio_mask)
+- return true;
+-
+- return false;
+-}
+ #endif
+
+ static bool spte_is_locklessly_modifiable(u64 spte)
+@@ -3230,21 +3207,6 @@ static bool quickly_check_mmio_pf(struct kvm_vcpu *vcpu, u64 addr, bool direct)
+ return vcpu_match_mmio_gva(vcpu, addr);
+ }
+
+-
+-/*
+- * On direct hosts, the last spte is only allows two states
+- * for mmio page fault:
+- * - It is the mmio spte
+- * - It is zapped or it is being zapped.
+- *
+- * This function completely checks the spte when the last spte
+- * is not the mmio spte.
+- */
+-static bool check_direct_spte_mmio_pf(u64 spte)
+-{
+- return __check_direct_spte_mmio_pf(spte);
+-}
+-
+ static u64 walk_shadow_page_get_mmio_spte(struct kvm_vcpu *vcpu, u64 addr)
+ {
+ struct kvm_shadow_walk_iterator iterator;
+@@ -3287,13 +3249,6 @@ int handle_mmio_page_fault_common(struct kvm_vcpu *vcpu, u64 addr, bool direct)
+ }
+
+ /*
+- * It's ok if the gva is remapped by other cpus on shadow guest,
+- * it's a BUG if the gfn is not a mmio page.
+- */
+- if (direct && !check_direct_spte_mmio_pf(spte))
+- return RET_MMIO_PF_BUG;
+-
+- /*
+ * If the page table is zapped by other cpus, let CPU fault again on
+ * the address.
+ */
+diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
+index b83bff87408f..f98baebfa9a7 100644
+--- a/arch/x86/kvm/svm.c
++++ b/arch/x86/kvm/svm.c
+@@ -512,7 +512,7 @@ static void skip_emulated_instruction(struct kvm_vcpu *vcpu)
+ struct vcpu_svm *svm = to_svm(vcpu);
+
+ if (svm->vmcb->control.next_rip != 0) {
+- WARN_ON(!static_cpu_has(X86_FEATURE_NRIPS));
++ WARN_ON_ONCE(!static_cpu_has(X86_FEATURE_NRIPS));
+ svm->next_rip = svm->vmcb->control.next_rip;
+ }
+
+diff --git a/arch/x86/mm/init_32.c b/arch/x86/mm/init_32.c
+index c8140e12816a..c23ab1ee3a9a 100644
+--- a/arch/x86/mm/init_32.c
++++ b/arch/x86/mm/init_32.c
+@@ -137,6 +137,7 @@ page_table_range_init_count(unsigned long start, unsigned long end)
+
+ vaddr = start;
+ pgd_idx = pgd_index(vaddr);
++ pmd_idx = pmd_index(vaddr);
+
+ for ( ; (pgd_idx < PTRS_PER_PGD) && (vaddr != end); pgd_idx++) {
+ for (; (pmd_idx < PTRS_PER_PMD) && (vaddr != end);
+diff --git a/arch/x86/mm/init_64.c b/arch/x86/mm/init_64.c
+index 4e5dfec750fc..fa77995b62a4 100644
+--- a/arch/x86/mm/init_64.c
++++ b/arch/x86/mm/init_64.c
+@@ -1144,7 +1144,7 @@ void mark_rodata_ro(void)
+ * has been zapped already via cleanup_highmem().
+ */
+ all_end = roundup((unsigned long)_brk_end, PMD_SIZE);
+- set_memory_nx(rodata_start, (all_end - rodata_start) >> PAGE_SHIFT);
++ set_memory_nx(text_end, (all_end - text_end) >> PAGE_SHIFT);
+
+ rodata_test();
+
+diff --git a/arch/x86/platform/efi/efi.c b/arch/x86/platform/efi/efi.c
+index dbc8627a5cdf..6d6080f3fa35 100644
+--- a/arch/x86/platform/efi/efi.c
++++ b/arch/x86/platform/efi/efi.c
+@@ -670,6 +670,70 @@ out:
+ }
+
+ /*
++ * Iterate the EFI memory map in reverse order because the regions
++ * will be mapped top-down. The end result is the same as if we had
++ * mapped things forward, but doesn't require us to change the
++ * existing implementation of efi_map_region().
++ */
++static inline void *efi_map_next_entry_reverse(void *entry)
++{
++ /* Initial call */
++ if (!entry)
++ return memmap.map_end - memmap.desc_size;
++
++ entry -= memmap.desc_size;
++ if (entry < memmap.map)
++ return NULL;
++
++ return entry;
++}
++
++/*
++ * efi_map_next_entry - Return the next EFI memory map descriptor
++ * @entry: Previous EFI memory map descriptor
++ *
++ * This is a helper function to iterate over the EFI memory map, which
++ * we do in different orders depending on the current configuration.
++ *
++ * To begin traversing the memory map @entry must be %NULL.
++ *
++ * Returns %NULL when we reach the end of the memory map.
++ */
++static void *efi_map_next_entry(void *entry)
++{
++ if (!efi_enabled(EFI_OLD_MEMMAP) && efi_enabled(EFI_64BIT)) {
++ /*
++ * Starting in UEFI v2.5 the EFI_PROPERTIES_TABLE
++ * config table feature requires us to map all entries
++ * in the same order as they appear in the EFI memory
++ * map. That is to say, entry N must have a lower
++ * virtual address than entry N+1. This is because the
++ * firmware toolchain leaves relative references in
++ * the code/data sections, which are split and become
++ * separate EFI memory regions. Mapping things
++ * out-of-order leads to the firmware accessing
++ * unmapped addresses.
++ *
++ * Since we need to map things this way whether or not
++ * the kernel actually makes use of
++ * EFI_PROPERTIES_TABLE, let's just switch to this
++ * scheme by default for 64-bit.
++ */
++ return efi_map_next_entry_reverse(entry);
++ }
++
++ /* Initial call */
++ if (!entry)
++ return memmap.map;
++
++ entry += memmap.desc_size;
++ if (entry >= memmap.map_end)
++ return NULL;
++
++ return entry;
++}
++
++/*
+ * Map the efi memory ranges of the runtime services and update new_mmap with
+ * virtual addresses.
+ */
+@@ -679,7 +743,8 @@ static void * __init efi_map_regions(int *count, int *pg_shift)
+ unsigned long left = 0;
+ efi_memory_desc_t *md;
+
+- for (p = memmap.map; p < memmap.map_end; p += memmap.desc_size) {
++ p = NULL;
++ while ((p = efi_map_next_entry(p))) {
+ md = p;
+ if (!(md->attribute & EFI_MEMORY_RUNTIME)) {
+ #ifdef CONFIG_X86_64
+diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
+index d8d81d1aa1d5..7e365d231a93 100644
+--- a/arch/x86/xen/enlighten.c
++++ b/arch/x86/xen/enlighten.c
+@@ -33,6 +33,10 @@
+ #include <linux/memblock.h>
+ #include <linux/edd.h>
+
++#ifdef CONFIG_KEXEC_CORE
++#include <linux/kexec.h>
++#endif
++
+ #include <xen/xen.h>
+ #include <xen/events.h>
+ #include <xen/interface/xen.h>
+@@ -1859,6 +1863,21 @@ static struct notifier_block xen_hvm_cpu_notifier = {
+ .notifier_call = xen_hvm_cpu_notify,
+ };
+
++#ifdef CONFIG_KEXEC_CORE
++static void xen_hvm_shutdown(void)
++{
++ native_machine_shutdown();
++ if (kexec_in_progress)
++ xen_reboot(SHUTDOWN_soft_reset);
++}
++
++static void xen_hvm_crash_shutdown(struct pt_regs *regs)
++{
++ native_machine_crash_shutdown(regs);
++ xen_reboot(SHUTDOWN_soft_reset);
++}
++#endif
++
+ static void __init xen_hvm_guest_init(void)
+ {
+ init_hvm_pv_info();
+@@ -1875,6 +1894,10 @@ static void __init xen_hvm_guest_init(void)
+ x86_init.irqs.intr_init = xen_init_IRQ;
+ xen_hvm_init_time_ops();
+ xen_hvm_init_mmu_ops();
++#ifdef CONFIG_KEXEC_CORE
++ machine_ops.shutdown = xen_hvm_shutdown;
++ machine_ops.crash_shutdown = xen_hvm_crash_shutdown;
++#endif
+ }
+
+ static bool xen_nopv = false;
+diff --git a/arch/xtensa/include/asm/traps.h b/arch/xtensa/include/asm/traps.h
+index 677bfcf4ee5d..28f33a8b7f5f 100644
+--- a/arch/xtensa/include/asm/traps.h
++++ b/arch/xtensa/include/asm/traps.h
+@@ -25,30 +25,39 @@ static inline void spill_registers(void)
+ {
+ #if XCHAL_NUM_AREGS > 16
+ __asm__ __volatile__ (
+- " call12 1f\n"
++ " call8 1f\n"
+ " _j 2f\n"
+ " retw\n"
+ " .align 4\n"
+ "1:\n"
++#if XCHAL_NUM_AREGS == 32
++ " _entry a1, 32\n"
++ " addi a8, a0, 3\n"
++ " _entry a1, 16\n"
++ " mov a12, a12\n"
++ " retw\n"
++#else
+ " _entry a1, 48\n"
+- " addi a12, a0, 3\n"
+-#if XCHAL_NUM_AREGS > 32
+- " .rept (" __stringify(XCHAL_NUM_AREGS) " - 32) / 12\n"
++ " call12 1f\n"
++ " retw\n"
++ " .align 4\n"
++ "1:\n"
++ " .rept (" __stringify(XCHAL_NUM_AREGS) " - 16) / 12\n"
+ " _entry a1, 48\n"
+ " mov a12, a0\n"
+ " .endr\n"
+-#endif
+- " _entry a1, 48\n"
++ " _entry a1, 16\n"
+ #if XCHAL_NUM_AREGS % 12 == 0
+- " mov a8, a8\n"
+-#elif XCHAL_NUM_AREGS % 12 == 4
+ " mov a12, a12\n"
+-#elif XCHAL_NUM_AREGS % 12 == 8
++#elif XCHAL_NUM_AREGS % 12 == 4
+ " mov a4, a4\n"
++#elif XCHAL_NUM_AREGS % 12 == 8
++ " mov a8, a8\n"
+ #endif
+ " retw\n"
++#endif
+ "2:\n"
+- : : : "a12", "a13", "memory");
++ : : : "a8", "a9", "memory");
+ #else
+ __asm__ __volatile__ (
+ " mov a12, a12\n"
+diff --git a/arch/xtensa/kernel/entry.S b/arch/xtensa/kernel/entry.S
+index 82bbfa5a05b3..a2a902140c4e 100644
+--- a/arch/xtensa/kernel/entry.S
++++ b/arch/xtensa/kernel/entry.S
+@@ -568,12 +568,13 @@ user_exception_exit:
+ * (if we have restored WSBITS-1 frames).
+ */
+
++2:
+ #if XCHAL_HAVE_THREADPTR
+ l32i a3, a1, PT_THREADPTR
+ wur a3, threadptr
+ #endif
+
+-2: j common_exception_exit
++ j common_exception_exit
+
+ /* This is the kernel exception exit.
+ * We avoided to do a MOVSP when we entered the exception, but we
+@@ -1820,7 +1821,7 @@ ENDPROC(system_call)
+ mov a12, a0
+ .endr
+ #endif
+- _entry a1, 48
++ _entry a1, 16
+ #if XCHAL_NUM_AREGS % 12 == 0
+ mov a8, a8
+ #elif XCHAL_NUM_AREGS % 12 == 4
+@@ -1844,7 +1845,7 @@ ENDPROC(system_call)
+
+ ENTRY(_switch_to)
+
+- entry a1, 16
++ entry a1, 48
+
+ mov a11, a3 # and 'next' (a3)
+
+diff --git a/block/blk-mq-sysfs.c b/block/blk-mq-sysfs.c
+index 1630a20d5dcf..d477f83f29bf 100644
+--- a/block/blk-mq-sysfs.c
++++ b/block/blk-mq-sysfs.c
+@@ -141,15 +141,26 @@ static ssize_t blk_mq_sysfs_completed_show(struct blk_mq_ctx *ctx, char *page)
+
+ static ssize_t sysfs_list_show(char *page, struct list_head *list, char *msg)
+ {
+- char *start_page = page;
+ struct request *rq;
++ int len = snprintf(page, PAGE_SIZE - 1, "%s:\n", msg);
++
++ list_for_each_entry(rq, list, queuelist) {
++ const int rq_len = 2 * sizeof(rq) + 2;
++
++ /* if the output will be truncated */
++ if (PAGE_SIZE - 1 < len + rq_len) {
++ /* backspacing if it can't hold '\t...\n' */
++ if (PAGE_SIZE - 1 < len + 5)
++ len -= rq_len;
++ len += snprintf(page + len, PAGE_SIZE - 1 - len,
++ "\t...\n");
++ break;
++ }
++ len += snprintf(page + len, PAGE_SIZE - 1 - len,
++ "\t%p\n", rq);
++ }
+
+- page += sprintf(page, "%s:\n", msg);
+-
+- list_for_each_entry(rq, list, queuelist)
+- page += sprintf(page, "\t%p\n", rq);
+-
+- return page - start_page;
++ return len;
+ }
+
+ static ssize_t blk_mq_sysfs_rq_list_show(struct blk_mq_ctx *ctx, char *page)
+diff --git a/drivers/auxdisplay/ks0108.c b/drivers/auxdisplay/ks0108.c
+index 5b93852392b8..0d752851a1ee 100644
+--- a/drivers/auxdisplay/ks0108.c
++++ b/drivers/auxdisplay/ks0108.c
+@@ -139,6 +139,7 @@ static int __init ks0108_init(void)
+
+ ks0108_pardevice = parport_register_device(ks0108_parport, KS0108_NAME,
+ NULL, NULL, NULL, PARPORT_DEV_EXCL, NULL);
++ parport_put_port(ks0108_parport);
+ if (ks0108_pardevice == NULL) {
+ printk(KERN_ERR KS0108_NAME ": ERROR: "
+ "parport didn't register new device\n");
+diff --git a/drivers/base/devres.c b/drivers/base/devres.c
+index c8a53d1e019f..875464690117 100644
+--- a/drivers/base/devres.c
++++ b/drivers/base/devres.c
+@@ -297,10 +297,10 @@ void * devres_get(struct device *dev, void *new_res,
+ if (!dr) {
+ add_dr(dev, &new_dr->node);
+ dr = new_dr;
+- new_dr = NULL;
++ new_res = NULL;
+ }
+ spin_unlock_irqrestore(&dev->devres_lock, flags);
+- devres_free(new_dr);
++ devres_free(new_res);
+
+ return dr->data;
+ }
+diff --git a/drivers/base/node.c b/drivers/base/node.c
+index 472168cd0c97..74d45823890b 100644
+--- a/drivers/base/node.c
++++ b/drivers/base/node.c
+@@ -396,6 +396,16 @@ int register_mem_sect_under_node(struct memory_block *mem_blk, int nid)
+ for (pfn = sect_start_pfn; pfn <= sect_end_pfn; pfn++) {
+ int page_nid;
+
++ /*
++ * memory block could have several absent sections from start.
++ * skip pfn range from absent section
++ */
++ if (!pfn_present(pfn)) {
++ pfn = round_down(pfn + PAGES_PER_SECTION,
++ PAGES_PER_SECTION) - 1;
++ continue;
++ }
++
+ page_nid = get_nid_for_pfn(pfn);
+ if (page_nid < 0)
+ continue;
+diff --git a/drivers/base/platform.c b/drivers/base/platform.c
+index 360272cd4549..317e0e491ea0 100644
+--- a/drivers/base/platform.c
++++ b/drivers/base/platform.c
+@@ -375,9 +375,7 @@ int platform_device_add(struct platform_device *pdev)
+
+ while (--i >= 0) {
+ struct resource *r = &pdev->resource[i];
+- unsigned long type = resource_type(r);
+-
+- if (type == IORESOURCE_MEM || type == IORESOURCE_IO)
++ if (r->parent)
+ release_resource(r);
+ }
+
+@@ -408,9 +406,7 @@ void platform_device_del(struct platform_device *pdev)
+
+ for (i = 0; i < pdev->num_resources; i++) {
+ struct resource *r = &pdev->resource[i];
+- unsigned long type = resource_type(r);
+-
+- if (type == IORESOURCE_MEM || type == IORESOURCE_IO)
++ if (r->parent)
+ release_resource(r);
+ }
+ }
+diff --git a/drivers/base/regmap/regmap-debugfs.c b/drivers/base/regmap/regmap-debugfs.c
+index 5799a0b9e6cc..c8941f39c919 100644
+--- a/drivers/base/regmap/regmap-debugfs.c
++++ b/drivers/base/regmap/regmap-debugfs.c
+@@ -32,8 +32,7 @@ static DEFINE_MUTEX(regmap_debugfs_early_lock);
+ /* Calculate the length of a fixed format */
+ static size_t regmap_calc_reg_len(int max_val, char *buf, size_t buf_size)
+ {
+- snprintf(buf, buf_size, "%x", max_val);
+- return strlen(buf);
++ return snprintf(NULL, 0, "%x", max_val);
+ }
+
+ static ssize_t regmap_name_read_file(struct file *file,
+@@ -432,7 +431,7 @@ static ssize_t regmap_access_read_file(struct file *file,
+ /* If we're in the region the user is trying to read */
+ if (p >= *ppos) {
+ /* ...but not beyond it */
+- if (buf_pos >= count - 1 - tot_len)
++ if (buf_pos + tot_len + 1 >= count)
+ break;
+
+ /* Format the register */
+diff --git a/drivers/block/zram/zcomp.c b/drivers/block/zram/zcomp.c
+index f1ff39a3d1c1..54d946a9eee6 100644
+--- a/drivers/block/zram/zcomp.c
++++ b/drivers/block/zram/zcomp.c
+@@ -325,12 +325,14 @@ void zcomp_destroy(struct zcomp *comp)
+ * allocate new zcomp and initialize it. return compressing
+ * backend pointer or ERR_PTR if things went bad. ERR_PTR(-EINVAL)
+ * if requested algorithm is not supported, ERR_PTR(-ENOMEM) in
+- * case of allocation error.
++ * case of allocation error, or any other error potentially
++ * returned by functions zcomp_strm_{multi,single}_create.
+ */
+ struct zcomp *zcomp_create(const char *compress, int max_strm)
+ {
+ struct zcomp *comp;
+ struct zcomp_backend *backend;
++ int error;
+
+ backend = find_backend(compress);
+ if (!backend)
+@@ -342,12 +344,12 @@ struct zcomp *zcomp_create(const char *compress, int max_strm)
+
+ comp->backend = backend;
+ if (max_strm > 1)
+- zcomp_strm_multi_create(comp, max_strm);
++ error = zcomp_strm_multi_create(comp, max_strm);
+ else
+- zcomp_strm_single_create(comp);
+- if (!comp->stream) {
++ error = zcomp_strm_single_create(comp);
++ if (error) {
+ kfree(comp);
+- return ERR_PTR(-ENOMEM);
++ return ERR_PTR(error);
+ }
+ return comp;
+ }
+diff --git a/drivers/clk/ti/clk-3xxx.c b/drivers/clk/ti/clk-3xxx.c
+index 0d1750a8aea4..088930c3ee4b 100644
+--- a/drivers/clk/ti/clk-3xxx.c
++++ b/drivers/clk/ti/clk-3xxx.c
+@@ -170,7 +170,6 @@ static struct ti_dt_clk omap3xxx_clks[] = {
+ DT_CLK(NULL, "gpio2_ick", "gpio2_ick"),
+ DT_CLK(NULL, "wdt3_ick", "wdt3_ick"),
+ DT_CLK(NULL, "uart3_ick", "uart3_ick"),
+- DT_CLK(NULL, "uart4_ick", "uart4_ick"),
+ DT_CLK(NULL, "gpt9_ick", "gpt9_ick"),
+ DT_CLK(NULL, "gpt8_ick", "gpt8_ick"),
+ DT_CLK(NULL, "gpt7_ick", "gpt7_ick"),
+@@ -313,6 +312,7 @@ static struct ti_dt_clk am35xx_clks[] = {
+ static struct ti_dt_clk omap36xx_clks[] = {
+ DT_CLK(NULL, "omap_192m_alwon_fck", "omap_192m_alwon_fck"),
+ DT_CLK(NULL, "uart4_fck", "uart4_fck"),
++ DT_CLK(NULL, "uart4_ick", "uart4_ick"),
+ { .node_name = NULL },
+ };
+
+diff --git a/drivers/clk/versatile/clk-sp810.c b/drivers/clk/versatile/clk-sp810.c
+index c6e86a9a2aa3..5122ef25f595 100644
+--- a/drivers/clk/versatile/clk-sp810.c
++++ b/drivers/clk/versatile/clk-sp810.c
+@@ -128,8 +128,8 @@ static struct clk *clk_sp810_timerclken_of_get(struct of_phandle_args *clkspec,
+ {
+ struct clk_sp810 *sp810 = data;
+
+- if (WARN_ON(clkspec->args_count != 1 || clkspec->args[0] >
+- ARRAY_SIZE(sp810->timerclken)))
++ if (WARN_ON(clkspec->args_count != 1 ||
++ clkspec->args[0] >= ARRAY_SIZE(sp810->timerclken)))
+ return NULL;
+
+ return sp810->timerclken[clkspec->args[0]].clk;
+diff --git a/drivers/cpufreq/cpufreq-dt.c b/drivers/cpufreq/cpufreq-dt.c
+index f657c571b18e..bdb6951d0978 100644
+--- a/drivers/cpufreq/cpufreq-dt.c
++++ b/drivers/cpufreq/cpufreq-dt.c
+@@ -240,7 +240,8 @@ static int cpufreq_init(struct cpufreq_policy *policy)
+ rcu_read_unlock();
+
+ tol_uV = opp_uV * priv->voltage_tolerance / 100;
+- if (regulator_is_supported_voltage(cpu_reg, opp_uV,
++ if (regulator_is_supported_voltage(cpu_reg,
++ opp_uV - tol_uV,
+ opp_uV + tol_uV)) {
+ if (opp_uV < min_uV)
+ min_uV = opp_uV;
+diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
+index d0d21363c63f..c1da6e121a67 100644
+--- a/drivers/cpufreq/intel_pstate.c
++++ b/drivers/cpufreq/intel_pstate.c
+@@ -47,9 +47,9 @@ static inline int32_t mul_fp(int32_t x, int32_t y)
+ return ((int64_t)x * (int64_t)y) >> FRAC_BITS;
+ }
+
+-static inline int32_t div_fp(int32_t x, int32_t y)
++static inline int32_t div_fp(s64 x, s64 y)
+ {
+- return div_s64((int64_t)x << FRAC_BITS, y);
++ return div64_s64((int64_t)x << FRAC_BITS, y);
+ }
+
+ static inline int ceiling_fp(int32_t x)
+@@ -659,7 +659,7 @@ static inline void intel_pstate_set_sample_time(struct cpudata *cpu)
+ static inline int32_t intel_pstate_get_scaled_busy(struct cpudata *cpu)
+ {
+ int32_t core_busy, max_pstate, current_pstate, sample_ratio;
+- u32 duration_us;
++ s64 duration_us;
+ u32 sample_time;
+
+ core_busy = cpu->sample.core_pct_busy;
+@@ -668,8 +668,8 @@ static inline int32_t intel_pstate_get_scaled_busy(struct cpudata *cpu)
+ core_busy = mul_fp(core_busy, div_fp(max_pstate, current_pstate));
+
+ sample_time = pid_params.sample_rate_ms * USEC_PER_MSEC;
+- duration_us = (u32) ktime_us_delta(cpu->sample.time,
+- cpu->last_sample_time);
++ duration_us = ktime_us_delta(cpu->sample.time,
++ cpu->last_sample_time);
+ if (duration_us > sample_time * 3) {
+ sample_ratio = div_fp(int_tofp(sample_time),
+ int_tofp(duration_us));
+diff --git a/drivers/dma/dw/core.c b/drivers/dma/dw/core.c
+index 244722170410..9da24a5e1561 100644
+--- a/drivers/dma/dw/core.c
++++ b/drivers/dma/dw/core.c
+@@ -1579,7 +1579,6 @@ int dw_dma_probe(struct dw_dma_chip *chip, struct dw_dma_platform_data *pdata)
+ INIT_LIST_HEAD(&dw->dma.channels);
+ for (i = 0; i < nr_channels; i++) {
+ struct dw_dma_chan *dwc = &dw->chan[i];
+- int r = nr_channels - i - 1;
+
+ dwc->chan.device = &dw->dma;
+ dma_cookie_init(&dwc->chan);
+@@ -1591,7 +1590,7 @@ int dw_dma_probe(struct dw_dma_chip *chip, struct dw_dma_platform_data *pdata)
+
+ /* 7 is highest priority & 0 is lowest. */
+ if (pdata->chan_priority == CHAN_PRIORITY_ASCENDING)
+- dwc->priority = r;
++ dwc->priority = nr_channels - i - 1;
+ else
+ dwc->priority = i;
+
+@@ -1610,6 +1609,7 @@ int dw_dma_probe(struct dw_dma_chip *chip, struct dw_dma_platform_data *pdata)
+ /* Hardware configuration */
+ if (autocfg) {
+ unsigned int dwc_params;
++ unsigned int r = DW_DMA_MAX_NR_CHANNELS - i - 1;
+ void __iomem *addr = chip->regs + r * sizeof(u32);
+
+ dwc_params = dma_read_byaddr(addr, DWC_PARAMS);
+diff --git a/drivers/gpu/drm/drm_lock.c b/drivers/gpu/drm/drm_lock.c
+index f861361a635e..4924d381b664 100644
+--- a/drivers/gpu/drm/drm_lock.c
++++ b/drivers/gpu/drm/drm_lock.c
+@@ -61,6 +61,9 @@ int drm_legacy_lock(struct drm_device *dev, void *data,
+ struct drm_master *master = file_priv->master;
+ int ret = 0;
+
++ if (drm_core_check_feature(dev, DRIVER_MODESET))
++ return -EINVAL;
++
+ ++file_priv->lock_count;
+
+ if (lock->context == DRM_KERNEL_CONTEXT) {
+@@ -153,6 +156,9 @@ int drm_legacy_unlock(struct drm_device *dev, void *data, struct drm_file *file_
+ struct drm_lock *lock = data;
+ struct drm_master *master = file_priv->master;
+
++ if (drm_core_check_feature(dev, DRIVER_MODESET))
++ return -EINVAL;
++
+ if (lock->context == DRM_KERNEL_CONTEXT) {
+ DRM_ERROR("Process %d using kernel context %d\n",
+ task_pid_nr(current), lock->context);
+diff --git a/drivers/gpu/drm/i915/intel_bios.c b/drivers/gpu/drm/i915/intel_bios.c
+index a4bd90f36a03..d96b152a6e04 100644
+--- a/drivers/gpu/drm/i915/intel_bios.c
++++ b/drivers/gpu/drm/i915/intel_bios.c
+@@ -41,7 +41,7 @@ find_section(struct bdb_header *bdb, int section_id)
+ {
+ u8 *base = (u8 *)bdb;
+ int index = 0;
+- u16 total, current_size;
++ u32 total, current_size;
+ u8 current_id;
+
+ /* skip to first section */
+@@ -56,6 +56,10 @@ find_section(struct bdb_header *bdb, int section_id)
+ current_size = *((u16 *)(base + index));
+ index += 2;
+
++ /* The MIPI Sequence Block v3+ has a separate size field. */
++ if (current_id == BDB_MIPI_SEQUENCE && *(base + index) >= 3)
++ current_size = *((const u32 *)(base + index + 1));
++
+ if (index + current_size > total)
+ return NULL;
+
+@@ -794,6 +798,12 @@ parse_mipi(struct drm_i915_private *dev_priv, struct bdb_header *bdb)
+ return;
+ }
+
++ /* Fail gracefully for forward incompatible sequence block. */
++ if (sequence->version >= 3) {
++ DRM_ERROR("Unable to parse MIPI Sequence Block v3+\n");
++ return;
++ }
++
+ DRM_DEBUG_DRIVER("Found MIPI sequence block\n");
+
+ block_size = get_blocksize(sequence);
+diff --git a/drivers/gpu/drm/qxl/qxl_display.c b/drivers/gpu/drm/qxl/qxl_display.c
+index 0d1396266857..011b22836fd6 100644
+--- a/drivers/gpu/drm/qxl/qxl_display.c
++++ b/drivers/gpu/drm/qxl/qxl_display.c
+@@ -136,9 +136,35 @@ static int qxl_add_monitors_config_modes(struct drm_connector *connector,
+ *pwidth = head->width;
+ *pheight = head->height;
+ drm_mode_probed_add(connector, mode);
++ /* remember the last custom size for mode validation */
++ qdev->monitors_config_width = mode->hdisplay;
++ qdev->monitors_config_height = mode->vdisplay;
+ return 1;
+ }
+
++static struct mode_size {
++ int w;
++ int h;
++} common_modes[] = {
++ { 640, 480},
++ { 720, 480},
++ { 800, 600},
++ { 848, 480},
++ {1024, 768},
++ {1152, 768},
++ {1280, 720},
++ {1280, 800},
++ {1280, 854},
++ {1280, 960},
++ {1280, 1024},
++ {1440, 900},
++ {1400, 1050},
++ {1680, 1050},
++ {1600, 1200},
++ {1920, 1080},
++ {1920, 1200}
++};
++
+ static int qxl_add_common_modes(struct drm_connector *connector,
+ unsigned pwidth,
+ unsigned pheight)
+@@ -146,29 +172,6 @@ static int qxl_add_common_modes(struct drm_connector *connector,
+ struct drm_device *dev = connector->dev;
+ struct drm_display_mode *mode = NULL;
+ int i;
+- struct mode_size {
+- int w;
+- int h;
+- } common_modes[] = {
+- { 640, 480},
+- { 720, 480},
+- { 800, 600},
+- { 848, 480},
+- {1024, 768},
+- {1152, 768},
+- {1280, 720},
+- {1280, 800},
+- {1280, 854},
+- {1280, 960},
+- {1280, 1024},
+- {1440, 900},
+- {1400, 1050},
+- {1680, 1050},
+- {1600, 1200},
+- {1920, 1080},
+- {1920, 1200}
+- };
+-
+ for (i = 0; i < ARRAY_SIZE(common_modes); i++) {
+ mode = drm_cvt_mode(dev, common_modes[i].w, common_modes[i].h,
+ 60, false, false, false);
+@@ -598,7 +601,7 @@ static int qxl_crtc_mode_set(struct drm_crtc *crtc,
+ adjusted_mode->hdisplay,
+ adjusted_mode->vdisplay);
+
+- if (qcrtc->index == 0)
++ if (bo->is_primary == false)
+ recreate_primary = true;
+
+ if (bo->surf.stride * bo->surf.height > qdev->vram_size) {
+@@ -806,11 +809,22 @@ static int qxl_conn_get_modes(struct drm_connector *connector)
+ static int qxl_conn_mode_valid(struct drm_connector *connector,
+ struct drm_display_mode *mode)
+ {
++ struct drm_device *ddev = connector->dev;
++ struct qxl_device *qdev = ddev->dev_private;
++ int i;
++
+ /* TODO: is this called for user defined modes? (xrandr --add-mode)
+ * TODO: check that the mode fits in the framebuffer */
+- DRM_DEBUG("%s: %dx%d status=%d\n", mode->name, mode->hdisplay,
+- mode->vdisplay, mode->status);
+- return MODE_OK;
++
++ if(qdev->monitors_config_width == mode->hdisplay &&
++ qdev->monitors_config_height == mode->vdisplay)
++ return MODE_OK;
++
++ for (i = 0; i < ARRAY_SIZE(common_modes); i++) {
++ if (common_modes[i].w == mode->hdisplay && common_modes[i].h == mode->vdisplay)
++ return MODE_OK;
++ }
++ return MODE_BAD;
+ }
+
+ static struct drm_encoder *qxl_best_encoder(struct drm_connector *connector)
+@@ -855,13 +869,15 @@ static enum drm_connector_status qxl_conn_detect(
+ drm_connector_to_qxl_output(connector);
+ struct drm_device *ddev = connector->dev;
+ struct qxl_device *qdev = ddev->dev_private;
+- int connected;
++ bool connected = false;
+
+ /* The first monitor is always connected */
+- connected = (output->index == 0) ||
+- (qdev->client_monitors_config &&
+- qdev->client_monitors_config->count > output->index &&
+- qxl_head_enabled(&qdev->client_monitors_config->heads[output->index]));
++ if (!qdev->client_monitors_config) {
++ if (output->index == 0)
++ connected = true;
++ } else
++ connected = qdev->client_monitors_config->count > output->index &&
++ qxl_head_enabled(&qdev->client_monitors_config->heads[output->index]);
+
+ DRM_DEBUG("#%d connected: %d\n", output->index, connected);
+ if (!connected)
+diff --git a/drivers/gpu/drm/qxl/qxl_drv.h b/drivers/gpu/drm/qxl/qxl_drv.h
+index 7c6cafe21f5f..e66143cc1a7a 100644
+--- a/drivers/gpu/drm/qxl/qxl_drv.h
++++ b/drivers/gpu/drm/qxl/qxl_drv.h
+@@ -325,6 +325,8 @@ struct qxl_device {
+ struct work_struct fb_work;
+
+ struct drm_property *hotplug_mode_update_property;
++ int monitors_config_width;
++ int monitors_config_height;
+ };
+
+ /* forward declaration for QXL_INFO_IO */
+diff --git a/drivers/gpu/drm/radeon/atombios_encoders.c b/drivers/gpu/drm/radeon/atombios_encoders.c
+index b8cd7975f797..d8a5db204a81 100644
+--- a/drivers/gpu/drm/radeon/atombios_encoders.c
++++ b/drivers/gpu/drm/radeon/atombios_encoders.c
+@@ -1586,8 +1586,9 @@ radeon_atom_encoder_dpms_avivo(struct drm_encoder *encoder, int mode)
+ } else
+ atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args);
+ if (radeon_encoder->devices & (ATOM_DEVICE_LCD_SUPPORT)) {
+- args.ucAction = ATOM_LCD_BLON;
+- atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args);
++ struct radeon_encoder_atom_dig *dig = radeon_encoder->enc_priv;
++
++ atombios_set_backlight_level(radeon_encoder, dig->backlight_level);
+ }
+ break;
+ case DRM_MODE_DPMS_STANDBY:
+@@ -1668,8 +1669,7 @@ radeon_atom_encoder_dpms_dig(struct drm_encoder *encoder, int mode)
+ atombios_dig_encoder_setup(encoder, ATOM_ENCODER_CMD_DP_VIDEO_ON, 0);
+ }
+ if (radeon_encoder->devices & (ATOM_DEVICE_LCD_SUPPORT))
+- atombios_dig_transmitter_setup(encoder,
+- ATOM_TRANSMITTER_ACTION_LCD_BLON, 0, 0);
++ atombios_set_backlight_level(radeon_encoder, dig->backlight_level);
+ if (ext_encoder)
+ atombios_external_encoder_setup(encoder, ext_encoder, ATOM_ENABLE);
+ break;
+diff --git a/drivers/gpu/drm/radeon/radeon_combios.c b/drivers/gpu/drm/radeon/radeon_combios.c
+index c097d3a82bda..a9b01bcf7d0a 100644
+--- a/drivers/gpu/drm/radeon/radeon_combios.c
++++ b/drivers/gpu/drm/radeon/radeon_combios.c
+@@ -3387,6 +3387,14 @@ void radeon_combios_asic_init(struct drm_device *dev)
+ rdev->pdev->subsystem_device == 0x30ae)
+ return;
+
++ /* quirk for rs4xx HP Compaq dc5750 Small Form Factor to make it resume
++ * - it hangs on resume inside the dynclk 1 table.
++ */
++ if (rdev->family == CHIP_RS480 &&
++ rdev->pdev->subsystem_vendor == 0x103c &&
++ rdev->pdev->subsystem_device == 0x280a)
++ return;
++
+ /* DYN CLK 1 */
+ table = combios_get_table_offset(dev, COMBIOS_DYN_CLK_1_TABLE);
+ if (table)
+diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c
+index 26baa9c05f6c..15f09068ac00 100644
+--- a/drivers/gpu/drm/radeon/radeon_connectors.c
++++ b/drivers/gpu/drm/radeon/radeon_connectors.c
+@@ -72,6 +72,11 @@ void radeon_connector_hotplug(struct drm_connector *connector)
+ if (!radeon_hpd_sense(rdev, radeon_connector->hpd.hpd)) {
+ drm_helper_connector_dpms(connector, DRM_MODE_DPMS_OFF);
+ } else if (radeon_dp_needs_link_train(radeon_connector)) {
++ /* Don't try to start link training before we
++ * have the dpcd */
++ if (!radeon_dp_getdpcd(radeon_connector))
++ return;
++
+ /* set it to OFF so that drm_helper_connector_dpms()
+ * won't return immediately since the current state
+ * is ON at this point.
+diff --git a/drivers/hid/usbhid/hid-core.c b/drivers/hid/usbhid/hid-core.c
+index ca6849a0121e..97342ebc7de7 100644
+--- a/drivers/hid/usbhid/hid-core.c
++++ b/drivers/hid/usbhid/hid-core.c
+@@ -164,7 +164,7 @@ static void hid_io_error(struct hid_device *hid)
+ if (time_after(jiffies, usbhid->stop_retry)) {
+
+ /* Retries failed, so do a port reset unless we lack bandwidth*/
+- if (test_bit(HID_NO_BANDWIDTH, &usbhid->iofl)
++ if (!test_bit(HID_NO_BANDWIDTH, &usbhid->iofl)
+ && !test_and_set_bit(HID_RESET_PENDING, &usbhid->iofl)) {
+
+ schedule_work(&usbhid->reset_work);
+diff --git a/drivers/hwmon/nct6775.c b/drivers/hwmon/nct6775.c
+index 6461964f49a8..3aa958b5d45d 100644
+--- a/drivers/hwmon/nct6775.c
++++ b/drivers/hwmon/nct6775.c
+@@ -350,6 +350,10 @@ static const u16 NCT6775_REG_TEMP_CRIT[ARRAY_SIZE(nct6775_temp_label) - 1]
+
+ /* NCT6776 specific data */
+
++/* STEP_UP_TIME and STEP_DOWN_TIME regs are swapped for all chips but NCT6775 */
++#define NCT6776_REG_FAN_STEP_UP_TIME NCT6775_REG_FAN_STEP_DOWN_TIME
++#define NCT6776_REG_FAN_STEP_DOWN_TIME NCT6775_REG_FAN_STEP_UP_TIME
++
+ static const s8 NCT6776_ALARM_BITS[] = {
+ 0, 1, 2, 3, 8, 21, 20, 16, /* in0.. in7 */
+ 17, -1, -1, -1, -1, -1, -1, /* in8..in14 */
+@@ -3476,8 +3480,8 @@ static int nct6775_probe(struct platform_device *pdev)
+ data->REG_FAN_PULSES = NCT6776_REG_FAN_PULSES;
+ data->FAN_PULSE_SHIFT = NCT6775_FAN_PULSE_SHIFT;
+ data->REG_FAN_TIME[0] = NCT6775_REG_FAN_STOP_TIME;
+- data->REG_FAN_TIME[1] = NCT6775_REG_FAN_STEP_UP_TIME;
+- data->REG_FAN_TIME[2] = NCT6775_REG_FAN_STEP_DOWN_TIME;
++ data->REG_FAN_TIME[1] = NCT6776_REG_FAN_STEP_UP_TIME;
++ data->REG_FAN_TIME[2] = NCT6776_REG_FAN_STEP_DOWN_TIME;
+ data->REG_TOLERANCE_H = NCT6776_REG_TOLERANCE_H;
+ data->REG_PWM[0] = NCT6775_REG_PWM;
+ data->REG_PWM[1] = NCT6775_REG_FAN_START_OUTPUT;
+@@ -3548,8 +3552,8 @@ static int nct6775_probe(struct platform_device *pdev)
+ data->REG_FAN_PULSES = NCT6779_REG_FAN_PULSES;
+ data->FAN_PULSE_SHIFT = NCT6775_FAN_PULSE_SHIFT;
+ data->REG_FAN_TIME[0] = NCT6775_REG_FAN_STOP_TIME;
+- data->REG_FAN_TIME[1] = NCT6775_REG_FAN_STEP_UP_TIME;
+- data->REG_FAN_TIME[2] = NCT6775_REG_FAN_STEP_DOWN_TIME;
++ data->REG_FAN_TIME[1] = NCT6776_REG_FAN_STEP_UP_TIME;
++ data->REG_FAN_TIME[2] = NCT6776_REG_FAN_STEP_DOWN_TIME;
+ data->REG_TOLERANCE_H = NCT6776_REG_TOLERANCE_H;
+ data->REG_PWM[0] = NCT6775_REG_PWM;
+ data->REG_PWM[1] = NCT6775_REG_FAN_START_OUTPUT;
+@@ -3624,8 +3628,8 @@ static int nct6775_probe(struct platform_device *pdev)
+ data->REG_FAN_PULSES = NCT6779_REG_FAN_PULSES;
+ data->FAN_PULSE_SHIFT = NCT6775_FAN_PULSE_SHIFT;
+ data->REG_FAN_TIME[0] = NCT6775_REG_FAN_STOP_TIME;
+- data->REG_FAN_TIME[1] = NCT6775_REG_FAN_STEP_UP_TIME;
+- data->REG_FAN_TIME[2] = NCT6775_REG_FAN_STEP_DOWN_TIME;
++ data->REG_FAN_TIME[1] = NCT6776_REG_FAN_STEP_UP_TIME;
++ data->REG_FAN_TIME[2] = NCT6776_REG_FAN_STEP_DOWN_TIME;
+ data->REG_TOLERANCE_H = NCT6776_REG_TOLERANCE_H;
+ data->REG_PWM[0] = NCT6775_REG_PWM;
+ data->REG_PWM[1] = NCT6775_REG_FAN_START_OUTPUT;
+diff --git a/drivers/iio/imu/adis16480.c b/drivers/iio/imu/adis16480.c
+index 989605dd6f78..b94bfd3f595b 100644
+--- a/drivers/iio/imu/adis16480.c
++++ b/drivers/iio/imu/adis16480.c
+@@ -110,6 +110,10 @@
+ struct adis16480_chip_info {
+ unsigned int num_channels;
+ const struct iio_chan_spec *channels;
++ unsigned int gyro_max_val;
++ unsigned int gyro_max_scale;
++ unsigned int accel_max_val;
++ unsigned int accel_max_scale;
+ };
+
+ struct adis16480 {
+@@ -497,19 +501,21 @@ static int adis16480_set_filter_freq(struct iio_dev *indio_dev,
+ static int adis16480_read_raw(struct iio_dev *indio_dev,
+ const struct iio_chan_spec *chan, int *val, int *val2, long info)
+ {
++ struct adis16480 *st = iio_priv(indio_dev);
++
+ switch (info) {
+ case IIO_CHAN_INFO_RAW:
+ return adis_single_conversion(indio_dev, chan, 0, val);
+ case IIO_CHAN_INFO_SCALE:
+ switch (chan->type) {
+ case IIO_ANGL_VEL:
+- *val = 0;
+- *val2 = IIO_DEGREE_TO_RAD(20000); /* 0.02 degree/sec */
+- return IIO_VAL_INT_PLUS_MICRO;
++ *val = st->chip_info->gyro_max_scale;
++ *val2 = st->chip_info->gyro_max_val;
++ return IIO_VAL_FRACTIONAL;
+ case IIO_ACCEL:
+- *val = 0;
+- *val2 = IIO_G_TO_M_S_2(800); /* 0.8 mg */
+- return IIO_VAL_INT_PLUS_MICRO;
++ *val = st->chip_info->accel_max_scale;
++ *val2 = st->chip_info->accel_max_val;
++ return IIO_VAL_FRACTIONAL;
+ case IIO_MAGN:
+ *val = 0;
+ *val2 = 100; /* 0.0001 gauss */
+@@ -674,18 +680,39 @@ static const struct adis16480_chip_info adis16480_chip_info[] = {
+ [ADIS16375] = {
+ .channels = adis16485_channels,
+ .num_channels = ARRAY_SIZE(adis16485_channels),
++ /*
++ * storing the value in rad/degree and the scale in degree
++ * gives us the result in rad and better precession than
++ * storing the scale directly in rad.
++ */
++ .gyro_max_val = IIO_RAD_TO_DEGREE(22887),
++ .gyro_max_scale = 300,
++ .accel_max_val = IIO_M_S_2_TO_G(21973),
++ .accel_max_scale = 18,
+ },
+ [ADIS16480] = {
+ .channels = adis16480_channels,
+ .num_channels = ARRAY_SIZE(adis16480_channels),
++ .gyro_max_val = IIO_RAD_TO_DEGREE(22500),
++ .gyro_max_scale = 450,
++ .accel_max_val = IIO_M_S_2_TO_G(12500),
++ .accel_max_scale = 5,
+ },
+ [ADIS16485] = {
+ .channels = adis16485_channels,
+ .num_channels = ARRAY_SIZE(adis16485_channels),
++ .gyro_max_val = IIO_RAD_TO_DEGREE(22500),
++ .gyro_max_scale = 450,
++ .accel_max_val = IIO_M_S_2_TO_G(20000),
++ .accel_max_scale = 5,
+ },
+ [ADIS16488] = {
+ .channels = adis16480_channels,
+ .num_channels = ARRAY_SIZE(adis16480_channels),
++ .gyro_max_val = IIO_RAD_TO_DEGREE(22500),
++ .gyro_max_scale = 450,
++ .accel_max_val = IIO_M_S_2_TO_G(22500),
++ .accel_max_scale = 18,
+ },
+ };
+
+diff --git a/drivers/iio/industrialio-buffer.c b/drivers/iio/industrialio-buffer.c
+index f971f79103ec..25c68de393ad 100644
+--- a/drivers/iio/industrialio-buffer.c
++++ b/drivers/iio/industrialio-buffer.c
+@@ -93,7 +93,7 @@ unsigned int iio_buffer_poll(struct file *filp,
+ struct iio_buffer *rb = indio_dev->buffer;
+
+ if (!indio_dev->info)
+- return -ENODEV;
++ return 0;
+
+ poll_wait(filp, &rb->pollq, wait);
+ if (iio_buffer_data_available(rb))
+diff --git a/drivers/iio/industrialio-event.c b/drivers/iio/industrialio-event.c
+index 35c02aeec75e..158a760ada12 100644
+--- a/drivers/iio/industrialio-event.c
++++ b/drivers/iio/industrialio-event.c
+@@ -84,7 +84,7 @@ static unsigned int iio_event_poll(struct file *filep,
+ unsigned int events = 0;
+
+ if (!indio_dev->info)
+- return -ENODEV;
++ return events;
+
+ poll_wait(filep, &ev_int->wait, wait);
+
+diff --git a/drivers/infiniband/core/uverbs.h b/drivers/infiniband/core/uverbs.h
+index 643c08a025a5..1c74d89fd2ad 100644
+--- a/drivers/infiniband/core/uverbs.h
++++ b/drivers/infiniband/core/uverbs.h
+@@ -85,7 +85,7 @@
+ */
+
+ struct ib_uverbs_device {
+- struct kref ref;
++ atomic_t refcount;
+ int num_comp_vectors;
+ struct completion comp;
+ struct device *dev;
+@@ -94,6 +94,7 @@ struct ib_uverbs_device {
+ struct cdev cdev;
+ struct rb_root xrcd_tree;
+ struct mutex xrcd_tree_mutex;
++ struct kobject kobj;
+ };
+
+ struct ib_uverbs_event_file {
+diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c
+index 63a9f04bdb6c..f3748311d79b 100644
+--- a/drivers/infiniband/core/uverbs_cmd.c
++++ b/drivers/infiniband/core/uverbs_cmd.c
+@@ -2204,6 +2204,12 @@ ssize_t ib_uverbs_post_send(struct ib_uverbs_file *file,
+ next->send_flags = user_wr->send_flags;
+
+ if (is_ud) {
++ if (next->opcode != IB_WR_SEND &&
++ next->opcode != IB_WR_SEND_WITH_IMM) {
++ ret = -EINVAL;
++ goto out_put;
++ }
++
+ next->wr.ud.ah = idr_read_ah(user_wr->wr.ud.ah,
+ file->ucontext);
+ if (!next->wr.ud.ah) {
+@@ -2243,9 +2249,11 @@ ssize_t ib_uverbs_post_send(struct ib_uverbs_file *file,
+ user_wr->wr.atomic.compare_add;
+ next->wr.atomic.swap = user_wr->wr.atomic.swap;
+ next->wr.atomic.rkey = user_wr->wr.atomic.rkey;
++ case IB_WR_SEND:
+ break;
+ default:
+- break;
++ ret = -EINVAL;
++ goto out_put;
+ }
+ }
+
+diff --git a/drivers/infiniband/core/uverbs_main.c b/drivers/infiniband/core/uverbs_main.c
+index 71ab83fde472..d3abb7ea2dee 100644
+--- a/drivers/infiniband/core/uverbs_main.c
++++ b/drivers/infiniband/core/uverbs_main.c
+@@ -128,14 +128,18 @@ static int (*uverbs_ex_cmd_table[])(struct ib_uverbs_file *file,
+ static void ib_uverbs_add_one(struct ib_device *device);
+ static void ib_uverbs_remove_one(struct ib_device *device);
+
+-static void ib_uverbs_release_dev(struct kref *ref)
++static void ib_uverbs_release_dev(struct kobject *kobj)
+ {
+ struct ib_uverbs_device *dev =
+- container_of(ref, struct ib_uverbs_device, ref);
++ container_of(kobj, struct ib_uverbs_device, kobj);
+
+- complete(&dev->comp);
++ kfree(dev);
+ }
+
++static struct kobj_type ib_uverbs_dev_ktype = {
++ .release = ib_uverbs_release_dev,
++};
++
+ static void ib_uverbs_release_event_file(struct kref *ref)
+ {
+ struct ib_uverbs_event_file *file =
+@@ -299,13 +303,19 @@ static int ib_uverbs_cleanup_ucontext(struct ib_uverbs_file *file,
+ return context->device->dealloc_ucontext(context);
+ }
+
++static void ib_uverbs_comp_dev(struct ib_uverbs_device *dev)
++{
++ complete(&dev->comp);
++}
++
+ static void ib_uverbs_release_file(struct kref *ref)
+ {
+ struct ib_uverbs_file *file =
+ container_of(ref, struct ib_uverbs_file, ref);
+
+ module_put(file->device->ib_dev->owner);
+- kref_put(&file->device->ref, ib_uverbs_release_dev);
++ if (atomic_dec_and_test(&file->device->refcount))
++ ib_uverbs_comp_dev(file->device);
+
+ kfree(file);
+ }
+@@ -739,9 +749,7 @@ static int ib_uverbs_open(struct inode *inode, struct file *filp)
+ int ret;
+
+ dev = container_of(inode->i_cdev, struct ib_uverbs_device, cdev);
+- if (dev)
+- kref_get(&dev->ref);
+- else
++ if (!atomic_inc_not_zero(&dev->refcount))
+ return -ENXIO;
+
+ if (!try_module_get(dev->ib_dev->owner)) {
+@@ -762,6 +770,7 @@ static int ib_uverbs_open(struct inode *inode, struct file *filp)
+ mutex_init(&file->mutex);
+
+ filp->private_data = file;
++ kobject_get(&dev->kobj);
+
+ return nonseekable_open(inode, filp);
+
+@@ -769,13 +778,16 @@ err_module:
+ module_put(dev->ib_dev->owner);
+
+ err:
+- kref_put(&dev->ref, ib_uverbs_release_dev);
++ if (atomic_dec_and_test(&dev->refcount))
++ ib_uverbs_comp_dev(dev);
++
+ return ret;
+ }
+
+ static int ib_uverbs_close(struct inode *inode, struct file *filp)
+ {
+ struct ib_uverbs_file *file = filp->private_data;
++ struct ib_uverbs_device *dev = file->device;
+
+ ib_uverbs_cleanup_ucontext(file, file->ucontext);
+
+@@ -783,6 +795,7 @@ static int ib_uverbs_close(struct inode *inode, struct file *filp)
+ kref_put(&file->async_file->ref, ib_uverbs_release_event_file);
+
+ kref_put(&file->ref, ib_uverbs_release_file);
++ kobject_put(&dev->kobj);
+
+ return 0;
+ }
+@@ -878,10 +891,11 @@ static void ib_uverbs_add_one(struct ib_device *device)
+ if (!uverbs_dev)
+ return;
+
+- kref_init(&uverbs_dev->ref);
++ atomic_set(&uverbs_dev->refcount, 1);
+ init_completion(&uverbs_dev->comp);
+ uverbs_dev->xrcd_tree = RB_ROOT;
+ mutex_init(&uverbs_dev->xrcd_tree_mutex);
++ kobject_init(&uverbs_dev->kobj, &ib_uverbs_dev_ktype);
+
+ spin_lock(&map_lock);
+ devnum = find_first_zero_bit(dev_map, IB_UVERBS_MAX_DEVICES);
+@@ -908,6 +922,7 @@ static void ib_uverbs_add_one(struct ib_device *device)
+ cdev_init(&uverbs_dev->cdev, NULL);
+ uverbs_dev->cdev.owner = THIS_MODULE;
+ uverbs_dev->cdev.ops = device->mmap ? &uverbs_mmap_fops : &uverbs_fops;
++ uverbs_dev->cdev.kobj.parent = &uverbs_dev->kobj;
+ kobject_set_name(&uverbs_dev->cdev.kobj, "uverbs%d", uverbs_dev->devnum);
+ if (cdev_add(&uverbs_dev->cdev, base, 1))
+ goto err_cdev;
+@@ -938,9 +953,10 @@ err_cdev:
+ clear_bit(devnum, overflow_map);
+
+ err:
+- kref_put(&uverbs_dev->ref, ib_uverbs_release_dev);
++ if (atomic_dec_and_test(&uverbs_dev->refcount))
++ ib_uverbs_comp_dev(uverbs_dev);
+ wait_for_completion(&uverbs_dev->comp);
+- kfree(uverbs_dev);
++ kobject_put(&uverbs_dev->kobj);
+ return;
+ }
+
+@@ -960,9 +976,10 @@ static void ib_uverbs_remove_one(struct ib_device *device)
+ else
+ clear_bit(uverbs_dev->devnum - IB_UVERBS_MAX_DEVICES, overflow_map);
+
+- kref_put(&uverbs_dev->ref, ib_uverbs_release_dev);
++ if (atomic_dec_and_test(&uverbs_dev->refcount))
++ ib_uverbs_comp_dev(uverbs_dev);
+ wait_for_completion(&uverbs_dev->comp);
+- kfree(uverbs_dev);
++ kobject_put(&uverbs_dev->kobj);
+ }
+
+ static char *uverbs_devnode(struct device *dev, umode_t *mode)
+diff --git a/drivers/infiniband/hw/mlx4/ah.c b/drivers/infiniband/hw/mlx4/ah.c
+index 2d8c3397774f..e65ee1947279 100644
+--- a/drivers/infiniband/hw/mlx4/ah.c
++++ b/drivers/infiniband/hw/mlx4/ah.c
+@@ -147,9 +147,13 @@ int mlx4_ib_query_ah(struct ib_ah *ibah, struct ib_ah_attr *ah_attr)
+ enum rdma_link_layer ll;
+
+ memset(ah_attr, 0, sizeof *ah_attr);
+- ah_attr->sl = be32_to_cpu(ah->av.ib.sl_tclass_flowlabel) >> 28;
+ ah_attr->port_num = be32_to_cpu(ah->av.ib.port_pd) >> 24;
+ ll = rdma_port_get_link_layer(ibah->device, ah_attr->port_num);
++ if (ll == IB_LINK_LAYER_ETHERNET)
++ ah_attr->sl = be32_to_cpu(ah->av.eth.sl_tclass_flowlabel) >> 29;
++ else
++ ah_attr->sl = be32_to_cpu(ah->av.ib.sl_tclass_flowlabel) >> 28;
++
+ ah_attr->dlid = ll == IB_LINK_LAYER_INFINIBAND ? be16_to_cpu(ah->av.ib.dlid) : 0;
+ if (ah->av.ib.stat_rate)
+ ah_attr->static_rate = ah->av.ib.stat_rate - MLX4_STAT_RATE_OFFSET;
+diff --git a/drivers/infiniband/hw/mlx4/sysfs.c b/drivers/infiniband/hw/mlx4/sysfs.c
+index cb4c66e723b5..89b43da1978d 100644
+--- a/drivers/infiniband/hw/mlx4/sysfs.c
++++ b/drivers/infiniband/hw/mlx4/sysfs.c
+@@ -660,6 +660,8 @@ static int add_port(struct mlx4_ib_dev *dev, int port_num, int slave)
+ struct mlx4_port *p;
+ int i;
+ int ret;
++ int is_eth = rdma_port_get_link_layer(&dev->ib_dev, port_num) ==
++ IB_LINK_LAYER_ETHERNET;
+
+ p = kzalloc(sizeof *p, GFP_KERNEL);
+ if (!p)
+@@ -677,7 +679,8 @@ static int add_port(struct mlx4_ib_dev *dev, int port_num, int slave)
+
+ p->pkey_group.name = "pkey_idx";
+ p->pkey_group.attrs =
+- alloc_group_attrs(show_port_pkey, store_port_pkey,
++ alloc_group_attrs(show_port_pkey,
++ is_eth ? NULL : store_port_pkey,
+ dev->dev->caps.pkey_table_len[port_num]);
+ if (!p->pkey_group.attrs) {
+ ret = -ENOMEM;
+diff --git a/drivers/infiniband/hw/qib/qib_keys.c b/drivers/infiniband/hw/qib/qib_keys.c
+index 3b9afccaaade..eabe54738be6 100644
+--- a/drivers/infiniband/hw/qib/qib_keys.c
++++ b/drivers/infiniband/hw/qib/qib_keys.c
+@@ -86,6 +86,10 @@ int qib_alloc_lkey(struct qib_mregion *mr, int dma_region)
+ * unrestricted LKEY.
+ */
+ rkt->gen++;
++ /*
++ * bits are capped in qib_verbs.c to insure enough bits
++ * for generation number
++ */
+ mr->lkey = (r << (32 - ib_qib_lkey_table_size)) |
+ ((((1 << (24 - ib_qib_lkey_table_size)) - 1) & rkt->gen)
+ << 8);
+diff --git a/drivers/infiniband/hw/qib/qib_verbs.c b/drivers/infiniband/hw/qib/qib_verbs.c
+index 9bcfbd842980..40afdfce2fbc 100644
+--- a/drivers/infiniband/hw/qib/qib_verbs.c
++++ b/drivers/infiniband/hw/qib/qib_verbs.c
+@@ -40,6 +40,7 @@
+ #include <linux/rculist.h>
+ #include <linux/mm.h>
+ #include <linux/random.h>
++#include <linux/vmalloc.h>
+
+ #include "qib.h"
+ #include "qib_common.h"
+@@ -2086,10 +2087,16 @@ int qib_register_ib_device(struct qib_devdata *dd)
+ * the LKEY). The remaining bits act as a generation number or tag.
+ */
+ spin_lock_init(&dev->lk_table.lock);
++ /* insure generation is at least 4 bits see keys.c */
++ if (ib_qib_lkey_table_size > MAX_LKEY_TABLE_BITS) {
++ qib_dev_warn(dd, "lkey bits %u too large, reduced to %u\n",
++ ib_qib_lkey_table_size, MAX_LKEY_TABLE_BITS);
++ ib_qib_lkey_table_size = MAX_LKEY_TABLE_BITS;
++ }
+ dev->lk_table.max = 1 << ib_qib_lkey_table_size;
+ lk_tab_size = dev->lk_table.max * sizeof(*dev->lk_table.table);
+ dev->lk_table.table = (struct qib_mregion __rcu **)
+- __get_free_pages(GFP_KERNEL, get_order(lk_tab_size));
++ vmalloc(lk_tab_size);
+ if (dev->lk_table.table == NULL) {
+ ret = -ENOMEM;
+ goto err_lk;
+@@ -2262,7 +2269,7 @@ err_tx:
+ sizeof(struct qib_pio_header),
+ dev->pio_hdrs, dev->pio_hdrs_phys);
+ err_hdrs:
+- free_pages((unsigned long) dev->lk_table.table, get_order(lk_tab_size));
++ vfree(dev->lk_table.table);
+ err_lk:
+ kfree(dev->qp_table);
+ err_qpt:
+@@ -2316,8 +2323,7 @@ void qib_unregister_ib_device(struct qib_devdata *dd)
+ sizeof(struct qib_pio_header),
+ dev->pio_hdrs, dev->pio_hdrs_phys);
+ lk_tab_size = dev->lk_table.max * sizeof(*dev->lk_table.table);
+- free_pages((unsigned long) dev->lk_table.table,
+- get_order(lk_tab_size));
++ vfree(dev->lk_table.table);
+ kfree(dev->qp_table);
+ }
+
+diff --git a/drivers/infiniband/hw/qib/qib_verbs.h b/drivers/infiniband/hw/qib/qib_verbs.h
+index bfc8948fdd35..44ca28c83fe6 100644
+--- a/drivers/infiniband/hw/qib/qib_verbs.h
++++ b/drivers/infiniband/hw/qib/qib_verbs.h
+@@ -647,6 +647,8 @@ struct qib_qpn_table {
+ struct qpn_map map[QPNMAP_ENTRIES];
+ };
+
++#define MAX_LKEY_TABLE_BITS 23
++
+ struct qib_lkey_table {
+ spinlock_t lock; /* protect changes in this struct */
+ u32 next; /* next unused index (speeds search) */
+diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c
+index 7b8c29b295ac..357206a20017 100644
+--- a/drivers/infiniband/ulp/isert/ib_isert.c
++++ b/drivers/infiniband/ulp/isert/ib_isert.c
+@@ -3110,9 +3110,16 @@ isert_get_dataout(struct iscsi_conn *conn, struct iscsi_cmd *cmd, bool recovery)
+ static int
+ isert_immediate_queue(struct iscsi_conn *conn, struct iscsi_cmd *cmd, int state)
+ {
+- int ret;
++ struct isert_cmd *isert_cmd = iscsit_priv_cmd(cmd);
++ int ret = 0;
+
+ switch (state) {
++ case ISTATE_REMOVE:
++ spin_lock_bh(&conn->cmd_lock);
++ list_del_init(&cmd->i_conn_node);
++ spin_unlock_bh(&conn->cmd_lock);
++ isert_put_cmd(isert_cmd, true);
++ break;
+ case ISTATE_SEND_NOPIN_WANT_RESPONSE:
+ ret = isert_put_nopin(cmd, conn, false);
+ break;
+diff --git a/drivers/input/evdev.c b/drivers/input/evdev.c
+index 8afa28e4570e..928dec311c2b 100644
+--- a/drivers/input/evdev.c
++++ b/drivers/input/evdev.c
+@@ -239,19 +239,14 @@ static int evdev_flush(struct file *file, fl_owner_t id)
+ {
+ struct evdev_client *client = file->private_data;
+ struct evdev *evdev = client->evdev;
+- int retval;
+
+- retval = mutex_lock_interruptible(&evdev->mutex);
+- if (retval)
+- return retval;
++ mutex_lock(&evdev->mutex);
+
+- if (!evdev->exist || client->revoked)
+- retval = -ENODEV;
+- else
+- retval = input_flush_device(&evdev->handle, file);
++ if (evdev->exist && !client->revoked)
++ input_flush_device(&evdev->handle, file);
+
+ mutex_unlock(&evdev->mutex);
+- return retval;
++ return 0;
+ }
+
+ static void evdev_free(struct device *dev)
+diff --git a/drivers/macintosh/windfarm_core.c b/drivers/macintosh/windfarm_core.c
+index 3ee198b65843..cc7ece1712b5 100644
+--- a/drivers/macintosh/windfarm_core.c
++++ b/drivers/macintosh/windfarm_core.c
+@@ -435,7 +435,7 @@ int wf_unregister_client(struct notifier_block *nb)
+ {
+ mutex_lock(&wf_lock);
+ blocking_notifier_chain_unregister(&wf_client_list, nb);
+- wf_client_count++;
++ wf_client_count--;
+ if (wf_client_count == 0)
+ wf_stop_thread();
+ mutex_unlock(&wf_lock);
+diff --git a/drivers/md/dm-cache-policy-cleaner.c b/drivers/md/dm-cache-policy-cleaner.c
+index b04d1f904d07..2eca9084defe 100644
+--- a/drivers/md/dm-cache-policy-cleaner.c
++++ b/drivers/md/dm-cache-policy-cleaner.c
+@@ -434,7 +434,7 @@ static struct dm_cache_policy *wb_create(dm_cblock_t cache_size,
+ static struct dm_cache_policy_type wb_policy_type = {
+ .name = "cleaner",
+ .version = {1, 0, 0},
+- .hint_size = 0,
++ .hint_size = 4,
+ .owner = THIS_MODULE,
+ .create = wb_create
+ };
+diff --git a/drivers/md/dm-raid.c b/drivers/md/dm-raid.c
+index 07c0fa0fa284..e5d97da5f41e 100644
+--- a/drivers/md/dm-raid.c
++++ b/drivers/md/dm-raid.c
+@@ -327,8 +327,7 @@ static int validate_region_size(struct raid_set *rs, unsigned long region_size)
+ */
+ if (min_region_size > (1 << 13)) {
+ /* If not a power of 2, make it the next power of 2 */
+- if (min_region_size & (min_region_size - 1))
+- region_size = 1 << fls(region_size);
++ region_size = roundup_pow_of_two(min_region_size);
+ DMINFO("Choosing default region size of %lu sectors",
+ region_size);
+ } else {
+diff --git a/drivers/md/md.c b/drivers/md/md.c
+index dd7a3701b99c..9c5d53f3e4c6 100644
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -5073,6 +5073,8 @@ EXPORT_SYMBOL_GPL(md_stop_writes);
+ static void __md_stop(struct mddev *mddev)
+ {
+ mddev->ready = 0;
++ /* Ensure ->event_work is done */
++ flush_workqueue(md_misc_wq);
+ mddev->pers->stop(mddev);
+ if (mddev->pers->sync_request && mddev->to_remove == NULL)
+ mddev->to_remove = &md_redundancy_group;
+diff --git a/drivers/md/persistent-data/dm-btree-internal.h b/drivers/md/persistent-data/dm-btree-internal.h
+index bf2b80d5c470..8731b6ea026b 100644
+--- a/drivers/md/persistent-data/dm-btree-internal.h
++++ b/drivers/md/persistent-data/dm-btree-internal.h
+@@ -138,4 +138,10 @@ int lower_bound(struct btree_node *n, uint64_t key);
+
+ extern struct dm_block_validator btree_node_validator;
+
++/*
++ * Value type for upper levels of multi-level btrees.
++ */
++extern void init_le64_type(struct dm_transaction_manager *tm,
++ struct dm_btree_value_type *vt);
++
+ #endif /* DM_BTREE_INTERNAL_H */
+diff --git a/drivers/md/persistent-data/dm-btree-remove.c b/drivers/md/persistent-data/dm-btree-remove.c
+index a03178e91a79..7c0d75547ccf 100644
+--- a/drivers/md/persistent-data/dm-btree-remove.c
++++ b/drivers/md/persistent-data/dm-btree-remove.c
+@@ -544,14 +544,6 @@ static int remove_raw(struct shadow_spine *s, struct dm_btree_info *info,
+ return r;
+ }
+
+-static struct dm_btree_value_type le64_type = {
+- .context = NULL,
+- .size = sizeof(__le64),
+- .inc = NULL,
+- .dec = NULL,
+- .equal = NULL
+-};
+-
+ int dm_btree_remove(struct dm_btree_info *info, dm_block_t root,
+ uint64_t *keys, dm_block_t *new_root)
+ {
+@@ -559,12 +551,14 @@ int dm_btree_remove(struct dm_btree_info *info, dm_block_t root,
+ int index = 0, r = 0;
+ struct shadow_spine spine;
+ struct btree_node *n;
++ struct dm_btree_value_type le64_vt;
+
++ init_le64_type(info->tm, &le64_vt);
+ init_shadow_spine(&spine, info);
+ for (level = 0; level < info->levels; level++) {
+ r = remove_raw(&spine, info,
+ (level == last_level ?
+- &info->value_type : &le64_type),
++ &info->value_type : &le64_vt),
+ root, keys[level], (unsigned *)&index);
+ if (r < 0)
+ break;
+diff --git a/drivers/md/persistent-data/dm-btree-spine.c b/drivers/md/persistent-data/dm-btree-spine.c
+index 1b5e13ec7f96..0dee514ba4c5 100644
+--- a/drivers/md/persistent-data/dm-btree-spine.c
++++ b/drivers/md/persistent-data/dm-btree-spine.c
+@@ -249,3 +249,40 @@ int shadow_root(struct shadow_spine *s)
+ {
+ return s->root;
+ }
++
++static void le64_inc(void *context, const void *value_le)
++{
++ struct dm_transaction_manager *tm = context;
++ __le64 v_le;
++
++ memcpy(&v_le, value_le, sizeof(v_le));
++ dm_tm_inc(tm, le64_to_cpu(v_le));
++}
++
++static void le64_dec(void *context, const void *value_le)
++{
++ struct dm_transaction_manager *tm = context;
++ __le64 v_le;
++
++ memcpy(&v_le, value_le, sizeof(v_le));
++ dm_tm_dec(tm, le64_to_cpu(v_le));
++}
++
++static int le64_equal(void *context, const void *value1_le, const void *value2_le)
++{
++ __le64 v1_le, v2_le;
++
++ memcpy(&v1_le, value1_le, sizeof(v1_le));
++ memcpy(&v2_le, value2_le, sizeof(v2_le));
++ return v1_le == v2_le;
++}
++
++void init_le64_type(struct dm_transaction_manager *tm,
++ struct dm_btree_value_type *vt)
++{
++ vt->context = tm;
++ vt->size = sizeof(__le64);
++ vt->inc = le64_inc;
++ vt->dec = le64_dec;
++ vt->equal = le64_equal;
++}
+diff --git a/drivers/md/persistent-data/dm-btree.c b/drivers/md/persistent-data/dm-btree.c
+index fdd3793e22f9..c7726cebc495 100644
+--- a/drivers/md/persistent-data/dm-btree.c
++++ b/drivers/md/persistent-data/dm-btree.c
+@@ -667,12 +667,7 @@ static int insert(struct dm_btree_info *info, dm_block_t root,
+ struct btree_node *n;
+ struct dm_btree_value_type le64_type;
+
+- le64_type.context = NULL;
+- le64_type.size = sizeof(__le64);
+- le64_type.inc = NULL;
+- le64_type.dec = NULL;
+- le64_type.equal = NULL;
+-
++ init_le64_type(info->tm, &le64_type);
+ init_shadow_spine(&spine, info);
+
+ for (level = 0; level < (info->levels - 1); level++) {
+diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
+index 32e282f4c83c..17eb76760bf5 100644
+--- a/drivers/md/raid10.c
++++ b/drivers/md/raid10.c
+@@ -3581,6 +3581,7 @@ static struct r10conf *setup_conf(struct mddev *mddev)
+ /* far_copies must be 1 */
+ conf->prev.stride = conf->dev_sectors;
+ }
++ conf->reshape_safe = conf->reshape_progress;
+ spin_lock_init(&conf->device_lock);
+ INIT_LIST_HEAD(&conf->retry_list);
+
+@@ -3788,7 +3789,6 @@ static int run(struct mddev *mddev)
+ }
+ conf->offset_diff = min_offset_diff;
+
+- conf->reshape_safe = conf->reshape_progress;
+ clear_bit(MD_RECOVERY_SYNC, &mddev->recovery);
+ clear_bit(MD_RECOVERY_CHECK, &mddev->recovery);
+ set_bit(MD_RECOVERY_RESHAPE, &mddev->recovery);
+@@ -4135,6 +4135,7 @@ static int raid10_start_reshape(struct mddev *mddev)
+ conf->reshape_progress = size;
+ } else
+ conf->reshape_progress = 0;
++ conf->reshape_safe = conf->reshape_progress;
+ spin_unlock_irq(&conf->device_lock);
+
+ if (mddev->delta_disks && mddev->bitmap) {
+@@ -4201,6 +4202,7 @@ abort:
+ rdev->new_data_offset = rdev->data_offset;
+ smp_wmb();
+ conf->reshape_progress = MaxSector;
++ conf->reshape_safe = MaxSector;
+ mddev->reshape_position = MaxSector;
+ spin_unlock_irq(&conf->device_lock);
+ return ret;
+@@ -4555,6 +4557,7 @@ static void end_reshape(struct r10conf *conf)
+ md_finish_reshape(conf->mddev);
+ smp_wmb();
+ conf->reshape_progress = MaxSector;
++ conf->reshape_safe = MaxSector;
+ spin_unlock_irq(&conf->device_lock);
+
+ /* read-ahead size must cover two whole stripes, which is
+diff --git a/drivers/media/platform/omap3isp/isp.c b/drivers/media/platform/omap3isp/isp.c
+index 72265e58ca60..233eccc5c33e 100644
+--- a/drivers/media/platform/omap3isp/isp.c
++++ b/drivers/media/platform/omap3isp/isp.c
+@@ -813,14 +813,14 @@ static int isp_pipeline_link_notify(struct media_link *link, u32 flags,
+ int ret;
+
+ if (notification == MEDIA_DEV_NOTIFY_POST_LINK_CH &&
+- !(link->flags & MEDIA_LNK_FL_ENABLED)) {
++ !(flags & MEDIA_LNK_FL_ENABLED)) {
+ /* Powering off entities is assumed to never fail. */
+ isp_pipeline_pm_power(source, -sink_use);
+ isp_pipeline_pm_power(sink, -source_use);
+ return 0;
+ }
+
+- if (notification == MEDIA_DEV_NOTIFY_POST_LINK_CH &&
++ if (notification == MEDIA_DEV_NOTIFY_PRE_LINK_CH &&
+ (flags & MEDIA_LNK_FL_ENABLED)) {
+
+ ret = isp_pipeline_pm_power(source, sink_use);
+diff --git a/drivers/media/rc/rc-main.c b/drivers/media/rc/rc-main.c
+index fc369b033484..b4ceda856939 100644
+--- a/drivers/media/rc/rc-main.c
++++ b/drivers/media/rc/rc-main.c
+@@ -1191,9 +1191,6 @@ static int rc_dev_uevent(struct device *device, struct kobj_uevent_env *env)
+ {
+ struct rc_dev *dev = to_rc_dev(device);
+
+- if (!dev || !dev->input_dev)
+- return -ENODEV;
+-
+ if (dev->rc_map.name)
+ ADD_HOTPLUG_VAR("NAME=%s", dev->rc_map.name);
+ if (dev->driver_name)
+diff --git a/drivers/misc/cxl/pci.c b/drivers/misc/cxl/pci.c
+index eee4fd606dc1..cc55691dbea6 100644
+--- a/drivers/misc/cxl/pci.c
++++ b/drivers/misc/cxl/pci.c
+@@ -987,8 +987,6 @@ static int cxl_probe(struct pci_dev *dev, const struct pci_device_id *id)
+ int slice;
+ int rc;
+
+- pci_dev_get(dev);
+-
+ if (cxl_verbose)
+ dump_cxl_config_space(dev);
+
+diff --git a/drivers/mmc/core/core.c b/drivers/mmc/core/core.c
+index 297b4f912c2d..9a8cb9cd852d 100644
+--- a/drivers/mmc/core/core.c
++++ b/drivers/mmc/core/core.c
+@@ -314,8 +314,10 @@ EXPORT_SYMBOL(mmc_start_bkops);
+ */
+ static void mmc_wait_data_done(struct mmc_request *mrq)
+ {
+- mrq->host->context_info.is_done_rcv = true;
+- wake_up_interruptible(&mrq->host->context_info.wait);
++ struct mmc_context_info *context_info = &mrq->host->context_info;
++
++ context_info->is_done_rcv = true;
++ wake_up_interruptible(&context_info->wait);
+ }
+
+ static void mmc_wait_done(struct mmc_request *mrq)
+diff --git a/drivers/mtd/nand/pxa3xx_nand.c b/drivers/mtd/nand/pxa3xx_nand.c
+index bc677362bc73..eac876732f97 100644
+--- a/drivers/mtd/nand/pxa3xx_nand.c
++++ b/drivers/mtd/nand/pxa3xx_nand.c
+@@ -1465,6 +1465,9 @@ static int pxa3xx_nand_scan(struct mtd_info *mtd)
+ if (pdata->keep_config && !pxa3xx_nand_detect_config(info))
+ goto KEEP_CONFIG;
+
++ /* Set a default chunk size */
++ info->chunk_size = 512;
++
+ ret = pxa3xx_nand_sensing(info);
+ if (ret) {
+ dev_info(&info->pdev->dev, "There is no chip on cs %d!\n",
+diff --git a/drivers/mtd/ubi/io.c b/drivers/mtd/ubi/io.c
+index d36134925d31..db657f2168d7 100644
+--- a/drivers/mtd/ubi/io.c
++++ b/drivers/mtd/ubi/io.c
+@@ -921,6 +921,11 @@ static int validate_vid_hdr(const struct ubi_device *ubi,
+ goto bad;
+ }
+
++ if (data_size > ubi->leb_size) {
++ ubi_err("bad data_size");
++ goto bad;
++ }
++
+ if (vol_type == UBI_VID_STATIC) {
+ /*
+ * Although from high-level point of view static volumes may
+diff --git a/drivers/mtd/ubi/vtbl.c b/drivers/mtd/ubi/vtbl.c
+index 07cac5f9ffb8..ec1009407fec 100644
+--- a/drivers/mtd/ubi/vtbl.c
++++ b/drivers/mtd/ubi/vtbl.c
+@@ -651,6 +651,7 @@ static int init_volumes(struct ubi_device *ubi,
+ if (ubi->corr_peb_count)
+ ubi_err("%d PEBs are corrupted and not used",
+ ubi->corr_peb_count);
++ return -ENOSPC;
+ }
+ ubi->rsvd_pebs += reserved_pebs;
+ ubi->avail_pebs -= reserved_pebs;
+diff --git a/drivers/mtd/ubi/wl.c b/drivers/mtd/ubi/wl.c
+index ef670560971e..21d03130d8a7 100644
+--- a/drivers/mtd/ubi/wl.c
++++ b/drivers/mtd/ubi/wl.c
+@@ -1982,6 +1982,7 @@ int ubi_wl_init(struct ubi_device *ubi, struct ubi_attach_info *ai)
+ if (ubi->corr_peb_count)
+ ubi_err("%d PEBs are corrupted and not used",
+ ubi->corr_peb_count);
++ err = -ENOSPC;
+ goto out_free;
+ }
+ ubi->avail_pebs -= reserved_pebs;
+diff --git a/drivers/net/dsa/bcm_sf2.c b/drivers/net/dsa/bcm_sf2.c
+index 4f4c2a7888e5..ea26483833f5 100644
+--- a/drivers/net/dsa/bcm_sf2.c
++++ b/drivers/net/dsa/bcm_sf2.c
+@@ -684,16 +684,12 @@ static void bcm_sf2_sw_fixed_link_update(struct dsa_switch *ds, int port,
+ struct fixed_phy_status *status)
+ {
+ struct bcm_sf2_priv *priv = ds_to_priv(ds);
+- u32 link, duplex, pause, speed;
++ u32 link, duplex, pause;
+ u32 reg;
+
+ link = core_readl(priv, CORE_LNKSTS);
+ duplex = core_readl(priv, CORE_DUPSTS);
+ pause = core_readl(priv, CORE_PAUSESTS);
+- speed = core_readl(priv, CORE_SPDSTS);
+-
+- speed >>= (port * SPDSTS_SHIFT);
+- speed &= SPDSTS_MASK;
+
+ status->link = 0;
+
+@@ -717,18 +713,6 @@ static void bcm_sf2_sw_fixed_link_update(struct dsa_switch *ds, int port,
+ status->duplex = !!(duplex & (1 << port));
+ }
+
+- switch (speed) {
+- case SPDSTS_10:
+- status->speed = SPEED_10;
+- break;
+- case SPDSTS_100:
+- status->speed = SPEED_100;
+- break;
+- case SPDSTS_1000:
+- status->speed = SPEED_1000;
+- break;
+- }
+-
+ if ((pause & (1 << port)) &&
+ (pause & (1 << (port + PAUSESTS_TX_PAUSE_SHIFT)))) {
+ status->asym_pause = 1;
+diff --git a/drivers/net/dsa/bcm_sf2.h b/drivers/net/dsa/bcm_sf2.h
+index ee9f650d5026..3ecfda86366e 100644
+--- a/drivers/net/dsa/bcm_sf2.h
++++ b/drivers/net/dsa/bcm_sf2.h
+@@ -110,8 +110,8 @@ static inline u64 name##_readq(struct bcm_sf2_priv *priv, u32 off) \
+ spin_unlock(&priv->indir_lock); \
+ return (u64)indir << 32 | dir; \
+ } \
+-static inline void name##_writeq(struct bcm_sf2_priv *priv, u32 off, \
+- u64 val) \
++static inline void name##_writeq(struct bcm_sf2_priv *priv, u64 val, \
++ u32 off) \
+ { \
+ spin_lock(&priv->indir_lock); \
+ reg_writel(priv, upper_32_bits(val), REG_DIR_DATA_WRITE); \
+diff --git a/drivers/net/ethernet/altera/altera_tse_main.c b/drivers/net/ethernet/altera/altera_tse_main.c
+index 4efc4355d345..2eb6404755b1 100644
+--- a/drivers/net/ethernet/altera/altera_tse_main.c
++++ b/drivers/net/ethernet/altera/altera_tse_main.c
+@@ -501,8 +501,7 @@ static int tse_poll(struct napi_struct *napi, int budget)
+ if (rxcomplete >= budget || txcomplete > 0)
+ return rxcomplete;
+
+- napi_gro_flush(napi, false);
+- __napi_complete(napi);
++ napi_complete(napi);
+
+ netdev_dbg(priv->dev,
+ "NAPI Complete, did %d packets with budget %d\n",
+diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
+index a37800ecb27c..6fa8272c8f31 100644
+--- a/drivers/net/ethernet/broadcom/tg3.c
++++ b/drivers/net/ethernet/broadcom/tg3.c
+@@ -10752,7 +10752,7 @@ static ssize_t tg3_show_temp(struct device *dev,
+ tg3_ape_scratchpad_read(tp, &temperature, attr->index,
+ sizeof(temperature));
+ spin_unlock_bh(&tp->lock);
+- return sprintf(buf, "%u\n", temperature);
++ return sprintf(buf, "%u\n", temperature * 1000);
+ }
+
+
+diff --git a/drivers/net/ethernet/brocade/bna/bnad.c b/drivers/net/ethernet/brocade/bna/bnad.c
+index c3861de9dc81..d864614f1255 100644
+--- a/drivers/net/ethernet/brocade/bna/bnad.c
++++ b/drivers/net/ethernet/brocade/bna/bnad.c
+@@ -674,6 +674,7 @@ bnad_cq_process(struct bnad *bnad, struct bna_ccb *ccb, int budget)
+ if (!next_cmpl->valid)
+ break;
+ }
++ packets++;
+
+ /* TODO: BNA_CQ_EF_LOCAL ? */
+ if (unlikely(flags & (BNA_CQ_EF_MAC_ERROR |
+@@ -690,7 +691,6 @@ bnad_cq_process(struct bnad *bnad, struct bna_ccb *ccb, int budget)
+ else
+ bnad_cq_setup_skb_frags(rcb, skb, sop_ci, nvecs, len);
+
+- packets++;
+ rcb->rxq->rx_packets++;
+ rcb->rxq->rx_bytes += totlen;
+ ccb->bytes_per_intr += totlen;
+diff --git a/drivers/net/ethernet/intel/igb/igb.h b/drivers/net/ethernet/intel/igb/igb.h
+index 82d891e183b1..95f47b9f50d4 100644
+--- a/drivers/net/ethernet/intel/igb/igb.h
++++ b/drivers/net/ethernet/intel/igb/igb.h
+@@ -531,6 +531,7 @@ void igb_ptp_rx_pktstamp(struct igb_q_vector *q_vector, unsigned char *va,
+ struct sk_buff *skb);
+ int igb_ptp_set_ts_config(struct net_device *netdev, struct ifreq *ifr);
+ int igb_ptp_get_ts_config(struct net_device *netdev, struct ifreq *ifr);
++void igb_set_flag_queue_pairs(struct igb_adapter *, const u32);
+ #ifdef CONFIG_IGB_HWMON
+ void igb_sysfs_exit(struct igb_adapter *adapter);
+ int igb_sysfs_init(struct igb_adapter *adapter);
+diff --git a/drivers/net/ethernet/intel/igb/igb_ethtool.c b/drivers/net/ethernet/intel/igb/igb_ethtool.c
+index 02cfd3b14762..aa176cea5a41 100644
+--- a/drivers/net/ethernet/intel/igb/igb_ethtool.c
++++ b/drivers/net/ethernet/intel/igb/igb_ethtool.c
+@@ -2979,6 +2979,7 @@ static int igb_set_channels(struct net_device *netdev,
+ {
+ struct igb_adapter *adapter = netdev_priv(netdev);
+ unsigned int count = ch->combined_count;
++ unsigned int max_combined = 0;
+
+ /* Verify they are not requesting separate vectors */
+ if (!count || ch->rx_count || ch->tx_count)
+@@ -2989,11 +2990,13 @@ static int igb_set_channels(struct net_device *netdev,
+ return -EINVAL;
+
+ /* Verify the number of channels doesn't exceed hw limits */
+- if (count > igb_max_channels(adapter))
++ max_combined = igb_max_channels(adapter);
++ if (count > max_combined)
+ return -EINVAL;
+
+ if (count != adapter->rss_queues) {
+ adapter->rss_queues = count;
++ igb_set_flag_queue_pairs(adapter, max_combined);
+
+ /* Hardware has to reinitialize queues and interrupts to
+ * match the new configuration.
+diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c
+index 487cd9c4ac0d..e0f36647d3dd 100644
+--- a/drivers/net/ethernet/intel/igb/igb_main.c
++++ b/drivers/net/ethernet/intel/igb/igb_main.c
+@@ -1207,8 +1207,14 @@ static int igb_alloc_q_vector(struct igb_adapter *adapter,
+
+ /* allocate q_vector and rings */
+ q_vector = adapter->q_vector[v_idx];
+- if (!q_vector)
++ if (!q_vector) {
++ q_vector = kzalloc(size, GFP_KERNEL);
++ } else if (size > ksize(q_vector)) {
++ kfree_rcu(q_vector, rcu);
+ q_vector = kzalloc(size, GFP_KERNEL);
++ } else {
++ memset(q_vector, 0, size);
++ }
+ if (!q_vector)
+ return -ENOMEM;
+
+@@ -2861,7 +2867,7 @@ static void igb_probe_vfs(struct igb_adapter *adapter)
+ return;
+
+ pci_sriov_set_totalvfs(pdev, 7);
+- igb_pci_enable_sriov(pdev, max_vfs);
++ igb_enable_sriov(pdev, max_vfs);
+
+ #endif /* CONFIG_PCI_IOV */
+ }
+@@ -2902,6 +2908,14 @@ static void igb_init_queue_configuration(struct igb_adapter *adapter)
+
+ adapter->rss_queues = min_t(u32, max_rss_queues, num_online_cpus());
+
++ igb_set_flag_queue_pairs(adapter, max_rss_queues);
++}
++
++void igb_set_flag_queue_pairs(struct igb_adapter *adapter,
++ const u32 max_rss_queues)
++{
++ struct e1000_hw *hw = &adapter->hw;
++
+ /* Determine if we need to pair queues. */
+ switch (hw->mac.type) {
+ case e1000_82575:
+diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
+index e7ed2513b1d1..7a598932f922 100644
+--- a/drivers/net/usb/usbnet.c
++++ b/drivers/net/usb/usbnet.c
+@@ -779,7 +779,7 @@ int usbnet_stop (struct net_device *net)
+ {
+ struct usbnet *dev = netdev_priv(net);
+ struct driver_info *info = dev->driver_info;
+- int retval, pm;
++ int retval, pm, mpn;
+
+ clear_bit(EVENT_DEV_OPEN, &dev->flags);
+ netif_stop_queue (net);
+@@ -810,6 +810,8 @@ int usbnet_stop (struct net_device *net)
+
+ usbnet_purge_paused_rxq(dev);
+
++ mpn = !test_and_clear_bit(EVENT_NO_RUNTIME_PM, &dev->flags);
++
+ /* deferred work (task, timer, softirq) must also stop.
+ * can't flush_scheduled_work() until we drop rtnl (later),
+ * else workers could deadlock; so make workers a NOP.
+@@ -820,8 +822,7 @@ int usbnet_stop (struct net_device *net)
+ if (!pm)
+ usb_autopm_put_interface(dev->intf);
+
+- if (info->manage_power &&
+- !test_and_clear_bit(EVENT_NO_RUNTIME_PM, &dev->flags))
++ if (info->manage_power && mpn)
+ info->manage_power(dev, 0);
+ else
+ usb_autopm_put_interface(dev->intf);
+diff --git a/drivers/net/wireless/ath/ath10k/htc.c b/drivers/net/wireless/ath/ath10k/htc.c
+index 676bd4ed969b..32003e682351 100644
+--- a/drivers/net/wireless/ath/ath10k/htc.c
++++ b/drivers/net/wireless/ath/ath10k/htc.c
+@@ -162,8 +162,10 @@ int ath10k_htc_send(struct ath10k_htc *htc,
+
+ skb_cb->paddr = dma_map_single(dev, skb->data, skb->len, DMA_TO_DEVICE);
+ ret = dma_mapping_error(dev, skb_cb->paddr);
+- if (ret)
++ if (ret) {
++ ret = -EIO;
+ goto err_credits;
++ }
+
+ sg_item.transfer_id = ep->eid;
+ sg_item.transfer_context = skb;
+diff --git a/drivers/net/wireless/ath/ath10k/htt_tx.c b/drivers/net/wireless/ath/ath10k/htt_tx.c
+index bd87a35201d8..55c60783c129 100644
+--- a/drivers/net/wireless/ath/ath10k/htt_tx.c
++++ b/drivers/net/wireless/ath/ath10k/htt_tx.c
+@@ -402,8 +402,10 @@ int ath10k_htt_mgmt_tx(struct ath10k_htt *htt, struct sk_buff *msdu)
+ skb_cb->paddr = dma_map_single(dev, msdu->data, msdu->len,
+ DMA_TO_DEVICE);
+ res = dma_mapping_error(dev, skb_cb->paddr);
+- if (res)
++ if (res) {
++ res = -EIO;
+ goto err_free_txdesc;
++ }
+
+ skb_put(txdesc, len);
+ cmd = (struct htt_cmd *)txdesc->data;
+@@ -488,8 +490,10 @@ int ath10k_htt_tx(struct ath10k_htt *htt, struct sk_buff *msdu)
+ skb_cb->paddr = dma_map_single(dev, msdu->data, msdu->len,
+ DMA_TO_DEVICE);
+ res = dma_mapping_error(dev, skb_cb->paddr);
+- if (res)
++ if (res) {
++ res = -EIO;
+ goto err_free_txbuf;
++ }
+
+ if (likely(use_frags)) {
+ frags = skb_cb->htt.txbuf->frags;
+diff --git a/drivers/net/wireless/ath/ath10k/pci.c b/drivers/net/wireless/ath/ath10k/pci.c
+index 59e0ea83be50..06620657cc19 100644
+--- a/drivers/net/wireless/ath/ath10k/pci.c
++++ b/drivers/net/wireless/ath/ath10k/pci.c
+@@ -1298,8 +1298,10 @@ static int ath10k_pci_hif_exchange_bmi_msg(struct ath10k *ar,
+
+ req_paddr = dma_map_single(ar->dev, treq, req_len, DMA_TO_DEVICE);
+ ret = dma_mapping_error(ar->dev, req_paddr);
+- if (ret)
++ if (ret) {
++ ret = -EIO;
+ goto err_dma;
++ }
+
+ if (resp && resp_len) {
+ tresp = kzalloc(*resp_len, GFP_KERNEL);
+@@ -1311,8 +1313,10 @@ static int ath10k_pci_hif_exchange_bmi_msg(struct ath10k *ar,
+ resp_paddr = dma_map_single(ar->dev, tresp, *resp_len,
+ DMA_FROM_DEVICE);
+ ret = dma_mapping_error(ar->dev, resp_paddr);
+- if (ret)
++ if (ret) {
++ ret = EIO;
+ goto err_req;
++ }
+
+ xfer.wait_for_resp = true;
+ xfer.resp_len = 0;
+diff --git a/drivers/net/wireless/ath/ath10k/wmi.c b/drivers/net/wireless/ath/ath10k/wmi.c
+index 2c42bd504b79..8a091485960d 100644
+--- a/drivers/net/wireless/ath/ath10k/wmi.c
++++ b/drivers/net/wireless/ath/ath10k/wmi.c
+@@ -1661,6 +1661,7 @@ static void ath10k_wmi_event_host_swba(struct ath10k *ar, struct sk_buff *skb)
+ ATH10K_SKB_CB(bcn)->paddr);
+ if (ret) {
+ ath10k_warn(ar, "failed to map beacon: %d\n", ret);
++ ret = -EIO;
+ dev_kfree_skb_any(bcn);
+ goto skip;
+ }
+diff --git a/drivers/net/wireless/rtlwifi/rtl8821ae/hw.c b/drivers/net/wireless/rtlwifi/rtl8821ae/hw.c
+index 43c14d4da563..e17b728a21aa 100644
+--- a/drivers/net/wireless/rtlwifi/rtl8821ae/hw.c
++++ b/drivers/net/wireless/rtlwifi/rtl8821ae/hw.c
+@@ -2180,7 +2180,7 @@ static int _rtl8821ae_set_media_status(struct ieee80211_hw *hw,
+
+ rtl_write_byte(rtlpriv, (MSR), bt_msr);
+ rtlpriv->cfg->ops->led_control(hw, ledaction);
+- if ((bt_msr & 0xfc) == MSR_AP)
++ if ((bt_msr & MSR_MASK) == MSR_AP)
+ rtl_write_byte(rtlpriv, REG_BCNTCFG + 1, 0x00);
+ else
+ rtl_write_byte(rtlpriv, REG_BCNTCFG + 1, 0x66);
+diff --git a/drivers/net/wireless/rtlwifi/rtl8821ae/reg.h b/drivers/net/wireless/rtlwifi/rtl8821ae/reg.h
+index 53668fc8f23e..1d6110f9c1fb 100644
+--- a/drivers/net/wireless/rtlwifi/rtl8821ae/reg.h
++++ b/drivers/net/wireless/rtlwifi/rtl8821ae/reg.h
+@@ -429,6 +429,7 @@
+ #define MSR_ADHOC 0x01
+ #define MSR_INFRA 0x02
+ #define MSR_AP 0x03
++#define MSR_MASK 0x03
+
+ #define RRSR_RSC_OFFSET 21
+ #define RRSR_SHORT_OFFSET 23
+diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
+index 2b0b4e62f171..2a64f28b2dad 100644
+--- a/drivers/net/xen-netfront.c
++++ b/drivers/net/xen-netfront.c
+@@ -1432,7 +1432,8 @@ static void xennet_disconnect_backend(struct netfront_info *info)
+ queue->tx_evtchn = queue->rx_evtchn = 0;
+ queue->tx_irq = queue->rx_irq = 0;
+
+- napi_synchronize(&queue->napi);
++ if (netif_running(info->netdev))
++ napi_synchronize(&queue->napi);
+
+ xennet_release_tx_bufs(queue);
+ xennet_release_rx_bufs(queue);
+diff --git a/drivers/of/address.c b/drivers/of/address.c
+index 1dba1a9c1fcf..9e77614391a0 100644
+--- a/drivers/of/address.c
++++ b/drivers/of/address.c
+@@ -845,10 +845,10 @@ struct device_node *of_find_matching_node_by_address(struct device_node *from,
+ struct resource res;
+
+ while (dn) {
+- if (of_address_to_resource(dn, 0, &res))
+- continue;
+- if (res.start == base_address)
++ if (!of_address_to_resource(dn, 0, &res) &&
++ res.start == base_address)
+ return dn;
++
+ dn = of_find_matching_node(dn, matches);
+ }
+
+diff --git a/drivers/of/of_mdio.c b/drivers/of/of_mdio.c
+index 1bd43053b8c7..5dc1ef955a0f 100644
+--- a/drivers/of/of_mdio.c
++++ b/drivers/of/of_mdio.c
+@@ -262,7 +262,8 @@ EXPORT_SYMBOL(of_phy_attach);
+ bool of_phy_is_fixed_link(struct device_node *np)
+ {
+ struct device_node *dn;
+- int len;
++ int len, err;
++ const char *managed;
+
+ /* New binding */
+ dn = of_get_child_by_name(np, "fixed-link");
+@@ -271,6 +272,10 @@ bool of_phy_is_fixed_link(struct device_node *np)
+ return true;
+ }
+
++ err = of_property_read_string(np, "managed", &managed);
++ if (err == 0 && strcmp(managed, "auto") != 0)
++ return true;
++
+ /* Old binding */
+ if (of_get_property(np, "fixed-link", &len) &&
+ len == (5 * sizeof(__be32)))
+@@ -285,8 +290,18 @@ int of_phy_register_fixed_link(struct device_node *np)
+ struct fixed_phy_status status = {};
+ struct device_node *fixed_link_node;
+ const __be32 *fixed_link_prop;
+- int len;
++ int len, err;
+ struct phy_device *phy;
++ const char *managed;
++
++ err = of_property_read_string(np, "managed", &managed);
++ if (err == 0) {
++ if (strcmp(managed, "in-band-status") == 0) {
++ /* status is zeroed, namely its .link member */
++ phy = fixed_phy_register(PHY_POLL, &status, np);
++ return IS_ERR(phy) ? PTR_ERR(phy) : 0;
++ }
++ }
+
+ /* New binding */
+ fixed_link_node = of_get_child_by_name(np, "fixed-link");
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index 04ea682ab2aa..00b1cd32a4b1 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -2818,12 +2818,15 @@ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x3c28, vtd_mask_spec_errors);
+
+ static void fixup_ti816x_class(struct pci_dev *dev)
+ {
++ u32 class = dev->class;
++
+ /* TI 816x devices do not have class code set when in PCIe boot mode */
+- dev_info(&dev->dev, "Setting PCI class for 816x PCIe device\n");
+- dev->class = PCI_CLASS_MULTIMEDIA_VIDEO;
++ dev->class = PCI_CLASS_MULTIMEDIA_VIDEO << 8;
++ dev_info(&dev->dev, "PCI class overridden (%#08x -> %#08x)\n",
++ class, dev->class);
+ }
+ DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_TI, 0xb800,
+- PCI_CLASS_NOT_DEFINED, 0, fixup_ti816x_class);
++ PCI_CLASS_NOT_DEFINED, 0, fixup_ti816x_class);
+
+ /* Some PCIe devices do not work reliably with the claimed maximum
+ * payload size supported.
+diff --git a/drivers/platform/x86/hp-wmi.c b/drivers/platform/x86/hp-wmi.c
+index 4c559640dcba..301386c4d85b 100644
+--- a/drivers/platform/x86/hp-wmi.c
++++ b/drivers/platform/x86/hp-wmi.c
+@@ -54,8 +54,9 @@ MODULE_ALIAS("wmi:5FB7F034-2C63-45e9-BE91-3D44E2C707E4");
+ #define HPWMI_HARDWARE_QUERY 0x4
+ #define HPWMI_WIRELESS_QUERY 0x5
+ #define HPWMI_BIOS_QUERY 0x9
++#define HPWMI_FEATURE_QUERY 0xb
+ #define HPWMI_HOTKEY_QUERY 0xc
+-#define HPWMI_FEATURE_QUERY 0xd
++#define HPWMI_FEATURE2_QUERY 0xd
+ #define HPWMI_WIRELESS2_QUERY 0x1b
+ #define HPWMI_POSTCODEERROR_QUERY 0x2a
+
+@@ -295,25 +296,33 @@ static int hp_wmi_tablet_state(void)
+ return (state & 0x4) ? 1 : 0;
+ }
+
+-static int __init hp_wmi_bios_2009_later(void)
++static int __init hp_wmi_bios_2008_later(void)
+ {
+ int state = 0;
+ int ret = hp_wmi_perform_query(HPWMI_FEATURE_QUERY, 0, &state,
+ sizeof(state), sizeof(state));
+- if (ret)
+- return ret;
++ if (!ret)
++ return 1;
+
+- return (state & 0x10) ? 1 : 0;
++ return (ret == HPWMI_RET_UNKNOWN_CMDTYPE) ? 0 : -ENXIO;
+ }
+
+-static int hp_wmi_enable_hotkeys(void)
++static int __init hp_wmi_bios_2009_later(void)
+ {
+- int ret;
+- int query = 0x6e;
++ int state = 0;
++ int ret = hp_wmi_perform_query(HPWMI_FEATURE2_QUERY, 0, &state,
++ sizeof(state), sizeof(state));
++ if (!ret)
++ return 1;
+
+- ret = hp_wmi_perform_query(HPWMI_BIOS_QUERY, 1, &query, sizeof(query),
+- 0);
++ return (ret == HPWMI_RET_UNKNOWN_CMDTYPE) ? 0 : -ENXIO;
++}
+
++static int __init hp_wmi_enable_hotkeys(void)
++{
++ int value = 0x6e;
++ int ret = hp_wmi_perform_query(HPWMI_BIOS_QUERY, 1, &value,
++ sizeof(value), 0);
+ if (ret)
+ return -EINVAL;
+ return 0;
+@@ -663,7 +672,7 @@ static int __init hp_wmi_input_setup(void)
+ hp_wmi_tablet_state());
+ input_sync(hp_wmi_input_dev);
+
+- if (hp_wmi_bios_2009_later() == 4)
++ if (!hp_wmi_bios_2009_later() && hp_wmi_bios_2008_later())
+ hp_wmi_enable_hotkeys();
+
+ status = wmi_install_notify_handler(HPWMI_EVENT_GUID, hp_wmi_notify, NULL);
+diff --git a/drivers/power/avs/Kconfig b/drivers/power/avs/Kconfig
+index 7f3d389bd601..a67eeace6a89 100644
+--- a/drivers/power/avs/Kconfig
++++ b/drivers/power/avs/Kconfig
+@@ -13,7 +13,7 @@ menuconfig POWER_AVS
+
+ config ROCKCHIP_IODOMAIN
+ tristate "Rockchip IO domain support"
+- depends on ARCH_ROCKCHIP && OF
++ depends on POWER_AVS && ARCH_ROCKCHIP && OF
+ help
+ Say y here to enable support io domains on Rockchip SoCs. It is
+ necessary for the io domain setting of the SoC to match the
+diff --git a/drivers/s390/char/sclp_early.c b/drivers/s390/char/sclp_early.c
+index 5bd6cb145a87..efc9a13bf457 100644
+--- a/drivers/s390/char/sclp_early.c
++++ b/drivers/s390/char/sclp_early.c
+@@ -7,6 +7,7 @@
+ #define KMSG_COMPONENT "sclp_early"
+ #define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
+
++#include <linux/errno.h>
+ #include <asm/ctl_reg.h>
+ #include <asm/sclp.h>
+ #include <asm/ipl.h>
+diff --git a/drivers/scsi/3w-9xxx.c b/drivers/scsi/3w-9xxx.c
+index 5f57e3d35e26..6adf9abdf955 100644
+--- a/drivers/scsi/3w-9xxx.c
++++ b/drivers/scsi/3w-9xxx.c
+@@ -225,6 +225,17 @@ static const struct file_operations twa_fops = {
+ .llseek = noop_llseek,
+ };
+
++/*
++ * The controllers use an inline buffer instead of a mapped SGL for small,
++ * single entry buffers. Note that we treat a zero-length transfer like
++ * a mapped SGL.
++ */
++static bool twa_command_mapped(struct scsi_cmnd *cmd)
++{
++ return scsi_sg_count(cmd) != 1 ||
++ scsi_bufflen(cmd) >= TW_MIN_SGL_LENGTH;
++}
++
+ /* This function will complete an aen request from the isr */
+ static int twa_aen_complete(TW_Device_Extension *tw_dev, int request_id)
+ {
+@@ -1351,7 +1362,8 @@ static irqreturn_t twa_interrupt(int irq, void *dev_instance)
+ }
+
+ /* Now complete the io */
+- scsi_dma_unmap(cmd);
++ if (twa_command_mapped(cmd))
++ scsi_dma_unmap(cmd);
+ cmd->scsi_done(cmd);
+ tw_dev->state[request_id] = TW_S_COMPLETED;
+ twa_free_request_id(tw_dev, request_id);
+@@ -1594,7 +1606,8 @@ static int twa_reset_device_extension(TW_Device_Extension *tw_dev)
+ struct scsi_cmnd *cmd = tw_dev->srb[i];
+
+ cmd->result = (DID_RESET << 16);
+- scsi_dma_unmap(cmd);
++ if (twa_command_mapped(cmd))
++ scsi_dma_unmap(cmd);
+ cmd->scsi_done(cmd);
+ }
+ }
+@@ -1777,12 +1790,14 @@ static int twa_scsi_queue_lck(struct scsi_cmnd *SCpnt, void (*done)(struct scsi_
+ retval = twa_scsiop_execute_scsi(tw_dev, request_id, NULL, 0, NULL);
+ switch (retval) {
+ case SCSI_MLQUEUE_HOST_BUSY:
+- scsi_dma_unmap(SCpnt);
++ if (twa_command_mapped(SCpnt))
++ scsi_dma_unmap(SCpnt);
+ twa_free_request_id(tw_dev, request_id);
+ break;
+ case 1:
+ SCpnt->result = (DID_ERROR << 16);
+- scsi_dma_unmap(SCpnt);
++ if (twa_command_mapped(SCpnt))
++ scsi_dma_unmap(SCpnt);
+ done(SCpnt);
+ tw_dev->state[request_id] = TW_S_COMPLETED;
+ twa_free_request_id(tw_dev, request_id);
+@@ -1843,8 +1858,7 @@ static int twa_scsiop_execute_scsi(TW_Device_Extension *tw_dev, int request_id,
+ /* Map sglist from scsi layer to cmd packet */
+
+ if (scsi_sg_count(srb)) {
+- if ((scsi_sg_count(srb) == 1) &&
+- (scsi_bufflen(srb) < TW_MIN_SGL_LENGTH)) {
++ if (!twa_command_mapped(srb)) {
+ if (srb->sc_data_direction == DMA_TO_DEVICE ||
+ srb->sc_data_direction == DMA_BIDIRECTIONAL)
+ scsi_sg_copy_to_buffer(srb,
+@@ -1917,7 +1931,7 @@ static void twa_scsiop_execute_scsi_complete(TW_Device_Extension *tw_dev, int re
+ {
+ struct scsi_cmnd *cmd = tw_dev->srb[request_id];
+
+- if (scsi_bufflen(cmd) < TW_MIN_SGL_LENGTH &&
++ if (!twa_command_mapped(cmd) &&
+ (cmd->sc_data_direction == DMA_FROM_DEVICE ||
+ cmd->sc_data_direction == DMA_BIDIRECTIONAL)) {
+ if (scsi_sg_count(cmd) == 1) {
+diff --git a/drivers/scsi/scsi_error.c b/drivers/scsi/scsi_error.c
+index 01a79473350a..3d12c52c3f81 100644
+--- a/drivers/scsi/scsi_error.c
++++ b/drivers/scsi/scsi_error.c
+@@ -2166,8 +2166,17 @@ int scsi_error_handler(void *data)
+ * We never actually get interrupted because kthread_run
+ * disables signal delivery for the created thread.
+ */
+- while (!kthread_should_stop()) {
++ while (true) {
++ /*
++ * The sequence in kthread_stop() sets the stop flag first
++ * then wakes the process. To avoid missed wakeups, the task
++ * should always be in a non running state before the stop
++ * flag is checked
++ */
+ set_current_state(TASK_INTERRUPTIBLE);
++ if (kthread_should_stop())
++ break;
++
+ if ((shost->host_failed == 0 && shost->host_eh_scheduled == 0) ||
+ shost->host_failed != atomic_read(&shost->host_busy)) {
+ SCSI_LOG_ERROR_RECOVERY(1,
+diff --git a/drivers/spi/spi-pxa2xx.c b/drivers/spi/spi-pxa2xx.c
+index d95656d05eb6..e56802d85ff9 100644
+--- a/drivers/spi/spi-pxa2xx.c
++++ b/drivers/spi/spi-pxa2xx.c
+@@ -564,6 +564,10 @@ static irqreturn_t ssp_int(int irq, void *dev_id)
+ if (!(sccr1_reg & SSCR1_TIE))
+ mask &= ~SSSR_TFS;
+
++ /* Ignore RX timeout interrupt if it is disabled */
++ if (!(sccr1_reg & SSCR1_TINTE))
++ mask &= ~SSSR_TINT;
++
+ if (!(status & mask))
+ return IRQ_NONE;
+
+diff --git a/drivers/spi/spi-xtensa-xtfpga.c b/drivers/spi/spi-xtensa-xtfpga.c
+index 0dc5df5233a9..cb030389a265 100644
+--- a/drivers/spi/spi-xtensa-xtfpga.c
++++ b/drivers/spi/spi-xtensa-xtfpga.c
+@@ -34,13 +34,13 @@ struct xtfpga_spi {
+ static inline void xtfpga_spi_write32(const struct xtfpga_spi *spi,
+ unsigned addr, u32 val)
+ {
+- iowrite32(val, spi->regs + addr);
++ __raw_writel(val, spi->regs + addr);
+ }
+
+ static inline unsigned int xtfpga_spi_read32(const struct xtfpga_spi *spi,
+ unsigned addr)
+ {
+- return ioread32(spi->regs + addr);
++ return __raw_readl(spi->regs + addr);
+ }
+
+ static inline void xtfpga_spi_wait_busy(struct xtfpga_spi *xspi)
+diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
+index 115ad5dbc7c5..85a6da81723a 100644
+--- a/drivers/spi/spi.c
++++ b/drivers/spi/spi.c
+@@ -1478,8 +1478,7 @@ static struct class spi_master_class = {
+ *
+ * The caller is responsible for assigning the bus number and initializing
+ * the master's methods before calling spi_register_master(); and (after errors
+- * adding the device) calling spi_master_put() and kfree() to prevent a memory
+- * leak.
++ * adding the device) calling spi_master_put() to prevent a memory leak.
+ */
+ struct spi_master *spi_alloc_master(struct device *dev, unsigned size)
+ {
+diff --git a/drivers/staging/android/ion/ion.c b/drivers/staging/android/ion/ion.c
+index 56604f41ec48..ce3808a868e7 100644
+--- a/drivers/staging/android/ion/ion.c
++++ b/drivers/staging/android/ion/ion.c
+@@ -1176,13 +1176,13 @@ struct ion_handle *ion_import_dma_buf(struct ion_client *client, int fd)
+ mutex_unlock(&client->lock);
+ goto end;
+ }
+- mutex_unlock(&client->lock);
+
+ handle = ion_handle_create(client, buffer);
+- if (IS_ERR(handle))
++ if (IS_ERR(handle)) {
++ mutex_unlock(&client->lock);
+ goto end;
++ }
+
+- mutex_lock(&client->lock);
+ ret = ion_handle_add(client, handle);
+ mutex_unlock(&client->lock);
+ if (ret) {
+diff --git a/drivers/staging/comedi/drivers/adl_pci7x3x.c b/drivers/staging/comedi/drivers/adl_pci7x3x.c
+index fb8e5f582496..3346c0753d7e 100644
+--- a/drivers/staging/comedi/drivers/adl_pci7x3x.c
++++ b/drivers/staging/comedi/drivers/adl_pci7x3x.c
+@@ -113,8 +113,20 @@ static int adl_pci7x3x_do_insn_bits(struct comedi_device *dev,
+ {
+ unsigned long reg = (unsigned long)s->private;
+
+- if (comedi_dio_update_state(s, data))
+- outl(s->state, dev->iobase + reg);
++ if (comedi_dio_update_state(s, data)) {
++ unsigned int val = s->state;
++
++ if (s->n_chan == 16) {
++ /*
++ * It seems the PCI-7230 needs the 16-bit DO state
++ * to be shifted left by 16 bits before being written
++ * to the 32-bit register. Set the value in both
++ * halves of the register to be sure.
++ */
++ val |= val << 16;
++ }
++ outl(val, dev->iobase + reg);
++ }
+
+ data[1] = s->state;
+
+diff --git a/drivers/staging/speakup/fakekey.c b/drivers/staging/speakup/fakekey.c
+index 4299cf45f947..5e1f16c36b49 100644
+--- a/drivers/staging/speakup/fakekey.c
++++ b/drivers/staging/speakup/fakekey.c
+@@ -81,6 +81,7 @@ void speakup_fake_down_arrow(void)
+ __this_cpu_write(reporting_keystroke, true);
+ input_report_key(virt_keyboard, KEY_DOWN, PRESSED);
+ input_report_key(virt_keyboard, KEY_DOWN, RELEASED);
++ input_sync(virt_keyboard);
+ __this_cpu_write(reporting_keystroke, false);
+
+ /* reenable preemption */
+diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
+index 06ea1a113e45..062633295bc2 100644
+--- a/drivers/target/iscsi/iscsi_target.c
++++ b/drivers/target/iscsi/iscsi_target.c
+@@ -343,7 +343,6 @@ static struct iscsi_np *iscsit_get_np(
+
+ struct iscsi_np *iscsit_add_np(
+ struct __kernel_sockaddr_storage *sockaddr,
+- char *ip_str,
+ int network_transport)
+ {
+ struct sockaddr_in *sock_in;
+@@ -372,11 +371,9 @@ struct iscsi_np *iscsit_add_np(
+ np->np_flags |= NPF_IP_NETWORK;
+ if (sockaddr->ss_family == AF_INET6) {
+ sock_in6 = (struct sockaddr_in6 *)sockaddr;
+- snprintf(np->np_ip, IPV6_ADDRESS_SPACE, "%s", ip_str);
+ np->np_port = ntohs(sock_in6->sin6_port);
+ } else {
+ sock_in = (struct sockaddr_in *)sockaddr;
+- sprintf(np->np_ip, "%s", ip_str);
+ np->np_port = ntohs(sock_in->sin_port);
+ }
+
+@@ -413,8 +410,8 @@ struct iscsi_np *iscsit_add_np(
+ list_add_tail(&np->np_list, &g_np_list);
+ mutex_unlock(&np_lock);
+
+- pr_debug("CORE[0] - Added Network Portal: %s:%hu on %s\n",
+- np->np_ip, np->np_port, np->np_transport->name);
++ pr_debug("CORE[0] - Added Network Portal: %pISc:%hu on %s\n",
++ &np->np_sockaddr, np->np_port, np->np_transport->name);
+
+ return np;
+ }
+@@ -483,8 +480,8 @@ int iscsit_del_np(struct iscsi_np *np)
+ list_del(&np->np_list);
+ mutex_unlock(&np_lock);
+
+- pr_debug("CORE[0] - Removed Network Portal: %s:%hu on %s\n",
+- np->np_ip, np->np_port, np->np_transport->name);
++ pr_debug("CORE[0] - Removed Network Portal: %pISc:%hu on %s\n",
++ &np->np_sockaddr, np->np_port, np->np_transport->name);
+
+ iscsit_put_transport(np->np_transport);
+ kfree(np);
+@@ -3482,11 +3479,18 @@ iscsit_build_sendtargets_response(struct iscsi_cmd *cmd,
+ target_name_printed = 1;
+ }
+
+- len = sprintf(buf, "TargetAddress="
+- "%s:%hu,%hu",
+- inaddr_any ? conn->local_ip : np->np_ip,
+- np->np_port,
+- tpg->tpgt);
++ if (inaddr_any) {
++ len = sprintf(buf, "TargetAddress="
++ "%s:%hu,%hu",
++ conn->local_ip,
++ np->np_port,
++ tpg->tpgt);
++ } else {
++ len = sprintf(buf, "TargetAddress="
++ "%pISpc,%hu",
++ &np->np_sockaddr,
++ tpg->tpgt);
++ }
+ len += 1;
+
+ if ((len + payload_len) > buffer_len) {
+diff --git a/drivers/target/iscsi/iscsi_target.h b/drivers/target/iscsi/iscsi_target.h
+index e936d56fb523..3ef6ef582b10 100644
+--- a/drivers/target/iscsi/iscsi_target.h
++++ b/drivers/target/iscsi/iscsi_target.h
+@@ -13,7 +13,7 @@ extern int iscsit_deaccess_np(struct iscsi_np *, struct iscsi_portal_group *,
+ extern bool iscsit_check_np_match(struct __kernel_sockaddr_storage *,
+ struct iscsi_np *, int);
+ extern struct iscsi_np *iscsit_add_np(struct __kernel_sockaddr_storage *,
+- char *, int);
++ int);
+ extern int iscsit_reset_np_thread(struct iscsi_np *, struct iscsi_tpg_np *,
+ struct iscsi_portal_group *, bool);
+ extern int iscsit_del_np(struct iscsi_np *);
+diff --git a/drivers/target/iscsi/iscsi_target_configfs.c b/drivers/target/iscsi/iscsi_target_configfs.c
+index 9059c1e0b26e..49b34655e57a 100644
+--- a/drivers/target/iscsi/iscsi_target_configfs.c
++++ b/drivers/target/iscsi/iscsi_target_configfs.c
+@@ -103,7 +103,7 @@ static ssize_t lio_target_np_store_sctp(
+ * Use existing np->np_sockaddr for SCTP network portal reference
+ */
+ tpg_np_sctp = iscsit_tpg_add_network_portal(tpg, &np->np_sockaddr,
+- np->np_ip, tpg_np, ISCSI_SCTP_TCP);
++ tpg_np, ISCSI_SCTP_TCP);
+ if (!tpg_np_sctp || IS_ERR(tpg_np_sctp))
+ goto out;
+ } else {
+@@ -181,7 +181,7 @@ static ssize_t lio_target_np_store_iser(
+ }
+
+ tpg_np_iser = iscsit_tpg_add_network_portal(tpg, &np->np_sockaddr,
+- np->np_ip, tpg_np, ISCSI_INFINIBAND);
++ tpg_np, ISCSI_INFINIBAND);
+ if (IS_ERR(tpg_np_iser)) {
+ rc = PTR_ERR(tpg_np_iser);
+ goto out;
+@@ -252,8 +252,8 @@ static struct se_tpg_np *lio_target_call_addnptotpg(
+ return ERR_PTR(-EINVAL);
+ }
+ str++; /* Skip over leading "[" */
+- *str2 = '\0'; /* Terminate the IPv6 address */
+- str2++; /* Skip over the "]" */
++ *str2 = '\0'; /* Terminate the unbracketed IPv6 address */
++ str2++; /* Skip over the \0 */
+ port_str = strstr(str2, ":");
+ if (!port_str) {
+ pr_err("Unable to locate \":port\""
+@@ -320,7 +320,7 @@ static struct se_tpg_np *lio_target_call_addnptotpg(
+ * sys/kernel/config/iscsi/$IQN/$TPG/np/$IP:$PORT/
+ *
+ */
+- tpg_np = iscsit_tpg_add_network_portal(tpg, &sockaddr, str, NULL,
++ tpg_np = iscsit_tpg_add_network_portal(tpg, &sockaddr, NULL,
+ ISCSI_TCP);
+ if (IS_ERR(tpg_np)) {
+ iscsit_put_tpg(tpg);
+@@ -348,8 +348,8 @@ static void lio_target_call_delnpfromtpg(
+
+ se_tpg = &tpg->tpg_se_tpg;
+ pr_debug("LIO_Target_ConfigFS: DEREGISTER -> %s TPGT: %hu"
+- " PORTAL: %s:%hu\n", config_item_name(&se_tpg->se_tpg_wwn->wwn_group.cg_item),
+- tpg->tpgt, tpg_np->tpg_np->np_ip, tpg_np->tpg_np->np_port);
++ " PORTAL: %pISc:%hu\n", config_item_name(&se_tpg->se_tpg_wwn->wwn_group.cg_item),
++ tpg->tpgt, &tpg_np->tpg_np->np_sockaddr, tpg_np->tpg_np->np_port);
+
+ ret = iscsit_tpg_del_network_portal(tpg, tpg_np);
+ if (ret < 0)
+diff --git a/drivers/target/iscsi/iscsi_target_login.c b/drivers/target/iscsi/iscsi_target_login.c
+index 719ec300cd24..eb320e6eb93d 100644
+--- a/drivers/target/iscsi/iscsi_target_login.c
++++ b/drivers/target/iscsi/iscsi_target_login.c
+@@ -879,8 +879,8 @@ static void iscsi_handle_login_thread_timeout(unsigned long data)
+ struct iscsi_np *np = (struct iscsi_np *) data;
+
+ spin_lock_bh(&np->np_thread_lock);
+- pr_err("iSCSI Login timeout on Network Portal %s:%hu\n",
+- np->np_ip, np->np_port);
++ pr_err("iSCSI Login timeout on Network Portal %pISc:%hu\n",
++ &np->np_sockaddr, np->np_port);
+
+ if (np->np_login_timer_flags & ISCSI_TF_STOP) {
+ spin_unlock_bh(&np->np_thread_lock);
+@@ -1357,8 +1357,8 @@ static int __iscsi_target_login_thread(struct iscsi_np *np)
+ spin_lock_bh(&np->np_thread_lock);
+ if (np->np_thread_state != ISCSI_NP_THREAD_ACTIVE) {
+ spin_unlock_bh(&np->np_thread_lock);
+- pr_err("iSCSI Network Portal on %s:%hu currently not"
+- " active.\n", np->np_ip, np->np_port);
++ pr_err("iSCSI Network Portal on %pISc:%hu currently not"
++ " active.\n", &np->np_sockaddr, np->np_port);
+ iscsit_tx_login_rsp(conn, ISCSI_STATUS_CLS_TARGET_ERR,
+ ISCSI_LOGIN_STATUS_SVC_UNAVAILABLE);
+ goto new_sess_out;
+diff --git a/drivers/target/iscsi/iscsi_target_tpg.c b/drivers/target/iscsi/iscsi_target_tpg.c
+index c3cb5c15efda..5530321c44f2 100644
+--- a/drivers/target/iscsi/iscsi_target_tpg.c
++++ b/drivers/target/iscsi/iscsi_target_tpg.c
+@@ -464,7 +464,6 @@ static bool iscsit_tpg_check_network_portal(
+ struct iscsi_tpg_np *iscsit_tpg_add_network_portal(
+ struct iscsi_portal_group *tpg,
+ struct __kernel_sockaddr_storage *sockaddr,
+- char *ip_str,
+ struct iscsi_tpg_np *tpg_np_parent,
+ int network_transport)
+ {
+@@ -474,8 +473,8 @@ struct iscsi_tpg_np *iscsit_tpg_add_network_portal(
+ if (!tpg_np_parent) {
+ if (iscsit_tpg_check_network_portal(tpg->tpg_tiqn, sockaddr,
+ network_transport)) {
+- pr_err("Network Portal: %s already exists on a"
+- " different TPG on %s\n", ip_str,
++ pr_err("Network Portal: %pISc already exists on a"
++ " different TPG on %s\n", sockaddr,
+ tpg->tpg_tiqn->tiqn);
+ return ERR_PTR(-EEXIST);
+ }
+@@ -488,7 +487,7 @@ struct iscsi_tpg_np *iscsit_tpg_add_network_portal(
+ return ERR_PTR(-ENOMEM);
+ }
+
+- np = iscsit_add_np(sockaddr, ip_str, network_transport);
++ np = iscsit_add_np(sockaddr, network_transport);
+ if (IS_ERR(np)) {
+ kfree(tpg_np);
+ return ERR_CAST(np);
+@@ -519,8 +518,8 @@ struct iscsi_tpg_np *iscsit_tpg_add_network_portal(
+ spin_unlock(&tpg_np_parent->tpg_np_parent_lock);
+ }
+
+- pr_debug("CORE[%s] - Added Network Portal: %s:%hu,%hu on %s\n",
+- tpg->tpg_tiqn->tiqn, np->np_ip, np->np_port, tpg->tpgt,
++ pr_debug("CORE[%s] - Added Network Portal: %pISc:%hu,%hu on %s\n",
++ tpg->tpg_tiqn->tiqn, &np->np_sockaddr, np->np_port, tpg->tpgt,
+ np->np_transport->name);
+
+ return tpg_np;
+@@ -533,8 +532,8 @@ static int iscsit_tpg_release_np(
+ {
+ iscsit_clear_tpg_np_login_thread(tpg_np, tpg, true);
+
+- pr_debug("CORE[%s] - Removed Network Portal: %s:%hu,%hu on %s\n",
+- tpg->tpg_tiqn->tiqn, np->np_ip, np->np_port, tpg->tpgt,
++ pr_debug("CORE[%s] - Removed Network Portal: %pISc:%hu,%hu on %s\n",
++ tpg->tpg_tiqn->tiqn, &np->np_sockaddr, np->np_port, tpg->tpgt,
+ np->np_transport->name);
+
+ tpg_np->tpg_np = NULL;
+diff --git a/drivers/target/iscsi/iscsi_target_tpg.h b/drivers/target/iscsi/iscsi_target_tpg.h
+index e7265337bc43..e216128b5a98 100644
+--- a/drivers/target/iscsi/iscsi_target_tpg.h
++++ b/drivers/target/iscsi/iscsi_target_tpg.h
+@@ -22,7 +22,7 @@ extern struct iscsi_node_attrib *iscsit_tpg_get_node_attrib(struct iscsi_session
+ extern void iscsit_tpg_del_external_nps(struct iscsi_tpg_np *);
+ extern struct iscsi_tpg_np *iscsit_tpg_locate_child_np(struct iscsi_tpg_np *, int);
+ extern struct iscsi_tpg_np *iscsit_tpg_add_network_portal(struct iscsi_portal_group *,
+- struct __kernel_sockaddr_storage *, char *, struct iscsi_tpg_np *,
++ struct __kernel_sockaddr_storage *, struct iscsi_tpg_np *,
+ int);
+ extern int iscsit_tpg_del_network_portal(struct iscsi_portal_group *,
+ struct iscsi_tpg_np *);
+diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c
+index e3ebb674a693..fea7d905e77c 100644
+--- a/drivers/tty/n_tty.c
++++ b/drivers/tty/n_tty.c
+@@ -364,8 +364,8 @@ static void n_tty_packet_mode_flush(struct tty_struct *tty)
+ spin_lock_irqsave(&tty->ctrl_lock, flags);
+ if (tty->link->packet) {
+ tty->ctrl_status |= TIOCPKT_FLUSHREAD;
+- if (waitqueue_active(&tty->link->read_wait))
+- wake_up_interruptible(&tty->link->read_wait);
++ spin_unlock_irqrestore(&tty->ctrl_lock, flags);
++ wake_up_interruptible(&tty->link->read_wait);
+ }
+ spin_unlock_irqrestore(&tty->ctrl_lock, flags);
+ }
+@@ -1387,8 +1387,7 @@ handle_newline:
+ put_tty_queue(c, ldata);
+ ldata->canon_head = ldata->read_head;
+ kill_fasync(&tty->fasync, SIGIO, POLL_IN);
+- if (waitqueue_active(&tty->read_wait))
+- wake_up_interruptible_poll(&tty->read_wait, POLLIN);
++ wake_up_interruptible_poll(&tty->read_wait, POLLIN);
+ return 0;
+ }
+ }
+@@ -1671,8 +1670,7 @@ static void __receive_buf(struct tty_struct *tty, const unsigned char *cp,
+ if ((!ldata->icanon && (read_cnt(ldata) >= ldata->minimum_to_wake)) ||
+ L_EXTPROC(tty)) {
+ kill_fasync(&tty->fasync, SIGIO, POLL_IN);
+- if (waitqueue_active(&tty->read_wait))
+- wake_up_interruptible_poll(&tty->read_wait, POLLIN);
++ wake_up_interruptible_poll(&tty->read_wait, POLLIN);
+ }
+ }
+
+@@ -1891,10 +1889,8 @@ static void n_tty_set_termios(struct tty_struct *tty, struct ktermios *old)
+ }
+
+ /* The termios change make the tty ready for I/O */
+- if (waitqueue_active(&tty->write_wait))
+- wake_up_interruptible(&tty->write_wait);
+- if (waitqueue_active(&tty->read_wait))
+- wake_up_interruptible(&tty->read_wait);
++ wake_up_interruptible(&tty->write_wait);
++ wake_up_interruptible(&tty->read_wait);
+ }
+
+ /**
+diff --git a/drivers/tty/serial/8250/8250_pnp.c b/drivers/tty/serial/8250/8250_pnp.c
+index 682a2fbe5c06..2b22cc1e57a2 100644
+--- a/drivers/tty/serial/8250/8250_pnp.c
++++ b/drivers/tty/serial/8250/8250_pnp.c
+@@ -364,6 +364,11 @@ static const struct pnp_device_id pnp_dev_table[] = {
+ /* Winbond CIR port, should not be probed. We should keep track
+ of it to prevent the legacy serial driver from probing it */
+ { "WEC1022", CIR_PORT },
++ /*
++ * SMSC IrCC SIR/FIR port, should not be probed by serial driver
++ * as well so its own driver can bind to it.
++ */
++ { "SMCF010", CIR_PORT },
+ { "", 0 }
+ };
+
+diff --git a/drivers/usb/chipidea/udc.c b/drivers/usb/chipidea/udc.c
+index c42bf8da56db..7b362870277e 100644
+--- a/drivers/usb/chipidea/udc.c
++++ b/drivers/usb/chipidea/udc.c
+@@ -638,6 +638,44 @@ __acquires(hwep->lock)
+ return 0;
+ }
+
++static int _ep_set_halt(struct usb_ep *ep, int value, bool check_transfer)
++{
++ struct ci_hw_ep *hwep = container_of(ep, struct ci_hw_ep, ep);
++ int direction, retval = 0;
++ unsigned long flags;
++
++ if (ep == NULL || hwep->ep.desc == NULL)
++ return -EINVAL;
++
++ if (usb_endpoint_xfer_isoc(hwep->ep.desc))
++ return -EOPNOTSUPP;
++
++ spin_lock_irqsave(hwep->lock, flags);
++
++ if (value && hwep->dir == TX && check_transfer &&
++ !list_empty(&hwep->qh.queue) &&
++ !usb_endpoint_xfer_control(hwep->ep.desc)) {
++ spin_unlock_irqrestore(hwep->lock, flags);
++ return -EAGAIN;
++ }
++
++ direction = hwep->dir;
++ do {
++ retval |= hw_ep_set_halt(hwep->ci, hwep->num, hwep->dir, value);
++
++ if (!value)
++ hwep->wedge = 0;
++
++ if (hwep->type == USB_ENDPOINT_XFER_CONTROL)
++ hwep->dir = (hwep->dir == TX) ? RX : TX;
++
++ } while (hwep->dir != direction);
++
++ spin_unlock_irqrestore(hwep->lock, flags);
++ return retval;
++}
++
++
+ /**
+ * _gadget_stop_activity: stops all USB activity, flushes & disables all endpts
+ * @gadget: gadget
+@@ -1037,7 +1075,7 @@ __acquires(ci->lock)
+ num += ci->hw_ep_max / 2;
+
+ spin_unlock(&ci->lock);
+- err = usb_ep_set_halt(&ci->ci_hw_ep[num].ep);
++ err = _ep_set_halt(&ci->ci_hw_ep[num].ep, 1, false);
+ spin_lock(&ci->lock);
+ if (!err)
+ isr_setup_status_phase(ci);
+@@ -1096,8 +1134,8 @@ delegate:
+
+ if (err < 0) {
+ spin_unlock(&ci->lock);
+- if (usb_ep_set_halt(&hwep->ep))
+- dev_err(ci->dev, "error: ep_set_halt\n");
++ if (_ep_set_halt(&hwep->ep, 1, false))
++ dev_err(ci->dev, "error: _ep_set_halt\n");
+ spin_lock(&ci->lock);
+ }
+ }
+@@ -1128,9 +1166,9 @@ __acquires(ci->lock)
+ err = isr_setup_status_phase(ci);
+ if (err < 0) {
+ spin_unlock(&ci->lock);
+- if (usb_ep_set_halt(&hwep->ep))
++ if (_ep_set_halt(&hwep->ep, 1, false))
+ dev_err(ci->dev,
+- "error: ep_set_halt\n");
++ "error: _ep_set_halt\n");
+ spin_lock(&ci->lock);
+ }
+ }
+@@ -1373,41 +1411,7 @@ static int ep_dequeue(struct usb_ep *ep, struct usb_request *req)
+ */
+ static int ep_set_halt(struct usb_ep *ep, int value)
+ {
+- struct ci_hw_ep *hwep = container_of(ep, struct ci_hw_ep, ep);
+- int direction, retval = 0;
+- unsigned long flags;
+-
+- if (ep == NULL || hwep->ep.desc == NULL)
+- return -EINVAL;
+-
+- if (usb_endpoint_xfer_isoc(hwep->ep.desc))
+- return -EOPNOTSUPP;
+-
+- spin_lock_irqsave(hwep->lock, flags);
+-
+-#ifndef STALL_IN
+- /* g_file_storage MS compliant but g_zero fails chapter 9 compliance */
+- if (value && hwep->type == USB_ENDPOINT_XFER_BULK && hwep->dir == TX &&
+- !list_empty(&hwep->qh.queue)) {
+- spin_unlock_irqrestore(hwep->lock, flags);
+- return -EAGAIN;
+- }
+-#endif
+-
+- direction = hwep->dir;
+- do {
+- retval |= hw_ep_set_halt(hwep->ci, hwep->num, hwep->dir, value);
+-
+- if (!value)
+- hwep->wedge = 0;
+-
+- if (hwep->type == USB_ENDPOINT_XFER_CONTROL)
+- hwep->dir = (hwep->dir == TX) ? RX : TX;
+-
+- } while (hwep->dir != direction);
+-
+- spin_unlock_irqrestore(hwep->lock, flags);
+- return retval;
++ return _ep_set_halt(ep, value, true);
+ }
+
+ /**
+diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c
+index b2a540b43f97..b9ddf0c1ffe5 100644
+--- a/drivers/usb/core/config.c
++++ b/drivers/usb/core/config.c
+@@ -112,7 +112,7 @@ static void usb_parse_ss_endpoint_companion(struct device *ddev, int cfgno,
+ cfgno, inum, asnum, ep->desc.bEndpointAddress);
+ ep->ss_ep_comp.bmAttributes = 16;
+ } else if (usb_endpoint_xfer_isoc(&ep->desc) &&
+- desc->bmAttributes > 2) {
++ USB_SS_MULT(desc->bmAttributes) > 3) {
+ dev_warn(ddev, "Isoc endpoint has Mult of %d in "
+ "config %d interface %d altsetting %d ep %d: "
+ "setting to 3\n", desc->bmAttributes + 1,
+@@ -121,7 +121,8 @@ static void usb_parse_ss_endpoint_companion(struct device *ddev, int cfgno,
+ }
+
+ if (usb_endpoint_xfer_isoc(&ep->desc))
+- max_tx = (desc->bMaxBurst + 1) * (desc->bmAttributes + 1) *
++ max_tx = (desc->bMaxBurst + 1) *
++ (USB_SS_MULT(desc->bmAttributes)) *
+ usb_endpoint_maxp(&ep->desc);
+ else if (usb_endpoint_xfer_int(&ep->desc))
+ max_tx = usb_endpoint_maxp(&ep->desc) *
+diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
+index 41e510ae8c83..8a77a417ccfd 100644
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -54,6 +54,13 @@ static const struct usb_device_id usb_quirk_list[] = {
+ { USB_DEVICE(0x046d, 0x082d), .driver_info = USB_QUIRK_DELAY_INIT },
+ { USB_DEVICE(0x046d, 0x0843), .driver_info = USB_QUIRK_DELAY_INIT },
+
++ /* Logitech ConferenceCam CC3000e */
++ { USB_DEVICE(0x046d, 0x0847), .driver_info = USB_QUIRK_DELAY_INIT },
++ { USB_DEVICE(0x046d, 0x0848), .driver_info = USB_QUIRK_DELAY_INIT },
++
++ /* Logitech PTZ Pro Camera */
++ { USB_DEVICE(0x046d, 0x0853), .driver_info = USB_QUIRK_DELAY_INIT },
++
+ /* Logitech Quickcam Fusion */
+ { USB_DEVICE(0x046d, 0x08c1), .driver_info = USB_QUIRK_RESET_RESUME },
+
+@@ -78,6 +85,12 @@ static const struct usb_device_id usb_quirk_list[] = {
+ /* Philips PSC805 audio device */
+ { USB_DEVICE(0x0471, 0x0155), .driver_info = USB_QUIRK_RESET_RESUME },
+
++ /* Plantronic Audio 655 DSP */
++ { USB_DEVICE(0x047f, 0xc008), .driver_info = USB_QUIRK_RESET_RESUME },
++
++ /* Plantronic Audio 648 USB */
++ { USB_DEVICE(0x047f, 0xc013), .driver_info = USB_QUIRK_RESET_RESUME },
++
+ /* Artisman Watchdog Dongle */
+ { USB_DEVICE(0x04b4, 0x0526), .driver_info =
+ USB_QUIRK_CONFIG_INTF_STRINGS },
+diff --git a/drivers/usb/dwc3/ep0.c b/drivers/usb/dwc3/ep0.c
+index bdc995da3420..1c1525b0a1fb 100644
+--- a/drivers/usb/dwc3/ep0.c
++++ b/drivers/usb/dwc3/ep0.c
+@@ -818,6 +818,11 @@ static void dwc3_ep0_complete_data(struct dwc3 *dwc,
+ unsigned maxp = ep0->endpoint.maxpacket;
+
+ transfer_size += (maxp - (transfer_size % maxp));
++
++ /* Maximum of DWC3_EP0_BOUNCE_SIZE can only be received */
++ if (transfer_size > DWC3_EP0_BOUNCE_SIZE)
++ transfer_size = DWC3_EP0_BOUNCE_SIZE;
++
+ transferred = min_t(u32, ur->length,
+ transfer_size - length);
+ memcpy(ur->buf, dwc->ep0_bounce, transferred);
+@@ -937,11 +942,14 @@ static void __dwc3_ep0_do_control_data(struct dwc3 *dwc,
+ return;
+ }
+
+- WARN_ON(req->request.length > DWC3_EP0_BOUNCE_SIZE);
+-
+ maxpacket = dep->endpoint.maxpacket;
+ transfer_size = roundup(req->request.length, maxpacket);
+
++ if (transfer_size > DWC3_EP0_BOUNCE_SIZE) {
++ dev_WARN(dwc->dev, "bounce buf can't handle req len\n");
++ transfer_size = DWC3_EP0_BOUNCE_SIZE;
++ }
++
+ dwc->ep0_bounced = true;
+
+ /*
+diff --git a/drivers/usb/host/ehci-sysfs.c b/drivers/usb/host/ehci-sysfs.c
+index f6459dfb6f54..94054dad7710 100644
+--- a/drivers/usb/host/ehci-sysfs.c
++++ b/drivers/usb/host/ehci-sysfs.c
+@@ -29,7 +29,7 @@ static ssize_t show_companion(struct device *dev,
+ int count = PAGE_SIZE;
+ char *ptr = buf;
+
+- ehci = hcd_to_ehci(bus_to_hcd(dev_get_drvdata(dev)));
++ ehci = hcd_to_ehci(dev_get_drvdata(dev));
+ nports = HCS_N_PORTS(ehci->hcs_params);
+
+ for (index = 0; index < nports; ++index) {
+@@ -54,7 +54,7 @@ static ssize_t store_companion(struct device *dev,
+ struct ehci_hcd *ehci;
+ int portnum, new_owner;
+
+- ehci = hcd_to_ehci(bus_to_hcd(dev_get_drvdata(dev)));
++ ehci = hcd_to_ehci(dev_get_drvdata(dev));
+ new_owner = PORT_OWNER; /* Owned by companion */
+ if (sscanf(buf, "%d", &portnum) != 1)
+ return -EINVAL;
+@@ -85,7 +85,7 @@ static ssize_t show_uframe_periodic_max(struct device *dev,
+ struct ehci_hcd *ehci;
+ int n;
+
+- ehci = hcd_to_ehci(bus_to_hcd(dev_get_drvdata(dev)));
++ ehci = hcd_to_ehci(dev_get_drvdata(dev));
+ n = scnprintf(buf, PAGE_SIZE, "%d\n", ehci->uframe_periodic_max);
+ return n;
+ }
+@@ -101,7 +101,7 @@ static ssize_t store_uframe_periodic_max(struct device *dev,
+ unsigned long flags;
+ ssize_t ret;
+
+- ehci = hcd_to_ehci(bus_to_hcd(dev_get_drvdata(dev)));
++ ehci = hcd_to_ehci(dev_get_drvdata(dev));
+ if (kstrtouint(buf, 0, &uframe_periodic_max) < 0)
+ return -EINVAL;
+
+diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
+index d44c904df055..ce3087bd95d2 100644
+--- a/drivers/usb/host/xhci-mem.c
++++ b/drivers/usb/host/xhci-mem.c
+@@ -1502,10 +1502,10 @@ int xhci_endpoint_init(struct xhci_hcd *xhci,
+ * use Event Data TRBs, and we don't chain in a link TRB on short
+ * transfers, we're basically dividing by 1.
+ *
+- * xHCI 1.0 specification indicates that the Average TRB Length should
+- * be set to 8 for control endpoints.
++ * xHCI 1.0 and 1.1 specification indicates that the Average TRB Length
++ * should be set to 8 for control endpoints.
+ */
+- if (usb_endpoint_xfer_control(&ep->desc) && xhci->hci_version == 0x100)
++ if (usb_endpoint_xfer_control(&ep->desc) && xhci->hci_version >= 0x100)
+ ep_ctx->tx_info |= cpu_to_le32(AVG_TRB_LENGTH_FOR_EP(8));
+ else
+ ep_ctx->tx_info |=
+@@ -1796,8 +1796,7 @@ void xhci_mem_cleanup(struct xhci_hcd *xhci)
+ int size;
+ int i, j, num_ports;
+
+- if (timer_pending(&xhci->cmd_timer))
+- del_timer_sync(&xhci->cmd_timer);
++ del_timer_sync(&xhci->cmd_timer);
+
+ /* Free the Event Ring Segment Table and the actual Event Ring */
+ size = sizeof(struct xhci_erst_entry)*(xhci->erst.num_entries);
+@@ -2325,6 +2324,10 @@ int xhci_mem_init(struct xhci_hcd *xhci, gfp_t flags)
+
+ INIT_LIST_HEAD(&xhci->cmd_list);
+
++ /* init command timeout timer */
++ setup_timer(&xhci->cmd_timer, xhci_handle_command_timeout,
++ (unsigned long)xhci);
++
+ page_size = readl(&xhci->op_regs->page_size);
+ xhci_dbg_trace(xhci, trace_xhci_dbg_init,
+ "Supported page size register = 0x%x", page_size);
+@@ -2509,11 +2512,6 @@ int xhci_mem_init(struct xhci_hcd *xhci, gfp_t flags)
+ "Wrote ERST address to ir_set 0.");
+ xhci_print_ir_set(xhci, 0);
+
+- /* init command timeout timer */
+- init_timer(&xhci->cmd_timer);
+- xhci->cmd_timer.data = (unsigned long) xhci;
+- xhci->cmd_timer.function = xhci_handle_command_timeout;
+-
+ /*
+ * XXX: Might need to set the Interrupter Moderation Register to
+ * something other than the default (~1ms minimum between interrupts).
+diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
+index c70291cffc27..136259bc93b8 100644
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -3049,9 +3049,11 @@ static int queue_bulk_sg_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
+ struct xhci_td *td;
+ struct scatterlist *sg;
+ int num_sgs;
+- int trb_buff_len, this_sg_len, running_total;
++ int trb_buff_len, this_sg_len, running_total, ret;
+ unsigned int total_packet_count;
++ bool zero_length_needed;
+ bool first_trb;
++ int last_trb_num;
+ u64 addr;
+ bool more_trbs_coming;
+
+@@ -3067,13 +3069,27 @@ static int queue_bulk_sg_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
+ total_packet_count = DIV_ROUND_UP(urb->transfer_buffer_length,
+ usb_endpoint_maxp(&urb->ep->desc));
+
+- trb_buff_len = prepare_transfer(xhci, xhci->devs[slot_id],
++ ret = prepare_transfer(xhci, xhci->devs[slot_id],
+ ep_index, urb->stream_id,
+ num_trbs, urb, 0, mem_flags);
+- if (trb_buff_len < 0)
+- return trb_buff_len;
++ if (ret < 0)
++ return ret;
+
+ urb_priv = urb->hcpriv;
++
++ /* Deal with URB_ZERO_PACKET - need one more td/trb */
++ zero_length_needed = urb->transfer_flags & URB_ZERO_PACKET &&
++ urb_priv->length == 2;
++ if (zero_length_needed) {
++ num_trbs++;
++ xhci_dbg(xhci, "Creating zero length td.\n");
++ ret = prepare_transfer(xhci, xhci->devs[slot_id],
++ ep_index, urb->stream_id,
++ 1, urb, 1, mem_flags);
++ if (ret < 0)
++ return ret;
++ }
++
+ td = urb_priv->td[0];
+
+ /*
+@@ -3103,6 +3119,7 @@ static int queue_bulk_sg_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
+ trb_buff_len = urb->transfer_buffer_length;
+
+ first_trb = true;
++ last_trb_num = zero_length_needed ? 2 : 1;
+ /* Queue the first TRB, even if it's zero-length */
+ do {
+ u32 field = 0;
+@@ -3120,12 +3137,15 @@ static int queue_bulk_sg_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
+ /* Chain all the TRBs together; clear the chain bit in the last
+ * TRB to indicate it's the last TRB in the chain.
+ */
+- if (num_trbs > 1) {
++ if (num_trbs > last_trb_num) {
+ field |= TRB_CHAIN;
+- } else {
+- /* FIXME - add check for ZERO_PACKET flag before this */
++ } else if (num_trbs == last_trb_num) {
+ td->last_trb = ep_ring->enqueue;
+ field |= TRB_IOC;
++ } else if (zero_length_needed && num_trbs == 1) {
++ trb_buff_len = 0;
++ urb_priv->td[1]->last_trb = ep_ring->enqueue;
++ field |= TRB_IOC;
+ }
+
+ /* Only set interrupt on short packet for IN endpoints */
+@@ -3187,7 +3207,7 @@ static int queue_bulk_sg_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
+ if (running_total + trb_buff_len > urb->transfer_buffer_length)
+ trb_buff_len =
+ urb->transfer_buffer_length - running_total;
+- } while (running_total < urb->transfer_buffer_length);
++ } while (num_trbs > 0);
+
+ check_trb_math(urb, num_trbs, running_total);
+ giveback_first_trb(xhci, slot_id, ep_index, urb->stream_id,
+@@ -3205,7 +3225,9 @@ int xhci_queue_bulk_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
+ int num_trbs;
+ struct xhci_generic_trb *start_trb;
+ bool first_trb;
++ int last_trb_num;
+ bool more_trbs_coming;
++ bool zero_length_needed;
+ int start_cycle;
+ u32 field, length_field;
+
+@@ -3236,7 +3258,6 @@ int xhci_queue_bulk_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
+ num_trbs++;
+ running_total += TRB_MAX_BUFF_SIZE;
+ }
+- /* FIXME: this doesn't deal with URB_ZERO_PACKET - need one more */
+
+ ret = prepare_transfer(xhci, xhci->devs[slot_id],
+ ep_index, urb->stream_id,
+@@ -3245,6 +3266,20 @@ int xhci_queue_bulk_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
+ return ret;
+
+ urb_priv = urb->hcpriv;
++
++ /* Deal with URB_ZERO_PACKET - need one more td/trb */
++ zero_length_needed = urb->transfer_flags & URB_ZERO_PACKET &&
++ urb_priv->length == 2;
++ if (zero_length_needed) {
++ num_trbs++;
++ xhci_dbg(xhci, "Creating zero length td.\n");
++ ret = prepare_transfer(xhci, xhci->devs[slot_id],
++ ep_index, urb->stream_id,
++ 1, urb, 1, mem_flags);
++ if (ret < 0)
++ return ret;
++ }
++
+ td = urb_priv->td[0];
+
+ /*
+@@ -3266,7 +3301,7 @@ int xhci_queue_bulk_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
+ trb_buff_len = urb->transfer_buffer_length;
+
+ first_trb = true;
+-
++ last_trb_num = zero_length_needed ? 2 : 1;
+ /* Queue the first TRB, even if it's zero-length */
+ do {
+ u32 remainder = 0;
+@@ -3283,12 +3318,15 @@ int xhci_queue_bulk_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
+ /* Chain all the TRBs together; clear the chain bit in the last
+ * TRB to indicate it's the last TRB in the chain.
+ */
+- if (num_trbs > 1) {
++ if (num_trbs > last_trb_num) {
+ field |= TRB_CHAIN;
+- } else {
+- /* FIXME - add check for ZERO_PACKET flag before this */
++ } else if (num_trbs == last_trb_num) {
+ td->last_trb = ep_ring->enqueue;
+ field |= TRB_IOC;
++ } else if (zero_length_needed && num_trbs == 1) {
++ trb_buff_len = 0;
++ urb_priv->td[1]->last_trb = ep_ring->enqueue;
++ field |= TRB_IOC;
+ }
+
+ /* Only set interrupt on short packet for IN endpoints */
+@@ -3326,7 +3364,7 @@ int xhci_queue_bulk_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
+ trb_buff_len = urb->transfer_buffer_length - running_total;
+ if (trb_buff_len > TRB_MAX_BUFF_SIZE)
+ trb_buff_len = TRB_MAX_BUFF_SIZE;
+- } while (running_total < urb->transfer_buffer_length);
++ } while (num_trbs > 0);
+
+ check_trb_math(urb, num_trbs, running_total);
+ giveback_first_trb(xhci, slot_id, ep_index, urb->stream_id,
+@@ -3393,8 +3431,8 @@ int xhci_queue_ctrl_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
+ if (start_cycle == 0)
+ field |= 0x1;
+
+- /* xHCI 1.0 6.4.1.2.1: Transfer Type field */
+- if (xhci->hci_version == 0x100) {
++ /* xHCI 1.0/1.1 6.4.1.2.1: Transfer Type field */
++ if (xhci->hci_version >= 0x100) {
+ if (urb->transfer_buffer_length > 0) {
+ if (setup->bRequestType & USB_DIR_IN)
+ field |= TRB_TX_TYPE(TRB_DATA_IN);
+diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
+index 8e5f46082316..98380fa68fbf 100644
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -147,7 +147,8 @@ static int xhci_start(struct xhci_hcd *xhci)
+ "waited %u microseconds.\n",
+ XHCI_MAX_HALT_USEC);
+ if (!ret)
+- xhci->xhc_state &= ~XHCI_STATE_HALTED;
++ xhci->xhc_state &= ~(XHCI_STATE_HALTED | XHCI_STATE_DYING);
++
+ return ret;
+ }
+
+@@ -1343,6 +1344,11 @@ int xhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flags)
+
+ if (usb_endpoint_xfer_isoc(&urb->ep->desc))
+ size = urb->number_of_packets;
++ else if (usb_endpoint_is_bulk_out(&urb->ep->desc) &&
++ urb->transfer_buffer_length > 0 &&
++ urb->transfer_flags & URB_ZERO_PACKET &&
++ !(urb->transfer_buffer_length % usb_endpoint_maxp(&urb->ep->desc)))
++ size = 2;
+ else
+ size = 1;
+
+@@ -3787,6 +3793,9 @@ static int xhci_setup_device(struct usb_hcd *hcd, struct usb_device *udev,
+ u64 temp_64;
+ struct xhci_command *command;
+
++ if (xhci->xhc_state) /* dying or halted */
++ return -EINVAL;
++
+ if (!udev->slot_id) {
+ xhci_dbg_trace(xhci, trace_xhci_dbg_address,
+ "Bad Slot ID %d", udev->slot_id);
+diff --git a/drivers/usb/musb/musb_cppi41.c b/drivers/usb/musb/musb_cppi41.c
+index 5a9b977fbc19..d59b232614d5 100644
+--- a/drivers/usb/musb/musb_cppi41.c
++++ b/drivers/usb/musb/musb_cppi41.c
+@@ -600,7 +600,7 @@ static int cppi41_dma_controller_start(struct cppi41_dma_controller *controller)
+ {
+ struct musb *musb = controller->musb;
+ struct device *dev = musb->controller;
+- struct device_node *np = dev->of_node;
++ struct device_node *np = dev->parent->of_node;
+ struct cppi41_dma_channel *cppi41_channel;
+ int count;
+ int i;
+@@ -650,7 +650,7 @@ static int cppi41_dma_controller_start(struct cppi41_dma_controller *controller)
+ musb_dma->status = MUSB_DMA_STATUS_FREE;
+ musb_dma->max_len = SZ_4M;
+
+- dc = dma_request_slave_channel(dev, str);
++ dc = dma_request_slave_channel(dev->parent, str);
+ if (!dc) {
+ dev_err(dev, "Failed to request %s.\n", str);
+ ret = -EPROBE_DEFER;
+@@ -680,7 +680,7 @@ struct dma_controller *dma_controller_create(struct musb *musb,
+ struct cppi41_dma_controller *controller;
+ int ret = 0;
+
+- if (!musb->controller->of_node) {
++ if (!musb->controller->parent->of_node) {
+ dev_err(musb->controller, "Need DT for the DMA engine.\n");
+ return NULL;
+ }
+diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
+index 4c8b3b82103d..a5a0376bbd48 100644
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -605,6 +605,10 @@ static const struct usb_device_id id_table_combined[] = {
+ { USB_DEVICE(FTDI_VID, FTDI_NT_ORIONLXM_PID),
+ .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
+ { USB_DEVICE(FTDI_VID, FTDI_SYNAPSE_SS200_PID) },
++ { USB_DEVICE(FTDI_VID, FTDI_CUSTOMWARE_MINIPLEX_PID) },
++ { USB_DEVICE(FTDI_VID, FTDI_CUSTOMWARE_MINIPLEX2_PID) },
++ { USB_DEVICE(FTDI_VID, FTDI_CUSTOMWARE_MINIPLEX2WI_PID) },
++ { USB_DEVICE(FTDI_VID, FTDI_CUSTOMWARE_MINIPLEX3_PID) },
+ /*
+ * ELV devices:
+ */
+diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
+index 792e054126de..2943b97b2a83 100644
+--- a/drivers/usb/serial/ftdi_sio_ids.h
++++ b/drivers/usb/serial/ftdi_sio_ids.h
+@@ -568,6 +568,14 @@
+ */
+ #define FTDI_SYNAPSE_SS200_PID 0x9090 /* SS200 - SNAP Stick 200 */
+
++/*
++ * CustomWare / ShipModul NMEA multiplexers product ids (FTDI_VID)
++ */
++#define FTDI_CUSTOMWARE_MINIPLEX_PID 0xfd48 /* MiniPlex first generation NMEA Multiplexer */
++#define FTDI_CUSTOMWARE_MINIPLEX2_PID 0xfd49 /* MiniPlex-USB and MiniPlex-2 series */
++#define FTDI_CUSTOMWARE_MINIPLEX2WI_PID 0xfd4a /* MiniPlex-2Wi */
++#define FTDI_CUSTOMWARE_MINIPLEX3_PID 0xfd4b /* MiniPlex-3 series */
++
+
+ /********************************/
+ /** third-party VID/PID combos **/
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index 463feb836f20..17d04d98358c 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -278,6 +278,10 @@ static void option_instat_callback(struct urb *urb);
+ #define ZTE_PRODUCT_MF622 0x0001
+ #define ZTE_PRODUCT_MF628 0x0015
+ #define ZTE_PRODUCT_MF626 0x0031
++#define ZTE_PRODUCT_ZM8620_X 0x0396
++#define ZTE_PRODUCT_ME3620_MBIM 0x0426
++#define ZTE_PRODUCT_ME3620_X 0x1432
++#define ZTE_PRODUCT_ME3620_L 0x1433
+ #define ZTE_PRODUCT_AC2726 0xfff1
+ #define ZTE_PRODUCT_MG880 0xfffd
+ #define ZTE_PRODUCT_CDMA_TECH 0xfffe
+@@ -552,6 +556,18 @@ static const struct option_blacklist_info zte_mc2716_z_blacklist = {
+ .sendsetup = BIT(1) | BIT(2) | BIT(3),
+ };
+
++static const struct option_blacklist_info zte_me3620_mbim_blacklist = {
++ .reserved = BIT(2) | BIT(3) | BIT(4),
++};
++
++static const struct option_blacklist_info zte_me3620_xl_blacklist = {
++ .reserved = BIT(3) | BIT(4) | BIT(5),
++};
++
++static const struct option_blacklist_info zte_zm8620_x_blacklist = {
++ .reserved = BIT(3) | BIT(4) | BIT(5),
++};
++
+ static const struct option_blacklist_info huawei_cdc12_blacklist = {
+ .reserved = BIT(1) | BIT(2),
+ };
+@@ -1599,6 +1615,14 @@ static const struct usb_device_id option_ids[] = {
+ .driver_info = (kernel_ulong_t)&zte_ad3812_z_blacklist },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MC2716, 0xff, 0xff, 0xff),
+ .driver_info = (kernel_ulong_t)&zte_mc2716_z_blacklist },
++ { USB_DEVICE(ZTE_VENDOR_ID, ZTE_PRODUCT_ME3620_L),
++ .driver_info = (kernel_ulong_t)&zte_me3620_xl_blacklist },
++ { USB_DEVICE(ZTE_VENDOR_ID, ZTE_PRODUCT_ME3620_MBIM),
++ .driver_info = (kernel_ulong_t)&zte_me3620_mbim_blacklist },
++ { USB_DEVICE(ZTE_VENDOR_ID, ZTE_PRODUCT_ME3620_X),
++ .driver_info = (kernel_ulong_t)&zte_me3620_xl_blacklist },
++ { USB_DEVICE(ZTE_VENDOR_ID, ZTE_PRODUCT_ZM8620_X),
++ .driver_info = (kernel_ulong_t)&zte_zm8620_x_blacklist },
+ { USB_VENDOR_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff, 0x02, 0x01) },
+ { USB_VENDOR_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff, 0x02, 0x05) },
+ { USB_VENDOR_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff, 0x86, 0x10) },
+diff --git a/drivers/usb/serial/symbolserial.c b/drivers/usb/serial/symbolserial.c
+index 8fceec7298e0..6ed804450a5a 100644
+--- a/drivers/usb/serial/symbolserial.c
++++ b/drivers/usb/serial/symbolserial.c
+@@ -94,7 +94,7 @@ exit:
+
+ static int symbol_open(struct tty_struct *tty, struct usb_serial_port *port)
+ {
+- struct symbol_private *priv = usb_get_serial_data(port->serial);
++ struct symbol_private *priv = usb_get_serial_port_data(port);
+ unsigned long flags;
+ int result = 0;
+
+@@ -120,7 +120,7 @@ static void symbol_close(struct usb_serial_port *port)
+ static void symbol_throttle(struct tty_struct *tty)
+ {
+ struct usb_serial_port *port = tty->driver_data;
+- struct symbol_private *priv = usb_get_serial_data(port->serial);
++ struct symbol_private *priv = usb_get_serial_port_data(port);
+
+ spin_lock_irq(&priv->lock);
+ priv->throttled = true;
+@@ -130,7 +130,7 @@ static void symbol_throttle(struct tty_struct *tty)
+ static void symbol_unthrottle(struct tty_struct *tty)
+ {
+ struct usb_serial_port *port = tty->driver_data;
+- struct symbol_private *priv = usb_get_serial_data(port->serial);
++ struct symbol_private *priv = usb_get_serial_port_data(port);
+ int result;
+ bool was_throttled;
+
+diff --git a/drivers/usb/serial/whiteheat.c b/drivers/usb/serial/whiteheat.c
+index 6c3734d2b45a..d3ea90bef84d 100644
+--- a/drivers/usb/serial/whiteheat.c
++++ b/drivers/usb/serial/whiteheat.c
+@@ -80,6 +80,8 @@ static int whiteheat_firmware_download(struct usb_serial *serial,
+ static int whiteheat_firmware_attach(struct usb_serial *serial);
+
+ /* function prototypes for the Connect Tech WhiteHEAT serial converter */
++static int whiteheat_probe(struct usb_serial *serial,
++ const struct usb_device_id *id);
+ static int whiteheat_attach(struct usb_serial *serial);
+ static void whiteheat_release(struct usb_serial *serial);
+ static int whiteheat_port_probe(struct usb_serial_port *port);
+@@ -116,6 +118,7 @@ static struct usb_serial_driver whiteheat_device = {
+ .description = "Connect Tech - WhiteHEAT",
+ .id_table = id_table_std,
+ .num_ports = 4,
++ .probe = whiteheat_probe,
+ .attach = whiteheat_attach,
+ .release = whiteheat_release,
+ .port_probe = whiteheat_port_probe,
+@@ -217,6 +220,34 @@ static int whiteheat_firmware_attach(struct usb_serial *serial)
+ /*****************************************************************************
+ * Connect Tech's White Heat serial driver functions
+ *****************************************************************************/
++
++static int whiteheat_probe(struct usb_serial *serial,
++ const struct usb_device_id *id)
++{
++ struct usb_host_interface *iface_desc;
++ struct usb_endpoint_descriptor *endpoint;
++ size_t num_bulk_in = 0;
++ size_t num_bulk_out = 0;
++ size_t min_num_bulk;
++ unsigned int i;
++
++ iface_desc = serial->interface->cur_altsetting;
++
++ for (i = 0; i < iface_desc->desc.bNumEndpoints; i++) {
++ endpoint = &iface_desc->endpoint[i].desc;
++ if (usb_endpoint_is_bulk_in(endpoint))
++ ++num_bulk_in;
++ if (usb_endpoint_is_bulk_out(endpoint))
++ ++num_bulk_out;
++ }
++
++ min_num_bulk = COMMAND_PORT + 1;
++ if (num_bulk_in < min_num_bulk || num_bulk_out < min_num_bulk)
++ return -ENODEV;
++
++ return 0;
++}
++
+ static int whiteheat_attach(struct usb_serial *serial)
+ {
+ struct usb_serial_port *command_port;
+diff --git a/drivers/video/fbdev/Kconfig b/drivers/video/fbdev/Kconfig
+index c7bf606a8706..a5f88377cec5 100644
+--- a/drivers/video/fbdev/Kconfig
++++ b/drivers/video/fbdev/Kconfig
+@@ -298,7 +298,7 @@ config FB_ARMCLCD
+
+ # Helper logic selected only by the ARM Versatile platform family.
+ config PLAT_VERSATILE_CLCD
+- def_bool ARCH_VERSATILE || ARCH_REALVIEW || ARCH_VEXPRESS
++ def_bool ARCH_VERSATILE || ARCH_REALVIEW || ARCH_VEXPRESS || ARCH_INTEGRATOR
+ depends on ARM
+ depends on FB_ARMCLCD && FB=y
+
+diff --git a/drivers/watchdog/sunxi_wdt.c b/drivers/watchdog/sunxi_wdt.c
+index b62301e74e5f..a9b37bdac5d3 100644
+--- a/drivers/watchdog/sunxi_wdt.c
++++ b/drivers/watchdog/sunxi_wdt.c
+@@ -184,7 +184,7 @@ static int sunxi_wdt_start(struct watchdog_device *wdt_dev)
+ /* Set system reset function */
+ reg = readl(wdt_base + regs->wdt_cfg);
+ reg &= ~(regs->wdt_reset_mask);
+- reg |= ~(regs->wdt_reset_val);
++ reg |= regs->wdt_reset_val;
+ writel(reg, wdt_base + regs->wdt_cfg);
+
+ /* Enable watchdog */
+diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
+index 02391f3eb9b0..cb239ddae5c9 100644
+--- a/fs/btrfs/extent_io.c
++++ b/fs/btrfs/extent_io.c
+@@ -2767,7 +2767,8 @@ static int submit_extent_page(int rw, struct extent_io_tree *tree,
+ bio_end_io_t end_io_func,
+ int mirror_num,
+ unsigned long prev_bio_flags,
+- unsigned long bio_flags)
++ unsigned long bio_flags,
++ bool force_bio_submit)
+ {
+ int ret = 0;
+ struct bio *bio;
+@@ -2785,6 +2786,7 @@ static int submit_extent_page(int rw, struct extent_io_tree *tree,
+ contig = bio_end_sector(bio) == sector;
+
+ if (prev_bio_flags != bio_flags || !contig ||
++ force_bio_submit ||
+ merge_bio(rw, tree, page, offset, page_size, bio, bio_flags) ||
+ bio_add_page(bio, page, page_size, offset) < page_size) {
+ ret = submit_one_bio(rw, bio, mirror_num,
+@@ -2876,7 +2878,8 @@ static int __do_readpage(struct extent_io_tree *tree,
+ get_extent_t *get_extent,
+ struct extent_map **em_cached,
+ struct bio **bio, int mirror_num,
+- unsigned long *bio_flags, int rw)
++ unsigned long *bio_flags, int rw,
++ u64 *prev_em_start)
+ {
+ struct inode *inode = page->mapping->host;
+ u64 start = page_offset(page);
+@@ -2924,6 +2927,7 @@ static int __do_readpage(struct extent_io_tree *tree,
+ }
+ while (cur <= end) {
+ unsigned long pnr = (last_byte >> PAGE_CACHE_SHIFT) + 1;
++ bool force_bio_submit = false;
+
+ if (cur >= last_byte) {
+ char *userpage;
+@@ -2974,6 +2978,49 @@ static int __do_readpage(struct extent_io_tree *tree,
+ block_start = em->block_start;
+ if (test_bit(EXTENT_FLAG_PREALLOC, &em->flags))
+ block_start = EXTENT_MAP_HOLE;
++
++ /*
++ * If we have a file range that points to a compressed extent
++ * and it's followed by a consecutive file range that points to
++ * to the same compressed extent (possibly with a different
++ * offset and/or length, so it either points to the whole extent
++ * or only part of it), we must make sure we do not submit a
++ * single bio to populate the pages for the 2 ranges because
++ * this makes the compressed extent read zero out the pages
++ * belonging to the 2nd range. Imagine the following scenario:
++ *
++ * File layout
++ * [0 - 8K] [8K - 24K]
++ * | |
++ * | |
++ * points to extent X, points to extent X,
++ * offset 4K, length of 8K offset 0, length 16K
++ *
++ * [extent X, compressed length = 4K uncompressed length = 16K]
++ *
++ * If the bio to read the compressed extent covers both ranges,
++ * it will decompress extent X into the pages belonging to the
++ * first range and then it will stop, zeroing out the remaining
++ * pages that belong to the other range that points to extent X.
++ * So here we make sure we submit 2 bios, one for the first
++ * range and another one for the third range. Both will target
++ * the same physical extent from disk, but we can't currently
++ * make the compressed bio endio callback populate the pages
++ * for both ranges because each compressed bio is tightly
++ * coupled with a single extent map, and each range can have
++ * an extent map with a different offset value relative to the
++ * uncompressed data of our extent and different lengths. This
++ * is a corner case so we prioritize correctness over
++ * non-optimal behavior (submitting 2 bios for the same extent).
++ */
++ if (test_bit(EXTENT_FLAG_COMPRESSED, &em->flags) &&
++ prev_em_start && *prev_em_start != (u64)-1 &&
++ *prev_em_start != em->orig_start)
++ force_bio_submit = true;
++
++ if (prev_em_start)
++ *prev_em_start = em->orig_start;
++
+ free_extent_map(em);
+ em = NULL;
+
+@@ -3023,7 +3070,8 @@ static int __do_readpage(struct extent_io_tree *tree,
+ bdev, bio, pnr,
+ end_bio_extent_readpage, mirror_num,
+ *bio_flags,
+- this_bio_flag);
++ this_bio_flag,
++ force_bio_submit);
+ if (!ret) {
+ nr++;
+ *bio_flags = this_bio_flag;
+@@ -3050,7 +3098,8 @@ static inline void __do_contiguous_readpages(struct extent_io_tree *tree,
+ get_extent_t *get_extent,
+ struct extent_map **em_cached,
+ struct bio **bio, int mirror_num,
+- unsigned long *bio_flags, int rw)
++ unsigned long *bio_flags, int rw,
++ u64 *prev_em_start)
+ {
+ struct inode *inode;
+ struct btrfs_ordered_extent *ordered;
+@@ -3070,7 +3119,7 @@ static inline void __do_contiguous_readpages(struct extent_io_tree *tree,
+
+ for (index = 0; index < nr_pages; index++) {
+ __do_readpage(tree, pages[index], get_extent, em_cached, bio,
+- mirror_num, bio_flags, rw);
++ mirror_num, bio_flags, rw, prev_em_start);
+ page_cache_release(pages[index]);
+ }
+ }
+@@ -3080,7 +3129,8 @@ static void __extent_readpages(struct extent_io_tree *tree,
+ int nr_pages, get_extent_t *get_extent,
+ struct extent_map **em_cached,
+ struct bio **bio, int mirror_num,
+- unsigned long *bio_flags, int rw)
++ unsigned long *bio_flags, int rw,
++ u64 *prev_em_start)
+ {
+ u64 start = 0;
+ u64 end = 0;
+@@ -3101,7 +3151,7 @@ static void __extent_readpages(struct extent_io_tree *tree,
+ index - first_index, start,
+ end, get_extent, em_cached,
+ bio, mirror_num, bio_flags,
+- rw);
++ rw, prev_em_start);
+ start = page_start;
+ end = start + PAGE_CACHE_SIZE - 1;
+ first_index = index;
+@@ -3112,7 +3162,8 @@ static void __extent_readpages(struct extent_io_tree *tree,
+ __do_contiguous_readpages(tree, &pages[first_index],
+ index - first_index, start,
+ end, get_extent, em_cached, bio,
+- mirror_num, bio_flags, rw);
++ mirror_num, bio_flags, rw,
++ prev_em_start);
+ }
+
+ static int __extent_read_full_page(struct extent_io_tree *tree,
+@@ -3138,7 +3189,7 @@ static int __extent_read_full_page(struct extent_io_tree *tree,
+ }
+
+ ret = __do_readpage(tree, page, get_extent, NULL, bio, mirror_num,
+- bio_flags, rw);
++ bio_flags, rw, NULL);
+ return ret;
+ }
+
+@@ -3164,7 +3215,7 @@ int extent_read_full_page_nolock(struct extent_io_tree *tree, struct page *page,
+ int ret;
+
+ ret = __do_readpage(tree, page, get_extent, NULL, &bio, mirror_num,
+- &bio_flags, READ);
++ &bio_flags, READ, NULL);
+ if (bio)
+ ret = submit_one_bio(READ, bio, mirror_num, bio_flags);
+ return ret;
+@@ -3417,7 +3468,7 @@ static noinline_for_stack int __extent_writepage_io(struct inode *inode,
+ sector, iosize, pg_offset,
+ bdev, &epd->bio, max_nr,
+ end_bio_extent_writepage,
+- 0, 0, 0);
++ 0, 0, 0, false);
+ if (ret)
+ SetPageError(page);
+ }
+@@ -3719,7 +3770,7 @@ static noinline_for_stack int write_one_eb(struct extent_buffer *eb,
+ ret = submit_extent_page(rw, tree, p, offset >> 9,
+ PAGE_CACHE_SIZE, 0, bdev, &epd->bio,
+ -1, end_bio_extent_buffer_writepage,
+- 0, epd->bio_flags, bio_flags);
++ 0, epd->bio_flags, bio_flags, false);
+ epd->bio_flags = bio_flags;
+ if (ret) {
+ set_btree_ioerr(p);
+@@ -4123,6 +4174,7 @@ int extent_readpages(struct extent_io_tree *tree,
+ struct page *page;
+ struct extent_map *em_cached = NULL;
+ int nr = 0;
++ u64 prev_em_start = (u64)-1;
+
+ for (page_idx = 0; page_idx < nr_pages; page_idx++) {
+ page = list_entry(pages->prev, struct page, lru);
+@@ -4139,12 +4191,12 @@ int extent_readpages(struct extent_io_tree *tree,
+ if (nr < ARRAY_SIZE(pagepool))
+ continue;
+ __extent_readpages(tree, pagepool, nr, get_extent, &em_cached,
+- &bio, 0, &bio_flags, READ);
++ &bio, 0, &bio_flags, READ, &prev_em_start);
+ nr = 0;
+ }
+ if (nr)
+ __extent_readpages(tree, pagepool, nr, get_extent, &em_cached,
+- &bio, 0, &bio_flags, READ);
++ &bio, 0, &bio_flags, READ, &prev_em_start);
+
+ if (em_cached)
+ free_extent_map(em_cached);
+diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
+index edaa6178b4ec..0be09bb34b75 100644
+--- a/fs/btrfs/inode.c
++++ b/fs/btrfs/inode.c
+@@ -4802,7 +4802,8 @@ void btrfs_evict_inode(struct inode *inode)
+ goto no_delete;
+ }
+ /* do we really want it for ->i_nlink > 0 and zero btrfs_root_refs? */
+- btrfs_wait_ordered_range(inode, 0, (u64)-1);
++ if (!special_file(inode->i_mode))
++ btrfs_wait_ordered_range(inode, 0, (u64)-1);
+
+ btrfs_free_io_failure_record(inode, 0, (u64)-1);
+
+diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c
+index 63c6d05950f2..7dce00b91a71 100644
+--- a/fs/btrfs/transaction.c
++++ b/fs/btrfs/transaction.c
+@@ -1756,8 +1756,11 @@ int btrfs_commit_transaction(struct btrfs_trans_handle *trans,
+ spin_unlock(&root->fs_info->trans_lock);
+
+ wait_for_commit(root, prev_trans);
++ ret = prev_trans->aborted;
+
+ btrfs_put_transaction(prev_trans);
++ if (ret)
++ goto cleanup_transaction;
+ } else {
+ spin_unlock(&root->fs_info->trans_lock);
+ }
+diff --git a/fs/cifs/cifsencrypt.c b/fs/cifs/cifsencrypt.c
+index 4ac7445e6ec7..da7fbfaa60b4 100644
+--- a/fs/cifs/cifsencrypt.c
++++ b/fs/cifs/cifsencrypt.c
+@@ -441,6 +441,48 @@ find_domain_name(struct cifs_ses *ses, const struct nls_table *nls_cp)
+ return 0;
+ }
+
++/* Server has provided av pairs/target info in the type 2 challenge
++ * packet and we have plucked it and stored within smb session.
++ * We parse that blob here to find the server given timestamp
++ * as part of ntlmv2 authentication (or local current time as
++ * default in case of failure)
++ */
++static __le64
++find_timestamp(struct cifs_ses *ses)
++{
++ unsigned int attrsize;
++ unsigned int type;
++ unsigned int onesize = sizeof(struct ntlmssp2_name);
++ unsigned char *blobptr;
++ unsigned char *blobend;
++ struct ntlmssp2_name *attrptr;
++
++ if (!ses->auth_key.len || !ses->auth_key.response)
++ return 0;
++
++ blobptr = ses->auth_key.response;
++ blobend = blobptr + ses->auth_key.len;
++
++ while (blobptr + onesize < blobend) {
++ attrptr = (struct ntlmssp2_name *) blobptr;
++ type = le16_to_cpu(attrptr->type);
++ if (type == NTLMSSP_AV_EOL)
++ break;
++ blobptr += 2; /* advance attr type */
++ attrsize = le16_to_cpu(attrptr->length);
++ blobptr += 2; /* advance attr size */
++ if (blobptr + attrsize > blobend)
++ break;
++ if (type == NTLMSSP_AV_TIMESTAMP) {
++ if (attrsize == sizeof(u64))
++ return *((__le64 *)blobptr);
++ }
++ blobptr += attrsize; /* advance attr value */
++ }
++
++ return cpu_to_le64(cifs_UnixTimeToNT(CURRENT_TIME));
++}
++
+ static int calc_ntlmv2_hash(struct cifs_ses *ses, char *ntlmv2_hash,
+ const struct nls_table *nls_cp)
+ {
+@@ -637,6 +679,7 @@ setup_ntlmv2_rsp(struct cifs_ses *ses, const struct nls_table *nls_cp)
+ struct ntlmv2_resp *ntlmv2;
+ char ntlmv2_hash[16];
+ unsigned char *tiblob = NULL; /* target info blob */
++ __le64 rsp_timestamp;
+
+ if (ses->server->negflavor == CIFS_NEGFLAVOR_EXTENDED) {
+ if (!ses->domainName) {
+@@ -655,6 +698,12 @@ setup_ntlmv2_rsp(struct cifs_ses *ses, const struct nls_table *nls_cp)
+ }
+ }
+
++ /* Must be within 5 minutes of the server (or in range +/-2h
++ * in case of Mac OS X), so simply carry over server timestamp
++ * (as Windows 7 does)
++ */
++ rsp_timestamp = find_timestamp(ses);
++
+ baselen = CIFS_SESS_KEY_SIZE + sizeof(struct ntlmv2_resp);
+ tilen = ses->auth_key.len;
+ tiblob = ses->auth_key.response;
+@@ -671,8 +720,8 @@ setup_ntlmv2_rsp(struct cifs_ses *ses, const struct nls_table *nls_cp)
+ (ses->auth_key.response + CIFS_SESS_KEY_SIZE);
+ ntlmv2->blob_signature = cpu_to_le32(0x00000101);
+ ntlmv2->reserved = 0;
+- /* Must be within 5 minutes of the server */
+- ntlmv2->time = cpu_to_le64(cifs_UnixTimeToNT(CURRENT_TIME));
++ ntlmv2->time = rsp_timestamp;
++
+ get_random_bytes(&ntlmv2->client_chal, sizeof(ntlmv2->client_chal));
+ ntlmv2->reserved2 = 0;
+
+diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
+index 0c3ce464cae4..c88a8279e532 100644
+--- a/fs/cifs/inode.c
++++ b/fs/cifs/inode.c
+@@ -2010,7 +2010,6 @@ cifs_set_file_size(struct inode *inode, struct iattr *attrs,
+ struct tcon_link *tlink = NULL;
+ struct cifs_tcon *tcon = NULL;
+ struct TCP_Server_Info *server;
+- struct cifs_io_parms io_parms;
+
+ /*
+ * To avoid spurious oplock breaks from server, in the case of
+@@ -2032,18 +2031,6 @@ cifs_set_file_size(struct inode *inode, struct iattr *attrs,
+ rc = -ENOSYS;
+ cifsFileInfo_put(open_file);
+ cifs_dbg(FYI, "SetFSize for attrs rc = %d\n", rc);
+- if ((rc == -EINVAL) || (rc == -EOPNOTSUPP)) {
+- unsigned int bytes_written;
+-
+- io_parms.netfid = open_file->fid.netfid;
+- io_parms.pid = open_file->pid;
+- io_parms.tcon = tcon;
+- io_parms.offset = 0;
+- io_parms.length = attrs->ia_size;
+- rc = CIFSSMBWrite(xid, &io_parms, &bytes_written,
+- NULL, NULL, 1);
+- cifs_dbg(FYI, "Wrt seteof rc %d\n", rc);
+- }
+ } else
+ rc = -EINVAL;
+
+@@ -2069,28 +2056,7 @@ cifs_set_file_size(struct inode *inode, struct iattr *attrs,
+ else
+ rc = -ENOSYS;
+ cifs_dbg(FYI, "SetEOF by path (setattrs) rc = %d\n", rc);
+- if ((rc == -EINVAL) || (rc == -EOPNOTSUPP)) {
+- __u16 netfid;
+- int oplock = 0;
+
+- rc = SMBLegacyOpen(xid, tcon, full_path, FILE_OPEN,
+- GENERIC_WRITE, CREATE_NOT_DIR, &netfid,
+- &oplock, NULL, cifs_sb->local_nls,
+- cifs_remap(cifs_sb));
+- if (rc == 0) {
+- unsigned int bytes_written;
+-
+- io_parms.netfid = netfid;
+- io_parms.pid = current->tgid;
+- io_parms.tcon = tcon;
+- io_parms.offset = 0;
+- io_parms.length = attrs->ia_size;
+- rc = CIFSSMBWrite(xid, &io_parms, &bytes_written, NULL,
+- NULL, 1);
+- cifs_dbg(FYI, "wrt seteof rc %d\n", rc);
+- CIFSSMBClose(xid, tcon, netfid);
+- }
+- }
+ if (tlink)
+ cifs_put_tlink(tlink);
+
+diff --git a/fs/cifs/ioctl.c b/fs/cifs/ioctl.c
+index 8b7898b7670f..64a9bca976d0 100644
+--- a/fs/cifs/ioctl.c
++++ b/fs/cifs/ioctl.c
+@@ -67,6 +67,12 @@ static long cifs_ioctl_clone(unsigned int xid, struct file *dst_file,
+ goto out_drop_write;
+ }
+
++ if (src_file.file->f_op->unlocked_ioctl != cifs_ioctl) {
++ rc = -EBADF;
++ cifs_dbg(VFS, "src file seems to be from a different filesystem type\n");
++ goto out_fput;
++ }
++
+ if ((!src_file.file->private_data) || (!dst_file->private_data)) {
+ rc = -EBADF;
+ cifs_dbg(VFS, "missing cifsFileInfo on copy range src file\n");
+diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c
+index cc93a7ffe8e4..51f5251d7db5 100644
+--- a/fs/cifs/smb2ops.c
++++ b/fs/cifs/smb2ops.c
+@@ -50,9 +50,13 @@ change_conf(struct TCP_Server_Info *server)
+ break;
+ default:
+ server->echoes = true;
+- server->oplocks = true;
++ if (enable_oplocks) {
++ server->oplocks = true;
++ server->oplock_credits = 1;
++ } else
++ server->oplocks = false;
++
+ server->echo_credits = 1;
+- server->oplock_credits = 1;
+ }
+ server->credits -= server->echo_credits + server->oplock_credits;
+ return 0;
+diff --git a/fs/coredump.c b/fs/coredump.c
+index 4c5866b948e7..00d75e82f6f2 100644
+--- a/fs/coredump.c
++++ b/fs/coredump.c
+@@ -506,10 +506,10 @@ void do_coredump(const siginfo_t *siginfo)
+ const struct cred *old_cred;
+ struct cred *cred;
+ int retval = 0;
+- int flag = 0;
+ int ispipe;
+ struct files_struct *displaced;
+- bool need_nonrelative = false;
++ /* require nonrelative corefile path and be extra careful */
++ bool need_suid_safe = false;
+ bool core_dumped = false;
+ static atomic_t core_dump_count = ATOMIC_INIT(0);
+ struct coredump_params cprm = {
+@@ -543,9 +543,8 @@ void do_coredump(const siginfo_t *siginfo)
+ */
+ if (__get_dumpable(cprm.mm_flags) == SUID_DUMP_ROOT) {
+ /* Setuid core dump mode */
+- flag = O_EXCL; /* Stop rewrite attacks */
+ cred->fsuid = GLOBAL_ROOT_UID; /* Dump root private */
+- need_nonrelative = true;
++ need_suid_safe = true;
+ }
+
+ retval = coredump_wait(siginfo->si_signo, &core_state);
+@@ -626,7 +625,7 @@ void do_coredump(const siginfo_t *siginfo)
+ if (cprm.limit < binfmt->min_coredump)
+ goto fail_unlock;
+
+- if (need_nonrelative && cn.corename[0] != '/') {
++ if (need_suid_safe && cn.corename[0] != '/') {
+ printk(KERN_WARNING "Pid %d(%s) can only dump core "\
+ "to fully qualified path!\n",
+ task_tgid_vnr(current), current->comm);
+@@ -634,8 +633,35 @@ void do_coredump(const siginfo_t *siginfo)
+ goto fail_unlock;
+ }
+
++ /*
++ * Unlink the file if it exists unless this is a SUID
++ * binary - in that case, we're running around with root
++ * privs and don't want to unlink another user's coredump.
++ */
++ if (!need_suid_safe) {
++ mm_segment_t old_fs;
++
++ old_fs = get_fs();
++ set_fs(KERNEL_DS);
++ /*
++ * If it doesn't exist, that's fine. If there's some
++ * other problem, we'll catch it at the filp_open().
++ */
++ (void) sys_unlink((const char __user *)cn.corename);
++ set_fs(old_fs);
++ }
++
++ /*
++ * There is a race between unlinking and creating the
++ * file, but if that causes an EEXIST here, that's
++ * fine - another process raced with us while creating
++ * the corefile, and the other process won. To userspace,
++ * what matters is that at least one of the two processes
++ * writes its coredump successfully, not which one.
++ */
+ cprm.file = filp_open(cn.corename,
+- O_CREAT | 2 | O_NOFOLLOW | O_LARGEFILE | flag,
++ O_CREAT | 2 | O_NOFOLLOW |
++ O_LARGEFILE | O_EXCL,
+ 0600);
+ if (IS_ERR(cprm.file))
+ goto fail_unlock;
+diff --git a/fs/dcache.c b/fs/dcache.c
+index a66d6d80e2d9..d25f8fdcd397 100644
+--- a/fs/dcache.c
++++ b/fs/dcache.c
+@@ -1528,7 +1528,8 @@ void d_set_d_op(struct dentry *dentry, const struct dentry_operations *op)
+ DCACHE_OP_COMPARE |
+ DCACHE_OP_REVALIDATE |
+ DCACHE_OP_WEAK_REVALIDATE |
+- DCACHE_OP_DELETE ));
++ DCACHE_OP_DELETE |
++ DCACHE_OP_SELECT_INODE));
+ dentry->d_op = op;
+ if (!op)
+ return;
+@@ -1544,6 +1545,8 @@ void d_set_d_op(struct dentry *dentry, const struct dentry_operations *op)
+ dentry->d_flags |= DCACHE_OP_DELETE;
+ if (op->d_prune)
+ dentry->d_flags |= DCACHE_OP_PRUNE;
++ if (op->d_select_inode)
++ dentry->d_flags |= DCACHE_OP_SELECT_INODE;
+
+ }
+ EXPORT_SYMBOL(d_set_d_op);
+@@ -2889,6 +2892,13 @@ restart:
+
+ if (dentry == vfsmnt->mnt_root || IS_ROOT(dentry)) {
+ struct mount *parent = ACCESS_ONCE(mnt->mnt_parent);
++ /* Escaped? */
++ if (dentry != vfsmnt->mnt_root) {
++ bptr = *buffer;
++ blen = *buflen;
++ error = 3;
++ break;
++ }
+ /* Global root? */
+ if (mnt != parent) {
+ dentry = ACCESS_ONCE(mnt->mnt_mountpoint);
+diff --git a/fs/ext4/super.c b/fs/ext4/super.c
+index bf038468d752..b5a2c29a8db8 100644
+--- a/fs/ext4/super.c
++++ b/fs/ext4/super.c
+@@ -4754,10 +4754,11 @@ static int ext4_freeze(struct super_block *sb)
+ error = jbd2_journal_flush(journal);
+ if (error < 0)
+ goto out;
++
++ /* Journal blocked and flushed, clear needs_recovery flag. */
++ EXT4_CLEAR_INCOMPAT_FEATURE(sb, EXT4_FEATURE_INCOMPAT_RECOVER);
+ }
+
+- /* Journal blocked and flushed, clear needs_recovery flag. */
+- EXT4_CLEAR_INCOMPAT_FEATURE(sb, EXT4_FEATURE_INCOMPAT_RECOVER);
+ error = ext4_commit_super(sb, 1);
+ out:
+ if (journal)
+@@ -4775,8 +4776,11 @@ static int ext4_unfreeze(struct super_block *sb)
+ if (sb->s_flags & MS_RDONLY)
+ return 0;
+
+- /* Reset the needs_recovery flag before the fs is unlocked. */
+- EXT4_SET_INCOMPAT_FEATURE(sb, EXT4_FEATURE_INCOMPAT_RECOVER);
++ if (EXT4_SB(sb)->s_journal) {
++ /* Reset the needs_recovery flag before the fs is unlocked. */
++ EXT4_SET_INCOMPAT_FEATURE(sb, EXT4_FEATURE_INCOMPAT_RECOVER);
++ }
++
+ ext4_commit_super(sb, 1);
+ return 0;
+ }
+diff --git a/fs/hfs/bnode.c b/fs/hfs/bnode.c
+index d3fa6bd9503e..221719eac5de 100644
+--- a/fs/hfs/bnode.c
++++ b/fs/hfs/bnode.c
+@@ -288,7 +288,6 @@ static struct hfs_bnode *__hfs_bnode_create(struct hfs_btree *tree, u32 cnid)
+ page_cache_release(page);
+ goto fail;
+ }
+- page_cache_release(page);
+ node->page[i] = page;
+ }
+
+@@ -398,11 +397,11 @@ node_error:
+
+ void hfs_bnode_free(struct hfs_bnode *node)
+ {
+- //int i;
++ int i;
+
+- //for (i = 0; i < node->tree->pages_per_bnode; i++)
+- // if (node->page[i])
+- // page_cache_release(node->page[i]);
++ for (i = 0; i < node->tree->pages_per_bnode; i++)
++ if (node->page[i])
++ page_cache_release(node->page[i]);
+ kfree(node);
+ }
+
+diff --git a/fs/hfs/brec.c b/fs/hfs/brec.c
+index 9f4ee7f52026..6fc766df0461 100644
+--- a/fs/hfs/brec.c
++++ b/fs/hfs/brec.c
+@@ -131,13 +131,16 @@ skip:
+ hfs_bnode_write(node, entry, data_off + key_len, entry_len);
+ hfs_bnode_dump(node);
+
+- if (new_node) {
+- /* update parent key if we inserted a key
+- * at the start of the first node
+- */
+- if (!rec && new_node != node)
+- hfs_brec_update_parent(fd);
++ /*
++ * update parent key if we inserted a key
++ * at the start of the node and it is not the new node
++ */
++ if (!rec && new_node != node) {
++ hfs_bnode_read_key(node, fd->search_key, data_off + size);
++ hfs_brec_update_parent(fd);
++ }
+
++ if (new_node) {
+ hfs_bnode_put(fd->bnode);
+ if (!new_node->parent) {
+ hfs_btree_inc_height(tree);
+@@ -166,9 +169,6 @@ skip:
+ goto again;
+ }
+
+- if (!rec)
+- hfs_brec_update_parent(fd);
+-
+ return 0;
+ }
+
+@@ -366,6 +366,8 @@ again:
+ if (IS_ERR(parent))
+ return PTR_ERR(parent);
+ __hfs_brec_find(parent, fd);
++ if (fd->record < 0)
++ return -ENOENT;
+ hfs_bnode_dump(parent);
+ rec = fd->record;
+
+diff --git a/fs/hfsplus/bnode.c b/fs/hfsplus/bnode.c
+index 759708fd9331..63924662aaf3 100644
+--- a/fs/hfsplus/bnode.c
++++ b/fs/hfsplus/bnode.c
+@@ -454,7 +454,6 @@ static struct hfs_bnode *__hfs_bnode_create(struct hfs_btree *tree, u32 cnid)
+ page_cache_release(page);
+ goto fail;
+ }
+- page_cache_release(page);
+ node->page[i] = page;
+ }
+
+@@ -566,13 +565,11 @@ node_error:
+
+ void hfs_bnode_free(struct hfs_bnode *node)
+ {
+-#if 0
+ int i;
+
+ for (i = 0; i < node->tree->pages_per_bnode; i++)
+ if (node->page[i])
+ page_cache_release(node->page[i]);
+-#endif
+ kfree(node);
+ }
+
+diff --git a/fs/hpfs/namei.c b/fs/hpfs/namei.c
+index bdbc2c3080a4..0642cafaab34 100644
+--- a/fs/hpfs/namei.c
++++ b/fs/hpfs/namei.c
+@@ -8,6 +8,17 @@
+ #include <linux/sched.h>
+ #include "hpfs_fn.h"
+
++static void hpfs_update_directory_times(struct inode *dir)
++{
++ time_t t = get_seconds();
++ if (t == dir->i_mtime.tv_sec &&
++ t == dir->i_ctime.tv_sec)
++ return;
++ dir->i_mtime.tv_sec = dir->i_ctime.tv_sec = t;
++ dir->i_mtime.tv_nsec = dir->i_ctime.tv_nsec = 0;
++ hpfs_write_inode_nolock(dir);
++}
++
+ static int hpfs_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode)
+ {
+ const unsigned char *name = dentry->d_name.name;
+@@ -99,6 +110,7 @@ static int hpfs_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode)
+ result->i_mode = mode | S_IFDIR;
+ hpfs_write_inode_nolock(result);
+ }
++ hpfs_update_directory_times(dir);
+ d_instantiate(dentry, result);
+ hpfs_unlock(dir->i_sb);
+ return 0;
+@@ -187,6 +199,7 @@ static int hpfs_create(struct inode *dir, struct dentry *dentry, umode_t mode, b
+ result->i_mode = mode | S_IFREG;
+ hpfs_write_inode_nolock(result);
+ }
++ hpfs_update_directory_times(dir);
+ d_instantiate(dentry, result);
+ hpfs_unlock(dir->i_sb);
+ return 0;
+@@ -262,6 +275,7 @@ static int hpfs_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, de
+ insert_inode_hash(result);
+
+ hpfs_write_inode_nolock(result);
++ hpfs_update_directory_times(dir);
+ d_instantiate(dentry, result);
+ brelse(bh);
+ hpfs_unlock(dir->i_sb);
+@@ -340,6 +354,7 @@ static int hpfs_symlink(struct inode *dir, struct dentry *dentry, const char *sy
+ insert_inode_hash(result);
+
+ hpfs_write_inode_nolock(result);
++ hpfs_update_directory_times(dir);
+ d_instantiate(dentry, result);
+ hpfs_unlock(dir->i_sb);
+ return 0;
+@@ -423,6 +438,8 @@ again:
+ out1:
+ hpfs_brelse4(&qbh);
+ out:
++ if (!err)
++ hpfs_update_directory_times(dir);
+ hpfs_unlock(dir->i_sb);
+ return err;
+ }
+@@ -477,6 +494,8 @@ static int hpfs_rmdir(struct inode *dir, struct dentry *dentry)
+ out1:
+ hpfs_brelse4(&qbh);
+ out:
++ if (!err)
++ hpfs_update_directory_times(dir);
+ hpfs_unlock(dir->i_sb);
+ return err;
+ }
+@@ -595,7 +614,7 @@ static int hpfs_rename(struct inode *old_dir, struct dentry *old_dentry,
+ goto end1;
+ }
+
+- end:
++end:
+ hpfs_i(i)->i_parent_dir = new_dir->i_ino;
+ if (S_ISDIR(i->i_mode)) {
+ inc_nlink(new_dir);
+@@ -610,6 +629,10 @@ static int hpfs_rename(struct inode *old_dir, struct dentry *old_dentry,
+ brelse(bh);
+ }
+ end1:
++ if (!err) {
++ hpfs_update_directory_times(old_dir);
++ hpfs_update_directory_times(new_dir);
++ }
+ hpfs_unlock(i->i_sb);
+ return err;
+ }
+diff --git a/fs/internal.h b/fs/internal.h
+index 757ba2abf21e..53279bd90b72 100644
+--- a/fs/internal.h
++++ b/fs/internal.h
+@@ -106,6 +106,7 @@ extern struct file *do_file_open_root(struct dentry *, struct vfsmount *,
+ extern long do_handle_open(int mountdirfd,
+ struct file_handle __user *ufh, int open_flag);
+ extern int open_check_o_direct(struct file *f);
++extern int vfs_open(const struct path *, struct file *, const struct cred *);
+
+ /*
+ * inode.c
+diff --git a/fs/namei.c b/fs/namei.c
+index d20f061cddd3..be3d538d56b3 100644
+--- a/fs/namei.c
++++ b/fs/namei.c
+@@ -487,6 +487,24 @@ void path_put(const struct path *path)
+ }
+ EXPORT_SYMBOL(path_put);
+
++/**
++ * path_connected - Verify that a path->dentry is below path->mnt.mnt_root
++ * @path: nameidate to verify
++ *
++ * Rename can sometimes move a file or directory outside of a bind
++ * mount, path_connected allows those cases to be detected.
++ */
++static bool path_connected(const struct path *path)
++{
++ struct vfsmount *mnt = path->mnt;
++
++ /* Only bind mounts can have disconnected paths */
++ if (mnt->mnt_root == mnt->mnt_sb->s_root)
++ return true;
++
++ return is_subdir(path->dentry, mnt->mnt_root);
++}
++
+ /*
+ * Path walking has 2 modes, rcu-walk and ref-walk (see
+ * Documentation/filesystems/path-lookup.txt). In situations when we can't
+@@ -1164,6 +1182,8 @@ static int follow_dotdot_rcu(struct nameidata *nd)
+ goto failed;
+ nd->path.dentry = parent;
+ nd->seq = seq;
++ if (unlikely(!path_connected(&nd->path)))
++ goto failed;
+ break;
+ }
+ if (!follow_up_rcu(&nd->path))
+@@ -1260,7 +1280,7 @@ static void follow_mount(struct path *path)
+ }
+ }
+
+-static void follow_dotdot(struct nameidata *nd)
++static int follow_dotdot(struct nameidata *nd)
+ {
+ if (!nd->root.mnt)
+ set_root(nd);
+@@ -1276,6 +1296,10 @@ static void follow_dotdot(struct nameidata *nd)
+ /* rare case of legitimate dget_parent()... */
+ nd->path.dentry = dget_parent(nd->path.dentry);
+ dput(old);
++ if (unlikely(!path_connected(&nd->path))) {
++ path_put(&nd->path);
++ return -ENOENT;
++ }
+ break;
+ }
+ if (!follow_up(&nd->path))
+@@ -1283,6 +1307,7 @@ static void follow_dotdot(struct nameidata *nd)
+ }
+ follow_mount(&nd->path);
+ nd->inode = nd->path.dentry->d_inode;
++ return 0;
+ }
+
+ /*
+@@ -1503,7 +1528,7 @@ static inline int handle_dots(struct nameidata *nd, int type)
+ if (follow_dotdot_rcu(nd))
+ return -ECHILD;
+ } else
+- follow_dotdot(nd);
++ return follow_dotdot(nd);
+ }
+ return 0;
+ }
+@@ -2239,7 +2264,7 @@ mountpoint_last(struct nameidata *nd, struct path *path)
+ if (unlikely(nd->last_type != LAST_NORM)) {
+ error = handle_dots(nd, nd->last_type);
+ if (error)
+- goto out;
++ return error;
+ dentry = dget(nd->path.dentry);
+ goto done;
+ }
+diff --git a/fs/nfs/filelayout/filelayout.c b/fs/nfs/filelayout/filelayout.c
+index 7afb52f6a25a..32879965b255 100644
+--- a/fs/nfs/filelayout/filelayout.c
++++ b/fs/nfs/filelayout/filelayout.c
+@@ -682,23 +682,18 @@ out_put:
+ goto out;
+ }
+
+-static void filelayout_free_fh_array(struct nfs4_filelayout_segment *fl)
++static void _filelayout_free_lseg(struct nfs4_filelayout_segment *fl)
+ {
+ int i;
+
+- for (i = 0; i < fl->num_fh; i++) {
+- if (!fl->fh_array[i])
+- break;
+- kfree(fl->fh_array[i]);
++ if (fl->fh_array) {
++ for (i = 0; i < fl->num_fh; i++) {
++ if (!fl->fh_array[i])
++ break;
++ kfree(fl->fh_array[i]);
++ }
++ kfree(fl->fh_array);
+ }
+- kfree(fl->fh_array);
+- fl->fh_array = NULL;
+-}
+-
+-static void
+-_filelayout_free_lseg(struct nfs4_filelayout_segment *fl)
+-{
+- filelayout_free_fh_array(fl);
+ kfree(fl);
+ }
+
+@@ -769,21 +764,21 @@ filelayout_decode_layout(struct pnfs_layout_hdr *flo,
+ /* Do we want to use a mempool here? */
+ fl->fh_array[i] = kmalloc(sizeof(struct nfs_fh), gfp_flags);
+ if (!fl->fh_array[i])
+- goto out_err_free;
++ goto out_err;
+
+ p = xdr_inline_decode(&stream, 4);
+ if (unlikely(!p))
+- goto out_err_free;
++ goto out_err;
+ fl->fh_array[i]->size = be32_to_cpup(p++);
+ if (sizeof(struct nfs_fh) < fl->fh_array[i]->size) {
+ printk(KERN_ERR "NFS: Too big fh %d received %d\n",
+ i, fl->fh_array[i]->size);
+- goto out_err_free;
++ goto out_err;
+ }
+
+ p = xdr_inline_decode(&stream, fl->fh_array[i]->size);
+ if (unlikely(!p))
+- goto out_err_free;
++ goto out_err;
+ memcpy(fl->fh_array[i]->data, p, fl->fh_array[i]->size);
+ dprintk("DEBUG: %s: fh len %d\n", __func__,
+ fl->fh_array[i]->size);
+@@ -792,8 +787,6 @@ filelayout_decode_layout(struct pnfs_layout_hdr *flo,
+ __free_page(scratch);
+ return 0;
+
+-out_err_free:
+- filelayout_free_fh_array(fl);
+ out_err:
+ __free_page(scratch);
+ return -EIO;
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index c9ff4a176a25..123a494d018b 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -2346,7 +2346,7 @@ static int _nfs4_do_open(struct inode *dir,
+ goto err_free_label;
+ state = ctx->state;
+
+- if ((opendata->o_arg.open_flags & O_EXCL) &&
++ if ((opendata->o_arg.open_flags & (O_CREAT|O_EXCL)) == (O_CREAT|O_EXCL) &&
+ (opendata->o_arg.createmode != NFS4_CREATE_GUARDED)) {
+ nfs4_exclusive_attrset(opendata, sattr);
+
+@@ -8443,6 +8443,7 @@ static const struct nfs4_minor_version_ops nfs_v4_2_minor_ops = {
+ .reboot_recovery_ops = &nfs41_reboot_recovery_ops,
+ .nograce_recovery_ops = &nfs41_nograce_recovery_ops,
+ .state_renewal_ops = &nfs41_state_renewal_ops,
++ .mig_recovery_ops = &nfs41_mig_recovery_ops,
+ };
+ #endif
+
+diff --git a/fs/nfs/pagelist.c b/fs/nfs/pagelist.c
+index ed0db61f8543..54631609d601 100644
+--- a/fs/nfs/pagelist.c
++++ b/fs/nfs/pagelist.c
+@@ -63,8 +63,8 @@ EXPORT_SYMBOL_GPL(nfs_pgheader_init);
+ void nfs_set_pgio_error(struct nfs_pgio_header *hdr, int error, loff_t pos)
+ {
+ spin_lock(&hdr->lock);
+- if (pos < hdr->io_start + hdr->good_bytes) {
+- set_bit(NFS_IOHDR_ERROR, &hdr->flags);
++ if (!test_and_set_bit(NFS_IOHDR_ERROR, &hdr->flags)
++ || pos < hdr->io_start + hdr->good_bytes) {
+ clear_bit(NFS_IOHDR_EOF, &hdr->flags);
+ hdr->good_bytes = pos - hdr->io_start;
+ hdr->error = error;
+@@ -486,7 +486,7 @@ size_t nfs_generic_pg_test(struct nfs_pageio_descriptor *desc,
+ * for it without upsetting the slab allocator.
+ */
+ if (((desc->pg_count + req->wb_bytes) >> PAGE_SHIFT) *
+- sizeof(struct page) > PAGE_SIZE)
++ sizeof(struct page *) > PAGE_SIZE)
+ return 0;
+
+ return min(desc->pg_bsize - desc->pg_count, (size_t)req->wb_bytes);
+diff --git a/fs/ocfs2/dlm/dlmmaster.c b/fs/ocfs2/dlm/dlmmaster.c
+index 9ec1eea7c3a3..5972f5a30713 100644
+--- a/fs/ocfs2/dlm/dlmmaster.c
++++ b/fs/ocfs2/dlm/dlmmaster.c
+@@ -1447,6 +1447,7 @@ int dlm_master_request_handler(struct o2net_msg *msg, u32 len, void *data,
+ int found, ret;
+ int set_maybe;
+ int dispatch_assert = 0;
++ int dispatched = 0;
+
+ if (!dlm_grab(dlm))
+ return DLM_MASTER_RESP_NO;
+@@ -1653,14 +1654,17 @@ send_response:
+ mlog(ML_ERROR, "failed to dispatch assert master work\n");
+ response = DLM_MASTER_RESP_ERROR;
+ dlm_lockres_put(res);
+- } else
++ } else {
++ dispatched = 1;
+ dlm_lockres_grab_inflight_worker(dlm, res);
++ }
+ } else {
+ if (res)
+ dlm_lockres_put(res);
+ }
+
+- dlm_put(dlm);
++ if (!dispatched)
++ dlm_put(dlm);
+ return response;
+ }
+
+@@ -2084,7 +2088,6 @@ int dlm_dispatch_assert_master(struct dlm_ctxt *dlm,
+
+
+ /* queue up work for dlm_assert_master_worker */
+- dlm_grab(dlm); /* get an extra ref for the work item */
+ dlm_init_work_item(dlm, item, dlm_assert_master_worker, NULL);
+ item->u.am.lockres = res; /* already have a ref */
+ /* can optionally ignore node numbers higher than this node */
+diff --git a/fs/ocfs2/dlm/dlmrecovery.c b/fs/ocfs2/dlm/dlmrecovery.c
+index 3365839d2971..8632f9c5fb5d 100644
+--- a/fs/ocfs2/dlm/dlmrecovery.c
++++ b/fs/ocfs2/dlm/dlmrecovery.c
+@@ -1687,6 +1687,7 @@ int dlm_master_requery_handler(struct o2net_msg *msg, u32 len, void *data,
+ unsigned int hash;
+ int master = DLM_LOCK_RES_OWNER_UNKNOWN;
+ u32 flags = DLM_ASSERT_MASTER_REQUERY;
++ int dispatched = 0;
+
+ if (!dlm_grab(dlm)) {
+ /* since the domain has gone away on this
+@@ -1708,8 +1709,10 @@ int dlm_master_requery_handler(struct o2net_msg *msg, u32 len, void *data,
+ mlog_errno(-ENOMEM);
+ /* retry!? */
+ BUG();
+- } else
++ } else {
++ dispatched = 1;
+ __dlm_lockres_grab_inflight_worker(dlm, res);
++ }
+ spin_unlock(&res->spinlock);
+ } else {
+ /* put.. incase we are not the master */
+@@ -1719,7 +1722,8 @@ int dlm_master_requery_handler(struct o2net_msg *msg, u32 len, void *data,
+ }
+ spin_unlock(&dlm->spinlock);
+
+- dlm_put(dlm);
++ if (!dispatched)
++ dlm_put(dlm);
+ return master;
+ }
+
+diff --git a/fs/open.c b/fs/open.c
+index 4a8a355ffab8..d058ff1b841b 100644
+--- a/fs/open.c
++++ b/fs/open.c
+@@ -665,18 +665,18 @@ int open_check_o_direct(struct file *f)
+ }
+
+ static int do_dentry_open(struct file *f,
++ struct inode *inode,
+ int (*open)(struct inode *, struct file *),
+ const struct cred *cred)
+ {
+ static const struct file_operations empty_fops = {};
+- struct inode *inode;
+ int error;
+
+ f->f_mode = OPEN_FMODE(f->f_flags) | FMODE_LSEEK |
+ FMODE_PREAD | FMODE_PWRITE;
+
+ path_get(&f->f_path);
+- inode = f->f_inode = f->f_path.dentry->d_inode;
++ f->f_inode = inode;
+ f->f_mapping = inode->i_mapping;
+
+ if (unlikely(f->f_flags & O_PATH)) {
+@@ -780,7 +780,8 @@ int finish_open(struct file *file, struct dentry *dentry,
+ BUG_ON(*opened & FILE_OPENED); /* once it's opened, it's opened */
+
+ file->f_path.dentry = dentry;
+- error = do_dentry_open(file, open, current_cred());
++ error = do_dentry_open(file, d_backing_inode(dentry), open,
++ current_cred());
+ if (!error)
+ *opened |= FILE_OPENED;
+
+@@ -809,6 +810,28 @@ int finish_no_open(struct file *file, struct dentry *dentry)
+ }
+ EXPORT_SYMBOL(finish_no_open);
+
++/**
++ * vfs_open - open the file at the given path
++ * @path: path to open
++ * @file: newly allocated file with f_flag initialized
++ * @cred: credentials to use
++ */
++int vfs_open(const struct path *path, struct file *file,
++ const struct cred *cred)
++{
++ struct dentry *dentry = path->dentry;
++ struct inode *inode = dentry->d_inode;
++
++ file->f_path = *path;
++ if (dentry->d_flags & DCACHE_OP_SELECT_INODE) {
++ inode = dentry->d_op->d_select_inode(dentry, file->f_flags);
++ if (IS_ERR(inode))
++ return PTR_ERR(inode);
++ }
++
++ return do_dentry_open(file, inode, NULL, cred);
++}
++
+ struct file *dentry_open(const struct path *path, int flags,
+ const struct cred *cred)
+ {
+@@ -840,26 +863,6 @@ struct file *dentry_open(const struct path *path, int flags,
+ }
+ EXPORT_SYMBOL(dentry_open);
+
+-/**
+- * vfs_open - open the file at the given path
+- * @path: path to open
+- * @filp: newly allocated file with f_flag initialized
+- * @cred: credentials to use
+- */
+-int vfs_open(const struct path *path, struct file *filp,
+- const struct cred *cred)
+-{
+- struct inode *inode = path->dentry->d_inode;
+-
+- if (inode->i_op->dentry_open)
+- return inode->i_op->dentry_open(path->dentry, filp, cred);
+- else {
+- filp->f_path = *path;
+- return do_dentry_open(filp, NULL, cred);
+- }
+-}
+-EXPORT_SYMBOL(vfs_open);
+-
+ static inline int build_open_flags(int flags, umode_t mode, struct open_flags *op)
+ {
+ int lookup_flags = 0;
+diff --git a/fs/overlayfs/inode.c b/fs/overlayfs/inode.c
+index 07d74b24913b..e3903b74a1f2 100644
+--- a/fs/overlayfs/inode.c
++++ b/fs/overlayfs/inode.c
+@@ -333,37 +333,33 @@ static bool ovl_open_need_copy_up(int flags, enum ovl_path_type type,
+ return true;
+ }
+
+-static int ovl_dentry_open(struct dentry *dentry, struct file *file,
+- const struct cred *cred)
++struct inode *ovl_d_select_inode(struct dentry *dentry, unsigned file_flags)
+ {
+ int err;
+ struct path realpath;
+ enum ovl_path_type type;
+- bool want_write = false;
++
++ if (d_is_dir(dentry))
++ return d_backing_inode(dentry);
+
+ type = ovl_path_real(dentry, &realpath);
+- if (ovl_open_need_copy_up(file->f_flags, type, realpath.dentry)) {
+- want_write = true;
++ if (ovl_open_need_copy_up(file_flags, type, realpath.dentry)) {
+ err = ovl_want_write(dentry);
+ if (err)
+- goto out;
++ return ERR_PTR(err);
+
+- if (file->f_flags & O_TRUNC)
++ if (file_flags & O_TRUNC)
+ err = ovl_copy_up_last(dentry, NULL, true);
+ else
+ err = ovl_copy_up(dentry);
++ ovl_drop_write(dentry);
+ if (err)
+- goto out_drop_write;
++ return ERR_PTR(err);
+
+ ovl_path_upper(dentry, &realpath);
+ }
+
+- err = vfs_open(&realpath, file, cred);
+-out_drop_write:
+- if (want_write)
+- ovl_drop_write(dentry);
+-out:
+- return err;
++ return d_backing_inode(realpath.dentry);
+ }
+
+ static const struct inode_operations ovl_file_inode_operations = {
+@@ -374,7 +370,6 @@ static const struct inode_operations ovl_file_inode_operations = {
+ .getxattr = ovl_getxattr,
+ .listxattr = ovl_listxattr,
+ .removexattr = ovl_removexattr,
+- .dentry_open = ovl_dentry_open,
+ };
+
+ static const struct inode_operations ovl_symlink_inode_operations = {
+diff --git a/fs/overlayfs/overlayfs.h b/fs/overlayfs/overlayfs.h
+index 814bed33dd07..1714fcc7603e 100644
+--- a/fs/overlayfs/overlayfs.h
++++ b/fs/overlayfs/overlayfs.h
+@@ -165,6 +165,7 @@ ssize_t ovl_getxattr(struct dentry *dentry, const char *name,
+ void *value, size_t size);
+ ssize_t ovl_listxattr(struct dentry *dentry, char *list, size_t size);
+ int ovl_removexattr(struct dentry *dentry, const char *name);
++struct inode *ovl_d_select_inode(struct dentry *dentry, unsigned file_flags);
+
+ struct inode *ovl_new_inode(struct super_block *sb, umode_t mode,
+ struct ovl_entry *oe);
+diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c
+index f16d318b71f8..6256c8ed52c9 100644
+--- a/fs/overlayfs/super.c
++++ b/fs/overlayfs/super.c
+@@ -269,6 +269,7 @@ static void ovl_dentry_release(struct dentry *dentry)
+
+ static const struct dentry_operations ovl_dentry_operations = {
+ .d_release = ovl_dentry_release,
++ .d_select_inode = ovl_d_select_inode,
+ };
+
+ static struct ovl_entry *ovl_alloc_entry(void)
+diff --git a/include/linux/dcache.h b/include/linux/dcache.h
+index 1c2f1b84468b..340ee0dae93b 100644
+--- a/include/linux/dcache.h
++++ b/include/linux/dcache.h
+@@ -160,6 +160,7 @@ struct dentry_operations {
+ char *(*d_dname)(struct dentry *, char *, int);
+ struct vfsmount *(*d_automount)(struct path *);
+ int (*d_manage)(struct dentry *, bool);
++ struct inode *(*d_select_inode)(struct dentry *, unsigned);
+ } ____cacheline_aligned;
+
+ /*
+@@ -222,6 +223,7 @@ struct dentry_operations {
+ #define DCACHE_FILE_TYPE 0x00400000 /* Other file type */
+
+ #define DCACHE_MAY_FREE 0x00800000
++#define DCACHE_OP_SELECT_INODE 0x02000000 /* Unioned entry: dcache op selects inode */
+
+ extern seqlock_t rename_lock;
+
+@@ -468,4 +470,61 @@ static inline unsigned long vfs_pressure_ratio(unsigned long val)
+ {
+ return mult_frac(val, sysctl_vfs_cache_pressure, 100);
+ }
++
++/**
++ * d_inode - Get the actual inode of this dentry
++ * @dentry: The dentry to query
++ *
++ * This is the helper normal filesystems should use to get at their own inodes
++ * in their own dentries and ignore the layering superimposed upon them.
++ */
++static inline struct inode *d_inode(const struct dentry *dentry)
++{
++ return dentry->d_inode;
++}
++
++/**
++ * d_inode_rcu - Get the actual inode of this dentry with ACCESS_ONCE()
++ * @dentry: The dentry to query
++ *
++ * This is the helper normal filesystems should use to get at their own inodes
++ * in their own dentries and ignore the layering superimposed upon them.
++ */
++static inline struct inode *d_inode_rcu(const struct dentry *dentry)
++{
++ return ACCESS_ONCE(dentry->d_inode);
++}
++
++/**
++ * d_backing_inode - Get upper or lower inode we should be using
++ * @upper: The upper layer
++ *
++ * This is the helper that should be used to get at the inode that will be used
++ * if this dentry were to be opened as a file. The inode may be on the upper
++ * dentry or it may be on a lower dentry pinned by the upper.
++ *
++ * Normal filesystems should not use this to access their own inodes.
++ */
++static inline struct inode *d_backing_inode(const struct dentry *upper)
++{
++ struct inode *inode = upper->d_inode;
++
++ return inode;
++}
++
++/**
++ * d_backing_dentry - Get upper or lower dentry we should be using
++ * @upper: The upper layer
++ *
++ * This is the helper that should be used to get the dentry of the inode that
++ * will be used if this dentry were opened as a file. It may be the upper
++ * dentry or it may be a lower dentry pinned by the upper.
++ *
++ * Normal filesystems should not use this to access their own dentries.
++ */
++static inline struct dentry *d_backing_dentry(struct dentry *upper)
++{
++ return upper;
++}
++
+ #endif /* __LINUX_DCACHE_H */
+diff --git a/include/linux/fs.h b/include/linux/fs.h
+index 84d672914bd8..6fd017e25c0a 100644
+--- a/include/linux/fs.h
++++ b/include/linux/fs.h
+@@ -1552,7 +1552,6 @@ struct inode_operations {
+ int (*set_acl)(struct inode *, struct posix_acl *, int);
+
+ /* WARNING: probably going away soon, do not use! */
+- int (*dentry_open)(struct dentry *, struct file *, const struct cred *);
+ } ____cacheline_aligned;
+
+ ssize_t rw_copy_check_uvector(int type, const struct iovec __user * uvector,
+@@ -2068,7 +2067,6 @@ extern struct file *file_open_name(struct filename *, int, umode_t);
+ extern struct file *filp_open(const char *, int, umode_t);
+ extern struct file *file_open_root(struct dentry *, struct vfsmount *,
+ const char *, int);
+-extern int vfs_open(const struct path *, struct file *, const struct cred *);
+ extern struct file * dentry_open(const struct path *, int, const struct cred *);
+ extern int filp_close(struct file *, fl_owner_t id);
+
+diff --git a/include/linux/if_link.h b/include/linux/if_link.h
+index 119130e9298b..da4929927f69 100644
+--- a/include/linux/if_link.h
++++ b/include/linux/if_link.h
+@@ -14,5 +14,6 @@ struct ifla_vf_info {
+ __u32 linkstate;
+ __u32 min_tx_rate;
+ __u32 max_tx_rate;
++ __u32 rss_query_en;
+ };
+ #endif /* _LINUX_IF_LINK_H */
+diff --git a/include/linux/iio/iio.h b/include/linux/iio/iio.h
+index 15dc6bc2bdd2..6c17af80823c 100644
+--- a/include/linux/iio/iio.h
++++ b/include/linux/iio/iio.h
+@@ -614,6 +614,15 @@ int iio_str_to_fixpoint(const char *str, int fract_mult, int *integer,
+ #define IIO_DEGREE_TO_RAD(deg) (((deg) * 314159ULL + 9000000ULL) / 18000000ULL)
+
+ /**
++ * IIO_RAD_TO_DEGREE() - Convert rad to degree
++ * @rad: A value in rad
++ *
++ * Returns the given value converted from rad to degree
++ */
++#define IIO_RAD_TO_DEGREE(rad) \
++ (((rad) * 18000000ULL + 314159ULL / 2) / 314159ULL)
++
++/**
+ * IIO_G_TO_M_S_2() - Convert g to meter / second**2
+ * @g: A value in g
+ *
+@@ -621,4 +630,12 @@ int iio_str_to_fixpoint(const char *str, int fract_mult, int *integer,
+ */
+ #define IIO_G_TO_M_S_2(g) ((g) * 980665ULL / 100000ULL)
+
++/**
++ * IIO_M_S_2_TO_G() - Convert meter / second**2 to g
++ * @ms2: A value in meter / second**2
++ *
++ * Returns the given value converted from meter / second**2 to g
++ */
++#define IIO_M_S_2_TO_G(ms2) (((ms2) * 100000ULL + 980665ULL / 2) / 980665ULL)
++
+ #endif /* _INDUSTRIAL_IO_H_ */
+diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
+index c3fd34da6c08..70fde9c5c61d 100644
+--- a/include/linux/netdevice.h
++++ b/include/linux/netdevice.h
+@@ -859,6 +859,11 @@ typedef u16 (*select_queue_fallback_t)(struct net_device *dev,
+ * int (*ndo_set_vf_link_state)(struct net_device *dev, int vf, int link_state);
+ * int (*ndo_set_vf_port)(struct net_device *dev, int vf,
+ * struct nlattr *port[]);
++ *
++ * Enable or disable the VF ability to query its RSS Redirection Table and
++ * Hash Key. This is needed since on some devices VF share this information
++ * with PF and querying it may adduce a theoretical security risk.
++ * int (*ndo_set_vf_rss_query_en)(struct net_device *dev, int vf, bool setting);
+ * int (*ndo_get_vf_port)(struct net_device *dev, int vf, struct sk_buff *skb);
+ * int (*ndo_setup_tc)(struct net_device *dev, u8 tc)
+ * Called to setup 'tc' number of traffic classes in the net device. This
+@@ -1071,6 +1076,9 @@ struct net_device_ops {
+ struct nlattr *port[]);
+ int (*ndo_get_vf_port)(struct net_device *dev,
+ int vf, struct sk_buff *skb);
++ int (*ndo_set_vf_rss_query_en)(
++ struct net_device *dev,
++ int vf, bool setting);
+ int (*ndo_setup_tc)(struct net_device *dev, u8 tc);
+ #if IS_ENABLED(CONFIG_FCOE)
+ int (*ndo_fcoe_enable)(struct net_device *dev);
+diff --git a/include/linux/security.h b/include/linux/security.h
+index ba96471c11ba..ea9eda4abdd5 100644
+--- a/include/linux/security.h
++++ b/include/linux/security.h
+@@ -2471,7 +2471,7 @@ static inline int security_task_prctl(int option, unsigned long arg2,
+ unsigned long arg4,
+ unsigned long arg5)
+ {
+- return cap_task_prctl(option, arg2, arg3, arg3, arg5);
++ return cap_task_prctl(option, arg2, arg3, arg4, arg5);
+ }
+
+ static inline void security_task_to_inode(struct task_struct *p, struct inode *inode)
+diff --git a/include/target/iscsi/iscsi_target_core.h b/include/target/iscsi/iscsi_target_core.h
+new file mode 100644
+index 000000000000..7bd03f867fca
+--- /dev/null
++++ b/include/target/iscsi/iscsi_target_core.h
+@@ -0,0 +1,904 @@
++#ifndef ISCSI_TARGET_CORE_H
++#define ISCSI_TARGET_CORE_H
++
++#include <linux/in.h>
++#include <linux/configfs.h>
++#include <net/sock.h>
++#include <net/tcp.h>
++#include <scsi/scsi_cmnd.h>
++#include <scsi/iscsi_proto.h>
++#include <target/target_core_base.h>
++
++#define ISCSIT_VERSION "v4.1.0"
++#define ISCSI_MAX_DATASN_MISSING_COUNT 16
++#define ISCSI_TX_THREAD_TCP_TIMEOUT 2
++#define ISCSI_RX_THREAD_TCP_TIMEOUT 2
++#define SECONDS_FOR_ASYNC_LOGOUT 10
++#define SECONDS_FOR_ASYNC_TEXT 10
++#define SECONDS_FOR_LOGOUT_COMP 15
++#define WHITE_SPACE " \t\v\f\n\r"
++#define ISCSIT_MIN_TAGS 16
++#define ISCSIT_EXTRA_TAGS 8
++#define ISCSIT_TCP_BACKLOG 256
++#define ISCSI_RX_THREAD_NAME "iscsi_trx"
++#define ISCSI_TX_THREAD_NAME "iscsi_ttx"
++
++/* struct iscsi_node_attrib sanity values */
++#define NA_DATAOUT_TIMEOUT 3
++#define NA_DATAOUT_TIMEOUT_MAX 60
++#define NA_DATAOUT_TIMEOUT_MIX 2
++#define NA_DATAOUT_TIMEOUT_RETRIES 5
++#define NA_DATAOUT_TIMEOUT_RETRIES_MAX 15
++#define NA_DATAOUT_TIMEOUT_RETRIES_MIN 1
++#define NA_NOPIN_TIMEOUT 15
++#define NA_NOPIN_TIMEOUT_MAX 60
++#define NA_NOPIN_TIMEOUT_MIN 3
++#define NA_NOPIN_RESPONSE_TIMEOUT 30
++#define NA_NOPIN_RESPONSE_TIMEOUT_MAX 60
++#define NA_NOPIN_RESPONSE_TIMEOUT_MIN 3
++#define NA_RANDOM_DATAIN_PDU_OFFSETS 0
++#define NA_RANDOM_DATAIN_SEQ_OFFSETS 0
++#define NA_RANDOM_R2T_OFFSETS 0
++
++/* struct iscsi_tpg_attrib sanity values */
++#define TA_AUTHENTICATION 1
++#define TA_LOGIN_TIMEOUT 15
++#define TA_LOGIN_TIMEOUT_MAX 30
++#define TA_LOGIN_TIMEOUT_MIN 5
++#define TA_NETIF_TIMEOUT 2
++#define TA_NETIF_TIMEOUT_MAX 15
++#define TA_NETIF_TIMEOUT_MIN 2
++#define TA_GENERATE_NODE_ACLS 0
++#define TA_DEFAULT_CMDSN_DEPTH 64
++#define TA_DEFAULT_CMDSN_DEPTH_MAX 512
++#define TA_DEFAULT_CMDSN_DEPTH_MIN 1
++#define TA_CACHE_DYNAMIC_ACLS 0
++/* Enabled by default in demo mode (generic_node_acls=1) */
++#define TA_DEMO_MODE_WRITE_PROTECT 1
++/* Disabled by default in production mode w/ explict ACLs */
++#define TA_PROD_MODE_WRITE_PROTECT 0
++#define TA_DEMO_MODE_DISCOVERY 1
++#define TA_DEFAULT_ERL 0
++#define TA_CACHE_CORE_NPS 0
++/* T10 protection information disabled by default */
++#define TA_DEFAULT_T10_PI 0
++#define TA_DEFAULT_FABRIC_PROT_TYPE 0
++
++#define ISCSI_IOV_DATA_BUFFER 5
++
++enum iscsit_transport_type {
++ ISCSI_TCP = 0,
++ ISCSI_SCTP_TCP = 1,
++ ISCSI_SCTP_UDP = 2,
++ ISCSI_IWARP_TCP = 3,
++ ISCSI_IWARP_SCTP = 4,
++ ISCSI_INFINIBAND = 5,
++};
++
++/* RFC-3720 7.1.4 Standard Connection State Diagram for a Target */
++enum target_conn_state_table {
++ TARG_CONN_STATE_FREE = 0x1,
++ TARG_CONN_STATE_XPT_UP = 0x3,
++ TARG_CONN_STATE_IN_LOGIN = 0x4,
++ TARG_CONN_STATE_LOGGED_IN = 0x5,
++ TARG_CONN_STATE_IN_LOGOUT = 0x6,
++ TARG_CONN_STATE_LOGOUT_REQUESTED = 0x7,
++ TARG_CONN_STATE_CLEANUP_WAIT = 0x8,
++};
++
++/* RFC-3720 7.3.2 Session State Diagram for a Target */
++enum target_sess_state_table {
++ TARG_SESS_STATE_FREE = 0x1,
++ TARG_SESS_STATE_ACTIVE = 0x2,
++ TARG_SESS_STATE_LOGGED_IN = 0x3,
++ TARG_SESS_STATE_FAILED = 0x4,
++ TARG_SESS_STATE_IN_CONTINUE = 0x5,
++};
++
++/* struct iscsi_data_count->type */
++enum data_count_type {
++ ISCSI_RX_DATA = 1,
++ ISCSI_TX_DATA = 2,
++};
++
++/* struct iscsi_datain_req->dr_complete */
++enum datain_req_comp_table {
++ DATAIN_COMPLETE_NORMAL = 1,
++ DATAIN_COMPLETE_WITHIN_COMMAND_RECOVERY = 2,
++ DATAIN_COMPLETE_CONNECTION_RECOVERY = 3,
++};
++
++/* struct iscsi_datain_req->recovery */
++enum datain_req_rec_table {
++ DATAIN_WITHIN_COMMAND_RECOVERY = 1,
++ DATAIN_CONNECTION_RECOVERY = 2,
++};
++
++/* struct iscsi_portal_group->state */
++enum tpg_state_table {
++ TPG_STATE_FREE = 0,
++ TPG_STATE_ACTIVE = 1,
++ TPG_STATE_INACTIVE = 2,
++ TPG_STATE_COLD_RESET = 3,
++};
++
++/* struct iscsi_tiqn->tiqn_state */
++enum tiqn_state_table {
++ TIQN_STATE_ACTIVE = 1,
++ TIQN_STATE_SHUTDOWN = 2,
++};
++
++/* struct iscsi_cmd->cmd_flags */
++enum cmd_flags_table {
++ ICF_GOT_LAST_DATAOUT = 0x00000001,
++ ICF_GOT_DATACK_SNACK = 0x00000002,
++ ICF_NON_IMMEDIATE_UNSOLICITED_DATA = 0x00000004,
++ ICF_SENT_LAST_R2T = 0x00000008,
++ ICF_WITHIN_COMMAND_RECOVERY = 0x00000010,
++ ICF_CONTIG_MEMORY = 0x00000020,
++ ICF_ATTACHED_TO_RQUEUE = 0x00000040,
++ ICF_OOO_CMDSN = 0x00000080,
++ ICF_SENDTARGETS_ALL = 0x00000100,
++ ICF_SENDTARGETS_SINGLE = 0x00000200,
++};
++
++/* struct iscsi_cmd->i_state */
++enum cmd_i_state_table {
++ ISTATE_NO_STATE = 0,
++ ISTATE_NEW_CMD = 1,
++ ISTATE_DEFERRED_CMD = 2,
++ ISTATE_UNSOLICITED_DATA = 3,
++ ISTATE_RECEIVE_DATAOUT = 4,
++ ISTATE_RECEIVE_DATAOUT_RECOVERY = 5,
++ ISTATE_RECEIVED_LAST_DATAOUT = 6,
++ ISTATE_WITHIN_DATAOUT_RECOVERY = 7,
++ ISTATE_IN_CONNECTION_RECOVERY = 8,
++ ISTATE_RECEIVED_TASKMGT = 9,
++ ISTATE_SEND_ASYNCMSG = 10,
++ ISTATE_SENT_ASYNCMSG = 11,
++ ISTATE_SEND_DATAIN = 12,
++ ISTATE_SEND_LAST_DATAIN = 13,
++ ISTATE_SENT_LAST_DATAIN = 14,
++ ISTATE_SEND_LOGOUTRSP = 15,
++ ISTATE_SENT_LOGOUTRSP = 16,
++ ISTATE_SEND_NOPIN = 17,
++ ISTATE_SENT_NOPIN = 18,
++ ISTATE_SEND_REJECT = 19,
++ ISTATE_SENT_REJECT = 20,
++ ISTATE_SEND_R2T = 21,
++ ISTATE_SENT_R2T = 22,
++ ISTATE_SEND_R2T_RECOVERY = 23,
++ ISTATE_SENT_R2T_RECOVERY = 24,
++ ISTATE_SEND_LAST_R2T = 25,
++ ISTATE_SENT_LAST_R2T = 26,
++ ISTATE_SEND_LAST_R2T_RECOVERY = 27,
++ ISTATE_SENT_LAST_R2T_RECOVERY = 28,
++ ISTATE_SEND_STATUS = 29,
++ ISTATE_SEND_STATUS_BROKEN_PC = 30,
++ ISTATE_SENT_STATUS = 31,
++ ISTATE_SEND_STATUS_RECOVERY = 32,
++ ISTATE_SENT_STATUS_RECOVERY = 33,
++ ISTATE_SEND_TASKMGTRSP = 34,
++ ISTATE_SENT_TASKMGTRSP = 35,
++ ISTATE_SEND_TEXTRSP = 36,
++ ISTATE_SENT_TEXTRSP = 37,
++ ISTATE_SEND_NOPIN_WANT_RESPONSE = 38,
++ ISTATE_SENT_NOPIN_WANT_RESPONSE = 39,
++ ISTATE_SEND_NOPIN_NO_RESPONSE = 40,
++ ISTATE_REMOVE = 41,
++ ISTATE_FREE = 42,
++};
++
++/* Used for iscsi_recover_cmdsn() return values */
++enum recover_cmdsn_ret_table {
++ CMDSN_ERROR_CANNOT_RECOVER = -1,
++ CMDSN_NORMAL_OPERATION = 0,
++ CMDSN_LOWER_THAN_EXP = 1,
++ CMDSN_HIGHER_THAN_EXP = 2,
++ CMDSN_MAXCMDSN_OVERRUN = 3,
++};
++
++/* Used for iscsi_handle_immediate_data() return values */
++enum immedate_data_ret_table {
++ IMMEDIATE_DATA_CANNOT_RECOVER = -1,
++ IMMEDIATE_DATA_NORMAL_OPERATION = 0,
++ IMMEDIATE_DATA_ERL1_CRC_FAILURE = 1,
++};
++
++/* Used for iscsi_decide_dataout_action() return values */
++enum dataout_action_ret_table {
++ DATAOUT_CANNOT_RECOVER = -1,
++ DATAOUT_NORMAL = 0,
++ DATAOUT_SEND_R2T = 1,
++ DATAOUT_SEND_TO_TRANSPORT = 2,
++ DATAOUT_WITHIN_COMMAND_RECOVERY = 3,
++};
++
++/* Used for struct iscsi_node_auth->naf_flags */
++enum naf_flags_table {
++ NAF_USERID_SET = 0x01,
++ NAF_PASSWORD_SET = 0x02,
++ NAF_USERID_IN_SET = 0x04,
++ NAF_PASSWORD_IN_SET = 0x08,
++};
++
++/* Used by various struct timer_list to manage iSCSI specific state */
++enum iscsi_timer_flags_table {
++ ISCSI_TF_RUNNING = 0x01,
++ ISCSI_TF_STOP = 0x02,
++ ISCSI_TF_EXPIRED = 0x04,
++};
++
++/* Used for struct iscsi_np->np_flags */
++enum np_flags_table {
++ NPF_IP_NETWORK = 0x00,
++};
++
++/* Used for struct iscsi_np->np_thread_state */
++enum np_thread_state_table {
++ ISCSI_NP_THREAD_ACTIVE = 1,
++ ISCSI_NP_THREAD_INACTIVE = 2,
++ ISCSI_NP_THREAD_RESET = 3,
++ ISCSI_NP_THREAD_SHUTDOWN = 4,
++ ISCSI_NP_THREAD_EXIT = 5,
++};
++
++struct iscsi_conn_ops {
++ u8 HeaderDigest; /* [0,1] == [None,CRC32C] */
++ u8 DataDigest; /* [0,1] == [None,CRC32C] */
++ u32 MaxRecvDataSegmentLength; /* [512..2**24-1] */
++ u32 MaxXmitDataSegmentLength; /* [512..2**24-1] */
++ u8 OFMarker; /* [0,1] == [No,Yes] */
++ u8 IFMarker; /* [0,1] == [No,Yes] */
++ u32 OFMarkInt; /* [1..65535] */
++ u32 IFMarkInt; /* [1..65535] */
++ /*
++ * iSER specific connection parameters
++ */
++ u32 InitiatorRecvDataSegmentLength; /* [512..2**24-1] */
++ u32 TargetRecvDataSegmentLength; /* [512..2**24-1] */
++};
++
++struct iscsi_sess_ops {
++ char InitiatorName[224];
++ char InitiatorAlias[256];
++ char TargetName[224];
++ char TargetAlias[256];
++ char TargetAddress[256];
++ u16 TargetPortalGroupTag; /* [0..65535] */
++ u16 MaxConnections; /* [1..65535] */
++ u8 InitialR2T; /* [0,1] == [No,Yes] */
++ u8 ImmediateData; /* [0,1] == [No,Yes] */
++ u32 MaxBurstLength; /* [512..2**24-1] */
++ u32 FirstBurstLength; /* [512..2**24-1] */
++ u16 DefaultTime2Wait; /* [0..3600] */
++ u16 DefaultTime2Retain; /* [0..3600] */
++ u16 MaxOutstandingR2T; /* [1..65535] */
++ u8 DataPDUInOrder; /* [0,1] == [No,Yes] */
++ u8 DataSequenceInOrder; /* [0,1] == [No,Yes] */
++ u8 ErrorRecoveryLevel; /* [0..2] */
++ u8 SessionType; /* [0,1] == [Normal,Discovery]*/
++ /*
++ * iSER specific session parameters
++ */
++ u8 RDMAExtensions; /* [0,1] == [No,Yes] */
++};
++
++struct iscsi_queue_req {
++ int state;
++ struct iscsi_cmd *cmd;
++ struct list_head qr_list;
++};
++
++struct iscsi_data_count {
++ int data_length;
++ int sync_and_steering;
++ enum data_count_type type;
++ u32 iov_count;
++ u32 ss_iov_count;
++ u32 ss_marker_count;
++ struct kvec *iov;
++};
++
++struct iscsi_param_list {
++ bool iser;
++ struct list_head param_list;
++ struct list_head extra_response_list;
++};
++
++struct iscsi_datain_req {
++ enum datain_req_comp_table dr_complete;
++ int generate_recovery_values;
++ enum datain_req_rec_table recovery;
++ u32 begrun;
++ u32 runlength;
++ u32 data_length;
++ u32 data_offset;
++ u32 data_sn;
++ u32 next_burst_len;
++ u32 read_data_done;
++ u32 seq_send_order;
++ struct list_head cmd_datain_node;
++} ____cacheline_aligned;
++
++struct iscsi_ooo_cmdsn {
++ u16 cid;
++ u32 batch_count;
++ u32 cmdsn;
++ u32 exp_cmdsn;
++ struct iscsi_cmd *cmd;
++ struct list_head ooo_list;
++} ____cacheline_aligned;
++
++struct iscsi_datain {
++ u8 flags;
++ u32 data_sn;
++ u32 length;
++ u32 offset;
++} ____cacheline_aligned;
++
++struct iscsi_r2t {
++ int seq_complete;
++ int recovery_r2t;
++ int sent_r2t;
++ u32 r2t_sn;
++ u32 offset;
++ u32 targ_xfer_tag;
++ u32 xfer_len;
++ struct list_head r2t_list;
++} ____cacheline_aligned;
++
++struct iscsi_cmd {
++ enum iscsi_timer_flags_table dataout_timer_flags;
++ /* DataOUT timeout retries */
++ u8 dataout_timeout_retries;
++ /* Within command recovery count */
++ u8 error_recovery_count;
++ /* iSCSI dependent state for out or order CmdSNs */
++ enum cmd_i_state_table deferred_i_state;
++ /* iSCSI dependent state */
++ enum cmd_i_state_table i_state;
++ /* Command is an immediate command (ISCSI_OP_IMMEDIATE set) */
++ u8 immediate_cmd;
++ /* Immediate data present */
++ u8 immediate_data;
++ /* iSCSI Opcode */
++ u8 iscsi_opcode;
++ /* iSCSI Response Code */
++ u8 iscsi_response;
++ /* Logout reason when iscsi_opcode == ISCSI_INIT_LOGOUT_CMND */
++ u8 logout_reason;
++ /* Logout response code when iscsi_opcode == ISCSI_INIT_LOGOUT_CMND */
++ u8 logout_response;
++ /* MaxCmdSN has been incremented */
++ u8 maxcmdsn_inc;
++ /* Immediate Unsolicited Dataout */
++ u8 unsolicited_data;
++ /* Reject reason code */
++ u8 reject_reason;
++ /* CID contained in logout PDU when opcode == ISCSI_INIT_LOGOUT_CMND */
++ u16 logout_cid;
++ /* Command flags */
++ enum cmd_flags_table cmd_flags;
++ /* Initiator Task Tag assigned from Initiator */
++ itt_t init_task_tag;
++ /* Target Transfer Tag assigned from Target */
++ u32 targ_xfer_tag;
++ /* CmdSN assigned from Initiator */
++ u32 cmd_sn;
++ /* ExpStatSN assigned from Initiator */
++ u32 exp_stat_sn;
++ /* StatSN assigned to this ITT */
++ u32 stat_sn;
++ /* DataSN Counter */
++ u32 data_sn;
++ /* R2TSN Counter */
++ u32 r2t_sn;
++ /* Last DataSN acknowledged via DataAck SNACK */
++ u32 acked_data_sn;
++ /* Used for echoing NOPOUT ping data */
++ u32 buf_ptr_size;
++ /* Used to store DataDigest */
++ u32 data_crc;
++ /* Counter for MaxOutstandingR2T */
++ u32 outstanding_r2ts;
++ /* Next R2T Offset when DataSequenceInOrder=Yes */
++ u32 r2t_offset;
++ /* Iovec current and orig count for iscsi_cmd->iov_data */
++ u32 iov_data_count;
++ u32 orig_iov_data_count;
++ /* Number of miscellaneous iovecs used for IP stack calls */
++ u32 iov_misc_count;
++ /* Number of struct iscsi_pdu in struct iscsi_cmd->pdu_list */
++ u32 pdu_count;
++ /* Next struct iscsi_pdu to send in struct iscsi_cmd->pdu_list */
++ u32 pdu_send_order;
++ /* Current struct iscsi_pdu in struct iscsi_cmd->pdu_list */
++ u32 pdu_start;
++ /* Next struct iscsi_seq to send in struct iscsi_cmd->seq_list */
++ u32 seq_send_order;
++ /* Number of struct iscsi_seq in struct iscsi_cmd->seq_list */
++ u32 seq_count;
++ /* Current struct iscsi_seq in struct iscsi_cmd->seq_list */
++ u32 seq_no;
++ /* Lowest offset in current DataOUT sequence */
++ u32 seq_start_offset;
++ /* Highest offset in current DataOUT sequence */
++ u32 seq_end_offset;
++ /* Total size in bytes received so far of READ data */
++ u32 read_data_done;
++ /* Total size in bytes received so far of WRITE data */
++ u32 write_data_done;
++ /* Counter for FirstBurstLength key */
++ u32 first_burst_len;
++ /* Counter for MaxBurstLength key */
++ u32 next_burst_len;
++ /* Transfer size used for IP stack calls */
++ u32 tx_size;
++ /* Buffer used for various purposes */
++ void *buf_ptr;
++ /* Used by SendTargets=[iqn.,eui.] discovery */
++ void *text_in_ptr;
++ /* See include/linux/dma-mapping.h */
++ enum dma_data_direction data_direction;
++ /* iSCSI PDU Header + CRC */
++ unsigned char pdu[ISCSI_HDR_LEN + ISCSI_CRC_LEN];
++ /* Number of times struct iscsi_cmd is present in immediate queue */
++ atomic_t immed_queue_count;
++ atomic_t response_queue_count;
++ spinlock_t datain_lock;
++ spinlock_t dataout_timeout_lock;
++ /* spinlock for protecting struct iscsi_cmd->i_state */
++ spinlock_t istate_lock;
++ /* spinlock for adding within command recovery entries */
++ spinlock_t error_lock;
++ /* spinlock for adding R2Ts */
++ spinlock_t r2t_lock;
++ /* DataIN List */
++ struct list_head datain_list;
++ /* R2T List */
++ struct list_head cmd_r2t_list;
++ /* Timer for DataOUT */
++ struct timer_list dataout_timer;
++ /* Iovecs for SCSI data payload RX/TX w/ kernel level sockets */
++ struct kvec *iov_data;
++ /* Iovecs for miscellaneous purposes */
++#define ISCSI_MISC_IOVECS 5
++ struct kvec iov_misc[ISCSI_MISC_IOVECS];
++ /* Array of struct iscsi_pdu used for DataPDUInOrder=No */
++ struct iscsi_pdu *pdu_list;
++ /* Current struct iscsi_pdu used for DataPDUInOrder=No */
++ struct iscsi_pdu *pdu_ptr;
++ /* Array of struct iscsi_seq used for DataSequenceInOrder=No */
++ struct iscsi_seq *seq_list;
++ /* Current struct iscsi_seq used for DataSequenceInOrder=No */
++ struct iscsi_seq *seq_ptr;
++ /* TMR Request when iscsi_opcode == ISCSI_OP_SCSI_TMFUNC */
++ struct iscsi_tmr_req *tmr_req;
++ /* Connection this command is alligient to */
++ struct iscsi_conn *conn;
++ /* Pointer to connection recovery entry */
++ struct iscsi_conn_recovery *cr;
++ /* Session the command is part of, used for connection recovery */
++ struct iscsi_session *sess;
++ /* list_head for connection list */
++ struct list_head i_conn_node;
++ /* The TCM I/O descriptor that is accessed via container_of() */
++ struct se_cmd se_cmd;
++ /* Sense buffer that will be mapped into outgoing status */
++#define ISCSI_SENSE_BUFFER_LEN (TRANSPORT_SENSE_BUFFER + 2)
++ unsigned char sense_buffer[ISCSI_SENSE_BUFFER_LEN];
++
++ u32 padding;
++ u8 pad_bytes[4];
++
++ struct scatterlist *first_data_sg;
++ u32 first_data_sg_off;
++ u32 kmapped_nents;
++ sense_reason_t sense_reason;
++} ____cacheline_aligned;
++
++struct iscsi_tmr_req {
++ bool task_reassign:1;
++ u32 exp_data_sn;
++ struct iscsi_cmd *ref_cmd;
++ struct iscsi_conn_recovery *conn_recovery;
++ struct se_tmr_req *se_tmr_req;
++};
++
++struct iscsi_conn {
++ wait_queue_head_t queues_wq;
++ /* Authentication Successful for this connection */
++ u8 auth_complete;
++ /* State connection is currently in */
++ u8 conn_state;
++ u8 conn_logout_reason;
++ u8 network_transport;
++ enum iscsi_timer_flags_table nopin_timer_flags;
++ enum iscsi_timer_flags_table nopin_response_timer_flags;
++ /* Used to know what thread encountered a transport failure */
++ u8 which_thread;
++ /* connection id assigned by the Initiator */
++ u16 cid;
++ /* Remote TCP Port */
++ u16 login_port;
++ u16 local_port;
++ int net_size;
++ int login_family;
++ u32 auth_id;
++ u32 conn_flags;
++ /* Used for iscsi_tx_login_rsp() */
++ itt_t login_itt;
++ u32 exp_statsn;
++ /* Per connection status sequence number */
++ u32 stat_sn;
++ /* IFMarkInt's Current Value */
++ u32 if_marker;
++ /* OFMarkInt's Current Value */
++ u32 of_marker;
++ /* Used for calculating OFMarker offset to next PDU */
++ u32 of_marker_offset;
++#define IPV6_ADDRESS_SPACE 48
++ unsigned char login_ip[IPV6_ADDRESS_SPACE];
++ unsigned char local_ip[IPV6_ADDRESS_SPACE];
++ int conn_usage_count;
++ int conn_waiting_on_uc;
++ atomic_t check_immediate_queue;
++ atomic_t conn_logout_remove;
++ atomic_t connection_exit;
++ atomic_t connection_recovery;
++ atomic_t connection_reinstatement;
++ atomic_t connection_wait_rcfr;
++ atomic_t sleep_on_conn_wait_comp;
++ atomic_t transport_failed;
++ struct completion conn_post_wait_comp;
++ struct completion conn_wait_comp;
++ struct completion conn_wait_rcfr_comp;
++ struct completion conn_waiting_on_uc_comp;
++ struct completion conn_logout_comp;
++ struct completion tx_half_close_comp;
++ struct completion rx_half_close_comp;
++ /* socket used by this connection */
++ struct socket *sock;
++ void (*orig_data_ready)(struct sock *);
++ void (*orig_state_change)(struct sock *);
++#define LOGIN_FLAGS_READ_ACTIVE 1
++#define LOGIN_FLAGS_CLOSED 2
++#define LOGIN_FLAGS_READY 4
++ unsigned long login_flags;
++ struct delayed_work login_work;
++ struct delayed_work login_cleanup_work;
++ struct iscsi_login *login;
++ struct timer_list nopin_timer;
++ struct timer_list nopin_response_timer;
++ struct timer_list transport_timer;
++ struct task_struct *login_kworker;
++ /* Spinlock used for add/deleting cmd's from conn_cmd_list */
++ spinlock_t cmd_lock;
++ spinlock_t conn_usage_lock;
++ spinlock_t immed_queue_lock;
++ spinlock_t nopin_timer_lock;
++ spinlock_t response_queue_lock;
++ spinlock_t state_lock;
++ /* libcrypto RX and TX contexts for crc32c */
++ struct hash_desc conn_rx_hash;
++ struct hash_desc conn_tx_hash;
++ /* Used for scheduling TX and RX connection kthreads */
++ cpumask_var_t conn_cpumask;
++ unsigned int conn_rx_reset_cpumask:1;
++ unsigned int conn_tx_reset_cpumask:1;
++ /* list_head of struct iscsi_cmd for this connection */
++ struct list_head conn_cmd_list;
++ struct list_head immed_queue_list;
++ struct list_head response_queue_list;
++ struct iscsi_conn_ops *conn_ops;
++ struct iscsi_login *conn_login;
++ struct iscsit_transport *conn_transport;
++ struct iscsi_param_list *param_list;
++ /* Used for per connection auth state machine */
++ void *auth_protocol;
++ void *context;
++ struct iscsi_login_thread_s *login_thread;
++ struct iscsi_portal_group *tpg;
++ struct iscsi_tpg_np *tpg_np;
++ /* Pointer to parent session */
++ struct iscsi_session *sess;
++ int bitmap_id;
++ int rx_thread_active;
++ struct task_struct *rx_thread;
++ struct completion rx_login_comp;
++ int tx_thread_active;
++ struct task_struct *tx_thread;
++ /* list_head for session connection list */
++ struct list_head conn_list;
++} ____cacheline_aligned;
++
++struct iscsi_conn_recovery {
++ u16 cid;
++ u32 cmd_count;
++ u32 maxrecvdatasegmentlength;
++ u32 maxxmitdatasegmentlength;
++ int ready_for_reallegiance;
++ struct list_head conn_recovery_cmd_list;
++ spinlock_t conn_recovery_cmd_lock;
++ struct timer_list time2retain_timer;
++ struct iscsi_session *sess;
++ struct list_head cr_list;
++} ____cacheline_aligned;
++
++struct iscsi_session {
++ u8 initiator_vendor;
++ u8 isid[6];
++ enum iscsi_timer_flags_table time2retain_timer_flags;
++ u8 version_active;
++ u16 cid_called;
++ u16 conn_recovery_count;
++ u16 tsih;
++ /* state session is currently in */
++ u32 session_state;
++ /* session wide counter: initiator assigned task tag */
++ itt_t init_task_tag;
++ /* session wide counter: target assigned task tag */
++ u32 targ_xfer_tag;
++ u32 cmdsn_window;
++
++ /* protects cmdsn values */
++ struct mutex cmdsn_mutex;
++ /* session wide counter: expected command sequence number */
++ u32 exp_cmd_sn;
++ /* session wide counter: maximum allowed command sequence number */
++ u32 max_cmd_sn;
++ struct list_head sess_ooo_cmdsn_list;
++
++ /* LIO specific session ID */
++ u32 sid;
++ char auth_type[8];
++ /* unique within the target */
++ int session_index;
++ /* Used for session reference counting */
++ int session_usage_count;
++ int session_waiting_on_uc;
++ atomic_long_t cmd_pdus;
++ atomic_long_t rsp_pdus;
++ atomic_long_t tx_data_octets;
++ atomic_long_t rx_data_octets;
++ atomic_long_t conn_digest_errors;
++ atomic_long_t conn_timeout_errors;
++ u64 creation_time;
++ /* Number of active connections */
++ atomic_t nconn;
++ atomic_t session_continuation;
++ atomic_t session_fall_back_to_erl0;
++ atomic_t session_logout;
++ atomic_t session_reinstatement;
++ atomic_t session_stop_active;
++ atomic_t sleep_on_sess_wait_comp;
++ /* connection list */
++ struct list_head sess_conn_list;
++ struct list_head cr_active_list;
++ struct list_head cr_inactive_list;
++ spinlock_t conn_lock;
++ spinlock_t cr_a_lock;
++ spinlock_t cr_i_lock;
++ spinlock_t session_usage_lock;
++ spinlock_t ttt_lock;
++ struct completion async_msg_comp;
++ struct completion reinstatement_comp;
++ struct completion session_wait_comp;
++ struct completion session_waiting_on_uc_comp;
++ struct timer_list time2retain_timer;
++ struct iscsi_sess_ops *sess_ops;
++ struct se_session *se_sess;
++ struct iscsi_portal_group *tpg;
++} ____cacheline_aligned;
++
++struct iscsi_login {
++ u8 auth_complete;
++ u8 checked_for_existing;
++ u8 current_stage;
++ u8 leading_connection;
++ u8 first_request;
++ u8 version_min;
++ u8 version_max;
++ u8 login_complete;
++ u8 login_failed;
++ bool zero_tsih;
++ char isid[6];
++ u32 cmd_sn;
++ itt_t init_task_tag;
++ u32 initial_exp_statsn;
++ u32 rsp_length;
++ u16 cid;
++ u16 tsih;
++ char req[ISCSI_HDR_LEN];
++ char rsp[ISCSI_HDR_LEN];
++ char *req_buf;
++ char *rsp_buf;
++ struct iscsi_conn *conn;
++ struct iscsi_np *np;
++} ____cacheline_aligned;
++
++struct iscsi_node_attrib {
++ u32 dataout_timeout;
++ u32 dataout_timeout_retries;
++ u32 default_erl;
++ u32 nopin_timeout;
++ u32 nopin_response_timeout;
++ u32 random_datain_pdu_offsets;
++ u32 random_datain_seq_offsets;
++ u32 random_r2t_offsets;
++ u32 tmr_cold_reset;
++ u32 tmr_warm_reset;
++ struct iscsi_node_acl *nacl;
++};
++
++struct se_dev_entry_s;
++
++struct iscsi_node_auth {
++ enum naf_flags_table naf_flags;
++ int authenticate_target;
++ /* Used for iscsit_global->discovery_auth,
++ * set to zero (auth disabled) by default */
++ int enforce_discovery_auth;
++#define MAX_USER_LEN 256
++#define MAX_PASS_LEN 256
++ char userid[MAX_USER_LEN];
++ char password[MAX_PASS_LEN];
++ char userid_mutual[MAX_USER_LEN];
++ char password_mutual[MAX_PASS_LEN];
++};
++
++#include "iscsi_target_stat.h"
++
++struct iscsi_node_stat_grps {
++ struct config_group iscsi_sess_stats_group;
++ struct config_group iscsi_conn_stats_group;
++};
++
++struct iscsi_node_acl {
++ struct iscsi_node_attrib node_attrib;
++ struct iscsi_node_auth node_auth;
++ struct iscsi_node_stat_grps node_stat_grps;
++ struct se_node_acl se_node_acl;
++};
++
++struct iscsi_tpg_attrib {
++ u32 authentication;
++ u32 login_timeout;
++ u32 netif_timeout;
++ u32 generate_node_acls;
++ u32 cache_dynamic_acls;
++ u32 default_cmdsn_depth;
++ u32 demo_mode_write_protect;
++ u32 prod_mode_write_protect;
++ u32 demo_mode_discovery;
++ u32 default_erl;
++ u8 t10_pi;
++ u32 fabric_prot_type;
++ struct iscsi_portal_group *tpg;
++};
++
++struct iscsi_np {
++ int np_network_transport;
++ int np_ip_proto;
++ int np_sock_type;
++ enum np_thread_state_table np_thread_state;
++ bool enabled;
++ enum iscsi_timer_flags_table np_login_timer_flags;
++ u32 np_exports;
++ enum np_flags_table np_flags;
++ u16 np_port;
++ spinlock_t np_thread_lock;
++ struct completion np_restart_comp;
++ struct socket *np_socket;
++ struct __kernel_sockaddr_storage np_sockaddr;
++ struct task_struct *np_thread;
++ struct timer_list np_login_timer;
++ void *np_context;
++ struct iscsit_transport *np_transport;
++ struct list_head np_list;
++} ____cacheline_aligned;
++
++struct iscsi_tpg_np {
++ struct iscsi_np *tpg_np;
++ struct iscsi_portal_group *tpg;
++ struct iscsi_tpg_np *tpg_np_parent;
++ struct list_head tpg_np_list;
++ struct list_head tpg_np_child_list;
++ struct list_head tpg_np_parent_list;
++ struct se_tpg_np se_tpg_np;
++ spinlock_t tpg_np_parent_lock;
++ struct completion tpg_np_comp;
++ struct kref tpg_np_kref;
++};
++
++struct iscsi_portal_group {
++ unsigned char tpg_chap_id;
++ /* TPG State */
++ enum tpg_state_table tpg_state;
++ /* Target Portal Group Tag */
++ u16 tpgt;
++ /* Id assigned to target sessions */
++ u16 ntsih;
++ /* Number of active sessions */
++ u32 nsessions;
++ /* Number of Network Portals available for this TPG */
++ u32 num_tpg_nps;
++ /* Per TPG LIO specific session ID. */
++ u32 sid;
++ /* Spinlock for adding/removing Network Portals */
++ spinlock_t tpg_np_lock;
++ spinlock_t tpg_state_lock;
++ struct se_portal_group tpg_se_tpg;
++ struct mutex tpg_access_lock;
++ struct semaphore np_login_sem;
++ struct iscsi_tpg_attrib tpg_attrib;
++ struct iscsi_node_auth tpg_demo_auth;
++ /* Pointer to default list of iSCSI parameters for TPG */
++ struct iscsi_param_list *param_list;
++ struct iscsi_tiqn *tpg_tiqn;
++ struct list_head tpg_gnp_list;
++ struct list_head tpg_list;
++} ____cacheline_aligned;
++
++struct iscsi_wwn_stat_grps {
++ struct config_group iscsi_stat_group;
++ struct config_group iscsi_instance_group;
++ struct config_group iscsi_sess_err_group;
++ struct config_group iscsi_tgt_attr_group;
++ struct config_group iscsi_login_stats_group;
++ struct config_group iscsi_logout_stats_group;
++};
++
++struct iscsi_tiqn {
++#define ISCSI_IQN_LEN 224
++ unsigned char tiqn[ISCSI_IQN_LEN];
++ enum tiqn_state_table tiqn_state;
++ int tiqn_access_count;
++ u32 tiqn_active_tpgs;
++ u32 tiqn_ntpgs;
++ u32 tiqn_num_tpg_nps;
++ u32 tiqn_nsessions;
++ struct list_head tiqn_list;
++ struct list_head tiqn_tpg_list;
++ spinlock_t tiqn_state_lock;
++ spinlock_t tiqn_tpg_lock;
++ struct se_wwn tiqn_wwn;
++ struct iscsi_wwn_stat_grps tiqn_stat_grps;
++ int tiqn_index;
++ struct iscsi_sess_err_stats sess_err_stats;
++ struct iscsi_login_stats login_stats;
++ struct iscsi_logout_stats logout_stats;
++} ____cacheline_aligned;
++
++struct iscsit_global {
++ /* In core shutdown */
++ u32 in_shutdown;
++ u32 active_ts;
++ /* Unique identifier used for the authentication daemon */
++ u32 auth_id;
++ u32 inactive_ts;
++#define ISCSIT_BITMAP_BITS 262144
++ /* Thread Set bitmap pointer */
++ unsigned long *ts_bitmap;
++ spinlock_t ts_bitmap_lock;
++ /* Used for iSCSI discovery session authentication */
++ struct iscsi_node_acl discovery_acl;
++ struct iscsi_portal_group *discovery_tpg;
++};
++
++static inline u32 session_get_next_ttt(struct iscsi_session *session)
++{
++ u32 ttt;
++
++ spin_lock_bh(&session->ttt_lock);
++ ttt = session->targ_xfer_tag++;
++ if (ttt == 0xFFFFFFFF)
++ ttt = session->targ_xfer_tag++;
++ spin_unlock_bh(&session->ttt_lock);
++
++ return ttt;
++}
++
++extern struct iscsi_cmd *iscsit_find_cmd_from_itt(struct iscsi_conn *, itt_t);
++#endif /* ISCSI_TARGET_CORE_H */
+diff --git a/include/uapi/linux/if_link.h b/include/uapi/linux/if_link.h
+index 0bdb77e16875..fe017d125839 100644
+--- a/include/uapi/linux/if_link.h
++++ b/include/uapi/linux/if_link.h
+@@ -436,6 +436,9 @@ enum {
+ IFLA_VF_SPOOFCHK, /* Spoof Checking on/off switch */
+ IFLA_VF_LINK_STATE, /* link state enable/disable/auto switch */
+ IFLA_VF_RATE, /* Min and Max TX Bandwidth Allocation */
++ IFLA_VF_RSS_QUERY_EN, /* RSS Redirection Table and Hash Key query
++ * on/off switch
++ */
+ __IFLA_VF_MAX,
+ };
+
+@@ -480,6 +483,11 @@ struct ifla_vf_link_state {
+ __u32 link_state;
+ };
+
++struct ifla_vf_rss_query_en {
++ __u32 vf;
++ __u32 setting;
++};
++
+ /* VF ports management section
+ *
+ * Nested layout of set/get msg is:
+diff --git a/include/xen/interface/sched.h b/include/xen/interface/sched.h
+index 9ce083960a25..f18490985fc8 100644
+--- a/include/xen/interface/sched.h
++++ b/include/xen/interface/sched.h
+@@ -107,5 +107,13 @@ struct sched_watchdog {
+ #define SHUTDOWN_suspend 2 /* Clean up, save suspend info, kill. */
+ #define SHUTDOWN_crash 3 /* Tell controller we've crashed. */
+ #define SHUTDOWN_watchdog 4 /* Restart because watchdog time expired. */
++/*
++ * Domain asked to perform 'soft reset' for it. The expected behavior is to
++ * reset internal Xen state for the domain returning it to the point where it
++ * was created but leaving the domain's memory contents and vCPU contexts
++ * intact. This will allow the domain to start over and set up all Xen specific
++ * interfaces again.
++ */
++#define SHUTDOWN_soft_reset 5
+
+ #endif /* __XEN_PUBLIC_SCHED_H__ */
+diff --git a/ipc/msg.c b/ipc/msg.c
+index c5d8e3749985..cfc8b388332d 100644
+--- a/ipc/msg.c
++++ b/ipc/msg.c
+@@ -137,13 +137,6 @@ static int newque(struct ipc_namespace *ns, struct ipc_params *params)
+ return retval;
+ }
+
+- /* ipc_addid() locks msq upon success. */
+- id = ipc_addid(&msg_ids(ns), &msq->q_perm, ns->msg_ctlmni);
+- if (id < 0) {
+- ipc_rcu_putref(msq, msg_rcu_free);
+- return id;
+- }
+-
+ msq->q_stime = msq->q_rtime = 0;
+ msq->q_ctime = get_seconds();
+ msq->q_cbytes = msq->q_qnum = 0;
+@@ -153,6 +146,13 @@ static int newque(struct ipc_namespace *ns, struct ipc_params *params)
+ INIT_LIST_HEAD(&msq->q_receivers);
+ INIT_LIST_HEAD(&msq->q_senders);
+
++ /* ipc_addid() locks msq upon success. */
++ id = ipc_addid(&msg_ids(ns), &msq->q_perm, ns->msg_ctlmni);
++ if (id < 0) {
++ ipc_rcu_putref(msq, msg_rcu_free);
++ return id;
++ }
++
+ ipc_unlock_object(&msq->q_perm);
+ rcu_read_unlock();
+
+diff --git a/ipc/shm.c b/ipc/shm.c
+index 01454796ba3c..2511771a9a07 100644
+--- a/ipc/shm.c
++++ b/ipc/shm.c
+@@ -549,12 +549,6 @@ static int newseg(struct ipc_namespace *ns, struct ipc_params *params)
+ if (IS_ERR(file))
+ goto no_file;
+
+- id = ipc_addid(&shm_ids(ns), &shp->shm_perm, ns->shm_ctlmni);
+- if (id < 0) {
+- error = id;
+- goto no_id;
+- }
+-
+ shp->shm_cprid = task_tgid_vnr(current);
+ shp->shm_lprid = 0;
+ shp->shm_atim = shp->shm_dtim = 0;
+@@ -563,6 +557,13 @@ static int newseg(struct ipc_namespace *ns, struct ipc_params *params)
+ shp->shm_nattch = 0;
+ shp->shm_file = file;
+ shp->shm_creator = current;
++
++ id = ipc_addid(&shm_ids(ns), &shp->shm_perm, ns->shm_ctlmni);
++ if (id < 0) {
++ error = id;
++ goto no_id;
++ }
++
+ list_add(&shp->shm_clist, ¤t->sysvshm.shm_clist);
+
+ /*
+diff --git a/ipc/util.c b/ipc/util.c
+index 88adc329888c..bc72cbf929da 100644
+--- a/ipc/util.c
++++ b/ipc/util.c
+@@ -277,6 +277,10 @@ int ipc_addid(struct ipc_ids *ids, struct kern_ipc_perm *new, int size)
+ rcu_read_lock();
+ spin_lock(&new->lock);
+
++ current_euid_egid(&euid, &egid);
++ new->cuid = new->uid = euid;
++ new->gid = new->cgid = egid;
++
+ id = idr_alloc(&ids->ipcs_idr, new,
+ (next_id < 0) ? 0 : ipcid_to_idx(next_id), 0,
+ GFP_NOWAIT);
+@@ -289,10 +293,6 @@ int ipc_addid(struct ipc_ids *ids, struct kern_ipc_perm *new, int size)
+
+ ids->in_use++;
+
+- current_euid_egid(&euid, &egid);
+- new->cuid = new->uid = euid;
+- new->gid = new->cgid = egid;
+-
+ if (next_id < 0) {
+ new->seq = ids->seq++;
+ if (ids->seq > IPCID_SEQ_MAX)
+diff --git a/kernel/fork.c b/kernel/fork.c
+index 9b7d746d6d62..0a4f601e35ab 100644
+--- a/kernel/fork.c
++++ b/kernel/fork.c
+@@ -1800,13 +1800,21 @@ static int check_unshare_flags(unsigned long unshare_flags)
+ CLONE_NEWUSER|CLONE_NEWPID))
+ return -EINVAL;
+ /*
+- * Not implemented, but pretend it works if there is nothing to
+- * unshare. Note that unsharing CLONE_THREAD or CLONE_SIGHAND
+- * needs to unshare vm.
++ * Not implemented, but pretend it works if there is nothing
++ * to unshare. Note that unsharing the address space or the
++ * signal handlers also need to unshare the signal queues (aka
++ * CLONE_THREAD).
+ */
+ if (unshare_flags & (CLONE_THREAD | CLONE_SIGHAND | CLONE_VM)) {
+- /* FIXME: get_task_mm() increments ->mm_users */
+- if (atomic_read(¤t->mm->mm_users) > 1)
++ if (!thread_group_empty(current))
++ return -EINVAL;
++ }
++ if (unshare_flags & (CLONE_SIGHAND | CLONE_VM)) {
++ if (atomic_read(¤t->sighand->count) > 1)
++ return -EINVAL;
++ }
++ if (unshare_flags & CLONE_VM) {
++ if (!current_is_single_threaded())
+ return -EINVAL;
+ }
+
+@@ -1875,16 +1883,16 @@ SYSCALL_DEFINE1(unshare, unsigned long, unshare_flags)
+ if (unshare_flags & CLONE_NEWUSER)
+ unshare_flags |= CLONE_THREAD | CLONE_FS;
+ /*
+- * If unsharing a thread from a thread group, must also unshare vm.
+- */
+- if (unshare_flags & CLONE_THREAD)
+- unshare_flags |= CLONE_VM;
+- /*
+ * If unsharing vm, must also unshare signal handlers.
+ */
+ if (unshare_flags & CLONE_VM)
+ unshare_flags |= CLONE_SIGHAND;
+ /*
++ * If unsharing a signal handlers, must also unshare the signal queues.
++ */
++ if (unshare_flags & CLONE_SIGHAND)
++ unshare_flags |= CLONE_THREAD;
++ /*
+ * If unsharing namespace, must also unshare filesystem information.
+ */
+ if (unshare_flags & CLONE_NEWNS)
+diff --git a/kernel/irq/proc.c b/kernel/irq/proc.c
+index 9dc9bfd8a678..9791f93dd5f2 100644
+--- a/kernel/irq/proc.c
++++ b/kernel/irq/proc.c
+@@ -12,6 +12,7 @@
+ #include <linux/seq_file.h>
+ #include <linux/interrupt.h>
+ #include <linux/kernel_stat.h>
++#include <linux/mutex.h>
+
+ #include "internals.h"
+
+@@ -326,18 +327,29 @@ void register_handler_proc(unsigned int irq, struct irqaction *action)
+
+ void register_irq_proc(unsigned int irq, struct irq_desc *desc)
+ {
++ static DEFINE_MUTEX(register_lock);
+ char name [MAX_NAMELEN];
+
+- if (!root_irq_dir || (desc->irq_data.chip == &no_irq_chip) || desc->dir)
++ if (!root_irq_dir || (desc->irq_data.chip == &no_irq_chip))
+ return;
+
++ /*
++ * irq directories are registered only when a handler is
++ * added, not when the descriptor is created, so multiple
++ * tasks might try to register at the same time.
++ */
++ mutex_lock(®ister_lock);
++
++ if (desc->dir)
++ goto out_unlock;
++
+ memset(name, 0, MAX_NAMELEN);
+ sprintf(name, "%d", irq);
+
+ /* create /proc/irq/1234 */
+ desc->dir = proc_mkdir(name, root_irq_dir);
+ if (!desc->dir)
+- return;
++ goto out_unlock;
+
+ #ifdef CONFIG_SMP
+ /* create /proc/irq/<irq>/smp_affinity */
+@@ -358,6 +370,9 @@ void register_irq_proc(unsigned int irq, struct irq_desc *desc)
+
+ proc_create_data("spurious", 0444, desc->dir,
+ &irq_spurious_proc_fops, (void *)(long)irq);
++
++out_unlock:
++ mutex_unlock(®ister_lock);
+ }
+
+ void unregister_irq_proc(unsigned int irq, struct irq_desc *desc)
+diff --git a/kernel/sched/core.c b/kernel/sched/core.c
+index 6810e572eda5..a882dd91722d 100644
+--- a/kernel/sched/core.c
++++ b/kernel/sched/core.c
+@@ -2256,11 +2256,11 @@ static void finish_task_switch(struct rq *rq, struct task_struct *prev)
+ * If a task dies, then it sets TASK_DEAD in tsk->state and calls
+ * schedule one last time. The schedule call will never return, and
+ * the scheduled task must drop that reference.
+- * The test for TASK_DEAD must occur while the runqueue locks are
+- * still held, otherwise prev could be scheduled on another cpu, die
+- * there before we look at prev->state, and then the reference would
+- * be dropped twice.
+- * Manfred Spraul <manfred@colorfullife.com>
++ *
++ * We must observe prev->state before clearing prev->on_cpu (in
++ * finish_lock_switch), otherwise a concurrent wakeup can get prev
++ * running on another CPU and we could rave with its RUNNING -> DEAD
++ * transition, resulting in a double drop.
+ */
+ prev_state = prev->state;
+ vtime_task_switch(prev);
+@@ -2404,13 +2404,20 @@ unsigned long nr_running(void)
+
+ /*
+ * Check if only the current task is running on the cpu.
++ *
++ * Caution: this function does not check that the caller has disabled
++ * preemption, thus the result might have a time-of-check-to-time-of-use
++ * race. The caller is responsible to use it correctly, for example:
++ *
++ * - from a non-preemptable section (of course)
++ *
++ * - from a thread that is bound to a single CPU
++ *
++ * - in a loop with very short iterations (e.g. a polling loop)
+ */
+ bool single_task_running(void)
+ {
+- if (cpu_rq(smp_processor_id())->nr_running == 1)
+- return true;
+- else
+- return false;
++ return raw_rq()->nr_running == 1;
+ }
+ EXPORT_SYMBOL(single_task_running);
+
+diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
+index 2246a36050f9..07a75c150eeb 100644
+--- a/kernel/sched/fair.c
++++ b/kernel/sched/fair.c
+@@ -4844,18 +4844,21 @@ again:
+ * entity, update_curr() will update its vruntime, otherwise
+ * forget we've ever seen it.
+ */
+- if (curr && curr->on_rq)
+- update_curr(cfs_rq);
+- else
+- curr = NULL;
++ if (curr) {
++ if (curr->on_rq)
++ update_curr(cfs_rq);
++ else
++ curr = NULL;
+
+- /*
+- * This call to check_cfs_rq_runtime() will do the throttle and
+- * dequeue its entity in the parent(s). Therefore the 'simple'
+- * nr_running test will indeed be correct.
+- */
+- if (unlikely(check_cfs_rq_runtime(cfs_rq)))
+- goto simple;
++ /*
++ * This call to check_cfs_rq_runtime() will do the
++ * throttle and dequeue its entity in the parent(s).
++ * Therefore the 'simple' nr_running test will indeed
++ * be correct.
++ */
++ if (unlikely(check_cfs_rq_runtime(cfs_rq)))
++ goto simple;
++ }
+
+ se = pick_next_entity(cfs_rq, curr);
+ cfs_rq = group_cfs_rq(se);
+diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h
+index 2df8ef067cc5..f698089e10ca 100644
+--- a/kernel/sched/sched.h
++++ b/kernel/sched/sched.h
+@@ -994,9 +994,10 @@ static inline void finish_lock_switch(struct rq *rq, struct task_struct *prev)
+ * After ->on_cpu is cleared, the task can be moved to a different CPU.
+ * We must ensure this doesn't happen until the switch is completely
+ * finished.
++ *
++ * Pairs with the control dependency and rmb in try_to_wake_up().
+ */
+- smp_wmb();
+- prev->on_cpu = 0;
++ smp_store_release(&prev->on_cpu, 0);
+ #endif
+ #ifdef CONFIG_DEBUG_SPINLOCK
+ /* this is a valid case when another task releases the spinlock */
+diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
+index ec1791fae965..a4038c57e25d 100644
+--- a/kernel/time/timekeeping.c
++++ b/kernel/time/timekeeping.c
+@@ -1369,7 +1369,7 @@ static __always_inline void timekeeping_freqadjust(struct timekeeper *tk,
+ negative = (tick_error < 0);
+
+ /* Sort out the magnitude of the correction */
+- tick_error = abs(tick_error);
++ tick_error = abs64(tick_error);
+ for (adj = 0; tick_error > interval; adj++)
+ tick_error >>= 1;
+
+diff --git a/mm/hugetlb.c b/mm/hugetlb.c
+index a1d4dfa62023..77c8d03b4278 100644
+--- a/mm/hugetlb.c
++++ b/mm/hugetlb.c
+@@ -2806,6 +2806,14 @@ static void unmap_ref_private(struct mm_struct *mm, struct vm_area_struct *vma,
+ continue;
+
+ /*
++ * Shared VMAs have their own reserves and do not affect
++ * MAP_PRIVATE accounting but it is possible that a shared
++ * VMA is using the same page so check and skip such VMAs.
++ */
++ if (iter_vma->vm_flags & VM_MAYSHARE)
++ continue;
++
++ /*
+ * Unmap the page from other VMAs without their own reserves.
+ * They get marked to be SIGKILLed if they fault in these
+ * areas. This is because a future no-page fault on this VMA
+diff --git a/mm/slab.c b/mm/slab.c
+index f34e053ec46e..b7f9f6456a61 100644
+--- a/mm/slab.c
++++ b/mm/slab.c
+@@ -2175,9 +2175,16 @@ __kmem_cache_create (struct kmem_cache *cachep, unsigned long flags)
+ size += BYTES_PER_WORD;
+ }
+ #if FORCED_DEBUG && defined(CONFIG_DEBUG_PAGEALLOC)
+- if (size >= kmalloc_size(INDEX_NODE + 1)
+- && cachep->object_size > cache_line_size()
+- && ALIGN(size, cachep->align) < PAGE_SIZE) {
++ /*
++ * To activate debug pagealloc, off-slab management is necessary
++ * requirement. In early phase of initialization, small sized slab
++ * doesn't get initialized so it would not be possible. So, we need
++ * to check size >= 256. It guarantees that all necessary small
++ * sized slab is initialized in current slab initialization sequence.
++ */
++ if (!slab_early_init && size >= kmalloc_size(INDEX_NODE) &&
++ size >= 256 && cachep->object_size > cache_line_size() &&
++ ALIGN(size, cachep->align) < PAGE_SIZE) {
+ cachep->obj_offset += PAGE_SIZE - ALIGN(size, cachep->align);
+ size = PAGE_SIZE;
+ }
+diff --git a/mm/vmscan.c b/mm/vmscan.c
+index e321fe20b979..d48b28219edf 100644
+--- a/mm/vmscan.c
++++ b/mm/vmscan.c
+@@ -1111,7 +1111,7 @@ cull_mlocked:
+ if (PageSwapCache(page))
+ try_to_free_swap(page);
+ unlock_page(page);
+- putback_lru_page(page);
++ list_add(&page->lru, &ret_pages);
+ continue;
+
+ activate_locked:
+diff --git a/net/batman-adv/distributed-arp-table.c b/net/batman-adv/distributed-arp-table.c
+index b5981113c9a7..4bbd72e90756 100644
+--- a/net/batman-adv/distributed-arp-table.c
++++ b/net/batman-adv/distributed-arp-table.c
+@@ -15,6 +15,7 @@
+ * along with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+
++#include <linux/bitops.h>
+ #include <linux/if_ether.h>
+ #include <linux/if_arp.h>
+ #include <linux/if_vlan.h>
+@@ -422,7 +423,7 @@ static bool batadv_is_orig_node_eligible(struct batadv_dat_candidate *res,
+ int j;
+
+ /* check if orig node candidate is running DAT */
+- if (!(candidate->capabilities & BATADV_ORIG_CAPA_HAS_DAT))
++ if (!test_bit(BATADV_ORIG_CAPA_HAS_DAT, &candidate->capabilities))
+ goto out;
+
+ /* Check if this node has already been selected... */
+@@ -682,9 +683,9 @@ static void batadv_dat_tvlv_ogm_handler_v1(struct batadv_priv *bat_priv,
+ uint16_t tvlv_value_len)
+ {
+ if (flags & BATADV_TVLV_HANDLER_OGM_CIFNOTFND)
+- orig->capabilities &= ~BATADV_ORIG_CAPA_HAS_DAT;
++ clear_bit(BATADV_ORIG_CAPA_HAS_DAT, &orig->capabilities);
+ else
+- orig->capabilities |= BATADV_ORIG_CAPA_HAS_DAT;
++ set_bit(BATADV_ORIG_CAPA_HAS_DAT, &orig->capabilities);
+ }
+
+ /**
+diff --git a/net/batman-adv/network-coding.c b/net/batman-adv/network-coding.c
+index 8d04d174669e..65d19690d8ae 100644
+--- a/net/batman-adv/network-coding.c
++++ b/net/batman-adv/network-coding.c
+@@ -15,6 +15,7 @@
+ * along with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+
++#include <linux/bitops.h>
+ #include <linux/debugfs.h>
+
+ #include "main.h"
+@@ -105,9 +106,9 @@ static void batadv_nc_tvlv_ogm_handler_v1(struct batadv_priv *bat_priv,
+ uint16_t tvlv_value_len)
+ {
+ if (flags & BATADV_TVLV_HANDLER_OGM_CIFNOTFND)
+- orig->capabilities &= ~BATADV_ORIG_CAPA_HAS_NC;
++ clear_bit(BATADV_ORIG_CAPA_HAS_NC, &orig->capabilities);
+ else
+- orig->capabilities |= BATADV_ORIG_CAPA_HAS_NC;
++ set_bit(BATADV_ORIG_CAPA_HAS_NC, &orig->capabilities);
+ }
+
+ /**
+@@ -871,7 +872,7 @@ void batadv_nc_update_nc_node(struct batadv_priv *bat_priv,
+ goto out;
+
+ /* check if orig node is network coding enabled */
+- if (!(orig_node->capabilities & BATADV_ORIG_CAPA_HAS_NC))
++ if (!test_bit(BATADV_ORIG_CAPA_HAS_NC, &orig_node->capabilities))
+ goto out;
+
+ /* accept ogms from 'good' neighbors and single hop neighbors */
+diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c
+index 5467955eb27c..492b0593dc2f 100644
+--- a/net/batman-adv/soft-interface.c
++++ b/net/batman-adv/soft-interface.c
+@@ -173,6 +173,7 @@ static int batadv_interface_tx(struct sk_buff *skb,
+ int gw_mode;
+ enum batadv_forw_mode forw_mode;
+ struct batadv_orig_node *mcast_single_orig = NULL;
++ int network_offset = ETH_HLEN;
+
+ if (atomic_read(&bat_priv->mesh_state) != BATADV_MESH_ACTIVE)
+ goto dropped;
+@@ -185,14 +186,18 @@ static int batadv_interface_tx(struct sk_buff *skb,
+ case ETH_P_8021Q:
+ vhdr = vlan_eth_hdr(skb);
+
+- if (vhdr->h_vlan_encapsulated_proto != ethertype)
++ if (vhdr->h_vlan_encapsulated_proto != ethertype) {
++ network_offset += VLAN_HLEN;
+ break;
++ }
+
+ /* fall through */
+ case ETH_P_BATMAN:
+ goto dropped;
+ }
+
++ skb_set_network_header(skb, network_offset);
++
+ if (batadv_bla_tx(bat_priv, skb, vid))
+ goto dropped;
+
+diff --git a/net/batman-adv/translation-table.c b/net/batman-adv/translation-table.c
+index 5f59e7f899a0..58ad6ba429b3 100644
+--- a/net/batman-adv/translation-table.c
++++ b/net/batman-adv/translation-table.c
+@@ -15,6 +15,7 @@
+ * along with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+
++#include <linux/bitops.h>
+ #include "main.h"
+ #include "translation-table.h"
+ #include "soft-interface.h"
+@@ -1015,6 +1016,7 @@ uint16_t batadv_tt_local_remove(struct batadv_priv *bat_priv,
+ struct batadv_tt_local_entry *tt_local_entry;
+ uint16_t flags, curr_flags = BATADV_NO_FLAGS;
+ struct batadv_softif_vlan *vlan;
++ void *tt_entry_exists;
+
+ tt_local_entry = batadv_tt_local_hash_find(bat_priv, addr, vid);
+ if (!tt_local_entry)
+@@ -1042,7 +1044,15 @@ uint16_t batadv_tt_local_remove(struct batadv_priv *bat_priv,
+ * immediately purge it
+ */
+ batadv_tt_local_event(bat_priv, tt_local_entry, BATADV_TT_CLIENT_DEL);
+- hlist_del_rcu(&tt_local_entry->common.hash_entry);
++
++ tt_entry_exists = batadv_hash_remove(bat_priv->tt.local_hash,
++ batadv_compare_tt,
++ batadv_choose_tt,
++ &tt_local_entry->common);
++ if (!tt_entry_exists)
++ goto out;
++
++ /* extra call to free the local tt entry */
+ batadv_tt_local_entry_free_ref(tt_local_entry);
+
+ /* decrease the reference held for this vlan */
+@@ -1844,7 +1854,7 @@ void batadv_tt_global_del_orig(struct batadv_priv *bat_priv,
+ }
+ spin_unlock_bh(list_lock);
+ }
+- orig_node->capa_initialized &= ~BATADV_ORIG_CAPA_HAS_TT;
++ clear_bit(BATADV_ORIG_CAPA_HAS_TT, &orig_node->capa_initialized);
+ }
+
+ static bool batadv_tt_global_to_purge(struct batadv_tt_global_entry *tt_global,
+@@ -2804,7 +2814,7 @@ static void _batadv_tt_update_changes(struct batadv_priv *bat_priv,
+ return;
+ }
+ }
+- orig_node->capa_initialized |= BATADV_ORIG_CAPA_HAS_TT;
++ set_bit(BATADV_ORIG_CAPA_HAS_TT, &orig_node->capa_initialized);
+ }
+
+ static void batadv_tt_fill_gtable(struct batadv_priv *bat_priv,
+@@ -3304,7 +3314,8 @@ static void batadv_tt_update_orig(struct batadv_priv *bat_priv,
+ bool has_tt_init;
+
+ tt_vlan = (struct batadv_tvlv_tt_vlan_data *)tt_buff;
+- has_tt_init = orig_node->capa_initialized & BATADV_ORIG_CAPA_HAS_TT;
++ has_tt_init = test_bit(BATADV_ORIG_CAPA_HAS_TT,
++ &orig_node->capa_initialized);
+
+ /* orig table not initialised AND first diff is in the OGM OR the ttvn
+ * increased by one -> we can apply the attached changes
+diff --git a/net/batman-adv/types.h b/net/batman-adv/types.h
+index 8854c05622a9..fdf65b50e3ec 100644
+--- a/net/batman-adv/types.h
++++ b/net/batman-adv/types.h
+@@ -258,8 +258,8 @@ struct batadv_orig_node {
+ struct hlist_node mcast_want_all_ipv4_node;
+ struct hlist_node mcast_want_all_ipv6_node;
+ #endif
+- uint8_t capabilities;
+- uint8_t capa_initialized;
++ unsigned long capabilities;
++ unsigned long capa_initialized;
+ atomic_t last_ttvn;
+ unsigned char *tt_buff;
+ int16_t tt_buff_len;
+@@ -298,9 +298,9 @@ struct batadv_orig_node {
+ * (= orig node announces a tvlv of type BATADV_TVLV_MCAST)
+ */
+ enum batadv_orig_capabilities {
+- BATADV_ORIG_CAPA_HAS_DAT = BIT(0),
+- BATADV_ORIG_CAPA_HAS_NC = BIT(1),
+- BATADV_ORIG_CAPA_HAS_TT = BIT(2),
++ BATADV_ORIG_CAPA_HAS_DAT,
++ BATADV_ORIG_CAPA_HAS_NC,
++ BATADV_ORIG_CAPA_HAS_TT,
+ BATADV_ORIG_CAPA_HAS_MCAST = BIT(3),
+ };
+
+diff --git a/net/core/datagram.c b/net/core/datagram.c
+index 3a402a7b20e9..61e99f315ed9 100644
+--- a/net/core/datagram.c
++++ b/net/core/datagram.c
+@@ -130,6 +130,35 @@ out_noerr:
+ goto out;
+ }
+
++static int skb_set_peeked(struct sk_buff *skb)
++{
++ struct sk_buff *nskb;
++
++ if (skb->peeked)
++ return 0;
++
++ /* We have to unshare an skb before modifying it. */
++ if (!skb_shared(skb))
++ goto done;
++
++ nskb = skb_clone(skb, GFP_ATOMIC);
++ if (!nskb)
++ return -ENOMEM;
++
++ skb->prev->next = nskb;
++ skb->next->prev = nskb;
++ nskb->prev = skb->prev;
++ nskb->next = skb->next;
++
++ consume_skb(skb);
++ skb = nskb;
++
++done:
++ skb->peeked = 1;
++
++ return 0;
++}
++
+ /**
+ * __skb_recv_datagram - Receive a datagram skbuff
+ * @sk: socket
+@@ -164,7 +193,9 @@ out_noerr:
+ struct sk_buff *__skb_recv_datagram(struct sock *sk, unsigned int flags,
+ int *peeked, int *off, int *err)
+ {
++ struct sk_buff_head *queue = &sk->sk_receive_queue;
+ struct sk_buff *skb, *last;
++ unsigned long cpu_flags;
+ long timeo;
+ /*
+ * Caller is allowed not to check sk->sk_err before skb_recv_datagram()
+@@ -183,8 +214,6 @@ struct sk_buff *__skb_recv_datagram(struct sock *sk, unsigned int flags,
+ * Look at current nfs client by the way...
+ * However, this function was correct in any case. 8)
+ */
+- unsigned long cpu_flags;
+- struct sk_buff_head *queue = &sk->sk_receive_queue;
+ int _off = *off;
+
+ last = (struct sk_buff *)queue;
+@@ -198,7 +227,11 @@ struct sk_buff *__skb_recv_datagram(struct sock *sk, unsigned int flags,
+ _off -= skb->len;
+ continue;
+ }
+- skb->peeked = 1;
++
++ error = skb_set_peeked(skb);
++ if (error)
++ goto unlock_err;
++
+ atomic_inc(&skb->users);
+ } else
+ __skb_unlink(skb, queue);
+@@ -222,6 +255,8 @@ struct sk_buff *__skb_recv_datagram(struct sock *sk, unsigned int flags,
+
+ return NULL;
+
++unlock_err:
++ spin_unlock_irqrestore(&queue->lock, cpu_flags);
+ no_packet:
+ *err = error;
+ return NULL;
+diff --git a/net/core/fib_rules.c b/net/core/fib_rules.c
+index 185c341fafbd..99ae718b79be 100644
+--- a/net/core/fib_rules.c
++++ b/net/core/fib_rules.c
+@@ -621,15 +621,17 @@ static int dump_rules(struct sk_buff *skb, struct netlink_callback *cb,
+ {
+ int idx = 0;
+ struct fib_rule *rule;
++ int err = 0;
+
+ rcu_read_lock();
+ list_for_each_entry_rcu(rule, &ops->rules_list, list) {
+ if (idx < cb->args[1])
+ goto skip;
+
+- if (fib_nl_fill_rule(skb, rule, NETLINK_CB(cb->skb).portid,
+- cb->nlh->nlmsg_seq, RTM_NEWRULE,
+- NLM_F_MULTI, ops) < 0)
++ err = fib_nl_fill_rule(skb, rule, NETLINK_CB(cb->skb).portid,
++ cb->nlh->nlmsg_seq, RTM_NEWRULE,
++ NLM_F_MULTI, ops);
++ if (err < 0)
+ break;
+ skip:
+ idx++;
+@@ -638,7 +640,7 @@ skip:
+ cb->args[1] = idx;
+ rules_ops_put(ops);
+
+- return skb->len;
++ return err;
+ }
+
+ static int fib_nl_dumprule(struct sk_buff *skb, struct netlink_callback *cb)
+@@ -654,7 +656,9 @@ static int fib_nl_dumprule(struct sk_buff *skb, struct netlink_callback *cb)
+ if (ops == NULL)
+ return -EAFNOSUPPORT;
+
+- return dump_rules(skb, cb, ops);
++ dump_rules(skb, cb, ops);
++
++ return skb->len;
+ }
+
+ rcu_read_lock();
+diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
+index c522f7a00eab..c412db774603 100644
+--- a/net/core/rtnetlink.c
++++ b/net/core/rtnetlink.c
+@@ -805,7 +805,8 @@ static inline int rtnl_vfinfo_size(const struct net_device *dev,
+ nla_total_size(sizeof(struct ifla_vf_vlan)) +
+ nla_total_size(sizeof(struct ifla_vf_spoofchk)) +
+ nla_total_size(sizeof(struct ifla_vf_rate)) +
+- nla_total_size(sizeof(struct ifla_vf_link_state)));
++ nla_total_size(sizeof(struct ifla_vf_link_state)) +
++ nla_total_size(sizeof(struct ifla_vf_rss_query_en)));
+ return size;
+ } else
+ return 0;
+@@ -1075,14 +1076,16 @@ static int rtnl_fill_ifinfo(struct sk_buff *skb, struct net_device *dev,
+ struct ifla_vf_tx_rate vf_tx_rate;
+ struct ifla_vf_spoofchk vf_spoofchk;
+ struct ifla_vf_link_state vf_linkstate;
++ struct ifla_vf_rss_query_en vf_rss_query_en;
+
+ /*
+ * Not all SR-IOV capable drivers support the
+- * spoofcheck query. Preset to -1 so the user
+- * space tool can detect that the driver didn't
+- * report anything.
++ * spoofcheck and "RSS query enable" query. Preset to
++ * -1 so the user space tool can detect that the driver
++ * didn't report anything.
+ */
+ ivi.spoofchk = -1;
++ ivi.rss_query_en = -1;
+ memset(ivi.mac, 0, sizeof(ivi.mac));
+ /* The default value for VF link state is "auto"
+ * IFLA_VF_LINK_STATE_AUTO which equals zero
+@@ -1095,7 +1098,8 @@ static int rtnl_fill_ifinfo(struct sk_buff *skb, struct net_device *dev,
+ vf_rate.vf =
+ vf_tx_rate.vf =
+ vf_spoofchk.vf =
+- vf_linkstate.vf = ivi.vf;
++ vf_linkstate.vf =
++ vf_rss_query_en.vf = ivi.vf;
+
+ memcpy(vf_mac.mac, ivi.mac, sizeof(ivi.mac));
+ vf_vlan.vlan = ivi.vlan;
+@@ -1105,6 +1109,7 @@ static int rtnl_fill_ifinfo(struct sk_buff *skb, struct net_device *dev,
+ vf_rate.max_tx_rate = ivi.max_tx_rate;
+ vf_spoofchk.setting = ivi.spoofchk;
+ vf_linkstate.link_state = ivi.linkstate;
++ vf_rss_query_en.setting = ivi.rss_query_en;
+ vf = nla_nest_start(skb, IFLA_VF_INFO);
+ if (!vf) {
+ nla_nest_cancel(skb, vfinfo);
+@@ -1119,7 +1124,10 @@ static int rtnl_fill_ifinfo(struct sk_buff *skb, struct net_device *dev,
+ nla_put(skb, IFLA_VF_SPOOFCHK, sizeof(vf_spoofchk),
+ &vf_spoofchk) ||
+ nla_put(skb, IFLA_VF_LINK_STATE, sizeof(vf_linkstate),
+- &vf_linkstate))
++ &vf_linkstate) ||
++ nla_put(skb, IFLA_VF_RSS_QUERY_EN,
++ sizeof(vf_rss_query_en),
++ &vf_rss_query_en))
+ goto nla_put_failure;
+ nla_nest_end(skb, vf);
+ }
+@@ -1207,10 +1215,6 @@ static const struct nla_policy ifla_info_policy[IFLA_INFO_MAX+1] = {
+ [IFLA_INFO_SLAVE_DATA] = { .type = NLA_NESTED },
+ };
+
+-static const struct nla_policy ifla_vfinfo_policy[IFLA_VF_INFO_MAX+1] = {
+- [IFLA_VF_INFO] = { .type = NLA_NESTED },
+-};
+-
+ static const struct nla_policy ifla_vf_policy[IFLA_VF_MAX+1] = {
+ [IFLA_VF_MAC] = { .len = sizeof(struct ifla_vf_mac) },
+ [IFLA_VF_VLAN] = { .len = sizeof(struct ifla_vf_vlan) },
+@@ -1218,6 +1222,7 @@ static const struct nla_policy ifla_vf_policy[IFLA_VF_MAX+1] = {
+ [IFLA_VF_SPOOFCHK] = { .len = sizeof(struct ifla_vf_spoofchk) },
+ [IFLA_VF_RATE] = { .len = sizeof(struct ifla_vf_rate) },
+ [IFLA_VF_LINK_STATE] = { .len = sizeof(struct ifla_vf_link_state) },
++ [IFLA_VF_RSS_QUERY_EN] = { .len = sizeof(struct ifla_vf_rss_query_en) },
+ };
+
+ static const struct nla_policy ifla_port_policy[IFLA_PORT_MAX+1] = {
+@@ -1356,85 +1361,98 @@ static int validate_linkmsg(struct net_device *dev, struct nlattr *tb[])
+ return 0;
+ }
+
+-static int do_setvfinfo(struct net_device *dev, struct nlattr *attr)
++static int do_setvfinfo(struct net_device *dev, struct nlattr **tb)
+ {
+- int rem, err = -EINVAL;
+- struct nlattr *vf;
+ const struct net_device_ops *ops = dev->netdev_ops;
++ int err = -EINVAL;
+
+- nla_for_each_nested(vf, attr, rem) {
+- switch (nla_type(vf)) {
+- case IFLA_VF_MAC: {
+- struct ifla_vf_mac *ivm;
+- ivm = nla_data(vf);
+- err = -EOPNOTSUPP;
+- if (ops->ndo_set_vf_mac)
+- err = ops->ndo_set_vf_mac(dev, ivm->vf,
+- ivm->mac);
+- break;
+- }
+- case IFLA_VF_VLAN: {
+- struct ifla_vf_vlan *ivv;
+- ivv = nla_data(vf);
+- err = -EOPNOTSUPP;
+- if (ops->ndo_set_vf_vlan)
+- err = ops->ndo_set_vf_vlan(dev, ivv->vf,
+- ivv->vlan,
+- ivv->qos);
+- break;
+- }
+- case IFLA_VF_TX_RATE: {
+- struct ifla_vf_tx_rate *ivt;
+- struct ifla_vf_info ivf;
+- ivt = nla_data(vf);
+- err = -EOPNOTSUPP;
+- if (ops->ndo_get_vf_config)
+- err = ops->ndo_get_vf_config(dev, ivt->vf,
+- &ivf);
+- if (err)
+- break;
+- err = -EOPNOTSUPP;
+- if (ops->ndo_set_vf_rate)
+- err = ops->ndo_set_vf_rate(dev, ivt->vf,
+- ivf.min_tx_rate,
+- ivt->rate);
+- break;
+- }
+- case IFLA_VF_RATE: {
+- struct ifla_vf_rate *ivt;
+- ivt = nla_data(vf);
+- err = -EOPNOTSUPP;
+- if (ops->ndo_set_vf_rate)
+- err = ops->ndo_set_vf_rate(dev, ivt->vf,
+- ivt->min_tx_rate,
+- ivt->max_tx_rate);
+- break;
+- }
+- case IFLA_VF_SPOOFCHK: {
+- struct ifla_vf_spoofchk *ivs;
+- ivs = nla_data(vf);
+- err = -EOPNOTSUPP;
+- if (ops->ndo_set_vf_spoofchk)
+- err = ops->ndo_set_vf_spoofchk(dev, ivs->vf,
+- ivs->setting);
+- break;
+- }
+- case IFLA_VF_LINK_STATE: {
+- struct ifla_vf_link_state *ivl;
+- ivl = nla_data(vf);
+- err = -EOPNOTSUPP;
+- if (ops->ndo_set_vf_link_state)
+- err = ops->ndo_set_vf_link_state(dev, ivl->vf,
+- ivl->link_state);
+- break;
+- }
+- default:
+- err = -EINVAL;
+- break;
+- }
+- if (err)
+- break;
++ if (tb[IFLA_VF_MAC]) {
++ struct ifla_vf_mac *ivm = nla_data(tb[IFLA_VF_MAC]);
++
++ err = -EOPNOTSUPP;
++ if (ops->ndo_set_vf_mac)
++ err = ops->ndo_set_vf_mac(dev, ivm->vf,
++ ivm->mac);
++ if (err < 0)
++ return err;
++ }
++
++ if (tb[IFLA_VF_VLAN]) {
++ struct ifla_vf_vlan *ivv = nla_data(tb[IFLA_VF_VLAN]);
++
++ err = -EOPNOTSUPP;
++ if (ops->ndo_set_vf_vlan)
++ err = ops->ndo_set_vf_vlan(dev, ivv->vf, ivv->vlan,
++ ivv->qos);
++ if (err < 0)
++ return err;
+ }
++
++ if (tb[IFLA_VF_TX_RATE]) {
++ struct ifla_vf_tx_rate *ivt = nla_data(tb[IFLA_VF_TX_RATE]);
++ struct ifla_vf_info ivf;
++
++ err = -EOPNOTSUPP;
++ if (ops->ndo_get_vf_config)
++ err = ops->ndo_get_vf_config(dev, ivt->vf, &ivf);
++ if (err < 0)
++ return err;
++
++ err = -EOPNOTSUPP;
++ if (ops->ndo_set_vf_rate)
++ err = ops->ndo_set_vf_rate(dev, ivt->vf,
++ ivf.min_tx_rate,
++ ivt->rate);
++ if (err < 0)
++ return err;
++ }
++
++ if (tb[IFLA_VF_RATE]) {
++ struct ifla_vf_rate *ivt = nla_data(tb[IFLA_VF_RATE]);
++
++ err = -EOPNOTSUPP;
++ if (ops->ndo_set_vf_rate)
++ err = ops->ndo_set_vf_rate(dev, ivt->vf,
++ ivt->min_tx_rate,
++ ivt->max_tx_rate);
++ if (err < 0)
++ return err;
++ }
++
++ if (tb[IFLA_VF_SPOOFCHK]) {
++ struct ifla_vf_spoofchk *ivs = nla_data(tb[IFLA_VF_SPOOFCHK]);
++
++ err = -EOPNOTSUPP;
++ if (ops->ndo_set_vf_spoofchk)
++ err = ops->ndo_set_vf_spoofchk(dev, ivs->vf,
++ ivs->setting);
++ if (err < 0)
++ return err;
++ }
++
++ if (tb[IFLA_VF_LINK_STATE]) {
++ struct ifla_vf_link_state *ivl = nla_data(tb[IFLA_VF_LINK_STATE]);
++
++ err = -EOPNOTSUPP;
++ if (ops->ndo_set_vf_link_state)
++ err = ops->ndo_set_vf_link_state(dev, ivl->vf,
++ ivl->link_state);
++ if (err < 0)
++ return err;
++ }
++
++ if (tb[IFLA_VF_RSS_QUERY_EN]) {
++ struct ifla_vf_rss_query_en *ivrssq_en;
++
++ err = -EOPNOTSUPP;
++ ivrssq_en = nla_data(tb[IFLA_VF_RSS_QUERY_EN]);
++ if (ops->ndo_set_vf_rss_query_en)
++ err = ops->ndo_set_vf_rss_query_en(dev, ivrssq_en->vf,
++ ivrssq_en->setting);
++ if (err < 0)
++ return err;
++ }
++
+ return err;
+ }
+
+@@ -1630,14 +1648,21 @@ static int do_setlink(const struct sk_buff *skb,
+ }
+
+ if (tb[IFLA_VFINFO_LIST]) {
++ struct nlattr *vfinfo[IFLA_VF_MAX + 1];
+ struct nlattr *attr;
+ int rem;
++
+ nla_for_each_nested(attr, tb[IFLA_VFINFO_LIST], rem) {
+- if (nla_type(attr) != IFLA_VF_INFO) {
++ if (nla_type(attr) != IFLA_VF_INFO ||
++ nla_len(attr) < NLA_HDRLEN) {
+ err = -EINVAL;
+ goto errout;
+ }
+- err = do_setvfinfo(dev, attr);
++ err = nla_parse_nested(vfinfo, IFLA_VF_MAX, attr,
++ ifla_vf_policy);
++ if (err < 0)
++ goto errout;
++ err = do_setvfinfo(dev, vfinfo);
+ if (err < 0)
+ goto errout;
+ status |= DO_SETLINK_NOTIFY;
+diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
+index dc9f925b0cd5..9c7d88870e2b 100644
+--- a/net/ipv4/tcp_output.c
++++ b/net/ipv4/tcp_output.c
+@@ -2798,6 +2798,7 @@ void tcp_send_active_reset(struct sock *sk, gfp_t priority)
+ skb_reserve(skb, MAX_TCP_HEADER);
+ tcp_init_nondata_skb(skb, tcp_acceptable_seq(sk),
+ TCPHDR_ACK | TCPHDR_RST);
++ skb_mstamp_get(&skb->skb_mstamp);
+ /* Send it off. */
+ if (tcp_transmit_skb(sk, skb, 0, priority))
+ NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPABORTFAILED);
+diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
+index c5e3194fd9a5..4ea975324888 100644
+--- a/net/ipv4/udp.c
++++ b/net/ipv4/udp.c
+@@ -1983,12 +1983,19 @@ void udp_v4_early_demux(struct sk_buff *skb)
+
+ skb->sk = sk;
+ skb->destructor = sock_efree;
+- dst = sk->sk_rx_dst;
++ dst = READ_ONCE(sk->sk_rx_dst);
+
+ if (dst)
+ dst = dst_check(dst, 0);
+- if (dst)
+- skb_dst_set_noref(skb, dst);
++ if (dst) {
++ /* DST_NOCACHE can not be used without taking a reference */
++ if (dst->flags & DST_NOCACHE) {
++ if (likely(atomic_inc_not_zero(&dst->__refcnt)))
++ skb_dst_set(skb, dst);
++ } else {
++ skb_dst_set_noref(skb, dst);
++ }
++ }
+ }
+
+ int udp_rcv(struct sk_buff *skb)
+diff --git a/net/ipv6/exthdrs_offload.c b/net/ipv6/exthdrs_offload.c
+index 447a7fbd1bb6..f5e2ba1c18bf 100644
+--- a/net/ipv6/exthdrs_offload.c
++++ b/net/ipv6/exthdrs_offload.c
+@@ -36,6 +36,6 @@ out:
+ return ret;
+
+ out_rt:
+- inet_del_offload(&rthdr_offload, IPPROTO_ROUTING);
++ inet6_del_offload(&rthdr_offload, IPPROTO_ROUTING);
+ goto out;
+ }
+diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
+index 0e32d2e1bdbf..28d7a245ea34 100644
+--- a/net/ipv6/ip6_gre.c
++++ b/net/ipv6/ip6_gre.c
+@@ -360,7 +360,7 @@ static void ip6gre_tunnel_uninit(struct net_device *dev)
+ struct ip6_tnl *t = netdev_priv(dev);
+ struct ip6gre_net *ign = net_generic(t->net, ip6gre_net_id);
+
+- ip6gre_tunnel_unlink(ign, t);
++ ip6_tnl_dst_reset(netdev_priv(dev));
+ dev_put(dev);
+ }
+
+diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
+index 1a01d79b8698..0d58542f9db0 100644
+--- a/net/ipv6/ip6mr.c
++++ b/net/ipv6/ip6mr.c
+@@ -552,7 +552,7 @@ static void ipmr_mfc_seq_stop(struct seq_file *seq, void *v)
+
+ if (it->cache == &mrt->mfc6_unres_queue)
+ spin_unlock_bh(&mfc_unres_lock);
+- else if (it->cache == mrt->mfc6_cache_array)
++ else if (it->cache == &mrt->mfc6_cache_array[it->ct])
+ read_unlock(&mrt_lock);
+ }
+
+diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
+index 80ce44f6693d..45e782825567 100644
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -299,9 +299,6 @@ ieee80211_tx_h_check_assoc(struct ieee80211_tx_data *tx)
+ if (tx->sdata->vif.type == NL80211_IFTYPE_WDS)
+ return TX_CONTINUE;
+
+- if (tx->sdata->vif.type == NL80211_IFTYPE_MESH_POINT)
+- return TX_CONTINUE;
+-
+ if (tx->flags & IEEE80211_TX_PS_BUFFERED)
+ return TX_CONTINUE;
+
+diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
+index 990decba1fe4..3a2fa9c044f8 100644
+--- a/net/netfilter/ipvs/ip_vs_core.c
++++ b/net/netfilter/ipvs/ip_vs_core.c
+@@ -313,7 +313,13 @@ ip_vs_sched_persist(struct ip_vs_service *svc,
+ * return *ignored=0 i.e. ICMP and NF_DROP
+ */
+ sched = rcu_dereference(svc->scheduler);
+- dest = sched->schedule(svc, skb, iph);
++ if (sched) {
++ /* read svc->sched_data after svc->scheduler */
++ smp_rmb();
++ dest = sched->schedule(svc, skb, iph);
++ } else {
++ dest = NULL;
++ }
+ if (!dest) {
+ IP_VS_DBG(1, "p-schedule: no dest found.\n");
+ kfree(param.pe_data);
+@@ -461,7 +467,13 @@ ip_vs_schedule(struct ip_vs_service *svc, struct sk_buff *skb,
+ }
+
+ sched = rcu_dereference(svc->scheduler);
+- dest = sched->schedule(svc, skb, iph);
++ if (sched) {
++ /* read svc->sched_data after svc->scheduler */
++ smp_rmb();
++ dest = sched->schedule(svc, skb, iph);
++ } else {
++ dest = NULL;
++ }
+ if (dest == NULL) {
+ IP_VS_DBG(1, "Schedule: no dest found.\n");
+ return NULL;
+diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
+index ac7ba689efe7..9b1452e8e868 100644
+--- a/net/netfilter/ipvs/ip_vs_ctl.c
++++ b/net/netfilter/ipvs/ip_vs_ctl.c
+@@ -828,15 +828,16 @@ __ip_vs_update_dest(struct ip_vs_service *svc, struct ip_vs_dest *dest,
+ __ip_vs_dst_cache_reset(dest);
+ spin_unlock_bh(&dest->dst_lock);
+
+- sched = rcu_dereference_protected(svc->scheduler, 1);
+ if (add) {
+ ip_vs_start_estimator(svc->net, &dest->stats);
+ list_add_rcu(&dest->n_list, &svc->destinations);
+ svc->num_dests++;
+- if (sched->add_dest)
++ sched = rcu_dereference_protected(svc->scheduler, 1);
++ if (sched && sched->add_dest)
+ sched->add_dest(svc, dest);
+ } else {
+- if (sched->upd_dest)
++ sched = rcu_dereference_protected(svc->scheduler, 1);
++ if (sched && sched->upd_dest)
+ sched->upd_dest(svc, dest);
+ }
+ }
+@@ -1070,7 +1071,7 @@ static void __ip_vs_unlink_dest(struct ip_vs_service *svc,
+ struct ip_vs_scheduler *sched;
+
+ sched = rcu_dereference_protected(svc->scheduler, 1);
+- if (sched->del_dest)
++ if (sched && sched->del_dest)
+ sched->del_dest(svc, dest);
+ }
+ }
+@@ -1161,11 +1162,14 @@ ip_vs_add_service(struct net *net, struct ip_vs_service_user_kern *u,
+ ip_vs_use_count_inc();
+
+ /* Lookup the scheduler by 'u->sched_name' */
+- sched = ip_vs_scheduler_get(u->sched_name);
+- if (sched == NULL) {
+- pr_info("Scheduler module ip_vs_%s not found\n", u->sched_name);
+- ret = -ENOENT;
+- goto out_err;
++ if (strcmp(u->sched_name, "none")) {
++ sched = ip_vs_scheduler_get(u->sched_name);
++ if (!sched) {
++ pr_info("Scheduler module ip_vs_%s not found\n",
++ u->sched_name);
++ ret = -ENOENT;
++ goto out_err;
++ }
+ }
+
+ if (u->pe_name && *u->pe_name) {
+@@ -1226,10 +1230,12 @@ ip_vs_add_service(struct net *net, struct ip_vs_service_user_kern *u,
+ spin_lock_init(&svc->stats.lock);
+
+ /* Bind the scheduler */
+- ret = ip_vs_bind_scheduler(svc, sched);
+- if (ret)
+- goto out_err;
+- sched = NULL;
++ if (sched) {
++ ret = ip_vs_bind_scheduler(svc, sched);
++ if (ret)
++ goto out_err;
++ sched = NULL;
++ }
+
+ /* Bind the ct retriever */
+ RCU_INIT_POINTER(svc->pe, pe);
+@@ -1277,17 +1283,20 @@ ip_vs_add_service(struct net *net, struct ip_vs_service_user_kern *u,
+ static int
+ ip_vs_edit_service(struct ip_vs_service *svc, struct ip_vs_service_user_kern *u)
+ {
+- struct ip_vs_scheduler *sched, *old_sched;
++ struct ip_vs_scheduler *sched = NULL, *old_sched;
+ struct ip_vs_pe *pe = NULL, *old_pe = NULL;
+ int ret = 0;
+
+ /*
+ * Lookup the scheduler, by 'u->sched_name'
+ */
+- sched = ip_vs_scheduler_get(u->sched_name);
+- if (sched == NULL) {
+- pr_info("Scheduler module ip_vs_%s not found\n", u->sched_name);
+- return -ENOENT;
++ if (strcmp(u->sched_name, "none")) {
++ sched = ip_vs_scheduler_get(u->sched_name);
++ if (!sched) {
++ pr_info("Scheduler module ip_vs_%s not found\n",
++ u->sched_name);
++ return -ENOENT;
++ }
+ }
+ old_sched = sched;
+
+@@ -1315,14 +1324,20 @@ ip_vs_edit_service(struct ip_vs_service *svc, struct ip_vs_service_user_kern *u)
+
+ old_sched = rcu_dereference_protected(svc->scheduler, 1);
+ if (sched != old_sched) {
++ if (old_sched) {
++ ip_vs_unbind_scheduler(svc, old_sched);
++ RCU_INIT_POINTER(svc->scheduler, NULL);
++ /* Wait all svc->sched_data users */
++ synchronize_rcu();
++ }
+ /* Bind the new scheduler */
+- ret = ip_vs_bind_scheduler(svc, sched);
+- if (ret) {
+- old_sched = sched;
+- goto out;
++ if (sched) {
++ ret = ip_vs_bind_scheduler(svc, sched);
++ if (ret) {
++ ip_vs_scheduler_put(sched);
++ goto out;
++ }
+ }
+- /* Unbind the old scheduler on success */
+- ip_vs_unbind_scheduler(svc, old_sched);
+ }
+
+ /*
+@@ -1962,6 +1977,7 @@ static int ip_vs_info_seq_show(struct seq_file *seq, void *v)
+ const struct ip_vs_iter *iter = seq->private;
+ const struct ip_vs_dest *dest;
+ struct ip_vs_scheduler *sched = rcu_dereference(svc->scheduler);
++ char *sched_name = sched ? sched->name : "none";
+
+ if (iter->table == ip_vs_svc_table) {
+ #ifdef CONFIG_IP_VS_IPV6
+@@ -1970,18 +1986,18 @@ static int ip_vs_info_seq_show(struct seq_file *seq, void *v)
+ ip_vs_proto_name(svc->protocol),
+ &svc->addr.in6,
+ ntohs(svc->port),
+- sched->name);
++ sched_name);
+ else
+ #endif
+ seq_printf(seq, "%s %08X:%04X %s %s ",
+ ip_vs_proto_name(svc->protocol),
+ ntohl(svc->addr.ip),
+ ntohs(svc->port),
+- sched->name,
++ sched_name,
+ (svc->flags & IP_VS_SVC_F_ONEPACKET)?"ops ":"");
+ } else {
+ seq_printf(seq, "FWM %08X %s %s",
+- svc->fwmark, sched->name,
++ svc->fwmark, sched_name,
+ (svc->flags & IP_VS_SVC_F_ONEPACKET)?"ops ":"");
+ }
+
+@@ -2401,13 +2417,15 @@ static void
+ ip_vs_copy_service(struct ip_vs_service_entry *dst, struct ip_vs_service *src)
+ {
+ struct ip_vs_scheduler *sched;
++ char *sched_name;
+
+ sched = rcu_dereference_protected(src->scheduler, 1);
++ sched_name = sched ? sched->name : "none";
+ dst->protocol = src->protocol;
+ dst->addr = src->addr.ip;
+ dst->port = src->port;
+ dst->fwmark = src->fwmark;
+- strlcpy(dst->sched_name, sched->name, sizeof(dst->sched_name));
++ strlcpy(dst->sched_name, sched_name, sizeof(dst->sched_name));
+ dst->flags = src->flags;
+ dst->timeout = src->timeout / HZ;
+ dst->netmask = src->netmask;
+@@ -2836,6 +2854,7 @@ static int ip_vs_genl_fill_service(struct sk_buff *skb,
+ struct nlattr *nl_service;
+ struct ip_vs_flags flags = { .flags = svc->flags,
+ .mask = ~0 };
++ char *sched_name;
+
+ nl_service = nla_nest_start(skb, IPVS_CMD_ATTR_SERVICE);
+ if (!nl_service)
+@@ -2854,8 +2873,9 @@ static int ip_vs_genl_fill_service(struct sk_buff *skb,
+ }
+
+ sched = rcu_dereference_protected(svc->scheduler, 1);
++ sched_name = sched ? sched->name : "none";
+ pe = rcu_dereference_protected(svc->pe, 1);
+- if (nla_put_string(skb, IPVS_SVC_ATTR_SCHED_NAME, sched->name) ||
++ if (nla_put_string(skb, IPVS_SVC_ATTR_SCHED_NAME, sched_name) ||
+ (pe && nla_put_string(skb, IPVS_SVC_ATTR_PE_NAME, pe->name)) ||
+ nla_put(skb, IPVS_SVC_ATTR_FLAGS, sizeof(flags), &flags) ||
+ nla_put_u32(skb, IPVS_SVC_ATTR_TIMEOUT, svc->timeout / HZ) ||
+diff --git a/net/netfilter/ipvs/ip_vs_sched.c b/net/netfilter/ipvs/ip_vs_sched.c
+index 4dbcda6258bc..21b6b515a09c 100644
+--- a/net/netfilter/ipvs/ip_vs_sched.c
++++ b/net/netfilter/ipvs/ip_vs_sched.c
+@@ -74,7 +74,7 @@ void ip_vs_unbind_scheduler(struct ip_vs_service *svc,
+
+ if (sched->done_service)
+ sched->done_service(svc);
+- /* svc->scheduler can not be set to NULL */
++ /* svc->scheduler can be set to NULL only by caller */
+ }
+
+
+@@ -148,21 +148,21 @@ void ip_vs_scheduler_put(struct ip_vs_scheduler *scheduler)
+
+ void ip_vs_scheduler_err(struct ip_vs_service *svc, const char *msg)
+ {
+- struct ip_vs_scheduler *sched;
++ struct ip_vs_scheduler *sched = rcu_dereference(svc->scheduler);
++ char *sched_name = sched ? sched->name : "none";
+
+- sched = rcu_dereference(svc->scheduler);
+ if (svc->fwmark) {
+ IP_VS_ERR_RL("%s: FWM %u 0x%08X - %s\n",
+- sched->name, svc->fwmark, svc->fwmark, msg);
++ sched_name, svc->fwmark, svc->fwmark, msg);
+ #ifdef CONFIG_IP_VS_IPV6
+ } else if (svc->af == AF_INET6) {
+ IP_VS_ERR_RL("%s: %s [%pI6c]:%d - %s\n",
+- sched->name, ip_vs_proto_name(svc->protocol),
++ sched_name, ip_vs_proto_name(svc->protocol),
+ &svc->addr.in6, ntohs(svc->port), msg);
+ #endif
+ } else {
+ IP_VS_ERR_RL("%s: %s %pI4:%d - %s\n",
+- sched->name, ip_vs_proto_name(svc->protocol),
++ sched_name, ip_vs_proto_name(svc->protocol),
+ &svc->addr.ip, ntohs(svc->port), msg);
+ }
+ }
+diff --git a/net/netfilter/ipvs/ip_vs_sync.c b/net/netfilter/ipvs/ip_vs_sync.c
+index 7162c86fd50d..72fac696c85e 100644
+--- a/net/netfilter/ipvs/ip_vs_sync.c
++++ b/net/netfilter/ipvs/ip_vs_sync.c
+@@ -612,7 +612,7 @@ static void ip_vs_sync_conn_v0(struct net *net, struct ip_vs_conn *cp,
+ pkts = atomic_add_return(1, &cp->in_pkts);
+ else
+ pkts = sysctl_sync_threshold(ipvs);
+- ip_vs_sync_conn(net, cp->control, pkts);
++ ip_vs_sync_conn(net, cp, pkts);
+ }
+ }
+
+diff --git a/net/netfilter/ipvs/ip_vs_xmit.c b/net/netfilter/ipvs/ip_vs_xmit.c
+index bd90bf8107da..72f030878e7a 100644
+--- a/net/netfilter/ipvs/ip_vs_xmit.c
++++ b/net/netfilter/ipvs/ip_vs_xmit.c
+@@ -130,7 +130,6 @@ static struct rtable *do_output_route4(struct net *net, __be32 daddr,
+
+ memset(&fl4, 0, sizeof(fl4));
+ fl4.daddr = daddr;
+- fl4.saddr = (rt_mode & IP_VS_RT_MODE_CONNECT) ? *saddr : 0;
+ fl4.flowi4_flags = (rt_mode & IP_VS_RT_MODE_KNOWN_NH) ?
+ FLOWI_FLAG_KNOWN_NH : 0;
+
+@@ -524,6 +523,21 @@ static inline int ip_vs_tunnel_xmit_prepare(struct sk_buff *skb,
+ return ret;
+ }
+
++/* In the event of a remote destination, it's possible that we would have
++ * matches against an old socket (particularly a TIME-WAIT socket). This
++ * causes havoc down the line (ip_local_out et. al. expect regular sockets
++ * and invalid memory accesses will happen) so simply drop the association
++ * in this case.
++*/
++static inline void ip_vs_drop_early_demux_sk(struct sk_buff *skb)
++{
++ /* If dev is set, the packet came from the LOCAL_IN callback and
++ * not from a local TCP socket.
++ */
++ if (skb->dev)
++ skb_orphan(skb);
++}
++
+ /* return NF_STOLEN (sent) or NF_ACCEPT if local=1 (not sent) */
+ static inline int ip_vs_nat_send_or_cont(int pf, struct sk_buff *skb,
+ struct ip_vs_conn *cp, int local)
+@@ -535,12 +549,21 @@ static inline int ip_vs_nat_send_or_cont(int pf, struct sk_buff *skb,
+ ip_vs_notrack(skb);
+ else
+ ip_vs_update_conntrack(skb, cp, 1);
++
++ /* Remove the early_demux association unless it's bound for the
++ * exact same port and address on this host after translation.
++ */
++ if (!local || cp->vport != cp->dport ||
++ !ip_vs_addr_equal(cp->af, &cp->vaddr, &cp->daddr))
++ ip_vs_drop_early_demux_sk(skb);
++
+ if (!local) {
+ skb_forward_csum(skb);
+ NF_HOOK(pf, NF_INET_LOCAL_OUT, skb, NULL, skb_dst(skb)->dev,
+ dst_output);
+ } else
+ ret = NF_ACCEPT;
++
+ return ret;
+ }
+
+@@ -554,6 +577,7 @@ static inline int ip_vs_send_or_cont(int pf, struct sk_buff *skb,
+ if (likely(!(cp->flags & IP_VS_CONN_F_NFCT)))
+ ip_vs_notrack(skb);
+ if (!local) {
++ ip_vs_drop_early_demux_sk(skb);
+ skb_forward_csum(skb);
+ NF_HOOK(pf, NF_INET_LOCAL_OUT, skb, NULL, skb_dst(skb)->dev,
+ dst_output);
+@@ -842,6 +866,8 @@ ip_vs_prepare_tunneled_skb(struct sk_buff *skb, int skb_af,
+ struct ipv6hdr *old_ipv6h = NULL;
+ #endif
+
++ ip_vs_drop_early_demux_sk(skb);
++
+ if (skb_headroom(skb) < max_headroom || skb_cloned(skb)) {
+ new_skb = skb_realloc_headroom(skb, max_headroom);
+ if (!new_skb)
+diff --git a/net/netfilter/nf_conntrack_expect.c b/net/netfilter/nf_conntrack_expect.c
+index 91a1837acd0e..26af45193ab7 100644
+--- a/net/netfilter/nf_conntrack_expect.c
++++ b/net/netfilter/nf_conntrack_expect.c
+@@ -219,7 +219,8 @@ static inline int expect_clash(const struct nf_conntrack_expect *a,
+ a->mask.src.u3.all[count] & b->mask.src.u3.all[count];
+ }
+
+- return nf_ct_tuple_mask_cmp(&a->tuple, &b->tuple, &intersect_mask);
++ return nf_ct_tuple_mask_cmp(&a->tuple, &b->tuple, &intersect_mask) &&
++ nf_ct_zone(a->master) == nf_ct_zone(b->master);
+ }
+
+ static inline int expect_matches(const struct nf_conntrack_expect *a,
+diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
+index 1bd9ed9e62f6..d3ea2999d0dc 100644
+--- a/net/netfilter/nf_conntrack_netlink.c
++++ b/net/netfilter/nf_conntrack_netlink.c
+@@ -2956,11 +2956,6 @@ ctnetlink_create_expect(struct net *net, u16 zone,
+ }
+
+ err = nf_ct_expect_related_report(exp, portid, report);
+- if (err < 0)
+- goto err_exp;
+-
+- return 0;
+-err_exp:
+ nf_ct_expect_put(exp);
+ err_ct:
+ nf_ct_put(ct);
+diff --git a/net/netfilter/nf_log.c b/net/netfilter/nf_log.c
+index d7197649dba6..cfe93c2227c5 100644
+--- a/net/netfilter/nf_log.c
++++ b/net/netfilter/nf_log.c
+@@ -19,6 +19,9 @@
+ static struct nf_logger __rcu *loggers[NFPROTO_NUMPROTO][NF_LOG_TYPE_MAX] __read_mostly;
+ static DEFINE_MUTEX(nf_log_mutex);
+
++#define nft_log_dereference(logger) \
++ rcu_dereference_protected(logger, lockdep_is_held(&nf_log_mutex))
++
+ static struct nf_logger *__find_logger(int pf, const char *str_logger)
+ {
+ struct nf_logger *log;
+@@ -28,8 +31,7 @@ static struct nf_logger *__find_logger(int pf, const char *str_logger)
+ if (loggers[pf][i] == NULL)
+ continue;
+
+- log = rcu_dereference_protected(loggers[pf][i],
+- lockdep_is_held(&nf_log_mutex));
++ log = nft_log_dereference(loggers[pf][i]);
+ if (!strncasecmp(str_logger, log->name, strlen(log->name)))
+ return log;
+ }
+@@ -45,8 +47,7 @@ void nf_log_set(struct net *net, u_int8_t pf, const struct nf_logger *logger)
+ return;
+
+ mutex_lock(&nf_log_mutex);
+- log = rcu_dereference_protected(net->nf.nf_loggers[pf],
+- lockdep_is_held(&nf_log_mutex));
++ log = nft_log_dereference(net->nf.nf_loggers[pf]);
+ if (log == NULL)
+ rcu_assign_pointer(net->nf.nf_loggers[pf], logger);
+
+@@ -61,8 +62,7 @@ void nf_log_unset(struct net *net, const struct nf_logger *logger)
+
+ mutex_lock(&nf_log_mutex);
+ for (i = 0; i < NFPROTO_NUMPROTO; i++) {
+- log = rcu_dereference_protected(net->nf.nf_loggers[i],
+- lockdep_is_held(&nf_log_mutex));
++ log = nft_log_dereference(net->nf.nf_loggers[i]);
+ if (log == logger)
+ RCU_INIT_POINTER(net->nf.nf_loggers[i], NULL);
+ }
+@@ -97,12 +97,17 @@ EXPORT_SYMBOL(nf_log_register);
+
+ void nf_log_unregister(struct nf_logger *logger)
+ {
++ const struct nf_logger *log;
+ int i;
+
+ mutex_lock(&nf_log_mutex);
+- for (i = 0; i < NFPROTO_NUMPROTO; i++)
+- RCU_INIT_POINTER(loggers[i][logger->type], NULL);
++ for (i = 0; i < NFPROTO_NUMPROTO; i++) {
++ log = nft_log_dereference(loggers[i][logger->type]);
++ if (log == logger)
++ RCU_INIT_POINTER(loggers[i][logger->type], NULL);
++ }
+ mutex_unlock(&nf_log_mutex);
++ synchronize_rcu();
+ }
+ EXPORT_SYMBOL(nf_log_unregister);
+
+@@ -297,8 +302,7 @@ static int seq_show(struct seq_file *s, void *v)
+ int i, ret;
+ struct net *net = seq_file_net(s);
+
+- logger = rcu_dereference_protected(net->nf.nf_loggers[*pos],
+- lockdep_is_held(&nf_log_mutex));
++ logger = nft_log_dereference(net->nf.nf_loggers[*pos]);
+
+ if (!logger)
+ ret = seq_printf(s, "%2lld NONE (", *pos);
+@@ -312,8 +316,7 @@ static int seq_show(struct seq_file *s, void *v)
+ if (loggers[*pos][i] == NULL)
+ continue;
+
+- logger = rcu_dereference_protected(loggers[*pos][i],
+- lockdep_is_held(&nf_log_mutex));
++ logger = nft_log_dereference(loggers[*pos][i]);
+ ret = seq_printf(s, "%s", logger->name);
+ if (ret < 0)
+ return ret;
+@@ -385,8 +388,7 @@ static int nf_log_proc_dostring(struct ctl_table *table, int write,
+ mutex_unlock(&nf_log_mutex);
+ } else {
+ mutex_lock(&nf_log_mutex);
+- logger = rcu_dereference_protected(net->nf.nf_loggers[tindex],
+- lockdep_is_held(&nf_log_mutex));
++ logger = nft_log_dereference(net->nf.nf_loggers[tindex]);
+ if (!logger)
+ table->data = "NONE";
+ else
+diff --git a/net/netfilter/nfnetlink.c b/net/netfilter/nfnetlink.c
+index 1aa7049c93f5..e41bab38a3ca 100644
+--- a/net/netfilter/nfnetlink.c
++++ b/net/netfilter/nfnetlink.c
+@@ -433,6 +433,7 @@ done:
+ static void nfnetlink_rcv(struct sk_buff *skb)
+ {
+ struct nlmsghdr *nlh = nlmsg_hdr(skb);
++ u_int16_t res_id;
+ int msglen;
+
+ if (nlh->nlmsg_len < NLMSG_HDRLEN ||
+@@ -457,7 +458,12 @@ static void nfnetlink_rcv(struct sk_buff *skb)
+
+ nfgenmsg = nlmsg_data(nlh);
+ skb_pull(skb, msglen);
+- nfnetlink_rcv_batch(skb, nlh, nfgenmsg->res_id);
++ /* Work around old nft using host byte order */
++ if (nfgenmsg->res_id == NFNL_SUBSYS_NFTABLES)
++ res_id = NFNL_SUBSYS_NFTABLES;
++ else
++ res_id = ntohs(nfgenmsg->res_id);
++ nfnetlink_rcv_batch(skb, nlh, res_id);
+ } else {
+ netlink_rcv_skb(skb, &nfnetlink_rcv_msg);
+ }
+diff --git a/net/netfilter/nft_compat.c b/net/netfilter/nft_compat.c
+index e22a2961cc39..ff6f35971ea2 100644
+--- a/net/netfilter/nft_compat.c
++++ b/net/netfilter/nft_compat.c
+@@ -561,6 +561,13 @@ struct nft_xt {
+
+ static struct nft_expr_type nft_match_type;
+
++static bool nft_match_cmp(const struct xt_match *match,
++ const char *name, u32 rev, u32 family)
++{
++ return strcmp(match->name, name) == 0 && match->revision == rev &&
++ (match->family == NFPROTO_UNSPEC || match->family == family);
++}
++
+ static const struct nft_expr_ops *
+ nft_match_select_ops(const struct nft_ctx *ctx,
+ const struct nlattr * const tb[])
+@@ -568,7 +575,7 @@ nft_match_select_ops(const struct nft_ctx *ctx,
+ struct nft_xt *nft_match;
+ struct xt_match *match;
+ char *mt_name;
+- __u32 rev, family;
++ u32 rev, family;
+
+ if (tb[NFTA_MATCH_NAME] == NULL ||
+ tb[NFTA_MATCH_REV] == NULL ||
+@@ -583,9 +590,12 @@ nft_match_select_ops(const struct nft_ctx *ctx,
+ list_for_each_entry(nft_match, &nft_match_list, head) {
+ struct xt_match *match = nft_match->ops.data;
+
+- if (strcmp(match->name, mt_name) == 0 &&
+- match->revision == rev && match->family == family)
++ if (nft_match_cmp(match, mt_name, rev, family)) {
++ if (!try_module_get(match->me))
++ return ERR_PTR(-ENOENT);
++
+ return &nft_match->ops;
++ }
+ }
+
+ match = xt_request_find_match(family, mt_name, rev);
+@@ -631,6 +641,13 @@ static LIST_HEAD(nft_target_list);
+
+ static struct nft_expr_type nft_target_type;
+
++static bool nft_target_cmp(const struct xt_target *tg,
++ const char *name, u32 rev, u32 family)
++{
++ return strcmp(tg->name, name) == 0 && tg->revision == rev &&
++ (tg->family == NFPROTO_UNSPEC || tg->family == family);
++}
++
+ static const struct nft_expr_ops *
+ nft_target_select_ops(const struct nft_ctx *ctx,
+ const struct nlattr * const tb[])
+@@ -638,7 +655,7 @@ nft_target_select_ops(const struct nft_ctx *ctx,
+ struct nft_xt *nft_target;
+ struct xt_target *target;
+ char *tg_name;
+- __u32 rev, family;
++ u32 rev, family;
+
+ if (tb[NFTA_TARGET_NAME] == NULL ||
+ tb[NFTA_TARGET_REV] == NULL ||
+@@ -653,9 +670,12 @@ nft_target_select_ops(const struct nft_ctx *ctx,
+ list_for_each_entry(nft_target, &nft_target_list, head) {
+ struct xt_target *target = nft_target->ops.data;
+
+- if (strcmp(target->name, tg_name) == 0 &&
+- target->revision == rev && target->family == family)
++ if (nft_target_cmp(target, tg_name, rev, family)) {
++ if (!try_module_get(target->me))
++ return ERR_PTR(-ENOENT);
++
+ return &nft_target->ops;
++ }
+ }
+
+ target = xt_request_find_target(family, tg_name, rev);
+diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
+index 6ffd1ebaba93..fe106b50053e 100644
+--- a/net/netlink/af_netlink.c
++++ b/net/netlink/af_netlink.c
+@@ -133,6 +133,24 @@ static inline u32 netlink_group_mask(u32 group)
+ return group ? 1 << (group - 1) : 0;
+ }
+
++static struct sk_buff *netlink_to_full_skb(const struct sk_buff *skb,
++ gfp_t gfp_mask)
++{
++ unsigned int len = skb_end_offset(skb);
++ struct sk_buff *new;
++
++ new = alloc_skb(len, gfp_mask);
++ if (new == NULL)
++ return NULL;
++
++ NETLINK_CB(new).portid = NETLINK_CB(skb).portid;
++ NETLINK_CB(new).dst_group = NETLINK_CB(skb).dst_group;
++ NETLINK_CB(new).creds = NETLINK_CB(skb).creds;
++
++ memcpy(skb_put(new, len), skb->data, len);
++ return new;
++}
++
+ int netlink_add_tap(struct netlink_tap *nt)
+ {
+ if (unlikely(nt->dev->type != ARPHRD_NETLINK))
+@@ -215,7 +233,11 @@ static int __netlink_deliver_tap_skb(struct sk_buff *skb,
+ int ret = -ENOMEM;
+
+ dev_hold(dev);
+- nskb = skb_clone(skb, GFP_ATOMIC);
++
++ if (netlink_skb_is_mmaped(skb) || is_vmalloc_addr(skb->head))
++ nskb = netlink_to_full_skb(skb, GFP_ATOMIC);
++ else
++ nskb = skb_clone(skb, GFP_ATOMIC);
+ if (nskb) {
+ nskb->dev = dev;
+ nskb->protocol = htons((u16) sk->sk_protocol);
+@@ -287,11 +309,6 @@ static void netlink_rcv_wake(struct sock *sk)
+ }
+
+ #ifdef CONFIG_NETLINK_MMAP
+-static bool netlink_skb_is_mmaped(const struct sk_buff *skb)
+-{
+- return NETLINK_CB(skb).flags & NETLINK_SKB_MMAPED;
+-}
+-
+ static bool netlink_rx_is_mmaped(struct sock *sk)
+ {
+ return nlk_sk(sk)->rx_ring.pg_vec != NULL;
+@@ -843,7 +860,6 @@ static void netlink_ring_set_copied(struct sock *sk, struct sk_buff *skb)
+ }
+
+ #else /* CONFIG_NETLINK_MMAP */
+-#define netlink_skb_is_mmaped(skb) false
+ #define netlink_rx_is_mmaped(sk) false
+ #define netlink_tx_is_mmaped(sk) false
+ #define netlink_mmap sock_no_mmap
+diff --git a/net/netlink/af_netlink.h b/net/netlink/af_netlink.h
+index b20a1731759b..3951874e715d 100644
+--- a/net/netlink/af_netlink.h
++++ b/net/netlink/af_netlink.h
+@@ -57,6 +57,15 @@ static inline struct netlink_sock *nlk_sk(struct sock *sk)
+ return container_of(sk, struct netlink_sock, sk);
+ }
+
++static inline bool netlink_skb_is_mmaped(const struct sk_buff *skb)
++{
++#ifdef CONFIG_NETLINK_MMAP
++ return NETLINK_CB(skb).flags & NETLINK_SKB_MMAPED;
++#else
++ return false;
++#endif /* CONFIG_NETLINK_MMAP */
++}
++
+ struct netlink_table {
+ struct rhashtable hash;
+ struct hlist_head mc_list;
+diff --git a/net/openvswitch/datapath.c b/net/openvswitch/datapath.c
+index 28213dff723d..acf6b2edba65 100644
+--- a/net/openvswitch/datapath.c
++++ b/net/openvswitch/datapath.c
+@@ -834,7 +834,7 @@ static int ovs_flow_cmd_new(struct sk_buff *skb, struct genl_info *info)
+ if (error)
+ goto err_kfree_flow;
+
+- ovs_flow_mask_key(&new_flow->key, &new_flow->unmasked_key, &mask);
++ ovs_flow_mask_key(&new_flow->key, &new_flow->unmasked_key, true, &mask);
+
+ /* Validate actions. */
+ acts = ovs_nla_alloc_flow_actions(nla_len(a[OVS_FLOW_ATTR_ACTIONS]));
+@@ -949,7 +949,7 @@ static struct sw_flow_actions *get_flow_actions(const struct nlattr *a,
+ if (IS_ERR(acts))
+ return acts;
+
+- ovs_flow_mask_key(&masked_key, key, mask);
++ ovs_flow_mask_key(&masked_key, key, true, mask);
+ error = ovs_nla_copy_actions(a, &masked_key, 0, &acts);
+ if (error) {
+ OVS_NLERR("Flow actions may not be safe on all matching packets.\n");
+diff --git a/net/openvswitch/flow_table.c b/net/openvswitch/flow_table.c
+index cf2d853646f0..740041a09b9d 100644
+--- a/net/openvswitch/flow_table.c
++++ b/net/openvswitch/flow_table.c
+@@ -56,20 +56,21 @@ static u16 range_n_bytes(const struct sw_flow_key_range *range)
+ }
+
+ void ovs_flow_mask_key(struct sw_flow_key *dst, const struct sw_flow_key *src,
+- const struct sw_flow_mask *mask)
++ bool full, const struct sw_flow_mask *mask)
+ {
+- const long *m = (const long *)((const u8 *)&mask->key +
+- mask->range.start);
+- const long *s = (const long *)((const u8 *)src +
+- mask->range.start);
+- long *d = (long *)((u8 *)dst + mask->range.start);
++ int start = full ? 0 : mask->range.start;
++ int len = full ? sizeof *dst : range_n_bytes(&mask->range);
++ const long *m = (const long *)((const u8 *)&mask->key + start);
++ const long *s = (const long *)((const u8 *)src + start);
++ long *d = (long *)((u8 *)dst + start);
+ int i;
+
+- /* The memory outside of the 'mask->range' are not set since
+- * further operations on 'dst' only uses contents within
+- * 'mask->range'.
++ /* If 'full' is true then all of 'dst' is fully initialized. Otherwise,
++ * if 'full' is false the memory outside of the 'mask->range' is left
++ * uninitialized. This can be used as an optimization when further
++ * operations on 'dst' only use contents within 'mask->range'.
+ */
+- for (i = 0; i < range_n_bytes(&mask->range); i += sizeof(long))
++ for (i = 0; i < len; i += sizeof(long))
+ *d++ = *s++ & *m++;
+ }
+
+@@ -418,7 +419,7 @@ static struct sw_flow *masked_flow_lookup(struct table_instance *ti,
+ u32 hash;
+ struct sw_flow_key masked_key;
+
+- ovs_flow_mask_key(&masked_key, unmasked, mask);
++ ovs_flow_mask_key(&masked_key, unmasked, false, mask);
+ hash = flow_hash(&masked_key, key_start, key_end);
+ head = find_bucket(ti, hash);
+ hlist_for_each_entry_rcu(flow, head, hash_node[ti->node_ver]) {
+diff --git a/net/openvswitch/flow_table.h b/net/openvswitch/flow_table.h
+index 5918bff7f3f6..2f0cf200ede9 100644
+--- a/net/openvswitch/flow_table.h
++++ b/net/openvswitch/flow_table.h
+@@ -82,5 +82,5 @@ bool ovs_flow_cmp_unmasked_key(const struct sw_flow *flow,
+ struct sw_flow_match *match);
+
+ void ovs_flow_mask_key(struct sw_flow_key *dst, const struct sw_flow_key *src,
+- const struct sw_flow_mask *mask);
++ bool full, const struct sw_flow_mask *mask);
+ #endif /* flow_table.h */
+diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
+index 5dcfe05ea232..bf6097793170 100644
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -2645,7 +2645,7 @@ static int packet_release(struct socket *sock)
+ static int packet_do_bind(struct sock *sk, struct net_device *dev, __be16 proto)
+ {
+ struct packet_sock *po = pkt_sk(sk);
+- const struct net_device *dev_curr;
++ struct net_device *dev_curr;
+ __be16 proto_curr;
+ bool need_rehook;
+
+@@ -2669,15 +2669,13 @@ static int packet_do_bind(struct sock *sk, struct net_device *dev, __be16 proto)
+
+ po->num = proto;
+ po->prot_hook.type = proto;
+-
+- if (po->prot_hook.dev)
+- dev_put(po->prot_hook.dev);
+-
+ po->prot_hook.dev = dev;
+
+ po->ifindex = dev ? dev->ifindex : 0;
+ packet_cached_dev_assign(po, dev);
+ }
++ if (dev_curr)
++ dev_put(dev_curr);
+
+ if (proto == 0 || !need_rehook)
+ goto out_unlock;
+diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c
+index 8f34b27d5775..143c4ebd55fa 100644
+--- a/net/sctp/protocol.c
++++ b/net/sctp/protocol.c
+@@ -1166,7 +1166,7 @@ static void sctp_v4_del_protocol(void)
+ unregister_inetaddr_notifier(&sctp_inetaddr_notifier);
+ }
+
+-static int __net_init sctp_net_init(struct net *net)
++static int __net_init sctp_defaults_init(struct net *net)
+ {
+ int status;
+
+@@ -1259,12 +1259,6 @@ static int __net_init sctp_net_init(struct net *net)
+
+ sctp_dbg_objcnt_init(net);
+
+- /* Initialize the control inode/socket for handling OOTB packets. */
+- if ((status = sctp_ctl_sock_init(net))) {
+- pr_err("Failed to initialize the SCTP control sock\n");
+- goto err_ctl_sock_init;
+- }
+-
+ /* Initialize the local address list. */
+ INIT_LIST_HEAD(&net->sctp.local_addr_list);
+ spin_lock_init(&net->sctp.local_addr_lock);
+@@ -1280,9 +1274,6 @@ static int __net_init sctp_net_init(struct net *net)
+
+ return 0;
+
+-err_ctl_sock_init:
+- sctp_dbg_objcnt_exit(net);
+- sctp_proc_exit(net);
+ err_init_proc:
+ cleanup_sctp_mibs(net);
+ err_init_mibs:
+@@ -1291,15 +1282,12 @@ err_sysctl_register:
+ return status;
+ }
+
+-static void __net_exit sctp_net_exit(struct net *net)
++static void __net_exit sctp_defaults_exit(struct net *net)
+ {
+ /* Free the local address list */
+ sctp_free_addr_wq(net);
+ sctp_free_local_addr_list(net);
+
+- /* Free the control endpoint. */
+- inet_ctl_sock_destroy(net->sctp.ctl_sock);
+-
+ sctp_dbg_objcnt_exit(net);
+
+ sctp_proc_exit(net);
+@@ -1307,9 +1295,32 @@ static void __net_exit sctp_net_exit(struct net *net)
+ sctp_sysctl_net_unregister(net);
+ }
+
+-static struct pernet_operations sctp_net_ops = {
+- .init = sctp_net_init,
+- .exit = sctp_net_exit,
++static struct pernet_operations sctp_defaults_ops = {
++ .init = sctp_defaults_init,
++ .exit = sctp_defaults_exit,
++};
++
++static int __net_init sctp_ctrlsock_init(struct net *net)
++{
++ int status;
++
++ /* Initialize the control inode/socket for handling OOTB packets. */
++ status = sctp_ctl_sock_init(net);
++ if (status)
++ pr_err("Failed to initialize the SCTP control sock\n");
++
++ return status;
++}
++
++static void __net_init sctp_ctrlsock_exit(struct net *net)
++{
++ /* Free the control endpoint. */
++ inet_ctl_sock_destroy(net->sctp.ctl_sock);
++}
++
++static struct pernet_operations sctp_ctrlsock_ops = {
++ .init = sctp_ctrlsock_init,
++ .exit = sctp_ctrlsock_exit,
+ };
+
+ /* Initialize the universe into something sensible. */
+@@ -1443,8 +1454,11 @@ static __init int sctp_init(void)
+ sctp_v4_pf_init();
+ sctp_v6_pf_init();
+
+- status = sctp_v4_protosw_init();
++ status = register_pernet_subsys(&sctp_defaults_ops);
++ if (status)
++ goto err_register_defaults;
+
++ status = sctp_v4_protosw_init();
+ if (status)
+ goto err_protosw_init;
+
+@@ -1452,9 +1466,9 @@ static __init int sctp_init(void)
+ if (status)
+ goto err_v6_protosw_init;
+
+- status = register_pernet_subsys(&sctp_net_ops);
++ status = register_pernet_subsys(&sctp_ctrlsock_ops);
+ if (status)
+- goto err_register_pernet_subsys;
++ goto err_register_ctrlsock;
+
+ status = sctp_v4_add_protocol();
+ if (status)
+@@ -1470,12 +1484,14 @@ out:
+ err_v6_add_protocol:
+ sctp_v4_del_protocol();
+ err_add_protocol:
+- unregister_pernet_subsys(&sctp_net_ops);
+-err_register_pernet_subsys:
++ unregister_pernet_subsys(&sctp_ctrlsock_ops);
++err_register_ctrlsock:
+ sctp_v6_protosw_exit();
+ err_v6_protosw_init:
+ sctp_v4_protosw_exit();
+ err_protosw_init:
++ unregister_pernet_subsys(&sctp_defaults_ops);
++err_register_defaults:
+ sctp_v4_pf_exit();
+ sctp_v6_pf_exit();
+ sctp_sysctl_unregister();
+@@ -1508,12 +1524,14 @@ static __exit void sctp_exit(void)
+ sctp_v6_del_protocol();
+ sctp_v4_del_protocol();
+
+- unregister_pernet_subsys(&sctp_net_ops);
++ unregister_pernet_subsys(&sctp_ctrlsock_ops);
+
+ /* Free protosw registrations */
+ sctp_v6_protosw_exit();
+ sctp_v4_protosw_exit();
+
++ unregister_pernet_subsys(&sctp_defaults_ops);
++
+ /* Unregister with socket layer. */
+ sctp_v6_pf_exit();
+ sctp_v4_pf_exit();
+diff --git a/net/sunrpc/xprtrdma/svc_rdma_sendto.c b/net/sunrpc/xprtrdma/svc_rdma_sendto.c
+index 9f1b50689c0f..03252a652e4b 100644
+--- a/net/sunrpc/xprtrdma/svc_rdma_sendto.c
++++ b/net/sunrpc/xprtrdma/svc_rdma_sendto.c
+@@ -372,6 +372,7 @@ static int send_reply(struct svcxprt_rdma *rdma,
+ int byte_count)
+ {
+ struct ib_send_wr send_wr;
++ u32 xdr_off;
+ int sge_no;
+ int sge_bytes;
+ int page_no;
+@@ -406,8 +407,8 @@ static int send_reply(struct svcxprt_rdma *rdma,
+ ctxt->direction = DMA_TO_DEVICE;
+
+ /* Map the payload indicated by 'byte_count' */
++ xdr_off = 0;
+ for (sge_no = 1; byte_count && sge_no < vec->count; sge_no++) {
+- int xdr_off = 0;
+ sge_bytes = min_t(size_t, vec->sge[sge_no].iov_len, byte_count);
+ byte_count -= sge_bytes;
+ ctxt->sge[sge_no].addr =
+@@ -443,6 +444,14 @@ static int send_reply(struct svcxprt_rdma *rdma,
+ rqstp->rq_next_page = rqstp->rq_respages + 1;
+
+ BUG_ON(sge_no > rdma->sc_max_sge);
++
++ /* The loop above bumps sc_dma_used for each sge. The
++ * xdr_buf.tail gets a separate sge, but resides in the
++ * same page as xdr_buf.head. Don't count it twice.
++ */
++ if (sge_no > ctxt->count)
++ atomic_dec(&rdma->sc_dma_used);
++
+ memset(&send_wr, 0, sizeof send_wr);
+ ctxt->wr_op = IB_WR_SEND;
+ send_wr.wr_id = (unsigned long)ctxt;
+diff --git a/sound/arm/Kconfig b/sound/arm/Kconfig
+index 885683a3b0bd..e0406211716b 100644
+--- a/sound/arm/Kconfig
++++ b/sound/arm/Kconfig
+@@ -9,6 +9,14 @@ menuconfig SND_ARM
+ Drivers that are implemented on ASoC can be found in
+ "ALSA for SoC audio support" section.
+
++config SND_PXA2XX_LIB
++ tristate
++ select SND_AC97_CODEC if SND_PXA2XX_LIB_AC97
++ select SND_DMAENGINE_PCM
++
++config SND_PXA2XX_LIB_AC97
++ bool
++
+ if SND_ARM
+
+ config SND_ARMAACI
+@@ -21,13 +29,6 @@ config SND_PXA2XX_PCM
+ tristate
+ select SND_PCM
+
+-config SND_PXA2XX_LIB
+- tristate
+- select SND_AC97_CODEC if SND_PXA2XX_LIB_AC97
+-
+-config SND_PXA2XX_LIB_AC97
+- bool
+-
+ config SND_PXA2XX_AC97
+ tristate "AC97 driver for the Intel PXA2xx chip"
+ depends on ARCH_PXA
+diff --git a/sound/pci/hda/patch_cirrus.c b/sound/pci/hda/patch_cirrus.c
+index e5dac8ea65e4..1b3b38d025fc 100644
+--- a/sound/pci/hda/patch_cirrus.c
++++ b/sound/pci/hda/patch_cirrus.c
+@@ -634,6 +634,7 @@ static const struct snd_pci_quirk cs4208_mac_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x106b, 0x5e00, "MacBookPro 11,2", CS4208_MBP11),
+ SND_PCI_QUIRK(0x106b, 0x7100, "MacBookAir 6,1", CS4208_MBA6),
+ SND_PCI_QUIRK(0x106b, 0x7200, "MacBookAir 6,2", CS4208_MBA6),
++ SND_PCI_QUIRK(0x106b, 0x7b00, "MacBookPro 12,1", CS4208_MBP11),
+ {} /* terminator */
+ };
+
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index f979293b421a..d36cdb27a02c 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -1131,7 +1131,7 @@ static const struct hda_fixup alc880_fixups[] = {
+ /* override all pins as BIOS on old Amilo is broken */
+ .type = HDA_FIXUP_PINS,
+ .v.pins = (const struct hda_pintbl[]) {
+- { 0x14, 0x0121411f }, /* HP */
++ { 0x14, 0x0121401f }, /* HP */
+ { 0x15, 0x99030120 }, /* speaker */
+ { 0x16, 0x99030130 }, /* bass speaker */
+ { 0x17, 0x411111f0 }, /* N/A */
+@@ -1151,7 +1151,7 @@ static const struct hda_fixup alc880_fixups[] = {
+ /* almost compatible with FUJITSU, but no bass and SPDIF */
+ .type = HDA_FIXUP_PINS,
+ .v.pins = (const struct hda_pintbl[]) {
+- { 0x14, 0x0121411f }, /* HP */
++ { 0x14, 0x0121401f }, /* HP */
+ { 0x15, 0x99030120 }, /* speaker */
+ { 0x16, 0x411111f0 }, /* N/A */
+ { 0x17, 0x411111f0 }, /* N/A */
+@@ -1360,7 +1360,7 @@ static const struct snd_pci_quirk alc880_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x161f, 0x203d, "W810", ALC880_FIXUP_W810),
+ SND_PCI_QUIRK(0x161f, 0x205d, "Medion Rim 2150", ALC880_FIXUP_MEDION_RIM),
+ SND_PCI_QUIRK(0x1631, 0xe011, "PB 13201056", ALC880_FIXUP_6ST_AUTOMUTE),
+- SND_PCI_QUIRK(0x1734, 0x107c, "FSC F1734", ALC880_FIXUP_F1734),
++ SND_PCI_QUIRK(0x1734, 0x107c, "FSC Amilo M1437", ALC880_FIXUP_FUJITSU),
+ SND_PCI_QUIRK(0x1734, 0x1094, "FSC Amilo M1451G", ALC880_FIXUP_FUJITSU),
+ SND_PCI_QUIRK(0x1734, 0x10ac, "FSC AMILO Xi 1526", ALC880_FIXUP_F1734),
+ SND_PCI_QUIRK(0x1734, 0x10b0, "FSC Amilo Pi1556", ALC880_FIXUP_FUJITSU),
+@@ -5050,6 +5050,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x17aa, 0x2212, "Thinkpad T440", ALC292_FIXUP_TPT440_DOCK),
+ SND_PCI_QUIRK(0x17aa, 0x2214, "Thinkpad X240", ALC292_FIXUP_TPT440_DOCK),
+ SND_PCI_QUIRK(0x17aa, 0x2215, "Thinkpad", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
++ SND_PCI_QUIRK(0x17aa, 0x2223, "ThinkPad T550", ALC292_FIXUP_TPT440_DOCK),
+ SND_PCI_QUIRK(0x17aa, 0x2226, "ThinkPad X250", ALC292_FIXUP_TPT440_DOCK),
+ SND_PCI_QUIRK(0x17aa, 0x3977, "IdeaPad S210", ALC283_FIXUP_INT_MIC),
+ SND_PCI_QUIRK(0x17aa, 0x3978, "IdeaPad Y410P", ALC269_FIXUP_NO_SHUTUP),
+diff --git a/sound/soc/dwc/designware_i2s.c b/sound/soc/dwc/designware_i2s.c
+index 10e1b8ca42ed..8086f3da5de8 100644
+--- a/sound/soc/dwc/designware_i2s.c
++++ b/sound/soc/dwc/designware_i2s.c
+@@ -100,10 +100,10 @@ static inline void i2s_clear_irqs(struct dw_i2s_dev *dev, u32 stream)
+
+ if (stream == SNDRV_PCM_STREAM_PLAYBACK) {
+ for (i = 0; i < 4; i++)
+- i2s_write_reg(dev->i2s_base, TOR(i), 0);
++ i2s_read_reg(dev->i2s_base, TOR(i));
+ } else {
+ for (i = 0; i < 4; i++)
+- i2s_write_reg(dev->i2s_base, ROR(i), 0);
++ i2s_read_reg(dev->i2s_base, ROR(i));
+ }
+ }
+
+diff --git a/sound/soc/pxa/Kconfig b/sound/soc/pxa/Kconfig
+index 2434b6d61675..e1f501b46c9d 100644
+--- a/sound/soc/pxa/Kconfig
++++ b/sound/soc/pxa/Kconfig
+@@ -1,7 +1,6 @@
+ config SND_PXA2XX_SOC
+ tristate "SoC Audio for the Intel PXA2xx chip"
+ depends on ARCH_PXA
+- select SND_ARM
+ select SND_PXA2XX_LIB
+ help
+ Say Y or M if you want to add support for codecs attached to
+@@ -25,7 +24,6 @@ config SND_PXA2XX_AC97
+ config SND_PXA2XX_SOC_AC97
+ tristate
+ select AC97_BUS
+- select SND_ARM
+ select SND_PXA2XX_LIB_AC97
+ select SND_SOC_AC97_BUS
+
+diff --git a/sound/soc/pxa/pxa2xx-ac97.c b/sound/soc/pxa/pxa2xx-ac97.c
+index ae956e3f4b9d..593e3202fc35 100644
+--- a/sound/soc/pxa/pxa2xx-ac97.c
++++ b/sound/soc/pxa/pxa2xx-ac97.c
+@@ -49,7 +49,7 @@ static struct snd_ac97_bus_ops pxa2xx_ac97_ops = {
+ .reset = pxa2xx_ac97_cold_reset,
+ };
+
+-static unsigned long pxa2xx_ac97_pcm_stereo_in_req = 12;
++static unsigned long pxa2xx_ac97_pcm_stereo_in_req = 11;
+ static struct snd_dmaengine_dai_dma_data pxa2xx_ac97_pcm_stereo_in = {
+ .addr = __PREG(PCDR),
+ .addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES,
+@@ -57,7 +57,7 @@ static struct snd_dmaengine_dai_dma_data pxa2xx_ac97_pcm_stereo_in = {
+ .filter_data = &pxa2xx_ac97_pcm_stereo_in_req,
+ };
+
+-static unsigned long pxa2xx_ac97_pcm_stereo_out_req = 11;
++static unsigned long pxa2xx_ac97_pcm_stereo_out_req = 12;
+ static struct snd_dmaengine_dai_dma_data pxa2xx_ac97_pcm_stereo_out = {
+ .addr = __PREG(PCDR),
+ .addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES,
+diff --git a/sound/synth/emux/emux_oss.c b/sound/synth/emux/emux_oss.c
+index daf61abc3670..646b66703bd8 100644
+--- a/sound/synth/emux/emux_oss.c
++++ b/sound/synth/emux/emux_oss.c
+@@ -69,7 +69,8 @@ snd_emux_init_seq_oss(struct snd_emux *emu)
+ struct snd_seq_oss_reg *arg;
+ struct snd_seq_device *dev;
+
+- if (snd_seq_device_new(emu->card, 0, SNDRV_SEQ_DEV_ID_OSS,
++ /* using device#1 here for avoiding conflicts with OPL3 */
++ if (snd_seq_device_new(emu->card, 1, SNDRV_SEQ_DEV_ID_OSS,
+ sizeof(struct snd_seq_oss_reg), &dev) < 0)
+ return;
+
+diff --git a/tools/lib/traceevent/event-parse.c b/tools/lib/traceevent/event-parse.c
+index cf3a44bf1ec3..dfb8be78ff75 100644
+--- a/tools/lib/traceevent/event-parse.c
++++ b/tools/lib/traceevent/event-parse.c
+@@ -3658,7 +3658,7 @@ static void print_str_arg(struct trace_seq *s, void *data, int size,
+ struct format_field *field;
+ struct printk_map *printk;
+ unsigned long long val, fval;
+- unsigned long addr;
++ unsigned long long addr;
+ char *str;
+ unsigned char *hex;
+ int print;
+@@ -3691,13 +3691,30 @@ static void print_str_arg(struct trace_seq *s, void *data, int size,
+ */
+ if (!(field->flags & FIELD_IS_ARRAY) &&
+ field->size == pevent->long_size) {
+- addr = *(unsigned long *)(data + field->offset);
++
++ /* Handle heterogeneous recording and processing
++ * architectures
++ *
++ * CASE I:
++ * Traces recorded on 32-bit devices (32-bit
++ * addressing) and processed on 64-bit devices:
++ * In this case, only 32 bits should be read.
++ *
++ * CASE II:
++ * Traces recorded on 64 bit devices and processed
++ * on 32-bit devices:
++ * In this case, 64 bits must be read.
++ */
++ addr = (pevent->long_size == 8) ?
++ *(unsigned long long *)(data + field->offset) :
++ (unsigned long long)*(unsigned int *)(data + field->offset);
++
+ /* Check if it matches a print format */
+ printk = find_printk(pevent, addr);
+ if (printk)
+ trace_seq_puts(s, printk->printk);
+ else
+- trace_seq_printf(s, "%lx", addr);
++ trace_seq_printf(s, "%llx", addr);
+ break;
+ }
+ str = malloc(len + 1);
+diff --git a/tools/perf/builtin-stat.c b/tools/perf/builtin-stat.c
+index 055ce9232c9e..66c9fc730a14 100644
+--- a/tools/perf/builtin-stat.c
++++ b/tools/perf/builtin-stat.c
+@@ -1117,7 +1117,7 @@ static void abs_printout(int id, int nr, struct perf_evsel *evsel, double avg)
+ static void print_aggr(char *prefix)
+ {
+ struct perf_evsel *counter;
+- int cpu, cpu2, s, s2, id, nr;
++ int cpu, s, s2, id, nr;
+ double uval;
+ u64 ena, run, val;
+
+@@ -1130,8 +1130,7 @@ static void print_aggr(char *prefix)
+ val = ena = run = 0;
+ nr = 0;
+ for (cpu = 0; cpu < perf_evsel__nr_cpus(counter); cpu++) {
+- cpu2 = perf_evsel__cpus(counter)->map[cpu];
+- s2 = aggr_get_id(evsel_list->cpus, cpu2);
++ s2 = aggr_get_id(perf_evsel__cpus(counter), cpu);
+ if (s2 != id)
+ continue;
+ val += counter->counts->cpu[cpu].val;
+diff --git a/tools/perf/util/header.c b/tools/perf/util/header.c
+index 26f5b2fe5dc8..74caa262ace5 100644
+--- a/tools/perf/util/header.c
++++ b/tools/perf/util/header.c
+@@ -1775,7 +1775,7 @@ static int process_nrcpus(struct perf_file_section *section __maybe_unused,
+ if (ph->needs_swap)
+ nr = bswap_32(nr);
+
+- ph->env.nr_cpus_online = nr;
++ ph->env.nr_cpus_avail = nr;
+
+ ret = readn(fd, &nr, sizeof(nr));
+ if (ret != sizeof(nr))
+@@ -1784,7 +1784,7 @@ static int process_nrcpus(struct perf_file_section *section __maybe_unused,
+ if (ph->needs_swap)
+ nr = bswap_32(nr);
+
+- ph->env.nr_cpus_avail = nr;
++ ph->env.nr_cpus_online = nr;
+ return 0;
+ }
+
+diff --git a/tools/perf/util/hist.c b/tools/perf/util/hist.c
+index 6e88b9e395df..06868c61f8dd 100644
+--- a/tools/perf/util/hist.c
++++ b/tools/perf/util/hist.c
+@@ -150,6 +150,9 @@ void hists__calc_col_len(struct hists *hists, struct hist_entry *h)
+ hists__new_col_len(hists, HISTC_LOCAL_WEIGHT, 12);
+ hists__new_col_len(hists, HISTC_GLOBAL_WEIGHT, 12);
+
++ if (h->srcline)
++ hists__new_col_len(hists, HISTC_SRCLINE, strlen(h->srcline));
++
+ if (h->transaction)
+ hists__new_col_len(hists, HISTC_TRANSACTION,
+ hist_entry__transaction_len());
+diff --git a/tools/perf/util/symbol-elf.c b/tools/perf/util/symbol-elf.c
+index fcaf06b40558..194300a08197 100644
+--- a/tools/perf/util/symbol-elf.c
++++ b/tools/perf/util/symbol-elf.c
+@@ -1166,8 +1166,6 @@ out_close:
+ static int kcore__init(struct kcore *kcore, char *filename, int elfclass,
+ bool temp)
+ {
+- GElf_Ehdr *ehdr;
+-
+ kcore->elfclass = elfclass;
+
+ if (temp)
+@@ -1184,9 +1182,7 @@ static int kcore__init(struct kcore *kcore, char *filename, int elfclass,
+ if (!gelf_newehdr(kcore->elf, elfclass))
+ goto out_end;
+
+- ehdr = gelf_getehdr(kcore->elf, &kcore->ehdr);
+- if (!ehdr)
+- goto out_end;
++ memset(&kcore->ehdr, 0, sizeof(GElf_Ehdr));
+
+ return 0;
+
+@@ -1243,23 +1239,18 @@ static int kcore__copy_hdr(struct kcore *from, struct kcore *to, size_t count)
+ static int kcore__add_phdr(struct kcore *kcore, int idx, off_t offset,
+ u64 addr, u64 len)
+ {
+- GElf_Phdr gphdr;
+- GElf_Phdr *phdr;
+-
+- phdr = gelf_getphdr(kcore->elf, idx, &gphdr);
+- if (!phdr)
+- return -1;
+-
+- phdr->p_type = PT_LOAD;
+- phdr->p_flags = PF_R | PF_W | PF_X;
+- phdr->p_offset = offset;
+- phdr->p_vaddr = addr;
+- phdr->p_paddr = 0;
+- phdr->p_filesz = len;
+- phdr->p_memsz = len;
+- phdr->p_align = page_size;
+-
+- if (!gelf_update_phdr(kcore->elf, idx, phdr))
++ GElf_Phdr phdr = {
++ .p_type = PT_LOAD,
++ .p_flags = PF_R | PF_W | PF_X,
++ .p_offset = offset,
++ .p_vaddr = addr,
++ .p_paddr = 0,
++ .p_filesz = len,
++ .p_memsz = len,
++ .p_align = page_size,
++ };
++
++ if (!gelf_update_phdr(kcore->elf, idx, &phdr))
+ return -1;
+
+ return 0;
+diff --git a/virt/kvm/eventfd.c b/virt/kvm/eventfd.c
+index b0fb390943c6..5a310caf4bbe 100644
+--- a/virt/kvm/eventfd.c
++++ b/virt/kvm/eventfd.c
+@@ -775,40 +775,14 @@ static enum kvm_bus ioeventfd_bus_from_flags(__u32 flags)
+ return KVM_MMIO_BUS;
+ }
+
+-static int
+-kvm_assign_ioeventfd(struct kvm *kvm, struct kvm_ioeventfd *args)
++static int kvm_assign_ioeventfd_idx(struct kvm *kvm,
++ enum kvm_bus bus_idx,
++ struct kvm_ioeventfd *args)
+ {
+- enum kvm_bus bus_idx;
+- struct _ioeventfd *p;
+- struct eventfd_ctx *eventfd;
+- int ret;
+-
+- bus_idx = ioeventfd_bus_from_flags(args->flags);
+- /* must be natural-word sized, or 0 to ignore length */
+- switch (args->len) {
+- case 0:
+- case 1:
+- case 2:
+- case 4:
+- case 8:
+- break;
+- default:
+- return -EINVAL;
+- }
+-
+- /* check for range overflow */
+- if (args->addr + args->len < args->addr)
+- return -EINVAL;
+
+- /* check for extra flags that we don't understand */
+- if (args->flags & ~KVM_IOEVENTFD_VALID_FLAG_MASK)
+- return -EINVAL;
+-
+- /* ioeventfd with no length can't be combined with DATAMATCH */
+- if (!args->len &&
+- args->flags & (KVM_IOEVENTFD_FLAG_PIO |
+- KVM_IOEVENTFD_FLAG_DATAMATCH))
+- return -EINVAL;
++ struct eventfd_ctx *eventfd;
++ struct _ioeventfd *p;
++ int ret;
+
+ eventfd = eventfd_ctx_fdget(args->fd);
+ if (IS_ERR(eventfd))
+@@ -847,16 +821,6 @@ kvm_assign_ioeventfd(struct kvm *kvm, struct kvm_ioeventfd *args)
+ if (ret < 0)
+ goto unlock_fail;
+
+- /* When length is ignored, MMIO is also put on a separate bus, for
+- * faster lookups.
+- */
+- if (!args->len && !(args->flags & KVM_IOEVENTFD_FLAG_PIO)) {
+- ret = kvm_io_bus_register_dev(kvm, KVM_FAST_MMIO_BUS,
+- p->addr, 0, &p->dev);
+- if (ret < 0)
+- goto register_fail;
+- }
+-
+ kvm->buses[bus_idx]->ioeventfd_count++;
+ list_add_tail(&p->list, &kvm->ioeventfds);
+
+@@ -864,8 +828,6 @@ kvm_assign_ioeventfd(struct kvm *kvm, struct kvm_ioeventfd *args)
+
+ return 0;
+
+-register_fail:
+- kvm_io_bus_unregister_dev(kvm, bus_idx, &p->dev);
+ unlock_fail:
+ mutex_unlock(&kvm->slots_lock);
+
+@@ -877,14 +839,13 @@ fail:
+ }
+
+ static int
+-kvm_deassign_ioeventfd(struct kvm *kvm, struct kvm_ioeventfd *args)
++kvm_deassign_ioeventfd_idx(struct kvm *kvm, enum kvm_bus bus_idx,
++ struct kvm_ioeventfd *args)
+ {
+- enum kvm_bus bus_idx;
+ struct _ioeventfd *p, *tmp;
+ struct eventfd_ctx *eventfd;
+ int ret = -ENOENT;
+
+- bus_idx = ioeventfd_bus_from_flags(args->flags);
+ eventfd = eventfd_ctx_fdget(args->fd);
+ if (IS_ERR(eventfd))
+ return PTR_ERR(eventfd);
+@@ -905,10 +866,6 @@ kvm_deassign_ioeventfd(struct kvm *kvm, struct kvm_ioeventfd *args)
+ continue;
+
+ kvm_io_bus_unregister_dev(kvm, bus_idx, &p->dev);
+- if (!p->length) {
+- kvm_io_bus_unregister_dev(kvm, KVM_FAST_MMIO_BUS,
+- &p->dev);
+- }
+ kvm->buses[bus_idx]->ioeventfd_count--;
+ ioeventfd_release(p);
+ ret = 0;
+@@ -922,6 +879,71 @@ kvm_deassign_ioeventfd(struct kvm *kvm, struct kvm_ioeventfd *args)
+ return ret;
+ }
+
++static int kvm_deassign_ioeventfd(struct kvm *kvm, struct kvm_ioeventfd *args)
++{
++ enum kvm_bus bus_idx = ioeventfd_bus_from_flags(args->flags);
++ int ret = kvm_deassign_ioeventfd_idx(kvm, bus_idx, args);
++
++ if (!args->len && bus_idx == KVM_MMIO_BUS)
++ kvm_deassign_ioeventfd_idx(kvm, KVM_FAST_MMIO_BUS, args);
++
++ return ret;
++}
++
++static int
++kvm_assign_ioeventfd(struct kvm *kvm, struct kvm_ioeventfd *args)
++{
++ enum kvm_bus bus_idx;
++ int ret;
++
++ bus_idx = ioeventfd_bus_from_flags(args->flags);
++ /* must be natural-word sized, or 0 to ignore length */
++ switch (args->len) {
++ case 0:
++ case 1:
++ case 2:
++ case 4:
++ case 8:
++ break;
++ default:
++ return -EINVAL;
++ }
++
++ /* check for range overflow */
++ if (args->addr + args->len < args->addr)
++ return -EINVAL;
++
++ /* check for extra flags that we don't understand */
++ if (args->flags & ~KVM_IOEVENTFD_VALID_FLAG_MASK)
++ return -EINVAL;
++
++ /* ioeventfd with no length can't be combined with DATAMATCH */
++ if (!args->len &&
++ args->flags & (KVM_IOEVENTFD_FLAG_PIO |
++ KVM_IOEVENTFD_FLAG_DATAMATCH))
++ return -EINVAL;
++
++ ret = kvm_assign_ioeventfd_idx(kvm, bus_idx, args);
++ if (ret)
++ goto fail;
++
++ /* When length is ignored, MMIO is also put on a separate bus, for
++ * faster lookups.
++ */
++ if (!args->len && bus_idx == KVM_MMIO_BUS) {
++ ret = kvm_assign_ioeventfd_idx(kvm, KVM_FAST_MMIO_BUS, args);
++ if (ret < 0)
++ goto fast_fail;
++ }
++
++ return 0;
++
++fast_fail:
++ kvm_deassign_ioeventfd_idx(kvm, bus_idx, args);
++fail:
++ return ret;
++}
++
+ int
+ kvm_ioeventfd(struct kvm *kvm, struct kvm_ioeventfd *args)
+ {
+diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
+index 4e52bb926374..329c3c91bb68 100644
+--- a/virt/kvm/kvm_main.c
++++ b/virt/kvm/kvm_main.c
+@@ -2875,10 +2875,25 @@ static void kvm_io_bus_destroy(struct kvm_io_bus *bus)
+ static inline int kvm_io_bus_cmp(const struct kvm_io_range *r1,
+ const struct kvm_io_range *r2)
+ {
+- if (r1->addr < r2->addr)
++ gpa_t addr1 = r1->addr;
++ gpa_t addr2 = r2->addr;
++
++ if (addr1 < addr2)
+ return -1;
+- if (r1->addr + r1->len > r2->addr + r2->len)
++
++ /* If r2->len == 0, match the exact address. If r2->len != 0,
++ * accept any overlapping write. Any order is acceptable for
++ * overlapping ranges, because kvm_io_bus_get_first_dev ensures
++ * we process all of them.
++ */
++ if (r2->len) {
++ addr1 += r1->len;
++ addr2 += r2->len;
++ }
++
++ if (addr1 > addr2)
+ return 1;
++
+ return 0;
+ }
+
^ permalink raw reply related [flat|nested] 67+ messages in thread
* [gentoo-commits] proj/linux-patches:3.18 commit in: /
@ 2015-11-03 18:39 Mike Pagano
0 siblings, 0 replies; 67+ messages in thread
From: Mike Pagano @ 2015-11-03 18:39 UTC (permalink / raw
To: gentoo-commits
commit: 22cf0359e3a1f6a2406230bdd75bb7a63c3212d0
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Tue Nov 3 18:39:46 2015 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Tue Nov 3 18:39:46 2015 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=22cf0359
Linux patch 3.18.24
0000_README | 4 ++++
1023_linux-3.18.24.patch | 24 ++++++++++++++++++++++++
2 files changed, 28 insertions(+)
diff --git a/0000_README b/0000_README
index 84e11a6..d829823 100644
--- a/0000_README
+++ b/0000_README
@@ -135,6 +135,10 @@ Patch: 1022_linux-3.18.23.patch
From: http://www.kernel.org
Desc: Linux 3.18.23
+Patch: 1023_linux-3.18.24.patch
+From: http://www.kernel.org
+Desc: Linux 3.18.24
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1023_linux-3.18.24.patch b/1023_linux-3.18.24.patch
new file mode 100644
index 0000000..bed3a75
--- /dev/null
+++ b/1023_linux-3.18.24.patch
@@ -0,0 +1,24 @@
+diff --git a/Makefile b/Makefile
+index 2ebc49903d33..9769e3bce6a2 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 18
+-SUBLEVEL = 23
++SUBLEVEL = 24
+ EXTRAVERSION =
+ NAME = Diseased Newt
+
+diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c
+index fea7d905e77c..04e7d8e38c53 100644
+--- a/drivers/tty/n_tty.c
++++ b/drivers/tty/n_tty.c
+@@ -364,7 +364,6 @@ static void n_tty_packet_mode_flush(struct tty_struct *tty)
+ spin_lock_irqsave(&tty->ctrl_lock, flags);
+ if (tty->link->packet) {
+ tty->ctrl_status |= TIOCPKT_FLUSHREAD;
+- spin_unlock_irqrestore(&tty->ctrl_lock, flags);
+ wake_up_interruptible(&tty->link->read_wait);
+ }
+ spin_unlock_irqrestore(&tty->ctrl_lock, flags);
^ permalink raw reply related [flat|nested] 67+ messages in thread
* [gentoo-commits] proj/linux-patches:3.18 commit in: /
@ 2015-12-17 17:12 Mike Pagano
0 siblings, 0 replies; 67+ messages in thread
From: Mike Pagano @ 2015-12-17 17:12 UTC (permalink / raw
To: gentoo-commits
commit: 7302e8593ad28569d4ce2175a02536b1cdd4b909
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Thu Dec 17 17:12:14 2015 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Thu Dec 17 17:12:14 2015 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=7302e859
Linux patch 3.18.25
0000_README | 4 +
1024_linux-3.18.25.patch | 4339 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 4343 insertions(+)
diff --git a/0000_README b/0000_README
index d829823..369ed3d 100644
--- a/0000_README
+++ b/0000_README
@@ -139,6 +139,10 @@ Patch: 1023_linux-3.18.24.patch
From: http://www.kernel.org
Desc: Linux 3.18.24
+Patch: 1024_linux-3.18.25.patch
+From: http://www.kernel.org
+Desc: Linux 3.18.25
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1024_linux-3.18.25.patch b/1024_linux-3.18.25.patch
new file mode 100644
index 0000000..dba2da3
--- /dev/null
+++ b/1024_linux-3.18.25.patch
@@ -0,0 +1,4339 @@
+diff --git a/Makefile b/Makefile
+index 9769e3bce6a2..6df25277ea44 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 18
+-SUBLEVEL = 24
++SUBLEVEL = 25
+ EXTRAVERSION =
+ NAME = Diseased Newt
+
+diff --git a/arch/arm/plat-orion/common.c b/arch/arm/plat-orion/common.c
+index f5b00f41c4f6..b8b6e22f9987 100644
+--- a/arch/arm/plat-orion/common.c
++++ b/arch/arm/plat-orion/common.c
+@@ -499,7 +499,7 @@ void __init orion_ge00_switch_init(struct dsa_platform_data *d, int irq)
+
+ d->netdev = &orion_ge00.dev;
+ for (i = 0; i < d->nr_chips; i++)
+- d->chip[i].host_dev = &orion_ge00_shared.dev;
++ d->chip[i].host_dev = &orion_ge_mvmdio.dev;
+ orion_switch_device.dev.platform_data = d;
+
+ platform_device_register(&orion_switch_device);
+diff --git a/arch/arm64/Makefile b/arch/arm64/Makefile
+index e7391aef5433..2d54c55400ed 100644
+--- a/arch/arm64/Makefile
++++ b/arch/arm64/Makefile
+@@ -33,7 +33,7 @@ endif
+ CHECKFLAGS += -D__aarch64__
+
+ ifeq ($(CONFIG_ARM64_ERRATUM_843419), y)
+-CFLAGS_MODULE += -mcmodel=large
++KBUILD_CFLAGS_MODULE += -mcmodel=large
+ endif
+
+ # Default value
+diff --git a/arch/arm64/kernel/stacktrace.c b/arch/arm64/kernel/stacktrace.c
+index 407991bf79f5..ccb6078ed9f2 100644
+--- a/arch/arm64/kernel/stacktrace.c
++++ b/arch/arm64/kernel/stacktrace.c
+@@ -48,11 +48,7 @@ int notrace unwind_frame(struct stackframe *frame)
+
+ frame->sp = fp + 0x10;
+ frame->fp = *(unsigned long *)(fp);
+- /*
+- * -4 here because we care about the PC at time of bl,
+- * not where the return will go.
+- */
+- frame->pc = *(unsigned long *)(fp + 8) - 4;
++ frame->pc = *(unsigned long *)(fp + 8);
+
+ return 0;
+ }
+diff --git a/arch/powerpc/kernel/rtas.c b/arch/powerpc/kernel/rtas.c
+index af0dafab5807..79c459a2b684 100644
+--- a/arch/powerpc/kernel/rtas.c
++++ b/arch/powerpc/kernel/rtas.c
+@@ -1045,6 +1045,9 @@ asmlinkage int ppc_rtas(struct rtas_args __user *uargs)
+ if (!capable(CAP_SYS_ADMIN))
+ return -EPERM;
+
++ if (!rtas.entry)
++ return -EINVAL;
++
+ if (copy_from_user(&args, uargs, 3 * sizeof(u32)) != 0)
+ return -EFAULT;
+
+diff --git a/arch/sparc/crypto/aes_glue.c b/arch/sparc/crypto/aes_glue.c
+index 705408766ab0..ef0870500240 100644
+--- a/arch/sparc/crypto/aes_glue.c
++++ b/arch/sparc/crypto/aes_glue.c
+@@ -433,6 +433,7 @@ static struct crypto_alg algs[] = { {
+ .blkcipher = {
+ .min_keysize = AES_MIN_KEY_SIZE,
+ .max_keysize = AES_MAX_KEY_SIZE,
++ .ivsize = AES_BLOCK_SIZE,
+ .setkey = aes_set_key,
+ .encrypt = cbc_encrypt,
+ .decrypt = cbc_decrypt,
+@@ -452,6 +453,7 @@ static struct crypto_alg algs[] = { {
+ .blkcipher = {
+ .min_keysize = AES_MIN_KEY_SIZE,
+ .max_keysize = AES_MAX_KEY_SIZE,
++ .ivsize = AES_BLOCK_SIZE,
+ .setkey = aes_set_key,
+ .encrypt = ctr_crypt,
+ .decrypt = ctr_crypt,
+diff --git a/arch/sparc/crypto/camellia_glue.c b/arch/sparc/crypto/camellia_glue.c
+index 641f55cb61c3..eb87d6dd86b1 100644
+--- a/arch/sparc/crypto/camellia_glue.c
++++ b/arch/sparc/crypto/camellia_glue.c
+@@ -274,6 +274,7 @@ static struct crypto_alg algs[] = { {
+ .blkcipher = {
+ .min_keysize = CAMELLIA_MIN_KEY_SIZE,
+ .max_keysize = CAMELLIA_MAX_KEY_SIZE,
++ .ivsize = CAMELLIA_BLOCK_SIZE,
+ .setkey = camellia_set_key,
+ .encrypt = cbc_encrypt,
+ .decrypt = cbc_decrypt,
+diff --git a/arch/sparc/crypto/des_glue.c b/arch/sparc/crypto/des_glue.c
+index d11500972994..1359bfc544e4 100644
+--- a/arch/sparc/crypto/des_glue.c
++++ b/arch/sparc/crypto/des_glue.c
+@@ -429,6 +429,7 @@ static struct crypto_alg algs[] = { {
+ .blkcipher = {
+ .min_keysize = DES_KEY_SIZE,
+ .max_keysize = DES_KEY_SIZE,
++ .ivsize = DES_BLOCK_SIZE,
+ .setkey = des_set_key,
+ .encrypt = cbc_encrypt,
+ .decrypt = cbc_decrypt,
+@@ -485,6 +486,7 @@ static struct crypto_alg algs[] = { {
+ .blkcipher = {
+ .min_keysize = DES3_EDE_KEY_SIZE,
+ .max_keysize = DES3_EDE_KEY_SIZE,
++ .ivsize = DES3_EDE_BLOCK_SIZE,
+ .setkey = des3_ede_set_key,
+ .encrypt = cbc3_encrypt,
+ .decrypt = cbc3_decrypt,
+diff --git a/arch/x86/include/uapi/asm/svm.h b/arch/x86/include/uapi/asm/svm.h
+index b5d7640abc5d..8a4add8e4639 100644
+--- a/arch/x86/include/uapi/asm/svm.h
++++ b/arch/x86/include/uapi/asm/svm.h
+@@ -100,6 +100,7 @@
+ { SVM_EXIT_EXCP_BASE + UD_VECTOR, "UD excp" }, \
+ { SVM_EXIT_EXCP_BASE + PF_VECTOR, "PF excp" }, \
+ { SVM_EXIT_EXCP_BASE + NM_VECTOR, "NM excp" }, \
++ { SVM_EXIT_EXCP_BASE + AC_VECTOR, "AC excp" }, \
+ { SVM_EXIT_EXCP_BASE + MC_VECTOR, "MC excp" }, \
+ { SVM_EXIT_INTR, "interrupt" }, \
+ { SVM_EXIT_NMI, "nmi" }, \
+diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
+index 974e4d98ed29..852572c971c4 100644
+--- a/arch/x86/kvm/emulate.c
++++ b/arch/x86/kvm/emulate.c
+@@ -658,7 +658,7 @@ static int __linearize(struct x86_emulate_ctxt *ctxt,
+ *max_size = 0;
+ switch (ctxt->mode) {
+ case X86EMUL_MODE_PROT64:
+- if (((signed long)la << 16) >> 16 != la)
++ if (is_noncanonical_address(la))
+ return emulate_gp(ctxt, 0);
+
+ *max_size = min_t(u64, ~0u, (1ull << 48) - la);
+diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
+index f98baebfa9a7..9dc0aa0dae96 100644
+--- a/arch/x86/kvm/svm.c
++++ b/arch/x86/kvm/svm.c
+@@ -1103,6 +1103,7 @@ static void init_vmcb(struct vcpu_svm *svm)
+ set_exception_intercept(svm, PF_VECTOR);
+ set_exception_intercept(svm, UD_VECTOR);
+ set_exception_intercept(svm, MC_VECTOR);
++ set_exception_intercept(svm, AC_VECTOR);
+
+ set_intercept(svm, INTERCEPT_INTR);
+ set_intercept(svm, INTERCEPT_NMI);
+@@ -1789,6 +1790,12 @@ static int ud_interception(struct vcpu_svm *svm)
+ return 1;
+ }
+
++static int ac_interception(struct vcpu_svm *svm)
++{
++ kvm_queue_exception_e(&svm->vcpu, AC_VECTOR, 0);
++ return 1;
++}
++
+ static void svm_fpu_activate(struct kvm_vcpu *vcpu)
+ {
+ struct vcpu_svm *svm = to_svm(vcpu);
+@@ -3350,6 +3357,7 @@ static int (*const svm_exit_handlers[])(struct vcpu_svm *svm) = {
+ [SVM_EXIT_EXCP_BASE + PF_VECTOR] = pf_interception,
+ [SVM_EXIT_EXCP_BASE + NM_VECTOR] = nm_interception,
+ [SVM_EXIT_EXCP_BASE + MC_VECTOR] = mc_interception,
++ [SVM_EXIT_EXCP_BASE + AC_VECTOR] = ac_interception,
+ [SVM_EXIT_INTR] = intr_interception,
+ [SVM_EXIT_NMI] = nmi_interception,
+ [SVM_EXIT_SMI] = nop_on_interception,
+diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
+index 0d7f1dcfcdac..84de207a8848 100644
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -1493,7 +1493,7 @@ static void update_exception_bitmap(struct kvm_vcpu *vcpu)
+ u32 eb;
+
+ eb = (1u << PF_VECTOR) | (1u << UD_VECTOR) | (1u << MC_VECTOR) |
+- (1u << NM_VECTOR) | (1u << DB_VECTOR);
++ (1u << NM_VECTOR) | (1u << DB_VECTOR) | (1u << AC_VECTOR);
+ if ((vcpu->guest_debug &
+ (KVM_GUESTDBG_ENABLE | KVM_GUESTDBG_USE_SW_BP)) ==
+ (KVM_GUESTDBG_ENABLE | KVM_GUESTDBG_USE_SW_BP))
+@@ -4933,6 +4933,9 @@ static int handle_exception(struct kvm_vcpu *vcpu)
+ return handle_rmode_exception(vcpu, ex_no, error_code);
+
+ switch (ex_no) {
++ case AC_VECTOR:
++ kvm_queue_exception_e(vcpu, AC_VECTOR, error_code);
++ return 1;
+ case DB_VECTOR:
+ dr6 = vmcs_readl(EXIT_QUALIFICATION);
+ if (!(vcpu->guest_debug &
+diff --git a/crypto/ablkcipher.c b/crypto/ablkcipher.c
+index 40886c489903..520729d898fe 100644
+--- a/crypto/ablkcipher.c
++++ b/crypto/ablkcipher.c
+@@ -695,7 +695,7 @@ struct crypto_ablkcipher *crypto_alloc_ablkcipher(const char *alg_name,
+ err:
+ if (err != -EAGAIN)
+ break;
+- if (signal_pending(current)) {
++ if (fatal_signal_pending(current)) {
+ err = -EINTR;
+ break;
+ }
+diff --git a/crypto/ahash.c b/crypto/ahash.c
+index f6a36a52d738..c1d8591913e9 100644
+--- a/crypto/ahash.c
++++ b/crypto/ahash.c
+@@ -543,7 +543,8 @@ static int ahash_prepare_alg(struct ahash_alg *alg)
+ struct crypto_alg *base = &alg->halg.base;
+
+ if (alg->halg.digestsize > PAGE_SIZE / 8 ||
+- alg->halg.statesize > PAGE_SIZE / 8)
++ alg->halg.statesize > PAGE_SIZE / 8 ||
++ alg->halg.statesize == 0)
+ return -EINVAL;
+
+ base->cra_type = &crypto_ahash_type;
+diff --git a/crypto/algapi.c b/crypto/algapi.c
+index 71a8143e23b1..314cc745f2f8 100644
+--- a/crypto/algapi.c
++++ b/crypto/algapi.c
+@@ -337,7 +337,7 @@ static void crypto_wait_for_test(struct crypto_larval *larval)
+ crypto_alg_tested(larval->alg.cra_driver_name, 0);
+ }
+
+- err = wait_for_completion_interruptible(&larval->completion);
++ err = wait_for_completion_killable(&larval->completion);
+ WARN_ON(err);
+
+ out:
+diff --git a/crypto/api.c b/crypto/api.c
+index 2a81e98a0021..7db2e89a3114 100644
+--- a/crypto/api.c
++++ b/crypto/api.c
+@@ -172,7 +172,7 @@ static struct crypto_alg *crypto_larval_wait(struct crypto_alg *alg)
+ struct crypto_larval *larval = (void *)alg;
+ long timeout;
+
+- timeout = wait_for_completion_interruptible_timeout(
++ timeout = wait_for_completion_killable_timeout(
+ &larval->completion, 60 * HZ);
+
+ alg = larval->adult;
+@@ -435,7 +435,7 @@ struct crypto_tfm *crypto_alloc_base(const char *alg_name, u32 type, u32 mask)
+ err:
+ if (err != -EAGAIN)
+ break;
+- if (signal_pending(current)) {
++ if (fatal_signal_pending(current)) {
+ err = -EINTR;
+ break;
+ }
+@@ -552,7 +552,7 @@ void *crypto_alloc_tfm(const char *alg_name,
+ err:
+ if (err != -EAGAIN)
+ break;
+- if (signal_pending(current)) {
++ if (fatal_signal_pending(current)) {
+ err = -EINTR;
+ break;
+ }
+diff --git a/crypto/crypto_user.c b/crypto/crypto_user.c
+index e2a34feec7a4..c90af2537d24 100644
+--- a/crypto/crypto_user.c
++++ b/crypto/crypto_user.c
+@@ -367,7 +367,7 @@ static struct crypto_alg *crypto_user_aead_alg(const char *name, u32 type,
+ err = PTR_ERR(alg);
+ if (err != -EAGAIN)
+ break;
+- if (signal_pending(current)) {
++ if (fatal_signal_pending(current)) {
+ err = -EINTR;
+ break;
+ }
+diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c
+index dc1ca84e90f1..8f51d6e3883e 100644
+--- a/drivers/block/rbd.c
++++ b/drivers/block/rbd.c
+@@ -3780,6 +3780,9 @@ static int rbd_init_disk(struct rbd_device *rbd_dev)
+ q->limits.discard_zeroes_data = 1;
+
+ blk_queue_merge_bvec(q, rbd_merge_bvec);
++ if (!ceph_test_opt(rbd_dev->rbd_client->client, NOCRC))
++ q->backing_dev_info.capabilities |= BDI_CAP_STABLE_WRITES;
++
+ disk->queue = q;
+
+ q->queuedata = rbd_dev;
+@@ -5198,7 +5201,6 @@ static int rbd_dev_probe_parent(struct rbd_device *rbd_dev)
+ out_err:
+ if (parent) {
+ rbd_dev_unparent(rbd_dev);
+- kfree(rbd_dev->header_name);
+ rbd_dev_destroy(parent);
+ } else {
+ rbd_put_client(rbdc);
+diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c
+index 218c4858f494..34a01f191b33 100644
+--- a/drivers/block/xen-blkfront.c
++++ b/drivers/block/xen-blkfront.c
+@@ -1911,7 +1911,8 @@ static void blkback_changed(struct xenbus_device *dev,
+ break;
+ /* Missed the backend's Closing state -- fallthrough */
+ case XenbusStateClosing:
+- blkfront_closing(info);
++ if (info)
++ blkfront_closing(info);
+ break;
+ }
+ }
+diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
+index 448327fe4d85..60c68e3cedeb 100644
+--- a/drivers/gpu/drm/i915/intel_display.c
++++ b/drivers/gpu/drm/i915/intel_display.c
+@@ -1650,6 +1650,8 @@ static void i9xx_enable_pll(struct intel_crtc *crtc)
+ I915_READ(DPLL(!crtc->pipe)) | DPLL_DVO_2X_MODE);
+ }
+
++ I915_WRITE(reg, dpll);
++
+ /* Wait for the clocks to stabilize. */
+ POSTING_READ(reg);
+ udelay(150);
+diff --git a/drivers/gpu/drm/nouveau/nouveau_fbcon.c b/drivers/gpu/drm/nouveau/nouveau_fbcon.c
+index 593ef8a2a069..ddcfc1d2544b 100644
+--- a/drivers/gpu/drm/nouveau/nouveau_fbcon.c
++++ b/drivers/gpu/drm/nouveau/nouveau_fbcon.c
+@@ -178,8 +178,30 @@ nouveau_fbcon_sync(struct fb_info *info)
+ return 0;
+ }
+
++static int
++nouveau_fbcon_open(struct fb_info *info, int user)
++{
++ struct nouveau_fbdev *fbcon = info->par;
++ struct nouveau_drm *drm = nouveau_drm(fbcon->dev);
++ int ret = pm_runtime_get_sync(drm->dev->dev);
++ if (ret < 0 && ret != -EACCES)
++ return ret;
++ return 0;
++}
++
++static int
++nouveau_fbcon_release(struct fb_info *info, int user)
++{
++ struct nouveau_fbdev *fbcon = info->par;
++ struct nouveau_drm *drm = nouveau_drm(fbcon->dev);
++ pm_runtime_put(drm->dev->dev);
++ return 0;
++}
++
+ static struct fb_ops nouveau_fbcon_ops = {
+ .owner = THIS_MODULE,
++ .fb_open = nouveau_fbcon_open,
++ .fb_release = nouveau_fbcon_release,
+ .fb_check_var = drm_fb_helper_check_var,
+ .fb_set_par = drm_fb_helper_set_par,
+ .fb_fillrect = nouveau_fbcon_fillrect,
+@@ -195,6 +217,8 @@ static struct fb_ops nouveau_fbcon_ops = {
+
+ static struct fb_ops nouveau_fbcon_sw_ops = {
+ .owner = THIS_MODULE,
++ .fb_open = nouveau_fbcon_open,
++ .fb_release = nouveau_fbcon_release,
+ .fb_check_var = drm_fb_helper_check_var,
+ .fb_set_par = drm_fb_helper_set_par,
+ .fb_fillrect = cfb_fillrect,
+diff --git a/drivers/gpu/drm/nouveau/nouveau_gem.c b/drivers/gpu/drm/nouveau/nouveau_gem.c
+index 36951ee4b157..9fcc77d5923e 100644
+--- a/drivers/gpu/drm/nouveau/nouveau_gem.c
++++ b/drivers/gpu/drm/nouveau/nouveau_gem.c
+@@ -199,11 +199,12 @@ nouveau_gem_info(struct drm_file *file_priv, struct drm_gem_object *gem,
+ struct nouveau_bo *nvbo = nouveau_gem_object(gem);
+ struct nouveau_vma *vma;
+
+- if (nvbo->bo.mem.mem_type == TTM_PL_TT)
++ if (is_power_of_2(nvbo->valid_domains))
++ rep->domain = nvbo->valid_domains;
++ else if (nvbo->bo.mem.mem_type == TTM_PL_TT)
+ rep->domain = NOUVEAU_GEM_DOMAIN_GART;
+ else
+ rep->domain = NOUVEAU_GEM_DOMAIN_VRAM;
+-
+ rep->offset = nvbo->bo.offset;
+ if (cli->vm) {
+ vma = nouveau_bo_vma_find(nvbo, cli->vm);
+diff --git a/drivers/gpu/drm/radeon/radeon.h b/drivers/gpu/drm/radeon/radeon.h
+index d6f0e40db81d..ee38f9aba391 100644
+--- a/drivers/gpu/drm/radeon/radeon.h
++++ b/drivers/gpu/drm/radeon/radeon.h
+@@ -1628,6 +1628,7 @@ struct radeon_pm {
+ struct device *int_hwmon_dev;
+ /* dpm */
+ bool dpm_enabled;
++ bool sysfs_initialized;
+ struct radeon_dpm dpm;
+ };
+
+diff --git a/drivers/gpu/drm/radeon/radeon_display.c b/drivers/gpu/drm/radeon/radeon_display.c
+index 2e1e9aa79cea..21e6e9745d00 100644
+--- a/drivers/gpu/drm/radeon/radeon_display.c
++++ b/drivers/gpu/drm/radeon/radeon_display.c
+@@ -1619,18 +1619,8 @@ int radeon_modeset_init(struct radeon_device *rdev)
+ radeon_fbdev_init(rdev);
+ drm_kms_helper_poll_init(rdev->ddev);
+
+- if (rdev->pm.dpm_enabled) {
+- /* do dpm late init */
+- ret = radeon_pm_late_init(rdev);
+- if (ret) {
+- rdev->pm.dpm_enabled = false;
+- DRM_ERROR("radeon_pm_late_init failed, disabling dpm\n");
+- }
+- /* set the dpm state for PX since there won't be
+- * a modeset to call this.
+- */
+- radeon_pm_compute_clocks(rdev);
+- }
++ /* do pm late init */
++ ret = radeon_pm_late_init(rdev);
+
+ return 0;
+ }
+diff --git a/drivers/gpu/drm/radeon/radeon_pm.c b/drivers/gpu/drm/radeon/radeon_pm.c
+index 1d94b542cd82..fa537c0602e8 100644
+--- a/drivers/gpu/drm/radeon/radeon_pm.c
++++ b/drivers/gpu/drm/radeon/radeon_pm.c
+@@ -1192,14 +1192,6 @@ static int radeon_pm_init_old(struct radeon_device *rdev)
+ INIT_DELAYED_WORK(&rdev->pm.dynpm_idle_work, radeon_dynpm_idle_work_handler);
+
+ if (rdev->pm.num_power_states > 1) {
+- /* where's the best place to put these? */
+- ret = device_create_file(rdev->dev, &dev_attr_power_profile);
+- if (ret)
+- DRM_ERROR("failed to create device file for power profile\n");
+- ret = device_create_file(rdev->dev, &dev_attr_power_method);
+- if (ret)
+- DRM_ERROR("failed to create device file for power method\n");
+-
+ if (radeon_debugfs_pm_init(rdev)) {
+ DRM_ERROR("Failed to register debugfs file for PM!\n");
+ }
+@@ -1257,20 +1249,6 @@ static int radeon_pm_init_dpm(struct radeon_device *rdev)
+ goto dpm_failed;
+ rdev->pm.dpm_enabled = true;
+
+- ret = device_create_file(rdev->dev, &dev_attr_power_dpm_state);
+- if (ret)
+- DRM_ERROR("failed to create device file for dpm state\n");
+- ret = device_create_file(rdev->dev, &dev_attr_power_dpm_force_performance_level);
+- if (ret)
+- DRM_ERROR("failed to create device file for dpm state\n");
+- /* XXX: these are noops for dpm but are here for backwards compat */
+- ret = device_create_file(rdev->dev, &dev_attr_power_profile);
+- if (ret)
+- DRM_ERROR("failed to create device file for power profile\n");
+- ret = device_create_file(rdev->dev, &dev_attr_power_method);
+- if (ret)
+- DRM_ERROR("failed to create device file for power method\n");
+-
+ if (radeon_debugfs_pm_init(rdev)) {
+ DRM_ERROR("Failed to register debugfs file for dpm!\n");
+ }
+@@ -1411,9 +1389,51 @@ int radeon_pm_late_init(struct radeon_device *rdev)
+ int ret = 0;
+
+ if (rdev->pm.pm_method == PM_METHOD_DPM) {
+- mutex_lock(&rdev->pm.mutex);
+- ret = radeon_dpm_late_enable(rdev);
+- mutex_unlock(&rdev->pm.mutex);
++ if (rdev->pm.dpm_enabled) {
++ if (!rdev->pm.sysfs_initialized) {
++ ret = device_create_file(rdev->dev, &dev_attr_power_dpm_state);
++ if (ret)
++ DRM_ERROR("failed to create device file for dpm state\n");
++ ret = device_create_file(rdev->dev, &dev_attr_power_dpm_force_performance_level);
++ if (ret)
++ DRM_ERROR("failed to create device file for dpm state\n");
++ /* XXX: these are noops for dpm but are here for backwards compat */
++ ret = device_create_file(rdev->dev, &dev_attr_power_profile);
++ if (ret)
++ DRM_ERROR("failed to create device file for power profile\n");
++ ret = device_create_file(rdev->dev, &dev_attr_power_method);
++ if (ret)
++ DRM_ERROR("failed to create device file for power method\n");
++ if (!ret)
++ rdev->pm.sysfs_initialized = true;
++ }
++
++ mutex_lock(&rdev->pm.mutex);
++ ret = radeon_dpm_late_enable(rdev);
++ mutex_unlock(&rdev->pm.mutex);
++ if (ret) {
++ rdev->pm.dpm_enabled = false;
++ DRM_ERROR("radeon_pm_late_init failed, disabling dpm\n");
++ } else {
++ /* set the dpm state for PX since there won't be
++ * a modeset to call this.
++ */
++ radeon_pm_compute_clocks(rdev);
++ }
++ }
++ } else {
++ if ((rdev->pm.num_power_states > 1) &&
++ (!rdev->pm.sysfs_initialized)) {
++ /* where's the best place to put these? */
++ ret = device_create_file(rdev->dev, &dev_attr_power_profile);
++ if (ret)
++ DRM_ERROR("failed to create device file for power profile\n");
++ ret = device_create_file(rdev->dev, &dev_attr_power_method);
++ if (ret)
++ DRM_ERROR("failed to create device file for power method\n");
++ if (!ret)
++ rdev->pm.sysfs_initialized = true;
++ }
+ }
+ return ret;
+ }
+diff --git a/drivers/hid/hid-apple.c b/drivers/hid/hid-apple.c
+index f822fd2a1ada..884d82f9190e 100644
+--- a/drivers/hid/hid-apple.c
++++ b/drivers/hid/hid-apple.c
+@@ -546,6 +546,12 @@ static const struct hid_device_id apple_devices[] = {
+ .driver_data = APPLE_HAS_FN | APPLE_ISO_KEYBOARD },
+ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING8_JIS),
+ .driver_data = APPLE_HAS_FN | APPLE_RDESC_JIS },
++ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING9_ANSI),
++ .driver_data = APPLE_HAS_FN },
++ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING9_ISO),
++ .driver_data = APPLE_HAS_FN | APPLE_ISO_KEYBOARD },
++ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING9_JIS),
++ .driver_data = APPLE_HAS_FN | APPLE_RDESC_JIS },
+ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_ANSI),
+ .driver_data = APPLE_NUMLOCK_EMULATION | APPLE_HAS_FN },
+ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_ISO),
+diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
+index 737d18c924bc..ab52d1b30161 100644
+--- a/drivers/hid/hid-core.c
++++ b/drivers/hid/hid-core.c
+@@ -1751,6 +1751,9 @@ static const struct hid_device_id hid_have_special_driver[] = {
+ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING8_ANSI) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING8_ISO) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING8_JIS) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING9_ANSI) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING9_ISO) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING9_JIS) },
+ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_ANSI) },
+ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_ISO) },
+ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_JIS) },
+@@ -2434,6 +2437,9 @@ static const struct hid_device_id hid_mouse_ignore_list[] = {
+ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING8_ANSI) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING8_ISO) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING8_JIS) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING9_ANSI) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING9_ISO) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING9_JIS) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_FOUNTAIN_TP_ONLY) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_GEYSER1_TP_ONLY) },
+ { }
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index ef984eba8396..984e43cb83f0 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -142,6 +142,9 @@
+ #define USB_DEVICE_ID_APPLE_WELLSPRING8_ANSI 0x0290
+ #define USB_DEVICE_ID_APPLE_WELLSPRING8_ISO 0x0291
+ #define USB_DEVICE_ID_APPLE_WELLSPRING8_JIS 0x0292
++#define USB_DEVICE_ID_APPLE_WELLSPRING9_ANSI 0x0272
++#define USB_DEVICE_ID_APPLE_WELLSPRING9_ISO 0x0273
++#define USB_DEVICE_ID_APPLE_WELLSPRING9_JIS 0x0274
+ #define USB_DEVICE_ID_APPLE_FOUNTAIN_TP_ONLY 0x030a
+ #define USB_DEVICE_ID_APPLE_GEYSER1_TP_ONLY 0x030b
+ #define USB_DEVICE_ID_APPLE_IRCONTROL 0x8240
+@@ -918,7 +921,8 @@
+ #define USB_DEVICE_ID_TOUCHPACK_RTS 0x1688
+
+ #define USB_VENDOR_ID_TPV 0x25aa
+-#define USB_DEVICE_ID_TPV_OPTICAL_TOUCHSCREEN 0x8883
++#define USB_DEVICE_ID_TPV_OPTICAL_TOUCHSCREEN_8882 0x8882
++#define USB_DEVICE_ID_TPV_OPTICAL_TOUCHSCREEN_8883 0x8883
+
+ #define USB_VENDOR_ID_TURBOX 0x062a
+ #define USB_DEVICE_ID_TURBOX_KEYBOARD 0x0201
+diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c
+index a4d1fe64c925..f7dd36e4fcb3 100644
+--- a/drivers/hid/usbhid/hid-quirks.c
++++ b/drivers/hid/usbhid/hid-quirks.c
+@@ -111,7 +111,8 @@ static const struct hid_blacklist {
+ { USB_VENDOR_ID_SUN, USB_DEVICE_ID_RARITAN_KVM_DONGLE, HID_QUIRK_NOGET },
+ { USB_VENDOR_ID_SYMBOL, USB_DEVICE_ID_SYMBOL_SCANNER_1, HID_QUIRK_NOGET },
+ { USB_VENDOR_ID_SYMBOL, USB_DEVICE_ID_SYMBOL_SCANNER_2, HID_QUIRK_NOGET },
+- { USB_VENDOR_ID_TPV, USB_DEVICE_ID_TPV_OPTICAL_TOUCHSCREEN, HID_QUIRK_NOGET },
++ { USB_VENDOR_ID_TPV, USB_DEVICE_ID_TPV_OPTICAL_TOUCHSCREEN_8882, HID_QUIRK_NOGET },
++ { USB_VENDOR_ID_TPV, USB_DEVICE_ID_TPV_OPTICAL_TOUCHSCREEN_8883, HID_QUIRK_NOGET },
+ { USB_VENDOR_ID_TURBOX, USB_DEVICE_ID_TURBOX_KEYBOARD, HID_QUIRK_NOGET },
+ { USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_UCLOGIC_TABLET_KNA5, HID_QUIRK_MULTI_INPUT },
+ { USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_UCLOGIC_TABLET_TWA60, HID_QUIRK_MULTI_INPUT },
+diff --git a/drivers/i2c/busses/i2c-designware-platdrv.c b/drivers/i2c/busses/i2c-designware-platdrv.c
+index 373dd4d47765..76babdb800f9 100644
+--- a/drivers/i2c/busses/i2c-designware-platdrv.c
++++ b/drivers/i2c/busses/i2c-designware-platdrv.c
+@@ -24,6 +24,7 @@
+ #include <linux/kernel.h>
+ #include <linux/module.h>
+ #include <linux/delay.h>
++#include <linux/dmi.h>
+ #include <linux/i2c.h>
+ #include <linux/clk.h>
+ #include <linux/clk-provider.h>
+@@ -51,6 +52,22 @@ static u32 i2c_dw_get_clk_rate_khz(struct dw_i2c_dev *dev)
+ }
+
+ #ifdef CONFIG_ACPI
++/*
++ * The HCNT/LCNT information coming from ACPI should be the most accurate
++ * for given platform. However, some systems get it wrong. On such systems
++ * we get better results by calculating those based on the input clock.
++ */
++static const struct dmi_system_id dw_i2c_no_acpi_params[] = {
++ {
++ .ident = "Dell Inspiron 7348",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Inspiron 7348"),
++ },
++ },
++ { }
++};
++
+ static void dw_i2c_acpi_params(struct platform_device *pdev, char method[],
+ u16 *hcnt, u16 *lcnt, u32 *sda_hold)
+ {
+@@ -58,6 +75,9 @@ static void dw_i2c_acpi_params(struct platform_device *pdev, char method[],
+ acpi_handle handle = ACPI_HANDLE(&pdev->dev);
+ union acpi_object *obj;
+
++ if (dmi_check_system(dw_i2c_no_acpi_params))
++ return;
++
+ if (ACPI_FAILURE(acpi_evaluate_object(handle, method, NULL, &buf)))
+ return;
+
+diff --git a/drivers/i2c/busses/i2c-rcar.c b/drivers/i2c/busses/i2c-rcar.c
+index d826e82dd997..47bd421f2750 100644
+--- a/drivers/i2c/busses/i2c-rcar.c
++++ b/drivers/i2c/busses/i2c-rcar.c
+@@ -584,15 +584,16 @@ static int rcar_i2c_probe(struct platform_device *pdev)
+ return ret;
+ }
+
++ pm_runtime_enable(dev);
++ platform_set_drvdata(pdev, priv);
++
+ ret = i2c_add_numbered_adapter(adap);
+ if (ret < 0) {
+ dev_err(dev, "reg adap failed: %d\n", ret);
++ pm_runtime_disable(dev);
+ return ret;
+ }
+
+- pm_runtime_enable(dev);
+- platform_set_drvdata(pdev, priv);
+-
+ dev_info(dev, "probed\n");
+
+ return 0;
+diff --git a/drivers/i2c/busses/i2c-s3c2410.c b/drivers/i2c/busses/i2c-s3c2410.c
+index c127af99a0e0..b928e7a62f59 100644
+--- a/drivers/i2c/busses/i2c-s3c2410.c
++++ b/drivers/i2c/busses/i2c-s3c2410.c
+@@ -1219,17 +1219,19 @@ static int s3c24xx_i2c_probe(struct platform_device *pdev)
+ i2c->adap.nr = i2c->pdata->bus_num;
+ i2c->adap.dev.of_node = pdev->dev.of_node;
+
++ platform_set_drvdata(pdev, i2c);
++
++ pm_runtime_enable(&pdev->dev);
++
+ ret = i2c_add_numbered_adapter(&i2c->adap);
+ if (ret < 0) {
+ dev_err(&pdev->dev, "failed to add bus to i2c core\n");
++ pm_runtime_disable(&pdev->dev);
+ s3c24xx_i2c_deregister_cpufreq(i2c);
+ clk_unprepare(i2c->clk);
+ return ret;
+ }
+
+- platform_set_drvdata(pdev, i2c);
+-
+- pm_runtime_enable(&pdev->dev);
+ pm_runtime_enable(&i2c->adap.dev);
+
+ dev_info(&pdev->dev, "%s: S3C I2C adapter\n", dev_name(&i2c->adap.dev));
+diff --git a/drivers/infiniband/core/cm.c b/drivers/infiniband/core/cm.c
+index e28a494e2a3a..c3a83f7aa096 100644
+--- a/drivers/infiniband/core/cm.c
++++ b/drivers/infiniband/core/cm.c
+@@ -860,6 +860,11 @@ retest:
+ case IB_CM_SIDR_REQ_RCVD:
+ spin_unlock_irq(&cm_id_priv->lock);
+ cm_reject_sidr_req(cm_id_priv, IB_SIDR_REJECT);
++ spin_lock_irq(&cm.lock);
++ if (!RB_EMPTY_NODE(&cm_id_priv->sidr_id_node))
++ rb_erase(&cm_id_priv->sidr_id_node,
++ &cm.remote_sidr_table);
++ spin_unlock_irq(&cm.lock);
+ break;
+ case IB_CM_REQ_SENT:
+ ib_cancel_mad(cm_id_priv->av.port->mad_agent, cm_id_priv->msg);
+@@ -3099,7 +3104,10 @@ int ib_send_cm_sidr_rep(struct ib_cm_id *cm_id,
+ spin_unlock_irqrestore(&cm_id_priv->lock, flags);
+
+ spin_lock_irqsave(&cm.lock, flags);
+- rb_erase(&cm_id_priv->sidr_id_node, &cm.remote_sidr_table);
++ if (!RB_EMPTY_NODE(&cm_id_priv->sidr_id_node)) {
++ rb_erase(&cm_id_priv->sidr_id_node, &cm.remote_sidr_table);
++ RB_CLEAR_NODE(&cm_id_priv->sidr_id_node);
++ }
+ spin_unlock_irqrestore(&cm.lock, flags);
+ return 0;
+
+diff --git a/drivers/input/joystick/Kconfig b/drivers/input/joystick/Kconfig
+index 56eb471b5576..4215b5382092 100644
+--- a/drivers/input/joystick/Kconfig
++++ b/drivers/input/joystick/Kconfig
+@@ -196,6 +196,7 @@ config JOYSTICK_TWIDJOY
+ config JOYSTICK_ZHENHUA
+ tristate "5-byte Zhenhua RC transmitter"
+ select SERIO
++ select BITREVERSE
+ help
+ Say Y here if you have a Zhen Hua PPM-4CH transmitter which is
+ supplied with a ready to fly micro electric indoor helicopters
+diff --git a/drivers/input/keyboard/omap4-keypad.c b/drivers/input/keyboard/omap4-keypad.c
+index 024b7bdffe5b..3ab045369c0c 100644
+--- a/drivers/input/keyboard/omap4-keypad.c
++++ b/drivers/input/keyboard/omap4-keypad.c
+@@ -266,7 +266,7 @@ static int omap4_keypad_probe(struct platform_device *pdev)
+
+ error = omap4_keypad_parse_dt(&pdev->dev, keypad_data);
+ if (error)
+- return error;
++ goto err_free_keypad;
+
+ res = request_mem_region(res->start, resource_size(res), pdev->name);
+ if (!res) {
+diff --git a/drivers/input/mouse/psmouse-base.c b/drivers/input/mouse/psmouse-base.c
+index 95a3a6e2faf6..51a61e28b89e 100644
+--- a/drivers/input/mouse/psmouse-base.c
++++ b/drivers/input/mouse/psmouse-base.c
+@@ -1473,6 +1473,10 @@ static int psmouse_connect(struct serio *serio, struct serio_driver *drv)
+ if (error)
+ goto err_clear_drvdata;
+
++ /* give PT device some time to settle down before probing */
++ if (serio->id.type == SERIO_PS_PSTHRU)
++ usleep_range(10000, 15000);
++
+ if (psmouse_probe(psmouse) < 0) {
+ error = -ENODEV;
+ goto err_close_serio;
+diff --git a/drivers/input/serio/parkbd.c b/drivers/input/serio/parkbd.c
+index 26b45936f9fd..1e8cd6f1fe9e 100644
+--- a/drivers/input/serio/parkbd.c
++++ b/drivers/input/serio/parkbd.c
+@@ -194,6 +194,7 @@ static int __init parkbd_init(void)
+ parkbd_port = parkbd_allocate_serio();
+ if (!parkbd_port) {
+ parport_release(parkbd_dev);
++ parport_unregister_device(parkbd_dev);
+ return -ENOMEM;
+ }
+
+diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c
+index fab0ea1a46d1..af3daf89c77d 100644
+--- a/drivers/iommu/amd_iommu.c
++++ b/drivers/iommu/amd_iommu.c
+@@ -1705,14 +1705,16 @@ static unsigned long dma_ops_area_alloc(struct device *dev,
+ unsigned long next_bit = dom->next_address % APERTURE_RANGE_SIZE;
+ int max_index = dom->aperture_size >> APERTURE_RANGE_SHIFT;
+ int i = start >> APERTURE_RANGE_SHIFT;
+- unsigned long boundary_size;
++ unsigned long boundary_size, mask;
+ unsigned long address = -1;
+ unsigned long limit;
+
+ next_bit >>= PAGE_SHIFT;
+
+- boundary_size = ALIGN(dma_get_seg_boundary(dev) + 1,
+- PAGE_SIZE) >> PAGE_SHIFT;
++ mask = dma_get_seg_boundary(dev);
++
++ boundary_size = mask + 1 ? ALIGN(mask + 1, PAGE_SIZE) >> PAGE_SHIFT :
++ 1UL << (BITS_PER_LONG - PAGE_SHIFT);
+
+ for (;i < max_index; ++i) {
+ unsigned long offset = dom->aperture[i]->offset >> PAGE_SHIFT;
+@@ -2100,8 +2102,8 @@ static void set_dte_entry(u16 devid, struct protection_domain *domain, bool ats)
+ static void clear_dte_entry(u16 devid)
+ {
+ /* remove entry from the device table seen by the hardware */
+- amd_iommu_dev_table[devid].data[0] = IOMMU_PTE_P | IOMMU_PTE_TV;
+- amd_iommu_dev_table[devid].data[1] = 0;
++ amd_iommu_dev_table[devid].data[0] = IOMMU_PTE_P | IOMMU_PTE_TV;
++ amd_iommu_dev_table[devid].data[1] &= DTE_FLAG_MASK;
+
+ amd_iommu_apply_erratum_63(devid);
+ }
+diff --git a/drivers/iommu/amd_iommu_types.h b/drivers/iommu/amd_iommu_types.h
+index cec51a8ba844..791442af1fba 100644
+--- a/drivers/iommu/amd_iommu_types.h
++++ b/drivers/iommu/amd_iommu_types.h
+@@ -289,6 +289,7 @@
+ #define IOMMU_PTE_IR (1ULL << 61)
+ #define IOMMU_PTE_IW (1ULL << 62)
+
++#define DTE_FLAG_MASK (0x3ffULL << 32)
+ #define DTE_FLAG_IOTLB (0x01UL << 32)
+ #define DTE_FLAG_GV (0x01ULL << 55)
+ #define DTE_GLX_SHIFT (56)
+diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c
+index 0801e35b9940..a7c9685c52f6 100644
+--- a/drivers/md/dm-thin.c
++++ b/drivers/md/dm-thin.c
+@@ -2596,7 +2596,7 @@ static int pool_ctr(struct dm_target *ti, unsigned argc, char **argv)
+ metadata_low_callback,
+ pool);
+ if (r)
+- goto out_free_pt;
++ goto out_flags_changed;
+
+ pt->callbacks.congested_fn = pool_is_congested;
+ dm_table_add_target_callbacks(ti->table, &pt->callbacks);
+diff --git a/drivers/md/md.c b/drivers/md/md.c
+index 9c5d53f3e4c6..6c169f18aab8 100644
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -7560,8 +7560,7 @@ static int remove_and_add_spares(struct mddev *mddev,
+ !test_bit(Bitmap_sync, &rdev->flags)))
+ continue;
+
+- if (rdev->saved_raid_disk < 0)
+- rdev->recovery_offset = 0;
++ rdev->recovery_offset = 0;
+ if (mddev->pers->
+ hot_add_disk(mddev, rdev) == 0) {
+ if (sysfs_link_rdev(mddev, rdev))
+diff --git a/drivers/md/persistent-data/dm-btree-remove.c b/drivers/md/persistent-data/dm-btree-remove.c
+index 7c0d75547ccf..92cd09f3c69b 100644
+--- a/drivers/md/persistent-data/dm-btree-remove.c
++++ b/drivers/md/persistent-data/dm-btree-remove.c
+@@ -301,11 +301,16 @@ static void redistribute3(struct dm_btree_info *info, struct btree_node *parent,
+ {
+ int s;
+ uint32_t max_entries = le32_to_cpu(left->header.max_entries);
+- unsigned target = (nr_left + nr_center + nr_right) / 3;
+- BUG_ON(target > max_entries);
++ unsigned total = nr_left + nr_center + nr_right;
++ unsigned target_right = total / 3;
++ unsigned remainder = (target_right * 3) != total;
++ unsigned target_left = target_right + remainder;
++
++ BUG_ON(target_left > max_entries);
++ BUG_ON(target_right > max_entries);
+
+ if (nr_left < nr_right) {
+- s = nr_left - target;
++ s = nr_left - target_left;
+
+ if (s < 0 && nr_center < -s) {
+ /* not enough in central node */
+@@ -316,10 +321,10 @@ static void redistribute3(struct dm_btree_info *info, struct btree_node *parent,
+ } else
+ shift(left, center, s);
+
+- shift(center, right, target - nr_right);
++ shift(center, right, target_right - nr_right);
+
+ } else {
+- s = target - nr_right;
++ s = target_right - nr_right;
+ if (s > 0 && nr_center < s) {
+ /* not enough in central node */
+ shift(center, right, nr_center);
+@@ -329,7 +334,7 @@ static void redistribute3(struct dm_btree_info *info, struct btree_node *parent,
+ } else
+ shift(center, right, s);
+
+- shift(left, center, nr_left - target);
++ shift(left, center, nr_left - target_left);
+ }
+
+ *key_ptr(parent, c->index) = center->keys[0];
+diff --git a/drivers/md/persistent-data/dm-btree.c b/drivers/md/persistent-data/dm-btree.c
+index c7726cebc495..d6e47033b5e0 100644
+--- a/drivers/md/persistent-data/dm-btree.c
++++ b/drivers/md/persistent-data/dm-btree.c
+@@ -523,7 +523,7 @@ static int btree_split_beneath(struct shadow_spine *s, uint64_t key)
+
+ r = new_block(s->info, &right);
+ if (r < 0) {
+- /* FIXME: put left */
++ unlock_block(s->info, left);
+ return r;
+ }
+
+diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
+index d24245c7b94a..3c8ada48ca76 100644
+--- a/drivers/md/raid1.c
++++ b/drivers/md/raid1.c
+@@ -2245,7 +2245,7 @@ static int narrow_write_error(struct r1bio *r1_bio, int i)
+ bio_trim(wbio, sector - r1_bio->sector, sectors);
+ wbio->bi_iter.bi_sector += rdev->data_offset;
+ wbio->bi_bdev = rdev->bdev;
+- if (submit_bio_wait(WRITE, wbio) == 0)
++ if (submit_bio_wait(WRITE, wbio) < 0)
+ /* failure! */
+ ok = rdev_set_badblocks(rdev, sector,
+ sectors, 0)
+diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
+index 17eb76760bf5..644f9e576736 100644
+--- a/drivers/md/raid10.c
++++ b/drivers/md/raid10.c
+@@ -2599,7 +2599,7 @@ static int narrow_write_error(struct r10bio *r10_bio, int i)
+ choose_data_offset(r10_bio, rdev) +
+ (sector - r10_bio->sector));
+ wbio->bi_bdev = rdev->bdev;
+- if (submit_bio_wait(WRITE, wbio) == 0)
++ if (submit_bio_wait(WRITE, wbio) < 0)
+ /* Failure! */
+ ok = rdev_set_badblocks(rdev, sector,
+ sectors, 0)
+diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
+index e421016bab77..5fa7549ba409 100644
+--- a/drivers/md/raid5.c
++++ b/drivers/md/raid5.c
+@@ -3060,6 +3060,8 @@ static void handle_stripe_clean_event(struct r5conf *conf,
+ }
+ if (!discard_pending &&
+ test_bit(R5_Discard, &sh->dev[sh->pd_idx].flags)) {
++ int hash = sh->hash_lock_index;
++
+ clear_bit(R5_Discard, &sh->dev[sh->pd_idx].flags);
+ clear_bit(R5_UPTODATE, &sh->dev[sh->pd_idx].flags);
+ if (sh->qd_idx >= 0) {
+@@ -3073,9 +3075,9 @@ static void handle_stripe_clean_event(struct r5conf *conf,
+ * no updated data, so remove it from hash list and the stripe
+ * will be reinitialized
+ */
+- spin_lock_irq(&conf->device_lock);
++ spin_lock_irq(conf->hash_locks + hash);
+ remove_hash(sh);
+- spin_unlock_irq(&conf->device_lock);
++ spin_unlock_irq(conf->hash_locks + hash);
+ if (test_bit(STRIPE_SYNC_REQUESTED, &sh->state))
+ set_bit(STRIPE_HANDLE, &sh->state);
+
+diff --git a/drivers/media/platform/vsp1/vsp1_regs.h b/drivers/media/platform/vsp1/vsp1_regs.h
+index 55f163d32d15..8bf802ca16ac 100644
+--- a/drivers/media/platform/vsp1/vsp1_regs.h
++++ b/drivers/media/platform/vsp1/vsp1_regs.h
+@@ -238,7 +238,7 @@
+ #define VI6_WPF_SZCLIP_EN (1 << 28)
+ #define VI6_WPF_SZCLIP_OFST_MASK (0xff << 16)
+ #define VI6_WPF_SZCLIP_OFST_SHIFT 16
+-#define VI6_WPF_SZCLIP_SIZE_MASK (0x1fff << 0)
++#define VI6_WPF_SZCLIP_SIZE_MASK (0xfff << 0)
+ #define VI6_WPF_SZCLIP_SIZE_SHIFT 0
+
+ #define VI6_WPF_OUTFMT 0x100c
+@@ -304,9 +304,9 @@
+ #define VI6_DPR_HST_ROUTE 0x2044
+ #define VI6_DPR_HSI_ROUTE 0x2048
+ #define VI6_DPR_BRU_ROUTE 0x204c
+-#define VI6_DPR_ROUTE_FXA_MASK (0xff << 8)
++#define VI6_DPR_ROUTE_FXA_MASK (0xff << 16)
+ #define VI6_DPR_ROUTE_FXA_SHIFT 16
+-#define VI6_DPR_ROUTE_FP_MASK (0xff << 8)
++#define VI6_DPR_ROUTE_FP_MASK (0x3f << 8)
+ #define VI6_DPR_ROUTE_FP_SHIFT 8
+ #define VI6_DPR_ROUTE_RT_MASK (0x3f << 0)
+ #define VI6_DPR_ROUTE_RT_SHIFT 0
+diff --git a/drivers/media/usb/gspca/m5602/m5602_s5k83a.c b/drivers/media/usb/gspca/m5602/m5602_s5k83a.c
+index 7cbc3a00bda8..bf6b215438e3 100644
+--- a/drivers/media/usb/gspca/m5602/m5602_s5k83a.c
++++ b/drivers/media/usb/gspca/m5602/m5602_s5k83a.c
+@@ -177,7 +177,7 @@ static int rotation_thread_function(void *data)
+ __s32 vflip, hflip;
+
+ set_current_state(TASK_INTERRUPTIBLE);
+- while (!schedule_timeout(100)) {
++ while (!schedule_timeout(msecs_to_jiffies(100))) {
+ if (mutex_lock_interruptible(&sd->gspca_dev.usb_lock))
+ break;
+
+diff --git a/drivers/media/usb/usbvision/usbvision-video.c b/drivers/media/usb/usbvision/usbvision-video.c
+index 9bfa041e3316..d78689831aea 100644
+--- a/drivers/media/usb/usbvision/usbvision-video.c
++++ b/drivers/media/usb/usbvision/usbvision-video.c
+@@ -435,6 +435,7 @@ static int usbvision_v4l2_close(struct file *file)
+ usbvision_scratch_free(usbvision);
+
+ usbvision->user--;
++ mutex_unlock(&usbvision->v4l2_lock);
+
+ if (power_on_at_open) {
+ /* power off in a little while
+@@ -448,7 +449,6 @@ static int usbvision_v4l2_close(struct file *file)
+ usbvision_release(usbvision);
+ return 0;
+ }
+- mutex_unlock(&usbvision->v4l2_lock);
+
+ PDEBUG(DBG_IO, "success");
+ return 0;
+diff --git a/drivers/message/fusion/mptctl.c b/drivers/message/fusion/mptctl.c
+index 70bb7530b22c..fc7393729081 100644
+--- a/drivers/message/fusion/mptctl.c
++++ b/drivers/message/fusion/mptctl.c
+@@ -1859,6 +1859,15 @@ mptctl_do_mpt_command (struct mpt_ioctl_command karg, void __user *mfPtr)
+ }
+ spin_unlock_irqrestore(&ioc->taskmgmt_lock, flags);
+
++ /* Basic sanity checks to prevent underflows or integer overflows */
++ if (karg.maxReplyBytes < 0 ||
++ karg.dataInSize < 0 ||
++ karg.dataOutSize < 0 ||
++ karg.dataSgeOffset < 0 ||
++ karg.maxSenseBytes < 0 ||
++ karg.dataSgeOffset > ioc->req_sz / 4)
++ return -EINVAL;
++
+ /* Verify that the final request frame will not be too large.
+ */
+ sz = karg.dataSgeOffset * 4;
+diff --git a/drivers/mfd/wm5110-tables.c b/drivers/mfd/wm5110-tables.c
+index 4642b5b816a0..6ccc0fdab767 100644
+--- a/drivers/mfd/wm5110-tables.c
++++ b/drivers/mfd/wm5110-tables.c
+@@ -249,6 +249,16 @@ static const struct reg_default wm5110_revd_patch[] = {
+ { 0x80, 0x0 },
+ };
+
++/* Add extra headphone write sequence locations */
++static const struct reg_default wm5110_reve_patch[] = {
++ { 0x80, 0x3 },
++ { 0x80, 0x3 },
++ { 0x4b, 0x138 },
++ { 0x4c, 0x13d },
++ { 0x80, 0x0 },
++ { 0x80, 0x0 },
++};
++
+ /* We use a function so we can use ARRAY_SIZE() */
+ int wm5110_patch(struct arizona *arizona)
+ {
+@@ -266,7 +276,9 @@ int wm5110_patch(struct arizona *arizona)
+ wm5110_revd_patch,
+ ARRAY_SIZE(wm5110_revd_patch));
+ default:
+- return 0;
++ return regmap_register_patch(arizona->regmap,
++ wm5110_reve_patch,
++ ARRAY_SIZE(wm5110_reve_patch));
+ }
+ }
+ EXPORT_SYMBOL_GPL(wm5110_patch);
+diff --git a/drivers/net/ethernet/mellanox/mlx4/cmd.c b/drivers/net/ethernet/mellanox/mlx4/cmd.c
+index 61ebb038fb75..2a6b149d7da3 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/cmd.c
++++ b/drivers/net/ethernet/mellanox/mlx4/cmd.c
+@@ -2047,7 +2047,7 @@ int mlx4_multi_func_init(struct mlx4_dev *dev)
+ spin_lock_init(&s_state->lock);
+ }
+
+- memset(&priv->mfunc.master.cmd_eqe, 0, dev->caps.eqe_size);
++ memset(&priv->mfunc.master.cmd_eqe, 0, sizeof(struct mlx4_eqe));
+ priv->mfunc.master.cmd_eqe.type = MLX4_EVENT_TYPE_CMD;
+ INIT_WORK(&priv->mfunc.master.comm_work,
+ mlx4_master_comm_channel);
+diff --git a/drivers/net/ethernet/mellanox/mlx4/eq.c b/drivers/net/ethernet/mellanox/mlx4/eq.c
+index af67e7d410eb..11ef2c2af9bf 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/eq.c
++++ b/drivers/net/ethernet/mellanox/mlx4/eq.c
+@@ -185,7 +185,7 @@ static void slave_event(struct mlx4_dev *dev, u8 slave, struct mlx4_eqe *eqe)
+ return;
+ }
+
+- memcpy(s_eqe, eqe, dev->caps.eqe_size - 1);
++ memcpy(s_eqe, eqe, sizeof(struct mlx4_eqe) - 1);
+ s_eqe->slave_id = slave;
+ /* ensure all information is written before setting the ownersip bit */
+ wmb();
+diff --git a/drivers/net/ethernet/sfc/ef10.c b/drivers/net/ethernet/sfc/ef10.c
+index a77f05ce8325..63ec209cdfd3 100644
+--- a/drivers/net/ethernet/sfc/ef10.c
++++ b/drivers/net/ethernet/sfc/ef10.c
+@@ -1344,7 +1344,9 @@ static void efx_ef10_tx_write(struct efx_tx_queue *tx_queue)
+ unsigned int write_ptr;
+ efx_qword_t *txd;
+
+- BUG_ON(tx_queue->write_count == tx_queue->insert_count);
++ tx_queue->xmit_more_available = false;
++ if (unlikely(tx_queue->write_count == tx_queue->insert_count))
++ return;
+
+ do {
+ write_ptr = tx_queue->write_count & tx_queue->ptr_mask;
+diff --git a/drivers/net/ethernet/sfc/farch.c b/drivers/net/ethernet/sfc/farch.c
+index 6859437b59fb..b70b865fd19b 100644
+--- a/drivers/net/ethernet/sfc/farch.c
++++ b/drivers/net/ethernet/sfc/farch.c
+@@ -316,7 +316,9 @@ void efx_farch_tx_write(struct efx_tx_queue *tx_queue)
+ unsigned write_ptr;
+ unsigned old_write_count = tx_queue->write_count;
+
+- BUG_ON(tx_queue->write_count == tx_queue->insert_count);
++ tx_queue->xmit_more_available = false;
++ if (unlikely(tx_queue->write_count == tx_queue->insert_count))
++ return;
+
+ do {
+ write_ptr = tx_queue->write_count & tx_queue->ptr_mask;
+diff --git a/drivers/net/ethernet/sfc/net_driver.h b/drivers/net/ethernet/sfc/net_driver.h
+index 9ede32064685..eda39c82f7e7 100644
+--- a/drivers/net/ethernet/sfc/net_driver.h
++++ b/drivers/net/ethernet/sfc/net_driver.h
+@@ -218,6 +218,7 @@ struct efx_tx_buffer {
+ * @tso_packets: Number of packets via the TSO xmit path
+ * @pushes: Number of times the TX push feature has been used
+ * @pio_packets: Number of times the TX PIO feature has been used
++ * @xmit_more_available: Are any packets waiting to be pushed to the NIC
+ * @empty_read_count: If the completion path has seen the queue as empty
+ * and the transmission path has not yet checked this, the value of
+ * @read_count bitwise-added to %EFX_EMPTY_COUNT_VALID; otherwise 0.
+@@ -250,6 +251,7 @@ struct efx_tx_queue {
+ unsigned int tso_packets;
+ unsigned int pushes;
+ unsigned int pio_packets;
++ bool xmit_more_available;
+ /* Statistics to supplement MAC stats */
+ unsigned long tx_packets;
+
+diff --git a/drivers/net/ethernet/sfc/selftest.c b/drivers/net/ethernet/sfc/selftest.c
+index 10b6173d557d..b605dfd5c7bc 100644
+--- a/drivers/net/ethernet/sfc/selftest.c
++++ b/drivers/net/ethernet/sfc/selftest.c
+@@ -46,7 +46,7 @@ struct efx_loopback_payload {
+ struct iphdr ip;
+ struct udphdr udp;
+ __be16 iteration;
+- const char msg[64];
++ char msg[64];
+ } __packed;
+
+ /* Loopback test source MAC address */
+diff --git a/drivers/net/ethernet/sfc/tx.c b/drivers/net/ethernet/sfc/tx.c
+index aaf2987512b5..e70edc3dea7e 100644
+--- a/drivers/net/ethernet/sfc/tx.c
++++ b/drivers/net/ethernet/sfc/tx.c
+@@ -431,8 +431,20 @@ finish_packet:
+ efx_tx_maybe_stop_queue(tx_queue);
+
+ /* Pass off to hardware */
+- if (!skb->xmit_more || netif_xmit_stopped(tx_queue->core_txq))
++ if (!skb->xmit_more || netif_xmit_stopped(tx_queue->core_txq)) {
++ struct efx_tx_queue *txq2 = efx_tx_queue_partner(tx_queue);
++
++ /* There could be packets left on the partner queue if those
++ * SKBs had skb->xmit_more set. If we do not push those they
++ * could be left for a long time and cause a netdev watchdog.
++ */
++ if (txq2->xmit_more_available)
++ efx_nic_push_buffers(txq2);
++
+ efx_nic_push_buffers(tx_queue);
++ } else {
++ tx_queue->xmit_more_available = skb->xmit_more;
++ }
+
+ tx_queue->tx_packets++;
+
+@@ -721,6 +733,7 @@ void efx_init_tx_queue(struct efx_tx_queue *tx_queue)
+ tx_queue->read_count = 0;
+ tx_queue->old_read_count = 0;
+ tx_queue->empty_read_count = 0 | EFX_EMPTY_COUNT_VALID;
++ tx_queue->xmit_more_available = false;
+
+ /* Set up TX descriptor ring */
+ efx_nic_init_tx(tx_queue);
+@@ -746,6 +759,7 @@ void efx_fini_tx_queue(struct efx_tx_queue *tx_queue)
+
+ ++tx_queue->read_count;
+ }
++ tx_queue->xmit_more_available = false;
+ netdev_tx_reset_queue(tx_queue->core_txq);
+ }
+
+@@ -1301,8 +1315,20 @@ static int efx_enqueue_skb_tso(struct efx_tx_queue *tx_queue,
+ efx_tx_maybe_stop_queue(tx_queue);
+
+ /* Pass off to hardware */
+- if (!skb->xmit_more || netif_xmit_stopped(tx_queue->core_txq))
++ if (!skb->xmit_more || netif_xmit_stopped(tx_queue->core_txq)) {
++ struct efx_tx_queue *txq2 = efx_tx_queue_partner(tx_queue);
++
++ /* There could be packets left on the partner queue if those
++ * SKBs had skb->xmit_more set. If we do not push those they
++ * could be left for a long time and cause a netdev watchdog.
++ */
++ if (txq2->xmit_more_available)
++ efx_nic_push_buffers(txq2);
++
+ efx_nic_push_buffers(tx_queue);
++ } else {
++ tx_queue->xmit_more_available = skb->xmit_more;
++ }
+
+ tx_queue->tso_bursts++;
+ return NETDEV_TX_OK;
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c
+index 3a08a1f78c73..11edb2c9e572 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c
+@@ -721,10 +721,13 @@ static int stmmac_get_ts_info(struct net_device *dev,
+ {
+ struct stmmac_priv *priv = netdev_priv(dev);
+
+- if ((priv->hwts_tx_en) && (priv->hwts_rx_en)) {
++ if ((priv->dma_cap.time_stamp || priv->dma_cap.atime_stamp)) {
+
+- info->so_timestamping = SOF_TIMESTAMPING_TX_HARDWARE |
++ info->so_timestamping = SOF_TIMESTAMPING_TX_SOFTWARE |
++ SOF_TIMESTAMPING_TX_HARDWARE |
++ SOF_TIMESTAMPING_RX_SOFTWARE |
+ SOF_TIMESTAMPING_RX_HARDWARE |
++ SOF_TIMESTAMPING_SOFTWARE |
+ SOF_TIMESTAMPING_RAW_HARDWARE;
+
+ if (priv->ptp_clock)
+diff --git a/drivers/net/macvtap.c b/drivers/net/macvtap.c
+index 91d0c6a86e37..91120f0ed98c 100644
+--- a/drivers/net/macvtap.c
++++ b/drivers/net/macvtap.c
+@@ -68,7 +68,7 @@ static const struct proto_ops macvtap_socket_ops;
+ #define TUN_OFFLOADS (NETIF_F_HW_CSUM | NETIF_F_TSO_ECN | NETIF_F_TSO | \
+ NETIF_F_TSO6)
+ #define RX_OFFLOADS (NETIF_F_GRO | NETIF_F_LRO)
+-#define TAP_FEATURES (NETIF_F_GSO | NETIF_F_SG)
++#define TAP_FEATURES (NETIF_F_GSO | NETIF_F_SG | NETIF_F_FRAGLIST)
+
+ static struct macvlan_dev *macvtap_get_vlan_rcu(const struct net_device *dev)
+ {
+diff --git a/drivers/net/phy/broadcom.c b/drivers/net/phy/broadcom.c
+index 854f2c9a7b2b..64860c041745 100644
+--- a/drivers/net/phy/broadcom.c
++++ b/drivers/net/phy/broadcom.c
+@@ -674,7 +674,7 @@ static struct mdio_device_id __maybe_unused broadcom_tbl[] = {
+ { PHY_ID_BCM5421, 0xfffffff0 },
+ { PHY_ID_BCM5461, 0xfffffff0 },
+ { PHY_ID_BCM5464, 0xfffffff0 },
+- { PHY_ID_BCM5482, 0xfffffff0 },
++ { PHY_ID_BCM5481, 0xfffffff0 },
+ { PHY_ID_BCM5482, 0xfffffff0 },
+ { PHY_ID_BCM50610, 0xfffffff0 },
+ { PHY_ID_BCM50610M, 0xfffffff0 },
+diff --git a/drivers/net/ppp/pppoe.c b/drivers/net/ppp/pppoe.c
+index 6c9c16d76935..5aa563136373 100644
+--- a/drivers/net/ppp/pppoe.c
++++ b/drivers/net/ppp/pppoe.c
+@@ -313,7 +313,6 @@ static void pppoe_flush_dev(struct net_device *dev)
+ if (po->pppoe_dev == dev &&
+ sk->sk_state & (PPPOX_CONNECTED | PPPOX_BOUND | PPPOX_ZOMBIE)) {
+ pppox_unbind_sock(sk);
+- sk->sk_state = PPPOX_ZOMBIE;
+ sk->sk_state_change(sk);
+ po->pppoe_dev = NULL;
+ dev_put(dev);
+@@ -570,7 +569,7 @@ static int pppoe_release(struct socket *sock)
+
+ po = pppox_sk(sk);
+
+- if (sk->sk_state & (PPPOX_CONNECTED | PPPOX_BOUND | PPPOX_ZOMBIE)) {
++ if (po->pppoe_dev) {
+ dev_put(po->pppoe_dev);
+ po->pppoe_dev = NULL;
+ }
+diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
+index b8a82b86f909..a5771515d9ab 100644
+--- a/drivers/net/usb/qmi_wwan.c
++++ b/drivers/net/usb/qmi_wwan.c
+@@ -535,6 +535,10 @@ static const struct usb_device_id products[] = {
+ USB_CDC_PROTO_NONE),
+ .driver_info = (unsigned long)&qmi_wwan_info,
+ },
++ { /* HP lt4112 LTE/HSPA+ Gobi 4G Module (Huawei me906e) */
++ USB_DEVICE_AND_INTERFACE_INFO(0x03f0, 0x581d, USB_CLASS_VENDOR_SPEC, 1, 7),
++ .driver_info = (unsigned long)&qmi_wwan_info,
++ },
+
+ /* 3. Combined interface devices matching on interface number */
+ {QMI_FIXED_INTF(0x0408, 0xea42, 4)}, /* Yota / Megafon M100-1 */
+@@ -760,12 +764,17 @@ static const struct usb_device_id products[] = {
+ {QMI_FIXED_INTF(0x1199, 0x9056, 8)}, /* Sierra Wireless Modem */
+ {QMI_FIXED_INTF(0x1199, 0x9057, 8)},
+ {QMI_FIXED_INTF(0x1199, 0x9061, 8)}, /* Sierra Wireless Modem */
++ {QMI_FIXED_INTF(0x1199, 0x9070, 8)}, /* Sierra Wireless MC74xx/EM74xx */
++ {QMI_FIXED_INTF(0x1199, 0x9070, 10)}, /* Sierra Wireless MC74xx/EM74xx */
++ {QMI_FIXED_INTF(0x1199, 0x9071, 8)}, /* Sierra Wireless MC74xx/EM74xx */
++ {QMI_FIXED_INTF(0x1199, 0x9071, 10)}, /* Sierra Wireless MC74xx/EM74xx */
+ {QMI_FIXED_INTF(0x1bbb, 0x011e, 4)}, /* Telekom Speedstick LTE II (Alcatel One Touch L100V LTE) */
+ {QMI_FIXED_INTF(0x1bbb, 0x0203, 2)}, /* Alcatel L800MA */
+ {QMI_FIXED_INTF(0x2357, 0x0201, 4)}, /* TP-LINK HSUPA Modem MA180 */
+ {QMI_FIXED_INTF(0x2357, 0x9000, 4)}, /* TP-LINK MA260 */
+ {QMI_FIXED_INTF(0x1bc7, 0x1200, 5)}, /* Telit LE920 */
+ {QMI_FIXED_INTF(0x1bc7, 0x1201, 2)}, /* Telit LE920 */
++ {QMI_FIXED_INTF(0x1c9e, 0x9b01, 3)}, /* XS Stick W100-2 from 4G Systems */
+ {QMI_FIXED_INTF(0x0b3c, 0xc000, 4)}, /* Olivetti Olicard 100 */
+ {QMI_FIXED_INTF(0x0b3c, 0xc001, 4)}, /* Olivetti Olicard 120 */
+ {QMI_FIXED_INTF(0x0b3c, 0xc002, 4)}, /* Olivetti Olicard 140 */
+@@ -780,7 +789,6 @@ static const struct usb_device_id products[] = {
+ {QMI_FIXED_INTF(0x413c, 0x81a4, 8)}, /* Dell Wireless 5570e HSPA+ (42Mbps) Mobile Broadband Card */
+ {QMI_FIXED_INTF(0x413c, 0x81a8, 8)}, /* Dell Wireless 5808 Gobi(TM) 4G LTE Mobile Broadband Card */
+ {QMI_FIXED_INTF(0x413c, 0x81a9, 8)}, /* Dell Wireless 5808e Gobi(TM) 4G LTE Mobile Broadband Card */
+- {QMI_FIXED_INTF(0x03f0, 0x581d, 4)}, /* HP lt4112 LTE/HSPA+ Gobi 4G Module (Huawei me906e) */
+
+ /* 4. Gobi 1000 devices */
+ {QMI_GOBI1K_DEVICE(0x05c6, 0x9212)}, /* Acer Gobi Modem Device */
+diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
+index 484ecce78025..ce2a29971230 100644
+--- a/drivers/net/virtio_net.c
++++ b/drivers/net/virtio_net.c
+@@ -1746,9 +1746,9 @@ static int virtnet_probe(struct virtio_device *vdev)
+ /* Do we support "hardware" checksums? */
+ if (virtio_has_feature(vdev, VIRTIO_NET_F_CSUM)) {
+ /* This opens up the world of extra features. */
+- dev->hw_features |= NETIF_F_HW_CSUM|NETIF_F_SG|NETIF_F_FRAGLIST;
++ dev->hw_features |= NETIF_F_HW_CSUM | NETIF_F_SG;
+ if (csum)
+- dev->features |= NETIF_F_HW_CSUM|NETIF_F_SG|NETIF_F_FRAGLIST;
++ dev->features |= NETIF_F_HW_CSUM | NETIF_F_SG;
+
+ if (virtio_has_feature(vdev, VIRTIO_NET_F_GSO)) {
+ dev->hw_features |= NETIF_F_TSO
+diff --git a/drivers/net/wireless/ath/ath9k/init.c b/drivers/net/wireless/ath/ath9k/init.c
+index 3bd030494986..ee15a579ec70 100644
+--- a/drivers/net/wireless/ath/ath9k/init.c
++++ b/drivers/net/wireless/ath/ath9k/init.c
+@@ -821,6 +821,7 @@ static void ath9k_set_hw_capab(struct ath_softc *sc, struct ieee80211_hw *hw)
+ hw->max_rate_tries = 10;
+ hw->sta_data_size = sizeof(struct ath_node);
+ hw->vif_data_size = sizeof(struct ath_vif);
++ hw->extra_tx_headroom = 4;
+
+ hw->wiphy->available_antennas_rx = BIT(ah->caps.max_rxchains) - 1;
+ hw->wiphy->available_antennas_tx = BIT(ah->caps.max_txchains) - 1;
+diff --git a/drivers/net/wireless/iwlwifi/dvm/lib.c b/drivers/net/wireless/iwlwifi/dvm/lib.c
+index cfe1293692fc..b51fb8977104 100644
+--- a/drivers/net/wireless/iwlwifi/dvm/lib.c
++++ b/drivers/net/wireless/iwlwifi/dvm/lib.c
+@@ -1022,7 +1022,7 @@ static void iwlagn_wowlan_program_keys(struct ieee80211_hw *hw,
+ u8 *pn = seq.ccmp.pn;
+
+ ieee80211_get_key_rx_seq(key, i, &seq);
+- aes_sc->pn = cpu_to_le64(
++ aes_sc[i].pn = cpu_to_le64(
+ (u64)pn[5] |
+ ((u64)pn[4] << 8) |
+ ((u64)pn[3] << 16) |
+diff --git a/drivers/net/wireless/iwlwifi/iwl-7000.c b/drivers/net/wireless/iwlwifi/iwl-7000.c
+index b04b8858c690..9dfd1d1106d7 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-7000.c
++++ b/drivers/net/wireless/iwlwifi/iwl-7000.c
+@@ -102,6 +102,9 @@
+ #define IWL7265_FW_PRE "iwlwifi-7265-"
+ #define IWL7265_MODULE_FIRMWARE(api) IWL7265_FW_PRE __stringify(api) ".ucode"
+
++#define IWL7265D_FW_PRE "iwlwifi-7265D-"
++#define IWL7265D_MODULE_FIRMWARE(api) IWL7265_FW_PRE __stringify(api) ".ucode"
++
+ #define NVM_HW_SECTION_NUM_FAMILY_7000 0
+
+ static const struct iwl_base_params iwl7000_base_params = {
+@@ -267,7 +270,37 @@ const struct iwl_cfg iwl7265_n_cfg = {
+ .pwr_tx_backoffs = iwl7265_pwr_tx_backoffs,
+ };
+
++const struct iwl_cfg iwl7265d_2ac_cfg = {
++ .name = "Intel(R) Dual Band Wireless AC 7265",
++ .fw_name_pre = IWL7265D_FW_PRE,
++ IWL_DEVICE_7000,
++ .ht_params = &iwl7265_ht_params,
++ .nvm_ver = IWL7265_NVM_VERSION,
++ .nvm_calib_ver = IWL7265_TX_POWER_VERSION,
++ .pwr_tx_backoffs = iwl7265_pwr_tx_backoffs,
++};
++
++const struct iwl_cfg iwl7265d_2n_cfg = {
++ .name = "Intel(R) Dual Band Wireless N 7265",
++ .fw_name_pre = IWL7265D_FW_PRE,
++ IWL_DEVICE_7000,
++ .ht_params = &iwl7265_ht_params,
++ .nvm_ver = IWL7265_NVM_VERSION,
++ .nvm_calib_ver = IWL7265_TX_POWER_VERSION,
++ .pwr_tx_backoffs = iwl7265_pwr_tx_backoffs,
++};
++
++const struct iwl_cfg iwl7265d_n_cfg = {
++ .name = "Intel(R) Wireless N 7265",
++ .fw_name_pre = IWL7265D_FW_PRE,
++ IWL_DEVICE_7000,
++ .ht_params = &iwl7265_ht_params,
++ .nvm_ver = IWL7265_NVM_VERSION,
++ .nvm_calib_ver = IWL7265_TX_POWER_VERSION,
++ .pwr_tx_backoffs = iwl7265_pwr_tx_backoffs,
++};
++
+ MODULE_FIRMWARE(IWL7260_MODULE_FIRMWARE(IWL7260_UCODE_API_OK));
+-MODULE_FIRMWARE(IWL3160_MODULE_FIRMWARE(IWL3160_UCODE_API_OK));
+-MODULE_FIRMWARE(IWL3165_MODULE_FIRMWARE(IWL3160_UCODE_API_OK));
++MODULE_FIRMWARE(IWL3160_MODULE_FIRMWARE(IWL7260_UCODE_API_OK));
+ MODULE_FIRMWARE(IWL7265_MODULE_FIRMWARE(IWL7260_UCODE_API_OK));
++MODULE_FIRMWARE(IWL7265D_MODULE_FIRMWARE(IWL7260_UCODE_API_OK));
+diff --git a/drivers/net/wireless/iwlwifi/iwl-config.h b/drivers/net/wireless/iwlwifi/iwl-config.h
+index 2ef83a39ff10..6cc051cace5d 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-config.h
++++ b/drivers/net/wireless/iwlwifi/iwl-config.h
+@@ -346,6 +346,9 @@ extern const struct iwl_cfg iwl3165_2ac_cfg;
+ extern const struct iwl_cfg iwl7265_2ac_cfg;
+ extern const struct iwl_cfg iwl7265_2n_cfg;
+ extern const struct iwl_cfg iwl7265_n_cfg;
++extern const struct iwl_cfg iwl7265d_2ac_cfg;
++extern const struct iwl_cfg iwl7265d_2n_cfg;
++extern const struct iwl_cfg iwl7265d_n_cfg;
+ extern const struct iwl_cfg iwl8260_2n_cfg;
+ extern const struct iwl_cfg iwl8260_2ac_cfg;
+ extern const struct iwl_cfg iwl8260_2ac_sdio_cfg;
+diff --git a/drivers/net/wireless/iwlwifi/iwl-csr.h b/drivers/net/wireless/iwlwifi/iwl-csr.h
+index 3f6f015285e5..671bdbca33ee 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-csr.h
++++ b/drivers/net/wireless/iwlwifi/iwl-csr.h
+@@ -305,23 +305,24 @@ enum {
+ };
+
+
+-#define CSR_HW_REV_TYPE_MSK (0x000FFF0)
+-#define CSR_HW_REV_TYPE_5300 (0x0000020)
+-#define CSR_HW_REV_TYPE_5350 (0x0000030)
+-#define CSR_HW_REV_TYPE_5100 (0x0000050)
+-#define CSR_HW_REV_TYPE_5150 (0x0000040)
+-#define CSR_HW_REV_TYPE_1000 (0x0000060)
+-#define CSR_HW_REV_TYPE_6x00 (0x0000070)
+-#define CSR_HW_REV_TYPE_6x50 (0x0000080)
+-#define CSR_HW_REV_TYPE_6150 (0x0000084)
+-#define CSR_HW_REV_TYPE_6x05 (0x00000B0)
+-#define CSR_HW_REV_TYPE_6x30 CSR_HW_REV_TYPE_6x05
+-#define CSR_HW_REV_TYPE_6x35 CSR_HW_REV_TYPE_6x05
+-#define CSR_HW_REV_TYPE_2x30 (0x00000C0)
+-#define CSR_HW_REV_TYPE_2x00 (0x0000100)
+-#define CSR_HW_REV_TYPE_105 (0x0000110)
+-#define CSR_HW_REV_TYPE_135 (0x0000120)
+-#define CSR_HW_REV_TYPE_NONE (0x00001F0)
++#define CSR_HW_REV_TYPE_MSK (0x000FFF0)
++#define CSR_HW_REV_TYPE_5300 (0x0000020)
++#define CSR_HW_REV_TYPE_5350 (0x0000030)
++#define CSR_HW_REV_TYPE_5100 (0x0000050)
++#define CSR_HW_REV_TYPE_5150 (0x0000040)
++#define CSR_HW_REV_TYPE_1000 (0x0000060)
++#define CSR_HW_REV_TYPE_6x00 (0x0000070)
++#define CSR_HW_REV_TYPE_6x50 (0x0000080)
++#define CSR_HW_REV_TYPE_6150 (0x0000084)
++#define CSR_HW_REV_TYPE_6x05 (0x00000B0)
++#define CSR_HW_REV_TYPE_6x30 CSR_HW_REV_TYPE_6x05
++#define CSR_HW_REV_TYPE_6x35 CSR_HW_REV_TYPE_6x05
++#define CSR_HW_REV_TYPE_2x30 (0x00000C0)
++#define CSR_HW_REV_TYPE_2x00 (0x0000100)
++#define CSR_HW_REV_TYPE_105 (0x0000110)
++#define CSR_HW_REV_TYPE_135 (0x0000120)
++#define CSR_HW_REV_TYPE_7265D (0x0000210)
++#define CSR_HW_REV_TYPE_NONE (0x00001F0)
+
+ /* EEPROM REG */
+ #define CSR_EEPROM_REG_READ_VALID_MSK (0x00000001)
+diff --git a/drivers/net/wireless/iwlwifi/mvm/d3.c b/drivers/net/wireless/iwlwifi/mvm/d3.c
+index c17be0fb7283..8da34a5d024f 100644
+--- a/drivers/net/wireless/iwlwifi/mvm/d3.c
++++ b/drivers/net/wireless/iwlwifi/mvm/d3.c
+@@ -298,12 +298,12 @@ static void iwl_mvm_wowlan_program_keys(struct ieee80211_hw *hw,
+ u8 *pn = seq.ccmp.pn;
+
+ ieee80211_get_key_rx_seq(key, i, &seq);
+- aes_sc->pn = cpu_to_le64((u64)pn[5] |
+- ((u64)pn[4] << 8) |
+- ((u64)pn[3] << 16) |
+- ((u64)pn[2] << 24) |
+- ((u64)pn[1] << 32) |
+- ((u64)pn[0] << 40));
++ aes_sc[i].pn = cpu_to_le64((u64)pn[5] |
++ ((u64)pn[4] << 8) |
++ ((u64)pn[3] << 16) |
++ ((u64)pn[2] << 24) |
++ ((u64)pn[1] << 32) |
++ ((u64)pn[0] << 40));
+ }
+ data->use_rsc_tsc = true;
+ break;
+diff --git a/drivers/net/wireless/iwlwifi/pcie/drv.c b/drivers/net/wireless/iwlwifi/pcie/drv.c
+index 05cba8c05d3f..a2f624d5771d 100644
+--- a/drivers/net/wireless/iwlwifi/pcie/drv.c
++++ b/drivers/net/wireless/iwlwifi/pcie/drv.c
+@@ -410,6 +410,11 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
+ {IWL_PCI_DEVICE(0x095A, 0x5590, iwl7265_2ac_cfg)},
+ {IWL_PCI_DEVICE(0x095B, 0x5290, iwl7265_2ac_cfg)},
+ {IWL_PCI_DEVICE(0x095A, 0x5490, iwl7265_2ac_cfg)},
++ {IWL_PCI_DEVICE(0x095A, 0x5F10, iwl7265_2ac_cfg)},
++ {IWL_PCI_DEVICE(0x095B, 0x5212, iwl7265_2ac_cfg)},
++ {IWL_PCI_DEVICE(0x095B, 0x520A, iwl7265_2ac_cfg)},
++ {IWL_PCI_DEVICE(0x095A, 0x9000, iwl7265_2ac_cfg)},
++ {IWL_PCI_DEVICE(0x095A, 0x9400, iwl7265_2ac_cfg)},
+
+ /* 8000 Series */
+ {IWL_PCI_DEVICE(0x24F3, 0x0010, iwl8260_2ac_cfg)},
+@@ -503,6 +508,7 @@ static void set_dflt_pwr_limit(struct iwl_trans *trans, struct pci_dev *pdev) {}
+ static int iwl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ {
+ const struct iwl_cfg *cfg = (struct iwl_cfg *)(ent->driver_data);
++ const struct iwl_cfg *cfg_7265d __maybe_unused = NULL;
+ struct iwl_trans *iwl_trans;
+ struct iwl_trans_pcie *trans_pcie;
+ int ret;
+@@ -511,6 +517,25 @@ static int iwl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ if (IS_ERR(iwl_trans))
+ return PTR_ERR(iwl_trans);
+
++#if IS_ENABLED(CONFIG_IWLMVM)
++ /*
++ * special-case 7265D, it has the same PCI IDs.
++ *
++ * Note that because we already pass the cfg to the transport above,
++ * all the parameters that the transport uses must, until that is
++ * changed, be identical to the ones in the 7265D configuration.
++ */
++ if (cfg == &iwl7265_2ac_cfg)
++ cfg_7265d = &iwl7265d_2ac_cfg;
++ else if (cfg == &iwl7265_2n_cfg)
++ cfg_7265d = &iwl7265d_2n_cfg;
++ else if (cfg == &iwl7265_n_cfg)
++ cfg_7265d = &iwl7265d_n_cfg;
++ if (cfg_7265d &&
++ (iwl_trans->hw_rev & CSR_HW_REV_TYPE_MSK) == CSR_HW_REV_TYPE_7265D)
++ cfg = cfg_7265d;
++#endif
++
+ pci_set_drvdata(pdev, iwl_trans);
+
+ trans_pcie = IWL_TRANS_GET_PCIE_TRANS(iwl_trans);
+diff --git a/drivers/pci/access.c b/drivers/pci/access.c
+index 49dd766852ba..7f249b9ab2ce 100644
+--- a/drivers/pci/access.c
++++ b/drivers/pci/access.c
+@@ -352,6 +352,56 @@ static const struct pci_vpd_ops pci_vpd_pci22_ops = {
+ .release = pci_vpd_pci22_release,
+ };
+
++static ssize_t pci_vpd_f0_read(struct pci_dev *dev, loff_t pos, size_t count,
++ void *arg)
++{
++ struct pci_dev *tdev = pci_get_slot(dev->bus, PCI_SLOT(dev->devfn));
++ ssize_t ret;
++
++ if (!tdev)
++ return -ENODEV;
++
++ ret = pci_read_vpd(tdev, pos, count, arg);
++ pci_dev_put(tdev);
++ return ret;
++}
++
++static ssize_t pci_vpd_f0_write(struct pci_dev *dev, loff_t pos, size_t count,
++ const void *arg)
++{
++ struct pci_dev *tdev = pci_get_slot(dev->bus, PCI_SLOT(dev->devfn));
++ ssize_t ret;
++
++ if (!tdev)
++ return -ENODEV;
++
++ ret = pci_write_vpd(tdev, pos, count, arg);
++ pci_dev_put(tdev);
++ return ret;
++}
++
++static const struct pci_vpd_ops pci_vpd_f0_ops = {
++ .read = pci_vpd_f0_read,
++ .write = pci_vpd_f0_write,
++ .release = pci_vpd_pci22_release,
++};
++
++static int pci_vpd_f0_dev_check(struct pci_dev *dev)
++{
++ struct pci_dev *tdev = pci_get_slot(dev->bus, PCI_SLOT(dev->devfn));
++ int ret = 0;
++
++ if (!tdev)
++ return -ENODEV;
++ if (!tdev->vpd || !tdev->multifunction ||
++ dev->class != tdev->class || dev->vendor != tdev->vendor ||
++ dev->device != tdev->device)
++ ret = -ENODEV;
++
++ pci_dev_put(tdev);
++ return ret;
++}
++
+ int pci_vpd_pci22_init(struct pci_dev *dev)
+ {
+ struct pci_vpd_pci22 *vpd;
+@@ -360,12 +410,21 @@ int pci_vpd_pci22_init(struct pci_dev *dev)
+ cap = pci_find_capability(dev, PCI_CAP_ID_VPD);
+ if (!cap)
+ return -ENODEV;
++ if (dev->dev_flags & PCI_DEV_FLAGS_VPD_REF_F0) {
++ int ret = pci_vpd_f0_dev_check(dev);
++
++ if (ret)
++ return ret;
++ }
+ vpd = kzalloc(sizeof(*vpd), GFP_ATOMIC);
+ if (!vpd)
+ return -ENOMEM;
+
+ vpd->base.len = PCI_VPD_PCI22_SIZE;
+- vpd->base.ops = &pci_vpd_pci22_ops;
++ if (dev->dev_flags & PCI_DEV_FLAGS_VPD_REF_F0)
++ vpd->base.ops = &pci_vpd_f0_ops;
++ else
++ vpd->base.ops = &pci_vpd_pci22_ops;
+ mutex_init(&vpd->lock);
+ vpd->cap = cap;
+ vpd->busy = false;
+diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
+index ff7af33f2353..ce0aa47222f6 100644
+--- a/drivers/pci/pci.c
++++ b/drivers/pci/pci.c
+@@ -3206,7 +3206,7 @@ static int pci_pm_reset(struct pci_dev *dev, int probe)
+ {
+ u16 csr;
+
+- if (!dev->pm_cap)
++ if (!dev->pm_cap || dev->dev_flags & PCI_DEV_FLAGS_NO_PM_RESET)
+ return -ENOTTY;
+
+ pci_read_config_word(dev, dev->pm_cap + PCI_PM_CTRL, &csr);
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index 00b1cd32a4b1..b6d646a97494 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -1883,6 +1883,15 @@ static void quirk_netmos(struct pci_dev *dev)
+ DECLARE_PCI_FIXUP_CLASS_HEADER(PCI_VENDOR_ID_NETMOS, PCI_ANY_ID,
+ PCI_CLASS_COMMUNICATION_SERIAL, 8, quirk_netmos);
+
++static void quirk_f0_vpd_link(struct pci_dev *dev)
++{
++ if (!dev->multifunction || !PCI_FUNC(dev->devfn))
++ return;
++ dev->dev_flags |= PCI_DEV_FLAGS_VPD_REF_F0;
++}
++DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, PCI_ANY_ID,
++ PCI_CLASS_NETWORK_ETHERNET, 8, quirk_f0_vpd_link);
++
+ static void quirk_e100_interrupt(struct pci_dev *dev)
+ {
+ u16 command, pmcsr;
+diff --git a/drivers/power/bq24190_charger.c b/drivers/power/bq24190_charger.c
+index e4c95e1a6733..d0e8236a6404 100644
+--- a/drivers/power/bq24190_charger.c
++++ b/drivers/power/bq24190_charger.c
+@@ -1208,7 +1208,7 @@ static irqreturn_t bq24190_irq_handler_thread(int irq, void *data)
+ {
+ struct bq24190_dev_info *bdi = data;
+ bool alert_userspace = false;
+- u8 ss_reg, f_reg;
++ u8 ss_reg = 0, f_reg = 0;
+ int ret;
+
+ pm_runtime_get_sync(bdi->dev);
+diff --git a/drivers/s390/char/con3270.c b/drivers/s390/char/con3270.c
+index 75ffe9980c3e..7c511add5aa7 100644
+--- a/drivers/s390/char/con3270.c
++++ b/drivers/s390/char/con3270.c
+@@ -413,6 +413,10 @@ con3270_irq(struct con3270 *cp, struct raw3270_request *rq, struct irb *irb)
+ else
+ /* Normal end. Copy residual count. */
+ rq->rescnt = irb->scsw.cmd.count;
++ } else if (irb->scsw.cmd.dstat & DEV_STAT_DEV_END) {
++ /* Interrupt without an outstanding request -> update all */
++ cp->update_flags = CON_UPDATE_ALL;
++ con3270_set_timer(cp, 1);
+ }
+ return RAW3270_IO_DONE;
+ }
+diff --git a/drivers/s390/char/tty3270.c b/drivers/s390/char/tty3270.c
+index e91b89dc6d1f..e96fc7fd9498 100644
+--- a/drivers/s390/char/tty3270.c
++++ b/drivers/s390/char/tty3270.c
+@@ -659,6 +659,10 @@ tty3270_irq(struct tty3270 *tp, struct raw3270_request *rq, struct irb *irb)
+ else
+ /* Normal end. Copy residual count. */
+ rq->rescnt = irb->scsw.cmd.count;
++ } else if (irb->scsw.cmd.dstat & DEV_STAT_DEV_END) {
++ /* Interrupt without an outstanding request -> update all */
++ tp->update_flags = TTY_UPDATE_ALL;
++ tty3270_set_timer(tp, 1);
+ }
+ return RAW3270_IO_DONE;
+ }
+diff --git a/drivers/scsi/mvsas/mv_sas.c b/drivers/scsi/mvsas/mv_sas.c
+index 0eb2da8a696f..89215d44d83f 100644
+--- a/drivers/scsi/mvsas/mv_sas.c
++++ b/drivers/scsi/mvsas/mv_sas.c
+@@ -988,6 +988,8 @@ static void mvs_slot_free(struct mvs_info *mvi, u32 rx_desc)
+ static void mvs_slot_task_free(struct mvs_info *mvi, struct sas_task *task,
+ struct mvs_slot_info *slot, u32 slot_idx)
+ {
++ if (!slot)
++ return;
+ if (!slot->task)
+ return;
+ if (!sas_protocol_ata(task->task_proto))
+diff --git a/drivers/staging/iio/adc/mxs-lradc.c b/drivers/staging/iio/adc/mxs-lradc.c
+index ffd42071a12e..6050c58db682 100644
+--- a/drivers/staging/iio/adc/mxs-lradc.c
++++ b/drivers/staging/iio/adc/mxs-lradc.c
+@@ -910,11 +910,12 @@ static int mxs_lradc_read_raw(struct iio_dev *iio_dev,
+ case IIO_CHAN_INFO_OFFSET:
+ if (chan->type == IIO_TEMP) {
+ /* The calculated value from the ADC is in Kelvin, we
+- * want Celsius for hwmon so the offset is
+- * -272.15 * scale
++ * want Celsius for hwmon so the offset is -273.15
++ * The offset is applied before scaling so it is
++ * actually -213.15 * 4 / 1.012 = -1079.644268
+ */
+- *val = -1075;
+- *val2 = 691699;
++ *val = -1079;
++ *val2 = 644268;
+
+ return IIO_VAL_INT_PLUS_MICRO;
+ }
+diff --git a/drivers/tty/serial/8250/8250_pci.c b/drivers/tty/serial/8250/8250_pci.c
+index 439bd1a5d00c..422773242917 100644
+--- a/drivers/tty/serial/8250/8250_pci.c
++++ b/drivers/tty/serial/8250/8250_pci.c
+@@ -1815,6 +1815,9 @@ pci_wch_ch353_setup(struct serial_private *priv,
+ #define PCI_DEVICE_ID_SUNIX_1999 0x1999
+
+
++#define PCI_DEVICE_ID_EXAR_XR17V4358 0x4358
++#define PCI_DEVICE_ID_EXAR_XR17V8358 0x8358
++
+ /* Unknown vendors/cards - this should not be in linux/pci_ids.h */
+ #define PCI_SUBDEVICE_ID_UNKNOWN_0x1584 0x1584
+ #define PCI_SUBDEVICE_ID_UNKNOWN_0x1588 0x1588
+@@ -2323,6 +2326,20 @@ static struct pci_serial_quirk pci_serial_quirks[] __refdata = {
+ .subdevice = PCI_ANY_ID,
+ .setup = pci_xr17v35x_setup,
+ },
++ {
++ .vendor = PCI_VENDOR_ID_EXAR,
++ .device = PCI_DEVICE_ID_EXAR_XR17V4358,
++ .subvendor = PCI_ANY_ID,
++ .subdevice = PCI_ANY_ID,
++ .setup = pci_xr17v35x_setup,
++ },
++ {
++ .vendor = PCI_VENDOR_ID_EXAR,
++ .device = PCI_DEVICE_ID_EXAR_XR17V8358,
++ .subvendor = PCI_ANY_ID,
++ .subdevice = PCI_ANY_ID,
++ .setup = pci_xr17v35x_setup,
++ },
+ /*
+ * Xircom cards
+ */
+@@ -2771,6 +2788,8 @@ enum pci_board_num_t {
+ pbn_exar_XR17V352,
+ pbn_exar_XR17V354,
+ pbn_exar_XR17V358,
++ pbn_exar_XR17V4358,
++ pbn_exar_XR17V8358,
+ pbn_exar_ibm_saturn,
+ pbn_pasemi_1682M,
+ pbn_ni8430_2,
+@@ -3440,6 +3459,22 @@ static struct pciserial_board pci_boards[] = {
+ .reg_shift = 0,
+ .first_offset = 0,
+ },
++ [pbn_exar_XR17V4358] = {
++ .flags = FL_BASE0,
++ .num_ports = 12,
++ .base_baud = 7812500,
++ .uart_offset = 0x400,
++ .reg_shift = 0,
++ .first_offset = 0,
++ },
++ [pbn_exar_XR17V8358] = {
++ .flags = FL_BASE0,
++ .num_ports = 16,
++ .base_baud = 7812500,
++ .uart_offset = 0x400,
++ .reg_shift = 0,
++ .first_offset = 0,
++ },
+ [pbn_exar_ibm_saturn] = {
+ .flags = FL_BASE0,
+ .num_ports = 1,
+@@ -4808,7 +4843,7 @@ static struct pci_device_id serial_pci_tbl[] = {
+ 0,
+ 0, pbn_exar_XR17C158 },
+ /*
+- * Exar Corp. XR17V35[248] Dual/Quad/Octal PCIe UARTs
++ * Exar Corp. XR17V[48]35[248] Dual/Quad/Octal/Hexa PCIe UARTs
+ */
+ { PCI_VENDOR_ID_EXAR, PCI_DEVICE_ID_EXAR_XR17V352,
+ PCI_ANY_ID, PCI_ANY_ID,
+@@ -4822,7 +4857,14 @@ static struct pci_device_id serial_pci_tbl[] = {
+ PCI_ANY_ID, PCI_ANY_ID,
+ 0,
+ 0, pbn_exar_XR17V358 },
+-
++ { PCI_VENDOR_ID_EXAR, PCI_DEVICE_ID_EXAR_XR17V4358,
++ PCI_ANY_ID, PCI_ANY_ID,
++ 0,
++ 0, pbn_exar_XR17V4358 },
++ { PCI_VENDOR_ID_EXAR, PCI_DEVICE_ID_EXAR_XR17V8358,
++ PCI_ANY_ID, PCI_ANY_ID,
++ 0,
++ 0, pbn_exar_XR17V8358 },
+ /*
+ * Topic TP560 Data/Fax/Voice 56k modem (reported by Evan Clarke)
+ */
+diff --git a/drivers/usb/chipidea/debug.c b/drivers/usb/chipidea/debug.c
+index 795d6538d630..4188cacaf100 100644
+--- a/drivers/usb/chipidea/debug.c
++++ b/drivers/usb/chipidea/debug.c
+@@ -66,9 +66,11 @@ static int ci_port_test_show(struct seq_file *s, void *data)
+ unsigned long flags;
+ unsigned mode;
+
++ pm_runtime_get_sync(ci->dev);
+ spin_lock_irqsave(&ci->lock, flags);
+ mode = hw_port_test_get(ci);
+ spin_unlock_irqrestore(&ci->lock, flags);
++ pm_runtime_put_sync(ci->dev);
+
+ seq_printf(s, "mode = %u\n", mode);
+
+@@ -94,9 +96,11 @@ static ssize_t ci_port_test_write(struct file *file, const char __user *ubuf,
+ if (sscanf(buf, "%u", &mode) != 1)
+ return -EINVAL;
+
++ pm_runtime_get_sync(ci->dev);
+ spin_lock_irqsave(&ci->lock, flags);
+ ret = hw_port_test_set(ci, mode);
+ spin_unlock_irqrestore(&ci->lock, flags);
++ pm_runtime_put_sync(ci->dev);
+
+ return ret ? ret : count;
+ }
+@@ -312,8 +316,10 @@ static ssize_t ci_role_write(struct file *file, const char __user *ubuf,
+ if (role == CI_ROLE_END || role == ci->role)
+ return -EINVAL;
+
++ pm_runtime_get_sync(ci->dev);
+ ci_role_stop(ci);
+ ret = ci_role_start(ci, role);
++ pm_runtime_put_sync(ci->dev);
+
+ return ret ? ret : count;
+ }
+diff --git a/drivers/usb/class/usbtmc.c b/drivers/usb/class/usbtmc.c
+index ec978408a2ee..49978cc495e9 100644
+--- a/drivers/usb/class/usbtmc.c
++++ b/drivers/usb/class/usbtmc.c
+@@ -109,6 +109,7 @@ struct usbtmc_ID_rigol_quirk {
+
+ static const struct usbtmc_ID_rigol_quirk usbtmc_id_quirk[] = {
+ { 0x1ab1, 0x0588 },
++ { 0x1ab1, 0x04b0 },
+ { 0, 0 }
+ };
+
+diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
+index 2af32e26fafc..7e5c90eebb9c 100644
+--- a/drivers/usb/host/xhci-pci.c
++++ b/drivers/usb/host/xhci-pci.c
+@@ -135,6 +135,7 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
+ if (pdev->vendor == PCI_VENDOR_ID_INTEL &&
+ pdev->device == PCI_DEVICE_ID_INTEL_LYNXPOINT_LP_XHCI) {
+ xhci->quirks |= XHCI_SPURIOUS_REBOOT;
++ xhci->quirks |= XHCI_SPURIOUS_WAKEUP;
+ }
+ if (pdev->vendor == PCI_VENDOR_ID_INTEL &&
+ (pdev->device == PCI_DEVICE_ID_INTEL_SUNRISEPOINT_LP_XHCI ||
+diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
+index 136259bc93b8..1e5fb8cfc9e3 100644
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -2238,6 +2238,7 @@ static int handle_tx_event(struct xhci_hcd *xhci,
+ u32 trb_comp_code;
+ int ret = 0;
+ int td_num = 0;
++ bool handling_skipped_tds = false;
+
+ slot_id = TRB_TO_SLOT_ID(le32_to_cpu(event->flags));
+ xdev = xhci->devs[slot_id];
+@@ -2371,6 +2372,10 @@ static int handle_tx_event(struct xhci_hcd *xhci,
+ ep->skip = true;
+ xhci_dbg(xhci, "Miss service interval error, set skip flag\n");
+ goto cleanup;
++ case COMP_PING_ERR:
++ ep->skip = true;
++ xhci_dbg(xhci, "No Ping response error, Skip one Isoc TD\n");
++ goto cleanup;
+ default:
+ if (xhci_is_vendor_info_code(xhci, trb_comp_code)) {
+ status = 0;
+@@ -2507,13 +2512,18 @@ static int handle_tx_event(struct xhci_hcd *xhci,
+ ep, &status);
+
+ cleanup:
++
++
++ handling_skipped_tds = ep->skip &&
++ trb_comp_code != COMP_MISSED_INT &&
++ trb_comp_code != COMP_PING_ERR;
++
+ /*
+- * Do not update event ring dequeue pointer if ep->skip is set.
+- * Will roll back to continue process missed tds.
++ * Do not update event ring dequeue pointer if we're in a loop
++ * processing missed tds.
+ */
+- if (trb_comp_code == COMP_MISSED_INT || !ep->skip) {
++ if (!handling_skipped_tds)
+ inc_deq(xhci, xhci->event_ring);
+- }
+
+ if (ret) {
+ urb = td->urb;
+@@ -2548,7 +2558,7 @@ cleanup:
+ * Process them as short transfer until reach the td pointed by
+ * the event.
+ */
+- } while (ep->skip && trb_comp_code != COMP_MISSED_INT);
++ } while (handling_skipped_tds);
+
+ return 0;
+ }
+diff --git a/drivers/usb/musb/musb_cppi41.c b/drivers/usb/musb/musb_cppi41.c
+index d59b232614d5..8dfd86771fac 100644
+--- a/drivers/usb/musb/musb_cppi41.c
++++ b/drivers/usb/musb/musb_cppi41.c
+@@ -541,10 +541,18 @@ static int cppi41_dma_channel_abort(struct dma_channel *channel)
+ csr &= ~MUSB_TXCSR_DMAENAB;
+ musb_writew(epio, MUSB_TXCSR, csr);
+ } else {
++ cppi41_set_autoreq_mode(cppi41_channel, EP_MODE_AUTOREQ_NONE);
++
++ /* delay to drain to cppi dma pipeline for isoch */
++ udelay(250);
++
+ csr = musb_readw(epio, MUSB_RXCSR);
+ csr &= ~(MUSB_RXCSR_H_REQPKT | MUSB_RXCSR_DMAENAB);
+ musb_writew(epio, MUSB_RXCSR, csr);
+
++ /* wait to drain cppi dma pipe line */
++ udelay(50);
++
+ csr = musb_readw(epio, MUSB_RXCSR);
+ if (csr & MUSB_RXCSR_RXPKTRDY) {
+ csr |= MUSB_RXCSR_FLUSHFIFO;
+@@ -558,13 +566,14 @@ static int cppi41_dma_channel_abort(struct dma_channel *channel)
+ tdbit <<= 16;
+
+ do {
+- musb_writel(musb->ctrl_base, USB_TDOWN, tdbit);
++ if (is_tx)
++ musb_writel(musb->ctrl_base, USB_TDOWN, tdbit);
+ ret = dmaengine_terminate_all(cppi41_channel->dc);
+ } while (ret == -EAGAIN);
+
+- musb_writel(musb->ctrl_base, USB_TDOWN, tdbit);
+-
+ if (is_tx) {
++ musb_writel(musb->ctrl_base, USB_TDOWN, tdbit);
++
+ csr = musb_readw(epio, MUSB_TXCSR);
+ if (csr & MUSB_TXCSR_TXPKTRDY) {
+ csr |= MUSB_TXCSR_FLUSHFIFO;
+diff --git a/drivers/usb/serial/symbolserial.c b/drivers/usb/serial/symbolserial.c
+index 6ed804450a5a..37f3ad15ed06 100644
+--- a/drivers/usb/serial/symbolserial.c
++++ b/drivers/usb/serial/symbolserial.c
+@@ -60,17 +60,15 @@ static void symbol_int_callback(struct urb *urb)
+
+ usb_serial_debug_data(&port->dev, __func__, urb->actual_length, data);
+
++ /*
++ * Data from the device comes with a 1 byte header:
++ *
++ * <size of data> <data>...
++ */
+ if (urb->actual_length > 1) {
+- data_length = urb->actual_length - 1;
+-
+- /*
+- * Data from the device comes with a 1 byte header:
+- *
+- * <size of data>data...
+- * This is real data to be sent to the tty layer
+- * we pretty much just ignore the size and send everything
+- * else to the tty layer.
+- */
++ data_length = data[0];
++ if (data_length > (urb->actual_length - 1))
++ data_length = urb->actual_length - 1;
+ tty_insert_flip_string(&port->port, &data[1], data_length);
+ tty_flip_buffer_push(&port->port);
+ } else {
+diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c
+index cb84f69f76ad..313f09a73624 100644
+--- a/drivers/vhost/scsi.c
++++ b/drivers/vhost/scsi.c
+@@ -1251,7 +1251,7 @@ tcm_vhost_send_evt(struct vhost_scsi *vs,
+ * lun[4-7] need to be zero according to virtio-scsi spec.
+ */
+ evt->event.lun[0] = 0x01;
+- evt->event.lun[1] = tpg->tport_tpgt & 0xFF;
++ evt->event.lun[1] = tpg->tport_tpgt;
+ if (lun->unpacked_lun >= 256)
+ evt->event.lun[2] = lun->unpacked_lun >> 8 | 0x40 ;
+ evt->event.lun[3] = lun->unpacked_lun & 0xFF;
+@@ -2122,12 +2122,12 @@ tcm_vhost_make_tpg(struct se_wwn *wwn,
+ struct tcm_vhost_tport, tport_wwn);
+
+ struct tcm_vhost_tpg *tpg;
+- unsigned long tpgt;
++ u16 tpgt;
+ int ret;
+
+ if (strstr(name, "tpgt_") != name)
+ return ERR_PTR(-EINVAL);
+- if (kstrtoul(name + 5, 10, &tpgt) || tpgt > UINT_MAX)
++ if (kstrtou16(name + 5, 10, &tpgt) || tpgt >= VHOST_SCSI_MAX_TARGET)
+ return ERR_PTR(-EINVAL);
+
+ tpg = kzalloc(sizeof(struct tcm_vhost_tpg), GFP_KERNEL);
+diff --git a/fs/btrfs/backref.c b/fs/btrfs/backref.c
+index 2d3e32ebfd15..cfd1e6f6ac64 100644
+--- a/fs/btrfs/backref.c
++++ b/fs/btrfs/backref.c
+@@ -1778,7 +1778,6 @@ static int iterate_inode_extrefs(u64 inum, struct btrfs_root *fs_root,
+ int found = 0;
+ struct extent_buffer *eb;
+ struct btrfs_inode_extref *extref;
+- struct extent_buffer *leaf;
+ u32 item_size;
+ u32 cur_offset;
+ unsigned long ptr;
+@@ -1806,9 +1805,8 @@ static int iterate_inode_extrefs(u64 inum, struct btrfs_root *fs_root,
+ btrfs_set_lock_blocking_rw(eb, BTRFS_READ_LOCK);
+ btrfs_release_path(path);
+
+- leaf = path->nodes[0];
+- item_size = btrfs_item_size_nr(leaf, slot);
+- ptr = btrfs_item_ptr_offset(leaf, slot);
++ item_size = btrfs_item_size_nr(eb, slot);
++ ptr = btrfs_item_ptr_offset(eb, slot);
+ cur_offset = 0;
+
+ while (cur_offset < item_size) {
+@@ -1822,7 +1820,7 @@ static int iterate_inode_extrefs(u64 inum, struct btrfs_root *fs_root,
+ if (ret)
+ break;
+
+- cur_offset += btrfs_inode_extref_name_len(leaf, extref);
++ cur_offset += btrfs_inode_extref_name_len(eb, extref);
+ cur_offset += sizeof(*extref);
+ }
+ btrfs_tree_read_unlock_blocking(eb);
+diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
+index 61d00a6e398f..4ae04561be88 100644
+--- a/fs/cifs/cifssmb.c
++++ b/fs/cifs/cifssmb.c
+@@ -625,9 +625,8 @@ CIFSSMBNegotiate(const unsigned int xid, struct cifs_ses *ses)
+ server->negflavor = CIFS_NEGFLAVOR_UNENCAP;
+ memcpy(ses->server->cryptkey, pSMBr->u.EncryptionKey,
+ CIFS_CRYPTO_KEY_SIZE);
+- } else if ((pSMBr->hdr.Flags2 & SMBFLG2_EXT_SEC ||
+- server->capabilities & CAP_EXTENDED_SECURITY) &&
+- (pSMBr->EncryptionKeyLength == 0)) {
++ } else if (pSMBr->hdr.Flags2 & SMBFLG2_EXT_SEC ||
++ server->capabilities & CAP_EXTENDED_SECURITY) {
+ server->negflavor = CIFS_NEGFLAVOR_EXTENDED;
+ rc = decode_ext_sec_blob(ses, pSMBr);
+ } else if (server->sec_mode & SECMODE_PW_ENCRYPT) {
+diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
+index b5fcb1ac0dd7..b95c32096a68 100644
+--- a/fs/ext4/extents.c
++++ b/fs/ext4/extents.c
+@@ -4792,12 +4792,6 @@ static long ext4_zero_range(struct file *file, loff_t offset,
+ else
+ max_blocks -= lblk;
+
+- flags = EXT4_GET_BLOCKS_CREATE_UNWRIT_EXT |
+- EXT4_GET_BLOCKS_CONVERT_UNWRITTEN |
+- EXT4_EX_NOCACHE;
+- if (mode & FALLOC_FL_KEEP_SIZE)
+- flags |= EXT4_GET_BLOCKS_KEEP_SIZE;
+-
+ mutex_lock(&inode->i_mutex);
+
+ /*
+@@ -4814,15 +4808,28 @@ static long ext4_zero_range(struct file *file, loff_t offset,
+ ret = inode_newsize_ok(inode, new_size);
+ if (ret)
+ goto out_mutex;
+- /*
+- * If we have a partial block after EOF we have to allocate
+- * the entire block.
+- */
+- if (partial_end)
+- max_blocks += 1;
+ }
+
++ flags = EXT4_GET_BLOCKS_CREATE_UNWRIT_EXT;
++ if (mode & FALLOC_FL_KEEP_SIZE)
++ flags |= EXT4_GET_BLOCKS_KEEP_SIZE;
++
++ /* Preallocate the range including the unaligned edges */
++ if (partial_begin || partial_end) {
++ ret = ext4_alloc_file_blocks(file,
++ round_down(offset, 1 << blkbits) >> blkbits,
++ (round_up((offset + len), 1 << blkbits) -
++ round_down(offset, 1 << blkbits)) >> blkbits,
++ new_size, flags, mode);
++ if (ret)
++ goto out_mutex;
++
++ }
++
++ /* Zero range excluding the unaligned edges */
+ if (max_blocks > 0) {
++ flags |= (EXT4_GET_BLOCKS_CONVERT_UNWRITTEN |
++ EXT4_EX_NOCACHE);
+
+ /* Now release the pages and zero block aligned part of pages*/
+ truncate_pagecache_range(inode, start, end - 1);
+@@ -4836,19 +4843,6 @@ static long ext4_zero_range(struct file *file, loff_t offset,
+ flags, mode);
+ if (ret)
+ goto out_dio;
+- /*
+- * Remove entire range from the extent status tree.
+- *
+- * ext4_es_remove_extent(inode, lblk, max_blocks) is
+- * NOT sufficient. I'm not sure why this is the case,
+- * but let's be conservative and remove the extent
+- * status tree for the entire inode. There should be
+- * no outstanding delalloc extents thanks to the
+- * filemap_write_and_wait_range() call above.
+- */
+- ret = ext4_es_remove_extent(inode, 0, EXT_MAX_BLOCKS);
+- if (ret)
+- goto out_dio;
+ }
+ if (!partial_begin && !partial_end)
+ goto out_dio;
+diff --git a/fs/jbd2/checkpoint.c b/fs/jbd2/checkpoint.c
+index 4227dc4f7437..8c44654ce274 100644
+--- a/fs/jbd2/checkpoint.c
++++ b/fs/jbd2/checkpoint.c
+@@ -417,12 +417,12 @@ int jbd2_cleanup_journal_tail(journal_t *journal)
+ * journal_clean_one_cp_list
+ *
+ * Find all the written-back checkpoint buffers in the given list and
+- * release them.
++ * release them. If 'destroy' is set, clean all buffers unconditionally.
+ *
+ * Called with j_list_lock held.
+ * Returns 1 if we freed the transaction, 0 otherwise.
+ */
+-static int journal_clean_one_cp_list(struct journal_head *jh)
++static int journal_clean_one_cp_list(struct journal_head *jh, bool destroy)
+ {
+ struct journal_head *last_jh;
+ struct journal_head *next_jh = jh;
+@@ -436,7 +436,10 @@ static int journal_clean_one_cp_list(struct journal_head *jh)
+ do {
+ jh = next_jh;
+ next_jh = jh->b_cpnext;
+- ret = __try_to_free_cp_buf(jh);
++ if (!destroy)
++ ret = __try_to_free_cp_buf(jh);
++ else
++ ret = __jbd2_journal_remove_checkpoint(jh) + 1;
+ if (!ret)
+ return freed;
+ if (ret == 2)
+@@ -459,10 +462,11 @@ static int journal_clean_one_cp_list(struct journal_head *jh)
+ * journal_clean_checkpoint_list
+ *
+ * Find all the written-back checkpoint buffers in the journal and release them.
++ * If 'destroy' is set, release all buffers unconditionally.
+ *
+ * Called with j_list_lock held.
+ */
+-void __jbd2_journal_clean_checkpoint_list(journal_t *journal)
++void __jbd2_journal_clean_checkpoint_list(journal_t *journal, bool destroy)
+ {
+ transaction_t *transaction, *last_transaction, *next_transaction;
+ int ret;
+@@ -476,7 +480,8 @@ void __jbd2_journal_clean_checkpoint_list(journal_t *journal)
+ do {
+ transaction = next_transaction;
+ next_transaction = transaction->t_cpnext;
+- ret = journal_clean_one_cp_list(transaction->t_checkpoint_list);
++ ret = journal_clean_one_cp_list(transaction->t_checkpoint_list,
++ destroy);
+ /*
+ * This function only frees up some memory if possible so we
+ * dont have an obligation to finish processing. Bail out if
+@@ -492,7 +497,7 @@ void __jbd2_journal_clean_checkpoint_list(journal_t *journal)
+ * we can possibly see not yet submitted buffers on io_list
+ */
+ ret = journal_clean_one_cp_list(transaction->
+- t_checkpoint_io_list);
++ t_checkpoint_io_list, destroy);
+ if (need_resched())
+ return;
+ /*
+@@ -506,6 +511,28 @@ void __jbd2_journal_clean_checkpoint_list(journal_t *journal)
+ }
+
+ /*
++ * Remove buffers from all checkpoint lists as journal is aborted and we just
++ * need to free memory
++ */
++void jbd2_journal_destroy_checkpoint(journal_t *journal)
++{
++ /*
++ * We loop because __jbd2_journal_clean_checkpoint_list() may abort
++ * early due to a need of rescheduling.
++ */
++ while (1) {
++ spin_lock(&journal->j_list_lock);
++ if (!journal->j_checkpoint_transactions) {
++ spin_unlock(&journal->j_list_lock);
++ break;
++ }
++ __jbd2_journal_clean_checkpoint_list(journal, true);
++ spin_unlock(&journal->j_list_lock);
++ cond_resched();
++ }
++}
++
++/*
+ * journal_remove_checkpoint: called after a buffer has been committed
+ * to disk (either by being write-back flushed to disk, or being
+ * committed to the log).
+diff --git a/fs/jbd2/commit.c b/fs/jbd2/commit.c
+index b73e0215baa7..362e5f614450 100644
+--- a/fs/jbd2/commit.c
++++ b/fs/jbd2/commit.c
+@@ -510,7 +510,7 @@ void jbd2_journal_commit_transaction(journal_t *journal)
+ * frees some memory
+ */
+ spin_lock(&journal->j_list_lock);
+- __jbd2_journal_clean_checkpoint_list(journal);
++ __jbd2_journal_clean_checkpoint_list(journal, false);
+ spin_unlock(&journal->j_list_lock);
+
+ jbd_debug(3, "JBD2: commit phase 1\n");
+diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c
+index be6f7178d23a..2540324f084b 100644
+--- a/fs/jbd2/journal.c
++++ b/fs/jbd2/journal.c
+@@ -1708,8 +1708,17 @@ int jbd2_journal_destroy(journal_t *journal)
+ while (journal->j_checkpoint_transactions != NULL) {
+ spin_unlock(&journal->j_list_lock);
+ mutex_lock(&journal->j_checkpoint_mutex);
+- jbd2_log_do_checkpoint(journal);
++ err = jbd2_log_do_checkpoint(journal);
+ mutex_unlock(&journal->j_checkpoint_mutex);
++ /*
++ * If checkpointing failed, just free the buffers to avoid
++ * looping forever
++ */
++ if (err) {
++ jbd2_journal_destroy_checkpoint(journal);
++ spin_lock(&journal->j_list_lock);
++ break;
++ }
+ spin_lock(&journal->j_list_lock);
+ }
+
+diff --git a/include/linux/ipv6.h b/include/linux/ipv6.h
+index ff560537dd61..2725b03b4ae2 100644
+--- a/include/linux/ipv6.h
++++ b/include/linux/ipv6.h
+@@ -212,7 +212,7 @@ struct ipv6_pinfo {
+ struct ipv6_ac_socklist *ipv6_ac_list;
+ struct ipv6_fl_socklist __rcu *ipv6_fl_list;
+
+- struct ipv6_txoptions *opt;
++ struct ipv6_txoptions __rcu *opt;
+ struct sk_buff *pktoptions;
+ struct sk_buff *rxpmtu;
+ struct {
+diff --git a/include/linux/jbd2.h b/include/linux/jbd2.h
+index dadb42109dec..4caf8acfef11 100644
+--- a/include/linux/jbd2.h
++++ b/include/linux/jbd2.h
+@@ -1042,8 +1042,9 @@ void jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block);
+ extern void jbd2_journal_commit_transaction(journal_t *);
+
+ /* Checkpoint list management */
+-void __jbd2_journal_clean_checkpoint_list(journal_t *journal);
++void __jbd2_journal_clean_checkpoint_list(journal_t *journal, bool destroy);
+ int __jbd2_journal_remove_checkpoint(struct journal_head *);
++void jbd2_journal_destroy_checkpoint(journal_t *journal);
+ void __jbd2_journal_insert_checkpoint(struct journal_head *, transaction_t *);
+
+
+diff --git a/include/linux/pci.h b/include/linux/pci.h
+index e92cdad3240d..7a3484490867 100644
+--- a/include/linux/pci.h
++++ b/include/linux/pci.h
+@@ -177,6 +177,10 @@ enum pci_dev_flags {
+ PCI_DEV_FLAG_PCIE_BRIDGE_ALIAS = (__force pci_dev_flags_t) (1 << 5),
+ /* Do not use bus resets for device */
+ PCI_DEV_FLAGS_NO_BUS_RESET = (__force pci_dev_flags_t) (1 << 6),
++ /* Do not use PM reset even if device advertises NoSoftRst- */
++ PCI_DEV_FLAGS_NO_PM_RESET = (__force pci_dev_flags_t) (1 << 7),
++ /* Get VPD from function 0 VPD */
++ PCI_DEV_FLAGS_VPD_REF_F0 = (__force pci_dev_flags_t) (1 << 8),
+ };
+
+ enum pci_irq_reroute_variant {
+diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
+index 522d83731709..3b57c6712495 100644
+--- a/include/linux/skbuff.h
++++ b/include/linux/skbuff.h
+@@ -2549,6 +2549,9 @@ static inline void skb_postpull_rcsum(struct sk_buff *skb,
+ {
+ if (skb->ip_summed == CHECKSUM_COMPLETE)
+ skb->csum = csum_sub(skb->csum, csum_partial(start, len, 0));
++ else if (skb->ip_summed == CHECKSUM_PARTIAL &&
++ skb_checksum_start_offset(skb) < 0)
++ skb->ip_summed = CHECKSUM_NONE;
+ }
+
+ unsigned char *skb_pull_rcsum(struct sk_buff *skb, unsigned int len);
+diff --git a/include/net/af_unix.h b/include/net/af_unix.h
+index a175ba4a7adb..dfe4ddfbb43c 100644
+--- a/include/net/af_unix.h
++++ b/include/net/af_unix.h
+@@ -64,7 +64,11 @@ struct unix_sock {
+ #define UNIX_GC_MAYBE_CYCLE 1
+ struct socket_wq peer_wq;
+ };
+-#define unix_sk(__sk) ((struct unix_sock *)__sk)
++
++static inline struct unix_sock *unix_sk(struct sock *sk)
++{
++ return (struct unix_sock *)sk;
++}
+
+ #define peer_wait peer_wq.wait
+
+diff --git a/include/net/inet_common.h b/include/net/inet_common.h
+index b2828a06a5a6..a7d812d05fba 100644
+--- a/include/net/inet_common.h
++++ b/include/net/inet_common.h
+@@ -42,7 +42,8 @@ int inet_recv_error(struct sock *sk, struct msghdr *msg, int len,
+
+ static inline void inet_ctl_sock_destroy(struct sock *sk)
+ {
+- sk_release_kernel(sk);
++ if (sk)
++ sk_release_kernel(sk);
+ }
+
+ #endif
+diff --git a/include/net/ip6_tunnel.h b/include/net/ip6_tunnel.h
+index a5593dab6af7..ef9557683fec 100644
+--- a/include/net/ip6_tunnel.h
++++ b/include/net/ip6_tunnel.h
+@@ -79,11 +79,12 @@ static inline void ip6tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
+ err = ip6_local_out(skb);
+
+ if (net_xmit_eval(err) == 0) {
+- struct pcpu_sw_netstats *tstats = this_cpu_ptr(dev->tstats);
++ struct pcpu_sw_netstats *tstats = get_cpu_ptr(dev->tstats);
+ u64_stats_update_begin(&tstats->syncp);
+ tstats->tx_bytes += pkt_len;
+ tstats->tx_packets++;
+ u64_stats_update_end(&tstats->syncp);
++ put_cpu_ptr(tstats);
+ } else {
+ stats->tx_errors++;
+ stats->tx_aborted_errors++;
+diff --git a/include/net/ip_tunnels.h b/include/net/ip_tunnels.h
+index 5bc6edeb7143..a3f2f8005126 100644
+--- a/include/net/ip_tunnels.h
++++ b/include/net/ip_tunnels.h
+@@ -186,12 +186,13 @@ static inline void iptunnel_xmit_stats(int err,
+ struct pcpu_sw_netstats __percpu *stats)
+ {
+ if (err > 0) {
+- struct pcpu_sw_netstats *tstats = this_cpu_ptr(stats);
++ struct pcpu_sw_netstats *tstats = get_cpu_ptr(stats);
+
+ u64_stats_update_begin(&tstats->syncp);
+ tstats->tx_bytes += err;
+ tstats->tx_packets++;
+ u64_stats_update_end(&tstats->syncp);
++ put_cpu_ptr(tstats);
+ } else if (err < 0) {
+ err_stats->tx_errors++;
+ err_stats->tx_aborted_errors++;
+diff --git a/include/net/ipv6.h b/include/net/ipv6.h
+index 4292929392b0..a5169a4e9ef7 100644
+--- a/include/net/ipv6.h
++++ b/include/net/ipv6.h
+@@ -207,6 +207,7 @@ extern rwlock_t ip6_ra_lock;
+ */
+
+ struct ipv6_txoptions {
++ atomic_t refcnt;
+ /* Length of this structure */
+ int tot_len;
+
+@@ -219,7 +220,7 @@ struct ipv6_txoptions {
+ struct ipv6_opt_hdr *dst0opt;
+ struct ipv6_rt_hdr *srcrt; /* Routing Header */
+ struct ipv6_opt_hdr *dst1opt;
+-
++ struct rcu_head rcu;
+ /* Option buffer, as read by IPV6_PKTOPTIONS, starts here. */
+ };
+
+@@ -252,6 +253,24 @@ struct ipv6_fl_socklist {
+ struct rcu_head rcu;
+ };
+
++static inline struct ipv6_txoptions *txopt_get(const struct ipv6_pinfo *np)
++{
++ struct ipv6_txoptions *opt;
++
++ rcu_read_lock();
++ opt = rcu_dereference(np->opt);
++ if (opt && !atomic_inc_not_zero(&opt->refcnt))
++ opt = NULL;
++ rcu_read_unlock();
++ return opt;
++}
++
++static inline void txopt_put(struct ipv6_txoptions *opt)
++{
++ if (opt && atomic_dec_and_test(&opt->refcnt))
++ kfree_rcu(opt, rcu);
++}
++
+ struct ip6_flowlabel *fl6_sock_lookup(struct sock *sk, __be32 label);
+ struct ipv6_txoptions *fl6_merge_options(struct ipv6_txoptions *opt_space,
+ struct ip6_flowlabel *fl,
+@@ -490,6 +509,7 @@ struct ip6_create_arg {
+ u32 user;
+ const struct in6_addr *src;
+ const struct in6_addr *dst;
++ int iif;
+ u8 ecn;
+ };
+
+diff --git a/include/net/sock.h b/include/net/sock.h
+index 4406dbe491f0..a098ce3cd242 100644
+--- a/include/net/sock.h
++++ b/include/net/sock.h
+@@ -819,6 +819,14 @@ static inline __must_check int sk_add_backlog(struct sock *sk, struct sk_buff *s
+ if (sk_rcvqueues_full(sk, limit))
+ return -ENOBUFS;
+
++ /*
++ * If the skb was allocated from pfmemalloc reserves, only
++ * allow SOCK_MEMALLOC sockets to use it as this socket is
++ * helping free memory
++ */
++ if (skb_pfmemalloc(skb) && !sock_flag(sk, SOCK_MEMALLOC))
++ return -ENOMEM;
++
+ __sk_add_backlog(sk, skb);
+ sk->sk_backlog.len += skb->truesize;
+ return 0;
+diff --git a/include/sound/wm8904.h b/include/sound/wm8904.h
+index 898be3a8db9a..6d8f8fba3341 100644
+--- a/include/sound/wm8904.h
++++ b/include/sound/wm8904.h
+@@ -119,7 +119,7 @@
+ #define WM8904_MIC_REGS 2
+ #define WM8904_GPIO_REGS 4
+ #define WM8904_DRC_REGS 4
+-#define WM8904_EQ_REGS 25
++#define WM8904_EQ_REGS 24
+
+ /**
+ * DRC configurations are specified with a label and a set of register
+diff --git a/kernel/auditsc.c b/kernel/auditsc.c
+index e420a0c41b5f..cc3416f0deda 100644
+--- a/kernel/auditsc.c
++++ b/kernel/auditsc.c
+@@ -72,6 +72,8 @@
+ #include <linux/fs_struct.h>
+ #include <linux/compat.h>
+ #include <linux/ctype.h>
++#include <linux/string.h>
++#include <uapi/linux/limits.h>
+
+ #include "audit.h"
+
+@@ -1861,8 +1863,7 @@ void __audit_inode(struct filename *name, const struct dentry *dentry,
+ }
+
+ list_for_each_entry_reverse(n, &context->names_list, list) {
+- /* does the name pointer match? */
+- if (!n->name || n->name->name != name->name)
++ if (!n->name || strcmp(n->name->name, name->name))
+ continue;
+
+ /* match the correct record type */
+@@ -1877,12 +1878,48 @@ void __audit_inode(struct filename *name, const struct dentry *dentry,
+ }
+
+ out_alloc:
+- /* unable to find the name from a previous getname(). Allocate a new
+- * anonymous entry.
+- */
+- n = audit_alloc_name(context, AUDIT_TYPE_NORMAL);
++ /* unable to find an entry with both a matching name and type */
++ n = audit_alloc_name(context, AUDIT_TYPE_UNKNOWN);
+ if (!n)
+ return;
++ /* unfortunately, while we may have a path name to record with the
++ * inode, we can't always rely on the string lasting until the end of
++ * the syscall so we need to create our own copy, it may fail due to
++ * memory allocation issues, but we do our best */
++ if (name) {
++ /* we can't use getname_kernel() due to size limits */
++ size_t len = strlen(name->name) + 1;
++ struct filename *new = __getname();
++
++ if (unlikely(!new))
++ goto out;
++
++ if (len <= (PATH_MAX - sizeof(*new))) {
++ new->name = (char *)(new) + sizeof(*new);
++ new->separate = false;
++ } else if (len <= PATH_MAX) {
++ /* this looks odd, but is due to final_putname() */
++ struct filename *new2;
++
++ new2 = kmalloc(sizeof(*new2), GFP_KERNEL);
++ if (unlikely(!new2)) {
++ __putname(new);
++ goto out;
++ }
++ new2->name = (char *)new;
++ new2->separate = true;
++ new = new2;
++ } else {
++ /* we should never get here, but let's be safe */
++ __putname(new);
++ goto out;
++ }
++ strlcpy((char *)new->name, name->name, len);
++ new->uptr = NULL;
++ new->aname = n;
++ n->name = new;
++ n->name_put = true;
++ }
+ out:
+ if (parent) {
+ n->name_len = n->name ? parent_len(n->name->name) : AUDIT_NAME_FULL;
+diff --git a/kernel/module.c b/kernel/module.c
+index c353707bbbd5..3da0c001d985 100644
+--- a/kernel/module.c
++++ b/kernel/module.c
+@@ -914,11 +914,15 @@ void symbol_put_addr(void *addr)
+ if (core_kernel_text(a))
+ return;
+
+- /* module_text_address is safe here: we're supposed to have reference
+- * to module from symbol_get, so it can't go away. */
++ /*
++ * Even though we hold a reference on the module; we still need to
++ * disable preemption in order to safely traverse the data structure.
++ */
++ preempt_disable();
+ modaddr = __module_text_address(a);
+ BUG_ON(!modaddr);
+ module_put(modaddr);
++ preempt_enable();
+ }
+ EXPORT_SYMBOL_GPL(symbol_put_addr);
+
+diff --git a/kernel/sched/core.c b/kernel/sched/core.c
+index a882dd91722d..d650e1e593b8 100644
+--- a/kernel/sched/core.c
++++ b/kernel/sched/core.c
+@@ -5284,6 +5284,14 @@ static int sched_cpu_active(struct notifier_block *nfb,
+ case CPU_STARTING:
+ set_cpu_rq_start_time();
+ return NOTIFY_OK;
++ case CPU_ONLINE:
++ /*
++ * At this point a starting CPU has marked itself as online via
++ * set_cpu_online(). But it might not yet have marked itself
++ * as active, which is essential from here on.
++ *
++ * Thus, fall-through and help the starting CPU along.
++ */
+ case CPU_DOWN_FAILED:
+ set_cpu_active((long)hcpu, true);
+ return NOTIFY_OK;
+diff --git a/kernel/workqueue.c b/kernel/workqueue.c
+index 2273f534b01a..bd3c41d4ec07 100644
+--- a/kernel/workqueue.c
++++ b/kernel/workqueue.c
+@@ -1442,13 +1442,13 @@ static void __queue_delayed_work(int cpu, struct workqueue_struct *wq,
+ timer_stats_timer_set_start_info(&dwork->timer);
+
+ dwork->wq = wq;
++ /* timer isn't guaranteed to run in this cpu, record earlier */
++ if (cpu == WORK_CPU_UNBOUND)
++ cpu = raw_smp_processor_id();
+ dwork->cpu = cpu;
+ timer->expires = jiffies + delay;
+
+- if (unlikely(cpu != WORK_CPU_UNBOUND))
+- add_timer_on(timer, cpu);
+- else
+- add_timer(timer);
++ add_timer_on(timer, cpu);
+ }
+
+ /**
+diff --git a/lib/radix-tree.c b/lib/radix-tree.c
+index 3291a8e37490..3d2aa27b845b 100644
+--- a/lib/radix-tree.c
++++ b/lib/radix-tree.c
+@@ -33,7 +33,7 @@
+ #include <linux/string.h>
+ #include <linux/bitops.h>
+ #include <linux/rcupdate.h>
+-#include <linux/hardirq.h> /* in_interrupt() */
++#include <linux/preempt_mask.h> /* in_interrupt() */
+
+
+ /*
+diff --git a/mm/filemap.c b/mm/filemap.c
+index 37beab98b416..7e6ab98d4d3c 100644
+--- a/mm/filemap.c
++++ b/mm/filemap.c
+@@ -2489,6 +2489,11 @@ again:
+ break;
+ }
+
++ if (fatal_signal_pending(current)) {
++ status = -EINTR;
++ break;
++ }
++
+ status = a_ops->write_begin(file, mapping, pos, bytes, flags,
+ &page, &fsdata);
+ if (unlikely(status < 0))
+@@ -2526,10 +2531,6 @@ again:
+ written += copied;
+
+ balance_dirty_pages_ratelimited(mapping);
+- if (fatal_signal_pending(current)) {
+- status = -EINTR;
+- break;
+- }
+ } while (iov_iter_count(i));
+
+ return written ? written : status;
+diff --git a/net/core/datagram.c b/net/core/datagram.c
+index 61e99f315ed9..3a402a7b20e9 100644
+--- a/net/core/datagram.c
++++ b/net/core/datagram.c
+@@ -130,35 +130,6 @@ out_noerr:
+ goto out;
+ }
+
+-static int skb_set_peeked(struct sk_buff *skb)
+-{
+- struct sk_buff *nskb;
+-
+- if (skb->peeked)
+- return 0;
+-
+- /* We have to unshare an skb before modifying it. */
+- if (!skb_shared(skb))
+- goto done;
+-
+- nskb = skb_clone(skb, GFP_ATOMIC);
+- if (!nskb)
+- return -ENOMEM;
+-
+- skb->prev->next = nskb;
+- skb->next->prev = nskb;
+- nskb->prev = skb->prev;
+- nskb->next = skb->next;
+-
+- consume_skb(skb);
+- skb = nskb;
+-
+-done:
+- skb->peeked = 1;
+-
+- return 0;
+-}
+-
+ /**
+ * __skb_recv_datagram - Receive a datagram skbuff
+ * @sk: socket
+@@ -193,9 +164,7 @@ done:
+ struct sk_buff *__skb_recv_datagram(struct sock *sk, unsigned int flags,
+ int *peeked, int *off, int *err)
+ {
+- struct sk_buff_head *queue = &sk->sk_receive_queue;
+ struct sk_buff *skb, *last;
+- unsigned long cpu_flags;
+ long timeo;
+ /*
+ * Caller is allowed not to check sk->sk_err before skb_recv_datagram()
+@@ -214,6 +183,8 @@ struct sk_buff *__skb_recv_datagram(struct sock *sk, unsigned int flags,
+ * Look at current nfs client by the way...
+ * However, this function was correct in any case. 8)
+ */
++ unsigned long cpu_flags;
++ struct sk_buff_head *queue = &sk->sk_receive_queue;
+ int _off = *off;
+
+ last = (struct sk_buff *)queue;
+@@ -227,11 +198,7 @@ struct sk_buff *__skb_recv_datagram(struct sock *sk, unsigned int flags,
+ _off -= skb->len;
+ continue;
+ }
+-
+- error = skb_set_peeked(skb);
+- if (error)
+- goto unlock_err;
+-
++ skb->peeked = 1;
+ atomic_inc(&skb->users);
+ } else
+ __skb_unlink(skb, queue);
+@@ -255,8 +222,6 @@ struct sk_buff *__skb_recv_datagram(struct sock *sk, unsigned int flags,
+
+ return NULL;
+
+-unlock_err:
+- spin_unlock_irqrestore(&queue->lock, cpu_flags);
+ no_packet:
+ *err = error;
+ return NULL;
+diff --git a/net/core/dst.c b/net/core/dst.c
+index a028409ee438..a80e92346b9b 100644
+--- a/net/core/dst.c
++++ b/net/core/dst.c
+@@ -285,7 +285,7 @@ void dst_release(struct dst_entry *dst)
+
+ newrefcnt = atomic_dec_return(&dst->__refcnt);
+ WARN_ON(newrefcnt < 0);
+- if (unlikely(dst->flags & DST_NOCACHE) && !newrefcnt)
++ if (!newrefcnt && unlikely(dst->flags & DST_NOCACHE))
+ call_rcu(&dst->rcu_head, dst_destroy_rcu);
+ }
+ }
+diff --git a/net/core/ethtool.c b/net/core/ethtool.c
+index 06dfb293e5aa..14bb1583947e 100644
+--- a/net/core/ethtool.c
++++ b/net/core/ethtool.c
+@@ -1257,7 +1257,7 @@ static int ethtool_get_strings(struct net_device *dev, void __user *useraddr)
+
+ gstrings.len = ret;
+
+- data = kmalloc(gstrings.len * ETH_GSTRING_LEN, GFP_USER);
++ data = kcalloc(gstrings.len, ETH_GSTRING_LEN, GFP_USER);
+ if (!data)
+ return -ENOMEM;
+
+diff --git a/net/core/neighbour.c b/net/core/neighbour.c
+index 2b0d99dad8be..0478423afd29 100644
+--- a/net/core/neighbour.c
++++ b/net/core/neighbour.c
+@@ -2263,7 +2263,7 @@ static int pneigh_fill_info(struct sk_buff *skb, struct pneigh_entry *pn,
+ ndm->ndm_pad2 = 0;
+ ndm->ndm_flags = pn->flags | NTF_PROXY;
+ ndm->ndm_type = RTN_UNICAST;
+- ndm->ndm_ifindex = pn->dev->ifindex;
++ ndm->ndm_ifindex = pn->dev ? pn->dev->ifindex : 0;
+ ndm->ndm_state = NUD_NONE;
+
+ if (nla_put(skb, NDA_DST, tbl->key_len, pn->key))
+@@ -2337,7 +2337,7 @@ static int pneigh_dump_table(struct neigh_table *tbl, struct sk_buff *skb,
+ if (h > s_h)
+ s_idx = 0;
+ for (n = tbl->phash_buckets[h], idx = 0; n; n = n->next) {
+- if (dev_net(n->dev) != net)
++ if (pneigh_net(n) != net)
+ continue;
+ if (idx < s_idx)
+ goto next;
+diff --git a/net/core/scm.c b/net/core/scm.c
+index b442e7e25e60..d30eb057fa7b 100644
+--- a/net/core/scm.c
++++ b/net/core/scm.c
+@@ -306,6 +306,8 @@ void scm_detach_fds(struct msghdr *msg, struct scm_cookie *scm)
+ err = put_user(cmlen, &cm->cmsg_len);
+ if (!err) {
+ cmlen = CMSG_SPACE(i*sizeof(int));
++ if (msg->msg_controllen < cmlen)
++ cmlen = msg->msg_controllen;
+ msg->msg_control += cmlen;
+ msg->msg_controllen -= cmlen;
+ }
+diff --git a/net/core/skbuff.c b/net/core/skbuff.c
+index 72400a1bb439..ea0bcc4a9657 100644
+--- a/net/core/skbuff.c
++++ b/net/core/skbuff.c
+@@ -2881,11 +2881,12 @@ EXPORT_SYMBOL(skb_append_datato_frags);
+ */
+ unsigned char *skb_pull_rcsum(struct sk_buff *skb, unsigned int len)
+ {
++ unsigned char *data = skb->data;
++
+ BUG_ON(len > skb->len);
+- skb->len -= len;
+- BUG_ON(skb->len < skb->data_len);
+- skb_postpull_rcsum(skb, skb->data, len);
+- return skb->data += len;
++ __skb_pull(skb, len);
++ skb_postpull_rcsum(skb, data, len);
++ return skb->data;
+ }
+ EXPORT_SYMBOL_GPL(skb_pull_rcsum);
+
+diff --git a/net/dccp/ipv6.c b/net/dccp/ipv6.c
+index 6bcaa33cd804..7bcb22317841 100644
+--- a/net/dccp/ipv6.c
++++ b/net/dccp/ipv6.c
+@@ -238,7 +238,9 @@ static int dccp_v6_send_response(struct sock *sk, struct request_sock *req)
+ security_req_classify_flow(req, flowi6_to_flowi(&fl6));
+
+
+- final_p = fl6_update_dst(&fl6, np->opt, &final);
++ rcu_read_lock();
++ final_p = fl6_update_dst(&fl6, rcu_dereference(np->opt), &final);
++ rcu_read_unlock();
+
+ dst = ip6_dst_lookup_flow(sk, &fl6, final_p);
+ if (IS_ERR(dst)) {
+@@ -255,7 +257,10 @@ static int dccp_v6_send_response(struct sock *sk, struct request_sock *req)
+ &ireq->ir_v6_loc_addr,
+ &ireq->ir_v6_rmt_addr);
+ fl6.daddr = ireq->ir_v6_rmt_addr;
+- err = ip6_xmit(sk, skb, &fl6, np->opt, np->tclass);
++ rcu_read_lock();
++ err = ip6_xmit(sk, skb, &fl6, rcu_dereference(np->opt),
++ np->tclass);
++ rcu_read_unlock();
+ err = net_xmit_eval(err);
+ }
+
+@@ -450,6 +455,7 @@ static struct sock *dccp_v6_request_recv_sock(struct sock *sk,
+ {
+ struct inet_request_sock *ireq = inet_rsk(req);
+ struct ipv6_pinfo *newnp, *np = inet6_sk(sk);
++ struct ipv6_txoptions *opt;
+ struct inet_sock *newinet;
+ struct dccp6_sock *newdp6;
+ struct sock *newsk;
+@@ -573,13 +579,15 @@ static struct sock *dccp_v6_request_recv_sock(struct sock *sk,
+ * Yes, keeping reference count would be much more clever, but we make
+ * one more one thing there: reattach optmem to newsk.
+ */
+- if (np->opt != NULL)
+- newnp->opt = ipv6_dup_options(newsk, np->opt);
+-
++ opt = rcu_dereference(np->opt);
++ if (opt) {
++ opt = ipv6_dup_options(newsk, opt);
++ RCU_INIT_POINTER(newnp->opt, opt);
++ }
+ inet_csk(newsk)->icsk_ext_hdr_len = 0;
+- if (newnp->opt != NULL)
+- inet_csk(newsk)->icsk_ext_hdr_len = (newnp->opt->opt_nflen +
+- newnp->opt->opt_flen);
++ if (opt)
++ inet_csk(newsk)->icsk_ext_hdr_len = opt->opt_nflen +
++ opt->opt_flen;
+
+ dccp_sync_mss(newsk, dst_mtu(dst));
+
+@@ -832,6 +840,7 @@ static int dccp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
+ struct ipv6_pinfo *np = inet6_sk(sk);
+ struct dccp_sock *dp = dccp_sk(sk);
+ struct in6_addr *saddr = NULL, *final_p, final;
++ struct ipv6_txoptions *opt;
+ struct flowi6 fl6;
+ struct dst_entry *dst;
+ int addr_type;
+@@ -933,7 +942,8 @@ static int dccp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
+ fl6.fl6_sport = inet->inet_sport;
+ security_sk_classify_flow(sk, flowi6_to_flowi(&fl6));
+
+- final_p = fl6_update_dst(&fl6, np->opt, &final);
++ opt = rcu_dereference_protected(np->opt, sock_owned_by_user(sk));
++ final_p = fl6_update_dst(&fl6, opt, &final);
+
+ dst = ip6_dst_lookup_flow(sk, &fl6, final_p);
+ if (IS_ERR(dst)) {
+@@ -953,9 +963,8 @@ static int dccp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
+ __ip6_dst_store(sk, dst, NULL, NULL);
+
+ icsk->icsk_ext_hdr_len = 0;
+- if (np->opt != NULL)
+- icsk->icsk_ext_hdr_len = (np->opt->opt_flen +
+- np->opt->opt_nflen);
++ if (opt)
++ icsk->icsk_ext_hdr_len = opt->opt_flen + opt->opt_nflen;
+
+ inet->inet_dport = usin->sin6_port;
+
+diff --git a/net/ipv4/gre_offload.c b/net/ipv4/gre_offload.c
+index 51973ddc05a6..abc50b41bc39 100644
+--- a/net/ipv4/gre_offload.c
++++ b/net/ipv4/gre_offload.c
+@@ -36,7 +36,8 @@ static struct sk_buff *gre_gso_segment(struct sk_buff *skb,
+ SKB_GSO_TCP_ECN |
+ SKB_GSO_GRE |
+ SKB_GSO_GRE_CSUM |
+- SKB_GSO_IPIP)))
++ SKB_GSO_IPIP |
++ SKB_GSO_SIT)))
+ goto out;
+
+ if (!skb->encapsulation)
+diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
+index c8034587859d..1b7f6da99ef4 100644
+--- a/net/ipv4/ipmr.c
++++ b/net/ipv4/ipmr.c
+@@ -136,7 +136,7 @@ static int __ipmr_fill_mroute(struct mr_table *mrt, struct sk_buff *skb,
+ struct mfc_cache *c, struct rtmsg *rtm);
+ static void mroute_netlink_event(struct mr_table *mrt, struct mfc_cache *mfc,
+ int cmd);
+-static void mroute_clean_tables(struct mr_table *mrt);
++static void mroute_clean_tables(struct mr_table *mrt, bool all);
+ static void ipmr_expire_process(unsigned long arg);
+
+ #ifdef CONFIG_IP_MROUTE_MULTIPLE_TABLES
+@@ -348,7 +348,7 @@ static struct mr_table *ipmr_new_table(struct net *net, u32 id)
+ static void ipmr_free_table(struct mr_table *mrt)
+ {
+ del_timer_sync(&mrt->ipmr_expire_timer);
+- mroute_clean_tables(mrt);
++ mroute_clean_tables(mrt, true);
+ kfree(mrt);
+ }
+
+@@ -1201,7 +1201,7 @@ static int ipmr_mfc_add(struct net *net, struct mr_table *mrt,
+ * Close the multicast socket, and clear the vif tables etc
+ */
+
+-static void mroute_clean_tables(struct mr_table *mrt)
++static void mroute_clean_tables(struct mr_table *mrt, bool all)
+ {
+ int i;
+ LIST_HEAD(list);
+@@ -1210,8 +1210,9 @@ static void mroute_clean_tables(struct mr_table *mrt)
+ /* Shut down all active vif entries */
+
+ for (i = 0; i < mrt->maxvif; i++) {
+- if (!(mrt->vif_table[i].flags & VIFF_STATIC))
+- vif_delete(mrt, i, 0, &list);
++ if (!all && (mrt->vif_table[i].flags & VIFF_STATIC))
++ continue;
++ vif_delete(mrt, i, 0, &list);
+ }
+ unregister_netdevice_many(&list);
+
+@@ -1219,7 +1220,7 @@ static void mroute_clean_tables(struct mr_table *mrt)
+
+ for (i = 0; i < MFC_LINES; i++) {
+ list_for_each_entry_safe(c, next, &mrt->mfc_cache_array[i], list) {
+- if (c->mfc_flags & MFC_STATIC)
++ if (!all && (c->mfc_flags & MFC_STATIC))
+ continue;
+ list_del_rcu(&c->list);
+ mroute_netlink_event(mrt, c, RTM_DELROUTE);
+@@ -1254,7 +1255,7 @@ static void mrtsock_destruct(struct sock *sk)
+ NETCONFA_IFINDEX_ALL,
+ net->ipv4.devconf_all);
+ RCU_INIT_POINTER(mrt->mroute_sk, NULL);
+- mroute_clean_tables(mrt);
++ mroute_clean_tables(mrt, false);
+ }
+ }
+ rtnl_unlock();
+@@ -1674,8 +1675,8 @@ static inline int ipmr_forward_finish(struct sk_buff *skb)
+ {
+ struct ip_options *opt = &(IPCB(skb)->opt);
+
+- IP_INC_STATS_BH(dev_net(skb_dst(skb)->dev), IPSTATS_MIB_OUTFORWDATAGRAMS);
+- IP_ADD_STATS_BH(dev_net(skb_dst(skb)->dev), IPSTATS_MIB_OUTOCTETS, skb->len);
++ IP_INC_STATS(dev_net(skb_dst(skb)->dev), IPSTATS_MIB_OUTFORWDATAGRAMS);
++ IP_ADD_STATS(dev_net(skb_dst(skb)->dev), IPSTATS_MIB_OUTOCTETS, skb->len);
+
+ if (unlikely(opt->optlen))
+ ip_forward_options(skb);
+@@ -1737,7 +1738,7 @@ static void ipmr_queue_xmit(struct net *net, struct mr_table *mrt,
+ * to blackhole.
+ */
+
+- IP_INC_STATS_BH(dev_net(dev), IPSTATS_MIB_FRAGFAILS);
++ IP_INC_STATS(dev_net(dev), IPSTATS_MIB_FRAGFAILS);
+ ip_rt_put(rt);
+ goto out_free;
+ }
+diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c
+index b3c53c8b331e..633cd34f57ec 100644
+--- a/net/ipv4/sysctl_net_ipv4.c
++++ b/net/ipv4/sysctl_net_ipv4.c
+@@ -45,10 +45,10 @@ static int ip_ping_group_range_max[] = { GID_T_MAX, GID_T_MAX };
+ /* Update system visible IP port range */
+ static void set_local_port_range(struct net *net, int range[2])
+ {
+- write_seqlock(&net->ipv4.ip_local_ports.lock);
++ write_seqlock_bh(&net->ipv4.ip_local_ports.lock);
+ net->ipv4.ip_local_ports.range[0] = range[0];
+ net->ipv4.ip_local_ports.range[1] = range[1];
+- write_sequnlock(&net->ipv4.ip_local_ports.lock);
++ write_sequnlock_bh(&net->ipv4.ip_local_ports.lock);
+ }
+
+ /* Validate changes from /proc interface. */
+diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
+index 6f46cde58e54..0c96055b2382 100644
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -4356,19 +4356,34 @@ static int __must_check tcp_queue_rcv(struct sock *sk, struct sk_buff *skb, int
+ int tcp_send_rcvq(struct sock *sk, struct msghdr *msg, size_t size)
+ {
+ struct sk_buff *skb;
++ int err = -ENOMEM;
++ int data_len = 0;
+ bool fragstolen;
+
+ if (size == 0)
+ return 0;
+
+- skb = alloc_skb(size, sk->sk_allocation);
++ if (size > PAGE_SIZE) {
++ int npages = min_t(size_t, size >> PAGE_SHIFT, MAX_SKB_FRAGS);
++
++ data_len = npages << PAGE_SHIFT;
++ size = data_len + (size & ~PAGE_MASK);
++ }
++ skb = alloc_skb_with_frags(size - data_len, data_len,
++ PAGE_ALLOC_COSTLY_ORDER,
++ &err, sk->sk_allocation);
+ if (!skb)
+ goto err;
+
++ skb_put(skb, size - data_len);
++ skb->data_len = data_len;
++ skb->len = size;
++
+ if (tcp_try_rmem_schedule(sk, skb, skb->truesize))
+ goto err_free;
+
+- if (memcpy_fromiovec(skb_put(skb, size), msg->msg_iov, size))
++ err = skb_copy_datagram_iovec(skb, 0, msg->msg_iov, size);
++ if (err)
+ goto err_free;
+
+ TCP_SKB_CB(skb)->seq = tcp_sk(sk)->rcv_nxt;
+@@ -4384,7 +4399,8 @@ int tcp_send_rcvq(struct sock *sk, struct msghdr *msg, size_t size)
+ err_free:
+ kfree_skb(skb);
+ err:
+- return -ENOMEM;
++ return err;
++
+ }
+
+ static void tcp_data_queue(struct sock *sk, struct sk_buff *skb)
+@@ -5524,6 +5540,7 @@ discard:
+ }
+
+ tp->rcv_nxt = TCP_SKB_CB(skb)->seq + 1;
++ tp->copied_seq = tp->rcv_nxt;
+ tp->rcv_wup = TCP_SKB_CB(skb)->seq + 1;
+
+ /* RFC1323: The window in SYN & SYN/ACK segments is
+diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
+index a5fdfe9fa542..6cd9f696d9c6 100644
+--- a/net/ipv4/tcp_ipv4.c
++++ b/net/ipv4/tcp_ipv4.c
+@@ -959,7 +959,8 @@ int tcp_md5_do_add(struct sock *sk, const union tcp_md5_addr *addr,
+ }
+
+ md5sig = rcu_dereference_protected(tp->md5sig_info,
+- sock_owned_by_user(sk));
++ sock_owned_by_user(sk) ||
++ lockdep_is_held(&sk->sk_lock.slock));
+ if (!md5sig) {
+ md5sig = kmalloc(sizeof(*md5sig), gfp);
+ if (!md5sig)
+diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
+index 17a025847999..e34efa766031 100644
+--- a/net/ipv6/addrconf.c
++++ b/net/ipv6/addrconf.c
+@@ -396,6 +396,7 @@ static struct inet6_dev *ipv6_add_dev(struct net_device *dev)
+ if (err) {
+ ipv6_mc_destroy_dev(ndev);
+ del_timer(&ndev->regen_timer);
++ snmp6_unregister_dev(ndev);
+ goto err_release;
+ }
+ /* protected by rtnl_lock */
+@@ -4843,6 +4844,21 @@ int addrconf_sysctl_forward(struct ctl_table *ctl, int write,
+ return ret;
+ }
+
++static
++int addrconf_sysctl_mtu(struct ctl_table *ctl, int write,
++ void __user *buffer, size_t *lenp, loff_t *ppos)
++{
++ struct inet6_dev *idev = ctl->extra1;
++ int min_mtu = IPV6_MIN_MTU;
++ struct ctl_table lctl;
++
++ lctl = *ctl;
++ lctl.extra1 = &min_mtu;
++ lctl.extra2 = idev ? &idev->dev->mtu : NULL;
++
++ return proc_dointvec_minmax(&lctl, write, buffer, lenp, ppos);
++}
++
+ static void dev_disable_change(struct inet6_dev *idev)
+ {
+ struct netdev_notifier_info info;
+@@ -4994,7 +5010,7 @@ static struct addrconf_sysctl_table
+ .data = &ipv6_devconf.mtu6,
+ .maxlen = sizeof(int),
+ .mode = 0644,
+- .proc_handler = proc_dointvec,
++ .proc_handler = addrconf_sysctl_mtu,
+ },
+ {
+ .procname = "accept_ra",
+diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
+index e8c4400f23e9..05417c330f4e 100644
+--- a/net/ipv6/af_inet6.c
++++ b/net/ipv6/af_inet6.c
+@@ -425,9 +425,11 @@ void inet6_destroy_sock(struct sock *sk)
+
+ /* Free tx options */
+
+- opt = xchg(&np->opt, NULL);
+- if (opt != NULL)
+- sock_kfree_s(sk, opt, opt->tot_len);
++ opt = xchg((__force struct ipv6_txoptions **)&np->opt, NULL);
++ if (opt) {
++ atomic_sub(opt->tot_len, &sk->sk_omem_alloc);
++ txopt_put(opt);
++ }
+ }
+ EXPORT_SYMBOL_GPL(inet6_destroy_sock);
+
+@@ -656,7 +658,10 @@ int inet6_sk_rebuild_header(struct sock *sk)
+ fl6.fl6_sport = inet->inet_sport;
+ security_sk_classify_flow(sk, flowi6_to_flowi(&fl6));
+
+- final_p = fl6_update_dst(&fl6, np->opt, &final);
++ rcu_read_lock();
++ final_p = fl6_update_dst(&fl6, rcu_dereference(np->opt),
++ &final);
++ rcu_read_unlock();
+
+ dst = ip6_dst_lookup_flow(sk, &fl6, final_p);
+ if (IS_ERR(dst)) {
+diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c
+index e069aeb2cf72..9e3b0b66a4f3 100644
+--- a/net/ipv6/datagram.c
++++ b/net/ipv6/datagram.c
+@@ -167,8 +167,10 @@ ipv4_connected:
+
+ security_sk_classify_flow(sk, flowi6_to_flowi(&fl6));
+
+- opt = flowlabel ? flowlabel->opt : np->opt;
++ rcu_read_lock();
++ opt = flowlabel ? flowlabel->opt : rcu_dereference(np->opt);
+ final_p = fl6_update_dst(&fl6, opt, &final);
++ rcu_read_unlock();
+
+ dst = ip6_dst_lookup_flow(sk, &fl6, final_p);
+ err = 0;
+diff --git a/net/ipv6/exthdrs.c b/net/ipv6/exthdrs.c
+index bfde361b6134..4f08a0f452eb 100644
+--- a/net/ipv6/exthdrs.c
++++ b/net/ipv6/exthdrs.c
+@@ -727,6 +727,7 @@ ipv6_dup_options(struct sock *sk, struct ipv6_txoptions *opt)
+ *((char **)&opt2->dst1opt) += dif;
+ if (opt2->srcrt)
+ *((char **)&opt2->srcrt) += dif;
++ atomic_set(&opt2->refcnt, 1);
+ }
+ return opt2;
+ }
+@@ -790,7 +791,7 @@ ipv6_renew_options(struct sock *sk, struct ipv6_txoptions *opt,
+ return ERR_PTR(-ENOBUFS);
+
+ memset(opt2, 0, tot_len);
+-
++ atomic_set(&opt2->refcnt, 1);
+ opt2->tot_len = tot_len;
+ p = (char *)(opt2 + 1);
+
+diff --git a/net/ipv6/inet6_connection_sock.c b/net/ipv6/inet6_connection_sock.c
+index 29b32206e494..6cc516c825b6 100644
+--- a/net/ipv6/inet6_connection_sock.c
++++ b/net/ipv6/inet6_connection_sock.c
+@@ -77,7 +77,9 @@ struct dst_entry *inet6_csk_route_req(struct sock *sk,
+ memset(fl6, 0, sizeof(*fl6));
+ fl6->flowi6_proto = IPPROTO_TCP;
+ fl6->daddr = ireq->ir_v6_rmt_addr;
+- final_p = fl6_update_dst(fl6, np->opt, &final);
++ rcu_read_lock();
++ final_p = fl6_update_dst(fl6, rcu_dereference(np->opt), &final);
++ rcu_read_unlock();
+ fl6->saddr = ireq->ir_v6_loc_addr;
+ fl6->flowi6_oif = ireq->ir_iif;
+ fl6->flowi6_mark = ireq->ir_mark;
+@@ -208,7 +210,9 @@ static struct dst_entry *inet6_csk_route_socket(struct sock *sk,
+ fl6->fl6_dport = inet->inet_dport;
+ security_sk_classify_flow(sk, flowi6_to_flowi(fl6));
+
+- final_p = fl6_update_dst(fl6, np->opt, &final);
++ rcu_read_lock();
++ final_p = fl6_update_dst(fl6, rcu_dereference(np->opt), &final);
++ rcu_read_unlock();
+
+ dst = __inet6_csk_dst_check(sk, np->dst_cookie);
+ if (!dst) {
+@@ -241,7 +245,8 @@ int inet6_csk_xmit(struct sock *sk, struct sk_buff *skb, struct flowi *fl_unused
+ /* Restore final destination back after routing done */
+ fl6.daddr = sk->sk_v6_daddr;
+
+- res = ip6_xmit(sk, skb, &fl6, np->opt, np->tclass);
++ res = ip6_xmit(sk, skb, &fl6, rcu_dereference(np->opt),
++ np->tclass);
+ rcu_read_unlock();
+ return res;
+ }
+diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
+index 0d58542f9db0..4ca7cdd15aad 100644
+--- a/net/ipv6/ip6mr.c
++++ b/net/ipv6/ip6mr.c
+@@ -120,7 +120,7 @@ static void mr6_netlink_event(struct mr6_table *mrt, struct mfc6_cache *mfc,
+ int cmd);
+ static int ip6mr_rtm_dumproute(struct sk_buff *skb,
+ struct netlink_callback *cb);
+-static void mroute_clean_tables(struct mr6_table *mrt);
++static void mroute_clean_tables(struct mr6_table *mrt, bool all);
+ static void ipmr_expire_process(unsigned long arg);
+
+ #ifdef CONFIG_IPV6_MROUTE_MULTIPLE_TABLES
+@@ -337,7 +337,7 @@ static struct mr6_table *ip6mr_new_table(struct net *net, u32 id)
+ static void ip6mr_free_table(struct mr6_table *mrt)
+ {
+ del_timer(&mrt->ipmr_expire_timer);
+- mroute_clean_tables(mrt);
++ mroute_clean_tables(mrt, true);
+ kfree(mrt);
+ }
+
+@@ -1540,7 +1540,7 @@ static int ip6mr_mfc_add(struct net *net, struct mr6_table *mrt,
+ * Close the multicast socket, and clear the vif tables etc
+ */
+
+-static void mroute_clean_tables(struct mr6_table *mrt)
++static void mroute_clean_tables(struct mr6_table *mrt, bool all)
+ {
+ int i;
+ LIST_HEAD(list);
+@@ -1550,8 +1550,9 @@ static void mroute_clean_tables(struct mr6_table *mrt)
+ * Shut down all active vif entries
+ */
+ for (i = 0; i < mrt->maxvif; i++) {
+- if (!(mrt->vif6_table[i].flags & VIFF_STATIC))
+- mif6_delete(mrt, i, &list);
++ if (!all && (mrt->vif6_table[i].flags & VIFF_STATIC))
++ continue;
++ mif6_delete(mrt, i, &list);
+ }
+ unregister_netdevice_many(&list);
+
+@@ -1560,7 +1561,7 @@ static void mroute_clean_tables(struct mr6_table *mrt)
+ */
+ for (i = 0; i < MFC6_LINES; i++) {
+ list_for_each_entry_safe(c, next, &mrt->mfc6_cache_array[i], list) {
+- if (c->mfc_flags & MFC_STATIC)
++ if (!all && (c->mfc_flags & MFC_STATIC))
+ continue;
+ write_lock_bh(&mrt_lock);
+ list_del(&c->list);
+@@ -1623,7 +1624,7 @@ int ip6mr_sk_done(struct sock *sk)
+ net->ipv6.devconf_all);
+ write_unlock_bh(&mrt_lock);
+
+- mroute_clean_tables(mrt);
++ mroute_clean_tables(mrt, false);
+ err = 0;
+ break;
+ }
+diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
+index e1a9583bb419..f81fcc09ea6c 100644
+--- a/net/ipv6/ipv6_sockglue.c
++++ b/net/ipv6/ipv6_sockglue.c
+@@ -110,10 +110,12 @@ struct ipv6_txoptions *ipv6_update_options(struct sock *sk,
+ icsk->icsk_ext_hdr_len = opt->opt_flen + opt->opt_nflen;
+ icsk->icsk_sync_mss(sk, icsk->icsk_pmtu_cookie);
+ }
+- opt = xchg(&inet6_sk(sk)->opt, opt);
++ opt = xchg((__force struct ipv6_txoptions **)&inet6_sk(sk)->opt,
++ opt);
+ } else {
+ spin_lock(&sk->sk_dst_lock);
+- opt = xchg(&inet6_sk(sk)->opt, opt);
++ opt = xchg((__force struct ipv6_txoptions **)&inet6_sk(sk)->opt,
++ opt);
+ spin_unlock(&sk->sk_dst_lock);
+ }
+ sk_dst_reset(sk);
+@@ -213,9 +215,12 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname,
+ sk->sk_socket->ops = &inet_dgram_ops;
+ sk->sk_family = PF_INET;
+ }
+- opt = xchg(&np->opt, NULL);
+- if (opt)
+- sock_kfree_s(sk, opt, opt->tot_len);
++ opt = xchg((__force struct ipv6_txoptions **)&np->opt,
++ NULL);
++ if (opt) {
++ atomic_sub(opt->tot_len, &sk->sk_omem_alloc);
++ txopt_put(opt);
++ }
+ pktopt = xchg(&np->pktoptions, NULL);
+ kfree_skb(pktopt);
+
+@@ -385,7 +390,8 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname,
+ if (optname != IPV6_RTHDR && !ns_capable(net->user_ns, CAP_NET_RAW))
+ break;
+
+- opt = ipv6_renew_options(sk, np->opt, optname,
++ opt = rcu_dereference_protected(np->opt, sock_owned_by_user(sk));
++ opt = ipv6_renew_options(sk, opt, optname,
+ (struct ipv6_opt_hdr __user *)optval,
+ optlen);
+ if (IS_ERR(opt)) {
+@@ -414,8 +420,10 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname,
+ retv = 0;
+ opt = ipv6_update_options(sk, opt);
+ sticky_done:
+- if (opt)
+- sock_kfree_s(sk, opt, opt->tot_len);
++ if (opt) {
++ atomic_sub(opt->tot_len, &sk->sk_omem_alloc);
++ txopt_put(opt);
++ }
+ break;
+ }
+
+@@ -468,6 +476,7 @@ sticky_done:
+ break;
+
+ memset(opt, 0, sizeof(*opt));
++ atomic_set(&opt->refcnt, 1);
+ opt->tot_len = sizeof(*opt) + optlen;
+ retv = -EFAULT;
+ if (copy_from_user(opt+1, optval, optlen))
+@@ -484,8 +493,10 @@ update:
+ retv = 0;
+ opt = ipv6_update_options(sk, opt);
+ done:
+- if (opt)
+- sock_kfree_s(sk, opt, opt->tot_len);
++ if (opt) {
++ atomic_sub(opt->tot_len, &sk->sk_omem_alloc);
++ txopt_put(opt);
++ }
+ break;
+ }
+ case IPV6_UNICAST_HOPS:
+@@ -1092,10 +1103,11 @@ static int do_ipv6_getsockopt(struct sock *sk, int level, int optname,
+ case IPV6_RTHDR:
+ case IPV6_DSTOPTS:
+ {
++ struct ipv6_txoptions *opt;
+
+ lock_sock(sk);
+- len = ipv6_getsockopt_sticky(sk, np->opt,
+- optname, optval, len);
++ opt = rcu_dereference_protected(np->opt, sock_owned_by_user(sk));
++ len = ipv6_getsockopt_sticky(sk, opt, optname, optval, len);
+ release_sock(sk);
+ /* check if ipv6_getsockopt_sticky() returns err code */
+ if (len < 0)
+diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
+index ed2c4e400b46..5aedf76fe287 100644
+--- a/net/ipv6/mcast.c
++++ b/net/ipv6/mcast.c
+@@ -1652,7 +1652,6 @@ out:
+ if (!err) {
+ ICMP6MSGOUT_INC_STATS(net, idev, ICMPV6_MLD2_REPORT);
+ ICMP6_INC_STATS(net, idev, ICMP6_MIB_OUTMSGS);
+- IP6_UPD_PO_STATS(net, idev, IPSTATS_MIB_OUTMCAST, payload_len);
+ } else {
+ IP6_INC_STATS(net, idev, IPSTATS_MIB_OUTDISCARDS);
+ }
+@@ -2015,7 +2014,6 @@ out:
+ if (!err) {
+ ICMP6MSGOUT_INC_STATS(net, idev, type);
+ ICMP6_INC_STATS(net, idev, ICMP6_MIB_OUTMSGS);
+- IP6_UPD_PO_STATS(net, idev, IPSTATS_MIB_OUTMCAST, full_len);
+ } else
+ IP6_INC_STATS(net, idev, IPSTATS_MIB_OUTDISCARDS);
+
+diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c
+index 6f187c8d8a1b..d235ed7f47ab 100644
+--- a/net/ipv6/netfilter/nf_conntrack_reasm.c
++++ b/net/ipv6/netfilter/nf_conntrack_reasm.c
+@@ -190,7 +190,7 @@ static void nf_ct_frag6_expire(unsigned long data)
+ /* Creation primitives. */
+ static inline struct frag_queue *fq_find(struct net *net, __be32 id,
+ u32 user, struct in6_addr *src,
+- struct in6_addr *dst, u8 ecn)
++ struct in6_addr *dst, int iif, u8 ecn)
+ {
+ struct inet_frag_queue *q;
+ struct ip6_create_arg arg;
+@@ -200,6 +200,7 @@ static inline struct frag_queue *fq_find(struct net *net, __be32 id,
+ arg.user = user;
+ arg.src = src;
+ arg.dst = dst;
++ arg.iif = iif;
+ arg.ecn = ecn;
+
+ local_bh_disable();
+@@ -603,7 +604,7 @@ struct sk_buff *nf_ct_frag6_gather(struct sk_buff *skb, u32 user)
+ fhdr = (struct frag_hdr *)skb_transport_header(clone);
+
+ fq = fq_find(net, fhdr->identification, user, &hdr->saddr, &hdr->daddr,
+- ip6_frag_ecn(hdr));
++ skb->dev ? skb->dev->ifindex : 0, ip6_frag_ecn(hdr));
+ if (fq == NULL) {
+ pr_debug("Can't find and can't create new queue\n");
+ goto ret_orig;
+diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
+index 896af8807979..a66a67d17ed6 100644
+--- a/net/ipv6/raw.c
++++ b/net/ipv6/raw.c
+@@ -735,6 +735,7 @@ static int rawv6_probe_proto_opt(struct flowi6 *fl6, struct msghdr *msg)
+ static int rawv6_sendmsg(struct kiocb *iocb, struct sock *sk,
+ struct msghdr *msg, size_t len)
+ {
++ struct ipv6_txoptions *opt_to_free = NULL;
+ struct ipv6_txoptions opt_space;
+ DECLARE_SOCKADDR(struct sockaddr_in6 *, sin6, msg->msg_name);
+ struct in6_addr *daddr, *final_p, final;
+@@ -840,8 +841,10 @@ static int rawv6_sendmsg(struct kiocb *iocb, struct sock *sk,
+ if (!(opt->opt_nflen|opt->opt_flen))
+ opt = NULL;
+ }
+- if (opt == NULL)
+- opt = np->opt;
++ if (!opt) {
++ opt = txopt_get(np);
++ opt_to_free = opt;
++ }
+ if (flowlabel)
+ opt = fl6_merge_options(&opt_space, flowlabel, opt);
+ opt = ipv6_fixup_options(&opt_space, opt);
+@@ -902,6 +905,7 @@ done:
+ dst_release(dst);
+ out:
+ fl6_sock_release(flowlabel);
++ txopt_put(opt_to_free);
+ return err < 0 ? err : len;
+ do_confirm:
+ dst_confirm(dst);
+diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c
+index 1a157ca2ebc1..28e72f396fde 100644
+--- a/net/ipv6/reassembly.c
++++ b/net/ipv6/reassembly.c
+@@ -108,7 +108,10 @@ bool ip6_frag_match(const struct inet_frag_queue *q, const void *a)
+ return fq->id == arg->id &&
+ fq->user == arg->user &&
+ ipv6_addr_equal(&fq->saddr, arg->src) &&
+- ipv6_addr_equal(&fq->daddr, arg->dst);
++ ipv6_addr_equal(&fq->daddr, arg->dst) &&
++ (arg->iif == fq->iif ||
++ !(ipv6_addr_type(arg->dst) & (IPV6_ADDR_MULTICAST |
++ IPV6_ADDR_LINKLOCAL)));
+ }
+ EXPORT_SYMBOL(ip6_frag_match);
+
+@@ -180,7 +183,7 @@ static void ip6_frag_expire(unsigned long data)
+
+ static __inline__ struct frag_queue *
+ fq_find(struct net *net, __be32 id, const struct in6_addr *src,
+- const struct in6_addr *dst, u8 ecn)
++ const struct in6_addr *dst, int iif, u8 ecn)
+ {
+ struct inet_frag_queue *q;
+ struct ip6_create_arg arg;
+@@ -190,6 +193,7 @@ fq_find(struct net *net, __be32 id, const struct in6_addr *src,
+ arg.user = IP6_DEFRAG_LOCAL_DELIVER;
+ arg.src = src;
+ arg.dst = dst;
++ arg.iif = iif;
+ arg.ecn = ecn;
+
+ hash = inet6_hash_frag(id, src, dst);
+@@ -550,7 +554,7 @@ static int ipv6_frag_rcv(struct sk_buff *skb)
+ }
+
+ fq = fq_find(net, fhdr->identification, &hdr->saddr, &hdr->daddr,
+- ip6_frag_ecn(hdr));
++ skb->dev ? skb->dev->ifindex : 0, ip6_frag_ecn(hdr));
+ if (fq != NULL) {
+ int ret;
+
+diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
+index a24557a1c1d8..45eae1e609d6 100644
+--- a/net/ipv6/sit.c
++++ b/net/ipv6/sit.c
+@@ -1394,34 +1394,20 @@ static int ipip6_tunnel_init(struct net_device *dev)
+ return 0;
+ }
+
+-static int __net_init ipip6_fb_tunnel_init(struct net_device *dev)
++static void __net_init ipip6_fb_tunnel_init(struct net_device *dev)
+ {
+ struct ip_tunnel *tunnel = netdev_priv(dev);
+ struct iphdr *iph = &tunnel->parms.iph;
+ struct net *net = dev_net(dev);
+ struct sit_net *sitn = net_generic(net, sit_net_id);
+
+- tunnel->dev = dev;
+- tunnel->net = dev_net(dev);
+-
+ iph->version = 4;
+ iph->protocol = IPPROTO_IPV6;
+ iph->ihl = 5;
+ iph->ttl = 64;
+
+- dev->tstats = netdev_alloc_pcpu_stats(struct pcpu_sw_netstats);
+- if (!dev->tstats)
+- return -ENOMEM;
+-
+- tunnel->dst_cache = alloc_percpu(struct ip_tunnel_dst);
+- if (!tunnel->dst_cache) {
+- free_percpu(dev->tstats);
+- return -ENOMEM;
+- }
+-
+ dev_hold(dev);
+ rcu_assign_pointer(sitn->tunnels_wc[0], tunnel);
+- return 0;
+ }
+
+ static int ipip6_validate(struct nlattr *tb[], struct nlattr *data[])
+@@ -1831,23 +1817,18 @@ static int __net_init sit_init_net(struct net *net)
+ */
+ sitn->fb_tunnel_dev->features |= NETIF_F_NETNS_LOCAL;
+
+- err = ipip6_fb_tunnel_init(sitn->fb_tunnel_dev);
+- if (err)
+- goto err_dev_free;
+-
+- ipip6_tunnel_clone_6rd(sitn->fb_tunnel_dev, sitn);
+-
+ if ((err = register_netdev(sitn->fb_tunnel_dev)))
+ goto err_reg_dev;
+
++ ipip6_tunnel_clone_6rd(sitn->fb_tunnel_dev, sitn);
++ ipip6_fb_tunnel_init(sitn->fb_tunnel_dev);
++
+ t = netdev_priv(sitn->fb_tunnel_dev);
+
+ strcpy(t->parms.name, sitn->fb_tunnel_dev->name);
+ return 0;
+
+ err_reg_dev:
+- dev_put(sitn->fb_tunnel_dev);
+-err_dev_free:
+ ipip6_dev_free(sitn->fb_tunnel_dev);
+ err_alloc_dev:
+ return err;
+diff --git a/net/ipv6/syncookies.c b/net/ipv6/syncookies.c
+index 2f25cb6347ca..aa9699301ea8 100644
+--- a/net/ipv6/syncookies.c
++++ b/net/ipv6/syncookies.c
+@@ -241,7 +241,7 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
+ memset(&fl6, 0, sizeof(fl6));
+ fl6.flowi6_proto = IPPROTO_TCP;
+ fl6.daddr = ireq->ir_v6_rmt_addr;
+- final_p = fl6_update_dst(&fl6, np->opt, &final);
++ final_p = fl6_update_dst(&fl6, rcu_dereference(np->opt), &final);
+ fl6.saddr = ireq->ir_v6_loc_addr;
+ fl6.flowi6_oif = sk->sk_bound_dev_if;
+ fl6.flowi6_mark = ireq->ir_mark;
+diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
+index a3f9f11abf4c..26feadd0b763 100644
+--- a/net/ipv6/tcp_ipv6.c
++++ b/net/ipv6/tcp_ipv6.c
+@@ -134,6 +134,7 @@ static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
+ struct ipv6_pinfo *np = inet6_sk(sk);
+ struct tcp_sock *tp = tcp_sk(sk);
+ struct in6_addr *saddr = NULL, *final_p, final;
++ struct ipv6_txoptions *opt;
+ struct rt6_info *rt;
+ struct flowi6 fl6;
+ struct dst_entry *dst;
+@@ -253,7 +254,8 @@ static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
+ fl6.fl6_dport = usin->sin6_port;
+ fl6.fl6_sport = inet->inet_sport;
+
+- final_p = fl6_update_dst(&fl6, np->opt, &final);
++ opt = rcu_dereference_protected(np->opt, sock_owned_by_user(sk));
++ final_p = fl6_update_dst(&fl6, opt, &final);
+
+ security_sk_classify_flow(sk, flowi6_to_flowi(&fl6));
+
+@@ -282,9 +284,9 @@ static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
+ tcp_fetch_timewait_stamp(sk, dst);
+
+ icsk->icsk_ext_hdr_len = 0;
+- if (np->opt)
+- icsk->icsk_ext_hdr_len = (np->opt->opt_flen +
+- np->opt->opt_nflen);
++ if (opt)
++ icsk->icsk_ext_hdr_len = opt->opt_flen +
++ opt->opt_nflen;
+
+ tp->rx_opt.mss_clamp = IPV6_MIN_MTU - sizeof(struct tcphdr) - sizeof(struct ipv6hdr);
+
+@@ -501,7 +503,8 @@ static int tcp_v6_send_synack(struct sock *sk, struct dst_entry *dst,
+ fl6->flowlabel = ip6_flowlabel(ipv6_hdr(ireq->pktopts));
+
+ skb_set_queue_mapping(skb, queue_mapping);
+- err = ip6_xmit(sk, skb, fl6, np->opt, np->tclass);
++ err = ip6_xmit(sk, skb, fl6, rcu_dereference(np->opt),
++ np->tclass);
+ err = net_xmit_eval(err);
+ }
+
+@@ -1052,6 +1055,7 @@ static struct sock *tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
+ struct inet_request_sock *ireq;
+ struct ipv6_pinfo *newnp, *np = inet6_sk(sk);
+ struct tcp6_sock *newtcp6sk;
++ struct ipv6_txoptions *opt;
+ struct inet_sock *newinet;
+ struct tcp_sock *newtp;
+ struct sock *newsk;
+@@ -1191,13 +1195,15 @@ static struct sock *tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
+ but we make one more one thing there: reattach optmem
+ to newsk.
+ */
+- if (np->opt)
+- newnp->opt = ipv6_dup_options(newsk, np->opt);
+-
++ opt = rcu_dereference(np->opt);
++ if (opt) {
++ opt = ipv6_dup_options(newsk, opt);
++ RCU_INIT_POINTER(newnp->opt, opt);
++ }
+ inet_csk(newsk)->icsk_ext_hdr_len = 0;
+- if (newnp->opt)
+- inet_csk(newsk)->icsk_ext_hdr_len = (newnp->opt->opt_nflen +
+- newnp->opt->opt_flen);
++ if (opt)
++ inet_csk(newsk)->icsk_ext_hdr_len = opt->opt_nflen +
++ opt->opt_flen;
+
+ tcp_sync_mss(newsk, dst_mtu(dst));
+ newtp->advmss = dst_metric_advmss(dst);
+diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
+index dd530f0e5a8a..a5ce70502699 100644
+--- a/net/ipv6/udp.c
++++ b/net/ipv6/udp.c
+@@ -1082,6 +1082,7 @@ int udpv6_sendmsg(struct kiocb *iocb, struct sock *sk,
+ DECLARE_SOCKADDR(struct sockaddr_in6 *, sin6, msg->msg_name);
+ struct in6_addr *daddr, *final_p, final;
+ struct ipv6_txoptions *opt = NULL;
++ struct ipv6_txoptions *opt_to_free = NULL;
+ struct ip6_flowlabel *flowlabel = NULL;
+ struct flowi6 fl6;
+ struct dst_entry *dst;
+@@ -1234,8 +1235,10 @@ do_udp_sendmsg:
+ opt = NULL;
+ connected = 0;
+ }
+- if (opt == NULL)
+- opt = np->opt;
++ if (!opt) {
++ opt = txopt_get(np);
++ opt_to_free = opt;
++ }
+ if (flowlabel)
+ opt = fl6_merge_options(&opt_space, flowlabel, opt);
+ opt = ipv6_fixup_options(&opt_space, opt);
+@@ -1329,6 +1332,7 @@ do_append_data:
+ out:
+ dst_release(dst);
+ fl6_sock_release(flowlabel);
++ txopt_put(opt_to_free);
+ if (!err)
+ return len;
+ /*
+diff --git a/net/irda/irlmp.c b/net/irda/irlmp.c
+index a5f28d421ea8..c3a939d7848f 100644
+--- a/net/irda/irlmp.c
++++ b/net/irda/irlmp.c
+@@ -1877,7 +1877,7 @@ static void *irlmp_seq_hb_idx(struct irlmp_iter_state *iter, loff_t *off)
+ for (element = hashbin_get_first(iter->hashbin);
+ element != NULL;
+ element = hashbin_get_next(iter->hashbin)) {
+- if (!off || *off-- == 0) {
++ if (!off || (*off)-- == 0) {
+ /* NB: hashbin left locked */
+ return element;
+ }
+diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c
+index 895348e44c7d..508154a04558 100644
+--- a/net/l2tp/l2tp_core.c
++++ b/net/l2tp/l2tp_core.c
+@@ -1319,7 +1319,7 @@ static void l2tp_tunnel_del_work(struct work_struct *work)
+ tunnel = container_of(work, struct l2tp_tunnel, del_work);
+ sk = l2tp_tunnel_sock_lookup(tunnel);
+ if (!sk)
+- return;
++ goto out;
+
+ sock = sk->sk_socket;
+
+@@ -1340,6 +1340,8 @@ static void l2tp_tunnel_del_work(struct work_struct *work)
+ }
+
+ l2tp_tunnel_sock_put(sk);
++out:
++ l2tp_tunnel_dec_refcount(tunnel);
+ }
+
+ /* Create a socket for the tunnel, if one isn't set up by
+@@ -1639,8 +1641,13 @@ EXPORT_SYMBOL_GPL(l2tp_tunnel_create);
+ */
+ int l2tp_tunnel_delete(struct l2tp_tunnel *tunnel)
+ {
++ l2tp_tunnel_inc_refcount(tunnel);
+ l2tp_tunnel_closeall(tunnel);
+- return (false == queue_work(l2tp_wq, &tunnel->del_work));
++ if (false == queue_work(l2tp_wq, &tunnel->del_work)) {
++ l2tp_tunnel_dec_refcount(tunnel);
++ return 1;
++ }
++ return 0;
+ }
+ EXPORT_SYMBOL_GPL(l2tp_tunnel_delete);
+
+diff --git a/net/l2tp/l2tp_ip6.c b/net/l2tp/l2tp_ip6.c
+index 0edb263cc002..38658826175c 100644
+--- a/net/l2tp/l2tp_ip6.c
++++ b/net/l2tp/l2tp_ip6.c
+@@ -487,6 +487,7 @@ static int l2tp_ip6_sendmsg(struct kiocb *iocb, struct sock *sk,
+ DECLARE_SOCKADDR(struct sockaddr_l2tpip6 *, lsa, msg->msg_name);
+ struct in6_addr *daddr, *final_p, final;
+ struct ipv6_pinfo *np = inet6_sk(sk);
++ struct ipv6_txoptions *opt_to_free = NULL;
+ struct ipv6_txoptions *opt = NULL;
+ struct ip6_flowlabel *flowlabel = NULL;
+ struct dst_entry *dst = NULL;
+@@ -576,8 +577,10 @@ static int l2tp_ip6_sendmsg(struct kiocb *iocb, struct sock *sk,
+ opt = NULL;
+ }
+
+- if (opt == NULL)
+- opt = np->opt;
++ if (!opt) {
++ opt = txopt_get(np);
++ opt_to_free = opt;
++ }
+ if (flowlabel)
+ opt = fl6_merge_options(&opt_space, flowlabel, opt);
+ opt = ipv6_fixup_options(&opt_space, opt);
+@@ -632,6 +635,7 @@ done:
+ dst_release(dst);
+ out:
+ fl6_sock_release(flowlabel);
++ txopt_put(opt_to_free);
+
+ return err < 0 ? err : len;
+
+diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
+index bf6097793170..22853af1b6b7 100644
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -1507,6 +1507,20 @@ static void fanout_release(struct sock *sk)
+ mutex_unlock(&fanout_mutex);
+ }
+
++static bool packet_extra_vlan_len_allowed(const struct net_device *dev,
++ struct sk_buff *skb)
++{
++ /* Earlier code assumed this would be a VLAN pkt, double-check
++ * this now that we have the actual packet in hand. We can only
++ * do this check on Ethernet devices.
++ */
++ if (unlikely(dev->type != ARPHRD_ETHER))
++ return false;
++
++ skb_reset_mac_header(skb);
++ return likely(eth_hdr(skb)->h_proto == htons(ETH_P_8021Q));
++}
++
+ static const struct proto_ops packet_ops;
+
+ static const struct proto_ops packet_ops_spkt;
+@@ -1668,18 +1682,10 @@ retry:
+ goto retry;
+ }
+
+- if (len > (dev->mtu + dev->hard_header_len + extra_len)) {
+- /* Earlier code assumed this would be a VLAN pkt,
+- * double-check this now that we have the actual
+- * packet in hand.
+- */
+- struct ethhdr *ehdr;
+- skb_reset_mac_header(skb);
+- ehdr = eth_hdr(skb);
+- if (ehdr->h_proto != htons(ETH_P_8021Q)) {
+- err = -EMSGSIZE;
+- goto out_unlock;
+- }
++ if (len > (dev->mtu + dev->hard_header_len + extra_len) &&
++ !packet_extra_vlan_len_allowed(dev, skb)) {
++ err = -EMSGSIZE;
++ goto out_unlock;
+ }
+
+ skb->protocol = proto;
+@@ -2081,6 +2087,15 @@ static void tpacket_destruct_skb(struct sk_buff *skb)
+ sock_wfree(skb);
+ }
+
++static void tpacket_set_protocol(const struct net_device *dev,
++ struct sk_buff *skb)
++{
++ if (dev->type == ARPHRD_ETHER) {
++ skb_reset_mac_header(skb);
++ skb->protocol = eth_hdr(skb)->h_proto;
++ }
++}
++
+ static int tpacket_fill_skb(struct packet_sock *po, struct sk_buff *skb,
+ void *frame, struct net_device *dev, int size_max,
+ __be16 proto, unsigned char *addr, int hlen)
+@@ -2117,8 +2132,6 @@ static int tpacket_fill_skb(struct packet_sock *po, struct sk_buff *skb,
+ skb_reserve(skb, hlen);
+ skb_reset_network_header(skb);
+
+- if (!packet_use_direct_xmit(po))
+- skb_probe_transport_header(skb, 0);
+ if (unlikely(po->tp_tx_has_off)) {
+ int off_min, off_max, off;
+ off_min = po->tp_hdrlen - sizeof(struct sockaddr_ll);
+@@ -2168,6 +2181,8 @@ static int tpacket_fill_skb(struct packet_sock *po, struct sk_buff *skb,
+ dev->hard_header_len);
+ if (unlikely(err))
+ return err;
++ if (!skb->protocol)
++ tpacket_set_protocol(dev, skb);
+
+ data += dev->hard_header_len;
+ to_write -= dev->hard_header_len;
+@@ -2202,6 +2217,8 @@ static int tpacket_fill_skb(struct packet_sock *po, struct sk_buff *skb,
+ len = ((to_write > len_max) ? len_max : to_write);
+ }
+
++ skb_probe_transport_header(skb, 0);
++
+ return tp_len;
+ }
+
+@@ -2246,12 +2263,13 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg)
+ if (unlikely(!(dev->flags & IFF_UP)))
+ goto out_put;
+
+- reserve = dev->hard_header_len + VLAN_HLEN;
++ if (po->sk.sk_socket->type == SOCK_RAW)
++ reserve = dev->hard_header_len;
+ size_max = po->tx_ring.frame_size
+ - (po->tp_hdrlen - sizeof(struct sockaddr_ll));
+
+- if (size_max > dev->mtu + reserve)
+- size_max = dev->mtu + reserve;
++ if (size_max > dev->mtu + reserve + VLAN_HLEN)
++ size_max = dev->mtu + reserve + VLAN_HLEN;
+
+ do {
+ ph = packet_current_frame(po, &po->tx_ring,
+@@ -2274,18 +2292,11 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg)
+
+ tp_len = tpacket_fill_skb(po, skb, ph, dev, size_max, proto,
+ addr, hlen);
+- if (tp_len > dev->mtu + dev->hard_header_len) {
+- struct ethhdr *ehdr;
+- /* Earlier code assumed this would be a VLAN pkt,
+- * double-check this now that we have the actual
+- * packet in hand.
+- */
++ if (likely(tp_len >= 0) &&
++ tp_len > dev->mtu + reserve &&
++ !packet_extra_vlan_len_allowed(dev, skb))
++ tp_len = -EMSGSIZE;
+
+- skb_reset_mac_header(skb);
+- ehdr = eth_hdr(skb);
+- if (ehdr->h_proto != htons(ETH_P_8021Q))
+- tp_len = -EMSGSIZE;
+- }
+ if (unlikely(tp_len < 0)) {
+ if (po->tp_loss) {
+ __packet_set_status(po, ph,
+@@ -2497,18 +2508,10 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len)
+
+ sock_tx_timestamp(sk, &skb_shinfo(skb)->tx_flags);
+
+- if (!gso_type && (len > dev->mtu + reserve + extra_len)) {
+- /* Earlier code assumed this would be a VLAN pkt,
+- * double-check this now that we have the actual
+- * packet in hand.
+- */
+- struct ethhdr *ehdr;
+- skb_reset_mac_header(skb);
+- ehdr = eth_hdr(skb);
+- if (ehdr->h_proto != htons(ETH_P_8021Q)) {
+- err = -EMSGSIZE;
+- goto out_free;
+- }
++ if (!gso_type && (len > dev->mtu + reserve + extra_len) &&
++ !packet_extra_vlan_len_allowed(dev, skb)) {
++ err = -EMSGSIZE;
++ goto out_free;
+ }
+
+ skb->protocol = proto;
+@@ -2537,8 +2540,8 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len)
+ len += vnet_hdr_len;
+ }
+
+- if (!packet_use_direct_xmit(po))
+- skb_probe_transport_header(skb, reserve);
++ skb_probe_transport_header(skb, reserve);
++
+ if (unlikely(extra_len == 4))
+ skb->no_fcs = 1;
+
+@@ -2642,22 +2645,40 @@ static int packet_release(struct socket *sock)
+ * Attach a packet hook.
+ */
+
+-static int packet_do_bind(struct sock *sk, struct net_device *dev, __be16 proto)
++static int packet_do_bind(struct sock *sk, const char *name, int ifindex,
++ __be16 proto)
+ {
+ struct packet_sock *po = pkt_sk(sk);
+ struct net_device *dev_curr;
+ __be16 proto_curr;
+ bool need_rehook;
++ struct net_device *dev = NULL;
++ int ret = 0;
++ bool unlisted = false;
+
+- if (po->fanout) {
+- if (dev)
+- dev_put(dev);
+-
++ if (po->fanout)
+ return -EINVAL;
+- }
+
+ lock_sock(sk);
+ spin_lock(&po->bind_lock);
++ rcu_read_lock();
++
++ if (name) {
++ dev = dev_get_by_name_rcu(sock_net(sk), name);
++ if (!dev) {
++ ret = -ENODEV;
++ goto out_unlock;
++ }
++ } else if (ifindex) {
++ dev = dev_get_by_index_rcu(sock_net(sk), ifindex);
++ if (!dev) {
++ ret = -ENODEV;
++ goto out_unlock;
++ }
++ }
++
++ if (dev)
++ dev_hold(dev);
+
+ proto_curr = po->prot_hook.type;
+ dev_curr = po->prot_hook.dev;
+@@ -2665,14 +2686,29 @@ static int packet_do_bind(struct sock *sk, struct net_device *dev, __be16 proto)
+ need_rehook = proto_curr != proto || dev_curr != dev;
+
+ if (need_rehook) {
+- unregister_prot_hook(sk, true);
++ if (po->running) {
++ rcu_read_unlock();
++ __unregister_prot_hook(sk, true);
++ rcu_read_lock();
++ dev_curr = po->prot_hook.dev;
++ if (dev)
++ unlisted = !dev_get_by_index_rcu(sock_net(sk),
++ dev->ifindex);
++ }
+
+ po->num = proto;
+ po->prot_hook.type = proto;
+- po->prot_hook.dev = dev;
+
+- po->ifindex = dev ? dev->ifindex : 0;
+- packet_cached_dev_assign(po, dev);
++ if (unlikely(unlisted)) {
++ dev_put(dev);
++ po->prot_hook.dev = NULL;
++ po->ifindex = -1;
++ packet_cached_dev_reset(po);
++ } else {
++ po->prot_hook.dev = dev;
++ po->ifindex = dev ? dev->ifindex : 0;
++ packet_cached_dev_assign(po, dev);
++ }
+ }
+ if (dev_curr)
+ dev_put(dev_curr);
+@@ -2680,7 +2716,7 @@ static int packet_do_bind(struct sock *sk, struct net_device *dev, __be16 proto)
+ if (proto == 0 || !need_rehook)
+ goto out_unlock;
+
+- if (!dev || (dev->flags & IFF_UP)) {
++ if (!unlisted && (!dev || (dev->flags & IFF_UP))) {
+ register_prot_hook(sk);
+ } else {
+ sk->sk_err = ENETDOWN;
+@@ -2689,9 +2725,10 @@ static int packet_do_bind(struct sock *sk, struct net_device *dev, __be16 proto)
+ }
+
+ out_unlock:
++ rcu_read_unlock();
+ spin_unlock(&po->bind_lock);
+ release_sock(sk);
+- return 0;
++ return ret;
+ }
+
+ /*
+@@ -2703,8 +2740,6 @@ static int packet_bind_spkt(struct socket *sock, struct sockaddr *uaddr,
+ {
+ struct sock *sk = sock->sk;
+ char name[15];
+- struct net_device *dev;
+- int err = -ENODEV;
+
+ /*
+ * Check legality
+@@ -2714,19 +2749,13 @@ static int packet_bind_spkt(struct socket *sock, struct sockaddr *uaddr,
+ return -EINVAL;
+ strlcpy(name, uaddr->sa_data, sizeof(name));
+
+- dev = dev_get_by_name(sock_net(sk), name);
+- if (dev)
+- err = packet_do_bind(sk, dev, pkt_sk(sk)->num);
+- return err;
++ return packet_do_bind(sk, name, 0, pkt_sk(sk)->num);
+ }
+
+ static int packet_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
+ {
+ struct sockaddr_ll *sll = (struct sockaddr_ll *)uaddr;
+ struct sock *sk = sock->sk;
+- struct net_device *dev = NULL;
+- int err;
+-
+
+ /*
+ * Check legality
+@@ -2737,16 +2766,8 @@ static int packet_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len
+ if (sll->sll_family != AF_PACKET)
+ return -EINVAL;
+
+- if (sll->sll_ifindex) {
+- err = -ENODEV;
+- dev = dev_get_by_index(sock_net(sk), sll->sll_ifindex);
+- if (dev == NULL)
+- goto out;
+- }
+- err = packet_do_bind(sk, dev, sll->sll_protocol ? : pkt_sk(sk)->num);
+-
+-out:
+- return err;
++ return packet_do_bind(sk, NULL, sll->sll_ifindex,
++ sll->sll_protocol ? : pkt_sk(sk)->num);
+ }
+
+ static struct proto packet_proto = {
+diff --git a/net/rds/connection.c b/net/rds/connection.c
+index 378c3a6acf84..f5fb7d6b7c41 100644
+--- a/net/rds/connection.c
++++ b/net/rds/connection.c
+@@ -183,6 +183,12 @@ static struct rds_connection *__rds_conn_create(__be32 laddr, __be32 faddr,
+ }
+ }
+
++ if (trans == NULL) {
++ kmem_cache_free(rds_conn_slab, conn);
++ conn = ERR_PTR(-ENODEV);
++ goto out;
++ }
++
+ conn->c_trans = trans;
+
+ ret = trans->conn_alloc(conn, gfp);
+diff --git a/net/rds/tcp_recv.c b/net/rds/tcp_recv.c
+index 9ae6e0a264ec..2dd88db4a1a2 100644
+--- a/net/rds/tcp_recv.c
++++ b/net/rds/tcp_recv.c
+@@ -234,8 +234,15 @@ static int rds_tcp_data_recv(read_descriptor_t *desc, struct sk_buff *skb,
+ }
+
+ to_copy = min(tc->t_tinc_data_rem, left);
+- pskb_pull(clone, offset);
+- pskb_trim(clone, to_copy);
++ if (!pskb_pull(clone, offset) ||
++ pskb_trim(clone, to_copy)) {
++ pr_warn("rds_tcp_data_recv: pull/trim failed "
++ "left %zu data_rem %zu skb_len %d\n",
++ left, tc->t_tinc_data_rem, skb->len);
++ kfree_skb(clone);
++ desc->error = -ENOMEM;
++ goto out;
++ }
+ skb_queue_tail(&tinc->ti_skb_list, clone);
+
+ rdsdebug("skb %p data %p len %d off %u to_copy %zu -> "
+diff --git a/net/sctp/auth.c b/net/sctp/auth.c
+index fb7976aee61c..603c3bbc5923 100644
+--- a/net/sctp/auth.c
++++ b/net/sctp/auth.c
+@@ -800,8 +800,8 @@ int sctp_auth_ep_set_hmacs(struct sctp_endpoint *ep,
+ if (!has_sha1)
+ return -EINVAL;
+
+- memcpy(ep->auth_hmacs_list->hmac_ids, &hmacs->shmac_idents[0],
+- hmacs->shmac_num_idents * sizeof(__u16));
++ for (i = 0; i < hmacs->shmac_num_idents; i++)
++ ep->auth_hmacs_list->hmac_ids[i] = htons(hmacs->shmac_idents[i]);
+ ep->auth_hmacs_list->param_hdr.length = htons(sizeof(sctp_paramhdr_t) +
+ hmacs->shmac_num_idents * sizeof(__u16));
+ return 0;
+diff --git a/net/sctp/socket.c b/net/sctp/socket.c
+index 99e640c46ab2..fb082aa4d656 100644
+--- a/net/sctp/socket.c
++++ b/net/sctp/socket.c
+@@ -7393,6 +7393,13 @@ struct proto sctp_prot = {
+
+ #if IS_ENABLED(CONFIG_IPV6)
+
++#include <net/transp_v6.h>
++static void sctp_v6_destroy_sock(struct sock *sk)
++{
++ sctp_destroy_sock(sk);
++ inet6_destroy_sock(sk);
++}
++
+ struct proto sctpv6_prot = {
+ .name = "SCTPv6",
+ .owner = THIS_MODULE,
+@@ -7402,7 +7409,7 @@ struct proto sctpv6_prot = {
+ .accept = sctp_accept,
+ .ioctl = sctp_ioctl,
+ .init = sctp_init_sock,
+- .destroy = sctp_destroy_sock,
++ .destroy = sctp_v6_destroy_sock,
+ .shutdown = sctp_shutdown,
+ .setsockopt = sctp_setsockopt,
+ .getsockopt = sctp_getsockopt,
+diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
+index 8232118b3f82..2ae4a5915aa7 100644
+--- a/net/unix/af_unix.c
++++ b/net/unix/af_unix.c
+@@ -1962,6 +1962,11 @@ static int unix_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
+ goto out;
+ }
+
++ if (flags & MSG_PEEK)
++ skip = sk_peek_offset(sk, flags);
++ else
++ skip = 0;
++
+ do {
+ int chunk;
+ struct sk_buff *skb, *last;
+@@ -2008,7 +2013,6 @@ again:
+ break;
+ }
+
+- skip = sk_peek_offset(sk, flags);
+ while (skip >= unix_skb_len(skb)) {
+ skip -= unix_skb_len(skb);
+ last = skb;
+@@ -2072,6 +2076,16 @@ again:
+
+ sk_peek_offset_fwd(sk, chunk);
+
++ if (UNIXCB(skb).fp)
++ break;
++
++ skip = 0;
++ last = skb;
++ unix_state_lock(sk);
++ skb = skb_peek_next(skb, &sk->sk_receive_queue);
++ if (skb)
++ goto again;
++ unix_state_unlock(sk);
+ break;
+ }
+ } while (size);
+diff --git a/security/keys/gc.c b/security/keys/gc.c
+index c7952375ac53..addf060399e0 100644
+--- a/security/keys/gc.c
++++ b/security/keys/gc.c
+@@ -134,6 +134,12 @@ static noinline void key_gc_unused_keys(struct list_head *keys)
+ kdebug("- %u", key->serial);
+ key_check(key);
+
++ /* Throw away the key data if the key is instantiated */
++ if (test_bit(KEY_FLAG_INSTANTIATED, &key->flags) &&
++ !test_bit(KEY_FLAG_NEGATIVE, &key->flags) &&
++ key->type->destroy)
++ key->type->destroy(key);
++
+ security_key_free(key);
+
+ /* deal with the user's key tracking and quota */
+@@ -148,10 +154,6 @@ static noinline void key_gc_unused_keys(struct list_head *keys)
+ if (test_bit(KEY_FLAG_INSTANTIATED, &key->flags))
+ atomic_dec(&key->user->nikeys);
+
+- /* now throw away the key memory */
+- if (key->type->destroy)
+- key->type->destroy(key);
+-
+ key_user_put(key->user);
+
+ kfree(key->description);
+diff --git a/tools/net/Makefile b/tools/net/Makefile
+index ee577ea03ba5..ddf888010652 100644
+--- a/tools/net/Makefile
++++ b/tools/net/Makefile
+@@ -4,6 +4,9 @@ CC = gcc
+ LEX = flex
+ YACC = bison
+
++CFLAGS += -Wall -O2
++CFLAGS += -D__EXPORTED_HEADERS__ -I../../include/uapi -I../../include
++
+ %.yacc.c: %.y
+ $(YACC) -o $@ -d $<
+
+@@ -12,15 +15,13 @@ YACC = bison
+
+ all : bpf_jit_disasm bpf_dbg bpf_asm
+
+-bpf_jit_disasm : CFLAGS = -Wall -O2 -DPACKAGE='bpf_jit_disasm'
++bpf_jit_disasm : CFLAGS += -DPACKAGE='bpf_jit_disasm'
+ bpf_jit_disasm : LDLIBS = -lopcodes -lbfd -ldl
+ bpf_jit_disasm : bpf_jit_disasm.o
+
+-bpf_dbg : CFLAGS = -Wall -O2
+ bpf_dbg : LDLIBS = -lreadline
+ bpf_dbg : bpf_dbg.o
+
+-bpf_asm : CFLAGS = -Wall -O2 -I.
+ bpf_asm : LDLIBS =
+ bpf_asm : bpf_asm.o bpf_exp.yacc.o bpf_exp.lex.o
+ bpf_exp.lex.o : bpf_exp.yacc.c
^ permalink raw reply related [flat|nested] 67+ messages in thread
* [gentoo-commits] proj/linux-patches:3.18 commit in: /
@ 2016-01-20 14:35 Mike Pagano
0 siblings, 0 replies; 67+ messages in thread
From: Mike Pagano @ 2016-01-20 14:35 UTC (permalink / raw
To: gentoo-commits
commit: 5976cc60315452fcf49adda2f52e5ff8c966e831
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed Jan 20 14:35:20 2016 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed Jan 20 14:35:20 2016 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=5976cc60
Ensure that thread joining a session keyring does not leak the keyring reference. CVE-2016-0728.
0000_README | 4 ++
...ing-refleak-in-join-session-CVE-2016-0728.patch | 81 ++++++++++++++++++++++
2 files changed, 85 insertions(+)
diff --git a/0000_README b/0000_README
index 369ed3d..3fe5eec 100644
--- a/0000_README
+++ b/0000_README
@@ -151,6 +151,10 @@ Patch: 1510_fs-enable-link-security-restrictions-by-default.patch
From: http://sources.debian.net/src/linux/3.16.7-ckt4-3/debian/patches/debian/fs-enable-link-security-restrictions-by-default.patch/
Desc: Enable link security restrictions by default
+Patch: 1520_keyring-refleak-in-join-session-CVE-2016-0728.patch
+From: https://bugs.gentoo.org/show_bug.cgi?id=572384
+Desc: Ensure that thread joining a session keyring does not leak the keyring reference. CVE-2016-0728.
+
Patch: 1700_ARM-dts-patch-to-support-popoplug-e02.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=508248
Desc: ARM: dts: Add support for Pogoplug E02.
diff --git a/1520_keyring-refleak-in-join-session-CVE-2016-0728.patch b/1520_keyring-refleak-in-join-session-CVE-2016-0728.patch
new file mode 100644
index 0000000..49020d7
--- /dev/null
+++ b/1520_keyring-refleak-in-join-session-CVE-2016-0728.patch
@@ -0,0 +1,81 @@
+From 23567fd052a9abb6d67fe8e7a9ccdd9800a540f2 Mon Sep 17 00:00:00 2001
+From: Yevgeny Pats <yevgeny@perception-point.io>
+Date: Tue, 19 Jan 2016 22:09:04 +0000
+Subject: KEYS: Fix keyring ref leak in join_session_keyring()
+
+This fixes CVE-2016-0728.
+
+If a thread is asked to join as a session keyring the keyring that's already
+set as its session, we leak a keyring reference.
+
+This can be tested with the following program:
+
+ #include <stddef.h>
+ #include <stdio.h>
+ #include <sys/types.h>
+ #include <keyutils.h>
+
+ int main(int argc, const char *argv[])
+ {
+ int i = 0;
+ key_serial_t serial;
+
+ serial = keyctl(KEYCTL_JOIN_SESSION_KEYRING,
+ "leaked-keyring");
+ if (serial < 0) {
+ perror("keyctl");
+ return -1;
+ }
+
+ if (keyctl(KEYCTL_SETPERM, serial,
+ KEY_POS_ALL | KEY_USR_ALL) < 0) {
+ perror("keyctl");
+ return -1;
+ }
+
+ for (i = 0; i < 100; i++) {
+ serial = keyctl(KEYCTL_JOIN_SESSION_KEYRING,
+ "leaked-keyring");
+ if (serial < 0) {
+ perror("keyctl");
+ return -1;
+ }
+ }
+
+ return 0;
+ }
+
+If, after the program has run, there something like the following line in
+/proc/keys:
+
+3f3d898f I--Q--- 100 perm 3f3f0000 0 0 keyring leaked-keyring: empty
+
+with a usage count of 100 * the number of times the program has been run,
+then the kernel is malfunctioning. If leaked-keyring has zero usages or
+has been garbage collected, then the problem is fixed.
+
+Reported-by: Yevgeny Pats <yevgeny@perception-point.io>
+Signed-off-by: David Howells <dhowells@redhat.com>
+Acked-by: Don Zickus <dzickus@redhat.com>
+Acked-by: Prarit Bhargava <prarit@redhat.com>
+Acked-by: Jarod Wilson <jarod@redhat.com>
+Signed-off-by: James Morris <james.l.morris@oracle.com>
+---
+ security/keys/process_keys.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/security/keys/process_keys.c b/security/keys/process_keys.c
+index a3f85d2..e6d50172 100644
+--- a/security/keys/process_keys.c
++++ b/security/keys/process_keys.c
+@@ -794,6 +794,7 @@ long join_session_keyring(const char *name)
+ ret = PTR_ERR(keyring);
+ goto error2;
+ } else if (keyring == new->session_keyring) {
++ key_put(keyring);
+ ret = 0;
+ goto error2;
+ }
+--
+cgit v0.12
+
^ permalink raw reply related [flat|nested] 67+ messages in thread
* [gentoo-commits] proj/linux-patches:3.18 commit in: /
@ 2016-01-31 15:36 Mike Pagano
0 siblings, 0 replies; 67+ messages in thread
From: Mike Pagano @ 2016-01-31 15:36 UTC (permalink / raw
To: gentoo-commits
commit: 41033c2db3e1f066508325a49e17c53e24013843
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Sun Jan 31 15:36:20 2016 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Sun Jan 31 15:36:20 2016 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=41033c2d
Linux patch 3.18.26. Removal of redundant patchset.
0000_README | 8 +-
1025_linux-3.18.26.patch | 1763 ++++++++++++++++++++
...ing-refleak-in-join-session-CVE-2016-0728.patch | 81 -
3 files changed, 1767 insertions(+), 85 deletions(-)
diff --git a/0000_README b/0000_README
index 3fe5eec..728c863 100644
--- a/0000_README
+++ b/0000_README
@@ -143,6 +143,10 @@ Patch: 1024_linux-3.18.25.patch
From: http://www.kernel.org
Desc: Linux 3.18.25
+Patch: 1025_linux-3.18.26.patch
+From: http://www.kernel.org
+Desc: Linux 3.18.26
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
@@ -151,10 +155,6 @@ Patch: 1510_fs-enable-link-security-restrictions-by-default.patch
From: http://sources.debian.net/src/linux/3.16.7-ckt4-3/debian/patches/debian/fs-enable-link-security-restrictions-by-default.patch/
Desc: Enable link security restrictions by default
-Patch: 1520_keyring-refleak-in-join-session-CVE-2016-0728.patch
-From: https://bugs.gentoo.org/show_bug.cgi?id=572384
-Desc: Ensure that thread joining a session keyring does not leak the keyring reference. CVE-2016-0728.
-
Patch: 1700_ARM-dts-patch-to-support-popoplug-e02.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=508248
Desc: ARM: dts: Add support for Pogoplug E02.
diff --git a/1025_linux-3.18.26.patch b/1025_linux-3.18.26.patch
new file mode 100644
index 0000000..5ad05b0
--- /dev/null
+++ b/1025_linux-3.18.26.patch
@@ -0,0 +1,1763 @@
+diff --git a/Makefile b/Makefile
+index 6df25277ea44..03b0c3fb5bfd 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 18
+-SUBLEVEL = 25
++SUBLEVEL = 26
+ EXTRAVERSION =
+ NAME = Diseased Newt
+
+diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c
+index 8f51d6e3883e..c546a93c0f8a 100644
+--- a/drivers/block/rbd.c
++++ b/drivers/block/rbd.c
+@@ -3394,6 +3394,7 @@ static void rbd_handle_request(struct rbd_device *rbd_dev, struct request *rq)
+ goto err_rq;
+ }
+ img_request->rq = rq;
++ snapc = NULL; /* img_request consumes a ref */
+
+ if (op_type == OBJ_OP_DISCARD)
+ result = rbd_img_request_fill(img_request, OBJ_REQUEST_NODATA,
+@@ -5172,41 +5173,36 @@ out_err:
+ static int rbd_dev_probe_parent(struct rbd_device *rbd_dev)
+ {
+ struct rbd_device *parent = NULL;
+- struct rbd_spec *parent_spec;
+- struct rbd_client *rbdc;
+ int ret;
+
+ if (!rbd_dev->parent_spec)
+ return 0;
+- /*
+- * We need to pass a reference to the client and the parent
+- * spec when creating the parent rbd_dev. Images related by
+- * parent/child relationships always share both.
+- */
+- parent_spec = rbd_spec_get(rbd_dev->parent_spec);
+- rbdc = __rbd_get_client(rbd_dev->rbd_client);
+
+- ret = -ENOMEM;
+- parent = rbd_dev_create(rbdc, parent_spec);
+- if (!parent)
++ parent = rbd_dev_create(rbd_dev->rbd_client, rbd_dev->parent_spec);
++ if (!parent) {
++ ret = -ENOMEM;
+ goto out_err;
++ }
++
++ /*
++ * Images related by parent/child relationships always share
++ * rbd_client and spec/parent_spec, so bump their refcounts.
++ */
++ __rbd_get_client(rbd_dev->rbd_client);
++ rbd_spec_get(rbd_dev->parent_spec);
+
+ ret = rbd_dev_image_probe(parent, false);
+ if (ret < 0)
+ goto out_err;
++
+ rbd_dev->parent = parent;
+ atomic_set(&rbd_dev->parent_ref, 1);
+-
+ return 0;
++
+ out_err:
+- if (parent) {
+- rbd_dev_unparent(rbd_dev);
++ rbd_dev_unparent(rbd_dev);
++ if (parent)
+ rbd_dev_destroy(parent);
+- } else {
+- rbd_put_client(rbdc);
+- rbd_spec_put(parent_spec);
+- }
+-
+ return ret;
+ }
+
+diff --git a/drivers/firewire/ohci.c b/drivers/firewire/ohci.c
+index a66a3217f1d9..f047d7c2b643 100644
+--- a/drivers/firewire/ohci.c
++++ b/drivers/firewire/ohci.c
+@@ -3682,6 +3682,11 @@ static int pci_probe(struct pci_dev *dev,
+
+ reg_write(ohci, OHCI1394_IsoXmitIntMaskSet, ~0);
+ ohci->it_context_support = reg_read(ohci, OHCI1394_IsoXmitIntMaskSet);
++ /* JMicron JMB38x often shows 0 at first read, just ignore it */
++ if (!ohci->it_context_support) {
++ ohci_notice(ohci, "overriding IsoXmitIntMask\n");
++ ohci->it_context_support = 0xf;
++ }
+ reg_write(ohci, OHCI1394_IsoXmitIntMaskClear, ~0);
+ ohci->it_context_mask = ohci->it_context_support;
+ ohci->n_it = hweight32(ohci->it_context_mask);
+diff --git a/drivers/net/ethernet/atheros/atl1c/atl1c_main.c b/drivers/net/ethernet/atheros/atl1c/atl1c_main.c
+index 72fb86b9aa24..067f2cb9b215 100644
+--- a/drivers/net/ethernet/atheros/atl1c/atl1c_main.c
++++ b/drivers/net/ethernet/atheros/atl1c/atl1c_main.c
+@@ -1014,13 +1014,12 @@ static int atl1c_setup_ring_resources(struct atl1c_adapter *adapter)
+ sizeof(struct atl1c_recv_ret_status) * rx_desc_count +
+ 8 * 4;
+
+- ring_header->desc = pci_alloc_consistent(pdev, ring_header->size,
+- &ring_header->dma);
++ ring_header->desc = dma_zalloc_coherent(&pdev->dev, ring_header->size,
++ &ring_header->dma, GFP_KERNEL);
+ if (unlikely(!ring_header->desc)) {
+- dev_err(&pdev->dev, "pci_alloc_consistend failed\n");
++ dev_err(&pdev->dev, "could not get memory for DMA buffer\n");
+ goto err_nomem;
+ }
+- memset(ring_header->desc, 0, ring_header->size);
+ /* init TPD ring */
+
+ tpd_ring[0].dma = roundup(ring_header->dma, 8);
+diff --git a/drivers/net/ethernet/qualcomm/qca_spi.c b/drivers/net/ethernet/qualcomm/qca_spi.c
+index 2c811f66d5ac..f77b58911558 100644
+--- a/drivers/net/ethernet/qualcomm/qca_spi.c
++++ b/drivers/net/ethernet/qualcomm/qca_spi.c
+@@ -737,9 +737,8 @@ qcaspi_netdev_tx_timeout(struct net_device *dev)
+ netdev_info(qca->net_dev, "Transmit timeout at %ld, latency %ld\n",
+ jiffies, jiffies - dev->trans_start);
+ qca->net_dev->stats.tx_errors++;
+- /* wake the queue if there is room */
+- if (qcaspi_tx_ring_has_space(&qca->txr))
+- netif_wake_queue(dev);
++ /* Trigger tx queue flush and QCA7000 reset */
++ qca->sync = QCASPI_SYNC_UNKNOWN;
+ }
+
+ static int
+diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c
+index b5db6b3f939f..b474dbfcdb4f 100644
+--- a/drivers/net/ethernet/renesas/sh_eth.c
++++ b/drivers/net/ethernet/renesas/sh_eth.c
+@@ -1417,6 +1417,7 @@ static int sh_eth_rx(struct net_device *ndev, u32 intr_status, int *quota)
+ if (mdp->cd->shift_rd0)
+ desc_status >>= 16;
+
++ skb = mdp->rx_skbuff[entry];
+ if (desc_status & (RD_RFS1 | RD_RFS2 | RD_RFS3 | RD_RFS4 |
+ RD_RFS5 | RD_RFS6 | RD_RFS10)) {
+ ndev->stats.rx_errors++;
+@@ -1432,12 +1433,11 @@ static int sh_eth_rx(struct net_device *ndev, u32 intr_status, int *quota)
+ ndev->stats.rx_missed_errors++;
+ if (desc_status & RD_RFS10)
+ ndev->stats.rx_over_errors++;
+- } else {
++ } else if (skb) {
+ if (!mdp->cd->hw_swap)
+ sh_eth_soft_swap(
+ phys_to_virt(ALIGN(rxdesc->addr, 4)),
+ pkt_len + 2);
+- skb = mdp->rx_skbuff[entry];
+ mdp->rx_skbuff[entry] = NULL;
+ if (mdp->cd->rpadir)
+ skb_reserve(skb, NET_IP_ALIGN);
+diff --git a/drivers/net/ppp/pptp.c b/drivers/net/ppp/pptp.c
+index 1dc628ffce2b..0710214df2bf 100644
+--- a/drivers/net/ppp/pptp.c
++++ b/drivers/net/ppp/pptp.c
+@@ -420,6 +420,9 @@ static int pptp_bind(struct socket *sock, struct sockaddr *uservaddr,
+ struct pptp_opt *opt = &po->proto.pptp;
+ int error = 0;
+
++ if (sockaddr_len < sizeof(struct sockaddr_pppox))
++ return -EINVAL;
++
+ lock_sock(sk);
+
+ opt->src_addr = sp->sa_addr.pptp;
+@@ -441,6 +444,9 @@ static int pptp_connect(struct socket *sock, struct sockaddr *uservaddr,
+ struct flowi4 fl4;
+ int error = 0;
+
++ if (sockaddr_len < sizeof(struct sockaddr_pppox))
++ return -EINVAL;
++
+ if (sp->sa_protocol != PX_PROTO_PPTP)
+ return -EINVAL;
+
+diff --git a/drivers/net/wireless/iwlwifi/iwl-7000.c b/drivers/net/wireless/iwlwifi/iwl-7000.c
+index 9dfd1d1106d7..655ecf982394 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-7000.c
++++ b/drivers/net/wireless/iwlwifi/iwl-7000.c
+@@ -69,8 +69,8 @@
+ #include "iwl-agn-hw.h"
+
+ /* Highest firmware API version supported */
+-#define IWL7260_UCODE_API_MAX 10
+-#define IWL3160_UCODE_API_MAX 10
++#define IWL7260_UCODE_API_MAX 12
++#define IWL3160_UCODE_API_MAX 12
+
+ /* Oldest version we won't warn about */
+ #define IWL7260_UCODE_API_OK 9
+@@ -103,7 +103,7 @@
+ #define IWL7265_MODULE_FIRMWARE(api) IWL7265_FW_PRE __stringify(api) ".ucode"
+
+ #define IWL7265D_FW_PRE "iwlwifi-7265D-"
+-#define IWL7265D_MODULE_FIRMWARE(api) IWL7265_FW_PRE __stringify(api) ".ucode"
++#define IWL7265D_MODULE_FIRMWARE(api) IWL7265D_FW_PRE __stringify(api) ".ucode"
+
+ #define NVM_HW_SECTION_NUM_FAMILY_7000 0
+
+diff --git a/drivers/net/wireless/iwlwifi/iwl-8000.c b/drivers/net/wireless/iwlwifi/iwl-8000.c
+index d2b7234b1c73..d727ad324d17 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-8000.c
++++ b/drivers/net/wireless/iwlwifi/iwl-8000.c
+@@ -69,7 +69,7 @@
+ #include "iwl-agn-hw.h"
+
+ /* Highest firmware API version supported */
+-#define IWL8000_UCODE_API_MAX 10
++#define IWL8000_UCODE_API_MAX 12
+
+ /* Oldest version we won't warn about */
+ #define IWL8000_UCODE_API_OK 8
+diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
+index 7d8c3d4ede20..0ecf393a7973 100644
+--- a/drivers/usb/class/cdc-acm.c
++++ b/drivers/usb/class/cdc-acm.c
+@@ -1860,6 +1860,11 @@ static const struct usb_device_id acm_ids[] = {
+ },
+ #endif
+
++ /* Exclude Infineon Flash Loader utility */
++ { USB_DEVICE(0x058b, 0x0041),
++ .driver_info = IGNORE_DEVICE,
++ },
++
+ /* control interfaces without any protocol set */
+ { USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_ACM,
+ USB_CDC_PROTO_NONE) },
+diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c
+index b9ddf0c1ffe5..894894f2ff93 100644
+--- a/drivers/usb/core/config.c
++++ b/drivers/usb/core/config.c
+@@ -115,7 +115,8 @@ static void usb_parse_ss_endpoint_companion(struct device *ddev, int cfgno,
+ USB_SS_MULT(desc->bmAttributes) > 3) {
+ dev_warn(ddev, "Isoc endpoint has Mult of %d in "
+ "config %d interface %d altsetting %d ep %d: "
+- "setting to 3\n", desc->bmAttributes + 1,
++ "setting to 3\n",
++ USB_SS_MULT(desc->bmAttributes),
+ cfgno, inum, asnum, ep->desc.bEndpointAddress);
+ ep->ss_ep_comp.bmAttributes = 2;
+ }
+diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
+index 2222899c4b69..88e6e5debbe9 100644
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -124,6 +124,10 @@ struct usb_hub *usb_hub_to_struct_hub(struct usb_device *hdev)
+
+ static int usb_device_supports_lpm(struct usb_device *udev)
+ {
++ /* Some devices have trouble with LPM */
++ if (udev->quirks & USB_QUIRK_NO_LPM)
++ return 0;
++
+ /* USB 2.1 (and greater) devices indicate LPM support through
+ * their USB 2.0 Extended Capabilities BOS descriptor.
+ */
+@@ -4498,6 +4502,8 @@ hub_port_init (struct usb_hub *hub, struct usb_device *udev, int port1,
+ goto fail;
+ }
+
++ usb_detect_quirks(udev);
++
+ if (udev->wusb == 0 && le16_to_cpu(udev->descriptor.bcdUSB) >= 0x0201) {
+ retval = usb_get_bos_descriptor(udev);
+ if (!retval) {
+@@ -4692,7 +4698,6 @@ static void hub_port_connect(struct usb_hub *hub, int port1, u16 portstatus,
+ if (status < 0)
+ goto loop;
+
+- usb_detect_quirks(udev);
+ if (udev->quirks & USB_QUIRK_DELAY_INIT)
+ msleep(1000);
+
+@@ -5324,9 +5329,6 @@ static int usb_reset_and_verify_device(struct usb_device *udev)
+ if (udev->usb2_hw_lpm_enabled == 1)
+ usb_set_usb2_hardware_lpm(udev, 0);
+
+- bos = udev->bos;
+- udev->bos = NULL;
+-
+ /* Disable LPM and LTM while we reset the device and reinstall the alt
+ * settings. Device-initiated LPM settings, and system exit latency
+ * settings are cleared when the device is reset, so we have to set
+@@ -5335,15 +5337,18 @@ static int usb_reset_and_verify_device(struct usb_device *udev)
+ ret = usb_unlocked_disable_lpm(udev);
+ if (ret) {
+ dev_err(&udev->dev, "%s Failed to disable LPM\n.", __func__);
+- goto re_enumerate;
++ goto re_enumerate_no_bos;
+ }
+ ret = usb_disable_ltm(udev);
+ if (ret) {
+ dev_err(&udev->dev, "%s Failed to disable LTM\n.",
+ __func__);
+- goto re_enumerate;
++ goto re_enumerate_no_bos;
+ }
+
++ bos = udev->bos;
++ udev->bos = NULL;
++
+ for (i = 0; i < SET_CONFIG_TRIES; ++i) {
+
+ /* ep0 maxpacket size may change; let the HCD know about it.
+@@ -5440,10 +5445,11 @@ done:
+ return 0;
+
+ re_enumerate:
+- /* LPM state doesn't matter when we're about to destroy the device. */
+- hub_port_logical_disconnect(parent_hub, port1);
+ usb_release_bos_descriptor(udev);
+ udev->bos = bos;
++re_enumerate_no_bos:
++ /* LPM state doesn't matter when we're about to destroy the device. */
++ hub_port_logical_disconnect(parent_hub, port1);
+ return -ENODEV;
+ }
+
+diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
+index 8a77a417ccfd..6b53fc3ec636 100644
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -196,6 +196,12 @@ static const struct usb_device_id usb_quirk_list[] = {
+ { USB_DEVICE(0x1a0a, 0x0200), .driver_info =
+ USB_QUIRK_LINEAR_UFRAME_INTR_BINTERVAL },
+
++ /* Blackmagic Design Intensity Shuttle */
++ { USB_DEVICE(0x1edb, 0xbd3b), .driver_info = USB_QUIRK_NO_LPM },
++
++ /* Blackmagic Design UltraStudio SDI */
++ { USB_DEVICE(0x1edb, 0xbd4f), .driver_info = USB_QUIRK_NO_LPM },
++
+ { } /* terminating entry must be last */
+ };
+
+diff --git a/drivers/usb/gadget/udc/pxa27x_udc.c b/drivers/usb/gadget/udc/pxa27x_udc.c
+index 4868369eeec6..69456811ec11 100644
+--- a/drivers/usb/gadget/udc/pxa27x_udc.c
++++ b/drivers/usb/gadget/udc/pxa27x_udc.c
+@@ -2564,6 +2564,9 @@ static int pxa_udc_suspend(struct platform_device *_dev, pm_message_t state)
+ udc->pullup_resume = udc->pullup_on;
+ dplus_pullup(udc, 0);
+
++ if (udc->driver)
++ udc->driver->disconnect(&udc->gadget);
++
+ return 0;
+ }
+
+diff --git a/drivers/usb/host/whci/qset.c b/drivers/usb/host/whci/qset.c
+index dc31c425ce01..9f1c0538b211 100644
+--- a/drivers/usb/host/whci/qset.c
++++ b/drivers/usb/host/whci/qset.c
+@@ -377,6 +377,10 @@ static int qset_fill_page_list(struct whc *whc, struct whc_std *std, gfp_t mem_f
+ if (std->pl_virt == NULL)
+ return -ENOMEM;
+ std->dma_addr = dma_map_single(whc->wusbhc.dev, std->pl_virt, pl_len, DMA_TO_DEVICE);
++ if (dma_mapping_error(whc->wusbhc.dev, std->dma_addr)) {
++ kfree(std->pl_virt);
++ return -EFAULT;
++ }
+
+ for (p = 0; p < std->num_pointers; p++) {
+ std->pl_virt[p].buf_ptr = cpu_to_le64(dma_addr);
+diff --git a/drivers/usb/musb/Kconfig b/drivers/usb/musb/Kconfig
+index 06cc5d6ea681..dbc56eb5eee4 100644
+--- a/drivers/usb/musb/Kconfig
++++ b/drivers/usb/musb/Kconfig
+@@ -140,7 +140,7 @@ config USB_TI_CPPI_DMA
+
+ config USB_TI_CPPI41_DMA
+ bool 'TI CPPI 4.1 (AM335x)'
+- depends on ARCH_OMAP
++ depends on ARCH_OMAP && DMADEVICES
+ select TI_CPPI41
+
+ config USB_TUSB_OMAP_DMA
+diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
+index eac7ccaa3c85..7d4f51a32e66 100644
+--- a/drivers/usb/serial/cp210x.c
++++ b/drivers/usb/serial/cp210x.c
+@@ -132,7 +132,6 @@ static const struct usb_device_id id_table[] = {
+ { USB_DEVICE(0x10C4, 0xEA60) }, /* Silicon Labs factory default */
+ { USB_DEVICE(0x10C4, 0xEA61) }, /* Silicon Labs factory default */
+ { USB_DEVICE(0x10C4, 0xEA70) }, /* Silicon Labs factory default */
+- { USB_DEVICE(0x10C4, 0xEA80) }, /* Silicon Labs factory default */
+ { USB_DEVICE(0x10C4, 0xEA71) }, /* Infinity GPS-MIC-1 Radio Monophone */
+ { USB_DEVICE(0x10C4, 0xF001) }, /* Elan Digital Systems USBscope50 */
+ { USB_DEVICE(0x10C4, 0xF002) }, /* Elan Digital Systems USBwave12 */
+diff --git a/drivers/usb/serial/usb-serial-simple.c b/drivers/usb/serial/usb-serial-simple.c
+index 7064eb8d6142..a1f2e2a05bc5 100644
+--- a/drivers/usb/serial/usb-serial-simple.c
++++ b/drivers/usb/serial/usb-serial-simple.c
+@@ -53,6 +53,7 @@ DEVICE(funsoft, FUNSOFT_IDS);
+
+ /* Infineon Flashloader driver */
+ #define FLASHLOADER_IDS() \
++ { USB_DEVICE_INTERFACE_CLASS(0x058b, 0x0041, USB_CLASS_CDC_DATA) }, \
+ { USB_DEVICE(0x8087, 0x0716) }
+ DEVICE(flashloader, FLASHLOADER_IDS);
+
+diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c
+index 5193c7844315..e557e4ca0392 100644
+--- a/fs/btrfs/file.c
++++ b/fs/btrfs/file.c
+@@ -760,8 +760,16 @@ next_slot:
+ }
+
+ btrfs_item_key_to_cpu(leaf, &key, path->slots[0]);
+- if (key.objectid > ino ||
+- key.type > BTRFS_EXTENT_DATA_KEY || key.offset >= end)
++
++ if (key.objectid > ino)
++ break;
++ if (WARN_ON_ONCE(key.objectid < ino) ||
++ key.type < BTRFS_EXTENT_DATA_KEY) {
++ ASSERT(del_nr == 0);
++ path->slots[0]++;
++ goto next_slot;
++ }
++ if (key.type > BTRFS_EXTENT_DATA_KEY || key.offset >= end)
+ break;
+
+ fi = btrfs_item_ptr(leaf, path->slots[0],
+@@ -780,8 +788,8 @@ next_slot:
+ btrfs_file_extent_inline_len(leaf,
+ path->slots[0], fi);
+ } else {
+- WARN_ON(1);
+- extent_end = search_start;
++ /* can't happen */
++ BUG();
+ }
+
+ /*
+diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
+index 0be09bb34b75..5db50e8bf52e 100644
+--- a/fs/btrfs/inode.c
++++ b/fs/btrfs/inode.c
+@@ -1268,8 +1268,14 @@ next_slot:
+ num_bytes = 0;
+ btrfs_item_key_to_cpu(leaf, &found_key, path->slots[0]);
+
+- if (found_key.objectid > ino ||
+- found_key.type > BTRFS_EXTENT_DATA_KEY ||
++ if (found_key.objectid > ino)
++ break;
++ if (WARN_ON_ONCE(found_key.objectid < ino) ||
++ found_key.type < BTRFS_EXTENT_DATA_KEY) {
++ path->slots[0]++;
++ goto next_slot;
++ }
++ if (found_key.type > BTRFS_EXTENT_DATA_KEY ||
+ found_key.offset > end)
+ break;
+
+diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
+index 3d50f1ee51ba..31c9f6471ce7 100644
+--- a/fs/btrfs/ioctl.c
++++ b/fs/btrfs/ioctl.c
+@@ -3187,6 +3187,150 @@ static void clone_update_extent_map(struct inode *inode,
+ &BTRFS_I(inode)->runtime_flags);
+ }
+
++/*
++ * Make sure we do not end up inserting an inline extent into a file that has
++ * already other (non-inline) extents. If a file has an inline extent it can
++ * not have any other extents and the (single) inline extent must start at the
++ * file offset 0. Failing to respect these rules will lead to file corruption,
++ * resulting in EIO errors on read/write operations, hitting BUG_ON's in mm, etc
++ *
++ * We can have extents that have been already written to disk or we can have
++ * dirty ranges still in delalloc, in which case the extent maps and items are
++ * created only when we run delalloc, and the delalloc ranges might fall outside
++ * the range we are currently locking in the inode's io tree. So we check the
++ * inode's i_size because of that (i_size updates are done while holding the
++ * i_mutex, which we are holding here).
++ * We also check to see if the inode has a size not greater than "datal" but has
++ * extents beyond it, due to an fallocate with FALLOC_FL_KEEP_SIZE (and we are
++ * protected against such concurrent fallocate calls by the i_mutex).
++ *
++ * If the file has no extents but a size greater than datal, do not allow the
++ * copy because we would need turn the inline extent into a non-inline one (even
++ * with NO_HOLES enabled). If we find our destination inode only has one inline
++ * extent, just overwrite it with the source inline extent if its size is less
++ * than the source extent's size, or we could copy the source inline extent's
++ * data into the destination inode's inline extent if the later is greater then
++ * the former.
++ */
++static int clone_copy_inline_extent(struct inode *src,
++ struct inode *dst,
++ struct btrfs_trans_handle *trans,
++ struct btrfs_path *path,
++ struct btrfs_key *new_key,
++ const u64 drop_start,
++ const u64 datal,
++ const u64 skip,
++ const u64 size,
++ char *inline_data)
++{
++ struct btrfs_root *root = BTRFS_I(dst)->root;
++ const u64 aligned_end = ALIGN(new_key->offset + datal,
++ root->sectorsize);
++ int ret;
++ struct btrfs_key key;
++
++ if (new_key->offset > 0)
++ return -EOPNOTSUPP;
++
++ key.objectid = btrfs_ino(dst);
++ key.type = BTRFS_EXTENT_DATA_KEY;
++ key.offset = 0;
++ ret = btrfs_search_slot(NULL, root, &key, path, 0, 0);
++ if (ret < 0) {
++ return ret;
++ } else if (ret > 0) {
++ if (path->slots[0] >= btrfs_header_nritems(path->nodes[0])) {
++ ret = btrfs_next_leaf(root, path);
++ if (ret < 0)
++ return ret;
++ else if (ret > 0)
++ goto copy_inline_extent;
++ }
++ btrfs_item_key_to_cpu(path->nodes[0], &key, path->slots[0]);
++ if (key.objectid == btrfs_ino(dst) &&
++ key.type == BTRFS_EXTENT_DATA_KEY) {
++ ASSERT(key.offset > 0);
++ return -EOPNOTSUPP;
++ }
++ } else if (i_size_read(dst) <= datal) {
++ struct btrfs_file_extent_item *ei;
++ u64 ext_len;
++
++ /*
++ * If the file size is <= datal, make sure there are no other
++ * extents following (can happen do to an fallocate call with
++ * the flag FALLOC_FL_KEEP_SIZE).
++ */
++ ei = btrfs_item_ptr(path->nodes[0], path->slots[0],
++ struct btrfs_file_extent_item);
++ /*
++ * If it's an inline extent, it can not have other extents
++ * following it.
++ */
++ if (btrfs_file_extent_type(path->nodes[0], ei) ==
++ BTRFS_FILE_EXTENT_INLINE)
++ goto copy_inline_extent;
++
++ ext_len = btrfs_file_extent_num_bytes(path->nodes[0], ei);
++ if (ext_len > aligned_end)
++ return -EOPNOTSUPP;
++
++ ret = btrfs_next_item(root, path);
++ if (ret < 0) {
++ return ret;
++ } else if (ret == 0) {
++ btrfs_item_key_to_cpu(path->nodes[0], &key,
++ path->slots[0]);
++ if (key.objectid == btrfs_ino(dst) &&
++ key.type == BTRFS_EXTENT_DATA_KEY)
++ return -EOPNOTSUPP;
++ }
++ }
++
++copy_inline_extent:
++ /*
++ * We have no extent items, or we have an extent at offset 0 which may
++ * or may not be inlined. All these cases are dealt the same way.
++ */
++ if (i_size_read(dst) > datal) {
++ /*
++ * If the destination inode has an inline extent...
++ * This would require copying the data from the source inline
++ * extent into the beginning of the destination's inline extent.
++ * But this is really complex, both extents can be compressed
++ * or just one of them, which would require decompressing and
++ * re-compressing data (which could increase the new compressed
++ * size, not allowing the compressed data to fit anymore in an
++ * inline extent).
++ * So just don't support this case for now (it should be rare,
++ * we are not really saving space when cloning inline extents).
++ */
++ return -EOPNOTSUPP;
++ }
++
++ btrfs_release_path(path);
++ ret = btrfs_drop_extents(trans, root, dst, drop_start, aligned_end, 1);
++ if (ret)
++ return ret;
++ ret = btrfs_insert_empty_item(trans, root, path, new_key, size);
++ if (ret)
++ return ret;
++
++ if (skip) {
++ const u32 start = btrfs_file_extent_calc_inline_size(0);
++
++ memmove(inline_data + start, inline_data + start + skip, datal);
++ }
++
++ write_extent_buffer(path->nodes[0], inline_data,
++ btrfs_item_ptr_offset(path->nodes[0],
++ path->slots[0]),
++ size);
++ inode_add_bytes(dst, datal);
++
++ return 0;
++}
++
+ /**
+ * btrfs_clone() - clone a range from inode file to another
+ *
+@@ -3451,7 +3595,6 @@ process_slot:
+ } else if (type == BTRFS_FILE_EXTENT_INLINE) {
+ u64 skip = 0;
+ u64 trim = 0;
+- u64 aligned_end = 0;
+
+ if (off > key.offset) {
+ skip = off - key.offset;
+@@ -3469,42 +3612,22 @@ process_slot:
+ size -= skip + trim;
+ datal -= skip + trim;
+
+- aligned_end = ALIGN(new_key.offset + datal,
+- root->sectorsize);
+- ret = btrfs_drop_extents(trans, root, inode,
+- drop_start,
+- aligned_end,
+- 1);
++ ret = clone_copy_inline_extent(src, inode,
++ trans, path,
++ &new_key,
++ drop_start,
++ datal,
++ skip, size, buf);
+ if (ret) {
+ if (ret != -EOPNOTSUPP)
+ btrfs_abort_transaction(trans,
+- root, ret);
+- btrfs_end_transaction(trans, root);
+- goto out;
+- }
+-
+- ret = btrfs_insert_empty_item(trans, root, path,
+- &new_key, size);
+- if (ret) {
+- btrfs_abort_transaction(trans, root,
+- ret);
++ root,
++ ret);
+ btrfs_end_transaction(trans, root);
+ goto out;
+ }
+-
+- if (skip) {
+- u32 start =
+- btrfs_file_extent_calc_inline_size(0);
+- memmove(buf+start, buf+start+skip,
+- datal);
+- }
+-
+ leaf = path->nodes[0];
+ slot = path->slots[0];
+- write_extent_buffer(leaf, buf,
+- btrfs_item_ptr_offset(leaf, slot),
+- size);
+- inode_add_bytes(inode, datal);
+ }
+
+ /* If we have an implicit hole (NO_HOLES feature). */
+diff --git a/fs/btrfs/xattr.c b/fs/btrfs/xattr.c
+index 01bad724b5f7..fbb0533e977f 100644
+--- a/fs/btrfs/xattr.c
++++ b/fs/btrfs/xattr.c
+@@ -309,8 +309,10 @@ ssize_t btrfs_listxattr(struct dentry *dentry, char *buffer, size_t size)
+ /* check to make sure this item is what we want */
+ if (found_key.objectid != key.objectid)
+ break;
+- if (found_key.type != BTRFS_XATTR_ITEM_KEY)
++ if (found_key.type > BTRFS_XATTR_ITEM_KEY)
+ break;
++ if (found_key.type < BTRFS_XATTR_ITEM_KEY)
++ goto next;
+
+ di = btrfs_item_ptr(leaf, slot, struct btrfs_dir_item);
+ if (verify_dir_item(root, leaf, di))
+diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c
+index a92d3f5c6c12..6f29455c03fe 100644
+--- a/fs/ceph/mds_client.c
++++ b/fs/ceph/mds_client.c
+@@ -1857,7 +1857,7 @@ static struct ceph_msg *create_request_message(struct ceph_mds_client *mdsc,
+
+ len = sizeof(*head) +
+ pathlen1 + pathlen2 + 2*(1 + sizeof(u32) + sizeof(u64)) +
+- sizeof(struct timespec);
++ sizeof(struct ceph_timespec);
+
+ /* calculate (max) length for cap releases */
+ len += sizeof(struct ceph_mds_request_release) *
+diff --git a/fs/ext4/super.c b/fs/ext4/super.c
+index b5a2c29a8db8..b16ba5239dcf 100644
+--- a/fs/ext4/super.c
++++ b/fs/ext4/super.c
+@@ -404,9 +404,13 @@ static void ext4_handle_error(struct super_block *sb)
+ smp_wmb();
+ sb->s_flags |= MS_RDONLY;
+ }
+- if (test_opt(sb, ERRORS_PANIC))
++ if (test_opt(sb, ERRORS_PANIC)) {
++ if (EXT4_SB(sb)->s_journal &&
++ !(EXT4_SB(sb)->s_journal->j_flags & JBD2_REC_ERR))
++ return;
+ panic("EXT4-fs (device %s): panic forced after error\n",
+ sb->s_id);
++ }
+ }
+
+ #define ext4_error_ratelimit(sb) \
+@@ -595,8 +599,12 @@ void __ext4_abort(struct super_block *sb, const char *function,
+ jbd2_journal_abort(EXT4_SB(sb)->s_journal, -EIO);
+ save_error_info(sb, function, line);
+ }
+- if (test_opt(sb, ERRORS_PANIC))
++ if (test_opt(sb, ERRORS_PANIC)) {
++ if (EXT4_SB(sb)->s_journal &&
++ !(EXT4_SB(sb)->s_journal->j_flags & JBD2_REC_ERR))
++ return;
+ panic("EXT4-fs panic from previous error\n");
++ }
+ }
+
+ void __ext4_msg(struct super_block *sb,
+diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c
+index 2540324f084b..07e87ec45709 100644
+--- a/fs/jbd2/journal.c
++++ b/fs/jbd2/journal.c
+@@ -2087,8 +2087,12 @@ static void __journal_abort_soft (journal_t *journal, int errno)
+
+ __jbd2_journal_abort_hard(journal);
+
+- if (errno)
++ if (errno) {
+ jbd2_journal_update_sb_errno(journal);
++ write_lock(&journal->j_state_lock);
++ journal->j_flags |= JBD2_REC_ERR;
++ write_unlock(&journal->j_state_lock);
++ }
+ }
+
+ /**
+diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c
+index 00689a8a85e4..d7cfc6e42b5e 100644
+--- a/fs/nfs/inode.c
++++ b/fs/nfs/inode.c
+@@ -1717,7 +1717,11 @@ static int nfs_update_inode(struct inode *inode, struct nfs_fattr *fattr)
+ nfsi->attrtimeo_timestamp = now;
+ }
+ }
+- invalid &= ~NFS_INO_INVALID_ATTR;
++
++ /* Don't declare attrcache up to date if there were no attrs! */
++ if (fattr->valid != 0)
++ invalid &= ~NFS_INO_INVALID_ATTR;
++
+ /* Don't invalidate the data if we were to blame */
+ if (!(S_ISREG(inode->i_mode) || S_ISDIR(inode->i_mode)
+ || S_ISLNK(inode->i_mode)))
+diff --git a/fs/nfs/nfs4client.c b/fs/nfs/nfs4client.c
+index 368a6b72290c..0e11fe80e5b9 100644
+--- a/fs/nfs/nfs4client.c
++++ b/fs/nfs/nfs4client.c
+@@ -33,7 +33,7 @@ static int nfs_get_cb_ident_idr(struct nfs_client *clp, int minorversion)
+ return ret;
+ idr_preload(GFP_KERNEL);
+ spin_lock(&nn->nfs_client_lock);
+- ret = idr_alloc(&nn->cb_ident_idr, clp, 0, 0, GFP_NOWAIT);
++ ret = idr_alloc(&nn->cb_ident_idr, clp, 1, 0, GFP_NOWAIT);
+ if (ret >= 0)
+ clp->cl_cb_ident = ret;
+ spin_unlock(&nn->nfs_client_lock);
+diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
+index eda99c8ec3ed..b6c3a8792358 100644
+--- a/fs/nfsd/nfs4state.c
++++ b/fs/nfsd/nfs4state.c
+@@ -3241,6 +3241,7 @@ static void init_open_stateid(struct nfs4_ol_stateid *stp, struct nfs4_file *fp,
+ stp->st_access_bmap = 0;
+ stp->st_deny_bmap = 0;
+ stp->st_openstp = NULL;
++ init_rwsem(&stp->st_rwsem);
+ spin_lock(&oo->oo_owner.so_client->cl_lock);
+ list_add(&stp->st_perstateowner, &oo->oo_owner.so_stateids);
+ spin_lock(&fp->fi_lock);
+@@ -4057,21 +4058,27 @@ nfsd4_process_open2(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nf
+ */
+ if (stp) {
+ /* Stateid was found, this is an OPEN upgrade */
++ down_read(&stp->st_rwsem);
+ status = nfs4_upgrade_open(rqstp, fp, current_fh, stp, open);
+- if (status)
++ if (status) {
++ up_read(&stp->st_rwsem);
+ goto out;
++ }
+ } else {
+ stp = open->op_stp;
+ open->op_stp = NULL;
+ init_open_stateid(stp, fp, open);
++ down_read(&stp->st_rwsem);
+ status = nfs4_get_vfs_file(rqstp, fp, current_fh, stp, open);
+ if (status) {
++ up_read(&stp->st_rwsem);
+ release_open_stateid(stp);
+ goto out;
+ }
+ }
+ update_stateid(&stp->st_stid.sc_stateid);
+ memcpy(&open->op_stateid, &stp->st_stid.sc_stateid, sizeof(stateid_t));
++ up_read(&stp->st_rwsem);
+
+ if (nfsd4_has_session(&resp->cstate)) {
+ if (open->op_deleg_want & NFS4_SHARE_WANT_NO_DELEG) {
+@@ -4647,10 +4654,13 @@ static __be32 nfs4_seqid_op_checks(struct nfsd4_compound_state *cstate, stateid_
+ * revoked delegations are kept only for free_stateid.
+ */
+ return nfserr_bad_stateid;
++ down_write(&stp->st_rwsem);
+ status = check_stateid_generation(stateid, &stp->st_stid.sc_stateid, nfsd4_has_session(cstate));
+- if (status)
+- return status;
+- return nfs4_check_fh(current_fh, &stp->st_stid);
++ if (status == nfs_ok)
++ status = nfs4_check_fh(current_fh, &stp->st_stid);
++ if (status != nfs_ok)
++ up_write(&stp->st_rwsem);
++ return status;
+ }
+
+ /*
+@@ -4697,6 +4707,7 @@ static __be32 nfs4_preprocess_confirmed_seqid_op(struct nfsd4_compound_state *cs
+ return status;
+ oo = openowner(stp->st_stateowner);
+ if (!(oo->oo_flags & NFS4_OO_CONFIRMED)) {
++ up_write(&stp->st_rwsem);
+ nfs4_put_stid(&stp->st_stid);
+ return nfserr_bad_stateid;
+ }
+@@ -4727,11 +4738,14 @@ nfsd4_open_confirm(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
+ goto out;
+ oo = openowner(stp->st_stateowner);
+ status = nfserr_bad_stateid;
+- if (oo->oo_flags & NFS4_OO_CONFIRMED)
++ if (oo->oo_flags & NFS4_OO_CONFIRMED) {
++ up_write(&stp->st_rwsem);
+ goto put_stateid;
++ }
+ oo->oo_flags |= NFS4_OO_CONFIRMED;
+ update_stateid(&stp->st_stid.sc_stateid);
+ memcpy(&oc->oc_resp_stateid, &stp->st_stid.sc_stateid, sizeof(stateid_t));
++ up_write(&stp->st_rwsem);
+ dprintk("NFSD: %s: success, seqid=%d stateid=" STATEID_FMT "\n",
+ __func__, oc->oc_seqid, STATEID_VAL(&stp->st_stid.sc_stateid));
+
+@@ -4810,6 +4824,7 @@ nfsd4_open_downgrade(struct svc_rqst *rqstp,
+ memcpy(&od->od_stateid, &stp->st_stid.sc_stateid, sizeof(stateid_t));
+ status = nfs_ok;
+ put_stateid:
++ up_write(&stp->st_rwsem);
+ nfs4_put_stid(&stp->st_stid);
+ out:
+ nfsd4_bump_seqid(cstate, status);
+@@ -4860,6 +4875,7 @@ nfsd4_close(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
+ goto out;
+ update_stateid(&stp->st_stid.sc_stateid);
+ memcpy(&close->cl_stateid, &stp->st_stid.sc_stateid, sizeof(stateid_t));
++ up_write(&stp->st_rwsem);
+
+ nfsd4_close_open_stateid(stp);
+
+@@ -5088,6 +5104,7 @@ init_lock_stateid(struct nfs4_ol_stateid *stp, struct nfs4_lockowner *lo,
+ stp->st_access_bmap = 0;
+ stp->st_deny_bmap = open_stp->st_deny_bmap;
+ stp->st_openstp = open_stp;
++ init_rwsem(&stp->st_rwsem);
+ list_add(&stp->st_locks, &open_stp->st_locks);
+ list_add(&stp->st_perstateowner, &lo->lo_owner.so_stateids);
+ spin_lock(&fp->fi_lock);
+@@ -5256,6 +5273,7 @@ nfsd4_lock(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
+ &open_stp, nn);
+ if (status)
+ goto out;
++ up_write(&open_stp->st_rwsem);
+ open_sop = openowner(open_stp->st_stateowner);
+ status = nfserr_bad_stateid;
+ if (!same_clid(&open_sop->oo_owner.so_client->cl_clientid,
+@@ -5263,6 +5281,8 @@ nfsd4_lock(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
+ goto out;
+ status = lookup_or_create_lock_state(cstate, open_stp, lock,
+ &lock_stp, &new);
++ if (status == nfs_ok)
++ down_write(&lock_stp->st_rwsem);
+ } else {
+ status = nfs4_preprocess_seqid_op(cstate,
+ lock->lk_old_lock_seqid,
+@@ -5368,6 +5388,8 @@ out:
+ seqid_mutating_err(ntohl(status)))
+ lock_sop->lo_owner.so_seqid++;
+
++ up_write(&lock_stp->st_rwsem);
++
+ /*
+ * If this is a new, never-before-used stateid, and we are
+ * returning an error, then just go ahead and release it.
+@@ -5538,6 +5560,7 @@ nfsd4_locku(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
+ fput:
+ fput(filp);
+ put_stateid:
++ up_write(&stp->st_rwsem);
+ nfs4_put_stid(&stp->st_stid);
+ out:
+ nfsd4_bump_seqid(cstate, status);
+diff --git a/fs/nfsd/state.h b/fs/nfsd/state.h
+index 2712042a66b1..3ccb1046a2f9 100644
+--- a/fs/nfsd/state.h
++++ b/fs/nfsd/state.h
+@@ -506,14 +506,15 @@ struct nfs4_file {
+ * Better suggestions welcome.
+ */
+ struct nfs4_ol_stateid {
+- struct nfs4_stid st_stid; /* must be first field */
+- struct list_head st_perfile;
+- struct list_head st_perstateowner;
+- struct list_head st_locks;
+- struct nfs4_stateowner * st_stateowner;
+- unsigned char st_access_bmap;
+- unsigned char st_deny_bmap;
+- struct nfs4_ol_stateid * st_openstp;
++ struct nfs4_stid st_stid;
++ struct list_head st_perfile;
++ struct list_head st_perstateowner;
++ struct list_head st_locks;
++ struct nfs4_stateowner *st_stateowner;
++ unsigned char st_access_bmap;
++ unsigned char st_deny_bmap;
++ struct nfs4_ol_stateid *st_openstp;
++ struct rw_semaphore st_rwsem;
+ };
+
+ static inline struct nfs4_ol_stateid *openlockstateid(struct nfs4_stid *s)
+diff --git a/fs/ocfs2/namei.c b/fs/ocfs2/namei.c
+index 914c121ec890..9fc1daecdfb3 100644
+--- a/fs/ocfs2/namei.c
++++ b/fs/ocfs2/namei.c
+@@ -361,6 +361,8 @@ static int ocfs2_mknod(struct inode *dir,
+ mlog_errno(status);
+ goto leave;
+ }
++ /* update inode->i_mode after mask with "umask". */
++ inode->i_mode = mode;
+
+ handle = ocfs2_start_trans(osb, ocfs2_mknod_credits(osb->sb,
+ S_ISDIR(mode),
+diff --git a/include/linux/jbd2.h b/include/linux/jbd2.h
+index 4caf8acfef11..c035001df223 100644
+--- a/include/linux/jbd2.h
++++ b/include/linux/jbd2.h
+@@ -1007,6 +1007,7 @@ struct journal_s
+ #define JBD2_ABORT_ON_SYNCDATA_ERR 0x040 /* Abort the journal on file
+ * data write error in ordered
+ * mode */
++#define JBD2_REC_ERR 0x080 /* The errno in the sb has been recorded */
+
+ /*
+ * Function declarations for the journaling transaction and buffer
+diff --git a/include/linux/usb/quirks.h b/include/linux/usb/quirks.h
+index 9948c874e3f1..1d0043dc34e4 100644
+--- a/include/linux/usb/quirks.h
++++ b/include/linux/usb/quirks.h
+@@ -47,4 +47,7 @@
+ /* device generates spurious wakeup, ignore remote wakeup capability */
+ #define USB_QUIRK_IGNORE_REMOTE_WAKEUP BIT(9)
+
++/* device can't handle Link Power Management */
++#define USB_QUIRK_NO_LPM BIT(10)
++
+ #endif /* __LINUX_USB_QUIRKS_H */
+diff --git a/include/net/af_unix.h b/include/net/af_unix.h
+index dfe4ddfbb43c..e830c3dff61a 100644
+--- a/include/net/af_unix.h
++++ b/include/net/af_unix.h
+@@ -63,6 +63,7 @@ struct unix_sock {
+ #define UNIX_GC_CANDIDATE 0
+ #define UNIX_GC_MAYBE_CYCLE 1
+ struct socket_wq peer_wq;
++ wait_queue_t peer_wake;
+ };
+
+ static inline struct unix_sock *unix_sk(struct sock *sk)
+diff --git a/include/net/dst.h b/include/net/dst.h
+index 0fb99a26e973..182b812d45e1 100644
+--- a/include/net/dst.h
++++ b/include/net/dst.h
+@@ -312,6 +312,39 @@ static inline void skb_dst_force(struct sk_buff *skb)
+ }
+ }
+
++/**
++ * dst_hold_safe - Take a reference on a dst if possible
++ * @dst: pointer to dst entry
++ *
++ * This helper returns false if it could not safely
++ * take a reference on a dst.
++ */
++static inline bool dst_hold_safe(struct dst_entry *dst)
++{
++ if (dst->flags & DST_NOCACHE)
++ return atomic_inc_not_zero(&dst->__refcnt);
++ dst_hold(dst);
++ return true;
++}
++
++/**
++ * skb_dst_force_safe - makes sure skb dst is refcounted
++ * @skb: buffer
++ *
++ * If dst is not yet refcounted and not destroyed, grab a ref on it.
++ */
++static inline void skb_dst_force_safe(struct sk_buff *skb)
++{
++ if (skb_dst_is_noref(skb)) {
++ struct dst_entry *dst = skb_dst(skb);
++
++ if (!dst_hold_safe(dst))
++ dst = NULL;
++
++ skb->_skb_refdst = (unsigned long)dst;
++ }
++}
++
+
+ /**
+ * __skb_tunnel_rx - prepare skb for rx reinsert
+diff --git a/include/net/sock.h b/include/net/sock.h
+index a098ce3cd242..a40bc8c0af4b 100644
+--- a/include/net/sock.h
++++ b/include/net/sock.h
+@@ -379,6 +379,7 @@ struct sock {
+ sk_no_check_rx : 1,
+ sk_userlocks : 4,
+ sk_protocol : 8,
++#define SK_PROTOCOL_MAX U8_MAX
+ sk_type : 16;
+ kmemcheck_bitfield_end(flags);
+ int sk_wmem_queued;
+@@ -715,6 +716,8 @@ enum sock_flags {
+ SOCK_SELECT_ERR_QUEUE, /* Wake select on error queue */
+ };
+
++#define SK_FLAGS_TIMESTAMP ((1UL << SOCK_TIMESTAMP) | (1UL << SOCK_TIMESTAMPING_RX_SOFTWARE))
++
+ static inline void sock_copy_flags(struct sock *nsk, struct sock *osk)
+ {
+ nsk->sk_flags = osk->sk_flags;
+@@ -789,7 +792,7 @@ void sk_stream_write_space(struct sock *sk);
+ static inline void __sk_add_backlog(struct sock *sk, struct sk_buff *skb)
+ {
+ /* dont let skb dst not refcounted, we are going to leave rcu lock */
+- skb_dst_force(skb);
++ skb_dst_force_safe(skb);
+
+ if (!sk->sk_backlog.tail)
+ sk->sk_backlog.head = skb;
+diff --git a/kernel/workqueue.c b/kernel/workqueue.c
+index bd3c41d4ec07..2273f534b01a 100644
+--- a/kernel/workqueue.c
++++ b/kernel/workqueue.c
+@@ -1442,13 +1442,13 @@ static void __queue_delayed_work(int cpu, struct workqueue_struct *wq,
+ timer_stats_timer_set_start_info(&dwork->timer);
+
+ dwork->wq = wq;
+- /* timer isn't guaranteed to run in this cpu, record earlier */
+- if (cpu == WORK_CPU_UNBOUND)
+- cpu = raw_smp_processor_id();
+ dwork->cpu = cpu;
+ timer->expires = jiffies + delay;
+
+- add_timer_on(timer, cpu);
++ if (unlikely(cpu != WORK_CPU_UNBOUND))
++ add_timer_on(timer, cpu);
++ else
++ add_timer(timer);
+ }
+
+ /**
+diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c
+index c35c3f48fc0f..1428c3ff3341 100644
+--- a/net/ax25/af_ax25.c
++++ b/net/ax25/af_ax25.c
+@@ -806,6 +806,9 @@ static int ax25_create(struct net *net, struct socket *sock, int protocol,
+ struct sock *sk;
+ ax25_cb *ax25;
+
++ if (protocol < 0 || protocol > SK_PROTOCOL_MAX)
++ return -EINVAL;
++
+ if (!net_eq(net, &init_net))
+ return -EAFNOSUPPORT;
+
+diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
+index 7ee9e4ab00f8..b3ef78a644ed 100644
+--- a/net/bluetooth/sco.c
++++ b/net/bluetooth/sco.c
+@@ -520,6 +520,9 @@ static int sco_sock_bind(struct socket *sock, struct sockaddr *addr, int addr_le
+ if (!addr || addr->sa_family != AF_BLUETOOTH)
+ return -EINVAL;
+
++ if (addr_len < sizeof(struct sockaddr_sco))
++ return -EINVAL;
++
+ lock_sock(sk);
+
+ if (sk->sk_state != BT_OPEN) {
+diff --git a/net/core/skbuff.c b/net/core/skbuff.c
+index ea0bcc4a9657..b2921c0d5608 100644
+--- a/net/core/skbuff.c
++++ b/net/core/skbuff.c
+@@ -3599,7 +3599,8 @@ static void __skb_complete_tx_timestamp(struct sk_buff *skb,
+ serr->ee.ee_info = tstype;
+ if (sk->sk_tsflags & SOF_TIMESTAMPING_OPT_ID) {
+ serr->ee.ee_data = skb_shinfo(skb)->tskey;
+- if (sk->sk_protocol == IPPROTO_TCP)
++ if (sk->sk_protocol == IPPROTO_TCP &&
++ sk->sk_type == SOCK_STREAM)
+ serr->ee.ee_data -= sk->sk_tskey;
+ }
+
+@@ -4108,7 +4109,8 @@ static struct sk_buff *skb_reorder_vlan_header(struct sk_buff *skb)
+ return NULL;
+ }
+
+- memmove(skb->data - ETH_HLEN, skb->data - VLAN_ETH_HLEN, 2 * ETH_ALEN);
++ memmove(skb->data - ETH_HLEN, skb->data - skb->mac_len - VLAN_HLEN,
++ 2 * ETH_ALEN);
+ skb->mac_header += VLAN_HLEN;
+ return skb;
+ }
+diff --git a/net/core/sock.c b/net/core/sock.c
+index 1e5130de31b6..b1a6ff0a9041 100644
+--- a/net/core/sock.c
++++ b/net/core/sock.c
+@@ -422,8 +422,6 @@ static void sock_warn_obsolete_bsdism(const char *name)
+ }
+ }
+
+-#define SK_FLAGS_TIMESTAMP ((1UL << SOCK_TIMESTAMP) | (1UL << SOCK_TIMESTAMPING_RX_SOFTWARE))
+-
+ static void sock_disable_timestamp(struct sock *sk, unsigned long flags)
+ {
+ if (sk->sk_flags & flags) {
+@@ -861,7 +859,8 @@ set_rcvbuf:
+ }
+ if (val & SOF_TIMESTAMPING_OPT_ID &&
+ !(sk->sk_tsflags & SOF_TIMESTAMPING_OPT_ID)) {
+- if (sk->sk_protocol == IPPROTO_TCP) {
++ if (sk->sk_protocol == IPPROTO_TCP &&
++ sk->sk_type == SOCK_STREAM) {
+ if (sk->sk_state != TCP_ESTABLISHED) {
+ ret = -EINVAL;
+ break;
+diff --git a/net/decnet/af_decnet.c b/net/decnet/af_decnet.c
+index 25733d538147..2aeeb4f22e9d 100644
+--- a/net/decnet/af_decnet.c
++++ b/net/decnet/af_decnet.c
+@@ -678,6 +678,9 @@ static int dn_create(struct net *net, struct socket *sock, int protocol,
+ {
+ struct sock *sk;
+
++ if (protocol < 0 || protocol > SK_PROTOCOL_MAX)
++ return -EINVAL;
++
+ if (!net_eq(net, &init_net))
+ return -EAFNOSUPPORT;
+
+diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
+index 9a173577a790..6cf020ea4f46 100644
+--- a/net/ipv4/af_inet.c
++++ b/net/ipv4/af_inet.c
+@@ -259,6 +259,9 @@ static int inet_create(struct net *net, struct socket *sock, int protocol,
+ int try_loading_module = 0;
+ int err;
+
++ if (protocol < 0 || protocol >= IPPROTO_MAX)
++ return -EINVAL;
++
+ sock->state = SS_UNCONNECTED;
+
+ /* Look for the requested type/protocol pair. */
+diff --git a/net/ipv4/fou.c b/net/ipv4/fou.c
+index 606c520ffd5a..8ce8e82d1abb 100644
+--- a/net/ipv4/fou.c
++++ b/net/ipv4/fou.c
+@@ -25,6 +25,7 @@ struct fou {
+ u16 port;
+ struct udp_offload udp_offloads;
+ struct list_head list;
++ struct rcu_head rcu;
+ };
+
+ struct fou_cfg {
+@@ -287,7 +288,7 @@ static void fou_release(struct fou *fou)
+
+ sock_release(sock);
+
+- kfree(fou);
++ kfree_rcu(fou, rcu);
+ }
+
+ static int fou_encap_init(struct sock *sk, struct fou *fou, struct fou_cfg *cfg)
+diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
+index 6cd9f696d9c6..5d5390299277 100644
+--- a/net/ipv4/tcp_ipv4.c
++++ b/net/ipv4/tcp_ipv4.c
+@@ -1553,7 +1553,7 @@ bool tcp_prequeue(struct sock *sk, struct sk_buff *skb)
+ if (likely(sk->sk_rx_dst))
+ skb_dst_drop(skb);
+ else
+- skb_dst_force(skb);
++ skb_dst_force_safe(skb);
+
+ __skb_queue_tail(&tp->ucopy.prequeue, skb);
+ tp->ucopy.memory += skb->truesize;
+@@ -1758,8 +1758,7 @@ void inet_sk_rx_dst_set(struct sock *sk, const struct sk_buff *skb)
+ {
+ struct dst_entry *dst = skb_dst(skb);
+
+- if (dst) {
+- dst_hold(dst);
++ if (dst && dst_hold_safe(dst)) {
+ sk->sk_rx_dst = dst;
+ inet_sk(sk)->rx_dst_ifindex = skb->skb_iif;
+ }
+diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
+index 05417c330f4e..ad95905e7a70 100644
+--- a/net/ipv6/af_inet6.c
++++ b/net/ipv6/af_inet6.c
+@@ -109,6 +109,9 @@ static int inet6_create(struct net *net, struct socket *sock, int protocol,
+ int try_loading_module = 0;
+ int err;
+
++ if (protocol < 0 || protocol >= IPPROTO_MAX)
++ return -EINVAL;
++
+ /* Look for the requested type/protocol pair. */
+ lookup_protocol:
+ err = -ESOCKTNOSUPPORT;
+diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
+index 28d7a245ea34..25cd22c1ddee 100644
+--- a/net/ipv6/ip6_gre.c
++++ b/net/ipv6/ip6_gre.c
+@@ -1563,13 +1563,11 @@ static int ip6gre_changelink(struct net_device *dev, struct nlattr *tb[],
+ return -EEXIST;
+ } else {
+ t = nt;
+-
+- ip6gre_tunnel_unlink(ign, t);
+- ip6gre_tnl_change(t, &p, !tb[IFLA_MTU]);
+- ip6gre_tunnel_link(ign, t);
+- netdev_state_change(dev);
+ }
+
++ ip6gre_tunnel_unlink(ign, t);
++ ip6gre_tnl_change(t, &p, !tb[IFLA_MTU]);
++ ip6gre_tunnel_link(ign, t);
+ return 0;
+ }
+
+diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
+index 26feadd0b763..b5a4ac8ce4b1 100644
+--- a/net/ipv6/tcp_ipv6.c
++++ b/net/ipv6/tcp_ipv6.c
+@@ -93,10 +93,9 @@ static void inet6_sk_rx_dst_set(struct sock *sk, const struct sk_buff *skb)
+ {
+ struct dst_entry *dst = skb_dst(skb);
+
+- if (dst) {
++ if (dst && dst_hold_safe(dst)) {
+ const struct rt6_info *rt = (const struct rt6_info *)dst;
+
+- dst_hold(dst);
+ sk->sk_rx_dst = dst;
+ inet_sk(sk)->rx_dst_ifindex = skb->skb_iif;
+ if (rt->rt6i_node)
+diff --git a/net/irda/af_irda.c b/net/irda/af_irda.c
+index 3f3a6cbdceb7..b3f6ec0df426 100644
+--- a/net/irda/af_irda.c
++++ b/net/irda/af_irda.c
+@@ -1100,6 +1100,9 @@ static int irda_create(struct net *net, struct socket *sock, int protocol,
+
+ IRDA_DEBUG(2, "%s()\n", __func__);
+
++ if (protocol < 0 || protocol > SK_PROTOCOL_MAX)
++ return -EINVAL;
++
+ if (net != &init_net)
+ return -EAFNOSUPPORT;
+
+diff --git a/net/rds/send.c b/net/rds/send.c
+index 0a64541020b0..0bae8d43b012 100644
+--- a/net/rds/send.c
++++ b/net/rds/send.c
+@@ -958,11 +958,13 @@ int rds_sendmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg,
+ release_sock(sk);
+ }
+
+- /* racing with another thread binding seems ok here */
++ lock_sock(sk);
+ if (daddr == 0 || rs->rs_bound_addr == 0) {
++ release_sock(sk);
+ ret = -ENOTCONN; /* XXX not a great errno */
+ goto out;
+ }
++ release_sock(sk);
+
+ /* size of rm including all sgs */
+ ret = rds_rm_size(msg, payload_len);
+diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
+index 0e4198ee2370..3267a5cbb3e8 100644
+--- a/net/sctp/ipv6.c
++++ b/net/sctp/ipv6.c
+@@ -634,6 +634,7 @@ static struct sock *sctp_v6_create_accept_sk(struct sock *sk,
+ struct sock *newsk;
+ struct ipv6_pinfo *newnp, *np = inet6_sk(sk);
+ struct sctp6_sock *newsctp6sk;
++ struct ipv6_txoptions *opt;
+
+ newsk = sk_alloc(sock_net(sk), PF_INET6, GFP_KERNEL, sk->sk_prot);
+ if (!newsk)
+@@ -653,6 +654,13 @@ static struct sock *sctp_v6_create_accept_sk(struct sock *sk,
+
+ memcpy(newnp, np, sizeof(struct ipv6_pinfo));
+
++ rcu_read_lock();
++ opt = rcu_dereference(np->opt);
++ if (opt)
++ opt = ipv6_dup_options(newsk, opt);
++ RCU_INIT_POINTER(newnp->opt, opt);
++ rcu_read_unlock();
++
+ /* Initialize sk's sport, dport, rcv_saddr and daddr for getsockname()
+ * and getpeername().
+ */
+diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
+index 371a152d9759..642c11570285 100644
+--- a/net/sctp/sm_make_chunk.c
++++ b/net/sctp/sm_make_chunk.c
+@@ -1652,7 +1652,7 @@ static sctp_cookie_param_t *sctp_pack_cookie(const struct sctp_endpoint *ep,
+
+ /* Set an expiration time for the cookie. */
+ cookie->c.expiration = ktime_add(asoc->cookie_life,
+- ktime_get());
++ ktime_get_real());
+
+ /* Copy the peer's init packet. */
+ memcpy(&cookie->c.peer_init[0], init_chunk->chunk_hdr,
+@@ -1780,7 +1780,7 @@ no_hmac:
+ if (sock_flag(ep->base.sk, SOCK_TIMESTAMP))
+ kt = skb_get_ktime(skb);
+ else
+- kt = ktime_get();
++ kt = ktime_get_real();
+
+ if (!asoc && ktime_before(bear_cookie->expiration, kt)) {
+ /*
+diff --git a/net/sctp/socket.c b/net/sctp/socket.c
+index fb082aa4d656..4130c1b87dd6 100644
+--- a/net/sctp/socket.c
++++ b/net/sctp/socket.c
+@@ -7181,6 +7181,7 @@ void sctp_copy_sock(struct sock *newsk, struct sock *sk,
+ newsk->sk_type = sk->sk_type;
+ newsk->sk_bound_dev_if = sk->sk_bound_dev_if;
+ newsk->sk_flags = sk->sk_flags;
++ newsk->sk_tsflags = sk->sk_tsflags;
+ newsk->sk_no_check_tx = sk->sk_no_check_tx;
+ newsk->sk_no_check_rx = sk->sk_no_check_rx;
+ newsk->sk_reuse = sk->sk_reuse;
+@@ -7213,6 +7214,9 @@ void sctp_copy_sock(struct sock *newsk, struct sock *sk,
+ newinet->mc_ttl = 1;
+ newinet->mc_index = 0;
+ newinet->mc_list = NULL;
++
++ if (newsk->sk_flags & SK_FLAGS_TIMESTAMP)
++ net_enable_timestamp();
+ }
+
+ static inline void sctp_copy_descendant(struct sock *sk_to,
+diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
+index 2ae4a5915aa7..7229794c1419 100644
+--- a/net/unix/af_unix.c
++++ b/net/unix/af_unix.c
+@@ -316,6 +316,118 @@ found:
+ return s;
+ }
+
++/* Support code for asymmetrically connected dgram sockets
++ *
++ * If a datagram socket is connected to a socket not itself connected
++ * to the first socket (eg, /dev/log), clients may only enqueue more
++ * messages if the present receive queue of the server socket is not
++ * "too large". This means there's a second writeability condition
++ * poll and sendmsg need to test. The dgram recv code will do a wake
++ * up on the peer_wait wait queue of a socket upon reception of a
++ * datagram which needs to be propagated to sleeping would-be writers
++ * since these might not have sent anything so far. This can't be
++ * accomplished via poll_wait because the lifetime of the server
++ * socket might be less than that of its clients if these break their
++ * association with it or if the server socket is closed while clients
++ * are still connected to it and there's no way to inform "a polling
++ * implementation" that it should let go of a certain wait queue
++ *
++ * In order to propagate a wake up, a wait_queue_t of the client
++ * socket is enqueued on the peer_wait queue of the server socket
++ * whose wake function does a wake_up on the ordinary client socket
++ * wait queue. This connection is established whenever a write (or
++ * poll for write) hit the flow control condition and broken when the
++ * association to the server socket is dissolved or after a wake up
++ * was relayed.
++ */
++
++static int unix_dgram_peer_wake_relay(wait_queue_t *q, unsigned mode, int flags,
++ void *key)
++{
++ struct unix_sock *u;
++ wait_queue_head_t *u_sleep;
++
++ u = container_of(q, struct unix_sock, peer_wake);
++
++ __remove_wait_queue(&unix_sk(u->peer_wake.private)->peer_wait,
++ q);
++ u->peer_wake.private = NULL;
++
++ /* relaying can only happen while the wq still exists */
++ u_sleep = sk_sleep(&u->sk);
++ if (u_sleep)
++ wake_up_interruptible_poll(u_sleep, key);
++
++ return 0;
++}
++
++static int unix_dgram_peer_wake_connect(struct sock *sk, struct sock *other)
++{
++ struct unix_sock *u, *u_other;
++ int rc;
++
++ u = unix_sk(sk);
++ u_other = unix_sk(other);
++ rc = 0;
++ spin_lock(&u_other->peer_wait.lock);
++
++ if (!u->peer_wake.private) {
++ u->peer_wake.private = other;
++ __add_wait_queue(&u_other->peer_wait, &u->peer_wake);
++
++ rc = 1;
++ }
++
++ spin_unlock(&u_other->peer_wait.lock);
++ return rc;
++}
++
++static void unix_dgram_peer_wake_disconnect(struct sock *sk,
++ struct sock *other)
++{
++ struct unix_sock *u, *u_other;
++
++ u = unix_sk(sk);
++ u_other = unix_sk(other);
++ spin_lock(&u_other->peer_wait.lock);
++
++ if (u->peer_wake.private == other) {
++ __remove_wait_queue(&u_other->peer_wait, &u->peer_wake);
++ u->peer_wake.private = NULL;
++ }
++
++ spin_unlock(&u_other->peer_wait.lock);
++}
++
++static void unix_dgram_peer_wake_disconnect_wakeup(struct sock *sk,
++ struct sock *other)
++{
++ unix_dgram_peer_wake_disconnect(sk, other);
++ wake_up_interruptible_poll(sk_sleep(sk),
++ POLLOUT |
++ POLLWRNORM |
++ POLLWRBAND);
++}
++
++/* preconditions:
++ * - unix_peer(sk) == other
++ * - association is stable
++ */
++static int unix_dgram_peer_wake_me(struct sock *sk, struct sock *other)
++{
++ int connected;
++
++ connected = unix_dgram_peer_wake_connect(sk, other);
++
++ if (unix_recvq_full(other))
++ return 1;
++
++ if (connected)
++ unix_dgram_peer_wake_disconnect(sk, other);
++
++ return 0;
++}
++
+ static inline int unix_writable(struct sock *sk)
+ {
+ return (atomic_read(&sk->sk_wmem_alloc) << 2) <= sk->sk_sndbuf;
+@@ -420,6 +532,8 @@ static void unix_release_sock(struct sock *sk, int embrion)
+ skpair->sk_state_change(skpair);
+ sk_wake_async(skpair, SOCK_WAKE_WAITD, POLL_HUP);
+ }
++
++ unix_dgram_peer_wake_disconnect(sk, skpair);
+ sock_put(skpair); /* It may now die */
+ unix_peer(sk) = NULL;
+ }
+@@ -653,6 +767,7 @@ static struct sock *unix_create1(struct net *net, struct socket *sock)
+ INIT_LIST_HEAD(&u->link);
+ mutex_init(&u->readlock); /* single task reading lock */
+ init_waitqueue_head(&u->peer_wait);
++ init_waitqueue_func_entry(&u->peer_wake, unix_dgram_peer_wake_relay);
+ unix_insert_socket(unix_sockets_unbound(sk), sk);
+ out:
+ if (sk == NULL)
+@@ -1020,6 +1135,8 @@ restart:
+ if (unix_peer(sk)) {
+ struct sock *old_peer = unix_peer(sk);
+ unix_peer(sk) = other;
++ unix_dgram_peer_wake_disconnect_wakeup(sk, old_peer);
++
+ unix_state_double_unlock(sk, other);
+
+ if (other != old_peer)
+@@ -1459,6 +1576,7 @@ static int unix_dgram_sendmsg(struct kiocb *kiocb, struct socket *sock,
+ struct scm_cookie tmp_scm;
+ int max_level;
+ int data_len = 0;
++ int sk_locked;
+
+ if (NULL == siocb->scm)
+ siocb->scm = &tmp_scm;
+@@ -1540,12 +1658,14 @@ restart:
+ goto out_free;
+ }
+
++ sk_locked = 0;
+ unix_state_lock(other);
++restart_locked:
+ err = -EPERM;
+ if (!unix_may_send(sk, other))
+ goto out_unlock;
+
+- if (sock_flag(other, SOCK_DEAD)) {
++ if (unlikely(sock_flag(other, SOCK_DEAD))) {
+ /*
+ * Check with 1003.1g - what should
+ * datagram error
+@@ -1553,10 +1673,14 @@ restart:
+ unix_state_unlock(other);
+ sock_put(other);
+
++ if (!sk_locked)
++ unix_state_lock(sk);
++
+ err = 0;
+- unix_state_lock(sk);
+ if (unix_peer(sk) == other) {
+ unix_peer(sk) = NULL;
++ unix_dgram_peer_wake_disconnect_wakeup(sk, other);
++
+ unix_state_unlock(sk);
+
+ unix_dgram_disconnected(sk, other);
+@@ -1582,21 +1706,38 @@ restart:
+ goto out_unlock;
+ }
+
+- if (unix_peer(other) != sk && unix_recvq_full(other)) {
+- if (!timeo) {
+- err = -EAGAIN;
+- goto out_unlock;
++ if (unlikely(unix_peer(other) != sk && unix_recvq_full(other))) {
++ if (timeo) {
++ timeo = unix_wait_for_peer(other, timeo);
++
++ err = sock_intr_errno(timeo);
++ if (signal_pending(current))
++ goto out_free;
++
++ goto restart;
+ }
+
+- timeo = unix_wait_for_peer(other, timeo);
++ if (!sk_locked) {
++ unix_state_unlock(other);
++ unix_state_double_lock(sk, other);
++ }
+
+- err = sock_intr_errno(timeo);
+- if (signal_pending(current))
+- goto out_free;
++ if (unix_peer(sk) != other ||
++ unix_dgram_peer_wake_me(sk, other)) {
++ err = -EAGAIN;
++ sk_locked = 1;
++ goto out_unlock;
++ }
+
+- goto restart;
++ if (!sk_locked) {
++ sk_locked = 1;
++ goto restart_locked;
++ }
+ }
+
++ if (unlikely(sk_locked))
++ unix_state_unlock(sk);
++
+ if (sock_flag(other, SOCK_RCVTSTAMP))
+ __net_timestamp(skb);
+ maybe_add_creds(skb, sock, other);
+@@ -1610,6 +1751,8 @@ restart:
+ return len;
+
+ out_unlock:
++ if (sk_locked)
++ unix_state_unlock(sk);
+ unix_state_unlock(other);
+ out_free:
+ kfree_skb(skb);
+@@ -1953,14 +2096,7 @@ static int unix_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
+ memset(&tmp_scm, 0, sizeof(tmp_scm));
+ }
+
+- err = mutex_lock_interruptible(&u->readlock);
+- if (unlikely(err)) {
+- /* recvmsg() in non blocking mode is supposed to return -EAGAIN
+- * sk_rcvtimeo is not honored by mutex_lock_interruptible()
+- */
+- err = noblock ? -EAGAIN : -ERESTARTSYS;
+- goto out;
+- }
++ mutex_lock(&u->readlock);
+
+ if (flags & MSG_PEEK)
+ skip = sk_peek_offset(sk, flags);
+@@ -2001,12 +2137,12 @@ again:
+
+ timeo = unix_stream_data_wait(sk, timeo, last);
+
+- if (signal_pending(current)
+- || mutex_lock_interruptible(&u->readlock)) {
++ if (signal_pending(current)) {
+ err = sock_intr_errno(timeo);
+ goto out;
+ }
+
++ mutex_lock(&u->readlock);
+ continue;
+ unlock:
+ unix_state_unlock(sk);
+@@ -2269,14 +2405,16 @@ static unsigned int unix_dgram_poll(struct file *file, struct socket *sock,
+ return mask;
+
+ writable = unix_writable(sk);
+- other = unix_peer_get(sk);
+- if (other) {
+- if (unix_peer(other) != sk) {
+- sock_poll_wait(file, &unix_sk(other)->peer_wait, wait);
+- if (unix_recvq_full(other))
+- writable = 0;
+- }
+- sock_put(other);
++ if (writable) {
++ unix_state_lock(sk);
++
++ other = unix_peer(sk);
++ if (other && unix_peer(other) != sk &&
++ unix_recvq_full(other) &&
++ unix_dgram_peer_wake_me(sk, other))
++ writable = 0;
++
++ unix_state_unlock(sk);
+ }
+
+ if (writable)
+diff --git a/security/keys/keyctl.c b/security/keys/keyctl.c
+index 4743d71e4aa6..fee27fe2b30f 100644
+--- a/security/keys/keyctl.c
++++ b/security/keys/keyctl.c
+@@ -757,16 +757,16 @@ long keyctl_read_key(key_serial_t keyid, char __user *buffer, size_t buflen)
+
+ /* the key is probably readable - now try to read it */
+ can_read_key:
+- ret = key_validate(key);
+- if (ret == 0) {
+- ret = -EOPNOTSUPP;
+- if (key->type->read) {
+- /* read the data with the semaphore held (since we
+- * might sleep) */
+- down_read(&key->sem);
++ ret = -EOPNOTSUPP;
++ if (key->type->read) {
++ /* Read the data with the semaphore held (since we might sleep)
++ * to protect against the key being updated or revoked.
++ */
++ down_read(&key->sem);
++ ret = key_validate(key);
++ if (ret == 0)
+ ret = key->type->read(key, buffer, buflen);
+- up_read(&key->sem);
+- }
++ up_read(&key->sem);
+ }
+
+ error2:
+diff --git a/security/keys/process_keys.c b/security/keys/process_keys.c
+index bd536cb221e2..db91639c81e3 100644
+--- a/security/keys/process_keys.c
++++ b/security/keys/process_keys.c
+@@ -794,6 +794,7 @@ long join_session_keyring(const char *name)
+ ret = PTR_ERR(keyring);
+ goto error2;
+ } else if (keyring == new->session_keyring) {
++ key_put(keyring);
+ ret = 0;
+ goto error2;
+ }
+diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
+index b422e406a9cb..99e952293498 100644
+--- a/sound/pci/hda/patch_hdmi.c
++++ b/sound/pci/hda/patch_hdmi.c
+@@ -48,8 +48,9 @@ MODULE_PARM_DESC(static_hdmi_pcm, "Don't restrict PCM parameters per ELD info");
+ #define is_haswell(codec) ((codec)->vendor_id == 0x80862807)
+ #define is_broadwell(codec) ((codec)->vendor_id == 0x80862808)
+ #define is_skylake(codec) ((codec)->vendor_id == 0x80862809)
++#define is_broxton(codec) ((codec)->vendor_id == 0x8086280a)
+ #define is_haswell_plus(codec) (is_haswell(codec) || is_broadwell(codec) \
+- || is_skylake(codec))
++ || is_skylake(codec) || is_broxton(codec))
+
+ #define is_valleyview(codec) ((codec)->vendor_id == 0x80862882)
+ #define is_cherryview(codec) ((codec)->vendor_id == 0x80862883)
diff --git a/1520_keyring-refleak-in-join-session-CVE-2016-0728.patch b/1520_keyring-refleak-in-join-session-CVE-2016-0728.patch
deleted file mode 100644
index 49020d7..0000000
--- a/1520_keyring-refleak-in-join-session-CVE-2016-0728.patch
+++ /dev/null
@@ -1,81 +0,0 @@
-From 23567fd052a9abb6d67fe8e7a9ccdd9800a540f2 Mon Sep 17 00:00:00 2001
-From: Yevgeny Pats <yevgeny@perception-point.io>
-Date: Tue, 19 Jan 2016 22:09:04 +0000
-Subject: KEYS: Fix keyring ref leak in join_session_keyring()
-
-This fixes CVE-2016-0728.
-
-If a thread is asked to join as a session keyring the keyring that's already
-set as its session, we leak a keyring reference.
-
-This can be tested with the following program:
-
- #include <stddef.h>
- #include <stdio.h>
- #include <sys/types.h>
- #include <keyutils.h>
-
- int main(int argc, const char *argv[])
- {
- int i = 0;
- key_serial_t serial;
-
- serial = keyctl(KEYCTL_JOIN_SESSION_KEYRING,
- "leaked-keyring");
- if (serial < 0) {
- perror("keyctl");
- return -1;
- }
-
- if (keyctl(KEYCTL_SETPERM, serial,
- KEY_POS_ALL | KEY_USR_ALL) < 0) {
- perror("keyctl");
- return -1;
- }
-
- for (i = 0; i < 100; i++) {
- serial = keyctl(KEYCTL_JOIN_SESSION_KEYRING,
- "leaked-keyring");
- if (serial < 0) {
- perror("keyctl");
- return -1;
- }
- }
-
- return 0;
- }
-
-If, after the program has run, there something like the following line in
-/proc/keys:
-
-3f3d898f I--Q--- 100 perm 3f3f0000 0 0 keyring leaked-keyring: empty
-
-with a usage count of 100 * the number of times the program has been run,
-then the kernel is malfunctioning. If leaked-keyring has zero usages or
-has been garbage collected, then the problem is fixed.
-
-Reported-by: Yevgeny Pats <yevgeny@perception-point.io>
-Signed-off-by: David Howells <dhowells@redhat.com>
-Acked-by: Don Zickus <dzickus@redhat.com>
-Acked-by: Prarit Bhargava <prarit@redhat.com>
-Acked-by: Jarod Wilson <jarod@redhat.com>
-Signed-off-by: James Morris <james.l.morris@oracle.com>
----
- security/keys/process_keys.c | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/security/keys/process_keys.c b/security/keys/process_keys.c
-index a3f85d2..e6d50172 100644
---- a/security/keys/process_keys.c
-+++ b/security/keys/process_keys.c
-@@ -794,6 +794,7 @@ long join_session_keyring(const char *name)
- ret = PTR_ERR(keyring);
- goto error2;
- } else if (keyring == new->session_keyring) {
-+ key_put(keyring);
- ret = 0;
- goto error2;
- }
---
-cgit v0.12
-
^ permalink raw reply related [flat|nested] 67+ messages in thread
* [gentoo-commits] proj/linux-patches:3.18 commit in: /
@ 2016-02-16 16:34 Mike Pagano
0 siblings, 0 replies; 67+ messages in thread
From: Mike Pagano @ 2016-02-16 16:34 UTC (permalink / raw
To: gentoo-commits
commit: 5af3185a936bdd0650b008b832b60067205a9e0d
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Tue Feb 16 16:27:10 2016 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Tue Feb 16 16:27:10 2016 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=5af3185a
Linux patch 3.18.27
0000_README | 4 +
1026_linux-3.18.27.patch | 8909 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 8913 insertions(+)
diff --git a/0000_README b/0000_README
index 728c863..0da11e3 100644
--- a/0000_README
+++ b/0000_README
@@ -147,6 +147,10 @@ Patch: 1025_linux-3.18.26.patch
From: http://www.kernel.org
Desc: Linux 3.18.26
+Patch: 1026_linux-3.18.27.patch
+From: http://www.kernel.org
+Desc: Linux 3.18.27
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1026_linux-3.18.27.patch b/1026_linux-3.18.27.patch
new file mode 100644
index 0000000..79d16a4
--- /dev/null
+++ b/1026_linux-3.18.27.patch
@@ -0,0 +1,8909 @@
+diff --git a/Makefile b/Makefile
+index 03b0c3fb5bfd..2393cc5e0229 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 18
+-SUBLEVEL = 26
++SUBLEVEL = 27
+ EXTRAVERSION =
+ NAME = Diseased Newt
+
+diff --git a/arch/arm/boot/dts/sama5d4.dtsi b/arch/arm/boot/dts/sama5d4.dtsi
+index e0157b0f075c..0837c1afd666 100644
+--- a/arch/arm/boot/dts/sama5d4.dtsi
++++ b/arch/arm/boot/dts/sama5d4.dtsi
+@@ -985,7 +985,7 @@
+ dbgu: serial@fc069000 {
+ compatible = "atmel,at91sam9260-usart";
+ reg = <0xfc069000 0x200>;
+- interrupts = <2 IRQ_TYPE_LEVEL_HIGH 7>;
++ interrupts = <45 IRQ_TYPE_LEVEL_HIGH 7>;
+ pinctrl-names = "default";
+ pinctrl-0 = <&pinctrl_dbgu>;
+ clocks = <&dbgu_clk>;
+diff --git a/arch/arm/boot/dts/ste-nomadik-stn8815.dtsi b/arch/arm/boot/dts/ste-nomadik-stn8815.dtsi
+index dbcf521b017f..a0dd81958285 100644
+--- a/arch/arm/boot/dts/ste-nomadik-stn8815.dtsi
++++ b/arch/arm/boot/dts/ste-nomadik-stn8815.dtsi
+@@ -117,7 +117,7 @@
+ mmcsd_default_mux: mmcsd_mux {
+ mmcsd_default_mux {
+ ste,function = "mmcsd";
+- ste,pins = "mmcsd_a_1";
++ ste,pins = "mmcsd_a_1", "mmcsd_b_1";
+ };
+ };
+ mmcsd_default_mode: mmcsd_default {
+@@ -127,9 +127,9 @@
+ ste,output = <0>;
+ };
+ mmcsd_default_cfg2 {
+- /* MCCMDDIR, MCDAT0DIR, MCDAT31DIR */
++ /* MCCMDDIR, MCDAT0DIR, MCDAT31DIR, MCDATDIR2 */
+ ste,pins = "GPIO10_C11", "GPIO15_A12",
+- "GPIO16_C13";
++ "GPIO16_C13", "GPIO23_D15";
+ ste,output = <1>;
+ };
+ mmcsd_default_cfg3 {
+diff --git a/arch/arm/net/bpf_jit_32.c b/arch/arm/net/bpf_jit_32.c
+index f412b53ed268..ace4dc1e24ba 100644
+--- a/arch/arm/net/bpf_jit_32.c
++++ b/arch/arm/net/bpf_jit_32.c
+@@ -161,19 +161,6 @@ static inline int mem_words_used(struct jit_ctx *ctx)
+ return fls(ctx->seen & SEEN_MEM);
+ }
+
+-static inline bool is_load_to_a(u16 inst)
+-{
+- switch (inst) {
+- case BPF_LD | BPF_W | BPF_LEN:
+- case BPF_LD | BPF_W | BPF_ABS:
+- case BPF_LD | BPF_H | BPF_ABS:
+- case BPF_LD | BPF_B | BPF_ABS:
+- return true;
+- default:
+- return false;
+- }
+-}
+-
+ static void jit_fill_hole(void *area, unsigned int size)
+ {
+ u32 *ptr;
+@@ -185,7 +172,6 @@ static void jit_fill_hole(void *area, unsigned int size)
+ static void build_prologue(struct jit_ctx *ctx)
+ {
+ u16 reg_set = saved_regs(ctx);
+- u16 first_inst = ctx->skf->insns[0].code;
+ u16 off;
+
+ #ifdef CONFIG_FRAME_POINTER
+@@ -215,7 +201,7 @@ static void build_prologue(struct jit_ctx *ctx)
+ emit(ARM_MOV_I(r_X, 0), ctx);
+
+ /* do not leak kernel data to userspace */
+- if ((first_inst != (BPF_RET | BPF_K)) && !(is_load_to_a(first_inst)))
++ if (bpf_needs_clear_a(&ctx->skf->insns[0]))
+ emit(ARM_MOV_I(r_A, 0), ctx);
+
+ /* stack space for the BPF_MEM words */
+diff --git a/arch/arm64/kernel/setup.c b/arch/arm64/kernel/setup.c
+index d502a86bed9f..b5853eec2a2d 100644
+--- a/arch/arm64/kernel/setup.c
++++ b/arch/arm64/kernel/setup.c
+@@ -503,6 +503,10 @@ static int c_show(struct seq_file *m, void *v)
+ seq_printf(m, "processor\t: %d\n", i);
+ #endif
+
++ seq_printf(m, "BogoMIPS\t: %lu.%02lu\n",
++ loops_per_jiffy / (500000UL/HZ),
++ loops_per_jiffy / (5000UL/HZ) % 100);
++
+ /*
+ * Dump out the common processor features in a single line.
+ * Userspace should read the hwcaps with getauxval(AT_HWCAP)
+diff --git a/arch/arm64/mm/pageattr.c b/arch/arm64/mm/pageattr.c
+index bb0ea94c4ba1..491acbb334c8 100644
+--- a/arch/arm64/mm/pageattr.c
++++ b/arch/arm64/mm/pageattr.c
+@@ -54,6 +54,9 @@ static int change_memory_common(unsigned long addr, int numpages,
+ if (!is_module_address(start) || !is_module_address(end - 1))
+ return -EINVAL;
+
++ if (!numpages)
++ return 0;
++
+ data.set_mask = set_mask;
+ data.clear_mask = clear_mask;
+
+diff --git a/arch/m32r/kernel/setup.c b/arch/m32r/kernel/setup.c
+index 0392112a5d70..a5ecef7188ba 100644
+--- a/arch/m32r/kernel/setup.c
++++ b/arch/m32r/kernel/setup.c
+@@ -81,7 +81,10 @@ static struct resource code_resource = {
+ };
+
+ unsigned long memory_start;
++EXPORT_SYMBOL(memory_start);
++
+ unsigned long memory_end;
++EXPORT_SYMBOL(memory_end);
+
+ void __init setup_arch(char **);
+ int get_cpuinfo(char *);
+diff --git a/arch/mips/net/bpf_jit.c b/arch/mips/net/bpf_jit.c
+index 9fd6834a2172..9fd82f48f8ed 100644
+--- a/arch/mips/net/bpf_jit.c
++++ b/arch/mips/net/bpf_jit.c
+@@ -556,19 +556,6 @@ static inline u16 align_sp(unsigned int num)
+ return num;
+ }
+
+-static bool is_load_to_a(u16 inst)
+-{
+- switch (inst) {
+- case BPF_LD | BPF_W | BPF_LEN:
+- case BPF_LD | BPF_W | BPF_ABS:
+- case BPF_LD | BPF_H | BPF_ABS:
+- case BPF_LD | BPF_B | BPF_ABS:
+- return true;
+- default:
+- return false;
+- }
+-}
+-
+ static void save_bpf_jit_regs(struct jit_ctx *ctx, unsigned offset)
+ {
+ int i = 0, real_off = 0;
+@@ -690,7 +677,6 @@ static unsigned int get_stack_depth(struct jit_ctx *ctx)
+
+ static void build_prologue(struct jit_ctx *ctx)
+ {
+- u16 first_inst = ctx->skf->insns[0].code;
+ int sp_off;
+
+ /* Calculate the total offset for the stack pointer */
+@@ -704,7 +690,7 @@ static void build_prologue(struct jit_ctx *ctx)
+ emit_jit_reg_move(r_X, r_zero, ctx);
+
+ /* Do not leak kernel data to userspace */
+- if ((first_inst != (BPF_RET | BPF_K)) && !(is_load_to_a(first_inst)))
++ if (bpf_needs_clear_a(&ctx->skf->insns[0]))
+ emit_jit_reg_move(r_A, r_zero, ctx);
+ }
+
+diff --git a/arch/parisc/include/uapi/asm/siginfo.h b/arch/parisc/include/uapi/asm/siginfo.h
+index d7034728f377..1c75565d984b 100644
+--- a/arch/parisc/include/uapi/asm/siginfo.h
++++ b/arch/parisc/include/uapi/asm/siginfo.h
+@@ -1,6 +1,10 @@
+ #ifndef _PARISC_SIGINFO_H
+ #define _PARISC_SIGINFO_H
+
++#if defined(__LP64__)
++#define __ARCH_SI_PREAMBLE_SIZE (4 * sizeof(int))
++#endif
++
+ #include <asm-generic/siginfo.h>
+
+ #undef NSIGTRAP
+diff --git a/arch/powerpc/kernel/eeh_pe.c b/arch/powerpc/kernel/eeh_pe.c
+index 5a63e2b0f65b..65335daf1438 100644
+--- a/arch/powerpc/kernel/eeh_pe.c
++++ b/arch/powerpc/kernel/eeh_pe.c
+@@ -840,32 +840,29 @@ void eeh_pe_restore_bars(struct eeh_pe *pe)
+ const char *eeh_pe_loc_get(struct eeh_pe *pe)
+ {
+ struct pci_bus *bus = eeh_pe_bus_get(pe);
+- struct device_node *dn = pci_bus_to_OF_node(bus);
++ struct device_node *dn;
+ const char *loc = NULL;
+
+- if (!dn)
+- goto out;
++ while (bus) {
++ dn = pci_bus_to_OF_node(bus);
++ if (!dn) {
++ bus = bus->parent;
++ continue;
++ }
+
+- /* PHB PE or root PE ? */
+- if (pci_is_root_bus(bus)) {
+- loc = of_get_property(dn, "ibm,loc-code", NULL);
+- if (!loc)
++ if (pci_is_root_bus(bus))
+ loc = of_get_property(dn, "ibm,io-base-loc-code", NULL);
++ else
++ loc = of_get_property(dn, "ibm,slot-location-code",
++ NULL);
++
+ if (loc)
+- goto out;
++ return loc;
+
+- /* Check the root port */
+- dn = dn->child;
+- if (!dn)
+- goto out;
++ bus = bus->parent;
+ }
+
+- loc = of_get_property(dn, "ibm,loc-code", NULL);
+- if (!loc)
+- loc = of_get_property(dn, "ibm,slot-location-code", NULL);
+-
+-out:
+- return loc ? loc : "N/A";
++ return "N/A";
+ }
+
+ /**
+diff --git a/arch/powerpc/kvm/book3s_hv_rmhandlers.S b/arch/powerpc/kvm/book3s_hv_rmhandlers.S
+index edb2ccdbb2ba..3e9d73f58718 100644
+--- a/arch/powerpc/kvm/book3s_hv_rmhandlers.S
++++ b/arch/powerpc/kvm/book3s_hv_rmhandlers.S
+@@ -2085,7 +2085,7 @@ END_FTR_SECTION_IFSET(CPU_FTR_ARCH_207S)
+
+ /* Emulate H_SET_DABR/X on P8 for the sake of compat mode guests */
+ 2: rlwimi r5, r4, 5, DAWRX_DR | DAWRX_DW
+- rlwimi r5, r4, 1, DAWRX_WT
++ rlwimi r5, r4, 2, DAWRX_WT
+ clrrdi r4, r4, 3
+ std r4, VCPU_DAWR(r3)
+ std r5, VCPU_DAWRX(r3)
+diff --git a/arch/powerpc/kvm/powerpc.c b/arch/powerpc/kvm/powerpc.c
+index c1f8f53cd312..8a0f04ff94f3 100644
+--- a/arch/powerpc/kvm/powerpc.c
++++ b/arch/powerpc/kvm/powerpc.c
+@@ -921,21 +921,17 @@ int kvm_vcpu_ioctl_get_one_reg(struct kvm_vcpu *vcpu, struct kvm_one_reg *reg)
+ r = -ENXIO;
+ break;
+ }
+- vcpu->arch.vr.vr[reg->id - KVM_REG_PPC_VR0] = val.vval;
++ val.vval = vcpu->arch.vr.vr[reg->id - KVM_REG_PPC_VR0];
+ break;
+ case KVM_REG_PPC_VSCR:
+ if (!cpu_has_feature(CPU_FTR_ALTIVEC)) {
+ r = -ENXIO;
+ break;
+ }
+- vcpu->arch.vr.vscr.u[3] = set_reg_val(reg->id, val);
++ val = get_reg_val(reg->id, vcpu->arch.vr.vscr.u[3]);
+ break;
+ case KVM_REG_PPC_VRSAVE:
+- if (!cpu_has_feature(CPU_FTR_ALTIVEC)) {
+- r = -ENXIO;
+- break;
+- }
+- vcpu->arch.vrsave = set_reg_val(reg->id, val);
++ val = get_reg_val(reg->id, vcpu->arch.vrsave);
+ break;
+ #endif /* CONFIG_ALTIVEC */
+ default:
+@@ -976,17 +972,21 @@ int kvm_vcpu_ioctl_set_one_reg(struct kvm_vcpu *vcpu, struct kvm_one_reg *reg)
+ r = -ENXIO;
+ break;
+ }
+- val.vval = vcpu->arch.vr.vr[reg->id - KVM_REG_PPC_VR0];
++ vcpu->arch.vr.vr[reg->id - KVM_REG_PPC_VR0] = val.vval;
+ break;
+ case KVM_REG_PPC_VSCR:
+ if (!cpu_has_feature(CPU_FTR_ALTIVEC)) {
+ r = -ENXIO;
+ break;
+ }
+- val = get_reg_val(reg->id, vcpu->arch.vr.vscr.u[3]);
++ vcpu->arch.vr.vscr.u[3] = set_reg_val(reg->id, val);
+ break;
+ case KVM_REG_PPC_VRSAVE:
+- val = get_reg_val(reg->id, vcpu->arch.vrsave);
++ if (!cpu_has_feature(CPU_FTR_ALTIVEC)) {
++ r = -ENXIO;
++ break;
++ }
++ vcpu->arch.vrsave = set_reg_val(reg->id, val);
+ break;
+ #endif /* CONFIG_ALTIVEC */
+ default:
+diff --git a/arch/powerpc/net/bpf_jit_comp.c b/arch/powerpc/net/bpf_jit_comp.c
+index cbae2dfd053c..6a29085dd5a9 100644
+--- a/arch/powerpc/net/bpf_jit_comp.c
++++ b/arch/powerpc/net/bpf_jit_comp.c
+@@ -78,18 +78,9 @@ static void bpf_jit_build_prologue(struct bpf_prog *fp, u32 *image,
+ PPC_LI(r_X, 0);
+ }
+
+- switch (filter[0].code) {
+- case BPF_RET | BPF_K:
+- case BPF_LD | BPF_W | BPF_LEN:
+- case BPF_LD | BPF_W | BPF_ABS:
+- case BPF_LD | BPF_H | BPF_ABS:
+- case BPF_LD | BPF_B | BPF_ABS:
+- /* first instruction sets A register (or is RET 'constant') */
+- break;
+- default:
+- /* make sure we dont leak kernel information to user */
++ /* make sure we dont leak kernel information to user */
++ if (bpf_needs_clear_a(&filter[0]))
+ PPC_LI(r_A, 0);
+- }
+ }
+
+ static void bpf_jit_build_epilogue(u32 *image, struct codegen_context *ctx)
+diff --git a/arch/s390/mm/extable.c b/arch/s390/mm/extable.c
+index 4d1ee88864e8..18c8b819b0aa 100644
+--- a/arch/s390/mm/extable.c
++++ b/arch/s390/mm/extable.c
+@@ -52,12 +52,16 @@ void sort_extable(struct exception_table_entry *start,
+ int i;
+
+ /* Normalize entries to being relative to the start of the section */
+- for (p = start, i = 0; p < finish; p++, i += 8)
++ for (p = start, i = 0; p < finish; p++, i += 8) {
+ p->insn += i;
++ p->fixup += i + 4;
++ }
+ sort(start, finish - start, sizeof(*start), cmp_ex, NULL);
+ /* Denormalize all entries */
+- for (p = start, i = 0; p < finish; p++, i += 8)
++ for (p = start, i = 0; p < finish; p++, i += 8) {
+ p->insn -= i;
++ p->fixup -= i + 4;
++ }
+ }
+
+ #ifdef CONFIG_MODULES
+diff --git a/arch/sparc/kernel/sys_sparc_64.c b/arch/sparc/kernel/sys_sparc_64.c
+index 30e7ddb27a3a..c690c8e16a96 100644
+--- a/arch/sparc/kernel/sys_sparc_64.c
++++ b/arch/sparc/kernel/sys_sparc_64.c
+@@ -413,7 +413,7 @@ out:
+
+ SYSCALL_DEFINE1(sparc64_personality, unsigned long, personality)
+ {
+- int ret;
++ long ret;
+
+ if (personality(current->personality) == PER_LINUX32 &&
+ personality(personality) == PER_LINUX)
+diff --git a/arch/sparc/net/bpf_jit_comp.c b/arch/sparc/net/bpf_jit_comp.c
+index f33e7c7a3bf7..5cf170aa15e6 100644
+--- a/arch/sparc/net/bpf_jit_comp.c
++++ b/arch/sparc/net/bpf_jit_comp.c
+@@ -420,22 +420,9 @@ void bpf_jit_compile(struct bpf_prog *fp)
+ }
+ emit_reg_move(O7, r_saved_O7);
+
+- switch (filter[0].code) {
+- case BPF_RET | BPF_K:
+- case BPF_LD | BPF_W | BPF_LEN:
+- case BPF_LD | BPF_W | BPF_ABS:
+- case BPF_LD | BPF_H | BPF_ABS:
+- case BPF_LD | BPF_B | BPF_ABS:
+- /* The first instruction sets the A register (or is
+- * a "RET 'constant'")
+- */
+- break;
+- default:
+- /* Make sure we dont leak kernel information to the
+- * user.
+- */
++ /* Make sure we dont leak kernel information to the user. */
++ if (bpf_needs_clear_a(&filter[0]))
+ emit_clear(r_A); /* A = 0 */
+- }
+
+ for (i = 0; i < flen; i++) {
+ unsigned int K = filter[i].k;
+diff --git a/arch/um/os-Linux/start_up.c b/arch/um/os-Linux/start_up.c
+index 337518c5042a..b412c62486f0 100644
+--- a/arch/um/os-Linux/start_up.c
++++ b/arch/um/os-Linux/start_up.c
+@@ -95,6 +95,8 @@ static int start_ptraced_child(void)
+ {
+ int pid, n, status;
+
++ fflush(stdout);
++
+ pid = fork();
+ if (pid == 0)
+ ptrace_child();
+diff --git a/arch/x86/mm/pageattr.c b/arch/x86/mm/pageattr.c
+index 36de293caf25..e5545f2105f6 100644
+--- a/arch/x86/mm/pageattr.c
++++ b/arch/x86/mm/pageattr.c
+@@ -33,7 +33,7 @@ struct cpa_data {
+ pgd_t *pgd;
+ pgprot_t mask_set;
+ pgprot_t mask_clr;
+- int numpages;
++ unsigned long numpages;
+ int flags;
+ unsigned long pfn;
+ unsigned force_split : 1;
+@@ -1293,7 +1293,7 @@ static int __change_page_attr_set_clr(struct cpa_data *cpa, int checkalias)
+ * CPA operation. Either a large page has been
+ * preserved or a single page update happened.
+ */
+- BUG_ON(cpa->numpages > numpages);
++ BUG_ON(cpa->numpages > numpages || !cpa->numpages);
+ numpages -= cpa->numpages;
+ if (cpa->flags & (CPA_PAGES_ARRAY | CPA_ARRAY))
+ cpa->curpage++;
+diff --git a/crypto/af_alg.c b/crypto/af_alg.c
+index 1de4beeb25f8..30c1ae491fd4 100644
+--- a/crypto/af_alg.c
++++ b/crypto/af_alg.c
+@@ -76,6 +76,8 @@ int af_alg_register_type(const struct af_alg_type *type)
+ goto unlock;
+
+ type->ops->owner = THIS_MODULE;
++ if (type->ops_nokey)
++ type->ops_nokey->owner = THIS_MODULE;
+ node->type = type;
+ list_add(&node->list, &alg_types);
+ err = 0;
+@@ -125,6 +127,26 @@ int af_alg_release(struct socket *sock)
+ }
+ EXPORT_SYMBOL_GPL(af_alg_release);
+
++void af_alg_release_parent(struct sock *sk)
++{
++ struct alg_sock *ask = alg_sk(sk);
++ unsigned int nokey = ask->nokey_refcnt;
++ bool last = nokey && !ask->refcnt;
++
++ sk = ask->parent;
++ ask = alg_sk(sk);
++
++ lock_sock(sk);
++ ask->nokey_refcnt -= nokey;
++ if (!last)
++ last = !--ask->refcnt;
++ release_sock(sk);
++
++ if (last)
++ sock_put(sk);
++}
++EXPORT_SYMBOL_GPL(af_alg_release_parent);
++
+ static int alg_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
+ {
+ struct sock *sk = sock->sk;
+@@ -132,6 +154,7 @@ static int alg_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
+ struct sockaddr_alg *sa = (void *)uaddr;
+ const struct af_alg_type *type;
+ void *private;
++ int err;
+
+ if (sock->state == SS_CONNECTED)
+ return -EINVAL;
+@@ -157,16 +180,22 @@ static int alg_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
+ return PTR_ERR(private);
+ }
+
++ err = -EBUSY;
+ lock_sock(sk);
++ if (ask->refcnt | ask->nokey_refcnt)
++ goto unlock;
+
+ swap(ask->type, type);
+ swap(ask->private, private);
+
++ err = 0;
++
++unlock:
+ release_sock(sk);
+
+ alg_do_release(type, private);
+
+- return 0;
++ return err;
+ }
+
+ static int alg_setkey(struct sock *sk, char __user *ukey,
+@@ -199,11 +228,15 @@ static int alg_setsockopt(struct socket *sock, int level, int optname,
+ struct sock *sk = sock->sk;
+ struct alg_sock *ask = alg_sk(sk);
+ const struct af_alg_type *type;
+- int err = -ENOPROTOOPT;
++ int err = -EBUSY;
+
+ lock_sock(sk);
++ if (ask->refcnt)
++ goto unlock;
++
+ type = ask->type;
+
++ err = -ENOPROTOOPT;
+ if (level != SOL_ALG || !type)
+ goto unlock;
+
+@@ -228,6 +261,7 @@ int af_alg_accept(struct sock *sk, struct socket *newsock)
+ struct alg_sock *ask = alg_sk(sk);
+ const struct af_alg_type *type;
+ struct sock *sk2;
++ unsigned int nokey;
+ int err;
+
+ lock_sock(sk);
+@@ -247,20 +281,29 @@ int af_alg_accept(struct sock *sk, struct socket *newsock)
+ security_sk_clone(sk, sk2);
+
+ err = type->accept(ask->private, sk2);
+- if (err) {
+- sk_free(sk2);
++
++ nokey = err == -ENOKEY;
++ if (nokey && type->accept_nokey)
++ err = type->accept_nokey(ask->private, sk2);
++
++ if (err)
+ goto unlock;
+- }
+
+ sk2->sk_family = PF_ALG;
+
+- sock_hold(sk);
++ if (nokey || !ask->refcnt++)
++ sock_hold(sk);
++ ask->nokey_refcnt += nokey;
+ alg_sk(sk2)->parent = sk;
+ alg_sk(sk2)->type = type;
++ alg_sk(sk2)->nokey_refcnt = nokey;
+
+ newsock->ops = type->ops;
+ newsock->state = SS_CONNECTED;
+
++ if (nokey)
++ newsock->ops = type->ops_nokey;
++
+ err = 0;
+
+ unlock:
+diff --git a/crypto/ahash.c b/crypto/ahash.c
+index c1d8591913e9..51d48cd34884 100644
+--- a/crypto/ahash.c
++++ b/crypto/ahash.c
+@@ -450,6 +450,7 @@ static int crypto_ahash_init_tfm(struct crypto_tfm *tfm)
+ struct ahash_alg *alg = crypto_ahash_alg(hash);
+
+ hash->setkey = ahash_nosetkey;
++ hash->has_setkey = false;
+ hash->export = ahash_no_export;
+ hash->import = ahash_no_import;
+
+@@ -462,8 +463,10 @@ static int crypto_ahash_init_tfm(struct crypto_tfm *tfm)
+ hash->finup = alg->finup ?: ahash_def_finup;
+ hash->digest = alg->digest;
+
+- if (alg->setkey)
++ if (alg->setkey) {
+ hash->setkey = alg->setkey;
++ hash->has_setkey = true;
++ }
+ if (alg->export)
+ hash->export = alg->export;
+ if (alg->import)
+diff --git a/crypto/algif_hash.c b/crypto/algif_hash.c
+index 850246206b12..434af81b9e33 100644
+--- a/crypto/algif_hash.c
++++ b/crypto/algif_hash.c
+@@ -34,6 +34,11 @@ struct hash_ctx {
+ struct ahash_request req;
+ };
+
++struct algif_hash_tfm {
++ struct crypto_ahash *hash;
++ bool has_key;
++};
++
+ static int hash_sendmsg(struct kiocb *unused, struct socket *sock,
+ struct msghdr *msg, size_t ignored)
+ {
+@@ -51,7 +56,8 @@ static int hash_sendmsg(struct kiocb *unused, struct socket *sock,
+
+ lock_sock(sk);
+ if (!ctx->more) {
+- err = crypto_ahash_init(&ctx->req);
++ err = af_alg_wait_for_completion(crypto_ahash_init(&ctx->req),
++ &ctx->completion);
+ if (err)
+ goto unlock;
+ }
+@@ -131,6 +137,7 @@ static ssize_t hash_sendpage(struct socket *sock, struct page *page,
+ } else {
+ if (!ctx->more) {
+ err = crypto_ahash_init(&ctx->req);
++ err = af_alg_wait_for_completion(err, &ctx->completion);
+ if (err)
+ goto unlock;
+ }
+@@ -238,19 +245,151 @@ static struct proto_ops algif_hash_ops = {
+ .accept = hash_accept,
+ };
+
++static int hash_check_key(struct socket *sock)
++{
++ int err = 0;
++ struct sock *psk;
++ struct alg_sock *pask;
++ struct algif_hash_tfm *tfm;
++ struct sock *sk = sock->sk;
++ struct alg_sock *ask = alg_sk(sk);
++
++ lock_sock(sk);
++ if (ask->refcnt)
++ goto unlock_child;
++
++ psk = ask->parent;
++ pask = alg_sk(ask->parent);
++ tfm = pask->private;
++
++ err = -ENOKEY;
++ lock_sock_nested(psk, SINGLE_DEPTH_NESTING);
++ if (!tfm->has_key)
++ goto unlock;
++
++ if (!pask->refcnt++)
++ sock_hold(psk);
++
++ ask->refcnt = 1;
++ sock_put(psk);
++
++ err = 0;
++
++unlock:
++ release_sock(psk);
++unlock_child:
++ release_sock(sk);
++
++ return err;
++}
++
++static int hash_sendmsg_nokey(struct socket *sock, struct msghdr *msg,
++ size_t size)
++{
++ int err;
++
++ err = hash_check_key(sock);
++ if (err)
++ return err;
++
++ return hash_sendmsg(NULL, sock, msg, size);
++}
++
++static ssize_t hash_sendpage_nokey(struct socket *sock, struct page *page,
++ int offset, size_t size, int flags)
++{
++ int err;
++
++ err = hash_check_key(sock);
++ if (err)
++ return err;
++
++ return hash_sendpage(sock, page, offset, size, flags);
++}
++
++static int hash_recvmsg_nokey(struct socket *sock, struct msghdr *msg,
++ size_t ignored, int flags)
++{
++ int err;
++
++ err = hash_check_key(sock);
++ if (err)
++ return err;
++
++ return hash_recvmsg(NULL, sock, msg, ignored, flags);
++}
++
++static int hash_accept_nokey(struct socket *sock, struct socket *newsock,
++ int flags)
++{
++ int err;
++
++ err = hash_check_key(sock);
++ if (err)
++ return err;
++
++ return hash_accept(sock, newsock, flags);
++}
++
++static struct proto_ops algif_hash_ops_nokey = {
++ .family = PF_ALG,
++
++ .connect = sock_no_connect,
++ .socketpair = sock_no_socketpair,
++ .getname = sock_no_getname,
++ .ioctl = sock_no_ioctl,
++ .listen = sock_no_listen,
++ .shutdown = sock_no_shutdown,
++ .getsockopt = sock_no_getsockopt,
++ .mmap = sock_no_mmap,
++ .bind = sock_no_bind,
++ .setsockopt = sock_no_setsockopt,
++ .poll = sock_no_poll,
++
++ .release = af_alg_release,
++ .sendmsg = hash_sendmsg_nokey,
++ .sendpage = hash_sendpage_nokey,
++ .recvmsg = hash_recvmsg_nokey,
++ .accept = hash_accept_nokey,
++};
++
+ static void *hash_bind(const char *name, u32 type, u32 mask)
+ {
+- return crypto_alloc_ahash(name, type, mask);
++ struct algif_hash_tfm *tfm;
++ struct crypto_ahash *hash;
++
++ tfm = kzalloc(sizeof(*tfm), GFP_KERNEL);
++ if (!tfm)
++ return ERR_PTR(-ENOMEM);
++
++ hash = crypto_alloc_ahash(name, type, mask);
++ if (IS_ERR(hash)) {
++ kfree(tfm);
++ return ERR_CAST(hash);
++ }
++
++ tfm->hash = hash;
++
++ return tfm;
+ }
+
+ static void hash_release(void *private)
+ {
+- crypto_free_ahash(private);
++ struct algif_hash_tfm *tfm = private;
++
++ crypto_free_ahash(tfm->hash);
++ kfree(tfm);
+ }
+
+ static int hash_setkey(void *private, const u8 *key, unsigned int keylen)
+ {
+- return crypto_ahash_setkey(private, key, keylen);
++ struct algif_hash_tfm *tfm = private;
++ int err;
++
++ err = crypto_ahash_setkey(tfm->hash, key, keylen);
++ tfm->has_key = !err;
++
++ return err;
+ }
+
+ static void hash_sock_destruct(struct sock *sk)
+@@ -264,12 +403,14 @@ static void hash_sock_destruct(struct sock *sk)
+ af_alg_release_parent(sk);
+ }
+
+-static int hash_accept_parent(void *private, struct sock *sk)
++static int hash_accept_parent_nokey(void *private, struct sock *sk)
+ {
+ struct hash_ctx *ctx;
+ struct alg_sock *ask = alg_sk(sk);
+- unsigned len = sizeof(*ctx) + crypto_ahash_reqsize(private);
+- unsigned ds = crypto_ahash_digestsize(private);
++ struct algif_hash_tfm *tfm = private;
++ struct crypto_ahash *hash = tfm->hash;
++ unsigned len = sizeof(*ctx) + crypto_ahash_reqsize(hash);
++ unsigned ds = crypto_ahash_digestsize(hash);
+
+ ctx = sock_kmalloc(sk, len, GFP_KERNEL);
+ if (!ctx)
+@@ -289,7 +430,7 @@ static int hash_accept_parent(void *private, struct sock *sk)
+
+ ask->private = ctx;
+
+- ahash_request_set_tfm(&ctx->req, private);
++ ahash_request_set_tfm(&ctx->req, hash);
+ ahash_request_set_callback(&ctx->req, CRYPTO_TFM_REQ_MAY_BACKLOG,
+ af_alg_complete, &ctx->completion);
+
+@@ -298,12 +439,24 @@ static int hash_accept_parent(void *private, struct sock *sk)
+ return 0;
+ }
+
++static int hash_accept_parent(void *private, struct sock *sk)
++{
++ struct algif_hash_tfm *tfm = private;
++
++ if (!tfm->has_key && crypto_ahash_has_setkey(tfm->hash))
++ return -ENOKEY;
++
++ return hash_accept_parent_nokey(private, sk);
++}
++
+ static const struct af_alg_type algif_type_hash = {
+ .bind = hash_bind,
+ .release = hash_release,
+ .setkey = hash_setkey,
+ .accept = hash_accept_parent,
++ .accept_nokey = hash_accept_parent_nokey,
+ .ops = &algif_hash_ops,
++ .ops_nokey = &algif_hash_ops_nokey,
+ .name = "hash",
+ .owner = THIS_MODULE
+ };
+diff --git a/crypto/asymmetric_keys/x509_public_key.c b/crypto/asymmetric_keys/x509_public_key.c
+index 24f17e6c5904..4c850ac474e2 100644
+--- a/crypto/asymmetric_keys/x509_public_key.c
++++ b/crypto/asymmetric_keys/x509_public_key.c
+@@ -307,10 +307,6 @@ static int x509_key_preparse(struct key_preparsed_payload *prep)
+ srlen = cert->raw_serial_size;
+ q = cert->raw_serial;
+ }
+- if (srlen > 1 && *q == 0) {
+- srlen--;
+- q++;
+- }
+
+ ret = -ENOMEM;
+ desc = kmalloc(sulen + 2 + srlen * 2 + 1, GFP_KERNEL);
+diff --git a/crypto/crc32c_generic.c b/crypto/crc32c_generic.c
+index 06f1b60f02b2..4c0a0e271876 100644
+--- a/crypto/crc32c_generic.c
++++ b/crypto/crc32c_generic.c
+@@ -172,4 +172,3 @@ MODULE_DESCRIPTION("CRC32c (Castagnoli) calculations wrapper for lib/crc32c");
+ MODULE_LICENSE("GPL");
+ MODULE_ALIAS_CRYPTO("crc32c");
+ MODULE_ALIAS_CRYPTO("crc32c-generic");
+-MODULE_SOFTDEP("pre: crc32c");
+diff --git a/crypto/shash.c b/crypto/shash.c
+index 47c713954bf3..03fbcd4a82c4 100644
+--- a/crypto/shash.c
++++ b/crypto/shash.c
+@@ -354,9 +354,10 @@ int crypto_init_shash_ops_async(struct crypto_tfm *tfm)
+ crt->final = shash_async_final;
+ crt->finup = shash_async_finup;
+ crt->digest = shash_async_digest;
++ crt->setkey = shash_async_setkey;
++
++ crt->has_setkey = alg->setkey != shash_no_setkey;
+
+- if (alg->setkey)
+- crt->setkey = shash_async_setkey;
+ if (alg->export)
+ crt->export = shash_async_export;
+ if (alg->import)
+diff --git a/drivers/block/zram/zcomp.c b/drivers/block/zram/zcomp.c
+index 54d946a9eee6..6fbb10ca73b1 100644
+--- a/drivers/block/zram/zcomp.c
++++ b/drivers/block/zram/zcomp.c
+@@ -76,7 +76,7 @@ static void zcomp_strm_free(struct zcomp *comp, struct zcomp_strm *zstrm)
+ */
+ static struct zcomp_strm *zcomp_strm_alloc(struct zcomp *comp)
+ {
+- struct zcomp_strm *zstrm = kmalloc(sizeof(*zstrm), GFP_KERNEL);
++ struct zcomp_strm *zstrm = kmalloc(sizeof(*zstrm), GFP_NOIO);
+ if (!zstrm)
+ return NULL;
+
+@@ -85,7 +85,7 @@ static struct zcomp_strm *zcomp_strm_alloc(struct zcomp *comp)
+ * allocate 2 pages. 1 for compressed data, plus 1 extra for the
+ * case when compressed size is larger than the original one
+ */
+- zstrm->buffer = (void *)__get_free_pages(GFP_KERNEL | __GFP_ZERO, 1);
++ zstrm->buffer = (void *)__get_free_pages(GFP_NOIO | __GFP_ZERO, 1);
+ if (!zstrm->private || !zstrm->buffer) {
+ zcomp_strm_free(comp, zstrm);
+ zstrm = NULL;
+diff --git a/drivers/block/zram/zcomp_lz4.c b/drivers/block/zram/zcomp_lz4.c
+index f2afb7e988c3..dd6083124276 100644
+--- a/drivers/block/zram/zcomp_lz4.c
++++ b/drivers/block/zram/zcomp_lz4.c
+@@ -10,17 +10,36 @@
+ #include <linux/kernel.h>
+ #include <linux/slab.h>
+ #include <linux/lz4.h>
++#include <linux/vmalloc.h>
++#include <linux/mm.h>
+
+ #include "zcomp_lz4.h"
+
+ static void *zcomp_lz4_create(void)
+ {
+- return kzalloc(LZ4_MEM_COMPRESS, GFP_KERNEL);
++ void *ret;
++
++ /*
++ * This function can be called in swapout/fs write path
++ * so we can't use GFP_FS|IO. And it assumes we already
++ * have at least one stream in zram initialization so we
++ * don't do best effort to allocate more stream in here.
++ * A default stream will work well without further multiple
++ * streams. That's why we use NORETRY | NOWARN.
++ */
++ ret = kzalloc(LZ4_MEM_COMPRESS, GFP_NOIO | __GFP_NORETRY |
++ __GFP_NOWARN);
++ if (!ret)
++ ret = __vmalloc(LZ4_MEM_COMPRESS,
++ GFP_NOIO | __GFP_NORETRY | __GFP_NOWARN |
++ __GFP_ZERO | __GFP_HIGHMEM,
++ PAGE_KERNEL);
++ return ret;
+ }
+
+ static void zcomp_lz4_destroy(void *private)
+ {
+- kfree(private);
++ kvfree(private);
+ }
+
+ static int zcomp_lz4_compress(const unsigned char *src, unsigned char *dst,
+diff --git a/drivers/block/zram/zcomp_lzo.c b/drivers/block/zram/zcomp_lzo.c
+index da1bc47d588e..edc549920fa0 100644
+--- a/drivers/block/zram/zcomp_lzo.c
++++ b/drivers/block/zram/zcomp_lzo.c
+@@ -10,17 +10,36 @@
+ #include <linux/kernel.h>
+ #include <linux/slab.h>
+ #include <linux/lzo.h>
++#include <linux/vmalloc.h>
++#include <linux/mm.h>
+
+ #include "zcomp_lzo.h"
+
+ static void *lzo_create(void)
+ {
+- return kzalloc(LZO1X_MEM_COMPRESS, GFP_KERNEL);
++ void *ret;
++
++ /*
++ * This function can be called in swapout/fs write path
++ * so we can't use GFP_FS|IO. And it assumes we already
++ * have at least one stream in zram initialization so we
++ * don't do best effort to allocate more stream in here.
++ * A default stream will work well without further multiple
++ * streams. That's why we use NORETRY | NOWARN.
++ */
++ ret = kzalloc(LZO1X_MEM_COMPRESS, GFP_NOIO | __GFP_NORETRY |
++ __GFP_NOWARN);
++ if (!ret)
++ ret = __vmalloc(LZO1X_MEM_COMPRESS,
++ GFP_NOIO | __GFP_NORETRY | __GFP_NOWARN |
++ __GFP_ZERO | __GFP_HIGHMEM,
++ PAGE_KERNEL);
++ return ret;
+ }
+
+ static void lzo_destroy(void *private)
+ {
+- kfree(private);
++ kvfree(private);
+ }
+
+ static int lzo_compress(const unsigned char *src, unsigned char *dst,
+diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
+index 82360dd65a1f..b1e4866dc8d5 100644
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -134,6 +134,10 @@ static const struct usb_device_id btusb_table[] = {
+ /* IMC Networks - Broadcom based */
+ { USB_VENDOR_AND_INTERFACE_INFO(0x13d3, 0xff, 0x01, 0x01) },
+
++ /* Toshiba Corp - Broadcom based */
++ { USB_VENDOR_AND_INTERFACE_INFO(0x0930, 0xff, 0x01, 0x01),
++ .driver_info = BTUSB_BCM_PATCHRAM },
++
+ /* Intel Bluetooth USB Bootloader (RAM module) */
+ { USB_DEVICE(0x8087, 0x0a5a),
+ .driver_info = BTUSB_INTEL_BOOT | BTUSB_BROKEN_ISOC },
+diff --git a/drivers/connector/connector.c b/drivers/connector/connector.c
+index f612d68629dc..fd7430e30cbc 100644
+--- a/drivers/connector/connector.c
++++ b/drivers/connector/connector.c
+@@ -172,26 +172,21 @@ static int cn_call_callback(struct sk_buff *skb)
+ *
+ * It checks skb, netlink header and msg sizes, and calls callback helper.
+ */
+-static void cn_rx_skb(struct sk_buff *__skb)
++static void cn_rx_skb(struct sk_buff *skb)
+ {
+ struct nlmsghdr *nlh;
+- struct sk_buff *skb;
+ int len, err;
+
+- skb = skb_get(__skb);
+-
+ if (skb->len >= NLMSG_HDRLEN) {
+ nlh = nlmsg_hdr(skb);
+ len = nlmsg_len(nlh);
+
+ if (len < (int)sizeof(struct cn_msg) ||
+ skb->len < nlh->nlmsg_len ||
+- len > CONNECTOR_MAX_MSG_SIZE) {
+- kfree_skb(skb);
++ len > CONNECTOR_MAX_MSG_SIZE)
+ return;
+- }
+
+- err = cn_call_callback(skb);
++ err = cn_call_callback(skb_get(skb));
+ if (err < 0)
+ kfree_skb(skb);
+ }
+diff --git a/drivers/dma/dw/core.c b/drivers/dma/dw/core.c
+index 9da24a5e1561..ec233a5888e8 100644
+--- a/drivers/dma/dw/core.c
++++ b/drivers/dma/dw/core.c
+@@ -148,6 +148,7 @@ static void dwc_initialize(struct dw_dma_chan *dwc)
+
+ /* Enable interrupts */
+ channel_set_bit(dw, MASK.XFER, dwc->mask);
++ channel_set_bit(dw, MASK.BLOCK, dwc->mask);
+ channel_set_bit(dw, MASK.ERROR, dwc->mask);
+
+ dwc->initialized = true;
+@@ -222,7 +223,8 @@ static void dwc_dostart(struct dw_dma_chan *dwc, struct dw_desc *first)
+ /* ASSERT: channel is idle */
+ if (dma_readl(dw, CH_EN) & dwc->mask) {
+ dev_err(chan2dev(&dwc->chan),
+- "BUG: Attempted to start non-idle channel\n");
++ "%s: BUG: Attempted to start non-idle channel\n",
++ __func__);
+ dwc_dump_chan_regs(dwc);
+
+ /* The tasklet will hopefully advance the queue... */
+@@ -527,16 +529,17 @@ EXPORT_SYMBOL(dw_dma_get_dst_addr);
+
+ /* Called with dwc->lock held and all DMAC interrupts disabled */
+ static void dwc_handle_cyclic(struct dw_dma *dw, struct dw_dma_chan *dwc,
+- u32 status_err, u32 status_xfer)
++ u32 status_block, u32 status_err, u32 status_xfer)
+ {
+ unsigned long flags;
+
+- if (dwc->mask) {
++ if (status_block & dwc->mask) {
+ void (*callback)(void *param);
+ void *callback_param;
+
+ dev_vdbg(chan2dev(&dwc->chan), "new cyclic period llp 0x%08x\n",
+ channel_readl(dwc, LLP));
++ dma_writel(dw, CLEAR.BLOCK, dwc->mask);
+
+ callback = dwc->cdesc->period_callback;
+ callback_param = dwc->cdesc->period_callback_param;
+@@ -568,6 +571,7 @@ static void dwc_handle_cyclic(struct dw_dma *dw, struct dw_dma_chan *dwc,
+ channel_writel(dwc, CTL_LO, 0);
+ channel_writel(dwc, CTL_HI, 0);
+
++ dma_writel(dw, CLEAR.BLOCK, dwc->mask);
+ dma_writel(dw, CLEAR.ERROR, dwc->mask);
+ dma_writel(dw, CLEAR.XFER, dwc->mask);
+
+@@ -584,10 +588,12 @@ static void dw_dma_tasklet(unsigned long data)
+ {
+ struct dw_dma *dw = (struct dw_dma *)data;
+ struct dw_dma_chan *dwc;
++ u32 status_block;
+ u32 status_xfer;
+ u32 status_err;
+ int i;
+
++ status_block = dma_readl(dw, RAW.BLOCK);
+ status_xfer = dma_readl(dw, RAW.XFER);
+ status_err = dma_readl(dw, RAW.ERROR);
+
+@@ -596,7 +602,8 @@ static void dw_dma_tasklet(unsigned long data)
+ for (i = 0; i < dw->dma.chancnt; i++) {
+ dwc = &dw->chan[i];
+ if (test_bit(DW_DMA_IS_CYCLIC, &dwc->flags))
+- dwc_handle_cyclic(dw, dwc, status_err, status_xfer);
++ dwc_handle_cyclic(dw, dwc, status_block, status_err,
++ status_xfer);
+ else if (status_err & (1 << i))
+ dwc_handle_error(dw, dwc);
+ else if (status_xfer & (1 << i))
+@@ -607,6 +614,7 @@ static void dw_dma_tasklet(unsigned long data)
+ * Re-enable interrupts.
+ */
+ channel_set_bit(dw, MASK.XFER, dw->all_chan_mask);
++ channel_set_bit(dw, MASK.BLOCK, dw->all_chan_mask);
+ channel_set_bit(dw, MASK.ERROR, dw->all_chan_mask);
+ }
+
+@@ -626,6 +634,7 @@ static irqreturn_t dw_dma_interrupt(int irq, void *dev_id)
+ * softirq handler.
+ */
+ channel_clear_bit(dw, MASK.XFER, dw->all_chan_mask);
++ channel_clear_bit(dw, MASK.BLOCK, dw->all_chan_mask);
+ channel_clear_bit(dw, MASK.ERROR, dw->all_chan_mask);
+
+ status = dma_readl(dw, STATUS_INT);
+@@ -636,6 +645,7 @@ static irqreturn_t dw_dma_interrupt(int irq, void *dev_id)
+
+ /* Try to recover */
+ channel_clear_bit(dw, MASK.XFER, (1 << 8) - 1);
++ channel_clear_bit(dw, MASK.BLOCK, (1 << 8) - 1);
+ channel_clear_bit(dw, MASK.SRC_TRAN, (1 << 8) - 1);
+ channel_clear_bit(dw, MASK.DST_TRAN, (1 << 8) - 1);
+ channel_clear_bit(dw, MASK.ERROR, (1 << 8) - 1);
+@@ -1103,6 +1113,7 @@ static void dw_dma_off(struct dw_dma *dw)
+ dma_writel(dw, CFG, 0);
+
+ channel_clear_bit(dw, MASK.XFER, dw->all_chan_mask);
++ channel_clear_bit(dw, MASK.BLOCK, dw->all_chan_mask);
+ channel_clear_bit(dw, MASK.SRC_TRAN, dw->all_chan_mask);
+ channel_clear_bit(dw, MASK.DST_TRAN, dw->all_chan_mask);
+ channel_clear_bit(dw, MASK.ERROR, dw->all_chan_mask);
+@@ -1208,6 +1219,7 @@ static void dwc_free_chan_resources(struct dma_chan *chan)
+
+ /* Disable interrupts */
+ channel_clear_bit(dw, MASK.XFER, dwc->mask);
++ channel_clear_bit(dw, MASK.BLOCK, dwc->mask);
+ channel_clear_bit(dw, MASK.ERROR, dwc->mask);
+
+ spin_unlock_irqrestore(&dwc->lock, flags);
+@@ -1237,7 +1249,6 @@ static void dwc_free_chan_resources(struct dma_chan *chan)
+ int dw_dma_cyclic_start(struct dma_chan *chan)
+ {
+ struct dw_dma_chan *dwc = to_dw_dma_chan(chan);
+- struct dw_dma *dw = to_dw_dma(dwc->chan.device);
+ unsigned long flags;
+
+ if (!test_bit(DW_DMA_IS_CYCLIC, &dwc->flags)) {
+@@ -1246,26 +1257,7 @@ int dw_dma_cyclic_start(struct dma_chan *chan)
+ }
+
+ spin_lock_irqsave(&dwc->lock, flags);
+-
+- /* Assert channel is idle */
+- if (dma_readl(dw, CH_EN) & dwc->mask) {
+- dev_err(chan2dev(&dwc->chan),
+- "BUG: Attempted to start non-idle channel\n");
+- dwc_dump_chan_regs(dwc);
+- spin_unlock_irqrestore(&dwc->lock, flags);
+- return -EBUSY;
+- }
+-
+- dma_writel(dw, CLEAR.ERROR, dwc->mask);
+- dma_writel(dw, CLEAR.XFER, dwc->mask);
+-
+- /* Setup DMAC channel registers */
+- channel_writel(dwc, LLP, dwc->cdesc->desc[0]->txd.phys);
+- channel_writel(dwc, CTL_LO, DWC_CTLL_LLP_D_EN | DWC_CTLL_LLP_S_EN);
+- channel_writel(dwc, CTL_HI, 0);
+-
+- channel_set_bit(dw, CH_EN, dwc->mask);
+-
++ dwc_dostart(dwc, dwc->cdesc->desc[0]);
+ spin_unlock_irqrestore(&dwc->lock, flags);
+
+ return 0;
+@@ -1470,6 +1462,7 @@ void dw_dma_cyclic_free(struct dma_chan *chan)
+
+ dwc_chan_disable(dw, dwc);
+
++ dma_writel(dw, CLEAR.BLOCK, dwc->mask);
+ dma_writel(dw, CLEAR.ERROR, dwc->mask);
+ dma_writel(dw, CLEAR.XFER, dwc->mask);
+
+@@ -1557,9 +1550,6 @@ int dw_dma_probe(struct dw_dma_chip *chip, struct dw_dma_platform_data *pdata)
+ /* Force dma off, just in case */
+ dw_dma_off(dw);
+
+- /* Disable BLOCK interrupts as well */
+- channel_clear_bit(dw, MASK.BLOCK, dw->all_chan_mask);
+-
+ /* Create a pool of consistent memory blocks for hardware descriptors */
+ dw->desc_pool = dmam_pool_create("dw_dmac_desc_pool", chip->dev,
+ sizeof(struct dw_desc), 4, 0);
+diff --git a/drivers/edac/edac_device.c b/drivers/edac/edac_device.c
+index 592af5f0cf39..53587377e672 100644
+--- a/drivers/edac/edac_device.c
++++ b/drivers/edac/edac_device.c
+@@ -435,16 +435,13 @@ void edac_device_workq_setup(struct edac_device_ctl_info *edac_dev,
+ */
+ void edac_device_workq_teardown(struct edac_device_ctl_info *edac_dev)
+ {
+- int status;
+-
+ if (!edac_dev->edac_check)
+ return;
+
+- status = cancel_delayed_work(&edac_dev->work);
+- if (status == 0) {
+- /* workq instance might be running, wait for it */
+- flush_workqueue(edac_workqueue);
+- }
++ edac_dev->op_state = OP_OFFLINE;
++
++ cancel_delayed_work_sync(&edac_dev->work);
++ flush_workqueue(edac_workqueue);
+ }
+
+ /*
+diff --git a/drivers/edac/edac_mc.c b/drivers/edac/edac_mc.c
+index c3893b0ddb18..2466d6cda9b1 100644
+--- a/drivers/edac/edac_mc.c
++++ b/drivers/edac/edac_mc.c
+@@ -581,18 +581,10 @@ static void edac_mc_workq_setup(struct mem_ctl_info *mci, unsigned msec,
+ */
+ static void edac_mc_workq_teardown(struct mem_ctl_info *mci)
+ {
+- int status;
+-
+- if (mci->op_state != OP_RUNNING_POLL)
+- return;
+-
+- status = cancel_delayed_work(&mci->work);
+- if (status == 0) {
+- edac_dbg(0, "not canceled, flush the queue\n");
++ mci->op_state = OP_OFFLINE;
+
+- /* workq instance might be running, wait for it */
+- flush_workqueue(edac_workqueue);
+- }
++ cancel_delayed_work_sync(&mci->work);
++ flush_workqueue(edac_workqueue);
+ }
+
+ /*
+diff --git a/drivers/edac/edac_pci.c b/drivers/edac/edac_pci.c
+index 2cf44b4db80c..b4b38603b804 100644
+--- a/drivers/edac/edac_pci.c
++++ b/drivers/edac/edac_pci.c
+@@ -274,13 +274,12 @@ static void edac_pci_workq_setup(struct edac_pci_ctl_info *pci,
+ */
+ static void edac_pci_workq_teardown(struct edac_pci_ctl_info *pci)
+ {
+- int status;
+-
+ edac_dbg(0, "\n");
+
+- status = cancel_delayed_work(&pci->work);
+- if (status == 0)
+- flush_workqueue(edac_workqueue);
++ pci->op_state = OP_OFFLINE;
++
++ cancel_delayed_work_sync(&pci->work);
++ flush_workqueue(edac_workqueue);
+ }
+
+ /*
+diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c
+index dea239c38134..72deb52fd1d0 100644
+--- a/drivers/gpu/drm/drm_dp_mst_topology.c
++++ b/drivers/gpu/drm/drm_dp_mst_topology.c
+@@ -956,17 +956,17 @@ static struct drm_dp_mst_port *drm_dp_get_port(struct drm_dp_mst_branch *mstb, u
+ static u8 drm_dp_calculate_rad(struct drm_dp_mst_port *port,
+ u8 *rad)
+ {
+- int lct = port->parent->lct;
++ int parent_lct = port->parent->lct;
+ int shift = 4;
+- int idx = lct / 2;
+- if (lct > 1) {
+- memcpy(rad, port->parent->rad, idx);
+- shift = (lct % 2) ? 4 : 0;
++ int idx = (parent_lct - 1) / 2;
++ if (parent_lct > 1) {
++ memcpy(rad, port->parent->rad, idx + 1);
++ shift = (parent_lct % 2) ? 4 : 0;
+ } else
+ rad[0] = 0;
+
+ rad[idx] |= port->port_num << shift;
+- return lct + 1;
++ return parent_lct + 1;
+ }
+
+ /*
+@@ -1014,19 +1014,20 @@ static void drm_dp_check_port_guid(struct drm_dp_mst_branch *mstb,
+
+ static void build_mst_prop_path(struct drm_dp_mst_port *port,
+ struct drm_dp_mst_branch *mstb,
+- char *proppath)
++ char *proppath,
++ size_t proppath_size)
+ {
+ int i;
+ char temp[8];
+- snprintf(proppath, 255, "mst:%d", mstb->mgr->conn_base_id);
++ snprintf(proppath, proppath_size, "mst:%d", mstb->mgr->conn_base_id);
+ for (i = 0; i < (mstb->lct - 1); i++) {
+ int shift = (i % 2) ? 0 : 4;
+- int port_num = mstb->rad[i / 2] >> shift;
+- snprintf(temp, 8, "-%d", port_num);
+- strncat(proppath, temp, 255);
++ int port_num = (mstb->rad[i / 2] >> shift) & 0xf;
++ snprintf(temp, sizeof(temp), "-%d", port_num);
++ strlcat(proppath, temp, proppath_size);
+ }
+- snprintf(temp, 8, "-%d", port->port_num);
+- strncat(proppath, temp, 255);
++ snprintf(temp, sizeof(temp), "-%d", port->port_num);
++ strlcat(proppath, temp, proppath_size);
+ }
+
+ static void drm_dp_add_port(struct drm_dp_mst_branch *mstb,
+@@ -1097,7 +1098,7 @@ static void drm_dp_add_port(struct drm_dp_mst_branch *mstb,
+
+ if (created && !port->input) {
+ char proppath[255];
+- build_mst_prop_path(port, mstb, proppath);
++ build_mst_prop_path(port, mstb, proppath, sizeof(proppath));
+ port->connector = (*mstb->mgr->cbs->add_connector)(mstb->mgr, port, proppath);
+ }
+
+@@ -1158,7 +1159,7 @@ static struct drm_dp_mst_branch *drm_dp_get_mst_branch_device(struct drm_dp_mst_
+
+ for (i = 0; i < lct - 1; i++) {
+ int shift = (i % 2) ? 0 : 4;
+- int port_num = rad[i / 2] >> shift;
++ int port_num = (rad[i / 2] >> shift) & 0xf;
+
+ list_for_each_entry(port, &mstb->ports, next) {
+ if (port->port_num == port_num) {
+@@ -1177,6 +1178,50 @@ static struct drm_dp_mst_branch *drm_dp_get_mst_branch_device(struct drm_dp_mst_
+ return mstb;
+ }
+
++static struct drm_dp_mst_branch *get_mst_branch_device_by_guid_helper(
++ struct drm_dp_mst_branch *mstb,
++ uint8_t *guid)
++{
++ struct drm_dp_mst_branch *found_mstb;
++ struct drm_dp_mst_port *port;
++
++ list_for_each_entry(port, &mstb->ports, next) {
++ if (!port->mstb)
++ continue;
++
++ if (port->guid_valid && memcmp(port->guid, guid, 16) == 0)
++ return port->mstb;
++
++ found_mstb = get_mst_branch_device_by_guid_helper(port->mstb, guid);
++
++ if (found_mstb)
++ return found_mstb;
++ }
++
++ return NULL;
++}
++
++static struct drm_dp_mst_branch *drm_dp_get_mst_branch_device_by_guid(
++ struct drm_dp_mst_topology_mgr *mgr,
++ uint8_t *guid)
++{
++ struct drm_dp_mst_branch *mstb;
++
++ /* find the port by iterating down */
++ mutex_lock(&mgr->lock);
++
++ if (mgr->guid_valid && memcmp(mgr->guid, guid, 16) == 0)
++ mstb = mgr->mst_primary;
++ else
++ mstb = get_mst_branch_device_by_guid_helper(mgr->mst_primary, guid);
++
++ if (mstb)
++ kref_get(&mstb->kref);
++
++ mutex_unlock(&mgr->lock);
++ return mstb;
++}
++
+ static void drm_dp_check_and_send_link_address(struct drm_dp_mst_topology_mgr *mgr,
+ struct drm_dp_mst_branch *mstb)
+ {
+@@ -1288,6 +1333,7 @@ static int set_hdr_from_dst_qlock(struct drm_dp_sideband_msg_hdr *hdr,
+ struct drm_dp_sideband_msg_tx *txmsg)
+ {
+ struct drm_dp_mst_branch *mstb = txmsg->dst;
++ u8 req_type;
+
+ /* both msg slots are full */
+ if (txmsg->seqno == -1) {
+@@ -1304,7 +1350,13 @@ static int set_hdr_from_dst_qlock(struct drm_dp_sideband_msg_hdr *hdr,
+ txmsg->seqno = 1;
+ mstb->tx_slots[txmsg->seqno] = txmsg;
+ }
+- hdr->broadcast = 0;
++
++ req_type = txmsg->msg[0] & 0x7f;
++ if (req_type == DP_CONNECTION_STATUS_NOTIFY ||
++ req_type == DP_RESOURCE_STATUS_NOTIFY)
++ hdr->broadcast = 1;
++ else
++ hdr->broadcast = 0;
+ hdr->path_msg = txmsg->path_msg;
+ hdr->lct = mstb->lct;
+ hdr->lcr = mstb->lct - 1;
+@@ -2092,28 +2144,50 @@ static int drm_dp_mst_handle_up_req(struct drm_dp_mst_topology_mgr *mgr)
+
+ if (mgr->up_req_recv.have_eomt) {
+ struct drm_dp_sideband_msg_req_body msg;
+- struct drm_dp_mst_branch *mstb;
++ struct drm_dp_mst_branch *mstb = NULL;
+ bool seqno;
+- mstb = drm_dp_get_mst_branch_device(mgr,
+- mgr->up_req_recv.initial_hdr.lct,
+- mgr->up_req_recv.initial_hdr.rad);
+- if (!mstb) {
+- DRM_DEBUG_KMS("Got MST reply from unknown device %d\n", mgr->up_req_recv.initial_hdr.lct);
+- memset(&mgr->up_req_recv, 0, sizeof(struct drm_dp_sideband_msg_rx));
+- return 0;
++
++ if (!mgr->up_req_recv.initial_hdr.broadcast) {
++ mstb = drm_dp_get_mst_branch_device(mgr,
++ mgr->up_req_recv.initial_hdr.lct,
++ mgr->up_req_recv.initial_hdr.rad);
++ if (!mstb) {
++ DRM_DEBUG_KMS("Got MST reply from unknown device %d\n", mgr->up_req_recv.initial_hdr.lct);
++ memset(&mgr->up_req_recv, 0, sizeof(struct drm_dp_sideband_msg_rx));
++ return 0;
++ }
+ }
+
+ seqno = mgr->up_req_recv.initial_hdr.seqno;
+ drm_dp_sideband_parse_req(&mgr->up_req_recv, &msg);
+
+ if (msg.req_type == DP_CONNECTION_STATUS_NOTIFY) {
+- drm_dp_send_up_ack_reply(mgr, mstb, msg.req_type, seqno, false);
++ drm_dp_send_up_ack_reply(mgr, mgr->mst_primary, msg.req_type, seqno, false);
++
++ if (!mstb)
++ mstb = drm_dp_get_mst_branch_device_by_guid(mgr, msg.u.conn_stat.guid);
++
++ if (!mstb) {
++ DRM_DEBUG_KMS("Got MST reply from unknown device %d\n", mgr->up_req_recv.initial_hdr.lct);
++ memset(&mgr->up_req_recv, 0, sizeof(struct drm_dp_sideband_msg_rx));
++ return 0;
++ }
++
+ drm_dp_update_port(mstb, &msg.u.conn_stat);
+ DRM_DEBUG_KMS("Got CSN: pn: %d ldps:%d ddps: %d mcs: %d ip: %d pdt: %d\n", msg.u.conn_stat.port_number, msg.u.conn_stat.legacy_device_plug_status, msg.u.conn_stat.displayport_device_plug_status, msg.u.conn_stat.message_capability_status, msg.u.conn_stat.input_port, msg.u.conn_stat.peer_device_type);
+ (*mgr->cbs->hotplug)(mgr);
+
+ } else if (msg.req_type == DP_RESOURCE_STATUS_NOTIFY) {
+- drm_dp_send_up_ack_reply(mgr, mstb, msg.req_type, seqno, false);
++ drm_dp_send_up_ack_reply(mgr, mgr->mst_primary, msg.req_type, seqno, false);
++ if (!mstb)
++ mstb = drm_dp_get_mst_branch_device_by_guid(mgr, msg.u.resource_stat.guid);
++
++ if (!mstb) {
++ DRM_DEBUG_KMS("Got MST reply from unknown device %d\n", mgr->up_req_recv.initial_hdr.lct);
++ memset(&mgr->up_req_recv, 0, sizeof(struct drm_dp_sideband_msg_rx));
++ return 0;
++ }
++
+ DRM_DEBUG_KMS("Got RSN: pn: %d avail_pbn %d\n", msg.u.resource_stat.port_number, msg.u.resource_stat.available_pbn);
+ }
+
+@@ -2283,6 +2357,7 @@ bool drm_dp_mst_allocate_vcpi(struct drm_dp_mst_topology_mgr *mgr, struct drm_dp
+ DRM_DEBUG_KMS("payload: vcpi %d already allocated for pbn %d - requested pbn %d\n", port->vcpi.vcpi, port->vcpi.pbn, pbn);
+ if (pbn == port->vcpi.pbn) {
+ *slots = port->vcpi.num_slots;
++ drm_dp_put_port(port);
+ return true;
+ }
+ }
+@@ -2429,32 +2504,31 @@ EXPORT_SYMBOL(drm_dp_check_act_status);
+ */
+ int drm_dp_calc_pbn_mode(int clock, int bpp)
+ {
+- fixed20_12 pix_bw;
+- fixed20_12 fbpp;
+- fixed20_12 result;
+- fixed20_12 margin, tmp;
+- u32 res;
+-
+- pix_bw.full = dfixed_const(clock);
+- fbpp.full = dfixed_const(bpp);
+- tmp.full = dfixed_const(8);
+- fbpp.full = dfixed_div(fbpp, tmp);
+-
+- result.full = dfixed_mul(pix_bw, fbpp);
+- margin.full = dfixed_const(54);
+- tmp.full = dfixed_const(64);
+- margin.full = dfixed_div(margin, tmp);
+- result.full = dfixed_div(result, margin);
+-
+- margin.full = dfixed_const(1006);
+- tmp.full = dfixed_const(1000);
+- margin.full = dfixed_div(margin, tmp);
+- result.full = dfixed_mul(result, margin);
+-
+- result.full = dfixed_div(result, tmp);
+- result.full = dfixed_ceil(result);
+- res = dfixed_trunc(result);
+- return res;
++ u64 kbps;
++ s64 peak_kbps;
++ u32 numerator;
++ u32 denominator;
++
++ kbps = clock * bpp;
++
++ /*
++ * margin 5300ppm + 300ppm ~ 0.6% as per spec, factor is 1.006
++ * The unit of 54/64Mbytes/sec is an arbitrary unit chosen based on
++ * common multiplier to render an integer PBN for all link rate/lane
++ * counts combinations
++ * calculate
++ * peak_kbps *= (1006/1000)
++ * peak_kbps *= (64/54)
++ * peak_kbps *= 8 convert to bytes
++ */
++
++ numerator = 64 * 1006;
++ denominator = 54 * 8 * 1000 * 1000;
++
++ kbps *= numerator;
++ peak_kbps = drm_fixp_from_fraction(kbps, denominator);
++
++ return drm_fixp2int_ceil(peak_kbps);
+ }
+ EXPORT_SYMBOL(drm_dp_calc_pbn_mode);
+
+@@ -2462,11 +2536,23 @@ static int test_calc_pbn_mode(void)
+ {
+ int ret;
+ ret = drm_dp_calc_pbn_mode(154000, 30);
+- if (ret != 689)
++ if (ret != 689) {
++ DRM_ERROR("PBN calculation test failed - clock %d, bpp %d, expected PBN %d, actual PBN %d.\n",
++ 154000, 30, 689, ret);
+ return -EINVAL;
++ }
+ ret = drm_dp_calc_pbn_mode(234000, 30);
+- if (ret != 1047)
++ if (ret != 1047) {
++ DRM_ERROR("PBN calculation test failed - clock %d, bpp %d, expected PBN %d, actual PBN %d.\n",
++ 234000, 30, 1047, ret);
+ return -EINVAL;
++ }
++ ret = drm_dp_calc_pbn_mode(297000, 24);
++ if (ret != 1063) {
++ DRM_ERROR("PBN calculation test failed - clock %d, bpp %d, expected PBN %d, actual PBN %d.\n",
++ 297000, 24, 1063, ret);
++ return -EINVAL;
++ }
+ return 0;
+ }
+
+diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
+index 60c68e3cedeb..c2d76fed3abf 100644
+--- a/drivers/gpu/drm/i915/intel_display.c
++++ b/drivers/gpu/drm/i915/intel_display.c
+@@ -10186,11 +10186,21 @@ connected_sink_compute_bpp(struct intel_connector *connector,
+ pipe_config->pipe_bpp = connector->base.display_info.bpc*3;
+ }
+
+- /* Clamp bpp to 8 on screens without EDID 1.4 */
+- if (connector->base.display_info.bpc == 0 && bpp > 24) {
+- DRM_DEBUG_KMS("clamping display bpp (was %d) to default limit of 24\n",
+- bpp);
+- pipe_config->pipe_bpp = 24;
++ /* Clamp bpp to default limit on screens without EDID 1.4 */
++ if (connector->base.display_info.bpc == 0) {
++ int type = connector->base.connector_type;
++ int clamp_bpp = 24;
++
++ /* Fall back to 18 bpp when DP sink capability is unknown. */
++ if (type == DRM_MODE_CONNECTOR_DisplayPort ||
++ type == DRM_MODE_CONNECTOR_eDP)
++ clamp_bpp = 18;
++
++ if (bpp > clamp_bpp) {
++ DRM_DEBUG_KMS("clamping display bpp (was %d) to default limit of %d\n",
++ bpp, clamp_bpp);
++ pipe_config->pipe_bpp = clamp_bpp;
++ }
+ }
+ }
+
+diff --git a/drivers/gpu/drm/nouveau/nouveau_connector.c b/drivers/gpu/drm/nouveau/nouveau_connector.c
+index c8ac9482cf2e..a088c96dab5b 100644
+--- a/drivers/gpu/drm/nouveau/nouveau_connector.c
++++ b/drivers/gpu/drm/nouveau/nouveau_connector.c
+@@ -952,10 +952,13 @@ nouveau_connector_hotplug(struct nvif_notify *notify)
+
+ NV_DEBUG(drm, "%splugged %s\n", plugged ? "" : "un", name);
+
++ mutex_lock(&drm->dev->mode_config.mutex);
+ if (plugged)
+ drm_helper_connector_dpms(connector, DRM_MODE_DPMS_ON);
+ else
+ drm_helper_connector_dpms(connector, DRM_MODE_DPMS_OFF);
++ mutex_unlock(&drm->dev->mode_config.mutex);
++
+ drm_helper_hpd_irq_event(connector->dev);
+ }
+
+diff --git a/drivers/gpu/drm/radeon/radeon_atombios.c b/drivers/gpu/drm/radeon/radeon_atombios.c
+index d79e892093b5..882171b411f0 100644
+--- a/drivers/gpu/drm/radeon/radeon_atombios.c
++++ b/drivers/gpu/drm/radeon/radeon_atombios.c
+@@ -436,7 +436,9 @@ static bool radeon_atom_apply_quirks(struct drm_device *dev,
+ }
+
+ /* Fujitsu D3003-S2 board lists DVI-I as DVI-D and VGA */
+- if (((dev->pdev->device == 0x9802) || (dev->pdev->device == 0x9806)) &&
++ if (((dev->pdev->device == 0x9802) ||
++ (dev->pdev->device == 0x9805) ||
++ (dev->pdev->device == 0x9806)) &&
+ (dev->pdev->subsystem_vendor == 0x1734) &&
+ (dev->pdev->subsystem_device == 0x11bd)) {
+ if (*connector_type == DRM_MODE_CONNECTOR_VGA) {
+@@ -447,14 +449,6 @@ static bool radeon_atom_apply_quirks(struct drm_device *dev,
+ }
+ }
+
+- /* Fujitsu D3003-S2 board lists DVI-I as DVI-I and VGA */
+- if ((dev->pdev->device == 0x9805) &&
+- (dev->pdev->subsystem_vendor == 0x1734) &&
+- (dev->pdev->subsystem_device == 0x11bd)) {
+- if (*connector_type == DRM_MODE_CONNECTOR_VGA)
+- return false;
+- }
+-
+ return true;
+ }
+
+diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
+index 5d54ab0fbe2b..e206795e3693 100644
+--- a/drivers/gpu/drm/radeon/radeon_device.c
++++ b/drivers/gpu/drm/radeon/radeon_device.c
+@@ -1665,6 +1665,7 @@ int radeon_resume_kms(struct drm_device *dev, bool resume, bool fbcon)
+ }
+
+ drm_kms_helper_poll_enable(dev);
++ drm_helper_hpd_irq_event(dev);
+
+ /* set the power state here in case we are a PX system or headless */
+ if ((rdev->pm.pm_method == PM_METHOD_DPM) && rdev->pm.dpm_enabled)
+diff --git a/drivers/gpu/drm/radeon/radeon_object.c b/drivers/gpu/drm/radeon/radeon_object.c
+index 2a7ba30165c7..9ec2ddd97edf 100644
+--- a/drivers/gpu/drm/radeon/radeon_object.c
++++ b/drivers/gpu/drm/radeon/radeon_object.c
+@@ -33,6 +33,7 @@
+ #include <linux/slab.h>
+ #include <drm/drmP.h>
+ #include <drm/radeon_drm.h>
++#include <drm/drm_cache.h>
+ #include "radeon.h"
+ #include "radeon_trace.h"
+
+@@ -204,7 +205,7 @@ int radeon_bo_create(struct radeon_device *rdev,
+ /* XXX: Write-combined CPU mappings of GTT seem broken on 32-bit
+ * See https://bugs.freedesktop.org/show_bug.cgi?id=84627
+ */
+- bo->flags &= ~RADEON_GEM_GTT_WC;
++ bo->flags &= ~(RADEON_GEM_GTT_WC | RADEON_GEM_GTT_UC);
+ #elif defined(CONFIG_X86) && !defined(CONFIG_X86_PAT)
+ /* Don't try to enable write-combining when it can't work, or things
+ * may be slow
+@@ -216,7 +217,13 @@ int radeon_bo_create(struct radeon_device *rdev,
+
+ DRM_INFO_ONCE("Please enable CONFIG_MTRR and CONFIG_X86_PAT for "
+ "better performance thanks to write-combining\n");
+- bo->flags &= ~RADEON_GEM_GTT_WC;
++ bo->flags &= ~(RADEON_GEM_GTT_WC | RADEON_GEM_GTT_UC);
++#else
++ /* For architectures that don't support WC memory,
++ * mask out the WC flag from the BO
++ */
++ if (!drm_arch_can_wc_memory())
++ bo->flags &= ~RADEON_GEM_GTT_WC;
+ #endif
+
+ radeon_ttm_placement_from_domain(bo, domain);
+@@ -798,3 +805,22 @@ int radeon_bo_wait(struct radeon_bo *bo, u32 *mem_type, bool no_wait)
+ ttm_bo_unreserve(&bo->tbo);
+ return r;
+ }
++
++/**
++ * radeon_bo_fence - add fence to buffer object
++ *
++ * @bo: buffer object in question
++ * @fence: fence to add
++ * @shared: true if fence should be added shared
++ *
++ */
++void radeon_bo_fence(struct radeon_bo *bo, struct radeon_fence *fence,
++ bool shared)
++{
++ struct reservation_object *resv = bo->tbo.resv;
++
++ if (shared)
++ reservation_object_add_shared_fence(resv, &fence->base);
++ else
++ reservation_object_add_excl_fence(resv, &fence->base);
++}
+diff --git a/drivers/gpu/drm/radeon/radeon_object.h b/drivers/gpu/drm/radeon/radeon_object.h
+index 1b8ec7917154..3b0b377f76cb 100644
+--- a/drivers/gpu/drm/radeon/radeon_object.h
++++ b/drivers/gpu/drm/radeon/radeon_object.h
+@@ -155,6 +155,8 @@ extern void radeon_bo_move_notify(struct ttm_buffer_object *bo,
+ struct ttm_mem_reg *new_mem);
+ extern int radeon_bo_fault_reserve_notify(struct ttm_buffer_object *bo);
+ extern int radeon_bo_get_surface_reg(struct radeon_bo *bo);
++extern void radeon_bo_fence(struct radeon_bo *bo, struct radeon_fence *fence,
++ bool shared);
+
+ /*
+ * sub allocation
+diff --git a/drivers/gpu/drm/radeon/radeon_vm.c b/drivers/gpu/drm/radeon/radeon_vm.c
+index 190eb5bee4eb..0974fa17deb2 100644
+--- a/drivers/gpu/drm/radeon/radeon_vm.c
++++ b/drivers/gpu/drm/radeon/radeon_vm.c
+@@ -143,7 +143,7 @@ struct radeon_cs_reloc *radeon_vm_get_bos(struct radeon_device *rdev,
+ list[0].prefered_domains = RADEON_GEM_DOMAIN_VRAM;
+ list[0].allowed_domains = RADEON_GEM_DOMAIN_VRAM;
+ list[0].tv.bo = &vm->page_directory->tbo;
+- list[0].tv.shared = false;
++ list[0].tv.shared = true;
+ list[0].tiling_flags = 0;
+ list[0].handle = 0;
+ list_add(&list[0].tv.head, head);
+@@ -157,7 +157,7 @@ struct radeon_cs_reloc *radeon_vm_get_bos(struct radeon_device *rdev,
+ list[idx].prefered_domains = RADEON_GEM_DOMAIN_VRAM;
+ list[idx].allowed_domains = RADEON_GEM_DOMAIN_VRAM;
+ list[idx].tv.bo = &list[idx].robj->tbo;
+- list[idx].tv.shared = false;
++ list[idx].tv.shared = true;
+ list[idx].tiling_flags = 0;
+ list[idx].handle = 0;
+ list_add(&list[idx++].tv.head, head);
+@@ -387,35 +387,25 @@ static void radeon_vm_set_pages(struct radeon_device *rdev,
+ static int radeon_vm_clear_bo(struct radeon_device *rdev,
+ struct radeon_bo *bo)
+ {
+- struct ttm_validate_buffer tv;
+- struct ww_acquire_ctx ticket;
+- struct list_head head;
+ struct radeon_ib ib;
+ unsigned entries;
+ uint64_t addr;
+ int r;
+
+- memset(&tv, 0, sizeof(tv));
+- tv.bo = &bo->tbo;
+- tv.shared = false;
+-
+- INIT_LIST_HEAD(&head);
+- list_add(&tv.head, &head);
+-
+- r = ttm_eu_reserve_buffers(&ticket, &head, true);
+- if (r)
++ r = radeon_bo_reserve(bo, false);
++ if (r)
+ return r;
+
+- r = ttm_bo_validate(&bo->tbo, &bo->placement, true, false);
+- if (r)
+- goto error;
++ r = ttm_bo_validate(&bo->tbo, &bo->placement, true, false);
++ if (r)
++ goto error_unreserve;
+
+ addr = radeon_bo_gpu_offset(bo);
+ entries = radeon_bo_size(bo) / 8;
+
+ r = radeon_ib_get(rdev, R600_RING_TYPE_DMA_INDEX, &ib, NULL, 256);
+ if (r)
+- goto error;
++ goto error_unreserve;
+
+ ib.length_dw = 0;
+
+@@ -425,15 +415,15 @@ static int radeon_vm_clear_bo(struct radeon_device *rdev,
+
+ r = radeon_ib_schedule(rdev, &ib, NULL, false);
+ if (r)
+- goto error;
++ goto error_free;
+
+- ttm_eu_fence_buffer_objects(&ticket, &head, &ib.fence->base);
+- radeon_ib_free(rdev, &ib);
++ radeon_bo_fence(bo, ib.fence, false);
+
+- return 0;
++error_free:
++ radeon_ib_free(rdev, &ib);
+
+-error:
+- ttm_eu_backoff_reservation(&ticket, &head);
++error_unreserve:
++ radeon_bo_unreserve(bo);
+ return r;
+ }
+
+@@ -464,14 +454,14 @@ int radeon_vm_bo_set_addr(struct radeon_device *rdev,
+
+ if (soffset) {
+ /* make sure object fit at this offset */
+- eoffset = soffset + size;
++ eoffset = soffset + size - 1;
+ if (soffset >= eoffset) {
+ return -EINVAL;
+ }
+
+ last_pfn = eoffset / RADEON_GPU_PAGE_SIZE;
+- if (last_pfn > rdev->vm_manager.max_pfn) {
+- dev_err(rdev->dev, "va above limit (0x%08X > 0x%08X)\n",
++ if (last_pfn >= rdev->vm_manager.max_pfn) {
++ dev_err(rdev->dev, "va above limit (0x%08X >= 0x%08X)\n",
+ last_pfn, rdev->vm_manager.max_pfn);
+ return -EINVAL;
+ }
+@@ -485,7 +475,7 @@ int radeon_vm_bo_set_addr(struct radeon_device *rdev,
+ eoffset /= RADEON_GPU_PAGE_SIZE;
+ if (soffset || eoffset) {
+ struct interval_tree_node *it;
+- it = interval_tree_iter_first(&vm->va, soffset, eoffset - 1);
++ it = interval_tree_iter_first(&vm->va, soffset, eoffset);
+ if (it && it != &bo_va->it) {
+ struct radeon_bo_va *tmp;
+ tmp = container_of(it, struct radeon_bo_va, it);
+@@ -524,7 +514,7 @@ int radeon_vm_bo_set_addr(struct radeon_device *rdev,
+
+ if (soffset || eoffset) {
+ bo_va->it.start = soffset;
+- bo_va->it.last = eoffset - 1;
++ bo_va->it.last = eoffset;
+ interval_tree_insert(&bo_va->it, &vm->va);
+ }
+
+@@ -712,6 +702,7 @@ int radeon_vm_update_page_directory(struct radeon_device *rdev,
+ radeon_ib_free(rdev, &ib);
+ return r;
+ }
++ radeon_bo_fence(pd, ib.fence, false);
+ radeon_fence_unref(&vm->fence);
+ vm->fence = radeon_fence_ref(ib.fence);
+ radeon_fence_unref(&vm->last_flush);
+@@ -870,6 +861,31 @@ static void radeon_vm_update_ptes(struct radeon_device *rdev,
+ }
+
+ /**
++ * radeon_vm_fence_pts - fence page tables after an update
++ *
++ * @vm: requested vm
++ * @start: start of GPU address range
++ * @end: end of GPU address range
++ * @fence: fence to use
++ *
++ * Fence the page tables in the range @start - @end (cayman+).
++ *
++ * Global and local mutex must be locked!
++ */
++static void radeon_vm_fence_pts(struct radeon_vm *vm,
++ uint64_t start, uint64_t end,
++ struct radeon_fence *fence)
++{
++ unsigned i;
++
++ start >>= radeon_vm_block_size;
++ end = (end - 1) >> radeon_vm_block_size;
++
++ for (i = start; i <= end; ++i)
++ radeon_bo_fence(vm->page_tables[i].bo, fence, false);
++}
++
++/**
+ * radeon_vm_bo_update - map a bo into the vm page table
+ *
+ * @rdev: radeon_device pointer
+@@ -981,6 +997,7 @@ int radeon_vm_bo_update(struct radeon_device *rdev,
+ radeon_ib_free(rdev, &ib);
+ return r;
+ }
++ radeon_vm_fence_pts(vm, bo_va->it.start, bo_va->it.last + 1, ib.fence);
+ radeon_fence_unref(&vm->fence);
+ vm->fence = radeon_fence_ref(ib.fence);
+ radeon_ib_free(rdev, &ib);
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
+index 0426b5bed8fc..59e2ae85eed9 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
+@@ -25,6 +25,7 @@
+ *
+ **************************************************************************/
+ #include <linux/module.h>
++#include <linux/console.h>
+
+ #include <drm/drmP.h>
+ #include "vmwgfx_drv.h"
+@@ -1447,6 +1448,12 @@ static int vmw_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ static int __init vmwgfx_init(void)
+ {
+ int ret;
++
++#ifdef CONFIG_VGA_CONSOLE
++ if (vgacon_text_force())
++ return -EINVAL;
++#endif
++
+ ret = drm_pci_init(&driver, &vmw_pci_driver);
+ if (ret)
+ DRM_ERROR("Failed initializing DRM.\n");
+diff --git a/drivers/infiniband/hw/qib/qib_qp.c b/drivers/infiniband/hw/qib/qib_qp.c
+index 6ddc0264aad2..c5b6e60ccad4 100644
+--- a/drivers/infiniband/hw/qib/qib_qp.c
++++ b/drivers/infiniband/hw/qib/qib_qp.c
+@@ -100,9 +100,10 @@ static u32 credit_table[31] = {
+ 32768 /* 1E */
+ };
+
+-static void get_map_page(struct qib_qpn_table *qpt, struct qpn_map *map)
++static void get_map_page(struct qib_qpn_table *qpt, struct qpn_map *map,
++ gfp_t gfp)
+ {
+- unsigned long page = get_zeroed_page(GFP_KERNEL);
++ unsigned long page = get_zeroed_page(gfp);
+
+ /*
+ * Free the page if someone raced with us installing it.
+@@ -121,7 +122,7 @@ static void get_map_page(struct qib_qpn_table *qpt, struct qpn_map *map)
+ * zero/one for QP type IB_QPT_SMI/IB_QPT_GSI.
+ */
+ static int alloc_qpn(struct qib_devdata *dd, struct qib_qpn_table *qpt,
+- enum ib_qp_type type, u8 port)
++ enum ib_qp_type type, u8 port, gfp_t gfp)
+ {
+ u32 i, offset, max_scan, qpn;
+ struct qpn_map *map;
+@@ -151,7 +152,7 @@ static int alloc_qpn(struct qib_devdata *dd, struct qib_qpn_table *qpt,
+ max_scan = qpt->nmaps - !offset;
+ for (i = 0;;) {
+ if (unlikely(!map->page)) {
+- get_map_page(qpt, map);
++ get_map_page(qpt, map, gfp);
+ if (unlikely(!map->page))
+ break;
+ }
+@@ -983,13 +984,21 @@ struct ib_qp *qib_create_qp(struct ib_pd *ibpd,
+ size_t sz;
+ size_t sg_list_sz;
+ struct ib_qp *ret;
++ gfp_t gfp;
++
+
+ if (init_attr->cap.max_send_sge > ib_qib_max_sges ||
+ init_attr->cap.max_send_wr > ib_qib_max_qp_wrs ||
+- init_attr->create_flags) {
+- ret = ERR_PTR(-EINVAL);
+- goto bail;
+- }
++ init_attr->create_flags & ~(IB_QP_CREATE_USE_GFP_NOIO))
++ return ERR_PTR(-EINVAL);
++
++ /* GFP_NOIO is applicable in RC QPs only */
++ if (init_attr->create_flags & IB_QP_CREATE_USE_GFP_NOIO &&
++ init_attr->qp_type != IB_QPT_RC)
++ return ERR_PTR(-EINVAL);
++
++ gfp = init_attr->create_flags & IB_QP_CREATE_USE_GFP_NOIO ?
++ GFP_NOIO : GFP_KERNEL;
+
+ /* Check receive queue parameters if no SRQ is specified. */
+ if (!init_attr->srq) {
+@@ -1021,7 +1030,8 @@ struct ib_qp *qib_create_qp(struct ib_pd *ibpd,
+ sz = sizeof(struct qib_sge) *
+ init_attr->cap.max_send_sge +
+ sizeof(struct qib_swqe);
+- swq = vmalloc((init_attr->cap.max_send_wr + 1) * sz);
++ swq = __vmalloc((init_attr->cap.max_send_wr + 1) * sz,
++ gfp, PAGE_KERNEL);
+ if (swq == NULL) {
+ ret = ERR_PTR(-ENOMEM);
+ goto bail;
+@@ -1037,13 +1047,13 @@ struct ib_qp *qib_create_qp(struct ib_pd *ibpd,
+ } else if (init_attr->cap.max_recv_sge > 1)
+ sg_list_sz = sizeof(*qp->r_sg_list) *
+ (init_attr->cap.max_recv_sge - 1);
+- qp = kzalloc(sz + sg_list_sz, GFP_KERNEL);
++ qp = kzalloc(sz + sg_list_sz, gfp);
+ if (!qp) {
+ ret = ERR_PTR(-ENOMEM);
+ goto bail_swq;
+ }
+ RCU_INIT_POINTER(qp->next, NULL);
+- qp->s_hdr = kzalloc(sizeof(*qp->s_hdr), GFP_KERNEL);
++ qp->s_hdr = kzalloc(sizeof(*qp->s_hdr), gfp);
+ if (!qp->s_hdr) {
+ ret = ERR_PTR(-ENOMEM);
+ goto bail_qp;
+@@ -1058,8 +1068,16 @@ struct ib_qp *qib_create_qp(struct ib_pd *ibpd,
+ qp->r_rq.max_sge = init_attr->cap.max_recv_sge;
+ sz = (sizeof(struct ib_sge) * qp->r_rq.max_sge) +
+ sizeof(struct qib_rwqe);
+- qp->r_rq.wq = vmalloc_user(sizeof(struct qib_rwq) +
+- qp->r_rq.size * sz);
++ if (gfp != GFP_NOIO)
++ qp->r_rq.wq = vmalloc_user(
++ sizeof(struct qib_rwq) +
++ qp->r_rq.size * sz);
++ else
++ qp->r_rq.wq = __vmalloc(
++ sizeof(struct qib_rwq) +
++ qp->r_rq.size * sz,
++ gfp, PAGE_KERNEL);
++
+ if (!qp->r_rq.wq) {
+ ret = ERR_PTR(-ENOMEM);
+ goto bail_qp;
+@@ -1090,7 +1108,7 @@ struct ib_qp *qib_create_qp(struct ib_pd *ibpd,
+ dev = to_idev(ibpd->device);
+ dd = dd_from_dev(dev);
+ err = alloc_qpn(dd, &dev->qpn_table, init_attr->qp_type,
+- init_attr->port_num);
++ init_attr->port_num, gfp);
+ if (err < 0) {
+ ret = ERR_PTR(err);
+ vfree(qp->r_rq.wq);
+diff --git a/drivers/infiniband/hw/qib/qib_verbs_mcast.c b/drivers/infiniband/hw/qib/qib_verbs_mcast.c
+index dabb697b1c2a..48ba1c3e945a 100644
+--- a/drivers/infiniband/hw/qib/qib_verbs_mcast.c
++++ b/drivers/infiniband/hw/qib/qib_verbs_mcast.c
+@@ -286,15 +286,13 @@ int qib_multicast_detach(struct ib_qp *ibqp, union ib_gid *gid, u16 lid)
+ struct qib_ibdev *dev = to_idev(ibqp->device);
+ struct qib_ibport *ibp = to_iport(ibqp->device, qp->port_num);
+ struct qib_mcast *mcast = NULL;
+- struct qib_mcast_qp *p, *tmp;
++ struct qib_mcast_qp *p, *tmp, *delp = NULL;
+ struct rb_node *n;
+ int last = 0;
+ int ret;
+
+- if (ibqp->qp_num <= 1 || qp->state == IB_QPS_RESET) {
+- ret = -EINVAL;
+- goto bail;
+- }
++ if (ibqp->qp_num <= 1 || qp->state == IB_QPS_RESET)
++ return -EINVAL;
+
+ spin_lock_irq(&ibp->lock);
+
+@@ -303,8 +301,7 @@ int qib_multicast_detach(struct ib_qp *ibqp, union ib_gid *gid, u16 lid)
+ while (1) {
+ if (n == NULL) {
+ spin_unlock_irq(&ibp->lock);
+- ret = -EINVAL;
+- goto bail;
++ return -EINVAL;
+ }
+
+ mcast = rb_entry(n, struct qib_mcast, rb_node);
+@@ -328,6 +325,7 @@ int qib_multicast_detach(struct ib_qp *ibqp, union ib_gid *gid, u16 lid)
+ */
+ list_del_rcu(&p->list);
+ mcast->n_attached--;
++ delp = p;
+
+ /* If this was the last attached QP, remove the GID too. */
+ if (list_empty(&mcast->qp_list)) {
+@@ -338,15 +336,16 @@ int qib_multicast_detach(struct ib_qp *ibqp, union ib_gid *gid, u16 lid)
+ }
+
+ spin_unlock_irq(&ibp->lock);
++ /* QP not attached */
++ if (!delp)
++ return -EINVAL;
++ /*
++ * Wait for any list walkers to finish before freeing the
++ * list element.
++ */
++ wait_event(mcast->wait, atomic_read(&mcast->refcount) <= 1);
++ qib_mcast_qp_free(delp);
+
+- if (p) {
+- /*
+- * Wait for any list walkers to finish before freeing the
+- * list element.
+- */
+- wait_event(mcast->wait, atomic_read(&mcast->refcount) <= 1);
+- qib_mcast_qp_free(p);
+- }
+ if (last) {
+ atomic_dec(&mcast->refcount);
+ wait_event(mcast->wait, !atomic_read(&mcast->refcount));
+@@ -355,11 +354,7 @@ int qib_multicast_detach(struct ib_qp *ibqp, union ib_gid *gid, u16 lid)
+ dev->n_mcast_grps_allocated--;
+ spin_unlock_irq(&dev->n_mcast_grps_lock);
+ }
+-
+- ret = 0;
+-
+-bail:
+- return ret;
++ return 0;
+ }
+
+ int qib_mcast_tree_empty(struct qib_ibport *ibp)
+diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c
+index aa7f9209ac6c..b3b2a137e55e 100644
+--- a/drivers/input/mouse/elantech.c
++++ b/drivers/input/mouse/elantech.c
+@@ -1214,7 +1214,7 @@ static int elantech_set_input_params(struct psmouse *psmouse)
+ input_set_abs_params(dev, ABS_TOOL_WIDTH, ETP_WMIN_V2,
+ ETP_WMAX_V2, 0, 0);
+ }
+- input_mt_init_slots(dev, 2, 0);
++ input_mt_init_slots(dev, 2, INPUT_MT_SEMI_MT);
+ input_set_abs_params(dev, ABS_MT_POSITION_X, x_min, x_max, 0, 0);
+ input_set_abs_params(dev, ABS_MT_POSITION_Y, y_min, y_max, 0, 0);
+ break;
+diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h
+index 39bec4715f2c..89daac119a69 100644
+--- a/drivers/input/serio/i8042-x86ia64io.h
++++ b/drivers/input/serio/i8042-x86ia64io.h
+@@ -258,6 +258,13 @@ static const struct dmi_system_id __initconst i8042_dmi_nomux_table[] = {
+ },
+ },
+ {
++ /* Fujitsu Lifebook U745 */
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK U745"),
++ },
++ },
++ {
+ /* Fujitsu T70H */
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
+diff --git a/drivers/irqchip/irq-atmel-aic-common.c b/drivers/irqchip/irq-atmel-aic-common.c
+index fa22e5ba3d33..d84c742dd073 100644
+--- a/drivers/irqchip/irq-atmel-aic-common.c
++++ b/drivers/irqchip/irq-atmel-aic-common.c
+@@ -86,7 +86,7 @@ int aic_common_set_priority(int priority, unsigned *val)
+ priority > AT91_AIC_IRQ_MAX_PRIORITY)
+ return -EINVAL;
+
+- *val &= AT91_AIC_PRIOR;
++ *val &= ~AT91_AIC_PRIOR;
+ *val |= priority;
+
+ return 0;
+diff --git a/drivers/isdn/i4l/isdn_ppp.c b/drivers/isdn/i4l/isdn_ppp.c
+index c4198fa490bf..9c1e8adaf4fc 100644
+--- a/drivers/isdn/i4l/isdn_ppp.c
++++ b/drivers/isdn/i4l/isdn_ppp.c
+@@ -301,6 +301,8 @@ isdn_ppp_open(int min, struct file *file)
+ is->compflags = 0;
+
+ is->reset = isdn_ppp_ccp_reset_alloc(is);
++ if (!is->reset)
++ return -ENOMEM;
+
+ is->lp = NULL;
+ is->mp_seqno = 0; /* MP sequence number */
+@@ -320,6 +322,10 @@ isdn_ppp_open(int min, struct file *file)
+ * VJ header compression init
+ */
+ is->slcomp = slhc_init(16, 16); /* not necessary for 2. link in bundle */
++ if (IS_ERR(is->slcomp)) {
++ isdn_ppp_ccp_reset_free(is);
++ return PTR_ERR(is->slcomp);
++ }
+ #endif
+ #ifdef CONFIG_IPPP_FILTER
+ is->pass_filter = NULL;
+@@ -567,10 +573,8 @@ isdn_ppp_ioctl(int min, struct file *file, unsigned int cmd, unsigned long arg)
+ is->maxcid = val;
+ #ifdef CONFIG_ISDN_PPP_VJ
+ sltmp = slhc_init(16, val);
+- if (!sltmp) {
+- printk(KERN_ERR "ippp, can't realloc slhc struct\n");
+- return -ENOMEM;
+- }
++ if (IS_ERR(sltmp))
++ return PTR_ERR(sltmp);
+ if (is->slcomp)
+ slhc_free(is->slcomp);
+ is->slcomp = sltmp;
+diff --git a/drivers/md/bcache/btree.c b/drivers/md/bcache/btree.c
+index 00cde40db572..43829d9493f7 100644
+--- a/drivers/md/bcache/btree.c
++++ b/drivers/md/bcache/btree.c
+@@ -1741,6 +1741,7 @@ static void bch_btree_gc(struct cache_set *c)
+ do {
+ ret = btree_root(gc_root, c, &op, &writes, &stats);
+ closure_sync(&writes);
++ cond_resched();
+
+ if (ret && ret != -EAGAIN)
+ pr_warn("gc failed!");
+@@ -2162,8 +2163,10 @@ int bch_btree_insert_check_key(struct btree *b, struct btree_op *op,
+ rw_lock(true, b, b->level);
+
+ if (b->key.ptr[0] != btree_ptr ||
+- b->seq != seq + 1)
++ b->seq != seq + 1) {
++ op->lock = b->level;
+ goto out;
++ }
+ }
+
+ SET_KEY_PTRS(check_key, 1);
+diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
+index 4dd2bb7167f0..42522c8f13c6 100644
+--- a/drivers/md/bcache/super.c
++++ b/drivers/md/bcache/super.c
+@@ -708,6 +708,8 @@ static void bcache_device_link(struct bcache_device *d, struct cache_set *c,
+ WARN(sysfs_create_link(&d->kobj, &c->kobj, "cache") ||
+ sysfs_create_link(&c->kobj, &d->kobj, d->name),
+ "Couldn't create device <-> cache set symlinks");
++
++ clear_bit(BCACHE_DEV_UNLINK_DONE, &d->flags);
+ }
+
+ static void bcache_device_detach(struct bcache_device *d)
+@@ -878,8 +880,11 @@ void bch_cached_dev_run(struct cached_dev *dc)
+ buf[SB_LABEL_SIZE] = '\0';
+ env[2] = kasprintf(GFP_KERNEL, "CACHED_LABEL=%s", buf);
+
+- if (atomic_xchg(&dc->running, 1))
++ if (atomic_xchg(&dc->running, 1)) {
++ kfree(env[1]);
++ kfree(env[2]);
+ return;
++ }
+
+ if (!d->c &&
+ BDEV_STATE(&dc->sb) != BDEV_STATE_NONE) {
+@@ -1967,6 +1972,8 @@ static ssize_t register_bcache(struct kobject *k, struct kobj_attribute *attr,
+ else
+ err = "device busy";
+ mutex_unlock(&bch_register_lock);
++ if (attr == &ksysfs_register_quiet)
++ goto out;
+ }
+ goto err;
+ }
+@@ -2005,8 +2012,7 @@ out:
+ err_close:
+ blkdev_put(bdev, FMODE_READ|FMODE_WRITE|FMODE_EXCL);
+ err:
+- if (attr != &ksysfs_register_quiet)
+- pr_info("error opening %s: %s", path, err);
++ pr_info("error opening %s: %s", path, err);
+ ret = -EINVAL;
+ goto out;
+ }
+@@ -2100,8 +2106,10 @@ static int __init bcache_init(void)
+ closure_debug_init();
+
+ bcache_major = register_blkdev(0, "bcache");
+- if (bcache_major < 0)
++ if (bcache_major < 0) {
++ unregister_reboot_notifier(&reboot);
+ return bcache_major;
++ }
+
+ if (!(bcache_wq = create_workqueue("bcache")) ||
+ !(bcache_kobj = kobject_create_and_add("bcache", fs_kobj)) ||
+diff --git a/drivers/md/bcache/writeback.c b/drivers/md/bcache/writeback.c
+index f1986bcd1bf0..540256a0df4f 100644
+--- a/drivers/md/bcache/writeback.c
++++ b/drivers/md/bcache/writeback.c
+@@ -323,6 +323,10 @@ void bcache_dev_sectors_dirty_add(struct cache_set *c, unsigned inode,
+
+ static bool dirty_pred(struct keybuf *buf, struct bkey *k)
+ {
++ struct cached_dev *dc = container_of(buf, struct cached_dev, writeback_keys);
++
++ BUG_ON(KEY_INODE(k) != dc->disk.id);
++
+ return KEY_DIRTY(k);
+ }
+
+@@ -372,11 +376,24 @@ next:
+ }
+ }
+
++/*
++ * Returns true if we scanned the entire disk
++ */
+ static bool refill_dirty(struct cached_dev *dc)
+ {
+ struct keybuf *buf = &dc->writeback_keys;
++ struct bkey start = KEY(dc->disk.id, 0, 0);
+ struct bkey end = KEY(dc->disk.id, MAX_KEY_OFFSET, 0);
+- bool searched_from_start = false;
++ struct bkey start_pos;
++
++ /*
++ * make sure keybuf pos is inside the range for this disk - at bringup
++ * we might not be attached yet so this disk's inode nr isn't
++ * initialized then
++ */
++ if (bkey_cmp(&buf->last_scanned, &start) < 0 ||
++ bkey_cmp(&buf->last_scanned, &end) > 0)
++ buf->last_scanned = start;
+
+ if (dc->partial_stripes_expensive) {
+ refill_full_stripes(dc);
+@@ -384,14 +401,20 @@ static bool refill_dirty(struct cached_dev *dc)
+ return false;
+ }
+
+- if (bkey_cmp(&buf->last_scanned, &end) >= 0) {
+- buf->last_scanned = KEY(dc->disk.id, 0, 0);
+- searched_from_start = true;
+- }
+-
++ start_pos = buf->last_scanned;
+ bch_refill_keybuf(dc->disk.c, buf, &end, dirty_pred);
+
+- return bkey_cmp(&buf->last_scanned, &end) >= 0 && searched_from_start;
++ if (bkey_cmp(&buf->last_scanned, &end) < 0)
++ return false;
++
++ /*
++ * If we get to the end start scanning again from the beginning, and
++ * only scan up to where we initially started scanning from:
++ */
++ buf->last_scanned = start;
++ bch_refill_keybuf(dc->disk.c, buf, &start_pos, dirty_pred);
++
++ return bkey_cmp(&buf->last_scanned, &start_pos) >= 0;
+ }
+
+ static int bch_writeback_thread(void *arg)
+diff --git a/drivers/md/bcache/writeback.h b/drivers/md/bcache/writeback.h
+index 0a9dab187b79..073a042aed24 100644
+--- a/drivers/md/bcache/writeback.h
++++ b/drivers/md/bcache/writeback.h
+@@ -63,7 +63,8 @@ static inline bool should_writeback(struct cached_dev *dc, struct bio *bio,
+
+ static inline void bch_writeback_queue(struct cached_dev *dc)
+ {
+- wake_up_process(dc->writeback_thread);
++ if (!IS_ERR_OR_NULL(dc->writeback_thread))
++ wake_up_process(dc->writeback_thread);
+ }
+
+ static inline void bch_writeback_add(struct cached_dev *dc)
+diff --git a/drivers/md/dm-exception-store.h b/drivers/md/dm-exception-store.h
+index 0b2536247cf5..84e27708ad97 100644
+--- a/drivers/md/dm-exception-store.h
++++ b/drivers/md/dm-exception-store.h
+@@ -70,7 +70,7 @@ struct dm_exception_store_type {
+ * Update the metadata with this exception.
+ */
+ void (*commit_exception) (struct dm_exception_store *store,
+- struct dm_exception *e,
++ struct dm_exception *e, int valid,
+ void (*callback) (void *, int success),
+ void *callback_context);
+
+diff --git a/drivers/md/dm-snap-persistent.c b/drivers/md/dm-snap-persistent.c
+index d6e88178d22c..d3272acc0f0e 100644
+--- a/drivers/md/dm-snap-persistent.c
++++ b/drivers/md/dm-snap-persistent.c
+@@ -700,7 +700,7 @@ static int persistent_prepare_exception(struct dm_exception_store *store,
+ }
+
+ static void persistent_commit_exception(struct dm_exception_store *store,
+- struct dm_exception *e,
++ struct dm_exception *e, int valid,
+ void (*callback) (void *, int success),
+ void *callback_context)
+ {
+@@ -709,6 +709,9 @@ static void persistent_commit_exception(struct dm_exception_store *store,
+ struct core_exception ce;
+ struct commit_callback *cb;
+
++ if (!valid)
++ ps->valid = 0;
++
+ ce.old_chunk = e->old_chunk;
+ ce.new_chunk = e->new_chunk;
+ write_exception(ps, ps->current_committed++, &ce);
+diff --git a/drivers/md/dm-snap-transient.c b/drivers/md/dm-snap-transient.c
+index 1ce9a2586e41..31439d53cf7e 100644
+--- a/drivers/md/dm-snap-transient.c
++++ b/drivers/md/dm-snap-transient.c
+@@ -52,12 +52,12 @@ static int transient_prepare_exception(struct dm_exception_store *store,
+ }
+
+ static void transient_commit_exception(struct dm_exception_store *store,
+- struct dm_exception *e,
++ struct dm_exception *e, int valid,
+ void (*callback) (void *, int success),
+ void *callback_context)
+ {
+ /* Just succeed */
+- callback(callback_context, 1);
++ callback(callback_context, valid);
+ }
+
+ static void transient_usage(struct dm_exception_store *store,
+diff --git a/drivers/md/dm-snap.c b/drivers/md/dm-snap.c
+index 33de9f7a7180..b91b39caf7a9 100644
+--- a/drivers/md/dm-snap.c
++++ b/drivers/md/dm-snap.c
+@@ -1428,8 +1428,9 @@ static void __invalidate_snapshot(struct dm_snapshot *s, int err)
+ dm_table_event(s->ti->table);
+ }
+
+-static void pending_complete(struct dm_snap_pending_exception *pe, int success)
++static void pending_complete(void *context, int success)
+ {
++ struct dm_snap_pending_exception *pe = context;
+ struct dm_exception *e;
+ struct dm_snapshot *s = pe->snap;
+ struct bio *origin_bios = NULL;
+@@ -1500,24 +1501,13 @@ out:
+ free_pending_exception(pe);
+ }
+
+-static void commit_callback(void *context, int success)
+-{
+- struct dm_snap_pending_exception *pe = context;
+-
+- pending_complete(pe, success);
+-}
+-
+ static void complete_exception(struct dm_snap_pending_exception *pe)
+ {
+ struct dm_snapshot *s = pe->snap;
+
+- if (unlikely(pe->copy_error))
+- pending_complete(pe, 0);
+-
+- else
+- /* Update the metadata if we are persistent */
+- s->store->type->commit_exception(s->store, &pe->e,
+- commit_callback, pe);
++ /* Update the metadata if we are persistent */
++ s->store->type->commit_exception(s->store, &pe->e, !pe->copy_error,
++ pending_complete, pe);
+ }
+
+ /*
+diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c
+index a7c9685c52f6..9dfe2bb713c5 100644
+--- a/drivers/md/dm-thin.c
++++ b/drivers/md/dm-thin.c
+@@ -2790,8 +2790,8 @@ static void pool_postsuspend(struct dm_target *ti)
+ struct pool_c *pt = ti->private;
+ struct pool *pool = pt->pool;
+
+- cancel_delayed_work(&pool->waker);
+- cancel_delayed_work(&pool->no_space_timeout);
++ cancel_delayed_work_sync(&pool->waker);
++ cancel_delayed_work_sync(&pool->no_space_timeout);
+ flush_workqueue(pool->wq);
+ (void) commit(pool);
+ }
+diff --git a/drivers/media/dvb-core/dvb_frontend.c b/drivers/media/dvb-core/dvb_frontend.c
+index 2cf30576bf39..61b9415088c8 100644
+--- a/drivers/media/dvb-core/dvb_frontend.c
++++ b/drivers/media/dvb-core/dvb_frontend.c
+@@ -2214,9 +2214,9 @@ static int dvb_frontend_ioctl_legacy(struct file *file,
+ dev_dbg(fe->dvb->device, "%s: current delivery system on cache: %d, V3 type: %d\n",
+ __func__, c->delivery_system, fe->ops.info.type);
+
+- /* Force the CAN_INVERSION_AUTO bit on. If the frontend doesn't
+- * do it, it is done for it. */
+- info->caps |= FE_CAN_INVERSION_AUTO;
++ /* Set CAN_INVERSION_AUTO bit on in other than oneshot mode */
++ if (!(fepriv->tune_mode_flags & FE_TUNE_MODE_ONESHOT))
++ info->caps |= FE_CAN_INVERSION_AUTO;
+ err = 0;
+ break;
+ }
+diff --git a/drivers/media/dvb-frontends/tda1004x.c b/drivers/media/dvb-frontends/tda1004x.c
+index a2631be7ffac..08e0f0dd8728 100644
+--- a/drivers/media/dvb-frontends/tda1004x.c
++++ b/drivers/media/dvb-frontends/tda1004x.c
+@@ -903,9 +903,18 @@ static int tda1004x_get_fe(struct dvb_frontend *fe)
+ {
+ struct dtv_frontend_properties *fe_params = &fe->dtv_property_cache;
+ struct tda1004x_state* state = fe->demodulator_priv;
++ int status;
+
+ dprintk("%s\n", __func__);
+
++ status = tda1004x_read_byte(state, TDA1004X_STATUS_CD);
++ if (status == -1)
++ return -EIO;
++
++ /* Only update the properties cache if device is locked */
++ if (!(status & 8))
++ return 0;
++
+ // inversion status
+ fe_params->inversion = INVERSION_OFF;
+ if (tda1004x_read_byte(state, TDA1004X_CONFC1) & 0x20)
+diff --git a/drivers/media/pci/saa7134/saa7134-alsa.c b/drivers/media/pci/saa7134/saa7134-alsa.c
+index 40569894c1c9..a769007672b3 100644
+--- a/drivers/media/pci/saa7134/saa7134-alsa.c
++++ b/drivers/media/pci/saa7134/saa7134-alsa.c
+@@ -1220,6 +1220,8 @@ static int alsa_device_init(struct saa7134_dev *dev)
+
+ static int alsa_device_exit(struct saa7134_dev *dev)
+ {
++ if (!snd_saa7134_cards[dev->nr])
++ return 1;
+
+ snd_card_free(snd_saa7134_cards[dev->nr]);
+ snd_saa7134_cards[dev->nr] = NULL;
+@@ -1269,7 +1271,8 @@ static void saa7134_alsa_exit(void)
+ int idx;
+
+ for (idx = 0; idx < SNDRV_CARDS; idx++) {
+- snd_card_free(snd_saa7134_cards[idx]);
++ if (snd_saa7134_cards[idx])
++ snd_card_free(snd_saa7134_cards[idx]);
+ }
+
+ saa7134_dmasound_init = NULL;
+diff --git a/drivers/media/usb/gspca/ov534.c b/drivers/media/usb/gspca/ov534.c
+index 90f0d637cd9d..cd05840abc91 100644
+--- a/drivers/media/usb/gspca/ov534.c
++++ b/drivers/media/usb/gspca/ov534.c
+@@ -1490,8 +1490,13 @@ static void sd_set_streamparm(struct gspca_dev *gspca_dev,
+ struct v4l2_fract *tpf = &cp->timeperframe;
+ struct sd *sd = (struct sd *) gspca_dev;
+
+- /* Set requested framerate */
+- sd->frame_rate = tpf->denominator / tpf->numerator;
++ if (tpf->numerator == 0 || tpf->denominator == 0)
++ /* Set default framerate */
++ sd->frame_rate = 30;
++ else
++ /* Set requested framerate */
++ sd->frame_rate = tpf->denominator / tpf->numerator;
++
+ if (gspca_dev->streaming)
+ set_frame_rate(gspca_dev);
+
+diff --git a/drivers/media/usb/gspca/topro.c b/drivers/media/usb/gspca/topro.c
+index 5fcd1eec2004..b10d77c5d9aa 100644
+--- a/drivers/media/usb/gspca/topro.c
++++ b/drivers/media/usb/gspca/topro.c
+@@ -4800,7 +4800,11 @@ static void sd_set_streamparm(struct gspca_dev *gspca_dev,
+ struct v4l2_fract *tpf = &cp->timeperframe;
+ int fr, i;
+
+- sd->framerate = tpf->denominator / tpf->numerator;
++ if (tpf->numerator == 0 || tpf->denominator == 0)
++ sd->framerate = 30;
++ else
++ sd->framerate = tpf->denominator / tpf->numerator;
++
+ if (gspca_dev->streaming)
+ setframerate(gspca_dev, v4l2_ctrl_g_ctrl(gspca_dev->exposure));
+
+diff --git a/drivers/media/v4l2-core/videobuf2-core.c b/drivers/media/v4l2-core/videobuf2-core.c
+index cc9537ef4829..1d1c4d35a1a6 100644
+--- a/drivers/media/v4l2-core/videobuf2-core.c
++++ b/drivers/media/v4l2-core/videobuf2-core.c
+@@ -2618,10 +2618,10 @@ unsigned int vb2_poll(struct vb2_queue *q, struct file *file, poll_table *wait)
+ return res | POLLERR;
+
+ /*
+- * For output streams you can write as long as there are fewer buffers
+- * queued than there are buffers available.
++ * For output streams you can call write() as long as there are fewer
++ * buffers queued than there are buffers available.
+ */
+- if (V4L2_TYPE_IS_OUTPUT(q->type) && q->queued_count < q->num_buffers)
++ if (V4L2_TYPE_IS_OUTPUT(q->type) && q->fileio && q->queued_count < q->num_buffers)
+ return res | POLLOUT | POLLWRNORM;
+
+ if (list_empty(&q->done_list))
+diff --git a/drivers/mmc/core/core.c b/drivers/mmc/core/core.c
+index 9a8cb9cd852d..01315db9a81a 100644
+--- a/drivers/mmc/core/core.c
++++ b/drivers/mmc/core/core.c
+@@ -1068,6 +1068,30 @@ void mmc_set_ungated(struct mmc_host *host)
+ }
+ #endif
+
++int mmc_execute_tuning(struct mmc_card *card)
++{
++ struct mmc_host *host = card->host;
++ u32 opcode;
++ int err;
++
++ if (!host->ops->execute_tuning)
++ return 0;
++
++ if (mmc_card_mmc(card))
++ opcode = MMC_SEND_TUNING_BLOCK_HS200;
++ else
++ opcode = MMC_SEND_TUNING_BLOCK;
++
++ mmc_host_clk_hold(host);
++ err = host->ops->execute_tuning(host, opcode);
++ mmc_host_clk_release(host);
++
++ if (err)
++ pr_err("%s: tuning execution failed\n", mmc_hostname(host));
++
++ return err;
++}
++
+ /*
+ * Change the bus mode (open drain/push-pull) of a host.
+ */
+diff --git a/drivers/mmc/core/core.h b/drivers/mmc/core/core.h
+index 443a584660f0..3ea5ad3a252a 100644
+--- a/drivers/mmc/core/core.h
++++ b/drivers/mmc/core/core.h
+@@ -81,5 +81,8 @@ void mmc_add_card_debugfs(struct mmc_card *card);
+ void mmc_remove_card_debugfs(struct mmc_card *card);
+
+ void mmc_init_context_info(struct mmc_host *host);
++
++int mmc_execute_tuning(struct mmc_card *card);
++
+ #endif
+
+diff --git a/drivers/mmc/core/mmc.c b/drivers/mmc/core/mmc.c
+index a301a78a2bd1..66c5c9f313a0 100644
+--- a/drivers/mmc/core/mmc.c
++++ b/drivers/mmc/core/mmc.c
+@@ -998,7 +998,7 @@ static int mmc_select_hs_ddr(struct mmc_card *card)
+ ext_csd_bits,
+ card->ext_csd.generic_cmd6_time);
+ if (err) {
+- pr_warn("%s: switch to bus width %d ddr failed\n",
++ pr_err("%s: switch to bus width %d ddr failed\n",
+ mmc_hostname(host), 1 << bus_width);
+ return err;
+ }
+@@ -1069,7 +1069,7 @@ static int mmc_select_hs400(struct mmc_card *card)
+ card->ext_csd.generic_cmd6_time,
+ true, true, true);
+ if (err) {
+- pr_warn("%s: switch to high-speed from hs200 failed, err:%d\n",
++ pr_err("%s: switch to high-speed from hs200 failed, err:%d\n",
+ mmc_hostname(host), err);
+ return err;
+ }
+@@ -1079,7 +1079,7 @@ static int mmc_select_hs400(struct mmc_card *card)
+ EXT_CSD_DDR_BUS_WIDTH_8,
+ card->ext_csd.generic_cmd6_time);
+ if (err) {
+- pr_warn("%s: switch to bus width for hs400 failed, err:%d\n",
++ pr_err("%s: switch to bus width for hs400 failed, err:%d\n",
+ mmc_hostname(host), err);
+ return err;
+ }
+@@ -1089,7 +1089,7 @@ static int mmc_select_hs400(struct mmc_card *card)
+ card->ext_csd.generic_cmd6_time,
+ true, true, true);
+ if (err) {
+- pr_warn("%s: switch to hs400 failed, err:%d\n",
++ pr_err("%s: switch to hs400 failed, err:%d\n",
+ mmc_hostname(host), err);
+ return err;
+ }
+@@ -1214,7 +1214,6 @@ EXPORT_SYMBOL(tuning_blk_pattern_8bit);
+ static int mmc_hs200_tuning(struct mmc_card *card)
+ {
+ struct mmc_host *host = card->host;
+- int err = 0;
+
+ /*
+ * Timing should be adjusted to the HS400 target
+@@ -1225,18 +1224,7 @@ static int mmc_hs200_tuning(struct mmc_card *card)
+ if (host->ops->prepare_hs400_tuning)
+ host->ops->prepare_hs400_tuning(host, &host->ios);
+
+- if (host->ops->execute_tuning) {
+- mmc_host_clk_hold(host);
+- err = host->ops->execute_tuning(host,
+- MMC_SEND_TUNING_BLOCK_HS200);
+- mmc_host_clk_release(host);
+-
+- if (err)
+- pr_warn("%s: tuning execution failed\n",
+- mmc_hostname(host));
+- }
+-
+- return err;
++ return mmc_execute_tuning(card);
+ }
+
+ /*
+@@ -1458,18 +1446,18 @@ static int mmc_init_card(struct mmc_host *host, u32 ocr,
+ if (mmc_card_hs200(card)) {
+ err = mmc_hs200_tuning(card);
+ if (err)
+- goto err;
++ goto free_card;
+
+ err = mmc_select_hs400(card);
+ if (err)
+- goto err;
++ goto free_card;
+ } else if (mmc_card_hs(card)) {
+ /* Select the desired bus width optionally */
+ err = mmc_select_bus_width(card);
+ if (!IS_ERR_VALUE(err)) {
+ err = mmc_select_hs_ddr(card);
+ if (err)
+- goto err;
++ goto free_card;
+ }
+ }
+
+diff --git a/drivers/mmc/core/sd.c b/drivers/mmc/core/sd.c
+index d90a6de7901d..d4c8c6fa369f 100644
+--- a/drivers/mmc/core/sd.c
++++ b/drivers/mmc/core/sd.c
+@@ -660,13 +660,24 @@ static int mmc_sd_init_uhs_card(struct mmc_card *card)
+ * SPI mode doesn't define CMD19 and tuning is only valid for SDR50 and
+ * SDR104 mode SD-cards. Note that tuning is mandatory for SDR104.
+ */
+- if (!mmc_host_is_spi(card->host) && card->host->ops->execute_tuning &&
+- (card->sd_bus_speed == UHS_SDR50_BUS_SPEED ||
+- card->sd_bus_speed == UHS_SDR104_BUS_SPEED)) {
+- mmc_host_clk_hold(card->host);
+- err = card->host->ops->execute_tuning(card->host,
+- MMC_SEND_TUNING_BLOCK);
+- mmc_host_clk_release(card->host);
++ if (!mmc_host_is_spi(card->host) &&
++ (card->host->ios.timing == MMC_TIMING_UHS_SDR50 ||
++ card->host->ios.timing == MMC_TIMING_UHS_DDR50 ||
++ card->host->ios.timing == MMC_TIMING_UHS_SDR104)) {
++ err = mmc_execute_tuning(card);
++
++ /*
++ * As SD Specifications Part1 Physical Layer Specification
++ * Version 3.01 says, CMD19 tuning is available for unlocked
++ * cards in transfer state of 1.8V signaling mode. The small
++ * difference between v3.00 and 3.01 spec means that CMD19
++ * tuning is also available for DDR50 mode.
++ */
++ if (err && card->host->ios.timing == MMC_TIMING_UHS_DDR50) {
++ pr_warn("%s: ddr50 tuning failed\n",
++ mmc_hostname(card->host));
++ err = 0;
++ }
+ }
+
+ out:
+diff --git a/drivers/mmc/core/sdio.c b/drivers/mmc/core/sdio.c
+index 2439e717655b..a3582929b2f7 100644
+--- a/drivers/mmc/core/sdio.c
++++ b/drivers/mmc/core/sdio.c
+@@ -567,17 +567,11 @@ static int mmc_sdio_init_uhs_card(struct mmc_card *card)
+ * SPI mode doesn't define CMD19 and tuning is only valid for SDR50 and
+ * SDR104 mode SD-cards. Note that tuning is mandatory for SDR104.
+ */
+- if (!mmc_host_is_spi(card->host) && card->host->ops->execute_tuning &&
+- ((card->sw_caps.sd3_bus_mode & SD_MODE_UHS_SDR50) ||
+- (card->sw_caps.sd3_bus_mode & SD_MODE_UHS_SDR104))) {
+- mmc_host_clk_hold(card->host);
+- err = card->host->ops->execute_tuning(card->host,
+- MMC_SEND_TUNING_BLOCK);
+- mmc_host_clk_release(card->host);
+- }
+-
++ if (!mmc_host_is_spi(card->host) &&
++ ((card->host->ios.timing == MMC_TIMING_UHS_SDR50) ||
++ (card->host->ios.timing == MMC_TIMING_UHS_SDR104)))
++ err = mmc_execute_tuning(card);
+ out:
+-
+ return err;
+ }
+
+@@ -669,7 +663,7 @@ try_again:
+ */
+ if (!powered_resume && (rocr & ocr & R4_18V_PRESENT)) {
+ err = mmc_set_signal_voltage(host, MMC_SIGNAL_VOLTAGE_180,
+- ocr);
++ ocr_card);
+ if (err == -EAGAIN) {
+ sdio_reset(host);
+ mmc_go_idle(host);
+diff --git a/drivers/mmc/host/mmci.c b/drivers/mmc/host/mmci.c
+index 43af791e2e45..3ec7e330f7e5 100644
+--- a/drivers/mmc/host/mmci.c
++++ b/drivers/mmc/host/mmci.c
+@@ -1881,7 +1881,7 @@ static struct amba_id mmci_ids[] = {
+ {
+ .id = 0x00280180,
+ .mask = 0x00ffffff,
+- .data = &variant_u300,
++ .data = &variant_nomadik,
+ },
+ {
+ .id = 0x00480180,
+diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c
+index 023c2010cd75..9109287e47ac 100644
+--- a/drivers/mmc/host/sdhci.c
++++ b/drivers/mmc/host/sdhci.c
+@@ -2681,7 +2681,7 @@ static int sdhci_runtime_pm_put(struct sdhci_host *host)
+
+ static void sdhci_runtime_pm_bus_on(struct sdhci_host *host)
+ {
+- if (host->runtime_suspended || host->bus_on)
++ if (host->bus_on)
+ return;
+ host->bus_on = true;
+ pm_runtime_get_noresume(host->mmc->parent);
+@@ -2689,7 +2689,7 @@ static void sdhci_runtime_pm_bus_on(struct sdhci_host *host)
+
+ static void sdhci_runtime_pm_bus_off(struct sdhci_host *host)
+ {
+- if (host->runtime_suspended || !host->bus_on)
++ if (!host->bus_on)
+ return;
+ host->bus_on = false;
+ pm_runtime_put_noidle(host->mmc->parent);
+diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
+index 081dd70813c8..566054c0eb9a 100644
+--- a/drivers/net/bonding/bond_main.c
++++ b/drivers/net/bonding/bond_main.c
+@@ -1154,7 +1154,6 @@ static int bond_master_upper_dev_link(struct net_device *bond_dev,
+ err = netdev_master_upper_dev_link_private(slave_dev, bond_dev, slave);
+ if (err)
+ return err;
+- slave_dev->flags |= IFF_SLAVE;
+ rtmsg_ifinfo(RTM_NEWLINK, slave_dev, IFF_SLAVE, GFP_KERNEL);
+ return 0;
+ }
+@@ -1362,6 +1361,9 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev)
+ }
+ }
+
++ /* set slave flag before open to prevent IPv6 addrconf */
++ slave_dev->flags |= IFF_SLAVE;
++
+ /* open the slave since the application closed it */
+ res = dev_open(slave_dev);
+ if (res) {
+@@ -1615,6 +1617,7 @@ err_close:
+ dev_close(slave_dev);
+
+ err_restore_mac:
++ slave_dev->flags &= ~IFF_SLAVE;
+ if (!bond->params.fail_over_mac ||
+ BOND_MODE(bond) != BOND_MODE_ACTIVEBACKUP) {
+ /* XXX TODO - fom follow mode needs to change master's
+diff --git a/drivers/net/ieee802154/at86rf230.c b/drivers/net/ieee802154/at86rf230.c
+index c9d2a752abd7..8d05658649db 100644
+--- a/drivers/net/ieee802154/at86rf230.c
++++ b/drivers/net/ieee802154/at86rf230.c
+@@ -1098,7 +1098,7 @@ at86rf230_set_hw_addr_filt(struct ieee802154_dev *dev,
+ {
+ struct at86rf230_local *lp = dev->priv;
+
+- if (changed & IEEE802515_AFILT_SADDR_CHANGED) {
++ if (changed & IEEE802154_AFILT_SADDR_CHANGED) {
+ u16 addr = le16_to_cpu(filt->short_addr);
+
+ dev_vdbg(&lp->spi->dev,
+@@ -1107,7 +1107,7 @@ at86rf230_set_hw_addr_filt(struct ieee802154_dev *dev,
+ __at86rf230_write(lp, RG_SHORT_ADDR_1, addr >> 8);
+ }
+
+- if (changed & IEEE802515_AFILT_PANID_CHANGED) {
++ if (changed & IEEE802154_AFILT_PANID_CHANGED) {
+ u16 pan = le16_to_cpu(filt->pan_id);
+
+ dev_vdbg(&lp->spi->dev,
+@@ -1116,7 +1116,7 @@ at86rf230_set_hw_addr_filt(struct ieee802154_dev *dev,
+ __at86rf230_write(lp, RG_PAN_ID_1, pan >> 8);
+ }
+
+- if (changed & IEEE802515_AFILT_IEEEADDR_CHANGED) {
++ if (changed & IEEE802154_AFILT_IEEEADDR_CHANGED) {
+ u8 i, addr[8];
+
+ memcpy(addr, &filt->ieee_addr, 8);
+@@ -1126,7 +1126,7 @@ at86rf230_set_hw_addr_filt(struct ieee802154_dev *dev,
+ __at86rf230_write(lp, RG_IEEE_ADDR_0 + i, addr[i]);
+ }
+
+- if (changed & IEEE802515_AFILT_PANC_CHANGED) {
++ if (changed & IEEE802154_AFILT_PANC_CHANGED) {
+ dev_vdbg(&lp->spi->dev,
+ "at86rf230_set_hw_addr_filt called for panc change\n");
+ if (filt->pan_coord)
+diff --git a/drivers/net/ieee802154/cc2520.c b/drivers/net/ieee802154/cc2520.c
+index 8a5ac7ab2300..571f280204b6 100644
+--- a/drivers/net/ieee802154/cc2520.c
++++ b/drivers/net/ieee802154/cc2520.c
+@@ -593,7 +593,7 @@ cc2520_filter(struct ieee802154_dev *dev,
+ {
+ struct cc2520_private *priv = dev->priv;
+
+- if (changed & IEEE802515_AFILT_PANID_CHANGED) {
++ if (changed & IEEE802154_AFILT_PANID_CHANGED) {
+ u16 panid = le16_to_cpu(filt->pan_id);
+
+ dev_vdbg(&priv->spi->dev,
+@@ -602,7 +602,7 @@ cc2520_filter(struct ieee802154_dev *dev,
+ sizeof(panid), (u8 *)&panid);
+ }
+
+- if (changed & IEEE802515_AFILT_IEEEADDR_CHANGED) {
++ if (changed & IEEE802154_AFILT_IEEEADDR_CHANGED) {
+ dev_vdbg(&priv->spi->dev,
+ "cc2520_filter called for IEEE addr\n");
+ cc2520_write_ram(priv, CC2520RAM_IEEEADDR,
+@@ -610,7 +610,7 @@ cc2520_filter(struct ieee802154_dev *dev,
+ (u8 *)&filt->ieee_addr);
+ }
+
+- if (changed & IEEE802515_AFILT_SADDR_CHANGED) {
++ if (changed & IEEE802154_AFILT_SADDR_CHANGED) {
+ u16 addr = le16_to_cpu(filt->short_addr);
+
+ dev_vdbg(&priv->spi->dev,
+@@ -619,7 +619,7 @@ cc2520_filter(struct ieee802154_dev *dev,
+ sizeof(addr), (u8 *)&addr);
+ }
+
+- if (changed & IEEE802515_AFILT_PANC_CHANGED) {
++ if (changed & IEEE802154_AFILT_PANC_CHANGED) {
+ dev_vdbg(&priv->spi->dev,
+ "cc2520_filter called for panc change\n");
+ if (filt->pan_coord)
+diff --git a/drivers/net/ieee802154/mrf24j40.c b/drivers/net/ieee802154/mrf24j40.c
+index 07e0b887c350..9fe1c7df5f61 100644
+--- a/drivers/net/ieee802154/mrf24j40.c
++++ b/drivers/net/ieee802154/mrf24j40.c
+@@ -461,7 +461,7 @@ static int mrf24j40_filter(struct ieee802154_dev *dev,
+
+ dev_dbg(printdev(devrec), "filter\n");
+
+- if (changed & IEEE802515_AFILT_SADDR_CHANGED) {
++ if (changed & IEEE802154_AFILT_SADDR_CHANGED) {
+ /* Short Addr */
+ u8 addrh, addrl;
+
+@@ -474,7 +474,7 @@ static int mrf24j40_filter(struct ieee802154_dev *dev,
+ "Set short addr to %04hx\n", filt->short_addr);
+ }
+
+- if (changed & IEEE802515_AFILT_IEEEADDR_CHANGED) {
++ if (changed & IEEE802154_AFILT_IEEEADDR_CHANGED) {
+ /* Device Address */
+ u8 i, addr[8];
+
+@@ -490,7 +490,7 @@ static int mrf24j40_filter(struct ieee802154_dev *dev,
+ #endif
+ }
+
+- if (changed & IEEE802515_AFILT_PANID_CHANGED) {
++ if (changed & IEEE802154_AFILT_PANID_CHANGED) {
+ /* PAN ID */
+ u8 panidl, panidh;
+
+@@ -502,7 +502,7 @@ static int mrf24j40_filter(struct ieee802154_dev *dev,
+ dev_dbg(printdev(devrec), "Set PANID to %04hx\n", filt->pan_id);
+ }
+
+- if (changed & IEEE802515_AFILT_PANC_CHANGED) {
++ if (changed & IEEE802154_AFILT_PANC_CHANGED) {
+ /* Pan Coordinator */
+ u8 val;
+ int ret;
+diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c
+index 6d6c20c3ef7e..fc7b3d76f08e 100644
+--- a/drivers/net/ppp/ppp_generic.c
++++ b/drivers/net/ppp/ppp_generic.c
+@@ -713,10 +713,8 @@ static long ppp_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
+ val &= 0xffff;
+ }
+ vj = slhc_init(val2+1, val+1);
+- if (!vj) {
+- netdev_err(ppp->dev,
+- "PPP: no memory (VJ compressor)\n");
+- err = -ENOMEM;
++ if (IS_ERR(vj)) {
++ err = PTR_ERR(vj);
+ break;
+ }
+ ppp_lock(ppp);
+diff --git a/drivers/net/slip/slhc.c b/drivers/net/slip/slhc.c
+index 079f7adfcde5..27ed25252aac 100644
+--- a/drivers/net/slip/slhc.c
++++ b/drivers/net/slip/slhc.c
+@@ -84,8 +84,9 @@ static long decode(unsigned char **cpp);
+ static unsigned char * put16(unsigned char *cp, unsigned short x);
+ static unsigned short pull16(unsigned char **cpp);
+
+-/* Initialize compression data structure
++/* Allocate compression data structure
+ * slots must be in range 0 to 255 (zero meaning no compression)
++ * Returns pointer to structure or ERR_PTR() on error.
+ */
+ struct slcompress *
+ slhc_init(int rslots, int tslots)
+@@ -94,11 +95,14 @@ slhc_init(int rslots, int tslots)
+ register struct cstate *ts;
+ struct slcompress *comp;
+
++ if (rslots < 0 || rslots > 255 || tslots < 0 || tslots > 255)
++ return ERR_PTR(-EINVAL);
++
+ comp = kzalloc(sizeof(struct slcompress), GFP_KERNEL);
+ if (! comp)
+ goto out_fail;
+
+- if ( rslots > 0 && rslots < 256 ) {
++ if (rslots > 0) {
+ size_t rsize = rslots * sizeof(struct cstate);
+ comp->rstate = kzalloc(rsize, GFP_KERNEL);
+ if (! comp->rstate)
+@@ -106,7 +110,7 @@ slhc_init(int rslots, int tslots)
+ comp->rslot_limit = rslots - 1;
+ }
+
+- if ( tslots > 0 && tslots < 256 ) {
++ if (tslots > 0) {
+ size_t tsize = tslots * sizeof(struct cstate);
+ comp->tstate = kzalloc(tsize, GFP_KERNEL);
+ if (! comp->tstate)
+@@ -141,7 +145,7 @@ out_free2:
+ out_free:
+ kfree(comp);
+ out_fail:
+- return NULL;
++ return ERR_PTR(-ENOMEM);
+ }
+
+
+diff --git a/drivers/net/slip/slip.c b/drivers/net/slip/slip.c
+index 05387b1e2e95..a17d86a57734 100644
+--- a/drivers/net/slip/slip.c
++++ b/drivers/net/slip/slip.c
+@@ -164,7 +164,7 @@ static int sl_alloc_bufs(struct slip *sl, int mtu)
+ if (cbuff == NULL)
+ goto err_exit;
+ slcomp = slhc_init(16, 16);
+- if (slcomp == NULL)
++ if (IS_ERR(slcomp))
+ goto err_exit;
+ #endif
+ spin_lock_bh(&sl->lock);
+diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
+index ebc95a3771a4..16c580379e38 100644
+--- a/drivers/net/team/team.c
++++ b/drivers/net/team/team.c
+@@ -1848,10 +1848,10 @@ static int team_vlan_rx_kill_vid(struct net_device *dev, __be16 proto, u16 vid)
+ struct team *team = netdev_priv(dev);
+ struct team_port *port;
+
+- rcu_read_lock();
+- list_for_each_entry_rcu(port, &team->port_list, list)
++ mutex_lock(&team->lock);
++ list_for_each_entry(port, &team->port_list, list)
+ vlan_vid_del(port->dev, proto, vid);
+- rcu_read_unlock();
++ mutex_unlock(&team->lock);
+
+ return 0;
+ }
+diff --git a/drivers/net/veth.c b/drivers/net/veth.c
+index 8ad596573d17..32ce1cd64d51 100644
+--- a/drivers/net/veth.c
++++ b/drivers/net/veth.c
+@@ -117,12 +117,6 @@ static netdev_tx_t veth_xmit(struct sk_buff *skb, struct net_device *dev)
+ kfree_skb(skb);
+ goto drop;
+ }
+- /* don't change ip_summed == CHECKSUM_PARTIAL, as that
+- * will cause bad checksum on forwarded packets
+- */
+- if (skb->ip_summed == CHECKSUM_NONE &&
+- rcv->features & NETIF_F_RXCSUM)
+- skb->ip_summed = CHECKSUM_UNNECESSARY;
+
+ if (likely(dev_forward_skb(rcv, skb) == NET_RX_SUCCESS)) {
+ struct pcpu_vstats *stats = this_cpu_ptr(dev->vstats);
+diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
+index 2826c5508762..59282dd2d9e0 100644
+--- a/drivers/net/vxlan.c
++++ b/drivers/net/vxlan.c
+@@ -2433,7 +2433,7 @@ static int vxlan_newlink(struct net *net, struct net_device *dev,
+ struct nlattr *tb[], struct nlattr *data[])
+ {
+ struct vxlan_net *vn = net_generic(net, vxlan_net_id);
+- struct vxlan_dev *vxlan = netdev_priv(dev);
++ struct vxlan_dev *vxlan = netdev_priv(dev), *tmp;
+ struct vxlan_rdst *dst = &vxlan->default_dst;
+ __u32 vni;
+ int err;
+@@ -2554,9 +2554,13 @@ static int vxlan_newlink(struct net *net, struct net_device *dev,
+ nla_get_u8(data[IFLA_VXLAN_UDP_ZERO_CSUM6_RX]))
+ vxlan->flags |= VXLAN_F_UDP_ZERO_CSUM6_RX;
+
+- if (vxlan_find_vni(net, vni, use_ipv6 ? AF_INET6 : AF_INET,
+- vxlan->dst_port)) {
+- pr_info("duplicate VNI %u\n", vni);
++ list_for_each_entry(tmp, &vn->vxlan_list, next) {
++ if (tmp->default_dst.remote_vni == vni &&
++ (tmp->default_dst.remote_ip.sa.sa_family == AF_INET6 ||
++ tmp->saddr.sa.sa_family == AF_INET6) == use_ipv6 &&
++ tmp->dst_port == vxlan->dst_port &&
++ (tmp->flags & VXLAN_F_RCV_FLAGS) ==
++ (vxlan->flags & VXLAN_F_RCV_FLAGS))
+ return -EEXIST;
+ }
+
+diff --git a/drivers/net/wireless/iwlwifi/pcie/drv.c b/drivers/net/wireless/iwlwifi/pcie/drv.c
+index a2f624d5771d..8407ce5f672f 100644
+--- a/drivers/net/wireless/iwlwifi/pcie/drv.c
++++ b/drivers/net/wireless/iwlwifi/pcie/drv.c
+@@ -380,6 +380,7 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
+ {IWL_PCI_DEVICE(0x095B, 0x5310, iwl7265_2ac_cfg)},
+ {IWL_PCI_DEVICE(0x095B, 0x5302, iwl7265_n_cfg)},
+ {IWL_PCI_DEVICE(0x095B, 0x5210, iwl7265_2ac_cfg)},
++ {IWL_PCI_DEVICE(0x095A, 0x5C10, iwl7265_2ac_cfg)},
+ {IWL_PCI_DEVICE(0x095A, 0x5012, iwl7265_2ac_cfg)},
+ {IWL_PCI_DEVICE(0x095A, 0x5412, iwl7265_2ac_cfg)},
+ {IWL_PCI_DEVICE(0x095A, 0x5410, iwl7265_2ac_cfg)},
+@@ -397,10 +398,10 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
+ {IWL_PCI_DEVICE(0x095A, 0x900A, iwl7265_2ac_cfg)},
+ {IWL_PCI_DEVICE(0x095A, 0x9110, iwl7265_2ac_cfg)},
+ {IWL_PCI_DEVICE(0x095A, 0x9112, iwl7265_2ac_cfg)},
+- {IWL_PCI_DEVICE(0x095A, 0x9210, iwl7265_2ac_cfg)},
++ {IWL_PCI_DEVICE(0x095B, 0x9210, iwl7265_2ac_cfg)},
+ {IWL_PCI_DEVICE(0x095B, 0x9200, iwl7265_2ac_cfg)},
+ {IWL_PCI_DEVICE(0x095A, 0x9510, iwl7265_2ac_cfg)},
+- {IWL_PCI_DEVICE(0x095A, 0x9310, iwl7265_2ac_cfg)},
++ {IWL_PCI_DEVICE(0x095B, 0x9310, iwl7265_2ac_cfg)},
+ {IWL_PCI_DEVICE(0x095A, 0x9410, iwl7265_2ac_cfg)},
+ {IWL_PCI_DEVICE(0x095A, 0x5020, iwl7265_2n_cfg)},
+ {IWL_PCI_DEVICE(0x095A, 0x502A, iwl7265_2n_cfg)},
+diff --git a/drivers/net/wireless/rtlwifi/pci.c b/drivers/net/wireless/rtlwifi/pci.c
+index 8c45cf44ce24..348d5aec7682 100644
+--- a/drivers/net/wireless/rtlwifi/pci.c
++++ b/drivers/net/wireless/rtlwifi/pci.c
+@@ -801,7 +801,9 @@ static void _rtl_pci_rx_interrupt(struct ieee80211_hw *hw)
+ hw_queue);
+ if (rx_remained_cnt == 0)
+ return;
+-
++ buffer_desc = &rtlpci->rx_ring[rxring_idx].buffer_desc[
++ rtlpci->rx_ring[rxring_idx].idx];
++ pdesc = (struct rtl_rx_desc *)skb->data;
+ } else { /* rx descriptor */
+ pdesc = &rtlpci->rx_ring[rxring_idx].desc[
+ rtlpci->rx_ring[rxring_idx].idx];
+@@ -824,13 +826,6 @@ static void _rtl_pci_rx_interrupt(struct ieee80211_hw *hw)
+ new_skb = dev_alloc_skb(rtlpci->rxbuffersize);
+ if (unlikely(!new_skb))
+ goto no_new;
+- if (rtlpriv->use_new_trx_flow) {
+- buffer_desc =
+- &rtlpci->rx_ring[rxring_idx].buffer_desc
+- [rtlpci->rx_ring[rxring_idx].idx];
+- /*means rx wifi info*/
+- pdesc = (struct rtl_rx_desc *)skb->data;
+- }
+ memset(&rx_status , 0 , sizeof(rx_status));
+ rtlpriv->cfg->ops->query_rx_desc(hw, &stats,
+ &rx_status, (u8 *)pdesc, skb);
+diff --git a/drivers/net/wireless/rtlwifi/rtl8188ee/sw.c b/drivers/net/wireless/rtlwifi/rtl8188ee/sw.c
+index 11344121c55e..47e32cb0ec1a 100644
+--- a/drivers/net/wireless/rtlwifi/rtl8188ee/sw.c
++++ b/drivers/net/wireless/rtlwifi/rtl8188ee/sw.c
+@@ -88,8 +88,6 @@ int rtl88e_init_sw_vars(struct ieee80211_hw *hw)
+ u8 tid;
+
+ rtl8188ee_bt_reg_init(hw);
+- rtlpci->msi_support = rtlpriv->cfg->mod_params->msi_support;
+-
+ rtlpriv->dm.dm_initialgain_enable = 1;
+ rtlpriv->dm.dm_flag = 0;
+ rtlpriv->dm.disable_framebursting = 0;
+@@ -138,6 +136,11 @@ int rtl88e_init_sw_vars(struct ieee80211_hw *hw)
+ rtlpriv->psc.inactiveps = rtlpriv->cfg->mod_params->inactiveps;
+ rtlpriv->psc.swctrl_lps = rtlpriv->cfg->mod_params->swctrl_lps;
+ rtlpriv->psc.fwctrl_lps = rtlpriv->cfg->mod_params->fwctrl_lps;
++ rtlpci->msi_support = rtlpriv->cfg->mod_params->msi_support;
++ rtlpriv->cfg->mod_params->sw_crypto =
++ rtlpriv->cfg->mod_params->sw_crypto;
++ rtlpriv->cfg->mod_params->disable_watchdog =
++ rtlpriv->cfg->mod_params->disable_watchdog;
+ if (rtlpriv->cfg->mod_params->disable_watchdog)
+ pr_info("watchdog disabled\n");
+ if (!rtlpriv->psc.inactiveps)
+diff --git a/drivers/net/wireless/rtlwifi/rtl8192ce/sw.c b/drivers/net/wireless/rtlwifi/rtl8192ce/sw.c
+index dd5aa089126a..1014de80faba 100644
+--- a/drivers/net/wireless/rtlwifi/rtl8192ce/sw.c
++++ b/drivers/net/wireless/rtlwifi/rtl8192ce/sw.c
+@@ -139,6 +139,8 @@ int rtl92c_init_sw_vars(struct ieee80211_hw *hw)
+ rtlpriv->psc.inactiveps = rtlpriv->cfg->mod_params->inactiveps;
+ rtlpriv->psc.swctrl_lps = rtlpriv->cfg->mod_params->swctrl_lps;
+ rtlpriv->psc.fwctrl_lps = rtlpriv->cfg->mod_params->fwctrl_lps;
++ rtlpriv->cfg->mod_params->sw_crypto =
++ rtlpriv->cfg->mod_params->sw_crypto;
+ if (!rtlpriv->psc.inactiveps)
+ pr_info("rtl8192ce: Power Save off (module option)\n");
+ if (!rtlpriv->psc.fwctrl_lps)
+diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
+index 5034660bf411..b2913de70d8d 100644
+--- a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
++++ b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
+@@ -65,6 +65,8 @@ static int rtl92cu_init_sw_vars(struct ieee80211_hw *hw)
+ rtlpriv->dm.disable_framebursting = false;
+ rtlpriv->dm.thermalvalue = 0;
+ rtlpriv->dbg.global_debuglevel = rtlpriv->cfg->mod_params->debug;
++ rtlpriv->cfg->mod_params->sw_crypto =
++ rtlpriv->cfg->mod_params->sw_crypto;
+
+ /* for firmware buf */
+ rtlpriv->rtlhal.pfirmware = vzalloc(0x4000);
+diff --git a/drivers/net/wireless/rtlwifi/rtl8192de/sw.c b/drivers/net/wireless/rtlwifi/rtl8192de/sw.c
+index a0aba088259a..f32c97286bda 100644
+--- a/drivers/net/wireless/rtlwifi/rtl8192de/sw.c
++++ b/drivers/net/wireless/rtlwifi/rtl8192de/sw.c
+@@ -376,8 +376,8 @@ module_param_named(swlps, rtl92de_mod_params.swctrl_lps, bool, 0444);
+ module_param_named(fwlps, rtl92de_mod_params.fwctrl_lps, bool, 0444);
+ MODULE_PARM_DESC(swenc, "Set to 1 for software crypto (default 0)\n");
+ MODULE_PARM_DESC(ips, "Set to 0 to not use link power save (default 1)\n");
+-MODULE_PARM_DESC(swlps, "Set to 1 to use SW control power save (default 0)\n");
+-MODULE_PARM_DESC(fwlps, "Set to 1 to use FW control power save (default 1)\n");
++MODULE_PARM_DESC(swlps, "Set to 1 to use SW control power save (default 1)\n");
++MODULE_PARM_DESC(fwlps, "Set to 1 to use FW control power save (default 0)\n");
+ MODULE_PARM_DESC(debug, "Set debug level (0-5) (default 0)");
+
+ static SIMPLE_DEV_PM_OPS(rtlwifi_pm_ops, rtl_pci_suspend, rtl_pci_resume);
+diff --git a/drivers/net/wireless/rtlwifi/rtl8192se/sw.c b/drivers/net/wireless/rtlwifi/rtl8192se/sw.c
+index fb003868bdef..3279b06fb9a3 100644
+--- a/drivers/net/wireless/rtlwifi/rtl8192se/sw.c
++++ b/drivers/net/wireless/rtlwifi/rtl8192se/sw.c
+@@ -187,6 +187,8 @@ static int rtl92s_init_sw_vars(struct ieee80211_hw *hw)
+ rtlpriv->psc.inactiveps = rtlpriv->cfg->mod_params->inactiveps;
+ rtlpriv->psc.swctrl_lps = rtlpriv->cfg->mod_params->swctrl_lps;
+ rtlpriv->psc.fwctrl_lps = rtlpriv->cfg->mod_params->fwctrl_lps;
++ rtlpriv->cfg->mod_params->sw_crypto =
++ rtlpriv->cfg->mod_params->sw_crypto;
+ if (!rtlpriv->psc.inactiveps)
+ pr_info("Power Save off (module option)\n");
+ if (!rtlpriv->psc.fwctrl_lps)
+@@ -425,8 +427,8 @@ module_param_named(swlps, rtl92se_mod_params.swctrl_lps, bool, 0444);
+ module_param_named(fwlps, rtl92se_mod_params.fwctrl_lps, bool, 0444);
+ MODULE_PARM_DESC(swenc, "Set to 1 for software crypto (default 0)\n");
+ MODULE_PARM_DESC(ips, "Set to 0 to not use link power save (default 1)\n");
+-MODULE_PARM_DESC(swlps, "Set to 1 to use SW control power save (default 0)\n");
+-MODULE_PARM_DESC(fwlps, "Set to 1 to use FW control power save (default 1)\n");
++MODULE_PARM_DESC(swlps, "Set to 1 to use SW control power save (default 1)\n");
++MODULE_PARM_DESC(fwlps, "Set to 1 to use FW control power save (default 0)\n");
+ MODULE_PARM_DESC(debug, "Set debug level (0-5) (default 0)");
+
+ static SIMPLE_DEV_PM_OPS(rtlwifi_pm_ops, rtl_pci_suspend, rtl_pci_resume);
+diff --git a/drivers/net/wireless/rtlwifi/usb.c b/drivers/net/wireless/rtlwifi/usb.c
+index 27cd6cabf6c5..0eb328981d38 100644
+--- a/drivers/net/wireless/rtlwifi/usb.c
++++ b/drivers/net/wireless/rtlwifi/usb.c
+@@ -531,6 +531,8 @@ static void _rtl_usb_rx_process_noagg(struct ieee80211_hw *hw,
+ ieee80211_rx(hw, skb);
+ else
+ dev_kfree_skb_any(skb);
++ } else {
++ dev_kfree_skb_any(skb);
+ }
+ }
+
+diff --git a/drivers/net/wireless/ti/wlcore/io.h b/drivers/net/wireless/ti/wlcore/io.h
+index 0305729d0986..10cf3747694d 100644
+--- a/drivers/net/wireless/ti/wlcore/io.h
++++ b/drivers/net/wireless/ti/wlcore/io.h
+@@ -207,19 +207,23 @@ static inline int __must_check wlcore_write_reg(struct wl1271 *wl, int reg,
+
+ static inline void wl1271_power_off(struct wl1271 *wl)
+ {
+- int ret;
++ int ret = 0;
+
+ if (!test_bit(WL1271_FLAG_GPIO_POWER, &wl->flags))
+ return;
+
+- ret = wl->if_ops->power(wl->dev, false);
++ if (wl->if_ops->power)
++ ret = wl->if_ops->power(wl->dev, false);
+ if (!ret)
+ clear_bit(WL1271_FLAG_GPIO_POWER, &wl->flags);
+ }
+
+ static inline int wl1271_power_on(struct wl1271 *wl)
+ {
+- int ret = wl->if_ops->power(wl->dev, true);
++ int ret = 0;
++
++ if (wl->if_ops->power)
++ ret = wl->if_ops->power(wl->dev, true);
+ if (ret == 0)
+ set_bit(WL1271_FLAG_GPIO_POWER, &wl->flags);
+
+diff --git a/drivers/net/wireless/ti/wlcore/spi.c b/drivers/net/wireless/ti/wlcore/spi.c
+index 69601f6741d9..2073305e0a58 100644
+--- a/drivers/net/wireless/ti/wlcore/spi.c
++++ b/drivers/net/wireless/ti/wlcore/spi.c
+@@ -73,7 +73,10 @@
+ */
+ #define SPI_AGGR_BUFFER_SIZE (4 * PAGE_SIZE)
+
+-#define WSPI_MAX_NUM_OF_CHUNKS (SPI_AGGR_BUFFER_SIZE / WSPI_MAX_CHUNK_SIZE)
++/* Maximum number of SPI write chunks */
++#define WSPI_MAX_NUM_OF_CHUNKS \
++ ((SPI_AGGR_BUFFER_SIZE / WSPI_MAX_CHUNK_SIZE) + 1)
++
+
+ struct wl12xx_spi_glue {
+ struct device *dev;
+@@ -268,9 +271,10 @@ static int __must_check wl12xx_spi_raw_write(struct device *child, int addr,
+ void *buf, size_t len, bool fixed)
+ {
+ struct wl12xx_spi_glue *glue = dev_get_drvdata(child->parent);
+- struct spi_transfer t[2 * (WSPI_MAX_NUM_OF_CHUNKS + 1)];
++ /* SPI write buffers - 2 for each chunk */
++ struct spi_transfer t[2 * WSPI_MAX_NUM_OF_CHUNKS];
+ struct spi_message m;
+- u32 commands[WSPI_MAX_NUM_OF_CHUNKS];
++ u32 commands[WSPI_MAX_NUM_OF_CHUNKS]; /* 1 command per chunk */
+ u32 *cmd;
+ u32 chunk_len;
+ int i;
+diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c
+index c39aace4f642..63f94134dfce 100644
+--- a/drivers/net/xen-netback/netback.c
++++ b/drivers/net/xen-netback/netback.c
+@@ -2185,8 +2185,11 @@ static int __init netback_init(void)
+ if (!xen_domain())
+ return -ENODEV;
+
+- /* Allow as many queues as there are CPUs, by default */
+- xenvif_max_queues = num_online_cpus();
++ /* Allow as many queues as there are CPUs if user has not
++ * specified a value.
++ */
++ if (xenvif_max_queues == 0)
++ xenvif_max_queues = num_online_cpus();
+
+ if (fatal_skb_slots < XEN_NETBK_LEGACY_SLOTS_MAX) {
+ pr_info("fatal_skb_slots too small (%d), bump it to XEN_NETBK_LEGACY_SLOTS_MAX (%d)\n",
+diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
+index 2a64f28b2dad..8f45be1592ca 100644
+--- a/drivers/net/xen-netfront.c
++++ b/drivers/net/xen-netfront.c
+@@ -1792,19 +1792,19 @@ static void xennet_destroy_queues(struct netfront_info *info)
+ }
+
+ static int xennet_create_queues(struct netfront_info *info,
+- unsigned int num_queues)
++ unsigned int *num_queues)
+ {
+ unsigned int i;
+ int ret;
+
+- info->queues = kcalloc(num_queues, sizeof(struct netfront_queue),
++ info->queues = kcalloc(*num_queues, sizeof(struct netfront_queue),
+ GFP_KERNEL);
+ if (!info->queues)
+ return -ENOMEM;
+
+ rtnl_lock();
+
+- for (i = 0; i < num_queues; i++) {
++ for (i = 0; i < *num_queues; i++) {
+ struct netfront_queue *queue = &info->queues[i];
+
+ queue->id = i;
+@@ -1814,7 +1814,7 @@ static int xennet_create_queues(struct netfront_info *info,
+ if (ret < 0) {
+ dev_warn(&info->netdev->dev,
+ "only created %d queues\n", i);
+- num_queues = i;
++ *num_queues = i;
+ break;
+ }
+
+@@ -1824,11 +1824,11 @@ static int xennet_create_queues(struct netfront_info *info,
+ napi_enable(&queue->napi);
+ }
+
+- netif_set_real_num_tx_queues(info->netdev, num_queues);
++ netif_set_real_num_tx_queues(info->netdev, *num_queues);
+
+ rtnl_unlock();
+
+- if (num_queues == 0) {
++ if (*num_queues == 0) {
+ dev_err(&info->netdev->dev, "no queues\n");
+ return -EINVAL;
+ }
+@@ -1874,7 +1874,7 @@ static int talk_to_netback(struct xenbus_device *dev,
+ if (info->queues)
+ xennet_destroy_queues(info);
+
+- err = xennet_create_queues(info, num_queues);
++ err = xennet_create_queues(info, &num_queues);
+ if (err < 0)
+ goto destroy_ring;
+
+@@ -2351,8 +2351,11 @@ static int __init netif_init(void)
+
+ pr_info("Initialising Xen virtual ethernet driver\n");
+
+- /* Allow as many queues as there are CPUs, by default */
+- xennet_max_queues = num_online_cpus();
++ /* Allow as many queues as there are CPUs if user has not
++ * specified a value.
++ */
++ if (xennet_max_queues == 0)
++ xennet_max_queues = num_online_cpus();
+
+ return xenbus_register_frontend(&netfront_driver);
+ }
+diff --git a/drivers/pci/bus.c b/drivers/pci/bus.c
+index 8fb16188cd82..8ca17ace1519 100644
+--- a/drivers/pci/bus.c
++++ b/drivers/pci/bus.c
+@@ -146,6 +146,8 @@ static int pci_bus_alloc_from_region(struct pci_bus *bus, struct resource *res,
+ type_mask |= IORESOURCE_TYPE_BITS;
+
+ pci_bus_for_each_resource(bus, r, i) {
++ resource_size_t min_used = min;
++
+ if (!r)
+ continue;
+
+@@ -169,12 +171,12 @@ static int pci_bus_alloc_from_region(struct pci_bus *bus, struct resource *res,
+ * overrides "min".
+ */
+ if (avail.start)
+- min = avail.start;
++ min_used = avail.start;
+
+ max = avail.end;
+
+ /* Ok, try it out.. */
+- ret = allocate_resource(r, res, size, min, max,
++ ret = allocate_resource(r, res, size, min_used, max,
+ align, alignf, alignf_data);
+ if (ret == 0)
+ return 0;
+diff --git a/drivers/pci/host/pci-dra7xx.c b/drivers/pci/host/pci-dra7xx.c
+index 52b34fee07fd..b2d093ea5ff2 100644
+--- a/drivers/pci/host/pci-dra7xx.c
++++ b/drivers/pci/host/pci-dra7xx.c
+@@ -289,7 +289,8 @@ static int add_pcie_port(struct dra7xx_pcie *dra7xx,
+ }
+
+ ret = devm_request_irq(&pdev->dev, pp->irq,
+- dra7xx_pcie_msi_irq_handler, IRQF_SHARED,
++ dra7xx_pcie_msi_irq_handler,
++ IRQF_SHARED | IRQF_NO_THREAD,
+ "dra7-pcie-msi", pp);
+ if (ret) {
+ dev_err(&pdev->dev, "failed to request irq\n");
+diff --git a/drivers/pci/host/pci-exynos.c b/drivers/pci/host/pci-exynos.c
+index c5d0ca384502..ab8bcaabaf21 100644
+--- a/drivers/pci/host/pci-exynos.c
++++ b/drivers/pci/host/pci-exynos.c
+@@ -535,7 +535,8 @@ static int __init add_pcie_port(struct pcie_port *pp,
+
+ ret = devm_request_irq(&pdev->dev, pp->msi_irq,
+ exynos_pcie_msi_irq_handler,
+- IRQF_SHARED, "exynos-pcie", pp);
++ IRQF_SHARED | IRQF_NO_THREAD,
++ "exynos-pcie", pp);
+ if (ret) {
+ dev_err(&pdev->dev, "failed to request msi irq\n");
+ return ret;
+diff --git a/drivers/pci/host/pci-imx6.c b/drivers/pci/host/pci-imx6.c
+index 69202d1eb8fb..f1f239f60685 100644
+--- a/drivers/pci/host/pci-imx6.c
++++ b/drivers/pci/host/pci-imx6.c
+@@ -533,8 +533,9 @@ static int __init imx6_add_pcie_port(struct pcie_port *pp,
+ }
+
+ ret = devm_request_irq(&pdev->dev, pp->msi_irq,
+- imx6_pcie_msi_handler,
+- IRQF_SHARED, "mx6-pcie-msi", pp);
++ imx6_pcie_msi_handler,
++ IRQF_SHARED | IRQF_NO_THREAD,
++ "mx6-pcie-msi", pp);
+ if (ret) {
+ dev_err(&pdev->dev, "failed to request MSI irq\n");
+ return -ENODEV;
+diff --git a/drivers/pci/host/pci-tegra.c b/drivers/pci/host/pci-tegra.c
+index 19bb19c7db4a..2898f1597c84 100644
+--- a/drivers/pci/host/pci-tegra.c
++++ b/drivers/pci/host/pci-tegra.c
+@@ -1374,7 +1374,7 @@ static int tegra_pcie_enable_msi(struct tegra_pcie *pcie)
+
+ msi->irq = err;
+
+- err = request_irq(msi->irq, tegra_pcie_msi_irq, 0,
++ err = request_irq(msi->irq, tegra_pcie_msi_irq, IRQF_NO_THREAD,
+ tegra_msi_irq_chip.name, pcie);
+ if (err < 0) {
+ dev_err(&pdev->dev, "failed to request IRQ: %d\n", err);
+diff --git a/drivers/pci/host/pcie-rcar.c b/drivers/pci/host/pcie-rcar.c
+index 61158e03ab5f..bfab844f772d 100644
+--- a/drivers/pci/host/pcie-rcar.c
++++ b/drivers/pci/host/pcie-rcar.c
+@@ -704,14 +704,16 @@ static int rcar_pcie_enable_msi(struct rcar_pcie *pcie)
+
+ /* Two irqs are for MSI, but they are also used for non-MSI irqs */
+ err = devm_request_irq(&pdev->dev, msi->irq1, rcar_pcie_msi_irq,
+- IRQF_SHARED, rcar_msi_irq_chip.name, pcie);
++ IRQF_SHARED | IRQF_NO_THREAD,
++ rcar_msi_irq_chip.name, pcie);
+ if (err < 0) {
+ dev_err(&pdev->dev, "failed to request IRQ: %d\n", err);
+ goto err;
+ }
+
+ err = devm_request_irq(&pdev->dev, msi->irq2, rcar_pcie_msi_irq,
+- IRQF_SHARED, rcar_msi_irq_chip.name, pcie);
++ IRQF_SHARED | IRQF_NO_THREAD,
++ rcar_msi_irq_chip.name, pcie);
+ if (err < 0) {
+ dev_err(&pdev->dev, "failed to request IRQ: %d\n", err);
+ goto err;
+diff --git a/drivers/pci/host/pcie-spear13xx.c b/drivers/pci/host/pcie-spear13xx.c
+index b4ba6ff56cf6..925cfbad5be6 100644
+--- a/drivers/pci/host/pcie-spear13xx.c
++++ b/drivers/pci/host/pcie-spear13xx.c
+@@ -280,7 +280,8 @@ static int add_pcie_port(struct pcie_port *pp, struct platform_device *pdev)
+ return -ENODEV;
+ }
+ ret = devm_request_irq(dev, pp->irq, spear13xx_pcie_irq_handler,
+- IRQF_SHARED, "spear1340-pcie", pp);
++ IRQF_SHARED | IRQF_NO_THREAD,
++ "spear1340-pcie", pp);
+ if (ret) {
+ dev_err(dev, "failed to request irq %d\n", pp->irq);
+ return ret;
+diff --git a/drivers/pci/host/pcie-xilinx.c b/drivers/pci/host/pcie-xilinx.c
+index ccc496b33a97..0b68a45a8d97 100644
+--- a/drivers/pci/host/pcie-xilinx.c
++++ b/drivers/pci/host/pcie-xilinx.c
+@@ -859,7 +859,8 @@ static int xilinx_pcie_parse_dt(struct xilinx_pcie_port *port)
+
+ port->irq = irq_of_parse_and_map(node, 0);
+ err = devm_request_irq(dev, port->irq, xilinx_pcie_intr_handler,
+- IRQF_SHARED, "xilinx-pcie", port);
++ IRQF_SHARED | IRQF_NO_THREAD,
++ "xilinx-pcie", port);
+ if (err) {
+ dev_err(dev, "unable to request irq %d\n", port->irq);
+ return err;
+diff --git a/drivers/pci/hotplug/acpiphp_glue.c b/drivers/pci/hotplug/acpiphp_glue.c
+index bcb90e4888dd..b60309ee80ed 100644
+--- a/drivers/pci/hotplug/acpiphp_glue.c
++++ b/drivers/pci/hotplug/acpiphp_glue.c
+@@ -954,8 +954,10 @@ int acpiphp_enable_slot(struct acpiphp_slot *slot)
+ {
+ pci_lock_rescan_remove();
+
+- if (slot->flags & SLOT_IS_GOING_AWAY)
++ if (slot->flags & SLOT_IS_GOING_AWAY) {
++ pci_unlock_rescan_remove();
+ return -ENODEV;
++ }
+
+ /* configure all functions */
+ if (!(slot->flags & SLOT_ENABLED))
+diff --git a/drivers/platform/x86/ideapad-laptop.c b/drivers/platform/x86/ideapad-laptop.c
+index 14ad4c28b0be..4c82e8e26125 100644
+--- a/drivers/platform/x86/ideapad-laptop.c
++++ b/drivers/platform/x86/ideapad-laptop.c
+@@ -839,6 +839,13 @@ static const struct dmi_system_id no_hw_rfkill_list[] = {
+ },
+ },
+ {
++ .ident = "Lenovo ideapad Y700-17ISK",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_PRODUCT_VERSION, "Lenovo ideapad Y700-17ISK"),
++ },
++ },
++ {
+ .ident = "Lenovo Yoga 2 11 / 13 / Pro",
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+@@ -852,6 +859,20 @@ static const struct dmi_system_id no_hw_rfkill_list[] = {
+ DMI_MATCH(DMI_PRODUCT_VERSION, "Lenovo YOGA 3 Pro-1370"),
+ },
+ },
++ {
++ .ident = "Lenovo Yoga 700",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_PRODUCT_VERSION, "Lenovo YOGA 700"),
++ },
++ },
++ {
++ .ident = "Lenovo Yoga 900",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_PRODUCT_VERSION, "Lenovo YOGA 900"),
++ },
++ },
+ {}
+ };
+
+diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
+index 6d931d598d80..10720938e5c5 100644
+--- a/drivers/scsi/sd.c
++++ b/drivers/scsi/sd.c
+@@ -3187,8 +3187,8 @@ static int sd_suspend_common(struct device *dev, bool ignore_stop_errors)
+ struct scsi_disk *sdkp = scsi_disk_get_from_dev(dev);
+ int ret = 0;
+
+- if (!sdkp)
+- return 0; /* this can happen */
++ if (!sdkp) /* E.g.: runtime suspend following sd_remove() */
++ return 0;
+
+ if (sdkp->WCE && sdkp->media_present) {
+ sd_printk(KERN_NOTICE, sdkp, "Synchronizing SCSI cache\n");
+@@ -3229,6 +3229,9 @@ static int sd_resume(struct device *dev)
+ struct scsi_disk *sdkp = scsi_disk_get_from_dev(dev);
+ int ret = 0;
+
++ if (!sdkp) /* E.g.: runtime resume at the start of sd_probe() */
++ return 0;
++
+ if (!sdkp->device->manage_start_stop)
+ goto done;
+
+diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
+index b3c8aabfd687..a1866c0c6a57 100644
+--- a/drivers/scsi/sg.c
++++ b/drivers/scsi/sg.c
+@@ -1296,7 +1296,7 @@ sg_mmap(struct file *filp, struct vm_area_struct *vma)
+ }
+
+ sfp->mmap_called = 1;
+- vma->vm_flags |= VM_DONTEXPAND | VM_DONTDUMP;
++ vma->vm_flags |= VM_IO | VM_DONTEXPAND | VM_DONTDUMP;
+ vma->vm_private_data = sfp;
+ vma->vm_ops = &sg_mmap_vm_ops;
+ return 0;
+diff --git a/drivers/scsi/sr.c b/drivers/scsi/sr.c
+index 2de44cc58b1a..b8475b817aa2 100644
+--- a/drivers/scsi/sr.c
++++ b/drivers/scsi/sr.c
+@@ -144,6 +144,9 @@ static int sr_runtime_suspend(struct device *dev)
+ {
+ struct scsi_cd *cd = dev_get_drvdata(dev);
+
++ if (!cd) /* E.g.: runtime suspend following sr_remove() */
++ return 0;
++
+ if (cd->media_present)
+ return -EBUSY;
+ else
+@@ -990,6 +993,7 @@ static int sr_remove(struct device *dev)
+ scsi_autopm_get_device(cd->device);
+
+ del_gendisk(cd->disk);
++ dev_set_drvdata(dev, NULL);
+
+ mutex_lock(&sr_ref_mutex);
+ kref_put(&cd->kref, sr_kref_release);
+diff --git a/drivers/staging/speakup/selection.c b/drivers/staging/speakup/selection.c
+index 507fc9a1776e..fb6a686b009c 100644
+--- a/drivers/staging/speakup/selection.c
++++ b/drivers/staging/speakup/selection.c
+@@ -141,7 +141,9 @@ static void __speakup_paste_selection(struct work_struct *work)
+ struct tty_ldisc *ld;
+ DECLARE_WAITQUEUE(wait, current);
+
+- ld = tty_ldisc_ref_wait(tty);
++ ld = tty_ldisc_ref(tty);
++ if (!ld)
++ goto tty_unref;
+ tty_buffer_lock_exclusive(&vc->port);
+
+ add_wait_queue(&vc->paste_wait, &wait);
+@@ -161,6 +163,7 @@ static void __speakup_paste_selection(struct work_struct *work)
+
+ tty_buffer_unlock_exclusive(&vc->port);
+ tty_ldisc_deref(ld);
++tty_unref:
+ tty_kref_put(tty);
+ }
+
+diff --git a/drivers/staging/speakup/serialio.c b/drivers/staging/speakup/serialio.c
+index 1d9d51bdf517..f41a7da1949d 100644
+--- a/drivers/staging/speakup/serialio.c
++++ b/drivers/staging/speakup/serialio.c
+@@ -6,6 +6,11 @@
+ #include "spk_priv.h"
+ #include "serialio.h"
+
++#include <linux/serial_core.h>
++/* WARNING: Do not change this to <linux/serial.h> without testing that
++ * SERIAL_PORT_DFNS does get defined to the appropriate value. */
++#include <asm/serial.h>
++
+ #ifndef SERIAL_PORT_DFNS
+ #define SERIAL_PORT_DFNS
+ #endif
+@@ -23,9 +28,15 @@ const struct old_serial_port *spk_serial_init(int index)
+ int baud = 9600, quot = 0;
+ unsigned int cval = 0;
+ int cflag = CREAD | HUPCL | CLOCAL | B9600 | CS8;
+- const struct old_serial_port *ser = rs_table + index;
++ const struct old_serial_port *ser;
+ int err;
+
++ if (index >= ARRAY_SIZE(rs_table)) {
++ pr_info("no port info for ttyS%d\n", index);
++ return NULL;
++ }
++ ser = rs_table + index;
++
+ /* Divisor, bytesize and parity */
+ quot = ser->baud_base / baud;
+ cval = cflag & (CSIZE | CSTOPB);
+diff --git a/drivers/target/iscsi/iscsi_target_configfs.c b/drivers/target/iscsi/iscsi_target_configfs.c
+index 49b34655e57a..80a1a4fbede0 100644
+--- a/drivers/target/iscsi/iscsi_target_configfs.c
++++ b/drivers/target/iscsi/iscsi_target_configfs.c
+@@ -1887,7 +1887,8 @@ static void lio_tpg_release_fabric_acl(
+ }
+
+ /*
+- * Called with spin_lock_bh(struct se_portal_group->session_lock) held..
++ * Called with spin_lock_irq(struct se_portal_group->session_lock) held
++ * or not held.
+ *
+ * Also, this function calls iscsit_inc_session_usage_count() on the
+ * struct iscsi_session in question.
+@@ -1895,19 +1896,32 @@ static void lio_tpg_release_fabric_acl(
+ static int lio_tpg_shutdown_session(struct se_session *se_sess)
+ {
+ struct iscsi_session *sess = se_sess->fabric_sess_ptr;
++ struct se_portal_group *se_tpg = se_sess->se_tpg;
++ bool local_lock = false;
++
++ if (!spin_is_locked(&se_tpg->session_lock)) {
++ spin_lock_irq(&se_tpg->session_lock);
++ local_lock = true;
++ }
+
+ spin_lock(&sess->conn_lock);
+ if (atomic_read(&sess->session_fall_back_to_erl0) ||
+ atomic_read(&sess->session_logout) ||
+ (sess->time2retain_timer_flags & ISCSI_TF_EXPIRED)) {
+ spin_unlock(&sess->conn_lock);
++ if (local_lock)
++ spin_unlock_irq(&sess->conn_lock);
+ return 0;
+ }
+ atomic_set(&sess->session_reinstatement, 1);
+ spin_unlock(&sess->conn_lock);
+
+ iscsit_stop_time2retain_timer(sess);
++ spin_unlock_irq(&se_tpg->session_lock);
++
+ iscsit_stop_session(sess, 1, 1);
++ if (!local_lock)
++ spin_lock_irq(&se_tpg->session_lock);
+
+ return 1;
+ }
+diff --git a/drivers/thermal/step_wise.c b/drivers/thermal/step_wise.c
+index fdd1f523a1ed..dc4b69671d87 100644
+--- a/drivers/thermal/step_wise.c
++++ b/drivers/thermal/step_wise.c
+@@ -63,6 +63,19 @@ static unsigned long get_target_state(struct thermal_instance *instance,
+ next_target = instance->target;
+ dev_dbg(&cdev->device, "cur_state=%ld\n", cur_state);
+
++ if (!instance->initialized) {
++ if (throttle) {
++ next_target = (cur_state + 1) >= instance->upper ?
++ instance->upper :
++ ((cur_state + 1) < instance->lower ?
++ instance->lower : (cur_state + 1));
++ } else {
++ next_target = THERMAL_NO_TARGET;
++ }
++
++ return next_target;
++ }
++
+ switch (trend) {
+ case THERMAL_TREND_RAISING:
+ if (throttle) {
+@@ -149,7 +162,7 @@ static void thermal_zone_trip_update(struct thermal_zone_device *tz, int trip)
+ dev_dbg(&instance->cdev->device, "old_target=%d, target=%d\n",
+ old_target, (int)instance->target);
+
+- if (old_target == instance->target)
++ if (instance->initialized && old_target == instance->target)
+ continue;
+
+ /* Activate a passive thermal instance */
+@@ -161,7 +174,7 @@ static void thermal_zone_trip_update(struct thermal_zone_device *tz, int trip)
+ instance->target == THERMAL_NO_TARGET)
+ update_passive_instance(tz, trip_type, -1);
+
+-
++ instance->initialized = true;
+ instance->cdev->updated = false; /* cdev needs update */
+ }
+
+diff --git a/drivers/thermal/thermal_core.c b/drivers/thermal/thermal_core.c
+index 488e9bfd996b..82164eb7d5b4 100644
+--- a/drivers/thermal/thermal_core.c
++++ b/drivers/thermal/thermal_core.c
+@@ -37,6 +37,7 @@
+ #include <linux/of.h>
+ #include <net/netlink.h>
+ #include <net/genetlink.h>
++#include <linux/suspend.h>
+
+ #define CREATE_TRACE_POINTS
+ #include <trace/events/thermal.h>
+@@ -59,6 +60,8 @@ static LIST_HEAD(thermal_governor_list);
+ static DEFINE_MUTEX(thermal_list_lock);
+ static DEFINE_MUTEX(thermal_governor_lock);
+
++static atomic_t in_suspend;
++
+ static struct thermal_governor *def_governor;
+
+ static struct thermal_governor *__find_governor(const char *name)
+@@ -469,14 +472,31 @@ static void update_temperature(struct thermal_zone_device *tz)
+ mutex_unlock(&tz->lock);
+
+ trace_thermal_temperature(tz);
+- dev_dbg(&tz->device, "last_temperature=%d, current_temperature=%d\n",
+- tz->last_temperature, tz->temperature);
++ if (tz->last_temperature == THERMAL_TEMP_INVALID)
++ dev_dbg(&tz->device, "last_temperature N/A, current_temperature=%d\n",
++ tz->temperature);
++ else
++ dev_dbg(&tz->device, "last_temperature=%d, current_temperature=%d\n",
++ tz->last_temperature, tz->temperature);
++}
++
++static void thermal_zone_device_reset(struct thermal_zone_device *tz)
++{
++ struct thermal_instance *pos;
++
++ tz->temperature = THERMAL_TEMP_INVALID;
++ tz->passive = 0;
++ list_for_each_entry(pos, &tz->thermal_instances, tz_node)
++ pos->initialized = false;
+ }
+
+ void thermal_zone_device_update(struct thermal_zone_device *tz)
+ {
+ int count;
+
++ if (atomic_read(&in_suspend))
++ return;
++
+ if (!tz->ops->get_temp)
+ return;
+
+@@ -994,6 +1014,7 @@ int thermal_zone_bind_cooling_device(struct thermal_zone_device *tz,
+ if (!result) {
+ list_add_tail(&dev->tz_node, &tz->thermal_instances);
+ list_add_tail(&dev->cdev_node, &cdev->thermal_instances);
++ atomic_set(&tz->need_update, 1);
+ }
+ mutex_unlock(&cdev->lock);
+ mutex_unlock(&tz->lock);
+@@ -1100,6 +1121,7 @@ __thermal_cooling_device_register(struct device_node *np,
+ const struct thermal_cooling_device_ops *ops)
+ {
+ struct thermal_cooling_device *cdev;
++ struct thermal_zone_device *pos = NULL;
+ int result;
+
+ if (type && strlen(type) >= THERMAL_NAME_LENGTH)
+@@ -1158,6 +1180,12 @@ __thermal_cooling_device_register(struct device_node *np,
+ /* Update binding information for 'this' new cdev */
+ bind_cdev(cdev);
+
++ mutex_lock(&thermal_list_lock);
++ list_for_each_entry(pos, &thermal_tz_list, node)
++ if (atomic_cmpxchg(&pos->need_update, 1, 0))
++ thermal_zone_device_update(pos);
++ mutex_unlock(&thermal_list_lock);
++
+ return cdev;
+
+ unregister:
+@@ -1493,6 +1521,8 @@ struct thermal_zone_device *thermal_zone_device_register(const char *type,
+ tz->trips = trips;
+ tz->passive_delay = passive_delay;
+ tz->polling_delay = polling_delay;
++ /* A new thermal zone needs to be updated anyway. */
++ atomic_set(&tz->need_update, 1);
+
+ dev_set_name(&tz->device, "thermal_zone%d", tz->id);
+ result = device_register(&tz->device);
+@@ -1573,7 +1603,10 @@ struct thermal_zone_device *thermal_zone_device_register(const char *type,
+ if (!tz->ops->get_temp)
+ thermal_zone_device_set_polling(tz, 0);
+
+- thermal_zone_device_update(tz);
++ thermal_zone_device_reset(tz);
++ /* Update the new thermal zone and mark it as already updated. */
++ if (atomic_cmpxchg(&tz->need_update, 1, 0))
++ thermal_zone_device_update(tz);
+
+ return tz;
+
+@@ -1811,6 +1844,36 @@ static void thermal_unregister_governors(void)
+ thermal_gov_user_space_unregister();
+ }
+
++static int thermal_pm_notify(struct notifier_block *nb,
++ unsigned long mode, void *_unused)
++{
++ struct thermal_zone_device *tz;
++
++ switch (mode) {
++ case PM_HIBERNATION_PREPARE:
++ case PM_RESTORE_PREPARE:
++ case PM_SUSPEND_PREPARE:
++ atomic_set(&in_suspend, 1);
++ break;
++ case PM_POST_HIBERNATION:
++ case PM_POST_RESTORE:
++ case PM_POST_SUSPEND:
++ atomic_set(&in_suspend, 0);
++ list_for_each_entry(tz, &thermal_tz_list, node) {
++ thermal_zone_device_reset(tz);
++ thermal_zone_device_update(tz);
++ }
++ break;
++ default:
++ break;
++ }
++ return 0;
++}
++
++static struct notifier_block thermal_pm_nb = {
++ .notifier_call = thermal_pm_notify,
++};
++
+ static int __init thermal_init(void)
+ {
+ int result;
+@@ -1831,6 +1894,11 @@ static int __init thermal_init(void)
+ if (result)
+ goto exit_netlink;
+
++ result = register_pm_notifier(&thermal_pm_nb);
++ if (result)
++ pr_warn("Thermal: Can not register suspend notifier, return %d\n",
++ result);
++
+ return 0;
+
+ exit_netlink:
+@@ -1850,6 +1918,7 @@ error:
+
+ static void __exit thermal_exit(void)
+ {
++ unregister_pm_notifier(&thermal_pm_nb);
+ of_thermal_destroy_zones();
+ genetlink_exit();
+ class_unregister(&thermal_class);
+diff --git a/drivers/thermal/thermal_core.h b/drivers/thermal/thermal_core.h
+index d15d243de27a..64ddc2f0ec5c 100644
+--- a/drivers/thermal/thermal_core.h
++++ b/drivers/thermal/thermal_core.h
+@@ -41,6 +41,7 @@ struct thermal_instance {
+ struct thermal_zone_device *tz;
+ struct thermal_cooling_device *cdev;
+ int trip;
++ bool initialized;
+ unsigned long upper; /* Highest cooling state for this trip point */
+ unsigned long lower; /* Lowest cooling state for this trip point */
+ unsigned long target; /* expected cooling state */
+diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c
+index 04e7d8e38c53..7b64a5fdd916 100644
+--- a/drivers/tty/n_tty.c
++++ b/drivers/tty/n_tty.c
+@@ -277,16 +277,13 @@ static void n_tty_check_throttle(struct tty_struct *tty)
+
+ static void n_tty_check_unthrottle(struct tty_struct *tty)
+ {
+- if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
+- tty->link->ldisc->ops->write_wakeup == n_tty_write_wakeup) {
++ if (tty->driver->type == TTY_DRIVER_TYPE_PTY) {
+ if (chars_in_buffer(tty) > TTY_THRESHOLD_UNTHROTTLE)
+ return;
+ if (!tty->count)
+ return;
+ n_tty_set_room(tty);
+- n_tty_write_wakeup(tty->link);
+- if (waitqueue_active(&tty->link->write_wait))
+- wake_up_interruptible_poll(&tty->link->write_wait, POLLOUT);
++ tty_wakeup(tty->link);
+ return;
+ }
+
+diff --git a/drivers/tty/serial/8250/8250_pci.c b/drivers/tty/serial/8250/8250_pci.c
+index 422773242917..98daabab85cf 100644
+--- a/drivers/tty/serial/8250/8250_pci.c
++++ b/drivers/tty/serial/8250/8250_pci.c
+@@ -1355,6 +1355,9 @@ ce4100_serial_setup(struct serial_private *priv,
+ #define PCI_DEVICE_ID_INTEL_BSW_UART1 0x228a
+ #define PCI_DEVICE_ID_INTEL_BSW_UART2 0x228c
+
++#define PCI_DEVICE_ID_INTEL_BDW_UART1 0x9ce3
++#define PCI_DEVICE_ID_INTEL_BDW_UART2 0x9ce4
++
+ #define BYT_PRV_CLK 0x800
+ #define BYT_PRV_CLK_EN (1 << 0)
+ #define BYT_PRV_CLK_M_VAL_SHIFT 1
+@@ -1456,11 +1459,13 @@ byt_serial_setup(struct serial_private *priv,
+ switch (pdev->device) {
+ case PCI_DEVICE_ID_INTEL_BYT_UART1:
+ case PCI_DEVICE_ID_INTEL_BSW_UART1:
++ case PCI_DEVICE_ID_INTEL_BDW_UART1:
+ rx_param->src_id = 3;
+ tx_param->dst_id = 2;
+ break;
+ case PCI_DEVICE_ID_INTEL_BYT_UART2:
+ case PCI_DEVICE_ID_INTEL_BSW_UART2:
++ case PCI_DEVICE_ID_INTEL_BDW_UART2:
+ rx_param->src_id = 5;
+ tx_param->dst_id = 4;
+ break;
+@@ -1944,6 +1949,20 @@ static struct pci_serial_quirk pci_serial_quirks[] __refdata = {
+ .subdevice = PCI_ANY_ID,
+ .setup = byt_serial_setup,
+ },
++ {
++ .vendor = PCI_VENDOR_ID_INTEL,
++ .device = PCI_DEVICE_ID_INTEL_BDW_UART1,
++ .subvendor = PCI_ANY_ID,
++ .subdevice = PCI_ANY_ID,
++ .setup = byt_serial_setup,
++ },
++ {
++ .vendor = PCI_VENDOR_ID_INTEL,
++ .device = PCI_DEVICE_ID_INTEL_BDW_UART2,
++ .subvendor = PCI_ANY_ID,
++ .subdevice = PCI_ANY_ID,
++ .setup = byt_serial_setup,
++ },
+ /*
+ * ITE
+ */
+@@ -5291,6 +5310,16 @@ static struct pci_device_id serial_pci_tbl[] = {
+ PCI_CLASS_COMMUNICATION_SERIAL << 8, 0xff0000,
+ pbn_byt },
+
++ /* Intel Broadwell */
++ { PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_BDW_UART1,
++ PCI_ANY_ID, PCI_ANY_ID,
++ PCI_CLASS_COMMUNICATION_SERIAL << 8, 0xff0000,
++ pbn_byt },
++ { PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_BDW_UART2,
++ PCI_ANY_ID, PCI_ANY_ID,
++ PCI_CLASS_COMMUNICATION_SERIAL << 8, 0xff0000,
++ pbn_byt },
++
+ /*
+ * Intel Quark x1000
+ */
+diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
+index 0a0a6305c511..dacf8d5a0268 100644
+--- a/drivers/tty/tty_io.c
++++ b/drivers/tty/tty_io.c
+@@ -2594,6 +2594,28 @@ static int tiocsetd(struct tty_struct *tty, int __user *p)
+ }
+
+ /**
++ * tiocgetd - get line discipline
++ * @tty: tty device
++ * @p: pointer to user data
++ *
++ * Retrieves the line discipline id directly from the ldisc.
++ *
++ * Locking: waits for ldisc reference (in case the line discipline
++ * is changing or the tty is being hungup)
++ */
++
++static int tiocgetd(struct tty_struct *tty, int __user *p)
++{
++ struct tty_ldisc *ld;
++ int ret;
++
++ ld = tty_ldisc_ref_wait(tty);
++ ret = put_user(ld->ops->num, p);
++ tty_ldisc_deref(ld);
++ return ret;
++}
++
++/**
+ * send_break - performed time break
+ * @tty: device to break on
+ * @duration: timeout in mS
+@@ -2807,7 +2829,7 @@ long tty_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
+ case TIOCGSID:
+ return tiocgsid(tty, real_tty, p);
+ case TIOCGETD:
+- return put_user(tty->ldisc->ops->num, (int __user *)p);
++ return tiocgetd(tty, p);
+ case TIOCSETD:
+ return tiocsetd(tty, p);
+ case TIOCVHANGUP:
+diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
+index 0ecf393a7973..7ec2b06069c9 100644
+--- a/drivers/usb/class/cdc-acm.c
++++ b/drivers/usb/class/cdc-acm.c
+@@ -430,7 +430,8 @@ static void acm_read_bulk_callback(struct urb *urb)
+ if (urb->status) {
+ dev_dbg(&acm->data->dev, "%s - non-zero urb status: %d\n",
+ __func__, urb->status);
+- return;
++ if ((urb->status != -ENOENT) || (urb->actual_length == 0))
++ return;
+ }
+
+ usb_mark_last_busy(acm->dev);
+@@ -1423,6 +1424,8 @@ made_compressed_probe:
+ usb_sndbulkpipe(usb_dev, epwrite->bEndpointAddress),
+ NULL, acm->writesize, acm_write_bulk, snd);
+ snd->urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
++ if (quirks & SEND_ZERO_PACKET)
++ snd->urb->transfer_flags |= URB_ZERO_PACKET;
+ snd->instance = acm;
+ }
+
+@@ -1860,6 +1863,11 @@ static const struct usb_device_id acm_ids[] = {
+ },
+ #endif
+
++ /*Samsung phone in firmware update mode */
++ { USB_DEVICE(0x04e8, 0x685d),
++ .driver_info = IGNORE_DEVICE,
++ },
++
+ /* Exclude Infineon Flash Loader utility */
+ { USB_DEVICE(0x058b, 0x0041),
+ .driver_info = IGNORE_DEVICE,
+@@ -1883,6 +1891,10 @@ static const struct usb_device_id acm_ids[] = {
+ { USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_ACM,
+ USB_CDC_ACM_PROTO_AT_CDMA) },
+
++ { USB_DEVICE(0x1519, 0x0452), /* Intel 7260 modem */
++ .driver_info = SEND_ZERO_PACKET,
++ },
++
+ { }
+ };
+
+diff --git a/drivers/usb/class/cdc-acm.h b/drivers/usb/class/cdc-acm.h
+index 9cca2e7280bb..70d24d7e9dc5 100644
+--- a/drivers/usb/class/cdc-acm.h
++++ b/drivers/usb/class/cdc-acm.h
+@@ -135,3 +135,4 @@ struct acm {
+ #define IGNORE_DEVICE BIT(5)
+ #define QUIRK_CONTROL_LINE_STATE BIT(6)
+ #define CLEAR_HALT_CONDITIONS BIT(7)
++#define SEND_ZERO_PACKET BIT(8)
+diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
+index 88e6e5debbe9..fd9a20f2b6e5 100644
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -1034,10 +1034,20 @@ static void hub_activate(struct usb_hub *hub, enum hub_activation_type type)
+ unsigned delay;
+
+ /* Continue a partial initialization */
+- if (type == HUB_INIT2)
+- goto init2;
+- if (type == HUB_INIT3)
++ if (type == HUB_INIT2 || type == HUB_INIT3) {
++ device_lock(hub->intfdev);
++
++ /* Was the hub disconnected while we were waiting? */
++ if (hub->disconnected) {
++ device_unlock(hub->intfdev);
++ kref_put(&hub->kref, hub_release);
++ return;
++ }
++ if (type == HUB_INIT2)
++ goto init2;
+ goto init3;
++ }
++ kref_get(&hub->kref);
+
+ /* The superspeed hub except for root hub has to use Hub Depth
+ * value as an offset into the route string to locate the bits
+@@ -1235,6 +1245,7 @@ static void hub_activate(struct usb_hub *hub, enum hub_activation_type type)
+ queue_delayed_work(system_power_efficient_wq,
+ &hub->init_work,
+ msecs_to_jiffies(delay));
++ device_unlock(hub->intfdev);
+ return; /* Continues at init3: below */
+ } else {
+ msleep(delay);
+@@ -1256,6 +1267,11 @@ static void hub_activate(struct usb_hub *hub, enum hub_activation_type type)
+ /* Allow autosuspend if it was suppressed */
+ if (type <= HUB_INIT3)
+ usb_autopm_put_interface_async(to_usb_interface(hub->intfdev));
++
++ if (type == HUB_INIT2 || type == HUB_INIT3)
++ device_unlock(hub->intfdev);
++
++ kref_put(&hub->kref, hub_release);
+ }
+
+ /* Implement the continuations for the delays above */
+@@ -5347,7 +5363,6 @@ static int usb_reset_and_verify_device(struct usb_device *udev)
+ }
+
+ bos = udev->bos;
+- udev->bos = NULL;
+
+ for (i = 0; i < SET_CONFIG_TRIES; ++i) {
+
+@@ -5440,8 +5455,11 @@ done:
+ usb_set_usb2_hardware_lpm(udev, 1);
+ usb_unlocked_enable_lpm(udev);
+ usb_enable_ltm(udev);
+- usb_release_bos_descriptor(udev);
+- udev->bos = bos;
++ /* release the new BOS descriptor allocated by hub_port_init() */
++ if (udev->bos != bos) {
++ usb_release_bos_descriptor(udev);
++ udev->bos = bos;
++ }
+ return 0;
+
+ re_enumerate:
+diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
+index 7e5c90eebb9c..3ff5fcc7c94b 100644
+--- a/drivers/usb/host/xhci-pci.c
++++ b/drivers/usb/host/xhci-pci.c
+@@ -23,10 +23,17 @@
+ #include <linux/pci.h>
+ #include <linux/slab.h>
+ #include <linux/module.h>
++#include <linux/acpi.h>
+
+ #include "xhci.h"
+ #include "xhci-trace.h"
+
++#define SSIC_PORT_NUM 2
++#define SSIC_PORT_CFG2 0x880c
++#define SSIC_PORT_CFG2_OFFSET 0x30
++#define PROG_DONE (1 << 30)
++#define SSIC_PORT_UNUSED (1 << 31)
++
+ /* Device for a quirk */
+ #define PCI_VENDOR_ID_FRESCO_LOGIC 0x1b73
+ #define PCI_DEVICE_ID_FRESCO_LOGIC_PDK 0x1000
+@@ -40,6 +47,7 @@
+ #define PCI_DEVICE_ID_INTEL_CHERRYVIEW_XHCI 0x22b5
+ #define PCI_DEVICE_ID_INTEL_SUNRISEPOINT_H_XHCI 0xa12f
+ #define PCI_DEVICE_ID_INTEL_SUNRISEPOINT_LP_XHCI 0x9d2f
++#define PCI_DEVICE_ID_INTEL_BROXTON_M_XHCI 0x0aa8
+
+ static const char hcd_name[] = "xhci_hcd";
+
+@@ -140,9 +148,14 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
+ if (pdev->vendor == PCI_VENDOR_ID_INTEL &&
+ (pdev->device == PCI_DEVICE_ID_INTEL_SUNRISEPOINT_LP_XHCI ||
+ pdev->device == PCI_DEVICE_ID_INTEL_SUNRISEPOINT_H_XHCI ||
+- pdev->device == PCI_DEVICE_ID_INTEL_CHERRYVIEW_XHCI)) {
++ pdev->device == PCI_DEVICE_ID_INTEL_CHERRYVIEW_XHCI ||
++ pdev->device == PCI_DEVICE_ID_INTEL_BROXTON_M_XHCI)) {
+ xhci->quirks |= XHCI_PME_STUCK_QUIRK;
+ }
++ if (pdev->vendor == PCI_VENDOR_ID_INTEL &&
++ pdev->device == PCI_DEVICE_ID_INTEL_CHERRYVIEW_XHCI) {
++ xhci->quirks |= XHCI_SSIC_PORT_UNUSED;
++ }
+ if (pdev->vendor == PCI_VENDOR_ID_ETRON &&
+ pdev->device == PCI_DEVICE_ID_EJ168) {
+ xhci->quirks |= XHCI_RESET_ON_RESUME;
+@@ -169,20 +182,18 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
+ "QUIRK: Resetting on resume");
+ }
+
+-/*
+- * Make sure PME works on some Intel xHCI controllers by writing 1 to clear
+- * the Internal PME flag bit in vendor specific PMCTRL register at offset 0x80a4
+- */
+-static void xhci_pme_quirk(struct xhci_hcd *xhci)
++#ifdef CONFIG_ACPI
++static void xhci_pme_acpi_rtd3_enable(struct pci_dev *dev)
+ {
+- u32 val;
+- void __iomem *reg;
+-
+- reg = (void __iomem *) xhci->cap_regs + 0x80a4;
+- val = readl(reg);
+- writel(val | BIT(28), reg);
+- readl(reg);
++ static const u8 intel_dsm_uuid[] = {
++ 0xb7, 0x0c, 0x34, 0xac, 0x01, 0xe9, 0xbf, 0x45,
++ 0xb7, 0xe6, 0x2b, 0x34, 0xec, 0x93, 0x1e, 0x23,
++ };
++ acpi_evaluate_dsm(ACPI_HANDLE(&dev->dev), intel_dsm_uuid, 3, 1, NULL);
+ }
++#else
++ static void xhci_pme_acpi_rtd3_enable(struct pci_dev *dev) { }
++#endif /* CONFIG_ACPI */
+
+ /* called during probe() after chip reset completes */
+ static int xhci_pci_setup(struct usb_hcd *hcd)
+@@ -263,6 +274,9 @@ static int xhci_pci_probe(struct pci_dev *dev, const struct pci_device_id *id)
+ HCC_MAX_PSA(xhci->hcc_params) >= 4)
+ xhci->shared_hcd->can_do_streams = 1;
+
++ if (xhci->quirks & XHCI_PME_STUCK_QUIRK)
++ xhci_pme_acpi_rtd3_enable(dev);
++
+ /* USB-2 and USB-3 roothubs initialized, allow runtime pm suspend */
+ pm_runtime_put_noidle(&dev->dev);
+
+@@ -296,10 +310,65 @@ static void xhci_pci_remove(struct pci_dev *dev)
+ }
+
+ #ifdef CONFIG_PM
++/*
++ * In some Intel xHCI controllers, in order to get D3 working,
++ * through a vendor specific SSIC CONFIG register at offset 0x883c,
++ * SSIC PORT need to be marked as "unused" before putting xHCI
++ * into D3. After D3 exit, the SSIC port need to be marked as "used".
++ * Without this change, xHCI might not enter D3 state.
++ */
++static void xhci_ssic_port_unused_quirk(struct usb_hcd *hcd, bool suspend)
++{
++ struct xhci_hcd *xhci = hcd_to_xhci(hcd);
++ u32 val;
++ void __iomem *reg;
++ int i;
++
++ for (i = 0; i < SSIC_PORT_NUM; i++) {
++ reg = (void __iomem *) xhci->cap_regs +
++ SSIC_PORT_CFG2 +
++ i * SSIC_PORT_CFG2_OFFSET;
++
++ /* Notify SSIC that SSIC profile programming is not done. */
++ val = readl(reg) & ~PROG_DONE;
++ writel(val, reg);
++
++ /* Mark SSIC port as unused(suspend) or used(resume) */
++ val = readl(reg);
++ if (suspend)
++ val |= SSIC_PORT_UNUSED;
++ else
++ val &= ~SSIC_PORT_UNUSED;
++ writel(val, reg);
++
++ /* Notify SSIC that SSIC profile programming is done */
++ val = readl(reg) | PROG_DONE;
++ writel(val, reg);
++ readl(reg);
++ }
++}
++
++/*
++ * Make sure PME works on some Intel xHCI controllers by writing 1 to clear
++ * the Internal PME flag bit in vendor specific PMCTRL register at offset 0x80a4
++ */
++static void xhci_pme_quirk(struct usb_hcd *hcd)
++{
++ struct xhci_hcd *xhci = hcd_to_xhci(hcd);
++ void __iomem *reg;
++ u32 val;
++
++ reg = (void __iomem *) xhci->cap_regs + 0x80a4;
++ val = readl(reg);
++ writel(val | BIT(28), reg);
++ readl(reg);
++}
++
+ static int xhci_pci_suspend(struct usb_hcd *hcd, bool do_wakeup)
+ {
+ struct xhci_hcd *xhci = hcd_to_xhci(hcd);
+ struct pci_dev *pdev = to_pci_dev(hcd->self.controller);
++ int ret;
+
+ /*
+ * Systems with the TI redriver that loses port status change events
+@@ -309,9 +378,16 @@ static int xhci_pci_suspend(struct usb_hcd *hcd, bool do_wakeup)
+ pdev->no_d3cold = true;
+
+ if (xhci->quirks & XHCI_PME_STUCK_QUIRK)
+- xhci_pme_quirk(xhci);
++ xhci_pme_quirk(hcd);
++
++ if (xhci->quirks & XHCI_SSIC_PORT_UNUSED)
++ xhci_ssic_port_unused_quirk(hcd, true);
+
+- return xhci_suspend(xhci, do_wakeup);
++ ret = xhci_suspend(xhci, do_wakeup);
++ if (ret && (xhci->quirks & XHCI_SSIC_PORT_UNUSED))
++ xhci_ssic_port_unused_quirk(hcd, false);
++
++ return ret;
+ }
+
+ static int xhci_pci_resume(struct usb_hcd *hcd, bool hibernated)
+@@ -341,8 +417,11 @@ static int xhci_pci_resume(struct usb_hcd *hcd, bool hibernated)
+ if (pdev->vendor == PCI_VENDOR_ID_INTEL)
+ usb_enable_intel_xhci_ports(pdev);
+
++ if (xhci->quirks & XHCI_SSIC_PORT_UNUSED)
++ xhci_ssic_port_unused_quirk(hcd, false);
++
+ if (xhci->quirks & XHCI_PME_STUCK_QUIRK)
+- xhci_pme_quirk(xhci);
++ xhci_pme_quirk(hcd);
+
+ retval = xhci_resume(xhci, hibernated);
+ return retval;
+diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
+index 98380fa68fbf..288d18493132 100644
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -1548,7 +1548,9 @@ int xhci_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status)
+ xhci_dbg_trace(xhci, trace_xhci_dbg_cancel_urb,
+ "HW died, freeing TD.");
+ urb_priv = urb->hcpriv;
+- for (i = urb_priv->td_cnt; i < urb_priv->length; i++) {
++ for (i = urb_priv->td_cnt;
++ i < urb_priv->length && xhci->devs[urb->dev->slot_id];
++ i++) {
+ td = urb_priv->td[i];
+ if (!list_empty(&td->td_list))
+ list_del_init(&td->td_list);
+diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
+index 54f386f80970..810f7f6d356c 100644
+--- a/drivers/usb/host/xhci.h
++++ b/drivers/usb/host/xhci.h
+@@ -1565,6 +1565,7 @@ struct xhci_hcd {
+ /* For controllers with a broken beyond repair streams implementation */
+ #define XHCI_BROKEN_STREAMS (1 << 19)
+ #define XHCI_PME_STUCK_QUIRK (1 << 20)
++#define XHCI_SSIC_PORT_UNUSED (1 << 22)
+ unsigned int num_active_eps;
+ unsigned int limit_active_eps;
+ /* There are two roothubs to keep track of bus suspend info for */
+diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
+index 7d4f51a32e66..9364bed2a8b3 100644
+--- a/drivers/usb/serial/cp210x.c
++++ b/drivers/usb/serial/cp210x.c
+@@ -98,6 +98,7 @@ static const struct usb_device_id id_table[] = {
+ { USB_DEVICE(0x10C4, 0x81AC) }, /* MSD Dash Hawk */
+ { USB_DEVICE(0x10C4, 0x81AD) }, /* INSYS USB Modem */
+ { USB_DEVICE(0x10C4, 0x81C8) }, /* Lipowsky Industrie Elektronik GmbH, Baby-JTAG */
++ { USB_DEVICE(0x10C4, 0x81D7) }, /* IAI Corp. RCB-CV-USB USB to RS485 Adaptor */
+ { USB_DEVICE(0x10C4, 0x81E2) }, /* Lipowsky Industrie Elektronik GmbH, Baby-LIN */
+ { USB_DEVICE(0x10C4, 0x81E7) }, /* Aerocomm Radio */
+ { USB_DEVICE(0x10C4, 0x81E8) }, /* Zephyr Bioharness */
+diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
+index a5a0376bbd48..8c660ae401d8 100644
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -824,6 +824,7 @@ static const struct usb_device_id id_table_combined[] = {
+ { USB_DEVICE(FTDI_VID, FTDI_TURTELIZER_PID),
+ .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
+ { USB_DEVICE(RATOC_VENDOR_ID, RATOC_PRODUCT_ID_USB60F) },
++ { USB_DEVICE(RATOC_VENDOR_ID, RATOC_PRODUCT_ID_SCU18) },
+ { USB_DEVICE(FTDI_VID, FTDI_REU_TINY_PID) },
+
+ /* Papouch devices based on FTDI chip */
+diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
+index 2943b97b2a83..7850071c0ae1 100644
+--- a/drivers/usb/serial/ftdi_sio_ids.h
++++ b/drivers/usb/serial/ftdi_sio_ids.h
+@@ -615,6 +615,7 @@
+ */
+ #define RATOC_VENDOR_ID 0x0584
+ #define RATOC_PRODUCT_ID_USB60F 0xb020
++#define RATOC_PRODUCT_ID_SCU18 0xb03a
+
+ /*
+ * Infineon Technologies
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index 17d04d98358c..95d3ab73da0e 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -270,6 +270,8 @@ static void option_instat_callback(struct urb *urb);
+ #define TELIT_PRODUCT_CC864_SINGLE 0x1006
+ #define TELIT_PRODUCT_DE910_DUAL 0x1010
+ #define TELIT_PRODUCT_UE910_V2 0x1012
++#define TELIT_PRODUCT_LE922_USBCFG0 0x1042
++#define TELIT_PRODUCT_LE922_USBCFG3 0x1043
+ #define TELIT_PRODUCT_LE920 0x1200
+ #define TELIT_PRODUCT_LE910 0x1201
+
+@@ -624,6 +626,16 @@ static const struct option_blacklist_info sierra_mc73xx_blacklist = {
+ .reserved = BIT(8) | BIT(10) | BIT(11),
+ };
+
++static const struct option_blacklist_info telit_le922_blacklist_usbcfg0 = {
++ .sendsetup = BIT(2),
++ .reserved = BIT(0) | BIT(1) | BIT(3),
++};
++
++static const struct option_blacklist_info telit_le922_blacklist_usbcfg3 = {
++ .sendsetup = BIT(0),
++ .reserved = BIT(1) | BIT(2) | BIT(3),
++};
++
+ static const struct usb_device_id option_ids[] = {
+ { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_COLT) },
+ { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_RICOLA) },
+@@ -1172,6 +1184,10 @@ static const struct usb_device_id option_ids[] = {
+ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_CC864_SINGLE) },
+ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_DE910_DUAL) },
+ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_UE910_V2) },
++ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE922_USBCFG0),
++ .driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg0 },
++ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE922_USBCFG3),
++ .driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg3 },
+ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910),
+ .driver_info = (kernel_ulong_t)&telit_le910_blacklist },
+ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920),
+@@ -1688,7 +1704,7 @@ static const struct usb_device_id option_ids[] = {
+ { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_EU3_P) },
+ { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_PH8),
+ .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
+- { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_AHXX) },
++ { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_AHXX, 0xff) },
+ { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_PLXX),
+ .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
+ { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_HC28_MDM) },
+diff --git a/drivers/usb/serial/visor.c b/drivers/usb/serial/visor.c
+index 60afb39eb73c..337a0be89fcf 100644
+--- a/drivers/usb/serial/visor.c
++++ b/drivers/usb/serial/visor.c
+@@ -544,6 +544,11 @@ static int treo_attach(struct usb_serial *serial)
+ (serial->num_interrupt_in == 0))
+ return 0;
+
++ if (serial->num_bulk_in < 2 || serial->num_interrupt_in < 2) {
++ dev_err(&serial->interface->dev, "missing endpoints\n");
++ return -ENODEV;
++ }
++
+ /*
+ * It appears that Treos and Kyoceras want to use the
+ * 1st bulk in endpoint to communicate with the 2nd bulk out endpoint,
+@@ -597,8 +602,10 @@ static int clie_5_attach(struct usb_serial *serial)
+ */
+
+ /* some sanity check */
+- if (serial->num_ports < 2)
+- return -1;
++ if (serial->num_bulk_out < 2) {
++ dev_err(&serial->interface->dev, "missing bulk out endpoints\n");
++ return -ENODEV;
++ }
+
+ /* port 0 now uses the modified endpoint Address */
+ port = serial->port[0];
+diff --git a/fs/cifs/cifs_debug.c b/fs/cifs/cifs_debug.c
+index 44ec72684df5..dab67ad53a1a 100644
+--- a/fs/cifs/cifs_debug.c
++++ b/fs/cifs/cifs_debug.c
+@@ -34,27 +34,9 @@
+ void
+ cifs_dump_mem(char *label, void *data, int length)
+ {
+- int i, j;
+- int *intptr = data;
+- char *charptr = data;
+- char buf[10], line[80];
+-
+- printk(KERN_DEBUG "%s: dump of %d bytes of data at 0x%p\n",
+- label, length, data);
+- for (i = 0; i < length; i += 16) {
+- line[0] = 0;
+- for (j = 0; (j < 4) && (i + j * 4 < length); j++) {
+- sprintf(buf, " %08x", intptr[i / 4 + j]);
+- strcat(line, buf);
+- }
+- buf[0] = ' ';
+- buf[2] = 0;
+- for (j = 0; (j < 16) && (i + j < length); j++) {
+- buf[1] = isprint(charptr[i + j]) ? charptr[i + j] : '.';
+- strcat(line, buf);
+- }
+- printk(KERN_DEBUG "%s\n", line);
+- }
++ pr_debug("%s: dump of %d bytes of data at 0x%p\n", label, length, data);
++ print_hex_dump(KERN_DEBUG, "", DUMP_PREFIX_OFFSET, 16, 4,
++ data, length, true);
+ }
+
+ #ifdef CONFIG_CIFS_DEBUG
+@@ -68,7 +50,7 @@ void cifs_vfs_err(const char *fmt, ...)
+ vaf.fmt = fmt;
+ vaf.va = &args;
+
+- printk(KERN_ERR "CIFS VFS: %pV", &vaf);
++ pr_err_ratelimited("CIFS VFS: %pV", &vaf);
+
+ va_end(args);
+ }
+diff --git a/fs/cifs/cifs_debug.h b/fs/cifs/cifs_debug.h
+index c99b40fb609b..66cf0f9fff89 100644
+--- a/fs/cifs/cifs_debug.h
++++ b/fs/cifs/cifs_debug.h
+@@ -51,15 +51,13 @@ __printf(1, 2) void cifs_vfs_err(const char *fmt, ...);
+ /* information message: e.g., configuration, major event */
+ #define cifs_dbg(type, fmt, ...) \
+ do { \
+- if (type == FYI) { \
+- if (cifsFYI & CIFS_INFO) { \
+- printk(KERN_DEBUG "%s: " fmt, \
+- __FILE__, ##__VA_ARGS__); \
+- } \
++ if (type == FYI && cifsFYI & CIFS_INFO) { \
++ pr_debug_ratelimited("%s: " \
++ fmt, __FILE__, ##__VA_ARGS__); \
+ } else if (type == VFS) { \
+ cifs_vfs_err(fmt, ##__VA_ARGS__); \
+ } else if (type == NOISY && type != 0) { \
+- printk(KERN_DEBUG fmt, ##__VA_ARGS__); \
++ pr_debug_ratelimited(fmt, ##__VA_ARGS__); \
+ } \
+ } while (0)
+
+@@ -71,7 +69,7 @@ do { \
+ #define cifs_dbg(type, fmt, ...) \
+ do { \
+ if (0) \
+- printk(KERN_DEBUG fmt, ##__VA_ARGS__); \
++ pr_debug(fmt, ##__VA_ARGS__); \
+ } while (0)
+ #endif
+
+diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
+index 24fa08d261fb..82ebe7dbd834 100644
+--- a/fs/cifs/connect.c
++++ b/fs/cifs/connect.c
+@@ -357,7 +357,6 @@ cifs_reconnect(struct TCP_Server_Info *server)
+ server->session_key.response = NULL;
+ server->session_key.len = 0;
+ server->lstrp = jiffies;
+- mutex_unlock(&server->srv_mutex);
+
+ /* mark submitted MIDs for retry and issue callback */
+ INIT_LIST_HEAD(&retry_list);
+@@ -370,6 +369,7 @@ cifs_reconnect(struct TCP_Server_Info *server)
+ list_move(&mid_entry->qhead, &retry_list);
+ }
+ spin_unlock(&GlobalMid_Lock);
++ mutex_unlock(&server->srv_mutex);
+
+ cifs_dbg(FYI, "%s: issuing mid callbacks\n", __func__);
+ list_for_each_safe(tmp, tmp2, &retry_list) {
+@@ -1466,9 +1466,7 @@ cifs_parse_mount_options(const char *mountdata, const char *devname,
+ vol->seal = 1;
+ break;
+ case Opt_noac:
+- printk(KERN_WARNING "CIFS: Mount option noac not "
+- "supported. Instead set "
+- "/proc/fs/cifs/LookupCacheEnabled to 0\n");
++ pr_warn("CIFS: Mount option noac not supported. Instead set /proc/fs/cifs/LookupCacheEnabled to 0\n");
+ break;
+ case Opt_fsc:
+ #ifndef CONFIG_CIFS_FSCACHE
+@@ -1598,7 +1596,7 @@ cifs_parse_mount_options(const char *mountdata, const char *devname,
+
+ if (strnlen(string, CIFS_MAX_USERNAME_LEN) >
+ CIFS_MAX_USERNAME_LEN) {
+- printk(KERN_WARNING "CIFS: username too long\n");
++ pr_warn("CIFS: username too long\n");
+ goto cifs_parse_mount_err;
+ }
+ vol->username = kstrdup(string, GFP_KERNEL);
+@@ -1662,8 +1660,7 @@ cifs_parse_mount_options(const char *mountdata, const char *devname,
+ temp_len = strlen(value);
+ vol->password = kzalloc(temp_len+1, GFP_KERNEL);
+ if (vol->password == NULL) {
+- printk(KERN_WARNING "CIFS: no memory "
+- "for password\n");
++ pr_warn("CIFS: no memory for password\n");
+ goto cifs_parse_mount_err;
+ }
+
+@@ -1687,8 +1684,7 @@ cifs_parse_mount_options(const char *mountdata, const char *devname,
+
+ if (!cifs_convert_address(dstaddr, string,
+ strlen(string))) {
+- printk(KERN_ERR "CIFS: bad ip= option (%s).\n",
+- string);
++ pr_err("CIFS: bad ip= option (%s).\n", string);
+ goto cifs_parse_mount_err;
+ }
+ got_ip = true;
+@@ -1700,15 +1696,13 @@ cifs_parse_mount_options(const char *mountdata, const char *devname,
+
+ if (strnlen(string, CIFS_MAX_DOMAINNAME_LEN)
+ == CIFS_MAX_DOMAINNAME_LEN) {
+- printk(KERN_WARNING "CIFS: domain name too"
+- " long\n");
++ pr_warn("CIFS: domain name too long\n");
+ goto cifs_parse_mount_err;
+ }
+
+ vol->domainname = kstrdup(string, GFP_KERNEL);
+ if (!vol->domainname) {
+- printk(KERN_WARNING "CIFS: no memory "
+- "for domainname\n");
++ pr_warn("CIFS: no memory for domainname\n");
+ goto cifs_parse_mount_err;
+ }
+ cifs_dbg(FYI, "Domain name set\n");
+@@ -1721,8 +1715,8 @@ cifs_parse_mount_options(const char *mountdata, const char *devname,
+ if (!cifs_convert_address(
+ (struct sockaddr *)&vol->srcaddr,
+ string, strlen(string))) {
+- printk(KERN_WARNING "CIFS: Could not parse"
+- " srcaddr: %s\n", string);
++ pr_warn("CIFS: Could not parse srcaddr: %s\n",
++ string);
+ goto cifs_parse_mount_err;
+ }
+ break;
+@@ -1732,8 +1726,7 @@ cifs_parse_mount_options(const char *mountdata, const char *devname,
+ goto out_nomem;
+
+ if (strnlen(string, 1024) >= 65) {
+- printk(KERN_WARNING "CIFS: iocharset name "
+- "too long.\n");
++ pr_warn("CIFS: iocharset name too long.\n");
+ goto cifs_parse_mount_err;
+ }
+
+@@ -1741,8 +1734,7 @@ cifs_parse_mount_options(const char *mountdata, const char *devname,
+ vol->iocharset = kstrdup(string,
+ GFP_KERNEL);
+ if (!vol->iocharset) {
+- printk(KERN_WARNING "CIFS: no memory"
+- "for charset\n");
++ pr_warn("CIFS: no memory for charset\n");
+ goto cifs_parse_mount_err;
+ }
+ }
+@@ -1773,9 +1765,7 @@ cifs_parse_mount_options(const char *mountdata, const char *devname,
+ * set at top of the function
+ */
+ if (i == RFC1001_NAME_LEN && string[i] != 0)
+- printk(KERN_WARNING "CIFS: netbiosname"
+- " longer than 15 truncated.\n");
+-
++ pr_warn("CIFS: netbiosname longer than 15 truncated.\n");
+ break;
+ case Opt_servern:
+ /* servernetbiosname specified override *SMBSERVER */
+@@ -1801,8 +1791,7 @@ cifs_parse_mount_options(const char *mountdata, const char *devname,
+ /* The string has 16th byte zero still from
+ set at top of the function */
+ if (i == RFC1001_NAME_LEN && string[i] != 0)
+- printk(KERN_WARNING "CIFS: server net"
+- "biosname longer than 15 truncated.\n");
++ pr_warn("CIFS: server netbiosname longer than 15 truncated.\n");
+ break;
+ case Opt_ver:
+ string = match_strdup(args);
+@@ -1814,8 +1803,7 @@ cifs_parse_mount_options(const char *mountdata, const char *devname,
+ break;
+ }
+ /* For all other value, error */
+- printk(KERN_WARNING "CIFS: Invalid version"
+- " specified\n");
++ pr_warn("CIFS: Invalid version specified\n");
+ goto cifs_parse_mount_err;
+ case Opt_vers:
+ string = match_strdup(args);
+@@ -1856,7 +1844,7 @@ cifs_parse_mount_options(const char *mountdata, const char *devname,
+ }
+
+ if (!sloppy && invalid) {
+- printk(KERN_ERR "CIFS: Unknown mount option \"%s\"\n", invalid);
++ pr_err("CIFS: Unknown mount option \"%s\"\n", invalid);
+ goto cifs_parse_mount_err;
+ }
+
+@@ -1882,8 +1870,7 @@ cifs_parse_mount_options(const char *mountdata, const char *devname,
+ /* No ip= option specified? Try to get it from UNC */
+ if (!cifs_convert_address(dstaddr, &vol->UNC[2],
+ strlen(&vol->UNC[2]))) {
+- printk(KERN_ERR "Unable to determine destination "
+- "address.\n");
++ pr_err("Unable to determine destination address.\n");
+ goto cifs_parse_mount_err;
+ }
+ }
+@@ -1894,20 +1881,18 @@ cifs_parse_mount_options(const char *mountdata, const char *devname,
+ if (uid_specified)
+ vol->override_uid = override_uid;
+ else if (override_uid == 1)
+- printk(KERN_NOTICE "CIFS: ignoring forceuid mount option "
+- "specified with no uid= option.\n");
++ pr_notice("CIFS: ignoring forceuid mount option specified with no uid= option.\n");
+
+ if (gid_specified)
+ vol->override_gid = override_gid;
+ else if (override_gid == 1)
+- printk(KERN_NOTICE "CIFS: ignoring forcegid mount option "
+- "specified with no gid= option.\n");
++ pr_notice("CIFS: ignoring forcegid mount option specified with no gid= option.\n");
+
+ kfree(mountdata_copy);
+ return 0;
+
+ out_nomem:
+- printk(KERN_WARNING "Could not allocate temporary buffer\n");
++ pr_warn("Could not allocate temporary buffer\n");
+ cifs_parse_mount_err:
+ kfree(string);
+ kfree(mountdata_copy);
+diff --git a/fs/cifs/misc.c b/fs/cifs/misc.c
+index b7415d596dbd..337946355b29 100644
+--- a/fs/cifs/misc.c
++++ b/fs/cifs/misc.c
+@@ -513,39 +513,11 @@ is_valid_oplock_break(char *buffer, struct TCP_Server_Info *srv)
+ void
+ dump_smb(void *buf, int smb_buf_length)
+ {
+- int i, j;
+- char debug_line[17];
+- unsigned char *buffer = buf;
+-
+ if (traceSMB == 0)
+ return;
+
+- for (i = 0, j = 0; i < smb_buf_length; i++, j++) {
+- if (i % 8 == 0) {
+- /* have reached the beginning of line */
+- printk(KERN_DEBUG "| ");
+- j = 0;
+- }
+- printk("%0#4x ", buffer[i]);
+- debug_line[2 * j] = ' ';
+- if (isprint(buffer[i]))
+- debug_line[1 + (2 * j)] = buffer[i];
+- else
+- debug_line[1 + (2 * j)] = '_';
+-
+- if (i % 8 == 7) {
+- /* reached end of line, time to print ascii */
+- debug_line[16] = 0;
+- printk(" | %s\n", debug_line);
+- }
+- }
+- for (; j < 8; j++) {
+- printk(" ");
+- debug_line[2 * j] = ' ';
+- debug_line[1 + (2 * j)] = ' ';
+- }
+- printk(" | %s\n", debug_line);
+- return;
++ print_hex_dump(KERN_DEBUG, "", DUMP_PREFIX_NONE, 8, 2, buf,
++ smb_buf_length, true);
+ }
+
+ void
+diff --git a/fs/cifs/readdir.c b/fs/cifs/readdir.c
+index 8fd2a95860ba..404b084614aa 100644
+--- a/fs/cifs/readdir.c
++++ b/fs/cifs/readdir.c
+@@ -845,6 +845,7 @@ int cifs_readdir(struct file *file, struct dir_context *ctx)
+ * if buggy server returns . and .. late do we want to
+ * check for that here?
+ */
++ *tmp_buf = 0;
+ rc = cifs_filldir(current_entry, file, ctx,
+ tmp_buf, max_len);
+ if (rc) {
+diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c
+index 9d087f4e7d4e..66106f6ed7b4 100644
+--- a/fs/cifs/transport.c
++++ b/fs/cifs/transport.c
+@@ -99,9 +99,9 @@ DeleteMidQEntry(struct mid_q_entry *midEntry)
+ something is wrong, unless it is quite a slow link or server */
+ if ((now - midEntry->when_alloc) > HZ) {
+ if ((cifsFYI & CIFS_TIMER) && (midEntry->command != command)) {
+- printk(KERN_DEBUG " CIFS slow rsp: cmd %d mid %llu",
++ pr_debug(" CIFS slow rsp: cmd %d mid %llu",
+ midEntry->command, midEntry->mid);
+- printk(" A: 0x%lx S: 0x%lx R: 0x%lx\n",
++ pr_info(" A: 0x%lx S: 0x%lx R: 0x%lx\n",
+ now - midEntry->when_alloc,
+ now - midEntry->when_sent,
+ now - midEntry->when_received);
+@@ -576,14 +576,16 @@ cifs_call_async(struct TCP_Server_Info *server, struct smb_rqst *rqst,
+ cifs_in_send_dec(server);
+ cifs_save_when_sent(mid);
+
+- if (rc < 0)
++ if (rc < 0) {
+ server->sequence_number -= 2;
++ cifs_delete_mid(mid);
++ }
++
+ mutex_unlock(&server->srv_mutex);
+
+ if (rc == 0)
+ return 0;
+
+- cifs_delete_mid(mid);
+ add_credits_and_wake_if(server, credits, optype);
+ return rc;
+ }
+diff --git a/fs/hostfs/hostfs_kern.c b/fs/hostfs/hostfs_kern.c
+index fd62cae0fdcb..6e4a3f1b9ce2 100644
+--- a/fs/hostfs/hostfs_kern.c
++++ b/fs/hostfs/hostfs_kern.c
+@@ -720,15 +720,13 @@ static int hostfs_mknod(struct inode *dir, struct dentry *dentry, umode_t mode,
+
+ init_special_inode(inode, mode, dev);
+ err = do_mknod(name, mode, MAJOR(dev), MINOR(dev));
+- if (!err)
++ if (err)
+ goto out_free;
+
+ err = read_name(inode, name);
+ __putname(name);
+ if (err)
+ goto out_put;
+- if (err)
+- goto out_put;
+
+ d_instantiate(dentry, inode);
+ return 0;
+diff --git a/fs/locks.c b/fs/locks.c
+index 59e2f905e4ff..298d1f5c66f0 100644
+--- a/fs/locks.c
++++ b/fs/locks.c
+@@ -2127,7 +2127,6 @@ int fcntl_setlk(unsigned int fd, struct file *filp, unsigned int cmd,
+ goto out;
+ }
+
+-again:
+ error = flock_to_posix_lock(filp, file_lock, &flock);
+ if (error)
+ goto out;
+@@ -2169,19 +2168,22 @@ again:
+ * Attempt to detect a close/fcntl race and recover by
+ * releasing the lock that was just acquired.
+ */
+- /*
+- * we need that spin_lock here - it prevents reordering between
+- * update of inode->i_flock and check for it done in close().
+- * rcu_read_lock() wouldn't do.
+- */
+- spin_lock(¤t->files->file_lock);
+- f = fcheck(fd);
+- spin_unlock(¤t->files->file_lock);
+- if (!error && f != filp && flock.l_type != F_UNLCK) {
+- flock.l_type = F_UNLCK;
+- goto again;
++ if (!error && file_lock->fl_type != F_UNLCK) {
++ /*
++ * We need that spin_lock here - it prevents reordering between
++ * update of i_flctx->flc_posix and check for it done in
++ * close(). rcu_read_lock() wouldn't do.
++ */
++ spin_lock(¤t->files->file_lock);
++ f = fcheck(fd);
++ spin_unlock(¤t->files->file_lock);
++ if (f != filp) {
++ file_lock->fl_type = F_UNLCK;
++ error = do_lock_file_wait(filp, cmd, file_lock);
++ WARN_ON_ONCE(error);
++ error = -EBADF;
++ }
+ }
+-
+ out:
+ locks_free_lock(file_lock);
+ return error;
+@@ -2267,7 +2269,6 @@ int fcntl_setlk64(unsigned int fd, struct file *filp, unsigned int cmd,
+ goto out;
+ }
+
+-again:
+ error = flock64_to_posix_lock(filp, file_lock, &flock);
+ if (error)
+ goto out;
+@@ -2309,14 +2310,22 @@ again:
+ * Attempt to detect a close/fcntl race and recover by
+ * releasing the lock that was just acquired.
+ */
+- spin_lock(¤t->files->file_lock);
+- f = fcheck(fd);
+- spin_unlock(¤t->files->file_lock);
+- if (!error && f != filp && flock.l_type != F_UNLCK) {
+- flock.l_type = F_UNLCK;
+- goto again;
++ if (!error && file_lock->fl_type != F_UNLCK) {
++ /*
++ * We need that spin_lock here - it prevents reordering between
++ * update of i_flctx->flc_posix and check for it done in
++ * close(). rcu_read_lock() wouldn't do.
++ */
++ spin_lock(¤t->files->file_lock);
++ f = fcheck(fd);
++ spin_unlock(¤t->files->file_lock);
++ if (f != filp) {
++ file_lock->fl_type = F_UNLCK;
++ error = do_lock_file_wait(filp, cmd, file_lock);
++ WARN_ON_ONCE(error);
++ error = -EBADF;
++ }
+ }
+-
+ out:
+ locks_free_lock(file_lock);
+ return error;
+diff --git a/fs/nfs/client.c b/fs/nfs/client.c
+index f9f4845db989..33a8f50fe738 100644
+--- a/fs/nfs/client.c
++++ b/fs/nfs/client.c
+@@ -776,7 +776,7 @@ static int nfs_init_server(struct nfs_server *server,
+ server->options = data->options;
+ server->caps |= NFS_CAP_HARDLINKS|NFS_CAP_SYMLINKS|NFS_CAP_FILEID|
+ NFS_CAP_MODE|NFS_CAP_NLINK|NFS_CAP_OWNER|NFS_CAP_OWNER_GROUP|
+- NFS_CAP_ATIME|NFS_CAP_CTIME|NFS_CAP_MTIME|NFS_CAP_CHANGE_ATTR;
++ NFS_CAP_ATIME|NFS_CAP_CTIME|NFS_CAP_MTIME;
+
+ if (data->rsize)
+ server->rsize = nfs_block_size(data->rsize, NULL);
+diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c
+index d7cfc6e42b5e..aa9eadc55834 100644
+--- a/fs/nfs/inode.c
++++ b/fs/nfs/inode.c
+@@ -435,7 +435,7 @@ nfs_fhget(struct super_block *sb, struct nfs_fh *fh, struct nfs_fattr *fattr, st
+ nfs_set_cache_invalid(inode, NFS_INO_INVALID_ATTR);
+ if (fattr->valid & NFS_ATTR_FATTR_CHANGE)
+ inode->i_version = fattr->change_attr;
+- else if (nfs_server_capable(inode, NFS_CAP_CHANGE_ATTR))
++ else
+ nfs_set_cache_invalid(inode, NFS_INO_INVALID_ATTR);
+ if (fattr->valid & NFS_ATTR_FATTR_SIZE)
+ inode->i_size = nfs_size_to_loff_t(fattr->size);
+@@ -1533,6 +1533,7 @@ static int nfs_update_inode(struct inode *inode, struct nfs_fattr *fattr)
+ unsigned long invalid = 0;
+ unsigned long now = jiffies;
+ unsigned long save_cache_validity;
++ bool cache_revalidated = true;
+
+ dfprintk(VFS, "NFS: %s(%s/%lu fh_crc=0x%08x ct=%d info=0x%x)\n",
+ __func__, inode->i_sb->s_id, inode->i_ino,
+@@ -1595,22 +1596,28 @@ static int nfs_update_inode(struct inode *inode, struct nfs_fattr *fattr)
+ nfs_force_lookup_revalidate(inode);
+ inode->i_version = fattr->change_attr;
+ }
+- } else if (server->caps & NFS_CAP_CHANGE_ATTR)
++ } else {
+ nfsi->cache_validity |= save_cache_validity;
++ cache_revalidated = false;
++ }
+
+ if (fattr->valid & NFS_ATTR_FATTR_MTIME) {
+ memcpy(&inode->i_mtime, &fattr->mtime, sizeof(inode->i_mtime));
+- } else if (server->caps & NFS_CAP_MTIME)
++ } else if (server->caps & NFS_CAP_MTIME) {
+ nfsi->cache_validity |= save_cache_validity &
+ (NFS_INO_INVALID_ATTR
+ | NFS_INO_REVAL_FORCED);
++ cache_revalidated = false;
++ }
+
+ if (fattr->valid & NFS_ATTR_FATTR_CTIME) {
+ memcpy(&inode->i_ctime, &fattr->ctime, sizeof(inode->i_ctime));
+- } else if (server->caps & NFS_CAP_CTIME)
++ } else if (server->caps & NFS_CAP_CTIME) {
+ nfsi->cache_validity |= save_cache_validity &
+ (NFS_INO_INVALID_ATTR
+ | NFS_INO_REVAL_FORCED);
++ cache_revalidated = false;
++ }
+
+ /* Check if our cached file size is stale */
+ if (fattr->valid & NFS_ATTR_FATTR_SIZE) {
+@@ -1631,19 +1638,23 @@ static int nfs_update_inode(struct inode *inode, struct nfs_fattr *fattr)
+ (long long)cur_isize,
+ (long long)new_isize);
+ }
+- } else
++ } else {
+ nfsi->cache_validity |= save_cache_validity &
+ (NFS_INO_INVALID_ATTR
+ | NFS_INO_REVAL_PAGECACHE
+ | NFS_INO_REVAL_FORCED);
++ cache_revalidated = false;
++ }
+
+
+ if (fattr->valid & NFS_ATTR_FATTR_ATIME)
+ memcpy(&inode->i_atime, &fattr->atime, sizeof(inode->i_atime));
+- else if (server->caps & NFS_CAP_ATIME)
++ else if (server->caps & NFS_CAP_ATIME) {
+ nfsi->cache_validity |= save_cache_validity &
+ (NFS_INO_INVALID_ATIME
+ | NFS_INO_REVAL_FORCED);
++ cache_revalidated = false;
++ }
+
+ if (fattr->valid & NFS_ATTR_FATTR_MODE) {
+ if ((inode->i_mode & S_IALLUGO) != (fattr->mode & S_IALLUGO)) {
+@@ -1652,36 +1663,42 @@ static int nfs_update_inode(struct inode *inode, struct nfs_fattr *fattr)
+ inode->i_mode = newmode;
+ invalid |= NFS_INO_INVALID_ATTR|NFS_INO_INVALID_ACCESS|NFS_INO_INVALID_ACL;
+ }
+- } else if (server->caps & NFS_CAP_MODE)
++ } else if (server->caps & NFS_CAP_MODE) {
+ nfsi->cache_validity |= save_cache_validity &
+ (NFS_INO_INVALID_ATTR
+ | NFS_INO_INVALID_ACCESS
+ | NFS_INO_INVALID_ACL
+ | NFS_INO_REVAL_FORCED);
++ cache_revalidated = false;
++ }
+
+ if (fattr->valid & NFS_ATTR_FATTR_OWNER) {
+ if (!uid_eq(inode->i_uid, fattr->uid)) {
+ invalid |= NFS_INO_INVALID_ATTR|NFS_INO_INVALID_ACCESS|NFS_INO_INVALID_ACL;
+ inode->i_uid = fattr->uid;
+ }
+- } else if (server->caps & NFS_CAP_OWNER)
++ } else if (server->caps & NFS_CAP_OWNER) {
+ nfsi->cache_validity |= save_cache_validity &
+ (NFS_INO_INVALID_ATTR
+ | NFS_INO_INVALID_ACCESS
+ | NFS_INO_INVALID_ACL
+ | NFS_INO_REVAL_FORCED);
++ cache_revalidated = false;
++ }
+
+ if (fattr->valid & NFS_ATTR_FATTR_GROUP) {
+ if (!gid_eq(inode->i_gid, fattr->gid)) {
+ invalid |= NFS_INO_INVALID_ATTR|NFS_INO_INVALID_ACCESS|NFS_INO_INVALID_ACL;
+ inode->i_gid = fattr->gid;
+ }
+- } else if (server->caps & NFS_CAP_OWNER_GROUP)
++ } else if (server->caps & NFS_CAP_OWNER_GROUP) {
+ nfsi->cache_validity |= save_cache_validity &
+ (NFS_INO_INVALID_ATTR
+ | NFS_INO_INVALID_ACCESS
+ | NFS_INO_INVALID_ACL
+ | NFS_INO_REVAL_FORCED);
++ cache_revalidated = false;
++ }
+
+ if (fattr->valid & NFS_ATTR_FATTR_NLINK) {
+ if (inode->i_nlink != fattr->nlink) {
+@@ -1690,19 +1707,22 @@ static int nfs_update_inode(struct inode *inode, struct nfs_fattr *fattr)
+ invalid |= NFS_INO_INVALID_DATA;
+ set_nlink(inode, fattr->nlink);
+ }
+- } else if (server->caps & NFS_CAP_NLINK)
++ } else if (server->caps & NFS_CAP_NLINK) {
+ nfsi->cache_validity |= save_cache_validity &
+ (NFS_INO_INVALID_ATTR
+ | NFS_INO_REVAL_FORCED);
++ cache_revalidated = false;
++ }
+
+ if (fattr->valid & NFS_ATTR_FATTR_SPACE_USED) {
+ /*
+ * report the blocks in 512byte units
+ */
+ inode->i_blocks = nfs_calc_block_size(fattr->du.nfs3.used);
+- }
+- if (fattr->valid & NFS_ATTR_FATTR_BLOCKS_USED)
++ } else if (fattr->valid & NFS_ATTR_FATTR_BLOCKS_USED)
+ inode->i_blocks = fattr->du.nfs2.blocks;
++ else
++ cache_revalidated = false;
+
+ /* Update attrtimeo value if we're out of the unstable period */
+ if (invalid & NFS_INO_INVALID_ATTR) {
+@@ -1711,15 +1731,19 @@ static int nfs_update_inode(struct inode *inode, struct nfs_fattr *fattr)
+ nfsi->attrtimeo_timestamp = now;
+ nfsi->attr_gencount = nfs_inc_attr_generation_counter();
+ } else {
+- if (!time_in_range_open(now, nfsi->attrtimeo_timestamp, nfsi->attrtimeo_timestamp + nfsi->attrtimeo)) {
+- if ((nfsi->attrtimeo <<= 1) > NFS_MAXATTRTIMEO(inode))
+- nfsi->attrtimeo = NFS_MAXATTRTIMEO(inode);
++ if (cache_revalidated) {
++ if (!time_in_range_open(now, nfsi->attrtimeo_timestamp,
++ nfsi->attrtimeo_timestamp + nfsi->attrtimeo)) {
++ nfsi->attrtimeo <<= 1;
++ if (nfsi->attrtimeo > NFS_MAXATTRTIMEO(inode))
++ nfsi->attrtimeo = NFS_MAXATTRTIMEO(inode);
++ }
+ nfsi->attrtimeo_timestamp = now;
+ }
+ }
+
+ /* Don't declare attrcache up to date if there were no attrs! */
+- if (fattr->valid != 0)
++ if (cache_revalidated)
+ invalid &= ~NFS_INO_INVALID_ATTR;
+
+ /* Don't invalidate the data if we were to blame */
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index 123a494d018b..4561b2bd1de1 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -1231,6 +1231,7 @@ static void __update_open_stateid(struct nfs4_state *state, nfs4_stateid *open_s
+ * Protect the call to nfs4_state_set_mode_locked and
+ * serialise the stateid update
+ */
++ spin_lock(&state->owner->so_lock);
+ write_seqlock(&state->seqlock);
+ if (deleg_stateid != NULL) {
+ nfs4_stateid_copy(&state->stateid, deleg_stateid);
+@@ -1239,7 +1240,6 @@ static void __update_open_stateid(struct nfs4_state *state, nfs4_stateid *open_s
+ if (open_stateid != NULL)
+ nfs_set_open_stateid_locked(state, open_stateid, fmode);
+ write_sequnlock(&state->seqlock);
+- spin_lock(&state->owner->so_lock);
+ update_open_stateflags(state, fmode);
+ spin_unlock(&state->owner->so_lock);
+ }
+@@ -8388,7 +8388,6 @@ static const struct nfs4_minor_version_ops nfs_v4_0_minor_ops = {
+ .minor_version = 0,
+ .init_caps = NFS_CAP_READDIRPLUS
+ | NFS_CAP_ATOMIC_OPEN
+- | NFS_CAP_CHANGE_ATTR
+ | NFS_CAP_POSIX_LOCK,
+ .init_client = nfs40_init_client,
+ .shutdown_client = nfs40_shutdown_client,
+@@ -8407,7 +8406,6 @@ static const struct nfs4_minor_version_ops nfs_v4_1_minor_ops = {
+ .minor_version = 1,
+ .init_caps = NFS_CAP_READDIRPLUS
+ | NFS_CAP_ATOMIC_OPEN
+- | NFS_CAP_CHANGE_ATTR
+ | NFS_CAP_POSIX_LOCK
+ | NFS_CAP_STATEID_NFSV41
+ | NFS_CAP_ATOMIC_OPEN_V1,
+@@ -8429,7 +8427,6 @@ static const struct nfs4_minor_version_ops nfs_v4_2_minor_ops = {
+ .minor_version = 2,
+ .init_caps = NFS_CAP_READDIRPLUS
+ | NFS_CAP_ATOMIC_OPEN
+- | NFS_CAP_CHANGE_ATTR
+ | NFS_CAP_POSIX_LOCK
+ | NFS_CAP_STATEID_NFSV41
+ | NFS_CAP_ATOMIC_OPEN_V1
+diff --git a/fs/ocfs2/dlm/dlmmaster.c b/fs/ocfs2/dlm/dlmmaster.c
+index 5972f5a30713..d14b28e832a7 100644
+--- a/fs/ocfs2/dlm/dlmmaster.c
++++ b/fs/ocfs2/dlm/dlmmaster.c
+@@ -2512,6 +2512,11 @@ static int dlm_migrate_lockres(struct dlm_ctxt *dlm,
+ spin_lock(&dlm->master_lock);
+ ret = dlm_add_migration_mle(dlm, res, mle, &oldmle, name,
+ namelen, target, dlm->node_num);
++ /* get an extra reference on the mle.
++ * otherwise the assert_master from the new
++ * master will destroy this.
++ */
++ dlm_get_mle_inuse(mle);
+ spin_unlock(&dlm->master_lock);
+ spin_unlock(&dlm->spinlock);
+
+@@ -2547,6 +2552,7 @@ fail:
+ if (mle_added) {
+ dlm_mle_detach_hb_events(dlm, mle);
+ dlm_put_mle(mle);
++ dlm_put_mle_inuse(mle);
+ } else if (mle) {
+ kmem_cache_free(dlm_mle_cache, mle);
+ mle = NULL;
+@@ -2564,17 +2570,6 @@ fail:
+ * ensure that all assert_master work is flushed. */
+ flush_workqueue(dlm->dlm_worker);
+
+- /* get an extra reference on the mle.
+- * otherwise the assert_master from the new
+- * master will destroy this.
+- * also, make sure that all callers of dlm_get_mle
+- * take both dlm->spinlock and dlm->master_lock */
+- spin_lock(&dlm->spinlock);
+- spin_lock(&dlm->master_lock);
+- dlm_get_mle_inuse(mle);
+- spin_unlock(&dlm->master_lock);
+- spin_unlock(&dlm->spinlock);
+-
+ /* notify new node and send all lock state */
+ /* call send_one_lockres with migration flag.
+ * this serves as notice to the target node that a
+@@ -3303,6 +3298,15 @@ top:
+ mle->new_master != dead_node)
+ continue;
+
++ if (mle->new_master == dead_node && mle->inuse) {
++ mlog(ML_NOTICE, "%s: target %u died during "
++ "migration from %u, the MLE is "
++ "still keep used, ignore it!\n",
++ dlm->name, dead_node,
++ mle->master);
++ continue;
++ }
++
+ /* If we have reached this point, this mle needs to be
+ * removed from the list and freed. */
+ dlm_clean_migration_mle(dlm, mle);
+diff --git a/fs/ocfs2/dlm/dlmrecovery.c b/fs/ocfs2/dlm/dlmrecovery.c
+index 8632f9c5fb5d..450363628f98 100644
+--- a/fs/ocfs2/dlm/dlmrecovery.c
++++ b/fs/ocfs2/dlm/dlmrecovery.c
+@@ -2348,6 +2348,8 @@ static void dlm_do_local_recovery_cleanup(struct dlm_ctxt *dlm, u8 dead_node)
+ break;
+ }
+ }
++ dlm_lockres_clear_refmap_bit(dlm, res,
++ dead_node);
+ spin_unlock(&res->spinlock);
+ continue;
+ }
+diff --git a/fs/ocfs2/dlmglue.c b/fs/ocfs2/dlmglue.c
+index 60d6fd9fb6ca..12fe56b2e870 100644
+--- a/fs/ocfs2/dlmglue.c
++++ b/fs/ocfs2/dlmglue.c
+@@ -1373,6 +1373,7 @@ static int __ocfs2_cluster_lock(struct ocfs2_super *osb,
+ unsigned long flags;
+ unsigned int gen;
+ int noqueue_attempted = 0;
++ int kick_dc = 0;
+
+ ocfs2_init_mask_waiter(&mw);
+
+@@ -1501,7 +1502,12 @@ update_holders:
+ unlock:
+ lockres_clear_flags(lockres, OCFS2_LOCK_UPCONVERT_FINISHING);
+
++ /* ocfs2_unblock_lock reques on seeing OCFS2_LOCK_UPCONVERT_FINISHING */
++ kick_dc = (lockres->l_flags & OCFS2_LOCK_BLOCKED);
++
+ spin_unlock_irqrestore(&lockres->l_lock, flags);
++ if (kick_dc)
++ ocfs2_wake_downconvert_thread(osb);
+ out:
+ /*
+ * This is helping work around a lock inversion between the page lock
+diff --git a/fs/overlayfs/copy_up.c b/fs/overlayfs/copy_up.c
+index ea10a8719107..54d62bd95e92 100644
+--- a/fs/overlayfs/copy_up.c
++++ b/fs/overlayfs/copy_up.c
+@@ -22,9 +22,9 @@
+
+ int ovl_copy_xattr(struct dentry *old, struct dentry *new)
+ {
+- ssize_t list_size, size;
+- char *buf, *name, *value;
+- int error;
++ ssize_t list_size, size, value_size = 0;
++ char *buf, *name, *value = NULL;
++ int uninitialized_var(error);
+
+ if (!old->d_inode->i_op->getxattr ||
+ !new->d_inode->i_op->getxattr)
+@@ -41,29 +41,40 @@ int ovl_copy_xattr(struct dentry *old, struct dentry *new)
+ if (!buf)
+ return -ENOMEM;
+
+- error = -ENOMEM;
+- value = kmalloc(XATTR_SIZE_MAX, GFP_KERNEL);
+- if (!value)
+- goto out;
+-
+ list_size = vfs_listxattr(old, buf, list_size);
+ if (list_size <= 0) {
+ error = list_size;
+- goto out_free_value;
++ goto out;
+ }
+
+ for (name = buf; name < (buf + list_size); name += strlen(name) + 1) {
+- size = vfs_getxattr(old, name, value, XATTR_SIZE_MAX);
+- if (size <= 0) {
++retry:
++ size = vfs_getxattr(old, name, value, value_size);
++ if (size == -ERANGE)
++ size = vfs_getxattr(old, name, NULL, 0);
++
++ if (size < 0) {
+ error = size;
+- goto out_free_value;
++ break;
++ }
++
++ if (size > value_size) {
++ void *new;
++
++ new = krealloc(value, size, GFP_KERNEL);
++ if (!new) {
++ error = -ENOMEM;
++ break;
++ }
++ value = new;
++ value_size = size;
++ goto retry;
+ }
++
+ error = vfs_setxattr(new, name, value, size, 0);
+ if (error)
+- goto out_free_value;
++ break;
+ }
+-
+-out_free_value:
+ kfree(value);
+ out:
+ kfree(buf);
+diff --git a/fs/overlayfs/readdir.c b/fs/overlayfs/readdir.c
+index ab1e3dcbed95..c55dc5588b17 100644
+--- a/fs/overlayfs/readdir.c
++++ b/fs/overlayfs/readdir.c
+@@ -579,7 +579,8 @@ void ovl_cleanup_whiteouts(struct dentry *upper, struct list_head *list)
+ (int) PTR_ERR(dentry));
+ continue;
+ }
+- ovl_cleanup(upper->d_inode, dentry);
++ if (dentry->d_inode)
++ ovl_cleanup(upper->d_inode, dentry);
+ dput(dentry);
+ }
+ mutex_unlock(&upper->d_inode->i_mutex);
+diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c
+index 6256c8ed52c9..b2361a1b50f2 100644
+--- a/fs/overlayfs/super.c
++++ b/fs/overlayfs/super.c
+@@ -776,6 +776,9 @@ static int ovl_fill_super(struct super_block *sb, void *data, int silent)
+
+ root_dentry->d_fsdata = oe;
+
++ ovl_copyattr(ovl_dentry_real(root_dentry)->d_inode,
++ root_dentry->d_inode);
++
+ sb->s_magic = OVERLAYFS_SUPER_MAGIC;
+ sb->s_op = &ovl_super_operations;
+ sb->s_root = root_dentry;
+diff --git a/fs/udf/inode.c b/fs/udf/inode.c
+index 7b72b7dd8906..9ae690d4cfeb 100644
+--- a/fs/udf/inode.c
++++ b/fs/udf/inode.c
+@@ -2054,14 +2054,29 @@ void udf_write_aext(struct inode *inode, struct extent_position *epos,
+ epos->offset += adsize;
+ }
+
++/*
++ * Only 1 indirect extent in a row really makes sense but allow upto 16 in case
++ * someone does some weird stuff.
++ */
++#define UDF_MAX_INDIR_EXTS 16
++
+ int8_t udf_next_aext(struct inode *inode, struct extent_position *epos,
+ struct kernel_lb_addr *eloc, uint32_t *elen, int inc)
+ {
+ int8_t etype;
++ unsigned int indirections = 0;
+
+ while ((etype = udf_current_aext(inode, epos, eloc, elen, inc)) ==
+ (EXT_NEXT_EXTENT_ALLOCDECS >> 30)) {
+ int block;
++
++ if (++indirections > UDF_MAX_INDIR_EXTS) {
++ udf_err(inode->i_sb,
++ "too many indirect extents in inode %lu\n",
++ inode->i_ino);
++ return -1;
++ }
++
+ epos->block = *eloc;
+ epos->offset = sizeof(struct allocExtDesc);
+ brelse(epos->bh);
+diff --git a/fs/udf/unicode.c b/fs/udf/unicode.c
+index b84fee372734..2eafe2c4d239 100644
+--- a/fs/udf/unicode.c
++++ b/fs/udf/unicode.c
+@@ -133,11 +133,15 @@ int udf_CS0toUTF8(struct ustr *utf_o, const struct ustr *ocu_i)
+ if (c < 0x80U)
+ utf_o->u_name[utf_o->u_len++] = (uint8_t)c;
+ else if (c < 0x800U) {
++ if (utf_o->u_len > (UDF_NAME_LEN - 4))
++ break;
+ utf_o->u_name[utf_o->u_len++] =
+ (uint8_t)(0xc0 | (c >> 6));
+ utf_o->u_name[utf_o->u_len++] =
+ (uint8_t)(0x80 | (c & 0x3f));
+ } else {
++ if (utf_o->u_len > (UDF_NAME_LEN - 5))
++ break;
+ utf_o->u_name[utf_o->u_len++] =
+ (uint8_t)(0xe0 | (c >> 12));
+ utf_o->u_name[utf_o->u_len++] =
+@@ -178,17 +182,22 @@ int udf_CS0toUTF8(struct ustr *utf_o, const struct ustr *ocu_i)
+ static int udf_UTF8toCS0(dstring *ocu, struct ustr *utf, int length)
+ {
+ unsigned c, i, max_val, utf_char;
+- int utf_cnt, u_len;
++ int utf_cnt, u_len, u_ch;
+
+ memset(ocu, 0, sizeof(dstring) * length);
+ ocu[0] = 8;
+ max_val = 0xffU;
++ u_ch = 1;
+
+ try_again:
+ u_len = 0U;
+ utf_char = 0U;
+ utf_cnt = 0U;
+ for (i = 0U; i < utf->u_len; i++) {
++ /* Name didn't fit? */
++ if (u_len + 1 + u_ch >= length)
++ return 0;
++
+ c = (uint8_t)utf->u_name[i];
+
+ /* Complete a multi-byte UTF-8 character */
+@@ -230,6 +239,7 @@ try_again:
+ if (max_val == 0xffU) {
+ max_val = 0xffffU;
+ ocu[0] = (uint8_t)0x10U;
++ u_ch = 2;
+ goto try_again;
+ }
+ goto error_out;
+@@ -282,7 +292,7 @@ static int udf_CS0toNLS(struct nls_table *nls, struct ustr *utf_o,
+ c = (c << 8) | ocu[i++];
+
+ len = nls->uni2char(c, &utf_o->u_name[utf_o->u_len],
+- UDF_NAME_LEN - utf_o->u_len);
++ UDF_NAME_LEN - 2 - utf_o->u_len);
+ /* Valid character? */
+ if (len >= 0)
+ utf_o->u_len += len;
+@@ -300,15 +310,19 @@ static int udf_NLStoCS0(struct nls_table *nls, dstring *ocu, struct ustr *uni,
+ int len;
+ unsigned i, max_val;
+ uint16_t uni_char;
+- int u_len;
++ int u_len, u_ch;
+
+ memset(ocu, 0, sizeof(dstring) * length);
+ ocu[0] = 8;
+ max_val = 0xffU;
++ u_ch = 1;
+
+ try_again:
+ u_len = 0U;
+ for (i = 0U; i < uni->u_len; i++) {
++ /* Name didn't fit? */
++ if (u_len + 1 + u_ch >= length)
++ return 0;
+ len = nls->char2uni(&uni->u_name[i], uni->u_len - i, &uni_char);
+ if (!len)
+ continue;
+@@ -321,6 +335,7 @@ try_again:
+ if (uni_char > max_val) {
+ max_val = 0xffffU;
+ ocu[0] = (uint8_t)0x10U;
++ u_ch = 2;
+ goto try_again;
+ }
+
+diff --git a/fs/xfs/libxfs/xfs_dquot_buf.c b/fs/xfs/libxfs/xfs_dquot_buf.c
+index bb969337efc8..89b7ddfe5377 100644
+--- a/fs/xfs/libxfs/xfs_dquot_buf.c
++++ b/fs/xfs/libxfs/xfs_dquot_buf.c
+@@ -56,7 +56,7 @@ xfs_dqcheck(
+ xfs_dqid_t id,
+ uint type, /* used only when IO_dorepair is true */
+ uint flags,
+- char *str)
++ const char *str)
+ {
+ xfs_dqblk_t *d = (xfs_dqblk_t *)ddq;
+ int errs = 0;
+@@ -209,7 +209,8 @@ xfs_dquot_buf_verify_crc(
+ STATIC bool
+ xfs_dquot_buf_verify(
+ struct xfs_mount *mp,
+- struct xfs_buf *bp)
++ struct xfs_buf *bp,
++ int warn)
+ {
+ struct xfs_dqblk *d = (struct xfs_dqblk *)bp->b_addr;
+ xfs_dqid_t id = 0;
+@@ -242,8 +243,7 @@ xfs_dquot_buf_verify(
+ if (i == 0)
+ id = be32_to_cpu(ddq->d_id);
+
+- error = xfs_dqcheck(mp, ddq, id + i, 0, XFS_QMOPT_DOWARN,
+- "xfs_dquot_buf_verify");
++ error = xfs_dqcheck(mp, ddq, id + i, 0, warn, __func__);
+ if (error)
+ return false;
+ }
+@@ -258,7 +258,7 @@ xfs_dquot_buf_read_verify(
+
+ if (!xfs_dquot_buf_verify_crc(mp, bp))
+ xfs_buf_ioerror(bp, -EFSBADCRC);
+- else if (!xfs_dquot_buf_verify(mp, bp))
++ else if (!xfs_dquot_buf_verify(mp, bp, XFS_QMOPT_DOWARN))
+ xfs_buf_ioerror(bp, -EFSCORRUPTED);
+
+ if (bp->b_error)
+@@ -266,6 +266,25 @@ xfs_dquot_buf_read_verify(
+ }
+
+ /*
++ * readahead errors are silent and simply leave the buffer as !done so a real
++ * read will then be run with the xfs_dquot_buf_ops verifier. See
++ * xfs_inode_buf_verify() for why we use EIO and ~XBF_DONE here rather than
++ * reporting the failure.
++ */
++static void
++xfs_dquot_buf_readahead_verify(
++ struct xfs_buf *bp)
++{
++ struct xfs_mount *mp = bp->b_target->bt_mount;
++
++ if (!xfs_dquot_buf_verify_crc(mp, bp) ||
++ !xfs_dquot_buf_verify(mp, bp, 0)) {
++ xfs_buf_ioerror(bp, -EIO);
++ bp->b_flags &= ~XBF_DONE;
++ }
++}
++
++/*
+ * we don't calculate the CRC here as that is done when the dquot is flushed to
+ * the buffer after the update is done. This ensures that the dquot in the
+ * buffer always has an up-to-date CRC value.
+@@ -276,7 +295,7 @@ xfs_dquot_buf_write_verify(
+ {
+ struct xfs_mount *mp = bp->b_target->bt_mount;
+
+- if (!xfs_dquot_buf_verify(mp, bp)) {
++ if (!xfs_dquot_buf_verify(mp, bp, XFS_QMOPT_DOWARN)) {
+ xfs_buf_ioerror(bp, -EFSCORRUPTED);
+ xfs_verifier_error(bp);
+ return;
+@@ -288,3 +307,7 @@ const struct xfs_buf_ops xfs_dquot_buf_ops = {
+ .verify_write = xfs_dquot_buf_write_verify,
+ };
+
++const struct xfs_buf_ops xfs_dquot_buf_ra_ops = {
++ .verify_read = xfs_dquot_buf_readahead_verify,
++ .verify_write = xfs_dquot_buf_write_verify,
++};
+diff --git a/fs/xfs/libxfs/xfs_inode_buf.c b/fs/xfs/libxfs/xfs_inode_buf.c
+index f18fd2da49f7..8249599238c3 100644
+--- a/fs/xfs/libxfs/xfs_inode_buf.c
++++ b/fs/xfs/libxfs/xfs_inode_buf.c
+@@ -66,11 +66,14 @@ xfs_inobp_check(
+ * has not had the inode cores stamped into it. Hence for readahead, the buffer
+ * may be potentially invalid.
+ *
+- * If the readahead buffer is invalid, we don't want to mark it with an error,
+- * but we do want to clear the DONE status of the buffer so that a followup read
+- * will re-read it from disk. This will ensure that we don't get an unnecessary
+- * warnings during log recovery and we don't get unnecssary panics on debug
+- * kernels.
++ * If the readahead buffer is invalid, we need to mark it with an error and
++ * clear the DONE status of the buffer so that a followup read will re-read it
++ * from disk. We don't report the error otherwise to avoid warnings during log
++ * recovery and we don't get unnecssary panics on debug kernels. We use EIO here
++ * because all we want to do is say readahead failed; there is no-one to report
++ * the error to, so this will distinguish it from a non-ra verifier failure.
++ * Changes to this readahead error behavour also need to be reflected in
++ * xfs_dquot_buf_readahead_verify().
+ */
+ static void
+ xfs_inode_buf_verify(
+@@ -98,6 +101,7 @@ xfs_inode_buf_verify(
+ XFS_RANDOM_ITOBP_INOTOBP))) {
+ if (readahead) {
+ bp->b_flags &= ~XBF_DONE;
++ xfs_buf_ioerror(bp, -EIO);
+ return;
+ }
+
+diff --git a/fs/xfs/libxfs/xfs_quota_defs.h b/fs/xfs/libxfs/xfs_quota_defs.h
+index 1b0a08379759..f51078f1e92a 100644
+--- a/fs/xfs/libxfs/xfs_quota_defs.h
++++ b/fs/xfs/libxfs/xfs_quota_defs.h
+@@ -153,7 +153,7 @@ typedef __uint16_t xfs_qwarncnt_t;
+ #define XFS_QMOPT_RESBLK_MASK (XFS_QMOPT_RES_REGBLKS | XFS_QMOPT_RES_RTBLKS)
+
+ extern int xfs_dqcheck(struct xfs_mount *mp, xfs_disk_dquot_t *ddq,
+- xfs_dqid_t id, uint type, uint flags, char *str);
++ xfs_dqid_t id, uint type, uint flags, const char *str);
+ extern int xfs_calc_dquots_per_chunk(unsigned int nbblks);
+
+ #endif /* __XFS_QUOTA_H__ */
+diff --git a/fs/xfs/libxfs/xfs_shared.h b/fs/xfs/libxfs/xfs_shared.h
+index 82404da2ca67..41b510c11e2c 100644
+--- a/fs/xfs/libxfs/xfs_shared.h
++++ b/fs/xfs/libxfs/xfs_shared.h
+@@ -49,6 +49,7 @@ extern const struct xfs_buf_ops xfs_inobt_buf_ops;
+ extern const struct xfs_buf_ops xfs_inode_buf_ops;
+ extern const struct xfs_buf_ops xfs_inode_buf_ra_ops;
+ extern const struct xfs_buf_ops xfs_dquot_buf_ops;
++extern const struct xfs_buf_ops xfs_dquot_buf_ra_ops;
+ extern const struct xfs_buf_ops xfs_sb_buf_ops;
+ extern const struct xfs_buf_ops xfs_sb_quiet_buf_ops;
+ extern const struct xfs_buf_ops xfs_symlink_buf_ops;
+diff --git a/fs/xfs/xfs_buf.c b/fs/xfs/xfs_buf.c
+index 24b4ebea0d4d..284c2b2cf810 100644
+--- a/fs/xfs/xfs_buf.c
++++ b/fs/xfs/xfs_buf.c
+@@ -607,6 +607,13 @@ found:
+ }
+ }
+
++ /*
++ * Clear b_error if this is a lookup from a caller that doesn't expect
++ * valid data to be found in the buffer.
++ */
++ if (!(flags & XBF_READ))
++ xfs_buf_ioerror(bp, 0);
++
+ XFS_STATS_INC(xb_get);
+ trace_xfs_buf_get(bp, flags, _RET_IP_);
+ return bp;
+diff --git a/fs/xfs/xfs_log_recover.c b/fs/xfs/xfs_log_recover.c
+index 00cd7f3a8f59..5942b9fa5681 100644
+--- a/fs/xfs/xfs_log_recover.c
++++ b/fs/xfs/xfs_log_recover.c
+@@ -3151,6 +3151,7 @@ xlog_recover_dquot_ra_pass2(
+ struct xfs_disk_dquot *recddq;
+ struct xfs_dq_logformat *dq_f;
+ uint type;
++ int len;
+
+
+ if (mp->m_qflags == 0)
+@@ -3171,8 +3172,12 @@ xlog_recover_dquot_ra_pass2(
+ ASSERT(dq_f);
+ ASSERT(dq_f->qlf_len == 1);
+
+- xfs_buf_readahead(mp->m_ddev_targp, dq_f->qlf_blkno,
+- XFS_FSB_TO_BB(mp, dq_f->qlf_len), NULL);
++ len = XFS_FSB_TO_BB(mp, dq_f->qlf_len);
++ if (xlog_peek_buffer_cancelled(log, dq_f->qlf_blkno, len, 0))
++ return;
++
++ xfs_buf_readahead(mp->m_ddev_targp, dq_f->qlf_blkno, len,
++ &xfs_dquot_buf_ra_ops);
+ }
+
+ STATIC void
+diff --git a/include/crypto/hash.h b/include/crypto/hash.h
+index 74b13ec1ebd4..6857e565a14d 100644
+--- a/include/crypto/hash.h
++++ b/include/crypto/hash.h
+@@ -99,6 +99,7 @@ struct crypto_ahash {
+ unsigned int keylen);
+
+ unsigned int reqsize;
++ bool has_setkey;
+ struct crypto_tfm base;
+ };
+
+@@ -186,6 +187,12 @@ static inline void *ahash_request_ctx(struct ahash_request *req)
+
+ int crypto_ahash_setkey(struct crypto_ahash *tfm, const u8 *key,
+ unsigned int keylen);
++
++static inline bool crypto_ahash_has_setkey(struct crypto_ahash *tfm)
++{
++ return tfm->has_setkey;
++}
++
+ int crypto_ahash_finup(struct ahash_request *req);
+ int crypto_ahash_final(struct ahash_request *req);
+ int crypto_ahash_digest(struct ahash_request *req);
+diff --git a/include/crypto/if_alg.h b/include/crypto/if_alg.h
+index d61c11170213..bfefd8139e18 100644
+--- a/include/crypto/if_alg.h
++++ b/include/crypto/if_alg.h
+@@ -30,6 +30,9 @@ struct alg_sock {
+
+ struct sock *parent;
+
++ unsigned int refcnt;
++ unsigned int nokey_refcnt;
++
+ const struct af_alg_type *type;
+ void *private;
+ };
+@@ -49,8 +52,10 @@ struct af_alg_type {
+ void (*release)(void *private);
+ int (*setkey)(void *private, const u8 *key, unsigned int keylen);
+ int (*accept)(void *private, struct sock *sk);
++ int (*accept_nokey)(void *private, struct sock *sk);
+
+ struct proto_ops *ops;
++ struct proto_ops *ops_nokey;
+ struct module *owner;
+ char name[14];
+ };
+@@ -64,6 +69,7 @@ int af_alg_register_type(const struct af_alg_type *type);
+ int af_alg_unregister_type(const struct af_alg_type *type);
+
+ int af_alg_release(struct socket *sock);
++void af_alg_release_parent(struct sock *sk);
+ int af_alg_accept(struct sock *sk, struct socket *newsock);
+
+ int af_alg_make_sg(struct af_alg_sgl *sgl, void __user *addr, int len,
+@@ -80,11 +86,6 @@ static inline struct alg_sock *alg_sk(struct sock *sk)
+ return (struct alg_sock *)sk;
+ }
+
+-static inline void af_alg_release_parent(struct sock *sk)
+-{
+- sock_put(alg_sk(sk)->parent);
+-}
+-
+ static inline void af_alg_init_completion(struct af_alg_completion *completion)
+ {
+ init_completion(&completion->completion);
+diff --git a/include/drm/drm_cache.h b/include/drm/drm_cache.h
+index 7bfb063029d8..461a0558bca4 100644
+--- a/include/drm/drm_cache.h
++++ b/include/drm/drm_cache.h
+@@ -35,4 +35,13 @@
+
+ void drm_clflush_pages(struct page *pages[], unsigned long num_pages);
+
++static inline bool drm_arch_can_wc_memory(void)
++{
++#if defined(CONFIG_PPC) && !defined(CONFIG_NOT_COHERENT_CACHE)
++ return false;
++#else
++ return true;
++#endif
++}
++
+ #endif
+diff --git a/include/drm/drm_fixed.h b/include/drm/drm_fixed.h
+index d639049a613d..553210c02ee0 100644
+--- a/include/drm/drm_fixed.h
++++ b/include/drm/drm_fixed.h
+@@ -73,18 +73,28 @@ static inline u32 dfixed_div(fixed20_12 A, fixed20_12 B)
+ #define DRM_FIXED_ONE (1ULL << DRM_FIXED_POINT)
+ #define DRM_FIXED_DECIMAL_MASK (DRM_FIXED_ONE - 1)
+ #define DRM_FIXED_DIGITS_MASK (~DRM_FIXED_DECIMAL_MASK)
++#define DRM_FIXED_EPSILON 1LL
++#define DRM_FIXED_ALMOST_ONE (DRM_FIXED_ONE - DRM_FIXED_EPSILON)
+
+ static inline s64 drm_int2fixp(int a)
+ {
+ return ((s64)a) << DRM_FIXED_POINT;
+ }
+
+-static inline int drm_fixp2int(int64_t a)
++static inline int drm_fixp2int(s64 a)
+ {
+ return ((s64)a) >> DRM_FIXED_POINT;
+ }
+
+-static inline unsigned drm_fixp_msbset(int64_t a)
++static inline int drm_fixp2int_ceil(s64 a)
++{
++ if (a > 0)
++ return drm_fixp2int(a + DRM_FIXED_ALMOST_ONE);
++ else
++ return drm_fixp2int(a - DRM_FIXED_ALMOST_ONE);
++}
++
++static inline unsigned drm_fixp_msbset(s64 a)
+ {
+ unsigned shift, sign = (a >> 63) & 1;
+
+@@ -136,6 +146,45 @@ static inline s64 drm_fixp_div(s64 a, s64 b)
+ return result;
+ }
+
++static inline s64 drm_fixp_from_fraction(s64 a, s64 b)
++{
++ s64 res;
++ bool a_neg = a < 0;
++ bool b_neg = b < 0;
++ u64 a_abs = a_neg ? -a : a;
++ u64 b_abs = b_neg ? -b : b;
++ u64 rem;
++
++ /* determine integer part */
++ u64 res_abs = div64_u64_rem(a_abs, b_abs, &rem);
++
++ /* determine fractional part */
++ {
++ u32 i = DRM_FIXED_POINT;
++
++ do {
++ rem <<= 1;
++ res_abs <<= 1;
++ if (rem >= b_abs) {
++ res_abs |= 1;
++ rem -= b_abs;
++ }
++ } while (--i != 0);
++ }
++
++ /* round up LSB */
++ {
++ u64 summand = (rem << 1) >= b_abs;
++
++ res_abs += summand;
++ }
++
++ res = (s64) res_abs;
++ if (a_neg ^ b_neg)
++ res = -res;
++ return res;
++}
++
+ static inline s64 drm_fixp_exp(s64 x)
+ {
+ s64 tolerance = div64_s64(DRM_FIXED_ONE, 1000000);
+diff --git a/include/linux/console.h b/include/linux/console.h
+index 7571a16bd653..ac1599bda9fc 100644
+--- a/include/linux/console.h
++++ b/include/linux/console.h
+@@ -150,6 +150,7 @@ extern int console_trylock(void);
+ extern void console_unlock(void);
+ extern void console_conditional_schedule(void);
+ extern void console_unblank(void);
++extern void console_flush_on_panic(void);
+ extern struct tty_driver *console_device(int *);
+ extern void console_stop(struct console *);
+ extern void console_start(struct console *);
+diff --git a/include/linux/filter.h b/include/linux/filter.h
+index ca95abd2bed1..c80b1a9d0715 100644
+--- a/include/linux/filter.h
++++ b/include/linux/filter.h
+@@ -427,6 +427,25 @@ static inline void bpf_jit_free(struct bpf_prog *fp)
+
+ #define BPF_ANC BIT(15)
+
++static inline bool bpf_needs_clear_a(const struct sock_filter *first)
++{
++ switch (first->code) {
++ case BPF_RET | BPF_K:
++ case BPF_LD | BPF_W | BPF_LEN:
++ return false;
++
++ case BPF_LD | BPF_W | BPF_ABS:
++ case BPF_LD | BPF_H | BPF_ABS:
++ case BPF_LD | BPF_B | BPF_ABS:
++ if (first->k == SKF_AD_OFF + SKF_AD_ALU_XOR_X)
++ return true;
++ return false;
++
++ default:
++ return true;
++ }
++}
++
+ static inline u16 bpf_anc_helper(const struct sock_filter *ftest)
+ {
+ BUG_ON(ftest->code & BPF_ANC);
+diff --git a/include/linux/fs.h b/include/linux/fs.h
+index 6fd017e25c0a..58f6ab319996 100644
+--- a/include/linux/fs.h
++++ b/include/linux/fs.h
+@@ -906,12 +906,11 @@ int locks_in_grace(struct net *);
+ * FIXME: should we create a separate "struct lock_request" to help distinguish
+ * these two uses?
+ *
+- * The i_flock list is ordered by:
++ * The varous i_flctx lists are ordered by:
+ *
+- * 1) lock type -- FL_LEASEs first, then FL_FLOCK, and finally FL_POSIX
+- * 2) lock owner
+- * 3) lock range start
+- * 4) lock range end
++ * 1) lock owner
++ * 2) lock range start
++ * 3) lock range end
+ *
+ * Obviously, the last two criteria only matter for POSIX locks.
+ */
+@@ -1946,8 +1945,9 @@ static inline int break_lease(struct inode *inode, unsigned int mode)
+ {
+ /*
+ * Since this check is lockless, we must ensure that any refcounts
+- * taken are done before checking inode->i_flock. Otherwise, we could
+- * end up racing with tasks trying to set a new lease on this file.
++ * taken are done before checking i_flctx->flc_lease. Otherwise, we
++ * could end up racing with tasks trying to set a new lease on this
++ * file.
+ */
+ smp_mb();
+ if (inode->i_flock)
+@@ -1959,8 +1959,9 @@ static inline int break_deleg(struct inode *inode, unsigned int mode)
+ {
+ /*
+ * Since this check is lockless, we must ensure that any refcounts
+- * taken are done before checking inode->i_flock. Otherwise, we could
+- * end up racing with tasks trying to set a new lease on this file.
++ * taken are done before checking i_flctx->flc_lease. Otherwise, we
++ * could end up racing with tasks trying to set a new lease on this
++ * file.
+ */
+ smp_mb();
+ if (inode->i_flock)
+diff --git a/include/linux/nfs_fs_sb.h b/include/linux/nfs_fs_sb.h
+index a32ba0d7a98f..fd249ab2718f 100644
+--- a/include/linux/nfs_fs_sb.h
++++ b/include/linux/nfs_fs_sb.h
+@@ -216,7 +216,7 @@ struct nfs_server {
+ #define NFS_CAP_SYMLINKS (1U << 2)
+ #define NFS_CAP_ACLS (1U << 3)
+ #define NFS_CAP_ATOMIC_OPEN (1U << 4)
+-#define NFS_CAP_CHANGE_ATTR (1U << 5)
++/* #define NFS_CAP_CHANGE_ATTR (1U << 5) */
+ #define NFS_CAP_FILEID (1U << 6)
+ #define NFS_CAP_MODE (1U << 7)
+ #define NFS_CAP_NLINK (1U << 8)
+diff --git a/include/linux/radix-tree.h b/include/linux/radix-tree.h
+index 33170dbd9db4..5d5174b59802 100644
+--- a/include/linux/radix-tree.h
++++ b/include/linux/radix-tree.h
+@@ -370,12 +370,28 @@ void **radix_tree_next_chunk(struct radix_tree_root *root,
+ struct radix_tree_iter *iter, unsigned flags);
+
+ /**
++ * radix_tree_iter_retry - retry this chunk of the iteration
++ * @iter: iterator state
++ *
++ * If we iterate over a tree protected only by the RCU lock, a race
++ * against deletion or creation may result in seeing a slot for which
++ * radix_tree_deref_retry() returns true. If so, call this function
++ * and continue the iteration.
++ */
++static inline __must_check
++void **radix_tree_iter_retry(struct radix_tree_iter *iter)
++{
++ iter->next_index = iter->index;
++ return NULL;
++}
++
++/**
+ * radix_tree_chunk_size - get current chunk size
+ *
+ * @iter: pointer to radix tree iterator
+ * Returns: current chunk size
+ */
+-static __always_inline unsigned
++static __always_inline long
+ radix_tree_chunk_size(struct radix_tree_iter *iter)
+ {
+ return iter->next_index - iter->index;
+@@ -409,9 +425,9 @@ radix_tree_next_slot(void **slot, struct radix_tree_iter *iter, unsigned flags)
+ return slot + offset + 1;
+ }
+ } else {
+- unsigned size = radix_tree_chunk_size(iter) - 1;
++ long size = radix_tree_chunk_size(iter);
+
+- while (size--) {
++ while (--size > 0) {
+ slot++;
+ iter->index++;
+ if (likely(*slot))
+diff --git a/include/linux/rmap.h b/include/linux/rmap.h
+index d9d7e7e56352..89195a456069 100644
+--- a/include/linux/rmap.h
++++ b/include/linux/rmap.h
+@@ -113,20 +113,6 @@ static inline struct anon_vma *page_anon_vma(struct page *page)
+ return page_rmapping(page);
+ }
+
+-static inline void vma_lock_anon_vma(struct vm_area_struct *vma)
+-{
+- struct anon_vma *anon_vma = vma->anon_vma;
+- if (anon_vma)
+- down_write(&anon_vma->root->rwsem);
+-}
+-
+-static inline void vma_unlock_anon_vma(struct vm_area_struct *vma)
+-{
+- struct anon_vma *anon_vma = vma->anon_vma;
+- if (anon_vma)
+- up_write(&anon_vma->root->rwsem);
+-}
+-
+ static inline void anon_vma_lock_write(struct anon_vma *anon_vma)
+ {
+ down_write(&anon_vma->root->rwsem);
+diff --git a/include/linux/sched.h b/include/linux/sched.h
+index 5e344bbe63ec..2a0bcc8411dc 100644
+--- a/include/linux/sched.h
++++ b/include/linux/sched.h
+@@ -758,6 +758,7 @@ struct user_struct {
+ unsigned long mq_bytes; /* How many bytes can be allocated to mqueue? */
+ #endif
+ unsigned long locked_shm; /* How many pages of mlocked shm ? */
++ unsigned long unix_inflight; /* How many files in flight in unix sockets */
+
+ #ifdef CONFIG_KEYS
+ struct key *uid_keyring; /* UID specific keyring */
+diff --git a/include/linux/thermal.h b/include/linux/thermal.h
+index ef90838b36a0..041f9b4e0074 100644
+--- a/include/linux/thermal.h
++++ b/include/linux/thermal.h
+@@ -40,6 +40,9 @@
+ /* No upper/lower limit requirement */
+ #define THERMAL_NO_LIMIT THERMAL_CSTATE_INVALID
+
++/* use value, which < 0K, to indicate an invalid/uninitialized temperature */
++#define THERMAL_TEMP_INVALID -274000
++
+ /* Unit conversion macros */
+ #define KELVIN_TO_CELSIUS(t) (long)(((long)t-2732 >= 0) ? \
+ ((long)t-2732+5)/10 : ((long)t-2732-5)/10)
+@@ -188,6 +191,7 @@ struct thermal_attr {
+ * @forced_passive: If > 0, temperature at which to switch on all ACPI
+ * processor cooling devices. Currently only used by the
+ * step-wise governor.
++ * @need_update: if equals 1, thermal_zone_device_update needs to be invoked.
+ * @ops: operations this &thermal_zone_device supports
+ * @tzp: thermal zone parameters
+ * @governor: pointer to the governor for this thermal zone
+@@ -214,6 +218,7 @@ struct thermal_zone_device {
+ int emul_temperature;
+ int passive;
+ unsigned int forced_passive;
++ atomic_t need_update;
+ struct thermal_zone_device_ops *ops;
+ const struct thermal_zone_params *tzp;
+ struct thermal_governor *governor;
+diff --git a/include/net/inet_ecn.h b/include/net/inet_ecn.h
+index 84b20835b736..0dc0a51da38f 100644
+--- a/include/net/inet_ecn.h
++++ b/include/net/inet_ecn.h
+@@ -111,11 +111,24 @@ static inline void ipv4_copy_dscp(unsigned int dscp, struct iphdr *inner)
+
+ struct ipv6hdr;
+
+-static inline int IP6_ECN_set_ce(struct ipv6hdr *iph)
++/* Note:
++ * IP_ECN_set_ce() has to tweak IPV4 checksum when setting CE,
++ * meaning both changes have no effect on skb->csum if/when CHECKSUM_COMPLETE
++ * In IPv6 case, no checksum compensates the change in IPv6 header,
++ * so we have to update skb->csum.
++ */
++static inline int IP6_ECN_set_ce(struct sk_buff *skb, struct ipv6hdr *iph)
+ {
++ __be32 from, to;
++
+ if (INET_ECN_is_not_ect(ipv6_get_dsfield(iph)))
+ return 0;
+- *(__be32*)iph |= htonl(INET_ECN_CE << 20);
++
++ from = *(__be32 *)iph;
++ to = from | htonl(INET_ECN_CE << 20);
++ *(__be32 *)iph = to;
++ if (skb->ip_summed == CHECKSUM_COMPLETE)
++ skb->csum = csum_add(csum_sub(skb->csum, from), to);
+ return 1;
+ }
+
+@@ -142,7 +155,7 @@ static inline int INET_ECN_set_ce(struct sk_buff *skb)
+ case cpu_to_be16(ETH_P_IPV6):
+ if (skb_network_header(skb) + sizeof(struct ipv6hdr) <=
+ skb_tail_pointer(skb))
+- return IP6_ECN_set_ce(ipv6_hdr(skb));
++ return IP6_ECN_set_ce(skb, ipv6_hdr(skb));
+ break;
+ }
+
+diff --git a/include/net/mac802154.h b/include/net/mac802154.h
+index 2e67cdd19cdc..0d34ce2ff07b 100644
+--- a/include/net/mac802154.h
++++ b/include/net/mac802154.h
+@@ -35,13 +35,13 @@
+ */
+
+ /* indicates that the Short Address changed */
+-#define IEEE802515_AFILT_SADDR_CHANGED 0x00000001
++#define IEEE802154_AFILT_SADDR_CHANGED 0x00000001
+ /* indicates that the IEEE Address changed */
+-#define IEEE802515_AFILT_IEEEADDR_CHANGED 0x00000002
++#define IEEE802154_AFILT_IEEEADDR_CHANGED 0x00000002
+ /* indicates that the PAN ID changed */
+-#define IEEE802515_AFILT_PANID_CHANGED 0x00000004
++#define IEEE802154_AFILT_PANID_CHANGED 0x00000004
+ /* indicates that PAN Coordinator status changed */
+-#define IEEE802515_AFILT_PANC_CHANGED 0x00000008
++#define IEEE802154_AFILT_PANC_CHANGED 0x00000008
+
+ struct ieee802154_hw_addr_filt {
+ __le16 pan_id; /* Each independent PAN selects a unique
+diff --git a/include/net/vxlan.h b/include/net/vxlan.h
+index 903461aa5644..2f3572f03f58 100644
+--- a/include/net/vxlan.h
++++ b/include/net/vxlan.h
+@@ -43,6 +43,11 @@ struct vxlan_sock {
+ #define VXLAN_F_UDP_ZERO_CSUM6_TX 0x80
+ #define VXLAN_F_UDP_ZERO_CSUM6_RX 0x100
+
++/* Flags that are used in the receive path. These flags must match in
++ * order for a socket to be shareable
++ */
++#define VXLAN_F_RCV_FLAGS VXLAN_F_UDP_ZERO_CSUM6_RX
++
+ struct vxlan_sock *vxlan_sock_add(struct net *net, __be16 port,
+ vxlan_rcv_t *rcv, void *data,
+ bool no_share, u32 flags);
+diff --git a/include/sound/rawmidi.h b/include/sound/rawmidi.h
+index 311dafe6cc4b..5bd2bfbf6dd1 100644
+--- a/include/sound/rawmidi.h
++++ b/include/sound/rawmidi.h
+@@ -165,6 +165,10 @@ int snd_rawmidi_transmit_peek(struct snd_rawmidi_substream *substream,
+ int snd_rawmidi_transmit_ack(struct snd_rawmidi_substream *substream, int count);
+ int snd_rawmidi_transmit(struct snd_rawmidi_substream *substream,
+ unsigned char *buffer, int count);
++int __snd_rawmidi_transmit_peek(struct snd_rawmidi_substream *substream,
++ unsigned char *buffer, int count);
++int __snd_rawmidi_transmit_ack(struct snd_rawmidi_substream *substream,
++ int count);
+
+ /* main midi functions */
+
+diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
+index 055ae6ac0280..67f5f177c071 100644
+--- a/kernel/bpf/verifier.c
++++ b/kernel/bpf/verifier.c
+@@ -1025,6 +1025,16 @@ static int check_alu_op(struct reg_state *regs, struct bpf_insn *insn)
+ return -EINVAL;
+ }
+
++ if ((opcode == BPF_LSH || opcode == BPF_RSH ||
++ opcode == BPF_ARSH) && BPF_SRC(insn->code) == BPF_K) {
++ int size = BPF_CLASS(insn->code) == BPF_ALU64 ? 64 : 32;
++
++ if (insn->imm < 0 || insn->imm >= size) {
++ verbose("invalid shift %d\n", insn->imm);
++ return -EINVAL;
++ }
++ }
++
+ /* pattern match 'bpf_add Rx, imm' instruction */
+ if (opcode == BPF_ADD && BPF_CLASS(insn->code) == BPF_ALU64 &&
+ regs[insn->dst_reg].type == FRAME_PTR &&
+diff --git a/kernel/futex.c b/kernel/futex.c
+index 63678b573d61..1c43013e6edc 100644
+--- a/kernel/futex.c
++++ b/kernel/futex.c
+@@ -2632,6 +2632,11 @@ static int futex_wait_requeue_pi(u32 __user *uaddr, unsigned int flags,
+ if (q.pi_state && (q.pi_state->owner != current)) {
+ spin_lock(q.lock_ptr);
+ ret = fixup_pi_state_owner(uaddr2, &q, current);
++ /*
++ * Drop the reference to the pi state which
++ * the requeue_pi() code acquired for us.
++ */
++ free_pi_state(q.pi_state);
+ spin_unlock(q.lock_ptr);
+ }
+ } else {
+diff --git a/kernel/panic.c b/kernel/panic.c
+index cf80672b7924..b81e85ba7de2 100644
+--- a/kernel/panic.c
++++ b/kernel/panic.c
+@@ -23,6 +23,7 @@
+ #include <linux/sysrq.h>
+ #include <linux/init.h>
+ #include <linux/nmi.h>
++#include <linux/console.h>
+
+ #define PANIC_TIMER_STEP 100
+ #define PANIC_BLINK_SPD 18
+@@ -145,6 +146,17 @@ void panic(const char *fmt, ...)
+
+ bust_spinlocks(0);
+
++ /*
++ * We may have ended up stopping the CPU holding the lock (in
++ * smp_send_stop()) while still having some valuable data in the console
++ * buffer. Try to acquire the lock then release it regardless of the
++ * result. The release will also print the buffers out. Locks debug
++ * should be disabled to avoid reporting bad unlock balance when
++ * panic() is not being callled from OOPS.
++ */
++ debug_locks_off();
++ console_flush_on_panic();
++
+ if (!panic_blink)
+ panic_blink = no_blink;
+
+diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c
+index 3b9f01ba363a..3100e0dd560e 100644
+--- a/kernel/printk/printk.c
++++ b/kernel/printk/printk.c
+@@ -2167,13 +2167,24 @@ void console_unlock(void)
+ static u64 seen_seq;
+ unsigned long flags;
+ bool wake_klogd = false;
+- bool retry;
++ bool do_cond_resched, retry;
+
+ if (console_suspended) {
+ up_console_sem();
+ return;
+ }
+
++ /*
++ * Console drivers are called under logbuf_lock, so
++ * @console_may_schedule should be cleared before; however, we may
++ * end up dumping a lot of lines, for example, if called from
++ * console registration path, and should invoke cond_resched()
++ * between lines if allowable. Not doing so can cause a very long
++ * scheduling stall on a slow console leading to RCU stall and
++ * softlockup warnings which exacerbate the issue with more
++ * messages practically incapacitating the system.
++ */
++ do_cond_resched = console_may_schedule;
+ console_may_schedule = 0;
+
+ /* flush buffered message fragment immediately to console */
+@@ -2235,6 +2246,9 @@ skip:
+ call_console_drivers(level, text, len);
+ start_critical_timings();
+ local_irq_restore(flags);
++
++ if (do_cond_resched)
++ cond_resched();
+ }
+ console_locked = 0;
+
+@@ -2302,6 +2316,25 @@ void console_unblank(void)
+ console_unlock();
+ }
+
++/**
++ * console_flush_on_panic - flush console content on panic
++ *
++ * Immediately output all pending messages no matter what.
++ */
++void console_flush_on_panic(void)
++{
++ /*
++ * If someone else is holding the console lock, trylock will fail
++ * and may_schedule may be set. Ignore and proceed to unlock so
++ * that messages are flushed out. As this can be called from any
++ * context and we don't want to get preempted while flushing,
++ * ensure may_schedule is cleared.
++ */
++ console_trylock();
++ console_may_schedule = 0;
++ console_unlock();
++}
++
+ /*
+ * Return the console tty driver structure and its associated index
+ */
+diff --git a/kernel/seccomp.c b/kernel/seccomp.c
+index 4ef9687ac115..a39025b02fd5 100644
+--- a/kernel/seccomp.c
++++ b/kernel/seccomp.c
+@@ -317,24 +317,24 @@ static inline void seccomp_sync_threads(void)
+ put_seccomp_filter(thread);
+ smp_store_release(&thread->seccomp.filter,
+ caller->seccomp.filter);
++
++ /*
++ * Don't let an unprivileged task work around
++ * the no_new_privs restriction by creating
++ * a thread that sets it up, enters seccomp,
++ * then dies.
++ */
++ if (task_no_new_privs(caller))
++ task_set_no_new_privs(thread);
++
+ /*
+ * Opt the other thread into seccomp if needed.
+ * As threads are considered to be trust-realm
+ * equivalent (see ptrace_may_access), it is safe to
+ * allow one thread to transition the other.
+ */
+- if (thread->seccomp.mode == SECCOMP_MODE_DISABLED) {
+- /*
+- * Don't let an unprivileged task work around
+- * the no_new_privs restriction by creating
+- * a thread that sets it up, enters seccomp,
+- * then dies.
+- */
+- if (task_no_new_privs(caller))
+- task_set_no_new_privs(thread);
+-
++ if (thread->seccomp.mode == SECCOMP_MODE_DISABLED)
+ seccomp_assign_mode(thread, SECCOMP_MODE_FILTER);
+- }
+ }
+ }
+
+diff --git a/kernel/time/posix-clock.c b/kernel/time/posix-clock.c
+index ce033c7aa2e8..9cff0ab82b63 100644
+--- a/kernel/time/posix-clock.c
++++ b/kernel/time/posix-clock.c
+@@ -69,10 +69,10 @@ static ssize_t posix_clock_read(struct file *fp, char __user *buf,
+ static unsigned int posix_clock_poll(struct file *fp, poll_table *wait)
+ {
+ struct posix_clock *clk = get_posix_clock(fp);
+- int result = 0;
++ unsigned int result = 0;
+
+ if (!clk)
+- return -ENODEV;
++ return POLLERR;
+
+ if (clk->ops.poll)
+ result = clk->ops.poll(clk, fp, wait);
+diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
+index a4038c57e25d..c596236607ae 100644
+--- a/kernel/time/timekeeping.c
++++ b/kernel/time/timekeeping.c
+@@ -202,8 +202,7 @@ static inline s64 timekeeping_get_ns(struct tk_read_base *tkr)
+ /* calculate the delta since the last update_wall_time: */
+ delta = clocksource_delta(cycle_now, tkr->cycle_last, tkr->mask);
+
+- nsec = delta * tkr->mult + tkr->xtime_nsec;
+- nsec >>= tkr->shift;
++ nsec = (delta * tkr->mult + tkr->xtime_nsec) >> tkr->shift;
+
+ /* If arch requires, add in get_arch_timeoffset() */
+ return nsec + arch_gettimeoffset();
+diff --git a/lib/dma-debug.c b/lib/dma-debug.c
+index add80cc02dbe..1ff0fd098504 100644
+--- a/lib/dma-debug.c
++++ b/lib/dma-debug.c
+@@ -1165,7 +1165,7 @@ static inline bool overlap(void *addr, unsigned long len, void *start, void *end
+
+ static void check_for_illegal_area(struct device *dev, void *addr, unsigned long len)
+ {
+- if (overlap(addr, len, _text, _etext) ||
++ if (overlap(addr, len, _stext, _etext) ||
+ overlap(addr, len, __start_rodata, __end_rodata))
+ err_printk(dev, NULL, "DMA-API: device driver maps memory from kernel text or rodata [addr=%p] [len=%lu]\n", addr, len);
+ }
+diff --git a/lib/dump_stack.c b/lib/dump_stack.c
+index 6745c6230db3..c30d07e99dba 100644
+--- a/lib/dump_stack.c
++++ b/lib/dump_stack.c
+@@ -25,6 +25,7 @@ static atomic_t dump_lock = ATOMIC_INIT(-1);
+
+ asmlinkage __visible void dump_stack(void)
+ {
++ unsigned long flags;
+ int was_locked;
+ int old;
+ int cpu;
+@@ -33,9 +34,8 @@ asmlinkage __visible void dump_stack(void)
+ * Permit this cpu to perform nested stack dumps while serialising
+ * against other CPUs
+ */
+- preempt_disable();
+-
+ retry:
++ local_irq_save(flags);
+ cpu = smp_processor_id();
+ old = atomic_cmpxchg(&dump_lock, -1, cpu);
+ if (old == -1) {
+@@ -43,6 +43,7 @@ retry:
+ } else if (old == cpu) {
+ was_locked = 1;
+ } else {
++ local_irq_restore(flags);
+ cpu_relax();
+ goto retry;
+ }
+@@ -52,7 +53,7 @@ retry:
+ if (!was_locked)
+ atomic_set(&dump_lock, -1);
+
+- preempt_enable();
++ local_irq_restore(flags);
+ }
+ #else
+ asmlinkage __visible void dump_stack(void)
+diff --git a/lib/libcrc32c.c b/lib/libcrc32c.c
+index 6a08ce7d6adc..acf9da449f81 100644
+--- a/lib/libcrc32c.c
++++ b/lib/libcrc32c.c
+@@ -74,3 +74,4 @@ module_exit(libcrc32c_mod_fini);
+ MODULE_AUTHOR("Clay Haapala <chaapala@cisco.com>");
+ MODULE_DESCRIPTION("CRC32c (Castagnoli) calculations");
+ MODULE_LICENSE("GPL");
++MODULE_SOFTDEP("pre: crc32c");
+diff --git a/lib/radix-tree.c b/lib/radix-tree.c
+index 3d2aa27b845b..8399002aa0f0 100644
+--- a/lib/radix-tree.c
++++ b/lib/radix-tree.c
+@@ -1014,9 +1014,13 @@ radix_tree_gang_lookup(struct radix_tree_root *root, void **results,
+ return 0;
+
+ radix_tree_for_each_slot(slot, root, &iter, first_index) {
+- results[ret] = indirect_to_ptr(rcu_dereference_raw(*slot));
++ results[ret] = rcu_dereference_raw(*slot);
+ if (!results[ret])
+ continue;
++ if (radix_tree_is_indirect_ptr(results[ret])) {
++ slot = radix_tree_iter_retry(&iter);
++ continue;
++ }
+ if (++ret == max_items)
+ break;
+ }
+@@ -1093,9 +1097,13 @@ radix_tree_gang_lookup_tag(struct radix_tree_root *root, void **results,
+ return 0;
+
+ radix_tree_for_each_tagged(slot, root, &iter, first_index, tag) {
+- results[ret] = indirect_to_ptr(rcu_dereference_raw(*slot));
++ results[ret] = rcu_dereference_raw(*slot);
+ if (!results[ret])
+ continue;
++ if (radix_tree_is_indirect_ptr(results[ret])) {
++ slot = radix_tree_iter_retry(&iter);
++ continue;
++ }
+ if (++ret == max_items)
+ break;
+ }
+diff --git a/mm/balloon_compaction.c b/mm/balloon_compaction.c
+index fcad8322ef36..b640609bcd17 100644
+--- a/mm/balloon_compaction.c
++++ b/mm/balloon_compaction.c
+@@ -61,6 +61,7 @@ struct page *balloon_page_dequeue(struct balloon_dev_info *b_dev_info)
+ bool dequeued_page;
+
+ dequeued_page = false;
++ spin_lock_irqsave(&b_dev_info->pages_lock, flags);
+ list_for_each_entry_safe(page, tmp, &b_dev_info->pages, lru) {
+ /*
+ * Block others from accessing the 'page' while we get around
+@@ -75,15 +76,14 @@ struct page *balloon_page_dequeue(struct balloon_dev_info *b_dev_info)
+ continue;
+ }
+ #endif
+- spin_lock_irqsave(&b_dev_info->pages_lock, flags);
+ balloon_page_delete(page);
+ __count_vm_event(BALLOON_DEFLATE);
+- spin_unlock_irqrestore(&b_dev_info->pages_lock, flags);
+ unlock_page(page);
+ dequeued_page = true;
+ break;
+ }
+ }
++ spin_unlock_irqrestore(&b_dev_info->pages_lock, flags);
+
+ if (!dequeued_page) {
+ /*
+diff --git a/mm/memcontrol.c b/mm/memcontrol.c
+index d72bdc3ca09b..0afd8444a8d6 100644
+--- a/mm/memcontrol.c
++++ b/mm/memcontrol.c
+@@ -4748,16 +4748,17 @@ static void __mem_cgroup_usage_unregister_event(struct mem_cgroup *memcg,
+ swap_buffers:
+ /* Swap primary and spare array */
+ thresholds->spare = thresholds->primary;
+- /* If all events are unregistered, free the spare array */
+- if (!new) {
+- kfree(thresholds->spare);
+- thresholds->spare = NULL;
+- }
+
+ rcu_assign_pointer(thresholds->primary, new);
+
+ /* To be sure that nobody uses thresholds */
+ synchronize_rcu();
++
++ /* If all events are unregistered, free the spare array */
++ if (!new) {
++ kfree(thresholds->spare);
++ thresholds->spare = NULL;
++ }
+ unlock:
+ mutex_unlock(&memcg->thresholds_lock);
+ }
+diff --git a/mm/memory-failure.c b/mm/memory-failure.c
+index 715bc57385b9..f7d6522beeaf 100644
+--- a/mm/memory-failure.c
++++ b/mm/memory-failure.c
+@@ -1523,7 +1523,7 @@ static int get_any_page(struct page *page, unsigned long pfn, int flags)
+ * Did it turn free?
+ */
+ ret = __get_any_page(page, pfn, 0);
+- if (!PageLRU(page)) {
++ if (ret == 1 && !PageLRU(page)) {
+ /* Drop page reference which is from __get_any_page() */
+ put_page(page);
+ pr_info("soft_offline: %#lx: unknown non LRU page type %lx\n",
+diff --git a/mm/mmap.c b/mm/mmap.c
+index f88b4f940327..f03267136fb7 100644
+--- a/mm/mmap.c
++++ b/mm/mmap.c
+@@ -443,12 +443,16 @@ static void validate_mm(struct mm_struct *mm)
+ struct vm_area_struct *vma = mm->mmap;
+
+ while (vma) {
++ struct anon_vma *anon_vma = vma->anon_vma;
+ struct anon_vma_chain *avc;
+
+- vma_lock_anon_vma(vma);
+- list_for_each_entry(avc, &vma->anon_vma_chain, same_vma)
+- anon_vma_interval_tree_verify(avc);
+- vma_unlock_anon_vma(vma);
++ if (anon_vma) {
++ anon_vma_lock_read(anon_vma);
++ list_for_each_entry(avc, &vma->anon_vma_chain, same_vma)
++ anon_vma_interval_tree_verify(avc);
++ anon_vma_unlock_read(anon_vma);
++ }
++
+ highest_address = vma->vm_end;
+ vma = vma->vm_next;
+ i++;
+@@ -2150,32 +2154,27 @@ static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, uns
+ */
+ int expand_upwards(struct vm_area_struct *vma, unsigned long address)
+ {
+- int error;
++ int error = 0;
+
+ if (!(vma->vm_flags & VM_GROWSUP))
+ return -EFAULT;
+
+- /*
+- * We must make sure the anon_vma is allocated
+- * so that the anon_vma locking is not a noop.
+- */
++ /* Guard against wrapping around to address 0. */
++ if (address < PAGE_ALIGN(address+4))
++ address = PAGE_ALIGN(address+4);
++ else
++ return -ENOMEM;
++
++ /* We must make sure the anon_vma is allocated. */
+ if (unlikely(anon_vma_prepare(vma)))
+ return -ENOMEM;
+- vma_lock_anon_vma(vma);
+
+ /*
+ * vma->vm_start/vm_end cannot change under us because the caller
+ * is required to hold the mmap_sem in read mode. We need the
+ * anon_vma lock to serialize against concurrent expand_stacks.
+- * Also guard against wrapping around to address 0.
+ */
+- if (address < PAGE_ALIGN(address+4))
+- address = PAGE_ALIGN(address+4);
+- else {
+- vma_unlock_anon_vma(vma);
+- return -ENOMEM;
+- }
+- error = 0;
++ anon_vma_lock_write(vma->anon_vma);
+
+ /* Somebody else might have raced and expanded it already */
+ if (address > vma->vm_end) {
+@@ -2193,7 +2192,7 @@ int expand_upwards(struct vm_area_struct *vma, unsigned long address)
+ * updates, but we only hold a shared mmap_sem
+ * lock here, so we need to protect against
+ * concurrent vma expansions.
+- * vma_lock_anon_vma() doesn't help here, as
++ * anon_vma_lock_write() doesn't help here, as
+ * we don't guarantee that all growable vmas
+ * in a mm share the same root anon vma.
+ * So, we reuse mm->page_table_lock to guard
+@@ -2213,7 +2212,7 @@ int expand_upwards(struct vm_area_struct *vma, unsigned long address)
+ }
+ }
+ }
+- vma_unlock_anon_vma(vma);
++ anon_vma_unlock_write(vma->anon_vma);
+ khugepaged_enter_vma_merge(vma, vma->vm_flags);
+ validate_mm(vma->vm_mm);
+ return error;
+@@ -2228,25 +2227,21 @@ int expand_downwards(struct vm_area_struct *vma,
+ {
+ int error;
+
+- /*
+- * We must make sure the anon_vma is allocated
+- * so that the anon_vma locking is not a noop.
+- */
+- if (unlikely(anon_vma_prepare(vma)))
+- return -ENOMEM;
+-
+ address &= PAGE_MASK;
+ error = security_mmap_addr(address);
+ if (error)
+ return error;
+
+- vma_lock_anon_vma(vma);
++ /* We must make sure the anon_vma is allocated. */
++ if (unlikely(anon_vma_prepare(vma)))
++ return -ENOMEM;
+
+ /*
+ * vma->vm_start/vm_end cannot change under us because the caller
+ * is required to hold the mmap_sem in read mode. We need the
+ * anon_vma lock to serialize against concurrent expand_stacks.
+ */
++ anon_vma_lock_write(vma->anon_vma);
+
+ /* Somebody else might have raced and expanded it already */
+ if (address < vma->vm_start) {
+@@ -2264,7 +2259,7 @@ int expand_downwards(struct vm_area_struct *vma,
+ * updates, but we only hold a shared mmap_sem
+ * lock here, so we need to protect against
+ * concurrent vma expansions.
+- * vma_lock_anon_vma() doesn't help here, as
++ * anon_vma_lock_write() doesn't help here, as
+ * we don't guarantee that all growable vmas
+ * in a mm share the same root anon vma.
+ * So, we reuse mm->page_table_lock to guard
+@@ -2282,7 +2277,7 @@ int expand_downwards(struct vm_area_struct *vma,
+ }
+ }
+ }
+- vma_unlock_anon_vma(vma);
++ anon_vma_unlock_write(vma->anon_vma);
+ khugepaged_enter_vma_merge(vma, vma->vm_flags);
+ validate_mm(vma->vm_mm);
+ return error;
+diff --git a/net/bridge/br_stp_if.c b/net/bridge/br_stp_if.c
+index 7832d07f48f6..ce658abdc2c8 100644
+--- a/net/bridge/br_stp_if.c
++++ b/net/bridge/br_stp_if.c
+@@ -128,7 +128,10 @@ static void br_stp_start(struct net_bridge *br)
+ char *argv[] = { BR_STP_PROG, br->dev->name, "start", NULL };
+ char *envp[] = { NULL };
+
+- r = call_usermodehelper(BR_STP_PROG, argv, envp, UMH_WAIT_PROC);
++ if (net_eq(dev_net(br->dev), &init_net))
++ r = call_usermodehelper(BR_STP_PROG, argv, envp, UMH_WAIT_PROC);
++ else
++ r = -ENOENT;
+
+ spin_lock_bh(&br->lock);
+
+diff --git a/net/core/dst.c b/net/core/dst.c
+index a80e92346b9b..57746a18c957 100644
+--- a/net/core/dst.c
++++ b/net/core/dst.c
+@@ -282,10 +282,11 @@ void dst_release(struct dst_entry *dst)
+ {
+ if (dst) {
+ int newrefcnt;
++ unsigned short nocache = dst->flags & DST_NOCACHE;
+
+ newrefcnt = atomic_dec_return(&dst->__refcnt);
+ WARN_ON(newrefcnt < 0);
+- if (!newrefcnt && unlikely(dst->flags & DST_NOCACHE))
++ if (!newrefcnt && unlikely(nocache))
+ call_rcu(&dst->rcu_head, dst_destroy_rcu);
+ }
+ }
+diff --git a/net/core/filter.c b/net/core/filter.c
+index 647b12265e18..e6cde173851d 100644
+--- a/net/core/filter.c
++++ b/net/core/filter.c
+@@ -728,6 +728,11 @@ int bpf_check_classic(const struct sock_filter *filter, unsigned int flen)
+ if (ftest->k == 0)
+ return -EINVAL;
+ break;
++ case BPF_ALU | BPF_LSH | BPF_K:
++ case BPF_ALU | BPF_RSH | BPF_K:
++ if (ftest->k >= 32)
++ return -EINVAL;
++ break;
+ case BPF_LD | BPF_MEM:
+ case BPF_LDX | BPF_MEM:
+ case BPF_ST:
+diff --git a/net/ipv4/tcp_yeah.c b/net/ipv4/tcp_yeah.c
+index cd7273218598..25a229764e7f 100644
+--- a/net/ipv4/tcp_yeah.c
++++ b/net/ipv4/tcp_yeah.c
+@@ -219,7 +219,7 @@ static u32 tcp_yeah_ssthresh(struct sock *sk)
+ yeah->fast_count = 0;
+ yeah->reno_count = max(yeah->reno_count>>1, 2U);
+
+- return tp->snd_cwnd - reduction;
++ return max_t(int, tp->snd_cwnd - reduction, 2);
+ }
+
+ static struct tcp_congestion_ops tcp_yeah __read_mostly = {
+diff --git a/net/ipv4/xfrm4_policy.c b/net/ipv4/xfrm4_policy.c
+index 6156f68a1e90..94fc16dad6c6 100644
+--- a/net/ipv4/xfrm4_policy.c
++++ b/net/ipv4/xfrm4_policy.c
+@@ -230,7 +230,7 @@ static void xfrm4_dst_ifdown(struct dst_entry *dst, struct net_device *dev,
+ xfrm_dst_ifdown(dst, dev);
+ }
+
+-static struct dst_ops xfrm4_dst_ops = {
++static struct dst_ops xfrm4_dst_ops_template = {
+ .family = AF_INET,
+ .protocol = cpu_to_be16(ETH_P_IP),
+ .gc = xfrm4_garbage_collect,
+@@ -245,7 +245,7 @@ static struct dst_ops xfrm4_dst_ops = {
+
+ static struct xfrm_policy_afinfo xfrm4_policy_afinfo = {
+ .family = AF_INET,
+- .dst_ops = &xfrm4_dst_ops,
++ .dst_ops = &xfrm4_dst_ops_template,
+ .dst_lookup = xfrm4_dst_lookup,
+ .get_saddr = xfrm4_get_saddr,
+ .decode_session = _decode_session4,
+@@ -267,7 +267,7 @@ static struct ctl_table xfrm4_policy_table[] = {
+ { }
+ };
+
+-static int __net_init xfrm4_net_init(struct net *net)
++static int __net_init xfrm4_net_sysctl_init(struct net *net)
+ {
+ struct ctl_table *table;
+ struct ctl_table_header *hdr;
+@@ -295,7 +295,7 @@ err_alloc:
+ return -ENOMEM;
+ }
+
+-static void __net_exit xfrm4_net_exit(struct net *net)
++static void __net_exit xfrm4_net_sysctl_exit(struct net *net)
+ {
+ struct ctl_table *table;
+
+@@ -307,12 +307,44 @@ static void __net_exit xfrm4_net_exit(struct net *net)
+ if (!net_eq(net, &init_net))
+ kfree(table);
+ }
++#else /* CONFIG_SYSCTL */
++static int inline xfrm4_net_sysctl_init(struct net *net)
++{
++ return 0;
++}
++
++static void inline xfrm4_net_sysctl_exit(struct net *net)
++{
++}
++#endif
++
++static int __net_init xfrm4_net_init(struct net *net)
++{
++ int ret;
++
++ memcpy(&net->xfrm.xfrm4_dst_ops, &xfrm4_dst_ops_template,
++ sizeof(xfrm4_dst_ops_template));
++ ret = dst_entries_init(&net->xfrm.xfrm4_dst_ops);
++ if (ret)
++ return ret;
++
++ ret = xfrm4_net_sysctl_init(net);
++ if (ret)
++ dst_entries_destroy(&net->xfrm.xfrm4_dst_ops);
++
++ return ret;
++}
++
++static void __net_exit xfrm4_net_exit(struct net *net)
++{
++ xfrm4_net_sysctl_exit(net);
++ dst_entries_destroy(&net->xfrm.xfrm4_dst_ops);
++}
+
+ static struct pernet_operations __net_initdata xfrm4_net_ops = {
+ .init = xfrm4_net_init,
+ .exit = xfrm4_net_exit,
+ };
+-#endif
+
+ static void __init xfrm4_policy_init(void)
+ {
+@@ -321,13 +353,9 @@ static void __init xfrm4_policy_init(void)
+
+ void __init xfrm4_init(void)
+ {
+- dst_entries_init(&xfrm4_dst_ops);
+-
+ xfrm4_state_init();
+ xfrm4_policy_init();
+ xfrm4_protocol_init();
+-#ifdef CONFIG_SYSCTL
+ register_pernet_subsys(&xfrm4_net_ops);
+-#endif
+ }
+
+diff --git a/net/ipv6/addrlabel.c b/net/ipv6/addrlabel.c
+index fd0dc47f471d..70efbdd4d308 100644
+--- a/net/ipv6/addrlabel.c
++++ b/net/ipv6/addrlabel.c
+@@ -558,7 +558,7 @@ static int ip6addrlbl_get(struct sk_buff *in_skb, struct nlmsghdr *nlh)
+
+ rcu_read_lock();
+ p = __ipv6_addr_label(net, addr, ipv6_addr_type(addr), ifal->ifal_index);
+- if (p && ip6addrlbl_hold(p))
++ if (p && !ip6addrlbl_hold(p))
+ p = NULL;
+ lseq = ip6addrlbl_table.seq;
+ rcu_read_unlock();
+diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
+index b5a4ac8ce4b1..78d180615495 100644
+--- a/net/ipv6/tcp_ipv6.c
++++ b/net/ipv6/tcp_ipv6.c
+@@ -502,8 +502,10 @@ static int tcp_v6_send_synack(struct sock *sk, struct dst_entry *dst,
+ fl6->flowlabel = ip6_flowlabel(ipv6_hdr(ireq->pktopts));
+
+ skb_set_queue_mapping(skb, queue_mapping);
++ rcu_read_lock();
+ err = ip6_xmit(sk, skb, fl6, rcu_dereference(np->opt),
+ np->tclass);
++ rcu_read_unlock();
+ err = net_xmit_eval(err);
+ }
+
+diff --git a/net/ipv6/xfrm6_mode_tunnel.c b/net/ipv6/xfrm6_mode_tunnel.c
+index 901ef6f8addc..5266ad2d6419 100644
+--- a/net/ipv6/xfrm6_mode_tunnel.c
++++ b/net/ipv6/xfrm6_mode_tunnel.c
+@@ -24,7 +24,7 @@ static inline void ipip6_ecn_decapsulate(struct sk_buff *skb)
+ struct ipv6hdr *inner_iph = ipipv6_hdr(skb);
+
+ if (INET_ECN_is_ce(ipv6_get_dsfield(outer_iph)))
+- IP6_ECN_set_ce(inner_iph);
++ IP6_ECN_set_ce(skb, inner_iph);
+ }
+
+ /* Add encapsulation header.
+diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c
+index 5f983644373a..d2425cef8a38 100644
+--- a/net/ipv6/xfrm6_policy.c
++++ b/net/ipv6/xfrm6_policy.c
+@@ -284,7 +284,7 @@ static void xfrm6_dst_ifdown(struct dst_entry *dst, struct net_device *dev,
+ xfrm_dst_ifdown(dst, dev);
+ }
+
+-static struct dst_ops xfrm6_dst_ops = {
++static struct dst_ops xfrm6_dst_ops_template = {
+ .family = AF_INET6,
+ .protocol = cpu_to_be16(ETH_P_IPV6),
+ .gc = xfrm6_garbage_collect,
+@@ -299,7 +299,7 @@ static struct dst_ops xfrm6_dst_ops = {
+
+ static struct xfrm_policy_afinfo xfrm6_policy_afinfo = {
+ .family = AF_INET6,
+- .dst_ops = &xfrm6_dst_ops,
++ .dst_ops = &xfrm6_dst_ops_template,
+ .dst_lookup = xfrm6_dst_lookup,
+ .get_saddr = xfrm6_get_saddr,
+ .decode_session = _decode_session6,
+@@ -332,7 +332,7 @@ static struct ctl_table xfrm6_policy_table[] = {
+ { }
+ };
+
+-static int __net_init xfrm6_net_init(struct net *net)
++static int __net_init xfrm6_net_sysctl_init(struct net *net)
+ {
+ struct ctl_table *table;
+ struct ctl_table_header *hdr;
+@@ -360,7 +360,7 @@ err_alloc:
+ return -ENOMEM;
+ }
+
+-static void __net_exit xfrm6_net_exit(struct net *net)
++static void __net_exit xfrm6_net_sysctl_exit(struct net *net)
+ {
+ struct ctl_table *table;
+
+@@ -372,24 +372,52 @@ static void __net_exit xfrm6_net_exit(struct net *net)
+ if (!net_eq(net, &init_net))
+ kfree(table);
+ }
++#else /* CONFIG_SYSCTL */
++static int inline xfrm6_net_sysctl_init(struct net *net)
++{
++ return 0;
++}
++
++static void inline xfrm6_net_sysctl_exit(struct net *net)
++{
++}
++#endif
++
++static int __net_init xfrm6_net_init(struct net *net)
++{
++ int ret;
++
++ memcpy(&net->xfrm.xfrm6_dst_ops, &xfrm6_dst_ops_template,
++ sizeof(xfrm6_dst_ops_template));
++ ret = dst_entries_init(&net->xfrm.xfrm6_dst_ops);
++ if (ret)
++ return ret;
++
++ ret = xfrm6_net_sysctl_init(net);
++ if (ret)
++ dst_entries_destroy(&net->xfrm.xfrm6_dst_ops);
++
++ return ret;
++}
++
++static void __net_exit xfrm6_net_exit(struct net *net)
++{
++ xfrm6_net_sysctl_exit(net);
++ dst_entries_destroy(&net->xfrm.xfrm6_dst_ops);
++}
+
+ static struct pernet_operations xfrm6_net_ops = {
+ .init = xfrm6_net_init,
+ .exit = xfrm6_net_exit,
+ };
+-#endif
+
+ int __init xfrm6_init(void)
+ {
+ int ret;
+
+- dst_entries_init(&xfrm6_dst_ops);
+-
+ ret = xfrm6_policy_init();
+- if (ret) {
+- dst_entries_destroy(&xfrm6_dst_ops);
++ if (ret)
+ goto out;
+- }
+ ret = xfrm6_state_init();
+ if (ret)
+ goto out_policy;
+@@ -398,9 +426,7 @@ int __init xfrm6_init(void)
+ if (ret)
+ goto out_state;
+
+-#ifdef CONFIG_SYSCTL
+ register_pernet_subsys(&xfrm6_net_ops);
+-#endif
+ out:
+ return ret;
+ out_state:
+@@ -412,11 +438,8 @@ out_policy:
+
+ void xfrm6_fini(void)
+ {
+-#ifdef CONFIG_SYSCTL
+ unregister_pernet_subsys(&xfrm6_net_ops);
+-#endif
+ xfrm6_protocol_fini();
+ xfrm6_policy_fini();
+ xfrm6_state_fini();
+- dst_entries_destroy(&xfrm6_dst_ops);
+ }
+diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
+index 509bc157ce55..76de04be8900 100644
+--- a/net/mac80211/ibss.c
++++ b/net/mac80211/ibss.c
+@@ -1620,7 +1620,6 @@ void ieee80211_ibss_notify_scan_completed(struct ieee80211_local *local)
+ if (sdata->vif.type != NL80211_IFTYPE_ADHOC)
+ continue;
+ sdata->u.ibss.last_scan_completed = jiffies;
+- ieee80211_queue_work(&local->hw, &sdata->work);
+ }
+ mutex_unlock(&local->iflist_mtx);
+ }
+diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c
+index 0c8b2a77d312..2bbc820c7dfc 100644
+--- a/net/mac80211/mesh.c
++++ b/net/mac80211/mesh.c
+@@ -1297,17 +1297,6 @@ out:
+ sdata_unlock(sdata);
+ }
+
+-void ieee80211_mesh_notify_scan_completed(struct ieee80211_local *local)
+-{
+- struct ieee80211_sub_if_data *sdata;
+-
+- rcu_read_lock();
+- list_for_each_entry_rcu(sdata, &local->interfaces, list)
+- if (ieee80211_vif_is_mesh(&sdata->vif) &&
+- ieee80211_sdata_running(sdata))
+- ieee80211_queue_work(&local->hw, &sdata->work);
+- rcu_read_unlock();
+-}
+
+ void ieee80211_mesh_init_sdata(struct ieee80211_sub_if_data *sdata)
+ {
+diff --git a/net/mac80211/mesh.h b/net/mac80211/mesh.h
+index f39a19f9090f..1ca355b5b608 100644
+--- a/net/mac80211/mesh.h
++++ b/net/mac80211/mesh.h
+@@ -355,14 +355,10 @@ static inline bool mesh_path_sel_is_hwmp(struct ieee80211_sub_if_data *sdata)
+ return sdata->u.mesh.mesh_pp_id == IEEE80211_PATH_PROTOCOL_HWMP;
+ }
+
+-void ieee80211_mesh_notify_scan_completed(struct ieee80211_local *local);
+-
+ void mesh_path_flush_by_iface(struct ieee80211_sub_if_data *sdata);
+ void mesh_sync_adjust_tbtt(struct ieee80211_sub_if_data *sdata);
+ void ieee80211s_stop(void);
+ #else
+-static inline void
+-ieee80211_mesh_notify_scan_completed(struct ieee80211_local *local) {}
+ static inline bool mesh_path_sel_is_hwmp(struct ieee80211_sub_if_data *sdata)
+ { return false; }
+ static inline void mesh_path_flush_by_iface(struct ieee80211_sub_if_data *sdata)
+diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
+index da1f639ecfb6..b13634c677f1 100644
+--- a/net/mac80211/mlme.c
++++ b/net/mac80211/mlme.c
+@@ -3715,8 +3715,6 @@ static void ieee80211_restart_sta_timer(struct ieee80211_sub_if_data *sdata)
+ if (!(flags & IEEE80211_HW_CONNECTION_MONITOR))
+ ieee80211_queue_work(&sdata->local->hw,
+ &sdata->u.mgd.monitor_work);
+- /* and do all the other regular work too */
+- ieee80211_queue_work(&sdata->local->hw, &sdata->work);
+ }
+ }
+
+diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
+index af0d094b2f2f..4835db45e197 100644
+--- a/net/mac80211/scan.c
++++ b/net/mac80211/scan.c
+@@ -290,6 +290,7 @@ static void __ieee80211_scan_completed(struct ieee80211_hw *hw, bool aborted)
+ struct ieee80211_local *local = hw_to_local(hw);
+ bool hw_scan = local->ops->hw_scan;
+ bool was_scanning = local->scanning;
++ struct ieee80211_sub_if_data *sdata;
+
+ lockdep_assert_held(&local->mtx);
+
+@@ -343,7 +344,16 @@ static void __ieee80211_scan_completed(struct ieee80211_hw *hw, bool aborted)
+
+ ieee80211_mlme_notify_scan_completed(local);
+ ieee80211_ibss_notify_scan_completed(local);
+- ieee80211_mesh_notify_scan_completed(local);
++
++ /* Requeue all the work that might have been ignored while
++ * the scan was in progress; if there was none this will
++ * just be a no-op for the particular interface.
++ */
++ list_for_each_entry_rcu(sdata, &local->interfaces, list) {
++ if (ieee80211_sdata_running(sdata))
++ ieee80211_queue_work(&sdata->local->hw, &sdata->work);
++ }
++
+ if (was_scanning)
+ ieee80211_start_next_roc(local);
+ }
+diff --git a/net/mac802154/mib.c b/net/mac802154/mib.c
+index 868a040fd422..488d1f428edb 100644
+--- a/net/mac802154/mib.c
++++ b/net/mac802154/mib.c
+@@ -93,7 +93,7 @@ void mac802154_dev_set_short_addr(struct net_device *dev, __le16 val)
+ if ((priv->hw->ops->set_hw_addr_filt) &&
+ (priv->hw->hw.hw_filt.short_addr != priv->short_addr)) {
+ priv->hw->hw.hw_filt.short_addr = priv->short_addr;
+- set_hw_addr_filt(dev, IEEE802515_AFILT_SADDR_CHANGED);
++ set_hw_addr_filt(dev, IEEE802154_AFILT_SADDR_CHANGED);
+ }
+ }
+
+@@ -121,7 +121,7 @@ void mac802154_dev_set_ieee_addr(struct net_device *dev)
+ if (mac->ops->set_hw_addr_filt &&
+ mac->hw.hw_filt.ieee_addr != priv->extended_addr) {
+ mac->hw.hw_filt.ieee_addr = priv->extended_addr;
+- set_hw_addr_filt(dev, IEEE802515_AFILT_IEEEADDR_CHANGED);
++ set_hw_addr_filt(dev, IEEE802154_AFILT_IEEEADDR_CHANGED);
+ }
+ }
+
+@@ -152,7 +152,7 @@ void mac802154_dev_set_pan_id(struct net_device *dev, __le16 val)
+ if ((priv->hw->ops->set_hw_addr_filt) &&
+ (priv->hw->hw.hw_filt.pan_id != priv->pan_id)) {
+ priv->hw->hw.hw_filt.pan_id = priv->pan_id;
+- set_hw_addr_filt(dev, IEEE802515_AFILT_PANID_CHANGED);
++ set_hw_addr_filt(dev, IEEE802154_AFILT_PANID_CHANGED);
+ }
+ }
+
+diff --git a/net/phonet/af_phonet.c b/net/phonet/af_phonet.c
+index 5a940dbd74a3..f0229223bf91 100644
+--- a/net/phonet/af_phonet.c
++++ b/net/phonet/af_phonet.c
+@@ -377,6 +377,10 @@ static int phonet_rcv(struct sk_buff *skb, struct net_device *dev,
+ struct sockaddr_pn sa;
+ u16 len;
+
++ skb = skb_share_check(skb, GFP_ATOMIC);
++ if (!skb)
++ return NET_RX_DROP;
++
+ /* check we have at least a full Phonet header */
+ if (!pskb_pull(skb, sizeof(struct phonethdr)))
+ goto out;
+diff --git a/net/rfkill/core.c b/net/rfkill/core.c
+index fa7cd792791c..a97bb7332607 100644
+--- a/net/rfkill/core.c
++++ b/net/rfkill/core.c
+@@ -1081,17 +1081,6 @@ static unsigned int rfkill_fop_poll(struct file *file, poll_table *wait)
+ return res;
+ }
+
+-static bool rfkill_readable(struct rfkill_data *data)
+-{
+- bool r;
+-
+- mutex_lock(&data->mtx);
+- r = !list_empty(&data->events);
+- mutex_unlock(&data->mtx);
+-
+- return r;
+-}
+-
+ static ssize_t rfkill_fop_read(struct file *file, char __user *buf,
+ size_t count, loff_t *pos)
+ {
+@@ -1108,8 +1097,11 @@ static ssize_t rfkill_fop_read(struct file *file, char __user *buf,
+ goto out;
+ }
+ mutex_unlock(&data->mtx);
++ /* since we re-check and it just compares pointers,
++ * using !list_empty() without locking isn't a problem
++ */
+ ret = wait_event_interruptible(data->read_wait,
+- rfkill_readable(data));
++ !list_empty(&data->events));
+ mutex_lock(&data->mtx);
+
+ if (ret)
+diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
+index 6efca30894aa..507edcf64088 100644
+--- a/net/sched/sch_generic.c
++++ b/net/sched/sch_generic.c
+@@ -666,8 +666,10 @@ static void qdisc_rcu_free(struct rcu_head *head)
+ {
+ struct Qdisc *qdisc = container_of(head, struct Qdisc, rcu_head);
+
+- if (qdisc_is_percpu_stats(qdisc))
++ if (qdisc_is_percpu_stats(qdisc)) {
+ free_percpu(qdisc->cpu_bstats);
++ free_percpu(qdisc->cpu_qstats);
++ }
+
+ kfree((char *) qdisc - qdisc->padded);
+ }
+diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
+index 3ee27b7704ff..e6bb98e583fb 100644
+--- a/net/sctp/sm_statefuns.c
++++ b/net/sctp/sm_statefuns.c
+@@ -4829,7 +4829,8 @@ sctp_disposition_t sctp_sf_do_9_1_prm_abort(
+
+ retval = SCTP_DISPOSITION_CONSUME;
+
+- sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(abort));
++ if (abort)
++ sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(abort));
+
+ /* Even if we can't send the ABORT due to low memory delete the
+ * TCB. This is a departure from our typical NOMEM handling.
+@@ -4966,7 +4967,8 @@ sctp_disposition_t sctp_sf_cookie_wait_prm_abort(
+ SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT));
+ retval = SCTP_DISPOSITION_CONSUME;
+
+- sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(abort));
++ if (abort)
++ sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(abort));
+
+ sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
+ SCTP_STATE(SCTP_STATE_CLOSED));
+diff --git a/net/sctp/socket.c b/net/sctp/socket.c
+index 4130c1b87dd6..72da7d58ccca 100644
+--- a/net/sctp/socket.c
++++ b/net/sctp/socket.c
+@@ -1518,8 +1518,7 @@ static void sctp_close(struct sock *sk, long timeout)
+ struct sctp_chunk *chunk;
+
+ chunk = sctp_make_abort_user(asoc, NULL, 0);
+- if (chunk)
+- sctp_primitive_ABORT(net, asoc, chunk);
++ sctp_primitive_ABORT(net, asoc, chunk);
+ } else
+ sctp_primitive_SHUTDOWN(net, asoc, NULL);
+ }
+diff --git a/net/sctp/sysctl.c b/net/sctp/sysctl.c
+index 2e9ada10fd84..5b6e7571081c 100644
+--- a/net/sctp/sysctl.c
++++ b/net/sctp/sysctl.c
+@@ -324,7 +324,7 @@ static int proc_sctp_do_hmac_alg(struct ctl_table *ctl, int write,
+ struct ctl_table tbl;
+ bool changed = false;
+ char *none = "none";
+- char tmp[8];
++ char tmp[8] = {0};
+ int ret;
+
+ memset(&tbl, 0, sizeof(struct ctl_table));
+diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
+index 7229794c1419..20d752634efb 100644
+--- a/net/unix/af_unix.c
++++ b/net/unix/af_unix.c
+@@ -1486,6 +1486,21 @@ static void unix_destruct_scm(struct sk_buff *skb)
+ sock_wfree(skb);
+ }
+
++/*
++ * The "user->unix_inflight" variable is protected by the garbage
++ * collection lock, and we just read it locklessly here. If you go
++ * over the limit, there might be a tiny race in actually noticing
++ * it across threads. Tough.
++ */
++static inline bool too_many_unix_fds(struct task_struct *p)
++{
++ struct user_struct *user = current_user();
++
++ if (unlikely(user->unix_inflight > task_rlimit(p, RLIMIT_NOFILE)))
++ return !capable(CAP_SYS_RESOURCE) && !capable(CAP_SYS_ADMIN);
++ return false;
++}
++
+ #define MAX_RECURSION_LEVEL 4
+
+ static int unix_attach_fds(struct scm_cookie *scm, struct sk_buff *skb)
+@@ -1494,6 +1509,9 @@ static int unix_attach_fds(struct scm_cookie *scm, struct sk_buff *skb)
+ unsigned char max_level = 0;
+ int unix_sock_count = 0;
+
++ if (too_many_unix_fds(current))
++ return -ETOOMANYREFS;
++
+ for (i = scm->fp->count - 1; i >= 0; i--) {
+ struct sock *sk = unix_get_socket(scm->fp->fp[i]);
+
+@@ -1515,10 +1533,8 @@ static int unix_attach_fds(struct scm_cookie *scm, struct sk_buff *skb)
+ if (!UNIXCB(skb).fp)
+ return -ENOMEM;
+
+- if (unix_sock_count) {
+- for (i = scm->fp->count - 1; i >= 0; i--)
+- unix_inflight(scm->fp->fp[i]);
+- }
++ for (i = scm->fp->count - 1; i >= 0; i--)
++ unix_inflight(scm->fp->fp[i]);
+ return max_level;
+ }
+
+diff --git a/net/unix/garbage.c b/net/unix/garbage.c
+index 99f7012b23b9..6247787e4760 100644
+--- a/net/unix/garbage.c
++++ b/net/unix/garbage.c
+@@ -125,9 +125,12 @@ struct sock *unix_get_socket(struct file *filp)
+ void unix_inflight(struct file *fp)
+ {
+ struct sock *s = unix_get_socket(fp);
++
++ spin_lock(&unix_gc_lock);
++
+ if (s) {
+ struct unix_sock *u = unix_sk(s);
+- spin_lock(&unix_gc_lock);
++
+ if (atomic_long_inc_return(&u->inflight) == 1) {
+ BUG_ON(!list_empty(&u->link));
+ list_add_tail(&u->link, &gc_inflight_list);
+@@ -135,22 +138,27 @@ void unix_inflight(struct file *fp)
+ BUG_ON(list_empty(&u->link));
+ }
+ unix_tot_inflight++;
+- spin_unlock(&unix_gc_lock);
+ }
++ fp->f_cred->user->unix_inflight++;
++ spin_unlock(&unix_gc_lock);
+ }
+
+ void unix_notinflight(struct file *fp)
+ {
+ struct sock *s = unix_get_socket(fp);
++
++ spin_lock(&unix_gc_lock);
++
+ if (s) {
+ struct unix_sock *u = unix_sk(s);
+- spin_lock(&unix_gc_lock);
++
+ BUG_ON(list_empty(&u->link));
+ if (atomic_long_dec_and_test(&u->inflight))
+ list_del_init(&u->link);
+ unix_tot_inflight--;
+- spin_unlock(&unix_gc_lock);
+ }
++ fp->f_cred->user->unix_inflight--;
++ spin_unlock(&unix_gc_lock);
+ }
+
+ static void scan_inflight(struct sock *x, void (*func)(struct unix_sock *),
+diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
+index f62fd2c5d836..4769382d9478 100644
+--- a/net/xfrm/xfrm_policy.c
++++ b/net/xfrm/xfrm_policy.c
+@@ -2801,7 +2801,6 @@ static struct neighbour *xfrm_neigh_lookup(const struct dst_entry *dst,
+
+ int xfrm_policy_register_afinfo(struct xfrm_policy_afinfo *afinfo)
+ {
+- struct net *net;
+ int err = 0;
+ if (unlikely(afinfo == NULL))
+ return -EINVAL;
+@@ -2832,26 +2831,6 @@ int xfrm_policy_register_afinfo(struct xfrm_policy_afinfo *afinfo)
+ }
+ spin_unlock(&xfrm_policy_afinfo_lock);
+
+- rtnl_lock();
+- for_each_net(net) {
+- struct dst_ops *xfrm_dst_ops;
+-
+- switch (afinfo->family) {
+- case AF_INET:
+- xfrm_dst_ops = &net->xfrm.xfrm4_dst_ops;
+- break;
+-#if IS_ENABLED(CONFIG_IPV6)
+- case AF_INET6:
+- xfrm_dst_ops = &net->xfrm.xfrm6_dst_ops;
+- break;
+-#endif
+- default:
+- BUG();
+- }
+- *xfrm_dst_ops = *afinfo->dst_ops;
+- }
+- rtnl_unlock();
+-
+ return err;
+ }
+ EXPORT_SYMBOL(xfrm_policy_register_afinfo);
+@@ -2887,22 +2866,6 @@ int xfrm_policy_unregister_afinfo(struct xfrm_policy_afinfo *afinfo)
+ }
+ EXPORT_SYMBOL(xfrm_policy_unregister_afinfo);
+
+-static void __net_init xfrm_dst_ops_init(struct net *net)
+-{
+- struct xfrm_policy_afinfo *afinfo;
+-
+- rcu_read_lock();
+- afinfo = rcu_dereference(xfrm_policy_afinfo[AF_INET]);
+- if (afinfo)
+- net->xfrm.xfrm4_dst_ops = *afinfo->dst_ops;
+-#if IS_ENABLED(CONFIG_IPV6)
+- afinfo = rcu_dereference(xfrm_policy_afinfo[AF_INET6]);
+- if (afinfo)
+- net->xfrm.xfrm6_dst_ops = *afinfo->dst_ops;
+-#endif
+- rcu_read_unlock();
+-}
+-
+ static int xfrm_dev_event(struct notifier_block *this, unsigned long event, void *ptr)
+ {
+ struct net_device *dev = netdev_notifier_info_to_dev(ptr);
+@@ -3050,7 +3013,6 @@ static int __net_init xfrm_net_init(struct net *net)
+ rv = xfrm_policy_init(net);
+ if (rv < 0)
+ goto out_policy;
+- xfrm_dst_ops_init(net);
+ rv = xfrm_sysctl_init(net);
+ if (rv < 0)
+ goto out_sysctl;
+diff --git a/scripts/bloat-o-meter b/scripts/bloat-o-meter
+index 23e78dcd12bf..38b64f487315 100755
+--- a/scripts/bloat-o-meter
++++ b/scripts/bloat-o-meter
+@@ -58,8 +58,8 @@ for name in common:
+ delta.sort()
+ delta.reverse()
+
+-print "add/remove: %s/%s grow/shrink: %s/%s up/down: %s/%s (%s)" % \
+- (add, remove, grow, shrink, up, -down, up-down)
+-print "%-40s %7s %7s %+7s" % ("function", "old", "new", "delta")
++print("add/remove: %s/%s grow/shrink: %s/%s up/down: %s/%s (%s)" % \
++ (add, remove, grow, shrink, up, -down, up-down))
++print("%-40s %7s %7s %+7s" % ("function", "old", "new", "delta"))
+ for d, n in delta:
+- if d: print "%-40s %7s %7s %+7d" % (n, old.get(n,"-"), new.get(n,"-"), d)
++ if d: print("%-40s %7s %7s %+7d" % (n, old.get(n,"-"), new.get(n,"-"), d))
+diff --git a/sound/core/compress_offload.c b/sound/core/compress_offload.c
+index 89028fab64fd..53cd5d69293e 100644
+--- a/sound/core/compress_offload.c
++++ b/sound/core/compress_offload.c
+@@ -44,6 +44,13 @@
+ #include <sound/compress_offload.h>
+ #include <sound/compress_driver.h>
+
++/* struct snd_compr_codec_caps overflows the ioctl bit size for some
++ * architectures, so we need to disable the relevant ioctls.
++ */
++#if _IOC_SIZEBITS < 14
++#define COMPR_CODEC_CAPS_OVERFLOW
++#endif
++
+ /* TODO:
+ * - add substream support for multiple devices in case of
+ * SND_DYNAMIC_MINORS is not used
+@@ -438,6 +445,7 @@ out:
+ return retval;
+ }
+
++#ifndef COMPR_CODEC_CAPS_OVERFLOW
+ static int
+ snd_compr_get_codec_caps(struct snd_compr_stream *stream, unsigned long arg)
+ {
+@@ -461,6 +469,7 @@ out:
+ kfree(caps);
+ return retval;
+ }
++#endif /* !COMPR_CODEC_CAPS_OVERFLOW */
+
+ /* revisit this with snd_pcm_preallocate_xxx */
+ static int snd_compr_allocate_buffer(struct snd_compr_stream *stream,
+@@ -799,9 +808,11 @@ static long snd_compr_ioctl(struct file *f, unsigned int cmd, unsigned long arg)
+ case _IOC_NR(SNDRV_COMPRESS_GET_CAPS):
+ retval = snd_compr_get_caps(stream, arg);
+ break;
++#ifndef COMPR_CODEC_CAPS_OVERFLOW
+ case _IOC_NR(SNDRV_COMPRESS_GET_CODEC_CAPS):
+ retval = snd_compr_get_codec_caps(stream, arg);
+ break;
++#endif
+ case _IOC_NR(SNDRV_COMPRESS_SET_PARAMS):
+ retval = snd_compr_set_params(stream, arg);
+ break;
+diff --git a/sound/core/oss/pcm_oss.c b/sound/core/oss/pcm_oss.c
+index ada69d7a8d70..f29f1ce4a455 100644
+--- a/sound/core/oss/pcm_oss.c
++++ b/sound/core/oss/pcm_oss.c
+@@ -834,7 +834,8 @@ static int choose_rate(struct snd_pcm_substream *substream,
+ return snd_pcm_hw_param_near(substream, params, SNDRV_PCM_HW_PARAM_RATE, best_rate, NULL);
+ }
+
+-static int snd_pcm_oss_change_params(struct snd_pcm_substream *substream)
++static int snd_pcm_oss_change_params(struct snd_pcm_substream *substream,
++ bool trylock)
+ {
+ struct snd_pcm_runtime *runtime = substream->runtime;
+ struct snd_pcm_hw_params *params, *sparams;
+@@ -848,7 +849,10 @@ static int snd_pcm_oss_change_params(struct snd_pcm_substream *substream)
+ struct snd_mask sformat_mask;
+ struct snd_mask mask;
+
+- if (mutex_lock_interruptible(&runtime->oss.params_lock))
++ if (trylock) {
++ if (!(mutex_trylock(&runtime->oss.params_lock)))
++ return -EAGAIN;
++ } else if (mutex_lock_interruptible(&runtime->oss.params_lock))
+ return -EINTR;
+ sw_params = kmalloc(sizeof(*sw_params), GFP_KERNEL);
+ params = kmalloc(sizeof(*params), GFP_KERNEL);
+@@ -1093,7 +1097,7 @@ static int snd_pcm_oss_get_active_substream(struct snd_pcm_oss_file *pcm_oss_fil
+ if (asubstream == NULL)
+ asubstream = substream;
+ if (substream->runtime->oss.params) {
+- err = snd_pcm_oss_change_params(substream);
++ err = snd_pcm_oss_change_params(substream, false);
+ if (err < 0)
+ return err;
+ }
+@@ -1133,7 +1137,7 @@ static int snd_pcm_oss_make_ready(struct snd_pcm_substream *substream)
+ return 0;
+ runtime = substream->runtime;
+ if (runtime->oss.params) {
+- err = snd_pcm_oss_change_params(substream);
++ err = snd_pcm_oss_change_params(substream, false);
+ if (err < 0)
+ return err;
+ }
+@@ -2164,7 +2168,7 @@ static int snd_pcm_oss_get_space(struct snd_pcm_oss_file *pcm_oss_file, int stre
+ runtime = substream->runtime;
+
+ if (runtime->oss.params &&
+- (err = snd_pcm_oss_change_params(substream)) < 0)
++ (err = snd_pcm_oss_change_params(substream, false)) < 0)
+ return err;
+
+ info.fragsize = runtime->oss.period_bytes;
+@@ -2801,7 +2805,12 @@ static int snd_pcm_oss_mmap(struct file *file, struct vm_area_struct *area)
+ return -EIO;
+
+ if (runtime->oss.params) {
+- if ((err = snd_pcm_oss_change_params(substream)) < 0)
++ /* use mutex_trylock() for params_lock for avoiding a deadlock
++ * between mmap_sem and params_lock taken by
++ * copy_from/to_user() in snd_pcm_oss_write/read()
++ */
++ err = snd_pcm_oss_change_params(substream, true);
++ if (err < 0)
+ return err;
+ }
+ #ifdef CONFIG_SND_PCM_OSS_PLUGINS
+diff --git a/sound/core/rawmidi.c b/sound/core/rawmidi.c
+index 6fc71a4c8a51..857741431fc6 100644
+--- a/sound/core/rawmidi.c
++++ b/sound/core/rawmidi.c
+@@ -952,31 +952,36 @@ static long snd_rawmidi_kernel_read1(struct snd_rawmidi_substream *substream,
+ unsigned long flags;
+ long result = 0, count1;
+ struct snd_rawmidi_runtime *runtime = substream->runtime;
++ unsigned long appl_ptr;
+
++ spin_lock_irqsave(&runtime->lock, flags);
+ while (count > 0 && runtime->avail) {
+ count1 = runtime->buffer_size - runtime->appl_ptr;
+ if (count1 > count)
+ count1 = count;
+- spin_lock_irqsave(&runtime->lock, flags);
+ if (count1 > (int)runtime->avail)
+ count1 = runtime->avail;
++
++ /* update runtime->appl_ptr before unlocking for userbuf */
++ appl_ptr = runtime->appl_ptr;
++ runtime->appl_ptr += count1;
++ runtime->appl_ptr %= runtime->buffer_size;
++ runtime->avail -= count1;
++
+ if (kernelbuf)
+- memcpy(kernelbuf + result, runtime->buffer + runtime->appl_ptr, count1);
++ memcpy(kernelbuf + result, runtime->buffer + appl_ptr, count1);
+ if (userbuf) {
+ spin_unlock_irqrestore(&runtime->lock, flags);
+ if (copy_to_user(userbuf + result,
+- runtime->buffer + runtime->appl_ptr, count1)) {
++ runtime->buffer + appl_ptr, count1)) {
+ return result > 0 ? result : -EFAULT;
+ }
+ spin_lock_irqsave(&runtime->lock, flags);
+ }
+- runtime->appl_ptr += count1;
+- runtime->appl_ptr %= runtime->buffer_size;
+- runtime->avail -= count1;
+- spin_unlock_irqrestore(&runtime->lock, flags);
+ result += count1;
+ count -= count1;
+ }
++ spin_unlock_irqrestore(&runtime->lock, flags);
+ return result;
+ }
+
+@@ -1065,23 +1070,16 @@ int snd_rawmidi_transmit_empty(struct snd_rawmidi_substream *substream)
+ EXPORT_SYMBOL(snd_rawmidi_transmit_empty);
+
+ /**
+- * snd_rawmidi_transmit_peek - copy data from the internal buffer
++ * __snd_rawmidi_transmit_peek - copy data from the internal buffer
+ * @substream: the rawmidi substream
+ * @buffer: the buffer pointer
+ * @count: data size to transfer
+ *
+- * Copies data from the internal output buffer to the given buffer.
+- *
+- * Call this in the interrupt handler when the midi output is ready,
+- * and call snd_rawmidi_transmit_ack() after the transmission is
+- * finished.
+- *
+- * Return: The size of copied data, or a negative error code on failure.
++ * This is a variant of snd_rawmidi_transmit_peek() without spinlock.
+ */
+-int snd_rawmidi_transmit_peek(struct snd_rawmidi_substream *substream,
++int __snd_rawmidi_transmit_peek(struct snd_rawmidi_substream *substream,
+ unsigned char *buffer, int count)
+ {
+- unsigned long flags;
+ int result, count1;
+ struct snd_rawmidi_runtime *runtime = substream->runtime;
+
+@@ -1091,7 +1089,6 @@ int snd_rawmidi_transmit_peek(struct snd_rawmidi_substream *substream,
+ return -EINVAL;
+ }
+ result = 0;
+- spin_lock_irqsave(&runtime->lock, flags);
+ if (runtime->avail >= runtime->buffer_size) {
+ /* warning: lowlevel layer MUST trigger down the hardware */
+ goto __skip;
+@@ -1116,25 +1113,47 @@ int snd_rawmidi_transmit_peek(struct snd_rawmidi_substream *substream,
+ }
+ }
+ __skip:
++ return result;
++}
++EXPORT_SYMBOL(__snd_rawmidi_transmit_peek);
++
++/**
++ * snd_rawmidi_transmit_peek - copy data from the internal buffer
++ * @substream: the rawmidi substream
++ * @buffer: the buffer pointer
++ * @count: data size to transfer
++ *
++ * Copies data from the internal output buffer to the given buffer.
++ *
++ * Call this in the interrupt handler when the midi output is ready,
++ * and call snd_rawmidi_transmit_ack() after the transmission is
++ * finished.
++ *
++ * Return: The size of copied data, or a negative error code on failure.
++ */
++int snd_rawmidi_transmit_peek(struct snd_rawmidi_substream *substream,
++ unsigned char *buffer, int count)
++{
++ struct snd_rawmidi_runtime *runtime = substream->runtime;
++ int result;
++ unsigned long flags;
++
++ spin_lock_irqsave(&runtime->lock, flags);
++ result = __snd_rawmidi_transmit_peek(substream, buffer, count);
+ spin_unlock_irqrestore(&runtime->lock, flags);
+ return result;
+ }
+ EXPORT_SYMBOL(snd_rawmidi_transmit_peek);
+
+ /**
+- * snd_rawmidi_transmit_ack - acknowledge the transmission
++ * __snd_rawmidi_transmit_ack - acknowledge the transmission
+ * @substream: the rawmidi substream
+ * @count: the transferred count
+ *
+- * Advances the hardware pointer for the internal output buffer with
+- * the given size and updates the condition.
+- * Call after the transmission is finished.
+- *
+- * Return: The advanced size if successful, or a negative error code on failure.
++ * This is a variant of __snd_rawmidi_transmit_ack() without spinlock.
+ */
+-int snd_rawmidi_transmit_ack(struct snd_rawmidi_substream *substream, int count)
++int __snd_rawmidi_transmit_ack(struct snd_rawmidi_substream *substream, int count)
+ {
+- unsigned long flags;
+ struct snd_rawmidi_runtime *runtime = substream->runtime;
+
+ if (runtime->buffer == NULL) {
+@@ -1142,7 +1161,6 @@ int snd_rawmidi_transmit_ack(struct snd_rawmidi_substream *substream, int count)
+ "snd_rawmidi_transmit_ack: output is not active!!!\n");
+ return -EINVAL;
+ }
+- spin_lock_irqsave(&runtime->lock, flags);
+ snd_BUG_ON(runtime->avail + count > runtime->buffer_size);
+ runtime->hw_ptr += count;
+ runtime->hw_ptr %= runtime->buffer_size;
+@@ -1152,9 +1170,32 @@ int snd_rawmidi_transmit_ack(struct snd_rawmidi_substream *substream, int count)
+ if (runtime->drain || snd_rawmidi_ready(substream))
+ wake_up(&runtime->sleep);
+ }
+- spin_unlock_irqrestore(&runtime->lock, flags);
+ return count;
+ }
++EXPORT_SYMBOL(__snd_rawmidi_transmit_ack);
++
++/**
++ * snd_rawmidi_transmit_ack - acknowledge the transmission
++ * @substream: the rawmidi substream
++ * @count: the transferred count
++ *
++ * Advances the hardware pointer for the internal output buffer with
++ * the given size and updates the condition.
++ * Call after the transmission is finished.
++ *
++ * Return: The advanced size if successful, or a negative error code on failure.
++ */
++int snd_rawmidi_transmit_ack(struct snd_rawmidi_substream *substream, int count)
++{
++ struct snd_rawmidi_runtime *runtime = substream->runtime;
++ int result;
++ unsigned long flags;
++
++ spin_lock_irqsave(&runtime->lock, flags);
++ result = __snd_rawmidi_transmit_ack(substream, count);
++ spin_unlock_irqrestore(&runtime->lock, flags);
++ return result;
++}
+ EXPORT_SYMBOL(snd_rawmidi_transmit_ack);
+
+ /**
+@@ -1170,12 +1211,22 @@ EXPORT_SYMBOL(snd_rawmidi_transmit_ack);
+ int snd_rawmidi_transmit(struct snd_rawmidi_substream *substream,
+ unsigned char *buffer, int count)
+ {
++ struct snd_rawmidi_runtime *runtime = substream->runtime;
++ int result;
++ unsigned long flags;
++
++ spin_lock_irqsave(&runtime->lock, flags);
+ if (!substream->opened)
+- return -EBADFD;
+- count = snd_rawmidi_transmit_peek(substream, buffer, count);
+- if (count < 0)
+- return count;
+- return snd_rawmidi_transmit_ack(substream, count);
++ result = -EBADFD;
++ else {
++ count = __snd_rawmidi_transmit_peek(substream, buffer, count);
++ if (count <= 0)
++ result = count;
++ else
++ result = __snd_rawmidi_transmit_ack(substream, count);
++ }
++ spin_unlock_irqrestore(&runtime->lock, flags);
++ return result;
+ }
+ EXPORT_SYMBOL(snd_rawmidi_transmit);
+
+@@ -1187,8 +1238,9 @@ static long snd_rawmidi_kernel_write1(struct snd_rawmidi_substream *substream,
+ unsigned long flags;
+ long count1, result;
+ struct snd_rawmidi_runtime *runtime = substream->runtime;
++ unsigned long appl_ptr;
+
+- if (snd_BUG_ON(!kernelbuf && !userbuf))
++ if (!kernelbuf && !userbuf)
+ return -EINVAL;
+ if (snd_BUG_ON(!runtime->buffer))
+ return -EINVAL;
+@@ -1207,12 +1259,19 @@ static long snd_rawmidi_kernel_write1(struct snd_rawmidi_substream *substream,
+ count1 = count;
+ if (count1 > (long)runtime->avail)
+ count1 = runtime->avail;
++
++ /* update runtime->appl_ptr before unlocking for userbuf */
++ appl_ptr = runtime->appl_ptr;
++ runtime->appl_ptr += count1;
++ runtime->appl_ptr %= runtime->buffer_size;
++ runtime->avail -= count1;
++
+ if (kernelbuf)
+- memcpy(runtime->buffer + runtime->appl_ptr,
++ memcpy(runtime->buffer + appl_ptr,
+ kernelbuf + result, count1);
+ else if (userbuf) {
+ spin_unlock_irqrestore(&runtime->lock, flags);
+- if (copy_from_user(runtime->buffer + runtime->appl_ptr,
++ if (copy_from_user(runtime->buffer + appl_ptr,
+ userbuf + result, count1)) {
+ spin_lock_irqsave(&runtime->lock, flags);
+ result = result > 0 ? result : -EFAULT;
+@@ -1220,9 +1279,6 @@ static long snd_rawmidi_kernel_write1(struct snd_rawmidi_substream *substream,
+ }
+ spin_lock_irqsave(&runtime->lock, flags);
+ }
+- runtime->appl_ptr += count1;
+- runtime->appl_ptr %= runtime->buffer_size;
+- runtime->avail -= count1;
+ result += count1;
+ count -= count1;
+ }
+diff --git a/sound/core/seq/oss/seq_oss_init.c b/sound/core/seq/oss/seq_oss_init.c
+index b9184d20c39f..beea8c861f49 100644
+--- a/sound/core/seq/oss/seq_oss_init.c
++++ b/sound/core/seq/oss/seq_oss_init.c
+@@ -204,7 +204,7 @@ snd_seq_oss_open(struct file *file, int level)
+
+ dp->index = i;
+ if (i >= SNDRV_SEQ_OSS_MAX_CLIENTS) {
+- pr_err("ALSA: seq_oss: too many applications\n");
++ pr_debug("ALSA: seq_oss: too many applications\n");
+ rc = -ENOMEM;
+ goto _error;
+ }
+diff --git a/sound/core/seq/oss/seq_oss_synth.c b/sound/core/seq/oss/seq_oss_synth.c
+index 701feb71b700..ac3d7d2125e9 100644
+--- a/sound/core/seq/oss/seq_oss_synth.c
++++ b/sound/core/seq/oss/seq_oss_synth.c
+@@ -308,7 +308,7 @@ snd_seq_oss_synth_cleanup(struct seq_oss_devinfo *dp)
+ struct seq_oss_synth *rec;
+ struct seq_oss_synthinfo *info;
+
+- if (snd_BUG_ON(dp->max_synthdev >= SNDRV_SEQ_OSS_MAX_SYNTH_DEVS))
++ if (snd_BUG_ON(dp->max_synthdev > SNDRV_SEQ_OSS_MAX_SYNTH_DEVS))
+ return;
+ for (i = 0; i < dp->max_synthdev; i++) {
+ info = &dp->synths[i];
+diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c
+index 225c73152ee9..a4dabd55e397 100644
+--- a/sound/core/seq/seq_clientmgr.c
++++ b/sound/core/seq/seq_clientmgr.c
+@@ -678,6 +678,9 @@ static int deliver_to_subscribers(struct snd_seq_client *client,
+ else
+ down_read(&grp->list_mutex);
+ list_for_each_entry(subs, &grp->list_head, src_list) {
++ /* both ports ready? */
++ if (atomic_read(&subs->ref_count) != 2)
++ continue;
+ event->dest = subs->info.dest;
+ if (subs->info.flags & SNDRV_SEQ_PORT_SUBS_TIMESTAMP)
+ /* convert time according to flag with subscription */
+diff --git a/sound/core/seq/seq_ports.c b/sound/core/seq/seq_ports.c
+index 794a341bf0e5..2dcdf81e0abb 100644
+--- a/sound/core/seq/seq_ports.c
++++ b/sound/core/seq/seq_ports.c
+@@ -175,10 +175,6 @@ struct snd_seq_client_port *snd_seq_create_port(struct snd_seq_client *client,
+ }
+
+ /* */
+-enum group_type {
+- SRC_LIST, DEST_LIST
+-};
+-
+ static int subscribe_port(struct snd_seq_client *client,
+ struct snd_seq_client_port *port,
+ struct snd_seq_port_subs_info *grp,
+@@ -205,6 +201,20 @@ static struct snd_seq_client_port *get_client_port(struct snd_seq_addr *addr,
+ return NULL;
+ }
+
++static void delete_and_unsubscribe_port(struct snd_seq_client *client,
++ struct snd_seq_client_port *port,
++ struct snd_seq_subscribers *subs,
++ bool is_src, bool ack);
++
++static inline struct snd_seq_subscribers *
++get_subscriber(struct list_head *p, bool is_src)
++{
++ if (is_src)
++ return list_entry(p, struct snd_seq_subscribers, src_list);
++ else
++ return list_entry(p, struct snd_seq_subscribers, dest_list);
++}
++
+ /*
+ * remove all subscribers on the list
+ * this is called from port_delete, for each src and dest list.
+@@ -212,7 +222,7 @@ static struct snd_seq_client_port *get_client_port(struct snd_seq_addr *addr,
+ static void clear_subscriber_list(struct snd_seq_client *client,
+ struct snd_seq_client_port *port,
+ struct snd_seq_port_subs_info *grp,
+- int grptype)
++ int is_src)
+ {
+ struct list_head *p, *n;
+
+@@ -221,15 +231,13 @@ static void clear_subscriber_list(struct snd_seq_client *client,
+ struct snd_seq_client *c;
+ struct snd_seq_client_port *aport;
+
+- if (grptype == SRC_LIST) {
+- subs = list_entry(p, struct snd_seq_subscribers, src_list);
++ subs = get_subscriber(p, is_src);
++ if (is_src)
+ aport = get_client_port(&subs->info.dest, &c);
+- } else {
+- subs = list_entry(p, struct snd_seq_subscribers, dest_list);
++ else
+ aport = get_client_port(&subs->info.sender, &c);
+- }
+- list_del(p);
+- unsubscribe_port(client, port, grp, &subs->info, 0);
++ delete_and_unsubscribe_port(client, port, subs, is_src, false);
++
+ if (!aport) {
+ /* looks like the connected port is being deleted.
+ * we decrease the counter, and when both ports are deleted
+@@ -237,21 +245,14 @@ static void clear_subscriber_list(struct snd_seq_client *client,
+ */
+ if (atomic_dec_and_test(&subs->ref_count))
+ kfree(subs);
+- } else {
+- /* ok we got the connected port */
+- struct snd_seq_port_subs_info *agrp;
+- agrp = (grptype == SRC_LIST) ? &aport->c_dest : &aport->c_src;
+- down_write(&agrp->list_mutex);
+- if (grptype == SRC_LIST)
+- list_del(&subs->dest_list);
+- else
+- list_del(&subs->src_list);
+- up_write(&agrp->list_mutex);
+- unsubscribe_port(c, aport, agrp, &subs->info, 1);
+- kfree(subs);
+- snd_seq_port_unlock(aport);
+- snd_seq_client_unlock(c);
++ continue;
+ }
++
++ /* ok we got the connected port */
++ delete_and_unsubscribe_port(c, aport, subs, !is_src, true);
++ kfree(subs);
++ snd_seq_port_unlock(aport);
++ snd_seq_client_unlock(c);
+ }
+ }
+
+@@ -264,8 +265,8 @@ static int port_delete(struct snd_seq_client *client,
+ snd_use_lock_sync(&port->use_lock);
+
+ /* clear subscribers info */
+- clear_subscriber_list(client, port, &port->c_src, SRC_LIST);
+- clear_subscriber_list(client, port, &port->c_dest, DEST_LIST);
++ clear_subscriber_list(client, port, &port->c_src, true);
++ clear_subscriber_list(client, port, &port->c_dest, false);
+
+ if (port->private_free)
+ port->private_free(port->private_data);
+@@ -484,85 +485,120 @@ static int match_subs_info(struct snd_seq_port_subscribe *r,
+ return 0;
+ }
+
+-
+-/* connect two ports */
+-int snd_seq_port_connect(struct snd_seq_client *connector,
+- struct snd_seq_client *src_client,
+- struct snd_seq_client_port *src_port,
+- struct snd_seq_client *dest_client,
+- struct snd_seq_client_port *dest_port,
+- struct snd_seq_port_subscribe *info)
++static int check_and_subscribe_port(struct snd_seq_client *client,
++ struct snd_seq_client_port *port,
++ struct snd_seq_subscribers *subs,
++ bool is_src, bool exclusive, bool ack)
+ {
+- struct snd_seq_port_subs_info *src = &src_port->c_src;
+- struct snd_seq_port_subs_info *dest = &dest_port->c_dest;
+- struct snd_seq_subscribers *subs, *s;
+- int err, src_called = 0;
+- unsigned long flags;
+- int exclusive;
++ struct snd_seq_port_subs_info *grp;
++ struct list_head *p;
++ struct snd_seq_subscribers *s;
++ int err;
+
+- subs = kzalloc(sizeof(*subs), GFP_KERNEL);
+- if (! subs)
+- return -ENOMEM;
+-
+- subs->info = *info;
+- atomic_set(&subs->ref_count, 2);
+-
+- down_write(&src->list_mutex);
+- down_write_nested(&dest->list_mutex, SINGLE_DEPTH_NESTING);
+-
+- exclusive = info->flags & SNDRV_SEQ_PORT_SUBS_EXCLUSIVE ? 1 : 0;
++ grp = is_src ? &port->c_src : &port->c_dest;
+ err = -EBUSY;
++ down_write(&grp->list_mutex);
+ if (exclusive) {
+- if (! list_empty(&src->list_head) || ! list_empty(&dest->list_head))
++ if (!list_empty(&grp->list_head))
+ goto __error;
+ } else {
+- if (src->exclusive || dest->exclusive)
++ if (grp->exclusive)
+ goto __error;
+ /* check whether already exists */
+- list_for_each_entry(s, &src->list_head, src_list) {
+- if (match_subs_info(info, &s->info))
+- goto __error;
+- }
+- list_for_each_entry(s, &dest->list_head, dest_list) {
+- if (match_subs_info(info, &s->info))
++ list_for_each(p, &grp->list_head) {
++ s = get_subscriber(p, is_src);
++ if (match_subs_info(&subs->info, &s->info))
+ goto __error;
+ }
+ }
+
+- if ((err = subscribe_port(src_client, src_port, src, info,
+- connector->number != src_client->number)) < 0)
+- goto __error;
+- src_called = 1;
+-
+- if ((err = subscribe_port(dest_client, dest_port, dest, info,
+- connector->number != dest_client->number)) < 0)
++ err = subscribe_port(client, port, grp, &subs->info, ack);
++ if (err < 0) {
++ grp->exclusive = 0;
+ goto __error;
++ }
+
+ /* add to list */
+- write_lock_irqsave(&src->list_lock, flags);
+- // write_lock(&dest->list_lock); // no other lock yet
+- list_add_tail(&subs->src_list, &src->list_head);
+- list_add_tail(&subs->dest_list, &dest->list_head);
+- // write_unlock(&dest->list_lock); // no other lock yet
+- write_unlock_irqrestore(&src->list_lock, flags);
++ write_lock_irq(&grp->list_lock);
++ if (is_src)
++ list_add_tail(&subs->src_list, &grp->list_head);
++ else
++ list_add_tail(&subs->dest_list, &grp->list_head);
++ grp->exclusive = exclusive;
++ atomic_inc(&subs->ref_count);
++ write_unlock_irq(&grp->list_lock);
++ err = 0;
++
++ __error:
++ up_write(&grp->list_mutex);
++ return err;
++}
+
+- src->exclusive = dest->exclusive = exclusive;
++static void delete_and_unsubscribe_port(struct snd_seq_client *client,
++ struct snd_seq_client_port *port,
++ struct snd_seq_subscribers *subs,
++ bool is_src, bool ack)
++{
++ struct snd_seq_port_subs_info *grp;
++
++ grp = is_src ? &port->c_src : &port->c_dest;
++ down_write(&grp->list_mutex);
++ write_lock_irq(&grp->list_lock);
++ if (is_src)
++ list_del(&subs->src_list);
++ else
++ list_del(&subs->dest_list);
++ grp->exclusive = 0;
++ write_unlock_irq(&grp->list_lock);
++ up_write(&grp->list_mutex);
++
++ unsubscribe_port(client, port, grp, &subs->info, ack);
++}
++
++/* connect two ports */
++int snd_seq_port_connect(struct snd_seq_client *connector,
++ struct snd_seq_client *src_client,
++ struct snd_seq_client_port *src_port,
++ struct snd_seq_client *dest_client,
++ struct snd_seq_client_port *dest_port,
++ struct snd_seq_port_subscribe *info)
++{
++ struct snd_seq_subscribers *subs;
++ bool exclusive;
++ int err;
++
++ subs = kzalloc(sizeof(*subs), GFP_KERNEL);
++ if (!subs)
++ return -ENOMEM;
++
++ subs->info = *info;
++ atomic_set(&subs->ref_count, 0);
++ INIT_LIST_HEAD(&subs->src_list);
++ INIT_LIST_HEAD(&subs->dest_list);
++
++ exclusive = !!(info->flags & SNDRV_SEQ_PORT_SUBS_EXCLUSIVE);
++
++ err = check_and_subscribe_port(src_client, src_port, subs, true,
++ exclusive,
++ connector->number != src_client->number);
++ if (err < 0)
++ goto error;
++ err = check_and_subscribe_port(dest_client, dest_port, subs, false,
++ exclusive,
++ connector->number != dest_client->number);
++ if (err < 0)
++ goto error_dest;
+
+- up_write(&dest->list_mutex);
+- up_write(&src->list_mutex);
+ return 0;
+
+- __error:
+- if (src_called)
+- unsubscribe_port(src_client, src_port, src, info,
+- connector->number != src_client->number);
++ error_dest:
++ delete_and_unsubscribe_port(src_client, src_port, subs, true,
++ connector->number != src_client->number);
++ error:
+ kfree(subs);
+- up_write(&dest->list_mutex);
+- up_write(&src->list_mutex);
+ return err;
+ }
+
+-
+ /* remove the connection */
+ int snd_seq_port_disconnect(struct snd_seq_client *connector,
+ struct snd_seq_client *src_client,
+@@ -572,37 +608,28 @@ int snd_seq_port_disconnect(struct snd_seq_client *connector,
+ struct snd_seq_port_subscribe *info)
+ {
+ struct snd_seq_port_subs_info *src = &src_port->c_src;
+- struct snd_seq_port_subs_info *dest = &dest_port->c_dest;
+ struct snd_seq_subscribers *subs;
+ int err = -ENOENT;
+- unsigned long flags;
+
+ down_write(&src->list_mutex);
+- down_write_nested(&dest->list_mutex, SINGLE_DEPTH_NESTING);
+-
+ /* look for the connection */
+ list_for_each_entry(subs, &src->list_head, src_list) {
+ if (match_subs_info(info, &subs->info)) {
+- write_lock_irqsave(&src->list_lock, flags);
+- // write_lock(&dest->list_lock); // no lock yet
+- list_del(&subs->src_list);
+- list_del(&subs->dest_list);
+- // write_unlock(&dest->list_lock);
+- write_unlock_irqrestore(&src->list_lock, flags);
+- src->exclusive = dest->exclusive = 0;
+- unsubscribe_port(src_client, src_port, src, info,
+- connector->number != src_client->number);
+- unsubscribe_port(dest_client, dest_port, dest, info,
+- connector->number != dest_client->number);
+- kfree(subs);
++ atomic_dec(&subs->ref_count); /* mark as not ready */
+ err = 0;
+ break;
+ }
+ }
+-
+- up_write(&dest->list_mutex);
+ up_write(&src->list_mutex);
+- return err;
++ if (err < 0)
++ return err;
++
++ delete_and_unsubscribe_port(src_client, src_port, subs, true,
++ connector->number != src_client->number);
++ delete_and_unsubscribe_port(dest_client, dest_port, subs, false,
++ connector->number != dest_client->number);
++ kfree(subs);
++ return 0;
+ }
+
+
+diff --git a/sound/core/seq/seq_timer.c b/sound/core/seq/seq_timer.c
+index e73605393eee..c943dc41c6fe 100644
+--- a/sound/core/seq/seq_timer.c
++++ b/sound/core/seq/seq_timer.c
+@@ -92,6 +92,9 @@ void snd_seq_timer_delete(struct snd_seq_timer **tmr)
+
+ void snd_seq_timer_defaults(struct snd_seq_timer * tmr)
+ {
++ unsigned long flags;
++
++ spin_lock_irqsave(&tmr->lock, flags);
+ /* setup defaults */
+ tmr->ppq = 96; /* 96 PPQ */
+ tmr->tempo = 500000; /* 120 BPM */
+@@ -107,21 +110,25 @@ void snd_seq_timer_defaults(struct snd_seq_timer * tmr)
+ tmr->preferred_resolution = seq_default_timer_resolution;
+
+ tmr->skew = tmr->skew_base = SKEW_BASE;
++ spin_unlock_irqrestore(&tmr->lock, flags);
+ }
+
+-void snd_seq_timer_reset(struct snd_seq_timer * tmr)
++static void seq_timer_reset(struct snd_seq_timer *tmr)
+ {
+- unsigned long flags;
+-
+- spin_lock_irqsave(&tmr->lock, flags);
+-
+ /* reset time & songposition */
+ tmr->cur_time.tv_sec = 0;
+ tmr->cur_time.tv_nsec = 0;
+
+ tmr->tick.cur_tick = 0;
+ tmr->tick.fraction = 0;
++}
++
++void snd_seq_timer_reset(struct snd_seq_timer *tmr)
++{
++ unsigned long flags;
+
++ spin_lock_irqsave(&tmr->lock, flags);
++ seq_timer_reset(tmr);
+ spin_unlock_irqrestore(&tmr->lock, flags);
+ }
+
+@@ -140,8 +147,11 @@ static void snd_seq_timer_interrupt(struct snd_timer_instance *timeri,
+ tmr = q->timer;
+ if (tmr == NULL)
+ return;
+- if (!tmr->running)
++ spin_lock_irqsave(&tmr->lock, flags);
++ if (!tmr->running) {
++ spin_unlock_irqrestore(&tmr->lock, flags);
+ return;
++ }
+
+ resolution *= ticks;
+ if (tmr->skew != tmr->skew_base) {
+@@ -150,8 +160,6 @@ static void snd_seq_timer_interrupt(struct snd_timer_instance *timeri,
+ (((resolution & 0xffff) * tmr->skew) >> 16);
+ }
+
+- spin_lock_irqsave(&tmr->lock, flags);
+-
+ /* update timer */
+ snd_seq_inc_time_nsec(&tmr->cur_time, resolution);
+
+@@ -298,26 +306,30 @@ int snd_seq_timer_open(struct snd_seq_queue *q)
+ t->callback = snd_seq_timer_interrupt;
+ t->callback_data = q;
+ t->flags |= SNDRV_TIMER_IFLG_AUTO;
++ spin_lock_irq(&tmr->lock);
+ tmr->timeri = t;
++ spin_unlock_irq(&tmr->lock);
+ return 0;
+ }
+
+ int snd_seq_timer_close(struct snd_seq_queue *q)
+ {
+ struct snd_seq_timer *tmr;
++ struct snd_timer_instance *t;
+
+ tmr = q->timer;
+ if (snd_BUG_ON(!tmr))
+ return -EINVAL;
+- if (tmr->timeri) {
+- snd_timer_stop(tmr->timeri);
+- snd_timer_close(tmr->timeri);
+- tmr->timeri = NULL;
+- }
++ spin_lock_irq(&tmr->lock);
++ t = tmr->timeri;
++ tmr->timeri = NULL;
++ spin_unlock_irq(&tmr->lock);
++ if (t)
++ snd_timer_close(t);
+ return 0;
+ }
+
+-int snd_seq_timer_stop(struct snd_seq_timer * tmr)
++static int seq_timer_stop(struct snd_seq_timer *tmr)
+ {
+ if (! tmr->timeri)
+ return -EINVAL;
+@@ -328,6 +340,17 @@ int snd_seq_timer_stop(struct snd_seq_timer * tmr)
+ return 0;
+ }
+
++int snd_seq_timer_stop(struct snd_seq_timer *tmr)
++{
++ unsigned long flags;
++ int err;
++
++ spin_lock_irqsave(&tmr->lock, flags);
++ err = seq_timer_stop(tmr);
++ spin_unlock_irqrestore(&tmr->lock, flags);
++ return err;
++}
++
+ static int initialize_timer(struct snd_seq_timer *tmr)
+ {
+ struct snd_timer *t;
+@@ -360,13 +383,13 @@ static int initialize_timer(struct snd_seq_timer *tmr)
+ return 0;
+ }
+
+-int snd_seq_timer_start(struct snd_seq_timer * tmr)
++static int seq_timer_start(struct snd_seq_timer *tmr)
+ {
+ if (! tmr->timeri)
+ return -EINVAL;
+ if (tmr->running)
+- snd_seq_timer_stop(tmr);
+- snd_seq_timer_reset(tmr);
++ seq_timer_stop(tmr);
++ seq_timer_reset(tmr);
+ if (initialize_timer(tmr) < 0)
+ return -EINVAL;
+ snd_timer_start(tmr->timeri, tmr->ticks);
+@@ -375,14 +398,25 @@ int snd_seq_timer_start(struct snd_seq_timer * tmr)
+ return 0;
+ }
+
+-int snd_seq_timer_continue(struct snd_seq_timer * tmr)
++int snd_seq_timer_start(struct snd_seq_timer *tmr)
++{
++ unsigned long flags;
++ int err;
++
++ spin_lock_irqsave(&tmr->lock, flags);
++ err = seq_timer_start(tmr);
++ spin_unlock_irqrestore(&tmr->lock, flags);
++ return err;
++}
++
++static int seq_timer_continue(struct snd_seq_timer *tmr)
+ {
+ if (! tmr->timeri)
+ return -EINVAL;
+ if (tmr->running)
+ return -EBUSY;
+ if (! tmr->initialized) {
+- snd_seq_timer_reset(tmr);
++ seq_timer_reset(tmr);
+ if (initialize_timer(tmr) < 0)
+ return -EINVAL;
+ }
+@@ -392,11 +426,24 @@ int snd_seq_timer_continue(struct snd_seq_timer * tmr)
+ return 0;
+ }
+
++int snd_seq_timer_continue(struct snd_seq_timer *tmr)
++{
++ unsigned long flags;
++ int err;
++
++ spin_lock_irqsave(&tmr->lock, flags);
++ err = seq_timer_continue(tmr);
++ spin_unlock_irqrestore(&tmr->lock, flags);
++ return err;
++}
++
+ /* return current 'real' time. use timeofday() to get better granularity. */
+ snd_seq_real_time_t snd_seq_timer_get_cur_time(struct snd_seq_timer *tmr)
+ {
+ snd_seq_real_time_t cur_time;
++ unsigned long flags;
+
++ spin_lock_irqsave(&tmr->lock, flags);
+ cur_time = tmr->cur_time;
+ if (tmr->running) {
+ struct timeval tm;
+@@ -412,7 +459,7 @@ snd_seq_real_time_t snd_seq_timer_get_cur_time(struct snd_seq_timer *tmr)
+ }
+ snd_seq_sanity_real_time(&cur_time);
+ }
+-
++ spin_unlock_irqrestore(&tmr->lock, flags);
+ return cur_time;
+ }
+
+diff --git a/sound/core/seq/seq_virmidi.c b/sound/core/seq/seq_virmidi.c
+index 56e0f4cd3f82..81134e067184 100644
+--- a/sound/core/seq/seq_virmidi.c
++++ b/sound/core/seq/seq_virmidi.c
+@@ -155,21 +155,26 @@ static void snd_virmidi_output_trigger(struct snd_rawmidi_substream *substream,
+ struct snd_virmidi *vmidi = substream->runtime->private_data;
+ int count, res;
+ unsigned char buf[32], *pbuf;
++ unsigned long flags;
+
+ if (up) {
+ vmidi->trigger = 1;
+ if (vmidi->seq_mode == SNDRV_VIRMIDI_SEQ_DISPATCH &&
+ !(vmidi->rdev->flags & SNDRV_VIRMIDI_SUBSCRIBE)) {
+- snd_rawmidi_transmit_ack(substream, substream->runtime->buffer_size - substream->runtime->avail);
+- return; /* ignored */
++ while (snd_rawmidi_transmit(substream, buf,
++ sizeof(buf)) > 0) {
++ /* ignored */
++ }
++ return;
+ }
+ if (vmidi->event.type != SNDRV_SEQ_EVENT_NONE) {
+ if (snd_seq_kernel_client_dispatch(vmidi->client, &vmidi->event, in_atomic(), 0) < 0)
+ return;
+ vmidi->event.type = SNDRV_SEQ_EVENT_NONE;
+ }
++ spin_lock_irqsave(&substream->runtime->lock, flags);
+ while (1) {
+- count = snd_rawmidi_transmit_peek(substream, buf, sizeof(buf));
++ count = __snd_rawmidi_transmit_peek(substream, buf, sizeof(buf));
+ if (count <= 0)
+ break;
+ pbuf = buf;
+@@ -179,16 +184,18 @@ static void snd_virmidi_output_trigger(struct snd_rawmidi_substream *substream,
+ snd_midi_event_reset_encode(vmidi->parser);
+ continue;
+ }
+- snd_rawmidi_transmit_ack(substream, res);
++ __snd_rawmidi_transmit_ack(substream, res);
+ pbuf += res;
+ count -= res;
+ if (vmidi->event.type != SNDRV_SEQ_EVENT_NONE) {
+ if (snd_seq_kernel_client_dispatch(vmidi->client, &vmidi->event, in_atomic(), 0) < 0)
+- return;
++ goto out;
+ vmidi->event.type = SNDRV_SEQ_EVENT_NONE;
+ }
+ }
+ }
++ out:
++ spin_unlock_irqrestore(&substream->runtime->lock, flags);
+ } else {
+ vmidi->trigger = 0;
+ }
+@@ -254,9 +261,13 @@ static int snd_virmidi_output_open(struct snd_rawmidi_substream *substream)
+ */
+ static int snd_virmidi_input_close(struct snd_rawmidi_substream *substream)
+ {
++ struct snd_virmidi_dev *rdev = substream->rmidi->private_data;
+ struct snd_virmidi *vmidi = substream->runtime->private_data;
+- snd_midi_event_free(vmidi->parser);
++
++ write_lock_irq(&rdev->filelist_lock);
+ list_del(&vmidi->list);
++ write_unlock_irq(&rdev->filelist_lock);
++ snd_midi_event_free(vmidi->parser);
+ substream->runtime->private_data = NULL;
+ kfree(vmidi);
+ return 0;
+diff --git a/sound/core/timer.c b/sound/core/timer.c
+index 777a45e08e53..942f36eb6946 100644
+--- a/sound/core/timer.c
++++ b/sound/core/timer.c
+@@ -215,11 +215,13 @@ static void snd_timer_check_master(struct snd_timer_instance *master)
+ slave->slave_id == master->slave_id) {
+ list_move_tail(&slave->open_list, &master->slave_list_head);
+ spin_lock_irq(&slave_active_lock);
++ spin_lock(&master->timer->lock);
+ slave->master = master;
+ slave->timer = master->timer;
+ if (slave->flags & SNDRV_TIMER_IFLG_RUNNING)
+ list_add_tail(&slave->active_list,
+ &master->slave_active_head);
++ spin_unlock(&master->timer->lock);
+ spin_unlock_irq(&slave_active_lock);
+ }
+ }
+@@ -299,8 +301,7 @@ int snd_timer_open(struct snd_timer_instance **ti,
+ return 0;
+ }
+
+-static int _snd_timer_stop(struct snd_timer_instance *timeri,
+- int keep_flag, int event);
++static int _snd_timer_stop(struct snd_timer_instance *timeri, int event);
+
+ /*
+ * close a timer instance
+@@ -342,19 +343,22 @@ int snd_timer_close(struct snd_timer_instance *timeri)
+ spin_unlock_irq(&timer->lock);
+ mutex_lock(®ister_mutex);
+ list_del(&timeri->open_list);
+- if (timer && list_empty(&timer->open_list_head) &&
++ if (list_empty(&timer->open_list_head) &&
+ timer->hw.close)
+ timer->hw.close(timer);
+ /* remove slave links */
++ spin_lock_irq(&slave_active_lock);
++ spin_lock(&timer->lock);
+ list_for_each_entry_safe(slave, tmp, &timeri->slave_list_head,
+ open_list) {
+- spin_lock_irq(&slave_active_lock);
+- _snd_timer_stop(slave, 1, SNDRV_TIMER_EVENT_RESOLUTION);
+ list_move_tail(&slave->open_list, &snd_timer_slave_list);
+ slave->master = NULL;
+ slave->timer = NULL;
+- spin_unlock_irq(&slave_active_lock);
++ list_del_init(&slave->ack_list);
++ list_del_init(&slave->active_list);
+ }
++ spin_unlock(&timer->lock);
++ spin_unlock_irq(&slave_active_lock);
+ mutex_unlock(®ister_mutex);
+ }
+ out:
+@@ -440,10 +444,17 @@ static int snd_timer_start_slave(struct snd_timer_instance *timeri)
+ unsigned long flags;
+
+ spin_lock_irqsave(&slave_active_lock, flags);
++ if (timeri->flags & SNDRV_TIMER_IFLG_RUNNING) {
++ spin_unlock_irqrestore(&slave_active_lock, flags);
++ return -EBUSY;
++ }
+ timeri->flags |= SNDRV_TIMER_IFLG_RUNNING;
+- if (timeri->master)
++ if (timeri->master && timeri->timer) {
++ spin_lock(&timeri->timer->lock);
+ list_add_tail(&timeri->active_list,
+ &timeri->master->slave_active_head);
++ spin_unlock(&timeri->timer->lock);
++ }
+ spin_unlock_irqrestore(&slave_active_lock, flags);
+ return 1; /* delayed start */
+ }
+@@ -461,23 +472,30 @@ int snd_timer_start(struct snd_timer_instance *timeri, unsigned int ticks)
+ return -EINVAL;
+ if (timeri->flags & SNDRV_TIMER_IFLG_SLAVE) {
+ result = snd_timer_start_slave(timeri);
+- snd_timer_notify1(timeri, SNDRV_TIMER_EVENT_START);
++ if (result >= 0)
++ snd_timer_notify1(timeri, SNDRV_TIMER_EVENT_START);
+ return result;
+ }
+ timer = timeri->timer;
+ if (timer == NULL)
+ return -EINVAL;
+ spin_lock_irqsave(&timer->lock, flags);
++ if (timeri->flags & (SNDRV_TIMER_IFLG_RUNNING |
++ SNDRV_TIMER_IFLG_START)) {
++ result = -EBUSY;
++ goto unlock;
++ }
+ timeri->ticks = timeri->cticks = ticks;
+ timeri->pticks = 0;
+ result = snd_timer_start1(timer, timeri, ticks);
++ unlock:
+ spin_unlock_irqrestore(&timer->lock, flags);
+- snd_timer_notify1(timeri, SNDRV_TIMER_EVENT_START);
++ if (result >= 0)
++ snd_timer_notify1(timeri, SNDRV_TIMER_EVENT_START);
+ return result;
+ }
+
+-static int _snd_timer_stop(struct snd_timer_instance * timeri,
+- int keep_flag, int event)
++static int _snd_timer_stop(struct snd_timer_instance *timeri, int event)
+ {
+ struct snd_timer *timer;
+ unsigned long flags;
+@@ -486,17 +504,26 @@ static int _snd_timer_stop(struct snd_timer_instance * timeri,
+ return -ENXIO;
+
+ if (timeri->flags & SNDRV_TIMER_IFLG_SLAVE) {
+- if (!keep_flag) {
+- spin_lock_irqsave(&slave_active_lock, flags);
+- timeri->flags &= ~SNDRV_TIMER_IFLG_RUNNING;
++ spin_lock_irqsave(&slave_active_lock, flags);
++ if (!(timeri->flags & SNDRV_TIMER_IFLG_RUNNING)) {
+ spin_unlock_irqrestore(&slave_active_lock, flags);
++ return -EBUSY;
+ }
++ timeri->flags &= ~SNDRV_TIMER_IFLG_RUNNING;
++ list_del_init(&timeri->ack_list);
++ list_del_init(&timeri->active_list);
++ spin_unlock_irqrestore(&slave_active_lock, flags);
+ goto __end;
+ }
+ timer = timeri->timer;
+ if (!timer)
+ return -EINVAL;
+ spin_lock_irqsave(&timer->lock, flags);
++ if (!(timeri->flags & (SNDRV_TIMER_IFLG_RUNNING |
++ SNDRV_TIMER_IFLG_START))) {
++ spin_unlock_irqrestore(&timer->lock, flags);
++ return -EBUSY;
++ }
+ list_del_init(&timeri->ack_list);
+ list_del_init(&timeri->active_list);
+ if ((timeri->flags & SNDRV_TIMER_IFLG_RUNNING) &&
+@@ -511,9 +538,7 @@ static int _snd_timer_stop(struct snd_timer_instance * timeri,
+ }
+ }
+ }
+- if (!keep_flag)
+- timeri->flags &=
+- ~(SNDRV_TIMER_IFLG_RUNNING | SNDRV_TIMER_IFLG_START);
++ timeri->flags &= ~(SNDRV_TIMER_IFLG_RUNNING | SNDRV_TIMER_IFLG_START);
+ spin_unlock_irqrestore(&timer->lock, flags);
+ __end:
+ if (event != SNDRV_TIMER_EVENT_RESOLUTION)
+@@ -532,7 +557,7 @@ int snd_timer_stop(struct snd_timer_instance *timeri)
+ unsigned long flags;
+ int err;
+
+- err = _snd_timer_stop(timeri, 0, SNDRV_TIMER_EVENT_STOP);
++ err = _snd_timer_stop(timeri, SNDRV_TIMER_EVENT_STOP);
+ if (err < 0)
+ return err;
+ timer = timeri->timer;
+@@ -562,10 +587,15 @@ int snd_timer_continue(struct snd_timer_instance *timeri)
+ if (! timer)
+ return -EINVAL;
+ spin_lock_irqsave(&timer->lock, flags);
++ if (timeri->flags & SNDRV_TIMER_IFLG_RUNNING) {
++ result = -EBUSY;
++ goto unlock;
++ }
+ if (!timeri->cticks)
+ timeri->cticks = 1;
+ timeri->pticks = 0;
+ result = snd_timer_start1(timer, timeri, timer->sticks);
++ unlock:
+ spin_unlock_irqrestore(&timer->lock, flags);
+ snd_timer_notify1(timeri, SNDRV_TIMER_EVENT_CONTINUE);
+ return result;
+@@ -576,7 +606,7 @@ int snd_timer_continue(struct snd_timer_instance *timeri)
+ */
+ int snd_timer_pause(struct snd_timer_instance * timeri)
+ {
+- return _snd_timer_stop(timeri, 0, SNDRV_TIMER_EVENT_PAUSE);
++ return _snd_timer_stop(timeri, SNDRV_TIMER_EVENT_PAUSE);
+ }
+
+ /*
+@@ -693,8 +723,8 @@ void snd_timer_interrupt(struct snd_timer * timer, unsigned long ticks_left)
+ ti->cticks = ti->ticks;
+ } else {
+ ti->flags &= ~SNDRV_TIMER_IFLG_RUNNING;
+- if (--timer->running)
+- list_del(&ti->active_list);
++ --timer->running;
++ list_del_init(&ti->active_list);
+ }
+ if ((timer->hw.flags & SNDRV_TIMER_HW_TASKLET) ||
+ (ti->flags & SNDRV_TIMER_IFLG_FAST))
+diff --git a/sound/drivers/dummy.c b/sound/drivers/dummy.c
+index fab90bd2bd51..1e29a1983791 100644
+--- a/sound/drivers/dummy.c
++++ b/sound/drivers/dummy.c
+@@ -87,7 +87,7 @@ MODULE_PARM_DESC(pcm_substreams, "PCM substreams # (1-128) for dummy driver.");
+ module_param(fake_buffer, bool, 0444);
+ MODULE_PARM_DESC(fake_buffer, "Fake buffer allocations.");
+ #ifdef CONFIG_HIGH_RES_TIMERS
+-module_param(hrtimer, bool, 0644);
++module_param(hrtimer, bool, 0444);
+ MODULE_PARM_DESC(hrtimer, "Use hrtimer as the timer source.");
+ #endif
+
+diff --git a/sound/firewire/bebob/bebob_stream.c b/sound/firewire/bebob/bebob_stream.c
+index 1aab0a32870c..c05b0f6c1bc2 100644
+--- a/sound/firewire/bebob/bebob_stream.c
++++ b/sound/firewire/bebob/bebob_stream.c
+@@ -47,14 +47,16 @@ static const unsigned int bridgeco_freq_table[] = {
+ [6] = 0x07,
+ };
+
+-static unsigned int
+-get_formation_index(unsigned int rate)
++static int
++get_formation_index(unsigned int rate, unsigned int *index)
+ {
+ unsigned int i;
+
+ for (i = 0; i < ARRAY_SIZE(snd_bebob_rate_table); i++) {
+- if (snd_bebob_rate_table[i] == rate)
+- return i;
++ if (snd_bebob_rate_table[i] == rate) {
++ *index = i;
++ return 0;
++ }
+ }
+ return -EINVAL;
+ }
+@@ -367,7 +369,9 @@ make_both_connections(struct snd_bebob *bebob, unsigned int rate)
+ goto end;
+
+ /* confirm params for both streams */
+- index = get_formation_index(rate);
++ err = get_formation_index(rate, &index);
++ if (err < 0)
++ goto end;
+ pcm_channels = bebob->tx_stream_formations[index].pcm;
+ midi_channels = bebob->tx_stream_formations[index].midi;
+ amdtp_stream_set_parameters(&bebob->tx_stream,
+diff --git a/sound/pci/hda/patch_cirrus.c b/sound/pci/hda/patch_cirrus.c
+index 1b3b38d025fc..e9eec080e46c 100644
+--- a/sound/pci/hda/patch_cirrus.c
++++ b/sound/pci/hda/patch_cirrus.c
+@@ -614,6 +614,7 @@ enum {
+ CS4208_MAC_AUTO,
+ CS4208_MBA6,
+ CS4208_MBP11,
++ CS4208_MACMINI,
+ CS4208_GPIO0,
+ };
+
+@@ -621,6 +622,7 @@ static const struct hda_model_fixup cs4208_models[] = {
+ { .id = CS4208_GPIO0, .name = "gpio0" },
+ { .id = CS4208_MBA6, .name = "mba6" },
+ { .id = CS4208_MBP11, .name = "mbp11" },
++ { .id = CS4208_MACMINI, .name = "macmini" },
+ {}
+ };
+
+@@ -632,6 +634,7 @@ static const struct snd_pci_quirk cs4208_fixup_tbl[] = {
+ /* codec SSID matching */
+ static const struct snd_pci_quirk cs4208_mac_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x106b, 0x5e00, "MacBookPro 11,2", CS4208_MBP11),
++ SND_PCI_QUIRK(0x106b, 0x6c00, "MacMini 7,1", CS4208_MACMINI),
+ SND_PCI_QUIRK(0x106b, 0x7100, "MacBookAir 6,1", CS4208_MBA6),
+ SND_PCI_QUIRK(0x106b, 0x7200, "MacBookAir 6,2", CS4208_MBA6),
+ SND_PCI_QUIRK(0x106b, 0x7b00, "MacBookPro 12,1", CS4208_MBP11),
+@@ -666,6 +669,24 @@ static void cs4208_fixup_mac(struct hda_codec *codec,
+ snd_hda_apply_fixup(codec, action);
+ }
+
++/* MacMini 7,1 has the inverted jack detection */
++static void cs4208_fixup_macmini(struct hda_codec *codec,
++ const struct hda_fixup *fix, int action)
++{
++ static const struct hda_pintbl pincfgs[] = {
++ { 0x18, 0x00ab9150 }, /* mic (audio-in) jack: disable detect */
++ { 0x21, 0x004be140 }, /* SPDIF: disable detect */
++ { }
++ };
++
++ if (action == HDA_FIXUP_ACT_PRE_PROBE) {
++ /* HP pin (0x10) has an inverted detection */
++ codec->inv_jack_detect = 1;
++ /* disable the bogus Mic and SPDIF jack detections */
++ snd_hda_apply_pincfgs(codec, pincfgs);
++ }
++}
++
+ static int cs4208_spdif_sw_put(struct snd_kcontrol *kcontrol,
+ struct snd_ctl_elem_value *ucontrol)
+ {
+@@ -709,6 +730,12 @@ static const struct hda_fixup cs4208_fixups[] = {
+ .chained = true,
+ .chain_id = CS4208_GPIO0,
+ },
++ [CS4208_MACMINI] = {
++ .type = HDA_FIXUP_FUNC,
++ .v.func = cs4208_fixup_macmini,
++ .chained = true,
++ .chain_id = CS4208_GPIO0,
++ },
+ [CS4208_GPIO0] = {
+ .type = HDA_FIXUP_FUNC,
+ .v.func = cs4208_fixup_gpio0,
+diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
+index 2c10c9ee36a2..2ef679caa8b9 100644
+--- a/sound/usb/quirks.c
++++ b/sound/usb/quirks.c
+@@ -1108,6 +1108,7 @@ bool snd_usb_get_sample_rate_quirk(struct snd_usb_audio *chip)
+ switch (chip->usb_id) {
+ case USB_ID(0x045E, 0x075D): /* MS Lifecam Cinema */
+ case USB_ID(0x045E, 0x076D): /* MS Lifecam HD-5000 */
++ case USB_ID(0x045E, 0x076F): /* MS Lifecam HD-6000 */
+ case USB_ID(0x045E, 0x0772): /* MS Lifecam Studio */
+ case USB_ID(0x045E, 0x0779): /* MS Lifecam HD-3000 */
+ case USB_ID(0x04D8, 0xFEEA): /* Benchmark DAC1 Pre */
+@@ -1190,8 +1191,12 @@ void snd_usb_set_interface_quirk(struct usb_device *dev)
+ * "Playback Design" products need a 50ms delay after setting the
+ * USB interface.
+ */
+- if (le16_to_cpu(dev->descriptor.idVendor) == 0x23ba)
++ switch (le16_to_cpu(dev->descriptor.idVendor)) {
++ case 0x23ba: /* Playback Design */
++ case 0x0644: /* TEAC Corp. */
+ mdelay(50);
++ break;
++ }
+ }
+
+ void snd_usb_ctl_msg_quirk(struct usb_device *dev, unsigned int pipe,
+@@ -1206,6 +1211,14 @@ void snd_usb_ctl_msg_quirk(struct usb_device *dev, unsigned int pipe,
+ (requesttype & USB_TYPE_MASK) == USB_TYPE_CLASS)
+ mdelay(20);
+
++ /*
++ * "TEAC Corp." products need a 20ms delay after each
++ * class compliant request
++ */
++ if ((le16_to_cpu(dev->descriptor.idVendor) == 0x0644) &&
++ (requesttype & USB_TYPE_MASK) == USB_TYPE_CLASS)
++ mdelay(20);
++
+ /* Marantz/Denon devices with USB DAC functionality need a delay
+ * after each class compliant request
+ */
+@@ -1261,6 +1274,8 @@ u64 snd_usb_interface_dsd_format_quirks(struct snd_usb_audio *chip,
+ case USB_ID(0x20b1, 0x000a): /* Gustard DAC-X20U */
+ case USB_ID(0x20b1, 0x2009): /* DIYINHK DSD DXD 384kHz USB to I2S/DSD */
+ case USB_ID(0x20b1, 0x2023): /* JLsounds I2SoverUSB */
++ case USB_ID(0x20b1, 0x3023): /* Aune X1S 32BIT/384 DSD DAC */
++ case USB_ID(0x2616, 0x0106): /* PS Audio NuWave DAC */
+ if (fp->altsetting == 3)
+ return SNDRV_PCM_FMTBIT_DSD_U32_BE;
+ break;
+diff --git a/tools/lib/traceevent/event-parse.c b/tools/lib/traceevent/event-parse.c
+index dfb8be78ff75..0c81ca7d18cd 100644
+--- a/tools/lib/traceevent/event-parse.c
++++ b/tools/lib/traceevent/event-parse.c
+@@ -4399,13 +4399,12 @@ static void pretty_print(struct trace_seq *s, void *data, int size, struct event
+ sizeof(long) != 8) {
+ char *p;
+
+- ls = 2;
+ /* make %l into %ll */
+- p = strchr(format, 'l');
+- if (p)
++ if (ls == 1 && (p = strchr(format, 'l')))
+ memmove(p+1, p, strlen(p)+1);
+ else if (strcmp(format, "%p") == 0)
+ strcpy(format, "0x%llx");
++ ls = 2;
+ }
+ switch (ls) {
+ case -2:
^ permalink raw reply related [flat|nested] 67+ messages in thread
* [gentoo-commits] proj/linux-patches:3.18 commit in: /
@ 2016-03-05 21:08 Mike Pagano
0 siblings, 0 replies; 67+ messages in thread
From: Mike Pagano @ 2016-03-05 21:08 UTC (permalink / raw
To: gentoo-commits
commit: f4b15f5e246692e7b269d9274d09ec521d49f4b1
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Sat Mar 5 21:07:59 2016 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Sat Mar 5 21:07:59 2016 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=f4b15f5e
Linux patch 3.18.28
0000_README | 4 +
1027_linux-3.18.28.patch | 4935 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 4939 insertions(+)
diff --git a/0000_README b/0000_README
index 0da11e3..124258e 100644
--- a/0000_README
+++ b/0000_README
@@ -151,6 +151,10 @@ Patch: 1026_linux-3.18.27.patch
From: http://www.kernel.org
Desc: Linux 3.18.27
+Patch: 1027_linux-3.18.28.patch
+From: http://www.kernel.org
+Desc: Linux 3.18.28
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1027_linux-3.18.28.patch b/1027_linux-3.18.28.patch
new file mode 100644
index 0000000..8597d31
--- /dev/null
+++ b/1027_linux-3.18.28.patch
@@ -0,0 +1,4935 @@
+diff --git a/Makefile b/Makefile
+index 2393cc5e0229..f849f29ce405 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 18
+-SUBLEVEL = 27
++SUBLEVEL = 28
+ EXTRAVERSION =
+ NAME = Diseased Newt
+
+diff --git a/arch/arm/common/icst.c b/arch/arm/common/icst.c
+index 2dc6da70ae59..d7ed252708c5 100644
+--- a/arch/arm/common/icst.c
++++ b/arch/arm/common/icst.c
+@@ -16,7 +16,7 @@
+ */
+ #include <linux/module.h>
+ #include <linux/kernel.h>
+-
++#include <asm/div64.h>
+ #include <asm/hardware/icst.h>
+
+ /*
+@@ -29,7 +29,11 @@ EXPORT_SYMBOL(icst525_s2div);
+
+ unsigned long icst_hz(const struct icst_params *p, struct icst_vco vco)
+ {
+- return p->ref * 2 * (vco.v + 8) / ((vco.r + 2) * p->s2div[vco.s]);
++ u64 dividend = p->ref * 2 * (u64)(vco.v + 8);
++ u32 divisor = (vco.r + 2) * p->s2div[vco.s];
++
++ do_div(dividend, divisor);
++ return (unsigned long)dividend;
+ }
+
+ EXPORT_SYMBOL(icst_hz);
+@@ -58,6 +62,7 @@ icst_hz_to_vco(const struct icst_params *p, unsigned long freq)
+
+ if (f > p->vco_min && f <= p->vco_max)
+ break;
++ i++;
+ } while (i < 8);
+
+ if (i >= 8)
+diff --git a/arch/mips/include/asm/syscall.h b/arch/mips/include/asm/syscall.h
+index bb7963753730..b81d3bafbcc2 100644
+--- a/arch/mips/include/asm/syscall.h
++++ b/arch/mips/include/asm/syscall.h
+@@ -107,10 +107,8 @@ static inline void syscall_get_arguments(struct task_struct *task,
+ /* O32 ABI syscall() - Either 64-bit with O32 or 32-bit */
+ if ((config_enabled(CONFIG_32BIT) ||
+ test_tsk_thread_flag(task, TIF_32BIT_REGS)) &&
+- (regs->regs[2] == __NR_syscall)) {
++ (regs->regs[2] == __NR_syscall))
+ i++;
+- n++;
+- }
+
+ while (n--)
+ ret |= mips_get_syscall_arg(args++, task, regs, i++);
+diff --git a/arch/powerpc/platforms/powernv/eeh-powernv.c b/arch/powerpc/platforms/powernv/eeh-powernv.c
+index 1d19e7917d7f..794815ff139c 100644
+--- a/arch/powerpc/platforms/powernv/eeh-powernv.c
++++ b/arch/powerpc/platforms/powernv/eeh-powernv.c
+@@ -39,11 +39,11 @@
+ #include "pci.h"
+
+ /**
+- * powernv_eeh_init - EEH platform dependent initialization
++ * pnv_eeh_init - EEH platform dependent initialization
+ *
+ * EEH platform dependent initialization on powernv
+ */
+-static int powernv_eeh_init(void)
++static int pnv_eeh_init(void)
+ {
+ struct pci_controller *hose;
+ struct pnv_phb *phb;
+@@ -75,14 +75,14 @@ static int powernv_eeh_init(void)
+ }
+
+ /**
+- * powernv_eeh_post_init - EEH platform dependent post initialization
++ * pnv_eeh_post_init - EEH platform dependent post initialization
+ *
+ * EEH platform dependent post initialization on powernv. When
+ * the function is called, the EEH PEs and devices should have
+ * been built. If the I/O cache staff has been built, EEH is
+ * ready to supply service.
+ */
+-static int powernv_eeh_post_init(void)
++static int pnv_eeh_post_init(void)
+ {
+ struct pci_controller *hose;
+ struct pnv_phb *phb;
+@@ -102,7 +102,7 @@ static int powernv_eeh_post_init(void)
+ }
+
+ /**
+- * powernv_eeh_dev_probe - Do probe on PCI device
++ * pnv_eeh_dev_probe - Do probe on PCI device
+ * @dev: PCI device
+ * @flag: unused
+ *
+@@ -118,7 +118,7 @@ static int powernv_eeh_post_init(void)
+ * was possiblly triggered by EEH core, the binding between EEH device
+ * and the PCI device isn't built yet.
+ */
+-static int powernv_eeh_dev_probe(struct pci_dev *dev, void *flag)
++static int pnv_eeh_dev_probe(struct pci_dev *dev, void *flag)
+ {
+ struct pci_controller *hose = pci_bus_to_host(dev->bus);
+ struct pnv_phb *phb = hose->private_data;
+@@ -210,7 +210,7 @@ static int powernv_eeh_dev_probe(struct pci_dev *dev, void *flag)
+ }
+
+ /**
+- * powernv_eeh_set_option - Initialize EEH or MMIO/DMA reenable
++ * pnv_eeh_set_option - Initialize EEH or MMIO/DMA reenable
+ * @pe: EEH PE
+ * @option: operation to be issued
+ *
+@@ -218,7 +218,7 @@ static int powernv_eeh_dev_probe(struct pci_dev *dev, void *flag)
+ * Currently, following options are support according to PAPR:
+ * Enable EEH, Disable EEH, Enable MMIO and Enable DMA
+ */
+-static int powernv_eeh_set_option(struct eeh_pe *pe, int option)
++static int pnv_eeh_set_option(struct eeh_pe *pe, int option)
+ {
+ struct pci_controller *hose = pe->phb;
+ struct pnv_phb *phb = hose->private_data;
+@@ -235,19 +235,19 @@ static int powernv_eeh_set_option(struct eeh_pe *pe, int option)
+ }
+
+ /**
+- * powernv_eeh_get_pe_addr - Retrieve PE address
++ * pnv_eeh_get_pe_addr - Retrieve PE address
+ * @pe: EEH PE
+ *
+ * Retrieve the PE address according to the given tranditional
+ * PCI BDF (Bus/Device/Function) address.
+ */
+-static int powernv_eeh_get_pe_addr(struct eeh_pe *pe)
++static int pnv_eeh_get_pe_addr(struct eeh_pe *pe)
+ {
+ return pe->addr;
+ }
+
+ /**
+- * powernv_eeh_get_state - Retrieve PE state
++ * pnv_eeh_get_state - Retrieve PE state
+ * @pe: EEH PE
+ * @delay: delay while PE state is temporarily unavailable
+ *
+@@ -256,7 +256,7 @@ static int powernv_eeh_get_pe_addr(struct eeh_pe *pe)
+ * we prefer passing down to hardware implementation to handle
+ * it.
+ */
+-static int powernv_eeh_get_state(struct eeh_pe *pe, int *delay)
++static int pnv_eeh_get_state(struct eeh_pe *pe, int *delay)
+ {
+ struct pci_controller *hose = pe->phb;
+ struct pnv_phb *phb = hose->private_data;
+@@ -281,13 +281,13 @@ static int powernv_eeh_get_state(struct eeh_pe *pe, int *delay)
+ }
+
+ /**
+- * powernv_eeh_reset - Reset the specified PE
++ * pnv_eeh_reset - Reset the specified PE
+ * @pe: EEH PE
+ * @option: reset option
+ *
+ * Reset the specified PE
+ */
+-static int powernv_eeh_reset(struct eeh_pe *pe, int option)
++static int pnv_eeh_reset(struct eeh_pe *pe, int option)
+ {
+ struct pci_controller *hose = pe->phb;
+ struct pnv_phb *phb = hose->private_data;
+@@ -300,20 +300,20 @@ static int powernv_eeh_reset(struct eeh_pe *pe, int option)
+ }
+
+ /**
+- * powernv_eeh_wait_state - Wait for PE state
++ * pnv_eeh_wait_state - Wait for PE state
+ * @pe: EEH PE
+ * @max_wait: maximal period in microsecond
+ *
+ * Wait for the state of associated PE. It might take some time
+ * to retrieve the PE's state.
+ */
+-static int powernv_eeh_wait_state(struct eeh_pe *pe, int max_wait)
++static int pnv_eeh_wait_state(struct eeh_pe *pe, int max_wait)
+ {
+ int ret;
+ int mwait;
+
+ while (1) {
+- ret = powernv_eeh_get_state(pe, &mwait);
++ ret = pnv_eeh_get_state(pe, &mwait);
+
+ /*
+ * If the PE's state is temporarily unavailable,
+@@ -337,7 +337,7 @@ static int powernv_eeh_wait_state(struct eeh_pe *pe, int max_wait)
+ }
+
+ /**
+- * powernv_eeh_get_log - Retrieve error log
++ * pnv_eeh_get_log - Retrieve error log
+ * @pe: EEH PE
+ * @severity: temporary or permanent error log
+ * @drv_log: driver log to be combined with retrieved error log
+@@ -345,8 +345,8 @@ static int powernv_eeh_wait_state(struct eeh_pe *pe, int max_wait)
+ *
+ * Retrieve the temporary or permanent error from the PE.
+ */
+-static int powernv_eeh_get_log(struct eeh_pe *pe, int severity,
+- char *drv_log, unsigned long len)
++static int pnv_eeh_get_log(struct eeh_pe *pe, int severity,
++ char *drv_log, unsigned long len)
+ {
+ struct pci_controller *hose = pe->phb;
+ struct pnv_phb *phb = hose->private_data;
+@@ -359,14 +359,14 @@ static int powernv_eeh_get_log(struct eeh_pe *pe, int severity,
+ }
+
+ /**
+- * powernv_eeh_configure_bridge - Configure PCI bridges in the indicated PE
++ * pnv_eeh_configure_bridge - Configure PCI bridges in the indicated PE
+ * @pe: EEH PE
+ *
+ * The function will be called to reconfigure the bridges included
+ * in the specified PE so that the mulfunctional PE would be recovered
+ * again.
+ */
+-static int powernv_eeh_configure_bridge(struct eeh_pe *pe)
++static int pnv_eeh_configure_bridge(struct eeh_pe *pe)
+ {
+ struct pci_controller *hose = pe->phb;
+ struct pnv_phb *phb = hose->private_data;
+@@ -379,7 +379,7 @@ static int powernv_eeh_configure_bridge(struct eeh_pe *pe)
+ }
+
+ /**
+- * powernv_pe_err_inject - Inject specified error to the indicated PE
++ * pnv_pe_err_inject - Inject specified error to the indicated PE
+ * @pe: the indicated PE
+ * @type: error type
+ * @func: specific error type
+@@ -390,8 +390,8 @@ static int powernv_eeh_configure_bridge(struct eeh_pe *pe)
+ * determined by @type and @func, to the indicated PE for
+ * testing purpose.
+ */
+-static int powernv_eeh_err_inject(struct eeh_pe *pe, int type, int func,
+- unsigned long addr, unsigned long mask)
++static int pnv_eeh_err_inject(struct eeh_pe *pe, int type, int func,
++ unsigned long addr, unsigned long mask)
+ {
+ struct pci_controller *hose = pe->phb;
+ struct pnv_phb *phb = hose->private_data;
+@@ -403,7 +403,7 @@ static int powernv_eeh_err_inject(struct eeh_pe *pe, int type, int func,
+ return ret;
+ }
+
+-static inline bool powernv_eeh_cfg_blocked(struct device_node *dn)
++static inline bool pnv_eeh_cfg_blocked(struct device_node *dn)
+ {
+ struct eeh_dev *edev = of_node_to_eeh_dev(dn);
+
+@@ -416,10 +416,10 @@ static inline bool powernv_eeh_cfg_blocked(struct device_node *dn)
+ return false;
+ }
+
+-static int powernv_eeh_read_config(struct device_node *dn,
+- int where, int size, u32 *val)
++static int pnv_eeh_read_config(struct device_node *dn,
++ int where, int size, u32 *val)
+ {
+- if (powernv_eeh_cfg_blocked(dn)) {
++ if (pnv_eeh_cfg_blocked(dn)) {
+ *val = 0xFFFFFFFF;
+ return PCIBIOS_SET_FAILED;
+ }
+@@ -427,22 +427,22 @@ static int powernv_eeh_read_config(struct device_node *dn,
+ return pnv_pci_cfg_read(dn, where, size, val);
+ }
+
+-static int powernv_eeh_write_config(struct device_node *dn,
+- int where, int size, u32 val)
++static int pnv_eeh_write_config(struct device_node *dn,
++ int where, int size, u32 val)
+ {
+- if (powernv_eeh_cfg_blocked(dn))
++ if (pnv_eeh_cfg_blocked(dn))
+ return PCIBIOS_SET_FAILED;
+
+ return pnv_pci_cfg_write(dn, where, size, val);
+ }
+
+ /**
+- * powernv_eeh_next_error - Retrieve next EEH error to handle
++ * pnv_eeh_next_error - Retrieve next EEH error to handle
+ * @pe: Affected PE
+ *
+ * Using OPAL API, to retrieve next EEH error for EEH core to handle
+ */
+-static int powernv_eeh_next_error(struct eeh_pe **pe)
++static int pnv_eeh_next_error(struct eeh_pe **pe)
+ {
+ struct pci_controller *hose;
+ struct pnv_phb *phb = NULL;
+@@ -458,7 +458,7 @@ static int powernv_eeh_next_error(struct eeh_pe **pe)
+ return -EEXIST;
+ }
+
+-static int powernv_eeh_restore_config(struct device_node *dn)
++static int pnv_eeh_restore_config(struct device_node *dn)
+ {
+ struct eeh_dev *edev = of_node_to_eeh_dev(dn);
+ struct pnv_phb *phb;
+@@ -479,24 +479,24 @@ static int powernv_eeh_restore_config(struct device_node *dn)
+ return 0;
+ }
+
+-static struct eeh_ops powernv_eeh_ops = {
++static struct eeh_ops pnv_eeh_ops = {
+ .name = "powernv",
+- .init = powernv_eeh_init,
+- .post_init = powernv_eeh_post_init,
++ .init = pnv_eeh_init,
++ .post_init = pnv_eeh_post_init,
+ .of_probe = NULL,
+- .dev_probe = powernv_eeh_dev_probe,
+- .set_option = powernv_eeh_set_option,
+- .get_pe_addr = powernv_eeh_get_pe_addr,
+- .get_state = powernv_eeh_get_state,
+- .reset = powernv_eeh_reset,
+- .wait_state = powernv_eeh_wait_state,
+- .get_log = powernv_eeh_get_log,
+- .configure_bridge = powernv_eeh_configure_bridge,
+- .err_inject = powernv_eeh_err_inject,
+- .read_config = powernv_eeh_read_config,
+- .write_config = powernv_eeh_write_config,
+- .next_error = powernv_eeh_next_error,
+- .restore_config = powernv_eeh_restore_config
++ .dev_probe = pnv_eeh_dev_probe,
++ .set_option = pnv_eeh_set_option,
++ .get_pe_addr = pnv_eeh_get_pe_addr,
++ .get_state = pnv_eeh_get_state,
++ .reset = pnv_eeh_reset,
++ .wait_state = pnv_eeh_wait_state,
++ .get_log = pnv_eeh_get_log,
++ .configure_bridge = pnv_eeh_configure_bridge,
++ .err_inject = pnv_eeh_err_inject,
++ .read_config = pnv_eeh_read_config,
++ .write_config = pnv_eeh_write_config,
++ .next_error = pnv_eeh_next_error,
++ .restore_config = pnv_eeh_restore_config
+ };
+
+ /**
+@@ -510,7 +510,7 @@ static int __init eeh_powernv_init(void)
+ int ret = -EINVAL;
+
+ eeh_set_pe_aux_size(PNV_PCI_DIAG_BUF_SIZE);
+- ret = eeh_ops_register(&powernv_eeh_ops);
++ ret = eeh_ops_register(&pnv_eeh_ops);
+ if (!ret)
+ pr_info("EEH: PowerNV platform initialized\n");
+ else
+diff --git a/crypto/crypto_user.c b/crypto/crypto_user.c
+index c90af2537d24..c571d85cfad7 100644
+--- a/crypto/crypto_user.c
++++ b/crypto/crypto_user.c
+@@ -483,6 +483,7 @@ static int crypto_user_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
+ if (link->dump == NULL)
+ return -EINVAL;
+
++ down_read(&crypto_alg_sem);
+ list_for_each_entry(alg, &crypto_alg_list, cra_list)
+ dump_alloc += CRYPTO_REPORT_MAXSIZE;
+
+@@ -492,8 +493,11 @@ static int crypto_user_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
+ .done = link->done,
+ .min_dump_alloc = dump_alloc,
+ };
+- return netlink_dump_start(crypto_nlsk, skb, nlh, &c);
++ err = netlink_dump_start(crypto_nlsk, skb, nlh, &c);
+ }
++ up_read(&crypto_alg_sem);
++
++ return err;
+ }
+
+ err = nlmsg_parse(nlh, crypto_msg_min[type], attrs, CRYPTOCFGA_MAX,
+diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
+index 73187771836c..62dcd80ec2c0 100644
+--- a/drivers/ata/ahci.c
++++ b/drivers/ata/ahci.c
+@@ -262,6 +262,26 @@ static const struct pci_device_id ahci_pci_tbl[] = {
+ { PCI_VDEVICE(INTEL, 0x3b2b), board_ahci }, /* PCH RAID */
+ { PCI_VDEVICE(INTEL, 0x3b2c), board_ahci }, /* PCH RAID */
+ { PCI_VDEVICE(INTEL, 0x3b2f), board_ahci }, /* PCH AHCI */
++ { PCI_VDEVICE(INTEL, 0x19b0), board_ahci }, /* DNV AHCI */
++ { PCI_VDEVICE(INTEL, 0x19b1), board_ahci }, /* DNV AHCI */
++ { PCI_VDEVICE(INTEL, 0x19b2), board_ahci }, /* DNV AHCI */
++ { PCI_VDEVICE(INTEL, 0x19b3), board_ahci }, /* DNV AHCI */
++ { PCI_VDEVICE(INTEL, 0x19b4), board_ahci }, /* DNV AHCI */
++ { PCI_VDEVICE(INTEL, 0x19b5), board_ahci }, /* DNV AHCI */
++ { PCI_VDEVICE(INTEL, 0x19b6), board_ahci }, /* DNV AHCI */
++ { PCI_VDEVICE(INTEL, 0x19b7), board_ahci }, /* DNV AHCI */
++ { PCI_VDEVICE(INTEL, 0x19bE), board_ahci }, /* DNV AHCI */
++ { PCI_VDEVICE(INTEL, 0x19bF), board_ahci }, /* DNV AHCI */
++ { PCI_VDEVICE(INTEL, 0x19c0), board_ahci }, /* DNV AHCI */
++ { PCI_VDEVICE(INTEL, 0x19c1), board_ahci }, /* DNV AHCI */
++ { PCI_VDEVICE(INTEL, 0x19c2), board_ahci }, /* DNV AHCI */
++ { PCI_VDEVICE(INTEL, 0x19c3), board_ahci }, /* DNV AHCI */
++ { PCI_VDEVICE(INTEL, 0x19c4), board_ahci }, /* DNV AHCI */
++ { PCI_VDEVICE(INTEL, 0x19c5), board_ahci }, /* DNV AHCI */
++ { PCI_VDEVICE(INTEL, 0x19c6), board_ahci }, /* DNV AHCI */
++ { PCI_VDEVICE(INTEL, 0x19c7), board_ahci }, /* DNV AHCI */
++ { PCI_VDEVICE(INTEL, 0x19cE), board_ahci }, /* DNV AHCI */
++ { PCI_VDEVICE(INTEL, 0x19cF), board_ahci }, /* DNV AHCI */
+ { PCI_VDEVICE(INTEL, 0x1c02), board_ahci }, /* CPT AHCI */
+ { PCI_VDEVICE(INTEL, 0x1c03), board_ahci }, /* CPT AHCI */
+ { PCI_VDEVICE(INTEL, 0x1c04), board_ahci }, /* CPT RAID */
+diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c
+index de88999521b7..a1d1c0e16697 100644
+--- a/drivers/ata/libahci.c
++++ b/drivers/ata/libahci.c
+@@ -495,8 +495,8 @@ void ahci_save_initial_config(struct device *dev, struct ahci_host_priv *hpriv)
+ }
+ }
+
+- /* fabricate port_map from cap.nr_ports */
+- if (!port_map) {
++ /* fabricate port_map from cap.nr_ports for < AHCI 1.3 */
++ if (!port_map && vers < 0x10300) {
+ port_map = (1 << ahci_nr_ports(cap)) - 1;
+ dev_warn(dev, "forcing PORTS_IMPL to 0x%x\n", port_map);
+
+diff --git a/drivers/ata/libata-sff.c b/drivers/ata/libata-sff.c
+index 2e86e3b85266..12d337754e4a 100644
+--- a/drivers/ata/libata-sff.c
++++ b/drivers/ata/libata-sff.c
+@@ -997,12 +997,9 @@ static inline int ata_hsm_ok_in_wq(struct ata_port *ap,
+ static void ata_hsm_qc_complete(struct ata_queued_cmd *qc, int in_wq)
+ {
+ struct ata_port *ap = qc->ap;
+- unsigned long flags;
+
+ if (ap->ops->error_handler) {
+ if (in_wq) {
+- spin_lock_irqsave(ap->lock, flags);
+-
+ /* EH might have kicked in while host lock is
+ * released.
+ */
+@@ -1014,8 +1011,6 @@ static void ata_hsm_qc_complete(struct ata_queued_cmd *qc, int in_wq)
+ } else
+ ata_port_freeze(ap);
+ }
+-
+- spin_unlock_irqrestore(ap->lock, flags);
+ } else {
+ if (likely(!(qc->err_mask & AC_ERR_HSM)))
+ ata_qc_complete(qc);
+@@ -1024,10 +1019,8 @@ static void ata_hsm_qc_complete(struct ata_queued_cmd *qc, int in_wq)
+ }
+ } else {
+ if (in_wq) {
+- spin_lock_irqsave(ap->lock, flags);
+ ata_sff_irq_on(ap);
+ ata_qc_complete(qc);
+- spin_unlock_irqrestore(ap->lock, flags);
+ } else
+ ata_qc_complete(qc);
+ }
+@@ -1048,9 +1041,10 @@ int ata_sff_hsm_move(struct ata_port *ap, struct ata_queued_cmd *qc,
+ {
+ struct ata_link *link = qc->dev->link;
+ struct ata_eh_info *ehi = &link->eh_info;
+- unsigned long flags = 0;
+ int poll_next;
+
++ lockdep_assert_held(ap->lock);
++
+ WARN_ON_ONCE((qc->flags & ATA_QCFLAG_ACTIVE) == 0);
+
+ /* Make sure ata_sff_qc_issue() does not throw things
+@@ -1112,14 +1106,6 @@ fsm_start:
+ }
+ }
+
+- /* Send the CDB (atapi) or the first data block (ata pio out).
+- * During the state transition, interrupt handler shouldn't
+- * be invoked before the data transfer is complete and
+- * hsm_task_state is changed. Hence, the following locking.
+- */
+- if (in_wq)
+- spin_lock_irqsave(ap->lock, flags);
+-
+ if (qc->tf.protocol == ATA_PROT_PIO) {
+ /* PIO data out protocol.
+ * send first data block.
+@@ -1135,9 +1121,6 @@ fsm_start:
+ /* send CDB */
+ atapi_send_cdb(ap, qc);
+
+- if (in_wq)
+- spin_unlock_irqrestore(ap->lock, flags);
+-
+ /* if polling, ata_sff_pio_task() handles the rest.
+ * otherwise, interrupt handler takes over from here.
+ */
+@@ -1361,12 +1344,14 @@ static void ata_sff_pio_task(struct work_struct *work)
+ u8 status;
+ int poll_next;
+
++ spin_lock_irq(ap->lock);
++
+ BUG_ON(ap->sff_pio_task_link == NULL);
+ /* qc can be NULL if timeout occurred */
+ qc = ata_qc_from_tag(ap, link->active_tag);
+ if (!qc) {
+ ap->sff_pio_task_link = NULL;
+- return;
++ goto out_unlock;
+ }
+
+ fsm_start:
+@@ -1381,11 +1366,14 @@ fsm_start:
+ */
+ status = ata_sff_busy_wait(ap, ATA_BUSY, 5);
+ if (status & ATA_BUSY) {
++ spin_unlock_irq(ap->lock);
+ ata_msleep(ap, 2);
++ spin_lock_irq(ap->lock);
++
+ status = ata_sff_busy_wait(ap, ATA_BUSY, 10);
+ if (status & ATA_BUSY) {
+ ata_sff_queue_pio_task(link, ATA_SHORT_PAUSE);
+- return;
++ goto out_unlock;
+ }
+ }
+
+@@ -1402,6 +1390,8 @@ fsm_start:
+ */
+ if (poll_next)
+ goto fsm_start;
++out_unlock:
++ spin_unlock_irq(ap->lock);
+ }
+
+ /**
+diff --git a/drivers/dma/dw/core.c b/drivers/dma/dw/core.c
+index ec233a5888e8..d95e1d0fcc18 100644
+--- a/drivers/dma/dw/core.c
++++ b/drivers/dma/dw/core.c
+@@ -148,7 +148,6 @@ static void dwc_initialize(struct dw_dma_chan *dwc)
+
+ /* Enable interrupts */
+ channel_set_bit(dw, MASK.XFER, dwc->mask);
+- channel_set_bit(dw, MASK.BLOCK, dwc->mask);
+ channel_set_bit(dw, MASK.ERROR, dwc->mask);
+
+ dwc->initialized = true;
+@@ -580,6 +579,9 @@ static void dwc_handle_cyclic(struct dw_dma *dw, struct dw_dma_chan *dwc,
+
+ spin_unlock_irqrestore(&dwc->lock, flags);
+ }
++
++ /* Re-enable interrupts */
++ channel_set_bit(dw, MASK.BLOCK, dwc->mask);
+ }
+
+ /* ------------------------------------------------------------------------- */
+@@ -610,11 +612,8 @@ static void dw_dma_tasklet(unsigned long data)
+ dwc_scan_descriptors(dw, dwc);
+ }
+
+- /*
+- * Re-enable interrupts.
+- */
++ /* Re-enable interrupts */
+ channel_set_bit(dw, MASK.XFER, dw->all_chan_mask);
+- channel_set_bit(dw, MASK.BLOCK, dw->all_chan_mask);
+ channel_set_bit(dw, MASK.ERROR, dw->all_chan_mask);
+ }
+
+@@ -1249,6 +1248,7 @@ static void dwc_free_chan_resources(struct dma_chan *chan)
+ int dw_dma_cyclic_start(struct dma_chan *chan)
+ {
+ struct dw_dma_chan *dwc = to_dw_dma_chan(chan);
++ struct dw_dma *dw = to_dw_dma(chan->device);
+ unsigned long flags;
+
+ if (!test_bit(DW_DMA_IS_CYCLIC, &dwc->flags)) {
+@@ -1257,7 +1257,12 @@ int dw_dma_cyclic_start(struct dma_chan *chan)
+ }
+
+ spin_lock_irqsave(&dwc->lock, flags);
++
++ /* Enable interrupts to perform cyclic transfer */
++ channel_set_bit(dw, MASK.BLOCK, dwc->mask);
++
+ dwc_dostart(dwc, dwc->cdesc->desc[0]);
++
+ spin_unlock_irqrestore(&dwc->lock, flags);
+
+ return 0;
+diff --git a/drivers/gpu/drm/i915/intel_dsi_panel_vbt.c b/drivers/gpu/drm/i915/intel_dsi_panel_vbt.c
+index f6bdd44069ce..6ea603ae9055 100644
+--- a/drivers/gpu/drm/i915/intel_dsi_panel_vbt.c
++++ b/drivers/gpu/drm/i915/intel_dsi_panel_vbt.c
+@@ -171,7 +171,12 @@ static u8 *mipi_exec_gpio(struct intel_dsi *intel_dsi, u8 *data)
+ gpio = *data++;
+
+ /* pull up/down */
+- action = *data++;
++ action = *data++ & 1;
++
++ if (gpio >= ARRAY_SIZE(gtable)) {
++ DRM_DEBUG_KMS("unknown gpio %u\n", gpio);
++ goto out;
++ }
+
+ function = gtable[gpio].function_reg;
+ pad = gtable[gpio].pad_reg;
+@@ -190,6 +195,7 @@ static u8 *mipi_exec_gpio(struct intel_dsi *intel_dsi, u8 *data)
+ vlv_gpio_nc_write(dev_priv, pad, val);
+ mutex_unlock(&dev_priv->dpio_lock);
+
++out:
+ return data;
+ }
+
+diff --git a/drivers/gpu/drm/qxl/qxl_ioctl.c b/drivers/gpu/drm/qxl/qxl_ioctl.c
+index 7354a4cda59d..3aefaa058f0c 100644
+--- a/drivers/gpu/drm/qxl/qxl_ioctl.c
++++ b/drivers/gpu/drm/qxl/qxl_ioctl.c
+@@ -168,7 +168,8 @@ static int qxl_process_single_command(struct qxl_device *qdev,
+ cmd->command_size))
+ return -EFAULT;
+
+- reloc_info = kmalloc(sizeof(struct qxl_reloc_info) * cmd->relocs_num, GFP_KERNEL);
++ reloc_info = kmalloc_array(cmd->relocs_num,
++ sizeof(struct qxl_reloc_info), GFP_KERNEL);
+ if (!reloc_info)
+ return -ENOMEM;
+
+diff --git a/drivers/gpu/drm/radeon/radeon_sa.c b/drivers/gpu/drm/radeon/radeon_sa.c
+index c507896aca45..197b157b73d0 100644
+--- a/drivers/gpu/drm/radeon/radeon_sa.c
++++ b/drivers/gpu/drm/radeon/radeon_sa.c
+@@ -349,8 +349,13 @@ int radeon_sa_bo_new(struct radeon_device *rdev,
+ /* see if we can skip over some allocations */
+ } while (radeon_sa_bo_next_hole(sa_manager, fences, tries));
+
++ for (i = 0; i < RADEON_NUM_RINGS; ++i)
++ radeon_fence_ref(fences[i]);
++
+ spin_unlock(&sa_manager->wq.lock);
+ r = radeon_fence_wait_any(rdev, fences, false);
++ for (i = 0; i < RADEON_NUM_RINGS; ++i)
++ radeon_fence_unref(&fences[i]);
+ spin_lock(&sa_manager->wq.lock);
+ /* if we have nothing to wait for block */
+ if (r == -ENOENT) {
+diff --git a/drivers/gpu/drm/radeon/radeon_ttm.c b/drivers/gpu/drm/radeon/radeon_ttm.c
+index 13f69472e716..33928b71445b 100644
+--- a/drivers/gpu/drm/radeon/radeon_ttm.c
++++ b/drivers/gpu/drm/radeon/radeon_ttm.c
+@@ -735,7 +735,7 @@ static int radeon_ttm_tt_populate(struct ttm_tt *ttm)
+ 0, PAGE_SIZE,
+ PCI_DMA_BIDIRECTIONAL);
+ if (pci_dma_mapping_error(rdev->pdev, gtt->ttm.dma_address[i])) {
+- while (--i) {
++ while (i--) {
+ pci_unmap_page(rdev->pdev, gtt->ttm.dma_address[i],
+ PAGE_SIZE, PCI_DMA_BIDIRECTIONAL);
+ gtt->ttm.dma_address[i] = 0;
+diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c
+index 357206a20017..041ade6ea565 100644
+--- a/drivers/infiniband/ulp/isert/ib_isert.c
++++ b/drivers/infiniband/ulp/isert/ib_isert.c
+@@ -1334,7 +1334,7 @@ sequence_cmd:
+ if (!rc && dump_payload == false && unsol_data)
+ iscsit_set_unsoliticed_dataout(cmd);
+ else if (dump_payload && imm_data)
+- target_put_sess_cmd(conn->sess->se_sess, &cmd->se_cmd);
++ target_put_sess_cmd(&cmd->se_cmd);
+
+ return 0;
+ }
+@@ -1753,7 +1753,7 @@ isert_put_cmd(struct isert_cmd *isert_cmd, bool comp_err)
+ cmd->se_cmd.t_state == TRANSPORT_WRITE_PENDING) {
+ struct se_cmd *se_cmd = &cmd->se_cmd;
+
+- target_put_sess_cmd(se_cmd->se_sess, se_cmd);
++ target_put_sess_cmd(se_cmd);
+ }
+ }
+
+@@ -1922,7 +1922,7 @@ isert_completion_rdma_read(struct iser_tx_desc *tx_desc,
+ spin_unlock_bh(&cmd->istate_lock);
+
+ if (ret) {
+- target_put_sess_cmd(se_cmd->se_sess, se_cmd);
++ target_put_sess_cmd(se_cmd);
+ transport_send_check_condition_and_sense(se_cmd,
+ se_cmd->pi_err, 0);
+ } else {
+diff --git a/drivers/infiniband/ulp/srpt/ib_srpt.c b/drivers/infiniband/ulp/srpt/ib_srpt.c
+index dc829682701a..ad4af66a4cbb 100644
+--- a/drivers/infiniband/ulp/srpt/ib_srpt.c
++++ b/drivers/infiniband/ulp/srpt/ib_srpt.c
+@@ -1335,7 +1335,7 @@ static int srpt_abort_cmd(struct srpt_send_ioctx *ioctx)
+
+ BUG_ON(ch->sess == NULL);
+
+- target_put_sess_cmd(ch->sess, &ioctx->cmd);
++ target_put_sess_cmd(&ioctx->cmd);
+ goto out;
+ }
+
+@@ -1366,11 +1366,11 @@ static int srpt_abort_cmd(struct srpt_send_ioctx *ioctx)
+ * not been received in time.
+ */
+ srpt_unmap_sg_to_ib_sge(ioctx->ch, ioctx);
+- target_put_sess_cmd(ioctx->ch->sess, &ioctx->cmd);
++ target_put_sess_cmd(&ioctx->cmd);
+ break;
+ case SRPT_STATE_MGMT_RSP_SENT:
+ srpt_set_cmd_state(ioctx, SRPT_STATE_DONE);
+- target_put_sess_cmd(ioctx->ch->sess, &ioctx->cmd);
++ target_put_sess_cmd(&ioctx->cmd);
+ break;
+ default:
+ WARN(1, "Unexpected command state (%d)", state);
+@@ -1682,7 +1682,7 @@ static int srpt_check_stop_free(struct se_cmd *cmd)
+ struct srpt_send_ioctx *ioctx = container_of(cmd,
+ struct srpt_send_ioctx, cmd);
+
+- return target_put_sess_cmd(ioctx->ch->sess, &ioctx->cmd);
++ return target_put_sess_cmd(&ioctx->cmd);
+ }
+
+ /**
+@@ -3079,7 +3079,7 @@ static void srpt_queue_response(struct se_cmd *cmd)
+ ioctx->tag);
+ srpt_unmap_sg_to_ib_sge(ch, ioctx);
+ srpt_set_cmd_state(ioctx, SRPT_STATE_DONE);
+- target_put_sess_cmd(ioctx->ch->sess, &ioctx->cmd);
++ target_put_sess_cmd(&ioctx->cmd);
+ }
+ }
+
+diff --git a/drivers/iommu/dmar.c b/drivers/iommu/dmar.c
+index c5c61cabd6e3..8a0643ae1fd9 100644
+--- a/drivers/iommu/dmar.c
++++ b/drivers/iommu/dmar.c
+@@ -1272,7 +1272,7 @@ void dmar_disable_qi(struct intel_iommu *iommu)
+
+ raw_spin_lock_irqsave(&iommu->register_lock, flags);
+
+- sts = dmar_readq(iommu->reg + DMAR_GSTS_REG);
++ sts = readl(iommu->reg + DMAR_GSTS_REG);
+ if (!(sts & DMA_GSTS_QIES))
+ goto end;
+
+diff --git a/drivers/iommu/intel_irq_remapping.c b/drivers/iommu/intel_irq_remapping.c
+index 7c80661b35c1..f2ed4ee201d6 100644
+--- a/drivers/iommu/intel_irq_remapping.c
++++ b/drivers/iommu/intel_irq_remapping.c
+@@ -531,7 +531,7 @@ static void iommu_disable_irq_remapping(struct intel_iommu *iommu)
+
+ raw_spin_lock_irqsave(&iommu->register_lock, flags);
+
+- sts = dmar_readq(iommu->reg + DMAR_GSTS_REG);
++ sts = readl(iommu->reg + DMAR_GSTS_REG);
+ if (!(sts & DMA_GSTS_IRES))
+ goto end;
+
+diff --git a/drivers/parport/parport_serial.c b/drivers/parport/parport_serial.c
+index ee932004724f..e15b4845f7c6 100644
+--- a/drivers/parport/parport_serial.c
++++ b/drivers/parport/parport_serial.c
+@@ -64,6 +64,7 @@ enum parport_pc_pci_cards {
+ timedia_9079c,
+ wch_ch353_1s1p,
+ wch_ch353_2s1p,
++ wch_ch382_2s1p,
+ sunix_2s1p,
+ };
+
+@@ -151,6 +152,7 @@ static struct parport_pc_pci cards[] = {
+ /* timedia_9079c */ { 1, { { 2, 3 }, } },
+ /* wch_ch353_1s1p*/ { 1, { { 1, -1}, } },
+ /* wch_ch353_2s1p*/ { 1, { { 2, -1}, } },
++ /* wch_ch382_2s1p*/ { 1, { { 2, -1}, } },
+ /* sunix_2s1p */ { 1, { { 3, -1 }, } },
+ };
+
+@@ -257,6 +259,7 @@ static struct pci_device_id parport_serial_pci_tbl[] = {
+ /* WCH CARDS */
+ { 0x4348, 0x5053, PCI_ANY_ID, PCI_ANY_ID, 0, 0, wch_ch353_1s1p},
+ { 0x4348, 0x7053, 0x4348, 0x3253, 0, 0, wch_ch353_2s1p},
++ { 0x1c00, 0x3250, 0x1c00, 0x3250, 0, 0, wch_ch382_2s1p},
+
+ /*
+ * More SUNIX variations. At least one of these has part number
+@@ -494,6 +497,13 @@ static struct pciserial_board pci_parport_serial_boards[] = {
+ .base_baud = 115200,
+ .uart_offset = 8,
+ },
++ [wch_ch382_2s1p] = {
++ .flags = FL_BASE0,
++ .num_ports = 2,
++ .base_baud = 115200,
++ .uart_offset = 8,
++ .first_offset = 0xC0,
++ },
+ [sunix_2s1p] = {
+ .flags = FL_BASE0|FL_BASE_BARS,
+ .num_ports = 2,
+diff --git a/drivers/pci/pcie/aer/aerdrv.c b/drivers/pci/pcie/aer/aerdrv.c
+index 0bf82a20a0fb..48d21e0edd56 100644
+--- a/drivers/pci/pcie/aer/aerdrv.c
++++ b/drivers/pci/pcie/aer/aerdrv.c
+@@ -262,7 +262,6 @@ static struct aer_rpc *aer_alloc_rpc(struct pcie_device *dev)
+ rpc->rpd = dev;
+ INIT_WORK(&rpc->dpc_handler, aer_isr);
+ mutex_init(&rpc->rpc_mutex);
+- init_waitqueue_head(&rpc->wait_release);
+
+ /* Use PCIe bus function to store rpc into PCIe device */
+ set_service_data(dev, rpc);
+@@ -285,8 +284,7 @@ static void aer_remove(struct pcie_device *dev)
+ if (rpc->isr)
+ free_irq(dev->irq, dev);
+
+- wait_event(rpc->wait_release, rpc->prod_idx == rpc->cons_idx);
+-
++ flush_work(&rpc->dpc_handler);
+ aer_disable_rootport(rpc);
+ kfree(rpc);
+ set_service_data(dev, NULL);
+diff --git a/drivers/pci/pcie/aer/aerdrv.h b/drivers/pci/pcie/aer/aerdrv.h
+index 84420b7c9456..945c939a86c5 100644
+--- a/drivers/pci/pcie/aer/aerdrv.h
++++ b/drivers/pci/pcie/aer/aerdrv.h
+@@ -72,7 +72,6 @@ struct aer_rpc {
+ * recovery on the same
+ * root port hierarchy
+ */
+- wait_queue_head_t wait_release;
+ };
+
+ struct aer_broadcast_data {
+diff --git a/drivers/pci/pcie/aer/aerdrv_core.c b/drivers/pci/pcie/aer/aerdrv_core.c
+index 5653ea94547f..b60a325234c5 100644
+--- a/drivers/pci/pcie/aer/aerdrv_core.c
++++ b/drivers/pci/pcie/aer/aerdrv_core.c
+@@ -784,8 +784,6 @@ void aer_isr(struct work_struct *work)
+ while (get_e_source(rpc, &e_src))
+ aer_isr_one_error(p_device, &e_src);
+ mutex_unlock(&rpc->rpc_mutex);
+-
+- wake_up(&rpc->wait_release);
+ }
+
+ /**
+diff --git a/drivers/phy/phy-core.c b/drivers/phy/phy-core.c
+index 2733112b3527..75c62907b99d 100644
+--- a/drivers/phy/phy-core.c
++++ b/drivers/phy/phy-core.c
+@@ -179,6 +179,7 @@ int phy_init(struct phy *phy)
+ ret = phy_pm_runtime_get_sync(phy);
+ if (ret < 0 && ret != -ENOTSUPP)
+ return ret;
++ ret = 0; /* Override possible ret == -ENOTSUPP */
+
+ mutex_lock(&phy->mutex);
+ if (phy->init_count == 0 && phy->ops->init) {
+@@ -187,8 +188,6 @@ int phy_init(struct phy *phy)
+ dev_err(&phy->dev, "phy init failed --> %d\n", ret);
+ goto out;
+ }
+- } else {
+- ret = 0; /* Override possible ret == -ENOTSUPP */
+ }
+ ++phy->init_count;
+
+@@ -209,6 +208,7 @@ int phy_exit(struct phy *phy)
+ ret = phy_pm_runtime_get_sync(phy);
+ if (ret < 0 && ret != -ENOTSUPP)
+ return ret;
++ ret = 0; /* Override possible ret == -ENOTSUPP */
+
+ mutex_lock(&phy->mutex);
+ if (phy->init_count == 1 && phy->ops->exit) {
+@@ -229,41 +229,42 @@ EXPORT_SYMBOL_GPL(phy_exit);
+
+ int phy_power_on(struct phy *phy)
+ {
+- int ret;
++ int ret = 0;
+
+ if (!phy)
+- return 0;
++ goto out;
+
+ if (phy->pwr) {
+ ret = regulator_enable(phy->pwr);
+ if (ret)
+- return ret;
++ goto out;
+ }
+
+ ret = phy_pm_runtime_get_sync(phy);
+ if (ret < 0 && ret != -ENOTSUPP)
+- return ret;
++ goto err_pm_sync;
++
++ ret = 0; /* Override possible ret == -ENOTSUPP */
+
+ mutex_lock(&phy->mutex);
+ if (phy->power_count == 0 && phy->ops->power_on) {
+ ret = phy->ops->power_on(phy);
+ if (ret < 0) {
+ dev_err(&phy->dev, "phy poweron failed --> %d\n", ret);
+- goto out;
++ goto err_pwr_on;
+ }
+- } else {
+- ret = 0; /* Override possible ret == -ENOTSUPP */
+ }
+ ++phy->power_count;
+ mutex_unlock(&phy->mutex);
+ return 0;
+
+-out:
++err_pwr_on:
+ mutex_unlock(&phy->mutex);
+ phy_pm_runtime_put_sync(phy);
++err_pm_sync:
+ if (phy->pwr)
+ regulator_disable(phy->pwr);
+-
++out:
+ return ret;
+ }
+ EXPORT_SYMBOL_GPL(phy_power_on);
+diff --git a/drivers/phy/phy-twl4030-usb.c b/drivers/phy/phy-twl4030-usb.c
+index 13dd070a69da..6ab230f1f513 100644
+--- a/drivers/phy/phy-twl4030-usb.c
++++ b/drivers/phy/phy-twl4030-usb.c
+@@ -753,6 +753,7 @@ static int twl4030_usb_remove(struct platform_device *pdev)
+ struct twl4030_usb *twl = platform_get_drvdata(pdev);
+ int val;
+
++ usb_remove_phy(&twl->phy);
+ pm_runtime_get_sync(twl->dev);
+ cancel_delayed_work(&twl->id_workaround_work);
+ device_remove_file(twl->dev, &dev_attr_vbus);
+@@ -760,6 +761,13 @@ static int twl4030_usb_remove(struct platform_device *pdev)
+ /* set transceiver mode to power on defaults */
+ twl4030_usb_set_mode(twl, -1);
+
++ /* idle ulpi before powering off */
++ if (cable_present(twl->linkstat))
++ pm_runtime_put_noidle(twl->dev);
++ pm_runtime_mark_last_busy(twl->dev);
++ pm_runtime_put_sync_suspend(twl->dev);
++ pm_runtime_disable(twl->dev);
++
+ /* autogate 60MHz ULPI clock,
+ * clear dpll clock request for i2c access,
+ * disable 32KHz
+@@ -774,11 +782,6 @@ static int twl4030_usb_remove(struct platform_device *pdev)
+ /* disable complete OTG block */
+ twl4030_usb_clear_bits(twl, POWER_CTRL, POWER_CTRL_OTG_ENAB);
+
+- if (cable_present(twl->linkstat))
+- pm_runtime_put_noidle(twl->dev);
+- pm_runtime_mark_last_busy(twl->dev);
+- pm_runtime_put(twl->dev);
+-
+ return 0;
+ }
+
+diff --git a/drivers/platform/x86/intel_scu_ipcutil.c b/drivers/platform/x86/intel_scu_ipcutil.c
+index 02bc5a6343c3..aa454241489c 100644
+--- a/drivers/platform/x86/intel_scu_ipcutil.c
++++ b/drivers/platform/x86/intel_scu_ipcutil.c
+@@ -49,7 +49,7 @@ struct scu_ipc_data {
+
+ static int scu_reg_access(u32 cmd, struct scu_ipc_data *data)
+ {
+- int count = data->count;
++ unsigned int count = data->count;
+
+ if (count == 0 || count == 3 || count > 4)
+ return -EINVAL;
+diff --git a/drivers/s390/block/dasd_alias.c b/drivers/s390/block/dasd_alias.c
+index a2597e683e79..6a64e86e8ccd 100644
+--- a/drivers/s390/block/dasd_alias.c
++++ b/drivers/s390/block/dasd_alias.c
+@@ -264,8 +264,10 @@ void dasd_alias_disconnect_device_from_lcu(struct dasd_device *device)
+ spin_unlock_irqrestore(&lcu->lock, flags);
+ cancel_work_sync(&lcu->suc_data.worker);
+ spin_lock_irqsave(&lcu->lock, flags);
+- if (device == lcu->suc_data.device)
++ if (device == lcu->suc_data.device) {
++ dasd_put_device(device);
+ lcu->suc_data.device = NULL;
++ }
+ }
+ was_pending = 0;
+ if (device == lcu->ruac_data.device) {
+@@ -273,8 +275,10 @@ void dasd_alias_disconnect_device_from_lcu(struct dasd_device *device)
+ was_pending = 1;
+ cancel_delayed_work_sync(&lcu->ruac_data.dwork);
+ spin_lock_irqsave(&lcu->lock, flags);
+- if (device == lcu->ruac_data.device)
++ if (device == lcu->ruac_data.device) {
++ dasd_put_device(device);
+ lcu->ruac_data.device = NULL;
++ }
+ }
+ private->lcu = NULL;
+ spin_unlock_irqrestore(&lcu->lock, flags);
+@@ -549,8 +553,10 @@ static void lcu_update_work(struct work_struct *work)
+ if ((rc && (rc != -EOPNOTSUPP)) || (lcu->flags & NEED_UAC_UPDATE)) {
+ DBF_DEV_EVENT(DBF_WARNING, device, "could not update"
+ " alias data in lcu (rc = %d), retry later", rc);
+- schedule_delayed_work(&lcu->ruac_data.dwork, 30*HZ);
++ if (!schedule_delayed_work(&lcu->ruac_data.dwork, 30*HZ))
++ dasd_put_device(device);
+ } else {
++ dasd_put_device(device);
+ lcu->ruac_data.device = NULL;
+ lcu->flags &= ~UPDATE_PENDING;
+ }
+@@ -593,8 +599,10 @@ static int _schedule_lcu_update(struct alias_lcu *lcu,
+ */
+ if (!usedev)
+ return -EINVAL;
++ dasd_get_device(usedev);
+ lcu->ruac_data.device = usedev;
+- schedule_delayed_work(&lcu->ruac_data.dwork, 0);
++ if (!schedule_delayed_work(&lcu->ruac_data.dwork, 0))
++ dasd_put_device(usedev);
+ return 0;
+ }
+
+@@ -722,7 +730,7 @@ static int reset_summary_unit_check(struct alias_lcu *lcu,
+ ASCEBC((char *) &cqr->magic, 4);
+ ccw = cqr->cpaddr;
+ ccw->cmd_code = DASD_ECKD_CCW_RSCK;
+- ccw->flags = 0 ;
++ ccw->flags = CCW_FLAG_SLI;
+ ccw->count = 16;
+ ccw->cda = (__u32)(addr_t) cqr->data;
+ ((char *)cqr->data)[0] = reason;
+@@ -926,6 +934,7 @@ static void summary_unit_check_handling_work(struct work_struct *work)
+ /* 3. read new alias configuration */
+ _schedule_lcu_update(lcu, device);
+ lcu->suc_data.device = NULL;
++ dasd_put_device(device);
+ spin_unlock_irqrestore(&lcu->lock, flags);
+ }
+
+@@ -985,6 +994,8 @@ void dasd_alias_handle_summary_unit_check(struct dasd_device *device,
+ }
+ lcu->suc_data.reason = reason;
+ lcu->suc_data.device = device;
++ dasd_get_device(device);
+ spin_unlock(&lcu->lock);
+- schedule_work(&lcu->suc_data.worker);
++ if (!schedule_work(&lcu->suc_data.worker))
++ dasd_put_device(device);
+ };
+diff --git a/drivers/scsi/device_handler/scsi_dh_rdac.c b/drivers/scsi/device_handler/scsi_dh_rdac.c
+index 1b5bc9293e37..cd4042a22a56 100644
+--- a/drivers/scsi/device_handler/scsi_dh_rdac.c
++++ b/drivers/scsi/device_handler/scsi_dh_rdac.c
+@@ -569,7 +569,7 @@ static int mode_select_handle_sense(struct scsi_device *sdev,
+ /*
+ * Command Lock contention
+ */
+- err = SCSI_DH_RETRY;
++ err = SCSI_DH_IMM_RETRY;
+ break;
+ default:
+ break;
+@@ -619,6 +619,8 @@ retry:
+ err = mode_select_handle_sense(sdev, h->sense);
+ if (err == SCSI_DH_RETRY && retry_cnt--)
+ goto retry;
++ if (err == SCSI_DH_IMM_RETRY)
++ goto retry;
+ }
+ if (err == SCSI_DH_OK) {
+ h->state = RDAC_STATE_ACTIVE;
+diff --git a/drivers/scsi/qla2xxx/qla_dbg.c b/drivers/scsi/qla2xxx/qla_dbg.c
+index d77fe43793b6..88ff7c3417ee 100644
+--- a/drivers/scsi/qla2xxx/qla_dbg.c
++++ b/drivers/scsi/qla2xxx/qla_dbg.c
+@@ -67,10 +67,10 @@
+ * | | | 0xd031-0xd0ff |
+ * | | | 0xd101-0xd1fe |
+ * | | | 0xd214-0xd2fe |
+- * | Target Mode | 0xe079 | |
+- * | Target Mode Management | 0xf072 | 0xf002 |
++ * | Target Mode | 0xe080 | |
++ * | Target Mode Management | 0xf096 | 0xf002 |
+ * | | | 0xf046-0xf049 |
+- * | Target Mode Task Management | 0x1000b | |
++ * | Target Mode Task Management | 0x1000d | |
+ * ----------------------------------------------------------------------
+ */
+
+diff --git a/drivers/scsi/qla2xxx/qla_def.h b/drivers/scsi/qla2xxx/qla_def.h
+index 5f6b2960cccb..c03d33f4df3a 100644
+--- a/drivers/scsi/qla2xxx/qla_def.h
++++ b/drivers/scsi/qla2xxx/qla_def.h
+@@ -274,6 +274,7 @@
+ #define RESPONSE_ENTRY_CNT_FX00 256 /* Number of response entries.*/
+
+ struct req_que;
++struct qla_tgt_sess;
+
+ /*
+ * (sd.h is not exported, hence local inclusion)
+@@ -2026,6 +2027,7 @@ typedef struct fc_port {
+ uint16_t port_id;
+
+ unsigned long retry_delay_timestamp;
++ struct qla_tgt_sess *tgt_session;
+ } fc_port_t;
+
+ #include "qla_mr.h"
+@@ -3576,6 +3578,16 @@ typedef struct scsi_qla_host {
+ uint16_t fcoe_fcf_idx;
+ uint8_t fcoe_vn_port_mac[6];
+
++ /* list of commands waiting on workqueue */
++ struct list_head qla_cmd_list;
++ struct list_head qla_sess_op_cmd_list;
++ spinlock_t cmd_list_lock;
++
++ /* Counter to detect races between ELS and RSCN events */
++ atomic_t generation_tick;
++ /* Time when global fcport update has been scheduled */
++ int total_fcport_update_gen;
++
+ uint32_t vp_abort_cnt;
+
+ struct fc_vport *fc_vport; /* holds fc_vport * for each vport */
+diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
+index a4dde7e80dbd..c919ac042593 100644
+--- a/drivers/scsi/qla2xxx/qla_init.c
++++ b/drivers/scsi/qla2xxx/qla_init.c
+@@ -115,6 +115,8 @@ qla2x00_async_iocb_timeout(void *data)
+ QLA_LOGIO_LOGIN_RETRIED : 0;
+ qla2x00_post_async_login_done_work(fcport->vha, fcport,
+ lio->u.logio.data);
++ } else if (sp->type == SRB_LOGOUT_CMD) {
++ qlt_logo_completion_handler(fcport, QLA_FUNCTION_TIMEOUT);
+ }
+ }
+
+@@ -497,7 +499,10 @@ void
+ qla2x00_async_logout_done(struct scsi_qla_host *vha, fc_port_t *fcport,
+ uint16_t *data)
+ {
+- qla2x00_mark_device_lost(vha, fcport, 1, 0);
++ /* Don't re-login in target mode */
++ if (!fcport->tgt_session)
++ qla2x00_mark_device_lost(vha, fcport, 1, 0);
++ qlt_logo_completion_handler(fcport, data[0]);
+ return;
+ }
+
+@@ -2141,7 +2146,7 @@ qla2x00_init_rings(scsi_qla_host_t *vha)
+ /* Clear outstanding commands array. */
+ for (que = 0; que < ha->max_req_queues; que++) {
+ req = ha->req_q_map[que];
+- if (!req)
++ if (!req || !test_bit(que, ha->req_qid_map))
+ continue;
+ req->out_ptr = (void *)(req->ring + req->length);
+ *req->out_ptr = 0;
+@@ -2158,7 +2163,7 @@ qla2x00_init_rings(scsi_qla_host_t *vha)
+
+ for (que = 0; que < ha->max_rsp_queues; que++) {
+ rsp = ha->rsp_q_map[que];
+- if (!rsp)
++ if (!rsp || !test_bit(que, ha->rsp_qid_map))
+ continue;
+ rsp->in_ptr = (void *)(rsp->ring + rsp->length);
+ *rsp->in_ptr = 0;
+@@ -2871,21 +2876,14 @@ qla2x00_rport_del(void *data)
+ {
+ fc_port_t *fcport = data;
+ struct fc_rport *rport;
+- scsi_qla_host_t *vha = fcport->vha;
+ unsigned long flags;
+
+ spin_lock_irqsave(fcport->vha->host->host_lock, flags);
+ rport = fcport->drport ? fcport->drport: fcport->rport;
+ fcport->drport = NULL;
+ spin_unlock_irqrestore(fcport->vha->host->host_lock, flags);
+- if (rport) {
++ if (rport)
+ fc_remote_port_delete(rport);
+- /*
+- * Release the target mode FC NEXUS in qla_target.c code
+- * if target mod is enabled.
+- */
+- qlt_fc_port_deleted(vha, fcport);
+- }
+ }
+
+ /**
+@@ -3254,6 +3252,7 @@ qla2x00_reg_remote_port(scsi_qla_host_t *vha, fc_port_t *fcport)
+ * Create target mode FC NEXUS in qla_target.c if target mode is
+ * enabled..
+ */
++
+ qlt_fc_port_added(vha, fcport);
+
+ spin_lock_irqsave(fcport->vha->host->host_lock, flags);
+@@ -3326,6 +3325,7 @@ qla2x00_configure_fabric(scsi_qla_host_t *vha)
+ LIST_HEAD(new_fcports);
+ struct qla_hw_data *ha = vha->hw;
+ struct scsi_qla_host *base_vha = pci_get_drvdata(ha->pdev);
++ int discovery_gen;
+
+ /* If FL port exists, then SNS is present */
+ if (IS_FWI2_CAPABLE(ha))
+@@ -3396,6 +3396,14 @@ qla2x00_configure_fabric(scsi_qla_host_t *vha)
+ fcport->scan_state = QLA_FCPORT_SCAN;
+ }
+
++ /* Mark the time right before querying FW for connected ports.
++ * This process is long, asynchronous and by the time it's done,
++ * collected information might not be accurate anymore. E.g.
++ * disconnected port might have re-connected and a brand new
++ * session has been created. In this case session's generation
++ * will be newer than discovery_gen. */
++ qlt_do_generation_tick(vha, &discovery_gen);
++
+ rval = qla2x00_find_all_fabric_devs(vha, &new_fcports);
+ if (rval != QLA_SUCCESS)
+ break;
+@@ -3411,20 +3419,44 @@ qla2x00_configure_fabric(scsi_qla_host_t *vha)
+ if ((fcport->flags & FCF_FABRIC_DEVICE) == 0)
+ continue;
+
+- if (fcport->scan_state == QLA_FCPORT_SCAN &&
+- atomic_read(&fcport->state) == FCS_ONLINE) {
+- qla2x00_mark_device_lost(vha, fcport,
+- ql2xplogiabsentdevice, 0);
+- if (fcport->loop_id != FC_NO_LOOP_ID &&
+- (fcport->flags & FCF_FCP2_DEVICE) == 0 &&
+- fcport->port_type != FCT_INITIATOR &&
+- fcport->port_type != FCT_BROADCAST) {
+- ha->isp_ops->fabric_logout(vha,
+- fcport->loop_id,
+- fcport->d_id.b.domain,
+- fcport->d_id.b.area,
+- fcport->d_id.b.al_pa);
+- qla2x00_clear_loop_id(fcport);
++ if (fcport->scan_state == QLA_FCPORT_SCAN) {
++ if (qla_ini_mode_enabled(base_vha) &&
++ atomic_read(&fcport->state) == FCS_ONLINE) {
++ qla2x00_mark_device_lost(vha, fcport,
++ ql2xplogiabsentdevice, 0);
++ if (fcport->loop_id != FC_NO_LOOP_ID &&
++ (fcport->flags & FCF_FCP2_DEVICE) == 0 &&
++ fcport->port_type != FCT_INITIATOR &&
++ fcport->port_type != FCT_BROADCAST) {
++ ha->isp_ops->fabric_logout(vha,
++ fcport->loop_id,
++ fcport->d_id.b.domain,
++ fcport->d_id.b.area,
++ fcport->d_id.b.al_pa);
++ qla2x00_clear_loop_id(fcport);
++ }
++ } else if (!qla_ini_mode_enabled(base_vha)) {
++ /*
++ * In target mode, explicitly kill
++ * sessions and log out of devices
++ * that are gone, so that we don't
++ * end up with an initiator using the
++ * wrong ACL (if the fabric recycles
++ * an FC address and we have a stale
++ * session around) and so that we don't
++ * report initiators that are no longer
++ * on the fabric.
++ */
++ ql_dbg(ql_dbg_tgt_mgt, vha, 0xf077,
++ "port gone, logging out/killing session: "
++ "%8phC state 0x%x flags 0x%x fc4_type 0x%x "
++ "scan_state %d\n",
++ fcport->port_name,
++ atomic_read(&fcport->state),
++ fcport->flags, fcport->fc4_type,
++ fcport->scan_state);
++ qlt_fc_port_deleted(vha, fcport,
++ discovery_gen);
+ }
+ }
+ }
+@@ -3445,6 +3477,28 @@ qla2x00_configure_fabric(scsi_qla_host_t *vha)
+ (fcport->flags & FCF_LOGIN_NEEDED) == 0)
+ continue;
+
++ /*
++ * If we're not an initiator, skip looking for devices
++ * and logging in. There's no reason for us to do it,
++ * and it seems to actively cause problems in target
++ * mode if we race with the initiator logging into us
++ * (we might get the "port ID used" status back from
++ * our login command and log out the initiator, which
++ * seems to cause havoc).
++ */
++ if (!qla_ini_mode_enabled(base_vha)) {
++ if (fcport->scan_state == QLA_FCPORT_FOUND) {
++ ql_dbg(ql_dbg_tgt_mgt, vha, 0xf078,
++ "port %8phC state 0x%x flags 0x%x fc4_type 0x%x "
++ "scan_state %d (initiator mode disabled; skipping "
++ "login)\n", fcport->port_name,
++ atomic_read(&fcport->state),
++ fcport->flags, fcport->fc4_type,
++ fcport->scan_state);
++ }
++ continue;
++ }
++
+ if (fcport->loop_id == FC_NO_LOOP_ID) {
+ fcport->loop_id = next_loopid;
+ rval = qla2x00_find_new_loop_id(
+@@ -3471,16 +3525,38 @@ qla2x00_configure_fabric(scsi_qla_host_t *vha)
+ test_bit(LOOP_RESYNC_NEEDED, &vha->dpc_flags))
+ break;
+
+- /* Find a new loop ID to use. */
+- fcport->loop_id = next_loopid;
+- rval = qla2x00_find_new_loop_id(base_vha, fcport);
+- if (rval != QLA_SUCCESS) {
+- /* Ran out of IDs to use */
+- break;
+- }
++ /*
++ * If we're not an initiator, skip looking for devices
++ * and logging in. There's no reason for us to do it,
++ * and it seems to actively cause problems in target
++ * mode if we race with the initiator logging into us
++ * (we might get the "port ID used" status back from
++ * our login command and log out the initiator, which
++ * seems to cause havoc).
++ */
++ if (qla_ini_mode_enabled(base_vha)) {
++ /* Find a new loop ID to use. */
++ fcport->loop_id = next_loopid;
++ rval = qla2x00_find_new_loop_id(base_vha,
++ fcport);
++ if (rval != QLA_SUCCESS) {
++ /* Ran out of IDs to use */
++ break;
++ }
+
+- /* Login and update database */
+- qla2x00_fabric_dev_login(vha, fcport, &next_loopid);
++ /* Login and update database */
++ qla2x00_fabric_dev_login(vha, fcport,
++ &next_loopid);
++ } else {
++ ql_dbg(ql_dbg_tgt_mgt, vha, 0xf079,
++ "new port %8phC state 0x%x flags 0x%x fc4_type "
++ "0x%x scan_state %d (initiator mode disabled; "
++ "skipping login)\n",
++ fcport->port_name,
++ atomic_read(&fcport->state),
++ fcport->flags, fcport->fc4_type,
++ fcport->scan_state);
++ }
+
+ list_move_tail(&fcport->list, &vha->vp_fcports);
+ }
+@@ -3676,11 +3752,12 @@ qla2x00_find_all_fabric_devs(scsi_qla_host_t *vha,
+ fcport->fp_speed = new_fcport->fp_speed;
+
+ /*
+- * If address the same and state FCS_ONLINE, nothing
+- * changed.
++ * If address the same and state FCS_ONLINE
++ * (or in target mode), nothing changed.
+ */
+ if (fcport->d_id.b24 == new_fcport->d_id.b24 &&
+- atomic_read(&fcport->state) == FCS_ONLINE) {
++ (atomic_read(&fcport->state) == FCS_ONLINE ||
++ !qla_ini_mode_enabled(base_vha))) {
+ break;
+ }
+
+@@ -3700,6 +3777,22 @@ qla2x00_find_all_fabric_devs(scsi_qla_host_t *vha,
+ * Log it out if still logged in and mark it for
+ * relogin later.
+ */
++ if (!qla_ini_mode_enabled(base_vha)) {
++ ql_dbg(ql_dbg_tgt_mgt, vha, 0xf080,
++ "port changed FC ID, %8phC"
++ " old %x:%x:%x (loop_id 0x%04x)-> new %x:%x:%x\n",
++ fcport->port_name,
++ fcport->d_id.b.domain,
++ fcport->d_id.b.area,
++ fcport->d_id.b.al_pa,
++ fcport->loop_id,
++ new_fcport->d_id.b.domain,
++ new_fcport->d_id.b.area,
++ new_fcport->d_id.b.al_pa);
++ fcport->d_id.b24 = new_fcport->d_id.b24;
++ break;
++ }
++
+ fcport->d_id.b24 = new_fcport->d_id.b24;
+ fcport->flags |= FCF_LOGIN_NEEDED;
+ if (fcport->loop_id != FC_NO_LOOP_ID &&
+@@ -3719,6 +3812,7 @@ qla2x00_find_all_fabric_devs(scsi_qla_host_t *vha,
+ if (found)
+ continue;
+ /* If device was not in our fcports list, then add it. */
++ new_fcport->scan_state = QLA_FCPORT_FOUND;
+ list_add_tail(&new_fcport->list, new_fcports);
+
+ /* Allocate a new replacement fcport. */
+@@ -4139,6 +4233,14 @@ qla2x00_update_fcports(scsi_qla_host_t *base_vha)
+ atomic_read(&fcport->state) != FCS_UNCONFIGURED) {
+ spin_unlock_irqrestore(&ha->vport_slock, flags);
+ qla2x00_rport_del(fcport);
++
++ /*
++ * Release the target mode FC NEXUS in
++ * qla_target.c, if target mod is enabled.
++ */
++ qlt_fc_port_deleted(vha, fcport,
++ base_vha->total_fcport_update_gen);
++
+ spin_lock_irqsave(&ha->vport_slock, flags);
+ }
+ }
+@@ -4806,7 +4908,7 @@ qla25xx_init_queues(struct qla_hw_data *ha)
+
+ for (i = 1; i < ha->max_rsp_queues; i++) {
+ rsp = ha->rsp_q_map[i];
+- if (rsp) {
++ if (rsp && test_bit(i, ha->rsp_qid_map)) {
+ rsp->options &= ~BIT_0;
+ ret = qla25xx_init_rsp_que(base_vha, rsp);
+ if (ret != QLA_SUCCESS)
+@@ -4821,8 +4923,8 @@ qla25xx_init_queues(struct qla_hw_data *ha)
+ }
+ for (i = 1; i < ha->max_req_queues; i++) {
+ req = ha->req_q_map[i];
+- if (req) {
+- /* Clear outstanding commands array. */
++ if (req && test_bit(i, ha->req_qid_map)) {
++ /* Clear outstanding commands array. */
+ req->options &= ~BIT_0;
+ ret = qla25xx_init_req_que(base_vha, req);
+ if (ret != QLA_SUCCESS)
+diff --git a/drivers/scsi/qla2xxx/qla_iocb.c b/drivers/scsi/qla2xxx/qla_iocb.c
+index f0edb07f3198..9788d30b21bf 100644
+--- a/drivers/scsi/qla2xxx/qla_iocb.c
++++ b/drivers/scsi/qla2xxx/qla_iocb.c
+@@ -1998,6 +1998,9 @@ qla24xx_logout_iocb(srb_t *sp, struct logio_entry_24xx *logio)
+ logio->entry_type = LOGINOUT_PORT_IOCB_TYPE;
+ logio->control_flags =
+ cpu_to_le16(LCF_COMMAND_LOGO|LCF_IMPL_LOGO);
++ if (!sp->fcport->tgt_session ||
++ !sp->fcport->tgt_session->keep_nport_handle)
++ logio->control_flags |= cpu_to_le16(LCF_FREE_NPORT);
+ logio->nport_handle = cpu_to_le16(sp->fcport->loop_id);
+ logio->port_id[0] = sp->fcport->d_id.b.al_pa;
+ logio->port_id[1] = sp->fcport->d_id.b.area;
+diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c
+index a04a1b1f7f32..e19117766369 100644
+--- a/drivers/scsi/qla2xxx/qla_isr.c
++++ b/drivers/scsi/qla2xxx/qla_isr.c
+@@ -2981,9 +2981,9 @@ qla24xx_enable_msix(struct qla_hw_data *ha, struct rsp_que *rsp)
+ "MSI-X: Failed to enable support "
+ "-- %d/%d\n Retry with %d vectors.\n",
+ ha->msix_count, ret, ret);
++ ha->msix_count = ret;
++ ha->max_rsp_queues = ha->msix_count - 1;
+ }
+- ha->msix_count = ret;
+- ha->max_rsp_queues = ha->msix_count - 1;
+ ha->msix_entries = kzalloc(sizeof(struct qla_msix_entry) *
+ ha->msix_count, GFP_KERNEL);
+ if (!ha->msix_entries) {
+diff --git a/drivers/scsi/qla2xxx/qla_mid.c b/drivers/scsi/qla2xxx/qla_mid.c
+index 5c2e0317f1c0..7c0b33d21f24 100644
+--- a/drivers/scsi/qla2xxx/qla_mid.c
++++ b/drivers/scsi/qla2xxx/qla_mid.c
+@@ -595,7 +595,7 @@ qla25xx_delete_queues(struct scsi_qla_host *vha)
+ /* Delete request queues */
+ for (cnt = 1; cnt < ha->max_req_queues; cnt++) {
+ req = ha->req_q_map[cnt];
+- if (req) {
++ if (req && test_bit(cnt, ha->req_qid_map)) {
+ ret = qla25xx_delete_req_que(vha, req);
+ if (ret != QLA_SUCCESS) {
+ ql_log(ql_log_warn, vha, 0x00ea,
+@@ -609,7 +609,7 @@ qla25xx_delete_queues(struct scsi_qla_host *vha)
+ /* Delete response queues */
+ for (cnt = 1; cnt < ha->max_rsp_queues; cnt++) {
+ rsp = ha->rsp_q_map[cnt];
+- if (rsp) {
++ if (rsp && test_bit(cnt, ha->rsp_qid_map)) {
+ ret = qla25xx_delete_rsp_que(vha, rsp);
+ if (ret != QLA_SUCCESS) {
+ ql_log(ql_log_warn, vha, 0x00eb,
+diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
+index db3dbd999cb6..e85978248323 100644
+--- a/drivers/scsi/qla2xxx/qla_os.c
++++ b/drivers/scsi/qla2xxx/qla_os.c
+@@ -399,6 +399,9 @@ static void qla2x00_free_queues(struct qla_hw_data *ha)
+ int cnt;
+
+ for (cnt = 0; cnt < ha->max_req_queues; cnt++) {
++ if (!test_bit(cnt, ha->req_qid_map))
++ continue;
++
+ req = ha->req_q_map[cnt];
+ qla2x00_free_req_que(ha, req);
+ }
+@@ -406,6 +409,9 @@ static void qla2x00_free_queues(struct qla_hw_data *ha)
+ ha->req_q_map = NULL;
+
+ for (cnt = 0; cnt < ha->max_rsp_queues; cnt++) {
++ if (!test_bit(cnt, ha->rsp_qid_map))
++ continue;
++
+ rsp = ha->rsp_q_map[cnt];
+ qla2x00_free_rsp_que(ha, rsp);
+ }
+@@ -735,7 +741,9 @@ qla2xxx_queuecommand(struct Scsi_Host *host, struct scsi_cmnd *cmd)
+ * Return target busy if we've received a non-zero retry_delay_timer
+ * in a FCP_RSP.
+ */
+- if (time_after(jiffies, fcport->retry_delay_timestamp))
++ if (fcport->retry_delay_timestamp == 0) {
++ /* retry delay not set */
++ } else if (time_after(jiffies, fcport->retry_delay_timestamp))
+ fcport->retry_delay_timestamp = 0;
+ else
+ goto qc24_target_busy;
+@@ -3301,11 +3309,14 @@ qla2x00_schedule_rport_del(struct scsi_qla_host *vha, fc_port_t *fcport,
+ spin_lock_irqsave(vha->host->host_lock, flags);
+ fcport->drport = rport;
+ spin_unlock_irqrestore(vha->host->host_lock, flags);
++ qlt_do_generation_tick(vha, &base_vha->total_fcport_update_gen);
+ set_bit(FCPORT_UPDATE_NEEDED, &base_vha->dpc_flags);
+ qla2xxx_wake_dpc(base_vha);
+ } else {
++ int now;
+ fc_remote_port_delete(rport);
+- qlt_fc_port_deleted(vha, fcport);
++ qlt_do_generation_tick(vha, &now);
++ qlt_fc_port_deleted(vha, fcport, now);
+ }
+ }
+
+@@ -3835,8 +3846,11 @@ struct scsi_qla_host *qla2x00_create_host(struct scsi_host_template *sht,
+ INIT_LIST_HEAD(&vha->vp_fcports);
+ INIT_LIST_HEAD(&vha->work_list);
+ INIT_LIST_HEAD(&vha->list);
++ INIT_LIST_HEAD(&vha->qla_cmd_list);
++ INIT_LIST_HEAD(&vha->qla_sess_op_cmd_list);
+
+ spin_lock_init(&vha->work_lock);
++ spin_lock_init(&vha->cmd_list_lock);
+
+ sprintf(vha->host_str, "%s_%ld", QLA2XXX_DRIVER_NAME, vha->host_no);
+ ql_dbg(ql_dbg_init, vha, 0x0041,
+diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c
+index a902fa1db7af..9f296dfeeb7f 100644
+--- a/drivers/scsi/qla2xxx/qla_target.c
++++ b/drivers/scsi/qla2xxx/qla_target.c
+@@ -113,6 +113,11 @@ static void qlt_abort_cmd_on_host_reset(struct scsi_qla_host *vha,
+ static void qlt_alloc_qfull_cmd(struct scsi_qla_host *vha,
+ struct atio_from_isp *atio, uint16_t status, int qfull);
+ static void qlt_disable_vha(struct scsi_qla_host *vha);
++static void qlt_clear_tgt_db(struct qla_tgt *tgt);
++static void qlt_send_notify_ack(struct scsi_qla_host *vha,
++ struct imm_ntfy_from_isp *ntfy,
++ uint32_t add_flags, uint16_t resp_code, int resp_code_valid,
++ uint16_t srr_flags, uint16_t srr_reject_code, uint8_t srr_explan);
+ /*
+ * Global Variables
+ */
+@@ -122,6 +127,16 @@ static struct workqueue_struct *qla_tgt_wq;
+ static DEFINE_MUTEX(qla_tgt_mutex);
+ static LIST_HEAD(qla_tgt_glist);
+
++/* This API intentionally takes dest as a parameter, rather than returning
++ * int value to avoid caller forgetting to issue wmb() after the store */
++void qlt_do_generation_tick(struct scsi_qla_host *vha, int *dest)
++{
++ scsi_qla_host_t *base_vha = pci_get_drvdata(vha->hw->pdev);
++ *dest = atomic_inc_return(&base_vha->generation_tick);
++ /* memory barrier */
++ wmb();
++}
++
+ /* ha->hardware_lock supposed to be held on entry (to protect tgt->sess_list) */
+ static struct qla_tgt_sess *qlt_find_sess_by_port_name(
+ struct qla_tgt *tgt,
+@@ -381,14 +396,73 @@ static void qlt_free_session_done(struct work_struct *work)
+ struct qla_tgt *tgt = sess->tgt;
+ struct scsi_qla_host *vha = sess->vha;
+ struct qla_hw_data *ha = vha->hw;
++ unsigned long flags;
++ bool logout_started = false;
++ fc_port_t fcport;
++
++ ql_dbg(ql_dbg_tgt_mgt, vha, 0xf084,
++ "%s: se_sess %p / sess %p from port %8phC loop_id %#04x"
++ " s_id %02x:%02x:%02x logout %d keep %d plogi %d\n",
++ __func__, sess->se_sess, sess, sess->port_name, sess->loop_id,
++ sess->s_id.b.domain, sess->s_id.b.area, sess->s_id.b.al_pa,
++ sess->logout_on_delete, sess->keep_nport_handle,
++ sess->plogi_ack_needed);
+
+ BUG_ON(!tgt);
++
++ if (sess->logout_on_delete) {
++ int rc;
++
++ memset(&fcport, 0, sizeof(fcport));
++ fcport.loop_id = sess->loop_id;
++ fcport.d_id = sess->s_id;
++ memcpy(fcport.port_name, sess->port_name, WWN_SIZE);
++ fcport.vha = vha;
++ fcport.tgt_session = sess;
++
++ rc = qla2x00_post_async_logout_work(vha, &fcport, NULL);
++ if (rc != QLA_SUCCESS)
++ ql_log(ql_log_warn, vha, 0xf085,
++ "Schedule logo failed sess %p rc %d\n",
++ sess, rc);
++ else
++ logout_started = true;
++ }
++
+ /*
+ * Release the target session for FC Nexus from fabric module code.
+ */
+ if (sess->se_sess != NULL)
+ ha->tgt.tgt_ops->free_session(sess);
+
++ if (logout_started) {
++ bool traced = false;
++
++ while (!ACCESS_ONCE(sess->logout_completed)) {
++ if (!traced) {
++ ql_dbg(ql_dbg_tgt_mgt, vha, 0xf086,
++ "%s: waiting for sess %p logout\n",
++ __func__, sess);
++ traced = true;
++ }
++ msleep(100);
++ }
++
++ ql_dbg(ql_dbg_tgt_mgt, vha, 0xf087,
++ "%s: sess %p logout completed\n",
++ __func__, sess);
++ }
++
++ spin_lock_irqsave(&ha->hardware_lock, flags);
++
++ if (sess->plogi_ack_needed)
++ qlt_send_notify_ack(vha, &sess->tm_iocb,
++ 0, 0, 0, 0, 0, 0);
++
++ list_del(&sess->sess_list_entry);
++
++ spin_unlock_irqrestore(&ha->hardware_lock, flags);
++
+ ql_dbg(ql_dbg_tgt_mgt, vha, 0xf001,
+ "Unregistration of sess %p finished\n", sess);
+
+@@ -409,9 +483,9 @@ void qlt_unreg_sess(struct qla_tgt_sess *sess)
+
+ vha->hw->tgt.tgt_ops->clear_nacl_from_fcport_map(sess);
+
+- list_del(&sess->sess_list_entry);
+- if (sess->deleted)
+- list_del(&sess->del_list_entry);
++ if (!list_empty(&sess->del_list_entry))
++ list_del_init(&sess->del_list_entry);
++ sess->deleted = QLA_SESS_DELETION_IN_PROGRESS;
+
+ INIT_WORK(&sess->free_work, qlt_free_session_done);
+ schedule_work(&sess->free_work);
+@@ -431,10 +505,10 @@ static int qlt_reset(struct scsi_qla_host *vha, void *iocb, int mcmd)
+
+ loop_id = le16_to_cpu(n->u.isp24.nport_handle);
+ if (loop_id == 0xFFFF) {
+-#if 0 /* FIXME: Re-enable Global event handling.. */
+ /* Global event */
+- atomic_inc(&ha->tgt.qla_tgt->tgt_global_resets_count);
+- qlt_clear_tgt_db(ha->tgt.qla_tgt);
++ atomic_inc(&vha->vha_tgt.qla_tgt->tgt_global_resets_count);
++ qlt_clear_tgt_db(vha->vha_tgt.qla_tgt);
++#if 0 /* FIXME: do we need to choose a session here? */
+ if (!list_empty(&ha->tgt.qla_tgt->sess_list)) {
+ sess = list_entry(ha->tgt.qla_tgt->sess_list.next,
+ typeof(*sess), sess_list_entry);
+@@ -489,27 +563,38 @@ static void qlt_schedule_sess_for_deletion(struct qla_tgt_sess *sess,
+ struct qla_tgt *tgt = sess->tgt;
+ uint32_t dev_loss_tmo = tgt->ha->port_down_retry_count + 5;
+
+- if (sess->deleted)
+- return;
++ if (sess->deleted) {
++ /* Upgrade to unconditional deletion in case it was temporary */
++ if (immediate && sess->deleted == QLA_SESS_DELETION_PENDING)
++ list_del(&sess->del_list_entry);
++ else
++ return;
++ }
+
+ ql_dbg(ql_dbg_tgt, sess->vha, 0xe001,
+ "Scheduling sess %p for deletion\n", sess);
+- list_add_tail(&sess->del_list_entry, &tgt->del_sess_list);
+- sess->deleted = 1;
+
+- if (immediate)
++ if (immediate) {
+ dev_loss_tmo = 0;
++ sess->deleted = QLA_SESS_DELETION_IN_PROGRESS;
++ list_add(&sess->del_list_entry, &tgt->del_sess_list);
++ } else {
++ sess->deleted = QLA_SESS_DELETION_PENDING;
++ list_add_tail(&sess->del_list_entry, &tgt->del_sess_list);
++ }
+
+ sess->expires = jiffies + dev_loss_tmo * HZ;
+
+ ql_dbg(ql_dbg_tgt, sess->vha, 0xe048,
+- "qla_target(%d): session for port %8phC (loop ID %d) scheduled for "
+- "deletion in %u secs (expires: %lu) immed: %d\n",
+- sess->vha->vp_idx, sess->port_name, sess->loop_id, dev_loss_tmo,
+- sess->expires, immediate);
++ "qla_target(%d): session for port %8phC (loop ID %d s_id %02x:%02x:%02x)"
++ " scheduled for deletion in %u secs (expires: %lu) immed: %d, logout: %d, gen: %#x\n",
++ sess->vha->vp_idx, sess->port_name, sess->loop_id,
++ sess->s_id.b.domain, sess->s_id.b.area, sess->s_id.b.al_pa,
++ dev_loss_tmo, sess->expires, immediate, sess->logout_on_delete,
++ sess->generation);
+
+ if (immediate)
+- schedule_delayed_work(&tgt->sess_del_work, 0);
++ mod_delayed_work(system_wq, &tgt->sess_del_work, 0);
+ else
+ schedule_delayed_work(&tgt->sess_del_work,
+ sess->expires - jiffies);
+@@ -578,9 +663,9 @@ out_free_id_list:
+ /* ha->hardware_lock supposed to be held on entry */
+ static void qlt_undelete_sess(struct qla_tgt_sess *sess)
+ {
+- BUG_ON(!sess->deleted);
++ BUG_ON(sess->deleted != QLA_SESS_DELETION_PENDING);
+
+- list_del(&sess->del_list_entry);
++ list_del_init(&sess->del_list_entry);
+ sess->deleted = 0;
+ }
+
+@@ -599,7 +684,9 @@ static void qlt_del_sess_work_fn(struct delayed_work *work)
+ del_list_entry);
+ elapsed = jiffies;
+ if (time_after_eq(elapsed, sess->expires)) {
+- qlt_undelete_sess(sess);
++ /* No turning back */
++ list_del_init(&sess->del_list_entry);
++ sess->deleted = QLA_SESS_DELETION_IN_PROGRESS;
+
+ ql_dbg(ql_dbg_tgt_mgt, vha, 0xf004,
+ "Timeout: sess %p about to be deleted\n",
+@@ -643,6 +730,13 @@ static struct qla_tgt_sess *qlt_create_sess(
+ fcport->d_id.b.al_pa, fcport->d_id.b.area,
+ fcport->loop_id);
+
++ /* Cannot undelete at this point */
++ if (sess->deleted == QLA_SESS_DELETION_IN_PROGRESS) {
++ spin_unlock_irqrestore(&ha->hardware_lock,
++ flags);
++ return NULL;
++ }
++
+ if (sess->deleted)
+ qlt_undelete_sess(sess);
+
+@@ -652,6 +746,9 @@ static struct qla_tgt_sess *qlt_create_sess(
+
+ if (sess->local && !local)
+ sess->local = 0;
++
++ qlt_do_generation_tick(vha, &sess->generation);
++
+ spin_unlock_irqrestore(&ha->hardware_lock, flags);
+
+ return sess;
+@@ -673,6 +770,14 @@ static struct qla_tgt_sess *qlt_create_sess(
+ sess->s_id = fcport->d_id;
+ sess->loop_id = fcport->loop_id;
+ sess->local = local;
++ INIT_LIST_HEAD(&sess->del_list_entry);
++
++ /* Under normal circumstances we want to logout from firmware when
++ * session eventually ends and release corresponding nport handle.
++ * In the exception cases (e.g. when new PLOGI is waiting) corresponding
++ * code will adjust these flags as necessary. */
++ sess->logout_on_delete = 1;
++ sess->keep_nport_handle = 0;
+
+ ql_dbg(ql_dbg_tgt_mgt, vha, 0xf006,
+ "Adding sess %p to tgt %p via ->check_initiator_node_acl()\n",
+@@ -705,6 +810,7 @@ static struct qla_tgt_sess *qlt_create_sess(
+ spin_lock_irqsave(&ha->hardware_lock, flags);
+ list_add_tail(&sess->sess_list_entry, &vha->vha_tgt.qla_tgt->sess_list);
+ vha->vha_tgt.qla_tgt->sess_count++;
++ qlt_do_generation_tick(vha, &sess->generation);
+ spin_unlock_irqrestore(&ha->hardware_lock, flags);
+
+ ql_dbg(ql_dbg_tgt_mgt, vha, 0xf04b,
+@@ -718,7 +824,7 @@ static struct qla_tgt_sess *qlt_create_sess(
+ }
+
+ /*
+- * Called from drivers/scsi/qla2xxx/qla_init.c:qla2x00_reg_remote_port()
++ * Called from qla2x00_reg_remote_port()
+ */
+ void qlt_fc_port_added(struct scsi_qla_host *vha, fc_port_t *fcport)
+ {
+@@ -750,6 +856,10 @@ void qlt_fc_port_added(struct scsi_qla_host *vha, fc_port_t *fcport)
+ mutex_unlock(&vha->vha_tgt.tgt_mutex);
+
+ spin_lock_irqsave(&ha->hardware_lock, flags);
++ } else if (sess->deleted == QLA_SESS_DELETION_IN_PROGRESS) {
++ /* Point of no return */
++ spin_unlock_irqrestore(&ha->hardware_lock, flags);
++ return;
+ } else {
+ kref_get(&sess->se_sess->sess_kref);
+
+@@ -780,27 +890,36 @@ void qlt_fc_port_added(struct scsi_qla_host *vha, fc_port_t *fcport)
+ spin_unlock_irqrestore(&ha->hardware_lock, flags);
+ }
+
+-void qlt_fc_port_deleted(struct scsi_qla_host *vha, fc_port_t *fcport)
++/*
++ * max_gen - specifies maximum session generation
++ * at which this deletion requestion is still valid
++ */
++void
++qlt_fc_port_deleted(struct scsi_qla_host *vha, fc_port_t *fcport, int max_gen)
+ {
+- struct qla_hw_data *ha = vha->hw;
+ struct qla_tgt *tgt = vha->vha_tgt.qla_tgt;
+ struct qla_tgt_sess *sess;
+- unsigned long flags;
+
+ if (!vha->hw->tgt.tgt_ops)
+ return;
+
+- if (!tgt || (fcport->port_type != FCT_INITIATOR))
++ if (!tgt)
+ return;
+
+- spin_lock_irqsave(&ha->hardware_lock, flags);
+ if (tgt->tgt_stop) {
+- spin_unlock_irqrestore(&ha->hardware_lock, flags);
+ return;
+ }
+ sess = qlt_find_sess_by_port_name(tgt, fcport->port_name);
+ if (!sess) {
+- spin_unlock_irqrestore(&ha->hardware_lock, flags);
++ return;
++ }
++
++ if (max_gen - sess->generation < 0) {
++ ql_dbg(ql_dbg_tgt_mgt, vha, 0xf092,
++ "Ignoring stale deletion request for se_sess %p / sess %p"
++ " for port %8phC, req_gen %d, sess_gen %d\n",
++ sess->se_sess, sess, sess->port_name, max_gen,
++ sess->generation);
+ return;
+ }
+
+@@ -808,7 +927,6 @@ void qlt_fc_port_deleted(struct scsi_qla_host *vha, fc_port_t *fcport)
+
+ sess->local = 1;
+ qlt_schedule_sess_for_deletion(sess, false);
+- spin_unlock_irqrestore(&ha->hardware_lock, flags);
+ }
+
+ static inline int test_tgt_sess_count(struct qla_tgt *tgt)
+@@ -1175,6 +1293,70 @@ static void qlt_24xx_retry_term_exchange(struct scsi_qla_host *vha,
+ FCP_TMF_CMPL, true);
+ }
+
++static int abort_cmd_for_tag(struct scsi_qla_host *vha, uint32_t tag)
++{
++ struct qla_tgt_sess_op *op;
++ struct qla_tgt_cmd *cmd;
++
++ spin_lock(&vha->cmd_list_lock);
++
++ list_for_each_entry(op, &vha->qla_sess_op_cmd_list, cmd_list) {
++ if (tag == op->atio.u.isp24.exchange_addr) {
++ op->aborted = true;
++ spin_unlock(&vha->cmd_list_lock);
++ return 1;
++ }
++ }
++
++ list_for_each_entry(cmd, &vha->qla_cmd_list, cmd_list) {
++ if (tag == cmd->atio.u.isp24.exchange_addr) {
++ cmd->state = QLA_TGT_STATE_ABORTED;
++ spin_unlock(&vha->cmd_list_lock);
++ return 1;
++ }
++ }
++
++ spin_unlock(&vha->cmd_list_lock);
++ return 0;
++}
++
++/* drop cmds for the given lun
++ * XXX only looks for cmds on the port through which lun reset was recieved
++ * XXX does not go through the list of other port (which may have cmds
++ * for the same lun)
++ */
++static void abort_cmds_for_lun(struct scsi_qla_host *vha,
++ uint32_t lun, uint8_t *s_id)
++{
++ struct qla_tgt_sess_op *op;
++ struct qla_tgt_cmd *cmd;
++ uint32_t key;
++
++ key = sid_to_key(s_id);
++ spin_lock(&vha->cmd_list_lock);
++ list_for_each_entry(op, &vha->qla_sess_op_cmd_list, cmd_list) {
++ uint32_t op_key;
++ uint32_t op_lun;
++
++ op_key = sid_to_key(op->atio.u.isp24.fcp_hdr.s_id);
++ op_lun = scsilun_to_int(
++ (struct scsi_lun *)&op->atio.u.isp24.fcp_cmnd.lun);
++ if (op_key == key && op_lun == lun)
++ op->aborted = true;
++ }
++ list_for_each_entry(cmd, &vha->qla_cmd_list, cmd_list) {
++ uint32_t cmd_key;
++ uint32_t cmd_lun;
++
++ cmd_key = sid_to_key(cmd->atio.u.isp24.fcp_hdr.s_id);
++ cmd_lun = scsilun_to_int(
++ (struct scsi_lun *)&cmd->atio.u.isp24.fcp_cmnd.lun);
++ if (cmd_key == key && cmd_lun == lun)
++ cmd->state = QLA_TGT_STATE_ABORTED;
++ }
++ spin_unlock(&vha->cmd_list_lock);
++}
++
+ /* ha->hardware_lock supposed to be held on entry */
+ static int __qlt_24xx_handle_abts(struct scsi_qla_host *vha,
+ struct abts_recv_from_24xx *abts, struct qla_tgt_sess *sess)
+@@ -1199,8 +1381,19 @@ static int __qlt_24xx_handle_abts(struct scsi_qla_host *vha,
+ }
+ spin_unlock(&se_sess->sess_cmd_lock);
+
+- if (!found_lun)
+- return -ENOENT;
++ /* cmd not in LIO lists, look in qla list */
++ if (!found_lun) {
++ if (abort_cmd_for_tag(vha, abts->exchange_addr_to_abort)) {
++ /* send TASK_ABORT response immediately */
++ qlt_24xx_send_abts_resp(vha, abts, FCP_TMF_CMPL, false);
++ return 0;
++ } else {
++ ql_dbg(ql_dbg_tgt_mgt, vha, 0xf081,
++ "unable to find cmd in driver or LIO for tag 0x%x\n",
++ abts->exchange_addr_to_abort);
++ return -ENOENT;
++ }
++ }
+
+ ql_dbg(ql_dbg_tgt_mgt, vha, 0xf00f,
+ "qla_target(%d): task abort (tag=%d)\n",
+@@ -1284,6 +1477,11 @@ static void qlt_24xx_handle_abts(struct scsi_qla_host *vha,
+ return;
+ }
+
++ if (sess->deleted == QLA_SESS_DELETION_IN_PROGRESS) {
++ qlt_24xx_send_abts_resp(vha, abts, FCP_TMF_REJECTED, false);
++ return;
++ }
++
+ rc = __qlt_24xx_handle_abts(vha, abts, sess);
+ if (rc != 0) {
+ ql_dbg(ql_dbg_tgt_mgt, vha, 0xf054,
+@@ -1726,21 +1924,6 @@ static int qlt_pre_xmit_response(struct qla_tgt_cmd *cmd,
+ struct qla_hw_data *ha = vha->hw;
+ struct se_cmd *se_cmd = &cmd->se_cmd;
+
+- if (unlikely(cmd->aborted)) {
+- ql_dbg(ql_dbg_tgt_mgt, vha, 0xf014,
+- "qla_target(%d): terminating exchange "
+- "for aborted cmd=%p (se_cmd=%p, tag=%d)", vha->vp_idx, cmd,
+- se_cmd, cmd->tag);
+-
+- cmd->state = QLA_TGT_STATE_ABORTED;
+- cmd->cmd_flags |= BIT_6;
+-
+- qlt_send_term_exchange(vha, cmd, &cmd->atio, 0);
+-
+- /* !! At this point cmd could be already freed !! */
+- return QLA_TGT_PRE_XMIT_RESP_CMD_ABORTED;
+- }
+-
+ prm->cmd = cmd;
+ prm->tgt = tgt;
+ prm->rq_result = scsi_status;
+@@ -2303,6 +2486,19 @@ int qlt_xmit_response(struct qla_tgt_cmd *cmd, int xmit_type,
+ unsigned long flags = 0;
+ int res;
+
++ spin_lock_irqsave(&ha->hardware_lock, flags);
++ if (cmd->sess && cmd->sess->deleted == QLA_SESS_DELETION_IN_PROGRESS) {
++ cmd->state = QLA_TGT_STATE_PROCESSED;
++ if (cmd->sess->logout_completed)
++ /* no need to terminate. FW already freed exchange. */
++ qlt_abort_cmd_on_host_reset(cmd->vha, cmd);
++ else
++ qlt_send_term_exchange(vha, cmd, &cmd->atio, 1);
++ spin_unlock_irqrestore(&ha->hardware_lock, flags);
++ return 0;
++ }
++ spin_unlock_irqrestore(&ha->hardware_lock, flags);
++
+ memset(&prm, 0, sizeof(prm));
+ qlt_check_srr_debug(cmd, &xmit_type);
+
+@@ -2315,9 +2511,6 @@ int qlt_xmit_response(struct qla_tgt_cmd *cmd, int xmit_type,
+ res = qlt_pre_xmit_response(cmd, &prm, xmit_type, scsi_status,
+ &full_req_cnt);
+ if (unlikely(res != 0)) {
+- if (res == QLA_TGT_PRE_XMIT_RESP_CMD_ABORTED)
+- return 0;
+-
+ return res;
+ }
+
+@@ -2463,7 +2656,8 @@ int qlt_rdy_to_xfer(struct qla_tgt_cmd *cmd)
+
+ spin_lock_irqsave(&ha->hardware_lock, flags);
+
+- if (qla2x00_reset_active(vha) || cmd->reset_count != ha->chip_reset) {
++ if (qla2x00_reset_active(vha) || (cmd->reset_count != ha->chip_reset) ||
++ (cmd->sess && cmd->sess->deleted == QLA_SESS_DELETION_IN_PROGRESS)) {
+ /*
+ * Either a chip reset is active or this request was from
+ * previous life, just abort the processing.
+@@ -2653,6 +2847,89 @@ out:
+
+ /* If hardware_lock held on entry, might drop it, then reaquire */
+ /* This function sends the appropriate CTIO to ISP 2xxx or 24xx */
++static int __qlt_send_term_imm_notif(struct scsi_qla_host *vha,
++ struct imm_ntfy_from_isp *ntfy)
++{
++ struct nack_to_isp *nack;
++ struct qla_hw_data *ha = vha->hw;
++ request_t *pkt;
++ int ret = 0;
++
++ ql_dbg(ql_dbg_tgt_tmr, vha, 0xe01c,
++ "Sending TERM ELS CTIO (ha=%p)\n", ha);
++
++ pkt = (request_t *)qla2x00_alloc_iocbs_ready(vha, NULL);
++ if (pkt == NULL) {
++ ql_dbg(ql_dbg_tgt, vha, 0xe080,
++ "qla_target(%d): %s failed: unable to allocate "
++ "request packet\n", vha->vp_idx, __func__);
++ return -ENOMEM;
++ }
++
++ pkt->entry_type = NOTIFY_ACK_TYPE;
++ pkt->entry_count = 1;
++ pkt->handle = QLA_TGT_SKIP_HANDLE | CTIO_COMPLETION_HANDLE_MARK;
++
++ nack = (struct nack_to_isp *)pkt;
++ nack->ox_id = ntfy->ox_id;
++
++ nack->u.isp24.nport_handle = ntfy->u.isp24.nport_handle;
++ if (le16_to_cpu(ntfy->u.isp24.status) == IMM_NTFY_ELS) {
++ nack->u.isp24.flags = ntfy->u.isp24.flags &
++ __constant_cpu_to_le32(NOTIFY24XX_FLAGS_PUREX_IOCB);
++ }
++
++ /* terminate */
++ nack->u.isp24.flags |=
++ __constant_cpu_to_le16(NOTIFY_ACK_FLAGS_TERMINATE);
++
++ nack->u.isp24.srr_rx_id = ntfy->u.isp24.srr_rx_id;
++ nack->u.isp24.status = ntfy->u.isp24.status;
++ nack->u.isp24.status_subcode = ntfy->u.isp24.status_subcode;
++ nack->u.isp24.fw_handle = ntfy->u.isp24.fw_handle;
++ nack->u.isp24.exchange_address = ntfy->u.isp24.exchange_address;
++ nack->u.isp24.srr_rel_offs = ntfy->u.isp24.srr_rel_offs;
++ nack->u.isp24.srr_ui = ntfy->u.isp24.srr_ui;
++ nack->u.isp24.vp_index = ntfy->u.isp24.vp_index;
++
++ qla2x00_start_iocbs(vha, vha->req);
++ return ret;
++}
++
++static void qlt_send_term_imm_notif(struct scsi_qla_host *vha,
++ struct imm_ntfy_from_isp *imm, int ha_locked)
++{
++ unsigned long flags = 0;
++ int rc;
++
++ if (qlt_issue_marker(vha, ha_locked) < 0)
++ return;
++
++ if (ha_locked) {
++ rc = __qlt_send_term_imm_notif(vha, imm);
++
++#if 0 /* Todo */
++ if (rc == -ENOMEM)
++ qlt_alloc_qfull_cmd(vha, imm, 0, 0);
++#endif
++ goto done;
++ }
++
++ spin_lock_irqsave(&vha->hw->hardware_lock, flags);
++ rc = __qlt_send_term_imm_notif(vha, imm);
++
++#if 0 /* Todo */
++ if (rc == -ENOMEM)
++ qlt_alloc_qfull_cmd(vha, imm, 0, 0);
++#endif
++
++done:
++ if (!ha_locked)
++ spin_unlock_irqrestore(&vha->hw->hardware_lock, flags);
++}
++
++/* If hardware_lock held on entry, might drop it, then reaquire */
++/* This function sends the appropriate CTIO to ISP 2xxx or 24xx */
+ static int __qlt_send_term_exchange(struct scsi_qla_host *vha,
+ struct qla_tgt_cmd *cmd,
+ struct atio_from_isp *atio)
+@@ -2794,6 +3071,24 @@ static void qlt_chk_exch_leak_thresh_hold(struct scsi_qla_host *vha)
+
+ }
+
++void qlt_abort_cmd(struct qla_tgt_cmd *cmd)
++{
++ struct qla_tgt *tgt = cmd->tgt;
++ struct scsi_qla_host *vha = tgt->vha;
++ struct se_cmd *se_cmd = &cmd->se_cmd;
++
++ ql_dbg(ql_dbg_tgt_mgt, vha, 0xf014,
++ "qla_target(%d): terminating exchange for aborted cmd=%p "
++ "(se_cmd=%p, tag=%llu)", vha->vp_idx, cmd, &cmd->se_cmd,
++ cmd->tag);
++
++ cmd->state = QLA_TGT_STATE_ABORTED;
++ cmd->cmd_flags |= BIT_6;
++
++ qlt_send_term_exchange(vha, cmd, &cmd->atio, 0);
++}
++EXPORT_SYMBOL(qlt_abort_cmd);
++
+ void qlt_free_cmd(struct qla_tgt_cmd *cmd)
+ {
+ struct qla_tgt_sess *sess = cmd->sess;
+@@ -3265,6 +3560,13 @@ static void __qlt_do_work(struct qla_tgt_cmd *cmd)
+ if (tgt->tgt_stop)
+ goto out_term;
+
++ if (cmd->state == QLA_TGT_STATE_ABORTED) {
++ ql_dbg(ql_dbg_tgt_mgt, vha, 0xf082,
++ "cmd with tag %u is aborted\n",
++ cmd->atio.u.isp24.exchange_addr);
++ goto out_term;
++ }
++
+ cdb = &atio->u.isp24.fcp_cmnd.cdb[0];
+ cmd->tag = atio->u.isp24.exchange_addr;
+ cmd->unpacked_lun = scsilun_to_int(
+@@ -3318,6 +3620,12 @@ out_term:
+ static void qlt_do_work(struct work_struct *work)
+ {
+ struct qla_tgt_cmd *cmd = container_of(work, struct qla_tgt_cmd, work);
++ scsi_qla_host_t *vha = cmd->vha;
++ unsigned long flags;
++
++ spin_lock_irqsave(&vha->cmd_list_lock, flags);
++ list_del(&cmd->cmd_list);
++ spin_unlock_irqrestore(&vha->cmd_list_lock, flags);
+
+ __qlt_do_work(cmd);
+ }
+@@ -3364,14 +3672,25 @@ static void qlt_create_sess_from_atio(struct work_struct *work)
+ unsigned long flags;
+ uint8_t *s_id = op->atio.u.isp24.fcp_hdr.s_id;
+
++ spin_lock_irqsave(&vha->cmd_list_lock, flags);
++ list_del(&op->cmd_list);
++ spin_unlock_irqrestore(&vha->cmd_list_lock, flags);
++
++ if (op->aborted) {
++ ql_dbg(ql_dbg_tgt_mgt, vha, 0xf083,
++ "sess_op with tag %u is aborted\n",
++ op->atio.u.isp24.exchange_addr);
++ goto out_term;
++ }
++
+ ql_dbg(ql_dbg_tgt_mgt, vha, 0xf022,
+- "qla_target(%d): Unable to find wwn login"
+- " (s_id %x:%x:%x), trying to create it manually\n",
+- vha->vp_idx, s_id[0], s_id[1], s_id[2]);
++ "qla_target(%d): Unable to find wwn login"
++ " (s_id %x:%x:%x), trying to create it manually\n",
++ vha->vp_idx, s_id[0], s_id[1], s_id[2]);
+
+ if (op->atio.u.raw.entry_count > 1) {
+ ql_dbg(ql_dbg_tgt_mgt, vha, 0xf023,
+- "Dropping multy entry atio %p\n", &op->atio);
++ "Dropping multy entry atio %p\n", &op->atio);
+ goto out_term;
+ }
+
+@@ -3436,10 +3755,25 @@ static int qlt_handle_cmd_for_atio(struct scsi_qla_host *vha,
+
+ memcpy(&op->atio, atio, sizeof(*atio));
+ op->vha = vha;
++
++ spin_lock(&vha->cmd_list_lock);
++ list_add_tail(&op->cmd_list, &vha->qla_sess_op_cmd_list);
++ spin_unlock(&vha->cmd_list_lock);
++
+ INIT_WORK(&op->work, qlt_create_sess_from_atio);
+ queue_work(qla_tgt_wq, &op->work);
+ return 0;
+ }
++
++ /* Another WWN used to have our s_id. Our PLOGI scheduled its
++ * session deletion, but it's still in sess_del_work wq */
++ if (sess->deleted == QLA_SESS_DELETION_IN_PROGRESS) {
++ ql_dbg(ql_dbg_io, vha, 0x3061,
++ "New command while old session %p is being deleted\n",
++ sess);
++ return -EFAULT;
++ }
++
+ /*
+ * Do kref_get() before returning + dropping qla_hw_data->hardware_lock.
+ */
+@@ -3460,6 +3794,11 @@ static int qlt_handle_cmd_for_atio(struct scsi_qla_host *vha,
+
+ cmd->cmd_in_wq = 1;
+ cmd->cmd_flags |= BIT_0;
++
++ spin_lock(&vha->cmd_list_lock);
++ list_add_tail(&cmd->cmd_list, &vha->qla_cmd_list);
++ spin_unlock(&vha->cmd_list_lock);
++
+ INIT_WORK(&cmd->work, qlt_do_work);
+ queue_work(qla_tgt_wq, &cmd->work);
+ return 0;
+@@ -3473,6 +3812,7 @@ static int qlt_issue_task_mgmt(struct qla_tgt_sess *sess, uint32_t lun,
+ struct scsi_qla_host *vha = sess->vha;
+ struct qla_hw_data *ha = vha->hw;
+ struct qla_tgt_mgmt_cmd *mcmd;
++ struct atio_from_isp *a = (struct atio_from_isp *)iocb;
+ int res;
+ uint8_t tmr_func;
+
+@@ -3513,6 +3853,7 @@ static int qlt_issue_task_mgmt(struct qla_tgt_sess *sess, uint32_t lun,
+ ql_dbg(ql_dbg_tgt_tmr, vha, 0x10002,
+ "qla_target(%d): LUN_RESET received\n", sess->vha->vp_idx);
+ tmr_func = TMR_LUN_RESET;
++ abort_cmds_for_lun(vha, lun, a->u.isp24.fcp_hdr.s_id);
+ break;
+
+ case QLA_TGT_CLEAR_TS:
+@@ -3601,6 +3942,9 @@ static int qlt_handle_task_mgmt(struct scsi_qla_host *vha, void *iocb)
+ sizeof(struct atio_from_isp));
+ }
+
++ if (sess->deleted == QLA_SESS_DELETION_IN_PROGRESS)
++ return -EFAULT;
++
+ return qlt_issue_task_mgmt(sess, unpacked_lun, fn, iocb, 0);
+ }
+
+@@ -3666,22 +4010,280 @@ static int qlt_abort_task(struct scsi_qla_host *vha,
+ return __qlt_abort_task(vha, iocb, sess);
+ }
+
++void qlt_logo_completion_handler(fc_port_t *fcport, int rc)
++{
++ if (fcport->tgt_session) {
++ if (rc != MBS_COMMAND_COMPLETE) {
++ ql_dbg(ql_dbg_tgt_mgt, fcport->vha, 0xf093,
++ "%s: se_sess %p / sess %p from"
++ " port %8phC loop_id %#04x s_id %02x:%02x:%02x"
++ " LOGO failed: %#x\n",
++ __func__,
++ fcport->tgt_session->se_sess,
++ fcport->tgt_session,
++ fcport->port_name, fcport->loop_id,
++ fcport->d_id.b.domain, fcport->d_id.b.area,
++ fcport->d_id.b.al_pa, rc);
++ }
++
++ fcport->tgt_session->logout_completed = 1;
++ }
++}
++
++static void qlt_swap_imm_ntfy_iocb(struct imm_ntfy_from_isp *a,
++ struct imm_ntfy_from_isp *b)
++{
++ struct imm_ntfy_from_isp tmp;
++ memcpy(&tmp, a, sizeof(struct imm_ntfy_from_isp));
++ memcpy(a, b, sizeof(struct imm_ntfy_from_isp));
++ memcpy(b, &tmp, sizeof(struct imm_ntfy_from_isp));
++}
++
++/*
++* ha->hardware_lock supposed to be held on entry (to protect tgt->sess_list)
++*
++* Schedules sessions with matching port_id/loop_id but different wwn for
++* deletion. Returns existing session with matching wwn if present.
++* Null otherwise.
++*/
++static struct qla_tgt_sess *
++qlt_find_sess_invalidate_other(struct qla_tgt *tgt, uint64_t wwn,
++ port_id_t port_id, uint16_t loop_id)
++{
++ struct qla_tgt_sess *sess = NULL, *other_sess;
++ uint64_t other_wwn;
++
++ list_for_each_entry(other_sess, &tgt->sess_list, sess_list_entry) {
++
++ other_wwn = wwn_to_u64(other_sess->port_name);
++
++ if (wwn == other_wwn) {
++ WARN_ON(sess);
++ sess = other_sess;
++ continue;
++ }
++
++ /* find other sess with nport_id collision */
++ if (port_id.b24 == other_sess->s_id.b24) {
++ if (loop_id != other_sess->loop_id) {
++ ql_dbg(ql_dbg_tgt_tmr, tgt->vha, 0x1000c,
++ "Invalidating sess %p loop_id %d wwn %llx.\n",
++ other_sess, other_sess->loop_id, other_wwn);
++
++ /*
++ * logout_on_delete is set by default, but another
++ * session that has the same s_id/loop_id combo
++ * might have cleared it when requested this session
++ * deletion, so don't touch it
++ */
++ qlt_schedule_sess_for_deletion(other_sess, true);
++ } else {
++ /*
++ * Another wwn used to have our s_id/loop_id
++ * combo - kill the session, but don't log out
++ */
++ sess->logout_on_delete = 0;
++ qlt_schedule_sess_for_deletion(other_sess,
++ true);
++ }
++ continue;
++ }
++
++ /* find other sess with nport handle collision */
++ if (loop_id == other_sess->loop_id) {
++ ql_dbg(ql_dbg_tgt_tmr, tgt->vha, 0x1000d,
++ "Invalidating sess %p loop_id %d wwn %llx.\n",
++ other_sess, other_sess->loop_id, other_wwn);
++
++ /* Same loop_id but different s_id
++ * Ok to kill and logout */
++ qlt_schedule_sess_for_deletion(other_sess, true);
++ }
++ }
++
++ return sess;
++}
++
++/* Abort any commands for this s_id waiting on qla_tgt_wq workqueue */
++static int abort_cmds_for_s_id(struct scsi_qla_host *vha, port_id_t *s_id)
++{
++ struct qla_tgt_sess_op *op;
++ struct qla_tgt_cmd *cmd;
++ uint32_t key;
++ int count = 0;
++
++ key = (((u32)s_id->b.domain << 16) |
++ ((u32)s_id->b.area << 8) |
++ ((u32)s_id->b.al_pa));
++
++ spin_lock(&vha->cmd_list_lock);
++ list_for_each_entry(op, &vha->qla_sess_op_cmd_list, cmd_list) {
++ uint32_t op_key = sid_to_key(op->atio.u.isp24.fcp_hdr.s_id);
++ if (op_key == key) {
++ op->aborted = true;
++ count++;
++ }
++ }
++ list_for_each_entry(cmd, &vha->qla_cmd_list, cmd_list) {
++ uint32_t cmd_key = sid_to_key(cmd->atio.u.isp24.fcp_hdr.s_id);
++ if (cmd_key == key) {
++ cmd->state = QLA_TGT_STATE_ABORTED;
++ count++;
++ }
++ }
++ spin_unlock(&vha->cmd_list_lock);
++
++ return count;
++}
++
+ /*
+ * ha->hardware_lock supposed to be held on entry. Might drop it, then reaquire
+ */
+ static int qlt_24xx_handle_els(struct scsi_qla_host *vha,
+ struct imm_ntfy_from_isp *iocb)
+ {
++ struct qla_tgt *tgt = vha->vha_tgt.qla_tgt;
++ struct qla_hw_data *ha = vha->hw;
++ struct qla_tgt_sess *sess = NULL;
++ uint64_t wwn;
++ port_id_t port_id;
++ uint16_t loop_id;
++ uint16_t wd3_lo;
+ int res = 0;
+
++ wwn = wwn_to_u64(iocb->u.isp24.port_name);
++
++ port_id.b.domain = iocb->u.isp24.port_id[2];
++ port_id.b.area = iocb->u.isp24.port_id[1];
++ port_id.b.al_pa = iocb->u.isp24.port_id[0];
++ port_id.b.rsvd_1 = 0;
++
++ loop_id = le16_to_cpu(iocb->u.isp24.nport_handle);
++
+ ql_dbg(ql_dbg_tgt_mgt, vha, 0xf026,
+ "qla_target(%d): Port ID: 0x%3phC ELS opcode: 0x%02x\n",
+ vha->vp_idx, iocb->u.isp24.port_id, iocb->u.isp24.status_subcode);
+
++ /* res = 1 means ack at the end of thread
++ * res = 0 means ack async/later.
++ */
+ switch (iocb->u.isp24.status_subcode) {
+ case ELS_PLOGI:
+- case ELS_FLOGI:
++
++ /* Mark all stale commands in qla_tgt_wq for deletion */
++ abort_cmds_for_s_id(vha, &port_id);
++
++ if (wwn)
++ sess = qlt_find_sess_invalidate_other(tgt, wwn,
++ port_id, loop_id);
++
++ if (!sess || IS_SW_RESV_ADDR(sess->s_id)) {
++ res = 1;
++ break;
++ }
++
++ if (sess->plogi_ack_needed) {
++ /*
++ * Initiator sent another PLOGI before last PLOGI could
++ * finish. Swap plogi iocbs and terminate old one
++ * without acking, new one will get acked when session
++ * deletion completes.
++ */
++ ql_log(ql_log_warn, sess->vha, 0xf094,
++ "sess %p received double plogi.\n", sess);
++
++ qlt_swap_imm_ntfy_iocb(iocb, &sess->tm_iocb);
++
++ qlt_send_term_imm_notif(vha, iocb, 1);
++
++ res = 0;
++ break;
++ }
++
++ res = 0;
++
++ /*
++ * Save immediate Notif IOCB for Ack when sess is done
++ * and being deleted.
++ */
++ memcpy(&sess->tm_iocb, iocb, sizeof(sess->tm_iocb));
++ sess->plogi_ack_needed = 1;
++
++ /*
++ * Under normal circumstances we want to release nport handle
++ * during LOGO process to avoid nport handle leaks inside FW.
++ * The exception is when LOGO is done while another PLOGI with
++ * the same nport handle is waiting as might be the case here.
++ * Note: there is always a possibily of a race where session
++ * deletion has already started for other reasons (e.g. ACL
++ * removal) and now PLOGI arrives:
++ * 1. if PLOGI arrived in FW after nport handle has been freed,
++ * FW must have assigned this PLOGI a new/same handle and we
++ * can proceed ACK'ing it as usual when session deletion
++ * completes.
++ * 2. if PLOGI arrived in FW before LOGO with LCF_FREE_NPORT
++ * bit reached it, the handle has now been released. We'll
++ * get an error when we ACK this PLOGI. Nothing will be sent
++ * back to initiator. Initiator should eventually retry
++ * PLOGI and situation will correct itself.
++ */
++ sess->keep_nport_handle = ((sess->loop_id == loop_id) &&
++ (sess->s_id.b24 == port_id.b24));
++ qlt_schedule_sess_for_deletion(sess, true);
++ break;
++
+ case ELS_PRLI:
++ wd3_lo = le16_to_cpu(iocb->u.isp24.u.prli.wd3_lo);
++
++ if (wwn)
++ sess = qlt_find_sess_invalidate_other(tgt, wwn, port_id,
++ loop_id);
++
++ if (sess != NULL) {
++ if (sess->deleted) {
++ /*
++ * Impatient initiator sent PRLI before last
++ * PLOGI could finish. Will force him to re-try,
++ * while last one finishes.
++ */
++ ql_log(ql_log_warn, sess->vha, 0xf095,
++ "sess %p PRLI received, before plogi ack.\n",
++ sess);
++ qlt_send_term_imm_notif(vha, iocb, 1);
++ res = 0;
++ break;
++ }
++
++ /*
++ * This shouldn't happen under normal circumstances,
++ * since we have deleted the old session during PLOGI
++ */
++ ql_dbg(ql_dbg_tgt_mgt, vha, 0xf096,
++ "PRLI (loop_id %#04x) for existing sess %p (loop_id %#04x)\n",
++ sess->loop_id, sess, iocb->u.isp24.nport_handle);
++
++ sess->local = 0;
++ sess->loop_id = loop_id;
++ sess->s_id = port_id;
++
++ if (wd3_lo & BIT_7)
++ sess->conf_compl_supported = 1;
++
++ }
++ res = 1; /* send notify ack */
++
++ /* Make session global (not used in fabric mode) */
++ if (ha->current_topology != ISP_CFG_F) {
++ set_bit(LOOP_RESYNC_NEEDED, &vha->dpc_flags);
++ set_bit(LOCAL_LOOP_UPDATE, &vha->dpc_flags);
++ qla2xxx_wake_dpc(vha);
++ } else {
++ /* todo: else - create sess here. */
++ res = 1; /* send notify ack */
++ }
++
++ break;
++
+ case ELS_LOGO:
+ case ELS_PRLO:
+ res = qlt_reset(vha, iocb, QLA_TGT_NEXUS_LOSS_SESS);
+@@ -3699,6 +4301,7 @@ static int qlt_24xx_handle_els(struct scsi_qla_host *vha,
+ break;
+ }
+
++ case ELS_FLOGI: /* should never happen */
+ default:
+ ql_dbg(ql_dbg_tgt_mgt, vha, 0xf061,
+ "qla_target(%d): Unsupported ELS command %x "
+@@ -5016,6 +5619,11 @@ static void qlt_abort_work(struct qla_tgt *tgt,
+ if (!sess)
+ goto out_term;
+ } else {
++ if (sess->deleted == QLA_SESS_DELETION_IN_PROGRESS) {
++ sess = NULL;
++ goto out_term;
++ }
++
+ kref_get(&sess->se_sess->sess_kref);
+ }
+
+@@ -5070,6 +5678,11 @@ static void qlt_tmr_work(struct qla_tgt *tgt,
+ if (!sess)
+ goto out_term;
+ } else {
++ if (sess->deleted == QLA_SESS_DELETION_IN_PROGRESS) {
++ sess = NULL;
++ goto out_term;
++ }
++
+ kref_get(&sess->se_sess->sess_kref);
+ }
+
+diff --git a/drivers/scsi/qla2xxx/qla_target.h b/drivers/scsi/qla2xxx/qla_target.h
+index 332086776dfe..d30c60a1d522 100644
+--- a/drivers/scsi/qla2xxx/qla_target.h
++++ b/drivers/scsi/qla2xxx/qla_target.h
+@@ -167,7 +167,24 @@ struct imm_ntfy_from_isp {
+ uint32_t srr_rel_offs;
+ uint16_t srr_ui;
+ uint16_t srr_ox_id;
+- uint8_t reserved_4[19];
++ union {
++ struct {
++ uint8_t node_name[8];
++ } plogi; /* PLOGI/ADISC/PDISC */
++ struct {
++ /* PRLI word 3 bit 0-15 */
++ uint16_t wd3_lo;
++ uint8_t resv0[6];
++ } prli;
++ struct {
++ uint8_t port_id[3];
++ uint8_t resv1;
++ uint16_t nport_handle;
++ uint16_t resv2;
++ } req_els;
++ } u;
++ uint8_t port_name[8];
++ uint8_t resv3[3];
+ uint8_t vp_index;
+ uint32_t reserved_5;
+ uint8_t port_id[3];
+@@ -234,6 +251,7 @@ struct nack_to_isp {
+ uint8_t reserved[2];
+ uint16_t ox_id;
+ } __packed;
++#define NOTIFY_ACK_FLAGS_TERMINATE BIT_3
+ #define NOTIFY_ACK_SRR_FLAGS_ACCEPT 0
+ #define NOTIFY_ACK_SRR_FLAGS_REJECT 1
+
+@@ -790,13 +808,6 @@ int qla2x00_wait_for_hba_online(struct scsi_qla_host *);
+ #define FC_TM_REJECT 4
+ #define FC_TM_FAILED 5
+
+-/*
+- * Error code of qlt_pre_xmit_response() meaning that cmd's exchange was
+- * terminated, so no more actions is needed and success should be returned
+- * to target.
+- */
+-#define QLA_TGT_PRE_XMIT_RESP_CMD_ABORTED 0x1717
+-
+ #if (BITS_PER_LONG > 32) || defined(CONFIG_HIGHMEM64G)
+ #define pci_dma_lo32(a) (a & 0xffffffff)
+ #define pci_dma_hi32(a) ((((a) >> 16)>>16) & 0xffffffff)
+@@ -874,6 +885,15 @@ struct qla_tgt_sess_op {
+ struct scsi_qla_host *vha;
+ struct atio_from_isp atio;
+ struct work_struct work;
++ struct list_head cmd_list;
++ bool aborted;
++};
++
++enum qla_sess_deletion {
++ QLA_SESS_DELETION_NONE = 0,
++ QLA_SESS_DELETION_PENDING = 1, /* hopefully we can get rid of
++ * this one */
++ QLA_SESS_DELETION_IN_PROGRESS = 2,
+ };
+
+ /*
+@@ -884,8 +904,15 @@ struct qla_tgt_sess {
+ port_id_t s_id;
+
+ unsigned int conf_compl_supported:1;
+- unsigned int deleted:1;
++ unsigned int deleted:2;
+ unsigned int local:1;
++ unsigned int logout_on_delete:1;
++ unsigned int plogi_ack_needed:1;
++ unsigned int keep_nport_handle:1;
++
++ unsigned char logout_completed;
++
++ int generation;
+
+ struct se_session *se_sess;
+ struct scsi_qla_host *vha;
+@@ -897,6 +924,10 @@ struct qla_tgt_sess {
+
+ uint8_t port_name[WWN_SIZE];
+ struct work_struct free_work;
++
++ union {
++ struct imm_ntfy_from_isp tm_iocb;
++ };
+ };
+
+ struct qla_tgt_cmd {
+@@ -912,7 +943,6 @@ struct qla_tgt_cmd {
+ unsigned int conf_compl_supported:1;
+ unsigned int sg_mapped:1;
+ unsigned int free_sg:1;
+- unsigned int aborted:1; /* Needed in case of SRR */
+ unsigned int write_data_transferred:1;
+ unsigned int ctx_dsd_alloced:1;
+ unsigned int q_full:1;
+@@ -1027,6 +1057,10 @@ struct qla_tgt_srr_ctio {
+ struct qla_tgt_cmd *cmd;
+ };
+
++/* Check for Switch reserved address */
++#define IS_SW_RESV_ADDR(_s_id) \
++ ((_s_id.b.domain == 0xff) && (_s_id.b.area == 0xfc))
++
+ #define QLA_TGT_XMIT_DATA 1
+ #define QLA_TGT_XMIT_STATUS 2
+ #define QLA_TGT_XMIT_ALL (QLA_TGT_XMIT_STATUS|QLA_TGT_XMIT_DATA)
+@@ -1044,7 +1078,7 @@ extern int qlt_lport_register(void *, u64, u64, u64,
+ extern void qlt_lport_deregister(struct scsi_qla_host *);
+ extern void qlt_unreg_sess(struct qla_tgt_sess *);
+ extern void qlt_fc_port_added(struct scsi_qla_host *, fc_port_t *);
+-extern void qlt_fc_port_deleted(struct scsi_qla_host *, fc_port_t *);
++extern void qlt_fc_port_deleted(struct scsi_qla_host *, fc_port_t *, int);
+ extern int __init qlt_init(void);
+ extern void qlt_exit(void);
+ extern void qlt_update_vp_map(struct scsi_qla_host *, int);
+@@ -1074,12 +1108,23 @@ static inline void qla_reverse_ini_mode(struct scsi_qla_host *ha)
+ ha->host->active_mode |= MODE_INITIATOR;
+ }
+
++static inline uint32_t sid_to_key(const uint8_t *s_id)
++{
++ uint32_t key;
++
++ key = (((unsigned long)s_id[0] << 16) |
++ ((unsigned long)s_id[1] << 8) |
++ (unsigned long)s_id[2]);
++ return key;
++}
++
+ /*
+ * Exported symbols from qla_target.c LLD logic used by qla2xxx code..
+ */
+ extern void qlt_response_pkt_all_vps(struct scsi_qla_host *, response_t *);
+ extern int qlt_rdy_to_xfer(struct qla_tgt_cmd *);
+ extern int qlt_xmit_response(struct qla_tgt_cmd *, int, uint8_t);
++extern void qlt_abort_cmd(struct qla_tgt_cmd *);
+ extern void qlt_xmit_tm_rsp(struct qla_tgt_mgmt_cmd *);
+ extern void qlt_free_mcmd(struct qla_tgt_mgmt_cmd *);
+ extern void qlt_free_cmd(struct qla_tgt_cmd *cmd);
+@@ -1110,5 +1155,7 @@ extern void qlt_stop_phase2(struct qla_tgt *);
+ extern irqreturn_t qla83xx_msix_atio_q(int, void *);
+ extern void qlt_83xx_iospace_config(struct qla_hw_data *);
+ extern int qlt_free_qfull_cmds(struct scsi_qla_host *);
++extern void qlt_logo_completion_handler(fc_port_t *, int);
++extern void qlt_do_generation_tick(struct scsi_qla_host *, int *);
+
+ #endif /* __QLA_TARGET_H */
+diff --git a/drivers/scsi/qla2xxx/qla_tmpl.c b/drivers/scsi/qla2xxx/qla_tmpl.c
+index a8c0c7362e48..de46cb370bdc 100644
+--- a/drivers/scsi/qla2xxx/qla_tmpl.c
++++ b/drivers/scsi/qla2xxx/qla_tmpl.c
+@@ -393,6 +393,10 @@ qla27xx_fwdt_entry_t263(struct scsi_qla_host *vha,
+ if (ent->t263.queue_type == T263_QUEUE_TYPE_REQ) {
+ for (i = 0; i < vha->hw->max_req_queues; i++) {
+ struct req_que *req = vha->hw->req_q_map[i];
++
++ if (!test_bit(i, vha->hw->req_qid_map))
++ continue;
++
+ if (req || !buf) {
+ length = req ?
+ req->length : REQUEST_ENTRY_CNT_24XX;
+@@ -406,6 +410,10 @@ qla27xx_fwdt_entry_t263(struct scsi_qla_host *vha,
+ } else if (ent->t263.queue_type == T263_QUEUE_TYPE_RSP) {
+ for (i = 0; i < vha->hw->max_rsp_queues; i++) {
+ struct rsp_que *rsp = vha->hw->rsp_q_map[i];
++
++ if (!test_bit(i, vha->hw->rsp_qid_map))
++ continue;
++
+ if (rsp || !buf) {
+ length = rsp ?
+ rsp->length : RESPONSE_ENTRY_CNT_MQ;
+@@ -632,6 +640,10 @@ qla27xx_fwdt_entry_t274(struct scsi_qla_host *vha,
+ if (ent->t274.queue_type == T274_QUEUE_TYPE_REQ_SHAD) {
+ for (i = 0; i < vha->hw->max_req_queues; i++) {
+ struct req_que *req = vha->hw->req_q_map[i];
++
++ if (!test_bit(i, vha->hw->req_qid_map))
++ continue;
++
+ if (req || !buf) {
+ qla27xx_insert16(i, buf, len);
+ qla27xx_insert16(1, buf, len);
+@@ -643,6 +655,10 @@ qla27xx_fwdt_entry_t274(struct scsi_qla_host *vha,
+ } else if (ent->t274.queue_type == T274_QUEUE_TYPE_RSP_SHAD) {
+ for (i = 0; i < vha->hw->max_rsp_queues; i++) {
+ struct rsp_que *rsp = vha->hw->rsp_q_map[i];
++
++ if (!test_bit(i, vha->hw->rsp_qid_map))
++ continue;
++
+ if (rsp || !buf) {
+ qla27xx_insert16(i, buf, len);
+ qla27xx_insert16(1, buf, len);
+diff --git a/drivers/scsi/qla2xxx/tcm_qla2xxx.c b/drivers/scsi/qla2xxx/tcm_qla2xxx.c
+index 272a2646a759..c763ca597a83 100644
+--- a/drivers/scsi/qla2xxx/tcm_qla2xxx.c
++++ b/drivers/scsi/qla2xxx/tcm_qla2xxx.c
+@@ -422,7 +422,7 @@ static int tcm_qla2xxx_check_stop_free(struct se_cmd *se_cmd)
+ cmd->cmd_flags |= BIT_14;
+ }
+
+- return target_put_sess_cmd(se_cmd->se_sess, se_cmd);
++ return target_put_sess_cmd(se_cmd);
+ }
+
+ /* tcm_qla2xxx_release_cmd - Callback from TCM Core to release underlying
+@@ -662,7 +662,6 @@ static int tcm_qla2xxx_queue_data_in(struct se_cmd *se_cmd)
+ cmd->cmd_flags |= BIT_4;
+ cmd->bufflen = se_cmd->data_length;
+ cmd->dma_data_direction = target_reverse_dma_direction(se_cmd);
+- cmd->aborted = (se_cmd->transport_state & CMD_T_ABORTED);
+
+ cmd->sg_cnt = se_cmd->t_data_nents;
+ cmd->sg = se_cmd->t_data_sg;
+@@ -692,7 +691,6 @@ static int tcm_qla2xxx_queue_status(struct se_cmd *se_cmd)
+ cmd->sg_cnt = 0;
+ cmd->offset = 0;
+ cmd->dma_data_direction = target_reverse_dma_direction(se_cmd);
+- cmd->aborted = (se_cmd->transport_state & CMD_T_ABORTED);
+ if (cmd->cmd_flags & BIT_5) {
+ pr_crit("Bit_5 already set for cmd = %p.\n", cmd);
+ dump_stack();
+@@ -757,14 +755,7 @@ static void tcm_qla2xxx_aborted_task(struct se_cmd *se_cmd)
+ {
+ struct qla_tgt_cmd *cmd = container_of(se_cmd,
+ struct qla_tgt_cmd, se_cmd);
+- struct scsi_qla_host *vha = cmd->vha;
+- struct qla_hw_data *ha = vha->hw;
+-
+- if (!cmd->sg_mapped)
+- return;
+-
+- pci_unmap_sg(ha->pdev, cmd->sg, cmd->sg_cnt, cmd->dma_data_direction);
+- cmd->sg_mapped = 0;
++ qlt_abort_cmd(cmd);
+ }
+
+ static void tcm_qla2xxx_clear_sess_lookup(struct tcm_qla2xxx_lport *,
+@@ -1273,9 +1264,7 @@ static struct qla_tgt_sess *tcm_qla2xxx_find_sess_by_s_id(
+ return NULL;
+ }
+
+- key = (((unsigned long)s_id[0] << 16) |
+- ((unsigned long)s_id[1] << 8) |
+- (unsigned long)s_id[2]);
++ key = sid_to_key(s_id);
+ pr_debug("find_sess_by_s_id: 0x%06x\n", key);
+
+ se_nacl = btree_lookup32(&lport->lport_fcport_map, key);
+@@ -1310,9 +1299,7 @@ static void tcm_qla2xxx_set_sess_by_s_id(
+ void *slot;
+ int rc;
+
+- key = (((unsigned long)s_id[0] << 16) |
+- ((unsigned long)s_id[1] << 8) |
+- (unsigned long)s_id[2]);
++ key = sid_to_key(s_id);
+ pr_debug("set_sess_by_s_id: %06x\n", key);
+
+ slot = btree_lookup32(&lport->lport_fcport_map, key);
+@@ -1670,6 +1657,10 @@ static void tcm_qla2xxx_update_sess(struct qla_tgt_sess *sess, port_id_t s_id,
+ }
+
+ sess->conf_compl_supported = conf_compl_supported;
++
++ /* Reset logout parameters to default */
++ sess->logout_on_delete = 1;
++ sess->keep_nport_handle = 0;
+ }
+
+ /*
+diff --git a/drivers/scsi/scsi_devinfo.c b/drivers/scsi/scsi_devinfo.c
+index 9f77d23239a2..6e2256f7d7d6 100644
+--- a/drivers/scsi/scsi_devinfo.c
++++ b/drivers/scsi/scsi_devinfo.c
+@@ -205,6 +205,7 @@ static struct {
+ {"Intel", "Multi-Flex", NULL, BLIST_NO_RSOC},
+ {"iRiver", "iFP Mass Driver", NULL, BLIST_NOT_LOCKABLE | BLIST_INQUIRY_36},
+ {"LASOUND", "CDX7405", "3.10", BLIST_MAX5LUN | BLIST_SINGLELUN},
++ {"Marvell", "Console", NULL, BLIST_SKIP_VPD_PAGES},
+ {"MATSHITA", "PD-1", NULL, BLIST_FORCELUN | BLIST_SINGLELUN},
+ {"MATSHITA", "DMC-LC5", NULL, BLIST_NOT_LOCKABLE | BLIST_INQUIRY_36},
+ {"MATSHITA", "DMC-LC40", NULL, BLIST_NOT_LOCKABLE | BLIST_INQUIRY_36},
+diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
+index 062633295bc2..958c732c428e 100644
+--- a/drivers/target/iscsi/iscsi_target.c
++++ b/drivers/target/iscsi/iscsi_target.c
+@@ -704,7 +704,7 @@ static int iscsit_add_reject_from_cmd(
+ */
+ if (cmd->se_cmd.se_tfo != NULL) {
+ pr_debug("iscsi reject: calling target_put_sess_cmd >>>>>>\n");
+- target_put_sess_cmd(conn->sess->se_sess, &cmd->se_cmd);
++ target_put_sess_cmd(&cmd->se_cmd);
+ }
+ return -1;
+ }
+@@ -994,7 +994,7 @@ int iscsit_setup_scsi_cmd(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
+ hdr->cmdsn, be32_to_cpu(hdr->data_length), payload_length,
+ conn->cid);
+
+- target_get_sess_cmd(conn->sess->se_sess, &cmd->se_cmd, true);
++ target_get_sess_cmd(&cmd->se_cmd, true);
+
+ cmd->sense_reason = transport_lookup_cmd_lun(&cmd->se_cmd,
+ scsilun_to_int(&hdr->lun));
+@@ -1060,7 +1060,7 @@ int iscsit_process_scsi_cmd(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
+ if (cmdsn_ret == CMDSN_ERROR_CANNOT_RECOVER)
+ return -1;
+ else if (cmdsn_ret == CMDSN_LOWER_THAN_EXP) {
+- target_put_sess_cmd(conn->sess->se_sess, &cmd->se_cmd);
++ target_put_sess_cmd(&cmd->se_cmd);
+ return 0;
+ }
+ }
+@@ -1076,7 +1076,7 @@ int iscsit_process_scsi_cmd(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
+ if (!cmd->sense_reason)
+ return 0;
+
+- target_put_sess_cmd(conn->sess->se_sess, &cmd->se_cmd);
++ target_put_sess_cmd(&cmd->se_cmd);
+ return 0;
+ }
+
+@@ -1107,7 +1107,6 @@ static int
+ iscsit_get_immediate_data(struct iscsi_cmd *cmd, struct iscsi_scsi_req *hdr,
+ bool dump_payload)
+ {
+- struct iscsi_conn *conn = cmd->conn;
+ int cmdsn_ret = 0, immed_ret = IMMEDIATE_DATA_NORMAL_OPERATION;
+ /*
+ * Special case for Unsupported SAM WRITE Opcodes and ImmediateData=Yes.
+@@ -1134,7 +1133,7 @@ after_immediate_data:
+
+ rc = iscsit_dump_data_payload(cmd->conn,
+ cmd->first_burst_len, 1);
+- target_put_sess_cmd(conn->sess->se_sess, &cmd->se_cmd);
++ target_put_sess_cmd(&cmd->se_cmd);
+ return rc;
+ } else if (cmd->unsolicited_data)
+ iscsit_set_unsoliticed_dataout(cmd);
+@@ -1804,7 +1803,7 @@ iscsit_handle_task_mgt_cmd(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
+ conn->sess->se_sess, 0, DMA_NONE,
+ MSG_SIMPLE_TAG, cmd->sense_buffer + 2);
+
+- target_get_sess_cmd(conn->sess->se_sess, &cmd->se_cmd, true);
++ target_get_sess_cmd(&cmd->se_cmd, true);
+ sess_ref = true;
+
+ switch (function) {
+@@ -1946,7 +1945,7 @@ attach:
+ */
+ if (sess_ref) {
+ pr_debug("Handle TMR, using sess_ref=true check\n");
+- target_put_sess_cmd(conn->sess->se_sess, &cmd->se_cmd);
++ target_put_sess_cmd(&cmd->se_cmd);
+ }
+
+ iscsit_add_cmd_to_response_queue(cmd, conn, cmd->i_state);
+diff --git a/drivers/target/iscsi/iscsi_target_configfs.c b/drivers/target/iscsi/iscsi_target_configfs.c
+index 80a1a4fbede0..bf8c6e446b68 100644
+--- a/drivers/target/iscsi/iscsi_target_configfs.c
++++ b/drivers/target/iscsi/iscsi_target_configfs.c
+@@ -1961,7 +1961,7 @@ static void lio_set_default_node_attributes(struct se_node_acl *se_acl)
+
+ static int lio_check_stop_free(struct se_cmd *se_cmd)
+ {
+- return target_put_sess_cmd(se_cmd->se_sess, se_cmd);
++ return target_put_sess_cmd(se_cmd);
+ }
+
+ static void lio_release_cmd(struct se_cmd *se_cmd)
+diff --git a/drivers/target/iscsi/iscsi_target_util.c b/drivers/target/iscsi/iscsi_target_util.c
+index 0b68c2ebce95..9062bdaf26ae 100644
+--- a/drivers/target/iscsi/iscsi_target_util.c
++++ b/drivers/target/iscsi/iscsi_target_util.c
+@@ -746,7 +746,7 @@ void iscsit_free_cmd(struct iscsi_cmd *cmd, bool shutdown)
+ rc = transport_generic_free_cmd(&cmd->se_cmd, shutdown);
+ if (!rc && shutdown && se_cmd && se_cmd->se_sess) {
+ __iscsit_free_cmd(cmd, true, shutdown);
+- target_put_sess_cmd(se_cmd->se_sess, se_cmd);
++ target_put_sess_cmd(se_cmd);
+ }
+ break;
+ case ISCSI_OP_REJECT:
+@@ -762,7 +762,7 @@ void iscsit_free_cmd(struct iscsi_cmd *cmd, bool shutdown)
+ rc = transport_generic_free_cmd(&cmd->se_cmd, shutdown);
+ if (!rc && shutdown && se_cmd->se_sess) {
+ __iscsit_free_cmd(cmd, true, shutdown);
+- target_put_sess_cmd(se_cmd->se_sess, se_cmd);
++ target_put_sess_cmd(se_cmd);
+ }
+ break;
+ }
+diff --git a/drivers/target/target_core_tmr.c b/drivers/target/target_core_tmr.c
+index fa5e157db47b..383074723fde 100644
+--- a/drivers/target/target_core_tmr.c
++++ b/drivers/target/target_core_tmr.c
+@@ -71,7 +71,7 @@ void core_tmr_release_req(struct se_tmr_req *tmr)
+
+ if (dev) {
+ spin_lock_irqsave(&dev->se_tmr_lock, flags);
+- list_del(&tmr->tmr_list);
++ list_del_init(&tmr->tmr_list);
+ spin_unlock_irqrestore(&dev->se_tmr_lock, flags);
+ }
+
+@@ -153,7 +153,7 @@ void core_tmr_abort_task(
+ cancel_work_sync(&se_cmd->work);
+ transport_wait_for_tasks(se_cmd);
+
+- target_put_sess_cmd(se_sess, se_cmd);
++ target_put_sess_cmd(se_cmd);
+ transport_cmd_finish_abort(se_cmd, true);
+
+ printk("ABORT_TASK: Sending TMR_FUNCTION_COMPLETE for"
+@@ -175,9 +175,11 @@ static void core_tmr_drain_tmr_list(
+ struct list_head *preempt_and_abort_list)
+ {
+ LIST_HEAD(drain_tmr_list);
++ struct se_session *sess;
+ struct se_tmr_req *tmr_p, *tmr_pp;
+ struct se_cmd *cmd;
+ unsigned long flags;
++ bool rc;
+ /*
+ * Release all pending and outgoing TMRs aside from the received
+ * LUN_RESET tmr..
+@@ -203,17 +205,31 @@ static void core_tmr_drain_tmr_list(
+ if (target_check_cdb_and_preempt(preempt_and_abort_list, cmd))
+ continue;
+
++ sess = cmd->se_sess;
++ if (WARN_ON_ONCE(!sess))
++ continue;
++
++ spin_lock(&sess->sess_cmd_lock);
+ spin_lock(&cmd->t_state_lock);
+ if (!(cmd->transport_state & CMD_T_ACTIVE)) {
+ spin_unlock(&cmd->t_state_lock);
++ spin_unlock(&sess->sess_cmd_lock);
+ continue;
+ }
+ if (cmd->t_state == TRANSPORT_ISTATE_PROCESSING) {
+ spin_unlock(&cmd->t_state_lock);
++ spin_unlock(&sess->sess_cmd_lock);
+ continue;
+ }
++ cmd->transport_state |= CMD_T_ABORTED;
+ spin_unlock(&cmd->t_state_lock);
+
++ rc = kref_get_unless_zero(&cmd->cmd_kref);
++ spin_unlock(&sess->sess_cmd_lock);
++ if (!rc) {
++ printk("LUN_RESET TMR: non-zero kref_get_unless_zero\n");
++ continue;
++ }
+ list_move_tail(&tmr_p->tmr_list, &drain_tmr_list);
+ }
+ spin_unlock_irqrestore(&dev->se_tmr_lock, flags);
+@@ -227,7 +243,11 @@ static void core_tmr_drain_tmr_list(
+ (preempt_and_abort_list) ? "Preempt" : "", tmr_p,
+ tmr_p->function, tmr_p->response, cmd->t_state);
+
++ cancel_work_sync(&cmd->work);
++ transport_wait_for_tasks(cmd);
++
+ transport_cmd_finish_abort(cmd, 1);
++ target_put_sess_cmd(cmd);
+ }
+ }
+
+diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
+index e786e9104c41..adf96b78e9f0 100644
+--- a/drivers/target/target_core_transport.c
++++ b/drivers/target/target_core_transport.c
+@@ -1379,7 +1379,7 @@ int target_submit_cmd_map_sgls(struct se_cmd *se_cmd, struct se_session *se_sess
+ * for fabrics using TARGET_SCF_ACK_KREF that expect a second
+ * kref_put() to happen during fabric packet acknowledgement.
+ */
+- ret = target_get_sess_cmd(se_sess, se_cmd, (flags & TARGET_SCF_ACK_KREF));
++ ret = target_get_sess_cmd(se_cmd, flags & TARGET_SCF_ACK_KREF);
+ if (ret)
+ return ret;
+ /*
+@@ -1393,7 +1393,7 @@ int target_submit_cmd_map_sgls(struct se_cmd *se_cmd, struct se_session *se_sess
+ rc = transport_lookup_cmd_lun(se_cmd, unpacked_lun);
+ if (rc) {
+ transport_send_check_condition_and_sense(se_cmd, rc, 0);
+- target_put_sess_cmd(se_sess, se_cmd);
++ target_put_sess_cmd(se_cmd);
+ return 0;
+ }
+
+@@ -1544,7 +1544,7 @@ int target_submit_tmr(struct se_cmd *se_cmd, struct se_session *se_sess,
+ se_cmd->se_tmr_req->ref_task_tag = tag;
+
+ /* See target_submit_cmd for commentary */
+- ret = target_get_sess_cmd(se_sess, se_cmd, (flags & TARGET_SCF_ACK_KREF));
++ ret = target_get_sess_cmd(se_cmd, flags & TARGET_SCF_ACK_KREF);
+ if (ret) {
+ core_tmr_release_req(se_cmd->se_tmr_req);
+ return ret;
+@@ -2146,7 +2146,7 @@ static int transport_release_cmd(struct se_cmd *cmd)
+ * If this cmd has been setup with target_get_sess_cmd(), drop
+ * the kref and call ->release_cmd() in kref callback.
+ */
+- return target_put_sess_cmd(cmd->se_sess, cmd);
++ return target_put_sess_cmd(cmd);
+ }
+
+ /**
+@@ -2390,13 +2390,12 @@ int transport_generic_free_cmd(struct se_cmd *cmd, int wait_for_tasks)
+ EXPORT_SYMBOL(transport_generic_free_cmd);
+
+ /* target_get_sess_cmd - Add command to active ->sess_cmd_list
+- * @se_sess: session to reference
+ * @se_cmd: command descriptor to add
+ * @ack_kref: Signal that fabric will perform an ack target_put_sess_cmd()
+ */
+-int target_get_sess_cmd(struct se_session *se_sess, struct se_cmd *se_cmd,
+- bool ack_kref)
++int target_get_sess_cmd(struct se_cmd *se_cmd, bool ack_kref)
+ {
++ struct se_session *se_sess = se_cmd->se_sess;
+ unsigned long flags;
+ int ret = 0;
+
+@@ -2420,7 +2419,7 @@ out:
+ spin_unlock_irqrestore(&se_sess->sess_cmd_lock, flags);
+
+ if (ret && ack_kref)
+- target_put_sess_cmd(se_sess, se_cmd);
++ target_put_sess_cmd(se_cmd);
+
+ return ret;
+ }
+@@ -2448,11 +2447,12 @@ static void target_release_cmd_kref(struct kref *kref)
+ }
+
+ /* target_put_sess_cmd - Check for active I/O shutdown via kref_put
+- * @se_sess: session to reference
+ * @se_cmd: command descriptor to drop
+ */
+-int target_put_sess_cmd(struct se_session *se_sess, struct se_cmd *se_cmd)
++int target_put_sess_cmd(struct se_cmd *se_cmd)
+ {
++ struct se_session *se_sess = se_cmd->se_sess;
++
+ if (!se_sess) {
+ se_cmd->se_tfo->release_cmd(se_cmd);
+ return 1;
+@@ -2945,8 +2945,17 @@ static void target_tmr_work(struct work_struct *work)
+ struct se_cmd *cmd = container_of(work, struct se_cmd, work);
+ struct se_device *dev = cmd->se_dev;
+ struct se_tmr_req *tmr = cmd->se_tmr_req;
++ unsigned long flags;
+ int ret;
+
++ spin_lock_irqsave(&cmd->t_state_lock, flags);
++ if (cmd->transport_state & CMD_T_ABORTED) {
++ tmr->response = TMR_FUNCTION_REJECTED;
++ spin_unlock_irqrestore(&cmd->t_state_lock, flags);
++ goto check_stop;
++ }
++ spin_unlock_irqrestore(&cmd->t_state_lock, flags);
++
+ switch (tmr->function) {
+ case TMR_ABORT_TASK:
+ core_tmr_abort_task(dev, tmr, cmd->se_sess);
+@@ -2974,9 +2983,17 @@ static void target_tmr_work(struct work_struct *work)
+ break;
+ }
+
++ spin_lock_irqsave(&cmd->t_state_lock, flags);
++ if (cmd->transport_state & CMD_T_ABORTED) {
++ spin_unlock_irqrestore(&cmd->t_state_lock, flags);
++ goto check_stop;
++ }
+ cmd->t_state = TRANSPORT_ISTATE_PROCESSING;
++ spin_unlock_irqrestore(&cmd->t_state_lock, flags);
++
+ cmd->se_tfo->queue_tm_rsp(cmd);
+
++check_stop:
+ transport_cmd_check_stop_to_fabric(cmd);
+ }
+
+diff --git a/drivers/tty/pty.c b/drivers/tty/pty.c
+index 082304dcbe8c..5222805bfb15 100644
+--- a/drivers/tty/pty.c
++++ b/drivers/tty/pty.c
+@@ -655,7 +655,14 @@ static void pty_unix98_remove(struct tty_driver *driver, struct tty_struct *tty)
+ /* this is called once with whichever end is closed last */
+ static void pty_unix98_shutdown(struct tty_struct *tty)
+ {
+- devpts_kill_index(tty->driver_data, tty->index);
++ struct inode *ptmx_inode;
++
++ if (tty->driver->subtype == PTY_TYPE_MASTER)
++ ptmx_inode = tty->driver_data;
++ else
++ ptmx_inode = tty->link->driver_data;
++ devpts_kill_index(ptmx_inode, tty->index);
++ devpts_del_ref(ptmx_inode);
+ }
+
+ static const struct tty_operations ptm_unix98_ops = {
+@@ -748,6 +755,18 @@ static int ptmx_open(struct inode *inode, struct file *filp)
+ set_bit(TTY_PTY_LOCK, &tty->flags); /* LOCK THE SLAVE */
+ tty->driver_data = inode;
+
++ /*
++ * In the case where all references to ptmx inode are dropped and we
++ * still have /dev/tty opened pointing to the master/slave pair (ptmx
++ * is closed/released before /dev/tty), we must make sure that the inode
++ * is still valid when we call the final pty_unix98_shutdown, thus we
++ * hold an additional reference to the ptmx inode. For the same /dev/tty
++ * last close case, we also need to make sure the super_block isn't
++ * destroyed (devpts instance unmounted), before /dev/tty is closed and
++ * on its release devpts_kill_index is called.
++ */
++ devpts_add_ref(inode);
++
+ tty_add_file(tty, filp);
+
+ slave_inode = devpts_pty_new(inode,
+diff --git a/drivers/tty/serial/8250/8250_pci.c b/drivers/tty/serial/8250/8250_pci.c
+index 98daabab85cf..f6e5ef5bac5e 100644
+--- a/drivers/tty/serial/8250/8250_pci.c
++++ b/drivers/tty/serial/8250/8250_pci.c
+@@ -1765,6 +1765,16 @@ pci_wch_ch353_setup(struct serial_private *priv,
+ return pci_default_setup(priv, board, port, idx);
+ }
+
++static int
++pci_wch_ch38x_setup(struct serial_private *priv,
++ const struct pciserial_board *board,
++ struct uart_8250_port *port, int idx)
++{
++ port->port.flags |= UPF_FIXED_TYPE;
++ port->port.type = PORT_16850;
++ return pci_default_setup(priv, board, port, idx);
++}
++
+ #define PCI_VENDOR_ID_SBSMODULARIO 0x124B
+ #define PCI_SUBVENDOR_ID_SBSMODULARIO 0x124B
+ #define PCI_DEVICE_ID_OCTPRO 0x0001
+@@ -1819,6 +1829,10 @@ pci_wch_ch353_setup(struct serial_private *priv,
+ #define PCI_VENDOR_ID_SUNIX 0x1fd4
+ #define PCI_DEVICE_ID_SUNIX_1999 0x1999
+
++#define PCIE_VENDOR_ID_WCH 0x1c00
++#define PCIE_DEVICE_ID_WCH_CH382_2S1P 0x3250
++#define PCIE_DEVICE_ID_WCH_CH384_4S 0x3470
++#define PCIE_DEVICE_ID_WCH_CH382_2S 0x3253
+
+ #define PCI_DEVICE_ID_EXAR_XR17V4358 0x4358
+ #define PCI_DEVICE_ID_EXAR_XR17V8358 0x8358
+@@ -2530,6 +2544,30 @@ static struct pci_serial_quirk pci_serial_quirks[] __refdata = {
+ .subdevice = PCI_ANY_ID,
+ .setup = pci_wch_ch353_setup,
+ },
++ /* WCH CH382 2S card (16850 clone) */
++ {
++ .vendor = PCIE_VENDOR_ID_WCH,
++ .device = PCIE_DEVICE_ID_WCH_CH382_2S,
++ .subvendor = PCI_ANY_ID,
++ .subdevice = PCI_ANY_ID,
++ .setup = pci_wch_ch38x_setup,
++ },
++ /* WCH CH382 2S1P card (16850 clone) */
++ {
++ .vendor = PCIE_VENDOR_ID_WCH,
++ .device = PCIE_DEVICE_ID_WCH_CH382_2S1P,
++ .subvendor = PCI_ANY_ID,
++ .subdevice = PCI_ANY_ID,
++ .setup = pci_wch_ch38x_setup,
++ },
++ /* WCH CH384 4S card (16850 clone) */
++ {
++ .vendor = PCIE_VENDOR_ID_WCH,
++ .device = PCIE_DEVICE_ID_WCH_CH384_4S,
++ .subvendor = PCI_ANY_ID,
++ .subdevice = PCI_ANY_ID,
++ .setup = pci_wch_ch38x_setup,
++ },
+ /*
+ * ASIX devices with FIFO bug
+ */
+@@ -2828,6 +2866,8 @@ enum pci_board_num_t {
+ pbn_fintek_4,
+ pbn_fintek_8,
+ pbn_fintek_12,
++ pbn_wch382_2,
++ pbn_wch384_4,
+ };
+
+ /*
+@@ -3629,6 +3669,20 @@ static struct pciserial_board pci_boards[] = {
+ .base_baud = 115200,
+ .first_offset = 0x40,
+ },
++ [pbn_wch382_2] = {
++ .flags = FL_BASE0,
++ .num_ports = 2,
++ .base_baud = 115200,
++ .uart_offset = 8,
++ .first_offset = 0xC0,
++ },
++ [pbn_wch384_4] = {
++ .flags = FL_BASE0,
++ .num_ports = 4,
++ .base_baud = 115200,
++ .uart_offset = 8,
++ .first_offset = 0xC0,
++ },
+ };
+
+ static const struct pci_device_id blacklist[] = {
+@@ -3640,6 +3694,8 @@ static const struct pci_device_id blacklist[] = {
+ /* multi-io cards handled by parport_serial */
+ { PCI_DEVICE(0x4348, 0x7053), }, /* WCH CH353 2S1P */
+ { PCI_DEVICE(0x4348, 0x5053), }, /* WCH CH353 1S1P */
++ { PCI_DEVICE(0x1c00, 0x3250), }, /* WCH CH382 2S1P */
++ { PCI_DEVICE(0x1c00, 0x3470), }, /* WCH CH384 4S */
+ };
+
+ /*
+@@ -5363,6 +5419,14 @@ static struct pci_device_id serial_pci_tbl[] = {
+ PCI_ANY_ID, PCI_ANY_ID,
+ 0, 0, pbn_b0_bt_2_115200 },
+
++ { PCIE_VENDOR_ID_WCH, PCIE_DEVICE_ID_WCH_CH382_2S,
++ PCI_ANY_ID, PCI_ANY_ID,
++ 0, 0, pbn_wch382_2 },
++
++ { PCIE_VENDOR_ID_WCH, PCIE_DEVICE_ID_WCH_CH384_4S,
++ PCI_ANY_ID, PCI_ANY_ID,
++ 0, 0, pbn_wch384_4 },
++
+ /*
+ * Commtech, Inc. Fastcom adapters
+ */
+diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c
+index 313f09a73624..be039663359c 100644
+--- a/drivers/vhost/scsi.c
++++ b/drivers/vhost/scsi.c
+@@ -595,7 +595,7 @@ static void vhost_scsi_free_cmd(struct tcm_vhost_cmd *cmd)
+
+ static int vhost_scsi_check_stop_free(struct se_cmd *se_cmd)
+ {
+- return target_put_sess_cmd(se_cmd->se_sess, se_cmd);
++ return target_put_sess_cmd(se_cmd);
+ }
+
+ static void
+diff --git a/fs/btrfs/backref.c b/fs/btrfs/backref.c
+index cfd1e6f6ac64..69e596b1f95b 100644
+--- a/fs/btrfs/backref.c
++++ b/fs/btrfs/backref.c
+@@ -1371,7 +1371,8 @@ char *btrfs_ref_to_path(struct btrfs_root *fs_root, struct btrfs_path *path,
+ read_extent_buffer(eb, dest + bytes_left,
+ name_off, name_len);
+ if (eb != eb_in) {
+- btrfs_tree_read_unlock_blocking(eb);
++ if (!path->skip_locking)
++ btrfs_tree_read_unlock_blocking(eb);
+ free_extent_buffer(eb);
+ }
+ ret = inode_ref_info(parent, 0, fs_root, path, &found_key);
+@@ -1390,9 +1391,10 @@ char *btrfs_ref_to_path(struct btrfs_root *fs_root, struct btrfs_path *path,
+ eb = path->nodes[0];
+ /* make sure we can use eb after releasing the path */
+ if (eb != eb_in) {
+- atomic_inc(&eb->refs);
+- btrfs_tree_read_lock(eb);
+- btrfs_set_lock_blocking_rw(eb, BTRFS_READ_LOCK);
++ if (!path->skip_locking)
++ btrfs_set_lock_blocking_rw(eb, BTRFS_READ_LOCK);
++ path->nodes[0] = NULL;
++ path->locks[0] = 0;
+ }
+ btrfs_release_path(path);
+ iref = btrfs_item_ptr(eb, slot, struct btrfs_inode_ref);
+diff --git a/fs/btrfs/delayed-inode.c b/fs/btrfs/delayed-inode.c
+index de4e70fb3cbb..37848167c4b8 100644
+--- a/fs/btrfs/delayed-inode.c
++++ b/fs/btrfs/delayed-inode.c
+@@ -1689,7 +1689,7 @@ int btrfs_should_delete_dir_index(struct list_head *del_list,
+ *
+ */
+ int btrfs_readdir_delayed_dir_index(struct dir_context *ctx,
+- struct list_head *ins_list)
++ struct list_head *ins_list, bool *emitted)
+ {
+ struct btrfs_dir_item *di;
+ struct btrfs_delayed_item *curr, *next;
+@@ -1733,6 +1733,7 @@ int btrfs_readdir_delayed_dir_index(struct dir_context *ctx,
+
+ if (over)
+ return 1;
++ *emitted = true;
+ }
+ return 0;
+ }
+diff --git a/fs/btrfs/delayed-inode.h b/fs/btrfs/delayed-inode.h
+index f70119f25421..0167853c84ae 100644
+--- a/fs/btrfs/delayed-inode.h
++++ b/fs/btrfs/delayed-inode.h
+@@ -144,7 +144,7 @@ void btrfs_put_delayed_items(struct list_head *ins_list,
+ int btrfs_should_delete_dir_index(struct list_head *del_list,
+ u64 index);
+ int btrfs_readdir_delayed_dir_index(struct dir_context *ctx,
+- struct list_head *ins_list);
++ struct list_head *ins_list, bool *emitted);
+
+ /* for init */
+ int __init btrfs_delayed_inode_init(void);
+diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
+index 5db50e8bf52e..211f19aa56ba 100644
+--- a/fs/btrfs/inode.c
++++ b/fs/btrfs/inode.c
+@@ -5341,6 +5341,7 @@ static int btrfs_real_readdir(struct file *file, struct dir_context *ctx)
+ char *name_ptr;
+ int name_len;
+ int is_curr = 0; /* ctx->pos points to the current index? */
++ bool emitted;
+
+ /* FIXME, use a real flag for deciding about the key type */
+ if (root->fs_info->tree_root == root)
+@@ -5369,6 +5370,7 @@ static int btrfs_real_readdir(struct file *file, struct dir_context *ctx)
+ if (ret < 0)
+ goto err;
+
++ emitted = false;
+ while (1) {
+ leaf = path->nodes[0];
+ slot = path->slots[0];
+@@ -5448,6 +5450,7 @@ skip:
+
+ if (over)
+ goto nopos;
++ emitted = true;
+ di_len = btrfs_dir_name_len(leaf, di) +
+ btrfs_dir_data_len(leaf, di) + sizeof(*di);
+ di_cur += di_len;
+@@ -5460,11 +5463,20 @@ next:
+ if (key_type == BTRFS_DIR_INDEX_KEY) {
+ if (is_curr)
+ ctx->pos++;
+- ret = btrfs_readdir_delayed_dir_index(ctx, &ins_list);
++ ret = btrfs_readdir_delayed_dir_index(ctx, &ins_list, &emitted);
+ if (ret)
+ goto nopos;
+ }
+
++ /*
++ * If we haven't emitted any dir entry, we must not touch ctx->pos as
++ * it was was set to the termination value in previous call. We assume
++ * that "." and ".." were emitted if we reach this point and set the
++ * termination value as well for an empty directory.
++ */
++ if (ctx->pos > 2 && !emitted)
++ goto nopos;
++
+ /* Reached end of directory/root. Bump pos past the last item. */
+ ctx->pos++;
+
+diff --git a/fs/cifs/cifsencrypt.c b/fs/cifs/cifsencrypt.c
+index da7fbfaa60b4..cee9889a6612 100644
+--- a/fs/cifs/cifsencrypt.c
++++ b/fs/cifs/cifsencrypt.c
+@@ -710,7 +710,7 @@ setup_ntlmv2_rsp(struct cifs_ses *ses, const struct nls_table *nls_cp)
+
+ ses->auth_key.response = kmalloc(baselen + tilen, GFP_KERNEL);
+ if (!ses->auth_key.response) {
+- rc = ENOMEM;
++ rc = -ENOMEM;
+ ses->auth_key.len = 0;
+ goto setup_ntlmv2_rsp_ret;
+ }
+diff --git a/fs/devpts/inode.c b/fs/devpts/inode.c
+index cfe8466f7fef..f13aa00ed1d6 100644
+--- a/fs/devpts/inode.c
++++ b/fs/devpts/inode.c
+@@ -569,6 +569,26 @@ void devpts_kill_index(struct inode *ptmx_inode, int idx)
+ mutex_unlock(&allocated_ptys_lock);
+ }
+
++/*
++ * pty code needs to hold extra references in case of last /dev/tty close
++ */
++
++void devpts_add_ref(struct inode *ptmx_inode)
++{
++ struct super_block *sb = pts_sb_from_inode(ptmx_inode);
++
++ atomic_inc(&sb->s_active);
++ ihold(ptmx_inode);
++}
++
++void devpts_del_ref(struct inode *ptmx_inode)
++{
++ struct super_block *sb = pts_sb_from_inode(ptmx_inode);
++
++ iput(ptmx_inode);
++ deactivate_super(sb);
++}
++
+ /**
+ * devpts_pty_new -- create a new inode in /dev/pts/
+ * @ptmx_inode: inode of the master
+diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
+index 777f74370143..2ea75cbeb697 100644
+--- a/fs/ext4/inode.c
++++ b/fs/ext4/inode.c
+@@ -3033,29 +3033,29 @@ static ssize_t ext4_ext_direct_IO(int rw, struct kiocb *iocb,
+ * case, we allocate an io_end structure to hook to the iocb.
+ */
+ iocb->private = NULL;
+- ext4_inode_aio_set(inode, NULL);
+- if (!is_sync_kiocb(iocb)) {
+- io_end = ext4_init_io_end(inode, GFP_NOFS);
+- if (!io_end) {
+- ret = -ENOMEM;
+- goto retake_lock;
+- }
+- /*
+- * Grab reference for DIO. Will be dropped in ext4_end_io_dio()
+- */
+- iocb->private = ext4_get_io_end(io_end);
+- /*
+- * we save the io structure for current async direct
+- * IO, so that later ext4_map_blocks() could flag the
+- * io structure whether there is a unwritten extents
+- * needs to be converted when IO is completed.
+- */
+- ext4_inode_aio_set(inode, io_end);
+- }
+-
+ if (overwrite) {
+ get_block_func = ext4_get_block_write_nolock;
+ } else {
++ ext4_inode_aio_set(inode, NULL);
++ if (!is_sync_kiocb(iocb)) {
++ io_end = ext4_init_io_end(inode, GFP_NOFS);
++ if (!io_end) {
++ ret = -ENOMEM;
++ goto retake_lock;
++ }
++ /*
++ * Grab reference for DIO. Will be dropped in
++ * ext4_end_io_dio()
++ */
++ iocb->private = ext4_get_io_end(io_end);
++ /*
++ * we save the io structure for current async direct
++ * IO, so that later ext4_map_blocks() could flag the
++ * io structure whether there is a unwritten extents
++ * needs to be converted when IO is completed.
++ */
++ ext4_inode_aio_set(inode, io_end);
++ }
+ get_block_func = ext4_get_block_write;
+ dio_flags = DIO_LOCKING;
+ }
+diff --git a/fs/ext4/move_extent.c b/fs/ext4/move_extent.c
+index 9f2311bc9c4f..165f309bafcc 100644
+--- a/fs/ext4/move_extent.c
++++ b/fs/ext4/move_extent.c
+@@ -269,10 +269,12 @@ move_extent_per_page(struct file *o_filp, struct inode *donor_inode,
+ unsigned long blocksize = orig_inode->i_sb->s_blocksize;
+ unsigned int w_flags = 0;
+ unsigned int tmp_data_size, data_size, replaced_size;
+- int err2, jblocks, retries = 0;
++ int i, err2, jblocks, retries = 0;
+ int replaced_count = 0;
+ int from = data_offset_in_page << orig_inode->i_blkbits;
+ int blocks_per_page = PAGE_CACHE_SIZE >> orig_inode->i_blkbits;
++ struct super_block *sb = orig_inode->i_sb;
++ struct buffer_head *bh = NULL;
+
+ /*
+ * It needs twice the amount of ordinary journal buffers because
+@@ -386,8 +388,16 @@ data_copy:
+ }
+ /* Perform all necessary steps similar write_begin()/write_end()
+ * but keeping in mind that i_size will not change */
+- *err = __block_write_begin(pagep[0], from, replaced_size,
+- ext4_get_block);
++ if (!page_has_buffers(pagep[0]))
++ create_empty_buffers(pagep[0], 1 << orig_inode->i_blkbits, 0);
++ bh = page_buffers(pagep[0]);
++ for (i = 0; i < data_offset_in_page; i++)
++ bh = bh->b_this_page;
++ for (i = 0; i < block_len_in_page; i++) {
++ *err = ext4_get_block(orig_inode, orig_blk_offset + i, bh, 0);
++ if (*err < 0)
++ break;
++ }
+ if (!*err)
+ *err = block_commit_write(pagep[0], from, from + replaced_size);
+
+@@ -405,10 +415,13 @@ unlock_pages:
+ page_cache_release(pagep[1]);
+ stop_journal:
+ ext4_journal_stop(handle);
++ if (*err == -ENOSPC &&
++ ext4_should_retry_alloc(sb, &retries))
++ goto again;
+ /* Buffer was busy because probably is pinned to journal transaction,
+ * force transaction commit may help to free it. */
+- if (*err == -EBUSY && ext4_should_retry_alloc(orig_inode->i_sb,
+- &retries))
++ if (*err == -EBUSY && retries++ < 4 && EXT4_SB(sb)->s_journal &&
++ jbd2_journal_force_commit_nested(EXT4_SB(sb)->s_journal))
+ goto again;
+ return replaced_count;
+
+diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c
+index ca4588388fc3..77c81c64a47e 100644
+--- a/fs/ext4/resize.c
++++ b/fs/ext4/resize.c
+@@ -186,7 +186,7 @@ static struct ext4_new_flex_group_data *alloc_flex_gd(unsigned long flexbg_size)
+ if (flex_gd == NULL)
+ goto out3;
+
+- if (flexbg_size >= UINT_MAX / sizeof(struct ext4_new_flex_group_data))
++ if (flexbg_size >= UINT_MAX / sizeof(struct ext4_new_group_data))
+ goto out2;
+ flex_gd->count = flexbg_size;
+
+diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c
+index 2d609a5fbfea..a07634599cd7 100644
+--- a/fs/fs-writeback.c
++++ b/fs/fs-writeback.c
+@@ -705,6 +705,21 @@ static long writeback_sb_inodes(struct super_block *sb,
+
+ work->nr_pages -= write_chunk - wbc.nr_to_write;
+ wrote += write_chunk - wbc.nr_to_write;
++
++ if (need_resched()) {
++ /*
++ * We're trying to balance between building up a nice
++ * long list of IOs to improve our merge rate, and
++ * getting those IOs out quickly for anyone throttling
++ * in balance_dirty_pages(). cond_resched() doesn't
++ * unplug, so get our IOs out the door before we
++ * give up the CPU.
++ */
++ blk_flush_plug(current);
++ cond_resched();
++ }
++
++
+ spin_lock(&wb->list_lock);
+ spin_lock(&inode->i_lock);
+ if (!(inode->i_state & I_DIRTY))
+@@ -712,7 +727,7 @@ static long writeback_sb_inodes(struct super_block *sb,
+ requeue_inode(inode, wb, &wbc);
+ inode_sync_complete(inode);
+ spin_unlock(&inode->i_lock);
+- cond_resched_lock(&wb->list_lock);
++
+ /*
+ * bail out to wb_writeback() often enough to check
+ * background threshold and other termination conditions.
+diff --git a/include/asm-generic/cputime_nsecs.h b/include/asm-generic/cputime_nsecs.h
+index 0419485891f2..0f1c6f315cdc 100644
+--- a/include/asm-generic/cputime_nsecs.h
++++ b/include/asm-generic/cputime_nsecs.h
+@@ -75,7 +75,7 @@ typedef u64 __nocast cputime64_t;
+ */
+ static inline cputime_t timespec_to_cputime(const struct timespec *val)
+ {
+- u64 ret = val->tv_sec * NSEC_PER_SEC + val->tv_nsec;
++ u64 ret = (u64)val->tv_sec * NSEC_PER_SEC + val->tv_nsec;
+ return (__force cputime_t) ret;
+ }
+ static inline void cputime_to_timespec(const cputime_t ct, struct timespec *val)
+@@ -91,7 +91,8 @@ static inline void cputime_to_timespec(const cputime_t ct, struct timespec *val)
+ */
+ static inline cputime_t timeval_to_cputime(const struct timeval *val)
+ {
+- u64 ret = val->tv_sec * NSEC_PER_SEC + val->tv_usec * NSEC_PER_USEC;
++ u64 ret = (u64)val->tv_sec * NSEC_PER_SEC +
++ val->tv_usec * NSEC_PER_USEC;
+ return (__force cputime_t) ret;
+ }
+ static inline void cputime_to_timeval(const cputime_t ct, struct timeval *val)
+diff --git a/include/linux/compiler.h b/include/linux/compiler.h
+index 2bd394ed35f6..1a6f01df1496 100644
+--- a/include/linux/compiler.h
++++ b/include/linux/compiler.h
+@@ -138,7 +138,7 @@ void ftrace_likely_update(struct ftrace_branch_data *f, int val, int expect);
+ */
+ #define if(cond, ...) __trace_if( (cond , ## __VA_ARGS__) )
+ #define __trace_if(cond) \
+- if (__builtin_constant_p((cond)) ? !!(cond) : \
++ if (__builtin_constant_p(!!(cond)) ? !!(cond) : \
+ ({ \
+ int ______r; \
+ static struct ftrace_branch_data \
+diff --git a/include/linux/devpts_fs.h b/include/linux/devpts_fs.h
+index 251a2090a554..e0ee0b3000b2 100644
+--- a/include/linux/devpts_fs.h
++++ b/include/linux/devpts_fs.h
+@@ -19,6 +19,8 @@
+
+ int devpts_new_index(struct inode *ptmx_inode);
+ void devpts_kill_index(struct inode *ptmx_inode, int idx);
++void devpts_add_ref(struct inode *ptmx_inode);
++void devpts_del_ref(struct inode *ptmx_inode);
+ /* mknod in devpts */
+ struct inode *devpts_pty_new(struct inode *ptmx_inode, dev_t device, int index,
+ void *priv);
+@@ -32,6 +34,8 @@ void devpts_pty_kill(struct inode *inode);
+ /* Dummy stubs in the no-pty case */
+ static inline int devpts_new_index(struct inode *ptmx_inode) { return -EINVAL; }
+ static inline void devpts_kill_index(struct inode *ptmx_inode, int idx) { }
++static inline void devpts_add_ref(struct inode *ptmx_inode) { }
++static inline void devpts_del_ref(struct inode *ptmx_inode) { }
+ static inline struct inode *devpts_pty_new(struct inode *ptmx_inode,
+ dev_t device, int index, void *priv)
+ {
+diff --git a/include/linux/tracepoint.h b/include/linux/tracepoint.h
+index c72851328ca9..72486551c4ca 100644
+--- a/include/linux/tracepoint.h
++++ b/include/linux/tracepoint.h
+@@ -14,8 +14,10 @@
+ * See the file COPYING for more details.
+ */
+
++#include <linux/smp.h>
+ #include <linux/errno.h>
+ #include <linux/types.h>
++#include <linux/cpumask.h>
+ #include <linux/rcupdate.h>
+ #include <linux/static_key.h>
+
+@@ -121,6 +123,9 @@ extern void syscall_unregfunc(void);
+ void *it_func; \
+ void *__data; \
+ \
++ if (!cpu_online(raw_smp_processor_id())) \
++ return; \
++ \
+ if (!(cond)) \
+ return; \
+ prercu; \
+diff --git a/include/sound/pcm.h b/include/sound/pcm.h
+index 8bb00a27e219..e02b1b8d8ee4 100644
+--- a/include/sound/pcm.h
++++ b/include/sound/pcm.h
+@@ -535,6 +535,12 @@ snd_pcm_debug_name(struct snd_pcm_substream *substream, char *buf, size_t size)
+ * PCM library
+ */
+
++/**
++ * snd_pcm_stream_linked - Check whether the substream is linked with others
++ * @substream: substream to check
++ *
++ * Returns true if the given substream is being linked with others.
++ */
+ static inline int snd_pcm_stream_linked(struct snd_pcm_substream *substream)
+ {
+ return substream->group != &substream->self_group;
+@@ -545,6 +551,16 @@ void snd_pcm_stream_unlock(struct snd_pcm_substream *substream);
+ void snd_pcm_stream_lock_irq(struct snd_pcm_substream *substream);
+ void snd_pcm_stream_unlock_irq(struct snd_pcm_substream *substream);
+ unsigned long _snd_pcm_stream_lock_irqsave(struct snd_pcm_substream *substream);
++
++/**
++ * snd_pcm_stream_lock_irqsave - Lock the PCM stream
++ * @substream: PCM substream
++ * @flags: irq flags
++ *
++ * This locks the PCM stream like snd_pcm_stream_lock() but with the local
++ * IRQ (only when nonatomic is false). In nonatomic case, this is identical
++ * as snd_pcm_stream_lock().
++ */
+ #define snd_pcm_stream_lock_irqsave(substream, flags) \
+ do { \
+ typecheck(unsigned long, flags); \
+@@ -553,9 +569,25 @@ unsigned long _snd_pcm_stream_lock_irqsave(struct snd_pcm_substream *substream);
+ void snd_pcm_stream_unlock_irqrestore(struct snd_pcm_substream *substream,
+ unsigned long flags);
+
++/**
++ * snd_pcm_group_for_each_entry - iterate over the linked substreams
++ * @s: the iterator
++ * @substream: the substream
++ *
++ * Iterate over the all linked substreams to the given @substream.
++ * When @substream isn't linked with any others, this gives returns @substream
++ * itself once.
++ */
+ #define snd_pcm_group_for_each_entry(s, substream) \
+ list_for_each_entry(s, &substream->group->substreams, link_list)
+
++/**
++ * snd_pcm_running - Check whether the substream is in a running state
++ * @substream: substream to check
++ *
++ * Returns true if the given substream is in the state RUNNING, or in the
++ * state DRAINING for playback.
++ */
+ static inline int snd_pcm_running(struct snd_pcm_substream *substream)
+ {
+ return (substream->runtime->status->state == SNDRV_PCM_STATE_RUNNING ||
+@@ -563,45 +595,81 @@ static inline int snd_pcm_running(struct snd_pcm_substream *substream)
+ substream->stream == SNDRV_PCM_STREAM_PLAYBACK));
+ }
+
++/**
++ * bytes_to_samples - Unit conversion of the size from bytes to samples
++ * @runtime: PCM runtime instance
++ * @size: size in bytes
++ */
+ static inline ssize_t bytes_to_samples(struct snd_pcm_runtime *runtime, ssize_t size)
+ {
+ return size * 8 / runtime->sample_bits;
+ }
+
++/**
++ * bytes_to_frames - Unit conversion of the size from bytes to frames
++ * @runtime: PCM runtime instance
++ * @size: size in bytes
++ */
+ static inline snd_pcm_sframes_t bytes_to_frames(struct snd_pcm_runtime *runtime, ssize_t size)
+ {
+ return size * 8 / runtime->frame_bits;
+ }
+
++/**
++ * samples_to_bytes - Unit conversion of the size from samples to bytes
++ * @runtime: PCM runtime instance
++ * @size: size in samples
++ */
+ static inline ssize_t samples_to_bytes(struct snd_pcm_runtime *runtime, ssize_t size)
+ {
+ return size * runtime->sample_bits / 8;
+ }
+
++/**
++ * frames_to_bytes - Unit conversion of the size from frames to bytes
++ * @runtime: PCM runtime instance
++ * @size: size in frames
++ */
+ static inline ssize_t frames_to_bytes(struct snd_pcm_runtime *runtime, snd_pcm_sframes_t size)
+ {
+ return size * runtime->frame_bits / 8;
+ }
+
++/**
++ * frame_aligned - Check whether the byte size is aligned to frames
++ * @runtime: PCM runtime instance
++ * @bytes: size in bytes
++ */
+ static inline int frame_aligned(struct snd_pcm_runtime *runtime, ssize_t bytes)
+ {
+ return bytes % runtime->byte_align == 0;
+ }
+
++/**
++ * snd_pcm_lib_buffer_bytes - Get the buffer size of the current PCM in bytes
++ * @substream: PCM substream
++ */
+ static inline size_t snd_pcm_lib_buffer_bytes(struct snd_pcm_substream *substream)
+ {
+ struct snd_pcm_runtime *runtime = substream->runtime;
+ return frames_to_bytes(runtime, runtime->buffer_size);
+ }
+
++/**
++ * snd_pcm_lib_period_bytes - Get the period size of the current PCM in bytes
++ * @substream: PCM substream
++ */
+ static inline size_t snd_pcm_lib_period_bytes(struct snd_pcm_substream *substream)
+ {
+ struct snd_pcm_runtime *runtime = substream->runtime;
+ return frames_to_bytes(runtime, runtime->period_size);
+ }
+
+-/*
+- * result is: 0 ... (boundary - 1)
++/**
++ * snd_pcm_playback_avail - Get the available (writable) space for playback
++ * @runtime: PCM runtime instance
++ *
++ * Result is between 0 ... (boundary - 1)
+ */
+ static inline snd_pcm_uframes_t snd_pcm_playback_avail(struct snd_pcm_runtime *runtime)
+ {
+@@ -613,8 +681,11 @@ static inline snd_pcm_uframes_t snd_pcm_playback_avail(struct snd_pcm_runtime *r
+ return avail;
+ }
+
+-/*
+- * result is: 0 ... (boundary - 1)
++/**
++ * snd_pcm_playback_avail - Get the available (readable) space for capture
++ * @runtime: PCM runtime instance
++ *
++ * Result is between 0 ... (boundary - 1)
+ */
+ static inline snd_pcm_uframes_t snd_pcm_capture_avail(struct snd_pcm_runtime *runtime)
+ {
+@@ -624,11 +695,19 @@ static inline snd_pcm_uframes_t snd_pcm_capture_avail(struct snd_pcm_runtime *ru
+ return avail;
+ }
+
++/**
++ * snd_pcm_playback_hw_avail - Get the queued space for playback
++ * @runtime: PCM runtime instance
++ */
+ static inline snd_pcm_sframes_t snd_pcm_playback_hw_avail(struct snd_pcm_runtime *runtime)
+ {
+ return runtime->buffer_size - snd_pcm_playback_avail(runtime);
+ }
+
++/**
++ * snd_pcm_capture_hw_avail - Get the free space for capture
++ * @runtime: PCM runtime instance
++ */
+ static inline snd_pcm_sframes_t snd_pcm_capture_hw_avail(struct snd_pcm_runtime *runtime)
+ {
+ return runtime->buffer_size - snd_pcm_capture_avail(runtime);
+@@ -708,6 +787,20 @@ static inline int snd_pcm_capture_empty(struct snd_pcm_substream *substream)
+ return snd_pcm_capture_avail(runtime) == 0;
+ }
+
++/**
++ * snd_pcm_trigger_done - Mark the master substream
++ * @substream: the pcm substream instance
++ * @master: the linked master substream
++ *
++ * When multiple substreams of the same card are linked and the hardware
++ * supports the single-shot operation, the driver calls this in the loop
++ * in snd_pcm_group_for_each_entry() for marking the substream as "done".
++ * Then most of trigger operations are performed only to the given master
++ * substream.
++ *
++ * The trigger_master mark is cleared at timestamp updates at the end
++ * of trigger operations.
++ */
+ static inline void snd_pcm_trigger_done(struct snd_pcm_substream *substream,
+ struct snd_pcm_substream *master)
+ {
+@@ -883,6 +976,14 @@ unsigned int snd_pcm_rate_bit_to_rate(unsigned int rate_bit);
+ unsigned int snd_pcm_rate_mask_intersect(unsigned int rates_a,
+ unsigned int rates_b);
+
++/**
++ * snd_pcm_set_runtime_buffer - Set the PCM runtime buffer
++ * @substream: PCM substream to set
++ * @bufp: the buffer information, NULL to clear
++ *
++ * Copy the buffer information to runtime->dma_buffer when @bufp is non-NULL.
++ * Otherwise it clears the current buffer information.
++ */
+ static inline void snd_pcm_set_runtime_buffer(struct snd_pcm_substream *substream,
+ struct snd_dma_buffer *bufp)
+ {
+@@ -908,6 +1009,11 @@ void snd_pcm_timer_resolution_change(struct snd_pcm_substream *substream);
+ void snd_pcm_timer_init(struct snd_pcm_substream *substream);
+ void snd_pcm_timer_done(struct snd_pcm_substream *substream);
+
++/**
++ * snd_pcm_gettime - Fill the timespec depending on the timestamp mode
++ * @runtime: PCM runtime instance
++ * @tv: timespec to fill
++ */
+ static inline void snd_pcm_gettime(struct snd_pcm_runtime *runtime,
+ struct timespec *tv)
+ {
+@@ -998,18 +1104,35 @@ struct page *snd_pcm_sgbuf_ops_page(struct snd_pcm_substream *substream,
+ #define snd_pcm_sgbuf_ops_page NULL
+ #endif /* SND_DMA_SGBUF */
+
++/**
++ * snd_pcm_sgbuf_get_addr - Get the DMA address at the corresponding offset
++ * @substream: PCM substream
++ * @ofs: byte offset
++ */
+ static inline dma_addr_t
+ snd_pcm_sgbuf_get_addr(struct snd_pcm_substream *substream, unsigned int ofs)
+ {
+ return snd_sgbuf_get_addr(snd_pcm_get_dma_buf(substream), ofs);
+ }
+
++/**
++ * snd_pcm_sgbuf_get_ptr - Get the virtual address at the corresponding offset
++ * @substream: PCM substream
++ * @ofs: byte offset
++ */
+ static inline void *
+ snd_pcm_sgbuf_get_ptr(struct snd_pcm_substream *substream, unsigned int ofs)
+ {
+ return snd_sgbuf_get_ptr(snd_pcm_get_dma_buf(substream), ofs);
+ }
+
++/**
++ * snd_pcm_sgbuf_chunk_size - Compute the max size that fits within the contig.
++ * page from the given size
++ * @substream: PCM substream
++ * @ofs: byte offset
++ * @size: byte size to examine
++ */
+ static inline unsigned int
+ snd_pcm_sgbuf_get_chunk_size(struct snd_pcm_substream *substream,
+ unsigned int ofs, unsigned int size)
+@@ -1017,13 +1140,24 @@ snd_pcm_sgbuf_get_chunk_size(struct snd_pcm_substream *substream,
+ return snd_sgbuf_get_chunk_size(snd_pcm_get_dma_buf(substream), ofs, size);
+ }
+
+-/* handle mmap counter - PCM mmap callback should handle this counter properly */
++/**
++ * snd_pcm_mmap_data_open - increase the mmap counter
++ * @area: VMA
++ *
++ * PCM mmap callback should handle this counter properly
++ */
+ static inline void snd_pcm_mmap_data_open(struct vm_area_struct *area)
+ {
+ struct snd_pcm_substream *substream = (struct snd_pcm_substream *)area->vm_private_data;
+ atomic_inc(&substream->mmap_count);
+ }
+
++/**
++ * snd_pcm_mmap_data_close - decrease the mmap counter
++ * @area: VMA
++ *
++ * PCM mmap callback should handle this counter properly
++ */
+ static inline void snd_pcm_mmap_data_close(struct vm_area_struct *area)
+ {
+ struct snd_pcm_substream *substream = (struct snd_pcm_substream *)area->vm_private_data;
+@@ -1043,6 +1177,11 @@ int snd_pcm_lib_mmap_iomem(struct snd_pcm_substream *substream, struct vm_area_s
+
+ #define snd_pcm_lib_mmap_vmalloc NULL
+
++/**
++ * snd_pcm_limit_isa_dma_size - Get the max size fitting with ISA DMA transfer
++ * @dma: DMA number
++ * @max: pointer to store the max size
++ */
+ static inline void snd_pcm_limit_isa_dma_size(int dma, size_t *max)
+ {
+ *max = dma < 4 ? 64 * 1024 : 128 * 1024;
+@@ -1095,7 +1234,11 @@ struct snd_pcm_chmap {
+ void *private_data; /* optional: private data pointer */
+ };
+
+-/* get the PCM substream assigned to the given chmap info */
++/**
++ * snd_pcm_chmap_substream - get the PCM substream assigned to the given chmap info
++ * @info: chmap information
++ * @idx: the substream number index
++ */
+ static inline struct snd_pcm_substream *
+ snd_pcm_chmap_substream(struct snd_pcm_chmap *info, unsigned int idx)
+ {
+@@ -1122,7 +1265,10 @@ int snd_pcm_add_chmap_ctls(struct snd_pcm *pcm, int stream,
+ unsigned long private_value,
+ struct snd_pcm_chmap **info_ret);
+
+-/* Strong-typed conversion of pcm_format to bitwise */
++/**
++ * pcm_format_to_bits - Strong-typed conversion of pcm_format to bitwise
++ * @pcm_format: PCM format
++ */
+ static inline u64 pcm_format_to_bits(snd_pcm_format_t pcm_format)
+ {
+ return 1ULL << (__force int) pcm_format;
+diff --git a/include/target/target_core_fabric.h b/include/target/target_core_fabric.h
+index 22a4e98eec80..e21dbdb0fe3d 100644
+--- a/include/target/target_core_fabric.h
++++ b/include/target/target_core_fabric.h
+@@ -126,8 +126,8 @@ bool transport_wait_for_tasks(struct se_cmd *);
+ int transport_check_aborted_status(struct se_cmd *, int);
+ int transport_send_check_condition_and_sense(struct se_cmd *,
+ sense_reason_t, int);
+-int target_get_sess_cmd(struct se_session *, struct se_cmd *, bool);
+-int target_put_sess_cmd(struct se_session *, struct se_cmd *);
++int target_get_sess_cmd(struct se_cmd *, bool);
++int target_put_sess_cmd(struct se_cmd *);
+ void target_sess_cmd_list_set_waiting(struct se_session *);
+ void target_wait_for_sess_cmds(struct se_session *);
+
+diff --git a/lib/klist.c b/lib/klist.c
+index 89b485a2a58d..2a072bfaeace 100644
+--- a/lib/klist.c
++++ b/lib/klist.c
+@@ -282,9 +282,9 @@ void klist_iter_init_node(struct klist *k, struct klist_iter *i,
+ struct klist_node *n)
+ {
+ i->i_klist = k;
+- i->i_cur = n;
+- if (n)
+- kref_get(&n->n_ref);
++ i->i_cur = NULL;
++ if (n && kref_get_unless_zero(&n->n_ref))
++ i->i_cur = n;
+ }
+ EXPORT_SYMBOL_GPL(klist_iter_init_node);
+
+diff --git a/security/integrity/evm/evm_main.c b/security/integrity/evm/evm_main.c
+index 4ada1a97a60b..e1998df4c160 100644
+--- a/security/integrity/evm/evm_main.c
++++ b/security/integrity/evm/evm_main.c
+@@ -24,6 +24,7 @@
+ #include <linux/evm.h>
+ #include <linux/magic.h>
+ #include <crypto/hash.h>
++#include <crypto/algapi.h>
+ #include "evm.h"
+
+ int evm_initialized;
+@@ -149,7 +150,7 @@ static enum integrity_status evm_verify_hmac(struct dentry *dentry,
+ xattr_value_len, calc.digest);
+ if (rc)
+ break;
+- rc = memcmp(xattr_data->digest, calc.digest,
++ rc = crypto_memneq(xattr_data->digest, calc.digest,
+ sizeof(calc.digest));
+ if (rc)
+ rc = -EINVAL;
+diff --git a/sound/core/pcm.c b/sound/core/pcm.c
+index c6ff94ab1ad6..b917a47a7bb6 100644
+--- a/sound/core/pcm.c
++++ b/sound/core/pcm.c
+@@ -220,6 +220,10 @@ static char *snd_pcm_format_names[] = {
+ FORMAT(DSD_U32_BE),
+ };
+
++/**
++ * snd_pcm_format_name - Return a name string for the given PCM format
++ * @format: PCM format
++ */
+ const char *snd_pcm_format_name(snd_pcm_format_t format)
+ {
+ if ((__force unsigned int)format >= ARRAY_SIZE(snd_pcm_format_names))
+@@ -709,7 +713,6 @@ int snd_pcm_new_stream(struct snd_pcm *pcm, int stream, int substream_count)
+ }
+ return 0;
+ }
+-
+ EXPORT_SYMBOL(snd_pcm_new_stream);
+
+ static int _snd_pcm_new(struct snd_card *card, const char *id, int device,
+@@ -1157,6 +1160,15 @@ static int snd_pcm_dev_disconnect(struct snd_device *device)
+ return 0;
+ }
+
++/**
++ * snd_pcm_notify - Add/remove the notify list
++ * @notify: PCM notify list
++ * @nfree: 0 = register, 1 = unregister
++ *
++ * This adds the given notifier to the global list so that the callback is
++ * called for each registered PCM devices. This exists only for PCM OSS
++ * emulation, so far.
++ */
+ int snd_pcm_notify(struct snd_pcm_notify *notify, int nfree)
+ {
+ struct snd_pcm *pcm;
+@@ -1179,7 +1191,6 @@ int snd_pcm_notify(struct snd_pcm_notify *notify, int nfree)
+ mutex_unlock(®ister_mutex);
+ return 0;
+ }
+-
+ EXPORT_SYMBOL(snd_pcm_notify);
+
+ #ifdef CONFIG_PROC_FS
+diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c
+index 9c823cfdfff0..b04802c6ffb9 100644
+--- a/sound/core/pcm_native.c
++++ b/sound/core/pcm_native.c
+@@ -77,6 +77,26 @@ static int snd_pcm_open(struct file *file, struct snd_pcm *pcm, int stream);
+ static DEFINE_RWLOCK(snd_pcm_link_rwlock);
+ static DECLARE_RWSEM(snd_pcm_link_rwsem);
+
++/* Writer in rwsem may block readers even during its waiting in queue,
++ * and this may lead to a deadlock when the code path takes read sem
++ * twice (e.g. one in snd_pcm_action_nonatomic() and another in
++ * snd_pcm_stream_lock()). As a (suboptimal) workaround, let writer to
++ * spin until it gets the lock.
++ */
++static inline void down_write_nonblock(struct rw_semaphore *lock)
++{
++ while (!down_write_trylock(lock))
++ cond_resched();
++}
++
++/**
++ * snd_pcm_stream_lock - Lock the PCM stream
++ * @substream: PCM substream
++ *
++ * This locks the PCM stream's spinlock or mutex depending on the nonatomic
++ * flag of the given substream. This also takes the global link rw lock
++ * (or rw sem), too, for avoiding the race with linked streams.
++ */
+ void snd_pcm_stream_lock(struct snd_pcm_substream *substream)
+ {
+ if (substream->pcm->nonatomic) {
+@@ -89,6 +109,12 @@ void snd_pcm_stream_lock(struct snd_pcm_substream *substream)
+ }
+ EXPORT_SYMBOL_GPL(snd_pcm_stream_lock);
+
++/**
++ * snd_pcm_stream_lock - Unlock the PCM stream
++ * @substream: PCM substream
++ *
++ * This unlocks the PCM stream that has been locked via snd_pcm_stream_lock().
++ */
+ void snd_pcm_stream_unlock(struct snd_pcm_substream *substream)
+ {
+ if (substream->pcm->nonatomic) {
+@@ -101,6 +127,14 @@ void snd_pcm_stream_unlock(struct snd_pcm_substream *substream)
+ }
+ EXPORT_SYMBOL_GPL(snd_pcm_stream_unlock);
+
++/**
++ * snd_pcm_stream_lock_irq - Lock the PCM stream
++ * @substream: PCM substream
++ *
++ * This locks the PCM stream like snd_pcm_stream_lock() and disables the local
++ * IRQ (only when nonatomic is false). In nonatomic case, this is identical
++ * as snd_pcm_stream_lock().
++ */
+ void snd_pcm_stream_lock_irq(struct snd_pcm_substream *substream)
+ {
+ if (!substream->pcm->nonatomic)
+@@ -109,6 +143,12 @@ void snd_pcm_stream_lock_irq(struct snd_pcm_substream *substream)
+ }
+ EXPORT_SYMBOL_GPL(snd_pcm_stream_lock_irq);
+
++/**
++ * snd_pcm_stream_unlock_irq - Unlock the PCM stream
++ * @substream: PCM substream
++ *
++ * This is a counter-part of snd_pcm_stream_lock_irq().
++ */
+ void snd_pcm_stream_unlock_irq(struct snd_pcm_substream *substream)
+ {
+ snd_pcm_stream_unlock(substream);
+@@ -127,6 +167,13 @@ unsigned long _snd_pcm_stream_lock_irqsave(struct snd_pcm_substream *substream)
+ }
+ EXPORT_SYMBOL_GPL(_snd_pcm_stream_lock_irqsave);
+
++/**
++ * snd_pcm_stream_unlock_irqrestore - Unlock the PCM stream
++ * @substream: PCM substream
++ * @flags: irq flags
++ *
++ * This is a counter-part of snd_pcm_stream_lock_irqsave().
++ */
+ void snd_pcm_stream_unlock_irqrestore(struct snd_pcm_substream *substream,
+ unsigned long flags)
+ {
+@@ -1747,7 +1794,7 @@ static int snd_pcm_link(struct snd_pcm_substream *substream, int fd)
+ res = -ENOMEM;
+ goto _nolock;
+ }
+- down_write(&snd_pcm_link_rwsem);
++ down_write_nonblock(&snd_pcm_link_rwsem);
+ write_lock_irq(&snd_pcm_link_rwlock);
+ if (substream->runtime->status->state == SNDRV_PCM_STATE_OPEN ||
+ substream->runtime->status->state != substream1->runtime->status->state ||
+@@ -1794,7 +1841,7 @@ static int snd_pcm_unlink(struct snd_pcm_substream *substream)
+ struct snd_pcm_substream *s;
+ int res = 0;
+
+- down_write(&snd_pcm_link_rwsem);
++ down_write_nonblock(&snd_pcm_link_rwsem);
+ write_lock_irq(&snd_pcm_link_rwlock);
+ if (!snd_pcm_stream_linked(substream)) {
+ res = -EALREADY;
+@@ -3319,6 +3366,15 @@ static const struct vm_operations_struct snd_pcm_vm_ops_data_fault = {
+ /*
+ * mmap the DMA buffer on RAM
+ */
++
++/**
++ * snd_pcm_lib_default_mmap - Default PCM data mmap function
++ * @substream: PCM substream
++ * @area: VMA
++ *
++ * This is the default mmap handler for PCM data. When mmap pcm_ops is NULL,
++ * this function is invoked implicitly.
++ */
+ int snd_pcm_lib_default_mmap(struct snd_pcm_substream *substream,
+ struct vm_area_struct *area)
+ {
+@@ -3354,6 +3410,15 @@ EXPORT_SYMBOL_GPL(snd_pcm_lib_default_mmap);
+ * mmap the DMA buffer on I/O memory area
+ */
+ #if SNDRV_PCM_INFO_MMAP_IOMEM
++/**
++ * snd_pcm_lib_mmap_iomem - Default PCM data mmap function for I/O mem
++ * @substream: PCM substream
++ * @area: VMA
++ *
++ * When your hardware uses the iomapped pages as the hardware buffer and
++ * wants to mmap it, pass this function as mmap pcm_ops. Note that this
++ * is supposed to work only on limited architectures.
++ */
+ int snd_pcm_lib_mmap_iomem(struct snd_pcm_substream *substream,
+ struct vm_area_struct *area)
+ {
+diff --git a/sound/core/seq/seq_fifo.c b/sound/core/seq/seq_fifo.c
+index 53a403e17c5b..1d5acbe0c08b 100644
+--- a/sound/core/seq/seq_fifo.c
++++ b/sound/core/seq/seq_fifo.c
+@@ -33,10 +33,8 @@ struct snd_seq_fifo *snd_seq_fifo_new(int poolsize)
+ struct snd_seq_fifo *f;
+
+ f = kzalloc(sizeof(*f), GFP_KERNEL);
+- if (f == NULL) {
+- pr_debug("ALSA: seq: malloc failed for snd_seq_fifo_new() \n");
++ if (!f)
+ return NULL;
+- }
+
+ f->pool = snd_seq_pool_new(poolsize);
+ if (f->pool == NULL) {
+diff --git a/sound/core/seq/seq_memory.c b/sound/core/seq/seq_memory.c
+index ba8e4a64e13e..c850345c43b5 100644
+--- a/sound/core/seq/seq_memory.c
++++ b/sound/core/seq/seq_memory.c
+@@ -383,17 +383,20 @@ int snd_seq_pool_init(struct snd_seq_pool *pool)
+
+ if (snd_BUG_ON(!pool))
+ return -EINVAL;
+- if (pool->ptr) /* should be atomic? */
+- return 0;
+
+- pool->ptr = vmalloc(sizeof(struct snd_seq_event_cell) * pool->size);
+- if (pool->ptr == NULL) {
+- pr_debug("ALSA: seq: malloc for sequencer events failed\n");
++ cellptr = vmalloc(sizeof(struct snd_seq_event_cell) * pool->size);
++ if (!cellptr)
+ return -ENOMEM;
+- }
+
+ /* add new cells to the free cell list */
+ spin_lock_irqsave(&pool->lock, flags);
++ if (pool->ptr) {
++ spin_unlock_irqrestore(&pool->lock, flags);
++ vfree(cellptr);
++ return 0;
++ }
++
++ pool->ptr = cellptr;
+ pool->free = NULL;
+
+ for (cell = 0; cell < pool->size; cell++) {
+@@ -463,10 +466,8 @@ struct snd_seq_pool *snd_seq_pool_new(int poolsize)
+
+ /* create pool block */
+ pool = kzalloc(sizeof(*pool), GFP_KERNEL);
+- if (pool == NULL) {
+- pr_debug("ALSA: seq: malloc failed for pool\n");
++ if (!pool)
+ return NULL;
+- }
+ spin_lock_init(&pool->lock);
+ pool->ptr = NULL;
+ pool->free = NULL;
+diff --git a/sound/core/seq/seq_ports.c b/sound/core/seq/seq_ports.c
+index 2dcdf81e0abb..9c1c8d50f593 100644
+--- a/sound/core/seq/seq_ports.c
++++ b/sound/core/seq/seq_ports.c
+@@ -141,10 +141,8 @@ struct snd_seq_client_port *snd_seq_create_port(struct snd_seq_client *client,
+
+ /* create a new port */
+ new_port = kzalloc(sizeof(*new_port), GFP_KERNEL);
+- if (! new_port) {
+- pr_debug("ALSA: seq: malloc failed for registering client port\n");
++ if (!new_port)
+ return NULL; /* failure, out of memory */
+- }
+ /* init port data */
+ new_port->addr.client = client->number;
+ new_port->addr.port = -1;
+@@ -540,19 +538,22 @@ static void delete_and_unsubscribe_port(struct snd_seq_client *client,
+ bool is_src, bool ack)
+ {
+ struct snd_seq_port_subs_info *grp;
++ struct list_head *list;
++ bool empty;
+
+ grp = is_src ? &port->c_src : &port->c_dest;
++ list = is_src ? &subs->src_list : &subs->dest_list;
+ down_write(&grp->list_mutex);
+ write_lock_irq(&grp->list_lock);
+- if (is_src)
+- list_del(&subs->src_list);
+- else
+- list_del(&subs->dest_list);
++ empty = list_empty(list);
++ if (!empty)
++ list_del_init(list);
+ grp->exclusive = 0;
+ write_unlock_irq(&grp->list_lock);
+ up_write(&grp->list_mutex);
+
+- unsubscribe_port(client, port, grp, &subs->info, ack);
++ if (!empty)
++ unsubscribe_port(client, port, grp, &subs->info, ack);
+ }
+
+ /* connect two ports */
+diff --git a/sound/core/seq/seq_prioq.c b/sound/core/seq/seq_prioq.c
+index 021b02bc9330..bc1c8488fc2a 100644
+--- a/sound/core/seq/seq_prioq.c
++++ b/sound/core/seq/seq_prioq.c
+@@ -59,10 +59,8 @@ struct snd_seq_prioq *snd_seq_prioq_new(void)
+ struct snd_seq_prioq *f;
+
+ f = kzalloc(sizeof(*f), GFP_KERNEL);
+- if (f == NULL) {
+- pr_debug("ALSA: seq: malloc failed for snd_seq_prioq_new()\n");
++ if (!f)
+ return NULL;
+- }
+
+ spin_lock_init(&f->lock);
+ f->head = NULL;
+diff --git a/sound/core/seq/seq_queue.c b/sound/core/seq/seq_queue.c
+index aad4878cee55..a0cda38205b9 100644
+--- a/sound/core/seq/seq_queue.c
++++ b/sound/core/seq/seq_queue.c
+@@ -111,10 +111,8 @@ static struct snd_seq_queue *queue_new(int owner, int locked)
+ struct snd_seq_queue *q;
+
+ q = kzalloc(sizeof(*q), GFP_KERNEL);
+- if (q == NULL) {
+- pr_debug("ALSA: seq: malloc failed for snd_seq_queue_new()\n");
++ if (!q)
+ return NULL;
+- }
+
+ spin_lock_init(&q->owner_lock);
+ spin_lock_init(&q->check_lock);
+diff --git a/sound/core/seq/seq_timer.c b/sound/core/seq/seq_timer.c
+index c943dc41c6fe..a2468f1101d1 100644
+--- a/sound/core/seq/seq_timer.c
++++ b/sound/core/seq/seq_timer.c
+@@ -56,10 +56,8 @@ struct snd_seq_timer *snd_seq_timer_new(void)
+ struct snd_seq_timer *tmr;
+
+ tmr = kzalloc(sizeof(*tmr), GFP_KERNEL);
+- if (tmr == NULL) {
+- pr_debug("ALSA: seq: malloc failed for snd_seq_timer_new() \n");
++ if (!tmr)
+ return NULL;
+- }
+ spin_lock_init(&tmr->lock);
+
+ /* reset setup to defaults */
+diff --git a/sound/core/timer.c b/sound/core/timer.c
+index 942f36eb6946..4927a3c88340 100644
+--- a/sound/core/timer.c
++++ b/sound/core/timer.c
+@@ -65,6 +65,7 @@ struct snd_timer_user {
+ int qtail;
+ int qused;
+ int queue_size;
++ bool disconnected;
+ struct snd_timer_read *queue;
+ struct snd_timer_tread *tqueue;
+ spinlock_t qlock;
+@@ -290,6 +291,9 @@ int snd_timer_open(struct snd_timer_instance **ti,
+ mutex_unlock(®ister_mutex);
+ return -ENOMEM;
+ }
++ /* take a card refcount for safe disconnection */
++ if (timer->card)
++ get_device(&timer->card->card_dev);
+ timeri->slave_class = tid->dev_sclass;
+ timeri->slave_id = slave_id;
+ if (list_empty(&timer->open_list_head) && timer->hw.open)
+@@ -359,6 +363,9 @@ int snd_timer_close(struct snd_timer_instance *timeri)
+ }
+ spin_unlock(&timer->lock);
+ spin_unlock_irq(&slave_active_lock);
++ /* release a card refcount for safe disconnection */
++ if (timer->card)
++ put_device(&timer->card->card_dev);
+ mutex_unlock(®ister_mutex);
+ }
+ out:
+@@ -415,7 +422,7 @@ static void snd_timer_notify1(struct snd_timer_instance *ti, int event)
+ spin_lock_irqsave(&timer->lock, flags);
+ list_for_each_entry(ts, &ti->slave_active_head, active_list)
+ if (ts->ccallback)
+- ts->ccallback(ti, event + 100, &tstamp, resolution);
++ ts->ccallback(ts, event + 100, &tstamp, resolution);
+ spin_unlock_irqrestore(&timer->lock, flags);
+ }
+
+@@ -479,6 +486,8 @@ int snd_timer_start(struct snd_timer_instance *timeri, unsigned int ticks)
+ timer = timeri->timer;
+ if (timer == NULL)
+ return -EINVAL;
++ if (timer->card && timer->card->shutdown)
++ return -ENODEV;
+ spin_lock_irqsave(&timer->lock, flags);
+ if (timeri->flags & (SNDRV_TIMER_IFLG_RUNNING |
+ SNDRV_TIMER_IFLG_START)) {
+@@ -509,9 +518,13 @@ static int _snd_timer_stop(struct snd_timer_instance *timeri, int event)
+ spin_unlock_irqrestore(&slave_active_lock, flags);
+ return -EBUSY;
+ }
++ if (timeri->timer)
++ spin_lock(&timeri->timer->lock);
+ timeri->flags &= ~SNDRV_TIMER_IFLG_RUNNING;
+ list_del_init(&timeri->ack_list);
+ list_del_init(&timeri->active_list);
++ if (timeri->timer)
++ spin_unlock(&timeri->timer->lock);
+ spin_unlock_irqrestore(&slave_active_lock, flags);
+ goto __end;
+ }
+@@ -526,6 +539,10 @@ static int _snd_timer_stop(struct snd_timer_instance *timeri, int event)
+ }
+ list_del_init(&timeri->ack_list);
+ list_del_init(&timeri->active_list);
++ if (timer->card && timer->card->shutdown) {
++ spin_unlock_irqrestore(&timer->lock, flags);
++ return 0;
++ }
+ if ((timeri->flags & SNDRV_TIMER_IFLG_RUNNING) &&
+ !(--timer->running)) {
+ timer->hw.stop(timer);
+@@ -586,6 +603,8 @@ int snd_timer_continue(struct snd_timer_instance *timeri)
+ timer = timeri->timer;
+ if (! timer)
+ return -EINVAL;
++ if (timer->card && timer->card->shutdown)
++ return -ENODEV;
+ spin_lock_irqsave(&timer->lock, flags);
+ if (timeri->flags & SNDRV_TIMER_IFLG_RUNNING) {
+ result = -EBUSY;
+@@ -654,6 +673,9 @@ static void snd_timer_tasklet(unsigned long arg)
+ unsigned long resolution, ticks;
+ unsigned long flags;
+
++ if (timer->card && timer->card->shutdown)
++ return;
++
+ spin_lock_irqsave(&timer->lock, flags);
+ /* now process all callbacks */
+ while (!list_empty(&timer->sack_list_head)) {
+@@ -694,6 +716,9 @@ void snd_timer_interrupt(struct snd_timer * timer, unsigned long ticks_left)
+ if (timer == NULL)
+ return;
+
++ if (timer->card && timer->card->shutdown)
++ return;
++
+ spin_lock_irqsave(&timer->lock, flags);
+
+ /* remember the current resolution */
+@@ -906,11 +931,28 @@ static int snd_timer_dev_register(struct snd_device *dev)
+ return 0;
+ }
+
++/* just for reference in snd_timer_dev_disconnect() below */
++static void snd_timer_user_ccallback(struct snd_timer_instance *timeri,
++ int event, struct timespec *tstamp,
++ unsigned long resolution);
++
+ static int snd_timer_dev_disconnect(struct snd_device *device)
+ {
+ struct snd_timer *timer = device->device_data;
++ struct snd_timer_instance *ti;
++
+ mutex_lock(®ister_mutex);
+ list_del_init(&timer->device_list);
++ /* wake up pending sleepers */
++ list_for_each_entry(ti, &timer->open_list_head, open_list) {
++ /* FIXME: better to have a ti.disconnect() op */
++ if (ti->ccallback == snd_timer_user_ccallback) {
++ struct snd_timer_user *tu = ti->callback_data;
++
++ tu->disconnected = true;
++ wake_up(&tu->qchange_sleep);
++ }
++ }
+ mutex_unlock(®ister_mutex);
+ return 0;
+ }
+@@ -921,6 +963,8 @@ void snd_timer_notify(struct snd_timer *timer, int event, struct timespec *tstam
+ unsigned long resolution = 0;
+ struct snd_timer_instance *ti, *ts;
+
++ if (timer->card && timer->card->shutdown)
++ return;
+ if (! (timer->hw.flags & SNDRV_TIMER_HW_SLAVE))
+ return;
+ if (snd_BUG_ON(event < SNDRV_TIMER_EVENT_MSTART ||
+@@ -1081,6 +1125,8 @@ static void snd_timer_proc_read(struct snd_info_entry *entry,
+
+ mutex_lock(®ister_mutex);
+ list_for_each_entry(timer, &snd_timer_list, device_list) {
++ if (timer->card && timer->card->shutdown)
++ continue;
+ switch (timer->tmr_class) {
+ case SNDRV_TIMER_CLASS_GLOBAL:
+ snd_iprintf(buffer, "G%i: ", timer->tmr_device);
+@@ -1876,6 +1922,7 @@ static ssize_t snd_timer_user_read(struct file *file, char __user *buffer,
+ {
+ struct snd_timer_user *tu;
+ long result = 0, unit;
++ int qhead;
+ int err = 0;
+
+ tu = file->private_data;
+@@ -1887,7 +1934,7 @@ static ssize_t snd_timer_user_read(struct file *file, char __user *buffer,
+
+ if ((file->f_flags & O_NONBLOCK) != 0 || result > 0) {
+ err = -EAGAIN;
+- break;
++ goto _error;
+ }
+
+ set_current_state(TASK_INTERRUPTIBLE);
+@@ -1900,40 +1947,39 @@ static ssize_t snd_timer_user_read(struct file *file, char __user *buffer,
+
+ remove_wait_queue(&tu->qchange_sleep, &wait);
+
++ if (tu->disconnected) {
++ err = -ENODEV;
++ goto _error;
++ }
+ if (signal_pending(current)) {
+ err = -ERESTARTSYS;
+- break;
++ goto _error;
+ }
+ }
+
++ qhead = tu->qhead++;
++ tu->qhead %= tu->queue_size;
+ spin_unlock_irq(&tu->qlock);
+- if (err < 0)
+- goto _error;
+
+ if (tu->tread) {
+- if (copy_to_user(buffer, &tu->tqueue[tu->qhead++],
+- sizeof(struct snd_timer_tread))) {
++ if (copy_to_user(buffer, &tu->tqueue[qhead],
++ sizeof(struct snd_timer_tread)))
+ err = -EFAULT;
+- goto _error;
+- }
+ } else {
+- if (copy_to_user(buffer, &tu->queue[tu->qhead++],
+- sizeof(struct snd_timer_read))) {
++ if (copy_to_user(buffer, &tu->queue[qhead],
++ sizeof(struct snd_timer_read)))
+ err = -EFAULT;
+- goto _error;
+- }
+ }
+
+- tu->qhead %= tu->queue_size;
+-
+- result += unit;
+- buffer += unit;
+-
+ spin_lock_irq(&tu->qlock);
+ tu->qused--;
++ if (err < 0)
++ goto _error;
++ result += unit;
++ buffer += unit;
+ }
+- spin_unlock_irq(&tu->qlock);
+ _error:
++ spin_unlock_irq(&tu->qlock);
+ return result > 0 ? result : err;
+ }
+
+@@ -1949,6 +1995,8 @@ static unsigned int snd_timer_user_poll(struct file *file, poll_table * wait)
+ mask = 0;
+ if (tu->qused)
+ mask |= POLLIN | POLLRDNORM;
++ if (tu->disconnected)
++ mask |= POLLERR;
+
+ return mask;
+ }
+diff --git a/sound/drivers/dummy.c b/sound/drivers/dummy.c
+index 1e29a1983791..387bb8f603ac 100644
+--- a/sound/drivers/dummy.c
++++ b/sound/drivers/dummy.c
+@@ -87,7 +87,7 @@ MODULE_PARM_DESC(pcm_substreams, "PCM substreams # (1-128) for dummy driver.");
+ module_param(fake_buffer, bool, 0444);
+ MODULE_PARM_DESC(fake_buffer, "Fake buffer allocations.");
+ #ifdef CONFIG_HIGH_RES_TIMERS
+-module_param(hrtimer, bool, 0444);
++module_param(hrtimer, bool, 0644);
+ MODULE_PARM_DESC(hrtimer, "Use hrtimer as the timer source.");
+ #endif
+
+@@ -109,6 +109,9 @@ struct dummy_timer_ops {
+ snd_pcm_uframes_t (*pointer)(struct snd_pcm_substream *);
+ };
+
++#define get_dummy_ops(substream) \
++ (*(const struct dummy_timer_ops **)(substream)->runtime->private_data)
++
+ struct dummy_model {
+ const char *name;
+ int (*playback_constraints)(struct snd_pcm_runtime *runtime);
+@@ -137,7 +140,6 @@ struct snd_dummy {
+ int iobox;
+ struct snd_kcontrol *cd_volume_ctl;
+ struct snd_kcontrol *cd_switch_ctl;
+- const struct dummy_timer_ops *timer_ops;
+ };
+
+ /*
+@@ -231,6 +233,8 @@ struct dummy_model *dummy_models[] = {
+ */
+
+ struct dummy_systimer_pcm {
++ /* ops must be the first item */
++ const struct dummy_timer_ops *timer_ops;
+ spinlock_t lock;
+ struct timer_list timer;
+ unsigned long base_time;
+@@ -368,6 +372,8 @@ static struct dummy_timer_ops dummy_systimer_ops = {
+ */
+
+ struct dummy_hrtimer_pcm {
++ /* ops must be the first item */
++ const struct dummy_timer_ops *timer_ops;
+ ktime_t base_time;
+ ktime_t period_time;
+ atomic_t running;
+@@ -494,31 +500,25 @@ static struct dummy_timer_ops dummy_hrtimer_ops = {
+
+ static int dummy_pcm_trigger(struct snd_pcm_substream *substream, int cmd)
+ {
+- struct snd_dummy *dummy = snd_pcm_substream_chip(substream);
+-
+ switch (cmd) {
+ case SNDRV_PCM_TRIGGER_START:
+ case SNDRV_PCM_TRIGGER_RESUME:
+- return dummy->timer_ops->start(substream);
++ return get_dummy_ops(substream)->start(substream);
+ case SNDRV_PCM_TRIGGER_STOP:
+ case SNDRV_PCM_TRIGGER_SUSPEND:
+- return dummy->timer_ops->stop(substream);
++ return get_dummy_ops(substream)->stop(substream);
+ }
+ return -EINVAL;
+ }
+
+ static int dummy_pcm_prepare(struct snd_pcm_substream *substream)
+ {
+- struct snd_dummy *dummy = snd_pcm_substream_chip(substream);
+-
+- return dummy->timer_ops->prepare(substream);
++ return get_dummy_ops(substream)->prepare(substream);
+ }
+
+ static snd_pcm_uframes_t dummy_pcm_pointer(struct snd_pcm_substream *substream)
+ {
+- struct snd_dummy *dummy = snd_pcm_substream_chip(substream);
+-
+- return dummy->timer_ops->pointer(substream);
++ return get_dummy_ops(substream)->pointer(substream);
+ }
+
+ static struct snd_pcm_hardware dummy_pcm_hardware = {
+@@ -564,17 +564,19 @@ static int dummy_pcm_open(struct snd_pcm_substream *substream)
+ struct snd_dummy *dummy = snd_pcm_substream_chip(substream);
+ struct dummy_model *model = dummy->model;
+ struct snd_pcm_runtime *runtime = substream->runtime;
++ const struct dummy_timer_ops *ops;
+ int err;
+
+- dummy->timer_ops = &dummy_systimer_ops;
++ ops = &dummy_systimer_ops;
+ #ifdef CONFIG_HIGH_RES_TIMERS
+ if (hrtimer)
+- dummy->timer_ops = &dummy_hrtimer_ops;
++ ops = &dummy_hrtimer_ops;
+ #endif
+
+- err = dummy->timer_ops->create(substream);
++ err = ops->create(substream);
+ if (err < 0)
+ return err;
++ get_dummy_ops(substream) = ops;
+
+ runtime->hw = dummy->pcm_hw;
+ if (substream->pcm->device & 1) {
+@@ -596,7 +598,7 @@ static int dummy_pcm_open(struct snd_pcm_substream *substream)
+ err = model->capture_constraints(substream->runtime);
+ }
+ if (err < 0) {
+- dummy->timer_ops->free(substream);
++ get_dummy_ops(substream)->free(substream);
+ return err;
+ }
+ return 0;
+@@ -604,8 +606,7 @@ static int dummy_pcm_open(struct snd_pcm_substream *substream)
+
+ static int dummy_pcm_close(struct snd_pcm_substream *substream)
+ {
+- struct snd_dummy *dummy = snd_pcm_substream_chip(substream);
+- dummy->timer_ops->free(substream);
++ get_dummy_ops(substream)->free(substream);
+ return 0;
+ }
+
+diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
+index 99e952293498..8e8ccde973df 100644
+--- a/sound/pci/hda/patch_hdmi.c
++++ b/sound/pci/hda/patch_hdmi.c
+@@ -435,7 +435,8 @@ static int hdmi_eld_ctl_get(struct snd_kcontrol *kcontrol,
+ eld = &per_pin->sink_eld;
+
+ mutex_lock(&per_pin->lock);
+- if (eld->eld_size > ARRAY_SIZE(ucontrol->value.bytes.data)) {
++ if (eld->eld_size > ARRAY_SIZE(ucontrol->value.bytes.data) ||
++ eld->eld_size > ELD_MAX_SIZE) {
+ mutex_unlock(&per_pin->lock);
+ snd_BUG();
+ return -EINVAL;
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index d36cdb27a02c..f9f929d5130a 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -2198,6 +2198,7 @@ static const struct snd_pci_quirk alc882_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x104d, 0x9047, "Sony Vaio TT", ALC889_FIXUP_VAIO_TT),
+ SND_PCI_QUIRK(0x104d, 0x905a, "Sony Vaio Z", ALC882_FIXUP_NO_PRIMARY_HP),
+ SND_PCI_QUIRK(0x104d, 0x9043, "Sony Vaio VGC-LN51JGB", ALC882_FIXUP_NO_PRIMARY_HP),
++ SND_PCI_QUIRK(0x104d, 0x9044, "Sony VAIO AiO", ALC882_FIXUP_NO_PRIMARY_HP),
+
+ /* All Apple entries are in codec SSIDs */
+ SND_PCI_QUIRK(0x106b, 0x00a0, "MacBookPro 3,1", ALC889_FIXUP_MBP_VREF),
+diff --git a/sound/soc/codecs/rt5645.c b/sound/soc/codecs/rt5645.c
+index d16331e0b64d..35a27281ed86 100644
+--- a/sound/soc/codecs/rt5645.c
++++ b/sound/soc/codecs/rt5645.c
+@@ -474,7 +474,7 @@ static const struct snd_kcontrol_new rt5645_snd_controls[] = {
+
+ /* IN1/IN2 Control */
+ SOC_SINGLE_TLV("IN1 Boost", RT5645_IN1_CTRL1,
+- RT5645_BST_SFT1, 8, 0, bst_tlv),
++ RT5645_BST_SFT1, 12, 0, bst_tlv),
+ SOC_SINGLE_TLV("IN2 Boost", RT5645_IN2_CTRL,
+ RT5645_BST_SFT2, 8, 0, bst_tlv),
+
+diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c
+index 57277dd79e11..f8893f51d47b 100644
+--- a/sound/soc/soc-pcm.c
++++ b/sound/soc/soc-pcm.c
+@@ -1668,7 +1668,8 @@ int dpcm_be_dai_hw_free(struct snd_soc_pcm_runtime *fe, int stream)
+ (be->dpcm[stream].state != SND_SOC_DPCM_STATE_PREPARE) &&
+ (be->dpcm[stream].state != SND_SOC_DPCM_STATE_HW_FREE) &&
+ (be->dpcm[stream].state != SND_SOC_DPCM_STATE_PAUSED) &&
+- (be->dpcm[stream].state != SND_SOC_DPCM_STATE_STOP))
++ (be->dpcm[stream].state != SND_SOC_DPCM_STATE_STOP) &&
++ (be->dpcm[stream].state != SND_SOC_DPCM_STATE_SUSPEND))
+ continue;
+
+ dev_dbg(be->dev, "ASoC: hw_free BE %s\n",
+diff --git a/sound/usb/midi.c b/sound/usb/midi.c
+index 5bfb695547f8..92ae88bdff7e 100644
+--- a/sound/usb/midi.c
++++ b/sound/usb/midi.c
+@@ -2406,7 +2406,6 @@ int snd_usbmidi_create(struct snd_card *card,
+ else
+ err = snd_usbmidi_create_endpoints(umidi, endpoints);
+ if (err < 0) {
+- snd_usbmidi_free(umidi);
+ return err;
+ }
+
^ permalink raw reply related [flat|nested] 67+ messages in thread
* [gentoo-commits] proj/linux-patches:3.18 commit in: /
@ 2016-03-17 22:50 Mike Pagano
0 siblings, 0 replies; 67+ messages in thread
From: Mike Pagano @ 2016-03-17 22:50 UTC (permalink / raw
To: gentoo-commits
commit: 17dfbe391ee8af34cdd598d8871504327cf9c210
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Thu Mar 17 22:50:28 2016 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Thu Mar 17 22:50:28 2016 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=17dfbe39
Linux patch 3.18.29
0000_README | 4 +
1028_linux-3.18.29.patch | 3850 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 3854 insertions(+)
diff --git a/0000_README b/0000_README
index 124258e..51c140d 100644
--- a/0000_README
+++ b/0000_README
@@ -155,6 +155,10 @@ Patch: 1027_linux-3.18.28.patch
From: http://www.kernel.org
Desc: Linux 3.18.28
+Patch: 1028_linux-3.18.29.patch
+From: http://www.kernel.org
+Desc: Linux 3.18.29
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1028_linux-3.18.29.patch b/1028_linux-3.18.29.patch
new file mode 100644
index 0000000..c935dc3
--- /dev/null
+++ b/1028_linux-3.18.29.patch
@@ -0,0 +1,3850 @@
+diff --git a/Makefile b/Makefile
+index f849f29ce405..13063ba47412 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 18
+-SUBLEVEL = 28
++SUBLEVEL = 29
+ EXTRAVERSION =
+ NAME = Diseased Newt
+
+diff --git a/arch/arm/kvm/guest.c b/arch/arm/kvm/guest.c
+index 8c97208b9b97..be68848071fd 100644
+--- a/arch/arm/kvm/guest.c
++++ b/arch/arm/kvm/guest.c
+@@ -173,7 +173,7 @@ static int get_timer_reg(struct kvm_vcpu *vcpu, const struct kvm_one_reg *reg)
+ u64 val;
+
+ val = kvm_arm_timer_get_reg(vcpu, reg->id);
+- return copy_to_user(uaddr, &val, KVM_REG_SIZE(reg->id));
++ return copy_to_user(uaddr, &val, KVM_REG_SIZE(reg->id)) ? -EFAULT : 0;
+ }
+
+ static unsigned long num_core_regs(void)
+diff --git a/arch/arm64/kernel/suspend.c b/arch/arm64/kernel/suspend.c
+index 2d6b6065fe7f..23e35de789f7 100644
+--- a/arch/arm64/kernel/suspend.c
++++ b/arch/arm64/kernel/suspend.c
+@@ -1,3 +1,4 @@
++#include <linux/ftrace.h>
+ #include <linux/percpu.h>
+ #include <linux/slab.h>
+ #include <asm/cacheflush.h>
+@@ -92,6 +93,13 @@ int __cpu_suspend(unsigned long arg, int (*fn)(unsigned long))
+ local_dbg_save(flags);
+
+ /*
++ * Function graph tracer state gets incosistent when the kernel
++ * calls functions that never return (aka suspend finishers) hence
++ * disable graph tracing during their execution.
++ */
++ pause_graph_tracing();
++
++ /*
+ * mm context saved on the stack, it will be restored when
+ * the cpu comes out of reset through the identity mapped
+ * page tables, so that the thread address space is properly
+@@ -128,6 +136,8 @@ int __cpu_suspend(unsigned long arg, int (*fn)(unsigned long))
+ hw_breakpoint_restore(NULL);
+ }
+
++ unpause_graph_tracing();
++
+ /*
+ * Restore pstate flags. OS lock and mdscr have been already
+ * restored, so from this point onwards, debugging is fully
+diff --git a/arch/arm64/kvm/guest.c b/arch/arm64/kvm/guest.c
+index 84d5959ff874..61ec16bd528b 100644
+--- a/arch/arm64/kvm/guest.c
++++ b/arch/arm64/kvm/guest.c
+@@ -184,7 +184,7 @@ static int get_timer_reg(struct kvm_vcpu *vcpu, const struct kvm_one_reg *reg)
+ u64 val;
+
+ val = kvm_arm_timer_get_reg(vcpu, reg->id);
+- return copy_to_user(uaddr, &val, KVM_REG_SIZE(reg->id));
++ return copy_to_user(uaddr, &val, KVM_REG_SIZE(reg->id)) ? -EFAULT : 0;
+ }
+
+ /**
+diff --git a/arch/mips/kernel/traps.c b/arch/mips/kernel/traps.c
+index f506c53cb4f5..2012a5a3055b 100644
+--- a/arch/mips/kernel/traps.c
++++ b/arch/mips/kernel/traps.c
+@@ -692,15 +692,15 @@ static int simulate_sync(struct pt_regs *regs, unsigned int opcode)
+ asmlinkage void do_ov(struct pt_regs *regs)
+ {
+ enum ctx_state prev_state;
+- siginfo_t info;
++ siginfo_t info = {
++ .si_signo = SIGFPE,
++ .si_code = FPE_INTOVF,
++ .si_addr = (void __user *)regs->cp0_epc,
++ };
+
+ prev_state = exception_enter();
+ die_if_kernel("Integer overflow", regs);
+
+- info.si_code = FPE_INTOVF;
+- info.si_signo = SIGFPE;
+- info.si_errno = 0;
+- info.si_addr = (void __user *) regs->cp0_epc;
+ force_sig_info(SIGFPE, &info, current);
+ exception_exit(prev_state);
+ }
+@@ -803,7 +803,7 @@ out:
+ static void do_trap_or_bp(struct pt_regs *regs, unsigned int code,
+ const char *str)
+ {
+- siginfo_t info;
++ siginfo_t info = { 0 };
+ char b[40];
+
+ #ifdef CONFIG_KGDB_LOW_LEVEL_TRAP
+@@ -831,7 +831,6 @@ static void do_trap_or_bp(struct pt_regs *regs, unsigned int code,
+ else
+ info.si_code = FPE_INTOVF;
+ info.si_signo = SIGFPE;
+- info.si_errno = 0;
+ info.si_addr = (void __user *) regs->cp0_epc;
+ force_sig_info(SIGFPE, &info, current);
+ break;
+diff --git a/arch/s390/kernel/compat_signal.c b/arch/s390/kernel/compat_signal.c
+index 14c3e80e003a..eb95315109e0 100644
+--- a/arch/s390/kernel/compat_signal.c
++++ b/arch/s390/kernel/compat_signal.c
+@@ -293,7 +293,7 @@ static int restore_sigregs_ext32(struct pt_regs *regs,
+
+ /* Restore high gprs from signal stack */
+ if (__copy_from_user(&gprs_high, &sregs_ext->gprs_high,
+- sizeof(&sregs_ext->gprs_high)))
++ sizeof(sregs_ext->gprs_high)))
+ return -EFAULT;
+ for (i = 0; i < NUM_GPRS; i++)
+ *(__u32 *)®s->gprs[i] = gprs_high[i];
+diff --git a/arch/x86/ia32/ia32entry.S b/arch/x86/ia32/ia32entry.S
+index ffe71228fc10..a39e89eaa763 100644
+--- a/arch/x86/ia32/ia32entry.S
++++ b/arch/x86/ia32/ia32entry.S
+@@ -422,6 +422,7 @@ ENTRY(ia32_syscall)
+ /*CFI_REL_OFFSET cs,CS-RIP*/
+ CFI_REL_OFFSET rip,RIP-RIP
+ PARAVIRT_ADJUST_EXCEPTION_FRAME
++ ASM_CLAC /* Do this early to minimize exposure */
+ SWAPGS
+ /*
+ * No need to follow this irqs on/off section: the syscall
+diff --git a/arch/x86/kernel/acpi/sleep.c b/arch/x86/kernel/acpi/sleep.c
+index d1daead5fcdd..adb3eaf8fe2a 100644
+--- a/arch/x86/kernel/acpi/sleep.c
++++ b/arch/x86/kernel/acpi/sleep.c
+@@ -16,6 +16,7 @@
+ #include <asm/cacheflush.h>
+ #include <asm/realmode.h>
+
++#include <linux/ftrace.h>
+ #include "../../realmode/rm/wakeup.h"
+ #include "sleep.h"
+
+@@ -107,7 +108,13 @@ int x86_acpi_suspend_lowlevel(void)
+ saved_magic = 0x123456789abcdef0L;
+ #endif /* CONFIG_64BIT */
+
++ /*
++ * Pause/unpause graph tracing around do_suspend_lowlevel as it has
++ * inconsistent call/return info after it jumps to the wakeup vector.
++ */
++ pause_graph_tracing();
+ do_suspend_lowlevel();
++ unpause_graph_tracing();
+ return 0;
+ }
+
+diff --git a/arch/x86/kvm/paging_tmpl.h b/arch/x86/kvm/paging_tmpl.h
+index 6e6d115fe9b5..d537c9badeb6 100644
+--- a/arch/x86/kvm/paging_tmpl.h
++++ b/arch/x86/kvm/paging_tmpl.h
+@@ -257,7 +257,7 @@ static int FNAME(update_accessed_dirty_bits)(struct kvm_vcpu *vcpu,
+ return ret;
+
+ mark_page_dirty(vcpu->kvm, table_gfn);
+- walker->ptes[level] = pte;
++ walker->ptes[level - 1] = pte;
+ }
+ return 0;
+ }
+diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
+index 0bb431c3f74e..9fbf7c7fcbd9 100644
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -2065,6 +2065,8 @@ static void accumulate_steal_time(struct kvm_vcpu *vcpu)
+
+ static void record_steal_time(struct kvm_vcpu *vcpu)
+ {
++ accumulate_steal_time(vcpu);
++
+ if (!(vcpu->arch.st.msr_val & KVM_MSR_ENABLED))
+ return;
+
+@@ -2198,12 +2200,6 @@ int kvm_set_msr_common(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
+ if (!(data & KVM_MSR_ENABLED))
+ break;
+
+- vcpu->arch.st.last_steal = current->sched_info.run_delay;
+-
+- preempt_disable();
+- accumulate_steal_time(vcpu);
+- preempt_enable();
+-
+ kvm_make_request(KVM_REQ_STEAL_UPDATE, vcpu);
+
+ break;
+@@ -2903,7 +2899,6 @@ void kvm_arch_vcpu_load(struct kvm_vcpu *vcpu, int cpu)
+ vcpu->cpu = cpu;
+ }
+
+- accumulate_steal_time(vcpu);
+ kvm_make_request(KVM_REQ_STEAL_UPDATE, vcpu);
+ }
+
+diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
+index 62dcd80ec2c0..f96e4d4f5319 100644
+--- a/drivers/ata/ahci.c
++++ b/drivers/ata/ahci.c
+@@ -363,6 +363,22 @@ static const struct pci_device_id ahci_pci_tbl[] = {
+ { PCI_VDEVICE(INTEL, 0xa105), board_ahci }, /* Sunrise Point-H RAID */
+ { PCI_VDEVICE(INTEL, 0xa107), board_ahci }, /* Sunrise Point-H RAID */
+ { PCI_VDEVICE(INTEL, 0xa10f), board_ahci }, /* Sunrise Point-H RAID */
++ { PCI_VDEVICE(INTEL, 0x2822), board_ahci }, /* Lewisburg RAID*/
++ { PCI_VDEVICE(INTEL, 0x2823), board_ahci }, /* Lewisburg AHCI*/
++ { PCI_VDEVICE(INTEL, 0x2826), board_ahci }, /* Lewisburg RAID*/
++ { PCI_VDEVICE(INTEL, 0x2827), board_ahci }, /* Lewisburg RAID*/
++ { PCI_VDEVICE(INTEL, 0xa182), board_ahci }, /* Lewisburg AHCI*/
++ { PCI_VDEVICE(INTEL, 0xa184), board_ahci }, /* Lewisburg RAID*/
++ { PCI_VDEVICE(INTEL, 0xa186), board_ahci }, /* Lewisburg RAID*/
++ { PCI_VDEVICE(INTEL, 0xa18e), board_ahci }, /* Lewisburg RAID*/
++ { PCI_VDEVICE(INTEL, 0xa1d2), board_ahci }, /* Lewisburg RAID*/
++ { PCI_VDEVICE(INTEL, 0xa1d6), board_ahci }, /* Lewisburg RAID*/
++ { PCI_VDEVICE(INTEL, 0xa202), board_ahci }, /* Lewisburg AHCI*/
++ { PCI_VDEVICE(INTEL, 0xa204), board_ahci }, /* Lewisburg RAID*/
++ { PCI_VDEVICE(INTEL, 0xa206), board_ahci }, /* Lewisburg RAID*/
++ { PCI_VDEVICE(INTEL, 0xa20e), board_ahci }, /* Lewisburg RAID*/
++ { PCI_VDEVICE(INTEL, 0xa252), board_ahci }, /* Lewisburg RAID*/
++ { PCI_VDEVICE(INTEL, 0xa256), board_ahci }, /* Lewisburg RAID*/
+
+ /* JMicron 360/1/3/5/6, match class to avoid IDE function */
+ { PCI_VENDOR_ID_JMICRON, PCI_ANY_ID, PCI_ANY_ID, PCI_ANY_ID,
+diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
+index 78d56c9390cc..f96be389cf98 100644
+--- a/drivers/ata/libata-scsi.c
++++ b/drivers/ata/libata-scsi.c
+@@ -674,19 +674,18 @@ static int ata_ioc32(struct ata_port *ap)
+ int ata_sas_scsi_ioctl(struct ata_port *ap, struct scsi_device *scsidev,
+ int cmd, void __user *arg)
+ {
+- int val = -EINVAL, rc = -EINVAL;
++ unsigned long val;
++ int rc = -EINVAL;
+ unsigned long flags;
+
+ switch (cmd) {
+- case ATA_IOC_GET_IO32:
++ case HDIO_GET_32BIT:
+ spin_lock_irqsave(ap->lock, flags);
+ val = ata_ioc32(ap);
+ spin_unlock_irqrestore(ap->lock, flags);
+- if (copy_to_user(arg, &val, 1))
+- return -EFAULT;
+- return 0;
++ return put_user(val, (unsigned long __user *)arg);
+
+- case ATA_IOC_SET_IO32:
++ case HDIO_SET_32BIT:
+ val = (unsigned long) arg;
+ rc = 0;
+ spin_lock_irqsave(ap->lock, flags);
+diff --git a/drivers/gpu/drm/ast/ast_main.c b/drivers/gpu/drm/ast/ast_main.c
+index 035dacc93382..fd5c5f3370f6 100644
+--- a/drivers/gpu/drm/ast/ast_main.c
++++ b/drivers/gpu/drm/ast/ast_main.c
+@@ -227,7 +227,7 @@ static int ast_get_dram_info(struct drm_device *dev)
+ } while (ast_read32(ast, 0x10000) != 0x01);
+ data = ast_read32(ast, 0x10004);
+
+- if (data & 0x400)
++ if (data & 0x40)
+ ast->dram_bus_width = 16;
+ else
+ ast->dram_bus_width = 32;
+diff --git a/drivers/gpu/drm/radeon/radeon_pm.c b/drivers/gpu/drm/radeon/radeon_pm.c
+index fa537c0602e8..d5ea5c106dd1 100644
+--- a/drivers/gpu/drm/radeon/radeon_pm.c
++++ b/drivers/gpu/drm/radeon/radeon_pm.c
+@@ -936,12 +936,6 @@ force:
+
+ /* update display watermarks based on new power state */
+ radeon_bandwidth_update(rdev);
+- /* update displays */
+- radeon_dpm_display_configuration_changed(rdev);
+-
+- rdev->pm.dpm.current_active_crtcs = rdev->pm.dpm.new_active_crtcs;
+- rdev->pm.dpm.current_active_crtc_count = rdev->pm.dpm.new_active_crtc_count;
+- rdev->pm.dpm.single_display = single_display;
+
+ /* wait for the rings to drain */
+ for (i = 0; i < RADEON_NUM_RINGS; i++) {
+@@ -958,6 +952,13 @@ force:
+
+ radeon_dpm_post_set_power_state(rdev);
+
++ /* update displays */
++ radeon_dpm_display_configuration_changed(rdev);
++
++ rdev->pm.dpm.current_active_crtcs = rdev->pm.dpm.new_active_crtcs;
++ rdev->pm.dpm.current_active_crtc_count = rdev->pm.dpm.new_active_crtc_count;
++ rdev->pm.dpm.single_display = single_display;
++
+ if (rdev->asic->dpm.force_performance_level) {
+ if (rdev->pm.dpm.thermal_active) {
+ enum radeon_dpm_forced_level level = rdev->pm.dpm.forced_level;
+diff --git a/drivers/hid/usbhid/hid-core.c b/drivers/hid/usbhid/hid-core.c
+index 97342ebc7de7..e318980f8d45 100644
+--- a/drivers/hid/usbhid/hid-core.c
++++ b/drivers/hid/usbhid/hid-core.c
+@@ -476,8 +476,6 @@ static void hid_ctrl(struct urb *urb)
+ struct usbhid_device *usbhid = hid->driver_data;
+ int unplug = 0, status = urb->status;
+
+- spin_lock(&usbhid->lock);
+-
+ switch (status) {
+ case 0: /* success */
+ if (usbhid->ctrl[usbhid->ctrltail].dir == USB_DIR_IN)
+@@ -497,6 +495,8 @@ static void hid_ctrl(struct urb *urb)
+ hid_warn(urb->dev, "ctrl urb status %d received\n", status);
+ }
+
++ spin_lock(&usbhid->lock);
++
+ if (unplug) {
+ usbhid->ctrltail = usbhid->ctrlhead;
+ } else {
+diff --git a/drivers/hwmon/ads1015.c b/drivers/hwmon/ads1015.c
+index f155b8380481..2b3105c8aed3 100644
+--- a/drivers/hwmon/ads1015.c
++++ b/drivers/hwmon/ads1015.c
+@@ -126,7 +126,7 @@ static int ads1015_reg_to_mv(struct i2c_client *client, unsigned int channel,
+ struct ads1015_data *data = i2c_get_clientdata(client);
+ unsigned int pga = data->channel_data[channel].pga;
+ int fullscale = fullscale_table[pga];
+- const unsigned mask = data->id == ads1115 ? 0x7fff : 0x7ff0;
++ const int mask = data->id == ads1115 ? 0x7fff : 0x7ff0;
+
+ return DIV_ROUND_CLOSEST(reg * fullscale, mask);
+ }
+diff --git a/drivers/iommu/amd_iommu_init.c b/drivers/iommu/amd_iommu_init.c
+index b0522f15730f..2f3475247f0f 100644
+--- a/drivers/iommu/amd_iommu_init.c
++++ b/drivers/iommu/amd_iommu_init.c
+@@ -227,6 +227,10 @@ static enum iommu_init_state init_state = IOMMU_START_STATE;
+ static int amd_iommu_enable_interrupts(void);
+ static int __init iommu_go_to_state(enum iommu_init_state state);
+
++static int iommu_pc_get_set_reg_val(struct amd_iommu *iommu,
++ u8 bank, u8 cntr, u8 fxn,
++ u64 *value, bool is_write);
++
+ static inline void update_last_devid(u16 devid)
+ {
+ if (devid > amd_iommu_last_bdf)
+@@ -1066,6 +1070,34 @@ static void amd_iommu_erratum_746_workaround(struct amd_iommu *iommu)
+ }
+
+ /*
++ * Family15h Model 30h-3fh (IOMMU Mishandles ATS Write Permission)
++ * Workaround:
++ * BIOS should enable ATS write permission check by setting
++ * L2_DEBUG_3[AtsIgnoreIWDis](D0F2xF4_x47[0]) = 1b
++ */
++static void amd_iommu_ats_write_check_workaround(struct amd_iommu *iommu)
++{
++ u32 value;
++
++ if ((boot_cpu_data.x86 != 0x15) ||
++ (boot_cpu_data.x86_model < 0x30) ||
++ (boot_cpu_data.x86_model > 0x3f))
++ return;
++
++ /* Test L2_DEBUG_3[AtsIgnoreIWDis] == 1 */
++ value = iommu_read_l2(iommu, 0x47);
++
++ if (value & BIT(0))
++ return;
++
++ /* Set L2_DEBUG_3[AtsIgnoreIWDis] = 1 */
++ iommu_write_l2(iommu, 0x47, value | BIT(0));
++
++ pr_info("AMD-Vi: Applying ATS write check workaround for IOMMU at %s\n",
++ dev_name(&iommu->dev->dev));
++}
++
++/*
+ * This function clues the initialization function for one IOMMU
+ * together and also allocates the command buffer and programs the
+ * hardware. It does NOT enable the IOMMU. This is done afterwards.
+@@ -1192,8 +1224,8 @@ static void init_iommu_perf_ctr(struct amd_iommu *iommu)
+ amd_iommu_pc_present = true;
+
+ /* Check if the performance counters can be written to */
+- if ((0 != amd_iommu_pc_get_set_reg_val(0, 0, 0, 0, &val, true)) ||
+- (0 != amd_iommu_pc_get_set_reg_val(0, 0, 0, 0, &val2, false)) ||
++ if ((0 != iommu_pc_get_set_reg_val(iommu, 0, 0, 0, &val, true)) ||
++ (0 != iommu_pc_get_set_reg_val(iommu, 0, 0, 0, &val2, false)) ||
+ (val != val2)) {
+ pr_err("AMD-Vi: Unable to write to IOMMU perf counter.\n");
+ amd_iommu_pc_present = false;
+@@ -1339,6 +1371,7 @@ static int iommu_init_pci(struct amd_iommu *iommu)
+ }
+
+ amd_iommu_erratum_746_workaround(iommu);
++ amd_iommu_ats_write_check_workaround(iommu);
+
+ iommu->iommu_dev = iommu_device_create(&iommu->dev->dev, iommu,
+ amd_iommu_groups, "ivhd%d",
+@@ -2363,22 +2396,15 @@ u8 amd_iommu_pc_get_max_counters(u16 devid)
+ }
+ EXPORT_SYMBOL(amd_iommu_pc_get_max_counters);
+
+-int amd_iommu_pc_get_set_reg_val(u16 devid, u8 bank, u8 cntr, u8 fxn,
++static int iommu_pc_get_set_reg_val(struct amd_iommu *iommu,
++ u8 bank, u8 cntr, u8 fxn,
+ u64 *value, bool is_write)
+ {
+- struct amd_iommu *iommu;
+ u32 offset;
+ u32 max_offset_lim;
+
+- /* Make sure the IOMMU PC resource is available */
+- if (!amd_iommu_pc_present)
+- return -ENODEV;
+-
+- /* Locate the iommu associated with the device ID */
+- iommu = amd_iommu_rlookup_table[devid];
+-
+ /* Check for valid iommu and pc register indexing */
+- if (WARN_ON((iommu == NULL) || (fxn > 0x28) || (fxn & 7)))
++ if (WARN_ON((fxn > 0x28) || (fxn & 7)))
+ return -ENODEV;
+
+ offset = (u32)(((0x40|bank) << 12) | (cntr << 8) | fxn);
+@@ -2402,3 +2428,16 @@ int amd_iommu_pc_get_set_reg_val(u16 devid, u8 bank, u8 cntr, u8 fxn,
+ return 0;
+ }
+ EXPORT_SYMBOL(amd_iommu_pc_get_set_reg_val);
++
++int amd_iommu_pc_get_set_reg_val(u16 devid, u8 bank, u8 cntr, u8 fxn,
++ u64 *value, bool is_write)
++{
++ struct amd_iommu *iommu = amd_iommu_rlookup_table[devid];
++
++ /* Make sure the IOMMU PC resource is available */
++ if (!amd_iommu_pc_present || iommu == NULL)
++ return -ENODEV;
++
++ return iommu_pc_get_set_reg_val(iommu, bank, cntr, fxn,
++ value, is_write);
++}
+diff --git a/drivers/media/i2c/adv7604.c b/drivers/media/i2c/adv7604.c
+index 47795ff71688..12cb0dee1721 100644
+--- a/drivers/media/i2c/adv7604.c
++++ b/drivers/media/i2c/adv7604.c
+@@ -1981,10 +1981,9 @@ static int adv7604_isr(struct v4l2_subdev *sd, u32 status, bool *handled)
+ }
+
+ /* tx 5v detect */
+- tx_5v = io_read(sd, 0x70) & info->cable_det_mask;
++ tx_5v = irq_reg_0x70 & info->cable_det_mask;
+ if (tx_5v) {
+ v4l2_dbg(1, debug, sd, "%s: tx_5v: 0x%x\n", __func__, tx_5v);
+- io_write(sd, 0x71, tx_5v);
+ adv7604_s_detect_tx_5v_ctrl(sd);
+ if (handled)
+ *handled = true;
+diff --git a/drivers/mtd/ubi/upd.c b/drivers/mtd/ubi/upd.c
+index 2a1b6e037e1a..0134ba32a057 100644
+--- a/drivers/mtd/ubi/upd.c
++++ b/drivers/mtd/ubi/upd.c
+@@ -193,7 +193,7 @@ int ubi_start_leb_change(struct ubi_device *ubi, struct ubi_volume *vol,
+ vol->changing_leb = 1;
+ vol->ch_lnum = req->lnum;
+
+- vol->upd_buf = vmalloc(req->bytes);
++ vol->upd_buf = vmalloc(ALIGN((int)req->bytes, ubi->min_io_size));
+ if (!vol->upd_buf)
+ return -ENOMEM;
+
+diff --git a/drivers/net/can/usb/ems_usb.c b/drivers/net/can/usb/ems_usb.c
+index 29d3f0938eb8..5c9f06cc35cc 100644
+--- a/drivers/net/can/usb/ems_usb.c
++++ b/drivers/net/can/usb/ems_usb.c
+@@ -117,6 +117,9 @@ MODULE_LICENSE("GPL v2");
+ */
+ #define EMS_USB_ARM7_CLOCK 8000000
+
++#define CPC_TX_QUEUE_TRIGGER_LOW 25
++#define CPC_TX_QUEUE_TRIGGER_HIGH 35
++
+ /*
+ * CAN-Message representation in a CPC_MSG. Message object type is
+ * CPC_MSG_TYPE_CAN_FRAME or CPC_MSG_TYPE_RTR_FRAME or
+@@ -278,6 +281,11 @@ static void ems_usb_read_interrupt_callback(struct urb *urb)
+ switch (urb->status) {
+ case 0:
+ dev->free_slots = dev->intr_in_buffer[1];
++ if(dev->free_slots > CPC_TX_QUEUE_TRIGGER_HIGH){
++ if (netif_queue_stopped(netdev)){
++ netif_wake_queue(netdev);
++ }
++ }
+ break;
+
+ case -ECONNRESET: /* unlink */
+@@ -528,8 +536,6 @@ static void ems_usb_write_bulk_callback(struct urb *urb)
+ /* Release context */
+ context->echo_index = MAX_TX_URBS;
+
+- if (netif_queue_stopped(netdev))
+- netif_wake_queue(netdev);
+ }
+
+ /*
+@@ -589,7 +595,7 @@ static int ems_usb_start(struct ems_usb *dev)
+ int err, i;
+
+ dev->intr_in_buffer[0] = 0;
+- dev->free_slots = 15; /* initial size */
++ dev->free_slots = 50; /* initial size */
+
+ for (i = 0; i < MAX_RX_URBS; i++) {
+ struct urb *urb = NULL;
+@@ -840,7 +846,7 @@ static netdev_tx_t ems_usb_start_xmit(struct sk_buff *skb, struct net_device *ne
+
+ /* Slow down tx path */
+ if (atomic_read(&dev->active_tx_urbs) >= MAX_TX_URBS ||
+- dev->free_slots < 5) {
++ dev->free_slots < CPC_TX_QUEUE_TRIGGER_LOW) {
+ netif_stop_queue(netdev);
+ }
+ }
+diff --git a/drivers/net/wireless/iwlwifi/iwl-prph.h b/drivers/net/wireless/iwlwifi/iwl-prph.h
+index 1560f4576c7d..90011b13fc9c 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-prph.h
++++ b/drivers/net/wireless/iwlwifi/iwl-prph.h
+@@ -368,4 +368,10 @@ enum secure_load_status_reg {
+ #define MON_BUFF_WRPTR (0xa03c44)
+ #define MON_BUFF_CYCLE_CNT (0xa03c48)
+
++/* FW chicken bits */
++#define LMPM_CHICK 0xA01FF8
++enum {
++ LMPM_CHICK_EXTENDED_ADDR_SPACE = BIT(0),
++};
++
+ #endif /* __iwl_prph_h__ */
+diff --git a/drivers/net/wireless/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
+index f71c22f8beea..1e2b5af502b8 100644
+--- a/drivers/net/wireless/iwlwifi/mvm/mac80211.c
++++ b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
+@@ -2144,6 +2144,10 @@ static int iwl_mvm_mac_sched_scan_start(struct ieee80211_hw *hw,
+ struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
+ int ret;
+
++ /* we don't support "match all" in the firmware */
++ if (!req->n_match_sets)
++ return -EOPNOTSUPP;
++
+ ret = iwl_mvm_cancel_scan_wait_notif(mvm, IWL_MVM_SCAN_OS);
+ if (ret)
+ return ret;
+diff --git a/drivers/net/wireless/iwlwifi/pcie/trans.c b/drivers/net/wireless/iwlwifi/pcie/trans.c
+index c943baa4e9f1..9dcb04f221fd 100644
+--- a/drivers/net/wireless/iwlwifi/pcie/trans.c
++++ b/drivers/net/wireless/iwlwifi/pcie/trans.c
+@@ -79,6 +79,10 @@
+ #include "iwl-fw-error-dump.h"
+ #include "internal.h"
+
++/* extended range in FW SRAM */
++#define IWL_FW_MEM_EXTENDED_START 0x40000
++#define IWL_FW_MEM_EXTENDED_END 0x57FFF
++
+ static void iwl_pcie_free_fw_monitor(struct iwl_trans *trans)
+ {
+ struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
+@@ -625,14 +629,28 @@ static int iwl_pcie_load_section(struct iwl_trans *trans, u8 section_num,
+ }
+
+ for (offset = 0; offset < section->len; offset += chunk_sz) {
+- u32 copy_size;
++ u32 copy_size, dst_addr;
++ bool extended_addr = false;
+
+ copy_size = min_t(u32, chunk_sz, section->len - offset);
++ dst_addr = section->offset + offset;
++
++ if (dst_addr >= IWL_FW_MEM_EXTENDED_START &&
++ dst_addr <= IWL_FW_MEM_EXTENDED_END)
++ extended_addr = true;
++
++ if (extended_addr)
++ iwl_set_bits_prph(trans, LMPM_CHICK,
++ LMPM_CHICK_EXTENDED_ADDR_SPACE);
+
+ memcpy(v_addr, (u8 *)section->data + offset, copy_size);
+- ret = iwl_pcie_load_firmware_chunk(trans,
+- section->offset + offset,
+- p_addr, copy_size);
++ ret = iwl_pcie_load_firmware_chunk(trans, dst_addr, p_addr,
++ copy_size);
++
++ if (extended_addr)
++ iwl_clear_bits_prph(trans, LMPM_CHICK,
++ LMPM_CHICK_EXTENDED_ADDR_SPACE);
++
+ if (ret) {
+ IWL_ERR(trans,
+ "Could not load the [%d] uCode section\n",
+diff --git a/drivers/pci/xen-pcifront.c b/drivers/pci/xen-pcifront.c
+index 116ca3746adb..bce77100eee9 100644
+--- a/drivers/pci/xen-pcifront.c
++++ b/drivers/pci/xen-pcifront.c
+@@ -52,7 +52,7 @@ struct pcifront_device {
+ };
+
+ struct pcifront_sd {
+- int domain;
++ struct pci_sysdata sd;
+ struct pcifront_device *pdev;
+ };
+
+@@ -66,7 +66,9 @@ static inline void pcifront_init_sd(struct pcifront_sd *sd,
+ unsigned int domain, unsigned int bus,
+ struct pcifront_device *pdev)
+ {
+- sd->domain = domain;
++ /* Because we do not expose that information via XenBus. */
++ sd->sd.node = first_online_node;
++ sd->sd.domain = domain;
+ sd->pdev = pdev;
+ }
+
+@@ -464,8 +466,8 @@ static int pcifront_scan_root(struct pcifront_device *pdev,
+ dev_info(&pdev->xdev->dev, "Creating PCI Frontend Bus %04x:%02x\n",
+ domain, bus);
+
+- bus_entry = kmalloc(sizeof(*bus_entry), GFP_KERNEL);
+- sd = kmalloc(sizeof(*sd), GFP_KERNEL);
++ bus_entry = kzalloc(sizeof(*bus_entry), GFP_KERNEL);
++ sd = kzalloc(sizeof(*sd), GFP_KERNEL);
+ if (!bus_entry || !sd) {
+ err = -ENOMEM;
+ goto err_out;
+diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
+index 958c732c428e..0b1fdfe34c98 100644
+--- a/drivers/target/iscsi/iscsi_target.c
++++ b/drivers/target/iscsi/iscsi_target.c
+@@ -4054,6 +4054,17 @@ reject:
+ return iscsit_add_reject(conn, ISCSI_REASON_BOOKMARK_NO_RESOURCES, buf);
+ }
+
++static bool iscsi_target_check_conn_state(struct iscsi_conn *conn)
++{
++ bool ret;
++
++ spin_lock_bh(&conn->state_lock);
++ ret = (conn->conn_state != TARG_CONN_STATE_LOGGED_IN);
++ spin_unlock_bh(&conn->state_lock);
++
++ return ret;
++}
++
+ int iscsi_target_rx_thread(void *arg)
+ {
+ int ret, rc;
+@@ -4071,7 +4082,7 @@ int iscsi_target_rx_thread(void *arg)
+ * incoming iscsi/tcp socket I/O, and/or failing the connection.
+ */
+ rc = wait_for_completion_interruptible(&conn->rx_login_comp);
+- if (rc < 0)
++ if (rc < 0 || iscsi_target_check_conn_state(conn))
+ return 0;
+
+ if (conn->conn_transport->transport_type == ISCSI_INFINIBAND) {
+diff --git a/drivers/target/iscsi/iscsi_target_nego.c b/drivers/target/iscsi/iscsi_target_nego.c
+index 092112e5e1a6..dcb63481325f 100644
+--- a/drivers/target/iscsi/iscsi_target_nego.c
++++ b/drivers/target/iscsi/iscsi_target_nego.c
+@@ -393,6 +393,7 @@ err:
+ if (login->login_complete) {
+ if (conn->rx_thread && conn->rx_thread_active) {
+ send_sig(SIGINT, conn->rx_thread, 1);
++ complete(&conn->rx_login_comp);
+ kthread_stop(conn->rx_thread);
+ }
+ if (conn->tx_thread && conn->tx_thread_active) {
+diff --git a/drivers/target/target_core_sbc.c b/drivers/target/target_core_sbc.c
+index fa89c2f105e6..496133a4be4f 100644
+--- a/drivers/target/target_core_sbc.c
++++ b/drivers/target/target_core_sbc.c
+@@ -299,7 +299,8 @@ sbc_setup_write_same(struct se_cmd *cmd, unsigned char *flags, struct sbc_ops *o
+ return 0;
+ }
+
+-static sense_reason_t xdreadwrite_callback(struct se_cmd *cmd, bool success)
++static sense_reason_t xdreadwrite_callback(struct se_cmd *cmd, bool success,
++ int *post_ret)
+ {
+ unsigned char *buf, *addr;
+ struct scatterlist *sg;
+@@ -363,7 +364,8 @@ sbc_execute_rw(struct se_cmd *cmd)
+ cmd->data_direction);
+ }
+
+-static sense_reason_t compare_and_write_post(struct se_cmd *cmd, bool success)
++static sense_reason_t compare_and_write_post(struct se_cmd *cmd, bool success,
++ int *post_ret)
+ {
+ struct se_device *dev = cmd->se_dev;
+
+@@ -373,8 +375,10 @@ static sense_reason_t compare_and_write_post(struct se_cmd *cmd, bool success)
+ * sent to the backend driver.
+ */
+ spin_lock_irq(&cmd->t_state_lock);
+- if ((cmd->transport_state & CMD_T_SENT) && !cmd->scsi_status)
++ if ((cmd->transport_state & CMD_T_SENT) && !cmd->scsi_status) {
+ cmd->se_cmd_flags |= SCF_COMPARE_AND_WRITE_POST;
++ *post_ret = 1;
++ }
+ spin_unlock_irq(&cmd->t_state_lock);
+
+ /*
+@@ -386,7 +390,8 @@ static sense_reason_t compare_and_write_post(struct se_cmd *cmd, bool success)
+ return TCM_NO_SENSE;
+ }
+
+-static sense_reason_t compare_and_write_callback(struct se_cmd *cmd, bool success)
++static sense_reason_t compare_and_write_callback(struct se_cmd *cmd, bool success,
++ int *post_ret)
+ {
+ struct se_device *dev = cmd->se_dev;
+ struct scatterlist *write_sg = NULL, *sg;
+@@ -482,11 +487,11 @@ static sense_reason_t compare_and_write_callback(struct se_cmd *cmd, bool succes
+
+ if (block_size < PAGE_SIZE) {
+ sg_set_page(&write_sg[i], m.page, block_size,
+- block_size);
++ m.piter.sg->offset + block_size);
+ } else {
+ sg_miter_next(&m);
+ sg_set_page(&write_sg[i], m.page, block_size,
+- 0);
++ m.piter.sg->offset);
+ }
+ len -= block_size;
+ i++;
+diff --git a/drivers/target/target_core_tmr.c b/drivers/target/target_core_tmr.c
+index 383074723fde..a5c2b3cf7d1a 100644
+--- a/drivers/target/target_core_tmr.c
++++ b/drivers/target/target_core_tmr.c
+@@ -78,16 +78,18 @@ void core_tmr_release_req(struct se_tmr_req *tmr)
+ kfree(tmr);
+ }
+
+-static void core_tmr_handle_tas_abort(
+- struct se_node_acl *tmr_nacl,
+- struct se_cmd *cmd,
+- int tas)
++static void core_tmr_handle_tas_abort(struct se_cmd *cmd, int tas)
+ {
+- bool remove = true;
++ unsigned long flags;
++ bool remove = true, send_tas;
+ /*
+ * TASK ABORTED status (TAS) bit support
+ */
+- if ((tmr_nacl && (tmr_nacl != cmd->se_sess->se_node_acl)) && tas) {
++ spin_lock_irqsave(&cmd->t_state_lock, flags);
++ send_tas = (cmd->transport_state & CMD_T_TAS);
++ spin_unlock_irqrestore(&cmd->t_state_lock, flags);
++
++ if (send_tas) {
+ remove = false;
+ transport_send_task_abort(cmd);
+ }
+@@ -110,6 +112,47 @@ static int target_check_cdb_and_preempt(struct list_head *list,
+ return 1;
+ }
+
++static bool __target_check_io_state(struct se_cmd *se_cmd,
++ struct se_session *tmr_sess, int tas)
++{
++ struct se_session *sess = se_cmd->se_sess;
++
++ assert_spin_locked(&sess->sess_cmd_lock);
++ WARN_ON_ONCE(!irqs_disabled());
++ /*
++ * If command already reached CMD_T_COMPLETE state within
++ * target_complete_cmd() or CMD_T_FABRIC_STOP due to shutdown,
++ * this se_cmd has been passed to fabric driver and will
++ * not be aborted.
++ *
++ * Otherwise, obtain a local se_cmd->cmd_kref now for TMR
++ * ABORT_TASK + LUN_RESET for CMD_T_ABORTED processing as
++ * long as se_cmd->cmd_kref is still active unless zero.
++ */
++ spin_lock(&se_cmd->t_state_lock);
++ if (se_cmd->transport_state & (CMD_T_COMPLETE | CMD_T_FABRIC_STOP)) {
++ pr_debug("Attempted to abort io tag: %u already complete or"
++ " fabric stop, skipping\n",
++ se_cmd->se_tfo->get_task_tag(se_cmd));
++ spin_unlock(&se_cmd->t_state_lock);
++ return false;
++ }
++ if (sess->sess_tearing_down || se_cmd->cmd_wait_set) {
++ pr_debug("Attempted to abort io tag: %u already shutdown,"
++ " skipping\n", se_cmd->se_tfo->get_task_tag(se_cmd));
++ spin_unlock(&se_cmd->t_state_lock);
++ return false;
++ }
++ se_cmd->transport_state |= CMD_T_ABORTED;
++
++ if ((tmr_sess != se_cmd->se_sess) && tas)
++ se_cmd->transport_state |= CMD_T_TAS;
++
++ spin_unlock(&se_cmd->t_state_lock);
++
++ return kref_get_unless_zero(&se_cmd->cmd_kref);
++}
++
+ void core_tmr_abort_task(
+ struct se_device *dev,
+ struct se_tmr_req *tmr,
+@@ -136,25 +179,20 @@ void core_tmr_abort_task(
+ printk("ABORT_TASK: Found referenced %s task_tag: %u\n",
+ se_cmd->se_tfo->get_fabric_name(), ref_tag);
+
+- spin_lock(&se_cmd->t_state_lock);
+- if (se_cmd->transport_state & CMD_T_COMPLETE) {
+- printk("ABORT_TASK: ref_tag: %u already complete, skipping\n", ref_tag);
+- spin_unlock(&se_cmd->t_state_lock);
++ if (!__target_check_io_state(se_cmd, se_sess, 0)) {
+ spin_unlock_irqrestore(&se_sess->sess_cmd_lock, flags);
++ target_put_sess_cmd(se_cmd);
+ goto out;
+ }
+- se_cmd->transport_state |= CMD_T_ABORTED;
+- spin_unlock(&se_cmd->t_state_lock);
+
+ list_del_init(&se_cmd->se_cmd_list);
+- kref_get(&se_cmd->cmd_kref);
+ spin_unlock_irqrestore(&se_sess->sess_cmd_lock, flags);
+
+ cancel_work_sync(&se_cmd->work);
+ transport_wait_for_tasks(se_cmd);
+
+- target_put_sess_cmd(se_cmd);
+ transport_cmd_finish_abort(se_cmd, true);
++ target_put_sess_cmd(se_cmd);
+
+ printk("ABORT_TASK: Sending TMR_FUNCTION_COMPLETE for"
+ " ref_tag: %d\n", ref_tag);
+@@ -211,7 +249,8 @@ static void core_tmr_drain_tmr_list(
+
+ spin_lock(&sess->sess_cmd_lock);
+ spin_lock(&cmd->t_state_lock);
+- if (!(cmd->transport_state & CMD_T_ACTIVE)) {
++ if (!(cmd->transport_state & CMD_T_ACTIVE) ||
++ (cmd->transport_state & CMD_T_FABRIC_STOP)) {
+ spin_unlock(&cmd->t_state_lock);
+ spin_unlock(&sess->sess_cmd_lock);
+ continue;
+@@ -221,15 +260,22 @@ static void core_tmr_drain_tmr_list(
+ spin_unlock(&sess->sess_cmd_lock);
+ continue;
+ }
++ if (sess->sess_tearing_down || cmd->cmd_wait_set) {
++ spin_unlock(&cmd->t_state_lock);
++ spin_unlock(&sess->sess_cmd_lock);
++ continue;
++ }
+ cmd->transport_state |= CMD_T_ABORTED;
+ spin_unlock(&cmd->t_state_lock);
+
+ rc = kref_get_unless_zero(&cmd->cmd_kref);
+- spin_unlock(&sess->sess_cmd_lock);
+ if (!rc) {
+ printk("LUN_RESET TMR: non-zero kref_get_unless_zero\n");
++ spin_unlock(&sess->sess_cmd_lock);
+ continue;
+ }
++ spin_unlock(&sess->sess_cmd_lock);
++
+ list_move_tail(&tmr_p->tmr_list, &drain_tmr_list);
+ }
+ spin_unlock_irqrestore(&dev->se_tmr_lock, flags);
+@@ -254,13 +300,15 @@ static void core_tmr_drain_tmr_list(
+ static void core_tmr_drain_state_list(
+ struct se_device *dev,
+ struct se_cmd *prout_cmd,
+- struct se_node_acl *tmr_nacl,
++ struct se_session *tmr_sess,
+ int tas,
+ struct list_head *preempt_and_abort_list)
+ {
+ LIST_HEAD(drain_task_list);
++ struct se_session *sess;
+ struct se_cmd *cmd, *next;
+ unsigned long flags;
++ int rc;
+
+ /*
+ * Complete outstanding commands with TASK_ABORTED SAM status.
+@@ -299,6 +347,16 @@ static void core_tmr_drain_state_list(
+ if (prout_cmd == cmd)
+ continue;
+
++ sess = cmd->se_sess;
++ if (WARN_ON_ONCE(!sess))
++ continue;
++
++ spin_lock(&sess->sess_cmd_lock);
++ rc = __target_check_io_state(cmd, tmr_sess, tas);
++ spin_unlock(&sess->sess_cmd_lock);
++ if (!rc)
++ continue;
++
+ list_move_tail(&cmd->state_list, &drain_task_list);
+ cmd->state_active = false;
+ }
+@@ -306,7 +364,7 @@ static void core_tmr_drain_state_list(
+
+ while (!list_empty(&drain_task_list)) {
+ cmd = list_entry(drain_task_list.next, struct se_cmd, state_list);
+- list_del(&cmd->state_list);
++ list_del_init(&cmd->state_list);
+
+ pr_debug("LUN_RESET: %s cmd: %p"
+ " ITT/CmdSN: 0x%08x/0x%08x, i_state: %d, t_state: %d"
+@@ -330,16 +388,11 @@ static void core_tmr_drain_state_list(
+ * loop above, but we do it down here given that
+ * cancel_work_sync may block.
+ */
+- if (cmd->t_state == TRANSPORT_COMPLETE)
+- cancel_work_sync(&cmd->work);
+-
+- spin_lock_irqsave(&cmd->t_state_lock, flags);
+- target_stop_cmd(cmd, &flags);
+-
+- cmd->transport_state |= CMD_T_ABORTED;
+- spin_unlock_irqrestore(&cmd->t_state_lock, flags);
++ cancel_work_sync(&cmd->work);
++ transport_wait_for_tasks(cmd);
+
+- core_tmr_handle_tas_abort(tmr_nacl, cmd, tas);
++ core_tmr_handle_tas_abort(cmd, tas);
++ target_put_sess_cmd(cmd);
+ }
+ }
+
+@@ -351,6 +404,7 @@ int core_tmr_lun_reset(
+ {
+ struct se_node_acl *tmr_nacl = NULL;
+ struct se_portal_group *tmr_tpg = NULL;
++ struct se_session *tmr_sess = NULL;
+ int tas;
+ /*
+ * TASK_ABORTED status bit, this is configurable via ConfigFS
+@@ -369,8 +423,9 @@ int core_tmr_lun_reset(
+ * or struct se_device passthrough..
+ */
+ if (tmr && tmr->task_cmd && tmr->task_cmd->se_sess) {
+- tmr_nacl = tmr->task_cmd->se_sess->se_node_acl;
+- tmr_tpg = tmr->task_cmd->se_sess->se_tpg;
++ tmr_sess = tmr->task_cmd->se_sess;
++ tmr_nacl = tmr_sess->se_node_acl;
++ tmr_tpg = tmr_sess->se_tpg;
+ if (tmr_nacl && tmr_tpg) {
+ pr_debug("LUN_RESET: TMR caller fabric: %s"
+ " initiator port %s\n",
+@@ -383,7 +438,7 @@ int core_tmr_lun_reset(
+ dev->transport->name, tas);
+
+ core_tmr_drain_tmr_list(dev, tmr, preempt_and_abort_list);
+- core_tmr_drain_state_list(dev, prout_cmd, tmr_nacl, tas,
++ core_tmr_drain_state_list(dev, prout_cmd, tmr_sess, tas,
+ preempt_and_abort_list);
+
+ /*
+diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
+index adf96b78e9f0..b6051c82f386 100644
+--- a/drivers/target/target_core_transport.c
++++ b/drivers/target/target_core_transport.c
+@@ -515,9 +515,6 @@ void transport_deregister_session(struct se_session *se_sess)
+ }
+ EXPORT_SYMBOL(transport_deregister_session);
+
+-/*
+- * Called with cmd->t_state_lock held.
+- */
+ static void target_remove_from_state_list(struct se_cmd *cmd)
+ {
+ struct se_device *dev = cmd->se_dev;
+@@ -542,10 +539,6 @@ static int transport_cmd_check_stop(struct se_cmd *cmd, bool remove_from_lists,
+ {
+ unsigned long flags;
+
+- spin_lock_irqsave(&cmd->t_state_lock, flags);
+- if (write_pending)
+- cmd->t_state = TRANSPORT_WRITE_PENDING;
+-
+ if (remove_from_lists) {
+ target_remove_from_state_list(cmd);
+
+@@ -555,6 +548,10 @@ static int transport_cmd_check_stop(struct se_cmd *cmd, bool remove_from_lists,
+ cmd->se_lun = NULL;
+ }
+
++ spin_lock_irqsave(&cmd->t_state_lock, flags);
++ if (write_pending)
++ cmd->t_state = TRANSPORT_WRITE_PENDING;
++
+ /*
+ * Determine if frontend context caller is requesting the stopping of
+ * this command for frontend exceptions.
+@@ -609,6 +606,8 @@ static void transport_lun_remove_cmd(struct se_cmd *cmd)
+
+ void transport_cmd_finish_abort(struct se_cmd *cmd, int remove)
+ {
++ bool ack_kref = (cmd->se_cmd_flags & SCF_ACK_KREF);
++
+ if (cmd->se_cmd_flags & SCF_SE_LUN_CMD)
+ transport_lun_remove_cmd(cmd);
+ /*
+@@ -620,7 +619,7 @@ void transport_cmd_finish_abort(struct se_cmd *cmd, int remove)
+
+ if (transport_cmd_check_stop_to_fabric(cmd))
+ return;
+- if (remove)
++ if (remove && ack_kref)
+ transport_put_cmd(cmd);
+ }
+
+@@ -688,7 +687,7 @@ void target_complete_cmd(struct se_cmd *cmd, u8 scsi_status)
+ * Check for case where an explicit ABORT_TASK has been received
+ * and transport_wait_for_tasks() will be waiting for completion..
+ */
+- if (cmd->transport_state & CMD_T_ABORTED &&
++ if (cmd->transport_state & CMD_T_ABORTED ||
+ cmd->transport_state & CMD_T_STOP) {
+ spin_unlock_irqrestore(&cmd->t_state_lock, flags);
+ complete_all(&cmd->t_transport_stop_comp);
+@@ -1596,7 +1595,7 @@ bool target_stop_cmd(struct se_cmd *cmd, unsigned long *flags)
+ void transport_generic_request_failure(struct se_cmd *cmd,
+ sense_reason_t sense_reason)
+ {
+- int ret = 0;
++ int ret = 0, post_ret = 0;
+
+ pr_debug("-----[ Storage Engine Exception for cmd: %p ITT: 0x%08x"
+ " CDB: 0x%02x\n", cmd, cmd->se_tfo->get_task_tag(cmd),
+@@ -1619,7 +1618,7 @@ void transport_generic_request_failure(struct se_cmd *cmd,
+ */
+ if ((cmd->se_cmd_flags & SCF_COMPARE_AND_WRITE) &&
+ cmd->transport_complete_callback)
+- cmd->transport_complete_callback(cmd, false);
++ cmd->transport_complete_callback(cmd, false, &post_ret);
+
+ switch (sense_reason) {
+ case TCM_NON_EXISTENT_LUN:
+@@ -1759,19 +1758,21 @@ static bool target_handle_task_attr(struct se_cmd *cmd)
+ return true;
+ }
+
++static int __transport_check_aborted_status(struct se_cmd *, int);
++
+ void target_execute_cmd(struct se_cmd *cmd)
+ {
+ /*
+- * If the received CDB has aleady been aborted stop processing it here.
+- */
+- if (transport_check_aborted_status(cmd, 1))
+- return;
+-
+- /*
+ * Determine if frontend context caller is requesting the stopping of
+ * this command for frontend exceptions.
++ *
++ * If the received CDB has aleady been aborted stop processing it here.
+ */
+ spin_lock_irq(&cmd->t_state_lock);
++ if (__transport_check_aborted_status(cmd, 1)) {
++ spin_unlock_irq(&cmd->t_state_lock);
++ return;
++ }
+ if (cmd->transport_state & CMD_T_STOP) {
+ pr_debug("%s:%d CMD_T_STOP for ITT: 0x%08x\n",
+ __func__, __LINE__,
+@@ -1974,11 +1975,13 @@ static void target_complete_ok_work(struct work_struct *work)
+ */
+ if (cmd->transport_complete_callback) {
+ sense_reason_t rc;
++ bool caw = (cmd->se_cmd_flags & SCF_COMPARE_AND_WRITE);
++ bool zero_dl = !(cmd->data_length);
++ int post_ret = 0;
+
+- rc = cmd->transport_complete_callback(cmd, true);
+- if (!rc && !(cmd->se_cmd_flags & SCF_COMPARE_AND_WRITE_POST)) {
+- if ((cmd->se_cmd_flags & SCF_COMPARE_AND_WRITE) &&
+- !cmd->data_length)
++ rc = cmd->transport_complete_callback(cmd, true, &post_ret);
++ if (!rc && !post_ret) {
++ if (caw && zero_dl)
+ goto queue_rsp;
+
+ return;
+@@ -2128,20 +2131,14 @@ static inline void transport_free_pages(struct se_cmd *cmd)
+ }
+
+ /**
+- * transport_release_cmd - free a command
+- * @cmd: command to free
++ * transport_put_cmd - release a reference to a command
++ * @cmd: command to release
+ *
+- * This routine unconditionally frees a command, and reference counting
+- * or list removal must be done in the caller.
++ * This routine releases our reference to the command and frees it if possible.
+ */
+-static int transport_release_cmd(struct se_cmd *cmd)
++static int transport_put_cmd(struct se_cmd *cmd)
+ {
+ BUG_ON(!cmd->se_tfo);
+-
+- if (cmd->se_cmd_flags & SCF_SCSI_TMR_CDB)
+- core_tmr_release_req(cmd->se_tmr_req);
+- if (cmd->t_task_cdb != cmd->__t_task_cdb)
+- kfree(cmd->t_task_cdb);
+ /*
+ * If this cmd has been setup with target_get_sess_cmd(), drop
+ * the kref and call ->release_cmd() in kref callback.
+@@ -2149,18 +2146,6 @@ static int transport_release_cmd(struct se_cmd *cmd)
+ return target_put_sess_cmd(cmd);
+ }
+
+-/**
+- * transport_put_cmd - release a reference to a command
+- * @cmd: command to release
+- *
+- * This routine releases our reference to the command and frees it if possible.
+- */
+-static int transport_put_cmd(struct se_cmd *cmd)
+-{
+- transport_free_pages(cmd);
+- return transport_release_cmd(cmd);
+-}
+-
+ void *transport_kmap_data_sg(struct se_cmd *cmd)
+ {
+ struct scatterlist *sg = cmd->t_data_sg;
+@@ -2356,34 +2341,59 @@ static void transport_write_pending_qf(struct se_cmd *cmd)
+ }
+ }
+
+-int transport_generic_free_cmd(struct se_cmd *cmd, int wait_for_tasks)
++static bool
++__transport_wait_for_tasks(struct se_cmd *, bool, bool *, bool *,
++ unsigned long *flags);
++
++static void target_wait_free_cmd(struct se_cmd *cmd, bool *aborted, bool *tas)
+ {
+ unsigned long flags;
++
++ spin_lock_irqsave(&cmd->t_state_lock, flags);
++ __transport_wait_for_tasks(cmd, true, aborted, tas, &flags);
++ spin_unlock_irqrestore(&cmd->t_state_lock, flags);
++}
++
++int transport_generic_free_cmd(struct se_cmd *cmd, int wait_for_tasks)
++{
+ int ret = 0;
++ bool aborted = false, tas = false;
+
+ if (!(cmd->se_cmd_flags & SCF_SE_LUN_CMD)) {
+ if (wait_for_tasks && (cmd->se_cmd_flags & SCF_SCSI_TMR_CDB))
+- transport_wait_for_tasks(cmd);
++ target_wait_free_cmd(cmd, &aborted, &tas);
+
+- ret = transport_release_cmd(cmd);
++ if (!aborted || tas)
++ ret = transport_put_cmd(cmd);
+ } else {
+ if (wait_for_tasks)
+- transport_wait_for_tasks(cmd);
++ target_wait_free_cmd(cmd, &aborted, &tas);
+ /*
+ * Handle WRITE failure case where transport_generic_new_cmd()
+ * has already added se_cmd to state_list, but fabric has
+ * failed command before I/O submission.
+ */
+- if (cmd->state_active) {
+- spin_lock_irqsave(&cmd->t_state_lock, flags);
++ if (cmd->state_active)
+ target_remove_from_state_list(cmd);
+- spin_unlock_irqrestore(&cmd->t_state_lock, flags);
+- }
+
+ if (cmd->se_lun)
+ transport_lun_remove_cmd(cmd);
+
+- ret = transport_put_cmd(cmd);
++ if (!aborted || tas)
++ ret = transport_put_cmd(cmd);
++ }
++ /*
++ * If the task has been internally aborted due to TMR ABORT_TASK
++ * or LUN_RESET, target_core_tmr.c is responsible for performing
++ * the remaining calls to target_put_sess_cmd(), and not the
++ * callers of this function.
++ */
++ if (aborted) {
++ pr_debug("Detected CMD_T_ABORTED for ITT: %u\n",
++ cmd->se_tfo->get_task_tag(cmd));
++ wait_for_completion(&cmd->cmd_wait_comp);
++ cmd->se_tfo->release_cmd(cmd);
++ ret = 1;
+ }
+ return ret;
+ }
+@@ -2425,24 +2435,44 @@ out:
+ }
+ EXPORT_SYMBOL(target_get_sess_cmd);
+
++static void target_free_cmd_mem(struct se_cmd *cmd)
++{
++ transport_free_pages(cmd);
++
++ if (cmd->se_cmd_flags & SCF_SCSI_TMR_CDB)
++ core_tmr_release_req(cmd->se_tmr_req);
++ if (cmd->t_task_cdb != cmd->__t_task_cdb)
++ kfree(cmd->t_task_cdb);
++}
++
+ static void target_release_cmd_kref(struct kref *kref)
+ {
+ struct se_cmd *se_cmd = container_of(kref, struct se_cmd, cmd_kref);
+ struct se_session *se_sess = se_cmd->se_sess;
++ bool fabric_stop;
+
+ if (list_empty(&se_cmd->se_cmd_list)) {
+ spin_unlock(&se_sess->sess_cmd_lock);
++ target_free_cmd_mem(se_cmd);
+ se_cmd->se_tfo->release_cmd(se_cmd);
+ return;
+ }
+- if (se_sess->sess_tearing_down && se_cmd->cmd_wait_set) {
++
++ spin_lock(&se_cmd->t_state_lock);
++ fabric_stop = (se_cmd->transport_state & CMD_T_FABRIC_STOP);
++ spin_unlock(&se_cmd->t_state_lock);
++
++ if (se_cmd->cmd_wait_set || fabric_stop) {
++ list_del_init(&se_cmd->se_cmd_list);
+ spin_unlock(&se_sess->sess_cmd_lock);
++ target_free_cmd_mem(se_cmd);
+ complete(&se_cmd->cmd_wait_comp);
+ return;
+ }
+- list_del(&se_cmd->se_cmd_list);
++ list_del_init(&se_cmd->se_cmd_list);
+ spin_unlock(&se_sess->sess_cmd_lock);
+
++ target_free_cmd_mem(se_cmd);
+ se_cmd->se_tfo->release_cmd(se_cmd);
+ }
+
+@@ -2454,6 +2484,7 @@ int target_put_sess_cmd(struct se_cmd *se_cmd)
+ struct se_session *se_sess = se_cmd->se_sess;
+
+ if (!se_sess) {
++ target_free_cmd_mem(se_cmd);
+ se_cmd->se_tfo->release_cmd(se_cmd);
+ return 1;
+ }
+@@ -2471,6 +2502,7 @@ void target_sess_cmd_list_set_waiting(struct se_session *se_sess)
+ {
+ struct se_cmd *se_cmd;
+ unsigned long flags;
++ int rc;
+
+ spin_lock_irqsave(&se_sess->sess_cmd_lock, flags);
+ if (se_sess->sess_tearing_down) {
+@@ -2480,8 +2512,15 @@ void target_sess_cmd_list_set_waiting(struct se_session *se_sess)
+ se_sess->sess_tearing_down = 1;
+ list_splice_init(&se_sess->sess_cmd_list, &se_sess->sess_wait_list);
+
+- list_for_each_entry(se_cmd, &se_sess->sess_wait_list, se_cmd_list)
+- se_cmd->cmd_wait_set = 1;
++ list_for_each_entry(se_cmd, &se_sess->sess_wait_list, se_cmd_list) {
++ rc = kref_get_unless_zero(&se_cmd->cmd_kref);
++ if (rc) {
++ se_cmd->cmd_wait_set = 1;
++ spin_lock(&se_cmd->t_state_lock);
++ se_cmd->transport_state |= CMD_T_FABRIC_STOP;
++ spin_unlock(&se_cmd->t_state_lock);
++ }
++ }
+
+ spin_unlock_irqrestore(&se_sess->sess_cmd_lock, flags);
+ }
+@@ -2494,15 +2533,25 @@ void target_wait_for_sess_cmds(struct se_session *se_sess)
+ {
+ struct se_cmd *se_cmd, *tmp_cmd;
+ unsigned long flags;
++ bool tas;
+
+ list_for_each_entry_safe(se_cmd, tmp_cmd,
+ &se_sess->sess_wait_list, se_cmd_list) {
+- list_del(&se_cmd->se_cmd_list);
++ list_del_init(&se_cmd->se_cmd_list);
+
+ pr_debug("Waiting for se_cmd: %p t_state: %d, fabric state:"
+ " %d\n", se_cmd, se_cmd->t_state,
+ se_cmd->se_tfo->get_cmd_state(se_cmd));
+
++ spin_lock_irqsave(&se_cmd->t_state_lock, flags);
++ tas = (se_cmd->transport_state & CMD_T_TAS);
++ spin_unlock_irqrestore(&se_cmd->t_state_lock, flags);
++
++ if (!target_put_sess_cmd(se_cmd)) {
++ if (tas)
++ target_put_sess_cmd(se_cmd);
++ }
++
+ wait_for_completion(&se_cmd->cmd_wait_comp);
+ pr_debug("After cmd_wait_comp: se_cmd: %p t_state: %d"
+ " fabric state: %d\n", se_cmd, se_cmd->t_state,
+@@ -2545,34 +2594,38 @@ int transport_clear_lun_ref(struct se_lun *lun)
+ return 0;
+ }
+
+-/**
+- * transport_wait_for_tasks - wait for completion to occur
+- * @cmd: command to wait
+- *
+- * Called from frontend fabric context to wait for storage engine
+- * to pause and/or release frontend generated struct se_cmd.
+- */
+-bool transport_wait_for_tasks(struct se_cmd *cmd)
++static bool
++__transport_wait_for_tasks(struct se_cmd *cmd, bool fabric_stop,
++ bool *aborted, bool *tas, unsigned long *flags)
++ __releases(&cmd->t_state_lock)
++ __acquires(&cmd->t_state_lock)
+ {
+- unsigned long flags;
+
+- spin_lock_irqsave(&cmd->t_state_lock, flags);
++ assert_spin_locked(&cmd->t_state_lock);
++ WARN_ON_ONCE(!irqs_disabled());
++
++ if (fabric_stop)
++ cmd->transport_state |= CMD_T_FABRIC_STOP;
++
++ if (cmd->transport_state & CMD_T_ABORTED)
++ *aborted = true;
++
++ if (cmd->transport_state & CMD_T_TAS)
++ *tas = true;
++
+ if (!(cmd->se_cmd_flags & SCF_SE_LUN_CMD) &&
+- !(cmd->se_cmd_flags & SCF_SCSI_TMR_CDB)) {
+- spin_unlock_irqrestore(&cmd->t_state_lock, flags);
++ !(cmd->se_cmd_flags & SCF_SCSI_TMR_CDB))
+ return false;
+- }
+
+ if (!(cmd->se_cmd_flags & SCF_SUPPORTED_SAM_OPCODE) &&
+- !(cmd->se_cmd_flags & SCF_SCSI_TMR_CDB)) {
+- spin_unlock_irqrestore(&cmd->t_state_lock, flags);
++ !(cmd->se_cmd_flags & SCF_SCSI_TMR_CDB))
+ return false;
+- }
+
+- if (!(cmd->transport_state & CMD_T_ACTIVE)) {
+- spin_unlock_irqrestore(&cmd->t_state_lock, flags);
++ if (!(cmd->transport_state & CMD_T_ACTIVE))
++ return false;
++
++ if (fabric_stop && *aborted)
+ return false;
+- }
+
+ cmd->transport_state |= CMD_T_STOP;
+
+@@ -2581,20 +2634,37 @@ bool transport_wait_for_tasks(struct se_cmd *cmd)
+ cmd, cmd->se_tfo->get_task_tag(cmd),
+ cmd->se_tfo->get_cmd_state(cmd), cmd->t_state);
+
+- spin_unlock_irqrestore(&cmd->t_state_lock, flags);
++ spin_unlock_irqrestore(&cmd->t_state_lock, *flags);
+
+ wait_for_completion(&cmd->t_transport_stop_comp);
+
+- spin_lock_irqsave(&cmd->t_state_lock, flags);
++ spin_lock_irqsave(&cmd->t_state_lock, *flags);
+ cmd->transport_state &= ~(CMD_T_ACTIVE | CMD_T_STOP);
+
+ pr_debug("wait_for_tasks: Stopped wait_for_completion("
+ "&cmd->t_transport_stop_comp) for ITT: 0x%08x\n",
+ cmd->se_tfo->get_task_tag(cmd));
+
++ return true;
++}
++
++/**
++ * transport_wait_for_tasks - wait for completion to occur
++ * @cmd: command to wait
++ *
++ * Called from frontend fabric context to wait for storage engine
++ * to pause and/or release frontend generated struct se_cmd.
++ */
++bool transport_wait_for_tasks(struct se_cmd *cmd)
++{
++ unsigned long flags;
++ bool ret, aborted = false, tas = false;
++
++ spin_lock_irqsave(&cmd->t_state_lock, flags);
++ ret = __transport_wait_for_tasks(cmd, false, &aborted, &tas, &flags);
+ spin_unlock_irqrestore(&cmd->t_state_lock, flags);
+
+- return true;
++ return ret;
+ }
+ EXPORT_SYMBOL(transport_wait_for_tasks);
+
+@@ -2880,8 +2950,13 @@ after_reason:
+ }
+ EXPORT_SYMBOL(transport_send_check_condition_and_sense);
+
+-int transport_check_aborted_status(struct se_cmd *cmd, int send_status)
++static int __transport_check_aborted_status(struct se_cmd *cmd, int send_status)
++ __releases(&cmd->t_state_lock)
++ __acquires(&cmd->t_state_lock)
+ {
++ assert_spin_locked(&cmd->t_state_lock);
++ WARN_ON_ONCE(!irqs_disabled());
++
+ if (!(cmd->transport_state & CMD_T_ABORTED))
+ return 0;
+
+@@ -2889,19 +2964,37 @@ int transport_check_aborted_status(struct se_cmd *cmd, int send_status)
+ * If cmd has been aborted but either no status is to be sent or it has
+ * already been sent, just return
+ */
+- if (!send_status || !(cmd->se_cmd_flags & SCF_SEND_DELAYED_TAS))
++ if (!send_status || !(cmd->se_cmd_flags & SCF_SEND_DELAYED_TAS)) {
++ if (send_status)
++ cmd->se_cmd_flags |= SCF_SEND_DELAYED_TAS;
+ return 1;
++ }
+
+- pr_debug("Sending delayed SAM_STAT_TASK_ABORTED status for CDB: 0x%02x ITT: 0x%08x\n",
+- cmd->t_task_cdb[0], cmd->se_tfo->get_task_tag(cmd));
++ pr_debug("Sending delayed SAM_STAT_TASK_ABORTED status for CDB:"
++ " 0x%02x ITT: 0x%08x\n", cmd->t_task_cdb[0],
++ cmd->se_tfo->get_task_tag(cmd));
+
+ cmd->se_cmd_flags &= ~SCF_SEND_DELAYED_TAS;
+ cmd->scsi_status = SAM_STAT_TASK_ABORTED;
+ trace_target_cmd_complete(cmd);
++
++ spin_unlock_irq(&cmd->t_state_lock);
+ cmd->se_tfo->queue_status(cmd);
++ spin_lock_irq(&cmd->t_state_lock);
+
+ return 1;
+ }
++
++int transport_check_aborted_status(struct se_cmd *cmd, int send_status)
++{
++ int ret;
++
++ spin_lock_irq(&cmd->t_state_lock);
++ ret = __transport_check_aborted_status(cmd, send_status);
++ spin_unlock_irq(&cmd->t_state_lock);
++
++ return ret;
++}
+ EXPORT_SYMBOL(transport_check_aborted_status);
+
+ void transport_send_task_abort(struct se_cmd *cmd)
+@@ -2923,11 +3016,17 @@ void transport_send_task_abort(struct se_cmd *cmd)
+ */
+ if (cmd->data_direction == DMA_TO_DEVICE) {
+ if (cmd->se_tfo->write_pending_status(cmd) != 0) {
+- cmd->transport_state |= CMD_T_ABORTED;
++ spin_lock_irqsave(&cmd->t_state_lock, flags);
++ if (cmd->se_cmd_flags & SCF_SEND_DELAYED_TAS) {
++ spin_unlock_irqrestore(&cmd->t_state_lock, flags);
++ goto send_abort;
++ }
+ cmd->se_cmd_flags |= SCF_SEND_DELAYED_TAS;
++ spin_unlock_irqrestore(&cmd->t_state_lock, flags);
+ return;
+ }
+ }
++send_abort:
+ cmd->scsi_status = SAM_STAT_TASK_ABORTED;
+
+ transport_lun_remove_cmd(cmd);
+diff --git a/drivers/usb/chipidea/otg.c b/drivers/usb/chipidea/otg.c
+index a048b08b9d4d..92f169ca520e 100644
+--- a/drivers/usb/chipidea/otg.c
++++ b/drivers/usb/chipidea/otg.c
+@@ -116,7 +116,7 @@ static void ci_otg_work(struct work_struct *work)
+ int ci_hdrc_otg_init(struct ci_hdrc *ci)
+ {
+ INIT_WORK(&ci->work, ci_otg_work);
+- ci->wq = create_singlethread_workqueue("ci_otg");
++ ci->wq = create_freezable_workqueue("ci_otg");
+ if (!ci->wq) {
+ dev_err(ci->dev, "can't create workqueue\n");
+ return -ENODEV;
+diff --git a/drivers/usb/dwc3/core.h b/drivers/usb/dwc3/core.h
+index 66f62563bcf9..be6bda9019e7 100644
+--- a/drivers/usb/dwc3/core.h
++++ b/drivers/usb/dwc3/core.h
+@@ -769,7 +769,6 @@ struct dwc3 {
+ unsigned pullups_connected:1;
+ unsigned resize_fifos:1;
+ unsigned setup_packet_pending:1;
+- unsigned start_config_issued:1;
+ unsigned three_stage_setup:1;
+ };
+
+diff --git a/drivers/usb/dwc3/ep0.c b/drivers/usb/dwc3/ep0.c
+index 1c1525b0a1fb..b75d7c8ad2f2 100644
+--- a/drivers/usb/dwc3/ep0.c
++++ b/drivers/usb/dwc3/ep0.c
+@@ -544,7 +544,6 @@ static int dwc3_ep0_set_config(struct dwc3 *dwc, struct usb_ctrlrequest *ctrl)
+ int ret;
+ u32 reg;
+
+- dwc->start_config_issued = false;
+ cfg = le16_to_cpu(ctrl->wValue);
+
+ switch (state) {
+@@ -727,10 +726,6 @@ static int dwc3_ep0_std_request(struct dwc3 *dwc, struct usb_ctrlrequest *ctrl)
+ dwc3_trace(trace_dwc3_ep0, "USB_REQ_SET_ISOCH_DELAY\n");
+ ret = dwc3_ep0_set_isoch_delay(dwc, ctrl);
+ break;
+- case USB_REQ_SET_INTERFACE:
+- dev_vdbg(dwc->dev, "USB_REQ_SET_INTERFACE\n");
+- dwc->start_config_issued = false;
+- /* Fall through */
+ default:
+ dwc3_trace(trace_dwc3_ep0, "Forwarding to gadget driver\n");
+ ret = dwc3_ep0_delegate_req(dwc, ctrl);
+diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
+index d98faf73d6b2..d4f7b607fc61 100644
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -382,24 +382,66 @@ static void dwc3_free_trb_pool(struct dwc3_ep *dep)
+ dep->trb_pool_dma = 0;
+ }
+
++static int dwc3_gadget_set_xfer_resource(struct dwc3 *dwc, struct dwc3_ep *dep);
++
++/**
++ * dwc3_gadget_start_config - Configure EP resources
++ * @dwc: pointer to our controller context structure
++ * @dep: endpoint that is being enabled
++ *
++ * The assignment of transfer resources cannot perfectly follow the
++ * data book due to the fact that the controller driver does not have
++ * all knowledge of the configuration in advance. It is given this
++ * information piecemeal by the composite gadget framework after every
++ * SET_CONFIGURATION and SET_INTERFACE. Trying to follow the databook
++ * programming model in this scenario can cause errors. For two
++ * reasons:
++ *
++ * 1) The databook says to do DEPSTARTCFG for every SET_CONFIGURATION
++ * and SET_INTERFACE (8.1.5). This is incorrect in the scenario of
++ * multiple interfaces.
++ *
++ * 2) The databook does not mention doing more DEPXFERCFG for new
++ * endpoint on alt setting (8.1.6).
++ *
++ * The following simplified method is used instead:
++ *
++ * All hardware endpoints can be assigned a transfer resource and this
++ * setting will stay persistent until either a core reset or
++ * hibernation. So whenever we do a DEPSTARTCFG(0) we can go ahead and
++ * do DEPXFERCFG for every hardware endpoint as well. We are
++ * guaranteed that there are as many transfer resources as endpoints.
++ *
++ * This function is called for each endpoint when it is being enabled
++ * but is triggered only when called for EP0-out, which always happens
++ * first, and which should only happen in one of the above conditions.
++ */
+ static int dwc3_gadget_start_config(struct dwc3 *dwc, struct dwc3_ep *dep)
+ {
+ struct dwc3_gadget_ep_cmd_params params;
+ u32 cmd;
++ int i;
++ int ret;
++
++ if (dep->number)
++ return 0;
+
+ memset(¶ms, 0x00, sizeof(params));
++ cmd = DWC3_DEPCMD_DEPSTARTCFG;
+
+- if (dep->number != 1) {
+- cmd = DWC3_DEPCMD_DEPSTARTCFG;
+- /* XferRscIdx == 0 for ep0 and 2 for the remaining */
+- if (dep->number > 1) {
+- if (dwc->start_config_issued)
+- return 0;
+- dwc->start_config_issued = true;
+- cmd |= DWC3_DEPCMD_PARAM(2);
+- }
++ ret = dwc3_send_gadget_ep_cmd(dwc, 0, cmd, ¶ms);
++ if (ret)
++ return ret;
+
+- return dwc3_send_gadget_ep_cmd(dwc, 0, cmd, ¶ms);
++ for (i = 0; i < DWC3_ENDPOINTS_NUM; i++) {
++ struct dwc3_ep *dep = dwc->eps[i];
++
++ if (!dep)
++ continue;
++
++ ret = dwc3_gadget_set_xfer_resource(dwc, dep);
++ if (ret)
++ return ret;
+ }
+
+ return 0;
+@@ -513,10 +555,6 @@ static int __dwc3_gadget_ep_enable(struct dwc3_ep *dep,
+ struct dwc3_trb *trb_st_hw;
+ struct dwc3_trb *trb_link;
+
+- ret = dwc3_gadget_set_xfer_resource(dwc, dep);
+- if (ret)
+- return ret;
+-
+ dep->endpoint.desc = desc;
+ dep->comp_desc = comp_desc;
+ dep->type = usb_endpoint_type(desc);
+@@ -1582,8 +1620,6 @@ static int dwc3_gadget_start(struct usb_gadget *g,
+ }
+ dwc3_writel(dwc->regs, DWC3_DCFG, reg);
+
+- dwc->start_config_issued = false;
+-
+ /* Start with SuperSpeed Default */
+ dwc3_gadget_ep0_desc.wMaxPacketSize = cpu_to_le16(512);
+
+@@ -2146,7 +2182,6 @@ static void dwc3_gadget_disconnect_interrupt(struct dwc3 *dwc)
+ dwc3_writel(dwc->regs, DWC3_DCTL, reg);
+
+ dwc3_disconnect_gadget(dwc);
+- dwc->start_config_issued = false;
+
+ dwc->gadget.speed = USB_SPEED_UNKNOWN;
+ dwc->setup_packet_pending = false;
+@@ -2200,7 +2235,6 @@ static void dwc3_gadget_reset_interrupt(struct dwc3 *dwc)
+
+ dwc3_stop_active_transfers(dwc);
+ dwc3_clear_stall_all_ep(dwc);
+- dwc->start_config_issued = false;
+
+ /* Reset device address to zero */
+ reg = dwc3_readl(dwc->regs, DWC3_DCFG);
+diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
+index 9364bed2a8b3..50426cf095a5 100644
+--- a/drivers/usb/serial/cp210x.c
++++ b/drivers/usb/serial/cp210x.c
+@@ -161,9 +161,14 @@ static const struct usb_device_id id_table[] = {
+ { USB_DEVICE(0x17F4, 0xAAAA) }, /* Wavesense Jazz blood glucose meter */
+ { USB_DEVICE(0x1843, 0x0200) }, /* Vaisala USB Instrument Cable */
+ { USB_DEVICE(0x18EF, 0xE00F) }, /* ELV USB-I2C-Interface */
++ { USB_DEVICE(0x18EF, 0xE025) }, /* ELV Marble Sound Board 1 */
++ { USB_DEVICE(0x1901, 0x0190) }, /* GE B850 CP2105 Recorder interface */
++ { USB_DEVICE(0x1901, 0x0193) }, /* GE B650 CP2104 PMC interface */
++ { USB_DEVICE(0x19CF, 0x3000) }, /* Parrot NMEA GPS Flight Recorder */
+ { USB_DEVICE(0x1ADB, 0x0001) }, /* Schweitzer Engineering C662 Cable */
+ { USB_DEVICE(0x1B1C, 0x1C00) }, /* Corsair USB Dongle */
+ { USB_DEVICE(0x1BA4, 0x0002) }, /* Silicon Labs 358x factory default */
++ { USB_DEVICE(0x1ADB, 0x0001) }, /* Schweitzer Engineering C662 Cable */
+ { USB_DEVICE(0x1BE3, 0x07A6) }, /* WAGO 750-923 USB Service Cable */
+ { USB_DEVICE(0x1D6F, 0x0010) }, /* Seluxit ApS RF Dongle */
+ { USB_DEVICE(0x1E29, 0x0102) }, /* Festo CPX-USB */
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index 95d3ab73da0e..5e194f187802 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -272,6 +272,7 @@ static void option_instat_callback(struct urb *urb);
+ #define TELIT_PRODUCT_UE910_V2 0x1012
+ #define TELIT_PRODUCT_LE922_USBCFG0 0x1042
+ #define TELIT_PRODUCT_LE922_USBCFG3 0x1043
++#define TELIT_PRODUCT_LE922_USBCFG5 0x1045
+ #define TELIT_PRODUCT_LE920 0x1200
+ #define TELIT_PRODUCT_LE910 0x1201
+
+@@ -317,6 +318,7 @@ static void option_instat_callback(struct urb *urb);
+ #define TOSHIBA_PRODUCT_G450 0x0d45
+
+ #define ALINK_VENDOR_ID 0x1e0e
++#define SIMCOM_PRODUCT_SIM7100E 0x9001 /* Yes, ALINK_VENDOR_ID */
+ #define ALINK_PRODUCT_PH300 0x9100
+ #define ALINK_PRODUCT_3GU 0x9200
+
+@@ -611,6 +613,10 @@ static const struct option_blacklist_info zte_1255_blacklist = {
+ .reserved = BIT(3) | BIT(4),
+ };
+
++static const struct option_blacklist_info simcom_sim7100e_blacklist = {
++ .reserved = BIT(5) | BIT(6),
++};
++
+ static const struct option_blacklist_info telit_le910_blacklist = {
+ .sendsetup = BIT(0),
+ .reserved = BIT(1) | BIT(2),
+@@ -1130,6 +1136,8 @@ static const struct usb_device_id option_ids[] = {
+ { USB_DEVICE(KYOCERA_VENDOR_ID, KYOCERA_PRODUCT_KPC650) },
+ { USB_DEVICE(KYOCERA_VENDOR_ID, KYOCERA_PRODUCT_KPC680) },
+ { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x6000)}, /* ZTE AC8700 */
++ { USB_DEVICE_AND_INTERFACE_INFO(QUALCOMM_VENDOR_ID, 0x6001, 0xff, 0xff, 0xff), /* 4G LTE usb-modem U901 */
++ .driver_info = (kernel_ulong_t)&net_intf3_blacklist },
+ { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x6613)}, /* Onda H600/ZTE MF330 */
+ { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x0023)}, /* ONYX 3G device */
+ { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x9000)}, /* SIMCom SIM5218 */
+@@ -1137,6 +1145,8 @@ static const struct usb_device_id option_ids[] = {
+ .driver_info = (kernel_ulong_t)&sierra_mc73xx_blacklist }, /* MC73xx */
+ { USB_DEVICE_INTERFACE_CLASS(SIERRA_VENDOR_ID, 0x9041, 0xff),
+ .driver_info = (kernel_ulong_t)&sierra_mc73xx_blacklist }, /* MC7305/MC7355 */
++ { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x9003), /* Quectel UC20 */
++ .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
+ { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6001) },
+ { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CMU_300) },
+ { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6003),
+@@ -1188,6 +1198,8 @@ static const struct usb_device_id option_ids[] = {
+ .driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg0 },
+ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE922_USBCFG3),
+ .driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg3 },
++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, TELIT_PRODUCT_LE922_USBCFG5, 0xff),
++ .driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg0 },
+ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910),
+ .driver_info = (kernel_ulong_t)&telit_le910_blacklist },
+ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920),
+@@ -1657,6 +1669,8 @@ static const struct usb_device_id option_ids[] = {
+ { USB_DEVICE(ALINK_VENDOR_ID, 0x9000) },
+ { USB_DEVICE(ALINK_VENDOR_ID, ALINK_PRODUCT_PH300) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ALINK_VENDOR_ID, ALINK_PRODUCT_3GU, 0xff, 0xff, 0xff) },
++ { USB_DEVICE(ALINK_VENDOR_ID, SIMCOM_PRODUCT_SIM7100E),
++ .driver_info = (kernel_ulong_t)&simcom_sim7100e_blacklist },
+ { USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_X060S_X200),
+ .driver_info = (kernel_ulong_t)&alcatel_x200_blacklist
+ },
+diff --git a/drivers/usb/serial/qcserial.c b/drivers/usb/serial/qcserial.c
+index d156545728c2..9dfbea6c1d2c 100644
+--- a/drivers/usb/serial/qcserial.c
++++ b/drivers/usb/serial/qcserial.c
+@@ -152,12 +152,17 @@ static const struct usb_device_id id_table[] = {
+ {DEVICE_SWI(0x1199, 0x9056)}, /* Sierra Wireless Modem */
+ {DEVICE_SWI(0x1199, 0x9060)}, /* Sierra Wireless Modem */
+ {DEVICE_SWI(0x1199, 0x9061)}, /* Sierra Wireless Modem */
++ {DEVICE_SWI(0x1199, 0x9070)}, /* Sierra Wireless MC74xx */
++ {DEVICE_SWI(0x1199, 0x9071)}, /* Sierra Wireless MC74xx */
++ {DEVICE_SWI(0x1199, 0x9078)}, /* Sierra Wireless EM74xx */
++ {DEVICE_SWI(0x1199, 0x9079)}, /* Sierra Wireless EM74xx */
+ {DEVICE_SWI(0x413c, 0x81a2)}, /* Dell Wireless 5806 Gobi(TM) 4G LTE Mobile Broadband Card */
+ {DEVICE_SWI(0x413c, 0x81a3)}, /* Dell Wireless 5570 HSPA+ (42Mbps) Mobile Broadband Card */
+ {DEVICE_SWI(0x413c, 0x81a4)}, /* Dell Wireless 5570e HSPA+ (42Mbps) Mobile Broadband Card */
+ {DEVICE_SWI(0x413c, 0x81a8)}, /* Dell Wireless 5808 Gobi(TM) 4G LTE Mobile Broadband Card */
+ {DEVICE_SWI(0x413c, 0x81a9)}, /* Dell Wireless 5808e Gobi(TM) 4G LTE Mobile Broadband Card */
+ {DEVICE_SWI(0x413c, 0x81b1)}, /* Dell Wireless 5809e Gobi(TM) 4G LTE Mobile Broadband Card */
++ {DEVICE_SWI(0x413c, 0x81b3)}, /* Dell Wireless 5809e Gobi(TM) 4G LTE Mobile Broadband Card (rev3) */
+
+ /* Huawei devices */
+ {DEVICE_HWI(0x03f0, 0x581d)}, /* HP lt4112 LTE/HSPA+ Gobi 4G Modem (Huawei me906e) */
+diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c
+index 2f8a0552d020..bc7bc4e26c89 100644
+--- a/drivers/vfio/pci/vfio_pci.c
++++ b/drivers/vfio/pci/vfio_pci.c
+@@ -375,7 +375,8 @@ static long vfio_pci_ioctl(void *device_data,
+ info.num_regions = VFIO_PCI_NUM_REGIONS;
+ info.num_irqs = VFIO_PCI_NUM_IRQS;
+
+- return copy_to_user((void __user *)arg, &info, minsz);
++ return copy_to_user((void __user *)arg, &info, minsz) ?
++ -EFAULT : 0;
+
+ } else if (cmd == VFIO_DEVICE_GET_REGION_INFO) {
+ struct pci_dev *pdev = vdev->pdev;
+@@ -448,7 +449,8 @@ static long vfio_pci_ioctl(void *device_data,
+ return -EINVAL;
+ }
+
+- return copy_to_user((void __user *)arg, &info, minsz);
++ return copy_to_user((void __user *)arg, &info, minsz) ?
++ -EFAULT : 0;
+
+ } else if (cmd == VFIO_DEVICE_GET_IRQ_INFO) {
+ struct vfio_irq_info info;
+@@ -482,7 +484,8 @@ static long vfio_pci_ioctl(void *device_data,
+ else
+ info.flags |= VFIO_IRQ_INFO_NORESIZE;
+
+- return copy_to_user((void __user *)arg, &info, minsz);
++ return copy_to_user((void __user *)arg, &info, minsz) ?
++ -EFAULT : 0;
+
+ } else if (cmd == VFIO_DEVICE_SET_IRQS) {
+ struct vfio_irq_set hdr;
+diff --git a/drivers/vfio/vfio_iommu_type1.c b/drivers/vfio/vfio_iommu_type1.c
+index 4a9d666f1e91..3d1cbbd730bc 100644
+--- a/drivers/vfio/vfio_iommu_type1.c
++++ b/drivers/vfio/vfio_iommu_type1.c
+@@ -928,7 +928,8 @@ static long vfio_iommu_type1_ioctl(void *iommu_data,
+
+ info.iova_pgsizes = vfio_pgsize_bitmap(iommu);
+
+- return copy_to_user((void __user *)arg, &info, minsz);
++ return copy_to_user((void __user *)arg, &info, minsz) ?
++ -EFAULT : 0;
+
+ } else if (cmd == VFIO_IOMMU_MAP_DMA) {
+ struct vfio_iommu_type1_dma_map map;
+@@ -961,7 +962,8 @@ static long vfio_iommu_type1_ioctl(void *iommu_data,
+ if (ret)
+ return ret;
+
+- return copy_to_user((void __user *)arg, &unmap, minsz);
++ return copy_to_user((void __user *)arg, &unmap, minsz) ?
++ -EFAULT : 0;
+ }
+
+ return -ENOTTY;
+diff --git a/drivers/xen/xen-pciback/pciback.h b/drivers/xen/xen-pciback/pciback.h
+index f72af87640e0..560b3ecbcba8 100644
+--- a/drivers/xen/xen-pciback/pciback.h
++++ b/drivers/xen/xen-pciback/pciback.h
+@@ -37,6 +37,7 @@ struct xen_pcibk_device {
+ struct xen_pci_sharedinfo *sh_info;
+ unsigned long flags;
+ struct work_struct op_work;
++ struct xen_pci_op op;
+ };
+
+ struct xen_pcibk_dev_data {
+diff --git a/drivers/xen/xen-pciback/pciback_ops.c b/drivers/xen/xen-pciback/pciback_ops.c
+index c4a0666de6f5..7eb8f8895a24 100644
+--- a/drivers/xen/xen-pciback/pciback_ops.c
++++ b/drivers/xen/xen-pciback/pciback_ops.c
+@@ -197,13 +197,26 @@ int xen_pcibk_enable_msix(struct xen_pcibk_device *pdev,
+ struct xen_pcibk_dev_data *dev_data;
+ int i, result;
+ struct msix_entry *entries;
++ u16 cmd;
+
+ if (unlikely(verbose_request))
+ printk(KERN_DEBUG DRV_NAME ": %s: enable MSI-X\n",
+ pci_name(dev));
++
+ if (op->value > SH_INFO_MAX_VEC)
+ return -EINVAL;
+
++ if (dev->msix_enabled)
++ return -EALREADY;
++
++ /*
++ * PCI_COMMAND_MEMORY must be enabled, otherwise we may not be able
++ * to access the BARs where the MSI-X entries reside.
++ */
++ pci_read_config_word(dev, PCI_COMMAND, &cmd);
++ if (dev->msi_enabled || !(cmd & PCI_COMMAND_MEMORY))
++ return -ENXIO;
++
+ entries = kmalloc(op->value * sizeof(*entries), GFP_KERNEL);
+ if (entries == NULL)
+ return -ENOMEM;
+@@ -298,9 +311,11 @@ void xen_pcibk_do_op(struct work_struct *data)
+ container_of(data, struct xen_pcibk_device, op_work);
+ struct pci_dev *dev;
+ struct xen_pcibk_dev_data *dev_data = NULL;
+- struct xen_pci_op *op = &pdev->sh_info->op;
++ struct xen_pci_op *op = &pdev->op;
+ int test_intx = 0;
+
++ *op = pdev->sh_info->op;
++ barrier();
+ dev = xen_pcibk_get_pci_dev(pdev, op->domain, op->bus, op->devfn);
+
+ if (dev == NULL)
+@@ -342,6 +357,17 @@ void xen_pcibk_do_op(struct work_struct *data)
+ if ((dev_data->enable_intx != test_intx))
+ xen_pcibk_control_isr(dev, 0 /* no reset */);
+ }
++ pdev->sh_info->op.err = op->err;
++ pdev->sh_info->op.value = op->value;
++#ifdef CONFIG_PCI_MSI
++ if (op->cmd == XEN_PCI_OP_enable_msix && op->err == 0) {
++ unsigned int i;
++
++ for (i = 0; i < op->value; i++)
++ pdev->sh_info->op.msix_entries[i].vector =
++ op->msix_entries[i].vector;
++ }
++#endif
+ /* Tell the driver domain that we're done. */
+ wmb();
+ clear_bit(_XEN_PCIF_active, (unsigned long *)&pdev->sh_info->flags);
+diff --git a/drivers/xen/xen-scsiback.c b/drivers/xen/xen-scsiback.c
+index d30c6b246342..7dec1407f1c7 100644
+--- a/drivers/xen/xen-scsiback.c
++++ b/drivers/xen/xen-scsiback.c
+@@ -947,12 +947,12 @@ out:
+ spin_unlock_irqrestore(&info->v2p_lock, flags);
+
+ out_free:
+- mutex_lock(&tpg->tv_tpg_mutex);
+- tpg->tv_tpg_fe_count--;
+- mutex_unlock(&tpg->tv_tpg_mutex);
+-
+- if (err)
++ if (err) {
++ mutex_lock(&tpg->tv_tpg_mutex);
++ tpg->tv_tpg_fe_count--;
++ mutex_unlock(&tpg->tv_tpg_mutex);
+ kfree(new);
++ }
+
+ return err;
+ }
+diff --git a/fs/cifs/cifsfs.h b/fs/cifs/cifsfs.h
+index 002e0c173939..15da9e346f60 100644
+--- a/fs/cifs/cifsfs.h
++++ b/fs/cifs/cifsfs.h
+@@ -31,19 +31,15 @@
+ * so that it will fit. We use hash_64 to convert the value to 31 bits, and
+ * then add 1, to ensure that we don't end up with a 0 as the value.
+ */
+-#if BITS_PER_LONG == 64
+ static inline ino_t
+ cifs_uniqueid_to_ino_t(u64 fileid)
+ {
++ if ((sizeof(ino_t)) < (sizeof(u64)))
++ return (ino_t)hash_64(fileid, (sizeof(ino_t) * 8) - 1) + 1;
++
+ return (ino_t)fileid;
++
+ }
+-#else
+-static inline ino_t
+-cifs_uniqueid_to_ino_t(u64 fileid)
+-{
+- return (ino_t)hash_64(fileid, (sizeof(ino_t) * 8) - 1) + 1;
+-}
+-#endif
+
+ extern struct file_system_type cifs_fs_type;
+ extern const struct address_space_operations cifs_addr_ops;
+diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
+index 4ae04561be88..9924c8cbe70f 100644
+--- a/fs/cifs/cifssmb.c
++++ b/fs/cifs/cifssmb.c
+@@ -1394,11 +1394,10 @@ openRetry:
+ * current bigbuf.
+ */
+ static int
+-cifs_readv_discard(struct TCP_Server_Info *server, struct mid_q_entry *mid)
++discard_remaining_data(struct TCP_Server_Info *server)
+ {
+ unsigned int rfclen = get_rfc1002_length(server->smallbuf);
+ int remaining = rfclen + 4 - server->total_read;
+- struct cifs_readdata *rdata = mid->callback_data;
+
+ while (remaining > 0) {
+ int length;
+@@ -1412,10 +1411,20 @@ cifs_readv_discard(struct TCP_Server_Info *server, struct mid_q_entry *mid)
+ remaining -= length;
+ }
+
+- dequeue_mid(mid, rdata->result);
+ return 0;
+ }
+
++static int
++cifs_readv_discard(struct TCP_Server_Info *server, struct mid_q_entry *mid)
++{
++ int length;
++ struct cifs_readdata *rdata = mid->callback_data;
++
++ length = discard_remaining_data(server);
++ dequeue_mid(mid, rdata->result);
++ return length;
++}
++
+ int
+ cifs_readv_receive(struct TCP_Server_Info *server, struct mid_q_entry *mid)
+ {
+@@ -1444,6 +1453,12 @@ cifs_readv_receive(struct TCP_Server_Info *server, struct mid_q_entry *mid)
+ return length;
+ server->total_read += length;
+
++ if (server->ops->is_status_pending &&
++ server->ops->is_status_pending(buf, server, 0)) {
++ discard_remaining_data(server);
++ return -1;
++ }
++
+ /* Was the SMB read successful? */
+ rdata->result = server->ops->map_error(buf, false);
+ if (rdata->result != 0) {
+diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
+index 8f1672bb82d5..3398ac7e7b37 100644
+--- a/fs/cifs/smb2pdu.c
++++ b/fs/cifs/smb2pdu.c
+@@ -997,21 +997,25 @@ parse_lease_state(struct TCP_Server_Info *server, struct smb2_create_rsp *rsp,
+ {
+ char *data_offset;
+ struct create_context *cc;
+- unsigned int next = 0;
++ unsigned int next;
++ unsigned int remaining;
+ char *name;
+
+ data_offset = (char *)rsp + 4 + le32_to_cpu(rsp->CreateContextsOffset);
++ remaining = le32_to_cpu(rsp->CreateContextsLength);
+ cc = (struct create_context *)data_offset;
+- do {
+- cc = (struct create_context *)((char *)cc + next);
++ while (remaining >= sizeof(struct create_context)) {
+ name = le16_to_cpu(cc->NameOffset) + (char *)cc;
+- if (le16_to_cpu(cc->NameLength) != 4 ||
+- strncmp(name, "RqLs", 4)) {
+- next = le32_to_cpu(cc->Next);
+- continue;
+- }
+- return server->ops->parse_lease_buf(cc, epoch);
+- } while (next != 0);
++ if (le16_to_cpu(cc->NameLength) == 4 &&
++ strncmp(name, "RqLs", 4) == 0)
++ return server->ops->parse_lease_buf(cc, epoch);
++
++ next = le32_to_cpu(cc->Next);
++ if (!next)
++ break;
++ remaining -= next;
++ cc = (struct create_context *)((char *)cc + next);
++ }
+
+ return 0;
+ }
+diff --git a/fs/hpfs/namei.c b/fs/hpfs/namei.c
+index 0642cafaab34..12da295759f7 100644
+--- a/fs/hpfs/namei.c
++++ b/fs/hpfs/namei.c
+@@ -377,12 +377,11 @@ static int hpfs_unlink(struct inode *dir, struct dentry *dentry)
+ struct inode *inode = dentry->d_inode;
+ dnode_secno dno;
+ int r;
+- int rep = 0;
+ int err;
+
+ hpfs_lock(dir->i_sb);
+ hpfs_adjust_length(name, &len);
+-again:
++
+ err = -ENOENT;
+ de = map_dirent(dir, hpfs_i(dir)->i_dno, name, len, &dno, &qbh);
+ if (!de)
+@@ -402,33 +401,9 @@ again:
+ hpfs_error(dir->i_sb, "there was error when removing dirent");
+ err = -EFSERROR;
+ break;
+- case 2: /* no space for deleting, try to truncate file */
+-
++ case 2: /* no space for deleting */
+ err = -ENOSPC;
+- if (rep++)
+- break;
+-
+- dentry_unhash(dentry);
+- if (!d_unhashed(dentry)) {
+- hpfs_unlock(dir->i_sb);
+- return -ENOSPC;
+- }
+- if (generic_permission(inode, MAY_WRITE) ||
+- !S_ISREG(inode->i_mode) ||
+- get_write_access(inode)) {
+- d_rehash(dentry);
+- } else {
+- struct iattr newattrs;
+- /*pr_info("truncating file before delete.\n");*/
+- newattrs.ia_size = 0;
+- newattrs.ia_valid = ATTR_SIZE | ATTR_CTIME;
+- err = notify_change(dentry, &newattrs, NULL);
+- put_write_access(inode);
+- if (!err)
+- goto again;
+- }
+- hpfs_unlock(dir->i_sb);
+- return -ENOSPC;
++ break;
+ default:
+ drop_nlink(inode);
+ err = 0;
+diff --git a/fs/jffs2/README.Locking b/fs/jffs2/README.Locking
+index 3ea36554107f..8918ac905a3b 100644
+--- a/fs/jffs2/README.Locking
++++ b/fs/jffs2/README.Locking
+@@ -2,10 +2,6 @@
+ JFFS2 LOCKING DOCUMENTATION
+ ---------------------------
+
+-At least theoretically, JFFS2 does not require the Big Kernel Lock
+-(BKL), which was always helpfully obtained for it by Linux 2.4 VFS
+-code. It has its own locking, as described below.
+-
+ This document attempts to describe the existing locking rules for
+ JFFS2. It is not expected to remain perfectly up to date, but ought to
+ be fairly close.
+@@ -69,6 +65,7 @@ Ordering constraints:
+ any f->sem held.
+ 2. Never attempt to lock two file mutexes in one thread.
+ No ordering rules have been made for doing so.
++ 3. Never lock a page cache page with f->sem held.
+
+
+ erase_completion_lock spinlock
+diff --git a/fs/jffs2/build.c b/fs/jffs2/build.c
+index a3750f902adc..c1f04947d7dc 100644
+--- a/fs/jffs2/build.c
++++ b/fs/jffs2/build.c
+@@ -49,7 +49,8 @@ next_inode(int *i, struct jffs2_inode_cache *ic, struct jffs2_sb_info *c)
+
+
+ static void jffs2_build_inode_pass1(struct jffs2_sb_info *c,
+- struct jffs2_inode_cache *ic)
++ struct jffs2_inode_cache *ic,
++ int *dir_hardlinks)
+ {
+ struct jffs2_full_dirent *fd;
+
+@@ -68,19 +69,21 @@ static void jffs2_build_inode_pass1(struct jffs2_sb_info *c,
+ dbg_fsbuild("child \"%s\" (ino #%u) of dir ino #%u doesn't exist!\n",
+ fd->name, fd->ino, ic->ino);
+ jffs2_mark_node_obsolete(c, fd->raw);
++ /* Clear the ic/raw union so it doesn't cause problems later. */
++ fd->ic = NULL;
+ continue;
+ }
+
++ /* From this point, fd->raw is no longer used so we can set fd->ic */
++ fd->ic = child_ic;
++ child_ic->pino_nlink++;
++ /* If we appear (at this stage) to have hard-linked directories,
++ * set a flag to trigger a scan later */
+ if (fd->type == DT_DIR) {
+- if (child_ic->pino_nlink) {
+- JFFS2_ERROR("child dir \"%s\" (ino #%u) of dir ino #%u appears to be a hard link\n",
+- fd->name, fd->ino, ic->ino);
+- /* TODO: What do we do about it? */
+- } else {
+- child_ic->pino_nlink = ic->ino;
+- }
+- } else
+- child_ic->pino_nlink++;
++ child_ic->flags |= INO_FLAGS_IS_DIR;
++ if (child_ic->pino_nlink > 1)
++ *dir_hardlinks = 1;
++ }
+
+ dbg_fsbuild("increased nlink for child \"%s\" (ino #%u)\n", fd->name, fd->ino);
+ /* Can't free scan_dents so far. We might need them in pass 2 */
+@@ -94,8 +97,7 @@ static void jffs2_build_inode_pass1(struct jffs2_sb_info *c,
+ */
+ static int jffs2_build_filesystem(struct jffs2_sb_info *c)
+ {
+- int ret;
+- int i;
++ int ret, i, dir_hardlinks = 0;
+ struct jffs2_inode_cache *ic;
+ struct jffs2_full_dirent *fd;
+ struct jffs2_full_dirent *dead_fds = NULL;
+@@ -119,7 +121,7 @@ static int jffs2_build_filesystem(struct jffs2_sb_info *c)
+ /* Now scan the directory tree, increasing nlink according to every dirent found. */
+ for_each_inode(i, c, ic) {
+ if (ic->scan_dents) {
+- jffs2_build_inode_pass1(c, ic);
++ jffs2_build_inode_pass1(c, ic, &dir_hardlinks);
+ cond_resched();
+ }
+ }
+@@ -155,6 +157,20 @@ static int jffs2_build_filesystem(struct jffs2_sb_info *c)
+ }
+
+ dbg_fsbuild("pass 2a complete\n");
++
++ if (dir_hardlinks) {
++ /* If we detected directory hardlinks earlier, *hopefully*
++ * they are gone now because some of the links were from
++ * dead directories which still had some old dirents lying
++ * around and not yet garbage-collected, but which have
++ * been discarded above. So clear the pino_nlink field
++ * in each directory, so that the final scan below can
++ * print appropriate warnings. */
++ for_each_inode(i, c, ic) {
++ if (ic->flags & INO_FLAGS_IS_DIR)
++ ic->pino_nlink = 0;
++ }
++ }
+ dbg_fsbuild("freeing temporary data structures\n");
+
+ /* Finally, we can scan again and free the dirent structs */
+@@ -162,6 +178,33 @@ static int jffs2_build_filesystem(struct jffs2_sb_info *c)
+ while(ic->scan_dents) {
+ fd = ic->scan_dents;
+ ic->scan_dents = fd->next;
++ /* We do use the pino_nlink field to count nlink of
++ * directories during fs build, so set it to the
++ * parent ino# now. Now that there's hopefully only
++ * one. */
++ if (fd->type == DT_DIR) {
++ if (!fd->ic) {
++ /* We'll have complained about it and marked the coresponding
++ raw node obsolete already. Just skip it. */
++ continue;
++ }
++
++ /* We *have* to have set this in jffs2_build_inode_pass1() */
++ BUG_ON(!(fd->ic->flags & INO_FLAGS_IS_DIR));
++
++ /* We clear ic->pino_nlink ∀ directories' ic *only* if dir_hardlinks
++ * is set. Otherwise, we know this should never trigger anyway, so
++ * we don't do the check. And ic->pino_nlink still contains the nlink
++ * value (which is 1). */
++ if (dir_hardlinks && fd->ic->pino_nlink) {
++ JFFS2_ERROR("child dir \"%s\" (ino #%u) of dir ino #%u is also hard linked from dir ino #%u\n",
++ fd->name, fd->ino, ic->ino, fd->ic->pino_nlink);
++ /* Should we unlink it from its previous parent? */
++ }
++
++ /* For directories, ic->pino_nlink holds that parent inode # */
++ fd->ic->pino_nlink = ic->ino;
++ }
+ jffs2_free_full_dirent(fd);
+ }
+ ic->scan_dents = NULL;
+@@ -240,11 +283,7 @@ static void jffs2_build_remove_unlinked_inode(struct jffs2_sb_info *c,
+
+ /* Reduce nlink of the child. If it's now zero, stick it on the
+ dead_fds list to be cleaned up later. Else just free the fd */
+-
+- if (fd->type == DT_DIR)
+- child_ic->pino_nlink = 0;
+- else
+- child_ic->pino_nlink--;
++ child_ic->pino_nlink--;
+
+ if (!child_ic->pino_nlink) {
+ dbg_fsbuild("inode #%u (\"%s\") now has no links; adding to dead_fds list.\n",
+diff --git a/fs/jffs2/file.c b/fs/jffs2/file.c
+index 64989ca9ba90..129eccb4c5a8 100644
+--- a/fs/jffs2/file.c
++++ b/fs/jffs2/file.c
+@@ -139,39 +139,33 @@ static int jffs2_write_begin(struct file *filp, struct address_space *mapping,
+ struct page *pg;
+ struct inode *inode = mapping->host;
+ struct jffs2_inode_info *f = JFFS2_INODE_INFO(inode);
+- struct jffs2_sb_info *c = JFFS2_SB_INFO(inode->i_sb);
+- struct jffs2_raw_inode ri;
+- uint32_t alloc_len = 0;
+ pgoff_t index = pos >> PAGE_CACHE_SHIFT;
+ uint32_t pageofs = index << PAGE_CACHE_SHIFT;
+ int ret = 0;
+
+- jffs2_dbg(1, "%s()\n", __func__);
+-
+- if (pageofs > inode->i_size) {
+- ret = jffs2_reserve_space(c, sizeof(ri), &alloc_len,
+- ALLOC_NORMAL, JFFS2_SUMMARY_INODE_SIZE);
+- if (ret)
+- return ret;
+- }
+-
+- mutex_lock(&f->sem);
+ pg = grab_cache_page_write_begin(mapping, index, flags);
+- if (!pg) {
+- if (alloc_len)
+- jffs2_complete_reservation(c);
+- mutex_unlock(&f->sem);
++ if (!pg)
+ return -ENOMEM;
+- }
+ *pagep = pg;
+
+- if (alloc_len) {
++ jffs2_dbg(1, "%s()\n", __func__);
++
++ if (pageofs > inode->i_size) {
+ /* Make new hole frag from old EOF to new page */
++ struct jffs2_sb_info *c = JFFS2_SB_INFO(inode->i_sb);
++ struct jffs2_raw_inode ri;
+ struct jffs2_full_dnode *fn;
++ uint32_t alloc_len;
+
+ jffs2_dbg(1, "Writing new hole frag 0x%x-0x%x between current EOF and new page\n",
+ (unsigned int)inode->i_size, pageofs);
+
++ ret = jffs2_reserve_space(c, sizeof(ri), &alloc_len,
++ ALLOC_NORMAL, JFFS2_SUMMARY_INODE_SIZE);
++ if (ret)
++ goto out_page;
++
++ mutex_lock(&f->sem);
+ memset(&ri, 0, sizeof(ri));
+
+ ri.magic = cpu_to_je16(JFFS2_MAGIC_BITMASK);
+@@ -198,6 +192,7 @@ static int jffs2_write_begin(struct file *filp, struct address_space *mapping,
+ if (IS_ERR(fn)) {
+ ret = PTR_ERR(fn);
+ jffs2_complete_reservation(c);
++ mutex_unlock(&f->sem);
+ goto out_page;
+ }
+ ret = jffs2_add_full_dnode_to_inode(c, f, fn);
+@@ -212,10 +207,12 @@ static int jffs2_write_begin(struct file *filp, struct address_space *mapping,
+ jffs2_mark_node_obsolete(c, fn->raw);
+ jffs2_free_full_dnode(fn);
+ jffs2_complete_reservation(c);
++ mutex_unlock(&f->sem);
+ goto out_page;
+ }
+ jffs2_complete_reservation(c);
+ inode->i_size = pageofs;
++ mutex_unlock(&f->sem);
+ }
+
+ /*
+@@ -224,18 +221,18 @@ static int jffs2_write_begin(struct file *filp, struct address_space *mapping,
+ * case of a short-copy.
+ */
+ if (!PageUptodate(pg)) {
++ mutex_lock(&f->sem);
+ ret = jffs2_do_readpage_nolock(inode, pg);
++ mutex_unlock(&f->sem);
+ if (ret)
+ goto out_page;
+ }
+- mutex_unlock(&f->sem);
+ jffs2_dbg(1, "end write_begin(). pg->flags %lx\n", pg->flags);
+ return ret;
+
+ out_page:
+ unlock_page(pg);
+ page_cache_release(pg);
+- mutex_unlock(&f->sem);
+ return ret;
+ }
+
+diff --git a/fs/jffs2/gc.c b/fs/jffs2/gc.c
+index 5a2dec2b064c..95d5880a63ee 100644
+--- a/fs/jffs2/gc.c
++++ b/fs/jffs2/gc.c
+@@ -1296,14 +1296,17 @@ static int jffs2_garbage_collect_dnode(struct jffs2_sb_info *c, struct jffs2_era
+ BUG_ON(start > orig_start);
+ }
+
+- /* First, use readpage() to read the appropriate page into the page cache */
+- /* Q: What happens if we actually try to GC the _same_ page for which commit_write()
+- * triggered garbage collection in the first place?
+- * A: I _think_ it's OK. read_cache_page shouldn't deadlock, we'll write out the
+- * page OK. We'll actually write it out again in commit_write, which is a little
+- * suboptimal, but at least we're correct.
+- */
++ /* The rules state that we must obtain the page lock *before* f->sem, so
++ * drop f->sem temporarily. Since we also hold c->alloc_sem, nothing's
++ * actually going to *change* so we're safe; we only allow reading.
++ *
++ * It is important to note that jffs2_write_begin() will ensure that its
++ * page is marked Uptodate before allocating space. That means that if we
++ * end up here trying to GC the *same* page that jffs2_write_begin() is
++ * trying to write out, read_cache_page() will not deadlock. */
++ mutex_unlock(&f->sem);
+ pg_ptr = jffs2_gc_fetch_page(c, f, start, &pg);
++ mutex_lock(&f->sem);
+
+ if (IS_ERR(pg_ptr)) {
+ pr_warn("read_cache_page() returned error: %ld\n",
+diff --git a/fs/jffs2/nodelist.h b/fs/jffs2/nodelist.h
+index fa35ff79ab35..0637271f3770 100644
+--- a/fs/jffs2/nodelist.h
++++ b/fs/jffs2/nodelist.h
+@@ -194,6 +194,7 @@ struct jffs2_inode_cache {
+ #define INO_STATE_CLEARING 6 /* In clear_inode() */
+
+ #define INO_FLAGS_XATTR_CHECKED 0x01 /* has no duplicate xattr_ref */
++#define INO_FLAGS_IS_DIR 0x02 /* is a directory */
+
+ #define RAWNODE_CLASS_INODE_CACHE 0
+ #define RAWNODE_CLASS_XATTR_DATUM 1
+@@ -249,7 +250,10 @@ struct jffs2_readinode_info
+
+ struct jffs2_full_dirent
+ {
+- struct jffs2_raw_node_ref *raw;
++ union {
++ struct jffs2_raw_node_ref *raw;
++ struct jffs2_inode_cache *ic; /* Just during part of build */
++ };
+ struct jffs2_full_dirent *next;
+ uint32_t version;
+ uint32_t ino; /* == zero for unlink */
+diff --git a/fs/namei.c b/fs/namei.c
+index be3d538d56b3..2a8ba683a888 100644
+--- a/fs/namei.c
++++ b/fs/namei.c
+@@ -3111,6 +3111,10 @@ opened:
+ goto exit_fput;
+ }
+ out:
++ if (unlikely(error > 0)) {
++ WARN_ON(1);
++ error = -EINVAL;
++ }
+ if (got_write)
+ mnt_drop_write(nd->path.mnt);
+ path_put(&save_parent);
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index 4561b2bd1de1..575fb0ebf980 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -2258,9 +2258,9 @@ static int _nfs4_open_and_get_state(struct nfs4_opendata *opendata,
+ dentry = d_add_unique(dentry, igrab(state->inode));
+ if (dentry == NULL) {
+ dentry = opendata->dentry;
+- } else if (dentry != ctx->dentry) {
++ } else {
+ dput(ctx->dentry);
+- ctx->dentry = dget(dentry);
++ ctx->dentry = dentry;
+ }
+ nfs_set_verifier(dentry,
+ nfs_save_change_attribute(opendata->dir->d_inode));
+diff --git a/include/linux/ata.h b/include/linux/ata.h
+index f2f4d8da97c0..f7ff6554a354 100644
+--- a/include/linux/ata.h
++++ b/include/linux/ata.h
+@@ -484,8 +484,8 @@ enum ata_tf_protocols {
+ };
+
+ enum ata_ioctls {
+- ATA_IOC_GET_IO32 = 0x309,
+- ATA_IOC_SET_IO32 = 0x324,
++ ATA_IOC_GET_IO32 = 0x309, /* HDIO_GET_32BIT */
++ ATA_IOC_SET_IO32 = 0x324, /* HDIO_SET_32BIT */
+ };
+
+ /* core structures */
+diff --git a/include/linux/bio.h b/include/linux/bio.h
+index 7347f486ceca..08ce93ede229 100644
+--- a/include/linux/bio.h
++++ b/include/linux/bio.h
+@@ -292,6 +292,43 @@ static inline unsigned bio_segments(struct bio *bio)
+ */
+ #define bio_get(bio) atomic_inc(&(bio)->bi_cnt)
+
++static inline void bio_get_first_bvec(struct bio *bio, struct bio_vec *bv)
++{
++ *bv = bio_iovec(bio);
++}
++
++static inline void bio_get_last_bvec(struct bio *bio, struct bio_vec *bv)
++{
++ struct bvec_iter iter = bio->bi_iter;
++ int idx;
++
++ if (!bio_flagged(bio, BIO_CLONED)) {
++ *bv = bio->bi_io_vec[bio->bi_vcnt - 1];
++ return;
++ }
++
++ if (unlikely(!bio_multiple_segments(bio))) {
++ *bv = bio_iovec(bio);
++ return;
++ }
++
++ bio_advance_iter(bio, &iter, iter.bi_size);
++
++ if (!iter.bi_bvec_done)
++ idx = iter.bi_idx - 1;
++ else /* in the middle of bvec */
++ idx = iter.bi_idx;
++
++ *bv = bio->bi_io_vec[idx];
++
++ /*
++ * iter.bi_bvec_done records actual length of the last bvec
++ * if this bio ends in the middle of one io vector
++ */
++ if (iter.bi_bvec_done)
++ bv->bv_len = iter.bi_bvec_done;
++}
++
+ enum bip_flags {
+ BIP_BLOCK_INTEGRITY = 1 << 0, /* block layer owns integrity data */
+ BIP_MAPPED_INTEGRITY = 1 << 1, /* ref tag has been remapped */
+diff --git a/include/linux/libata.h b/include/linux/libata.h
+index a60e04bcda0f..d69ce28efab1 100644
+--- a/include/linux/libata.h
++++ b/include/linux/libata.h
+@@ -715,7 +715,7 @@ struct ata_device {
+ union {
+ u16 id[ATA_ID_WORDS]; /* IDENTIFY xxx DEVICE data */
+ u32 gscr[SATA_PMP_GSCR_DWORDS]; /* PMP GSCR block */
+- };
++ } ____cacheline_aligned;
+
+ /* DEVSLP Timing Variables from Identify Device Data Log */
+ u8 devslp_timing[ATA_LOG_DEVSLP_SIZE];
+diff --git a/include/linux/nfs_fs.h b/include/linux/nfs_fs.h
+index c72d1ad41ad4..2446e1e21bc7 100644
+--- a/include/linux/nfs_fs.h
++++ b/include/linux/nfs_fs.h
+@@ -538,9 +538,7 @@ extern int nfs_readpage_async(struct nfs_open_context *, struct inode *,
+
+ static inline loff_t nfs_size_to_loff_t(__u64 size)
+ {
+- if (size > (__u64) OFFSET_MAX - 1)
+- return OFFSET_MAX - 1;
+- return (loff_t) size;
++ return min_t(u64, size, OFFSET_MAX);
+ }
+
+ static inline ino_t
+diff --git a/include/target/target_core_base.h b/include/target/target_core_base.h
+index c4b85a5889ba..ad9ce86428a6 100644
+--- a/include/target/target_core_base.h
++++ b/include/target/target_core_base.h
+@@ -520,7 +520,7 @@ struct se_cmd {
+ sense_reason_t (*execute_cmd)(struct se_cmd *);
+ sense_reason_t (*execute_rw)(struct se_cmd *, struct scatterlist *,
+ u32, enum dma_data_direction);
+- sense_reason_t (*transport_complete_callback)(struct se_cmd *, bool);
++ sense_reason_t (*transport_complete_callback)(struct se_cmd *, bool, int *);
+
+ unsigned char *t_task_cdb;
+ unsigned char __t_task_cdb[TCM_MAX_COMMAND_SIZE];
+@@ -535,6 +535,8 @@ struct se_cmd {
+ #define CMD_T_DEV_ACTIVE (1 << 7)
+ #define CMD_T_REQUEST_STOP (1 << 8)
+ #define CMD_T_BUSY (1 << 9)
++#define CMD_T_TAS (1 << 10)
++#define CMD_T_FABRIC_STOP (1 << 11)
+ spinlock_t t_state_lock;
+ struct completion t_transport_stop_comp;
+
+diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c
+index 1b0df1e504f0..b6cd1b653e21 100644
+--- a/kernel/trace/trace_events.c
++++ b/kernel/trace/trace_events.c
+@@ -644,7 +644,8 @@ t_next(struct seq_file *m, void *v, loff_t *pos)
+ * The ftrace subsystem is for showing formats only.
+ * They can not be enabled or disabled via the event files.
+ */
+- if (call->class && call->class->reg)
++ if (call->class && call->class->reg &&
++ !(call->flags & TRACE_EVENT_FL_IGNORE_ENABLE))
+ return file;
+ }
+
+diff --git a/mm/memory.c b/mm/memory.c
+index 90fb265b32b6..e8e3cf7bd247 100644
+--- a/mm/memory.c
++++ b/mm/memory.c
+@@ -3316,8 +3316,18 @@ static int __handle_mm_fault(struct mm_struct *mm, struct vm_area_struct *vma,
+ if (unlikely(pmd_none(*pmd)) &&
+ unlikely(__pte_alloc(mm, vma, pmd, address)))
+ return VM_FAULT_OOM;
+- /* if an huge pmd materialized from under us just retry later */
+- if (unlikely(pmd_trans_huge(*pmd)))
++ /*
++ * If a huge pmd materialized under us just retry later. Use
++ * pmd_trans_unstable() instead of pmd_trans_huge() to ensure the pmd
++ * didn't become pmd_trans_huge under us and then back to pmd_none, as
++ * a result of MADV_DONTNEED running immediately after a huge pmd fault
++ * in a different thread of this mm, in turn leading to a misleading
++ * pmd_trans_huge() retval. All we have to ensure is that it is a
++ * regular pmd that we can walk with pte_offset_map() and we can do that
++ * through an atomic read in C, which is what pmd_trans_unstable()
++ * provides.
++ */
++ if (unlikely(pmd_trans_unstable(pmd)))
+ return 0;
+ /*
+ * A regular pmd is established and it can't morph into a huge pmd
+diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c
+index 56a65536c8f1..1519051603ff 100644
+--- a/net/ceph/messenger.c
++++ b/net/ceph/messenger.c
+@@ -2287,7 +2287,7 @@ static int read_partial_message(struct ceph_connection *con)
+ con->in_base_pos = -front_len - middle_len - data_len -
+ sizeof(m->footer);
+ con->in_tag = CEPH_MSGR_TAG_READY;
+- return 0;
++ return 1;
+ } else if ((s64)seq - (s64)con->in_seq > 1) {
+ pr_err("read_partial_message bad seq %lld expected %lld\n",
+ seq, con->in_seq + 1);
+@@ -2320,7 +2320,7 @@ static int read_partial_message(struct ceph_connection *con)
+ sizeof(m->footer);
+ con->in_tag = CEPH_MSGR_TAG_READY;
+ con->in_seq++;
+- return 0;
++ return 1;
+ }
+
+ BUG_ON(!con->in_msg);
+diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
+index 25cd22c1ddee..1a93a39b2aab 100644
+--- a/net/ipv6/ip6_gre.c
++++ b/net/ipv6/ip6_gre.c
+@@ -360,6 +360,7 @@ static void ip6gre_tunnel_uninit(struct net_device *dev)
+ struct ip6_tnl *t = netdev_priv(dev);
+ struct ip6gre_net *ign = net_generic(t->net, ip6gre_net_id);
+
++ ip6gre_tunnel_unlink(ign, t);
+ ip6_tnl_dst_reset(netdev_priv(dev));
+ dev_put(dev);
+ }
+diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
+index 7b5cb003ee22..9524b4596bf5 100644
+--- a/net/ipv6/ip6_output.c
++++ b/net/ipv6/ip6_output.c
+@@ -374,6 +374,9 @@ int ip6_forward(struct sk_buff *skb)
+ if (skb->pkt_type != PACKET_HOST)
+ goto drop;
+
++ if (unlikely(skb->sk))
++ goto drop;
++
+ if (skb_warn_if_lro(skb))
+ goto drop;
+
+diff --git a/net/sunrpc/cache.c b/net/sunrpc/cache.c
+index 48f14003af10..14d38ec5e53d 100644
+--- a/net/sunrpc/cache.c
++++ b/net/sunrpc/cache.c
+@@ -1230,7 +1230,7 @@ int qword_get(char **bpp, char *dest, int bufsize)
+ if (bp[0] == '\\' && bp[1] == 'x') {
+ /* HEX STRING */
+ bp += 2;
+- while (len < bufsize) {
++ while (len < bufsize - 1) {
+ int h, l;
+
+ h = hex_to_bin(bp[0]);
+diff --git a/sound/core/control_compat.c b/sound/core/control_compat.c
+index b9c0910fb8c4..0608f216f359 100644
+--- a/sound/core/control_compat.c
++++ b/sound/core/control_compat.c
+@@ -170,6 +170,19 @@ struct snd_ctl_elem_value32 {
+ unsigned char reserved[128];
+ };
+
++#ifdef CONFIG_X86_X32
++/* x32 has a different alignment for 64bit values from ia32 */
++struct snd_ctl_elem_value_x32 {
++ struct snd_ctl_elem_id id;
++ unsigned int indirect; /* bit-field causes misalignment */
++ union {
++ s32 integer[128];
++ unsigned char data[512];
++ s64 integer64[64];
++ } value;
++ unsigned char reserved[128];
++};
++#endif /* CONFIG_X86_X32 */
+
+ /* get the value type and count of the control */
+ static int get_ctl_type(struct snd_card *card, struct snd_ctl_elem_id *id,
+@@ -219,9 +232,11 @@ static int get_elem_size(int type, int count)
+
+ static int copy_ctl_value_from_user(struct snd_card *card,
+ struct snd_ctl_elem_value *data,
+- struct snd_ctl_elem_value32 __user *data32,
++ void __user *userdata,
++ void __user *valuep,
+ int *typep, int *countp)
+ {
++ struct snd_ctl_elem_value32 __user *data32 = userdata;
+ int i, type, size;
+ int uninitialized_var(count);
+ unsigned int indirect;
+@@ -239,8 +254,9 @@ static int copy_ctl_value_from_user(struct snd_card *card,
+ if (type == SNDRV_CTL_ELEM_TYPE_BOOLEAN ||
+ type == SNDRV_CTL_ELEM_TYPE_INTEGER) {
+ for (i = 0; i < count; i++) {
++ s32 __user *intp = valuep;
+ int val;
+- if (get_user(val, &data32->value.integer[i]))
++ if (get_user(val, &intp[i]))
+ return -EFAULT;
+ data->value.integer.value[i] = val;
+ }
+@@ -250,8 +266,7 @@ static int copy_ctl_value_from_user(struct snd_card *card,
+ dev_err(card->dev, "snd_ioctl32_ctl_elem_value: unknown type %d\n", type);
+ return -EINVAL;
+ }
+- if (copy_from_user(data->value.bytes.data,
+- data32->value.data, size))
++ if (copy_from_user(data->value.bytes.data, valuep, size))
+ return -EFAULT;
+ }
+
+@@ -261,7 +276,8 @@ static int copy_ctl_value_from_user(struct snd_card *card,
+ }
+
+ /* restore the value to 32bit */
+-static int copy_ctl_value_to_user(struct snd_ctl_elem_value32 __user *data32,
++static int copy_ctl_value_to_user(void __user *userdata,
++ void __user *valuep,
+ struct snd_ctl_elem_value *data,
+ int type, int count)
+ {
+@@ -270,22 +286,22 @@ static int copy_ctl_value_to_user(struct snd_ctl_elem_value32 __user *data32,
+ if (type == SNDRV_CTL_ELEM_TYPE_BOOLEAN ||
+ type == SNDRV_CTL_ELEM_TYPE_INTEGER) {
+ for (i = 0; i < count; i++) {
++ s32 __user *intp = valuep;
+ int val;
+ val = data->value.integer.value[i];
+- if (put_user(val, &data32->value.integer[i]))
++ if (put_user(val, &intp[i]))
+ return -EFAULT;
+ }
+ } else {
+ size = get_elem_size(type, count);
+- if (copy_to_user(data32->value.data,
+- data->value.bytes.data, size))
++ if (copy_to_user(valuep, data->value.bytes.data, size))
+ return -EFAULT;
+ }
+ return 0;
+ }
+
+-static int snd_ctl_elem_read_user_compat(struct snd_card *card,
+- struct snd_ctl_elem_value32 __user *data32)
++static int ctl_elem_read_user(struct snd_card *card,
++ void __user *userdata, void __user *valuep)
+ {
+ struct snd_ctl_elem_value *data;
+ int err, type, count;
+@@ -294,7 +310,9 @@ static int snd_ctl_elem_read_user_compat(struct snd_card *card,
+ if (data == NULL)
+ return -ENOMEM;
+
+- if ((err = copy_ctl_value_from_user(card, data, data32, &type, &count)) < 0)
++ err = copy_ctl_value_from_user(card, data, userdata, valuep,
++ &type, &count);
++ if (err < 0)
+ goto error;
+
+ snd_power_lock(card);
+@@ -303,14 +321,15 @@ static int snd_ctl_elem_read_user_compat(struct snd_card *card,
+ err = snd_ctl_elem_read(card, data);
+ snd_power_unlock(card);
+ if (err >= 0)
+- err = copy_ctl_value_to_user(data32, data, type, count);
++ err = copy_ctl_value_to_user(userdata, valuep, data,
++ type, count);
+ error:
+ kfree(data);
+ return err;
+ }
+
+-static int snd_ctl_elem_write_user_compat(struct snd_ctl_file *file,
+- struct snd_ctl_elem_value32 __user *data32)
++static int ctl_elem_write_user(struct snd_ctl_file *file,
++ void __user *userdata, void __user *valuep)
+ {
+ struct snd_ctl_elem_value *data;
+ struct snd_card *card = file->card;
+@@ -320,7 +339,9 @@ static int snd_ctl_elem_write_user_compat(struct snd_ctl_file *file,
+ if (data == NULL)
+ return -ENOMEM;
+
+- if ((err = copy_ctl_value_from_user(card, data, data32, &type, &count)) < 0)
++ err = copy_ctl_value_from_user(card, data, userdata, valuep,
++ &type, &count);
++ if (err < 0)
+ goto error;
+
+ snd_power_lock(card);
+@@ -329,12 +350,39 @@ static int snd_ctl_elem_write_user_compat(struct snd_ctl_file *file,
+ err = snd_ctl_elem_write(card, file, data);
+ snd_power_unlock(card);
+ if (err >= 0)
+- err = copy_ctl_value_to_user(data32, data, type, count);
++ err = copy_ctl_value_to_user(userdata, valuep, data,
++ type, count);
+ error:
+ kfree(data);
+ return err;
+ }
+
++static int snd_ctl_elem_read_user_compat(struct snd_card *card,
++ struct snd_ctl_elem_value32 __user *data32)
++{
++ return ctl_elem_read_user(card, data32, &data32->value);
++}
++
++static int snd_ctl_elem_write_user_compat(struct snd_ctl_file *file,
++ struct snd_ctl_elem_value32 __user *data32)
++{
++ return ctl_elem_write_user(file, data32, &data32->value);
++}
++
++#ifdef CONFIG_X86_X32
++static int snd_ctl_elem_read_user_x32(struct snd_card *card,
++ struct snd_ctl_elem_value_x32 __user *data32)
++{
++ return ctl_elem_read_user(card, data32, &data32->value);
++}
++
++static int snd_ctl_elem_write_user_x32(struct snd_ctl_file *file,
++ struct snd_ctl_elem_value_x32 __user *data32)
++{
++ return ctl_elem_write_user(file, data32, &data32->value);
++}
++#endif /* CONFIG_X86_X32 */
++
+ /* add or replace a user control */
+ static int snd_ctl_elem_add_compat(struct snd_ctl_file *file,
+ struct snd_ctl_elem_info32 __user *data32,
+@@ -393,6 +441,10 @@ enum {
+ SNDRV_CTL_IOCTL_ELEM_WRITE32 = _IOWR('U', 0x13, struct snd_ctl_elem_value32),
+ SNDRV_CTL_IOCTL_ELEM_ADD32 = _IOWR('U', 0x17, struct snd_ctl_elem_info32),
+ SNDRV_CTL_IOCTL_ELEM_REPLACE32 = _IOWR('U', 0x18, struct snd_ctl_elem_info32),
++#ifdef CONFIG_X86_X32
++ SNDRV_CTL_IOCTL_ELEM_READ_X32 = _IOWR('U', 0x12, struct snd_ctl_elem_value_x32),
++ SNDRV_CTL_IOCTL_ELEM_WRITE_X32 = _IOWR('U', 0x13, struct snd_ctl_elem_value_x32),
++#endif /* CONFIG_X86_X32 */
+ };
+
+ static inline long snd_ctl_ioctl_compat(struct file *file, unsigned int cmd, unsigned long arg)
+@@ -431,6 +483,12 @@ static inline long snd_ctl_ioctl_compat(struct file *file, unsigned int cmd, uns
+ return snd_ctl_elem_add_compat(ctl, argp, 0);
+ case SNDRV_CTL_IOCTL_ELEM_REPLACE32:
+ return snd_ctl_elem_add_compat(ctl, argp, 1);
++#ifdef CONFIG_X86_X32
++ case SNDRV_CTL_IOCTL_ELEM_READ_X32:
++ return snd_ctl_elem_read_user_x32(ctl->card, argp);
++ case SNDRV_CTL_IOCTL_ELEM_WRITE_X32:
++ return snd_ctl_elem_write_user_x32(ctl, argp);
++#endif /* CONFIG_X86_X32 */
+ }
+
+ down_read(&snd_ioctl_rwsem);
+diff --git a/sound/core/rawmidi_compat.c b/sound/core/rawmidi_compat.c
+index 5268c1f58c25..09a89094dcf7 100644
+--- a/sound/core/rawmidi_compat.c
++++ b/sound/core/rawmidi_compat.c
+@@ -94,9 +94,58 @@ static int snd_rawmidi_ioctl_status_compat(struct snd_rawmidi_file *rfile,
+ return 0;
+ }
+
++#ifdef CONFIG_X86_X32
++/* X32 ABI has 64bit timespec and 64bit alignment */
++struct snd_rawmidi_status_x32 {
++ s32 stream;
++ u32 rsvd; /* alignment */
++ struct timespec tstamp;
++ u32 avail;
++ u32 xruns;
++ unsigned char reserved[16];
++} __attribute__((packed));
++
++#define put_timespec(src, dst) copy_to_user(dst, src, sizeof(*dst))
++
++static int snd_rawmidi_ioctl_status_x32(struct snd_rawmidi_file *rfile,
++ struct snd_rawmidi_status_x32 __user *src)
++{
++ int err;
++ struct snd_rawmidi_status status;
++
++ if (rfile->output == NULL)
++ return -EINVAL;
++ if (get_user(status.stream, &src->stream))
++ return -EFAULT;
++
++ switch (status.stream) {
++ case SNDRV_RAWMIDI_STREAM_OUTPUT:
++ err = snd_rawmidi_output_status(rfile->output, &status);
++ break;
++ case SNDRV_RAWMIDI_STREAM_INPUT:
++ err = snd_rawmidi_input_status(rfile->input, &status);
++ break;
++ default:
++ return -EINVAL;
++ }
++ if (err < 0)
++ return err;
++
++ if (put_timespec(&status.tstamp, &src->tstamp) ||
++ put_user(status.avail, &src->avail) ||
++ put_user(status.xruns, &src->xruns))
++ return -EFAULT;
++
++ return 0;
++}
++#endif /* CONFIG_X86_X32 */
++
+ enum {
+ SNDRV_RAWMIDI_IOCTL_PARAMS32 = _IOWR('W', 0x10, struct snd_rawmidi_params32),
+ SNDRV_RAWMIDI_IOCTL_STATUS32 = _IOWR('W', 0x20, struct snd_rawmidi_status32),
++#ifdef CONFIG_X86_X32
++ SNDRV_RAWMIDI_IOCTL_STATUS_X32 = _IOWR('W', 0x20, struct snd_rawmidi_status_x32),
++#endif /* CONFIG_X86_X32 */
+ };
+
+ static long snd_rawmidi_ioctl_compat(struct file *file, unsigned int cmd, unsigned long arg)
+@@ -115,6 +164,10 @@ static long snd_rawmidi_ioctl_compat(struct file *file, unsigned int cmd, unsign
+ return snd_rawmidi_ioctl_params_compat(rfile, argp);
+ case SNDRV_RAWMIDI_IOCTL_STATUS32:
+ return snd_rawmidi_ioctl_status_compat(rfile, argp);
++#ifdef CONFIG_X86_X32
++ case SNDRV_RAWMIDI_IOCTL_STATUS_X32:
++ return snd_rawmidi_ioctl_status_x32(rfile, argp);
++#endif /* CONFIG_X86_X32 */
+ }
+ return -ENOIOCTLCMD;
+ }
+diff --git a/sound/core/seq/oss/seq_oss.c b/sound/core/seq/oss/seq_oss.c
+index 16d42679e43f..bb032d7593e3 100644
+--- a/sound/core/seq/oss/seq_oss.c
++++ b/sound/core/seq/oss/seq_oss.c
+@@ -144,8 +144,6 @@ odev_release(struct inode *inode, struct file *file)
+ if ((dp = file->private_data) == NULL)
+ return 0;
+
+- snd_seq_oss_drain_write(dp);
+-
+ mutex_lock(®ister_mutex);
+ snd_seq_oss_release(dp);
+ mutex_unlock(®ister_mutex);
+diff --git a/sound/core/seq/oss/seq_oss_device.h b/sound/core/seq/oss/seq_oss_device.h
+index b43924325249..d7b4d016b547 100644
+--- a/sound/core/seq/oss/seq_oss_device.h
++++ b/sound/core/seq/oss/seq_oss_device.h
+@@ -127,7 +127,6 @@ int snd_seq_oss_write(struct seq_oss_devinfo *dp, const char __user *buf, int co
+ unsigned int snd_seq_oss_poll(struct seq_oss_devinfo *dp, struct file *file, poll_table * wait);
+
+ void snd_seq_oss_reset(struct seq_oss_devinfo *dp);
+-void snd_seq_oss_drain_write(struct seq_oss_devinfo *dp);
+
+ /* */
+ void snd_seq_oss_process_queue(struct seq_oss_devinfo *dp, abstime_t time);
+diff --git a/sound/core/seq/oss/seq_oss_init.c b/sound/core/seq/oss/seq_oss_init.c
+index beea8c861f49..acefecb1a47a 100644
+--- a/sound/core/seq/oss/seq_oss_init.c
++++ b/sound/core/seq/oss/seq_oss_init.c
+@@ -441,22 +441,6 @@ snd_seq_oss_release(struct seq_oss_devinfo *dp)
+
+
+ /*
+- * Wait until the queue is empty (if we don't have nonblock)
+- */
+-void
+-snd_seq_oss_drain_write(struct seq_oss_devinfo *dp)
+-{
+- if (! dp->timer->running)
+- return;
+- if (is_write_mode(dp->file_mode) && !is_nonblock_mode(dp->file_mode) &&
+- dp->writeq) {
+- while (snd_seq_oss_writeq_sync(dp->writeq))
+- ;
+- }
+-}
+-
+-
+-/*
+ * reset sequencer devices
+ */
+ void
+diff --git a/sound/core/timer_compat.c b/sound/core/timer_compat.c
+index e05802ae6e1b..2e908225d754 100644
+--- a/sound/core/timer_compat.c
++++ b/sound/core/timer_compat.c
+@@ -70,13 +70,14 @@ static int snd_timer_user_status_compat(struct file *file,
+ struct snd_timer_status32 __user *_status)
+ {
+ struct snd_timer_user *tu;
+- struct snd_timer_status status;
++ struct snd_timer_status32 status;
+
+ tu = file->private_data;
+ if (snd_BUG_ON(!tu->timeri))
+ return -ENXIO;
+ memset(&status, 0, sizeof(status));
+- status.tstamp = tu->tstamp;
++ status.tstamp.tv_sec = tu->tstamp.tv_sec;
++ status.tstamp.tv_nsec = tu->tstamp.tv_nsec;
+ status.resolution = snd_timer_resolution(tu->timeri);
+ status.lost = tu->timeri->lost;
+ status.overrun = tu->overrun;
+@@ -88,12 +89,21 @@ static int snd_timer_user_status_compat(struct file *file,
+ return 0;
+ }
+
++#ifdef CONFIG_X86_X32
++/* X32 ABI has the same struct as x86-64 */
++#define snd_timer_user_status_x32(file, s) \
++ snd_timer_user_status(file, s)
++#endif /* CONFIG_X86_X32 */
++
+ /*
+ */
+
+ enum {
+ SNDRV_TIMER_IOCTL_INFO32 = _IOR('T', 0x11, struct snd_timer_info32),
+ SNDRV_TIMER_IOCTL_STATUS32 = _IOW('T', 0x14, struct snd_timer_status32),
++#ifdef CONFIG_X86_X32
++ SNDRV_TIMER_IOCTL_STATUS_X32 = _IOW('T', 0x14, struct snd_timer_status),
++#endif /* CONFIG_X86_X32 */
+ };
+
+ static long snd_timer_user_ioctl_compat(struct file *file, unsigned int cmd, unsigned long arg)
+@@ -122,6 +132,10 @@ static long snd_timer_user_ioctl_compat(struct file *file, unsigned int cmd, uns
+ return snd_timer_user_info_compat(file, argp);
+ case SNDRV_TIMER_IOCTL_STATUS32:
+ return snd_timer_user_status_compat(file, argp);
++#ifdef CONFIG_X86_X32
++ case SNDRV_TIMER_IOCTL_STATUS_X32:
++ return snd_timer_user_status_x32(file, argp);
++#endif /* CONFIG_X86_X32 */
+ }
+ return -ENOIOCTLCMD;
+ }
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index f9f929d5130a..0405e9753c04 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -29,6 +29,7 @@
+ #include <linux/pci.h>
+ #include <linux/dmi.h>
+ #include <linux/module.h>
++#include <linux/input.h>
+ #include <sound/core.h>
+ #include <sound/jack.h>
+ #include "hda_codec.h"
+@@ -96,6 +97,8 @@ struct alc_spec {
+ hda_nid_t cap_mute_led_nid;
+
+ unsigned int gpio_led; /* used for alc269_fixup_hp_gpio_led() */
++ unsigned int gpio_mute_led_mask;
++ unsigned int gpio_mic_led_mask;
+
+ hda_nid_t headset_mic_pin;
+ hda_nid_t headphone_mic_pin;
+@@ -118,6 +121,9 @@ struct alc_spec {
+ hda_nid_t pll_nid;
+ unsigned int pll_coef_idx, pll_coef_bit;
+ unsigned int coef0;
++#if IS_ENABLED(CONFIG_INPUT)
++ struct input_dev *kb_dev;
++#endif
+ };
+
+ /*
+@@ -3322,41 +3328,45 @@ static void alc269_fixup_hp_mute_led_mic2(struct hda_codec *codec,
+ }
+ }
+
+-/* turn on/off mute LED per vmaster hook */
+-static void alc269_fixup_hp_gpio_mute_hook(void *private_data, int enabled)
++/* update LED status via GPIO */
++static void alc_update_gpio_led(struct hda_codec *codec, unsigned int mask,
++ bool enabled)
+ {
+- struct hda_codec *codec = private_data;
+ struct alc_spec *spec = codec->spec;
+ unsigned int oldval = spec->gpio_led;
+
++ if (spec->mute_led_polarity)
++ enabled = !enabled;
++
+ if (enabled)
+- spec->gpio_led &= ~0x08;
++ spec->gpio_led &= ~mask;
+ else
+- spec->gpio_led |= 0x08;
++ spec->gpio_led |= mask;
+ if (spec->gpio_led != oldval)
+ snd_hda_codec_write(codec, 0x01, 0, AC_VERB_SET_GPIO_DATA,
+ spec->gpio_led);
+ }
+
+-/* turn on/off mic-mute LED per capture hook */
+-static void alc269_fixup_hp_gpio_mic_mute_hook(struct hda_codec *codec,
+- struct snd_kcontrol *kcontrol,
+- struct snd_ctl_elem_value *ucontrol)
++/* turn on/off mute LED via GPIO per vmaster hook */
++static void alc_fixup_gpio_mute_hook(void *private_data, int enabled)
+ {
++ struct hda_codec *codec = private_data;
+ struct alc_spec *spec = codec->spec;
+- unsigned int oldval = spec->gpio_led;
+
+- if (!ucontrol)
+- return;
++ alc_update_gpio_led(codec, spec->gpio_mute_led_mask, enabled);
++}
+
+- if (ucontrol->value.integer.value[0] ||
+- ucontrol->value.integer.value[1])
+- spec->gpio_led &= ~0x10;
+- else
+- spec->gpio_led |= 0x10;
+- if (spec->gpio_led != oldval)
+- snd_hda_codec_write(codec, 0x01, 0, AC_VERB_SET_GPIO_DATA,
+- spec->gpio_led);
++/* turn on/off mic-mute LED via GPIO per capture hook */
++static void alc_fixup_gpio_mic_mute_hook(struct hda_codec *codec,
++ struct snd_kcontrol *kcontrol,
++ struct snd_ctl_elem_value *ucontrol)
++{
++ struct alc_spec *spec = codec->spec;
++
++ if (ucontrol)
++ alc_update_gpio_led(codec, spec->gpio_mic_led_mask,
++ ucontrol->value.integer.value[0] ||
++ ucontrol->value.integer.value[1]);
+ }
+
+ static void alc269_fixup_hp_gpio_led(struct hda_codec *codec,
+@@ -3370,9 +3380,33 @@ static void alc269_fixup_hp_gpio_led(struct hda_codec *codec,
+ };
+
+ if (action == HDA_FIXUP_ACT_PRE_PROBE) {
+- spec->gen.vmaster_mute.hook = alc269_fixup_hp_gpio_mute_hook;
+- spec->gen.cap_sync_hook = alc269_fixup_hp_gpio_mic_mute_hook;
++ spec->gen.vmaster_mute.hook = alc_fixup_gpio_mute_hook;
++ spec->gen.cap_sync_hook = alc_fixup_gpio_mic_mute_hook;
+ spec->gpio_led = 0;
++ spec->mute_led_polarity = 0;
++ spec->gpio_mute_led_mask = 0x08;
++ spec->gpio_mic_led_mask = 0x10;
++ snd_hda_add_verbs(codec, gpio_init);
++ }
++}
++
++static void alc286_fixup_hp_gpio_led(struct hda_codec *codec,
++ const struct hda_fixup *fix, int action)
++{
++ struct alc_spec *spec = codec->spec;
++ static const struct hda_verb gpio_init[] = {
++ { 0x01, AC_VERB_SET_GPIO_MASK, 0x22 },
++ { 0x01, AC_VERB_SET_GPIO_DIRECTION, 0x22 },
++ {}
++ };
++
++ if (action == HDA_FIXUP_ACT_PRE_PROBE) {
++ spec->gen.vmaster_mute.hook = alc_fixup_gpio_mute_hook;
++ spec->gen.cap_sync_hook = alc_fixup_gpio_mic_mute_hook;
++ spec->gpio_led = 0;
++ spec->mute_led_polarity = 0;
++ spec->gpio_mute_led_mask = 0x02;
++ spec->gpio_mic_led_mask = 0x20;
+ snd_hda_add_verbs(codec, gpio_init);
+ }
+ }
+@@ -3414,9 +3448,11 @@ static void alc269_fixup_hp_gpio_mic1_led(struct hda_codec *codec,
+ };
+
+ if (action == HDA_FIXUP_ACT_PRE_PROBE) {
+- spec->gen.vmaster_mute.hook = alc269_fixup_hp_gpio_mute_hook;
++ spec->gen.vmaster_mute.hook = alc_fixup_gpio_mute_hook;
+ spec->gen.cap_sync_hook = alc269_fixup_hp_cap_mic_mute_hook;
+ spec->gpio_led = 0;
++ spec->mute_led_polarity = 0;
++ spec->gpio_mute_led_mask = 0x08;
+ spec->cap_mute_led_nid = 0x18;
+ snd_hda_add_verbs(codec, gpio_init);
+ codec->power_filter = led_power_filter;
+@@ -3435,15 +3471,147 @@ static void alc280_fixup_hp_gpio4(struct hda_codec *codec,
+ };
+
+ if (action == HDA_FIXUP_ACT_PRE_PROBE) {
+- spec->gen.vmaster_mute.hook = alc269_fixup_hp_gpio_mute_hook;
++ spec->gen.vmaster_mute.hook = alc_fixup_gpio_mute_hook;
+ spec->gen.cap_sync_hook = alc269_fixup_hp_cap_mic_mute_hook;
+ spec->gpio_led = 0;
++ spec->mute_led_polarity = 0;
++ spec->gpio_mute_led_mask = 0x08;
+ spec->cap_mute_led_nid = 0x18;
+ snd_hda_add_verbs(codec, gpio_init);
+ codec->power_filter = led_power_filter;
+ }
+ }
+
++#if IS_ENABLED(CONFIG_INPUT)
++static void gpio2_mic_hotkey_event(struct hda_codec *codec,
++ struct hda_jack_callback *event)
++{
++ struct alc_spec *spec = codec->spec;
++
++ /* GPIO2 just toggles on a keypress/keyrelease cycle. Therefore
++ send both key on and key off event for every interrupt. */
++ input_report_key(spec->kb_dev, KEY_MICMUTE, 1);
++ input_sync(spec->kb_dev);
++ input_report_key(spec->kb_dev, KEY_MICMUTE, 0);
++ input_sync(spec->kb_dev);
++}
++#endif
++
++static int alc_register_micmute_input_device(struct hda_codec *codec)
++{
++ struct alc_spec *spec = codec->spec;
++
++ spec->kb_dev = input_allocate_device();
++ if (!spec->kb_dev) {
++ codec_err(codec, "Out of memory (input_allocate_device)\n");
++ return -ENOMEM;
++ }
++ spec->kb_dev->name = "Microphone Mute Button";
++ spec->kb_dev->evbit[0] = BIT_MASK(EV_KEY);
++ spec->kb_dev->keybit[BIT_WORD(KEY_MICMUTE)] = BIT_MASK(KEY_MICMUTE);
++
++ if (input_register_device(spec->kb_dev)) {
++ codec_err(codec, "input_register_device failed\n");
++ input_free_device(spec->kb_dev);
++ spec->kb_dev = NULL;
++ return -ENOMEM;
++ }
++
++ return 0;
++}
++
++static void alc280_fixup_hp_gpio2_mic_hotkey(struct hda_codec *codec,
++ const struct hda_fixup *fix, int action)
++{
++#if IS_ENABLED(CONFIG_INPUT)
++ /* GPIO1 = set according to SKU external amp
++ GPIO2 = mic mute hotkey
++ GPIO3 = mute LED
++ GPIO4 = mic mute LED */
++ static const struct hda_verb gpio_init[] = {
++ { 0x01, AC_VERB_SET_GPIO_MASK, 0x1e },
++ { 0x01, AC_VERB_SET_GPIO_DIRECTION, 0x1a },
++ { 0x01, AC_VERB_SET_GPIO_DATA, 0x02 },
++ {}
++ };
++
++ struct alc_spec *spec = codec->spec;
++
++ if (action == HDA_FIXUP_ACT_PRE_PROBE) {
++ if (alc_register_micmute_input_device(codec) != 0)
++ return;
++
++ snd_hda_add_verbs(codec, gpio_init);
++ snd_hda_codec_write_cache(codec, codec->afg, 0,
++ AC_VERB_SET_GPIO_UNSOLICITED_RSP_MASK, 0x04);
++ snd_hda_jack_detect_enable_callback(codec, codec->afg,
++ gpio2_mic_hotkey_event);
++
++ spec->gen.vmaster_mute.hook = alc_fixup_gpio_mute_hook;
++ spec->gen.cap_sync_hook = alc_fixup_gpio_mic_mute_hook;
++ spec->gpio_led = 0;
++ spec->mute_led_polarity = 0;
++ spec->gpio_mute_led_mask = 0x08;
++ spec->gpio_mic_led_mask = 0x10;
++ return;
++ }
++
++ if (!spec->kb_dev)
++ return;
++
++ switch (action) {
++ case HDA_FIXUP_ACT_PROBE:
++ spec->init_amp = ALC_INIT_DEFAULT;
++ break;
++ case HDA_FIXUP_ACT_FREE:
++ input_unregister_device(spec->kb_dev);
++ input_free_device(spec->kb_dev);
++ spec->kb_dev = NULL;
++ }
++#endif
++}
++
++static void alc233_fixup_lenovo_line2_mic_hotkey(struct hda_codec *codec,
++ const struct hda_fixup *fix, int action)
++{
++ /* Line2 = mic mute hotkey
++ GPIO2 = mic mute LED */
++ static const struct hda_verb gpio_init[] = {
++ { 0x01, AC_VERB_SET_GPIO_MASK, 0x04 },
++ { 0x01, AC_VERB_SET_GPIO_DIRECTION, 0x04 },
++ {}
++ };
++
++ struct alc_spec *spec = codec->spec;
++
++ if (action == HDA_FIXUP_ACT_PRE_PROBE) {
++ if (alc_register_micmute_input_device(codec) != 0)
++ return;
++
++ snd_hda_add_verbs(codec, gpio_init);
++ snd_hda_jack_detect_enable_callback(codec, 0x1b,
++ gpio2_mic_hotkey_event);
++
++ spec->gen.cap_sync_hook = alc_fixup_gpio_mic_mute_hook;
++ spec->gpio_led = 0;
++ spec->mute_led_polarity = 0;
++ spec->gpio_mic_led_mask = 0x04;
++ return;
++ }
++
++ if (!spec->kb_dev)
++ return;
++
++ switch (action) {
++ case HDA_FIXUP_ACT_PROBE:
++ spec->init_amp = ALC_INIT_DEFAULT;
++ break;
++ case HDA_FIXUP_ACT_FREE:
++ input_unregister_device(spec->kb_dev);
++ spec->kb_dev = NULL;
++ }
++}
++
+ static void alc269_fixup_hp_line1_mic1_led(struct hda_codec *codec,
+ const struct hda_fixup *fix, int action)
+ {
+@@ -3629,6 +3797,10 @@ static void alc_headset_mode_mic_in(struct hda_codec *codec, hda_nid_t hp_pin,
+
+ static void alc_headset_mode_default(struct hda_codec *codec)
+ {
++ static struct coef_fw coef0225[] = {
++ UPDATE_COEF(0x45, 0x3f<<10, 0x34<<10),
++ {}
++ };
+ static struct coef_fw coef0255[] = {
+ WRITE_COEF(0x45, 0xc089),
+ WRITE_COEF(0x45, 0xc489),
+@@ -3670,6 +3842,9 @@ static void alc_headset_mode_default(struct hda_codec *codec)
+ };
+
+ switch (codec->vendor_id) {
++ case 0x10ec0225:
++ alc_process_coef_fw(codec, coef0225);
++ break;
+ case 0x10ec0255:
+ case 0x10ec0256:
+ alc_process_coef_fw(codec, coef0255);
+@@ -4074,6 +4249,29 @@ static void alc_fixup_headset_mode_alc255_no_hp_mic(struct hda_codec *codec,
+ alc_fixup_headset_mode(codec, fix, action);
+ }
+
++static void alc288_update_headset_jack_cb(struct hda_codec *codec,
++ struct hda_jack_callback *jack)
++{
++ struct alc_spec *spec = codec->spec;
++ int present;
++
++ alc_update_headset_jack_cb(codec, jack);
++ /* Headset Mic enable or disable, only for Dell Dino */
++ present = spec->gen.hp_jack_present ? 0x40 : 0;
++ snd_hda_codec_write(codec, 0x01, 0, AC_VERB_SET_GPIO_DATA,
++ present);
++}
++
++static void alc_fixup_headset_mode_dell_alc288(struct hda_codec *codec,
++ const struct hda_fixup *fix, int action)
++{
++ alc_fixup_headset_mode(codec, fix, action);
++ if (action == HDA_FIXUP_ACT_PROBE) {
++ struct alc_spec *spec = codec->spec;
++ spec->gen.hp_automute_hook = alc288_update_headset_jack_cb;
++ }
++}
++
+ static void alc_fixup_auto_mute_via_amp(struct hda_codec *codec,
+ const struct hda_fixup *fix, int action)
+ {
+@@ -4431,6 +4629,20 @@ enum {
+ ALC255_FIXUP_DELL_WMI_MIC_MUTE_LED,
+ ALC282_FIXUP_ASPIRE_V5_PINS,
+ ALC280_FIXUP_HP_GPIO4,
++ ALC286_FIXUP_HP_GPIO_LED,
++ ALC280_FIXUP_HP_GPIO2_MIC_HOTKEY,
++ ALC280_FIXUP_HP_DOCK_PINS,
++ ALC288_FIXUP_DELL_HEADSET_MODE,
++ ALC288_FIXUP_DELL1_MIC_NO_PRESENCE,
++ ALC288_FIXUP_DELL_XPS_13_GPIO6,
++ ALC298_FIXUP_DELL1_MIC_NO_PRESENCE,
++ ALC275_FIXUP_DELL_XPS,
++ ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE,
++ ALC293_FIXUP_LENOVO_SPK_NOISE,
++ ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY,
++ ALC255_FIXUP_DELL_SPK_NOISE,
++ ALC225_FIXUP_DELL1_MIC_NO_PRESENCE,
++ ALC280_FIXUP_HP_HEADSET_MIC,
+ };
+
+ static const struct hda_fixup alc269_fixups[] = {
+@@ -4926,6 +5138,117 @@ static const struct hda_fixup alc269_fixups[] = {
+ .type = HDA_FIXUP_FUNC,
+ .v.func = alc280_fixup_hp_gpio4,
+ },
++ [ALC286_FIXUP_HP_GPIO_LED] = {
++ .type = HDA_FIXUP_FUNC,
++ .v.func = alc286_fixup_hp_gpio_led,
++ },
++ [ALC280_FIXUP_HP_GPIO2_MIC_HOTKEY] = {
++ .type = HDA_FIXUP_FUNC,
++ .v.func = alc280_fixup_hp_gpio2_mic_hotkey,
++ },
++ [ALC280_FIXUP_HP_DOCK_PINS] = {
++ .type = HDA_FIXUP_PINS,
++ .v.pins = (const struct hda_pintbl[]) {
++ { 0x1b, 0x21011020 }, /* line-out */
++ { 0x1a, 0x01a1903c }, /* headset mic */
++ { 0x18, 0x2181103f }, /* line-in */
++ { },
++ },
++ .chained = true,
++ .chain_id = ALC280_FIXUP_HP_GPIO4
++ },
++ [ALC288_FIXUP_DELL_HEADSET_MODE] = {
++ .type = HDA_FIXUP_FUNC,
++ .v.func = alc_fixup_headset_mode_dell_alc288,
++ .chained = true,
++ .chain_id = ALC255_FIXUP_DELL_WMI_MIC_MUTE_LED
++ },
++ [ALC288_FIXUP_DELL1_MIC_NO_PRESENCE] = {
++ .type = HDA_FIXUP_PINS,
++ .v.pins = (const struct hda_pintbl[]) {
++ { 0x18, 0x01a1913c }, /* use as headset mic, without its own jack detect */
++ { 0x1a, 0x01a1913d }, /* use as headphone mic, without its own jack detect */
++ { }
++ },
++ .chained = true,
++ .chain_id = ALC288_FIXUP_DELL_HEADSET_MODE
++ },
++ [ALC288_FIXUP_DELL_XPS_13_GPIO6] = {
++ .type = HDA_FIXUP_VERBS,
++ .v.verbs = (const struct hda_verb[]) {
++ {0x01, AC_VERB_SET_GPIO_MASK, 0x40},
++ {0x01, AC_VERB_SET_GPIO_DIRECTION, 0x40},
++ {0x01, AC_VERB_SET_GPIO_DATA, 0x00},
++ { }
++ },
++ .chained = true,
++ .chain_id = ALC288_FIXUP_DELL1_MIC_NO_PRESENCE
++ },
++ [ALC298_FIXUP_DELL1_MIC_NO_PRESENCE] = {
++ .type = HDA_FIXUP_PINS,
++ .v.pins = (const struct hda_pintbl[]) {
++ { 0x18, 0x01a1913c }, /* use as headset mic, without its own jack detect */
++ { 0x1a, 0x01a1913d }, /* use as headphone mic, without its own jack detect */
++ { }
++ },
++ .chained = true,
++ .chain_id = ALC269_FIXUP_HEADSET_MODE
++ },
++ [ALC275_FIXUP_DELL_XPS] = {
++ .type = HDA_FIXUP_VERBS,
++ .v.verbs = (const struct hda_verb[]) {
++ /* Enables internal speaker */
++ {0x20, AC_VERB_SET_COEF_INDEX, 0x1f},
++ {0x20, AC_VERB_SET_PROC_COEF, 0x00c0},
++ {0x20, AC_VERB_SET_COEF_INDEX, 0x30},
++ {0x20, AC_VERB_SET_PROC_COEF, 0x00b1},
++ {}
++ }
++ },
++ [ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE] = {
++ .type = HDA_FIXUP_VERBS,
++ .v.verbs = (const struct hda_verb[]) {
++ /* Disable pass-through path for FRONT 14h */
++ {0x20, AC_VERB_SET_COEF_INDEX, 0x36},
++ {0x20, AC_VERB_SET_PROC_COEF, 0x1737},
++ {}
++ },
++ .chained = true,
++ .chain_id = ALC255_FIXUP_DELL1_MIC_NO_PRESENCE
++ },
++ [ALC293_FIXUP_LENOVO_SPK_NOISE] = {
++ .type = HDA_FIXUP_FUNC,
++ .v.func = alc_fixup_disable_aamix,
++ .chained = true,
++ .chain_id = ALC269_FIXUP_THINKPAD_ACPI
++ },
++ [ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY] = {
++ .type = HDA_FIXUP_FUNC,
++ .v.func = alc233_fixup_lenovo_line2_mic_hotkey,
++ },
++ [ALC255_FIXUP_DELL_SPK_NOISE] = {
++ .type = HDA_FIXUP_FUNC,
++ .v.func = alc_fixup_disable_aamix,
++ .chained = true,
++ .chain_id = ALC255_FIXUP_DELL1_MIC_NO_PRESENCE
++ },
++ [ALC225_FIXUP_DELL1_MIC_NO_PRESENCE] = {
++ .type = HDA_FIXUP_VERBS,
++ .v.verbs = (const struct hda_verb[]) {
++ /* Disable pass-through path for FRONT 14h */
++ { 0x20, AC_VERB_SET_COEF_INDEX, 0x36 },
++ { 0x20, AC_VERB_SET_PROC_COEF, 0x57d7 },
++ {}
++ },
++ .chained = true,
++ .chain_id = ALC269_FIXUP_DELL1_MIC_NO_PRESENCE
++ },
++ [ALC280_FIXUP_HP_HEADSET_MIC] = {
++ .type = HDA_FIXUP_FUNC,
++ .v.func = alc_fixup_disable_aamix,
++ .chained = true,
++ .chain_id = ALC269_FIXUP_HEADSET_MIC,
++ },
+ };
+
+ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+@@ -4937,9 +5260,11 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1025, 0x080d, "Acer Aspire V5-122P", ALC269_FIXUP_ASPIRE_HEADSET_MIC),
+ SND_PCI_QUIRK(0x1025, 0x0740, "Acer AO725", ALC271_FIXUP_HP_GATE_MIC_JACK),
+ SND_PCI_QUIRK(0x1025, 0x0742, "Acer AO756", ALC271_FIXUP_HP_GATE_MIC_JACK),
++ SND_PCI_QUIRK(0x1025, 0x0762, "Acer Aspire E1-472", ALC271_FIXUP_HP_GATE_MIC_JACK_E1_572),
+ SND_PCI_QUIRK(0x1025, 0x0775, "Acer Aspire E1-572", ALC271_FIXUP_HP_GATE_MIC_JACK_E1_572),
+ SND_PCI_QUIRK(0x1025, 0x079b, "Acer Aspire V5-573G", ALC282_FIXUP_ASPIRE_V5_PINS),
+ SND_PCI_QUIRK(0x1028, 0x0470, "Dell M101z", ALC269_FIXUP_DELL_M101Z),
++ SND_PCI_QUIRK(0x1028, 0x054b, "Dell XPS one 2710", ALC275_FIXUP_DELL_XPS),
+ SND_PCI_QUIRK(0x1028, 0x05da, "Dell Vostro 5460", ALC290_FIXUP_SUBWOOFER),
+ SND_PCI_QUIRK(0x1028, 0x05f4, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1028, 0x05f5, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE),
+@@ -4952,11 +5277,14 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1028, 0x06c7, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1028, 0x06d9, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1028, 0x06da, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
++ SND_PCI_QUIRK(0x1028, 0x0704, "Dell XPS 13", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE),
++ SND_PCI_QUIRK(0x1028, 0x0725, "Dell Inspiron 3162", ALC255_FIXUP_DELL_SPK_NOISE),
+ SND_PCI_QUIRK(0x1028, 0x164a, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1028, 0x164b, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x103c, 0x1586, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC2),
+ SND_PCI_QUIRK(0x103c, 0x18e6, "HP", ALC269_FIXUP_HP_GPIO_LED),
+ SND_PCI_QUIRK(0x103c, 0x218b, "HP", ALC269_FIXUP_LIMIT_INT_MIC_BOOST_MUTE_LED),
++ SND_PCI_QUIRK(0x103c, 0x225f, "HP", ALC280_FIXUP_HP_GPIO2_MIC_HOTKEY),
+ /* ALC282 */
+ SND_PCI_QUIRK(0x103c, 0x21f9, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+ SND_PCI_QUIRK(0x103c, 0x2210, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+@@ -4970,6 +5298,8 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x103c, 0x226a, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+ SND_PCI_QUIRK(0x103c, 0x226b, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+ SND_PCI_QUIRK(0x103c, 0x226e, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
++ SND_PCI_QUIRK(0x103c, 0x2271, "HP", ALC286_FIXUP_HP_GPIO_LED),
++ SND_PCI_QUIRK(0x103c, 0x2272, "HP", ALC280_FIXUP_HP_DOCK_PINS),
+ SND_PCI_QUIRK(0x103c, 0x229e, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+ SND_PCI_QUIRK(0x103c, 0x22b2, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+ SND_PCI_QUIRK(0x103c, 0x22b7, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+@@ -5007,6 +5337,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x103c, 0x2335, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+ SND_PCI_QUIRK(0x103c, 0x2336, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+ SND_PCI_QUIRK(0x103c, 0x2337, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
++ SND_PCI_QUIRK(0x103c, 0x221c, "HP EliteBook 755 G2", ALC280_FIXUP_HP_HEADSET_MIC),
+ SND_PCI_QUIRK(0x1043, 0x103f, "ASUS TX300", ALC282_FIXUP_ASUS_TX300),
+ SND_PCI_QUIRK(0x1043, 0x106d, "Asus K53BE", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
+ SND_PCI_QUIRK(0x1043, 0x115d, "Asus 1015E", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
+@@ -5053,6 +5384,8 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x17aa, 0x2215, "Thinkpad", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
+ SND_PCI_QUIRK(0x17aa, 0x2223, "ThinkPad T550", ALC292_FIXUP_TPT440_DOCK),
+ SND_PCI_QUIRK(0x17aa, 0x2226, "ThinkPad X250", ALC292_FIXUP_TPT440_DOCK),
++ SND_PCI_QUIRK(0x17aa, 0x2233, "Thinkpad", ALC293_FIXUP_LENOVO_SPK_NOISE),
++ SND_PCI_QUIRK(0x17aa, 0x30bb, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY),
+ SND_PCI_QUIRK(0x17aa, 0x3977, "IdeaPad S210", ALC283_FIXUP_INT_MIC),
+ SND_PCI_QUIRK(0x17aa, 0x3978, "IdeaPad Y410P", ALC269_FIXUP_NO_SHUTUP),
+ SND_PCI_QUIRK(0x17aa, 0x5013, "Thinkpad", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
+@@ -5062,6 +5395,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x17aa, 0x5034, "Thinkpad T450", ALC292_FIXUP_TPT440_DOCK),
+ SND_PCI_QUIRK(0x17aa, 0x5036, "Thinkpad T450s", ALC292_FIXUP_TPT440_DOCK),
+ SND_PCI_QUIRK(0x17aa, 0x503c, "Thinkpad L450", ALC292_FIXUP_TPT440_DOCK),
++ SND_PCI_QUIRK(0x17aa, 0x504b, "Thinkpad", ALC293_FIXUP_LENOVO_SPK_NOISE),
+ SND_PCI_QUIRK(0x17aa, 0x5109, "Thinkpad", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
+ SND_PCI_QUIRK(0x17aa, 0x3bf8, "Quanta FL1", ALC269_FIXUP_PCM_44K),
+ SND_PCI_QUIRK(0x17aa, 0x9e54, "LENOVO NB", ALC269_FIXUP_LENOVO_EAPD),
+@@ -5142,6 +5476,9 @@ static const struct hda_model_fixup alc269_fixup_models[] = {
+ {.id = ALC292_FIXUP_TPT440_DOCK, .name = "tpt440-dock"},
+ {}
+ };
++#define ALC225_STANDARD_PINS \
++ {0x12, 0xb7a60130}, \
++ {0x21, 0x04211020}
+
+ #define ALC255_STANDARD_PINS \
+ {0x18, 0x411111f0}, \
+@@ -5167,6 +5504,13 @@ static const struct hda_model_fixup alc269_fixup_models[] = {
+ {0x1b, 0x411111f0}, \
+ {0x1e, 0x411111f0}
+
++#define ALC288_STANDARD_PINS \
++ {0x17, 0x411111f0}, \
++ {0x18, 0x411111f0}, \
++ {0x19, 0x411111f0}, \
++ {0x1a, 0x411111f0}, \
++ {0x1e, 0x411111f0}
++
+ #define ALC290_STANDARD_PINS \
+ {0x12, 0x99a30130}, \
+ {0x13, 0x40000000}, \
+@@ -5184,7 +5528,26 @@ static const struct hda_model_fixup alc269_fixup_models[] = {
+ {0x1d, 0x40700001}, \
+ {0x1e, 0x411111f0}
+
++#define ALC298_STANDARD_PINS \
++ {0x18, 0x411111f0}, \
++ {0x19, 0x411111f0}, \
++ {0x1a, 0x411111f0}, \
++ {0x1e, 0x411111f0}, \
++ {0x1f, 0x411111f0}
++
+ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = {
++ SND_HDA_PIN_QUIRK(0x10ec0225, 0x1028, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE,
++ ALC225_STANDARD_PINS,
++ {0x14, 0x901701a0}),
++ SND_HDA_PIN_QUIRK(0x10ec0225, 0x1028, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE,
++ ALC225_STANDARD_PINS,
++ {0x14, 0x901701b0}),
++ SND_HDA_PIN_QUIRK(0x10ec0225, 0x1028, "Dell", ALC225_FIXUP_DELL1_MIC_NO_PRESENCE,
++ ALC225_STANDARD_PINS,
++ {0x14, 0x901701a0}),
++ SND_HDA_PIN_QUIRK(0x10ec0225, 0x1028, "Dell", ALC225_FIXUP_DELL1_MIC_NO_PRESENCE,
++ ALC225_STANDARD_PINS,
++ {0x14, 0x901701b0}),
+ SND_HDA_PIN_QUIRK(0x10ec0255, 0x1028, "Dell", ALC255_FIXUP_DELL2_MIC_NO_PRESENCE,
+ ALC255_STANDARD_PINS,
+ {0x12, 0x40300000},
+@@ -5365,6 +5728,13 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = {
+ {0x19, 0x03a11020},
+ {0x1d, 0x40e00001},
+ {0x21, 0x0321101f}),
++ SND_HDA_PIN_QUIRK(0x10ec0288, 0x1028, "Dell", ALC288_FIXUP_DELL_XPS_13_GPIO6,
++ ALC288_STANDARD_PINS,
++ {0x12, 0x90a60120},
++ {0x13, 0x40000000},
++ {0x14, 0x90170110},
++ {0x1d, 0x4076832d},
++ {0x21, 0x0321101f}),
+ SND_HDA_PIN_QUIRK(0x10ec0290, 0x103c, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1,
+ ALC290_STANDARD_PINS,
+ {0x14, 0x411111f0},
+@@ -5449,6 +5819,14 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = {
+ {0x16, 0x411111f0},
+ {0x18, 0x411111f0},
+ {0x19, 0x411111f0}),
++ SND_HDA_PIN_QUIRK(0x10ec0298, 0x1028, "Dell", ALC298_FIXUP_DELL1_MIC_NO_PRESENCE,
++ ALC298_STANDARD_PINS,
++ {0x12, 0x90a60130},
++ {0x13, 0x40000000},
++ {0x14, 0x411111f0},
++ {0x17, 0x90170140},
++ {0x1d, 0x4068a36d},
++ {0x21, 0x03211020}),
+ {}
+ };
+
+@@ -5905,22 +6283,6 @@ static void alc_fixup_bass_chmap(struct hda_codec *codec,
+ }
+ }
+
+-/* turn on/off mute LED per vmaster hook */
+-static void alc662_led_gpio1_mute_hook(void *private_data, int enabled)
+-{
+- struct hda_codec *codec = private_data;
+- struct alc_spec *spec = codec->spec;
+- unsigned int oldval = spec->gpio_led;
+-
+- if (enabled)
+- spec->gpio_led |= 0x01;
+- else
+- spec->gpio_led &= ~0x01;
+- if (spec->gpio_led != oldval)
+- snd_hda_codec_write(codec, 0x01, 0, AC_VERB_SET_GPIO_DATA,
+- spec->gpio_led);
+-}
+-
+ /* avoid D3 for keeping GPIO up */
+ static unsigned int gpio_led_power_filter(struct hda_codec *codec,
+ hda_nid_t nid,
+@@ -5943,8 +6305,10 @@ static void alc662_fixup_led_gpio1(struct hda_codec *codec,
+ };
+
+ if (action == HDA_FIXUP_ACT_PRE_PROBE) {
+- spec->gen.vmaster_mute.hook = alc662_led_gpio1_mute_hook;
++ spec->gen.vmaster_mute.hook = alc_fixup_gpio_mute_hook;
+ spec->gpio_led = 0;
++ spec->mute_led_polarity = 1;
++ spec->gpio_mute_led_mask = 0x01;
+ snd_hda_add_verbs(codec, gpio_init);
+ codec->power_filter = gpio_led_power_filter;
+ }
+diff --git a/sound/pci/rme9652/hdsp.c b/sound/pci/rme9652/hdsp.c
+index 7646ba1664eb..799fe9a81552 100644
+--- a/sound/pci/rme9652/hdsp.c
++++ b/sound/pci/rme9652/hdsp.c
+@@ -2927,7 +2927,7 @@ static int snd_hdsp_get_dds_offset(struct snd_kcontrol *kcontrol, struct snd_ctl
+ {
+ struct hdsp *hdsp = snd_kcontrol_chip(kcontrol);
+
+- ucontrol->value.enumerated.item[0] = hdsp_dds_offset(hdsp);
++ ucontrol->value.integer.value[0] = hdsp_dds_offset(hdsp);
+ return 0;
+ }
+
+@@ -2939,7 +2939,7 @@ static int snd_hdsp_put_dds_offset(struct snd_kcontrol *kcontrol, struct snd_ctl
+
+ if (!snd_hdsp_use_is_exclusive(hdsp))
+ return -EBUSY;
+- val = ucontrol->value.enumerated.item[0];
++ val = ucontrol->value.integer.value[0];
+ spin_lock_irq(&hdsp->lock);
+ if (val != hdsp_dds_offset(hdsp))
+ change = (hdsp_set_dds_offset(hdsp, val) == 0) ? 1 : 0;
+diff --git a/sound/pci/rme9652/hdspm.c b/sound/pci/rme9652/hdspm.c
+index fcf91ee0328d..120fb18dd92b 100644
+--- a/sound/pci/rme9652/hdspm.c
++++ b/sound/pci/rme9652/hdspm.c
+@@ -1602,6 +1602,9 @@ static void hdspm_set_dds_value(struct hdspm *hdspm, int rate)
+ {
+ u64 n;
+
++ if (snd_BUG_ON(rate <= 0))
++ return;
++
+ if (rate >= 112000)
+ rate /= 4;
+ else if (rate >= 56000)
+@@ -2220,6 +2223,8 @@ static int hdspm_get_system_sample_rate(struct hdspm *hdspm)
+ } else {
+ /* slave mode, return external sample rate */
+ rate = hdspm_external_sample_rate(hdspm);
++ if (!rate)
++ rate = hdspm->system_sample_rate;
+ }
+ }
+
+@@ -2265,8 +2270,11 @@ static int snd_hdspm_put_system_sample_rate(struct snd_kcontrol *kcontrol,
+ ucontrol)
+ {
+ struct hdspm *hdspm = snd_kcontrol_chip(kcontrol);
++ int rate = ucontrol->value.integer.value[0];
+
+- hdspm_set_dds_value(hdspm, ucontrol->value.enumerated.item[0]);
++ if (rate < 27000 || rate > 207000)
++ return -EINVAL;
++ hdspm_set_dds_value(hdspm, ucontrol->value.integer.value[0]);
+ return 0;
+ }
+
+@@ -4465,7 +4473,7 @@ static int snd_hdspm_get_tco_word_term(struct snd_kcontrol *kcontrol,
+ {
+ struct hdspm *hdspm = snd_kcontrol_chip(kcontrol);
+
+- ucontrol->value.enumerated.item[0] = hdspm->tco->term;
++ ucontrol->value.integer.value[0] = hdspm->tco->term;
+
+ return 0;
+ }
+@@ -4476,8 +4484,8 @@ static int snd_hdspm_put_tco_word_term(struct snd_kcontrol *kcontrol,
+ {
+ struct hdspm *hdspm = snd_kcontrol_chip(kcontrol);
+
+- if (hdspm->tco->term != ucontrol->value.enumerated.item[0]) {
+- hdspm->tco->term = ucontrol->value.enumerated.item[0];
++ if (hdspm->tco->term != ucontrol->value.integer.value[0]) {
++ hdspm->tco->term = ucontrol->value.integer.value[0];
+
+ hdspm_tco_write(hdspm);
+
+diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
+index 2ef679caa8b9..42c1d0171a5a 100644
+--- a/sound/usb/quirks.c
++++ b/sound/usb/quirks.c
+@@ -1111,6 +1111,7 @@ bool snd_usb_get_sample_rate_quirk(struct snd_usb_audio *chip)
+ case USB_ID(0x045E, 0x076F): /* MS Lifecam HD-6000 */
+ case USB_ID(0x045E, 0x0772): /* MS Lifecam Studio */
+ case USB_ID(0x045E, 0x0779): /* MS Lifecam HD-3000 */
++ case USB_ID(0x047F, 0xAA05): /* Plantronics DA45 */
+ case USB_ID(0x04D8, 0xFEEA): /* Benchmark DAC1 Pre */
+ return true;
+ }
+diff --git a/tools/Makefile b/tools/Makefile
+index 9a617adc6675..f0fd70a5bd68 100644
+--- a/tools/Makefile
++++ b/tools/Makefile
+@@ -25,6 +25,10 @@ help:
+ @echo ' from the kernel command line to build and install one of'
+ @echo ' the tools above'
+ @echo ''
++ @echo ' $$ make tools/all'
++ @echo ''
++ @echo ' builds all tools.'
++ @echo ''
+ @echo ' $$ make tools/install'
+ @echo ''
+ @echo ' installs all tools.'
+@@ -62,6 +66,11 @@ turbostat x86_energy_perf_policy: FORCE
+ tmon: FORCE
+ $(call descend,thermal/$@)
+
++all: acpi cgroup cpupower hv firewire lguest \
++ perf selftests turbostat usb \
++ virtio vm net x86_energy_perf_policy \
++ tmon
++
+ acpi_install:
+ $(call descend,power/$(@:_install=),install)
+
+diff --git a/virt/kvm/arm/vgic.c b/virt/kvm/arm/vgic.c
+index d7cf2ffc56e9..68dd2df0d51b 100644
+--- a/virt/kvm/arm/vgic.c
++++ b/virt/kvm/arm/vgic.c
+@@ -1758,8 +1758,8 @@ void kvm_vgic_vcpu_destroy(struct kvm_vcpu *vcpu)
+ static int vgic_vcpu_init_maps(struct kvm_vcpu *vcpu, int nr_irqs)
+ {
+ struct vgic_cpu *vgic_cpu = &vcpu->arch.vgic_cpu;
+-
+- int sz = (nr_irqs - VGIC_NR_PRIVATE_IRQS) / 8;
++ int nr_longs = BITS_TO_LONGS(nr_irqs - VGIC_NR_PRIVATE_IRQS);
++ int sz = nr_longs * sizeof(unsigned long);
+ vgic_cpu->pending_shared = kzalloc(sz, GFP_KERNEL);
+ vgic_cpu->vgic_irq_lr_map = kmalloc(nr_irqs, GFP_KERNEL);
+
+diff --git a/virt/kvm/async_pf.c b/virt/kvm/async_pf.c
+index 5ff7f7f2689a..e06785470408 100644
+--- a/virt/kvm/async_pf.c
++++ b/virt/kvm/async_pf.c
+@@ -169,7 +169,7 @@ int kvm_setup_async_pf(struct kvm_vcpu *vcpu, gva_t gva, unsigned long hva,
+ * do alloc nowait since if we are going to sleep anyway we
+ * may as well sleep faulting in page
+ */
+- work = kmem_cache_zalloc(async_pf_cache, GFP_NOWAIT);
++ work = kmem_cache_zalloc(async_pf_cache, GFP_NOWAIT | __GFP_NOWARN);
+ if (!work)
+ return 0;
+
^ permalink raw reply related [flat|nested] 67+ messages in thread
* [gentoo-commits] proj/linux-patches:3.18 commit in: /
@ 2016-04-06 11:21 Mike Pagano
0 siblings, 0 replies; 67+ messages in thread
From: Mike Pagano @ 2016-04-06 11:21 UTC (permalink / raw
To: gentoo-commits
commit: c894a4336e2b325448b757f54c532361f781a813
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed Apr 6 11:21:37 2016 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed Apr 6 11:21:37 2016 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=c894a433
Linux patch 3.18.30
0000_README | 4 +
1029_linux-3.18.30.patch | 689 +++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 693 insertions(+)
diff --git a/0000_README b/0000_README
index 51c140d..eee1fbe 100644
--- a/0000_README
+++ b/0000_README
@@ -159,6 +159,10 @@ Patch: 1028_linux-3.18.29.patch
From: http://www.kernel.org
Desc: Linux 3.18.29
+Patch: 1029_linux-3.18.30.patch
+From: http://www.kernel.org
+Desc: Linux 3.18.30
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1029_linux-3.18.30.patch b/1029_linux-3.18.30.patch
new file mode 100644
index 0000000..26bd181
--- /dev/null
+++ b/1029_linux-3.18.30.patch
@@ -0,0 +1,689 @@
+diff --git a/Makefile b/Makefile
+index 13063ba47412..cdc9cf7cb4dd 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 18
+-SUBLEVEL = 29
++SUBLEVEL = 30
+ EXTRAVERSION =
+ NAME = Diseased Newt
+
+diff --git a/arch/arm/boot/dts/dra7.dtsi b/arch/arm/boot/dts/dra7.dtsi
+index 666e796847d8..8ba02cb2955f 100644
+--- a/arch/arm/boot/dts/dra7.dtsi
++++ b/arch/arm/boot/dts/dra7.dtsi
+@@ -34,6 +34,8 @@
+ serial3 = &uart4;
+ serial4 = &uart5;
+ serial5 = &uart6;
++ ethernet0 = &cpsw_emac0;
++ ethernet1 = &cpsw_emac1;
+ };
+
+ timer {
+@@ -1265,6 +1267,75 @@
+ ti,irqs-skip = <10 133 139 140>;
+ ti,irqs-safe-map = <0>;
+ };
++
++ mac: ethernet@4a100000 {
++ compatible = "ti,cpsw";
++ ti,hwmods = "gmac";
++ clocks = <&dpll_gmac_ck>, <&gmac_gmii_ref_clk_div>;
++ clock-names = "fck", "cpts";
++ cpdma_channels = <8>;
++ ale_entries = <1024>;
++ bd_ram_size = <0x2000>;
++ no_bd_ram = <0>;
++ rx_descs = <64>;
++ mac_control = <0x20>;
++ slaves = <2>;
++ active_slave = <0>;
++ cpts_clock_mult = <0x80000000>;
++ cpts_clock_shift = <29>;
++ reg = <0x48484000 0x1000
++ 0x48485200 0x2E00>;
++ #address-cells = <1>;
++ #size-cells = <1>;
++
++ /*
++ * Do not allow gating of cpsw clock as workaround
++ * for errata i877. Keeping internal clock disabled
++ * causes the device switching characteristics
++ * to degrade over time and eventually fail to meet
++ * the data manual delay time/skew specs.
++ */
++ ti,no-idle;
++
++ /*
++ * rx_thresh_pend
++ * rx_pend
++ * tx_pend
++ * misc_pend
++ */
++ interrupts = <GIC_SPI 334 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 335 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 336 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 337 IRQ_TYPE_LEVEL_HIGH>;
++ ranges;
++ status = "disabled";
++
++ davinci_mdio: mdio@48485000 {
++ compatible = "ti,davinci_mdio";
++ #address-cells = <1>;
++ #size-cells = <0>;
++ ti,hwmods = "davinci_mdio";
++ bus_freq = <1000000>;
++ reg = <0x48485000 0x100>;
++ };
++
++ cpsw_emac0: slave@48480200 {
++ /* Filled in by U-Boot */
++ mac-address = [ 00 00 00 00 00 00 ];
++ };
++
++ cpsw_emac1: slave@48480300 {
++ /* Filled in by U-Boot */
++ mac-address = [ 00 00 00 00 00 00 ];
++ };
++
++ phy_sel: cpsw-phy-sel@4a002554 {
++ compatible = "ti,dra7xx-cpsw-phy-sel";
++ reg= <0x4a002554 0x4>;
++ reg-names = "gmii-sel";
++ };
++ };
++
+ };
+ };
+
+diff --git a/arch/arm64/kernel/Makefile b/arch/arm64/kernel/Makefile
+index da2272811a31..33cba01d4f33 100644
+--- a/arch/arm64/kernel/Makefile
++++ b/arch/arm64/kernel/Makefile
+@@ -15,7 +15,7 @@ arm64-obj-y := cputable.o debug-monitors.o entry.o irq.o fpsimd.o \
+ entry-fpsimd.o process.o ptrace.o setup.o signal.o \
+ sys.o stacktrace.o time.o traps.o io.o vdso.o \
+ hyp-stub.o psci.o cpu_ops.o insn.o return_address.o \
+- cpuinfo.o cpu_errata.o alternative.o
++ cpuinfo.o cpu_errata.o alternative.o psci-call.o
+
+ arm64-obj-$(CONFIG_COMPAT) += sys32.o kuser32.o signal32.o \
+ sys_compat.o
+diff --git a/arch/arm64/kernel/psci-call.S b/arch/arm64/kernel/psci-call.S
+new file mode 100644
+index 000000000000..cf83e61cd3b5
+--- /dev/null
++++ b/arch/arm64/kernel/psci-call.S
+@@ -0,0 +1,28 @@
++/*
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 as
++ * published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
++ * GNU General Public License for more details.
++ *
++ * Copyright (C) 2015 ARM Limited
++ *
++ * Author: Will Deacon <will.deacon@arm.com>
++ */
++
++#include <linux/linkage.h>
++
++/* int __invoke_psci_fn_hvc(u64 function_id, u64 arg0, u64 arg1, u64 arg2) */
++ENTRY(__invoke_psci_fn_hvc)
++ hvc #0
++ ret
++ENDPROC(__invoke_psci_fn_hvc)
++
++/* int __invoke_psci_fn_smc(u64 function_id, u64 arg0, u64 arg1, u64 arg2) */
++ENTRY(__invoke_psci_fn_smc)
++ smc #0
++ ret
++ENDPROC(__invoke_psci_fn_smc)
+diff --git a/arch/arm64/kernel/psci.c b/arch/arm64/kernel/psci.c
+index 663da771580a..81c081eaca42 100644
+--- a/arch/arm64/kernel/psci.c
++++ b/arch/arm64/kernel/psci.c
+@@ -57,6 +57,9 @@ static struct psci_operations psci_ops;
+ static int (*invoke_psci_fn)(u64, u64, u64, u64);
+ typedef int (*psci_initcall_t)(const struct device_node *);
+
++asmlinkage int __invoke_psci_fn_hvc(u64, u64, u64, u64);
++asmlinkage int __invoke_psci_fn_smc(u64, u64, u64, u64);
++
+ enum psci_function {
+ PSCI_FN_CPU_SUSPEND,
+ PSCI_FN_CPU_ON,
+@@ -109,40 +112,6 @@ static void psci_power_state_unpack(u32 power_state,
+ PSCI_0_2_POWER_STATE_AFFL_SHIFT;
+ }
+
+-/*
+- * The following two functions are invoked via the invoke_psci_fn pointer
+- * and will not be inlined, allowing us to piggyback on the AAPCS.
+- */
+-static noinline int __invoke_psci_fn_hvc(u64 function_id, u64 arg0, u64 arg1,
+- u64 arg2)
+-{
+- asm volatile(
+- __asmeq("%0", "x0")
+- __asmeq("%1", "x1")
+- __asmeq("%2", "x2")
+- __asmeq("%3", "x3")
+- "hvc #0\n"
+- : "+r" (function_id)
+- : "r" (arg0), "r" (arg1), "r" (arg2));
+-
+- return function_id;
+-}
+-
+-static noinline int __invoke_psci_fn_smc(u64 function_id, u64 arg0, u64 arg1,
+- u64 arg2)
+-{
+- asm volatile(
+- __asmeq("%0", "x0")
+- __asmeq("%1", "x1")
+- __asmeq("%2", "x2")
+- __asmeq("%3", "x3")
+- "smc #0\n"
+- : "+r" (function_id)
+- : "r" (arg0), "r" (arg1), "r" (arg2));
+-
+- return function_id;
+-}
+-
+ static int psci_get_version(void)
+ {
+ int err;
+diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
+index 155bb7f5ad28..9536ef912f59 100644
+--- a/arch/mips/Kconfig
++++ b/arch/mips/Kconfig
+@@ -2048,7 +2048,7 @@ config MIPS_CMP
+
+ config MIPS_CPS
+ bool "MIPS Coherent Processing System support"
+- depends on SYS_SUPPORTS_MIPS_CPS && !64BIT
++ depends on SYS_SUPPORTS_MIPS_CPS
+ select MIPS_CM
+ select MIPS_CPC
+ select MIPS_CPS_PM if HOTPLUG_CPU
+diff --git a/arch/powerpc/kvm/book3s_hv_rmhandlers.S b/arch/powerpc/kvm/book3s_hv_rmhandlers.S
+index 3e9d73f58718..4329ea316683 100644
+--- a/arch/powerpc/kvm/book3s_hv_rmhandlers.S
++++ b/arch/powerpc/kvm/book3s_hv_rmhandlers.S
+@@ -1284,6 +1284,20 @@ END_FTR_SECTION_IFCLR(CPU_FTR_ARCH_207S)
+ std r6, VCPU_ACOP(r9)
+ stw r7, VCPU_GUEST_PID(r9)
+ std r8, VCPU_WORT(r9)
++ /*
++ * Restore various registers to 0, where non-zero values
++ * set by the guest could disrupt the host.
++ */
++ li r0, 0
++ mtspr SPRN_IAMR, r0
++ mtspr SPRN_CIABR, r0
++ mtspr SPRN_DAWRX, r0
++ mtspr SPRN_TCSCR, r0
++ mtspr SPRN_WORT, r0
++ /* Set MMCRS to 1<<31 to freeze and disable the SPMC counters */
++ li r0, 1
++ sldi r0, r0, 31
++ mtspr SPRN_MMCRS, r0
+ 8:
+
+ /* Save and reset AMR and UAMOR before turning on the MMU */
+diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
+index 84de207a8848..49cce7508a54 100644
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -1600,6 +1600,13 @@ static void add_atomic_switch_msr(struct vcpu_vmx *vmx, unsigned msr,
+ return;
+ }
+ break;
++ case MSR_IA32_PEBS_ENABLE:
++ /* PEBS needs a quiescent period after being disabled (to write
++ * a record). Disabling PEBS through VMX MSR swapping doesn't
++ * provide that period, so a CPU could write host's record into
++ * guest's memory.
++ */
++ wrmsrl(MSR_IA32_PEBS_ENABLE, 0);
+ }
+
+ for (i = 0; i < m->nr; ++i)
+diff --git a/drivers/gpu/drm/radeon/radeon_pm.c b/drivers/gpu/drm/radeon/radeon_pm.c
+index d5ea5c106dd1..ab782e3f5d95 100644
+--- a/drivers/gpu/drm/radeon/radeon_pm.c
++++ b/drivers/gpu/drm/radeon/radeon_pm.c
+@@ -936,6 +936,8 @@ force:
+
+ /* update display watermarks based on new power state */
+ radeon_bandwidth_update(rdev);
++ /* update displays */
++ radeon_dpm_display_configuration_changed(rdev);
+
+ /* wait for the rings to drain */
+ for (i = 0; i < RADEON_NUM_RINGS; i++) {
+@@ -952,9 +954,6 @@ force:
+
+ radeon_dpm_post_set_power_state(rdev);
+
+- /* update displays */
+- radeon_dpm_display_configuration_changed(rdev);
+-
+ rdev->pm.dpm.current_active_crtcs = rdev->pm.dpm.new_active_crtcs;
+ rdev->pm.dpm.current_active_crtc_count = rdev->pm.dpm.new_active_crtc_count;
+ rdev->pm.dpm.single_display = single_display;
+diff --git a/drivers/net/can/usb/gs_usb.c b/drivers/net/can/usb/gs_usb.c
+index 009acc8641fc..09c23a5ba1d4 100644
+--- a/drivers/net/can/usb/gs_usb.c
++++ b/drivers/net/can/usb/gs_usb.c
+@@ -826,9 +826,8 @@ static struct gs_can *gs_make_candev(unsigned int channel, struct usb_interface
+ static void gs_destroy_candev(struct gs_can *dev)
+ {
+ unregister_candev(dev->netdev);
+- free_candev(dev->netdev);
+ usb_kill_anchored_urbs(&dev->tx_submitted);
+- kfree(dev);
++ free_candev(dev->netdev);
+ }
+
+ static int gs_usb_probe(struct usb_interface *intf, const struct usb_device_id *id)
+@@ -911,12 +910,15 @@ static int gs_usb_probe(struct usb_interface *intf, const struct usb_device_id *
+ for (i = 0; i < icount; i++) {
+ dev->canch[i] = gs_make_candev(i, intf);
+ if (IS_ERR_OR_NULL(dev->canch[i])) {
++ /* save error code to return later */
++ rc = PTR_ERR(dev->canch[i]);
++
+ /* on failure destroy previously created candevs */
+ icount = i;
+- for (i = 0; i < icount; i++) {
++ for (i = 0; i < icount; i++)
+ gs_destroy_candev(dev->canch[i]);
+- dev->canch[i] = NULL;
+- }
++
++ usb_kill_anchored_urbs(&dev->rx_submitted);
+ kfree(dev);
+ return rc;
+ }
+@@ -937,16 +939,12 @@ static void gs_usb_disconnect(struct usb_interface *intf)
+ return;
+ }
+
+- for (i = 0; i < GS_MAX_INTF; i++) {
+- struct gs_can *can = dev->canch[i];
+-
+- if (!can)
+- continue;
+-
+- gs_destroy_candev(can);
+- }
++ for (i = 0; i < GS_MAX_INTF; i++)
++ if (dev->canch[i])
++ gs_destroy_candev(dev->canch[i]);
+
+ usb_kill_anchored_urbs(&dev->rx_submitted);
++ kfree(dev);
+ }
+
+ static const struct usb_device_id gs_usb_table[] = {
+diff --git a/drivers/net/wireless/iwlwifi/mvm/tx.c b/drivers/net/wireless/iwlwifi/mvm/tx.c
+index 5928c9db49ce..98639fe2448b 100644
+--- a/drivers/net/wireless/iwlwifi/mvm/tx.c
++++ b/drivers/net/wireless/iwlwifi/mvm/tx.c
+@@ -359,6 +359,15 @@ int iwl_mvm_tx_skb_non_sta(struct iwl_mvm *mvm, struct sk_buff *skb)
+ return -1;
+ }
+
++ /*
++ * Increase the pending frames counter, so that later when a reply comes
++ * in and the counter is decreased - we don't start getting negative
++ * values.
++ * Note that we don't need to make sure it isn't agg'd, since we're
++ * TXing non-sta
++ */
++ atomic_inc(&mvm->pending_frames[sta_id]);
++
+ return 0;
+ }
+
+diff --git a/drivers/target/target_core_tmr.c b/drivers/target/target_core_tmr.c
+index a5c2b3cf7d1a..05c0a90e11a9 100644
+--- a/drivers/target/target_core_tmr.c
++++ b/drivers/target/target_core_tmr.c
+@@ -181,7 +181,6 @@ void core_tmr_abort_task(
+
+ if (!__target_check_io_state(se_cmd, se_sess, 0)) {
+ spin_unlock_irqrestore(&se_sess->sess_cmd_lock, flags);
+- target_put_sess_cmd(se_cmd);
+ goto out;
+ }
+
+diff --git a/fs/overlayfs/dir.c b/fs/overlayfs/dir.c
+index 8ffc4b980f1b..ddb1dc97859e 100644
+--- a/fs/overlayfs/dir.c
++++ b/fs/overlayfs/dir.c
+@@ -595,7 +595,8 @@ static int ovl_remove_upper(struct dentry *dentry, bool is_dir)
+ * sole user of this dentry. Too tricky... Just unhash for
+ * now.
+ */
+- d_drop(dentry);
++ if (!err)
++ d_drop(dentry);
+ mutex_unlock(&dir->i_mutex);
+
+ return err;
+diff --git a/fs/overlayfs/inode.c b/fs/overlayfs/inode.c
+index e3903b74a1f2..8774ebb5d80a 100644
+--- a/fs/overlayfs/inode.c
++++ b/fs/overlayfs/inode.c
+@@ -53,6 +53,8 @@ int ovl_setattr(struct dentry *dentry, struct iattr *attr)
+ if (upperdentry) {
+ mutex_lock(&upperdentry->d_inode->i_mutex);
+ err = notify_change(upperdentry, attr, NULL);
++ if (!err)
++ ovl_copyattr(upperdentry->d_inode, dentry->d_inode);
+ mutex_unlock(&upperdentry->d_inode->i_mutex);
+ } else {
+ err = ovl_copy_up_last(dentry, attr, false);
+diff --git a/include/linux/tracepoint.h b/include/linux/tracepoint.h
+index 72486551c4ca..e267dc488cdf 100644
+--- a/include/linux/tracepoint.h
++++ b/include/linux/tracepoint.h
+@@ -123,9 +123,6 @@ extern void syscall_unregfunc(void);
+ void *it_func; \
+ void *__data; \
+ \
+- if (!cpu_online(raw_smp_processor_id())) \
+- return; \
+- \
+ if (!(cond)) \
+ return; \
+ prercu; \
+@@ -324,15 +321,19 @@ extern void syscall_unregfunc(void);
+ * "void *__data, proto" as the callback prototype.
+ */
+ #define DECLARE_TRACE_NOARGS(name) \
+- __DECLARE_TRACE(name, void, , 1, void *__data, __data)
++ __DECLARE_TRACE(name, void, , \
++ cpu_online(raw_smp_processor_id()), \
++ void *__data, __data)
+
+ #define DECLARE_TRACE(name, proto, args) \
+- __DECLARE_TRACE(name, PARAMS(proto), PARAMS(args), 1, \
+- PARAMS(void *__data, proto), \
+- PARAMS(__data, args))
++ __DECLARE_TRACE(name, PARAMS(proto), PARAMS(args), \
++ cpu_online(raw_smp_processor_id()), \
++ PARAMS(void *__data, proto), \
++ PARAMS(__data, args))
+
+ #define DECLARE_TRACE_CONDITION(name, proto, args, cond) \
+- __DECLARE_TRACE(name, PARAMS(proto), PARAMS(args), PARAMS(cond), \
++ __DECLARE_TRACE(name, PARAMS(proto), PARAMS(args), \
++ cpu_online(raw_smp_processor_id()) && (PARAMS(cond)), \
+ PARAMS(void *__data, proto), \
+ PARAMS(__data, args))
+
+diff --git a/include/net/iw_handler.h b/include/net/iw_handler.h
+index a830b01baba4..e8aa72eaded5 100644
+--- a/include/net/iw_handler.h
++++ b/include/net/iw_handler.h
+@@ -439,6 +439,12 @@ int dev_get_wireless_info(char *buffer, char **start, off_t offset, int length);
+ /* Send a single event to user space */
+ void wireless_send_event(struct net_device *dev, unsigned int cmd,
+ union iwreq_data *wrqu, const char *extra);
++#ifdef CONFIG_WEXT_CORE
++/* flush all previous wext events - if work is done from netdev notifiers */
++void wireless_nlevent_flush(void);
++#else
++static inline void wireless_nlevent_flush(void) {}
++#endif
+
+ /* We may need a function to send a stream of events to user space.
+ * More on that later... */
+diff --git a/net/mac80211/agg-rx.c b/net/mac80211/agg-rx.c
+index 7702978a4c99..f73fddfa548c 100644
+--- a/net/mac80211/agg-rx.c
++++ b/net/mac80211/agg-rx.c
+@@ -281,7 +281,7 @@ void __ieee80211_start_rx_ba_session(struct sta_info *sta,
+ }
+
+ /* prepare A-MPDU MLME for Rx aggregation */
+- tid_agg_rx = kmalloc(sizeof(struct tid_ampdu_rx), GFP_KERNEL);
++ tid_agg_rx = kzalloc(sizeof(*tid_agg_rx), GFP_KERNEL);
+ if (!tid_agg_rx)
+ goto end;
+
+diff --git a/net/mac80211/rc80211_minstrel_ht.c b/net/mac80211/rc80211_minstrel_ht.c
+index 408fd8ab4eef..0f632d6c6904 100644
+--- a/net/mac80211/rc80211_minstrel_ht.c
++++ b/net/mac80211/rc80211_minstrel_ht.c
+@@ -557,7 +557,7 @@ minstrel_aggr_check(struct ieee80211_sta *pubsta, struct sk_buff *skb)
+ if (skb_get_queue_mapping(skb) == IEEE80211_AC_VO)
+ return;
+
+- ieee80211_start_tx_ba_session(pubsta, tid, 5000);
++ ieee80211_start_tx_ba_session(pubsta, tid, 0);
+ }
+
+ static void
+diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
+index a578c5717112..074cdfa04cc4 100644
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -3171,6 +3171,7 @@ static bool prepare_for_handlers(struct ieee80211_rx_data *rx,
+ return false;
+ /* ignore action frames to TDLS-peers */
+ if (ieee80211_is_action(hdr->frame_control) &&
++ !is_broadcast_ether_addr(bssid) &&
+ !ether_addr_equal(bssid, hdr->addr1))
+ return false;
+ }
+diff --git a/net/wireless/core.c b/net/wireless/core.c
+index f52a4cd7017c..6c23065490d3 100644
+--- a/net/wireless/core.c
++++ b/net/wireless/core.c
+@@ -1039,6 +1039,8 @@ static int cfg80211_netdev_notifier_call(struct notifier_block *nb,
+ return NOTIFY_DONE;
+ }
+
++ wireless_nlevent_flush();
++
+ return NOTIFY_OK;
+ }
+
+diff --git a/net/wireless/wext-core.c b/net/wireless/wext-core.c
+index c8717c1d082e..b50ee5d622e1 100644
+--- a/net/wireless/wext-core.c
++++ b/net/wireless/wext-core.c
+@@ -342,6 +342,40 @@ static const int compat_event_type_size[] = {
+
+ /* IW event code */
+
++void wireless_nlevent_flush(void)
++{
++ struct sk_buff *skb;
++ struct net *net;
++
++ ASSERT_RTNL();
++
++ for_each_net(net) {
++ while ((skb = skb_dequeue(&net->wext_nlevents)))
++ rtnl_notify(skb, net, 0, RTNLGRP_LINK, NULL,
++ GFP_KERNEL);
++ }
++}
++EXPORT_SYMBOL_GPL(wireless_nlevent_flush);
++
++static int wext_netdev_notifier_call(struct notifier_block *nb,
++ unsigned long state, void *ptr)
++{
++ /*
++ * When a netdev changes state in any way, flush all pending messages
++ * to avoid them going out in a strange order, e.g. RTM_NEWLINK after
++ * RTM_DELLINK, or with IFF_UP after without IFF_UP during dev_close()
++ * or similar - all of which could otherwise happen due to delays from
++ * schedule_work().
++ */
++ wireless_nlevent_flush();
++
++ return NOTIFY_OK;
++}
++
++static struct notifier_block wext_netdev_notifier = {
++ .notifier_call = wext_netdev_notifier_call,
++};
++
+ static int __net_init wext_pernet_init(struct net *net)
+ {
+ skb_queue_head_init(&net->wext_nlevents);
+@@ -360,7 +394,12 @@ static struct pernet_operations wext_pernet_ops = {
+
+ static int __init wireless_nlevent_init(void)
+ {
+- return register_pernet_subsys(&wext_pernet_ops);
++ int err = register_pernet_subsys(&wext_pernet_ops);
++
++ if (err)
++ return err;
++
++ return register_netdevice_notifier(&wext_netdev_notifier);
+ }
+
+ subsys_initcall(wireless_nlevent_init);
+@@ -368,17 +407,8 @@ subsys_initcall(wireless_nlevent_init);
+ /* Process events generated by the wireless layer or the driver. */
+ static void wireless_nlevent_process(struct work_struct *work)
+ {
+- struct sk_buff *skb;
+- struct net *net;
+-
+ rtnl_lock();
+-
+- for_each_net(net) {
+- while ((skb = skb_dequeue(&net->wext_nlevents)))
+- rtnl_notify(skb, net, 0, RTNLGRP_LINK, NULL,
+- GFP_KERNEL);
+- }
+-
++ wireless_nlevent_flush();
+ rtnl_unlock();
+ }
+
+diff --git a/scripts/ld-version.sh b/scripts/ld-version.sh
+index 198580d245e0..1659b409ef10 100755
+--- a/scripts/ld-version.sh
++++ b/scripts/ld-version.sh
+@@ -1,7 +1,7 @@
+ #!/usr/bin/awk -f
+ # extract linker version number from stdin and turn into single number
+ {
+- gsub(".*)", "");
++ gsub(".*\\)", "");
+ split($1,a, ".");
+ print a[1]*10000000 + a[2]*100000 + a[3]*10000 + a[4]*100 + a[5];
+ exit
+diff --git a/sound/soc/codecs/wm8958-dsp2.c b/sound/soc/codecs/wm8958-dsp2.c
+index 0dada7f0105e..92c3fa57b600 100644
+--- a/sound/soc/codecs/wm8958-dsp2.c
++++ b/sound/soc/codecs/wm8958-dsp2.c
+@@ -459,7 +459,7 @@ static int wm8958_put_mbc_enum(struct snd_kcontrol *kcontrol,
+ struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
+ struct wm8994_priv *wm8994 = snd_soc_codec_get_drvdata(codec);
+ struct wm8994 *control = wm8994->wm8994;
+- int value = ucontrol->value.integer.value[0];
++ int value = ucontrol->value.enumerated.item[0];
+ int reg;
+
+ /* Don't allow on the fly reconfiguration */
+@@ -549,7 +549,7 @@ static int wm8958_put_vss_enum(struct snd_kcontrol *kcontrol,
+ struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
+ struct wm8994_priv *wm8994 = snd_soc_codec_get_drvdata(codec);
+ struct wm8994 *control = wm8994->wm8994;
+- int value = ucontrol->value.integer.value[0];
++ int value = ucontrol->value.enumerated.item[0];
+ int reg;
+
+ /* Don't allow on the fly reconfiguration */
+@@ -582,7 +582,7 @@ static int wm8958_put_vss_hpf_enum(struct snd_kcontrol *kcontrol,
+ struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
+ struct wm8994_priv *wm8994 = snd_soc_codec_get_drvdata(codec);
+ struct wm8994 *control = wm8994->wm8994;
+- int value = ucontrol->value.integer.value[0];
++ int value = ucontrol->value.enumerated.item[0];
+ int reg;
+
+ /* Don't allow on the fly reconfiguration */
+@@ -749,7 +749,7 @@ static int wm8958_put_enh_eq_enum(struct snd_kcontrol *kcontrol,
+ struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
+ struct wm8994_priv *wm8994 = snd_soc_codec_get_drvdata(codec);
+ struct wm8994 *control = wm8994->wm8994;
+- int value = ucontrol->value.integer.value[0];
++ int value = ucontrol->value.enumerated.item[0];
+ int reg;
+
+ /* Don't allow on the fly reconfiguration */
+diff --git a/sound/soc/codecs/wm8994.c b/sound/soc/codecs/wm8994.c
+index e5f14c878636..ba7d8e95ba78 100644
+--- a/sound/soc/codecs/wm8994.c
++++ b/sound/soc/codecs/wm8994.c
+@@ -360,7 +360,7 @@ static int wm8994_put_drc_enum(struct snd_kcontrol *kcontrol,
+ struct wm8994 *control = wm8994->wm8994;
+ struct wm8994_pdata *pdata = &control->pdata;
+ int drc = wm8994_get_drc(kcontrol->id.name);
+- int value = ucontrol->value.integer.value[0];
++ int value = ucontrol->value.enumerated.item[0];
+
+ if (drc < 0)
+ return drc;
+@@ -467,7 +467,7 @@ static int wm8994_put_retune_mobile_enum(struct snd_kcontrol *kcontrol,
+ struct wm8994 *control = wm8994->wm8994;
+ struct wm8994_pdata *pdata = &control->pdata;
+ int block = wm8994_get_retune_mobile_block(kcontrol->id.name);
+- int value = ucontrol->value.integer.value[0];
++ int value = ucontrol->value.enumerated.item[0];
+
+ if (block < 0)
+ return block;
+diff --git a/sound/soc/codecs/wm_adsp.c b/sound/soc/codecs/wm_adsp.c
+index 67124783558a..7f2f661c6453 100644
+--- a/sound/soc/codecs/wm_adsp.c
++++ b/sound/soc/codecs/wm_adsp.c
+@@ -246,7 +246,7 @@ static int wm_adsp_fw_get(struct snd_kcontrol *kcontrol,
+ struct soc_enum *e = (struct soc_enum *)kcontrol->private_value;
+ struct wm_adsp *adsp = snd_soc_codec_get_drvdata(codec);
+
+- ucontrol->value.integer.value[0] = adsp[e->shift_l].fw;
++ ucontrol->value.enumerated.item[0] = adsp[e->shift_l].fw;
+
+ return 0;
+ }
+@@ -258,16 +258,16 @@ static int wm_adsp_fw_put(struct snd_kcontrol *kcontrol,
+ struct soc_enum *e = (struct soc_enum *)kcontrol->private_value;
+ struct wm_adsp *adsp = snd_soc_codec_get_drvdata(codec);
+
+- if (ucontrol->value.integer.value[0] == adsp[e->shift_l].fw)
++ if (ucontrol->value.enumerated.item[0] == adsp[e->shift_l].fw)
+ return 0;
+
+- if (ucontrol->value.integer.value[0] >= WM_ADSP_NUM_FW)
++ if (ucontrol->value.enumerated.item[0] >= WM_ADSP_NUM_FW)
+ return -EINVAL;
+
+ if (adsp[e->shift_l].running)
+ return -EBUSY;
+
+- adsp[e->shift_l].fw = ucontrol->value.integer.value[0];
++ adsp[e->shift_l].fw = ucontrol->value.enumerated.item[0];
+
+ return 0;
+ }
^ permalink raw reply related [flat|nested] 67+ messages in thread
* [gentoo-commits] proj/linux-patches:3.18 commit in: /
@ 2016-04-20 11:21 Mike Pagano
0 siblings, 0 replies; 67+ messages in thread
From: Mike Pagano @ 2016-04-20 11:21 UTC (permalink / raw
To: gentoo-commits
commit: 2fa9b8276f2566bcb2de0fff6e3d0a0ff63b821d
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed Apr 20 11:21:38 2016 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed Apr 20 11:21:38 2016 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=2fa9b827
Linux patch 3.18.31
0000_README | 4 +
1030_linux-3.18.31.patch | 6783 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 6787 insertions(+)
diff --git a/0000_README b/0000_README
index eee1fbe..8c2614b 100644
--- a/0000_README
+++ b/0000_README
@@ -163,6 +163,10 @@ Patch: 1029_linux-3.18.30.patch
From: http://www.kernel.org
Desc: Linux 3.18.30
+Patch: 1030_linux-3.18.31.patch
+From: http://www.kernel.org
+Desc: Linux 3.18.31
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1030_linux-3.18.31.patch b/1030_linux-3.18.31.patch
new file mode 100644
index 0000000..7b0e526
--- /dev/null
+++ b/1030_linux-3.18.31.patch
@@ -0,0 +1,6783 @@
+diff --git a/Documentation/filesystems/efivarfs.txt b/Documentation/filesystems/efivarfs.txt
+index c477af086e65..686a64bba775 100644
+--- a/Documentation/filesystems/efivarfs.txt
++++ b/Documentation/filesystems/efivarfs.txt
+@@ -14,3 +14,10 @@ filesystem.
+ efivarfs is typically mounted like this,
+
+ mount -t efivarfs none /sys/firmware/efi/efivars
++
++Due to the presence of numerous firmware bugs where removing non-standard
++UEFI variables causes the system firmware to fail to POST, efivarfs
++files that are not well-known standardized variables are created
++as immutable files. This doesn't prevent removal - "chattr -i" will work -
++but it does prevent this kind of failure from being accomplished
++accidentally.
+diff --git a/MAINTAINERS b/MAINTAINERS
+index c721042e7e45..090eaae42181 100644
+--- a/MAINTAINERS
++++ b/MAINTAINERS
+@@ -9004,10 +9004,12 @@ S: Maintained
+ F: drivers/net/ethernet/dlink/sundance.c
+
+ SUPERH
++M: Yoshinori Sato <ysato@users.sourceforge.jp>
++M: Rich Felker <dalias@libc.org>
+ L: linux-sh@vger.kernel.org
+ W: http://www.linux-sh.org
+ Q: http://patchwork.kernel.org/project/linux-sh/list/
+-S: Orphan
++S: Maintained
+ F: Documentation/sh/
+ F: arch/sh/
+ F: drivers/sh/
+diff --git a/Makefile b/Makefile
+index cdc9cf7cb4dd..a05c9336722d 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 18
+-SUBLEVEL = 30
++SUBLEVEL = 31
+ EXTRAVERSION =
+ NAME = Diseased Newt
+
+diff --git a/arch/arm/boot/dts/armada-375.dtsi b/arch/arm/boot/dts/armada-375.dtsi
+index de6571445cef..34a4f07b5546 100644
+--- a/arch/arm/boot/dts/armada-375.dtsi
++++ b/arch/arm/boot/dts/armada-375.dtsi
+@@ -450,7 +450,7 @@
+ };
+
+ sata@a0000 {
+- compatible = "marvell,orion-sata";
++ compatible = "marvell,armada-370-sata";
+ reg = <0xa0000 0x5000>;
+ interrupts = <GIC_SPI 26 IRQ_TYPE_LEVEL_HIGH>;
+ clocks = <&gateclk 14>, <&gateclk 20>;
+diff --git a/arch/arm/boot/dts/sun5i-a10s.dtsi b/arch/arm/boot/dts/sun5i-a10s.dtsi
+index 531272c0e526..fd2bcd3b7a9a 100644
+--- a/arch/arm/boot/dts/sun5i-a10s.dtsi
++++ b/arch/arm/boot/dts/sun5i-a10s.dtsi
+@@ -526,7 +526,7 @@
+ };
+
+ rtp: rtp@01c25000 {
+- compatible = "allwinner,sun4i-a10-ts";
++ compatible = "allwinner,sun5i-a13-ts";
+ reg = <0x01c25000 0x100>;
+ interrupts = <29>;
+ };
+diff --git a/arch/arm/boot/dts/sun5i-a13.dtsi b/arch/arm/boot/dts/sun5i-a13.dtsi
+index b131068f4f35..f9b019991f86 100644
+--- a/arch/arm/boot/dts/sun5i-a13.dtsi
++++ b/arch/arm/boot/dts/sun5i-a13.dtsi
+@@ -474,7 +474,7 @@
+ };
+
+ rtp: rtp@01c25000 {
+- compatible = "allwinner,sun4i-a10-ts";
++ compatible = "allwinner,sun5i-a13-ts";
+ reg = <0x01c25000 0x100>;
+ interrupts = <29>;
+ };
+diff --git a/arch/arm/boot/dts/sun7i-a20.dtsi b/arch/arm/boot/dts/sun7i-a20.dtsi
+index 82097c905c48..dcff77817c22 100644
+--- a/arch/arm/boot/dts/sun7i-a20.dtsi
++++ b/arch/arm/boot/dts/sun7i-a20.dtsi
+@@ -896,7 +896,7 @@
+ };
+
+ rtp: rtp@01c25000 {
+- compatible = "allwinner,sun4i-a10-ts";
++ compatible = "allwinner,sun5i-a13-ts";
+ reg = <0x01c25000 0x100>;
+ interrupts = <0 29 4>;
+ };
+diff --git a/arch/arm/include/asm/psci.h b/arch/arm/include/asm/psci.h
+index c25ef3ec6d1f..e3789fb02c9c 100644
+--- a/arch/arm/include/asm/psci.h
++++ b/arch/arm/include/asm/psci.h
+@@ -37,7 +37,7 @@ struct psci_operations {
+ extern struct psci_operations psci_ops;
+ extern struct smp_operations psci_smp_ops;
+
+-#ifdef CONFIG_ARM_PSCI
++#if defined(CONFIG_SMP) && defined(CONFIG_ARM_PSCI)
+ int psci_init(void);
+ bool psci_smp_available(void);
+ #else
+diff --git a/arch/arm64/Makefile b/arch/arm64/Makefile
+index 2d54c55400ed..37c4fd6aeb7a 100644
+--- a/arch/arm64/Makefile
++++ b/arch/arm64/Makefile
+@@ -20,6 +20,8 @@ LIBGCC := $(shell $(CC) $(KBUILD_CFLAGS) -print-libgcc-file-name)
+ KBUILD_DEFCONFIG := defconfig
+
+ KBUILD_CFLAGS += -mgeneral-regs-only
++KBUILD_CFLAGS += $(call cc-option, -mpc-relative-literal-loads)
++
+ ifeq ($(CONFIG_CPU_BIG_ENDIAN), y)
+ KBUILD_CPPFLAGS += -mbig-endian
+ AS += -EB
+diff --git a/arch/arm64/include/asm/pgtable.h b/arch/arm64/include/asm/pgtable.h
+index 41a43bf26492..fba3e59e0c78 100644
+--- a/arch/arm64/include/asm/pgtable.h
++++ b/arch/arm64/include/asm/pgtable.h
+@@ -34,7 +34,7 @@
+ /*
+ * VMALLOC and SPARSEMEM_VMEMMAP ranges.
+ *
+- * VMEMAP_SIZE: allows the whole VA space to be covered by a struct page array
++ * VMEMAP_SIZE: allows the whole linear region to be covered by a struct page array
+ * (rounded up to PUD_SIZE).
+ * VMALLOC_START: beginning of the kernel VA space
+ * VMALLOC_END: extends to the available space below vmmemmap, PCI I/O space,
+@@ -44,7 +44,9 @@
+ #define VMALLOC_START (UL(0xffffffffffffffff) << VA_BITS)
+ #define VMALLOC_END (PAGE_OFFSET - PUD_SIZE - VMEMMAP_SIZE - SZ_64K)
+
+-#define vmemmap ((struct page *)(VMALLOC_END + SZ_64K))
++#define VMEMMAP_START (VMALLOC_END + SZ_64K)
++#define vmemmap ((struct page *)VMEMMAP_START - \
++ SECTION_ALIGN_DOWN(memstart_addr >> PAGE_SHIFT))
+
+ #define FIRST_USER_ADDRESS 0
+
+diff --git a/arch/arm64/mm/init.c b/arch/arm64/mm/init.c
+index f752943f75d2..43245e15413e 100644
+--- a/arch/arm64/mm/init.c
++++ b/arch/arm64/mm/init.c
+@@ -286,8 +286,8 @@ void __init mem_init(void)
+ " .data : 0x%p" " - 0x%p" " (%6ld KB)\n",
+ MLG(VMALLOC_START, VMALLOC_END),
+ #ifdef CONFIG_SPARSEMEM_VMEMMAP
+- MLG((unsigned long)vmemmap,
+- (unsigned long)vmemmap + VMEMMAP_SIZE),
++ MLG(VMEMMAP_START,
++ VMEMMAP_START + VMEMMAP_SIZE),
+ MLM((unsigned long)virt_to_page(PAGE_OFFSET),
+ (unsigned long)virt_to_page(high_memory)),
+ #endif
+diff --git a/arch/powerpc/kernel/module_64.c b/arch/powerpc/kernel/module_64.c
+index 68384514506b..e77dbaeb88ff 100644
+--- a/arch/powerpc/kernel/module_64.c
++++ b/arch/powerpc/kernel/module_64.c
+@@ -335,7 +335,7 @@ static void dedotify(Elf64_Sym *syms, unsigned int numsyms, char *strtab)
+ if (syms[i].st_shndx == SHN_UNDEF) {
+ char *name = strtab + syms[i].st_name;
+ if (name[0] == '.')
+- memmove(name, name+1, strlen(name));
++ syms[i].st_name++;
+ }
+ }
+ }
+diff --git a/arch/s390/include/asm/pci.h b/arch/s390/include/asm/pci.h
+index c030900320e0..d2d23f88464f 100644
+--- a/arch/s390/include/asm/pci.h
++++ b/arch/s390/include/asm/pci.h
+@@ -44,11 +44,7 @@ struct zpci_fmb {
+ u64 rpcit_ops;
+ u64 dma_rbytes;
+ u64 dma_wbytes;
+- /* software counters */
+- atomic64_t allocated_pages;
+- atomic64_t mapped_pages;
+- atomic64_t unmapped_pages;
+-} __packed __aligned(16);
++} __packed __aligned(64);
+
+ #define ZPCI_MSI_VEC_BITS 11
+ #define ZPCI_MSI_VEC_MAX (1 << ZPCI_MSI_VEC_BITS)
+@@ -114,6 +110,10 @@ struct zpci_dev {
+ /* Function measurement block */
+ struct zpci_fmb *fmb;
+ u16 fmb_update; /* update interval */
++ /* software counters */
++ atomic64_t allocated_pages;
++ atomic64_t mapped_pages;
++ atomic64_t unmapped_pages;
+
+ enum pci_bus_speed max_bus_speed;
+
+diff --git a/arch/s390/pci/pci.c b/arch/s390/pci/pci.c
+index 2fa7b14b9c08..944818617718 100644
+--- a/arch/s390/pci/pci.c
++++ b/arch/s390/pci/pci.c
+@@ -190,6 +190,11 @@ int zpci_fmb_enable_device(struct zpci_dev *zdev)
+ return -ENOMEM;
+ WARN_ON((u64) zdev->fmb & 0xf);
+
++ /* reset software counters */
++ atomic64_set(&zdev->allocated_pages, 0);
++ atomic64_set(&zdev->mapped_pages, 0);
++ atomic64_set(&zdev->unmapped_pages, 0);
++
+ args.fmb_addr = virt_to_phys(zdev->fmb);
+ return mod_pci(zdev, ZPCI_MOD_FC_SET_MEASURE, 0, &args);
+ }
+@@ -840,8 +845,11 @@ static inline int barsize(u8 size)
+
+ static int zpci_mem_init(void)
+ {
++ BUILD_BUG_ON(!is_power_of_2(__alignof__(struct zpci_fmb)) ||
++ __alignof__(struct zpci_fmb) < sizeof(struct zpci_fmb));
++
+ zdev_fmb_cache = kmem_cache_create("PCI_FMB_cache", sizeof(struct zpci_fmb),
+- 16, 0, NULL);
++ __alignof__(struct zpci_fmb), 0, NULL);
+ if (!zdev_fmb_cache)
+ goto error_zdev;
+
+diff --git a/arch/s390/pci/pci_debug.c b/arch/s390/pci/pci_debug.c
+index eec598c5939f..8eeccd7d7f79 100644
+--- a/arch/s390/pci/pci_debug.c
++++ b/arch/s390/pci/pci_debug.c
+@@ -31,12 +31,25 @@ static char *pci_perf_names[] = {
+ "Refresh operations",
+ "DMA read bytes",
+ "DMA write bytes",
+- /* software counters */
++};
++
++static char *pci_sw_names[] = {
+ "Allocated pages",
+ "Mapped pages",
+ "Unmapped pages",
+ };
+
++static void pci_sw_counter_show(struct seq_file *m)
++{
++ struct zpci_dev *zdev = m->private;
++ atomic64_t *counter = &zdev->allocated_pages;
++ int i;
++
++ for (i = 0; i < ARRAY_SIZE(pci_sw_names); i++, counter++)
++ seq_printf(m, "%26s:\t%llu\n", pci_sw_names[i],
++ atomic64_read(counter));
++}
++
+ static int pci_perf_show(struct seq_file *m, void *v)
+ {
+ struct zpci_dev *zdev = m->private;
+@@ -63,12 +76,8 @@ static int pci_perf_show(struct seq_file *m, void *v)
+ for (i = 4; i < 6; i++)
+ seq_printf(m, "%26s:\t%llu\n",
+ pci_perf_names[i], *(stat + i));
+- /* software counters */
+- for (i = 6; i < ARRAY_SIZE(pci_perf_names); i++)
+- seq_printf(m, "%26s:\t%llu\n",
+- pci_perf_names[i],
+- atomic64_read((atomic64_t *) (stat + i)));
+
++ pci_sw_counter_show(m);
+ return 0;
+ }
+
+diff --git a/arch/s390/pci/pci_dma.c b/arch/s390/pci/pci_dma.c
+index 4cbb29a4d615..6fd8d5836138 100644
+--- a/arch/s390/pci/pci_dma.c
++++ b/arch/s390/pci/pci_dma.c
+@@ -300,7 +300,7 @@ static dma_addr_t s390_dma_map_pages(struct device *dev, struct page *page,
+ flags |= ZPCI_TABLE_PROTECTED;
+
+ if (!dma_update_trans(zdev, pa, dma_addr, size, flags)) {
+- atomic64_add(nr_pages, &zdev->fmb->mapped_pages);
++ atomic64_add(nr_pages, &zdev->mapped_pages);
+ return dma_addr + (offset & ~PAGE_MASK);
+ }
+
+@@ -328,7 +328,7 @@ static void s390_dma_unmap_pages(struct device *dev, dma_addr_t dma_addr,
+ zpci_err_hex(&dma_addr, sizeof(dma_addr));
+ }
+
+- atomic64_add(npages, &zdev->fmb->unmapped_pages);
++ atomic64_add(npages, &zdev->unmapped_pages);
+ iommu_page_index = (dma_addr - zdev->start_dma) >> PAGE_SHIFT;
+ dma_free_iommu(zdev, iommu_page_index, npages);
+ }
+@@ -357,7 +357,7 @@ static void *s390_dma_alloc(struct device *dev, size_t size,
+ return NULL;
+ }
+
+- atomic64_add(size / PAGE_SIZE, &zdev->fmb->allocated_pages);
++ atomic64_add(size / PAGE_SIZE, &zdev->allocated_pages);
+ if (dma_handle)
+ *dma_handle = map;
+ return (void *) pa;
+@@ -370,7 +370,7 @@ static void s390_dma_free(struct device *dev, size_t size,
+ struct zpci_dev *zdev = get_zdev(to_pci_dev(dev));
+
+ size = PAGE_ALIGN(size);
+- atomic64_sub(size / PAGE_SIZE, &zdev->fmb->allocated_pages);
++ atomic64_sub(size / PAGE_SIZE, &zdev->allocated_pages);
+ s390_dma_unmap_pages(dev, dma_handle, size, DMA_BIDIRECTIONAL, NULL);
+ free_pages((unsigned long) pa, get_order(size));
+ }
+diff --git a/arch/um/drivers/mconsole_kern.c b/arch/um/drivers/mconsole_kern.c
+index 29880c9b324e..e22e57298522 100644
+--- a/arch/um/drivers/mconsole_kern.c
++++ b/arch/um/drivers/mconsole_kern.c
+@@ -133,7 +133,7 @@ void mconsole_proc(struct mc_request *req)
+ ptr += strlen("proc");
+ ptr = skip_spaces(ptr);
+
+- file = file_open_root(mnt->mnt_root, mnt, ptr, O_RDONLY);
++ file = file_open_root(mnt->mnt_root, mnt, ptr, O_RDONLY, 0);
+ if (IS_ERR(file)) {
+ mconsole_reply(req, "Failed to open file", 1, 0);
+ printk(KERN_ERR "open /proc/%s: %ld\n", ptr, PTR_ERR(file));
+diff --git a/arch/x86/include/asm/apic.h b/arch/x86/include/asm/apic.h
+index 465b309af254..dbaf844ddcb1 100644
+--- a/arch/x86/include/asm/apic.h
++++ b/arch/x86/include/asm/apic.h
+@@ -651,8 +651,8 @@ static inline void entering_irq(void)
+
+ static inline void entering_ack_irq(void)
+ {
+- ack_APIC_irq();
+ entering_irq();
++ ack_APIC_irq();
+ }
+
+ static inline void exiting_irq(void)
+diff --git a/arch/x86/include/asm/perf_event.h b/arch/x86/include/asm/perf_event.h
+index 8dfc9fd094a3..024fa1a20f15 100644
+--- a/arch/x86/include/asm/perf_event.h
++++ b/arch/x86/include/asm/perf_event.h
+@@ -159,6 +159,14 @@ struct x86_pmu_capability {
+ */
+ #define INTEL_PMC_IDX_FIXED_BTS (INTEL_PMC_IDX_FIXED + 16)
+
++#define GLOBAL_STATUS_COND_CHG BIT_ULL(63)
++#define GLOBAL_STATUS_BUFFER_OVF BIT_ULL(62)
++#define GLOBAL_STATUS_UNC_OVF BIT_ULL(61)
++#define GLOBAL_STATUS_ASIF BIT_ULL(60)
++#define GLOBAL_STATUS_COUNTERS_FROZEN BIT_ULL(59)
++#define GLOBAL_STATUS_LBRS_FROZEN BIT_ULL(58)
++#define GLOBAL_STATUS_TRACE_TOPAPMI BIT_ULL(55)
++
+ /*
+ * IBS cpuid feature detection
+ */
+diff --git a/arch/x86/include/asm/xen/hypervisor.h b/arch/x86/include/asm/xen/hypervisor.h
+index d866959e5685..d2ad00a42234 100644
+--- a/arch/x86/include/asm/xen/hypervisor.h
++++ b/arch/x86/include/asm/xen/hypervisor.h
+@@ -57,4 +57,6 @@ static inline bool xen_x2apic_para_available(void)
+ }
+ #endif
+
++extern void xen_set_iopl_mask(unsigned mask);
++
+ #endif /* _ASM_X86_XEN_HYPERVISOR_H */
+diff --git a/arch/x86/include/uapi/asm/msr-index.h b/arch/x86/include/uapi/asm/msr-index.h
+index e21331ce368f..177889cd0505 100644
+--- a/arch/x86/include/uapi/asm/msr-index.h
++++ b/arch/x86/include/uapi/asm/msr-index.h
+@@ -69,6 +69,12 @@
+ #define MSR_LBR_CORE_FROM 0x00000040
+ #define MSR_LBR_CORE_TO 0x00000060
+
++#define MSR_LBR_INFO_0 0x00000dc0 /* ... 0xddf for _31 */
++#define LBR_INFO_MISPRED BIT_ULL(63)
++#define LBR_INFO_IN_TX BIT_ULL(62)
++#define LBR_INFO_ABORT BIT_ULL(61)
++#define LBR_INFO_CYCLES 0xffff
++
+ #define MSR_IA32_PEBS_ENABLE 0x000003f1
+ #define MSR_IA32_DS_AREA 0x00000600
+ #define MSR_IA32_PERF_CAPABILITIES 0x00000345
+diff --git a/arch/x86/kernel/ioport.c b/arch/x86/kernel/ioport.c
+index 4ddaf66ea35f..792621a32457 100644
+--- a/arch/x86/kernel/ioport.c
++++ b/arch/x86/kernel/ioport.c
+@@ -96,9 +96,14 @@ asmlinkage long sys_ioperm(unsigned long from, unsigned long num, int turn_on)
+ SYSCALL_DEFINE1(iopl, unsigned int, level)
+ {
+ struct pt_regs *regs = current_pt_regs();
+- unsigned int old = (regs->flags >> 12) & 3;
+ struct thread_struct *t = ¤t->thread;
+
++ /*
++ * Careful: the IOPL bits in regs->flags are undefined under Xen PV
++ * and changing them has no effect.
++ */
++ unsigned int old = t->iopl >> X86_EFLAGS_IOPL_BIT;
++
+ if (level > 3)
+ return -EINVAL;
+ /* Trying to gain more privileges? */
+@@ -106,8 +111,9 @@ SYSCALL_DEFINE1(iopl, unsigned int, level)
+ if (!capable(CAP_SYS_RAWIO))
+ return -EPERM;
+ }
+- regs->flags = (regs->flags & ~X86_EFLAGS_IOPL) | (level << 12);
+- t->iopl = level << 12;
++ regs->flags = (regs->flags & ~X86_EFLAGS_IOPL) |
++ (level << X86_EFLAGS_IOPL_BIT);
++ t->iopl = level << X86_EFLAGS_IOPL_BIT;
+ set_iopl_mask(t->iopl);
+
+ return 0;
+diff --git a/arch/x86/kernel/process_64.c b/arch/x86/kernel/process_64.c
+index 54cfd5ebd96c..f547f866e86c 100644
+--- a/arch/x86/kernel/process_64.c
++++ b/arch/x86/kernel/process_64.c
+@@ -49,6 +49,7 @@
+ #include <asm/syscalls.h>
+ #include <asm/debugreg.h>
+ #include <asm/switch_to.h>
++#include <asm/xen/hypervisor.h>
+
+ asmlinkage extern void ret_from_fork(void);
+
+@@ -424,6 +425,17 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
+ task_thread_info(prev_p)->flags & _TIF_WORK_CTXSW_PREV))
+ __switch_to_xtra(prev_p, next_p, tss);
+
++#ifdef CONFIG_XEN
++ /*
++ * On Xen PV, IOPL bits in pt_regs->flags have no effect, and
++ * current_pt_regs()->flags may not match the current task's
++ * intended IOPL. We need to switch it manually.
++ */
++ if (unlikely(xen_pv_domain() &&
++ prev->iopl != next->iopl))
++ xen_set_iopl_mask(next->iopl);
++#endif
++
+ return prev_p;
+ }
+
+diff --git a/arch/x86/kvm/i8254.c b/arch/x86/kvm/i8254.c
+index 1406ffde3e35..b0a706d063cb 100644
+--- a/arch/x86/kvm/i8254.c
++++ b/arch/x86/kvm/i8254.c
+@@ -244,7 +244,7 @@ static void kvm_pit_ack_irq(struct kvm_irq_ack_notifier *kian)
+ * PIC is being reset. Handle it gracefully here
+ */
+ atomic_inc(&ps->pending);
+- else if (value > 0)
++ else if (value > 0 && ps->reinject)
+ /* in this case, we had multiple outstanding pit interrupts
+ * that we needed to inject. Reinject
+ */
+@@ -287,7 +287,9 @@ static void pit_do_work(struct kthread_work *work)
+ * last one has been acked.
+ */
+ spin_lock(&ps->inject_lock);
+- if (ps->irq_ack) {
++ if (!ps->reinject)
++ inject = 1;
++ else if (ps->irq_ack) {
+ ps->irq_ack = 0;
+ inject = 1;
+ }
+@@ -316,10 +318,10 @@ static enum hrtimer_restart pit_timer_fn(struct hrtimer *data)
+ struct kvm_kpit_state *ps = container_of(data, struct kvm_kpit_state, timer);
+ struct kvm_pit *pt = ps->kvm->arch.vpit;
+
+- if (ps->reinject || !atomic_read(&ps->pending)) {
++ if (ps->reinject)
+ atomic_inc(&ps->pending);
+- queue_kthread_work(&pt->worker, &pt->expired);
+- }
++
++ queue_kthread_work(&pt->worker, &pt->expired);
+
+ if (ps->is_periodic) {
+ hrtimer_add_expires_ns(&ps->timer, ps->period);
+diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
+index 49cce7508a54..d9c11f3f5b18 100644
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -6740,6 +6740,7 @@ static int handle_invept(struct kvm_vcpu *vcpu)
+ if (!(types & (1UL << type))) {
+ nested_vmx_failValid(vcpu,
+ VMXERR_INVALID_OPERAND_TO_INVEPT_INVVPID);
++ skip_emulated_instruction(vcpu);
+ return 1;
+ }
+
+diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
+index 9fbf7c7fcbd9..d77189c351a8 100644
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -3668,13 +3668,13 @@ static int kvm_vm_ioctl_get_pit(struct kvm *kvm, struct kvm_pit_state *ps)
+
+ static int kvm_vm_ioctl_set_pit(struct kvm *kvm, struct kvm_pit_state *ps)
+ {
+- int r = 0;
+-
++ int i;
+ mutex_lock(&kvm->arch.vpit->pit_state.lock);
+ memcpy(&kvm->arch.vpit->pit_state, ps, sizeof(struct kvm_pit_state));
+- kvm_pit_load_count(kvm, 0, ps->channels[0].count, 0);
++ for (i = 0; i < 3; i++)
++ kvm_pit_load_count(kvm, i, ps->channels[i].count, 0);
+ mutex_unlock(&kvm->arch.vpit->pit_state.lock);
+- return r;
++ return 0;
+ }
+
+ static int kvm_vm_ioctl_get_pit2(struct kvm *kvm, struct kvm_pit_state2 *ps)
+@@ -3693,6 +3693,7 @@ static int kvm_vm_ioctl_get_pit2(struct kvm *kvm, struct kvm_pit_state2 *ps)
+ static int kvm_vm_ioctl_set_pit2(struct kvm *kvm, struct kvm_pit_state2 *ps)
+ {
+ int r = 0, start = 0;
++ int i;
+ u32 prev_legacy, cur_legacy;
+ mutex_lock(&kvm->arch.vpit->pit_state.lock);
+ prev_legacy = kvm->arch.vpit->pit_state.flags & KVM_PIT_FLAGS_HPET_LEGACY;
+@@ -3702,7 +3703,8 @@ static int kvm_vm_ioctl_set_pit2(struct kvm *kvm, struct kvm_pit_state2 *ps)
+ memcpy(&kvm->arch.vpit->pit_state.channels, &ps->channels,
+ sizeof(kvm->arch.vpit->pit_state.channels));
+ kvm->arch.vpit->pit_state.flags = ps->flags;
+- kvm_pit_load_count(kvm, 0, kvm->arch.vpit->pit_state.channels[0].count, start);
++ for (i = 0; i < 3; i++)
++ kvm_pit_load_count(kvm, i, kvm->arch.vpit->pit_state.channels[i].count, start);
+ mutex_unlock(&kvm->arch.vpit->pit_state.lock);
+ return r;
+ }
+diff --git a/arch/x86/pci/fixup.c b/arch/x86/pci/fixup.c
+index 9a2b7101ae8a..f16af96c60a2 100644
+--- a/arch/x86/pci/fixup.c
++++ b/arch/x86/pci/fixup.c
+@@ -553,3 +553,10 @@ static void twinhead_reserve_killing_zone(struct pci_dev *dev)
+ }
+ }
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x27B9, twinhead_reserve_killing_zone);
++
++static void pci_bdwep_bar(struct pci_dev *dev)
++{
++ dev->non_compliant_bars = 1;
++}
++DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x6fa0, pci_bdwep_bar);
++DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x6fc0, pci_bdwep_bar);
+diff --git a/arch/x86/pci/intel_mid_pci.c b/arch/x86/pci/intel_mid_pci.c
+index b9958c364075..44b9271580b5 100644
+--- a/arch/x86/pci/intel_mid_pci.c
++++ b/arch/x86/pci/intel_mid_pci.c
+@@ -210,6 +210,9 @@ static int intel_mid_pci_irq_enable(struct pci_dev *dev)
+ {
+ int polarity;
+
++ if (dev->irq_managed && dev->irq > 0)
++ return 0;
++
+ if (intel_mid_identify_cpu() == INTEL_MID_CPU_CHIP_TANGIER)
+ polarity = 0; /* active high */
+ else
+@@ -224,13 +227,18 @@ static int intel_mid_pci_irq_enable(struct pci_dev *dev)
+ if (mp_map_gsi_to_irq(dev->irq, IOAPIC_MAP_ALLOC) < 0)
+ return -EBUSY;
+
++ dev->irq_managed = 1;
++
+ return 0;
+ }
+
+ static void intel_mid_pci_irq_disable(struct pci_dev *dev)
+ {
+- if (!mp_should_keep_irq(&dev->dev) && dev->irq > 0)
++ if (!mp_should_keep_irq(&dev->dev) && dev->irq_managed &&
++ dev->irq > 0) {
+ mp_unmap_irq(dev->irq);
++ dev->irq_managed = 0;
++ }
+ }
+
+ struct pci_ops intel_mid_pci_ops = {
+diff --git a/arch/x86/pci/irq.c b/arch/x86/pci/irq.c
+index eb500c2592ad..a47e2dea0972 100644
+--- a/arch/x86/pci/irq.c
++++ b/arch/x86/pci/irq.c
+@@ -1202,6 +1202,9 @@ static int pirq_enable_irq(struct pci_dev *dev)
+ int irq;
+ struct io_apic_irq_attr irq_attr;
+
++ if (dev->irq_managed && dev->irq > 0)
++ return 0;
++
+ irq = IO_APIC_get_PCI_irq_vector(dev->bus->number,
+ PCI_SLOT(dev->devfn),
+ pin - 1, &irq_attr);
+@@ -1228,6 +1231,7 @@ static int pirq_enable_irq(struct pci_dev *dev)
+ }
+ dev = temp_dev;
+ if (irq >= 0) {
++ dev->irq_managed = 1;
+ dev->irq = irq;
+ dev_info(&dev->dev, "PCI->APIC IRQ transform: "
+ "INT %c -> IRQ %d\n", 'A' + pin - 1, irq);
+@@ -1257,8 +1261,9 @@ static int pirq_enable_irq(struct pci_dev *dev)
+ static void pirq_disable_irq(struct pci_dev *dev)
+ {
+ if (io_apic_assign_pci_irqs && !mp_should_keep_irq(&dev->dev) &&
+- dev->irq) {
++ dev->irq_managed && dev->irq) {
+ mp_unmap_irq(dev->irq);
+ dev->irq = 0;
++ dev->irq_managed = 0;
+ }
+ }
+diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
+index 7e365d231a93..6ba1ec961aaa 100644
+--- a/arch/x86/xen/enlighten.c
++++ b/arch/x86/xen/enlighten.c
+@@ -956,7 +956,7 @@ static void xen_load_sp0(struct tss_struct *tss,
+ xen_mc_issue(PARAVIRT_LAZY_CPU);
+ }
+
+-static void xen_set_iopl_mask(unsigned mask)
++void xen_set_iopl_mask(unsigned mask)
+ {
+ struct physdev_set_iopl set_iopl;
+
+diff --git a/arch/xtensa/kernel/head.S b/arch/xtensa/kernel/head.S
+index aeeb3cc8a410..288b61f080fe 100644
+--- a/arch/xtensa/kernel/head.S
++++ b/arch/xtensa/kernel/head.S
+@@ -123,7 +123,7 @@ ENTRY(_startup)
+ wsr a0, icountlevel
+
+ .set _index, 0
+- .rept XCHAL_NUM_DBREAK - 1
++ .rept XCHAL_NUM_DBREAK
+ wsr a0, SREG_DBREAKC + _index
+ .set _index, _index + 1
+ .endr
+diff --git a/arch/xtensa/mm/cache.c b/arch/xtensa/mm/cache.c
+index d75aa1476da7..1a804a2f9a5b 100644
+--- a/arch/xtensa/mm/cache.c
++++ b/arch/xtensa/mm/cache.c
+@@ -97,11 +97,11 @@ void clear_user_highpage(struct page *page, unsigned long vaddr)
+ unsigned long paddr;
+ void *kvaddr = coherent_kvaddr(page, TLBTEMP_BASE_1, vaddr, &paddr);
+
+- pagefault_disable();
++ preempt_disable();
+ kmap_invalidate_coherent(page, vaddr);
+ set_bit(PG_arch_1, &page->flags);
+ clear_page_alias(kvaddr, paddr);
+- pagefault_enable();
++ preempt_enable();
+ }
+
+ void copy_user_highpage(struct page *dst, struct page *src,
+@@ -113,11 +113,11 @@ void copy_user_highpage(struct page *dst, struct page *src,
+ void *src_vaddr = coherent_kvaddr(src, TLBTEMP_BASE_2, vaddr,
+ &src_paddr);
+
+- pagefault_disable();
++ preempt_disable();
+ kmap_invalidate_coherent(dst, vaddr);
+ set_bit(PG_arch_1, &dst->flags);
+ copy_page_alias(dst_vaddr, src_vaddr, dst_paddr, src_paddr);
+- pagefault_enable();
++ preempt_enable();
+ }
+
+ #endif /* DCACHE_WAY_SIZE > PAGE_SIZE */
+diff --git a/arch/xtensa/platforms/iss/console.c b/arch/xtensa/platforms/iss/console.c
+index 70cb408bc20d..92d785fefb6d 100644
+--- a/arch/xtensa/platforms/iss/console.c
++++ b/arch/xtensa/platforms/iss/console.c
+@@ -100,21 +100,23 @@ static void rs_poll(unsigned long priv)
+ {
+ struct tty_port *port = (struct tty_port *)priv;
+ int i = 0;
++ int rd = 1;
+ unsigned char c;
+
+ spin_lock(&timer_lock);
+
+ while (simc_poll(0)) {
+- simc_read(0, &c, 1);
++ rd = simc_read(0, &c, 1);
++ if (rd <= 0)
++ break;
+ tty_insert_flip_char(port, c, TTY_NORMAL);
+ i++;
+ }
+
+ if (i)
+ tty_flip_buffer_push(port);
+-
+-
+- mod_timer(&serial_timer, jiffies + SERIAL_TIMER_VALUE);
++ if (rd)
++ mod_timer(&serial_timer, jiffies + SERIAL_TIMER_VALUE);
+ spin_unlock(&timer_lock);
+ }
+
+diff --git a/crypto/algif_skcipher.c b/crypto/algif_skcipher.c
+index 83187f497c7c..d2cacc7f079f 100644
+--- a/crypto/algif_skcipher.c
++++ b/crypto/algif_skcipher.c
+@@ -31,6 +31,11 @@ struct skcipher_sg_list {
+ struct scatterlist sg[0];
+ };
+
++struct skcipher_tfm {
++ struct crypto_ablkcipher *skcipher;
++ bool has_key;
++};
++
+ struct skcipher_ctx {
+ struct list_head tsgl;
+ struct af_alg_sgl rsgl;
+@@ -544,19 +549,139 @@ static struct proto_ops algif_skcipher_ops = {
+ .poll = skcipher_poll,
+ };
+
++static int skcipher_check_key(struct socket *sock)
++{
++ int err = 0;
++ struct sock *psk;
++ struct alg_sock *pask;
++ struct skcipher_tfm *tfm;
++ struct sock *sk = sock->sk;
++ struct alg_sock *ask = alg_sk(sk);
++
++ lock_sock(sk);
++ if (ask->refcnt)
++ goto unlock_child;
++
++ psk = ask->parent;
++ pask = alg_sk(ask->parent);
++ tfm = pask->private;
++
++ err = -ENOKEY;
++ lock_sock_nested(psk, SINGLE_DEPTH_NESTING);
++ if (!tfm->has_key)
++ goto unlock;
++
++ if (!pask->refcnt++)
++ sock_hold(psk);
++
++ ask->refcnt = 1;
++ sock_put(psk);
++
++ err = 0;
++
++unlock:
++ release_sock(psk);
++unlock_child:
++ release_sock(sk);
++
++ return err;
++}
++
++static int skcipher_sendmsg_nokey(struct kiocb *unused, struct socket *sock,
++ struct msghdr *msg, size_t size)
++{
++ int err;
++
++ err = skcipher_check_key(sock);
++ if (err)
++ return err;
++
++ return skcipher_sendmsg(NULL, sock, msg, size);
++}
++
++static ssize_t skcipher_sendpage_nokey(struct socket *sock, struct page *page,
++ int offset, size_t size, int flags)
++{
++ int err;
++
++ err = skcipher_check_key(sock);
++ if (err)
++ return err;
++
++ return skcipher_sendpage(sock, page, offset, size, flags);
++}
++
++static int skcipher_recvmsg_nokey(struct kiocb *unused, struct socket *sock,
++ struct msghdr *msg, size_t ignored, int flags)
++{
++ int err;
++
++ err = skcipher_check_key(sock);
++ if (err)
++ return err;
++
++ return skcipher_recvmsg(NULL, sock, msg, ignored, flags);
++}
++
++static struct proto_ops algif_skcipher_ops_nokey = {
++ .family = PF_ALG,
++
++ .connect = sock_no_connect,
++ .socketpair = sock_no_socketpair,
++ .getname = sock_no_getname,
++ .ioctl = sock_no_ioctl,
++ .listen = sock_no_listen,
++ .shutdown = sock_no_shutdown,
++ .getsockopt = sock_no_getsockopt,
++ .mmap = sock_no_mmap,
++ .bind = sock_no_bind,
++ .accept = sock_no_accept,
++ .setsockopt = sock_no_setsockopt,
++
++ .release = af_alg_release,
++ .sendmsg = skcipher_sendmsg_nokey,
++ .sendpage = skcipher_sendpage_nokey,
++ .recvmsg = skcipher_recvmsg_nokey,
++ .poll = skcipher_poll,
++};
++
+ static void *skcipher_bind(const char *name, u32 type, u32 mask)
+ {
+- return crypto_alloc_ablkcipher(name, type, mask);
++ struct skcipher_tfm *tfm;
++ struct crypto_ablkcipher *skcipher;
++
++ tfm = kzalloc(sizeof(*tfm), GFP_KERNEL);
++ if (!tfm)
++ return ERR_PTR(-ENOMEM);
++
++ skcipher = crypto_alloc_ablkcipher(name, type, mask);
++ if (IS_ERR(skcipher)) {
++ kfree(tfm);
++ return ERR_CAST(skcipher);
++ }
++
++ tfm->skcipher = skcipher;
++
++ return tfm;
+ }
+
+ static void skcipher_release(void *private)
+ {
+- crypto_free_ablkcipher(private);
++ struct skcipher_tfm *tfm = private;
++
++ crypto_free_ablkcipher(tfm->skcipher);
++ kfree(tfm);
+ }
+
+ static int skcipher_setkey(void *private, const u8 *key, unsigned int keylen)
+ {
+- return crypto_ablkcipher_setkey(private, key, keylen);
++ struct skcipher_tfm *tfm = private;
++ int err;
++
++ err = crypto_ablkcipher_setkey(tfm->skcipher, key, keylen);
++ tfm->has_key = !err;
++
++ return err;
+ }
+
+ static void skcipher_sock_destruct(struct sock *sk)
+@@ -571,24 +696,27 @@ static void skcipher_sock_destruct(struct sock *sk)
+ af_alg_release_parent(sk);
+ }
+
+-static int skcipher_accept_parent(void *private, struct sock *sk)
++static int skcipher_accept_parent_nokey(void *private, struct sock *sk)
+ {
+ struct skcipher_ctx *ctx;
+ struct alg_sock *ask = alg_sk(sk);
+- unsigned int len = sizeof(*ctx) + crypto_ablkcipher_reqsize(private);
++ struct skcipher_tfm *tfm = private;
++ struct crypto_ablkcipher *skcipher = tfm->skcipher;
++ unsigned int len = sizeof(*ctx) + crypto_ablkcipher_reqsize(skcipher);
+
+ ctx = sock_kmalloc(sk, len, GFP_KERNEL);
+ if (!ctx)
+ return -ENOMEM;
+
+- ctx->iv = sock_kmalloc(sk, crypto_ablkcipher_ivsize(private),
++ ctx->iv = sock_kmalloc(sk, crypto_ablkcipher_ivsize(skcipher),
+ GFP_KERNEL);
+ if (!ctx->iv) {
+ sock_kfree_s(sk, ctx, len);
+ return -ENOMEM;
+ }
+
+- memset(ctx->iv, 0, crypto_ablkcipher_ivsize(private));
++ memset(ctx->iv, 0, crypto_ablkcipher_ivsize(skcipher));
++
+
+ INIT_LIST_HEAD(&ctx->tsgl);
+ ctx->len = len;
+@@ -600,7 +728,7 @@ static int skcipher_accept_parent(void *private, struct sock *sk)
+
+ ask->private = ctx;
+
+- ablkcipher_request_set_tfm(&ctx->req, private);
++ ablkcipher_request_set_tfm(&ctx->req, skcipher);
+ ablkcipher_request_set_callback(&ctx->req, CRYPTO_TFM_REQ_MAY_BACKLOG,
+ af_alg_complete, &ctx->completion);
+
+@@ -609,12 +737,24 @@ static int skcipher_accept_parent(void *private, struct sock *sk)
+ return 0;
+ }
+
++static int skcipher_accept_parent(void *private, struct sock *sk)
++{
++ struct skcipher_tfm *tfm = private;
++
++ if (!tfm->has_key)
++ return -ENOKEY;
++
++ return skcipher_accept_parent_nokey(private, sk);
++}
++
+ static const struct af_alg_type algif_type_skcipher = {
+ .bind = skcipher_bind,
+ .release = skcipher_release,
+ .setkey = skcipher_setkey,
+ .accept = skcipher_accept_parent,
++ .accept_nokey = skcipher_accept_parent_nokey,
+ .ops = &algif_skcipher_ops,
++ .ops_nokey = &algif_skcipher_ops_nokey,
+ .name = "skcipher",
+ .owner = THIS_MODULE
+ };
+diff --git a/drivers/acpi/pci_irq.c b/drivers/acpi/pci_irq.c
+index 6e6b80eb0bba..5f1fdca65e5f 100644
+--- a/drivers/acpi/pci_irq.c
++++ b/drivers/acpi/pci_irq.c
+@@ -413,6 +413,9 @@ int acpi_pci_irq_enable(struct pci_dev *dev)
+ return 0;
+ }
+
++ if (dev->irq_managed && dev->irq > 0)
++ return 0;
++
+ entry = acpi_pci_irq_lookup(dev, pin);
+ if (!entry) {
+ /*
+@@ -456,6 +459,7 @@ int acpi_pci_irq_enable(struct pci_dev *dev)
+ return rc;
+ }
+ dev->irq = rc;
++ dev->irq_managed = 1;
+
+ if (link)
+ snprintf(link_desc, sizeof(link_desc), " -> Link[%s]", link);
+@@ -478,7 +482,7 @@ void acpi_pci_irq_disable(struct pci_dev *dev)
+ u8 pin;
+
+ pin = dev->pin;
+- if (!pin)
++ if (!pin || !dev->irq_managed || dev->irq <= 0)
+ return;
+
+ /* Keep IOAPIC pin configuration when suspending */
+@@ -506,6 +510,9 @@ void acpi_pci_irq_disable(struct pci_dev *dev)
+ */
+
+ dev_dbg(&dev->dev, "PCI INT %c disabled\n", pin_name(pin));
+- if (gsi >= 0 && dev->irq > 0)
++ if (gsi >= 0) {
+ acpi_unregister_gsi(gsi);
++ dev->irq = 0;
++ dev->irq_managed = 0;
++ }
+ }
+diff --git a/drivers/block/mtip32xx/mtip32xx.c b/drivers/block/mtip32xx/mtip32xx.c
+index 1bd5f523f8fd..d7e0b9b806e9 100644
+--- a/drivers/block/mtip32xx/mtip32xx.c
++++ b/drivers/block/mtip32xx/mtip32xx.c
+@@ -705,7 +705,7 @@ static void mtip_handle_tfe(struct driver_data *dd)
+ fail_reason = "thermal shutdown";
+ }
+ if (buf[288] == 0xBF) {
+- set_bit(MTIP_DDF_SEC_LOCK_BIT, &dd->dd_flag);
++ set_bit(MTIP_DDF_REBUILD_FAILED_BIT, &dd->dd_flag);
+ dev_info(&dd->pdev->dev,
+ "Drive indicates rebuild has failed. Secure erase required.\n");
+ fail_all_ncq_cmds = 1;
+@@ -896,6 +896,10 @@ static inline irqreturn_t mtip_handle_irq(struct driver_data *data)
+
+ /* Acknowledge the interrupt status on the port.*/
+ port_stat = readl(port->mmio + PORT_IRQ_STAT);
++ if (unlikely(port_stat == 0xFFFFFFFF)) {
++ mtip_check_surprise_removal(dd->pdev);
++ return IRQ_HANDLED;
++ }
+ writel(port_stat, port->mmio + PORT_IRQ_STAT);
+
+ /* Demux port status */
+@@ -991,15 +995,11 @@ static bool mtip_pause_ncq(struct mtip_port *port,
+ reply = port->rxfis + RX_FIS_D2H_REG;
+ task_file_data = readl(port->mmio+PORT_TFDATA);
+
+- if (fis->command == ATA_CMD_SEC_ERASE_UNIT)
+- clear_bit(MTIP_DDF_SEC_LOCK_BIT, &port->dd->dd_flag);
+-
+ if ((task_file_data & 1))
+ return false;
+
+ if (fis->command == ATA_CMD_SEC_ERASE_PREP) {
+ set_bit(MTIP_PF_SE_ACTIVE_BIT, &port->flags);
+- set_bit(MTIP_DDF_SEC_LOCK_BIT, &port->dd->dd_flag);
+ port->ic_pause_timer = jiffies;
+ return true;
+ } else if ((fis->command == ATA_CMD_DOWNLOAD_MICRO) &&
+@@ -1011,6 +1011,8 @@ static bool mtip_pause_ncq(struct mtip_port *port,
+ ((fis->command == 0xFC) &&
+ (fis->features == 0x27 || fis->features == 0x72 ||
+ fis->features == 0x62 || fis->features == 0x26))) {
++ clear_bit(MTIP_DDF_SEC_LOCK_BIT, &port->dd->dd_flag);
++ clear_bit(MTIP_DDF_REBUILD_FAILED_BIT, &port->dd->dd_flag);
+ /* Com reset after secure erase or lowlevel format */
+ mtip_restart_port(port);
+ return false;
+@@ -1102,6 +1104,7 @@ static int mtip_exec_internal_command(struct mtip_port *port,
+ struct mtip_cmd *int_cmd;
+ struct driver_data *dd = port->dd;
+ int rv = 0;
++ unsigned long start;
+
+ /* Make sure the buffer is 8 byte aligned. This is asic specific. */
+ if (buffer & 0x00000007) {
+@@ -1164,6 +1167,8 @@ static int mtip_exec_internal_command(struct mtip_port *port,
+ /* Populate the command header */
+ int_cmd->command_header->byte_count = 0;
+
++ start = jiffies;
++
+ /* Issue the command to the hardware */
+ mtip_issue_non_ncq_command(port, MTIP_TAG_INTERNAL);
+
+@@ -1172,10 +1177,12 @@ static int mtip_exec_internal_command(struct mtip_port *port,
+ if ((rv = wait_for_completion_interruptible_timeout(
+ &wait,
+ msecs_to_jiffies(timeout))) <= 0) {
++
+ if (rv == -ERESTARTSYS) { /* interrupted */
+ dev_err(&dd->pdev->dev,
+- "Internal command [%02X] was interrupted after %lu ms\n",
+- fis->command, timeout);
++ "Internal command [%02X] was interrupted after %u ms\n",
++ fis->command,
++ jiffies_to_msecs(jiffies - start));
+ rv = -EINTR;
+ goto exec_ic_exit;
+ } else if (rv == 0) /* timeout */
+@@ -2780,48 +2787,6 @@ static void mtip_hw_debugfs_exit(struct driver_data *dd)
+ debugfs_remove_recursive(dd->dfs_node);
+ }
+
+-static int mtip_free_orphan(struct driver_data *dd)
+-{
+- struct kobject *kobj;
+-
+- if (dd->bdev) {
+- if (dd->bdev->bd_holders >= 1)
+- return -2;
+-
+- bdput(dd->bdev);
+- dd->bdev = NULL;
+- }
+-
+- mtip_hw_debugfs_exit(dd);
+-
+- spin_lock(&rssd_index_lock);
+- ida_remove(&rssd_index_ida, dd->index);
+- spin_unlock(&rssd_index_lock);
+-
+- if (!test_bit(MTIP_DDF_INIT_DONE_BIT, &dd->dd_flag) &&
+- test_bit(MTIP_DDF_REBUILD_FAILED_BIT, &dd->dd_flag)) {
+- put_disk(dd->disk);
+- } else {
+- if (dd->disk) {
+- kobj = kobject_get(&disk_to_dev(dd->disk)->kobj);
+- if (kobj) {
+- mtip_hw_sysfs_exit(dd, kobj);
+- kobject_put(kobj);
+- }
+- del_gendisk(dd->disk);
+- dd->disk = NULL;
+- }
+- if (dd->queue) {
+- dd->queue->queuedata = NULL;
+- blk_cleanup_queue(dd->queue);
+- blk_mq_free_tag_set(&dd->tags);
+- dd->queue = NULL;
+- }
+- }
+- kfree(dd);
+- return 0;
+-}
+-
+ /*
+ * Perform any init/resume time hardware setup
+ *
+@@ -2969,7 +2934,6 @@ static int mtip_service_thread(void *data)
+ unsigned long slot, slot_start, slot_wrap;
+ unsigned int num_cmd_slots = dd->slot_groups * 32;
+ struct mtip_port *port = dd->port;
+- int ret;
+
+ while (1) {
+ if (kthread_should_stop() ||
+@@ -3055,18 +3019,6 @@ restart_eh:
+ if (kthread_should_stop())
+ goto st_out;
+ }
+-
+- while (1) {
+- ret = mtip_free_orphan(dd);
+- if (!ret) {
+- /* NOTE: All data structures are invalid, do not
+- * access any here */
+- return 0;
+- }
+- msleep_interruptible(1000);
+- if (kthread_should_stop())
+- goto st_out;
+- }
+ st_out:
+ return 0;
+ }
+@@ -3178,7 +3130,7 @@ static int mtip_hw_get_identify(struct driver_data *dd)
+ if (buf[288] == 0xBF) {
+ dev_info(&dd->pdev->dev,
+ "Drive indicates rebuild has failed.\n");
+- /* TODO */
++ set_bit(MTIP_DDF_REBUILD_FAILED_BIT, &dd->dd_flag);
+ }
+ }
+
+@@ -3352,20 +3304,25 @@ out1:
+ return rv;
+ }
+
+-static void mtip_standby_drive(struct driver_data *dd)
++static int mtip_standby_drive(struct driver_data *dd)
+ {
+- if (dd->sr)
+- return;
++ int rv = 0;
+
++ if (dd->sr || !dd->port)
++ return -ENODEV;
+ /*
+ * Send standby immediate (E0h) to the drive so that it
+ * saves its state.
+ */
+ if (!test_bit(MTIP_PF_REBUILD_BIT, &dd->port->flags) &&
+- !test_bit(MTIP_DDF_SEC_LOCK_BIT, &dd->dd_flag))
+- if (mtip_standby_immediate(dd->port))
++ !test_bit(MTIP_DDF_REBUILD_FAILED_BIT, &dd->dd_flag) &&
++ !test_bit(MTIP_DDF_SEC_LOCK_BIT, &dd->dd_flag)) {
++ rv = mtip_standby_immediate(dd->port);
++ if (rv)
+ dev_warn(&dd->pdev->dev,
+ "STANDBY IMMEDIATE failed\n");
++ }
++ return rv;
+ }
+
+ /*
+@@ -3394,6 +3351,7 @@ static int mtip_hw_exit(struct driver_data *dd)
+ /* Release the IRQ. */
+ irq_set_affinity_hint(dd->pdev->irq, NULL);
+ devm_free_irq(&dd->pdev->dev, dd->pdev->irq, dd);
++ msleep(1000);
+
+ /* Free dma regions */
+ mtip_dma_free(dd);
+@@ -3422,8 +3380,7 @@ static int mtip_hw_shutdown(struct driver_data *dd)
+ * Send standby immediate (E0h) to the drive so that it
+ * saves its state.
+ */
+- if (!dd->sr && dd->port)
+- mtip_standby_immediate(dd->port);
++ mtip_standby_drive(dd);
+
+ return 0;
+ }
+@@ -3446,7 +3403,7 @@ static int mtip_hw_suspend(struct driver_data *dd)
+ * Send standby immediate (E0h) to the drive
+ * so that it saves its state.
+ */
+- if (mtip_standby_immediate(dd->port) != 0) {
++ if (mtip_standby_drive(dd) != 0) {
+ dev_err(&dd->pdev->dev,
+ "Failed standby-immediate command\n");
+ return -EFAULT;
+@@ -3684,6 +3641,28 @@ static int mtip_block_getgeo(struct block_device *dev,
+ return 0;
+ }
+
++static int mtip_block_open(struct block_device *dev, fmode_t mode)
++{
++ struct driver_data *dd;
++
++ if (dev && dev->bd_disk) {
++ dd = (struct driver_data *) dev->bd_disk->private_data;
++
++ if (dd) {
++ if (test_bit(MTIP_DDF_REMOVAL_BIT,
++ &dd->dd_flag)) {
++ return -ENODEV;
++ }
++ return 0;
++ }
++ }
++ return -ENODEV;
++}
++
++void mtip_block_release(struct gendisk *disk, fmode_t mode)
++{
++}
++
+ /*
+ * Block device operation function.
+ *
+@@ -3691,6 +3670,8 @@ static int mtip_block_getgeo(struct block_device *dev,
+ * layer.
+ */
+ static const struct block_device_operations mtip_block_ops = {
++ .open = mtip_block_open,
++ .release = mtip_block_release,
+ .ioctl = mtip_block_ioctl,
+ #ifdef CONFIG_COMPAT
+ .compat_ioctl = mtip_block_compat_ioctl,
+@@ -3729,10 +3710,9 @@ static int mtip_submit_request(struct blk_mq_hw_ctx *hctx, struct request *rq)
+ rq_data_dir(rq))) {
+ return -ENODATA;
+ }
+- if (unlikely(test_bit(MTIP_DDF_SEC_LOCK_BIT, &dd->dd_flag)))
++ if (unlikely(test_bit(MTIP_DDF_SEC_LOCK_BIT, &dd->dd_flag) ||
++ test_bit(MTIP_DDF_REBUILD_FAILED_BIT, &dd->dd_flag)))
+ return -ENODATA;
+- if (test_bit(MTIP_DDF_REBUILD_FAILED_BIT, &dd->dd_flag))
+- return -ENXIO;
+ }
+
+ if (rq->cmd_flags & REQ_DISCARD) {
+@@ -4065,52 +4045,51 @@ static int mtip_block_remove(struct driver_data *dd)
+ {
+ struct kobject *kobj;
+
+- if (!dd->sr) {
+- mtip_hw_debugfs_exit(dd);
++ mtip_hw_debugfs_exit(dd);
+
+- if (dd->mtip_svc_handler) {
+- set_bit(MTIP_PF_SVC_THD_STOP_BIT, &dd->port->flags);
+- wake_up_interruptible(&dd->port->svc_wait);
+- kthread_stop(dd->mtip_svc_handler);
+- }
++ if (dd->mtip_svc_handler) {
++ set_bit(MTIP_PF_SVC_THD_STOP_BIT, &dd->port->flags);
++ wake_up_interruptible(&dd->port->svc_wait);
++ kthread_stop(dd->mtip_svc_handler);
++ }
+
+- /* Clean up the sysfs attributes, if created */
+- if (test_bit(MTIP_DDF_INIT_DONE_BIT, &dd->dd_flag)) {
+- kobj = kobject_get(&disk_to_dev(dd->disk)->kobj);
+- if (kobj) {
+- mtip_hw_sysfs_exit(dd, kobj);
+- kobject_put(kobj);
+- }
++ /* Clean up the sysfs attributes, if created */
++ if (test_bit(MTIP_DDF_INIT_DONE_BIT, &dd->dd_flag)) {
++ kobj = kobject_get(&disk_to_dev(dd->disk)->kobj);
++ if (kobj) {
++ mtip_hw_sysfs_exit(dd, kobj);
++ kobject_put(kobj);
+ }
++ }
+
++ if (!dd->sr)
+ mtip_standby_drive(dd);
+-
+- /*
+- * Delete our gendisk structure. This also removes the device
+- * from /dev
+- */
+- if (dd->bdev) {
+- bdput(dd->bdev);
+- dd->bdev = NULL;
+- }
+- if (dd->disk) {
+- if (dd->disk->queue) {
+- del_gendisk(dd->disk);
+- blk_cleanup_queue(dd->queue);
+- blk_mq_free_tag_set(&dd->tags);
+- dd->queue = NULL;
+- } else
+- put_disk(dd->disk);
+- }
+- dd->disk = NULL;
+-
+- spin_lock(&rssd_index_lock);
+- ida_remove(&rssd_index_ida, dd->index);
+- spin_unlock(&rssd_index_lock);
+- } else {
++ else
+ dev_info(&dd->pdev->dev, "device %s surprise removal\n",
+ dd->disk->disk_name);
++
++ /*
++ * Delete our gendisk structure. This also removes the device
++ * from /dev
++ */
++ if (dd->bdev) {
++ bdput(dd->bdev);
++ dd->bdev = NULL;
+ }
++ if (dd->disk) {
++ del_gendisk(dd->disk);
++ if (dd->disk->queue) {
++ blk_cleanup_queue(dd->queue);
++ blk_mq_free_tag_set(&dd->tags);
++ dd->queue = NULL;
++ }
++ put_disk(dd->disk);
++ }
++ dd->disk = NULL;
++
++ spin_lock(&rssd_index_lock);
++ ida_remove(&rssd_index_ida, dd->index);
++ spin_unlock(&rssd_index_lock);
+
+ /* De-initialize the protocol layer. */
+ mtip_hw_exit(dd);
+@@ -4139,12 +4118,12 @@ static int mtip_block_shutdown(struct driver_data *dd)
+ dev_info(&dd->pdev->dev,
+ "Shutting down %s ...\n", dd->disk->disk_name);
+
++ del_gendisk(dd->disk);
+ if (dd->disk->queue) {
+- del_gendisk(dd->disk);
+ blk_cleanup_queue(dd->queue);
+ blk_mq_free_tag_set(&dd->tags);
+- } else
+- put_disk(dd->disk);
++ }
++ put_disk(dd->disk);
+ dd->disk = NULL;
+ dd->queue = NULL;
+ }
+@@ -4484,7 +4463,7 @@ static void mtip_pci_remove(struct pci_dev *pdev)
+ struct driver_data *dd = pci_get_drvdata(pdev);
+ unsigned long flags, to;
+
+- set_bit(MTIP_DDF_REMOVE_PENDING_BIT, &dd->dd_flag);
++ set_bit(MTIP_DDF_REMOVAL_BIT, &dd->dd_flag);
+
+ spin_lock_irqsave(&dev_lock, flags);
+ list_del_init(&dd->online_list);
+@@ -4501,11 +4480,18 @@ static void mtip_pci_remove(struct pci_dev *pdev)
+ } while (atomic_read(&dd->irq_workers_active) != 0 &&
+ time_before(jiffies, to));
+
++ fsync_bdev(dd->bdev);
++
+ if (atomic_read(&dd->irq_workers_active) != 0) {
+ dev_warn(&dd->pdev->dev,
+ "Completion workers still active!\n");
+ }
+
++ if (dd->sr)
++ blk_mq_stop_hw_queues(dd->queue);
++
++ set_bit(MTIP_DDF_REMOVE_PENDING_BIT, &dd->dd_flag);
++
+ /* Clean up the block layer. */
+ mtip_block_remove(dd);
+
+@@ -4523,10 +4509,8 @@ static void mtip_pci_remove(struct pci_dev *pdev)
+ list_del_init(&dd->remove_list);
+ spin_unlock_irqrestore(&dev_lock, flags);
+
+- if (!dd->sr)
+- kfree(dd);
+- else
+- set_bit(MTIP_DDF_REMOVE_DONE_BIT, &dd->dd_flag);
++ kfree(dd);
++ set_bit(MTIP_DDF_REMOVE_DONE_BIT, &dd->dd_flag);
+
+ pcim_iounmap_regions(pdev, 1 << MTIP_ABAR);
+ pci_set_drvdata(pdev, NULL);
+diff --git a/drivers/block/mtip32xx/mtip32xx.h b/drivers/block/mtip32xx/mtip32xx.h
+index ba1b31ee22ec..76695265dffb 100644
+--- a/drivers/block/mtip32xx/mtip32xx.h
++++ b/drivers/block/mtip32xx/mtip32xx.h
+@@ -155,6 +155,7 @@ enum {
+ MTIP_DDF_RESUME_BIT = 6,
+ MTIP_DDF_INIT_DONE_BIT = 7,
+ MTIP_DDF_REBUILD_FAILED_BIT = 8,
++ MTIP_DDF_REMOVAL_BIT = 9,
+
+ MTIP_DDF_STOP_IO = ((1 << MTIP_DDF_REMOVE_PENDING_BIT) |
+ (1 << MTIP_DDF_SEC_LOCK_BIT) |
+diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c
+index e527a3e13939..cbea17da6fe6 100644
+--- a/drivers/bluetooth/ath3k.c
++++ b/drivers/bluetooth/ath3k.c
+@@ -82,6 +82,7 @@ static const struct usb_device_id ath3k_table[] = {
+ { USB_DEVICE(0x0489, 0xe05f) },
+ { USB_DEVICE(0x0489, 0xe076) },
+ { USB_DEVICE(0x0489, 0xe078) },
++ { USB_DEVICE(0x0489, 0xe095) },
+ { USB_DEVICE(0x04c5, 0x1330) },
+ { USB_DEVICE(0x04CA, 0x3004) },
+ { USB_DEVICE(0x04CA, 0x3005) },
+@@ -92,6 +93,7 @@ static const struct usb_device_id ath3k_table[] = {
+ { USB_DEVICE(0x04CA, 0x300d) },
+ { USB_DEVICE(0x04CA, 0x300f) },
+ { USB_DEVICE(0x04CA, 0x3010) },
++ { USB_DEVICE(0x04CA, 0x3014) },
+ { USB_DEVICE(0x0930, 0x0219) },
+ { USB_DEVICE(0x0930, 0x0220) },
+ { USB_DEVICE(0x0930, 0x0227) },
+@@ -111,10 +113,12 @@ static const struct usb_device_id ath3k_table[] = {
+ { USB_DEVICE(0x13d3, 0x3362) },
+ { USB_DEVICE(0x13d3, 0x3375) },
+ { USB_DEVICE(0x13d3, 0x3393) },
++ { USB_DEVICE(0x13d3, 0x3395) },
+ { USB_DEVICE(0x13d3, 0x3402) },
+ { USB_DEVICE(0x13d3, 0x3408) },
+ { USB_DEVICE(0x13d3, 0x3423) },
+ { USB_DEVICE(0x13d3, 0x3432) },
++ { USB_DEVICE(0x13d3, 0x3472) },
+ { USB_DEVICE(0x13d3, 0x3474) },
+
+ /* Atheros AR5BBU12 with sflash firmware */
+@@ -142,6 +146,7 @@ static const struct usb_device_id ath3k_blist_tbl[] = {
+ { USB_DEVICE(0x0489, 0xe05f), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x0489, 0xe076), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x0489, 0xe078), .driver_info = BTUSB_ATH3012 },
++ { USB_DEVICE(0x0489, 0xe095), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x04c5, 0x1330), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x04ca, 0x3004), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 },
+@@ -152,6 +157,7 @@ static const struct usb_device_id ath3k_blist_tbl[] = {
+ { USB_DEVICE(0x04ca, 0x300d), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x04ca, 0x300f), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x04ca, 0x3010), .driver_info = BTUSB_ATH3012 },
++ { USB_DEVICE(0x04ca, 0x3014), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x0930, 0x0220), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x0930, 0x0227), .driver_info = BTUSB_ATH3012 },
+@@ -171,10 +177,12 @@ static const struct usb_device_id ath3k_blist_tbl[] = {
+ { USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x13d3, 0x3393), .driver_info = BTUSB_ATH3012 },
++ { USB_DEVICE(0x13d3, 0x3395), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x13d3, 0x3402), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x13d3, 0x3408), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x13d3, 0x3423), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x13d3, 0x3432), .driver_info = BTUSB_ATH3012 },
++ { USB_DEVICE(0x13d3, 0x3472), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x13d3, 0x3474), .driver_info = BTUSB_ATH3012 },
+
+ /* Atheros AR5BBU22 with sflash firmware */
+diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
+index b1e4866dc8d5..b3334daab009 100644
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -174,6 +174,7 @@ static const struct usb_device_id blacklist_table[] = {
+ { USB_DEVICE(0x0489, 0xe05f), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x0489, 0xe076), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x0489, 0xe078), .driver_info = BTUSB_ATH3012 },
++ { USB_DEVICE(0x0489, 0xe095), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x04c5, 0x1330), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x04ca, 0x3004), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 },
+@@ -184,6 +185,7 @@ static const struct usb_device_id blacklist_table[] = {
+ { USB_DEVICE(0x04ca, 0x300d), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x04ca, 0x300f), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x04ca, 0x3010), .driver_info = BTUSB_ATH3012 },
++ { USB_DEVICE(0x04ca, 0x3014), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x0930, 0x0220), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x0930, 0x0227), .driver_info = BTUSB_ATH3012 },
+@@ -203,10 +205,12 @@ static const struct usb_device_id blacklist_table[] = {
+ { USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x13d3, 0x3393), .driver_info = BTUSB_ATH3012 },
++ { USB_DEVICE(0x13d3, 0x3395), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x13d3, 0x3402), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x13d3, 0x3408), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x13d3, 0x3423), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x13d3, 0x3432), .driver_info = BTUSB_ATH3012 },
++ { USB_DEVICE(0x13d3, 0x3472), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x13d3, 0x3474), .driver_info = BTUSB_ATH3012 },
+
+ /* Atheros AR5BBU12 with sflash firmware */
+diff --git a/drivers/bus/imx-weim.c b/drivers/bus/imx-weim.c
+index 75c9681f8021..0ff86b980d05 100644
+--- a/drivers/bus/imx-weim.c
++++ b/drivers/bus/imx-weim.c
+@@ -150,7 +150,7 @@ static int __init weim_parse_dt(struct platform_device *pdev,
+ return ret;
+ }
+
+- for_each_child_of_node(pdev->dev.of_node, child) {
++ for_each_available_child_of_node(pdev->dev.of_node, child) {
+ if (!child->name)
+ continue;
+
+diff --git a/drivers/clk/rockchip/clk-rk3188.c b/drivers/clk/rockchip/clk-rk3188.c
+index 8088b384ce6e..63c80a319a0e 100644
+--- a/drivers/clk/rockchip/clk-rk3188.c
++++ b/drivers/clk/rockchip/clk-rk3188.c
+@@ -713,6 +713,8 @@ static const char *rk3188_critical_clocks[] __initconst = {
+ "aclk_cpu",
+ "aclk_peri",
+ "hclk_peri",
++ "pclk_cpu",
++ "pclk_peri",
+ };
+
+ static void __init rk3188_common_clk_init(struct device_node *np)
+diff --git a/drivers/crypto/ccp/ccp-crypto-aes-cmac.c b/drivers/crypto/ccp/ccp-crypto-aes-cmac.c
+index 8e162ad82085..5c93afb1841a 100644
+--- a/drivers/crypto/ccp/ccp-crypto-aes-cmac.c
++++ b/drivers/crypto/ccp/ccp-crypto-aes-cmac.c
+@@ -201,6 +201,39 @@ static int ccp_aes_cmac_digest(struct ahash_request *req)
+ return ccp_aes_cmac_finup(req);
+ }
+
++static int ccp_aes_cmac_export(struct ahash_request *req, void *out)
++{
++ struct ccp_aes_cmac_req_ctx *rctx = ahash_request_ctx(req);
++ struct ccp_aes_cmac_exp_ctx state;
++
++ state.null_msg = rctx->null_msg;
++ memcpy(state.iv, rctx->iv, sizeof(state.iv));
++ state.buf_count = rctx->buf_count;
++ memcpy(state.buf, rctx->buf, sizeof(state.buf));
++
++ /* 'out' may not be aligned so memcpy from local variable */
++ memcpy(out, &state, sizeof(state));
++
++ return 0;
++}
++
++static int ccp_aes_cmac_import(struct ahash_request *req, const void *in)
++{
++ struct ccp_aes_cmac_req_ctx *rctx = ahash_request_ctx(req);
++ struct ccp_aes_cmac_exp_ctx state;
++
++ /* 'in' may not be aligned so memcpy to local variable */
++ memcpy(&state, in, sizeof(state));
++
++ memset(rctx, 0, sizeof(*rctx));
++ rctx->null_msg = state.null_msg;
++ memcpy(rctx->iv, state.iv, sizeof(rctx->iv));
++ rctx->buf_count = state.buf_count;
++ memcpy(rctx->buf, state.buf, sizeof(rctx->buf));
++
++ return 0;
++}
++
+ static int ccp_aes_cmac_setkey(struct crypto_ahash *tfm, const u8 *key,
+ unsigned int key_len)
+ {
+@@ -332,10 +365,13 @@ int ccp_register_aes_cmac_algs(struct list_head *head)
+ alg->final = ccp_aes_cmac_final;
+ alg->finup = ccp_aes_cmac_finup;
+ alg->digest = ccp_aes_cmac_digest;
++ alg->export = ccp_aes_cmac_export;
++ alg->import = ccp_aes_cmac_import;
+ alg->setkey = ccp_aes_cmac_setkey;
+
+ halg = &alg->halg;
+ halg->digestsize = AES_BLOCK_SIZE;
++ halg->statesize = sizeof(struct ccp_aes_cmac_exp_ctx);
+
+ base = &halg->base;
+ snprintf(base->cra_name, CRYPTO_MAX_ALG_NAME, "cmac(aes)");
+diff --git a/drivers/crypto/ccp/ccp-crypto-sha.c b/drivers/crypto/ccp/ccp-crypto-sha.c
+index 96531571f7cf..b368e985a086 100644
+--- a/drivers/crypto/ccp/ccp-crypto-sha.c
++++ b/drivers/crypto/ccp/ccp-crypto-sha.c
+@@ -193,6 +193,43 @@ static int ccp_sha_digest(struct ahash_request *req)
+ return ccp_sha_finup(req);
+ }
+
++static int ccp_sha_export(struct ahash_request *req, void *out)
++{
++ struct ccp_sha_req_ctx *rctx = ahash_request_ctx(req);
++ struct ccp_sha_exp_ctx state;
++
++ state.type = rctx->type;
++ state.msg_bits = rctx->msg_bits;
++ state.first = rctx->first;
++ memcpy(state.ctx, rctx->ctx, sizeof(state.ctx));
++ state.buf_count = rctx->buf_count;
++ memcpy(state.buf, rctx->buf, sizeof(state.buf));
++
++ /* 'out' may not be aligned so memcpy from local variable */
++ memcpy(out, &state, sizeof(state));
++
++ return 0;
++}
++
++static int ccp_sha_import(struct ahash_request *req, const void *in)
++{
++ struct ccp_sha_req_ctx *rctx = ahash_request_ctx(req);
++ struct ccp_sha_exp_ctx state;
++
++ /* 'in' may not be aligned so memcpy to local variable */
++ memcpy(&state, in, sizeof(state));
++
++ memset(rctx, 0, sizeof(*rctx));
++ rctx->type = state.type;
++ rctx->msg_bits = state.msg_bits;
++ rctx->first = state.first;
++ memcpy(rctx->ctx, state.ctx, sizeof(rctx->ctx));
++ rctx->buf_count = state.buf_count;
++ memcpy(rctx->buf, state.buf, sizeof(rctx->buf));
++
++ return 0;
++}
++
+ static int ccp_sha_setkey(struct crypto_ahash *tfm, const u8 *key,
+ unsigned int key_len)
+ {
+@@ -388,9 +425,12 @@ static int ccp_register_sha_alg(struct list_head *head,
+ alg->final = ccp_sha_final;
+ alg->finup = ccp_sha_finup;
+ alg->digest = ccp_sha_digest;
++ alg->export = ccp_sha_export;
++ alg->import = ccp_sha_import;
+
+ halg = &alg->halg;
+ halg->digestsize = def->digest_size;
++ halg->statesize = sizeof(struct ccp_sha_exp_ctx);
+
+ base = &halg->base;
+ snprintf(base->cra_name, CRYPTO_MAX_ALG_NAME, "%s", def->name);
+diff --git a/drivers/crypto/ccp/ccp-crypto.h b/drivers/crypto/ccp/ccp-crypto.h
+index 9aa4ae184f7f..7a0bb029ac8e 100644
+--- a/drivers/crypto/ccp/ccp-crypto.h
++++ b/drivers/crypto/ccp/ccp-crypto.h
+@@ -132,6 +132,15 @@ struct ccp_aes_cmac_req_ctx {
+ struct ccp_cmd cmd;
+ };
+
++struct ccp_aes_cmac_exp_ctx {
++ unsigned int null_msg;
++
++ u8 iv[AES_BLOCK_SIZE];
++
++ unsigned int buf_count;
++ u8 buf[AES_BLOCK_SIZE];
++};
++
+ /***** SHA related defines *****/
+ #define MAX_SHA_CONTEXT_SIZE SHA256_DIGEST_SIZE
+ #define MAX_SHA_BLOCK_SIZE SHA256_BLOCK_SIZE
+@@ -174,6 +183,19 @@ struct ccp_sha_req_ctx {
+ struct ccp_cmd cmd;
+ };
+
++struct ccp_sha_exp_ctx {
++ enum ccp_sha_type type;
++
++ u64 msg_bits;
++
++ unsigned int first;
++
++ u8 ctx[MAX_SHA_CONTEXT_SIZE];
++
++ unsigned int buf_count;
++ u8 buf[MAX_SHA_BLOCK_SIZE];
++};
++
+ /***** Common Context Structure *****/
+ struct ccp_ctx {
+ int (*complete)(struct crypto_async_request *req, int ret);
+diff --git a/drivers/edac/amd64_edac.c b/drivers/edac/amd64_edac.c
+index c7236ba92b8e..88acf836fe05 100644
+--- a/drivers/edac/amd64_edac.c
++++ b/drivers/edac/amd64_edac.c
+@@ -1316,7 +1316,7 @@ static u64 f1x_get_norm_dct_addr(struct amd64_pvt *pvt, u8 range,
+ u64 chan_off;
+ u64 dram_base = get_dram_base(pvt, range);
+ u64 hole_off = f10_dhar_offset(pvt);
+- u64 dct_sel_base_off = (pvt->dct_sel_hi & 0xFFFFFC00) << 16;
++ u64 dct_sel_base_off = (u64)(pvt->dct_sel_hi & 0xFFFFFC00) << 16;
+
+ if (hi_rng) {
+ /*
+diff --git a/drivers/edac/sb_edac.c b/drivers/edac/sb_edac.c
+index 15697c630139..b97f5f0c5c0a 100644
+--- a/drivers/edac/sb_edac.c
++++ b/drivers/edac/sb_edac.c
+@@ -991,8 +991,8 @@ static void get_memory_layout(const struct mem_ctl_info *mci)
+ edac_dbg(0, "TAD#%d: up to %u.%03u GB (0x%016Lx), socket interleave %d, memory interleave %d, TGT: %d, %d, %d, %d, reg=0x%08x\n",
+ n_tads, gb, (mb*1000)/1024,
+ ((u64)tmp_mb) << 20L,
+- (u32)TAD_SOCK(reg),
+- (u32)TAD_CH(reg),
++ (u32)(1 << TAD_SOCK(reg)),
++ (u32)TAD_CH(reg) + 1,
+ (u32)TAD_TGT0(reg),
+ (u32)TAD_TGT1(reg),
+ (u32)TAD_TGT2(reg),
+@@ -1264,7 +1264,7 @@ static int get_memory_error_data(struct mem_ctl_info *mci,
+ }
+
+ ch_way = TAD_CH(reg) + 1;
+- sck_way = TAD_SOCK(reg) + 1;
++ sck_way = 1 << TAD_SOCK(reg);
+
+ if (ch_way == 3)
+ idx = addr >> 6;
+@@ -1321,7 +1321,7 @@ static int get_memory_error_data(struct mem_ctl_info *mci,
+ n_tads,
+ addr,
+ limit,
+- (u32)TAD_SOCK(reg),
++ sck_way,
+ ch_way,
+ offset,
+ idx,
+@@ -1336,18 +1336,12 @@ static int get_memory_error_data(struct mem_ctl_info *mci,
+ offset, addr);
+ return -EINVAL;
+ }
+- addr -= offset;
+- /* Store the low bits [0:6] of the addr */
+- ch_addr = addr & 0x7f;
+- /* Remove socket wayness and remove 6 bits */
+- addr >>= 6;
+- addr = div_u64(addr, sck_xch);
+-#if 0
+- /* Divide by channel way */
+- addr = addr / ch_way;
+-#endif
+- /* Recover the last 6 bits */
+- ch_addr |= addr << 6;
++
++ ch_addr = addr - offset;
++ ch_addr >>= (6 + shiftup);
++ ch_addr /= ch_way * sck_way;
++ ch_addr <<= (6 + shiftup);
++ ch_addr |= addr & ((1 << (6 + shiftup)) - 1);
+
+ /*
+ * Step 3) Decode rank
+diff --git a/drivers/firmware/efi/efivars.c b/drivers/firmware/efi/efivars.c
+index f256ecd8a176..9790d7707119 100644
+--- a/drivers/firmware/efi/efivars.c
++++ b/drivers/firmware/efi/efivars.c
+@@ -221,7 +221,7 @@ sanity_check(struct efi_variable *var, efi_char16_t *name, efi_guid_t vendor,
+ }
+
+ if ((attributes & ~EFI_VARIABLE_MASK) != 0 ||
+- efivar_validate(name, data, size) == false) {
++ efivar_validate(vendor, name, data, size) == false) {
+ printk(KERN_ERR "efivars: Malformed variable content\n");
+ return -EINVAL;
+ }
+@@ -447,7 +447,8 @@ static ssize_t efivar_create(struct file *filp, struct kobject *kobj,
+ }
+
+ if ((attributes & ~EFI_VARIABLE_MASK) != 0 ||
+- efivar_validate(name, data, size) == false) {
++ efivar_validate(new_var->VendorGuid, name, data,
++ size) == false) {
+ printk(KERN_ERR "efivars: Malformed variable content\n");
+ return -EINVAL;
+ }
+@@ -535,50 +536,44 @@ static ssize_t efivar_delete(struct file *filp, struct kobject *kobj,
+ * efivar_create_sysfs_entry - create a new entry in sysfs
+ * @new_var: efivar entry to create
+ *
+- * Returns 1 on failure, 0 on success
++ * Returns 0 on success, negative error code on failure
+ */
+ static int
+ efivar_create_sysfs_entry(struct efivar_entry *new_var)
+ {
+- int i, short_name_size;
++ int short_name_size;
+ char *short_name;
+- unsigned long variable_name_size;
+- efi_char16_t *variable_name;
+-
+- variable_name = new_var->var.VariableName;
+- variable_name_size = ucs2_strlen(variable_name) * sizeof(efi_char16_t);
++ unsigned long utf8_name_size;
++ efi_char16_t *variable_name = new_var->var.VariableName;
++ int ret;
+
+ /*
+- * Length of the variable bytes in ASCII, plus the '-' separator,
++ * Length of the variable bytes in UTF8, plus the '-' separator,
+ * plus the GUID, plus trailing NUL
+ */
+- short_name_size = variable_name_size / sizeof(efi_char16_t)
+- + 1 + EFI_VARIABLE_GUID_LEN + 1;
+-
+- short_name = kzalloc(short_name_size, GFP_KERNEL);
++ utf8_name_size = ucs2_utf8size(variable_name);
++ short_name_size = utf8_name_size + 1 + EFI_VARIABLE_GUID_LEN + 1;
+
++ short_name = kmalloc(short_name_size, GFP_KERNEL);
+ if (!short_name)
+- return 1;
++ return -ENOMEM;
++
++ ucs2_as_utf8(short_name, variable_name, short_name_size);
+
+- /* Convert Unicode to normal chars (assume top bits are 0),
+- ala UTF-8 */
+- for (i=0; i < (int)(variable_name_size / sizeof(efi_char16_t)); i++) {
+- short_name[i] = variable_name[i] & 0xFF;
+- }
+ /* This is ugly, but necessary to separate one vendor's
+ private variables from another's. */
+
+- *(short_name + strlen(short_name)) = '-';
++ short_name[utf8_name_size] = '-';
+ efi_guid_unparse(&new_var->var.VendorGuid,
+- short_name + strlen(short_name));
++ short_name + utf8_name_size + 1);
+
+ new_var->kobj.kset = efivars_kset;
+
+- i = kobject_init_and_add(&new_var->kobj, &efivar_ktype,
++ ret = kobject_init_and_add(&new_var->kobj, &efivar_ktype,
+ NULL, "%s", short_name);
+ kfree(short_name);
+- if (i)
+- return 1;
++ if (ret)
++ return ret;
+
+ kobject_uevent(&new_var->kobj, KOBJ_ADD);
+ efivar_entry_add(new_var, &efivar_sysfs_list);
+diff --git a/drivers/firmware/efi/vars.c b/drivers/firmware/efi/vars.c
+index 70a0fb10517f..7f2ea21c730d 100644
+--- a/drivers/firmware/efi/vars.c
++++ b/drivers/firmware/efi/vars.c
+@@ -165,67 +165,133 @@ validate_ascii_string(efi_char16_t *var_name, int match, u8 *buffer,
+ }
+
+ struct variable_validate {
++ efi_guid_t vendor;
+ char *name;
+ bool (*validate)(efi_char16_t *var_name, int match, u8 *data,
+ unsigned long len);
+ };
+
++/*
++ * This is the list of variables we need to validate, as well as the
++ * whitelist for what we think is safe not to default to immutable.
++ *
++ * If it has a validate() method that's not NULL, it'll go into the
++ * validation routine. If not, it is assumed valid, but still used for
++ * whitelisting.
++ *
++ * Note that it's sorted by {vendor,name}, but globbed names must come after
++ * any other name with the same prefix.
++ */
+ static const struct variable_validate variable_validate[] = {
+- { "BootNext", validate_uint16 },
+- { "BootOrder", validate_boot_order },
+- { "DriverOrder", validate_boot_order },
+- { "Boot*", validate_load_option },
+- { "Driver*", validate_load_option },
+- { "ConIn", validate_device_path },
+- { "ConInDev", validate_device_path },
+- { "ConOut", validate_device_path },
+- { "ConOutDev", validate_device_path },
+- { "ErrOut", validate_device_path },
+- { "ErrOutDev", validate_device_path },
+- { "Timeout", validate_uint16 },
+- { "Lang", validate_ascii_string },
+- { "PlatformLang", validate_ascii_string },
+- { "", NULL },
++ { EFI_GLOBAL_VARIABLE_GUID, "BootNext", validate_uint16 },
++ { EFI_GLOBAL_VARIABLE_GUID, "BootOrder", validate_boot_order },
++ { EFI_GLOBAL_VARIABLE_GUID, "Boot*", validate_load_option },
++ { EFI_GLOBAL_VARIABLE_GUID, "DriverOrder", validate_boot_order },
++ { EFI_GLOBAL_VARIABLE_GUID, "Driver*", validate_load_option },
++ { EFI_GLOBAL_VARIABLE_GUID, "ConIn", validate_device_path },
++ { EFI_GLOBAL_VARIABLE_GUID, "ConInDev", validate_device_path },
++ { EFI_GLOBAL_VARIABLE_GUID, "ConOut", validate_device_path },
++ { EFI_GLOBAL_VARIABLE_GUID, "ConOutDev", validate_device_path },
++ { EFI_GLOBAL_VARIABLE_GUID, "ErrOut", validate_device_path },
++ { EFI_GLOBAL_VARIABLE_GUID, "ErrOutDev", validate_device_path },
++ { EFI_GLOBAL_VARIABLE_GUID, "Lang", validate_ascii_string },
++ { EFI_GLOBAL_VARIABLE_GUID, "OsIndications", NULL },
++ { EFI_GLOBAL_VARIABLE_GUID, "PlatformLang", validate_ascii_string },
++ { EFI_GLOBAL_VARIABLE_GUID, "Timeout", validate_uint16 },
++ { LINUX_EFI_CRASH_GUID, "*", NULL },
++ { NULL_GUID, "", NULL },
+ };
+
++static bool
++variable_matches(const char *var_name, size_t len, const char *match_name,
++ int *match)
++{
++ for (*match = 0; ; (*match)++) {
++ char c = match_name[*match];
++ char u = var_name[*match];
++
++ /* Wildcard in the matching name means we've matched */
++ if (c == '*')
++ return true;
++
++ /* Case sensitive match */
++ if (!c && *match == len)
++ return true;
++
++ if (c != u)
++ return false;
++
++ if (!c)
++ return true;
++ }
++ return true;
++}
++
+ bool
+-efivar_validate(efi_char16_t *var_name, u8 *data, unsigned long len)
++efivar_validate(efi_guid_t vendor, efi_char16_t *var_name, u8 *data,
++ unsigned long data_size)
+ {
+ int i;
+- u16 *unicode_name = var_name;
++ unsigned long utf8_size;
++ u8 *utf8_name;
+
+- for (i = 0; variable_validate[i].validate != NULL; i++) {
+- const char *name = variable_validate[i].name;
+- int match;
++ utf8_size = ucs2_utf8size(var_name);
++ utf8_name = kmalloc(utf8_size + 1, GFP_KERNEL);
++ if (!utf8_name)
++ return false;
+
+- for (match = 0; ; match++) {
+- char c = name[match];
+- u16 u = unicode_name[match];
++ ucs2_as_utf8(utf8_name, var_name, utf8_size);
++ utf8_name[utf8_size] = '\0';
+
+- /* All special variables are plain ascii */
+- if (u > 127)
+- return true;
++ for (i = 0; variable_validate[i].name[0] != '\0'; i++) {
++ const char *name = variable_validate[i].name;
++ int match = 0;
+
+- /* Wildcard in the matching name means we've matched */
+- if (c == '*')
+- return variable_validate[i].validate(var_name,
+- match, data, len);
++ if (efi_guidcmp(vendor, variable_validate[i].vendor))
++ continue;
+
+- /* Case sensitive match */
+- if (c != u)
++ if (variable_matches(utf8_name, utf8_size+1, name, &match)) {
++ if (variable_validate[i].validate == NULL)
+ break;
+-
+- /* Reached the end of the string while matching */
+- if (!c)
+- return variable_validate[i].validate(var_name,
+- match, data, len);
++ kfree(utf8_name);
++ return variable_validate[i].validate(var_name, match,
++ data, data_size);
+ }
+ }
+-
++ kfree(utf8_name);
+ return true;
+ }
+ EXPORT_SYMBOL_GPL(efivar_validate);
+
++bool
++efivar_variable_is_removable(efi_guid_t vendor, const char *var_name,
++ size_t len)
++{
++ int i;
++ bool found = false;
++ int match = 0;
++
++ /*
++ * Check if our variable is in the validated variables list
++ */
++ for (i = 0; variable_validate[i].name[0] != '\0'; i++) {
++ if (efi_guidcmp(variable_validate[i].vendor, vendor))
++ continue;
++
++ if (variable_matches(var_name, len,
++ variable_validate[i].name, &match)) {
++ found = true;
++ break;
++ }
++ }
++
++ /*
++ * If it's in our list, it is removable.
++ */
++ return found;
++}
++EXPORT_SYMBOL_GPL(efivar_variable_is_removable);
++
+ static efi_status_t
+ check_var_size(u32 attributes, unsigned long size)
+ {
+@@ -852,7 +918,7 @@ int efivar_entry_set_get_size(struct efivar_entry *entry, u32 attributes,
+
+ *set = false;
+
+- if (efivar_validate(name, data, *size) == false)
++ if (efivar_validate(*vendor, name, data, *size) == false)
+ return -EINVAL;
+
+ /*
+diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c
+index 72deb52fd1d0..563d3d2c54a9 100644
+--- a/drivers/gpu/drm/drm_dp_mst_topology.c
++++ b/drivers/gpu/drm/drm_dp_mst_topology.c
+@@ -996,18 +996,27 @@ static bool drm_dp_port_setup_pdt(struct drm_dp_mst_port *port)
+ return send_link;
+ }
+
+-static void drm_dp_check_port_guid(struct drm_dp_mst_branch *mstb,
+- struct drm_dp_mst_port *port)
++static void drm_dp_check_mstb_guid(struct drm_dp_mst_branch *mstb, u8 *guid)
+ {
+ int ret;
+- if (port->dpcd_rev >= 0x12) {
+- port->guid_valid = drm_dp_validate_guid(mstb->mgr, port->guid);
+- if (!port->guid_valid) {
+- ret = drm_dp_send_dpcd_write(mstb->mgr,
+- port,
+- DP_GUID,
+- 16, port->guid);
+- port->guid_valid = true;
++
++ memcpy(mstb->guid, guid, 16);
++
++ if (!drm_dp_validate_guid(mstb->mgr, mstb->guid)) {
++ if (mstb->port_parent) {
++ ret = drm_dp_send_dpcd_write(
++ mstb->mgr,
++ mstb->port_parent,
++ DP_GUID,
++ 16,
++ mstb->guid);
++ } else {
++
++ ret = drm_dp_dpcd_write(
++ mstb->mgr->aux,
++ DP_GUID,
++ mstb->guid,
++ 16);
+ }
+ }
+ }
+@@ -1064,7 +1073,6 @@ static void drm_dp_add_port(struct drm_dp_mst_branch *mstb,
+ port->dpcd_rev = port_msg->dpcd_revision;
+ port->num_sdp_streams = port_msg->num_sdp_streams;
+ port->num_sdp_stream_sinks = port_msg->num_sdp_stream_sinks;
+- memcpy(port->guid, port_msg->peer_guid, 16);
+
+ /* manage mstb port lists with mgr lock - take a reference
+ for this list */
+@@ -1077,11 +1085,9 @@ static void drm_dp_add_port(struct drm_dp_mst_branch *mstb,
+
+ if (old_ddps != port->ddps) {
+ if (port->ddps) {
+- drm_dp_check_port_guid(mstb, port);
+ if (!port->input)
+ drm_dp_send_enum_path_resources(mstb->mgr, mstb, port);
+ } else {
+- port->guid_valid = false;
+ port->available_pbn = 0;
+ }
+ }
+@@ -1126,10 +1132,8 @@ static void drm_dp_update_port(struct drm_dp_mst_branch *mstb,
+
+ if (old_ddps != port->ddps) {
+ if (port->ddps) {
+- drm_dp_check_port_guid(mstb, port);
+ dowork = true;
+ } else {
+- port->guid_valid = false;
+ port->available_pbn = 0;
+ }
+ }
+@@ -1185,13 +1189,14 @@ static struct drm_dp_mst_branch *get_mst_branch_device_by_guid_helper(
+ struct drm_dp_mst_branch *found_mstb;
+ struct drm_dp_mst_port *port;
+
++ if (memcmp(mstb->guid, guid, 16) == 0)
++ return mstb;
++
++
+ list_for_each_entry(port, &mstb->ports, next) {
+ if (!port->mstb)
+ continue;
+
+- if (port->guid_valid && memcmp(port->guid, guid, 16) == 0)
+- return port->mstb;
+-
+ found_mstb = get_mst_branch_device_by_guid_helper(port->mstb, guid);
+
+ if (found_mstb)
+@@ -1210,10 +1215,7 @@ static struct drm_dp_mst_branch *drm_dp_get_mst_branch_device_by_guid(
+ /* find the port by iterating down */
+ mutex_lock(&mgr->lock);
+
+- if (mgr->guid_valid && memcmp(mgr->guid, guid, 16) == 0)
+- mstb = mgr->mst_primary;
+- else
+- mstb = get_mst_branch_device_by_guid_helper(mgr->mst_primary, guid);
++ mstb = get_mst_branch_device_by_guid_helper(mgr->mst_primary, guid);
+
+ if (mstb)
+ kref_get(&mstb->kref);
+@@ -1525,6 +1527,9 @@ static int drm_dp_send_link_address(struct drm_dp_mst_topology_mgr *mgr,
+ txmsg->reply.u.link_addr.ports[i].num_sdp_streams,
+ txmsg->reply.u.link_addr.ports[i].num_sdp_stream_sinks);
+ }
++
++ drm_dp_check_mstb_guid(mstb, txmsg->reply.u.link_addr.guid);
++
+ for (i = 0; i < txmsg->reply.u.link_addr.nports; i++) {
+ drm_dp_add_port(mstb, mgr->dev, &txmsg->reply.u.link_addr.ports[i]);
+ }
+@@ -1928,31 +1933,17 @@ int drm_dp_mst_topology_mgr_set_mst(struct drm_dp_mst_topology_mgr *mgr, bool ms
+ mgr->mst_primary = mstb;
+ kref_get(&mgr->mst_primary->kref);
+
+- {
+- struct drm_dp_payload reset_pay;
+- reset_pay.start_slot = 0;
+- reset_pay.num_slots = 0x3f;
+- drm_dp_dpcd_write_payload(mgr, 0, &reset_pay);
+- }
+-
+ ret = drm_dp_dpcd_writeb(mgr->aux, DP_MSTM_CTRL,
+- DP_MST_EN | DP_UP_REQ_EN | DP_UPSTREAM_IS_SRC);
++ DP_MST_EN | DP_UP_REQ_EN | DP_UPSTREAM_IS_SRC);
+ if (ret < 0) {
+ goto out_unlock;
+ }
+
+-
+- /* sort out guid */
+- ret = drm_dp_dpcd_read(mgr->aux, DP_GUID, mgr->guid, 16);
+- if (ret != 16) {
+- DRM_DEBUG_KMS("failed to read DP GUID %d\n", ret);
+- goto out_unlock;
+- }
+-
+- mgr->guid_valid = drm_dp_validate_guid(mgr, mgr->guid);
+- if (!mgr->guid_valid) {
+- ret = drm_dp_dpcd_write(mgr->aux, DP_GUID, mgr->guid, 16);
+- mgr->guid_valid = true;
++ {
++ struct drm_dp_payload reset_pay;
++ reset_pay.start_slot = 0;
++ reset_pay.num_slots = 0x3f;
++ drm_dp_dpcd_write_payload(mgr, 0, &reset_pay);
+ }
+
+ queue_work(system_long_wq, &mgr->work);
+@@ -2174,6 +2165,7 @@ static int drm_dp_mst_handle_up_req(struct drm_dp_mst_topology_mgr *mgr)
+ }
+
+ drm_dp_update_port(mstb, &msg.u.conn_stat);
++
+ DRM_DEBUG_KMS("Got CSN: pn: %d ldps:%d ddps: %d mcs: %d ip: %d pdt: %d\n", msg.u.conn_stat.port_number, msg.u.conn_stat.legacy_device_plug_status, msg.u.conn_stat.displayport_device_plug_status, msg.u.conn_stat.message_capability_status, msg.u.conn_stat.input_port, msg.u.conn_stat.peer_device_type);
+ (*mgr->cbs->hotplug)(mgr);
+
+diff --git a/drivers/gpu/drm/gma500/gem.c b/drivers/gpu/drm/gma500/gem.c
+index c707fa6fca85..e3bdc8b1c32c 100644
+--- a/drivers/gpu/drm/gma500/gem.c
++++ b/drivers/gpu/drm/gma500/gem.c
+@@ -130,7 +130,7 @@ int psb_gem_create(struct drm_file *file, struct drm_device *dev, u64 size,
+ return ret;
+ }
+ /* We have the initial and handle reference but need only one now */
+- drm_gem_object_unreference(&r->gem);
++ drm_gem_object_unreference_unlocked(&r->gem);
+ *handlep = handle;
+ return 0;
+ }
+diff --git a/drivers/gpu/drm/radeon/atombios_encoders.c b/drivers/gpu/drm/radeon/atombios_encoders.c
+index d8a5db204a81..01701105653d 100644
+--- a/drivers/gpu/drm/radeon/atombios_encoders.c
++++ b/drivers/gpu/drm/radeon/atombios_encoders.c
+@@ -872,8 +872,6 @@ atombios_dig_encoder_setup(struct drm_encoder *encoder, int action, int panel_mo
+ else
+ args.v1.ucLaneNum = 4;
+
+- if (ENCODER_MODE_IS_DP(args.v1.ucEncoderMode) && (dp_clock == 270000))
+- args.v1.ucConfig |= ATOM_ENCODER_CONFIG_DPLINKRATE_2_70GHZ;
+ switch (radeon_encoder->encoder_id) {
+ case ENCODER_OBJECT_ID_INTERNAL_UNIPHY:
+ args.v1.ucConfig = ATOM_ENCODER_CONFIG_V2_TRANSMITTER1;
+@@ -890,6 +888,10 @@ atombios_dig_encoder_setup(struct drm_encoder *encoder, int action, int panel_mo
+ args.v1.ucConfig |= ATOM_ENCODER_CONFIG_LINKB;
+ else
+ args.v1.ucConfig |= ATOM_ENCODER_CONFIG_LINKA;
++
++ if (ENCODER_MODE_IS_DP(args.v1.ucEncoderMode) && (dp_clock == 270000))
++ args.v1.ucConfig |= ATOM_ENCODER_CONFIG_DPLINKRATE_2_70GHZ;
++
+ break;
+ case 2:
+ case 3:
+diff --git a/drivers/gpu/drm/radeon/radeon_atpx_handler.c b/drivers/gpu/drm/radeon/radeon_atpx_handler.c
+index 8bc7d0bbd3c8..1523cf94bcdc 100644
+--- a/drivers/gpu/drm/radeon/radeon_atpx_handler.c
++++ b/drivers/gpu/drm/radeon/radeon_atpx_handler.c
+@@ -62,6 +62,10 @@ bool radeon_has_atpx(void) {
+ return radeon_atpx_priv.atpx_detected;
+ }
+
++bool radeon_has_atpx_dgpu_power_cntl(void) {
++ return radeon_atpx_priv.atpx.functions.power_cntl;
++}
++
+ /**
+ * radeon_atpx_call - call an ATPX method
+ *
+@@ -141,10 +145,6 @@ static void radeon_atpx_parse_functions(struct radeon_atpx_functions *f, u32 mas
+ */
+ static int radeon_atpx_validate(struct radeon_atpx *atpx)
+ {
+- /* make sure required functions are enabled */
+- /* dGPU power control is required */
+- atpx->functions.power_cntl = true;
+-
+ if (atpx->functions.px_params) {
+ union acpi_object *info;
+ struct atpx_px_params output;
+diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
+index e206795e3693..eb5f88aa76ab 100644
+--- a/drivers/gpu/drm/radeon/radeon_device.c
++++ b/drivers/gpu/drm/radeon/radeon_device.c
+@@ -103,6 +103,12 @@ static const char radeon_family_name[][16] = {
+ "LAST",
+ };
+
++#if defined(CONFIG_VGA_SWITCHEROO)
++bool radeon_has_atpx_dgpu_power_cntl(void);
++#else
++static inline bool radeon_has_atpx_dgpu_power_cntl(void) { return false; }
++#endif
++
+ #define RADEON_PX_QUIRK_DISABLE_PX (1 << 0)
+ #define RADEON_PX_QUIRK_LONG_WAKEUP (1 << 1)
+
+@@ -1395,7 +1401,7 @@ int radeon_device_init(struct radeon_device *rdev,
+ * ignore it */
+ vga_client_register(rdev->pdev, rdev, NULL, radeon_vga_set_decode);
+
+- if (rdev->flags & RADEON_IS_PX)
++ if ((rdev->flags & RADEON_IS_PX) && radeon_has_atpx_dgpu_power_cntl())
+ runtime = true;
+ vga_switcheroo_register_client(rdev->pdev, &radeon_switcheroo_ops, runtime);
+ if (runtime)
+@@ -1665,7 +1671,6 @@ int radeon_resume_kms(struct drm_device *dev, bool resume, bool fbcon)
+ }
+
+ drm_kms_helper_poll_enable(dev);
+- drm_helper_hpd_irq_event(dev);
+
+ /* set the power state here in case we are a PX system or headless */
+ if ((rdev->pm.pm_method == PM_METHOD_DPM) && rdev->pm.dpm_enabled)
+diff --git a/drivers/gpu/drm/radeon/radeon_fb.c b/drivers/gpu/drm/radeon/radeon_fb.c
+index 0ea1db83d573..a5dc86ae0bdd 100644
+--- a/drivers/gpu/drm/radeon/radeon_fb.c
++++ b/drivers/gpu/drm/radeon/radeon_fb.c
+@@ -303,7 +303,8 @@ out_unref:
+
+ void radeon_fb_output_poll_changed(struct radeon_device *rdev)
+ {
+- drm_fb_helper_hotplug_event(&rdev->mode_info.rfbdev->helper);
++ if (rdev->mode_info.rfbdev)
++ drm_fb_helper_hotplug_event(&rdev->mode_info.rfbdev->helper);
+ }
+
+ static int radeon_fbdev_destroy(struct drm_device *dev, struct radeon_fbdev *rfbdev)
+@@ -343,6 +344,10 @@ int radeon_fbdev_init(struct radeon_device *rdev)
+ int bpp_sel = 32;
+ int ret;
+
++ /* don't enable fbdev if no connectors */
++ if (list_empty(&rdev->ddev->mode_config.connector_list))
++ return 0;
++
+ /* select 8 bpp console on RN50 or 16MB cards */
+ if (ASIC_IS_RN50(rdev) || rdev->mc.real_vram_size <= (32*1024*1024))
+ bpp_sel = 8;
+@@ -386,7 +391,8 @@ void radeon_fbdev_fini(struct radeon_device *rdev)
+
+ void radeon_fbdev_set_suspend(struct radeon_device *rdev, int state)
+ {
+- fb_set_suspend(rdev->mode_info.rfbdev->helper.fbdev, state);
++ if (rdev->mode_info.rfbdev)
++ fb_set_suspend(rdev->mode_info.rfbdev->helper.fbdev, state);
+ }
+
+ int radeon_fbdev_total_size(struct radeon_device *rdev)
+@@ -401,7 +407,22 @@ int radeon_fbdev_total_size(struct radeon_device *rdev)
+
+ bool radeon_fbdev_robj_is_fb(struct radeon_device *rdev, struct radeon_bo *robj)
+ {
++ if (!rdev->mode_info.rfbdev)
++ return false;
++
+ if (robj == gem_to_radeon_bo(rdev->mode_info.rfbdev->rfb.obj))
+ return true;
+ return false;
+ }
++
++void radeon_fb_add_connector(struct radeon_device *rdev, struct drm_connector *connector)
++{
++ if (rdev->mode_info.rfbdev)
++ drm_fb_helper_add_one_connector(&rdev->mode_info.rfbdev->helper, connector);
++}
++
++void radeon_fb_remove_connector(struct radeon_device *rdev, struct drm_connector *connector)
++{
++ if (rdev->mode_info.rfbdev)
++ drm_fb_helper_remove_one_connector(&rdev->mode_info.rfbdev->helper, connector);
++}
+diff --git a/drivers/gpu/drm/radeon/radeon_mode.h b/drivers/gpu/drm/radeon/radeon_mode.h
+index 04db2fdd8692..3a395f405fff 100644
+--- a/drivers/gpu/drm/radeon/radeon_mode.h
++++ b/drivers/gpu/drm/radeon/radeon_mode.h
+@@ -921,6 +921,10 @@ bool radeon_fbdev_robj_is_fb(struct radeon_device *rdev, struct radeon_bo *robj)
+ void radeon_fb_output_poll_changed(struct radeon_device *rdev);
+
+ void radeon_crtc_handle_vblank(struct radeon_device *rdev, int crtc_id);
++
++void radeon_fb_add_connector(struct radeon_device *rdev, struct drm_connector *connector);
++void radeon_fb_remove_connector(struct radeon_device *rdev, struct drm_connector *connector);
++
+ void radeon_crtc_handle_flip(struct radeon_device *rdev, int crtc_id);
+
+ int radeon_align_pitch(struct radeon_device *rdev, int width, int bpp, bool tiled);
+diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
+index ab52d1b30161..cb4bc0dadba5 100644
+--- a/drivers/hid/hid-core.c
++++ b/drivers/hid/hid-core.c
+@@ -2553,8 +2553,10 @@ int hid_add_device(struct hid_device *hdev)
+ /*
+ * Scan generic devices for group information
+ */
+- if (hid_ignore_special_drivers ||
+- !hid_match_id(hdev, hid_have_special_driver)) {
++ if (hid_ignore_special_drivers) {
++ hdev->group = HID_GROUP_GENERIC;
++ } else if (!hdev->group &&
++ !hid_match_id(hdev, hid_have_special_driver)) {
+ ret = hid_scan_report(hdev);
+ if (ret)
+ hid_warn(hdev, "bad device descriptor (%d)\n", ret);
+diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
+index 51e25b9407f2..e24e22687f33 100644
+--- a/drivers/hid/hid-multitouch.c
++++ b/drivers/hid/hid-multitouch.c
+@@ -312,8 +312,19 @@ static void mt_feature_mapping(struct hid_device *hdev,
+ break;
+ }
+
+- td->inputmode = field->report->id;
+- td->inputmode_index = usage->usage_index;
++ if (td->inputmode < 0) {
++ td->inputmode = field->report->id;
++ td->inputmode_index = usage->usage_index;
++ } else {
++ /*
++ * Some elan panels wrongly declare 2 input mode
++ * features, and silently ignore when we set the
++ * value in the second field. Skip the second feature
++ * and hope for the best.
++ */
++ dev_info(&hdev->dev,
++ "Ignoring the extra HID_DG_INPUTMODE\n");
++ }
+
+ break;
+ case HID_DG_CONTACTMAX:
+diff --git a/drivers/hid/i2c-hid/i2c-hid.c b/drivers/hid/i2c-hid/i2c-hid.c
+index 6d7c9c580ceb..fdcce357f395 100644
+--- a/drivers/hid/i2c-hid/i2c-hid.c
++++ b/drivers/hid/i2c-hid/i2c-hid.c
+@@ -277,17 +277,21 @@ static int i2c_hid_set_or_send_report(struct i2c_client *client, u8 reportType,
+ u16 dataRegister = le16_to_cpu(ihid->hdesc.wDataRegister);
+ u16 outputRegister = le16_to_cpu(ihid->hdesc.wOutputRegister);
+ u16 maxOutputLength = le16_to_cpu(ihid->hdesc.wMaxOutputLength);
++ u16 size;
++ int args_len;
++ int index = 0;
++
++ i2c_hid_dbg(ihid, "%s\n", __func__);
++
++ if (data_len > ihid->bufsize)
++ return -EINVAL;
+
+- /* hid_hw_* already checked that data_len < HID_MAX_BUFFER_SIZE */
+- u16 size = 2 /* size */ +
++ size = 2 /* size */ +
+ (reportID ? 1 : 0) /* reportID */ +
+ data_len /* buf */;
+- int args_len = (reportID >= 0x0F ? 1 : 0) /* optional third byte */ +
++ args_len = (reportID >= 0x0F ? 1 : 0) /* optional third byte */ +
+ 2 /* dataRegister */ +
+ size /* args */;
+- int index = 0;
+-
+- i2c_hid_dbg(ihid, "%s\n", __func__);
+
+ if (!use_data && maxOutputLength == 0)
+ return -ENOSYS;
+diff --git a/drivers/iio/dac/mcp4725.c b/drivers/iio/dac/mcp4725.c
+index 43d14588448d..b4dde8315210 100644
+--- a/drivers/iio/dac/mcp4725.c
++++ b/drivers/iio/dac/mcp4725.c
+@@ -300,6 +300,7 @@ static int mcp4725_probe(struct i2c_client *client,
+ data->client = client;
+
+ indio_dev->dev.parent = &client->dev;
++ indio_dev->name = id->name;
+ indio_dev->info = &mcp4725_info;
+ indio_dev->channels = &mcp4725_channel;
+ indio_dev->num_channels = 1;
+diff --git a/drivers/iio/imu/adis_buffer.c b/drivers/iio/imu/adis_buffer.c
+index cb32b593f1c5..36607d52fee0 100644
+--- a/drivers/iio/imu/adis_buffer.c
++++ b/drivers/iio/imu/adis_buffer.c
+@@ -43,7 +43,7 @@ int adis_update_scan_mode(struct iio_dev *indio_dev,
+ return -ENOMEM;
+
+ rx = adis->buffer;
+- tx = rx + indio_dev->scan_bytes;
++ tx = rx + scan_count;
+
+ spi_message_init(&adis->msg);
+
+diff --git a/drivers/iio/pressure/mpl115.c b/drivers/iio/pressure/mpl115.c
+index f5ecd6e19f5d..a0d7deeac62f 100644
+--- a/drivers/iio/pressure/mpl115.c
++++ b/drivers/iio/pressure/mpl115.c
+@@ -117,7 +117,7 @@ static int mpl115_read_raw(struct iio_dev *indio_dev,
+ *val = ret >> 6;
+ return IIO_VAL_INT;
+ case IIO_CHAN_INFO_OFFSET:
+- *val = 605;
++ *val = -605;
+ *val2 = 750000;
+ return IIO_VAL_INT_PLUS_MICRO;
+ case IIO_CHAN_INFO_SCALE:
+diff --git a/drivers/infiniband/hw/cxgb3/iwch_cm.c b/drivers/infiniband/hw/cxgb3/iwch_cm.c
+index cb78b1e9bcd9..f504ba73e5dc 100644
+--- a/drivers/infiniband/hw/cxgb3/iwch_cm.c
++++ b/drivers/infiniband/hw/cxgb3/iwch_cm.c
+@@ -149,7 +149,7 @@ static int iwch_l2t_send(struct t3cdev *tdev, struct sk_buff *skb, struct l2t_en
+ error = l2t_send(tdev, skb, l2e);
+ if (error < 0)
+ kfree_skb(skb);
+- return error;
++ return error < 0 ? error : 0;
+ }
+
+ int iwch_cxgb3_ofld_send(struct t3cdev *tdev, struct sk_buff *skb)
+@@ -165,7 +165,7 @@ int iwch_cxgb3_ofld_send(struct t3cdev *tdev, struct sk_buff *skb)
+ error = cxgb3_ofld_send(tdev, skb);
+ if (error < 0)
+ kfree_skb(skb);
+- return error;
++ return error < 0 ? error : 0;
+ }
+
+ static void release_tid(struct t3cdev *tdev, u32 hwtid, struct sk_buff *skb)
+diff --git a/drivers/infiniband/ulp/srpt/ib_srpt.c b/drivers/infiniband/ulp/srpt/ib_srpt.c
+index ad4af66a4cbb..9fc0326c1da7 100644
+--- a/drivers/infiniband/ulp/srpt/ib_srpt.c
++++ b/drivers/infiniband/ulp/srpt/ib_srpt.c
+@@ -1745,47 +1745,6 @@ send_sense:
+ return -1;
+ }
+
+-/**
+- * srpt_rx_mgmt_fn_tag() - Process a task management function by tag.
+- * @ch: RDMA channel of the task management request.
+- * @fn: Task management function to perform.
+- * @req_tag: Tag of the SRP task management request.
+- * @mgmt_ioctx: I/O context of the task management request.
+- *
+- * Returns zero if the target core will process the task management
+- * request asynchronously.
+- *
+- * Note: It is assumed that the initiator serializes tag-based task management
+- * requests.
+- */
+-static int srpt_rx_mgmt_fn_tag(struct srpt_send_ioctx *ioctx, u64 tag)
+-{
+- struct srpt_device *sdev;
+- struct srpt_rdma_ch *ch;
+- struct srpt_send_ioctx *target;
+- int ret, i;
+-
+- ret = -EINVAL;
+- ch = ioctx->ch;
+- BUG_ON(!ch);
+- BUG_ON(!ch->sport);
+- sdev = ch->sport->sdev;
+- BUG_ON(!sdev);
+- spin_lock_irq(&sdev->spinlock);
+- for (i = 0; i < ch->rq_size; ++i) {
+- target = ch->ioctx_ring[i];
+- if (target->cmd.se_lun == ioctx->cmd.se_lun &&
+- target->tag == tag &&
+- srpt_get_cmd_state(target) != SRPT_STATE_DONE) {
+- ret = 0;
+- /* now let the target core abort &target->cmd; */
+- break;
+- }
+- }
+- spin_unlock_irq(&sdev->spinlock);
+- return ret;
+-}
+-
+ static int srp_tmr_to_tcm(int fn)
+ {
+ switch (fn) {
+@@ -1820,7 +1779,6 @@ static void srpt_handle_tsk_mgmt(struct srpt_rdma_ch *ch,
+ struct se_cmd *cmd;
+ struct se_session *sess = ch->sess;
+ uint64_t unpacked_lun;
+- uint32_t tag = 0;
+ int tcm_tmr;
+ int rc;
+
+@@ -1836,25 +1794,10 @@ static void srpt_handle_tsk_mgmt(struct srpt_rdma_ch *ch,
+ srpt_set_cmd_state(send_ioctx, SRPT_STATE_MGMT);
+ send_ioctx->tag = srp_tsk->tag;
+ tcm_tmr = srp_tmr_to_tcm(srp_tsk->tsk_mgmt_func);
+- if (tcm_tmr < 0) {
+- send_ioctx->cmd.se_tmr_req->response =
+- TMR_TASK_MGMT_FUNCTION_NOT_SUPPORTED;
+- goto fail;
+- }
+ unpacked_lun = srpt_unpack_lun((uint8_t *)&srp_tsk->lun,
+ sizeof(srp_tsk->lun));
+-
+- if (srp_tsk->tsk_mgmt_func == SRP_TSK_ABORT_TASK) {
+- rc = srpt_rx_mgmt_fn_tag(send_ioctx, srp_tsk->task_tag);
+- if (rc < 0) {
+- send_ioctx->cmd.se_tmr_req->response =
+- TMR_TASK_DOES_NOT_EXIST;
+- goto fail;
+- }
+- tag = srp_tsk->task_tag;
+- }
+ rc = target_submit_tmr(&send_ioctx->cmd, sess, NULL, unpacked_lun,
+- srp_tsk, tcm_tmr, GFP_KERNEL, tag,
++ srp_tsk, tcm_tmr, GFP_KERNEL, srp_tsk->task_tag,
+ TARGET_SCF_ACK_KREF);
+ if (rc != 0) {
+ send_ioctx->cmd.se_tmr_req->response = TMR_FUNCTION_REJECTED;
+diff --git a/drivers/input/misc/ati_remote2.c b/drivers/input/misc/ati_remote2.c
+index f63341f20b91..e8c6a4842e91 100644
+--- a/drivers/input/misc/ati_remote2.c
++++ b/drivers/input/misc/ati_remote2.c
+@@ -817,26 +817,49 @@ static int ati_remote2_probe(struct usb_interface *interface, const struct usb_d
+
+ ar2->udev = udev;
+
++ /* Sanity check, first interface must have an endpoint */
++ if (alt->desc.bNumEndpoints < 1 || !alt->endpoint) {
++ dev_err(&interface->dev,
++ "%s(): interface 0 must have an endpoint\n", __func__);
++ r = -ENODEV;
++ goto fail1;
++ }
+ ar2->intf[0] = interface;
+ ar2->ep[0] = &alt->endpoint[0].desc;
+
++ /* Sanity check, the device must have two interfaces */
+ ar2->intf[1] = usb_ifnum_to_if(udev, 1);
++ if ((udev->actconfig->desc.bNumInterfaces < 2) || !ar2->intf[1]) {
++ dev_err(&interface->dev, "%s(): need 2 interfaces, found %d\n",
++ __func__, udev->actconfig->desc.bNumInterfaces);
++ r = -ENODEV;
++ goto fail1;
++ }
++
+ r = usb_driver_claim_interface(&ati_remote2_driver, ar2->intf[1], ar2);
+ if (r)
+ goto fail1;
++
++ /* Sanity check, second interface must have an endpoint */
+ alt = ar2->intf[1]->cur_altsetting;
++ if (alt->desc.bNumEndpoints < 1 || !alt->endpoint) {
++ dev_err(&interface->dev,
++ "%s(): interface 1 must have an endpoint\n", __func__);
++ r = -ENODEV;
++ goto fail2;
++ }
+ ar2->ep[1] = &alt->endpoint[0].desc;
+
+ r = ati_remote2_urb_init(ar2);
+ if (r)
+- goto fail2;
++ goto fail3;
+
+ ar2->channel_mask = channel_mask;
+ ar2->mode_mask = mode_mask;
+
+ r = ati_remote2_setup(ar2, ar2->channel_mask);
+ if (r)
+- goto fail2;
++ goto fail3;
+
+ usb_make_path(udev, ar2->phys, sizeof(ar2->phys));
+ strlcat(ar2->phys, "/input0", sizeof(ar2->phys));
+@@ -845,11 +868,11 @@ static int ati_remote2_probe(struct usb_interface *interface, const struct usb_d
+
+ r = sysfs_create_group(&udev->dev.kobj, &ati_remote2_attr_group);
+ if (r)
+- goto fail2;
++ goto fail3;
+
+ r = ati_remote2_input_init(ar2);
+ if (r)
+- goto fail3;
++ goto fail4;
+
+ usb_set_intfdata(interface, ar2);
+
+@@ -857,10 +880,11 @@ static int ati_remote2_probe(struct usb_interface *interface, const struct usb_d
+
+ return 0;
+
+- fail3:
++ fail4:
+ sysfs_remove_group(&udev->dev.kobj, &ati_remote2_attr_group);
+- fail2:
++ fail3:
+ ati_remote2_urb_cleanup(ar2);
++ fail2:
+ usb_driver_release_interface(&ati_remote2_driver, ar2->intf[1]);
+ fail1:
+ kfree(ar2);
+diff --git a/drivers/input/misc/ims-pcu.c b/drivers/input/misc/ims-pcu.c
+index afed8e2b2f94..41ef29b516f3 100644
+--- a/drivers/input/misc/ims-pcu.c
++++ b/drivers/input/misc/ims-pcu.c
+@@ -1663,6 +1663,8 @@ static int ims_pcu_parse_cdc_data(struct usb_interface *intf, struct ims_pcu *pc
+
+ pcu->ctrl_intf = usb_ifnum_to_if(pcu->udev,
+ union_desc->bMasterInterface0);
++ if (!pcu->ctrl_intf)
++ return -EINVAL;
+
+ alt = pcu->ctrl_intf->cur_altsetting;
+ pcu->ep_ctrl = &alt->endpoint[0].desc;
+@@ -1670,6 +1672,8 @@ static int ims_pcu_parse_cdc_data(struct usb_interface *intf, struct ims_pcu *pc
+
+ pcu->data_intf = usb_ifnum_to_if(pcu->udev,
+ union_desc->bSlaveInterface0);
++ if (!pcu->data_intf)
++ return -EINVAL;
+
+ alt = pcu->data_intf->cur_altsetting;
+ if (alt->desc.bNumEndpoints != 2) {
+diff --git a/drivers/input/misc/powermate.c b/drivers/input/misc/powermate.c
+index 63b539d3daba..84909a12ff36 100644
+--- a/drivers/input/misc/powermate.c
++++ b/drivers/input/misc/powermate.c
+@@ -307,6 +307,9 @@ static int powermate_probe(struct usb_interface *intf, const struct usb_device_i
+ int error = -ENOMEM;
+
+ interface = intf->cur_altsetting;
++ if (interface->desc.bNumEndpoints < 1)
++ return -EINVAL;
++
+ endpoint = &interface->endpoint[0].desc;
+ if (!usb_endpoint_is_int_in(endpoint))
+ return -EIO;
+diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
+index 826ef3df2dc7..1de070a239be 100644
+--- a/drivers/input/mouse/synaptics.c
++++ b/drivers/input/mouse/synaptics.c
+@@ -840,8 +840,9 @@ static void synaptics_report_ext_buttons(struct psmouse *psmouse,
+ if (!SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap))
+ return;
+
+- /* Bug in FW 8.1, buttons are reported only when ExtBit is 1 */
+- if (SYN_ID_FULL(priv->identity) == 0x801 &&
++ /* Bug in FW 8.1 & 8.2, buttons are reported only when ExtBit is 1 */
++ if ((SYN_ID_FULL(priv->identity) == 0x801 ||
++ SYN_ID_FULL(priv->identity) == 0x802) &&
+ !((psmouse->packet[0] ^ psmouse->packet[3]) & 0x02))
+ return;
+
+diff --git a/drivers/irqchip/irq-omap-intc.c b/drivers/irqchip/irq-omap-intc.c
+index c03f140acbae..0ee0546a6a6f 100644
+--- a/drivers/irqchip/irq-omap-intc.c
++++ b/drivers/irqchip/irq-omap-intc.c
+@@ -48,6 +48,7 @@
+ #define INTC_ILR0 0x0100
+
+ #define ACTIVEIRQ_MASK 0x7f /* omap2/3 active interrupt bits */
++#define SPURIOUSIRQ_MASK (0x1ffffff << 7)
+ #define INTCPS_NR_ILR_REGS 128
+ #define INTCPS_NR_MIR_REGS 4
+
+@@ -331,37 +332,36 @@ static int __init omap_init_irq(u32 base, struct device_node *node)
+ static asmlinkage void __exception_irq_entry
+ omap_intc_handle_irq(struct pt_regs *regs)
+ {
+- u32 irqnr = 0;
+- int handled_irq = 0;
+- int i;
+-
+- do {
+- for (i = 0; i < omap_nr_pending; i++) {
+- irqnr = intc_readl(INTC_PENDING_IRQ0 + (0x20 * i));
+- if (irqnr)
+- goto out;
+- }
+-
+-out:
+- if (!irqnr)
+- break;
++ extern unsigned long irq_err_count;
++ u32 irqnr;
+
+- irqnr = intc_readl(INTC_SIR);
+- irqnr &= ACTIVEIRQ_MASK;
+-
+- if (irqnr) {
+- handle_domain_irq(domain, irqnr, regs);
+- handled_irq = 1;
+- }
+- } while (irqnr);
++ irqnr = intc_readl(INTC_SIR);
+
+ /*
+- * If an irq is masked or deasserted while active, we will
+- * keep ending up here with no irq handled. So remove it from
+- * the INTC with an ack.
++ * A spurious IRQ can result if interrupt that triggered the
++ * sorting is no longer active during the sorting (10 INTC
++ * functional clock cycles after interrupt assertion). Or a
++ * change in interrupt mask affected the result during sorting
++ * time. There is no special handling required except ignoring
++ * the SIR register value just read and retrying.
++ * See section 6.2.5 of AM335x TRM Literature Number: SPRUH73K
++ *
++ * Many a times, a spurious interrupt situation has been fixed
++ * by adding a flush for the posted write acking the IRQ in
++ * the device driver. Typically, this is going be the device
++ * driver whose interrupt was handled just before the spurious
++ * IRQ occurred. Pay attention to those device drivers if you
++ * run into hitting the spurious IRQ condition below.
+ */
+- if (!handled_irq)
++ if (unlikely((irqnr & SPURIOUSIRQ_MASK) == SPURIOUSIRQ_MASK)) {
++ pr_err_once("%s: spurious irq!\n", __func__);
++ irq_err_count++;
+ omap_ack_irq(NULL);
++ return;
++ }
++
++ irqnr &= ACTIVEIRQ_MASK;
++ handle_domain_irq(domain, irqnr, regs);
+ }
+
+ void __init omap2_init_irq(void)
+diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
+index 42522c8f13c6..2a102834c2ee 100644
+--- a/drivers/md/bcache/super.c
++++ b/drivers/md/bcache/super.c
+@@ -1046,8 +1046,12 @@ int bch_cached_dev_attach(struct cached_dev *dc, struct cache_set *c)
+ */
+ atomic_set(&dc->count, 1);
+
+- if (bch_cached_dev_writeback_start(dc))
++ /* Block writeback thread, but spawn it */
++ down_write(&dc->writeback_lock);
++ if (bch_cached_dev_writeback_start(dc)) {
++ up_write(&dc->writeback_lock);
+ return -ENOMEM;
++ }
+
+ if (BDEV_STATE(&dc->sb) == BDEV_STATE_DIRTY) {
+ bch_sectors_dirty_init(dc);
+@@ -1059,6 +1063,9 @@ int bch_cached_dev_attach(struct cached_dev *dc, struct cache_set *c)
+ bch_cached_dev_run(dc);
+ bcache_device_link(&dc->disk, c, "bdev");
+
++ /* Allow the writeback thread to proceed */
++ up_write(&dc->writeback_lock);
++
+ pr_info("Caching %s as %s on set %pU",
+ bdevname(dc->bdev, buf), dc->disk.disk->disk_name,
+ dc->disk.c->sb.set_uuid);
+@@ -1397,6 +1404,9 @@ static void cache_set_flush(struct closure *cl)
+ struct btree *b;
+ unsigned i;
+
++ if (!c)
++ closure_return(cl);
++
+ bch_cache_accounting_destroy(&c->accounting);
+
+ kobject_put(&c->internal);
+@@ -1862,11 +1872,12 @@ static int cache_alloc(struct cache_sb *sb, struct cache *ca)
+ return 0;
+ }
+
+-static void register_cache(struct cache_sb *sb, struct page *sb_page,
++static int register_cache(struct cache_sb *sb, struct page *sb_page,
+ struct block_device *bdev, struct cache *ca)
+ {
+ char name[BDEVNAME_SIZE];
+- const char *err = "cannot allocate memory";
++ const char *err = NULL;
++ int ret = 0;
+
+ memcpy(&ca->sb, sb, sizeof(struct cache_sb));
+ ca->bdev = bdev;
+@@ -1881,27 +1892,35 @@ static void register_cache(struct cache_sb *sb, struct page *sb_page,
+ if (blk_queue_discard(bdev_get_queue(ca->bdev)))
+ ca->discard = CACHE_DISCARD(&ca->sb);
+
+- if (cache_alloc(sb, ca) != 0)
++ ret = cache_alloc(sb, ca);
++ if (ret != 0)
+ goto err;
+
+- err = "error creating kobject";
+- if (kobject_add(&ca->kobj, &part_to_dev(bdev->bd_part)->kobj, "bcache"))
+- goto err;
++ if (kobject_add(&ca->kobj, &part_to_dev(bdev->bd_part)->kobj, "bcache")) {
++ err = "error calling kobject_add";
++ ret = -ENOMEM;
++ goto out;
++ }
+
+ mutex_lock(&bch_register_lock);
+ err = register_cache_set(ca);
+ mutex_unlock(&bch_register_lock);
+
+- if (err)
+- goto err;
++ if (err) {
++ ret = -ENODEV;
++ goto out;
++ }
+
+ pr_info("registered cache device %s", bdevname(bdev, name));
++
+ out:
+ kobject_put(&ca->kobj);
+- return;
++
+ err:
+- pr_notice("error opening %s: %s", bdevname(bdev, name), err);
+- goto out;
++ if (err)
++ pr_notice("error opening %s: %s", bdevname(bdev, name), err);
++
++ return ret;
+ }
+
+ /* Global interfaces/init */
+@@ -1999,7 +2018,8 @@ static ssize_t register_bcache(struct kobject *k, struct kobj_attribute *attr,
+ if (!ca)
+ goto err_close;
+
+- register_cache(sb, sb_page, bdev, ca);
++ if (register_cache(sb, sb_page, bdev, ca) != 0)
++ goto err_close;
+ }
+ out:
+ if (sb_page)
+diff --git a/drivers/md/multipath.c b/drivers/md/multipath.c
+index 399272f9c042..2df218da1791 100644
+--- a/drivers/md/multipath.c
++++ b/drivers/md/multipath.c
+@@ -129,7 +129,9 @@ static void multipath_make_request(struct mddev *mddev, struct bio * bio)
+ }
+ multipath = conf->multipaths + mp_bh->path;
+
+- mp_bh->bio = *bio;
++ bio_init(&mp_bh->bio);
++ __bio_clone_fast(&mp_bh->bio, bio);
++
+ mp_bh->bio.bi_iter.bi_sector += multipath->rdev->data_offset;
+ mp_bh->bio.bi_bdev = multipath->rdev->bdev;
+ mp_bh->bio.bi_rw |= REQ_FAILFAST_TRANSPORT;
+diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
+index 5fa7549ba409..cdd8770de1c2 100644
+--- a/drivers/md/raid5.c
++++ b/drivers/md/raid5.c
+@@ -6245,8 +6245,8 @@ static int run(struct mddev *mddev)
+ }
+
+ if (discard_supported &&
+- mddev->queue->limits.max_discard_sectors >= stripe &&
+- mddev->queue->limits.discard_granularity >= stripe)
++ mddev->queue->limits.max_discard_sectors >= (stripe >> 9) &&
++ mddev->queue->limits.discard_granularity >= stripe)
+ queue_flag_set_unlocked(QUEUE_FLAG_DISCARD,
+ mddev->queue);
+ else
+diff --git a/drivers/media/i2c/adv7511.c b/drivers/media/i2c/adv7511.c
+index f98acf4aafd4..621e4c058297 100644
+--- a/drivers/media/i2c/adv7511.c
++++ b/drivers/media/i2c/adv7511.c
+@@ -833,12 +833,23 @@ static void adv7511_dbg_dump_edid(int lvl, int debug, struct v4l2_subdev *sd, in
+ }
+ }
+
++static void adv7511_notify_no_edid(struct v4l2_subdev *sd)
++{
++ struct adv7511_state *state = get_adv7511_state(sd);
++ struct adv7511_edid_detect ed;
++
++ /* We failed to read the EDID, so send an event for this. */
++ ed.present = false;
++ ed.segment = adv7511_rd(sd, 0xc4);
++ v4l2_subdev_notify(sd, ADV7511_EDID_DETECT, (void *)&ed);
++ v4l2_ctrl_s_ctrl(state->have_edid0_ctrl, 0x0);
++}
++
+ static void adv7511_edid_handler(struct work_struct *work)
+ {
+ struct delayed_work *dwork = to_delayed_work(work);
+ struct adv7511_state *state = container_of(dwork, struct adv7511_state, edid_handler);
+ struct v4l2_subdev *sd = &state->sd;
+- struct adv7511_edid_detect ed;
+
+ v4l2_dbg(1, debug, sd, "%s:\n", __func__);
+
+@@ -863,9 +874,7 @@ static void adv7511_edid_handler(struct work_struct *work)
+ }
+
+ /* We failed to read the EDID, so send an event for this. */
+- ed.present = false;
+- ed.segment = adv7511_rd(sd, 0xc4);
+- v4l2_subdev_notify(sd, ADV7511_EDID_DETECT, (void *)&ed);
++ adv7511_notify_no_edid(sd);
+ v4l2_dbg(1, debug, sd, "%s: no edid found\n", __func__);
+ }
+
+@@ -936,7 +945,6 @@ static void adv7511_check_monitor_present_status(struct v4l2_subdev *sd)
+ /* update read only ctrls */
+ v4l2_ctrl_s_ctrl(state->hotplug_ctrl, adv7511_have_hotplug(sd) ? 0x1 : 0x0);
+ v4l2_ctrl_s_ctrl(state->rx_sense_ctrl, adv7511_have_rx_sense(sd) ? 0x1 : 0x0);
+- v4l2_ctrl_s_ctrl(state->have_edid0_ctrl, state->edid.segments ? 0x1 : 0x0);
+
+ if ((status & MASK_ADV7511_HPD_DETECT) && ((status & MASK_ADV7511_MSEN_DETECT) || state->edid.segments)) {
+ v4l2_dbg(1, debug, sd, "%s: hotplug and (rx-sense or edid)\n", __func__);
+@@ -966,6 +974,7 @@ static void adv7511_check_monitor_present_status(struct v4l2_subdev *sd)
+ }
+ adv7511_s_power(sd, false);
+ memset(&state->edid, 0, sizeof(struct adv7511_state_edid));
++ adv7511_notify_no_edid(sd);
+ }
+ }
+
+@@ -1042,6 +1051,7 @@ static bool adv7511_check_edid_status(struct v4l2_subdev *sd)
+ }
+ /* one more segment read ok */
+ state->edid.segments = segment + 1;
++ v4l2_ctrl_s_ctrl(state->have_edid0_ctrl, 0x1);
+ if (((state->edid.data[0x7e] >> 1) + 1) > state->edid.segments) {
+ /* Request next EDID segment */
+ v4l2_dbg(1, debug, sd, "%s: request segment %d\n", __func__, state->edid.segments);
+@@ -1061,7 +1071,6 @@ static bool adv7511_check_edid_status(struct v4l2_subdev *sd)
+ ed.present = true;
+ ed.segment = 0;
+ state->edid_detect_counter++;
+- v4l2_ctrl_s_ctrl(state->have_edid0_ctrl, state->edid.segments ? 0x1 : 0x0);
+ v4l2_subdev_notify(sd, ADV7511_EDID_DETECT, (void *)&ed);
+ return ed.present;
+ }
+diff --git a/drivers/media/pci/bt8xx/bttv-driver.c b/drivers/media/pci/bt8xx/bttv-driver.c
+index 4a8176c09fc9..dbb00bfd3d78 100644
+--- a/drivers/media/pci/bt8xx/bttv-driver.c
++++ b/drivers/media/pci/bt8xx/bttv-driver.c
+@@ -2332,6 +2332,19 @@ static int bttv_g_fmt_vid_overlay(struct file *file, void *priv,
+ return 0;
+ }
+
++static void bttv_get_width_mask_vid_cap(const struct bttv_format *fmt,
++ unsigned int *width_mask,
++ unsigned int *width_bias)
++{
++ if (fmt->flags & FORMAT_FLAGS_PLANAR) {
++ *width_mask = ~15; /* width must be a multiple of 16 pixels */
++ *width_bias = 8; /* nearest */
++ } else {
++ *width_mask = ~3; /* width must be a multiple of 4 pixels */
++ *width_bias = 2; /* nearest */
++ }
++}
++
+ static int bttv_try_fmt_vid_cap(struct file *file, void *priv,
+ struct v4l2_format *f)
+ {
+@@ -2341,6 +2354,7 @@ static int bttv_try_fmt_vid_cap(struct file *file, void *priv,
+ enum v4l2_field field;
+ __s32 width, height;
+ __s32 height2;
++ unsigned int width_mask, width_bias;
+ int rc;
+
+ fmt = format_by_fourcc(f->fmt.pix.pixelformat);
+@@ -2373,9 +2387,9 @@ static int bttv_try_fmt_vid_cap(struct file *file, void *priv,
+ width = f->fmt.pix.width;
+ height = f->fmt.pix.height;
+
++ bttv_get_width_mask_vid_cap(fmt, &width_mask, &width_bias);
+ rc = limit_scaled_size_lock(fh, &width, &height, field,
+- /* width_mask: 4 pixels */ ~3,
+- /* width_bias: nearest */ 2,
++ width_mask, width_bias,
+ /* adjust_size */ 1,
+ /* adjust_crop */ 0);
+ if (0 != rc)
+@@ -2408,6 +2422,7 @@ static int bttv_s_fmt_vid_cap(struct file *file, void *priv,
+ struct bttv_fh *fh = priv;
+ struct bttv *btv = fh->btv;
+ __s32 width, height;
++ unsigned int width_mask, width_bias;
+ enum v4l2_field field;
+
+ retval = bttv_switch_type(fh, f->type);
+@@ -2422,9 +2437,10 @@ static int bttv_s_fmt_vid_cap(struct file *file, void *priv,
+ height = f->fmt.pix.height;
+ field = f->fmt.pix.field;
+
++ fmt = format_by_fourcc(f->fmt.pix.pixelformat);
++ bttv_get_width_mask_vid_cap(fmt, &width_mask, &width_bias);
+ retval = limit_scaled_size_lock(fh, &width, &height, f->fmt.pix.field,
+- /* width_mask: 4 pixels */ ~3,
+- /* width_bias: nearest */ 2,
++ width_mask, width_bias,
+ /* adjust_size */ 1,
+ /* adjust_crop */ 1);
+ if (0 != retval)
+@@ -2432,8 +2448,6 @@ static int bttv_s_fmt_vid_cap(struct file *file, void *priv,
+
+ f->fmt.pix.field = field;
+
+- fmt = format_by_fourcc(f->fmt.pix.pixelformat);
+-
+ /* update our state informations */
+ fh->fmt = fmt;
+ fh->cap.field = f->fmt.pix.field;
+diff --git a/drivers/media/pci/saa7134/saa7134-video.c b/drivers/media/pci/saa7134/saa7134-video.c
+index fc4a427cb51f..af268ca40393 100644
+--- a/drivers/media/pci/saa7134/saa7134-video.c
++++ b/drivers/media/pci/saa7134/saa7134-video.c
+@@ -1230,10 +1230,13 @@ static int saa7134_g_fmt_vid_cap(struct file *file, void *priv,
+ f->fmt.pix.height = dev->height;
+ f->fmt.pix.field = dev->field;
+ f->fmt.pix.pixelformat = dev->fmt->fourcc;
+- f->fmt.pix.bytesperline =
+- (f->fmt.pix.width * dev->fmt->depth) >> 3;
++ if (dev->fmt->planar)
++ f->fmt.pix.bytesperline = f->fmt.pix.width;
++ else
++ f->fmt.pix.bytesperline =
++ (f->fmt.pix.width * dev->fmt->depth) / 8;
+ f->fmt.pix.sizeimage =
+- f->fmt.pix.height * f->fmt.pix.bytesperline;
++ (f->fmt.pix.height * f->fmt.pix.width * dev->fmt->depth) / 8;
+ f->fmt.pix.colorspace = V4L2_COLORSPACE_SMPTE170M;
+ return 0;
+ }
+@@ -1309,10 +1312,13 @@ static int saa7134_try_fmt_vid_cap(struct file *file, void *priv,
+ if (f->fmt.pix.height > maxh)
+ f->fmt.pix.height = maxh;
+ f->fmt.pix.width &= ~0x03;
+- f->fmt.pix.bytesperline =
+- (f->fmt.pix.width * fmt->depth) >> 3;
++ if (fmt->planar)
++ f->fmt.pix.bytesperline = f->fmt.pix.width;
++ else
++ f->fmt.pix.bytesperline =
++ (f->fmt.pix.width * fmt->depth) / 8;
+ f->fmt.pix.sizeimage =
+- f->fmt.pix.height * f->fmt.pix.bytesperline;
++ (f->fmt.pix.height * f->fmt.pix.width * fmt->depth) / 8;
+ f->fmt.pix.colorspace = V4L2_COLORSPACE_SMPTE170M;
+
+ return 0;
+diff --git a/drivers/media/tuners/si2157.c b/drivers/media/tuners/si2157.c
+index cf97142e01e6..446917439ae5 100644
+--- a/drivers/media/tuners/si2157.c
++++ b/drivers/media/tuners/si2157.c
+@@ -157,6 +157,11 @@ static int si2157_init(struct dvb_frontend *fe)
+
+ for (remaining = fw->size; remaining > 0; remaining -= 17) {
+ len = fw->data[fw->size - remaining];
++ if (len > SI2157_ARGLEN) {
++ dev_err(&s->client->dev, "Bad firmware length\n");
++ ret = -EINVAL;
++ goto err;
++ }
+ memcpy(cmd.args, &fw->data[(fw->size - remaining) + 1], len);
+ cmd.wlen = len;
+ cmd.rlen = 1;
+diff --git a/drivers/media/usb/pwc/pwc-if.c b/drivers/media/usb/pwc/pwc-if.c
+index 15b754da4a2c..f3309269847a 100644
+--- a/drivers/media/usb/pwc/pwc-if.c
++++ b/drivers/media/usb/pwc/pwc-if.c
+@@ -91,6 +91,7 @@ static const struct usb_device_id pwc_device_table [] = {
+ { USB_DEVICE(0x0471, 0x0312) },
+ { USB_DEVICE(0x0471, 0x0313) }, /* the 'new' 720K */
+ { USB_DEVICE(0x0471, 0x0329) }, /* Philips SPC 900NC PC Camera */
++ { USB_DEVICE(0x0471, 0x032C) }, /* Philips SPC 880NC PC Camera */
+ { USB_DEVICE(0x069A, 0x0001) }, /* Askey */
+ { USB_DEVICE(0x046D, 0x08B0) }, /* Logitech QuickCam Pro 3000 */
+ { USB_DEVICE(0x046D, 0x08B1) }, /* Logitech QuickCam Notebook Pro */
+@@ -799,6 +800,11 @@ static int usb_pwc_probe(struct usb_interface *intf, const struct usb_device_id
+ name = "Philips SPC 900NC webcam";
+ type_id = 740;
+ break;
++ case 0x032C:
++ PWC_INFO("Philips SPC 880NC USB webcam detected.\n");
++ name = "Philips SPC 880NC webcam";
++ type_id = 740;
++ break;
+ default:
+ return -ENODEV;
+ break;
+diff --git a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
+index e502a5fb2994..e77d3fc50abd 100644
+--- a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
++++ b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
+@@ -392,7 +392,8 @@ static int get_v4l2_buffer32(struct v4l2_buffer *kp, struct v4l2_buffer32 __user
+ get_user(kp->index, &up->index) ||
+ get_user(kp->type, &up->type) ||
+ get_user(kp->flags, &up->flags) ||
+- get_user(kp->memory, &up->memory))
++ get_user(kp->memory, &up->memory) ||
++ get_user(kp->length, &up->length))
+ return -EFAULT;
+
+ if (V4L2_TYPE_IS_OUTPUT(kp->type))
+@@ -404,9 +405,6 @@ static int get_v4l2_buffer32(struct v4l2_buffer *kp, struct v4l2_buffer32 __user
+ return -EFAULT;
+
+ if (V4L2_TYPE_IS_MULTIPLANAR(kp->type)) {
+- if (get_user(kp->length, &up->length))
+- return -EFAULT;
+-
+ num_planes = kp->length;
+ if (num_planes == 0) {
+ kp->m.planes = NULL;
+@@ -439,16 +437,14 @@ static int get_v4l2_buffer32(struct v4l2_buffer *kp, struct v4l2_buffer32 __user
+ } else {
+ switch (kp->memory) {
+ case V4L2_MEMORY_MMAP:
+- if (get_user(kp->length, &up->length) ||
+- get_user(kp->m.offset, &up->m.offset))
++ if (get_user(kp->m.offset, &up->m.offset))
+ return -EFAULT;
+ break;
+ case V4L2_MEMORY_USERPTR:
+ {
+ compat_long_t tmp;
+
+- if (get_user(kp->length, &up->length) ||
+- get_user(tmp, &up->m.userptr))
++ if (get_user(tmp, &up->m.userptr))
+ return -EFAULT;
+
+ kp->m.userptr = (unsigned long)compat_ptr(tmp);
+@@ -490,7 +486,8 @@ static int put_v4l2_buffer32(struct v4l2_buffer *kp, struct v4l2_buffer32 __user
+ copy_to_user(&up->timecode, &kp->timecode, sizeof(struct v4l2_timecode)) ||
+ put_user(kp->sequence, &up->sequence) ||
+ put_user(kp->reserved2, &up->reserved2) ||
+- put_user(kp->reserved, &up->reserved))
++ put_user(kp->reserved, &up->reserved) ||
++ put_user(kp->length, &up->length))
+ return -EFAULT;
+
+ if (V4L2_TYPE_IS_MULTIPLANAR(kp->type)) {
+@@ -513,13 +510,11 @@ static int put_v4l2_buffer32(struct v4l2_buffer *kp, struct v4l2_buffer32 __user
+ } else {
+ switch (kp->memory) {
+ case V4L2_MEMORY_MMAP:
+- if (put_user(kp->length, &up->length) ||
+- put_user(kp->m.offset, &up->m.offset))
++ if (put_user(kp->m.offset, &up->m.offset))
+ return -EFAULT;
+ break;
+ case V4L2_MEMORY_USERPTR:
+- if (put_user(kp->length, &up->length) ||
+- put_user(kp->m.userptr, &up->m.userptr))
++ if (put_user(kp->m.userptr, &up->m.userptr))
+ return -EFAULT;
+ break;
+ case V4L2_MEMORY_OVERLAY:
+diff --git a/drivers/mmc/host/mmc_spi.c b/drivers/mmc/host/mmc_spi.c
+index e4a07546f8b6..fc9004a74346 100644
+--- a/drivers/mmc/host/mmc_spi.c
++++ b/drivers/mmc/host/mmc_spi.c
+@@ -1436,6 +1436,12 @@ static int mmc_spi_probe(struct spi_device *spi)
+ host->pdata->cd_debounce);
+ if (status != 0)
+ goto fail_add_host;
++
++ /* The platform has a CD GPIO signal that may support
++ * interrupts, so let mmc_gpiod_request_cd_irq() decide
++ * if polling is needed or not.
++ */
++ mmc->caps &= ~MMC_CAP_NEEDS_POLL;
+ mmc_gpiod_request_cd_irq(mmc);
+ }
+
+diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c
+index 9109287e47ac..8e7605894dfd 100644
+--- a/drivers/mmc/host/sdhci.c
++++ b/drivers/mmc/host/sdhci.c
+@@ -660,9 +660,20 @@ static u8 sdhci_calc_timeout(struct sdhci_host *host, struct mmc_command *cmd)
+ if (!data)
+ target_timeout = cmd->busy_timeout * 1000;
+ else {
+- target_timeout = data->timeout_ns / 1000;
+- if (host->clock)
+- target_timeout += data->timeout_clks / host->clock;
++ target_timeout = DIV_ROUND_UP(data->timeout_ns, 1000);
++ if (host->clock && data->timeout_clks) {
++ unsigned long long val;
++
++ /*
++ * data->timeout_clks is in units of clock cycles.
++ * host->clock is in Hz. target_timeout is in us.
++ * Hence, us = 1000000 * cycles / Hz. Round up.
++ */
++ val = 1000000 * data->timeout_clks;
++ if (do_div(val, host->clock))
++ target_timeout++;
++ target_timeout += val;
++ }
+ }
+
+ /*
+@@ -2978,14 +2989,14 @@ int sdhci_add_host(struct sdhci_host *host)
+ if (caps[0] & SDHCI_TIMEOUT_CLK_UNIT)
+ host->timeout_clk *= 1000;
+
++ if (override_timeout_clk)
++ host->timeout_clk = override_timeout_clk;
++
+ mmc->max_busy_timeout = host->ops->get_max_timeout_count ?
+ host->ops->get_max_timeout_count(host) : 1 << 27;
+ mmc->max_busy_timeout /= host->timeout_clk;
+ }
+
+- if (override_timeout_clk)
+- host->timeout_clk = override_timeout_clk;
+-
+ mmc->caps |= MMC_CAP_SDIO_IRQ | MMC_CAP_ERASE | MMC_CAP_CMD23;
+ mmc->caps2 |= MMC_CAP2_SDIO_IRQ_NOTHREAD;
+
+diff --git a/drivers/mtd/onenand/onenand_base.c b/drivers/mtd/onenand/onenand_base.c
+index 635ee0027691..c3f327ed7c12 100644
+--- a/drivers/mtd/onenand/onenand_base.c
++++ b/drivers/mtd/onenand/onenand_base.c
+@@ -2605,6 +2605,7 @@ static int onenand_default_block_markbad(struct mtd_info *mtd, loff_t ofs)
+ */
+ static int onenand_block_markbad(struct mtd_info *mtd, loff_t ofs)
+ {
++ struct onenand_chip *this = mtd->priv;
+ int ret;
+
+ ret = onenand_block_isbad(mtd, ofs);
+@@ -2616,7 +2617,7 @@ static int onenand_block_markbad(struct mtd_info *mtd, loff_t ofs)
+ }
+
+ onenand_get_device(mtd, FL_WRITING);
+- ret = mtd_block_markbad(mtd, ofs);
++ ret = this->block_markbad(mtd, ofs);
+ onenand_release_device(mtd);
+ return ret;
+ }
+diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c
+index fb34708aa5f4..3bd7e3d8fe5a 100644
+--- a/drivers/net/ethernet/marvell/mvneta.c
++++ b/drivers/net/ethernet/marvell/mvneta.c
+@@ -3078,7 +3078,7 @@ static int mvneta_probe(struct platform_device *pdev)
+ dev->features = NETIF_F_SG | NETIF_F_IP_CSUM | NETIF_F_TSO;
+ dev->hw_features |= dev->features;
+ dev->vlan_features |= dev->features;
+- dev->priv_flags |= IFF_UNICAST_FLT;
++ dev->priv_flags |= IFF_UNICAST_FLT | IFF_LIVE_ADDR_CHANGE;
+ dev->gso_max_segs = MVNETA_MAX_TSO_SEGS;
+
+ err = register_netdev(dev);
+diff --git a/drivers/net/irda/irtty-sir.c b/drivers/net/irda/irtty-sir.c
+index 24b6dddd7f2f..16219162566b 100644
+--- a/drivers/net/irda/irtty-sir.c
++++ b/drivers/net/irda/irtty-sir.c
+@@ -430,16 +430,6 @@ static int irtty_open(struct tty_struct *tty)
+
+ /* Module stuff handled via irda_ldisc.owner - Jean II */
+
+- /* First make sure we're not already connected. */
+- if (tty->disc_data != NULL) {
+- priv = tty->disc_data;
+- if (priv && priv->magic == IRTTY_MAGIC) {
+- ret = -EEXIST;
+- goto out;
+- }
+- tty->disc_data = NULL; /* ### */
+- }
+-
+ /* stop the underlying driver */
+ irtty_stop_receiver(tty, TRUE);
+ if (tty->ops->stop)
+diff --git a/drivers/net/rionet.c b/drivers/net/rionet.c
+index dac7a0d9bb46..18cc2c8d5447 100644
+--- a/drivers/net/rionet.c
++++ b/drivers/net/rionet.c
+@@ -280,7 +280,7 @@ static void rionet_outb_msg_event(struct rio_mport *mport, void *dev_id, int mbo
+ struct net_device *ndev = dev_id;
+ struct rionet_private *rnet = netdev_priv(ndev);
+
+- spin_lock(&rnet->lock);
++ spin_lock(&rnet->tx_lock);
+
+ if (netif_msg_intr(rnet))
+ printk(KERN_INFO
+@@ -299,7 +299,7 @@ static void rionet_outb_msg_event(struct rio_mport *mport, void *dev_id, int mbo
+ if (rnet->tx_cnt < RIONET_TX_RING_SIZE)
+ netif_wake_queue(ndev);
+
+- spin_unlock(&rnet->lock);
++ spin_unlock(&rnet->tx_lock);
+ }
+
+ static int rionet_open(struct net_device *ndev)
+diff --git a/drivers/of/of_reserved_mem.c b/drivers/of/of_reserved_mem.c
+index dc566b38645f..2ede604ff17a 100644
+--- a/drivers/of/of_reserved_mem.c
++++ b/drivers/of/of_reserved_mem.c
+@@ -31,11 +31,13 @@ int __init __weak early_init_dt_alloc_reserved_memory_arch(phys_addr_t size,
+ phys_addr_t align, phys_addr_t start, phys_addr_t end, bool nomap,
+ phys_addr_t *res_base)
+ {
++ phys_addr_t base;
+ /*
+ * We use __memblock_alloc_base() because memblock_alloc_base()
+ * panic()s on allocation failure.
+ */
+- phys_addr_t base = __memblock_alloc_base(size, align, end);
++ end = !end ? MEMBLOCK_ALLOC_ANYWHERE : end;
++ base = __memblock_alloc_base(size, align, end);
+ if (!base)
+ return -ENOMEM;
+
+diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
+index 3010ffc9029d..3f2d424c723f 100644
+--- a/drivers/pci/probe.c
++++ b/drivers/pci/probe.c
+@@ -177,6 +177,9 @@ int __pci_read_base(struct pci_dev *dev, enum pci_bar_type type,
+ struct pci_bus_region region, inverted_region;
+ bool bar_too_big = false, bar_too_high = false, bar_invalid = false;
+
++ if (dev->non_compliant_bars)
++ return 0;
++
+ mask = type ? PCI_ROM_ADDRESS_MASK : ~0;
+
+ /* No printks while decoding is disabled! */
+@@ -985,6 +988,8 @@ void set_pcie_port_type(struct pci_dev *pdev)
+ {
+ int pos;
+ u16 reg16;
++ int type;
++ struct pci_dev *parent;
+
+ pos = pci_find_capability(pdev, PCI_CAP_ID_EXP);
+ if (!pos)
+@@ -994,6 +999,22 @@ void set_pcie_port_type(struct pci_dev *pdev)
+ pdev->pcie_flags_reg = reg16;
+ pci_read_config_word(pdev, pos + PCI_EXP_DEVCAP, ®16);
+ pdev->pcie_mpss = reg16 & PCI_EXP_DEVCAP_PAYLOAD;
++
++ /*
++ * A Root Port is always the upstream end of a Link. No PCIe
++ * component has two Links. Two Links are connected by a Switch
++ * that has a Port on each Link and internal logic to connect the
++ * two Ports.
++ */
++ type = pci_pcie_type(pdev);
++ if (type == PCI_EXP_TYPE_ROOT_PORT)
++ pdev->has_secondary_link = 1;
++ else if (type == PCI_EXP_TYPE_UPSTREAM ||
++ type == PCI_EXP_TYPE_DOWNSTREAM) {
++ parent = pci_upstream_bridge(pdev);
++ if (!parent->has_secondary_link)
++ pdev->has_secondary_link = 1;
++ }
+ }
+
+ void set_pcie_hotplug_bridge(struct pci_dev *pdev)
+@@ -1110,6 +1131,7 @@ int pci_cfg_space_size(struct pci_dev *dev)
+ int pci_setup_device(struct pci_dev *dev)
+ {
+ u32 class;
++ u16 cmd;
+ u8 hdr_type;
+ struct pci_slot *slot;
+ int pos = 0;
+@@ -1157,6 +1179,16 @@ int pci_setup_device(struct pci_dev *dev)
+ /* device class may be changed after fixup */
+ class = dev->class >> 8;
+
++ if (dev->non_compliant_bars) {
++ pci_read_config_word(dev, PCI_COMMAND, &cmd);
++ if (cmd & (PCI_COMMAND_IO | PCI_COMMAND_MEMORY)) {
++ dev_info(&dev->dev, "device has non-compliant BARs; disabling IO/MEM decoding\n");
++ cmd &= ~PCI_COMMAND_IO;
++ cmd &= ~PCI_COMMAND_MEMORY;
++ pci_write_config_word(dev, PCI_COMMAND, cmd);
++ }
++ }
++
+ switch (dev->hdr_type) { /* header type */
+ case PCI_HEADER_TYPE_NORMAL: /* standard header */
+ if (class == PCI_CLASS_BRIDGE_PCI)
+diff --git a/drivers/platform/x86/ideapad-laptop.c b/drivers/platform/x86/ideapad-laptop.c
+index 4c82e8e26125..def22e8345cb 100644
+--- a/drivers/platform/x86/ideapad-laptop.c
++++ b/drivers/platform/x86/ideapad-laptop.c
+@@ -839,6 +839,20 @@ static const struct dmi_system_id no_hw_rfkill_list[] = {
+ },
+ },
+ {
++ .ident = "Lenovo ideapad Y700-15ISK",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_PRODUCT_VERSION, "Lenovo ideapad Y700-15ISK"),
++ },
++ },
++ {
++ .ident = "Lenovo ideapad Y700 Touch-15ISK",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_PRODUCT_VERSION, "Lenovo ideapad Y700 Touch-15ISK"),
++ },
++ },
++ {
+ .ident = "Lenovo ideapad Y700-17ISK",
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+diff --git a/drivers/scsi/aacraid/commsup.c b/drivers/scsi/aacraid/commsup.c
+index cab190af6345..6b32ddcefc11 100644
+--- a/drivers/scsi/aacraid/commsup.c
++++ b/drivers/scsi/aacraid/commsup.c
+@@ -83,9 +83,12 @@ static int fib_map_alloc(struct aac_dev *dev)
+
+ void aac_fib_map_free(struct aac_dev *dev)
+ {
+- pci_free_consistent(dev->pdev,
+- dev->max_fib_size * (dev->scsi_host_ptr->can_queue + AAC_NUM_MGT_FIB),
+- dev->hw_fib_va, dev->hw_fib_pa);
++ if (dev->hw_fib_va && dev->max_fib_size) {
++ pci_free_consistent(dev->pdev,
++ (dev->max_fib_size *
++ (dev->scsi_host_ptr->can_queue + AAC_NUM_MGT_FIB)),
++ dev->hw_fib_va, dev->hw_fib_pa);
++ }
+ dev->hw_fib_va = NULL;
+ dev->hw_fib_pa = 0;
+ }
+diff --git a/drivers/scsi/be2iscsi/be_main.c b/drivers/scsi/be2iscsi/be_main.c
+index be4586b788d1..3ed37dc28b3c 100644
+--- a/drivers/scsi/be2iscsi/be_main.c
++++ b/drivers/scsi/be2iscsi/be_main.c
+@@ -4435,6 +4435,7 @@ put_shost:
+ scsi_host_put(phba->shost);
+ free_kset:
+ iscsi_boot_destroy_kset(phba->boot_kset);
++ phba->boot_kset = NULL;
+ return -ENOMEM;
+ }
+
+diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
+index a1866c0c6a57..bc09f1d196c9 100644
+--- a/drivers/scsi/sg.c
++++ b/drivers/scsi/sg.c
+@@ -652,7 +652,8 @@ sg_write(struct file *filp, const char __user *buf, size_t count, loff_t * ppos)
+ else
+ hp->dxfer_direction = (mxsize > 0) ? SG_DXFER_FROM_DEV : SG_DXFER_NONE;
+ hp->dxfer_len = mxsize;
+- if (hp->dxfer_direction == SG_DXFER_TO_DEV)
++ if ((hp->dxfer_direction == SG_DXFER_TO_DEV) ||
++ (hp->dxfer_direction == SG_DXFER_TO_FROM_DEV))
+ hp->dxferp = (char __user *)buf + cmd_size;
+ else
+ hp->dxferp = NULL;
+diff --git a/drivers/staging/comedi/drivers/ni_mio_common.c b/drivers/staging/comedi/drivers/ni_mio_common.c
+index 320b080149b6..b7588e4e3644 100644
+--- a/drivers/staging/comedi/drivers/ni_mio_common.c
++++ b/drivers/staging/comedi/drivers/ni_mio_common.c
+@@ -248,24 +248,24 @@ static void ni_writel(struct comedi_device *dev, uint32_t data, int reg)
+ {
+ if (dev->mmio)
+ writel(data, dev->mmio + reg);
+-
+- outl(data, dev->iobase + reg);
++ else
++ outl(data, dev->iobase + reg);
+ }
+
+ static void ni_writew(struct comedi_device *dev, uint16_t data, int reg)
+ {
+ if (dev->mmio)
+ writew(data, dev->mmio + reg);
+-
+- outw(data, dev->iobase + reg);
++ else
++ outw(data, dev->iobase + reg);
+ }
+
+ static void ni_writeb(struct comedi_device *dev, uint8_t data, int reg)
+ {
+ if (dev->mmio)
+ writeb(data, dev->mmio + reg);
+-
+- outb(data, dev->iobase + reg);
++ else
++ outb(data, dev->iobase + reg);
+ }
+
+ static uint32_t ni_readl(struct comedi_device *dev, int reg)
+diff --git a/drivers/staging/comedi/drivers/ni_tiocmd.c b/drivers/staging/comedi/drivers/ni_tiocmd.c
+index 26e7291c4a51..8059db6c7a76 100644
+--- a/drivers/staging/comedi/drivers/ni_tiocmd.c
++++ b/drivers/staging/comedi/drivers/ni_tiocmd.c
+@@ -94,7 +94,7 @@ static int ni_tio_input_inttrig(struct comedi_device *dev,
+ unsigned long flags;
+ int ret = 0;
+
+- if (trig_num != cmd->start_src)
++ if (trig_num != cmd->start_arg)
+ return -EINVAL;
+
+ spin_lock_irqsave(&counter->lock, flags);
+diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
+index b6051c82f386..1a487f9c2f78 100644
+--- a/drivers/target/target_core_transport.c
++++ b/drivers/target/target_core_transport.c
+@@ -2537,8 +2537,6 @@ void target_wait_for_sess_cmds(struct se_session *se_sess)
+
+ list_for_each_entry_safe(se_cmd, tmp_cmd,
+ &se_sess->sess_wait_list, se_cmd_list) {
+- list_del_init(&se_cmd->se_cmd_list);
+-
+ pr_debug("Waiting for se_cmd: %p t_state: %d, fabric state:"
+ " %d\n", se_cmd, se_cmd->t_state,
+ se_cmd->se_tfo->get_cmd_state(se_cmd));
+diff --git a/drivers/thermal/thermal_core.c b/drivers/thermal/thermal_core.c
+index 82164eb7d5b4..f23813fe1a0d 100644
+--- a/drivers/thermal/thermal_core.c
++++ b/drivers/thermal/thermal_core.c
+@@ -391,6 +391,10 @@ static void handle_thermal_trip(struct thermal_zone_device *tz, int trip)
+ {
+ enum thermal_trip_type type;
+
++ /* Ignore disabled trip points */
++ if (test_bit(trip, &tz->trips_disabled))
++ return;
++
+ tz->ops->get_trip_type(tz, trip, &type);
+
+ if (type == THERMAL_TRIP_CRITICAL || type == THERMAL_TRIP_HOT)
+@@ -1484,6 +1488,7 @@ struct thermal_zone_device *thermal_zone_device_register(const char *type,
+ {
+ struct thermal_zone_device *tz;
+ enum thermal_trip_type trip_type;
++ int trip_temp;
+ int result;
+ int count;
+ int passive = 0;
+@@ -1554,9 +1559,15 @@ struct thermal_zone_device *thermal_zone_device_register(const char *type,
+ goto unregister;
+
+ for (count = 0; count < trips; count++) {
+- tz->ops->get_trip_type(tz, count, &trip_type);
++ if (tz->ops->get_trip_type(tz, count, &trip_type))
++ set_bit(count, &tz->trips_disabled);
+ if (trip_type == THERMAL_TRIP_PASSIVE)
+ passive = 1;
++ if (tz->ops->get_trip_temp(tz, count, &trip_temp))
++ set_bit(count, &tz->trips_disabled);
++ /* Check for bogus trip points */
++ if (trip_temp == 0)
++ set_bit(count, &tz->trips_disabled);
+ }
+
+ if (!passive) {
+diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
+index 7ec2b06069c9..0dd514e86fdc 100644
+--- a/drivers/usb/class/cdc-acm.c
++++ b/drivers/usb/class/cdc-acm.c
+@@ -1109,6 +1109,9 @@ static int acm_probe(struct usb_interface *intf,
+ if (quirks == NO_UNION_NORMAL) {
+ data_interface = usb_ifnum_to_if(usb_dev, 1);
+ control_interface = usb_ifnum_to_if(usb_dev, 0);
++ /* we would crash */
++ if (!data_interface || !control_interface)
++ return -ENODEV;
+ goto skip_normal_probe;
+ }
+
+diff --git a/drivers/usb/core/driver.c b/drivers/usb/core/driver.c
+index d7a6d8bc510b..66be3b43de9f 100644
+--- a/drivers/usb/core/driver.c
++++ b/drivers/usb/core/driver.c
+@@ -499,11 +499,15 @@ static int usb_unbind_interface(struct device *dev)
+ int usb_driver_claim_interface(struct usb_driver *driver,
+ struct usb_interface *iface, void *priv)
+ {
+- struct device *dev = &iface->dev;
++ struct device *dev;
+ struct usb_device *udev;
+ int retval = 0;
+ int lpm_disable_error;
+
++ if (!iface)
++ return -ENODEV;
++
++ dev = &iface->dev;
+ if (dev->driver)
+ return -EBUSY;
+
+diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
+index fd9a20f2b6e5..d8e1d5c1b9d2 100644
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -4242,7 +4242,7 @@ hub_port_init (struct usb_hub *hub, struct usb_device *udev, int port1,
+ {
+ struct usb_device *hdev = hub->hdev;
+ struct usb_hcd *hcd = bus_to_hcd(hdev->bus);
+- int i, j, retval;
++ int retries, operations, retval, i;
+ unsigned delay = HUB_SHORT_RESET_TIME;
+ enum usb_device_speed oldspeed = udev->speed;
+ const char *speed;
+@@ -4344,7 +4344,7 @@ hub_port_init (struct usb_hub *hub, struct usb_device *udev, int port1,
+ * first 8 bytes of the device descriptor to get the ep0 maxpacket
+ * value.
+ */
+- for (i = 0; i < GET_DESCRIPTOR_TRIES; (++i, msleep(100))) {
++ for (retries = 0; retries < GET_DESCRIPTOR_TRIES; (++retries, msleep(100))) {
+ bool did_new_scheme = false;
+
+ if (use_new_scheme(udev, retry_counter)) {
+@@ -4371,7 +4371,7 @@ hub_port_init (struct usb_hub *hub, struct usb_device *udev, int port1,
+ * 255 is for WUSB devices, we actually need to use
+ * 512 (WUSB1.0[4.8.1]).
+ */
+- for (j = 0; j < 3; ++j) {
++ for (operations = 0; operations < 3; ++operations) {
+ buf->bMaxPacketSize0 = 0;
+ r = usb_control_msg(udev, usb_rcvaddr0pipe(),
+ USB_REQ_GET_DESCRIPTOR, USB_DIR_IN,
+@@ -4391,7 +4391,13 @@ hub_port_init (struct usb_hub *hub, struct usb_device *udev, int port1,
+ r = -EPROTO;
+ break;
+ }
+- if (r == 0)
++ /*
++ * Some devices time out if they are powered on
++ * when already connected. They need a second
++ * reset. But only on the first attempt,
++ * lest we get into a time out/reset loop
++ */
++ if (r == 0 || (r == -ETIMEDOUT && retries == 0))
+ break;
+ }
+ udev->descriptor.bMaxPacketSize0 =
+@@ -4423,7 +4429,7 @@ hub_port_init (struct usb_hub *hub, struct usb_device *udev, int port1,
+ * authorization will assign the final address.
+ */
+ if (udev->wusb == 0) {
+- for (j = 0; j < SET_ADDRESS_TRIES; ++j) {
++ for (operations = 0; operations < SET_ADDRESS_TRIES; ++operations) {
+ retval = hub_set_address(udev, devnum);
+ if (retval >= 0)
+ break;
+diff --git a/drivers/usb/misc/iowarrior.c b/drivers/usb/misc/iowarrior.c
+index c6bfd13f6c92..1950e87b4219 100644
+--- a/drivers/usb/misc/iowarrior.c
++++ b/drivers/usb/misc/iowarrior.c
+@@ -787,6 +787,12 @@ static int iowarrior_probe(struct usb_interface *interface,
+ iface_desc = interface->cur_altsetting;
+ dev->product_id = le16_to_cpu(udev->descriptor.idProduct);
+
++ if (iface_desc->desc.bNumEndpoints < 1) {
++ dev_err(&interface->dev, "Invalid number of endpoints\n");
++ retval = -EINVAL;
++ goto error;
++ }
++
+ /* set up the endpoint information */
+ for (i = 0; i < iface_desc->desc.bNumEndpoints; ++i) {
+ endpoint = &iface_desc->endpoint[i].desc;
+diff --git a/drivers/usb/storage/uas.c b/drivers/usb/storage/uas.c
+index 2ef0f0abe246..c6b4af82b7ed 100644
+--- a/drivers/usb/storage/uas.c
++++ b/drivers/usb/storage/uas.c
+@@ -820,7 +820,7 @@ static struct scsi_host_template uas_host_template = {
+ .slave_configure = uas_slave_configure,
+ .eh_abort_handler = uas_eh_abort_handler,
+ .eh_bus_reset_handler = uas_eh_bus_reset_handler,
+- .can_queue = 65536, /* Is there a limit on the _host_ ? */
++ .can_queue = MAX_CMNDS,
+ .this_id = -1,
+ .sg_tablesize = SG_NONE,
+ .cmd_per_lun = 1, /* until we override it */
+diff --git a/drivers/watchdog/rc32434_wdt.c b/drivers/watchdog/rc32434_wdt.c
+index 71e78ef4b736..3a75f3b53452 100644
+--- a/drivers/watchdog/rc32434_wdt.c
++++ b/drivers/watchdog/rc32434_wdt.c
+@@ -237,7 +237,7 @@ static long rc32434_wdt_ioctl(struct file *file, unsigned int cmd,
+ return -EINVAL;
+ /* Fall through */
+ case WDIOC_GETTIMEOUT:
+- return copy_to_user(argp, &timeout, sizeof(int));
++ return copy_to_user(argp, &timeout, sizeof(int)) ? -EFAULT : 0;
+ default:
+ return -ENOTTY;
+ }
+diff --git a/fs/btrfs/async-thread.c b/fs/btrfs/async-thread.c
+index 4dabeb893b7c..dcc1aae4c951 100644
+--- a/fs/btrfs/async-thread.c
++++ b/fs/btrfs/async-thread.c
+@@ -316,8 +316,8 @@ static inline void __btrfs_queue_work(struct __btrfs_workqueue *wq,
+ list_add_tail(&work->ordered_list, &wq->ordered_list);
+ spin_unlock_irqrestore(&wq->list_lock, flags);
+ }
+- queue_work(wq->normal_wq, &work->normal_work);
+ trace_btrfs_work_queued(work);
++ queue_work(wq->normal_wq, &work->normal_work);
+ }
+
+ void btrfs_queue_work(struct btrfs_workqueue *wq,
+diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
+index b1709831b1a1..5177954e1a2c 100644
+--- a/fs/btrfs/disk-io.c
++++ b/fs/btrfs/disk-io.c
+@@ -2418,6 +2418,7 @@ int open_ctree(struct super_block *sb,
+ if (btrfs_check_super_csum(bh->b_data)) {
+ printk(KERN_ERR "BTRFS: superblock checksum mismatch\n");
+ err = -EINVAL;
++ brelse(bh);
+ goto fail_alloc;
+ }
+
+diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
+index 211f19aa56ba..c8d287fff7bc 100644
+--- a/fs/btrfs/inode.c
++++ b/fs/btrfs/inode.c
+@@ -6092,7 +6092,7 @@ out_unlock_inode:
+ static int btrfs_link(struct dentry *old_dentry, struct inode *dir,
+ struct dentry *dentry)
+ {
+- struct btrfs_trans_handle *trans;
++ struct btrfs_trans_handle *trans = NULL;
+ struct btrfs_root *root = BTRFS_I(dir)->root;
+ struct inode *inode = old_dentry->d_inode;
+ u64 index;
+@@ -6118,6 +6118,7 @@ static int btrfs_link(struct dentry *old_dentry, struct inode *dir,
+ trans = btrfs_start_transaction(root, 5);
+ if (IS_ERR(trans)) {
+ err = PTR_ERR(trans);
++ trans = NULL;
+ goto fail;
+ }
+
+@@ -6151,9 +6152,10 @@ static int btrfs_link(struct dentry *old_dentry, struct inode *dir,
+ btrfs_log_new_name(trans, inode, NULL, parent);
+ }
+
+- btrfs_end_transaction(trans, root);
+ btrfs_balance_delayed_items(root);
+ fail:
++ if (trans)
++ btrfs_end_transaction(trans, root);
+ if (drop_inode) {
+ inode_dec_link_count(inode);
+ iput(inode);
+@@ -8053,15 +8055,28 @@ int btrfs_readpage(struct file *file, struct page *page)
+ static int btrfs_writepage(struct page *page, struct writeback_control *wbc)
+ {
+ struct extent_io_tree *tree;
+-
++ struct inode *inode = page->mapping->host;
++ int ret;
+
+ if (current->flags & PF_MEMALLOC) {
+ redirty_page_for_writepage(wbc, page);
+ unlock_page(page);
+ return 0;
+ }
++
++ /*
++ * If we are under memory pressure we will call this directly from the
++ * VM, we need to make sure we have the inode referenced for the ordered
++ * extent. If not just return like we didn't do anything.
++ */
++ if (!igrab(inode)) {
++ redirty_page_for_writepage(wbc, page);
++ return AOP_WRITEPAGE_ACTIVATE;
++ }
+ tree = &BTRFS_I(page->mapping->host)->io_tree;
+- return extent_write_full_page(tree, page, btrfs_get_extent, wbc);
++ ret = extent_write_full_page(tree, page, btrfs_get_extent, wbc);
++ btrfs_add_delayed_iput(inode);
++ return ret;
+ }
+
+ static int btrfs_writepages(struct address_space *mapping,
+@@ -9137,9 +9152,11 @@ static int btrfs_symlink(struct inode *dir, struct dentry *dentry,
+ /*
+ * 2 items for inode item and ref
+ * 2 items for dir items
++ * 1 item for updating parent inode item
++ * 1 item for the inline extent item
+ * 1 item for xattr if selinux is on
+ */
+- trans = btrfs_start_transaction(root, 5);
++ trans = btrfs_start_transaction(root, 7);
+ if (IS_ERR(trans))
+ return PTR_ERR(trans);
+
+diff --git a/fs/btrfs/send.c b/fs/btrfs/send.c
+index 874828dd0a86..3cc2d1dfd7bf 100644
+--- a/fs/btrfs/send.c
++++ b/fs/btrfs/send.c
+@@ -1461,7 +1461,21 @@ static int read_symlink(struct btrfs_root *root,
+ ret = btrfs_search_slot(NULL, root, &key, path, 0, 0);
+ if (ret < 0)
+ goto out;
+- BUG_ON(ret);
++ if (ret) {
++ /*
++ * An empty symlink inode. Can happen in rare error paths when
++ * creating a symlink (transaction committed before the inode
++ * eviction handler removed the symlink inode items and a crash
++ * happened in between or the subvol was snapshoted in between).
++ * Print an informative message to dmesg/syslog so that the user
++ * can delete the symlink.
++ */
++ btrfs_err(root->fs_info,
++ "Found empty symlink inode %llu at root %llu",
++ ino, root->root_key.objectid);
++ ret = -EIO;
++ goto out;
++ }
+
+ ei = btrfs_item_ptr(path->nodes[0], path->slots[0],
+ struct btrfs_file_extent_item);
+diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c
+index 2105555657fc..7ceaaf2010f9 100644
+--- a/fs/btrfs/super.c
++++ b/fs/btrfs/super.c
+@@ -1775,6 +1775,8 @@ static int btrfs_calc_avail_data_space(struct btrfs_root *root, u64 *free_bytes)
+ * there are other factors that may change the result (like a new metadata
+ * chunk).
+ *
++ * If metadata is exhausted, f_bavail will be 0.
++ *
+ * FIXME: not accurate for mixed block groups, total and free/used are ok,
+ * available appears slightly larger.
+ */
+@@ -1786,11 +1788,13 @@ static int btrfs_statfs(struct dentry *dentry, struct kstatfs *buf)
+ struct btrfs_space_info *found;
+ u64 total_used = 0;
+ u64 total_free_data = 0;
++ u64 total_free_meta = 0;
+ int bits = dentry->d_sb->s_blocksize_bits;
+ __be32 *fsid = (__be32 *)fs_info->fsid;
+ unsigned factor = 1;
+ struct btrfs_block_rsv *block_rsv = &fs_info->global_block_rsv;
+ int ret;
++ u64 thresh = 0;
+
+ /*
+ * holding chunk_muext to avoid allocating new chunks, holding
+@@ -1818,6 +1822,8 @@ static int btrfs_statfs(struct dentry *dentry, struct kstatfs *buf)
+ }
+ }
+ }
++ if (found->flags & BTRFS_BLOCK_GROUP_METADATA)
++ total_free_meta += found->disk_total - found->disk_used;
+
+ total_used += found->disk_used;
+ }
+@@ -1845,6 +1851,24 @@ static int btrfs_statfs(struct dentry *dentry, struct kstatfs *buf)
+ mutex_unlock(&fs_info->chunk_mutex);
+ mutex_unlock(&fs_info->fs_devices->device_list_mutex);
+
++ /*
++ * We calculate the remaining metadata space minus global reserve. If
++ * this is (supposedly) smaller than zero, there's no space. But this
++ * does not hold in practice, the exhausted state happens where's still
++ * some positive delta. So we apply some guesswork and compare the
++ * delta to a 4M threshold. (Practically observed delta was ~2M.)
++ *
++ * We probably cannot calculate the exact threshold value because this
++ * depends on the internal reservations requested by various
++ * operations, so some operations that consume a few metadata will
++ * succeed even if the Avail is zero. But this is better than the other
++ * way around.
++ */
++ thresh = 4 * 1024 * 1024;
++
++ if (total_free_meta - thresh < block_rsv->size)
++ buf->f_bavail = 0;
++
+ buf->f_type = BTRFS_SUPER_MAGIC;
+ buf->f_bsize = dentry->d_sb->s_blocksize;
+ buf->f_namelen = BTRFS_NAME_LEN;
+diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
+index d47289c715c8..25df49239ceb 100644
+--- a/fs/btrfs/volumes.c
++++ b/fs/btrfs/volumes.c
+@@ -162,6 +162,7 @@ static struct btrfs_device *__alloc_device(void)
+ spin_lock_init(&dev->reada_lock);
+ atomic_set(&dev->reada_in_flight, 0);
+ atomic_set(&dev->dev_stats_ccnt, 0);
++ btrfs_device_data_ordered_init(dev);
+ INIT_RADIX_TREE(&dev->reada_zones, GFP_NOFS & ~__GFP_WAIT);
+ INIT_RADIX_TREE(&dev->reada_extents, GFP_NOFS & ~__GFP_WAIT);
+
+diff --git a/fs/coredump.c b/fs/coredump.c
+index 00d75e82f6f2..7eb6181184ea 100644
+--- a/fs/coredump.c
++++ b/fs/coredump.c
+@@ -32,6 +32,9 @@
+ #include <linux/pipe_fs_i.h>
+ #include <linux/oom.h>
+ #include <linux/compat.h>
++#include <linux/sched.h>
++#include <linux/fs.h>
++#include <linux/path.h>
+
+ #include <asm/uaccess.h>
+ #include <asm/mmu_context.h>
+@@ -621,6 +624,8 @@ void do_coredump(const siginfo_t *siginfo)
+ }
+ } else {
+ struct inode *inode;
++ int open_flags = O_CREAT | O_RDWR | O_NOFOLLOW |
++ O_LARGEFILE | O_EXCL;
+
+ if (cprm.limit < binfmt->min_coredump)
+ goto fail_unlock;
+@@ -659,10 +664,27 @@ void do_coredump(const siginfo_t *siginfo)
+ * what matters is that at least one of the two processes
+ * writes its coredump successfully, not which one.
+ */
+- cprm.file = filp_open(cn.corename,
+- O_CREAT | 2 | O_NOFOLLOW |
+- O_LARGEFILE | O_EXCL,
+- 0600);
++ if (need_suid_safe) {
++ /*
++ * Using user namespaces, normal user tasks can change
++ * their current->fs->root to point to arbitrary
++ * directories. Since the intention of the "only dump
++ * with a fully qualified path" rule is to control where
++ * coredumps may be placed using root privileges,
++ * current->fs->root must not be used. Instead, use the
++ * root directory of init_task.
++ */
++ struct path root;
++
++ task_lock(&init_task);
++ get_fs_root(init_task.fs, &root);
++ task_unlock(&init_task);
++ cprm.file = file_open_root(root.dentry, root.mnt,
++ cn.corename, open_flags, 0600);
++ path_put(&root);
++ } else {
++ cprm.file = filp_open(cn.corename, open_flags, 0600);
++ }
+ if (IS_ERR(cprm.file))
+ goto fail_unlock;
+
+diff --git a/fs/efivarfs/file.c b/fs/efivarfs/file.c
+index cdb2971192a5..174bb20042b3 100644
+--- a/fs/efivarfs/file.c
++++ b/fs/efivarfs/file.c
+@@ -10,6 +10,7 @@
+ #include <linux/efi.h>
+ #include <linux/fs.h>
+ #include <linux/slab.h>
++#include <linux/mount.h>
+
+ #include "internal.h"
+
+@@ -103,9 +104,79 @@ out_free:
+ return size;
+ }
+
++static int
++efivarfs_ioc_getxflags(struct file *file, void __user *arg)
++{
++ struct inode *inode = file->f_mapping->host;
++ unsigned int i_flags;
++ unsigned int flags = 0;
++
++ i_flags = inode->i_flags;
++ if (i_flags & S_IMMUTABLE)
++ flags |= FS_IMMUTABLE_FL;
++
++ if (copy_to_user(arg, &flags, sizeof(flags)))
++ return -EFAULT;
++ return 0;
++}
++
++static int
++efivarfs_ioc_setxflags(struct file *file, void __user *arg)
++{
++ struct inode *inode = file->f_mapping->host;
++ unsigned int flags;
++ unsigned int i_flags = 0;
++ int error;
++
++ if (!inode_owner_or_capable(inode))
++ return -EACCES;
++
++ if (copy_from_user(&flags, arg, sizeof(flags)))
++ return -EFAULT;
++
++ if (flags & ~FS_IMMUTABLE_FL)
++ return -EOPNOTSUPP;
++
++ if (!capable(CAP_LINUX_IMMUTABLE))
++ return -EPERM;
++
++ if (flags & FS_IMMUTABLE_FL)
++ i_flags |= S_IMMUTABLE;
++
++
++ error = mnt_want_write_file(file);
++ if (error)
++ return error;
++
++ mutex_lock(&inode->i_mutex);
++ inode->i_flags &= ~S_IMMUTABLE;
++ inode->i_flags |= i_flags;
++ mutex_unlock(&inode->i_mutex);
++
++ mnt_drop_write_file(file);
++
++ return 0;
++}
++
++long
++efivarfs_file_ioctl(struct file *file, unsigned int cmd, unsigned long p)
++{
++ void __user *arg = (void __user *)p;
++
++ switch (cmd) {
++ case FS_IOC_GETFLAGS:
++ return efivarfs_ioc_getxflags(file, arg);
++ case FS_IOC_SETFLAGS:
++ return efivarfs_ioc_setxflags(file, arg);
++ }
++
++ return -ENOTTY;
++}
++
+ const struct file_operations efivarfs_file_operations = {
+ .open = simple_open,
+ .read = efivarfs_file_read,
+ .write = efivarfs_file_write,
+ .llseek = no_llseek,
++ .unlocked_ioctl = efivarfs_file_ioctl,
+ };
+diff --git a/fs/efivarfs/inode.c b/fs/efivarfs/inode.c
+index 07ab49745e31..7e7318f10575 100644
+--- a/fs/efivarfs/inode.c
++++ b/fs/efivarfs/inode.c
+@@ -15,7 +15,8 @@
+ #include "internal.h"
+
+ struct inode *efivarfs_get_inode(struct super_block *sb,
+- const struct inode *dir, int mode, dev_t dev)
++ const struct inode *dir, int mode,
++ dev_t dev, bool is_removable)
+ {
+ struct inode *inode = new_inode(sb);
+
+@@ -23,6 +24,7 @@ struct inode *efivarfs_get_inode(struct super_block *sb,
+ inode->i_ino = get_next_ino();
+ inode->i_mode = mode;
+ inode->i_atime = inode->i_mtime = inode->i_ctime = CURRENT_TIME;
++ inode->i_flags = is_removable ? 0 : S_IMMUTABLE;
+ switch (mode & S_IFMT) {
+ case S_IFREG:
+ inode->i_fop = &efivarfs_file_operations;
+@@ -102,22 +104,17 @@ static void efivarfs_hex_to_guid(const char *str, efi_guid_t *guid)
+ static int efivarfs_create(struct inode *dir, struct dentry *dentry,
+ umode_t mode, bool excl)
+ {
+- struct inode *inode;
++ struct inode *inode = NULL;
+ struct efivar_entry *var;
+ int namelen, i = 0, err = 0;
++ bool is_removable = false;
+
+ if (!efivarfs_valid_name(dentry->d_name.name, dentry->d_name.len))
+ return -EINVAL;
+
+- inode = efivarfs_get_inode(dir->i_sb, dir, mode, 0);
+- if (!inode)
+- return -ENOMEM;
+-
+ var = kzalloc(sizeof(struct efivar_entry), GFP_KERNEL);
+- if (!var) {
+- err = -ENOMEM;
+- goto out;
+- }
++ if (!var)
++ return -ENOMEM;
+
+ /* length of the variable name itself: remove GUID and separator */
+ namelen = dentry->d_name.len - EFI_VARIABLE_GUID_LEN - 1;
+@@ -125,6 +122,16 @@ static int efivarfs_create(struct inode *dir, struct dentry *dentry,
+ efivarfs_hex_to_guid(dentry->d_name.name + namelen + 1,
+ &var->var.VendorGuid);
+
++ if (efivar_variable_is_removable(var->var.VendorGuid,
++ dentry->d_name.name, namelen))
++ is_removable = true;
++
++ inode = efivarfs_get_inode(dir->i_sb, dir, mode, 0, is_removable);
++ if (!inode) {
++ err = -ENOMEM;
++ goto out;
++ }
++
+ for (i = 0; i < namelen; i++)
+ var->var.VariableName[i] = dentry->d_name.name[i];
+
+@@ -138,7 +145,8 @@ static int efivarfs_create(struct inode *dir, struct dentry *dentry,
+ out:
+ if (err) {
+ kfree(var);
+- iput(inode);
++ if (inode)
++ iput(inode);
+ }
+ return err;
+ }
+diff --git a/fs/efivarfs/internal.h b/fs/efivarfs/internal.h
+index b5ff16addb7c..b4505188e799 100644
+--- a/fs/efivarfs/internal.h
++++ b/fs/efivarfs/internal.h
+@@ -15,7 +15,8 @@ extern const struct file_operations efivarfs_file_operations;
+ extern const struct inode_operations efivarfs_dir_inode_operations;
+ extern bool efivarfs_valid_name(const char *str, int len);
+ extern struct inode *efivarfs_get_inode(struct super_block *sb,
+- const struct inode *dir, int mode, dev_t dev);
++ const struct inode *dir, int mode, dev_t dev,
++ bool is_removable);
+
+ extern struct list_head efivarfs_list;
+
+diff --git a/fs/efivarfs/super.c b/fs/efivarfs/super.c
+index c2f421c30ccd..b57db0c6c2af 100644
+--- a/fs/efivarfs/super.c
++++ b/fs/efivarfs/super.c
+@@ -118,8 +118,9 @@ static int efivarfs_callback(efi_char16_t *name16, efi_guid_t vendor,
+ struct dentry *dentry, *root = sb->s_root;
+ unsigned long size = 0;
+ char *name;
+- int len, i;
++ int len;
+ int err = -ENOMEM;
++ bool is_removable = false;
+
+ entry = kzalloc(sizeof(*entry), GFP_KERNEL);
+ if (!entry)
+@@ -128,15 +129,17 @@ static int efivarfs_callback(efi_char16_t *name16, efi_guid_t vendor,
+ memcpy(entry->var.VariableName, name16, name_size);
+ memcpy(&(entry->var.VendorGuid), &vendor, sizeof(efi_guid_t));
+
+- len = ucs2_strlen(entry->var.VariableName);
++ len = ucs2_utf8size(entry->var.VariableName);
+
+ /* name, plus '-', plus GUID, plus NUL*/
+ name = kmalloc(len + 1 + EFI_VARIABLE_GUID_LEN + 1, GFP_KERNEL);
+ if (!name)
+ goto fail;
+
+- for (i = 0; i < len; i++)
+- name[i] = entry->var.VariableName[i] & 0xFF;
++ ucs2_as_utf8(name, entry->var.VariableName, len);
++
++ if (efivar_variable_is_removable(entry->var.VendorGuid, name, len))
++ is_removable = true;
+
+ name[len] = '-';
+
+@@ -144,7 +147,8 @@ static int efivarfs_callback(efi_char16_t *name16, efi_guid_t vendor,
+
+ name[len + EFI_VARIABLE_GUID_LEN+1] = '\0';
+
+- inode = efivarfs_get_inode(sb, root->d_inode, S_IFREG | 0644, 0);
++ inode = efivarfs_get_inode(sb, root->d_inode, S_IFREG | 0644, 0,
++ is_removable);
+ if (!inode)
+ goto fail_name;
+
+@@ -200,7 +204,7 @@ static int efivarfs_fill_super(struct super_block *sb, void *data, int silent)
+ sb->s_d_op = &efivarfs_d_ops;
+ sb->s_time_gran = 1;
+
+- inode = efivarfs_get_inode(sb, NULL, S_IFDIR | 0755, 0);
++ inode = efivarfs_get_inode(sb, NULL, S_IFDIR | 0755, 0, true);
+ if (!inode)
+ return -ENOMEM;
+ inode->i_op = &efivarfs_dir_inode_operations;
+diff --git a/fs/ext4/move_extent.c b/fs/ext4/move_extent.c
+index 165f309bafcc..f498c34b4688 100644
+--- a/fs/ext4/move_extent.c
++++ b/fs/ext4/move_extent.c
+@@ -397,6 +397,7 @@ data_copy:
+ *err = ext4_get_block(orig_inode, orig_blk_offset + i, bh, 0);
+ if (*err < 0)
+ break;
++ bh = bh->b_this_page;
+ }
+ if (!*err)
+ *err = block_commit_write(pagep[0], from, from + replaced_size);
+diff --git a/fs/fhandle.c b/fs/fhandle.c
+index d59712dfa3e7..ca3c3dd01789 100644
+--- a/fs/fhandle.c
++++ b/fs/fhandle.c
+@@ -228,7 +228,7 @@ long do_handle_open(int mountdirfd,
+ path_put(&path);
+ return fd;
+ }
+- file = file_open_root(path.dentry, path.mnt, "", open_flag);
++ file = file_open_root(path.dentry, path.mnt, "", open_flag, 0);
+ if (IS_ERR(file)) {
+ put_unused_fd(fd);
+ retval = PTR_ERR(file);
+diff --git a/fs/fuse/file.c b/fs/fuse/file.c
+index caa8d95b24e8..e2a2c14a90ee 100644
+--- a/fs/fuse/file.c
++++ b/fs/fuse/file.c
+@@ -1088,6 +1088,7 @@ static ssize_t fuse_fill_write_pages(struct fuse_req *req,
+ tmp = iov_iter_copy_from_user_atomic(page, ii, offset, bytes);
+ flush_dcache_page(page);
+
++ iov_iter_advance(ii, tmp);
+ if (!tmp) {
+ unlock_page(page);
+ page_cache_release(page);
+@@ -1100,7 +1101,6 @@ static ssize_t fuse_fill_write_pages(struct fuse_req *req,
+ req->page_descs[req->num_pages].length = tmp;
+ req->num_pages++;
+
+- iov_iter_advance(ii, tmp);
+ count += tmp;
+ pos += tmp;
+ offset += tmp;
+diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c
+index 07e87ec45709..985e95b9b4ef 100644
+--- a/fs/jbd2/journal.c
++++ b/fs/jbd2/journal.c
+@@ -1423,11 +1423,12 @@ out:
+ /**
+ * jbd2_mark_journal_empty() - Mark on disk journal as empty.
+ * @journal: The journal to update.
++ * @write_op: With which operation should we write the journal sb
+ *
+ * Update a journal's dynamic superblock fields to show that journal is empty.
+ * Write updated superblock to disk waiting for IO to complete.
+ */
+-static void jbd2_mark_journal_empty(journal_t *journal)
++static void jbd2_mark_journal_empty(journal_t *journal, int write_op)
+ {
+ journal_superblock_t *sb = journal->j_superblock;
+
+@@ -1445,7 +1446,7 @@ static void jbd2_mark_journal_empty(journal_t *journal)
+ sb->s_start = cpu_to_be32(0);
+ read_unlock(&journal->j_state_lock);
+
+- jbd2_write_superblock(journal, WRITE_FUA);
++ jbd2_write_superblock(journal, write_op);
+
+ /* Log is no longer empty */
+ write_lock(&journal->j_state_lock);
+@@ -1730,7 +1731,13 @@ int jbd2_journal_destroy(journal_t *journal)
+ if (journal->j_sb_buffer) {
+ if (!is_journal_aborted(journal)) {
+ mutex_lock(&journal->j_checkpoint_mutex);
+- jbd2_mark_journal_empty(journal);
++
++ write_lock(&journal->j_state_lock);
++ journal->j_tail_sequence =
++ ++journal->j_transaction_sequence;
++ write_unlock(&journal->j_state_lock);
++
++ jbd2_mark_journal_empty(journal, WRITE_FLUSH_FUA);
+ mutex_unlock(&journal->j_checkpoint_mutex);
+ } else
+ err = -EIO;
+@@ -1990,7 +1997,7 @@ int jbd2_journal_flush(journal_t *journal)
+ * the magic code for a fully-recovered superblock. Any future
+ * commits of data to the journal will restore the current
+ * s_start value. */
+- jbd2_mark_journal_empty(journal);
++ jbd2_mark_journal_empty(journal, WRITE_FUA);
+ mutex_unlock(&journal->j_checkpoint_mutex);
+ write_lock(&journal->j_state_lock);
+ J_ASSERT(!journal->j_running_transaction);
+@@ -2036,7 +2043,7 @@ int jbd2_journal_wipe(journal_t *journal, int write)
+ if (write) {
+ /* Lock to make assertions happy... */
+ mutex_lock(&journal->j_checkpoint_mutex);
+- jbd2_mark_journal_empty(journal);
++ jbd2_mark_journal_empty(journal, WRITE_FUA);
+ mutex_unlock(&journal->j_checkpoint_mutex);
+ }
+
+diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
+index 6ed585935d5e..606d5aa33d76 100644
+--- a/fs/nfsd/nfs4proc.c
++++ b/fs/nfsd/nfs4proc.c
+@@ -878,6 +878,7 @@ nfsd4_secinfo(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
+ &exp, &dentry);
+ if (err)
+ return err;
++ fh_unlock(&cstate->current_fh);
+ if (dentry->d_inode == NULL) {
+ exp_put(exp);
+ err = nfserr_noent;
+diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
+index 0fd2f1c76e60..dc7fd83409da 100644
+--- a/fs/nfsd/nfs4xdr.c
++++ b/fs/nfsd/nfs4xdr.c
+@@ -1061,8 +1061,9 @@ nfsd4_decode_rename(struct nfsd4_compoundargs *argp, struct nfsd4_rename *rename
+
+ READ_BUF(4);
+ rename->rn_snamelen = be32_to_cpup(p++);
+- READ_BUF(rename->rn_snamelen + 4);
++ READ_BUF(rename->rn_snamelen);
+ SAVEMEM(rename->rn_sname, rename->rn_snamelen);
++ READ_BUF(4);
+ rename->rn_tnamelen = be32_to_cpup(p++);
+ READ_BUF(rename->rn_tnamelen);
+ SAVEMEM(rename->rn_tname, rename->rn_tnamelen);
+@@ -1144,13 +1145,14 @@ nfsd4_decode_setclientid(struct nfsd4_compoundargs *argp, struct nfsd4_setclient
+ READ_BUF(8);
+ setclientid->se_callback_prog = be32_to_cpup(p++);
+ setclientid->se_callback_netid_len = be32_to_cpup(p++);
+-
+- READ_BUF(setclientid->se_callback_netid_len + 4);
++ READ_BUF(setclientid->se_callback_netid_len);
+ SAVEMEM(setclientid->se_callback_netid_val, setclientid->se_callback_netid_len);
++ READ_BUF(4);
+ setclientid->se_callback_addr_len = be32_to_cpup(p++);
+
+- READ_BUF(setclientid->se_callback_addr_len + 4);
++ READ_BUF(setclientid->se_callback_addr_len);
+ SAVEMEM(setclientid->se_callback_addr_val, setclientid->se_callback_addr_len);
++ READ_BUF(4);
+ setclientid->se_callback_ident = be32_to_cpup(p++);
+
+ DECODE_TAIL;
+@@ -1646,8 +1648,9 @@ nfsd4_decode_compound(struct nfsd4_compoundargs *argp)
+
+ READ_BUF(4);
+ argp->taglen = be32_to_cpup(p++);
+- READ_BUF(argp->taglen + 8);
++ READ_BUF(argp->taglen);
+ SAVEMEM(argp->tag, argp->taglen);
++ READ_BUF(8);
+ argp->minorversion = be32_to_cpup(p++);
+ argp->opcnt = be32_to_cpup(p++);
+ max_reply += 4 + (XDR_QUADLEN(argp->taglen) << 2);
+diff --git a/fs/ocfs2/dlm/dlmconvert.c b/fs/ocfs2/dlm/dlmconvert.c
+index e36d63ff1783..f90931335c6b 100644
+--- a/fs/ocfs2/dlm/dlmconvert.c
++++ b/fs/ocfs2/dlm/dlmconvert.c
+@@ -262,6 +262,7 @@ enum dlm_status dlmconvert_remote(struct dlm_ctxt *dlm,
+ struct dlm_lock *lock, int flags, int type)
+ {
+ enum dlm_status status;
++ u8 old_owner = res->owner;
+
+ mlog(0, "type=%d, convert_type=%d, busy=%d\n", lock->ml.type,
+ lock->ml.convert_type, res->state & DLM_LOCK_RES_IN_PROGRESS);
+@@ -287,6 +288,19 @@ enum dlm_status dlmconvert_remote(struct dlm_ctxt *dlm,
+ status = DLM_DENIED;
+ goto bail;
+ }
++
++ if (lock->ml.type == type && lock->ml.convert_type == LKM_IVMODE) {
++ mlog(0, "last convert request returned DLM_RECOVERING, but "
++ "owner has already queued and sent ast to me. res %.*s, "
++ "(cookie=%u:%llu, type=%d, conv=%d)\n",
++ res->lockname.len, res->lockname.name,
++ dlm_get_lock_cookie_node(be64_to_cpu(lock->ml.cookie)),
++ dlm_get_lock_cookie_seq(be64_to_cpu(lock->ml.cookie)),
++ lock->ml.type, lock->ml.convert_type);
++ status = DLM_NORMAL;
++ goto bail;
++ }
++
+ res->state |= DLM_LOCK_RES_IN_PROGRESS;
+ /* move lock to local convert queue */
+ /* do not alter lock refcount. switching lists. */
+@@ -316,11 +330,19 @@ enum dlm_status dlmconvert_remote(struct dlm_ctxt *dlm,
+ spin_lock(&res->spinlock);
+ res->state &= ~DLM_LOCK_RES_IN_PROGRESS;
+ lock->convert_pending = 0;
+- /* if it failed, move it back to granted queue */
++ /* if it failed, move it back to granted queue.
++ * if master returns DLM_NORMAL and then down before sending ast,
++ * it may have already been moved to granted queue, reset to
++ * DLM_RECOVERING and retry convert */
+ if (status != DLM_NORMAL) {
+ if (status != DLM_NOTQUEUED)
+ dlm_error(status);
+ dlm_revert_pending_convert(res, lock);
++ } else if ((res->state & DLM_LOCK_RES_RECOVERING) ||
++ (old_owner != res->owner)) {
++ mlog(0, "res %.*s is in recovering or has been recovered.\n",
++ res->lockname.len, res->lockname.name);
++ status = DLM_RECOVERING;
+ }
+ bail:
+ spin_unlock(&res->spinlock);
+diff --git a/fs/ocfs2/dlm/dlmrecovery.c b/fs/ocfs2/dlm/dlmrecovery.c
+index 450363628f98..3a78afb14b16 100644
+--- a/fs/ocfs2/dlm/dlmrecovery.c
++++ b/fs/ocfs2/dlm/dlmrecovery.c
+@@ -2056,7 +2056,6 @@ void dlm_move_lockres_to_recovery_list(struct dlm_ctxt *dlm,
+ dlm_lock_get(lock);
+ if (lock->convert_pending) {
+ /* move converting lock back to granted */
+- BUG_ON(i != DLM_CONVERTING_LIST);
+ mlog(0, "node died with convert pending "
+ "on %.*s. move back to granted list.\n",
+ res->lockname.len, res->lockname.name);
+diff --git a/fs/open.c b/fs/open.c
+index d058ff1b841b..1651f35d50f5 100644
+--- a/fs/open.c
++++ b/fs/open.c
+@@ -968,14 +968,12 @@ struct file *filp_open(const char *filename, int flags, umode_t mode)
+ EXPORT_SYMBOL(filp_open);
+
+ struct file *file_open_root(struct dentry *dentry, struct vfsmount *mnt,
+- const char *filename, int flags)
++ const char *filename, int flags, umode_t mode)
+ {
+ struct open_flags op;
+- int err = build_open_flags(flags, 0, &op);
++ int err = build_open_flags(flags, mode, &op);
+ if (err)
+ return ERR_PTR(err);
+- if (flags & O_CREAT)
+- return ERR_PTR(-EINVAL);
+ if (!filename && (flags & O_DIRECTORY))
+ if (!dentry->d_inode->i_op->lookup)
+ return ERR_PTR(-ENOTDIR);
+diff --git a/fs/overlayfs/inode.c b/fs/overlayfs/inode.c
+index 8774ebb5d80a..e696ba32a2b5 100644
+--- a/fs/overlayfs/inode.c
++++ b/fs/overlayfs/inode.c
+@@ -49,15 +49,15 @@ int ovl_setattr(struct dentry *dentry, struct iattr *attr)
+ if (err)
+ goto out;
+
+- upperdentry = ovl_dentry_upper(dentry);
+- if (upperdentry) {
++ err = ovl_copy_up(dentry);
++ if (!err) {
++ upperdentry = ovl_dentry_upper(dentry);
++
+ mutex_lock(&upperdentry->d_inode->i_mutex);
+ err = notify_change(upperdentry, attr, NULL);
+ if (!err)
+ ovl_copyattr(upperdentry->d_inode, dentry->d_inode);
+ mutex_unlock(&upperdentry->d_inode->i_mutex);
+- } else {
+- err = ovl_copy_up_last(dentry, attr, false);
+ }
+ ovl_drop_write(dentry);
+ out:
+diff --git a/fs/proc/array.c b/fs/proc/array.c
+index cd3653e4f35c..16226e24ec48 100644
+--- a/fs/proc/array.c
++++ b/fs/proc/array.c
+@@ -391,7 +391,7 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,
+
+ state = *get_task_state(task);
+ vsize = eip = esp = 0;
+- permitted = ptrace_may_access(task, PTRACE_MODE_READ | PTRACE_MODE_NOAUDIT);
++ permitted = ptrace_may_access(task, PTRACE_MODE_READ_FSCREDS | PTRACE_MODE_NOAUDIT);
+ mm = get_task_mm(task);
+ if (mm) {
+ vsize = task_vsize(mm);
+diff --git a/fs/proc/base.c b/fs/proc/base.c
+index 7dc3ea89ef1a..76b296fe93c9 100644
+--- a/fs/proc/base.c
++++ b/fs/proc/base.c
+@@ -211,7 +211,7 @@ static int proc_pid_cmdline(struct seq_file *m, struct pid_namespace *ns,
+ static int proc_pid_auxv(struct seq_file *m, struct pid_namespace *ns,
+ struct pid *pid, struct task_struct *task)
+ {
+- struct mm_struct *mm = mm_access(task, PTRACE_MODE_READ);
++ struct mm_struct *mm = mm_access(task, PTRACE_MODE_READ_FSCREDS);
+ if (mm && !IS_ERR(mm)) {
+ unsigned int nwords = 0;
+ do {
+@@ -239,7 +239,7 @@ static int proc_pid_wchan(struct seq_file *m, struct pid_namespace *ns,
+ wchan = get_wchan(task);
+
+ if (lookup_symbol_name(wchan, symname) < 0)
+- if (!ptrace_may_access(task, PTRACE_MODE_READ))
++ if (!ptrace_may_access(task, PTRACE_MODE_READ_FSCREDS))
+ return 0;
+ else
+ return seq_printf(m, "%lu", wchan);
+@@ -253,7 +253,7 @@ static int lock_trace(struct task_struct *task)
+ int err = mutex_lock_killable(&task->signal->cred_guard_mutex);
+ if (err)
+ return err;
+- if (!ptrace_may_access(task, PTRACE_MODE_ATTACH)) {
++ if (!ptrace_may_access(task, PTRACE_MODE_ATTACH_FSCREDS)) {
+ mutex_unlock(&task->signal->cred_guard_mutex);
+ return -EPERM;
+ }
+@@ -496,7 +496,7 @@ static int proc_fd_access_allowed(struct inode *inode)
+ */
+ task = get_proc_task(inode);
+ if (task) {
+- allowed = ptrace_may_access(task, PTRACE_MODE_READ);
++ allowed = ptrace_may_access(task, PTRACE_MODE_READ_FSCREDS);
+ put_task_struct(task);
+ }
+ return allowed;
+@@ -531,7 +531,7 @@ static bool has_pid_permissions(struct pid_namespace *pid,
+ return true;
+ if (in_group_p(pid->pid_gid))
+ return true;
+- return ptrace_may_access(task, PTRACE_MODE_READ);
++ return ptrace_may_access(task, PTRACE_MODE_READ_FSCREDS);
+ }
+
+
+@@ -608,7 +608,7 @@ struct mm_struct *proc_mem_open(struct inode *inode, unsigned int mode)
+ struct mm_struct *mm = ERR_PTR(-ESRCH);
+
+ if (task) {
+- mm = mm_access(task, mode);
++ mm = mm_access(task, mode | PTRACE_MODE_FSCREDS);
+ put_task_struct(task);
+
+ if (!IS_ERR_OR_NULL(mm)) {
+@@ -1670,7 +1670,7 @@ static int map_files_d_revalidate(struct dentry *dentry, unsigned int flags)
+ if (!task)
+ goto out_notask;
+
+- mm = mm_access(task, PTRACE_MODE_READ);
++ mm = mm_access(task, PTRACE_MODE_READ_FSCREDS);
+ if (IS_ERR_OR_NULL(mm))
+ goto out;
+
+@@ -1802,7 +1802,7 @@ static struct dentry *proc_map_files_lookup(struct inode *dir,
+ goto out;
+
+ result = -EACCES;
+- if (!ptrace_may_access(task, PTRACE_MODE_READ))
++ if (!ptrace_may_access(task, PTRACE_MODE_READ_FSCREDS))
+ goto out_put_task;
+
+ result = -ENOENT;
+@@ -1859,7 +1859,7 @@ proc_map_files_readdir(struct file *file, struct dir_context *ctx)
+ goto out;
+
+ ret = -EACCES;
+- if (!ptrace_may_access(task, PTRACE_MODE_READ))
++ if (!ptrace_may_access(task, PTRACE_MODE_READ_FSCREDS))
+ goto out_put_task;
+
+ ret = 0;
+@@ -2338,7 +2338,7 @@ static int do_io_accounting(struct task_struct *task, struct seq_file *m, int wh
+ if (result)
+ return result;
+
+- if (!ptrace_may_access(task, PTRACE_MODE_READ)) {
++ if (!ptrace_may_access(task, PTRACE_MODE_READ_FSCREDS)) {
+ result = -EACCES;
+ goto out_unlock;
+ }
+diff --git a/fs/proc/namespaces.c b/fs/proc/namespaces.c
+index 89026095f2b5..0bdad6b11a16 100644
+--- a/fs/proc/namespaces.c
++++ b/fs/proc/namespaces.c
+@@ -119,7 +119,7 @@ static void *proc_ns_follow_link(struct dentry *dentry, struct nameidata *nd)
+ if (!task)
+ goto out;
+
+- if (!ptrace_may_access(task, PTRACE_MODE_READ))
++ if (!ptrace_may_access(task, PTRACE_MODE_READ_FSCREDS))
+ goto out_put_task;
+
+ ns_path.dentry = proc_ns_get_dentry(sb, task, ei->ns.ns_ops);
+@@ -152,7 +152,7 @@ static int proc_ns_readlink(struct dentry *dentry, char __user *buffer, int bufl
+ if (!task)
+ goto out;
+
+- if (!ptrace_may_access(task, PTRACE_MODE_READ))
++ if (!ptrace_may_access(task, PTRACE_MODE_READ_FSCREDS))
+ goto out_put_task;
+
+ res = -ENOENT;
+diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c
+index 05fea2ac116c..18aaccb290c2 100644
+--- a/fs/quota/dquot.c
++++ b/fs/quota/dquot.c
+@@ -1384,7 +1384,7 @@ static int dquot_active(const struct inode *inode)
+ static void __dquot_initialize(struct inode *inode, int type)
+ {
+ int cnt, init_needed = 0;
+- struct dquot *got[MAXQUOTAS];
++ struct dquot *got[MAXQUOTAS] = {};
+ struct super_block *sb = inode->i_sb;
+ qsize_t rsv;
+
+@@ -1394,7 +1394,6 @@ static void __dquot_initialize(struct inode *inode, int type)
+ /* First get references to structures we might need. */
+ for (cnt = 0; cnt < MAXQUOTAS; cnt++) {
+ struct kqid qid;
+- got[cnt] = NULL;
+ if (type != -1 && cnt != type)
+ continue;
+ /*
+diff --git a/fs/splice.c b/fs/splice.c
+index 75c6058eabf2..cf0cb768a1a7 100644
+--- a/fs/splice.c
++++ b/fs/splice.c
+@@ -186,6 +186,9 @@ ssize_t splice_to_pipe(struct pipe_inode_info *pipe,
+ unsigned int spd_pages = spd->nr_pages;
+ int ret, do_wakeup, page_nr;
+
++ if (!spd_pages)
++ return 0;
++
+ ret = 0;
+ do_wakeup = 0;
+ page_nr = 0;
+diff --git a/fs/xfs/xfs_attr_list.c b/fs/xfs/xfs_attr_list.c
+index 62db83ab6cbc..ae64625937e5 100644
+--- a/fs/xfs/xfs_attr_list.c
++++ b/fs/xfs/xfs_attr_list.c
+@@ -205,8 +205,10 @@ xfs_attr_shortform_list(xfs_attr_list_context_t *context)
+ sbp->namelen,
+ sbp->valuelen,
+ &sbp->name[sbp->namelen]);
+- if (error)
++ if (error) {
++ kmem_free(sbuf);
+ return error;
++ }
+ if (context->seen_enough)
+ break;
+ cursor->offset++;
+@@ -454,14 +456,13 @@ xfs_attr3_leaf_list_int(
+ args.rmtblkcnt = xfs_attr3_rmt_blocks(
+ args.dp->i_mount, valuelen);
+ retval = xfs_attr_rmtval_get(&args);
+- if (retval)
+- return retval;
+- retval = context->put_listent(context,
+- entry->flags,
+- name_rmt->name,
+- (int)name_rmt->namelen,
+- valuelen,
+- args.value);
++ if (!retval)
++ retval = context->put_listent(context,
++ entry->flags,
++ name_rmt->name,
++ (int)name_rmt->namelen,
++ valuelen,
++ args.value);
+ kmem_free(args.value);
+ } else {
+ retval = context->put_listent(context,
+diff --git a/include/asm-generic/bitops/lock.h b/include/asm-generic/bitops/lock.h
+index c30266e94806..8ef0ccbf8167 100644
+--- a/include/asm-generic/bitops/lock.h
++++ b/include/asm-generic/bitops/lock.h
+@@ -29,16 +29,16 @@ do { \
+ * @nr: the bit to set
+ * @addr: the address to start counting from
+ *
+- * This operation is like clear_bit_unlock, however it is not atomic.
+- * It does provide release barrier semantics so it can be used to unlock
+- * a bit lock, however it would only be used if no other CPU can modify
+- * any bits in the memory until the lock is released (a good example is
+- * if the bit lock itself protects access to the other bits in the word).
++ * A weaker form of clear_bit_unlock() as used by __bit_lock_unlock(). If all
++ * the bits in the word are protected by this lock some archs can use weaker
++ * ops to safely unlock.
++ *
++ * See for example x86's implementation.
+ */
+ #define __clear_bit_unlock(nr, addr) \
+ do { \
+- smp_mb(); \
+- __clear_bit(nr, addr); \
++ smp_mb__before_atomic(); \
++ clear_bit(nr, addr); \
+ } while (0)
+
+ #endif /* _ASM_GENERIC_BITOPS_LOCK_H_ */
+diff --git a/include/drm/drm_dp_mst_helper.h b/include/drm/drm_dp_mst_helper.h
+index 338fc1053835..e4196de8b77c 100644
+--- a/include/drm/drm_dp_mst_helper.h
++++ b/include/drm/drm_dp_mst_helper.h
+@@ -44,8 +44,6 @@ struct drm_dp_vcpi {
+ /**
+ * struct drm_dp_mst_port - MST port
+ * @kref: reference count for this port.
+- * @guid_valid: for DP 1.2 devices if we have validated the GUID.
+- * @guid: guid for DP 1.2 device on this port.
+ * @port_num: port number
+ * @input: if this port is an input port.
+ * @mcs: message capability status - DP 1.2 spec.
+@@ -70,10 +68,6 @@ struct drm_dp_vcpi {
+ struct drm_dp_mst_port {
+ struct kref kref;
+
+- /* if dpcd 1.2 device is on this port - its GUID info */
+- bool guid_valid;
+- u8 guid[16];
+-
+ u8 port_num;
+ bool input;
+ bool mcs;
+@@ -107,10 +101,12 @@ struct drm_dp_mst_port {
+ * @tx_slots: transmission slots for this device.
+ * @last_seqno: last sequence number used to talk to this.
+ * @link_address_sent: if a link address message has been sent to this device yet.
++ * @guid: guid for DP 1.2 branch device. port under this branch can be
++ * identified by port #.
+ *
+ * This structure represents an MST branch device, there is one
+- * primary branch device at the root, along with any others connected
+- * to downstream ports
++ * primary branch device at the root, along with any other branches connected
++ * to downstream port of parent branches.
+ */
+ struct drm_dp_mst_branch {
+ struct kref kref;
+@@ -129,6 +125,9 @@ struct drm_dp_mst_branch {
+ struct drm_dp_sideband_msg_tx *tx_slots[2];
+ int last_seqno;
+ bool link_address_sent;
++
++ /* global unique identifier to identify branch devices */
++ u8 guid[16];
+ };
+
+
+@@ -401,11 +400,9 @@ struct drm_dp_payload {
+ * @conn_base_id: DRM connector ID this mgr is connected to.
+ * @down_rep_recv: msg receiver state for down replies.
+ * @up_req_recv: msg receiver state for up requests.
+- * @lock: protects mst state, primary, guid, dpcd.
++ * @lock: protects mst state, primary, dpcd.
+ * @mst_state: if this manager is enabled for an MST capable port.
+ * @mst_primary: pointer to the primary branch device.
+- * @guid_valid: GUID valid for the primary branch device.
+- * @guid: GUID for primary port.
+ * @dpcd: cache of DPCD for primary port.
+ * @pbn_div: PBN to slots divisor.
+ *
+@@ -427,13 +424,11 @@ struct drm_dp_mst_topology_mgr {
+ struct drm_dp_sideband_msg_rx up_req_recv;
+
+ /* pointer to info about the initial MST device */
+- struct mutex lock; /* protects mst_state + primary + guid + dpcd */
++ struct mutex lock; /* protects mst_state + primary + dpcd */
+
+ bool mst_state;
+ struct drm_dp_mst_branch *mst_primary;
+- /* primary MST device GUID */
+- bool guid_valid;
+- u8 guid[16];
++
+ u8 dpcd[DP_RECEIVER_CAP_SIZE];
+ u8 sink_count;
+ int pbn_div;
+diff --git a/include/linux/efi.h b/include/linux/efi.h
+index 0949f9c7e872..777c57596863 100644
+--- a/include/linux/efi.h
++++ b/include/linux/efi.h
+@@ -1155,7 +1155,10 @@ int efivar_entry_iter(int (*func)(struct efivar_entry *, void *),
+ struct efivar_entry *efivar_entry_find(efi_char16_t *name, efi_guid_t guid,
+ struct list_head *head, bool remove);
+
+-bool efivar_validate(efi_char16_t *var_name, u8 *data, unsigned long len);
++bool efivar_validate(efi_guid_t vendor, efi_char16_t *var_name, u8 *data,
++ unsigned long data_size);
++bool efivar_variable_is_removable(efi_guid_t vendor, const char *name,
++ size_t len);
+
+ extern struct work_struct efivar_work;
+ void efivar_run_worker(void);
+diff --git a/include/linux/fs.h b/include/linux/fs.h
+index 58f6ab319996..2a41353033d3 100644
+--- a/include/linux/fs.h
++++ b/include/linux/fs.h
+@@ -2067,7 +2067,7 @@ extern long do_sys_open(int dfd, const char __user *filename, int flags,
+ extern struct file *file_open_name(struct filename *, int, umode_t);
+ extern struct file *filp_open(const char *, int, umode_t);
+ extern struct file *file_open_root(struct dentry *, struct vfsmount *,
+- const char *, int);
++ const char *, int, umode_t);
+ extern struct file * dentry_open(const struct path *, int, const struct cred *);
+ extern int filp_close(struct file *, fl_owner_t id);
+
+diff --git a/include/linux/kernel.h b/include/linux/kernel.h
+index 3d770f5564b8..0fe0cb8a5862 100644
+--- a/include/linux/kernel.h
++++ b/include/linux/kernel.h
+@@ -590,7 +590,7 @@ do { \
+
+ #define do_trace_printk(fmt, args...) \
+ do { \
+- static const char *trace_printk_fmt \
++ static const char *trace_printk_fmt __used \
+ __attribute__((section("__trace_printk_fmt"))) = \
+ __builtin_constant_p(fmt) ? fmt : NULL; \
+ \
+@@ -634,7 +634,7 @@ int __trace_printk(unsigned long ip, const char *fmt, ...);
+ */
+
+ #define trace_puts(str) ({ \
+- static const char *trace_printk_fmt \
++ static const char *trace_printk_fmt __used \
+ __attribute__((section("__trace_printk_fmt"))) = \
+ __builtin_constant_p(str) ? str : NULL; \
+ \
+@@ -656,7 +656,7 @@ extern void trace_dump_stack(int skip);
+ #define ftrace_vprintk(fmt, vargs) \
+ do { \
+ if (__builtin_constant_p(fmt)) { \
+- static const char *trace_printk_fmt \
++ static const char *trace_printk_fmt __used \
+ __attribute__((section("__trace_printk_fmt"))) = \
+ __builtin_constant_p(fmt) ? fmt : NULL; \
+ \
+diff --git a/include/linux/mm.h b/include/linux/mm.h
+index 86a977bf4f79..9eef3a1f2291 100644
+--- a/include/linux/mm.h
++++ b/include/linux/mm.h
+@@ -598,7 +598,7 @@ static inline compound_page_dtor *get_compound_page_dtor(struct page *page)
+ return (compound_page_dtor *)page[1].lru.next;
+ }
+
+-static inline int compound_order(struct page *page)
++static inline unsigned int compound_order(struct page *page)
+ {
+ if (!PageHead(page))
+ return 0;
+@@ -1730,7 +1730,8 @@ extern void si_meminfo(struct sysinfo * val);
+ extern void si_meminfo_node(struct sysinfo *val, int nid);
+
+ extern __printf(3, 4)
+-void warn_alloc_failed(gfp_t gfp_mask, int order, const char *fmt, ...);
++void warn_alloc_failed(gfp_t gfp_mask, unsigned int order,
++ const char *fmt, ...);
+
+ extern void setup_per_cpu_pageset(void);
+
+diff --git a/include/linux/module.h b/include/linux/module.h
+index 71f282a4e307..18edb9660da0 100644
+--- a/include/linux/module.h
++++ b/include/linux/module.h
+@@ -224,6 +224,12 @@ struct module_ref {
+ unsigned long decs;
+ } __attribute((aligned(2 * sizeof(unsigned long))));
+
++struct mod_kallsyms {
++ Elf_Sym *symtab;
++ unsigned int num_symtab;
++ char *strtab;
++};
++
+ struct module {
+ enum module_state state;
+
+@@ -311,14 +317,9 @@ struct module {
+ #endif
+
+ #ifdef CONFIG_KALLSYMS
+- /*
+- * We keep the symbol and string tables for kallsyms.
+- * The core_* fields below are temporary, loader-only (they
+- * could really be discarded after module init).
+- */
+- Elf_Sym *symtab, *core_symtab;
+- unsigned int num_symtab, core_num_syms;
+- char *strtab, *core_strtab;
++ /* Protected by RCU and/or module_mutex: use rcu_dereference() */
++ struct mod_kallsyms *kallsyms;
++ struct mod_kallsyms core_kallsyms;
+
+ /* Section attributes */
+ struct module_sect_attrs *sect_attrs;
+diff --git a/include/linux/pageblock-flags.h b/include/linux/pageblock-flags.h
+index 2baeee12f48e..e942558b3585 100644
+--- a/include/linux/pageblock-flags.h
++++ b/include/linux/pageblock-flags.h
+@@ -44,7 +44,7 @@ enum pageblock_bits {
+ #ifdef CONFIG_HUGETLB_PAGE_SIZE_VARIABLE
+
+ /* Huge page sizes are variable */
+-extern int pageblock_order;
++extern unsigned int pageblock_order;
+
+ #else /* CONFIG_HUGETLB_PAGE_SIZE_VARIABLE */
+
+diff --git a/include/linux/pci.h b/include/linux/pci.h
+index 7a3484490867..88f1faf3de43 100644
+--- a/include/linux/pci.h
++++ b/include/linux/pci.h
+@@ -355,6 +355,9 @@ struct pci_dev {
+ unsigned int __aer_firmware_first:1;
+ unsigned int broken_intx_masking:1;
+ unsigned int io_window_1k:1; /* Intel P2P bridge 1K I/O windows */
++ unsigned int irq_managed:1;
++ unsigned int has_secondary_link:1;
++ unsigned int non_compliant_bars:1; /* broken BARs; ignore them */
+ pci_dev_flags_t dev_flags;
+ atomic_t enable_cnt; /* pci_enable_device has been called */
+
+diff --git a/include/linux/poison.h b/include/linux/poison.h
+index 2110a81c5e2a..253c9b4198ef 100644
+--- a/include/linux/poison.h
++++ b/include/linux/poison.h
+@@ -19,8 +19,8 @@
+ * under normal circumstances, used to verify that nobody uses
+ * non-initialized list entries.
+ */
+-#define LIST_POISON1 ((void *) 0x00100100 + POISON_POINTER_DELTA)
+-#define LIST_POISON2 ((void *) 0x00200200 + POISON_POINTER_DELTA)
++#define LIST_POISON1 ((void *) 0x100 + POISON_POINTER_DELTA)
++#define LIST_POISON2 ((void *) 0x200 + POISON_POINTER_DELTA)
+
+ /********** include/linux/timer.h **********/
+ /*
+diff --git a/include/linux/ptrace.h b/include/linux/ptrace.h
+index cc79eff4a1ad..608d90444b6f 100644
+--- a/include/linux/ptrace.h
++++ b/include/linux/ptrace.h
+@@ -56,7 +56,29 @@ extern void exit_ptrace(struct task_struct *tracer);
+ #define PTRACE_MODE_READ 0x01
+ #define PTRACE_MODE_ATTACH 0x02
+ #define PTRACE_MODE_NOAUDIT 0x04
+-/* Returns true on success, false on denial. */
++#define PTRACE_MODE_FSCREDS 0x08
++#define PTRACE_MODE_REALCREDS 0x10
++
++/* shorthands for READ/ATTACH and FSCREDS/REALCREDS combinations */
++#define PTRACE_MODE_READ_FSCREDS (PTRACE_MODE_READ | PTRACE_MODE_FSCREDS)
++#define PTRACE_MODE_READ_REALCREDS (PTRACE_MODE_READ | PTRACE_MODE_REALCREDS)
++#define PTRACE_MODE_ATTACH_FSCREDS (PTRACE_MODE_ATTACH | PTRACE_MODE_FSCREDS)
++#define PTRACE_MODE_ATTACH_REALCREDS (PTRACE_MODE_ATTACH | PTRACE_MODE_REALCREDS)
++
++/**
++ * ptrace_may_access - check whether the caller is permitted to access
++ * a target task.
++ * @task: target task
++ * @mode: selects type of access and caller credentials
++ *
++ * Returns true on success, false on denial.
++ *
++ * One of the flags PTRACE_MODE_FSCREDS and PTRACE_MODE_REALCREDS must
++ * be set in @mode to specify whether the access was requested through
++ * a filesystem syscall (should use effective capabilities and fsuid
++ * of the caller) or through an explicit syscall such as
++ * process_vm_writev or ptrace (and should use the real credentials).
++ */
+ extern bool ptrace_may_access(struct task_struct *task, unsigned int mode);
+
+ static inline int ptrace_reparented(struct task_struct *child)
+diff --git a/include/linux/thermal.h b/include/linux/thermal.h
+index 041f9b4e0074..96c305167a1e 100644
+--- a/include/linux/thermal.h
++++ b/include/linux/thermal.h
+@@ -175,6 +175,7 @@ struct thermal_attr {
+ * @trip_hyst_attrs: attributes for trip points for sysfs: trip hysteresis
+ * @devdata: private pointer for device private data
+ * @trips: number of trip points the thermal zone supports
++ * @trips_disabled; bitmap for disabled trips
+ * @passive_delay: number of milliseconds to wait between polls when
+ * performing passive cooling. Currenty only used by the
+ * step-wise governor
+@@ -211,6 +212,7 @@ struct thermal_zone_device {
+ struct thermal_attr *trip_hyst_attrs;
+ void *devdata;
+ int trips;
++ unsigned long trips_disabled; /* bitmap for disabled trips */
+ int passive_delay;
+ int polling_delay;
+ int temperature;
+diff --git a/include/linux/tty.h b/include/linux/tty.h
+index 5171ef8f7b85..4858a3b79b7a 100644
+--- a/include/linux/tty.h
++++ b/include/linux/tty.h
+@@ -574,7 +574,7 @@ static inline int tty_ldisc_receive_buf(struct tty_ldisc *ld, unsigned char *p,
+ count = ld->ops->receive_buf2(ld->tty, p, f, count);
+ else {
+ count = min_t(int, count, ld->tty->receive_room);
+- if (count)
++ if (count && ld->ops->receive_buf)
+ ld->ops->receive_buf(ld->tty, p, f, count);
+ }
+ return count;
+diff --git a/include/linux/ucs2_string.h b/include/linux/ucs2_string.h
+index cbb20afdbc01..bb679b48f408 100644
+--- a/include/linux/ucs2_string.h
++++ b/include/linux/ucs2_string.h
+@@ -11,4 +11,8 @@ unsigned long ucs2_strlen(const ucs2_char_t *s);
+ unsigned long ucs2_strsize(const ucs2_char_t *data, unsigned long maxlength);
+ int ucs2_strncmp(const ucs2_char_t *a, const ucs2_char_t *b, size_t len);
+
++unsigned long ucs2_utf8size(const ucs2_char_t *src);
++unsigned long ucs2_as_utf8(u8 *dest, const ucs2_char_t *src,
++ unsigned long maxlength);
++
+ #endif /* _LINUX_UCS2_STRING_H_ */
+diff --git a/kernel/events/core.c b/kernel/events/core.c
+index ff181a5a5562..44a47ac6c1e8 100644
+--- a/kernel/events/core.c
++++ b/kernel/events/core.c
+@@ -3188,7 +3188,7 @@ find_lively_task_by_vpid(pid_t vpid)
+
+ /* Reuse ptrace permission checks for now. */
+ err = -EACCES;
+- if (!ptrace_may_access(task, PTRACE_MODE_READ))
++ if (!ptrace_may_access(task, PTRACE_MODE_READ_REALCREDS))
+ goto errout;
+
+ return task;
+diff --git a/kernel/futex.c b/kernel/futex.c
+index 1c43013e6edc..d9d63806f55f 100644
+--- a/kernel/futex.c
++++ b/kernel/futex.c
+@@ -2763,7 +2763,7 @@ SYSCALL_DEFINE3(get_robust_list, int, pid,
+ }
+
+ ret = -EPERM;
+- if (!ptrace_may_access(p, PTRACE_MODE_READ))
++ if (!ptrace_may_access(p, PTRACE_MODE_READ_REALCREDS))
+ goto err_unlock;
+
+ head = p->robust_list;
+diff --git a/kernel/futex_compat.c b/kernel/futex_compat.c
+index 55c8c9349cfe..4ae3232e7a28 100644
+--- a/kernel/futex_compat.c
++++ b/kernel/futex_compat.c
+@@ -155,7 +155,7 @@ COMPAT_SYSCALL_DEFINE3(get_robust_list, int, pid,
+ }
+
+ ret = -EPERM;
+- if (!ptrace_may_access(p, PTRACE_MODE_READ))
++ if (!ptrace_may_access(p, PTRACE_MODE_READ_REALCREDS))
+ goto err_unlock;
+
+ head = p->compat_robust_list;
+diff --git a/kernel/kcmp.c b/kernel/kcmp.c
+index 0aa69ea1d8fd..3a47fa998fe0 100644
+--- a/kernel/kcmp.c
++++ b/kernel/kcmp.c
+@@ -122,8 +122,8 @@ SYSCALL_DEFINE5(kcmp, pid_t, pid1, pid_t, pid2, int, type,
+ &task2->signal->cred_guard_mutex);
+ if (ret)
+ goto err;
+- if (!ptrace_may_access(task1, PTRACE_MODE_READ) ||
+- !ptrace_may_access(task2, PTRACE_MODE_READ)) {
++ if (!ptrace_may_access(task1, PTRACE_MODE_READ_REALCREDS) ||
++ !ptrace_may_access(task2, PTRACE_MODE_READ_REALCREDS)) {
+ ret = -EPERM;
+ goto err_unlock;
+ }
+diff --git a/kernel/module.c b/kernel/module.c
+index 3da0c001d985..1df11b175a24 100644
+--- a/kernel/module.c
++++ b/kernel/module.c
+@@ -179,6 +179,9 @@ struct load_info {
+ struct _ddebug *debug;
+ unsigned int num_debug;
+ bool sig_ok;
++#ifdef CONFIG_KALLSYMS
++ unsigned long mod_kallsyms_init_off;
++#endif
+ struct {
+ unsigned int sym, str, mod, vers, info, pcpu;
+ } index;
+@@ -2325,8 +2328,20 @@ static void layout_symtab(struct module *mod, struct load_info *info)
+ strsect->sh_entsize = get_offset(mod, &mod->init_size, strsect,
+ info->index.str) | INIT_OFFSET_MASK;
+ pr_debug("\t%s\n", info->secstrings + strsect->sh_name);
++
++ /* We'll tack temporary mod_kallsyms on the end. */
++ mod->init_size = ALIGN(mod->init_size,
++ __alignof__(struct mod_kallsyms));
++ info->mod_kallsyms_init_off = mod->init_size;
++ mod->init_size += sizeof(struct mod_kallsyms);
++ mod->init_size = debug_align(mod->init_size);
+ }
+
++/*
++ * We use the full symtab and strtab which layout_symtab arranged to
++ * be appended to the init section. Later we switch to the cut-down
++ * core-only ones.
++ */
+ static void add_kallsyms(struct module *mod, const struct load_info *info)
+ {
+ unsigned int i, ndst;
+@@ -2335,28 +2350,33 @@ static void add_kallsyms(struct module *mod, const struct load_info *info)
+ char *s;
+ Elf_Shdr *symsec = &info->sechdrs[info->index.sym];
+
+- mod->symtab = (void *)symsec->sh_addr;
+- mod->num_symtab = symsec->sh_size / sizeof(Elf_Sym);
++ /* Set up to point into init section. */
++ mod->kallsyms = mod->module_init + info->mod_kallsyms_init_off;
++
++ mod->kallsyms->symtab = (void *)symsec->sh_addr;
++ mod->kallsyms->num_symtab = symsec->sh_size / sizeof(Elf_Sym);
+ /* Make sure we get permanent strtab: don't use info->strtab. */
+- mod->strtab = (void *)info->sechdrs[info->index.str].sh_addr;
++ mod->kallsyms->strtab = (void *)info->sechdrs[info->index.str].sh_addr;
+
+ /* Set types up while we still have access to sections. */
+- for (i = 0; i < mod->num_symtab; i++)
+- mod->symtab[i].st_info = elf_type(&mod->symtab[i], info);
+-
+- mod->core_symtab = dst = mod->module_core + info->symoffs;
+- mod->core_strtab = s = mod->module_core + info->stroffs;
+- src = mod->symtab;
+- for (ndst = i = 0; i < mod->num_symtab; i++) {
++ for (i = 0; i < mod->kallsyms->num_symtab; i++)
++ mod->kallsyms->symtab[i].st_info
++ = elf_type(&mod->kallsyms->symtab[i], info);
++
++ /* Now populate the cut down core kallsyms for after init. */
++ mod->core_kallsyms.symtab = dst = mod->module_core + info->symoffs;
++ mod->core_kallsyms.strtab = s = mod->module_core + info->stroffs;
++ src = mod->kallsyms->symtab;
++ for (ndst = i = 0; i < mod->kallsyms->num_symtab; i++) {
+ if (i == 0 ||
+ is_core_symbol(src+i, info->sechdrs, info->hdr->e_shnum)) {
+ dst[ndst] = src[i];
+- dst[ndst++].st_name = s - mod->core_strtab;
+- s += strlcpy(s, &mod->strtab[src[i].st_name],
++ dst[ndst++].st_name = s - mod->core_kallsyms.strtab;
++ s += strlcpy(s, &mod->kallsyms->strtab[src[i].st_name],
+ KSYM_NAME_LEN) + 1;
+ }
+ }
+- mod->core_num_syms = ndst;
++ mod->core_kallsyms.num_symtab = ndst;
+ }
+ #else
+ static inline void layout_symtab(struct module *mod, struct load_info *info)
+@@ -3076,9 +3096,8 @@ static int do_init_module(struct module *mod)
+ module_put(mod);
+ trim_init_extable(mod);
+ #ifdef CONFIG_KALLSYMS
+- mod->num_symtab = mod->core_num_syms;
+- mod->symtab = mod->core_symtab;
+- mod->strtab = mod->core_strtab;
++ /* Switch to core kallsyms now init is done: kallsyms may be walking! */
++ rcu_assign_pointer(mod->kallsyms, &mod->core_kallsyms);
+ #endif
+ unset_module_init_ro_nx(mod);
+ module_free(mod, mod->module_init);
+@@ -3401,6 +3420,11 @@ static inline int is_arm_mapping_symbol(const char *str)
+ && (str[2] == '\0' || str[2] == '.');
+ }
+
++static const char *symname(struct mod_kallsyms *kallsyms, unsigned int symnum)
++{
++ return kallsyms->strtab + kallsyms->symtab[symnum].st_name;
++}
++
+ static const char *get_ksymbol(struct module *mod,
+ unsigned long addr,
+ unsigned long *size,
+@@ -3408,6 +3432,7 @@ static const char *get_ksymbol(struct module *mod,
+ {
+ unsigned int i, best = 0;
+ unsigned long nextval;
++ struct mod_kallsyms *kallsyms = rcu_dereference_sched(mod->kallsyms);
+
+ /* At worse, next value is at end of module */
+ if (within_module_init(addr, mod))
+@@ -3417,32 +3442,32 @@ static const char *get_ksymbol(struct module *mod,
+
+ /* Scan for closest preceding symbol, and next symbol. (ELF
+ starts real symbols at 1). */
+- for (i = 1; i < mod->num_symtab; i++) {
+- if (mod->symtab[i].st_shndx == SHN_UNDEF)
++ for (i = 1; i < kallsyms->num_symtab; i++) {
++ if (kallsyms->symtab[i].st_shndx == SHN_UNDEF)
+ continue;
+
+ /* We ignore unnamed symbols: they're uninformative
+ * and inserted at a whim. */
+- if (mod->symtab[i].st_value <= addr
+- && mod->symtab[i].st_value > mod->symtab[best].st_value
+- && *(mod->strtab + mod->symtab[i].st_name) != '\0'
+- && !is_arm_mapping_symbol(mod->strtab + mod->symtab[i].st_name))
++ if (*symname(kallsyms, i) == '\0'
++ || is_arm_mapping_symbol(symname(kallsyms, i)))
++ continue;
++
++ if (kallsyms->symtab[i].st_value <= addr
++ && kallsyms->symtab[i].st_value > kallsyms->symtab[best].st_value)
+ best = i;
+- if (mod->symtab[i].st_value > addr
+- && mod->symtab[i].st_value < nextval
+- && *(mod->strtab + mod->symtab[i].st_name) != '\0'
+- && !is_arm_mapping_symbol(mod->strtab + mod->symtab[i].st_name))
+- nextval = mod->symtab[i].st_value;
++ if (kallsyms->symtab[i].st_value > addr
++ && kallsyms->symtab[i].st_value < nextval)
++ nextval = kallsyms->symtab[i].st_value;
+ }
+
+ if (!best)
+ return NULL;
+
+ if (size)
+- *size = nextval - mod->symtab[best].st_value;
++ *size = nextval - kallsyms->symtab[best].st_value;
+ if (offset)
+- *offset = addr - mod->symtab[best].st_value;
+- return mod->strtab + mod->symtab[best].st_name;
++ *offset = addr - kallsyms->symtab[best].st_value;
++ return symname(kallsyms, best);
+ }
+
+ /* For kallsyms to ask for address resolution. NULL means not found. Careful
+@@ -3535,19 +3560,21 @@ int module_get_kallsym(unsigned int symnum, unsigned long *value, char *type,
+
+ preempt_disable();
+ list_for_each_entry_rcu(mod, &modules, list) {
++ struct mod_kallsyms *kallsyms;
++
+ if (mod->state == MODULE_STATE_UNFORMED)
+ continue;
+- if (symnum < mod->num_symtab) {
+- *value = mod->symtab[symnum].st_value;
+- *type = mod->symtab[symnum].st_info;
+- strlcpy(name, mod->strtab + mod->symtab[symnum].st_name,
+- KSYM_NAME_LEN);
++ kallsyms = rcu_dereference_sched(mod->kallsyms);
++ if (symnum < kallsyms->num_symtab) {
++ *value = kallsyms->symtab[symnum].st_value;
++ *type = kallsyms->symtab[symnum].st_info;
++ strlcpy(name, symname(kallsyms, symnum), KSYM_NAME_LEN);
+ strlcpy(module_name, mod->name, MODULE_NAME_LEN);
+ *exported = is_exported(name, *value, mod);
+ preempt_enable();
+ return 0;
+ }
+- symnum -= mod->num_symtab;
++ symnum -= kallsyms->num_symtab;
+ }
+ preempt_enable();
+ return -ERANGE;
+@@ -3556,11 +3583,12 @@ int module_get_kallsym(unsigned int symnum, unsigned long *value, char *type,
+ static unsigned long mod_find_symname(struct module *mod, const char *name)
+ {
+ unsigned int i;
++ struct mod_kallsyms *kallsyms = rcu_dereference_sched(mod->kallsyms);
+
+- for (i = 0; i < mod->num_symtab; i++)
+- if (strcmp(name, mod->strtab+mod->symtab[i].st_name) == 0 &&
+- mod->symtab[i].st_info != 'U')
+- return mod->symtab[i].st_value;
++ for (i = 0; i < kallsyms->num_symtab; i++)
++ if (strcmp(name, symname(kallsyms, i)) == 0 &&
++ kallsyms->symtab[i].st_info != 'U')
++ return kallsyms->symtab[i].st_value;
+ return 0;
+ }
+
+@@ -3597,11 +3625,14 @@ int module_kallsyms_on_each_symbol(int (*fn)(void *, const char *,
+ int ret;
+
+ list_for_each_entry(mod, &modules, list) {
++ /* We hold module_mutex: no need for rcu_dereference_sched */
++ struct mod_kallsyms *kallsyms = mod->kallsyms;
++
+ if (mod->state == MODULE_STATE_UNFORMED)
+ continue;
+- for (i = 0; i < mod->num_symtab; i++) {
+- ret = fn(data, mod->strtab + mod->symtab[i].st_name,
+- mod, mod->symtab[i].st_value);
++ for (i = 0; i < kallsyms->num_symtab; i++) {
++ ret = fn(data, symname(kallsyms, i),
++ mod, kallsyms->symtab[i].st_value);
+ if (ret != 0)
+ return ret;
+ }
+diff --git a/kernel/ptrace.c b/kernel/ptrace.c
+index dcd968232d42..0856b9720598 100644
+--- a/kernel/ptrace.c
++++ b/kernel/ptrace.c
+@@ -219,6 +219,14 @@ static int ptrace_has_cap(struct user_namespace *ns, unsigned int mode)
+ static int __ptrace_may_access(struct task_struct *task, unsigned int mode)
+ {
+ const struct cred *cred = current_cred(), *tcred;
++ int dumpable = 0;
++ kuid_t caller_uid;
++ kgid_t caller_gid;
++
++ if (!(mode & PTRACE_MODE_FSCREDS) == !(mode & PTRACE_MODE_REALCREDS)) {
++ WARN(1, "denying ptrace access check without PTRACE_MODE_*CREDS\n");
++ return -EPERM;
++ }
+
+ /* May we inspect the given task?
+ * This check is used both for attaching with ptrace
+@@ -228,18 +236,33 @@ static int __ptrace_may_access(struct task_struct *task, unsigned int mode)
+ * because setting up the necessary parent/child relationship
+ * or halting the specified task is impossible.
+ */
+- int dumpable = 0;
++
+ /* Don't let security modules deny introspection */
+ if (same_thread_group(task, current))
+ return 0;
+ rcu_read_lock();
++ if (mode & PTRACE_MODE_FSCREDS) {
++ caller_uid = cred->fsuid;
++ caller_gid = cred->fsgid;
++ } else {
++ /*
++ * Using the euid would make more sense here, but something
++ * in userland might rely on the old behavior, and this
++ * shouldn't be a security problem since
++ * PTRACE_MODE_REALCREDS implies that the caller explicitly
++ * used a syscall that requests access to another process
++ * (and not a filesystem syscall to procfs).
++ */
++ caller_uid = cred->uid;
++ caller_gid = cred->gid;
++ }
+ tcred = __task_cred(task);
+- if (uid_eq(cred->uid, tcred->euid) &&
+- uid_eq(cred->uid, tcred->suid) &&
+- uid_eq(cred->uid, tcred->uid) &&
+- gid_eq(cred->gid, tcred->egid) &&
+- gid_eq(cred->gid, tcred->sgid) &&
+- gid_eq(cred->gid, tcred->gid))
++ if (uid_eq(caller_uid, tcred->euid) &&
++ uid_eq(caller_uid, tcred->suid) &&
++ uid_eq(caller_uid, tcred->uid) &&
++ gid_eq(caller_gid, tcred->egid) &&
++ gid_eq(caller_gid, tcred->sgid) &&
++ gid_eq(caller_gid, tcred->gid))
+ goto ok;
+ if (ptrace_has_cap(tcred->user_ns, mode))
+ goto ok;
+@@ -306,7 +329,7 @@ static int ptrace_attach(struct task_struct *task, long request,
+ goto out;
+
+ task_lock(task);
+- retval = __ptrace_may_access(task, PTRACE_MODE_ATTACH);
++ retval = __ptrace_may_access(task, PTRACE_MODE_ATTACH_REALCREDS);
+ task_unlock(task);
+ if (retval)
+ goto unlock_creds;
+diff --git a/kernel/resource.c b/kernel/resource.c
+index 0bcebffc4e77..e3011e1a5c8d 100644
+--- a/kernel/resource.c
++++ b/kernel/resource.c
+@@ -1073,9 +1073,10 @@ struct resource * __request_region(struct resource *parent,
+ if (!conflict)
+ break;
+ if (conflict != parent) {
+- parent = conflict;
+- if (!(conflict->flags & IORESOURCE_BUSY))
++ if (!(conflict->flags & IORESOURCE_BUSY)) {
++ parent = conflict;
+ continue;
++ }
+ }
+ if (conflict->flags & flags & IORESOURCE_MUXED) {
+ add_wait_queue(&muxed_resource_wait, &wait);
+diff --git a/kernel/sched/core.c b/kernel/sched/core.c
+index d650e1e593b8..4317f0156092 100644
+--- a/kernel/sched/core.c
++++ b/kernel/sched/core.c
+@@ -6416,7 +6416,7 @@ static void sched_init_numa(void)
+
+ sched_domains_numa_masks[i][j] = mask;
+
+- for (k = 0; k < nr_node_ids; k++) {
++ for_each_node(k) {
+ if (node_distance(j, k) > sched_domains_numa_distance[i])
+ continue;
+
+diff --git a/kernel/sched/cputime.c b/kernel/sched/cputime.c
+index 8394b1ee600c..87b8576cbd50 100644
+--- a/kernel/sched/cputime.c
++++ b/kernel/sched/cputime.c
+@@ -259,21 +259,21 @@ static __always_inline bool steal_account_process_tick(void)
+ #ifdef CONFIG_PARAVIRT
+ if (static_key_false(¶virt_steal_enabled)) {
+ u64 steal;
+- cputime_t steal_ct;
++ unsigned long steal_jiffies;
+
+ steal = paravirt_steal_clock(smp_processor_id());
+ steal -= this_rq()->prev_steal_time;
+
+ /*
+- * cputime_t may be less precise than nsecs (eg: if it's
+- * based on jiffies). Lets cast the result to cputime
++ * steal is in nsecs but our caller is expecting steal
++ * time in jiffies. Lets cast the result to jiffies
+ * granularity and account the rest on the next rounds.
+ */
+- steal_ct = nsecs_to_cputime(steal);
+- this_rq()->prev_steal_time += cputime_to_nsecs(steal_ct);
++ steal_jiffies = nsecs_to_jiffies(steal);
++ this_rq()->prev_steal_time += jiffies_to_nsecs(steal_jiffies);
+
+- account_steal_time(steal_ct);
+- return steal_ct;
++ account_steal_time(jiffies_to_cputime(steal_jiffies));
++ return steal_jiffies;
+ }
+ #endif
+ return false;
+diff --git a/kernel/sysctl_binary.c b/kernel/sysctl_binary.c
+index 9a4f750a2963..b99a55863de1 100644
+--- a/kernel/sysctl_binary.c
++++ b/kernel/sysctl_binary.c
+@@ -1320,7 +1320,7 @@ static ssize_t binary_sysctl(const int *name, int nlen,
+ }
+
+ mnt = task_active_pid_ns(current)->proc_mnt;
+- file = file_open_root(mnt->mnt_root, mnt, pathname, flags);
++ file = file_open_root(mnt->mnt_root, mnt, pathname, flags, 0);
+ result = PTR_ERR(file);
+ if (IS_ERR(file))
+ goto out_putname;
+diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
+index 72c71345db81..2d5909fae96d 100644
+--- a/kernel/trace/trace.c
++++ b/kernel/trace/trace.c
+@@ -4679,7 +4679,10 @@ static ssize_t tracing_splice_read_pipe(struct file *filp,
+
+ spd.nr_pages = i;
+
+- ret = splice_to_pipe(pipe, &spd);
++ if (i)
++ ret = splice_to_pipe(pipe, &spd);
++ else
++ ret = 0;
+ out:
+ splice_shrink_spd(&spd);
+ return ret;
+diff --git a/kernel/trace/trace_printk.c b/kernel/trace/trace_printk.c
+index 2900817ba65c..14ffaa59a9e9 100644
+--- a/kernel/trace/trace_printk.c
++++ b/kernel/trace/trace_printk.c
+@@ -291,6 +291,9 @@ static int t_show(struct seq_file *m, void *v)
+ const char *str = *fmt;
+ int i;
+
++ if (!*fmt)
++ return 0;
++
+ seq_printf(m, "0x%lx : \"", *(unsigned long *)fmt);
+
+ /*
+diff --git a/lib/ucs2_string.c b/lib/ucs2_string.c
+index 6f500ef2301d..f0b323abb4c6 100644
+--- a/lib/ucs2_string.c
++++ b/lib/ucs2_string.c
+@@ -49,3 +49,65 @@ ucs2_strncmp(const ucs2_char_t *a, const ucs2_char_t *b, size_t len)
+ }
+ }
+ EXPORT_SYMBOL(ucs2_strncmp);
++
++unsigned long
++ucs2_utf8size(const ucs2_char_t *src)
++{
++ unsigned long i;
++ unsigned long j = 0;
++
++ for (i = 0; i < ucs2_strlen(src); i++) {
++ u16 c = src[i];
++
++ if (c >= 0x800)
++ j += 3;
++ else if (c >= 0x80)
++ j += 2;
++ else
++ j += 1;
++ }
++
++ return j;
++}
++EXPORT_SYMBOL(ucs2_utf8size);
++
++/*
++ * copy at most maxlength bytes of whole utf8 characters to dest from the
++ * ucs2 string src.
++ *
++ * The return value is the number of characters copied, not including the
++ * final NUL character.
++ */
++unsigned long
++ucs2_as_utf8(u8 *dest, const ucs2_char_t *src, unsigned long maxlength)
++{
++ unsigned int i;
++ unsigned long j = 0;
++ unsigned long limit = ucs2_strnlen(src, maxlength);
++
++ for (i = 0; maxlength && i < limit; i++) {
++ u16 c = src[i];
++
++ if (c >= 0x800) {
++ if (maxlength < 3)
++ break;
++ maxlength -= 3;
++ dest[j++] = 0xe0 | (c & 0xf000) >> 12;
++ dest[j++] = 0x80 | (c & 0x0fc0) >> 6;
++ dest[j++] = 0x80 | (c & 0x003f);
++ } else if (c >= 0x80) {
++ if (maxlength < 2)
++ break;
++ maxlength -= 2;
++ dest[j++] = 0xc0 | (c & 0x7c0) >> 6;
++ dest[j++] = 0x80 | (c & 0x03f);
++ } else {
++ maxlength -= 1;
++ dest[j++] = c & 0x7f;
++ }
++ }
++ if (maxlength)
++ dest[j] = '\0';
++ return j;
++}
++EXPORT_SYMBOL(ucs2_as_utf8);
+diff --git a/mm/bootmem.c b/mm/bootmem.c
+index 477be696511d..a23dd1934654 100644
+--- a/mm/bootmem.c
++++ b/mm/bootmem.c
+@@ -164,7 +164,7 @@ void __init free_bootmem_late(unsigned long physaddr, unsigned long size)
+ end = PFN_DOWN(physaddr + size);
+
+ for (; cursor < end; cursor++) {
+- __free_pages_bootmem(pfn_to_page(cursor), 0);
++ __free_pages_bootmem(pfn_to_page(cursor), cursor, 0);
+ totalram_pages++;
+ }
+ }
+@@ -172,7 +172,7 @@ void __init free_bootmem_late(unsigned long physaddr, unsigned long size)
+ static unsigned long __init free_all_bootmem_core(bootmem_data_t *bdata)
+ {
+ struct page *page;
+- unsigned long *map, start, end, pages, count = 0;
++ unsigned long *map, start, end, pages, cur, count = 0;
+
+ if (!bdata->node_bootmem_map)
+ return 0;
+@@ -210,17 +210,17 @@ static unsigned long __init free_all_bootmem_core(bootmem_data_t *bdata)
+ if (IS_ALIGNED(start, BITS_PER_LONG) && vec == ~0UL) {
+ int order = ilog2(BITS_PER_LONG);
+
+- __free_pages_bootmem(pfn_to_page(start), order);
++ __free_pages_bootmem(pfn_to_page(start), start, order);
+ count += BITS_PER_LONG;
+ start += BITS_PER_LONG;
+ } else {
+- unsigned long cur = start;
++ cur = start;
+
+ start = ALIGN(start + 1, BITS_PER_LONG);
+ while (vec && cur != start) {
+ if (vec & 1) {
+ page = pfn_to_page(cur);
+- __free_pages_bootmem(page, 0);
++ __free_pages_bootmem(page, cur, 0);
+ count++;
+ }
+ vec >>= 1;
+@@ -229,12 +229,13 @@ static unsigned long __init free_all_bootmem_core(bootmem_data_t *bdata)
+ }
+ }
+
++ cur = bdata->node_min_pfn;
+ page = virt_to_page(bdata->node_bootmem_map);
+ pages = bdata->node_low_pfn - bdata->node_min_pfn;
+ pages = bootmem_bootmap_pages(pages);
+ count += pages;
+ while (pages--)
+- __free_pages_bootmem(page++, 0);
++ __free_pages_bootmem(page++, cur++, 0);
+
+ bdebug("nid=%td released=%lx\n", bdata - bootmem_node_data, count);
+
+diff --git a/mm/hugetlb.c b/mm/hugetlb.c
+index 77c8d03b4278..549bf5ac3d6e 100644
+--- a/mm/hugetlb.c
++++ b/mm/hugetlb.c
+@@ -681,7 +681,7 @@ static int hstate_next_node_to_free(struct hstate *h, nodemask_t *nodes_allowed)
+
+ #if defined(CONFIG_CMA) && defined(CONFIG_X86_64)
+ static void destroy_compound_gigantic_page(struct page *page,
+- unsigned long order)
++ unsigned int order)
+ {
+ int i;
+ int nr_pages = 1 << order;
+@@ -697,7 +697,7 @@ static void destroy_compound_gigantic_page(struct page *page,
+ __ClearPageHead(page);
+ }
+
+-static void free_gigantic_page(struct page *page, unsigned order)
++static void free_gigantic_page(struct page *page, unsigned int order)
+ {
+ free_contig_range(page_to_pfn(page), 1 << order);
+ }
+@@ -741,7 +741,7 @@ static bool zone_spans_last_pfn(const struct zone *zone,
+ return zone_spans_pfn(zone, last_pfn);
+ }
+
+-static struct page *alloc_gigantic_page(int nid, unsigned order)
++static struct page *alloc_gigantic_page(int nid, unsigned int order)
+ {
+ unsigned long nr_pages = 1 << order;
+ unsigned long ret, pfn, flags;
+@@ -777,7 +777,7 @@ static struct page *alloc_gigantic_page(int nid, unsigned order)
+ }
+
+ static void prep_new_huge_page(struct hstate *h, struct page *page, int nid);
+-static void prep_compound_gigantic_page(struct page *page, unsigned long order);
++static void prep_compound_gigantic_page(struct page *page, unsigned int order);
+
+ static struct page *alloc_fresh_gigantic_page_node(struct hstate *h, int nid)
+ {
+@@ -810,9 +810,9 @@ static int alloc_fresh_gigantic_page(struct hstate *h,
+ static inline bool gigantic_page_supported(void) { return true; }
+ #else
+ static inline bool gigantic_page_supported(void) { return false; }
+-static inline void free_gigantic_page(struct page *page, unsigned order) { }
++static inline void free_gigantic_page(struct page *page, unsigned int order) { }
+ static inline void destroy_compound_gigantic_page(struct page *page,
+- unsigned long order) { }
++ unsigned int order) { }
+ static inline int alloc_fresh_gigantic_page(struct hstate *h,
+ nodemask_t *nodes_allowed) { return 0; }
+ #endif
+@@ -932,7 +932,7 @@ static void prep_new_huge_page(struct hstate *h, struct page *page, int nid)
+ put_page(page); /* free it into the hugepage allocator */
+ }
+
+-static void prep_compound_gigantic_page(struct page *page, unsigned long order)
++static void prep_compound_gigantic_page(struct page *page, unsigned int order)
+ {
+ int i;
+ int nr_pages = 1 << order;
+@@ -1490,7 +1490,8 @@ found:
+ return 1;
+ }
+
+-static void __init prep_compound_huge_page(struct page *page, int order)
++static void __init prep_compound_huge_page(struct page *page,
++ unsigned int order)
+ {
+ if (unlikely(order > (MAX_ORDER - 1)))
+ prep_compound_gigantic_page(page, order);
+@@ -2197,7 +2198,7 @@ static int __init hugetlb_init(void)
+ module_init(hugetlb_init);
+
+ /* Should be called on processing a hugepagesz=... option */
+-void __init hugetlb_add_hstate(unsigned order)
++void __init hugetlb_add_hstate(unsigned int order)
+ {
+ struct hstate *h;
+ unsigned long i;
+diff --git a/mm/internal.h b/mm/internal.h
+index a4f90ba7068e..858c8bf8aaa4 100644
+--- a/mm/internal.h
++++ b/mm/internal.h
+@@ -133,8 +133,9 @@ __find_buddy_index(unsigned long page_idx, unsigned int order)
+ }
+
+ extern int __isolate_free_page(struct page *page, unsigned int order);
+-extern void __free_pages_bootmem(struct page *page, unsigned int order);
+-extern void prep_compound_page(struct page *page, unsigned long order);
++extern void __free_pages_bootmem(struct page *page, unsigned long pfn,
++ unsigned int order);
++extern void prep_compound_page(struct page *page, unsigned int order);
+ #ifdef CONFIG_MEMORY_FAILURE
+ extern bool is_free_buddy_page(struct page *page);
+ #endif
+@@ -192,7 +193,7 @@ isolate_migratepages_range(struct compact_control *cc,
+ * page cannot be allocated or merged in parallel. Alternatively, it must
+ * handle invalid values gracefully, and use page_order_unsafe() below.
+ */
+-static inline unsigned long page_order(struct page *page)
++static inline unsigned int page_order(struct page *page)
+ {
+ /* PageBuddy() must be checked by the caller */
+ return page_private(page);
+diff --git a/mm/memblock.c b/mm/memblock.c
+index 6ecb0d937fb5..eda16393e4f6 100644
+--- a/mm/memblock.c
++++ b/mm/memblock.c
+@@ -1305,7 +1305,7 @@ void __init __memblock_free_late(phys_addr_t base, phys_addr_t size)
+ end = PFN_DOWN(base + size);
+
+ for (; cursor < end; cursor++) {
+- __free_pages_bootmem(pfn_to_page(cursor), 0);
++ __free_pages_bootmem(pfn_to_page(cursor), cursor, 0);
+ totalram_pages++;
+ }
+ }
+diff --git a/mm/nobootmem.c b/mm/nobootmem.c
+index 90b50468333e..4bea539921df 100644
+--- a/mm/nobootmem.c
++++ b/mm/nobootmem.c
+@@ -77,7 +77,7 @@ void __init free_bootmem_late(unsigned long addr, unsigned long size)
+ end = PFN_DOWN(addr + size);
+
+ for (; cursor < end; cursor++) {
+- __free_pages_bootmem(pfn_to_page(cursor), 0);
++ __free_pages_bootmem(pfn_to_page(cursor), cursor, 0);
+ totalram_pages++;
+ }
+ }
+@@ -92,7 +92,7 @@ static void __init __free_pages_memory(unsigned long start, unsigned long end)
+ while (start + (1UL << order) > end)
+ order--;
+
+- __free_pages_bootmem(pfn_to_page(start), order);
++ __free_pages_bootmem(pfn_to_page(start), start, order);
+
+ start += (1UL << order);
+ }
+diff --git a/mm/page_alloc.c b/mm/page_alloc.c
+index c32cb64a1277..73b00abbe282 100644
+--- a/mm/page_alloc.c
++++ b/mm/page_alloc.c
+@@ -159,7 +159,7 @@ bool pm_suspended_storage(void)
+ #endif /* CONFIG_PM_SLEEP */
+
+ #ifdef CONFIG_HUGETLB_PAGE_SIZE_VARIABLE
+-int pageblock_order __read_mostly;
++unsigned int pageblock_order __read_mostly;
+ #endif
+
+ static void __free_pages_ok(struct page *page, unsigned int order);
+@@ -361,7 +361,7 @@ static void free_compound_page(struct page *page)
+ __free_pages_ok(page, compound_order(page));
+ }
+
+-void prep_compound_page(struct page *page, unsigned long order)
++void prep_compound_page(struct page *page, unsigned int order)
+ {
+ int i;
+ int nr_pages = 1 << order;
+@@ -546,7 +546,9 @@ static inline void __free_one_page(struct page *page,
+ unsigned long combined_idx;
+ unsigned long uninitialized_var(buddy_idx);
+ struct page *buddy;
+- int max_order = MAX_ORDER;
++ unsigned int max_order;
++
++ max_order = min_t(unsigned int, MAX_ORDER, pageblock_order + 1);
+
+ VM_BUG_ON(!zone_is_initialized(zone));
+
+@@ -555,28 +557,20 @@ static inline void __free_one_page(struct page *page,
+ return;
+
+ VM_BUG_ON(migratetype == -1);
+- if (is_migrate_isolate(migratetype)) {
+- /*
+- * We restrict max order of merging to prevent merge
+- * between freepages on isolate pageblock and normal
+- * pageblock. Without this, pageblock isolation
+- * could cause incorrect freepage accounting.
+- */
+- max_order = min(MAX_ORDER, pageblock_order + 1);
+- } else {
++ if (likely(!is_migrate_isolate(migratetype)))
+ __mod_zone_freepage_state(zone, 1 << order, migratetype);
+- }
+
+- page_idx = pfn & ((1 << max_order) - 1);
++ page_idx = pfn & ((1 << MAX_ORDER) - 1);
+
+ VM_BUG_ON_PAGE(page_idx & ((1 << order) - 1), page);
+ VM_BUG_ON_PAGE(bad_range(zone, page), page);
+
++continue_merging:
+ while (order < max_order - 1) {
+ buddy_idx = __find_buddy_index(page_idx, order);
+ buddy = page + (buddy_idx - page_idx);
+ if (!page_is_buddy(page, buddy, order))
+- break;
++ goto done_merging;
+ /*
+ * Our buddy is free or it is CONFIG_DEBUG_PAGEALLOC guard page,
+ * merge with it and move up one order.
+@@ -598,6 +592,32 @@ static inline void __free_one_page(struct page *page,
+ page_idx = combined_idx;
+ order++;
+ }
++ if (max_order < MAX_ORDER) {
++ /* If we are here, it means order is >= pageblock_order.
++ * We want to prevent merge between freepages on isolate
++ * pageblock and normal pageblock. Without this, pageblock
++ * isolation could cause incorrect freepage or CMA accounting.
++ *
++ * We don't want to hit this code for the more frequent
++ * low-order merging.
++ */
++ if (unlikely(has_isolate_pageblock(zone))) {
++ int buddy_mt;
++
++ buddy_idx = __find_buddy_index(page_idx, order);
++ buddy = page + (buddy_idx - page_idx);
++ buddy_mt = get_pageblock_migratetype(buddy);
++
++ if (migratetype != buddy_mt
++ && (is_migrate_isolate(migratetype) ||
++ is_migrate_isolate(buddy_mt)))
++ goto done_merging;
++ }
++ max_order++;
++ goto continue_merging;
++ }
++
++done_merging:
+ set_page_order(page, order);
+
+ /*
+@@ -780,7 +800,8 @@ static void __free_pages_ok(struct page *page, unsigned int order)
+ local_irq_restore(flags);
+ }
+
+-void __init __free_pages_bootmem(struct page *page, unsigned int order)
++void __init __free_pages_bootmem(struct page *page, unsigned long pfn,
++ unsigned int order)
+ {
+ unsigned int nr_pages = 1 << order;
+ struct page *p = page;
+@@ -993,7 +1014,7 @@ int move_freepages(struct zone *zone,
+ int migratetype)
+ {
+ struct page *page;
+- unsigned long order;
++ unsigned int order;
+ int pages_moved = 0;
+
+ #ifndef CONFIG_HOLES_IN_ZONE
+@@ -1079,7 +1100,7 @@ static void change_pageblock_range(struct page *pageblock_page,
+ static int try_to_steal_freepages(struct zone *zone, struct page *page,
+ int start_type, int fallback_type)
+ {
+- int current_order = page_order(page);
++ unsigned int current_order = page_order(page);
+
+ /*
+ * When borrowing from MIGRATE_CMA, we need to release the excess
+@@ -2142,7 +2163,7 @@ static DEFINE_RATELIMIT_STATE(nopage_rs,
+ DEFAULT_RATELIMIT_INTERVAL,
+ DEFAULT_RATELIMIT_BURST);
+
+-void warn_alloc_failed(gfp_t gfp_mask, int order, const char *fmt, ...)
++void warn_alloc_failed(gfp_t gfp_mask, unsigned int order, const char *fmt, ...)
+ {
+ unsigned int filter = SHOW_MEM_FILTER_NODES;
+
+@@ -2176,7 +2197,7 @@ void warn_alloc_failed(gfp_t gfp_mask, int order, const char *fmt, ...)
+ va_end(args);
+ }
+
+- pr_warn("%s: page allocation failure: order:%d, mode:0x%x\n",
++ pr_warn("%s: page allocation failure: order:%u, mode:0x%x\n",
+ current->comm, order, gfp_mask);
+
+ dump_stack();
+@@ -2949,7 +2970,8 @@ void free_kmem_pages(unsigned long addr, unsigned int order)
+ }
+ }
+
+-static void *make_alloc_exact(unsigned long addr, unsigned order, size_t size)
++static void *make_alloc_exact(unsigned long addr, unsigned int order,
++ size_t size)
+ {
+ if (addr) {
+ unsigned long alloc_end = addr + (PAGE_SIZE << order);
+@@ -3001,7 +3023,7 @@ EXPORT_SYMBOL(alloc_pages_exact);
+ */
+ void * __meminit alloc_pages_exact_nid(int nid, size_t size, gfp_t gfp_mask)
+ {
+- unsigned order = get_order(size);
++ unsigned int order = get_order(size);
+ struct page *p = alloc_pages_node(nid, gfp_mask, order);
+ if (!p)
+ return NULL;
+@@ -3300,7 +3322,8 @@ void show_free_areas(unsigned int filter)
+ }
+
+ for_each_populated_zone(zone) {
+- unsigned long nr[MAX_ORDER], flags, order, total = 0;
++ unsigned int order;
++ unsigned long nr[MAX_ORDER], flags, total = 0;
+ unsigned char types[MAX_ORDER];
+
+ if (skip_free_areas_node(filter, zone_to_nid(zone)))
+@@ -3649,7 +3672,7 @@ static void build_zonelists(pg_data_t *pgdat)
+ nodemask_t used_mask;
+ int local_node, prev_node;
+ struct zonelist *zonelist;
+- int order = current_zonelist_order;
++ unsigned int order = current_zonelist_order;
+
+ /* initialize zonelists */
+ for (i = 0; i < MAX_ZONELISTS; i++) {
+@@ -6320,7 +6343,8 @@ int alloc_contig_range(unsigned long start, unsigned long end,
+ unsigned migratetype)
+ {
+ unsigned long outer_start, outer_end;
+- int ret = 0, order;
++ unsigned int order;
++ int ret = 0;
+
+ struct compact_control cc = {
+ .nr_migratepages = 0,
+diff --git a/mm/process_vm_access.c b/mm/process_vm_access.c
+index 5077afcd9e11..b2dfa8cf6e4c 100644
+--- a/mm/process_vm_access.c
++++ b/mm/process_vm_access.c
+@@ -197,7 +197,7 @@ static ssize_t process_vm_rw_core(pid_t pid, struct iov_iter *iter,
+ goto free_proc_pages;
+ }
+
+- mm = mm_access(task, PTRACE_MODE_ATTACH);
++ mm = mm_access(task, PTRACE_MODE_ATTACH_REALCREDS);
+ if (!mm || IS_ERR(mm)) {
+ rc = IS_ERR(mm) ? PTR_ERR(mm) : -ESRCH;
+ /*
+diff --git a/net/core/datagram.c b/net/core/datagram.c
+index 3a402a7b20e9..2850ab32f28a 100644
+--- a/net/core/datagram.c
++++ b/net/core/datagram.c
+@@ -130,6 +130,35 @@ out_noerr:
+ goto out;
+ }
+
++static struct sk_buff *skb_set_peeked(struct sk_buff *skb)
++{
++ struct sk_buff *nskb;
++
++ if (skb->peeked)
++ return skb;
++
++ /* We have to unshare an skb before modifying it. */
++ if (!skb_shared(skb))
++ goto done;
++
++ nskb = skb_clone(skb, GFP_ATOMIC);
++ if (!nskb)
++ return ERR_PTR(-ENOMEM);
++
++ skb->prev->next = nskb;
++ skb->next->prev = nskb;
++ nskb->prev = skb->prev;
++ nskb->next = skb->next;
++
++ consume_skb(skb);
++ skb = nskb;
++
++done:
++ skb->peeked = 1;
++
++ return skb;
++}
++
+ /**
+ * __skb_recv_datagram - Receive a datagram skbuff
+ * @sk: socket
+@@ -164,7 +193,9 @@ out_noerr:
+ struct sk_buff *__skb_recv_datagram(struct sock *sk, unsigned int flags,
+ int *peeked, int *off, int *err)
+ {
++ struct sk_buff_head *queue = &sk->sk_receive_queue;
+ struct sk_buff *skb, *last;
++ unsigned long cpu_flags;
+ long timeo;
+ /*
+ * Caller is allowed not to check sk->sk_err before skb_recv_datagram()
+@@ -183,8 +214,6 @@ struct sk_buff *__skb_recv_datagram(struct sock *sk, unsigned int flags,
+ * Look at current nfs client by the way...
+ * However, this function was correct in any case. 8)
+ */
+- unsigned long cpu_flags;
+- struct sk_buff_head *queue = &sk->sk_receive_queue;
+ int _off = *off;
+
+ last = (struct sk_buff *)queue;
+@@ -198,7 +227,12 @@ struct sk_buff *__skb_recv_datagram(struct sock *sk, unsigned int flags,
+ _off -= skb->len;
+ continue;
+ }
+- skb->peeked = 1;
++
++ skb = skb_set_peeked(skb);
++ error = PTR_ERR(skb);
++ if (IS_ERR(skb))
++ goto unlock_err;
++
+ atomic_inc(&skb->users);
+ } else
+ __skb_unlink(skb, queue);
+@@ -222,6 +256,8 @@ struct sk_buff *__skb_recv_datagram(struct sock *sk, unsigned int flags,
+
+ return NULL;
+
++unlock_err:
++ spin_unlock_irqrestore(&queue->lock, cpu_flags);
+ no_packet:
+ *err = error;
+ return NULL;
+diff --git a/scripts/coccinelle/iterators/use_after_iter.cocci b/scripts/coccinelle/iterators/use_after_iter.cocci
+index f085f5968c52..ce8cc9c006e5 100644
+--- a/scripts/coccinelle/iterators/use_after_iter.cocci
++++ b/scripts/coccinelle/iterators/use_after_iter.cocci
+@@ -123,7 +123,7 @@ list_remove_head(x,c,...)
+ |
+ sizeof(<+...c...+>)
+ |
+-&c->member
++ &c->member
+ |
+ c = E
+ |
+diff --git a/security/commoncap.c b/security/commoncap.c
+index bab0611afc1e..6849e6c12987 100644
+--- a/security/commoncap.c
++++ b/security/commoncap.c
+@@ -142,12 +142,17 @@ int cap_ptrace_access_check(struct task_struct *child, unsigned int mode)
+ {
+ int ret = 0;
+ const struct cred *cred, *child_cred;
++ const kernel_cap_t *caller_caps;
+
+ rcu_read_lock();
+ cred = current_cred();
+ child_cred = __task_cred(child);
++ if (mode & PTRACE_MODE_FSCREDS)
++ caller_caps = &cred->cap_effective;
++ else
++ caller_caps = &cred->cap_permitted;
+ if (cred->user_ns == child_cred->user_ns &&
+- cap_issubset(child_cred->cap_permitted, cred->cap_permitted))
++ cap_issubset(child_cred->cap_permitted, *caller_caps))
+ goto out;
+ if (ns_capable(child_cred->user_ns, CAP_SYS_PTRACE))
+ goto out;
+diff --git a/security/keys/encrypted-keys/encrypted.c b/security/keys/encrypted-keys/encrypted.c
+index 7bed4ad7cd76..0a374a2ce030 100644
+--- a/security/keys/encrypted-keys/encrypted.c
++++ b/security/keys/encrypted-keys/encrypted.c
+@@ -845,6 +845,8 @@ static int encrypted_update(struct key *key, struct key_preparsed_payload *prep)
+ size_t datalen = prep->datalen;
+ int ret = 0;
+
++ if (test_bit(KEY_FLAG_NEGATIVE, &key->flags))
++ return -ENOKEY;
+ if (datalen <= 0 || datalen > 32767 || !prep->data)
+ return -EINVAL;
+
+diff --git a/security/keys/trusted.c b/security/keys/trusted.c
+index c0594cb07ada..aeb38f1a12e7 100644
+--- a/security/keys/trusted.c
++++ b/security/keys/trusted.c
+@@ -984,13 +984,16 @@ static void trusted_rcu_free(struct rcu_head *rcu)
+ */
+ static int trusted_update(struct key *key, struct key_preparsed_payload *prep)
+ {
+- struct trusted_key_payload *p = key->payload.data;
++ struct trusted_key_payload *p;
+ struct trusted_key_payload *new_p;
+ struct trusted_key_options *new_o;
+ size_t datalen = prep->datalen;
+ char *datablob;
+ int ret = 0;
+
++ if (test_bit(KEY_FLAG_NEGATIVE, &key->flags))
++ return -ENOKEY;
++ p = key->payload.data;
+ if (!p->migratable)
+ return -EPERM;
+ if (datalen <= 0 || datalen > 32767 || !prep->data)
+diff --git a/security/keys/user_defined.c b/security/keys/user_defined.c
+index 36b47bbd3d8c..7cf22260bdff 100644
+--- a/security/keys/user_defined.c
++++ b/security/keys/user_defined.c
+@@ -120,7 +120,10 @@ int user_update(struct key *key, struct key_preparsed_payload *prep)
+
+ if (ret == 0) {
+ /* attach the new data, displacing the old */
+- zap = key->payload.data;
++ if (!test_bit(KEY_FLAG_NEGATIVE, &key->flags))
++ zap = key->payload.data;
++ else
++ zap = NULL;
+ rcu_assign_keypointer(key, upayload);
+ key->expiry = 0;
+ }
+diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
+index 9d3c64af1ca9..cddf5d17bbc4 100644
+--- a/security/smack/smack_lsm.c
++++ b/security/smack/smack_lsm.c
+@@ -308,12 +308,10 @@ static int smk_copy_rules(struct list_head *nhead, struct list_head *ohead,
+ */
+ static inline unsigned int smk_ptrace_mode(unsigned int mode)
+ {
+- switch (mode) {
+- case PTRACE_MODE_READ:
+- return MAY_READ;
+- case PTRACE_MODE_ATTACH:
++ if (mode & PTRACE_MODE_ATTACH)
+ return MAY_READWRITE;
+- }
++ if (mode & PTRACE_MODE_READ)
++ return MAY_READ;
+
+ return 0;
+ }
+diff --git a/security/yama/yama_lsm.c b/security/yama/yama_lsm.c
+index 13c88fbcf037..0038834b558e 100644
+--- a/security/yama/yama_lsm.c
++++ b/security/yama/yama_lsm.c
+@@ -292,7 +292,7 @@ int yama_ptrace_access_check(struct task_struct *child,
+ return rc;
+
+ /* require ptrace target be a child of ptracer on attach */
+- if (mode == PTRACE_MODE_ATTACH) {
++ if (mode & PTRACE_MODE_ATTACH) {
+ switch (ptrace_scope) {
+ case YAMA_SCOPE_DISABLED:
+ /* No additional restrictions. */
+@@ -318,7 +318,7 @@ int yama_ptrace_access_check(struct task_struct *child,
+ }
+ }
+
+- if (rc) {
++ if (rc && (mode & PTRACE_MODE_NOAUDIT) == 0) {
+ printk_ratelimited(KERN_NOTICE
+ "ptrace of pid %d was attempted by: %s (pid %d)\n",
+ child->pid, current->comm, current->pid);
+diff --git a/sound/pci/hda/hda_generic.c b/sound/pci/hda/hda_generic.c
+index 6c6e35aba989..e5d39ed42e85 100644
+--- a/sound/pci/hda/hda_generic.c
++++ b/sound/pci/hda/hda_generic.c
+@@ -705,9 +705,6 @@ static void activate_amp(struct hda_codec *codec, hda_nid_t nid, int dir,
+ unsigned int caps;
+ unsigned int mask, val;
+
+- if (!enable && is_active_nid(codec, nid, dir, idx_to_check))
+- return;
+-
+ caps = query_amp_caps(codec, nid, dir);
+ val = get_amp_val_to_activate(codec, nid, dir, caps, enable);
+ mask = get_amp_mask_to_modify(codec, nid, dir, idx_to_check, caps);
+@@ -718,12 +715,22 @@ static void activate_amp(struct hda_codec *codec, hda_nid_t nid, int dir,
+ update_amp(codec, nid, dir, idx, mask, val);
+ }
+
++static void check_and_activate_amp(struct hda_codec *codec, hda_nid_t nid,
++ int dir, int idx, int idx_to_check,
++ bool enable)
++{
++ /* check whether the given amp is still used by others */
++ if (!enable && is_active_nid(codec, nid, dir, idx_to_check))
++ return;
++ activate_amp(codec, nid, dir, idx, idx_to_check, enable);
++}
++
+ static void activate_amp_out(struct hda_codec *codec, struct nid_path *path,
+ int i, bool enable)
+ {
+ hda_nid_t nid = path->path[i];
+ init_amp(codec, nid, HDA_OUTPUT, 0);
+- activate_amp(codec, nid, HDA_OUTPUT, 0, 0, enable);
++ check_and_activate_amp(codec, nid, HDA_OUTPUT, 0, 0, enable);
+ }
+
+ static void activate_amp_in(struct hda_codec *codec, struct nid_path *path,
+@@ -751,9 +758,16 @@ static void activate_amp_in(struct hda_codec *codec, struct nid_path *path,
+ * when aa-mixer is available, we need to enable the path as well
+ */
+ for (n = 0; n < nums; n++) {
+- if (n != idx && (!add_aamix || conn[n] != spec->mixer_merge_nid))
+- continue;
+- activate_amp(codec, nid, HDA_INPUT, n, idx, enable);
++ if (n != idx) {
++ if (conn[n] != spec->mixer_merge_nid)
++ continue;
++ /* when aamix is disabled, force to off */
++ if (!add_aamix) {
++ activate_amp(codec, nid, HDA_INPUT, n, n, false);
++ continue;
++ }
++ }
++ check_and_activate_amp(codec, nid, HDA_INPUT, n, idx, enable);
+ }
+ }
+
+@@ -1473,6 +1487,12 @@ static bool map_singles(struct hda_codec *codec, int outs,
+ return found;
+ }
+
++static inline bool has_aamix_out_paths(struct hda_gen_spec *spec)
++{
++ return spec->aamix_out_paths[0] || spec->aamix_out_paths[1] ||
++ spec->aamix_out_paths[2];
++}
++
+ /* create a new path including aamix if available, and return its index */
+ static int check_aamix_out_path(struct hda_codec *codec, int path_idx)
+ {
+@@ -2315,25 +2335,51 @@ static void update_aamix_paths(struct hda_codec *codec, bool do_mix,
+ }
+ }
+
++/* re-initialize the output paths; only called from loopback_mixing_put() */
++static void update_output_paths(struct hda_codec *codec, int num_outs,
++ const int *paths)
++{
++ struct hda_gen_spec *spec = codec->spec;
++ struct nid_path *path;
++ int i;
++
++ for (i = 0; i < num_outs; i++) {
++ path = snd_hda_get_path_from_idx(codec, paths[i]);
++ if (path)
++ snd_hda_activate_path(codec, path, path->active,
++ spec->aamix_mode);
++ }
++}
++
+ static int loopback_mixing_put(struct snd_kcontrol *kcontrol,
+ struct snd_ctl_elem_value *ucontrol)
+ {
+ struct hda_codec *codec = snd_kcontrol_chip(kcontrol);
+ struct hda_gen_spec *spec = codec->spec;
++ const struct auto_pin_cfg *cfg = &spec->autocfg;
+ unsigned int val = ucontrol->value.enumerated.item[0];
+
+ if (val == spec->aamix_mode)
+ return 0;
+ spec->aamix_mode = val;
+- update_aamix_paths(codec, val, spec->out_paths[0],
+- spec->aamix_out_paths[0],
+- spec->autocfg.line_out_type);
+- update_aamix_paths(codec, val, spec->hp_paths[0],
+- spec->aamix_out_paths[1],
+- AUTO_PIN_HP_OUT);
+- update_aamix_paths(codec, val, spec->speaker_paths[0],
+- spec->aamix_out_paths[2],
+- AUTO_PIN_SPEAKER_OUT);
++ if (has_aamix_out_paths(spec)) {
++ update_aamix_paths(codec, val, spec->out_paths[0],
++ spec->aamix_out_paths[0],
++ cfg->line_out_type);
++ update_aamix_paths(codec, val, spec->hp_paths[0],
++ spec->aamix_out_paths[1],
++ AUTO_PIN_HP_OUT);
++ update_aamix_paths(codec, val, spec->speaker_paths[0],
++ spec->aamix_out_paths[2],
++ AUTO_PIN_SPEAKER_OUT);
++ } else {
++ update_output_paths(codec, cfg->line_outs, spec->out_paths);
++ if (cfg->line_out_type != AUTO_PIN_HP_OUT)
++ update_output_paths(codec, cfg->hp_outs, spec->hp_paths);
++ if (cfg->line_out_type != AUTO_PIN_SPEAKER_OUT)
++ update_output_paths(codec, cfg->speaker_outs,
++ spec->speaker_paths);
++ }
+ return 1;
+ }
+
+@@ -2351,12 +2397,13 @@ static int create_loopback_mixing_ctl(struct hda_codec *codec)
+
+ if (!spec->mixer_nid)
+ return 0;
+- if (!(spec->aamix_out_paths[0] || spec->aamix_out_paths[1] ||
+- spec->aamix_out_paths[2]))
+- return 0;
+ if (!snd_hda_gen_add_kctl(spec, NULL, &loopback_mixing_enum))
+ return -ENOMEM;
+ spec->have_aamix_ctl = 1;
++ /* if no explicit aamix path is present (e.g. for Realtek codecs),
++ * enable aamix as default -- just for compatibility
++ */
++ spec->aamix_mode = !has_aamix_out_paths(spec);
+ return 0;
+ }
+
+@@ -5236,6 +5283,8 @@ static void init_aamix_paths(struct hda_codec *codec)
+
+ if (!spec->have_aamix_ctl)
+ return;
++ if (!has_aamix_out_paths(spec))
++ return;
+ update_aamix_paths(codec, spec->aamix_mode, spec->out_paths[0],
+ spec->aamix_out_paths[0],
+ spec->autocfg.line_out_type);
+diff --git a/sound/pci/hda/patch_cirrus.c b/sound/pci/hda/patch_cirrus.c
+index e9eec080e46c..087228a0bcea 100644
+--- a/sound/pci/hda/patch_cirrus.c
++++ b/sound/pci/hda/patch_cirrus.c
+@@ -174,8 +174,12 @@ static void cs_automute(struct hda_codec *codec)
+ snd_hda_gen_update_outputs(codec);
+
+ if (spec->gpio_eapd_hp || spec->gpio_eapd_speaker) {
+- spec->gpio_data = spec->gen.hp_jack_present ?
+- spec->gpio_eapd_hp : spec->gpio_eapd_speaker;
++ if (spec->gen.automute_speaker)
++ spec->gpio_data = spec->gen.hp_jack_present ?
++ spec->gpio_eapd_hp : spec->gpio_eapd_speaker;
++ else
++ spec->gpio_data =
++ spec->gpio_eapd_hp | spec->gpio_eapd_speaker;
+ snd_hda_codec_write(codec, 0x01, 0,
+ AC_VERB_SET_GPIO_DATA, spec->gpio_data);
+ }
+diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
+index 8e8ccde973df..f6c5cbbbcfea 100644
+--- a/sound/pci/hda/patch_hdmi.c
++++ b/sound/pci/hda/patch_hdmi.c
+@@ -1555,6 +1555,8 @@ static bool hdmi_present_sense(struct hdmi_spec_per_pin *per_pin, int repoll)
+
+ mutex_lock(&per_pin->lock);
+ pin_eld->monitor_present = !!(present & AC_PINSENSE_PRESENCE);
++ eld->monitor_present = pin_eld->monitor_present;
++
+ if (pin_eld->monitor_present)
+ eld->eld_valid = !!(present & AC_PINSENSE_ELDV);
+ else
+@@ -3356,6 +3358,9 @@ static const struct hda_codec_preset snd_hda_preset_hdmi[] = {
+ { .id = 0x10de0070, .name = "GPU 70 HDMI/DP", .patch = patch_nvhdmi },
+ { .id = 0x10de0071, .name = "GPU 71 HDMI/DP", .patch = patch_nvhdmi },
+ { .id = 0x10de0072, .name = "GPU 72 HDMI/DP", .patch = patch_nvhdmi },
++{ .id = 0x10de007d, .name = "GPU 7d HDMI/DP", .patch = patch_nvhdmi },
++{ .id = 0x10de0082, .name = "GPU 82 HDMI/DP", .patch = patch_nvhdmi },
++{ .id = 0x10de0083, .name = "GPU 83 HDMI/DP", .patch = patch_nvhdmi },
+ { .id = 0x10de8001, .name = "MCP73 HDMI", .patch = patch_nvhdmi_2ch },
+ { .id = 0x11069f80, .name = "VX900 HDMI/DP", .patch = patch_via_hdmi },
+ { .id = 0x11069f81, .name = "VX900 HDMI/DP", .patch = patch_via_hdmi },
+@@ -3417,6 +3422,7 @@ MODULE_ALIAS("snd-hda-codec-id:10de0067");
+ MODULE_ALIAS("snd-hda-codec-id:10de0070");
+ MODULE_ALIAS("snd-hda-codec-id:10de0071");
+ MODULE_ALIAS("snd-hda-codec-id:10de0072");
++MODULE_ALIAS("snd-hda-codec-id:10de007d");
+ MODULE_ALIAS("snd-hda-codec-id:10de8001");
+ MODULE_ALIAS("snd-hda-codec-id:11069f80");
+ MODULE_ALIAS("snd-hda-codec-id:11069f81");
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 0405e9753c04..1bc0be907ead 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -4618,6 +4618,7 @@ enum {
+ ALC290_FIXUP_SUBWOOFER,
+ ALC290_FIXUP_SUBWOOFER_HSJACK,
+ ALC269_FIXUP_THINKPAD_ACPI,
++ ALC269_FIXUP_DMIC_THINKPAD_ACPI,
+ ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
+ ALC255_FIXUP_DELL2_MIC_NO_PRESENCE,
+ ALC255_FIXUP_HEADSET_MODE,
+@@ -5052,6 +5053,12 @@ static const struct hda_fixup alc269_fixups[] = {
+ .type = HDA_FIXUP_FUNC,
+ .v.func = hda_fixup_thinkpad_acpi,
+ },
++ [ALC269_FIXUP_DMIC_THINKPAD_ACPI] = {
++ .type = HDA_FIXUP_FUNC,
++ .v.func = alc_fixup_inv_dmic,
++ .chained = true,
++ .chain_id = ALC269_FIXUP_THINKPAD_ACPI,
++ },
+ [ALC255_FIXUP_DELL1_MIC_NO_PRESENCE] = {
+ .type = HDA_FIXUP_PINS,
+ .v.pins = (const struct hda_pintbl[]) {
+@@ -5386,6 +5393,8 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x17aa, 0x2226, "ThinkPad X250", ALC292_FIXUP_TPT440_DOCK),
+ SND_PCI_QUIRK(0x17aa, 0x2233, "Thinkpad", ALC293_FIXUP_LENOVO_SPK_NOISE),
+ SND_PCI_QUIRK(0x17aa, 0x30bb, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY),
++ SND_PCI_QUIRK(0x17aa, 0x30e2, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY),
++ SND_PCI_QUIRK(0x17aa, 0x3902, "Lenovo E50-80", ALC269_FIXUP_DMIC_THINKPAD_ACPI),
+ SND_PCI_QUIRK(0x17aa, 0x3977, "IdeaPad S210", ALC283_FIXUP_INT_MIC),
+ SND_PCI_QUIRK(0x17aa, 0x3978, "IdeaPad Y410P", ALC269_FIXUP_NO_SHUTUP),
+ SND_PCI_QUIRK(0x17aa, 0x5013, "Thinkpad", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
+diff --git a/sound/pci/intel8x0.c b/sound/pci/intel8x0.c
+index 4a28252a42b9..b85ca1a2f75e 100644
+--- a/sound/pci/intel8x0.c
++++ b/sound/pci/intel8x0.c
+@@ -2894,6 +2894,7 @@ static void intel8x0_measure_ac97_clock(struct intel8x0 *chip)
+
+ static struct snd_pci_quirk intel8x0_clock_list[] = {
+ SND_PCI_QUIRK(0x0e11, 0x008a, "AD1885", 41000),
++ SND_PCI_QUIRK(0x1014, 0x0581, "AD1981B", 48000),
+ SND_PCI_QUIRK(0x1028, 0x00be, "AD1885", 44100),
+ SND_PCI_QUIRK(0x1028, 0x0177, "AD1980", 48000),
+ SND_PCI_QUIRK(0x1028, 0x01ad, "AD1981B", 48000),
+diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
+index b4edae1d4f5d..0d7f1ced1d3b 100644
+--- a/sound/usb/mixer.c
++++ b/sound/usb/mixer.c
+@@ -805,12 +805,12 @@ static struct usb_feature_control_info audio_feature_info[] = {
+ { "Tone Control - Treble", USB_MIXER_S8 },
+ { "Graphic Equalizer", USB_MIXER_S8 }, /* FIXME: not implemeted yet */
+ { "Auto Gain Control", USB_MIXER_BOOLEAN },
+- { "Delay Control", USB_MIXER_U16 },
++ { "Delay Control", USB_MIXER_U16 }, /* FIXME: U32 in UAC2 */
+ { "Bass Boost", USB_MIXER_BOOLEAN },
+ { "Loudness", USB_MIXER_BOOLEAN },
+ /* UAC2 specific */
+- { "Input Gain Control", USB_MIXER_U16 },
+- { "Input Gain Pad Control", USB_MIXER_BOOLEAN },
++ { "Input Gain Control", USB_MIXER_S16 },
++ { "Input Gain Pad Control", USB_MIXER_S16 },
+ { "Phase Inverter Control", USB_MIXER_BOOLEAN },
+ };
+
+diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
+index 42c1d0171a5a..7da345b0cdaf 100644
+--- a/sound/usb/quirks.c
++++ b/sound/usb/quirks.c
+@@ -168,6 +168,12 @@ static int create_fixed_stream_quirk(struct snd_usb_audio *chip,
+ }
+ alts = &iface->altsetting[fp->altset_idx];
+ altsd = get_iface_desc(alts);
++ if (altsd->bNumEndpoints < 1) {
++ kfree(fp);
++ kfree(rate_table);
++ return -EINVAL;
++ }
++
+ fp->protocol = altsd->bInterfaceProtocol;
+
+ if (fp->datainterval == 0)
+@@ -1108,6 +1114,7 @@ bool snd_usb_get_sample_rate_quirk(struct snd_usb_audio *chip)
+ switch (chip->usb_id) {
+ case USB_ID(0x045E, 0x075D): /* MS Lifecam Cinema */
+ case USB_ID(0x045E, 0x076D): /* MS Lifecam HD-5000 */
++ case USB_ID(0x045E, 0x076E): /* MS Lifecam HD-5001 */
+ case USB_ID(0x045E, 0x076F): /* MS Lifecam HD-6000 */
+ case USB_ID(0x045E, 0x0772): /* MS Lifecam Studio */
+ case USB_ID(0x045E, 0x0779): /* MS Lifecam HD-3000 */
+diff --git a/tools/hv/Makefile b/tools/hv/Makefile
+index bd22f786a60c..50715181d9a9 100644
+--- a/tools/hv/Makefile
++++ b/tools/hv/Makefile
+@@ -5,9 +5,11 @@ PTHREAD_LIBS = -lpthread
+ WARNINGS = -Wall -Wextra
+ CFLAGS = $(WARNINGS) -g $(PTHREAD_LIBS)
+
+-all: hv_kvp_daemon hv_vss_daemon
++CFLAGS += -D__EXPORTED_HEADERS__ -I../../include/uapi -I../../include
++
++all: hv_kvp_daemon hv_vss_daemon hv_fcopy_daemon
+ %: %.c
+ $(CC) $(CFLAGS) -o $@ $^
+
+ clean:
+- $(RM) hv_kvp_daemon hv_vss_daemon
++ $(RM) hv_kvp_daemon hv_vss_daemon hv_fcopy_daemon
+diff --git a/tools/perf/util/pmu.c b/tools/perf/util/pmu.c
+index e243ad962a4d..bc7ca4ffcd2d 100644
+--- a/tools/perf/util/pmu.c
++++ b/tools/perf/util/pmu.c
+@@ -221,13 +221,12 @@ static int pmu_aliases_parse(char *dir, struct list_head *head)
+ {
+ struct dirent *evt_ent;
+ DIR *event_dir;
+- int ret = 0;
+
+ event_dir = opendir(dir);
+ if (!event_dir)
+ return -EINVAL;
+
+- while (!ret && (evt_ent = readdir(event_dir))) {
++ while ((evt_ent = readdir(event_dir))) {
+ char path[PATH_MAX];
+ char *name = evt_ent->d_name;
+ FILE *file;
+@@ -243,17 +242,19 @@ static int pmu_aliases_parse(char *dir, struct list_head *head)
+
+ snprintf(path, PATH_MAX, "%s/%s", dir, name);
+
+- ret = -EINVAL;
+ file = fopen(path, "r");
+- if (!file)
+- break;
++ if (!file) {
++ pr_debug("Cannot open %s\n", path);
++ continue;
++ }
+
+- ret = perf_pmu__new_alias(head, dir, name, file);
++ if (perf_pmu__new_alias(head, dir, name, file) < 0)
++ pr_debug("Cannot set up %s\n", name);
+ fclose(file);
+ }
+
+ closedir(event_dir);
+- return ret;
++ return 0;
+ }
+
+ /*
+diff --git a/tools/testing/selftests/efivarfs/efivarfs.sh b/tools/testing/selftests/efivarfs/efivarfs.sh
+index 77edcdcc016b..057278448515 100644
+--- a/tools/testing/selftests/efivarfs/efivarfs.sh
++++ b/tools/testing/selftests/efivarfs/efivarfs.sh
+@@ -88,7 +88,11 @@ test_delete()
+ exit 1
+ fi
+
+- rm $file
++ rm $file 2>/dev/null
++ if [ $? -ne 0 ]; then
++ chattr -i $file
++ rm $file
++ fi
+
+ if [ -e $file ]; then
+ echo "$file couldn't be deleted" >&2
+@@ -111,6 +115,7 @@ test_zero_size_delete()
+ exit 1
+ fi
+
++ chattr -i $file
+ printf "$attrs" > $file
+
+ if [ -e $file ]; then
+@@ -141,7 +146,11 @@ test_valid_filenames()
+ echo "$file could not be created" >&2
+ ret=1
+ else
+- rm $file
++ rm $file 2>/dev/null
++ if [ $? -ne 0 ]; then
++ chattr -i $file
++ rm $file
++ fi
+ fi
+ done
+
+@@ -174,7 +183,11 @@ test_invalid_filenames()
+
+ if [ -e $file ]; then
+ echo "Creating $file should have failed" >&2
+- rm $file
++ rm $file 2>/dev/null
++ if [ $? -ne 0 ]; then
++ chattr -i $file
++ rm $file
++ fi
+ ret=1
+ fi
+ done
+diff --git a/tools/testing/selftests/efivarfs/open-unlink.c b/tools/testing/selftests/efivarfs/open-unlink.c
+index 8c0764407b3c..4af74f733036 100644
+--- a/tools/testing/selftests/efivarfs/open-unlink.c
++++ b/tools/testing/selftests/efivarfs/open-unlink.c
+@@ -1,10 +1,68 @@
++#include <errno.h>
+ #include <stdio.h>
+ #include <stdint.h>
+ #include <stdlib.h>
+ #include <unistd.h>
++#include <sys/ioctl.h>
+ #include <sys/types.h>
+ #include <sys/stat.h>
+ #include <fcntl.h>
++#include <linux/fs.h>
++
++static int set_immutable(const char *path, int immutable)
++{
++ unsigned int flags;
++ int fd;
++ int rc;
++ int error;
++
++ fd = open(path, O_RDONLY);
++ if (fd < 0)
++ return fd;
++
++ rc = ioctl(fd, FS_IOC_GETFLAGS, &flags);
++ if (rc < 0) {
++ error = errno;
++ close(fd);
++ errno = error;
++ return rc;
++ }
++
++ if (immutable)
++ flags |= FS_IMMUTABLE_FL;
++ else
++ flags &= ~FS_IMMUTABLE_FL;
++
++ rc = ioctl(fd, FS_IOC_SETFLAGS, &flags);
++ error = errno;
++ close(fd);
++ errno = error;
++ return rc;
++}
++
++static int get_immutable(const char *path)
++{
++ unsigned int flags;
++ int fd;
++ int rc;
++ int error;
++
++ fd = open(path, O_RDONLY);
++ if (fd < 0)
++ return fd;
++
++ rc = ioctl(fd, FS_IOC_GETFLAGS, &flags);
++ if (rc < 0) {
++ error = errno;
++ close(fd);
++ errno = error;
++ return rc;
++ }
++ close(fd);
++ if (flags & FS_IMMUTABLE_FL)
++ return 1;
++ return 0;
++}
+
+ int main(int argc, char **argv)
+ {
+@@ -27,7 +85,7 @@ int main(int argc, char **argv)
+ buf[4] = 0;
+
+ /* create a test variable */
+- fd = open(path, O_WRONLY | O_CREAT);
++ fd = open(path, O_WRONLY | O_CREAT, 0600);
+ if (fd < 0) {
+ perror("open(O_WRONLY)");
+ return EXIT_FAILURE;
+@@ -41,6 +99,18 @@ int main(int argc, char **argv)
+
+ close(fd);
+
++ rc = get_immutable(path);
++ if (rc < 0) {
++ perror("ioctl(FS_IOC_GETFLAGS)");
++ return EXIT_FAILURE;
++ } else if (rc) {
++ rc = set_immutable(path, 0);
++ if (rc < 0) {
++ perror("ioctl(FS_IOC_SETFLAGS)");
++ return EXIT_FAILURE;
++ }
++ }
++
+ fd = open(path, O_RDONLY);
+ if (fd < 0) {
+ perror("open");
+diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
+index 329c3c91bb68..2c9d47fbc498 100644
+--- a/virt/kvm/kvm_main.c
++++ b/virt/kvm/kvm_main.c
+@@ -460,6 +460,16 @@ static struct kvm *kvm_create_vm(unsigned long type)
+ if (!kvm)
+ return ERR_PTR(-ENOMEM);
+
++ spin_lock_init(&kvm->mmu_lock);
++ atomic_inc(¤t->mm->mm_count);
++ kvm->mm = current->mm;
++ kvm_eventfd_init(kvm);
++ mutex_init(&kvm->lock);
++ mutex_init(&kvm->irq_lock);
++ mutex_init(&kvm->slots_lock);
++ atomic_set(&kvm->users_count, 1);
++ INIT_LIST_HEAD(&kvm->devices);
++
+ r = kvm_arch_init_vm(kvm, type);
+ if (r)
+ goto out_err_no_disable;
+@@ -500,16 +510,6 @@ static struct kvm *kvm_create_vm(unsigned long type)
+ goto out_err;
+ }
+
+- spin_lock_init(&kvm->mmu_lock);
+- kvm->mm = current->mm;
+- atomic_inc(&kvm->mm->mm_count);
+- kvm_eventfd_init(kvm);
+- mutex_init(&kvm->lock);
+- mutex_init(&kvm->irq_lock);
+- mutex_init(&kvm->slots_lock);
+- atomic_set(&kvm->users_count, 1);
+- INIT_LIST_HEAD(&kvm->devices);
+-
+ r = kvm_init_mmu_notifier(kvm);
+ if (r)
+ goto out_err;
+@@ -531,6 +531,7 @@ out_err_no_disable:
+ kfree(kvm->buses[i]);
+ kvfree(kvm->memslots);
+ kvm_arch_free_vm(kvm);
++ mmdrop(current->mm);
+ return ERR_PTR(r);
+ }
+
^ permalink raw reply related [flat|nested] 67+ messages in thread
* [gentoo-commits] proj/linux-patches:3.18 commit in: /
@ 2016-05-12 0:10 Mike Pagano
0 siblings, 0 replies; 67+ messages in thread
From: Mike Pagano @ 2016-05-12 0:10 UTC (permalink / raw
To: gentoo-commits
commit: bd40d08ff68c535adeddd9303c508ca63ac433f4
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Thu May 12 00:10:44 2016 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Thu May 12 00:10:44 2016 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=bd40d08f
Linux patches 3.18.32 and 3.18.33
0000_README | 8 +
1031_linux-3.18.32.patch | 2327 ++++++++++++++++++++++++++++++++++++++++++++++
1032_linux-3.18.33.patch | 390 ++++++++
3 files changed, 2725 insertions(+)
diff --git a/0000_README b/0000_README
index 8c2614b..e4866a4 100644
--- a/0000_README
+++ b/0000_README
@@ -167,6 +167,14 @@ Patch: 1030_linux-3.18.31.patch
From: http://www.kernel.org
Desc: Linux 3.18.31
+Patch: 1031_linux-3.18.32.patch
+From: http://www.kernel.org
+Desc: Linux 3.18.32
+
+Patch: 1032_linux-3.18.33.patch
+From: http://www.kernel.org
+Desc: Linux 3.18.33
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1031_linux-3.18.32.patch b/1031_linux-3.18.32.patch
new file mode 100644
index 0000000..f1a51f9
--- /dev/null
+++ b/1031_linux-3.18.32.patch
@@ -0,0 +1,2327 @@
+diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
+index 61f9273d0c46..b2bdea1953e6 100644
+--- a/Documentation/kernel-parameters.txt
++++ b/Documentation/kernel-parameters.txt
+@@ -3651,6 +3651,8 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
+ sector if the number is odd);
+ i = IGNORE_DEVICE (don't bind to this
+ device);
++ j = NO_REPORT_LUNS (don't use report luns
++ command, uas only);
+ l = NOT_LOCKABLE (don't try to lock and
+ unlock ejectable media);
+ m = MAX_SECTORS_64 (don't transfer more
+diff --git a/Makefile b/Makefile
+index a05c9336722d..7a79cf89bf17 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 18
+-SUBLEVEL = 31
++SUBLEVEL = 32
+ EXTRAVERSION =
+ NAME = Diseased Newt
+
+diff --git a/arch/arm/mach-omap2/omap_hwmod.c b/arch/arm/mach-omap2/omap_hwmod.c
+index bb9a148af8cc..e67ffbc9ec40 100644
+--- a/arch/arm/mach-omap2/omap_hwmod.c
++++ b/arch/arm/mach-omap2/omap_hwmod.c
+@@ -1439,9 +1439,7 @@ static void _enable_sysc(struct omap_hwmod *oh)
+ (sf & SYSC_HAS_CLOCKACTIVITY))
+ _set_clockactivity(oh, oh->class->sysc->clockact, &v);
+
+- /* If the cached value is the same as the new value, skip the write */
+- if (oh->_sysc_cache != v)
+- _write_sysconfig(v, oh);
++ _write_sysconfig(v, oh);
+
+ /*
+ * Set the autoidle bit only after setting the smartidle bit
+@@ -1504,7 +1502,9 @@ static void _idle_sysc(struct omap_hwmod *oh)
+ _set_master_standbymode(oh, idlemode, &v);
+ }
+
+- _write_sysconfig(v, oh);
++ /* If the cached value is the same as the new value, skip the write */
++ if (oh->_sysc_cache != v)
++ _write_sysconfig(v, oh);
+ }
+
+ /**
+diff --git a/arch/parisc/include/asm/uaccess.h b/arch/parisc/include/asm/uaccess.h
+index a5cb070b54bf..df9d8dd72db2 100644
+--- a/arch/parisc/include/asm/uaccess.h
++++ b/arch/parisc/include/asm/uaccess.h
+@@ -76,6 +76,7 @@ struct exception_table_entry {
+ */
+ struct exception_data {
+ unsigned long fault_ip;
++ unsigned long fault_gp;
+ unsigned long fault_space;
+ unsigned long fault_addr;
+ };
+diff --git a/arch/parisc/kernel/asm-offsets.c b/arch/parisc/kernel/asm-offsets.c
+index dcd55103a4bb..a0dc1e50e3a3 100644
+--- a/arch/parisc/kernel/asm-offsets.c
++++ b/arch/parisc/kernel/asm-offsets.c
+@@ -292,6 +292,7 @@ int main(void)
+ DEFINE(ASM_PT_INITIAL, PT_INITIAL);
+ BLANK();
+ DEFINE(EXCDATA_IP, offsetof(struct exception_data, fault_ip));
++ DEFINE(EXCDATA_GP, offsetof(struct exception_data, fault_gp));
+ DEFINE(EXCDATA_SPACE, offsetof(struct exception_data, fault_space));
+ DEFINE(EXCDATA_ADDR, offsetof(struct exception_data, fault_addr));
+ BLANK();
+diff --git a/arch/parisc/kernel/parisc_ksyms.c b/arch/parisc/kernel/parisc_ksyms.c
+index 568b2c61ea02..3cad8aadc69e 100644
+--- a/arch/parisc/kernel/parisc_ksyms.c
++++ b/arch/parisc/kernel/parisc_ksyms.c
+@@ -47,11 +47,11 @@ EXPORT_SYMBOL(__cmpxchg_u64);
+ EXPORT_SYMBOL(lclear_user);
+ EXPORT_SYMBOL(lstrnlen_user);
+
+-/* Global fixups */
+-extern void fixup_get_user_skip_1(void);
+-extern void fixup_get_user_skip_2(void);
+-extern void fixup_put_user_skip_1(void);
+-extern void fixup_put_user_skip_2(void);
++/* Global fixups - defined as int to avoid creation of function pointers */
++extern int fixup_get_user_skip_1;
++extern int fixup_get_user_skip_2;
++extern int fixup_put_user_skip_1;
++extern int fixup_put_user_skip_2;
+ EXPORT_SYMBOL(fixup_get_user_skip_1);
+ EXPORT_SYMBOL(fixup_get_user_skip_2);
+ EXPORT_SYMBOL(fixup_put_user_skip_1);
+diff --git a/arch/parisc/kernel/traps.c b/arch/parisc/kernel/traps.c
+index 47ee620d15d2..05aab1333dfa 100644
+--- a/arch/parisc/kernel/traps.c
++++ b/arch/parisc/kernel/traps.c
+@@ -802,6 +802,9 @@ void notrace handle_interruption(int code, struct pt_regs *regs)
+
+ if (fault_space == 0 && !in_atomic())
+ {
++ /* Clean up and return if in exception table. */
++ if (fixup_exception(regs))
++ return;
+ pdc_chassis_send_status(PDC_CHASSIS_DIRECT_PANIC);
+ parisc_terminate("Kernel Fault", regs, code, fault_address);
+ }
+diff --git a/arch/parisc/lib/fixup.S b/arch/parisc/lib/fixup.S
+index f8c45cc2947d..1052b747e011 100644
+--- a/arch/parisc/lib/fixup.S
++++ b/arch/parisc/lib/fixup.S
+@@ -26,6 +26,7 @@
+
+ #ifdef CONFIG_SMP
+ .macro get_fault_ip t1 t2
++ loadgp
+ addil LT%__per_cpu_offset,%r27
+ LDREG RT%__per_cpu_offset(%r1),\t1
+ /* t2 = smp_processor_id() */
+@@ -38,16 +39,21 @@
+ LDREGX \t2(\t1),\t2
+ addil LT%exception_data,%r27
+ LDREG RT%exception_data(%r1),\t1
+- /* t1 = &__get_cpu_var(exception_data) */
++ /* t1 = this_cpu_ptr(&exception_data) */
+ add,l \t1,\t2,\t1
++ /* %r27 = t1->fault_gp - restore gp */
++ LDREG EXCDATA_GP(\t1), %r27
+ /* t1 = t1->fault_ip */
+ LDREG EXCDATA_IP(\t1), \t1
+ .endm
+ #else
+ .macro get_fault_ip t1 t2
+- /* t1 = &__get_cpu_var(exception_data) */
++ loadgp
++ /* t1 = this_cpu_ptr(&exception_data) */
+ addil LT%exception_data,%r27
+ LDREG RT%exception_data(%r1),\t2
++ /* %r27 = t2->fault_gp - restore gp */
++ LDREG EXCDATA_GP(\t2), %r27
+ /* t1 = t2->fault_ip */
+ LDREG EXCDATA_IP(\t2), \t1
+ .endm
+diff --git a/arch/parisc/mm/fault.c b/arch/parisc/mm/fault.c
+index e5120e653240..50d64a7fc672 100644
+--- a/arch/parisc/mm/fault.c
++++ b/arch/parisc/mm/fault.c
+@@ -151,6 +151,7 @@ int fixup_exception(struct pt_regs *regs)
+ struct exception_data *d;
+ d = this_cpu_ptr(&exception_data);
+ d->fault_ip = regs->iaoq[0];
++ d->fault_gp = regs->gr[27];
+ d->fault_space = regs->isr;
+ d->fault_addr = regs->ior;
+
+diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
+index d77189c351a8..160981f69d4f 100644
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -656,7 +656,6 @@ int __kvm_set_xcr(struct kvm_vcpu *vcpu, u32 index, u64 xcr)
+ if ((!(xcr0 & XSTATE_BNDREGS)) != (!(xcr0 & XSTATE_BNDCSR)))
+ return 1;
+
+- kvm_put_guest_xcr0(vcpu);
+ vcpu->arch.xcr0 = xcr0;
+
+ if ((xcr0 ^ old_xcr0) & XSTATE_EXTEND_MASK)
+@@ -6056,12 +6055,10 @@ static int inject_pending_event(struct kvm_vcpu *vcpu, bool req_int_win)
+ }
+
+ /* try to inject new event if pending */
+- if (vcpu->arch.nmi_pending) {
+- if (kvm_x86_ops->nmi_allowed(vcpu)) {
+- --vcpu->arch.nmi_pending;
+- vcpu->arch.nmi_injected = true;
+- kvm_x86_ops->set_nmi(vcpu);
+- }
++ if (vcpu->arch.nmi_pending && kvm_x86_ops->nmi_allowed(vcpu)) {
++ --vcpu->arch.nmi_pending;
++ vcpu->arch.nmi_injected = true;
++ kvm_x86_ops->set_nmi(vcpu);
+ } else if (kvm_cpu_has_injectable_intr(vcpu)) {
+ /*
+ * Because interrupts can be injected asynchronously, we are
+@@ -6231,10 +6228,12 @@ static int vcpu_enter_guest(struct kvm_vcpu *vcpu)
+ if (inject_pending_event(vcpu, req_int_win) != 0)
+ req_immediate_exit = true;
+ /* enable NMI/IRQ window open exits if needed */
+- else if (vcpu->arch.nmi_pending)
+- kvm_x86_ops->enable_nmi_window(vcpu);
+- else if (kvm_cpu_has_injectable_intr(vcpu) || req_int_win)
+- kvm_x86_ops->enable_irq_window(vcpu);
++ else {
++ if (vcpu->arch.nmi_pending)
++ kvm_x86_ops->enable_nmi_window(vcpu);
++ if (kvm_cpu_has_injectable_intr(vcpu) || req_int_win)
++ kvm_x86_ops->enable_irq_window(vcpu);
++ }
+
+ if (kvm_lapic_enabled(vcpu)) {
+ /*
+@@ -6259,8 +6258,6 @@ static int vcpu_enter_guest(struct kvm_vcpu *vcpu)
+ kvm_x86_ops->prepare_guest_switch(vcpu);
+ if (vcpu->fpu_active)
+ kvm_load_guest_fpu(vcpu);
+- kvm_load_guest_xcr0(vcpu);
+-
+ vcpu->mode = IN_GUEST_MODE;
+
+ srcu_read_unlock(&vcpu->kvm->srcu, vcpu->srcu_idx);
+@@ -6283,6 +6280,8 @@ static int vcpu_enter_guest(struct kvm_vcpu *vcpu)
+ goto cancel_injection;
+ }
+
++ kvm_load_guest_xcr0(vcpu);
++
+ if (req_immediate_exit)
+ smp_send_reschedule(vcpu->cpu);
+
+@@ -6331,6 +6330,8 @@ static int vcpu_enter_guest(struct kvm_vcpu *vcpu)
+ vcpu->mode = OUTSIDE_GUEST_MODE;
+ smp_wmb();
+
++ kvm_put_guest_xcr0(vcpu);
++
+ /* Interrupt is enabled by handle_external_intr() */
+ kvm_x86_ops->handle_external_intr(vcpu);
+
+@@ -6972,7 +6973,6 @@ void kvm_load_guest_fpu(struct kvm_vcpu *vcpu)
+ * and assume host would use all available bits.
+ * Guest xcr0 would be loaded later.
+ */
+- kvm_put_guest_xcr0(vcpu);
+ vcpu->guest_fpu_loaded = 1;
+ __kernel_fpu_begin();
+ fpu_restore_checking(&vcpu->arch.guest_fpu);
+@@ -6981,8 +6981,6 @@ void kvm_load_guest_fpu(struct kvm_vcpu *vcpu)
+
+ void kvm_put_guest_fpu(struct kvm_vcpu *vcpu)
+ {
+- kvm_put_guest_xcr0(vcpu);
+-
+ if (!vcpu->guest_fpu_loaded)
+ return;
+
+diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c
+index c546a93c0f8a..2f7358726737 100644
+--- a/drivers/block/rbd.c
++++ b/drivers/block/rbd.c
+@@ -1929,7 +1929,7 @@ static struct ceph_osd_request *rbd_osd_req_create(
+
+ osdc = &rbd_dev->rbd_client->client->osdc;
+ osd_req = ceph_osdc_alloc_request(osdc, snapc, num_ops, false,
+- GFP_ATOMIC);
++ GFP_NOIO);
+ if (!osd_req)
+ return NULL; /* ENOMEM */
+
+@@ -1978,7 +1978,7 @@ rbd_osd_req_create_copyup(struct rbd_obj_request *obj_request)
+ rbd_dev = img_request->rbd_dev;
+ osdc = &rbd_dev->rbd_client->client->osdc;
+ osd_req = ceph_osdc_alloc_request(osdc, snapc, num_osd_ops,
+- false, GFP_ATOMIC);
++ false, GFP_NOIO);
+ if (!osd_req)
+ return NULL; /* ENOMEM */
+
+@@ -2470,7 +2470,7 @@ static int rbd_img_request_fill(struct rbd_img_request *img_request,
+ bio_chain_clone_range(&bio_list,
+ &bio_offset,
+ clone_size,
+- GFP_ATOMIC);
++ GFP_NOIO);
+ if (!obj_request->bio_list)
+ goto out_unwind;
+ } else if (type == OBJ_REQUEST_PAGES) {
+diff --git a/drivers/dma/dw/core.c b/drivers/dma/dw/core.c
+index d95e1d0fcc18..f070a8d14168 100644
+--- a/drivers/dma/dw/core.c
++++ b/drivers/dma/dw/core.c
+@@ -122,26 +122,14 @@ static void dwc_desc_put(struct dw_dma_chan *dwc, struct dw_desc *desc)
+ static void dwc_initialize(struct dw_dma_chan *dwc)
+ {
+ struct dw_dma *dw = to_dw_dma(dwc->chan.device);
+- struct dw_dma_slave *dws = dwc->chan.private;
+ u32 cfghi = DWC_CFGH_FIFO_MODE;
+ u32 cfglo = DWC_CFGL_CH_PRIOR(dwc->priority);
+
+ if (dwc->initialized == true)
+ return;
+
+- if (dws) {
+- /*
+- * We need controller-specific data to set up slave
+- * transfers.
+- */
+- BUG_ON(!dws->dma_dev || dws->dma_dev != dw->dma.dev);
+-
+- cfghi |= DWC_CFGH_DST_PER(dws->dst_id);
+- cfghi |= DWC_CFGH_SRC_PER(dws->src_id);
+- } else {
+- cfghi |= DWC_CFGH_DST_PER(dwc->dst_id);
+- cfghi |= DWC_CFGH_SRC_PER(dwc->src_id);
+- }
++ cfghi |= DWC_CFGH_DST_PER(dwc->dst_id);
++ cfghi |= DWC_CFGH_SRC_PER(dwc->src_id);
+
+ channel_writel(dwc, CFG_LO, cfglo);
+ channel_writel(dwc, CFG_HI, cfghi);
+@@ -932,7 +920,7 @@ bool dw_dma_filter(struct dma_chan *chan, void *param)
+ struct dw_dma_chan *dwc = to_dw_dma_chan(chan);
+ struct dw_dma_slave *dws = param;
+
+- if (!dws || dws->dma_dev != chan->device->dev)
++ if (dws->dma_dev != chan->device->dev)
+ return false;
+
+ /* We have to copy data since dws can be temporary storage */
+@@ -1153,6 +1141,14 @@ static int dwc_alloc_chan_resources(struct dma_chan *chan)
+ * doesn't mean what you think it means), and status writeback.
+ */
+
++ /*
++ * We need controller-specific data to set up slave transfers.
++ */
++ if (chan->private && !dw_dma_filter(chan, chan->private)) {
++ dev_warn(chan2dev(chan), "Wrong controller-specific data\n");
++ return -EINVAL;
++ }
++
+ /* Enable controller here if needed */
+ if (!dw->in_use)
+ dw_dma_on(dw);
+@@ -1214,6 +1210,14 @@ static void dwc_free_chan_resources(struct dma_chan *chan)
+ spin_lock_irqsave(&dwc->lock, flags);
+ list_splice_init(&dwc->free_list, &list);
+ dwc->descs_allocated = 0;
++
++ /* Clear custom channel configuration */
++ dwc->src_id = 0;
++ dwc->dst_id = 0;
++
++ dwc->src_master = 0;
++ dwc->dst_master = 0;
++
+ dwc->initialized = false;
+
+ /* Disable interrupts */
+diff --git a/drivers/gpio/gpio-pca953x.c b/drivers/gpio/gpio-pca953x.c
+index e2da64abbccd..16f7c4f2d8c8 100644
+--- a/drivers/gpio/gpio-pca953x.c
++++ b/drivers/gpio/gpio-pca953x.c
+@@ -21,6 +21,7 @@
+ #ifdef CONFIG_OF_GPIO
+ #include <linux/of_platform.h>
+ #endif
++#include <asm/unaligned.h>
+
+ #define PCA953X_INPUT 0
+ #define PCA953X_OUTPUT 1
+@@ -154,7 +155,7 @@ static int pca953x_write_regs(struct pca953x_chip *chip, int reg, u8 *val)
+ switch (chip->chip_type) {
+ case PCA953X_TYPE:
+ ret = i2c_smbus_write_word_data(chip->client,
+- reg << 1, (u16) *val);
++ reg << 1, cpu_to_le16(get_unaligned((u16 *)val)));
+ break;
+ case PCA957X_TYPE:
+ ret = i2c_smbus_write_byte_data(chip->client, reg << 1,
+diff --git a/drivers/gpu/drm/qxl/qxl_display.c b/drivers/gpu/drm/qxl/qxl_display.c
+index 011b22836fd6..8e6e73cb187d 100644
+--- a/drivers/gpu/drm/qxl/qxl_display.c
++++ b/drivers/gpu/drm/qxl/qxl_display.c
+@@ -343,10 +343,15 @@ static int qxl_crtc_cursor_set2(struct drm_crtc *crtc,
+
+ qxl_bo_kunmap(user_bo);
+
++ qcrtc->cur_x += qcrtc->hot_spot_x - hot_x;
++ qcrtc->cur_y += qcrtc->hot_spot_y - hot_y;
++ qcrtc->hot_spot_x = hot_x;
++ qcrtc->hot_spot_y = hot_y;
++
+ cmd = (struct qxl_cursor_cmd *)qxl_release_map(qdev, release);
+ cmd->type = QXL_CURSOR_SET;
+- cmd->u.set.position.x = qcrtc->cur_x;
+- cmd->u.set.position.y = qcrtc->cur_y;
++ cmd->u.set.position.x = qcrtc->cur_x + qcrtc->hot_spot_x;
++ cmd->u.set.position.y = qcrtc->cur_y + qcrtc->hot_spot_y;
+
+ cmd->u.set.shape = qxl_bo_physical_address(qdev, cursor_bo, 0);
+
+@@ -409,8 +414,8 @@ static int qxl_crtc_cursor_move(struct drm_crtc *crtc,
+
+ cmd = (struct qxl_cursor_cmd *)qxl_release_map(qdev, release);
+ cmd->type = QXL_CURSOR_MOVE;
+- cmd->u.position.x = qcrtc->cur_x;
+- cmd->u.position.y = qcrtc->cur_y;
++ cmd->u.position.x = qcrtc->cur_x + qcrtc->hot_spot_x;
++ cmd->u.position.y = qcrtc->cur_y + qcrtc->hot_spot_y;
+ qxl_release_unmap(qdev, release, &cmd->release_info);
+
+ qxl_push_cursor_ring_release(qdev, release, QXL_CMD_CURSOR, false);
+diff --git a/drivers/gpu/drm/qxl/qxl_drv.h b/drivers/gpu/drm/qxl/qxl_drv.h
+index e66143cc1a7a..eef66769245f 100644
+--- a/drivers/gpu/drm/qxl/qxl_drv.h
++++ b/drivers/gpu/drm/qxl/qxl_drv.h
+@@ -135,6 +135,8 @@ struct qxl_crtc {
+ int index;
+ int cur_x;
+ int cur_y;
++ int hot_spot_x;
++ int hot_spot_y;
+ };
+
+ struct qxl_output {
+diff --git a/drivers/hid/usbhid/hid-core.c b/drivers/hid/usbhid/hid-core.c
+index e318980f8d45..d3fd973e8776 100644
+--- a/drivers/hid/usbhid/hid-core.c
++++ b/drivers/hid/usbhid/hid-core.c
+@@ -939,14 +939,6 @@ static int usbhid_output_report(struct hid_device *hid, __u8 *buf, size_t count)
+ return ret;
+ }
+
+-static void usbhid_restart_queues(struct usbhid_device *usbhid)
+-{
+- if (usbhid->urbout && !test_bit(HID_OUT_RUNNING, &usbhid->iofl))
+- usbhid_restart_out_queue(usbhid);
+- if (!test_bit(HID_CTRL_RUNNING, &usbhid->iofl))
+- usbhid_restart_ctrl_queue(usbhid);
+-}
+-
+ static void hid_free_buffers(struct usb_device *dev, struct hid_device *hid)
+ {
+ struct usbhid_device *usbhid = hid->driver_data;
+@@ -1392,6 +1384,37 @@ static void hid_cease_io(struct usbhid_device *usbhid)
+ usb_kill_urb(usbhid->urbout);
+ }
+
++static void hid_restart_io(struct hid_device *hid)
++{
++ struct usbhid_device *usbhid = hid->driver_data;
++ int clear_halt = test_bit(HID_CLEAR_HALT, &usbhid->iofl);
++ int reset_pending = test_bit(HID_RESET_PENDING, &usbhid->iofl);
++
++ spin_lock_irq(&usbhid->lock);
++ clear_bit(HID_SUSPENDED, &usbhid->iofl);
++ usbhid_mark_busy(usbhid);
++
++ if (clear_halt || reset_pending)
++ schedule_work(&usbhid->reset_work);
++ usbhid->retry_delay = 0;
++ spin_unlock_irq(&usbhid->lock);
++
++ if (reset_pending || !test_bit(HID_STARTED, &usbhid->iofl))
++ return;
++
++ if (!clear_halt) {
++ if (hid_start_in(hid) < 0)
++ hid_io_error(hid);
++ }
++
++ spin_lock_irq(&usbhid->lock);
++ if (usbhid->urbout && !test_bit(HID_OUT_RUNNING, &usbhid->iofl))
++ usbhid_restart_out_queue(usbhid);
++ if (!test_bit(HID_CTRL_RUNNING, &usbhid->iofl))
++ usbhid_restart_ctrl_queue(usbhid);
++ spin_unlock_irq(&usbhid->lock);
++}
++
+ /* Treat USB reset pretty much the same as suspend/resume */
+ static int hid_pre_reset(struct usb_interface *intf)
+ {
+@@ -1441,14 +1464,14 @@ static int hid_post_reset(struct usb_interface *intf)
+ return 1;
+ }
+
++ /* No need to do another reset or clear a halted endpoint */
+ spin_lock_irq(&usbhid->lock);
+ clear_bit(HID_RESET_PENDING, &usbhid->iofl);
++ clear_bit(HID_CLEAR_HALT, &usbhid->iofl);
+ spin_unlock_irq(&usbhid->lock);
+ hid_set_idle(dev, intf->cur_altsetting->desc.bInterfaceNumber, 0, 0);
+- status = hid_start_in(hid);
+- if (status < 0)
+- hid_io_error(hid);
+- usbhid_restart_queues(usbhid);
++
++ hid_restart_io(hid);
+
+ return 0;
+ }
+@@ -1471,25 +1494,9 @@ void usbhid_put_power(struct hid_device *hid)
+ #ifdef CONFIG_PM
+ static int hid_resume_common(struct hid_device *hid, bool driver_suspended)
+ {
+- struct usbhid_device *usbhid = hid->driver_data;
+- int status;
+-
+- spin_lock_irq(&usbhid->lock);
+- clear_bit(HID_SUSPENDED, &usbhid->iofl);
+- usbhid_mark_busy(usbhid);
+-
+- if (test_bit(HID_CLEAR_HALT, &usbhid->iofl) ||
+- test_bit(HID_RESET_PENDING, &usbhid->iofl))
+- schedule_work(&usbhid->reset_work);
+- usbhid->retry_delay = 0;
+-
+- usbhid_restart_queues(usbhid);
+- spin_unlock_irq(&usbhid->lock);
+-
+- status = hid_start_in(hid);
+- if (status < 0)
+- hid_io_error(hid);
++ int status = 0;
+
++ hid_restart_io(hid);
+ if (driver_suspended && hid->driver && hid->driver->resume)
+ status = hid->driver->resume(hid);
+ return status;
+@@ -1558,12 +1565,8 @@ static int hid_suspend(struct usb_interface *intf, pm_message_t message)
+ static int hid_resume(struct usb_interface *intf)
+ {
+ struct hid_device *hid = usb_get_intfdata (intf);
+- struct usbhid_device *usbhid = hid->driver_data;
+ int status;
+
+- if (!test_bit(HID_STARTED, &usbhid->iofl))
+- return 0;
+-
+ status = hid_resume_common(hid, true);
+ dev_dbg(&intf->dev, "resume status %d\n", status);
+ return 0;
+@@ -1572,10 +1575,8 @@ static int hid_resume(struct usb_interface *intf)
+ static int hid_reset_resume(struct usb_interface *intf)
+ {
+ struct hid_device *hid = usb_get_intfdata(intf);
+- struct usbhid_device *usbhid = hid->driver_data;
+ int status;
+
+- clear_bit(HID_SUSPENDED, &usbhid->iofl);
+ status = hid_post_reset(intf);
+ if (status >= 0 && hid->driver && hid->driver->reset_resume) {
+ int ret = hid->driver->reset_resume(hid);
+diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
+index 10720938e5c5..fedf432eef30 100644
+--- a/drivers/scsi/sd.c
++++ b/drivers/scsi/sd.c
+@@ -1279,18 +1279,19 @@ static int sd_getgeo(struct block_device *bdev, struct hd_geometry *geo)
+ struct scsi_disk *sdkp = scsi_disk(bdev->bd_disk);
+ struct scsi_device *sdp = sdkp->device;
+ struct Scsi_Host *host = sdp->host;
++ sector_t capacity = logical_to_sectors(sdp, sdkp->capacity);
+ int diskinfo[4];
+
+ /* default to most commonly used values */
+- diskinfo[0] = 0x40; /* 1 << 6 */
+- diskinfo[1] = 0x20; /* 1 << 5 */
+- diskinfo[2] = sdkp->capacity >> 11;
+-
++ diskinfo[0] = 0x40; /* 1 << 6 */
++ diskinfo[1] = 0x20; /* 1 << 5 */
++ diskinfo[2] = capacity >> 11;
++
+ /* override with calculated, extended default, or driver values */
+ if (host->hostt->bios_param)
+- host->hostt->bios_param(sdp, bdev, sdkp->capacity, diskinfo);
++ host->hostt->bios_param(sdp, bdev, capacity, diskinfo);
+ else
+- scsicam_bios_param(bdev, sdkp->capacity, diskinfo);
++ scsicam_bios_param(bdev, capacity, diskinfo);
+
+ geo->heads = diskinfo[0];
+ geo->sectors = diskinfo[1];
+@@ -2273,14 +2274,6 @@ got_data:
+ } else
+ sdkp->max_xfer_blocks = SD_DEF_XFER_BLOCKS;
+
+- /* Rescale capacity to 512-byte units */
+- if (sector_size == 4096)
+- sdkp->capacity <<= 3;
+- else if (sector_size == 2048)
+- sdkp->capacity <<= 2;
+- else if (sector_size == 1024)
+- sdkp->capacity <<= 1;
+-
+ blk_queue_physical_block_size(sdp->request_queue,
+ sdkp->physical_block_size);
+ sdkp->device->sector_size = sector_size;
+@@ -2815,7 +2808,7 @@ static int sd_revalidate_disk(struct gendisk *disk)
+ sdkp->disk->queue->limits.max_sectors =
+ min_not_zero(queue_max_hw_sectors(sdkp->disk->queue), max_xfer);
+
+- set_capacity(disk, sdkp->capacity);
++ set_capacity(disk, logical_to_sectors(sdp, sdkp->capacity));
+ sd_config_write_same(sdkp);
+ kfree(buffer);
+
+diff --git a/drivers/scsi/sd.h b/drivers/scsi/sd.h
+index 467377884b63..53f503354866 100644
+--- a/drivers/scsi/sd.h
++++ b/drivers/scsi/sd.h
+@@ -65,7 +65,7 @@ struct scsi_disk {
+ struct device dev;
+ struct gendisk *disk;
+ atomic_t openers;
+- sector_t capacity; /* size in 512-byte sectors */
++ sector_t capacity; /* size in logical blocks */
+ u32 max_xfer_blocks;
+ u32 max_ws_blocks;
+ u32 max_unmap_blocks;
+@@ -145,6 +145,11 @@ static inline int scsi_medium_access_command(struct scsi_cmnd *scmd)
+ return 0;
+ }
+
++static inline sector_t logical_to_sectors(struct scsi_device *sdev, sector_t blocks)
++{
++ return blocks << (ilog2(sdev->sector_size) - 9);
++}
++
+ /*
+ * A DIF-capable target device can be formatted with different
+ * protection schemes. Currently 0 through 3 are defined:
+diff --git a/drivers/thermal/thermal_core.c b/drivers/thermal/thermal_core.c
+index f23813fe1a0d..885adc345f57 100644
+--- a/drivers/thermal/thermal_core.c
++++ b/drivers/thermal/thermal_core.c
+@@ -1488,7 +1488,7 @@ struct thermal_zone_device *thermal_zone_device_register(const char *type,
+ {
+ struct thermal_zone_device *tz;
+ enum thermal_trip_type trip_type;
+- int trip_temp;
++ unsigned long trip_temp;
+ int result;
+ int count;
+ int passive = 0;
+diff --git a/drivers/usb/core/hcd-pci.c b/drivers/usb/core/hcd-pci.c
+index efc953119ce2..a4c0b855faeb 100644
+--- a/drivers/usb/core/hcd-pci.c
++++ b/drivers/usb/core/hcd-pci.c
+@@ -74,6 +74,15 @@ static void for_each_companion(struct pci_dev *pdev, struct usb_hcd *hcd,
+ if (companion->bus != pdev->bus ||
+ PCI_SLOT(companion->devfn) != slot)
+ continue;
++
++ /*
++ * Companion device should be either UHCI,OHCI or EHCI host
++ * controller, otherwise skip.
++ */
++ if (companion->class != CL_UHCI && companion->class != CL_OHCI &&
++ companion->class != CL_EHCI)
++ continue;
++
+ companion_hcd = pci_get_drvdata(companion);
+ if (!companion_hcd || !companion_hcd->self.root_hub)
+ continue;
+diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
+index ce3087bd95d2..150cab3290f8 100644
+--- a/drivers/usb/host/xhci-mem.c
++++ b/drivers/usb/host/xhci-mem.c
+@@ -1883,6 +1883,12 @@ no_bw:
+ kfree(xhci->rh_bw);
+ kfree(xhci->ext_caps);
+
++ xhci->usb2_ports = NULL;
++ xhci->usb3_ports = NULL;
++ xhci->port_array = NULL;
++ xhci->rh_bw = NULL;
++ xhci->ext_caps = NULL;
++
+ xhci->page_size = 0;
+ xhci->page_shift = 0;
+ xhci->bus_state[0].bus_suspended = 0;
+diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
+index 3ff5fcc7c94b..c6027acb6263 100644
+--- a/drivers/usb/host/xhci-pci.c
++++ b/drivers/usb/host/xhci-pci.c
+@@ -48,6 +48,7 @@
+ #define PCI_DEVICE_ID_INTEL_SUNRISEPOINT_H_XHCI 0xa12f
+ #define PCI_DEVICE_ID_INTEL_SUNRISEPOINT_LP_XHCI 0x9d2f
+ #define PCI_DEVICE_ID_INTEL_BROXTON_M_XHCI 0x0aa8
++#define PCI_DEVICE_ID_INTEL_BROXTON_B_XHCI 0x1aa8
+
+ static const char hcd_name[] = "xhci_hcd";
+
+@@ -149,7 +150,8 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
+ (pdev->device == PCI_DEVICE_ID_INTEL_SUNRISEPOINT_LP_XHCI ||
+ pdev->device == PCI_DEVICE_ID_INTEL_SUNRISEPOINT_H_XHCI ||
+ pdev->device == PCI_DEVICE_ID_INTEL_CHERRYVIEW_XHCI ||
+- pdev->device == PCI_DEVICE_ID_INTEL_BROXTON_M_XHCI)) {
++ pdev->device == PCI_DEVICE_ID_INTEL_BROXTON_M_XHCI ||
++ pdev->device == PCI_DEVICE_ID_INTEL_BROXTON_B_XHCI)) {
+ xhci->quirks |= XHCI_PME_STUCK_QUIRK;
+ }
+ if (pdev->vendor == PCI_VENDOR_ID_INTEL &&
+@@ -296,6 +298,7 @@ static void xhci_pci_remove(struct pci_dev *dev)
+ struct xhci_hcd *xhci;
+
+ xhci = hcd_to_xhci(pci_get_drvdata(dev));
++ xhci->xhc_state |= XHCI_STATE_REMOVING;
+ if (xhci->shared_hcd) {
+ usb_remove_hcd(xhci->shared_hcd);
+ usb_put_hcd(xhci->shared_hcd);
+diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
+index 1e5fb8cfc9e3..04e75258fb46 100644
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -3840,8 +3840,12 @@ static int queue_command(struct xhci_hcd *xhci, struct xhci_command *cmd,
+ {
+ int reserved_trbs = xhci->cmd_ring_reserved_trbs;
+ int ret;
+- if (xhci->xhc_state & XHCI_STATE_DYING)
++
++ if ((xhci->xhc_state & XHCI_STATE_DYING) ||
++ (xhci->xhc_state & XHCI_STATE_HALTED)) {
++ xhci_dbg(xhci, "xHCI dying or halted, can't queue_command\n");
+ return -ESHUTDOWN;
++ }
+
+ if (!command_must_succeed)
+ reserved_trbs++;
+diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
+index 288d18493132..f951b7550789 100644
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -147,7 +147,8 @@ static int xhci_start(struct xhci_hcd *xhci)
+ "waited %u microseconds.\n",
+ XHCI_MAX_HALT_USEC);
+ if (!ret)
+- xhci->xhc_state &= ~(XHCI_STATE_HALTED | XHCI_STATE_DYING);
++ /* clear state flags. Including dying, halted or removing */
++ xhci->xhc_state = 0;
+
+ return ret;
+ }
+@@ -1102,8 +1103,8 @@ int xhci_resume(struct xhci_hcd *xhci, bool hibernated)
+ /* Resume root hubs only when have pending events. */
+ status = readl(&xhci->op_regs->status);
+ if (status & STS_EINT) {
+- usb_hcd_resume_root_hub(hcd);
+ usb_hcd_resume_root_hub(xhci->shared_hcd);
++ usb_hcd_resume_root_hub(hcd);
+ }
+ }
+
+@@ -1118,10 +1119,10 @@ int xhci_resume(struct xhci_hcd *xhci, bool hibernated)
+
+ /* Re-enable port polling. */
+ xhci_dbg(xhci, "%s: starting port polling.\n", __func__);
+- set_bit(HCD_FLAG_POLL_RH, &hcd->flags);
+- usb_hcd_poll_rh_status(hcd);
+ set_bit(HCD_FLAG_POLL_RH, &xhci->shared_hcd->flags);
+ usb_hcd_poll_rh_status(xhci->shared_hcd);
++ set_bit(HCD_FLAG_POLL_RH, &hcd->flags);
++ usb_hcd_poll_rh_status(hcd);
+
+ return retval;
+ }
+@@ -2753,7 +2754,8 @@ int xhci_check_bandwidth(struct usb_hcd *hcd, struct usb_device *udev)
+ if (ret <= 0)
+ return ret;
+ xhci = hcd_to_xhci(hcd);
+- if (xhci->xhc_state & XHCI_STATE_DYING)
++ if ((xhci->xhc_state & XHCI_STATE_DYING) ||
++ (xhci->xhc_state & XHCI_STATE_REMOVING))
+ return -ENODEV;
+
+ xhci_dbg(xhci, "%s called for udev %p\n", __func__, udev);
+@@ -3795,7 +3797,7 @@ static int xhci_setup_device(struct usb_hcd *hcd, struct usb_device *udev,
+ u64 temp_64;
+ struct xhci_command *command;
+
+- if (xhci->xhc_state) /* dying or halted */
++ if (xhci->xhc_state) /* dying, removing or halted */
+ return -EINVAL;
+
+ if (!udev->slot_id) {
+@@ -4914,6 +4916,16 @@ int xhci_gen_setup(struct usb_hcd *hcd, xhci_get_quirks_t get_quirks)
+ goto error;
+ xhci_dbg(xhci, "Reset complete\n");
+
++ /*
++ * On some xHCI controllers (e.g. R-Car SoCs), the AC64 bit (bit 0)
++ * of HCCPARAMS1 is set to 1. However, the xHCs don't support 64-bit
++ * address memory pointers actually. So, this driver clears the AC64
++ * bit of xhci->hcc_params to call dma_set_coherent_mask(dev,
++ * DMA_BIT_MASK(32)) in this xhci_gen_setup().
++ */
++ if (xhci->quirks & XHCI_NO_64BIT_SUPPORT)
++ xhci->hcc_params &= ~BIT(0);
++
+ /* Set dma_mask and coherent_dma_mask to 64-bits,
+ * if xHC supports 64-bit addressing */
+ if (HCC_64BIT_ADDR(xhci->hcc_params) &&
+diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
+index 810f7f6d356c..3850cb2af7a9 100644
+--- a/drivers/usb/host/xhci.h
++++ b/drivers/usb/host/xhci.h
+@@ -1531,6 +1531,7 @@ struct xhci_hcd {
+ */
+ #define XHCI_STATE_DYING (1 << 0)
+ #define XHCI_STATE_HALTED (1 << 1)
++#define XHCI_STATE_REMOVING (1 << 2)
+ /* Statistics */
+ int error_bitmask;
+ unsigned int quirks;
+@@ -1566,6 +1567,7 @@ struct xhci_hcd {
+ #define XHCI_BROKEN_STREAMS (1 << 19)
+ #define XHCI_PME_STUCK_QUIRK (1 << 20)
+ #define XHCI_SSIC_PORT_UNUSED (1 << 22)
++#define XHCI_NO_64BIT_SUPPORT (1 << 23)
+ unsigned int num_active_eps;
+ unsigned int limit_active_eps;
+ /* There are two roothubs to keep track of bus suspend info for */
+diff --git a/drivers/usb/musb/musb_cppi41.c b/drivers/usb/musb/musb_cppi41.c
+index 8dfd86771fac..2a535b70af21 100644
+--- a/drivers/usb/musb/musb_cppi41.c
++++ b/drivers/usb/musb/musb_cppi41.c
+@@ -9,9 +9,9 @@
+
+ #define RNDIS_REG(x) (0x80 + ((x - 1) * 4))
+
+-#define EP_MODE_AUTOREG_NONE 0
+-#define EP_MODE_AUTOREG_ALL_NEOP 1
+-#define EP_MODE_AUTOREG_ALWAYS 3
++#define EP_MODE_AUTOREQ_NONE 0
++#define EP_MODE_AUTOREQ_ALL_NEOP 1
++#define EP_MODE_AUTOREQ_ALWAYS 3
+
+ #define EP_MODE_DMA_TRANSPARENT 0
+ #define EP_MODE_DMA_RNDIS 1
+@@ -396,19 +396,19 @@ static bool cppi41_configure_channel(struct dma_channel *channel,
+
+ /* auto req */
+ cppi41_set_autoreq_mode(cppi41_channel,
+- EP_MODE_AUTOREG_ALL_NEOP);
++ EP_MODE_AUTOREQ_ALL_NEOP);
+ } else {
+ musb_writel(musb->ctrl_base,
+ RNDIS_REG(cppi41_channel->port_num), 0);
+ cppi41_set_dma_mode(cppi41_channel,
+ EP_MODE_DMA_TRANSPARENT);
+ cppi41_set_autoreq_mode(cppi41_channel,
+- EP_MODE_AUTOREG_NONE);
++ EP_MODE_AUTOREQ_NONE);
+ }
+ } else {
+ /* fallback mode */
+ cppi41_set_dma_mode(cppi41_channel, EP_MODE_DMA_TRANSPARENT);
+- cppi41_set_autoreq_mode(cppi41_channel, EP_MODE_AUTOREG_NONE);
++ cppi41_set_autoreq_mode(cppi41_channel, EP_MODE_AUTOREQ_NONE);
+ len = min_t(u32, packet_sz, len);
+ }
+ cppi41_channel->prog_len = len;
+diff --git a/drivers/usb/renesas_usbhs/fifo.c b/drivers/usb/renesas_usbhs/fifo.c
+index 634c14d022ce..e5f429ee7a89 100644
+--- a/drivers/usb/renesas_usbhs/fifo.c
++++ b/drivers/usb/renesas_usbhs/fifo.c
+@@ -192,7 +192,8 @@ static int usbhsf_pkt_handler(struct usbhs_pipe *pipe, int type)
+ goto __usbhs_pkt_handler_end;
+ }
+
+- ret = func(pkt, &is_done);
++ if (likely(func))
++ ret = func(pkt, &is_done);
+
+ if (is_done)
+ __usbhsf_pkt_del(pkt);
+@@ -906,6 +907,7 @@ static int usbhsf_dma_prepare_push(struct usbhs_pkt *pkt, int *is_done)
+
+ pkt->trans = len;
+
++ usbhsf_tx_irq_ctrl(pipe, 0);
+ INIT_WORK(&pkt->work, xfer_work);
+ schedule_work(&pkt->work);
+
+diff --git a/drivers/usb/renesas_usbhs/mod_gadget.c b/drivers/usb/renesas_usbhs/mod_gadget.c
+index 294d43c387b2..e56bbb8ab9a0 100644
+--- a/drivers/usb/renesas_usbhs/mod_gadget.c
++++ b/drivers/usb/renesas_usbhs/mod_gadget.c
+@@ -118,18 +118,34 @@ struct usbhsg_recip_handle {
+ /*
+ * queue push/pop
+ */
+-static void usbhsg_queue_pop(struct usbhsg_uep *uep,
+- struct usbhsg_request *ureq,
+- int status)
++static void __usbhsg_queue_pop(struct usbhsg_uep *uep,
++ struct usbhsg_request *ureq,
++ int status)
+ {
+ struct usbhsg_gpriv *gpriv = usbhsg_uep_to_gpriv(uep);
+ struct usbhs_pipe *pipe = usbhsg_uep_to_pipe(uep);
+ struct device *dev = usbhsg_gpriv_to_dev(gpriv);
++ struct usbhs_priv *priv = usbhsg_gpriv_to_priv(gpriv);
+
+ dev_dbg(dev, "pipe %d : queue pop\n", usbhs_pipe_number(pipe));
+
+ ureq->req.status = status;
++ spin_unlock(usbhs_priv_to_lock(priv));
+ usb_gadget_giveback_request(&uep->ep, &ureq->req);
++ spin_lock(usbhs_priv_to_lock(priv));
++}
++
++static void usbhsg_queue_pop(struct usbhsg_uep *uep,
++ struct usbhsg_request *ureq,
++ int status)
++{
++ struct usbhsg_gpriv *gpriv = usbhsg_uep_to_gpriv(uep);
++ struct usbhs_priv *priv = usbhsg_gpriv_to_priv(gpriv);
++ unsigned long flags;
++
++ usbhs_lock(priv, flags);
++ __usbhsg_queue_pop(uep, ureq, status);
++ usbhs_unlock(priv, flags);
+ }
+
+ static void usbhsg_queue_done(struct usbhs_priv *priv, struct usbhs_pkt *pkt)
+@@ -137,10 +153,14 @@ static void usbhsg_queue_done(struct usbhs_priv *priv, struct usbhs_pkt *pkt)
+ struct usbhs_pipe *pipe = pkt->pipe;
+ struct usbhsg_uep *uep = usbhsg_pipe_to_uep(pipe);
+ struct usbhsg_request *ureq = usbhsg_pkt_to_ureq(pkt);
++ unsigned long flags;
+
+ ureq->req.actual = pkt->actual;
+
+- usbhsg_queue_pop(uep, ureq, 0);
++ usbhs_lock(priv, flags);
++ if (uep)
++ __usbhsg_queue_pop(uep, ureq, 0);
++ usbhs_unlock(priv, flags);
+ }
+
+ static void usbhsg_queue_push(struct usbhsg_uep *uep,
+diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
+index 50426cf095a5..d4541ac5bf48 100644
+--- a/drivers/usb/serial/cp210x.c
++++ b/drivers/usb/serial/cp210x.c
+@@ -164,6 +164,7 @@ static const struct usb_device_id id_table[] = {
+ { USB_DEVICE(0x18EF, 0xE025) }, /* ELV Marble Sound Board 1 */
+ { USB_DEVICE(0x1901, 0x0190) }, /* GE B850 CP2105 Recorder interface */
+ { USB_DEVICE(0x1901, 0x0193) }, /* GE B650 CP2104 PMC interface */
++ { USB_DEVICE(0x1901, 0x0194) }, /* GE Healthcare Remote Alarm Box */
+ { USB_DEVICE(0x19CF, 0x3000) }, /* Parrot NMEA GPS Flight Recorder */
+ { USB_DEVICE(0x1ADB, 0x0001) }, /* Schweitzer Engineering C662 Cable */
+ { USB_DEVICE(0x1B1C, 0x1C00) }, /* Corsair USB Dongle */
+diff --git a/drivers/usb/serial/cypress_m8.c b/drivers/usb/serial/cypress_m8.c
+index 01bf53392819..244acb1299a9 100644
+--- a/drivers/usb/serial/cypress_m8.c
++++ b/drivers/usb/serial/cypress_m8.c
+@@ -447,6 +447,11 @@ static int cypress_generic_port_probe(struct usb_serial_port *port)
+ struct usb_serial *serial = port->serial;
+ struct cypress_private *priv;
+
++ if (!port->interrupt_out_urb || !port->interrupt_in_urb) {
++ dev_err(&port->dev, "required endpoint is missing\n");
++ return -ENODEV;
++ }
++
+ priv = kzalloc(sizeof(struct cypress_private), GFP_KERNEL);
+ if (!priv)
+ return -ENOMEM;
+@@ -606,12 +611,6 @@ static int cypress_open(struct tty_struct *tty, struct usb_serial_port *port)
+ cypress_set_termios(tty, port, &priv->tmp_termios);
+
+ /* setup the port and start reading from the device */
+- if (!port->interrupt_in_urb) {
+- dev_err(&port->dev, "%s - interrupt_in_urb is empty!\n",
+- __func__);
+- return -1;
+- }
+-
+ usb_fill_int_urb(port->interrupt_in_urb, serial->dev,
+ usb_rcvintpipe(serial->dev, port->interrupt_in_endpointAddress),
+ port->interrupt_in_urb->transfer_buffer,
+diff --git a/drivers/usb/serial/digi_acceleport.c b/drivers/usb/serial/digi_acceleport.c
+index 12b0e67473ba..3df7b7ec178e 100644
+--- a/drivers/usb/serial/digi_acceleport.c
++++ b/drivers/usb/serial/digi_acceleport.c
+@@ -1251,8 +1251,27 @@ static int digi_port_init(struct usb_serial_port *port, unsigned port_num)
+
+ static int digi_startup(struct usb_serial *serial)
+ {
++ struct device *dev = &serial->interface->dev;
+ struct digi_serial *serial_priv;
+ int ret;
++ int i;
++
++ /* check whether the device has the expected number of endpoints */
++ if (serial->num_port_pointers < serial->type->num_ports + 1) {
++ dev_err(dev, "OOB endpoints missing\n");
++ return -ENODEV;
++ }
++
++ for (i = 0; i < serial->type->num_ports + 1 ; i++) {
++ if (!serial->port[i]->read_urb) {
++ dev_err(dev, "bulk-in endpoint missing\n");
++ return -ENODEV;
++ }
++ if (!serial->port[i]->write_urb) {
++ dev_err(dev, "bulk-out endpoint missing\n");
++ return -ENODEV;
++ }
++ }
+
+ serial_priv = kzalloc(sizeof(*serial_priv), GFP_KERNEL);
+ if (!serial_priv)
+diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
+index 8c660ae401d8..b61f12160d37 100644
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -1004,6 +1004,10 @@ static const struct usb_device_id id_table_combined[] = {
+ { USB_DEVICE(FTDI_VID, CHETCO_SEASMART_DISPLAY_PID) },
+ { USB_DEVICE(FTDI_VID, CHETCO_SEASMART_LITE_PID) },
+ { USB_DEVICE(FTDI_VID, CHETCO_SEASMART_ANALOG_PID) },
++ /* ICP DAS I-756xU devices */
++ { USB_DEVICE(ICPDAS_VID, ICPDAS_I7560U_PID) },
++ { USB_DEVICE(ICPDAS_VID, ICPDAS_I7561U_PID) },
++ { USB_DEVICE(ICPDAS_VID, ICPDAS_I7563U_PID) },
+ { } /* Terminating entry */
+ };
+
+diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
+index 7850071c0ae1..334bc600282d 100644
+--- a/drivers/usb/serial/ftdi_sio_ids.h
++++ b/drivers/usb/serial/ftdi_sio_ids.h
+@@ -872,6 +872,14 @@
+ #define NOVITUS_BONO_E_PID 0x6010
+
+ /*
++ * ICPDAS I-756*U devices
++ */
++#define ICPDAS_VID 0x1b5c
++#define ICPDAS_I7560U_PID 0x0103
++#define ICPDAS_I7561U_PID 0x0104
++#define ICPDAS_I7563U_PID 0x0105
++
++/*
+ * RT Systems programming cables for various ham radios
+ */
+ #define RTSYSTEMS_VID 0x2100 /* Vendor ID */
+diff --git a/drivers/usb/serial/mct_u232.c b/drivers/usb/serial/mct_u232.c
+index fd707d6a10e2..89726f702202 100644
+--- a/drivers/usb/serial/mct_u232.c
++++ b/drivers/usb/serial/mct_u232.c
+@@ -376,14 +376,21 @@ static void mct_u232_msr_to_state(struct usb_serial_port *port,
+
+ static int mct_u232_port_probe(struct usb_serial_port *port)
+ {
++ struct usb_serial *serial = port->serial;
+ struct mct_u232_private *priv;
+
++ /* check first to simplify error handling */
++ if (!serial->port[1] || !serial->port[1]->interrupt_in_urb) {
++ dev_err(&port->dev, "expected endpoint missing\n");
++ return -ENODEV;
++ }
++
+ priv = kzalloc(sizeof(*priv), GFP_KERNEL);
+ if (!priv)
+ return -ENOMEM;
+
+ /* Use second interrupt-in endpoint for reading. */
+- priv->read_urb = port->serial->port[1]->interrupt_in_urb;
++ priv->read_urb = serial->port[1]->interrupt_in_urb;
+ priv->read_urb->context = port;
+
+ spin_lock_init(&priv->lock);
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index 5e194f187802..2a593d9232d7 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -1827,6 +1827,8 @@ static const struct usb_device_id option_ids[] = {
+ { USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x7d02, 0xff, 0x00, 0x00) },
+ { USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x7d03, 0xff, 0x02, 0x01) },
+ { USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x7d03, 0xff, 0x00, 0x00) },
++ { USB_DEVICE_INTERFACE_CLASS(0x2001, 0x7e19, 0xff), /* D-Link DWM-221 B1 */
++ .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
+ { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) }, /* D-Link DWM-152/C1 */
+ { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e02, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/C1 */
+ { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x4000, 0xff) }, /* OLICARD300 - MT6225 */
+diff --git a/drivers/usb/storage/uas.c b/drivers/usb/storage/uas.c
+index c6b4af82b7ed..e390d1d11baf 100644
+--- a/drivers/usb/storage/uas.c
++++ b/drivers/usb/storage/uas.c
+@@ -2,7 +2,7 @@
+ * USB Attached SCSI
+ * Note that this is not the same as the USB Mass Storage driver
+ *
+- * Copyright Hans de Goede <hdegoede@redhat.com> for Red Hat, Inc. 2013 - 2014
++ * Copyright Hans de Goede <hdegoede@redhat.com> for Red Hat, Inc. 2013 - 2016
+ * Copyright Matthew Wilcox for Intel Corp, 2010
+ * Copyright Sarah Sharp for Intel Corp, 2010
+ *
+@@ -768,6 +768,17 @@ static int uas_eh_bus_reset_handler(struct scsi_cmnd *cmnd)
+ return SUCCESS;
+ }
+
++static int uas_target_alloc(struct scsi_target *starget)
++{
++ struct uas_dev_info *devinfo = (struct uas_dev_info *)
++ dev_to_shost(starget->dev.parent)->hostdata;
++
++ if (devinfo->flags & US_FL_NO_REPORT_LUNS)
++ starget->no_report_luns = 1;
++
++ return 0;
++}
++
+ static int uas_slave_alloc(struct scsi_device *sdev)
+ {
+ struct uas_dev_info *devinfo =
+@@ -816,6 +827,7 @@ static struct scsi_host_template uas_host_template = {
+ .module = THIS_MODULE,
+ .name = "uas",
+ .queuecommand = uas_queuecommand,
++ .target_alloc = uas_target_alloc,
+ .slave_alloc = uas_slave_alloc,
+ .slave_configure = uas_slave_configure,
+ .eh_abort_handler = uas_eh_abort_handler,
+diff --git a/drivers/usb/storage/unusual_uas.h b/drivers/usb/storage/unusual_uas.h
+index cd4ba61330c8..eb87c44663b1 100644
+--- a/drivers/usb/storage/unusual_uas.h
++++ b/drivers/usb/storage/unusual_uas.h
+@@ -54,6 +54,13 @@ UNUSUAL_DEV(0x0bc2, 0x3312, 0x0000, 0x9999,
+ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+ US_FL_NO_ATA_1X),
+
++/* Reported-by: David Webb <djw@noc.ac.uk> */
++UNUSUAL_DEV(0x0bc2, 0x331a, 0x0000, 0x9999,
++ "Seagate",
++ "Expansion Desk",
++ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
++ US_FL_NO_REPORT_LUNS),
++
+ /* Reported-by: Hans de Goede <hdegoede@redhat.com> */
+ UNUSUAL_DEV(0x0bc2, 0x3320, 0x0000, 0x9999,
+ "Seagate",
+diff --git a/drivers/usb/storage/usb.c b/drivers/usb/storage/usb.c
+index cda42cf779a5..b770fff1d321 100644
+--- a/drivers/usb/storage/usb.c
++++ b/drivers/usb/storage/usb.c
+@@ -480,7 +480,7 @@ void usb_stor_adjust_quirks(struct usb_device *udev, unsigned long *fflags)
+ US_FL_NO_READ_DISC_INFO | US_FL_NO_READ_CAPACITY_16 |
+ US_FL_INITIAL_READ10 | US_FL_WRITE_CACHE |
+ US_FL_NO_ATA_1X | US_FL_NO_REPORT_OPCODES |
+- US_FL_MAX_SECTORS_240);
++ US_FL_MAX_SECTORS_240 | US_FL_NO_REPORT_LUNS);
+
+ p = quirks;
+ while (*p) {
+@@ -530,6 +530,9 @@ void usb_stor_adjust_quirks(struct usb_device *udev, unsigned long *fflags)
+ case 'i':
+ f |= US_FL_IGNORE_DEVICE;
+ break;
++ case 'j':
++ f |= US_FL_NO_REPORT_LUNS;
++ break;
+ case 'l':
+ f |= US_FL_NOT_LOCKABLE;
+ break;
+diff --git a/drivers/xen/events/events_base.c b/drivers/xen/events/events_base.c
+index 38387950490e..511aab3b9206 100644
+--- a/drivers/xen/events/events_base.c
++++ b/drivers/xen/events/events_base.c
+@@ -483,9 +483,19 @@ static void eoi_pirq(struct irq_data *data)
+ struct physdev_eoi eoi = { .irq = pirq_from_irq(data->irq) };
+ int rc = 0;
+
+- irq_move_irq(data);
++ if (!VALID_EVTCHN(evtchn))
++ return;
+
+- if (VALID_EVTCHN(evtchn))
++ if (unlikely(irqd_is_setaffinity_pending(data))) {
++ int masked = test_and_set_mask(evtchn);
++
++ clear_evtchn(evtchn);
++
++ irq_move_masked_irq(data);
++
++ if (!masked)
++ unmask_evtchn(evtchn);
++ } else
+ clear_evtchn(evtchn);
+
+ if (pirq_needs_eoi(data->irq)) {
+@@ -1360,9 +1370,19 @@ static void ack_dynirq(struct irq_data *data)
+ {
+ int evtchn = evtchn_from_irq(data->irq);
+
+- irq_move_irq(data);
++ if (!VALID_EVTCHN(evtchn))
++ return;
+
+- if (VALID_EVTCHN(evtchn))
++ if (unlikely(irqd_is_setaffinity_pending(data))) {
++ int masked = test_and_set_mask(evtchn);
++
++ clear_evtchn(evtchn);
++
++ irq_move_masked_irq(data);
++
++ if (!masked)
++ unmask_evtchn(evtchn);
++ } else
+ clear_evtchn(evtchn);
+ }
+
+diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c
+index 7dce00b91a71..240019f36b2a 100644
+--- a/fs/btrfs/transaction.c
++++ b/fs/btrfs/transaction.c
+@@ -723,7 +723,7 @@ static int __btrfs_end_transaction(struct btrfs_trans_handle *trans,
+
+ if (!list_empty(&trans->ordered)) {
+ spin_lock(&info->trans_lock);
+- list_splice(&trans->ordered, &cur_trans->pending_ordered);
++ list_splice_init(&trans->ordered, &cur_trans->pending_ordered);
+ spin_unlock(&info->trans_lock);
+ }
+
+@@ -1732,7 +1732,7 @@ int btrfs_commit_transaction(struct btrfs_trans_handle *trans,
+ }
+
+ spin_lock(&root->fs_info->trans_lock);
+- list_splice(&trans->ordered, &cur_trans->pending_ordered);
++ list_splice_init(&trans->ordered, &cur_trans->pending_ordered);
+ if (cur_trans->state >= TRANS_STATE_COMMIT_START) {
+ spin_unlock(&root->fs_info->trans_lock);
+ atomic_inc(&cur_trans->use_count);
+diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
+index 3b68c75eccea..f6c20cf6090e 100644
+--- a/fs/btrfs/tree-log.c
++++ b/fs/btrfs/tree-log.c
+@@ -3929,6 +3929,308 @@ static int logged_inode_size(struct btrfs_root *log, struct inode *inode,
+ return 0;
+ }
+
++/*
++ * At the moment we always log all xattrs. This is to figure out at log replay
++ * time which xattrs must have their deletion replayed. If a xattr is missing
++ * in the log tree and exists in the fs/subvol tree, we delete it. This is
++ * because if a xattr is deleted, the inode is fsynced and a power failure
++ * happens, causing the log to be replayed the next time the fs is mounted,
++ * we want the xattr to not exist anymore (same behaviour as other filesystems
++ * with a journal, ext3/4, xfs, f2fs, etc).
++ */
++static int btrfs_log_all_xattrs(struct btrfs_trans_handle *trans,
++ struct btrfs_root *root,
++ struct inode *inode,
++ struct btrfs_path *path,
++ struct btrfs_path *dst_path)
++{
++ int ret;
++ struct btrfs_key key;
++ const u64 ino = btrfs_ino(inode);
++ int ins_nr = 0;
++ int start_slot = 0;
++
++ key.objectid = ino;
++ key.type = BTRFS_XATTR_ITEM_KEY;
++ key.offset = 0;
++
++ ret = btrfs_search_slot(NULL, root, &key, path, 0, 0);
++ if (ret < 0)
++ return ret;
++
++ while (true) {
++ int slot = path->slots[0];
++ struct extent_buffer *leaf = path->nodes[0];
++ int nritems = btrfs_header_nritems(leaf);
++
++ if (slot >= nritems) {
++ if (ins_nr > 0) {
++ u64 last_extent = 0;
++
++ ret = copy_items(trans, inode, dst_path, path,
++ &last_extent, start_slot,
++ ins_nr, 1, 0);
++ /* can't be 1, extent items aren't processed */
++ ASSERT(ret <= 0);
++ if (ret < 0)
++ return ret;
++ ins_nr = 0;
++ }
++ ret = btrfs_next_leaf(root, path);
++ if (ret < 0)
++ return ret;
++ else if (ret > 0)
++ break;
++ continue;
++ }
++
++ btrfs_item_key_to_cpu(leaf, &key, slot);
++ if (key.objectid != ino || key.type != BTRFS_XATTR_ITEM_KEY)
++ break;
++
++ if (ins_nr == 0)
++ start_slot = slot;
++ ins_nr++;
++ path->slots[0]++;
++ cond_resched();
++ }
++ if (ins_nr > 0) {
++ u64 last_extent = 0;
++
++ ret = copy_items(trans, inode, dst_path, path,
++ &last_extent, start_slot,
++ ins_nr, 1, 0);
++ /* can't be 1, extent items aren't processed */
++ ASSERT(ret <= 0);
++ if (ret < 0)
++ return ret;
++ }
++
++ return 0;
++}
++
++/*
++ * If the no holes feature is enabled we need to make sure any hole between the
++ * last extent and the i_size of our inode is explicitly marked in the log. This
++ * is to make sure that doing something like:
++ *
++ * 1) create file with 128Kb of data
++ * 2) truncate file to 64Kb
++ * 3) truncate file to 256Kb
++ * 4) fsync file
++ * 5) <crash/power failure>
++ * 6) mount fs and trigger log replay
++ *
++ * Will give us a file with a size of 256Kb, the first 64Kb of data match what
++ * the file had in its first 64Kb of data at step 1 and the last 192Kb of the
++ * file correspond to a hole. The presence of explicit holes in a log tree is
++ * what guarantees that log replay will remove/adjust file extent items in the
++ * fs/subvol tree.
++ *
++ * Here we do not need to care about holes between extents, that is already done
++ * by copy_items(). We also only need to do this in the full sync path, where we
++ * lookup for extents from the fs/subvol tree only. In the fast path case, we
++ * lookup the list of modified extent maps and if any represents a hole, we
++ * insert a corresponding extent representing a hole in the log tree.
++ */
++static int btrfs_log_trailing_hole(struct btrfs_trans_handle *trans,
++ struct btrfs_root *root,
++ struct inode *inode,
++ struct btrfs_path *path)
++{
++ int ret;
++ struct btrfs_key key;
++ u64 hole_start;
++ u64 hole_size;
++ struct extent_buffer *leaf;
++ struct btrfs_root *log = root->log_root;
++ const u64 ino = btrfs_ino(inode);
++ const u64 i_size = i_size_read(inode);
++
++ if (!btrfs_fs_incompat(root->fs_info, NO_HOLES))
++ return 0;
++
++ key.objectid = ino;
++ key.type = BTRFS_EXTENT_DATA_KEY;
++ key.offset = (u64)-1;
++
++ ret = btrfs_search_slot(NULL, root, &key, path, 0, 0);
++ ASSERT(ret != 0);
++ if (ret < 0)
++ return ret;
++
++ ASSERT(path->slots[0] > 0);
++ path->slots[0]--;
++ leaf = path->nodes[0];
++ btrfs_item_key_to_cpu(leaf, &key, path->slots[0]);
++
++ if (key.objectid != ino || key.type != BTRFS_EXTENT_DATA_KEY) {
++ /* inode does not have any extents */
++ hole_start = 0;
++ hole_size = i_size;
++ } else {
++ struct btrfs_file_extent_item *extent;
++ u64 len;
++
++ /*
++ * If there's an extent beyond i_size, an explicit hole was
++ * already inserted by copy_items().
++ */
++ if (key.offset >= i_size)
++ return 0;
++
++ extent = btrfs_item_ptr(leaf, path->slots[0],
++ struct btrfs_file_extent_item);
++
++ if (btrfs_file_extent_type(leaf, extent) ==
++ BTRFS_FILE_EXTENT_INLINE) {
++ len = btrfs_file_extent_inline_len(leaf,
++ path->slots[0],
++ extent);
++ ASSERT(len == i_size);
++ return 0;
++ }
++
++ len = btrfs_file_extent_num_bytes(leaf, extent);
++ /* Last extent goes beyond i_size, no need to log a hole. */
++ if (key.offset + len > i_size)
++ return 0;
++ hole_start = key.offset + len;
++ hole_size = i_size - hole_start;
++ }
++ btrfs_release_path(path);
++
++ /* Last extent ends at i_size. */
++ if (hole_size == 0)
++ return 0;
++
++ hole_size = ALIGN(hole_size, root->sectorsize);
++ ret = btrfs_insert_file_extent(trans, log, ino, hole_start, 0, 0,
++ hole_size, 0, hole_size, 0, 0, 0);
++ return ret;
++}
++
++/*
++ * When we are logging a new inode X, check if it doesn't have a reference that
++ * matches the reference from some other inode Y created in a past transaction
++ * and that was renamed in the current transaction. If we don't do this, then at
++ * log replay time we can lose inode Y (and all its files if it's a directory):
++ *
++ * mkdir /mnt/x
++ * echo "hello world" > /mnt/x/foobar
++ * sync
++ * mv /mnt/x /mnt/y
++ * mkdir /mnt/x # or touch /mnt/x
++ * xfs_io -c fsync /mnt/x
++ * <power fail>
++ * mount fs, trigger log replay
++ *
++ * After the log replay procedure, we would lose the first directory and all its
++ * files (file foobar).
++ * For the case where inode Y is not a directory we simply end up losing it:
++ *
++ * echo "123" > /mnt/foo
++ * sync
++ * mv /mnt/foo /mnt/bar
++ * echo "abc" > /mnt/foo
++ * xfs_io -c fsync /mnt/foo
++ * <power fail>
++ *
++ * We also need this for cases where a snapshot entry is replaced by some other
++ * entry (file or directory) otherwise we end up with an unreplayable log due to
++ * attempts to delete the snapshot entry (entry of type BTRFS_ROOT_ITEM_KEY) as
++ * if it were a regular entry:
++ *
++ * mkdir /mnt/x
++ * btrfs subvolume snapshot /mnt /mnt/x/snap
++ * btrfs subvolume delete /mnt/x/snap
++ * rmdir /mnt/x
++ * mkdir /mnt/x
++ * fsync /mnt/x or fsync some new file inside it
++ * <power fail>
++ *
++ * The snapshot delete, rmdir of x, mkdir of a new x and the fsync all happen in
++ * the same transaction.
++ */
++static int btrfs_check_ref_name_override(struct extent_buffer *eb,
++ const int slot,
++ const struct btrfs_key *key,
++ struct inode *inode)
++{
++ int ret;
++ struct btrfs_path *search_path;
++ char *name = NULL;
++ u32 name_len = 0;
++ u32 item_size = btrfs_item_size_nr(eb, slot);
++ u32 cur_offset = 0;
++ unsigned long ptr = btrfs_item_ptr_offset(eb, slot);
++
++ search_path = btrfs_alloc_path();
++ if (!search_path)
++ return -ENOMEM;
++ search_path->search_commit_root = 1;
++ search_path->skip_locking = 1;
++
++ while (cur_offset < item_size) {
++ u64 parent;
++ u32 this_name_len;
++ u32 this_len;
++ unsigned long name_ptr;
++ struct btrfs_dir_item *di;
++
++ if (key->type == BTRFS_INODE_REF_KEY) {
++ struct btrfs_inode_ref *iref;
++
++ iref = (struct btrfs_inode_ref *)(ptr + cur_offset);
++ parent = key->offset;
++ this_name_len = btrfs_inode_ref_name_len(eb, iref);
++ name_ptr = (unsigned long)(iref + 1);
++ this_len = sizeof(*iref) + this_name_len;
++ } else {
++ struct btrfs_inode_extref *extref;
++
++ extref = (struct btrfs_inode_extref *)(ptr +
++ cur_offset);
++ parent = btrfs_inode_extref_parent(eb, extref);
++ this_name_len = btrfs_inode_extref_name_len(eb, extref);
++ name_ptr = (unsigned long)&extref->name;
++ this_len = sizeof(*extref) + this_name_len;
++ }
++
++ if (this_name_len > name_len) {
++ char *new_name;
++
++ new_name = krealloc(name, this_name_len, GFP_NOFS);
++ if (!new_name) {
++ ret = -ENOMEM;
++ goto out;
++ }
++ name_len = this_name_len;
++ name = new_name;
++ }
++
++ read_extent_buffer(eb, name, name_ptr, this_name_len);
++ di = btrfs_lookup_dir_item(NULL, BTRFS_I(inode)->root,
++ search_path, parent,
++ name, this_name_len, 0);
++ if (di && !IS_ERR(di)) {
++ ret = 1;
++ goto out;
++ } else if (IS_ERR(di)) {
++ ret = PTR_ERR(di);
++ goto out;
++ }
++ btrfs_release_path(search_path);
++
++ cur_offset += this_len;
++ }
++ ret = 0;
++out:
++ btrfs_free_path(search_path);
++ kfree(name);
++ return ret;
++}
++
+ /* log a single inode in the tree log.
+ * At least one parent directory for this inode must exist in the tree
+ * or be logged already.
+@@ -3967,6 +4269,7 @@ static int btrfs_log_inode(struct btrfs_trans_handle *trans,
+ u64 ino = btrfs_ino(inode);
+ struct extent_map_tree *em_tree = &BTRFS_I(inode)->extent_tree;
+ u64 logged_isize = 0;
++ bool need_log_inode_item = true;
+
+ path = btrfs_alloc_path();
+ if (!path)
+@@ -4056,11 +4359,6 @@ static int btrfs_log_inode(struct btrfs_trans_handle *trans,
+ } else {
+ if (inode_only == LOG_INODE_ALL)
+ fast_search = true;
+- ret = log_inode_item(trans, log, dst_path, inode);
+- if (ret) {
+- err = ret;
+- goto out_unlock;
+- }
+ goto log_extents;
+ }
+
+@@ -4083,6 +4381,44 @@ again:
+ if (min_key.type > max_key.type)
+ break;
+
++ if (min_key.type == BTRFS_INODE_ITEM_KEY)
++ need_log_inode_item = false;
++
++ if ((min_key.type == BTRFS_INODE_REF_KEY ||
++ min_key.type == BTRFS_INODE_EXTREF_KEY) &&
++ BTRFS_I(inode)->generation == trans->transid) {
++ ret = btrfs_check_ref_name_override(path->nodes[0],
++ path->slots[0],
++ &min_key, inode);
++ if (ret < 0) {
++ err = ret;
++ goto out_unlock;
++ } else if (ret > 0) {
++ err = 1;
++ btrfs_set_log_full_commit(root->fs_info, trans);
++ goto out_unlock;
++ }
++ }
++
++ /* Skip xattrs, we log them later with btrfs_log_all_xattrs() */
++ if (min_key.type == BTRFS_XATTR_ITEM_KEY) {
++ if (ins_nr == 0)
++ goto next_slot;
++ ret = copy_items(trans, inode, dst_path, path,
++ &last_extent, ins_start_slot,
++ ins_nr, inode_only, logged_isize);
++ if (ret < 0) {
++ err = ret;
++ goto out_unlock;
++ }
++ ins_nr = 0;
++ if (ret) {
++ btrfs_release_path(path);
++ continue;
++ }
++ goto next_slot;
++ }
++
+ src = path->nodes[0];
+ if (ins_nr && ins_start_slot + ins_nr == path->slots[0]) {
+ ins_nr++;
+@@ -4150,9 +4486,26 @@ next_slot:
+ ins_nr = 0;
+ }
+
++ btrfs_release_path(path);
++ btrfs_release_path(dst_path);
++ err = btrfs_log_all_xattrs(trans, root, inode, path, dst_path);
++ if (err)
++ goto out_unlock;
++ if (max_key.type >= BTRFS_EXTENT_DATA_KEY && !fast_search) {
++ btrfs_release_path(path);
++ btrfs_release_path(dst_path);
++ err = btrfs_log_trailing_hole(trans, root, inode, path);
++ if (err)
++ goto out_unlock;
++ }
+ log_extents:
+ btrfs_release_path(path);
+ btrfs_release_path(dst_path);
++ if (need_log_inode_item) {
++ err = log_inode_item(trans, log, dst_path, inode);
++ if (err)
++ goto out_unlock;
++ }
+ if (fast_search) {
+ ret = btrfs_log_changed_extents(trans, root, inode, dst_path,
+ &logged_list, ctx);
+diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
+index c55a1faaed58..6ce71e4e82e5 100644
+--- a/fs/ext4/ext4.h
++++ b/fs/ext4/ext4.h
+@@ -811,6 +811,29 @@ do { \
+ #include "extents_status.h"
+
+ /*
++ * Lock subclasses for i_data_sem in the ext4_inode_info structure.
++ *
++ * These are needed to avoid lockdep false positives when we need to
++ * allocate blocks to the quota inode during ext4_map_blocks(), while
++ * holding i_data_sem for a normal (non-quota) inode. Since we don't
++ * do quota tracking for the quota inode, this avoids deadlock (as
++ * well as infinite recursion, since it isn't turtles all the way
++ * down...)
++ *
++ * I_DATA_SEM_NORMAL - Used for most inodes
++ * I_DATA_SEM_OTHER - Used by move_inode.c for the second normal inode
++ * where the second inode has larger inode number
++ * than the first
++ * I_DATA_SEM_QUOTA - Used for quota inodes only
++ */
++enum {
++ I_DATA_SEM_NORMAL = 0,
++ I_DATA_SEM_OTHER,
++ I_DATA_SEM_QUOTA,
++};
++
++
++/*
+ * fourth extended file system inode data in memory
+ */
+ struct ext4_inode_info {
+diff --git a/fs/ext4/move_extent.c b/fs/ext4/move_extent.c
+index f498c34b4688..4d1049517e4a 100644
+--- a/fs/ext4/move_extent.c
++++ b/fs/ext4/move_extent.c
+@@ -60,10 +60,10 @@ ext4_double_down_write_data_sem(struct inode *first, struct inode *second)
+ {
+ if (first < second) {
+ down_write(&EXT4_I(first)->i_data_sem);
+- down_write_nested(&EXT4_I(second)->i_data_sem, SINGLE_DEPTH_NESTING);
++ down_write_nested(&EXT4_I(second)->i_data_sem, I_DATA_SEM_OTHER);
+ } else {
+ down_write(&EXT4_I(second)->i_data_sem);
+- down_write_nested(&EXT4_I(first)->i_data_sem, SINGLE_DEPTH_NESTING);
++ down_write_nested(&EXT4_I(first)->i_data_sem, I_DATA_SEM_OTHER);
+
+ }
+ }
+@@ -491,6 +491,13 @@ mext_check_arguments(struct inode *orig_inode,
+ return -EBUSY;
+ }
+
++ if (IS_NOQUOTA(orig_inode) || IS_NOQUOTA(donor_inode)) {
++ ext4_debug("ext4 move extent: The argument files should "
++ "not be quota files [ino:orig %lu, donor %lu]\n",
++ orig_inode->i_ino, donor_inode->i_ino);
++ return -EBUSY;
++ }
++
+ /* Ext4 move extent supports only extent based file */
+ if (!(ext4_test_inode_flag(orig_inode, EXT4_INODE_EXTENTS))) {
+ ext4_debug("ext4 move extent: orig file is not extents "
+diff --git a/fs/ext4/super.c b/fs/ext4/super.c
+index b16ba5239dcf..a5d94f263870 100644
+--- a/fs/ext4/super.c
++++ b/fs/ext4/super.c
+@@ -1281,9 +1281,9 @@ static int set_qf_name(struct super_block *sb, int qtype, substring_t *args)
+ return -1;
+ }
+ if (EXT4_HAS_RO_COMPAT_FEATURE(sb, EXT4_FEATURE_RO_COMPAT_QUOTA)) {
+- ext4_msg(sb, KERN_ERR, "Cannot set journaled quota options "
+- "when QUOTA feature is enabled");
+- return -1;
++ ext4_msg(sb, KERN_INFO, "Journaled quota options "
++ "ignored when QUOTA feature is enabled");
++ return 1;
+ }
+ qname = match_strdup(args);
+ if (!qname) {
+@@ -1622,10 +1622,10 @@ static int handle_mount_opt(struct super_block *sb, char *opt, int token,
+ }
+ if (EXT4_HAS_RO_COMPAT_FEATURE(sb,
+ EXT4_FEATURE_RO_COMPAT_QUOTA)) {
+- ext4_msg(sb, KERN_ERR,
+- "Cannot set journaled quota options "
++ ext4_msg(sb, KERN_INFO,
++ "Quota format mount options ignored "
+ "when QUOTA feature is enabled");
+- return -1;
++ return 1;
+ }
+ sbi->s_jquota_fmt = m->mount_opt;
+ #endif
+@@ -1677,11 +1677,11 @@ static int parse_options(char *options, struct super_block *sb,
+ #ifdef CONFIG_QUOTA
+ if (EXT4_HAS_RO_COMPAT_FEATURE(sb, EXT4_FEATURE_RO_COMPAT_QUOTA) &&
+ (test_opt(sb, USRQUOTA) || test_opt(sb, GRPQUOTA))) {
+- ext4_msg(sb, KERN_ERR, "Cannot set quota options when QUOTA "
+- "feature is enabled");
+- return 0;
+- }
+- if (sbi->s_qf_names[USRQUOTA] || sbi->s_qf_names[GRPQUOTA]) {
++ ext4_msg(sb, KERN_INFO, "Quota feature enabled, usrquota and grpquota "
++ "mount options ignored.");
++ clear_opt(sb, USRQUOTA);
++ clear_opt(sb, GRPQUOTA);
++ } else if (sbi->s_qf_names[USRQUOTA] || sbi->s_qf_names[GRPQUOTA]) {
+ if (test_opt(sb, USRQUOTA) && sbi->s_qf_names[USRQUOTA])
+ clear_opt(sb, USRQUOTA);
+
+@@ -5187,6 +5187,20 @@ static int ext4_quota_on_mount(struct super_block *sb, int type)
+ EXT4_SB(sb)->s_jquota_fmt, type);
+ }
+
++static void lockdep_set_quota_inode(struct inode *inode, int subclass)
++{
++ struct ext4_inode_info *ei = EXT4_I(inode);
++
++ /* The first argument of lockdep_set_subclass has to be
++ * *exactly* the same as the argument to init_rwsem() --- in
++ * this case, in init_once() --- or lockdep gets unhappy
++ * because the name of the lock is set using the
++ * stringification of the argument to init_rwsem().
++ */
++ (void) ei; /* shut up clang warning if !CONFIG_LOCKDEP */
++ lockdep_set_subclass(&ei->i_data_sem, subclass);
++}
++
+ /*
+ * Standard function to be called on quota_on
+ */
+@@ -5226,8 +5240,12 @@ static int ext4_quota_on(struct super_block *sb, int type, int format_id,
+ if (err)
+ return err;
+ }
+-
+- return dquot_quota_on(sb, type, format_id, path);
++ lockdep_set_quota_inode(path->dentry->d_inode, I_DATA_SEM_QUOTA);
++ err = dquot_quota_on(sb, type, format_id, path);
++ if (err)
++ lockdep_set_quota_inode(path->dentry->d_inode,
++ I_DATA_SEM_NORMAL);
++ return err;
+ }
+
+ static int ext4_quota_enable(struct super_block *sb, int type, int format_id,
+@@ -5253,8 +5271,11 @@ static int ext4_quota_enable(struct super_block *sb, int type, int format_id,
+
+ /* Don't account quota for quota files to avoid recursion */
+ qf_inode->i_flags |= S_NOQUOTA;
++ lockdep_set_quota_inode(qf_inode, I_DATA_SEM_QUOTA);
+ err = dquot_enable(qf_inode, type, format_id, flags);
+ iput(qf_inode);
++ if (err)
++ lockdep_set_quota_inode(qf_inode, I_DATA_SEM_NORMAL);
+
+ return err;
+ }
+diff --git a/include/linux/compiler-gcc.h b/include/linux/compiler-gcc.h
+index 02ae99e8e6d3..633716ef19b0 100644
+--- a/include/linux/compiler-gcc.h
++++ b/include/linux/compiler-gcc.h
+@@ -100,10 +100,122 @@
+ #define __maybe_unused __attribute__((unused))
+ #define __always_unused __attribute__((unused))
+
+-#define __gcc_header(x) #x
+-#define _gcc_header(x) __gcc_header(linux/compiler-gcc##x.h)
+-#define gcc_header(x) _gcc_header(x)
+-#include gcc_header(__GNUC__)
++/* gcc version specific checks */
++
++#if GCC_VERSION < 30200
++# error Sorry, your compiler is too old - please upgrade it.
++#endif
++
++#if GCC_VERSION < 30300
++# define __used __attribute__((__unused__))
++#else
++# define __used __attribute__((__used__))
++#endif
++
++#ifdef CONFIG_GCOV_KERNEL
++# if GCC_VERSION < 30400
++# error "GCOV profiling support for gcc versions below 3.4 not included"
++# endif /* __GNUC_MINOR__ */
++#endif /* CONFIG_GCOV_KERNEL */
++
++#if GCC_VERSION >= 30400
++#define __must_check __attribute__((warn_unused_result))
++#endif
++
++#if GCC_VERSION >= 40000
++
++/* GCC 4.1.[01] miscompiles __weak */
++#ifdef __KERNEL__
++# if GCC_VERSION >= 40100 && GCC_VERSION <= 40101
++# error Your version of gcc miscompiles the __weak directive
++# endif
++#endif
++
++#define __used __attribute__((__used__))
++#define __compiler_offsetof(a, b) \
++ __builtin_offsetof(a, b)
++
++#if GCC_VERSION >= 40100 && GCC_VERSION < 40600
++# define __compiletime_object_size(obj) __builtin_object_size(obj, 0)
++#endif
++
++#if GCC_VERSION >= 40300
++/* Mark functions as cold. gcc will assume any path leading to a call
++ * to them will be unlikely. This means a lot of manual unlikely()s
++ * are unnecessary now for any paths leading to the usual suspects
++ * like BUG(), printk(), panic() etc. [but let's keep them for now for
++ * older compilers]
++ *
++ * Early snapshots of gcc 4.3 don't support this and we can't detect this
++ * in the preprocessor, but we can live with this because they're unreleased.
++ * Maketime probing would be overkill here.
++ *
++ * gcc also has a __attribute__((__hot__)) to move hot functions into
++ * a special section, but I don't see any sense in this right now in
++ * the kernel context
++ */
++#define __cold __attribute__((__cold__))
++
++#define __UNIQUE_ID(prefix) __PASTE(__PASTE(__UNIQUE_ID_, prefix), __COUNTER__)
++
++#ifndef __CHECKER__
++# define __compiletime_warning(message) __attribute__((warning(message)))
++# define __compiletime_error(message) __attribute__((error(message)))
++#endif /* __CHECKER__ */
++#endif /* GCC_VERSION >= 40300 */
++
++#if GCC_VERSION >= 40500
++/*
++ * Mark a position in code as unreachable. This can be used to
++ * suppress control flow warnings after asm blocks that transfer
++ * control elsewhere.
++ *
++ * Early snapshots of gcc 4.5 don't support this and we can't detect
++ * this in the preprocessor, but we can live with this because they're
++ * unreleased. Really, we need to have autoconf for the kernel.
++ */
++#define unreachable() __builtin_unreachable()
++
++/* Mark a function definition as prohibited from being cloned. */
++#define __noclone __attribute__((__noclone__, __optimize__("no-tracer")))
++
++#endif /* GCC_VERSION >= 40500 */
++
++#if GCC_VERSION >= 40600
++/*
++ * Tell the optimizer that something else uses this function or variable.
++ */
++#define __visible __attribute__((externally_visible))
++#endif
++
++/*
++ * GCC 'asm goto' miscompiles certain code sequences:
++ *
++ * http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58670
++ *
++ * Work it around via a compiler barrier quirk suggested by Jakub Jelinek.
++ *
++ * (asm goto is automatically volatile - the naming reflects this.)
++ */
++#define asm_volatile_goto(x...) do { asm goto(x); asm (""); } while (0)
++
++#ifdef CONFIG_ARCH_USE_BUILTIN_BSWAP
++#if GCC_VERSION >= 40400
++#define __HAVE_BUILTIN_BSWAP32__
++#define __HAVE_BUILTIN_BSWAP64__
++#endif
++#if GCC_VERSION >= 40800 || (defined(__powerpc__) && GCC_VERSION >= 40600)
++#define __HAVE_BUILTIN_BSWAP16__
++#endif
++#endif /* CONFIG_ARCH_USE_BUILTIN_BSWAP */
++
++#if GCC_VERSION >= 50000
++#define KASAN_ABI_VERSION 4
++#elif GCC_VERSION >= 40902
++#define KASAN_ABI_VERSION 3
++#endif
++
++#endif /* gcc version >= 40000 specific checks */
+
+ #if !defined(__noclone)
+ #define __noclone /* not needed */
+diff --git a/include/linux/compiler-gcc3.h b/include/linux/compiler-gcc3.h
+deleted file mode 100644
+index 7d89febe4d79..000000000000
+--- a/include/linux/compiler-gcc3.h
++++ /dev/null
+@@ -1,23 +0,0 @@
+-#ifndef __LINUX_COMPILER_H
+-#error "Please don't include <linux/compiler-gcc3.h> directly, include <linux/compiler.h> instead."
+-#endif
+-
+-#if GCC_VERSION < 30200
+-# error Sorry, your compiler is too old - please upgrade it.
+-#endif
+-
+-#if GCC_VERSION >= 30300
+-# define __used __attribute__((__used__))
+-#else
+-# define __used __attribute__((__unused__))
+-#endif
+-
+-#if GCC_VERSION >= 30400
+-#define __must_check __attribute__((warn_unused_result))
+-#endif
+-
+-#ifdef CONFIG_GCOV_KERNEL
+-# if GCC_VERSION < 30400
+-# error "GCOV profiling support for gcc versions below 3.4 not included"
+-# endif /* __GNUC_MINOR__ */
+-#endif /* CONFIG_GCOV_KERNEL */
+diff --git a/include/linux/compiler-gcc4.h b/include/linux/compiler-gcc4.h
+deleted file mode 100644
+index d1a558239b1a..000000000000
+--- a/include/linux/compiler-gcc4.h
++++ /dev/null
+@@ -1,87 +0,0 @@
+-#ifndef __LINUX_COMPILER_H
+-#error "Please don't include <linux/compiler-gcc4.h> directly, include <linux/compiler.h> instead."
+-#endif
+-
+-/* GCC 4.1.[01] miscompiles __weak */
+-#ifdef __KERNEL__
+-# if GCC_VERSION >= 40100 && GCC_VERSION <= 40101
+-# error Your version of gcc miscompiles the __weak directive
+-# endif
+-#endif
+-
+-#define __used __attribute__((__used__))
+-#define __must_check __attribute__((warn_unused_result))
+-#define __compiler_offsetof(a,b) __builtin_offsetof(a,b)
+-
+-#if GCC_VERSION >= 40100 && GCC_VERSION < 40600
+-# define __compiletime_object_size(obj) __builtin_object_size(obj, 0)
+-#endif
+-
+-#if GCC_VERSION >= 40300
+-/* Mark functions as cold. gcc will assume any path leading to a call
+- to them will be unlikely. This means a lot of manual unlikely()s
+- are unnecessary now for any paths leading to the usual suspects
+- like BUG(), printk(), panic() etc. [but let's keep them for now for
+- older compilers]
+-
+- Early snapshots of gcc 4.3 don't support this and we can't detect this
+- in the preprocessor, but we can live with this because they're unreleased.
+- Maketime probing would be overkill here.
+-
+- gcc also has a __attribute__((__hot__)) to move hot functions into
+- a special section, but I don't see any sense in this right now in
+- the kernel context */
+-#define __cold __attribute__((__cold__))
+-
+-#define __UNIQUE_ID(prefix) __PASTE(__PASTE(__UNIQUE_ID_, prefix), __COUNTER__)
+-
+-#ifndef __CHECKER__
+-# define __compiletime_warning(message) __attribute__((warning(message)))
+-# define __compiletime_error(message) __attribute__((error(message)))
+-#endif /* __CHECKER__ */
+-#endif /* GCC_VERSION >= 40300 */
+-
+-#if GCC_VERSION >= 40500
+-/*
+- * Mark a position in code as unreachable. This can be used to
+- * suppress control flow warnings after asm blocks that transfer
+- * control elsewhere.
+- *
+- * Early snapshots of gcc 4.5 don't support this and we can't detect
+- * this in the preprocessor, but we can live with this because they're
+- * unreleased. Really, we need to have autoconf for the kernel.
+- */
+-#define unreachable() __builtin_unreachable()
+-
+-/* Mark a function definition as prohibited from being cloned. */
+-#define __noclone __attribute__((__noclone__))
+-
+-#endif /* GCC_VERSION >= 40500 */
+-
+-#if GCC_VERSION >= 40600
+-/*
+- * Tell the optimizer that something else uses this function or variable.
+- */
+-#define __visible __attribute__((externally_visible))
+-#endif
+-
+-/*
+- * GCC 'asm goto' miscompiles certain code sequences:
+- *
+- * http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58670
+- *
+- * Work it around via a compiler barrier quirk suggested by Jakub Jelinek.
+- *
+- * (asm goto is automatically volatile - the naming reflects this.)
+- */
+-#define asm_volatile_goto(x...) do { asm goto(x); asm (""); } while (0)
+-
+-#ifdef CONFIG_ARCH_USE_BUILTIN_BSWAP
+-#if GCC_VERSION >= 40400
+-#define __HAVE_BUILTIN_BSWAP32__
+-#define __HAVE_BUILTIN_BSWAP64__
+-#endif
+-#if GCC_VERSION >= 40800 || (defined(__powerpc__) && GCC_VERSION >= 40600)
+-#define __HAVE_BUILTIN_BSWAP16__
+-#endif
+-#endif /* CONFIG_ARCH_USE_BUILTIN_BSWAP */
+diff --git a/include/linux/compiler-gcc5.h b/include/linux/compiler-gcc5.h
+deleted file mode 100644
+index c8c565952548..000000000000
+--- a/include/linux/compiler-gcc5.h
++++ /dev/null
+@@ -1,65 +0,0 @@
+-#ifndef __LINUX_COMPILER_H
+-#error "Please don't include <linux/compiler-gcc5.h> directly, include <linux/compiler.h> instead."
+-#endif
+-
+-#define __used __attribute__((__used__))
+-#define __must_check __attribute__((warn_unused_result))
+-#define __compiler_offsetof(a, b) __builtin_offsetof(a, b)
+-
+-/* Mark functions as cold. gcc will assume any path leading to a call
+- to them will be unlikely. This means a lot of manual unlikely()s
+- are unnecessary now for any paths leading to the usual suspects
+- like BUG(), printk(), panic() etc. [but let's keep them for now for
+- older compilers]
+-
+- Early snapshots of gcc 4.3 don't support this and we can't detect this
+- in the preprocessor, but we can live with this because they're unreleased.
+- Maketime probing would be overkill here.
+-
+- gcc also has a __attribute__((__hot__)) to move hot functions into
+- a special section, but I don't see any sense in this right now in
+- the kernel context */
+-#define __cold __attribute__((__cold__))
+-
+-#define __UNIQUE_ID(prefix) __PASTE(__PASTE(__UNIQUE_ID_, prefix), __COUNTER__)
+-
+-#ifndef __CHECKER__
+-# define __compiletime_warning(message) __attribute__((warning(message)))
+-# define __compiletime_error(message) __attribute__((error(message)))
+-#endif /* __CHECKER__ */
+-
+-/*
+- * Mark a position in code as unreachable. This can be used to
+- * suppress control flow warnings after asm blocks that transfer
+- * control elsewhere.
+- *
+- * Early snapshots of gcc 4.5 don't support this and we can't detect
+- * this in the preprocessor, but we can live with this because they're
+- * unreleased. Really, we need to have autoconf for the kernel.
+- */
+-#define unreachable() __builtin_unreachable()
+-
+-/* Mark a function definition as prohibited from being cloned. */
+-#define __noclone __attribute__((__noclone__))
+-
+-/*
+- * Tell the optimizer that something else uses this function or variable.
+- */
+-#define __visible __attribute__((externally_visible))
+-
+-/*
+- * GCC 'asm goto' miscompiles certain code sequences:
+- *
+- * http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58670
+- *
+- * Work it around via a compiler barrier quirk suggested by Jakub Jelinek.
+- *
+- * (asm goto is automatically volatile - the naming reflects this.)
+- */
+-#define asm_volatile_goto(x...) do { asm goto(x); asm (""); } while (0)
+-
+-#ifdef CONFIG_ARCH_USE_BUILTIN_BSWAP
+-#define __HAVE_BUILTIN_BSWAP32__
+-#define __HAVE_BUILTIN_BSWAP64__
+-#define __HAVE_BUILTIN_BSWAP16__
+-#endif /* CONFIG_ARCH_USE_BUILTIN_BSWAP */
+diff --git a/include/linux/usb_usual.h b/include/linux/usb_usual.h
+index 7f5f78bd15ad..245f57dbbb61 100644
+--- a/include/linux/usb_usual.h
++++ b/include/linux/usb_usual.h
+@@ -79,6 +79,8 @@
+ /* Cannot handle MI_REPORT_SUPPORTED_OPERATION_CODES */ \
+ US_FLAG(MAX_SECTORS_240, 0x08000000) \
+ /* Sets max_sectors to 240 */ \
++ US_FLAG(NO_REPORT_LUNS, 0x10000000) \
++ /* Cannot handle REPORT_LUNS */ \
+
+ #define US_FLAG(name, value) US_FL_##name = value ,
+ enum { US_DO_ALL_FLAGS };
+diff --git a/lib/assoc_array.c b/lib/assoc_array.c
+index 2404d03e251a..03a77f4740c1 100644
+--- a/lib/assoc_array.c
++++ b/lib/assoc_array.c
+@@ -523,7 +523,9 @@ static bool assoc_array_insert_into_terminal_node(struct assoc_array_edit *edit,
+ free_slot = i;
+ continue;
+ }
+- if (ops->compare_object(assoc_array_ptr_to_leaf(ptr), index_key)) {
++ if (assoc_array_ptr_is_leaf(ptr) &&
++ ops->compare_object(assoc_array_ptr_to_leaf(ptr),
++ index_key)) {
+ pr_devel("replace in slot %d\n", i);
+ edit->leaf_p = &node->slots[i];
+ edit->dead_leaf = node->slots[i];
+diff --git a/lib/lz4/lz4defs.h b/lib/lz4/lz4defs.h
+index abcecdc2d0f2..0710a62ad2f6 100644
+--- a/lib/lz4/lz4defs.h
++++ b/lib/lz4/lz4defs.h
+@@ -11,8 +11,7 @@
+ /*
+ * Detects 64 bits mode
+ */
+-#if (defined(__x86_64__) || defined(__x86_64) || defined(__amd64__) \
+- || defined(__ppc64__) || defined(__LP64__))
++#if defined(CONFIG_64BIT)
+ #define LZ4_ARCH64 1
+ #else
+ #define LZ4_ARCH64 0
+@@ -35,6 +34,10 @@ typedef struct _U64_S { u64 v; } U64_S;
+
+ #define PUT4(s, d) (A32(d) = A32(s))
+ #define PUT8(s, d) (A64(d) = A64(s))
++
++#define LZ4_READ_LITTLEENDIAN_16(d, s, p) \
++ (d = s - A16(p))
++
+ #define LZ4_WRITE_LITTLEENDIAN_16(p, v) \
+ do { \
+ A16(p) = v; \
+@@ -51,10 +54,13 @@ typedef struct _U64_S { u64 v; } U64_S;
+ #define PUT8(s, d) \
+ put_unaligned(get_unaligned((const u64 *) s), (u64 *) d)
+
+-#define LZ4_WRITE_LITTLEENDIAN_16(p, v) \
+- do { \
+- put_unaligned(v, (u16 *)(p)); \
+- p += 2; \
++#define LZ4_READ_LITTLEENDIAN_16(d, s, p) \
++ (d = s - get_unaligned_le16(p))
++
++#define LZ4_WRITE_LITTLEENDIAN_16(p, v) \
++ do { \
++ put_unaligned_le16(v, (u16 *)(p)); \
++ p += 2; \
+ } while (0)
+ #endif
+
+@@ -140,9 +146,6 @@ typedef struct _U64_S { u64 v; } U64_S;
+
+ #endif
+
+-#define LZ4_READ_LITTLEENDIAN_16(d, s, p) \
+- (d = s - get_unaligned_le16(p))
+-
+ #define LZ4_WILDCOPY(s, d, e) \
+ do { \
+ LZ4_COPYPACKET(s, d); \
+diff --git a/net/ipv4/tcp_cubic.c b/net/ipv4/tcp_cubic.c
+index 20de0118c98e..9332ec123a6c 100644
+--- a/net/ipv4/tcp_cubic.c
++++ b/net/ipv4/tcp_cubic.c
+@@ -154,6 +154,27 @@ static void bictcp_init(struct sock *sk)
+ tcp_sk(sk)->snd_ssthresh = initial_ssthresh;
+ }
+
++static void bictcp_cwnd_event(struct sock *sk, enum tcp_ca_event event)
++{
++ if (event == CA_EVENT_TX_START) {
++ struct bictcp *ca = inet_csk_ca(sk);
++ u32 now = tcp_time_stamp;
++ s32 delta;
++
++ delta = now - tcp_sk(sk)->lsndtime;
++
++ /* We were application limited (idle) for a while.
++ * Shift epoch_start to keep cwnd growth to cubic curve.
++ */
++ if (ca->epoch_start && delta > 0) {
++ ca->epoch_start += delta;
++ if (after(ca->epoch_start, now))
++ ca->epoch_start = now;
++ }
++ return;
++ }
++}
++
+ /* calculate the cubic root of x using a table lookup followed by one
+ * Newton-Raphson iteration.
+ * Avg err ~= 0.195%
+@@ -440,6 +461,7 @@ static struct tcp_congestion_ops cubictcp __read_mostly = {
+ .cong_avoid = bictcp_cong_avoid,
+ .set_state = bictcp_state,
+ .undo_cwnd = bictcp_undo_cwnd,
++ .cwnd_event = bictcp_cwnd_event,
+ .pkts_acked = bictcp_acked,
+ .owner = THIS_MODULE,
+ .name = "cubic",
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 1bc0be907ead..c3c8337c4ea2 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -4644,6 +4644,7 @@ enum {
+ ALC255_FIXUP_DELL_SPK_NOISE,
+ ALC225_FIXUP_DELL1_MIC_NO_PRESENCE,
+ ALC280_FIXUP_HP_HEADSET_MIC,
++ ALC221_FIXUP_HP_FRONT_MIC,
+ };
+
+ static const struct hda_fixup alc269_fixups[] = {
+@@ -5256,6 +5257,13 @@ static const struct hda_fixup alc269_fixups[] = {
+ .chained = true,
+ .chain_id = ALC269_FIXUP_HEADSET_MIC,
+ },
++ [ALC221_FIXUP_HP_FRONT_MIC] = {
++ .type = HDA_FIXUP_PINS,
++ .v.pins = (const struct hda_pintbl[]) {
++ { 0x19, 0x02a19020 }, /* Front Mic */
++ { }
++ },
++ },
+ };
+
+ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+@@ -5345,6 +5353,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x103c, 0x2336, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+ SND_PCI_QUIRK(0x103c, 0x2337, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+ SND_PCI_QUIRK(0x103c, 0x221c, "HP EliteBook 755 G2", ALC280_FIXUP_HP_HEADSET_MIC),
++ SND_PCI_QUIRK(0x103c, 0x8256, "HP", ALC221_FIXUP_HP_FRONT_MIC),
+ SND_PCI_QUIRK(0x1043, 0x103f, "ASUS TX300", ALC282_FIXUP_ASUS_TX300),
+ SND_PCI_QUIRK(0x1043, 0x106d, "Asus K53BE", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
+ SND_PCI_QUIRK(0x1043, 0x115d, "Asus 1015E", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
+diff --git a/sound/usb/mixer_maps.c b/sound/usb/mixer_maps.c
+index 9a3e1076a5b1..c758638df9f7 100644
+--- a/sound/usb/mixer_maps.c
++++ b/sound/usb/mixer_maps.c
+@@ -351,6 +351,16 @@ static struct usbmix_name_map dragonfly_1_2_map[] = {
+ };
+
+ /*
++ * Dell usb dock with ALC4020 codec had a firmware problem where it got
++ * screwed up when zero volume is passed; just skip it as a workaround
++ */
++static const struct usbmix_name_map dell_alc4020_map[] = {
++ { 16, NULL },
++ { 19, NULL },
++ { 0 }
++};
++
++/*
+ * Control map entries
+ */
+
+@@ -433,6 +443,10 @@ static struct usbmix_ctl_map usbmix_ctl_maps[] = {
+ .map = aureon_51_2_map,
+ },
+ {
++ .id = USB_ID(0x0bda, 0x4014),
++ .map = dell_alc4020_map,
++ },
++ {
+ .id = USB_ID(0x13e5, 0x0001),
+ .map = scratch_live_map,
+ .ignore_ctl_error = 1,
+diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
+index 7da345b0cdaf..c7f5ff4d8f98 100644
+--- a/sound/usb/quirks.c
++++ b/sound/usb/quirks.c
+@@ -1118,8 +1118,12 @@ bool snd_usb_get_sample_rate_quirk(struct snd_usb_audio *chip)
+ case USB_ID(0x045E, 0x076F): /* MS Lifecam HD-6000 */
+ case USB_ID(0x045E, 0x0772): /* MS Lifecam Studio */
+ case USB_ID(0x045E, 0x0779): /* MS Lifecam HD-3000 */
++ case USB_ID(0x047F, 0x0415): /* Plantronics BT-300 */
+ case USB_ID(0x047F, 0xAA05): /* Plantronics DA45 */
+ case USB_ID(0x04D8, 0xFEEA): /* Benchmark DAC1 Pre */
++ case USB_ID(0x074D, 0x3553): /* Outlaw RR2150 (Micronas UAC3553B) */
++ case USB_ID(0x1de7, 0x0014): /* Phoenix Audio TMX320 */
++ case USB_ID(0x21B4, 0x0081): /* AudioQuest DragonFly */
+ return true;
+ }
+ return false;
diff --git a/1032_linux-3.18.33.patch b/1032_linux-3.18.33.patch
new file mode 100644
index 0000000..a91229b
--- /dev/null
+++ b/1032_linux-3.18.33.patch
@@ -0,0 +1,390 @@
+diff --git a/Makefile b/Makefile
+index 7a79cf89bf17..59d0737f9524 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 18
+-SUBLEVEL = 32
++SUBLEVEL = 33
+ EXTRAVERSION =
+ NAME = Diseased Newt
+
+diff --git a/arch/powerpc/include/uapi/asm/cputable.h b/arch/powerpc/include/uapi/asm/cputable.h
+index de2c0e4ee1aa..67de80a8e178 100644
+--- a/arch/powerpc/include/uapi/asm/cputable.h
++++ b/arch/powerpc/include/uapi/asm/cputable.h
+@@ -31,6 +31,7 @@
+ #define PPC_FEATURE_PSERIES_PERFMON_COMPAT \
+ 0x00000040
+
++/* Reserved - do not use 0x00000004 */
+ #define PPC_FEATURE_TRUE_LE 0x00000002
+ #define PPC_FEATURE_PPC_LE 0x00000001
+
+diff --git a/arch/powerpc/kernel/prom.c b/arch/powerpc/kernel/prom.c
+index 099f27e6d1b0..d2804fd65c4b 100644
+--- a/arch/powerpc/kernel/prom.c
++++ b/arch/powerpc/kernel/prom.c
+@@ -149,17 +149,24 @@ static struct ibm_pa_feature {
+ unsigned long cpu_features; /* CPU_FTR_xxx bit */
+ unsigned long mmu_features; /* MMU_FTR_xxx bit */
+ unsigned int cpu_user_ftrs; /* PPC_FEATURE_xxx bit */
++ unsigned int cpu_user_ftrs2; /* PPC_FEATURE2_xxx bit */
+ unsigned char pabyte; /* byte number in ibm,pa-features */
+ unsigned char pabit; /* bit number (big-endian) */
+ unsigned char invert; /* if 1, pa bit set => clear feature */
+ } ibm_pa_features[] __initdata = {
+- {0, 0, PPC_FEATURE_HAS_MMU, 0, 0, 0},
+- {0, 0, PPC_FEATURE_HAS_FPU, 0, 1, 0},
+- {CPU_FTR_CTRL, 0, 0, 0, 3, 0},
+- {CPU_FTR_NOEXECUTE, 0, 0, 0, 6, 0},
+- {CPU_FTR_NODSISRALIGN, 0, 0, 1, 1, 1},
+- {0, MMU_FTR_CI_LARGE_PAGE, 0, 1, 2, 0},
+- {CPU_FTR_REAL_LE, PPC_FEATURE_TRUE_LE, 5, 0, 0},
++ {0, 0, PPC_FEATURE_HAS_MMU, 0, 0, 0, 0},
++ {0, 0, PPC_FEATURE_HAS_FPU, 0, 0, 1, 0},
++ {CPU_FTR_CTRL, 0, 0, 0, 0, 3, 0},
++ {CPU_FTR_NOEXECUTE, 0, 0, 0, 0, 6, 0},
++ {CPU_FTR_NODSISRALIGN, 0, 0, 0, 1, 1, 1},
++ {0, MMU_FTR_CI_LARGE_PAGE, 0, 0, 1, 2, 0},
++ {CPU_FTR_REAL_LE, 0, PPC_FEATURE_TRUE_LE, 0, 5, 0, 0},
++ /*
++ * If the kernel doesn't support TM (ie. CONFIG_PPC_TRANSACTIONAL_MEM=n),
++ * we don't want to turn on CPU_FTR_TM here, so we use CPU_FTR_TM_COMP
++ * which is 0 if the kernel doesn't support TM.
++ */
++ {CPU_FTR_TM_COMP, 0, 0, 0, 22, 0, 0},
+ };
+
+ static void __init scan_features(unsigned long node, const unsigned char *ftrs,
+@@ -190,10 +197,12 @@ static void __init scan_features(unsigned long node, const unsigned char *ftrs,
+ if (bit ^ fp->invert) {
+ cur_cpu_spec->cpu_features |= fp->cpu_features;
+ cur_cpu_spec->cpu_user_features |= fp->cpu_user_ftrs;
++ cur_cpu_spec->cpu_user_features2 |= fp->cpu_user_ftrs2;
+ cur_cpu_spec->mmu_features |= fp->mmu_features;
+ } else {
+ cur_cpu_spec->cpu_features &= ~fp->cpu_features;
+ cur_cpu_spec->cpu_user_features &= ~fp->cpu_user_ftrs;
++ cur_cpu_spec->cpu_user_features2 &= ~fp->cpu_user_ftrs2;
+ cur_cpu_spec->mmu_features &= ~fp->mmu_features;
+ }
+ }
+diff --git a/arch/s390/include/asm/hugetlb.h b/arch/s390/include/asm/hugetlb.h
+index 11eae5f55b70..9787b61e0758 100644
+--- a/arch/s390/include/asm/hugetlb.h
++++ b/arch/s390/include/asm/hugetlb.h
+@@ -14,6 +14,7 @@
+
+ #define is_hugepage_only_range(mm, addr, len) 0
+ #define hugetlb_free_pgd_range free_pgd_range
++#define hugepages_supported() (MACHINE_HAS_HPAGE)
+
+ void set_huge_pte_at(struct mm_struct *mm, unsigned long addr,
+ pte_t *ptep, pte_t pte);
+diff --git a/arch/x86/crypto/sha-mb/sha1_mb.c b/arch/x86/crypto/sha-mb/sha1_mb.c
+index d42c9b7fadcf..418319b3763e 100644
+--- a/arch/x86/crypto/sha-mb/sha1_mb.c
++++ b/arch/x86/crypto/sha-mb/sha1_mb.c
+@@ -457,10 +457,10 @@ static int sha_complete_job(struct mcryptd_hash_request_ctx *rctx,
+
+ req = cast_mcryptd_ctx_to_req(req_ctx);
+ if (irqs_disabled())
+- rctx->complete(&req->base, ret);
++ req_ctx->complete(&req->base, ret);
+ else {
+ local_bh_disable();
+- rctx->complete(&req->base, ret);
++ req_ctx->complete(&req->base, ret);
+ local_bh_enable();
+ }
+ }
+diff --git a/arch/x86/include/asm/hugetlb.h b/arch/x86/include/asm/hugetlb.h
+index 68c05398bba9..7aadd3cea843 100644
+--- a/arch/x86/include/asm/hugetlb.h
++++ b/arch/x86/include/asm/hugetlb.h
+@@ -4,6 +4,7 @@
+ #include <asm/page.h>
+ #include <asm-generic/hugetlb.h>
+
++#define hugepages_supported() cpu_has_pse
+
+ static inline int is_hugepage_only_range(struct mm_struct *mm,
+ unsigned long addr,
+diff --git a/drivers/crypto/ccp/ccp-crypto-aes-cmac.c b/drivers/crypto/ccp/ccp-crypto-aes-cmac.c
+index 5c93afb1841a..f10b4998937d 100644
+--- a/drivers/crypto/ccp/ccp-crypto-aes-cmac.c
++++ b/drivers/crypto/ccp/ccp-crypto-aes-cmac.c
+@@ -206,6 +206,9 @@ static int ccp_aes_cmac_export(struct ahash_request *req, void *out)
+ struct ccp_aes_cmac_req_ctx *rctx = ahash_request_ctx(req);
+ struct ccp_aes_cmac_exp_ctx state;
+
++ /* Don't let anything leak to 'out' */
++ memset(&state, 0, sizeof(state));
++
+ state.null_msg = rctx->null_msg;
+ memcpy(state.iv, rctx->iv, sizeof(state.iv));
+ state.buf_count = rctx->buf_count;
+diff --git a/drivers/crypto/ccp/ccp-crypto-sha.c b/drivers/crypto/ccp/ccp-crypto-sha.c
+index b368e985a086..ced9f38a8978 100644
+--- a/drivers/crypto/ccp/ccp-crypto-sha.c
++++ b/drivers/crypto/ccp/ccp-crypto-sha.c
+@@ -198,6 +198,9 @@ static int ccp_sha_export(struct ahash_request *req, void *out)
+ struct ccp_sha_req_ctx *rctx = ahash_request_ctx(req);
+ struct ccp_sha_exp_ctx state;
+
++ /* Don't let anything leak to 'out' */
++ memset(&state, 0, sizeof(state));
++
+ state.type = rctx->type;
+ state.msg_bits = rctx->msg_bits;
+ state.first = rctx->first;
+diff --git a/drivers/edac/sb_edac.c b/drivers/edac/sb_edac.c
+index b97f5f0c5c0a..6251a0aeadcb 100644
+--- a/drivers/edac/sb_edac.c
++++ b/drivers/edac/sb_edac.c
+@@ -1264,7 +1264,7 @@ static int get_memory_error_data(struct mem_ctl_info *mci,
+ }
+
+ ch_way = TAD_CH(reg) + 1;
+- sck_way = 1 << TAD_SOCK(reg);
++ sck_way = TAD_SOCK(reg);
+
+ if (ch_way == 3)
+ idx = addr >> 6;
+@@ -1303,7 +1303,7 @@ static int get_memory_error_data(struct mem_ctl_info *mci,
+ switch(ch_way) {
+ case 2:
+ case 4:
+- sck_xch = 1 << sck_way * (ch_way >> 1);
++ sck_xch = (1 << sck_way) * (ch_way >> 1);
+ break;
+ default:
+ sprintf(msg, "Invalid mirror set. Can't decode addr");
+@@ -1339,7 +1339,7 @@ static int get_memory_error_data(struct mem_ctl_info *mci,
+
+ ch_addr = addr - offset;
+ ch_addr >>= (6 + shiftup);
+- ch_addr /= ch_way * sck_way;
++ ch_addr /= sck_xch;
+ ch_addr <<= (6 + shiftup);
+ ch_addr |= addr & ((1 << (6 + shiftup)) - 1);
+
+diff --git a/drivers/gpu/drm/radeon/radeon_atpx_handler.c b/drivers/gpu/drm/radeon/radeon_atpx_handler.c
+index 1523cf94bcdc..8bc7d0bbd3c8 100644
+--- a/drivers/gpu/drm/radeon/radeon_atpx_handler.c
++++ b/drivers/gpu/drm/radeon/radeon_atpx_handler.c
+@@ -62,10 +62,6 @@ bool radeon_has_atpx(void) {
+ return radeon_atpx_priv.atpx_detected;
+ }
+
+-bool radeon_has_atpx_dgpu_power_cntl(void) {
+- return radeon_atpx_priv.atpx.functions.power_cntl;
+-}
+-
+ /**
+ * radeon_atpx_call - call an ATPX method
+ *
+@@ -145,6 +141,10 @@ static void radeon_atpx_parse_functions(struct radeon_atpx_functions *f, u32 mas
+ */
+ static int radeon_atpx_validate(struct radeon_atpx *atpx)
+ {
++ /* make sure required functions are enabled */
++ /* dGPU power control is required */
++ atpx->functions.power_cntl = true;
++
+ if (atpx->functions.px_params) {
+ union acpi_object *info;
+ struct atpx_px_params output;
+diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
+index eb5f88aa76ab..5d54ab0fbe2b 100644
+--- a/drivers/gpu/drm/radeon/radeon_device.c
++++ b/drivers/gpu/drm/radeon/radeon_device.c
+@@ -103,12 +103,6 @@ static const char radeon_family_name[][16] = {
+ "LAST",
+ };
+
+-#if defined(CONFIG_VGA_SWITCHEROO)
+-bool radeon_has_atpx_dgpu_power_cntl(void);
+-#else
+-static inline bool radeon_has_atpx_dgpu_power_cntl(void) { return false; }
+-#endif
+-
+ #define RADEON_PX_QUIRK_DISABLE_PX (1 << 0)
+ #define RADEON_PX_QUIRK_LONG_WAKEUP (1 << 1)
+
+@@ -1401,7 +1395,7 @@ int radeon_device_init(struct radeon_device *rdev,
+ * ignore it */
+ vga_client_register(rdev->pdev, rdev, NULL, radeon_vga_set_decode);
+
+- if ((rdev->flags & RADEON_IS_PX) && radeon_has_atpx_dgpu_power_cntl())
++ if (rdev->flags & RADEON_IS_PX)
+ runtime = true;
+ vga_switcheroo_register_client(rdev->pdev, &radeon_switcheroo_ops, runtime);
+ if (runtime)
+diff --git a/drivers/gpu/drm/radeon/radeon_ttm.c b/drivers/gpu/drm/radeon/radeon_ttm.c
+index 33928b71445b..fdea9d07cca7 100644
+--- a/drivers/gpu/drm/radeon/radeon_ttm.c
++++ b/drivers/gpu/drm/radeon/radeon_ttm.c
+@@ -212,6 +212,8 @@ static int radeon_verify_access(struct ttm_buffer_object *bo, struct file *filp)
+ {
+ struct radeon_bo *rbo = container_of(bo, struct radeon_bo, tbo);
+
++ if (radeon_ttm_tt_has_userptr(bo->ttm))
++ return -EPERM;
+ return drm_vma_node_verify_access(&rbo->gem_base.vma_node, filp);
+ }
+
+diff --git a/drivers/gpu/drm/radeon/si_dpm.c b/drivers/gpu/drm/radeon/si_dpm.c
+index c6ad8a9f1452..481e718086fc 100644
+--- a/drivers/gpu/drm/radeon/si_dpm.c
++++ b/drivers/gpu/drm/radeon/si_dpm.c
+@@ -2923,6 +2923,10 @@ static struct si_dpm_quirk si_dpm_quirk_list[] = {
+ { PCI_VENDOR_ID_ATI, 0x6810, 0x1462, 0x3036, 0, 120000 },
+ { PCI_VENDOR_ID_ATI, 0x6811, 0x174b, 0xe271, 0, 120000 },
+ { PCI_VENDOR_ID_ATI, 0x6810, 0x174b, 0xe271, 85000, 90000 },
++ { PCI_VENDOR_ID_ATI, 0x6811, 0x1762, 0x2015, 0, 120000 },
++ { PCI_VENDOR_ID_ATI, 0x6811, 0x1043, 0x2015, 0, 120000 },
++ { PCI_VENDOR_ID_ATI, 0x6811, 0x148c, 0x2015, 0, 120000 },
++ { PCI_VENDOR_ID_ATI, 0x6810, 0x1682, 0x9275, 0, 120000 },
+ { 0, 0, 0, 0 },
+ };
+
+diff --git a/drivers/input/tablet/gtco.c b/drivers/input/tablet/gtco.c
+index 858045694e9d..a51de543a0b2 100644
+--- a/drivers/input/tablet/gtco.c
++++ b/drivers/input/tablet/gtco.c
+@@ -868,6 +868,14 @@ static int gtco_probe(struct usb_interface *usbinterface,
+ goto err_free_buf;
+ }
+
++ /* Sanity check that a device has an endpoint */
++ if (usbinterface->altsetting[0].desc.bNumEndpoints < 1) {
++ dev_err(&usbinterface->dev,
++ "Invalid number of endpoints\n");
++ error = -EINVAL;
++ goto err_free_urb;
++ }
++
+ /*
+ * The endpoint is always altsetting 0, we know this since we know
+ * this device only has one interrupt endpoint
+@@ -889,7 +897,7 @@ static int gtco_probe(struct usb_interface *usbinterface,
+ * HID report descriptor
+ */
+ if (usb_get_extra_descriptor(usbinterface->cur_altsetting,
+- HID_DEVICE_TYPE, &hid_desc) != 0){
++ HID_DEVICE_TYPE, &hid_desc) != 0) {
+ dev_err(&usbinterface->dev,
+ "Can't retrieve exta USB descriptor to get hid report descriptor length\n");
+ error = -EIO;
+diff --git a/include/drm/drm_cache.h b/include/drm/drm_cache.h
+index 461a0558bca4..cebecff536a3 100644
+--- a/include/drm/drm_cache.h
++++ b/include/drm/drm_cache.h
+@@ -39,6 +39,8 @@ static inline bool drm_arch_can_wc_memory(void)
+ {
+ #if defined(CONFIG_PPC) && !defined(CONFIG_NOT_COHERENT_CACHE)
+ return false;
++#elif defined(CONFIG_MIPS) && defined(CONFIG_CPU_LOONGSON3)
++ return false;
+ #else
+ return true;
+ #endif
+diff --git a/include/linux/hugetlb.h b/include/linux/hugetlb.h
+index 14020c7796af..e6192934cdfa 100644
+--- a/include/linux/hugetlb.h
++++ b/include/linux/hugetlb.h
+@@ -415,15 +415,14 @@ static inline spinlock_t *huge_pte_lockptr(struct hstate *h,
+ return &mm->page_table_lock;
+ }
+
+-static inline bool hugepages_supported(void)
+-{
+- /*
+- * Some platform decide whether they support huge pages at boot
+- * time. On these, such as powerpc, HPAGE_SHIFT is set to 0 when
+- * there is no such support
+- */
+- return HPAGE_SHIFT != 0;
+-}
++#ifndef hugepages_supported
++/*
++ * Some platform decide whether they support huge pages at boot
++ * time. Some of them, such as powerpc, set HPAGE_SHIFT to 0
++ * when there is no such support
++ */
++#define hugepages_supported() (HPAGE_SHIFT != 0)
++#endif
+
+ #else /* CONFIG_HUGETLB_PAGE */
+ struct hstate {};
+diff --git a/kernel/futex.c b/kernel/futex.c
+index d9d63806f55f..d58859d62b8b 100644
+--- a/kernel/futex.c
++++ b/kernel/futex.c
+@@ -1157,10 +1157,20 @@ static int wake_futex_pi(u32 __user *uaddr, u32 uval, struct futex_q *this)
+ */
+ newval = FUTEX_WAITERS | task_pid_vnr(new_owner);
+
+- if (cmpxchg_futex_value_locked(&curval, uaddr, uval, newval))
++ if (cmpxchg_futex_value_locked(&curval, uaddr, uval, newval)) {
+ ret = -EFAULT;
+- else if (curval != uval)
+- ret = -EINVAL;
++ } else if (curval != uval) {
++ /*
++ * If a unconditional UNLOCK_PI operation (user space did not
++ * try the TID->0 transition) raced with a waiter setting the
++ * FUTEX_WAITERS flag between get_user() and locking the hash
++ * bucket lock, retry the operation.
++ */
++ if ((FUTEX_TID_MASK & curval) == uval)
++ ret = -EAGAIN;
++ else
++ ret = -EINVAL;
++ }
+ if (ret) {
+ raw_spin_unlock(&pi_state->pi_mutex.wait_lock);
+ return ret;
+@@ -2419,6 +2429,15 @@ retry:
+ */
+ if (ret == -EFAULT)
+ goto pi_faulted;
++ /*
++ * A unconditional UNLOCK_PI op raced against a waiter
++ * setting the FUTEX_WAITERS bit. Try again.
++ */
++ if (ret == -EAGAIN) {
++ spin_unlock(&hb->lock);
++ put_futex_key(&key);
++ goto retry;
++ }
+ goto out_unlock;
+ }
+
+diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
+index 5fed79cfe45a..0286733f2e8c 100644
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -11951,7 +11951,7 @@ static int nl80211_netlink_notify(struct notifier_block * nb,
+ struct wireless_dev *wdev;
+ struct cfg80211_beacon_registration *reg, *tmp;
+
+- if (state != NETLINK_URELEASE)
++ if (state != NETLINK_URELEASE || notify->protocol != NETLINK_GENERIC)
+ return NOTIFY_DONE;
+
+ rcu_read_lock();
+diff --git a/sound/pci/pcxhr/pcxhr_core.c b/sound/pci/pcxhr/pcxhr_core.c
+index a584acb61c00..874591e18b3e 100644
+--- a/sound/pci/pcxhr/pcxhr_core.c
++++ b/sound/pci/pcxhr/pcxhr_core.c
+@@ -1339,5 +1339,6 @@ irqreturn_t pcxhr_threaded_irq(int irq, void *dev_id)
+ }
+
+ pcxhr_msg_thread(mgr);
++ mutex_unlock(&mgr->lock);
+ return IRQ_HANDLED;
+ }
^ permalink raw reply related [flat|nested] 67+ messages in thread
* [gentoo-commits] proj/linux-patches:3.18 commit in: /
@ 2016-05-24 12:03 Mike Pagano
0 siblings, 0 replies; 67+ messages in thread
From: Mike Pagano @ 2016-05-24 12:03 UTC (permalink / raw
To: gentoo-commits
commit: 35a866a10473dea83b293537d3682b15140b8dbc
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Tue May 24 12:03:17 2016 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Tue May 24 12:03:17 2016 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=35a866a1
Linux patch 3.18.34
0000_README | 4 +
1033_linux-3.18.34.patch | 2143 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 2147 insertions(+)
diff --git a/0000_README b/0000_README
index e4866a4..a6bf155 100644
--- a/0000_README
+++ b/0000_README
@@ -175,6 +175,10 @@ Patch: 1032_linux-3.18.33.patch
From: http://www.kernel.org
Desc: Linux 3.18.33
+Patch: 1033_linux-3.18.34.patch
+From: http://www.kernel.org
+Desc: Linux 3.18.34
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1033_linux-3.18.34.patch b/1033_linux-3.18.34.patch
new file mode 100644
index 0000000..2998f69
--- /dev/null
+++ b/1033_linux-3.18.34.patch
@@ -0,0 +1,2143 @@
+diff --git a/Documentation/devicetree/bindings/ata/ahci-platform.txt b/Documentation/devicetree/bindings/ata/ahci-platform.txt
+index 4ab09f2202d4..e6d5a4aa953f 100644
+--- a/Documentation/devicetree/bindings/ata/ahci-platform.txt
++++ b/Documentation/devicetree/bindings/ata/ahci-platform.txt
+@@ -30,6 +30,10 @@ Optional properties:
+ - target-supply : regulator for SATA target power
+ - phys : reference to the SATA PHY node
+ - phy-names : must be "sata-phy"
++- ports-implemented : Mask that indicates which ports that the HBA supports
++ are available for software to use. Useful if PORTS_IMPL
++ is not programmed by the BIOS, which is true with
++ some embedded SOC's.
+
+ Required properties when using sub-nodes:
+ - #address-cells : number of cells to encode an address
+diff --git a/MAINTAINERS b/MAINTAINERS
+index 090eaae42181..f553cf7abe6a 100644
+--- a/MAINTAINERS
++++ b/MAINTAINERS
+@@ -3558,8 +3558,8 @@ F: Documentation/efi-stub.txt
+ F: arch/ia64/kernel/efi.c
+ F: arch/x86/boot/compressed/eboot.[ch]
+ F: arch/x86/include/asm/efi.h
+-F: arch/x86/platform/efi/*
+-F: drivers/firmware/efi/*
++F: arch/x86/platform/efi/
++F: drivers/firmware/efi/
+ F: include/linux/efi*.h
+
+ EFI VARIABLE FILESYSTEM
+diff --git a/Makefile b/Makefile
+index 59d0737f9524..0df57f0a9e11 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 18
+-SUBLEVEL = 33
++SUBLEVEL = 34
+ EXTRAVERSION =
+ NAME = Diseased Newt
+
+diff --git a/arch/arm/mach-socfpga/headsmp.S b/arch/arm/mach-socfpga/headsmp.S
+index f65ea0af4af3..a2b1c4a3afd8 100644
+--- a/arch/arm/mach-socfpga/headsmp.S
++++ b/arch/arm/mach-socfpga/headsmp.S
+@@ -12,6 +12,7 @@
+ #include <asm/memory.h>
+
+ .arch armv7-a
++ .arm
+
+ ENTRY(secondary_trampoline)
+ /* CPU1 will always fetch from 0x0 when it is brought out of reset.
+diff --git a/arch/parisc/kernel/ptrace.c b/arch/parisc/kernel/ptrace.c
+index 9585c81f755f..ce0b2b4075c7 100644
+--- a/arch/parisc/kernel/ptrace.c
++++ b/arch/parisc/kernel/ptrace.c
+@@ -269,14 +269,19 @@ long compat_arch_ptrace(struct task_struct *child, compat_long_t request,
+
+ long do_syscall_trace_enter(struct pt_regs *regs)
+ {
+- long ret = 0;
+-
+ /* Do the secure computing check first. */
+ secure_computing_strict(regs->gr[20]);
+
+ if (test_thread_flag(TIF_SYSCALL_TRACE) &&
+- tracehook_report_syscall_entry(regs))
+- ret = -1L;
++ tracehook_report_syscall_entry(regs)) {
++ /*
++ * Tracing decided this syscall should not happen or the
++ * debugger stored an invalid system call number. Skip
++ * the system call and the system call restart handling.
++ */
++ regs->gr[20] = -1UL;
++ goto out;
++ }
+
+ #ifdef CONFIG_64BIT
+ if (!is_compat_task())
+@@ -290,7 +295,8 @@ long do_syscall_trace_enter(struct pt_regs *regs)
+ regs->gr[24] & 0xffffffff,
+ regs->gr[23] & 0xffffffff);
+
+- return ret ? : regs->gr[20];
++out:
++ return regs->gr[20];
+ }
+
+ void do_syscall_trace_exit(struct pt_regs *regs)
+diff --git a/arch/parisc/kernel/syscall.S b/arch/parisc/kernel/syscall.S
+index 0b8d26d3ba43..099c23616901 100644
+--- a/arch/parisc/kernel/syscall.S
++++ b/arch/parisc/kernel/syscall.S
+@@ -342,8 +342,8 @@ tracesys_next:
+ stw %r21, -56(%r30) /* 6th argument */
+ #endif
+
+- comiclr,>>= __NR_Linux_syscalls, %r20, %r0
+- b,n .Lsyscall_nosys
++ comiclr,>> __NR_Linux_syscalls, %r20, %r0
++ b,n .Ltracesys_nosys
+
+ LDREGX %r20(%r19), %r19
+
+@@ -359,6 +359,9 @@ tracesys_next:
+ be 0(%sr7,%r19)
+ ldo R%tracesys_exit(%r2),%r2
+
++.Ltracesys_nosys:
++ ldo -ENOSYS(%r0),%r28 /* set errno */
++
+ /* Do *not* call this function on the gateway page, because it
+ makes a direct call to syscall_trace. */
+
+diff --git a/arch/powerpc/include/asm/word-at-a-time.h b/arch/powerpc/include/asm/word-at-a-time.h
+index 5b3a903adae6..7043539e0248 100644
+--- a/arch/powerpc/include/asm/word-at-a-time.h
++++ b/arch/powerpc/include/asm/word-at-a-time.h
+@@ -77,7 +77,7 @@ static inline unsigned long create_zero_mask(unsigned long bits)
+ "andc %1,%1,%2\n\t"
+ "popcntd %0,%1"
+ : "=r" (leading_zero_bits), "=&r" (trailing_zero_bit_mask)
+- : "r" (bits));
++ : "b" (bits));
+
+ return leading_zero_bits;
+ }
+diff --git a/arch/x86/kernel/sysfb_efi.c b/arch/x86/kernel/sysfb_efi.c
+index b285d4e8c68e..5da924bbf0a0 100644
+--- a/arch/x86/kernel/sysfb_efi.c
++++ b/arch/x86/kernel/sysfb_efi.c
+@@ -106,14 +106,24 @@ static int __init efifb_set_system(const struct dmi_system_id *id)
+ continue;
+ for (i = 0; i < DEVICE_COUNT_RESOURCE; i++) {
+ resource_size_t start, end;
++ unsigned long flags;
++
++ flags = pci_resource_flags(dev, i);
++ if (!(flags & IORESOURCE_MEM))
++ continue;
++
++ if (flags & IORESOURCE_UNSET)
++ continue;
++
++ if (pci_resource_len(dev, i) == 0)
++ continue;
+
+ start = pci_resource_start(dev, i);
+- if (start == 0)
+- break;
+ end = pci_resource_end(dev, i);
+ if (screen_info.lfb_base >= start &&
+ screen_info.lfb_base < end) {
+ found_bar = 1;
++ break;
+ }
+ }
+ }
+diff --git a/arch/x86/kernel/tsc_msr.c b/arch/x86/kernel/tsc_msr.c
+index 92ae6acac8a7..6aa0f4d9eea6 100644
+--- a/arch/x86/kernel/tsc_msr.c
++++ b/arch/x86/kernel/tsc_msr.c
+@@ -92,7 +92,7 @@ unsigned long try_msr_calibrate_tsc(void)
+
+ if (freq_desc_tables[cpu_index].msr_plat) {
+ rdmsr(MSR_PLATFORM_INFO, lo, hi);
+- ratio = (lo >> 8) & 0x1f;
++ ratio = (lo >> 8) & 0xff;
+ } else {
+ rdmsr(MSR_IA32_PERF_STATUS, lo, hi);
+ ratio = (hi >> 8) & 0x1f;
+diff --git a/crypto/ahash.c b/crypto/ahash.c
+index 51d48cd34884..46ab9099c330 100644
+--- a/crypto/ahash.c
++++ b/crypto/ahash.c
+@@ -68,8 +68,9 @@ static int hash_walk_new_entry(struct crypto_hash_walk *walk)
+ struct scatterlist *sg;
+
+ sg = walk->sg;
+- walk->pg = sg_page(sg);
+ walk->offset = sg->offset;
++ walk->pg = sg_page(walk->sg) + (walk->offset >> PAGE_SHIFT);
++ walk->offset = offset_in_page(walk->offset);
+ walk->entrylen = sg->length;
+
+ if (walk->entrylen > walk->total)
+diff --git a/drivers/acpi/acpica/dsmethod.c b/drivers/acpi/acpica/dsmethod.c
+index 3c7f7378b94d..86ddd0b3a7bf 100644
+--- a/drivers/acpi/acpica/dsmethod.c
++++ b/drivers/acpi/acpica/dsmethod.c
+@@ -412,6 +412,9 @@ acpi_ds_begin_method_execution(struct acpi_namespace_node *method_node,
+ obj_desc->method.mutex->mutex.
+ original_sync_level =
+ obj_desc->method.mutex->mutex.sync_level;
++
++ obj_desc->method.mutex->mutex.thread_id =
++ acpi_os_get_thread_id();
+ }
+ }
+
+diff --git a/drivers/ata/ahci_platform.c b/drivers/ata/ahci_platform.c
+index 06f1d59fa678..83c2b8be99b8 100644
+--- a/drivers/ata/ahci_platform.c
++++ b/drivers/ata/ahci_platform.c
+@@ -43,6 +43,9 @@ static int ahci_probe(struct platform_device *pdev)
+ if (rc)
+ return rc;
+
++ of_property_read_u32(dev->of_node,
++ "ports-implemented", &hpriv->force_port_map);
++
+ if (of_device_is_compatible(dev->of_node, "hisilicon,hisi-ahci"))
+ hpriv->flags |= AHCI_HFLAG_NO_FBS | AHCI_HFLAG_NO_NCQ;
+
+diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c
+index a1d1c0e16697..794448ce2fc0 100644
+--- a/drivers/ata/libahci.c
++++ b/drivers/ata/libahci.c
+@@ -467,6 +467,7 @@ void ahci_save_initial_config(struct device *dev, struct ahci_host_priv *hpriv)
+ dev_info(dev, "forcing port_map 0x%x -> 0x%x\n",
+ port_map, hpriv->force_port_map);
+ port_map = hpriv->force_port_map;
++ hpriv->saved_port_map = port_map;
+ }
+
+ if (hpriv->mask_port_map) {
+diff --git a/drivers/base/regmap/regmap-spmi.c b/drivers/base/regmap/regmap-spmi.c
+index d7026dc33388..b394aaef3867 100644
+--- a/drivers/base/regmap/regmap-spmi.c
++++ b/drivers/base/regmap/regmap-spmi.c
+@@ -153,7 +153,7 @@ static int regmap_spmi_ext_read(void *context,
+ while (val_size) {
+ len = min_t(size_t, val_size, 8);
+
+- err = spmi_ext_register_readl(context, addr, val, val_size);
++ err = spmi_ext_register_readl(context, addr, val, len);
+ if (err)
+ goto err_out;
+
+diff --git a/drivers/edac/i7core_edac.c b/drivers/edac/i7core_edac.c
+index 9cd0b301f81b..f84ef75b6487 100644
+--- a/drivers/edac/i7core_edac.c
++++ b/drivers/edac/i7core_edac.c
+@@ -1874,7 +1874,7 @@ static int i7core_mce_check_error(struct notifier_block *nb, unsigned long val,
+
+ i7_dev = get_i7core_dev(mce->socketid);
+ if (!i7_dev)
+- return NOTIFY_BAD;
++ return NOTIFY_DONE;
+
+ mci = i7_dev->mci;
+ pvt = mci->pvt_info;
+diff --git a/drivers/edac/sb_edac.c b/drivers/edac/sb_edac.c
+index 6251a0aeadcb..6aa25a3aa2c7 100644
+--- a/drivers/edac/sb_edac.c
++++ b/drivers/edac/sb_edac.c
+@@ -2047,7 +2047,7 @@ static int sbridge_mce_check_error(struct notifier_block *nb, unsigned long val,
+
+ mci = get_mci_for_node_id(mce->socketid);
+ if (!mci)
+- return NOTIFY_BAD;
++ return NOTIFY_DONE;
+ pvt = mci->pvt_info;
+
+ /*
+diff --git a/drivers/firmware/efi/vars.c b/drivers/firmware/efi/vars.c
+index 7f2ea21c730d..6f182fd91a6d 100644
+--- a/drivers/firmware/efi/vars.c
++++ b/drivers/firmware/efi/vars.c
+@@ -202,29 +202,44 @@ static const struct variable_validate variable_validate[] = {
+ { NULL_GUID, "", NULL },
+ };
+
++/*
++ * Check if @var_name matches the pattern given in @match_name.
++ *
++ * @var_name: an array of @len non-NUL characters.
++ * @match_name: a NUL-terminated pattern string, optionally ending in "*". A
++ * final "*" character matches any trailing characters @var_name,
++ * including the case when there are none left in @var_name.
++ * @match: on output, the number of non-wildcard characters in @match_name
++ * that @var_name matches, regardless of the return value.
++ * @return: whether @var_name fully matches @match_name.
++ */
+ static bool
+ variable_matches(const char *var_name, size_t len, const char *match_name,
+ int *match)
+ {
+ for (*match = 0; ; (*match)++) {
+ char c = match_name[*match];
+- char u = var_name[*match];
+
+- /* Wildcard in the matching name means we've matched */
+- if (c == '*')
++ switch (c) {
++ case '*':
++ /* Wildcard in @match_name means we've matched. */
+ return true;
+
+- /* Case sensitive match */
+- if (!c && *match == len)
+- return true;
++ case '\0':
++ /* @match_name has ended. Has @var_name too? */
++ return (*match == len);
+
+- if (c != u)
++ default:
++ /*
++ * We've reached a non-wildcard char in @match_name.
++ * Continue only if there's an identical character in
++ * @var_name.
++ */
++ if (*match < len && c == var_name[*match])
++ continue;
+ return false;
+-
+- if (!c)
+- return true;
++ }
+ }
+- return true;
+ }
+
+ bool
+diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c
+index 563d3d2c54a9..c4f8e8f172cd 100644
+--- a/drivers/gpu/drm/drm_dp_mst_topology.c
++++ b/drivers/gpu/drm/drm_dp_mst_topology.c
+@@ -1694,6 +1694,11 @@ int drm_dp_update_payload_part1(struct drm_dp_mst_topology_mgr *mgr)
+ req_payload.start_slot = cur_slots;
+ if (mgr->proposed_vcpis[i]) {
+ port = container_of(mgr->proposed_vcpis[i], struct drm_dp_mst_port, vcpi);
++ port = drm_dp_get_validated_port_ref(mgr, port);
++ if (!port) {
++ mutex_unlock(&mgr->payload_lock);
++ return -EINVAL;
++ }
+ req_payload.num_slots = mgr->proposed_vcpis[i]->num_slots;
+ } else {
+ port = NULL;
+@@ -1719,6 +1724,9 @@ int drm_dp_update_payload_part1(struct drm_dp_mst_topology_mgr *mgr)
+ mgr->payloads[i].payload_state = req_payload.payload_state;
+ }
+ cur_slots += req_payload.num_slots;
++
++ if (port)
++ drm_dp_put_port(port);
+ }
+
+ for (i = 0; i < mgr->max_payloads; i++) {
+@@ -2005,6 +2013,8 @@ int drm_dp_mst_topology_mgr_resume(struct drm_dp_mst_topology_mgr *mgr)
+
+ if (mgr->mst_primary) {
+ int sret;
++ u8 guid[16];
++
+ sret = drm_dp_dpcd_read(mgr->aux, DP_DPCD_REV, mgr->dpcd, DP_RECEIVER_CAP_SIZE);
+ if (sret != DP_RECEIVER_CAP_SIZE) {
+ DRM_DEBUG_KMS("dpcd read failed - undocked during suspend?\n");
+@@ -2019,6 +2029,16 @@ int drm_dp_mst_topology_mgr_resume(struct drm_dp_mst_topology_mgr *mgr)
+ ret = -1;
+ goto out_unlock;
+ }
++
++ /* Some hubs forget their guids after they resume */
++ sret = drm_dp_dpcd_read(mgr->aux, DP_GUID, guid, 16);
++ if (sret != 16) {
++ DRM_DEBUG_KMS("dpcd read failed - undocked during suspend?\n");
++ ret = -1;
++ goto out_unlock;
++ }
++ drm_dp_check_mstb_guid(mgr->mst_primary, guid);
++
+ ret = 0;
+ } else
+ ret = -1;
+diff --git a/drivers/gpu/drm/i915/intel_crt.c b/drivers/gpu/drm/i915/intel_crt.c
+index 9212e6504e0f..f0e8e2a2c547 100644
+--- a/drivers/gpu/drm/i915/intel_crt.c
++++ b/drivers/gpu/drm/i915/intel_crt.c
+@@ -311,8 +311,14 @@ static bool intel_crt_compute_config(struct intel_encoder *encoder,
+ pipe_config->has_pch_encoder = true;
+
+ /* LPT FDI RX only supports 8bpc. */
+- if (HAS_PCH_LPT(dev))
++ if (HAS_PCH_LPT(dev)) {
++ if (pipe_config->bw_constrained && pipe_config->pipe_bpp < 24) {
++ DRM_DEBUG_KMS("LPT only supports 24bpp\n");
++ return false;
++ }
++
+ pipe_config->pipe_bpp = 24;
++ }
+
+ /* FDI must always be 2.7 GHz */
+ if (HAS_DDI(dev)) {
+diff --git a/drivers/gpu/drm/i915/intel_ddi.c b/drivers/gpu/drm/i915/intel_ddi.c
+index b63d4fa204a3..4b476aa4ab05 100644
+--- a/drivers/gpu/drm/i915/intel_ddi.c
++++ b/drivers/gpu/drm/i915/intel_ddi.c
+@@ -1515,12 +1515,6 @@ void intel_ddi_get_config(struct intel_encoder *encoder,
+ hsw_ddi_clock_get(encoder, pipe_config);
+ }
+
+-static void intel_ddi_destroy(struct drm_encoder *encoder)
+-{
+- /* HDMI has nothing special to destroy, so we can go with this. */
+- intel_dp_encoder_destroy(encoder);
+-}
+-
+ static bool intel_ddi_compute_config(struct intel_encoder *encoder,
+ struct intel_crtc_config *pipe_config)
+ {
+@@ -1539,7 +1533,8 @@ static bool intel_ddi_compute_config(struct intel_encoder *encoder,
+ }
+
+ static const struct drm_encoder_funcs intel_ddi_funcs = {
+- .destroy = intel_ddi_destroy,
++ .reset = intel_dp_encoder_reset,
++ .destroy = intel_dp_encoder_destroy,
+ };
+
+ static struct intel_connector *
+@@ -1612,6 +1607,7 @@ void intel_ddi_init(struct drm_device *dev, enum port port)
+ intel_encoder->post_disable = intel_ddi_post_disable;
+ intel_encoder->get_hw_state = intel_ddi_get_hw_state;
+ intel_encoder->get_config = intel_ddi_get_config;
++ intel_encoder->suspend = intel_dp_encoder_suspend;
+
+ intel_dig_port->port = port;
+ intel_dig_port->saved_port_bits = I915_READ(DDI_BUF_CTL(port)) &
+diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
+index 3104d06aa20c..a915d729c33d 100644
+--- a/drivers/gpu/drm/i915/intel_dp.c
++++ b/drivers/gpu/drm/i915/intel_dp.c
+@@ -4423,7 +4423,7 @@ void intel_dp_encoder_destroy(struct drm_encoder *encoder)
+ kfree(intel_dig_port);
+ }
+
+-static void intel_dp_encoder_suspend(struct intel_encoder *intel_encoder)
++void intel_dp_encoder_suspend(struct intel_encoder *intel_encoder)
+ {
+ struct intel_dp *intel_dp = enc_to_intel_dp(&intel_encoder->base);
+
+@@ -4440,9 +4440,52 @@ static void intel_dp_encoder_suspend(struct intel_encoder *intel_encoder)
+ pps_unlock(intel_dp);
+ }
+
+-static void intel_dp_encoder_reset(struct drm_encoder *encoder)
++static void intel_edp_panel_vdd_sanitize(struct intel_dp *intel_dp)
+ {
+- intel_edp_panel_vdd_sanitize(to_intel_encoder(encoder));
++ struct intel_digital_port *intel_dig_port = dp_to_dig_port(intel_dp);
++ struct drm_device *dev = intel_dig_port->base.base.dev;
++ struct drm_i915_private *dev_priv = dev->dev_private;
++ enum intel_display_power_domain power_domain;
++
++ lockdep_assert_held(&dev_priv->pps_mutex);
++
++ if (!edp_have_panel_vdd(intel_dp))
++ return;
++
++ /*
++ * The VDD bit needs a power domain reference, so if the bit is
++ * already enabled when we boot or resume, grab this reference and
++ * schedule a vdd off, so we don't hold on to the reference
++ * indefinitely.
++ */
++ DRM_DEBUG_KMS("VDD left on by BIOS, adjusting state tracking\n");
++ power_domain = intel_display_port_power_domain(&intel_dig_port->base);
++ intel_display_power_get(dev_priv, power_domain);
++
++ edp_panel_vdd_schedule_off(intel_dp);
++}
++
++void intel_dp_encoder_reset(struct drm_encoder *encoder)
++{
++ struct intel_dp *intel_dp;
++
++ if (to_intel_encoder(encoder)->type != INTEL_OUTPUT_EDP)
++ return;
++
++ intel_dp = enc_to_intel_dp(encoder);
++
++ pps_lock(intel_dp);
++
++ /*
++ * Read out the current power sequencer assignment,
++ * in case the BIOS did something with it.
++ */
++ if (IS_VALLEYVIEW(encoder->dev))
++ vlv_initial_power_sequencer_setup(intel_dp);
++
++ intel_edp_panel_vdd_sanitize(intel_dp);
++
++ pps_unlock(intel_dp);
+ }
+
+ static const struct drm_connector_funcs intel_dp_connector_funcs = {
+@@ -4924,37 +4967,6 @@ intel_dp_drrs_init(struct intel_digital_port *intel_dig_port,
+ return downclock_mode;
+ }
+
+-void intel_edp_panel_vdd_sanitize(struct intel_encoder *intel_encoder)
+-{
+- struct drm_device *dev = intel_encoder->base.dev;
+- struct drm_i915_private *dev_priv = dev->dev_private;
+- struct intel_dp *intel_dp;
+- enum intel_display_power_domain power_domain;
+-
+- if (intel_encoder->type != INTEL_OUTPUT_EDP)
+- return;
+-
+- intel_dp = enc_to_intel_dp(&intel_encoder->base);
+-
+- pps_lock(intel_dp);
+-
+- if (!edp_have_panel_vdd(intel_dp))
+- goto out;
+- /*
+- * The VDD bit needs a power domain reference, so if the bit is
+- * already enabled when we boot or resume, grab this reference and
+- * schedule a vdd off, so we don't hold on to the reference
+- * indefinitely.
+- */
+- DRM_DEBUG_KMS("VDD left on by BIOS, adjusting state tracking\n");
+- power_domain = intel_display_port_power_domain(intel_encoder);
+- intel_display_power_get(dev_priv, power_domain);
+-
+- edp_panel_vdd_schedule_off(intel_dp);
+- out:
+- pps_unlock(intel_dp);
+-}
+-
+ static bool intel_edp_init_connector(struct intel_dp *intel_dp,
+ struct intel_connector *intel_connector,
+ struct edp_power_seq *power_seq)
+@@ -4975,7 +4987,9 @@ static bool intel_edp_init_connector(struct intel_dp *intel_dp,
+ if (!is_edp(intel_dp))
+ return true;
+
+- intel_edp_panel_vdd_sanitize(intel_encoder);
++ pps_lock(intel_dp);
++ intel_edp_panel_vdd_sanitize(intel_dp);
++ pps_unlock(intel_dp);
+
+ /* Cache DPCD and EDID for edp. */
+ intel_edp_panel_vdd_on(intel_dp);
+diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h
+index ba715229a540..87743dd1df48 100644
+--- a/drivers/gpu/drm/i915/intel_drv.h
++++ b/drivers/gpu/drm/i915/intel_drv.h
+@@ -925,6 +925,8 @@ void intel_dp_start_link_train(struct intel_dp *intel_dp);
+ void intel_dp_complete_link_train(struct intel_dp *intel_dp);
+ void intel_dp_stop_link_train(struct intel_dp *intel_dp);
+ void intel_dp_sink_dpms(struct intel_dp *intel_dp, int mode);
++void intel_dp_encoder_reset(struct drm_encoder *encoder);
++void intel_dp_encoder_suspend(struct intel_encoder *intel_encoder);
+ void intel_dp_encoder_destroy(struct drm_encoder *encoder);
+ void intel_dp_check_link_status(struct intel_dp *intel_dp);
+ int intel_dp_sink_crc(struct intel_dp *intel_dp, u8 *crc);
+@@ -936,7 +938,6 @@ bool intel_dp_hpd_pulse(struct intel_digital_port *intel_dig_port,
+ void intel_edp_backlight_on(struct intel_dp *intel_dp);
+ void intel_edp_backlight_off(struct intel_dp *intel_dp);
+ void intel_edp_panel_vdd_on(struct intel_dp *intel_dp);
+-void intel_edp_panel_vdd_sanitize(struct intel_encoder *intel_encoder);
+ void intel_edp_panel_on(struct intel_dp *intel_dp);
+ void intel_edp_panel_off(struct intel_dp *intel_dp);
+ void intel_edp_psr_enable(struct intel_dp *intel_dp);
+diff --git a/drivers/gpu/drm/radeon/atombios_encoders.c b/drivers/gpu/drm/radeon/atombios_encoders.c
+index 01701105653d..07dd3523425a 100644
+--- a/drivers/gpu/drm/radeon/atombios_encoders.c
++++ b/drivers/gpu/drm/radeon/atombios_encoders.c
+@@ -308,6 +308,10 @@ static bool radeon_atom_mode_fixup(struct drm_encoder *encoder,
+ && (mode->crtc_vsync_start < (mode->crtc_vdisplay + 2)))
+ adjusted_mode->crtc_vsync_start = adjusted_mode->crtc_vdisplay + 2;
+
++ /* vertical FP must be at least 1 */
++ if (mode->crtc_vsync_start == mode->crtc_vdisplay)
++ adjusted_mode->crtc_vsync_start++;
++
+ /* get the native mode for scaling */
+ if (radeon_encoder->active_device & (ATOM_DEVICE_LCD_SUPPORT)) {
+ radeon_panel_mode_fixup(encoder, adjusted_mode);
+diff --git a/drivers/hv/ring_buffer.c b/drivers/hv/ring_buffer.c
+index 6361d124f67d..14d45c70056e 100644
+--- a/drivers/hv/ring_buffer.c
++++ b/drivers/hv/ring_buffer.c
+@@ -103,19 +103,30 @@ static bool hv_need_to_signal(u32 old_write, struct hv_ring_buffer_info *rbi)
+ * there is room for the producer to send the pending packet.
+ */
+
+-static bool hv_need_to_signal_on_read(u32 old_rd,
+- struct hv_ring_buffer_info *rbi)
++static bool hv_need_to_signal_on_read(struct hv_ring_buffer_info *rbi)
+ {
+- u32 prev_write_sz;
+ u32 cur_write_sz;
+ u32 r_size;
+- u32 write_loc = rbi->ring_buffer->write_index;
++ u32 write_loc;
+ u32 read_loc = rbi->ring_buffer->read_index;
+- u32 pending_sz = rbi->ring_buffer->pending_send_sz;
++ u32 pending_sz;
+
+ /*
+- * If the other end is not blocked on write don't bother.
++ * Issue a full memory barrier before making the signaling decision.
++ * Here is the reason for having this barrier:
++ * If the reading of the pend_sz (in this function)
++ * were to be reordered and read before we commit the new read
++ * index (in the calling function) we could
++ * have a problem. If the host were to set the pending_sz after we
++ * have sampled pending_sz and go to sleep before we commit the
++ * read index, we could miss sending the interrupt. Issue a full
++ * memory barrier to address this.
+ */
++ mb();
++
++ pending_sz = rbi->ring_buffer->pending_send_sz;
++ write_loc = rbi->ring_buffer->write_index;
++ /* If the other end is not blocked on write don't bother. */
+ if (pending_sz == 0)
+ return false;
+
+@@ -123,22 +134,13 @@ static bool hv_need_to_signal_on_read(u32 old_rd,
+ cur_write_sz = write_loc >= read_loc ? r_size - (write_loc - read_loc) :
+ read_loc - write_loc;
+
+- prev_write_sz = write_loc >= old_rd ? r_size - (write_loc - old_rd) :
+- old_rd - write_loc;
+-
+-
+- if ((prev_write_sz < pending_sz) && (cur_write_sz >= pending_sz))
++ if (cur_write_sz >= pending_sz)
+ return true;
+
+ return false;
+ }
+
+-/*
+- * hv_get_next_write_location()
+- *
+- * Get the next write location for the specified ring buffer
+- *
+- */
++/* Get the next write location for the specified ring buffer. */
+ static inline u32
+ hv_get_next_write_location(struct hv_ring_buffer_info *ring_info)
+ {
+@@ -147,12 +149,7 @@ hv_get_next_write_location(struct hv_ring_buffer_info *ring_info)
+ return next;
+ }
+
+-/*
+- * hv_set_next_write_location()
+- *
+- * Set the next write location for the specified ring buffer
+- *
+- */
++/* Set the next write location for the specified ring buffer. */
+ static inline void
+ hv_set_next_write_location(struct hv_ring_buffer_info *ring_info,
+ u32 next_write_location)
+@@ -160,11 +157,7 @@ hv_set_next_write_location(struct hv_ring_buffer_info *ring_info,
+ ring_info->ring_buffer->write_index = next_write_location;
+ }
+
+-/*
+- * hv_get_next_read_location()
+- *
+- * Get the next read location for the specified ring buffer
+- */
++/* Get the next read location for the specified ring buffer. */
+ static inline u32
+ hv_get_next_read_location(struct hv_ring_buffer_info *ring_info)
+ {
+@@ -174,10 +167,8 @@ hv_get_next_read_location(struct hv_ring_buffer_info *ring_info)
+ }
+
+ /*
+- * hv_get_next_readlocation_withoffset()
+- *
+ * Get the next read location + offset for the specified ring buffer.
+- * This allows the caller to skip
++ * This allows the caller to skip.
+ */
+ static inline u32
+ hv_get_next_readlocation_withoffset(struct hv_ring_buffer_info *ring_info,
+@@ -191,13 +182,7 @@ hv_get_next_readlocation_withoffset(struct hv_ring_buffer_info *ring_info,
+ return next;
+ }
+
+-/*
+- *
+- * hv_set_next_read_location()
+- *
+- * Set the next read location for the specified ring buffer
+- *
+- */
++/* Set the next read location for the specified ring buffer. */
+ static inline void
+ hv_set_next_read_location(struct hv_ring_buffer_info *ring_info,
+ u32 next_read_location)
+@@ -206,12 +191,7 @@ hv_set_next_read_location(struct hv_ring_buffer_info *ring_info,
+ }
+
+
+-/*
+- *
+- * hv_get_ring_buffer()
+- *
+- * Get the start of the ring buffer
+- */
++/* Get the start of the ring buffer. */
+ static inline void *
+ hv_get_ring_buffer(struct hv_ring_buffer_info *ring_info)
+ {
+@@ -219,25 +199,14 @@ hv_get_ring_buffer(struct hv_ring_buffer_info *ring_info)
+ }
+
+
+-/*
+- *
+- * hv_get_ring_buffersize()
+- *
+- * Get the size of the ring buffer
+- */
++/* Get the size of the ring buffer. */
+ static inline u32
+ hv_get_ring_buffersize(struct hv_ring_buffer_info *ring_info)
+ {
+ return ring_info->ring_datasize;
+ }
+
+-/*
+- *
+- * hv_get_ring_bufferindices()
+- *
+- * Get the read and write indices as u64 of the specified ring buffer
+- *
+- */
++/* Get the read and write indices as u64 of the specified ring buffer. */
+ static inline u64
+ hv_get_ring_bufferindices(struct hv_ring_buffer_info *ring_info)
+ {
+@@ -245,12 +214,8 @@ hv_get_ring_bufferindices(struct hv_ring_buffer_info *ring_info)
+ }
+
+ /*
+- *
+- * hv_copyfrom_ringbuffer()
+- *
+ * Helper routine to copy to source from ring buffer.
+ * Assume there is enough room. Handles wrap-around in src case only!!
+- *
+ */
+ static u32 hv_copyfrom_ringbuffer(
+ struct hv_ring_buffer_info *ring_info,
+@@ -282,12 +247,8 @@ static u32 hv_copyfrom_ringbuffer(
+
+
+ /*
+- *
+- * hv_copyto_ringbuffer()
+- *
+ * Helper routine to copy from source to ring buffer.
+ * Assume there is enough room. Handles wrap-around in dest case only!!
+- *
+ */
+ static u32 hv_copyto_ringbuffer(
+ struct hv_ring_buffer_info *ring_info,
+@@ -313,13 +274,7 @@ static u32 hv_copyto_ringbuffer(
+ return start_write_offset;
+ }
+
+-/*
+- *
+- * hv_ringbuffer_get_debuginfo()
+- *
+- * Get various debug metrics for the specified ring buffer
+- *
+- */
++/* Get various debug metrics for the specified ring buffer. */
+ void hv_ringbuffer_get_debuginfo(struct hv_ring_buffer_info *ring_info,
+ struct hv_ring_buffer_debug_info *debug_info)
+ {
+@@ -342,13 +297,7 @@ void hv_ringbuffer_get_debuginfo(struct hv_ring_buffer_info *ring_info,
+ }
+ }
+
+-/*
+- *
+- * hv_ringbuffer_init()
+- *
+- *Initialize the ring buffer
+- *
+- */
++/* Initialize the ring buffer. */
+ int hv_ringbuffer_init(struct hv_ring_buffer_info *ring_info,
+ void *buffer, u32 buflen)
+ {
+@@ -361,9 +310,7 @@ int hv_ringbuffer_init(struct hv_ring_buffer_info *ring_info,
+ ring_info->ring_buffer->read_index =
+ ring_info->ring_buffer->write_index = 0;
+
+- /*
+- * Set the feature bit for enabling flow control.
+- */
++ /* Set the feature bit for enabling flow control. */
+ ring_info->ring_buffer->feature_bits.value = 1;
+
+ ring_info->ring_size = buflen;
+@@ -374,24 +321,12 @@ int hv_ringbuffer_init(struct hv_ring_buffer_info *ring_info,
+ return 0;
+ }
+
+-/*
+- *
+- * hv_ringbuffer_cleanup()
+- *
+- * Cleanup the ring buffer
+- *
+- */
++/* Cleanup the ring buffer. */
+ void hv_ringbuffer_cleanup(struct hv_ring_buffer_info *ring_info)
+ {
+ }
+
+-/*
+- *
+- * hv_ringbuffer_write()
+- *
+- * Write to the ring buffer
+- *
+- */
++/* Write to the ring buffer. */
+ int hv_ringbuffer_write(struct hv_ring_buffer_info *outring_info,
+ struct kvec *kv_list, u32 kv_count, bool *signal)
+ {
+@@ -416,10 +351,11 @@ int hv_ringbuffer_write(struct hv_ring_buffer_info *outring_info,
+ &bytes_avail_toread,
+ &bytes_avail_towrite);
+
+-
+- /* If there is only room for the packet, assume it is full. */
+- /* Otherwise, the next time around, we think the ring buffer */
+- /* is empty since the read index == write index */
++ /*
++ * If there is only room for the packet, assume it is full.
++ * Otherwise, the next time around, we think the ring buffer
++ * is empty since the read index == write index.
++ */
+ if (bytes_avail_towrite <= totalbytes_towrite) {
+ spin_unlock_irqrestore(&outring_info->ring_lock, flags);
+ return -EAGAIN;
+@@ -459,13 +395,7 @@ int hv_ringbuffer_write(struct hv_ring_buffer_info *outring_info,
+ }
+
+
+-/*
+- *
+- * hv_ringbuffer_peek()
+- *
+- * Read without advancing the read index
+- *
+- */
++/* Read without advancing the read index. */
+ int hv_ringbuffer_peek(struct hv_ring_buffer_info *Inring_info,
+ void *Buffer, u32 buflen)
+ {
+@@ -502,13 +432,7 @@ int hv_ringbuffer_peek(struct hv_ring_buffer_info *Inring_info,
+ }
+
+
+-/*
+- *
+- * hv_ringbuffer_read()
+- *
+- * Read and advance the read index
+- *
+- */
++/* Read and advance the read index. */
+ int hv_ringbuffer_read(struct hv_ring_buffer_info *inring_info, void *buffer,
+ u32 buflen, u32 offset, bool *signal)
+ {
+@@ -517,7 +441,6 @@ int hv_ringbuffer_read(struct hv_ring_buffer_info *inring_info, void *buffer,
+ u32 next_read_location = 0;
+ u64 prev_indices = 0;
+ unsigned long flags;
+- u32 old_read;
+
+ if (buflen <= 0)
+ return -EINVAL;
+@@ -528,8 +451,6 @@ int hv_ringbuffer_read(struct hv_ring_buffer_info *inring_info, void *buffer,
+ &bytes_avail_toread,
+ &bytes_avail_towrite);
+
+- old_read = bytes_avail_toread;
+-
+ /* Make sure there is something to read */
+ if (bytes_avail_toread < buflen) {
+ spin_unlock_irqrestore(&inring_info->ring_lock, flags);
+@@ -550,9 +471,11 @@ int hv_ringbuffer_read(struct hv_ring_buffer_info *inring_info, void *buffer,
+ sizeof(u64),
+ next_read_location);
+
+- /* Make sure all reads are done before we update the read index since */
+- /* the writer may start writing to the read area once the read index */
+- /*is updated */
++ /*
++ * Make sure all reads are done before we update the read index since
++ * the writer may start writing to the read area once the read index
++ * is updated.
++ */
+ mb();
+
+ /* Update the read index */
+@@ -560,7 +483,7 @@ int hv_ringbuffer_read(struct hv_ring_buffer_info *inring_info, void *buffer,
+
+ spin_unlock_irqrestore(&inring_info->ring_lock, flags);
+
+- *signal = hv_need_to_signal_on_read(old_read, inring_info);
++ *signal = hv_need_to_signal_on_read(inring_info);
+
+ return 0;
+ }
+diff --git a/drivers/iio/magnetometer/ak8975.c b/drivers/iio/magnetometer/ak8975.c
+index bf5ef077e791..f03c3bf9a780 100644
+--- a/drivers/iio/magnetometer/ak8975.c
++++ b/drivers/iio/magnetometer/ak8975.c
+@@ -160,6 +160,8 @@ static int ak8975_setup_irq(struct ak8975_data *data)
+ int rc;
+ int irq;
+
++ init_waitqueue_head(&data->data_ready_queue);
++ clear_bit(0, &data->flags);
+ if (client->irq)
+ irq = client->irq;
+ else
+@@ -175,8 +177,6 @@ static int ak8975_setup_irq(struct ak8975_data *data)
+ return rc;
+ }
+
+- init_waitqueue_head(&data->data_ready_queue);
+- clear_bit(0, &data->flags);
+ data->eoc_irq = irq;
+
+ return rc;
+diff --git a/drivers/infiniband/core/ucm.c b/drivers/infiniband/core/ucm.c
+index f2f63933e8a9..5befec118a18 100644
+--- a/drivers/infiniband/core/ucm.c
++++ b/drivers/infiniband/core/ucm.c
+@@ -48,6 +48,7 @@
+
+ #include <asm/uaccess.h>
+
++#include <rdma/ib.h>
+ #include <rdma/ib_cm.h>
+ #include <rdma/ib_user_cm.h>
+ #include <rdma/ib_marshall.h>
+@@ -1104,6 +1105,9 @@ static ssize_t ib_ucm_write(struct file *filp, const char __user *buf,
+ struct ib_ucm_cmd_hdr hdr;
+ ssize_t result;
+
++ if (WARN_ON_ONCE(!ib_safe_file_access(filp)))
++ return -EACCES;
++
+ if (len < sizeof(hdr))
+ return -EINVAL;
+
+diff --git a/drivers/infiniband/core/ucma.c b/drivers/infiniband/core/ucma.c
+index 45d67e9228d7..81dd84d0b68b 100644
+--- a/drivers/infiniband/core/ucma.c
++++ b/drivers/infiniband/core/ucma.c
+@@ -1487,6 +1487,9 @@ static ssize_t ucma_write(struct file *filp, const char __user *buf,
+ struct rdma_ucm_cmd_hdr hdr;
+ ssize_t ret;
+
++ if (WARN_ON_ONCE(!ib_safe_file_access(filp)))
++ return -EACCES;
++
+ if (len < sizeof(hdr))
+ return -EINVAL;
+
+diff --git a/drivers/infiniband/core/uverbs_main.c b/drivers/infiniband/core/uverbs_main.c
+index d3abb7ea2dee..c221310005f8 100644
+--- a/drivers/infiniband/core/uverbs_main.c
++++ b/drivers/infiniband/core/uverbs_main.c
+@@ -48,6 +48,8 @@
+
+ #include <asm/uaccess.h>
+
++#include <rdma/ib.h>
++
+ #include "uverbs.h"
+
+ MODULE_AUTHOR("Roland Dreier");
+@@ -610,6 +612,9 @@ static ssize_t ib_uverbs_write(struct file *filp, const char __user *buf,
+ struct ib_uverbs_cmd_hdr hdr;
+ __u32 flags;
+
++ if (WARN_ON_ONCE(!ib_safe_file_access(filp)))
++ return -EACCES;
++
+ if (count < sizeof hdr)
+ return -EINVAL;
+
+diff --git a/drivers/infiniband/hw/qib/qib_file_ops.c b/drivers/infiniband/hw/qib/qib_file_ops.c
+index b15e34eeef68..3ab8229b1d8c 100644
+--- a/drivers/infiniband/hw/qib/qib_file_ops.c
++++ b/drivers/infiniband/hw/qib/qib_file_ops.c
+@@ -45,6 +45,8 @@
+ #include <linux/delay.h>
+ #include <linux/export.h>
+
++#include <rdma/ib.h>
++
+ #include "qib.h"
+ #include "qib_common.h"
+ #include "qib_user_sdma.h"
+@@ -2058,6 +2060,9 @@ static ssize_t qib_write(struct file *fp, const char __user *data,
+ ssize_t ret = 0;
+ void *dest;
+
++ if (WARN_ON_ONCE(!ib_safe_file_access(fp)))
++ return -EACCES;
++
+ if (count < sizeof(cmd.type)) {
+ ret = -EINVAL;
+ goto bail;
+diff --git a/drivers/input/misc/max8997_haptic.c b/drivers/input/misc/max8997_haptic.c
+index a363ebbd9cc0..57f3d90d7b03 100644
+--- a/drivers/input/misc/max8997_haptic.c
++++ b/drivers/input/misc/max8997_haptic.c
+@@ -255,12 +255,14 @@ static int max8997_haptic_probe(struct platform_device *pdev)
+ struct max8997_dev *iodev = dev_get_drvdata(pdev->dev.parent);
+ const struct max8997_platform_data *pdata =
+ dev_get_platdata(iodev->dev);
+- const struct max8997_haptic_platform_data *haptic_pdata =
+- pdata->haptic_pdata;
++ const struct max8997_haptic_platform_data *haptic_pdata = NULL;
+ struct max8997_haptic *chip;
+ struct input_dev *input_dev;
+ int error;
+
++ if (pdata)
++ haptic_pdata = pdata->haptic_pdata;
++
+ if (!haptic_pdata) {
+ dev_err(&pdev->dev, "no haptic platform data\n");
+ return -EINVAL;
+diff --git a/drivers/md/md.c b/drivers/md/md.c
+index 6c169f18aab8..3d2cc7453ec1 100644
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -282,6 +282,8 @@ static void md_make_request(struct request_queue *q, struct bio *bio)
+ * go away inside make_request
+ */
+ sectors = bio_sectors(bio);
++ /* bio could be mergeable after passing to underlayer */
++ bio->bi_rw &= ~REQ_NOMERGE;
+ mddev->pers->make_request(mddev, bio);
+
+ cpu = part_stat_lock();
+diff --git a/drivers/misc/cxl/irq.c b/drivers/misc/cxl/irq.c
+index 6fe4027feb7d..7355d9c114ef 100644
+--- a/drivers/misc/cxl/irq.c
++++ b/drivers/misc/cxl/irq.c
+@@ -272,7 +272,6 @@ unsigned int cxl_map_irq(struct cxl *adapter, irq_hw_number_t hwirq,
+ void cxl_unmap_irq(unsigned int virq, void *cookie)
+ {
+ free_irq(virq, cookie);
+- irq_dispose_mapping(virq);
+ }
+
+ static int cxl_register_one_irq(struct cxl *adapter,
+diff --git a/drivers/regulator/s2mps11.c b/drivers/regulator/s2mps11.c
+index 697be114e21a..ad9920c3dda7 100644
+--- a/drivers/regulator/s2mps11.c
++++ b/drivers/regulator/s2mps11.c
+@@ -302,7 +302,7 @@ static struct regulator_ops s2mps11_buck_ops = {
+ .enable_mask = S2MPS11_ENABLE_MASK \
+ }
+
+-#define regulator_desc_s2mps11_buck6_10(num, min, step) { \
++#define regulator_desc_s2mps11_buck67810(num, min, step) { \
+ .name = "BUCK"#num, \
+ .id = S2MPS11_BUCK##num, \
+ .ops = &s2mps11_buck_ops, \
+@@ -318,6 +318,22 @@ static struct regulator_ops s2mps11_buck_ops = {
+ .enable_mask = S2MPS11_ENABLE_MASK \
+ }
+
++#define regulator_desc_s2mps11_buck9 { \
++ .name = "BUCK9", \
++ .id = S2MPS11_BUCK9, \
++ .ops = &s2mps11_buck_ops, \
++ .type = REGULATOR_VOLTAGE, \
++ .owner = THIS_MODULE, \
++ .min_uV = MIN_3000_MV, \
++ .uV_step = STEP_25_MV, \
++ .n_voltages = S2MPS11_BUCK9_N_VOLTAGES, \
++ .ramp_delay = S2MPS11_RAMP_DELAY, \
++ .vsel_reg = S2MPS11_REG_B9CTRL2, \
++ .vsel_mask = S2MPS11_BUCK9_VSEL_MASK, \
++ .enable_reg = S2MPS11_REG_B9CTRL1, \
++ .enable_mask = S2MPS11_ENABLE_MASK \
++}
++
+ static const struct regulator_desc s2mps11_regulators[] = {
+ regulator_desc_s2mps11_ldo(1, STEP_25_MV),
+ regulator_desc_s2mps11_ldo(2, STEP_50_MV),
+@@ -362,11 +378,11 @@ static const struct regulator_desc s2mps11_regulators[] = {
+ regulator_desc_s2mps11_buck1_4(3),
+ regulator_desc_s2mps11_buck1_4(4),
+ regulator_desc_s2mps11_buck5,
+- regulator_desc_s2mps11_buck6_10(6, MIN_600_MV, STEP_6_25_MV),
+- regulator_desc_s2mps11_buck6_10(7, MIN_600_MV, STEP_6_25_MV),
+- regulator_desc_s2mps11_buck6_10(8, MIN_600_MV, STEP_6_25_MV),
+- regulator_desc_s2mps11_buck6_10(9, MIN_3000_MV, STEP_25_MV),
+- regulator_desc_s2mps11_buck6_10(10, MIN_750_MV, STEP_12_5_MV),
++ regulator_desc_s2mps11_buck67810(6, MIN_600_MV, STEP_6_25_MV),
++ regulator_desc_s2mps11_buck67810(7, MIN_600_MV, STEP_6_25_MV),
++ regulator_desc_s2mps11_buck67810(8, MIN_600_MV, STEP_6_25_MV),
++ regulator_desc_s2mps11_buck9,
++ regulator_desc_s2mps11_buck67810(10, MIN_750_MV, STEP_12_5_MV),
+ };
+
+ static int s2mps14_regulator_enable(struct regulator_dev *rdev)
+diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
+index d8e1d5c1b9d2..74d856c7522b 100644
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -5369,6 +5369,7 @@ static int usb_reset_and_verify_device(struct usb_device *udev)
+ }
+
+ bos = udev->bos;
++ udev->bos = NULL;
+
+ for (i = 0; i < SET_CONFIG_TRIES; ++i) {
+
+@@ -5461,11 +5462,8 @@ done:
+ usb_set_usb2_hardware_lpm(udev, 1);
+ usb_unlocked_enable_lpm(udev);
+ usb_enable_ltm(udev);
+- /* release the new BOS descriptor allocated by hub_port_init() */
+- if (udev->bos != bos) {
+- usb_release_bos_descriptor(udev);
+- udev->bos = bos;
+- }
++ usb_release_bos_descriptor(udev);
++ udev->bos = bos;
+ return 0;
+
+ re_enumerate:
+diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
+index d4541ac5bf48..642125d27df4 100644
+--- a/drivers/usb/serial/cp210x.c
++++ b/drivers/usb/serial/cp210x.c
+@@ -108,6 +108,7 @@ static const struct usb_device_id id_table[] = {
+ { USB_DEVICE(0x10C4, 0x826B) }, /* Cygnal Integrated Products, Inc., Fasttrax GPS demonstration module */
+ { USB_DEVICE(0x10C4, 0x8281) }, /* Nanotec Plug & Drive */
+ { USB_DEVICE(0x10C4, 0x8293) }, /* Telegesis ETRX2USB */
++ { USB_DEVICE(0x10C4, 0x82F4) }, /* Starizona MicroTouch */
+ { USB_DEVICE(0x10C4, 0x82F9) }, /* Procyon AVS */
+ { USB_DEVICE(0x10C4, 0x8341) }, /* Siemens MC35PU GPRS Modem */
+ { USB_DEVICE(0x10C4, 0x8382) }, /* Cygnal Integrated Products, Inc. */
+@@ -117,6 +118,7 @@ static const struct usb_device_id id_table[] = {
+ { USB_DEVICE(0x10C4, 0x8418) }, /* IRZ Automation Teleport SG-10 GSM/GPRS Modem */
+ { USB_DEVICE(0x10C4, 0x846E) }, /* BEI USB Sensor Interface (VCP) */
+ { USB_DEVICE(0x10C4, 0x8477) }, /* Balluff RFID */
++ { USB_DEVICE(0x10C4, 0x84B6) }, /* Starizona Hyperion */
+ { USB_DEVICE(0x10C4, 0x85EA) }, /* AC-Services IBUS-IF */
+ { USB_DEVICE(0x10C4, 0x85EB) }, /* AC-Services CIS-IBUS */
+ { USB_DEVICE(0x10C4, 0x85F8) }, /* Virtenio Preon32 */
+@@ -140,6 +142,8 @@ static const struct usb_device_id id_table[] = {
+ { USB_DEVICE(0x10C4, 0xF004) }, /* Elan Digital Systems USBcount50 */
+ { USB_DEVICE(0x10C5, 0xEA61) }, /* Silicon Labs MobiData GPRS USB Modem */
+ { USB_DEVICE(0x10CE, 0xEA6A) }, /* Silicon Labs MobiData GPRS USB Modem 100EU */
++ { USB_DEVICE(0x12B8, 0xEC60) }, /* Link G4 ECU */
++ { USB_DEVICE(0x12B8, 0xEC62) }, /* Link G4+ ECU */
+ { USB_DEVICE(0x13AD, 0x9999) }, /* Baltech card reader */
+ { USB_DEVICE(0x1555, 0x0004) }, /* Owen AC4 USB-RS485 Converter */
+ { USB_DEVICE(0x166A, 0x0201) }, /* Clipsal 5500PACA C-Bus Pascal Automation Controller */
+diff --git a/fs/isofs/rock.c b/fs/isofs/rock.c
+index 735d7522a3a9..204659a5f6db 100644
+--- a/fs/isofs/rock.c
++++ b/fs/isofs/rock.c
+@@ -203,6 +203,8 @@ int get_rock_ridge_filename(struct iso_directory_record *de,
+ int retnamlen = 0;
+ int truncate = 0;
+ int ret = 0;
++ char *p;
++ int len;
+
+ if (!ISOFS_SB(inode->i_sb)->s_rock)
+ return 0;
+@@ -267,12 +269,17 @@ repeat:
+ rr->u.NM.flags);
+ break;
+ }
+- if ((strlen(retname) + rr->len - 5) >= 254) {
++ len = rr->len - 5;
++ if (retnamlen + len >= 254) {
+ truncate = 1;
+ break;
+ }
+- strncat(retname, rr->u.NM.name, rr->len - 5);
+- retnamlen += rr->len - 5;
++ p = memchr(rr->u.NM.name, '\0', len);
++ if (unlikely(p))
++ len = p - rr->u.NM.name;
++ memcpy(retname + retnamlen, rr->u.NM.name, len);
++ retnamlen += len;
++ retname[retnamlen] = '\0';
+ break;
+ case SIG('R', 'E'):
+ kfree(rs.buffer);
+diff --git a/fs/namei.c b/fs/namei.c
+index 2a8ba683a888..e1976450a1e2 100644
+--- a/fs/namei.c
++++ b/fs/namei.c
+@@ -2797,22 +2797,10 @@ no_open:
+ dentry = lookup_real(dir, dentry, nd->flags);
+ if (IS_ERR(dentry))
+ return PTR_ERR(dentry);
+-
+- if (create_error) {
+- int open_flag = op->open_flag;
+-
+- error = create_error;
+- if ((open_flag & O_EXCL)) {
+- if (!dentry->d_inode)
+- goto out;
+- } else if (!dentry->d_inode) {
+- goto out;
+- } else if ((open_flag & O_TRUNC) &&
+- S_ISREG(dentry->d_inode->i_mode)) {
+- goto out;
+- }
+- /* will fail later, go on to get the right error */
+- }
++ }
++ if (create_error && !dentry->d_inode) {
++ error = create_error;
++ goto out;
+ }
+ looked_up:
+ path->dentry = dentry;
+diff --git a/fs/ocfs2/acl.c b/fs/ocfs2/acl.c
+index 7e8282dcea2a..8a7d2f812b5b 100644
+--- a/fs/ocfs2/acl.c
++++ b/fs/ocfs2/acl.c
+@@ -310,3 +310,90 @@ struct posix_acl *ocfs2_iop_get_acl(struct inode *inode, int type)
+
+ return acl;
+ }
++
++int ocfs2_acl_chmod(struct inode *inode, struct buffer_head *bh)
++{
++ struct ocfs2_super *osb = OCFS2_SB(inode->i_sb);
++ struct posix_acl *acl;
++ int ret;
++
++ if (S_ISLNK(inode->i_mode))
++ return -EOPNOTSUPP;
++
++ if (!(osb->s_mount_opt & OCFS2_MOUNT_POSIX_ACL))
++ return 0;
++
++ acl = ocfs2_get_acl_nolock(inode, ACL_TYPE_ACCESS, bh);
++ if (IS_ERR(acl) || !acl)
++ return PTR_ERR(acl);
++ ret = __posix_acl_chmod(&acl, GFP_KERNEL, inode->i_mode);
++ if (ret)
++ return ret;
++ ret = ocfs2_set_acl(NULL, inode, NULL, ACL_TYPE_ACCESS,
++ acl, NULL, NULL);
++ posix_acl_release(acl);
++ return ret;
++}
++
++/*
++ * Initialize the ACLs of a new inode. If parent directory has default ACL,
++ * then clone to new inode. Called from ocfs2_mknod.
++ */
++int ocfs2_init_acl(handle_t *handle,
++ struct inode *inode,
++ struct inode *dir,
++ struct buffer_head *di_bh,
++ struct buffer_head *dir_bh,
++ struct ocfs2_alloc_context *meta_ac,
++ struct ocfs2_alloc_context *data_ac)
++{
++ struct ocfs2_super *osb = OCFS2_SB(inode->i_sb);
++ struct posix_acl *acl = NULL;
++ int ret = 0, ret2;
++ umode_t mode;
++
++ if (!S_ISLNK(inode->i_mode)) {
++ if (osb->s_mount_opt & OCFS2_MOUNT_POSIX_ACL) {
++ acl = ocfs2_get_acl_nolock(dir, ACL_TYPE_DEFAULT,
++ dir_bh);
++ if (IS_ERR(acl))
++ return PTR_ERR(acl);
++ }
++ if (!acl) {
++ mode = inode->i_mode & ~current_umask();
++ ret = ocfs2_acl_set_mode(inode, di_bh, handle, mode);
++ if (ret) {
++ mlog_errno(ret);
++ goto cleanup;
++ }
++ }
++ }
++ if ((osb->s_mount_opt & OCFS2_MOUNT_POSIX_ACL) && acl) {
++ if (S_ISDIR(inode->i_mode)) {
++ ret = ocfs2_set_acl(handle, inode, di_bh,
++ ACL_TYPE_DEFAULT, acl,
++ meta_ac, data_ac);
++ if (ret)
++ goto cleanup;
++ }
++ mode = inode->i_mode;
++ ret = __posix_acl_create(&acl, GFP_NOFS, &mode);
++ if (ret < 0)
++ return ret;
++
++ ret2 = ocfs2_acl_set_mode(inode, di_bh, handle, mode);
++ if (ret2) {
++ mlog_errno(ret2);
++ ret = ret2;
++ goto cleanup;
++ }
++ if (ret > 0) {
++ ret = ocfs2_set_acl(handle, inode,
++ di_bh, ACL_TYPE_ACCESS,
++ acl, meta_ac, data_ac);
++ }
++ }
++cleanup:
++ posix_acl_release(acl);
++ return ret;
++}
+diff --git a/fs/ocfs2/acl.h b/fs/ocfs2/acl.h
+index 3fce68d08625..2783a75b3999 100644
+--- a/fs/ocfs2/acl.h
++++ b/fs/ocfs2/acl.h
+@@ -35,5 +35,10 @@ int ocfs2_set_acl(handle_t *handle,
+ struct posix_acl *acl,
+ struct ocfs2_alloc_context *meta_ac,
+ struct ocfs2_alloc_context *data_ac);
++extern int ocfs2_acl_chmod(struct inode *, struct buffer_head *);
++extern int ocfs2_init_acl(handle_t *, struct inode *, struct inode *,
++ struct buffer_head *, struct buffer_head *,
++ struct ocfs2_alloc_context *,
++ struct ocfs2_alloc_context *);
+
+ #endif /* OCFS2_ACL_H */
+diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c
+index e6e8d6449b47..9d5adfd6b326 100644
+--- a/fs/ocfs2/file.c
++++ b/fs/ocfs2/file.c
+@@ -1249,18 +1249,18 @@ bail_unlock_rw:
+ if (size_change)
+ ocfs2_rw_unlock(inode, 1);
+ bail:
+- brelse(bh);
+
+ /* Release quota pointers in case we acquired them */
+ for (qtype = 0; qtype < OCFS2_MAXQUOTAS; qtype++)
+ dqput(transfer_to[qtype]);
+
+ if (!status && attr->ia_valid & ATTR_MODE) {
+- status = posix_acl_chmod(inode, inode->i_mode);
++ status = ocfs2_acl_chmod(inode, bh);
+ if (status < 0)
+ mlog_errno(status);
+ }
+
++ brelse(bh);
+ return status;
+ }
+
+diff --git a/fs/ocfs2/namei.c b/fs/ocfs2/namei.c
+index 9fc1daecdfb3..8f7f5de38e91 100644
+--- a/fs/ocfs2/namei.c
++++ b/fs/ocfs2/namei.c
+@@ -253,7 +253,6 @@ static int ocfs2_mknod(struct inode *dir,
+ struct ocfs2_dir_lookup_result lookup = { NULL, };
+ sigset_t oldset;
+ int did_block_signals = 0;
+- struct posix_acl *default_acl = NULL, *acl = NULL;
+ struct ocfs2_dentry_lock *dl = NULL;
+
+ trace_ocfs2_mknod(dir, dentry, dentry->d_name.len, dentry->d_name.name,
+@@ -356,14 +355,6 @@ static int ocfs2_mknod(struct inode *dir,
+ goto leave;
+ }
+
+- status = posix_acl_create(dir, &mode, &default_acl, &acl);
+- if (status) {
+- mlog_errno(status);
+- goto leave;
+- }
+- /* update inode->i_mode after mask with "umask". */
+- inode->i_mode = mode;
+-
+ handle = ocfs2_start_trans(osb, ocfs2_mknod_credits(osb->sb,
+ S_ISDIR(mode),
+ xattr_credits));
+@@ -412,16 +403,8 @@ static int ocfs2_mknod(struct inode *dir,
+ inc_nlink(dir);
+ }
+
+- if (default_acl) {
+- status = ocfs2_set_acl(handle, inode, new_fe_bh,
+- ACL_TYPE_DEFAULT, default_acl,
+- meta_ac, data_ac);
+- }
+- if (!status && acl) {
+- status = ocfs2_set_acl(handle, inode, new_fe_bh,
+- ACL_TYPE_ACCESS, acl,
+- meta_ac, data_ac);
+- }
++ status = ocfs2_init_acl(handle, inode, dir, new_fe_bh, parent_fe_bh,
++ meta_ac, data_ac);
+
+ if (status < 0) {
+ mlog_errno(status);
+@@ -463,10 +446,6 @@ static int ocfs2_mknod(struct inode *dir,
+ d_instantiate(dentry, inode);
+ status = 0;
+ leave:
+- if (default_acl)
+- posix_acl_release(default_acl);
+- if (acl)
+- posix_acl_release(acl);
+ if (status < 0 && did_quota_inode)
+ dquot_free_inode(inode);
+ if (handle)
+diff --git a/fs/ocfs2/refcounttree.c b/fs/ocfs2/refcounttree.c
+index d81f6e2a97f5..18e8b4d8447a 100644
+--- a/fs/ocfs2/refcounttree.c
++++ b/fs/ocfs2/refcounttree.c
+@@ -4268,20 +4268,12 @@ static int ocfs2_reflink(struct dentry *old_dentry, struct inode *dir,
+ struct inode *inode = old_dentry->d_inode;
+ struct buffer_head *old_bh = NULL;
+ struct inode *new_orphan_inode = NULL;
+- struct posix_acl *default_acl, *acl;
+- umode_t mode;
+
+ if (!ocfs2_refcount_tree(OCFS2_SB(inode->i_sb)))
+ return -EOPNOTSUPP;
+
+- mode = inode->i_mode;
+- error = posix_acl_create(dir, &mode, &default_acl, &acl);
+- if (error) {
+- mlog_errno(error);
+- goto out;
+- }
+
+- error = ocfs2_create_inode_in_orphan(dir, mode,
++ error = ocfs2_create_inode_in_orphan(dir, inode->i_mode,
+ &new_orphan_inode);
+ if (error) {
+ mlog_errno(error);
+@@ -4320,16 +4312,11 @@ static int ocfs2_reflink(struct dentry *old_dentry, struct inode *dir,
+ /* If the security isn't preserved, we need to re-initialize them. */
+ if (!preserve) {
+ error = ocfs2_init_security_and_acl(dir, new_orphan_inode,
+- &new_dentry->d_name,
+- default_acl, acl);
++ &new_dentry->d_name);
+ if (error)
+ mlog_errno(error);
+ }
+ out:
+- if (default_acl)
+- posix_acl_release(default_acl);
+- if (acl)
+- posix_acl_release(acl);
+ if (!error) {
+ error = ocfs2_mv_orphaned_inode_to_new(dir, new_orphan_inode,
+ new_dentry);
+diff --git a/fs/ocfs2/xattr.c b/fs/ocfs2/xattr.c
+index 016f01df3825..c237008c010d 100644
+--- a/fs/ocfs2/xattr.c
++++ b/fs/ocfs2/xattr.c
+@@ -7207,12 +7207,10 @@ out:
+ */
+ int ocfs2_init_security_and_acl(struct inode *dir,
+ struct inode *inode,
+- const struct qstr *qstr,
+- struct posix_acl *default_acl,
+- struct posix_acl *acl)
++ const struct qstr *qstr)
+ {
+- struct buffer_head *dir_bh = NULL;
+ int ret = 0;
++ struct buffer_head *dir_bh = NULL;
+
+ ret = ocfs2_init_security_get(inode, dir, qstr, NULL);
+ if (ret) {
+@@ -7225,11 +7223,9 @@ int ocfs2_init_security_and_acl(struct inode *dir,
+ mlog_errno(ret);
+ goto leave;
+ }
+-
+- if (!ret && default_acl)
+- ret = ocfs2_iop_set_acl(inode, default_acl, ACL_TYPE_DEFAULT);
+- if (!ret && acl)
+- ret = ocfs2_iop_set_acl(inode, acl, ACL_TYPE_ACCESS);
++ ret = ocfs2_init_acl(NULL, inode, dir, NULL, dir_bh, NULL, NULL);
++ if (ret)
++ mlog_errno(ret);
+
+ ocfs2_inode_unlock(dir, 0);
+ brelse(dir_bh);
+diff --git a/fs/ocfs2/xattr.h b/fs/ocfs2/xattr.h
+index f10d5b93c366..1633cc15ea1f 100644
+--- a/fs/ocfs2/xattr.h
++++ b/fs/ocfs2/xattr.h
+@@ -94,7 +94,5 @@ int ocfs2_reflink_xattrs(struct inode *old_inode,
+ bool preserve_security);
+ int ocfs2_init_security_and_acl(struct inode *dir,
+ struct inode *inode,
+- const struct qstr *qstr,
+- struct posix_acl *default_acl,
+- struct posix_acl *acl);
++ const struct qstr *qstr);
+ #endif /* OCFS2_XATTR_H */
+diff --git a/fs/pnode.c b/fs/pnode.c
+index aae331a5d03b..18e56fc4a88c 100644
+--- a/fs/pnode.c
++++ b/fs/pnode.c
+@@ -198,10 +198,15 @@ static struct mount *next_group(struct mount *m, struct mount *origin)
+
+ /* all accesses are serialized by namespace_sem */
+ static struct user_namespace *user_ns;
+-static struct mount *last_dest, *last_source, *dest_master;
++static struct mount *last_dest, *first_source, *last_source, *dest_master;
+ static struct mountpoint *mp;
+ static struct hlist_head *list;
+
++static inline bool peers(struct mount *m1, struct mount *m2)
++{
++ return m1->mnt_group_id == m2->mnt_group_id && m1->mnt_group_id;
++}
++
+ static int propagate_one(struct mount *m)
+ {
+ struct mount *child;
+@@ -212,24 +217,26 @@ static int propagate_one(struct mount *m)
+ /* skip if mountpoint isn't covered by it */
+ if (!is_subdir(mp->m_dentry, m->mnt.mnt_root))
+ return 0;
+- if (m->mnt_group_id == last_dest->mnt_group_id) {
++ if (peers(m, last_dest)) {
+ type = CL_MAKE_SHARED;
+ } else {
+ struct mount *n, *p;
++ bool done;
+ for (n = m; ; n = p) {
+ p = n->mnt_master;
+- if (p == dest_master || IS_MNT_MARKED(p)) {
+- while (last_dest->mnt_master != p) {
+- last_source = last_source->mnt_master;
+- last_dest = last_source->mnt_parent;
+- }
+- if (n->mnt_group_id != last_dest->mnt_group_id) {
+- last_source = last_source->mnt_master;
+- last_dest = last_source->mnt_parent;
+- }
++ if (p == dest_master || IS_MNT_MARKED(p))
+ break;
+- }
+ }
++ do {
++ struct mount *parent = last_source->mnt_parent;
++ if (last_source == first_source)
++ break;
++ done = parent->mnt_master == p;
++ if (done && peers(n, parent))
++ break;
++ last_source = last_source->mnt_master;
++ } while (!done);
++
+ type = CL_SLAVE;
+ /* beginning of peer group among the slaves? */
+ if (IS_MNT_SHARED(m))
+@@ -280,6 +287,7 @@ int propagate_mnt(struct mount *dest_mnt, struct mountpoint *dest_mp,
+ */
+ user_ns = current->nsproxy->mnt_ns->user_ns;
+ last_dest = dest_mnt;
++ first_source = source_mnt;
+ last_source = source_mnt;
+ mp = dest_mp;
+ list = tree_list;
+diff --git a/include/linux/hash.h b/include/linux/hash.h
+index d0494c399392..a75b1009d3f7 100644
+--- a/include/linux/hash.h
++++ b/include/linux/hash.h
+@@ -33,12 +33,28 @@
+ #error Wordsize not 32 or 64
+ #endif
+
++/*
++ * The above primes are actively bad for hashing, since they are
++ * too sparse. The 32-bit one is mostly ok, the 64-bit one causes
++ * real problems. Besides, the "prime" part is pointless for the
++ * multiplicative hash.
++ *
++ * Although a random odd number will do, it turns out that the golden
++ * ratio phi = (sqrt(5)-1)/2, or its negative, has particularly nice
++ * properties.
++ *
++ * These are the negative, (1 - phi) = (phi^2) = (3 - sqrt(5))/2.
++ * (See Knuth vol 3, section 6.4, exercise 9.)
++ */
++#define GOLDEN_RATIO_32 0x61C88647
++#define GOLDEN_RATIO_64 0x61C8864680B583EBull
++
+ static __always_inline u64 hash_64(u64 val, unsigned int bits)
+ {
+ u64 hash = val;
+
+-#if defined(CONFIG_ARCH_HAS_FAST_MULTIPLIER) && BITS_PER_LONG == 64
+- hash = hash * GOLDEN_RATIO_PRIME_64;
++#if BITS_PER_LONG == 64
++ hash = hash * GOLDEN_RATIO_64;
+ #else
+ /* Sigh, gcc can't optimise this alone like it does for 32 bits. */
+ u64 n = hash;
+diff --git a/include/linux/mfd/samsung/s2mps11.h b/include/linux/mfd/samsung/s2mps11.h
+index 7981a9d77d3f..ad81a1a7193f 100644
+--- a/include/linux/mfd/samsung/s2mps11.h
++++ b/include/linux/mfd/samsung/s2mps11.h
+@@ -173,10 +173,12 @@ enum s2mps11_regulators {
+
+ #define S2MPS11_LDO_VSEL_MASK 0x3F
+ #define S2MPS11_BUCK_VSEL_MASK 0xFF
++#define S2MPS11_BUCK9_VSEL_MASK 0x1F
+ #define S2MPS11_ENABLE_MASK (0x03 << S2MPS11_ENABLE_SHIFT)
+ #define S2MPS11_ENABLE_SHIFT 0x06
+ #define S2MPS11_LDO_N_VOLTAGES (S2MPS11_LDO_VSEL_MASK + 1)
+ #define S2MPS11_BUCK_N_VOLTAGES (S2MPS11_BUCK_VSEL_MASK + 1)
++#define S2MPS11_BUCK9_N_VOLTAGES (S2MPS11_BUCK9_VSEL_MASK + 1)
+ #define S2MPS11_RAMP_DELAY 25000 /* uV/us */
+
+
+diff --git a/include/rdma/ib.h b/include/rdma/ib.h
+index cf8f9e700e48..a6b93706b0fc 100644
+--- a/include/rdma/ib.h
++++ b/include/rdma/ib.h
+@@ -34,6 +34,7 @@
+ #define _RDMA_IB_H
+
+ #include <linux/types.h>
++#include <linux/sched.h>
+
+ struct ib_addr {
+ union {
+@@ -86,4 +87,19 @@ struct sockaddr_ib {
+ __u64 sib_scope_id;
+ };
+
++/*
++ * The IB interfaces that use write() as bi-directional ioctl() are
++ * fundamentally unsafe, since there are lots of ways to trigger "write()"
++ * calls from various contexts with elevated privileges. That includes the
++ * traditional suid executable error message writes, but also various kernel
++ * interfaces that can write to file descriptors.
++ *
++ * This function provides protection for the legacy API by restricting the
++ * calling context.
++ */
++static inline bool ib_safe_file_access(struct file *filp)
++{
++ return filp->f_cred == current_cred() && segment_eq(get_fs(), USER_DS);
++}
++
+ #endif /* _RDMA_IB_H */
+diff --git a/include/uapi/linux/v4l2-dv-timings.h b/include/uapi/linux/v4l2-dv-timings.h
+index 6c8f159e416e..63467ce7c3eb 100644
+--- a/include/uapi/linux/v4l2-dv-timings.h
++++ b/include/uapi/linux/v4l2-dv-timings.h
+@@ -175,70 +175,80 @@
+
+ #define V4L2_DV_BT_CEA_3840X2160P24 { \
+ .type = V4L2_DV_BT_656_1120, \
+- V4L2_INIT_BT_TIMINGS(3840, 2160, 0, V4L2_DV_HSYNC_POS_POL, \
++ V4L2_INIT_BT_TIMINGS(3840, 2160, 0, \
++ V4L2_DV_HSYNC_POS_POL | V4L2_DV_VSYNC_POS_POL, \
+ 297000000, 1276, 88, 296, 8, 10, 72, 0, 0, 0, \
+ V4L2_DV_BT_STD_CEA861, V4L2_DV_FL_CAN_REDUCE_FPS) \
+ }
+
+ #define V4L2_DV_BT_CEA_3840X2160P25 { \
+ .type = V4L2_DV_BT_656_1120, \
+- V4L2_INIT_BT_TIMINGS(3840, 2160, 0, V4L2_DV_HSYNC_POS_POL, \
++ V4L2_INIT_BT_TIMINGS(3840, 2160, 0, \
++ V4L2_DV_HSYNC_POS_POL | V4L2_DV_VSYNC_POS_POL, \
+ 297000000, 1056, 88, 296, 8, 10, 72, 0, 0, 0, \
+ V4L2_DV_BT_STD_CEA861, 0) \
+ }
+
+ #define V4L2_DV_BT_CEA_3840X2160P30 { \
+ .type = V4L2_DV_BT_656_1120, \
+- V4L2_INIT_BT_TIMINGS(3840, 2160, 0, V4L2_DV_HSYNC_POS_POL, \
++ V4L2_INIT_BT_TIMINGS(3840, 2160, 0, \
++ V4L2_DV_HSYNC_POS_POL | V4L2_DV_VSYNC_POS_POL, \
+ 297000000, 176, 88, 296, 8, 10, 72, 0, 0, 0, \
+ V4L2_DV_BT_STD_CEA861, V4L2_DV_FL_CAN_REDUCE_FPS) \
+ }
+
+ #define V4L2_DV_BT_CEA_3840X2160P50 { \
+ .type = V4L2_DV_BT_656_1120, \
+- V4L2_INIT_BT_TIMINGS(3840, 2160, 0, V4L2_DV_HSYNC_POS_POL, \
++ V4L2_INIT_BT_TIMINGS(3840, 2160, 0, \
++ V4L2_DV_HSYNC_POS_POL | V4L2_DV_VSYNC_POS_POL, \
+ 594000000, 1056, 88, 296, 8, 10, 72, 0, 0, 0, \
+ V4L2_DV_BT_STD_CEA861, 0) \
+ }
+
+ #define V4L2_DV_BT_CEA_3840X2160P60 { \
+ .type = V4L2_DV_BT_656_1120, \
+- V4L2_INIT_BT_TIMINGS(3840, 2160, 0, V4L2_DV_HSYNC_POS_POL, \
++ V4L2_INIT_BT_TIMINGS(3840, 2160, 0, \
++ V4L2_DV_HSYNC_POS_POL | V4L2_DV_VSYNC_POS_POL, \
+ 594000000, 176, 88, 296, 8, 10, 72, 0, 0, 0, \
+ V4L2_DV_BT_STD_CEA861, V4L2_DV_FL_CAN_REDUCE_FPS) \
+ }
+
+ #define V4L2_DV_BT_CEA_4096X2160P24 { \
+ .type = V4L2_DV_BT_656_1120, \
+- V4L2_INIT_BT_TIMINGS(4096, 2160, 0, V4L2_DV_HSYNC_POS_POL, \
++ V4L2_INIT_BT_TIMINGS(4096, 2160, 0, \
++ V4L2_DV_HSYNC_POS_POL | V4L2_DV_VSYNC_POS_POL, \
+ 297000000, 1020, 88, 296, 8, 10, 72, 0, 0, 0, \
+ V4L2_DV_BT_STD_CEA861, V4L2_DV_FL_CAN_REDUCE_FPS) \
+ }
+
+ #define V4L2_DV_BT_CEA_4096X2160P25 { \
+ .type = V4L2_DV_BT_656_1120, \
+- V4L2_INIT_BT_TIMINGS(4096, 2160, 0, V4L2_DV_HSYNC_POS_POL, \
++ V4L2_INIT_BT_TIMINGS(4096, 2160, 0, \
++ V4L2_DV_HSYNC_POS_POL | V4L2_DV_VSYNC_POS_POL, \
+ 297000000, 968, 88, 128, 8, 10, 72, 0, 0, 0, \
+ V4L2_DV_BT_STD_CEA861, 0) \
+ }
+
+ #define V4L2_DV_BT_CEA_4096X2160P30 { \
+ .type = V4L2_DV_BT_656_1120, \
+- V4L2_INIT_BT_TIMINGS(4096, 2160, 0, V4L2_DV_HSYNC_POS_POL, \
++ V4L2_INIT_BT_TIMINGS(4096, 2160, 0, \
++ V4L2_DV_HSYNC_POS_POL | V4L2_DV_VSYNC_POS_POL, \
+ 297000000, 88, 88, 128, 8, 10, 72, 0, 0, 0, \
+ V4L2_DV_BT_STD_CEA861, V4L2_DV_FL_CAN_REDUCE_FPS) \
+ }
+
+ #define V4L2_DV_BT_CEA_4096X2160P50 { \
+ .type = V4L2_DV_BT_656_1120, \
+- V4L2_INIT_BT_TIMINGS(4096, 2160, 0, V4L2_DV_HSYNC_POS_POL, \
++ V4L2_INIT_BT_TIMINGS(4096, 2160, 0, \
++ V4L2_DV_HSYNC_POS_POL | V4L2_DV_VSYNC_POS_POL, \
+ 594000000, 968, 88, 128, 8, 10, 72, 0, 0, 0, \
+ V4L2_DV_BT_STD_CEA861, 0) \
+ }
+
+ #define V4L2_DV_BT_CEA_4096X2160P60 { \
+ .type = V4L2_DV_BT_656_1120, \
+- V4L2_INIT_BT_TIMINGS(4096, 2160, 0, V4L2_DV_HSYNC_POS_POL, \
++ V4L2_INIT_BT_TIMINGS(4096, 2160, 0, \
++ V4L2_DV_HSYNC_POS_POL | V4L2_DV_VSYNC_POS_POL, \
+ 594000000, 88, 88, 128, 8, 10, 72, 0, 0, 0, \
+ V4L2_DV_BT_STD_CEA861, V4L2_DV_FL_CAN_REDUCE_FPS) \
+ }
+diff --git a/kernel/time/timer.c b/kernel/time/timer.c
+index 3260ffdb368f..3c4e3116cdb1 100644
+--- a/kernel/time/timer.c
++++ b/kernel/time/timer.c
+@@ -956,13 +956,27 @@ EXPORT_SYMBOL(add_timer);
+ */
+ void add_timer_on(struct timer_list *timer, int cpu)
+ {
+- struct tvec_base *base = per_cpu(tvec_bases, cpu);
++ struct tvec_base *new_base = per_cpu(tvec_bases, cpu);
++ struct tvec_base *base;
+ unsigned long flags;
+
+ timer_stats_timer_set_start_info(timer);
+ BUG_ON(timer_pending(timer) || !timer->function);
+- spin_lock_irqsave(&base->lock, flags);
+- timer_set_base(timer, base);
++
++ /*
++ * If @timer was on a different CPU, it should be migrated with the
++ * old base locked to prevent other operations proceeding with the
++ * wrong base locked. See lock_timer_base().
++ */
++ base = lock_timer_base(timer, &flags);
++ if (base != new_base) {
++ timer_set_base(timer, NULL);
++ spin_unlock(&base->lock);
++ base = new_base;
++ spin_lock(&base->lock);
++ timer_set_base(timer, base);
++ }
++
+ debug_activate(timer, timer->expires);
+ internal_add_timer(base, timer);
+ spin_unlock_irqrestore(&base->lock, flags);
+diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c
+index b6cd1b653e21..51c47bc832d4 100644
+--- a/kernel/trace/trace_events.c
++++ b/kernel/trace/trace_events.c
+@@ -1584,8 +1584,13 @@ event_create_dir(struct dentry *parent, struct ftrace_event_file *file)
+ trace_create_file("filter", 0644, file->dir, file,
+ &ftrace_event_filter_fops);
+
+- trace_create_file("trigger", 0644, file->dir, file,
+- &event_trigger_fops);
++ /*
++ * Only event directories that can be enabled should have
++ * triggers.
++ */
++ if (!(call->flags & TRACE_EVENT_FL_IGNORE_ENABLE))
++ trace_create_file("trigger", 0644, file->dir, file,
++ &event_trigger_fops);
+
+ trace_create_file("format", 0444, file->dir, call,
+ &ftrace_event_format_fops);
+diff --git a/kernel/workqueue.c b/kernel/workqueue.c
+index 2273f534b01a..0963b7fbc9a6 100644
+--- a/kernel/workqueue.c
++++ b/kernel/workqueue.c
+@@ -623,6 +623,35 @@ static void set_work_pool_and_clear_pending(struct work_struct *work,
+ */
+ smp_wmb();
+ set_work_data(work, (unsigned long)pool_id << WORK_OFFQ_POOL_SHIFT, 0);
++ /*
++ * The following mb guarantees that previous clear of a PENDING bit
++ * will not be reordered with any speculative LOADS or STORES from
++ * work->current_func, which is executed afterwards. This possible
++ * reordering can lead to a missed execution on attempt to qeueue
++ * the same @work. E.g. consider this case:
++ *
++ * CPU#0 CPU#1
++ * ---------------------------- --------------------------------
++ *
++ * 1 STORE event_indicated
++ * 2 queue_work_on() {
++ * 3 test_and_set_bit(PENDING)
++ * 4 } set_..._and_clear_pending() {
++ * 5 set_work_data() # clear bit
++ * 6 smp_mb()
++ * 7 work->current_func() {
++ * 8 LOAD event_indicated
++ * }
++ *
++ * Without an explicit full barrier speculative LOAD on line 8 can
++ * be executed before CPU#0 does STORE on line 1. If that happens,
++ * CPU#0 observes the PENDING bit is still set and new execution of
++ * a @work is not queued in a hope, that CPU#1 will eventually
++ * finish the queued @work. Meanwhile CPU#1 does not see
++ * event_indicated is set, because speculative LOAD was executed
++ * before actual STORE.
++ */
++ smp_mb();
+ }
+
+ static void clear_work_data(struct work_struct *work)
+@@ -4513,6 +4542,17 @@ static void rebind_workers(struct worker_pool *pool)
+ pool->attrs->cpumask) < 0);
+
+ spin_lock_irq(&pool->lock);
++
++ /*
++ * XXX: CPU hotplug notifiers are weird and can call DOWN_FAILED
++ * w/o preceding DOWN_PREPARE. Work around it. CPU hotplug is
++ * being reworked and this can go away in time.
++ */
++ if (!(pool->flags & POOL_DISASSOCIATED)) {
++ spin_unlock_irq(&pool->lock);
++ return;
++ }
++
+ pool->flags &= ~POOL_DISASSOCIATED;
+
+ for_each_pool_worker(worker, pool) {
+diff --git a/mm/compaction.c b/mm/compaction.c
+index b47f08e159d4..8d010df763dc 100644
+--- a/mm/compaction.c
++++ b/mm/compaction.c
+@@ -784,16 +784,8 @@ isolate_migratepages_range(struct compact_control *cc, unsigned long start_pfn,
+ pfn = isolate_migratepages_block(cc, pfn, block_end_pfn,
+ ISOLATE_UNEVICTABLE);
+
+- /*
+- * In case of fatal failure, release everything that might
+- * have been isolated in the previous iteration, and signal
+- * the failure back to caller.
+- */
+- if (!pfn) {
+- putback_movable_pages(&cc->migratepages);
+- cc->nr_migratepages = 0;
++ if (!pfn)
+ break;
+- }
+
+ if (cc->nr_migratepages == COMPACT_CLUSTER_MAX)
+ break;
+diff --git a/mm/huge_memory.c b/mm/huge_memory.c
+index de984159cf0b..2e39d4e0ff09 100644
+--- a/mm/huge_memory.c
++++ b/mm/huge_memory.c
+@@ -2081,10 +2081,9 @@ int khugepaged_enter_vma_merge(struct vm_area_struct *vma,
+ * page fault if needed.
+ */
+ return 0;
+- if (vma->vm_ops)
++ if (vma->vm_ops || (vm_flags & VM_NO_THP))
+ /* khugepaged not yet working on file or special mappings */
+ return 0;
+- VM_BUG_ON_VMA(vm_flags & VM_NO_THP, vma);
+ hstart = (vma->vm_start + ~HPAGE_PMD_MASK) & HPAGE_PMD_MASK;
+ hend = vma->vm_end & HPAGE_PMD_MASK;
+ if (hstart < hend)
+@@ -2407,8 +2406,7 @@ static bool hugepage_vma_check(struct vm_area_struct *vma)
+ return false;
+ if (is_vma_temporary_stack(vma))
+ return false;
+- VM_BUG_ON_VMA(vma->vm_flags & VM_NO_THP, vma);
+- return true;
++ return !(vma->vm_flags & VM_NO_THP);
+ }
+
+ static void collapse_huge_page(struct mm_struct *mm,
+diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
+index c5880124ec0d..98cd0e78c94c 100644
+--- a/net/netfilter/nf_conntrack_core.c
++++ b/net/netfilter/nf_conntrack_core.c
+@@ -1739,6 +1739,7 @@ void nf_conntrack_init_end(void)
+
+ int nf_conntrack_init_net(struct net *net)
+ {
++ static atomic64_t unique_id;
+ int ret = -ENOMEM;
+ int cpu;
+
+@@ -1762,7 +1763,8 @@ int nf_conntrack_init_net(struct net *net)
+ if (!net->ct.stat)
+ goto err_pcpu_lists;
+
+- net->ct.slabname = kasprintf(GFP_KERNEL, "nf_conntrack_%p", net);
++ net->ct.slabname = kasprintf(GFP_KERNEL, "nf_conntrack_%llu",
++ (u64)atomic64_inc_return(&unique_id));
+ if (!net->ct.slabname)
+ goto err_slabname;
+
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index c3c8337c4ea2..4a69d6f1b8ef 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -5413,6 +5413,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x17aa, 0x5034, "Thinkpad T450", ALC292_FIXUP_TPT440_DOCK),
+ SND_PCI_QUIRK(0x17aa, 0x5036, "Thinkpad T450s", ALC292_FIXUP_TPT440_DOCK),
+ SND_PCI_QUIRK(0x17aa, 0x503c, "Thinkpad L450", ALC292_FIXUP_TPT440_DOCK),
++ SND_PCI_QUIRK(0x17aa, 0x504a, "ThinkPad X260", ALC292_FIXUP_TPT440_DOCK),
+ SND_PCI_QUIRK(0x17aa, 0x504b, "Thinkpad", ALC293_FIXUP_LENOVO_SPK_NOISE),
+ SND_PCI_QUIRK(0x17aa, 0x5109, "Thinkpad", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
+ SND_PCI_QUIRK(0x17aa, 0x3bf8, "Quanta FL1", ALC269_FIXUP_PCM_44K),
+@@ -6391,6 +6392,8 @@ enum {
+ ALC668_FIXUP_AUTO_MUTE,
+ ALC668_FIXUP_DELL_DISABLE_AAMIX,
+ ALC668_FIXUP_DELL_XPS13,
++ ALC662_FIXUP_ASUS_Nx50,
++ ALC668_FIXUP_ASUS_Nx51,
+ };
+
+ static const struct hda_fixup alc662_fixups[] = {
+@@ -6631,6 +6634,21 @@ static const struct hda_fixup alc662_fixups[] = {
+ .type = HDA_FIXUP_FUNC,
+ .v.func = alc_fixup_bass_chmap,
+ },
++ [ALC662_FIXUP_ASUS_Nx50] = {
++ .type = HDA_FIXUP_FUNC,
++ .v.func = alc_fixup_auto_mute_via_amp,
++ .chained = true,
++ .chain_id = ALC662_FIXUP_BASS_1A
++ },
++ [ALC668_FIXUP_ASUS_Nx51] = {
++ .type = HDA_FIXUP_PINS,
++ .v.pins = (const struct hda_pintbl[]) {
++ {0x1a, 0x90170151}, /* bass speaker */
++ {}
++ },
++ .chained = true,
++ .chain_id = ALC662_FIXUP_BASS_CHMAP,
++ },
+ };
+
+ static const struct snd_pci_quirk alc662_fixup_tbl[] = {
+@@ -6651,9 +6669,14 @@ static const struct snd_pci_quirk alc662_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1028, 0x0698, "Dell", ALC668_FIXUP_DELL_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1028, 0x069f, "Dell", ALC668_FIXUP_DELL_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x103c, 0x1632, "HP RP5800", ALC662_FIXUP_HP_RP5800),
+- SND_PCI_QUIRK(0x1043, 0x11cd, "Asus N550", ALC662_FIXUP_BASS_1A),
++ SND_PCI_QUIRK(0x1043, 0x1080, "Asus UX501VW", ALC668_FIXUP_HEADSET_MODE),
++ SND_PCI_QUIRK(0x1043, 0x11cd, "Asus N550", ALC662_FIXUP_ASUS_Nx50),
++ SND_PCI_QUIRK(0x1043, 0x13df, "Asus N550JX", ALC662_FIXUP_BASS_1A),
++ SND_PCI_QUIRK(0x1043, 0x129d, "Asus N750", ALC662_FIXUP_ASUS_Nx50),
+ SND_PCI_QUIRK(0x1043, 0x1477, "ASUS N56VZ", ALC662_FIXUP_BASS_MODE4_CHMAP),
+ SND_PCI_QUIRK(0x1043, 0x15a7, "ASUS UX51VZH", ALC662_FIXUP_BASS_16),
++ SND_PCI_QUIRK(0x1043, 0x177d, "ASUS N551", ALC668_FIXUP_ASUS_Nx51),
++ SND_PCI_QUIRK(0x1043, 0x17bd, "ASUS N751", ALC668_FIXUP_ASUS_Nx51),
+ SND_PCI_QUIRK(0x1043, 0x1b73, "ASUS N55SF", ALC662_FIXUP_BASS_16),
+ SND_PCI_QUIRK(0x1043, 0x1bf3, "ASUS N76VZ", ALC662_FIXUP_BASS_MODE4_CHMAP),
+ SND_PCI_QUIRK(0x1043, 0x8469, "ASUS mobo", ALC662_FIXUP_NO_JACK_DETECT),
+diff --git a/sound/soc/codecs/rt5640.c b/sound/soc/codecs/rt5640.c
+index c3f2decd643c..607c758febd8 100644
+--- a/sound/soc/codecs/rt5640.c
++++ b/sound/soc/codecs/rt5640.c
+@@ -361,7 +361,7 @@ static unsigned int bst_tlv[] = {
+
+ /* Interface data select */
+ static const char * const rt5640_data_select[] = {
+- "Normal", "left copy to right", "right copy to left", "Swap"};
++ "Normal", "Swap", "left copy to right", "right copy to left"};
+
+ static SOC_ENUM_SINGLE_DECL(rt5640_if1_dac_enum, RT5640_DIG_INF_DATA,
+ RT5640_IF1_DAC_SEL_SFT, rt5640_data_select);
+diff --git a/sound/soc/codecs/rt5640.h b/sound/soc/codecs/rt5640.h
+index 3deb8babeabb..243f42633989 100644
+--- a/sound/soc/codecs/rt5640.h
++++ b/sound/soc/codecs/rt5640.h
+@@ -442,39 +442,39 @@
+ #define RT5640_IF1_DAC_SEL_MASK (0x3 << 14)
+ #define RT5640_IF1_DAC_SEL_SFT 14
+ #define RT5640_IF1_DAC_SEL_NOR (0x0 << 14)
+-#define RT5640_IF1_DAC_SEL_L2R (0x1 << 14)
+-#define RT5640_IF1_DAC_SEL_R2L (0x2 << 14)
+-#define RT5640_IF1_DAC_SEL_SWAP (0x3 << 14)
++#define RT5640_IF1_DAC_SEL_SWAP (0x1 << 14)
++#define RT5640_IF1_DAC_SEL_L2R (0x2 << 14)
++#define RT5640_IF1_DAC_SEL_R2L (0x3 << 14)
+ #define RT5640_IF1_ADC_SEL_MASK (0x3 << 12)
+ #define RT5640_IF1_ADC_SEL_SFT 12
+ #define RT5640_IF1_ADC_SEL_NOR (0x0 << 12)
+-#define RT5640_IF1_ADC_SEL_L2R (0x1 << 12)
+-#define RT5640_IF1_ADC_SEL_R2L (0x2 << 12)
+-#define RT5640_IF1_ADC_SEL_SWAP (0x3 << 12)
++#define RT5640_IF1_ADC_SEL_SWAP (0x1 << 12)
++#define RT5640_IF1_ADC_SEL_L2R (0x2 << 12)
++#define RT5640_IF1_ADC_SEL_R2L (0x3 << 12)
+ #define RT5640_IF2_DAC_SEL_MASK (0x3 << 10)
+ #define RT5640_IF2_DAC_SEL_SFT 10
+ #define RT5640_IF2_DAC_SEL_NOR (0x0 << 10)
+-#define RT5640_IF2_DAC_SEL_L2R (0x1 << 10)
+-#define RT5640_IF2_DAC_SEL_R2L (0x2 << 10)
+-#define RT5640_IF2_DAC_SEL_SWAP (0x3 << 10)
++#define RT5640_IF2_DAC_SEL_SWAP (0x1 << 10)
++#define RT5640_IF2_DAC_SEL_L2R (0x2 << 10)
++#define RT5640_IF2_DAC_SEL_R2L (0x3 << 10)
+ #define RT5640_IF2_ADC_SEL_MASK (0x3 << 8)
+ #define RT5640_IF2_ADC_SEL_SFT 8
+ #define RT5640_IF2_ADC_SEL_NOR (0x0 << 8)
+-#define RT5640_IF2_ADC_SEL_L2R (0x1 << 8)
+-#define RT5640_IF2_ADC_SEL_R2L (0x2 << 8)
+-#define RT5640_IF2_ADC_SEL_SWAP (0x3 << 8)
++#define RT5640_IF2_ADC_SEL_SWAP (0x1 << 8)
++#define RT5640_IF2_ADC_SEL_L2R (0x2 << 8)
++#define RT5640_IF2_ADC_SEL_R2L (0x3 << 8)
+ #define RT5640_IF3_DAC_SEL_MASK (0x3 << 6)
+ #define RT5640_IF3_DAC_SEL_SFT 6
+ #define RT5640_IF3_DAC_SEL_NOR (0x0 << 6)
+-#define RT5640_IF3_DAC_SEL_L2R (0x1 << 6)
+-#define RT5640_IF3_DAC_SEL_R2L (0x2 << 6)
+-#define RT5640_IF3_DAC_SEL_SWAP (0x3 << 6)
++#define RT5640_IF3_DAC_SEL_SWAP (0x1 << 6)
++#define RT5640_IF3_DAC_SEL_L2R (0x2 << 6)
++#define RT5640_IF3_DAC_SEL_R2L (0x3 << 6)
+ #define RT5640_IF3_ADC_SEL_MASK (0x3 << 4)
+ #define RT5640_IF3_ADC_SEL_SFT 4
+ #define RT5640_IF3_ADC_SEL_NOR (0x0 << 4)
+-#define RT5640_IF3_ADC_SEL_L2R (0x1 << 4)
+-#define RT5640_IF3_ADC_SEL_R2L (0x2 << 4)
+-#define RT5640_IF3_ADC_SEL_SWAP (0x3 << 4)
++#define RT5640_IF3_ADC_SEL_SWAP (0x1 << 4)
++#define RT5640_IF3_ADC_SEL_L2R (0x2 << 4)
++#define RT5640_IF3_ADC_SEL_R2L (0x3 << 4)
+
+ /* REC Left Mixer Control 1 (0x3b) */
+ #define RT5640_G_HP_L_RM_L_MASK (0x7 << 13)
+diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
+index c7f5ff4d8f98..982c2df6d0b5 100644
+--- a/sound/usb/quirks.c
++++ b/sound/usb/quirks.c
+@@ -1121,8 +1121,11 @@ bool snd_usb_get_sample_rate_quirk(struct snd_usb_audio *chip)
+ case USB_ID(0x047F, 0x0415): /* Plantronics BT-300 */
+ case USB_ID(0x047F, 0xAA05): /* Plantronics DA45 */
+ case USB_ID(0x04D8, 0xFEEA): /* Benchmark DAC1 Pre */
++ case USB_ID(0x0556, 0x0014): /* Phoenix Audio TMX320VC */
+ case USB_ID(0x074D, 0x3553): /* Outlaw RR2150 (Micronas UAC3553B) */
++ case USB_ID(0x1de7, 0x0013): /* Phoenix Audio MT202exe */
+ case USB_ID(0x1de7, 0x0014): /* Phoenix Audio TMX320 */
++ case USB_ID(0x1de7, 0x0114): /* Phoenix Audio MT202pcs */
+ case USB_ID(0x21B4, 0x0081): /* AudioQuest DragonFly */
+ return true;
+ }
+diff --git a/tools/lib/traceevent/parse-filter.c b/tools/lib/traceevent/parse-filter.c
+index b50234402fc2..88cccea3ca99 100644
+--- a/tools/lib/traceevent/parse-filter.c
++++ b/tools/lib/traceevent/parse-filter.c
+@@ -1058,6 +1058,7 @@ process_filter(struct event_format *event, struct filter_arg **parg,
+ *parg = current_op;
+ else
+ *parg = current_exp;
++ free(token);
+ return PEVENT_ERRNO__UNBALANCED_PAREN;
+ }
+ break;
+@@ -1163,11 +1164,12 @@ process_filter(struct event_format *event, struct filter_arg **parg,
+ current_op = current_exp;
+
+ ret = collapse_tree(current_op, parg, error_str);
++ /* collapse_tree() may free current_op, and updates parg accordingly */
++ current_op = NULL;
+ if (ret < 0)
+ goto fail;
+
+- *parg = current_op;
+-
++ free(token);
+ return 0;
+
+ fail_alloc:
^ permalink raw reply related [flat|nested] 67+ messages in thread
* [gentoo-commits] proj/linux-patches:3.18 commit in: /
@ 2016-06-08 11:20 Mike Pagano
0 siblings, 0 replies; 67+ messages in thread
From: Mike Pagano @ 2016-06-08 11:20 UTC (permalink / raw
To: gentoo-commits
commit: fd2734bce6708d405a02613c10722ddd8f0a1857
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed Jun 8 11:20:10 2016 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed Jun 8 11:20:10 2016 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=fd2734bc
Linux patch 3.18.35
0000_README | 4 +
1034_linux-3.18.35.patch | 4097 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 4101 insertions(+)
diff --git a/0000_README b/0000_README
index a6bf155..0ce5fde 100644
--- a/0000_README
+++ b/0000_README
@@ -179,6 +179,10 @@ Patch: 1033_linux-3.18.34.patch
From: http://www.kernel.org
Desc: Linux 3.18.34
+Patch: 1034_linux-3.18.35.patch
+From: http://www.kernel.org
+Desc: Linux 3.18.35
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1034_linux-3.18.35.patch b/1034_linux-3.18.35.patch
new file mode 100644
index 0000000..e7bfc48
--- /dev/null
+++ b/1034_linux-3.18.35.patch
@@ -0,0 +1,4097 @@
+diff --git a/Documentation/devicetree/bindings/crypto/samsung-sss.txt b/Documentation/devicetree/bindings/crypto/samsung-sss.txt
+index a6dafa83c6df..7a5ca56683cc 100644
+--- a/Documentation/devicetree/bindings/crypto/samsung-sss.txt
++++ b/Documentation/devicetree/bindings/crypto/samsung-sss.txt
+@@ -23,10 +23,8 @@ Required properties:
+ - "samsung,exynos4210-secss" for Exynos4210, Exynos4212, Exynos4412, Exynos5250,
+ Exynos5260 and Exynos5420 SoCs.
+ - reg : Offset and length of the register set for the module
+-- interrupts : interrupt specifiers of SSS module interrupts, should contain
+- following entries:
+- - first : feed control interrupt (required for all variants),
+- - second : hash interrupt (required only for samsung,s5pv210-secss).
++- interrupts : interrupt specifiers of SSS module interrupts (one feed
++ control interrupt).
+
+ - clocks : list of clock phandle and specifier pairs for all clocks listed in
+ clock-names property.
+diff --git a/Makefile b/Makefile
+index 0df57f0a9e11..3ba252c1b187 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 18
+-SUBLEVEL = 34
++SUBLEVEL = 35
+ EXTRAVERSION =
+ NAME = Diseased Newt
+
+@@ -376,7 +376,7 @@ AFLAGS_MODULE =
+ LDFLAGS_MODULE =
+ CFLAGS_KERNEL =
+ AFLAGS_KERNEL =
+-CFLAGS_GCOV = -fprofile-arcs -ftest-coverage
++CFLAGS_GCOV = -fprofile-arcs -ftest-coverage -fno-tree-loop-im
+
+
+ # Use USERINCLUDE when you must reference the UAPI directories only.
+@@ -686,9 +686,10 @@ KBUILD_CFLAGS += $(call cc-option, -mno-global-merge,)
+ KBUILD_CFLAGS += $(call cc-option, -fcatch-undefined-behavior)
+ else
+
+-# This warning generated too much noise in a regular build.
+-# Use make W=1 to enable this warning (see scripts/Makefile.build)
++# These warnings generated too much noise in a regular build.
++# Use make W=1 to enable them (see scripts/Makefile.build)
+ KBUILD_CFLAGS += $(call cc-disable-warning, unused-but-set-variable)
++KBUILD_CFLAGS += $(call cc-disable-warning, unused-const-variable)
+ endif
+
+ ifdef CONFIG_FRAME_POINTER
+diff --git a/arch/arm/kvm/mmu.c b/arch/arm/kvm/mmu.c
+index 3535480e0e6b..0310b03697e0 100644
+--- a/arch/arm/kvm/mmu.c
++++ b/arch/arm/kvm/mmu.c
+@@ -841,11 +841,14 @@ static int stage2_set_pmd_huge(struct kvm *kvm, struct kvm_mmu_memory_cache
+ VM_BUG_ON(pmd_present(*pmd) && pmd_pfn(*pmd) != pmd_pfn(*new_pmd));
+
+ old_pmd = *pmd;
+- kvm_set_pmd(pmd, *new_pmd);
+- if (pmd_present(old_pmd))
++ if (pmd_present(old_pmd)) {
++ pmd_clear(pmd);
+ kvm_tlb_flush_vmid_ipa(kvm, addr);
+- else
++ } else {
+ get_page(virt_to_page(pmd));
++ }
++
++ kvm_set_pmd(pmd, *new_pmd);
+ return 0;
+ }
+
+@@ -882,12 +885,14 @@ static int stage2_set_pte(struct kvm *kvm, struct kvm_mmu_memory_cache *cache,
+
+ /* Create 2nd stage page table mapping - Level 3 */
+ old_pte = *pte;
+- kvm_set_pte(pte, *new_pte);
+- if (pte_present(old_pte))
++ if (pte_present(old_pte)) {
++ kvm_set_pte(pte, __pte(0));
+ kvm_tlb_flush_vmid_ipa(kvm, addr);
+- else
++ } else {
+ get_page(virt_to_page(pte));
++ }
+
++ kvm_set_pte(pte, *new_pte);
+ return 0;
+ }
+
+diff --git a/arch/arm64/include/asm/pgtable-hwdef.h b/arch/arm64/include/asm/pgtable-hwdef.h
+index 88174e0bfafe..31e6b0477e60 100644
+--- a/arch/arm64/include/asm/pgtable-hwdef.h
++++ b/arch/arm64/include/asm/pgtable-hwdef.h
+@@ -77,7 +77,6 @@
+ * Section
+ */
+ #define PMD_SECT_VALID (_AT(pmdval_t, 1) << 0)
+-#define PMD_SECT_PROT_NONE (_AT(pmdval_t, 1) << 58)
+ #define PMD_SECT_USER (_AT(pmdval_t, 1) << 6) /* AP[1] */
+ #define PMD_SECT_RDONLY (_AT(pmdval_t, 1) << 7) /* AP[2] */
+ #define PMD_SECT_S (_AT(pmdval_t, 3) << 8)
+diff --git a/arch/arm64/include/asm/pgtable.h b/arch/arm64/include/asm/pgtable.h
+index fba3e59e0c78..1dcbde6036a8 100644
+--- a/arch/arm64/include/asm/pgtable.h
++++ b/arch/arm64/include/asm/pgtable.h
+@@ -281,6 +281,8 @@ void pmdp_splitting_flush(struct vm_area_struct *vma, unsigned long address,
+ #endif /* CONFIG_HAVE_RCU_TABLE_FREE */
+ #endif /* CONFIG_TRANSPARENT_HUGEPAGE */
+
++#define pmd_present(pmd) pte_present(pmd_pte(pmd))
++#define pmd_dirty(pmd) pte_dirty(pmd_pte(pmd))
+ #define pmd_young(pmd) pte_young(pmd_pte(pmd))
+ #define pmd_wrprotect(pmd) pte_pmd(pte_wrprotect(pmd_pte(pmd)))
+ #define pmd_mksplitting(pmd) pte_pmd(pte_mkspecial(pmd_pte(pmd)))
+@@ -288,7 +290,7 @@ void pmdp_splitting_flush(struct vm_area_struct *vma, unsigned long address,
+ #define pmd_mkwrite(pmd) pte_pmd(pte_mkwrite(pmd_pte(pmd)))
+ #define pmd_mkdirty(pmd) pte_pmd(pte_mkdirty(pmd_pte(pmd)))
+ #define pmd_mkyoung(pmd) pte_pmd(pte_mkyoung(pmd_pte(pmd)))
+-#define pmd_mknotpresent(pmd) (__pmd(pmd_val(pmd) & ~PMD_TYPE_MASK))
++#define pmd_mknotpresent(pmd) (__pmd(pmd_val(pmd) & ~PMD_SECT_VALID))
+
+ #define __HAVE_ARCH_PMD_WRITE
+ #define pmd_write(pmd) pte_write(pmd_pte(pmd))
+@@ -328,7 +330,6 @@ extern pgprot_t phys_mem_access_prot(struct file *file, unsigned long pfn,
+ unsigned long size, pgprot_t vma_prot);
+
+ #define pmd_none(pmd) (!pmd_val(pmd))
+-#define pmd_present(pmd) (pmd_val(pmd))
+
+ #define pmd_bad(pmd) (!(pmd_val(pmd) & 2))
+
+diff --git a/arch/mips/ath79/early_printk.c b/arch/mips/ath79/early_printk.c
+index b955fafc58ba..d1adc59af5bf 100644
+--- a/arch/mips/ath79/early_printk.c
++++ b/arch/mips/ath79/early_printk.c
+@@ -31,13 +31,15 @@ static inline void prom_putchar_wait(void __iomem *reg, u32 mask, u32 val)
+ } while (1);
+ }
+
++#define BOTH_EMPTY (UART_LSR_TEMT | UART_LSR_THRE)
++
+ static void prom_putchar_ar71xx(unsigned char ch)
+ {
+ void __iomem *base = (void __iomem *)(KSEG1ADDR(AR71XX_UART_BASE));
+
+- prom_putchar_wait(base + UART_LSR * 4, UART_LSR_THRE, UART_LSR_THRE);
++ prom_putchar_wait(base + UART_LSR * 4, BOTH_EMPTY, BOTH_EMPTY);
+ __raw_writel(ch, base + UART_TX * 4);
+- prom_putchar_wait(base + UART_LSR * 4, UART_LSR_THRE, UART_LSR_THRE);
++ prom_putchar_wait(base + UART_LSR * 4, BOTH_EMPTY, BOTH_EMPTY);
+ }
+
+ static void prom_putchar_ar933x(unsigned char ch)
+diff --git a/arch/mips/include/asm/kvm_host.h b/arch/mips/include/asm/kvm_host.h
+index 4e3205a3bee2..1616b56eadfe 100644
+--- a/arch/mips/include/asm/kvm_host.h
++++ b/arch/mips/include/asm/kvm_host.h
+@@ -717,7 +717,7 @@ extern enum emulation_result kvm_mips_complete_mmio_load(struct kvm_vcpu *vcpu,
+
+ uint32_t kvm_mips_read_count(struct kvm_vcpu *vcpu);
+ void kvm_mips_write_count(struct kvm_vcpu *vcpu, uint32_t count);
+-void kvm_mips_write_compare(struct kvm_vcpu *vcpu, uint32_t compare);
++void kvm_mips_write_compare(struct kvm_vcpu *vcpu, uint32_t compare, bool ack);
+ void kvm_mips_init_count(struct kvm_vcpu *vcpu);
+ int kvm_mips_set_count_ctl(struct kvm_vcpu *vcpu, s64 count_ctl);
+ int kvm_mips_set_count_resume(struct kvm_vcpu *vcpu, s64 count_resume);
+diff --git a/arch/mips/include/asm/msa.h b/arch/mips/include/asm/msa.h
+index af5638b12c75..38bbeda8644c 100644
+--- a/arch/mips/include/asm/msa.h
++++ b/arch/mips/include/asm/msa.h
+@@ -67,6 +67,19 @@ static inline void restore_msa(struct task_struct *t)
+ _restore_msa(t);
+ }
+
++static inline void init_msa_upper(void)
++{
++ /*
++ * Check cpu_has_msa only if it's a constant. This will allow the
++ * compiler to optimise out code for CPUs without MSA without adding
++ * an extra redundant check for CPUs with MSA.
++ */
++ if (__builtin_constant_p(cpu_has_msa) && !cpu_has_msa)
++ return;
++
++ _init_msa_upper();
++}
++
+ #ifdef TOOLCHAIN_SUPPORTS_MSA
+
+ #define __BUILD_MSA_CTL_REG(name, cs) \
+diff --git a/arch/mips/include/uapi/asm/siginfo.h b/arch/mips/include/uapi/asm/siginfo.h
+index e81174432bab..6e1218ae916c 100644
+--- a/arch/mips/include/uapi/asm/siginfo.h
++++ b/arch/mips/include/uapi/asm/siginfo.h
+@@ -48,13 +48,13 @@ typedef struct siginfo {
+
+ /* kill() */
+ struct {
+- pid_t _pid; /* sender's pid */
++ __kernel_pid_t _pid; /* sender's pid */
+ __ARCH_SI_UID_T _uid; /* sender's uid */
+ } _kill;
+
+ /* POSIX.1b timers */
+ struct {
+- timer_t _tid; /* timer id */
++ __kernel_timer_t _tid; /* timer id */
+ int _overrun; /* overrun count */
+ char _pad[sizeof( __ARCH_SI_UID_T) - sizeof(int)];
+ sigval_t _sigval; /* same as below */
+@@ -63,26 +63,26 @@ typedef struct siginfo {
+
+ /* POSIX.1b signals */
+ struct {
+- pid_t _pid; /* sender's pid */
++ __kernel_pid_t _pid; /* sender's pid */
+ __ARCH_SI_UID_T _uid; /* sender's uid */
+ sigval_t _sigval;
+ } _rt;
+
+ /* SIGCHLD */
+ struct {
+- pid_t _pid; /* which child */
++ __kernel_pid_t _pid; /* which child */
+ __ARCH_SI_UID_T _uid; /* sender's uid */
+ int _status; /* exit code */
+- clock_t _utime;
+- clock_t _stime;
++ __kernel_clock_t _utime;
++ __kernel_clock_t _stime;
+ } _sigchld;
+
+ /* IRIX SIGCHLD */
+ struct {
+- pid_t _pid; /* which child */
+- clock_t _utime;
++ __kernel_pid_t _pid; /* which child */
++ __kernel_clock_t _utime;
+ int _status; /* exit code */
+- clock_t _stime;
++ __kernel_clock_t _stime;
+ } _irix_sigchld;
+
+ /* SIGILL, SIGFPE, SIGSEGV, SIGBUS */
+diff --git a/arch/mips/kernel/process.c b/arch/mips/kernel/process.c
+index 636b0745d7c7..7d09efd25b56 100644
+--- a/arch/mips/kernel/process.c
++++ b/arch/mips/kernel/process.c
+@@ -437,7 +437,7 @@ unsigned long notrace unwind_stack_by_address(unsigned long stack_page,
+ *sp + sizeof(*regs) <= stack_page + THREAD_SIZE - 32) {
+ regs = (struct pt_regs *)*sp;
+ pc = regs->cp0_epc;
+- if (__kernel_text_address(pc)) {
++ if (!user_mode(regs) && __kernel_text_address(pc)) {
+ *sp = regs->regs[29];
+ *ra = regs->regs[31];
+ return pc;
+diff --git a/arch/mips/kernel/traps.c b/arch/mips/kernel/traps.c
+index 2012a5a3055b..aaa64429ea4f 100644
+--- a/arch/mips/kernel/traps.c
++++ b/arch/mips/kernel/traps.c
+@@ -141,7 +141,7 @@ static void show_backtrace(struct task_struct *task, const struct pt_regs *regs)
+ if (!task)
+ task = current;
+
+- if (raw_show_trace || !__kernel_text_address(pc)) {
++ if (raw_show_trace || user_mode(regs) || !__kernel_text_address(pc)) {
+ show_raw_backtrace(sp);
+ return;
+ }
+@@ -1103,7 +1103,7 @@ static int enable_restore_fp_context(int msa)
+ err = init_fpu();
+ if (msa && !err) {
+ enable_msa();
+- _init_msa_upper();
++ init_msa_upper();
+ set_thread_flag(TIF_USEDMSA);
+ set_thread_flag(TIF_MSA_CTX_LIVE);
+ }
+@@ -1166,7 +1166,7 @@ static int enable_restore_fp_context(int msa)
+ */
+ prior_msa = test_and_set_thread_flag(TIF_MSA_CTX_LIVE);
+ if (!prior_msa && was_fpu_owner) {
+- _init_msa_upper();
++ init_msa_upper();
+
+ goto out;
+ }
+@@ -1183,7 +1183,7 @@ static int enable_restore_fp_context(int msa)
+ * of each vector register such that it cannot see data left
+ * behind by another task.
+ */
+- _init_msa_upper();
++ init_msa_upper();
+ } else {
+ /* We need to restore the vector context. */
+ restore_msa(current);
+diff --git a/arch/mips/kvm/emulate.c b/arch/mips/kvm/emulate.c
+index 838d3a6a5b7d..824be0da92cd 100644
+--- a/arch/mips/kvm/emulate.c
++++ b/arch/mips/kvm/emulate.c
+@@ -302,12 +302,31 @@ static inline ktime_t kvm_mips_count_time(struct kvm_vcpu *vcpu)
+ */
+ static uint32_t kvm_mips_read_count_running(struct kvm_vcpu *vcpu, ktime_t now)
+ {
+- ktime_t expires;
++ struct mips_coproc *cop0 = vcpu->arch.cop0;
++ ktime_t expires, threshold;
++ uint32_t count, compare;
+ int running;
+
+- /* Is the hrtimer pending? */
++ /* Calculate the biased and scaled guest CP0_Count */
++ count = vcpu->arch.count_bias + kvm_mips_ktime_to_count(vcpu, now);
++ compare = kvm_read_c0_guest_compare(cop0);
++
++ /*
++ * Find whether CP0_Count has reached the closest timer interrupt. If
++ * not, we shouldn't inject it.
++ */
++ if ((int32_t)(count - compare) < 0)
++ return count;
++
++ /*
++ * The CP0_Count we're going to return has already reached the closest
++ * timer interrupt. Quickly check if it really is a new interrupt by
++ * looking at whether the interval until the hrtimer expiry time is
++ * less than 1/4 of the timer period.
++ */
+ expires = hrtimer_get_expires(&vcpu->arch.comparecount_timer);
+- if (ktime_compare(now, expires) >= 0) {
++ threshold = ktime_add_ns(now, vcpu->arch.count_period / 4);
++ if (ktime_before(expires, threshold)) {
+ /*
+ * Cancel it while we handle it so there's no chance of
+ * interference with the timeout handler.
+@@ -329,8 +348,7 @@ static uint32_t kvm_mips_read_count_running(struct kvm_vcpu *vcpu, ktime_t now)
+ }
+ }
+
+- /* Return the biased and scaled guest CP0_Count */
+- return vcpu->arch.count_bias + kvm_mips_ktime_to_count(vcpu, now);
++ return count;
+ }
+
+ /**
+@@ -420,32 +438,6 @@ static void kvm_mips_resume_hrtimer(struct kvm_vcpu *vcpu,
+ }
+
+ /**
+- * kvm_mips_update_hrtimer() - Update next expiry time of hrtimer.
+- * @vcpu: Virtual CPU.
+- *
+- * Recalculates and updates the expiry time of the hrtimer. This can be used
+- * after timer parameters have been altered which do not depend on the time that
+- * the change occurs (in those cases kvm_mips_freeze_hrtimer() and
+- * kvm_mips_resume_hrtimer() are used directly).
+- *
+- * It is guaranteed that no timer interrupts will be lost in the process.
+- *
+- * Assumes !kvm_mips_count_disabled(@vcpu) (guest CP0_Count timer is running).
+- */
+-static void kvm_mips_update_hrtimer(struct kvm_vcpu *vcpu)
+-{
+- ktime_t now;
+- uint32_t count;
+-
+- /*
+- * freeze_hrtimer takes care of a timer interrupts <= count, and
+- * resume_hrtimer the hrtimer takes care of a timer interrupts > count.
+- */
+- now = kvm_mips_freeze_hrtimer(vcpu, &count);
+- kvm_mips_resume_hrtimer(vcpu, now, count);
+-}
+-
+-/**
+ * kvm_mips_write_count() - Modify the count and update timer.
+ * @vcpu: Virtual CPU.
+ * @count: Guest CP0_Count value to set.
+@@ -540,23 +532,42 @@ int kvm_mips_set_count_hz(struct kvm_vcpu *vcpu, s64 count_hz)
+ * kvm_mips_write_compare() - Modify compare and update timer.
+ * @vcpu: Virtual CPU.
+ * @compare: New CP0_Compare value.
++ * @ack: Whether to acknowledge timer interrupt.
+ *
+ * Update CP0_Compare to a new value and update the timeout.
++ * If @ack, atomically acknowledge any pending timer interrupt, otherwise ensure
++ * any pending timer interrupt is preserved.
+ */
+-void kvm_mips_write_compare(struct kvm_vcpu *vcpu, uint32_t compare)
++void kvm_mips_write_compare(struct kvm_vcpu *vcpu, uint32_t compare, bool ack)
+ {
+ struct mips_coproc *cop0 = vcpu->arch.cop0;
++ int dc;
++ u32 old_compare = kvm_read_c0_guest_compare(cop0);
++ ktime_t now;
++ uint32_t count;
+
+ /* if unchanged, must just be an ack */
+- if (kvm_read_c0_guest_compare(cop0) == compare)
++ if (old_compare == compare) {
++ if (!ack)
++ return;
++ kvm_mips_callbacks->dequeue_timer_int(vcpu);
++ kvm_write_c0_guest_compare(cop0, compare);
+ return;
++ }
++
++ /* freeze_hrtimer() takes care of timer interrupts <= count */
++ dc = kvm_mips_count_disabled(vcpu);
++ if (!dc)
++ now = kvm_mips_freeze_hrtimer(vcpu, &count);
++
++ if (ack)
++ kvm_mips_callbacks->dequeue_timer_int(vcpu);
+
+- /* Update compare */
+ kvm_write_c0_guest_compare(cop0, compare);
+
+- /* Update timeout if count enabled */
+- if (!kvm_mips_count_disabled(vcpu))
+- kvm_mips_update_hrtimer(vcpu);
++ /* resume_hrtimer() takes care of timer interrupts > count */
++ if (!dc)
++ kvm_mips_resume_hrtimer(vcpu, now, count);
+ }
+
+ /**
+@@ -1017,9 +1028,9 @@ enum emulation_result kvm_mips_emulate_CP0(uint32_t inst, uint32_t *opc,
+
+ /* If we are writing to COMPARE */
+ /* Clear pending timer interrupt, if any */
+- kvm_mips_callbacks->dequeue_timer_int(vcpu);
+ kvm_mips_write_compare(vcpu,
+- vcpu->arch.gprs[rt]);
++ vcpu->arch.gprs[rt],
++ true);
+ } else if ((rd == MIPS_CP0_STATUS) && (sel == 0)) {
+ kvm_write_c0_guest_status(cop0,
+ vcpu->arch.gprs[rt]);
+diff --git a/arch/mips/kvm/trap_emul.c b/arch/mips/kvm/trap_emul.c
+index 4372cc86650c..9bf7b2b83956 100644
+--- a/arch/mips/kvm/trap_emul.c
++++ b/arch/mips/kvm/trap_emul.c
+@@ -449,7 +449,7 @@ static int kvm_trap_emul_set_one_reg(struct kvm_vcpu *vcpu,
+ kvm_mips_write_count(vcpu, v);
+ break;
+ case KVM_REG_MIPS_CP0_COMPARE:
+- kvm_mips_write_compare(vcpu, v);
++ kvm_mips_write_compare(vcpu, v, false);
+ break;
+ case KVM_REG_MIPS_CP0_CAUSE:
+ /*
+diff --git a/arch/mips/math-emu/cp1emu.c b/arch/mips/math-emu/cp1emu.c
+index cac529a405b8..22a2e15bd91b 100644
+--- a/arch/mips/math-emu/cp1emu.c
++++ b/arch/mips/math-emu/cp1emu.c
+@@ -443,9 +443,11 @@ static int isBranchInstr(struct pt_regs *regs, struct mm_decoded_insn dec_insn,
+ case spec_op:
+ switch (insn.r_format.func) {
+ case jalr_op:
+- regs->regs[insn.r_format.rd] =
+- regs->cp0_epc + dec_insn.pc_inc +
+- dec_insn.next_pc_inc;
++ if (insn.r_format.rd != 0) {
++ regs->regs[insn.r_format.rd] =
++ regs->cp0_epc + dec_insn.pc_inc +
++ dec_insn.next_pc_inc;
++ }
+ /* Fall through */
+ case jr_op:
+ *contpc = regs->regs[insn.r_format.rs];
+diff --git a/arch/powerpc/include/asm/pgtable-ppc64.h b/arch/powerpc/include/asm/pgtable-ppc64.h
+index daf4add50743..59830c87d6b6 100644
+--- a/arch/powerpc/include/asm/pgtable-ppc64.h
++++ b/arch/powerpc/include/asm/pgtable-ppc64.h
+@@ -479,6 +479,7 @@ static inline pte_t *pmdp_ptep(pmd_t *pmd)
+ }
+
+ #define pmd_pfn(pmd) pte_pfn(pmd_pte(pmd))
++#define pmd_dirty(pmd) pte_dirty(pmd_pte(pmd))
+ #define pmd_young(pmd) pte_young(pmd_pte(pmd))
+ #define pmd_mkold(pmd) pte_pmd(pte_mkold(pmd_pte(pmd)))
+ #define pmd_wrprotect(pmd) pte_pmd(pte_wrprotect(pmd_pte(pmd)))
+diff --git a/arch/powerpc/kernel/eeh_driver.c b/arch/powerpc/kernel/eeh_driver.c
+index 6535936bdf27..2fa2a44259c8 100644
+--- a/arch/powerpc/kernel/eeh_driver.c
++++ b/arch/powerpc/kernel/eeh_driver.c
+@@ -188,6 +188,16 @@ static void *eeh_dev_save_state(void *data, void *userdata)
+ if (!edev)
+ return NULL;
+
++ /*
++ * We cannot access the config space on some adapters.
++ * Otherwise, it will cause fenced PHB. We don't save
++ * the content in their config space and will restore
++ * from the initial config space saved when the EEH
++ * device is created.
++ */
++ if (edev->pe && (edev->pe->state & EEH_PE_CFG_RESTRICTED))
++ return NULL;
++
+ pdev = eeh_dev_to_pci_dev(edev);
+ if (!pdev)
+ return NULL;
+@@ -327,6 +337,19 @@ static void *eeh_dev_restore_state(void *data, void *userdata)
+ if (!edev)
+ return NULL;
+
++ /*
++ * The content in the config space isn't saved because
++ * the blocked config space on some adapters. We have
++ * to restore the initial saved config space when the
++ * EEH device is created.
++ */
++ if (edev->pe && (edev->pe->state & EEH_PE_CFG_RESTRICTED)) {
++ if (list_is_last(&edev->list, &edev->pe->edevs))
++ eeh_pe_restore_bars(edev->pe);
++
++ return NULL;
++ }
++
+ pdev = eeh_dev_to_pci_dev(edev);
+ if (!pdev)
+ return NULL;
+@@ -524,9 +547,6 @@ int eeh_pe_reset_and_recover(struct eeh_pe *pe)
+ /* Save states */
+ eeh_pe_dev_traverse(pe, eeh_dev_save_state, NULL);
+
+- /* Report error */
+- eeh_pe_dev_traverse(pe, eeh_report_error, &result);
+-
+ /* Issue reset */
+ eeh_pe_state_mark(pe, EEH_PE_CFG_BLOCKED);
+ ret = eeh_reset_pe(pe);
+diff --git a/arch/powerpc/kernel/exceptions-64s.S b/arch/powerpc/kernel/exceptions-64s.S
+index 5e0198425194..f7487ea09d15 100644
+--- a/arch/powerpc/kernel/exceptions-64s.S
++++ b/arch/powerpc/kernel/exceptions-64s.S
+@@ -938,11 +938,6 @@ hv_facility_unavailable_relon_trampoline:
+ #endif
+ STD_RELON_EXCEPTION_PSERIES(0x5700, 0x1700, altivec_assist)
+
+- /* Other future vectors */
+- .align 7
+- .globl __end_interrupts
+-__end_interrupts:
+-
+ .align 7
+ system_call_entry_direct:
+ #if defined(CONFIG_RELOCATABLE)
+@@ -1236,6 +1231,17 @@ __end_handlers:
+ STD_RELON_EXCEPTION_PSERIES_OOL(0xf60, facility_unavailable)
+ STD_RELON_EXCEPTION_HV_OOL(0xf80, hv_facility_unavailable)
+
++ /*
++ * The __end_interrupts marker must be past the out-of-line (OOL)
++ * handlers, so that they are copied to real address 0x100 when running
++ * a relocatable kernel. This ensures they can be reached from the short
++ * trampoline handlers (like 0x4f00, 0x4f20, etc.) which branch
++ * directly, without using LOAD_HANDLER().
++ */
++ .align 7
++ .globl __end_interrupts
++__end_interrupts:
++
+ #if defined(CONFIG_PPC_PSERIES) || defined(CONFIG_PPC_POWERNV)
+ /*
+ * Data area reserved for FWNMI option.
+diff --git a/arch/sparc/include/asm/pgtable_64.h b/arch/sparc/include/asm/pgtable_64.h
+index bfeb626085ac..1ff9e7864168 100644
+--- a/arch/sparc/include/asm/pgtable_64.h
++++ b/arch/sparc/include/asm/pgtable_64.h
+@@ -667,6 +667,13 @@ static inline unsigned long pmd_pfn(pmd_t pmd)
+ }
+
+ #ifdef CONFIG_TRANSPARENT_HUGEPAGE
++static inline unsigned long pmd_dirty(pmd_t pmd)
++{
++ pte_t pte = __pte(pmd_val(pmd));
++
++ return pte_dirty(pte);
++}
++
+ static inline unsigned long pmd_young(pmd_t pmd)
+ {
+ pte_t pte = __pte(pmd_val(pmd));
+diff --git a/arch/x86/include/asm/acpi.h b/arch/x86/include/asm/acpi.h
+index 0ab4f9fd2687..3a45668f6dc3 100644
+--- a/arch/x86/include/asm/acpi.h
++++ b/arch/x86/include/asm/acpi.h
+@@ -50,6 +50,7 @@ void acpi_pic_sci_set_trigger(unsigned int, u16);
+
+ extern int (*__acpi_register_gsi)(struct device *dev, u32 gsi,
+ int trigger, int polarity);
++extern void (*__acpi_unregister_gsi)(u32 gsi);
+
+ static inline void disable_acpi(void)
+ {
+diff --git a/arch/x86/include/asm/pgtable.h b/arch/x86/include/asm/pgtable.h
+index aa97a070f09f..081d6f45e006 100644
+--- a/arch/x86/include/asm/pgtable.h
++++ b/arch/x86/include/asm/pgtable.h
+@@ -99,6 +99,11 @@ static inline int pte_young(pte_t pte)
+ return pte_flags(pte) & _PAGE_ACCESSED;
+ }
+
++static inline int pmd_dirty(pmd_t pmd)
++{
++ return pmd_flags(pmd) & _PAGE_DIRTY;
++}
++
+ static inline int pmd_young(pmd_t pmd)
+ {
+ return pmd_flags(pmd) & _PAGE_ACCESSED;
+diff --git a/arch/x86/pci/xen.c b/arch/x86/pci/xen.c
+index 6b3cf7c4e5c2..41c15dc4241c 100644
+--- a/arch/x86/pci/xen.c
++++ b/arch/x86/pci/xen.c
+@@ -442,6 +442,7 @@ int __init pci_xen_hvm_init(void)
+ * just how GSIs get registered.
+ */
+ __acpi_register_gsi = acpi_register_gsi_xen_hvm;
++ __acpi_unregister_gsi = NULL;
+ #endif
+
+ #ifdef CONFIG_PCI_MSI
+@@ -464,8 +465,12 @@ int __init pci_xen_initial_domain(void)
+ x86_msi.msix_mask_irq = xen_nop_msix_mask_irq;
+ #endif
+ __acpi_register_gsi = acpi_register_gsi_xen;
+- /* Pre-allocate legacy irqs */
+- for (irq = 0; irq < nr_legacy_irqs(); irq++) {
++ __acpi_unregister_gsi = NULL;
++ /*
++ * Pre-allocate the legacy IRQs. Use NR_LEGACY_IRQS here
++ * because we don't have a PIC and thus nr_legacy_irqs() is zero.
++ */
++ for (irq = 0; irq < NR_IRQS_LEGACY; irq++) {
+ int trigger, polarity;
+
+ if (acpi_get_override_irq(irq, &trigger, &polarity) == -1)
+diff --git a/drivers/acpi/osl.c b/drivers/acpi/osl.c
+index 838359818228..d23c2006f07c 100644
+--- a/drivers/acpi/osl.c
++++ b/drivers/acpi/osl.c
+@@ -138,7 +138,7 @@ static struct osi_linux {
+ unsigned int enable:1;
+ unsigned int dmi:1;
+ unsigned int cmdline:1;
+- unsigned int default_disabling:1;
++ u8 default_disabling;
+ } osi_linux = {0, 0, 0, 0};
+
+ static u32 acpi_osi_handler(acpi_string interface, u32 supported)
+@@ -1443,10 +1443,13 @@ void __init acpi_osi_setup(char *str)
+ if (*str == '!') {
+ str++;
+ if (*str == '\0') {
+- osi_linux.default_disabling = 1;
++ /* Do not override acpi_osi=!* */
++ if (!osi_linux.default_disabling)
++ osi_linux.default_disabling =
++ ACPI_DISABLE_ALL_VENDOR_STRINGS;
+ return;
+ } else if (*str == '*') {
+- acpi_update_interfaces(ACPI_DISABLE_ALL_STRINGS);
++ osi_linux.default_disabling = ACPI_DISABLE_ALL_STRINGS;
+ for (i = 0; i < OSI_STRING_ENTRIES_MAX; i++) {
+ osi = &osi_setup_entries[i];
+ osi->enable = false;
+@@ -1519,10 +1522,13 @@ static void __init acpi_osi_setup_late(void)
+ acpi_status status;
+
+ if (osi_linux.default_disabling) {
+- status = acpi_update_interfaces(ACPI_DISABLE_ALL_VENDOR_STRINGS);
++ status = acpi_update_interfaces(osi_linux.default_disabling);
+
+ if (ACPI_SUCCESS(status))
+- printk(KERN_INFO PREFIX "Disabled all _OSI OS vendors\n");
++ printk(KERN_INFO PREFIX "Disabled all _OSI OS vendors%s\n",
++ osi_linux.default_disabling ==
++ ACPI_DISABLE_ALL_STRINGS ?
++ " and feature groups" : "");
+ }
+
+ for (i = 0; i < OSI_STRING_ENTRIES_MAX; i++) {
+diff --git a/drivers/base/power/main.c b/drivers/base/power/main.c
+index 9717d5f20139..508a8f67c028 100644
+--- a/drivers/base/power/main.c
++++ b/drivers/base/power/main.c
+@@ -1251,14 +1251,15 @@ int dpm_suspend_late(pm_message_t state)
+ error = device_suspend_late(dev);
+
+ mutex_lock(&dpm_list_mtx);
++ if (!list_empty(&dev->power.entry))
++ list_move(&dev->power.entry, &dpm_late_early_list);
++
+ if (error) {
+ pm_dev_err(dev, state, " late", error);
+ dpm_save_failed_dev(dev_name(dev));
+ put_device(dev);
+ break;
+ }
+- if (!list_empty(&dev->power.entry))
+- list_move(&dev->power.entry, &dpm_late_early_list);
+ put_device(dev);
+
+ if (async_error)
+diff --git a/drivers/base/power/runtime.c b/drivers/base/power/runtime.c
+index 67c7938e430b..f6f1f90e9448 100644
+--- a/drivers/base/power/runtime.c
++++ b/drivers/base/power/runtime.c
+@@ -1474,11 +1474,16 @@ int pm_runtime_force_resume(struct device *dev)
+ goto out;
+ }
+
+- ret = callback(dev);
++ ret = pm_runtime_set_active(dev);
+ if (ret)
+ goto out;
+
+- pm_runtime_set_active(dev);
++ ret = callback(dev);
++ if (ret) {
++ pm_runtime_set_suspended(dev);
++ goto out;
++ }
++
+ pm_runtime_mark_last_busy(dev);
+ out:
+ pm_runtime_enable(dev);
+diff --git a/drivers/bluetooth/hci_vhci.c b/drivers/bluetooth/hci_vhci.c
+index 6653473f2757..eaa646dfa783 100644
+--- a/drivers/bluetooth/hci_vhci.c
++++ b/drivers/bluetooth/hci_vhci.c
+@@ -50,6 +50,7 @@ struct vhci_data {
+ wait_queue_head_t read_wait;
+ struct sk_buff_head readq;
+
++ struct mutex open_mutex;
+ struct delayed_work open_timeout;
+ };
+
+@@ -95,12 +96,15 @@ static int vhci_send_frame(struct hci_dev *hdev, struct sk_buff *skb)
+ return 0;
+ }
+
+-static int vhci_create_device(struct vhci_data *data, __u8 opcode)
++static int __vhci_create_device(struct vhci_data *data, __u8 opcode)
+ {
+ struct hci_dev *hdev;
+ struct sk_buff *skb;
+ __u8 dev_type;
+
++ if (data->hdev)
++ return -EBADFD;
++
+ /* bits 0-1 are dev_type (BR/EDR or AMP) */
+ dev_type = opcode & 0x03;
+
+@@ -159,6 +163,17 @@ static int vhci_create_device(struct vhci_data *data, __u8 opcode)
+ return 0;
+ }
+
++static int vhci_create_device(struct vhci_data *data, __u8 opcode)
++{
++ int err;
++
++ mutex_lock(&data->open_mutex);
++ err = __vhci_create_device(data, opcode);
++ mutex_unlock(&data->open_mutex);
++
++ return err;
++}
++
+ static inline ssize_t vhci_get_user(struct vhci_data *data,
+ struct iov_iter *from)
+ {
+@@ -197,11 +212,6 @@ static inline ssize_t vhci_get_user(struct vhci_data *data,
+ break;
+
+ case HCI_VENDOR_PKT:
+- if (data->hdev) {
+- kfree_skb(skb);
+- return -EBADFD;
+- }
+-
+ cancel_delayed_work_sync(&data->open_timeout);
+
+ opcode = *((__u8 *) skb->data);
+@@ -328,6 +338,7 @@ static int vhci_open(struct inode *inode, struct file *file)
+ skb_queue_head_init(&data->readq);
+ init_waitqueue_head(&data->read_wait);
+
++ mutex_init(&data->open_mutex);
+ INIT_DELAYED_WORK(&data->open_timeout, vhci_open_timeout);
+
+ file->private_data = data;
+@@ -341,15 +352,18 @@ static int vhci_open(struct inode *inode, struct file *file)
+ static int vhci_release(struct inode *inode, struct file *file)
+ {
+ struct vhci_data *data = file->private_data;
+- struct hci_dev *hdev = data->hdev;
++ struct hci_dev *hdev;
+
+ cancel_delayed_work_sync(&data->open_timeout);
+
++ hdev = data->hdev;
++
+ if (hdev) {
+ hci_unregister_dev(hdev);
+ hci_free_dev(hdev);
+ }
+
++ skb_queue_purge(&data->readq);
+ file->private_data = NULL;
+ kfree(data);
+
+diff --git a/drivers/cpuidle/cpuidle.c b/drivers/cpuidle/cpuidle.c
+index 9ab99642ca7a..59dc6db6be15 100644
+--- a/drivers/cpuidle/cpuidle.c
++++ b/drivers/cpuidle/cpuidle.c
+@@ -127,7 +127,7 @@ int cpuidle_enter_state(struct cpuidle_device *dev, struct cpuidle_driver *drv,
+ time_end = ktime_get();
+ trace_cpu_idle_rcuidle(PWR_EVENT_EXIT, dev->cpu);
+
+- if (!cpuidle_state_is_coupled(dev, drv, entered_state))
++ if (!cpuidle_state_is_coupled(dev, drv, index))
+ local_irq_enable();
+
+ diff = ktime_to_us(ktime_sub(time_end, time_start));
+@@ -355,6 +355,8 @@ static void __cpuidle_unregister_device(struct cpuidle_device *dev)
+ list_del(&dev->device_list);
+ per_cpu(cpuidle_devices, dev->cpu) = NULL;
+ module_put(drv->owner);
++
++ dev->registered = 0;
+ }
+
+ static void __cpuidle_device_init(struct cpuidle_device *dev)
+diff --git a/drivers/crypto/caam/jr.c b/drivers/crypto/caam/jr.c
+index 4d18e27ffa9e..e87d12545754 100644
+--- a/drivers/crypto/caam/jr.c
++++ b/drivers/crypto/caam/jr.c
+@@ -244,7 +244,7 @@ static void caam_jr_dequeue(unsigned long devarg)
+ struct device *caam_jr_alloc(void)
+ {
+ struct caam_drv_private_jr *jrpriv, *min_jrpriv = NULL;
+- struct device *dev = NULL;
++ struct device *dev = ERR_PTR(-ENODEV);
+ int min_tfm_cnt = INT_MAX;
+ int tfm_cnt;
+
+diff --git a/drivers/crypto/s5p-sss.c b/drivers/crypto/s5p-sss.c
+index 4197ad9a711b..658fa533ced1 100644
+--- a/drivers/crypto/s5p-sss.c
++++ b/drivers/crypto/s5p-sss.c
+@@ -149,7 +149,6 @@
+
+ /**
+ * struct samsung_aes_variant - platform specific SSS driver data
+- * @has_hash_irq: true if SSS module uses hash interrupt, false otherwise
+ * @aes_offset: AES register offset from SSS module's base.
+ *
+ * Specifies platform specific configuration of SSS module.
+@@ -157,7 +156,6 @@
+ * expansion of its usage.
+ */
+ struct samsung_aes_variant {
+- bool has_hash_irq;
+ unsigned int aes_offset;
+ };
+
+@@ -178,7 +176,6 @@ struct s5p_aes_dev {
+ struct clk *clk;
+ void __iomem *ioaddr;
+ void __iomem *aes_ioaddr;
+- int irq_hash;
+ int irq_fc;
+
+ struct ablkcipher_request *req;
+@@ -197,12 +194,10 @@ struct s5p_aes_dev {
+ static struct s5p_aes_dev *s5p_dev;
+
+ static const struct samsung_aes_variant s5p_aes_data = {
+- .has_hash_irq = true,
+ .aes_offset = 0x4000,
+ };
+
+ static const struct samsung_aes_variant exynos_aes_data = {
+- .has_hash_irq = false,
+ .aes_offset = 0x200,
+ };
+
+@@ -313,43 +308,55 @@ static int s5p_set_indata(struct s5p_aes_dev *dev, struct scatterlist *sg)
+ return err;
+ }
+
+-static void s5p_aes_tx(struct s5p_aes_dev *dev)
++/*
++ * Returns true if new transmitting (output) data is ready and its
++ * address+length have to be written to device (by calling
++ * s5p_set_dma_outdata()). False otherwise.
++ */
++static bool s5p_aes_tx(struct s5p_aes_dev *dev)
+ {
+ int err = 0;
++ bool ret = false;
+
+ s5p_unset_outdata(dev);
+
+ if (!sg_is_last(dev->sg_dst)) {
+ err = s5p_set_outdata(dev, sg_next(dev->sg_dst));
+- if (err) {
++ if (err)
+ s5p_aes_complete(dev, err);
+- return;
+- }
+-
+- s5p_set_dma_outdata(dev, dev->sg_dst);
++ else
++ ret = true;
+ } else {
+ s5p_aes_complete(dev, err);
+
+ dev->busy = true;
+ tasklet_schedule(&dev->tasklet);
+ }
++
++ return ret;
+ }
+
+-static void s5p_aes_rx(struct s5p_aes_dev *dev)
++/*
++ * Returns true if new receiving (input) data is ready and its
++ * address+length have to be written to device (by calling
++ * s5p_set_dma_indata()). False otherwise.
++ */
++static bool s5p_aes_rx(struct s5p_aes_dev *dev)
+ {
+ int err;
++ bool ret = false;
+
+ s5p_unset_indata(dev);
+
+ if (!sg_is_last(dev->sg_src)) {
+ err = s5p_set_indata(dev, sg_next(dev->sg_src));
+- if (err) {
++ if (err)
+ s5p_aes_complete(dev, err);
+- return;
+- }
+-
+- s5p_set_dma_indata(dev, dev->sg_src);
++ else
++ ret = true;
+ }
++
++ return ret;
+ }
+
+ static irqreturn_t s5p_aes_interrupt(int irq, void *dev_id)
+@@ -358,18 +365,29 @@ static irqreturn_t s5p_aes_interrupt(int irq, void *dev_id)
+ struct s5p_aes_dev *dev = platform_get_drvdata(pdev);
+ uint32_t status;
+ unsigned long flags;
++ bool set_dma_tx = false;
++ bool set_dma_rx = false;
+
+ spin_lock_irqsave(&dev->lock, flags);
+
+- if (irq == dev->irq_fc) {
+- status = SSS_READ(dev, FCINTSTAT);
+- if (status & SSS_FCINTSTAT_BRDMAINT)
+- s5p_aes_rx(dev);
+- if (status & SSS_FCINTSTAT_BTDMAINT)
+- s5p_aes_tx(dev);
+-
+- SSS_WRITE(dev, FCINTPEND, status);
+- }
++ status = SSS_READ(dev, FCINTSTAT);
++ if (status & SSS_FCINTSTAT_BRDMAINT)
++ set_dma_rx = s5p_aes_rx(dev);
++ if (status & SSS_FCINTSTAT_BTDMAINT)
++ set_dma_tx = s5p_aes_tx(dev);
++
++ SSS_WRITE(dev, FCINTPEND, status);
++
++ /*
++ * Writing length of DMA block (either receiving or transmitting)
++ * will start the operation immediately, so this should be done
++ * at the end (even after clearing pending interrupts to not miss the
++ * interrupt).
++ */
++ if (set_dma_tx)
++ s5p_set_dma_outdata(dev, dev->sg_dst);
++ if (set_dma_rx)
++ s5p_set_dma_indata(dev, dev->sg_src);
+
+ spin_unlock_irqrestore(&dev->lock, flags);
+
+@@ -671,21 +689,6 @@ static int s5p_aes_probe(struct platform_device *pdev)
+ goto err_irq;
+ }
+
+- if (variant->has_hash_irq) {
+- pdata->irq_hash = platform_get_irq(pdev, 1);
+- if (pdata->irq_hash < 0) {
+- err = pdata->irq_hash;
+- dev_warn(dev, "hash interrupt is not available.\n");
+- goto err_irq;
+- }
+- err = devm_request_irq(dev, pdata->irq_hash, s5p_aes_interrupt,
+- IRQF_SHARED, pdev->name, pdev);
+- if (err < 0) {
+- dev_warn(dev, "hash interrupt is not available.\n");
+- goto err_irq;
+- }
+- }
+-
+ pdata->busy = false;
+ pdata->variant = variant;
+ pdata->dev = dev;
+diff --git a/drivers/dma/imx-sdma.c b/drivers/dma/imx-sdma.c
+index 88afc48c2ca7..3ed46c8cd2a0 100644
+--- a/drivers/dma/imx-sdma.c
++++ b/drivers/dma/imx-sdma.c
+@@ -531,6 +531,10 @@ static int sdma_run_channel0(struct sdma_engine *sdma)
+ dev_err(sdma->dev, "Timeout waiting for CH0 ready\n");
+ }
+
++ /* Set bits of CONFIG register with dynamic context switching */
++ if (readl(sdma->regs + SDMA_H_CONFIG) == 0)
++ writel_relaxed(SDMA_H_CONFIG_CSM, sdma->regs + SDMA_H_CONFIG);
++
+ return ret ? 0 : -ETIMEDOUT;
+ }
+
+@@ -1399,9 +1403,6 @@ static int __init sdma_init(struct sdma_engine *sdma)
+
+ writel_relaxed(ccb_phys, sdma->regs + SDMA_H_C0PTR);
+
+- /* Set bits of CONFIG register with given context switching mode */
+- writel_relaxed(SDMA_H_CONFIG_CSM, sdma->regs + SDMA_H_CONFIG);
+-
+ /* Initializes channel's priorities */
+ sdma_set_channel_priority(&sdma->channel[0], 7);
+
+diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c
+index e9a2827ad1c4..1463804b63f0 100644
+--- a/drivers/gpu/drm/drm_fb_helper.c
++++ b/drivers/gpu/drm/drm_fb_helper.c
+@@ -1453,7 +1453,6 @@ static int drm_pick_crtcs(struct drm_fb_helper *fb_helper,
+ int n, int width, int height)
+ {
+ int c, o;
+- struct drm_device *dev = fb_helper->dev;
+ struct drm_connector *connector;
+ struct drm_connector_helper_funcs *connector_funcs;
+ struct drm_encoder *encoder;
+@@ -1472,7 +1471,7 @@ static int drm_pick_crtcs(struct drm_fb_helper *fb_helper,
+ if (modes[n] == NULL)
+ return best_score;
+
+- crtcs = kzalloc(dev->mode_config.num_connector *
++ crtcs = kzalloc(fb_helper->connector_count *
+ sizeof(struct drm_fb_helper_crtc *), GFP_KERNEL);
+ if (!crtcs)
+ return best_score;
+@@ -1518,7 +1517,7 @@ static int drm_pick_crtcs(struct drm_fb_helper *fb_helper,
+ if (score > best_score) {
+ best_score = score;
+ memcpy(best_crtcs, crtcs,
+- dev->mode_config.num_connector *
++ fb_helper->connector_count *
+ sizeof(struct drm_fb_helper_crtc *));
+ }
+ }
+diff --git a/drivers/gpu/drm/gma500/mdfld_dsi_pkg_sender.c b/drivers/gpu/drm/gma500/mdfld_dsi_pkg_sender.c
+index 87885d8c06e8..4869117b69eb 100644
+--- a/drivers/gpu/drm/gma500/mdfld_dsi_pkg_sender.c
++++ b/drivers/gpu/drm/gma500/mdfld_dsi_pkg_sender.c
+@@ -85,7 +85,7 @@ static const char *const dsi_errors[] = {
+ "RX Prot Violation",
+ "HS Generic Write FIFO Full",
+ "LP Generic Write FIFO Full",
+- "Generic Read Data Avail"
++ "Generic Read Data Avail",
+ "Special Packet Sent",
+ "Tearing Effect",
+ };
+diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
+index c64f1942e8de..993df2dded42 100644
+--- a/drivers/gpu/drm/i915/intel_pm.c
++++ b/drivers/gpu/drm/i915/intel_pm.c
+@@ -2952,6 +2952,8 @@ static void ilk_pipe_wm_get_hw_state(struct drm_crtc *crtc)
+ if (IS_HASWELL(dev) || IS_BROADWELL(dev))
+ hw->wm_linetime[pipe] = I915_READ(PIPE_WM_LINETIME(pipe));
+
++ memset(active, 0, sizeof(*active));
++
+ active->pipe_enabled = intel_crtc_active(crtc);
+
+ if (active->pipe_enabled) {
+diff --git a/drivers/input/misc/uinput.c b/drivers/input/misc/uinput.c
+index 421e29e4cd81..5221450f9b57 100644
+--- a/drivers/input/misc/uinput.c
++++ b/drivers/input/misc/uinput.c
+@@ -895,9 +895,15 @@ static long uinput_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
+ }
+
+ #ifdef CONFIG_COMPAT
++
++#define UI_SET_PHYS_COMPAT _IOW(UINPUT_IOCTL_BASE, 108, compat_uptr_t)
++
+ static long uinput_compat_ioctl(struct file *file,
+ unsigned int cmd, unsigned long arg)
+ {
++ if (cmd == UI_SET_PHYS_COMPAT)
++ cmd = UI_SET_PHYS;
++
+ return uinput_ioctl_handler(file, cmd, arg, compat_ptr(arg));
+ }
+ #endif
+diff --git a/drivers/irqchip/irq-gic-v3.c b/drivers/irqchip/irq-gic-v3.c
+index aa17ae805a70..a94342f4a3ef 100644
+--- a/drivers/irqchip/irq-gic-v3.c
++++ b/drivers/irqchip/irq-gic-v3.c
+@@ -283,6 +283,13 @@ static asmlinkage void __exception_irq_entry gic_handle_irq(struct pt_regs *regs
+ if (irqnr < 16) {
+ gic_write_eoir(irqnr);
+ #ifdef CONFIG_SMP
++ /*
++ * Unlike GICv2, we don't need an smp_rmb() here.
++ * The control dependency from gic_read_iar to
++ * the ISB in gic_write_eoir is enough to ensure
++ * that any shared data read by handle_IPI will
++ * be read after the ACK.
++ */
+ handle_IPI(irqnr, regs);
+ #else
+ WARN_ONCE(true, "Unexpected SGI received!\n");
+diff --git a/drivers/irqchip/irq-gic.c b/drivers/irqchip/irq-gic.c
+index 38493ff28fa5..1107051df379 100644
+--- a/drivers/irqchip/irq-gic.c
++++ b/drivers/irqchip/irq-gic.c
+@@ -276,6 +276,14 @@ static void __exception_irq_entry gic_handle_irq(struct pt_regs *regs)
+ if (irqnr < 16) {
+ writel_relaxed(irqstat, cpu_base + GIC_CPU_EOI);
+ #ifdef CONFIG_SMP
++ /*
++ * Ensure any shared data written by the CPU sending
++ * the IPI is read after we've read the ACK register
++ * on the GIC.
++ *
++ * Pairs with the write barrier in gic_raise_softirq
++ */
++ smp_rmb();
+ handle_IPI(irqnr, regs);
+ #endif
+ continue;
+diff --git a/drivers/mcb/mcb-parse.c b/drivers/mcb/mcb-parse.c
+index 004926955263..b0155b05cddb 100644
+--- a/drivers/mcb/mcb-parse.c
++++ b/drivers/mcb/mcb-parse.c
+@@ -57,7 +57,7 @@ static int chameleon_parse_gdd(struct mcb_bus *bus,
+ mdev->id = GDD_DEV(reg1);
+ mdev->rev = GDD_REV(reg1);
+ mdev->var = GDD_VAR(reg1);
+- mdev->bar = GDD_BAR(reg1);
++ mdev->bar = GDD_BAR(reg2);
+ mdev->group = GDD_GRP(reg2);
+ mdev->inst = GDD_INS(reg2);
+
+diff --git a/drivers/mfd/omap-usb-tll.c b/drivers/mfd/omap-usb-tll.c
+index 532eacab6b46..0f8cd6bbe914 100644
+--- a/drivers/mfd/omap-usb-tll.c
++++ b/drivers/mfd/omap-usb-tll.c
+@@ -269,6 +269,8 @@ static int usbtll_omap_probe(struct platform_device *pdev)
+
+ if (IS_ERR(tll->ch_clk[i]))
+ dev_dbg(dev, "can't get clock : %s\n", clkname);
++ else
++ clk_prepare(tll->ch_clk[i]);
+ }
+
+ pm_runtime_put_sync(dev);
+@@ -301,9 +303,12 @@ static int usbtll_omap_remove(struct platform_device *pdev)
+ tll_dev = NULL;
+ spin_unlock(&tll_lock);
+
+- for (i = 0; i < tll->nch; i++)
+- if (!IS_ERR(tll->ch_clk[i]))
++ for (i = 0; i < tll->nch; i++) {
++ if (!IS_ERR(tll->ch_clk[i])) {
++ clk_unprepare(tll->ch_clk[i]);
+ clk_put(tll->ch_clk[i]);
++ }
++ }
+
+ pm_runtime_disable(&pdev->dev);
+ return 0;
+@@ -421,7 +426,7 @@ int omap_tll_enable(struct usbhs_omap_platform_data *pdata)
+ if (IS_ERR(tll->ch_clk[i]))
+ continue;
+
+- r = clk_prepare_enable(tll->ch_clk[i]);
++ r = clk_enable(tll->ch_clk[i]);
+ if (r) {
+ dev_err(tll_dev,
+ "Error enabling ch %d clock: %d\n", i, r);
+@@ -449,7 +454,7 @@ int omap_tll_disable(struct usbhs_omap_platform_data *pdata)
+ for (i = 0; i < tll->nch; i++) {
+ if (omap_usb_mode_needs_tll(pdata->port_mode[i])) {
+ if (!IS_ERR(tll->ch_clk[i]))
+- clk_disable_unprepare(tll->ch_clk[i]);
++ clk_disable(tll->ch_clk[i]);
+ }
+ }
+
+diff --git a/drivers/mmc/card/block.c b/drivers/mmc/card/block.c
+index 10ecc0a0112b..5027ae76fde8 100644
+--- a/drivers/mmc/card/block.c
++++ b/drivers/mmc/card/block.c
+@@ -2410,11 +2410,12 @@ static const struct mmc_fixup blk_fixups[] =
+ MMC_QUIRK_BLK_NO_CMD23),
+
+ /*
+- * Some Micron MMC cards needs longer data read timeout than
+- * indicated in CSD.
++ * Some MMC cards need longer data read timeout than indicated in CSD.
+ */
+ MMC_FIXUP(CID_NAME_ANY, CID_MANFID_MICRON, 0x200, add_quirk_mmc,
+ MMC_QUIRK_LONG_READ_TIME),
++ MMC_FIXUP("008GE0", CID_MANFID_TOSHIBA, CID_OEMID_ANY, add_quirk_mmc,
++ MMC_QUIRK_LONG_READ_TIME),
+
+ /*
+ * On these Samsung MoviNAND parts, performing secure erase or
+diff --git a/drivers/mmc/core/core.c b/drivers/mmc/core/core.c
+index 01315db9a81a..eefe36afa601 100644
+--- a/drivers/mmc/core/core.c
++++ b/drivers/mmc/core/core.c
+@@ -811,11 +811,11 @@ void mmc_set_data_timeout(struct mmc_data *data, const struct mmc_card *card)
+ /*
+ * Some cards require longer data read timeout than indicated in CSD.
+ * Address this by setting the read timeout to a "reasonably high"
+- * value. For the cards tested, 300ms has proven enough. If necessary,
++ * value. For the cards tested, 600ms has proven enough. If necessary,
+ * this value can be increased if other problematic cards require this.
+ */
+ if (mmc_card_long_read_time(card) && data->flags & MMC_DATA_READ) {
+- data->timeout_ns = 300000000;
++ data->timeout_ns = 600000000;
+ data->timeout_clks = 0;
+ }
+
+diff --git a/drivers/mmc/core/mmc.c b/drivers/mmc/core/mmc.c
+index 66c5c9f313a0..449aa7a4227d 100644
+--- a/drivers/mmc/core/mmc.c
++++ b/drivers/mmc/core/mmc.c
+@@ -388,6 +388,9 @@ static void mmc_manage_gp_partitions(struct mmc_card *card, u8 *ext_csd)
+ }
+ }
+
++/* Minimum partition switch timeout in milliseconds */
++#define MMC_MIN_PART_SWITCH_TIME 300
++
+ /*
+ * Decode extended CSD.
+ */
+@@ -450,6 +453,10 @@ static int mmc_read_ext_csd(struct mmc_card *card, u8 *ext_csd)
+
+ /* EXT_CSD value is in units of 10ms, but we store in ms */
+ card->ext_csd.part_time = 10 * ext_csd[EXT_CSD_PART_SWITCH_TIME];
++ /* Some eMMC set the value too low so set a minimum */
++ if (card->ext_csd.part_time &&
++ card->ext_csd.part_time < MMC_MIN_PART_SWITCH_TIME)
++ card->ext_csd.part_time = MMC_MIN_PART_SWITCH_TIME;
+
+ /* Sleep / awake timeout in 100ns units */
+ if (sa_shift > 0 && sa_shift <= 0x17)
+diff --git a/drivers/mmc/host/sdhci-acpi.c b/drivers/mmc/host/sdhci-acpi.c
+index 9cccc0e89b04..1de7056ccd92 100644
+--- a/drivers/mmc/host/sdhci-acpi.c
++++ b/drivers/mmc/host/sdhci-acpi.c
+@@ -180,7 +180,8 @@ static int sdhci_acpi_sd_probe_slot(struct platform_device *pdev,
+ static const struct sdhci_acpi_slot sdhci_acpi_slot_int_emmc = {
+ .chip = &sdhci_acpi_chip_int,
+ .caps = MMC_CAP_8_BIT_DATA | MMC_CAP_NONREMOVABLE |
+- MMC_CAP_HW_RESET | MMC_CAP_1_8V_DDR,
++ MMC_CAP_HW_RESET | MMC_CAP_1_8V_DDR |
++ MMC_CAP_WAIT_WHILE_BUSY,
+ .caps2 = MMC_CAP2_HC_ERASE_SZ,
+ .flags = SDHCI_ACPI_RUNTIME_PM,
+ .quirks2 = SDHCI_QUIRK2_PRESET_VALUE_BROKEN | SDHCI_QUIRK2_STOP_WITH_TC,
+@@ -190,7 +191,8 @@ static const struct sdhci_acpi_slot sdhci_acpi_slot_int_emmc = {
+ static const struct sdhci_acpi_slot sdhci_acpi_slot_int_sdio = {
+ .quirks = SDHCI_QUIRK_BROKEN_CARD_DETECTION,
+ .quirks2 = SDHCI_QUIRK2_HOST_OFF_CARD_ON,
+- .caps = MMC_CAP_NONREMOVABLE | MMC_CAP_POWER_OFF_CARD,
++ .caps = MMC_CAP_NONREMOVABLE | MMC_CAP_POWER_OFF_CARD |
++ MMC_CAP_WAIT_WHILE_BUSY,
+ .flags = SDHCI_ACPI_RUNTIME_PM,
+ .pm_caps = MMC_PM_KEEP_POWER,
+ .probe_slot = sdhci_acpi_sdio_probe_slot,
+@@ -201,6 +203,7 @@ static const struct sdhci_acpi_slot sdhci_acpi_slot_int_sd = {
+ SDHCI_ACPI_RUNTIME_PM,
+ .quirks2 = SDHCI_QUIRK2_CARD_ON_NEEDS_BUS_ON |
+ SDHCI_QUIRK2_STOP_WITH_TC,
++ .caps = MMC_CAP_WAIT_WHILE_BUSY,
+ .probe_slot = sdhci_acpi_sd_probe_slot,
+ };
+
+diff --git a/drivers/mtd/ubi/eba.c b/drivers/mtd/ubi/eba.c
+index 493f7b3dbc33..0aa7087438fa 100644
+--- a/drivers/mtd/ubi/eba.c
++++ b/drivers/mtd/ubi/eba.c
+@@ -425,8 +425,27 @@ retry:
+ ubi_warn("corrupted VID header at PEB %d, LEB %d:%d",
+ pnum, vol_id, lnum);
+ err = -EBADMSG;
+- } else
+- ubi_ro_mode(ubi);
++ } else {
++ /*
++ * Ending up here in the non-Fastmap case
++ * is a clear bug as the VID header had to
++ * be present at scan time to have it referenced.
++ * With fastmap the story is more complicated.
++ * Fastmap has the mapping info without the need
++ * of a full scan. So the LEB could have been
++ * unmapped, Fastmap cannot know this and keeps
++ * the LEB referenced.
++ * This is valid and works as the layer above UBI
++ * has to do bookkeeping about used/referenced
++ * LEBs in any case.
++ */
++ if (ubi->fast_attach) {
++ err = -EBADMSG;
++ } else {
++ err = -EINVAL;
++ ubi_ro_mode(ubi);
++ }
++ }
+ }
+ goto out_free;
+ } else if (err == UBI_IO_BITFLIPS)
+diff --git a/drivers/mtd/ubi/fastmap.c b/drivers/mtd/ubi/fastmap.c
+index cfd5b5e90156..9d38605717a0 100644
+--- a/drivers/mtd/ubi/fastmap.c
++++ b/drivers/mtd/ubi/fastmap.c
+@@ -1071,6 +1071,7 @@ int ubi_scan_fastmap(struct ubi_device *ubi, struct ubi_attach_info *ai,
+ ubi_msg("fastmap pool size: %d", ubi->fm_pool.max_size);
+ ubi_msg("fastmap WL pool size: %d", ubi->fm_wl_pool.max_size);
+ ubi->fm_disabled = 0;
++ ubi->fast_attach = 1;
+
+ ubi_free_vid_hdr(ubi, vh);
+ kfree(ech);
+diff --git a/drivers/mtd/ubi/ubi.h b/drivers/mtd/ubi/ubi.h
+index 320fc38fa2a1..206607668ee4 100644
+--- a/drivers/mtd/ubi/ubi.h
++++ b/drivers/mtd/ubi/ubi.h
+@@ -426,6 +426,8 @@ struct ubi_debug_info {
+ * @fm_size: fastmap size in bytes
+ * @fm_sem: allows ubi_update_fastmap() to block EBA table changes
+ * @fm_work: fastmap work queue
++ * @fm_work_scheduled: non-zero if fastmap work was scheduled
++ * @fast_attach: non-zero if UBI was attached by fastmap
+ *
+ * @used: RB-tree of used physical eraseblocks
+ * @erroneous: RB-tree of erroneous used physical eraseblocks
+@@ -437,7 +439,7 @@ struct ubi_debug_info {
+ * @pq_head: protection queue head
+ * @wl_lock: protects the @used, @free, @pq, @pq_head, @lookuptbl, @move_from,
+ * @move_to, @move_to_put @erase_pending, @wl_scheduled, @works,
+- * @erroneous, and @erroneous_peb_count fields
++ * @erroneous, @erroneous_peb_count, and @fm_work_scheduled fields
+ * @move_mutex: serializes eraseblock moves
+ * @work_sem: used to wait for all the scheduled works to finish and prevent
+ * new works from being submitted
+@@ -532,6 +534,8 @@ struct ubi_device {
+ void *fm_buf;
+ size_t fm_size;
+ struct work_struct fm_work;
++ int fm_work_scheduled;
++ int fast_attach;
+
+ /* Wear-leveling sub-system's stuff */
+ struct rb_root used;
+diff --git a/drivers/mtd/ubi/wl.c b/drivers/mtd/ubi/wl.c
+index 21d03130d8a7..e9b82816b8ce 100644
+--- a/drivers/mtd/ubi/wl.c
++++ b/drivers/mtd/ubi/wl.c
+@@ -149,6 +149,9 @@ static void update_fastmap_work_fn(struct work_struct *wrk)
+ {
+ struct ubi_device *ubi = container_of(wrk, struct ubi_device, fm_work);
+ ubi_update_fastmap(ubi);
++ spin_lock(&ubi->wl_lock);
++ ubi->fm_work_scheduled = 0;
++ spin_unlock(&ubi->wl_lock);
+ }
+
+ /**
+@@ -657,7 +660,10 @@ static struct ubi_wl_entry *get_peb_for_wl(struct ubi_device *ubi)
+ /* We cannot update the fastmap here because this
+ * function is called in atomic context.
+ * Let's fail here and refill/update it as soon as possible. */
+- schedule_work(&ubi->fm_work);
++ if (!ubi->fm_work_scheduled) {
++ ubi->fm_work_scheduled = 1;
++ schedule_work(&ubi->fm_work);
++ }
+ return NULL;
+ } else {
+ pnum = pool->pebs[pool->used++];
+diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c
+index 573b53b38af4..80185ebc7a43 100644
+--- a/drivers/net/can/dev.c
++++ b/drivers/net/can/dev.c
+@@ -615,11 +615,17 @@ int can_change_mtu(struct net_device *dev, int new_mtu)
+ /* allow change of MTU according to the CANFD ability of the device */
+ switch (new_mtu) {
+ case CAN_MTU:
++ /* 'CANFD-only' controllers can not switch to CAN_MTU */
++ if (priv->ctrlmode_static & CAN_CTRLMODE_FD)
++ return -EINVAL;
++
+ priv->ctrlmode &= ~CAN_CTRLMODE_FD;
+ break;
+
+ case CANFD_MTU:
+- if (!(priv->ctrlmode_supported & CAN_CTRLMODE_FD))
++ /* check for potential CANFD ability */
++ if (!(priv->ctrlmode_supported & CAN_CTRLMODE_FD) &&
++ !(priv->ctrlmode_static & CAN_CTRLMODE_FD))
+ return -EINVAL;
+
+ priv->ctrlmode |= CAN_CTRLMODE_FD;
+@@ -701,6 +707,35 @@ static const struct nla_policy can_policy[IFLA_CAN_MAX + 1] = {
+ = { .len = sizeof(struct can_bittiming_const) },
+ };
+
++static int can_validate(struct nlattr *tb[], struct nlattr *data[])
++{
++ bool is_can_fd = false;
++
++ /* Make sure that valid CAN FD configurations always consist of
++ * - nominal/arbitration bittiming
++ * - data bittiming
++ * - control mode with CAN_CTRLMODE_FD set
++ */
++
++ if (data[IFLA_CAN_CTRLMODE]) {
++ struct can_ctrlmode *cm = nla_data(data[IFLA_CAN_CTRLMODE]);
++
++ is_can_fd = cm->flags & cm->mask & CAN_CTRLMODE_FD;
++ }
++
++ if (is_can_fd) {
++ if (!data[IFLA_CAN_BITTIMING] || !data[IFLA_CAN_DATA_BITTIMING])
++ return -EOPNOTSUPP;
++ }
++
++ if (data[IFLA_CAN_DATA_BITTIMING]) {
++ if (!is_can_fd || !data[IFLA_CAN_BITTIMING])
++ return -EOPNOTSUPP;
++ }
++
++ return 0;
++}
++
+ static int can_changelink(struct net_device *dev,
+ struct nlattr *tb[], struct nlattr *data[])
+ {
+@@ -732,19 +767,31 @@ static int can_changelink(struct net_device *dev,
+
+ if (data[IFLA_CAN_CTRLMODE]) {
+ struct can_ctrlmode *cm;
++ u32 ctrlstatic;
++ u32 maskedflags;
+
+ /* Do not allow changing controller mode while running */
+ if (dev->flags & IFF_UP)
+ return -EBUSY;
+ cm = nla_data(data[IFLA_CAN_CTRLMODE]);
++ ctrlstatic = priv->ctrlmode_static;
++ maskedflags = cm->flags & cm->mask;
++
++ /* check whether provided bits are allowed to be passed */
++ if (cm->mask & ~(priv->ctrlmode_supported | ctrlstatic))
++ return -EOPNOTSUPP;
++
++ /* do not check for static fd-non-iso if 'fd' is disabled */
++ if (!(maskedflags & CAN_CTRLMODE_FD))
++ ctrlstatic &= ~CAN_CTRLMODE_FD_NON_ISO;
+
+- /* check whether changed bits are allowed to be modified */
+- if (cm->mask & ~priv->ctrlmode_supported)
++ /* make sure static options are provided by configuration */
++ if ((maskedflags & ctrlstatic) != ctrlstatic)
+ return -EOPNOTSUPP;
+
+ /* clear bits to be modified and copy the flag values */
+ priv->ctrlmode &= ~cm->mask;
+- priv->ctrlmode |= (cm->flags & cm->mask);
++ priv->ctrlmode |= maskedflags;
+
+ /* CAN_CTRLMODE_FD can only be set when driver supports FD */
+ if (priv->ctrlmode & CAN_CTRLMODE_FD)
+@@ -885,6 +932,7 @@ static struct rtnl_link_ops can_link_ops __read_mostly = {
+ .maxtype = IFLA_CAN_MAX,
+ .policy = can_policy,
+ .setup = can_setup,
++ .validate = can_validate,
+ .newlink = can_newlink,
+ .changelink = can_changelink,
+ .get_size = can_get_size,
+diff --git a/drivers/net/can/m_can/m_can.c b/drivers/net/can/m_can/m_can.c
+index 244529881be9..62143cd7018f 100644
+--- a/drivers/net/can/m_can/m_can.c
++++ b/drivers/net/can/m_can/m_can.c
+@@ -957,7 +957,7 @@ static struct net_device *alloc_m_can_dev(void)
+ priv->can.do_get_berr_counter = m_can_get_berr_counter;
+
+ /* CAN_CTRLMODE_FD_NON_ISO is fixed with M_CAN IP v3.0.1 */
+- priv->can.ctrlmode = CAN_CTRLMODE_FD_NON_ISO;
++ can_set_static_ctrlmode(dev, CAN_CTRLMODE_FD_NON_ISO);
+
+ /* CAN_CTRLMODE_FD_NON_ISO can not be changed with M_CAN IP v3.0.1 */
+ priv->can.ctrlmode_supported = CAN_CTRLMODE_LOOPBACK |
+diff --git a/drivers/net/wireless/ath/ath5k/led.c b/drivers/net/wireless/ath/ath5k/led.c
+index 0beb7e7d6075..7349b05d6a7d 100644
+--- a/drivers/net/wireless/ath/ath5k/led.c
++++ b/drivers/net/wireless/ath/ath5k/led.c
+@@ -77,7 +77,7 @@ static const struct pci_device_id ath5k_led_devices[] = {
+ /* HP Compaq CQ60-206US (ddreggors@jumptv.com) */
+ { ATH_SDEVICE(PCI_VENDOR_ID_HP, 0x0137a), ATH_LED(3, 1) },
+ /* HP Compaq C700 (nitrousnrg@gmail.com) */
+- { ATH_SDEVICE(PCI_VENDOR_ID_HP, 0x0137b), ATH_LED(3, 1) },
++ { ATH_SDEVICE(PCI_VENDOR_ID_HP, 0x0137b), ATH_LED(3, 0) },
+ /* LiteOn AR5BXB63 (magooz@salug.it) */
+ { ATH_SDEVICE(PCI_VENDOR_ID_ATHEROS, 0x3067), ATH_LED(3, 0) },
+ /* IBM-specific AR5212 (all others) */
+diff --git a/drivers/net/wireless/ath/ath9k/pci.c b/drivers/net/wireless/ath/ath9k/pci.c
+index c018dea0b2e8..5ca08edb3988 100644
+--- a/drivers/net/wireless/ath/ath9k/pci.c
++++ b/drivers/net/wireless/ath/ath9k/pci.c
+@@ -28,6 +28,16 @@ static const struct pci_device_id ath_pci_id_table[] = {
+ { PCI_VDEVICE(ATHEROS, 0x0024) }, /* PCI-E */
+ { PCI_VDEVICE(ATHEROS, 0x0027) }, /* PCI */
+ { PCI_VDEVICE(ATHEROS, 0x0029) }, /* PCI */
++
++#ifdef CONFIG_ATH9K_PCOEM
++ /* Mini PCI AR9220 MB92 cards: Compex WLM200NX, Wistron DNMA-92 */
++ { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
++ 0x0029,
++ PCI_VENDOR_ID_ATHEROS,
++ 0x2096),
++ .driver_data = ATH9K_PCI_LED_ACT_HI },
++#endif
++
+ { PCI_VDEVICE(ATHEROS, 0x002A) }, /* PCI-E */
+
+ { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+diff --git a/drivers/net/wireless/rtlwifi/base.c b/drivers/net/wireless/rtlwifi/base.c
+index af2486965782..339f94e72555 100644
+--- a/drivers/net/wireless/rtlwifi/base.c
++++ b/drivers/net/wireless/rtlwifi/base.c
+@@ -1587,9 +1587,9 @@ void rtl_watchdog_wq_callback(void *data)
+ if (((rtlpriv->link_info.num_rx_inperiod +
+ rtlpriv->link_info.num_tx_inperiod) > 8) ||
+ (rtlpriv->link_info.num_rx_inperiod > 2))
+- rtl_lps_enter(hw);
+- else
+ rtl_lps_leave(hw);
++ else
++ rtl_lps_enter(hw);
+ }
+
+ rtlpriv->link_info.num_rx_inperiod = 0;
+diff --git a/drivers/net/wireless/rtlwifi/pci.c b/drivers/net/wireless/rtlwifi/pci.c
+index 348d5aec7682..2afe4cc161b5 100644
+--- a/drivers/net/wireless/rtlwifi/pci.c
++++ b/drivers/net/wireless/rtlwifi/pci.c
+@@ -1573,7 +1573,7 @@ int rtl_pci_reset_trx_ring(struct ieee80211_hw *hw)
+ true,
+ HW_DESC_TXBUFF_ADDR),
+ skb->len, PCI_DMA_TODEVICE);
+- kfree_skb(skb);
++ dev_kfree_skb_irq(skb);
+ ring->idx = (ring->idx + 1) % ring->entries;
+ }
+ ring->idx = 0;
+diff --git a/drivers/net/wireless/rtlwifi/rtl8723be/sw.c b/drivers/net/wireless/rtlwifi/rtl8723be/sw.c
+index 775e7bc292f2..24a855238d13 100644
+--- a/drivers/net/wireless/rtlwifi/rtl8723be/sw.c
++++ b/drivers/net/wireless/rtlwifi/rtl8723be/sw.c
+@@ -93,7 +93,6 @@ int rtl8723be_init_sw_vars(struct ieee80211_hw *hw)
+ struct rtl_mac *mac = rtl_mac(rtl_priv(hw));
+
+ rtl8723be_bt_reg_init(hw);
+- rtlpci->msi_support = rtlpriv->cfg->mod_params->msi_support;
+ rtlpriv->btcoexist.btc_ops = rtl_btc_get_ops_pointer();
+
+ rtlpriv->dm.dm_initialgain_enable = 1;
+@@ -151,6 +150,10 @@ int rtl8723be_init_sw_vars(struct ieee80211_hw *hw)
+ rtlpriv->psc.swctrl_lps = rtlpriv->cfg->mod_params->swctrl_lps;
+ rtlpriv->psc.fwctrl_lps = rtlpriv->cfg->mod_params->fwctrl_lps;
+ rtlpci->msi_support = rtlpriv->cfg->mod_params->msi_support;
++ rtlpriv->cfg->mod_params->sw_crypto =
++ rtlpriv->cfg->mod_params->sw_crypto;
++ rtlpriv->cfg->mod_params->disable_watchdog =
++ rtlpriv->cfg->mod_params->disable_watchdog;
+ if (rtlpriv->cfg->mod_params->disable_watchdog)
+ pr_info("watchdog disabled\n");
+ rtlpriv->psc.reg_fwctrl_lps = 3;
+@@ -267,6 +270,9 @@ static struct rtl_mod_params rtl8723be_mod_params = {
+ .inactiveps = true,
+ .swctrl_lps = false,
+ .fwctrl_lps = true,
++ .msi_support = false,
++ .disable_watchdog = false,
++ .debug = DBG_EMERG,
+ };
+
+ static struct rtl_hal_cfg rtl8723be_hal_cfg = {
+diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
+index 3f2d424c723f..7de026897f1d 100644
+--- a/drivers/pci/probe.c
++++ b/drivers/pci/probe.c
+@@ -177,9 +177,6 @@ int __pci_read_base(struct pci_dev *dev, enum pci_bar_type type,
+ struct pci_bus_region region, inverted_region;
+ bool bar_too_big = false, bar_too_high = false, bar_invalid = false;
+
+- if (dev->non_compliant_bars)
+- return 0;
+-
+ mask = type ? PCI_ROM_ADDRESS_MASK : ~0;
+
+ /* No printks while decoding is disabled! */
+@@ -331,6 +328,9 @@ static void pci_read_bases(struct pci_dev *dev, unsigned int howmany, int rom)
+ {
+ unsigned int pos, reg;
+
++ if (dev->non_compliant_bars)
++ return;
++
+ for (pos = 0; pos < howmany; pos++) {
+ struct resource *res = &dev->resource[pos];
+ reg = PCI_BASE_ADDRESS_0 + (pos << 2);
+diff --git a/drivers/pinctrl/samsung/pinctrl-exynos5440.c b/drivers/pinctrl/samsung/pinctrl-exynos5440.c
+index 88acfc0efd54..9a77a2a06b0f 100644
+--- a/drivers/pinctrl/samsung/pinctrl-exynos5440.c
++++ b/drivers/pinctrl/samsung/pinctrl-exynos5440.c
+@@ -109,6 +109,7 @@ struct exynos5440_pmx_func {
+ * @nr_groups: number of pin groups available.
+ * @pmx_functions: list of pin functions parsed from device tree.
+ * @nr_functions: number of pin functions available.
++ * @range: gpio range to register with pinctrl
+ */
+ struct exynos5440_pinctrl_priv_data {
+ void __iomem *reg_base;
+@@ -119,6 +120,7 @@ struct exynos5440_pinctrl_priv_data {
+ unsigned int nr_groups;
+ const struct exynos5440_pmx_func *pmx_functions;
+ unsigned int nr_functions;
++ struct pinctrl_gpio_range range;
+ };
+
+ /**
+@@ -769,7 +771,6 @@ static int exynos5440_pinctrl_register(struct platform_device *pdev,
+ struct pinctrl_desc *ctrldesc;
+ struct pinctrl_dev *pctl_dev;
+ struct pinctrl_pin_desc *pindesc, *pdesc;
+- struct pinctrl_gpio_range grange;
+ char *pin_names;
+ int pin, ret;
+
+@@ -827,12 +828,12 @@ static int exynos5440_pinctrl_register(struct platform_device *pdev,
+ return -EINVAL;
+ }
+
+- grange.name = "exynos5440-pctrl-gpio-range";
+- grange.id = 0;
+- grange.base = 0;
+- grange.npins = EXYNOS5440_MAX_PINS;
+- grange.gc = priv->gc;
+- pinctrl_add_gpio_range(pctl_dev, &grange);
++ priv->range.name = "exynos5440-pctrl-gpio-range";
++ priv->range.id = 0;
++ priv->range.base = 0;
++ priv->range.npins = EXYNOS5440_MAX_PINS;
++ priv->range.gc = priv->gc;
++ pinctrl_add_gpio_range(pctl_dev, &priv->range);
+ return 0;
+ }
+
+diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
+index bc3d80f9d5d6..872e53f15590 100644
+--- a/drivers/regulator/core.c
++++ b/drivers/regulator/core.c
+@@ -110,6 +110,11 @@ static struct regulator *create_regulator(struct regulator_dev *rdev,
+ struct device *dev,
+ const char *supply_name);
+
++static struct regulator_dev *dev_to_rdev(struct device *dev)
++{
++ return container_of(dev, struct regulator_dev, dev);
++}
++
+ static const char *rdev_get_name(struct regulator_dev *rdev)
+ {
+ if (rdev->constraints && rdev->constraints->name)
+@@ -3994,13 +3999,57 @@ static int __init regulator_init(void)
+ /* init early to allow our consumers to complete system booting */
+ core_initcall(regulator_init);
+
+-static int __init regulator_init_complete(void)
++static int __init regulator_late_cleanup(struct device *dev, void *data)
+ {
+- struct regulator_dev *rdev;
+- const struct regulator_ops *ops;
+- struct regulation_constraints *c;
++ struct regulator_dev *rdev = dev_to_rdev(dev);
++ const struct regulator_ops *ops = rdev->desc->ops;
++ struct regulation_constraints *c = rdev->constraints;
+ int enabled, ret;
+
++ if (c && c->always_on)
++ return 0;
++
++ if (c && !(c->valid_ops_mask & REGULATOR_CHANGE_STATUS))
++ return 0;
++
++ mutex_lock(&rdev->mutex);
++
++ if (rdev->use_count)
++ goto unlock;
++
++ /* If we can't read the status assume it's on. */
++ if (ops->is_enabled)
++ enabled = ops->is_enabled(rdev);
++ else
++ enabled = 1;
++
++ if (!enabled)
++ goto unlock;
++
++ if (have_full_constraints()) {
++ /* We log since this may kill the system if it goes
++ * wrong. */
++ rdev_info(rdev, "disabling\n");
++ ret = _regulator_do_disable(rdev);
++ if (ret != 0)
++ rdev_err(rdev, "couldn't disable: %d\n", ret);
++ } else {
++ /* The intention is that in future we will
++ * assume that full constraints are provided
++ * so warn even if we aren't going to do
++ * anything here.
++ */
++ rdev_warn(rdev, "incomplete constraints, leaving on\n");
++ }
++
++unlock:
++ mutex_unlock(&rdev->mutex);
++
++ return 0;
++}
++
++static int __init regulator_init_complete(void)
++{
+ /*
+ * Since DT doesn't provide an idiomatic mechanism for
+ * enabling full constraints and since it's much more natural
+@@ -4010,58 +4059,13 @@ static int __init regulator_init_complete(void)
+ if (of_have_populated_dt())
+ has_full_constraints = true;
+
+- mutex_lock(®ulator_list_mutex);
+-
+ /* If we have a full configuration then disable any regulators
+ * we have permission to change the status for and which are
+ * not in use or always_on. This is effectively the default
+ * for DT and ACPI as they have full constraints.
+ */
+- list_for_each_entry(rdev, ®ulator_list, list) {
+- ops = rdev->desc->ops;
+- c = rdev->constraints;
+-
+- if (c && c->always_on)
+- continue;
+-
+- if (c && !(c->valid_ops_mask & REGULATOR_CHANGE_STATUS))
+- continue;
+-
+- mutex_lock(&rdev->mutex);
+-
+- if (rdev->use_count)
+- goto unlock;
+-
+- /* If we can't read the status assume it's on. */
+- if (ops->is_enabled)
+- enabled = ops->is_enabled(rdev);
+- else
+- enabled = 1;
+-
+- if (!enabled)
+- goto unlock;
+-
+- if (have_full_constraints()) {
+- /* We log since this may kill the system if it
+- * goes wrong. */
+- rdev_info(rdev, "disabling\n");
+- ret = _regulator_do_disable(rdev);
+- if (ret != 0)
+- rdev_err(rdev, "couldn't disable: %d\n", ret);
+- } else {
+- /* The intention is that in future we will
+- * assume that full constraints are provided
+- * so warn even if we aren't going to do
+- * anything here.
+- */
+- rdev_warn(rdev, "incomplete constraints, leaving on\n");
+- }
+-
+-unlock:
+- mutex_unlock(&rdev->mutex);
+- }
+-
+- mutex_unlock(®ulator_list_mutex);
++ class_for_each_device(®ulator_class, NULL, NULL,
++ regulator_late_cleanup);
+
+ return 0;
+ }
+diff --git a/drivers/scsi/aacraid/commsup.c b/drivers/scsi/aacraid/commsup.c
+index 6b32ddcefc11..ce177a50ec05 100644
+--- a/drivers/scsi/aacraid/commsup.c
++++ b/drivers/scsi/aacraid/commsup.c
+@@ -590,10 +590,10 @@ int aac_fib_send(u16 command, struct fib *fibptr, unsigned long size,
+ }
+ return -EFAULT;
+ }
+- /* We used to udelay() here but that absorbed
+- * a CPU when a timeout occured. Not very
+- * useful. */
+- cpu_relax();
++ /*
++ * Allow other processes / CPUS to use core
++ */
++ schedule();
+ }
+ } else if (down_interruptible(&fibptr->event_wait)) {
+ /* Do nothing ... satisfy
+@@ -1921,6 +1921,10 @@ int aac_command_thread(void *data)
+ if (difference <= 0)
+ difference = 1;
+ set_current_state(TASK_INTERRUPTIBLE);
++
++ if (kthread_should_stop())
++ break;
++
+ schedule_timeout(difference);
+
+ if (kthread_should_stop())
+diff --git a/drivers/thunderbolt/eeprom.c b/drivers/thunderbolt/eeprom.c
+index 0dde34e3a7c5..545c60c826a1 100644
+--- a/drivers/thunderbolt/eeprom.c
++++ b/drivers/thunderbolt/eeprom.c
+@@ -444,6 +444,7 @@ int tb_drom_read(struct tb_switch *sw)
+ return tb_drom_parse_entries(sw);
+ err:
+ kfree(sw->drom);
++ sw->drom = NULL;
+ return -EIO;
+
+ }
+diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c
+index bce16e405d59..db37ee49c3bf 100644
+--- a/drivers/tty/n_gsm.c
++++ b/drivers/tty/n_gsm.c
+@@ -2045,7 +2045,9 @@ static void gsm_cleanup_mux(struct gsm_mux *gsm)
+ }
+ }
+ spin_unlock(&gsm_mux_lock);
+- WARN_ON(i == MAX_MUX);
++ /* open failed before registering => nothing to do */
++ if (i == MAX_MUX)
++ return;
+
+ /* In theory disconnecting DLCI 0 is sufficient but for some
+ modems this is apparently not the case. */
+diff --git a/drivers/tty/serial/ucc_uart.c b/drivers/tty/serial/ucc_uart.c
+index c107a0f0e72f..c859eab47bd8 100644
+--- a/drivers/tty/serial/ucc_uart.c
++++ b/drivers/tty/serial/ucc_uart.c
+@@ -1478,6 +1478,9 @@ static struct of_device_id ucc_uart_match[] = {
+ .type = "serial",
+ .compatible = "ucc_uart",
+ },
++ {
++ .compatible = "fsl,t1040-ucc-uart",
++ },
+ {},
+ };
+ MODULE_DEVICE_TABLE(of, ucc_uart_match);
+diff --git a/drivers/usb/core/driver.c b/drivers/usb/core/driver.c
+index 66be3b43de9f..3c6adc16b34f 100644
+--- a/drivers/usb/core/driver.c
++++ b/drivers/usb/core/driver.c
+@@ -283,7 +283,7 @@ static int usb_probe_interface(struct device *dev)
+ struct usb_device *udev = interface_to_usbdev(intf);
+ const struct usb_device_id *id;
+ int error = -ENODEV;
+- int lpm_disable_error;
++ int lpm_disable_error = -ENODEV;
+
+ dev_dbg(dev, "%s\n", __func__);
+
+@@ -331,12 +331,14 @@ static int usb_probe_interface(struct device *dev)
+ * setting during probe, that should also be fine. usb_set_interface()
+ * will attempt to disable LPM, and fail if it can't disable it.
+ */
+- lpm_disable_error = usb_unlocked_disable_lpm(udev);
+- if (lpm_disable_error && driver->disable_hub_initiated_lpm) {
+- dev_err(&intf->dev, "%s Failed to disable LPM for driver %s\n.",
+- __func__, driver->name);
+- error = lpm_disable_error;
+- goto err;
++ if (driver->disable_hub_initiated_lpm) {
++ lpm_disable_error = usb_unlocked_disable_lpm(udev);
++ if (lpm_disable_error) {
++ dev_err(&intf->dev, "%s Failed to disable LPM for driver %s\n.",
++ __func__, driver->name);
++ error = lpm_disable_error;
++ goto err;
++ }
+ }
+
+ /* Carry out a deferred switch to altsetting 0 */
+@@ -386,7 +388,8 @@ static int usb_unbind_interface(struct device *dev)
+ struct usb_interface *intf = to_usb_interface(dev);
+ struct usb_host_endpoint *ep, **eps = NULL;
+ struct usb_device *udev;
+- int i, j, error, r, lpm_disable_error;
++ int i, j, error, r;
++ int lpm_disable_error = -ENODEV;
+
+ intf->condition = USB_INTERFACE_UNBINDING;
+
+@@ -394,12 +397,13 @@ static int usb_unbind_interface(struct device *dev)
+ udev = interface_to_usbdev(intf);
+ error = usb_autoresume_device(udev);
+
+- /* Hub-initiated LPM policy may change, so attempt to disable LPM until
++ /* If hub-initiated LPM policy may change, attempt to disable LPM until
+ * the driver is unbound. If LPM isn't disabled, that's fine because it
+ * wouldn't be enabled unless all the bound interfaces supported
+ * hub-initiated LPM.
+ */
+- lpm_disable_error = usb_unlocked_disable_lpm(udev);
++ if (driver->disable_hub_initiated_lpm)
++ lpm_disable_error = usb_unlocked_disable_lpm(udev);
+
+ /*
+ * Terminate all URBs for this interface unless the driver
+@@ -502,7 +506,7 @@ int usb_driver_claim_interface(struct usb_driver *driver,
+ struct device *dev;
+ struct usb_device *udev;
+ int retval = 0;
+- int lpm_disable_error;
++ int lpm_disable_error = -ENODEV;
+
+ if (!iface)
+ return -ENODEV;
+@@ -519,12 +523,14 @@ int usb_driver_claim_interface(struct usb_driver *driver,
+
+ iface->condition = USB_INTERFACE_BOUND;
+
+- /* Disable LPM until this driver is bound. */
+- lpm_disable_error = usb_unlocked_disable_lpm(udev);
+- if (lpm_disable_error && driver->disable_hub_initiated_lpm) {
+- dev_err(&iface->dev, "%s Failed to disable LPM for driver %s\n.",
+- __func__, driver->name);
+- return -ENOMEM;
++ /* See the comment about disabling LPM in usb_probe_interface(). */
++ if (driver->disable_hub_initiated_lpm) {
++ lpm_disable_error = usb_unlocked_disable_lpm(udev);
++ if (lpm_disable_error) {
++ dev_err(&iface->dev, "%s Failed to disable LPM for driver %s\n.",
++ __func__, driver->name);
++ return -ENOMEM;
++ }
+ }
+
+ /* Claimed interfaces are initially inactive (suspended) and
+diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c
+index 0009fc847eee..87cc0654b49e 100644
+--- a/drivers/usb/core/hcd.c
++++ b/drivers/usb/core/hcd.c
+@@ -915,7 +915,7 @@ static void usb_bus_init (struct usb_bus *bus)
+ bus->bandwidth_allocated = 0;
+ bus->bandwidth_int_reqs = 0;
+ bus->bandwidth_isoc_reqs = 0;
+- mutex_init(&bus->usb_address0_mutex);
++ mutex_init(&bus->devnum_next_mutex);
+
+ INIT_LIST_HEAD (&bus->bus_list);
+ }
+@@ -2447,6 +2447,14 @@ struct usb_hcd *usb_create_shared_hcd(const struct hc_driver *driver,
+ return NULL;
+ }
+ if (primary_hcd == NULL) {
++ hcd->address0_mutex = kmalloc(sizeof(*hcd->address0_mutex),
++ GFP_KERNEL);
++ if (!hcd->address0_mutex) {
++ kfree(hcd);
++ dev_dbg(dev, "hcd address0 mutex alloc failed\n");
++ return NULL;
++ }
++ mutex_init(hcd->address0_mutex);
+ hcd->bandwidth_mutex = kmalloc(sizeof(*hcd->bandwidth_mutex),
+ GFP_KERNEL);
+ if (!hcd->bandwidth_mutex) {
+@@ -2458,6 +2466,7 @@ struct usb_hcd *usb_create_shared_hcd(const struct hc_driver *driver,
+ dev_set_drvdata(dev, hcd);
+ } else {
+ mutex_lock(&usb_port_peer_mutex);
++ hcd->address0_mutex = primary_hcd->address0_mutex;
+ hcd->bandwidth_mutex = primary_hcd->bandwidth_mutex;
+ hcd->primary_hcd = primary_hcd;
+ primary_hcd->primary_hcd = primary_hcd;
+@@ -2524,8 +2533,10 @@ static void hcd_release(struct kref *kref)
+ struct usb_hcd *hcd = container_of (kref, struct usb_hcd, kref);
+
+ mutex_lock(&usb_port_peer_mutex);
+- if (usb_hcd_is_primary_hcd(hcd))
++ if (usb_hcd_is_primary_hcd(hcd)) {
++ kfree(hcd->address0_mutex);
+ kfree(hcd->bandwidth_mutex);
++ }
+ if (hcd->shared_hcd) {
+ struct usb_hcd *peer = hcd->shared_hcd;
+
+diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
+index 74d856c7522b..ea9475fe20df 100644
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -2066,7 +2066,7 @@ static void choose_devnum(struct usb_device *udev)
+ struct usb_bus *bus = udev->bus;
+
+ /* be safe when more hub events are proceed in parallel */
+- mutex_lock(&bus->usb_address0_mutex);
++ mutex_lock(&bus->devnum_next_mutex);
+ if (udev->wusb) {
+ devnum = udev->portnum + 1;
+ BUG_ON(test_bit(devnum, bus->devmap.devicemap));
+@@ -2084,7 +2084,7 @@ static void choose_devnum(struct usb_device *udev)
+ set_bit(devnum, bus->devmap.devicemap);
+ udev->devnum = devnum;
+ }
+- mutex_unlock(&bus->usb_address0_mutex);
++ mutex_unlock(&bus->devnum_next_mutex);
+ }
+
+ static void release_devnum(struct usb_device *udev)
+@@ -4262,7 +4262,7 @@ hub_port_init (struct usb_hub *hub, struct usb_device *udev, int port1,
+ if (oldspeed == USB_SPEED_LOW)
+ delay = HUB_LONG_RESET_TIME;
+
+- mutex_lock(&hdev->bus->usb_address0_mutex);
++ mutex_lock(hcd->address0_mutex);
+
+ /* Reset the device; full speed may morph to high speed */
+ /* FIXME a USB 2.0 device may morph into SuperSpeed on reset. */
+@@ -4544,7 +4544,7 @@ fail:
+ hub_port_disable(hub, port1, 0);
+ update_devnum(udev, devnum); /* for disconnect processing */
+ }
+- mutex_unlock(&hdev->bus->usb_address0_mutex);
++ mutex_unlock(hcd->address0_mutex);
+ return retval;
+ }
+
+diff --git a/drivers/usb/misc/usbtest.c b/drivers/usb/misc/usbtest.c
+index 0bbafe795a72..bbddc44ce8bc 100644
+--- a/drivers/usb/misc/usbtest.c
++++ b/drivers/usb/misc/usbtest.c
+@@ -303,11 +303,20 @@ static unsigned mod_pattern;
+ module_param_named(pattern, mod_pattern, uint, S_IRUGO | S_IWUSR);
+ MODULE_PARM_DESC(mod_pattern, "i/o pattern (0 == zeroes)");
+
+-static inline void simple_fill_buf(struct urb *urb)
++static unsigned get_maxpacket(struct usb_device *udev, int pipe)
++{
++ struct usb_host_endpoint *ep;
++
++ ep = usb_pipe_endpoint(udev, pipe);
++ return le16_to_cpup(&ep->desc.wMaxPacketSize);
++}
++
++static void simple_fill_buf(struct urb *urb)
+ {
+ unsigned i;
+ u8 *buf = urb->transfer_buffer;
+ unsigned len = urb->transfer_buffer_length;
++ unsigned maxpacket;
+
+ switch (pattern) {
+ default:
+@@ -316,8 +325,9 @@ static inline void simple_fill_buf(struct urb *urb)
+ memset(buf, 0, len);
+ break;
+ case 1: /* mod63 */
++ maxpacket = get_maxpacket(urb->dev, urb->pipe);
+ for (i = 0; i < len; i++)
+- *buf++ = (u8) (i % 63);
++ *buf++ = (u8) ((i % maxpacket) % 63);
+ break;
+ }
+ }
+@@ -349,6 +359,7 @@ static int simple_check_buf(struct usbtest_dev *tdev, struct urb *urb)
+ u8 expected;
+ u8 *buf = urb->transfer_buffer;
+ unsigned len = urb->actual_length;
++ unsigned maxpacket = get_maxpacket(urb->dev, urb->pipe);
+
+ int ret = check_guard_bytes(tdev, urb);
+ if (ret)
+@@ -366,7 +377,7 @@ static int simple_check_buf(struct usbtest_dev *tdev, struct urb *urb)
+ * with set_interface or set_config.
+ */
+ case 1: /* mod63 */
+- expected = i % 63;
++ expected = (i % maxpacket) % 63;
+ break;
+ /* always fail unsupported patterns */
+ default:
+@@ -478,11 +489,14 @@ static void free_sglist(struct scatterlist *sg, int nents)
+ }
+
+ static struct scatterlist *
+-alloc_sglist(int nents, int max, int vary)
++alloc_sglist(int nents, int max, int vary, struct usbtest_dev *dev, int pipe)
+ {
+ struct scatterlist *sg;
++ unsigned int n_size = 0;
+ unsigned i;
+ unsigned size = max;
++ unsigned maxpacket =
++ get_maxpacket(interface_to_usbdev(dev->intf), pipe);
+
+ if (max == 0)
+ return NULL;
+@@ -511,7 +525,8 @@ alloc_sglist(int nents, int max, int vary)
+ break;
+ case 1:
+ for (j = 0; j < size; j++)
+- *buf++ = (u8) (j % 63);
++ *buf++ = (u8) (((j + n_size) % maxpacket) % 63);
++ n_size += size;
+ break;
+ }
+
+@@ -2175,7 +2190,8 @@ usbtest_ioctl(struct usb_interface *intf, unsigned int code, void *buf)
+ "TEST 5: write %d sglists %d entries of %d bytes\n",
+ param->iterations,
+ param->sglen, param->length);
+- sg = alloc_sglist(param->sglen, param->length, 0);
++ sg = alloc_sglist(param->sglen, param->length,
++ 0, dev, dev->out_pipe);
+ if (!sg) {
+ retval = -ENOMEM;
+ break;
+@@ -2193,7 +2209,8 @@ usbtest_ioctl(struct usb_interface *intf, unsigned int code, void *buf)
+ "TEST 6: read %d sglists %d entries of %d bytes\n",
+ param->iterations,
+ param->sglen, param->length);
+- sg = alloc_sglist(param->sglen, param->length, 0);
++ sg = alloc_sglist(param->sglen, param->length,
++ 0, dev, dev->in_pipe);
+ if (!sg) {
+ retval = -ENOMEM;
+ break;
+@@ -2210,7 +2227,8 @@ usbtest_ioctl(struct usb_interface *intf, unsigned int code, void *buf)
+ "TEST 7: write/%d %d sglists %d entries 0..%d bytes\n",
+ param->vary, param->iterations,
+ param->sglen, param->length);
+- sg = alloc_sglist(param->sglen, param->length, param->vary);
++ sg = alloc_sglist(param->sglen, param->length,
++ param->vary, dev, dev->out_pipe);
+ if (!sg) {
+ retval = -ENOMEM;
+ break;
+@@ -2227,7 +2245,8 @@ usbtest_ioctl(struct usb_interface *intf, unsigned int code, void *buf)
+ "TEST 8: read/%d %d sglists %d entries 0..%d bytes\n",
+ param->vary, param->iterations,
+ param->sglen, param->length);
+- sg = alloc_sglist(param->sglen, param->length, param->vary);
++ sg = alloc_sglist(param->sglen, param->length,
++ param->vary, dev, dev->in_pipe);
+ if (!sg) {
+ retval = -ENOMEM;
+ break;
+diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
+index 642125d27df4..685a90168d8e 100644
+--- a/drivers/usb/serial/cp210x.c
++++ b/drivers/usb/serial/cp210x.c
+@@ -43,8 +43,8 @@ static int cp210x_tiocmset(struct tty_struct *, unsigned int, unsigned int);
+ static int cp210x_tiocmset_port(struct usb_serial_port *port,
+ unsigned int, unsigned int);
+ static void cp210x_break_ctl(struct tty_struct *, int);
+-static int cp210x_startup(struct usb_serial *);
+-static void cp210x_release(struct usb_serial *);
++static int cp210x_port_probe(struct usb_serial_port *);
++static int cp210x_port_remove(struct usb_serial_port *);
+ static void cp210x_dtr_rts(struct usb_serial_port *p, int on);
+
+ static const struct usb_device_id id_table[] = {
+@@ -207,7 +207,7 @@ static const struct usb_device_id id_table[] = {
+
+ MODULE_DEVICE_TABLE(usb, id_table);
+
+-struct cp210x_serial_private {
++struct cp210x_port_private {
+ __u8 bInterfaceNumber;
+ };
+
+@@ -226,8 +226,8 @@ static struct usb_serial_driver cp210x_device = {
+ .set_termios = cp210x_set_termios,
+ .tiocmget = cp210x_tiocmget,
+ .tiocmset = cp210x_tiocmset,
+- .attach = cp210x_startup,
+- .release = cp210x_release,
++ .port_probe = cp210x_port_probe,
++ .port_remove = cp210x_port_remove,
+ .dtr_rts = cp210x_dtr_rts
+ };
+
+@@ -321,7 +321,7 @@ static int cp210x_get_config(struct usb_serial_port *port, u8 request,
+ unsigned int *data, int size)
+ {
+ struct usb_serial *serial = port->serial;
+- struct cp210x_serial_private *spriv = usb_get_serial_data(serial);
++ struct cp210x_port_private *port_priv = usb_get_serial_port_data(port);
+ __le32 *buf;
+ int result, i, length;
+
+@@ -335,7 +335,7 @@ static int cp210x_get_config(struct usb_serial_port *port, u8 request,
+ /* Issue the request, attempting to read 'size' bytes */
+ result = usb_control_msg(serial->dev, usb_rcvctrlpipe(serial->dev, 0),
+ request, REQTYPE_INTERFACE_TO_HOST, 0x0000,
+- spriv->bInterfaceNumber, buf, size,
++ port_priv->bInterfaceNumber, buf, size,
+ USB_CTRL_GET_TIMEOUT);
+
+ /* Convert data into an array of integers */
+@@ -366,7 +366,7 @@ static int cp210x_set_config(struct usb_serial_port *port, u8 request,
+ unsigned int *data, int size)
+ {
+ struct usb_serial *serial = port->serial;
+- struct cp210x_serial_private *spriv = usb_get_serial_data(serial);
++ struct cp210x_port_private *port_priv = usb_get_serial_port_data(port);
+ __le32 *buf;
+ int result, i, length;
+
+@@ -385,13 +385,13 @@ static int cp210x_set_config(struct usb_serial_port *port, u8 request,
+ result = usb_control_msg(serial->dev,
+ usb_sndctrlpipe(serial->dev, 0),
+ request, REQTYPE_HOST_TO_INTERFACE, 0x0000,
+- spriv->bInterfaceNumber, buf, size,
++ port_priv->bInterfaceNumber, buf, size,
+ USB_CTRL_SET_TIMEOUT);
+ } else {
+ result = usb_control_msg(serial->dev,
+ usb_sndctrlpipe(serial->dev, 0),
+ request, REQTYPE_HOST_TO_INTERFACE, data[0],
+- spriv->bInterfaceNumber, NULL, 0,
++ port_priv->bInterfaceNumber, NULL, 0,
+ USB_CTRL_SET_TIMEOUT);
+ }
+
+@@ -785,7 +785,7 @@ static void cp210x_set_termios(struct tty_struct *tty,
+ } else {
+ modem_ctl[0] &= ~0x7B;
+ modem_ctl[0] |= 0x01;
+- modem_ctl[1] |= 0x40;
++ modem_ctl[1] = 0x40;
+ dev_dbg(dev, "%s - flow control = NONE\n", __func__);
+ }
+
+@@ -873,29 +873,32 @@ static void cp210x_break_ctl(struct tty_struct *tty, int break_state)
+ cp210x_set_config(port, CP210X_SET_BREAK, &state, 2);
+ }
+
+-static int cp210x_startup(struct usb_serial *serial)
++static int cp210x_port_probe(struct usb_serial_port *port)
+ {
++ struct usb_serial *serial = port->serial;
+ struct usb_host_interface *cur_altsetting;
+- struct cp210x_serial_private *spriv;
++ struct cp210x_port_private *port_priv;
+
+- spriv = kzalloc(sizeof(*spriv), GFP_KERNEL);
+- if (!spriv)
++ port_priv = kzalloc(sizeof(*port_priv), GFP_KERNEL);
++ if (!port_priv)
+ return -ENOMEM;
+
+ cur_altsetting = serial->interface->cur_altsetting;
+- spriv->bInterfaceNumber = cur_altsetting->desc.bInterfaceNumber;
++ port_priv->bInterfaceNumber = cur_altsetting->desc.bInterfaceNumber;
+
+- usb_set_serial_data(serial, spriv);
++ usb_set_serial_port_data(port, port_priv);
+
+ return 0;
+ }
+
+-static void cp210x_release(struct usb_serial *serial)
++static int cp210x_port_remove(struct usb_serial_port *port)
+ {
+- struct cp210x_serial_private *spriv;
++ struct cp210x_port_private *port_priv;
++
++ port_priv = usb_get_serial_port_data(port);
++ kfree(port_priv);
+
+- spriv = usb_get_serial_data(serial);
+- kfree(spriv);
++ return 0;
+ }
+
+ module_usb_serial_driver(serial_drivers, id_table);
+diff --git a/drivers/usb/serial/io_edgeport.c b/drivers/usb/serial/io_edgeport.c
+index c0866971db2b..1947ea0e0988 100644
+--- a/drivers/usb/serial/io_edgeport.c
++++ b/drivers/usb/serial/io_edgeport.c
+@@ -2856,14 +2856,16 @@ static int edge_startup(struct usb_serial *serial)
+ /* not set up yet, so do it now */
+ edge_serial->interrupt_read_urb =
+ usb_alloc_urb(0, GFP_KERNEL);
+- if (!edge_serial->interrupt_read_urb)
+- return -ENOMEM;
++ if (!edge_serial->interrupt_read_urb) {
++ response = -ENOMEM;
++ break;
++ }
+
+ edge_serial->interrupt_in_buffer =
+ kmalloc(buffer_size, GFP_KERNEL);
+ if (!edge_serial->interrupt_in_buffer) {
+- usb_free_urb(edge_serial->interrupt_read_urb);
+- return -ENOMEM;
++ response = -ENOMEM;
++ break;
+ }
+ edge_serial->interrupt_in_endpoint =
+ endpoint->bEndpointAddress;
+@@ -2891,14 +2893,16 @@ static int edge_startup(struct usb_serial *serial)
+ /* not set up yet, so do it now */
+ edge_serial->read_urb =
+ usb_alloc_urb(0, GFP_KERNEL);
+- if (!edge_serial->read_urb)
+- return -ENOMEM;
++ if (!edge_serial->read_urb) {
++ response = -ENOMEM;
++ break;
++ }
+
+ edge_serial->bulk_in_buffer =
+ kmalloc(buffer_size, GFP_KERNEL);
+ if (!edge_serial->bulk_in_buffer) {
+- usb_free_urb(edge_serial->read_urb);
+- return -ENOMEM;
++ response = -ENOMEM;
++ break;
+ }
+ edge_serial->bulk_in_endpoint =
+ endpoint->bEndpointAddress;
+@@ -2924,9 +2928,22 @@ static int edge_startup(struct usb_serial *serial)
+ }
+ }
+
+- if (!interrupt_in_found || !bulk_in_found || !bulk_out_found) {
+- dev_err(ddev, "Error - the proper endpoints were not found!\n");
+- return -ENODEV;
++ if (response || !interrupt_in_found || !bulk_in_found ||
++ !bulk_out_found) {
++ if (!response) {
++ dev_err(ddev, "expected endpoints not found\n");
++ response = -ENODEV;
++ }
++
++ usb_free_urb(edge_serial->interrupt_read_urb);
++ kfree(edge_serial->interrupt_in_buffer);
++
++ usb_free_urb(edge_serial->read_urb);
++ kfree(edge_serial->bulk_in_buffer);
++
++ kfree(edge_serial);
++
++ return response;
+ }
+
+ /* start interrupt read for this edgeport this interrupt will
+@@ -2949,16 +2966,9 @@ static void edge_disconnect(struct usb_serial *serial)
+ {
+ struct edgeport_serial *edge_serial = usb_get_serial_data(serial);
+
+- /* stop reads and writes on all ports */
+- /* free up our endpoint stuff */
+ if (edge_serial->is_epic) {
+ usb_kill_urb(edge_serial->interrupt_read_urb);
+- usb_free_urb(edge_serial->interrupt_read_urb);
+- kfree(edge_serial->interrupt_in_buffer);
+-
+ usb_kill_urb(edge_serial->read_urb);
+- usb_free_urb(edge_serial->read_urb);
+- kfree(edge_serial->bulk_in_buffer);
+ }
+ }
+
+@@ -2971,6 +2981,16 @@ static void edge_release(struct usb_serial *serial)
+ {
+ struct edgeport_serial *edge_serial = usb_get_serial_data(serial);
+
++ if (edge_serial->is_epic) {
++ usb_kill_urb(edge_serial->interrupt_read_urb);
++ usb_free_urb(edge_serial->interrupt_read_urb);
++ kfree(edge_serial->interrupt_in_buffer);
++
++ usb_kill_urb(edge_serial->read_urb);
++ usb_free_urb(edge_serial->read_urb);
++ kfree(edge_serial->bulk_in_buffer);
++ }
++
+ kfree(edge_serial);
+ }
+
+diff --git a/drivers/usb/serial/keyspan.c b/drivers/usb/serial/keyspan.c
+index e07b15ed5814..7faa901ee47f 100644
+--- a/drivers/usb/serial/keyspan.c
++++ b/drivers/usb/serial/keyspan.c
+@@ -2376,6 +2376,10 @@ static void keyspan_release(struct usb_serial *serial)
+
+ s_priv = usb_get_serial_data(serial);
+
++ /* Make sure to unlink the URBs submitted in attach. */
++ usb_kill_urb(s_priv->instat_urb);
++ usb_kill_urb(s_priv->indat_urb);
++
+ usb_free_urb(s_priv->instat_urb);
+ usb_free_urb(s_priv->indat_urb);
+ usb_free_urb(s_priv->glocont_urb);
+diff --git a/drivers/usb/serial/mxuport.c b/drivers/usb/serial/mxuport.c
+index 460a40669967..d029b2fc0f75 100644
+--- a/drivers/usb/serial/mxuport.c
++++ b/drivers/usb/serial/mxuport.c
+@@ -1263,6 +1263,15 @@ static int mxuport_attach(struct usb_serial *serial)
+ return 0;
+ }
+
++static void mxuport_release(struct usb_serial *serial)
++{
++ struct usb_serial_port *port0 = serial->port[0];
++ struct usb_serial_port *port1 = serial->port[1];
++
++ usb_serial_generic_close(port1);
++ usb_serial_generic_close(port0);
++}
++
+ static int mxuport_open(struct tty_struct *tty, struct usb_serial_port *port)
+ {
+ struct mxuport_port *mxport = usb_get_serial_port_data(port);
+@@ -1365,6 +1374,7 @@ static struct usb_serial_driver mxuport_device = {
+ .probe = mxuport_probe,
+ .port_probe = mxuport_port_probe,
+ .attach = mxuport_attach,
++ .release = mxuport_release,
+ .calc_num_ports = mxuport_calc_num_ports,
+ .open = mxuport_open,
+ .close = mxuport_close,
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index 2a593d9232d7..d67b687f20db 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -376,18 +376,22 @@ static void option_instat_callback(struct urb *urb);
+ #define HAIER_PRODUCT_CE81B 0x10f8
+ #define HAIER_PRODUCT_CE100 0x2009
+
+-/* Cinterion (formerly Siemens) products */
+-#define SIEMENS_VENDOR_ID 0x0681
+-#define CINTERION_VENDOR_ID 0x1e2d
++/* Gemalto's Cinterion products (formerly Siemens) */
++#define SIEMENS_VENDOR_ID 0x0681
++#define CINTERION_VENDOR_ID 0x1e2d
++#define CINTERION_PRODUCT_HC25_MDMNET 0x0040
+ #define CINTERION_PRODUCT_HC25_MDM 0x0047
+-#define CINTERION_PRODUCT_HC25_MDMNET 0x0040
++#define CINTERION_PRODUCT_HC28_MDMNET 0x004A /* same for HC28J */
+ #define CINTERION_PRODUCT_HC28_MDM 0x004C
+-#define CINTERION_PRODUCT_HC28_MDMNET 0x004A /* same for HC28J */
+ #define CINTERION_PRODUCT_EU3_E 0x0051
+ #define CINTERION_PRODUCT_EU3_P 0x0052
+ #define CINTERION_PRODUCT_PH8 0x0053
+ #define CINTERION_PRODUCT_AHXX 0x0055
+ #define CINTERION_PRODUCT_PLXX 0x0060
++#define CINTERION_PRODUCT_PH8_2RMNET 0x0082
++#define CINTERION_PRODUCT_PH8_AUDIO 0x0083
++#define CINTERION_PRODUCT_AHXX_2RMNET 0x0084
++#define CINTERION_PRODUCT_AHXX_AUDIO 0x0085
+
+ /* Olivetti products */
+ #define OLIVETTI_VENDOR_ID 0x0b3c
+@@ -642,6 +646,10 @@ static const struct option_blacklist_info telit_le922_blacklist_usbcfg3 = {
+ .reserved = BIT(1) | BIT(2) | BIT(3),
+ };
+
++static const struct option_blacklist_info cinterion_rmnet2_blacklist = {
++ .reserved = BIT(4) | BIT(5),
++};
++
+ static const struct usb_device_id option_ids[] = {
+ { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_COLT) },
+ { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_RICOLA) },
+@@ -1614,7 +1622,79 @@ static const struct usb_device_id option_ids[] = {
+ .driver_info = (kernel_ulong_t)&net_intf3_blacklist },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0178, 0xff, 0xff, 0xff),
+ .driver_info = (kernel_ulong_t)&net_intf3_blacklist },
+- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffe9, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff42, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff43, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff44, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff45, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff46, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff47, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff48, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff49, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff4a, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff4b, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff4c, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff4d, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff4e, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff4f, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff50, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff51, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff52, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff53, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff54, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff55, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff56, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff57, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff58, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff59, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff5a, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff5b, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff5c, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff5d, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff5e, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff5f, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff60, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff61, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff62, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff63, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff64, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff65, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff66, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff67, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff68, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff69, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff6a, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff6b, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff6c, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff6d, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff6e, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff6f, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff70, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff71, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff72, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff73, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff74, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff75, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff76, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff77, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff78, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff79, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff7a, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff7b, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff7c, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff7d, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff7e, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff7f, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff80, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff81, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff82, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff83, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff84, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff85, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff86, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff87, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff88, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff89, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff8a, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff8b, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff8c, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff8d, 0xff, 0xff, 0xff) },
+@@ -1625,6 +1705,61 @@ static const struct usb_device_id option_ids[] = {
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff92, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff93, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff94, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff9f, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffa0, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffa1, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffa2, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffa3, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffa4, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffa5, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffa6, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffa7, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffa8, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffa9, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffaa, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffab, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffac, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffae, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffaf, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffb0, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffb1, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffb2, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffb3, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffb4, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffb5, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffb6, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffb7, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffb8, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffb9, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffba, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffbb, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffbc, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffbd, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffbe, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffbf, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffc0, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffc1, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffc2, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffc3, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffc4, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffc5, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffc6, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffc7, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffc8, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffc9, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffca, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffcb, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffcc, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffcd, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffce, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffcf, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffd0, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffd1, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffd2, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffd3, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffd4, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffd5, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffe9, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffec, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffee, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xfff6, 0xff, 0xff, 0xff) },
+@@ -1721,7 +1856,13 @@ static const struct usb_device_id option_ids[] = {
+ { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_AHXX, 0xff) },
+ { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_PLXX),
+ .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
+- { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_HC28_MDM) },
++ { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_PH8_2RMNET, 0xff),
++ .driver_info = (kernel_ulong_t)&cinterion_rmnet2_blacklist },
++ { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_PH8_AUDIO, 0xff),
++ .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
++ { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_AHXX_2RMNET, 0xff) },
++ { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_AHXX_AUDIO, 0xff) },
++ { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_HC28_MDM) },
+ { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_HC28_MDMNET) },
+ { USB_DEVICE(SIEMENS_VENDOR_ID, CINTERION_PRODUCT_HC25_MDM) },
+ { USB_DEVICE(SIEMENS_VENDOR_ID, CINTERION_PRODUCT_HC25_MDMNET) },
+diff --git a/drivers/usb/serial/quatech2.c b/drivers/usb/serial/quatech2.c
+index 504f5bff79c0..b18974cbd995 100644
+--- a/drivers/usb/serial/quatech2.c
++++ b/drivers/usb/serial/quatech2.c
+@@ -141,6 +141,7 @@ static void qt2_release(struct usb_serial *serial)
+
+ serial_priv = usb_get_serial_data(serial);
+
++ usb_kill_urb(serial_priv->read_urb);
+ usb_free_urb(serial_priv->read_urb);
+ kfree(serial_priv->read_buffer);
+ kfree(serial_priv);
+diff --git a/drivers/xen/events/events_base.c b/drivers/xen/events/events_base.c
+index 511aab3b9206..4bf7a34f6a4c 100644
+--- a/drivers/xen/events/events_base.c
++++ b/drivers/xen/events/events_base.c
+@@ -486,7 +486,8 @@ static void eoi_pirq(struct irq_data *data)
+ if (!VALID_EVTCHN(evtchn))
+ return;
+
+- if (unlikely(irqd_is_setaffinity_pending(data))) {
++ if (unlikely(irqd_is_setaffinity_pending(data)) &&
++ likely(!irqd_irq_disabled(data))) {
+ int masked = test_and_set_mask(evtchn);
+
+ clear_evtchn(evtchn);
+@@ -1373,7 +1374,8 @@ static void ack_dynirq(struct irq_data *data)
+ if (!VALID_EVTCHN(evtchn))
+ return;
+
+- if (unlikely(irqd_is_setaffinity_pending(data))) {
++ if (unlikely(irqd_is_setaffinity_pending(data)) &&
++ likely(!irqd_irq_disabled(data))) {
+ int masked = test_and_set_mask(evtchn);
+
+ clear_evtchn(evtchn);
+diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
+index ba5aec76e6f8..42d11e7cf7fe 100644
+--- a/fs/btrfs/ctree.h
++++ b/fs/btrfs/ctree.h
+@@ -3866,6 +3866,7 @@ extern const struct dentry_operations btrfs_dentry_operations;
+
+ /* ioctl.c */
+ long btrfs_ioctl(struct file *file, unsigned int cmd, unsigned long arg);
++long btrfs_compat_ioctl(struct file *file, unsigned int cmd, unsigned long arg);
+ void btrfs_update_iflags(struct inode *inode);
+ void btrfs_inherit_iflags(struct inode *inode, struct inode *dir);
+ int btrfs_is_empty_uuid(u8 *uuid);
+diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c
+index e557e4ca0392..2ad4cb3da8f6 100644
+--- a/fs/btrfs/file.c
++++ b/fs/btrfs/file.c
+@@ -2797,7 +2797,7 @@ const struct file_operations btrfs_file_operations = {
+ .fallocate = btrfs_fallocate,
+ .unlocked_ioctl = btrfs_ioctl,
+ #ifdef CONFIG_COMPAT
+- .compat_ioctl = btrfs_ioctl,
++ .compat_ioctl = btrfs_compat_ioctl,
+ #endif
+ };
+
+diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
+index c8d287fff7bc..ef677cdf777f 100644
+--- a/fs/btrfs/inode.c
++++ b/fs/btrfs/inode.c
+@@ -9513,7 +9513,7 @@ static const struct file_operations btrfs_dir_file_operations = {
+ .iterate = btrfs_real_readdir,
+ .unlocked_ioctl = btrfs_ioctl,
+ #ifdef CONFIG_COMPAT
+- .compat_ioctl = btrfs_ioctl,
++ .compat_ioctl = btrfs_compat_ioctl,
+ #endif
+ .release = btrfs_release_file,
+ .fsync = btrfs_sync_file,
+diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
+index 31c9f6471ce7..1c1ee12ab0cf 100644
+--- a/fs/btrfs/ioctl.c
++++ b/fs/btrfs/ioctl.c
+@@ -5495,3 +5495,24 @@ long btrfs_ioctl(struct file *file, unsigned int
+
+ return -ENOTTY;
+ }
++
++#ifdef CONFIG_COMPAT
++long btrfs_compat_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
++{
++ switch (cmd) {
++ case FS_IOC32_GETFLAGS:
++ cmd = FS_IOC_GETFLAGS;
++ break;
++ case FS_IOC32_SETFLAGS:
++ cmd = FS_IOC_SETFLAGS;
++ break;
++ case FS_IOC32_GETVERSION:
++ cmd = FS_IOC_GETVERSION;
++ break;
++ default:
++ return -ENOIOCTLCMD;
++ }
++
++ return btrfs_ioctl(file, cmd, (unsigned long) compat_ptr(arg));
++}
++#endif
+diff --git a/fs/cifs/cifs_spnego.c b/fs/cifs/cifs_spnego.c
+index f4cf200b3c76..79450fa66d16 100644
+--- a/fs/cifs/cifs_spnego.c
++++ b/fs/cifs/cifs_spnego.c
+@@ -24,10 +24,13 @@
+ #include <linux/string.h>
+ #include <keys/user-type.h>
+ #include <linux/key-type.h>
++#include <linux/keyctl.h>
+ #include <linux/inet.h>
+ #include "cifsglob.h"
+ #include "cifs_spnego.h"
+ #include "cifs_debug.h"
++#include "cifsproto.h"
++static const struct cred *spnego_cred;
+
+ /* create a new cifs key */
+ static int
+@@ -102,6 +105,7 @@ cifs_get_spnego_key(struct cifs_ses *sesInfo)
+ size_t desc_len;
+ struct key *spnego_key;
+ const char *hostname = server->hostname;
++ const struct cred *saved_cred;
+
+ /* length of fields (with semicolons): ver=0xyz ip4=ipaddress
+ host=hostname sec=mechanism uid=0xFF user=username */
+@@ -163,7 +167,9 @@ cifs_get_spnego_key(struct cifs_ses *sesInfo)
+ sprintf(dp, ";pid=0x%x", current->pid);
+
+ cifs_dbg(FYI, "key description = %s\n", description);
++ saved_cred = override_creds(spnego_cred);
+ spnego_key = request_key(&cifs_spnego_key_type, description, "");
++ revert_creds(saved_cred);
+
+ #ifdef CONFIG_CIFS_DEBUG2
+ if (cifsFYI && !IS_ERR(spnego_key)) {
+@@ -177,3 +183,64 @@ out:
+ kfree(description);
+ return spnego_key;
+ }
++
++int
++init_cifs_spnego(void)
++{
++ struct cred *cred;
++ struct key *keyring;
++ int ret;
++
++ cifs_dbg(FYI, "Registering the %s key type\n",
++ cifs_spnego_key_type.name);
++
++ /*
++ * Create an override credential set with special thread keyring for
++ * spnego upcalls.
++ */
++
++ cred = prepare_kernel_cred(NULL);
++ if (!cred)
++ return -ENOMEM;
++
++ keyring = keyring_alloc(".cifs_spnego",
++ GLOBAL_ROOT_UID, GLOBAL_ROOT_GID, cred,
++ (KEY_POS_ALL & ~KEY_POS_SETATTR) |
++ KEY_USR_VIEW | KEY_USR_READ,
++ KEY_ALLOC_NOT_IN_QUOTA, NULL);
++ if (IS_ERR(keyring)) {
++ ret = PTR_ERR(keyring);
++ goto failed_put_cred;
++ }
++
++ ret = register_key_type(&cifs_spnego_key_type);
++ if (ret < 0)
++ goto failed_put_key;
++
++ /*
++ * instruct request_key() to use this special keyring as a cache for
++ * the results it looks up
++ */
++ set_bit(KEY_FLAG_ROOT_CAN_CLEAR, &keyring->flags);
++ cred->thread_keyring = keyring;
++ cred->jit_keyring = KEY_REQKEY_DEFL_THREAD_KEYRING;
++ spnego_cred = cred;
++
++ cifs_dbg(FYI, "cifs spnego keyring: %d\n", key_serial(keyring));
++ return 0;
++
++failed_put_key:
++ key_put(keyring);
++failed_put_cred:
++ put_cred(cred);
++ return ret;
++}
++
++void
++exit_cifs_spnego(void)
++{
++ key_revoke(spnego_cred->thread_keyring);
++ unregister_key_type(&cifs_spnego_key_type);
++ put_cred(spnego_cred);
++ cifs_dbg(FYI, "Unregistered %s key type\n", cifs_spnego_key_type.name);
++}
+diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
+index 9d7996e8e793..3e924abdd969 100644
+--- a/fs/cifs/cifsfs.c
++++ b/fs/cifs/cifsfs.c
+@@ -1249,7 +1249,7 @@ init_cifs(void)
+ goto out_destroy_mids;
+
+ #ifdef CONFIG_CIFS_UPCALL
+- rc = register_key_type(&cifs_spnego_key_type);
++ rc = init_cifs_spnego();
+ if (rc)
+ goto out_destroy_request_bufs;
+ #endif /* CONFIG_CIFS_UPCALL */
+@@ -1272,7 +1272,7 @@ out_init_cifs_idmap:
+ out_register_key_type:
+ #endif
+ #ifdef CONFIG_CIFS_UPCALL
+- unregister_key_type(&cifs_spnego_key_type);
++ exit_cifs_spnego();
+ out_destroy_request_bufs:
+ #endif
+ cifs_destroy_request_bufs();
+diff --git a/fs/cifs/cifsproto.h b/fs/cifs/cifsproto.h
+index c31ce98c1704..5b868060eab8 100644
+--- a/fs/cifs/cifsproto.h
++++ b/fs/cifs/cifsproto.h
+@@ -60,6 +60,8 @@ do { \
+ } while (0)
+ extern int init_cifs_idmap(void);
+ extern void exit_cifs_idmap(void);
++extern int init_cifs_spnego(void);
++extern void exit_cifs_spnego(void);
+ extern char *build_path_from_dentry(struct dentry *);
+ extern char *cifs_build_path_to_root(struct smb_vol *vol,
+ struct cifs_sb_info *cifs_sb,
+diff --git a/fs/cifs/sess.c b/fs/cifs/sess.c
+index 57db63ff88da..fe423e18450f 100644
+--- a/fs/cifs/sess.c
++++ b/fs/cifs/sess.c
+@@ -400,19 +400,27 @@ int build_ntlmssp_auth_blob(unsigned char *pbuffer,
+ sec_blob->LmChallengeResponse.MaximumLength = 0;
+
+ sec_blob->NtChallengeResponse.BufferOffset = cpu_to_le32(tmp - pbuffer);
+- rc = setup_ntlmv2_rsp(ses, nls_cp);
+- if (rc) {
+- cifs_dbg(VFS, "Error %d during NTLMSSP authentication\n", rc);
+- goto setup_ntlmv2_ret;
++ if (ses->user_name != NULL) {
++ rc = setup_ntlmv2_rsp(ses, nls_cp);
++ if (rc) {
++ cifs_dbg(VFS, "Error %d during NTLMSSP authentication\n", rc);
++ goto setup_ntlmv2_ret;
++ }
++ memcpy(tmp, ses->auth_key.response + CIFS_SESS_KEY_SIZE,
++ ses->auth_key.len - CIFS_SESS_KEY_SIZE);
++ tmp += ses->auth_key.len - CIFS_SESS_KEY_SIZE;
++
++ sec_blob->NtChallengeResponse.Length =
++ cpu_to_le16(ses->auth_key.len - CIFS_SESS_KEY_SIZE);
++ sec_blob->NtChallengeResponse.MaximumLength =
++ cpu_to_le16(ses->auth_key.len - CIFS_SESS_KEY_SIZE);
++ } else {
++ /*
++ * don't send an NT Response for anonymous access
++ */
++ sec_blob->NtChallengeResponse.Length = 0;
++ sec_blob->NtChallengeResponse.MaximumLength = 0;
+ }
+- memcpy(tmp, ses->auth_key.response + CIFS_SESS_KEY_SIZE,
+- ses->auth_key.len - CIFS_SESS_KEY_SIZE);
+- tmp += ses->auth_key.len - CIFS_SESS_KEY_SIZE;
+-
+- sec_blob->NtChallengeResponse.Length =
+- cpu_to_le16(ses->auth_key.len - CIFS_SESS_KEY_SIZE);
+- sec_blob->NtChallengeResponse.MaximumLength =
+- cpu_to_le16(ses->auth_key.len - CIFS_SESS_KEY_SIZE);
+
+ if (ses->domainName == NULL) {
+ sec_blob->DomainName.BufferOffset = cpu_to_le32(tmp - pbuffer);
+@@ -670,20 +678,24 @@ sess_auth_lanman(struct sess_data *sess_data)
+
+ pSMB->req.hdr.Flags2 &= ~SMBFLG2_UNICODE;
+
+- /* no capabilities flags in old lanman negotiation */
+- pSMB->old_req.PasswordLength = cpu_to_le16(CIFS_AUTH_RESP_SIZE);
+-
+- /* Calculate hash with password and copy into bcc_ptr.
+- * Encryption Key (stored as in cryptkey) gets used if the
+- * security mode bit in Negottiate Protocol response states
+- * to use challenge/response method (i.e. Password bit is 1).
+- */
+- rc = calc_lanman_hash(ses->password, ses->server->cryptkey,
+- ses->server->sec_mode & SECMODE_PW_ENCRYPT ?
+- true : false, lnm_session_key);
+-
+- memcpy(bcc_ptr, (char *)lnm_session_key, CIFS_AUTH_RESP_SIZE);
+- bcc_ptr += CIFS_AUTH_RESP_SIZE;
++ if (ses->user_name != NULL) {
++ /* no capabilities flags in old lanman negotiation */
++ pSMB->old_req.PasswordLength = cpu_to_le16(CIFS_AUTH_RESP_SIZE);
++
++ /* Calculate hash with password and copy into bcc_ptr.
++ * Encryption Key (stored as in cryptkey) gets used if the
++ * security mode bit in Negottiate Protocol response states
++ * to use challenge/response method (i.e. Password bit is 1).
++ */
++ rc = calc_lanman_hash(ses->password, ses->server->cryptkey,
++ ses->server->sec_mode & SECMODE_PW_ENCRYPT ?
++ true : false, lnm_session_key);
++
++ memcpy(bcc_ptr, (char *)lnm_session_key, CIFS_AUTH_RESP_SIZE);
++ bcc_ptr += CIFS_AUTH_RESP_SIZE;
++ } else {
++ pSMB->old_req.PasswordLength = 0;
++ }
+
+ /*
+ * can not sign if LANMAN negotiated so no need
+@@ -769,26 +781,31 @@ sess_auth_ntlm(struct sess_data *sess_data)
+ capabilities = cifs_ssetup_hdr(ses, pSMB);
+
+ pSMB->req_no_secext.Capabilities = cpu_to_le32(capabilities);
+- pSMB->req_no_secext.CaseInsensitivePasswordLength =
+- cpu_to_le16(CIFS_AUTH_RESP_SIZE);
+- pSMB->req_no_secext.CaseSensitivePasswordLength =
+- cpu_to_le16(CIFS_AUTH_RESP_SIZE);
+-
+- /* calculate ntlm response and session key */
+- rc = setup_ntlm_response(ses, sess_data->nls_cp);
+- if (rc) {
+- cifs_dbg(VFS, "Error %d during NTLM authentication\n",
+- rc);
+- goto out;
+- }
++ if (ses->user_name != NULL) {
++ pSMB->req_no_secext.CaseInsensitivePasswordLength =
++ cpu_to_le16(CIFS_AUTH_RESP_SIZE);
++ pSMB->req_no_secext.CaseSensitivePasswordLength =
++ cpu_to_le16(CIFS_AUTH_RESP_SIZE);
++
++ /* calculate ntlm response and session key */
++ rc = setup_ntlm_response(ses, sess_data->nls_cp);
++ if (rc) {
++ cifs_dbg(VFS, "Error %d during NTLM authentication\n",
++ rc);
++ goto out;
++ }
+
+- /* copy ntlm response */
+- memcpy(bcc_ptr, ses->auth_key.response + CIFS_SESS_KEY_SIZE,
+- CIFS_AUTH_RESP_SIZE);
+- bcc_ptr += CIFS_AUTH_RESP_SIZE;
+- memcpy(bcc_ptr, ses->auth_key.response + CIFS_SESS_KEY_SIZE,
+- CIFS_AUTH_RESP_SIZE);
+- bcc_ptr += CIFS_AUTH_RESP_SIZE;
++ /* copy ntlm response */
++ memcpy(bcc_ptr, ses->auth_key.response + CIFS_SESS_KEY_SIZE,
++ CIFS_AUTH_RESP_SIZE);
++ bcc_ptr += CIFS_AUTH_RESP_SIZE;
++ memcpy(bcc_ptr, ses->auth_key.response + CIFS_SESS_KEY_SIZE,
++ CIFS_AUTH_RESP_SIZE);
++ bcc_ptr += CIFS_AUTH_RESP_SIZE;
++ } else {
++ pSMB->req_no_secext.CaseInsensitivePasswordLength = 0;
++ pSMB->req_no_secext.CaseSensitivePasswordLength = 0;
++ }
+
+ if (ses->capabilities & CAP_UNICODE) {
+ /* unicode strings must be word aligned */
+@@ -878,22 +895,26 @@ sess_auth_ntlmv2(struct sess_data *sess_data)
+ /* LM2 password would be here if we supported it */
+ pSMB->req_no_secext.CaseInsensitivePasswordLength = 0;
+
+- /* calculate nlmv2 response and session key */
+- rc = setup_ntlmv2_rsp(ses, sess_data->nls_cp);
+- if (rc) {
+- cifs_dbg(VFS, "Error %d during NTLMv2 authentication\n", rc);
+- goto out;
+- }
++ if (ses->user_name != NULL) {
++ /* calculate nlmv2 response and session key */
++ rc = setup_ntlmv2_rsp(ses, sess_data->nls_cp);
++ if (rc) {
++ cifs_dbg(VFS, "Error %d during NTLMv2 authentication\n", rc);
++ goto out;
++ }
+
+- memcpy(bcc_ptr, ses->auth_key.response + CIFS_SESS_KEY_SIZE,
+- ses->auth_key.len - CIFS_SESS_KEY_SIZE);
+- bcc_ptr += ses->auth_key.len - CIFS_SESS_KEY_SIZE;
++ memcpy(bcc_ptr, ses->auth_key.response + CIFS_SESS_KEY_SIZE,
++ ses->auth_key.len - CIFS_SESS_KEY_SIZE);
++ bcc_ptr += ses->auth_key.len - CIFS_SESS_KEY_SIZE;
+
+- /* set case sensitive password length after tilen may get
+- * assigned, tilen is 0 otherwise.
+- */
+- pSMB->req_no_secext.CaseSensitivePasswordLength =
+- cpu_to_le16(ses->auth_key.len - CIFS_SESS_KEY_SIZE);
++ /* set case sensitive password length after tilen may get
++ * assigned, tilen is 0 otherwise.
++ */
++ pSMB->req_no_secext.CaseSensitivePasswordLength =
++ cpu_to_le16(ses->auth_key.len - CIFS_SESS_KEY_SIZE);
++ } else {
++ pSMB->req_no_secext.CaseSensitivePasswordLength = 0;
++ }
+
+ if (ses->capabilities & CAP_UNICODE) {
+ if (sess_data->iov[0].iov_len % 2) {
+diff --git a/fs/cifs/smb2glob.h b/fs/cifs/smb2glob.h
+index bc0bb9c34f72..0ffa18094335 100644
+--- a/fs/cifs/smb2glob.h
++++ b/fs/cifs/smb2glob.h
+@@ -44,6 +44,7 @@
+ #define SMB2_OP_DELETE 7
+ #define SMB2_OP_HARDLINK 8
+ #define SMB2_OP_SET_EOF 9
++#define SMB2_OP_RMDIR 10
+
+ /* Used when constructing chained read requests. */
+ #define CHAINED_REQUEST 1
+diff --git a/fs/cifs/smb2inode.c b/fs/cifs/smb2inode.c
+index 899bbc86f73e..4f0231e685a9 100644
+--- a/fs/cifs/smb2inode.c
++++ b/fs/cifs/smb2inode.c
+@@ -80,6 +80,10 @@ smb2_open_op_close(const unsigned int xid, struct cifs_tcon *tcon,
+ * SMB2_open() call.
+ */
+ break;
++ case SMB2_OP_RMDIR:
++ tmprc = SMB2_rmdir(xid, tcon, fid.persistent_fid,
++ fid.volatile_fid);
++ break;
+ case SMB2_OP_RENAME:
+ tmprc = SMB2_rename(xid, tcon, fid.persistent_fid,
+ fid.volatile_fid, (__le16 *)data);
+@@ -191,8 +195,8 @@ smb2_rmdir(const unsigned int xid, struct cifs_tcon *tcon, const char *name,
+ struct cifs_sb_info *cifs_sb)
+ {
+ return smb2_open_op_close(xid, tcon, cifs_sb, name, DELETE, FILE_OPEN,
+- CREATE_NOT_FILE | CREATE_DELETE_ON_CLOSE,
+- NULL, SMB2_OP_DELETE);
++ CREATE_NOT_FILE,
++ NULL, SMB2_OP_RMDIR);
+ }
+
+ int
+diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
+index 3398ac7e7b37..e8d1f8c59b56 100644
+--- a/fs/cifs/smb2pdu.c
++++ b/fs/cifs/smb2pdu.c
+@@ -2336,6 +2336,22 @@ SMB2_rename(const unsigned int xid, struct cifs_tcon *tcon,
+ }
+
+ int
++SMB2_rmdir(const unsigned int xid, struct cifs_tcon *tcon,
++ u64 persistent_fid, u64 volatile_fid)
++{
++ __u8 delete_pending = 1;
++ void *data;
++ unsigned int size;
++
++ data = &delete_pending;
++ size = 1; /* sizeof __u8 */
++
++ return send_set_info(xid, tcon, persistent_fid, volatile_fid,
++ current->tgid, FILE_DISPOSITION_INFORMATION, 1, &data,
++ &size);
++}
++
++int
+ SMB2_set_hardlink(const unsigned int xid, struct cifs_tcon *tcon,
+ u64 persistent_fid, u64 volatile_fid, __le16 *target_file)
+ {
+diff --git a/fs/cifs/smb2proto.h b/fs/cifs/smb2proto.h
+index 79dc650c18b2..9bc59f9c12fb 100644
+--- a/fs/cifs/smb2proto.h
++++ b/fs/cifs/smb2proto.h
+@@ -140,6 +140,8 @@ extern int SMB2_query_directory(const unsigned int xid, struct cifs_tcon *tcon,
+ extern int SMB2_rename(const unsigned int xid, struct cifs_tcon *tcon,
+ u64 persistent_fid, u64 volatile_fid,
+ __le16 *target_file);
++extern int SMB2_rmdir(const unsigned int xid, struct cifs_tcon *tcon,
++ u64 persistent_fid, u64 volatile_fid);
+ extern int SMB2_set_hardlink(const unsigned int xid, struct cifs_tcon *tcon,
+ u64 persistent_fid, u64 volatile_fid,
+ __le16 *target_file);
+diff --git a/fs/ext4/ialloc.c b/fs/ext4/ialloc.c
+index ac644c31ca67..9f230e589ecc 100644
+--- a/fs/ext4/ialloc.c
++++ b/fs/ext4/ialloc.c
+@@ -1090,22 +1090,20 @@ struct inode *ext4_orphan_get(struct super_block *sb, unsigned long ino)
+ unsigned long max_ino = le32_to_cpu(EXT4_SB(sb)->s_es->s_inodes_count);
+ ext4_group_t block_group;
+ int bit;
+- struct buffer_head *bitmap_bh;
++ struct buffer_head *bitmap_bh = NULL;
+ struct inode *inode = NULL;
+- long err = -EIO;
++ int err = -EIO;
+
+- /* Error cases - e2fsck has already cleaned up for us */
+- if (ino > max_ino) {
+- ext4_warning(sb, "bad orphan ino %lu! e2fsck was run?", ino);
+- goto error;
+- }
++ if (ino < EXT4_FIRST_INO(sb) || ino > max_ino)
++ goto bad_orphan;
+
+ block_group = (ino - 1) / EXT4_INODES_PER_GROUP(sb);
+ bit = (ino - 1) % EXT4_INODES_PER_GROUP(sb);
+ bitmap_bh = ext4_read_inode_bitmap(sb, block_group);
+ if (!bitmap_bh) {
+- ext4_warning(sb, "inode bitmap error for orphan %lu", ino);
+- goto error;
++ ext4_error(sb, "inode bitmap error %ld for orphan %lu",
++ ino, PTR_ERR(bitmap_bh));
++ return (struct inode *) bitmap_bh;
+ }
+
+ /* Having the inode bit set should be a 100% indicator that this
+@@ -1116,15 +1114,21 @@ struct inode *ext4_orphan_get(struct super_block *sb, unsigned long ino)
+ goto bad_orphan;
+
+ inode = ext4_iget(sb, ino);
+- if (IS_ERR(inode))
+- goto iget_failed;
++ if (IS_ERR(inode)) {
++ err = PTR_ERR(inode);
++ ext4_error(sb, "couldn't read orphan inode %lu (err %d)",
++ ino, err);
++ return inode;
++ }
+
+ /*
+- * If the orphans has i_nlinks > 0 then it should be able to be
+- * truncated, otherwise it won't be removed from the orphan list
+- * during processing and an infinite loop will result.
++ * If the orphans has i_nlinks > 0 then it should be able to
++ * be truncated, otherwise it won't be removed from the orphan
++ * list during processing and an infinite loop will result.
++ * Similarly, it must not be a bad inode.
+ */
+- if (inode->i_nlink && !ext4_can_truncate(inode))
++ if ((inode->i_nlink && !ext4_can_truncate(inode)) ||
++ is_bad_inode(inode))
+ goto bad_orphan;
+
+ if (NEXT_ORPHAN(inode) > max_ino)
+@@ -1132,29 +1136,25 @@ struct inode *ext4_orphan_get(struct super_block *sb, unsigned long ino)
+ brelse(bitmap_bh);
+ return inode;
+
+-iget_failed:
+- err = PTR_ERR(inode);
+- inode = NULL;
+ bad_orphan:
+- ext4_warning(sb, "bad orphan inode %lu! e2fsck was run?", ino);
+- printk(KERN_WARNING "ext4_test_bit(bit=%d, block=%llu) = %d\n",
+- bit, (unsigned long long)bitmap_bh->b_blocknr,
+- ext4_test_bit(bit, bitmap_bh->b_data));
+- printk(KERN_WARNING "inode=%p\n", inode);
++ ext4_error(sb, "bad orphan inode %lu", ino);
++ if (bitmap_bh)
++ printk(KERN_ERR "ext4_test_bit(bit=%d, block=%llu) = %d\n",
++ bit, (unsigned long long)bitmap_bh->b_blocknr,
++ ext4_test_bit(bit, bitmap_bh->b_data));
+ if (inode) {
+- printk(KERN_WARNING "is_bad_inode(inode)=%d\n",
++ printk(KERN_ERR "is_bad_inode(inode)=%d\n",
+ is_bad_inode(inode));
+- printk(KERN_WARNING "NEXT_ORPHAN(inode)=%u\n",
++ printk(KERN_ERR "NEXT_ORPHAN(inode)=%u\n",
+ NEXT_ORPHAN(inode));
+- printk(KERN_WARNING "max_ino=%lu\n", max_ino);
+- printk(KERN_WARNING "i_nlink=%u\n", inode->i_nlink);
++ printk(KERN_ERR "max_ino=%lu\n", max_ino);
++ printk(KERN_ERR "i_nlink=%u\n", inode->i_nlink);
+ /* Avoid freeing blocks if we got a bad deleted inode */
+ if (inode->i_nlink == 0)
+ inode->i_blocks = 0;
+ iput(inode);
+ }
+ brelse(bitmap_bh);
+-error:
+ return ERR_PTR(err);
+ }
+
+diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
+index 99c8e38ffb7b..dee06cd428eb 100644
+--- a/fs/ext4/mballoc.c
++++ b/fs/ext4/mballoc.c
+@@ -1248,6 +1248,7 @@ static void ext4_mb_unload_buddy(struct ext4_buddy *e4b)
+ static int mb_find_order_for_block(struct ext4_buddy *e4b, int block)
+ {
+ int order = 1;
++ int bb_incr = 1 << (e4b->bd_blkbits - 1);
+ void *bb;
+
+ BUG_ON(e4b->bd_bitmap == e4b->bd_buddy);
+@@ -1260,7 +1261,8 @@ static int mb_find_order_for_block(struct ext4_buddy *e4b, int block)
+ /* this block is part of buddy of order 'order' */
+ return order;
+ }
+- bb += 1 << (e4b->bd_blkbits - order);
++ bb += bb_incr;
++ bb_incr >>= 1;
+ order++;
+ }
+ return 0;
+@@ -2553,7 +2555,7 @@ int ext4_mb_init(struct super_block *sb)
+ {
+ struct ext4_sb_info *sbi = EXT4_SB(sb);
+ unsigned i, j;
+- unsigned offset;
++ unsigned offset, offset_incr;
+ unsigned max;
+ int ret;
+
+@@ -2582,11 +2584,13 @@ int ext4_mb_init(struct super_block *sb)
+
+ i = 1;
+ offset = 0;
++ offset_incr = 1 << (sb->s_blocksize_bits - 1);
+ max = sb->s_blocksize << 2;
+ do {
+ sbi->s_mb_offsets[i] = offset;
+ sbi->s_mb_maxs[i] = max;
+- offset += 1 << (sb->s_blocksize_bits - i);
++ offset += offset_incr;
++ offset_incr = offset_incr >> 1;
+ max = max >> 1;
+ i++;
+ } while (i <= sb->s_blocksize_bits + 1);
+diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
+index 447486425b8c..d3a22a11ac76 100644
+--- a/fs/ext4/namei.c
++++ b/fs/ext4/namei.c
+@@ -2598,7 +2598,7 @@ int ext4_orphan_add(handle_t *handle, struct inode *inode)
+ * list entries can cause panics at unmount time.
+ */
+ mutex_lock(&sbi->s_orphan_lock);
+- list_del(&EXT4_I(inode)->i_orphan);
++ list_del_init(&EXT4_I(inode)->i_orphan);
+ mutex_unlock(&sbi->s_orphan_lock);
+ }
+ }
+diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
+index 69aa378e60d9..af33fb77196f 100644
+--- a/fs/proc/task_mmu.c
++++ b/fs/proc/task_mmu.c
+@@ -447,58 +447,91 @@ struct mem_size_stats {
+ u64 pss;
+ };
+
++static void smaps_account(struct mem_size_stats *mss, struct page *page,
++ unsigned long size, bool young, bool dirty)
++{
++ int mapcount;
++
++ if (PageAnon(page))
++ mss->anonymous += size;
+
+-static void smaps_pte_entry(pte_t ptent, unsigned long addr,
+- unsigned long ptent_size, struct mm_walk *walk)
++ mss->resident += size;
++ /* Accumulate the size in pages that have been accessed. */
++ if (young || PageReferenced(page))
++ mss->referenced += size;
++ mapcount = page_mapcount(page);
++ if (mapcount >= 2) {
++ u64 pss_delta;
++
++ if (dirty || PageDirty(page))
++ mss->shared_dirty += size;
++ else
++ mss->shared_clean += size;
++ pss_delta = (u64)size << PSS_SHIFT;
++ do_div(pss_delta, mapcount);
++ mss->pss += pss_delta;
++ } else {
++ if (dirty || PageDirty(page))
++ mss->private_dirty += size;
++ else
++ mss->private_clean += size;
++ mss->pss += (u64)size << PSS_SHIFT;
++ }
++}
++
++static void smaps_pte_entry(pte_t *pte, unsigned long addr,
++ struct mm_walk *walk)
+ {
+ struct mem_size_stats *mss = walk->private;
+ struct vm_area_struct *vma = mss->vma;
+ pgoff_t pgoff = linear_page_index(vma, addr);
+ struct page *page = NULL;
+- int mapcount;
+
+- if (pte_present(ptent)) {
+- page = vm_normal_page(vma, addr, ptent);
+- } else if (is_swap_pte(ptent)) {
+- swp_entry_t swpent = pte_to_swp_entry(ptent);
++ if (pte_present(*pte)) {
++ page = vm_normal_page(vma, addr, *pte);
++ } else if (is_swap_pte(*pte)) {
++ swp_entry_t swpent = pte_to_swp_entry(*pte);
+
+ if (!non_swap_entry(swpent))
+- mss->swap += ptent_size;
++ mss->swap += PAGE_SIZE;
+ else if (is_migration_entry(swpent))
+ page = migration_entry_to_page(swpent);
+- } else if (pte_file(ptent)) {
+- if (pte_to_pgoff(ptent) != pgoff)
+- mss->nonlinear += ptent_size;
++ } else if (pte_file(*pte)) {
++ if (pte_to_pgoff(*pte) != pgoff)
++ mss->nonlinear += PAGE_SIZE;
+ }
+
+ if (!page)
+ return;
+
+- if (PageAnon(page))
+- mss->anonymous += ptent_size;
+-
+ if (page->index != pgoff)
+- mss->nonlinear += ptent_size;
++ mss->nonlinear += PAGE_SIZE;
+
+- mss->resident += ptent_size;
+- /* Accumulate the size in pages that have been accessed. */
+- if (pte_young(ptent) || PageReferenced(page))
+- mss->referenced += ptent_size;
+- mapcount = page_mapcount(page);
+- if (mapcount >= 2) {
+- if (pte_dirty(ptent) || PageDirty(page))
+- mss->shared_dirty += ptent_size;
+- else
+- mss->shared_clean += ptent_size;
+- mss->pss += (ptent_size << PSS_SHIFT) / mapcount;
+- } else {
+- if (pte_dirty(ptent) || PageDirty(page))
+- mss->private_dirty += ptent_size;
+- else
+- mss->private_clean += ptent_size;
+- mss->pss += (ptent_size << PSS_SHIFT);
+- }
++ smaps_account(mss, page, PAGE_SIZE, pte_young(*pte), pte_dirty(*pte));
++}
++
++#ifdef CONFIG_TRANSPARENT_HUGEPAGE
++static void smaps_pmd_entry(pmd_t *pmd, unsigned long addr,
++ struct mm_walk *walk)
++{
++ struct mem_size_stats *mss = walk->private;
++ struct vm_area_struct *vma = mss->vma;
++ struct page *page;
++
++ /* FOLL_DUMP will return -EFAULT on huge zero page */
++ page = follow_trans_huge_pmd(vma, addr, pmd, FOLL_DUMP);
++ if (IS_ERR_OR_NULL(page))
++ return;
++ mss->anonymous_thp += HPAGE_PMD_SIZE;
++ smaps_account(mss, page, HPAGE_PMD_SIZE,
++ pmd_young(*pmd), pmd_dirty(*pmd));
+ }
++#else
++static void smaps_pmd_entry(pmd_t *pmd, unsigned long addr,
++ struct mm_walk *walk)
++{
++}
++#endif
+
+ static int smaps_pte_range(pmd_t *pmd, unsigned long addr, unsigned long end,
+ struct mm_walk *walk)
+@@ -509,9 +542,8 @@ static int smaps_pte_range(pmd_t *pmd, unsigned long addr, unsigned long end,
+ spinlock_t *ptl;
+
+ if (pmd_trans_huge_lock(pmd, vma, &ptl) == 1) {
+- smaps_pte_entry(*(pte_t *)pmd, addr, HPAGE_PMD_SIZE, walk);
++ smaps_pmd_entry(pmd, addr, walk);
+ spin_unlock(ptl);
+- mss->anonymous_thp += HPAGE_PMD_SIZE;
+ return 0;
+ }
+
+@@ -524,7 +556,7 @@ static int smaps_pte_range(pmd_t *pmd, unsigned long addr, unsigned long end,
+ */
+ pte = pte_offset_map_lock(vma->vm_mm, pmd, addr, &ptl);
+ for (; addr != end; pte++, addr += PAGE_SIZE)
+- smaps_pte_entry(*pte, addr, PAGE_SIZE, walk);
++ smaps_pte_entry(pte, addr, walk);
+ pte_unmap_unlock(pte - 1, ptl);
+ cond_resched();
+ return 0;
+diff --git a/fs/xfs/xfs_inode.c b/fs/xfs/xfs_inode.c
+index 32e95c76cbd0..44e5598744b1 100644
+--- a/fs/xfs/xfs_inode.c
++++ b/fs/xfs/xfs_inode.c
+@@ -2969,13 +2969,14 @@ xfs_iflush_cluster(
+ * We need to check under the i_flags_lock for a valid inode
+ * here. Skip it if it is not valid or the wrong inode.
+ */
+- spin_lock(&ip->i_flags_lock);
+- if (!ip->i_ino ||
++ spin_lock(&iq->i_flags_lock);
++ if (!iq->i_ino ||
++ __xfs_iflags_test(iq, XFS_ISTALE) ||
+ (XFS_INO_TO_AGINO(mp, iq->i_ino) & mask) != first_index) {
+- spin_unlock(&ip->i_flags_lock);
++ spin_unlock(&iq->i_flags_lock);
+ continue;
+ }
+- spin_unlock(&ip->i_flags_lock);
++ spin_unlock(&iq->i_flags_lock);
+
+ /*
+ * Do an un-protected check to see if the inode is dirty and
+@@ -3091,7 +3092,7 @@ xfs_iflush(
+ struct xfs_buf **bpp)
+ {
+ struct xfs_mount *mp = ip->i_mount;
+- struct xfs_buf *bp;
++ struct xfs_buf *bp = NULL;
+ struct xfs_dinode *dip;
+ int error;
+
+@@ -3133,14 +3134,22 @@ xfs_iflush(
+ }
+
+ /*
+- * Get the buffer containing the on-disk inode.
++ * Get the buffer containing the on-disk inode. We are doing a try-lock
++ * operation here, so we may get an EAGAIN error. In that case, we
++ * simply want to return with the inode still dirty.
++ *
++ * If we get any other error, we effectively have a corruption situation
++ * and we cannot flush the inode, so we treat it the same as failing
++ * xfs_iflush_int().
+ */
+ error = xfs_imap_to_bp(mp, NULL, &ip->i_imap, &dip, &bp, XBF_TRYLOCK,
+ 0);
+- if (error || !bp) {
++ if (error == -EAGAIN) {
+ xfs_ifunlock(ip);
+ return error;
+ }
++ if (error)
++ goto corrupt_out;
+
+ /*
+ * First flush out the inode that xfs_iflush was called with.
+@@ -3168,7 +3177,8 @@ xfs_iflush(
+ return 0;
+
+ corrupt_out:
+- xfs_buf_relse(bp);
++ if (bp)
++ xfs_buf_relse(bp);
+ xfs_force_shutdown(mp, SHUTDOWN_CORRUPT_INCORE);
+ cluster_corrupt_out:
+ error = -EFSCORRUPTED;
+diff --git a/fs/xfs/xfs_super.c b/fs/xfs/xfs_super.c
+index 9f622feda6a4..73b6c8fca308 100644
+--- a/fs/xfs/xfs_super.c
++++ b/fs/xfs/xfs_super.c
+@@ -1248,6 +1248,22 @@ xfs_fs_remount(
+
+ /* ro -> rw */
+ if ((mp->m_flags & XFS_MOUNT_RDONLY) && !(*flags & MS_RDONLY)) {
++ if (mp->m_flags & XFS_MOUNT_NORECOVERY) {
++ xfs_warn(mp,
++ "ro->rw transition prohibited on norecovery mount");
++ return -EINVAL;
++ }
++
++ if (XFS_SB_VERSION_NUM(sbp) == XFS_SB_VERSION_5 &&
++ xfs_sb_has_ro_compat_feature(sbp,
++ XFS_SB_FEAT_RO_COMPAT_UNKNOWN)) {
++ xfs_warn(mp,
++"ro->rw transition prohibited on unknown (0x%x) ro-compat filesystem",
++ (sbp->sb_features_ro_compat &
++ XFS_SB_FEAT_RO_COMPAT_UNKNOWN));
++ return -EINVAL;
++ }
++
+ mp->m_flags &= ~XFS_MOUNT_RDONLY;
+
+ /*
+diff --git a/include/linux/can/dev.h b/include/linux/can/dev.h
+index b37ea95bc348..71e37afd7290 100644
+--- a/include/linux/can/dev.h
++++ b/include/linux/can/dev.h
+@@ -39,8 +39,11 @@ struct can_priv {
+ struct can_clock clock;
+
+ enum can_state state;
+- u32 ctrlmode;
+- u32 ctrlmode_supported;
++
++ /* CAN controller features - see include/uapi/linux/can/netlink.h */
++ u32 ctrlmode; /* current options setting */
++ u32 ctrlmode_supported; /* options that can be modified by netlink */
++ u32 ctrlmode_static; /* static enabled options for driver/hardware */
+
+ int restart_ms;
+ struct timer_list restart_timer;
+@@ -105,6 +108,21 @@ static inline bool can_is_canfd_skb(const struct sk_buff *skb)
+ return skb->len == CANFD_MTU;
+ }
+
++/* helper to define static CAN controller features at device creation time */
++static inline void can_set_static_ctrlmode(struct net_device *dev,
++ u32 static_mode)
++{
++ struct can_priv *priv = netdev_priv(dev);
++
++ /* alloc_candev() succeeded => netdev_priv() is valid at this point */
++ priv->ctrlmode = static_mode;
++ priv->ctrlmode_static = static_mode;
++
++ /* override MTU which was set by default in can_setup()? */
++ if (static_mode & CAN_CTRLMODE_FD)
++ dev->mtu = CANFD_MTU;
++}
++
+ /* get data length from can_dlc with sanitized can_dlc */
+ u8 can_dlc2len(u8 can_dlc);
+
+diff --git a/include/linux/usb.h b/include/linux/usb.h
+index bdbd19fb1ff8..0f963c15d0cd 100644
+--- a/include/linux/usb.h
++++ b/include/linux/usb.h
+@@ -367,14 +367,13 @@ struct usb_bus {
+
+ int devnum_next; /* Next open device number in
+ * round-robin allocation */
++ struct mutex devnum_next_mutex; /* devnum_next mutex */
+
+ struct usb_devmap devmap; /* device address allocation map */
+ struct usb_device *root_hub; /* Root hub */
+ struct usb_bus *hs_companion; /* Companion EHCI bus, if any */
+ struct list_head bus_list; /* list of busses */
+
+- struct mutex usb_address0_mutex; /* unaddressed device mutex */
+-
+ int bandwidth_allocated; /* on this bus: how much of the time
+ * reserved for periodic (intr/iso)
+ * requests is used, on average?
+@@ -1060,7 +1059,7 @@ struct usbdrv_wrap {
+ * for interfaces bound to this driver.
+ * @soft_unbind: if set to 1, the USB core will not kill URBs and disable
+ * endpoints before calling the driver's disconnect method.
+- * @disable_hub_initiated_lpm: if set to 0, the USB core will not allow hubs
++ * @disable_hub_initiated_lpm: if set to 1, the USB core will not allow hubs
+ * to initiate lower power link state transitions when an idle timeout
+ * occurs. Device-initiated USB 3.0 link PM will still be allowed.
+ *
+diff --git a/include/linux/usb/hcd.h b/include/linux/usb/hcd.h
+index 2f48e1756cbd..a4ef2e7c243a 100644
+--- a/include/linux/usb/hcd.h
++++ b/include/linux/usb/hcd.h
+@@ -169,6 +169,7 @@ struct usb_hcd {
+ * bandwidth_mutex should be dropped after a successful control message
+ * to the device, or resetting the bandwidth after a failed attempt.
+ */
++ struct mutex *address0_mutex;
+ struct mutex *bandwidth_mutex;
+ struct usb_hcd *shared_hcd;
+ struct usb_hcd *primary_hcd;
+diff --git a/kernel/exit.c b/kernel/exit.c
+index 2116aace6c85..654021d9f1b3 100644
+--- a/kernel/exit.c
++++ b/kernel/exit.c
+@@ -930,17 +930,28 @@ static int eligible_pid(struct wait_opts *wo, struct task_struct *p)
+ task_pid_type(p, wo->wo_type) == wo->wo_pid;
+ }
+
+-static int eligible_child(struct wait_opts *wo, struct task_struct *p)
++static int
++eligible_child(struct wait_opts *wo, bool ptrace, struct task_struct *p)
+ {
+ if (!eligible_pid(wo, p))
+ return 0;
+- /* Wait for all children (clone and not) if __WALL is set;
+- * otherwise, wait for clone children *only* if __WCLONE is
+- * set; otherwise, wait for non-clone children *only*. (Note:
+- * A "clone" child here is one that reports to its parent
+- * using a signal other than SIGCHLD.) */
+- if (((p->exit_signal != SIGCHLD) ^ !!(wo->wo_flags & __WCLONE))
+- && !(wo->wo_flags & __WALL))
++
++ /*
++ * Wait for all children (clone and not) if __WALL is set or
++ * if it is traced by us.
++ */
++ if (ptrace || (wo->wo_flags & __WALL))
++ return 1;
++
++ /*
++ * Otherwise, wait for clone children *only* if __WCLONE is set;
++ * otherwise, wait for non-clone children *only*.
++ *
++ * Note: a "clone" child here is one that reports to its parent
++ * using a signal other than SIGCHLD, or a non-leader thread which
++ * we can only see if it is traced by us.
++ */
++ if ((p->exit_signal != SIGCHLD) ^ !!(wo->wo_flags & __WCLONE))
+ return 0;
+
+ return 1;
+@@ -1313,7 +1324,7 @@ static int wait_consider_task(struct wait_opts *wo, int ptrace,
+ if (unlikely(exit_state == EXIT_DEAD))
+ return 0;
+
+- ret = eligible_child(wo, p);
++ ret = eligible_child(wo, ptrace, p);
+ if (!ret)
+ return ret;
+
+diff --git a/kernel/sched/proc.c b/kernel/sched/proc.c
+index 8ecd552fe4f2..09dfe51f89b5 100644
+--- a/kernel/sched/proc.c
++++ b/kernel/sched/proc.c
+@@ -97,10 +97,13 @@ long calc_load_fold_active(struct rq *this_rq)
+ static unsigned long
+ calc_load(unsigned long load, unsigned long exp, unsigned long active)
+ {
+- load *= exp;
+- load += active * (FIXED_1 - exp);
+- load += 1UL << (FSHIFT - 1);
+- return load >> FSHIFT;
++ unsigned long newload;
++
++ newload = load * exp + active * (FIXED_1 - exp);
++ if (active >= load)
++ newload += FIXED_1-1;
++
++ return newload / FIXED_1;
+ }
+
+ #ifdef CONFIG_NO_HZ_COMMON
+diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
+index 0fc5cfedcc8c..d4588b08e07a 100644
+--- a/kernel/trace/ring_buffer.c
++++ b/kernel/trace/ring_buffer.c
+@@ -466,7 +466,8 @@ struct ring_buffer_per_cpu {
+ raw_spinlock_t reader_lock; /* serialize readers */
+ arch_spinlock_t lock;
+ struct lock_class_key lock_key;
+- unsigned int nr_pages;
++ unsigned long nr_pages;
++ unsigned int current_context;
+ struct list_head *pages;
+ struct buffer_page *head_page; /* read from head */
+ struct buffer_page *tail_page; /* write to tail */
+@@ -486,7 +487,7 @@ struct ring_buffer_per_cpu {
+ u64 write_stamp;
+ u64 read_stamp;
+ /* ring buffer pages to update, > 0 to add, < 0 to remove */
+- int nr_pages_to_update;
++ long nr_pages_to_update;
+ struct list_head new_pages; /* new pages to add */
+ struct work_struct update_pages_work;
+ struct completion update_done;
+@@ -1165,10 +1166,10 @@ static int rb_check_pages(struct ring_buffer_per_cpu *cpu_buffer)
+ return 0;
+ }
+
+-static int __rb_allocate_pages(int nr_pages, struct list_head *pages, int cpu)
++static int __rb_allocate_pages(long nr_pages, struct list_head *pages, int cpu)
+ {
+- int i;
+ struct buffer_page *bpage, *tmp;
++ long i;
+
+ for (i = 0; i < nr_pages; i++) {
+ struct page *page;
+@@ -1205,7 +1206,7 @@ free_pages:
+ }
+
+ static int rb_allocate_pages(struct ring_buffer_per_cpu *cpu_buffer,
+- unsigned nr_pages)
++ unsigned long nr_pages)
+ {
+ LIST_HEAD(pages);
+
+@@ -1230,7 +1231,7 @@ static int rb_allocate_pages(struct ring_buffer_per_cpu *cpu_buffer,
+ }
+
+ static struct ring_buffer_per_cpu *
+-rb_allocate_cpu_buffer(struct ring_buffer *buffer, int nr_pages, int cpu)
++rb_allocate_cpu_buffer(struct ring_buffer *buffer, long nr_pages, int cpu)
+ {
+ struct ring_buffer_per_cpu *cpu_buffer;
+ struct buffer_page *bpage;
+@@ -1330,8 +1331,9 @@ struct ring_buffer *__ring_buffer_alloc(unsigned long size, unsigned flags,
+ struct lock_class_key *key)
+ {
+ struct ring_buffer *buffer;
++ long nr_pages;
+ int bsize;
+- int cpu, nr_pages;
++ int cpu;
+
+ /* keep it in its own cache line */
+ buffer = kzalloc(ALIGN(sizeof(*buffer), cache_line_size()),
+@@ -1457,12 +1459,12 @@ static inline unsigned long rb_page_write(struct buffer_page *bpage)
+ }
+
+ static int
+-rb_remove_pages(struct ring_buffer_per_cpu *cpu_buffer, unsigned int nr_pages)
++rb_remove_pages(struct ring_buffer_per_cpu *cpu_buffer, unsigned long nr_pages)
+ {
+ struct list_head *tail_page, *to_remove, *next_page;
+ struct buffer_page *to_remove_page, *tmp_iter_page;
+ struct buffer_page *last_page, *first_page;
+- unsigned int nr_removed;
++ unsigned long nr_removed;
+ unsigned long head_bit;
+ int page_entries;
+
+@@ -1679,7 +1681,7 @@ int ring_buffer_resize(struct ring_buffer *buffer, unsigned long size,
+ int cpu_id)
+ {
+ struct ring_buffer_per_cpu *cpu_buffer;
+- unsigned nr_pages;
++ unsigned long nr_pages;
+ int cpu, err = 0;
+
+ /*
+@@ -1693,14 +1695,13 @@ int ring_buffer_resize(struct ring_buffer *buffer, unsigned long size,
+ !cpumask_test_cpu(cpu_id, buffer->cpumask))
+ return size;
+
+- size = DIV_ROUND_UP(size, BUF_PAGE_SIZE);
+- size *= BUF_PAGE_SIZE;
++ nr_pages = DIV_ROUND_UP(size, BUF_PAGE_SIZE);
+
+ /* we need a minimum of two pages */
+- if (size < BUF_PAGE_SIZE * 2)
+- size = BUF_PAGE_SIZE * 2;
++ if (nr_pages < 2)
++ nr_pages = 2;
+
+- nr_pages = DIV_ROUND_UP(size, BUF_PAGE_SIZE);
++ size = nr_pages * BUF_PAGE_SIZE;
+
+ /*
+ * Don't succeed if resizing is disabled, as a reader might be
+@@ -2680,11 +2681,11 @@ rb_reserve_next_event(struct ring_buffer *buffer,
+ * just so happens that it is the same bit corresponding to
+ * the current context.
+ */
+-static DEFINE_PER_CPU(unsigned int, current_context);
+
+-static __always_inline int trace_recursive_lock(void)
++static __always_inline int
++trace_recursive_lock(struct ring_buffer_per_cpu *cpu_buffer)
+ {
+- unsigned int val = __this_cpu_read(current_context);
++ unsigned int val = cpu_buffer->current_context;
+ int bit;
+
+ if (in_interrupt()) {
+@@ -2701,23 +2702,21 @@ static __always_inline int trace_recursive_lock(void)
+ return 1;
+
+ val |= (1 << bit);
+- __this_cpu_write(current_context, val);
++ cpu_buffer->current_context = val;
+
+ return 0;
+ }
+
+-static __always_inline void trace_recursive_unlock(void)
++static __always_inline void
++trace_recursive_unlock(struct ring_buffer_per_cpu *cpu_buffer)
+ {
+- unsigned int val = __this_cpu_read(current_context);
+-
+- val &= val & (val - 1);
+- __this_cpu_write(current_context, val);
++ cpu_buffer->current_context &= cpu_buffer->current_context - 1;
+ }
+
+ #else
+
+-#define trace_recursive_lock() (0)
+-#define trace_recursive_unlock() do { } while (0)
++#define trace_recursive_lock(cpu_buffer) (0)
++#define trace_recursive_unlock(cpu_buffer) do { } while (0)
+
+ #endif
+
+@@ -2749,35 +2748,34 @@ ring_buffer_lock_reserve(struct ring_buffer *buffer, unsigned long length)
+ /* If we are tracing schedule, we don't want to recurse */
+ preempt_disable_notrace();
+
+- if (atomic_read(&buffer->record_disabled))
+- goto out_nocheck;
+-
+- if (trace_recursive_lock())
+- goto out_nocheck;
++ if (unlikely(atomic_read(&buffer->record_disabled)))
++ goto out;
+
+ cpu = raw_smp_processor_id();
+
+- if (!cpumask_test_cpu(cpu, buffer->cpumask))
++ if (unlikely(!cpumask_test_cpu(cpu, buffer->cpumask)))
+ goto out;
+
+ cpu_buffer = buffer->buffers[cpu];
+
+- if (atomic_read(&cpu_buffer->record_disabled))
++ if (unlikely(atomic_read(&cpu_buffer->record_disabled)))
+ goto out;
+
+- if (length > BUF_MAX_DATA_SIZE)
++ if (unlikely(length > BUF_MAX_DATA_SIZE))
++ goto out;
++
++ if (unlikely(trace_recursive_lock(cpu_buffer)))
+ goto out;
+
+ event = rb_reserve_next_event(buffer, cpu_buffer, length);
+ if (!event)
+- goto out;
++ goto out_unlock;
+
+ return event;
+
++ out_unlock:
++ trace_recursive_unlock(cpu_buffer);
+ out:
+- trace_recursive_unlock();
+-
+- out_nocheck:
+ preempt_enable_notrace();
+ return NULL;
+ }
+@@ -2867,7 +2865,7 @@ int ring_buffer_unlock_commit(struct ring_buffer *buffer,
+
+ rb_wakeups(buffer, cpu_buffer);
+
+- trace_recursive_unlock();
++ trace_recursive_unlock(cpu_buffer);
+
+ preempt_enable_notrace();
+
+@@ -2978,7 +2976,7 @@ void ring_buffer_discard_commit(struct ring_buffer *buffer,
+ out:
+ rb_end_commit(cpu_buffer);
+
+- trace_recursive_unlock();
++ trace_recursive_unlock(cpu_buffer);
+
+ preempt_enable_notrace();
+
+@@ -4655,8 +4653,9 @@ static int rb_cpu_notify(struct notifier_block *self,
+ struct ring_buffer *buffer =
+ container_of(self, struct ring_buffer, cpu_notify);
+ long cpu = (long)hcpu;
+- int cpu_i, nr_pages_same;
+- unsigned int nr_pages;
++ long nr_pages_same;
++ int cpu_i;
++ unsigned long nr_pages;
+
+ switch (action) {
+ case CPU_UP_PREPARE:
+diff --git a/lib/dma-debug.c b/lib/dma-debug.c
+index 1ff0fd098504..c83ac43418be 100644
+--- a/lib/dma-debug.c
++++ b/lib/dma-debug.c
+@@ -646,9 +646,9 @@ static struct dma_debug_entry *dma_entry_alloc(void)
+ spin_lock_irqsave(&free_entries_lock, flags);
+
+ if (list_empty(&free_entries)) {
+- pr_err("DMA-API: debugging out of memory - disabling\n");
+ global_disable = true;
+ spin_unlock_irqrestore(&free_entries_lock, flags);
++ pr_err("DMA-API: debugging out of memory - disabling\n");
+ return NULL;
+ }
+
+diff --git a/net/sunrpc/auth_gss/svcauth_gss.c b/net/sunrpc/auth_gss/svcauth_gss.c
+index c548ab213f76..d08f75972c57 100644
+--- a/net/sunrpc/auth_gss/svcauth_gss.c
++++ b/net/sunrpc/auth_gss/svcauth_gss.c
+@@ -855,8 +855,8 @@ unwrap_integ_data(struct svc_rqst *rqstp, struct xdr_buf *buf, u32 seq, struct g
+ goto out;
+ if (svc_getnl(&buf->head[0]) != seq)
+ goto out;
+- /* trim off the mic at the end before returning */
+- xdr_buf_trim(buf, mic.len + 4);
++ /* trim off the mic and padding at the end before returning */
++ xdr_buf_trim(buf, round_up_to_quad(mic.len) + 4);
+ stat = 0;
+ out:
+ kfree(mic.data);
+diff --git a/scripts/Makefile.extrawarn b/scripts/Makefile.extrawarn
+index f734033af219..5c17a5c1f306 100644
+--- a/scripts/Makefile.extrawarn
++++ b/scripts/Makefile.extrawarn
+@@ -24,6 +24,7 @@ warning-1 += $(call cc-option, -Wmissing-prototypes)
+ warning-1 += -Wold-style-definition
+ warning-1 += $(call cc-option, -Wmissing-include-dirs)
+ warning-1 += $(call cc-option, -Wunused-but-set-variable)
++warning-1 += $(call cc-option, -Wunused-const-variable)
+ warning-1 += $(call cc-disable-warning, missing-field-initializers)
+
+ warning-2 := -Waggregate-return
+diff --git a/sound/soc/codecs/ak4642.c b/sound/soc/codecs/ak4642.c
+index 041712592e29..f449d8710b00 100644
+--- a/sound/soc/codecs/ak4642.c
++++ b/sound/soc/codecs/ak4642.c
+@@ -64,12 +64,15 @@
+ #define FIL1_0 0x1c
+ #define FIL1_1 0x1d
+ #define FIL1_2 0x1e
+-#define FIL1_3 0x1f
++#define FIL1_3 0x1f /* The maximum valid register for ak4642 */
+ #define PW_MGMT4 0x20
+ #define MD_CTL5 0x21
+ #define LO_MS 0x22
+ #define HP_MS 0x23
+-#define SPK_MS 0x24
++#define SPK_MS 0x24 /* The maximum valid register for ak4643 */
++#define EQ_FBEQAB 0x25
++#define EQ_FBEQCD 0x26
++#define EQ_FBEQE 0x27 /* The maximum valid register for ak4648 */
+
+ /* PW_MGMT1*/
+ #define PMVCM (1 << 6) /* VCOM Power Management */
+@@ -210,7 +213,7 @@ static const struct snd_soc_dapm_route ak4642_intercon[] = {
+ /*
+ * ak4642 register cache
+ */
+-static const struct reg_default ak4642_reg[] = {
++static const struct reg_default ak4643_reg[] = {
+ { 0, 0x00 }, { 1, 0x00 }, { 2, 0x01 }, { 3, 0x00 },
+ { 4, 0x02 }, { 5, 0x00 }, { 6, 0x00 }, { 7, 0x00 },
+ { 8, 0xe1 }, { 9, 0xe1 }, { 10, 0x18 }, { 11, 0x00 },
+@@ -223,6 +226,14 @@ static const struct reg_default ak4642_reg[] = {
+ { 36, 0x00 },
+ };
+
++/* The default settings for 0x0 ~ 0x1f registers are the same for ak4642
++ and ak4643. So we reuse the ak4643 reg_default for ak4642.
++ The valid registers for ak4642 are 0x0 ~ 0x1f which is a subset of ak4643,
++ so define NUM_AK4642_REG_DEFAULTS for ak4642.
++*/
++#define ak4642_reg ak4643_reg
++#define NUM_AK4642_REG_DEFAULTS (FIL1_3 + 1)
++
+ static const struct reg_default ak4648_reg[] = {
+ { 0, 0x00 }, { 1, 0x00 }, { 2, 0x01 }, { 3, 0x00 },
+ { 4, 0x02 }, { 5, 0x00 }, { 6, 0x00 }, { 7, 0x00 },
+@@ -521,17 +532,28 @@ static struct snd_soc_codec_driver soc_codec_dev_ak4642 = {
+ static const struct regmap_config ak4642_regmap = {
+ .reg_bits = 8,
+ .val_bits = 8,
+- .max_register = ARRAY_SIZE(ak4642_reg) + 1,
++ .max_register = FIL1_3,
+ .reg_defaults = ak4642_reg,
+- .num_reg_defaults = ARRAY_SIZE(ak4642_reg),
++ .num_reg_defaults = NUM_AK4642_REG_DEFAULTS,
++ .cache_type = REGCACHE_RBTREE,
++};
++
++static const struct regmap_config ak4643_regmap = {
++ .reg_bits = 8,
++ .val_bits = 8,
++ .max_register = SPK_MS,
++ .reg_defaults = ak4643_reg,
++ .num_reg_defaults = ARRAY_SIZE(ak4643_reg),
++ .cache_type = REGCACHE_RBTREE,
+ };
+
+ static const struct regmap_config ak4648_regmap = {
+ .reg_bits = 8,
+ .val_bits = 8,
+- .max_register = ARRAY_SIZE(ak4648_reg) + 1,
++ .max_register = EQ_FBEQE,
+ .reg_defaults = ak4648_reg,
+ .num_reg_defaults = ARRAY_SIZE(ak4648_reg),
++ .cache_type = REGCACHE_RBTREE,
+ };
+
+ static const struct ak4642_drvdata ak4642_drvdata = {
+@@ -539,7 +561,7 @@ static const struct ak4642_drvdata ak4642_drvdata = {
+ };
+
+ static const struct ak4642_drvdata ak4643_drvdata = {
+- .regmap_config = &ak4642_regmap,
++ .regmap_config = &ak4643_regmap,
+ };
+
+ static const struct ak4642_drvdata ak4648_drvdata = {
^ permalink raw reply related [flat|nested] 67+ messages in thread
* [gentoo-commits] proj/linux-patches:3.18 commit in: /
@ 2016-06-23 11:44 Mike Pagano
0 siblings, 0 replies; 67+ messages in thread
From: Mike Pagano @ 2016-06-23 11:44 UTC (permalink / raw
To: gentoo-commits
commit: 10f7e262ba392916ff8c908256076e7d534817fd
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Thu Jun 23 11:43:57 2016 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Thu Jun 23 11:43:57 2016 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=10f7e262
Linux patch 3.18.36
0000_README | 4 +
1035_linux-3.18.36.patch | 1160 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 1164 insertions(+)
diff --git a/0000_README b/0000_README
index 0ce5fde..fcefa63 100644
--- a/0000_README
+++ b/0000_README
@@ -183,6 +183,10 @@ Patch: 1034_linux-3.18.35.patch
From: http://www.kernel.org
Desc: Linux 3.18.35
+Patch: 1035_linux-3.18.36.patch
+From: http://www.kernel.org
+Desc: Linux 3.18.36
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1035_linux-3.18.36.patch b/1035_linux-3.18.36.patch
new file mode 100644
index 0000000..82fab96
--- /dev/null
+++ b/1035_linux-3.18.36.patch
@@ -0,0 +1,1160 @@
+diff --git a/Makefile b/Makefile
+index 3ba252c1b187..497f437efebf 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 18
+-SUBLEVEL = 35
++SUBLEVEL = 36
+ EXTRAVERSION =
+ NAME = Diseased Newt
+
+diff --git a/arch/arm/kernel/ptrace.c b/arch/arm/kernel/ptrace.c
+index ef9119f7462e..4d9375814b53 100644
+--- a/arch/arm/kernel/ptrace.c
++++ b/arch/arm/kernel/ptrace.c
+@@ -733,8 +733,8 @@ static int vfp_set(struct task_struct *target,
+ if (ret)
+ return ret;
+
+- vfp_flush_hwstate(thread);
+ thread->vfpstate.hard = new_vfp;
++ vfp_flush_hwstate(thread);
+
+ return 0;
+ }
+diff --git a/arch/parisc/kernel/unaligned.c b/arch/parisc/kernel/unaligned.c
+index d7c0acb35ec2..8d49614d600d 100644
+--- a/arch/parisc/kernel/unaligned.c
++++ b/arch/parisc/kernel/unaligned.c
+@@ -666,7 +666,7 @@ void handle_unaligned(struct pt_regs *regs)
+ break;
+ }
+
+- if (modify && R1(regs->iir))
++ if (ret == 0 && modify && R1(regs->iir))
+ regs->gr[R1(regs->iir)] = newbase;
+
+
+@@ -677,6 +677,14 @@ void handle_unaligned(struct pt_regs *regs)
+
+ if (ret)
+ {
++ /*
++ * The unaligned handler failed.
++ * If we were called by __get_user() or __put_user() jump
++ * to it's exception fixup handler instead of crashing.
++ */
++ if (!user_mode(regs) && fixup_exception(regs))
++ return;
++
+ printk(KERN_CRIT "Unaligned handler failed, ret = %d\n", ret);
+ die_if_kernel("Unaligned data reference", regs, 28);
+
+diff --git a/arch/powerpc/include/asm/reg.h b/arch/powerpc/include/asm/reg.h
+index a68ee15964b3..32fd9f6ad6ef 100644
+--- a/arch/powerpc/include/asm/reg.h
++++ b/arch/powerpc/include/asm/reg.h
+@@ -703,7 +703,7 @@
+ #define MMCR0_FCWAIT 0x00000002UL /* freeze counter in WAIT state */
+ #define MMCR0_FCHV 0x00000001UL /* freeze conditions in hypervisor mode */
+ #define SPRN_MMCR1 798
+-#define SPRN_MMCR2 769
++#define SPRN_MMCR2 785
+ #define SPRN_MMCRA 0x312
+ #define MMCRA_SDSYNC 0x80000000UL /* SDAR synced with SIAR */
+ #define MMCRA_SDAR_DCACHE_MISS 0x40000000UL
+@@ -739,13 +739,13 @@
+ #define SPRN_PMC6 792
+ #define SPRN_PMC7 793
+ #define SPRN_PMC8 794
+-#define SPRN_SIAR 780
+-#define SPRN_SDAR 781
+ #define SPRN_SIER 784
+ #define SIER_SIPR 0x2000000 /* Sampled MSR_PR */
+ #define SIER_SIHV 0x1000000 /* Sampled MSR_HV */
+ #define SIER_SIAR_VALID 0x0400000 /* SIAR contents valid */
+ #define SIER_SDAR_VALID 0x0200000 /* SDAR contents valid */
++#define SPRN_SIAR 796
++#define SPRN_SDAR 797
+ #define SPRN_TACR 888
+ #define SPRN_TCSCR 889
+ #define SPRN_CSIGR 890
+diff --git a/arch/powerpc/platforms/pseries/eeh_pseries.c b/arch/powerpc/platforms/pseries/eeh_pseries.c
+index a6c7e19f5eb3..5c80e02a346c 100644
+--- a/arch/powerpc/platforms/pseries/eeh_pseries.c
++++ b/arch/powerpc/platforms/pseries/eeh_pseries.c
+@@ -642,29 +642,50 @@ static int pseries_eeh_configure_bridge(struct eeh_pe *pe)
+ {
+ int config_addr;
+ int ret;
++ /* Waiting 0.2s maximum before skipping configuration */
++ int max_wait = 200;
+
+ /* Figure out the PE address */
+ config_addr = pe->config_addr;
+ if (pe->addr)
+ config_addr = pe->addr;
+
+- /* Use new configure-pe function, if supported */
+- if (ibm_configure_pe != RTAS_UNKNOWN_SERVICE) {
+- ret = rtas_call(ibm_configure_pe, 3, 1, NULL,
+- config_addr, BUID_HI(pe->phb->buid),
+- BUID_LO(pe->phb->buid));
+- } else if (ibm_configure_bridge != RTAS_UNKNOWN_SERVICE) {
+- ret = rtas_call(ibm_configure_bridge, 3, 1, NULL,
+- config_addr, BUID_HI(pe->phb->buid),
+- BUID_LO(pe->phb->buid));
+- } else {
+- return -EFAULT;
+- }
++ while (max_wait > 0) {
++ /* Use new configure-pe function, if supported */
++ if (ibm_configure_pe != RTAS_UNKNOWN_SERVICE) {
++ ret = rtas_call(ibm_configure_pe, 3, 1, NULL,
++ config_addr, BUID_HI(pe->phb->buid),
++ BUID_LO(pe->phb->buid));
++ } else if (ibm_configure_bridge != RTAS_UNKNOWN_SERVICE) {
++ ret = rtas_call(ibm_configure_bridge, 3, 1, NULL,
++ config_addr, BUID_HI(pe->phb->buid),
++ BUID_LO(pe->phb->buid));
++ } else {
++ return -EFAULT;
++ }
+
+- if (ret)
+- pr_warn("%s: Unable to configure bridge PHB#%d-PE#%x (%d)\n",
+- __func__, pe->phb->global_number, pe->addr, ret);
++ if (!ret)
++ return ret;
++
++ /*
++ * If RTAS returns a delay value that's above 100ms, cut it
++ * down to 100ms in case firmware made a mistake. For more
++ * on how these delay values work see rtas_busy_delay_time
++ */
++ if (ret > RTAS_EXTENDED_DELAY_MIN+2 &&
++ ret <= RTAS_EXTENDED_DELAY_MAX)
++ ret = RTAS_EXTENDED_DELAY_MIN+2;
++
++ max_wait -= rtas_busy_delay_time(ret);
++
++ if (max_wait < 0)
++ break;
++
++ rtas_busy_delay(ret);
++ }
+
++ pr_warn("%s: Unable to configure bridge PHB#%d-PE#%x (%d)\n",
++ __func__, pe->phb->global_number, pe->addr, ret);
+ return ret;
+ }
+
+diff --git a/arch/x86/boot/Makefile b/arch/x86/boot/Makefile
+index 3db07f30636f..32342a6034df 100644
+--- a/arch/x86/boot/Makefile
++++ b/arch/x86/boot/Makefile
+@@ -160,6 +160,9 @@ isoimage: $(obj)/bzImage
+ for i in lib lib64 share end ; do \
+ if [ -f /usr/$$i/syslinux/isolinux.bin ] ; then \
+ cp /usr/$$i/syslinux/isolinux.bin $(obj)/isoimage ; \
++ if [ -f /usr/$$i/syslinux/ldlinux.c32 ]; then \
++ cp /usr/$$i/syslinux/ldlinux.c32 $(obj)/isoimage ; \
++ fi ; \
+ break ; \
+ fi ; \
+ if [ $$i = end ] ; then exit 1 ; fi ; \
+diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
+index 160981f69d4f..518c7a8a3121 100644
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -3111,6 +3111,11 @@ static int kvm_vcpu_ioctl_x86_set_debugregs(struct kvm_vcpu *vcpu,
+ if (dbgregs->flags)
+ return -EINVAL;
+
++ if (dbgregs->dr6 & ~0xffffffffull)
++ return -EINVAL;
++ if (dbgregs->dr7 & ~0xffffffffull)
++ return -EINVAL;
++
+ memcpy(vcpu->arch.db, dbgregs->db, sizeof(vcpu->arch.db));
+ vcpu->arch.dr6 = dbgregs->dr6;
+ kvm_update_dr6(vcpu);
+diff --git a/crypto/asymmetric_keys/Kconfig b/crypto/asymmetric_keys/Kconfig
+index 4870f28403f5..05bfe568cd30 100644
+--- a/crypto/asymmetric_keys/Kconfig
++++ b/crypto/asymmetric_keys/Kconfig
+@@ -14,6 +14,7 @@ config ASYMMETRIC_PUBLIC_KEY_SUBTYPE
+ select MPILIB
+ select PUBLIC_KEY_ALGO_RSA
+ select CRYPTO_HASH_INFO
++ select CRYPTO_AKCIPHER
+ help
+ This option provides support for asymmetric public key type handling.
+ If signature generation and/or verification are to be used,
+diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
+index c1da6e121a67..0fdb8c7d609b 100644
+--- a/drivers/cpufreq/intel_pstate.c
++++ b/drivers/cpufreq/intel_pstate.c
+@@ -847,8 +847,11 @@ static int intel_pstate_cpu_init(struct cpufreq_policy *policy)
+
+ /* cpuinfo and default policy values */
+ policy->cpuinfo.min_freq = cpu->pstate.min_pstate * cpu->pstate.scaling;
+- policy->cpuinfo.max_freq =
+- cpu->pstate.turbo_pstate * cpu->pstate.scaling;
++ update_turbo_state();
++ policy->cpuinfo.max_freq = limits.turbo_disabled ?
++ cpu->pstate.max_pstate : cpu->pstate.turbo_pstate;
++ policy->cpuinfo.max_freq *= cpu->pstate.scaling;
++
+ policy->cpuinfo.transition_latency = CPUFREQ_ETERNAL;
+ cpumask_set_cpu(policy->cpu, policy->cpus);
+
+diff --git a/drivers/crypto/ccp/ccp-crypto-aes-xts.c b/drivers/crypto/ccp/ccp-crypto-aes-xts.c
+index 0cc5594b7de3..8b294c27c8b1 100644
+--- a/drivers/crypto/ccp/ccp-crypto-aes-xts.c
++++ b/drivers/crypto/ccp/ccp-crypto-aes-xts.c
+@@ -123,6 +123,7 @@ static int ccp_aes_xts_crypt(struct ablkcipher_request *req,
+ struct ccp_ctx *ctx = crypto_tfm_ctx(req->base.tfm);
+ struct ccp_aes_req_ctx *rctx = ablkcipher_request_ctx(req);
+ unsigned int unit;
++ u32 unit_size;
+ int ret;
+
+ if (!ctx->u.aes.key_len)
+@@ -134,11 +135,17 @@ static int ccp_aes_xts_crypt(struct ablkcipher_request *req,
+ if (!req->info)
+ return -EINVAL;
+
+- for (unit = 0; unit < ARRAY_SIZE(unit_size_map); unit++)
+- if (!(req->nbytes & (unit_size_map[unit].size - 1)))
+- break;
++ unit_size = CCP_XTS_AES_UNIT_SIZE__LAST;
++ if (req->nbytes <= unit_size_map[0].size) {
++ for (unit = 0; unit < ARRAY_SIZE(unit_size_map); unit++) {
++ if (!(req->nbytes & (unit_size_map[unit].size - 1))) {
++ unit_size = unit_size_map[unit].value;
++ break;
++ }
++ }
++ }
+
+- if ((unit_size_map[unit].value == CCP_XTS_AES_UNIT_SIZE__LAST) ||
++ if ((unit_size == CCP_XTS_AES_UNIT_SIZE__LAST) ||
+ (ctx->u.aes.key_len != AES_KEYSIZE_128)) {
+ /* Use the fallback to process the request for any
+ * unsupported unit sizes or key sizes
+@@ -159,7 +166,7 @@ static int ccp_aes_xts_crypt(struct ablkcipher_request *req,
+ rctx->cmd.engine = CCP_ENGINE_XTS_AES_128;
+ rctx->cmd.u.xts.action = (encrypt) ? CCP_AES_ACTION_ENCRYPT
+ : CCP_AES_ACTION_DECRYPT;
+- rctx->cmd.u.xts.unit_size = unit_size_map[unit].value;
++ rctx->cmd.u.xts.unit_size = unit_size;
+ rctx->cmd.u.xts.key = &ctx->u.aes.key_sg;
+ rctx->cmd.u.xts.key_len = ctx->u.aes.key_len;
+ rctx->cmd.u.xts.iv = &rctx->iv_sg;
+diff --git a/drivers/gpio/gpio-bcm-kona.c b/drivers/gpio/gpio-bcm-kona.c
+index de0801e9767a..b2826eeca465 100644
+--- a/drivers/gpio/gpio-bcm-kona.c
++++ b/drivers/gpio/gpio-bcm-kona.c
+@@ -549,11 +549,11 @@ static void bcm_kona_gpio_reset(struct bcm_kona_gpio *kona_gpio)
+ /* disable interrupts and clear status */
+ for (i = 0; i < kona_gpio->num_bank; i++) {
+ /* Unlock the entire bank first */
+- bcm_kona_gpio_write_lock_regs(kona_gpio, i, UNLOCK_CODE);
++ bcm_kona_gpio_write_lock_regs(reg_base, i, UNLOCK_CODE);
+ writel(0xffffffff, reg_base + GPIO_INT_MASK(i));
+ writel(0xffffffff, reg_base + GPIO_INT_STATUS(i));
+ /* Now re-lock the bank */
+- bcm_kona_gpio_write_lock_regs(kona_gpio, i, LOCK_CODE);
++ bcm_kona_gpio_write_lock_regs(reg_base, i, LOCK_CODE);
+ }
+ }
+
+diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
+index c81bda0ec2cf..164ee9b4646b 100644
+--- a/drivers/gpio/gpiolib.c
++++ b/drivers/gpio/gpiolib.c
+@@ -356,7 +356,7 @@ struct gpio_chip *gpiochip_find(void *data,
+
+ spin_lock_irqsave(&gpio_lock, flags);
+ list_for_each_entry(chip, &gpio_chips, list)
+- if (match(chip, data))
++ if (chip && match(chip, data))
+ break;
+
+ /* No match? */
+diff --git a/drivers/gpu/drm/ast/ast_fb.c b/drivers/gpu/drm/ast/ast_fb.c
+index 5c60ae524c45..ff68eefae273 100644
+--- a/drivers/gpu/drm/ast/ast_fb.c
++++ b/drivers/gpu/drm/ast/ast_fb.c
+@@ -335,18 +335,27 @@ int ast_fbdev_init(struct drm_device *dev)
+
+ ret = drm_fb_helper_init(dev, &afbdev->helper,
+ 1, 1);
+- if (ret) {
+- kfree(afbdev);
+- return ret;
+- }
++ if (ret)
++ goto free;
+
+- drm_fb_helper_single_add_all_connectors(&afbdev->helper);
++ ret = drm_fb_helper_single_add_all_connectors(&afbdev->helper);
++ if (ret)
++ goto fini;
+
+ /* disable all the possible outputs/crtcs before entering KMS mode */
+ drm_helper_disable_unused_functions(dev);
+
+- drm_fb_helper_initial_config(&afbdev->helper, 32);
++ ret = drm_fb_helper_initial_config(&afbdev->helper, 32);
++ if (ret)
++ goto fini;
++
+ return 0;
++
++fini:
++ drm_fb_helper_fini(&afbdev->helper);
++free:
++ kfree(afbdev);
++ return ret;
+ }
+
+ void ast_fbdev_fini(struct drm_device *dev)
+diff --git a/drivers/gpu/drm/bochs/bochs_fbdev.c b/drivers/gpu/drm/bochs/bochs_fbdev.c
+index fe95d31cd110..9cdab0f2575c 100644
+--- a/drivers/gpu/drm/bochs/bochs_fbdev.c
++++ b/drivers/gpu/drm/bochs/bochs_fbdev.c
+@@ -197,12 +197,22 @@ int bochs_fbdev_init(struct bochs_device *bochs)
+ if (ret)
+ return ret;
+
+- drm_fb_helper_single_add_all_connectors(&bochs->fb.helper);
++ ret = drm_fb_helper_single_add_all_connectors(&bochs->fb.helper);
++ if (ret)
++ goto fini;
++
+ drm_helper_disable_unused_functions(bochs->dev);
+- drm_fb_helper_initial_config(&bochs->fb.helper, 32);
++
++ ret = drm_fb_helper_initial_config(&bochs->fb.helper, 32);
++ if (ret)
++ goto fini;
+
+ bochs->fb.initialized = true;
+ return 0;
++
++fini:
++ drm_fb_helper_fini(&bochs->fb.helper);
++ return ret;
+ }
+
+ void bochs_fbdev_fini(struct bochs_device *bochs)
+diff --git a/drivers/gpu/drm/cirrus/cirrus_fbdev.c b/drivers/gpu/drm/cirrus/cirrus_fbdev.c
+index d231b1c317af..b487c4e40d83 100644
+--- a/drivers/gpu/drm/cirrus/cirrus_fbdev.c
++++ b/drivers/gpu/drm/cirrus/cirrus_fbdev.c
+@@ -314,17 +314,17 @@ int cirrus_fbdev_init(struct cirrus_device *cdev)
+
+ ret = drm_fb_helper_init(cdev->dev, &gfbdev->helper,
+ cdev->num_crtc, CIRRUSFB_CONN_LIMIT);
+- if (ret) {
+- kfree(gfbdev);
++ if (ret)
++ return ret;
++
++ ret = drm_fb_helper_single_add_all_connectors(&gfbdev->helper);
++ if (ret)
+ return ret;
+- }
+- drm_fb_helper_single_add_all_connectors(&gfbdev->helper);
+
+ /* disable all the possible outputs/crtcs before entering KMS mode */
+ drm_helper_disable_unused_functions(cdev->dev);
+- drm_fb_helper_initial_config(&gfbdev->helper, bpp_sel);
+
+- return 0;
++ return drm_fb_helper_initial_config(&gfbdev->helper, bpp_sel);
+ }
+
+ void cirrus_fbdev_fini(struct cirrus_device *cdev)
+diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c
+index 1463804b63f0..1e41f466055c 100644
+--- a/drivers/gpu/drm/drm_fb_helper.c
++++ b/drivers/gpu/drm/drm_fb_helper.c
+@@ -1637,7 +1637,7 @@ out:
+ * RETURNS:
+ * Zero if everything went ok, nonzero otherwise.
+ */
+-bool drm_fb_helper_initial_config(struct drm_fb_helper *fb_helper, int bpp_sel)
++int drm_fb_helper_initial_config(struct drm_fb_helper *fb_helper, int bpp_sel)
+ {
+ struct drm_device *dev = fb_helper->dev;
+ int count = 0;
+diff --git a/drivers/gpu/drm/gma500/framebuffer.c b/drivers/gpu/drm/gma500/framebuffer.c
+index ddd90ddbc200..2d42ce6d3757 100644
+--- a/drivers/gpu/drm/gma500/framebuffer.c
++++ b/drivers/gpu/drm/gma500/framebuffer.c
+@@ -593,6 +593,7 @@ int psb_fbdev_init(struct drm_device *dev)
+ {
+ struct psb_fbdev *fbdev;
+ struct drm_psb_private *dev_priv = dev->dev_private;
++ int ret;
+
+ fbdev = kzalloc(sizeof(struct psb_fbdev), GFP_KERNEL);
+ if (!fbdev) {
+@@ -604,16 +605,29 @@ int psb_fbdev_init(struct drm_device *dev)
+
+ drm_fb_helper_prepare(dev, &fbdev->psb_fb_helper, &psb_fb_helper_funcs);
+
+- drm_fb_helper_init(dev, &fbdev->psb_fb_helper, dev_priv->ops->crtcs,
+- INTELFB_CONN_LIMIT);
++ ret = drm_fb_helper_init(dev, &fbdev->psb_fb_helper,
++ dev_priv->ops->crtcs, INTELFB_CONN_LIMIT);
++ if (ret)
++ goto free;
+
+- drm_fb_helper_single_add_all_connectors(&fbdev->psb_fb_helper);
++ ret = drm_fb_helper_single_add_all_connectors(&fbdev->psb_fb_helper);
++ if (ret)
++ goto fini;
+
+ /* disable all the possible outputs/crtcs before entering KMS mode */
+ drm_helper_disable_unused_functions(dev);
+
+- drm_fb_helper_initial_config(&fbdev->psb_fb_helper, 32);
++ ret = drm_fb_helper_initial_config(&fbdev->psb_fb_helper, 32);
++ if (ret)
++ goto fini;
++
+ return 0;
++
++fini:
++ drm_fb_helper_fini(&fbdev->psb_fb_helper);
++free:
++ kfree(fbdev);
++ return ret;
+ }
+
+ static void psb_fbdev_fini(struct drm_device *dev)
+diff --git a/drivers/gpu/drm/mgag200/mgag200_fb.c b/drivers/gpu/drm/mgag200/mgag200_fb.c
+index 4415af3666ab..c36b8304042b 100644
+--- a/drivers/gpu/drm/mgag200/mgag200_fb.c
++++ b/drivers/gpu/drm/mgag200/mgag200_fb.c
+@@ -303,14 +303,22 @@ int mgag200_fbdev_init(struct mga_device *mdev)
+ if (ret)
+ return ret;
+
+- drm_fb_helper_single_add_all_connectors(&mfbdev->helper);
++ ret = drm_fb_helper_single_add_all_connectors(&mfbdev->helper);
++ if (ret)
++ goto fini;
+
+ /* disable all the possible outputs/crtcs before entering KMS mode */
+ drm_helper_disable_unused_functions(mdev->dev);
+
+- drm_fb_helper_initial_config(&mfbdev->helper, bpp_sel);
++ ret = drm_fb_helper_initial_config(&mfbdev->helper, bpp_sel);
++ if (ret)
++ goto fini;
+
+ return 0;
++
++fini:
++ drm_fb_helper_fini(&mfbdev->helper);
++ return ret;
+ }
+
+ void mgag200_fbdev_fini(struct mga_device *mdev)
+diff --git a/drivers/gpu/drm/msm/msm_fbdev.c b/drivers/gpu/drm/msm/msm_fbdev.c
+index ab5bfd2d0ebf..956710dd84a4 100644
+--- a/drivers/gpu/drm/msm/msm_fbdev.c
++++ b/drivers/gpu/drm/msm/msm_fbdev.c
+@@ -245,17 +245,23 @@ struct drm_fb_helper *msm_fbdev_init(struct drm_device *dev)
+ goto fail;
+ }
+
+- drm_fb_helper_single_add_all_connectors(helper);
++ ret = drm_fb_helper_single_add_all_connectors(helper);
++ if (ret)
++ goto fini;
+
+ /* disable all the possible outputs/crtcs before entering KMS mode */
+ drm_helper_disable_unused_functions(dev);
+
+- drm_fb_helper_initial_config(helper, 32);
++ ret = drm_fb_helper_initial_config(helper, 32);
++ if (ret)
++ goto fini;
+
+ priv->fbdev = helper;
+
+ return helper;
+
++fini:
++ drm_fb_helper_fini(helper);
+ fail:
+ kfree(fbdev);
+ return NULL;
+diff --git a/drivers/gpu/drm/nouveau/nouveau_fbcon.c b/drivers/gpu/drm/nouveau/nouveau_fbcon.c
+index ddcfc1d2544b..ff6358f8a9c6 100644
+--- a/drivers/gpu/drm/nouveau/nouveau_fbcon.c
++++ b/drivers/gpu/drm/nouveau/nouveau_fbcon.c
+@@ -546,12 +546,12 @@ nouveau_fbcon_init(struct drm_device *dev)
+
+ ret = drm_fb_helper_init(dev, &fbcon->helper,
+ dev->mode_config.num_crtc, 4);
+- if (ret) {
+- kfree(fbcon);
+- return ret;
+- }
++ if (ret)
++ goto free;
+
+- drm_fb_helper_single_add_all_connectors(&fbcon->helper);
++ ret = drm_fb_helper_single_add_all_connectors(&fbcon->helper);
++ if (ret)
++ goto fini;
+
+ if (drm->device.info.ram_size <= 32 * 1024 * 1024)
+ preferred_bpp = 8;
+@@ -564,8 +564,18 @@ nouveau_fbcon_init(struct drm_device *dev)
+ /* disable all the possible outputs/crtcs before entering KMS mode */
+ drm_helper_disable_unused_functions(dev);
+
+- drm_fb_helper_initial_config(&fbcon->helper, preferred_bpp);
++ ret = drm_fb_helper_initial_config(&fbcon->helper, preferred_bpp);
++ if (ret)
++ goto fini;
++
++ fbcon->helper.fbdev->pixmap.buf_align = 4;
+ return 0;
++
++fini:
++ drm_fb_helper_fini(&fbcon->helper);
++free:
++ kfree(fbcon);
++ return ret;
+ }
+
+ void
+diff --git a/drivers/gpu/drm/nouveau/nv04_fbcon.c b/drivers/gpu/drm/nouveau/nv04_fbcon.c
+index 4ef602c5469d..7ab83f7f2763 100644
+--- a/drivers/gpu/drm/nouveau/nv04_fbcon.c
++++ b/drivers/gpu/drm/nouveau/nv04_fbcon.c
+@@ -82,7 +82,6 @@ nv04_fbcon_imageblit(struct fb_info *info, const struct fb_image *image)
+ uint32_t fg;
+ uint32_t bg;
+ uint32_t dsize;
+- uint32_t width;
+ uint32_t *data = (uint32_t *)image->data;
+ int ret;
+
+@@ -93,9 +92,6 @@ nv04_fbcon_imageblit(struct fb_info *info, const struct fb_image *image)
+ if (ret)
+ return ret;
+
+- width = ALIGN(image->width, 8);
+- dsize = ALIGN(width * image->height, 32) >> 5;
+-
+ if (info->fix.visual == FB_VISUAL_TRUECOLOR ||
+ info->fix.visual == FB_VISUAL_DIRECTCOLOR) {
+ fg = ((uint32_t *) info->pseudo_palette)[image->fg_color];
+@@ -111,10 +107,11 @@ nv04_fbcon_imageblit(struct fb_info *info, const struct fb_image *image)
+ ((image->dx + image->width) & 0xffff));
+ OUT_RING(chan, bg);
+ OUT_RING(chan, fg);
+- OUT_RING(chan, (image->height << 16) | width);
++ OUT_RING(chan, (image->height << 16) | image->width);
+ OUT_RING(chan, (image->height << 16) | image->width);
+ OUT_RING(chan, (image->dy << 16) | (image->dx & 0xffff));
+
++ dsize = ALIGN(image->width * image->height, 32) >> 5;
+ while (dsize) {
+ int iter_len = dsize > 128 ? 128 : dsize;
+
+diff --git a/drivers/gpu/drm/nouveau/nv50_fbcon.c b/drivers/gpu/drm/nouveau/nv50_fbcon.c
+index 394c89abcc97..cb2a71ada99e 100644
+--- a/drivers/gpu/drm/nouveau/nv50_fbcon.c
++++ b/drivers/gpu/drm/nouveau/nv50_fbcon.c
+@@ -95,7 +95,7 @@ nv50_fbcon_imageblit(struct fb_info *info, const struct fb_image *image)
+ struct nouveau_fbdev *nfbdev = info->par;
+ struct nouveau_drm *drm = nouveau_drm(nfbdev->dev);
+ struct nouveau_channel *chan = drm->channel;
+- uint32_t width, dwords, *data = (uint32_t *)image->data;
++ uint32_t dwords, *data = (uint32_t *)image->data;
+ uint32_t mask = ~(~0 >> (32 - info->var.bits_per_pixel));
+ uint32_t *palette = info->pseudo_palette;
+ int ret;
+@@ -107,9 +107,6 @@ nv50_fbcon_imageblit(struct fb_info *info, const struct fb_image *image)
+ if (ret)
+ return ret;
+
+- width = ALIGN(image->width, 32);
+- dwords = (width * image->height) >> 5;
+-
+ BEGIN_NV04(chan, NvSub2D, 0x0814, 2);
+ if (info->fix.visual == FB_VISUAL_TRUECOLOR ||
+ info->fix.visual == FB_VISUAL_DIRECTCOLOR) {
+@@ -128,6 +125,7 @@ nv50_fbcon_imageblit(struct fb_info *info, const struct fb_image *image)
+ OUT_RING(chan, 0);
+ OUT_RING(chan, image->dy);
+
++ dwords = ALIGN(image->width * image->height, 32) >> 5;
+ while (dwords) {
+ int push = dwords > 2047 ? 2047 : dwords;
+
+diff --git a/drivers/gpu/drm/nouveau/nvc0_fbcon.c b/drivers/gpu/drm/nouveau/nvc0_fbcon.c
+index 61246677e8dc..69f760e8c54f 100644
+--- a/drivers/gpu/drm/nouveau/nvc0_fbcon.c
++++ b/drivers/gpu/drm/nouveau/nvc0_fbcon.c
+@@ -95,7 +95,7 @@ nvc0_fbcon_imageblit(struct fb_info *info, const struct fb_image *image)
+ struct nouveau_fbdev *nfbdev = info->par;
+ struct nouveau_drm *drm = nouveau_drm(nfbdev->dev);
+ struct nouveau_channel *chan = drm->channel;
+- uint32_t width, dwords, *data = (uint32_t *)image->data;
++ uint32_t dwords, *data = (uint32_t *)image->data;
+ uint32_t mask = ~(~0 >> (32 - info->var.bits_per_pixel));
+ uint32_t *palette = info->pseudo_palette;
+ int ret;
+@@ -107,9 +107,6 @@ nvc0_fbcon_imageblit(struct fb_info *info, const struct fb_image *image)
+ if (ret)
+ return ret;
+
+- width = ALIGN(image->width, 32);
+- dwords = (width * image->height) >> 5;
+-
+ BEGIN_NVC0(chan, NvSub2D, 0x0814, 2);
+ if (info->fix.visual == FB_VISUAL_TRUECOLOR ||
+ info->fix.visual == FB_VISUAL_DIRECTCOLOR) {
+@@ -128,6 +125,7 @@ nvc0_fbcon_imageblit(struct fb_info *info, const struct fb_image *image)
+ OUT_RING (chan, 0);
+ OUT_RING (chan, image->dy);
+
++ dwords = ALIGN(image->width * image->height, 32) >> 5;
+ while (dwords) {
+ int push = dwords > 2047 ? 2047 : dwords;
+
+diff --git a/drivers/gpu/drm/omapdrm/omap_fbdev.c b/drivers/gpu/drm/omapdrm/omap_fbdev.c
+index 8436c6857cda..d292d24b3a6e 100644
+--- a/drivers/gpu/drm/omapdrm/omap_fbdev.c
++++ b/drivers/gpu/drm/omapdrm/omap_fbdev.c
+@@ -334,17 +334,23 @@ struct drm_fb_helper *omap_fbdev_init(struct drm_device *dev)
+ goto fail;
+ }
+
+- drm_fb_helper_single_add_all_connectors(helper);
++ ret = drm_fb_helper_single_add_all_connectors(helper);
++ if (ret)
++ goto fini;
+
+ /* disable all the possible outputs/crtcs before entering KMS mode */
+ drm_helper_disable_unused_functions(dev);
+
+- drm_fb_helper_initial_config(helper, 32);
++ ret = drm_fb_helper_initial_config(helper, 32);
++ if (ret)
++ goto fini;
+
+ priv->fbdev = helper;
+
+ return helper;
+
++fini:
++ drm_fb_helper_fini(helper);
+ fail:
+ kfree(fbdev);
+ return NULL;
+diff --git a/drivers/gpu/drm/qxl/qxl_fb.c b/drivers/gpu/drm/qxl/qxl_fb.c
+index 3d7c1d00a424..f778c0e8ae3c 100644
+--- a/drivers/gpu/drm/qxl/qxl_fb.c
++++ b/drivers/gpu/drm/qxl/qxl_fb.c
+@@ -686,14 +686,24 @@ int qxl_fbdev_init(struct qxl_device *qdev)
+ ret = drm_fb_helper_init(qdev->ddev, &qfbdev->helper,
+ qxl_num_crtc /* num_crtc - QXL supports just 1 */,
+ QXLFB_CONN_LIMIT);
+- if (ret) {
+- kfree(qfbdev);
+- return ret;
+- }
++ if (ret)
++ goto free;
++
++ ret = drm_fb_helper_single_add_all_connectors(&qfbdev->helper);
++ if (ret)
++ goto fini;
++
++ ret = drm_fb_helper_initial_config(&qfbdev->helper, bpp_sel);
++ if (ret)
++ goto fini;
+
+- drm_fb_helper_single_add_all_connectors(&qfbdev->helper);
+- drm_fb_helper_initial_config(&qfbdev->helper, bpp_sel);
+ return 0;
++
++fini:
++ drm_fb_helper_fini(&qfbdev->helper);
++free:
++ kfree(qfbdev);
++ return ret;
+ }
+
+ void qxl_fbdev_fini(struct qxl_device *qdev)
+diff --git a/drivers/gpu/drm/radeon/radeon_fb.c b/drivers/gpu/drm/radeon/radeon_fb.c
+index a5dc86ae0bdd..6514ff218995 100644
+--- a/drivers/gpu/drm/radeon/radeon_fb.c
++++ b/drivers/gpu/drm/radeon/radeon_fb.c
+@@ -365,18 +365,27 @@ int radeon_fbdev_init(struct radeon_device *rdev)
+ ret = drm_fb_helper_init(rdev->ddev, &rfbdev->helper,
+ rdev->num_crtc,
+ RADEONFB_CONN_LIMIT);
+- if (ret) {
+- kfree(rfbdev);
+- return ret;
+- }
++ if (ret)
++ goto free;
+
+- drm_fb_helper_single_add_all_connectors(&rfbdev->helper);
++ ret = drm_fb_helper_single_add_all_connectors(&rfbdev->helper);
++ if (ret)
++ goto fini;
+
+ /* disable all the possible outputs/crtcs before entering KMS mode */
+ drm_helper_disable_unused_functions(rdev->ddev);
+
+- drm_fb_helper_initial_config(&rfbdev->helper, bpp_sel);
++ ret = drm_fb_helper_initial_config(&rfbdev->helper, bpp_sel);
++ if (ret)
++ goto fini;
++
+ return 0;
++
++fini:
++ drm_fb_helper_fini(&rfbdev->helper);
++free:
++ kfree(rfbdev);
++ return ret;
+ }
+
+ void radeon_fbdev_fini(struct radeon_device *rdev)
+diff --git a/drivers/gpu/drm/udl/udl_fb.c b/drivers/gpu/drm/udl/udl_fb.c
+index 8cbcb4589bd3..5fc16cecd3ba 100644
+--- a/drivers/gpu/drm/udl/udl_fb.c
++++ b/drivers/gpu/drm/udl/udl_fb.c
+@@ -589,19 +589,27 @@ int udl_fbdev_init(struct drm_device *dev)
+
+ ret = drm_fb_helper_init(dev, &ufbdev->helper,
+ 1, 1);
+- if (ret) {
+- kfree(ufbdev);
+- return ret;
+-
+- }
++ if (ret)
++ goto free;
+
+- drm_fb_helper_single_add_all_connectors(&ufbdev->helper);
++ ret = drm_fb_helper_single_add_all_connectors(&ufbdev->helper);
++ if (ret)
++ goto fini;
+
+ /* disable all the possible outputs/crtcs before entering KMS mode */
+ drm_helper_disable_unused_functions(dev);
+
+- drm_fb_helper_initial_config(&ufbdev->helper, bpp_sel);
++ ret = drm_fb_helper_initial_config(&ufbdev->helper, bpp_sel);
++ if (ret)
++ goto fini;
++
+ return 0;
++
++fini:
++ drm_fb_helper_fini(&ufbdev->helper);
++free:
++ kfree(ufbdev);
++ return ret;
+ }
+
+ void udl_fbdev_cleanup(struct drm_device *dev)
+diff --git a/drivers/irqchip/irq-gic-v3.c b/drivers/irqchip/irq-gic-v3.c
+index a94342f4a3ef..1242d8a25721 100644
+--- a/drivers/irqchip/irq-gic-v3.c
++++ b/drivers/irqchip/irq-gic-v3.c
+@@ -474,15 +474,19 @@ out:
+ return tlist;
+ }
+
++#define MPIDR_TO_SGI_AFFINITY(cluster_id, level) \
++ (MPIDR_AFFINITY_LEVEL(cluster_id, level) \
++ << ICC_SGI1R_AFFINITY_## level ##_SHIFT)
++
+ static void gic_send_sgi(u64 cluster_id, u16 tlist, unsigned int irq)
+ {
+ u64 val;
+
+- val = (MPIDR_AFFINITY_LEVEL(cluster_id, 3) << 48 |
+- MPIDR_AFFINITY_LEVEL(cluster_id, 2) << 32 |
+- irq << 24 |
+- MPIDR_AFFINITY_LEVEL(cluster_id, 1) << 16 |
+- tlist);
++ val = (MPIDR_TO_SGI_AFFINITY(cluster_id, 3) |
++ MPIDR_TO_SGI_AFFINITY(cluster_id, 2) |
++ irq << ICC_SGI1R_SGI_ID_SHIFT |
++ MPIDR_TO_SGI_AFFINITY(cluster_id, 1) |
++ tlist << ICC_SGI1R_TARGET_LIST_SHIFT);
+
+ pr_debug("CPU%d: ICC_SGI1R_EL1 %llx\n", smp_processor_id(), val);
+ gic_write_sgi1r(val);
+diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
+index c9ad4cf1adfb..c30cd5daaacf 100644
+--- a/drivers/net/wireless/mac80211_hwsim.c
++++ b/drivers/net/wireless/mac80211_hwsim.c
+@@ -2277,6 +2277,7 @@ static int hwsim_tx_info_frame_received_nl(struct sk_buff *skb_2,
+ if (!info->attrs[HWSIM_ATTR_ADDR_TRANSMITTER] ||
+ !info->attrs[HWSIM_ATTR_FLAGS] ||
+ !info->attrs[HWSIM_ATTR_COOKIE] ||
++ !info->attrs[HWSIM_ATTR_SIGNAL] ||
+ !info->attrs[HWSIM_ATTR_TX_INFO])
+ goto out;
+
+diff --git a/drivers/of/irq.c b/drivers/of/irq.c
+index b97363adca0b..8e557ebb8d84 100644
+--- a/drivers/of/irq.c
++++ b/drivers/of/irq.c
+@@ -385,13 +385,13 @@ int of_irq_to_resource(struct device_node *dev, int index, struct resource *r)
+ EXPORT_SYMBOL_GPL(of_irq_to_resource);
+
+ /**
+- * of_irq_get - Decode a node's IRQ and return it as a Linux irq number
++ * of_irq_get - Decode a node's IRQ and return it as a Linux IRQ number
+ * @dev: pointer to device tree node
+- * @index: zero-based index of the irq
+- *
+- * Returns Linux irq number on success, or -EPROBE_DEFER if the irq domain
+- * is not yet created.
++ * @index: zero-based index of the IRQ
+ *
++ * Returns Linux IRQ number on success, or 0 on the IRQ mapping failure, or
++ * -EPROBE_DEFER if the IRQ domain is not yet created, or error code in case
++ * of any other failure.
+ */
+ int of_irq_get(struct device_node *dev, int index)
+ {
+@@ -411,12 +411,13 @@ int of_irq_get(struct device_node *dev, int index)
+ }
+
+ /**
+- * of_irq_get_byname - Decode a node's IRQ and return it as a Linux irq number
++ * of_irq_get_byname - Decode a node's IRQ and return it as a Linux IRQ number
+ * @dev: pointer to device tree node
+- * @name: irq name
++ * @name: IRQ name
+ *
+- * Returns Linux irq number on success, or -EPROBE_DEFER if the irq domain
+- * is not yet created, or error code in case of any other failure.
++ * Returns Linux IRQ number on success, or 0 on the IRQ mapping failure, or
++ * -EPROBE_DEFER if the IRQ domain is not yet created, or error code in case
++ * of any other failure.
+ */
+ int of_irq_get_byname(struct device_node *dev, const char *name)
+ {
+diff --git a/drivers/scsi/scsi_devinfo.c b/drivers/scsi/scsi_devinfo.c
+index 6e2256f7d7d6..7439304f01d0 100644
+--- a/drivers/scsi/scsi_devinfo.c
++++ b/drivers/scsi/scsi_devinfo.c
+@@ -227,6 +227,7 @@ static struct {
+ {"PIONEER", "CD-ROM DRM-624X", NULL, BLIST_FORCELUN | BLIST_SINGLELUN},
+ {"Promise", "VTrak E610f", NULL, BLIST_SPARSELUN | BLIST_NO_RSOC},
+ {"Promise", "", NULL, BLIST_SPARSELUN},
++ {"QEMU", "QEMU CD-ROM", NULL, BLIST_SKIP_VPD_PAGES},
+ {"QNAP", "iSCSI Storage", NULL, BLIST_MAX_1024},
+ {"QUANTUM", "XP34301", "1071", BLIST_NOTQ},
+ {"REGAL", "CDC-4X", NULL, BLIST_MAX5LUN | BLIST_SINGLELUN},
+diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
+index b1ab509d0e05..a11837054d6c 100644
+--- a/drivers/scsi/scsi_lib.c
++++ b/drivers/scsi/scsi_lib.c
+@@ -919,9 +919,12 @@ void scsi_io_completion(struct scsi_cmnd *cmd, unsigned int good_bytes)
+ }
+
+ /*
+- * If we finished all bytes in the request we are done now.
++ * special case: failed zero length commands always need to
++ * drop down into the retry code. Otherwise, if we finished
++ * all bytes in the request we are done now.
+ */
+- if (!scsi_end_request(req, error, good_bytes, 0))
++ if (!(blk_rq_bytes(req) == 0 && error) &&
++ !scsi_end_request(req, error, good_bytes, 0))
+ return;
+
+ /*
+diff --git a/fs/dcache.c b/fs/dcache.c
+index d25f8fdcd397..7654509f398f 100644
+--- a/fs/dcache.c
++++ b/fs/dcache.c
+@@ -1481,7 +1481,7 @@ struct dentry *d_alloc(struct dentry * parent, const struct qstr *name)
+ struct dentry *dentry = __d_alloc(parent->d_sb, name);
+ if (!dentry)
+ return NULL;
+-
++ dentry->d_flags |= DCACHE_RCUACCESS;
+ spin_lock(&parent->d_lock);
+ /*
+ * don't need child lock because it is not subject
+@@ -2313,7 +2313,6 @@ static void __d_rehash(struct dentry * entry, struct hlist_bl_head *b)
+ {
+ BUG_ON(!d_unhashed(entry));
+ hlist_bl_lock(b);
+- entry->d_flags |= DCACHE_RCUACCESS;
+ hlist_bl_add_head_rcu(&entry->d_hash, b);
+ hlist_bl_unlock(b);
+ }
+@@ -2532,6 +2531,7 @@ static void __d_move(struct dentry *dentry, struct dentry *target,
+ /* ... and switch them in the tree */
+ if (IS_ROOT(dentry)) {
+ /* splicing a tree */
++ dentry->d_flags |= DCACHE_RCUACCESS;
+ dentry->d_parent = target->d_parent;
+ target->d_parent = target;
+ list_del_init(&target->d_child);
+diff --git a/fs/ecryptfs/kthread.c b/fs/ecryptfs/kthread.c
+index f1ea610362c6..9b661a4ccee7 100644
+--- a/fs/ecryptfs/kthread.c
++++ b/fs/ecryptfs/kthread.c
+@@ -25,6 +25,7 @@
+ #include <linux/slab.h>
+ #include <linux/wait.h>
+ #include <linux/mount.h>
++#include <linux/file.h>
+ #include "ecryptfs_kernel.h"
+
+ struct ecryptfs_open_req {
+@@ -147,7 +148,7 @@ int ecryptfs_privileged_open(struct file **lower_file,
+ flags |= IS_RDONLY(lower_dentry->d_inode) ? O_RDONLY : O_RDWR;
+ (*lower_file) = dentry_open(&req.path, flags, cred);
+ if (!IS_ERR(*lower_file))
+- goto out;
++ goto have_file;
+ if ((flags & O_ACCMODE) == O_RDONLY) {
+ rc = PTR_ERR((*lower_file));
+ goto out;
+@@ -165,8 +166,16 @@ int ecryptfs_privileged_open(struct file **lower_file,
+ mutex_unlock(&ecryptfs_kthread_ctl.mux);
+ wake_up(&ecryptfs_kthread_ctl.wait);
+ wait_for_completion(&req.done);
+- if (IS_ERR(*lower_file))
++ if (IS_ERR(*lower_file)) {
+ rc = PTR_ERR(*lower_file);
++ goto out;
++ }
++have_file:
++ if ((*lower_file)->f_op->mmap == NULL) {
++ fput(*lower_file);
++ *lower_file = NULL;
++ rc = -EMEDIUMTYPE;
++ }
+ out:
+ return rc;
+ }
+diff --git a/fs/namespace.c b/fs/namespace.c
+index da23ad8a2c85..db31a49e01fd 100644
+--- a/fs/namespace.c
++++ b/fs/namespace.c
+@@ -2331,8 +2331,10 @@ static int do_new_mount(struct path *path, const char *fstype, int flags,
+ mnt_flags |= MNT_NODEV | MNT_LOCK_NODEV;
+ }
+ if (type->fs_flags & FS_USERNS_VISIBLE) {
+- if (!fs_fully_visible(type, &mnt_flags))
++ if (!fs_fully_visible(type, &mnt_flags)) {
++ put_filesystem(type);
+ return -EPERM;
++ }
+ }
+ }
+
+@@ -3173,7 +3175,7 @@ static bool fs_fully_visible(struct file_system_type *type, int *new_mnt_flags)
+ list_for_each_entry(child, &mnt->mnt_mounts, mnt_child) {
+ struct inode *inode = child->mnt_mountpoint->d_inode;
+ /* Only worry about locked mounts */
+- if (!(mnt->mnt.mnt_flags & MNT_LOCKED))
++ if (!(child->mnt.mnt_flags & MNT_LOCKED))
+ continue;
+ if (!S_ISDIR(inode->i_mode))
+ goto next;
+diff --git a/fs/proc/root.c b/fs/proc/root.c
+index 9e772f1a5386..7863ed5a6a88 100644
+--- a/fs/proc/root.c
++++ b/fs/proc/root.c
+@@ -121,6 +121,13 @@ static struct dentry *proc_mount(struct file_system_type *fs_type,
+ if (IS_ERR(sb))
+ return ERR_CAST(sb);
+
++ /*
++ * procfs isn't actually a stacking filesystem; however, there is
++ * too much magic going on inside it to permit stacking things on
++ * top of it
++ */
++ sb->s_stack_depth = FILESYSTEM_MAX_STACK_DEPTH;
++
+ if (!proc_parse_options(options, ns)) {
+ deactivate_locked_super(sb);
+ return ERR_PTR(-EINVAL);
+diff --git a/include/drm/drm_fb_helper.h b/include/drm/drm_fb_helper.h
+index f4ad254e3488..39d099aa09e1 100644
+--- a/include/drm/drm_fb_helper.h
++++ b/include/drm/drm_fb_helper.h
+@@ -119,7 +119,7 @@ void drm_fb_helper_fill_fix(struct fb_info *info, uint32_t pitch,
+ int drm_fb_helper_setcmap(struct fb_cmap *cmap, struct fb_info *info);
+
+ int drm_fb_helper_hotplug_event(struct drm_fb_helper *fb_helper);
+-bool drm_fb_helper_initial_config(struct drm_fb_helper *fb_helper, int bpp_sel);
++int drm_fb_helper_initial_config(struct drm_fb_helper *fb_helper, int bpp_sel);
+ int drm_fb_helper_single_add_all_connectors(struct drm_fb_helper *fb_helper);
+ int drm_fb_helper_debug_enter(struct fb_info *info);
+ int drm_fb_helper_debug_leave(struct fb_info *info);
+diff --git a/include/linux/irqchip/arm-gic-v3.h b/include/linux/irqchip/arm-gic-v3.h
+index 03a4ea37ba86..e93d2c5549db 100644
+--- a/include/linux/irqchip/arm-gic-v3.h
++++ b/include/linux/irqchip/arm-gic-v3.h
+@@ -142,6 +142,18 @@
+ #define ICC_SRE_EL2_SRE (1 << 0)
+ #define ICC_SRE_EL2_ENABLE (1 << 3)
+
++#define ICC_SGI1R_TARGET_LIST_SHIFT 0
++#define ICC_SGI1R_TARGET_LIST_MASK (0xffff << ICC_SGI1R_TARGET_LIST_SHIFT)
++#define ICC_SGI1R_AFFINITY_1_SHIFT 16
++#define ICC_SGI1R_AFFINITY_1_MASK (0xff << ICC_SGI1R_AFFINITY_1_SHIFT)
++#define ICC_SGI1R_SGI_ID_SHIFT 24
++#define ICC_SGI1R_SGI_ID_MASK (0xfULL << ICC_SGI1R_SGI_ID_SHIFT)
++#define ICC_SGI1R_AFFINITY_2_SHIFT 32
++#define ICC_SGI1R_AFFINITY_2_MASK (0xffULL << ICC_SGI1R_AFFINITY_1_SHIFT)
++#define ICC_SGI1R_IRQ_ROUTING_MODE_BIT 40
++#define ICC_SGI1R_AFFINITY_3_SHIFT 48
++#define ICC_SGI1R_AFFINITY_3_MASK (0xffULL << ICC_SGI1R_AFFINITY_1_SHIFT)
++
+ /*
+ * System register definitions
+ */
+diff --git a/kernel/locking/mutex.c b/kernel/locking/mutex.c
+index dadbf88c22c4..e3fe1dda72ca 100644
+--- a/kernel/locking/mutex.c
++++ b/kernel/locking/mutex.c
+@@ -471,9 +471,6 @@ __mutex_lock_check_stamp(struct mutex *lock, struct ww_acquire_ctx *ctx)
+ if (!hold_ctx)
+ return 0;
+
+- if (unlikely(ctx == hold_ctx))
+- return -EALREADY;
+-
+ if (ctx->stamp - hold_ctx->stamp <= LONG_MAX &&
+ (ctx->stamp != hold_ctx->stamp || ctx > hold_ctx)) {
+ #ifdef CONFIG_DEBUG_MUTEXES
+@@ -499,6 +496,12 @@ __mutex_lock_common(struct mutex *lock, long state, unsigned int subclass,
+ unsigned long flags;
+ int ret;
+
++ if (use_ww_ctx) {
++ struct ww_mutex *ww = container_of(lock, struct ww_mutex, base);
++ if (unlikely(ww_ctx == READ_ONCE(ww->ctx)))
++ return -EALREADY;
++ }
++
+ preempt_disable();
+ mutex_acquire_nest(&lock->dep_map, subclass, 0, nest_lock, ip);
+
+diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c
+index 2bbc820c7dfc..ac04e3874af1 100644
+--- a/net/mac80211/mesh.c
++++ b/net/mac80211/mesh.c
+@@ -161,6 +161,10 @@ void mesh_sta_cleanup(struct sta_info *sta)
+ del_timer_sync(&sta->plink_timer);
+ }
+
++ /* make sure no readers can access nexthop sta from here on */
++ mesh_path_flush_by_nexthop(sta);
++ synchronize_net();
++
+ if (changed)
+ ieee80211_mbss_info_change_notify(sdata, changed);
+ }
+diff --git a/net/wireless/wext-core.c b/net/wireless/wext-core.c
+index b50ee5d622e1..c753211cb83f 100644
+--- a/net/wireless/wext-core.c
++++ b/net/wireless/wext-core.c
+@@ -955,8 +955,29 @@ static int wireless_process_ioctl(struct net *net, struct ifreq *ifr,
+ return private(dev, iwr, cmd, info, handler);
+ }
+ /* Old driver API : call driver ioctl handler */
+- if (dev->netdev_ops->ndo_do_ioctl)
+- return dev->netdev_ops->ndo_do_ioctl(dev, ifr, cmd);
++ if (dev->netdev_ops->ndo_do_ioctl) {
++#ifdef CONFIG_COMPAT
++ if (info->flags & IW_REQUEST_FLAG_COMPAT) {
++ int ret = 0;
++ struct iwreq iwr_lcl;
++ struct compat_iw_point *iwp_compat = (void *) &iwr->u.data;
++
++ memcpy(&iwr_lcl, iwr, sizeof(struct iwreq));
++ iwr_lcl.u.data.pointer = compat_ptr(iwp_compat->pointer);
++ iwr_lcl.u.data.length = iwp_compat->length;
++ iwr_lcl.u.data.flags = iwp_compat->flags;
++
++ ret = dev->netdev_ops->ndo_do_ioctl(dev, (void *) &iwr_lcl, cmd);
++
++ iwp_compat->pointer = ptr_to_compat(iwr_lcl.u.data.pointer);
++ iwp_compat->length = iwr_lcl.u.data.length;
++ iwp_compat->flags = iwr_lcl.u.data.flags;
++
++ return ret;
++ } else
++#endif
++ return dev->netdev_ops->ndo_do_ioctl(dev, ifr, cmd);
++ }
+ return -EOPNOTSUPP;
+ }
+
+diff --git a/scripts/mod/file2alias.c b/scripts/mod/file2alias.c
+index e614ef689eee..268acec72c4f 100644
+--- a/scripts/mod/file2alias.c
++++ b/scripts/mod/file2alias.c
+@@ -653,7 +653,7 @@ static int do_of_entry (const char *filename, void *symval, char *alias)
+ len = sprintf(alias, "of:N%sT%s", (*name)[0] ? *name : "*",
+ (*type)[0] ? *type : "*");
+
+- if (compatible[0])
++ if ((*compatible)[0])
+ sprintf(&alias[len], "%sC%s", (*type)[0] ? "*" : "",
+ *compatible);
+
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 4a69d6f1b8ef..5b2c7fe0ac85 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -5641,6 +5641,10 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = {
+ {0x17, 0x40000000},
+ {0x1d, 0x40700001},
+ {0x21, 0x02211040}),
++ SND_HDA_PIN_QUIRK(0x10ec0255, 0x1028, "Dell Inspiron 5565", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
++ {0x12, 0x90a60180},
++ {0x14, 0x90170120},
++ {0x21, 0x02211030}),
+ SND_HDA_PIN_QUIRK(0x10ec0256, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
+ ALC256_STANDARD_PINS,
+ {0x13, 0x40000000}),
+diff --git a/virt/kvm/irqchip.c b/virt/kvm/irqchip.c
+index 7f256f31df10..da39ee32005f 100644
+--- a/virt/kvm/irqchip.c
++++ b/virt/kvm/irqchip.c
+@@ -51,7 +51,7 @@ int kvm_irq_map_gsi(struct kvm *kvm,
+
+ irq_rt = srcu_dereference_check(kvm->irq_routing, &kvm->irq_srcu,
+ lockdep_is_held(&kvm->irq_lock));
+- if (gsi < irq_rt->nr_rt_entries) {
++ if (irq_rt && gsi < irq_rt->nr_rt_entries) {
+ hlist_for_each_entry(e, &irq_rt->map[gsi], link) {
+ entries[n] = *e;
+ ++n;
^ permalink raw reply related [flat|nested] 67+ messages in thread
* [gentoo-commits] proj/linux-patches:3.18 commit in: /
@ 2016-07-01 20:50 Mike Pagano
0 siblings, 0 replies; 67+ messages in thread
From: Mike Pagano @ 2016-07-01 20:50 UTC (permalink / raw
To: gentoo-commits
commit: 8f00680e929b129178c148c4e9eb119d644d2924
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Fri Jul 1 20:49:58 2016 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Fri Jul 1 20:49:58 2016 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=8f00680e
Update gcc 4.9+ optimization patch. Bug #587578
...-additional-cpu-optimizations-for-gcc-4.9.patch | 90 ++++++++++++++--------
1 file changed, 57 insertions(+), 33 deletions(-)
diff --git a/5010_enable-additional-cpu-optimizations-for-gcc-4.9.patch b/5010_enable-additional-cpu-optimizations-for-gcc-4.9.patch
index c4efd06..d9729b2 100644
--- a/5010_enable-additional-cpu-optimizations-for-gcc-4.9.patch
+++ b/5010_enable-additional-cpu-optimizations-for-gcc-4.9.patch
@@ -21,11 +21,12 @@ bug report to see if I'm right: https://bugzilla.kernel.org/show_bug.cgi?id=7746
This patch will expand the number of microarchitectures to include newer
processors including: AMD K10-family, AMD Family 10h (Barcelona), AMD Family
14h (Bobcat), AMD Family 15h (Bulldozer), AMD Family 15h (Piledriver), AMD
-Family 16h (Jaguar), Intel 1st Gen Core i3/i5/i7 (Nehalem), Intel 1.5 Gen Core
-i3/i5/i7 (Westmere), Intel 2nd Gen Core i3/i5/i7 (Sandybridge), Intel 3rd Gen
-Core i3/i5/i7 (Ivybridge), Intel 4th Gen Core i3/i5/i7 (Haswell), Intel 5th
-Gen Core i3/i5/i7 (Broadwell), and the low power Silvermont series of Atom
-processors (Silvermont). It also offers the compiler the 'native' flag.
+Family 15h (Steamroller), Family 16h (Jaguar), Intel 1st Gen Core i3/i5/i7
+(Nehalem), Intel 1.5 Gen Core i3/i5/i7 (Westmere), Intel 2nd Gen Core i3/i5/i7
+(Sandybridge), Intel 3rd Gen Core i3/i5/i7 (Ivybridge), Intel 4th Gen Core
+i3/i5/i7 (Haswell), Intel 5th Gen Core i3/i5/i7 (Broadwell), and the low power
+Silvermont series of Atom processors (Silvermont). It also offers the compiler
+the 'native' flag.
Small but real speed increases are measurable using a make endpoint comparing
a generic kernel to one built with one of the respective microarchs.
@@ -37,9 +38,9 @@ REQUIREMENTS
linux version >=3.15
gcc version >=4.9
---- a/arch/x86/include/asm/module.h 2014-06-16 16:44:27.000000000 -0400
-+++ b/arch/x86/include/asm/module.h 2015-03-07 03:27:32.556672424 -0500
-@@ -15,6 +15,22 @@
+--- a/arch/x86/include/asm/module.h 2015-08-30 14:34:09.000000000 -0400
++++ b/arch/x86/include/asm/module.h 2015-11-06 14:18:24.234941036 -0500
+@@ -15,6 +15,24 @@
#define MODULE_PROC_FAMILY "586MMX "
#elif defined CONFIG_MCORE2
#define MODULE_PROC_FAMILY "CORE2 "
@@ -59,10 +60,12 @@ gcc version >=4.9
+#define MODULE_PROC_FAMILY "HASWELL "
+#elif defined CONFIG_MBROADWELL
+#define MODULE_PROC_FAMILY "BROADWELL "
++#elif defined CONFIG_MSKYLAKE
++#define MODULE_PROC_FAMILY "SKYLAKE "
#elif defined CONFIG_MATOM
#define MODULE_PROC_FAMILY "ATOM "
#elif defined CONFIG_M686
-@@ -33,6 +49,20 @@
+@@ -33,6 +51,22 @@
#define MODULE_PROC_FAMILY "K7 "
#elif defined CONFIG_MK8
#define MODULE_PROC_FAMILY "K8 "
@@ -77,14 +80,16 @@ gcc version >=4.9
+#elif defined CONFIG_MBULLDOZER
+#define MODULE_PROC_FAMILY "BULLDOZER "
+#elif defined CONFIG_MPILEDRIVER
++#define MODULE_PROC_FAMILY "STEAMROLLER "
++#elif defined CONFIG_MSTEAMROLLER
+#define MODULE_PROC_FAMILY "PILEDRIVER "
+#elif defined CONFIG_MJAGUAR
+#define MODULE_PROC_FAMILY "JAGUAR "
#elif defined CONFIG_MELAN
#define MODULE_PROC_FAMILY "ELAN "
#elif defined CONFIG_MCRUSOE
---- a/arch/x86/Kconfig.cpu 2014-06-16 16:44:27.000000000 -0400
-+++ b/arch/x86/Kconfig.cpu 2015-03-07 03:32:14.337713226 -0500
+--- a/arch/x86/Kconfig.cpu 2015-08-30 14:34:09.000000000 -0400
++++ b/arch/x86/Kconfig.cpu 2015-11-06 14:20:14.948369244 -0500
@@ -137,9 +137,8 @@ config MPENTIUM4
-Paxville
-Dempsey
@@ -105,7 +110,7 @@ gcc version >=4.9
depends on X86_32
---help---
Select this for an AMD Athlon K7-family processor. Enables use of
-@@ -155,12 +154,62 @@ config MK7
+@@ -155,12 +154,69 @@ config MK7
flags to GCC.
config MK8
@@ -159,6 +164,13 @@ gcc version >=4.9
+
+ Enables -march=bdver2
+
++config MSTEAMROLLER
++ bool "AMD Steamroller"
++ ---help---
++ Select this for AMD Steamroller processors.
++
++ Enables -march=bdver3
++
+config MJAGUAR
+ bool "AMD Jaguar"
+ ---help---
@@ -169,7 +181,7 @@ gcc version >=4.9
config MCRUSOE
bool "Crusoe"
depends on X86_32
-@@ -251,8 +300,17 @@ config MPSC
+@@ -251,8 +307,17 @@ config MPSC
using the cpu family field
in /proc/cpuinfo. Family 15 is an older Xeon, Family 6 a newer one.
@@ -188,7 +200,7 @@ gcc version >=4.9
---help---
Select this for Intel Core 2 and newer Core 2 Xeons (Xeon 51xx and
-@@ -260,14 +318,63 @@ config MCORE2
+@@ -260,14 +325,71 @@ config MCORE2
family in /proc/cpuinfo. Newer ones have 6 and older ones 15
(not a typo)
@@ -255,10 +267,18 @@ gcc version >=4.9
+ Select this for 5th Gen Core processors in the Broadwell family.
+
+ Enables -march=broadwell
++
++config MSKYLAKE
++ bool "Intel Skylake"
++ ---help---
++
++ Select this for 6th Gen Core processors in the Skylake family.
++
++ Enables -march=skylake
config GENERIC_CPU
bool "Generic-x86-64"
-@@ -276,6 +383,19 @@ config GENERIC_CPU
+@@ -276,6 +398,19 @@ config GENERIC_CPU
Generic x86-64 CPU.
Run equally well on all x86-64 CPUs.
@@ -278,54 +298,54 @@ gcc version >=4.9
endchoice
config X86_GENERIC
-@@ -300,7 +420,7 @@ config X86_INTERNODE_CACHE_SHIFT
+@@ -300,7 +435,7 @@ config X86_INTERNODE_CACHE_SHIFT
config X86_L1_CACHE_SHIFT
int
default "7" if MPENTIUM4 || MPSC
- default "6" if MK7 || MK8 || MPENTIUMM || MCORE2 || MATOM || MVIAC7 || X86_GENERIC || GENERIC_CPU
-+ default "6" if MK7 || MK8 || MK8SSE3 || MK10 || MBARCELONA || MBOBCAT || MBULLDOZER || MPILEDRIVER || MJAGUAR || MPENTIUMM || MCORE2 || MNEHALEM || MWESTMERE || MSILVERMONT || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || BROADWELL || MNATIVE || MATOM || MVIAC7 || X86_GENERIC || GENERIC_CPU
++ default "6" if MK7 || MK8 || MK8SSE3 || MK10 || MBARCELONA || MBOBCAT || MBULLDOZER || MPILEDRIVER || MSTEAMROLLER || MJAGUAR || MPENTIUMM || MCORE2 || MNEHALEM || MWESTMERE || MSILVERMONT || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || MBROADWELL || MSKYLAKE || MNATIVE || MATOM || MVIAC7 || X86_GENERIC || GENERIC_CPU
default "4" if MELAN || M486 || MGEODEGX1
default "5" if MWINCHIP3D || MWINCHIPC6 || MCRUSOE || MEFFICEON || MCYRIXIII || MK6 || MPENTIUMIII || MPENTIUMII || M686 || M586MMX || M586TSC || M586 || MVIAC3_2 || MGEODE_LX
-@@ -331,11 +451,11 @@ config X86_ALIGNMENT_16
+@@ -331,11 +466,11 @@ config X86_ALIGNMENT_16
config X86_INTEL_USERCOPY
def_bool y
- depends on MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M586MMX || X86_GENERIC || MK8 || MK7 || MEFFICEON || MCORE2
-+ depends on MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M586MMX || X86_GENERIC || MK8 || MK8SSE3 || MK7 || MEFFICEON || MCORE2 || MK10 || MBARCELONA || MNEHALEM || MWESTMERE || MSILVERMONT || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || MBROADWELL || MNATIVE
++ depends on MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M586MMX || X86_GENERIC || MK8 || MK8SSE3 || MK7 || MEFFICEON || MCORE2 || MK10 || MBARCELONA || MNEHALEM || MWESTMERE || MSILVERMONT || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || MBROADWELL || MSKYLAKE || MNATIVE
config X86_USE_PPRO_CHECKSUM
def_bool y
- depends on MWINCHIP3D || MWINCHIPC6 || MCYRIXIII || MK7 || MK6 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MK8 || MVIAC3_2 || MVIAC7 || MEFFICEON || MGEODE_LX || MCORE2 || MATOM
-+ depends on MWINCHIP3D || MWINCHIPC6 || MCYRIXIII || MK7 || MK6 || MK10 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MK8 || MK8SSE3 || MVIAC3_2 || MVIAC7 || MEFFICEON || MGEODE_LX || MCORE2 || MNEHALEM || MWESTMERE || MSILVERMONT || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || MBROADWELL || MATOM || MNATIVE
++ depends on MWINCHIP3D || MWINCHIPC6 || MCYRIXIII || MK7 || MK6 || MK10 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MK8 || MK8SSE3 || MVIAC3_2 || MVIAC7 || MEFFICEON || MGEODE_LX || MCORE2 || MNEHALEM || MWESTMERE || MSILVERMONT || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || MBROADWELL || MSKYLAKE || MATOM || MNATIVE
config X86_USE_3DNOW
def_bool y
-@@ -359,17 +479,17 @@ config X86_P6_NOP
+@@ -359,17 +494,17 @@ config X86_P6_NOP
config X86_TSC
def_bool y
- depends on (MWINCHIP3D || MCRUSOE || MEFFICEON || MCYRIXIII || MK7 || MK6 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || M586MMX || M586TSC || MK8 || MVIAC3_2 || MVIAC7 || MGEODEGX1 || MGEODE_LX || MCORE2 || MATOM) || X86_64
-+ depends on (MWINCHIP3D || MCRUSOE || MEFFICEON || MCYRIXIII || MK7 || MK6 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || M586MMX || M586TSC || MK8 || MK8SSE3 || MVIAC3_2 || MVIAC7 || MGEODEGX1 || MGEODE_LX || MCORE2 || MNEHALEM || MWESTMERE || MSILVERMONT || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || MBROADWELL || MNATIVE || MATOM) || X86_64
++ depends on (MWINCHIP3D || MCRUSOE || MEFFICEON || MCYRIXIII || MK7 || MK6 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || M586MMX || M586TSC || MK8 || MK8SSE3 || MVIAC3_2 || MVIAC7 || MGEODEGX1 || MGEODE_LX || MCORE2 || MNEHALEM || MWESTMERE || MSILVERMONT || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || MBROADWELL || MSKYLAKE || MNATIVE || MATOM) || X86_64
config X86_CMPXCHG64
def_bool y
- depends on X86_PAE || X86_64 || MCORE2 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MATOM
-+ depends on X86_PAE || X86_64 || MCORE2 || MNEHALEM || MWESTMERE || MSILVERMONT || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || MBROADWELL || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MATOM || MNATIVE
++ depends on X86_PAE || X86_64 || MCORE2 || MNEHALEM || MWESTMERE || MSILVERMONT || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || MBROADWELL || MSKYLAKE || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MATOM || MNATIVE
# this should be set for all -march=.. options where the compiler
# generates cmov.
config X86_CMOV
def_bool y
- depends on (MK8 || MK7 || MCORE2 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MVIAC3_2 || MVIAC7 || MCRUSOE || MEFFICEON || X86_64 || MATOM || MGEODE_LX)
-+ depends on (MK8 || MK8SSE3 || MK10 || MBARCELONA || MBOBCAT || MBULLDOZER || MPILEDRIVER || MJAGUAR || MK7 || MCORE2 || MNEHALEM || MWESTMERE || MSILVERMONT || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || MBROADWELL || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MVIAC3_2 || MVIAC7 || MCRUSOE || MEFFICEON || X86_64 || MNATIVE || MATOM || MGEODE_LX)
++ depends on (MK8 || MK8SSE3 || MK10 || MBARCELONA || MBOBCAT || MBULLDOZER || MPILEDRIVER || MSTEAMROLLER || MJAGUAR || MK7 || MCORE2 || MNEHALEM || MWESTMERE || MSILVERMONT || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || MBROADWELL || MSKYLAKE || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MVIAC3_2 || MVIAC7 || MCRUSOE || MEFFICEON || X86_64 || MNATIVE || MATOM || MGEODE_LX)
config X86_MINIMUM_CPU_FAMILY
int
---- a/arch/x86/Makefile 2014-06-16 16:44:27.000000000 -0400
-+++ b/arch/x86/Makefile 2015-03-07 03:33:27.650843211 -0500
-@@ -92,13 +92,35 @@ else
- KBUILD_CFLAGS += $(call cc-option,-mpreferred-stack-boundary=3)
+--- a/arch/x86/Makefile 2015-08-30 14:34:09.000000000 -0400
++++ b/arch/x86/Makefile 2015-11-06 14:21:05.708983344 -0500
+@@ -94,13 +94,38 @@ else
+ KBUILD_CFLAGS += $(call cc-option,-mskip-rax-setup)
# FIXME - should be integrated in Makefile.cpu (Makefile_32.cpu)
+ cflags-$(CONFIG_MNATIVE) += $(call cc-option,-march=native)
@@ -336,6 +356,7 @@ gcc version >=4.9
+ cflags-$(CONFIG_MBOBCAT) += $(call cc-option,-march=btver1)
+ cflags-$(CONFIG_MBULLDOZER) += $(call cc-option,-march=bdver1)
+ cflags-$(CONFIG_MPILEDRIVER) += $(call cc-option,-march=bdver2)
++ cflags-$(CONFIG_MSTEAMROLLER) += $(call cc-option,-march=bdver3)
+ cflags-$(CONFIG_MJAGUAR) += $(call cc-option,-march=btver2)
cflags-$(CONFIG_MPSC) += $(call cc-option,-march=nocona)
@@ -358,14 +379,16 @@ gcc version >=4.9
+ $(call cc-option,-march=haswell,$(call cc-option,-mtune=haswell))
+ cflags-$(CONFIG_MBROADWELL) += \
+ $(call cc-option,-march=broadwell,$(call cc-option,-mtune=broadwell))
++ cflags-$(CONFIG_MSKYLAKE) += \
++ $(call cc-option,-march=skylake,$(call cc-option,-mtune=skylake))
+ cflags-$(CONFIG_MATOM) += $(call cc-option,-march=bonnell) \
+ $(call cc-option,-mtune=bonnell,$(call cc-option,-mtune=generic))
cflags-$(CONFIG_GENERIC_CPU) += $(call cc-option,-mtune=generic)
KBUILD_CFLAGS += $(cflags-y)
---- a/arch/x86/Makefile_32.cpu 2014-06-16 16:44:27.000000000 -0400
-+++ b/arch/x86/Makefile_32.cpu 2015-03-07 03:34:15.203586024 -0500
-@@ -23,7 +23,15 @@ cflags-$(CONFIG_MK6) += -march=k6
+--- a/arch/x86/Makefile_32.cpu 2015-08-30 14:34:09.000000000 -0400
++++ b/arch/x86/Makefile_32.cpu 2015-11-06 14:21:43.604429077 -0500
+@@ -23,7 +23,16 @@ cflags-$(CONFIG_MK6) += -march=k6
# Please note, that patches that add -march=athlon-xp and friends are pointless.
# They make zero difference whatsosever to performance at this time.
cflags-$(CONFIG_MK7) += -march=athlon
@@ -377,11 +400,12 @@ gcc version >=4.9
+cflags-$(CONFIG_MBOBCAT) += $(call cc-option,-march=btver1,-march=athlon)
+cflags-$(CONFIG_MBULLDOZER) += $(call cc-option,-march=bdver1,-march=athlon)
+cflags-$(CONFIG_MPILEDRIVER) += $(call cc-option,-march=bdver2,-march=athlon)
++cflags-$(CONFIG_MSTEAMROLLER) += $(call cc-option,-march=bdver3,-march=athlon)
+cflags-$(CONFIG_MJAGUAR) += $(call cc-option,-march=btver2,-march=athlon)
cflags-$(CONFIG_MCRUSOE) += -march=i686 $(align)-functions=0 $(align)-jumps=0 $(align)-loops=0
cflags-$(CONFIG_MEFFICEON) += -march=i686 $(call tune,pentium3) $(align)-functions=0 $(align)-jumps=0 $(align)-loops=0
cflags-$(CONFIG_MWINCHIPC6) += $(call cc-option,-march=winchip-c6,-march=i586)
-@@ -32,8 +40,15 @@ cflags-$(CONFIG_MCYRIXIII) += $(call cc-
+@@ -32,8 +41,16 @@ cflags-$(CONFIG_MCYRIXIII) += $(call cc-
cflags-$(CONFIG_MVIAC3_2) += $(call cc-option,-march=c3-2,-march=i686)
cflags-$(CONFIG_MVIAC7) += -march=i686
cflags-$(CONFIG_MCORE2) += -march=i686 $(call tune,core2)
@@ -394,9 +418,9 @@ gcc version >=4.9
+cflags-$(CONFIG_MIVYBRIDGE) += -march=i686 $(call tune,ivybridge)
+cflags-$(CONFIG_MHASWELL) += -march=i686 $(call tune,haswell)
+cflags-$(CONFIG_MBROADWELL) += -march=i686 $(call tune,broadwell)
++cflags-$(CONFIG_MSKYLAKE) += -march=i686 $(call tune,skylake)
+cflags-$(CONFIG_MATOM) += $(call cc-option,-march=bonnell,$(call cc-option,-march=core2,-march=i686)) \
+ $(call cc-option,-mtune=bonnell,$(call cc-option,-mtune=generic))
# AMD Elan support
cflags-$(CONFIG_MELAN) += -march=i486
-
^ permalink raw reply related [flat|nested] 67+ messages in thread
* [gentoo-commits] proj/linux-patches:3.18 commit in: /
@ 2016-07-13 23:28 Mike Pagano
0 siblings, 0 replies; 67+ messages in thread
From: Mike Pagano @ 2016-07-13 23:28 UTC (permalink / raw
To: gentoo-commits
commit: 51038750b9ff426c91ecb93374c72e1b8438e3e7
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed Jul 13 23:28:24 2016 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed Jul 13 23:28:24 2016 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=51038750
Linux patch 3.18.37
0000_README | 4 +
1036_linux-3.18.37.patch | 11191 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 11195 insertions(+)
diff --git a/0000_README b/0000_README
index fcefa63..1863a89 100644
--- a/0000_README
+++ b/0000_README
@@ -187,6 +187,10 @@ Patch: 1035_linux-3.18.36.patch
From: http://www.kernel.org
Desc: Linux 3.18.36
+Patch: 1036_linux-3.18.37.patch
+From: http://www.kernel.org
+Desc: Linux 3.18.37
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1036_linux-3.18.37.patch b/1036_linux-3.18.37.patch
new file mode 100644
index 0000000..40419a5
--- /dev/null
+++ b/1036_linux-3.18.37.patch
@@ -0,0 +1,11191 @@
+diff --git a/Documentation/scsi/scsi_eh.txt b/Documentation/scsi/scsi_eh.txt
+index a0c85110a07e..689ab9b9953a 100644
+--- a/Documentation/scsi/scsi_eh.txt
++++ b/Documentation/scsi/scsi_eh.txt
+@@ -263,19 +263,23 @@ scmd->allowed.
+
+ 3. scmd recovered
+ ACTION: scsi_eh_finish_cmd() is invoked to EH-finish scmd
+- - shost->host_failed--
+ - clear scmd->eh_eflags
+ - scsi_setup_cmd_retry()
+ - move from local eh_work_q to local eh_done_q
+ LOCKING: none
++ CONCURRENCY: at most one thread per separate eh_work_q to
++ keep queue manipulation lockless
+
+ 4. EH completes
+ ACTION: scsi_eh_flush_done_q() retries scmds or notifies upper
+- layer of failure.
++ layer of failure. May be called concurrently but must have
++ a no more than one thread per separate eh_work_q to
++ manipulate the queue locklessly
+ - scmd is removed from eh_done_q and scmd->eh_entry is cleared
+ - if retry is necessary, scmd is requeued using
+ scsi_queue_insert()
+ - otherwise, scsi_finish_command() is invoked for scmd
++ - zero shost->host_failed
+ LOCKING: queue or finish function performs appropriate locking
+
+
+diff --git a/Documentation/sysctl/fs.txt b/Documentation/sysctl/fs.txt
+index 88152f214f48..302b5ed616a6 100644
+--- a/Documentation/sysctl/fs.txt
++++ b/Documentation/sysctl/fs.txt
+@@ -32,6 +32,8 @@ Currently, these files are in /proc/sys/fs:
+ - nr_open
+ - overflowuid
+ - overflowgid
++- pipe-user-pages-hard
++- pipe-user-pages-soft
+ - protected_hardlinks
+ - protected_symlinks
+ - suid_dumpable
+@@ -159,6 +161,27 @@ The default is 65534.
+
+ ==============================================================
+
++pipe-user-pages-hard:
++
++Maximum total number of pages a non-privileged user may allocate for pipes.
++Once this limit is reached, no new pipes may be allocated until usage goes
++below the limit again. When set to 0, no limit is applied, which is the default
++setting.
++
++==============================================================
++
++pipe-user-pages-soft:
++
++Maximum total number of pages a non-privileged user may allocate for pipes
++before the pipe size gets limited to a single page. Once this limit is reached,
++new pipes will be limited to a single page in size for this user in order to
++limit total memory usage, and trying to increase them using fcntl() will be
++denied until usage goes below the limit again. The default value allows to
++allocate up to 1024 pipes at their default size. When set to 0, no limit is
++applied.
++
++==============================================================
++
+ protected_hardlinks:
+
+ A long-standing class of security issues is the hardlink-based
+diff --git a/Makefile b/Makefile
+index 497f437efebf..e6953a43fe64 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 18
+-SUBLEVEL = 36
++SUBLEVEL = 37
+ EXTRAVERSION =
+ NAME = Diseased Newt
+
+diff --git a/arch/arc/Makefile b/arch/arc/Makefile
+index 10bc3d4e8a44..dada919aba27 100644
+--- a/arch/arc/Makefile
++++ b/arch/arc/Makefile
+@@ -34,7 +34,6 @@ cflags-$(atleast_gcc44) += -fsection-anchors
+ cflags-$(CONFIG_ARC_HAS_LLSC) += -mlock
+ cflags-$(CONFIG_ARC_HAS_SWAPE) += -mswape
+ cflags-$(CONFIG_ARC_HAS_RTSC) += -mrtsc
+-cflags-$(CONFIG_ARC_DW2_UNWIND) += -fasynchronous-unwind-tables
+
+ # By default gcc 4.8 generates dwarf4 which kernel unwinder can't grok
+ ifeq ($(atleast_gcc48),y)
+diff --git a/arch/arc/kernel/stacktrace.c b/arch/arc/kernel/stacktrace.c
+index fb98769b6a98..3e349aefdb9e 100644
+--- a/arch/arc/kernel/stacktrace.c
++++ b/arch/arc/kernel/stacktrace.c
+@@ -131,7 +131,7 @@ arc_unwind_core(struct task_struct *tsk, struct pt_regs *regs,
+ * prelogue is setup (callee regs saved and then fp set and not other
+ * way around
+ */
+- pr_warn("CONFIG_ARC_DW2_UNWIND needs to be enabled\n");
++ pr_warn_once("CONFIG_ARC_DW2_UNWIND needs to be enabled\n");
+ return 0;
+
+ #endif
+diff --git a/arch/arm/include/asm/pgtable-2level.h b/arch/arm/include/asm/pgtable-2level.h
+index f0279411847d..67a251a815f1 100644
+--- a/arch/arm/include/asm/pgtable-2level.h
++++ b/arch/arm/include/asm/pgtable-2level.h
+@@ -163,6 +163,7 @@ static inline pmd_t *pmd_offset(pud_t *pud, unsigned long addr)
+
+ #define pmd_large(pmd) (pmd_val(pmd) & 2)
+ #define pmd_bad(pmd) (pmd_val(pmd) & 2)
++#define pmd_present(pmd) (pmd_val(pmd))
+
+ #define copy_pmd(pmdpd,pmdps) \
+ do { \
+diff --git a/arch/arm/include/asm/pgtable-3level.h b/arch/arm/include/asm/pgtable-3level.h
+index a31ecdad4b59..b5ef8c7c6220 100644
+--- a/arch/arm/include/asm/pgtable-3level.h
++++ b/arch/arm/include/asm/pgtable-3level.h
+@@ -212,6 +212,7 @@ static inline pmd_t *pmd_offset(pud_t *pud, unsigned long addr)
+ : !!(pmd_val(pmd) & (val)))
+ #define pmd_isclear(pmd, val) (!(pmd_val(pmd) & (val)))
+
++#define pmd_present(pmd) (pmd_isset((pmd), L_PMD_SECT_VALID))
+ #define pmd_young(pmd) (pmd_isset((pmd), PMD_SECT_AF))
+ #define pte_special(pte) (pte_isset((pte), L_PTE_SPECIAL))
+ static inline pte_t pte_mkspecial(pte_t pte)
+@@ -257,8 +258,11 @@ PMD_BIT_FUNC(mkyoung, |= PMD_SECT_AF);
+ #define pfn_pmd(pfn,prot) (__pmd(((phys_addr_t)(pfn) << PAGE_SHIFT) | pgprot_val(prot)))
+ #define mk_pmd(page,prot) pfn_pmd(page_to_pfn(page),prot)
+
+-/* represent a notpresent pmd by zero, this is used by pmdp_invalidate */
+-#define pmd_mknotpresent(pmd) (__pmd(0))
++/* represent a notpresent pmd by faulting entry, this is used by pmdp_invalidate */
++static inline pmd_t pmd_mknotpresent(pmd_t pmd)
++{
++ return __pmd(pmd_val(pmd) & ~L_PMD_SECT_VALID);
++}
+
+ static inline pmd_t pmd_modify(pmd_t pmd, pgprot_t newprot)
+ {
+diff --git a/arch/arm/include/asm/pgtable.h b/arch/arm/include/asm/pgtable.h
+index 3b30062975b2..e42bbd9ec427 100644
+--- a/arch/arm/include/asm/pgtable.h
++++ b/arch/arm/include/asm/pgtable.h
+@@ -182,7 +182,6 @@ extern pgd_t swapper_pg_dir[PTRS_PER_PGD];
+ #define pgd_offset_k(addr) pgd_offset(&init_mm, addr)
+
+ #define pmd_none(pmd) (!pmd_val(pmd))
+-#define pmd_present(pmd) (pmd_val(pmd))
+
+ static inline pte_t *pmd_page_vaddr(pmd_t pmd)
+ {
+diff --git a/arch/arm/kvm/arm.c b/arch/arm/kvm/arm.c
+index ed5834e8e2ac..e8193b987313 100644
+--- a/arch/arm/kvm/arm.c
++++ b/arch/arm/kvm/arm.c
+@@ -251,6 +251,7 @@ void kvm_arch_vcpu_free(struct kvm_vcpu *vcpu)
+ kvm_mmu_free_memory_caches(vcpu);
+ kvm_timer_vcpu_terminate(vcpu);
+ kvm_vgic_vcpu_destroy(vcpu);
++ kvm_vcpu_uninit(vcpu);
+ kmem_cache_free(kvm_vcpu_cache, vcpu);
+ }
+
+diff --git a/arch/arm/mach-omap2/cpuidle34xx.c b/arch/arm/mach-omap2/cpuidle34xx.c
+index e18709d3b95d..38e1bdcaf015 100644
+--- a/arch/arm/mach-omap2/cpuidle34xx.c
++++ b/arch/arm/mach-omap2/cpuidle34xx.c
+@@ -34,6 +34,7 @@
+ #include "pm.h"
+ #include "control.h"
+ #include "common.h"
++#include "soc.h"
+
+ /* Mach specific information to be recorded in the C-state driver_data */
+ struct omap3_idle_statedata {
+@@ -322,6 +323,69 @@ static struct cpuidle_driver omap3_idle_driver = {
+ .safe_state_index = 0,
+ };
+
++/*
++ * Numbers based on measurements made in October 2009 for PM optimized kernel
++ * with CPU freq enabled on device Nokia N900. Assumes OPP2 (main idle OPP,
++ * and worst case latencies).
++ */
++static struct cpuidle_driver omap3430_idle_driver = {
++ .name = "omap3430_idle",
++ .owner = THIS_MODULE,
++ .states = {
++ {
++ .enter = omap3_enter_idle_bm,
++ .exit_latency = 110 + 162,
++ .target_residency = 5,
++ .name = "C1",
++ .desc = "MPU ON + CORE ON",
++ },
++ {
++ .enter = omap3_enter_idle_bm,
++ .exit_latency = 106 + 180,
++ .target_residency = 309,
++ .name = "C2",
++ .desc = "MPU ON + CORE ON",
++ },
++ {
++ .enter = omap3_enter_idle_bm,
++ .exit_latency = 107 + 410,
++ .target_residency = 46057,
++ .name = "C3",
++ .desc = "MPU RET + CORE ON",
++ },
++ {
++ .enter = omap3_enter_idle_bm,
++ .exit_latency = 121 + 3374,
++ .target_residency = 46057,
++ .name = "C4",
++ .desc = "MPU OFF + CORE ON",
++ },
++ {
++ .enter = omap3_enter_idle_bm,
++ .exit_latency = 855 + 1146,
++ .target_residency = 46057,
++ .name = "C5",
++ .desc = "MPU RET + CORE RET",
++ },
++ {
++ .enter = omap3_enter_idle_bm,
++ .exit_latency = 7580 + 4134,
++ .target_residency = 484329,
++ .name = "C6",
++ .desc = "MPU OFF + CORE RET",
++ },
++ {
++ .enter = omap3_enter_idle_bm,
++ .exit_latency = 7505 + 15274,
++ .target_residency = 484329,
++ .name = "C7",
++ .desc = "MPU OFF + CORE OFF",
++ },
++ },
++ .state_count = ARRAY_SIZE(omap3_idle_data),
++ .safe_state_index = 0,
++};
++
+ /* Public functions */
+
+ /**
+@@ -340,5 +404,8 @@ int __init omap3_idle_init(void)
+ if (!mpu_pd || !core_pd || !per_pd || !cam_pd)
+ return -ENODEV;
+
+- return cpuidle_register(&omap3_idle_driver, NULL);
++ if (cpu_is_omap3430())
++ return cpuidle_register(&omap3430_idle_driver, NULL);
++ else
++ return cpuidle_register(&omap3_idle_driver, NULL);
+ }
+diff --git a/arch/arm/mach-s3c64xx/dev-audio.c b/arch/arm/mach-s3c64xx/dev-audio.c
+index ff780a8d8366..9a42736ef4ac 100644
+--- a/arch/arm/mach-s3c64xx/dev-audio.c
++++ b/arch/arm/mach-s3c64xx/dev-audio.c
+@@ -54,12 +54,12 @@ static int s3c64xx_i2s_cfg_gpio(struct platform_device *pdev)
+
+ static struct resource s3c64xx_iis0_resource[] = {
+ [0] = DEFINE_RES_MEM(S3C64XX_PA_IIS0, SZ_256),
+- [1] = DEFINE_RES_DMA(DMACH_I2S0_OUT),
+- [2] = DEFINE_RES_DMA(DMACH_I2S0_IN),
+ };
+
+-static struct s3c_audio_pdata i2sv3_pdata = {
++static struct s3c_audio_pdata i2s0_pdata = {
+ .cfg_gpio = s3c64xx_i2s_cfg_gpio,
++ .dma_playback = DMACH_I2S0_OUT,
++ .dma_capture = DMACH_I2S0_IN,
+ };
+
+ struct platform_device s3c64xx_device_iis0 = {
+@@ -68,15 +68,19 @@ struct platform_device s3c64xx_device_iis0 = {
+ .num_resources = ARRAY_SIZE(s3c64xx_iis0_resource),
+ .resource = s3c64xx_iis0_resource,
+ .dev = {
+- .platform_data = &i2sv3_pdata,
++ .platform_data = &i2s0_pdata,
+ },
+ };
+ EXPORT_SYMBOL(s3c64xx_device_iis0);
+
+ static struct resource s3c64xx_iis1_resource[] = {
+ [0] = DEFINE_RES_MEM(S3C64XX_PA_IIS1, SZ_256),
+- [1] = DEFINE_RES_DMA(DMACH_I2S1_OUT),
+- [2] = DEFINE_RES_DMA(DMACH_I2S1_IN),
++};
++
++static struct s3c_audio_pdata i2s1_pdata = {
++ .cfg_gpio = s3c64xx_i2s_cfg_gpio,
++ .dma_playback = DMACH_I2S1_OUT,
++ .dma_capture = DMACH_I2S1_IN,
+ };
+
+ struct platform_device s3c64xx_device_iis1 = {
+@@ -85,19 +89,19 @@ struct platform_device s3c64xx_device_iis1 = {
+ .num_resources = ARRAY_SIZE(s3c64xx_iis1_resource),
+ .resource = s3c64xx_iis1_resource,
+ .dev = {
+- .platform_data = &i2sv3_pdata,
++ .platform_data = &i2s1_pdata,
+ },
+ };
+ EXPORT_SYMBOL(s3c64xx_device_iis1);
+
+ static struct resource s3c64xx_iisv4_resource[] = {
+ [0] = DEFINE_RES_MEM(S3C64XX_PA_IISV4, SZ_256),
+- [1] = DEFINE_RES_DMA(DMACH_HSI_I2SV40_TX),
+- [2] = DEFINE_RES_DMA(DMACH_HSI_I2SV40_RX),
+ };
+
+ static struct s3c_audio_pdata i2sv4_pdata = {
+ .cfg_gpio = s3c64xx_i2s_cfg_gpio,
++ .dma_playback = DMACH_HSI_I2SV40_TX,
++ .dma_capture = DMACH_HSI_I2SV40_RX,
+ .type = {
+ .i2s = {
+ .quirks = QUIRK_PRI_6CHAN,
+@@ -142,12 +146,12 @@ static int s3c64xx_pcm_cfg_gpio(struct platform_device *pdev)
+
+ static struct resource s3c64xx_pcm0_resource[] = {
+ [0] = DEFINE_RES_MEM(S3C64XX_PA_PCM0, SZ_256),
+- [1] = DEFINE_RES_DMA(DMACH_PCM0_TX),
+- [2] = DEFINE_RES_DMA(DMACH_PCM0_RX),
+ };
+
+ static struct s3c_audio_pdata s3c_pcm0_pdata = {
+ .cfg_gpio = s3c64xx_pcm_cfg_gpio,
++ .dma_capture = DMACH_PCM0_RX,
++ .dma_playback = DMACH_PCM0_TX,
+ };
+
+ struct platform_device s3c64xx_device_pcm0 = {
+@@ -163,12 +167,12 @@ EXPORT_SYMBOL(s3c64xx_device_pcm0);
+
+ static struct resource s3c64xx_pcm1_resource[] = {
+ [0] = DEFINE_RES_MEM(S3C64XX_PA_PCM1, SZ_256),
+- [1] = DEFINE_RES_DMA(DMACH_PCM1_TX),
+- [2] = DEFINE_RES_DMA(DMACH_PCM1_RX),
+ };
+
+ static struct s3c_audio_pdata s3c_pcm1_pdata = {
+ .cfg_gpio = s3c64xx_pcm_cfg_gpio,
++ .dma_playback = DMACH_PCM1_TX,
++ .dma_capture = DMACH_PCM1_RX,
+ };
+
+ struct platform_device s3c64xx_device_pcm1 = {
+@@ -196,13 +200,14 @@ static int s3c64xx_ac97_cfg_gpe(struct platform_device *pdev)
+
+ static struct resource s3c64xx_ac97_resource[] = {
+ [0] = DEFINE_RES_MEM(S3C64XX_PA_AC97, SZ_256),
+- [1] = DEFINE_RES_DMA(DMACH_AC97_PCMOUT),
+- [2] = DEFINE_RES_DMA(DMACH_AC97_PCMIN),
+- [3] = DEFINE_RES_DMA(DMACH_AC97_MICIN),
+- [4] = DEFINE_RES_IRQ(IRQ_AC97),
++ [1] = DEFINE_RES_IRQ(IRQ_AC97),
+ };
+
+-static struct s3c_audio_pdata s3c_ac97_pdata;
++static struct s3c_audio_pdata s3c_ac97_pdata = {
++ .dma_playback = DMACH_AC97_PCMOUT,
++ .dma_capture = DMACH_AC97_PCMIN,
++ .dma_capture_mic = DMACH_AC97_MICIN,
++};
+
+ static u64 s3c64xx_ac97_dmamask = DMA_BIT_MASK(32);
+
+diff --git a/arch/arm/mach-s3c64xx/include/mach/dma.h b/arch/arm/mach-s3c64xx/include/mach/dma.h
+index 059b1fc85037..41a304803497 100644
+--- a/arch/arm/mach-s3c64xx/include/mach/dma.h
++++ b/arch/arm/mach-s3c64xx/include/mach/dma.h
+@@ -14,38 +14,38 @@
+ #define S3C64XX_DMA_CHAN(name) ((unsigned long)(name))
+
+ /* DMA0/SDMA0 */
+-#define DMACH_UART0 S3C64XX_DMA_CHAN("uart0_tx")
+-#define DMACH_UART0_SRC2 S3C64XX_DMA_CHAN("uart0_rx")
+-#define DMACH_UART1 S3C64XX_DMA_CHAN("uart1_tx")
+-#define DMACH_UART1_SRC2 S3C64XX_DMA_CHAN("uart1_rx")
+-#define DMACH_UART2 S3C64XX_DMA_CHAN("uart2_tx")
+-#define DMACH_UART2_SRC2 S3C64XX_DMA_CHAN("uart2_rx")
+-#define DMACH_UART3 S3C64XX_DMA_CHAN("uart3_tx")
+-#define DMACH_UART3_SRC2 S3C64XX_DMA_CHAN("uart3_rx")
+-#define DMACH_PCM0_TX S3C64XX_DMA_CHAN("pcm0_tx")
+-#define DMACH_PCM0_RX S3C64XX_DMA_CHAN("pcm0_rx")
+-#define DMACH_I2S0_OUT S3C64XX_DMA_CHAN("i2s0_tx")
+-#define DMACH_I2S0_IN S3C64XX_DMA_CHAN("i2s0_rx")
++#define DMACH_UART0 "uart0_tx"
++#define DMACH_UART0_SRC2 "uart0_rx"
++#define DMACH_UART1 "uart1_tx"
++#define DMACH_UART1_SRC2 "uart1_rx"
++#define DMACH_UART2 "uart2_tx"
++#define DMACH_UART2_SRC2 "uart2_rx"
++#define DMACH_UART3 "uart3_tx"
++#define DMACH_UART3_SRC2 "uart3_rx"
++#define DMACH_PCM0_TX "pcm0_tx"
++#define DMACH_PCM0_RX "pcm0_rx"
++#define DMACH_I2S0_OUT "i2s0_tx"
++#define DMACH_I2S0_IN "i2s0_rx"
+ #define DMACH_SPI0_TX S3C64XX_DMA_CHAN("spi0_tx")
+ #define DMACH_SPI0_RX S3C64XX_DMA_CHAN("spi0_rx")
+-#define DMACH_HSI_I2SV40_TX S3C64XX_DMA_CHAN("i2s2_tx")
+-#define DMACH_HSI_I2SV40_RX S3C64XX_DMA_CHAN("i2s2_rx")
++#define DMACH_HSI_I2SV40_TX "i2s2_tx"
++#define DMACH_HSI_I2SV40_RX "i2s2_rx"
+
+ /* DMA1/SDMA1 */
+-#define DMACH_PCM1_TX S3C64XX_DMA_CHAN("pcm1_tx")
+-#define DMACH_PCM1_RX S3C64XX_DMA_CHAN("pcm1_rx")
+-#define DMACH_I2S1_OUT S3C64XX_DMA_CHAN("i2s1_tx")
+-#define DMACH_I2S1_IN S3C64XX_DMA_CHAN("i2s1_rx")
++#define DMACH_PCM1_TX "pcm1_tx"
++#define DMACH_PCM1_RX "pcm1_rx"
++#define DMACH_I2S1_OUT "i2s1_tx"
++#define DMACH_I2S1_IN "i2s1_rx"
+ #define DMACH_SPI1_TX S3C64XX_DMA_CHAN("spi1_tx")
+ #define DMACH_SPI1_RX S3C64XX_DMA_CHAN("spi1_rx")
+-#define DMACH_AC97_PCMOUT S3C64XX_DMA_CHAN("ac97_out")
+-#define DMACH_AC97_PCMIN S3C64XX_DMA_CHAN("ac97_in")
+-#define DMACH_AC97_MICIN S3C64XX_DMA_CHAN("ac97_mic")
+-#define DMACH_PWM S3C64XX_DMA_CHAN("pwm")
+-#define DMACH_IRDA S3C64XX_DMA_CHAN("irda")
+-#define DMACH_EXTERNAL S3C64XX_DMA_CHAN("external")
+-#define DMACH_SECURITY_RX S3C64XX_DMA_CHAN("sec_rx")
+-#define DMACH_SECURITY_TX S3C64XX_DMA_CHAN("sec_tx")
++#define DMACH_AC97_PCMOUT "ac97_out"
++#define DMACH_AC97_PCMIN "ac97_in"
++#define DMACH_AC97_MICIN "ac97_mic"
++#define DMACH_PWM "pwm"
++#define DMACH_IRDA "irda"
++#define DMACH_EXTERNAL "external"
++#define DMACH_SECURITY_RX "sec_rx"
++#define DMACH_SECURITY_TX "sec_tx"
+
+ enum dma_ch {
+ DMACH_MAX = 32
+diff --git a/arch/arm/plat-samsung/devs.c b/arch/arm/plat-samsung/devs.c
+index 83c7d154bde0..8b67db8c1213 100644
+--- a/arch/arm/plat-samsung/devs.c
++++ b/arch/arm/plat-samsung/devs.c
+@@ -65,6 +65,7 @@
+ #include <linux/platform_data/usb-ohci-s3c2410.h>
+ #include <plat/usb-phy.h>
+ #include <plat/regs-spi.h>
++#include <linux/platform_data/asoc-s3c.h>
+ #include <linux/platform_data/spi-s3c64xx.h>
+
+ static u64 samsung_device_dma_mask = DMA_BIT_MASK(32);
+@@ -74,9 +75,12 @@ static u64 samsung_device_dma_mask = DMA_BIT_MASK(32);
+ static struct resource s3c_ac97_resource[] = {
+ [0] = DEFINE_RES_MEM(S3C2440_PA_AC97, S3C2440_SZ_AC97),
+ [1] = DEFINE_RES_IRQ(IRQ_S3C244X_AC97),
+- [2] = DEFINE_RES_DMA_NAMED(DMACH_PCM_OUT, "PCM out"),
+- [3] = DEFINE_RES_DMA_NAMED(DMACH_PCM_IN, "PCM in"),
+- [4] = DEFINE_RES_DMA_NAMED(DMACH_MIC_IN, "Mic in"),
++};
++
++static struct s3c_audio_pdata s3c_ac97_pdata = {
++ .dma_playback = (void *)DMACH_PCM_OUT,
++ .dma_capture = (void *)DMACH_PCM_IN,
++ .dma_capture_mic = (void *)DMACH_MIC_IN,
+ };
+
+ struct platform_device s3c_device_ac97 = {
+@@ -87,6 +91,7 @@ struct platform_device s3c_device_ac97 = {
+ .dev = {
+ .dma_mask = &samsung_device_dma_mask,
+ .coherent_dma_mask = DMA_BIT_MASK(32),
++ .platform_data = &s3c_ac97_pdata,
+ }
+ };
+ #endif /* CONFIG_CPU_S3C2440 */
+diff --git a/arch/arm64/kernel/pci.c b/arch/arm64/kernel/pci.c
+index ce5836c14ec1..6f93c24ca801 100644
+--- a/arch/arm64/kernel/pci.c
++++ b/arch/arm64/kernel/pci.c
+@@ -46,25 +46,3 @@ int pcibios_add_device(struct pci_dev *dev)
+
+ return 0;
+ }
+-
+-
+-#ifdef CONFIG_PCI_DOMAINS_GENERIC
+-static bool dt_domain_found = false;
+-
+-void pci_bus_assign_domain_nr(struct pci_bus *bus, struct device *parent)
+-{
+- int domain = of_get_pci_domain_nr(parent->of_node);
+-
+- if (domain >= 0) {
+- dt_domain_found = true;
+- } else if (dt_domain_found == true) {
+- dev_err(parent, "Node %s is missing \"linux,pci-domain\" property in DT\n",
+- parent->of_node->full_name);
+- return;
+- } else {
+- domain = pci_get_new_domain_nr();
+- }
+-
+- bus->domain_nr = domain;
+-}
+-#endif
+diff --git a/arch/arm64/mm/flush.c b/arch/arm64/mm/flush.c
+index b6f14e8d2121..bfb8eb168f2d 100644
+--- a/arch/arm64/mm/flush.c
++++ b/arch/arm64/mm/flush.c
+@@ -74,10 +74,6 @@ void __sync_icache_dcache(pte_t pte, unsigned long addr)
+ {
+ struct page *page = pte_page(pte);
+
+- /* no flushing needed for anonymous pages */
+- if (!page_mapping(page))
+- return;
+-
+ if (!test_and_set_bit(PG_dcache_clean, &page->flags)) {
+ __flush_dcache_area(page_address(page),
+ PAGE_SIZE << compound_order(page));
+diff --git a/arch/mips/include/asm/kvm_host.h b/arch/mips/include/asm/kvm_host.h
+index 1616b56eadfe..b369199d9f39 100644
+--- a/arch/mips/include/asm/kvm_host.h
++++ b/arch/mips/include/asm/kvm_host.h
+@@ -377,6 +377,7 @@ struct kvm_mips_tlb {
+ #define KVM_MIPS_GUEST_TLB_SIZE 64
+ struct kvm_vcpu_arch {
+ void *host_ebase, *guest_ebase;
++ int (*vcpu_run)(struct kvm_run *run, struct kvm_vcpu *vcpu);
+ unsigned long host_stack;
+ unsigned long host_gp;
+
+diff --git a/arch/mips/include/asm/processor.h b/arch/mips/include/asm/processor.h
+index f1df4cb4a286..578ece1e4a99 100644
+--- a/arch/mips/include/asm/processor.h
++++ b/arch/mips/include/asm/processor.h
+@@ -51,7 +51,7 @@ extern unsigned int vced_count, vcei_count;
+ * User space process size: 2GB. This is hardcoded into a few places,
+ * so don't change it unless you know what you are doing.
+ */
+-#define TASK_SIZE 0x7fff8000UL
++#define TASK_SIZE 0x80000000UL
+ #endif
+
+ #ifdef __KERNEL__
+diff --git a/arch/mips/kernel/setup.c b/arch/mips/kernel/setup.c
+index f3b635f86c39..2168355591f5 100644
+--- a/arch/mips/kernel/setup.c
++++ b/arch/mips/kernel/setup.c
+@@ -685,6 +685,9 @@ static void __init arch_mem_init(char **cmdline_p)
+ for_each_memblock(reserved, reg)
+ if (reg->size != 0)
+ reserve_bootmem(reg->base, reg->size, BOOTMEM_DEFAULT);
++
++ reserve_bootmem_region(__pa_symbol(&__nosave_begin),
++ __pa_symbol(&__nosave_end)); /* Reserve for hibernation */
+ }
+
+ static void __init resource_init(void)
+diff --git a/arch/mips/kvm/interrupt.h b/arch/mips/kvm/interrupt.h
+index 4ab4bdfad703..2143884709e4 100644
+--- a/arch/mips/kvm/interrupt.h
++++ b/arch/mips/kvm/interrupt.h
+@@ -28,6 +28,7 @@
+ #define MIPS_EXC_MAX 12
+ /* XXXSL More to follow */
+
++extern char __kvm_mips_vcpu_run_end[];
+ extern char mips32_exception[], mips32_exceptionEnd[];
+ extern char mips32_GuestException[], mips32_GuestExceptionEnd[];
+
+diff --git a/arch/mips/kvm/locore.S b/arch/mips/kvm/locore.S
+index 4a68b176d6e4..21c257579a06 100644
+--- a/arch/mips/kvm/locore.S
++++ b/arch/mips/kvm/locore.S
+@@ -231,6 +231,7 @@ FEXPORT(__kvm_mips_load_k0k1)
+
+ /* Jump to guest */
+ eret
++EXPORT(__kvm_mips_vcpu_run_end)
+
+ VECTOR(MIPSX(exception), unknown)
+ /* Find out what mode we came from and jump to the proper handler. */
+diff --git a/arch/mips/kvm/mips.c b/arch/mips/kvm/mips.c
+index a53eaf50c224..26059bf34b1a 100644
+--- a/arch/mips/kvm/mips.c
++++ b/arch/mips/kvm/mips.c
+@@ -306,6 +306,15 @@ struct kvm_vcpu *kvm_arch_vcpu_create(struct kvm *kvm, unsigned int id)
+ memcpy(gebase + offset, mips32_GuestException,
+ mips32_GuestExceptionEnd - mips32_GuestException);
+
++#ifdef MODULE
++ offset += mips32_GuestExceptionEnd - mips32_GuestException;
++ memcpy(gebase + offset, (char *)__kvm_mips_vcpu_run,
++ __kvm_mips_vcpu_run_end - (char *)__kvm_mips_vcpu_run);
++ vcpu->arch.vcpu_run = gebase + offset;
++#else
++ vcpu->arch.vcpu_run = __kvm_mips_vcpu_run;
++#endif
++
+ /* Invalidate the icache for these ranges */
+ local_flush_icache_range((unsigned long)gebase,
+ (unsigned long)gebase + ALIGN(size, PAGE_SIZE));
+@@ -392,7 +401,7 @@ int kvm_arch_vcpu_ioctl_run(struct kvm_vcpu *vcpu, struct kvm_run *run)
+ /* Disable hardware page table walking while in guest */
+ htw_stop();
+
+- r = __kvm_mips_vcpu_run(run, vcpu);
++ r = vcpu->arch.vcpu_run(run, vcpu);
+
+ /* Re-enable HTW before enabling interrupts */
+ htw_start();
+diff --git a/arch/powerpc/kernel/process.c b/arch/powerpc/kernel/process.c
+index 923cd2daba89..5d2ea3f90f72 100644
+--- a/arch/powerpc/kernel/process.c
++++ b/arch/powerpc/kernel/process.c
+@@ -1224,6 +1224,16 @@ void start_thread(struct pt_regs *regs, unsigned long start, unsigned long sp)
+ current->thread.regs = regs - 1;
+ }
+
++#ifdef CONFIG_PPC_TRANSACTIONAL_MEM
++ /*
++ * Clear any transactional state, we're exec()ing. The cause is
++ * not important as there will never be a recheckpoint so it's not
++ * user visible.
++ */
++ if (MSR_TM_SUSPENDED(mfmsr()))
++ tm_reclaim_current(0);
++#endif
++
+ memset(regs->gpr, 0, sizeof(regs->gpr));
+ regs->ctr = 0;
+ regs->link = 0;
+diff --git a/arch/powerpc/kernel/prom.c b/arch/powerpc/kernel/prom.c
+index d2804fd65c4b..7a218ab7e941 100644
+--- a/arch/powerpc/kernel/prom.c
++++ b/arch/powerpc/kernel/prom.c
+@@ -162,11 +162,12 @@ static struct ibm_pa_feature {
+ {0, MMU_FTR_CI_LARGE_PAGE, 0, 0, 1, 2, 0},
+ {CPU_FTR_REAL_LE, 0, PPC_FEATURE_TRUE_LE, 0, 5, 0, 0},
+ /*
+- * If the kernel doesn't support TM (ie. CONFIG_PPC_TRANSACTIONAL_MEM=n),
+- * we don't want to turn on CPU_FTR_TM here, so we use CPU_FTR_TM_COMP
+- * which is 0 if the kernel doesn't support TM.
++ * If the kernel doesn't support TM (ie CONFIG_PPC_TRANSACTIONAL_MEM=n),
++ * we don't want to turn on TM here, so we use the *_COMP versions
++ * which are 0 if the kernel doesn't support TM.
+ */
+- {CPU_FTR_TM_COMP, 0, 0, 0, 22, 0, 0},
++ {CPU_FTR_TM_COMP, 0, 0,
++ PPC_FEATURE2_HTM_COMP|PPC_FEATURE2_HTM_NOSC_COMP, 22, 0, 0},
+ };
+
+ static void __init scan_features(unsigned long node, const unsigned char *ftrs,
+diff --git a/arch/s390/kernel/ipl.c b/arch/s390/kernel/ipl.c
+index 39badb9ca0b3..f5ec05984364 100644
+--- a/arch/s390/kernel/ipl.c
++++ b/arch/s390/kernel/ipl.c
+@@ -2102,13 +2102,6 @@ void s390_reset_system(void (*func)(void *), void *data)
+ S390_lowcore.program_new_psw.addr =
+ PSW_ADDR_AMODE | (unsigned long) s390_base_pgm_handler;
+
+- /*
+- * Clear subchannel ID and number to signal new kernel that no CCW or
+- * SCSI IPL has been done (for kexec and kdump)
+- */
+- S390_lowcore.subchannel_id = 0;
+- S390_lowcore.subchannel_nr = 0;
+-
+ /* Store status at absolute zero */
+ store_status();
+
+diff --git a/arch/sparc/include/asm/head_64.h b/arch/sparc/include/asm/head_64.h
+index 10e9dabc4c41..f0700cfeedd7 100644
+--- a/arch/sparc/include/asm/head_64.h
++++ b/arch/sparc/include/asm/head_64.h
+@@ -15,6 +15,10 @@
+
+ #define PTREGS_OFF (STACK_BIAS + STACKFRAME_SZ)
+
++#define RTRAP_PSTATE (PSTATE_TSO|PSTATE_PEF|PSTATE_PRIV|PSTATE_IE)
++#define RTRAP_PSTATE_IRQOFF (PSTATE_TSO|PSTATE_PEF|PSTATE_PRIV)
++#define RTRAP_PSTATE_AG_IRQOFF (PSTATE_TSO|PSTATE_PEF|PSTATE_PRIV|PSTATE_AG)
++
+ #define __CHEETAH_ID 0x003e0014
+ #define __JALAPENO_ID 0x003e0016
+ #define __SERRANO_ID 0x003e0022
+diff --git a/arch/sparc/include/asm/ttable.h b/arch/sparc/include/asm/ttable.h
+index 71b5a67522ab..781b9f1dbdc2 100644
+--- a/arch/sparc/include/asm/ttable.h
++++ b/arch/sparc/include/asm/ttable.h
+@@ -589,8 +589,8 @@ user_rtt_fill_64bit: \
+ restored; \
+ nop; nop; nop; nop; nop; nop; \
+ nop; nop; nop; nop; nop; \
+- ba,a,pt %xcc, user_rtt_fill_fixup; \
+- ba,a,pt %xcc, user_rtt_fill_fixup; \
++ ba,a,pt %xcc, user_rtt_fill_fixup_dax; \
++ ba,a,pt %xcc, user_rtt_fill_fixup_mna; \
+ ba,a,pt %xcc, user_rtt_fill_fixup;
+
+
+@@ -652,8 +652,8 @@ user_rtt_fill_32bit: \
+ restored; \
+ nop; nop; nop; nop; nop; \
+ nop; nop; nop; \
+- ba,a,pt %xcc, user_rtt_fill_fixup; \
+- ba,a,pt %xcc, user_rtt_fill_fixup; \
++ ba,a,pt %xcc, user_rtt_fill_fixup_dax; \
++ ba,a,pt %xcc, user_rtt_fill_fixup_mna; \
+ ba,a,pt %xcc, user_rtt_fill_fixup;
+
+
+diff --git a/arch/sparc/kernel/Makefile b/arch/sparc/kernel/Makefile
+index 7cf9c6ea3f1f..fdb13327fded 100644
+--- a/arch/sparc/kernel/Makefile
++++ b/arch/sparc/kernel/Makefile
+@@ -21,6 +21,7 @@ CFLAGS_REMOVE_perf_event.o := -pg
+ CFLAGS_REMOVE_pcr.o := -pg
+ endif
+
++obj-$(CONFIG_SPARC64) += urtt_fill.o
+ obj-$(CONFIG_SPARC32) += entry.o wof.o wuf.o
+ obj-$(CONFIG_SPARC32) += etrap_32.o
+ obj-$(CONFIG_SPARC32) += rtrap_32.o
+diff --git a/arch/sparc/kernel/cherrs.S b/arch/sparc/kernel/cherrs.S
+index 4ee1ad420862..655628def68e 100644
+--- a/arch/sparc/kernel/cherrs.S
++++ b/arch/sparc/kernel/cherrs.S
+@@ -214,8 +214,7 @@ do_dcpe_tl1_nonfatal: /* Ok we may use interrupt globals safely. */
+ subcc %g1, %g2, %g1 ! Next cacheline
+ bge,pt %icc, 1b
+ nop
+- ba,pt %xcc, dcpe_icpe_tl1_common
+- nop
++ ba,a,pt %xcc, dcpe_icpe_tl1_common
+
+ do_dcpe_tl1_fatal:
+ sethi %hi(1f), %g7
+@@ -224,8 +223,7 @@ do_dcpe_tl1_fatal:
+ mov 0x2, %o0
+ call cheetah_plus_parity_error
+ add %sp, PTREGS_OFF, %o1
+- ba,pt %xcc, rtrap
+- nop
++ ba,a,pt %xcc, rtrap
+ .size do_dcpe_tl1,.-do_dcpe_tl1
+
+ .globl do_icpe_tl1
+@@ -259,8 +257,7 @@ do_icpe_tl1_nonfatal: /* Ok we may use interrupt globals safely. */
+ subcc %g1, %g2, %g1
+ bge,pt %icc, 1b
+ nop
+- ba,pt %xcc, dcpe_icpe_tl1_common
+- nop
++ ba,a,pt %xcc, dcpe_icpe_tl1_common
+
+ do_icpe_tl1_fatal:
+ sethi %hi(1f), %g7
+@@ -269,8 +266,7 @@ do_icpe_tl1_fatal:
+ mov 0x3, %o0
+ call cheetah_plus_parity_error
+ add %sp, PTREGS_OFF, %o1
+- ba,pt %xcc, rtrap
+- nop
++ ba,a,pt %xcc, rtrap
+ .size do_icpe_tl1,.-do_icpe_tl1
+
+ .type dcpe_icpe_tl1_common,#function
+@@ -456,7 +452,7 @@ __cheetah_log_error:
+ cmp %g2, 0x63
+ be c_cee
+ nop
+- ba,pt %xcc, c_deferred
++ ba,a,pt %xcc, c_deferred
+ .size __cheetah_log_error,.-__cheetah_log_error
+
+ /* Cheetah FECC trap handling, we get here from tl{0,1}_fecc
+diff --git a/arch/sparc/kernel/entry.S b/arch/sparc/kernel/entry.S
+index 33c02b15f478..a83707c83be8 100644
+--- a/arch/sparc/kernel/entry.S
++++ b/arch/sparc/kernel/entry.S
+@@ -948,7 +948,24 @@ linux_syscall_trace:
+ cmp %o0, 0
+ bne 3f
+ mov -ENOSYS, %o0
++
++ /* Syscall tracing can modify the registers. */
++ ld [%sp + STACKFRAME_SZ + PT_G1], %g1
++ sethi %hi(sys_call_table), %l7
++ ld [%sp + STACKFRAME_SZ + PT_I0], %i0
++ or %l7, %lo(sys_call_table), %l7
++ ld [%sp + STACKFRAME_SZ + PT_I1], %i1
++ ld [%sp + STACKFRAME_SZ + PT_I2], %i2
++ ld [%sp + STACKFRAME_SZ + PT_I3], %i3
++ ld [%sp + STACKFRAME_SZ + PT_I4], %i4
++ ld [%sp + STACKFRAME_SZ + PT_I5], %i5
++ cmp %g1, NR_syscalls
++ bgeu 3f
++ mov -ENOSYS, %o0
++
++ sll %g1, 2, %l4
+ mov %i0, %o0
++ ld [%l7 + %l4], %l7
+ mov %i1, %o1
+ mov %i2, %o2
+ mov %i3, %o3
+diff --git a/arch/sparc/kernel/fpu_traps.S b/arch/sparc/kernel/fpu_traps.S
+index a6864826a4bd..336d2750fe78 100644
+--- a/arch/sparc/kernel/fpu_traps.S
++++ b/arch/sparc/kernel/fpu_traps.S
+@@ -100,8 +100,8 @@ do_fpdis:
+ fmuld %f0, %f2, %f26
+ faddd %f0, %f2, %f28
+ fmuld %f0, %f2, %f30
+- b,pt %xcc, fpdis_exit
+- nop
++ ba,a,pt %xcc, fpdis_exit
++
+ 2: andcc %g5, FPRS_DU, %g0
+ bne,pt %icc, 3f
+ fzero %f32
+@@ -144,8 +144,8 @@ do_fpdis:
+ fmuld %f32, %f34, %f58
+ faddd %f32, %f34, %f60
+ fmuld %f32, %f34, %f62
+- ba,pt %xcc, fpdis_exit
+- nop
++ ba,a,pt %xcc, fpdis_exit
++
+ 3: mov SECONDARY_CONTEXT, %g3
+ add %g6, TI_FPREGS, %g1
+
+@@ -197,8 +197,7 @@ fpdis_exit2:
+ fp_other_bounce:
+ call do_fpother
+ add %sp, PTREGS_OFF, %o0
+- ba,pt %xcc, rtrap
+- nop
++ ba,a,pt %xcc, rtrap
+ .size fp_other_bounce,.-fp_other_bounce
+
+ .align 32
+diff --git a/arch/sparc/kernel/head_64.S b/arch/sparc/kernel/head_64.S
+index 3d61fcae7ee3..8ff57630a486 100644
+--- a/arch/sparc/kernel/head_64.S
++++ b/arch/sparc/kernel/head_64.S
+@@ -461,9 +461,8 @@ sun4v_chip_type:
+ subcc %g3, 1, %g3
+ bne,pt %xcc, 41b
+ add %g1, 1, %g1
+- mov SUN4V_CHIP_SPARC64X, %g4
+ ba,pt %xcc, 5f
+- nop
++ mov SUN4V_CHIP_SPARC64X, %g4
+
+ 49:
+ mov SUN4V_CHIP_UNKNOWN, %g4
+@@ -548,8 +547,7 @@ sun4u_init:
+ stxa %g0, [%g7] ASI_DMMU
+ membar #Sync
+
+- ba,pt %xcc, sun4u_continue
+- nop
++ ba,a,pt %xcc, sun4u_continue
+
+ sun4v_init:
+ /* Set ctx 0 */
+@@ -560,14 +558,12 @@ sun4v_init:
+ mov SECONDARY_CONTEXT, %g7
+ stxa %g0, [%g7] ASI_MMU
+ membar #Sync
+- ba,pt %xcc, niagara_tlb_fixup
+- nop
++ ba,a,pt %xcc, niagara_tlb_fixup
+
+ sun4u_continue:
+ BRANCH_IF_ANY_CHEETAH(g1, g7, cheetah_tlb_fixup)
+
+- ba,pt %xcc, spitfire_tlb_fixup
+- nop
++ ba,a,pt %xcc, spitfire_tlb_fixup
+
+ niagara_tlb_fixup:
+ mov 3, %g2 /* Set TLB type to hypervisor. */
+@@ -639,8 +635,7 @@ niagara_patch:
+ call hypervisor_patch_cachetlbops
+ nop
+
+- ba,pt %xcc, tlb_fixup_done
+- nop
++ ba,a,pt %xcc, tlb_fixup_done
+
+ cheetah_tlb_fixup:
+ mov 2, %g2 /* Set TLB type to cheetah+. */
+@@ -659,8 +654,7 @@ cheetah_tlb_fixup:
+ call cheetah_patch_cachetlbops
+ nop
+
+- ba,pt %xcc, tlb_fixup_done
+- nop
++ ba,a,pt %xcc, tlb_fixup_done
+
+ spitfire_tlb_fixup:
+ /* Set TLB type to spitfire. */
+@@ -782,8 +776,7 @@ setup_trap_table:
+ call %o1
+ add %sp, (2047 + 128), %o0
+
+- ba,pt %xcc, 2f
+- nop
++ ba,a,pt %xcc, 2f
+
+ 1: sethi %hi(sparc64_ttable_tl0), %o0
+ set prom_set_trap_table_name, %g2
+@@ -822,8 +815,7 @@ setup_trap_table:
+
+ BRANCH_IF_ANY_CHEETAH(o2, o3, 1f)
+
+- ba,pt %xcc, 2f
+- nop
++ ba,a,pt %xcc, 2f
+
+ /* Disable STICK_INT interrupts. */
+ 1:
+diff --git a/arch/sparc/kernel/misctrap.S b/arch/sparc/kernel/misctrap.S
+index 753b4f031bfb..34b4933900bf 100644
+--- a/arch/sparc/kernel/misctrap.S
++++ b/arch/sparc/kernel/misctrap.S
+@@ -18,8 +18,7 @@ __do_privact:
+ 109: or %g7, %lo(109b), %g7
+ call do_privact
+ add %sp, PTREGS_OFF, %o0
+- ba,pt %xcc, rtrap
+- nop
++ ba,a,pt %xcc, rtrap
+ .size __do_privact,.-__do_privact
+
+ .type do_mna,#function
+@@ -46,8 +45,7 @@ do_mna:
+ mov %l5, %o2
+ call mem_address_unaligned
+ add %sp, PTREGS_OFF, %o0
+- ba,pt %xcc, rtrap
+- nop
++ ba,a,pt %xcc, rtrap
+ .size do_mna,.-do_mna
+
+ .type do_lddfmna,#function
+@@ -65,8 +63,7 @@ do_lddfmna:
+ mov %l5, %o2
+ call handle_lddfmna
+ add %sp, PTREGS_OFF, %o0
+- ba,pt %xcc, rtrap
+- nop
++ ba,a,pt %xcc, rtrap
+ .size do_lddfmna,.-do_lddfmna
+
+ .type do_stdfmna,#function
+@@ -84,8 +81,7 @@ do_stdfmna:
+ mov %l5, %o2
+ call handle_stdfmna
+ add %sp, PTREGS_OFF, %o0
+- ba,pt %xcc, rtrap
+- nop
++ ba,a,pt %xcc, rtrap
+ .size do_stdfmna,.-do_stdfmna
+
+ .type breakpoint_trap,#function
+diff --git a/arch/sparc/kernel/pci.c b/arch/sparc/kernel/pci.c
+index b36365f49478..f9288bf12fea 100644
+--- a/arch/sparc/kernel/pci.c
++++ b/arch/sparc/kernel/pci.c
+@@ -995,6 +995,23 @@ void pcibios_set_master(struct pci_dev *dev)
+ /* No special bus mastering setup handling */
+ }
+
++#ifdef CONFIG_PCI_IOV
++int pcibios_add_device(struct pci_dev *dev)
++{
++ struct pci_dev *pdev;
++
++ /* Add sriov arch specific initialization here.
++ * Copy dev_archdata from PF to VF
++ */
++ if (dev->is_virtfn) {
++ pdev = dev->physfn;
++ memcpy(&dev->dev.archdata, &pdev->dev.archdata,
++ sizeof(struct dev_archdata));
++ }
++ return 0;
++}
++#endif /* CONFIG_PCI_IOV */
++
+ static int __init pcibios_init(void)
+ {
+ pci_dfl_cache_line_size = 64 >> 2;
+diff --git a/arch/sparc/kernel/rtrap_64.S b/arch/sparc/kernel/rtrap_64.S
+index 39f0c662f4c8..8de386dc8150 100644
+--- a/arch/sparc/kernel/rtrap_64.S
++++ b/arch/sparc/kernel/rtrap_64.S
+@@ -14,10 +14,6 @@
+ #include <asm/visasm.h>
+ #include <asm/processor.h>
+
+-#define RTRAP_PSTATE (PSTATE_TSO|PSTATE_PEF|PSTATE_PRIV|PSTATE_IE)
+-#define RTRAP_PSTATE_IRQOFF (PSTATE_TSO|PSTATE_PEF|PSTATE_PRIV)
+-#define RTRAP_PSTATE_AG_IRQOFF (PSTATE_TSO|PSTATE_PEF|PSTATE_PRIV|PSTATE_AG)
+-
+ #ifdef CONFIG_CONTEXT_TRACKING
+ # define SCHEDULE_USER schedule_user
+ #else
+@@ -236,52 +232,17 @@ rt_continue: ldx [%sp + PTREGS_OFF + PT_V9_G1], %g1
+ wrpr %g1, %cwp
+ ba,a,pt %xcc, user_rtt_fill_64bit
+
+-user_rtt_fill_fixup:
+- rdpr %cwp, %g1
+- add %g1, 1, %g1
+- wrpr %g1, 0x0, %cwp
+-
+- rdpr %wstate, %g2
+- sll %g2, 3, %g2
+- wrpr %g2, 0x0, %wstate
+-
+- /* We know %canrestore and %otherwin are both zero. */
+-
+- sethi %hi(sparc64_kern_pri_context), %g2
+- ldx [%g2 + %lo(sparc64_kern_pri_context)], %g2
+- mov PRIMARY_CONTEXT, %g1
+-
+-661: stxa %g2, [%g1] ASI_DMMU
+- .section .sun4v_1insn_patch, "ax"
+- .word 661b
+- stxa %g2, [%g1] ASI_MMU
+- .previous
+-
+- sethi %hi(KERNBASE), %g1
+- flush %g1
++user_rtt_fill_fixup_dax:
++ ba,pt %xcc, user_rtt_fill_fixup_common
++ mov 1, %g3
+
+- or %g4, FAULT_CODE_WINFIXUP, %g4
+- stb %g4, [%g6 + TI_FAULT_CODE]
+- stx %g5, [%g6 + TI_FAULT_ADDR]
++user_rtt_fill_fixup_mna:
++ ba,pt %xcc, user_rtt_fill_fixup_common
++ mov 2, %g3
+
+- mov %g6, %l1
+- wrpr %g0, 0x0, %tl
+-
+-661: nop
+- .section .sun4v_1insn_patch, "ax"
+- .word 661b
+- SET_GL(0)
+- .previous
+-
+- wrpr %g0, RTRAP_PSTATE, %pstate
+-
+- mov %l1, %g6
+- ldx [%g6 + TI_TASK], %g4
+- LOAD_PER_CPU_BASE(%g5, %g6, %g1, %g2, %g3)
+- call do_sparc64_fault
+- add %sp, PTREGS_OFF, %o0
+- ba,pt %xcc, rtrap
+- nop
++user_rtt_fill_fixup:
++ ba,pt %xcc, user_rtt_fill_fixup_common
++ clr %g3
+
+ user_rtt_pre_restore:
+ add %g1, 1, %g1
+diff --git a/arch/sparc/kernel/signal32.c b/arch/sparc/kernel/signal32.c
+index 62deba7be1a9..94646266f0e4 100644
+--- a/arch/sparc/kernel/signal32.c
++++ b/arch/sparc/kernel/signal32.c
+@@ -138,12 +138,24 @@ int copy_siginfo_from_user32(siginfo_t *to, compat_siginfo_t __user *from)
+ return 0;
+ }
+
++/* Checks if the fp is valid. We always build signal frames which are
++ * 16-byte aligned, therefore we can always enforce that the restore
++ * frame has that property as well.
++ */
++static bool invalid_frame_pointer(void __user *fp, int fplen)
++{
++ if ((((unsigned long) fp) & 15) ||
++ ((unsigned long)fp) > 0x100000000ULL - fplen)
++ return true;
++ return false;
++}
++
+ void do_sigreturn32(struct pt_regs *regs)
+ {
+ struct signal_frame32 __user *sf;
+ compat_uptr_t fpu_save;
+ compat_uptr_t rwin_save;
+- unsigned int psr;
++ unsigned int psr, ufp;
+ unsigned pc, npc;
+ sigset_t set;
+ compat_sigset_t seta;
+@@ -158,11 +170,16 @@ void do_sigreturn32(struct pt_regs *regs)
+ sf = (struct signal_frame32 __user *) regs->u_regs[UREG_FP];
+
+ /* 1. Make sure we are not getting garbage from the user */
+- if (!access_ok(VERIFY_READ, sf, sizeof(*sf)) ||
+- (((unsigned long) sf) & 3))
++ if (invalid_frame_pointer(sf, sizeof(*sf)))
++ goto segv;
++
++ if (get_user(ufp, &sf->info.si_regs.u_regs[UREG_FP]))
++ goto segv;
++
++ if (ufp & 0x7)
+ goto segv;
+
+- if (get_user(pc, &sf->info.si_regs.pc) ||
++ if (__get_user(pc, &sf->info.si_regs.pc) ||
+ __get_user(npc, &sf->info.si_regs.npc))
+ goto segv;
+
+@@ -227,7 +244,7 @@ segv:
+ asmlinkage void do_rt_sigreturn32(struct pt_regs *regs)
+ {
+ struct rt_signal_frame32 __user *sf;
+- unsigned int psr, pc, npc;
++ unsigned int psr, pc, npc, ufp;
+ compat_uptr_t fpu_save;
+ compat_uptr_t rwin_save;
+ sigset_t set;
+@@ -242,11 +259,16 @@ asmlinkage void do_rt_sigreturn32(struct pt_regs *regs)
+ sf = (struct rt_signal_frame32 __user *) regs->u_regs[UREG_FP];
+
+ /* 1. Make sure we are not getting garbage from the user */
+- if (!access_ok(VERIFY_READ, sf, sizeof(*sf)) ||
+- (((unsigned long) sf) & 3))
++ if (invalid_frame_pointer(sf, sizeof(*sf)))
+ goto segv;
+
+- if (get_user(pc, &sf->regs.pc) ||
++ if (get_user(ufp, &sf->regs.u_regs[UREG_FP]))
++ goto segv;
++
++ if (ufp & 0x7)
++ goto segv;
++
++ if (__get_user(pc, &sf->regs.pc) ||
+ __get_user(npc, &sf->regs.npc))
+ goto segv;
+
+@@ -307,14 +329,6 @@ segv:
+ force_sig(SIGSEGV, current);
+ }
+
+-/* Checks if the fp is valid */
+-static int invalid_frame_pointer(void __user *fp, int fplen)
+-{
+- if ((((unsigned long) fp) & 7) || ((unsigned long)fp) > 0x100000000ULL - fplen)
+- return 1;
+- return 0;
+-}
+-
+ static void __user *get_sigframe(struct ksignal *ksig, struct pt_regs *regs, unsigned long framesize)
+ {
+ unsigned long sp;
+diff --git a/arch/sparc/kernel/signal_32.c b/arch/sparc/kernel/signal_32.c
+index 9ee72fc8e0e4..8492291424ab 100644
+--- a/arch/sparc/kernel/signal_32.c
++++ b/arch/sparc/kernel/signal_32.c
+@@ -60,10 +60,22 @@ struct rt_signal_frame {
+ #define SF_ALIGNEDSZ (((sizeof(struct signal_frame) + 7) & (~7)))
+ #define RT_ALIGNEDSZ (((sizeof(struct rt_signal_frame) + 7) & (~7)))
+
++/* Checks if the fp is valid. We always build signal frames which are
++ * 16-byte aligned, therefore we can always enforce that the restore
++ * frame has that property as well.
++ */
++static inline bool invalid_frame_pointer(void __user *fp, int fplen)
++{
++ if ((((unsigned long) fp) & 15) || !__access_ok((unsigned long)fp, fplen))
++ return true;
++
++ return false;
++}
++
+ asmlinkage void do_sigreturn(struct pt_regs *regs)
+ {
++ unsigned long up_psr, pc, npc, ufp;
+ struct signal_frame __user *sf;
+- unsigned long up_psr, pc, npc;
+ sigset_t set;
+ __siginfo_fpu_t __user *fpu_save;
+ __siginfo_rwin_t __user *rwin_save;
+@@ -77,10 +89,13 @@ asmlinkage void do_sigreturn(struct pt_regs *regs)
+ sf = (struct signal_frame __user *) regs->u_regs[UREG_FP];
+
+ /* 1. Make sure we are not getting garbage from the user */
+- if (!access_ok(VERIFY_READ, sf, sizeof(*sf)))
++ if (!invalid_frame_pointer(sf, sizeof(*sf)))
++ goto segv_and_exit;
++
++ if (get_user(ufp, &sf->info.si_regs.u_regs[UREG_FP]))
+ goto segv_and_exit;
+
+- if (((unsigned long) sf) & 3)
++ if (ufp & 0x7)
+ goto segv_and_exit;
+
+ err = __get_user(pc, &sf->info.si_regs.pc);
+@@ -127,7 +142,7 @@ segv_and_exit:
+ asmlinkage void do_rt_sigreturn(struct pt_regs *regs)
+ {
+ struct rt_signal_frame __user *sf;
+- unsigned int psr, pc, npc;
++ unsigned int psr, pc, npc, ufp;
+ __siginfo_fpu_t __user *fpu_save;
+ __siginfo_rwin_t __user *rwin_save;
+ sigset_t set;
+@@ -135,8 +150,13 @@ asmlinkage void do_rt_sigreturn(struct pt_regs *regs)
+
+ synchronize_user_stack();
+ sf = (struct rt_signal_frame __user *) regs->u_regs[UREG_FP];
+- if (!access_ok(VERIFY_READ, sf, sizeof(*sf)) ||
+- (((unsigned long) sf) & 0x03))
++ if (!invalid_frame_pointer(sf, sizeof(*sf)))
++ goto segv;
++
++ if (get_user(ufp, &sf->regs.u_regs[UREG_FP]))
++ goto segv;
++
++ if (ufp & 0x7)
+ goto segv;
+
+ err = __get_user(pc, &sf->regs.pc);
+@@ -178,15 +198,6 @@ segv:
+ force_sig(SIGSEGV, current);
+ }
+
+-/* Checks if the fp is valid */
+-static inline int invalid_frame_pointer(void __user *fp, int fplen)
+-{
+- if ((((unsigned long) fp) & 7) || !__access_ok((unsigned long)fp, fplen))
+- return 1;
+-
+- return 0;
+-}
+-
+ static inline void __user *get_sigframe(struct ksignal *ksig, struct pt_regs *regs, unsigned long framesize)
+ {
+ unsigned long sp = regs->u_regs[UREG_FP];
+diff --git a/arch/sparc/kernel/signal_64.c b/arch/sparc/kernel/signal_64.c
+index 1a6999868031..9acf9822cbbd 100644
+--- a/arch/sparc/kernel/signal_64.c
++++ b/arch/sparc/kernel/signal_64.c
+@@ -52,7 +52,7 @@ asmlinkage void sparc64_set_context(struct pt_regs *regs)
+ unsigned char fenab;
+ int err;
+
+- flush_user_windows();
++ synchronize_user_stack();
+ if (get_thread_wsaved() ||
+ (((unsigned long)ucp) & (sizeof(unsigned long)-1)) ||
+ (!__access_ok(ucp, sizeof(*ucp))))
+@@ -234,6 +234,17 @@ do_sigsegv:
+ goto out;
+ }
+
++/* Checks if the fp is valid. We always build rt signal frames which
++ * are 16-byte aligned, therefore we can always enforce that the
++ * restore frame has that property as well.
++ */
++static bool invalid_frame_pointer(void __user *fp)
++{
++ if (((unsigned long) fp) & 15)
++ return true;
++ return false;
++}
++
+ struct rt_signal_frame {
+ struct sparc_stackf ss;
+ siginfo_t info;
+@@ -246,8 +257,8 @@ struct rt_signal_frame {
+
+ void do_rt_sigreturn(struct pt_regs *regs)
+ {
++ unsigned long tpc, tnpc, tstate, ufp;
+ struct rt_signal_frame __user *sf;
+- unsigned long tpc, tnpc, tstate;
+ __siginfo_fpu_t __user *fpu_save;
+ __siginfo_rwin_t __user *rwin_save;
+ sigset_t set;
+@@ -261,10 +272,16 @@ void do_rt_sigreturn(struct pt_regs *regs)
+ (regs->u_regs [UREG_FP] + STACK_BIAS);
+
+ /* 1. Make sure we are not getting garbage from the user */
+- if (((unsigned long) sf) & 3)
++ if (invalid_frame_pointer(sf))
++ goto segv;
++
++ if (get_user(ufp, &sf->regs.u_regs[UREG_FP]))
+ goto segv;
+
+- err = get_user(tpc, &sf->regs.tpc);
++ if ((ufp + STACK_BIAS) & 0x7)
++ goto segv;
++
++ err = __get_user(tpc, &sf->regs.tpc);
+ err |= __get_user(tnpc, &sf->regs.tnpc);
+ if (test_thread_flag(TIF_32BIT)) {
+ tpc &= 0xffffffff;
+@@ -308,14 +325,6 @@ segv:
+ force_sig(SIGSEGV, current);
+ }
+
+-/* Checks if the fp is valid */
+-static int invalid_frame_pointer(void __user *fp)
+-{
+- if (((unsigned long) fp) & 15)
+- return 1;
+- return 0;
+-}
+-
+ static inline void __user *get_sigframe(struct ksignal *ksig, struct pt_regs *regs, unsigned long framesize)
+ {
+ unsigned long sp = regs->u_regs[UREG_FP] + STACK_BIAS;
+diff --git a/arch/sparc/kernel/sigutil_32.c b/arch/sparc/kernel/sigutil_32.c
+index 0f6eebe71e6c..e5fe8cef9a69 100644
+--- a/arch/sparc/kernel/sigutil_32.c
++++ b/arch/sparc/kernel/sigutil_32.c
+@@ -48,6 +48,10 @@ int save_fpu_state(struct pt_regs *regs, __siginfo_fpu_t __user *fpu)
+ int restore_fpu_state(struct pt_regs *regs, __siginfo_fpu_t __user *fpu)
+ {
+ int err;
++
++ if (((unsigned long) fpu) & 3)
++ return -EFAULT;
++
+ #ifdef CONFIG_SMP
+ if (test_tsk_thread_flag(current, TIF_USEDFPU))
+ regs->psr &= ~PSR_EF;
+@@ -97,7 +101,10 @@ int restore_rwin_state(__siginfo_rwin_t __user *rp)
+ struct thread_info *t = current_thread_info();
+ int i, wsaved, err;
+
+- __get_user(wsaved, &rp->wsaved);
++ if (((unsigned long) rp) & 3)
++ return -EFAULT;
++
++ get_user(wsaved, &rp->wsaved);
+ if (wsaved > NSWINS)
+ return -EFAULT;
+
+diff --git a/arch/sparc/kernel/sigutil_64.c b/arch/sparc/kernel/sigutil_64.c
+index 387834a9c56a..36aadcbeac69 100644
+--- a/arch/sparc/kernel/sigutil_64.c
++++ b/arch/sparc/kernel/sigutil_64.c
+@@ -37,7 +37,10 @@ int restore_fpu_state(struct pt_regs *regs, __siginfo_fpu_t __user *fpu)
+ unsigned long fprs;
+ int err;
+
+- err = __get_user(fprs, &fpu->si_fprs);
++ if (((unsigned long) fpu) & 7)
++ return -EFAULT;
++
++ err = get_user(fprs, &fpu->si_fprs);
+ fprs_write(0);
+ regs->tstate &= ~TSTATE_PEF;
+ if (fprs & FPRS_DL)
+@@ -72,7 +75,10 @@ int restore_rwin_state(__siginfo_rwin_t __user *rp)
+ struct thread_info *t = current_thread_info();
+ int i, wsaved, err;
+
+- __get_user(wsaved, &rp->wsaved);
++ if (((unsigned long) rp) & 7)
++ return -EFAULT;
++
++ get_user(wsaved, &rp->wsaved);
+ if (wsaved > NSWINS)
+ return -EFAULT;
+
+diff --git a/arch/sparc/kernel/spiterrs.S b/arch/sparc/kernel/spiterrs.S
+index c357e40ffd01..4a73009f66a5 100644
+--- a/arch/sparc/kernel/spiterrs.S
++++ b/arch/sparc/kernel/spiterrs.S
+@@ -85,8 +85,7 @@ __spitfire_cee_trap_continue:
+ ba,pt %xcc, etraptl1
+ rd %pc, %g7
+
+- ba,pt %xcc, 2f
+- nop
++ ba,a,pt %xcc, 2f
+
+ 1: ba,pt %xcc, etrap_irq
+ rd %pc, %g7
+@@ -100,8 +99,7 @@ __spitfire_cee_trap_continue:
+ mov %l5, %o2
+ call spitfire_access_error
+ add %sp, PTREGS_OFF, %o0
+- ba,pt %xcc, rtrap
+- nop
++ ba,a,pt %xcc, rtrap
+ .size __spitfire_access_error,.-__spitfire_access_error
+
+ /* This is the trap handler entry point for ECC correctable
+@@ -179,8 +177,7 @@ __spitfire_data_access_exception_tl1:
+ mov %l5, %o2
+ call spitfire_data_access_exception_tl1
+ add %sp, PTREGS_OFF, %o0
+- ba,pt %xcc, rtrap
+- nop
++ ba,a,pt %xcc, rtrap
+ .size __spitfire_data_access_exception_tl1,.-__spitfire_data_access_exception_tl1
+
+ .type __spitfire_data_access_exception,#function
+@@ -200,8 +197,7 @@ __spitfire_data_access_exception:
+ mov %l5, %o2
+ call spitfire_data_access_exception
+ add %sp, PTREGS_OFF, %o0
+- ba,pt %xcc, rtrap
+- nop
++ ba,a,pt %xcc, rtrap
+ .size __spitfire_data_access_exception,.-__spitfire_data_access_exception
+
+ .type __spitfire_insn_access_exception_tl1,#function
+@@ -220,8 +216,7 @@ __spitfire_insn_access_exception_tl1:
+ mov %l5, %o2
+ call spitfire_insn_access_exception_tl1
+ add %sp, PTREGS_OFF, %o0
+- ba,pt %xcc, rtrap
+- nop
++ ba,a,pt %xcc, rtrap
+ .size __spitfire_insn_access_exception_tl1,.-__spitfire_insn_access_exception_tl1
+
+ .type __spitfire_insn_access_exception,#function
+@@ -240,6 +235,5 @@ __spitfire_insn_access_exception:
+ mov %l5, %o2
+ call spitfire_insn_access_exception
+ add %sp, PTREGS_OFF, %o0
+- ba,pt %xcc, rtrap
+- nop
++ ba,a,pt %xcc, rtrap
+ .size __spitfire_insn_access_exception,.-__spitfire_insn_access_exception
+diff --git a/arch/sparc/kernel/syscalls.S b/arch/sparc/kernel/syscalls.S
+index 33a17e7b3ccd..6ec7531f27fc 100644
+--- a/arch/sparc/kernel/syscalls.S
++++ b/arch/sparc/kernel/syscalls.S
+@@ -148,7 +148,25 @@ linux_syscall_trace32:
+ add %sp, PTREGS_OFF, %o0
+ brnz,pn %o0, 3f
+ mov -ENOSYS, %o0
++
++ /* Syscall tracing can modify the registers. */
++ ldx [%sp + PTREGS_OFF + PT_V9_G1], %g1
++ sethi %hi(sys_call_table32), %l7
++ ldx [%sp + PTREGS_OFF + PT_V9_I0], %i0
++ or %l7, %lo(sys_call_table32), %l7
++ ldx [%sp + PTREGS_OFF + PT_V9_I1], %i1
++ ldx [%sp + PTREGS_OFF + PT_V9_I2], %i2
++ ldx [%sp + PTREGS_OFF + PT_V9_I3], %i3
++ ldx [%sp + PTREGS_OFF + PT_V9_I4], %i4
++ ldx [%sp + PTREGS_OFF + PT_V9_I5], %i5
++
++ cmp %g1, NR_syscalls
++ bgeu,pn %xcc, 3f
++ mov -ENOSYS, %o0
++
++ sll %g1, 2, %l4
+ srl %i0, 0, %o0
++ lduw [%l7 + %l4], %l7
+ srl %i4, 0, %o4
+ srl %i1, 0, %o1
+ srl %i2, 0, %o2
+@@ -160,7 +178,25 @@ linux_syscall_trace:
+ add %sp, PTREGS_OFF, %o0
+ brnz,pn %o0, 3f
+ mov -ENOSYS, %o0
++
++ /* Syscall tracing can modify the registers. */
++ ldx [%sp + PTREGS_OFF + PT_V9_G1], %g1
++ sethi %hi(sys_call_table64), %l7
++ ldx [%sp + PTREGS_OFF + PT_V9_I0], %i0
++ or %l7, %lo(sys_call_table64), %l7
++ ldx [%sp + PTREGS_OFF + PT_V9_I1], %i1
++ ldx [%sp + PTREGS_OFF + PT_V9_I2], %i2
++ ldx [%sp + PTREGS_OFF + PT_V9_I3], %i3
++ ldx [%sp + PTREGS_OFF + PT_V9_I4], %i4
++ ldx [%sp + PTREGS_OFF + PT_V9_I5], %i5
++
++ cmp %g1, NR_syscalls
++ bgeu,pn %xcc, 3f
++ mov -ENOSYS, %o0
++
++ sll %g1, 2, %l4
+ mov %i0, %o0
++ lduw [%l7 + %l4], %l7
+ mov %i1, %o1
+ mov %i2, %o2
+ mov %i3, %o3
+diff --git a/arch/sparc/kernel/urtt_fill.S b/arch/sparc/kernel/urtt_fill.S
+new file mode 100644
+index 000000000000..5604a2b051d4
+--- /dev/null
++++ b/arch/sparc/kernel/urtt_fill.S
+@@ -0,0 +1,98 @@
++#include <asm/thread_info.h>
++#include <asm/trap_block.h>
++#include <asm/spitfire.h>
++#include <asm/ptrace.h>
++#include <asm/head.h>
++
++ .text
++ .align 8
++ .globl user_rtt_fill_fixup_common
++user_rtt_fill_fixup_common:
++ rdpr %cwp, %g1
++ add %g1, 1, %g1
++ wrpr %g1, 0x0, %cwp
++
++ rdpr %wstate, %g2
++ sll %g2, 3, %g2
++ wrpr %g2, 0x0, %wstate
++
++ /* We know %canrestore and %otherwin are both zero. */
++
++ sethi %hi(sparc64_kern_pri_context), %g2
++ ldx [%g2 + %lo(sparc64_kern_pri_context)], %g2
++ mov PRIMARY_CONTEXT, %g1
++
++661: stxa %g2, [%g1] ASI_DMMU
++ .section .sun4v_1insn_patch, "ax"
++ .word 661b
++ stxa %g2, [%g1] ASI_MMU
++ .previous
++
++ sethi %hi(KERNBASE), %g1
++ flush %g1
++
++ mov %g4, %l4
++ mov %g5, %l5
++ brnz,pn %g3, 1f
++ mov %g3, %l3
++
++ or %g4, FAULT_CODE_WINFIXUP, %g4
++ stb %g4, [%g6 + TI_FAULT_CODE]
++ stx %g5, [%g6 + TI_FAULT_ADDR]
++1:
++ mov %g6, %l1
++ wrpr %g0, 0x0, %tl
++
++661: nop
++ .section .sun4v_1insn_patch, "ax"
++ .word 661b
++ SET_GL(0)
++ .previous
++
++ wrpr %g0, RTRAP_PSTATE, %pstate
++
++ mov %l1, %g6
++ ldx [%g6 + TI_TASK], %g4
++ LOAD_PER_CPU_BASE(%g5, %g6, %g1, %g2, %g3)
++
++ brnz,pn %l3, 1f
++ nop
++
++ call do_sparc64_fault
++ add %sp, PTREGS_OFF, %o0
++ ba,pt %xcc, rtrap
++ nop
++
++1: cmp %g3, 2
++ bne,pn %xcc, 2f
++ nop
++
++ sethi %hi(tlb_type), %g1
++ lduw [%g1 + %lo(tlb_type)], %g1
++ cmp %g1, 3
++ bne,pt %icc, 1f
++ add %sp, PTREGS_OFF, %o0
++ mov %l4, %o2
++ call sun4v_do_mna
++ mov %l5, %o1
++ ba,a,pt %xcc, rtrap
++1: mov %l4, %o1
++ mov %l5, %o2
++ call mem_address_unaligned
++ nop
++ ba,a,pt %xcc, rtrap
++
++2: sethi %hi(tlb_type), %g1
++ mov %l4, %o1
++ lduw [%g1 + %lo(tlb_type)], %g1
++ mov %l5, %o2
++ cmp %g1, 3
++ bne,pt %icc, 1f
++ add %sp, PTREGS_OFF, %o0
++ call sun4v_data_access_exception
++ nop
++ ba,a,pt %xcc, rtrap
++
++1: call spitfire_data_access_exception
++ nop
++ ba,a,pt %xcc, rtrap
+diff --git a/arch/sparc/kernel/utrap.S b/arch/sparc/kernel/utrap.S
+index b7f0f3f3a909..c731e8023d3e 100644
+--- a/arch/sparc/kernel/utrap.S
++++ b/arch/sparc/kernel/utrap.S
+@@ -11,8 +11,7 @@ utrap_trap: /* %g3=handler,%g4=level */
+ mov %l4, %o1
+ call bad_trap
+ add %sp, PTREGS_OFF, %o0
+- ba,pt %xcc, rtrap
+- nop
++ ba,a,pt %xcc, rtrap
+
+ invoke_utrap:
+ sllx %g3, 3, %g3
+diff --git a/arch/sparc/kernel/vmlinux.lds.S b/arch/sparc/kernel/vmlinux.lds.S
+index 09243057cb0b..7028b4dab903 100644
+--- a/arch/sparc/kernel/vmlinux.lds.S
++++ b/arch/sparc/kernel/vmlinux.lds.S
+@@ -33,6 +33,10 @@ ENTRY(_start)
+ jiffies = jiffies_64;
+ #endif
+
++#ifdef CONFIG_SPARC64
++ASSERT((swapper_tsb == 0x0000000000408000), "Error: sparc64 early assembler too large")
++#endif
++
+ SECTIONS
+ {
+ #ifdef CONFIG_SPARC64
+diff --git a/arch/sparc/kernel/winfixup.S b/arch/sparc/kernel/winfixup.S
+index 1e67ce958369..855019a8590e 100644
+--- a/arch/sparc/kernel/winfixup.S
++++ b/arch/sparc/kernel/winfixup.S
+@@ -32,8 +32,7 @@ fill_fixup:
+ rd %pc, %g7
+ call do_sparc64_fault
+ add %sp, PTREGS_OFF, %o0
+- ba,pt %xcc, rtrap
+- nop
++ ba,a,pt %xcc, rtrap
+
+ /* Be very careful about usage of the trap globals here.
+ * You cannot touch %g5 as that has the fault information.
+diff --git a/arch/sparc/mm/init_64.c b/arch/sparc/mm/init_64.c
+index 2d91c62f7f5f..7dd57626da19 100644
+--- a/arch/sparc/mm/init_64.c
++++ b/arch/sparc/mm/init_64.c
+@@ -1300,10 +1300,18 @@ static int __init numa_parse_sun4u(void)
+
+ static int __init bootmem_init_numa(void)
+ {
++ int i, j;
+ int err = -1;
+
+ numadbg("bootmem_init_numa()\n");
+
++ /* Some sane defaults for numa latency values */
++ for (i = 0; i < MAX_NUMNODES; i++) {
++ for (j = 0; j < MAX_NUMNODES; j++)
++ numa_latency[i][j] = (i == j) ?
++ LOCAL_DISTANCE : REMOTE_DISTANCE;
++ }
++
+ if (numa_enabled) {
+ if (tlb_type == hypervisor)
+ err = numa_parse_mdesc();
+@@ -2730,9 +2738,10 @@ void hugetlb_setup(struct pt_regs *regs)
+ * the Data-TLB for huge pages.
+ */
+ if (tlb_type == cheetah_plus) {
++ bool need_context_reload = false;
+ unsigned long ctx;
+
+- spin_lock(&ctx_alloc_lock);
++ spin_lock_irq(&ctx_alloc_lock);
+ ctx = mm->context.sparc64_ctx_val;
+ ctx &= ~CTX_PGSZ_MASK;
+ ctx |= CTX_PGSZ_BASE << CTX_PGSZ0_SHIFT;
+@@ -2751,9 +2760,12 @@ void hugetlb_setup(struct pt_regs *regs)
+ * also executing in this address space.
+ */
+ mm->context.sparc64_ctx_val = ctx;
+- on_each_cpu(context_reload, mm, 0);
++ need_context_reload = true;
+ }
+- spin_unlock(&ctx_alloc_lock);
++ spin_unlock_irq(&ctx_alloc_lock);
++
++ if (need_context_reload)
++ on_each_cpu(context_reload, mm, 0);
+ }
+ }
+ #endif
+diff --git a/arch/x86/kernel/kprobes/core.c b/arch/x86/kernel/kprobes/core.c
+index f2e281cf8c19..a78aa118afc2 100644
+--- a/arch/x86/kernel/kprobes/core.c
++++ b/arch/x86/kernel/kprobes/core.c
+@@ -931,7 +931,19 @@ int kprobe_fault_handler(struct pt_regs *regs, int trapnr)
+ * normal page fault.
+ */
+ regs->ip = (unsigned long)cur->addr;
++ /*
++ * Trap flag (TF) has been set here because this fault
++ * happened where the single stepping will be done.
++ * So clear it by resetting the current kprobe:
++ */
++ regs->flags &= ~X86_EFLAGS_TF;
++
++ /*
++ * If the TF flag was set before the kprobe hit,
++ * don't touch it:
++ */
+ regs->flags |= kcb->kprobe_old_flags;
++
+ if (kcb->kprobe_status == KPROBE_REENTER)
+ restore_previous_kprobe(kcb);
+ else
+diff --git a/arch/x86/mm/kmmio.c b/arch/x86/mm/kmmio.c
+index 637ab34ed632..ddb2244b06a1 100644
+--- a/arch/x86/mm/kmmio.c
++++ b/arch/x86/mm/kmmio.c
+@@ -33,7 +33,7 @@
+ struct kmmio_fault_page {
+ struct list_head list;
+ struct kmmio_fault_page *release_next;
+- unsigned long page; /* location of the fault page */
++ unsigned long addr; /* the requested address */
+ pteval_t old_presence; /* page presence prior to arming */
+ bool armed;
+
+@@ -70,9 +70,16 @@ unsigned int kmmio_count;
+ static struct list_head kmmio_page_table[KMMIO_PAGE_TABLE_SIZE];
+ static LIST_HEAD(kmmio_probes);
+
+-static struct list_head *kmmio_page_list(unsigned long page)
++static struct list_head *kmmio_page_list(unsigned long addr)
+ {
+- return &kmmio_page_table[hash_long(page, KMMIO_PAGE_HASH_BITS)];
++ unsigned int l;
++ pte_t *pte = lookup_address(addr, &l);
++
++ if (!pte)
++ return NULL;
++ addr &= page_level_mask(l);
++
++ return &kmmio_page_table[hash_long(addr, KMMIO_PAGE_HASH_BITS)];
+ }
+
+ /* Accessed per-cpu */
+@@ -98,15 +105,19 @@ static struct kmmio_probe *get_kmmio_probe(unsigned long addr)
+ }
+
+ /* You must be holding RCU read lock. */
+-static struct kmmio_fault_page *get_kmmio_fault_page(unsigned long page)
++static struct kmmio_fault_page *get_kmmio_fault_page(unsigned long addr)
+ {
+ struct list_head *head;
+ struct kmmio_fault_page *f;
++ unsigned int l;
++ pte_t *pte = lookup_address(addr, &l);
+
+- page &= PAGE_MASK;
+- head = kmmio_page_list(page);
++ if (!pte)
++ return NULL;
++ addr &= page_level_mask(l);
++ head = kmmio_page_list(addr);
+ list_for_each_entry_rcu(f, head, list) {
+- if (f->page == page)
++ if (f->addr == addr)
+ return f;
+ }
+ return NULL;
+@@ -137,10 +148,10 @@ static void clear_pte_presence(pte_t *pte, bool clear, pteval_t *old)
+ static int clear_page_presence(struct kmmio_fault_page *f, bool clear)
+ {
+ unsigned int level;
+- pte_t *pte = lookup_address(f->page, &level);
++ pte_t *pte = lookup_address(f->addr, &level);
+
+ if (!pte) {
+- pr_err("no pte for page 0x%08lx\n", f->page);
++ pr_err("no pte for addr 0x%08lx\n", f->addr);
+ return -1;
+ }
+
+@@ -156,7 +167,7 @@ static int clear_page_presence(struct kmmio_fault_page *f, bool clear)
+ return -1;
+ }
+
+- __flush_tlb_one(f->page);
++ __flush_tlb_one(f->addr);
+ return 0;
+ }
+
+@@ -176,12 +187,12 @@ static int arm_kmmio_fault_page(struct kmmio_fault_page *f)
+ int ret;
+ WARN_ONCE(f->armed, KERN_ERR pr_fmt("kmmio page already armed.\n"));
+ if (f->armed) {
+- pr_warning("double-arm: page 0x%08lx, ref %d, old %d\n",
+- f->page, f->count, !!f->old_presence);
++ pr_warning("double-arm: addr 0x%08lx, ref %d, old %d\n",
++ f->addr, f->count, !!f->old_presence);
+ }
+ ret = clear_page_presence(f, true);
+- WARN_ONCE(ret < 0, KERN_ERR pr_fmt("arming 0x%08lx failed.\n"),
+- f->page);
++ WARN_ONCE(ret < 0, KERN_ERR pr_fmt("arming at 0x%08lx failed.\n"),
++ f->addr);
+ f->armed = true;
+ return ret;
+ }
+@@ -191,7 +202,7 @@ static void disarm_kmmio_fault_page(struct kmmio_fault_page *f)
+ {
+ int ret = clear_page_presence(f, false);
+ WARN_ONCE(ret < 0,
+- KERN_ERR "kmmio disarming 0x%08lx failed.\n", f->page);
++ KERN_ERR "kmmio disarming at 0x%08lx failed.\n", f->addr);
+ f->armed = false;
+ }
+
+@@ -215,6 +226,12 @@ int kmmio_handler(struct pt_regs *regs, unsigned long addr)
+ struct kmmio_context *ctx;
+ struct kmmio_fault_page *faultpage;
+ int ret = 0; /* default to fault not handled */
++ unsigned long page_base = addr;
++ unsigned int l;
++ pte_t *pte = lookup_address(addr, &l);
++ if (!pte)
++ return -EINVAL;
++ page_base &= page_level_mask(l);
+
+ /*
+ * Preemption is now disabled to prevent process switch during
+@@ -227,7 +244,7 @@ int kmmio_handler(struct pt_regs *regs, unsigned long addr)
+ preempt_disable();
+ rcu_read_lock();
+
+- faultpage = get_kmmio_fault_page(addr);
++ faultpage = get_kmmio_fault_page(page_base);
+ if (!faultpage) {
+ /*
+ * Either this page fault is not caused by kmmio, or
+@@ -239,7 +256,7 @@ int kmmio_handler(struct pt_regs *regs, unsigned long addr)
+
+ ctx = &get_cpu_var(kmmio_ctx);
+ if (ctx->active) {
+- if (addr == ctx->addr) {
++ if (page_base == ctx->addr) {
+ /*
+ * A second fault on the same page means some other
+ * condition needs handling by do_page_fault(), the
+@@ -267,9 +284,9 @@ int kmmio_handler(struct pt_regs *regs, unsigned long addr)
+ ctx->active++;
+
+ ctx->fpage = faultpage;
+- ctx->probe = get_kmmio_probe(addr);
++ ctx->probe = get_kmmio_probe(page_base);
+ ctx->saved_flags = (regs->flags & (X86_EFLAGS_TF | X86_EFLAGS_IF));
+- ctx->addr = addr;
++ ctx->addr = page_base;
+
+ if (ctx->probe && ctx->probe->pre_handler)
+ ctx->probe->pre_handler(ctx->probe, regs, addr);
+@@ -354,12 +371,11 @@ out:
+ }
+
+ /* You must be holding kmmio_lock. */
+-static int add_kmmio_fault_page(unsigned long page)
++static int add_kmmio_fault_page(unsigned long addr)
+ {
+ struct kmmio_fault_page *f;
+
+- page &= PAGE_MASK;
+- f = get_kmmio_fault_page(page);
++ f = get_kmmio_fault_page(addr);
+ if (f) {
+ if (!f->count)
+ arm_kmmio_fault_page(f);
+@@ -372,26 +388,25 @@ static int add_kmmio_fault_page(unsigned long page)
+ return -1;
+
+ f->count = 1;
+- f->page = page;
++ f->addr = addr;
+
+ if (arm_kmmio_fault_page(f)) {
+ kfree(f);
+ return -1;
+ }
+
+- list_add_rcu(&f->list, kmmio_page_list(f->page));
++ list_add_rcu(&f->list, kmmio_page_list(f->addr));
+
+ return 0;
+ }
+
+ /* You must be holding kmmio_lock. */
+-static void release_kmmio_fault_page(unsigned long page,
++static void release_kmmio_fault_page(unsigned long addr,
+ struct kmmio_fault_page **release_list)
+ {
+ struct kmmio_fault_page *f;
+
+- page &= PAGE_MASK;
+- f = get_kmmio_fault_page(page);
++ f = get_kmmio_fault_page(addr);
+ if (!f)
+ return;
+
+@@ -420,18 +435,27 @@ int register_kmmio_probe(struct kmmio_probe *p)
+ int ret = 0;
+ unsigned long size = 0;
+ const unsigned long size_lim = p->len + (p->addr & ~PAGE_MASK);
++ unsigned int l;
++ pte_t *pte;
+
+ spin_lock_irqsave(&kmmio_lock, flags);
+ if (get_kmmio_probe(p->addr)) {
+ ret = -EEXIST;
+ goto out;
+ }
++
++ pte = lookup_address(p->addr, &l);
++ if (!pte) {
++ ret = -EINVAL;
++ goto out;
++ }
++
+ kmmio_count++;
+ list_add_rcu(&p->list, &kmmio_probes);
+ while (size < size_lim) {
+ if (add_kmmio_fault_page(p->addr + size))
+ pr_err("Unable to set page fault.\n");
+- size += PAGE_SIZE;
++ size += page_level_size(l);
+ }
+ out:
+ spin_unlock_irqrestore(&kmmio_lock, flags);
+@@ -506,11 +530,17 @@ void unregister_kmmio_probe(struct kmmio_probe *p)
+ const unsigned long size_lim = p->len + (p->addr & ~PAGE_MASK);
+ struct kmmio_fault_page *release_list = NULL;
+ struct kmmio_delayed_release *drelease;
++ unsigned int l;
++ pte_t *pte;
++
++ pte = lookup_address(p->addr, &l);
++ if (!pte)
++ return;
+
+ spin_lock_irqsave(&kmmio_lock, flags);
+ while (size < size_lim) {
+ release_kmmio_fault_page(p->addr + size, &release_list);
+- size += PAGE_SIZE;
++ size += page_level_size(l);
+ }
+ list_del_rcu(&p->list);
+ kmmio_count--;
+diff --git a/crypto/asymmetric_keys/pkcs7_trust.c b/crypto/asymmetric_keys/pkcs7_trust.c
+index 1d29376072da..841a04c1b258 100644
+--- a/crypto/asymmetric_keys/pkcs7_trust.c
++++ b/crypto/asymmetric_keys/pkcs7_trust.c
+@@ -174,6 +174,8 @@ int pkcs7_validate_trust(struct pkcs7_message *pkcs7,
+ int cached_ret = -ENOKEY;
+ int ret;
+
++ *_trusted = false;
++
+ for (p = pkcs7->certs; p; p = p->next)
+ p->seen = false;
+
+diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c
+index 4ec95b76f6a1..0550c76f4e6c 100644
+--- a/drivers/ata/libata-eh.c
++++ b/drivers/ata/libata-eh.c
+@@ -605,7 +605,7 @@ void ata_scsi_error(struct Scsi_Host *host)
+ ata_scsi_port_error_handler(host, ap);
+
+ /* finish or retry handled scmd's and clean up */
+- WARN_ON(host->host_failed || !list_empty(&eh_work_q));
++ WARN_ON(!list_empty(&eh_work_q));
+
+ DPRINTK("EXIT\n");
+ }
+diff --git a/drivers/base/module.c b/drivers/base/module.c
+index db930d3ee312..2a215780eda2 100644
+--- a/drivers/base/module.c
++++ b/drivers/base/module.c
+@@ -24,10 +24,12 @@ static char *make_driver_name(struct device_driver *drv)
+
+ static void module_create_drivers_dir(struct module_kobject *mk)
+ {
+- if (!mk || mk->drivers_dir)
+- return;
++ static DEFINE_MUTEX(drivers_dir_mutex);
+
+- mk->drivers_dir = kobject_create_and_add("drivers", &mk->kobj);
++ mutex_lock(&drivers_dir_mutex);
++ if (mk && !mk->drivers_dir)
++ mk->drivers_dir = kobject_create_and_add("drivers", &mk->kobj);
++ mutex_unlock(&drivers_dir_mutex);
+ }
+
+ void module_add_driver(struct module *mod, struct device_driver *drv)
+diff --git a/drivers/block/mtip32xx/mtip32xx.c b/drivers/block/mtip32xx/mtip32xx.c
+index d7e0b9b806e9..93e542cb4911 100644
+--- a/drivers/block/mtip32xx/mtip32xx.c
++++ b/drivers/block/mtip32xx/mtip32xx.c
+@@ -2946,9 +2946,15 @@ static int mtip_service_thread(void *data)
+ * is in progress nor error handling is active
+ */
+ wait_event_interruptible(port->svc_wait, (port->flags) &&
+- !(port->flags & MTIP_PF_PAUSE_IO));
++ (port->flags & MTIP_PF_SVC_THD_WORK));
+
+- set_bit(MTIP_PF_SVC_THD_ACTIVE_BIT, &port->flags);
++ if (kthread_should_stop() ||
++ test_bit(MTIP_PF_SVC_THD_STOP_BIT, &port->flags))
++ goto st_out;
++
++ if (unlikely(test_bit(MTIP_DDF_REMOVE_PENDING_BIT,
++ &dd->dd_flag)))
++ goto st_out;
+
+ if (kthread_should_stop() ||
+ test_bit(MTIP_PF_SVC_THD_STOP_BIT, &port->flags))
+@@ -2962,6 +2968,8 @@ static int mtip_service_thread(void *data)
+ &dd->dd_flag)))
+ goto st_out;
+
++ set_bit(MTIP_PF_SVC_THD_ACTIVE_BIT, &port->flags);
++
+ restart_eh:
+ /* Demux bits: start with error handling */
+ if (test_bit(MTIP_PF_EH_ACTIVE_BIT, &port->flags)) {
+@@ -3004,10 +3012,8 @@ restart_eh:
+ }
+
+ if (test_bit(MTIP_PF_REBUILD_BIT, &port->flags)) {
+- if (mtip_ftl_rebuild_poll(dd) < 0)
+- set_bit(MTIP_DDF_REBUILD_FAILED_BIT,
+- &dd->dd_flag);
+- clear_bit(MTIP_PF_REBUILD_BIT, &port->flags);
++ if (mtip_ftl_rebuild_poll(dd) == 0)
++ clear_bit(MTIP_PF_REBUILD_BIT, &port->flags);
+ }
+ }
+
+@@ -3886,7 +3892,6 @@ static int mtip_block_initialize(struct driver_data *dd)
+
+ mtip_hw_debugfs_init(dd);
+
+-skip_create_disk:
+ memset(&dd->tags, 0, sizeof(dd->tags));
+ dd->tags.ops = &mtip_mq_ops;
+ dd->tags.nr_hw_queues = 1;
+@@ -3916,6 +3921,7 @@ skip_create_disk:
+ dd->disk->queue = dd->queue;
+ dd->queue->queuedata = dd;
+
++skip_create_disk:
+ /* Initialize the protocol layer. */
+ wait_for_rebuild = mtip_hw_get_identify(dd);
+ if (wait_for_rebuild < 0) {
+@@ -4077,7 +4083,8 @@ static int mtip_block_remove(struct driver_data *dd)
+ dd->bdev = NULL;
+ }
+ if (dd->disk) {
+- del_gendisk(dd->disk);
++ if (test_bit(MTIP_DDF_INIT_DONE_BIT, &dd->dd_flag))
++ del_gendisk(dd->disk);
+ if (dd->disk->queue) {
+ blk_cleanup_queue(dd->queue);
+ blk_mq_free_tag_set(&dd->tags);
+@@ -4118,7 +4125,8 @@ static int mtip_block_shutdown(struct driver_data *dd)
+ dev_info(&dd->pdev->dev,
+ "Shutting down %s ...\n", dd->disk->disk_name);
+
+- del_gendisk(dd->disk);
++ if (test_bit(MTIP_DDF_INIT_DONE_BIT, &dd->dd_flag))
++ del_gendisk(dd->disk);
+ if (dd->disk->queue) {
+ blk_cleanup_queue(dd->queue);
+ blk_mq_free_tag_set(&dd->tags);
+diff --git a/drivers/block/mtip32xx/mtip32xx.h b/drivers/block/mtip32xx/mtip32xx.h
+index 76695265dffb..578ad36c9913 100644
+--- a/drivers/block/mtip32xx/mtip32xx.h
++++ b/drivers/block/mtip32xx/mtip32xx.h
+@@ -145,6 +145,11 @@ enum {
+ MTIP_PF_SR_CLEANUP_BIT = 7,
+ MTIP_PF_SVC_THD_STOP_BIT = 8,
+
++ MTIP_PF_SVC_THD_WORK = ((1 << MTIP_PF_EH_ACTIVE_BIT) |
++ (1 << MTIP_PF_ISSUE_CMDS_BIT) |
++ (1 << MTIP_PF_REBUILD_BIT) |
++ (1 << MTIP_PF_SVC_THD_STOP_BIT)),
++
+ /* below are bit numbers in 'dd_flag' defined in driver_data */
+ MTIP_DDF_SEC_LOCK_BIT = 0,
+ MTIP_DDF_REMOVE_PENDING_BIT = 1,
+diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
+index a98c41f72c63..101232982c58 100644
+--- a/drivers/block/nbd.c
++++ b/drivers/block/nbd.c
+@@ -578,8 +578,8 @@ static void do_nbd_request(struct request_queue *q)
+ BUG_ON(nbd->magic != NBD_MAGIC);
+
+ if (unlikely(!nbd->sock)) {
+- dev_err(disk_to_dev(nbd->disk),
+- "Attempted send on closed socket\n");
++ dev_err_ratelimited(disk_to_dev(nbd->disk),
++ "Attempted send on closed socket\n");
+ req->errors++;
+ nbd_end_request(req);
+ spin_lock_irq(q->queue_lock);
+diff --git a/drivers/block/paride/pd.c b/drivers/block/paride/pd.c
+index d48715b287e6..b0414702e61a 100644
+--- a/drivers/block/paride/pd.c
++++ b/drivers/block/paride/pd.c
+@@ -126,7 +126,7 @@
+ */
+ #include <linux/types.h>
+
+-static bool verbose = 0;
++static int verbose = 0;
+ static int major = PD_MAJOR;
+ static char *name = PD_NAME;
+ static int cluster = 64;
+@@ -161,7 +161,7 @@ enum {D_PRT, D_PRO, D_UNI, D_MOD, D_GEO, D_SBY, D_DLY, D_SLV};
+ static DEFINE_MUTEX(pd_mutex);
+ static DEFINE_SPINLOCK(pd_lock);
+
+-module_param(verbose, bool, 0);
++module_param(verbose, int, 0);
+ module_param(major, int, 0);
+ module_param(name, charp, 0);
+ module_param(cluster, int, 0);
+diff --git a/drivers/block/paride/pt.c b/drivers/block/paride/pt.c
+index 2596042eb987..ada45058e04d 100644
+--- a/drivers/block/paride/pt.c
++++ b/drivers/block/paride/pt.c
+@@ -117,7 +117,7 @@
+
+ */
+
+-static bool verbose = 0;
++static int verbose = 0;
+ static int major = PT_MAJOR;
+ static char *name = PT_NAME;
+ static int disable = 0;
+@@ -152,7 +152,7 @@ static int (*drives[4])[6] = {&drive0, &drive1, &drive2, &drive3};
+
+ #include <asm/uaccess.h>
+
+-module_param(verbose, bool, 0);
++module_param(verbose, int, 0);
+ module_param(major, int, 0);
+ module_param(name, charp, 0);
+ module_param_array(drive0, int, NULL, 0);
+diff --git a/drivers/clk/qcom/gcc-msm8960.c b/drivers/clk/qcom/gcc-msm8960.c
+index 007534f7a2d7..9004a4e88800 100644
+--- a/drivers/clk/qcom/gcc-msm8960.c
++++ b/drivers/clk/qcom/gcc-msm8960.c
+@@ -2740,7 +2740,7 @@ static struct clk_rcg ce3_src = {
+ },
+ .freq_tbl = clk_tbl_ce3,
+ .clkr = {
+- .enable_reg = 0x2c08,
++ .enable_reg = 0x36c0,
+ .enable_mask = BIT(7),
+ .hw.init = &(struct clk_init_data){
+ .name = "ce3_src",
+@@ -2756,7 +2756,7 @@ static struct clk_branch ce3_core_clk = {
+ .halt_reg = 0x2fdc,
+ .halt_bit = 5,
+ .clkr = {
+- .enable_reg = 0x36c4,
++ .enable_reg = 0x36cc,
+ .enable_mask = BIT(4),
+ .hw.init = &(struct clk_init_data){
+ .name = "ce3_core_clk",
+diff --git a/drivers/clk/rockchip/clk.c b/drivers/clk/rockchip/clk.c
+index 880a266f0143..a25261aaf793 100644
+--- a/drivers/clk/rockchip/clk.c
++++ b/drivers/clk/rockchip/clk.c
+@@ -70,7 +70,7 @@ static struct clk *rockchip_clk_register_branch(const char *name,
+ if (gate_offset >= 0) {
+ gate = kzalloc(sizeof(*gate), GFP_KERNEL);
+ if (!gate)
+- return ERR_PTR(-ENOMEM);
++ goto err_gate;
+
+ gate->flags = gate_flags;
+ gate->reg = base + gate_offset;
+@@ -82,7 +82,7 @@ static struct clk *rockchip_clk_register_branch(const char *name,
+ if (div_width > 0) {
+ div = kzalloc(sizeof(*div), GFP_KERNEL);
+ if (!div)
+- return ERR_PTR(-ENOMEM);
++ goto err_div;
+
+ div->flags = div_flags;
+ div->reg = base + muxdiv_offset;
+@@ -100,6 +100,11 @@ static struct clk *rockchip_clk_register_branch(const char *name,
+ flags);
+
+ return clk;
++err_div:
++ kfree(gate);
++err_gate:
++ kfree(mux);
++ return ERR_PTR(-ENOMEM);
+ }
+
+ static struct clk *rockchip_clk_register_frac_branch(const char *name,
+diff --git a/drivers/clk/versatile/clk-sp810.c b/drivers/clk/versatile/clk-sp810.c
+index 5122ef25f595..e63c3ef9b5ec 100644
+--- a/drivers/clk/versatile/clk-sp810.c
++++ b/drivers/clk/versatile/clk-sp810.c
+@@ -141,6 +141,7 @@ void __init clk_sp810_of_setup(struct device_node *node)
+ const char *parent_names[2];
+ char name[12];
+ struct clk_init_data init;
++ static int instance;
+ int i;
+
+ if (!sp810) {
+@@ -172,7 +173,7 @@ void __init clk_sp810_of_setup(struct device_node *node)
+ init.num_parents = ARRAY_SIZE(parent_names);
+
+ for (i = 0; i < ARRAY_SIZE(sp810->timerclken); i++) {
+- snprintf(name, ARRAY_SIZE(name), "timerclken%d", i);
++ snprintf(name, sizeof(name), "sp810_%d_%d", instance, i);
+
+ sp810->timerclken[i].sp810 = sp810;
+ sp810->timerclken[i].channel = i;
+@@ -184,5 +185,6 @@ void __init clk_sp810_of_setup(struct device_node *node)
+ }
+
+ of_clk_add_provider(node, clk_sp810_timerclken_of_get, sp810);
++ instance++;
+ }
+ CLK_OF_DECLARE(sp810, "arm,sp810", clk_sp810_of_setup);
+diff --git a/drivers/crypto/ux500/hash/hash_core.c b/drivers/crypto/ux500/hash/hash_core.c
+index 8e5e0187506f..3ff21c3e9ab2 100644
+--- a/drivers/crypto/ux500/hash/hash_core.c
++++ b/drivers/crypto/ux500/hash/hash_core.c
+@@ -797,7 +797,7 @@ static int hash_process_data(struct hash_device_data *device_data,
+ &device_data->state);
+ memmove(req_ctx->state.buffer,
+ device_data->state.buffer,
+- HASH_BLOCK_SIZE / sizeof(u32));
++ HASH_BLOCK_SIZE);
+ if (ret) {
+ dev_err(device_data->dev,
+ "%s: hash_resume_state() failed!\n",
+@@ -848,7 +848,7 @@ static int hash_process_data(struct hash_device_data *device_data,
+
+ memmove(device_data->state.buffer,
+ req_ctx->state.buffer,
+- HASH_BLOCK_SIZE / sizeof(u32));
++ HASH_BLOCK_SIZE);
+ if (ret) {
+ dev_err(device_data->dev, "%s: hash_save_state() failed!\n",
+ __func__);
+diff --git a/drivers/firmware/efi/efi.c b/drivers/firmware/efi/efi.c
+index 8590099ac148..71e090c8c85e 100644
+--- a/drivers/firmware/efi/efi.c
++++ b/drivers/firmware/efi/efi.c
+@@ -154,6 +154,7 @@ static int generic_ops_register(void)
+ {
+ generic_ops.get_variable = efi.get_variable;
+ generic_ops.set_variable = efi.set_variable;
++ generic_ops.set_variable_nonblocking = efi.set_variable_nonblocking;
+ generic_ops.get_next_variable = efi.get_next_variable;
+ generic_ops.query_variable_store = efi_query_variable_store;
+
+diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
+index c2d76fed3abf..234e89c013dd 100644
+--- a/drivers/gpu/drm/i915/intel_display.c
++++ b/drivers/gpu/drm/i915/intel_display.c
+@@ -6526,12 +6526,14 @@ static void ironlake_init_pch_refclk(struct drm_device *dev)
+ {
+ struct drm_i915_private *dev_priv = dev->dev_private;
+ struct intel_encoder *encoder;
++ int i;
+ u32 val, final;
+ bool has_lvds = false;
+ bool has_cpu_edp = false;
+ bool has_panel = false;
+ bool has_ck505 = false;
+ bool can_ssc = false;
++ bool using_ssc_source = false;
+
+ /* We need to take the global config into account */
+ for_each_intel_encoder(dev, encoder) {
+@@ -6556,8 +6558,22 @@ static void ironlake_init_pch_refclk(struct drm_device *dev)
+ can_ssc = true;
+ }
+
+- DRM_DEBUG_KMS("has_panel %d has_lvds %d has_ck505 %d\n",
+- has_panel, has_lvds, has_ck505);
++ /* Check if any DPLLs are using the SSC source */
++ for (i = 0; i < dev_priv->num_shared_dpll; i++) {
++ u32 temp = I915_READ(PCH_DPLL(i));
++
++ if (!(temp & DPLL_VCO_ENABLE))
++ continue;
++
++ if ((temp & PLL_REF_INPUT_MASK) ==
++ PLLB_REF_INPUT_SPREADSPECTRUMIN) {
++ using_ssc_source = true;
++ break;
++ }
++ }
++
++ DRM_DEBUG_KMS("has_panel %d has_lvds %d has_ck505 %d using_ssc_source %d\n",
++ has_panel, has_lvds, has_ck505, using_ssc_source);
+
+ /* Ironlake: try to setup display ref clock before DPLL
+ * enabling. This is only under driver's control after
+@@ -6594,9 +6610,9 @@ static void ironlake_init_pch_refclk(struct drm_device *dev)
+ final |= DREF_CPU_SOURCE_OUTPUT_NONSPREAD;
+ } else
+ final |= DREF_CPU_SOURCE_OUTPUT_DISABLE;
+- } else {
+- final |= DREF_SSC_SOURCE_DISABLE;
+- final |= DREF_CPU_SOURCE_OUTPUT_DISABLE;
++ } else if (using_ssc_source) {
++ final |= DREF_SSC_SOURCE_ENABLE;
++ final |= DREF_SSC1_ENABLE;
+ }
+
+ if (final == val)
+@@ -6642,7 +6658,7 @@ static void ironlake_init_pch_refclk(struct drm_device *dev)
+ POSTING_READ(PCH_DREF_CONTROL);
+ udelay(200);
+ } else {
+- DRM_DEBUG_KMS("Disabling SSC entirely\n");
++ DRM_DEBUG_KMS("Disabling CPU source output\n");
+
+ val &= ~DREF_CPU_SOURCE_OUTPUT_MASK;
+
+@@ -6653,16 +6669,20 @@ static void ironlake_init_pch_refclk(struct drm_device *dev)
+ POSTING_READ(PCH_DREF_CONTROL);
+ udelay(200);
+
+- /* Turn off the SSC source */
+- val &= ~DREF_SSC_SOURCE_MASK;
+- val |= DREF_SSC_SOURCE_DISABLE;
++ if (!using_ssc_source) {
++ DRM_DEBUG_KMS("Disabling SSC source\n");
+
+- /* Turn off SSC1 */
+- val &= ~DREF_SSC1_ENABLE;
++ /* Turn off the SSC source */
++ val &= ~DREF_SSC_SOURCE_MASK;
++ val |= DREF_SSC_SOURCE_DISABLE;
+
+- I915_WRITE(PCH_DREF_CONTROL, val);
+- POSTING_READ(PCH_DREF_CONTROL);
+- udelay(200);
++ /* Turn off SSC1 */
++ val &= ~DREF_SSC1_ENABLE;
++
++ I915_WRITE(PCH_DREF_CONTROL, val);
++ POSTING_READ(PCH_DREF_CONTROL);
++ udelay(200);
++ }
+ }
+
+ BUG_ON(val != final);
+diff --git a/drivers/gpu/drm/nouveau/nouveau_fbcon.c b/drivers/gpu/drm/nouveau/nouveau_fbcon.c
+index ff6358f8a9c6..993c9a0377da 100644
+--- a/drivers/gpu/drm/nouveau/nouveau_fbcon.c
++++ b/drivers/gpu/drm/nouveau/nouveau_fbcon.c
+@@ -568,7 +568,8 @@ nouveau_fbcon_init(struct drm_device *dev)
+ if (ret)
+ goto fini;
+
+- fbcon->helper.fbdev->pixmap.buf_align = 4;
++ if (fbcon->helper.fbdev)
++ fbcon->helper.fbdev->pixmap.buf_align = 4;
+ return 0;
+
+ fini:
+diff --git a/drivers/gpu/drm/radeon/atombios_crtc.c b/drivers/gpu/drm/radeon/atombios_crtc.c
+index ce8cab52285b..2f2e50a0feb4 100644
+--- a/drivers/gpu/drm/radeon/atombios_crtc.c
++++ b/drivers/gpu/drm/radeon/atombios_crtc.c
+@@ -1730,6 +1730,7 @@ static u32 radeon_get_pll_use_mask(struct drm_crtc *crtc)
+ static int radeon_get_shared_dp_ppll(struct drm_crtc *crtc)
+ {
+ struct drm_device *dev = crtc->dev;
++ struct radeon_device *rdev = dev->dev_private;
+ struct drm_crtc *test_crtc;
+ struct radeon_crtc *test_radeon_crtc;
+
+@@ -1739,6 +1740,10 @@ static int radeon_get_shared_dp_ppll(struct drm_crtc *crtc)
+ test_radeon_crtc = to_radeon_crtc(test_crtc);
+ if (test_radeon_crtc->encoder &&
+ ENCODER_MODE_IS_DP(atombios_get_encoder_mode(test_radeon_crtc->encoder))) {
++ /* PPLL2 is exclusive to UNIPHYA on DCE61 */
++ if (ASIC_IS_DCE61(rdev) && !ASIC_IS_DCE8(rdev) &&
++ test_radeon_crtc->pll_id == ATOM_PPLL2)
++ continue;
+ /* for DP use the same PLL for all */
+ if (test_radeon_crtc->pll_id != ATOM_PPLL_INVALID)
+ return test_radeon_crtc->pll_id;
+@@ -1760,6 +1765,7 @@ static int radeon_get_shared_nondp_ppll(struct drm_crtc *crtc)
+ {
+ struct radeon_crtc *radeon_crtc = to_radeon_crtc(crtc);
+ struct drm_device *dev = crtc->dev;
++ struct radeon_device *rdev = dev->dev_private;
+ struct drm_crtc *test_crtc;
+ struct radeon_crtc *test_radeon_crtc;
+ u32 adjusted_clock, test_adjusted_clock;
+@@ -1775,6 +1781,10 @@ static int radeon_get_shared_nondp_ppll(struct drm_crtc *crtc)
+ test_radeon_crtc = to_radeon_crtc(test_crtc);
+ if (test_radeon_crtc->encoder &&
+ !ENCODER_MODE_IS_DP(atombios_get_encoder_mode(test_radeon_crtc->encoder))) {
++ /* PPLL2 is exclusive to UNIPHYA on DCE61 */
++ if (ASIC_IS_DCE61(rdev) && !ASIC_IS_DCE8(rdev) &&
++ test_radeon_crtc->pll_id == ATOM_PPLL2)
++ continue;
+ /* check if we are already driving this connector with another crtc */
+ if (test_radeon_crtc->connector == radeon_crtc->connector) {
+ /* if we are, return that pll */
+diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
+index 5d54ab0fbe2b..6b99d3956baa 100644
+--- a/drivers/gpu/drm/radeon/radeon_device.c
++++ b/drivers/gpu/drm/radeon/radeon_device.c
+@@ -599,6 +599,23 @@ void radeon_gtt_location(struct radeon_device *rdev, struct radeon_mc *mc)
+ /*
+ * GPU helpers function.
+ */
++
++/**
++ * radeon_device_is_virtual - check if we are running is a virtual environment
++ *
++ * Check if the asic has been passed through to a VM (all asics).
++ * Used at driver startup.
++ * Returns true if virtual or false if not.
++ */
++static bool radeon_device_is_virtual(void)
++{
++#ifdef CONFIG_X86
++ return boot_cpu_has(X86_FEATURE_HYPERVISOR);
++#else
++ return false;
++#endif
++}
++
+ /**
+ * radeon_card_posted - check if the hw has already been initialized
+ *
+@@ -612,6 +629,10 @@ bool radeon_card_posted(struct radeon_device *rdev)
+ {
+ uint32_t reg;
+
++ /* for pass through, always force asic_init */
++ if (radeon_device_is_virtual())
++ return false;
++
+ /* required for EFI mode on macbook2,1 which uses an r5xx asic */
+ if (efi_enabled(EFI_BOOT) &&
+ (rdev->pdev->subsystem_vendor == PCI_VENDOR_ID_APPLE) &&
+diff --git a/drivers/gpu/drm/radeon/si_dpm.c b/drivers/gpu/drm/radeon/si_dpm.c
+index 481e718086fc..c3530caa7ddd 100644
+--- a/drivers/gpu/drm/radeon/si_dpm.c
++++ b/drivers/gpu/drm/radeon/si_dpm.c
+@@ -2922,6 +2922,7 @@ static struct si_dpm_quirk si_dpm_quirk_list[] = {
+ /* PITCAIRN - https://bugs.freedesktop.org/show_bug.cgi?id=76490 */
+ { PCI_VENDOR_ID_ATI, 0x6810, 0x1462, 0x3036, 0, 120000 },
+ { PCI_VENDOR_ID_ATI, 0x6811, 0x174b, 0xe271, 0, 120000 },
++ { PCI_VENDOR_ID_ATI, 0x6811, 0x174b, 0x2015, 0, 120000 },
+ { PCI_VENDOR_ID_ATI, 0x6810, 0x174b, 0xe271, 85000, 90000 },
+ { PCI_VENDOR_ID_ATI, 0x6811, 0x1762, 0x2015, 0, 120000 },
+ { PCI_VENDOR_ID_ATI, 0x6811, 0x1043, 0x2015, 0, 120000 },
+@@ -2956,6 +2957,10 @@ static void si_apply_state_adjust_rules(struct radeon_device *rdev,
+ }
+ ++p;
+ }
++ /* limit mclk on all R7 370 parts for stability */
++ if (rdev->pdev->device == 0x6811 &&
++ rdev->pdev->revision == 0x81)
++ max_mclk = 120000;
+
+ if ((rdev->pm.dpm.new_active_crtc_count > 1) ||
+ ni_dpm_vblank_too_short(rdev))
+diff --git a/drivers/gpu/drm/udl/udl_fb.c b/drivers/gpu/drm/udl/udl_fb.c
+index 5fc16cecd3ba..cd8d183dcfe5 100644
+--- a/drivers/gpu/drm/udl/udl_fb.c
++++ b/drivers/gpu/drm/udl/udl_fb.c
+@@ -546,7 +546,7 @@ static int udlfb_create(struct drm_fb_helper *helper,
+
+ return ret;
+ out_gfree:
+- drm_gem_object_unreference(&ufbdev->ufb.obj->base);
++ drm_gem_object_unreference_unlocked(&ufbdev->ufb.obj->base);
+ out:
+ return ret;
+ }
+diff --git a/drivers/gpu/drm/udl/udl_gem.c b/drivers/gpu/drm/udl/udl_gem.c
+index 8044f5fb7c49..6de963b70eee 100644
+--- a/drivers/gpu/drm/udl/udl_gem.c
++++ b/drivers/gpu/drm/udl/udl_gem.c
+@@ -51,7 +51,7 @@ udl_gem_create(struct drm_file *file,
+ return ret;
+ }
+
+- drm_gem_object_unreference(&obj->base);
++ drm_gem_object_unreference_unlocked(&obj->base);
+ *handle_p = handle;
+ return 0;
+ }
+diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
+index cb4bc0dadba5..19a3a12f3257 100644
+--- a/drivers/hid/hid-core.c
++++ b/drivers/hid/hid-core.c
+@@ -1834,6 +1834,7 @@ static const struct hid_device_id hid_have_special_driver[] = {
+ { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_ELITE_KBD) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_CORDLESS_DESKTOP_LX500) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_EXTREME_3D) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_DUAL_ACTION) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_WHEEL) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_RUMBLEPAD_CORD) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_RUMBLEPAD) },
+diff --git a/drivers/hid/hid-elo.c b/drivers/hid/hid-elo.c
+index 4e49462870ab..d0c8a1c1e1fe 100644
+--- a/drivers/hid/hid-elo.c
++++ b/drivers/hid/hid-elo.c
+@@ -259,7 +259,7 @@ static void elo_remove(struct hid_device *hdev)
+ struct elo_priv *priv = hid_get_drvdata(hdev);
+
+ hid_hw_stop(hdev);
+- flush_workqueue(wq);
++ cancel_delayed_work_sync(&priv->work);
+ kfree(priv);
+ }
+
+diff --git a/drivers/hid/usbhid/hiddev.c b/drivers/hid/usbhid/hiddev.c
+index 2f1ddca6f2e0..700145b15088 100644
+--- a/drivers/hid/usbhid/hiddev.c
++++ b/drivers/hid/usbhid/hiddev.c
+@@ -516,13 +516,13 @@ static noinline int hiddev_ioctl_usage(struct hiddev *hiddev, unsigned int cmd,
+ goto inval;
+ } else if (uref->usage_index >= field->report_count)
+ goto inval;
+-
+- else if ((cmd == HIDIOCGUSAGES || cmd == HIDIOCSUSAGES) &&
+- (uref_multi->num_values > HID_MAX_MULTI_USAGES ||
+- uref->usage_index + uref_multi->num_values > field->report_count))
+- goto inval;
+ }
+
++ if ((cmd == HIDIOCGUSAGES || cmd == HIDIOCSUSAGES) &&
++ (uref_multi->num_values > HID_MAX_MULTI_USAGES ||
++ uref->usage_index + uref_multi->num_values > field->report_count))
++ goto inval;
++
+ switch (cmd) {
+ case HIDIOCGUSAGE:
+ uref->value = field->value[uref->usage_index];
+diff --git a/drivers/hwmon/max1111.c b/drivers/hwmon/max1111.c
+index f67d71ee8386..159f50d0ae39 100644
+--- a/drivers/hwmon/max1111.c
++++ b/drivers/hwmon/max1111.c
+@@ -85,6 +85,9 @@ static struct max1111_data *the_max1111;
+
+ int max1111_read_channel(int channel)
+ {
++ if (!the_max1111 || !the_max1111->spi)
++ return -ENODEV;
++
+ return max1111_read(&the_max1111->spi->dev, channel);
+ }
+ EXPORT_SYMBOL(max1111_read_channel);
+@@ -258,6 +261,9 @@ static int max1111_remove(struct spi_device *spi)
+ {
+ struct max1111_data *data = spi_get_drvdata(spi);
+
++#ifdef CONFIG_SHARPSL_PM
++ the_max1111 = NULL;
++#endif
+ hwmon_device_unregister(data->hwmon_dev);
+ sysfs_remove_group(&spi->dev.kobj, &max1110_attr_group);
+ sysfs_remove_group(&spi->dev.kobj, &max1111_attr_group);
+diff --git a/drivers/i2c/busses/i2c-exynos5.c b/drivers/i2c/busses/i2c-exynos5.c
+index 81e6263cd7da..91a6362bbef6 100644
+--- a/drivers/i2c/busses/i2c-exynos5.c
++++ b/drivers/i2c/busses/i2c-exynos5.c
+@@ -671,7 +671,9 @@ static int exynos5_i2c_xfer(struct i2c_adapter *adap,
+ return -EIO;
+ }
+
+- clk_prepare_enable(i2c->clk);
++ ret = clk_enable(i2c->clk);
++ if (ret)
++ return ret;
+
+ for (i = 0; i < num; i++, msgs++) {
+ stop = (i == num - 1);
+@@ -695,7 +697,7 @@ static int exynos5_i2c_xfer(struct i2c_adapter *adap,
+ }
+
+ out:
+- clk_disable_unprepare(i2c->clk);
++ clk_disable(i2c->clk);
+ return ret;
+ }
+
+@@ -747,7 +749,9 @@ static int exynos5_i2c_probe(struct platform_device *pdev)
+ return -ENOENT;
+ }
+
+- clk_prepare_enable(i2c->clk);
++ ret = clk_prepare_enable(i2c->clk);
++ if (ret)
++ return ret;
+
+ mem = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+ i2c->regs = devm_ioremap_resource(&pdev->dev, mem);
+@@ -799,6 +803,10 @@ static int exynos5_i2c_probe(struct platform_device *pdev)
+
+ platform_set_drvdata(pdev, i2c);
+
++ clk_disable(i2c->clk);
++
++ return 0;
++
+ err_clk:
+ clk_disable_unprepare(i2c->clk);
+ return ret;
+@@ -810,6 +818,8 @@ static int exynos5_i2c_remove(struct platform_device *pdev)
+
+ i2c_del_adapter(&i2c->adap);
+
++ clk_unprepare(i2c->clk);
++
+ return 0;
+ }
+
+@@ -821,6 +831,8 @@ static int exynos5_i2c_suspend_noirq(struct device *dev)
+
+ i2c->suspended = 1;
+
++ clk_unprepare(i2c->clk);
++
+ return 0;
+ }
+
+@@ -830,7 +842,9 @@ static int exynos5_i2c_resume_noirq(struct device *dev)
+ struct exynos5_i2c *i2c = platform_get_drvdata(pdev);
+ int ret = 0;
+
+- clk_prepare_enable(i2c->clk);
++ ret = clk_prepare_enable(i2c->clk);
++ if (ret)
++ return ret;
+
+ ret = exynos5_hsi2c_clock_setup(i2c);
+ if (ret) {
+@@ -839,7 +853,7 @@ static int exynos5_i2c_resume_noirq(struct device *dev)
+ }
+
+ exynos5_i2c_init(i2c);
+- clk_disable_unprepare(i2c->clk);
++ clk_disable(i2c->clk);
+ i2c->suspended = 0;
+
+ return 0;
+diff --git a/drivers/infiniband/hw/mlx4/ah.c b/drivers/infiniband/hw/mlx4/ah.c
+index e65ee1947279..b33fa45a13cc 100644
+--- a/drivers/infiniband/hw/mlx4/ah.c
++++ b/drivers/infiniband/hw/mlx4/ah.c
+@@ -46,6 +46,7 @@ static struct ib_ah *create_ib_ah(struct ib_pd *pd, struct ib_ah_attr *ah_attr,
+
+ ah->av.ib.port_pd = cpu_to_be32(to_mpd(pd)->pdn | (ah_attr->port_num << 24));
+ ah->av.ib.g_slid = ah_attr->src_path_bits;
++ ah->av.ib.sl_tclass_flowlabel = cpu_to_be32(ah_attr->sl << 28);
+ if (ah_attr->ah_flags & IB_AH_GRH) {
+ ah->av.ib.g_slid |= 0x80;
+ ah->av.ib.gid_index = ah_attr->grh.sgid_index;
+@@ -63,7 +64,6 @@ static struct ib_ah *create_ib_ah(struct ib_pd *pd, struct ib_ah_attr *ah_attr,
+ !(1 << ah->av.ib.stat_rate & dev->caps.stat_rate_support))
+ --ah->av.ib.stat_rate;
+ }
+- ah->av.ib.sl_tclass_flowlabel = cpu_to_be32(ah_attr->sl << 28);
+
+ return &ah->ibah;
+ }
+diff --git a/drivers/input/misc/pmic8xxx-pwrkey.c b/drivers/input/misc/pmic8xxx-pwrkey.c
+index c91e3d33aea9..88db9204bac2 100644
+--- a/drivers/input/misc/pmic8xxx-pwrkey.c
++++ b/drivers/input/misc/pmic8xxx-pwrkey.c
+@@ -94,7 +94,8 @@ static int pmic8xxx_pwrkey_probe(struct platform_device *pdev)
+ if (of_property_read_u32(pdev->dev.of_node, "debounce", &kpd_delay))
+ kpd_delay = 15625;
+
+- if (kpd_delay > 62500 || kpd_delay == 0) {
++ /* Valid range of pwr key trigger delay is 1/64 sec to 2 seconds. */
++ if (kpd_delay > USEC_PER_SEC * 2 || kpd_delay < USEC_PER_SEC / 64) {
+ dev_err(&pdev->dev, "invalid power key trigger delay\n");
+ return -EINVAL;
+ }
+@@ -124,8 +125,8 @@ static int pmic8xxx_pwrkey_probe(struct platform_device *pdev)
+ pwr->name = "pmic8xxx_pwrkey";
+ pwr->phys = "pmic8xxx_pwrkey/input0";
+
+- delay = (kpd_delay << 10) / USEC_PER_SEC;
+- delay = 1 + ilog2(delay);
++ delay = (kpd_delay << 6) / USEC_PER_SEC;
++ delay = ilog2(delay);
+
+ err = regmap_read(regmap, PON_CNTL_1, &pon_cntl);
+ if (err < 0) {
+diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c
+index b3b2a137e55e..8c964907d291 100644
+--- a/drivers/input/mouse/elantech.c
++++ b/drivers/input/mouse/elantech.c
+@@ -1550,12 +1550,7 @@ static int elantech_set_properties(struct elantech_data *etd)
+ case 5:
+ etd->hw_version = 3;
+ break;
+- case 6:
+- case 7:
+- case 8:
+- case 9:
+- case 10:
+- case 13:
++ case 6 ... 14:
+ etd->hw_version = 4;
+ break;
+ default:
+diff --git a/drivers/input/touchscreen/wacom_w8001.c b/drivers/input/touchscreen/wacom_w8001.c
+index 2792ca397dd0..3ed0ce1e4dcb 100644
+--- a/drivers/input/touchscreen/wacom_w8001.c
++++ b/drivers/input/touchscreen/wacom_w8001.c
+@@ -27,7 +27,7 @@ MODULE_AUTHOR("Jaya Kumar <jayakumar.lkml@gmail.com>");
+ MODULE_DESCRIPTION(DRIVER_DESC);
+ MODULE_LICENSE("GPL");
+
+-#define W8001_MAX_LENGTH 11
++#define W8001_MAX_LENGTH 13
+ #define W8001_LEAD_MASK 0x80
+ #define W8001_LEAD_BYTE 0x80
+ #define W8001_TAB_MASK 0x40
+diff --git a/drivers/input/touchscreen/zforce_ts.c b/drivers/input/touchscreen/zforce_ts.c
+index 8ba48f5eff7b..ce1a855d8b9a 100644
+--- a/drivers/input/touchscreen/zforce_ts.c
++++ b/drivers/input/touchscreen/zforce_ts.c
+@@ -359,8 +359,8 @@ static int zforce_touch_event(struct zforce_ts *ts, u8 *payload)
+ point.coord_x = point.coord_y = 0;
+ }
+
+- point.state = payload[9 * i + 5] & 0x03;
+- point.id = (payload[9 * i + 5] & 0xfc) >> 2;
++ point.state = payload[9 * i + 5] & 0x0f;
++ point.id = (payload[9 * i + 5] & 0xf0) >> 4;
+
+ /* determine touch major, minor and orientation */
+ point.area_major = max(payload[9 * i + 6],
+diff --git a/drivers/media/platform/vsp1/vsp1_sru.c b/drivers/media/platform/vsp1/vsp1_sru.c
+index b7d3c8b9f189..47f1a4879837 100644
+--- a/drivers/media/platform/vsp1/vsp1_sru.c
++++ b/drivers/media/platform/vsp1/vsp1_sru.c
+@@ -154,6 +154,7 @@ static int sru_s_stream(struct v4l2_subdev *subdev, int enable)
+ mutex_lock(sru->ctrls.lock);
+ ctrl0 |= vsp1_sru_read(sru, VI6_SRU_CTRL0)
+ & (VI6_SRU_CTRL0_PARAM0_MASK | VI6_SRU_CTRL0_PARAM1_MASK);
++ vsp1_sru_write(sru, VI6_SRU_CTRL0, ctrl0);
+ mutex_unlock(sru->ctrls.lock);
+
+ vsp1_sru_write(sru, VI6_SRU_CTRL1, VI6_SRU_CTRL1_PARAM5);
+diff --git a/drivers/misc/Kconfig b/drivers/misc/Kconfig
+index bbeb4516facf..878d5430973c 100644
+--- a/drivers/misc/Kconfig
++++ b/drivers/misc/Kconfig
+@@ -429,7 +429,7 @@ config ARM_CHARLCD
+ still useful.
+
+ config BMP085
+- bool
++ tristate
+ depends on SYSFS
+
+ config BMP085_I2C
+diff --git a/drivers/misc/ad525x_dpot.c b/drivers/misc/ad525x_dpot.c
+index a43053daad0e..46272b0ae2dd 100644
+--- a/drivers/misc/ad525x_dpot.c
++++ b/drivers/misc/ad525x_dpot.c
+@@ -215,7 +215,7 @@ static s32 dpot_read_i2c(struct dpot_data *dpot, u8 reg)
+ */
+ value = swab16(value);
+
+- if (dpot->uid == DPOT_UID(AD5271_ID))
++ if (dpot->uid == DPOT_UID(AD5274_ID))
+ value = value >> 2;
+ return value;
+ default:
+diff --git a/drivers/mtd/ubi/eba.c b/drivers/mtd/ubi/eba.c
+index 0aa7087438fa..e40db2fd2da3 100644
+--- a/drivers/mtd/ubi/eba.c
++++ b/drivers/mtd/ubi/eba.c
+@@ -861,7 +861,7 @@ write_error:
+ int ubi_eba_atomic_leb_change(struct ubi_device *ubi, struct ubi_volume *vol,
+ int lnum, const void *buf, int len)
+ {
+- int err, pnum, tries = 0, vol_id = vol->vol_id;
++ int err, pnum, old_pnum, tries = 0, vol_id = vol->vol_id;
+ struct ubi_vid_hdr *vid_hdr;
+ uint32_t crc;
+
+@@ -924,16 +924,17 @@ retry:
+ goto write_error;
+ }
+
+- if (vol->eba_tbl[lnum] >= 0) {
+- err = ubi_wl_put_peb(ubi, vol_id, lnum, vol->eba_tbl[lnum], 0);
+- if (err)
+- goto out_leb_unlock;
+- }
+-
+ down_read(&ubi->fm_sem);
++ old_pnum = vol->eba_tbl[lnum];
+ vol->eba_tbl[lnum] = pnum;
+ up_read(&ubi->fm_sem);
+
++ if (old_pnum >= 0) {
++ err = ubi_wl_put_peb(ubi, vol_id, lnum, old_pnum, 0);
++ if (err)
++ goto out_leb_unlock;
++ }
++
+ out_leb_unlock:
+ leb_write_unlock(ubi, vol_id, lnum);
+ out_mutex:
+diff --git a/drivers/net/can/at91_can.c b/drivers/net/can/at91_can.c
+index 05e1aa090add..2c4e54f764c5 100644
+--- a/drivers/net/can/at91_can.c
++++ b/drivers/net/can/at91_can.c
+@@ -734,9 +734,10 @@ static int at91_poll_rx(struct net_device *dev, int quota)
+
+ /* upper group completed, look again in lower */
+ if (priv->rx_next > get_mb_rx_low_last(priv) &&
+- quota > 0 && mb > get_mb_rx_last(priv)) {
++ mb > get_mb_rx_last(priv)) {
+ priv->rx_next = get_mb_rx_first(priv);
+- goto again;
++ if (quota > 0)
++ goto again;
+ }
+
+ return received;
+diff --git a/drivers/net/can/c_can/c_can.c b/drivers/net/can/c_can/c_can.c
+index 60285820f7b4..055457619c1e 100644
+--- a/drivers/net/can/c_can/c_can.c
++++ b/drivers/net/can/c_can/c_can.c
+@@ -331,9 +331,23 @@ static void c_can_setup_tx_object(struct net_device *dev, int iface,
+
+ priv->write_reg(priv, C_CAN_IFACE(MSGCTRL_REG, iface), ctrl);
+
+- for (i = 0; i < frame->can_dlc; i += 2) {
+- priv->write_reg(priv, C_CAN_IFACE(DATA1_REG, iface) + i / 2,
+- frame->data[i] | (frame->data[i + 1] << 8));
++ if (priv->type == BOSCH_D_CAN) {
++ u32 data = 0, dreg = C_CAN_IFACE(DATA1_REG, iface);
++
++ for (i = 0; i < frame->can_dlc; i += 4, dreg += 2) {
++ data = (u32)frame->data[i];
++ data |= (u32)frame->data[i + 1] << 8;
++ data |= (u32)frame->data[i + 2] << 16;
++ data |= (u32)frame->data[i + 3] << 24;
++ priv->write_reg32(priv, dreg, data);
++ }
++ } else {
++ for (i = 0; i < frame->can_dlc; i += 2) {
++ priv->write_reg(priv,
++ C_CAN_IFACE(DATA1_REG, iface) + i / 2,
++ frame->data[i] |
++ (frame->data[i + 1] << 8));
++ }
+ }
+ }
+
+@@ -401,10 +415,20 @@ static int c_can_read_msg_object(struct net_device *dev, int iface, u32 ctrl)
+ } else {
+ int i, dreg = C_CAN_IFACE(DATA1_REG, iface);
+
+- for (i = 0; i < frame->can_dlc; i += 2, dreg ++) {
+- data = priv->read_reg(priv, dreg);
+- frame->data[i] = data;
+- frame->data[i + 1] = data >> 8;
++ if (priv->type == BOSCH_D_CAN) {
++ for (i = 0; i < frame->can_dlc; i += 4, dreg += 2) {
++ data = priv->read_reg32(priv, dreg);
++ frame->data[i] = data;
++ frame->data[i + 1] = data >> 8;
++ frame->data[i + 2] = data >> 16;
++ frame->data[i + 3] = data >> 24;
++ }
++ } else {
++ for (i = 0; i < frame->can_dlc; i += 2, dreg++) {
++ data = priv->read_reg(priv, dreg);
++ frame->data[i] = data;
++ frame->data[i + 1] = data >> 8;
++ }
+ }
+ }
+
+diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c
+index 80185ebc7a43..bcefb375d232 100644
+--- a/drivers/net/can/dev.c
++++ b/drivers/net/can/dev.c
+@@ -717,6 +717,9 @@ static int can_validate(struct nlattr *tb[], struct nlattr *data[])
+ * - control mode with CAN_CTRLMODE_FD set
+ */
+
++ if (!data)
++ return 0;
++
+ if (data[IFLA_CAN_CTRLMODE]) {
+ struct can_ctrlmode *cm = nla_data(data[IFLA_CAN_CTRLMODE]);
+
+@@ -927,6 +930,11 @@ static int can_newlink(struct net *src_net, struct net_device *dev,
+ return -EOPNOTSUPP;
+ }
+
++static void can_dellink(struct net_device *dev, struct list_head *head)
++{
++ return;
++}
++
+ static struct rtnl_link_ops can_link_ops __read_mostly = {
+ .kind = "can",
+ .maxtype = IFLA_CAN_MAX,
+@@ -935,6 +943,7 @@ static struct rtnl_link_ops can_link_ops __read_mostly = {
+ .validate = can_validate,
+ .newlink = can_newlink,
+ .changelink = can_changelink,
++ .dellink = can_dellink,
+ .get_size = can_get_size,
+ .fill_info = can_fill_info,
+ .get_xstats_size = can_get_xstats_size,
+diff --git a/drivers/net/ethernet/atheros/atlx/atl2.c b/drivers/net/ethernet/atheros/atlx/atl2.c
+index 84a09e8ddd9c..5086ec9214c3 100644
+--- a/drivers/net/ethernet/atheros/atlx/atl2.c
++++ b/drivers/net/ethernet/atheros/atlx/atl2.c
+@@ -1412,7 +1412,7 @@ static int atl2_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+
+ err = -EIO;
+
+- netdev->hw_features = NETIF_F_SG | NETIF_F_HW_VLAN_CTAG_RX;
++ netdev->hw_features = NETIF_F_HW_VLAN_CTAG_RX;
+ netdev->features |= (NETIF_F_HW_VLAN_CTAG_TX | NETIF_F_HW_VLAN_CTAG_RX);
+
+ /* Init PHY as early as possible due to power saving issue */
+diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+index bb27028d392b..1db35f8053a1 100644
+--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c
++++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+@@ -912,7 +912,7 @@ static unsigned int __bcmgenet_tx_reclaim(struct net_device *dev,
+ dev->stats.tx_bytes += tx_cb_ptr->skb->len;
+ dma_unmap_single(&dev->dev,
+ dma_unmap_addr(tx_cb_ptr, dma_addr),
+- tx_cb_ptr->skb->len,
++ dma_unmap_len(tx_cb_ptr, dma_len),
+ DMA_TO_DEVICE);
+ bcmgenet_free_cb(tx_cb_ptr);
+ } else if (dma_unmap_addr(tx_cb_ptr, dma_addr)) {
+@@ -1019,7 +1019,7 @@ static int bcmgenet_xmit_single(struct net_device *dev,
+ }
+
+ dma_unmap_addr_set(tx_cb_ptr, dma_addr, mapping);
+- dma_unmap_len_set(tx_cb_ptr, dma_len, skb->len);
++ dma_unmap_len_set(tx_cb_ptr, dma_len, skb_len);
+ length_status = (skb_len << DMA_BUFLENGTH_SHIFT) | dma_desc_flags |
+ (priv->hw_params->qtag_mask << DMA_TX_QTAG_SHIFT) |
+ DMA_TX_APPEND_CRC;
+diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
+index 96ba23e90111..2ee3c9537772 100644
+--- a/drivers/net/ethernet/freescale/fec_main.c
++++ b/drivers/net/ethernet/freescale/fec_main.c
+@@ -1539,9 +1539,15 @@ fec_enet_rx(struct net_device *ndev, int budget)
+ struct fec_enet_private *fep = netdev_priv(ndev);
+
+ for_each_set_bit(queue_id, &fep->work_rx, FEC_ENET_MAX_RX_QS) {
+- clear_bit(queue_id, &fep->work_rx);
+- pkt_received += fec_enet_rx_queue(ndev,
++ int ret;
++
++ ret = fec_enet_rx_queue(ndev,
+ budget - pkt_received, queue_id);
++
++ if (ret < budget - pkt_received)
++ clear_bit(queue_id, &fep->work_rx);
++
++ pkt_received += ret;
+ }
+ return pkt_received;
+ }
+diff --git a/drivers/net/ethernet/jme.c b/drivers/net/ethernet/jme.c
+index 4a1be34d7214..70039afd68fa 100644
+--- a/drivers/net/ethernet/jme.c
++++ b/drivers/net/ethernet/jme.c
+@@ -270,11 +270,17 @@ jme_reset_mac_processor(struct jme_adapter *jme)
+ }
+
+ static inline void
+-jme_clear_pm(struct jme_adapter *jme)
++jme_clear_pm_enable_wol(struct jme_adapter *jme)
+ {
+ jwrite32(jme, JME_PMCS, PMCS_STMASK | jme->reg_pmcs);
+ }
+
++static inline void
++jme_clear_pm_disable_wol(struct jme_adapter *jme)
++{
++ jwrite32(jme, JME_PMCS, PMCS_STMASK);
++}
++
+ static int
+ jme_reload_eeprom(struct jme_adapter *jme)
+ {
+@@ -1857,7 +1863,7 @@ jme_open(struct net_device *netdev)
+ struct jme_adapter *jme = netdev_priv(netdev);
+ int rc;
+
+- jme_clear_pm(jme);
++ jme_clear_pm_disable_wol(jme);
+ JME_NAPI_ENABLE(jme);
+
+ tasklet_init(&jme->linkch_task, jme_link_change_tasklet,
+@@ -1929,11 +1935,11 @@ jme_wait_link(struct jme_adapter *jme)
+ static void
+ jme_powersave_phy(struct jme_adapter *jme)
+ {
+- if (jme->reg_pmcs) {
++ if (jme->reg_pmcs && device_may_wakeup(&jme->pdev->dev)) {
+ jme_set_100m_half(jme);
+ if (jme->reg_pmcs & (PMCS_LFEN | PMCS_LREN))
+ jme_wait_link(jme);
+- jme_clear_pm(jme);
++ jme_clear_pm_enable_wol(jme);
+ } else {
+ jme_phy_off(jme);
+ }
+@@ -2650,9 +2656,6 @@ jme_set_wol(struct net_device *netdev,
+ if (wol->wolopts & WAKE_MAGIC)
+ jme->reg_pmcs |= PMCS_MFEN;
+
+- jwrite32(jme, JME_PMCS, jme->reg_pmcs);
+- device_set_wakeup_enable(&jme->pdev->dev, !!(jme->reg_pmcs));
+-
+ return 0;
+ }
+
+@@ -3176,8 +3179,8 @@ jme_init_one(struct pci_dev *pdev,
+ jme->mii_if.mdio_read = jme_mdio_read;
+ jme->mii_if.mdio_write = jme_mdio_write;
+
+- jme_clear_pm(jme);
+- device_set_wakeup_enable(&pdev->dev, true);
++ jme_clear_pm_disable_wol(jme);
++ device_init_wakeup(&pdev->dev, true);
+
+ jme_set_phyfifo_5level(jme);
+ jme->pcirev = pdev->revision;
+@@ -3308,7 +3311,7 @@ jme_resume(struct device *dev)
+ if (!netif_running(netdev))
+ return 0;
+
+- jme_clear_pm(jme);
++ jme_clear_pm_disable_wol(jme);
+ jme_phy_on(jme);
+ if (test_bit(JME_FLAG_SSET, &jme->flags))
+ jme_set_settings(netdev, &jme->old_ecmd);
+@@ -3316,13 +3319,14 @@ jme_resume(struct device *dev)
+ jme_reset_phy_processor(jme);
+ jme_phy_calibration(jme);
+ jme_phy_setEA(jme);
+- jme_start_irq(jme);
+ netif_device_attach(netdev);
+
+ atomic_inc(&jme->link_changing);
+
+ jme_reset_link(jme);
+
++ jme_start_irq(jme);
++
+ return 0;
+ }
+
+diff --git a/drivers/net/ethernet/mellanox/mlx4/en_tx.c b/drivers/net/ethernet/mellanox/mlx4/en_tx.c
+index 5980d3fe597c..fdc592ac2529 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/en_tx.c
++++ b/drivers/net/ethernet/mellanox/mlx4/en_tx.c
+@@ -391,7 +391,6 @@ static bool mlx4_en_process_tx_cq(struct net_device *dev,
+ u32 packets = 0;
+ u32 bytes = 0;
+ int factor = priv->cqe_factor;
+- u64 timestamp = 0;
+ int done = 0;
+ int budget = priv->tx_work_limit;
+ u32 last_nr_txbb;
+@@ -431,9 +430,12 @@ static bool mlx4_en_process_tx_cq(struct net_device *dev,
+ new_index = be16_to_cpu(cqe->wqe_index) & size_mask;
+
+ do {
++ u64 timestamp = 0;
++
+ txbbs_skipped += last_nr_txbb;
+ ring_index = (ring_index + last_nr_txbb) & size_mask;
+- if (ring->tx_info[ring_index].ts_requested)
++
++ if (unlikely(ring->tx_info[ring_index].ts_requested))
+ timestamp = mlx4_en_get_cqe_ts(cqe);
+
+ /* free next descriptor */
+diff --git a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
+index cd5cf6d957c7..e57df91bad06 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
++++ b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
+@@ -2922,7 +2922,7 @@ static int verify_qp_parameters(struct mlx4_dev *dev,
+ case QP_TRANS_RTS2RTS:
+ case QP_TRANS_SQD2SQD:
+ case QP_TRANS_SQD2RTS:
+- if (slave != mlx4_master_func_num(dev))
++ if (slave != mlx4_master_func_num(dev)) {
+ if (optpar & MLX4_QP_OPTPAR_PRIMARY_ADDR_PATH) {
+ port = (qp_ctx->pri_path.sched_queue >> 6 & 1) + 1;
+ if (dev->caps.port_mask[port] != MLX4_PORT_TYPE_IB)
+@@ -2941,6 +2941,7 @@ static int verify_qp_parameters(struct mlx4_dev *dev,
+ if (qp_ctx->alt_path.mgid_index >= num_gids)
+ return -EINVAL;
+ }
++ }
+ break;
+ default:
+ break;
+diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h b/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h
+index e56c1bb36141..76b2cfe12504 100644
+--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h
++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h
+@@ -567,6 +567,7 @@ struct qlcnic_adapter_stats {
+ u64 tx_dma_map_error;
+ u64 spurious_intr;
+ u64 mac_filter_limit_overrun;
++ u64 mbx_spurious_intr;
+ };
+
+ /*
+@@ -1092,7 +1093,7 @@ struct qlcnic_mailbox {
+ unsigned long status;
+ spinlock_t queue_lock; /* Mailbox queue lock */
+ spinlock_t aen_lock; /* Mailbox response/AEN lock */
+- atomic_t rsp_status;
++ u32 rsp_status;
+ u32 num_cmds;
+ };
+
+diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
+index 840bf36b5e9d..dd618d7ed257 100644
+--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
+@@ -489,7 +489,7 @@ irqreturn_t qlcnic_83xx_clear_legacy_intr(struct qlcnic_adapter *adapter)
+
+ static inline void qlcnic_83xx_notify_mbx_response(struct qlcnic_mailbox *mbx)
+ {
+- atomic_set(&mbx->rsp_status, QLC_83XX_MBX_RESPONSE_ARRIVED);
++ mbx->rsp_status = QLC_83XX_MBX_RESPONSE_ARRIVED;
+ complete(&mbx->completion);
+ }
+
+@@ -508,7 +508,7 @@ static void qlcnic_83xx_poll_process_aen(struct qlcnic_adapter *adapter)
+ if (event & QLCNIC_MBX_ASYNC_EVENT) {
+ __qlcnic_83xx_process_aen(adapter);
+ } else {
+- if (atomic_read(&mbx->rsp_status) != rsp_status)
++ if (mbx->rsp_status != rsp_status)
+ qlcnic_83xx_notify_mbx_response(mbx);
+ }
+ out:
+@@ -1023,7 +1023,7 @@ static void qlcnic_83xx_process_aen(struct qlcnic_adapter *adapter)
+ if (event & QLCNIC_MBX_ASYNC_EVENT) {
+ __qlcnic_83xx_process_aen(adapter);
+ } else {
+- if (atomic_read(&mbx->rsp_status) != rsp_status)
++ if (mbx->rsp_status != rsp_status)
+ qlcnic_83xx_notify_mbx_response(mbx);
+ }
+ }
+@@ -2338,9 +2338,9 @@ static void qlcnic_83xx_handle_link_aen(struct qlcnic_adapter *adapter,
+
+ static irqreturn_t qlcnic_83xx_handle_aen(int irq, void *data)
+ {
++ u32 mask, resp, event, rsp_status = QLC_83XX_MBX_RESPONSE_ARRIVED;
+ struct qlcnic_adapter *adapter = data;
+ struct qlcnic_mailbox *mbx;
+- u32 mask, resp, event;
+ unsigned long flags;
+
+ mbx = adapter->ahw->mailbox;
+@@ -2350,10 +2350,14 @@ static irqreturn_t qlcnic_83xx_handle_aen(int irq, void *data)
+ goto out;
+
+ event = readl(QLCNIC_MBX_FW(adapter->ahw, 0));
+- if (event & QLCNIC_MBX_ASYNC_EVENT)
++ if (event & QLCNIC_MBX_ASYNC_EVENT) {
+ __qlcnic_83xx_process_aen(adapter);
+- else
+- qlcnic_83xx_notify_mbx_response(mbx);
++ } else {
++ if (mbx->rsp_status != rsp_status)
++ qlcnic_83xx_notify_mbx_response(mbx);
++ else
++ adapter->stats.mbx_spurious_intr++;
++ }
+
+ out:
+ mask = QLCRDX(adapter->ahw, QLCNIC_DEF_INT_MASK);
+@@ -4025,10 +4029,10 @@ static void qlcnic_83xx_mailbox_worker(struct work_struct *work)
+ struct qlcnic_adapter *adapter = mbx->adapter;
+ struct qlcnic_mbx_ops *mbx_ops = mbx->ops;
+ struct device *dev = &adapter->pdev->dev;
+- atomic_t *rsp_status = &mbx->rsp_status;
+ struct list_head *head = &mbx->cmd_q;
+ struct qlcnic_hardware_context *ahw;
+ struct qlcnic_cmd_args *cmd = NULL;
++ unsigned long flags;
+
+ ahw = adapter->ahw;
+
+@@ -4038,7 +4042,9 @@ static void qlcnic_83xx_mailbox_worker(struct work_struct *work)
+ return;
+ }
+
+- atomic_set(rsp_status, QLC_83XX_MBX_RESPONSE_WAIT);
++ spin_lock_irqsave(&mbx->aen_lock, flags);
++ mbx->rsp_status = QLC_83XX_MBX_RESPONSE_WAIT;
++ spin_unlock_irqrestore(&mbx->aen_lock, flags);
+
+ spin_lock(&mbx->queue_lock);
+
+diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c
+index 494e8105adee..0a2318cad34d 100644
+--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c
++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c
+@@ -59,7 +59,8 @@ static const struct qlcnic_stats qlcnic_gstrings_stats[] = {
+ QLC_OFF(stats.mac_filter_limit_overrun)},
+ {"spurious intr", QLC_SIZEOF(stats.spurious_intr),
+ QLC_OFF(stats.spurious_intr)},
+-
++ {"mbx spurious intr", QLC_SIZEOF(stats.mbx_spurious_intr),
++ QLC_OFF(stats.mbx_spurious_intr)},
+ };
+
+ static const char qlcnic_device_gstrings_stats[][ETH_GSTRING_LEN] = {
+diff --git a/drivers/net/ethernet/qlogic/qlge/qlge_main.c b/drivers/net/ethernet/qlogic/qlge/qlge_main.c
+index 6c904a6cad2a..7bbb04124dc1 100644
+--- a/drivers/net/ethernet/qlogic/qlge/qlge_main.c
++++ b/drivers/net/ethernet/qlogic/qlge/qlge_main.c
+@@ -1648,7 +1648,18 @@ static void ql_process_mac_rx_skb(struct ql_adapter *qdev,
+ return;
+ }
+ skb_reserve(new_skb, NET_IP_ALIGN);
++
++ pci_dma_sync_single_for_cpu(qdev->pdev,
++ dma_unmap_addr(sbq_desc, mapaddr),
++ dma_unmap_len(sbq_desc, maplen),
++ PCI_DMA_FROMDEVICE);
++
+ memcpy(skb_put(new_skb, length), skb->data, length);
++
++ pci_dma_sync_single_for_device(qdev->pdev,
++ dma_unmap_addr(sbq_desc, mapaddr),
++ dma_unmap_len(sbq_desc, maplen),
++ PCI_DMA_FROMDEVICE);
+ skb = new_skb;
+
+ /* Frame error, so drop the packet. */
+diff --git a/drivers/net/ethernet/qualcomm/qca_spi.c b/drivers/net/ethernet/qualcomm/qca_spi.c
+index f77b58911558..f55be6ddf3a7 100644
+--- a/drivers/net/ethernet/qualcomm/qca_spi.c
++++ b/drivers/net/ethernet/qualcomm/qca_spi.c
+@@ -812,7 +812,7 @@ qcaspi_netdev_setup(struct net_device *dev)
+ dev->netdev_ops = &qcaspi_netdev_ops;
+ qcaspi_set_ethtool_ops(dev);
+ dev->watchdog_timeo = QCASPI_TX_TIMEOUT;
+- dev->flags = IFF_MULTICAST;
++ dev->priv_flags &= ~IFF_TX_SKB_SHARING;
+ dev->tx_queue_len = 100;
+
+ qca = netdev_priv(dev);
+diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c
+index b474dbfcdb4f..c44bae495804 100644
+--- a/drivers/net/ethernet/renesas/sh_eth.c
++++ b/drivers/net/ethernet/renesas/sh_eth.c
+@@ -1112,6 +1112,7 @@ static void sh_eth_ring_format(struct net_device *ndev)
+ int rx_ringsize = sizeof(*rxdesc) * mdp->num_rx_ring;
+ int tx_ringsize = sizeof(*txdesc) * mdp->num_tx_ring;
+ int skbuff_size = mdp->rx_buf_sz + SH_ETH_RX_ALIGN - 1;
++ dma_addr_t dma_addr;
+
+ mdp->cur_rx = 0;
+ mdp->cur_tx = 0;
+@@ -1125,18 +1126,23 @@ static void sh_eth_ring_format(struct net_device *ndev)
+ /* skb */
+ mdp->rx_skbuff[i] = NULL;
+ skb = netdev_alloc_skb(ndev, skbuff_size);
+- mdp->rx_skbuff[i] = skb;
+ if (skb == NULL)
+ break;
+ sh_eth_set_receive_align(skb);
+
+ /* RX descriptor */
+ rxdesc = &mdp->rx_ring[i];
+- /* The size of the buffer is a multiple of 16 bytes. */
+- rxdesc->buffer_length = ALIGN(mdp->rx_buf_sz, 16);
+- dma_map_single(&ndev->dev, skb->data, rxdesc->buffer_length,
+- DMA_FROM_DEVICE);
+- rxdesc->addr = virt_to_phys(PTR_ALIGN(skb->data, 4));
++ /* The size of the buffer is a multiple of 32 bytes. */
++ rxdesc->buffer_length = ALIGN(mdp->rx_buf_sz, 32);
++ dma_addr = dma_map_single(&ndev->dev, skb->data,
++ rxdesc->buffer_length,
++ DMA_FROM_DEVICE);
++ if (dma_mapping_error(&ndev->dev, dma_addr)) {
++ kfree_skb(skb);
++ break;
++ }
++ mdp->rx_skbuff[i] = skb;
++ rxdesc->addr = dma_addr;
+ rxdesc->status = cpu_to_edmac(mdp, RD_RACT | RD_RFP);
+
+ /* Rx descriptor address set */
+@@ -1151,7 +1157,8 @@ static void sh_eth_ring_format(struct net_device *ndev)
+ mdp->dirty_rx = (u32) (i - mdp->num_rx_ring);
+
+ /* Mark the last entry as wrapping the ring. */
+- rxdesc->status |= cpu_to_edmac(mdp, RD_RDEL);
++ if (rxdesc)
++ rxdesc->status |= cpu_to_edmac(mdp, RD_RDEL);
+
+ memset(mdp->tx_ring, 0, tx_ringsize);
+
+@@ -1391,6 +1398,7 @@ static int sh_eth_rx(struct net_device *ndev, u32 intr_status, int *quota)
+ u16 pkt_len = 0;
+ u32 desc_status;
+ int skbuff_size = mdp->rx_buf_sz + SH_ETH_RX_ALIGN - 1;
++ dma_addr_t dma_addr;
+
+ rxdesc = &mdp->rx_ring[entry];
+ while (!(rxdesc->status & cpu_to_edmac(mdp, RD_RACT))) {
+@@ -1441,9 +1449,9 @@ static int sh_eth_rx(struct net_device *ndev, u32 intr_status, int *quota)
+ mdp->rx_skbuff[entry] = NULL;
+ if (mdp->cd->rpadir)
+ skb_reserve(skb, NET_IP_ALIGN);
+- dma_sync_single_for_cpu(&ndev->dev, rxdesc->addr,
+- ALIGN(mdp->rx_buf_sz, 16),
+- DMA_FROM_DEVICE);
++ dma_unmap_single(&ndev->dev, rxdesc->addr,
++ ALIGN(mdp->rx_buf_sz, 32),
++ DMA_FROM_DEVICE);
+ skb_put(skb, pkt_len);
+ skb->protocol = eth_type_trans(skb, ndev);
+ netif_receive_skb(skb);
+@@ -1458,20 +1466,25 @@ static int sh_eth_rx(struct net_device *ndev, u32 intr_status, int *quota)
+ for (; mdp->cur_rx - mdp->dirty_rx > 0; mdp->dirty_rx++) {
+ entry = mdp->dirty_rx % mdp->num_rx_ring;
+ rxdesc = &mdp->rx_ring[entry];
+- /* The size of the buffer is 16 byte boundary. */
+- rxdesc->buffer_length = ALIGN(mdp->rx_buf_sz, 16);
++ /* The size of the buffer is 32 byte boundary. */
++ rxdesc->buffer_length = ALIGN(mdp->rx_buf_sz, 32);
+
+ if (mdp->rx_skbuff[entry] == NULL) {
+ skb = netdev_alloc_skb(ndev, skbuff_size);
+- mdp->rx_skbuff[entry] = skb;
+ if (skb == NULL)
+ break; /* Better luck next round. */
+ sh_eth_set_receive_align(skb);
+- dma_map_single(&ndev->dev, skb->data,
+- rxdesc->buffer_length, DMA_FROM_DEVICE);
++ dma_addr = dma_map_single(&ndev->dev, skb->data,
++ rxdesc->buffer_length,
++ DMA_FROM_DEVICE);
++ if (dma_mapping_error(&ndev->dev, dma_addr)) {
++ kfree_skb(skb);
++ break;
++ }
++ mdp->rx_skbuff[entry] = skb;
+
+ skb_checksum_none_assert(skb);
+- rxdesc->addr = virt_to_phys(PTR_ALIGN(skb->data, 4));
++ rxdesc->addr = dma_addr;
+ }
+ if (entry >= mdp->num_rx_ring - 1)
+ rxdesc->status |=
+diff --git a/drivers/net/ethernet/sfc/ef10.c b/drivers/net/ethernet/sfc/ef10.c
+index 63ec209cdfd3..010009d64017 100644
+--- a/drivers/net/ethernet/sfc/ef10.c
++++ b/drivers/net/ethernet/sfc/ef10.c
+@@ -452,6 +452,17 @@ fail:
+ return rc;
+ }
+
++static void efx_ef10_forget_old_piobufs(struct efx_nic *efx)
++{
++ struct efx_channel *channel;
++ struct efx_tx_queue *tx_queue;
++
++ /* All our existing PIO buffers went away */
++ efx_for_each_channel(channel, efx)
++ efx_for_each_channel_tx_queue(tx_queue, channel)
++ tx_queue->piobuf = NULL;
++}
++
+ #else /* !EFX_USE_PIO */
+
+ static int efx_ef10_alloc_piobufs(struct efx_nic *efx, unsigned int n)
+@@ -468,6 +479,10 @@ static void efx_ef10_free_piobufs(struct efx_nic *efx)
+ {
+ }
+
++static void efx_ef10_forget_old_piobufs(struct efx_nic *efx)
++{
++}
++
+ #endif /* EFX_USE_PIO */
+
+ static void efx_ef10_remove(struct efx_nic *efx)
+@@ -699,6 +714,7 @@ static void efx_ef10_reset_mc_allocations(struct efx_nic *efx)
+ nic_data->must_realloc_vis = true;
+ nic_data->must_restore_filters = true;
+ nic_data->must_restore_piobufs = true;
++ efx_ef10_forget_old_piobufs(efx);
+ nic_data->rx_rss_context = EFX_EF10_RSS_CONTEXT_INVALID;
+ }
+
+diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c
+index fc7b3d76f08e..e3fbbbbd84e7 100644
+--- a/drivers/net/ppp/ppp_generic.c
++++ b/drivers/net/ppp/ppp_generic.c
+@@ -561,7 +561,7 @@ static int get_filter(void __user *arg, struct sock_filter **p)
+
+ static long ppp_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
+ {
+- struct ppp_file *pf = file->private_data;
++ struct ppp_file *pf;
+ struct ppp *ppp;
+ int err = -EFAULT, val, val2, i;
+ struct ppp_idle idle;
+@@ -571,9 +571,14 @@ static long ppp_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
+ void __user *argp = (void __user *)arg;
+ int __user *p = argp;
+
+- if (!pf)
+- return ppp_unattached_ioctl(current->nsproxy->net_ns,
+- pf, file, cmd, arg);
++ mutex_lock(&ppp_mutex);
++
++ pf = file->private_data;
++ if (!pf) {
++ err = ppp_unattached_ioctl(current->nsproxy->net_ns,
++ pf, file, cmd, arg);
++ goto out;
++ }
+
+ if (cmd == PPPIOCDETACH) {
+ /*
+@@ -588,7 +593,6 @@ static long ppp_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
+ * this fd and reopening /dev/ppp.
+ */
+ err = -EINVAL;
+- mutex_lock(&ppp_mutex);
+ if (pf->kind == INTERFACE) {
+ ppp = PF_TO_PPP(pf);
+ if (file == ppp->owner)
+@@ -600,15 +604,13 @@ static long ppp_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
+ } else
+ pr_warn("PPPIOCDETACH file->f_count=%ld\n",
+ atomic_long_read(&file->f_count));
+- mutex_unlock(&ppp_mutex);
+- return err;
++ goto out;
+ }
+
+ if (pf->kind == CHANNEL) {
+ struct channel *pch;
+ struct ppp_channel *chan;
+
+- mutex_lock(&ppp_mutex);
+ pch = PF_TO_CHANNEL(pf);
+
+ switch (cmd) {
+@@ -630,17 +632,16 @@ static long ppp_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
+ err = chan->ops->ioctl(chan, cmd, arg);
+ up_read(&pch->chan_sem);
+ }
+- mutex_unlock(&ppp_mutex);
+- return err;
++ goto out;
+ }
+
+ if (pf->kind != INTERFACE) {
+ /* can't happen */
+ pr_err("PPP: not interface or channel??\n");
+- return -EINVAL;
++ err = -EINVAL;
++ goto out;
+ }
+
+- mutex_lock(&ppp_mutex);
+ ppp = PF_TO_PPP(pf);
+ switch (cmd) {
+ case PPPIOCSMRU:
+@@ -815,7 +816,10 @@ static long ppp_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
+ default:
+ err = -ENOTTY;
+ }
++
++out:
+ mutex_unlock(&ppp_mutex);
++
+ return err;
+ }
+
+@@ -828,7 +832,6 @@ static int ppp_unattached_ioctl(struct net *net, struct ppp_file *pf,
+ struct ppp_net *pn;
+ int __user *p = (int __user *)arg;
+
+- mutex_lock(&ppp_mutex);
+ switch (cmd) {
+ case PPPIOCNEWUNIT:
+ /* Create a new ppp unit */
+@@ -879,7 +882,7 @@ static int ppp_unattached_ioctl(struct net *net, struct ppp_file *pf,
+ default:
+ err = -ENOTTY;
+ }
+- mutex_unlock(&ppp_mutex);
++
+ return err;
+ }
+
+@@ -2242,7 +2245,7 @@ int ppp_register_net_channel(struct net *net, struct ppp_channel *chan)
+
+ pch->ppp = NULL;
+ pch->chan = chan;
+- pch->chan_net = net;
++ pch->chan_net = get_net(net);
+ chan->ppp = pch;
+ init_ppp_file(&pch->file, CHANNEL);
+ pch->file.hdrlen = chan->hdrlen;
+@@ -2339,6 +2342,8 @@ ppp_unregister_channel(struct ppp_channel *chan)
+ spin_lock_bh(&pn->all_channels_lock);
+ list_del(&pch->list);
+ spin_unlock_bh(&pn->all_channels_lock);
++ put_net(pch->chan_net);
++ pch->chan_net = NULL;
+
+ pch->file.dead = 1;
+ wake_up_interruptible(&pch->file.rwait);
+diff --git a/drivers/net/tun.c b/drivers/net/tun.c
+index 9dd3746994a4..a4685a22f665 100644
+--- a/drivers/net/tun.c
++++ b/drivers/net/tun.c
+@@ -499,11 +499,13 @@ static void tun_detach_all(struct net_device *dev)
+ for (i = 0; i < n; i++) {
+ tfile = rtnl_dereference(tun->tfiles[i]);
+ BUG_ON(!tfile);
++ tfile->socket.sk->sk_shutdown = RCV_SHUTDOWN;
+ tfile->socket.sk->sk_data_ready(tfile->socket.sk);
+ RCU_INIT_POINTER(tfile->tun, NULL);
+ --tun->numqueues;
+ }
+ list_for_each_entry(tfile, &tun->disabled, next) {
++ tfile->socket.sk->sk_shutdown = RCV_SHUTDOWN;
+ tfile->socket.sk->sk_data_ready(tfile->socket.sk);
+ RCU_INIT_POINTER(tfile->tun, NULL);
+ }
+@@ -558,6 +560,7 @@ static int tun_attach(struct tun_struct *tun, struct file *file, bool skip_filte
+ goto out;
+ }
+ tfile->queue_index = tun->numqueues;
++ tfile->socket.sk->sk_shutdown &= ~RCV_SHUTDOWN;
+ rcu_assign_pointer(tfile->tun, tun);
+ rcu_assign_pointer(tun->tfiles[tun->numqueues], tfile);
+ tun->numqueues++;
+@@ -1356,9 +1359,6 @@ static ssize_t tun_do_read(struct tun_struct *tun, struct tun_file *tfile,
+ if (!len)
+ return ret;
+
+- if (tun->dev->reg_state != NETREG_REGISTERED)
+- return -EIO;
+-
+ /* Read frames from queue */
+ skb = __skb_recv_datagram(tfile->socket.sk, noblock ? MSG_DONTWAIT : 0,
+ &peeked, &off, &err);
+diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c
+index 8067b8fbb0ee..614b4ca6420a 100644
+--- a/drivers/net/usb/cdc_ncm.c
++++ b/drivers/net/usb/cdc_ncm.c
+@@ -815,7 +815,11 @@ advance:
+
+ iface_no = ctx->data->cur_altsetting->desc.bInterfaceNumber;
+
+- /* reset data interface */
++ /* Reset data interface. Some devices will not reset properly
++ * unless they are configured first. Toggle the altsetting to
++ * force a reset
++ */
++ usb_set_interface(dev->udev, iface_no, data_altsetting);
+ temp = usb_set_interface(dev->udev, iface_no, 0);
+ if (temp) {
+ dev_dbg(&intf->dev, "set interface failed\n");
+diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
+index a5771515d9ab..73f55a98798f 100644
+--- a/drivers/net/usb/qmi_wwan.c
++++ b/drivers/net/usb/qmi_wwan.c
+@@ -748,6 +748,7 @@ static const struct usb_device_id products[] = {
+ {QMI_FIXED_INTF(0x19d2, 0x1426, 2)}, /* ZTE MF91 */
+ {QMI_FIXED_INTF(0x19d2, 0x1428, 2)}, /* Telewell TW-LTE 4G v2 */
+ {QMI_FIXED_INTF(0x19d2, 0x2002, 4)}, /* ZTE (Vodafone) K3765-Z */
++ {QMI_FIXED_INTF(0x2001, 0x7e19, 4)}, /* D-Link DWM-221 B1 */
+ {QMI_FIXED_INTF(0x0f3d, 0x68a2, 8)}, /* Sierra Wireless MC7700 */
+ {QMI_FIXED_INTF(0x114f, 0x68a2, 8)}, /* Sierra Wireless MC7750 */
+ {QMI_FIXED_INTF(0x1199, 0x68a2, 8)}, /* Sierra Wireless MC7710 in QMI mode */
+@@ -766,8 +767,10 @@ static const struct usb_device_id products[] = {
+ {QMI_FIXED_INTF(0x1199, 0x9061, 8)}, /* Sierra Wireless Modem */
+ {QMI_FIXED_INTF(0x1199, 0x9070, 8)}, /* Sierra Wireless MC74xx/EM74xx */
+ {QMI_FIXED_INTF(0x1199, 0x9070, 10)}, /* Sierra Wireless MC74xx/EM74xx */
+- {QMI_FIXED_INTF(0x1199, 0x9071, 8)}, /* Sierra Wireless MC74xx/EM74xx */
+- {QMI_FIXED_INTF(0x1199, 0x9071, 10)}, /* Sierra Wireless MC74xx/EM74xx */
++ {QMI_FIXED_INTF(0x1199, 0x9071, 8)}, /* Sierra Wireless MC74xx */
++ {QMI_FIXED_INTF(0x1199, 0x9071, 10)}, /* Sierra Wireless MC74xx */
++ {QMI_FIXED_INTF(0x1199, 0x9079, 8)}, /* Sierra Wireless EM74xx */
++ {QMI_FIXED_INTF(0x1199, 0x9079, 10)}, /* Sierra Wireless EM74xx */
+ {QMI_FIXED_INTF(0x1bbb, 0x011e, 4)}, /* Telekom Speedstick LTE II (Alcatel One Touch L100V LTE) */
+ {QMI_FIXED_INTF(0x1bbb, 0x0203, 2)}, /* Alcatel L800MA */
+ {QMI_FIXED_INTF(0x2357, 0x0201, 4)}, /* TP-LINK HSUPA Modem MA180 */
+diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
+index 7a598932f922..bb570916e340 100644
+--- a/drivers/net/usb/usbnet.c
++++ b/drivers/net/usb/usbnet.c
+@@ -1755,6 +1755,13 @@ out3:
+ if (info->unbind)
+ info->unbind (dev, udev);
+ out1:
++ /* subdrivers must undo all they did in bind() if they
++ * fail it, but we may fail later and a deferred kevent
++ * may trigger an error resubmitting itself and, worse,
++ * schedule a timer. So we kill it all just in case.
++ */
++ cancel_work_sync(&dev->kevent);
++ del_timer_sync(&dev->delay);
+ free_netdev(net);
+ out:
+ return status;
+diff --git a/drivers/net/wan/farsync.c b/drivers/net/wan/farsync.c
+index 44541dbc5c28..69b994f3b8c5 100644
+--- a/drivers/net/wan/farsync.c
++++ b/drivers/net/wan/farsync.c
+@@ -2516,7 +2516,7 @@ fst_add_one(struct pci_dev *pdev, const struct pci_device_id *ent)
+ dev->mem_start = card->phys_mem
+ + BUF_OFFSET ( txBuffer[i][0][0]);
+ dev->mem_end = card->phys_mem
+- + BUF_OFFSET ( txBuffer[i][NUM_TX_BUFFER][0]);
++ + BUF_OFFSET ( txBuffer[i][NUM_TX_BUFFER - 1][LEN_RX_BUFFER - 1]);
+ dev->base_addr = card->pci_conf;
+ dev->irq = card->irq;
+
+diff --git a/drivers/net/wireless/ath/ath9k/eeprom.c b/drivers/net/wireless/ath/ath9k/eeprom.c
+index 971d770722cf..2ac05486424b 100644
+--- a/drivers/net/wireless/ath/ath9k/eeprom.c
++++ b/drivers/net/wireless/ath/ath9k/eeprom.c
+@@ -408,10 +408,9 @@ void ath9k_hw_get_gain_boundaries_pdadcs(struct ath_hw *ah,
+
+ if (match) {
+ if (AR_SREV_9287(ah)) {
+- /* FIXME: array overrun? */
+ for (i = 0; i < numXpdGains; i++) {
+ minPwrT4[i] = data_9287[idxL].pwrPdg[i][0];
+- maxPwrT4[i] = data_9287[idxL].pwrPdg[i][4];
++ maxPwrT4[i] = data_9287[idxL].pwrPdg[i][intercepts - 1];
+ ath9k_hw_fill_vpd_table(minPwrT4[i], maxPwrT4[i],
+ data_9287[idxL].pwrPdg[i],
+ data_9287[idxL].vpdPdg[i],
+@@ -421,7 +420,7 @@ void ath9k_hw_get_gain_boundaries_pdadcs(struct ath_hw *ah,
+ } else if (eeprom_4k) {
+ for (i = 0; i < numXpdGains; i++) {
+ minPwrT4[i] = data_4k[idxL].pwrPdg[i][0];
+- maxPwrT4[i] = data_4k[idxL].pwrPdg[i][4];
++ maxPwrT4[i] = data_4k[idxL].pwrPdg[i][intercepts - 1];
+ ath9k_hw_fill_vpd_table(minPwrT4[i], maxPwrT4[i],
+ data_4k[idxL].pwrPdg[i],
+ data_4k[idxL].vpdPdg[i],
+@@ -431,7 +430,7 @@ void ath9k_hw_get_gain_boundaries_pdadcs(struct ath_hw *ah,
+ } else {
+ for (i = 0; i < numXpdGains; i++) {
+ minPwrT4[i] = data_def[idxL].pwrPdg[i][0];
+- maxPwrT4[i] = data_def[idxL].pwrPdg[i][4];
++ maxPwrT4[i] = data_def[idxL].pwrPdg[i][intercepts - 1];
+ ath9k_hw_fill_vpd_table(minPwrT4[i], maxPwrT4[i],
+ data_def[idxL].pwrPdg[i],
+ data_def[idxL].vpdPdg[i],
+diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
+index ce0aa47222f6..94ff20e9a8a0 100644
+--- a/drivers/pci/pci.c
++++ b/drivers/pci/pci.c
+@@ -10,6 +10,8 @@
+ #include <linux/kernel.h>
+ #include <linux/delay.h>
+ #include <linux/init.h>
++#include <linux/of.h>
++#include <linux/of_pci.h>
+ #include <linux/pci.h>
+ #include <linux/pm.h>
+ #include <linux/slab.h>
+@@ -4490,6 +4492,55 @@ int pci_get_new_domain_nr(void)
+ {
+ return atomic_inc_return(&__domain_nr);
+ }
++
++#ifdef CONFIG_PCI_DOMAINS_GENERIC
++void pci_bus_assign_domain_nr(struct pci_bus *bus, struct device *parent)
++{
++ static int use_dt_domains = -1;
++ int domain = -1;
++
++ if (parent)
++ domain = of_get_pci_domain_nr(parent->of_node);
++ /*
++ * Check DT domain and use_dt_domains values.
++ *
++ * If DT domain property is valid (domain >= 0) and
++ * use_dt_domains != 0, the DT assignment is valid since this means
++ * we have not previously allocated a domain number by using
++ * pci_get_new_domain_nr(); we should also update use_dt_domains to
++ * 1, to indicate that we have just assigned a domain number from
++ * DT.
++ *
++ * If DT domain property value is not valid (ie domain < 0), and we
++ * have not previously assigned a domain number from DT
++ * (use_dt_domains != 1) we should assign a domain number by
++ * using the:
++ *
++ * pci_get_new_domain_nr()
++ *
++ * API and update the use_dt_domains value to keep track of method we
++ * are using to assign domain numbers (use_dt_domains = 0).
++ *
++ * All other combinations imply we have a platform that is trying
++ * to mix domain numbers obtained from DT and pci_get_new_domain_nr(),
++ * which is a recipe for domain mishandling and it is prevented by
++ * invalidating the domain value (domain = -1) and printing a
++ * corresponding error.
++ */
++ if (domain >= 0 && use_dt_domains) {
++ use_dt_domains = 1;
++ } else if (domain < 0 && use_dt_domains != 1) {
++ use_dt_domains = 0;
++ domain = pci_get_new_domain_nr();
++ } else {
++ dev_err(parent, "Node %s has inconsistent \"linux,pci-domain\" property in DT\n",
++ parent->of_node->full_name);
++ domain = -1;
++ }
++
++ bus->domain_nr = domain;
++}
++#endif
+ #endif
+
+ /**
+diff --git a/drivers/pinctrl/freescale/pinctrl-imx.c b/drivers/pinctrl/freescale/pinctrl-imx.c
+index 6f806f93662a..857f29ba406a 100644
+--- a/drivers/pinctrl/freescale/pinctrl-imx.c
++++ b/drivers/pinctrl/freescale/pinctrl-imx.c
+@@ -205,9 +205,9 @@ static int imx_pmx_set(struct pinctrl_dev *pctldev, unsigned selector,
+ pin_reg = &info->pin_regs[pin_id];
+
+ if (pin_reg->mux_reg == -1) {
+- dev_err(ipctl->dev, "Pin(%s) does not support mux function\n",
++ dev_dbg(ipctl->dev, "Pin(%s) does not support mux function\n",
+ info->pins[pin_id].name);
+- return -EINVAL;
++ continue;
+ }
+
+ if (info->flags & SHARE_MUX_CONF_REG) {
+diff --git a/drivers/pinctrl/nomadik/pinctrl-nomadik.c b/drivers/pinctrl/nomadik/pinctrl-nomadik.c
+index 746db6acf648..25d5a21c51e5 100644
+--- a/drivers/pinctrl/nomadik/pinctrl-nomadik.c
++++ b/drivers/pinctrl/nomadik/pinctrl-nomadik.c
+@@ -1025,7 +1025,7 @@ static void nmk_gpio_dbg_show_one(struct seq_file *s,
+ int pullidx = 0;
+
+ if (pull)
+- pullidx = data_out ? 1 : 2;
++ pullidx = data_out ? 2 : 1;
+
+ seq_printf(s, " gpio-%-3d (%-20.20s) in %s %s",
+ gpio,
+diff --git a/drivers/pinctrl/pinctrl-single.c b/drivers/pinctrl/pinctrl-single.c
+index fb94b772ad62..f94d46c57dc5 100644
+--- a/drivers/pinctrl/pinctrl-single.c
++++ b/drivers/pinctrl/pinctrl-single.c
+@@ -1273,9 +1273,9 @@ static int pcs_parse_bits_in_pinctrl_entry(struct pcs_device *pcs,
+
+ /* Parse pins in each row from LSB */
+ while (mask) {
+- bit_pos = ffs(mask);
++ bit_pos = __ffs(mask);
+ pin_num_from_lsb = bit_pos / pcs->bits_per_pin;
+- mask_pos = ((pcs->fmask) << (bit_pos - 1));
++ mask_pos = ((pcs->fmask) << bit_pos);
+ val_pos = val & mask_pos;
+ submask = mask & mask_pos;
+
+@@ -1576,6 +1576,9 @@ static inline void pcs_irq_set(struct pcs_soc_data *pcs_soc,
+ else
+ mask &= ~soc_mask;
+ pcs->write(mask, pcswi->reg);
++
++ /* flush posted write */
++ mask = pcs->read(pcswi->reg);
+ raw_spin_unlock(&pcs->lock);
+ }
+
+@@ -1851,7 +1854,7 @@ static int pcs_probe(struct platform_device *pdev)
+ ret = of_property_read_u32(np, "pinctrl-single,function-mask",
+ &pcs->fmask);
+ if (!ret) {
+- pcs->fshift = ffs(pcs->fmask) - 1;
++ pcs->fshift = __ffs(pcs->fmask);
+ pcs->fmax = pcs->fmask >> pcs->fshift;
+ } else {
+ /* If mask property doesn't exist, function mux is invalid. */
+diff --git a/drivers/regulator/s5m8767.c b/drivers/regulator/s5m8767.c
+index 0ab5cbeeb797..c53fe2645548 100644
+--- a/drivers/regulator/s5m8767.c
++++ b/drivers/regulator/s5m8767.c
+@@ -202,9 +202,10 @@ static int s5m8767_get_register(struct s5m8767_info *s5m8767, int reg_id,
+ }
+ }
+
+- if (i < s5m8767->num_regulators)
+- *enable_ctrl =
+- s5m8767_opmode_reg[reg_id][mode] << S5M8767_ENCTRL_SHIFT;
++ if (i >= s5m8767->num_regulators)
++ return -EINVAL;
++
++ *enable_ctrl = s5m8767_opmode_reg[reg_id][mode] << S5M8767_ENCTRL_SHIFT;
+
+ return 0;
+ }
+@@ -936,8 +937,12 @@ static int s5m8767_pmic_probe(struct platform_device *pdev)
+ else
+ regulators[id].vsel_mask = 0xff;
+
+- s5m8767_get_register(s5m8767, id, &enable_reg,
++ ret = s5m8767_get_register(s5m8767, id, &enable_reg,
+ &enable_val);
++ if (ret) {
++ dev_err(s5m8767->dev, "error reading registers\n");
++ return ret;
++ }
+ regulators[id].enable_reg = enable_reg;
+ regulators[id].enable_mask = S5M8767_ENCTRL_MASK;
+ regulators[id].enable_val = enable_val;
+diff --git a/drivers/rtc/rtc-hym8563.c b/drivers/rtc/rtc-hym8563.c
+index b936bb4096b5..280584b2813b 100644
+--- a/drivers/rtc/rtc-hym8563.c
++++ b/drivers/rtc/rtc-hym8563.c
+@@ -144,7 +144,7 @@ static int hym8563_rtc_set_time(struct device *dev, struct rtc_time *tm)
+ * it does not seem to carry it over a subsequent write/read.
+ * So we'll limit ourself to 100 years, starting at 2000 for now.
+ */
+- buf[6] = tm->tm_year - 100;
++ buf[6] = bin2bcd(tm->tm_year - 100);
+
+ /*
+ * CTL1 only contains TEST-mode bits apart from stop,
+diff --git a/drivers/rtc/rtc-max77686.c b/drivers/rtc/rtc-max77686.c
+index cf73e969c8cc..b69d409c9d9c 100644
+--- a/drivers/rtc/rtc-max77686.c
++++ b/drivers/rtc/rtc-max77686.c
+@@ -463,7 +463,7 @@ static int max77686_rtc_probe(struct platform_device *pdev)
+
+ info->virq = regmap_irq_get_virq(max77686->rtc_irq_data,
+ MAX77686_RTCIRQ_RTCA1);
+- if (!info->virq) {
++ if (info->virq <= 0) {
+ ret = -ENXIO;
+ goto err_rtc;
+ }
+diff --git a/drivers/rtc/rtc-vr41xx.c b/drivers/rtc/rtc-vr41xx.c
+index 88c9c92e89fd..4b0966ed5394 100644
+--- a/drivers/rtc/rtc-vr41xx.c
++++ b/drivers/rtc/rtc-vr41xx.c
+@@ -272,12 +272,13 @@ static irqreturn_t rtclong1_interrupt(int irq, void *dev_id)
+ }
+
+ static const struct rtc_class_ops vr41xx_rtc_ops = {
+- .release = vr41xx_rtc_release,
+- .ioctl = vr41xx_rtc_ioctl,
+- .read_time = vr41xx_rtc_read_time,
+- .set_time = vr41xx_rtc_set_time,
+- .read_alarm = vr41xx_rtc_read_alarm,
+- .set_alarm = vr41xx_rtc_set_alarm,
++ .release = vr41xx_rtc_release,
++ .ioctl = vr41xx_rtc_ioctl,
++ .read_time = vr41xx_rtc_read_time,
++ .set_time = vr41xx_rtc_set_time,
++ .read_alarm = vr41xx_rtc_read_alarm,
++ .set_alarm = vr41xx_rtc_set_alarm,
++ .alarm_irq_enable = vr41xx_rtc_alarm_irq_enable,
+ };
+
+ static int rtc_probe(struct platform_device *pdev)
+diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c
+index 0b2c53af85c7..6a6b3db5780d 100644
+--- a/drivers/scsi/lpfc/lpfc_init.c
++++ b/drivers/scsi/lpfc/lpfc_init.c
+@@ -2822,7 +2822,7 @@ lpfc_online(struct lpfc_hba *phba)
+ }
+
+ vports = lpfc_create_vport_work_array(phba);
+- if (vports != NULL)
++ if (vports != NULL) {
+ for (i = 0; i <= phba->max_vports && vports[i] != NULL; i++) {
+ struct Scsi_Host *shost;
+ shost = lpfc_shost_from_vport(vports[i]);
+@@ -2839,7 +2839,8 @@ lpfc_online(struct lpfc_hba *phba)
+ }
+ spin_unlock_irq(shost->host_lock);
+ }
+- lpfc_destroy_vport_work_array(phba, vports);
++ }
++ lpfc_destroy_vport_work_array(phba, vports);
+
+ lpfc_unblock_mgmt_io(phba);
+ return 0;
+diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c
+index 6e503802947a..b1af2987b0c8 100644
+--- a/drivers/scsi/megaraid/megaraid_sas_base.c
++++ b/drivers/scsi/megaraid/megaraid_sas_base.c
+@@ -6096,12 +6096,13 @@ megasas_mgmt_fw_ioctl(struct megasas_instance *instance,
+ }
+
+ for (i = 0; i < ioc->sge_count; i++) {
+- if (kbuff_arr[i])
++ if (kbuff_arr[i]) {
+ dma_free_coherent(&instance->pdev->dev,
+ le32_to_cpu(kern_sge32[i].length),
+ kbuff_arr[i],
+ le32_to_cpu(kern_sge32[i].phys_addr));
+ kbuff_arr[i] = NULL;
++ }
+ }
+
+ if (instance->ctrl_context && cmd->mpt_pthr_cmd_blocked)
+diff --git a/drivers/scsi/scsi_error.c b/drivers/scsi/scsi_error.c
+index 3d12c52c3f81..29a67a85ee71 100644
+--- a/drivers/scsi/scsi_error.c
++++ b/drivers/scsi/scsi_error.c
+@@ -1115,7 +1115,6 @@ static int scsi_eh_action(struct scsi_cmnd *scmd, int rtn)
+ */
+ void scsi_eh_finish_cmd(struct scsi_cmnd *scmd, struct list_head *done_q)
+ {
+- scmd->device->host->host_failed--;
+ scmd->eh_eflags = 0;
+ list_move_tail(&scmd->eh_entry, done_q);
+ }
+@@ -2213,6 +2212,9 @@ int scsi_error_handler(void *data)
+ else
+ scsi_unjam_host(shost);
+
++ /* All scmds have been handled */
++ shost->host_failed = 0;
++
+ /*
+ * Note - if the above fails completely, the action is to take
+ * individual devices offline and flush the queue of any
+diff --git a/drivers/spi/spi-rockchip.c b/drivers/spi/spi-rockchip.c
+index 87bc16f491f0..4703aeb7c25d 100644
+--- a/drivers/spi/spi-rockchip.c
++++ b/drivers/spi/spi-rockchip.c
+@@ -264,7 +264,10 @@ static inline u32 rx_max(struct rockchip_spi *rs)
+ static void rockchip_spi_set_cs(struct spi_device *spi, bool enable)
+ {
+ u32 ser;
+- struct rockchip_spi *rs = spi_master_get_devdata(spi->master);
++ struct spi_master *master = spi->master;
++ struct rockchip_spi *rs = spi_master_get_devdata(master);
++
++ pm_runtime_get_sync(rs->dev);
+
+ ser = readl_relaxed(rs->regs + ROCKCHIP_SPI_SER) & SER_MASK;
+
+@@ -289,6 +292,8 @@ static void rockchip_spi_set_cs(struct spi_device *spi, bool enable)
+ ser &= ~(1 << spi->chip_select);
+
+ writel_relaxed(ser, rs->regs + ROCKCHIP_SPI_SER);
++
++ pm_runtime_put_sync(rs->dev);
+ }
+
+ static int rockchip_spi_prepare_message(struct spi_master *master,
+diff --git a/drivers/spi/spi-sun4i.c b/drivers/spi/spi-sun4i.c
+index 85204c93f3d3..19169bf9bf4d 100644
+--- a/drivers/spi/spi-sun4i.c
++++ b/drivers/spi/spi-sun4i.c
+@@ -170,13 +170,17 @@ static int sun4i_spi_transfer_one(struct spi_master *master,
+ {
+ struct sun4i_spi *sspi = spi_master_get_devdata(master);
+ unsigned int mclk_rate, div, timeout;
++ unsigned int start, end, tx_time;
+ unsigned int tx_len = 0;
+ int ret = 0;
+ u32 reg;
+
+ /* We don't support transfer larger than the FIFO */
+ if (tfr->len > SUN4I_FIFO_DEPTH)
+- return -EINVAL;
++ return -EMSGSIZE;
++
++ if (tfr->tx_buf && tfr->len >= SUN4I_FIFO_DEPTH)
++ return -EMSGSIZE;
+
+ reinit_completion(&sspi->done);
+ sspi->tx_buf = tfr->tx_buf;
+@@ -229,8 +233,8 @@ static int sun4i_spi_transfer_one(struct spi_master *master,
+
+ /* Ensure that we have a parent clock fast enough */
+ mclk_rate = clk_get_rate(sspi->mclk);
+- if (mclk_rate < (2 * spi->max_speed_hz)) {
+- clk_set_rate(sspi->mclk, 2 * spi->max_speed_hz);
++ if (mclk_rate < (2 * tfr->speed_hz)) {
++ clk_set_rate(sspi->mclk, 2 * tfr->speed_hz);
+ mclk_rate = clk_get_rate(sspi->mclk);
+ }
+
+@@ -248,14 +252,14 @@ static int sun4i_spi_transfer_one(struct spi_master *master,
+ * First try CDR2, and if we can't reach the expected
+ * frequency, fall back to CDR1.
+ */
+- div = mclk_rate / (2 * spi->max_speed_hz);
++ div = mclk_rate / (2 * tfr->speed_hz);
+ if (div <= (SUN4I_CLK_CTL_CDR2_MASK + 1)) {
+ if (div > 0)
+ div--;
+
+ reg = SUN4I_CLK_CTL_CDR2(div) | SUN4I_CLK_CTL_DRS;
+ } else {
+- div = ilog2(mclk_rate) - ilog2(spi->max_speed_hz);
++ div = ilog2(mclk_rate) - ilog2(tfr->speed_hz);
+ reg = SUN4I_CLK_CTL_CDR1(div);
+ }
+
+@@ -269,8 +273,12 @@ static int sun4i_spi_transfer_one(struct spi_master *master,
+ sun4i_spi_write(sspi, SUN4I_BURST_CNT_REG, SUN4I_BURST_CNT(tfr->len));
+ sun4i_spi_write(sspi, SUN4I_XMIT_CNT_REG, SUN4I_XMIT_CNT(tx_len));
+
+- /* Fill the TX FIFO */
+- sun4i_spi_fill_fifo(sspi, SUN4I_FIFO_DEPTH);
++ /*
++ * Fill the TX FIFO
++ * Filling the FIFO fully causes timeout for some reason
++ * at least on spi2 on A10s
++ */
++ sun4i_spi_fill_fifo(sspi, SUN4I_FIFO_DEPTH - 1);
+
+ /* Enable the interrupts */
+ sun4i_spi_write(sspi, SUN4I_INT_CTL_REG, SUN4I_INT_CTL_TC);
+@@ -279,9 +287,16 @@ static int sun4i_spi_transfer_one(struct spi_master *master,
+ reg = sun4i_spi_read(sspi, SUN4I_CTL_REG);
+ sun4i_spi_write(sspi, SUN4I_CTL_REG, reg | SUN4I_CTL_XCH);
+
++ tx_time = max(tfr->len * 8 * 2 / (tfr->speed_hz / 1000), 100U);
++ start = jiffies;
+ timeout = wait_for_completion_timeout(&sspi->done,
+- msecs_to_jiffies(1000));
++ msecs_to_jiffies(tx_time));
++ end = jiffies;
+ if (!timeout) {
++ dev_warn(&master->dev,
++ "%s: timeout transferring %u bytes@%iHz for %i(%i)ms",
++ dev_name(&spi->dev), tfr->len, tfr->speed_hz,
++ jiffies_to_msecs(end - start), tx_time);
+ ret = -ETIMEDOUT;
+ goto out;
+ }
+diff --git a/drivers/spi/spi-sun6i.c b/drivers/spi/spi-sun6i.c
+index bd24093f4038..04e90851504c 100644
+--- a/drivers/spi/spi-sun6i.c
++++ b/drivers/spi/spi-sun6i.c
+@@ -160,6 +160,7 @@ static int sun6i_spi_transfer_one(struct spi_master *master,
+ {
+ struct sun6i_spi *sspi = spi_master_get_devdata(master);
+ unsigned int mclk_rate, div, timeout;
++ unsigned int start, end, tx_time;
+ unsigned int tx_len = 0;
+ int ret = 0;
+ u32 reg;
+@@ -217,8 +218,8 @@ static int sun6i_spi_transfer_one(struct spi_master *master,
+
+ /* Ensure that we have a parent clock fast enough */
+ mclk_rate = clk_get_rate(sspi->mclk);
+- if (mclk_rate < (2 * spi->max_speed_hz)) {
+- clk_set_rate(sspi->mclk, 2 * spi->max_speed_hz);
++ if (mclk_rate < (2 * tfr->speed_hz)) {
++ clk_set_rate(sspi->mclk, 2 * tfr->speed_hz);
+ mclk_rate = clk_get_rate(sspi->mclk);
+ }
+
+@@ -236,14 +237,14 @@ static int sun6i_spi_transfer_one(struct spi_master *master,
+ * First try CDR2, and if we can't reach the expected
+ * frequency, fall back to CDR1.
+ */
+- div = mclk_rate / (2 * spi->max_speed_hz);
++ div = mclk_rate / (2 * tfr->speed_hz);
+ if (div <= (SUN6I_CLK_CTL_CDR2_MASK + 1)) {
+ if (div > 0)
+ div--;
+
+ reg = SUN6I_CLK_CTL_CDR2(div) | SUN6I_CLK_CTL_DRS;
+ } else {
+- div = ilog2(mclk_rate) - ilog2(spi->max_speed_hz);
++ div = ilog2(mclk_rate) - ilog2(tfr->speed_hz);
+ reg = SUN6I_CLK_CTL_CDR1(div);
+ }
+
+@@ -269,9 +270,16 @@ static int sun6i_spi_transfer_one(struct spi_master *master,
+ reg = sun6i_spi_read(sspi, SUN6I_TFR_CTL_REG);
+ sun6i_spi_write(sspi, SUN6I_TFR_CTL_REG, reg | SUN6I_TFR_CTL_XCH);
+
++ tx_time = max(tfr->len * 8 * 2 / (tfr->speed_hz / 1000), 100U);
++ start = jiffies;
+ timeout = wait_for_completion_timeout(&sspi->done,
+- msecs_to_jiffies(1000));
++ msecs_to_jiffies(tx_time));
++ end = jiffies;
+ if (!timeout) {
++ dev_warn(&master->dev,
++ "%s: timeout transferring %u bytes@%iHz for %i(%i)ms",
++ dev_name(&spi->dev), tfr->len, tfr->speed_hz,
++ jiffies_to_msecs(end - start), tx_time);
+ ret = -ETIMEDOUT;
+ goto out;
+ }
+diff --git a/drivers/tty/serial/8250/8250_core.c b/drivers/tty/serial/8250/8250_core.c
+index e5c31eadb0ac..04da6f0e3326 100644
+--- a/drivers/tty/serial/8250/8250_core.c
++++ b/drivers/tty/serial/8250/8250_core.c
+@@ -738,22 +738,16 @@ static int size_fifo(struct uart_8250_port *up)
+ */
+ static unsigned int autoconfig_read_divisor_id(struct uart_8250_port *p)
+ {
+- unsigned char old_dll, old_dlm, old_lcr;
+- unsigned int id;
++ unsigned char old_lcr;
++ unsigned int id, old_dl;
+
+ old_lcr = serial_in(p, UART_LCR);
+ serial_out(p, UART_LCR, UART_LCR_CONF_MODE_A);
++ old_dl = serial_dl_read(p);
++ serial_dl_write(p, 0);
++ id = serial_dl_read(p);
++ serial_dl_write(p, old_dl);
+
+- old_dll = serial_in(p, UART_DLL);
+- old_dlm = serial_in(p, UART_DLM);
+-
+- serial_out(p, UART_DLL, 0);
+- serial_out(p, UART_DLM, 0);
+-
+- id = serial_in(p, UART_DLL) | serial_in(p, UART_DLM) << 8;
+-
+- serial_out(p, UART_DLL, old_dll);
+- serial_out(p, UART_DLM, old_dlm);
+ serial_out(p, UART_LCR, old_lcr);
+
+ return id;
+diff --git a/drivers/tty/serial/samsung.c b/drivers/tty/serial/samsung.c
+index 587d63bcbd0e..b7213637f498 100644
+--- a/drivers/tty/serial/samsung.c
++++ b/drivers/tty/serial/samsung.c
+@@ -749,6 +749,8 @@ static void s3c24xx_serial_set_termios(struct uart_port *port,
+ /* check to see if we need to change clock source */
+
+ if (ourport->baudclk != clk) {
++ clk_prepare_enable(clk);
++
+ s3c24xx_serial_setsource(port, clk_sel);
+
+ if (!IS_ERR(ourport->baudclk)) {
+@@ -756,8 +758,6 @@ static void s3c24xx_serial_set_termios(struct uart_port *port,
+ ourport->baudclk = ERR_PTR(-EINVAL);
+ }
+
+- clk_prepare_enable(clk);
+-
+ ourport->baudclk = clk;
+ ourport->baudclk_rate = clk ? clk_get_rate(clk) : 0;
+ }
+diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c
+index 53c25bca7d05..9062636d3154 100644
+--- a/drivers/tty/vt/vt.c
++++ b/drivers/tty/vt/vt.c
+@@ -3591,9 +3591,10 @@ static int do_register_con_driver(const struct consw *csw, int first, int last)
+ goto err;
+
+ desc = csw->con_startup();
+-
+- if (!desc)
++ if (!desc) {
++ retval = -ENODEV;
+ goto err;
++ }
+
+ retval = -EINVAL;
+
+diff --git a/drivers/usb/common/usb-otg-fsm.c b/drivers/usb/common/usb-otg-fsm.c
+index c812fefe0e50..27baa36cca00 100644
+--- a/drivers/usb/common/usb-otg-fsm.c
++++ b/drivers/usb/common/usb-otg-fsm.c
+@@ -21,6 +21,7 @@
+ * 675 Mass Ave, Cambridge, MA 02139, USA.
+ */
+
++#include <linux/module.h>
+ #include <linux/kernel.h>
+ #include <linux/types.h>
+ #include <linux/mutex.h>
+@@ -365,3 +366,4 @@ int otg_statemachine(struct otg_fsm *fsm)
+ return state_changed;
+ }
+ EXPORT_SYMBOL_GPL(otg_statemachine);
++MODULE_LICENSE("GPL");
+diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c
+index 87cc0654b49e..096bb82c69c4 100644
+--- a/drivers/usb/core/hcd.c
++++ b/drivers/usb/core/hcd.c
+@@ -2523,26 +2523,23 @@ EXPORT_SYMBOL_GPL(usb_create_hcd);
+ * Don't deallocate the bandwidth_mutex until the last shared usb_hcd is
+ * deallocated.
+ *
+- * Make sure to only deallocate the bandwidth_mutex when the primary HCD is
+- * freed. When hcd_release() is called for either hcd in a peer set
+- * invalidate the peer's ->shared_hcd and ->primary_hcd pointers to
+- * block new peering attempts
++ * Make sure to deallocate the bandwidth_mutex only when the last HCD is
++ * freed. When hcd_release() is called for either hcd in a peer set,
++ * invalidate the peer's ->shared_hcd and ->primary_hcd pointers.
+ */
+ static void hcd_release(struct kref *kref)
+ {
+ struct usb_hcd *hcd = container_of (kref, struct usb_hcd, kref);
+
+ mutex_lock(&usb_port_peer_mutex);
+- if (usb_hcd_is_primary_hcd(hcd)) {
+- kfree(hcd->address0_mutex);
+- kfree(hcd->bandwidth_mutex);
+- }
+ if (hcd->shared_hcd) {
+ struct usb_hcd *peer = hcd->shared_hcd;
+
+ peer->shared_hcd = NULL;
+- if (peer->primary_hcd == hcd)
+- peer->primary_hcd = NULL;
++ peer->primary_hcd = NULL;
++ } else {
++ kfree(hcd->address0_mutex);
++ kfree(hcd->bandwidth_mutex);
+ }
+ mutex_unlock(&usb_port_peer_mutex);
+ kfree(hcd);
+diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
+index 6b53fc3ec636..0673a5abc21d 100644
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -44,6 +44,9 @@ static const struct usb_device_id usb_quirk_list[] = {
+ /* Creative SB Audigy 2 NX */
+ { USB_DEVICE(0x041e, 0x3020), .driver_info = USB_QUIRK_RESET_RESUME },
+
++ /* USB3503 */
++ { USB_DEVICE(0x0424, 0x3503), .driver_info = USB_QUIRK_RESET_RESUME },
++
+ /* Microsoft Wireless Laser Mouse 6000 Receiver */
+ { USB_DEVICE(0x045e, 0x00e1), .driver_info = USB_QUIRK_RESET_RESUME },
+
+@@ -167,6 +170,10 @@ static const struct usb_device_id usb_quirk_list[] = {
+ /* MAYA44USB sound device */
+ { USB_DEVICE(0x0a92, 0x0091), .driver_info = USB_QUIRK_RESET_RESUME },
+
++ /* ASUS Base Station(T100) */
++ { USB_DEVICE(0x0b05, 0x17e0), .driver_info =
++ USB_QUIRK_IGNORE_REMOTE_WAKEUP },
++
+ /* Action Semiconductor flash disk */
+ { USB_DEVICE(0x10d6, 0x2200), .driver_info =
+ USB_QUIRK_STRING_FETCH_255 },
+@@ -182,26 +189,22 @@ static const struct usb_device_id usb_quirk_list[] = {
+ { USB_DEVICE(0x1908, 0x1315), .driver_info =
+ USB_QUIRK_HONOR_BNUMINTERFACES },
+
+- /* INTEL VALUE SSD */
+- { USB_DEVICE(0x8086, 0xf1a5), .driver_info = USB_QUIRK_RESET_RESUME },
+-
+- /* USB3503 */
+- { USB_DEVICE(0x0424, 0x3503), .driver_info = USB_QUIRK_RESET_RESUME },
+-
+- /* ASUS Base Station(T100) */
+- { USB_DEVICE(0x0b05, 0x17e0), .driver_info =
+- USB_QUIRK_IGNORE_REMOTE_WAKEUP },
+-
+ /* Protocol and OTG Electrical Test Device */
+ { USB_DEVICE(0x1a0a, 0x0200), .driver_info =
+ USB_QUIRK_LINEAR_UFRAME_INTR_BINTERVAL },
+
++ /* Acer C120 LED Projector */
++ { USB_DEVICE(0x1de1, 0xc102), .driver_info = USB_QUIRK_NO_LPM },
++
+ /* Blackmagic Design Intensity Shuttle */
+ { USB_DEVICE(0x1edb, 0xbd3b), .driver_info = USB_QUIRK_NO_LPM },
+
+ /* Blackmagic Design UltraStudio SDI */
+ { USB_DEVICE(0x1edb, 0xbd4f), .driver_info = USB_QUIRK_NO_LPM },
+
++ /* INTEL VALUE SSD */
++ { USB_DEVICE(0x8086, 0xf1a5), .driver_info = USB_QUIRK_RESET_RESUME },
++
+ { } /* terminating entry must be last */
+ };
+
+diff --git a/drivers/usb/dwc3/dwc3-exynos.c b/drivers/usb/dwc3/dwc3-exynos.c
+index 3951a65fea04..e184d17588ab 100644
+--- a/drivers/usb/dwc3/dwc3-exynos.c
++++ b/drivers/usb/dwc3/dwc3-exynos.c
+@@ -106,7 +106,6 @@ static int dwc3_exynos_remove_child(struct device *dev, void *unused)
+ static int dwc3_exynos_probe(struct platform_device *pdev)
+ {
+ struct dwc3_exynos *exynos;
+- struct clk *clk;
+ struct device *dev = &pdev->dev;
+ struct device_node *node = dev->of_node;
+
+@@ -127,21 +126,13 @@ static int dwc3_exynos_probe(struct platform_device *pdev)
+
+ platform_set_drvdata(pdev, exynos);
+
+- ret = dwc3_exynos_register_phys(exynos);
+- if (ret) {
+- dev_err(dev, "couldn't register PHYs\n");
+- return ret;
+- }
++ exynos->dev = dev;
+
+- clk = devm_clk_get(dev, "usbdrd30");
+- if (IS_ERR(clk)) {
++ exynos->clk = devm_clk_get(dev, "usbdrd30");
++ if (IS_ERR(exynos->clk)) {
+ dev_err(dev, "couldn't get clock\n");
+ return -EINVAL;
+ }
+-
+- exynos->dev = dev;
+- exynos->clk = clk;
+-
+ clk_prepare_enable(exynos->clk);
+
+ exynos->vdd33 = devm_regulator_get(dev, "vdd33");
+@@ -166,26 +157,35 @@ static int dwc3_exynos_probe(struct platform_device *pdev)
+ goto err3;
+ }
+
++ ret = dwc3_exynos_register_phys(exynos);
++ if (ret) {
++ dev_err(dev, "couldn't register PHYs\n");
++ goto err4;
++ }
++
+ if (node) {
+ ret = of_platform_populate(node, NULL, NULL, dev);
+ if (ret) {
+ dev_err(dev, "failed to add dwc3 core\n");
+- goto err4;
++ goto err5;
+ }
+ } else {
+ dev_err(dev, "no device node, failed to add dwc3 core\n");
+ ret = -ENODEV;
+- goto err4;
++ goto err5;
+ }
+
+ return 0;
+
++err5:
++ platform_device_unregister(exynos->usb2_phy);
++ platform_device_unregister(exynos->usb3_phy);
+ err4:
+ regulator_disable(exynos->vdd10);
+ err3:
+ regulator_disable(exynos->vdd33);
+ err2:
+- clk_disable_unprepare(clk);
++ clk_disable_unprepare(exynos->clk);
+ return ret;
+ }
+
+diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c
+index db2becd31a51..54f964bbc79a 100644
+--- a/drivers/usb/gadget/legacy/inode.c
++++ b/drivers/usb/gadget/legacy/inode.c
+@@ -1018,8 +1018,11 @@ ep0_read (struct file *fd, char __user *buf, size_t len, loff_t *ptr)
+ struct usb_ep *ep = dev->gadget->ep0;
+ struct usb_request *req = dev->req;
+
+- if ((retval = setup_req (ep, req, 0)) == 0)
+- retval = usb_ep_queue (ep, req, GFP_ATOMIC);
++ if ((retval = setup_req (ep, req, 0)) == 0) {
++ spin_unlock_irq (&dev->lock);
++ retval = usb_ep_queue (ep, req, GFP_KERNEL);
++ spin_lock_irq (&dev->lock);
++ }
+ dev->state = STATE_DEV_CONNECTED;
+
+ /* assume that was SET_CONFIGURATION */
+@@ -1550,8 +1553,11 @@ delegate:
+ w_length);
+ if (value < 0)
+ break;
++
++ spin_unlock (&dev->lock);
+ value = usb_ep_queue (gadget->ep0, dev->req,
+- GFP_ATOMIC);
++ GFP_KERNEL);
++ spin_lock (&dev->lock);
+ if (value < 0) {
+ clean_req (gadget->ep0, dev->req);
+ break;
+@@ -1574,11 +1580,14 @@ delegate:
+ if (value >= 0 && dev->state != STATE_DEV_SETUP) {
+ req->length = value;
+ req->zero = value < w_length;
+- value = usb_ep_queue (gadget->ep0, req, GFP_ATOMIC);
++
++ spin_unlock (&dev->lock);
++ value = usb_ep_queue (gadget->ep0, req, GFP_KERNEL);
+ if (value < 0) {
+ DBG (dev, "ep_queue --> %d\n", value);
+ req->status = 0;
+ }
++ return value;
+ }
+
+ /* device stalls when value < 0 */
+diff --git a/drivers/usb/host/ehci-tegra.c b/drivers/usb/host/ehci-tegra.c
+index aaa01971efe9..aad253559bcd 100644
+--- a/drivers/usb/host/ehci-tegra.c
++++ b/drivers/usb/host/ehci-tegra.c
+@@ -89,7 +89,7 @@ static int tegra_reset_usb_controller(struct platform_device *pdev)
+ if (!usb1_reset_attempted) {
+ struct reset_control *usb1_reset;
+
+- usb1_reset = of_reset_control_get(phy_np, "usb");
++ usb1_reset = of_reset_control_get(phy_np, "utmi-pads");
+ if (IS_ERR(usb1_reset)) {
+ dev_warn(&pdev->dev,
+ "can't get utmi-pads reset from the PHY\n");
+diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
+index c6027acb6263..54caaf87c567 100644
+--- a/drivers/usb/host/xhci-pci.c
++++ b/drivers/usb/host/xhci-pci.c
+@@ -37,6 +37,7 @@
+ /* Device for a quirk */
+ #define PCI_VENDOR_ID_FRESCO_LOGIC 0x1b73
+ #define PCI_DEVICE_ID_FRESCO_LOGIC_PDK 0x1000
++#define PCI_DEVICE_ID_FRESCO_LOGIC_FL1009 0x1009
+ #define PCI_DEVICE_ID_FRESCO_LOGIC_FL1400 0x1400
+
+ #define PCI_VENDOR_ID_ETRON 0x1b6f
+@@ -108,6 +109,10 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
+ xhci->quirks |= XHCI_TRUST_TX_LENGTH;
+ }
+
++ if (pdev->vendor == PCI_VENDOR_ID_FRESCO_LOGIC &&
++ pdev->device == PCI_DEVICE_ID_FRESCO_LOGIC_FL1009)
++ xhci->quirks |= XHCI_BROKEN_STREAMS;
++
+ if (pdev->vendor == PCI_VENDOR_ID_NEC)
+ xhci->quirks |= XHCI_NEC_HOST;
+
+diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c
+index 22516f41c6f4..3dd487872bf1 100644
+--- a/drivers/usb/host/xhci-plat.c
++++ b/drivers/usb/host/xhci-plat.c
+@@ -118,6 +118,9 @@ static int xhci_plat_probe(struct platform_device *pdev)
+ ret = clk_prepare_enable(clk);
+ if (ret)
+ goto put_hcd;
++ } else if (PTR_ERR(clk) == -EPROBE_DEFER) {
++ ret = -EPROBE_DEFER;
++ goto put_hcd;
+ }
+
+ if (of_device_is_compatible(pdev->dev.of_node,
+diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
+index 04e75258fb46..69464630be54 100644
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -289,6 +289,14 @@ static int xhci_abort_cmd_ring(struct xhci_hcd *xhci)
+
+ temp_64 = xhci_read_64(xhci, &xhci->op_regs->cmd_ring);
+ xhci->cmd_ring_state = CMD_RING_STATE_ABORTED;
++
++ /*
++ * Writing the CMD_RING_ABORT bit should cause a cmd completion event,
++ * however on some host hw the CMD_RING_RUNNING bit is correctly cleared
++ * but the completion event in never sent. Use the cmd timeout timer to
++ * handle those cases. Use twice the time to cover the bit polling retry
++ */
++ mod_timer(&xhci->cmd_timer, jiffies + (2 * XHCI_CMD_DEFAULT_TIMEOUT));
+ xhci_write_64(xhci, temp_64 | CMD_RING_ABORT,
+ &xhci->op_regs->cmd_ring);
+
+@@ -304,6 +312,7 @@ static int xhci_abort_cmd_ring(struct xhci_hcd *xhci)
+ if (ret < 0) {
+ xhci_err(xhci, "Stopped the command ring failed, "
+ "maybe the host is dead\n");
++ del_timer(&xhci->cmd_timer);
+ xhci->xhc_state |= XHCI_STATE_DYING;
+ xhci_quiesce(xhci);
+ xhci_halt(xhci);
+@@ -1245,22 +1254,21 @@ void xhci_handle_command_timeout(unsigned long data)
+ int ret;
+ unsigned long flags;
+ u64 hw_ring_state;
+- struct xhci_command *cur_cmd = NULL;
++ bool second_timeout = false;
+ xhci = (struct xhci_hcd *) data;
+
+ /* mark this command to be cancelled */
+ spin_lock_irqsave(&xhci->lock, flags);
+ if (xhci->current_cmd) {
+- cur_cmd = xhci->current_cmd;
+- cur_cmd->status = COMP_CMD_ABORT;
++ if (xhci->current_cmd->status == COMP_CMD_ABORT)
++ second_timeout = true;
++ xhci->current_cmd->status = COMP_CMD_ABORT;
+ }
+
+-
+ /* Make sure command ring is running before aborting it */
+ hw_ring_state = xhci_read_64(xhci, &xhci->op_regs->cmd_ring);
+ if ((xhci->cmd_ring_state & CMD_RING_STATE_RUNNING) &&
+ (hw_ring_state & CMD_RING_RUNNING)) {
+-
+ spin_unlock_irqrestore(&xhci->lock, flags);
+ xhci_dbg(xhci, "Command timeout\n");
+ ret = xhci_abort_cmd_ring(xhci);
+@@ -1272,6 +1280,15 @@ void xhci_handle_command_timeout(unsigned long data)
+ }
+ return;
+ }
++
++ /* command ring failed to restart, or host removed. Bail out */
++ if (second_timeout || xhci->xhc_state & XHCI_STATE_REMOVING) {
++ spin_unlock_irqrestore(&xhci->lock, flags);
++ xhci_dbg(xhci, "command timed out twice, ring start fail?\n");
++ xhci_cleanup_command_queue(xhci);
++ return;
++ }
++
+ /* command timeout on stopped ring, ring can't be aborted */
+ xhci_dbg(xhci, "Command timeout on stopped ring\n");
+ xhci_handle_stopped_cmd_ring(xhci, xhci->current_cmd);
+diff --git a/drivers/usb/musb/musb_host.c b/drivers/usb/musb/musb_host.c
+index 4500610356f2..7da914bc2094 100644
+--- a/drivers/usb/musb/musb_host.c
++++ b/drivers/usb/musb/musb_host.c
+@@ -583,14 +583,13 @@ musb_rx_reinit(struct musb *musb, struct musb_qh *qh, struct musb_hw_ep *ep)
+ musb_writew(ep->regs, MUSB_TXCSR, 0);
+
+ /* scrub all previous state, clearing toggle */
+- } else {
+- csr = musb_readw(ep->regs, MUSB_RXCSR);
+- if (csr & MUSB_RXCSR_RXPKTRDY)
+- WARNING("rx%d, packet/%d ready?\n", ep->epnum,
+- musb_readw(ep->regs, MUSB_RXCOUNT));
+-
+- musb_h_flush_rxfifo(ep, MUSB_RXCSR_CLRDATATOG);
+ }
++ csr = musb_readw(ep->regs, MUSB_RXCSR);
++ if (csr & MUSB_RXCSR_RXPKTRDY)
++ WARNING("rx%d, packet/%d ready?\n", ep->epnum,
++ musb_readw(ep->regs, MUSB_RXCOUNT));
++
++ musb_h_flush_rxfifo(ep, MUSB_RXCSR_CLRDATATOG);
+
+ /* target addr and (for multipoint) hub addr/port */
+ if (musb->is_multipoint) {
+@@ -950,9 +949,15 @@ static void musb_bulk_nak_timeout(struct musb *musb, struct musb_hw_ep *ep,
+ if (is_in) {
+ dma = is_dma_capable() ? ep->rx_channel : NULL;
+
+- /* clear nak timeout bit */
++ /*
++ * Need to stop the transaction by clearing REQPKT first
++ * then the NAK Timeout bit ref MUSBMHDRC USB 2.0 HIGH-SPEED
++ * DUAL-ROLE CONTROLLER Programmer's Guide, section 9.2.2
++ */
+ rx_csr = musb_readw(epio, MUSB_RXCSR);
+ rx_csr |= MUSB_RXCSR_H_WZC_BITS;
++ rx_csr &= ~MUSB_RXCSR_H_REQPKT;
++ musb_writew(epio, MUSB_RXCSR, rx_csr);
+ rx_csr &= ~MUSB_RXCSR_DATAERROR;
+ musb_writew(epio, MUSB_RXCSR, rx_csr);
+
+diff --git a/drivers/usb/usbip/usbip_common.c b/drivers/usb/usbip/usbip_common.c
+index facaaf003f19..e40da7759a0e 100644
+--- a/drivers/usb/usbip/usbip_common.c
++++ b/drivers/usb/usbip/usbip_common.c
+@@ -741,6 +741,17 @@ int usbip_recv_xbuff(struct usbip_device *ud, struct urb *urb)
+ if (!(size > 0))
+ return 0;
+
++ if (size > urb->transfer_buffer_length) {
++ /* should not happen, probably malicious packet */
++ if (ud->side == USBIP_STUB) {
++ usbip_event_add(ud, SDEV_EVENT_ERROR_TCP);
++ return 0;
++ } else {
++ usbip_event_add(ud, VDEV_EVENT_ERROR_TCP);
++ return -EPIPE;
++ }
++ }
++
+ ret = usbip_recv(ud->tcp_socket, urb->transfer_buffer, size);
+ if (ret != size) {
+ dev_err(&urb->dev->dev, "recv xbuf, %d\n", ret);
+diff --git a/drivers/video/fbdev/Kconfig b/drivers/video/fbdev/Kconfig
+index a5f88377cec5..cdd965fae22c 100644
+--- a/drivers/video/fbdev/Kconfig
++++ b/drivers/video/fbdev/Kconfig
+@@ -2266,7 +2266,6 @@ config XEN_FBDEV_FRONTEND
+ select FB_SYS_IMAGEBLIT
+ select FB_SYS_FOPS
+ select FB_DEFERRED_IO
+- select INPUT_XEN_KBDDEV_FRONTEND if INPUT_MISC
+ select XEN_XENBUS_FRONTEND
+ default y
+ help
+diff --git a/drivers/video/fbdev/da8xx-fb.c b/drivers/video/fbdev/da8xx-fb.c
+index 10c876c95772..4515e4cddbca 100644
+--- a/drivers/video/fbdev/da8xx-fb.c
++++ b/drivers/video/fbdev/da8xx-fb.c
+@@ -209,8 +209,7 @@ static struct fb_videomode known_lcd_panels[] = {
+ .lower_margin = 2,
+ .hsync_len = 0,
+ .vsync_len = 0,
+- .sync = FB_SYNC_CLK_INVERT |
+- FB_SYNC_HOR_HIGH_ACT | FB_SYNC_VERT_HIGH_ACT,
++ .sync = FB_SYNC_CLK_INVERT,
+ },
+ /* Sharp LK043T1DG01 */
+ [1] = {
+@@ -224,7 +223,7 @@ static struct fb_videomode known_lcd_panels[] = {
+ .lower_margin = 2,
+ .hsync_len = 41,
+ .vsync_len = 10,
+- .sync = FB_SYNC_HOR_HIGH_ACT | FB_SYNC_VERT_HIGH_ACT,
++ .sync = 0,
+ .flag = 0,
+ },
+ [2] = {
+@@ -239,7 +238,7 @@ static struct fb_videomode known_lcd_panels[] = {
+ .lower_margin = 10,
+ .hsync_len = 10,
+ .vsync_len = 10,
+- .sync = FB_SYNC_HOR_HIGH_ACT | FB_SYNC_VERT_HIGH_ACT,
++ .sync = 0,
+ .flag = 0,
+ },
+ [3] = {
+diff --git a/drivers/xen/xen-pciback/conf_space.c b/drivers/xen/xen-pciback/conf_space.c
+index 9c234209d8b5..47a4177b16d2 100644
+--- a/drivers/xen/xen-pciback/conf_space.c
++++ b/drivers/xen/xen-pciback/conf_space.c
+@@ -183,8 +183,7 @@ int xen_pcibk_config_read(struct pci_dev *dev, int offset, int size,
+ field_start = OFFSET(cfg_entry);
+ field_end = OFFSET(cfg_entry) + field->size;
+
+- if ((req_start >= field_start && req_start < field_end)
+- || (req_end > field_start && req_end <= field_end)) {
++ if (req_end > field_start && field_end > req_start) {
+ err = conf_space_read(dev, cfg_entry, field_start,
+ &tmp_val);
+ if (err)
+@@ -230,8 +229,7 @@ int xen_pcibk_config_write(struct pci_dev *dev, int offset, int size, u32 value)
+ field_start = OFFSET(cfg_entry);
+ field_end = OFFSET(cfg_entry) + field->size;
+
+- if ((req_start >= field_start && req_start < field_end)
+- || (req_end > field_start && req_end <= field_end)) {
++ if (req_end > field_start && field_end > req_start) {
+ tmp_val = 0;
+
+ err = xen_pcibk_config_read(dev, field_start,
+diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c
+index f54511dd287e..39c68ef10808 100644
+--- a/fs/btrfs/ctree.c
++++ b/fs/btrfs/ctree.c
+@@ -1542,6 +1542,7 @@ noinline int btrfs_cow_block(struct btrfs_trans_handle *trans,
+ trans->transid, root->fs_info->generation);
+
+ if (!should_cow_block(trans, root, buf)) {
++ trans->dirty = true;
+ *cow_ret = buf;
+ return 0;
+ }
+@@ -2762,8 +2763,10 @@ again:
+ * then we don't want to set the path blocking,
+ * so we test it here
+ */
+- if (!should_cow_block(trans, root, b))
++ if (!should_cow_block(trans, root, b)) {
++ trans->dirty = true;
+ goto cow_done;
++ }
+
+ /*
+ * must have write locks on this node and the
+diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
+index 950479f2d337..a067065efa6b 100644
+--- a/fs/btrfs/extent-tree.c
++++ b/fs/btrfs/extent-tree.c
+@@ -7237,7 +7237,7 @@ btrfs_init_new_buffer(struct btrfs_trans_handle *trans, struct btrfs_root *root,
+ set_extent_dirty(&trans->transaction->dirty_pages, buf->start,
+ buf->start + buf->len - 1, GFP_NOFS);
+ }
+- trans->blocks_used++;
++ trans->dirty = true;
+ /* this returns a buffer locked for blocking */
+ return buf;
+ }
+@@ -9196,9 +9196,8 @@ void btrfs_create_pending_block_groups(struct btrfs_trans_handle *trans,
+ int ret = 0;
+
+ list_for_each_entry_safe(block_group, tmp, &trans->new_bgs, bg_list) {
+- list_del_init(&block_group->bg_list);
+ if (ret)
+- continue;
++ goto next;
+
+ spin_lock(&block_group->lock);
+ memcpy(&item, &block_group->item, sizeof(item));
+@@ -9213,6 +9212,8 @@ void btrfs_create_pending_block_groups(struct btrfs_trans_handle *trans,
+ key.objectid, key.offset);
+ if (ret)
+ btrfs_abort_transaction(trans, extent_root, ret);
++next:
++ list_del_init(&block_group->bg_list);
+ }
+ }
+
+diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
+index 1c1ee12ab0cf..d96b2bc444c8 100644
+--- a/fs/btrfs/ioctl.c
++++ b/fs/btrfs/ioctl.c
+@@ -1656,7 +1656,7 @@ static noinline int btrfs_ioctl_snap_create_transid(struct file *file,
+
+ src_inode = file_inode(src.file);
+ if (src_inode->i_sb != file_inode(file)->i_sb) {
+- btrfs_info(BTRFS_I(src_inode)->root->fs_info,
++ btrfs_info(BTRFS_I(file_inode(file))->root->fs_info,
+ "Snapshot src from another FS");
+ ret = -EXDEV;
+ } else if (!inode_owner_or_capable(src_inode)) {
+diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c
+index 7ceaaf2010f9..cf6d11bb8dcb 100644
+--- a/fs/btrfs/super.c
++++ b/fs/btrfs/super.c
+@@ -262,7 +262,7 @@ void __btrfs_abort_transaction(struct btrfs_trans_handle *trans,
+ trans->aborted = errno;
+ /* Nothing used. The other threads that have joined this
+ * transaction may be able to continue. */
+- if (!trans->blocks_used) {
++ if (!trans->dirty && list_empty(&trans->new_bgs)) {
+ const char *errstr;
+
+ errstr = btrfs_decode_error(errno);
+diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c
+index 240019f36b2a..30dbf315c2d6 100644
+--- a/fs/btrfs/transaction.c
++++ b/fs/btrfs/transaction.c
+@@ -472,7 +472,6 @@ again:
+
+ h->transid = cur_trans->transid;
+ h->transaction = cur_trans;
+- h->blocks_used = 0;
+ h->bytes_reserved = 0;
+ h->root = root;
+ h->delayed_ref_updates = 0;
+diff --git a/fs/btrfs/transaction.h b/fs/btrfs/transaction.h
+index 1ba9c3e04191..1cf5de30368a 100644
+--- a/fs/btrfs/transaction.h
++++ b/fs/btrfs/transaction.h
+@@ -88,7 +88,6 @@ struct btrfs_trans_handle {
+ u64 qgroup_reserved;
+ unsigned long use_count;
+ unsigned long blocks_reserved;
+- unsigned long blocks_used;
+ unsigned long delayed_ref_updates;
+ struct btrfs_transaction *transaction;
+ struct btrfs_block_rsv *block_rsv;
+@@ -98,6 +97,7 @@ struct btrfs_trans_handle {
+ bool allocating_chunk;
+ bool reloc_reserved;
+ bool sync;
++ bool dirty;
+ unsigned int type;
+ /*
+ * this root is only needed to validate that the root passed to
+diff --git a/fs/cifs/cifs_unicode.c b/fs/cifs/cifs_unicode.c
+index 0303c6793d90..f7fb4b8658ba 100644
+--- a/fs/cifs/cifs_unicode.c
++++ b/fs/cifs/cifs_unicode.c
+@@ -136,6 +136,12 @@ convert_sfm_char(const __u16 src_char, char *target)
+ case SFM_SLASH:
+ *target = '\\';
+ break;
++ case SFM_SPACE:
++ *target = ' ';
++ break;
++ case SFM_PERIOD:
++ *target = '.';
++ break;
+ default:
+ return false;
+ }
+@@ -364,7 +370,7 @@ static __le16 convert_to_sfu_char(char src_char)
+ return dest_char;
+ }
+
+-static __le16 convert_to_sfm_char(char src_char)
++static __le16 convert_to_sfm_char(char src_char, bool end_of_string)
+ {
+ __le16 dest_char;
+
+@@ -387,6 +393,18 @@ static __le16 convert_to_sfm_char(char src_char)
+ case '|':
+ dest_char = cpu_to_le16(SFM_PIPE);
+ break;
++ case '.':
++ if (end_of_string)
++ dest_char = cpu_to_le16(SFM_PERIOD);
++ else
++ dest_char = 0;
++ break;
++ case ' ':
++ if (end_of_string)
++ dest_char = cpu_to_le16(SFM_SPACE);
++ else
++ dest_char = 0;
++ break;
+ default:
+ dest_char = 0;
+ }
+@@ -424,9 +442,16 @@ cifsConvertToUTF16(__le16 *target, const char *source, int srclen,
+ /* see if we must remap this char */
+ if (map_chars == SFU_MAP_UNI_RSVD)
+ dst_char = convert_to_sfu_char(src_char);
+- else if (map_chars == SFM_MAP_UNI_RSVD)
+- dst_char = convert_to_sfm_char(src_char);
+- else
++ else if (map_chars == SFM_MAP_UNI_RSVD) {
++ bool end_of_string;
++
++ if (i == srclen - 1)
++ end_of_string = true;
++ else
++ end_of_string = false;
++
++ dst_char = convert_to_sfm_char(src_char, end_of_string);
++ } else
+ dst_char = 0;
+ /*
+ * FIXME: We can not handle remapping backslash (UNI_SLASH)
+diff --git a/fs/cifs/cifs_unicode.h b/fs/cifs/cifs_unicode.h
+index bdc52cb9a676..479bc0a941f3 100644
+--- a/fs/cifs/cifs_unicode.h
++++ b/fs/cifs/cifs_unicode.h
+@@ -64,6 +64,8 @@
+ #define SFM_LESSTHAN ((__u16) 0xF023)
+ #define SFM_PIPE ((__u16) 0xF027)
+ #define SFM_SLASH ((__u16) 0xF026)
++#define SFM_PERIOD ((__u16) 0xF028)
++#define SFM_SPACE ((__u16) 0xF029)
+
+ /*
+ * Mapping mechanism to use when one of the seven reserved characters is
+diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
+index 82ebe7dbd834..db97215a23b2 100644
+--- a/fs/cifs/connect.c
++++ b/fs/cifs/connect.c
+@@ -413,7 +413,9 @@ cifs_echo_request(struct work_struct *work)
+ * server->ops->need_neg() == true. Also, no need to ping if
+ * we got a response recently.
+ */
+- if (!server->ops->need_neg || server->ops->need_neg(server) ||
++
++ if (server->tcpStatus == CifsNeedReconnect ||
++ server->tcpStatus == CifsExiting || server->tcpStatus == CifsNew ||
+ (server->ops->can_echo && !server->ops->can_echo(server)) ||
+ time_before(jiffies, server->lstrp + SMB_ECHO_INTERVAL - HZ))
+ goto requeue_echo;
+diff --git a/fs/cifs/ntlmssp.h b/fs/cifs/ntlmssp.h
+index 848249fa120f..3079b38f0afb 100644
+--- a/fs/cifs/ntlmssp.h
++++ b/fs/cifs/ntlmssp.h
+@@ -133,6 +133,6 @@ typedef struct _AUTHENTICATE_MESSAGE {
+
+ int decode_ntlmssp_challenge(char *bcc_ptr, int blob_len, struct cifs_ses *ses);
+ void build_ntlmssp_negotiate_blob(unsigned char *pbuffer, struct cifs_ses *ses);
+-int build_ntlmssp_auth_blob(unsigned char *pbuffer, u16 *buflen,
++int build_ntlmssp_auth_blob(unsigned char **pbuffer, u16 *buflen,
+ struct cifs_ses *ses,
+ const struct nls_table *nls_cp);
+diff --git a/fs/cifs/sess.c b/fs/cifs/sess.c
+index fe423e18450f..693da83a65f0 100644
+--- a/fs/cifs/sess.c
++++ b/fs/cifs/sess.c
+@@ -364,19 +364,43 @@ void build_ntlmssp_negotiate_blob(unsigned char *pbuffer,
+ sec_blob->DomainName.MaximumLength = 0;
+ }
+
+-/* We do not malloc the blob, it is passed in pbuffer, because its
+- maximum possible size is fixed and small, making this approach cleaner.
+- This function returns the length of the data in the blob */
+-int build_ntlmssp_auth_blob(unsigned char *pbuffer,
++static int size_of_ntlmssp_blob(struct cifs_ses *ses)
++{
++ int sz = sizeof(AUTHENTICATE_MESSAGE) + ses->auth_key.len
++ - CIFS_SESS_KEY_SIZE + CIFS_CPHTXT_SIZE + 2;
++
++ if (ses->domainName)
++ sz += 2 * strnlen(ses->domainName, CIFS_MAX_DOMAINNAME_LEN);
++ else
++ sz += 2;
++
++ if (ses->user_name)
++ sz += 2 * strnlen(ses->user_name, CIFS_MAX_USERNAME_LEN);
++ else
++ sz += 2;
++
++ return sz;
++}
++
++int build_ntlmssp_auth_blob(unsigned char **pbuffer,
+ u16 *buflen,
+ struct cifs_ses *ses,
+ const struct nls_table *nls_cp)
+ {
+ int rc;
+- AUTHENTICATE_MESSAGE *sec_blob = (AUTHENTICATE_MESSAGE *)pbuffer;
++ AUTHENTICATE_MESSAGE *sec_blob;
+ __u32 flags;
+ unsigned char *tmp;
+
++ rc = setup_ntlmv2_rsp(ses, nls_cp);
++ if (rc) {
++ cifs_dbg(VFS, "Error %d during NTLMSSP authentication\n", rc);
++ *buflen = 0;
++ goto setup_ntlmv2_ret;
++ }
++ *pbuffer = kmalloc(size_of_ntlmssp_blob(ses), GFP_KERNEL);
++ sec_blob = (AUTHENTICATE_MESSAGE *)*pbuffer;
++
+ memcpy(sec_blob->Signature, NTLMSSP_SIGNATURE, 8);
+ sec_blob->MessageType = NtLmAuthenticate;
+
+@@ -391,7 +415,7 @@ int build_ntlmssp_auth_blob(unsigned char *pbuffer,
+ flags |= NTLMSSP_NEGOTIATE_KEY_XCH;
+ }
+
+- tmp = pbuffer + sizeof(AUTHENTICATE_MESSAGE);
++ tmp = *pbuffer + sizeof(AUTHENTICATE_MESSAGE);
+ sec_blob->NegotiateFlags = cpu_to_le32(flags);
+
+ sec_blob->LmChallengeResponse.BufferOffset =
+@@ -399,13 +423,9 @@ int build_ntlmssp_auth_blob(unsigned char *pbuffer,
+ sec_blob->LmChallengeResponse.Length = 0;
+ sec_blob->LmChallengeResponse.MaximumLength = 0;
+
+- sec_blob->NtChallengeResponse.BufferOffset = cpu_to_le32(tmp - pbuffer);
++ sec_blob->NtChallengeResponse.BufferOffset =
++ cpu_to_le32(tmp - *pbuffer);
+ if (ses->user_name != NULL) {
+- rc = setup_ntlmv2_rsp(ses, nls_cp);
+- if (rc) {
+- cifs_dbg(VFS, "Error %d during NTLMSSP authentication\n", rc);
+- goto setup_ntlmv2_ret;
+- }
+ memcpy(tmp, ses->auth_key.response + CIFS_SESS_KEY_SIZE,
+ ses->auth_key.len - CIFS_SESS_KEY_SIZE);
+ tmp += ses->auth_key.len - CIFS_SESS_KEY_SIZE;
+@@ -423,7 +443,7 @@ int build_ntlmssp_auth_blob(unsigned char *pbuffer,
+ }
+
+ if (ses->domainName == NULL) {
+- sec_blob->DomainName.BufferOffset = cpu_to_le32(tmp - pbuffer);
++ sec_blob->DomainName.BufferOffset = cpu_to_le32(tmp - *pbuffer);
+ sec_blob->DomainName.Length = 0;
+ sec_blob->DomainName.MaximumLength = 0;
+ tmp += 2;
+@@ -432,14 +452,14 @@ int build_ntlmssp_auth_blob(unsigned char *pbuffer,
+ len = cifs_strtoUTF16((__le16 *)tmp, ses->domainName,
+ CIFS_MAX_USERNAME_LEN, nls_cp);
+ len *= 2; /* unicode is 2 bytes each */
+- sec_blob->DomainName.BufferOffset = cpu_to_le32(tmp - pbuffer);
++ sec_blob->DomainName.BufferOffset = cpu_to_le32(tmp - *pbuffer);
+ sec_blob->DomainName.Length = cpu_to_le16(len);
+ sec_blob->DomainName.MaximumLength = cpu_to_le16(len);
+ tmp += len;
+ }
+
+ if (ses->user_name == NULL) {
+- sec_blob->UserName.BufferOffset = cpu_to_le32(tmp - pbuffer);
++ sec_blob->UserName.BufferOffset = cpu_to_le32(tmp - *pbuffer);
+ sec_blob->UserName.Length = 0;
+ sec_blob->UserName.MaximumLength = 0;
+ tmp += 2;
+@@ -448,13 +468,13 @@ int build_ntlmssp_auth_blob(unsigned char *pbuffer,
+ len = cifs_strtoUTF16((__le16 *)tmp, ses->user_name,
+ CIFS_MAX_USERNAME_LEN, nls_cp);
+ len *= 2; /* unicode is 2 bytes each */
+- sec_blob->UserName.BufferOffset = cpu_to_le32(tmp - pbuffer);
++ sec_blob->UserName.BufferOffset = cpu_to_le32(tmp - *pbuffer);
+ sec_blob->UserName.Length = cpu_to_le16(len);
+ sec_blob->UserName.MaximumLength = cpu_to_le16(len);
+ tmp += len;
+ }
+
+- sec_blob->WorkstationName.BufferOffset = cpu_to_le32(tmp - pbuffer);
++ sec_blob->WorkstationName.BufferOffset = cpu_to_le32(tmp - *pbuffer);
+ sec_blob->WorkstationName.Length = 0;
+ sec_blob->WorkstationName.MaximumLength = 0;
+ tmp += 2;
+@@ -463,19 +483,19 @@ int build_ntlmssp_auth_blob(unsigned char *pbuffer,
+ (ses->ntlmssp->server_flags & NTLMSSP_NEGOTIATE_EXTENDED_SEC))
+ && !calc_seckey(ses)) {
+ memcpy(tmp, ses->ntlmssp->ciphertext, CIFS_CPHTXT_SIZE);
+- sec_blob->SessionKey.BufferOffset = cpu_to_le32(tmp - pbuffer);
++ sec_blob->SessionKey.BufferOffset = cpu_to_le32(tmp - *pbuffer);
+ sec_blob->SessionKey.Length = cpu_to_le16(CIFS_CPHTXT_SIZE);
+ sec_blob->SessionKey.MaximumLength =
+ cpu_to_le16(CIFS_CPHTXT_SIZE);
+ tmp += CIFS_CPHTXT_SIZE;
+ } else {
+- sec_blob->SessionKey.BufferOffset = cpu_to_le32(tmp - pbuffer);
++ sec_blob->SessionKey.BufferOffset = cpu_to_le32(tmp - *pbuffer);
+ sec_blob->SessionKey.Length = 0;
+ sec_blob->SessionKey.MaximumLength = 0;
+ }
+
++ *buflen = tmp - *pbuffer;
+ setup_ntlmv2_ret:
+- *buflen = tmp - pbuffer;
+ return rc;
+ }
+
+@@ -1266,7 +1286,7 @@ sess_auth_rawntlmssp_authenticate(struct sess_data *sess_data)
+ struct cifs_ses *ses = sess_data->ses;
+ __u16 bytes_remaining;
+ char *bcc_ptr;
+- char *ntlmsspblob = NULL;
++ unsigned char *ntlmsspblob = NULL;
+ u16 blob_len;
+
+ cifs_dbg(FYI, "rawntlmssp session setup authenticate phase\n");
+@@ -1279,19 +1299,7 @@ sess_auth_rawntlmssp_authenticate(struct sess_data *sess_data)
+ /* Build security blob before we assemble the request */
+ pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
+ smb_buf = (struct smb_hdr *)pSMB;
+- /*
+- * 5 is an empirical value, large enough to hold
+- * authenticate message plus max 10 of av paris,
+- * domain, user, workstation names, flags, etc.
+- */
+- ntlmsspblob = kzalloc(5*sizeof(struct _AUTHENTICATE_MESSAGE),
+- GFP_KERNEL);
+- if (!ntlmsspblob) {
+- rc = -ENOMEM;
+- goto out;
+- }
+-
+- rc = build_ntlmssp_auth_blob(ntlmsspblob,
++ rc = build_ntlmssp_auth_blob(&ntlmsspblob,
+ &blob_len, ses, sess_data->nls_cp);
+ if (rc)
+ goto out_free_ntlmsspblob;
+diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
+index e8d1f8c59b56..d759ecdfa9d6 100644
+--- a/fs/cifs/smb2pdu.c
++++ b/fs/cifs/smb2pdu.c
+@@ -46,6 +46,7 @@
+ #include "smb2status.h"
+ #include "smb2glob.h"
+ #include "cifspdu.h"
++#include "cifs_spnego.h"
+
+ /*
+ * The following table defines the expected "StructureSize" of SMB2 requests
+@@ -427,20 +428,15 @@ SMB2_negotiate(const unsigned int xid, struct cifs_ses *ses)
+ cifs_dbg(FYI, "missing security blob on negprot\n");
+
+ rc = cifs_enable_signing(server, ses->sign);
+-#ifdef CONFIG_SMB2_ASN1 /* BB REMOVEME when updated asn1.c ready */
+ if (rc)
+ goto neg_exit;
+- if (blob_length)
+- rc = decode_neg_token_init(security_blob, blob_length,
+- &server->sec_type);
+- if (rc == 1)
+- rc = 0;
+- else if (rc == 0) {
+- rc = -EIO;
+- goto neg_exit;
++ if (blob_length) {
++ rc = decode_negTokenInit(security_blob, blob_length, server);
++ if (rc == 1)
++ rc = 0;
++ else if (rc == 0)
++ rc = -EIO;
+ }
+-#endif
+-
+ neg_exit:
+ free_rsp_buf(resp_buftype, rsp);
+ return rc;
+@@ -534,8 +530,9 @@ SMB2_sess_setup(const unsigned int xid, struct cifs_ses *ses,
+ __le32 phase = NtLmNegotiate; /* NTLMSSP, if needed, is multistage */
+ struct TCP_Server_Info *server = ses->server;
+ u16 blob_length = 0;
+- char *security_blob;
+- char *ntlmssp_blob = NULL;
++ struct key *spnego_key = NULL;
++ char *security_blob = NULL;
++ unsigned char *ntlmssp_blob = NULL;
+ bool use_spnego = false; /* else use raw ntlmssp */
+
+ cifs_dbg(FYI, "Session Setup\n");
+@@ -562,7 +559,8 @@ SMB2_sess_setup(const unsigned int xid, struct cifs_ses *ses,
+ ses->ntlmssp->sesskey_per_smbsess = true;
+
+ /* FIXME: allow for other auth types besides NTLMSSP (e.g. krb5) */
+- ses->sectype = RawNTLMSSP;
++ if (ses->sectype != Kerberos && ses->sectype != RawNTLMSSP)
++ ses->sectype = RawNTLMSSP;
+
+ ssetup_ntlmssp_authenticate:
+ if (phase == NtLmChallenge)
+@@ -591,7 +589,48 @@ ssetup_ntlmssp_authenticate:
+ iov[0].iov_base = (char *)req;
+ /* 4 for rfc1002 length field and 1 for pad */
+ iov[0].iov_len = get_rfc1002_length(req) + 4 - 1;
+- if (phase == NtLmNegotiate) {
++
++ if (ses->sectype == Kerberos) {
++#ifdef CONFIG_CIFS_UPCALL
++ struct cifs_spnego_msg *msg;
++
++ spnego_key = cifs_get_spnego_key(ses);
++ if (IS_ERR(spnego_key)) {
++ rc = PTR_ERR(spnego_key);
++ spnego_key = NULL;
++ goto ssetup_exit;
++ }
++
++ msg = spnego_key->payload.data;
++ /*
++ * check version field to make sure that cifs.upcall is
++ * sending us a response in an expected form
++ */
++ if (msg->version != CIFS_SPNEGO_UPCALL_VERSION) {
++ cifs_dbg(VFS,
++ "bad cifs.upcall version. Expected %d got %d",
++ CIFS_SPNEGO_UPCALL_VERSION, msg->version);
++ rc = -EKEYREJECTED;
++ goto ssetup_exit;
++ }
++ ses->auth_key.response = kmemdup(msg->data, msg->sesskey_len,
++ GFP_KERNEL);
++ if (!ses->auth_key.response) {
++ cifs_dbg(VFS,
++ "Kerberos can't allocate (%u bytes) memory",
++ msg->sesskey_len);
++ rc = -ENOMEM;
++ goto ssetup_exit;
++ }
++ ses->auth_key.len = msg->sesskey_len;
++ blob_length = msg->secblob_len;
++ iov[1].iov_base = msg->data + msg->sesskey_len;
++ iov[1].iov_len = blob_length;
++#else
++ rc = -EOPNOTSUPP;
++ goto ssetup_exit;
++#endif /* CONFIG_CIFS_UPCALL */
++ } else if (phase == NtLmNegotiate) { /* if not krb5 must be ntlmssp */
+ ntlmssp_blob = kmalloc(sizeof(struct _NEGOTIATE_MESSAGE),
+ GFP_KERNEL);
+ if (ntlmssp_blob == NULL) {
+@@ -614,15 +653,11 @@ ssetup_ntlmssp_authenticate:
+ /* with raw NTLMSSP we don't encapsulate in SPNEGO */
+ security_blob = ntlmssp_blob;
+ }
++ iov[1].iov_base = security_blob;
++ iov[1].iov_len = blob_length;
+ } else if (phase == NtLmAuthenticate) {
+ req->hdr.SessionId = ses->Suid;
+- ntlmssp_blob = kzalloc(sizeof(struct _NEGOTIATE_MESSAGE) + 500,
+- GFP_KERNEL);
+- if (ntlmssp_blob == NULL) {
+- rc = -ENOMEM;
+- goto ssetup_exit;
+- }
+- rc = build_ntlmssp_auth_blob(ntlmssp_blob, &blob_length, ses,
++ rc = build_ntlmssp_auth_blob(&ntlmssp_blob, &blob_length, ses,
+ nls_cp);
+ if (rc) {
+ cifs_dbg(FYI, "build_ntlmssp_auth_blob failed %d\n",
+@@ -641,6 +676,8 @@ ssetup_ntlmssp_authenticate:
+ } else {
+ security_blob = ntlmssp_blob;
+ }
++ iov[1].iov_base = security_blob;
++ iov[1].iov_len = blob_length;
+ } else {
+ cifs_dbg(VFS, "illegal ntlmssp phase\n");
+ rc = -EIO;
+@@ -652,8 +689,6 @@ ssetup_ntlmssp_authenticate:
+ cpu_to_le16(sizeof(struct smb2_sess_setup_req) -
+ 1 /* pad */ - 4 /* rfc1001 len */);
+ req->SecurityBufferLength = cpu_to_le16(blob_length);
+- iov[1].iov_base = security_blob;
+- iov[1].iov_len = blob_length;
+
+ inc_rfc1001_len(req, blob_length - 1 /* pad */);
+
+@@ -664,6 +699,7 @@ ssetup_ntlmssp_authenticate:
+
+ kfree(security_blob);
+ rsp = (struct smb2_sess_setup_rsp *)iov[0].iov_base;
++ ses->Suid = rsp->hdr.SessionId;
+ if (resp_buftype != CIFS_NO_BUFFER &&
+ rsp->hdr.Status == STATUS_MORE_PROCESSING_REQUIRED) {
+ if (phase != NtLmNegotiate) {
+@@ -681,7 +717,6 @@ ssetup_ntlmssp_authenticate:
+ /* NTLMSSP Negotiate sent now processing challenge (response) */
+ phase = NtLmChallenge; /* process ntlmssp challenge */
+ rc = 0; /* MORE_PROCESSING is not an error here but expected */
+- ses->Suid = rsp->hdr.SessionId;
+ rc = decode_ntlmssp_challenge(rsp->Buffer,
+ le16_to_cpu(rsp->SecurityBufferLength), ses);
+ }
+@@ -738,6 +773,10 @@ keygen_exit:
+ kfree(ses->auth_key.response);
+ ses->auth_key.response = NULL;
+ }
++ if (spnego_key) {
++ key_invalidate(spnego_key);
++ key_put(spnego_key);
++ }
+ kfree(ses->ntlmssp);
+
+ return rc;
+@@ -1584,6 +1623,33 @@ SMB2_echo(struct TCP_Server_Info *server)
+
+ cifs_dbg(FYI, "In echo request\n");
+
++ if (server->tcpStatus == CifsNeedNegotiate) {
++ struct list_head *tmp, *tmp2;
++ struct cifs_ses *ses;
++ struct cifs_tcon *tcon;
++
++ cifs_dbg(FYI, "Need negotiate, reconnecting tcons\n");
++ spin_lock(&cifs_tcp_ses_lock);
++ list_for_each(tmp, &server->smb_ses_list) {
++ ses = list_entry(tmp, struct cifs_ses, smb_ses_list);
++ list_for_each(tmp2, &ses->tcon_list) {
++ tcon = list_entry(tmp2, struct cifs_tcon,
++ tcon_list);
++ /* add check for persistent handle reconnect */
++ if (tcon && tcon->need_reconnect) {
++ spin_unlock(&cifs_tcp_ses_lock);
++ rc = smb2_reconnect(SMB2_ECHO, tcon);
++ spin_lock(&cifs_tcp_ses_lock);
++ }
++ }
++ }
++ spin_unlock(&cifs_tcp_ses_lock);
++ }
++
++ /* if no session, renegotiate failed above */
++ if (server->tcpStatus == CifsNeedNegotiate)
++ return -EIO;
++
+ rc = small_smb2_init(SMB2_ECHO, NULL, (void **)&req);
+ if (rc)
+ return rc;
+diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
+index 2ea75cbeb697..6d7293082086 100644
+--- a/fs/ext4/inode.c
++++ b/fs/ext4/inode.c
+@@ -4841,6 +4841,8 @@ int ext4_mark_inode_dirty(handle_t *handle, struct inode *inode)
+ might_sleep();
+ trace_ext4_mark_inode_dirty(inode, _RET_IP_);
+ err = ext4_reserve_inode_write(handle, inode, &iloc);
++ if (err)
++ return err;
+ if (ext4_handle_valid(handle) &&
+ EXT4_I(inode)->i_extra_isize < sbi->s_want_extra_isize &&
+ !ext4_test_inode_state(inode, EXT4_STATE_NO_EXPAND)) {
+@@ -4871,9 +4873,7 @@ int ext4_mark_inode_dirty(handle_t *handle, struct inode *inode)
+ }
+ }
+ }
+- if (!err)
+- err = ext4_mark_iloc_dirty(handle, inode, &iloc);
+- return err;
++ return ext4_mark_iloc_dirty(handle, inode, &iloc);
+ }
+
+ /*
+diff --git a/fs/locks.c b/fs/locks.c
+index 298d1f5c66f0..253ca5c2b9c7 100644
+--- a/fs/locks.c
++++ b/fs/locks.c
+@@ -1580,7 +1580,7 @@ generic_add_lease(struct file *filp, long arg, struct file_lock **flp, void **pr
+ {
+ struct file_lock *fl, **before, **my_before = NULL, *lease;
+ struct dentry *dentry = filp->f_path.dentry;
+- struct inode *inode = dentry->d_inode;
++ struct inode *inode = file_inode(filp);
+ bool is_deleg = (*flp)->fl_flags & FL_DELEG;
+ int error;
+ LIST_HEAD(dispose);
+diff --git a/fs/namespace.c b/fs/namespace.c
+index db31a49e01fd..d0cd3f4012ec 100644
+--- a/fs/namespace.c
++++ b/fs/namespace.c
+@@ -1494,6 +1494,7 @@ void __detach_mounts(struct dentry *dentry)
+ goto out_unlock;
+
+ lock_mount_hash();
++ event++;
+ while (!hlist_empty(&mp->m_list)) {
+ mnt = hlist_entry(mp->m_list.first, struct mount, mnt_mp_list);
+ umount_tree(mnt, 0);
+diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c
+index 7a8d67cd823d..29b7a75064af 100644
+--- a/fs/nfs/dir.c
++++ b/fs/nfs/dir.c
+@@ -1529,9 +1529,9 @@ int nfs_atomic_open(struct inode *dir, struct dentry *dentry,
+ err = PTR_ERR(inode);
+ trace_nfs_atomic_open_exit(dir, ctx, open_flags, err);
+ put_nfs_open_context(ctx);
++ d_drop(dentry);
+ switch (err) {
+ case -ENOENT:
+- d_drop(dentry);
+ d_add(dentry, NULL);
+ nfs_set_verifier(dentry, nfs_save_change_attribute(dir));
+ break;
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index 575fb0ebf980..43fb57831567 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -2635,12 +2635,11 @@ static void nfs4_close_prepare(struct rpc_task *task, void *data)
+ call_close |= is_wronly;
+ else if (is_wronly)
+ calldata->arg.fmode |= FMODE_WRITE;
++ if (calldata->arg.fmode != (FMODE_READ|FMODE_WRITE))
++ call_close |= is_rdwr;
+ } else if (is_rdwr)
+ calldata->arg.fmode |= FMODE_READ|FMODE_WRITE;
+
+- if (calldata->arg.fmode == 0)
+- call_close |= is_rdwr;
+-
+ if (!nfs4_valid_open_stateid(state))
+ call_close = 0;
+ spin_unlock(&state->owner->so_lock);
+diff --git a/fs/nfsd/nfs4callback.c b/fs/nfsd/nfs4callback.c
+index 7cbdf1b2e4ab..9701a76f562e 100644
+--- a/fs/nfsd/nfs4callback.c
++++ b/fs/nfsd/nfs4callback.c
+@@ -630,22 +630,6 @@ static struct rpc_cred *get_backchannel_cred(struct nfs4_client *clp, struct rpc
+ }
+ }
+
+-static struct rpc_clnt *create_backchannel_client(struct rpc_create_args *args)
+-{
+- struct rpc_xprt *xprt;
+-
+- if (args->protocol != XPRT_TRANSPORT_BC_TCP)
+- return rpc_create(args);
+-
+- xprt = args->bc_xprt->xpt_bc_xprt;
+- if (xprt) {
+- xprt_get(xprt);
+- return rpc_create_xprt(args, xprt);
+- }
+-
+- return rpc_create(args);
+-}
+-
+ static int setup_callback_client(struct nfs4_client *clp, struct nfs4_cb_conn *conn, struct nfsd4_session *ses)
+ {
+ int maxtime = max_cb_time(clp->net);
+@@ -688,7 +672,7 @@ static int setup_callback_client(struct nfs4_client *clp, struct nfs4_cb_conn *c
+ args.authflavor = ses->se_cb_sec.flavor;
+ }
+ /* Create RPC client */
+- client = create_backchannel_client(&args);
++ client = rpc_create(&args);
+ if (IS_ERR(client)) {
+ dprintk("NFSD: couldn't create callback client: %ld\n",
+ PTR_ERR(client));
+diff --git a/fs/nilfs2/the_nilfs.c b/fs/nilfs2/the_nilfs.c
+index 9da25fe9ea61..ed3a2d9ec5f7 100644
+--- a/fs/nilfs2/the_nilfs.c
++++ b/fs/nilfs2/the_nilfs.c
+@@ -443,7 +443,7 @@ static int nilfs_valid_sb(struct nilfs_super_block *sbp)
+ if (!sbp || le16_to_cpu(sbp->s_magic) != NILFS_SUPER_MAGIC)
+ return 0;
+ bytes = le16_to_cpu(sbp->s_bytes);
+- if (bytes > BLOCK_SIZE)
++ if (bytes < sumoff + 4 || bytes > BLOCK_SIZE)
+ return 0;
+ crc = crc32_le(le32_to_cpu(sbp->s_crc_seed), (unsigned char *)sbp,
+ sumoff);
+diff --git a/fs/pipe.c b/fs/pipe.c
+index 21981e58e2a6..e3ba6c3a1743 100644
+--- a/fs/pipe.c
++++ b/fs/pipe.c
+@@ -39,6 +39,12 @@ unsigned int pipe_max_size = 1048576;
+ */
+ unsigned int pipe_min_size = PAGE_SIZE;
+
++/* Maximum allocatable pages per user. Hard limit is unset by default, soft
++ * matches default values.
++ */
++unsigned long pipe_user_pages_hard;
++unsigned long pipe_user_pages_soft = PIPE_DEF_BUFFERS * INR_OPEN_CUR;
++
+ /*
+ * We use a start+len construction, which provides full use of the
+ * allocated memory.
+@@ -585,20 +591,49 @@ pipe_fasync(int fd, struct file *filp, int on)
+ return retval;
+ }
+
++static void account_pipe_buffers(struct pipe_inode_info *pipe,
++ unsigned long old, unsigned long new)
++{
++ atomic_long_add(new - old, &pipe->user->pipe_bufs);
++}
++
++static bool too_many_pipe_buffers_soft(struct user_struct *user)
++{
++ return pipe_user_pages_soft &&
++ atomic_long_read(&user->pipe_bufs) >= pipe_user_pages_soft;
++}
++
++static bool too_many_pipe_buffers_hard(struct user_struct *user)
++{
++ return pipe_user_pages_hard &&
++ atomic_long_read(&user->pipe_bufs) >= pipe_user_pages_hard;
++}
++
+ struct pipe_inode_info *alloc_pipe_info(void)
+ {
+ struct pipe_inode_info *pipe;
+
+ pipe = kzalloc(sizeof(struct pipe_inode_info), GFP_KERNEL);
+ if (pipe) {
+- pipe->bufs = kzalloc(sizeof(struct pipe_buffer) * PIPE_DEF_BUFFERS, GFP_KERNEL);
++ unsigned long pipe_bufs = PIPE_DEF_BUFFERS;
++ struct user_struct *user = get_current_user();
++
++ if (!too_many_pipe_buffers_hard(user)) {
++ if (too_many_pipe_buffers_soft(user))
++ pipe_bufs = 1;
++ pipe->bufs = kzalloc(sizeof(struct pipe_buffer) * pipe_bufs, GFP_KERNEL);
++ }
++
+ if (pipe->bufs) {
+ init_waitqueue_head(&pipe->wait);
+ pipe->r_counter = pipe->w_counter = 1;
+- pipe->buffers = PIPE_DEF_BUFFERS;
++ pipe->buffers = pipe_bufs;
++ pipe->user = user;
++ account_pipe_buffers(pipe, 0, pipe_bufs);
+ mutex_init(&pipe->mutex);
+ return pipe;
+ }
++ free_uid(user);
+ kfree(pipe);
+ }
+
+@@ -609,6 +644,8 @@ void free_pipe_info(struct pipe_inode_info *pipe)
+ {
+ int i;
+
++ account_pipe_buffers(pipe, pipe->buffers, 0);
++ free_uid(pipe->user);
+ for (i = 0; i < pipe->buffers; i++) {
+ struct pipe_buffer *buf = pipe->bufs + i;
+ if (buf->ops)
+@@ -999,6 +1036,7 @@ static long pipe_set_size(struct pipe_inode_info *pipe, unsigned long nr_pages)
+ memcpy(bufs + head, pipe->bufs, tail * sizeof(struct pipe_buffer));
+ }
+
++ account_pipe_buffers(pipe, pipe->buffers, nr_pages);
+ pipe->curbuf = 0;
+ kfree(pipe->bufs);
+ pipe->bufs = bufs;
+@@ -1070,6 +1108,11 @@ long pipe_fcntl(struct file *file, unsigned int cmd, unsigned long arg)
+ if (!capable(CAP_SYS_RESOURCE) && size > pipe_max_size) {
+ ret = -EPERM;
+ goto out;
++ } else if ((too_many_pipe_buffers_hard(pipe->user) ||
++ too_many_pipe_buffers_soft(pipe->user)) &&
++ !capable(CAP_SYS_RESOURCE) && !capable(CAP_SYS_ADMIN)) {
++ ret = -EPERM;
++ goto out;
+ }
+ ret = pipe_set_size(pipe, nr_pages);
+ break;
+diff --git a/fs/proc/base.c b/fs/proc/base.c
+index 76b296fe93c9..dc98620634a3 100644
+--- a/fs/proc/base.c
++++ b/fs/proc/base.c
+@@ -752,7 +752,8 @@ static ssize_t environ_read(struct file *file, char __user *buf,
+ int ret = 0;
+ struct mm_struct *mm = file->private_data;
+
+- if (!mm)
++ /* Ensure the process spawned far enough to have an environment. */
++ if (!mm || !mm->env_end)
+ return 0;
+
+ page = (char *)__get_free_page(GFP_TEMPORARY);
+diff --git a/fs/ubifs/file.c b/fs/ubifs/file.c
+index b5b593c45270..d37140e5b722 100644
+--- a/fs/ubifs/file.c
++++ b/fs/ubifs/file.c
+@@ -54,6 +54,7 @@
+ #include <linux/mount.h>
+ #include <linux/namei.h>
+ #include <linux/slab.h>
++#include <linux/migrate.h>
+
+ static int read_block(struct inode *inode, void *addr, unsigned int block,
+ struct ubifs_data_node *dn)
+@@ -1419,6 +1420,26 @@ static int ubifs_set_page_dirty(struct page *page)
+ return ret;
+ }
+
++#ifdef CONFIG_MIGRATION
++static int ubifs_migrate_page(struct address_space *mapping,
++ struct page *newpage, struct page *page, enum migrate_mode mode)
++{
++ int rc;
++
++ rc = migrate_page_move_mapping(mapping, newpage, page, NULL, mode, 0);
++ if (rc != MIGRATEPAGE_SUCCESS)
++ return rc;
++
++ if (PagePrivate(page)) {
++ ClearPagePrivate(page);
++ SetPagePrivate(newpage);
++ }
++
++ migrate_page_copy(newpage, page);
++ return MIGRATEPAGE_SUCCESS;
++}
++#endif
++
+ static int ubifs_releasepage(struct page *page, gfp_t unused_gfp_flags)
+ {
+ /*
+@@ -1556,6 +1577,9 @@ const struct address_space_operations ubifs_file_address_operations = {
+ .write_end = ubifs_write_end,
+ .invalidatepage = ubifs_invalidatepage,
+ .set_page_dirty = ubifs_set_page_dirty,
++#ifdef CONFIG_MIGRATION
++ .migratepage = ubifs_migrate_page,
++#endif
+ .releasepage = ubifs_releasepage,
+ };
+
+diff --git a/fs/xfs/libxfs/xfs_alloc.c b/fs/xfs/libxfs/xfs_alloc.c
+index eff34218f405..2300743e701e 100644
+--- a/fs/xfs/libxfs/xfs_alloc.c
++++ b/fs/xfs/libxfs/xfs_alloc.c
+@@ -515,6 +515,7 @@ xfs_agfl_write_verify(
+ }
+
+ const struct xfs_buf_ops xfs_agfl_buf_ops = {
++ .name = "xfs_agfl",
+ .verify_read = xfs_agfl_read_verify,
+ .verify_write = xfs_agfl_write_verify,
+ };
+@@ -2271,6 +2272,7 @@ xfs_agf_write_verify(
+ }
+
+ const struct xfs_buf_ops xfs_agf_buf_ops = {
++ .name = "xfs_agf",
+ .verify_read = xfs_agf_read_verify,
+ .verify_write = xfs_agf_write_verify,
+ };
+diff --git a/fs/xfs/libxfs/xfs_alloc_btree.c b/fs/xfs/libxfs/xfs_alloc_btree.c
+index e0e83e24d3ef..3bd94d5a5068 100644
+--- a/fs/xfs/libxfs/xfs_alloc_btree.c
++++ b/fs/xfs/libxfs/xfs_alloc_btree.c
+@@ -380,6 +380,7 @@ xfs_allocbt_write_verify(
+ }
+
+ const struct xfs_buf_ops xfs_allocbt_buf_ops = {
++ .name = "xfs_allocbt",
+ .verify_read = xfs_allocbt_read_verify,
+ .verify_write = xfs_allocbt_write_verify,
+ };
+diff --git a/fs/xfs/libxfs/xfs_attr_leaf.c b/fs/xfs/libxfs/xfs_attr_leaf.c
+index b7cd0a0541af..905b0cdb0107 100644
+--- a/fs/xfs/libxfs/xfs_attr_leaf.c
++++ b/fs/xfs/libxfs/xfs_attr_leaf.c
+@@ -251,6 +251,7 @@ xfs_attr3_leaf_read_verify(
+ }
+
+ const struct xfs_buf_ops xfs_attr3_leaf_buf_ops = {
++ .name = "xfs_attr3_leaf",
+ .verify_read = xfs_attr3_leaf_read_verify,
+ .verify_write = xfs_attr3_leaf_write_verify,
+ };
+diff --git a/fs/xfs/libxfs/xfs_attr_remote.c b/fs/xfs/libxfs/xfs_attr_remote.c
+index 7510ab8058a4..fda9c2aad37c 100644
+--- a/fs/xfs/libxfs/xfs_attr_remote.c
++++ b/fs/xfs/libxfs/xfs_attr_remote.c
+@@ -198,6 +198,7 @@ xfs_attr3_rmt_write_verify(
+ }
+
+ const struct xfs_buf_ops xfs_attr3_rmt_buf_ops = {
++ .name = "xfs_attr3_rmt",
+ .verify_read = xfs_attr3_rmt_read_verify,
+ .verify_write = xfs_attr3_rmt_write_verify,
+ };
+diff --git a/fs/xfs/libxfs/xfs_bmap_btree.c b/fs/xfs/libxfs/xfs_bmap_btree.c
+index fba753308f31..e6bde91a7d0c 100644
+--- a/fs/xfs/libxfs/xfs_bmap_btree.c
++++ b/fs/xfs/libxfs/xfs_bmap_btree.c
+@@ -722,6 +722,7 @@ xfs_bmbt_write_verify(
+ }
+
+ const struct xfs_buf_ops xfs_bmbt_buf_ops = {
++ .name = "xfs_bmbt",
+ .verify_read = xfs_bmbt_read_verify,
+ .verify_write = xfs_bmbt_write_verify,
+ };
+diff --git a/fs/xfs/libxfs/xfs_da_btree.c b/fs/xfs/libxfs/xfs_da_btree.c
+index fd827530afec..837b366c3fcf 100644
+--- a/fs/xfs/libxfs/xfs_da_btree.c
++++ b/fs/xfs/libxfs/xfs_da_btree.c
+@@ -243,6 +243,7 @@ xfs_da3_node_read_verify(
+ }
+
+ const struct xfs_buf_ops xfs_da3_node_buf_ops = {
++ .name = "xfs_da3_node",
+ .verify_read = xfs_da3_node_read_verify,
+ .verify_write = xfs_da3_node_write_verify,
+ };
+diff --git a/fs/xfs/libxfs/xfs_dir2_block.c b/fs/xfs/libxfs/xfs_dir2_block.c
+index 9628ceccfa02..11a3beed2e57 100644
+--- a/fs/xfs/libxfs/xfs_dir2_block.c
++++ b/fs/xfs/libxfs/xfs_dir2_block.c
+@@ -123,6 +123,7 @@ xfs_dir3_block_write_verify(
+ }
+
+ const struct xfs_buf_ops xfs_dir3_block_buf_ops = {
++ .name = "xfs_dir3_block",
+ .verify_read = xfs_dir3_block_read_verify,
+ .verify_write = xfs_dir3_block_write_verify,
+ };
+diff --git a/fs/xfs/libxfs/xfs_dir2_data.c b/fs/xfs/libxfs/xfs_dir2_data.c
+index fdd803fecb8e..47504a191bb3 100644
+--- a/fs/xfs/libxfs/xfs_dir2_data.c
++++ b/fs/xfs/libxfs/xfs_dir2_data.c
+@@ -302,11 +302,13 @@ xfs_dir3_data_write_verify(
+ }
+
+ const struct xfs_buf_ops xfs_dir3_data_buf_ops = {
++ .name = "xfs_dir3_data",
+ .verify_read = xfs_dir3_data_read_verify,
+ .verify_write = xfs_dir3_data_write_verify,
+ };
+
+ static const struct xfs_buf_ops xfs_dir3_data_reada_buf_ops = {
++ .name = "xfs_dir3_data_reada",
+ .verify_read = xfs_dir3_data_reada_verify,
+ .verify_write = xfs_dir3_data_write_verify,
+ };
+diff --git a/fs/xfs/libxfs/xfs_dir2_leaf.c b/fs/xfs/libxfs/xfs_dir2_leaf.c
+index a19174eb3cb2..a03f595674bf 100644
+--- a/fs/xfs/libxfs/xfs_dir2_leaf.c
++++ b/fs/xfs/libxfs/xfs_dir2_leaf.c
+@@ -244,11 +244,13 @@ xfs_dir3_leafn_write_verify(
+ }
+
+ const struct xfs_buf_ops xfs_dir3_leaf1_buf_ops = {
++ .name = "xfs_dir3_leaf1",
+ .verify_read = xfs_dir3_leaf1_read_verify,
+ .verify_write = xfs_dir3_leaf1_write_verify,
+ };
+
+ const struct xfs_buf_ops xfs_dir3_leafn_buf_ops = {
++ .name = "xfs_dir3_leafn",
+ .verify_read = xfs_dir3_leafn_read_verify,
+ .verify_write = xfs_dir3_leafn_write_verify,
+ };
+diff --git a/fs/xfs/libxfs/xfs_dir2_node.c b/fs/xfs/libxfs/xfs_dir2_node.c
+index 2ae6ac2c11ae..75431b220174 100644
+--- a/fs/xfs/libxfs/xfs_dir2_node.c
++++ b/fs/xfs/libxfs/xfs_dir2_node.c
+@@ -149,6 +149,7 @@ xfs_dir3_free_write_verify(
+ }
+
+ const struct xfs_buf_ops xfs_dir3_free_buf_ops = {
++ .name = "xfs_dir3_free",
+ .verify_read = xfs_dir3_free_read_verify,
+ .verify_write = xfs_dir3_free_write_verify,
+ };
+diff --git a/fs/xfs/libxfs/xfs_dquot_buf.c b/fs/xfs/libxfs/xfs_dquot_buf.c
+index 89b7ddfe5377..c6fba7314e8f 100644
+--- a/fs/xfs/libxfs/xfs_dquot_buf.c
++++ b/fs/xfs/libxfs/xfs_dquot_buf.c
+@@ -303,6 +303,7 @@ xfs_dquot_buf_write_verify(
+ }
+
+ const struct xfs_buf_ops xfs_dquot_buf_ops = {
++ .name = "xfs_dquot",
+ .verify_read = xfs_dquot_buf_read_verify,
+ .verify_write = xfs_dquot_buf_write_verify,
+ };
+diff --git a/fs/xfs/libxfs/xfs_ialloc.c b/fs/xfs/libxfs/xfs_ialloc.c
+index 23dcb72fc5e6..196f29690484 100644
+--- a/fs/xfs/libxfs/xfs_ialloc.c
++++ b/fs/xfs/libxfs/xfs_ialloc.c
+@@ -2105,6 +2105,7 @@ xfs_agi_write_verify(
+ }
+
+ const struct xfs_buf_ops xfs_agi_buf_ops = {
++ .name = "xfs_agi",
+ .verify_read = xfs_agi_read_verify,
+ .verify_write = xfs_agi_write_verify,
+ };
+diff --git a/fs/xfs/libxfs/xfs_ialloc_btree.c b/fs/xfs/libxfs/xfs_ialloc_btree.c
+index c9b06f30fe86..14ae3e295e7c 100644
+--- a/fs/xfs/libxfs/xfs_ialloc_btree.c
++++ b/fs/xfs/libxfs/xfs_ialloc_btree.c
+@@ -297,6 +297,7 @@ xfs_inobt_write_verify(
+ }
+
+ const struct xfs_buf_ops xfs_inobt_buf_ops = {
++ .name = "xfs_inobt",
+ .verify_read = xfs_inobt_read_verify,
+ .verify_write = xfs_inobt_write_verify,
+ };
+diff --git a/fs/xfs/libxfs/xfs_inode_buf.c b/fs/xfs/libxfs/xfs_inode_buf.c
+index 8249599238c3..1bf2f1ccd957 100644
+--- a/fs/xfs/libxfs/xfs_inode_buf.c
++++ b/fs/xfs/libxfs/xfs_inode_buf.c
+@@ -141,11 +141,13 @@ xfs_inode_buf_write_verify(
+ }
+
+ const struct xfs_buf_ops xfs_inode_buf_ops = {
++ .name = "xfs_inode",
+ .verify_read = xfs_inode_buf_read_verify,
+ .verify_write = xfs_inode_buf_write_verify,
+ };
+
+ const struct xfs_buf_ops xfs_inode_buf_ra_ops = {
++ .name = "xxfs_inode_ra",
+ .verify_read = xfs_inode_buf_readahead_verify,
+ .verify_write = xfs_inode_buf_write_verify,
+ };
+diff --git a/fs/xfs/libxfs/xfs_sb.c b/fs/xfs/libxfs/xfs_sb.c
+index 5f902fa7913f..acfcdc625aca 100644
+--- a/fs/xfs/libxfs/xfs_sb.c
++++ b/fs/xfs/libxfs/xfs_sb.c
+@@ -704,11 +704,13 @@ xfs_sb_write_verify(
+ }
+
+ const struct xfs_buf_ops xfs_sb_buf_ops = {
++ .name = "xfs_sb",
+ .verify_read = xfs_sb_read_verify,
+ .verify_write = xfs_sb_write_verify,
+ };
+
+ const struct xfs_buf_ops xfs_sb_quiet_buf_ops = {
++ .name = "xfs_sb_quiet",
+ .verify_read = xfs_sb_quiet_read_verify,
+ .verify_write = xfs_sb_write_verify,
+ };
+diff --git a/fs/xfs/libxfs/xfs_symlink_remote.c b/fs/xfs/libxfs/xfs_symlink_remote.c
+index a7dce9aea5b5..ccbbbbc7f25a 100644
+--- a/fs/xfs/libxfs/xfs_symlink_remote.c
++++ b/fs/xfs/libxfs/xfs_symlink_remote.c
+@@ -166,6 +166,7 @@ xfs_symlink_write_verify(
+ }
+
+ const struct xfs_buf_ops xfs_symlink_buf_ops = {
++ .name = "xfs_symlink",
+ .verify_read = xfs_symlink_read_verify,
+ .verify_write = xfs_symlink_write_verify,
+ };
+diff --git a/fs/xfs/xfs_buf.h b/fs/xfs/xfs_buf.h
+index 82002c00af90..136319ccabf5 100644
+--- a/fs/xfs/xfs_buf.h
++++ b/fs/xfs/xfs_buf.h
+@@ -131,6 +131,7 @@ struct xfs_buf_map {
+ struct xfs_buf_map (map) = { .bm_bn = (blkno), .bm_len = (numblk) };
+
+ struct xfs_buf_ops {
++ char *name;
+ void (*verify_read)(struct xfs_buf *);
+ void (*verify_write)(struct xfs_buf *);
+ };
+diff --git a/fs/xfs/xfs_error.c b/fs/xfs/xfs_error.c
+index b92fd7bc49e3..d55a1ce6d880 100644
+--- a/fs/xfs/xfs_error.c
++++ b/fs/xfs/xfs_error.c
+@@ -166,9 +166,9 @@ xfs_verifier_error(
+ {
+ struct xfs_mount *mp = bp->b_target->bt_mount;
+
+- xfs_alert(mp, "Metadata %s detected at %pF, block 0x%llx",
++ xfs_alert(mp, "Metadata %s detected at %pF, %s block 0x%llx",
+ bp->b_error == -EFSBADCRC ? "CRC error" : "corruption",
+- __return_address, bp->b_bn);
++ __return_address, bp->b_ops->name, bp->b_bn);
+
+ xfs_alert(mp, "Unmount and run xfs_repair");
+
+diff --git a/include/linux/netfilter/x_tables.h b/include/linux/netfilter/x_tables.h
+index a3e215bb0241..7741efa43b35 100644
+--- a/include/linux/netfilter/x_tables.h
++++ b/include/linux/netfilter/x_tables.h
+@@ -239,11 +239,18 @@ void xt_unregister_match(struct xt_match *target);
+ int xt_register_matches(struct xt_match *match, unsigned int n);
+ void xt_unregister_matches(struct xt_match *match, unsigned int n);
+
++int xt_check_entry_offsets(const void *base, const char *elems,
++ unsigned int target_offset,
++ unsigned int next_offset);
++
+ int xt_check_match(struct xt_mtchk_param *, unsigned int size, u_int8_t proto,
+ bool inv_proto);
+ int xt_check_target(struct xt_tgchk_param *, unsigned int size, u_int8_t proto,
+ bool inv_proto);
+
++void *xt_copy_counters_from_user(const void __user *user, unsigned int len,
++ struct xt_counters_info *info, bool compat);
++
+ struct xt_table *xt_register_table(struct net *net,
+ const struct xt_table *table,
+ struct xt_table_info *bootstrap,
+@@ -421,7 +428,7 @@ void xt_compat_init_offsets(u_int8_t af, unsigned int number);
+ int xt_compat_calc_jump(u_int8_t af, unsigned int offset);
+
+ int xt_compat_match_offset(const struct xt_match *match);
+-int xt_compat_match_from_user(struct xt_entry_match *m, void **dstptr,
++void xt_compat_match_from_user(struct xt_entry_match *m, void **dstptr,
+ unsigned int *size);
+ int xt_compat_match_to_user(const struct xt_entry_match *m,
+ void __user **dstptr, unsigned int *size);
+@@ -431,6 +438,9 @@ void xt_compat_target_from_user(struct xt_entry_target *t, void **dstptr,
+ unsigned int *size);
+ int xt_compat_target_to_user(const struct xt_entry_target *t,
+ void __user **dstptr, unsigned int *size);
++int xt_compat_check_entry_offsets(const void *base, const char *elems,
++ unsigned int target_offset,
++ unsigned int next_offset);
+
+ #endif /* CONFIG_COMPAT */
+ #endif /* _X_TABLES_H */
+diff --git a/include/linux/pipe_fs_i.h b/include/linux/pipe_fs_i.h
+index eb8b8ac6df3c..24f5470d3944 100644
+--- a/include/linux/pipe_fs_i.h
++++ b/include/linux/pipe_fs_i.h
+@@ -42,6 +42,7 @@ struct pipe_buffer {
+ * @fasync_readers: reader side fasync
+ * @fasync_writers: writer side fasync
+ * @bufs: the circular array of pipe buffers
++ * @user: the user who created this pipe
+ **/
+ struct pipe_inode_info {
+ struct mutex mutex;
+@@ -57,6 +58,7 @@ struct pipe_inode_info {
+ struct fasync_struct *fasync_readers;
+ struct fasync_struct *fasync_writers;
+ struct pipe_buffer *bufs;
++ struct user_struct *user;
+ };
+
+ /*
+@@ -123,6 +125,8 @@ void pipe_unlock(struct pipe_inode_info *);
+ void pipe_double_lock(struct pipe_inode_info *, struct pipe_inode_info *);
+
+ extern unsigned int pipe_max_size, pipe_min_size;
++extern unsigned long pipe_user_pages_hard;
++extern unsigned long pipe_user_pages_soft;
+ int pipe_proc_fn(struct ctl_table *, int, void __user *, size_t *, loff_t *);
+
+
+diff --git a/include/linux/platform_data/asoc-s3c.h b/include/linux/platform_data/asoc-s3c.h
+index a6591c693ebb..e8d9f84ec931 100644
+--- a/include/linux/platform_data/asoc-s3c.h
++++ b/include/linux/platform_data/asoc-s3c.h
+@@ -38,6 +38,10 @@ struct samsung_i2s {
+ */
+ struct s3c_audio_pdata {
+ int (*cfg_gpio)(struct platform_device *);
++ void *dma_playback;
++ void *dma_capture;
++ void *dma_play_sec;
++ void *dma_capture_mic;
+ union {
+ struct samsung_i2s i2s;
+ } type;
+diff --git a/include/linux/sched.h b/include/linux/sched.h
+index 2a0bcc8411dc..ebfd7a5ea6d4 100644
+--- a/include/linux/sched.h
++++ b/include/linux/sched.h
+@@ -759,6 +759,7 @@ struct user_struct {
+ #endif
+ unsigned long locked_shm; /* How many pages of mlocked shm ? */
+ unsigned long unix_inflight; /* How many files in flight in unix sockets */
++ atomic_long_t pipe_bufs; /* how many pages are allocated in pipe buffers */
+
+ #ifdef CONFIG_KEYS
+ struct key *uid_keyring; /* UID specific keyring */
+diff --git a/include/linux/sunrpc/clnt.h b/include/linux/sunrpc/clnt.h
+index b363a0f6dfe1..3fbae6853df3 100644
+--- a/include/linux/sunrpc/clnt.h
++++ b/include/linux/sunrpc/clnt.h
+@@ -131,8 +131,6 @@ struct rpc_create_args {
+ #define RPC_CLNT_CREATE_NO_RETRANS_TIMEOUT (1UL << 9)
+
+ struct rpc_clnt *rpc_create(struct rpc_create_args *args);
+-struct rpc_clnt *rpc_create_xprt(struct rpc_create_args *args,
+- struct rpc_xprt *xprt);
+ struct rpc_clnt *rpc_bind_new_program(struct rpc_clnt *,
+ const struct rpc_program *, u32);
+ void rpc_task_reset_client(struct rpc_task *task, struct rpc_clnt *clnt);
+diff --git a/include/linux/swap.h b/include/linux/swap.h
+index 37a585beef5c..1dc0e886227d 100644
+--- a/include/linux/swap.h
++++ b/include/linux/swap.h
+@@ -315,7 +315,7 @@ extern void lru_add_drain(void);
+ extern void lru_add_drain_cpu(int cpu);
+ extern void lru_add_drain_all(void);
+ extern void rotate_reclaimable_page(struct page *page);
+-extern void deactivate_page(struct page *page);
++extern void deactivate_file_page(struct page *page);
+ extern void swap_setup(void);
+
+ extern void add_page_to_unevictable_list(struct page *page);
+diff --git a/include/linux/usb/ehci_def.h b/include/linux/usb/ehci_def.h
+index daec99af5d54..1c88b177cb9c 100644
+--- a/include/linux/usb/ehci_def.h
++++ b/include/linux/usb/ehci_def.h
+@@ -178,11 +178,11 @@ struct ehci_regs {
+ * PORTSCx
+ */
+ /* HOSTPC: offset 0x84 */
+- u32 hostpc[1]; /* HOSTPC extension */
++ u32 hostpc[0]; /* HOSTPC extension */
+ #define HOSTPC_PHCD (1<<22) /* Phy clock disable */
+ #define HOSTPC_PSPD (3<<25) /* Port speed detection */
+
+- u32 reserved5[16];
++ u32 reserved5[17];
+
+ /* USBMODE_EX: offset 0xc8 */
+ u32 usbmode_ex; /* USB Device mode extension */
+diff --git a/include/net/codel.h b/include/net/codel.h
+index aeee28081245..7302a4df618c 100644
+--- a/include/net/codel.h
++++ b/include/net/codel.h
+@@ -158,11 +158,13 @@ struct codel_vars {
+ * struct codel_stats - contains codel shared variables and stats
+ * @maxpacket: largest packet we've seen so far
+ * @drop_count: temp count of dropped packets in dequeue()
++ * @drop_len: bytes of dropped packets in dequeue()
+ * ecn_mark: number of packets we ECN marked instead of dropping
+ */
+ struct codel_stats {
+ u32 maxpacket;
+ u32 drop_count;
++ u32 drop_len;
+ u32 ecn_mark;
+ };
+
+@@ -297,6 +299,7 @@ static struct sk_buff *codel_dequeue(struct Qdisc *sch,
+ vars->rec_inv_sqrt);
+ goto end;
+ }
++ stats->drop_len += qdisc_pkt_len(skb);
+ qdisc_drop(skb, sch);
+ stats->drop_count++;
+ skb = dequeue_func(vars, sch);
+@@ -319,6 +322,7 @@ static struct sk_buff *codel_dequeue(struct Qdisc *sch,
+ if (params->ecn && INET_ECN_set_ce(skb)) {
+ stats->ecn_mark++;
+ } else {
++ stats->drop_len += qdisc_pkt_len(skb);
+ qdisc_drop(skb, sch);
+ stats->drop_count++;
+
+diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h
+index 5ccfe161f359..f10b01467f07 100644
+--- a/include/net/sch_generic.h
++++ b/include/net/sch_generic.h
+@@ -393,7 +393,8 @@ struct Qdisc *dev_graft_qdisc(struct netdev_queue *dev_queue,
+ struct Qdisc *qdisc);
+ void qdisc_reset(struct Qdisc *qdisc);
+ void qdisc_destroy(struct Qdisc *qdisc);
+-void qdisc_tree_decrease_qlen(struct Qdisc *qdisc, unsigned int n);
++void qdisc_tree_reduce_backlog(struct Qdisc *qdisc, unsigned int n,
++ unsigned int len);
+ struct Qdisc *qdisc_alloc(struct netdev_queue *dev_queue,
+ const struct Qdisc_ops *ops);
+ struct Qdisc *qdisc_create_dflt(struct netdev_queue *dev_queue,
+@@ -689,6 +690,23 @@ static inline void qdisc_reset_queue(struct Qdisc *sch)
+ sch->qstats.backlog = 0;
+ }
+
++static inline struct Qdisc *qdisc_replace(struct Qdisc *sch, struct Qdisc *new,
++ struct Qdisc **pold)
++{
++ struct Qdisc *old;
++
++ sch_tree_lock(sch);
++ old = *pold;
++ *pold = new;
++ if (old != NULL) {
++ qdisc_tree_reduce_backlog(old, old->q.qlen, old->qstats.backlog);
++ qdisc_reset(old);
++ }
++ sch_tree_unlock(sch);
++
++ return old;
++}
++
+ static inline unsigned int __qdisc_queue_drop(struct Qdisc *sch,
+ struct sk_buff_head *list)
+ {
+diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
+index 67f5f177c071..eac45b688c08 100644
+--- a/kernel/bpf/verifier.c
++++ b/kernel/bpf/verifier.c
+@@ -1737,7 +1737,6 @@ static int replace_map_fd_with_map_ptr(struct verifier_env *env)
+ if (IS_ERR(map)) {
+ verbose("fd %d is not pointing to valid bpf_map\n",
+ insn->imm);
+- fdput(f);
+ return PTR_ERR(map);
+ }
+
+diff --git a/kernel/cgroup.c b/kernel/cgroup.c
+index 136eceadeed1..f033fbd94ac3 100644
+--- a/kernel/cgroup.c
++++ b/kernel/cgroup.c
+@@ -4489,7 +4489,7 @@ static int create_css(struct cgroup *cgrp, struct cgroup_subsys *ss,
+
+ err = cgroup_idr_alloc(&ss->css_idr, NULL, 2, 0, GFP_NOWAIT);
+ if (err < 0)
+- goto err_free_percpu_ref;
++ goto err_free_css;
+ css->id = err;
+
+ if (visible) {
+@@ -4521,9 +4521,6 @@ err_list_del:
+ list_del_rcu(&css->sibling);
+ cgroup_clear_dir(css->cgroup, 1 << css->ss->id);
+ err_free_id:
+- cgroup_idr_remove(&ss->css_idr, css->id);
+-err_free_percpu_ref:
+- percpu_ref_exit(&css->refcnt);
+ err_free_css:
+ call_rcu(&css->rcu_head, css_free_rcu_fn);
+ return err;
+diff --git a/kernel/futex.c b/kernel/futex.c
+index d58859d62b8b..8874a7b431e4 100644
+--- a/kernel/futex.c
++++ b/kernel/futex.c
+@@ -1381,8 +1381,8 @@ void requeue_futex(struct futex_q *q, struct futex_hash_bucket *hb1,
+ if (likely(&hb1->chain != &hb2->chain)) {
+ plist_del(&q->list, &hb1->chain);
+ hb_waiters_dec(hb1);
+- plist_add(&q->list, &hb2->chain);
+ hb_waiters_inc(hb2);
++ plist_add(&q->list, &hb2->chain);
+ q->lock_ptr = &hb2->lock;
+ }
+ get_futex_key_refs(key2);
+diff --git a/kernel/sched/core.c b/kernel/sched/core.c
+index 4317f0156092..2f774edcc4e8 100644
+--- a/kernel/sched/core.c
++++ b/kernel/sched/core.c
+@@ -4595,14 +4595,16 @@ void show_state_filter(unsigned long state_filter)
+ /*
+ * reset the NMI-timeout, listing all files on a slow
+ * console might take a lot of time:
++ * Also, reset softlockup watchdogs on all CPUs, because
++ * another CPU might be blocked waiting for us to process
++ * an IPI.
+ */
+ touch_nmi_watchdog();
++ touch_all_softlockup_watchdogs();
+ if (!state_filter || (p->state & state_filter))
+ sched_show_task(p);
+ }
+
+- touch_all_softlockup_watchdogs();
+-
+ #ifdef CONFIG_SCHED_DEBUG
+ sysrq_sched_debug_show();
+ #endif
+diff --git a/kernel/sysctl.c b/kernel/sysctl.c
+index cd0e835ecb85..07da431802e4 100644
+--- a/kernel/sysctl.c
++++ b/kernel/sysctl.c
+@@ -1656,6 +1656,20 @@ static struct ctl_table fs_table[] = {
+ .proc_handler = &pipe_proc_fn,
+ .extra1 = &pipe_min_size,
+ },
++ {
++ .procname = "pipe-user-pages-hard",
++ .data = &pipe_user_pages_hard,
++ .maxlen = sizeof(pipe_user_pages_hard),
++ .mode = 0644,
++ .proc_handler = proc_doulongvec_minmax,
++ },
++ {
++ .procname = "pipe-user-pages-soft",
++ .data = &pipe_user_pages_soft,
++ .maxlen = sizeof(pipe_user_pages_soft),
++ .mode = 0644,
++ .proc_handler = proc_doulongvec_minmax,
++ },
+ { }
+ };
+
+diff --git a/kernel/trace/trace_printk.c b/kernel/trace/trace_printk.c
+index 14ffaa59a9e9..9008103db583 100644
+--- a/kernel/trace/trace_printk.c
++++ b/kernel/trace/trace_printk.c
+@@ -38,6 +38,10 @@ struct trace_bprintk_fmt {
+ static inline struct trace_bprintk_fmt *lookup_format(const char *fmt)
+ {
+ struct trace_bprintk_fmt *pos;
++
++ if (!fmt)
++ return ERR_PTR(-EINVAL);
++
+ list_for_each_entry(pos, &trace_bprintk_fmt_list, list) {
+ if (!strcmp(pos->fmt, fmt))
+ return pos;
+@@ -59,7 +63,8 @@ void hold_module_trace_bprintk_format(const char **start, const char **end)
+ for (iter = start; iter < end; iter++) {
+ struct trace_bprintk_fmt *tb_fmt = lookup_format(*iter);
+ if (tb_fmt) {
+- *iter = tb_fmt->fmt;
++ if (!IS_ERR(tb_fmt))
++ *iter = tb_fmt->fmt;
+ continue;
+ }
+
+diff --git a/mm/compaction.c b/mm/compaction.c
+index 8d010df763dc..9f8b1dd5303c 100644
+--- a/mm/compaction.c
++++ b/mm/compaction.c
+@@ -371,6 +371,24 @@ static unsigned long isolate_freepages_block(struct compact_control *cc,
+
+ if (!valid_page)
+ valid_page = page;
++
++ /*
++ * For compound pages such as THP and hugetlbfs, we can save
++ * potentially a lot of iterations if we skip them at once.
++ * The check is racy, but we can consider only valid values
++ * and the only danger is skipping too much.
++ */
++ if (PageCompound(page)) {
++ unsigned int comp_order = compound_order(page);
++
++ if (likely(comp_order < MAX_ORDER)) {
++ blockpfn += (1UL << comp_order) - 1;
++ cursor += (1UL << comp_order) - 1;
++ }
++
++ goto isolate_fail;
++ }
++
+ if (!PageBuddy(page))
+ goto isolate_fail;
+
+@@ -402,18 +420,23 @@ static unsigned long isolate_freepages_block(struct compact_control *cc,
+
+ /* Found a free page, break it into order-0 pages */
+ isolated = split_free_page(page);
++ if (!isolated)
++ break;
++
+ total_isolated += isolated;
++ cc->nr_freepages += isolated;
+ for (i = 0; i < isolated; i++) {
+ list_add(&page->lru, freelist);
+ page++;
+ }
+-
+- /* If a page was split, advance to the end of it */
+- if (isolated) {
+- blockpfn += isolated - 1;
+- cursor += isolated - 1;
+- continue;
++ if (!strict && cc->nr_migratepages <= cc->nr_freepages) {
++ blockpfn += isolated;
++ break;
+ }
++ /* Advance to the end of split page */
++ blockpfn += isolated - 1;
++ cursor += isolated - 1;
++ continue;
+
+ isolate_fail:
+ if (strict)
+@@ -423,6 +446,16 @@ isolate_fail:
+
+ }
+
++ if (locked)
++ spin_unlock_irqrestore(&cc->zone->lock, flags);
++
++ /*
++ * There is a tiny chance that we have read bogus compound_order(),
++ * so be careful to not go outside of the pageblock.
++ */
++ if (unlikely(blockpfn > end_pfn))
++ blockpfn = end_pfn;
++
+ /* Record how far we have got within the block */
+ *start_pfn = blockpfn;
+
+@@ -436,9 +469,6 @@ isolate_fail:
+ if (strict && blockpfn < end_pfn)
+ total_isolated = 0;
+
+- if (locked)
+- spin_unlock_irqrestore(&cc->zone->lock, flags);
+-
+ /* Update the pageblock-skip if the whole pageblock was scanned */
+ if (blockpfn == end_pfn)
+ update_pageblock_skip(cc, valid_page, total_isolated, false);
+@@ -864,7 +894,12 @@ static void isolate_freepages(struct compact_control *cc)
+
+ /* Found a block suitable for isolating free pages from. */
+ isolated = isolate_freepages_block(cc, &isolate_start_pfn,
+- block_end_pfn, freelist, false);
++ block_end_pfn, freelist, false);
++ /* If isolation failed early, do not continue needlessly */
++ if (!isolated && isolate_start_pfn < block_end_pfn &&
++ cc->nr_migratepages > cc->nr_freepages)
++ break;
++
+ nr_freepages += isolated;
+
+ /*
+diff --git a/mm/migrate.c b/mm/migrate.c
+index cd4fd10c4ec3..3594defceff9 100644
+--- a/mm/migrate.c
++++ b/mm/migrate.c
+@@ -421,6 +421,7 @@ int migrate_page_move_mapping(struct address_space *mapping,
+
+ return MIGRATEPAGE_SUCCESS;
+ }
++EXPORT_SYMBOL(migrate_page_move_mapping);
+
+ /*
+ * The expected number of remaining references is the same as that
+@@ -580,6 +581,7 @@ void migrate_page_copy(struct page *newpage, struct page *page)
+ if (PageWriteback(newpage))
+ end_page_writeback(newpage);
+ }
++EXPORT_SYMBOL(migrate_page_copy);
+
+ /************************************************************
+ * Migration functions
+diff --git a/mm/page_isolation.c b/mm/page_isolation.c
+index ec66134fb2a5..03648ced21c2 100644
+--- a/mm/page_isolation.c
++++ b/mm/page_isolation.c
+@@ -299,11 +299,11 @@ struct page *alloc_migrate_target(struct page *page, unsigned long private,
+ * now as a simple work-around, we use the next node for destination.
+ */
+ if (PageHuge(page)) {
+- nodemask_t src = nodemask_of_node(page_to_nid(page));
+- nodemask_t dst;
+- nodes_complement(dst, src);
++ int node = next_online_node(page_to_nid(page));
++ if (node == MAX_NUMNODES)
++ node = first_online_node;
+ return alloc_huge_page_node(page_hstate(compound_head(page)),
+- next_node(page_to_nid(page), dst));
++ node);
+ }
+
+ if (PageHighMem(page))
+diff --git a/mm/percpu.c b/mm/percpu.c
+index 88bb6c92d83a..5ae6e0284967 100644
+--- a/mm/percpu.c
++++ b/mm/percpu.c
+@@ -110,7 +110,7 @@ struct pcpu_chunk {
+ int map_used; /* # of map entries used before the sentry */
+ int map_alloc; /* # of map entries allocated */
+ int *map; /* allocation map */
+- struct work_struct map_extend_work;/* async ->map[] extension */
++ struct list_head map_extend_list;/* on pcpu_map_extend_chunks */
+
+ void *data; /* chunk data */
+ int first_free; /* no free below this */
+@@ -160,10 +160,13 @@ static struct pcpu_chunk *pcpu_reserved_chunk;
+ static int pcpu_reserved_chunk_limit;
+
+ static DEFINE_SPINLOCK(pcpu_lock); /* all internal data structures */
+-static DEFINE_MUTEX(pcpu_alloc_mutex); /* chunk create/destroy, [de]pop */
++static DEFINE_MUTEX(pcpu_alloc_mutex); /* chunk create/destroy, [de]pop, map ext */
+
+ static struct list_head *pcpu_slot __read_mostly; /* chunk list slots */
+
++/* chunks which need their map areas extended, protected by pcpu_lock */
++static LIST_HEAD(pcpu_map_extend_chunks);
++
+ /*
+ * The number of empty populated pages, protected by pcpu_lock. The
+ * reserved chunk doesn't contribute to the count.
+@@ -397,13 +400,19 @@ static int pcpu_need_to_extend(struct pcpu_chunk *chunk, bool is_atomic)
+ {
+ int margin, new_alloc;
+
++ lockdep_assert_held(&pcpu_lock);
++
+ if (is_atomic) {
+ margin = 3;
+
+ if (chunk->map_alloc <
+- chunk->map_used + PCPU_ATOMIC_MAP_MARGIN_LOW &&
+- pcpu_async_enabled)
+- schedule_work(&chunk->map_extend_work);
++ chunk->map_used + PCPU_ATOMIC_MAP_MARGIN_LOW) {
++ if (list_empty(&chunk->map_extend_list)) {
++ list_add_tail(&chunk->map_extend_list,
++ &pcpu_map_extend_chunks);
++ pcpu_schedule_balance_work();
++ }
++ }
+ } else {
+ margin = PCPU_ATOMIC_MAP_MARGIN_HIGH;
+ }
+@@ -437,6 +446,8 @@ static int pcpu_extend_area_map(struct pcpu_chunk *chunk, int new_alloc)
+ size_t old_size = 0, new_size = new_alloc * sizeof(new[0]);
+ unsigned long flags;
+
++ lockdep_assert_held(&pcpu_alloc_mutex);
++
+ new = pcpu_mem_zalloc(new_size);
+ if (!new)
+ return -ENOMEM;
+@@ -469,20 +480,6 @@ out_unlock:
+ return 0;
+ }
+
+-static void pcpu_map_extend_workfn(struct work_struct *work)
+-{
+- struct pcpu_chunk *chunk = container_of(work, struct pcpu_chunk,
+- map_extend_work);
+- int new_alloc;
+-
+- spin_lock_irq(&pcpu_lock);
+- new_alloc = pcpu_need_to_extend(chunk, false);
+- spin_unlock_irq(&pcpu_lock);
+-
+- if (new_alloc)
+- pcpu_extend_area_map(chunk, new_alloc);
+-}
+-
+ /**
+ * pcpu_fit_in_area - try to fit the requested allocation in a candidate area
+ * @chunk: chunk the candidate area belongs to
+@@ -742,7 +739,7 @@ static struct pcpu_chunk *pcpu_alloc_chunk(void)
+ chunk->map_used = 1;
+
+ INIT_LIST_HEAD(&chunk->list);
+- INIT_WORK(&chunk->map_extend_work, pcpu_map_extend_workfn);
++ INIT_LIST_HEAD(&chunk->map_extend_list);
+ chunk->free_size = pcpu_unit_size;
+ chunk->contig_hint = pcpu_unit_size;
+
+@@ -897,6 +894,9 @@ static void __percpu *pcpu_alloc(size_t size, size_t align, bool reserved,
+ return NULL;
+ }
+
++ if (!is_atomic)
++ mutex_lock(&pcpu_alloc_mutex);
++
+ spin_lock_irqsave(&pcpu_lock, flags);
+
+ /* serve reserved allocations from the reserved chunk if available */
+@@ -969,12 +969,9 @@ restart:
+ if (is_atomic)
+ goto fail;
+
+- mutex_lock(&pcpu_alloc_mutex);
+-
+ if (list_empty(&pcpu_slot[pcpu_nr_slots - 1])) {
+ chunk = pcpu_create_chunk();
+ if (!chunk) {
+- mutex_unlock(&pcpu_alloc_mutex);
+ err = "failed to allocate new chunk";
+ goto fail;
+ }
+@@ -985,7 +982,6 @@ restart:
+ spin_lock_irqsave(&pcpu_lock, flags);
+ }
+
+- mutex_unlock(&pcpu_alloc_mutex);
+ goto restart;
+
+ area_found:
+@@ -995,8 +991,6 @@ area_found:
+ if (!is_atomic) {
+ int page_start, page_end, rs, re;
+
+- mutex_lock(&pcpu_alloc_mutex);
+-
+ page_start = PFN_DOWN(off);
+ page_end = PFN_UP(off + size);
+
+@@ -1007,7 +1001,6 @@ area_found:
+
+ spin_lock_irqsave(&pcpu_lock, flags);
+ if (ret) {
+- mutex_unlock(&pcpu_alloc_mutex);
+ pcpu_free_area(chunk, off, &occ_pages);
+ err = "failed to populate";
+ goto fail_unlock;
+@@ -1047,6 +1040,8 @@ fail:
+ /* see the flag handling in pcpu_blance_workfn() */
+ pcpu_atomic_alloc_failed = true;
+ pcpu_schedule_balance_work();
++ } else {
++ mutex_unlock(&pcpu_alloc_mutex);
+ }
+ return NULL;
+ }
+@@ -1131,6 +1126,7 @@ static void pcpu_balance_workfn(struct work_struct *work)
+ if (chunk == list_first_entry(free_head, struct pcpu_chunk, list))
+ continue;
+
++ list_del_init(&chunk->map_extend_list);
+ list_move(&chunk->list, &to_free);
+ }
+
+@@ -1148,6 +1144,25 @@ static void pcpu_balance_workfn(struct work_struct *work)
+ pcpu_destroy_chunk(chunk);
+ }
+
++ /* service chunks which requested async area map extension */
++ do {
++ int new_alloc = 0;
++
++ spin_lock_irq(&pcpu_lock);
++
++ chunk = list_first_entry_or_null(&pcpu_map_extend_chunks,
++ struct pcpu_chunk, map_extend_list);
++ if (chunk) {
++ list_del_init(&chunk->map_extend_list);
++ new_alloc = pcpu_need_to_extend(chunk, false);
++ }
++
++ spin_unlock_irq(&pcpu_lock);
++
++ if (new_alloc)
++ pcpu_extend_area_map(chunk, new_alloc);
++ } while (chunk);
++
+ /*
+ * Ensure there are certain number of free populated pages for
+ * atomic allocs. Fill up from the most packed so that atomic
+@@ -1648,7 +1663,7 @@ int __init pcpu_setup_first_chunk(const struct pcpu_alloc_info *ai,
+ */
+ schunk = memblock_virt_alloc(pcpu_chunk_struct_size, 0);
+ INIT_LIST_HEAD(&schunk->list);
+- INIT_WORK(&schunk->map_extend_work, pcpu_map_extend_workfn);
++ INIT_LIST_HEAD(&schunk->map_extend_list);
+ schunk->base_addr = base_addr;
+ schunk->map = smap;
+ schunk->map_alloc = ARRAY_SIZE(smap);
+@@ -1678,7 +1693,7 @@ int __init pcpu_setup_first_chunk(const struct pcpu_alloc_info *ai,
+ if (dyn_size) {
+ dchunk = memblock_virt_alloc(pcpu_chunk_struct_size, 0);
+ INIT_LIST_HEAD(&dchunk->list);
+- INIT_WORK(&dchunk->map_extend_work, pcpu_map_extend_workfn);
++ INIT_LIST_HEAD(&dchunk->map_extend_list);
+ dchunk->base_addr = base_addr;
+ dchunk->map = dmap;
+ dchunk->map_alloc = ARRAY_SIZE(dmap);
+diff --git a/mm/shmem.c b/mm/shmem.c
+index 0b4ba556703a..fac22b578eb9 100644
+--- a/mm/shmem.c
++++ b/mm/shmem.c
+@@ -2140,9 +2140,11 @@ static long shmem_fallocate(struct file *file, int mode, loff_t offset,
+ NULL);
+ if (error) {
+ /* Remove the !PageUptodate pages we added */
+- shmem_undo_range(inode,
+- (loff_t)start << PAGE_CACHE_SHIFT,
+- (loff_t)index << PAGE_CACHE_SHIFT, true);
++ if (index > start) {
++ shmem_undo_range(inode,
++ (loff_t)start << PAGE_CACHE_SHIFT,
++ ((loff_t)index << PAGE_CACHE_SHIFT) - 1, true);
++ }
+ goto undone;
+ }
+
+diff --git a/mm/swap.c b/mm/swap.c
+index 8a12b33936b4..9ccec11ed3fb 100644
+--- a/mm/swap.c
++++ b/mm/swap.c
+@@ -42,7 +42,7 @@ int page_cluster;
+
+ static DEFINE_PER_CPU(struct pagevec, lru_add_pvec);
+ static DEFINE_PER_CPU(struct pagevec, lru_rotate_pvecs);
+-static DEFINE_PER_CPU(struct pagevec, lru_deactivate_pvecs);
++static DEFINE_PER_CPU(struct pagevec, lru_deactivate_file_pvecs);
+
+ /*
+ * This path almost never happens for VM activity - pages are normally
+@@ -475,7 +475,7 @@ void rotate_reclaimable_page(struct page *page)
+ page_cache_get(page);
+ local_irq_save(flags);
+ pvec = this_cpu_ptr(&lru_rotate_pvecs);
+- if (!pagevec_add(pvec, page))
++ if (!pagevec_add(pvec, page) || PageCompound(page))
+ pagevec_move_tail(pvec);
+ local_irq_restore(flags);
+ }
+@@ -531,7 +531,7 @@ void activate_page(struct page *page)
+ struct pagevec *pvec = &get_cpu_var(activate_page_pvecs);
+
+ page_cache_get(page);
+- if (!pagevec_add(pvec, page))
++ if (!pagevec_add(pvec, page) || PageCompound(page))
+ pagevec_lru_move_fn(pvec, __activate_page, NULL);
+ put_cpu_var(activate_page_pvecs);
+ }
+@@ -623,9 +623,8 @@ static void __lru_cache_add(struct page *page)
+ struct pagevec *pvec = &get_cpu_var(lru_add_pvec);
+
+ page_cache_get(page);
+- if (!pagevec_space(pvec))
++ if (!pagevec_space(pvec) || PageCompound(page))
+ __pagevec_lru_add(pvec);
+- pagevec_add(pvec, page);
+ put_cpu_var(lru_add_pvec);
+ }
+
+@@ -743,7 +742,7 @@ void lru_cache_add_active_or_unevictable(struct page *page,
+ * be write it out by flusher threads as this is much more effective
+ * than the single-page writeout from reclaim.
+ */
+-static void lru_deactivate_fn(struct page *page, struct lruvec *lruvec,
++static void lru_deactivate_file_fn(struct page *page, struct lruvec *lruvec,
+ void *arg)
+ {
+ int lru, file;
+@@ -811,36 +810,36 @@ void lru_add_drain_cpu(int cpu)
+ local_irq_restore(flags);
+ }
+
+- pvec = &per_cpu(lru_deactivate_pvecs, cpu);
++ pvec = &per_cpu(lru_deactivate_file_pvecs, cpu);
+ if (pagevec_count(pvec))
+- pagevec_lru_move_fn(pvec, lru_deactivate_fn, NULL);
++ pagevec_lru_move_fn(pvec, lru_deactivate_file_fn, NULL);
+
+ activate_page_drain(cpu);
+ }
+
+ /**
+- * deactivate_page - forcefully deactivate a page
++ * deactivate_file_page - forcefully deactivate a file page
+ * @page: page to deactivate
+ *
+ * This function hints the VM that @page is a good reclaim candidate,
+ * for example if its invalidation fails due to the page being dirty
+ * or under writeback.
+ */
+-void deactivate_page(struct page *page)
++void deactivate_file_page(struct page *page)
+ {
+ /*
+- * In a workload with many unevictable page such as mprotect, unevictable
+- * page deactivation for accelerating reclaim is pointless.
++ * In a workload with many unevictable page such as mprotect,
++ * unevictable page deactivation for accelerating reclaim is pointless.
+ */
+ if (PageUnevictable(page))
+ return;
+
+ if (likely(get_page_unless_zero(page))) {
+- struct pagevec *pvec = &get_cpu_var(lru_deactivate_pvecs);
++ struct pagevec *pvec = &get_cpu_var(lru_deactivate_file_pvecs);
+
+- if (!pagevec_add(pvec, page))
+- pagevec_lru_move_fn(pvec, lru_deactivate_fn, NULL);
+- put_cpu_var(lru_deactivate_pvecs);
++ if (!pagevec_add(pvec, page) || PageCompound(page))
++ pagevec_lru_move_fn(pvec, lru_deactivate_file_fn, NULL);
++ put_cpu_var(lru_deactivate_file_pvecs);
+ }
+ }
+
+@@ -872,7 +871,7 @@ void lru_add_drain_all(void)
+
+ if (pagevec_count(&per_cpu(lru_add_pvec, cpu)) ||
+ pagevec_count(&per_cpu(lru_rotate_pvecs, cpu)) ||
+- pagevec_count(&per_cpu(lru_deactivate_pvecs, cpu)) ||
++ pagevec_count(&per_cpu(lru_deactivate_file_pvecs, cpu)) ||
+ need_activate_page_drain(cpu)) {
+ INIT_WORK(work, lru_add_drain_per_cpu);
+ schedule_work_on(cpu, work);
+diff --git a/mm/truncate.c b/mm/truncate.c
+index f1e4d6052369..dff252c03f3b 100644
+--- a/mm/truncate.c
++++ b/mm/truncate.c
+@@ -513,7 +513,7 @@ unsigned long invalidate_mapping_pages(struct address_space *mapping,
+ * of interest and try to speed up its reclaim.
+ */
+ if (!ret)
+- deactivate_page(page);
++ deactivate_file_page(page);
+ count += ret;
+ }
+ pagevec_remove_exceptionals(&pvec);
+diff --git a/net/batman-adv/routing.c b/net/batman-adv/routing.c
+index 35f76f2f7824..bbb1d04e7f8f 100644
+--- a/net/batman-adv/routing.c
++++ b/net/batman-adv/routing.c
+@@ -88,6 +88,15 @@ static void _batadv_update_route(struct batadv_priv *bat_priv,
+ neigh_node = NULL;
+
+ spin_lock_bh(&orig_node->neigh_list_lock);
++ /* curr_router used earlier may not be the current orig_ifinfo->router
++ * anymore because it was dereferenced outside of the neigh_list_lock
++ * protected region. After the new best neighbor has replace the current
++ * best neighbor the reference counter needs to decrease. Consequently,
++ * the code needs to ensure the curr_router variable contains a pointer
++ * to the replaced best neighbor.
++ */
++ curr_router = rcu_dereference_protected(orig_ifinfo->router, true);
++
+ rcu_assign_pointer(orig_ifinfo->router, neigh_node);
+ spin_unlock_bh(&orig_node->neigh_list_lock);
+ batadv_orig_ifinfo_free_ref(orig_ifinfo);
+diff --git a/net/batman-adv/send.c b/net/batman-adv/send.c
+index 3d64ed20c393..6004c2de7b2a 100644
+--- a/net/batman-adv/send.c
++++ b/net/batman-adv/send.c
+@@ -611,6 +611,9 @@ batadv_purge_outstanding_packets(struct batadv_priv *bat_priv,
+
+ if (pending) {
+ hlist_del(&forw_packet->list);
++ if (!forw_packet->own)
++ atomic_inc(&bat_priv->bcast_queue_left);
++
+ batadv_forw_packet_free(forw_packet);
+ }
+ }
+@@ -638,6 +641,9 @@ batadv_purge_outstanding_packets(struct batadv_priv *bat_priv,
+
+ if (pending) {
+ hlist_del(&forw_packet->list);
++ if (!forw_packet->own)
++ atomic_inc(&bat_priv->batman_queue_left);
++
+ batadv_forw_packet_free(forw_packet);
+ }
+ }
+diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c
+index 492b0593dc2f..0bb7cae486b3 100644
+--- a/net/batman-adv/soft-interface.c
++++ b/net/batman-adv/soft-interface.c
+@@ -378,11 +378,17 @@ void batadv_interface_rx(struct net_device *soft_iface,
+ */
+ nf_reset(skb);
+
++ if (unlikely(!pskb_may_pull(skb, ETH_HLEN)))
++ goto dropped;
++
+ vid = batadv_get_vid(skb, 0);
+ ethhdr = eth_hdr(skb);
+
+ switch (ntohs(ethhdr->h_proto)) {
+ case ETH_P_8021Q:
++ if (!pskb_may_pull(skb, VLAN_ETH_HLEN))
++ goto dropped;
++
+ vhdr = (struct vlan_ethhdr *)skb->data;
+
+ if (vhdr->h_vlan_encapsulated_proto != ethertype)
+@@ -394,8 +400,6 @@ void batadv_interface_rx(struct net_device *soft_iface,
+ }
+
+ /* skb->dev & skb->pkt_type are set here */
+- if (unlikely(!pskb_may_pull(skb, ETH_HLEN)))
+- goto dropped;
+ skb->protocol = eth_type_trans(skb, soft_iface);
+
+ /* should not be necessary anymore as we use skb_pull_rcsum()
+diff --git a/net/bridge/br_ioctl.c b/net/bridge/br_ioctl.c
+index 8d423bc649b9..f876f707fd9e 100644
+--- a/net/bridge/br_ioctl.c
++++ b/net/bridge/br_ioctl.c
+@@ -21,18 +21,19 @@
+ #include <asm/uaccess.h>
+ #include "br_private.h"
+
+-/* called with RTNL */
+ static int get_bridge_ifindices(struct net *net, int *indices, int num)
+ {
+ struct net_device *dev;
+ int i = 0;
+
+- for_each_netdev(net, dev) {
++ rcu_read_lock();
++ for_each_netdev_rcu(net, dev) {
+ if (i >= num)
+ break;
+ if (dev->priv_flags & IFF_EBRIDGE)
+ indices[i++] = dev->ifindex;
+ }
++ rcu_read_unlock();
+
+ return i;
+ }
+diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
+index c412db774603..e1574edf4e43 100644
+--- a/net/core/rtnetlink.c
++++ b/net/core/rtnetlink.c
+@@ -1019,14 +1019,16 @@ static int rtnl_fill_ifinfo(struct sk_buff *skb, struct net_device *dev,
+ goto nla_put_failure;
+
+ if (1) {
+- struct rtnl_link_ifmap map = {
+- .mem_start = dev->mem_start,
+- .mem_end = dev->mem_end,
+- .base_addr = dev->base_addr,
+- .irq = dev->irq,
+- .dma = dev->dma,
+- .port = dev->if_port,
+- };
++ struct rtnl_link_ifmap map;
++
++ memset(&map, 0, sizeof(map));
++ map.mem_start = dev->mem_start;
++ map.mem_end = dev->mem_end;
++ map.base_addr = dev->base_addr;
++ map.irq = dev->irq;
++ map.dma = dev->dma;
++ map.port = dev->if_port;
++
+ if (nla_put(skb, IFLA_MAP, sizeof(map), &map))
+ goto nla_put_failure;
+ }
+diff --git a/net/decnet/dn_route.c b/net/decnet/dn_route.c
+index daccc4a36d80..4047341f6c07 100644
+--- a/net/decnet/dn_route.c
++++ b/net/decnet/dn_route.c
+@@ -1042,10 +1042,13 @@ source_ok:
+ if (!fld.daddr) {
+ fld.daddr = fld.saddr;
+
+- err = -EADDRNOTAVAIL;
+ if (dev_out)
+ dev_put(dev_out);
++ err = -EINVAL;
+ dev_out = init_net.loopback_dev;
++ if (!dev_out->dn_ptr)
++ goto out;
++ err = -EADDRNOTAVAIL;
+ dev_hold(dev_out);
+ if (!fld.daddr) {
+ fld.daddr =
+@@ -1118,6 +1121,8 @@ source_ok:
+ if (dev_out == NULL)
+ goto out;
+ dn_db = rcu_dereference_raw(dev_out->dn_ptr);
++ if (!dn_db)
++ goto e_inval;
+ /* Possible improvement - check all devices for local addr */
+ if (dn_dev_islocal(dev_out, fld.daddr)) {
+ dev_put(dev_out);
+@@ -1159,6 +1164,8 @@ select_source:
+ dev_put(dev_out);
+ dev_out = init_net.loopback_dev;
+ dev_hold(dev_out);
++ if (!dev_out->dn_ptr)
++ goto e_inval;
+ fld.flowidn_oif = dev_out->ifindex;
+ if (res.fi)
+ dn_fib_info_put(res.fi);
+diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
+index 214882e7d6de..464293c34b7a 100644
+--- a/net/ipv4/devinet.c
++++ b/net/ipv4/devinet.c
+@@ -334,6 +334,9 @@ static void __inet_del_ifa(struct in_device *in_dev, struct in_ifaddr **ifap,
+
+ ASSERT_RTNL();
+
++ if (in_dev->dead)
++ goto no_promotions;
++
+ /* 1. Deleting primary ifaddr forces deletion all secondaries
+ * unless alias promotion is set
+ **/
+@@ -380,6 +383,7 @@ static void __inet_del_ifa(struct in_device *in_dev, struct in_ifaddr **ifap,
+ fib_del_ifaddr(ifa, ifa1);
+ }
+
++no_promotions:
+ /* 2. Unlink it */
+
+ *ifap = ifa1->ifa_next;
+diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
+index 23104a3f2924..d4c698ce0838 100644
+--- a/net/ipv4/fib_frontend.c
++++ b/net/ipv4/fib_frontend.c
+@@ -814,6 +814,9 @@ void fib_del_ifaddr(struct in_ifaddr *ifa, struct in_ifaddr *iprim)
+ subnet = 1;
+ }
+
++ if (in_dev->dead)
++ goto no_promotions;
++
+ /* Deletion is more complicated than add.
+ * We should take care of not to delete too much :-)
+ *
+@@ -889,6 +892,7 @@ void fib_del_ifaddr(struct in_ifaddr *ifa, struct in_ifaddr *iprim)
+ }
+ }
+
++no_promotions:
+ if (!(ok & BRD_OK))
+ fib_magic(RTM_DELROUTE, RTN_BROADCAST, ifa->ifa_broadcast, 32, prim);
+ if (subnet && ifa->ifa_prefixlen < 31) {
+diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
+index f95b6f93814b..655e1b05ff74 100644
+--- a/net/ipv4/netfilter/arp_tables.c
++++ b/net/ipv4/netfilter/arp_tables.c
+@@ -355,11 +355,24 @@ unsigned int arpt_do_table(struct sk_buff *skb,
+ }
+
+ /* All zeroes == unconditional rule. */
+-static inline bool unconditional(const struct arpt_arp *arp)
++static inline bool unconditional(const struct arpt_entry *e)
+ {
+ static const struct arpt_arp uncond;
+
+- return memcmp(arp, &uncond, sizeof(uncond)) == 0;
++ return e->target_offset == sizeof(struct arpt_entry) &&
++ memcmp(&e->arp, &uncond, sizeof(uncond)) == 0;
++}
++
++static bool find_jump_target(const struct xt_table_info *t,
++ const struct arpt_entry *target)
++{
++ struct arpt_entry *iter;
++
++ xt_entry_foreach(iter, t->entries, t->size) {
++ if (iter == target)
++ return true;
++ }
++ return false;
+ }
+
+ /* Figures out from what hook each rule can be called: returns 0 if
+@@ -398,11 +411,10 @@ static int mark_source_chains(const struct xt_table_info *newinfo,
+ |= ((1 << hook) | (1 << NF_ARP_NUMHOOKS));
+
+ /* Unconditional return/END. */
+- if ((e->target_offset == sizeof(struct arpt_entry) &&
++ if ((unconditional(e) &&
+ (strcmp(t->target.u.user.name,
+ XT_STANDARD_TARGET) == 0) &&
+- t->verdict < 0 && unconditional(&e->arp)) ||
+- visited) {
++ t->verdict < 0) || visited) {
+ unsigned int oldpos, size;
+
+ if ((strcmp(t->target.u.user.name,
+@@ -435,6 +447,8 @@ static int mark_source_chains(const struct xt_table_info *newinfo,
+ size = e->next_offset;
+ e = (struct arpt_entry *)
+ (entry0 + pos + size);
++ if (pos + size >= newinfo->size)
++ return 0;
+ e->counters.pcnt = pos;
+ pos += size;
+ } else {
+@@ -454,9 +468,15 @@ static int mark_source_chains(const struct xt_table_info *newinfo,
+ /* This a jump; chase it. */
+ duprintf("Jump rule %u -> %u\n",
+ pos, newpos);
++ e = (struct arpt_entry *)
++ (entry0 + newpos);
++ if (!find_jump_target(newinfo, e))
++ return 0;
+ } else {
+ /* ... this is a fallthru */
+ newpos = pos + e->next_offset;
++ if (newpos >= newinfo->size)
++ return 0;
+ }
+ e = (struct arpt_entry *)
+ (entry0 + newpos);
+@@ -470,25 +490,6 @@ static int mark_source_chains(const struct xt_table_info *newinfo,
+ return 1;
+ }
+
+-static inline int check_entry(const struct arpt_entry *e, const char *name)
+-{
+- const struct xt_entry_target *t;
+-
+- if (!arp_checkentry(&e->arp)) {
+- duprintf("arp_tables: arp check failed %p %s.\n", e, name);
+- return -EINVAL;
+- }
+-
+- if (e->target_offset + sizeof(struct xt_entry_target) > e->next_offset)
+- return -EINVAL;
+-
+- t = arpt_get_target_c(e);
+- if (e->target_offset + t->u.target_size > e->next_offset)
+- return -EINVAL;
+-
+- return 0;
+-}
+-
+ static inline int check_target(struct arpt_entry *e, const char *name)
+ {
+ struct xt_entry_target *t = arpt_get_target(e);
+@@ -518,10 +519,6 @@ find_check_entry(struct arpt_entry *e, const char *name, unsigned int size)
+ struct xt_target *target;
+ int ret;
+
+- ret = check_entry(e, name);
+- if (ret)
+- return ret;
+-
+ t = arpt_get_target(e);
+ target = xt_request_find_target(NFPROTO_ARP, t->u.user.name,
+ t->u.user.revision);
+@@ -547,7 +544,7 @@ static bool check_underflow(const struct arpt_entry *e)
+ const struct xt_entry_target *t;
+ unsigned int verdict;
+
+- if (!unconditional(&e->arp))
++ if (!unconditional(e))
+ return false;
+ t = arpt_get_target_c(e);
+ if (strcmp(t->u.user.name, XT_STANDARD_TARGET) != 0)
+@@ -566,9 +563,11 @@ static inline int check_entry_size_and_hooks(struct arpt_entry *e,
+ unsigned int valid_hooks)
+ {
+ unsigned int h;
++ int err;
+
+ if ((unsigned long)e % __alignof__(struct arpt_entry) != 0 ||
+- (unsigned char *)e + sizeof(struct arpt_entry) >= limit) {
++ (unsigned char *)e + sizeof(struct arpt_entry) >= limit ||
++ (unsigned char *)e + e->next_offset > limit) {
+ duprintf("Bad offset %p\n", e);
+ return -EINVAL;
+ }
+@@ -580,6 +579,14 @@ static inline int check_entry_size_and_hooks(struct arpt_entry *e,
+ return -EINVAL;
+ }
+
++ if (!arp_checkentry(&e->arp))
++ return -EINVAL;
++
++ err = xt_check_entry_offsets(e, e->elems, e->target_offset,
++ e->next_offset);
++ if (err)
++ return err;
++
+ /* Check hooks & underflows */
+ for (h = 0; h < NF_ARP_NUMHOOKS; h++) {
+ if (!(valid_hooks & (1 << h)))
+@@ -588,9 +595,9 @@ static inline int check_entry_size_and_hooks(struct arpt_entry *e,
+ newinfo->hook_entry[h] = hook_entries[h];
+ if ((unsigned char *)e - base == underflows[h]) {
+ if (!check_underflow(e)) {
+- pr_err("Underflows must be unconditional and "
+- "use the STANDARD target with "
+- "ACCEPT/DROP\n");
++ pr_debug("Underflows must be unconditional and "
++ "use the STANDARD target with "
++ "ACCEPT/DROP\n");
+ return -EINVAL;
+ }
+ newinfo->underflow[h] = underflows[h];
+@@ -680,10 +687,8 @@ static int translate_table(struct xt_table_info *newinfo, void *entry0,
+ }
+ }
+
+- if (!mark_source_chains(newinfo, repl->valid_hooks, entry0)) {
+- duprintf("Looping hook\n");
++ if (!mark_source_chains(newinfo, repl->valid_hooks, entry0))
+ return -ELOOP;
+- }
+
+ /* Finally, each sanity check must pass */
+ i = 0;
+@@ -1116,56 +1121,18 @@ static int do_add_counters(struct net *net, const void __user *user,
+ unsigned int i, curcpu;
+ struct xt_counters_info tmp;
+ struct xt_counters *paddc;
+- unsigned int num_counters;
+- const char *name;
+- int size;
+- void *ptmp;
+ struct xt_table *t;
+ const struct xt_table_info *private;
+ int ret = 0;
+ void *loc_cpu_entry;
+ struct arpt_entry *iter;
+ unsigned int addend;
+-#ifdef CONFIG_COMPAT
+- struct compat_xt_counters_info compat_tmp;
+
+- if (compat) {
+- ptmp = &compat_tmp;
+- size = sizeof(struct compat_xt_counters_info);
+- } else
+-#endif
+- {
+- ptmp = &tmp;
+- size = sizeof(struct xt_counters_info);
+- }
++ paddc = xt_copy_counters_from_user(user, len, &tmp, compat);
++ if (IS_ERR(paddc))
++ return PTR_ERR(paddc);
+
+- if (copy_from_user(ptmp, user, size) != 0)
+- return -EFAULT;
+-
+-#ifdef CONFIG_COMPAT
+- if (compat) {
+- num_counters = compat_tmp.num_counters;
+- name = compat_tmp.name;
+- } else
+-#endif
+- {
+- num_counters = tmp.num_counters;
+- name = tmp.name;
+- }
+-
+- if (len != size + num_counters * sizeof(struct xt_counters))
+- return -EINVAL;
+-
+- paddc = vmalloc(len - size);
+- if (!paddc)
+- return -ENOMEM;
+-
+- if (copy_from_user(paddc, user + size, len - size) != 0) {
+- ret = -EFAULT;
+- goto free;
+- }
+-
+- t = xt_find_table_lock(net, NFPROTO_ARP, name);
++ t = xt_find_table_lock(net, NFPROTO_ARP, tmp.name);
+ if (IS_ERR_OR_NULL(t)) {
+ ret = t ? PTR_ERR(t) : -ENOENT;
+ goto free;
+@@ -1173,7 +1140,7 @@ static int do_add_counters(struct net *net, const void __user *user,
+
+ local_bh_disable();
+ private = t->private;
+- if (private->number != num_counters) {
++ if (private->number != tmp.num_counters) {
+ ret = -EINVAL;
+ goto unlock_up_free;
+ }
+@@ -1199,6 +1166,18 @@ static int do_add_counters(struct net *net, const void __user *user,
+ }
+
+ #ifdef CONFIG_COMPAT
++struct compat_arpt_replace {
++ char name[XT_TABLE_MAXNAMELEN];
++ u32 valid_hooks;
++ u32 num_entries;
++ u32 size;
++ u32 hook_entry[NF_ARP_NUMHOOKS];
++ u32 underflow[NF_ARP_NUMHOOKS];
++ u32 num_counters;
++ compat_uptr_t counters;
++ struct compat_arpt_entry entries[0];
++};
++
+ static inline void compat_release_entry(struct compat_arpt_entry *e)
+ {
+ struct xt_entry_target *t;
+@@ -1207,24 +1186,22 @@ static inline void compat_release_entry(struct compat_arpt_entry *e)
+ module_put(t->u.kernel.target->me);
+ }
+
+-static inline int
++static int
+ check_compat_entry_size_and_hooks(struct compat_arpt_entry *e,
+ struct xt_table_info *newinfo,
+ unsigned int *size,
+ const unsigned char *base,
+- const unsigned char *limit,
+- const unsigned int *hook_entries,
+- const unsigned int *underflows,
+- const char *name)
++ const unsigned char *limit)
+ {
+ struct xt_entry_target *t;
+ struct xt_target *target;
+ unsigned int entry_offset;
+- int ret, off, h;
++ int ret, off;
+
+ duprintf("check_compat_entry_size_and_hooks %p\n", e);
+ if ((unsigned long)e % __alignof__(struct compat_arpt_entry) != 0 ||
+- (unsigned char *)e + sizeof(struct compat_arpt_entry) >= limit) {
++ (unsigned char *)e + sizeof(struct compat_arpt_entry) >= limit ||
++ (unsigned char *)e + e->next_offset > limit) {
+ duprintf("Bad offset %p, limit = %p\n", e, limit);
+ return -EINVAL;
+ }
+@@ -1236,8 +1213,11 @@ check_compat_entry_size_and_hooks(struct compat_arpt_entry *e,
+ return -EINVAL;
+ }
+
+- /* For purposes of check_entry casting the compat entry is fine */
+- ret = check_entry((struct arpt_entry *)e, name);
++ if (!arp_checkentry(&e->arp))
++ return -EINVAL;
++
++ ret = xt_compat_check_entry_offsets(e, e->elems, e->target_offset,
++ e->next_offset);
+ if (ret)
+ return ret;
+
+@@ -1261,17 +1241,6 @@ check_compat_entry_size_and_hooks(struct compat_arpt_entry *e,
+ if (ret)
+ goto release_target;
+
+- /* Check hooks & underflows */
+- for (h = 0; h < NF_ARP_NUMHOOKS; h++) {
+- if ((unsigned char *)e - base == hook_entries[h])
+- newinfo->hook_entry[h] = hook_entries[h];
+- if ((unsigned char *)e - base == underflows[h])
+- newinfo->underflow[h] = underflows[h];
+- }
+-
+- /* Clear counters and comefrom */
+- memset(&e->counters, 0, sizeof(e->counters));
+- e->comefrom = 0;
+ return 0;
+
+ release_target:
+@@ -1280,18 +1249,17 @@ out:
+ return ret;
+ }
+
+-static int
++static void
+ compat_copy_entry_from_user(struct compat_arpt_entry *e, void **dstptr,
+- unsigned int *size, const char *name,
++ unsigned int *size,
+ struct xt_table_info *newinfo, unsigned char *base)
+ {
+ struct xt_entry_target *t;
+ struct xt_target *target;
+ struct arpt_entry *de;
+ unsigned int origsize;
+- int ret, h;
++ int h;
+
+- ret = 0;
+ origsize = *size;
+ de = (struct arpt_entry *)*dstptr;
+ memcpy(de, e, sizeof(struct arpt_entry));
+@@ -1312,144 +1280,81 @@ compat_copy_entry_from_user(struct compat_arpt_entry *e, void **dstptr,
+ if ((unsigned char *)de - base < newinfo->underflow[h])
+ newinfo->underflow[h] -= origsize - *size;
+ }
+- return ret;
+ }
+
+-static int translate_compat_table(const char *name,
+- unsigned int valid_hooks,
+- struct xt_table_info **pinfo,
++static int translate_compat_table(struct xt_table_info **pinfo,
+ void **pentry0,
+- unsigned int total_size,
+- unsigned int number,
+- unsigned int *hook_entries,
+- unsigned int *underflows)
++ const struct compat_arpt_replace *compatr)
+ {
+ unsigned int i, j;
+ struct xt_table_info *newinfo, *info;
+ void *pos, *entry0, *entry1;
+ struct compat_arpt_entry *iter0;
+- struct arpt_entry *iter1;
++ struct arpt_replace repl;
+ unsigned int size;
+ int ret = 0;
+
+ info = *pinfo;
+ entry0 = *pentry0;
+- size = total_size;
+- info->number = number;
+-
+- /* Init all hooks to impossible value. */
+- for (i = 0; i < NF_ARP_NUMHOOKS; i++) {
+- info->hook_entry[i] = 0xFFFFFFFF;
+- info->underflow[i] = 0xFFFFFFFF;
+- }
++ size = compatr->size;
++ info->number = compatr->num_entries;
+
+ duprintf("translate_compat_table: size %u\n", info->size);
+ j = 0;
+ xt_compat_lock(NFPROTO_ARP);
+- xt_compat_init_offsets(NFPROTO_ARP, number);
++ xt_compat_init_offsets(NFPROTO_ARP, compatr->num_entries);
+ /* Walk through entries, checking offsets. */
+- xt_entry_foreach(iter0, entry0, total_size) {
++ xt_entry_foreach(iter0, entry0, compatr->size) {
+ ret = check_compat_entry_size_and_hooks(iter0, info, &size,
+ entry0,
+- entry0 + total_size,
+- hook_entries,
+- underflows,
+- name);
++ entry0 + compatr->size);
+ if (ret != 0)
+ goto out_unlock;
+ ++j;
+ }
+
+ ret = -EINVAL;
+- if (j != number) {
++ if (j != compatr->num_entries) {
+ duprintf("translate_compat_table: %u not %u entries\n",
+- j, number);
++ j, compatr->num_entries);
+ goto out_unlock;
+ }
+
+- /* Check hooks all assigned */
+- for (i = 0; i < NF_ARP_NUMHOOKS; i++) {
+- /* Only hooks which are valid */
+- if (!(valid_hooks & (1 << i)))
+- continue;
+- if (info->hook_entry[i] == 0xFFFFFFFF) {
+- duprintf("Invalid hook entry %u %u\n",
+- i, hook_entries[i]);
+- goto out_unlock;
+- }
+- if (info->underflow[i] == 0xFFFFFFFF) {
+- duprintf("Invalid underflow %u %u\n",
+- i, underflows[i]);
+- goto out_unlock;
+- }
+- }
+-
+ ret = -ENOMEM;
+ newinfo = xt_alloc_table_info(size);
+ if (!newinfo)
+ goto out_unlock;
+
+- newinfo->number = number;
++ newinfo->number = compatr->num_entries;
+ for (i = 0; i < NF_ARP_NUMHOOKS; i++) {
+ newinfo->hook_entry[i] = info->hook_entry[i];
+ newinfo->underflow[i] = info->underflow[i];
+ }
+ entry1 = newinfo->entries[raw_smp_processor_id()];
+ pos = entry1;
+- size = total_size;
+- xt_entry_foreach(iter0, entry0, total_size) {
+- ret = compat_copy_entry_from_user(iter0, &pos, &size,
+- name, newinfo, entry1);
+- if (ret != 0)
+- break;
+- }
++ size = compatr->size;
++ xt_entry_foreach(iter0, entry0, compatr->size)
++ compat_copy_entry_from_user(iter0, &pos, &size,
++ newinfo, entry1);
++
++ /* all module references in entry0 are now gone */
++
+ xt_compat_flush_offsets(NFPROTO_ARP);
+ xt_compat_unlock(NFPROTO_ARP);
+- if (ret)
+- goto free_newinfo;
+
+- ret = -ELOOP;
+- if (!mark_source_chains(newinfo, valid_hooks, entry1))
+- goto free_newinfo;
++ memcpy(&repl, compatr, sizeof(*compatr));
+
+- i = 0;
+- xt_entry_foreach(iter1, entry1, newinfo->size) {
+- ret = check_target(iter1, name);
+- if (ret != 0)
+- break;
+- ++i;
+- if (strcmp(arpt_get_target(iter1)->u.user.name,
+- XT_ERROR_TARGET) == 0)
+- ++newinfo->stacksize;
+- }
+- if (ret) {
+- /*
+- * The first i matches need cleanup_entry (calls ->destroy)
+- * because they had called ->check already. The other j-i
+- * entries need only release.
+- */
+- int skip = i;
+- j -= i;
+- xt_entry_foreach(iter0, entry0, newinfo->size) {
+- if (skip-- > 0)
+- continue;
+- if (j-- == 0)
+- break;
+- compat_release_entry(iter0);
+- }
+- xt_entry_foreach(iter1, entry1, newinfo->size) {
+- if (i-- == 0)
+- break;
+- cleanup_entry(iter1);
+- }
+- xt_free_table_info(newinfo);
+- return ret;
++ for (i = 0; i < NF_ARP_NUMHOOKS; i++) {
++ repl.hook_entry[i] = newinfo->hook_entry[i];
++ repl.underflow[i] = newinfo->underflow[i];
+ }
+
+- /* And one copy for every other CPU */
+- for_each_possible_cpu(i)
+- if (newinfo->entries[i] && newinfo->entries[i] != entry1)
+- memcpy(newinfo->entries[i], entry1, newinfo->size);
++ repl.num_counters = 0;
++ repl.counters = NULL;
++ repl.size = newinfo->size;
++ ret = translate_table(newinfo, entry1, &repl);
++ if (ret)
++ goto free_newinfo;
+
+ *pinfo = newinfo;
+ *pentry0 = entry1;
+@@ -1458,31 +1363,18 @@ static int translate_compat_table(const char *name,
+
+ free_newinfo:
+ xt_free_table_info(newinfo);
+-out:
+- xt_entry_foreach(iter0, entry0, total_size) {
++ return ret;
++out_unlock:
++ xt_compat_flush_offsets(NFPROTO_ARP);
++ xt_compat_unlock(NFPROTO_ARP);
++ xt_entry_foreach(iter0, entry0, compatr->size) {
+ if (j-- == 0)
+ break;
+ compat_release_entry(iter0);
+ }
+ return ret;
+-out_unlock:
+- xt_compat_flush_offsets(NFPROTO_ARP);
+- xt_compat_unlock(NFPROTO_ARP);
+- goto out;
+ }
+
+-struct compat_arpt_replace {
+- char name[XT_TABLE_MAXNAMELEN];
+- u32 valid_hooks;
+- u32 num_entries;
+- u32 size;
+- u32 hook_entry[NF_ARP_NUMHOOKS];
+- u32 underflow[NF_ARP_NUMHOOKS];
+- u32 num_counters;
+- compat_uptr_t counters;
+- struct compat_arpt_entry entries[0];
+-};
+-
+ static int compat_do_replace(struct net *net, void __user *user,
+ unsigned int len)
+ {
+@@ -1513,10 +1405,7 @@ static int compat_do_replace(struct net *net, void __user *user,
+ goto free_newinfo;
+ }
+
+- ret = translate_compat_table(tmp.name, tmp.valid_hooks,
+- &newinfo, &loc_cpu_entry, tmp.size,
+- tmp.num_entries, tmp.hook_entry,
+- tmp.underflow);
++ ret = translate_compat_table(&newinfo, &loc_cpu_entry, &tmp);
+ if (ret != 0)
+ goto free_newinfo;
+
+diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
+index 99e810f84671..865e738d3804 100644
+--- a/net/ipv4/netfilter/ip_tables.c
++++ b/net/ipv4/netfilter/ip_tables.c
+@@ -168,11 +168,12 @@ get_entry(const void *base, unsigned int offset)
+
+ /* All zeroes == unconditional rule. */
+ /* Mildly perf critical (only if packet tracing is on) */
+-static inline bool unconditional(const struct ipt_ip *ip)
++static inline bool unconditional(const struct ipt_entry *e)
+ {
+ static const struct ipt_ip uncond;
+
+- return memcmp(ip, &uncond, sizeof(uncond)) == 0;
++ return e->target_offset == sizeof(struct ipt_entry) &&
++ memcmp(&e->ip, &uncond, sizeof(uncond)) == 0;
+ #undef FWINV
+ }
+
+@@ -229,11 +230,10 @@ get_chainname_rulenum(const struct ipt_entry *s, const struct ipt_entry *e,
+ } else if (s == e) {
+ (*rulenum)++;
+
+- if (s->target_offset == sizeof(struct ipt_entry) &&
++ if (unconditional(s) &&
+ strcmp(t->target.u.kernel.target->name,
+ XT_STANDARD_TARGET) == 0 &&
+- t->verdict < 0 &&
+- unconditional(&s->ip)) {
++ t->verdict < 0) {
+ /* Tail of chains: STANDARD target (return/policy) */
+ *comment = *chainname == hookname
+ ? comments[NF_IP_TRACE_COMMENT_POLICY]
+@@ -439,6 +439,18 @@ ipt_do_table(struct sk_buff *skb,
+ #endif
+ }
+
++static bool find_jump_target(const struct xt_table_info *t,
++ const struct ipt_entry *target)
++{
++ struct ipt_entry *iter;
++
++ xt_entry_foreach(iter, t->entries, t->size) {
++ if (iter == target)
++ return true;
++ }
++ return false;
++}
++
+ /* Figures out from what hook each rule can be called: returns 0 if
+ there are loops. Puts hook bitmask in comefrom. */
+ static int
+@@ -472,11 +484,10 @@ mark_source_chains(const struct xt_table_info *newinfo,
+ e->comefrom |= ((1 << hook) | (1 << NF_INET_NUMHOOKS));
+
+ /* Unconditional return/END. */
+- if ((e->target_offset == sizeof(struct ipt_entry) &&
++ if ((unconditional(e) &&
+ (strcmp(t->target.u.user.name,
+ XT_STANDARD_TARGET) == 0) &&
+- t->verdict < 0 && unconditional(&e->ip)) ||
+- visited) {
++ t->verdict < 0) || visited) {
+ unsigned int oldpos, size;
+
+ if ((strcmp(t->target.u.user.name,
+@@ -517,6 +528,8 @@ mark_source_chains(const struct xt_table_info *newinfo,
+ size = e->next_offset;
+ e = (struct ipt_entry *)
+ (entry0 + pos + size);
++ if (pos + size >= newinfo->size)
++ return 0;
+ e->counters.pcnt = pos;
+ pos += size;
+ } else {
+@@ -535,9 +548,15 @@ mark_source_chains(const struct xt_table_info *newinfo,
+ /* This a jump; chase it. */
+ duprintf("Jump rule %u -> %u\n",
+ pos, newpos);
++ e = (struct ipt_entry *)
++ (entry0 + newpos);
++ if (!find_jump_target(newinfo, e))
++ return 0;
+ } else {
+ /* ... this is a fallthru */
+ newpos = pos + e->next_offset;
++ if (newpos >= newinfo->size)
++ return 0;
+ }
+ e = (struct ipt_entry *)
+ (entry0 + newpos);
+@@ -565,27 +584,6 @@ static void cleanup_match(struct xt_entry_match *m, struct net *net)
+ }
+
+ static int
+-check_entry(const struct ipt_entry *e, const char *name)
+-{
+- const struct xt_entry_target *t;
+-
+- if (!ip_checkentry(&e->ip)) {
+- duprintf("ip check failed %p %s.\n", e, name);
+- return -EINVAL;
+- }
+-
+- if (e->target_offset + sizeof(struct xt_entry_target) >
+- e->next_offset)
+- return -EINVAL;
+-
+- t = ipt_get_target_c(e);
+- if (e->target_offset + t->u.target_size > e->next_offset)
+- return -EINVAL;
+-
+- return 0;
+-}
+-
+-static int
+ check_match(struct xt_entry_match *m, struct xt_mtchk_param *par)
+ {
+ const struct ipt_ip *ip = par->entryinfo;
+@@ -662,10 +660,6 @@ find_check_entry(struct ipt_entry *e, struct net *net, const char *name,
+ struct xt_mtchk_param mtpar;
+ struct xt_entry_match *ematch;
+
+- ret = check_entry(e, name);
+- if (ret)
+- return ret;
+-
+ j = 0;
+ mtpar.net = net;
+ mtpar.table = name;
+@@ -709,7 +703,7 @@ static bool check_underflow(const struct ipt_entry *e)
+ const struct xt_entry_target *t;
+ unsigned int verdict;
+
+- if (!unconditional(&e->ip))
++ if (!unconditional(e))
+ return false;
+ t = ipt_get_target_c(e);
+ if (strcmp(t->u.user.name, XT_STANDARD_TARGET) != 0)
+@@ -729,9 +723,11 @@ check_entry_size_and_hooks(struct ipt_entry *e,
+ unsigned int valid_hooks)
+ {
+ unsigned int h;
++ int err;
+
+ if ((unsigned long)e % __alignof__(struct ipt_entry) != 0 ||
+- (unsigned char *)e + sizeof(struct ipt_entry) >= limit) {
++ (unsigned char *)e + sizeof(struct ipt_entry) >= limit ||
++ (unsigned char *)e + e->next_offset > limit) {
+ duprintf("Bad offset %p\n", e);
+ return -EINVAL;
+ }
+@@ -743,6 +739,14 @@ check_entry_size_and_hooks(struct ipt_entry *e,
+ return -EINVAL;
+ }
+
++ if (!ip_checkentry(&e->ip))
++ return -EINVAL;
++
++ err = xt_check_entry_offsets(e, e->elems, e->target_offset,
++ e->next_offset);
++ if (err)
++ return err;
++
+ /* Check hooks & underflows */
+ for (h = 0; h < NF_INET_NUMHOOKS; h++) {
+ if (!(valid_hooks & (1 << h)))
+@@ -751,9 +755,9 @@ check_entry_size_and_hooks(struct ipt_entry *e,
+ newinfo->hook_entry[h] = hook_entries[h];
+ if ((unsigned char *)e - base == underflows[h]) {
+ if (!check_underflow(e)) {
+- pr_err("Underflows must be unconditional and "
+- "use the STANDARD target with "
+- "ACCEPT/DROP\n");
++ pr_debug("Underflows must be unconditional and "
++ "use the STANDARD target with "
++ "ACCEPT/DROP\n");
+ return -EINVAL;
+ }
+ newinfo->underflow[h] = underflows[h];
+@@ -1304,56 +1308,18 @@ do_add_counters(struct net *net, const void __user *user,
+ unsigned int i, curcpu;
+ struct xt_counters_info tmp;
+ struct xt_counters *paddc;
+- unsigned int num_counters;
+- const char *name;
+- int size;
+- void *ptmp;
+ struct xt_table *t;
+ const struct xt_table_info *private;
+ int ret = 0;
+ void *loc_cpu_entry;
+ struct ipt_entry *iter;
+ unsigned int addend;
+-#ifdef CONFIG_COMPAT
+- struct compat_xt_counters_info compat_tmp;
+-
+- if (compat) {
+- ptmp = &compat_tmp;
+- size = sizeof(struct compat_xt_counters_info);
+- } else
+-#endif
+- {
+- ptmp = &tmp;
+- size = sizeof(struct xt_counters_info);
+- }
+-
+- if (copy_from_user(ptmp, user, size) != 0)
+- return -EFAULT;
+-
+-#ifdef CONFIG_COMPAT
+- if (compat) {
+- num_counters = compat_tmp.num_counters;
+- name = compat_tmp.name;
+- } else
+-#endif
+- {
+- num_counters = tmp.num_counters;
+- name = tmp.name;
+- }
+
+- if (len != size + num_counters * sizeof(struct xt_counters))
+- return -EINVAL;
+-
+- paddc = vmalloc(len - size);
+- if (!paddc)
+- return -ENOMEM;
+-
+- if (copy_from_user(paddc, user + size, len - size) != 0) {
+- ret = -EFAULT;
+- goto free;
+- }
++ paddc = xt_copy_counters_from_user(user, len, &tmp, compat);
++ if (IS_ERR(paddc))
++ return PTR_ERR(paddc);
+
+- t = xt_find_table_lock(net, AF_INET, name);
++ t = xt_find_table_lock(net, AF_INET, tmp.name);
+ if (IS_ERR_OR_NULL(t)) {
+ ret = t ? PTR_ERR(t) : -ENOENT;
+ goto free;
+@@ -1361,7 +1327,7 @@ do_add_counters(struct net *net, const void __user *user,
+
+ local_bh_disable();
+ private = t->private;
+- if (private->number != num_counters) {
++ if (private->number != tmp.num_counters) {
+ ret = -EINVAL;
+ goto unlock_up_free;
+ }
+@@ -1440,7 +1406,6 @@ compat_copy_entry_to_user(struct ipt_entry *e, void __user **dstptr,
+
+ static int
+ compat_find_calc_match(struct xt_entry_match *m,
+- const char *name,
+ const struct ipt_ip *ip,
+ unsigned int hookmask,
+ int *size)
+@@ -1476,21 +1441,19 @@ check_compat_entry_size_and_hooks(struct compat_ipt_entry *e,
+ struct xt_table_info *newinfo,
+ unsigned int *size,
+ const unsigned char *base,
+- const unsigned char *limit,
+- const unsigned int *hook_entries,
+- const unsigned int *underflows,
+- const char *name)
++ const unsigned char *limit)
+ {
+ struct xt_entry_match *ematch;
+ struct xt_entry_target *t;
+ struct xt_target *target;
+ unsigned int entry_offset;
+ unsigned int j;
+- int ret, off, h;
++ int ret, off;
+
+ duprintf("check_compat_entry_size_and_hooks %p\n", e);
+ if ((unsigned long)e % __alignof__(struct compat_ipt_entry) != 0 ||
+- (unsigned char *)e + sizeof(struct compat_ipt_entry) >= limit) {
++ (unsigned char *)e + sizeof(struct compat_ipt_entry) >= limit ||
++ (unsigned char *)e + e->next_offset > limit) {
+ duprintf("Bad offset %p, limit = %p\n", e, limit);
+ return -EINVAL;
+ }
+@@ -1502,8 +1465,11 @@ check_compat_entry_size_and_hooks(struct compat_ipt_entry *e,
+ return -EINVAL;
+ }
+
+- /* For purposes of check_entry casting the compat entry is fine */
+- ret = check_entry((struct ipt_entry *)e, name);
++ if (!ip_checkentry(&e->ip))
++ return -EINVAL;
++
++ ret = xt_compat_check_entry_offsets(e, e->elems,
++ e->target_offset, e->next_offset);
+ if (ret)
+ return ret;
+
+@@ -1511,8 +1477,8 @@ check_compat_entry_size_and_hooks(struct compat_ipt_entry *e,
+ entry_offset = (void *)e - (void *)base;
+ j = 0;
+ xt_ematch_foreach(ematch, e) {
+- ret = compat_find_calc_match(ematch, name,
+- &e->ip, e->comefrom, &off);
++ ret = compat_find_calc_match(ematch, &e->ip, e->comefrom,
++ &off);
+ if (ret != 0)
+ goto release_matches;
+ ++j;
+@@ -1535,17 +1501,6 @@ check_compat_entry_size_and_hooks(struct compat_ipt_entry *e,
+ if (ret)
+ goto out;
+
+- /* Check hooks & underflows */
+- for (h = 0; h < NF_INET_NUMHOOKS; h++) {
+- if ((unsigned char *)e - base == hook_entries[h])
+- newinfo->hook_entry[h] = hook_entries[h];
+- if ((unsigned char *)e - base == underflows[h])
+- newinfo->underflow[h] = underflows[h];
+- }
+-
+- /* Clear counters and comefrom */
+- memset(&e->counters, 0, sizeof(e->counters));
+- e->comefrom = 0;
+ return 0;
+
+ out:
+@@ -1559,19 +1514,18 @@ release_matches:
+ return ret;
+ }
+
+-static int
++static void
+ compat_copy_entry_from_user(struct compat_ipt_entry *e, void **dstptr,
+- unsigned int *size, const char *name,
++ unsigned int *size,
+ struct xt_table_info *newinfo, unsigned char *base)
+ {
+ struct xt_entry_target *t;
+ struct xt_target *target;
+ struct ipt_entry *de;
+ unsigned int origsize;
+- int ret, h;
++ int h;
+ struct xt_entry_match *ematch;
+
+- ret = 0;
+ origsize = *size;
+ de = (struct ipt_entry *)*dstptr;
+ memcpy(de, e, sizeof(struct ipt_entry));
+@@ -1580,198 +1534,104 @@ compat_copy_entry_from_user(struct compat_ipt_entry *e, void **dstptr,
+ *dstptr += sizeof(struct ipt_entry);
+ *size += sizeof(struct ipt_entry) - sizeof(struct compat_ipt_entry);
+
+- xt_ematch_foreach(ematch, e) {
+- ret = xt_compat_match_from_user(ematch, dstptr, size);
+- if (ret != 0)
+- return ret;
+- }
++ xt_ematch_foreach(ematch, e)
++ xt_compat_match_from_user(ematch, dstptr, size);
++
+ de->target_offset = e->target_offset - (origsize - *size);
+ t = compat_ipt_get_target(e);
+ target = t->u.kernel.target;
+ xt_compat_target_from_user(t, dstptr, size);
+
+ de->next_offset = e->next_offset - (origsize - *size);
++
+ for (h = 0; h < NF_INET_NUMHOOKS; h++) {
+ if ((unsigned char *)de - base < newinfo->hook_entry[h])
+ newinfo->hook_entry[h] -= origsize - *size;
+ if ((unsigned char *)de - base < newinfo->underflow[h])
+ newinfo->underflow[h] -= origsize - *size;
+ }
+- return ret;
+-}
+-
+-static int
+-compat_check_entry(struct ipt_entry *e, struct net *net, const char *name)
+-{
+- struct xt_entry_match *ematch;
+- struct xt_mtchk_param mtpar;
+- unsigned int j;
+- int ret = 0;
+-
+- j = 0;
+- mtpar.net = net;
+- mtpar.table = name;
+- mtpar.entryinfo = &e->ip;
+- mtpar.hook_mask = e->comefrom;
+- mtpar.family = NFPROTO_IPV4;
+- xt_ematch_foreach(ematch, e) {
+- ret = check_match(ematch, &mtpar);
+- if (ret != 0)
+- goto cleanup_matches;
+- ++j;
+- }
+-
+- ret = check_target(e, net, name);
+- if (ret)
+- goto cleanup_matches;
+- return 0;
+-
+- cleanup_matches:
+- xt_ematch_foreach(ematch, e) {
+- if (j-- == 0)
+- break;
+- cleanup_match(ematch, net);
+- }
+- return ret;
+ }
+
+ static int
+ translate_compat_table(struct net *net,
+- const char *name,
+- unsigned int valid_hooks,
+ struct xt_table_info **pinfo,
+ void **pentry0,
+- unsigned int total_size,
+- unsigned int number,
+- unsigned int *hook_entries,
+- unsigned int *underflows)
++ const struct compat_ipt_replace *compatr)
+ {
+ unsigned int i, j;
+ struct xt_table_info *newinfo, *info;
+ void *pos, *entry0, *entry1;
+ struct compat_ipt_entry *iter0;
+- struct ipt_entry *iter1;
++ struct ipt_replace repl;
+ unsigned int size;
+ int ret;
+
+ info = *pinfo;
+ entry0 = *pentry0;
+- size = total_size;
+- info->number = number;
+-
+- /* Init all hooks to impossible value. */
+- for (i = 0; i < NF_INET_NUMHOOKS; i++) {
+- info->hook_entry[i] = 0xFFFFFFFF;
+- info->underflow[i] = 0xFFFFFFFF;
+- }
++ size = compatr->size;
++ info->number = compatr->num_entries;
+
+ duprintf("translate_compat_table: size %u\n", info->size);
+ j = 0;
+ xt_compat_lock(AF_INET);
+- xt_compat_init_offsets(AF_INET, number);
++ xt_compat_init_offsets(AF_INET, compatr->num_entries);
+ /* Walk through entries, checking offsets. */
+- xt_entry_foreach(iter0, entry0, total_size) {
++ xt_entry_foreach(iter0, entry0, compatr->size) {
+ ret = check_compat_entry_size_and_hooks(iter0, info, &size,
+ entry0,
+- entry0 + total_size,
+- hook_entries,
+- underflows,
+- name);
++ entry0 + compatr->size);
+ if (ret != 0)
+ goto out_unlock;
+ ++j;
+ }
+
+ ret = -EINVAL;
+- if (j != number) {
++ if (j != compatr->num_entries) {
+ duprintf("translate_compat_table: %u not %u entries\n",
+- j, number);
++ j, compatr->num_entries);
+ goto out_unlock;
+ }
+
+- /* Check hooks all assigned */
+- for (i = 0; i < NF_INET_NUMHOOKS; i++) {
+- /* Only hooks which are valid */
+- if (!(valid_hooks & (1 << i)))
+- continue;
+- if (info->hook_entry[i] == 0xFFFFFFFF) {
+- duprintf("Invalid hook entry %u %u\n",
+- i, hook_entries[i]);
+- goto out_unlock;
+- }
+- if (info->underflow[i] == 0xFFFFFFFF) {
+- duprintf("Invalid underflow %u %u\n",
+- i, underflows[i]);
+- goto out_unlock;
+- }
+- }
+-
+ ret = -ENOMEM;
+ newinfo = xt_alloc_table_info(size);
+ if (!newinfo)
+ goto out_unlock;
+
+- newinfo->number = number;
++ newinfo->number = compatr->num_entries;
+ for (i = 0; i < NF_INET_NUMHOOKS; i++) {
+- newinfo->hook_entry[i] = info->hook_entry[i];
+- newinfo->underflow[i] = info->underflow[i];
++ newinfo->hook_entry[i] = compatr->hook_entry[i];
++ newinfo->underflow[i] = compatr->underflow[i];
+ }
+ entry1 = newinfo->entries[raw_smp_processor_id()];
+ pos = entry1;
+- size = total_size;
+- xt_entry_foreach(iter0, entry0, total_size) {
+- ret = compat_copy_entry_from_user(iter0, &pos, &size,
+- name, newinfo, entry1);
+- if (ret != 0)
+- break;
+- }
++ size = compatr->size;
++ xt_entry_foreach(iter0, entry0, compatr->size)
++ compat_copy_entry_from_user(iter0, &pos, &size,
++ newinfo, entry1);
++
++ /* all module references in entry0 are now gone.
++ * entry1/newinfo contains a 64bit ruleset that looks exactly as
++ * generated by 64bit userspace.
++ *
++ * Call standard translate_table() to validate all hook_entrys,
++ * underflows, check for loops, etc.
++ */
+ xt_compat_flush_offsets(AF_INET);
+ xt_compat_unlock(AF_INET);
+- if (ret)
+- goto free_newinfo;
+
+- ret = -ELOOP;
+- if (!mark_source_chains(newinfo, valid_hooks, entry1))
+- goto free_newinfo;
++ memcpy(&repl, compatr, sizeof(*compatr));
+
+- i = 0;
+- xt_entry_foreach(iter1, entry1, newinfo->size) {
+- ret = compat_check_entry(iter1, net, name);
+- if (ret != 0)
+- break;
+- ++i;
+- if (strcmp(ipt_get_target(iter1)->u.user.name,
+- XT_ERROR_TARGET) == 0)
+- ++newinfo->stacksize;
+- }
+- if (ret) {
+- /*
+- * The first i matches need cleanup_entry (calls ->destroy)
+- * because they had called ->check already. The other j-i
+- * entries need only release.
+- */
+- int skip = i;
+- j -= i;
+- xt_entry_foreach(iter0, entry0, newinfo->size) {
+- if (skip-- > 0)
+- continue;
+- if (j-- == 0)
+- break;
+- compat_release_entry(iter0);
+- }
+- xt_entry_foreach(iter1, entry1, newinfo->size) {
+- if (i-- == 0)
+- break;
+- cleanup_entry(iter1, net);
+- }
+- xt_free_table_info(newinfo);
+- return ret;
++ for (i = 0; i < NF_INET_NUMHOOKS; i++) {
++ repl.hook_entry[i] = newinfo->hook_entry[i];
++ repl.underflow[i] = newinfo->underflow[i];
+ }
+
+- /* And one copy for every other CPU */
+- for_each_possible_cpu(i)
+- if (newinfo->entries[i] && newinfo->entries[i] != entry1)
+- memcpy(newinfo->entries[i], entry1, newinfo->size);
++ repl.num_counters = 0;
++ repl.counters = NULL;
++ repl.size = newinfo->size;
++ ret = translate_table(net, newinfo, entry1, &repl);
++ if (ret)
++ goto free_newinfo;
+
+ *pinfo = newinfo;
+ *pentry0 = entry1;
+@@ -1780,17 +1640,16 @@ translate_compat_table(struct net *net,
+
+ free_newinfo:
+ xt_free_table_info(newinfo);
+-out:
+- xt_entry_foreach(iter0, entry0, total_size) {
++ return ret;
++out_unlock:
++ xt_compat_flush_offsets(AF_INET);
++ xt_compat_unlock(AF_INET);
++ xt_entry_foreach(iter0, entry0, compatr->size) {
+ if (j-- == 0)
+ break;
+ compat_release_entry(iter0);
+ }
+ return ret;
+-out_unlock:
+- xt_compat_flush_offsets(AF_INET);
+- xt_compat_unlock(AF_INET);
+- goto out;
+ }
+
+ static int
+@@ -1824,10 +1683,7 @@ compat_do_replace(struct net *net, void __user *user, unsigned int len)
+ goto free_newinfo;
+ }
+
+- ret = translate_compat_table(net, tmp.name, tmp.valid_hooks,
+- &newinfo, &loc_cpu_entry, tmp.size,
+- tmp.num_entries, tmp.hook_entry,
+- tmp.underflow);
++ ret = translate_compat_table(net, &newinfo, &loc_cpu_entry, &tmp);
+ if (ret != 0)
+ goto free_newinfo;
+
+diff --git a/net/ipv4/netfilter/nf_nat_masquerade_ipv4.c b/net/ipv4/netfilter/nf_nat_masquerade_ipv4.c
+index c6eb42100e9a..ea91058b5f6f 100644
+--- a/net/ipv4/netfilter/nf_nat_masquerade_ipv4.c
++++ b/net/ipv4/netfilter/nf_nat_masquerade_ipv4.c
+@@ -108,10 +108,18 @@ static int masq_inet_event(struct notifier_block *this,
+ unsigned long event,
+ void *ptr)
+ {
+- struct net_device *dev = ((struct in_ifaddr *)ptr)->ifa_dev->dev;
++ struct in_device *idev = ((struct in_ifaddr *)ptr)->ifa_dev;
+ struct netdev_notifier_info info;
+
+- netdev_notifier_info_init(&info, dev);
++ /* The masq_dev_notifier will catch the case of the device going
++ * down. So if the inetdev is dead and being destroyed we have
++ * no work to do. Otherwise this is an individual address removal
++ * and we have to perform the flush.
++ */
++ if (idev->dead)
++ return NOTIFY_DONE;
++
++ netdev_notifier_info_init(&info, idev->dev);
+ return masq_device_event(this, event, &info);
+ }
+
+diff --git a/net/ipv4/route.c b/net/ipv4/route.c
+index b7ac498fed5f..12c5df33c0b7 100644
+--- a/net/ipv4/route.c
++++ b/net/ipv4/route.c
+@@ -1924,6 +1924,18 @@ static struct rtable *__mkroute_output(const struct fib_result *res,
+ */
+ if (fi && res->prefixlen < 4)
+ fi = NULL;
++ } else if ((type == RTN_LOCAL) && (orig_oif != 0) &&
++ (orig_oif != dev_out->ifindex)) {
++ /* For local routes that require a particular output interface
++ * we do not want to cache the result. Caching the result
++ * causes incorrect behaviour when there are multiple source
++ * addresses on the interface, the end result being that if the
++ * intended recipient is waiting on that interface for the
++ * packet he won't receive it because it will be delivered on
++ * the loopback interface and the IP_PKTINFO ipi_ifindex will
++ * be set to the loopback interface as well.
++ */
++ fi = NULL;
+ }
+
+ fnhe = NULL;
+diff --git a/net/ipv4/tcp_metrics.c b/net/ipv4/tcp_metrics.c
+index ed9c9a91851c..c90e76c2eca0 100644
+--- a/net/ipv4/tcp_metrics.c
++++ b/net/ipv4/tcp_metrics.c
+@@ -550,7 +550,7 @@ reset:
+ */
+ if (crtt > tp->srtt_us) {
+ /* Set RTO like tcp_rtt_estimator(), but from cached RTT. */
+- crtt /= 8 * USEC_PER_MSEC;
++ crtt /= 8 * USEC_PER_SEC / HZ;
+ inet_csk(sk)->icsk_rto = crtt + max(2 * crtt, tcp_rto_min(sk));
+ } else if (tp->srtt_us == 0) {
+ /* RFC6298: 5.7 We've failed to get a valid RTT sample from
+diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
+index 9c7d88870e2b..af2f64eeb98f 100644
+--- a/net/ipv4/tcp_output.c
++++ b/net/ipv4/tcp_output.c
+@@ -2532,8 +2532,10 @@ int __tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb)
+ */
+ if (unlikely((NET_IP_ALIGN && ((unsigned long)skb->data & 3)) ||
+ skb_headroom(skb) >= 0xFFFF)) {
+- struct sk_buff *nskb = __pskb_copy(skb, MAX_TCP_HEADER,
+- GFP_ATOMIC);
++ struct sk_buff *nskb;
++
++ skb_mstamp_get(&skb->skb_mstamp);
++ nskb = __pskb_copy(skb, MAX_TCP_HEADER, GFP_ATOMIC);
+ err = nskb ? tcp_transmit_skb(sk, nskb, 0, GFP_ATOMIC) :
+ -ENOBUFS;
+ } else {
+diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
+index 4ea975324888..2a5d388d76a4 100644
+--- a/net/ipv4/udp.c
++++ b/net/ipv4/udp.c
+@@ -1965,10 +1965,14 @@ void udp_v4_early_demux(struct sk_buff *skb)
+ if (!in_dev)
+ return;
+
+- ours = ip_check_mc_rcu(in_dev, iph->daddr, iph->saddr,
+- iph->protocol);
+- if (!ours)
+- return;
++ /* we are supposed to accept bcast packets */
++ if (skb->pkt_type == PACKET_MULTICAST) {
++ ours = ip_check_mc_rcu(in_dev, iph->daddr, iph->saddr,
++ iph->protocol);
++ if (!ours)
++ return;
++ }
++
+ sk = __udp4_lib_mcast_demux_lookup(net, uh->dest, iph->daddr,
+ uh->source, iph->saddr, dif);
+ } else if (skb->pkt_type == PACKET_HOST) {
+diff --git a/net/ipv6/exthdrs_core.c b/net/ipv6/exthdrs_core.c
+index 8af3eb57f438..c7c8f71d0d48 100644
+--- a/net/ipv6/exthdrs_core.c
++++ b/net/ipv6/exthdrs_core.c
+@@ -257,7 +257,11 @@ int ipv6_find_hdr(const struct sk_buff *skb, unsigned int *offset,
+ *fragoff = _frag_off;
+ return hp->nexthdr;
+ }
+- return -ENOENT;
++ if (!found)
++ return -ENOENT;
++ if (fragoff)
++ *fragoff = _frag_off;
++ break;
+ }
+ hdrlen = 8;
+ } else if (nexthdr == NEXTHDR_AUTH) {
+diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
+index 9cb94cfa0ae7..6987d3cb4163 100644
+--- a/net/ipv6/ip6_tunnel.c
++++ b/net/ipv6/ip6_tunnel.c
+@@ -273,12 +273,12 @@ static int ip6_tnl_create2(struct net_device *dev)
+
+ t = netdev_priv(dev);
+
++ dev->rtnl_link_ops = &ip6_link_ops;
+ err = register_netdevice(dev);
+ if (err < 0)
+ goto out;
+
+ strcpy(t->parms.name, dev->name);
+- dev->rtnl_link_ops = &ip6_link_ops;
+
+ dev_hold(dev);
+ ip6_tnl_link(ip6n, t);
+diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
+index e080fbbbc0e5..1b6ed70bab37 100644
+--- a/net/ipv6/netfilter/ip6_tables.c
++++ b/net/ipv6/netfilter/ip6_tables.c
+@@ -195,11 +195,12 @@ get_entry(const void *base, unsigned int offset)
+
+ /* All zeroes == unconditional rule. */
+ /* Mildly perf critical (only if packet tracing is on) */
+-static inline bool unconditional(const struct ip6t_ip6 *ipv6)
++static inline bool unconditional(const struct ip6t_entry *e)
+ {
+ static const struct ip6t_ip6 uncond;
+
+- return memcmp(ipv6, &uncond, sizeof(uncond)) == 0;
++ return e->target_offset == sizeof(struct ip6t_entry) &&
++ memcmp(&e->ipv6, &uncond, sizeof(uncond)) == 0;
+ }
+
+ static inline const struct xt_entry_target *
+@@ -255,11 +256,10 @@ get_chainname_rulenum(const struct ip6t_entry *s, const struct ip6t_entry *e,
+ } else if (s == e) {
+ (*rulenum)++;
+
+- if (s->target_offset == sizeof(struct ip6t_entry) &&
++ if (unconditional(s) &&
+ strcmp(t->target.u.kernel.target->name,
+ XT_STANDARD_TARGET) == 0 &&
+- t->verdict < 0 &&
+- unconditional(&s->ipv6)) {
++ t->verdict < 0) {
+ /* Tail of chains: STANDARD target (return/policy) */
+ *comment = *chainname == hookname
+ ? comments[NF_IP6_TRACE_COMMENT_POLICY]
+@@ -449,6 +449,18 @@ ip6t_do_table(struct sk_buff *skb,
+ #endif
+ }
+
++static bool find_jump_target(const struct xt_table_info *t,
++ const struct ip6t_entry *target)
++{
++ struct ip6t_entry *iter;
++
++ xt_entry_foreach(iter, t->entries, t->size) {
++ if (iter == target)
++ return true;
++ }
++ return false;
++}
++
+ /* Figures out from what hook each rule can be called: returns 0 if
+ there are loops. Puts hook bitmask in comefrom. */
+ static int
+@@ -482,11 +494,10 @@ mark_source_chains(const struct xt_table_info *newinfo,
+ e->comefrom |= ((1 << hook) | (1 << NF_INET_NUMHOOKS));
+
+ /* Unconditional return/END. */
+- if ((e->target_offset == sizeof(struct ip6t_entry) &&
++ if ((unconditional(e) &&
+ (strcmp(t->target.u.user.name,
+ XT_STANDARD_TARGET) == 0) &&
+- t->verdict < 0 &&
+- unconditional(&e->ipv6)) || visited) {
++ t->verdict < 0) || visited) {
+ unsigned int oldpos, size;
+
+ if ((strcmp(t->target.u.user.name,
+@@ -527,6 +538,8 @@ mark_source_chains(const struct xt_table_info *newinfo,
+ size = e->next_offset;
+ e = (struct ip6t_entry *)
+ (entry0 + pos + size);
++ if (pos + size >= newinfo->size)
++ return 0;
+ e->counters.pcnt = pos;
+ pos += size;
+ } else {
+@@ -545,9 +558,15 @@ mark_source_chains(const struct xt_table_info *newinfo,
+ /* This a jump; chase it. */
+ duprintf("Jump rule %u -> %u\n",
+ pos, newpos);
++ e = (struct ip6t_entry *)
++ (entry0 + newpos);
++ if (!find_jump_target(newinfo, e))
++ return 0;
+ } else {
+ /* ... this is a fallthru */
+ newpos = pos + e->next_offset;
++ if (newpos >= newinfo->size)
++ return 0;
+ }
+ e = (struct ip6t_entry *)
+ (entry0 + newpos);
+@@ -574,27 +593,6 @@ static void cleanup_match(struct xt_entry_match *m, struct net *net)
+ module_put(par.match->me);
+ }
+
+-static int
+-check_entry(const struct ip6t_entry *e, const char *name)
+-{
+- const struct xt_entry_target *t;
+-
+- if (!ip6_checkentry(&e->ipv6)) {
+- duprintf("ip_tables: ip check failed %p %s.\n", e, name);
+- return -EINVAL;
+- }
+-
+- if (e->target_offset + sizeof(struct xt_entry_target) >
+- e->next_offset)
+- return -EINVAL;
+-
+- t = ip6t_get_target_c(e);
+- if (e->target_offset + t->u.target_size > e->next_offset)
+- return -EINVAL;
+-
+- return 0;
+-}
+-
+ static int check_match(struct xt_entry_match *m, struct xt_mtchk_param *par)
+ {
+ const struct ip6t_ip6 *ipv6 = par->entryinfo;
+@@ -673,10 +671,6 @@ find_check_entry(struct ip6t_entry *e, struct net *net, const char *name,
+ struct xt_mtchk_param mtpar;
+ struct xt_entry_match *ematch;
+
+- ret = check_entry(e, name);
+- if (ret)
+- return ret;
+-
+ j = 0;
+ mtpar.net = net;
+ mtpar.table = name;
+@@ -720,7 +714,7 @@ static bool check_underflow(const struct ip6t_entry *e)
+ const struct xt_entry_target *t;
+ unsigned int verdict;
+
+- if (!unconditional(&e->ipv6))
++ if (!unconditional(e))
+ return false;
+ t = ip6t_get_target_c(e);
+ if (strcmp(t->u.user.name, XT_STANDARD_TARGET) != 0)
+@@ -740,9 +734,11 @@ check_entry_size_and_hooks(struct ip6t_entry *e,
+ unsigned int valid_hooks)
+ {
+ unsigned int h;
++ int err;
+
+ if ((unsigned long)e % __alignof__(struct ip6t_entry) != 0 ||
+- (unsigned char *)e + sizeof(struct ip6t_entry) >= limit) {
++ (unsigned char *)e + sizeof(struct ip6t_entry) >= limit ||
++ (unsigned char *)e + e->next_offset > limit) {
+ duprintf("Bad offset %p\n", e);
+ return -EINVAL;
+ }
+@@ -754,6 +750,14 @@ check_entry_size_and_hooks(struct ip6t_entry *e,
+ return -EINVAL;
+ }
+
++ if (!ip6_checkentry(&e->ipv6))
++ return -EINVAL;
++
++ err = xt_check_entry_offsets(e, e->elems, e->target_offset,
++ e->next_offset);
++ if (err)
++ return err;
++
+ /* Check hooks & underflows */
+ for (h = 0; h < NF_INET_NUMHOOKS; h++) {
+ if (!(valid_hooks & (1 << h)))
+@@ -762,9 +766,9 @@ check_entry_size_and_hooks(struct ip6t_entry *e,
+ newinfo->hook_entry[h] = hook_entries[h];
+ if ((unsigned char *)e - base == underflows[h]) {
+ if (!check_underflow(e)) {
+- pr_err("Underflows must be unconditional and "
+- "use the STANDARD target with "
+- "ACCEPT/DROP\n");
++ pr_debug("Underflows must be unconditional and "
++ "use the STANDARD target with "
++ "ACCEPT/DROP\n");
+ return -EINVAL;
+ }
+ newinfo->underflow[h] = underflows[h];
+@@ -1314,56 +1318,17 @@ do_add_counters(struct net *net, const void __user *user, unsigned int len,
+ unsigned int i, curcpu;
+ struct xt_counters_info tmp;
+ struct xt_counters *paddc;
+- unsigned int num_counters;
+- char *name;
+- int size;
+- void *ptmp;
+ struct xt_table *t;
+ const struct xt_table_info *private;
+ int ret = 0;
+ const void *loc_cpu_entry;
+ struct ip6t_entry *iter;
+ unsigned int addend;
+-#ifdef CONFIG_COMPAT
+- struct compat_xt_counters_info compat_tmp;
+-
+- if (compat) {
+- ptmp = &compat_tmp;
+- size = sizeof(struct compat_xt_counters_info);
+- } else
+-#endif
+- {
+- ptmp = &tmp;
+- size = sizeof(struct xt_counters_info);
+- }
+-
+- if (copy_from_user(ptmp, user, size) != 0)
+- return -EFAULT;
+
+-#ifdef CONFIG_COMPAT
+- if (compat) {
+- num_counters = compat_tmp.num_counters;
+- name = compat_tmp.name;
+- } else
+-#endif
+- {
+- num_counters = tmp.num_counters;
+- name = tmp.name;
+- }
+-
+- if (len != size + num_counters * sizeof(struct xt_counters))
+- return -EINVAL;
+-
+- paddc = vmalloc(len - size);
+- if (!paddc)
+- return -ENOMEM;
+-
+- if (copy_from_user(paddc, user + size, len - size) != 0) {
+- ret = -EFAULT;
+- goto free;
+- }
+-
+- t = xt_find_table_lock(net, AF_INET6, name);
++ paddc = xt_copy_counters_from_user(user, len, &tmp, compat);
++ if (IS_ERR(paddc))
++ return PTR_ERR(paddc);
++ t = xt_find_table_lock(net, AF_INET6, tmp.name);
+ if (IS_ERR_OR_NULL(t)) {
+ ret = t ? PTR_ERR(t) : -ENOENT;
+ goto free;
+@@ -1372,7 +1337,7 @@ do_add_counters(struct net *net, const void __user *user, unsigned int len,
+
+ local_bh_disable();
+ private = t->private;
+- if (private->number != num_counters) {
++ if (private->number != tmp.num_counters) {
+ ret = -EINVAL;
+ goto unlock_up_free;
+ }
+@@ -1452,7 +1417,6 @@ compat_copy_entry_to_user(struct ip6t_entry *e, void __user **dstptr,
+
+ static int
+ compat_find_calc_match(struct xt_entry_match *m,
+- const char *name,
+ const struct ip6t_ip6 *ipv6,
+ unsigned int hookmask,
+ int *size)
+@@ -1488,21 +1452,19 @@ check_compat_entry_size_and_hooks(struct compat_ip6t_entry *e,
+ struct xt_table_info *newinfo,
+ unsigned int *size,
+ const unsigned char *base,
+- const unsigned char *limit,
+- const unsigned int *hook_entries,
+- const unsigned int *underflows,
+- const char *name)
++ const unsigned char *limit)
+ {
+ struct xt_entry_match *ematch;
+ struct xt_entry_target *t;
+ struct xt_target *target;
+ unsigned int entry_offset;
+ unsigned int j;
+- int ret, off, h;
++ int ret, off;
+
+ duprintf("check_compat_entry_size_and_hooks %p\n", e);
+ if ((unsigned long)e % __alignof__(struct compat_ip6t_entry) != 0 ||
+- (unsigned char *)e + sizeof(struct compat_ip6t_entry) >= limit) {
++ (unsigned char *)e + sizeof(struct compat_ip6t_entry) >= limit ||
++ (unsigned char *)e + e->next_offset > limit) {
+ duprintf("Bad offset %p, limit = %p\n", e, limit);
+ return -EINVAL;
+ }
+@@ -1514,8 +1476,11 @@ check_compat_entry_size_and_hooks(struct compat_ip6t_entry *e,
+ return -EINVAL;
+ }
+
+- /* For purposes of check_entry casting the compat entry is fine */
+- ret = check_entry((struct ip6t_entry *)e, name);
++ if (!ip6_checkentry(&e->ipv6))
++ return -EINVAL;
++
++ ret = xt_compat_check_entry_offsets(e, e->elems,
++ e->target_offset, e->next_offset);
+ if (ret)
+ return ret;
+
+@@ -1523,8 +1488,8 @@ check_compat_entry_size_and_hooks(struct compat_ip6t_entry *e,
+ entry_offset = (void *)e - (void *)base;
+ j = 0;
+ xt_ematch_foreach(ematch, e) {
+- ret = compat_find_calc_match(ematch, name,
+- &e->ipv6, e->comefrom, &off);
++ ret = compat_find_calc_match(ematch, &e->ipv6, e->comefrom,
++ &off);
+ if (ret != 0)
+ goto release_matches;
+ ++j;
+@@ -1547,17 +1512,6 @@ check_compat_entry_size_and_hooks(struct compat_ip6t_entry *e,
+ if (ret)
+ goto out;
+
+- /* Check hooks & underflows */
+- for (h = 0; h < NF_INET_NUMHOOKS; h++) {
+- if ((unsigned char *)e - base == hook_entries[h])
+- newinfo->hook_entry[h] = hook_entries[h];
+- if ((unsigned char *)e - base == underflows[h])
+- newinfo->underflow[h] = underflows[h];
+- }
+-
+- /* Clear counters and comefrom */
+- memset(&e->counters, 0, sizeof(e->counters));
+- e->comefrom = 0;
+ return 0;
+
+ out:
+@@ -1571,18 +1525,17 @@ release_matches:
+ return ret;
+ }
+
+-static int
++static void
+ compat_copy_entry_from_user(struct compat_ip6t_entry *e, void **dstptr,
+- unsigned int *size, const char *name,
++ unsigned int *size,
+ struct xt_table_info *newinfo, unsigned char *base)
+ {
+ struct xt_entry_target *t;
+ struct ip6t_entry *de;
+ unsigned int origsize;
+- int ret, h;
++ int h;
+ struct xt_entry_match *ematch;
+
+- ret = 0;
+ origsize = *size;
+ de = (struct ip6t_entry *)*dstptr;
+ memcpy(de, e, sizeof(struct ip6t_entry));
+@@ -1591,11 +1544,9 @@ compat_copy_entry_from_user(struct compat_ip6t_entry *e, void **dstptr,
+ *dstptr += sizeof(struct ip6t_entry);
+ *size += sizeof(struct ip6t_entry) - sizeof(struct compat_ip6t_entry);
+
+- xt_ematch_foreach(ematch, e) {
+- ret = xt_compat_match_from_user(ematch, dstptr, size);
+- if (ret != 0)
+- return ret;
+- }
++ xt_ematch_foreach(ematch, e)
++ xt_compat_match_from_user(ematch, dstptr, size);
++
+ de->target_offset = e->target_offset - (origsize - *size);
+ t = compat_ip6t_get_target(e);
+ xt_compat_target_from_user(t, dstptr, size);
+@@ -1607,181 +1558,82 @@ compat_copy_entry_from_user(struct compat_ip6t_entry *e, void **dstptr,
+ if ((unsigned char *)de - base < newinfo->underflow[h])
+ newinfo->underflow[h] -= origsize - *size;
+ }
+- return ret;
+-}
+-
+-static int compat_check_entry(struct ip6t_entry *e, struct net *net,
+- const char *name)
+-{
+- unsigned int j;
+- int ret = 0;
+- struct xt_mtchk_param mtpar;
+- struct xt_entry_match *ematch;
+-
+- j = 0;
+- mtpar.net = net;
+- mtpar.table = name;
+- mtpar.entryinfo = &e->ipv6;
+- mtpar.hook_mask = e->comefrom;
+- mtpar.family = NFPROTO_IPV6;
+- xt_ematch_foreach(ematch, e) {
+- ret = check_match(ematch, &mtpar);
+- if (ret != 0)
+- goto cleanup_matches;
+- ++j;
+- }
+-
+- ret = check_target(e, net, name);
+- if (ret)
+- goto cleanup_matches;
+- return 0;
+-
+- cleanup_matches:
+- xt_ematch_foreach(ematch, e) {
+- if (j-- == 0)
+- break;
+- cleanup_match(ematch, net);
+- }
+- return ret;
+ }
+
+ static int
+ translate_compat_table(struct net *net,
+- const char *name,
+- unsigned int valid_hooks,
+ struct xt_table_info **pinfo,
+ void **pentry0,
+- unsigned int total_size,
+- unsigned int number,
+- unsigned int *hook_entries,
+- unsigned int *underflows)
++ const struct compat_ip6t_replace *compatr)
+ {
+ unsigned int i, j;
+ struct xt_table_info *newinfo, *info;
+ void *pos, *entry0, *entry1;
+ struct compat_ip6t_entry *iter0;
+- struct ip6t_entry *iter1;
++ struct ip6t_replace repl;
+ unsigned int size;
+ int ret = 0;
+
+ info = *pinfo;
+ entry0 = *pentry0;
+- size = total_size;
+- info->number = number;
+-
+- /* Init all hooks to impossible value. */
+- for (i = 0; i < NF_INET_NUMHOOKS; i++) {
+- info->hook_entry[i] = 0xFFFFFFFF;
+- info->underflow[i] = 0xFFFFFFFF;
+- }
++ size = compatr->size;
++ info->number = compatr->num_entries;
+
+ duprintf("translate_compat_table: size %u\n", info->size);
+ j = 0;
+ xt_compat_lock(AF_INET6);
+- xt_compat_init_offsets(AF_INET6, number);
++ xt_compat_init_offsets(AF_INET6, compatr->num_entries);
+ /* Walk through entries, checking offsets. */
+- xt_entry_foreach(iter0, entry0, total_size) {
++ xt_entry_foreach(iter0, entry0, compatr->size) {
+ ret = check_compat_entry_size_and_hooks(iter0, info, &size,
+ entry0,
+- entry0 + total_size,
+- hook_entries,
+- underflows,
+- name);
++ entry0 + compatr->size);
+ if (ret != 0)
+ goto out_unlock;
+ ++j;
+ }
+
+ ret = -EINVAL;
+- if (j != number) {
++ if (j != compatr->num_entries) {
+ duprintf("translate_compat_table: %u not %u entries\n",
+- j, number);
++ j, compatr->num_entries);
+ goto out_unlock;
+ }
+
+- /* Check hooks all assigned */
+- for (i = 0; i < NF_INET_NUMHOOKS; i++) {
+- /* Only hooks which are valid */
+- if (!(valid_hooks & (1 << i)))
+- continue;
+- if (info->hook_entry[i] == 0xFFFFFFFF) {
+- duprintf("Invalid hook entry %u %u\n",
+- i, hook_entries[i]);
+- goto out_unlock;
+- }
+- if (info->underflow[i] == 0xFFFFFFFF) {
+- duprintf("Invalid underflow %u %u\n",
+- i, underflows[i]);
+- goto out_unlock;
+- }
+- }
+-
+ ret = -ENOMEM;
+ newinfo = xt_alloc_table_info(size);
+ if (!newinfo)
+ goto out_unlock;
+
+- newinfo->number = number;
++ newinfo->number = compatr->num_entries;
+ for (i = 0; i < NF_INET_NUMHOOKS; i++) {
+- newinfo->hook_entry[i] = info->hook_entry[i];
+- newinfo->underflow[i] = info->underflow[i];
++ newinfo->hook_entry[i] = compatr->hook_entry[i];
++ newinfo->underflow[i] = compatr->underflow[i];
+ }
+ entry1 = newinfo->entries[raw_smp_processor_id()];
+ pos = entry1;
+- size = total_size;
+- xt_entry_foreach(iter0, entry0, total_size) {
+- ret = compat_copy_entry_from_user(iter0, &pos, &size,
+- name, newinfo, entry1);
+- if (ret != 0)
+- break;
+- }
++ size = compatr->size;
++ xt_entry_foreach(iter0, entry0, compatr->size)
++ compat_copy_entry_from_user(iter0, &pos, &size,
++ newinfo, entry1);
++
++ /* all module references in entry0 are now gone. */
+ xt_compat_flush_offsets(AF_INET6);
+ xt_compat_unlock(AF_INET6);
+- if (ret)
+- goto free_newinfo;
+
+- ret = -ELOOP;
+- if (!mark_source_chains(newinfo, valid_hooks, entry1))
+- goto free_newinfo;
++ memcpy(&repl, compatr, sizeof(*compatr));
+
+- i = 0;
+- xt_entry_foreach(iter1, entry1, newinfo->size) {
+- ret = compat_check_entry(iter1, net, name);
+- if (ret != 0)
+- break;
+- ++i;
+- if (strcmp(ip6t_get_target(iter1)->u.user.name,
+- XT_ERROR_TARGET) == 0)
+- ++newinfo->stacksize;
+- }
+- if (ret) {
+- /*
+- * The first i matches need cleanup_entry (calls ->destroy)
+- * because they had called ->check already. The other j-i
+- * entries need only release.
+- */
+- int skip = i;
+- j -= i;
+- xt_entry_foreach(iter0, entry0, newinfo->size) {
+- if (skip-- > 0)
+- continue;
+- if (j-- == 0)
+- break;
+- compat_release_entry(iter0);
+- }
+- xt_entry_foreach(iter1, entry1, newinfo->size) {
+- if (i-- == 0)
+- break;
+- cleanup_entry(iter1, net);
+- }
+- xt_free_table_info(newinfo);
+- return ret;
++ for (i = 0; i < NF_INET_NUMHOOKS; i++) {
++ repl.hook_entry[i] = newinfo->hook_entry[i];
++ repl.underflow[i] = newinfo->underflow[i];
+ }
+
+- /* And one copy for every other CPU */
+- for_each_possible_cpu(i)
+- if (newinfo->entries[i] && newinfo->entries[i] != entry1)
+- memcpy(newinfo->entries[i], entry1, newinfo->size);
++ repl.num_counters = 0;
++ repl.counters = NULL;
++ repl.size = newinfo->size;
++ ret = translate_table(net, newinfo, entry1, &repl);
++ if (ret)
++ goto free_newinfo;
+
+ *pinfo = newinfo;
+ *pentry0 = entry1;
+@@ -1790,17 +1642,16 @@ translate_compat_table(struct net *net,
+
+ free_newinfo:
+ xt_free_table_info(newinfo);
+-out:
+- xt_entry_foreach(iter0, entry0, total_size) {
++ return ret;
++out_unlock:
++ xt_compat_flush_offsets(AF_INET6);
++ xt_compat_unlock(AF_INET6);
++ xt_entry_foreach(iter0, entry0, compatr->size) {
+ if (j-- == 0)
+ break;
+ compat_release_entry(iter0);
+ }
+ return ret;
+-out_unlock:
+- xt_compat_flush_offsets(AF_INET6);
+- xt_compat_unlock(AF_INET6);
+- goto out;
+ }
+
+ static int
+@@ -1834,10 +1685,7 @@ compat_do_replace(struct net *net, void __user *user, unsigned int len)
+ goto free_newinfo;
+ }
+
+- ret = translate_compat_table(net, tmp.name, tmp.valid_hooks,
+- &newinfo, &loc_cpu_entry, tmp.size,
+- tmp.num_entries, tmp.hook_entry,
+- tmp.underflow);
++ ret = translate_compat_table(net, &newinfo, &loc_cpu_entry, &tmp);
+ if (ret != 0)
+ goto free_newinfo;
+
+diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
+index 78d180615495..b8e14a5ae0b1 100644
+--- a/net/ipv6/tcp_ipv6.c
++++ b/net/ipv6/tcp_ipv6.c
+@@ -1749,7 +1749,9 @@ static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
+ destp = ntohs(inet->inet_dport);
+ srcp = ntohs(inet->inet_sport);
+
+- if (icsk->icsk_pending == ICSK_TIME_RETRANS) {
++ if (icsk->icsk_pending == ICSK_TIME_RETRANS ||
++ icsk->icsk_pending == ICSK_TIME_EARLY_RETRANS ||
++ icsk->icsk_pending == ICSK_TIME_LOSS_PROBE) {
+ timer_active = 1;
+ timer_expires = icsk->icsk_timeout;
+ } else if (icsk->icsk_pending == ICSK_TIME_PROBE0) {
+diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
+index a5ce70502699..7d0111696190 100644
+--- a/net/ipv6/udp.c
++++ b/net/ipv6/udp.c
+@@ -898,11 +898,9 @@ int __udp6_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
+ ret = udpv6_queue_rcv_skb(sk, skb);
+ sock_put(sk);
+
+- /* a return value > 0 means to resubmit the input, but
+- * it wants the return to be -protocol, or 0
+- */
++ /* a return value > 0 means to resubmit the input */
+ if (ret > 0)
+- return -ret;
++ return ret;
+
+ return 0;
+ }
+diff --git a/net/l2tp/l2tp_ip.c b/net/l2tp/l2tp_ip.c
+index 369a9822488c..e45d2b77bb42 100644
+--- a/net/l2tp/l2tp_ip.c
++++ b/net/l2tp/l2tp_ip.c
+@@ -123,12 +123,11 @@ static int l2tp_ip_recv(struct sk_buff *skb)
+ struct l2tp_tunnel *tunnel = NULL;
+ int length;
+
+- /* Point to L2TP header */
+- optr = ptr = skb->data;
+-
+ if (!pskb_may_pull(skb, 4))
+ goto discard;
+
++ /* Point to L2TP header */
++ optr = ptr = skb->data;
+ session_id = ntohl(*((__be32 *) ptr));
+ ptr += 4;
+
+@@ -156,6 +155,9 @@ static int l2tp_ip_recv(struct sk_buff *skb)
+ if (!pskb_may_pull(skb, length))
+ goto discard;
+
++ /* Point to L2TP header */
++ optr = ptr = skb->data;
++ ptr += 4;
+ pr_debug("%s: ip recv\n", tunnel->name);
+ print_hex_dump_bytes("", DUMP_PREFIX_OFFSET, ptr, length);
+ }
+diff --git a/net/l2tp/l2tp_ip6.c b/net/l2tp/l2tp_ip6.c
+index 38658826175c..b8e469b832df 100644
+--- a/net/l2tp/l2tp_ip6.c
++++ b/net/l2tp/l2tp_ip6.c
+@@ -135,12 +135,11 @@ static int l2tp_ip6_recv(struct sk_buff *skb)
+ struct l2tp_tunnel *tunnel = NULL;
+ int length;
+
+- /* Point to L2TP header */
+- optr = ptr = skb->data;
+-
+ if (!pskb_may_pull(skb, 4))
+ goto discard;
+
++ /* Point to L2TP header */
++ optr = ptr = skb->data;
+ session_id = ntohl(*((__be32 *) ptr));
+ ptr += 4;
+
+@@ -168,6 +167,9 @@ static int l2tp_ip6_recv(struct sk_buff *skb)
+ if (!pskb_may_pull(skb, length))
+ goto discard;
+
++ /* Point to L2TP header */
++ optr = ptr = skb->data;
++ ptr += 4;
+ pr_debug("%s: ip recv\n", tunnel->name);
+ print_hex_dump_bytes("", DUMP_PREFIX_OFFSET, ptr, length);
+ }
+diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c
+index bb9cbc17d926..3e8691895385 100644
+--- a/net/llc/af_llc.c
++++ b/net/llc/af_llc.c
+@@ -626,6 +626,7 @@ static void llc_cmsg_rcv(struct msghdr *msg, struct sk_buff *skb)
+ if (llc->cmsg_flags & LLC_CMSG_PKTINFO) {
+ struct llc_pktinfo info;
+
++ memset(&info, 0, sizeof(info));
+ info.lpi_ifindex = llc_sk(skb->sk)->dev->ifindex;
+ llc_pdu_decode_dsap(skb, &info.lpi_sap);
+ llc_pdu_decode_da(skb, info.lpi_mac);
+diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
+index 074cdfa04cc4..c848d0b38c86 100644
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -2090,7 +2090,7 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
+ struct ieee80211_sub_if_data *sdata = rx->sdata;
+ struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
+ struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
+- u16 q, hdrlen;
++ u16 ac, q, hdrlen;
+
+ hdr = (struct ieee80211_hdr *) skb->data;
+ hdrlen = ieee80211_hdrlen(hdr->frame_control);
+@@ -2160,7 +2160,8 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
+ ether_addr_equal(sdata->vif.addr, hdr->addr3))
+ return RX_CONTINUE;
+
+- q = ieee80211_select_queue_80211(sdata, skb, hdr);
++ ac = ieee80211_select_queue_80211(sdata, skb, hdr);
++ q = sdata->vif.hw_queue[ac];
+ if (ieee80211_queue_stopped(&local->hw, q)) {
+ IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_congestion);
+ return RX_DROP_MONITOR;
+diff --git a/net/netfilter/ipvs/ip_vs_pe_sip.c b/net/netfilter/ipvs/ip_vs_pe_sip.c
+index bed5f7042529..bb318e4623a3 100644
+--- a/net/netfilter/ipvs/ip_vs_pe_sip.c
++++ b/net/netfilter/ipvs/ip_vs_pe_sip.c
+@@ -88,7 +88,7 @@ ip_vs_sip_fill_param(struct ip_vs_conn_param *p, struct sk_buff *skb)
+ dptr = skb->data + dataoff;
+ datalen = skb->len - dataoff;
+
+- if (get_callid(dptr, dataoff, datalen, &matchoff, &matchlen))
++ if (get_callid(dptr, 0, datalen, &matchoff, &matchlen))
+ return -EINVAL;
+
+ /* N.B: pe_data is only set on success,
+diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c
+index 133eb4772f12..0c01ad4e078f 100644
+--- a/net/netfilter/x_tables.c
++++ b/net/netfilter/x_tables.c
+@@ -418,6 +418,47 @@ int xt_check_match(struct xt_mtchk_param *par,
+ }
+ EXPORT_SYMBOL_GPL(xt_check_match);
+
++/** xt_check_entry_match - check that matches end before start of target
++ *
++ * @match: beginning of xt_entry_match
++ * @target: beginning of this rules target (alleged end of matches)
++ * @alignment: alignment requirement of match structures
++ *
++ * Validates that all matches add up to the beginning of the target,
++ * and that each match covers at least the base structure size.
++ *
++ * Return: 0 on success, negative errno on failure.
++ */
++static int xt_check_entry_match(const char *match, const char *target,
++ const size_t alignment)
++{
++ const struct xt_entry_match *pos;
++ int length = target - match;
++
++ if (length == 0) /* no matches */
++ return 0;
++
++ pos = (struct xt_entry_match *)match;
++ do {
++ if ((unsigned long)pos % alignment)
++ return -EINVAL;
++
++ if (length < (int)sizeof(struct xt_entry_match))
++ return -EINVAL;
++
++ if (pos->u.match_size < sizeof(struct xt_entry_match))
++ return -EINVAL;
++
++ if (pos->u.match_size > length)
++ return -EINVAL;
++
++ length -= pos->u.match_size;
++ pos = ((void *)((char *)(pos) + (pos)->u.match_size));
++ } while (length > 0);
++
++ return 0;
++}
++
+ #ifdef CONFIG_COMPAT
+ int xt_compat_add_offset(u_int8_t af, unsigned int offset, int delta)
+ {
+@@ -487,13 +528,14 @@ int xt_compat_match_offset(const struct xt_match *match)
+ }
+ EXPORT_SYMBOL_GPL(xt_compat_match_offset);
+
+-int xt_compat_match_from_user(struct xt_entry_match *m, void **dstptr,
+- unsigned int *size)
++void xt_compat_match_from_user(struct xt_entry_match *m, void **dstptr,
++ unsigned int *size)
+ {
+ const struct xt_match *match = m->u.kernel.match;
+ struct compat_xt_entry_match *cm = (struct compat_xt_entry_match *)m;
+ int pad, off = xt_compat_match_offset(match);
+ u_int16_t msize = cm->u.user.match_size;
++ char name[sizeof(m->u.user.name)];
+
+ m = *dstptr;
+ memcpy(m, cm, sizeof(*cm));
+@@ -507,10 +549,12 @@ int xt_compat_match_from_user(struct xt_entry_match *m, void **dstptr,
+
+ msize += off;
+ m->u.user.match_size = msize;
++ strlcpy(name, match->name, sizeof(name));
++ module_put(match->me);
++ strncpy(m->u.user.name, name, sizeof(m->u.user.name));
+
+ *size += off;
+ *dstptr += msize;
+- return 0;
+ }
+ EXPORT_SYMBOL_GPL(xt_compat_match_from_user);
+
+@@ -541,8 +585,125 @@ int xt_compat_match_to_user(const struct xt_entry_match *m,
+ return 0;
+ }
+ EXPORT_SYMBOL_GPL(xt_compat_match_to_user);
++
++/* non-compat version may have padding after verdict */
++struct compat_xt_standard_target {
++ struct compat_xt_entry_target t;
++ compat_uint_t verdict;
++};
++
++int xt_compat_check_entry_offsets(const void *base, const char *elems,
++ unsigned int target_offset,
++ unsigned int next_offset)
++{
++ long size_of_base_struct = elems - (const char *)base;
++ const struct compat_xt_entry_target *t;
++ const char *e = base;
++
++ if (target_offset < size_of_base_struct)
++ return -EINVAL;
++
++ if (target_offset + sizeof(*t) > next_offset)
++ return -EINVAL;
++
++ t = (void *)(e + target_offset);
++ if (t->u.target_size < sizeof(*t))
++ return -EINVAL;
++
++ if (target_offset + t->u.target_size > next_offset)
++ return -EINVAL;
++
++ if (strcmp(t->u.user.name, XT_STANDARD_TARGET) == 0 &&
++ COMPAT_XT_ALIGN(target_offset + sizeof(struct compat_xt_standard_target)) != next_offset)
++ return -EINVAL;
++
++ /* compat_xt_entry match has less strict aligment requirements,
++ * otherwise they are identical. In case of padding differences
++ * we need to add compat version of xt_check_entry_match.
++ */
++ BUILD_BUG_ON(sizeof(struct compat_xt_entry_match) != sizeof(struct xt_entry_match));
++
++ return xt_check_entry_match(elems, base + target_offset,
++ __alignof__(struct compat_xt_entry_match));
++}
++EXPORT_SYMBOL(xt_compat_check_entry_offsets);
+ #endif /* CONFIG_COMPAT */
+
++/**
++ * xt_check_entry_offsets - validate arp/ip/ip6t_entry
++ *
++ * @base: pointer to arp/ip/ip6t_entry
++ * @elems: pointer to first xt_entry_match, i.e. ip(6)t_entry->elems
++ * @target_offset: the arp/ip/ip6_t->target_offset
++ * @next_offset: the arp/ip/ip6_t->next_offset
++ *
++ * validates that target_offset and next_offset are sane and that all
++ * match sizes (if any) align with the target offset.
++ *
++ * This function does not validate the targets or matches themselves, it
++ * only tests that all the offsets and sizes are correct, that all
++ * match structures are aligned, and that the last structure ends where
++ * the target structure begins.
++ *
++ * Also see xt_compat_check_entry_offsets for CONFIG_COMPAT version.
++ *
++ * The arp/ip/ip6t_entry structure @base must have passed following tests:
++ * - it must point to a valid memory location
++ * - base to base + next_offset must be accessible, i.e. not exceed allocated
++ * length.
++ *
++ * A well-formed entry looks like this:
++ *
++ * ip(6)t_entry match [mtdata] match [mtdata] target [tgdata] ip(6)t_entry
++ * e->elems[]-----' | |
++ * matchsize | |
++ * matchsize | |
++ * | |
++ * target_offset---------------------------------' |
++ * next_offset---------------------------------------------------'
++ *
++ * elems[]: flexible array member at end of ip(6)/arpt_entry struct.
++ * This is where matches (if any) and the target reside.
++ * target_offset: beginning of target.
++ * next_offset: start of the next rule; also: size of this rule.
++ * Since targets have a minimum size, target_offset + minlen <= next_offset.
++ *
++ * Every match stores its size, sum of sizes must not exceed target_offset.
++ *
++ * Return: 0 on success, negative errno on failure.
++ */
++int xt_check_entry_offsets(const void *base,
++ const char *elems,
++ unsigned int target_offset,
++ unsigned int next_offset)
++{
++ long size_of_base_struct = elems - (const char *)base;
++ const struct xt_entry_target *t;
++ const char *e = base;
++
++ /* target start is within the ip/ip6/arpt_entry struct */
++ if (target_offset < size_of_base_struct)
++ return -EINVAL;
++
++ if (target_offset + sizeof(*t) > next_offset)
++ return -EINVAL;
++
++ t = (void *)(e + target_offset);
++ if (t->u.target_size < sizeof(*t))
++ return -EINVAL;
++
++ if (target_offset + t->u.target_size > next_offset)
++ return -EINVAL;
++
++ if (strcmp(t->u.user.name, XT_STANDARD_TARGET) == 0 &&
++ XT_ALIGN(target_offset + sizeof(struct xt_standard_target)) != next_offset)
++ return -EINVAL;
++
++ return xt_check_entry_match(elems, base + target_offset,
++ __alignof__(struct xt_entry_match));
++}
++EXPORT_SYMBOL(xt_check_entry_offsets);
++
+ int xt_check_target(struct xt_tgchk_param *par,
+ unsigned int size, u_int8_t proto, bool inv_proto)
+ {
+@@ -593,6 +754,80 @@ int xt_check_target(struct xt_tgchk_param *par,
+ }
+ EXPORT_SYMBOL_GPL(xt_check_target);
+
++/**
++ * xt_copy_counters_from_user - copy counters and metadata from userspace
++ *
++ * @user: src pointer to userspace memory
++ * @len: alleged size of userspace memory
++ * @info: where to store the xt_counters_info metadata
++ * @compat: true if we setsockopt call is done by 32bit task on 64bit kernel
++ *
++ * Copies counter meta data from @user and stores it in @info.
++ *
++ * vmallocs memory to hold the counters, then copies the counter data
++ * from @user to the new memory and returns a pointer to it.
++ *
++ * If @compat is true, @info gets converted automatically to the 64bit
++ * representation.
++ *
++ * The metadata associated with the counters is stored in @info.
++ *
++ * Return: returns pointer that caller has to test via IS_ERR().
++ * If IS_ERR is false, caller has to vfree the pointer.
++ */
++void *xt_copy_counters_from_user(const void __user *user, unsigned int len,
++ struct xt_counters_info *info, bool compat)
++{
++ void *mem;
++ u64 size;
++
++#ifdef CONFIG_COMPAT
++ if (compat) {
++ /* structures only differ in size due to alignment */
++ struct compat_xt_counters_info compat_tmp;
++
++ if (len <= sizeof(compat_tmp))
++ return ERR_PTR(-EINVAL);
++
++ len -= sizeof(compat_tmp);
++ if (copy_from_user(&compat_tmp, user, sizeof(compat_tmp)) != 0)
++ return ERR_PTR(-EFAULT);
++
++ strlcpy(info->name, compat_tmp.name, sizeof(info->name));
++ info->num_counters = compat_tmp.num_counters;
++ user += sizeof(compat_tmp);
++ } else
++#endif
++ {
++ if (len <= sizeof(*info))
++ return ERR_PTR(-EINVAL);
++
++ len -= sizeof(*info);
++ if (copy_from_user(info, user, sizeof(*info)) != 0)
++ return ERR_PTR(-EFAULT);
++
++ info->name[sizeof(info->name) - 1] = '\0';
++ user += sizeof(*info);
++ }
++
++ size = sizeof(struct xt_counters);
++ size *= info->num_counters;
++
++ if (size != (u64)len)
++ return ERR_PTR(-EINVAL);
++
++ mem = vmalloc(len);
++ if (!mem)
++ return ERR_PTR(-ENOMEM);
++
++ if (copy_from_user(mem, user, len) == 0)
++ return mem;
++
++ vfree(mem);
++ return ERR_PTR(-EFAULT);
++}
++EXPORT_SYMBOL_GPL(xt_copy_counters_from_user);
++
+ #ifdef CONFIG_COMPAT
+ int xt_compat_target_offset(const struct xt_target *target)
+ {
+@@ -608,6 +843,7 @@ void xt_compat_target_from_user(struct xt_entry_target *t, void **dstptr,
+ struct compat_xt_entry_target *ct = (struct compat_xt_entry_target *)t;
+ int pad, off = xt_compat_target_offset(target);
+ u_int16_t tsize = ct->u.user.target_size;
++ char name[sizeof(t->u.user.name)];
+
+ t = *dstptr;
+ memcpy(t, ct, sizeof(*ct));
+@@ -621,6 +857,9 @@ void xt_compat_target_from_user(struct xt_entry_target *t, void **dstptr,
+
+ tsize += off;
+ t->u.user.target_size = tsize;
++ strlcpy(name, target->name, sizeof(name));
++ module_put(target->me);
++ strncpy(t->u.user.name, name, sizeof(t->u.user.name));
+
+ *size += off;
+ *dstptr += tsize;
+diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
+index fe106b50053e..15fc0938e1c4 100644
+--- a/net/netlink/af_netlink.c
++++ b/net/netlink/af_netlink.c
+@@ -2630,6 +2630,7 @@ static int netlink_dump(struct sock *sk)
+ struct netlink_callback *cb;
+ struct sk_buff *skb = NULL;
+ struct nlmsghdr *nlh;
++ struct module *module;
+ int len, err = -ENOBUFS;
+ int alloc_size;
+
+@@ -2699,9 +2700,11 @@ static int netlink_dump(struct sock *sk)
+ cb->done(cb);
+
+ nlk->cb_running = false;
++ module = cb->module;
++ skb = cb->skb;
+ mutex_unlock(nlk->cb_mutex);
+- module_put(cb->module);
+- consume_skb(cb->skb);
++ module_put(module);
++ consume_skb(skb);
+ return 0;
+
+ errout_skb:
+diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
+index 22853af1b6b7..e73b3fb1a144 100644
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -3143,6 +3143,7 @@ static int packet_mc_add(struct sock *sk, struct packet_mreq_max *mreq)
+ i->ifindex = mreq->mr_ifindex;
+ i->alen = mreq->mr_alen;
+ memcpy(i->addr, mreq->mr_address, i->alen);
++ memset(i->addr + i->alen, 0, sizeof(i->addr) - i->alen);
+ i->count = 1;
+ i->next = po->mclist;
+ po->mclist = i;
+diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c
+index a25fae3c8ad6..a2a7a81b2b0b 100644
+--- a/net/sched/sch_api.c
++++ b/net/sched/sch_api.c
+@@ -740,14 +740,15 @@ static u32 qdisc_alloc_handle(struct net_device *dev)
+ return 0;
+ }
+
+-void qdisc_tree_decrease_qlen(struct Qdisc *sch, unsigned int n)
++void qdisc_tree_reduce_backlog(struct Qdisc *sch, unsigned int n,
++ unsigned int len)
+ {
+ const struct Qdisc_class_ops *cops;
+ unsigned long cl;
+ u32 parentid;
+ int drops;
+
+- if (n == 0)
++ if (n == 0 && len == 0)
+ return;
+ drops = max_t(int, n, 0);
+ while ((parentid = sch->parent)) {
+@@ -766,10 +767,11 @@ void qdisc_tree_decrease_qlen(struct Qdisc *sch, unsigned int n)
+ cops->put(sch, cl);
+ }
+ sch->q.qlen -= n;
++ sch->qstats.backlog -= len;
+ __qdisc_qstats_drop(sch, drops);
+ }
+ }
+-EXPORT_SYMBOL(qdisc_tree_decrease_qlen);
++EXPORT_SYMBOL(qdisc_tree_reduce_backlog);
+
+ static void notify_and_destroy(struct net *net, struct sk_buff *skb,
+ struct nlmsghdr *n, u32 clid,
+diff --git a/net/sched/sch_cbq.c b/net/sched/sch_cbq.c
+index beeb75f80fdb..f6e7a60012b1 100644
+--- a/net/sched/sch_cbq.c
++++ b/net/sched/sch_cbq.c
+@@ -1624,13 +1624,8 @@ static int cbq_graft(struct Qdisc *sch, unsigned long arg, struct Qdisc *new,
+ new->reshape_fail = cbq_reshape_fail;
+ #endif
+ }
+- sch_tree_lock(sch);
+- *old = cl->q;
+- cl->q = new;
+- qdisc_tree_decrease_qlen(*old, (*old)->q.qlen);
+- qdisc_reset(*old);
+- sch_tree_unlock(sch);
+
++ *old = qdisc_replace(sch, new, &cl->q);
+ return 0;
+ }
+
+@@ -1914,7 +1909,7 @@ static int cbq_delete(struct Qdisc *sch, unsigned long arg)
+ {
+ struct cbq_sched_data *q = qdisc_priv(sch);
+ struct cbq_class *cl = (struct cbq_class *)arg;
+- unsigned int qlen;
++ unsigned int qlen, backlog;
+
+ if (cl->filters || cl->children || cl == &q->link)
+ return -EBUSY;
+@@ -1922,8 +1917,9 @@ static int cbq_delete(struct Qdisc *sch, unsigned long arg)
+ sch_tree_lock(sch);
+
+ qlen = cl->q->q.qlen;
++ backlog = cl->q->qstats.backlog;
+ qdisc_reset(cl->q);
+- qdisc_tree_decrease_qlen(cl->q, qlen);
++ qdisc_tree_reduce_backlog(cl->q, qlen, backlog);
+
+ if (cl->next_alive)
+ cbq_deactivate_class(cl);
+diff --git a/net/sched/sch_choke.c b/net/sched/sch_choke.c
+index c009eb9045ce..3f6437db9b0f 100644
+--- a/net/sched/sch_choke.c
++++ b/net/sched/sch_choke.c
+@@ -128,8 +128,8 @@ static void choke_drop_by_idx(struct Qdisc *sch, unsigned int idx)
+ choke_zap_tail_holes(q);
+
+ qdisc_qstats_backlog_dec(sch, skb);
++ qdisc_tree_reduce_backlog(sch, 1, qdisc_pkt_len(skb));
+ qdisc_drop(skb, sch);
+- qdisc_tree_decrease_qlen(sch, 1);
+ --sch->q.qlen;
+ }
+
+@@ -449,6 +449,7 @@ static int choke_change(struct Qdisc *sch, struct nlattr *opt)
+ old = q->tab;
+ if (old) {
+ unsigned int oqlen = sch->q.qlen, tail = 0;
++ unsigned dropped = 0;
+
+ while (q->head != q->tail) {
+ struct sk_buff *skb = q->tab[q->head];
+@@ -460,11 +461,12 @@ static int choke_change(struct Qdisc *sch, struct nlattr *opt)
+ ntab[tail++] = skb;
+ continue;
+ }
++ dropped += qdisc_pkt_len(skb);
+ qdisc_qstats_backlog_dec(sch, skb);
+ --sch->q.qlen;
+ qdisc_drop(skb, sch);
+ }
+- qdisc_tree_decrease_qlen(sch, oqlen - sch->q.qlen);
++ qdisc_tree_reduce_backlog(sch, oqlen - sch->q.qlen, dropped);
+ q->head = 0;
+ q->tail = tail;
+ }
+diff --git a/net/sched/sch_codel.c b/net/sched/sch_codel.c
+index de28f8e968e8..0d60ea5a5bb6 100644
+--- a/net/sched/sch_codel.c
++++ b/net/sched/sch_codel.c
+@@ -79,12 +79,13 @@ static struct sk_buff *codel_qdisc_dequeue(struct Qdisc *sch)
+
+ skb = codel_dequeue(sch, &q->params, &q->vars, &q->stats, dequeue);
+
+- /* We cant call qdisc_tree_decrease_qlen() if our qlen is 0,
++ /* We cant call qdisc_tree_reduce_backlog() if our qlen is 0,
+ * or HTB crashes. Defer it for next round.
+ */
+ if (q->stats.drop_count && sch->q.qlen) {
+- qdisc_tree_decrease_qlen(sch, q->stats.drop_count);
++ qdisc_tree_reduce_backlog(sch, q->stats.drop_count, q->stats.drop_len);
+ q->stats.drop_count = 0;
++ q->stats.drop_len = 0;
+ }
+ if (skb)
+ qdisc_bstats_update(sch, skb);
+@@ -115,7 +116,7 @@ static int codel_change(struct Qdisc *sch, struct nlattr *opt)
+ {
+ struct codel_sched_data *q = qdisc_priv(sch);
+ struct nlattr *tb[TCA_CODEL_MAX + 1];
+- unsigned int qlen;
++ unsigned int qlen, dropped = 0;
+ int err;
+
+ if (!opt)
+@@ -149,10 +150,11 @@ static int codel_change(struct Qdisc *sch, struct nlattr *opt)
+ while (sch->q.qlen > sch->limit) {
+ struct sk_buff *skb = __skb_dequeue(&sch->q);
+
++ dropped += qdisc_pkt_len(skb);
+ qdisc_qstats_backlog_dec(sch, skb);
+ qdisc_drop(skb, sch);
+ }
+- qdisc_tree_decrease_qlen(sch, qlen - sch->q.qlen);
++ qdisc_tree_reduce_backlog(sch, qlen - sch->q.qlen, dropped);
+
+ sch_tree_unlock(sch);
+ return 0;
+diff --git a/net/sched/sch_drr.c b/net/sched/sch_drr.c
+index 338706092c27..e599803caa1e 100644
+--- a/net/sched/sch_drr.c
++++ b/net/sched/sch_drr.c
+@@ -53,9 +53,10 @@ static struct drr_class *drr_find_class(struct Qdisc *sch, u32 classid)
+ static void drr_purge_queue(struct drr_class *cl)
+ {
+ unsigned int len = cl->qdisc->q.qlen;
++ unsigned int backlog = cl->qdisc->qstats.backlog;
+
+ qdisc_reset(cl->qdisc);
+- qdisc_tree_decrease_qlen(cl->qdisc, len);
++ qdisc_tree_reduce_backlog(cl->qdisc, len, backlog);
+ }
+
+ static const struct nla_policy drr_policy[TCA_DRR_MAX + 1] = {
+@@ -226,11 +227,7 @@ static int drr_graft_class(struct Qdisc *sch, unsigned long arg,
+ new = &noop_qdisc;
+ }
+
+- sch_tree_lock(sch);
+- drr_purge_queue(cl);
+- *old = cl->qdisc;
+- cl->qdisc = new;
+- sch_tree_unlock(sch);
++ *old = qdisc_replace(sch, new, &cl->qdisc);
+ return 0;
+ }
+
+diff --git a/net/sched/sch_dsmark.c b/net/sched/sch_dsmark.c
+index 227114f27f94..eb87a2a94d19 100644
+--- a/net/sched/sch_dsmark.c
++++ b/net/sched/sch_dsmark.c
+@@ -67,13 +67,7 @@ static int dsmark_graft(struct Qdisc *sch, unsigned long arg,
+ new = &noop_qdisc;
+ }
+
+- sch_tree_lock(sch);
+- *old = p->q;
+- p->q = new;
+- qdisc_tree_decrease_qlen(*old, (*old)->q.qlen);
+- qdisc_reset(*old);
+- sch_tree_unlock(sch);
+-
++ *old = qdisc_replace(sch, new, &p->q);
+ return 0;
+ }
+
+@@ -262,6 +256,7 @@ static int dsmark_enqueue(struct sk_buff *skb, struct Qdisc *sch)
+ return err;
+ }
+
++ qdisc_qstats_backlog_inc(sch, skb);
+ sch->q.qlen++;
+
+ return NET_XMIT_SUCCESS;
+@@ -284,6 +279,7 @@ static struct sk_buff *dsmark_dequeue(struct Qdisc *sch)
+ return NULL;
+
+ qdisc_bstats_update(sch, skb);
++ qdisc_qstats_backlog_dec(sch, skb);
+ sch->q.qlen--;
+
+ index = skb->tc_index & (p->indices - 1);
+@@ -399,6 +395,7 @@ static void dsmark_reset(struct Qdisc *sch)
+
+ pr_debug("%s(sch %p,[qdisc %p])\n", __func__, sch, p);
+ qdisc_reset(p->q);
++ sch->qstats.backlog = 0;
+ sch->q.qlen = 0;
+ }
+
+diff --git a/net/sched/sch_fq.c b/net/sched/sch_fq.c
+index cbd7e1fd23b4..01fe9d532075 100644
+--- a/net/sched/sch_fq.c
++++ b/net/sched/sch_fq.c
+@@ -644,6 +644,7 @@ static int fq_change(struct Qdisc *sch, struct nlattr *opt)
+ struct fq_sched_data *q = qdisc_priv(sch);
+ struct nlattr *tb[TCA_FQ_MAX + 1];
+ int err, drop_count = 0;
++ unsigned drop_len = 0;
+ u32 fq_log;
+
+ if (!opt)
+@@ -709,10 +710,11 @@ static int fq_change(struct Qdisc *sch, struct nlattr *opt)
+
+ if (!skb)
+ break;
++ drop_len += qdisc_pkt_len(skb);
+ kfree_skb(skb);
+ drop_count++;
+ }
+- qdisc_tree_decrease_qlen(sch, drop_count);
++ qdisc_tree_reduce_backlog(sch, drop_count, drop_len);
+
+ sch_tree_unlock(sch);
+ return err;
+diff --git a/net/sched/sch_fq_codel.c b/net/sched/sch_fq_codel.c
+index 1e52decb7b59..8d21f1b5d5b9 100644
+--- a/net/sched/sch_fq_codel.c
++++ b/net/sched/sch_fq_codel.c
+@@ -173,7 +173,7 @@ static unsigned int fq_codel_drop(struct Qdisc *sch)
+ static int fq_codel_enqueue(struct sk_buff *skb, struct Qdisc *sch)
+ {
+ struct fq_codel_sched_data *q = qdisc_priv(sch);
+- unsigned int idx;
++ unsigned int idx, prev_backlog;
+ struct fq_codel_flow *flow;
+ int uninitialized_var(ret);
+
+@@ -201,6 +201,7 @@ static int fq_codel_enqueue(struct sk_buff *skb, struct Qdisc *sch)
+ if (++sch->q.qlen <= sch->limit)
+ return NET_XMIT_SUCCESS;
+
++ prev_backlog = sch->qstats.backlog;
+ q->drop_overlimit++;
+ /* Return Congestion Notification only if we dropped a packet
+ * from this flow.
+@@ -209,7 +210,7 @@ static int fq_codel_enqueue(struct sk_buff *skb, struct Qdisc *sch)
+ return NET_XMIT_CN;
+
+ /* As we dropped a packet, better let upper stack know this */
+- qdisc_tree_decrease_qlen(sch, 1);
++ qdisc_tree_reduce_backlog(sch, 1, prev_backlog - sch->qstats.backlog);
+ return NET_XMIT_SUCCESS;
+ }
+
+@@ -239,6 +240,7 @@ static struct sk_buff *fq_codel_dequeue(struct Qdisc *sch)
+ struct fq_codel_flow *flow;
+ struct list_head *head;
+ u32 prev_drop_count, prev_ecn_mark;
++ unsigned int prev_backlog;
+
+ begin:
+ head = &q->new_flows;
+@@ -257,6 +259,7 @@ begin:
+
+ prev_drop_count = q->cstats.drop_count;
+ prev_ecn_mark = q->cstats.ecn_mark;
++ prev_backlog = sch->qstats.backlog;
+
+ skb = codel_dequeue(sch, &q->cparams, &flow->cvars, &q->cstats,
+ dequeue);
+@@ -274,12 +277,14 @@ begin:
+ }
+ qdisc_bstats_update(sch, skb);
+ flow->deficit -= qdisc_pkt_len(skb);
+- /* We cant call qdisc_tree_decrease_qlen() if our qlen is 0,
++ /* We cant call qdisc_tree_reduce_backlog() if our qlen is 0,
+ * or HTB crashes. Defer it for next round.
+ */
+ if (q->cstats.drop_count && sch->q.qlen) {
+- qdisc_tree_decrease_qlen(sch, q->cstats.drop_count);
++ qdisc_tree_reduce_backlog(sch, q->cstats.drop_count,
++ q->cstats.drop_len);
+ q->cstats.drop_count = 0;
++ q->cstats.drop_len = 0;
+ }
+ return skb;
+ }
+@@ -347,11 +352,13 @@ static int fq_codel_change(struct Qdisc *sch, struct nlattr *opt)
+ while (sch->q.qlen > sch->limit) {
+ struct sk_buff *skb = fq_codel_dequeue(sch);
+
++ q->cstats.drop_len += qdisc_pkt_len(skb);
+ kfree_skb(skb);
+ q->cstats.drop_count++;
+ }
+- qdisc_tree_decrease_qlen(sch, q->cstats.drop_count);
++ qdisc_tree_reduce_backlog(sch, q->cstats.drop_count, q->cstats.drop_len);
+ q->cstats.drop_count = 0;
++ q->cstats.drop_len = 0;
+
+ sch_tree_unlock(sch);
+ return 0;
+diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
+index 507edcf64088..49003540186c 100644
+--- a/net/sched/sch_generic.c
++++ b/net/sched/sch_generic.c
+@@ -159,12 +159,15 @@ int sch_direct_xmit(struct sk_buff *skb, struct Qdisc *q,
+ if (validate)
+ skb = validate_xmit_skb_list(skb, dev);
+
+- if (skb) {
++ if (likely(skb)) {
+ HARD_TX_LOCK(dev, txq, smp_processor_id());
+ if (!netif_xmit_frozen_or_stopped(txq))
+ skb = dev_hard_start_xmit(skb, dev, txq, &ret);
+
+ HARD_TX_UNLOCK(dev, txq);
++ } else {
++ spin_lock(root_lock);
++ return qdisc_qlen(q);
+ }
+ spin_lock(root_lock);
+
+diff --git a/net/sched/sch_hfsc.c b/net/sched/sch_hfsc.c
+index e6c7416d0332..d3e21dac8b40 100644
+--- a/net/sched/sch_hfsc.c
++++ b/net/sched/sch_hfsc.c
+@@ -895,9 +895,10 @@ static void
+ hfsc_purge_queue(struct Qdisc *sch, struct hfsc_class *cl)
+ {
+ unsigned int len = cl->qdisc->q.qlen;
++ unsigned int backlog = cl->qdisc->qstats.backlog;
+
+ qdisc_reset(cl->qdisc);
+- qdisc_tree_decrease_qlen(cl->qdisc, len);
++ qdisc_tree_reduce_backlog(cl->qdisc, len, backlog);
+ }
+
+ static void
+@@ -1215,11 +1216,7 @@ hfsc_graft_class(struct Qdisc *sch, unsigned long arg, struct Qdisc *new,
+ new = &noop_qdisc;
+ }
+
+- sch_tree_lock(sch);
+- hfsc_purge_queue(sch, cl);
+- *old = cl->qdisc;
+- cl->qdisc = new;
+- sch_tree_unlock(sch);
++ *old = qdisc_replace(sch, new, &cl->qdisc);
+ return 0;
+ }
+
+diff --git a/net/sched/sch_hhf.c b/net/sched/sch_hhf.c
+index 15d3aabfe250..792c6f330f77 100644
+--- a/net/sched/sch_hhf.c
++++ b/net/sched/sch_hhf.c
+@@ -390,6 +390,7 @@ static int hhf_enqueue(struct sk_buff *skb, struct Qdisc *sch)
+ struct hhf_sched_data *q = qdisc_priv(sch);
+ enum wdrr_bucket_idx idx;
+ struct wdrr_bucket *bucket;
++ unsigned int prev_backlog;
+
+ idx = hhf_classify(skb, sch);
+
+@@ -417,6 +418,7 @@ static int hhf_enqueue(struct sk_buff *skb, struct Qdisc *sch)
+ if (++sch->q.qlen <= sch->limit)
+ return NET_XMIT_SUCCESS;
+
++ prev_backlog = sch->qstats.backlog;
+ q->drop_overlimit++;
+ /* Return Congestion Notification only if we dropped a packet from this
+ * bucket.
+@@ -425,7 +427,7 @@ static int hhf_enqueue(struct sk_buff *skb, struct Qdisc *sch)
+ return NET_XMIT_CN;
+
+ /* As we dropped a packet, better let upper stack know this. */
+- qdisc_tree_decrease_qlen(sch, 1);
++ qdisc_tree_reduce_backlog(sch, 1, prev_backlog - sch->qstats.backlog);
+ return NET_XMIT_SUCCESS;
+ }
+
+@@ -535,7 +537,7 @@ static int hhf_change(struct Qdisc *sch, struct nlattr *opt)
+ {
+ struct hhf_sched_data *q = qdisc_priv(sch);
+ struct nlattr *tb[TCA_HHF_MAX + 1];
+- unsigned int qlen;
++ unsigned int qlen, prev_backlog;
+ int err;
+ u64 non_hh_quantum;
+ u32 new_quantum = q->quantum;
+@@ -585,12 +587,14 @@ static int hhf_change(struct Qdisc *sch, struct nlattr *opt)
+ }
+
+ qlen = sch->q.qlen;
++ prev_backlog = sch->qstats.backlog;
+ while (sch->q.qlen > sch->limit) {
+ struct sk_buff *skb = hhf_dequeue(sch);
+
+ kfree_skb(skb);
+ }
+- qdisc_tree_decrease_qlen(sch, qlen - sch->q.qlen);
++ qdisc_tree_reduce_backlog(sch, qlen - sch->q.qlen,
++ prev_backlog - sch->qstats.backlog);
+
+ sch_tree_unlock(sch);
+ return 0;
+diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c
+index f1acb0f60dc3..ccff00640713 100644
+--- a/net/sched/sch_htb.c
++++ b/net/sched/sch_htb.c
+@@ -600,6 +600,7 @@ static int htb_enqueue(struct sk_buff *skb, struct Qdisc *sch)
+ htb_activate(q, cl);
+ }
+
++ qdisc_qstats_backlog_inc(sch, skb);
+ sch->q.qlen++;
+ return NET_XMIT_SUCCESS;
+ }
+@@ -889,6 +890,7 @@ static struct sk_buff *htb_dequeue(struct Qdisc *sch)
+ ok:
+ qdisc_bstats_update(sch, skb);
+ qdisc_unthrottled(sch);
++ qdisc_qstats_backlog_dec(sch, skb);
+ sch->q.qlen--;
+ return skb;
+ }
+@@ -955,6 +957,7 @@ static unsigned int htb_drop(struct Qdisc *sch)
+ unsigned int len;
+ if (cl->un.leaf.q->ops->drop &&
+ (len = cl->un.leaf.q->ops->drop(cl->un.leaf.q))) {
++ sch->qstats.backlog -= len;
+ sch->q.qlen--;
+ if (!cl->un.leaf.q->q.qlen)
+ htb_deactivate(q, cl);
+@@ -984,12 +987,12 @@ static void htb_reset(struct Qdisc *sch)
+ }
+ cl->prio_activity = 0;
+ cl->cmode = HTB_CAN_SEND;
+-
+ }
+ }
+ qdisc_watchdog_cancel(&q->watchdog);
+ __skb_queue_purge(&q->direct_queue);
+ sch->q.qlen = 0;
++ sch->qstats.backlog = 0;
+ memset(q->hlevel, 0, sizeof(q->hlevel));
+ memset(q->row_mask, 0, sizeof(q->row_mask));
+ for (i = 0; i < TC_HTB_NUMPRIO; i++)
+@@ -1165,14 +1168,7 @@ static int htb_graft(struct Qdisc *sch, unsigned long arg, struct Qdisc *new,
+ cl->common.classid)) == NULL)
+ return -ENOBUFS;
+
+- sch_tree_lock(sch);
+- *old = cl->un.leaf.q;
+- cl->un.leaf.q = new;
+- if (*old != NULL) {
+- qdisc_tree_decrease_qlen(*old, (*old)->q.qlen);
+- qdisc_reset(*old);
+- }
+- sch_tree_unlock(sch);
++ *old = qdisc_replace(sch, new, &cl->un.leaf.q);
+ return 0;
+ }
+
+@@ -1274,7 +1270,6 @@ static int htb_delete(struct Qdisc *sch, unsigned long arg)
+ {
+ struct htb_sched *q = qdisc_priv(sch);
+ struct htb_class *cl = (struct htb_class *)arg;
+- unsigned int qlen;
+ struct Qdisc *new_q = NULL;
+ int last_child = 0;
+
+@@ -1294,9 +1289,11 @@ static int htb_delete(struct Qdisc *sch, unsigned long arg)
+ sch_tree_lock(sch);
+
+ if (!cl->level) {
+- qlen = cl->un.leaf.q->q.qlen;
++ unsigned int qlen = cl->un.leaf.q->q.qlen;
++ unsigned int backlog = cl->un.leaf.q->qstats.backlog;
++
+ qdisc_reset(cl->un.leaf.q);
+- qdisc_tree_decrease_qlen(cl->un.leaf.q, qlen);
++ qdisc_tree_reduce_backlog(cl->un.leaf.q, qlen, backlog);
+ }
+
+ /* delete from hash and active; remainder in destroy_class */
+@@ -1430,10 +1427,11 @@ static int htb_change_class(struct Qdisc *sch, u32 classid,
+ sch_tree_lock(sch);
+ if (parent && !parent->level) {
+ unsigned int qlen = parent->un.leaf.q->q.qlen;
++ unsigned int backlog = parent->un.leaf.q->qstats.backlog;
+
+ /* turn parent into inner node */
+ qdisc_reset(parent->un.leaf.q);
+- qdisc_tree_decrease_qlen(parent->un.leaf.q, qlen);
++ qdisc_tree_reduce_backlog(parent->un.leaf.q, qlen, backlog);
+ qdisc_destroy(parent->un.leaf.q);
+ if (parent->prio_activity)
+ htb_deactivate(q, parent);
+diff --git a/net/sched/sch_multiq.c b/net/sched/sch_multiq.c
+index 42dd218871e0..23437d62a8db 100644
+--- a/net/sched/sch_multiq.c
++++ b/net/sched/sch_multiq.c
+@@ -218,7 +218,8 @@ static int multiq_tune(struct Qdisc *sch, struct nlattr *opt)
+ if (q->queues[i] != &noop_qdisc) {
+ struct Qdisc *child = q->queues[i];
+ q->queues[i] = &noop_qdisc;
+- qdisc_tree_decrease_qlen(child, child->q.qlen);
++ qdisc_tree_reduce_backlog(child, child->q.qlen,
++ child->qstats.backlog);
+ qdisc_destroy(child);
+ }
+ }
+@@ -238,8 +239,9 @@ static int multiq_tune(struct Qdisc *sch, struct nlattr *opt)
+ q->queues[i] = child;
+
+ if (old != &noop_qdisc) {
+- qdisc_tree_decrease_qlen(old,
+- old->q.qlen);
++ qdisc_tree_reduce_backlog(old,
++ old->q.qlen,
++ old->qstats.backlog);
+ qdisc_destroy(old);
+ }
+ sch_tree_unlock(sch);
+@@ -303,13 +305,7 @@ static int multiq_graft(struct Qdisc *sch, unsigned long arg, struct Qdisc *new,
+ if (new == NULL)
+ new = &noop_qdisc;
+
+- sch_tree_lock(sch);
+- *old = q->queues[band];
+- q->queues[band] = new;
+- qdisc_tree_decrease_qlen(*old, (*old)->q.qlen);
+- qdisc_reset(*old);
+- sch_tree_unlock(sch);
+-
++ *old = qdisc_replace(sch, new, &q->queues[band]);
+ return 0;
+ }
+
+diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c
+index b34331967e02..f60db2b3e5ef 100644
+--- a/net/sched/sch_netem.c
++++ b/net/sched/sch_netem.c
+@@ -408,6 +408,25 @@ static void tfifo_enqueue(struct sk_buff *nskb, struct Qdisc *sch)
+ sch->q.qlen++;
+ }
+
++/* netem can't properly corrupt a megapacket (like we get from GSO), so instead
++ * when we statistically choose to corrupt one, we instead segment it, returning
++ * the first packet to be corrupted, and re-enqueue the remaining frames
++ */
++static struct sk_buff *netem_segment(struct sk_buff *skb, struct Qdisc *sch)
++{
++ struct sk_buff *segs;
++ netdev_features_t features = netif_skb_features(skb);
++
++ segs = skb_gso_segment(skb, features & ~NETIF_F_GSO_MASK);
++
++ if (IS_ERR_OR_NULL(segs)) {
++ qdisc_reshape_fail(skb, sch);
++ return NULL;
++ }
++ consume_skb(skb);
++ return segs;
++}
++
+ /*
+ * Insert one skb into qdisc.
+ * Note: parent depends on return value to account for queue length.
+@@ -420,7 +439,11 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch)
+ /* We don't fill cb now as skb_unshare() may invalidate it */
+ struct netem_skb_cb *cb;
+ struct sk_buff *skb2;
++ struct sk_buff *segs = NULL;
++ unsigned int len = 0, last_len, prev_len = qdisc_pkt_len(skb);
++ int nb = 0;
+ int count = 1;
++ int rc = NET_XMIT_SUCCESS;
+
+ /* Random duplication */
+ if (q->duplicate && q->duplicate >= get_crandom(&q->dup_cor))
+@@ -466,10 +489,23 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch)
+ * do it now in software before we mangle it.
+ */
+ if (q->corrupt && q->corrupt >= get_crandom(&q->corrupt_cor)) {
++ if (skb_is_gso(skb)) {
++ segs = netem_segment(skb, sch);
++ if (!segs)
++ return NET_XMIT_DROP;
++ } else {
++ segs = skb;
++ }
++
++ skb = segs;
++ segs = segs->next;
++
+ if (!(skb = skb_unshare(skb, GFP_ATOMIC)) ||
+ (skb->ip_summed == CHECKSUM_PARTIAL &&
+- skb_checksum_help(skb)))
+- return qdisc_drop(skb, sch);
++ skb_checksum_help(skb))) {
++ rc = qdisc_drop(skb, sch);
++ goto finish_segs;
++ }
+
+ skb->data[prandom_u32() % skb_headlen(skb)] ^=
+ 1<<(prandom_u32() % 8);
+@@ -529,6 +565,27 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch)
+ sch->qstats.requeues++;
+ }
+
++finish_segs:
++ if (segs) {
++ while (segs) {
++ skb2 = segs->next;
++ segs->next = NULL;
++ qdisc_skb_cb(segs)->pkt_len = segs->len;
++ last_len = segs->len;
++ rc = qdisc_enqueue(segs, sch);
++ if (rc != NET_XMIT_SUCCESS) {
++ if (net_xmit_drop_count(rc))
++ qdisc_qstats_drop(sch);
++ } else {
++ nb++;
++ len += last_len;
++ }
++ segs = skb2;
++ }
++ sch->q.qlen += nb;
++ if (nb > 1)
++ qdisc_tree_reduce_backlog(sch, 1 - nb, prev_len - len);
++ }
+ return NET_XMIT_SUCCESS;
+ }
+
+@@ -610,7 +667,8 @@ deliver:
+ if (unlikely(err != NET_XMIT_SUCCESS)) {
+ if (net_xmit_drop_count(err)) {
+ qdisc_qstats_drop(sch);
+- qdisc_tree_decrease_qlen(sch, 1);
++ qdisc_tree_reduce_backlog(sch, 1,
++ qdisc_pkt_len(skb));
+ }
+ }
+ goto tfifo_dequeue;
+@@ -1049,15 +1107,7 @@ static int netem_graft(struct Qdisc *sch, unsigned long arg, struct Qdisc *new,
+ {
+ struct netem_sched_data *q = qdisc_priv(sch);
+
+- sch_tree_lock(sch);
+- *old = q->qdisc;
+- q->qdisc = new;
+- if (*old) {
+- qdisc_tree_decrease_qlen(*old, (*old)->q.qlen);
+- qdisc_reset(*old);
+- }
+- sch_tree_unlock(sch);
+-
++ *old = qdisc_replace(sch, new, &q->qdisc);
+ return 0;
+ }
+
+diff --git a/net/sched/sch_pie.c b/net/sched/sch_pie.c
+index b783a446d884..71ae3b9629f9 100644
+--- a/net/sched/sch_pie.c
++++ b/net/sched/sch_pie.c
+@@ -183,7 +183,7 @@ static int pie_change(struct Qdisc *sch, struct nlattr *opt)
+ {
+ struct pie_sched_data *q = qdisc_priv(sch);
+ struct nlattr *tb[TCA_PIE_MAX + 1];
+- unsigned int qlen;
++ unsigned int qlen, dropped = 0;
+ int err;
+
+ if (!opt)
+@@ -232,10 +232,11 @@ static int pie_change(struct Qdisc *sch, struct nlattr *opt)
+ while (sch->q.qlen > sch->limit) {
+ struct sk_buff *skb = __skb_dequeue(&sch->q);
+
++ dropped += qdisc_pkt_len(skb);
+ qdisc_qstats_backlog_dec(sch, skb);
+ qdisc_drop(skb, sch);
+ }
+- qdisc_tree_decrease_qlen(sch, qlen - sch->q.qlen);
++ qdisc_tree_reduce_backlog(sch, qlen - sch->q.qlen, dropped);
+
+ sch_tree_unlock(sch);
+ return 0;
+diff --git a/net/sched/sch_prio.c b/net/sched/sch_prio.c
+index 8e5cd34aaa74..e671b1a4e815 100644
+--- a/net/sched/sch_prio.c
++++ b/net/sched/sch_prio.c
+@@ -191,7 +191,7 @@ static int prio_tune(struct Qdisc *sch, struct nlattr *opt)
+ struct Qdisc *child = q->queues[i];
+ q->queues[i] = &noop_qdisc;
+ if (child != &noop_qdisc) {
+- qdisc_tree_decrease_qlen(child, child->q.qlen);
++ qdisc_tree_reduce_backlog(child, child->q.qlen, child->qstats.backlog);
+ qdisc_destroy(child);
+ }
+ }
+@@ -210,8 +210,9 @@ static int prio_tune(struct Qdisc *sch, struct nlattr *opt)
+ q->queues[i] = child;
+
+ if (old != &noop_qdisc) {
+- qdisc_tree_decrease_qlen(old,
+- old->q.qlen);
++ qdisc_tree_reduce_backlog(old,
++ old->q.qlen,
++ old->qstats.backlog);
+ qdisc_destroy(old);
+ }
+ sch_tree_unlock(sch);
+@@ -268,13 +269,7 @@ static int prio_graft(struct Qdisc *sch, unsigned long arg, struct Qdisc *new,
+ if (new == NULL)
+ new = &noop_qdisc;
+
+- sch_tree_lock(sch);
+- *old = q->queues[band];
+- q->queues[band] = new;
+- qdisc_tree_decrease_qlen(*old, (*old)->q.qlen);
+- qdisc_reset(*old);
+- sch_tree_unlock(sch);
+-
++ *old = qdisc_replace(sch, new, &q->queues[band]);
+ return 0;
+ }
+
+diff --git a/net/sched/sch_qfq.c b/net/sched/sch_qfq.c
+index 3ec7e88a43ca..e2b8fd47008b 100644
+--- a/net/sched/sch_qfq.c
++++ b/net/sched/sch_qfq.c
+@@ -221,9 +221,10 @@ static struct qfq_class *qfq_find_class(struct Qdisc *sch, u32 classid)
+ static void qfq_purge_queue(struct qfq_class *cl)
+ {
+ unsigned int len = cl->qdisc->q.qlen;
++ unsigned int backlog = cl->qdisc->qstats.backlog;
+
+ qdisc_reset(cl->qdisc);
+- qdisc_tree_decrease_qlen(cl->qdisc, len);
++ qdisc_tree_reduce_backlog(cl->qdisc, len, backlog);
+ }
+
+ static const struct nla_policy qfq_policy[TCA_QFQ_MAX + 1] = {
+@@ -619,11 +620,7 @@ static int qfq_graft_class(struct Qdisc *sch, unsigned long arg,
+ new = &noop_qdisc;
+ }
+
+- sch_tree_lock(sch);
+- qfq_purge_queue(cl);
+- *old = cl->qdisc;
+- cl->qdisc = new;
+- sch_tree_unlock(sch);
++ *old = qdisc_replace(sch, new, &cl->qdisc);
+ return 0;
+ }
+
+diff --git a/net/sched/sch_red.c b/net/sched/sch_red.c
+index 6c0534cc7758..8c0508c0e287 100644
+--- a/net/sched/sch_red.c
++++ b/net/sched/sch_red.c
+@@ -210,7 +210,8 @@ static int red_change(struct Qdisc *sch, struct nlattr *opt)
+ q->flags = ctl->flags;
+ q->limit = ctl->limit;
+ if (child) {
+- qdisc_tree_decrease_qlen(q->qdisc, q->qdisc->q.qlen);
++ qdisc_tree_reduce_backlog(q->qdisc, q->qdisc->q.qlen,
++ q->qdisc->qstats.backlog);
+ qdisc_destroy(q->qdisc);
+ q->qdisc = child;
+ }
+@@ -313,12 +314,7 @@ static int red_graft(struct Qdisc *sch, unsigned long arg, struct Qdisc *new,
+ if (new == NULL)
+ new = &noop_qdisc;
+
+- sch_tree_lock(sch);
+- *old = q->qdisc;
+- q->qdisc = new;
+- qdisc_tree_decrease_qlen(*old, (*old)->q.qlen);
+- qdisc_reset(*old);
+- sch_tree_unlock(sch);
++ *old = qdisc_replace(sch, new, &q->qdisc);
+ return 0;
+ }
+
+diff --git a/net/sched/sch_sfb.c b/net/sched/sch_sfb.c
+index 5819dd82630d..e1d634e3c255 100644
+--- a/net/sched/sch_sfb.c
++++ b/net/sched/sch_sfb.c
+@@ -518,7 +518,8 @@ static int sfb_change(struct Qdisc *sch, struct nlattr *opt)
+
+ sch_tree_lock(sch);
+
+- qdisc_tree_decrease_qlen(q->qdisc, q->qdisc->q.qlen);
++ qdisc_tree_reduce_backlog(q->qdisc, q->qdisc->q.qlen,
++ q->qdisc->qstats.backlog);
+ qdisc_destroy(q->qdisc);
+ q->qdisc = child;
+
+@@ -614,12 +615,7 @@ static int sfb_graft(struct Qdisc *sch, unsigned long arg, struct Qdisc *new,
+ if (new == NULL)
+ new = &noop_qdisc;
+
+- sch_tree_lock(sch);
+- *old = q->qdisc;
+- q->qdisc = new;
+- qdisc_tree_decrease_qlen(*old, (*old)->q.qlen);
+- qdisc_reset(*old);
+- sch_tree_unlock(sch);
++ *old = qdisc_replace(sch, new, &q->qdisc);
+ return 0;
+ }
+
+diff --git a/net/sched/sch_sfq.c b/net/sched/sch_sfq.c
+index b877140beda5..4417fb25166f 100644
+--- a/net/sched/sch_sfq.c
++++ b/net/sched/sch_sfq.c
+@@ -369,7 +369,7 @@ static int
+ sfq_enqueue(struct sk_buff *skb, struct Qdisc *sch)
+ {
+ struct sfq_sched_data *q = qdisc_priv(sch);
+- unsigned int hash;
++ unsigned int hash, dropped;
+ sfq_index x, qlen;
+ struct sfq_slot *slot;
+ int uninitialized_var(ret);
+@@ -484,7 +484,7 @@ enqueue:
+ return NET_XMIT_SUCCESS;
+
+ qlen = slot->qlen;
+- sfq_drop(sch);
++ dropped = sfq_drop(sch);
+ /* Return Congestion Notification only if we dropped a packet
+ * from this flow.
+ */
+@@ -492,7 +492,7 @@ enqueue:
+ return NET_XMIT_CN;
+
+ /* As we dropped a packet, better let upper stack know this */
+- qdisc_tree_decrease_qlen(sch, 1);
++ qdisc_tree_reduce_backlog(sch, 1, dropped);
+ return NET_XMIT_SUCCESS;
+ }
+
+@@ -560,6 +560,7 @@ static void sfq_rehash(struct Qdisc *sch)
+ struct sfq_slot *slot;
+ struct sk_buff_head list;
+ int dropped = 0;
++ unsigned int drop_len = 0;
+
+ __skb_queue_head_init(&list);
+
+@@ -588,6 +589,7 @@ static void sfq_rehash(struct Qdisc *sch)
+ if (x >= SFQ_MAX_FLOWS) {
+ drop:
+ qdisc_qstats_backlog_dec(sch, skb);
++ drop_len += qdisc_pkt_len(skb);
+ kfree_skb(skb);
+ dropped++;
+ continue;
+@@ -617,7 +619,7 @@ drop:
+ }
+ }
+ sch->q.qlen -= dropped;
+- qdisc_tree_decrease_qlen(sch, dropped);
++ qdisc_tree_reduce_backlog(sch, dropped, drop_len);
+ }
+
+ static void sfq_perturbation(unsigned long arg)
+@@ -641,7 +643,7 @@ static int sfq_change(struct Qdisc *sch, struct nlattr *opt)
+ struct sfq_sched_data *q = qdisc_priv(sch);
+ struct tc_sfq_qopt *ctl = nla_data(opt);
+ struct tc_sfq_qopt_v1 *ctl_v1 = NULL;
+- unsigned int qlen;
++ unsigned int qlen, dropped = 0;
+ struct red_parms *p = NULL;
+
+ if (opt->nla_len < nla_attr_size(sizeof(*ctl)))
+@@ -690,8 +692,8 @@ static int sfq_change(struct Qdisc *sch, struct nlattr *opt)
+
+ qlen = sch->q.qlen;
+ while (sch->q.qlen > q->limit)
+- sfq_drop(sch);
+- qdisc_tree_decrease_qlen(sch, qlen - sch->q.qlen);
++ dropped += sfq_drop(sch);
++ qdisc_tree_reduce_backlog(sch, qlen - sch->q.qlen, dropped);
+
+ del_timer(&q->perturb_timer);
+ if (q->perturb_period) {
+diff --git a/net/sched/sch_tbf.c b/net/sched/sch_tbf.c
+index a4afde14e865..c2fbde742f37 100644
+--- a/net/sched/sch_tbf.c
++++ b/net/sched/sch_tbf.c
+@@ -160,6 +160,7 @@ static int tbf_segment(struct sk_buff *skb, struct Qdisc *sch)
+ struct tbf_sched_data *q = qdisc_priv(sch);
+ struct sk_buff *segs, *nskb;
+ netdev_features_t features = netif_skb_features(skb);
++ unsigned int len = 0, prev_len = qdisc_pkt_len(skb);
+ int ret, nb;
+
+ segs = skb_gso_segment(skb, features & ~NETIF_F_GSO_MASK);
+@@ -172,6 +173,7 @@ static int tbf_segment(struct sk_buff *skb, struct Qdisc *sch)
+ nskb = segs->next;
+ segs->next = NULL;
+ qdisc_skb_cb(segs)->pkt_len = segs->len;
++ len += segs->len;
+ ret = qdisc_enqueue(segs, q->qdisc);
+ if (ret != NET_XMIT_SUCCESS) {
+ if (net_xmit_drop_count(ret))
+@@ -183,7 +185,7 @@ static int tbf_segment(struct sk_buff *skb, struct Qdisc *sch)
+ }
+ sch->q.qlen += nb;
+ if (nb > 1)
+- qdisc_tree_decrease_qlen(sch, 1 - nb);
++ qdisc_tree_reduce_backlog(sch, 1 - nb, prev_len - len);
+ consume_skb(skb);
+ return nb > 0 ? NET_XMIT_SUCCESS : NET_XMIT_DROP;
+ }
+@@ -399,7 +401,8 @@ static int tbf_change(struct Qdisc *sch, struct nlattr *opt)
+
+ sch_tree_lock(sch);
+ if (child) {
+- qdisc_tree_decrease_qlen(q->qdisc, q->qdisc->q.qlen);
++ qdisc_tree_reduce_backlog(q->qdisc, q->qdisc->q.qlen,
++ q->qdisc->qstats.backlog);
+ qdisc_destroy(q->qdisc);
+ q->qdisc = child;
+ }
+@@ -502,13 +505,7 @@ static int tbf_graft(struct Qdisc *sch, unsigned long arg, struct Qdisc *new,
+ if (new == NULL)
+ new = &noop_qdisc;
+
+- sch_tree_lock(sch);
+- *old = q->qdisc;
+- q->qdisc = new;
+- qdisc_tree_decrease_qlen(*old, (*old)->q.qlen);
+- qdisc_reset(*old);
+- sch_tree_unlock(sch);
+-
++ *old = qdisc_replace(sch, new, &q->qdisc);
+ return 0;
+ }
+
+diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
+index 3267a5cbb3e8..18361cbfc882 100644
+--- a/net/sctp/ipv6.c
++++ b/net/sctp/ipv6.c
+@@ -519,6 +519,8 @@ static int sctp_v6_cmp_addr(const union sctp_addr *addr1,
+ }
+ return 0;
+ }
++ if (addr1->v6.sin6_port != addr2->v6.sin6_port)
++ return 0;
+ if (!ipv6_addr_equal(&addr1->v6.sin6_addr, &addr2->v6.sin6_addr))
+ return 0;
+ /* If this is a linklocal address, compare the scope_id. */
+diff --git a/net/socket.c b/net/socket.c
+index 02fc7c8ea9ed..7f61789c78ff 100644
+--- a/net/socket.c
++++ b/net/socket.c
+@@ -2410,31 +2410,31 @@ int __sys_recvmmsg(int fd, struct mmsghdr __user *mmsg, unsigned int vlen,
+ break;
+ }
+
+-out_put:
+- fput_light(sock->file, fput_needed);
+-
+ if (err == 0)
+- return datagrams;
++ goto out_put;
+
+- if (datagrams != 0) {
++ if (datagrams == 0) {
++ datagrams = err;
++ goto out_put;
++ }
++
++ /*
++ * We may return less entries than requested (vlen) if the
++ * sock is non block and there aren't enough datagrams...
++ */
++ if (err != -EAGAIN) {
+ /*
+- * We may return less entries than requested (vlen) if the
+- * sock is non block and there aren't enough datagrams...
++ * ... or if recvmsg returns an error after we
++ * received some datagrams, where we record the
++ * error to return on the next call or if the
++ * app asks about it using getsockopt(SO_ERROR).
+ */
+- if (err != -EAGAIN) {
+- /*
+- * ... or if recvmsg returns an error after we
+- * received some datagrams, where we record the
+- * error to return on the next call or if the
+- * app asks about it using getsockopt(SO_ERROR).
+- */
+- sock->sk->sk_err = -err;
+- }
+-
+- return datagrams;
++ sock->sk->sk_err = -err;
+ }
++out_put:
++ fput_light(sock->file, fput_needed);
+
+- return err;
++ return datagrams;
+ }
+
+ SYSCALL_DEFINE5(recvmmsg, int, fd, struct mmsghdr __user *, mmsg,
+diff --git a/net/sunrpc/cache.c b/net/sunrpc/cache.c
+index 14d38ec5e53d..11e7b55f04e2 100644
+--- a/net/sunrpc/cache.c
++++ b/net/sunrpc/cache.c
+@@ -1187,14 +1187,14 @@ int sunrpc_cache_pipe_upcall(struct cache_detail *detail, struct cache_head *h)
+ }
+
+ crq->q.reader = 0;
+- crq->item = cache_get(h);
+ crq->buf = buf;
+ crq->len = 0;
+ crq->readers = 0;
+ spin_lock(&queue_lock);
+- if (test_bit(CACHE_PENDING, &h->flags))
++ if (test_bit(CACHE_PENDING, &h->flags)) {
++ crq->item = cache_get(h);
+ list_add_tail(&crq->q.list, &detail->queue);
+- else
++ } else
+ /* Lost a race, no longer PENDING, so don't enqueue */
+ ret = -EAGAIN;
+ spin_unlock(&queue_lock);
+diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
+index ae46f0198608..7b738b53f061 100644
+--- a/net/sunrpc/clnt.c
++++ b/net/sunrpc/clnt.c
+@@ -439,7 +439,7 @@ out_no_rpciod:
+ return ERR_PTR(err);
+ }
+
+-struct rpc_clnt *rpc_create_xprt(struct rpc_create_args *args,
++static struct rpc_clnt *rpc_create_xprt(struct rpc_create_args *args,
+ struct rpc_xprt *xprt)
+ {
+ struct rpc_clnt *clnt = NULL;
+@@ -471,7 +471,6 @@ struct rpc_clnt *rpc_create_xprt(struct rpc_create_args *args,
+
+ return clnt;
+ }
+-EXPORT_SYMBOL_GPL(rpc_create_xprt);
+
+ /**
+ * rpc_create - create an RPC client and transport with one call
+@@ -497,6 +496,15 @@ struct rpc_clnt *rpc_create(struct rpc_create_args *args)
+ };
+ char servername[48];
+
++ if (args->bc_xprt) {
++ WARN_ON(args->protocol != XPRT_TRANSPORT_BC_TCP);
++ xprt = args->bc_xprt->xpt_bc_xprt;
++ if (xprt) {
++ xprt_get(xprt);
++ return rpc_create_xprt(args, xprt);
++ }
++ }
++
+ if (args->flags & RPC_CLNT_CREATE_INFINITE_SLOTS)
+ xprtargs.flags |= XPRT_CREATE_INFINITE_SLOTS;
+ if (args->flags & RPC_CLNT_CREATE_NO_IDLE_TIMEOUT)
+diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
+index 20d752634efb..287087b10a7e 100644
+--- a/net/unix/af_unix.c
++++ b/net/unix/af_unix.c
+@@ -305,7 +305,7 @@ static struct sock *unix_find_socket_byinode(struct inode *i)
+ &unix_socket_table[i->i_ino & (UNIX_HASH_SIZE - 1)]) {
+ struct dentry *dentry = unix_sk(s)->path.dentry;
+
+- if (dentry && dentry->d_inode == i) {
++ if (dentry && d_backing_inode(dentry) == i) {
+ sock_hold(s);
+ goto found;
+ }
+@@ -898,7 +898,7 @@ static struct sock *unix_find_other(struct net *net,
+ err = kern_path(sunname->sun_path, LOOKUP_FOLLOW, &path);
+ if (err)
+ goto fail;
+- inode = path.dentry->d_inode;
++ inode = d_backing_inode(path.dentry);
+ err = inode_permission(inode, MAY_WRITE);
+ if (err)
+ goto put_fail;
+@@ -940,32 +940,20 @@ fail:
+ return NULL;
+ }
+
+-static int unix_mknod(const char *sun_path, umode_t mode, struct path *res)
++static int unix_mknod(struct dentry *dentry, struct path *path, umode_t mode,
++ struct path *res)
+ {
+- struct dentry *dentry;
+- struct path path;
+- int err = 0;
+- /*
+- * Get the parent directory, calculate the hash for last
+- * component.
+- */
+- dentry = kern_path_create(AT_FDCWD, sun_path, &path, 0);
+- err = PTR_ERR(dentry);
+- if (IS_ERR(dentry))
+- return err;
++ int err;
+
+- /*
+- * All right, let's create it.
+- */
+- err = security_path_mknod(&path, dentry, mode, 0);
++ err = security_path_mknod(path, dentry, mode, 0);
+ if (!err) {
+- err = vfs_mknod(path.dentry->d_inode, dentry, mode, 0);
++ err = vfs_mknod(d_inode(path->dentry), dentry, mode, 0);
+ if (!err) {
+- res->mnt = mntget(path.mnt);
++ res->mnt = mntget(path->mnt);
+ res->dentry = dget(dentry);
+ }
+ }
+- done_path_create(&path, dentry);
++
+ return err;
+ }
+
+@@ -976,10 +964,12 @@ static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
+ struct unix_sock *u = unix_sk(sk);
+ struct sockaddr_un *sunaddr = (struct sockaddr_un *)uaddr;
+ char *sun_path = sunaddr->sun_path;
+- int err;
++ int err, name_err;
+ unsigned int hash;
+ struct unix_address *addr;
+ struct hlist_head *list;
++ struct path path;
++ struct dentry *dentry;
+
+ err = -EINVAL;
+ if (sunaddr->sun_family != AF_UNIX)
+@@ -995,14 +985,34 @@ static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
+ goto out;
+ addr_len = err;
+
++ name_err = 0;
++ dentry = NULL;
++ if (sun_path[0]) {
++ /* Get the parent directory, calculate the hash for last
++ * component.
++ */
++ dentry = kern_path_create(AT_FDCWD, sun_path, &path, 0);
++
++ if (IS_ERR(dentry)) {
++ /* delay report until after 'already bound' check */
++ name_err = PTR_ERR(dentry);
++ dentry = NULL;
++ }
++ }
++
+ err = mutex_lock_interruptible(&u->readlock);
+ if (err)
+- goto out;
++ goto out_path;
+
+ err = -EINVAL;
+ if (u->addr)
+ goto out_up;
+
++ if (name_err) {
++ err = name_err == -EEXIST ? -EADDRINUSE : name_err;
++ goto out_up;
++ }
++
+ err = -ENOMEM;
+ addr = kmalloc(sizeof(*addr)+addr_len, GFP_KERNEL);
+ if (!addr)
+@@ -1013,11 +1023,11 @@ static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
+ addr->hash = hash ^ sk->sk_type;
+ atomic_set(&addr->refcnt, 1);
+
+- if (sun_path[0]) {
+- struct path path;
++ if (dentry) {
++ struct path u_path;
+ umode_t mode = S_IFSOCK |
+ (SOCK_INODE(sock)->i_mode & ~current_umask());
+- err = unix_mknod(sun_path, mode, &path);
++ err = unix_mknod(dentry, &path, mode, &u_path);
+ if (err) {
+ if (err == -EEXIST)
+ err = -EADDRINUSE;
+@@ -1025,9 +1035,9 @@ static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
+ goto out_up;
+ }
+ addr->hash = UNIX_HASH_SIZE;
+- hash = path.dentry->d_inode->i_ino & (UNIX_HASH_SIZE-1);
++ hash = d_backing_inode(dentry)->i_ino & (UNIX_HASH_SIZE - 1);
+ spin_lock(&unix_table_lock);
+- u->path = path;
++ u->path = u_path;
+ list = &unix_socket_table[hash];
+ } else {
+ spin_lock(&unix_table_lock);
+@@ -1050,6 +1060,10 @@ out_unlock:
+ spin_unlock(&unix_table_lock);
+ out_up:
+ mutex_unlock(&u->readlock);
++out_path:
++ if (dentry)
++ done_path_create(&path, dentry);
++
+ out:
+ return err;
+ }
+diff --git a/net/unix/diag.c b/net/unix/diag.c
+index 86fa0f3b2caf..9d4218fc0a61 100644
+--- a/net/unix/diag.c
++++ b/net/unix/diag.c
+@@ -25,7 +25,7 @@ static int sk_diag_dump_vfs(struct sock *sk, struct sk_buff *nlskb)
+
+ if (dentry) {
+ struct unix_diag_vfs uv = {
+- .udiag_vfs_ino = dentry->d_inode->i_ino,
++ .udiag_vfs_ino = d_backing_inode(dentry)->i_ino,
+ .udiag_vfs_dev = dentry->d_sb->s_dev,
+ };
+
+diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c
+index 85d232bed87d..e8d3313ea2c9 100644
+--- a/net/vmw_vsock/af_vsock.c
++++ b/net/vmw_vsock/af_vsock.c
+@@ -1796,27 +1796,8 @@ vsock_stream_recvmsg(struct kiocb *kiocb,
+ else if (sk->sk_shutdown & RCV_SHUTDOWN)
+ err = 0;
+
+- if (copied > 0) {
+- /* We only do these additional bookkeeping/notification steps
+- * if we actually copied something out of the queue pair
+- * instead of just peeking ahead.
+- */
+-
+- if (!(flags & MSG_PEEK)) {
+- /* If the other side has shutdown for sending and there
+- * is nothing more to read, then modify the socket
+- * state.
+- */
+- if (vsk->peer_shutdown & SEND_SHUTDOWN) {
+- if (vsock_stream_has_data(vsk) <= 0) {
+- sk->sk_state = SS_UNCONNECTED;
+- sock_set_flag(sk, SOCK_DONE);
+- sk->sk_state_change(sk);
+- }
+- }
+- }
++ if (copied > 0)
+ err = copied;
+- }
+
+ out_wait:
+ finish_wait(sk_sleep(sk), &wait);
+diff --git a/net/x25/x25_facilities.c b/net/x25/x25_facilities.c
+index 7ecd04c21360..997ff7b2509b 100644
+--- a/net/x25/x25_facilities.c
++++ b/net/x25/x25_facilities.c
+@@ -277,6 +277,7 @@ int x25_negotiate_facilities(struct sk_buff *skb, struct sock *sk,
+
+ memset(&theirs, 0, sizeof(theirs));
+ memcpy(new, ours, sizeof(*new));
++ memset(dte, 0, sizeof(*dte));
+
+ len = x25_parse_facilities(skb, &theirs, dte, &x25->vc_facil_mask);
+ if (len < 0)
+diff --git a/net/xfrm/xfrm_input.c b/net/xfrm/xfrm_input.c
+index 00977873300c..d0e6d351aba8 100644
+--- a/net/xfrm/xfrm_input.c
++++ b/net/xfrm/xfrm_input.c
+@@ -292,12 +292,15 @@ int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type)
+ XFRM_SKB_CB(skb)->seq.input.hi = seq_hi;
+
+ skb_dst_force(skb);
++ dev_hold(skb->dev);
+
+ nexthdr = x->type->input(x, skb);
+
+ if (nexthdr == -EINPROGRESS)
+ return 0;
+ resume:
++ dev_put(skb->dev);
++
+ spin_lock(&x->lock);
+ if (nexthdr <= 0) {
+ if (nexthdr == -EBADMSG) {
+diff --git a/security/keys/key.c b/security/keys/key.c
+index e17ba6aefdc0..f8bde20bed5d 100644
+--- a/security/keys/key.c
++++ b/security/keys/key.c
+@@ -580,7 +580,7 @@ int key_reject_and_link(struct key *key,
+
+ mutex_unlock(&key_construction_mutex);
+
+- if (keyring)
++ if (keyring && link_ret == 0)
+ __key_link_end(keyring, &key->index_key, edit);
+
+ /* wake up anyone waiting for a key to be constructed */
+diff --git a/sound/core/timer.c b/sound/core/timer.c
+index 4927a3c88340..2fd0dccf8505 100644
+--- a/sound/core/timer.c
++++ b/sound/core/timer.c
+@@ -1053,8 +1053,8 @@ static int snd_timer_s_start(struct snd_timer * timer)
+ njiff += timer->sticks - priv->correction;
+ priv->correction = 0;
+ }
+- priv->last_expires = priv->tlist.expires = njiff;
+- add_timer(&priv->tlist);
++ priv->last_expires = njiff;
++ mod_timer(&priv->tlist, njiff);
+ return 0;
+ }
+
+diff --git a/sound/drivers/dummy.c b/sound/drivers/dummy.c
+index 387bb8f603ac..35cc884bca6b 100644
+--- a/sound/drivers/dummy.c
++++ b/sound/drivers/dummy.c
+@@ -422,6 +422,7 @@ static int dummy_hrtimer_stop(struct snd_pcm_substream *substream)
+
+ static inline void dummy_hrtimer_sync(struct dummy_hrtimer_pcm *dpcm)
+ {
++ hrtimer_cancel(&dpcm->timer);
+ tasklet_kill(&dpcm->tasklet);
+ }
+
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 5b2c7fe0ac85..77bd16739dbd 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -5544,8 +5544,7 @@ static const struct hda_model_fixup alc269_fixup_models[] = {
+ {0x15, 0x0221401f}, \
+ {0x1a, 0x411111f0}, \
+ {0x1b, 0x411111f0}, \
+- {0x1d, 0x40700001}, \
+- {0x1e, 0x411111f0}
++ {0x1d, 0x40700001}
+
+ #define ALC298_STANDARD_PINS \
+ {0x18, 0x411111f0}, \
+@@ -5813,35 +5812,48 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = {
+ {0x13, 0x411111f0},
+ {0x16, 0x01014020},
+ {0x18, 0x411111f0},
+- {0x19, 0x01a19030}),
++ {0x19, 0x01a19030},
++ {0x1e, 0x411111f0}),
+ SND_HDA_PIN_QUIRK(0x10ec0292, 0x1028, "Dell", ALC269_FIXUP_DELL2_MIC_NO_PRESENCE,
+ ALC292_STANDARD_PINS,
+ {0x12, 0x90a60140},
+ {0x13, 0x411111f0},
+ {0x16, 0x01014020},
+ {0x18, 0x02a19031},
+- {0x19, 0x01a1903e}),
++ {0x19, 0x01a1903e},
++ {0x1e, 0x411111f0}),
+ SND_HDA_PIN_QUIRK(0x10ec0292, 0x1028, "Dell", ALC269_FIXUP_DELL3_MIC_NO_PRESENCE,
+ ALC292_STANDARD_PINS,
+ {0x12, 0x90a60140},
+ {0x13, 0x411111f0},
+ {0x16, 0x411111f0},
+ {0x18, 0x411111f0},
+- {0x19, 0x411111f0}),
++ {0x19, 0x411111f0},
++ {0x1e, 0x411111f0}),
+ SND_HDA_PIN_QUIRK(0x10ec0293, 0x1028, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE,
+ ALC292_STANDARD_PINS,
+ {0x12, 0x40000000},
+ {0x13, 0x90a60140},
+ {0x16, 0x21014020},
+ {0x18, 0x411111f0},
+- {0x19, 0x21a19030}),
++ {0x19, 0x21a19030},
++ {0x1e, 0x411111f0}),
+ SND_HDA_PIN_QUIRK(0x10ec0293, 0x1028, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE,
+ ALC292_STANDARD_PINS,
+ {0x12, 0x40000000},
+ {0x13, 0x90a60140},
+ {0x16, 0x411111f0},
+ {0x18, 0x411111f0},
+- {0x19, 0x411111f0}),
++ {0x19, 0x411111f0},
++ {0x1e, 0x411111f0}),
++ SND_HDA_PIN_QUIRK(0x10ec0293, 0x1028, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE,
++ ALC292_STANDARD_PINS,
++ {0x12, 0x40000000},
++ {0x13, 0x90a60140},
++ {0x16, 0x21014020},
++ {0x18, 0x411111f0},
++ {0x19, 0x21a19030},
++ {0x1e, 0x411111ff}),
+ SND_HDA_PIN_QUIRK(0x10ec0298, 0x1028, "Dell", ALC298_FIXUP_DELL1_MIC_NO_PRESENCE,
+ ALC298_STANDARD_PINS,
+ {0x12, 0x90a60130},
+diff --git a/sound/soc/codecs/ssm4567.c b/sound/soc/codecs/ssm4567.c
+index 4b5c17f8507e..9bb976e7d609 100644
+--- a/sound/soc/codecs/ssm4567.c
++++ b/sound/soc/codecs/ssm4567.c
+@@ -206,6 +206,11 @@ static int ssm4567_set_power(struct ssm4567 *ssm4567, bool enable)
+ regcache_cache_only(ssm4567->regmap, !enable);
+
+ if (enable) {
++ ret = regmap_write(ssm4567->regmap, SSM4567_REG_SOFT_RESET,
++ 0x00);
++ if (ret)
++ return ret;
++
+ ret = regmap_update_bits(ssm4567->regmap,
+ SSM4567_REG_POWER_CTRL,
+ SSM4567_POWER_SPWDN, 0x00);
+diff --git a/sound/soc/samsung/ac97.c b/sound/soc/samsung/ac97.c
+index e1615113fd84..98e3b9313d55 100644
+--- a/sound/soc/samsung/ac97.c
++++ b/sound/soc/samsung/ac97.c
+@@ -324,7 +324,7 @@ static const struct snd_soc_component_driver s3c_ac97_component = {
+
+ static int s3c_ac97_probe(struct platform_device *pdev)
+ {
+- struct resource *mem_res, *dmatx_res, *dmarx_res, *dmamic_res, *irq_res;
++ struct resource *mem_res, *irq_res;
+ struct s3c_audio_pdata *ac97_pdata;
+ int ret;
+
+@@ -335,24 +335,6 @@ static int s3c_ac97_probe(struct platform_device *pdev)
+ }
+
+ /* Check for availability of necessary resource */
+- dmatx_res = platform_get_resource(pdev, IORESOURCE_DMA, 0);
+- if (!dmatx_res) {
+- dev_err(&pdev->dev, "Unable to get AC97-TX dma resource\n");
+- return -ENXIO;
+- }
+-
+- dmarx_res = platform_get_resource(pdev, IORESOURCE_DMA, 1);
+- if (!dmarx_res) {
+- dev_err(&pdev->dev, "Unable to get AC97-RX dma resource\n");
+- return -ENXIO;
+- }
+-
+- dmamic_res = platform_get_resource(pdev, IORESOURCE_DMA, 2);
+- if (!dmamic_res) {
+- dev_err(&pdev->dev, "Unable to get AC97-MIC dma resource\n");
+- return -ENXIO;
+- }
+-
+ irq_res = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
+ if (!irq_res) {
+ dev_err(&pdev->dev, "AC97 IRQ not provided!\n");
+@@ -364,11 +346,11 @@ static int s3c_ac97_probe(struct platform_device *pdev)
+ if (IS_ERR(s3c_ac97.regs))
+ return PTR_ERR(s3c_ac97.regs);
+
+- s3c_ac97_pcm_out.channel = dmatx_res->start;
++ s3c_ac97_pcm_out.slave = ac97_pdata->dma_playback;
+ s3c_ac97_pcm_out.dma_addr = mem_res->start + S3C_AC97_PCM_DATA;
+- s3c_ac97_pcm_in.channel = dmarx_res->start;
++ s3c_ac97_pcm_in.slave = ac97_pdata->dma_capture;
+ s3c_ac97_pcm_in.dma_addr = mem_res->start + S3C_AC97_PCM_DATA;
+- s3c_ac97_mic_in.channel = dmamic_res->start;
++ s3c_ac97_mic_in.slave = ac97_pdata->dma_capture_mic;
+ s3c_ac97_mic_in.dma_addr = mem_res->start + S3C_AC97_MIC_DATA;
+
+ init_completion(&s3c_ac97.done);
+diff --git a/sound/soc/samsung/dma.h b/sound/soc/samsung/dma.h
+index 0e85dcfec023..085ef30f5ca2 100644
+--- a/sound/soc/samsung/dma.h
++++ b/sound/soc/samsung/dma.h
+@@ -15,7 +15,7 @@
+ #include <sound/dmaengine_pcm.h>
+
+ struct s3c_dma_params {
+- int channel; /* Channel ID */
++ void *slave; /* Channel ID */
+ dma_addr_t dma_addr;
+ int dma_size; /* Size of the DMA transfer */
+ char *ch_name;
+diff --git a/sound/soc/samsung/dmaengine.c b/sound/soc/samsung/dmaengine.c
+index 506f5bf6d082..727008d57d14 100644
+--- a/sound/soc/samsung/dmaengine.c
++++ b/sound/soc/samsung/dmaengine.c
+@@ -50,14 +50,14 @@ void samsung_asoc_init_dma_data(struct snd_soc_dai *dai,
+
+ if (playback) {
+ playback_data = &playback->dma_data;
+- playback_data->filter_data = (void *)playback->channel;
++ playback_data->filter_data = playback->slave;
+ playback_data->chan_name = playback->ch_name;
+ playback_data->addr = playback->dma_addr;
+ playback_data->addr_width = playback->dma_size;
+ }
+ if (capture) {
+ capture_data = &capture->dma_data;
+- capture_data->filter_data = (void *)capture->channel;
++ capture_data->filter_data = capture->slave;
+ capture_data->chan_name = capture->ch_name;
+ capture_data->addr = capture->dma_addr;
+ capture_data->addr_width = capture->dma_size;
+diff --git a/sound/soc/samsung/i2s.c b/sound/soc/samsung/i2s.c
+index 9d513473b300..f2ce03dbf02f 100644
+--- a/sound/soc/samsung/i2s.c
++++ b/sound/soc/samsung/i2s.c
+@@ -1167,27 +1167,14 @@ static int samsung_i2s_probe(struct platform_device *pdev)
+ }
+
+ if (!np) {
+- res = platform_get_resource(pdev, IORESOURCE_DMA, 0);
+- if (!res) {
+- dev_err(&pdev->dev,
+- "Unable to get I2S-TX dma resource\n");
+- return -ENXIO;
+- }
+- pri_dai->dma_playback.channel = res->start;
+-
+- res = platform_get_resource(pdev, IORESOURCE_DMA, 1);
+- if (!res) {
+- dev_err(&pdev->dev,
+- "Unable to get I2S-RX dma resource\n");
+- return -ENXIO;
+- }
+- pri_dai->dma_capture.channel = res->start;
+-
+ if (i2s_pdata == NULL) {
+ dev_err(&pdev->dev, "Can't work without s3c_audio_pdata\n");
+ return -EINVAL;
+ }
+
++ pri_dai->dma_playback.slave = i2s_pdata->dma_playback;
++ pri_dai->dma_capture.slave = i2s_pdata->dma_capture;
++
+ if (&i2s_pdata->type)
+ i2s_cfg = &i2s_pdata->type.i2s;
+
+@@ -1242,11 +1229,8 @@ static int samsung_i2s_probe(struct platform_device *pdev)
+ sec_dai->dma_playback.dma_addr = regs_base + I2STXDS;
+ sec_dai->dma_playback.ch_name = "tx-sec";
+
+- if (!np) {
+- res = platform_get_resource(pdev, IORESOURCE_DMA, 2);
+- if (res)
+- sec_dai->dma_playback.channel = res->start;
+- }
++ if (!np)
++ sec_dai->dma_playback.slave = i2s_pdata->dma_play_sec;
+
+ sec_dai->dma_playback.dma_size = 4;
+ sec_dai->base = regs_base;
+diff --git a/sound/soc/samsung/pcm.c b/sound/soc/samsung/pcm.c
+index bac034b15a27..9e6e33b17213 100644
+--- a/sound/soc/samsung/pcm.c
++++ b/sound/soc/samsung/pcm.c
+@@ -486,7 +486,7 @@ static const struct snd_soc_component_driver s3c_pcm_component = {
+ static int s3c_pcm_dev_probe(struct platform_device *pdev)
+ {
+ struct s3c_pcm_info *pcm;
+- struct resource *mem_res, *dmatx_res, *dmarx_res;
++ struct resource *mem_res;
+ struct s3c_audio_pdata *pcm_pdata;
+ int ret;
+
+@@ -499,18 +499,6 @@ static int s3c_pcm_dev_probe(struct platform_device *pdev)
+ pcm_pdata = pdev->dev.platform_data;
+
+ /* Check for availability of necessary resource */
+- dmatx_res = platform_get_resource(pdev, IORESOURCE_DMA, 0);
+- if (!dmatx_res) {
+- dev_err(&pdev->dev, "Unable to get PCM-TX dma resource\n");
+- return -ENXIO;
+- }
+-
+- dmarx_res = platform_get_resource(pdev, IORESOURCE_DMA, 1);
+- if (!dmarx_res) {
+- dev_err(&pdev->dev, "Unable to get PCM-RX dma resource\n");
+- return -ENXIO;
+- }
+-
+ mem_res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+ if (!mem_res) {
+ dev_err(&pdev->dev, "Unable to get register resource\n");
+@@ -568,8 +556,10 @@ static int s3c_pcm_dev_probe(struct platform_device *pdev)
+ s3c_pcm_stereo_out[pdev->id].dma_addr = mem_res->start
+ + S3C_PCM_TXFIFO;
+
+- s3c_pcm_stereo_in[pdev->id].channel = dmarx_res->start;
+- s3c_pcm_stereo_out[pdev->id].channel = dmatx_res->start;
++ if (pcm_pdata) {
++ s3c_pcm_stereo_in[pdev->id].slave = pcm_pdata->dma_capture;
++ s3c_pcm_stereo_out[pdev->id].slave = pcm_pdata->dma_playback;
++ }
+
+ pcm->dma_capture = &s3c_pcm_stereo_in[pdev->id];
+ pcm->dma_playback = &s3c_pcm_stereo_out[pdev->id];
+diff --git a/sound/soc/samsung/s3c-i2s-v2.c b/sound/soc/samsung/s3c-i2s-v2.c
+index df65c5b494b1..b6ab3fc5789e 100644
+--- a/sound/soc/samsung/s3c-i2s-v2.c
++++ b/sound/soc/samsung/s3c-i2s-v2.c
+@@ -709,7 +709,7 @@ static int s3c2412_i2s_resume(struct snd_soc_dai *dai)
+ #endif
+
+ int s3c_i2sv2_register_component(struct device *dev, int id,
+- struct snd_soc_component_driver *cmp_drv,
++ const struct snd_soc_component_driver *cmp_drv,
+ struct snd_soc_dai_driver *dai_drv)
+ {
+ struct snd_soc_dai_ops *ops = (struct snd_soc_dai_ops *)dai_drv->ops;
+diff --git a/sound/soc/samsung/s3c-i2s-v2.h b/sound/soc/samsung/s3c-i2s-v2.h
+index 90abab364b49..d0684145ed1f 100644
+--- a/sound/soc/samsung/s3c-i2s-v2.h
++++ b/sound/soc/samsung/s3c-i2s-v2.h
+@@ -101,7 +101,7 @@ extern int s3c_i2sv2_probe(struct snd_soc_dai *dai,
+ * soc core.
+ */
+ extern int s3c_i2sv2_register_component(struct device *dev, int id,
+- struct snd_soc_component_driver *cmp_drv,
++ const struct snd_soc_component_driver *cmp_drv,
+ struct snd_soc_dai_driver *dai_drv);
+
+ #endif /* __SND_SOC_S3C24XX_S3C_I2SV2_I2S_H */
+diff --git a/sound/soc/samsung/s3c2412-i2s.c b/sound/soc/samsung/s3c2412-i2s.c
+index 27b339c6580e..e3650d1497ec 100644
+--- a/sound/soc/samsung/s3c2412-i2s.c
++++ b/sound/soc/samsung/s3c2412-i2s.c
+@@ -34,13 +34,13 @@
+ #include "s3c2412-i2s.h"
+
+ static struct s3c_dma_params s3c2412_i2s_pcm_stereo_out = {
+- .channel = DMACH_I2S_OUT,
++ .slave = (void *)(uintptr_t)DMACH_I2S_OUT,
+ .ch_name = "tx",
+ .dma_size = 4,
+ };
+
+ static struct s3c_dma_params s3c2412_i2s_pcm_stereo_in = {
+- .channel = DMACH_I2S_IN,
++ .slave = (void *)(uintptr_t)DMACH_I2S_IN,
+ .ch_name = "rx",
+ .dma_size = 4,
+ };
+diff --git a/sound/soc/samsung/s3c24xx-i2s.c b/sound/soc/samsung/s3c24xx-i2s.c
+index fb1d39324a65..60be3985a4ce 100644
+--- a/sound/soc/samsung/s3c24xx-i2s.c
++++ b/sound/soc/samsung/s3c24xx-i2s.c
+@@ -32,13 +32,13 @@
+ #include "s3c24xx-i2s.h"
+
+ static struct s3c_dma_params s3c24xx_i2s_pcm_stereo_out = {
+- .channel = DMACH_I2S_OUT,
++ .slave = (void *)(uintptr_t)DMACH_I2S_OUT,
+ .ch_name = "tx",
+ .dma_size = 2,
+ };
+
+ static struct s3c_dma_params s3c24xx_i2s_pcm_stereo_in = {
+- .channel = DMACH_I2S_IN,
++ .slave = (void *)(uintptr_t)DMACH_I2S_IN,
+ .ch_name = "rx",
+ .dma_size = 2,
+ };
+diff --git a/sound/soc/samsung/spdif.c b/sound/soc/samsung/spdif.c
+index d7d2e208f486..1de2686819cb 100644
+--- a/sound/soc/samsung/spdif.c
++++ b/sound/soc/samsung/spdif.c
+@@ -359,7 +359,7 @@ static const struct snd_soc_component_driver samsung_spdif_component = {
+ static int spdif_probe(struct platform_device *pdev)
+ {
+ struct s3c_audio_pdata *spdif_pdata;
+- struct resource *mem_res, *dma_res;
++ struct resource *mem_res;
+ struct samsung_spdif_info *spdif;
+ int ret;
+
+@@ -367,12 +367,6 @@ static int spdif_probe(struct platform_device *pdev)
+
+ dev_dbg(&pdev->dev, "Entered %s\n", __func__);
+
+- dma_res = platform_get_resource(pdev, IORESOURCE_DMA, 0);
+- if (!dma_res) {
+- dev_err(&pdev->dev, "Unable to get dma resource.\n");
+- return -ENXIO;
+- }
+-
+ mem_res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+ if (!mem_res) {
+ dev_err(&pdev->dev, "Unable to get register resource.\n");
+@@ -432,7 +426,7 @@ static int spdif_probe(struct platform_device *pdev)
+
+ spdif_stereo_out.dma_size = 2;
+ spdif_stereo_out.dma_addr = mem_res->start + DATA_OUTBUF;
+- spdif_stereo_out.channel = dma_res->start;
++ spdif_stereo_out.slave = spdif_pdata ? spdif_pdata->dma_playback : NULL;
+
+ spdif->dma_playback = &spdif_stereo_out;
+
+diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
+index 982c2df6d0b5..7a44d07c797d 100644
+--- a/sound/usb/quirks.c
++++ b/sound/usb/quirks.c
+@@ -138,6 +138,7 @@ static int create_fixed_stream_quirk(struct snd_usb_audio *chip,
+ usb_audio_err(chip, "cannot memdup\n");
+ return -ENOMEM;
+ }
++ INIT_LIST_HEAD(&fp->list);
+ if (fp->nr_rates > MAX_NR_RATES) {
+ kfree(fp);
+ return -EINVAL;
+@@ -155,23 +156,18 @@ static int create_fixed_stream_quirk(struct snd_usb_audio *chip,
+ stream = (fp->endpoint & USB_DIR_IN)
+ ? SNDRV_PCM_STREAM_CAPTURE : SNDRV_PCM_STREAM_PLAYBACK;
+ err = snd_usb_add_audio_stream(chip, stream, fp);
+- if (err < 0) {
+- kfree(fp);
+- kfree(rate_table);
+- return err;
+- }
++ if (err < 0)
++ goto error;
+ if (fp->iface != get_iface_desc(&iface->altsetting[0])->bInterfaceNumber ||
+ fp->altset_idx >= iface->num_altsetting) {
+- kfree(fp);
+- kfree(rate_table);
+- return -EINVAL;
++ err = -EINVAL;
++ goto error;
+ }
+ alts = &iface->altsetting[fp->altset_idx];
+ altsd = get_iface_desc(alts);
+ if (altsd->bNumEndpoints < 1) {
+- kfree(fp);
+- kfree(rate_table);
+- return -EINVAL;
++ err = -EINVAL;
++ goto error;
+ }
+
+ fp->protocol = altsd->bInterfaceProtocol;
+@@ -184,6 +180,12 @@ static int create_fixed_stream_quirk(struct snd_usb_audio *chip,
+ snd_usb_init_pitch(chip, fp->iface, alts, fp);
+ snd_usb_init_sample_rate(chip, fp->iface, alts, fp, fp->rate_max);
+ return 0;
++
++ error:
++ list_del(&fp->list); /* unlink for avoiding double-free */
++ kfree(fp);
++ kfree(rate_table);
++ return err;
+ }
+
+ static int create_auto_pcm_quirk(struct snd_usb_audio *chip,
+@@ -456,6 +458,7 @@ static int create_uaxx_quirk(struct snd_usb_audio *chip,
+ fp->ep_attr = get_endpoint(alts, 0)->bmAttributes;
+ fp->datainterval = 0;
+ fp->maxpacksize = le16_to_cpu(get_endpoint(alts, 0)->wMaxPacketSize);
++ INIT_LIST_HEAD(&fp->list);
+
+ switch (fp->maxpacksize) {
+ case 0x120:
+@@ -479,6 +482,7 @@ static int create_uaxx_quirk(struct snd_usb_audio *chip,
+ ? SNDRV_PCM_STREAM_CAPTURE : SNDRV_PCM_STREAM_PLAYBACK;
+ err = snd_usb_add_audio_stream(chip, stream, fp);
+ if (err < 0) {
++ list_del(&fp->list); /* unlink for avoiding double-free */
+ kfree(fp);
+ return err;
+ }
+diff --git a/sound/usb/stream.c b/sound/usb/stream.c
+index 310a3822d2b7..25e8075f9ea3 100644
+--- a/sound/usb/stream.c
++++ b/sound/usb/stream.c
+@@ -315,7 +315,9 @@ static struct snd_pcm_chmap_elem *convert_chmap(int channels, unsigned int bits,
+ /*
+ * add this endpoint to the chip instance.
+ * if a stream with the same endpoint already exists, append to it.
+- * if not, create a new pcm stream.
++ * if not, create a new pcm stream. note, fp is added to the substream
++ * fmt_list and will be freed on the chip instance release. do not free
++ * fp or do remove it from the substream fmt_list to avoid double-free.
+ */
+ int snd_usb_add_audio_stream(struct snd_usb_audio *chip,
+ int stream,
+@@ -668,6 +670,7 @@ int snd_usb_parse_audio_interface(struct snd_usb_audio *chip, int iface_no)
+ * (fp->maxpacksize & 0x7ff);
+ fp->attributes = parse_uac_endpoint_attributes(chip, alts, protocol, iface_no);
+ fp->clock = clock;
++ INIT_LIST_HEAD(&fp->list);
+
+ /* some quirks for attributes here */
+
+@@ -716,6 +719,7 @@ int snd_usb_parse_audio_interface(struct snd_usb_audio *chip, int iface_no)
+ dev_dbg(&dev->dev, "%u:%d: add audio endpoint %#x\n", iface_no, altno, fp->endpoint);
+ err = snd_usb_add_audio_stream(chip, stream, fp);
+ if (err < 0) {
++ list_del(&fp->list); /* unlink for avoiding double-free */
+ kfree(fp->rate_table);
+ kfree(fp->chmap);
+ kfree(fp);
+diff --git a/tools/perf/Documentation/perf-stat.txt b/tools/perf/Documentation/perf-stat.txt
+index 29ee857c09c6..6f9fbb44cd19 100644
+--- a/tools/perf/Documentation/perf-stat.txt
++++ b/tools/perf/Documentation/perf-stat.txt
+@@ -50,6 +50,14 @@ OPTIONS
+ --scale::
+ scale/normalize counter values
+
++-d::
++--detailed::
++ print more detailed statistics, can be specified up to 3 times
++
++ -d: detailed events, L1 and LLC data cache
++ -d -d: more detailed events, dTLB and iTLB events
++ -d -d -d: very detailed events, adding prefetch events
++
+ -r::
+ --repeat=<n>::
+ repeat command and print average + stddev (max: 100). 0 means forever.
+diff --git a/tools/perf/util/event.c b/tools/perf/util/event.c
+index 4af6b279e34a..da4c17cccb71 100644
+--- a/tools/perf/util/event.c
++++ b/tools/perf/util/event.c
+@@ -197,7 +197,7 @@ int perf_event__synthesize_mmap_events(struct perf_tool *tool,
+ strcpy(execname, "");
+
+ /* 00400000-0040c000 r-xp 00000000 fd:01 41038 /bin/cat */
+- n = sscanf(bf, "%"PRIx64"-%"PRIx64" %s %"PRIx64" %x:%x %u %s\n",
++ n = sscanf(bf, "%"PRIx64"-%"PRIx64" %s %"PRIx64" %x:%x %u %[^\n]\n",
+ &event->mmap2.start, &event->mmap2.len, prot,
+ &event->mmap2.pgoff, &event->mmap2.maj,
+ &event->mmap2.min,
+diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
+index 2c9d47fbc498..7d32b4e82e86 100644
+--- a/virt/kvm/kvm_main.c
++++ b/virt/kvm/kvm_main.c
+@@ -2559,7 +2559,7 @@ static long kvm_vm_ioctl(struct file *filp,
+ if (copy_from_user(&routing, argp, sizeof(routing)))
+ goto out;
+ r = -EINVAL;
+- if (routing.nr >= KVM_MAX_IRQ_ROUTES)
++ if (routing.nr > KVM_MAX_IRQ_ROUTES)
+ goto out;
+ if (routing.flags)
+ goto out;
^ permalink raw reply related [flat|nested] 67+ messages in thread
* [gentoo-commits] proj/linux-patches:3.18 commit in: /
@ 2016-07-15 14:46 Mike Pagano
0 siblings, 0 replies; 67+ messages in thread
From: Mike Pagano @ 2016-07-15 14:46 UTC (permalink / raw
To: gentoo-commits
commit: adba88cd57526f2f189fb86125bca5bfd9af3801
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Fri Jul 15 14:46:26 2016 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Fri Jul 15 14:46:26 2016 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=adba88cd
Revert commit 8f182270dfec mm/swap.c: flush lru pvecs on compound page arrival to fix OOM error.
0000_README | 4 ++++
1800_fix-lru-cache-add-oom-regression.patch | 17 +++++++++++++++++
2 files changed, 21 insertions(+)
diff --git a/0000_README b/0000_README
index 1863a89..35319e8 100644
--- a/0000_README
+++ b/0000_README
@@ -207,6 +207,10 @@ Patch: 2700_ThinkPad-30-brightness-control-fix.patch
From: Seth Forshee <seth.forshee@canonical.com>
Desc: ACPI: Disable Windows 8 compatibility for some Lenovo ThinkPads.
+Patch: 1800_fix-lru-cache-add-oom-regression.patch
+From: http://thread.gmane.org/gmane.linux.kernel.stable/184384
+Desc: Revert commit 8f182270dfec mm/swap.c: flush lru pvecs on compound page arrival to fix OOM error.
+
Patch: 2900_dev-root-proc-mount-fix.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=438380
Desc: Ensure that /dev/root doesn't appear in /proc/mounts when bootint without an initramfs.
diff --git a/1800_fix-lru-cache-add-oom-regression.patch b/1800_fix-lru-cache-add-oom-regression.patch
new file mode 100644
index 0000000..f1ca64b
--- /dev/null
+++ b/1800_fix-lru-cache-add-oom-regression.patch
@@ -0,0 +1,17 @@
+Revert commit 8f182270dfec mm/swap.c: flush lru pvecs on compound page arrival to fix OOM error.
+
+Signed-off-by: Steven Rostedt <rostedt <at> goodmis.org>
+---
+diff --git a/mm/swap.c b/mm/swap.c
+index b523f0a4cbfb..ab3b9c2dd783 100644
+--- a/mm/swap.c
++++ b/mm/swap.c
+ <at> <at> -631,7 +631,7 <at> <at> static void __lru_cache_add(struct page *page)
+ struct pagevec *pvec = &get_cpu_var(lru_add_pvec);
+
+ page_cache_get(page);
+- if (!pagevec_space(pvec) || PageCompound(page))
++ if (!pagevec_add(pvec, page) || PageCompound(page))
+ __pagevec_lru_add(pvec);
+ put_cpu_var(lru_add_pvec);
+ }
^ permalink raw reply related [flat|nested] 67+ messages in thread
* [gentoo-commits] proj/linux-patches:3.18 commit in: /
@ 2016-07-31 15:27 Mike Pagano
0 siblings, 0 replies; 67+ messages in thread
From: Mike Pagano @ 2016-07-31 15:27 UTC (permalink / raw
To: gentoo-commits
commit: 3d17cc6a46a7b90b3002170d6b61600732112f22
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Sun Jul 31 15:27:06 2016 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Sun Jul 31 15:27:06 2016 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=3d17cc6a
Linux patch 3.18.38
0000_README | 4 +
1037_linux-3.18.38.patch | 360 +++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 364 insertions(+)
diff --git a/0000_README b/0000_README
index 35319e8..b5306ef 100644
--- a/0000_README
+++ b/0000_README
@@ -191,6 +191,10 @@ Patch: 1036_linux-3.18.37.patch
From: http://www.kernel.org
Desc: Linux 3.18.37
+Patch: 1037_linux-3.18.38.patch
+From: http://www.kernel.org
+Desc: Linux 3.18.38
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1037_linux-3.18.38.patch b/1037_linux-3.18.38.patch
new file mode 100644
index 0000000..35be23d
--- /dev/null
+++ b/1037_linux-3.18.38.patch
@@ -0,0 +1,360 @@
+diff --git a/Makefile b/Makefile
+index e6953a43fe64..2940c7532661 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 18
+-SUBLEVEL = 37
++SUBLEVEL = 38
+ EXTRAVERSION =
+ NAME = Diseased Newt
+
+diff --git a/arch/mips/include/asm/pgtable.h b/arch/mips/include/asm/pgtable.h
+index 060fc2e50cd2..825dd09e80a4 100644
+--- a/arch/mips/include/asm/pgtable.h
++++ b/arch/mips/include/asm/pgtable.h
+@@ -596,7 +596,8 @@ static inline struct page *pmd_page(pmd_t pmd)
+
+ static inline pmd_t pmd_modify(pmd_t pmd, pgprot_t newprot)
+ {
+- pmd_val(pmd) = (pmd_val(pmd) & _PAGE_CHG_MASK) | pgprot_val(newprot);
++ pmd_val(pmd) = (pmd_val(pmd) & (_PAGE_CHG_MASK | _PAGE_HUGE)) |
++ (pgprot_val(newprot) & ~_PAGE_CHG_MASK);
+ return pmd;
+ }
+
+diff --git a/arch/powerpc/kernel/prom.c b/arch/powerpc/kernel/prom.c
+index 7a218ab7e941..269ae9b58d74 100644
+--- a/arch/powerpc/kernel/prom.c
++++ b/arch/powerpc/kernel/prom.c
+@@ -166,8 +166,7 @@ static struct ibm_pa_feature {
+ * we don't want to turn on TM here, so we use the *_COMP versions
+ * which are 0 if the kernel doesn't support TM.
+ */
+- {CPU_FTR_TM_COMP, 0, 0,
+- PPC_FEATURE2_HTM_COMP|PPC_FEATURE2_HTM_NOSC_COMP, 22, 0, 0},
++ {CPU_FTR_TM_COMP, 0, 0, PPC_FEATURE2_HTM_COMP, 22, 0, 0},
+ };
+
+ static void __init scan_features(unsigned long node, const unsigned char *ftrs,
+diff --git a/arch/x86/kernel/amd_nb.c b/arch/x86/kernel/amd_nb.c
+index f04dbb3069b8..29f0c55d6efc 100644
+--- a/arch/x86/kernel/amd_nb.c
++++ b/arch/x86/kernel/amd_nb.c
+@@ -69,8 +69,8 @@ int amd_cache_northbridges(void)
+ while ((misc = next_northbridge(misc, amd_nb_misc_ids)) != NULL)
+ i++;
+
+- if (i == 0)
+- return 0;
++ if (!i)
++ return -ENODEV;
+
+ nb = kzalloc(i * sizeof(struct amd_northbridge), GFP_KERNEL);
+ if (!nb)
+diff --git a/block/ioprio.c b/block/ioprio.c
+index 31666c92b46a..563435684c3c 100644
+--- a/block/ioprio.c
++++ b/block/ioprio.c
+@@ -149,8 +149,10 @@ static int get_task_ioprio(struct task_struct *p)
+ if (ret)
+ goto out;
+ ret = IOPRIO_PRIO_VALUE(IOPRIO_CLASS_NONE, IOPRIO_NORM);
++ task_lock(p);
+ if (p->io_context)
+ ret = p->io_context->ioprio;
++ task_unlock(p);
+ out:
+ return ret;
+ }
+diff --git a/drivers/s390/net/qeth_l2_main.c b/drivers/s390/net/qeth_l2_main.c
+index c2679bfe7f66..d23138b87af3 100644
+--- a/drivers/s390/net/qeth_l2_main.c
++++ b/drivers/s390/net/qeth_l2_main.c
+@@ -911,6 +911,7 @@ static void qeth_l2_remove_device(struct ccwgroup_device *cgdev)
+ qeth_l2_set_offline(cgdev);
+
+ if (card->dev) {
++ netif_napi_del(&card->napi);
+ unregister_netdev(card->dev);
+ card->dev = NULL;
+ }
+diff --git a/drivers/s390/net/qeth_l3_main.c b/drivers/s390/net/qeth_l3_main.c
+index afebb9709763..0513d11b741e 100644
+--- a/drivers/s390/net/qeth_l3_main.c
++++ b/drivers/s390/net/qeth_l3_main.c
+@@ -3337,6 +3337,7 @@ static void qeth_l3_remove_device(struct ccwgroup_device *cgdev)
+ qeth_l3_set_offline(cgdev);
+
+ if (card->dev) {
++ netif_napi_del(&card->napi);
+ unregister_netdev(card->dev);
+ card->dev = NULL;
+ }
+diff --git a/drivers/scsi/ipr.c b/drivers/scsi/ipr.c
+index f2e1b92eb314..105adb4cf6a8 100644
+--- a/drivers/scsi/ipr.c
++++ b/drivers/scsi/ipr.c
+@@ -9759,6 +9759,7 @@ static int ipr_probe_ioa(struct pci_dev *pdev,
+ ioa_cfg->intr_flag = IPR_USE_MSI;
+ else {
+ ioa_cfg->intr_flag = IPR_USE_LSI;
++ ioa_cfg->clear_isr = 1;
+ ioa_cfg->nvectors = 1;
+ dev_info(&pdev->dev, "Cannot enable MSI.\n");
+ }
+diff --git a/drivers/xen/xen-acpi-processor.c b/drivers/xen/xen-acpi-processor.c
+index 59fc190f1e92..b96e207bf250 100644
+--- a/drivers/xen/xen-acpi-processor.c
++++ b/drivers/xen/xen-acpi-processor.c
+@@ -423,36 +423,7 @@ upload:
+
+ return 0;
+ }
+-static int __init check_prereq(void)
+-{
+- struct cpuinfo_x86 *c = &cpu_data(0);
+-
+- if (!xen_initial_domain())
+- return -ENODEV;
+-
+- if (!acpi_gbl_FADT.smi_command)
+- return -ENODEV;
+-
+- if (c->x86_vendor == X86_VENDOR_INTEL) {
+- if (!cpu_has(c, X86_FEATURE_EST))
+- return -ENODEV;
+
+- return 0;
+- }
+- if (c->x86_vendor == X86_VENDOR_AMD) {
+- /* Copied from powernow-k8.h, can't include ../cpufreq/powernow
+- * as we get compile warnings for the static functions.
+- */
+-#define CPUID_FREQ_VOLT_CAPABILITIES 0x80000007
+-#define USE_HW_PSTATE 0x00000080
+- u32 eax, ebx, ecx, edx;
+- cpuid(CPUID_FREQ_VOLT_CAPABILITIES, &eax, &ebx, &ecx, &edx);
+- if ((edx & USE_HW_PSTATE) != USE_HW_PSTATE)
+- return -ENODEV;
+- return 0;
+- }
+- return -ENODEV;
+-}
+ /* acpi_perf_data is a pointer to percpu data. */
+ static struct acpi_processor_performance __percpu *acpi_perf_data;
+
+@@ -509,10 +480,10 @@ struct notifier_block xen_acpi_processor_resume_nb = {
+ static int __init xen_acpi_processor_init(void)
+ {
+ unsigned int i;
+- int rc = check_prereq();
++ int rc;
+
+- if (rc)
+- return rc;
++ if (!xen_initial_domain())
++ return -ENODEV;
+
+ nr_acpi_bits = get_max_acpi_id() + 1;
+ acpi_ids_done = kcalloc(BITS_TO_LONGS(nr_acpi_bits), sizeof(unsigned long), GFP_KERNEL);
+diff --git a/drivers/xen/xenbus/xenbus_dev_frontend.c b/drivers/xen/xenbus/xenbus_dev_frontend.c
+index 85534ea63555..531e76474983 100644
+--- a/drivers/xen/xenbus/xenbus_dev_frontend.c
++++ b/drivers/xen/xenbus/xenbus_dev_frontend.c
+@@ -316,26 +316,31 @@ static int xenbus_write_transaction(unsigned msg_type,
+ rc = -ENOMEM;
+ goto out;
+ }
++ } else {
++ list_for_each_entry(trans, &u->transactions, list)
++ if (trans->handle.id == u->u.msg.tx_id)
++ break;
++ if (&trans->list == &u->transactions)
++ return -ESRCH;
+ }
+
+ reply = xenbus_dev_request_and_reply(&u->u.msg);
+ if (IS_ERR(reply)) {
+- kfree(trans);
++ if (msg_type == XS_TRANSACTION_START)
++ kfree(trans);
+ rc = PTR_ERR(reply);
+ goto out;
+ }
+
+ if (msg_type == XS_TRANSACTION_START) {
+- trans->handle.id = simple_strtoul(reply, NULL, 0);
+-
+- list_add(&trans->list, &u->transactions);
+- } else if (msg_type == XS_TRANSACTION_END) {
+- list_for_each_entry(trans, &u->transactions, list)
+- if (trans->handle.id == u->u.msg.tx_id)
+- break;
+- BUG_ON(&trans->list == &u->transactions);
++ if (u->u.msg.type == XS_ERROR)
++ kfree(trans);
++ else {
++ trans->handle.id = simple_strtoul(reply, NULL, 0);
++ list_add(&trans->list, &u->transactions);
++ }
++ } else if (u->u.msg.type == XS_TRANSACTION_END) {
+ list_del(&trans->list);
+-
+ kfree(trans);
+ }
+
+diff --git a/drivers/xen/xenbus/xenbus_xs.c b/drivers/xen/xenbus/xenbus_xs.c
+index ba804f3d8278..ce65591b4168 100644
+--- a/drivers/xen/xenbus/xenbus_xs.c
++++ b/drivers/xen/xenbus/xenbus_xs.c
+@@ -250,9 +250,6 @@ void *xenbus_dev_request_and_reply(struct xsd_sockmsg *msg)
+
+ mutex_unlock(&xs_state.request_mutex);
+
+- if (IS_ERR(ret))
+- return ret;
+-
+ if ((msg->type == XS_TRANSACTION_END) ||
+ ((req_msg.type == XS_TRANSACTION_START) &&
+ (msg->type == XS_ERROR)))
+diff --git a/fs/ecryptfs/file.c b/fs/ecryptfs/file.c
+index 77a3db3791c7..c02f52cfe64a 100644
+--- a/fs/ecryptfs/file.c
++++ b/fs/ecryptfs/file.c
+@@ -177,6 +177,19 @@ out:
+ return rc;
+ }
+
++static int ecryptfs_mmap(struct file *file, struct vm_area_struct *vma)
++{
++ struct file *lower_file = ecryptfs_file_to_lower(file);
++ /*
++ * Don't allow mmap on top of file systems that don't support it
++ * natively. If FILESYSTEM_MAX_STACK_DEPTH > 2 or ecryptfs
++ * allows recursive mounting, this will need to be extended.
++ */
++ if (!lower_file->f_op->mmap)
++ return -ENODEV;
++ return generic_file_mmap(file, vma);
++}
++
+ /**
+ * ecryptfs_open
+ * @inode: inode speciying file to open
+@@ -374,7 +387,7 @@ const struct file_operations ecryptfs_main_fops = {
+ #ifdef CONFIG_COMPAT
+ .compat_ioctl = ecryptfs_compat_ioctl,
+ #endif
+- .mmap = generic_file_mmap,
++ .mmap = ecryptfs_mmap,
+ .open = ecryptfs_open,
+ .flush = ecryptfs_flush,
+ .release = ecryptfs_release,
+diff --git a/fs/ecryptfs/kthread.c b/fs/ecryptfs/kthread.c
+index 9b661a4ccee7..f1ea610362c6 100644
+--- a/fs/ecryptfs/kthread.c
++++ b/fs/ecryptfs/kthread.c
+@@ -25,7 +25,6 @@
+ #include <linux/slab.h>
+ #include <linux/wait.h>
+ #include <linux/mount.h>
+-#include <linux/file.h>
+ #include "ecryptfs_kernel.h"
+
+ struct ecryptfs_open_req {
+@@ -148,7 +147,7 @@ int ecryptfs_privileged_open(struct file **lower_file,
+ flags |= IS_RDONLY(lower_dentry->d_inode) ? O_RDONLY : O_RDWR;
+ (*lower_file) = dentry_open(&req.path, flags, cred);
+ if (!IS_ERR(*lower_file))
+- goto have_file;
++ goto out;
+ if ((flags & O_ACCMODE) == O_RDONLY) {
+ rc = PTR_ERR((*lower_file));
+ goto out;
+@@ -166,16 +165,8 @@ int ecryptfs_privileged_open(struct file **lower_file,
+ mutex_unlock(&ecryptfs_kthread_ctl.mux);
+ wake_up(&ecryptfs_kthread_ctl.wait);
+ wait_for_completion(&req.done);
+- if (IS_ERR(*lower_file)) {
++ if (IS_ERR(*lower_file))
+ rc = PTR_ERR(*lower_file);
+- goto out;
+- }
+-have_file:
+- if ((*lower_file)->f_op->mmap == NULL) {
+- fput(*lower_file);
+- *lower_file = NULL;
+- rc = -EMEDIUMTYPE;
+- }
+ out:
+ return rc;
+ }
+diff --git a/mm/swap.c b/mm/swap.c
+index 9ccec11ed3fb..e657ba642e5e 100644
+--- a/mm/swap.c
++++ b/mm/swap.c
+@@ -623,7 +623,7 @@ static void __lru_cache_add(struct page *page)
+ struct pagevec *pvec = &get_cpu_var(lru_add_pvec);
+
+ page_cache_get(page);
+- if (!pagevec_space(pvec) || PageCompound(page))
++ if (!pagevec_add(pvec, page) || PageCompound(page))
+ __pagevec_lru_add(pvec);
+ put_cpu_var(lru_add_pvec);
+ }
+diff --git a/sound/core/timer.c b/sound/core/timer.c
+index 2fd0dccf8505..5c769ea59b68 100644
+--- a/sound/core/timer.c
++++ b/sound/core/timer.c
+@@ -1959,6 +1959,7 @@ static ssize_t snd_timer_user_read(struct file *file, char __user *buffer,
+
+ qhead = tu->qhead++;
+ tu->qhead %= tu->queue_size;
++ tu->qused--;
+ spin_unlock_irq(&tu->qlock);
+
+ if (tu->tread) {
+@@ -1972,7 +1973,6 @@ static ssize_t snd_timer_user_read(struct file *file, char __user *buffer,
+ }
+
+ spin_lock_irq(&tu->qlock);
+- tu->qused--;
+ if (err < 0)
+ goto _error;
+ result += unit;
+diff --git a/sound/pci/au88x0/au88x0_core.c b/sound/pci/au88x0/au88x0_core.c
+index 72e81286b70e..8eae95acc09c 100644
+--- a/sound/pci/au88x0/au88x0_core.c
++++ b/sound/pci/au88x0/au88x0_core.c
+@@ -1442,9 +1442,8 @@ static int vortex_wtdma_bufshift(vortex_t * vortex, int wtdma)
+ int page, p, pp, delta, i;
+
+ page =
+- (hwread(vortex->mmio, VORTEX_WTDMA_STAT + (wtdma << 2)) &
+- WT_SUBBUF_MASK)
+- >> WT_SUBBUF_SHIFT;
++ (hwread(vortex->mmio, VORTEX_WTDMA_STAT + (wtdma << 2))
++ >> WT_SUBBUF_SHIFT) & WT_SUBBUF_MASK;
+ if (dma->nr_periods >= 4)
+ delta = (page - dma->period_real) & 3;
+ else {
+diff --git a/sound/pci/echoaudio/echoaudio.c b/sound/pci/echoaudio/echoaudio.c
+index 631aaa4046ad..3a1fe2c79b4a 100644
+--- a/sound/pci/echoaudio/echoaudio.c
++++ b/sound/pci/echoaudio/echoaudio.c
+@@ -2247,11 +2247,11 @@ static int snd_echo_resume(struct device *dev)
+
+ DE_INIT(("resume start\n"));
+ pci_restore_state(pci);
+- commpage_bak = kmalloc(sizeof(struct echoaudio), GFP_KERNEL);
++ commpage_bak = kmalloc(sizeof(*commpage), GFP_KERNEL);
+ if (commpage_bak == NULL)
+ return -ENOMEM;
+ commpage = chip->comm_page;
+- memcpy(commpage_bak, commpage, sizeof(struct comm_page));
++ memcpy(commpage_bak, commpage, sizeof(*commpage));
+
+ err = init_hw(chip, chip->pci->device, chip->pci->subsystem_device);
+ if (err < 0) {
^ permalink raw reply related [flat|nested] 67+ messages in thread
* [gentoo-commits] proj/linux-patches:3.18 commit in: /
@ 2016-08-10 12:54 Mike Pagano
0 siblings, 0 replies; 67+ messages in thread
From: Mike Pagano @ 2016-08-10 12:54 UTC (permalink / raw
To: gentoo-commits
commit: 08b477679e9842d315b7e455240f89e00bfdf694
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed Aug 10 12:54:25 2016 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed Aug 10 12:54:25 2016 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=08b47767
Linux patch 3.18.39
0000_README | 4 +
1038_linux-3.18.39.patch | 1354 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 1358 insertions(+)
diff --git a/0000_README b/0000_README
index b5306ef..2568ef1 100644
--- a/0000_README
+++ b/0000_README
@@ -195,6 +195,10 @@ Patch: 1037_linux-3.18.38.patch
From: http://www.kernel.org
Desc: Linux 3.18.38
+Patch: 1038_linux-3.18.39.patch
+From: http://www.kernel.org
+Desc: Linux 3.18.39
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1038_linux-3.18.39.patch b/1038_linux-3.18.39.patch
new file mode 100644
index 0000000..1812d18
--- /dev/null
+++ b/1038_linux-3.18.39.patch
@@ -0,0 +1,1354 @@
+diff --git a/Makefile b/Makefile
+index 2940c7532661..758b8efbb881 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 18
+-SUBLEVEL = 38
++SUBLEVEL = 39
+ EXTRAVERSION =
+ NAME = Diseased Newt
+
+diff --git a/arch/arm/mach-mvebu/coherency.c b/arch/arm/mach-mvebu/coherency.c
+index 01efe130912e..9e5c29df91f5 100644
+--- a/arch/arm/mach-mvebu/coherency.c
++++ b/arch/arm/mach-mvebu/coherency.c
+@@ -315,22 +315,16 @@ static void __init armada_370_coherency_init(struct device_node *np)
+ }
+
+ /*
+- * This ioremap hook is used on Armada 375/38x to ensure that PCIe
+- * memory areas are mapped as MT_UNCACHED instead of MT_DEVICE. This
+- * is needed as a workaround for a deadlock issue between the PCIe
+- * interface and the cache controller.
++ * This ioremap hook is used on Armada 375/38x to ensure that all MMIO
++ * areas are mapped as MT_UNCACHED instead of MT_DEVICE. This is
++ * needed for the HW I/O coherency mechanism to work properly without
++ * deadlock.
+ */
+ static void __iomem *
+-armada_pcie_wa_ioremap_caller(phys_addr_t phys_addr, size_t size,
+- unsigned int mtype, void *caller)
++armada_wa_ioremap_caller(phys_addr_t phys_addr, size_t size,
++ unsigned int mtype, void *caller)
+ {
+- struct resource pcie_mem;
+-
+- mvebu_mbus_get_pcie_mem_aperture(&pcie_mem);
+-
+- if (pcie_mem.start <= phys_addr && (phys_addr + size) <= pcie_mem.end)
+- mtype = MT_UNCACHED;
+-
++ mtype = MT_UNCACHED;
+ return __arm_ioremap_caller(phys_addr, size, mtype, caller);
+ }
+
+@@ -339,7 +333,7 @@ static void __init armada_375_380_coherency_init(struct device_node *np)
+ struct device_node *cache_dn;
+
+ coherency_cpu_base = of_iomap(np, 0);
+- arch_ioremap_caller = armada_pcie_wa_ioremap_caller;
++ arch_ioremap_caller = armada_wa_ioremap_caller;
+
+ /*
+ * We should switch the PL310 to I/O coherency mode only if
+diff --git a/arch/mips/kernel/setup.c b/arch/mips/kernel/setup.c
+index 2168355591f5..f3b635f86c39 100644
+--- a/arch/mips/kernel/setup.c
++++ b/arch/mips/kernel/setup.c
+@@ -685,9 +685,6 @@ static void __init arch_mem_init(char **cmdline_p)
+ for_each_memblock(reserved, reg)
+ if (reg->size != 0)
+ reserve_bootmem(reg->base, reg->size, BOOTMEM_DEFAULT);
+-
+- reserve_bootmem_region(__pa_symbol(&__nosave_begin),
+- __pa_symbol(&__nosave_end)); /* Reserve for hibernation */
+ }
+
+ static void __init resource_init(void)
+diff --git a/arch/sparc/mm/init_64.c b/arch/sparc/mm/init_64.c
+index 7dd57626da19..c30a5ec6498c 100644
+--- a/arch/sparc/mm/init_64.c
++++ b/arch/sparc/mm/init_64.c
+@@ -1300,18 +1300,10 @@ static int __init numa_parse_sun4u(void)
+
+ static int __init bootmem_init_numa(void)
+ {
+- int i, j;
+ int err = -1;
+
+ numadbg("bootmem_init_numa()\n");
+
+- /* Some sane defaults for numa latency values */
+- for (i = 0; i < MAX_NUMNODES; i++) {
+- for (j = 0; j < MAX_NUMNODES; j++)
+- numa_latency[i][j] = (i == j) ?
+- LOCAL_DISTANCE : REMOTE_DISTANCE;
+- }
+-
+ if (numa_enabled) {
+ if (tlb_type == hypervisor)
+ err = numa_parse_mdesc();
+diff --git a/arch/x86/kernel/early-quirks.c b/arch/x86/kernel/early-quirks.c
+index 2e1a6853e00c..2fa494f59828 100644
+--- a/arch/x86/kernel/early-quirks.c
++++ b/arch/x86/kernel/early-quirks.c
+@@ -11,7 +11,11 @@
+
+ #include <linux/pci.h>
+ #include <linux/acpi.h>
++#include <linux/delay.h>
++#include <linux/dmi.h>
+ #include <linux/pci_ids.h>
++#include <linux/bcma/bcma.h>
++#include <linux/bcma/bcma_regs.h>
+ #include <drm/i915_drm.h>
+ #include <asm/pci-direct.h>
+ #include <asm/dma.h>
+@@ -21,6 +25,9 @@
+ #include <asm/iommu.h>
+ #include <asm/gart.h>
+ #include <asm/irq_remapping.h>
++#include <asm/early_ioremap.h>
++
++#define dev_err(msg) pr_err("pci 0000:%02x:%02x.%d: %s", bus, slot, func, msg)
+
+ static void __init fix_hypertransport_config(int num, int slot, int func)
+ {
+@@ -76,6 +83,13 @@ static void __init nvidia_bugs(int num, int slot, int func)
+ #ifdef CONFIG_ACPI
+ #ifdef CONFIG_X86_IO_APIC
+ /*
++ * Only applies to Nvidia root ports (bus 0) and not to
++ * Nvidia graphics cards with PCI ports on secondary buses.
++ */
++ if (num)
++ return;
++
++ /*
+ * All timer overrides on Nvidia are
+ * wrong unless HPET is enabled.
+ * Unfortunately that's not true on many Asus boards.
+@@ -565,6 +579,61 @@ static void __init force_disable_hpet(int num, int slot, int func)
+ #endif
+ }
+
++#define BCM4331_MMIO_SIZE 16384
++#define BCM4331_PM_CAP 0x40
++#define bcma_aread32(reg) ioread32(mmio + 1 * BCMA_CORE_SIZE + reg)
++#define bcma_awrite32(reg, val) iowrite32(val, mmio + 1 * BCMA_CORE_SIZE + reg)
++
++static void __init apple_airport_reset(int bus, int slot, int func)
++{
++ void __iomem *mmio;
++ u16 pmcsr;
++ u64 addr;
++ int i;
++
++ if (!dmi_match(DMI_SYS_VENDOR, "Apple Inc."))
++ return;
++
++ /* Card may have been put into PCI_D3hot by grub quirk */
++ pmcsr = read_pci_config_16(bus, slot, func, BCM4331_PM_CAP + PCI_PM_CTRL);
++
++ if ((pmcsr & PCI_PM_CTRL_STATE_MASK) != PCI_D0) {
++ pmcsr &= ~PCI_PM_CTRL_STATE_MASK;
++ write_pci_config_16(bus, slot, func, BCM4331_PM_CAP + PCI_PM_CTRL, pmcsr);
++ mdelay(10);
++
++ pmcsr = read_pci_config_16(bus, slot, func, BCM4331_PM_CAP + PCI_PM_CTRL);
++ if ((pmcsr & PCI_PM_CTRL_STATE_MASK) != PCI_D0) {
++ dev_err("Cannot power up Apple AirPort card\n");
++ return;
++ }
++ }
++
++ addr = read_pci_config(bus, slot, func, PCI_BASE_ADDRESS_0);
++ addr |= (u64)read_pci_config(bus, slot, func, PCI_BASE_ADDRESS_1) << 32;
++ addr &= PCI_BASE_ADDRESS_MEM_MASK;
++
++ mmio = early_ioremap(addr, BCM4331_MMIO_SIZE);
++ if (!mmio) {
++ dev_err("Cannot iomap Apple AirPort card\n");
++ return;
++ }
++
++ pr_info("Resetting Apple AirPort card (left enabled by EFI)\n");
++
++ for (i = 0; bcma_aread32(BCMA_RESET_ST) && i < 30; i++)
++ udelay(10);
++
++ bcma_awrite32(BCMA_RESET_CTL, BCMA_RESET_CTL_RESET);
++ bcma_aread32(BCMA_RESET_CTL);
++ udelay(1);
++
++ bcma_awrite32(BCMA_RESET_CTL, 0);
++ bcma_aread32(BCMA_RESET_CTL);
++ udelay(10);
++
++ early_iounmap(mmio, BCM4331_MMIO_SIZE);
++}
+
+ #define QFLAG_APPLY_ONCE 0x1
+ #define QFLAG_APPLIED 0x2
+@@ -578,12 +647,6 @@ struct chipset {
+ void (*f)(int num, int slot, int func);
+ };
+
+-/*
+- * Only works for devices on the root bus. If you add any devices
+- * not on bus 0 readd another loop level in early_quirks(). But
+- * be careful because at least the Nvidia quirk here relies on
+- * only matching on bus 0.
+- */
+ static struct chipset early_qrk[] __initdata = {
+ { PCI_VENDOR_ID_NVIDIA, PCI_ANY_ID,
+ PCI_CLASS_BRIDGE_PCI, PCI_ANY_ID, QFLAG_APPLY_ONCE, nvidia_bugs },
+@@ -609,9 +672,13 @@ static struct chipset early_qrk[] __initdata = {
+ */
+ { PCI_VENDOR_ID_INTEL, 0x0f00,
+ PCI_CLASS_BRIDGE_HOST, PCI_ANY_ID, 0, force_disable_hpet},
++ { PCI_VENDOR_ID_BROADCOM, 0x4331,
++ PCI_CLASS_NETWORK_OTHER, PCI_ANY_ID, 0, apple_airport_reset},
+ {}
+ };
+
++static void __init early_pci_scan_bus(int bus);
++
+ /**
+ * check_dev_quirk - apply early quirks to a given PCI device
+ * @num: bus number
+@@ -620,7 +687,7 @@ static struct chipset early_qrk[] __initdata = {
+ *
+ * Check the vendor & device ID against the early quirks table.
+ *
+- * If the device is single function, let early_quirks() know so we don't
++ * If the device is single function, let early_pci_scan_bus() know so we don't
+ * poke at this device again.
+ */
+ static int __init check_dev_quirk(int num, int slot, int func)
+@@ -629,6 +696,7 @@ static int __init check_dev_quirk(int num, int slot, int func)
+ u16 vendor;
+ u16 device;
+ u8 type;
++ u8 sec;
+ int i;
+
+ class = read_pci_config_16(num, slot, func, PCI_CLASS_DEVICE);
+@@ -656,25 +724,36 @@ static int __init check_dev_quirk(int num, int slot, int func)
+
+ type = read_pci_config_byte(num, slot, func,
+ PCI_HEADER_TYPE);
++
++ if ((type & 0x7f) == PCI_HEADER_TYPE_BRIDGE) {
++ sec = read_pci_config_byte(num, slot, func, PCI_SECONDARY_BUS);
++ if (sec > num)
++ early_pci_scan_bus(sec);
++ }
++
+ if (!(type & 0x80))
+ return -1;
+
+ return 0;
+ }
+
+-void __init early_quirks(void)
++static void __init early_pci_scan_bus(int bus)
+ {
+ int slot, func;
+
+- if (!early_pci_allowed())
+- return;
+-
+ /* Poor man's PCI discovery */
+- /* Only scan the root bus */
+ for (slot = 0; slot < 32; slot++)
+ for (func = 0; func < 8; func++) {
+ /* Only probe function 0 on single fn devices */
+- if (check_dev_quirk(0, slot, func))
++ if (check_dev_quirk(bus, slot, func))
+ break;
+ }
+ }
++
++void __init early_quirks(void)
++{
++ if (!early_pci_allowed())
++ return;
++
++ early_pci_scan_bus(0);
++}
+diff --git a/drivers/bcma/bcma_private.h b/drivers/bcma/bcma_private.h
+index b6412b2d748d..150def7afc17 100644
+--- a/drivers/bcma/bcma_private.h
++++ b/drivers/bcma/bcma_private.h
+@@ -8,8 +8,6 @@
+ #include <linux/bcma/bcma.h>
+ #include <linux/delay.h>
+
+-#define BCMA_CORE_SIZE 0x1000
+-
+ #define bcma_err(bus, fmt, ...) \
+ pr_err("bus%d: " fmt, (bus)->num, ##__VA_ARGS__)
+ #define bcma_warn(bus, fmt, ...) \
+diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c
+index d395b0bef73b..7370202c2022 100644
+--- a/drivers/gpu/drm/ttm/ttm_bo.c
++++ b/drivers/gpu/drm/ttm/ttm_bo.c
+@@ -1000,9 +1000,9 @@ out_unlock:
+ return ret;
+ }
+
+-static bool ttm_bo_mem_compat(struct ttm_placement *placement,
+- struct ttm_mem_reg *mem,
+- uint32_t *new_flags)
++bool ttm_bo_mem_compat(struct ttm_placement *placement,
++ struct ttm_mem_reg *mem,
++ uint32_t *new_flags)
+ {
+ int i;
+
+@@ -1034,6 +1034,7 @@ static bool ttm_bo_mem_compat(struct ttm_placement *placement,
+
+ return false;
+ }
++EXPORT_SYMBOL(ttm_bo_mem_compat);
+
+ int ttm_bo_validate(struct ttm_buffer_object *bo,
+ struct ttm_placement *placement,
+diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c
+index fc55f0d15b70..7b41d543a41f 100644
+--- a/drivers/input/joystick/xpad.c
++++ b/drivers/input/joystick/xpad.c
+@@ -1006,6 +1006,9 @@ static int xpad_probe(struct usb_interface *intf, const struct usb_device_id *id
+ int ep_irq_in_idx;
+ int i, error;
+
++ if (intf->cur_altsetting->desc.bNumEndpoints != 2)
++ return -ENODEV;
++
+ for (i = 0; xpad_device[i].idVendor; i++) {
+ if ((le16_to_cpu(udev->descriptor.idVendor) == xpad_device[i].idVendor) &&
+ (le16_to_cpu(udev->descriptor.idProduct) == xpad_device[i].idProduct))
+diff --git a/drivers/media/usb/airspy/airspy.c b/drivers/media/usb/airspy/airspy.c
+index 4069234abed5..cc92ae7ba462 100644
+--- a/drivers/media/usb/airspy/airspy.c
++++ b/drivers/media/usb/airspy/airspy.c
+@@ -1072,7 +1072,7 @@ static int airspy_probe(struct usb_interface *intf,
+ if (ret) {
+ dev_err(s->dev, "Failed to register as video device (%d)\n",
+ ret);
+- goto err_unregister_v4l2_dev;
++ goto err_free_controls;
+ }
+ dev_info(s->dev, "Registered as %s\n",
+ video_device_node_name(&s->vdev));
+@@ -1081,7 +1081,6 @@ static int airspy_probe(struct usb_interface *intf,
+
+ err_free_controls:
+ v4l2_ctrl_handler_free(&s->hdl);
+-err_unregister_v4l2_dev:
+ v4l2_device_unregister(&s->v4l2_dev);
+ err_free_mem:
+ kfree(s);
+diff --git a/drivers/mmc/card/block.c b/drivers/mmc/card/block.c
+index 5027ae76fde8..4078ebe81c45 100644
+--- a/drivers/mmc/card/block.c
++++ b/drivers/mmc/card/block.c
+@@ -1669,8 +1669,8 @@ static void mmc_blk_packed_hdr_wrq_prep(struct mmc_queue_req *mqrq,
+
+ packed_cmd_hdr = packed->cmd_hdr;
+ memset(packed_cmd_hdr, 0, sizeof(packed->cmd_hdr));
+- packed_cmd_hdr[0] = (packed->nr_entries << 16) |
+- (PACKED_CMD_WR << 8) | PACKED_CMD_VER;
++ packed_cmd_hdr[0] = cpu_to_le32((packed->nr_entries << 16) |
++ (PACKED_CMD_WR << 8) | PACKED_CMD_VER);
+ hdr_blocks = mmc_large_sector(card) ? 8 : 1;
+
+ /*
+@@ -1684,14 +1684,14 @@ static void mmc_blk_packed_hdr_wrq_prep(struct mmc_queue_req *mqrq,
+ ((brq->data.blocks * brq->data.blksz) >=
+ card->ext_csd.data_tag_unit_size);
+ /* Argument of CMD23 */
+- packed_cmd_hdr[(i * 2)] =
++ packed_cmd_hdr[(i * 2)] = cpu_to_le32(
+ (do_rel_wr ? MMC_CMD23_ARG_REL_WR : 0) |
+ (do_data_tag ? MMC_CMD23_ARG_TAG_REQ : 0) |
+- blk_rq_sectors(prq);
++ blk_rq_sectors(prq));
+ /* Argument of CMD18 or CMD25 */
+- packed_cmd_hdr[((i * 2)) + 1] =
++ packed_cmd_hdr[((i * 2)) + 1] = cpu_to_le32(
+ mmc_card_blockaddr(card) ?
+- blk_rq_pos(prq) : blk_rq_pos(prq) << 9;
++ blk_rq_pos(prq) : blk_rq_pos(prq) << 9);
+ packed->blocks += blk_rq_sectors(prq);
+ i++;
+ }
+diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c
+index 3bd7e3d8fe5a..e6a7b50a4781 100644
+--- a/drivers/net/ethernet/marvell/mvneta.c
++++ b/drivers/net/ethernet/marvell/mvneta.c
+@@ -216,7 +216,7 @@
+ /* Various constants */
+
+ /* Coalescing */
+-#define MVNETA_TXDONE_COAL_PKTS 1
++#define MVNETA_TXDONE_COAL_PKTS 0 /* interrupt per packet */
+ #define MVNETA_RX_COAL_PKTS 32
+ #define MVNETA_RX_COAL_USEC 100
+
+diff --git a/drivers/pps/clients/pps_parport.c b/drivers/pps/clients/pps_parport.c
+index 38a8bbe74810..83797d89c30f 100644
+--- a/drivers/pps/clients/pps_parport.c
++++ b/drivers/pps/clients/pps_parport.c
+@@ -195,7 +195,7 @@ static void parport_detach(struct parport *port)
+ struct pps_client_pp *device;
+
+ /* FIXME: oooh, this is ugly! */
+- if (strcmp(pardev->name, KBUILD_MODNAME))
++ if (!pardev || strcmp(pardev->name, KBUILD_MODNAME))
+ /* not our port */
+ return;
+
+diff --git a/drivers/tty/vt/keyboard.c b/drivers/tty/vt/keyboard.c
+index c039cfea5b11..15c22d00df03 100644
+--- a/drivers/tty/vt/keyboard.c
++++ b/drivers/tty/vt/keyboard.c
+@@ -365,34 +365,22 @@ static void to_utf8(struct vc_data *vc, uint c)
+
+ static void do_compute_shiftstate(void)
+ {
+- unsigned int i, j, k, sym, val;
++ unsigned int k, sym, val;
+
+ shift_state = 0;
+ memset(shift_down, 0, sizeof(shift_down));
+
+- for (i = 0; i < ARRAY_SIZE(key_down); i++) {
+-
+- if (!key_down[i])
++ for_each_set_bit(k, key_down, min(NR_KEYS, KEY_CNT)) {
++ sym = U(key_maps[0][k]);
++ if (KTYP(sym) != KT_SHIFT && KTYP(sym) != KT_SLOCK)
+ continue;
+
+- k = i * BITS_PER_LONG;
+-
+- for (j = 0; j < BITS_PER_LONG; j++, k++) {
+-
+- if (!test_bit(k, key_down))
+- continue;
++ val = KVAL(sym);
++ if (val == KVAL(K_CAPSSHIFT))
++ val = KVAL(K_SHIFT);
+
+- sym = U(key_maps[0][k]);
+- if (KTYP(sym) != KT_SHIFT && KTYP(sym) != KT_SLOCK)
+- continue;
+-
+- val = KVAL(sym);
+- if (val == KVAL(K_CAPSSHIFT))
+- val = KVAL(K_SHIFT);
+-
+- shift_down[val]++;
+- shift_state |= (1 << val);
+- }
++ shift_down[val]++;
++ shift_state |= BIT(val);
+ }
+ }
+
+diff --git a/fs/overlayfs/dir.c b/fs/overlayfs/dir.c
+index ddb1dc97859e..d124faf087f9 100644
+--- a/fs/overlayfs/dir.c
++++ b/fs/overlayfs/dir.c
+@@ -505,6 +505,7 @@ static int ovl_remove_and_whiteout(struct dentry *dentry, bool is_dir)
+ struct dentry *upper;
+ struct dentry *opaquedir = NULL;
+ int err;
++ int flags = 0;
+
+ if (is_dir) {
+ opaquedir = ovl_check_empty_and_clear(dentry);
+@@ -517,46 +518,39 @@ static int ovl_remove_and_whiteout(struct dentry *dentry, bool is_dir)
+ if (err)
+ goto out_dput;
+
+- whiteout = ovl_whiteout(workdir, dentry);
+- err = PTR_ERR(whiteout);
+- if (IS_ERR(whiteout))
++ upper = lookup_one_len(dentry->d_name.name, upperdir,
++ dentry->d_name.len);
++ err = PTR_ERR(upper);
++ if (IS_ERR(upper))
+ goto out_unlock;
+
+- upper = ovl_dentry_upper(dentry);
+- if (!upper) {
+- upper = lookup_one_len(dentry->d_name.name, upperdir,
+- dentry->d_name.len);
+- err = PTR_ERR(upper);
+- if (IS_ERR(upper))
+- goto kill_whiteout;
+-
+- err = ovl_do_rename(wdir, whiteout, udir, upper, 0);
+- dput(upper);
+- if (err)
+- goto kill_whiteout;
+- } else {
+- int flags = 0;
++ err = -ESTALE;
++ if ((opaquedir && upper != opaquedir) ||
++ (!opaquedir && ovl_dentry_upper(dentry) &&
++ upper != ovl_dentry_upper(dentry))) {
++ goto out_dput_upper;
++ }
+
+- if (opaquedir)
+- upper = opaquedir;
+- err = -ESTALE;
+- if (upper->d_parent != upperdir)
+- goto kill_whiteout;
++ whiteout = ovl_whiteout(workdir, dentry);
++ err = PTR_ERR(whiteout);
++ if (IS_ERR(whiteout))
++ goto out_dput_upper;
+
+- if (is_dir)
+- flags |= RENAME_EXCHANGE;
++ if (d_is_dir(upper))
++ flags = RENAME_EXCHANGE;
+
+- err = ovl_do_rename(wdir, whiteout, udir, upper, flags);
+- if (err)
+- goto kill_whiteout;
++ err = ovl_do_rename(wdir, whiteout, udir, upper, flags);
++ if (err)
++ goto kill_whiteout;
++ if (flags)
++ ovl_cleanup(wdir, upper);
+
+- if (is_dir)
+- ovl_cleanup(wdir, upper);
+- }
+ ovl_dentry_version_inc(dentry->d_parent);
+ out_d_drop:
+ d_drop(dentry);
+ dput(whiteout);
++out_dput_upper:
++ dput(upper);
+ out_unlock:
+ unlock_rename(workdir, upperdir);
+ out_dput:
+diff --git a/fs/overlayfs/inode.c b/fs/overlayfs/inode.c
+index e696ba32a2b5..fefce48e0f31 100644
+--- a/fs/overlayfs/inode.c
++++ b/fs/overlayfs/inode.c
+@@ -54,6 +54,10 @@ int ovl_setattr(struct dentry *dentry, struct iattr *attr)
+ upperdentry = ovl_dentry_upper(dentry);
+
+ mutex_lock(&upperdentry->d_inode->i_mutex);
++
++ if (attr->ia_valid & (ATTR_KILL_SUID|ATTR_KILL_SGID))
++ attr->ia_valid &= ~ATTR_MODE;
++
+ err = notify_change(upperdentry, attr, NULL);
+ if (!err)
+ ovl_copyattr(upperdentry->d_inode, dentry->d_inode);
+@@ -395,12 +399,11 @@ struct inode *ovl_new_inode(struct super_block *sb, umode_t mode,
+ if (!inode)
+ return NULL;
+
+- mode &= S_IFMT;
+-
+ inode->i_ino = get_next_ino();
+ inode->i_mode = mode;
+ inode->i_flags |= S_NOATIME | S_NOCMTIME;
+
++ mode &= S_IFMT;
+ switch (mode) {
+ case S_IFDIR:
+ inode->i_private = oe;
+diff --git a/fs/overlayfs/overlayfs.h b/fs/overlayfs/overlayfs.h
+index 1714fcc7603e..00eb848faad8 100644
+--- a/fs/overlayfs/overlayfs.h
++++ b/fs/overlayfs/overlayfs.h
+@@ -173,6 +173,7 @@ static inline void ovl_copyattr(struct inode *from, struct inode *to)
+ {
+ to->i_uid = from->i_uid;
+ to->i_gid = from->i_gid;
++ to->i_mode = from->i_mode;
+ }
+
+ /* dir.c */
+diff --git a/include/drm/ttm/ttm_bo_api.h b/include/drm/ttm/ttm_bo_api.h
+index 0ccf7f267ff9..3f3367c42896 100644
+--- a/include/drm/ttm/ttm_bo_api.h
++++ b/include/drm/ttm/ttm_bo_api.h
+@@ -316,6 +316,20 @@ ttm_bo_reference(struct ttm_buffer_object *bo)
+ */
+ extern int ttm_bo_wait(struct ttm_buffer_object *bo, bool lazy,
+ bool interruptible, bool no_wait);
++
++/**
++ * ttm_bo_mem_compat - Check if proposed placement is compatible with a bo
++ *
++ * @placement: Return immediately if buffer is busy.
++ * @mem: The struct ttm_mem_reg indicating the region where the bo resides
++ * @new_flags: Describes compatible placement found
++ *
++ * Returns true if the placement is compatible
++ */
++extern bool ttm_bo_mem_compat(struct ttm_placement *placement,
++ struct ttm_mem_reg *mem,
++ uint32_t *new_flags);
++
+ /**
+ * ttm_bo_validate
+ *
+diff --git a/include/linux/bcma/bcma.h b/include/linux/bcma/bcma.h
+index 729f48e6b20b..828198db5614 100644
+--- a/include/linux/bcma/bcma.h
++++ b/include/linux/bcma/bcma.h
+@@ -154,6 +154,7 @@ struct bcma_host_ops {
+ #define BCMA_CORE_DEFAULT 0xFFF
+
+ #define BCMA_MAX_NR_CORES 16
++#define BCMA_CORE_SIZE 0x1000
+
+ /* Chip IDs of PCIe devices */
+ #define BCMA_CHIP_ID_BCM4313 0x4313
+diff --git a/include/linux/netfilter/x_tables.h b/include/linux/netfilter/x_tables.h
+index 7741efa43b35..cc615e273f80 100644
+--- a/include/linux/netfilter/x_tables.h
++++ b/include/linux/netfilter/x_tables.h
+@@ -243,6 +243,10 @@ int xt_check_entry_offsets(const void *base, const char *elems,
+ unsigned int target_offset,
+ unsigned int next_offset);
+
++unsigned int *xt_alloc_entry_offsets(unsigned int size);
++bool xt_find_jump_offset(const unsigned int *offsets,
++ unsigned int target, unsigned int size);
++
+ int xt_check_match(struct xt_mtchk_param *, unsigned int size, u_int8_t proto,
+ bool inv_proto);
+ int xt_check_target(struct xt_tgchk_param *, unsigned int size, u_int8_t proto,
+diff --git a/include/linux/radix-tree.h b/include/linux/radix-tree.h
+index 5d5174b59802..673dee29a9b9 100644
+--- a/include/linux/radix-tree.h
++++ b/include/linux/radix-tree.h
+@@ -382,6 +382,7 @@ static inline __must_check
+ void **radix_tree_iter_retry(struct radix_tree_iter *iter)
+ {
+ iter->next_index = iter->index;
++ iter->tags = 0;
+ return NULL;
+ }
+
+diff --git a/kernel/time/posix-cpu-timers.c b/kernel/time/posix-cpu-timers.c
+index a16b67859e2a..731d7a342670 100644
+--- a/kernel/time/posix-cpu-timers.c
++++ b/kernel/time/posix-cpu-timers.c
+@@ -784,6 +784,7 @@ static void posix_cpu_timer_get(struct k_itimer *timer, struct itimerspec *itp)
+ timer->it.cpu.expires = 0;
+ sample_to_timespec(timer->it_clock, timer->it.cpu.expires,
+ &itp->it_value);
++ return;
+ } else {
+ cpu_timer_sample_group(timer->it_clock, p, &now);
+ unlock_task_sighand(p, &flags);
+diff --git a/net/ceph/osdmap.c b/net/ceph/osdmap.c
+index b8c3fde5b04f..60441b6a9546 100644
+--- a/net/ceph/osdmap.c
++++ b/net/ceph/osdmap.c
+@@ -1167,6 +1167,115 @@ struct ceph_osdmap *ceph_osdmap_decode(void **p, void *end)
+ }
+
+ /*
++ * Encoding order is (new_up_client, new_state, new_weight). Need to
++ * apply in the (new_weight, new_state, new_up_client) order, because
++ * an incremental map may look like e.g.
++ *
++ * new_up_client: { osd=6, addr=... } # set osd_state and addr
++ * new_state: { osd=6, xorstate=EXISTS } # clear osd_state
++ */
++static int decode_new_up_state_weight(void **p, void *end,
++ struct ceph_osdmap *map)
++{
++ void *new_up_client;
++ void *new_state;
++ void *new_weight_end;
++ u32 len;
++
++ new_up_client = *p;
++ ceph_decode_32_safe(p, end, len, e_inval);
++ len *= sizeof(u32) + sizeof(struct ceph_entity_addr);
++ ceph_decode_need(p, end, len, e_inval);
++ *p += len;
++
++ new_state = *p;
++ ceph_decode_32_safe(p, end, len, e_inval);
++ len *= sizeof(u32) + sizeof(u8);
++ ceph_decode_need(p, end, len, e_inval);
++ *p += len;
++
++ /* new_weight */
++ ceph_decode_32_safe(p, end, len, e_inval);
++ while (len--) {
++ s32 osd;
++ u32 w;
++
++ ceph_decode_need(p, end, 2*sizeof(u32), e_inval);
++ osd = ceph_decode_32(p);
++ w = ceph_decode_32(p);
++ BUG_ON(osd >= map->max_osd);
++ pr_info("osd%d weight 0x%x %s\n", osd, w,
++ w == CEPH_OSD_IN ? "(in)" :
++ (w == CEPH_OSD_OUT ? "(out)" : ""));
++ map->osd_weight[osd] = w;
++
++ /*
++ * If we are marking in, set the EXISTS, and clear the
++ * AUTOOUT and NEW bits.
++ */
++ if (w) {
++ map->osd_state[osd] |= CEPH_OSD_EXISTS;
++ map->osd_state[osd] &= ~(CEPH_OSD_AUTOOUT |
++ CEPH_OSD_NEW);
++ }
++ }
++ new_weight_end = *p;
++
++ /* new_state (up/down) */
++ *p = new_state;
++ len = ceph_decode_32(p);
++ while (len--) {
++ s32 osd;
++ u8 xorstate;
++ int ret;
++
++ osd = ceph_decode_32(p);
++ xorstate = ceph_decode_8(p);
++ if (xorstate == 0)
++ xorstate = CEPH_OSD_UP;
++ BUG_ON(osd >= map->max_osd);
++ if ((map->osd_state[osd] & CEPH_OSD_UP) &&
++ (xorstate & CEPH_OSD_UP))
++ pr_info("osd%d down\n", osd);
++ if ((map->osd_state[osd] & CEPH_OSD_EXISTS) &&
++ (xorstate & CEPH_OSD_EXISTS)) {
++ pr_info("osd%d does not exist\n", osd);
++ map->osd_weight[osd] = CEPH_OSD_IN;
++ ret = set_primary_affinity(map, osd,
++ CEPH_OSD_DEFAULT_PRIMARY_AFFINITY);
++ if (ret)
++ return ret;
++ memset(map->osd_addr + osd, 0, sizeof(*map->osd_addr));
++ map->osd_state[osd] = 0;
++ } else {
++ map->osd_state[osd] ^= xorstate;
++ }
++ }
++
++ /* new_up_client */
++ *p = new_up_client;
++ len = ceph_decode_32(p);
++ while (len--) {
++ s32 osd;
++ struct ceph_entity_addr addr;
++
++ osd = ceph_decode_32(p);
++ ceph_decode_copy(p, &addr, sizeof(addr));
++ ceph_decode_addr(&addr);
++ BUG_ON(osd >= map->max_osd);
++ pr_info("osd%d up\n", osd);
++ map->osd_state[osd] |= CEPH_OSD_EXISTS | CEPH_OSD_UP;
++ map->osd_addr[osd] = addr;
++ }
++
++ *p = new_weight_end;
++ return 0;
++
++e_inval:
++ return -EINVAL;
++}
++
++/*
+ * decode and apply an incremental map update.
+ */
+ struct ceph_osdmap *osdmap_apply_incremental(void **p, void *end,
+@@ -1265,49 +1374,10 @@ struct ceph_osdmap *osdmap_apply_incremental(void **p, void *end,
+ __remove_pg_pool(&map->pg_pools, pi);
+ }
+
+- /* new_up */
+- ceph_decode_32_safe(p, end, len, e_inval);
+- while (len--) {
+- u32 osd;
+- struct ceph_entity_addr addr;
+- ceph_decode_32_safe(p, end, osd, e_inval);
+- ceph_decode_copy_safe(p, end, &addr, sizeof(addr), e_inval);
+- ceph_decode_addr(&addr);
+- pr_info("osd%d up\n", osd);
+- BUG_ON(osd >= map->max_osd);
+- map->osd_state[osd] |= CEPH_OSD_UP;
+- map->osd_addr[osd] = addr;
+- }
+-
+- /* new_state */
+- ceph_decode_32_safe(p, end, len, e_inval);
+- while (len--) {
+- u32 osd;
+- u8 xorstate;
+- ceph_decode_32_safe(p, end, osd, e_inval);
+- xorstate = **(u8 **)p;
+- (*p)++; /* clean flag */
+- if (xorstate == 0)
+- xorstate = CEPH_OSD_UP;
+- if (xorstate & CEPH_OSD_UP)
+- pr_info("osd%d down\n", osd);
+- if (osd < map->max_osd)
+- map->osd_state[osd] ^= xorstate;
+- }
+-
+- /* new_weight */
+- ceph_decode_32_safe(p, end, len, e_inval);
+- while (len--) {
+- u32 osd, off;
+- ceph_decode_need(p, end, sizeof(u32)*2, e_inval);
+- osd = ceph_decode_32(p);
+- off = ceph_decode_32(p);
+- pr_info("osd%d weight 0x%x %s\n", osd, off,
+- off == CEPH_OSD_IN ? "(in)" :
+- (off == CEPH_OSD_OUT ? "(out)" : ""));
+- if (osd < map->max_osd)
+- map->osd_weight[osd] = off;
+- }
++ /* new_up_client, new_state, new_weight */
++ err = decode_new_up_state_weight(p, end, map);
++ if (err)
++ goto bad;
+
+ /* new_pg_temp */
+ err = decode_new_pg_temp(p, end, map);
+diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
+index 655e1b05ff74..b3bfa5111799 100644
+--- a/net/ipv4/netfilter/arp_tables.c
++++ b/net/ipv4/netfilter/arp_tables.c
+@@ -363,23 +363,12 @@ static inline bool unconditional(const struct arpt_entry *e)
+ memcmp(&e->arp, &uncond, sizeof(uncond)) == 0;
+ }
+
+-static bool find_jump_target(const struct xt_table_info *t,
+- const struct arpt_entry *target)
+-{
+- struct arpt_entry *iter;
+-
+- xt_entry_foreach(iter, t->entries, t->size) {
+- if (iter == target)
+- return true;
+- }
+- return false;
+-}
+-
+ /* Figures out from what hook each rule can be called: returns 0 if
+ * there are loops. Puts hook bitmask in comefrom.
+ */
+ static int mark_source_chains(const struct xt_table_info *newinfo,
+- unsigned int valid_hooks, void *entry0)
++ unsigned int valid_hooks, void *entry0,
++ unsigned int *offsets)
+ {
+ unsigned int hook;
+
+@@ -468,10 +457,11 @@ static int mark_source_chains(const struct xt_table_info *newinfo,
+ /* This a jump; chase it. */
+ duprintf("Jump rule %u -> %u\n",
+ pos, newpos);
++ if (!xt_find_jump_offset(offsets, newpos,
++ newinfo->number))
++ return 0;
+ e = (struct arpt_entry *)
+ (entry0 + newpos);
+- if (!find_jump_target(newinfo, e))
+- return 0;
+ } else {
+ /* ... this is a fallthru */
+ newpos = pos + e->next_offset;
+@@ -631,6 +621,7 @@ static int translate_table(struct xt_table_info *newinfo, void *entry0,
+ const struct arpt_replace *repl)
+ {
+ struct arpt_entry *iter;
++ unsigned int *offsets;
+ unsigned int i;
+ int ret = 0;
+
+@@ -644,8 +635,10 @@ static int translate_table(struct xt_table_info *newinfo, void *entry0,
+ }
+
+ duprintf("translate_table: size %u\n", newinfo->size);
++ offsets = xt_alloc_entry_offsets(newinfo->number);
++ if (!offsets)
++ return -ENOMEM;
+ i = 0;
+-
+ /* Walk through entries, checking offsets. */
+ xt_entry_foreach(iter, entry0, newinfo->size) {
+ ret = check_entry_size_and_hooks(iter, newinfo, entry0,
+@@ -654,7 +647,9 @@ static int translate_table(struct xt_table_info *newinfo, void *entry0,
+ repl->underflow,
+ repl->valid_hooks);
+ if (ret != 0)
+- break;
++ goto out_free;
++ if (i < repl->num_entries)
++ offsets[i] = (void *)iter - entry0;
+ ++i;
+ if (strcmp(arpt_get_target(iter)->u.user.name,
+ XT_ERROR_TARGET) == 0)
+@@ -662,12 +657,13 @@ static int translate_table(struct xt_table_info *newinfo, void *entry0,
+ }
+ duprintf("translate_table: ARPT_ENTRY_ITERATE gives %d\n", ret);
+ if (ret != 0)
+- return ret;
++ goto out_free;
+
++ ret = -EINVAL;
+ if (i != repl->num_entries) {
+ duprintf("translate_table: %u not %u entries\n",
+ i, repl->num_entries);
+- return -EINVAL;
++ goto out_free;
+ }
+
+ /* Check hooks all assigned */
+@@ -678,17 +674,20 @@ static int translate_table(struct xt_table_info *newinfo, void *entry0,
+ if (newinfo->hook_entry[i] == 0xFFFFFFFF) {
+ duprintf("Invalid hook entry %u %u\n",
+ i, repl->hook_entry[i]);
+- return -EINVAL;
++ goto out_free;
+ }
+ if (newinfo->underflow[i] == 0xFFFFFFFF) {
+ duprintf("Invalid underflow %u %u\n",
+ i, repl->underflow[i]);
+- return -EINVAL;
++ goto out_free;
+ }
+ }
+
+- if (!mark_source_chains(newinfo, repl->valid_hooks, entry0))
+- return -ELOOP;
++ if (!mark_source_chains(newinfo, repl->valid_hooks, entry0, offsets)) {
++ ret = -ELOOP;
++ goto out_free;
++ }
++ kvfree(offsets);
+
+ /* Finally, each sanity check must pass */
+ i = 0;
+@@ -715,6 +714,9 @@ static int translate_table(struct xt_table_info *newinfo, void *entry0,
+ }
+
+ return ret;
++ out_free:
++ kvfree(offsets);
++ return ret;
+ }
+
+ static void get_counters(const struct xt_table_info *t,
+diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
+index 865e738d3804..4e40f2ec2b68 100644
+--- a/net/ipv4/netfilter/ip_tables.c
++++ b/net/ipv4/netfilter/ip_tables.c
+@@ -439,23 +439,12 @@ ipt_do_table(struct sk_buff *skb,
+ #endif
+ }
+
+-static bool find_jump_target(const struct xt_table_info *t,
+- const struct ipt_entry *target)
+-{
+- struct ipt_entry *iter;
+-
+- xt_entry_foreach(iter, t->entries, t->size) {
+- if (iter == target)
+- return true;
+- }
+- return false;
+-}
+-
+ /* Figures out from what hook each rule can be called: returns 0 if
+ there are loops. Puts hook bitmask in comefrom. */
+ static int
+ mark_source_chains(const struct xt_table_info *newinfo,
+- unsigned int valid_hooks, void *entry0)
++ unsigned int valid_hooks, void *entry0,
++ unsigned int *offsets)
+ {
+ unsigned int hook;
+
+@@ -548,10 +537,11 @@ mark_source_chains(const struct xt_table_info *newinfo,
+ /* This a jump; chase it. */
+ duprintf("Jump rule %u -> %u\n",
+ pos, newpos);
++ if (!xt_find_jump_offset(offsets, newpos,
++ newinfo->number))
++ return 0;
+ e = (struct ipt_entry *)
+ (entry0 + newpos);
+- if (!find_jump_target(newinfo, e))
+- return 0;
+ } else {
+ /* ... this is a fallthru */
+ newpos = pos + e->next_offset;
+@@ -798,6 +788,7 @@ translate_table(struct net *net, struct xt_table_info *newinfo, void *entry0,
+ const struct ipt_replace *repl)
+ {
+ struct ipt_entry *iter;
++ unsigned int *offsets;
+ unsigned int i;
+ int ret = 0;
+
+@@ -811,6 +802,9 @@ translate_table(struct net *net, struct xt_table_info *newinfo, void *entry0,
+ }
+
+ duprintf("translate_table: size %u\n", newinfo->size);
++ offsets = xt_alloc_entry_offsets(newinfo->number);
++ if (!offsets)
++ return -ENOMEM;
+ i = 0;
+ /* Walk through entries, checking offsets. */
+ xt_entry_foreach(iter, entry0, newinfo->size) {
+@@ -820,17 +814,20 @@ translate_table(struct net *net, struct xt_table_info *newinfo, void *entry0,
+ repl->underflow,
+ repl->valid_hooks);
+ if (ret != 0)
+- return ret;
++ goto out_free;
++ if (i < repl->num_entries)
++ offsets[i] = (void *)iter - entry0;
+ ++i;
+ if (strcmp(ipt_get_target(iter)->u.user.name,
+ XT_ERROR_TARGET) == 0)
+ ++newinfo->stacksize;
+ }
+
++ ret = -EINVAL;
+ if (i != repl->num_entries) {
+ duprintf("translate_table: %u not %u entries\n",
+ i, repl->num_entries);
+- return -EINVAL;
++ goto out_free;
+ }
+
+ /* Check hooks all assigned */
+@@ -841,17 +838,20 @@ translate_table(struct net *net, struct xt_table_info *newinfo, void *entry0,
+ if (newinfo->hook_entry[i] == 0xFFFFFFFF) {
+ duprintf("Invalid hook entry %u %u\n",
+ i, repl->hook_entry[i]);
+- return -EINVAL;
++ goto out_free;
+ }
+ if (newinfo->underflow[i] == 0xFFFFFFFF) {
+ duprintf("Invalid underflow %u %u\n",
+ i, repl->underflow[i]);
+- return -EINVAL;
++ goto out_free;
+ }
+ }
+
+- if (!mark_source_chains(newinfo, repl->valid_hooks, entry0))
+- return -ELOOP;
++ if (!mark_source_chains(newinfo, repl->valid_hooks, entry0, offsets)) {
++ ret = -ELOOP;
++ goto out_free;
++ }
++ kvfree(offsets);
+
+ /* Finally, each sanity check must pass */
+ i = 0;
+@@ -878,6 +878,9 @@ translate_table(struct net *net, struct xt_table_info *newinfo, void *entry0,
+ }
+
+ return ret;
++ out_free:
++ kvfree(offsets);
++ return ret;
+ }
+
+ static void
+diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
+index 1b6ed70bab37..cb3cc2a4426a 100644
+--- a/net/ipv6/netfilter/ip6_tables.c
++++ b/net/ipv6/netfilter/ip6_tables.c
+@@ -449,23 +449,12 @@ ip6t_do_table(struct sk_buff *skb,
+ #endif
+ }
+
+-static bool find_jump_target(const struct xt_table_info *t,
+- const struct ip6t_entry *target)
+-{
+- struct ip6t_entry *iter;
+-
+- xt_entry_foreach(iter, t->entries, t->size) {
+- if (iter == target)
+- return true;
+- }
+- return false;
+-}
+-
+ /* Figures out from what hook each rule can be called: returns 0 if
+ there are loops. Puts hook bitmask in comefrom. */
+ static int
+ mark_source_chains(const struct xt_table_info *newinfo,
+- unsigned int valid_hooks, void *entry0)
++ unsigned int valid_hooks, void *entry0,
++ unsigned int *offsets)
+ {
+ unsigned int hook;
+
+@@ -558,10 +547,11 @@ mark_source_chains(const struct xt_table_info *newinfo,
+ /* This a jump; chase it. */
+ duprintf("Jump rule %u -> %u\n",
+ pos, newpos);
++ if (!xt_find_jump_offset(offsets, newpos,
++ newinfo->number))
++ return 0;
+ e = (struct ip6t_entry *)
+ (entry0 + newpos);
+- if (!find_jump_target(newinfo, e))
+- return 0;
+ } else {
+ /* ... this is a fallthru */
+ newpos = pos + e->next_offset;
+@@ -808,6 +798,7 @@ translate_table(struct net *net, struct xt_table_info *newinfo, void *entry0,
+ const struct ip6t_replace *repl)
+ {
+ struct ip6t_entry *iter;
++ unsigned int *offsets;
+ unsigned int i;
+ int ret = 0;
+
+@@ -821,6 +812,9 @@ translate_table(struct net *net, struct xt_table_info *newinfo, void *entry0,
+ }
+
+ duprintf("translate_table: size %u\n", newinfo->size);
++ offsets = xt_alloc_entry_offsets(newinfo->number);
++ if (!offsets)
++ return -ENOMEM;
+ i = 0;
+ /* Walk through entries, checking offsets. */
+ xt_entry_foreach(iter, entry0, newinfo->size) {
+@@ -830,17 +824,20 @@ translate_table(struct net *net, struct xt_table_info *newinfo, void *entry0,
+ repl->underflow,
+ repl->valid_hooks);
+ if (ret != 0)
+- return ret;
++ goto out_free;
++ if (i < repl->num_entries)
++ offsets[i] = (void *)iter - entry0;
+ ++i;
+ if (strcmp(ip6t_get_target(iter)->u.user.name,
+ XT_ERROR_TARGET) == 0)
+ ++newinfo->stacksize;
+ }
+
++ ret = -EINVAL;
+ if (i != repl->num_entries) {
+ duprintf("translate_table: %u not %u entries\n",
+ i, repl->num_entries);
+- return -EINVAL;
++ goto out_free;
+ }
+
+ /* Check hooks all assigned */
+@@ -851,17 +848,20 @@ translate_table(struct net *net, struct xt_table_info *newinfo, void *entry0,
+ if (newinfo->hook_entry[i] == 0xFFFFFFFF) {
+ duprintf("Invalid hook entry %u %u\n",
+ i, repl->hook_entry[i]);
+- return -EINVAL;
++ goto out_free;
+ }
+ if (newinfo->underflow[i] == 0xFFFFFFFF) {
+ duprintf("Invalid underflow %u %u\n",
+ i, repl->underflow[i]);
+- return -EINVAL;
++ goto out_free;
+ }
+ }
+
+- if (!mark_source_chains(newinfo, repl->valid_hooks, entry0))
+- return -ELOOP;
++ if (!mark_source_chains(newinfo, repl->valid_hooks, entry0, offsets)) {
++ ret = -ELOOP;
++ goto out_free;
++ }
++ kvfree(offsets);
+
+ /* Finally, each sanity check must pass */
+ i = 0;
+@@ -888,6 +888,9 @@ translate_table(struct net *net, struct xt_table_info *newinfo, void *entry0,
+ }
+
+ return ret;
++ out_free:
++ kvfree(offsets);
++ return ret;
+ }
+
+ static void
+diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c
+index 0c01ad4e078f..489899325bf7 100644
+--- a/net/netfilter/x_tables.c
++++ b/net/netfilter/x_tables.c
+@@ -704,6 +704,56 @@ int xt_check_entry_offsets(const void *base,
+ }
+ EXPORT_SYMBOL(xt_check_entry_offsets);
+
++/**
++ * xt_alloc_entry_offsets - allocate array to store rule head offsets
++ *
++ * @size: number of entries
++ *
++ * Return: NULL or kmalloc'd or vmalloc'd array
++ */
++unsigned int *xt_alloc_entry_offsets(unsigned int size)
++{
++ unsigned int *off;
++
++ off = kcalloc(size, sizeof(unsigned int), GFP_KERNEL | __GFP_NOWARN);
++
++ if (off)
++ return off;
++
++ if (size < (SIZE_MAX / sizeof(unsigned int)))
++ off = vmalloc(size * sizeof(unsigned int));
++
++ return off;
++}
++EXPORT_SYMBOL(xt_alloc_entry_offsets);
++
++/**
++ * xt_find_jump_offset - check if target is a valid jump offset
++ *
++ * @offsets: array containing all valid rule start offsets of a rule blob
++ * @target: the jump target to search for
++ * @size: entries in @offset
++ */
++bool xt_find_jump_offset(const unsigned int *offsets,
++ unsigned int target, unsigned int size)
++{
++ int m, low = 0, hi = size;
++
++ while (hi > low) {
++ m = (low + hi) / 2u;
++
++ if (offsets[m] > target)
++ hi = m;
++ else if (offsets[m] < target)
++ low = m + 1;
++ else
++ return true;
++ }
++
++ return false;
++}
++EXPORT_SYMBOL(xt_find_jump_offset);
++
+ int xt_check_target(struct xt_tgchk_param *par,
+ unsigned int size, u_int8_t proto, bool inv_proto)
+ {
+diff --git a/sound/core/control.c b/sound/core/control.c
+index 82a638a01b24..733b803af271 100644
+--- a/sound/core/control.c
++++ b/sound/core/control.c
+@@ -150,6 +150,8 @@ void snd_ctl_notify(struct snd_card *card, unsigned int mask,
+
+ if (snd_BUG_ON(!card || !id))
+ return;
++ if (card->shutdown)
++ return;
+ read_lock(&card->ctl_files_rwlock);
+ #if IS_ENABLED(CONFIG_SND_MIXER_OSS)
+ card->mixer_oss_change_count++;
+diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
+index 58f82733c893..bc9ed75c651c 100644
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -1119,8 +1119,10 @@ static int azx_free(struct azx *chip)
+ if (use_vga_switcheroo(hda)) {
+ if (chip->disabled && chip->bus)
+ snd_hda_unlock_devices(chip->bus);
+- if (hda->vga_switcheroo_registered)
++ if (hda->vga_switcheroo_registered) {
+ vga_switcheroo_unregister_client(chip->pci);
++ vga_switcheroo_fini_domain_pm_ops(chip->card->dev);
++ }
+ }
+
+ if (chip->initialized) {
+@@ -2093,6 +2095,10 @@ static const struct pci_device_id azx_ids[] = {
+ /* ATI HDMI */
+ { PCI_DEVICE(0x1002, 0x1308),
+ .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS },
++ { PCI_DEVICE(0x1002, 0x157a),
++ .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS },
++ { PCI_DEVICE(0x1002, 0x15b3),
++ .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS },
+ { PCI_DEVICE(0x1002, 0x793b),
+ .driver_data = AZX_DRIVER_ATIHDMI | AZX_DCAPS_PRESET_ATI_HDMI },
+ { PCI_DEVICE(0x1002, 0x7919),
+@@ -2147,8 +2153,14 @@ static const struct pci_device_id azx_ids[] = {
+ .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS },
+ { PCI_DEVICE(0x1002, 0xaab0),
+ .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS },
++ { PCI_DEVICE(0x1002, 0xaac0),
++ .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS },
+ { PCI_DEVICE(0x1002, 0xaac8),
+ .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS },
++ { PCI_DEVICE(0x1002, 0xaad8),
++ .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS },
++ { PCI_DEVICE(0x1002, 0xaae8),
++ .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS },
+ /* VIA VT8251/VT8237A */
+ { PCI_DEVICE(0x1106, 0x3288),
+ .driver_data = AZX_DRIVER_VIA | AZX_DCAPS_POSFIX_VIA },
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 77bd16739dbd..c35960b74026 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -5496,7 +5496,6 @@ static const struct hda_model_fixup alc269_fixup_models[] = {
+ {}
+ };
+ #define ALC225_STANDARD_PINS \
+- {0x12, 0xb7a60130}, \
+ {0x21, 0x04211020}
+
+ #define ALC255_STANDARD_PINS \
+@@ -5562,10 +5561,24 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = {
+ {0x14, 0x901701b0}),
+ SND_HDA_PIN_QUIRK(0x10ec0225, 0x1028, "Dell", ALC225_FIXUP_DELL1_MIC_NO_PRESENCE,
+ ALC225_STANDARD_PINS,
++ {0x12, 0xb7a60130},
+ {0x14, 0x901701a0}),
+ SND_HDA_PIN_QUIRK(0x10ec0225, 0x1028, "Dell", ALC225_FIXUP_DELL1_MIC_NO_PRESENCE,
+ ALC225_STANDARD_PINS,
++ {0x12, 0xb7a60130},
+ {0x14, 0x901701b0}),
++ SND_HDA_PIN_QUIRK(0x10ec0225, 0x1028, "Dell", ALC225_FIXUP_DELL1_MIC_NO_PRESENCE,
++ ALC225_STANDARD_PINS,
++ {0x12, 0xb7a60150},
++ {0x14, 0x901701a0}),
++ SND_HDA_PIN_QUIRK(0x10ec0225, 0x1028, "Dell", ALC225_FIXUP_DELL1_MIC_NO_PRESENCE,
++ ALC225_STANDARD_PINS,
++ {0x12, 0xb7a60150},
++ {0x14, 0x901701b0}),
++ SND_HDA_PIN_QUIRK(0x10ec0225, 0x1028, "Dell", ALC225_FIXUP_DELL1_MIC_NO_PRESENCE,
++ ALC225_STANDARD_PINS,
++ {0x12, 0xb7a60130},
++ {0x1b, 0x90170110}),
+ SND_HDA_PIN_QUIRK(0x10ec0255, 0x1028, "Dell", ALC255_FIXUP_DELL2_MIC_NO_PRESENCE,
+ ALC255_STANDARD_PINS,
+ {0x12, 0x40300000},
^ permalink raw reply related [flat|nested] 67+ messages in thread
* [gentoo-commits] proj/linux-patches:3.18 commit in: /
@ 2016-08-22 23:27 Mike Pagano
0 siblings, 0 replies; 67+ messages in thread
From: Mike Pagano @ 2016-08-22 23:27 UTC (permalink / raw
To: gentoo-commits
commit: 05e153f62c470439f15a6039465f162032ea1643
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Mon Aug 22 23:27:31 2016 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Mon Aug 22 23:27:31 2016 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=05e153f6
Linux patch 3.18.40
0000_README | 4 +
1039_linux-3.18.40.patch | 4290 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 4294 insertions(+)
diff --git a/0000_README b/0000_README
index 2568ef1..c85b470 100644
--- a/0000_README
+++ b/0000_README
@@ -199,6 +199,10 @@ Patch: 1038_linux-3.18.39.patch
From: http://www.kernel.org
Desc: Linux 3.18.39
+Patch: 1039_linux-3.18.40.patch
+From: http://www.kernel.org
+Desc: Linux 3.18.40
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1039_linux-3.18.40.patch b/1039_linux-3.18.40.patch
new file mode 100644
index 0000000..e19eec8
--- /dev/null
+++ b/1039_linux-3.18.40.patch
@@ -0,0 +1,4290 @@
+diff --git a/.mailmap b/.mailmap
+index 1ad68731fb47..cf92e1ea6fd3 100644
+--- a/.mailmap
++++ b/.mailmap
+@@ -78,6 +78,7 @@ Leonid I Ananiev <leonid.i.ananiev@intel.com>
+ Linas Vepstas <linas@austin.ibm.com>
+ Mark Brown <broonie@sirena.org.uk>
+ Matthieu CASTET <castet.matthieu@free.fr>
++Mauro Carvalho Chehab <mchehab@kernel.org> <maurochehab@gmail.com> <mchehab@infradead.org> <mchehab@redhat.com> <m.chehab@samsung.com> <mchehab@osg.samsung.com> <mchehab@s-opensource.com>
+ Mayuresh Janorkar <mayur@ti.com>
+ Michael Buesch <m@bues.ch>
+ Michel Dänzer <michel@tungstengraphics.com>
+diff --git a/CREDITS b/CREDITS
+index bb6278884f89..89d2297b70cb 100644
+--- a/CREDITS
++++ b/CREDITS
+@@ -636,6 +636,7 @@ D: Configure, Menuconfig, xconfig
+
+ N: Mauro Carvalho Chehab
+ E: m.chehab@samsung.org
++E: mchehab@osg.samsung.com
+ E: mchehab@infradead.org
+ D: Media subsystem (V4L/DVB) drivers and core
+ D: EDAC drivers and EDAC 3.0 core rework
+diff --git a/Documentation/module-signing.txt b/Documentation/module-signing.txt
+index 09c2382ad055..e3af8c27eef2 100644
+--- a/Documentation/module-signing.txt
++++ b/Documentation/module-signing.txt
+@@ -239,3 +239,9 @@ Since the private key is used to sign modules, viruses and malware could use
+ the private key to sign modules and compromise the operating system. The
+ private key must be either destroyed or moved to a secure location and not kept
+ in the root node of the kernel source tree.
++
++If you use the same private key to sign modules for multiple kernel
++configurations, you must ensure that the module version information is
++sufficient to prevent loading a module into a different kernel. Either
++set CONFIG_MODVERSIONS=y or ensure that each configuration has a different
++kernel release string by changing EXTRAVERSION or CONFIG_LOCALVERSION.
+diff --git a/MAINTAINERS b/MAINTAINERS
+index f553cf7abe6a..bcfe54f2aa13 100644
+--- a/MAINTAINERS
++++ b/MAINTAINERS
+@@ -1828,7 +1828,8 @@ F: include/net/ax25.h
+ F: net/ax25/
+
+ AZ6007 DVB DRIVER
+-M: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
++M: Mauro Carvalho Chehab <mchehab@s-opensource.com>
++M: Mauro Carvalho Chehab <mchehab@kernel.org>
+ L: linux-media@vger.kernel.org
+ W: http://linuxtv.org
+ T: git git://linuxtv.org/media_tree.git
+@@ -2198,7 +2199,8 @@ F: Documentation/filesystems/btrfs.txt
+ F: fs/btrfs/
+
+ BTTV VIDEO4LINUX DRIVER
+-M: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
++M: Mauro Carvalho Chehab <mchehab@s-opensource.com>
++M: Mauro Carvalho Chehab <mchehab@kernel.org>
+ L: linux-media@vger.kernel.org
+ W: http://linuxtv.org
+ T: git git://linuxtv.org/media_tree.git
+@@ -2719,7 +2721,8 @@ F: drivers/media/common/cx2341x*
+ F: include/media/cx2341x*
+
+ CX88 VIDEO4LINUX DRIVER
+-M: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
++M: Mauro Carvalho Chehab <mchehab@s-opensource.com>
++M: Mauro Carvalho Chehab <mchehab@kernel.org>
+ L: linux-media@vger.kernel.org
+ W: http://linuxtv.org
+ T: git git://linuxtv.org/media_tree.git
+@@ -3402,7 +3405,8 @@ F: fs/ecryptfs/
+ EDAC-CORE
+ M: Doug Thompson <dougthompson@xmission.com>
+ M: Borislav Petkov <bp@alien8.de>
+-M: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
++M: Mauro Carvalho Chehab <mchehab@s-opensource.com>
++M: Mauro Carvalho Chehab <mchehab@kernel.org>
+ L: linux-edac@vger.kernel.org
+ W: bluesmoke.sourceforge.net
+ S: Supported
+@@ -3451,7 +3455,8 @@ S: Maintained
+ F: drivers/edac/e7xxx_edac.c
+
+ EDAC-GHES
+-M: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
++M: Mauro Carvalho Chehab <mchehab@s-opensource.com>
++M: Mauro Carvalho Chehab <mchehab@kernel.org>
+ L: linux-edac@vger.kernel.org
+ W: bluesmoke.sourceforge.net
+ S: Maintained
+@@ -3479,21 +3484,24 @@ S: Maintained
+ F: drivers/edac/i5000_edac.c
+
+ EDAC-I5400
+-M: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
++M: Mauro Carvalho Chehab <mchehab@s-opensource.com>
++M: Mauro Carvalho Chehab <mchehab@kernel.org>
+ L: linux-edac@vger.kernel.org
+ W: bluesmoke.sourceforge.net
+ S: Maintained
+ F: drivers/edac/i5400_edac.c
+
+ EDAC-I7300
+-M: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
++M: Mauro Carvalho Chehab <mchehab@s-opensource.com>
++M: Mauro Carvalho Chehab <mchehab@kernel.org>
+ L: linux-edac@vger.kernel.org
+ W: bluesmoke.sourceforge.net
+ S: Maintained
+ F: drivers/edac/i7300_edac.c
+
+ EDAC-I7CORE
+-M: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
++M: Mauro Carvalho Chehab <mchehab@s-opensource.com>
++M: Mauro Carvalho Chehab <mchehab@kernel.org>
+ L: linux-edac@vger.kernel.org
+ W: bluesmoke.sourceforge.net
+ S: Maintained
+@@ -3536,7 +3544,8 @@ S: Maintained
+ F: drivers/edac/r82600_edac.c
+
+ EDAC-SBRIDGE
+-M: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
++M: Mauro Carvalho Chehab <mchehab@s-opensource.com>
++M: Mauro Carvalho Chehab <mchehab@kernel.org>
+ L: linux-edac@vger.kernel.org
+ W: bluesmoke.sourceforge.net
+ S: Maintained
+@@ -3596,7 +3605,8 @@ S: Maintained
+ F: drivers/net/ethernet/ibm/ehea/
+
+ EM28XX VIDEO4LINUX DRIVER
+-M: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
++M: Mauro Carvalho Chehab <mchehab@s-opensource.com>
++M: Mauro Carvalho Chehab <mchehab@kernel.org>
+ L: linux-media@vger.kernel.org
+ W: http://linuxtv.org
+ T: git git://linuxtv.org/media_tree.git
+@@ -5962,7 +5972,8 @@ S: Maintained
+ F: drivers/media/radio/radio-maxiradio*
+
+ MEDIA INPUT INFRASTRUCTURE (V4L/DVB)
+-M: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
++M: Mauro Carvalho Chehab <mchehab@s-opensource.com>
++M: Mauro Carvalho Chehab <mchehab@kernel.org>
+ P: LinuxTV.org Project
+ L: linux-media@vger.kernel.org
+ W: http://linuxtv.org
+@@ -8013,7 +8024,8 @@ S: Odd Fixes
+ F: drivers/media/i2c/saa6588*
+
+ SAA7134 VIDEO4LINUX DRIVER
+-M: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
++M: Mauro Carvalho Chehab <mchehab@s-opensource.com>
++M: Mauro Carvalho Chehab <mchehab@kernel.org>
+ L: linux-media@vger.kernel.org
+ W: http://linuxtv.org
+ T: git git://linuxtv.org/media_tree.git
+@@ -8471,7 +8483,8 @@ S: Maintained
+ F: drivers/media/radio/si4713/radio-usb-si4713.c
+
+ SIANO DVB DRIVER
+-M: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
++M: Mauro Carvalho Chehab <mchehab@s-opensource.com>
++M: Mauro Carvalho Chehab <mchehab@kernel.org>
+ L: linux-media@vger.kernel.org
+ W: http://linuxtv.org
+ T: git git://linuxtv.org/media_tree.git
+@@ -9160,7 +9173,8 @@ S: Maintained
+ F: drivers/media/i2c/tda9840*
+
+ TEA5761 TUNER DRIVER
+-M: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
++M: Mauro Carvalho Chehab <mchehab@s-opensource.com>
++M: Mauro Carvalho Chehab <mchehab@kernel.org>
+ L: linux-media@vger.kernel.org
+ W: http://linuxtv.org
+ T: git git://linuxtv.org/media_tree.git
+@@ -9168,7 +9182,8 @@ S: Odd fixes
+ F: drivers/media/tuners/tea5761.*
+
+ TEA5767 TUNER DRIVER
+-M: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
++M: Mauro Carvalho Chehab <mchehab@s-opensource.com>
++M: Mauro Carvalho Chehab <mchehab@kernel.org>
+ L: linux-media@vger.kernel.org
+ W: http://linuxtv.org
+ T: git git://linuxtv.org/media_tree.git
+@@ -9480,7 +9495,8 @@ F: include/linux/shmem_fs.h
+ F: mm/shmem.c
+
+ TM6000 VIDEO4LINUX DRIVER
+-M: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
++M: Mauro Carvalho Chehab <mchehab@s-opensource.com>
++M: Mauro Carvalho Chehab <mchehab@kernel.org>
+ L: linux-media@vger.kernel.org
+ W: http://linuxtv.org
+ T: git git://linuxtv.org/media_tree.git
+@@ -10301,7 +10317,8 @@ S: Maintained
+ F: arch/x86/kernel/cpu/mcheck/*
+
+ XC2028/3028 TUNER DRIVER
+-M: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
++M: Mauro Carvalho Chehab <mchehab@s-opensource.com>
++M: Mauro Carvalho Chehab <mchehab@kernel.org>
+ L: linux-media@vger.kernel.org
+ W: http://linuxtv.org
+ T: git git://linuxtv.org/media_tree.git
+diff --git a/Makefile b/Makefile
+index 758b8efbb881..39e8b5638789 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 18
+-SUBLEVEL = 39
++SUBLEVEL = 40
+ EXTRAVERSION =
+ NAME = Diseased Newt
+
+diff --git a/arch/arc/include/asm/pgtable.h b/arch/arc/include/asm/pgtable.h
+index 7670f33b9ce2..b556b4ef9775 100644
+--- a/arch/arc/include/asm/pgtable.h
++++ b/arch/arc/include/asm/pgtable.h
+@@ -98,7 +98,7 @@
+ #define ___DEF (_PAGE_PRESENT | _PAGE_DEF_CACHEABLE)
+
+ /* Set of bits not changed in pte_modify */
+-#define _PAGE_CHG_MASK (PAGE_MASK | _PAGE_ACCESSED | _PAGE_MODIFIED)
++#define _PAGE_CHG_MASK (PAGE_MASK | _PAGE_ACCESSED | _PAGE_MODIFIED | _PAGE_SPECIAL)
+
+ /* More Abbrevaited helpers */
+ #define PAGE_U_NONE __pgprot(___DEF)
+diff --git a/arch/arm/boot/dts/sun4i-a10-a1000.dts b/arch/arm/boot/dts/sun4i-a10-a1000.dts
+index 9e99ade35e37..0b43a186a36e 100644
+--- a/arch/arm/boot/dts/sun4i-a10-a1000.dts
++++ b/arch/arm/boot/dts/sun4i-a10-a1000.dts
+@@ -139,6 +139,7 @@
+ regulator-name = "emac-3v3";
+ regulator-min-microvolt = <3300000>;
+ regulator-max-microvolt = <3300000>;
++ startup-delay-us = <20000>;
+ enable-active-high;
+ gpio = <&pio 7 15 0>;
+ };
+diff --git a/arch/arm/boot/dts/sun4i-a10-hackberry.dts b/arch/arm/boot/dts/sun4i-a10-hackberry.dts
+index 891ea446abae..8ad4354b7feb 100644
+--- a/arch/arm/boot/dts/sun4i-a10-hackberry.dts
++++ b/arch/arm/boot/dts/sun4i-a10-hackberry.dts
+@@ -120,6 +120,7 @@
+ regulator-name = "emac-3v3";
+ regulator-min-microvolt = <3300000>;
+ regulator-max-microvolt = <3300000>;
++ startup-delay-us = <20000>;
+ enable-active-high;
+ gpio = <&pio 7 19 0>;
+ };
+diff --git a/arch/arm64/kernel/debug-monitors.c b/arch/arm64/kernel/debug-monitors.c
+index b056369fd47d..62c91b3b42e8 100644
+--- a/arch/arm64/kernel/debug-monitors.c
++++ b/arch/arm64/kernel/debug-monitors.c
+@@ -150,7 +150,6 @@ static int debug_monitors_init(void)
+ /* Clear the OS lock. */
+ on_each_cpu(clear_os_lock, NULL, 1);
+ isb();
+- local_dbg_enable();
+
+ /* Register hotplug handler. */
+ __register_cpu_notifier(&os_lock_nb);
+diff --git a/arch/arm64/kernel/smp.c b/arch/arm64/kernel/smp.c
+index 0ef87896e4ae..a1f054549cb6 100644
+--- a/arch/arm64/kernel/smp.c
++++ b/arch/arm64/kernel/smp.c
+@@ -179,7 +179,6 @@ asmlinkage void secondary_start_kernel(void)
+ set_cpu_online(cpu, true);
+ complete(&cpu_running);
+
+- local_dbg_enable();
+ local_irq_enable();
+ local_async_enable();
+
+diff --git a/arch/arm64/mm/proc.S b/arch/arm64/mm/proc.S
+index 4e778b13291b..302353d9150b 100644
+--- a/arch/arm64/mm/proc.S
++++ b/arch/arm64/mm/proc.S
+@@ -202,6 +202,8 @@ ENTRY(__cpu_setup)
+ mov x0, #3 << 20
+ msr cpacr_el1, x0 // Enable FP/ASIMD
+ msr mdscr_el1, xzr // Reset mdscr_el1
++ isb // Unmask debug exceptions now,
++ enable_dbg // since this is per-cpu
+ /*
+ * Memory region attributes for LPAE:
+ *
+diff --git a/arch/metag/include/asm/cmpxchg_lnkget.h b/arch/metag/include/asm/cmpxchg_lnkget.h
+index 0154e2807ebb..2369ad394876 100644
+--- a/arch/metag/include/asm/cmpxchg_lnkget.h
++++ b/arch/metag/include/asm/cmpxchg_lnkget.h
+@@ -73,7 +73,7 @@ static inline unsigned long __cmpxchg_u32(volatile int *m, unsigned long old,
+ " DCACHE [%2], %0\n"
+ #endif
+ "2:\n"
+- : "=&d" (temp), "=&da" (retval)
++ : "=&d" (temp), "=&d" (retval)
+ : "da" (m), "bd" (old), "da" (new)
+ : "cc"
+ );
+diff --git a/arch/mips/kernel/scall64-n32.S b/arch/mips/kernel/scall64-n32.S
+index a8eb6575edc0..9a47c1233d2a 100644
+--- a/arch/mips/kernel/scall64-n32.S
++++ b/arch/mips/kernel/scall64-n32.S
+@@ -353,7 +353,7 @@ EXPORT(sysn32_call_table)
+ PTR sys_ni_syscall /* available, was setaltroot */
+ PTR sys_add_key
+ PTR sys_request_key
+- PTR sys_keyctl /* 6245 */
++ PTR compat_sys_keyctl /* 6245 */
+ PTR sys_set_thread_area
+ PTR sys_inotify_init
+ PTR sys_inotify_add_watch
+diff --git a/arch/mips/kernel/scall64-o32.S b/arch/mips/kernel/scall64-o32.S
+index 6f8db9f728e8..8be0757e34cd 100644
+--- a/arch/mips/kernel/scall64-o32.S
++++ b/arch/mips/kernel/scall64-o32.S
+@@ -491,7 +491,7 @@ EXPORT(sys32_call_table)
+ PTR sys_ni_syscall /* available, was setaltroot */
+ PTR sys_add_key /* 4280 */
+ PTR sys_request_key
+- PTR sys_keyctl
++ PTR compat_sys_keyctl
+ PTR sys_set_thread_area
+ PTR sys_inotify_init
+ PTR sys_inotify_add_watch /* 4285 */
+diff --git a/arch/powerpc/kernel/tm.S b/arch/powerpc/kernel/tm.S
+index 2a324f4cb1b9..08225a352477 100644
+--- a/arch/powerpc/kernel/tm.S
++++ b/arch/powerpc/kernel/tm.S
+@@ -110,17 +110,11 @@ _GLOBAL(tm_reclaim)
+ std r3, STK_PARAM(R3)(r1)
+ SAVE_NVGPRS(r1)
+
+- /* We need to setup MSR for VSX register save instructions. Here we
+- * also clear the MSR RI since when we do the treclaim, we won't have a
+- * valid kernel pointer for a while. We clear RI here as it avoids
+- * adding another mtmsr closer to the treclaim. This makes the region
+- * maked as non-recoverable wider than it needs to be but it saves on
+- * inserting another mtmsrd later.
+- */
++ /* We need to setup MSR for VSX register save instructions. */
+ mfmsr r14
+ mr r15, r14
+ ori r15, r15, MSR_FP
+- li r16, MSR_RI
++ li r16, 0
+ ori r16, r16, MSR_EE /* IRQs hard off */
+ andc r15, r15, r16
+ oris r15, r15, MSR_VEC@h
+@@ -176,7 +170,17 @@ dont_backup_fp:
+ 1: tdeqi r6, 0
+ EMIT_BUG_ENTRY 1b,__FILE__,__LINE__,0
+
+- /* The moment we treclaim, ALL of our GPRs will switch
++ /* Clear MSR RI since we are about to change r1, EE is already off. */
++ li r4, 0
++ mtmsrd r4, 1
++
++ /*
++ * BE CAREFUL HERE:
++ * At this point we can't take an SLB miss since we have MSR_RI
++ * off. Load only to/from the stack/paca which are in SLB bolted regions
++ * until we turn MSR RI back on.
++ *
++ * The moment we treclaim, ALL of our GPRs will switch
+ * to user register state. (FPRs, CCR etc. also!)
+ * Use an sprg and a tm_scratch in the PACA to shuffle.
+ */
+@@ -197,6 +201,11 @@ dont_backup_fp:
+
+ /* Store the PPR in r11 and reset to decent value */
+ std r11, GPR11(r1) /* Temporary stash */
++
++ /* Reset MSR RI so we can take SLB faults again */
++ li r11, MSR_RI
++ mtmsrd r11, 1
++
+ mfspr r11, SPRN_PPR
+ HMT_MEDIUM
+
+@@ -329,8 +338,6 @@ _GLOBAL(__tm_recheckpoint)
+ */
+ subi r7, r7, STACK_FRAME_OVERHEAD
+
+- SET_SCRATCH0(r1)
+-
+ mfmsr r6
+ /* R4 = original MSR to indicate whether thread used FP/Vector etc. */
+
+@@ -397,11 +404,6 @@ restore_gprs:
+ ld r5, THREAD_TM_DSCR(r3)
+ ld r6, THREAD_TM_PPR(r3)
+
+- /* Clear the MSR RI since we are about to change R1. EE is already off
+- */
+- li r4, 0
+- mtmsrd r4, 1
+-
+ REST_GPR(0, r7) /* GPR0 */
+ REST_2GPRS(2, r7) /* GPR2-3 */
+ REST_GPR(4, r7) /* GPR4 */
+@@ -439,10 +441,34 @@ restore_gprs:
+ ld r6, _CCR(r7)
+ mtcr r6
+
+- REST_GPR(1, r7) /* GPR1 */
+- REST_GPR(5, r7) /* GPR5-7 */
+ REST_GPR(6, r7)
+- ld r7, GPR7(r7)
++
++ /*
++ * Store r1 and r5 on the stack so that we can access them
++ * after we clear MSR RI.
++ */
++
++ REST_GPR(5, r7)
++ std r5, -8(r1)
++ ld r5, GPR1(r7)
++ std r5, -16(r1)
++
++ REST_GPR(7, r7)
++
++ /* Clear MSR RI since we are about to change r1. EE is already off */
++ li r5, 0
++ mtmsrd r5, 1
++
++ /*
++ * BE CAREFUL HERE:
++ * At this point we can't take an SLB miss since we have MSR_RI
++ * off. Load only to/from the stack/paca which are in SLB bolted regions
++ * until we turn MSR RI back on.
++ */
++
++ SET_SCRATCH0(r1)
++ ld r5, -8(r1)
++ ld r1, -16(r1)
+
+ /* Commit register state as checkpointed state: */
+ TRECHKPT
+diff --git a/arch/powerpc/kvm/book3s_hv_rmhandlers.S b/arch/powerpc/kvm/book3s_hv_rmhandlers.S
+index 4329ea316683..549d28fdc291 100644
+--- a/arch/powerpc/kvm/book3s_hv_rmhandlers.S
++++ b/arch/powerpc/kvm/book3s_hv_rmhandlers.S
+@@ -632,112 +632,8 @@ END_FTR_SECTION_IFCLR(CPU_FTR_ARCH_207S)
+
+ #ifdef CONFIG_PPC_TRANSACTIONAL_MEM
+ BEGIN_FTR_SECTION
+- b skip_tm
+-END_FTR_SECTION_IFCLR(CPU_FTR_TM)
+-
+- /* Turn on TM/FP/VSX/VMX so we can restore them. */
+- mfmsr r5
+- li r6, MSR_TM >> 32
+- sldi r6, r6, 32
+- or r5, r5, r6
+- ori r5, r5, MSR_FP
+- oris r5, r5, (MSR_VEC | MSR_VSX)@h
+- mtmsrd r5
+-
+- /*
+- * The user may change these outside of a transaction, so they must
+- * always be context switched.
+- */
+- ld r5, VCPU_TFHAR(r4)
+- ld r6, VCPU_TFIAR(r4)
+- ld r7, VCPU_TEXASR(r4)
+- mtspr SPRN_TFHAR, r5
+- mtspr SPRN_TFIAR, r6
+- mtspr SPRN_TEXASR, r7
+-
+- ld r5, VCPU_MSR(r4)
+- rldicl. r5, r5, 64 - MSR_TS_S_LG, 62
+- beq skip_tm /* TM not active in guest */
+-
+- /* Make sure the failure summary is set, otherwise we'll program check
+- * when we trechkpt. It's possible that this might have been not set
+- * on a kvmppc_set_one_reg() call but we shouldn't let this crash the
+- * host.
+- */
+- oris r7, r7, (TEXASR_FS)@h
+- mtspr SPRN_TEXASR, r7
+-
+- /*
+- * We need to load up the checkpointed state for the guest.
+- * We need to do this early as it will blow away any GPRs, VSRs and
+- * some SPRs.
+- */
+-
+- mr r31, r4
+- addi r3, r31, VCPU_FPRS_TM
+- bl load_fp_state
+- addi r3, r31, VCPU_VRS_TM
+- bl load_vr_state
+- mr r4, r31
+- lwz r7, VCPU_VRSAVE_TM(r4)
+- mtspr SPRN_VRSAVE, r7
+-
+- ld r5, VCPU_LR_TM(r4)
+- lwz r6, VCPU_CR_TM(r4)
+- ld r7, VCPU_CTR_TM(r4)
+- ld r8, VCPU_AMR_TM(r4)
+- ld r9, VCPU_TAR_TM(r4)
+- mtlr r5
+- mtcr r6
+- mtctr r7
+- mtspr SPRN_AMR, r8
+- mtspr SPRN_TAR, r9
+-
+- /*
+- * Load up PPR and DSCR values but don't put them in the actual SPRs
+- * till the last moment to avoid running with userspace PPR and DSCR for
+- * too long.
+- */
+- ld r29, VCPU_DSCR_TM(r4)
+- ld r30, VCPU_PPR_TM(r4)
+-
+- std r2, PACATMSCRATCH(r13) /* Save TOC */
+-
+- /* Clear the MSR RI since r1, r13 are all going to be foobar. */
+- li r5, 0
+- mtmsrd r5, 1
+-
+- /* Load GPRs r0-r28 */
+- reg = 0
+- .rept 29
+- ld reg, VCPU_GPRS_TM(reg)(r31)
+- reg = reg + 1
+- .endr
+-
+- mtspr SPRN_DSCR, r29
+- mtspr SPRN_PPR, r30
+-
+- /* Load final GPRs */
+- ld 29, VCPU_GPRS_TM(29)(r31)
+- ld 30, VCPU_GPRS_TM(30)(r31)
+- ld 31, VCPU_GPRS_TM(31)(r31)
+-
+- /* TM checkpointed state is now setup. All GPRs are now volatile. */
+- TRECHKPT
+-
+- /* Now let's get back the state we need. */
+- HMT_MEDIUM
+- GET_PACA(r13)
+- ld r29, HSTATE_DSCR(r13)
+- mtspr SPRN_DSCR, r29
+- ld r4, HSTATE_KVM_VCPU(r13)
+- ld r1, HSTATE_HOST_R1(r13)
+- ld r2, PACATMSCRATCH(r13)
+-
+- /* Set the MSR RI since we have our registers back. */
+- li r5, MSR_RI
+- mtmsrd r5, 1
+-skip_tm:
++ bl kvmppc_restore_tm
++END_FTR_SECTION_IFSET(CPU_FTR_TM)
+ #endif
+
+ /* Load guest PMU registers */
+@@ -828,12 +724,6 @@ BEGIN_FTR_SECTION
+ /* Skip next section on POWER7 or PPC970 */
+ b 8f
+ END_FTR_SECTION_IFCLR(CPU_FTR_ARCH_207S)
+- /* Turn on TM so we can access TFHAR/TFIAR/TEXASR */
+- mfmsr r8
+- li r0, 1
+- rldimi r8, r0, MSR_TM_LG, 63-MSR_TM_LG
+- mtmsrd r8
+-
+ /* Load up POWER8-specific registers */
+ ld r5, VCPU_IAMR(r4)
+ lwz r6, VCPU_PSPB(r4)
+@@ -1354,106 +1244,8 @@ END_FTR_SECTION_IFSET(CPU_FTR_ARCH_206)
+
+ #ifdef CONFIG_PPC_TRANSACTIONAL_MEM
+ BEGIN_FTR_SECTION
+- b 2f
+-END_FTR_SECTION_IFCLR(CPU_FTR_TM)
+- /* Turn on TM. */
+- mfmsr r8
+- li r0, 1
+- rldimi r8, r0, MSR_TM_LG, 63-MSR_TM_LG
+- mtmsrd r8
+-
+- ld r5, VCPU_MSR(r9)
+- rldicl. r5, r5, 64 - MSR_TS_S_LG, 62
+- beq 1f /* TM not active in guest. */
+-
+- li r3, TM_CAUSE_KVM_RESCHED
+-
+- /* Clear the MSR RI since r1, r13 are all going to be foobar. */
+- li r5, 0
+- mtmsrd r5, 1
+-
+- /* All GPRs are volatile at this point. */
+- TRECLAIM(R3)
+-
+- /* Temporarily store r13 and r9 so we have some regs to play with */
+- SET_SCRATCH0(r13)
+- GET_PACA(r13)
+- std r9, PACATMSCRATCH(r13)
+- ld r9, HSTATE_KVM_VCPU(r13)
+-
+- /* Get a few more GPRs free. */
+- std r29, VCPU_GPRS_TM(29)(r9)
+- std r30, VCPU_GPRS_TM(30)(r9)
+- std r31, VCPU_GPRS_TM(31)(r9)
+-
+- /* Save away PPR and DSCR soon so don't run with user values. */
+- mfspr r31, SPRN_PPR
+- HMT_MEDIUM
+- mfspr r30, SPRN_DSCR
+- ld r29, HSTATE_DSCR(r13)
+- mtspr SPRN_DSCR, r29
+-
+- /* Save all but r9, r13 & r29-r31 */
+- reg = 0
+- .rept 29
+- .if (reg != 9) && (reg != 13)
+- std reg, VCPU_GPRS_TM(reg)(r9)
+- .endif
+- reg = reg + 1
+- .endr
+- /* ... now save r13 */
+- GET_SCRATCH0(r4)
+- std r4, VCPU_GPRS_TM(13)(r9)
+- /* ... and save r9 */
+- ld r4, PACATMSCRATCH(r13)
+- std r4, VCPU_GPRS_TM(9)(r9)
+-
+- /* Reload stack pointer and TOC. */
+- ld r1, HSTATE_HOST_R1(r13)
+- ld r2, PACATOC(r13)
+-
+- /* Set MSR RI now we have r1 and r13 back. */
+- li r5, MSR_RI
+- mtmsrd r5, 1
+-
+- /* Save away checkpinted SPRs. */
+- std r31, VCPU_PPR_TM(r9)
+- std r30, VCPU_DSCR_TM(r9)
+- mflr r5
+- mfcr r6
+- mfctr r7
+- mfspr r8, SPRN_AMR
+- mfspr r10, SPRN_TAR
+- std r5, VCPU_LR_TM(r9)
+- stw r6, VCPU_CR_TM(r9)
+- std r7, VCPU_CTR_TM(r9)
+- std r8, VCPU_AMR_TM(r9)
+- std r10, VCPU_TAR_TM(r9)
+-
+- /* Restore r12 as trap number. */
+- lwz r12, VCPU_TRAP(r9)
+-
+- /* Save FP/VSX. */
+- addi r3, r9, VCPU_FPRS_TM
+- bl store_fp_state
+- addi r3, r9, VCPU_VRS_TM
+- bl store_vr_state
+- mfspr r6, SPRN_VRSAVE
+- stw r6, VCPU_VRSAVE_TM(r9)
+-1:
+- /*
+- * We need to save these SPRs after the treclaim so that the software
+- * error code is recorded correctly in the TEXASR. Also the user may
+- * change these outside of a transaction, so they must always be
+- * context switched.
+- */
+- mfspr r5, SPRN_TFHAR
+- mfspr r6, SPRN_TFIAR
+- mfspr r7, SPRN_TEXASR
+- std r5, VCPU_TFHAR(r9)
+- std r6, VCPU_TFIAR(r9)
+- std r7, VCPU_TEXASR(r9)
+-2:
++ bl kvmppc_save_tm
++END_FTR_SECTION_IFSET(CPU_FTR_TM)
+ #endif
+
+ /* Increment yield count if they have a VPA */
+@@ -2181,6 +1973,13 @@ END_FTR_SECTION_IFCLR(CPU_FTR_ARCH_206)
+ /* save FP state */
+ bl kvmppc_save_fp
+
++#ifdef CONFIG_PPC_TRANSACTIONAL_MEM
++BEGIN_FTR_SECTION
++ ld r9, HSTATE_KVM_VCPU(r13)
++ bl kvmppc_save_tm
++END_FTR_SECTION_IFSET(CPU_FTR_TM)
++#endif
++
+ /*
+ * Take a nap until a decrementer or external or doobell interrupt
+ * occurs, with PECE1, PECE0 and PECEDP set in LPCR. Also clear the
+@@ -2220,6 +2019,12 @@ kvm_end_cede:
+ /* Woken by external or decrementer interrupt */
+ ld r1, HSTATE_HOST_R1(r13)
+
++#ifdef CONFIG_PPC_TRANSACTIONAL_MEM
++BEGIN_FTR_SECTION
++ bl kvmppc_restore_tm
++END_FTR_SECTION_IFSET(CPU_FTR_TM)
++#endif
++
+ /* load up FP state */
+ bl kvmppc_load_fp
+
+@@ -2500,6 +2305,239 @@ END_FTR_SECTION_IFSET(CPU_FTR_ALTIVEC)
+ mr r4,r31
+ blr
+
++#ifdef CONFIG_PPC_TRANSACTIONAL_MEM
++/*
++ * Save transactional state and TM-related registers.
++ * Called with r9 pointing to the vcpu struct.
++ * This can modify all checkpointed registers, but
++ * restores r1, r2 and r9 (vcpu pointer) before exit.
++ */
++kvmppc_save_tm:
++ mflr r0
++ std r0, PPC_LR_STKOFF(r1)
++
++ /* Turn on TM. */
++ mfmsr r8
++ li r0, 1
++ rldimi r8, r0, MSR_TM_LG, 63-MSR_TM_LG
++ mtmsrd r8
++
++ ld r5, VCPU_MSR(r9)
++ rldicl. r5, r5, 64 - MSR_TS_S_LG, 62
++ beq 1f /* TM not active in guest. */
++
++ std r1, HSTATE_HOST_R1(r13)
++ li r3, TM_CAUSE_KVM_RESCHED
++
++ /* Clear the MSR RI since r1, r13 are all going to be foobar. */
++ li r5, 0
++ mtmsrd r5, 1
++
++ /* All GPRs are volatile at this point. */
++ TRECLAIM(R3)
++
++ /* Temporarily store r13 and r9 so we have some regs to play with */
++ SET_SCRATCH0(r13)
++ GET_PACA(r13)
++ std r9, PACATMSCRATCH(r13)
++ ld r9, HSTATE_KVM_VCPU(r13)
++
++ /* Get a few more GPRs free. */
++ std r29, VCPU_GPRS_TM(29)(r9)
++ std r30, VCPU_GPRS_TM(30)(r9)
++ std r31, VCPU_GPRS_TM(31)(r9)
++
++ /* Save away PPR and DSCR soon so don't run with user values. */
++ mfspr r31, SPRN_PPR
++ HMT_MEDIUM
++ mfspr r30, SPRN_DSCR
++ ld r29, HSTATE_DSCR(r13)
++ mtspr SPRN_DSCR, r29
++
++ /* Save all but r9, r13 & r29-r31 */
++ reg = 0
++ .rept 29
++ .if (reg != 9) && (reg != 13)
++ std reg, VCPU_GPRS_TM(reg)(r9)
++ .endif
++ reg = reg + 1
++ .endr
++ /* ... now save r13 */
++ GET_SCRATCH0(r4)
++ std r4, VCPU_GPRS_TM(13)(r9)
++ /* ... and save r9 */
++ ld r4, PACATMSCRATCH(r13)
++ std r4, VCPU_GPRS_TM(9)(r9)
++
++ /* Reload stack pointer and TOC. */
++ ld r1, HSTATE_HOST_R1(r13)
++ ld r2, PACATOC(r13)
++
++ /* Set MSR RI now we have r1 and r13 back. */
++ li r5, MSR_RI
++ mtmsrd r5, 1
++
++ /* Save away checkpinted SPRs. */
++ std r31, VCPU_PPR_TM(r9)
++ std r30, VCPU_DSCR_TM(r9)
++ mflr r5
++ mfcr r6
++ mfctr r7
++ mfspr r8, SPRN_AMR
++ mfspr r10, SPRN_TAR
++ std r5, VCPU_LR_TM(r9)
++ stw r6, VCPU_CR_TM(r9)
++ std r7, VCPU_CTR_TM(r9)
++ std r8, VCPU_AMR_TM(r9)
++ std r10, VCPU_TAR_TM(r9)
++
++ /* Restore r12 as trap number. */
++ lwz r12, VCPU_TRAP(r9)
++
++ /* Save FP/VSX. */
++ addi r3, r9, VCPU_FPRS_TM
++ bl store_fp_state
++ addi r3, r9, VCPU_VRS_TM
++ bl store_vr_state
++ mfspr r6, SPRN_VRSAVE
++ stw r6, VCPU_VRSAVE_TM(r9)
++1:
++ /*
++ * We need to save these SPRs after the treclaim so that the software
++ * error code is recorded correctly in the TEXASR. Also the user may
++ * change these outside of a transaction, so they must always be
++ * context switched.
++ */
++ mfspr r5, SPRN_TFHAR
++ mfspr r6, SPRN_TFIAR
++ mfspr r7, SPRN_TEXASR
++ std r5, VCPU_TFHAR(r9)
++ std r6, VCPU_TFIAR(r9)
++ std r7, VCPU_TEXASR(r9)
++
++ ld r0, PPC_LR_STKOFF(r1)
++ mtlr r0
++ blr
++
++/*
++ * Restore transactional state and TM-related registers.
++ * Called with r4 pointing to the vcpu struct.
++ * This potentially modifies all checkpointed registers.
++ * It restores r1, r2, r4 from the PACA.
++ */
++kvmppc_restore_tm:
++ mflr r0
++ std r0, PPC_LR_STKOFF(r1)
++
++ /* Turn on TM/FP/VSX/VMX so we can restore them. */
++ mfmsr r5
++ li r6, MSR_TM >> 32
++ sldi r6, r6, 32
++ or r5, r5, r6
++ ori r5, r5, MSR_FP
++ oris r5, r5, (MSR_VEC | MSR_VSX)@h
++ mtmsrd r5
++
++ /*
++ * The user may change these outside of a transaction, so they must
++ * always be context switched.
++ */
++ ld r5, VCPU_TFHAR(r4)
++ ld r6, VCPU_TFIAR(r4)
++ ld r7, VCPU_TEXASR(r4)
++ mtspr SPRN_TFHAR, r5
++ mtspr SPRN_TFIAR, r6
++ mtspr SPRN_TEXASR, r7
++
++ ld r5, VCPU_MSR(r4)
++ rldicl. r5, r5, 64 - MSR_TS_S_LG, 62
++ beqlr /* TM not active in guest */
++ std r1, HSTATE_HOST_R1(r13)
++
++ /* Make sure the failure summary is set, otherwise we'll program check
++ * when we trechkpt. It's possible that this might have been not set
++ * on a kvmppc_set_one_reg() call but we shouldn't let this crash the
++ * host.
++ */
++ oris r7, r7, (TEXASR_FS)@h
++ mtspr SPRN_TEXASR, r7
++
++ /*
++ * We need to load up the checkpointed state for the guest.
++ * We need to do this early as it will blow away any GPRs, VSRs and
++ * some SPRs.
++ */
++
++ mr r31, r4
++ addi r3, r31, VCPU_FPRS_TM
++ bl load_fp_state
++ addi r3, r31, VCPU_VRS_TM
++ bl load_vr_state
++ mr r4, r31
++ lwz r7, VCPU_VRSAVE_TM(r4)
++ mtspr SPRN_VRSAVE, r7
++
++ ld r5, VCPU_LR_TM(r4)
++ lwz r6, VCPU_CR_TM(r4)
++ ld r7, VCPU_CTR_TM(r4)
++ ld r8, VCPU_AMR_TM(r4)
++ ld r9, VCPU_TAR_TM(r4)
++ mtlr r5
++ mtcr r6
++ mtctr r7
++ mtspr SPRN_AMR, r8
++ mtspr SPRN_TAR, r9
++
++ /*
++ * Load up PPR and DSCR values but don't put them in the actual SPRs
++ * till the last moment to avoid running with userspace PPR and DSCR for
++ * too long.
++ */
++ ld r29, VCPU_DSCR_TM(r4)
++ ld r30, VCPU_PPR_TM(r4)
++
++ std r2, PACATMSCRATCH(r13) /* Save TOC */
++
++ /* Clear the MSR RI since r1, r13 are all going to be foobar. */
++ li r5, 0
++ mtmsrd r5, 1
++
++ /* Load GPRs r0-r28 */
++ reg = 0
++ .rept 29
++ ld reg, VCPU_GPRS_TM(reg)(r31)
++ reg = reg + 1
++ .endr
++
++ mtspr SPRN_DSCR, r29
++ mtspr SPRN_PPR, r30
++
++ /* Load final GPRs */
++ ld 29, VCPU_GPRS_TM(29)(r31)
++ ld 30, VCPU_GPRS_TM(30)(r31)
++ ld 31, VCPU_GPRS_TM(31)(r31)
++
++ /* TM checkpointed state is now setup. All GPRs are now volatile. */
++ TRECHKPT
++
++ /* Now let's get back the state we need. */
++ HMT_MEDIUM
++ GET_PACA(r13)
++ ld r29, HSTATE_DSCR(r13)
++ mtspr SPRN_DSCR, r29
++ ld r4, HSTATE_KVM_VCPU(r13)
++ ld r1, HSTATE_HOST_R1(r13)
++ ld r2, PACATMSCRATCH(r13)
++
++ /* Set the MSR RI since we have our registers back. */
++ li r5, MSR_RI
++ mtmsrd r5, 1
++
++ ld r0, PPC_LR_STKOFF(r1)
++ mtlr r0
++ blr
++#endif
++
+ /*
+ * We come here if we get any exception or interrupt while we are
+ * executing host real mode code while in guest MMU context.
+diff --git a/arch/powerpc/platforms/pseries/iommu.c b/arch/powerpc/platforms/pseries/iommu.c
+index e32e00976a94..05a2c9eefc08 100644
+--- a/arch/powerpc/platforms/pseries/iommu.c
++++ b/arch/powerpc/platforms/pseries/iommu.c
+@@ -825,7 +825,8 @@ machine_arch_initcall(pseries, find_existing_ddw_windows);
+ static int query_ddw(struct pci_dev *dev, const u32 *ddw_avail,
+ struct ddw_query_response *query)
+ {
+- struct eeh_dev *edev;
++ struct device_node *dn;
++ struct pci_dn *pdn;
+ u32 cfg_addr;
+ u64 buid;
+ int ret;
+@@ -836,11 +837,10 @@ static int query_ddw(struct pci_dev *dev, const u32 *ddw_avail,
+ * Retrieve them from the pci device, not the node with the
+ * dma-window property
+ */
+- edev = pci_dev_to_eeh_dev(dev);
+- cfg_addr = edev->config_addr;
+- if (edev->pe_config_addr)
+- cfg_addr = edev->pe_config_addr;
+- buid = edev->phb->buid;
++ dn = pci_device_to_OF_node(dev);
++ pdn = PCI_DN(dn);
++ buid = pdn->phb->buid;
++ cfg_addr = ((pdn->busno << 16) | (pdn->devfn << 8));
+
+ ret = rtas_call(ddw_avail[0], 3, 5, (u32 *)query,
+ cfg_addr, BUID_HI(buid), BUID_LO(buid));
+@@ -854,7 +854,8 @@ static int create_ddw(struct pci_dev *dev, const u32 *ddw_avail,
+ struct ddw_create_response *create, int page_shift,
+ int window_shift)
+ {
+- struct eeh_dev *edev;
++ struct device_node *dn;
++ struct pci_dn *pdn;
+ u32 cfg_addr;
+ u64 buid;
+ int ret;
+@@ -865,11 +866,10 @@ static int create_ddw(struct pci_dev *dev, const u32 *ddw_avail,
+ * Retrieve them from the pci device, not the node with the
+ * dma-window property
+ */
+- edev = pci_dev_to_eeh_dev(dev);
+- cfg_addr = edev->config_addr;
+- if (edev->pe_config_addr)
+- cfg_addr = edev->pe_config_addr;
+- buid = edev->phb->buid;
++ dn = pci_device_to_OF_node(dev);
++ pdn = PCI_DN(dn);
++ buid = pdn->phb->buid;
++ cfg_addr = ((pdn->busno << 16) | (pdn->devfn << 8));
+
+ do {
+ /* extra outputs are LIOBN and dma-addr (hi, lo) */
+diff --git a/arch/s390/mm/pgtable.c b/arch/s390/mm/pgtable.c
+index 1b79ca67392f..35fde2a24751 100644
+--- a/arch/s390/mm/pgtable.c
++++ b/arch/s390/mm/pgtable.c
+@@ -207,7 +207,7 @@ EXPORT_SYMBOL_GPL(gmap_alloc);
+ static void gmap_flush_tlb(struct gmap *gmap)
+ {
+ if (MACHINE_HAS_IDTE)
+- __tlb_flush_asce(gmap->mm, gmap->asce);
++ __tlb_flush_idte(gmap->asce);
+ else
+ __tlb_flush_global();
+ }
+@@ -246,7 +246,7 @@ void gmap_free(struct gmap *gmap)
+
+ /* Flush tlb. */
+ if (MACHINE_HAS_IDTE)
+- __tlb_flush_asce(gmap->mm, gmap->asce);
++ __tlb_flush_idte(gmap->asce);
+ else
+ __tlb_flush_global();
+
+diff --git a/arch/x86/kernel/cpu/perf_event_intel.c b/arch/x86/kernel/cpu/perf_event_intel.c
+index df11583a9041..22fbeafa140b 100644
+--- a/arch/x86/kernel/cpu/perf_event_intel.c
++++ b/arch/x86/kernel/cpu/perf_event_intel.c
+@@ -2609,7 +2609,7 @@ __init int intel_pmu_init(void)
+ c->idxmsk64 |= (1ULL << x86_pmu.num_counters) - 1;
+ }
+ c->idxmsk64 &=
+- ~(~0UL << (INTEL_PMC_IDX_FIXED + x86_pmu.num_counters_fixed));
++ ~(~0ULL << (INTEL_PMC_IDX_FIXED + x86_pmu.num_counters_fixed));
+ c->weight = hweight64(c->idxmsk64);
+ }
+ }
+diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
+index d9c11f3f5b18..888eaab57fbc 100644
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -7767,14 +7767,29 @@ static void vmx_load_vmcs01(struct kvm_vcpu *vcpu)
+ put_cpu();
+ }
+
++/*
++ * Ensure that the current vmcs of the logical processor is the
++ * vmcs01 of the vcpu before calling free_nested().
++ */
++static void vmx_free_vcpu_nested(struct kvm_vcpu *vcpu)
++{
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++ int r;
++
++ r = vcpu_load(vcpu);
++ BUG_ON(r);
++ vmx_load_vmcs01(vcpu);
++ free_nested(vmx);
++ vcpu_put(vcpu);
++}
++
+ static void vmx_free_vcpu(struct kvm_vcpu *vcpu)
+ {
+ struct vcpu_vmx *vmx = to_vmx(vcpu);
+
+ free_vpid(vmx);
+ leave_guest_mode(vcpu);
+- vmx_load_vmcs01(vcpu);
+- free_nested(vmx);
++ vmx_free_vcpu_nested(vcpu);
+ free_loaded_vmcs(vmx->loaded_vmcs);
+ kfree(vmx->guest_msrs);
+ kvm_vcpu_uninit(vcpu);
+diff --git a/arch/x86/syscalls/syscall_32.tbl b/arch/x86/syscalls/syscall_32.tbl
+index 9fe1b5d002f0..3d05d0080961 100644
+--- a/arch/x86/syscalls/syscall_32.tbl
++++ b/arch/x86/syscalls/syscall_32.tbl
+@@ -294,7 +294,7 @@
+ # 285 sys_setaltroot
+ 286 i386 add_key sys_add_key
+ 287 i386 request_key sys_request_key
+-288 i386 keyctl sys_keyctl
++288 i386 keyctl sys_keyctl compat_sys_keyctl
+ 289 i386 ioprio_set sys_ioprio_set
+ 290 i386 ioprio_get sys_ioprio_get
+ 291 i386 inotify_init sys_inotify_init
+diff --git a/block/genhd.c b/block/genhd.c
+index c2fb3f7bdec4..40a06b934b1f 100644
+--- a/block/genhd.c
++++ b/block/genhd.c
+@@ -829,6 +829,7 @@ static void disk_seqf_stop(struct seq_file *seqf, void *v)
+ if (iter) {
+ class_dev_iter_exit(iter);
+ kfree(iter);
++ seqf->private = NULL;
+ }
+ }
+
+diff --git a/crypto/gcm.c b/crypto/gcm.c
+index 2e403f6138c1..ee3c29bd7ddb 100644
+--- a/crypto/gcm.c
++++ b/crypto/gcm.c
+@@ -716,7 +716,9 @@ static struct crypto_instance *crypto_gcm_alloc_common(struct rtattr **tb,
+
+ ghash_alg = crypto_find_alg(ghash_name, &crypto_ahash_type,
+ CRYPTO_ALG_TYPE_HASH,
+- CRYPTO_ALG_TYPE_AHASH_MASK);
++ CRYPTO_ALG_TYPE_AHASH_MASK |
++ crypto_requires_sync(algt->type,
++ algt->mask));
+ if (IS_ERR(ghash_alg))
+ return ERR_CAST(ghash_alg);
+
+diff --git a/crypto/scatterwalk.c b/crypto/scatterwalk.c
+index 79ca2278c2a3..0ec7a6fa3d4d 100644
+--- a/crypto/scatterwalk.c
++++ b/crypto/scatterwalk.c
+@@ -68,7 +68,8 @@ static void scatterwalk_pagedone(struct scatter_walk *walk, int out,
+
+ void scatterwalk_done(struct scatter_walk *walk, int out, int more)
+ {
+- if (!(scatterwalk_pagelen(walk) & (PAGE_SIZE - 1)) || !more)
++ if (!more || walk->offset >= walk->sg->offset + walk->sg->length ||
++ !(walk->offset & (PAGE_SIZE - 1)))
+ scatterwalk_pagedone(walk, out, more);
+ }
+ EXPORT_SYMBOL_GPL(scatterwalk_done);
+diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c
+index cbea17da6fe6..036969223c16 100644
+--- a/drivers/bluetooth/ath3k.c
++++ b/drivers/bluetooth/ath3k.c
+@@ -120,6 +120,8 @@ static const struct usb_device_id ath3k_table[] = {
+ { USB_DEVICE(0x13d3, 0x3432) },
+ { USB_DEVICE(0x13d3, 0x3472) },
+ { USB_DEVICE(0x13d3, 0x3474) },
++ { USB_DEVICE(0x13d3, 0x3487) },
++ { USB_DEVICE(0x13d3, 0x3490) },
+
+ /* Atheros AR5BBU12 with sflash firmware */
+ { USB_DEVICE(0x0489, 0xE02C) },
+@@ -184,6 +186,8 @@ static const struct usb_device_id ath3k_blist_tbl[] = {
+ { USB_DEVICE(0x13d3, 0x3432), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x13d3, 0x3472), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x13d3, 0x3474), .driver_info = BTUSB_ATH3012 },
++ { USB_DEVICE(0x13d3, 0x3487), .driver_info = BTUSB_ATH3012 },
++ { USB_DEVICE(0x13d3, 0x3490), .driver_info = BTUSB_ATH3012 },
+
+ /* Atheros AR5BBU22 with sflash firmware */
+ { USB_DEVICE(0x0489, 0xE036), .driver_info = BTUSB_ATH3012 },
+diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
+index b3334daab009..2dd73a3e95a2 100644
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -212,6 +212,8 @@ static const struct usb_device_id blacklist_table[] = {
+ { USB_DEVICE(0x13d3, 0x3432), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x13d3, 0x3472), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x13d3, 0x3474), .driver_info = BTUSB_ATH3012 },
++ { USB_DEVICE(0x13d3, 0x3487), .driver_info = BTUSB_ATH3012 },
++ { USB_DEVICE(0x13d3, 0x3490), .driver_info = BTUSB_ATH3012 },
+
+ /* Atheros AR5BBU12 with sflash firmware */
+ { USB_DEVICE(0x0489, 0xe02c), .driver_info = BTUSB_IGNORE },
+diff --git a/drivers/gpio/gpio-intel-mid.c b/drivers/gpio/gpio-intel-mid.c
+index aa28c65eb6b4..14945fd9d5e1 100644
+--- a/drivers/gpio/gpio-intel-mid.c
++++ b/drivers/gpio/gpio-intel-mid.c
+@@ -17,7 +17,6 @@
+ * Moorestown platform Langwell chip.
+ * Medfield platform Penwell chip.
+ * Clovertrail platform Cloverview chip.
+- * Merrifield platform Tangier chip.
+ */
+
+ #include <linux/module.h>
+@@ -64,10 +63,6 @@ enum GPIO_REG {
+ /* intel_mid gpio driver data */
+ struct intel_mid_gpio_ddata {
+ u16 ngpio; /* number of gpio pins */
+- u32 gplr_offset; /* offset of first GPLR register from base */
+- u32 flis_base; /* base address of FLIS registers */
+- u32 flis_len; /* length of FLIS registers */
+- u32 (*get_flis_offset)(int gpio);
+ u32 chip_irq_type; /* chip interrupt type */
+ };
+
+@@ -257,15 +252,6 @@ static const struct intel_mid_gpio_ddata gpio_cloverview_core = {
+ .chip_irq_type = INTEL_MID_IRQ_TYPE_EDGE,
+ };
+
+-static const struct intel_mid_gpio_ddata gpio_tangier = {
+- .ngpio = 192,
+- .gplr_offset = 4,
+- .flis_base = 0xff0c0000,
+- .flis_len = 0x8000,
+- .get_flis_offset = NULL,
+- .chip_irq_type = INTEL_MID_IRQ_TYPE_EDGE,
+-};
+-
+ static const struct pci_device_id intel_gpio_ids[] = {
+ {
+ /* Lincroft */
+@@ -292,11 +278,6 @@ static const struct pci_device_id intel_gpio_ids[] = {
+ PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x08f7),
+ .driver_data = (kernel_ulong_t)&gpio_cloverview_core,
+ },
+- {
+- /* Tangier */
+- PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x1199),
+- .driver_data = (kernel_ulong_t)&gpio_tangier,
+- },
+ { 0 }
+ };
+ MODULE_DEVICE_TABLE(pci, intel_gpio_ids);
+diff --git a/drivers/gpio/gpio-pca953x.c b/drivers/gpio/gpio-pca953x.c
+index 16f7c4f2d8c8..6e2720ea7d45 100644
+--- a/drivers/gpio/gpio-pca953x.c
++++ b/drivers/gpio/gpio-pca953x.c
+@@ -76,7 +76,7 @@ MODULE_DEVICE_TABLE(i2c, pca953x_id);
+ #define MAX_BANK 5
+ #define BANK_SZ 8
+
+-#define NBANK(chip) (chip->gpio_chip.ngpio / BANK_SZ)
++#define NBANK(chip) DIV_ROUND_UP(chip->gpio_chip.ngpio, BANK_SZ)
+
+ struct pca953x_chip {
+ unsigned gpio_start;
+diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
+index 234e89c013dd..c2d76fed3abf 100644
+--- a/drivers/gpu/drm/i915/intel_display.c
++++ b/drivers/gpu/drm/i915/intel_display.c
+@@ -6526,14 +6526,12 @@ static void ironlake_init_pch_refclk(struct drm_device *dev)
+ {
+ struct drm_i915_private *dev_priv = dev->dev_private;
+ struct intel_encoder *encoder;
+- int i;
+ u32 val, final;
+ bool has_lvds = false;
+ bool has_cpu_edp = false;
+ bool has_panel = false;
+ bool has_ck505 = false;
+ bool can_ssc = false;
+- bool using_ssc_source = false;
+
+ /* We need to take the global config into account */
+ for_each_intel_encoder(dev, encoder) {
+@@ -6558,22 +6556,8 @@ static void ironlake_init_pch_refclk(struct drm_device *dev)
+ can_ssc = true;
+ }
+
+- /* Check if any DPLLs are using the SSC source */
+- for (i = 0; i < dev_priv->num_shared_dpll; i++) {
+- u32 temp = I915_READ(PCH_DPLL(i));
+-
+- if (!(temp & DPLL_VCO_ENABLE))
+- continue;
+-
+- if ((temp & PLL_REF_INPUT_MASK) ==
+- PLLB_REF_INPUT_SPREADSPECTRUMIN) {
+- using_ssc_source = true;
+- break;
+- }
+- }
+-
+- DRM_DEBUG_KMS("has_panel %d has_lvds %d has_ck505 %d using_ssc_source %d\n",
+- has_panel, has_lvds, has_ck505, using_ssc_source);
++ DRM_DEBUG_KMS("has_panel %d has_lvds %d has_ck505 %d\n",
++ has_panel, has_lvds, has_ck505);
+
+ /* Ironlake: try to setup display ref clock before DPLL
+ * enabling. This is only under driver's control after
+@@ -6610,9 +6594,9 @@ static void ironlake_init_pch_refclk(struct drm_device *dev)
+ final |= DREF_CPU_SOURCE_OUTPUT_NONSPREAD;
+ } else
+ final |= DREF_CPU_SOURCE_OUTPUT_DISABLE;
+- } else if (using_ssc_source) {
+- final |= DREF_SSC_SOURCE_ENABLE;
+- final |= DREF_SSC1_ENABLE;
++ } else {
++ final |= DREF_SSC_SOURCE_DISABLE;
++ final |= DREF_CPU_SOURCE_OUTPUT_DISABLE;
+ }
+
+ if (final == val)
+@@ -6658,7 +6642,7 @@ static void ironlake_init_pch_refclk(struct drm_device *dev)
+ POSTING_READ(PCH_DREF_CONTROL);
+ udelay(200);
+ } else {
+- DRM_DEBUG_KMS("Disabling CPU source output\n");
++ DRM_DEBUG_KMS("Disabling SSC entirely\n");
+
+ val &= ~DREF_CPU_SOURCE_OUTPUT_MASK;
+
+@@ -6669,20 +6653,16 @@ static void ironlake_init_pch_refclk(struct drm_device *dev)
+ POSTING_READ(PCH_DREF_CONTROL);
+ udelay(200);
+
+- if (!using_ssc_source) {
+- DRM_DEBUG_KMS("Disabling SSC source\n");
+-
+- /* Turn off the SSC source */
+- val &= ~DREF_SSC_SOURCE_MASK;
+- val |= DREF_SSC_SOURCE_DISABLE;
++ /* Turn off the SSC source */
++ val &= ~DREF_SSC_SOURCE_MASK;
++ val |= DREF_SSC_SOURCE_DISABLE;
+
+- /* Turn off SSC1 */
+- val &= ~DREF_SSC1_ENABLE;
++ /* Turn off SSC1 */
++ val &= ~DREF_SSC1_ENABLE;
+
+- I915_WRITE(PCH_DREF_CONTROL, val);
+- POSTING_READ(PCH_DREF_CONTROL);
+- udelay(200);
+- }
++ I915_WRITE(PCH_DREF_CONTROL, val);
++ POSTING_READ(PCH_DREF_CONTROL);
++ udelay(200);
+ }
+
+ BUG_ON(val != final);
+diff --git a/drivers/gpu/drm/nouveau/nv04_fbcon.c b/drivers/gpu/drm/nouveau/nv04_fbcon.c
+index 7ab83f7f2763..ec974273d1e4 100644
+--- a/drivers/gpu/drm/nouveau/nv04_fbcon.c
++++ b/drivers/gpu/drm/nouveau/nv04_fbcon.c
+@@ -107,11 +107,11 @@ nv04_fbcon_imageblit(struct fb_info *info, const struct fb_image *image)
+ ((image->dx + image->width) & 0xffff));
+ OUT_RING(chan, bg);
+ OUT_RING(chan, fg);
+- OUT_RING(chan, (image->height << 16) | image->width);
++ OUT_RING(chan, (image->height << 16) | ALIGN(image->width, 8));
+ OUT_RING(chan, (image->height << 16) | image->width);
+ OUT_RING(chan, (image->dy << 16) | (image->dx & 0xffff));
+
+- dsize = ALIGN(image->width * image->height, 32) >> 5;
++ dsize = ALIGN(ALIGN(image->width, 8) * image->height, 32) >> 5;
+ while (dsize) {
+ int iter_len = dsize > 128 ? 128 : dsize;
+
+diff --git a/drivers/gpu/drm/nouveau/nv50_fbcon.c b/drivers/gpu/drm/nouveau/nv50_fbcon.c
+index cb2a71ada99e..8462f72e8819 100644
+--- a/drivers/gpu/drm/nouveau/nv50_fbcon.c
++++ b/drivers/gpu/drm/nouveau/nv50_fbcon.c
+@@ -125,7 +125,7 @@ nv50_fbcon_imageblit(struct fb_info *info, const struct fb_image *image)
+ OUT_RING(chan, 0);
+ OUT_RING(chan, image->dy);
+
+- dwords = ALIGN(image->width * image->height, 32) >> 5;
++ dwords = ALIGN(ALIGN(image->width, 8) * image->height, 32) >> 5;
+ while (dwords) {
+ int push = dwords > 2047 ? 2047 : dwords;
+
+diff --git a/drivers/gpu/drm/nouveau/nvc0_fbcon.c b/drivers/gpu/drm/nouveau/nvc0_fbcon.c
+index 69f760e8c54f..90552420c217 100644
+--- a/drivers/gpu/drm/nouveau/nvc0_fbcon.c
++++ b/drivers/gpu/drm/nouveau/nvc0_fbcon.c
+@@ -125,7 +125,7 @@ nvc0_fbcon_imageblit(struct fb_info *info, const struct fb_image *image)
+ OUT_RING (chan, 0);
+ OUT_RING (chan, image->dy);
+
+- dwords = ALIGN(image->width * image->height, 32) >> 5;
++ dwords = ALIGN(ALIGN(image->width, 8) * image->height, 32) >> 5;
+ while (dwords) {
+ int push = dwords > 2047 ? 2047 : dwords;
+
+diff --git a/drivers/gpu/drm/radeon/atombios_encoders.c b/drivers/gpu/drm/radeon/atombios_encoders.c
+index 07dd3523425a..e809d2574356 100644
+--- a/drivers/gpu/drm/radeon/atombios_encoders.c
++++ b/drivers/gpu/drm/radeon/atombios_encoders.c
+@@ -119,6 +119,7 @@ atombios_set_backlight_level(struct radeon_encoder *radeon_encoder, u8 level)
+ case ENCODER_OBJECT_ID_INTERNAL_KLDSCP_LVTMA:
+ case ENCODER_OBJECT_ID_INTERNAL_UNIPHY1:
+ case ENCODER_OBJECT_ID_INTERNAL_UNIPHY2:
++ case ENCODER_OBJECT_ID_INTERNAL_UNIPHY3:
+ if (dig->backlight_level == 0)
+ atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_LCD_BLOFF, 0, 0);
+ else {
+diff --git a/drivers/gpu/drm/radeon/radeon_atombios.c b/drivers/gpu/drm/radeon/radeon_atombios.c
+index 882171b411f0..ad0f9c7882c4 100644
+--- a/drivers/gpu/drm/radeon/radeon_atombios.c
++++ b/drivers/gpu/drm/radeon/radeon_atombios.c
+@@ -1128,7 +1128,7 @@ bool radeon_atom_get_clock_info(struct drm_device *dev)
+ le16_to_cpu(firmware_info->info.usReferenceClock);
+ p1pll->reference_div = 0;
+
+- if (crev < 2)
++ if ((frev < 2) && (crev < 2))
+ p1pll->pll_out_min =
+ le16_to_cpu(firmware_info->info.usMinPixelClockPLL_Output);
+ else
+@@ -1137,7 +1137,7 @@ bool radeon_atom_get_clock_info(struct drm_device *dev)
+ p1pll->pll_out_max =
+ le32_to_cpu(firmware_info->info.ulMaxPixelClockPLL_Output);
+
+- if (crev >= 4) {
++ if (((frev < 2) && (crev >= 4)) || (frev >= 2)) {
+ p1pll->lcd_pll_out_min =
+ le16_to_cpu(firmware_info->info_14.usLcdMinPixelClockPLL_Output) * 100;
+ if (p1pll->lcd_pll_out_min == 0)
+diff --git a/drivers/gpu/drm/radeon/radeon_atpx_handler.c b/drivers/gpu/drm/radeon/radeon_atpx_handler.c
+index 8bc7d0bbd3c8..868247c22de4 100644
+--- a/drivers/gpu/drm/radeon/radeon_atpx_handler.c
++++ b/drivers/gpu/drm/radeon/radeon_atpx_handler.c
+@@ -10,6 +10,7 @@
+ #include <linux/slab.h>
+ #include <linux/acpi.h>
+ #include <linux/pci.h>
++#include <linux/delay.h>
+
+ #include "radeon_acpi.h"
+
+@@ -255,6 +256,10 @@ static int radeon_atpx_set_discrete_state(struct radeon_atpx *atpx, u8 state)
+ if (!info)
+ return -EIO;
+ kfree(info);
++
++ /* 200ms delay is required after off */
++ if (state == 0)
++ msleep(200);
+ }
+ return 0;
+ }
+diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c
+index 15f09068ac00..4f686bb6bad7 100644
+--- a/drivers/gpu/drm/radeon/radeon_connectors.c
++++ b/drivers/gpu/drm/radeon/radeon_connectors.c
+@@ -1949,7 +1949,6 @@ radeon_add_atom_connector(struct drm_device *dev,
+ DRM_MODE_SCALE_NONE);
+ /* no HPD on analog connectors */
+ radeon_connector->hpd.hpd = RADEON_HPD_NONE;
+- connector->polled = DRM_CONNECTOR_POLL_CONNECT;
+ connector->interlace_allowed = true;
+ connector->doublescan_allowed = true;
+ break;
+@@ -2180,8 +2179,10 @@ radeon_add_atom_connector(struct drm_device *dev,
+ }
+
+ if (radeon_connector->hpd.hpd == RADEON_HPD_NONE) {
+- if (i2c_bus->valid)
+- connector->polled = DRM_CONNECTOR_POLL_CONNECT;
++ if (i2c_bus->valid) {
++ connector->polled = DRM_CONNECTOR_POLL_CONNECT |
++ DRM_CONNECTOR_POLL_DISCONNECT;
++ }
+ } else
+ connector->polled = DRM_CONNECTOR_POLL_HPD;
+
+@@ -2257,7 +2258,6 @@ radeon_add_legacy_connector(struct drm_device *dev,
+ 1);
+ /* no HPD on analog connectors */
+ radeon_connector->hpd.hpd = RADEON_HPD_NONE;
+- connector->polled = DRM_CONNECTOR_POLL_CONNECT;
+ connector->interlace_allowed = true;
+ connector->doublescan_allowed = true;
+ break;
+@@ -2342,10 +2342,13 @@ radeon_add_legacy_connector(struct drm_device *dev,
+ }
+
+ if (radeon_connector->hpd.hpd == RADEON_HPD_NONE) {
+- if (i2c_bus->valid)
+- connector->polled = DRM_CONNECTOR_POLL_CONNECT;
++ if (i2c_bus->valid) {
++ connector->polled = DRM_CONNECTOR_POLL_CONNECT |
++ DRM_CONNECTOR_POLL_DISCONNECT;
++ }
+ } else
+ connector->polled = DRM_CONNECTOR_POLL_HPD;
++
+ connector->display_info.subpixel_order = subpixel_order;
+ drm_connector_register(connector);
+ }
+diff --git a/drivers/hid/uhid.c b/drivers/hid/uhid.c
+index e094c572b86e..1a2032c2c1fb 100644
+--- a/drivers/hid/uhid.c
++++ b/drivers/hid/uhid.c
+@@ -51,10 +51,26 @@ struct uhid_device {
+ u32 report_id;
+ u32 report_type;
+ struct uhid_event report_buf;
++ struct work_struct worker;
+ };
+
+ static struct miscdevice uhid_misc;
+
++static void uhid_device_add_worker(struct work_struct *work)
++{
++ struct uhid_device *uhid = container_of(work, struct uhid_device, worker);
++ int ret;
++
++ ret = hid_add_device(uhid->hid);
++ if (ret) {
++ hid_err(uhid->hid, "Cannot register HID device: error %d\n", ret);
++
++ hid_destroy_device(uhid->hid);
++ uhid->hid = NULL;
++ uhid->running = false;
++ }
++}
++
+ static void uhid_queue(struct uhid_device *uhid, struct uhid_event *ev)
+ {
+ __u8 newhead;
+@@ -498,18 +514,14 @@ static int uhid_dev_create2(struct uhid_device *uhid,
+ uhid->hid = hid;
+ uhid->running = true;
+
+- ret = hid_add_device(hid);
+- if (ret) {
+- hid_err(hid, "Cannot register HID device\n");
+- goto err_hid;
+- }
++ /* Adding of a HID device is done through a worker, to allow HID drivers
++ * which use feature requests during .probe to work, without they would
++ * be blocked on devlock, which is held by uhid_char_write.
++ */
++ schedule_work(&uhid->worker);
+
+ return 0;
+
+-err_hid:
+- hid_destroy_device(hid);
+- uhid->hid = NULL;
+- uhid->running = false;
+ err_free:
+ kfree(uhid->rd_data);
+ uhid->rd_data = NULL;
+@@ -550,6 +562,8 @@ static int uhid_dev_destroy(struct uhid_device *uhid)
+ uhid->running = false;
+ wake_up_interruptible(&uhid->report_wait);
+
++ cancel_work_sync(&uhid->worker);
++
+ hid_destroy_device(uhid->hid);
+ kfree(uhid->rd_data);
+
+@@ -612,6 +626,7 @@ static int uhid_char_open(struct inode *inode, struct file *file)
+ init_waitqueue_head(&uhid->waitq);
+ init_waitqueue_head(&uhid->report_wait);
+ uhid->running = false;
++ INIT_WORK(&uhid->worker, uhid_device_add_worker);
+
+ file->private_data = uhid;
+ nonseekable_open(inode, file);
+diff --git a/drivers/input/serio/i8042.c b/drivers/input/serio/i8042.c
+index 804d2e02010a..1889f0a6c4ca 100644
+--- a/drivers/input/serio/i8042.c
++++ b/drivers/input/serio/i8042.c
+@@ -1230,6 +1230,7 @@ static int __init i8042_create_kbd_port(void)
+ serio->start = i8042_start;
+ serio->stop = i8042_stop;
+ serio->close = i8042_port_close;
++ serio->ps2_cmd_mutex = &i8042_mutex;
+ serio->port_data = port;
+ serio->dev.parent = &i8042_platform_device->dev;
+ strlcpy(serio->name, "i8042 KBD port", sizeof(serio->name));
+@@ -1323,21 +1324,6 @@ static void i8042_unregister_ports(void)
+ }
+ }
+
+-/*
+- * Checks whether port belongs to i8042 controller.
+- */
+-bool i8042_check_port_owner(const struct serio *port)
+-{
+- int i;
+-
+- for (i = 0; i < I8042_NUM_PORTS; i++)
+- if (i8042_ports[i].serio == port)
+- return true;
+-
+- return false;
+-}
+-EXPORT_SYMBOL(i8042_check_port_owner);
+-
+ static void i8042_free_irqs(void)
+ {
+ if (i8042_aux_irq_registered)
+diff --git a/drivers/input/serio/libps2.c b/drivers/input/serio/libps2.c
+index 75516996db20..ded0c6f65c9f 100644
+--- a/drivers/input/serio/libps2.c
++++ b/drivers/input/serio/libps2.c
+@@ -56,19 +56,17 @@ EXPORT_SYMBOL(ps2_sendbyte);
+
+ void ps2_begin_command(struct ps2dev *ps2dev)
+ {
+- mutex_lock(&ps2dev->cmd_mutex);
++ struct mutex *m = ps2dev->serio->ps2_cmd_mutex ?: &ps2dev->cmd_mutex;
+
+- if (i8042_check_port_owner(ps2dev->serio))
+- i8042_lock_chip();
++ mutex_lock(m);
+ }
+ EXPORT_SYMBOL(ps2_begin_command);
+
+ void ps2_end_command(struct ps2dev *ps2dev)
+ {
+- if (i8042_check_port_owner(ps2dev->serio))
+- i8042_unlock_chip();
++ struct mutex *m = ps2dev->serio->ps2_cmd_mutex ?: &ps2dev->cmd_mutex;
+
+- mutex_unlock(&ps2dev->cmd_mutex);
++ mutex_unlock(m);
+ }
+ EXPORT_SYMBOL(ps2_end_command);
+
+diff --git a/drivers/md/dm-flakey.c b/drivers/md/dm-flakey.c
+index b257e46876d3..0f5e1820c92d 100644
+--- a/drivers/md/dm-flakey.c
++++ b/drivers/md/dm-flakey.c
+@@ -287,10 +287,16 @@ static int flakey_map(struct dm_target *ti, struct bio *bio)
+ pb->bio_submitted = true;
+
+ /*
+- * Map reads as normal.
++ * Map reads as normal only if corrupt_bio_byte set.
+ */
+- if (bio_data_dir(bio) == READ)
+- goto map_bio;
++ if (bio_data_dir(bio) == READ) {
++ /* If flags were specified, only corrupt those that match. */
++ if (fc->corrupt_bio_byte && (fc->corrupt_bio_rw == READ) &&
++ all_corrupt_bio_flags_match(bio, fc))
++ goto map_bio;
++ else
++ return -EIO;
++ }
+
+ /*
+ * Drop writes?
+@@ -328,12 +334,13 @@ static int flakey_end_io(struct dm_target *ti, struct bio *bio, int error)
+
+ /*
+ * Corrupt successful READs while in down state.
+- * If flags were specified, only corrupt those that match.
+ */
+- if (fc->corrupt_bio_byte && !error && pb->bio_submitted &&
+- (bio_data_dir(bio) == READ) && (fc->corrupt_bio_rw == READ) &&
+- all_corrupt_bio_flags_match(bio, fc))
+- corrupt_bio_data(bio, fc);
++ if (!error && pb->bio_submitted && (bio_data_dir(bio) == READ)) {
++ if (fc->corrupt_bio_byte)
++ corrupt_bio_data(bio, fc);
++ else
++ return -EIO;
++ }
+
+ return error;
+ }
+diff --git a/drivers/media/dvb-core/dvb_ringbuffer.c b/drivers/media/dvb-core/dvb_ringbuffer.c
+index 1100e98a7b1d..7df7fb3738a0 100644
+--- a/drivers/media/dvb-core/dvb_ringbuffer.c
++++ b/drivers/media/dvb-core/dvb_ringbuffer.c
+@@ -55,7 +55,13 @@ void dvb_ringbuffer_init(struct dvb_ringbuffer *rbuf, void *data, size_t len)
+
+ int dvb_ringbuffer_empty(struct dvb_ringbuffer *rbuf)
+ {
+- return (rbuf->pread==rbuf->pwrite);
++ /* smp_load_acquire() to load write pointer on reader side
++ * this pairs with smp_store_release() in dvb_ringbuffer_write(),
++ * dvb_ringbuffer_write_user(), or dvb_ringbuffer_reset()
++ *
++ * for memory barriers also see Documentation/circular-buffers.txt
++ */
++ return (rbuf->pread == smp_load_acquire(&rbuf->pwrite));
+ }
+
+
+@@ -64,7 +70,12 @@ ssize_t dvb_ringbuffer_free(struct dvb_ringbuffer *rbuf)
+ {
+ ssize_t free;
+
+- free = rbuf->pread - rbuf->pwrite;
++ /* ACCESS_ONCE() to load read pointer on writer side
++ * this pairs with smp_store_release() in dvb_ringbuffer_read(),
++ * dvb_ringbuffer_read_user(), dvb_ringbuffer_flush(),
++ * or dvb_ringbuffer_reset()
++ */
++ free = ACCESS_ONCE(rbuf->pread) - rbuf->pwrite;
+ if (free <= 0)
+ free += rbuf->size;
+ return free-1;
+@@ -76,7 +87,11 @@ ssize_t dvb_ringbuffer_avail(struct dvb_ringbuffer *rbuf)
+ {
+ ssize_t avail;
+
+- avail = rbuf->pwrite - rbuf->pread;
++ /* smp_load_acquire() to load write pointer on reader side
++ * this pairs with smp_store_release() in dvb_ringbuffer_write(),
++ * dvb_ringbuffer_write_user(), or dvb_ringbuffer_reset()
++ */
++ avail = smp_load_acquire(&rbuf->pwrite) - rbuf->pread;
+ if (avail < 0)
+ avail += rbuf->size;
+ return avail;
+@@ -86,14 +101,25 @@ ssize_t dvb_ringbuffer_avail(struct dvb_ringbuffer *rbuf)
+
+ void dvb_ringbuffer_flush(struct dvb_ringbuffer *rbuf)
+ {
+- rbuf->pread = rbuf->pwrite;
++ /* dvb_ringbuffer_flush() counts as read operation
++ * smp_load_acquire() to load write pointer
++ * smp_store_release() to update read pointer, this ensures that the
++ * correct pointer is visible for subsequent dvb_ringbuffer_free()
++ * calls on other cpu cores
++ */
++ smp_store_release(&rbuf->pread, smp_load_acquire(&rbuf->pwrite));
+ rbuf->error = 0;
+ }
+ EXPORT_SYMBOL(dvb_ringbuffer_flush);
+
+ void dvb_ringbuffer_reset(struct dvb_ringbuffer *rbuf)
+ {
+- rbuf->pread = rbuf->pwrite = 0;
++ /* dvb_ringbuffer_reset() counts as read and write operation
++ * smp_store_release() to update read pointer
++ */
++ smp_store_release(&rbuf->pread, 0);
++ /* smp_store_release() to update write pointer */
++ smp_store_release(&rbuf->pwrite, 0);
+ rbuf->error = 0;
+ }
+
+@@ -119,12 +145,17 @@ ssize_t dvb_ringbuffer_read_user(struct dvb_ringbuffer *rbuf, u8 __user *buf, si
+ return -EFAULT;
+ buf += split;
+ todo -= split;
+- rbuf->pread = 0;
++ /* smp_store_release() for read pointer update to ensure
++ * that buf is not overwritten until read is complete,
++ * this pairs with ACCESS_ONCE() in dvb_ringbuffer_free()
++ */
++ smp_store_release(&rbuf->pread, 0);
+ }
+ if (copy_to_user(buf, rbuf->data+rbuf->pread, todo))
+ return -EFAULT;
+
+- rbuf->pread = (rbuf->pread + todo) % rbuf->size;
++ /* smp_store_release() to update read pointer, see above */
++ smp_store_release(&rbuf->pread, (rbuf->pread + todo) % rbuf->size);
+
+ return len;
+ }
+@@ -139,11 +170,16 @@ void dvb_ringbuffer_read(struct dvb_ringbuffer *rbuf, u8 *buf, size_t len)
+ memcpy(buf, rbuf->data+rbuf->pread, split);
+ buf += split;
+ todo -= split;
+- rbuf->pread = 0;
++ /* smp_store_release() for read pointer update to ensure
++ * that buf is not overwritten until read is complete,
++ * this pairs with ACCESS_ONCE() in dvb_ringbuffer_free()
++ */
++ smp_store_release(&rbuf->pread, 0);
+ }
+ memcpy(buf, rbuf->data+rbuf->pread, todo);
+
+- rbuf->pread = (rbuf->pread + todo) % rbuf->size;
++ /* smp_store_release() to update read pointer, see above */
++ smp_store_release(&rbuf->pread, (rbuf->pread + todo) % rbuf->size);
+ }
+
+
+@@ -158,10 +194,16 @@ ssize_t dvb_ringbuffer_write(struct dvb_ringbuffer *rbuf, const u8 *buf, size_t
+ memcpy(rbuf->data+rbuf->pwrite, buf, split);
+ buf += split;
+ todo -= split;
+- rbuf->pwrite = 0;
++ /* smp_store_release() for write pointer update to ensure that
++ * written data is visible on other cpu cores before the pointer
++ * update, this pairs with smp_load_acquire() in
++ * dvb_ringbuffer_empty() or dvb_ringbuffer_avail()
++ */
++ smp_store_release(&rbuf->pwrite, 0);
+ }
+ memcpy(rbuf->data+rbuf->pwrite, buf, todo);
+- rbuf->pwrite = (rbuf->pwrite + todo) % rbuf->size;
++ /* smp_store_release() for write pointer update, see above */
++ smp_store_release(&rbuf->pwrite, (rbuf->pwrite + todo) % rbuf->size);
+
+ return len;
+ }
+@@ -181,12 +223,18 @@ ssize_t dvb_ringbuffer_write_user(struct dvb_ringbuffer *rbuf,
+ return len - todo;
+ buf += split;
+ todo -= split;
+- rbuf->pwrite = 0;
++ /* smp_store_release() for write pointer update to ensure that
++ * written data is visible on other cpu cores before the pointer
++ * update, this pairs with smp_load_acquire() in
++ * dvb_ringbuffer_empty() or dvb_ringbuffer_avail()
++ */
++ smp_store_release(&rbuf->pwrite, 0);
+ }
+ status = copy_from_user(rbuf->data+rbuf->pwrite, buf, todo);
+ if (status)
+ return len - todo;
+- rbuf->pwrite = (rbuf->pwrite + todo) % rbuf->size;
++ /* smp_store_release() for write pointer update, see above */
++ smp_store_release(&rbuf->pwrite, (rbuf->pwrite + todo) % rbuf->size);
+
+ return len;
+ }
+diff --git a/drivers/media/platform/s5p-mfc/s5p_mfc.c b/drivers/media/platform/s5p-mfc/s5p_mfc.c
+index 165bc86c5962..ebef91c35fce 100644
+--- a/drivers/media/platform/s5p-mfc/s5p_mfc.c
++++ b/drivers/media/platform/s5p-mfc/s5p_mfc.c
+@@ -1008,6 +1008,11 @@ static int match_child(struct device *dev, void *data)
+ return !strcmp(dev_name(dev), (char *)data);
+ }
+
++static void s5p_mfc_memdev_release(struct device *dev)
++{
++ dma_release_declared_memory(dev);
++}
++
+ static void *mfc_get_drv_data(struct platform_device *pdev);
+
+ static int s5p_mfc_alloc_memdevs(struct s5p_mfc_dev *dev)
+@@ -1020,6 +1025,9 @@ static int s5p_mfc_alloc_memdevs(struct s5p_mfc_dev *dev)
+ mfc_err("Not enough memory\n");
+ return -ENOMEM;
+ }
++
++ dev_set_name(dev->mem_dev_l, "%s", "s5p-mfc-l");
++ dev->mem_dev_l->release = s5p_mfc_memdev_release;
+ device_initialize(dev->mem_dev_l);
+ of_property_read_u32_array(dev->plat_dev->dev.of_node,
+ "samsung,mfc-l", mem_info, 2);
+@@ -1037,6 +1045,9 @@ static int s5p_mfc_alloc_memdevs(struct s5p_mfc_dev *dev)
+ mfc_err("Not enough memory\n");
+ return -ENOMEM;
+ }
++
++ dev_set_name(dev->mem_dev_r, "%s", "s5p-mfc-r");
++ dev->mem_dev_r->release = s5p_mfc_memdev_release;
+ device_initialize(dev->mem_dev_r);
+ of_property_read_u32_array(dev->plat_dev->dev.of_node,
+ "samsung,mfc-r", mem_info, 2);
+diff --git a/drivers/media/rc/ir-rc5-decoder.c b/drivers/media/rc/ir-rc5-decoder.c
+index 84fa6e9b59a1..67314c034cdb 100644
+--- a/drivers/media/rc/ir-rc5-decoder.c
++++ b/drivers/media/rc/ir-rc5-decoder.c
+@@ -29,7 +29,7 @@
+ #define RC5_BIT_START (1 * RC5_UNIT)
+ #define RC5_BIT_END (1 * RC5_UNIT)
+ #define RC5X_SPACE (4 * RC5_UNIT)
+-#define RC5_TRAILER (10 * RC5_UNIT) /* In reality, approx 100 */
++#define RC5_TRAILER (6 * RC5_UNIT) /* In reality, approx 100 */
+
+ enum rc5_state {
+ STATE_INACTIVE,
+diff --git a/drivers/media/usb/usbtv/usbtv-audio.c b/drivers/media/usb/usbtv/usbtv-audio.c
+index 78c12d22dfbb..5dab02432e82 100644
+--- a/drivers/media/usb/usbtv/usbtv-audio.c
++++ b/drivers/media/usb/usbtv/usbtv-audio.c
+@@ -278,6 +278,9 @@ static void snd_usbtv_trigger(struct work_struct *work)
+ {
+ struct usbtv *chip = container_of(work, struct usbtv, snd_trigger);
+
++ if (!chip->snd)
++ return;
++
+ if (atomic_read(&chip->snd_stream))
+ usbtv_audio_start(chip);
+ else
+@@ -378,6 +381,8 @@ err:
+
+ void usbtv_audio_free(struct usbtv *usbtv)
+ {
++ cancel_work_sync(&usbtv->snd_trigger);
++
+ if (usbtv->snd && usbtv->udev) {
+ snd_card_free(usbtv->snd);
+ usbtv->snd = NULL;
+diff --git a/drivers/mtd/nand/nand_base.c b/drivers/mtd/nand/nand_base.c
+index 5b5c62712814..2e2da0a4be1a 100644
+--- a/drivers/mtd/nand/nand_base.c
++++ b/drivers/mtd/nand/nand_base.c
+@@ -2424,7 +2424,7 @@ static int nand_do_write_ops(struct mtd_info *mtd, loff_t to,
+ int cached = writelen > bytes && page != blockmask;
+ uint8_t *wbuf = buf;
+ int use_bufpoi;
+- int part_pagewr = (column || writelen < (mtd->writesize - 1));
++ int part_pagewr = (column || writelen < mtd->writesize);
+
+ if (part_pagewr)
+ use_bufpoi = 1;
+diff --git a/drivers/mtd/ubi/build.c b/drivers/mtd/ubi/build.c
+index 6e30a3c280d0..c3db383a9000 100644
+--- a/drivers/mtd/ubi/build.c
++++ b/drivers/mtd/ubi/build.c
+@@ -999,6 +999,9 @@ int ubi_attach_mtd_dev(struct mtd_info *mtd, int ubi_num,
+ goto out_detach;
+ }
+
++ /* Make device "available" before it becomes accessible via sysfs */
++ ubi_devices[ubi_num] = ubi;
++
+ err = uif_init(ubi, &ref);
+ if (err)
+ goto out_detach;
+@@ -1043,7 +1046,6 @@ int ubi_attach_mtd_dev(struct mtd_info *mtd, int ubi_num,
+ wake_up_process(ubi->bgt_thread);
+ spin_unlock(&ubi->wl_lock);
+
+- ubi_devices[ubi_num] = ubi;
+ ubi_notify_all(ubi, UBI_VOLUME_ADDED, NULL);
+ return ubi_num;
+
+@@ -1054,6 +1056,7 @@ out_uif:
+ ubi_assert(ref);
+ uif_close(ubi);
+ out_detach:
++ ubi_devices[ubi_num] = NULL;
+ ubi_wl_close(ubi);
+ ubi_free_internal_volumes(ubi);
+ vfree(ubi->vtbl);
+diff --git a/drivers/mtd/ubi/vmt.c b/drivers/mtd/ubi/vmt.c
+index 8330703c098f..96131eb34c9f 100644
+--- a/drivers/mtd/ubi/vmt.c
++++ b/drivers/mtd/ubi/vmt.c
+@@ -534,13 +534,6 @@ int ubi_resize_volume(struct ubi_volume_desc *desc, int reserved_pebs)
+ spin_unlock(&ubi->volumes_lock);
+ }
+
+- /* Change volume table record */
+- vtbl_rec = ubi->vtbl[vol_id];
+- vtbl_rec.reserved_pebs = cpu_to_be32(reserved_pebs);
+- err = ubi_change_vtbl_record(ubi, vol_id, &vtbl_rec);
+- if (err)
+- goto out_acc;
+-
+ if (pebs < 0) {
+ for (i = 0; i < -pebs; i++) {
+ err = ubi_eba_unmap_leb(ubi, vol, reserved_pebs + i);
+@@ -558,6 +551,24 @@ int ubi_resize_volume(struct ubi_volume_desc *desc, int reserved_pebs)
+ spin_unlock(&ubi->volumes_lock);
+ }
+
++ /*
++ * When we shrink a volume we have to flush all pending (erase) work.
++ * Otherwise it can happen that upon next attach UBI finds a LEB with
++ * lnum > highest_lnum and refuses to attach.
++ */
++ if (pebs < 0) {
++ err = ubi_wl_flush(ubi, vol_id, UBI_ALL);
++ if (err)
++ goto out_acc;
++ }
++
++ /* Change volume table record */
++ vtbl_rec = ubi->vtbl[vol_id];
++ vtbl_rec.reserved_pebs = cpu_to_be32(reserved_pebs);
++ err = ubi_change_vtbl_record(ubi, vol_id, &vtbl_rec);
++ if (err)
++ goto out_acc;
++
+ vol->reserved_pebs = reserved_pebs;
+ if (vol->vol_type == UBI_DYNAMIC_VOLUME) {
+ vol->used_ebs = reserved_pebs;
+diff --git a/drivers/of/base.c b/drivers/of/base.c
+index 469d2b7f47eb..4e0e8ee2d17f 100644
+--- a/drivers/of/base.c
++++ b/drivers/of/base.c
+@@ -111,6 +111,7 @@ static ssize_t of_node_property_read(struct file *filp, struct kobject *kobj,
+ return memory_read_from_buffer(buf, count, &offset, pp->value, pp->length);
+ }
+
++/* always return newly allocated name, caller must free after use */
+ static const char *safe_name(struct kobject *kobj, const char *orig_name)
+ {
+ const char *name = orig_name;
+@@ -125,9 +126,12 @@ static const char *safe_name(struct kobject *kobj, const char *orig_name)
+ name = kasprintf(GFP_KERNEL, "%s#%i", orig_name, ++i);
+ }
+
+- if (name != orig_name)
++ if (name == orig_name) {
++ name = kstrdup(orig_name, GFP_KERNEL);
++ } else {
+ pr_warn("device-tree: Duplicate name in %s, renamed to \"%s\"\n",
+ kobject_name(kobj), name);
++ }
+ return name;
+ }
+
+@@ -158,6 +162,7 @@ int __of_add_property_sysfs(struct device_node *np, struct property *pp)
+ int __of_attach_node_sysfs(struct device_node *np)
+ {
+ const char *name;
++ struct kobject *parent;
+ struct property *pp;
+ int rc;
+
+@@ -170,15 +175,16 @@ int __of_attach_node_sysfs(struct device_node *np)
+ np->kobj.kset = of_kset;
+ if (!np->parent) {
+ /* Nodes without parents are new top level trees */
+- rc = kobject_add(&np->kobj, NULL, "%s",
+- safe_name(&of_kset->kobj, "base"));
++ name = safe_name(&of_kset->kobj, "base");
++ parent = NULL;
+ } else {
+ name = safe_name(&np->parent->kobj, kbasename(np->full_name));
+- if (!name || !name[0])
+- return -EINVAL;
+-
+- rc = kobject_add(&np->kobj, &np->parent->kobj, "%s", name);
++ parent = &np->parent->kobj;
+ }
++ if (!name)
++ return -ENOMEM;
++ rc = kobject_add(&np->kobj, parent, "%s", name);
++ kfree(name);
+ if (rc)
+ return rc;
+
+@@ -1709,6 +1715,12 @@ int __of_remove_property(struct device_node *np, struct property *prop)
+ return 0;
+ }
+
++void __of_sysfs_remove_bin_file(struct device_node *np, struct property *prop)
++{
++ sysfs_remove_bin_file(&np->kobj, &prop->attr);
++ kfree(prop->attr.attr.name);
++}
++
+ void __of_remove_property_sysfs(struct device_node *np, struct property *prop)
+ {
+ if (!IS_ENABLED(CONFIG_SYSFS))
+@@ -1716,7 +1728,7 @@ void __of_remove_property_sysfs(struct device_node *np, struct property *prop)
+
+ /* at early boot, bail here and defer setup to of_init() */
+ if (of_kset && of_node_is_attached(np))
+- sysfs_remove_bin_file(&np->kobj, &prop->attr);
++ __of_sysfs_remove_bin_file(np, prop);
+ }
+
+ /**
+@@ -1786,7 +1798,7 @@ void __of_update_property_sysfs(struct device_node *np, struct property *newprop
+ return;
+
+ if (oldprop)
+- sysfs_remove_bin_file(&np->kobj, &oldprop->attr);
++ __of_sysfs_remove_bin_file(np, oldprop);
+ __of_add_property_sysfs(np, newprop);
+ }
+
+diff --git a/drivers/of/dynamic.c b/drivers/of/dynamic.c
+index d4994177dec2..ab7374960393 100644
+--- a/drivers/of/dynamic.c
++++ b/drivers/of/dynamic.c
+@@ -55,7 +55,7 @@ void __of_detach_node_sysfs(struct device_node *np)
+ /* only remove properties if on sysfs */
+ if (of_node_is_attached(np)) {
+ for_each_property_of_node(np, pp)
+- sysfs_remove_bin_file(&np->kobj, &pp->attr);
++ __of_sysfs_remove_bin_file(np, pp);
+ kobject_del(&np->kobj);
+ }
+
+diff --git a/drivers/of/of_private.h b/drivers/of/of_private.h
+index 858e0a5d9a11..21bf733eb4ad 100644
+--- a/drivers/of/of_private.h
++++ b/drivers/of/of_private.h
+@@ -81,6 +81,9 @@ extern int __of_attach_node_sysfs(struct device_node *np);
+ extern void __of_detach_node(struct device_node *np);
+ extern void __of_detach_node_sysfs(struct device_node *np);
+
++extern void __of_sysfs_remove_bin_file(struct device_node *np,
++ struct property *prop);
++
+ /* iterators for transactions, used for overlays */
+ /* forward iterator */
+ #define for_each_transaction_entry(_oft, _te) \
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index b6d646a97494..d89d4dac2c09 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -3060,13 +3060,15 @@ static void quirk_no_bus_reset(struct pci_dev *dev)
+ }
+
+ /*
+- * Atheros AR93xx chips do not behave after a bus reset. The device will
+- * throw a Link Down error on AER-capable systems and regardless of AER,
+- * config space of the device is never accessible again and typically
+- * causes the system to hang or reset when access is attempted.
++ * Some Atheros AR9xxx and QCA988x chips do not behave after a bus reset.
++ * The device will throw a Link Down error on AER-capable systems and
++ * regardless of AER, config space of the device is never accessible again
++ * and typically causes the system to hang or reset when access is attempted.
+ * http://www.spinics.net/lists/linux-pci/msg34797.html
+ */
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATHEROS, 0x0030, quirk_no_bus_reset);
++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATHEROS, 0x0032, quirk_no_bus_reset);
++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATHEROS, 0x003c, quirk_no_bus_reset);
+
+ #ifdef CONFIG_ACPI
+ /*
+diff --git a/drivers/platform/x86/hp-wmi.c b/drivers/platform/x86/hp-wmi.c
+index 301386c4d85b..450d790c8bbf 100644
+--- a/drivers/platform/x86/hp-wmi.c
++++ b/drivers/platform/x86/hp-wmi.c
+@@ -723,6 +723,11 @@ static int __init hp_wmi_rfkill_setup(struct platform_device *device)
+ if (err)
+ return err;
+
++ err = hp_wmi_perform_query(HPWMI_WIRELESS_QUERY, 1, &wireless,
++ sizeof(wireless), 0);
++ if (err)
++ return err;
++
+ if (wireless & 0x1) {
+ wifi_rfkill = rfkill_alloc("hp-wifi", &device->dev,
+ RFKILL_TYPE_WLAN,
+@@ -910,7 +915,7 @@ static int __init hp_wmi_bios_setup(struct platform_device *device)
+ gps_rfkill = NULL;
+ rfkill2_count = 0;
+
+- if (hp_wmi_bios_2009_later() || hp_wmi_rfkill_setup(device))
++ if (hp_wmi_rfkill_setup(device))
+ hp_wmi_rfkill2_setup(device);
+
+ err = device_create_file(&device->dev, &dev_attr_display);
+diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
+index 0b1fdfe34c98..450fbad835e4 100644
+--- a/drivers/target/iscsi/iscsi_target.c
++++ b/drivers/target/iscsi/iscsi_target.c
+@@ -502,7 +502,8 @@ static void iscsit_aborted_task(struct iscsi_conn *conn, struct iscsi_cmd *cmd)
+ bool scsi_cmd = (cmd->iscsi_opcode == ISCSI_OP_SCSI_CMD);
+
+ spin_lock_bh(&conn->cmd_lock);
+- if (!list_empty(&cmd->i_conn_node))
++ if (!list_empty(&cmd->i_conn_node) &&
++ !(cmd->se_cmd.transport_state & CMD_T_FABRIC_STOP))
+ list_del_init(&cmd->i_conn_node);
+ spin_unlock_bh(&conn->cmd_lock);
+
+@@ -4174,6 +4175,7 @@ transport_err:
+
+ static void iscsit_release_commands_from_conn(struct iscsi_conn *conn)
+ {
++ LIST_HEAD(tmp_list);
+ struct iscsi_cmd *cmd = NULL, *cmd_tmp = NULL;
+ struct iscsi_session *sess = conn->sess;
+ /*
+@@ -4182,18 +4184,26 @@ static void iscsit_release_commands_from_conn(struct iscsi_conn *conn)
+ * has been reset -> returned sleeping pre-handler state.
+ */
+ spin_lock_bh(&conn->cmd_lock);
+- list_for_each_entry_safe(cmd, cmd_tmp, &conn->conn_cmd_list, i_conn_node) {
++ list_splice_init(&conn->conn_cmd_list, &tmp_list);
+
++ list_for_each_entry(cmd, &tmp_list, i_conn_node) {
++ struct se_cmd *se_cmd = &cmd->se_cmd;
++
++ if (se_cmd->se_tfo != NULL) {
++ spin_lock(&se_cmd->t_state_lock);
++ se_cmd->transport_state |= CMD_T_FABRIC_STOP;
++ spin_unlock(&se_cmd->t_state_lock);
++ }
++ }
++ spin_unlock_bh(&conn->cmd_lock);
++
++ list_for_each_entry_safe(cmd, cmd_tmp, &tmp_list, i_conn_node) {
+ list_del_init(&cmd->i_conn_node);
+- spin_unlock_bh(&conn->cmd_lock);
+
+ iscsit_increment_maxcmdsn(cmd, sess);
+-
+ iscsit_free_cmd(cmd, true);
+
+- spin_lock_bh(&conn->cmd_lock);
+ }
+- spin_unlock_bh(&conn->cmd_lock);
+ }
+
+ static void iscsit_stop_timers_for_cmds(
+diff --git a/drivers/target/iscsi/iscsi_target_login.c b/drivers/target/iscsi/iscsi_target_login.c
+index eb320e6eb93d..b06d3c0d2e66 100644
+--- a/drivers/target/iscsi/iscsi_target_login.c
++++ b/drivers/target/iscsi/iscsi_target_login.c
+@@ -1414,8 +1414,9 @@ static int __iscsi_target_login_thread(struct iscsi_np *np)
+ }
+ login->zero_tsih = zero_tsih;
+
+- conn->sess->se_sess->sup_prot_ops =
+- conn->conn_transport->iscsit_get_sup_prot_ops(conn);
++ if (conn->sess)
++ conn->sess->se_sess->sup_prot_ops =
++ conn->conn_transport->iscsit_get_sup_prot_ops(conn);
+
+ tpg = conn->tpg;
+ if (!tpg) {
+diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
+index 1a487f9c2f78..837d464fa6da 100644
+--- a/drivers/target/target_core_transport.c
++++ b/drivers/target/target_core_transport.c
+@@ -2451,15 +2451,9 @@ static void target_release_cmd_kref(struct kref *kref)
+ struct se_session *se_sess = se_cmd->se_sess;
+ bool fabric_stop;
+
+- if (list_empty(&se_cmd->se_cmd_list)) {
+- spin_unlock(&se_sess->sess_cmd_lock);
+- target_free_cmd_mem(se_cmd);
+- se_cmd->se_tfo->release_cmd(se_cmd);
+- return;
+- }
+-
+ spin_lock(&se_cmd->t_state_lock);
+- fabric_stop = (se_cmd->transport_state & CMD_T_FABRIC_STOP);
++ fabric_stop = (se_cmd->transport_state & CMD_T_FABRIC_STOP) &&
++ (se_cmd->transport_state & CMD_T_ABORTED);
+ spin_unlock(&se_cmd->t_state_lock);
+
+ if (se_cmd->cmd_wait_set || fabric_stop) {
+diff --git a/drivers/tty/serial/samsung.c b/drivers/tty/serial/samsung.c
+index b7213637f498..c751604d3856 100644
+--- a/drivers/tty/serial/samsung.c
++++ b/drivers/tty/serial/samsung.c
+@@ -1154,7 +1154,7 @@ static int s3c24xx_serial_init_port(struct s3c24xx_uart_port *ourport,
+ return -ENODEV;
+
+ if (port->mapbase != 0)
+- return 0;
++ return -EINVAL;
+
+ /* setup info for port */
+ port->dev = &platdev->dev;
+@@ -1204,14 +1204,15 @@ static int s3c24xx_serial_init_port(struct s3c24xx_uart_port *ourport,
+ if (IS_ERR(ourport->clk)) {
+ pr_err("%s: Controller clock not found\n",
+ dev_name(&platdev->dev));
+- return PTR_ERR(ourport->clk);
++ ret = PTR_ERR(ourport->clk);
++ goto err;
+ }
+
+ ret = clk_prepare_enable(ourport->clk);
+ if (ret) {
+ pr_err("uart: clock failed to prepare+enable: %d\n", ret);
+ clk_put(ourport->clk);
+- return ret;
++ goto err;
+ }
+
+ /* Keep all interrupts masked and cleared */
+@@ -1227,7 +1228,12 @@ static int s3c24xx_serial_init_port(struct s3c24xx_uart_port *ourport,
+
+ /* reset the fifos (and setup the uart) */
+ s3c24xx_serial_resetport(port, cfg);
++
+ return 0;
++
++err:
++ port->mapbase = 0;
++ return ret;
+ }
+
+ #ifdef CONFIG_SAMSUNG_CLOCK
+diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
+index 0673a5abc21d..6c7e47f67dd4 100644
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -125,6 +125,12 @@ static const struct usb_device_id usb_quirk_list[] = {
+ { USB_DEVICE(0x04f3, 0x016f), .driver_info =
+ USB_QUIRK_DEVICE_QUALIFIER },
+
++ { USB_DEVICE(0x04f3, 0x0381), .driver_info =
++ USB_QUIRK_NO_LPM },
++
++ { USB_DEVICE(0x04f3, 0x21b8), .driver_info =
++ USB_QUIRK_DEVICE_QUALIFIER },
++
+ /* Roland SC-8820 */
+ { USB_DEVICE(0x0582, 0x0007), .driver_info = USB_QUIRK_RESET_RESUME },
+
+diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
+index d4f7b607fc61..37da0e8bac33 100644
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -1931,6 +1931,10 @@ static int dwc3_cleanup_done_reqs(struct dwc3 *dwc, struct dwc3_ep *dep,
+ return 1;
+ }
+
++ if (usb_endpoint_xfer_isoc(dep->endpoint.desc))
++ if ((event->status & DEPEVT_STATUS_IOC) &&
++ (trb->ctrl & DWC3_TRB_CTRL_IOC))
++ return 0;
+ return 1;
+ }
+
+diff --git a/drivers/usb/renesas_usbhs/fifo.c b/drivers/usb/renesas_usbhs/fifo.c
+index e5f429ee7a89..96bc405a5821 100644
+--- a/drivers/usb/renesas_usbhs/fifo.c
++++ b/drivers/usb/renesas_usbhs/fifo.c
+@@ -831,37 +831,47 @@ static void xfer_work(struct work_struct *work)
+ {
+ struct usbhs_pkt *pkt = container_of(work, struct usbhs_pkt, work);
+ struct usbhs_pipe *pipe = pkt->pipe;
+- struct usbhs_fifo *fifo = usbhs_pipe_to_fifo(pipe);
++ struct usbhs_fifo *fifo;
+ struct usbhs_priv *priv = usbhs_pipe_to_priv(pipe);
+ struct dma_async_tx_descriptor *desc;
+- struct dma_chan *chan = usbhsf_dma_chan_get(fifo, pkt);
++ struct dma_chan *chan;
+ struct device *dev = usbhs_priv_to_dev(priv);
+ enum dma_transfer_direction dir;
++ unsigned long flags;
+
++ usbhs_lock(priv, flags);
++ fifo = usbhs_pipe_to_fifo(pipe);
++ if (!fifo)
++ goto xfer_work_end;
++
++ chan = usbhsf_dma_chan_get(fifo, pkt);
+ dir = usbhs_pipe_is_dir_in(pipe) ? DMA_DEV_TO_MEM : DMA_MEM_TO_DEV;
+
+ desc = dmaengine_prep_slave_single(chan, pkt->dma + pkt->actual,
+ pkt->trans, dir,
+ DMA_PREP_INTERRUPT | DMA_CTRL_ACK);
+ if (!desc)
+- return;
++ goto xfer_work_end;
+
+ desc->callback = usbhsf_dma_complete;
+ desc->callback_param = pipe;
+
+ if (dmaengine_submit(desc) < 0) {
+ dev_err(dev, "Failed to submit dma descriptor\n");
+- return;
++ goto xfer_work_end;
+ }
+
+ dev_dbg(dev, " %s %d (%d/ %d)\n",
+ fifo->name, usbhs_pipe_number(pipe), pkt->length, pkt->zero);
+
+ usbhs_pipe_running(pipe, 1);
+- usbhs_pipe_set_trans_count_if_bulk(pipe, pkt->trans);
+- usbhs_pipe_enable(pipe);
+ usbhsf_dma_start(pipe, fifo);
++ usbhs_pipe_set_trans_count_if_bulk(pipe, pkt->trans);
+ dma_async_issue_pending(chan);
++ usbhs_pipe_enable(pipe);
++
++xfer_work_end:
++ usbhs_unlock(priv, flags);
+ }
+
+ /*
+diff --git a/drivers/usb/renesas_usbhs/mod_gadget.c b/drivers/usb/renesas_usbhs/mod_gadget.c
+index e56bbb8ab9a0..9f5e9fbfaae5 100644
+--- a/drivers/usb/renesas_usbhs/mod_gadget.c
++++ b/drivers/usb/renesas_usbhs/mod_gadget.c
+@@ -578,6 +578,9 @@ static int usbhsg_ep_enable(struct usb_ep *ep,
+ struct usbhs_priv *priv = usbhsg_gpriv_to_priv(gpriv);
+ struct usbhs_pipe *pipe;
+ int ret = -EIO;
++ unsigned long flags;
++
++ usbhs_lock(priv, flags);
+
+ /*
+ * if it already have pipe,
+@@ -586,7 +589,8 @@ static int usbhsg_ep_enable(struct usb_ep *ep,
+ if (uep->pipe) {
+ usbhs_pipe_clear(uep->pipe);
+ usbhs_pipe_sequence_data0(uep->pipe);
+- return 0;
++ ret = 0;
++ goto usbhsg_ep_enable_end;
+ }
+
+ pipe = usbhs_pipe_malloc(priv,
+@@ -614,6 +618,9 @@ static int usbhsg_ep_enable(struct usb_ep *ep,
+ ret = 0;
+ }
+
++usbhsg_ep_enable_end:
++ usbhs_unlock(priv, flags);
++
+ return ret;
+ }
+
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index d67b687f20db..2477bf19a3b4 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -275,6 +275,7 @@ static void option_instat_callback(struct urb *urb);
+ #define TELIT_PRODUCT_LE922_USBCFG5 0x1045
+ #define TELIT_PRODUCT_LE920 0x1200
+ #define TELIT_PRODUCT_LE910 0x1201
++#define TELIT_PRODUCT_LE910_USBCFG4 0x1206
+
+ /* ZTE PRODUCTS */
+ #define ZTE_VENDOR_ID 0x19d2
+@@ -1210,6 +1211,8 @@ static const struct usb_device_id option_ids[] = {
+ .driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg0 },
+ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910),
+ .driver_info = (kernel_ulong_t)&telit_le910_blacklist },
++ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910_USBCFG4),
++ .driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg3 },
+ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920),
+ .driver_info = (kernel_ulong_t)&telit_le920_blacklist },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MF622, 0xff, 0xff, 0xff) }, /* ZTE WCDMA products */
+diff --git a/drivers/virtio/virtio_balloon.c b/drivers/virtio/virtio_balloon.c
+index 440d78f39c01..0f9638e72b91 100644
+--- a/drivers/virtio/virtio_balloon.c
++++ b/drivers/virtio/virtio_balloon.c
+@@ -178,6 +178,8 @@ static void leak_balloon(struct virtio_balloon *vb, size_t num)
+ num = min(num, ARRAY_SIZE(vb->pfns));
+
+ mutex_lock(&vb->balloon_lock);
++ /* We can't release more pages than taken */
++ num = min(num, (size_t)vb->num_pages);
+ for (vb->num_pfns = 0; vb->num_pfns < num;
+ vb->num_pfns += VIRTIO_BALLOON_PAGES_PER_PAGE) {
+ page = balloon_page_dequeue(vb_dev_info);
+diff --git a/fs/cifs/cifs_fs_sb.h b/fs/cifs/cifs_fs_sb.h
+index 3182273a3407..1418daa03d95 100644
+--- a/fs/cifs/cifs_fs_sb.h
++++ b/fs/cifs/cifs_fs_sb.h
+@@ -46,6 +46,9 @@
+ #define CIFS_MOUNT_CIFS_BACKUPUID 0x200000 /* backup intent bit for a user */
+ #define CIFS_MOUNT_CIFS_BACKUPGID 0x400000 /* backup intent bit for a group */
+ #define CIFS_MOUNT_MAP_SFM_CHR 0x800000 /* SFM/MAC mapping for illegal chars */
++#define CIFS_MOUNT_USE_PREFIX_PATH 0x1000000 /* make subpath with unaccessible
++ * root mountable
++ */
+
+ struct cifs_sb_info {
+ struct rb_root tlink_tree;
+@@ -67,5 +70,6 @@ struct cifs_sb_info {
+ struct backing_dev_info bdi;
+ struct delayed_work prune_tlinks;
+ struct rcu_head rcu;
++ char *prepath;
+ };
+ #endif /* _CIFS_FS_SB_H */
+diff --git a/fs/cifs/cifsencrypt.c b/fs/cifs/cifsencrypt.c
+index cee9889a6612..78404806a7f6 100644
+--- a/fs/cifs/cifsencrypt.c
++++ b/fs/cifs/cifsencrypt.c
+@@ -727,24 +727,26 @@ setup_ntlmv2_rsp(struct cifs_ses *ses, const struct nls_table *nls_cp)
+
+ memcpy(ses->auth_key.response + baselen, tiblob, tilen);
+
++ mutex_lock(&ses->server->srv_mutex);
++
+ rc = crypto_hmacmd5_alloc(ses->server);
+ if (rc) {
+ cifs_dbg(VFS, "could not crypto alloc hmacmd5 rc %d\n", rc);
+- goto setup_ntlmv2_rsp_ret;
++ goto unlock;
+ }
+
+ /* calculate ntlmv2_hash */
+ rc = calc_ntlmv2_hash(ses, ntlmv2_hash, nls_cp);
+ if (rc) {
+ cifs_dbg(VFS, "could not get v2 hash rc %d\n", rc);
+- goto setup_ntlmv2_rsp_ret;
++ goto unlock;
+ }
+
+ /* calculate first part of the client response (CR1) */
+ rc = CalcNTLMv2_response(ses, ntlmv2_hash);
+ if (rc) {
+ cifs_dbg(VFS, "Could not calculate CR1 rc: %d\n", rc);
+- goto setup_ntlmv2_rsp_ret;
++ goto unlock;
+ }
+
+ /* now calculate the session key for NTLMv2 */
+@@ -753,13 +755,13 @@ setup_ntlmv2_rsp(struct cifs_ses *ses, const struct nls_table *nls_cp)
+ if (rc) {
+ cifs_dbg(VFS, "%s: Could not set NTLMV2 Hash as a key\n",
+ __func__);
+- goto setup_ntlmv2_rsp_ret;
++ goto unlock;
+ }
+
+ rc = crypto_shash_init(&ses->server->secmech.sdeschmacmd5->shash);
+ if (rc) {
+ cifs_dbg(VFS, "%s: Could not init hmacmd5\n", __func__);
+- goto setup_ntlmv2_rsp_ret;
++ goto unlock;
+ }
+
+ rc = crypto_shash_update(&ses->server->secmech.sdeschmacmd5->shash,
+@@ -767,7 +769,7 @@ setup_ntlmv2_rsp(struct cifs_ses *ses, const struct nls_table *nls_cp)
+ CIFS_HMAC_MD5_HASH_SIZE);
+ if (rc) {
+ cifs_dbg(VFS, "%s: Could not update with response\n", __func__);
+- goto setup_ntlmv2_rsp_ret;
++ goto unlock;
+ }
+
+ rc = crypto_shash_final(&ses->server->secmech.sdeschmacmd5->shash,
+@@ -775,6 +777,8 @@ setup_ntlmv2_rsp(struct cifs_ses *ses, const struct nls_table *nls_cp)
+ if (rc)
+ cifs_dbg(VFS, "%s: Could not generate md5 hash\n", __func__);
+
++unlock:
++ mutex_unlock(&ses->server->srv_mutex);
+ setup_ntlmv2_rsp_ret:
+ kfree(tiblob);
+
+diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
+index 3e924abdd969..103e8b6604b1 100644
+--- a/fs/cifs/cifsfs.c
++++ b/fs/cifs/cifsfs.c
+@@ -678,6 +678,14 @@ cifs_do_mount(struct file_system_type *fs_type,
+ goto out_cifs_sb;
+ }
+
++ if (volume_info->prepath) {
++ cifs_sb->prepath = kstrdup(volume_info->prepath, GFP_KERNEL);
++ if (cifs_sb->prepath == NULL) {
++ root = ERR_PTR(-ENOMEM);
++ goto out_cifs_sb;
++ }
++ }
++
+ cifs_setup_cifs_sb(volume_info, cifs_sb);
+
+ rc = cifs_mount(cifs_sb, volume_info);
+@@ -716,7 +724,11 @@ cifs_do_mount(struct file_system_type *fs_type,
+ sb->s_flags |= MS_ACTIVE;
+ }
+
+- root = cifs_get_root(volume_info, sb);
++ if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_USE_PREFIX_PATH)
++ root = dget(sb->s_root);
++ else
++ root = cifs_get_root(volume_info, sb);
++
+ if (IS_ERR(root))
+ goto out_super;
+
+diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
+index db97215a23b2..5093710e7660 100644
+--- a/fs/cifs/connect.c
++++ b/fs/cifs/connect.c
+@@ -3434,6 +3434,44 @@ cifs_get_volume_info(char *mount_data, const char *devname)
+ return volume_info;
+ }
+
++static int
++cifs_are_all_path_components_accessible(struct TCP_Server_Info *server,
++ unsigned int xid,
++ struct cifs_tcon *tcon,
++ struct cifs_sb_info *cifs_sb,
++ char *full_path)
++{
++ int rc;
++ char *s;
++ char sep, tmp;
++
++ sep = CIFS_DIR_SEP(cifs_sb);
++ s = full_path;
++
++ rc = server->ops->is_path_accessible(xid, tcon, cifs_sb, "");
++ while (rc == 0) {
++ /* skip separators */
++ while (*s == sep)
++ s++;
++ if (!*s)
++ break;
++ /* next separator */
++ while (*s && *s != sep)
++ s++;
++
++ /*
++ * temporarily null-terminate the path at the end of
++ * the current component
++ */
++ tmp = *s;
++ *s = 0;
++ rc = server->ops->is_path_accessible(xid, tcon, cifs_sb,
++ full_path);
++ *s = tmp;
++ }
++ return rc;
++}
++
+ int
+ cifs_mount(struct cifs_sb_info *cifs_sb, struct smb_vol *volume_info)
+ {
+@@ -3560,6 +3598,16 @@ remote_path_check:
+ kfree(full_path);
+ goto mount_fail_check;
+ }
++
++ rc = cifs_are_all_path_components_accessible(server,
++ xid, tcon, cifs_sb,
++ full_path);
++ if (rc != 0) {
++ cifs_dbg(VFS, "cannot query dirs between root and final path, "
++ "enabling CIFS_MOUNT_USE_PREFIX_PATH\n");
++ cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_USE_PREFIX_PATH;
++ rc = 0;
++ }
+ kfree(full_path);
+ }
+
+@@ -3823,6 +3871,7 @@ cifs_umount(struct cifs_sb_info *cifs_sb)
+
+ bdi_destroy(&cifs_sb->bdi);
+ kfree(cifs_sb->mountdata);
++ kfree(cifs_sb->prepath);
+ call_rcu(&cifs_sb->rcu, delayed_free);
+ }
+
+diff --git a/fs/cifs/dir.c b/fs/cifs/dir.c
+index b72bc29cba23..ed7b6f7d5abe 100644
+--- a/fs/cifs/dir.c
++++ b/fs/cifs/dir.c
+@@ -84,6 +84,7 @@ build_path_from_dentry(struct dentry *direntry)
+ struct dentry *temp;
+ int namelen;
+ int dfsplen;
++ int pplen = 0;
+ char *full_path;
+ char dirsep;
+ struct cifs_sb_info *cifs_sb = CIFS_SB(direntry->d_sb);
+@@ -95,8 +96,12 @@ build_path_from_dentry(struct dentry *direntry)
+ dfsplen = strnlen(tcon->treeName, MAX_TREE_SIZE + 1);
+ else
+ dfsplen = 0;
++
++ if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_USE_PREFIX_PATH)
++ pplen = cifs_sb->prepath ? strlen(cifs_sb->prepath) + 1 : 0;
++
+ cifs_bp_rename_retry:
+- namelen = dfsplen;
++ namelen = dfsplen + pplen;
+ seq = read_seqbegin(&rename_lock);
+ rcu_read_lock();
+ for (temp = direntry; !IS_ROOT(temp);) {
+@@ -137,7 +142,7 @@ cifs_bp_rename_retry:
+ }
+ }
+ rcu_read_unlock();
+- if (namelen != dfsplen || read_seqretry(&rename_lock, seq)) {
++ if (namelen != dfsplen + pplen || read_seqretry(&rename_lock, seq)) {
+ cifs_dbg(FYI, "did not end path lookup where expected. namelen=%ddfsplen=%d\n",
+ namelen, dfsplen);
+ /* presumably this is only possible if racing with a rename
+@@ -153,6 +158,17 @@ cifs_bp_rename_retry:
+ those safely to '/' if any are found in the middle of the prepath */
+ /* BB test paths to Windows with '/' in the midst of prepath */
+
++ if (pplen) {
++ int i;
++
++ cifs_dbg(FYI, "using cifs_sb prepath <%s>\n", cifs_sb->prepath);
++ memcpy(full_path+dfsplen+1, cifs_sb->prepath, pplen-1);
++ full_path[dfsplen] = '\\';
++ for (i = 0; i < pplen-1; i++)
++ if (full_path[dfsplen+1+i] == '/')
++ full_path[dfsplen+1+i] = CIFS_DIR_SEP(cifs_sb);
++ }
++
+ if (dfsplen) {
+ strncpy(full_path, tcon->treeName, dfsplen);
+ if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_POSIX_PATHS) {
+@@ -229,6 +245,13 @@ cifs_do_create(struct inode *inode, struct dentry *direntry, unsigned int xid,
+ goto cifs_create_get_file_info;
+ }
+
++ if (S_ISDIR(newinode->i_mode)) {
++ CIFSSMBClose(xid, tcon, fid->netfid);
++ iput(newinode);
++ rc = -EISDIR;
++ goto out;
++ }
++
+ if (!S_ISREG(newinode->i_mode)) {
+ /*
+ * The server may allow us to open things like
+@@ -399,10 +422,14 @@ cifs_create_set_dentry:
+ if (rc != 0) {
+ cifs_dbg(FYI, "Create worked, get_inode_info failed rc = %d\n",
+ rc);
+- if (server->ops->close)
+- server->ops->close(xid, tcon, fid);
+- goto out;
++ goto out_err;
+ }
++
++ if (S_ISDIR(newinode->i_mode)) {
++ rc = -EISDIR;
++ goto out_err;
++ }
++
+ d_drop(direntry);
+ d_add(direntry, newinode);
+
+@@ -410,6 +437,13 @@ out:
+ kfree(buf);
+ kfree(full_path);
+ return rc;
++
++out_err:
++ if (server->ops->close)
++ server->ops->close(xid, tcon, fid);
++ if (newinode)
++ iput(newinode);
++ goto out;
+ }
+
+ int
+diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
+index c88a8279e532..ff226cc6d391 100644
+--- a/fs/cifs/inode.c
++++ b/fs/cifs/inode.c
+@@ -958,10 +958,26 @@ struct inode *cifs_root_iget(struct super_block *sb)
+ struct inode *inode = NULL;
+ long rc;
+ struct cifs_tcon *tcon = cifs_sb_master_tcon(cifs_sb);
++ char *path = NULL;
++ int len;
++
++ if ((cifs_sb->mnt_cifs_flags & CIFS_MOUNT_USE_PREFIX_PATH)
++ && cifs_sb->prepath) {
++ len = strlen(cifs_sb->prepath);
++ path = kzalloc(len + 2 /* leading sep + null */, GFP_KERNEL);
++ if (path == NULL)
++ return ERR_PTR(-ENOMEM);
++ path[0] = '/';
++ memcpy(path+1, cifs_sb->prepath, len);
++ } else {
++ path = kstrdup("", GFP_KERNEL);
++ if (path == NULL)
++ return ERR_PTR(-ENOMEM);
++ }
+
+ xid = get_xid();
+ if (tcon->unix_ext) {
+- rc = cifs_get_inode_info_unix(&inode, "", sb, xid);
++ rc = cifs_get_inode_info_unix(&inode, path, sb, xid);
+ /* some servers mistakenly claim POSIX support */
+ if (rc != -EOPNOTSUPP)
+ goto iget_no_retry;
+@@ -969,7 +985,8 @@ struct inode *cifs_root_iget(struct super_block *sb)
+ tcon->unix_ext = false;
+ }
+
+- rc = cifs_get_inode_info(&inode, "", NULL, sb, xid, NULL);
++ convert_delimiter(path, CIFS_DIR_SEP(cifs_sb));
++ rc = cifs_get_inode_info(&inode, path, NULL, sb, xid, NULL);
+
+ iget_no_retry:
+ if (!inode) {
+@@ -998,6 +1015,7 @@ iget_no_retry:
+ }
+
+ out:
++ kfree(path);
+ /* can not call macro free_xid here since in a void func
+ * TODO: This is no longer true
+ */
+diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c
+index 51f5251d7db5..aa68b34301ec 100644
+--- a/fs/cifs/smb2ops.c
++++ b/fs/cifs/smb2ops.c
+@@ -972,6 +972,9 @@ smb2_new_lease_key(struct cifs_fid *fid)
+ get_random_bytes(fid->lease_key, SMB2_LEASE_KEY_SIZE);
+ }
+
++#define SMB2_SYMLINK_STRUCT_SIZE \
++ (sizeof(struct smb2_err_rsp) - 1 + sizeof(struct smb2_symlink_err_rsp))
++
+ static int
+ smb2_query_symlink(const unsigned int xid, struct cifs_tcon *tcon,
+ const char *full_path, char **target_path,
+@@ -984,7 +987,10 @@ smb2_query_symlink(const unsigned int xid, struct cifs_tcon *tcon,
+ struct cifs_fid fid;
+ struct smb2_err_rsp *err_buf = NULL;
+ struct smb2_symlink_err_rsp *symlink;
+- unsigned int sub_len, sub_offset;
++ unsigned int sub_len;
++ unsigned int sub_offset;
++ unsigned int print_len;
++ unsigned int print_offset;
+
+ cifs_dbg(FYI, "%s: path: %s\n", __func__, full_path);
+
+@@ -1005,11 +1011,33 @@ smb2_query_symlink(const unsigned int xid, struct cifs_tcon *tcon,
+ kfree(utf16_path);
+ return -ENOENT;
+ }
++
++ if (le32_to_cpu(err_buf->ByteCount) < sizeof(struct smb2_symlink_err_rsp) ||
++ get_rfc1002_length(err_buf) + 4 < SMB2_SYMLINK_STRUCT_SIZE) {
++ kfree(utf16_path);
++ return -ENOENT;
++ }
++
+ /* open must fail on symlink - reset rc */
+ rc = 0;
+ symlink = (struct smb2_symlink_err_rsp *)err_buf->ErrorData;
+ sub_len = le16_to_cpu(symlink->SubstituteNameLength);
+ sub_offset = le16_to_cpu(symlink->SubstituteNameOffset);
++ print_len = le16_to_cpu(symlink->PrintNameLength);
++ print_offset = le16_to_cpu(symlink->PrintNameOffset);
++
++ if (get_rfc1002_length(err_buf) + 4 <
++ SMB2_SYMLINK_STRUCT_SIZE + sub_offset + sub_len) {
++ kfree(utf16_path);
++ return -ENOENT;
++ }
++
++ if (get_rfc1002_length(err_buf) + 4 <
++ SMB2_SYMLINK_STRUCT_SIZE + print_offset + print_len) {
++ kfree(utf16_path);
++ return -ENOENT;
++ }
++
+ *target_path = cifs_strndup_from_utf16(
+ (char *)symlink->PathBuffer + sub_offset,
+ sub_len, true, cifs_sb->local_nls);
+diff --git a/fs/dcache.c b/fs/dcache.c
+index 7654509f398f..53ad17f9ea44 100644
+--- a/fs/dcache.c
++++ b/fs/dcache.c
+@@ -508,7 +508,7 @@ static void __dentry_kill(struct dentry *dentry)
+ * dentry_iput drops the locks, at which point nobody (except
+ * transient RCU lookups) can reach this dentry.
+ */
+- BUG_ON((int)dentry->d_lockref.count > 0);
++ BUG_ON(dentry->d_lockref.count > 0);
+ this_cpu_dec(nr_dentry);
+ if (dentry->d_op && dentry->d_op->d_release)
+ dentry->d_op->d_release(dentry);
+@@ -552,7 +552,6 @@ static struct dentry *dentry_kill(struct dentry *dentry)
+
+ failed:
+ spin_unlock(&dentry->d_lock);
+- cpu_relax();
+ return dentry; /* try again with same dentry */
+ }
+
+@@ -561,7 +560,7 @@ static inline struct dentry *lock_parent(struct dentry *dentry)
+ struct dentry *parent = dentry->d_parent;
+ if (IS_ROOT(dentry))
+ return NULL;
+- if (unlikely((int)dentry->d_lockref.count < 0))
++ if (unlikely(dentry->d_lockref.count < 0))
+ return NULL;
+ if (likely(spin_trylock(&parent->d_lock)))
+ return parent;
+@@ -590,6 +589,110 @@ again:
+ return parent;
+ }
+
++/*
++ * Try to do a lockless dput(), and return whether that was successful.
++ *
++ * If unsuccessful, we return false, having already taken the dentry lock.
++ *
++ * The caller needs to hold the RCU read lock, so that the dentry is
++ * guaranteed to stay around even if the refcount goes down to zero!
++ */
++static inline bool fast_dput(struct dentry *dentry)
++{
++ int ret;
++ unsigned int d_flags;
++
++ /*
++ * If we have a d_op->d_delete() operation, we sould not
++ * let the dentry count go to zero, so use "put__or_lock".
++ */
++ if (unlikely(dentry->d_flags & DCACHE_OP_DELETE))
++ return lockref_put_or_lock(&dentry->d_lockref);
++
++ /*
++ * .. otherwise, we can try to just decrement the
++ * lockref optimistically.
++ */
++ ret = lockref_put_return(&dentry->d_lockref);
++
++ /*
++ * If the lockref_put_return() failed due to the lock being held
++ * by somebody else, the fast path has failed. We will need to
++ * get the lock, and then check the count again.
++ */
++ if (unlikely(ret < 0)) {
++ spin_lock(&dentry->d_lock);
++ if (dentry->d_lockref.count > 1) {
++ dentry->d_lockref.count--;
++ spin_unlock(&dentry->d_lock);
++ return 1;
++ }
++ return 0;
++ }
++
++ /*
++ * If we weren't the last ref, we're done.
++ */
++ if (ret)
++ return 1;
++
++ /*
++ * Careful, careful. The reference count went down
++ * to zero, but we don't hold the dentry lock, so
++ * somebody else could get it again, and do another
++ * dput(), and we need to not race with that.
++ *
++ * However, there is a very special and common case
++ * where we don't care, because there is nothing to
++ * do: the dentry is still hashed, it does not have
++ * a 'delete' op, and it's referenced and already on
++ * the LRU list.
++ *
++ * NOTE! Since we aren't locked, these values are
++ * not "stable". However, it is sufficient that at
++ * some point after we dropped the reference the
++ * dentry was hashed and the flags had the proper
++ * value. Other dentry users may have re-gotten
++ * a reference to the dentry and change that, but
++ * our work is done - we can leave the dentry
++ * around with a zero refcount.
++ */
++ smp_rmb();
++ d_flags = ACCESS_ONCE(dentry->d_flags);
++ d_flags &= DCACHE_REFERENCED | DCACHE_LRU_LIST;
++
++ /* Nothing to do? Dropping the reference was all we needed? */
++ if (d_flags == (DCACHE_REFERENCED | DCACHE_LRU_LIST) && !d_unhashed(dentry))
++ return 1;
++
++ /*
++ * Not the fast normal case? Get the lock. We've already decremented
++ * the refcount, but we'll need to re-check the situation after
++ * getting the lock.
++ */
++ spin_lock(&dentry->d_lock);
++
++ /*
++ * Did somebody else grab a reference to it in the meantime, and
++ * we're no longer the last user after all? Alternatively, somebody
++ * else could have killed it and marked it dead. Either way, we
++ * don't need to do anything else.
++ */
++ if (dentry->d_lockref.count) {
++ spin_unlock(&dentry->d_lock);
++ return 1;
++ }
++
++ /*
++ * Re-get the reference we optimistically dropped. We hold the
++ * lock, and we just tested that it was zero, so we can just
++ * set it to 1.
++ */
++ dentry->d_lockref.count = 1;
++ return 0;
++}
++
++
+ /*
+ * This is dput
+ *
+@@ -622,8 +725,16 @@ void dput(struct dentry *dentry)
+ return;
+
+ repeat:
+- if (lockref_put_or_lock(&dentry->d_lockref))
++ might_sleep();
++
++ rcu_read_lock();
++ if (likely(fast_dput(dentry))) {
++ rcu_read_unlock();
+ return;
++ }
++
++ /* Slow case: now with the dentry lock held */
++ rcu_read_unlock();
+
+ /* Unreachable? Get rid of it */
+ if (unlikely(d_unhashed(dentry)))
+@@ -647,8 +758,10 @@ repeat:
+
+ kill_it:
+ dentry = dentry_kill(dentry);
+- if (dentry)
++ if (dentry) {
++ cond_resched();
+ goto repeat;
++ }
+ }
+ EXPORT_SYMBOL(dput);
+
+@@ -813,7 +926,7 @@ static void shrink_dentry_list(struct list_head *list)
+ * We found an inuse dentry which was not removed from
+ * the LRU because of laziness during lookup. Do not free it.
+ */
+- if ((int)dentry->d_lockref.count > 0) {
++ if (dentry->d_lockref.count > 0) {
+ spin_unlock(&dentry->d_lock);
+ if (parent)
+ spin_unlock(&parent->d_lock);
+diff --git a/fs/ext4/balloc.c b/fs/ext4/balloc.c
+index 83a6f497c4e0..cb3860817fed 100644
+--- a/fs/ext4/balloc.c
++++ b/fs/ext4/balloc.c
+@@ -209,6 +209,9 @@ static int ext4_init_block_bitmap(struct super_block *sb,
+ memset(bh->b_data, 0, sb->s_blocksize);
+
+ bit_max = ext4_num_base_meta_clusters(sb, block_group);
++ if ((bit_max >> 3) >= bh->b_size)
++ return -EIO;
++
+ for (bit = 0; bit < bit_max; bit++)
+ ext4_set_bit(bit, bh->b_data);
+
+diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
+index b95c32096a68..e5b44dd2724e 100644
+--- a/fs/ext4/extents.c
++++ b/fs/ext4/extents.c
+@@ -375,9 +375,13 @@ static int ext4_valid_extent(struct inode *inode, struct ext4_extent *ext)
+ ext4_fsblk_t block = ext4_ext_pblock(ext);
+ int len = ext4_ext_get_actual_len(ext);
+ ext4_lblk_t lblock = le32_to_cpu(ext->ee_block);
+- ext4_lblk_t last = lblock + len - 1;
+
+- if (len == 0 || lblock > last)
++ /*
++ * We allow neither:
++ * - zero length
++ * - overflow/wrap-around
++ */
++ if (lblock + len <= lblock)
+ return 0;
+ return ext4_data_block_valid(EXT4_SB(inode->i_sb), block, len);
+ }
+diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
+index 6d7293082086..e5dc3007627a 100644
+--- a/fs/ext4/inode.c
++++ b/fs/ext4/inode.c
+@@ -207,9 +207,9 @@ void ext4_evict_inode(struct inode *inode)
+ * Note that directories do not have this problem because they
+ * don't use page cache.
+ */
+- if (ext4_should_journal_data(inode) &&
+- (S_ISLNK(inode->i_mode) || S_ISREG(inode->i_mode)) &&
+- inode->i_ino != EXT4_JOURNAL_INO) {
++ if (inode->i_ino != EXT4_JOURNAL_INO &&
++ ext4_should_journal_data(inode) &&
++ (S_ISLNK(inode->i_mode) || S_ISREG(inode->i_mode))) {
+ journal_t *journal = EXT4_SB(inode->i_sb)->s_journal;
+ tid_t commit_tid = EXT4_I(inode)->i_datasync_tid;
+
+@@ -2441,13 +2441,36 @@ retry:
+ done = true;
+ }
+ }
+- ext4_journal_stop(handle);
++ /*
++ * Caution: If the handle is synchronous,
++ * ext4_journal_stop() can wait for transaction commit
++ * to finish which may depend on writeback of pages to
++ * complete or on page lock to be released. In that
++ * case, we have to wait until after after we have
++ * submitted all the IO, released page locks we hold,
++ * and dropped io_end reference (for extent conversion
++ * to be able to complete) before stopping the handle.
++ */
++ if (!ext4_handle_valid(handle) || handle->h_sync == 0) {
++ ext4_journal_stop(handle);
++ handle = NULL;
++ }
+ /* Submit prepared bio */
+ ext4_io_submit(&mpd.io_submit);
+ /* Unlock pages we didn't use */
+ mpage_release_unused_pages(&mpd, give_up_on_write);
+- /* Drop our io_end reference we got from init */
+- ext4_put_io_end(mpd.io_submit.io_end);
++ /*
++ * Drop our io_end reference we got from init. We have
++ * to be careful and use deferred io_end finishing if
++ * we are still holding the transaction as we can
++ * release the last reference to io_end which may end
++ * up doing unwritten extent conversion.
++ */
++ if (handle) {
++ ext4_put_io_end_defer(mpd.io_submit.io_end);
++ ext4_journal_stop(handle);
++ } else
++ ext4_put_io_end(mpd.io_submit.io_end);
+
+ if (ret == -ENOSPC && sbi->s_journal) {
+ /*
+diff --git a/fs/ext4/super.c b/fs/ext4/super.c
+index a5d94f263870..02711ffbb398 100644
+--- a/fs/ext4/super.c
++++ b/fs/ext4/super.c
+@@ -2204,6 +2204,16 @@ static void ext4_orphan_cleanup(struct super_block *sb,
+ while (es->s_last_orphan) {
+ struct inode *inode;
+
++ /*
++ * We may have encountered an error during cleanup; if
++ * so, skip the rest.
++ */
++ if (EXT4_SB(sb)->s_mount_state & EXT4_ERROR_FS) {
++ jbd_debug(1, "Skipping orphan recovery on fs with errors.\n");
++ es->s_last_orphan = 0;
++ break;
++ }
++
+ inode = ext4_orphan_get(sb, le32_to_cpu(es->s_last_orphan));
+ if (IS_ERR(inode)) {
+ es->s_last_orphan = 0;
+@@ -3668,6 +3678,13 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
+ goto failed_mount;
+ }
+
++ if (le16_to_cpu(sbi->s_es->s_reserved_gdt_blocks) > (blocksize / 4)) {
++ ext4_msg(sb, KERN_ERR,
++ "Number of reserved GDT blocks insanely large: %d",
++ le16_to_cpu(sbi->s_es->s_reserved_gdt_blocks));
++ goto failed_mount;
++ }
++
+ if (sb->s_blocksize != blocksize) {
+ /* Validate the filesystem blocksize */
+ if (!sb_set_blocksize(sb, blocksize)) {
+diff --git a/fs/fuse/file.c b/fs/fuse/file.c
+index e2a2c14a90ee..8e2c5ccc09b1 100644
+--- a/fs/fuse/file.c
++++ b/fs/fuse/file.c
+@@ -454,6 +454,15 @@ static int fuse_flush(struct file *file, fl_owner_t id)
+ fuse_sync_writes(inode);
+ mutex_unlock(&inode->i_mutex);
+
++ if (test_bit(AS_ENOSPC, &file->f_mapping->flags) &&
++ test_and_clear_bit(AS_ENOSPC, &file->f_mapping->flags))
++ err = -ENOSPC;
++ if (test_bit(AS_EIO, &file->f_mapping->flags) &&
++ test_and_clear_bit(AS_EIO, &file->f_mapping->flags))
++ err = -EIO;
++ if (err)
++ return err;
++
+ req = fuse_get_req_nofail_nopages(fc, file);
+ memset(&inarg, 0, sizeof(inarg));
+ inarg.fh = ff->fh;
+@@ -499,6 +508,21 @@ int fuse_fsync_common(struct file *file, loff_t start, loff_t end,
+ goto out;
+
+ fuse_sync_writes(inode);
++
++ /*
++ * Due to implementation of fuse writeback
++ * filemap_write_and_wait_range() does not catch errors.
++ * We have to do this directly after fuse_sync_writes()
++ */
++ if (test_bit(AS_ENOSPC, &file->f_mapping->flags) &&
++ test_and_clear_bit(AS_ENOSPC, &file->f_mapping->flags))
++ err = -ENOSPC;
++ if (test_bit(AS_EIO, &file->f_mapping->flags) &&
++ test_and_clear_bit(AS_EIO, &file->f_mapping->flags))
++ err = -EIO;
++ if (err)
++ goto out;
++
+ err = sync_inode_metadata(inode, 1);
+ if (err)
+ goto out;
+diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c
+index 9e3f6cfee2fb..230b424543ef 100644
+--- a/fs/fuse/inode.c
++++ b/fs/fuse/inode.c
+@@ -933,7 +933,7 @@ static void fuse_send_init(struct fuse_conn *fc, struct fuse_req *req)
+ arg->flags |= FUSE_ASYNC_READ | FUSE_POSIX_LOCKS | FUSE_ATOMIC_O_TRUNC |
+ FUSE_EXPORT_SUPPORT | FUSE_BIG_WRITES | FUSE_DONT_MASK |
+ FUSE_SPLICE_WRITE | FUSE_SPLICE_MOVE | FUSE_SPLICE_READ |
+- FUSE_FLOCK_LOCKS | FUSE_IOCTL_DIR | FUSE_AUTO_INVAL_DATA |
++ FUSE_FLOCK_LOCKS | FUSE_HAS_IOCTL_DIR | FUSE_AUTO_INVAL_DATA |
+ FUSE_DO_READDIRPLUS | FUSE_READDIRPLUS_AUTO | FUSE_ASYNC_DIO |
+ FUSE_WRITEBACK_CACHE | FUSE_NO_OPEN_SUPPORT;
+ req->in.h.opcode = FUSE_INIT;
+diff --git a/fs/nfs/write.c b/fs/nfs/write.c
+index 6067f2a0b493..395b93f43df5 100644
+--- a/fs/nfs/write.c
++++ b/fs/nfs/write.c
+@@ -1204,6 +1204,9 @@ int nfs_updatepage(struct file *file, struct page *page,
+ dprintk("NFS: nfs_updatepage(%pD2 %d@%lld)\n",
+ file, count, (long long)(page_file_offset(page) + offset));
+
++ if (!count)
++ goto out;
++
+ if (nfs_can_extend_write(file, page, inode)) {
+ count = max(count + offset, nfs_page_length(page));
+ offset = 0;
+@@ -1214,7 +1217,7 @@ int nfs_updatepage(struct file *file, struct page *page,
+ nfs_set_pageerror(page);
+ else
+ __set_page_dirty_nobuffers(page);
+-
++out:
+ dprintk("NFS: nfs_updatepage returns %d (isize %lld)\n",
+ status, (long long)i_size_read(inode));
+ return status;
+diff --git a/fs/nfsd/nfs2acl.c b/fs/nfsd/nfs2acl.c
+index ac54ea60b3f6..67bdb78216f3 100644
+--- a/fs/nfsd/nfs2acl.c
++++ b/fs/nfsd/nfs2acl.c
+@@ -104,22 +104,21 @@ static __be32 nfsacld_proc_setacl(struct svc_rqst * rqstp,
+ goto out;
+
+ inode = fh->fh_dentry->d_inode;
+- if (!IS_POSIXACL(inode) || !inode->i_op->set_acl) {
+- error = -EOPNOTSUPP;
+- goto out_errno;
+- }
+
+ error = fh_want_write(fh);
+ if (error)
+ goto out_errno;
+
+- error = inode->i_op->set_acl(inode, argp->acl_access, ACL_TYPE_ACCESS);
++ fh_lock(fh);
++
++ error = set_posix_acl(inode, ACL_TYPE_ACCESS, argp->acl_access);
+ if (error)
+- goto out_drop_write;
+- error = inode->i_op->set_acl(inode, argp->acl_default,
+- ACL_TYPE_DEFAULT);
++ goto out_drop_lock;
++ error = set_posix_acl(inode, ACL_TYPE_DEFAULT, argp->acl_default);
+ if (error)
+- goto out_drop_write;
++ goto out_drop_lock;
++
++ fh_unlock(fh);
+
+ fh_drop_write(fh);
+
+@@ -131,7 +130,8 @@ out:
+ posix_acl_release(argp->acl_access);
+ posix_acl_release(argp->acl_default);
+ return nfserr;
+-out_drop_write:
++out_drop_lock:
++ fh_unlock(fh);
+ fh_drop_write(fh);
+ out_errno:
+ nfserr = nfserrno(error);
+diff --git a/fs/nfsd/nfs3acl.c b/fs/nfsd/nfs3acl.c
+index 34cbbab6abd7..78562dd5999c 100644
+--- a/fs/nfsd/nfs3acl.c
++++ b/fs/nfsd/nfs3acl.c
+@@ -95,22 +95,20 @@ static __be32 nfsd3_proc_setacl(struct svc_rqst * rqstp,
+ goto out;
+
+ inode = fh->fh_dentry->d_inode;
+- if (!IS_POSIXACL(inode) || !inode->i_op->set_acl) {
+- error = -EOPNOTSUPP;
+- goto out_errno;
+- }
+
+ error = fh_want_write(fh);
+ if (error)
+ goto out_errno;
+
+- error = inode->i_op->set_acl(inode, argp->acl_access, ACL_TYPE_ACCESS);
++ fh_lock(fh);
++
++ error = set_posix_acl(inode, ACL_TYPE_ACCESS, argp->acl_access);
+ if (error)
+- goto out_drop_write;
+- error = inode->i_op->set_acl(inode, argp->acl_default,
+- ACL_TYPE_DEFAULT);
++ goto out_drop_lock;
++ error = set_posix_acl(inode, ACL_TYPE_DEFAULT, argp->acl_default);
+
+-out_drop_write:
++out_drop_lock:
++ fh_unlock(fh);
+ fh_drop_write(fh);
+ out_errno:
+ nfserr = nfserrno(error);
+diff --git a/fs/nfsd/nfs4acl.c b/fs/nfsd/nfs4acl.c
+index 59fd76651781..df90268d7562 100644
+--- a/fs/nfsd/nfs4acl.c
++++ b/fs/nfsd/nfs4acl.c
+@@ -830,9 +830,6 @@ nfsd4_set_nfs4_acl(struct svc_rqst *rqstp, struct svc_fh *fhp,
+ dentry = fhp->fh_dentry;
+ inode = dentry->d_inode;
+
+- if (!inode->i_op->set_acl || !IS_POSIXACL(inode))
+- return nfserr_attrnotsupp;
+-
+ if (S_ISDIR(inode->i_mode))
+ flags = NFS4_ACL_DIR;
+
+@@ -842,16 +839,19 @@ nfsd4_set_nfs4_acl(struct svc_rqst *rqstp, struct svc_fh *fhp,
+ if (host_error < 0)
+ goto out_nfserr;
+
+- host_error = inode->i_op->set_acl(inode, pacl, ACL_TYPE_ACCESS);
++ fh_lock(fhp);
++
++ host_error = set_posix_acl(inode, ACL_TYPE_ACCESS, pacl);
+ if (host_error < 0)
+- goto out_release;
++ goto out_drop_lock;
+
+ if (S_ISDIR(inode->i_mode)) {
+- host_error = inode->i_op->set_acl(inode, dpacl,
+- ACL_TYPE_DEFAULT);
++ host_error = set_posix_acl(inode, ACL_TYPE_DEFAULT, dpacl);
+ }
+
+-out_release:
++out_drop_lock:
++ fh_unlock(fhp);
++
+ posix_acl_release(pacl);
+ posix_acl_release(dpacl);
+ out_nfserr:
+diff --git a/fs/posix_acl.c b/fs/posix_acl.c
+index 0855f772cd41..3de7c223c963 100644
+--- a/fs/posix_acl.c
++++ b/fs/posix_acl.c
+@@ -787,38 +787,42 @@ posix_acl_xattr_get(struct dentry *dentry, const char *name,
+ return error;
+ }
+
+-static int
+-posix_acl_xattr_set(struct dentry *dentry, const char *name,
+- const void *value, size_t size, int flags, int type)
++int
++set_posix_acl(struct inode *inode, int type, struct posix_acl *acl)
+ {
+- struct inode *inode = dentry->d_inode;
+- struct posix_acl *acl = NULL;
+- int ret;
+-
+ if (!IS_POSIXACL(inode))
+ return -EOPNOTSUPP;
+ if (!inode->i_op->set_acl)
+ return -EOPNOTSUPP;
+
+ if (type == ACL_TYPE_DEFAULT && !S_ISDIR(inode->i_mode))
+- return value ? -EACCES : 0;
++ return acl ? -EACCES : 0;
+ if (!inode_owner_or_capable(inode))
+ return -EPERM;
+
++ if (acl) {
++ int ret = posix_acl_valid(acl);
++ if (ret)
++ return ret;
++ }
++ return inode->i_op->set_acl(inode, acl, type);
++}
++EXPORT_SYMBOL(set_posix_acl);
++
++static int
++posix_acl_xattr_set(struct dentry *dentry, const char *name,
++ const void *value, size_t size, int flags, int type)
++{
++ struct inode *inode = dentry->d_inode;
++ struct posix_acl *acl = NULL;
++ int ret;
++
+ if (value) {
+ acl = posix_acl_from_xattr(&init_user_ns, value, size);
+ if (IS_ERR(acl))
+ return PTR_ERR(acl);
+-
+- if (acl) {
+- ret = posix_acl_valid(acl);
+- if (ret)
+- goto out;
+- }
+ }
+-
+- ret = inode->i_op->set_acl(inode, acl, type);
+-out:
++ ret = set_posix_acl(inode, type, acl);
+ posix_acl_release(acl);
+ return ret;
+ }
+diff --git a/include/linux/i8042.h b/include/linux/i8042.h
+index 0f9bafa17a02..d98780ca9604 100644
+--- a/include/linux/i8042.h
++++ b/include/linux/i8042.h
+@@ -62,7 +62,6 @@ struct serio;
+ void i8042_lock_chip(void);
+ void i8042_unlock_chip(void);
+ int i8042_command(unsigned char *param, int command);
+-bool i8042_check_port_owner(const struct serio *);
+ int i8042_install_filter(bool (*filter)(unsigned char data, unsigned char str,
+ struct serio *serio));
+ int i8042_remove_filter(bool (*filter)(unsigned char data, unsigned char str,
+@@ -83,11 +82,6 @@ static inline int i8042_command(unsigned char *param, int command)
+ return -ENODEV;
+ }
+
+-static inline bool i8042_check_port_owner(const struct serio *serio)
+-{
+- return false;
+-}
+-
+ static inline int i8042_install_filter(bool (*filter)(unsigned char data, unsigned char str,
+ struct serio *serio))
+ {
+diff --git a/include/linux/lockref.h b/include/linux/lockref.h
+index 4bfde0e99ed5..b10b122dd099 100644
+--- a/include/linux/lockref.h
++++ b/include/linux/lockref.h
+@@ -28,12 +28,13 @@ struct lockref {
+ #endif
+ struct {
+ spinlock_t lock;
+- unsigned int count;
++ int count;
+ };
+ };
+ };
+
+ extern void lockref_get(struct lockref *);
++extern int lockref_put_return(struct lockref *);
+ extern int lockref_get_not_zero(struct lockref *);
+ extern int lockref_get_or_lock(struct lockref *);
+ extern int lockref_put_or_lock(struct lockref *);
+diff --git a/include/linux/serio.h b/include/linux/serio.h
+index 9f779c7a2da4..27ae809edd70 100644
+--- a/include/linux/serio.h
++++ b/include/linux/serio.h
+@@ -29,7 +29,8 @@ struct serio {
+
+ struct serio_device_id id;
+
+- spinlock_t lock; /* protects critical sections from port's interrupt handler */
++ /* Protects critical sections from port's interrupt handler */
++ spinlock_t lock;
+
+ int (*write)(struct serio *, unsigned char);
+ int (*open)(struct serio *);
+@@ -38,16 +39,29 @@ struct serio {
+ void (*stop)(struct serio *);
+
+ struct serio *parent;
+- struct list_head child_node; /* Entry in parent->children list */
++ /* Entry in parent->children list */
++ struct list_head child_node;
+ struct list_head children;
+- unsigned int depth; /* level of nesting in serio hierarchy */
++ /* Level of nesting in serio hierarchy */
++ unsigned int depth;
+
+- struct serio_driver *drv; /* accessed from interrupt, must be protected by serio->lock and serio->sem */
+- struct mutex drv_mutex; /* protects serio->drv so attributes can pin driver */
++ /*
++ * serio->drv is accessed from interrupt handlers; when modifying
++ * caller should acquire serio->drv_mutex and serio->lock.
++ */
++ struct serio_driver *drv;
++ /* Protects serio->drv so attributes can pin current driver */
++ struct mutex drv_mutex;
+
+ struct device dev;
+
+ struct list_head node;
++
++ /*
++ * For use by PS/2 layer when several ports share hardware and
++ * may get indigestion when exposed to concurrent access (i8042).
++ */
++ struct mutex *ps2_cmd_mutex;
+ };
+ #define to_serio_port(d) container_of(d, struct serio, dev)
+
+diff --git a/ipc/msg.c b/ipc/msg.c
+index cfc8b388332d..02e72d3db498 100644
+--- a/ipc/msg.c
++++ b/ipc/msg.c
+@@ -678,7 +678,7 @@ long do_msgsnd(int msqid, long mtype, void __user *mtext,
+ rcu_read_lock();
+ ipc_lock_object(&msq->q_perm);
+
+- ipc_rcu_putref(msq, ipc_rcu_free);
++ ipc_rcu_putref(msq, msg_rcu_free);
+ /* raced with RMID? */
+ if (!ipc_valid_object(&msq->q_perm)) {
+ err = -EIDRM;
+diff --git a/ipc/sem.c b/ipc/sem.c
+index 85ad28aaf548..e59935d0dfcb 100644
+--- a/ipc/sem.c
++++ b/ipc/sem.c
+@@ -441,7 +441,7 @@ static inline struct sem_array *sem_obtain_object_check(struct ipc_namespace *ns
+ static inline void sem_lock_and_putref(struct sem_array *sma)
+ {
+ sem_lock(sma, NULL, -1);
+- ipc_rcu_putref(sma, ipc_rcu_free);
++ ipc_rcu_putref(sma, sem_rcu_free);
+ }
+
+ static inline void sem_rmid(struct ipc_namespace *ns, struct sem_array *s)
+@@ -1384,7 +1384,7 @@ static int semctl_main(struct ipc_namespace *ns, int semid, int semnum,
+ rcu_read_unlock();
+ sem_io = ipc_alloc(sizeof(ushort)*nsems);
+ if (sem_io == NULL) {
+- ipc_rcu_putref(sma, ipc_rcu_free);
++ ipc_rcu_putref(sma, sem_rcu_free);
+ return -ENOMEM;
+ }
+
+@@ -1418,20 +1418,20 @@ static int semctl_main(struct ipc_namespace *ns, int semid, int semnum,
+ if (nsems > SEMMSL_FAST) {
+ sem_io = ipc_alloc(sizeof(ushort)*nsems);
+ if (sem_io == NULL) {
+- ipc_rcu_putref(sma, ipc_rcu_free);
++ ipc_rcu_putref(sma, sem_rcu_free);
+ return -ENOMEM;
+ }
+ }
+
+ if (copy_from_user(sem_io, p, nsems*sizeof(ushort))) {
+- ipc_rcu_putref(sma, ipc_rcu_free);
++ ipc_rcu_putref(sma, sem_rcu_free);
+ err = -EFAULT;
+ goto out_free;
+ }
+
+ for (i = 0; i < nsems; i++) {
+ if (sem_io[i] > SEMVMX) {
+- ipc_rcu_putref(sma, ipc_rcu_free);
++ ipc_rcu_putref(sma, sem_rcu_free);
+ err = -ERANGE;
+ goto out_free;
+ }
+@@ -1721,7 +1721,7 @@ static struct sem_undo *find_alloc_undo(struct ipc_namespace *ns, int semid)
+ /* step 2: allocate new undo structure */
+ new = kzalloc(sizeof(struct sem_undo) + sizeof(short)*nsems, GFP_KERNEL);
+ if (!new) {
+- ipc_rcu_putref(sma, ipc_rcu_free);
++ ipc_rcu_putref(sma, sem_rcu_free);
+ return ERR_PTR(-ENOMEM);
+ }
+
+diff --git a/kernel/auditsc.c b/kernel/auditsc.c
+index cc3416f0deda..3a6e01013b34 100644
+--- a/kernel/auditsc.c
++++ b/kernel/auditsc.c
+@@ -73,6 +73,7 @@
+ #include <linux/compat.h>
+ #include <linux/ctype.h>
+ #include <linux/string.h>
++#include <linux/uaccess.h>
+ #include <uapi/linux/limits.h>
+
+ #include "audit.h"
+@@ -82,7 +83,8 @@
+ #define AUDITSC_SUCCESS 1
+ #define AUDITSC_FAILURE 2
+
+-/* no execve audit message should be longer than this (userspace limits) */
++/* no execve audit message should be longer than this (userspace limits),
++ * see the note near the top of audit_log_execve_info() about this value */
+ #define MAX_EXECVE_AUDIT_LEN 7500
+
+ /* max length to print of cmdline/proctitle value during audit */
+@@ -1010,185 +1012,178 @@ static int audit_log_pid_context(struct audit_context *context, pid_t pid,
+ return rc;
+ }
+
+-/*
+- * to_send and len_sent accounting are very loose estimates. We aren't
+- * really worried about a hard cap to MAX_EXECVE_AUDIT_LEN so much as being
+- * within about 500 bytes (next page boundary)
+- *
+- * why snprintf? an int is up to 12 digits long. if we just assumed when
+- * logging that a[%d]= was going to be 16 characters long we would be wasting
+- * space in every audit message. In one 7500 byte message we can log up to
+- * about 1000 min size arguments. That comes down to about 50% waste of space
+- * if we didn't do the snprintf to find out how long arg_num_len was.
+- */
+-static int audit_log_single_execve_arg(struct audit_context *context,
+- struct audit_buffer **ab,
+- int arg_num,
+- size_t *len_sent,
+- const char __user *p,
+- char *buf)
++static void audit_log_execve_info(struct audit_context *context,
++ struct audit_buffer **ab)
+ {
+- char arg_num_len_buf[12];
+- const char __user *tmp_p = p;
+- /* how many digits are in arg_num? 5 is the length of ' a=""' */
+- size_t arg_num_len = snprintf(arg_num_len_buf, 12, "%d", arg_num) + 5;
+- size_t len, len_left, to_send;
+- size_t max_execve_audit_len = MAX_EXECVE_AUDIT_LEN;
+- unsigned int i, has_cntl = 0, too_long = 0;
+- int ret;
+-
+- /* strnlen_user includes the null we don't want to send */
+- len_left = len = strnlen_user(p, MAX_ARG_STRLEN) - 1;
+-
+- /*
+- * We just created this mm, if we can't find the strings
+- * we just copied into it something is _very_ wrong. Similar
+- * for strings that are too long, we should not have created
+- * any.
+- */
+- if (unlikely((len == -1) || len > MAX_ARG_STRLEN - 1)) {
+- WARN_ON(1);
+- send_sig(SIGKILL, current, 0);
+- return -1;
++ long len_max;
++ long len_rem;
++ long len_full;
++ long len_buf;
++ long len_abuf;
++ long len_tmp;
++ bool require_data;
++ bool encode;
++ unsigned int iter;
++ unsigned int arg;
++ char *buf_head;
++ char *buf;
++ const char __user *p = (const char __user *)current->mm->arg_start;
++
++ /* NOTE: this buffer needs to be large enough to hold all the non-arg
++ * data we put in the audit record for this argument (see the
++ * code below) ... at this point in time 96 is plenty */
++ char abuf[96];
++
++ /* NOTE: we set MAX_EXECVE_AUDIT_LEN to a rather arbitrary limit, the
++ * current value of 7500 is not as important as the fact that it
++ * is less than 8k, a setting of 7500 gives us plenty of wiggle
++ * room if we go over a little bit in the logging below */
++ WARN_ON_ONCE(MAX_EXECVE_AUDIT_LEN > 7500);
++ len_max = MAX_EXECVE_AUDIT_LEN;
++
++ /* scratch buffer to hold the userspace args */
++ buf_head = kmalloc(MAX_EXECVE_AUDIT_LEN + 1, GFP_KERNEL);
++ if (!buf_head) {
++ audit_panic("out of memory for argv string");
++ return;
+ }
++ buf = buf_head;
+
+- /* walk the whole argument looking for non-ascii chars */
++ audit_log_format(*ab, "argc=%d", context->execve.argc);
++
++ len_rem = len_max;
++ len_buf = 0;
++ len_full = 0;
++ require_data = true;
++ encode = false;
++ iter = 0;
++ arg = 0;
+ do {
+- if (len_left > MAX_EXECVE_AUDIT_LEN)
+- to_send = MAX_EXECVE_AUDIT_LEN;
+- else
+- to_send = len_left;
+- ret = copy_from_user(buf, tmp_p, to_send);
+- /*
+- * There is no reason for this copy to be short. We just
+- * copied them here, and the mm hasn't been exposed to user-
+- * space yet.
+- */
+- if (ret) {
+- WARN_ON(1);
+- send_sig(SIGKILL, current, 0);
+- return -1;
+- }
+- buf[to_send] = '\0';
+- has_cntl = audit_string_contains_control(buf, to_send);
+- if (has_cntl) {
+- /*
+- * hex messages get logged as 2 bytes, so we can only
+- * send half as much in each message
+- */
+- max_execve_audit_len = MAX_EXECVE_AUDIT_LEN / 2;
+- break;
+- }
+- len_left -= to_send;
+- tmp_p += to_send;
+- } while (len_left > 0);
+-
+- len_left = len;
+-
+- if (len > max_execve_audit_len)
+- too_long = 1;
+-
+- /* rewalk the argument actually logging the message */
+- for (i = 0; len_left > 0; i++) {
+- int room_left;
+-
+- if (len_left > max_execve_audit_len)
+- to_send = max_execve_audit_len;
+- else
+- to_send = len_left;
+-
+- /* do we have space left to send this argument in this ab? */
+- room_left = MAX_EXECVE_AUDIT_LEN - arg_num_len - *len_sent;
+- if (has_cntl)
+- room_left -= (to_send * 2);
+- else
+- room_left -= to_send;
+- if (room_left < 0) {
+- *len_sent = 0;
+- audit_log_end(*ab);
+- *ab = audit_log_start(context, GFP_KERNEL, AUDIT_EXECVE);
+- if (!*ab)
+- return 0;
+- }
++ /* NOTE: we don't ever want to trust this value for anything
++ * serious, but the audit record format insists we
++ * provide an argument length for really long arguments,
++ * e.g. > MAX_EXECVE_AUDIT_LEN, so we have no choice but
++ * to use strncpy_from_user() to obtain this value for
++ * recording in the log, although we don't use it
++ * anywhere here to avoid a double-fetch problem */
++ if (len_full == 0)
++ len_full = strnlen_user(p, MAX_ARG_STRLEN) - 1;
++
++ /* read more data from userspace */
++ if (require_data) {
++ /* can we make more room in the buffer? */
++ if (buf != buf_head) {
++ memmove(buf_head, buf, len_buf);
++ buf = buf_head;
++ }
++
++ /* fetch as much as we can of the argument */
++ len_tmp = strncpy_from_user(&buf_head[len_buf], p,
++ len_max - len_buf);
++ if (len_tmp == -EFAULT) {
++ /* unable to copy from userspace */
++ send_sig(SIGKILL, current, 0);
++ goto out;
++ } else if (len_tmp == (len_max - len_buf)) {
++ /* buffer is not large enough */
++ require_data = true;
++ /* NOTE: if we are going to span multiple
++ * buffers force the encoding so we stand
++ * a chance at a sane len_full value and
++ * consistent record encoding */
++ encode = true;
++ len_full = len_full * 2;
++ p += len_tmp;
++ } else {
++ require_data = false;
++ if (!encode)
++ encode = audit_string_contains_control(
++ buf, len_tmp);
++ /* try to use a trusted value for len_full */
++ if (len_full < len_max)
++ len_full = (encode ?
++ len_tmp * 2 : len_tmp);
++ p += len_tmp + 1;
++ }
++ len_buf += len_tmp;
++ buf_head[len_buf] = '\0';
+
+- /*
+- * first record needs to say how long the original string was
+- * so we can be sure nothing was lost.
+- */
+- if ((i == 0) && (too_long))
+- audit_log_format(*ab, " a%d_len=%zu", arg_num,
+- has_cntl ? 2*len : len);
+-
+- /*
+- * normally arguments are small enough to fit and we already
+- * filled buf above when we checked for control characters
+- * so don't bother with another copy_from_user
+- */
+- if (len >= max_execve_audit_len)
+- ret = copy_from_user(buf, p, to_send);
+- else
+- ret = 0;
+- if (ret) {
+- WARN_ON(1);
+- send_sig(SIGKILL, current, 0);
+- return -1;
++ /* length of the buffer in the audit record? */
++ len_abuf = (encode ? len_buf * 2 : len_buf + 2);
+ }
+- buf[to_send] = '\0';
+-
+- /* actually log it */
+- audit_log_format(*ab, " a%d", arg_num);
+- if (too_long)
+- audit_log_format(*ab, "[%d]", i);
+- audit_log_format(*ab, "=");
+- if (has_cntl)
+- audit_log_n_hex(*ab, buf, to_send);
+- else
+- audit_log_string(*ab, buf);
+-
+- p += to_send;
+- len_left -= to_send;
+- *len_sent += arg_num_len;
+- if (has_cntl)
+- *len_sent += to_send * 2;
+- else
+- *len_sent += to_send;
+- }
+- /* include the null we didn't log */
+- return len + 1;
+-}
+
+-static void audit_log_execve_info(struct audit_context *context,
+- struct audit_buffer **ab)
+-{
+- int i, len;
+- size_t len_sent = 0;
+- const char __user *p;
+- char *buf;
++ /* write as much as we can to the audit log */
++ if (len_buf > 0) {
++ /* NOTE: some magic numbers here - basically if we
++ * can't fit a reasonable amount of data into the
++ * existing audit buffer, flush it and start with
++ * a new buffer */
++ if ((sizeof(abuf) + 8) > len_rem) {
++ len_rem = len_max;
++ audit_log_end(*ab);
++ *ab = audit_log_start(context,
++ GFP_KERNEL, AUDIT_EXECVE);
++ if (!*ab)
++ goto out;
++ }
+
+- p = (const char __user *)current->mm->arg_start;
++ /* create the non-arg portion of the arg record */
++ len_tmp = 0;
++ if (require_data || (iter > 0) ||
++ ((len_abuf + sizeof(abuf)) > len_rem)) {
++ if (iter == 0) {
++ len_tmp += snprintf(&abuf[len_tmp],
++ sizeof(abuf) - len_tmp,
++ " a%d_len=%lu",
++ arg, len_full);
++ }
++ len_tmp += snprintf(&abuf[len_tmp],
++ sizeof(abuf) - len_tmp,
++ " a%d[%d]=", arg, iter++);
++ } else
++ len_tmp += snprintf(&abuf[len_tmp],
++ sizeof(abuf) - len_tmp,
++ " a%d=", arg);
++ WARN_ON(len_tmp >= sizeof(abuf));
++ abuf[sizeof(abuf) - 1] = '\0';
++
++ /* log the arg in the audit record */
++ audit_log_format(*ab, "%s", abuf);
++ len_rem -= len_tmp;
++ len_tmp = len_buf;
++ if (encode) {
++ if (len_abuf > len_rem)
++ len_tmp = len_rem / 2; /* encoding */
++ audit_log_n_hex(*ab, buf, len_tmp);
++ len_rem -= len_tmp * 2;
++ len_abuf -= len_tmp * 2;
++ } else {
++ if (len_abuf > len_rem)
++ len_tmp = len_rem - 2; /* quotes */
++ audit_log_n_string(*ab, buf, len_tmp);
++ len_rem -= len_tmp + 2;
++ /* don't subtract the "2" because we still need
++ * to add quotes to the remaining string */
++ len_abuf -= len_tmp;
++ }
++ len_buf -= len_tmp;
++ buf += len_tmp;
++ }
+
+- audit_log_format(*ab, "argc=%d", context->execve.argc);
++ /* ready to move to the next argument? */
++ if ((len_buf == 0) && !require_data) {
++ arg++;
++ iter = 0;
++ len_full = 0;
++ require_data = true;
++ encode = false;
++ }
++ } while (arg < context->execve.argc);
+
+- /*
+- * we need some kernel buffer to hold the userspace args. Just
+- * allocate one big one rather than allocating one of the right size
+- * for every single argument inside audit_log_single_execve_arg()
+- * should be <8k allocation so should be pretty safe.
+- */
+- buf = kmalloc(MAX_EXECVE_AUDIT_LEN + 1, GFP_KERNEL);
+- if (!buf) {
+- audit_panic("out of memory for argv string");
+- return;
+- }
++ /* NOTE: the caller handles the final audit_log_end() call */
+
+- for (i = 0; i < context->execve.argc; i++) {
+- len = audit_log_single_execve_arg(context, ab, i,
+- &len_sent, p, buf);
+- if (len <= 0)
+- break;
+- p += len;
+- }
+- kfree(buf);
++out:
++ kfree(buf_head);
+ }
+
+ static void show_special(struct audit_context *context, int *call_panic)
+diff --git a/kernel/module.c b/kernel/module.c
+index 1df11b175a24..737d53099360 100644
+--- a/kernel/module.c
++++ b/kernel/module.c
+@@ -2454,13 +2454,18 @@ static inline void kmemleak_load_module(const struct module *mod,
+ #endif
+
+ #ifdef CONFIG_MODULE_SIG
+-static int module_sig_check(struct load_info *info)
++static int module_sig_check(struct load_info *info, int flags)
+ {
+ int err = -ENOKEY;
+ const unsigned long markerlen = sizeof(MODULE_SIG_STRING) - 1;
+ const void *mod = info->hdr;
+
+- if (info->len > markerlen &&
++ /*
++ * Require flags == 0, as a module with version information
++ * removed is no longer the module that was signed
++ */
++ if (flags == 0 &&
++ info->len > markerlen &&
+ memcmp(mod + info->len - markerlen, MODULE_SIG_STRING, markerlen) == 0) {
+ /* We truncate the module to discard the signature */
+ info->len -= markerlen;
+@@ -2479,7 +2484,7 @@ static int module_sig_check(struct load_info *info)
+ return err;
+ }
+ #else /* !CONFIG_MODULE_SIG */
+-static int module_sig_check(struct load_info *info)
++static int module_sig_check(struct load_info *info, int flags)
+ {
+ return 0;
+ }
+@@ -3215,7 +3220,7 @@ static int load_module(struct load_info *info, const char __user *uargs,
+ long err;
+ char *after_dashes;
+
+- err = module_sig_check(info);
++ err = module_sig_check(info, flags);
+ if (err)
+ goto free_copy;
+
+diff --git a/lib/lockref.c b/lib/lockref.c
+index d2233de9a86e..ecb9a665ec19 100644
+--- a/lib/lockref.c
++++ b/lib/lockref.c
+@@ -60,7 +60,7 @@ void lockref_get(struct lockref *lockref)
+ EXPORT_SYMBOL(lockref_get);
+
+ /**
+- * lockref_get_not_zero - Increments count unless the count is 0
++ * lockref_get_not_zero - Increments count unless the count is 0 or dead
+ * @lockref: pointer to lockref structure
+ * Return: 1 if count updated successfully or 0 if count was zero
+ */
+@@ -70,7 +70,7 @@ int lockref_get_not_zero(struct lockref *lockref)
+
+ CMPXCHG_LOOP(
+ new.count++;
+- if (!old.count)
++ if (old.count <= 0)
+ return 0;
+ ,
+ return 1;
+@@ -78,7 +78,7 @@ int lockref_get_not_zero(struct lockref *lockref)
+
+ spin_lock(&lockref->lock);
+ retval = 0;
+- if (lockref->count) {
++ if (lockref->count > 0) {
+ lockref->count++;
+ retval = 1;
+ }
+@@ -88,7 +88,7 @@ int lockref_get_not_zero(struct lockref *lockref)
+ EXPORT_SYMBOL(lockref_get_not_zero);
+
+ /**
+- * lockref_get_or_lock - Increments count unless the count is 0
++ * lockref_get_or_lock - Increments count unless the count is 0 or dead
+ * @lockref: pointer to lockref structure
+ * Return: 1 if count updated successfully or 0 if count was zero
+ * and we got the lock instead.
+@@ -97,14 +97,14 @@ int lockref_get_or_lock(struct lockref *lockref)
+ {
+ CMPXCHG_LOOP(
+ new.count++;
+- if (!old.count)
++ if (old.count <= 0)
+ break;
+ ,
+ return 1;
+ );
+
+ spin_lock(&lockref->lock);
+- if (!lockref->count)
++ if (lockref->count <= 0)
+ return 0;
+ lockref->count++;
+ spin_unlock(&lockref->lock);
+@@ -113,6 +113,26 @@ int lockref_get_or_lock(struct lockref *lockref)
+ EXPORT_SYMBOL(lockref_get_or_lock);
+
+ /**
++ * lockref_put_return - Decrement reference count if possible
++ * @lockref: pointer to lockref structure
++ *
++ * Decrement the reference count and return the new value.
++ * If the lockref was dead or locked, return an error.
++ */
++int lockref_put_return(struct lockref *lockref)
++{
++ CMPXCHG_LOOP(
++ new.count--;
++ if (old.count <= 0)
++ return -1;
++ ,
++ return new.count;
++ );
++ return -1;
++}
++EXPORT_SYMBOL(lockref_put_return);
++
++/**
+ * lockref_put_or_lock - decrements count unless count <= 1 before decrement
+ * @lockref: pointer to lockref structure
+ * Return: 1 if count updated successfully or 0 if count <= 1 and lock taken
+@@ -158,7 +178,7 @@ int lockref_get_not_dead(struct lockref *lockref)
+
+ CMPXCHG_LOOP(
+ new.count++;
+- if ((int)old.count < 0)
++ if (old.count < 0)
+ return 0;
+ ,
+ return 1;
+@@ -166,7 +186,7 @@ int lockref_get_not_dead(struct lockref *lockref)
+
+ spin_lock(&lockref->lock);
+ retval = 0;
+- if ((int) lockref->count >= 0) {
++ if (lockref->count >= 0) {
+ lockref->count++;
+ retval = 1;
+ }
+diff --git a/mm/hugetlb.c b/mm/hugetlb.c
+index 549bf5ac3d6e..7a57e302338f 100644
+--- a/mm/hugetlb.c
++++ b/mm/hugetlb.c
+@@ -1675,6 +1675,10 @@ static unsigned long set_max_huge_pages(struct hstate *h, unsigned long count,
+ * and reducing the surplus.
+ */
+ spin_unlock(&hugetlb_lock);
++
++ /* yield cpu to avoid soft lockup */
++ cond_resched();
++
+ if (hstate_is_gigantic(h))
+ ret = alloc_fresh_gigantic_page(h, nodes_allowed);
+ else
+diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
+index 31f106e61ca2..79678aafae6c 100644
+--- a/net/bluetooth/l2cap_sock.c
++++ b/net/bluetooth/l2cap_sock.c
+@@ -922,7 +922,7 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname,
+ break;
+ }
+
+- if (get_user(opt, (u32 __user *) optval)) {
++ if (get_user(opt, (u16 __user *) optval)) {
+ err = -EFAULT;
+ break;
+ }
+diff --git a/net/irda/af_irda.c b/net/irda/af_irda.c
+index b3f6ec0df426..1cc2b7b58ab1 100644
+--- a/net/irda/af_irda.c
++++ b/net/irda/af_irda.c
+@@ -1036,8 +1036,11 @@ static int irda_connect(struct socket *sock, struct sockaddr *uaddr,
+ }
+
+ /* Check if we have opened a local TSAP */
+- if (!self->tsap)
+- irda_open_tsap(self, LSAP_ANY, addr->sir_name);
++ if (!self->tsap) {
++ err = irda_open_tsap(self, LSAP_ANY, addr->sir_name);
++ if (err)
++ goto out;
++ }
+
+ /* Move to connecting socket, start sending Connect Requests */
+ sock->state = SS_CONNECTING;
+diff --git a/net/netlabel/netlabel_kapi.c b/net/netlabel/netlabel_kapi.c
+index 28cddc85b700..bfa2b6d5b5cf 100644
+--- a/net/netlabel/netlabel_kapi.c
++++ b/net/netlabel/netlabel_kapi.c
+@@ -824,7 +824,11 @@ socket_setattr_return:
+ */
+ void netlbl_sock_delattr(struct sock *sk)
+ {
+- cipso_v4_sock_delattr(sk);
++ switch (sk->sk_family) {
++ case AF_INET:
++ cipso_v4_sock_delattr(sk);
++ break;
++ }
+ }
+
+ /**
+@@ -987,7 +991,11 @@ req_setattr_return:
+ */
+ void netlbl_req_delattr(struct request_sock *req)
+ {
+- cipso_v4_req_delattr(req);
++ switch (req->rsk_ops->family) {
++ case AF_INET:
++ cipso_v4_req_delattr(req);
++ break;
++ }
+ }
+
+ /**
+diff --git a/scripts/recordmcount.c b/scripts/recordmcount.c
+index 001facfa5b74..d96d8a2647d6 100644
+--- a/scripts/recordmcount.c
++++ b/scripts/recordmcount.c
+@@ -33,10 +33,17 @@
+ #include <string.h>
+ #include <unistd.h>
+
++/*
++ * glibc synced up and added the metag number but didn't add the relocations.
++ * Work around this in a crude manner for now.
++ */
+ #ifndef EM_METAG
+-/* Remove this when these make it to the standard system elf.h. */
+ #define EM_METAG 174
++#endif
++#ifndef R_METAG_ADDR32
+ #define R_METAG_ADDR32 2
++#endif
++#ifndef R_METAG_NONE
+ #define R_METAG_NONE 3
+ #endif
+
+diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
+index bc9ed75c651c..c1115b3b90c8 100644
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -2093,6 +2093,8 @@ static const struct pci_device_id azx_ids[] = {
+ { PCI_DEVICE(0x1022, 0x780d),
+ .driver_data = AZX_DRIVER_GENERIC | AZX_DCAPS_PRESET_ATI_SB },
+ /* ATI HDMI */
++ { PCI_DEVICE(0x1002, 0x0002),
++ .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS },
+ { PCI_DEVICE(0x1002, 0x1308),
+ .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS },
+ { PCI_DEVICE(0x1002, 0x157a),
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index c35960b74026..ebb8feff0a84 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -4552,6 +4552,55 @@ static void alc290_fixup_mono_speakers(struct hda_codec *codec,
+ }
+ }
+
++/* Hook to update amp GPIO4 for automute */
++static void alc280_hp_gpio4_automute_hook(struct hda_codec *codec,
++ struct hda_jack_callback *jack)
++{
++ struct alc_spec *spec = codec->spec;
++
++ snd_hda_gen_hp_automute(codec, jack);
++ /* mute_led_polarity is set to 0, so we pass inverted value here */
++ alc_update_gpio_led(codec, 0x10, !spec->gen.hp_jack_present);
++}
++
++/* Manage GPIOs for HP EliteBook Folio 9480m.
++ *
++ * GPIO4 is the headphone amplifier power control
++ * GPIO3 is the audio output mute indicator LED
++ */
++
++static void alc280_fixup_hp_9480m(struct hda_codec *codec,
++ const struct hda_fixup *fix,
++ int action)
++{
++ struct alc_spec *spec = codec->spec;
++ static const struct hda_verb gpio_init[] = {
++ { 0x01, AC_VERB_SET_GPIO_MASK, 0x18 },
++ { 0x01, AC_VERB_SET_GPIO_DIRECTION, 0x18 },
++ {}
++ };
++
++ if (action == HDA_FIXUP_ACT_PRE_PROBE) {
++ /* Set the hooks to turn the headphone amp on/off
++ * as needed
++ */
++ spec->gen.vmaster_mute.hook = alc_fixup_gpio_mute_hook;
++ spec->gen.hp_automute_hook = alc280_hp_gpio4_automute_hook;
++
++ /* The GPIOs are currently off */
++ spec->gpio_led = 0;
++
++ /* GPIO3 is connected to the output mute LED,
++ * high is on, low is off
++ */
++ spec->mute_led_polarity = 0;
++ spec->gpio_mute_led_mask = 0x08;
++
++ /* Initialize GPIO configuration */
++ snd_hda_add_verbs(codec, gpio_init);
++ }
++}
++
+ /* for hda_fixup_thinkpad_acpi() */
+ #include "thinkpad_helper.c"
+
+@@ -4633,6 +4682,7 @@ enum {
+ ALC286_FIXUP_HP_GPIO_LED,
+ ALC280_FIXUP_HP_GPIO2_MIC_HOTKEY,
+ ALC280_FIXUP_HP_DOCK_PINS,
++ ALC280_FIXUP_HP_9480M,
+ ALC288_FIXUP_DELL_HEADSET_MODE,
+ ALC288_FIXUP_DELL1_MIC_NO_PRESENCE,
+ ALC288_FIXUP_DELL_XPS_13_GPIO6,
+@@ -5165,6 +5215,10 @@ static const struct hda_fixup alc269_fixups[] = {
+ .chained = true,
+ .chain_id = ALC280_FIXUP_HP_GPIO4
+ },
++ [ALC280_FIXUP_HP_9480M] = {
++ .type = HDA_FIXUP_FUNC,
++ .v.func = alc280_fixup_hp_9480m,
++ },
+ [ALC288_FIXUP_DELL_HEADSET_MODE] = {
+ .type = HDA_FIXUP_FUNC,
+ .v.func = alc_fixup_headset_mode_dell_alc288,
+@@ -5320,6 +5374,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x103c, 0x22b7, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+ SND_PCI_QUIRK(0x103c, 0x22bf, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+ SND_PCI_QUIRK(0x103c, 0x22cf, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
++ SND_PCI_QUIRK(0x103c, 0x22db, "HP", ALC280_FIXUP_HP_9480M),
+ SND_PCI_QUIRK(0x103c, 0x22dc, "HP", ALC269_FIXUP_HP_GPIO_MIC1_LED),
+ SND_PCI_QUIRK(0x103c, 0x22fb, "HP", ALC269_FIXUP_HP_GPIO_MIC1_LED),
+ /* ALC290 */
+diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
+index 7d32b4e82e86..e013f90f7a29 100644
+--- a/virt/kvm/kvm_main.c
++++ b/virt/kvm/kvm_main.c
+@@ -139,6 +139,7 @@ int vcpu_load(struct kvm_vcpu *vcpu)
+ put_cpu();
+ return 0;
+ }
++EXPORT_SYMBOL_GPL(vcpu_load);
+
+ void vcpu_put(struct kvm_vcpu *vcpu)
+ {
+@@ -148,6 +149,7 @@ void vcpu_put(struct kvm_vcpu *vcpu)
+ preempt_enable();
+ mutex_unlock(&vcpu->mutex);
+ }
++EXPORT_SYMBOL_GPL(vcpu_put);
+
+ static void ack_flush(void *_completed)
+ {
^ permalink raw reply related [flat|nested] 67+ messages in thread
* [gentoo-commits] proj/linux-patches:3.18 commit in: /
@ 2016-09-18 12:43 Mike Pagano
0 siblings, 0 replies; 67+ messages in thread
From: Mike Pagano @ 2016-09-18 12:43 UTC (permalink / raw
To: gentoo-commits
commit: a3730ed4142f4394f432aa12a5f8371eadd992a9
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Sun Sep 18 12:43:17 2016 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Sun Sep 18 12:43:17 2016 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=a3730ed4
Linux patch 3.18.41 and 3.18.42.
0000_README | 8 +
1040_linux-3.18.41.patch | 1139 ++++++++++++++++++++++++++++++++++++++++++++++
1041_linux-3.18.42.patch | 611 +++++++++++++++++++++++++
3 files changed, 1758 insertions(+)
diff --git a/0000_README b/0000_README
index c85b470..7228605 100644
--- a/0000_README
+++ b/0000_README
@@ -203,6 +203,14 @@ Patch: 1039_linux-3.18.40.patch
From: http://www.kernel.org
Desc: Linux 3.18.40
+Patch: 1040_linux-3.18.41.patch
+From: http://www.kernel.org
+Desc: Linux 3.18.41
+
+Patch: 1041_linux-3.18.42.patch
+From: http://www.kernel.org
+Desc: Linux 3.18.42
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1040_linux-3.18.41.patch b/1040_linux-3.18.41.patch
new file mode 100644
index 0000000..ca98c36
--- /dev/null
+++ b/1040_linux-3.18.41.patch
@@ -0,0 +1,1139 @@
+diff --git a/Makefile b/Makefile
+index 39e8b5638789..e31123a1d511 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 18
+-SUBLEVEL = 40
++SUBLEVEL = 41
+ EXTRAVERSION =
+ NAME = Diseased Newt
+
+diff --git a/arch/arc/include/asm/entry.h b/arch/arc/include/asm/entry.h
+index 884081099f80..81cdbc36699b 100644
+--- a/arch/arc/include/asm/entry.h
++++ b/arch/arc/include/asm/entry.h
+@@ -143,8 +143,6 @@
+ POP r13
+ .endm
+
+-#define OFF_USER_R25_FROM_R24 (SZ_CALLEE_REGS + SZ_PT_REGS - 8)/4
+-
+ /*--------------------------------------------------------------
+ * Collect User Mode callee regs as struct callee_regs - needed by
+ * fork/do_signal/unaligned-access-emulation.
+@@ -157,12 +155,13 @@
+ *-------------------------------------------------------------*/
+ .macro SAVE_CALLEE_SAVED_USER
+
++ mov r12, sp ; save SP as ref to pt_regs
+ SAVE_R13_TO_R24
+
+ #ifdef CONFIG_ARC_CURR_IN_REG
+- ; Retrieve orig r25 and save it on stack
+- ld.as r12, [sp, OFF_USER_R25_FROM_R24]
+- st.a r12, [sp, -4]
++ ; Retrieve orig r25 and save it with rest of callee_regs
++ ld r12, [r12, PT_user_r25]
++ PUSH r12
+ #else
+ PUSH r25
+ #endif
+@@ -209,12 +208,16 @@
+ .macro RESTORE_CALLEE_SAVED_USER
+
+ #ifdef CONFIG_ARC_CURR_IN_REG
+- ld.ab r12, [sp, 4]
+- st.as r12, [sp, OFF_USER_R25_FROM_R24]
++ POP r12
+ #else
+ POP r25
+ #endif
+ RESTORE_R24_TO_R13
++
++ ; SP is back to start of pt_regs
++#ifdef CONFIG_ARC_CURR_IN_REG
++ st r12, [sp, PT_user_r25]
++#endif
+ .endm
+
+ /*--------------------------------------------------------------
+diff --git a/arch/arc/include/asm/irqflags.h b/arch/arc/include/asm/irqflags.h
+index 742816f1b210..ec8276de345e 100644
+--- a/arch/arc/include/asm/irqflags.h
++++ b/arch/arc/include/asm/irqflags.h
+@@ -159,10 +159,10 @@ static inline int arch_irqs_disabled(void)
+ .endm
+
+ .macro IRQ_ENABLE scratch
++ TRACE_ASM_IRQ_ENABLE
+ lr \scratch, [status32]
+ or \scratch, \scratch, (STATUS_E1_MASK | STATUS_E2_MASK)
+ flag \scratch
+- TRACE_ASM_IRQ_ENABLE
+ .endm
+
+ #endif /* __ASSEMBLY__ */
+diff --git a/arch/arc/include/uapi/asm/elf.h b/arch/arc/include/uapi/asm/elf.h
+index 0f99ac8fcbb2..0037a587320d 100644
+--- a/arch/arc/include/uapi/asm/elf.h
++++ b/arch/arc/include/uapi/asm/elf.h
+@@ -13,8 +13,15 @@
+
+ /* Machine specific ELF Hdr flags */
+ #define EF_ARC_OSABI_MSK 0x00000f00
+-#define EF_ARC_OSABI_ORIG 0x00000000 /* MUST be zero for back-compat */
+-#define EF_ARC_OSABI_CURRENT 0x00000300 /* v3 (no legacy syscalls) */
++
++#define EF_ARC_OSABI_V3 0x00000300 /* v3 (no legacy syscalls) */
++#define EF_ARC_OSABI_V4 0x00000400 /* v4 (64bit data any reg align) */
++
++#if __GNUC__ < 6
++#define EF_ARC_OSABI_CURRENT EF_ARC_OSABI_V3
++#else
++#define EF_ARC_OSABI_CURRENT EF_ARC_OSABI_V4
++#endif
+
+ typedef unsigned long elf_greg_t;
+ typedef unsigned long elf_fpregset_t;
+diff --git a/arch/arc/kernel/arcksyms.c b/arch/arc/kernel/arcksyms.c
+index 4d9e77724bed..000dd041ab42 100644
+--- a/arch/arc/kernel/arcksyms.c
++++ b/arch/arc/kernel/arcksyms.c
+@@ -28,6 +28,7 @@ extern void __muldf3(void);
+ extern void __divdf3(void);
+ extern void __floatunsidf(void);
+ extern void __floatunsisf(void);
++extern void __udivdi3(void);
+
+ EXPORT_SYMBOL(__ashldi3);
+ EXPORT_SYMBOL(__ashrdi3);
+@@ -45,6 +46,7 @@ EXPORT_SYMBOL(__muldf3);
+ EXPORT_SYMBOL(__divdf3);
+ EXPORT_SYMBOL(__floatunsidf);
+ EXPORT_SYMBOL(__floatunsisf);
++EXPORT_SYMBOL(__udivdi3);
+
+ /* ARC optimised assembler routines */
+ EXPORT_SYMBOL(memset);
+diff --git a/arch/arc/kernel/asm-offsets.c b/arch/arc/kernel/asm-offsets.c
+index 6c3aa0edb9b5..5f14311ce59e 100644
+--- a/arch/arc/kernel/asm-offsets.c
++++ b/arch/arc/kernel/asm-offsets.c
+@@ -59,5 +59,7 @@ int main(void)
+
+ DEFINE(SZ_CALLEE_REGS, sizeof(struct callee_regs));
+ DEFINE(SZ_PT_REGS, sizeof(struct pt_regs));
++ DEFINE(PT_user_r25, offsetof(struct pt_regs, user_r25));
++
+ return 0;
+ }
+diff --git a/arch/arc/kernel/process.c b/arch/arc/kernel/process.c
+index fdd89715d2d3..f45b98781116 100644
+--- a/arch/arc/kernel/process.c
++++ b/arch/arc/kernel/process.c
+@@ -223,7 +223,7 @@ int elf_check_arch(const struct elf32_hdr *x)
+ return 0;
+
+ eflags = x->e_flags;
+- if ((eflags & EF_ARC_OSABI_MSK) < EF_ARC_OSABI_CURRENT) {
++ if ((eflags & EF_ARC_OSABI_MSK) != EF_ARC_OSABI_CURRENT) {
+ pr_err("ABI mismatch - you need newer toolchain\n");
+ force_sigsegv(SIGSEGV, current);
+ return 0;
+diff --git a/arch/arc/kernel/setup.c b/arch/arc/kernel/setup.c
+index 252bf603db9c..e5ec4789c31e 100644
+--- a/arch/arc/kernel/setup.c
++++ b/arch/arc/kernel/setup.c
+@@ -234,8 +234,10 @@ static char *arc_extn_mumbojumbo(int cpu_id, char *buf, int len)
+ cpu->dccm.base_addr, TO_KB(cpu->dccm.sz),
+ cpu->iccm.base_addr, TO_KB(cpu->iccm.sz));
+
+- n += scnprintf(buf + n, len - n,
+- "OS ABI [v3]\t: no-legacy-syscalls\n");
++ n += scnprintf(buf + n, len - n, "OS ABI [v%d]\t: %s\n",
++ EF_ARC_OSABI_CURRENT >> 8,
++ EF_ARC_OSABI_CURRENT == EF_ARC_OSABI_V3 ?
++ "no-legacy-syscalls" : "64-bit data any register aligned");
+
+ return buf;
+ }
+diff --git a/arch/arc/mm/cache_arc700.c b/arch/arc/mm/cache_arc700.c
+index 8c3a3e02ba92..2147ca2bc131 100644
+--- a/arch/arc/mm/cache_arc700.c
++++ b/arch/arc/mm/cache_arc700.c
+@@ -155,6 +155,15 @@ void arc_cache_init(void)
+
+ printk(arc_cache_mumbojumbo(0, str, sizeof(str)));
+
++ /*
++ * Only master CPU needs to execute rest of function:
++ * - Assume SMP so all cores will have same cache config so
++ * any geomtry checks will be same for all
++ * - IOC setup / dma callbacks only need to be setup once
++ */
++ if (cpu)
++ return;
++
+ if (IS_ENABLED(CONFIG_ARC_HAS_ICACHE)) {
+ struct cpuinfo_arc_cache *ic = &cpuinfo_arc700[cpu].icache;
+
+diff --git a/arch/parisc/include/uapi/asm/errno.h b/arch/parisc/include/uapi/asm/errno.h
+index c0ae62520d15..274d5bc6ecce 100644
+--- a/arch/parisc/include/uapi/asm/errno.h
++++ b/arch/parisc/include/uapi/asm/errno.h
+@@ -97,10 +97,10 @@
+ #define ENOTCONN 235 /* Transport endpoint is not connected */
+ #define ESHUTDOWN 236 /* Cannot send after transport endpoint shutdown */
+ #define ETOOMANYREFS 237 /* Too many references: cannot splice */
+-#define EREFUSED ECONNREFUSED /* for HP's NFS apparently */
+ #define ETIMEDOUT 238 /* Connection timed out */
+ #define ECONNREFUSED 239 /* Connection refused */
+-#define EREMOTERELEASE 240 /* Remote peer released connection */
++#define EREFUSED ECONNREFUSED /* for HP's NFS apparently */
++#define EREMOTERELEASE 240 /* Remote peer released connection */
+ #define EHOSTDOWN 241 /* Host is down */
+ #define EHOSTUNREACH 242 /* No route to host */
+
+diff --git a/arch/powerpc/kernel/eeh.c b/arch/powerpc/kernel/eeh.c
+index 2248a1999c64..f8402e17ef89 100644
+--- a/arch/powerpc/kernel/eeh.c
++++ b/arch/powerpc/kernel/eeh.c
+@@ -646,7 +646,7 @@ int eeh_pci_enable(struct eeh_pe *pe, int function)
+ /* Check if the request is finished successfully */
+ if (active_flag) {
+ rc = eeh_ops->wait_state(pe, PCI_BUS_RESET_WAIT_MSEC);
+- if (rc <= 0)
++ if (rc < 0)
+ return rc;
+
+ if (rc & active_flag)
+diff --git a/drivers/clocksource/sun4i_timer.c b/drivers/clocksource/sun4i_timer.c
+index f4a9c0058b4d..501c95941882 100644
+--- a/drivers/clocksource/sun4i_timer.c
++++ b/drivers/clocksource/sun4i_timer.c
+@@ -120,12 +120,16 @@ static struct clock_event_device sun4i_clockevent = {
+ .set_next_event = sun4i_clkevt_next_event,
+ };
+
++static void sun4i_timer_clear_interrupt(void)
++{
++ writel(TIMER_IRQ_EN(0), timer_base + TIMER_IRQ_ST_REG);
++}
+
+ static irqreturn_t sun4i_timer_interrupt(int irq, void *dev_id)
+ {
+ struct clock_event_device *evt = (struct clock_event_device *)dev_id;
+
+- writel(0x1, timer_base + TIMER_IRQ_ST_REG);
++ sun4i_timer_clear_interrupt();
+ evt->event_handler(evt);
+
+ return IRQ_HANDLED;
+@@ -182,6 +186,9 @@ static void __init sun4i_timer_init(struct device_node *node)
+ /* Make sure timer is stopped before playing with interrupts */
+ sun4i_clkevt_time_stop(0);
+
++ /* clear timer0 interrupt */
++ sun4i_timer_clear_interrupt();
++
+ sun4i_clockevent.cpumask = cpu_possible_mask;
+ sun4i_clockevent.irq = irq;
+
+diff --git a/drivers/crypto/caam/caamhash.c b/drivers/crypto/caam/caamhash.c
+index 5408450204b0..e3920af78621 100644
+--- a/drivers/crypto/caam/caamhash.c
++++ b/drivers/crypto/caam/caamhash.c
+@@ -1861,6 +1861,7 @@ caam_hash_alloc(struct caam_hash_template *template,
+ template->name);
+ snprintf(alg->cra_driver_name, CRYPTO_MAX_ALG_NAME, "%s",
+ template->driver_name);
++ t_alg->ahash_alg.setkey = NULL;
+ }
+ alg->cra_module = THIS_MODULE;
+ alg->cra_init = caam_hash_cra_init;
+diff --git a/drivers/gpio/Kconfig b/drivers/gpio/Kconfig
+index 0959ca9b6b27..929b680d4b29 100644
+--- a/drivers/gpio/Kconfig
++++ b/drivers/gpio/Kconfig
+@@ -50,6 +50,7 @@ config GPIO_DEVRES
+ config OF_GPIO
+ def_bool y
+ depends on OF
++ depends on HAS_IOMEM
+
+ config GPIO_ACPI
+ def_bool y
+diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c
+index 0cd6e0d7dd1a..18dd03bb7af0 100644
+--- a/drivers/gpu/drm/drm_crtc.c
++++ b/drivers/gpu/drm/drm_crtc.c
+@@ -4583,6 +4583,9 @@ int drm_mode_page_flip_ioctl(struct drm_device *dev,
+ unsigned long flags;
+ int ret = -EINVAL;
+
++ if (!drm_core_check_feature(dev, DRIVER_MODESET))
++ return -EINVAL;
++
+ if (page_flip->flags & ~DRM_MODE_PAGE_FLIP_FLAGS ||
+ page_flip->reserved != 0)
+ return -EINVAL;
+diff --git a/drivers/gpu/drm/i915/i915_gem_gtt.c b/drivers/gpu/drm/i915/i915_gem_gtt.c
+index 728938f02341..b92844ae5b27 100644
+--- a/drivers/gpu/drm/i915/i915_gem_gtt.c
++++ b/drivers/gpu/drm/i915/i915_gem_gtt.c
+@@ -1745,6 +1745,7 @@ void i915_global_gtt_cleanup(struct drm_device *dev)
+ struct i915_hw_ppgtt *ppgtt = dev_priv->mm.aliasing_ppgtt;
+
+ ppgtt->base.cleanup(&ppgtt->base);
++ kfree(ppgtt);
+ }
+
+ if (drm_mm_initialized(&vm->mm)) {
+diff --git a/drivers/gpu/drm/radeon/atombios_crtc.c b/drivers/gpu/drm/radeon/atombios_crtc.c
+index 2f2e50a0feb4..e0780bf1138f 100644
+--- a/drivers/gpu/drm/radeon/atombios_crtc.c
++++ b/drivers/gpu/drm/radeon/atombios_crtc.c
+@@ -586,7 +586,8 @@ static u32 atombios_adjust_pll(struct drm_crtc *crtc,
+ if (ASIC_IS_DCE41(rdev) || ASIC_IS_DCE61(rdev) || ASIC_IS_DCE8(rdev))
+ radeon_crtc->pll_flags |= RADEON_PLL_USE_FRAC_FB_DIV;
+ /* use frac fb div on RS780/RS880 */
+- if ((rdev->family == CHIP_RS780) || (rdev->family == CHIP_RS880))
++ if (((rdev->family == CHIP_RS780) || (rdev->family == CHIP_RS880))
++ && !radeon_crtc->ss_enabled)
+ radeon_crtc->pll_flags |= RADEON_PLL_USE_FRAC_FB_DIV;
+ if (ASIC_IS_DCE32(rdev) && mode->clock > 165000)
+ radeon_crtc->pll_flags |= RADEON_PLL_USE_FRAC_FB_DIV;
+@@ -616,7 +617,9 @@ static u32 atombios_adjust_pll(struct drm_crtc *crtc,
+ if (radeon_crtc->ss.refdiv) {
+ radeon_crtc->pll_flags |= RADEON_PLL_USE_REF_DIV;
+ radeon_crtc->pll_reference_div = radeon_crtc->ss.refdiv;
+- if (ASIC_IS_AVIVO(rdev))
++ if (ASIC_IS_AVIVO(rdev) &&
++ rdev->family != CHIP_RS780 &&
++ rdev->family != CHIP_RS880)
+ radeon_crtc->pll_flags |= RADEON_PLL_USE_FRAC_FB_DIV;
+ }
+ }
+diff --git a/drivers/gpu/drm/radeon/radeon_ttm.c b/drivers/gpu/drm/radeon/radeon_ttm.c
+index fdea9d07cca7..f361af72c548 100644
+--- a/drivers/gpu/drm/radeon/radeon_ttm.c
++++ b/drivers/gpu/drm/radeon/radeon_ttm.c
+@@ -240,8 +240,8 @@ static int radeon_move_blit(struct ttm_buffer_object *bo,
+
+ rdev = radeon_get_rdev(bo->bdev);
+ ridx = radeon_copy_ring_index(rdev);
+- old_start = old_mem->start << PAGE_SHIFT;
+- new_start = new_mem->start << PAGE_SHIFT;
++ old_start = (u64)old_mem->start << PAGE_SHIFT;
++ new_start = (u64)new_mem->start << PAGE_SHIFT;
+
+ switch (old_mem->mem_type) {
+ case TTM_PL_VRAM:
+diff --git a/drivers/input/keyboard/tegra-kbc.c b/drivers/input/keyboard/tegra-kbc.c
+index 9757a58bc897..5d39b966dd28 100644
+--- a/drivers/input/keyboard/tegra-kbc.c
++++ b/drivers/input/keyboard/tegra-kbc.c
+@@ -376,7 +376,7 @@ static int tegra_kbc_start(struct tegra_kbc *kbc)
+ /* Reset the KBC controller to clear all previous status.*/
+ reset_control_assert(kbc->rst);
+ udelay(100);
+- reset_control_assert(kbc->rst);
++ reset_control_deassert(kbc->rst);
+ udelay(100);
+
+ tegra_kbc_config_pins(kbc);
+diff --git a/drivers/input/serio/i8042.c b/drivers/input/serio/i8042.c
+index 1889f0a6c4ca..1e25a0616ca0 100644
+--- a/drivers/input/serio/i8042.c
++++ b/drivers/input/serio/i8042.c
+@@ -1258,6 +1258,7 @@ static int __init i8042_create_aux_port(int idx)
+ serio->write = i8042_aux_write;
+ serio->start = i8042_start;
+ serio->stop = i8042_stop;
++ serio->ps2_cmd_mutex = &i8042_mutex;
+ serio->port_data = port;
+ serio->dev.parent = &i8042_platform_device->dev;
+ if (idx < 0) {
+diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
+index 2a102834c2ee..a7a03a21d78a 100644
+--- a/drivers/md/bcache/super.c
++++ b/drivers/md/bcache/super.c
+@@ -1851,7 +1851,7 @@ static int cache_alloc(struct cache_sb *sb, struct cache *ca)
+ free = roundup_pow_of_two(ca->sb.nbuckets) >> 10;
+
+ if (!init_fifo(&ca->free[RESERVE_BTREE], 8, GFP_KERNEL) ||
+- !init_fifo(&ca->free[RESERVE_PRIO], prio_buckets(ca), GFP_KERNEL) ||
++ !init_fifo_exact(&ca->free[RESERVE_PRIO], prio_buckets(ca), GFP_KERNEL) ||
+ !init_fifo(&ca->free[RESERVE_MOVINGGC], free, GFP_KERNEL) ||
+ !init_fifo(&ca->free[RESERVE_NONE], free, GFP_KERNEL) ||
+ !init_fifo(&ca->free_inc, free << 2, GFP_KERNEL) ||
+@@ -1876,7 +1876,7 @@ static int register_cache(struct cache_sb *sb, struct page *sb_page,
+ struct block_device *bdev, struct cache *ca)
+ {
+ char name[BDEVNAME_SIZE];
+- const char *err = NULL;
++ const char *err = NULL; /* must be set for any error case */
+ int ret = 0;
+
+ memcpy(&ca->sb, sb, sizeof(struct cache_sb));
+@@ -1893,8 +1893,13 @@ static int register_cache(struct cache_sb *sb, struct page *sb_page,
+ ca->discard = CACHE_DISCARD(&ca->sb);
+
+ ret = cache_alloc(sb, ca);
+- if (ret != 0)
++ if (ret != 0) {
++ if (ret == -ENOMEM)
++ err = "cache_alloc(): -ENOMEM";
++ else
++ err = "cache_alloc(): unknown error";
+ goto err;
++ }
+
+ if (kobject_add(&ca->kobj, &part_to_dev(bdev->bd_part)->kobj, "bcache")) {
+ err = "error calling kobject_add";
+diff --git a/drivers/md/dm-flakey.c b/drivers/md/dm-flakey.c
+index 0f5e1820c92d..768c9fdf0df8 100644
+--- a/drivers/md/dm-flakey.c
++++ b/drivers/md/dm-flakey.c
+@@ -287,15 +287,13 @@ static int flakey_map(struct dm_target *ti, struct bio *bio)
+ pb->bio_submitted = true;
+
+ /*
+- * Map reads as normal only if corrupt_bio_byte set.
++ * Error reads if neither corrupt_bio_byte or drop_writes are set.
++ * Otherwise, flakey_end_io() will decide if the reads should be modified.
+ */
+ if (bio_data_dir(bio) == READ) {
+- /* If flags were specified, only corrupt those that match. */
+- if (fc->corrupt_bio_byte && (fc->corrupt_bio_rw == READ) &&
+- all_corrupt_bio_flags_match(bio, fc))
+- goto map_bio;
+- else
++ if (!fc->corrupt_bio_byte && !test_bit(DROP_WRITES, &fc->flags))
+ return -EIO;
++ goto map_bio;
+ }
+
+ /*
+@@ -332,14 +330,21 @@ static int flakey_end_io(struct dm_target *ti, struct bio *bio, int error)
+ struct flakey_c *fc = ti->private;
+ struct per_bio_data *pb = dm_per_bio_data(bio, sizeof(struct per_bio_data));
+
+- /*
+- * Corrupt successful READs while in down state.
+- */
+ if (!error && pb->bio_submitted && (bio_data_dir(bio) == READ)) {
+- if (fc->corrupt_bio_byte)
++ if (fc->corrupt_bio_byte && (fc->corrupt_bio_rw == READ) &&
++ all_corrupt_bio_flags_match(bio, fc)) {
++ /*
++ * Corrupt successful matching READs while in down state.
++ */
+ corrupt_bio_data(bio, fc);
+- else
++
++ } else if (!test_bit(DROP_WRITES, &fc->flags)) {
++ /*
++ * Error read during the down_interval if drop_writes
++ * wasn't configured.
++ */
+ return -EIO;
++ }
+ }
+
+ return error;
+diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
+index 2ee3c9537772..51f65299094b 100644
+--- a/drivers/net/ethernet/freescale/fec_main.c
++++ b/drivers/net/ethernet/freescale/fec_main.c
+@@ -3166,6 +3166,7 @@ fec_probe(struct platform_device *pdev)
+ /* setup board info structure */
+ fep = netdev_priv(ndev);
+
++ fep->netdev = ndev;
+ fep->num_rx_queues = num_rx_qs;
+ fep->num_tx_queues = num_tx_qs;
+
+diff --git a/drivers/pci/pci-sysfs.c b/drivers/pci/pci-sysfs.c
+index eb1543841e39..795d800deef2 100644
+--- a/drivers/pci/pci-sysfs.c
++++ b/drivers/pci/pci-sysfs.c
+@@ -1363,10 +1363,10 @@ int __must_check pci_create_sysfs_dev_files(struct pci_dev *pdev)
+ if (!sysfs_initialized)
+ return -EACCES;
+
+- if (pdev->cfg_size < PCI_CFG_SPACE_EXP_SIZE)
+- retval = sysfs_create_bin_file(&pdev->dev.kobj, &pci_config_attr);
+- else
++ if (pdev->cfg_size > PCI_CFG_SPACE_SIZE)
+ retval = sysfs_create_bin_file(&pdev->dev.kobj, &pcie_config_attr);
++ else
++ retval = sysfs_create_bin_file(&pdev->dev.kobj, &pci_config_attr);
+ if (retval)
+ goto err;
+
+@@ -1418,10 +1418,10 @@ err_rom_file:
+ err_resource_files:
+ pci_remove_resource_files(pdev);
+ err_config_file:
+- if (pdev->cfg_size < PCI_CFG_SPACE_EXP_SIZE)
+- sysfs_remove_bin_file(&pdev->dev.kobj, &pci_config_attr);
+- else
++ if (pdev->cfg_size > PCI_CFG_SPACE_SIZE)
+ sysfs_remove_bin_file(&pdev->dev.kobj, &pcie_config_attr);
++ else
++ sysfs_remove_bin_file(&pdev->dev.kobj, &pci_config_attr);
+ err:
+ return retval;
+ }
+@@ -1455,10 +1455,10 @@ void pci_remove_sysfs_dev_files(struct pci_dev *pdev)
+
+ pci_remove_capabilities_sysfs(pdev);
+
+- if (pdev->cfg_size < PCI_CFG_SPACE_EXP_SIZE)
+- sysfs_remove_bin_file(&pdev->dev.kobj, &pci_config_attr);
+- else
++ if (pdev->cfg_size > PCI_CFG_SPACE_SIZE)
+ sysfs_remove_bin_file(&pdev->dev.kobj, &pcie_config_attr);
++ else
++ sysfs_remove_bin_file(&pdev->dev.kobj, &pci_config_attr);
+
+ pci_remove_resource_files(pdev);
+
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index d89d4dac2c09..b3e63f567c56 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -288,6 +288,18 @@ static void quirk_citrine(struct pci_dev *dev)
+ }
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_IBM, PCI_DEVICE_ID_IBM_CITRINE, quirk_citrine);
+
++/*
++ * This chip can cause bus lockups if config addresses above 0x600
++ * are read or written.
++ */
++static void quirk_nfp6000(struct pci_dev *dev)
++{
++ dev->cfg_size = 0x600;
++}
++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_NETRONOME, PCI_DEVICE_ID_NETRONOME_NFP4000, quirk_nfp6000);
++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_NETRONOME, PCI_DEVICE_ID_NETRONOME_NFP6000, quirk_nfp6000);
++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_NETRONOME, PCI_DEVICE_ID_NETRONOME_NFP6000_VF, quirk_nfp6000);
++
+ /* On IBM Crocodile ipr SAS adapters, expand BAR to system page size */
+ static void quirk_extend_bar_to_page(struct pci_dev *dev)
+ {
+diff --git a/drivers/s390/block/dasd.c b/drivers/s390/block/dasd.c
+index 329db997ee66..35672b081254 100644
+--- a/drivers/s390/block/dasd.c
++++ b/drivers/s390/block/dasd.c
+@@ -1621,9 +1621,18 @@ void dasd_int_handler(struct ccw_device *cdev, unsigned long intparm,
+ unsigned long long now;
+ int expires;
+
++ cqr = (struct dasd_ccw_req *) intparm;
+ if (IS_ERR(irb)) {
+ switch (PTR_ERR(irb)) {
+ case -EIO:
++ if (cqr && cqr->status == DASD_CQR_CLEAR_PENDING) {
++ device = (struct dasd_device *) cqr->startdev;
++ cqr->status = DASD_CQR_CLEARED;
++ dasd_device_clear_timer(device);
++ wake_up(&dasd_flush_wq);
++ dasd_schedule_device_bh(device);
++ return;
++ }
+ break;
+ case -ETIMEDOUT:
+ DBF_EVENT_DEVID(DBF_WARNING, cdev, "%s: "
+@@ -1639,7 +1648,6 @@ void dasd_int_handler(struct ccw_device *cdev, unsigned long intparm,
+ }
+
+ now = get_tod_clock();
+- cqr = (struct dasd_ccw_req *) intparm;
+ /* check for conditions that should be handled immediately */
+ if (!cqr ||
+ !(scsw_dstat(&irb->scsw) == (DEV_STAT_CHN_END | DEV_STAT_DEV_END) &&
+diff --git a/drivers/scsi/aacraid/commctrl.c b/drivers/scsi/aacraid/commctrl.c
+index fbcd48d0bfc3..16b2db3cd9f1 100644
+--- a/drivers/scsi/aacraid/commctrl.c
++++ b/drivers/scsi/aacraid/commctrl.c
+@@ -63,7 +63,7 @@ static int ioctl_send_fib(struct aac_dev * dev, void __user *arg)
+ struct fib *fibptr;
+ struct hw_fib * hw_fib = (struct hw_fib *)0;
+ dma_addr_t hw_fib_pa = (dma_addr_t)0LL;
+- unsigned size;
++ unsigned int size, osize;
+ int retval;
+
+ if (dev->in_reset) {
+@@ -87,7 +87,8 @@ static int ioctl_send_fib(struct aac_dev * dev, void __user *arg)
+ * will not overrun the buffer when we copy the memory. Return
+ * an error if we would.
+ */
+- size = le16_to_cpu(kfib->header.Size) + sizeof(struct aac_fibhdr);
++ osize = size = le16_to_cpu(kfib->header.Size) +
++ sizeof(struct aac_fibhdr);
+ if (size < le16_to_cpu(kfib->header.SenderSize))
+ size = le16_to_cpu(kfib->header.SenderSize);
+ if (size > dev->max_fib_size) {
+@@ -118,6 +119,14 @@ static int ioctl_send_fib(struct aac_dev * dev, void __user *arg)
+ goto cleanup;
+ }
+
++ /* Sanity check the second copy */
++ if ((osize != le16_to_cpu(kfib->header.Size) +
++ sizeof(struct aac_fibhdr))
++ || (size < le16_to_cpu(kfib->header.SenderSize))) {
++ retval = -EINVAL;
++ goto cleanup;
++ }
++
+ if (kfib->header.Command == cpu_to_le16(TakeABreakPt)) {
+ aac_adapter_interrupt(dev);
+ /*
+diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
+index 0dd514e86fdc..f88ee8f3373d 100644
+--- a/drivers/usb/class/cdc-acm.c
++++ b/drivers/usb/class/cdc-acm.c
+@@ -1342,7 +1342,6 @@ made_compressed_probe:
+ spin_lock_init(&acm->write_lock);
+ spin_lock_init(&acm->read_lock);
+ mutex_init(&acm->mutex);
+- acm->rx_endpoint = usb_rcvbulkpipe(usb_dev, epread->bEndpointAddress);
+ acm->is_int_ep = usb_endpoint_xfer_int(epread);
+ if (acm->is_int_ep)
+ acm->bInterval = epread->bInterval;
+@@ -1392,14 +1391,14 @@ made_compressed_probe:
+ urb->transfer_dma = rb->dma;
+ if (acm->is_int_ep) {
+ usb_fill_int_urb(urb, acm->dev,
+- acm->rx_endpoint,
++ usb_rcvintpipe(usb_dev, epread->bEndpointAddress),
+ rb->base,
+ acm->readsize,
+ acm_read_bulk_callback, rb,
+ acm->bInterval);
+ } else {
+ usb_fill_bulk_urb(urb, acm->dev,
+- acm->rx_endpoint,
++ usb_rcvbulkpipe(usb_dev, epread->bEndpointAddress),
+ rb->base,
+ acm->readsize,
+ acm_read_bulk_callback, rb);
+diff --git a/drivers/usb/class/cdc-acm.h b/drivers/usb/class/cdc-acm.h
+index 70d24d7e9dc5..6050d8e92c5e 100644
+--- a/drivers/usb/class/cdc-acm.h
++++ b/drivers/usb/class/cdc-acm.h
+@@ -95,7 +95,6 @@ struct acm {
+ struct urb *read_urbs[ACM_NR];
+ struct acm_rb read_buffers[ACM_NR];
+ int rx_buflimit;
+- int rx_endpoint;
+ spinlock_t read_lock;
+ int write_used; /* number of non-empty write buffers */
+ int transmitting;
+diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
+index ea9475fe20df..464542a046c7 100644
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -1298,8 +1298,6 @@ static void hub_quiesce(struct usb_hub *hub, enum hub_quiescing_type type)
+ struct usb_device *hdev = hub->hdev;
+ int i;
+
+- cancel_delayed_work_sync(&hub->init_work);
+-
+ /* hub_wq and related activity won't re-trigger */
+ hub->quiescing = 1;
+
+diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
+index 37da0e8bac33..2d49d66113ee 100644
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -1802,7 +1802,8 @@ static void dwc3_gadget_free_endpoints(struct dwc3 *dwc)
+
+ static int __dwc3_cleanup_done_trbs(struct dwc3 *dwc, struct dwc3_ep *dep,
+ struct dwc3_request *req, struct dwc3_trb *trb,
+- const struct dwc3_event_depevt *event, int status)
++ const struct dwc3_event_depevt *event, int status,
++ int chain)
+ {
+ unsigned int count;
+ unsigned int s_pkt = 0;
+@@ -1810,6 +1811,19 @@ static int __dwc3_cleanup_done_trbs(struct dwc3 *dwc, struct dwc3_ep *dep,
+
+ trace_dwc3_complete_trb(dep, trb);
+
++ /*
++ * If we're in the middle of series of chained TRBs and we
++ * receive a short transfer along the way, DWC3 will skip
++ * through all TRBs including the last TRB in the chain (the
++ * where CHN bit is zero. DWC3 will also avoid clearing HWO
++ * bit and SW has to do it manually.
++ *
++ * We're going to do that here to avoid problems of HW trying
++ * to use bogus TRBs for transfers.
++ */
++ if (chain && (trb->ctrl & DWC3_TRB_CTRL_HWO))
++ trb->ctrl &= ~DWC3_TRB_CTRL_HWO;
++
+ if ((trb->ctrl & DWC3_TRB_CTRL_HWO) && status != -ESHUTDOWN)
+ /*
+ * We continue despite the error. There is not much we
+@@ -1821,6 +1835,7 @@ static int __dwc3_cleanup_done_trbs(struct dwc3 *dwc, struct dwc3_ep *dep,
+ */
+ dev_err(dwc->dev, "%s's TRB (%p) still owned by HW\n",
+ dep->name, trb);
++
+ count = trb->size & DWC3_TRB_SIZE_MASK;
+
+ if (dep->direction) {
+@@ -1858,15 +1873,7 @@ static int __dwc3_cleanup_done_trbs(struct dwc3 *dwc, struct dwc3_ep *dep,
+ s_pkt = 1;
+ }
+
+- /*
+- * We assume here we will always receive the entire data block
+- * which we should receive. Meaning, if we program RX to
+- * receive 4K but we receive only 2K, we assume that's all we
+- * should receive and we simply bounce the request back to the
+- * gadget driver for further processing.
+- */
+- req->request.actual += req->request.length - count;
+- if (s_pkt)
++ if (s_pkt && !chain)
+ return 1;
+ if ((event->status & DEPEVT_STATUS_LST) &&
+ (trb->ctrl & (DWC3_TRB_CTRL_LST |
+@@ -1885,14 +1892,19 @@ static int dwc3_cleanup_done_reqs(struct dwc3 *dwc, struct dwc3_ep *dep,
+ struct dwc3_trb *trb;
+ unsigned int slot;
+ unsigned int i;
++ int count = 0;
+ int ret;
+
+ do {
++ int chain;
++
+ req = next_request(&dep->req_queued);
+ if (!req) {
+ WARN_ON_ONCE(1);
+ return 1;
+ }
++
++ chain = req->request.num_mapped_sgs > 0;
+ i = 0;
+ do {
+ slot = req->start_slot + i;
+@@ -1901,13 +1913,22 @@ static int dwc3_cleanup_done_reqs(struct dwc3 *dwc, struct dwc3_ep *dep,
+ slot++;
+ slot %= DWC3_TRB_NUM;
+ trb = &dep->trb_pool[slot];
++ count += trb->size & DWC3_TRB_SIZE_MASK;
+
+ ret = __dwc3_cleanup_done_trbs(dwc, dep, req, trb,
+- event, status);
++ event, status, chain);
+ if (ret)
+ break;
+ }while (++i < req->request.num_mapped_sgs);
+
++ /*
++ * We assume here we will always receive the entire data block
++ * which we should receive. Meaning, if we program RX to
++ * receive 4K but we receive only 2K, we assume that's all we
++ * should receive and we simply bounce the request back to the
++ * gadget driver for further processing.
++ */
++ req->request.actual += req->request.length - count;
+ dwc3_gadget_giveback(dep, req, status);
+
+ if (ret)
+diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
+index 8bdfb38782f8..dfe835d21b15 100644
+--- a/drivers/usb/host/xhci-hub.c
++++ b/drivers/usb/host/xhci-hub.c
+@@ -276,6 +276,9 @@ static int xhci_stop_device(struct xhci_hcd *xhci, int slot_id, int suspend)
+
+ ret = 0;
+ virt_dev = xhci->devs[slot_id];
++ if (!virt_dev)
++ return -ENODEV;
++
+ cmd = xhci_alloc_command(xhci, false, true, GFP_NOIO);
+ if (!cmd) {
+ xhci_dbg(xhci, "Couldn't allocate command structure.\n");
+diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
+index 69464630be54..51ff57497b91 100644
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -1324,12 +1324,6 @@ static void handle_cmd_completion(struct xhci_hcd *xhci,
+
+ cmd = list_entry(xhci->cmd_list.next, struct xhci_command, cmd_list);
+
+- if (cmd->command_trb != xhci->cmd_ring->dequeue) {
+- xhci_err(xhci,
+- "Command completion event does not match command\n");
+- return;
+- }
+-
+ del_timer(&xhci->cmd_timer);
+
+ trace_xhci_cmd_completion(cmd_trb, (struct xhci_generic_trb *) event);
+@@ -1341,6 +1335,13 @@ static void handle_cmd_completion(struct xhci_hcd *xhci,
+ xhci_handle_stopped_cmd_ring(xhci, cmd);
+ return;
+ }
++
++ if (cmd->command_trb != xhci->cmd_ring->dequeue) {
++ xhci_err(xhci,
++ "Command completion event does not match command\n");
++ return;
++ }
++
+ /*
+ * Host aborted the command ring, check if the current command was
+ * supposed to be aborted, otherwise continue normally.
+diff --git a/drivers/usb/misc/usbtest.c b/drivers/usb/misc/usbtest.c
+index bbddc44ce8bc..c33ad2181b33 100644
+--- a/drivers/usb/misc/usbtest.c
++++ b/drivers/usb/misc/usbtest.c
+@@ -545,7 +545,6 @@ static void sg_timeout(unsigned long _req)
+ {
+ struct usb_sg_request *req = (struct usb_sg_request *) _req;
+
+- req->status = -ETIMEDOUT;
+ usb_sg_cancel(req);
+ }
+
+@@ -576,8 +575,10 @@ static int perform_sglist(
+ mod_timer(&sg_timer, jiffies +
+ msecs_to_jiffies(SIMPLE_IO_TIMEOUT));
+ usb_sg_wait(req);
+- del_timer_sync(&sg_timer);
+- retval = req->status;
++ if (!del_timer_sync(&sg_timer))
++ retval = -ETIMEDOUT;
++ else
++ retval = req->status;
+
+ /* FIXME check resulting data pattern */
+
+diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
+index b61f12160d37..8c48c9d83d48 100644
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -648,6 +648,8 @@ static const struct usb_device_id id_table_combined[] = {
+ { USB_DEVICE(FTDI_VID, FTDI_ELV_TFD128_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_ELV_FM3RX_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_ELV_WS777_PID) },
++ { USB_DEVICE(FTDI_VID, FTDI_PALMSENS_PID) },
++ { USB_DEVICE(FTDI_VID, FTDI_IVIUM_XSTAT_PID) },
+ { USB_DEVICE(FTDI_VID, LINX_SDMUSBQSS_PID) },
+ { USB_DEVICE(FTDI_VID, LINX_MASTERDEVEL2_PID) },
+ { USB_DEVICE(FTDI_VID, LINX_FUTURE_0_PID) },
+@@ -1008,6 +1010,7 @@ static const struct usb_device_id id_table_combined[] = {
+ { USB_DEVICE(ICPDAS_VID, ICPDAS_I7560U_PID) },
+ { USB_DEVICE(ICPDAS_VID, ICPDAS_I7561U_PID) },
+ { USB_DEVICE(ICPDAS_VID, ICPDAS_I7563U_PID) },
++ { USB_DEVICE(WICED_VID, WICED_USB20706V2_PID) },
+ { } /* Terminating entry */
+ };
+
+diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
+index 334bc600282d..48db84f25cc9 100644
+--- a/drivers/usb/serial/ftdi_sio_ids.h
++++ b/drivers/usb/serial/ftdi_sio_ids.h
+@@ -406,6 +406,12 @@
+ #define FTDI_4N_GALAXY_DE_3_PID 0xF3C2
+
+ /*
++ * Ivium Technologies product IDs
++ */
++#define FTDI_PALMSENS_PID 0xf440
++#define FTDI_IVIUM_XSTAT_PID 0xf441
++
++/*
+ * Linx Technologies product ids
+ */
+ #define LINX_SDMUSBQSS_PID 0xF448 /* Linx SDM-USB-QS-S */
+@@ -673,6 +679,12 @@
+ #define INTREPID_NEOVI_PID 0x0701
+
+ /*
++ * WICED USB UART
++ */
++#define WICED_VID 0x0A5C
++#define WICED_USB20706V2_PID 0x6422
++
++/*
+ * Definitions for ID TECH (www.idt-net.com) devices
+ */
+ #define IDTECH_VID 0x0ACD /* ID TECH Vendor ID */
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index 2477bf19a3b4..023ed532e7b3 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -276,6 +276,12 @@ static void option_instat_callback(struct urb *urb);
+ #define TELIT_PRODUCT_LE920 0x1200
+ #define TELIT_PRODUCT_LE910 0x1201
+ #define TELIT_PRODUCT_LE910_USBCFG4 0x1206
++#define TELIT_PRODUCT_LE920A4_1207 0x1207
++#define TELIT_PRODUCT_LE920A4_1208 0x1208
++#define TELIT_PRODUCT_LE920A4_1211 0x1211
++#define TELIT_PRODUCT_LE920A4_1212 0x1212
++#define TELIT_PRODUCT_LE920A4_1213 0x1213
++#define TELIT_PRODUCT_LE920A4_1214 0x1214
+
+ /* ZTE PRODUCTS */
+ #define ZTE_VENDOR_ID 0x19d2
+@@ -637,6 +643,11 @@ static const struct option_blacklist_info sierra_mc73xx_blacklist = {
+ .reserved = BIT(8) | BIT(10) | BIT(11),
+ };
+
++static const struct option_blacklist_info telit_le920a4_blacklist_1 = {
++ .sendsetup = BIT(0),
++ .reserved = BIT(1),
++};
++
+ static const struct option_blacklist_info telit_le922_blacklist_usbcfg0 = {
+ .sendsetup = BIT(2),
+ .reserved = BIT(0) | BIT(1) | BIT(3),
+@@ -1215,6 +1226,16 @@ static const struct usb_device_id option_ids[] = {
+ .driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg3 },
+ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920),
+ .driver_info = (kernel_ulong_t)&telit_le920_blacklist },
++ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1207) },
++ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1208),
++ .driver_info = (kernel_ulong_t)&telit_le920a4_blacklist_1 },
++ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1211),
++ .driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg3 },
++ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1212),
++ .driver_info = (kernel_ulong_t)&telit_le920a4_blacklist_1 },
++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1213, 0xff) },
++ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1214),
++ .driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg3 },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MF622, 0xff, 0xff, 0xff) }, /* ZTE WCDMA products */
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0002, 0xff, 0xff, 0xff),
+ .driver_info = (kernel_ulong_t)&net_intf1_blacklist },
+@@ -1975,6 +1996,7 @@ static const struct usb_device_id option_ids[] = {
+ .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
+ { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) }, /* D-Link DWM-152/C1 */
+ { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e02, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/C1 */
++ { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x7e11, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/A3 */
+ { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x4000, 0xff) }, /* OLICARD300 - MT6225 */
+ { USB_DEVICE(INOVIA_VENDOR_ID, INOVIA_SEW858) },
+ { USB_DEVICE(VIATELECOM_VENDOR_ID, VIATELECOM_PRODUCT_CDS7) },
+diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c
+index 6fbfc8fc2f5d..d3bf8348e638 100644
+--- a/drivers/usb/serial/usb-serial.c
++++ b/drivers/usb/serial/usb-serial.c
+@@ -1416,7 +1416,7 @@ int usb_serial_register_drivers(struct usb_serial_driver *const serial_drivers[]
+
+ rc = usb_register(udriver);
+ if (rc)
+- return rc;
++ goto failed_usb_register;
+
+ for (sd = serial_drivers; *sd; ++sd) {
+ (*sd)->usb_driver = udriver;
+@@ -1434,6 +1434,8 @@ int usb_serial_register_drivers(struct usb_serial_driver *const serial_drivers[]
+ while (sd-- > serial_drivers)
+ usb_serial_deregister(*sd);
+ usb_deregister(udriver);
++failed_usb_register:
++ kfree(udriver);
+ return rc;
+ }
+ EXPORT_SYMBOL_GPL(usb_serial_register_drivers);
+diff --git a/drivers/xen/xenbus/xenbus_dev_frontend.c b/drivers/xen/xenbus/xenbus_dev_frontend.c
+index 531e76474983..0e0eb10f82a0 100644
+--- a/drivers/xen/xenbus/xenbus_dev_frontend.c
++++ b/drivers/xen/xenbus/xenbus_dev_frontend.c
+@@ -316,7 +316,7 @@ static int xenbus_write_transaction(unsigned msg_type,
+ rc = -ENOMEM;
+ goto out;
+ }
+- } else {
++ } else if (msg_type == XS_TRANSACTION_END) {
+ list_for_each_entry(trans, &u->transactions, list)
+ if (trans->handle.id == u->u.msg.tx_id)
+ break;
+diff --git a/fs/seq_file.c b/fs/seq_file.c
+index 3857b720cb1b..fbb1688bff87 100644
+--- a/fs/seq_file.c
++++ b/fs/seq_file.c
+@@ -219,8 +219,10 @@ ssize_t seq_read(struct file *file, char __user *buf, size_t size, loff_t *ppos)
+ size -= n;
+ buf += n;
+ copied += n;
+- if (!m->count)
++ if (!m->count) {
++ m->from = 0;
+ m->index++;
++ }
+ if (!size)
+ goto Done;
+ }
+diff --git a/fs/ubifs/tnc_commit.c b/fs/ubifs/tnc_commit.c
+index 7a205e046776..9bece329a12c 100644
+--- a/fs/ubifs/tnc_commit.c
++++ b/fs/ubifs/tnc_commit.c
+@@ -370,7 +370,7 @@ static int layout_in_gaps(struct ubifs_info *c, int cnt)
+
+ p = c->gap_lebs;
+ do {
+- ubifs_assert(p < c->gap_lebs + sizeof(int) * c->lst.idx_lebs);
++ ubifs_assert(p < c->gap_lebs + c->lst.idx_lebs);
+ written = layout_leb_in_gaps(c, p);
+ if (written < 0) {
+ err = written;
+diff --git a/include/linux/pci_ids.h b/include/linux/pci_ids.h
+index 1fa99a301817..1ce77d9b29ab 100644
+--- a/include/linux/pci_ids.h
++++ b/include/linux/pci_ids.h
+@@ -2478,6 +2478,13 @@
+ #define PCI_DEVICE_ID_KORENIX_JETCARDF2 0x1700
+ #define PCI_DEVICE_ID_KORENIX_JETCARDF3 0x17ff
+
++#define PCI_VENDOR_ID_NETRONOME 0x19ee
++#define PCI_DEVICE_ID_NETRONOME_NFP3200 0x3200
++#define PCI_DEVICE_ID_NETRONOME_NFP3240 0x3240
++#define PCI_DEVICE_ID_NETRONOME_NFP4000 0x4000
++#define PCI_DEVICE_ID_NETRONOME_NFP6000 0x6000
++#define PCI_DEVICE_ID_NETRONOME_NFP6000_VF 0x6003
++
+ #define PCI_VENDOR_ID_QMI 0x1a32
+
+ #define PCI_VENDOR_ID_AZWAVE 0x1a3b
+diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c
+index ed8f2cde34c5..4e10bb0b1704 100644
+--- a/kernel/events/uprobes.c
++++ b/kernel/events/uprobes.c
+@@ -179,8 +179,10 @@ static int __replace_page(struct vm_area_struct *vma, unsigned long addr,
+ mmu_notifier_invalidate_range_start(mm, mmun_start, mmun_end);
+ err = -EAGAIN;
+ ptep = page_check_address(page, mm, addr, &ptl, 0);
+- if (!ptep)
++ if (!ptep) {
++ mem_cgroup_cancel_charge(kpage, memcg);
+ goto unlock;
++ }
+
+ get_page(kpage);
+ page_add_new_anon_rmap(kpage, vma, addr);
+@@ -207,7 +209,6 @@ static int __replace_page(struct vm_area_struct *vma, unsigned long addr,
+
+ err = 0;
+ unlock:
+- mem_cgroup_cancel_charge(kpage, memcg);
+ mmu_notifier_invalidate_range_end(mm, mmun_start, mmun_end);
+ unlock_page(page);
+ return err;
+diff --git a/kernel/time/timekeeping_debug.c b/kernel/time/timekeeping_debug.c
+index f6bd65236712..107310a6f36f 100644
+--- a/kernel/time/timekeeping_debug.c
++++ b/kernel/time/timekeeping_debug.c
+@@ -23,7 +23,9 @@
+
+ #include "timekeeping_internal.h"
+
+-static unsigned int sleep_time_bin[32] = {0};
++#define NUM_BINS 32
++
++static unsigned int sleep_time_bin[NUM_BINS] = {0};
+
+ static int tk_debug_show_sleep_time(struct seq_file *s, void *data)
+ {
+@@ -69,6 +71,9 @@ late_initcall(tk_debug_sleep_time_init);
+
+ void tk_debug_account_sleep_time(struct timespec64 *t)
+ {
+- sleep_time_bin[fls(t->tv_sec)]++;
++ /* Cap bin index so we don't overflow the array */
++ int bin = min(fls(t->tv_sec), NUM_BINS-1);
++
++ sleep_time_bin[bin]++;
+ }
+
+diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
+index 0c96055b2382..067baa738001 100644
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -88,7 +88,7 @@ int sysctl_tcp_adv_win_scale __read_mostly = 1;
+ EXPORT_SYMBOL(sysctl_tcp_adv_win_scale);
+
+ /* rfc5961 challenge ack rate limiting */
+-int sysctl_tcp_challenge_ack_limit = 100;
++int sysctl_tcp_challenge_ack_limit = 1000;
+
+ int sysctl_tcp_stdurg __read_mostly;
+ int sysctl_tcp_rfc1337 __read_mostly;
+@@ -3324,13 +3324,18 @@ static void tcp_send_challenge_ack(struct sock *sk)
+ /* unprotected vars, we dont care of overwrites */
+ static u32 challenge_timestamp;
+ static unsigned int challenge_count;
+- u32 now = jiffies / HZ;
++ u32 count, now = jiffies / HZ;
+
+ if (now != challenge_timestamp) {
++ u32 half = (sysctl_tcp_challenge_ack_limit + 1) >> 1;
++
+ challenge_timestamp = now;
+- challenge_count = 0;
++ WRITE_ONCE(challenge_count, half +
++ prandom_u32_max(sysctl_tcp_challenge_ack_limit));
+ }
+- if (++challenge_count <= sysctl_tcp_challenge_ack_limit) {
++ count = READ_ONCE(challenge_count);
++ if (count > 0) {
++ WRITE_ONCE(challenge_count, count - 1);
+ NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPCHALLENGEACK);
+ tcp_send_ack(sk);
+ }
+diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
+index 343da1e35025..095e3958d83c 100644
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -865,7 +865,7 @@ static int ieee80211_stop_ap(struct wiphy *wiphy, struct net_device *dev)
+
+ /* free all potentially still buffered bcast frames */
+ local->total_ps_buffered -= skb_queue_len(&sdata->u.ap.ps.bc_buf);
+- skb_queue_purge(&sdata->u.ap.ps.bc_buf);
++ ieee80211_purge_tx_queue(&local->hw, &sdata->u.ap.ps.bc_buf);
+
+ mutex_lock(&local->mtx);
+ ieee80211_vif_copy_chanctx_to_vlans(sdata, true);
+diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
+index 45e782825567..655abb9aa597 100644
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -353,7 +353,7 @@ static void purge_old_ps_buffers(struct ieee80211_local *local)
+ skb = skb_dequeue(&ps->bc_buf);
+ if (skb) {
+ purged++;
+- dev_kfree_skb(skb);
++ ieee80211_free_txskb(&local->hw, skb);
+ }
+ total += skb_queue_len(&ps->bc_buf);
+ }
+@@ -436,7 +436,7 @@ ieee80211_tx_h_multicast_ps_buf(struct ieee80211_tx_data *tx)
+ if (skb_queue_len(&ps->bc_buf) >= AP_MAX_BC_BUFFER) {
+ ps_dbg(tx->sdata,
+ "BC TX buffer full - dropping the oldest frame\n");
+- dev_kfree_skb(skb_dequeue(&ps->bc_buf));
++ ieee80211_free_txskb(&tx->local->hw, skb_dequeue(&ps->bc_buf));
+ } else
+ tx->local->total_ps_buffered++;
+
+@@ -2999,7 +2999,7 @@ ieee80211_get_buffered_bc(struct ieee80211_hw *hw,
+ sdata = IEEE80211_DEV_TO_SUB_IF(skb->dev);
+ if (!ieee80211_tx_prepare(sdata, &tx, skb))
+ break;
+- dev_kfree_skb_any(skb);
++ ieee80211_free_txskb(hw, skb);
+ }
+
+ info = IEEE80211_SKB_CB(skb);
diff --git a/1041_linux-3.18.42.patch b/1041_linux-3.18.42.patch
new file mode 100644
index 0000000..669a531
--- /dev/null
+++ b/1041_linux-3.18.42.patch
@@ -0,0 +1,611 @@
+diff --git a/Makefile b/Makefile
+index e31123a1d511..dafc1eade47e 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 18
+-SUBLEVEL = 41
++SUBLEVEL = 42
+ EXTRAVERSION =
+ NAME = Diseased Newt
+
+diff --git a/arch/arc/include/asm/pgtable.h b/arch/arc/include/asm/pgtable.h
+index b556b4ef9775..7670f33b9ce2 100644
+--- a/arch/arc/include/asm/pgtable.h
++++ b/arch/arc/include/asm/pgtable.h
+@@ -98,7 +98,7 @@
+ #define ___DEF (_PAGE_PRESENT | _PAGE_DEF_CACHEABLE)
+
+ /* Set of bits not changed in pte_modify */
+-#define _PAGE_CHG_MASK (PAGE_MASK | _PAGE_ACCESSED | _PAGE_MODIFIED | _PAGE_SPECIAL)
++#define _PAGE_CHG_MASK (PAGE_MASK | _PAGE_ACCESSED | _PAGE_MODIFIED)
+
+ /* More Abbrevaited helpers */
+ #define PAGE_U_NONE __pgprot(___DEF)
+diff --git a/arch/arm/kernel/sys_oabi-compat.c b/arch/arm/kernel/sys_oabi-compat.c
+index e90a3148f385..eb821e7b80f9 100644
+--- a/arch/arm/kernel/sys_oabi-compat.c
++++ b/arch/arm/kernel/sys_oabi-compat.c
+@@ -193,15 +193,44 @@ struct oabi_flock64 {
+ pid_t l_pid;
+ } __attribute__ ((packed,aligned(4)));
+
+-asmlinkage long sys_oabi_fcntl64(unsigned int fd, unsigned int cmd,
++static long do_locks(unsigned int fd, unsigned int cmd,
+ unsigned long arg)
+ {
+- struct oabi_flock64 user;
+ struct flock64 kernel;
+- mm_segment_t fs = USER_DS; /* initialized to kill a warning */
+- unsigned long local_arg = arg;
+- int ret;
++ struct oabi_flock64 user;
++ mm_segment_t fs;
++ long ret;
++
++ if (copy_from_user(&user, (struct oabi_flock64 __user *)arg,
++ sizeof(user)))
++ return -EFAULT;
++ kernel.l_type = user.l_type;
++ kernel.l_whence = user.l_whence;
++ kernel.l_start = user.l_start;
++ kernel.l_len = user.l_len;
++ kernel.l_pid = user.l_pid;
++
++ fs = get_fs();
++ set_fs(KERNEL_DS);
++ ret = sys_fcntl64(fd, cmd, (unsigned long)&kernel);
++ set_fs(fs);
++
++ if (!ret && (cmd == F_GETLK64 || cmd == F_OFD_GETLK)) {
++ user.l_type = kernel.l_type;
++ user.l_whence = kernel.l_whence;
++ user.l_start = kernel.l_start;
++ user.l_len = kernel.l_len;
++ user.l_pid = kernel.l_pid;
++ if (copy_to_user((struct oabi_flock64 __user *)arg,
++ &user, sizeof(user)))
++ ret = -EFAULT;
++ }
++ return ret;
++}
+
++asmlinkage long sys_oabi_fcntl64(unsigned int fd, unsigned int cmd,
++ unsigned long arg)
++{
+ switch (cmd) {
+ case F_OFD_GETLK:
+ case F_OFD_SETLK:
+@@ -209,39 +238,11 @@ asmlinkage long sys_oabi_fcntl64(unsigned int fd, unsigned int cmd,
+ case F_GETLK64:
+ case F_SETLK64:
+ case F_SETLKW64:
+- if (copy_from_user(&user, (struct oabi_flock64 __user *)arg,
+- sizeof(user)))
+- return -EFAULT;
+- kernel.l_type = user.l_type;
+- kernel.l_whence = user.l_whence;
+- kernel.l_start = user.l_start;
+- kernel.l_len = user.l_len;
+- kernel.l_pid = user.l_pid;
+- local_arg = (unsigned long)&kernel;
+- fs = get_fs();
+- set_fs(KERNEL_DS);
+- }
+-
+- ret = sys_fcntl64(fd, cmd, local_arg);
++ return do_locks(fd, cmd, arg);
+
+- switch (cmd) {
+- case F_GETLK64:
+- if (!ret) {
+- user.l_type = kernel.l_type;
+- user.l_whence = kernel.l_whence;
+- user.l_start = kernel.l_start;
+- user.l_len = kernel.l_len;
+- user.l_pid = kernel.l_pid;
+- if (copy_to_user((struct oabi_flock64 __user *)arg,
+- &user, sizeof(user)))
+- ret = -EFAULT;
+- }
+- case F_SETLK64:
+- case F_SETLKW64:
+- set_fs(fs);
++ default:
++ return sys_fcntl64(fd, cmd, arg);
+ }
+-
+- return ret;
+ }
+
+ struct oabi_epoll_event {
+diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c
+index 813d29d00a17..a86afc3741dc 100644
+--- a/arch/x86/kernel/cpu/amd.c
++++ b/arch/x86/kernel/cpu/amd.c
+@@ -603,6 +603,17 @@ static void init_amd_gh(struct cpuinfo_x86 *c)
+ set_cpu_bug(c, X86_BUG_AMD_TLB_MMATCH);
+ }
+
++#define MSR_AMD64_DE_CFG 0xC0011029
++
++static void init_amd_ln(struct cpuinfo_x86 *c)
++{
++ /*
++ * Apply erratum 665 fix unconditionally so machines without a BIOS
++ * fix work.
++ */
++ msr_set_bit(MSR_AMD64_DE_CFG, 31);
++}
++
+ static void init_amd_bd(struct cpuinfo_x86 *c)
+ {
+ u64 value;
+@@ -672,6 +683,7 @@ static void init_amd(struct cpuinfo_x86 *c)
+ case 6: init_amd_k7(c); break;
+ case 0xf: init_amd_k8(c); break;
+ case 0x10: init_amd_gh(c); break;
++ case 0x12: init_amd_ln(c); break;
+ case 0x15: init_amd_bd(c); break;
+ }
+
+diff --git a/arch/x86/kernel/paravirt.c b/arch/x86/kernel/paravirt.c
+index 8d12f0546dfc..8819ec730be4 100644
+--- a/arch/x86/kernel/paravirt.c
++++ b/arch/x86/kernel/paravirt.c
+@@ -55,12 +55,12 @@ asm (".pushsection .entry.text, \"ax\"\n"
+ ".popsection");
+
+ /* identity function, which can be inlined */
+-u32 _paravirt_ident_32(u32 x)
++u32 notrace _paravirt_ident_32(u32 x)
+ {
+ return x;
+ }
+
+-u64 _paravirt_ident_64(u64 x)
++u64 notrace _paravirt_ident_64(u64 x)
+ {
+ return x;
+ }
+diff --git a/drivers/iio/accel/kxsd9.c b/drivers/iio/accel/kxsd9.c
+index 98ba761cbb9c..6dfce7e722cb 100644
+--- a/drivers/iio/accel/kxsd9.c
++++ b/drivers/iio/accel/kxsd9.c
+@@ -160,6 +160,7 @@ static int kxsd9_read_raw(struct iio_dev *indio_dev,
+ if (ret < 0)
+ goto error_ret;
+ *val = ret;
++ ret = IIO_VAL_INT;
+ break;
+ case IIO_CHAN_INFO_SCALE:
+ ret = spi_w8r8(st->us, KXSD9_READ(KXSD9_REG_CTRL_C));
+diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c
+index 08981be7baa1..b1c2bef46f8d 100644
+--- a/drivers/md/dm-crypt.c
++++ b/drivers/md/dm-crypt.c
+@@ -1401,7 +1401,7 @@ static int crypt_alloc_tfms(struct crypt_config *cc, char *ciphermode)
+ unsigned i;
+ int err;
+
+- cc->tfms = kmalloc(cc->tfms_count * sizeof(struct crypto_ablkcipher *),
++ cc->tfms = kzalloc(cc->tfms_count * sizeof(struct crypto_ablkcipher *),
+ GFP_KERNEL);
+ if (!cc->tfms)
+ return -ENOMEM;
+@@ -1842,6 +1842,13 @@ static int crypt_map(struct dm_target *ti, struct bio *bio)
+ return DM_MAPIO_REMAPPED;
+ }
+
++ /*
++ * Check if bio is too large, split as needed.
++ */
++ if (unlikely(bio->bi_iter.bi_size > (BIO_MAX_PAGES << PAGE_SHIFT)) &&
++ bio_data_dir(bio) == WRITE)
++ dm_accept_partial_bio(bio, ((BIO_MAX_PAGES << PAGE_SHIFT) >> SECTOR_SHIFT));
++
+ io = dm_per_bio_data(bio, cc->per_bio_data_size);
+ crypt_io_init(io, cc, bio, dm_target_offset(ti, bio->bi_iter.bi_sector));
+ io->ctx.req = (struct ablkcipher_request *)(io + 1);
+diff --git a/drivers/staging/comedi/drivers/daqboard2000.c b/drivers/staging/comedi/drivers/daqboard2000.c
+index e5b5a8133b34..55cfc34bd187 100644
+--- a/drivers/staging/comedi/drivers/daqboard2000.c
++++ b/drivers/staging/comedi/drivers/daqboard2000.c
+@@ -637,7 +637,7 @@ static const void *daqboard2000_find_boardinfo(struct comedi_device *dev,
+ const struct daq200_boardtype *board;
+ int i;
+
+- if (pcidev->subsystem_device != PCI_VENDOR_ID_IOTECH)
++ if (pcidev->subsystem_vendor != PCI_VENDOR_ID_IOTECH)
+ return NULL;
+
+ for (i = 0; i < ARRAY_SIZE(boardtypes); i++) {
+diff --git a/drivers/staging/comedi/drivers/ni_mio_common.c b/drivers/staging/comedi/drivers/ni_mio_common.c
+index b7588e4e3644..8400f2fa76bd 100644
+--- a/drivers/staging/comedi/drivers/ni_mio_common.c
++++ b/drivers/staging/comedi/drivers/ni_mio_common.c
+@@ -3015,7 +3015,15 @@ static int ni_ao_inttrig(struct comedi_device *dev,
+ int i;
+ static const int timeout = 1000;
+
+- if (trig_num != cmd->start_arg)
++ /*
++ * Require trig_num == cmd->start_arg when cmd->start_src == TRIG_INT.
++ * For backwards compatibility, also allow trig_num == 0 when
++ * cmd->start_src != TRIG_INT (i.e. when cmd->start_src == TRIG_EXT);
++ * in that case, the internal trigger is being used as a pre-trigger
++ * before the external trigger.
++ */
++ if (!(trig_num == cmd->start_arg ||
++ (trig_num == 0 && cmd->start_src != TRIG_INT)))
+ return -EINVAL;
+
+ /* Null trig at beginning prevent ao start trigger from executing more than
+@@ -5674,7 +5682,7 @@ static int ni_E_init(struct comedi_device *dev,
+ s->maxdata = (devpriv->is_m_series) ? 0xffffffff
+ : 0x00ffffff;
+ s->insn_read = ni_tio_insn_read;
+- s->insn_write = ni_tio_insn_read;
++ s->insn_write = ni_tio_insn_write;
+ s->insn_config = ni_tio_insn_config;
+ #ifdef PCIDMA
+ if (dev->irq && devpriv->mite) {
+diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
+index a85eadff6bea..ea8ec9ceab68 100644
+--- a/drivers/usb/core/devio.c
++++ b/drivers/usb/core/devio.c
+@@ -1526,11 +1526,17 @@ static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb
+ as->urb->start_frame = uurb->start_frame;
+ as->urb->number_of_packets = number_of_packets;
+ as->urb->stream_id = stream_id;
+- if (uurb->type == USBDEVFS_URB_TYPE_ISO ||
+- ps->dev->speed == USB_SPEED_HIGH)
+- as->urb->interval = 1 << min(15, ep->desc.bInterval - 1);
+- else
+- as->urb->interval = ep->desc.bInterval;
++
++ if (ep->desc.bInterval) {
++ if (uurb->type == USBDEVFS_URB_TYPE_ISO ||
++ ps->dev->speed == USB_SPEED_HIGH ||
++ ps->dev->speed >= USB_SPEED_SUPER)
++ as->urb->interval = 1 <<
++ min(15, ep->desc.bInterval - 1);
++ else
++ as->urb->interval = ep->desc.bInterval;
++ }
++
+ as->urb->context = as;
+ as->urb->complete = async_completed;
+ for (totlen = u = 0; u < number_of_packets; u++) {
+diff --git a/drivers/usb/serial/mos7720.c b/drivers/usb/serial/mos7720.c
+index dfd728a263d2..c3b8ae360424 100644
+--- a/drivers/usb/serial/mos7720.c
++++ b/drivers/usb/serial/mos7720.c
+@@ -1239,7 +1239,7 @@ static int mos7720_write(struct tty_struct *tty, struct usb_serial_port *port,
+
+ if (urb->transfer_buffer == NULL) {
+ urb->transfer_buffer = kmalloc(URB_TRANSFER_BUFFER_SIZE,
+- GFP_KERNEL);
++ GFP_ATOMIC);
+ if (!urb->transfer_buffer)
+ goto exit;
+ }
+diff --git a/drivers/usb/serial/mos7840.c b/drivers/usb/serial/mos7840.c
+index 3d88eefdf1d1..0b547d9e2aeb 100644
+--- a/drivers/usb/serial/mos7840.c
++++ b/drivers/usb/serial/mos7840.c
+@@ -1369,8 +1369,8 @@ static int mos7840_write(struct tty_struct *tty, struct usb_serial_port *port,
+ }
+
+ if (urb->transfer_buffer == NULL) {
+- urb->transfer_buffer =
+- kmalloc(URB_TRANSFER_BUFFER_SIZE, GFP_KERNEL);
++ urb->transfer_buffer = kmalloc(URB_TRANSFER_BUFFER_SIZE,
++ GFP_ATOMIC);
+ if (!urb->transfer_buffer)
+ goto exit;
+ }
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index 023ed532e7b3..3814b7bd7d9f 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -534,6 +534,13 @@ enum option_blacklist_reason {
+ };
+
+ #define MAX_BL_NUM 11
++
++/* WeTelecom products */
++#define WETELECOM_VENDOR_ID 0x22de
++#define WETELECOM_PRODUCT_WMD200 0x6801
++#define WETELECOM_PRODUCT_6802 0x6802
++#define WETELECOM_PRODUCT_WMD300 0x6803
++
+ struct option_blacklist_info {
+ /* bitfield of interface numbers for OPTION_BLACKLIST_SENDSETUP */
+ const unsigned long sendsetup;
+@@ -2000,6 +2007,9 @@ static const struct usb_device_id option_ids[] = {
+ { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x4000, 0xff) }, /* OLICARD300 - MT6225 */
+ { USB_DEVICE(INOVIA_VENDOR_ID, INOVIA_SEW858) },
+ { USB_DEVICE(VIATELECOM_VENDOR_ID, VIATELECOM_PRODUCT_CDS7) },
++ { USB_DEVICE_AND_INTERFACE_INFO(WETELECOM_VENDOR_ID, WETELECOM_PRODUCT_WMD200, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(WETELECOM_VENDOR_ID, WETELECOM_PRODUCT_6802, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(WETELECOM_VENDOR_ID, WETELECOM_PRODUCT_WMD300, 0xff, 0xff, 0xff) },
+ { } /* Terminating entry */
+ };
+ MODULE_DEVICE_TABLE(usb, option_ids);
+diff --git a/fs/ext4/super.c b/fs/ext4/super.c
+index 02711ffbb398..60964b7d7ffe 100644
+--- a/fs/ext4/super.c
++++ b/fs/ext4/super.c
+@@ -2057,6 +2057,7 @@ void ext4_group_desc_csum_set(struct super_block *sb, __u32 block_group,
+
+ /* Called at mount-time, super-block is locked */
+ static int ext4_check_descriptors(struct super_block *sb,
++ ext4_fsblk_t sb_block,
+ ext4_group_t *first_not_zeroed)
+ {
+ struct ext4_sb_info *sbi = EXT4_SB(sb);
+@@ -2087,6 +2088,11 @@ static int ext4_check_descriptors(struct super_block *sb,
+ grp = i;
+
+ block_bitmap = ext4_block_bitmap(sb, gdp);
++ if (block_bitmap == sb_block) {
++ ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: "
++ "Block bitmap for group %u overlaps "
++ "superblock", i);
++ }
+ if (block_bitmap < first_block || block_bitmap > last_block) {
+ ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: "
+ "Block bitmap for group %u not in group "
+@@ -2094,6 +2100,11 @@ static int ext4_check_descriptors(struct super_block *sb,
+ return 0;
+ }
+ inode_bitmap = ext4_inode_bitmap(sb, gdp);
++ if (inode_bitmap == sb_block) {
++ ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: "
++ "Inode bitmap for group %u overlaps "
++ "superblock", i);
++ }
+ if (inode_bitmap < first_block || inode_bitmap > last_block) {
+ ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: "
+ "Inode bitmap for group %u not in group "
+@@ -2101,6 +2112,11 @@ static int ext4_check_descriptors(struct super_block *sb,
+ return 0;
+ }
+ inode_table = ext4_inode_table(sb, gdp);
++ if (inode_table == sb_block) {
++ ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: "
++ "Inode table for group %u overlaps "
++ "superblock", i);
++ }
+ if (inode_table < first_block ||
+ inode_table + sbi->s_itb_per_group - 1 > last_block) {
+ ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: "
+@@ -3926,7 +3942,7 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
+ goto failed_mount2;
+ }
+ }
+- if (!ext4_check_descriptors(sb, &first_not_zeroed)) {
++ if (!ext4_check_descriptors(sb, logical_sb_block, &first_not_zeroed)) {
+ ext4_msg(sb, KERN_ERR, "group descriptors corrupted!");
+ goto failed_mount2;
+ }
+diff --git a/fs/kernfs/file.c b/fs/kernfs/file.c
+index 4429d6d9217f..efb1f7b5883e 100644
+--- a/fs/kernfs/file.c
++++ b/fs/kernfs/file.c
+@@ -828,21 +828,35 @@ repeat:
+ mutex_lock(&kernfs_mutex);
+
+ list_for_each_entry(info, &kernfs_root(kn)->supers, node) {
++ struct kernfs_node *parent;
+ struct inode *inode;
+- struct dentry *dentry;
+
++ /*
++ * We want fsnotify_modify() on @kn but as the
++ * modifications aren't originating from userland don't
++ * have the matching @file available. Look up the inodes
++ * and generate the events manually.
++ */
+ inode = ilookup(info->sb, kn->ino);
+ if (!inode)
+ continue;
+
+- dentry = d_find_any_alias(inode);
+- if (dentry) {
+- fsnotify_parent(NULL, dentry, FS_MODIFY);
+- fsnotify(inode, FS_MODIFY, inode, FSNOTIFY_EVENT_INODE,
+- NULL, 0);
+- dput(dentry);
++ parent = kernfs_get_parent(kn);
++ if (parent) {
++ struct inode *p_inode;
++
++ p_inode = ilookup(info->sb, parent->ino);
++ if (p_inode) {
++ fsnotify(p_inode, FS_MODIFY | FS_EVENT_ON_CHILD,
++ inode, FSNOTIFY_EVENT_INODE, kn->name, 0);
++ iput(p_inode);
++ }
++
++ kernfs_put(parent);
+ }
+
++ fsnotify(inode, FS_MODIFY, inode, FSNOTIFY_EVENT_INODE,
++ kn->name, 0);
+ iput(inode);
+ }
+
+diff --git a/fs/nfs/callback.c b/fs/nfs/callback.c
+index 351be9205bf8..3b8cdb8298c4 100644
+--- a/fs/nfs/callback.c
++++ b/fs/nfs/callback.c
+@@ -303,6 +303,7 @@ static int nfs_callback_up_net(int minorversion, struct svc_serv *serv, struct n
+ err_socks:
+ svc_rpcb_cleanup(serv, net);
+ err_bind:
++ nn->cb_users[minorversion]--;
+ dprintk("NFS: Couldn't create callback socket: err = %d; "
+ "net = %p\n", ret, net);
+ return ret;
+diff --git a/fs/overlayfs/copy_up.c b/fs/overlayfs/copy_up.c
+index 54d62bd95e92..4cb1c10c7706 100644
+--- a/fs/overlayfs/copy_up.c
++++ b/fs/overlayfs/copy_up.c
+@@ -48,6 +48,8 @@ int ovl_copy_xattr(struct dentry *old, struct dentry *new)
+ }
+
+ for (name = buf; name < (buf + list_size); name += strlen(name) + 1) {
++ if (ovl_is_private_xattr(name))
++ continue;
+ retry:
+ size = vfs_getxattr(old, name, value, value_size);
+ if (size == -ERANGE)
+diff --git a/fs/overlayfs/inode.c b/fs/overlayfs/inode.c
+index fefce48e0f31..6d52041d13cf 100644
+--- a/fs/overlayfs/inode.c
++++ b/fs/overlayfs/inode.c
+@@ -208,8 +208,7 @@ static int ovl_readlink(struct dentry *dentry, char __user *buf, int bufsiz)
+ return realinode->i_op->readlink(realpath.dentry, buf, bufsiz);
+ }
+
+-
+-static bool ovl_is_private_xattr(const char *name)
++bool ovl_is_private_xattr(const char *name)
+ {
+ return strncmp(name, "trusted.overlay.", 14) == 0;
+ }
+@@ -264,7 +263,8 @@ ssize_t ovl_listxattr(struct dentry *dentry, char *list, size_t size)
+ struct path realpath;
+ enum ovl_path_type type = ovl_path_real(dentry, &realpath);
+ ssize_t res;
+- int off;
++ size_t len;
++ char *s;
+
+ res = vfs_listxattr(realpath.dentry, list, size);
+ if (res <= 0 || size == 0)
+@@ -274,17 +274,19 @@ ssize_t ovl_listxattr(struct dentry *dentry, char *list, size_t size)
+ return res;
+
+ /* filter out private xattrs */
+- for (off = 0; off < res;) {
+- char *s = list + off;
+- size_t slen = strlen(s) + 1;
++ for (s = list, len = res; len;) {
++ size_t slen = strnlen(s, len) + 1;
+
+- BUG_ON(off + slen > res);
++ /* underlying fs providing us with an broken xattr list? */
++ if (WARN_ON(slen > len))
++ return -EIO;
+
++ len -= slen;
+ if (ovl_is_private_xattr(s)) {
+ res -= slen;
+- memmove(s, s + slen, res - off);
++ memmove(s, s + slen, len);
+ } else {
+- off += slen;
++ s += slen;
+ }
+ }
+
+diff --git a/fs/overlayfs/overlayfs.h b/fs/overlayfs/overlayfs.h
+index 00eb848faad8..f13557f411ae 100644
+--- a/fs/overlayfs/overlayfs.h
++++ b/fs/overlayfs/overlayfs.h
+@@ -166,6 +166,7 @@ ssize_t ovl_getxattr(struct dentry *dentry, const char *name,
+ ssize_t ovl_listxattr(struct dentry *dentry, char *list, size_t size);
+ int ovl_removexattr(struct dentry *dentry, const char *name);
+ struct inode *ovl_d_select_inode(struct dentry *dentry, unsigned file_flags);
++bool ovl_is_private_xattr(const char *name);
+
+ struct inode *ovl_new_inode(struct super_block *sb, umode_t mode,
+ struct ovl_entry *oe);
+diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c
+index b2361a1b50f2..963dba388243 100644
+--- a/fs/overlayfs/super.c
++++ b/fs/overlayfs/super.c
+@@ -545,6 +545,10 @@ retry:
+ struct kstat stat = {
+ .mode = S_IFDIR | 0,
+ };
++ struct iattr attr = {
++ .ia_valid = ATTR_MODE,
++ .ia_mode = stat.mode,
++ };
+
+ if (work->d_inode) {
+ err = -EEXIST;
+@@ -560,6 +564,21 @@ retry:
+ err = ovl_create_real(dir, work, &stat, NULL, NULL, true);
+ if (err)
+ goto out_dput;
++
++ err = vfs_removexattr(work, XATTR_NAME_POSIX_ACL_DEFAULT);
++ if (err && err != -ENODATA)
++ goto out_dput;
++
++ err = vfs_removexattr(work, XATTR_NAME_POSIX_ACL_ACCESS);
++ if (err && err != -ENODATA)
++ goto out_dput;
++
++ /* Clear any inherited mode bits */
++ mutex_lock(&work->d_inode->i_mutex);
++ err = notify_change(work, &attr, NULL);
++ mutex_unlock(&work->d_inode->i_mutex);
++ if (err)
++ goto out_dput;
+ }
+ out_unlock:
+ mutex_unlock(&dir->i_mutex);
+diff --git a/fs/xfs/libxfs/xfs_sb.c b/fs/xfs/libxfs/xfs_sb.c
+index acfcdc625aca..0c95d77bd8e1 100644
+--- a/fs/xfs/libxfs/xfs_sb.c
++++ b/fs/xfs/libxfs/xfs_sb.c
+@@ -606,7 +606,8 @@ xfs_sb_verify(
+ * Only check the in progress field for the primary superblock as
+ * mkfs.xfs doesn't clear it from secondary superblocks.
+ */
+- return xfs_mount_validate_sb(mp, &sb, bp->b_bn == XFS_SB_DADDR,
++ return xfs_mount_validate_sb(mp, &sb,
++ bp->b_maps[0].bm_bn == XFS_SB_DADDR,
+ check_version);
+ }
+
+diff --git a/kernel/cpuset.c b/kernel/cpuset.c
+index 71b52dd957de..56dc7c1b6300 100644
+--- a/kernel/cpuset.c
++++ b/kernel/cpuset.c
+@@ -2045,6 +2045,20 @@ static void cpuset_bind(struct cgroup_subsys_state *root_css)
+ mutex_unlock(&cpuset_mutex);
+ }
+
++/*
++ * Make sure the new task conform to the current state of its parent,
++ * which could have been changed by cpuset just after it inherits the
++ * state from the parent and before it sits on the cgroup's task list.
++ */
++void cpuset_fork(struct task_struct *task)
++{
++ if (task_css_is_root(task, cpuset_cgrp_id))
++ return;
++
++ set_cpus_allowed_ptr(task, ¤t->cpus_allowed);
++ task->mems_allowed = current->mems_allowed;
++}
++
+ struct cgroup_subsys cpuset_cgrp_subsys = {
+ .css_alloc = cpuset_css_alloc,
+ .css_online = cpuset_css_online,
+@@ -2054,6 +2068,7 @@ struct cgroup_subsys cpuset_cgrp_subsys = {
+ .cancel_attach = cpuset_cancel_attach,
+ .attach = cpuset_attach,
+ .bind = cpuset_bind,
++ .fork = cpuset_fork,
+ .legacy_cftypes = files,
+ .early_init = 1,
+ };
^ permalink raw reply related [flat|nested] 67+ messages in thread
* [gentoo-commits] proj/linux-patches:3.18 commit in: /
@ 2016-10-12 19:51 Mike Pagano
0 siblings, 0 replies; 67+ messages in thread
From: Mike Pagano @ 2016-10-12 19:51 UTC (permalink / raw
To: gentoo-commits
commit: e847c6fdd3e89d7a472571c54c47bbf87ef0cd0c
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed Oct 12 19:51:03 2016 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed Oct 12 19:51:03 2016 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=e847c6fd
Linux patch 3.18.43
0000_README | 4 +
1042_linux-3.18.43.patch | 3150 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 3154 insertions(+)
diff --git a/0000_README b/0000_README
index 7228605..cc667fc 100644
--- a/0000_README
+++ b/0000_README
@@ -211,6 +211,10 @@ Patch: 1041_linux-3.18.42.patch
From: http://www.kernel.org
Desc: Linux 3.18.42
+Patch: 1042_linux-3.18.43.patch
+From: http://www.kernel.org
+Desc: Linux 3.18.43
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1042_linux-3.18.43.patch b/1042_linux-3.18.43.patch
new file mode 100644
index 0000000..8356192
--- /dev/null
+++ b/1042_linux-3.18.43.patch
@@ -0,0 +1,3150 @@
+diff --git a/Makefile b/Makefile
+index dafc1eade47e..28912c341bd8 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 18
+-SUBLEVEL = 42
++SUBLEVEL = 43
+ EXTRAVERSION =
+ NAME = Diseased Newt
+
+diff --git a/arch/arc/include/asm/uaccess.h b/arch/arc/include/asm/uaccess.h
+index 30c9baffa96f..08770c750696 100644
+--- a/arch/arc/include/asm/uaccess.h
++++ b/arch/arc/include/asm/uaccess.h
+@@ -83,7 +83,10 @@
+ "2: ;nop\n" \
+ " .section .fixup, \"ax\"\n" \
+ " .align 4\n" \
+- "3: mov %0, %3\n" \
++ "3: # return -EFAULT\n" \
++ " mov %0, %3\n" \
++ " # zero out dst ptr\n" \
++ " mov %1, 0\n" \
+ " j 2b\n" \
+ " .previous\n" \
+ " .section __ex_table, \"a\"\n" \
+@@ -101,7 +104,11 @@
+ "2: ;nop\n" \
+ " .section .fixup, \"ax\"\n" \
+ " .align 4\n" \
+- "3: mov %0, %3\n" \
++ "3: # return -EFAULT\n" \
++ " mov %0, %3\n" \
++ " # zero out dst ptr\n" \
++ " mov %1, 0\n" \
++ " mov %R1, 0\n" \
+ " j 2b\n" \
+ " .previous\n" \
+ " .section __ex_table, \"a\"\n" \
+diff --git a/arch/arm/boot/dts/kirkwood-ib62x0.dts b/arch/arm/boot/dts/kirkwood-ib62x0.dts
+index bfa5edde179c..2c1e7f09205f 100644
+--- a/arch/arm/boot/dts/kirkwood-ib62x0.dts
++++ b/arch/arm/boot/dts/kirkwood-ib62x0.dts
+@@ -113,7 +113,7 @@
+
+ partition@e0000 {
+ label = "u-boot environment";
+- reg = <0xe0000 0x100000>;
++ reg = <0xe0000 0x20000>;
+ };
+
+ partition@100000 {
+diff --git a/arch/arm/kvm/arm.c b/arch/arm/kvm/arm.c
+index e8193b987313..6c3dc428a881 100644
+--- a/arch/arm/kvm/arm.c
++++ b/arch/arm/kvm/arm.c
+@@ -153,8 +153,6 @@ void kvm_arch_destroy_vm(struct kvm *kvm)
+ {
+ int i;
+
+- kvm_free_stage2_pgd(kvm);
+-
+ for (i = 0; i < KVM_MAX_VCPUS; ++i) {
+ if (kvm->vcpus[i]) {
+ kvm_arch_vcpu_free(kvm->vcpus[i]);
+diff --git a/arch/arm/kvm/mmu.c b/arch/arm/kvm/mmu.c
+index 0310b03697e0..feda3ff185e9 100644
+--- a/arch/arm/kvm/mmu.c
++++ b/arch/arm/kvm/mmu.c
+@@ -1493,6 +1493,7 @@ void kvm_arch_memslots_updated(struct kvm *kvm)
+
+ void kvm_arch_flush_shadow_all(struct kvm *kvm)
+ {
++ kvm_free_stage2_pgd(kvm);
+ }
+
+ void kvm_arch_flush_shadow_memslot(struct kvm *kvm,
+diff --git a/arch/arm/mach-imx/pm-imx6.c b/arch/arm/mach-imx/pm-imx6.c
+index 5c3af8f993d0..bdd1d9061759 100644
+--- a/arch/arm/mach-imx/pm-imx6.c
++++ b/arch/arm/mach-imx/pm-imx6.c
+@@ -293,7 +293,7 @@ int imx6q_set_lpm(enum mxc_cpu_pwr_mode mode)
+ val |= 0x3 << BP_CLPCR_STBY_COUNT;
+ val |= BM_CLPCR_VSTBY;
+ val |= BM_CLPCR_SBYOS;
+- if (cpu_is_imx6sl())
++ if (cpu_is_imx6sl() || cpu_is_imx6sx())
+ val |= BM_CLPCR_BYPASS_PMIC_READY;
+ if (cpu_is_imx6sl() || cpu_is_imx6sx())
+ val |= BM_CLPCR_BYP_MMDC_CH0_LPM_HS;
+diff --git a/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c b/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c
+index 2a78b093c0ce..e74ddb373131 100644
+--- a/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c
++++ b/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c
+@@ -724,8 +724,20 @@ static struct omap_hwmod omap3xxx_dss_dispc_hwmod = {
+ * display serial interface controller
+ */
+
++static struct omap_hwmod_class_sysconfig omap3xxx_dsi_sysc = {
++ .rev_offs = 0x0000,
++ .sysc_offs = 0x0010,
++ .syss_offs = 0x0014,
++ .sysc_flags = (SYSC_HAS_AUTOIDLE | SYSC_HAS_CLOCKACTIVITY |
++ SYSC_HAS_ENAWAKEUP | SYSC_HAS_SIDLEMODE |
++ SYSC_HAS_SOFTRESET | SYSS_HAS_RESET_STATUS),
++ .idlemodes = (SIDLE_FORCE | SIDLE_NO | SIDLE_SMART),
++ .sysc_fields = &omap_hwmod_sysc_type1,
++};
++
+ static struct omap_hwmod_class omap3xxx_dsi_hwmod_class = {
+ .name = "dsi",
++ .sysc = &omap3xxx_dsi_sysc,
+ };
+
+ static struct omap_hwmod_irq_info omap3xxx_dsi1_irqs[] = {
+diff --git a/arch/arm/plat-orion/gpio.c b/arch/arm/plat-orion/gpio.c
+index e048f6198d68..14f6e647c739 100644
+--- a/arch/arm/plat-orion/gpio.c
++++ b/arch/arm/plat-orion/gpio.c
+@@ -505,9 +505,9 @@ static void orion_gpio_unmask_irq(struct irq_data *d)
+ u32 mask = d->mask;
+
+ irq_gc_lock(gc);
+- reg_val = irq_reg_readl(gc->reg_base + ct->regs.mask);
++ reg_val = irq_reg_readl(gc, ct->regs.mask);
+ reg_val |= mask;
+- irq_reg_writel(reg_val, gc->reg_base + ct->regs.mask);
++ irq_reg_writel(gc, reg_val, ct->regs.mask);
+ irq_gc_unlock(gc);
+ }
+
+@@ -519,9 +519,9 @@ static void orion_gpio_mask_irq(struct irq_data *d)
+ u32 reg_val;
+
+ irq_gc_lock(gc);
+- reg_val = irq_reg_readl(gc->reg_base + ct->regs.mask);
++ reg_val = irq_reg_readl(gc, ct->regs.mask);
+ reg_val &= ~mask;
+- irq_reg_writel(reg_val, gc->reg_base + ct->regs.mask);
++ irq_reg_writel(gc, reg_val, ct->regs.mask);
+ irq_gc_unlock(gc);
+ }
+
+diff --git a/arch/arm64/crypto/aes-glue.c b/arch/arm64/crypto/aes-glue.c
+index 5f63a791b2fb..31d014f01574 100644
+--- a/arch/arm64/crypto/aes-glue.c
++++ b/arch/arm64/crypto/aes-glue.c
+@@ -205,7 +205,7 @@ static int ctr_encrypt(struct blkcipher_desc *desc, struct scatterlist *dst,
+ err = blkcipher_walk_done(desc, &walk,
+ walk.nbytes % AES_BLOCK_SIZE);
+ }
+- if (nbytes) {
++ if (walk.nbytes % AES_BLOCK_SIZE) {
+ u8 *tdst = walk.dst.virt.addr + blocks * AES_BLOCK_SIZE;
+ u8 *tsrc = walk.src.virt.addr + blocks * AES_BLOCK_SIZE;
+ u8 __aligned(8) tail[AES_BLOCK_SIZE];
+diff --git a/arch/arm64/include/asm/spinlock.h b/arch/arm64/include/asm/spinlock.h
+index c45b7b1b7197..3c0bb9b303e8 100644
+--- a/arch/arm64/include/asm/spinlock.h
++++ b/arch/arm64/include/asm/spinlock.h
+@@ -231,4 +231,14 @@ static inline int arch_read_trylock(arch_rwlock_t *rw)
+ #define arch_read_relax(lock) cpu_relax()
+ #define arch_write_relax(lock) cpu_relax()
+
++/*
++ * Accesses appearing in program order before a spin_lock() operation
++ * can be reordered with accesses inside the critical section, by virtue
++ * of arch_spin_lock being constructed using acquire semantics.
++ *
++ * In cases where this is problematic (e.g. try_to_wake_up), an
++ * smp_mb__before_spinlock() can restore the required ordering.
++ */
++#define smp_mb__before_spinlock() smp_mb()
++
+ #endif /* __ASM_SPINLOCK_H */
+diff --git a/arch/avr32/include/asm/uaccess.h b/arch/avr32/include/asm/uaccess.h
+index 245b2ee213c9..a0a9b8c31041 100644
+--- a/arch/avr32/include/asm/uaccess.h
++++ b/arch/avr32/include/asm/uaccess.h
+@@ -74,7 +74,7 @@ extern __kernel_size_t __copy_user(void *to, const void *from,
+
+ extern __kernel_size_t copy_to_user(void __user *to, const void *from,
+ __kernel_size_t n);
+-extern __kernel_size_t copy_from_user(void *to, const void __user *from,
++extern __kernel_size_t ___copy_from_user(void *to, const void __user *from,
+ __kernel_size_t n);
+
+ static inline __kernel_size_t __copy_to_user(void __user *to, const void *from,
+@@ -88,6 +88,15 @@ static inline __kernel_size_t __copy_from_user(void *to,
+ {
+ return __copy_user(to, (const void __force *)from, n);
+ }
++static inline __kernel_size_t copy_from_user(void *to,
++ const void __user *from,
++ __kernel_size_t n)
++{
++ size_t res = ___copy_from_user(to, from, n);
++ if (unlikely(res))
++ memset(to + (n - res), 0, res);
++ return res;
++}
+
+ #define __copy_to_user_inatomic __copy_to_user
+ #define __copy_from_user_inatomic __copy_from_user
+diff --git a/arch/avr32/kernel/avr32_ksyms.c b/arch/avr32/kernel/avr32_ksyms.c
+index d93ead02daed..7c6cf14f0985 100644
+--- a/arch/avr32/kernel/avr32_ksyms.c
++++ b/arch/avr32/kernel/avr32_ksyms.c
+@@ -36,7 +36,7 @@ EXPORT_SYMBOL(copy_page);
+ /*
+ * Userspace access stuff.
+ */
+-EXPORT_SYMBOL(copy_from_user);
++EXPORT_SYMBOL(___copy_from_user);
+ EXPORT_SYMBOL(copy_to_user);
+ EXPORT_SYMBOL(__copy_user);
+ EXPORT_SYMBOL(strncpy_from_user);
+diff --git a/arch/avr32/lib/copy_user.S b/arch/avr32/lib/copy_user.S
+index ea59c04b07de..075373471da1 100644
+--- a/arch/avr32/lib/copy_user.S
++++ b/arch/avr32/lib/copy_user.S
+@@ -23,13 +23,13 @@
+ */
+ .text
+ .align 1
+- .global copy_from_user
+- .type copy_from_user, @function
+-copy_from_user:
++ .global ___copy_from_user
++ .type ___copy_from_user, @function
++___copy_from_user:
+ branch_if_kernel r8, __copy_user
+ ret_if_privileged r8, r11, r10, r10
+ rjmp __copy_user
+- .size copy_from_user, . - copy_from_user
++ .size ___copy_from_user, . - ___copy_from_user
+
+ .global copy_to_user
+ .type copy_to_user, @function
+diff --git a/arch/blackfin/include/asm/uaccess.h b/arch/blackfin/include/asm/uaccess.h
+index 57701c3b8a59..a992a788409c 100644
+--- a/arch/blackfin/include/asm/uaccess.h
++++ b/arch/blackfin/include/asm/uaccess.h
+@@ -177,11 +177,12 @@ static inline int bad_user_access_length(void)
+ static inline unsigned long __must_check
+ copy_from_user(void *to, const void __user *from, unsigned long n)
+ {
+- if (access_ok(VERIFY_READ, from, n))
++ if (likely(access_ok(VERIFY_READ, from, n))) {
+ memcpy(to, (const void __force *)from, n);
+- else
+- return n;
+- return 0;
++ return 0;
++ }
++ memset(to, 0, n);
++ return n;
+ }
+
+ static inline unsigned long __must_check
+diff --git a/arch/frv/include/asm/uaccess.h b/arch/frv/include/asm/uaccess.h
+index 3ac9a59d65d4..87d9e34c5df8 100644
+--- a/arch/frv/include/asm/uaccess.h
++++ b/arch/frv/include/asm/uaccess.h
+@@ -263,19 +263,25 @@ do { \
+ extern long __memset_user(void *dst, unsigned long count);
+ extern long __memcpy_user(void *dst, const void *src, unsigned long count);
+
+-#define clear_user(dst,count) __memset_user(____force(dst), (count))
++#define __clear_user(dst,count) __memset_user(____force(dst), (count))
+ #define __copy_from_user_inatomic(to, from, n) __memcpy_user((to), ____force(from), (n))
+ #define __copy_to_user_inatomic(to, from, n) __memcpy_user(____force(to), (from), (n))
+
+ #else
+
+-#define clear_user(dst,count) (memset(____force(dst), 0, (count)), 0)
++#define __clear_user(dst,count) (memset(____force(dst), 0, (count)), 0)
+ #define __copy_from_user_inatomic(to, from, n) (memcpy((to), ____force(from), (n)), 0)
+ #define __copy_to_user_inatomic(to, from, n) (memcpy(____force(to), (from), (n)), 0)
+
+ #endif
+
+-#define __clear_user clear_user
++static inline unsigned long __must_check
++clear_user(void __user *to, unsigned long n)
++{
++ if (likely(__access_ok(to, n)))
++ n = __clear_user(to, n);
++ return n;
++}
+
+ static inline unsigned long __must_check
+ __copy_to_user(void __user *to, const void *from, unsigned long n)
+diff --git a/arch/hexagon/include/asm/cacheflush.h b/arch/hexagon/include/asm/cacheflush.h
+index 49e0896ec240..b86f9f300e94 100644
+--- a/arch/hexagon/include/asm/cacheflush.h
++++ b/arch/hexagon/include/asm/cacheflush.h
+@@ -21,10 +21,7 @@
+ #ifndef _ASM_CACHEFLUSH_H
+ #define _ASM_CACHEFLUSH_H
+
+-#include <linux/cache.h>
+-#include <linux/mm.h>
+-#include <asm/string.h>
+-#include <asm-generic/cacheflush.h>
++#include <linux/mm_types.h>
+
+ /* Cache flushing:
+ *
+@@ -41,6 +38,20 @@
+ #define LINESIZE 32
+ #define LINEBITS 5
+
++#define flush_cache_all() do { } while (0)
++#define flush_cache_mm(mm) do { } while (0)
++#define flush_cache_dup_mm(mm) do { } while (0)
++#define flush_cache_range(vma, start, end) do { } while (0)
++#define flush_cache_page(vma, vmaddr, pfn) do { } while (0)
++#define ARCH_IMPLEMENTS_FLUSH_DCACHE_PAGE 0
++#define flush_dcache_page(page) do { } while (0)
++#define flush_dcache_mmap_lock(mapping) do { } while (0)
++#define flush_dcache_mmap_unlock(mapping) do { } while (0)
++#define flush_icache_page(vma, pg) do { } while (0)
++#define flush_icache_user_range(vma, pg, adr, len) do { } while (0)
++#define flush_cache_vmap(start, end) do { } while (0)
++#define flush_cache_vunmap(start, end) do { } while (0)
++
+ /*
+ * Flush Dcache range through current map.
+ */
+@@ -49,7 +60,6 @@ extern void flush_dcache_range(unsigned long start, unsigned long end);
+ /*
+ * Flush Icache range through current map.
+ */
+-#undef flush_icache_range
+ extern void flush_icache_range(unsigned long start, unsigned long end);
+
+ /*
+@@ -79,19 +89,11 @@ static inline void update_mmu_cache(struct vm_area_struct *vma,
+ /* generic_ptrace_pokedata doesn't wind up here, does it? */
+ }
+
+-#undef copy_to_user_page
+-static inline void copy_to_user_page(struct vm_area_struct *vma,
+- struct page *page,
+- unsigned long vaddr,
+- void *dst, void *src, int len)
+-{
+- memcpy(dst, src, len);
+- if (vma->vm_flags & VM_EXEC) {
+- flush_icache_range((unsigned long) dst,
+- (unsigned long) dst + len);
+- }
+-}
++void copy_to_user_page(struct vm_area_struct *vma, struct page *page,
++ unsigned long vaddr, void *dst, void *src, int len);
+
++#define copy_from_user_page(vma, page, vaddr, dst, src, len) \
++ memcpy(dst, src, len)
+
+ extern void hexagon_inv_dcache_range(unsigned long start, unsigned long end);
+ extern void hexagon_clean_dcache_range(unsigned long start, unsigned long end);
+diff --git a/arch/hexagon/include/asm/io.h b/arch/hexagon/include/asm/io.h
+index 70298996e9b2..66f5e9a61efc 100644
+--- a/arch/hexagon/include/asm/io.h
++++ b/arch/hexagon/include/asm/io.h
+@@ -24,14 +24,9 @@
+ #ifdef __KERNEL__
+
+ #include <linux/types.h>
+-#include <linux/delay.h>
+-#include <linux/vmalloc.h>
+-#include <asm/string.h>
+-#include <asm/mem-layout.h>
+ #include <asm/iomap.h>
+ #include <asm/page.h>
+ #include <asm/cacheflush.h>
+-#include <asm/tlbflush.h>
+
+ /*
+ * We don't have PCI yet.
+diff --git a/arch/hexagon/include/asm/uaccess.h b/arch/hexagon/include/asm/uaccess.h
+index e4127e4d6a5b..25fc9049db8a 100644
+--- a/arch/hexagon/include/asm/uaccess.h
++++ b/arch/hexagon/include/asm/uaccess.h
+@@ -102,7 +102,8 @@ static inline long hexagon_strncpy_from_user(char *dst, const char __user *src,
+ {
+ long res = __strnlen_user(src, n);
+
+- /* return from strnlen can't be zero -- that would be rubbish. */
++ if (unlikely(!res))
++ return -EFAULT;
+
+ if (res > n) {
+ copy_from_user(dst, src, n);
+diff --git a/arch/hexagon/kernel/setup.c b/arch/hexagon/kernel/setup.c
+index 0e7c1dbb37b2..6981949f5df3 100644
+--- a/arch/hexagon/kernel/setup.c
++++ b/arch/hexagon/kernel/setup.c
+@@ -19,6 +19,7 @@
+ */
+
+ #include <linux/init.h>
++#include <linux/delay.h>
+ #include <linux/bootmem.h>
+ #include <linux/mmzone.h>
+ #include <linux/mm.h>
+diff --git a/arch/hexagon/mm/cache.c b/arch/hexagon/mm/cache.c
+index 0c76c802e31c..a7c6d827d8b6 100644
+--- a/arch/hexagon/mm/cache.c
++++ b/arch/hexagon/mm/cache.c
+@@ -127,3 +127,13 @@ void flush_cache_all_hexagon(void)
+ local_irq_restore(flags);
+ mb();
+ }
++
++void copy_to_user_page(struct vm_area_struct *vma, struct page *page,
++ unsigned long vaddr, void *dst, void *src, int len)
++{
++ memcpy(dst, src, len);
++ if (vma->vm_flags & VM_EXEC) {
++ flush_icache_range((unsigned long) dst,
++ (unsigned long) dst + len);
++ }
++}
+diff --git a/arch/hexagon/mm/ioremap.c b/arch/hexagon/mm/ioremap.c
+index 5905fd5f97f6..d27d67224046 100644
+--- a/arch/hexagon/mm/ioremap.c
++++ b/arch/hexagon/mm/ioremap.c
+@@ -20,6 +20,7 @@
+
+ #include <linux/io.h>
+ #include <linux/vmalloc.h>
++#include <linux/mm.h>
+
+ void __iomem *ioremap_nocache(unsigned long phys_addr, unsigned long size)
+ {
+diff --git a/arch/ia64/include/asm/uaccess.h b/arch/ia64/include/asm/uaccess.h
+index 449c8c0fa2bd..810926c56e31 100644
+--- a/arch/ia64/include/asm/uaccess.h
++++ b/arch/ia64/include/asm/uaccess.h
+@@ -262,17 +262,15 @@ __copy_from_user (void *to, const void __user *from, unsigned long count)
+ __cu_len; \
+ })
+
+-#define copy_from_user(to, from, n) \
+-({ \
+- void *__cu_to = (to); \
+- const void __user *__cu_from = (from); \
+- long __cu_len = (n); \
+- \
+- __chk_user_ptr(__cu_from); \
+- if (__access_ok(__cu_from, __cu_len, get_fs())) \
+- __cu_len = __copy_user((__force void __user *) __cu_to, __cu_from, __cu_len); \
+- __cu_len; \
+-})
++static inline unsigned long
++copy_from_user(void *to, const void __user *from, unsigned long n)
++{
++ if (likely(__access_ok(from, n, get_fs())))
++ n = __copy_user((__force void __user *) to, from, n);
++ else
++ memset(to, 0, n);
++ return n;
++}
+
+ #define __copy_in_user(to, from, size) __copy_user((to), (from), (size))
+
+diff --git a/arch/m32r/include/asm/uaccess.h b/arch/m32r/include/asm/uaccess.h
+index 84fe7ba53035..c393e8f57cf7 100644
+--- a/arch/m32r/include/asm/uaccess.h
++++ b/arch/m32r/include/asm/uaccess.h
+@@ -215,7 +215,7 @@ extern int fixup_exception(struct pt_regs *regs);
+ #define __get_user_nocheck(x,ptr,size) \
+ ({ \
+ long __gu_err = 0; \
+- unsigned long __gu_val; \
++ unsigned long __gu_val = 0; \
+ might_fault(); \
+ __get_user_size(__gu_val,(ptr),(size),__gu_err); \
+ (x) = (__typeof__(*(ptr)))__gu_val; \
+diff --git a/arch/metag/include/asm/uaccess.h b/arch/metag/include/asm/uaccess.h
+index 0748b0a97986..7841f2290385 100644
+--- a/arch/metag/include/asm/uaccess.h
++++ b/arch/metag/include/asm/uaccess.h
+@@ -199,8 +199,9 @@ extern unsigned long __must_check __copy_user_zeroing(void *to,
+ static inline unsigned long
+ copy_from_user(void *to, const void __user *from, unsigned long n)
+ {
+- if (access_ok(VERIFY_READ, from, n))
++ if (likely(access_ok(VERIFY_READ, from, n)))
+ return __copy_user_zeroing(to, from, n);
++ memset(to, 0, n);
+ return n;
+ }
+
+diff --git a/arch/microblaze/include/asm/uaccess.h b/arch/microblaze/include/asm/uaccess.h
+index 59a89a64a865..336be7716972 100644
+--- a/arch/microblaze/include/asm/uaccess.h
++++ b/arch/microblaze/include/asm/uaccess.h
+@@ -226,7 +226,7 @@ extern long __user_bad(void);
+
+ #define __get_user(x, ptr) \
+ ({ \
+- unsigned long __gu_val; \
++ unsigned long __gu_val = 0; \
+ /*unsigned long __gu_ptr = (unsigned long)(ptr);*/ \
+ long __gu_err; \
+ switch (sizeof(*(ptr))) { \
+@@ -371,10 +371,13 @@ extern long __user_bad(void);
+ static inline long copy_from_user(void *to,
+ const void __user *from, unsigned long n)
+ {
++ unsigned long res = n;
+ might_fault();
+- if (access_ok(VERIFY_READ, from, n))
+- return __copy_from_user(to, from, n);
+- return n;
++ if (likely(access_ok(VERIFY_READ, from, n)))
++ res = __copy_from_user(to, from, n);
++ if (unlikely(res))
++ memset(to + (n - res), 0, res);
++ return res;
+ }
+
+ #define __copy_to_user(to, from, n) \
+diff --git a/arch/mips/include/asm/asmmacro.h b/arch/mips/include/asm/asmmacro.h
+index 71fef0af9c9a..a7ef4fba9774 100644
+--- a/arch/mips/include/asm/asmmacro.h
++++ b/arch/mips/include/asm/asmmacro.h
+@@ -134,6 +134,7 @@
+ ldc1 $f28, THREAD_FPR28_LS64(\thread)
+ ldc1 $f30, THREAD_FPR30_LS64(\thread)
+ ctc1 \tmp, fcr31
++ .set pop
+ .endm
+
+ .macro fpu_restore_16odd thread
+diff --git a/arch/mips/include/asm/mach-paravirt/kernel-entry-init.h b/arch/mips/include/asm/mach-paravirt/kernel-entry-init.h
+index 2f82bfa3a773..c9f5769dfc8f 100644
+--- a/arch/mips/include/asm/mach-paravirt/kernel-entry-init.h
++++ b/arch/mips/include/asm/mach-paravirt/kernel-entry-init.h
+@@ -11,11 +11,13 @@
+ #define CP0_EBASE $15, 1
+
+ .macro kernel_entry_setup
++#ifdef CONFIG_SMP
+ mfc0 t0, CP0_EBASE
+ andi t0, t0, 0x3ff # CPUNum
+ beqz t0, 1f
+ # CPUs other than zero goto smp_bootstrap
+ j smp_bootstrap
++#endif /* CONFIG_SMP */
+
+ 1:
+ .endm
+diff --git a/arch/mips/include/asm/uaccess.h b/arch/mips/include/asm/uaccess.h
+index 22a5624e2fd2..953a75a8a8d2 100644
+--- a/arch/mips/include/asm/uaccess.h
++++ b/arch/mips/include/asm/uaccess.h
+@@ -14,6 +14,7 @@
+ #include <linux/kernel.h>
+ #include <linux/errno.h>
+ #include <linux/thread_info.h>
++#include <linux/string.h>
+ #include <asm/asm-eva.h>
+
+ /*
+@@ -1136,6 +1137,8 @@ extern size_t __copy_in_user_eva(void *__to, const void *__from, size_t __n);
+ __cu_len = __invoke_copy_from_user(__cu_to, \
+ __cu_from, \
+ __cu_len); \
++ } else { \
++ memset(__cu_to, 0, __cu_len); \
+ } \
+ } \
+ __cu_len; \
+diff --git a/arch/mips/kvm/tlb.c b/arch/mips/kvm/tlb.c
+index bbcd82242059..b814f659f43d 100644
+--- a/arch/mips/kvm/tlb.c
++++ b/arch/mips/kvm/tlb.c
+@@ -152,7 +152,7 @@ static int kvm_mips_map_page(struct kvm *kvm, gfn_t gfn)
+ srcu_idx = srcu_read_lock(&kvm->srcu);
+ pfn = kvm_mips_gfn_to_pfn(kvm, gfn);
+
+- if (kvm_mips_is_error_pfn(pfn)) {
++ if (is_error_noslot_pfn(pfn)) {
+ kvm_err("Couldn't get pfn for gfn %#" PRIx64 "!\n", gfn);
+ err = -EFAULT;
+ goto out;
+diff --git a/arch/mn10300/include/asm/uaccess.h b/arch/mn10300/include/asm/uaccess.h
+index 537278746a15..4af43d9ba495 100644
+--- a/arch/mn10300/include/asm/uaccess.h
++++ b/arch/mn10300/include/asm/uaccess.h
+@@ -181,6 +181,7 @@ struct __large_struct { unsigned long buf[100]; };
+ "2:\n" \
+ " .section .fixup,\"ax\"\n" \
+ "3:\n\t" \
++ " mov 0,%1\n" \
+ " mov %3,%0\n" \
+ " jmp 2b\n" \
+ " .previous\n" \
+diff --git a/arch/mn10300/lib/usercopy.c b/arch/mn10300/lib/usercopy.c
+index 7826e6c364e7..ce8899e5e171 100644
+--- a/arch/mn10300/lib/usercopy.c
++++ b/arch/mn10300/lib/usercopy.c
+@@ -9,7 +9,7 @@
+ * as published by the Free Software Foundation; either version
+ * 2 of the Licence, or (at your option) any later version.
+ */
+-#include <asm/uaccess.h>
++#include <linux/uaccess.h>
+
+ unsigned long
+ __generic_copy_to_user(void *to, const void *from, unsigned long n)
+@@ -24,6 +24,8 @@ __generic_copy_from_user(void *to, const void *from, unsigned long n)
+ {
+ if (access_ok(VERIFY_READ, from, n))
+ __copy_user_zeroing(to, from, n);
++ else
++ memset(to, 0, n);
+ return n;
+ }
+
+diff --git a/arch/openrisc/include/asm/uaccess.h b/arch/openrisc/include/asm/uaccess.h
+index ab2e7a198a4c..d441480a4af4 100644
+--- a/arch/openrisc/include/asm/uaccess.h
++++ b/arch/openrisc/include/asm/uaccess.h
+@@ -273,28 +273,20 @@ __copy_tofrom_user(void *to, const void *from, unsigned long size);
+ static inline unsigned long
+ copy_from_user(void *to, const void *from, unsigned long n)
+ {
+- unsigned long over;
+-
+- if (access_ok(VERIFY_READ, from, n))
+- return __copy_tofrom_user(to, from, n);
+- if ((unsigned long)from < TASK_SIZE) {
+- over = (unsigned long)from + n - TASK_SIZE;
+- return __copy_tofrom_user(to, from, n - over) + over;
+- }
+- return n;
++ unsigned long res = n;
++
++ if (likely(access_ok(VERIFY_READ, from, n)))
++ res = __copy_tofrom_user(to, from, n);
++ if (unlikely(res))
++ memset(to + (n - res), 0, res);
++ return res;
+ }
+
+ static inline unsigned long
+ copy_to_user(void *to, const void *from, unsigned long n)
+ {
+- unsigned long over;
+-
+- if (access_ok(VERIFY_WRITE, to, n))
+- return __copy_tofrom_user(to, from, n);
+- if ((unsigned long)to < TASK_SIZE) {
+- over = (unsigned long)to + n - TASK_SIZE;
+- return __copy_tofrom_user(to, from, n - over) + over;
+- }
++ if (likely(access_ok(VERIFY_WRITE, to, n)))
++ n = __copy_tofrom_user(to, from, n);
+ return n;
+ }
+
+@@ -303,13 +295,8 @@ extern unsigned long __clear_user(void *addr, unsigned long size);
+ static inline __must_check unsigned long
+ clear_user(void *addr, unsigned long size)
+ {
+-
+- if (access_ok(VERIFY_WRITE, addr, size))
+- return __clear_user(addr, size);
+- if ((unsigned long)addr < TASK_SIZE) {
+- unsigned long over = (unsigned long)addr + size - TASK_SIZE;
+- return __clear_user(addr, size - over) + over;
+- }
++ if (likely(access_ok(VERIFY_WRITE, addr, size)))
++ size = __clear_user(addr, size);
+ return size;
+ }
+
+diff --git a/arch/parisc/include/asm/uaccess.h b/arch/parisc/include/asm/uaccess.h
+index df9d8dd72db2..3c38f8535499 100644
+--- a/arch/parisc/include/asm/uaccess.h
++++ b/arch/parisc/include/asm/uaccess.h
+@@ -10,6 +10,7 @@
+ #include <asm-generic/uaccess-unaligned.h>
+
+ #include <linux/bug.h>
++#include <linux/string.h>
+
+ #define VERIFY_READ 0
+ #define VERIFY_WRITE 1
+@@ -245,13 +246,14 @@ static inline unsigned long __must_check copy_from_user(void *to,
+ unsigned long n)
+ {
+ int sz = __compiletime_object_size(to);
+- int ret = -EFAULT;
++ unsigned long ret = n;
+
+ if (likely(sz == -1 || !__builtin_constant_p(n) || sz >= n))
+ ret = __copy_from_user(to, from, n);
+ else
+ copy_from_user_overflow();
+-
++ if (unlikely(ret))
++ memset(to + (n - ret), 0, ret);
+ return ret;
+ }
+
+diff --git a/arch/powerpc/include/asm/uaccess.h b/arch/powerpc/include/asm/uaccess.h
+index 9485b43a7c00..46c486599645 100644
+--- a/arch/powerpc/include/asm/uaccess.h
++++ b/arch/powerpc/include/asm/uaccess.h
+@@ -323,30 +323,17 @@ extern unsigned long __copy_tofrom_user(void __user *to,
+ static inline unsigned long copy_from_user(void *to,
+ const void __user *from, unsigned long n)
+ {
+- unsigned long over;
+-
+- if (access_ok(VERIFY_READ, from, n))
++ if (likely(access_ok(VERIFY_READ, from, n)))
+ return __copy_tofrom_user((__force void __user *)to, from, n);
+- if ((unsigned long)from < TASK_SIZE) {
+- over = (unsigned long)from + n - TASK_SIZE;
+- return __copy_tofrom_user((__force void __user *)to, from,
+- n - over) + over;
+- }
++ memset(to, 0, n);
+ return n;
+ }
+
+ static inline unsigned long copy_to_user(void __user *to,
+ const void *from, unsigned long n)
+ {
+- unsigned long over;
+-
+ if (access_ok(VERIFY_WRITE, to, n))
+ return __copy_tofrom_user(to, (__force void __user *)from, n);
+- if ((unsigned long)to < TASK_SIZE) {
+- over = (unsigned long)to + n - TASK_SIZE;
+- return __copy_tofrom_user(to, (__force void __user *)from,
+- n - over) + over;
+- }
+ return n;
+ }
+
+@@ -437,10 +424,6 @@ static inline unsigned long clear_user(void __user *addr, unsigned long size)
+ might_fault();
+ if (likely(access_ok(VERIFY_WRITE, addr, size)))
+ return __clear_user(addr, size);
+- if ((unsigned long)addr < TASK_SIZE) {
+- unsigned long over = (unsigned long)addr + size - TASK_SIZE;
+- return __clear_user(addr, size - over) + over;
+- }
+ return size;
+ }
+
+diff --git a/arch/powerpc/mm/slb_low.S b/arch/powerpc/mm/slb_low.S
+index 736d18b3cefd..4c48b487698c 100644
+--- a/arch/powerpc/mm/slb_low.S
++++ b/arch/powerpc/mm/slb_low.S
+@@ -113,7 +113,12 @@ BEGIN_FTR_SECTION
+ END_MMU_FTR_SECTION_IFCLR(MMU_FTR_1T_SEGMENT)
+ b slb_finish_load_1T
+
+-0:
++0: /*
++ * For userspace addresses, make sure this is region 0.
++ */
++ cmpdi r9, 0
++ bne 8f
++
+ /* when using slices, we extract the psize off the slice bitmaps
+ * and then we need to get the sllp encoding off the mmu_psize_defs
+ * array.
+diff --git a/arch/s390/include/asm/uaccess.h b/arch/s390/include/asm/uaccess.h
+index cd4c68e0398d..528f08c1d584 100644
+--- a/arch/s390/include/asm/uaccess.h
++++ b/arch/s390/include/asm/uaccess.h
+@@ -213,28 +213,28 @@ int __put_user_bad(void) __attribute__((noreturn));
+ __chk_user_ptr(ptr); \
+ switch (sizeof(*(ptr))) { \
+ case 1: { \
+- unsigned char __x; \
++ unsigned char __x = 0; \
+ __gu_err = __get_user_fn(&__x, ptr, \
+ sizeof(*(ptr))); \
+ (x) = *(__force __typeof__(*(ptr)) *) &__x; \
+ break; \
+ }; \
+ case 2: { \
+- unsigned short __x; \
++ unsigned short __x = 0; \
+ __gu_err = __get_user_fn(&__x, ptr, \
+ sizeof(*(ptr))); \
+ (x) = *(__force __typeof__(*(ptr)) *) &__x; \
+ break; \
+ }; \
+ case 4: { \
+- unsigned int __x; \
++ unsigned int __x = 0; \
+ __gu_err = __get_user_fn(&__x, ptr, \
+ sizeof(*(ptr))); \
+ (x) = *(__force __typeof__(*(ptr)) *) &__x; \
+ break; \
+ }; \
+ case 8: { \
+- unsigned long long __x; \
++ unsigned long long __x = 0; \
+ __gu_err = __get_user_fn(&__x, ptr, \
+ sizeof(*(ptr))); \
+ (x) = *(__force __typeof__(*(ptr)) *) &__x; \
+diff --git a/arch/score/include/asm/uaccess.h b/arch/score/include/asm/uaccess.h
+index ab66ddde777b..69326dfb894d 100644
+--- a/arch/score/include/asm/uaccess.h
++++ b/arch/score/include/asm/uaccess.h
+@@ -158,7 +158,7 @@ do { \
+ __get_user_asm(val, "lw", ptr); \
+ break; \
+ case 8: \
+- if ((copy_from_user((void *)&val, ptr, 8)) == 0) \
++ if (__copy_from_user((void *)&val, ptr, 8) == 0) \
+ __gu_err = 0; \
+ else \
+ __gu_err = -EFAULT; \
+@@ -183,6 +183,8 @@ do { \
+ \
+ if (likely(access_ok(VERIFY_READ, __gu_ptr, size))) \
+ __get_user_common((x), size, __gu_ptr); \
++ else \
++ (x) = 0; \
+ \
+ __gu_err; \
+ })
+@@ -196,6 +198,7 @@ do { \
+ "2:\n" \
+ ".section .fixup,\"ax\"\n" \
+ "3:li %0, %4\n" \
++ "li %1, 0\n" \
+ "j 2b\n" \
+ ".previous\n" \
+ ".section __ex_table,\"a\"\n" \
+@@ -293,35 +296,34 @@ extern int __copy_tofrom_user(void *to, const void *from, unsigned long len);
+ static inline unsigned long
+ copy_from_user(void *to, const void *from, unsigned long len)
+ {
+- unsigned long over;
++ unsigned long res = len;
+
+- if (access_ok(VERIFY_READ, from, len))
+- return __copy_tofrom_user(to, from, len);
++ if (likely(access_ok(VERIFY_READ, from, len)))
++ res = __copy_tofrom_user(to, from, len);
+
+- if ((unsigned long)from < TASK_SIZE) {
+- over = (unsigned long)from + len - TASK_SIZE;
+- return __copy_tofrom_user(to, from, len - over) + over;
+- }
+- return len;
++ if (unlikely(res))
++ memset(to + (len - res), 0, res);
++
++ return res;
+ }
+
+ static inline unsigned long
+ copy_to_user(void *to, const void *from, unsigned long len)
+ {
+- unsigned long over;
+-
+- if (access_ok(VERIFY_WRITE, to, len))
+- return __copy_tofrom_user(to, from, len);
++ if (likely(access_ok(VERIFY_WRITE, to, len)))
++ len = __copy_tofrom_user(to, from, len);
+
+- if ((unsigned long)to < TASK_SIZE) {
+- over = (unsigned long)to + len - TASK_SIZE;
+- return __copy_tofrom_user(to, from, len - over) + over;
+- }
+ return len;
+ }
+
+-#define __copy_from_user(to, from, len) \
+- __copy_tofrom_user((to), (from), (len))
++static inline unsigned long
++__copy_from_user(void *to, const void *from, unsigned long len)
++{
++ unsigned long left = __copy_tofrom_user(to, from, len);
++ if (unlikely(left))
++ memset(to + (len - left), 0, left);
++ return left;
++}
+
+ #define __copy_to_user(to, from, len) \
+ __copy_tofrom_user((to), (from), (len))
+@@ -335,17 +337,17 @@ __copy_to_user_inatomic(void *to, const void *from, unsigned long len)
+ static inline unsigned long
+ __copy_from_user_inatomic(void *to, const void *from, unsigned long len)
+ {
+- return __copy_from_user(to, from, len);
++ return __copy_tofrom_user(to, from, len);
+ }
+
+-#define __copy_in_user(to, from, len) __copy_from_user(to, from, len)
++#define __copy_in_user(to, from, len) __copy_tofrom_user(to, from, len)
+
+ static inline unsigned long
+ copy_in_user(void *to, const void *from, unsigned long len)
+ {
+ if (access_ok(VERIFY_READ, from, len) &&
+ access_ok(VERFITY_WRITE, to, len))
+- return copy_from_user(to, from, len);
++ return __copy_tofrom_user(to, from, len);
+ }
+
+ /*
+diff --git a/arch/sh/include/asm/uaccess.h b/arch/sh/include/asm/uaccess.h
+index 9486376605f4..c04cc18ae9cd 100644
+--- a/arch/sh/include/asm/uaccess.h
++++ b/arch/sh/include/asm/uaccess.h
+@@ -151,7 +151,10 @@ copy_from_user(void *to, const void __user *from, unsigned long n)
+ __kernel_size_t __copy_size = (__kernel_size_t) n;
+
+ if (__copy_size && __access_ok(__copy_from, __copy_size))
+- return __copy_user(to, from, __copy_size);
++ __copy_size = __copy_user(to, from, __copy_size);
++
++ if (unlikely(__copy_size))
++ memset(to + (n - __copy_size), 0, __copy_size);
+
+ return __copy_size;
+ }
+diff --git a/arch/sh/include/asm/uaccess_64.h b/arch/sh/include/asm/uaccess_64.h
+index 2e07e0f40c6a..a2f9d0531328 100644
+--- a/arch/sh/include/asm/uaccess_64.h
++++ b/arch/sh/include/asm/uaccess_64.h
+@@ -24,6 +24,7 @@
+ #define __get_user_size(x,ptr,size,retval) \
+ do { \
+ retval = 0; \
++ x = 0; \
+ switch (size) { \
+ case 1: \
+ retval = __get_user_asm_b((void *)&x, \
+diff --git a/arch/sparc/include/asm/uaccess_32.h b/arch/sparc/include/asm/uaccess_32.h
+index 9634d086fc56..79b03872e165 100644
+--- a/arch/sparc/include/asm/uaccess_32.h
++++ b/arch/sparc/include/asm/uaccess_32.h
+@@ -265,8 +265,10 @@ static inline unsigned long copy_from_user(void *to, const void __user *from, un
+ {
+ if (n && __access_ok((unsigned long) from, n))
+ return __copy_user((__force void __user *) to, from, n);
+- else
++ else {
++ memset(to, 0, n);
+ return n;
++ }
+ }
+
+ static inline unsigned long __copy_from_user(void *to, const void __user *from, unsigned long n)
+diff --git a/arch/x86/include/asm/uaccess.h b/arch/x86/include/asm/uaccess.h
+index 0d592e0a5b84..8e046ade1c88 100644
+--- a/arch/x86/include/asm/uaccess.h
++++ b/arch/x86/include/asm/uaccess.h
+@@ -391,7 +391,11 @@ do { \
+ #define __get_user_asm_ex(x, addr, itype, rtype, ltype) \
+ asm volatile("1: mov"itype" %1,%"rtype"0\n" \
+ "2:\n" \
+- _ASM_EXTABLE_EX(1b, 2b) \
++ ".section .fixup,\"ax\"\n" \
++ "3:xor"itype" %"rtype"0,%"rtype"0\n" \
++ " jmp 2b\n" \
++ ".previous\n" \
++ _ASM_EXTABLE_EX(1b, 3b) \
+ : ltype(x) : "m" (__m(addr)))
+
+ #define __put_user_nocheck(x, ptr, size) \
+diff --git a/block/bio.c b/block/bio.c
+index 3e6e1986a5b2..78803e99c154 100644
+--- a/block/bio.c
++++ b/block/bio.c
+@@ -1824,8 +1824,9 @@ EXPORT_SYMBOL(bio_endio_nodec);
+ * Allocates and returns a new bio which represents @sectors from the start of
+ * @bio, and updates @bio to represent the remaining sectors.
+ *
+- * The newly allocated bio will point to @bio's bi_io_vec; it is the caller's
+- * responsibility to ensure that @bio is not freed before the split.
++ * Unless this is a discard request the newly allocated bio will point
++ * to @bio's bi_io_vec; it is the caller's responsibility to ensure that
++ * @bio is not freed before the split.
+ */
+ struct bio *bio_split(struct bio *bio, int sectors,
+ gfp_t gfp, struct bio_set *bs)
+@@ -1835,7 +1836,15 @@ struct bio *bio_split(struct bio *bio, int sectors,
+ BUG_ON(sectors <= 0);
+ BUG_ON(sectors >= bio_sectors(bio));
+
+- split = bio_clone_fast(bio, gfp, bs);
++ /*
++ * Discards need a mutable bio_vec to accommodate the payload
++ * required by the DSM TRIM and UNMAP commands.
++ */
++ if (bio->bi_rw & REQ_DISCARD)
++ split = bio_clone_bioset(bio, gfp, bs);
++ else
++ split = bio_clone_fast(bio, gfp, bs);
++
+ if (!split)
+ return NULL;
+
+diff --git a/crypto/blkcipher.c b/crypto/blkcipher.c
+index 0122bec38564..f25799f351f7 100644
+--- a/crypto/blkcipher.c
++++ b/crypto/blkcipher.c
+@@ -233,6 +233,8 @@ static int blkcipher_walk_next(struct blkcipher_desc *desc,
+ return blkcipher_walk_done(desc, walk, -EINVAL);
+ }
+
++ bsize = min(walk->walk_blocksize, n);
++
+ walk->flags &= ~(BLKCIPHER_WALK_SLOW | BLKCIPHER_WALK_COPY |
+ BLKCIPHER_WALK_DIFF);
+ if (!scatterwalk_aligned(&walk->in, walk->alignmask) ||
+@@ -245,7 +247,6 @@ static int blkcipher_walk_next(struct blkcipher_desc *desc,
+ }
+ }
+
+- bsize = min(walk->walk_blocksize, n);
+ n = scatterwalk_clamp(&walk->in, n);
+ n = scatterwalk_clamp(&walk->out, n);
+
+diff --git a/crypto/cryptd.c b/crypto/cryptd.c
+index 650afac10fd7..be367e43ffe8 100644
+--- a/crypto/cryptd.c
++++ b/crypto/cryptd.c
+@@ -565,9 +565,14 @@ static int cryptd_hash_export(struct ahash_request *req, void *out)
+
+ static int cryptd_hash_import(struct ahash_request *req, const void *in)
+ {
+- struct cryptd_hash_request_ctx *rctx = ahash_request_ctx(req);
++ struct crypto_ahash *tfm = crypto_ahash_reqtfm(req);
++ struct cryptd_hash_ctx *ctx = crypto_ahash_ctx(tfm);
++ struct shash_desc *desc = cryptd_shash_desc(req);
++
++ desc->tfm = ctx->child;
++ desc->flags = req->base.flags;
+
+- return crypto_shash_import(&rctx->desc, in);
++ return crypto_shash_import(desc, in);
+ }
+
+ static int cryptd_create_hash(struct crypto_template *tmpl, struct rtattr **tb,
+diff --git a/drivers/bus/arm-ccn.c b/drivers/bus/arm-ccn.c
+index 60397ec77ff7..27fd0dacad5f 100644
+--- a/drivers/bus/arm-ccn.c
++++ b/drivers/bus/arm-ccn.c
+@@ -804,6 +804,10 @@ static void arm_ccn_pmu_xp_dt_config(struct perf_event *event, int enable)
+ struct arm_ccn_component *xp;
+ u32 val, dt_cfg;
+
++ /* Nothing to do for cycle counter */
++ if (hw->idx == CCN_IDX_PMU_CYCLE_COUNTER)
++ return;
++
+ if (CCN_CONFIG_TYPE(event->attr.config) == CCN_TYPE_XP)
+ xp = &ccn->xp[CCN_CONFIG_XP(event->attr.config)];
+ else
+@@ -901,7 +905,7 @@ static void arm_ccn_pmu_xp_watchpoint_config(struct perf_event *event)
+
+ /* Comparison values */
+ writel(cmp_l & 0xffffffff, source->base + CCN_XP_DT_CMP_VAL_L(wp));
+- writel((cmp_l >> 32) & 0xefffffff,
++ writel((cmp_l >> 32) & 0x7fffffff,
+ source->base + CCN_XP_DT_CMP_VAL_L(wp) + 4);
+ writel(cmp_h & 0xffffffff, source->base + CCN_XP_DT_CMP_VAL_H(wp));
+ writel((cmp_h >> 32) & 0x0fffffff,
+@@ -909,7 +913,7 @@ static void arm_ccn_pmu_xp_watchpoint_config(struct perf_event *event)
+
+ /* Mask */
+ writel(mask_l & 0xffffffff, source->base + CCN_XP_DT_CMP_MASK_L(wp));
+- writel((mask_l >> 32) & 0xefffffff,
++ writel((mask_l >> 32) & 0x7fffffff,
+ source->base + CCN_XP_DT_CMP_MASK_L(wp) + 4);
+ writel(mask_h & 0xffffffff, source->base + CCN_XP_DT_CMP_MASK_H(wp));
+ writel((mask_h >> 32) & 0x0fffffff,
+diff --git a/drivers/iio/accel/kxsd9.c b/drivers/iio/accel/kxsd9.c
+index 6dfce7e722cb..2254f8509a69 100644
+--- a/drivers/iio/accel/kxsd9.c
++++ b/drivers/iio/accel/kxsd9.c
+@@ -166,6 +166,7 @@ static int kxsd9_read_raw(struct iio_dev *indio_dev,
+ ret = spi_w8r8(st->us, KXSD9_READ(KXSD9_REG_CTRL_C));
+ if (ret)
+ goto error_ret;
++ *val = 0;
+ *val2 = kxsd9_micro_scales[ret & KXSD9_FS_MASK];
+ ret = IIO_VAL_INT_PLUS_MICRO;
+ break;
+diff --git a/drivers/irqchip/irq-atmel-aic.c b/drivers/irqchip/irq-atmel-aic.c
+index 9a2cf3c1a3a5..27fdd8c3e7b4 100644
+--- a/drivers/irqchip/irq-atmel-aic.c
++++ b/drivers/irqchip/irq-atmel-aic.c
+@@ -65,11 +65,11 @@ aic_handle(struct pt_regs *regs)
+ u32 irqnr;
+ u32 irqstat;
+
+- irqnr = irq_reg_readl(gc->reg_base + AT91_AIC_IVR);
+- irqstat = irq_reg_readl(gc->reg_base + AT91_AIC_ISR);
++ irqnr = irq_reg_readl(gc, AT91_AIC_IVR);
++ irqstat = irq_reg_readl(gc, AT91_AIC_ISR);
+
+ if (!irqstat)
+- irq_reg_writel(0, gc->reg_base + AT91_AIC_EOICR);
++ irq_reg_writel(gc, 0, AT91_AIC_EOICR);
+ else
+ handle_domain_irq(aic_domain, irqnr, regs);
+ }
+@@ -80,7 +80,7 @@ static int aic_retrigger(struct irq_data *d)
+
+ /* Enable interrupt on AIC5 */
+ irq_gc_lock(gc);
+- irq_reg_writel(d->mask, gc->reg_base + AT91_AIC_ISCR);
++ irq_reg_writel(gc, d->mask, AT91_AIC_ISCR);
+ irq_gc_unlock(gc);
+
+ return 0;
+@@ -92,12 +92,12 @@ static int aic_set_type(struct irq_data *d, unsigned type)
+ unsigned int smr;
+ int ret;
+
+- smr = irq_reg_readl(gc->reg_base + AT91_AIC_SMR(d->hwirq));
++ smr = irq_reg_readl(gc, AT91_AIC_SMR(d->hwirq));
+ ret = aic_common_set_type(d, type, &smr);
+ if (ret)
+ return ret;
+
+- irq_reg_writel(smr, gc->reg_base + AT91_AIC_SMR(d->hwirq));
++ irq_reg_writel(gc, smr, AT91_AIC_SMR(d->hwirq));
+
+ return 0;
+ }
+@@ -108,8 +108,8 @@ static void aic_suspend(struct irq_data *d)
+ struct irq_chip_generic *gc = irq_data_get_irq_chip_data(d);
+
+ irq_gc_lock(gc);
+- irq_reg_writel(gc->mask_cache, gc->reg_base + AT91_AIC_IDCR);
+- irq_reg_writel(gc->wake_active, gc->reg_base + AT91_AIC_IECR);
++ irq_reg_writel(gc, gc->mask_cache, AT91_AIC_IDCR);
++ irq_reg_writel(gc, gc->wake_active, AT91_AIC_IECR);
+ irq_gc_unlock(gc);
+ }
+
+@@ -118,8 +118,8 @@ static void aic_resume(struct irq_data *d)
+ struct irq_chip_generic *gc = irq_data_get_irq_chip_data(d);
+
+ irq_gc_lock(gc);
+- irq_reg_writel(gc->wake_active, gc->reg_base + AT91_AIC_IDCR);
+- irq_reg_writel(gc->mask_cache, gc->reg_base + AT91_AIC_IECR);
++ irq_reg_writel(gc, gc->wake_active, AT91_AIC_IDCR);
++ irq_reg_writel(gc, gc->mask_cache, AT91_AIC_IECR);
+ irq_gc_unlock(gc);
+ }
+
+@@ -128,8 +128,8 @@ static void aic_pm_shutdown(struct irq_data *d)
+ struct irq_chip_generic *gc = irq_data_get_irq_chip_data(d);
+
+ irq_gc_lock(gc);
+- irq_reg_writel(0xffffffff, gc->reg_base + AT91_AIC_IDCR);
+- irq_reg_writel(0xffffffff, gc->reg_base + AT91_AIC_ICCR);
++ irq_reg_writel(gc, 0xffffffff, AT91_AIC_IDCR);
++ irq_reg_writel(gc, 0xffffffff, AT91_AIC_ICCR);
+ irq_gc_unlock(gc);
+ }
+ #else
+@@ -148,24 +148,24 @@ static void __init aic_hw_init(struct irq_domain *domain)
+ * will not Lock out nIRQ
+ */
+ for (i = 0; i < 8; i++)
+- irq_reg_writel(0, gc->reg_base + AT91_AIC_EOICR);
++ irq_reg_writel(gc, 0, AT91_AIC_EOICR);
+
+ /*
+ * Spurious Interrupt ID in Spurious Vector Register.
+ * When there is no current interrupt, the IRQ Vector Register
+ * reads the value stored in AIC_SPU
+ */
+- irq_reg_writel(0xffffffff, gc->reg_base + AT91_AIC_SPU);
++ irq_reg_writel(gc, 0xffffffff, AT91_AIC_SPU);
+
+ /* No debugging in AIC: Debug (Protect) Control Register */
+- irq_reg_writel(0, gc->reg_base + AT91_AIC_DCR);
++ irq_reg_writel(gc, 0, AT91_AIC_DCR);
+
+ /* Disable and clear all interrupts initially */
+- irq_reg_writel(0xffffffff, gc->reg_base + AT91_AIC_IDCR);
+- irq_reg_writel(0xffffffff, gc->reg_base + AT91_AIC_ICCR);
++ irq_reg_writel(gc, 0xffffffff, AT91_AIC_IDCR);
++ irq_reg_writel(gc, 0xffffffff, AT91_AIC_ICCR);
+
+ for (i = 0; i < 32; i++)
+- irq_reg_writel(i, gc->reg_base + AT91_AIC_SVR(i));
++ irq_reg_writel(gc, i, AT91_AIC_SVR(i));
+ }
+
+ static int aic_irq_domain_xlate(struct irq_domain *d,
+@@ -195,10 +195,10 @@ static int aic_irq_domain_xlate(struct irq_domain *d,
+ gc = dgc->gc[idx];
+
+ irq_gc_lock(gc);
+- smr = irq_reg_readl(gc->reg_base + AT91_AIC_SMR(*out_hwirq));
++ smr = irq_reg_readl(gc, AT91_AIC_SMR(*out_hwirq));
+ ret = aic_common_set_priority(intspec[2], &smr);
+ if (!ret)
+- irq_reg_writel(smr, gc->reg_base + AT91_AIC_SMR(*out_hwirq));
++ irq_reg_writel(gc, smr, AT91_AIC_SMR(*out_hwirq));
+ irq_gc_unlock(gc);
+
+ return ret;
+diff --git a/drivers/irqchip/irq-atmel-aic5.c b/drivers/irqchip/irq-atmel-aic5.c
+index a11aae8fb006..a2e8c3f876cb 100644
+--- a/drivers/irqchip/irq-atmel-aic5.c
++++ b/drivers/irqchip/irq-atmel-aic5.c
+@@ -75,11 +75,11 @@ aic5_handle(struct pt_regs *regs)
+ u32 irqnr;
+ u32 irqstat;
+
+- irqnr = irq_reg_readl(gc->reg_base + AT91_AIC5_IVR);
+- irqstat = irq_reg_readl(gc->reg_base + AT91_AIC5_ISR);
++ irqnr = irq_reg_readl(gc, AT91_AIC5_IVR);
++ irqstat = irq_reg_readl(gc, AT91_AIC5_ISR);
+
+ if (!irqstat)
+- irq_reg_writel(0, gc->reg_base + AT91_AIC5_EOICR);
++ irq_reg_writel(gc, 0, AT91_AIC5_EOICR);
+ else
+ handle_domain_irq(aic5_domain, irqnr, regs);
+ }
+@@ -92,8 +92,8 @@ static void aic5_mask(struct irq_data *d)
+
+ /* Disable interrupt on AIC5 */
+ irq_gc_lock(gc);
+- irq_reg_writel(d->hwirq, gc->reg_base + AT91_AIC5_SSR);
+- irq_reg_writel(1, gc->reg_base + AT91_AIC5_IDCR);
++ irq_reg_writel(gc, d->hwirq, AT91_AIC5_SSR);
++ irq_reg_writel(gc, 1, AT91_AIC5_IDCR);
+ gc->mask_cache &= ~d->mask;
+ irq_gc_unlock(gc);
+ }
+@@ -106,8 +106,8 @@ static void aic5_unmask(struct irq_data *d)
+
+ /* Enable interrupt on AIC5 */
+ irq_gc_lock(gc);
+- irq_reg_writel(d->hwirq, gc->reg_base + AT91_AIC5_SSR);
+- irq_reg_writel(1, gc->reg_base + AT91_AIC5_IECR);
++ irq_reg_writel(gc, d->hwirq, AT91_AIC5_SSR);
++ irq_reg_writel(gc, 1, AT91_AIC5_IECR);
+ gc->mask_cache |= d->mask;
+ irq_gc_unlock(gc);
+ }
+@@ -120,8 +120,8 @@ static int aic5_retrigger(struct irq_data *d)
+
+ /* Enable interrupt on AIC5 */
+ irq_gc_lock(gc);
+- irq_reg_writel(d->hwirq, gc->reg_base + AT91_AIC5_SSR);
+- irq_reg_writel(1, gc->reg_base + AT91_AIC5_ISCR);
++ irq_reg_writel(gc, d->hwirq, AT91_AIC5_SSR);
++ irq_reg_writel(gc, 1, AT91_AIC5_ISCR);
+ irq_gc_unlock(gc);
+
+ return 0;
+@@ -136,11 +136,11 @@ static int aic5_set_type(struct irq_data *d, unsigned type)
+ int ret;
+
+ irq_gc_lock(gc);
+- irq_reg_writel(d->hwirq, gc->reg_base + AT91_AIC5_SSR);
+- smr = irq_reg_readl(gc->reg_base + AT91_AIC5_SMR);
++ irq_reg_writel(gc, d->hwirq, AT91_AIC5_SSR);
++ smr = irq_reg_readl(gc, AT91_AIC5_SMR);
+ ret = aic_common_set_type(d, type, &smr);
+ if (!ret)
+- irq_reg_writel(smr, gc->reg_base + AT91_AIC5_SMR);
++ irq_reg_writel(gc, smr, AT91_AIC5_SMR);
+ irq_gc_unlock(gc);
+
+ return ret;
+@@ -162,12 +162,11 @@ static void aic5_suspend(struct irq_data *d)
+ if ((mask & gc->mask_cache) == (mask & gc->wake_active))
+ continue;
+
+- irq_reg_writel(i + gc->irq_base,
+- bgc->reg_base + AT91_AIC5_SSR);
++ irq_reg_writel(bgc, i + gc->irq_base, AT91_AIC5_SSR);
+ if (mask & gc->wake_active)
+- irq_reg_writel(1, bgc->reg_base + AT91_AIC5_IECR);
++ irq_reg_writel(bgc, 1, AT91_AIC5_IECR);
+ else
+- irq_reg_writel(1, bgc->reg_base + AT91_AIC5_IDCR);
++ irq_reg_writel(bgc, 1, AT91_AIC5_IDCR);
+ }
+ irq_gc_unlock(bgc);
+ }
+@@ -187,12 +186,11 @@ static void aic5_resume(struct irq_data *d)
+ if ((mask & gc->mask_cache) == (mask & gc->wake_active))
+ continue;
+
+- irq_reg_writel(i + gc->irq_base,
+- bgc->reg_base + AT91_AIC5_SSR);
++ irq_reg_writel(bgc, i + gc->irq_base, AT91_AIC5_SSR);
+ if (mask & gc->mask_cache)
+- irq_reg_writel(1, bgc->reg_base + AT91_AIC5_IECR);
++ irq_reg_writel(bgc, 1, AT91_AIC5_IECR);
+ else
+- irq_reg_writel(1, bgc->reg_base + AT91_AIC5_IDCR);
++ irq_reg_writel(bgc, 1, AT91_AIC5_IDCR);
+ }
+ irq_gc_unlock(bgc);
+ }
+@@ -207,10 +205,9 @@ static void aic5_pm_shutdown(struct irq_data *d)
+
+ irq_gc_lock(bgc);
+ for (i = 0; i < dgc->irqs_per_chip; i++) {
+- irq_reg_writel(i + gc->irq_base,
+- bgc->reg_base + AT91_AIC5_SSR);
+- irq_reg_writel(1, bgc->reg_base + AT91_AIC5_IDCR);
+- irq_reg_writel(1, bgc->reg_base + AT91_AIC5_ICCR);
++ irq_reg_writel(bgc, i + gc->irq_base, AT91_AIC5_SSR);
++ irq_reg_writel(bgc, 1, AT91_AIC5_IDCR);
++ irq_reg_writel(bgc, 1, AT91_AIC5_ICCR);
+ }
+ irq_gc_unlock(bgc);
+ }
+@@ -230,24 +227,24 @@ static void __init aic5_hw_init(struct irq_domain *domain)
+ * will not Lock out nIRQ
+ */
+ for (i = 0; i < 8; i++)
+- irq_reg_writel(0, gc->reg_base + AT91_AIC5_EOICR);
++ irq_reg_writel(gc, 0, AT91_AIC5_EOICR);
+
+ /*
+ * Spurious Interrupt ID in Spurious Vector Register.
+ * When there is no current interrupt, the IRQ Vector Register
+ * reads the value stored in AIC_SPU
+ */
+- irq_reg_writel(0xffffffff, gc->reg_base + AT91_AIC5_SPU);
++ irq_reg_writel(gc, 0xffffffff, AT91_AIC5_SPU);
+
+ /* No debugging in AIC: Debug (Protect) Control Register */
+- irq_reg_writel(0, gc->reg_base + AT91_AIC5_DCR);
++ irq_reg_writel(gc, 0, AT91_AIC5_DCR);
+
+ /* Disable and clear all interrupts initially */
+ for (i = 0; i < domain->revmap_size; i++) {
+- irq_reg_writel(i, gc->reg_base + AT91_AIC5_SSR);
+- irq_reg_writel(i, gc->reg_base + AT91_AIC5_SVR);
+- irq_reg_writel(1, gc->reg_base + AT91_AIC5_IDCR);
+- irq_reg_writel(1, gc->reg_base + AT91_AIC5_ICCR);
++ irq_reg_writel(gc, i, AT91_AIC5_SSR);
++ irq_reg_writel(gc, i, AT91_AIC5_SVR);
++ irq_reg_writel(gc, 1, AT91_AIC5_IDCR);
++ irq_reg_writel(gc, 1, AT91_AIC5_ICCR);
+ }
+ }
+
+@@ -273,11 +270,11 @@ static int aic5_irq_domain_xlate(struct irq_domain *d,
+ gc = dgc->gc[0];
+
+ irq_gc_lock(gc);
+- irq_reg_writel(*out_hwirq, gc->reg_base + AT91_AIC5_SSR);
+- smr = irq_reg_readl(gc->reg_base + AT91_AIC5_SMR);
++ irq_reg_writel(gc, *out_hwirq, AT91_AIC5_SSR);
++ smr = irq_reg_readl(gc, AT91_AIC5_SMR);
+ ret = aic_common_set_priority(intspec[2], &smr);
+ if (!ret)
+- irq_reg_writel(intspec[2] | smr, gc->reg_base + AT91_AIC5_SMR);
++ irq_reg_writel(gc, intspec[2] | smr, AT91_AIC5_SMR);
+ irq_gc_unlock(gc);
+
+ return ret;
+diff --git a/drivers/irqchip/irq-sunxi-nmi.c b/drivers/irqchip/irq-sunxi-nmi.c
+index eb9b59e8f122..6b2b582433bd 100644
+--- a/drivers/irqchip/irq-sunxi-nmi.c
++++ b/drivers/irqchip/irq-sunxi-nmi.c
+@@ -50,12 +50,12 @@ static struct sunxi_sc_nmi_reg_offs sun6i_reg_offs = {
+ static inline void sunxi_sc_nmi_write(struct irq_chip_generic *gc, u32 off,
+ u32 val)
+ {
+- irq_reg_writel(val, gc->reg_base + off);
++ irq_reg_writel(gc, val, off);
+ }
+
+ static inline u32 sunxi_sc_nmi_read(struct irq_chip_generic *gc, u32 off)
+ {
+- return irq_reg_readl(gc->reg_base + off);
++ return irq_reg_readl(gc, off);
+ }
+
+ static void sunxi_sc_nmi_handle_irq(unsigned int irq, struct irq_desc *desc)
+diff --git a/drivers/irqchip/irq-tb10x.c b/drivers/irqchip/irq-tb10x.c
+index 7c44c99bf1f2..accc20036a3c 100644
+--- a/drivers/irqchip/irq-tb10x.c
++++ b/drivers/irqchip/irq-tb10x.c
+@@ -43,12 +43,12 @@
+ static inline void ab_irqctl_writereg(struct irq_chip_generic *gc, u32 reg,
+ u32 val)
+ {
+- irq_reg_writel(val, gc->reg_base + reg);
++ irq_reg_writel(gc, val, reg);
+ }
+
+ static inline u32 ab_irqctl_readreg(struct irq_chip_generic *gc, u32 reg)
+ {
+- return irq_reg_readl(gc->reg_base + reg);
++ return irq_reg_readl(gc, reg);
+ }
+
+ static int tb10x_irq_set_type(struct irq_data *data, unsigned int flow_type)
+diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c
+index 9768ba6387ad..0a28c50fcb89 100644
+--- a/drivers/net/can/flexcan.c
++++ b/drivers/net/can/flexcan.c
+@@ -1341,11 +1341,10 @@ static int __maybe_unused flexcan_suspend(struct device *device)
+ struct flexcan_priv *priv = netdev_priv(dev);
+ int err;
+
+- err = flexcan_chip_disable(priv);
+- if (err)
+- return err;
+-
+ if (netif_running(dev)) {
++ err = flexcan_chip_disable(priv);
++ if (err)
++ return err;
+ netif_stop_queue(dev);
+ netif_device_detach(dev);
+ }
+@@ -1358,13 +1357,17 @@ static int __maybe_unused flexcan_resume(struct device *device)
+ {
+ struct net_device *dev = dev_get_drvdata(device);
+ struct flexcan_priv *priv = netdev_priv(dev);
++ int err;
+
+ priv->can.state = CAN_STATE_ERROR_ACTIVE;
+ if (netif_running(dev)) {
+ netif_device_attach(dev);
+ netif_start_queue(dev);
++ err = flexcan_chip_enable(priv);
++ if (err)
++ return err;
+ }
+- return flexcan_chip_enable(priv);
++ return 0;
+ }
+
+ static SIMPLE_DEV_PM_OPS(flexcan_pm_ops, flexcan_suspend, flexcan_resume);
+diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c
+index 894894f2ff93..81336acc7040 100644
+--- a/drivers/usb/core/config.c
++++ b/drivers/usb/core/config.c
+@@ -184,8 +184,10 @@ static int usb_parse_endpoint(struct device *ddev, int cfgno, int inum,
+ memcpy(&endpoint->desc, d, n);
+ INIT_LIST_HEAD(&endpoint->urb_list);
+
+- /* Fix up bInterval values outside the legal range. Use 32 ms if no
+- * proper value can be guessed. */
++ /*
++ * Fix up bInterval values outside the legal range.
++ * Use 10 or 8 ms if no proper value can be guessed.
++ */
+ i = 0; /* i = min, j = max, n = default */
+ j = 255;
+ if (usb_endpoint_xfer_int(d)) {
+@@ -193,13 +195,15 @@ static int usb_parse_endpoint(struct device *ddev, int cfgno, int inum,
+ switch (to_usb_device(ddev)->speed) {
+ case USB_SPEED_SUPER:
+ case USB_SPEED_HIGH:
+- /* Many device manufacturers are using full-speed
++ /*
++ * Many device manufacturers are using full-speed
+ * bInterval values in high-speed interrupt endpoint
+- * descriptors. Try to fix those and fall back to a
+- * 32 ms default value otherwise. */
++ * descriptors. Try to fix those and fall back to an
++ * 8-ms default value otherwise.
++ */
+ n = fls(d->bInterval*8);
+ if (n == 0)
+- n = 9; /* 32 ms = 2^(9-1) uframes */
++ n = 7; /* 8 ms = 2^(7-1) uframes */
+ j = 16;
+
+ /*
+@@ -214,10 +218,12 @@ static int usb_parse_endpoint(struct device *ddev, int cfgno, int inum,
+ }
+ break;
+ default: /* USB_SPEED_FULL or _LOW */
+- /* For low-speed, 10 ms is the official minimum.
++ /*
++ * For low-speed, 10 ms is the official minimum.
+ * But some "overclocked" devices might want faster
+- * polling so we'll allow it. */
+- n = 32;
++ * polling so we'll allow it.
++ */
++ n = 10;
+ break;
+ }
+ } else if (usb_endpoint_xfer_isoc(d)) {
+@@ -225,10 +231,10 @@ static int usb_parse_endpoint(struct device *ddev, int cfgno, int inum,
+ j = 16;
+ switch (to_usb_device(ddev)->speed) {
+ case USB_SPEED_HIGH:
+- n = 9; /* 32 ms = 2^(9-1) uframes */
++ n = 7; /* 8 ms = 2^(7-1) uframes */
+ break;
+ default: /* USB_SPEED_FULL */
+- n = 6; /* 32 ms = 2^(6-1) frames */
++ n = 4; /* 8 ms = 2^(4-1) frames */
+ break;
+ }
+ }
+diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
+index 51ff57497b91..c15dbffe660b 100644
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -839,6 +839,10 @@ void xhci_stop_endpoint_command_watchdog(unsigned long arg)
+ spin_lock_irqsave(&xhci->lock, flags);
+
+ ep->stop_cmds_pending--;
++ if (xhci->xhc_state & XHCI_STATE_REMOVING) {
++ spin_unlock_irqrestore(&xhci->lock, flags);
++ return;
++ }
+ if (xhci->xhc_state & XHCI_STATE_DYING) {
+ xhci_dbg_trace(xhci, trace_xhci_dbg_cancel_urb,
+ "Stop EP timer ran, but another timer marked "
+@@ -892,7 +896,7 @@ void xhci_stop_endpoint_command_watchdog(unsigned long arg)
+ spin_unlock_irqrestore(&xhci->lock, flags);
+ xhci_dbg_trace(xhci, trace_xhci_dbg_cancel_urb,
+ "Calling usb_hc_died()");
+- usb_hc_died(xhci_to_hcd(xhci)->primary_hcd);
++ usb_hc_died(xhci_to_hcd(xhci));
+ xhci_dbg_trace(xhci, trace_xhci_dbg_cancel_urb,
+ "xHCI host controller is dead.");
+ }
+diff --git a/drivers/usb/renesas_usbhs/mod.c b/drivers/usb/renesas_usbhs/mod.c
+index 9a705b15b3a1..cf274b8c63fe 100644
+--- a/drivers/usb/renesas_usbhs/mod.c
++++ b/drivers/usb/renesas_usbhs/mod.c
+@@ -277,9 +277,16 @@ static irqreturn_t usbhs_interrupt(int irq, void *data)
+ usbhs_write(priv, INTSTS0, ~irq_state.intsts0 & INTSTS0_MAGIC);
+ usbhs_write(priv, INTSTS1, ~irq_state.intsts1 & INTSTS1_MAGIC);
+
+- usbhs_write(priv, BRDYSTS, ~irq_state.brdysts);
++ /*
++ * The driver should not clear the xxxSTS after the line of
++ * "call irq callback functions" because each "if" statement is
++ * possible to call the callback function for avoiding any side effects.
++ */
++ if (irq_state.intsts0 & BRDY)
++ usbhs_write(priv, BRDYSTS, ~irq_state.brdysts);
+ usbhs_write(priv, NRDYSTS, ~irq_state.nrdysts);
+- usbhs_write(priv, BEMPSTS, ~irq_state.bempsts);
++ if (irq_state.intsts0 & BEMP)
++ usbhs_write(priv, BEMPSTS, ~irq_state.bempsts);
+
+ /*
+ * call irq callback functions
+diff --git a/drivers/usb/serial/usb-serial-simple.c b/drivers/usb/serial/usb-serial-simple.c
+index a1f2e2a05bc5..40de275cddf4 100644
+--- a/drivers/usb/serial/usb-serial-simple.c
++++ b/drivers/usb/serial/usb-serial-simple.c
+@@ -54,7 +54,8 @@ DEVICE(funsoft, FUNSOFT_IDS);
+ /* Infineon Flashloader driver */
+ #define FLASHLOADER_IDS() \
+ { USB_DEVICE_INTERFACE_CLASS(0x058b, 0x0041, USB_CLASS_CDC_DATA) }, \
+- { USB_DEVICE(0x8087, 0x0716) }
++ { USB_DEVICE(0x8087, 0x0716) }, \
++ { USB_DEVICE(0x8087, 0x0801) }
+ DEVICE(flashloader, FLASHLOADER_IDS);
+
+ /* ViVOpay USB Serial Driver */
+diff --git a/fs/autofs4/autofs_i.h b/fs/autofs4/autofs_i.h
+index 8e98cf954bab..cecd252a3e01 100644
+--- a/fs/autofs4/autofs_i.h
++++ b/fs/autofs4/autofs_i.h
+@@ -79,9 +79,13 @@ struct autofs_info {
+ };
+
+ #define AUTOFS_INF_EXPIRING (1<<0) /* dentry is in the process of expiring */
+-#define AUTOFS_INF_NO_RCU (1<<1) /* the dentry is being considered
++#define AUTOFS_INF_WANT_EXPIRE (1<<1) /* the dentry is being considered
+ * for expiry, so RCU_walk is
+- * not permitted
++ * not permitted. If it progresses to
++ * actual expiry attempt, the flag is
++ * not cleared when EXPIRING is set -
++ * in that case it gets cleared only
++ * when it comes to clearing EXPIRING.
+ */
+ #define AUTOFS_INF_PENDING (1<<2) /* dentry pending mount */
+
+diff --git a/fs/autofs4/expire.c b/fs/autofs4/expire.c
+index dcdec6fd33c6..513b8e5d151c 100644
+--- a/fs/autofs4/expire.c
++++ b/fs/autofs4/expire.c
+@@ -321,19 +321,17 @@ struct dentry *autofs4_expire_direct(struct super_block *sb,
+ if (ino->flags & AUTOFS_INF_PENDING)
+ goto out;
+ if (!autofs4_direct_busy(mnt, root, timeout, do_now)) {
+- ino->flags |= AUTOFS_INF_NO_RCU;
++ ino->flags |= AUTOFS_INF_WANT_EXPIRE;
+ spin_unlock(&sbi->fs_lock);
+ synchronize_rcu();
+ spin_lock(&sbi->fs_lock);
+ if (!autofs4_direct_busy(mnt, root, timeout, do_now)) {
+ ino->flags |= AUTOFS_INF_EXPIRING;
+- smp_mb();
+- ino->flags &= ~AUTOFS_INF_NO_RCU;
+ init_completion(&ino->expire_complete);
+ spin_unlock(&sbi->fs_lock);
+ return root;
+ }
+- ino->flags &= ~AUTOFS_INF_NO_RCU;
++ ino->flags &= ~AUTOFS_INF_WANT_EXPIRE;
+ }
+ out:
+ spin_unlock(&sbi->fs_lock);
+@@ -425,6 +423,7 @@ static struct dentry *should_expire(struct dentry *dentry,
+ }
+ return NULL;
+ }
++
+ /*
+ * Find an eligible tree to time-out
+ * A tree is eligible if :-
+@@ -440,6 +439,7 @@ struct dentry *autofs4_expire_indirect(struct super_block *sb,
+ struct dentry *root = sb->s_root;
+ struct dentry *dentry;
+ struct dentry *expired;
++ struct dentry *found;
+ struct autofs_info *ino;
+
+ if (!root)
+@@ -450,31 +450,46 @@ struct dentry *autofs4_expire_indirect(struct super_block *sb,
+
+ dentry = NULL;
+ while ((dentry = get_next_positive_subdir(dentry, root))) {
++ int flags = how;
++
+ spin_lock(&sbi->fs_lock);
+ ino = autofs4_dentry_ino(dentry);
+- if (ino->flags & AUTOFS_INF_NO_RCU)
+- expired = NULL;
+- else
+- expired = should_expire(dentry, mnt, timeout, how);
+- if (!expired) {
++ if (ino->flags & AUTOFS_INF_WANT_EXPIRE) {
+ spin_unlock(&sbi->fs_lock);
+ continue;
+ }
++ spin_unlock(&sbi->fs_lock);
++
++ expired = should_expire(dentry, mnt, timeout, flags);
++ if (!expired)
++ continue;
++
++ spin_lock(&sbi->fs_lock);
+ ino = autofs4_dentry_ino(expired);
+- ino->flags |= AUTOFS_INF_NO_RCU;
++ ino->flags |= AUTOFS_INF_WANT_EXPIRE;
+ spin_unlock(&sbi->fs_lock);
+ synchronize_rcu();
+- spin_lock(&sbi->fs_lock);
+- if (should_expire(expired, mnt, timeout, how)) {
+- if (expired != dentry)
+- dput(dentry);
+- goto found;
+- }
+
+- ino->flags &= ~AUTOFS_INF_NO_RCU;
++ /* Make sure a reference is not taken on found if
++ * things have changed.
++ */
++ flags &= ~AUTOFS_EXP_LEAVES;
++ found = should_expire(expired, mnt, timeout, how);
++ if (!found || found != expired)
++ /* Something has changed, continue */
++ goto next;
++
+ if (expired != dentry)
+- dput(expired);
++ dput(dentry);
++
++ spin_lock(&sbi->fs_lock);
++ goto found;
++next:
++ spin_lock(&sbi->fs_lock);
++ ino->flags &= ~AUTOFS_INF_WANT_EXPIRE;
+ spin_unlock(&sbi->fs_lock);
++ if (expired != dentry)
++ dput(expired);
+ }
+ return NULL;
+
+@@ -482,17 +497,8 @@ found:
+ DPRINTK("returning %p %.*s",
+ expired, (int)expired->d_name.len, expired->d_name.name);
+ ino->flags |= AUTOFS_INF_EXPIRING;
+- smp_mb();
+- ino->flags &= ~AUTOFS_INF_NO_RCU;
+ init_completion(&ino->expire_complete);
+ spin_unlock(&sbi->fs_lock);
+- spin_lock(&sbi->lookup_lock);
+- spin_lock(&expired->d_parent->d_lock);
+- spin_lock_nested(&expired->d_lock, DENTRY_D_LOCK_NESTED);
+- list_move(&expired->d_parent->d_subdirs, &expired->d_child);
+- spin_unlock(&expired->d_lock);
+- spin_unlock(&expired->d_parent->d_lock);
+- spin_unlock(&sbi->lookup_lock);
+ return expired;
+ }
+
+@@ -501,15 +507,27 @@ int autofs4_expire_wait(struct dentry *dentry, int rcu_walk)
+ struct autofs_sb_info *sbi = autofs4_sbi(dentry->d_sb);
+ struct autofs_info *ino = autofs4_dentry_ino(dentry);
+ int status;
++ int state;
+
+ /* Block on any pending expire */
+- if (!(ino->flags & (AUTOFS_INF_EXPIRING | AUTOFS_INF_NO_RCU)))
++ if (!(ino->flags & AUTOFS_INF_WANT_EXPIRE))
+ return 0;
+ if (rcu_walk)
+ return -ECHILD;
+
++retry:
+ spin_lock(&sbi->fs_lock);
+- if (ino->flags & AUTOFS_INF_EXPIRING) {
++ state = ino->flags & (AUTOFS_INF_WANT_EXPIRE | AUTOFS_INF_EXPIRING);
++ if (state == AUTOFS_INF_WANT_EXPIRE) {
++ spin_unlock(&sbi->fs_lock);
++ /*
++ * Possibly being selected for expire, wait until
++ * it's selected or not.
++ */
++ schedule_timeout_uninterruptible(HZ/10);
++ goto retry;
++ }
++ if (state & AUTOFS_INF_EXPIRING) {
+ spin_unlock(&sbi->fs_lock);
+
+ DPRINTK("waiting for expire %p name=%.*s",
+@@ -561,7 +579,7 @@ int autofs4_expire_run(struct super_block *sb,
+ ino = autofs4_dentry_ino(dentry);
+ /* avoid rapid-fire expire attempts if expiry fails */
+ ino->last_used = now;
+- ino->flags &= ~AUTOFS_INF_EXPIRING;
++ ino->flags &= ~(AUTOFS_INF_EXPIRING|AUTOFS_INF_WANT_EXPIRE);
+ complete_all(&ino->expire_complete);
+ spin_unlock(&sbi->fs_lock);
+
+@@ -589,7 +607,7 @@ int autofs4_do_expire_multi(struct super_block *sb, struct vfsmount *mnt,
+ spin_lock(&sbi->fs_lock);
+ /* avoid rapid-fire expire attempts if expiry fails */
+ ino->last_used = now;
+- ino->flags &= ~AUTOFS_INF_EXPIRING;
++ ino->flags &= ~(AUTOFS_INF_EXPIRING|AUTOFS_INF_WANT_EXPIRE);
+ complete_all(&ino->expire_complete);
+ spin_unlock(&sbi->fs_lock);
+ dput(dentry);
+diff --git a/fs/autofs4/root.c b/fs/autofs4/root.c
+index 0822c9eacc56..21b5bb13af65 100644
+--- a/fs/autofs4/root.c
++++ b/fs/autofs4/root.c
+@@ -459,7 +459,7 @@ static int autofs4_d_manage(struct dentry *dentry, bool rcu_walk)
+ * a mount-trap.
+ */
+ struct inode *inode;
+- if (ino->flags & (AUTOFS_INF_EXPIRING | AUTOFS_INF_NO_RCU))
++ if (ino->flags & AUTOFS_INF_WANT_EXPIRE)
+ return 0;
+ if (d_mountpoint(dentry))
+ return 0;
+diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
+index d96b2bc444c8..dd8526a659f8 100644
+--- a/fs/btrfs/ioctl.c
++++ b/fs/btrfs/ioctl.c
+@@ -1627,6 +1627,9 @@ static noinline int btrfs_ioctl_snap_create_transid(struct file *file,
+ int namelen;
+ int ret = 0;
+
++ if (!S_ISDIR(file_inode(file)->i_mode))
++ return -ENOTDIR;
++
+ ret = mnt_want_write_file(file);
+ if (ret)
+ goto out;
+@@ -1684,6 +1687,9 @@ static noinline int btrfs_ioctl_snap_create(struct file *file,
+ struct btrfs_ioctl_vol_args *vol_args;
+ int ret;
+
++ if (!S_ISDIR(file_inode(file)->i_mode))
++ return -ENOTDIR;
++
+ vol_args = memdup_user(arg, sizeof(*vol_args));
+ if (IS_ERR(vol_args))
+ return PTR_ERR(vol_args);
+@@ -1707,6 +1713,9 @@ static noinline int btrfs_ioctl_snap_create_v2(struct file *file,
+ bool readonly = false;
+ struct btrfs_qgroup_inherit *inherit = NULL;
+
++ if (!S_ISDIR(file_inode(file)->i_mode))
++ return -ENOTDIR;
++
+ vol_args = memdup_user(arg, sizeof(*vol_args));
+ if (IS_ERR(vol_args))
+ return PTR_ERR(vol_args);
+@@ -2335,6 +2344,9 @@ static noinline int btrfs_ioctl_snap_destroy(struct file *file,
+ int ret;
+ int err = 0;
+
++ if (!S_ISDIR(dir->i_mode))
++ return -ENOTDIR;
++
+ vol_args = memdup_user(arg, sizeof(*vol_args));
+ if (IS_ERR(vol_args))
+ return PTR_ERR(vol_args);
+diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
+index f6c20cf6090e..ccad76a482ca 100644
+--- a/fs/btrfs/tree-log.c
++++ b/fs/btrfs/tree-log.c
+@@ -2604,6 +2604,8 @@ int btrfs_sync_log(struct btrfs_trans_handle *trans,
+ }
+
+ if (log_root_tree->log_transid_committed >= root_log_ctx.log_transid) {
++ blk_finish_plug(&plug);
++ list_del_init(&root_log_ctx.list);
+ mutex_unlock(&log_root_tree->log_mutex);
+ ret = root_log_ctx.log_ret;
+ goto out;
+diff --git a/fs/notify/fanotify/fanotify.c b/fs/notify/fanotify/fanotify.c
+index 30d3addfad75..f6298b974316 100644
+--- a/fs/notify/fanotify/fanotify.c
++++ b/fs/notify/fanotify/fanotify.c
+@@ -67,18 +67,7 @@ static int fanotify_get_response(struct fsnotify_group *group,
+
+ pr_debug("%s: group=%p event=%p\n", __func__, group, event);
+
+- wait_event(group->fanotify_data.access_waitq, event->response ||
+- atomic_read(&group->fanotify_data.bypass_perm));
+-
+- if (!event->response) { /* bypass_perm set */
+- /*
+- * Event was canceled because group is being destroyed. Remove
+- * it from group's event list because we are responsible for
+- * freeing the permission event.
+- */
+- fsnotify_remove_event(group, &event->fae.fse);
+- return 0;
+- }
++ wait_event(group->fanotify_data.access_waitq, event->response);
+
+ /* userspace responded, convert to something usable */
+ switch (event->response) {
+diff --git a/fs/notify/fanotify/fanotify_user.c b/fs/notify/fanotify/fanotify_user.c
+index c991616acca9..f2639f5724e8 100644
+--- a/fs/notify/fanotify/fanotify_user.c
++++ b/fs/notify/fanotify/fanotify_user.c
+@@ -358,16 +358,20 @@ static int fanotify_release(struct inode *ignored, struct file *file)
+
+ #ifdef CONFIG_FANOTIFY_ACCESS_PERMISSIONS
+ struct fanotify_perm_event_info *event, *next;
++ struct fsnotify_event *fsn_event;
+
+ /*
+- * There may be still new events arriving in the notification queue
+- * but since userspace cannot use fanotify fd anymore, no event can
+- * enter or leave access_list by now.
++ * Stop new events from arriving in the notification queue. since
++ * userspace cannot use fanotify fd anymore, no event can enter or
++ * leave access_list by now either.
+ */
+- spin_lock(&group->fanotify_data.access_lock);
+-
+- atomic_inc(&group->fanotify_data.bypass_perm);
++ fsnotify_group_stop_queueing(group);
+
++ /*
++ * Process all permission events on access_list and notification queue
++ * and simulate reply from userspace.
++ */
++ spin_lock(&group->fanotify_data.access_lock);
+ list_for_each_entry_safe(event, next, &group->fanotify_data.access_list,
+ fae.fse.list) {
+ pr_debug("%s: found group=%p event=%p\n", __func__, group,
+@@ -379,12 +383,21 @@ static int fanotify_release(struct inode *ignored, struct file *file)
+ spin_unlock(&group->fanotify_data.access_lock);
+
+ /*
+- * Since bypass_perm is set, newly queued events will not wait for
+- * access response. Wake up the already sleeping ones now.
+- * synchronize_srcu() in fsnotify_destroy_group() will wait for all
+- * processes sleeping in fanotify_handle_event() waiting for access
+- * response and thus also for all permission events to be freed.
++ * Destroy all non-permission events. For permission events just
++ * dequeue them and set the response. They will be freed once the
++ * response is consumed and fanotify_get_response() returns.
+ */
++ mutex_lock(&group->notification_mutex);
++ while (!fsnotify_notify_queue_is_empty(group)) {
++ fsn_event = fsnotify_remove_first_event(group);
++ if (!(fsn_event->mask & FAN_ALL_PERM_EVENTS))
++ fsnotify_destroy_event(group, fsn_event);
++ else
++ FANOTIFY_PE(fsn_event)->response = FAN_ALLOW;
++ }
++ mutex_unlock(&group->notification_mutex);
++
++ /* Response for all permission events it set, wakeup waiters */
+ wake_up(&group->fanotify_data.access_waitq);
+ #endif
+
+@@ -742,7 +755,6 @@ SYSCALL_DEFINE2(fanotify_init, unsigned int, flags, unsigned int, event_f_flags)
+ spin_lock_init(&group->fanotify_data.access_lock);
+ init_waitqueue_head(&group->fanotify_data.access_waitq);
+ INIT_LIST_HEAD(&group->fanotify_data.access_list);
+- atomic_set(&group->fanotify_data.bypass_perm, 0);
+ #endif
+ switch (flags & FAN_ALL_CLASS_BITS) {
+ case FAN_CLASS_NOTIF:
+diff --git a/fs/notify/group.c b/fs/notify/group.c
+index d16b62cb2854..18eb30c6bd8f 100644
+--- a/fs/notify/group.c
++++ b/fs/notify/group.c
+@@ -40,6 +40,17 @@ static void fsnotify_final_destroy_group(struct fsnotify_group *group)
+ }
+
+ /*
++ * Stop queueing new events for this group. Once this function returns
++ * fsnotify_add_event() will not add any new events to the group's queue.
++ */
++void fsnotify_group_stop_queueing(struct fsnotify_group *group)
++{
++ mutex_lock(&group->notification_mutex);
++ group->shutdown = true;
++ mutex_unlock(&group->notification_mutex);
++}
++
++/*
+ * Trying to get rid of a group. Remove all marks, flush all events and release
+ * the group reference.
+ * Note that another thread calling fsnotify_clear_marks_by_group() may still
+@@ -47,6 +58,14 @@ static void fsnotify_final_destroy_group(struct fsnotify_group *group)
+ */
+ void fsnotify_destroy_group(struct fsnotify_group *group)
+ {
++ /*
++ * Stop queueing new events. The code below is careful enough to not
++ * require this but fanotify needs to stop queuing events even before
++ * fsnotify_destroy_group() is called and this makes the other callers
++ * of fsnotify_destroy_group() to see the same behavior.
++ */
++ fsnotify_group_stop_queueing(group);
++
+ /* clear all inode marks for this group */
+ fsnotify_clear_marks_by_group(group);
+
+diff --git a/fs/notify/notification.c b/fs/notify/notification.c
+index a95d8e037aeb..e455e83ceeeb 100644
+--- a/fs/notify/notification.c
++++ b/fs/notify/notification.c
+@@ -82,7 +82,8 @@ void fsnotify_destroy_event(struct fsnotify_group *group,
+ * Add an event to the group notification queue. The group can later pull this
+ * event off the queue to deal with. The function returns 0 if the event was
+ * added to the queue, 1 if the event was merged with some other queued event,
+- * 2 if the queue of events has overflown.
++ * 2 if the event was not queued - either the queue of events has overflown
++ * or the group is shutting down.
+ */
+ int fsnotify_add_event(struct fsnotify_group *group,
+ struct fsnotify_event *event,
+@@ -96,6 +97,11 @@ int fsnotify_add_event(struct fsnotify_group *group,
+
+ mutex_lock(&group->notification_mutex);
+
++ if (group->shutdown) {
++ mutex_unlock(&group->notification_mutex);
++ return 2;
++ }
++
+ if (group->q_len >= group->max_events) {
+ ret = 2;
+ /* Queue overflow event only if it isn't already queued */
+@@ -126,21 +132,6 @@ queue:
+ }
+
+ /*
+- * Remove @event from group's notification queue. It is the responsibility of
+- * the caller to destroy the event.
+- */
+-void fsnotify_remove_event(struct fsnotify_group *group,
+- struct fsnotify_event *event)
+-{
+- mutex_lock(&group->notification_mutex);
+- if (!list_empty(&event->list)) {
+- list_del_init(&event->list);
+- group->q_len--;
+- }
+- mutex_unlock(&group->notification_mutex);
+-}
+-
+-/*
+ * Remove and return the first event from the notification list. It is the
+ * responsibility of the caller to destroy the obtained event
+ */
+diff --git a/fs/ocfs2/dlm/dlmconvert.c b/fs/ocfs2/dlm/dlmconvert.c
+index f90931335c6b..2e11658676eb 100644
+--- a/fs/ocfs2/dlm/dlmconvert.c
++++ b/fs/ocfs2/dlm/dlmconvert.c
+@@ -262,7 +262,6 @@ enum dlm_status dlmconvert_remote(struct dlm_ctxt *dlm,
+ struct dlm_lock *lock, int flags, int type)
+ {
+ enum dlm_status status;
+- u8 old_owner = res->owner;
+
+ mlog(0, "type=%d, convert_type=%d, busy=%d\n", lock->ml.type,
+ lock->ml.convert_type, res->state & DLM_LOCK_RES_IN_PROGRESS);
+@@ -329,7 +328,6 @@ enum dlm_status dlmconvert_remote(struct dlm_ctxt *dlm,
+
+ spin_lock(&res->spinlock);
+ res->state &= ~DLM_LOCK_RES_IN_PROGRESS;
+- lock->convert_pending = 0;
+ /* if it failed, move it back to granted queue.
+ * if master returns DLM_NORMAL and then down before sending ast,
+ * it may have already been moved to granted queue, reset to
+@@ -338,12 +336,14 @@ enum dlm_status dlmconvert_remote(struct dlm_ctxt *dlm,
+ if (status != DLM_NOTQUEUED)
+ dlm_error(status);
+ dlm_revert_pending_convert(res, lock);
+- } else if ((res->state & DLM_LOCK_RES_RECOVERING) ||
+- (old_owner != res->owner)) {
+- mlog(0, "res %.*s is in recovering or has been recovered.\n",
+- res->lockname.len, res->lockname.name);
++ } else if (!lock->convert_pending) {
++ mlog(0, "%s: res %.*s, owner died and lock has been moved back "
++ "to granted list, retry convert.\n",
++ dlm->name, res->lockname.len, res->lockname.name);
+ status = DLM_RECOVERING;
+ }
++
++ lock->convert_pending = 0;
+ bail:
+ spin_unlock(&res->spinlock);
+
+diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c
+index 9d5adfd6b326..2adcb9876e91 100644
+--- a/fs/ocfs2/file.c
++++ b/fs/ocfs2/file.c
+@@ -1515,7 +1515,8 @@ static int ocfs2_zero_partial_clusters(struct inode *inode,
+ u64 start, u64 len)
+ {
+ int ret = 0;
+- u64 tmpend, end = start + len;
++ u64 tmpend = 0;
++ u64 end = start + len;
+ struct ocfs2_super *osb = OCFS2_SB(inode->i_sb);
+ unsigned int csize = osb->s_clustersize;
+ handle_t *handle;
+@@ -1547,18 +1548,31 @@ static int ocfs2_zero_partial_clusters(struct inode *inode,
+ }
+
+ /*
+- * We want to get the byte offset of the end of the 1st cluster.
++ * If start is on a cluster boundary and end is somewhere in another
++ * cluster, we have not COWed the cluster starting at start, unless
++ * end is also within the same cluster. So, in this case, we skip this
++ * first call to ocfs2_zero_range_for_truncate() truncate and move on
++ * to the next one.
+ */
+- tmpend = (u64)osb->s_clustersize + (start & ~(osb->s_clustersize - 1));
+- if (tmpend > end)
+- tmpend = end;
++ if ((start & (csize - 1)) != 0) {
++ /*
++ * We want to get the byte offset of the end of the 1st
++ * cluster.
++ */
++ tmpend = (u64)osb->s_clustersize +
++ (start & ~(osb->s_clustersize - 1));
++ if (tmpend > end)
++ tmpend = end;
+
+- trace_ocfs2_zero_partial_clusters_range1((unsigned long long)start,
+- (unsigned long long)tmpend);
++ trace_ocfs2_zero_partial_clusters_range1(
++ (unsigned long long)start,
++ (unsigned long long)tmpend);
+
+- ret = ocfs2_zero_range_for_truncate(inode, handle, start, tmpend);
+- if (ret)
+- mlog_errno(ret);
++ ret = ocfs2_zero_range_for_truncate(inode, handle, start,
++ tmpend);
++ if (ret)
++ mlog_errno(ret);
++ }
+
+ if (tmpend < end) {
+ /*
+diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c
+index 963dba388243..b5bddae27be2 100644
+--- a/fs/overlayfs/super.c
++++ b/fs/overlayfs/super.c
+@@ -566,11 +566,11 @@ retry:
+ goto out_dput;
+
+ err = vfs_removexattr(work, XATTR_NAME_POSIX_ACL_DEFAULT);
+- if (err && err != -ENODATA)
++ if (err && err != -ENODATA && err != -EOPNOTSUPP)
+ goto out_dput;
+
+ err = vfs_removexattr(work, XATTR_NAME_POSIX_ACL_ACCESS);
+- if (err && err != -ENODATA)
++ if (err && err != -ENODATA && err != -EOPNOTSUPP)
+ goto out_dput;
+
+ /* Clear any inherited mode bits */
+diff --git a/include/asm-generic/uaccess.h b/include/asm-generic/uaccess.h
+index 72d8803832ff..32901d11f8c4 100644
+--- a/include/asm-generic/uaccess.h
++++ b/include/asm-generic/uaccess.h
+@@ -163,9 +163,10 @@ static inline __must_check long __copy_to_user(void __user *to,
+
+ #define put_user(x, ptr) \
+ ({ \
++ void *__p = (ptr); \
+ might_fault(); \
+- access_ok(VERIFY_WRITE, ptr, sizeof(*ptr)) ? \
+- __put_user(x, ptr) : \
++ access_ok(VERIFY_WRITE, __p, sizeof(*ptr)) ? \
++ __put_user((x), ((__typeof__(*(ptr)) *)__p)) : \
+ -EFAULT; \
+ })
+
+@@ -225,17 +226,22 @@ extern int __put_user_bad(void) __attribute__((noreturn));
+
+ #define get_user(x, ptr) \
+ ({ \
++ const void *__p = (ptr); \
+ might_fault(); \
+- access_ok(VERIFY_READ, ptr, sizeof(*ptr)) ? \
+- __get_user(x, ptr) : \
+- -EFAULT; \
++ access_ok(VERIFY_READ, __p, sizeof(*ptr)) ? \
++ __get_user((x), (__typeof__(*(ptr)) *)__p) : \
++ ((x) = (__typeof__(*(ptr)))0,-EFAULT); \
+ })
+
+ #ifndef __get_user_fn
+ static inline int __get_user_fn(size_t size, const void __user *ptr, void *x)
+ {
+- size = __copy_from_user(x, ptr, size);
+- return size ? -EFAULT : size;
++ size_t n = __copy_from_user(x, ptr, size);
++ if (unlikely(n)) {
++ memset(x + (size - n), 0, n);
++ return -EFAULT;
++ }
++ return 0;
+ }
+
+ #define __get_user_fn(sz, u, k) __get_user_fn(sz, u, k)
+@@ -255,11 +261,13 @@ extern int __get_user_bad(void) __attribute__((noreturn));
+ static inline long copy_from_user(void *to,
+ const void __user * from, unsigned long n)
+ {
++ unsigned long res = n;
+ might_fault();
+- if (access_ok(VERIFY_READ, from, n))
+- return __copy_from_user(to, from, n);
+- else
+- return n;
++ if (likely(access_ok(VERIFY_READ, from, n)))
++ res = __copy_from_user(to, from, n);
++ if (unlikely(res))
++ memset(to + (n - res), 0, res);
++ return res;
+ }
+
+ static inline long copy_to_user(void __user *to,
+diff --git a/include/linux/fsnotify_backend.h b/include/linux/fsnotify_backend.h
+index ca060d7c4fa6..b36d7a908051 100644
+--- a/include/linux/fsnotify_backend.h
++++ b/include/linux/fsnotify_backend.h
+@@ -150,6 +150,7 @@ struct fsnotify_group {
+ #define FS_PRIO_1 1 /* fanotify content based access control */
+ #define FS_PRIO_2 2 /* fanotify pre-content access */
+ unsigned int priority;
++ bool shutdown; /* group is being shut down, don't queue more events */
+
+ /* stores all fastpath marks assoc with this group so they can be cleaned on unregister */
+ struct mutex mark_mutex; /* protect marks_list */
+@@ -181,7 +182,6 @@ struct fsnotify_group {
+ spinlock_t access_lock;
+ struct list_head access_list;
+ wait_queue_head_t access_waitq;
+- atomic_t bypass_perm;
+ #endif /* CONFIG_FANOTIFY_ACCESS_PERMISSIONS */
+ int f_flags;
+ unsigned int max_marks;
+@@ -314,6 +314,8 @@ extern struct fsnotify_group *fsnotify_alloc_group(const struct fsnotify_ops *op
+ extern void fsnotify_get_group(struct fsnotify_group *group);
+ /* drop reference on a group from fsnotify_alloc_group */
+ extern void fsnotify_put_group(struct fsnotify_group *group);
++/* group destruction begins, stop queuing new events */
++extern void fsnotify_group_stop_queueing(struct fsnotify_group *group);
+ /* destroy group */
+ extern void fsnotify_destroy_group(struct fsnotify_group *group);
+ /* fasync handler function */
+@@ -326,8 +328,6 @@ extern int fsnotify_add_event(struct fsnotify_group *group,
+ struct fsnotify_event *event,
+ int (*merge)(struct list_head *,
+ struct fsnotify_event *));
+-/* Remove passed event from groups notification queue */
+-extern void fsnotify_remove_event(struct fsnotify_group *group, struct fsnotify_event *event);
+ /* true if the group notification queue is empty */
+ extern bool fsnotify_notify_queue_is_empty(struct fsnotify_group *group);
+ /* return, but do not dequeue the first event on the notification queue */
+diff --git a/include/linux/irq.h b/include/linux/irq.h
+index 03f48d936f66..c91ce60746f7 100644
+--- a/include/linux/irq.h
++++ b/include/linux/irq.h
+@@ -20,6 +20,7 @@
+ #include <linux/errno.h>
+ #include <linux/topology.h>
+ #include <linux/wait.h>
++#include <linux/io.h>
+
+ #include <asm/irq.h>
+ #include <asm/ptrace.h>
+@@ -639,13 +640,6 @@ void arch_teardown_hwirq(unsigned int irq);
+ void irq_init_desc(unsigned int irq);
+ #endif
+
+-#ifndef irq_reg_writel
+-# define irq_reg_writel(val, addr) writel(val, addr)
+-#endif
+-#ifndef irq_reg_readl
+-# define irq_reg_readl(addr) readl(addr)
+-#endif
+-
+ /**
+ * struct irq_chip_regs - register offsets for struct irq_gci
+ * @enable: Enable register offset to reg_base
+@@ -821,4 +815,26 @@ static inline void irq_gc_lock(struct irq_chip_generic *gc) { }
+ static inline void irq_gc_unlock(struct irq_chip_generic *gc) { }
+ #endif
+
++/*
++ * The irqsave variants are for usage in non interrupt code. Do not use
++ * them in irq_chip callbacks. Use irq_gc_lock() instead.
++ */
++#define irq_gc_lock_irqsave(gc, flags) \
++ raw_spin_lock_irqsave(&(gc)->lock, flags)
++
++#define irq_gc_unlock_irqrestore(gc, flags) \
++ raw_spin_unlock_irqrestore(&(gc)->lock, flags)
++
++static inline void irq_reg_writel(struct irq_chip_generic *gc,
++ u32 val, int reg_offset)
++{
++ writel(val, gc->reg_base + reg_offset);
++}
++
++static inline u32 irq_reg_readl(struct irq_chip_generic *gc,
++ int reg_offset)
++{
++ return readl(gc->reg_base + reg_offset);
++}
++
+ #endif /* _LINUX_IRQ_H */
+diff --git a/include/linux/pagemap.h b/include/linux/pagemap.h
+index 4b3736f7065c..30a8f531236c 100644
+--- a/include/linux/pagemap.h
++++ b/include/linux/pagemap.h
+@@ -594,56 +594,56 @@ static inline int fault_in_pages_readable(const char __user *uaddr, int size)
+ */
+ static inline int fault_in_multipages_writeable(char __user *uaddr, int size)
+ {
+- int ret = 0;
+ char __user *end = uaddr + size - 1;
+
+ if (unlikely(size == 0))
+- return ret;
++ return 0;
+
++ if (unlikely(uaddr > end))
++ return -EFAULT;
+ /*
+ * Writing zeroes into userspace here is OK, because we know that if
+ * the zero gets there, we'll be overwriting it.
+ */
+- while (uaddr <= end) {
+- ret = __put_user(0, uaddr);
+- if (ret != 0)
+- return ret;
++ do {
++ if (unlikely(__put_user(0, uaddr) != 0))
++ return -EFAULT;
+ uaddr += PAGE_SIZE;
+- }
++ } while (uaddr <= end);
+
+ /* Check whether the range spilled into the next page. */
+ if (((unsigned long)uaddr & PAGE_MASK) ==
+ ((unsigned long)end & PAGE_MASK))
+- ret = __put_user(0, end);
++ return __put_user(0, end);
+
+- return ret;
++ return 0;
+ }
+
+ static inline int fault_in_multipages_readable(const char __user *uaddr,
+ int size)
+ {
+ volatile char c;
+- int ret = 0;
+ const char __user *end = uaddr + size - 1;
+
+ if (unlikely(size == 0))
+- return ret;
++ return 0;
+
+- while (uaddr <= end) {
+- ret = __get_user(c, uaddr);
+- if (ret != 0)
+- return ret;
++ if (unlikely(uaddr > end))
++ return -EFAULT;
++
++ do {
++ if (unlikely(__get_user(c, uaddr) != 0))
++ return -EFAULT;
+ uaddr += PAGE_SIZE;
+- }
++ } while (uaddr <= end);
+
+ /* Check whether the range spilled into the next page. */
+ if (((unsigned long)uaddr & PAGE_MASK) ==
+ ((unsigned long)end & PAGE_MASK)) {
+- ret = __get_user(c, end);
+- (void)c;
++ return __get_user(c, end);
+ }
+
+- return ret;
++ return 0;
+ }
+
+ int add_to_page_cache_locked(struct page *page, struct address_space *mapping,
+diff --git a/kernel/irq/generic-chip.c b/kernel/irq/generic-chip.c
+index cf80e7b0ddab..db458c68e392 100644
+--- a/kernel/irq/generic-chip.c
++++ b/kernel/irq/generic-chip.c
+@@ -39,7 +39,7 @@ void irq_gc_mask_disable_reg(struct irq_data *d)
+ u32 mask = d->mask;
+
+ irq_gc_lock(gc);
+- irq_reg_writel(mask, gc->reg_base + ct->regs.disable);
++ irq_reg_writel(gc, mask, ct->regs.disable);
+ *ct->mask_cache &= ~mask;
+ irq_gc_unlock(gc);
+ }
+@@ -59,7 +59,7 @@ void irq_gc_mask_set_bit(struct irq_data *d)
+
+ irq_gc_lock(gc);
+ *ct->mask_cache |= mask;
+- irq_reg_writel(*ct->mask_cache, gc->reg_base + ct->regs.mask);
++ irq_reg_writel(gc, *ct->mask_cache, ct->regs.mask);
+ irq_gc_unlock(gc);
+ }
+ EXPORT_SYMBOL_GPL(irq_gc_mask_set_bit);
+@@ -79,7 +79,7 @@ void irq_gc_mask_clr_bit(struct irq_data *d)
+
+ irq_gc_lock(gc);
+ *ct->mask_cache &= ~mask;
+- irq_reg_writel(*ct->mask_cache, gc->reg_base + ct->regs.mask);
++ irq_reg_writel(gc, *ct->mask_cache, ct->regs.mask);
+ irq_gc_unlock(gc);
+ }
+ EXPORT_SYMBOL_GPL(irq_gc_mask_clr_bit);
+@@ -98,7 +98,7 @@ void irq_gc_unmask_enable_reg(struct irq_data *d)
+ u32 mask = d->mask;
+
+ irq_gc_lock(gc);
+- irq_reg_writel(mask, gc->reg_base + ct->regs.enable);
++ irq_reg_writel(gc, mask, ct->regs.enable);
+ *ct->mask_cache |= mask;
+ irq_gc_unlock(gc);
+ }
+@@ -114,7 +114,7 @@ void irq_gc_ack_set_bit(struct irq_data *d)
+ u32 mask = d->mask;
+
+ irq_gc_lock(gc);
+- irq_reg_writel(mask, gc->reg_base + ct->regs.ack);
++ irq_reg_writel(gc, mask, ct->regs.ack);
+ irq_gc_unlock(gc);
+ }
+ EXPORT_SYMBOL_GPL(irq_gc_ack_set_bit);
+@@ -130,7 +130,7 @@ void irq_gc_ack_clr_bit(struct irq_data *d)
+ u32 mask = ~d->mask;
+
+ irq_gc_lock(gc);
+- irq_reg_writel(mask, gc->reg_base + ct->regs.ack);
++ irq_reg_writel(gc, mask, ct->regs.ack);
+ irq_gc_unlock(gc);
+ }
+
+@@ -145,8 +145,8 @@ void irq_gc_mask_disable_reg_and_ack(struct irq_data *d)
+ u32 mask = d->mask;
+
+ irq_gc_lock(gc);
+- irq_reg_writel(mask, gc->reg_base + ct->regs.mask);
+- irq_reg_writel(mask, gc->reg_base + ct->regs.ack);
++ irq_reg_writel(gc, mask, ct->regs.mask);
++ irq_reg_writel(gc, mask, ct->regs.ack);
+ irq_gc_unlock(gc);
+ }
+
+@@ -161,7 +161,7 @@ void irq_gc_eoi(struct irq_data *d)
+ u32 mask = d->mask;
+
+ irq_gc_lock(gc);
+- irq_reg_writel(mask, gc->reg_base + ct->regs.eoi);
++ irq_reg_writel(gc, mask, ct->regs.eoi);
+ irq_gc_unlock(gc);
+ }
+
+@@ -245,7 +245,7 @@ irq_gc_init_mask_cache(struct irq_chip_generic *gc, enum irq_gc_flags flags)
+ }
+ ct[i].mask_cache = mskptr;
+ if (flags & IRQ_GC_INIT_MASK_CACHE)
+- *mskptr = irq_reg_readl(gc->reg_base + mskreg);
++ *mskptr = irq_reg_readl(gc, mskreg);
+ }
+ }
+
+diff --git a/kernel/sched/core.c b/kernel/sched/core.c
+index 2f774edcc4e8..44de06747e41 100644
+--- a/kernel/sched/core.c
++++ b/kernel/sched/core.c
+@@ -1705,6 +1705,28 @@ try_to_wake_up(struct task_struct *p, unsigned int state, int wake_flags)
+ success = 1; /* we're going to change ->state */
+ cpu = task_cpu(p);
+
++ /*
++ * Ensure we load p->on_rq _after_ p->state, otherwise it would
++ * be possible to, falsely, observe p->on_rq == 0 and get stuck
++ * in smp_cond_load_acquire() below.
++ *
++ * sched_ttwu_pending() try_to_wake_up()
++ * [S] p->on_rq = 1; [L] P->state
++ * UNLOCK rq->lock -----.
++ * \
++ * +--- RMB
++ * schedule() /
++ * LOCK rq->lock -----'
++ * UNLOCK rq->lock
++ *
++ * [task p]
++ * [S] p->state = UNINTERRUPTIBLE [L] p->on_rq
++ *
++ * Pairs with the UNLOCK+LOCK on rq->lock from the
++ * last wakeup of our task and the schedule that got our task
++ * current.
++ */
++ smp_rmb();
+ if (p->on_rq && ttwu_remote(p, wake_flags))
+ goto stat;
+
+diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
+index e34efa766031..953572c17b3d 100644
+--- a/net/ipv6/addrconf.c
++++ b/net/ipv6/addrconf.c
+@@ -1689,6 +1689,7 @@ void addrconf_dad_failure(struct inet6_ifaddr *ifp)
+ spin_unlock_bh(&ifp->state_lock);
+
+ addrconf_mod_dad_work(ifp, 0);
++ in6_ifa_put(ifp);
+ }
+
+ /* Join to solicited addr multicast group.
+@@ -3277,6 +3278,7 @@ static void addrconf_dad_work(struct work_struct *w)
+ addrconf_dad_begin(ifp);
+ goto out;
+ } else if (action == DAD_ABORT) {
++ in6_ifa_hold(ifp);
+ addrconf_dad_stop(ifp, 1);
+ goto out;
+ }
+diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
+index 0286733f2e8c..7f9a3c932d5b 100644
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -6033,7 +6033,7 @@ static int nl80211_channel_switch(struct sk_buff *skb, struct genl_info *info)
+
+ params.n_counter_offsets_presp = len / sizeof(u16);
+ if (rdev->wiphy.max_num_csa_counters &&
+- (params.n_counter_offsets_beacon >
++ (params.n_counter_offsets_presp >
+ rdev->wiphy.max_num_csa_counters))
+ return -EINVAL;
+
+diff --git a/net/wireless/wext-core.c b/net/wireless/wext-core.c
+index c753211cb83f..b50ee5d622e1 100644
+--- a/net/wireless/wext-core.c
++++ b/net/wireless/wext-core.c
+@@ -955,29 +955,8 @@ static int wireless_process_ioctl(struct net *net, struct ifreq *ifr,
+ return private(dev, iwr, cmd, info, handler);
+ }
+ /* Old driver API : call driver ioctl handler */
+- if (dev->netdev_ops->ndo_do_ioctl) {
+-#ifdef CONFIG_COMPAT
+- if (info->flags & IW_REQUEST_FLAG_COMPAT) {
+- int ret = 0;
+- struct iwreq iwr_lcl;
+- struct compat_iw_point *iwp_compat = (void *) &iwr->u.data;
+-
+- memcpy(&iwr_lcl, iwr, sizeof(struct iwreq));
+- iwr_lcl.u.data.pointer = compat_ptr(iwp_compat->pointer);
+- iwr_lcl.u.data.length = iwp_compat->length;
+- iwr_lcl.u.data.flags = iwp_compat->flags;
+-
+- ret = dev->netdev_ops->ndo_do_ioctl(dev, (void *) &iwr_lcl, cmd);
+-
+- iwp_compat->pointer = ptr_to_compat(iwr_lcl.u.data.pointer);
+- iwp_compat->length = iwr_lcl.u.data.length;
+- iwp_compat->flags = iwr_lcl.u.data.flags;
+-
+- return ret;
+- } else
+-#endif
+- return dev->netdev_ops->ndo_do_ioctl(dev, ifr, cmd);
+- }
++ if (dev->netdev_ops->ndo_do_ioctl)
++ return dev->netdev_ops->ndo_do_ioctl(dev, ifr, cmd);
+ return -EOPNOTSUPP;
+ }
+
+diff --git a/sound/core/timer.c b/sound/core/timer.c
+index 5c769ea59b68..c9da76e05b3f 100644
+--- a/sound/core/timer.c
++++ b/sound/core/timer.c
+@@ -35,6 +35,9 @@
+ #include <sound/initval.h>
+ #include <linux/kmod.h>
+
++/* internal flags */
++#define SNDRV_TIMER_IFLG_PAUSED 0x00010000
++
+ #if IS_ENABLED(CONFIG_SND_HRTIMER)
+ #define DEFAULT_TIMER_LIMIT 4
+ #elif IS_ENABLED(CONFIG_SND_RTCTIMER)
+@@ -296,8 +299,21 @@ int snd_timer_open(struct snd_timer_instance **ti,
+ get_device(&timer->card->card_dev);
+ timeri->slave_class = tid->dev_sclass;
+ timeri->slave_id = slave_id;
+- if (list_empty(&timer->open_list_head) && timer->hw.open)
+- timer->hw.open(timer);
++
++ if (list_empty(&timer->open_list_head) && timer->hw.open) {
++ int err = timer->hw.open(timer);
++ if (err) {
++ kfree(timeri->owner);
++ kfree(timeri);
++
++ if (timer->card)
++ put_device(&timer->card->card_dev);
++ module_put(timer->module);
++ mutex_unlock(®ister_mutex);
++ return err;
++ }
++ }
++
+ list_add_tail(&timeri->open_list, &timer->open_list_head);
+ snd_timer_check_master(timeri);
+ mutex_unlock(®ister_mutex);
+@@ -305,8 +321,6 @@ int snd_timer_open(struct snd_timer_instance **ti,
+ return 0;
+ }
+
+-static int _snd_timer_stop(struct snd_timer_instance *timeri, int event);
+-
+ /*
+ * close a timer instance
+ */
+@@ -395,7 +409,6 @@ unsigned long snd_timer_resolution(struct snd_timer_instance *timeri)
+ static void snd_timer_notify1(struct snd_timer_instance *ti, int event)
+ {
+ struct snd_timer *timer;
+- unsigned long flags;
+ unsigned long resolution = 0;
+ struct snd_timer_instance *ts;
+ struct timespec tstamp;
+@@ -419,34 +432,66 @@ static void snd_timer_notify1(struct snd_timer_instance *ti, int event)
+ return;
+ if (timer->hw.flags & SNDRV_TIMER_HW_SLAVE)
+ return;
+- spin_lock_irqsave(&timer->lock, flags);
+ list_for_each_entry(ts, &ti->slave_active_head, active_list)
+ if (ts->ccallback)
+ ts->ccallback(ts, event + 100, &tstamp, resolution);
+- spin_unlock_irqrestore(&timer->lock, flags);
+ }
+
+-static int snd_timer_start1(struct snd_timer *timer, struct snd_timer_instance *timeri,
+- unsigned long sticks)
++/* start/continue a master timer */
++static int snd_timer_start1(struct snd_timer_instance *timeri,
++ bool start, unsigned long ticks)
+ {
++ struct snd_timer *timer;
++ int result;
++ unsigned long flags;
++
++ timer = timeri->timer;
++ if (!timer)
++ return -EINVAL;
++
++ spin_lock_irqsave(&timer->lock, flags);
++ if (timer->card && timer->card->shutdown) {
++ result = -ENODEV;
++ goto unlock;
++ }
++ if (timeri->flags & (SNDRV_TIMER_IFLG_RUNNING |
++ SNDRV_TIMER_IFLG_START)) {
++ result = -EBUSY;
++ goto unlock;
++ }
++
++ if (start)
++ timeri->ticks = timeri->cticks = ticks;
++ else if (!timeri->cticks)
++ timeri->cticks = 1;
++ timeri->pticks = 0;
++
+ list_move_tail(&timeri->active_list, &timer->active_list_head);
+ if (timer->running) {
+ if (timer->hw.flags & SNDRV_TIMER_HW_SLAVE)
+ goto __start_now;
+ timer->flags |= SNDRV_TIMER_FLG_RESCHED;
+ timeri->flags |= SNDRV_TIMER_IFLG_START;
+- return 1; /* delayed start */
++ result = 1; /* delayed start */
+ } else {
+- timer->sticks = sticks;
++ if (start)
++ timer->sticks = ticks;
+ timer->hw.start(timer);
+ __start_now:
+ timer->running++;
+ timeri->flags |= SNDRV_TIMER_IFLG_RUNNING;
+- return 0;
++ result = 0;
+ }
++ snd_timer_notify1(timeri, start ? SNDRV_TIMER_EVENT_START :
++ SNDRV_TIMER_EVENT_CONTINUE);
++ unlock:
++ spin_unlock_irqrestore(&timer->lock, flags);
++ return result;
+ }
+
+-static int snd_timer_start_slave(struct snd_timer_instance *timeri)
++/* start/continue a slave timer */
++static int snd_timer_start_slave(struct snd_timer_instance *timeri,
++ bool start)
+ {
+ unsigned long flags;
+
+@@ -460,88 +505,37 @@ static int snd_timer_start_slave(struct snd_timer_instance *timeri)
+ spin_lock(&timeri->timer->lock);
+ list_add_tail(&timeri->active_list,
+ &timeri->master->slave_active_head);
++ snd_timer_notify1(timeri, start ? SNDRV_TIMER_EVENT_START :
++ SNDRV_TIMER_EVENT_CONTINUE);
+ spin_unlock(&timeri->timer->lock);
+ }
+ spin_unlock_irqrestore(&slave_active_lock, flags);
+ return 1; /* delayed start */
+ }
+
+-/*
+- * start the timer instance
+- */
+-int snd_timer_start(struct snd_timer_instance *timeri, unsigned int ticks)
+-{
+- struct snd_timer *timer;
+- int result = -EINVAL;
+- unsigned long flags;
+-
+- if (timeri == NULL || ticks < 1)
+- return -EINVAL;
+- if (timeri->flags & SNDRV_TIMER_IFLG_SLAVE) {
+- result = snd_timer_start_slave(timeri);
+- if (result >= 0)
+- snd_timer_notify1(timeri, SNDRV_TIMER_EVENT_START);
+- return result;
+- }
+- timer = timeri->timer;
+- if (timer == NULL)
+- return -EINVAL;
+- if (timer->card && timer->card->shutdown)
+- return -ENODEV;
+- spin_lock_irqsave(&timer->lock, flags);
+- if (timeri->flags & (SNDRV_TIMER_IFLG_RUNNING |
+- SNDRV_TIMER_IFLG_START)) {
+- result = -EBUSY;
+- goto unlock;
+- }
+- timeri->ticks = timeri->cticks = ticks;
+- timeri->pticks = 0;
+- result = snd_timer_start1(timer, timeri, ticks);
+- unlock:
+- spin_unlock_irqrestore(&timer->lock, flags);
+- if (result >= 0)
+- snd_timer_notify1(timeri, SNDRV_TIMER_EVENT_START);
+- return result;
+-}
+-
+-static int _snd_timer_stop(struct snd_timer_instance *timeri, int event)
++/* stop/pause a master timer */
++static int snd_timer_stop1(struct snd_timer_instance *timeri, bool stop)
+ {
+ struct snd_timer *timer;
++ int result = 0;
+ unsigned long flags;
+
+- if (snd_BUG_ON(!timeri))
+- return -ENXIO;
+-
+- if (timeri->flags & SNDRV_TIMER_IFLG_SLAVE) {
+- spin_lock_irqsave(&slave_active_lock, flags);
+- if (!(timeri->flags & SNDRV_TIMER_IFLG_RUNNING)) {
+- spin_unlock_irqrestore(&slave_active_lock, flags);
+- return -EBUSY;
+- }
+- if (timeri->timer)
+- spin_lock(&timeri->timer->lock);
+- timeri->flags &= ~SNDRV_TIMER_IFLG_RUNNING;
+- list_del_init(&timeri->ack_list);
+- list_del_init(&timeri->active_list);
+- if (timeri->timer)
+- spin_unlock(&timeri->timer->lock);
+- spin_unlock_irqrestore(&slave_active_lock, flags);
+- goto __end;
+- }
+ timer = timeri->timer;
+ if (!timer)
+ return -EINVAL;
+ spin_lock_irqsave(&timer->lock, flags);
+ if (!(timeri->flags & (SNDRV_TIMER_IFLG_RUNNING |
+ SNDRV_TIMER_IFLG_START))) {
+- spin_unlock_irqrestore(&timer->lock, flags);
+- return -EBUSY;
++ result = -EBUSY;
++ goto unlock;
+ }
+ list_del_init(&timeri->ack_list);
+ list_del_init(&timeri->active_list);
+- if (timer->card && timer->card->shutdown) {
+- spin_unlock_irqrestore(&timer->lock, flags);
+- return 0;
++ if (timer->card && timer->card->shutdown)
++ goto unlock;
++ if (stop) {
++ timeri->cticks = timeri->ticks;
++ timeri->pticks = 0;
+ }
+ if ((timeri->flags & SNDRV_TIMER_IFLG_RUNNING) &&
+ !(--timer->running)) {
+@@ -556,35 +550,64 @@ static int _snd_timer_stop(struct snd_timer_instance *timeri, int event)
+ }
+ }
+ timeri->flags &= ~(SNDRV_TIMER_IFLG_RUNNING | SNDRV_TIMER_IFLG_START);
++ if (stop)
++ timeri->flags &= ~SNDRV_TIMER_IFLG_PAUSED;
++ else
++ timeri->flags |= SNDRV_TIMER_IFLG_PAUSED;
++ snd_timer_notify1(timeri, stop ? SNDRV_TIMER_EVENT_STOP :
++ SNDRV_TIMER_EVENT_CONTINUE);
++ unlock:
+ spin_unlock_irqrestore(&timer->lock, flags);
+- __end:
+- if (event != SNDRV_TIMER_EVENT_RESOLUTION)
+- snd_timer_notify1(timeri, event);
++ return result;
++}
++
++/* stop/pause a slave timer */
++static int snd_timer_stop_slave(struct snd_timer_instance *timeri, bool stop)
++{
++ unsigned long flags;
++
++ spin_lock_irqsave(&slave_active_lock, flags);
++ if (!(timeri->flags & SNDRV_TIMER_IFLG_RUNNING)) {
++ spin_unlock_irqrestore(&slave_active_lock, flags);
++ return -EBUSY;
++ }
++ timeri->flags &= ~SNDRV_TIMER_IFLG_RUNNING;
++ if (timeri->timer) {
++ spin_lock(&timeri->timer->lock);
++ list_del_init(&timeri->ack_list);
++ list_del_init(&timeri->active_list);
++ snd_timer_notify1(timeri, stop ? SNDRV_TIMER_EVENT_STOP :
++ SNDRV_TIMER_EVENT_CONTINUE);
++ spin_unlock(&timeri->timer->lock);
++ }
++ spin_unlock_irqrestore(&slave_active_lock, flags);
+ return 0;
+ }
+
+ /*
++ * start the timer instance
++ */
++int snd_timer_start(struct snd_timer_instance *timeri, unsigned int ticks)
++{
++ if (timeri == NULL || ticks < 1)
++ return -EINVAL;
++ if (timeri->flags & SNDRV_TIMER_IFLG_SLAVE)
++ return snd_timer_start_slave(timeri, true);
++ else
++ return snd_timer_start1(timeri, true, ticks);
++}
++
++/*
+ * stop the timer instance.
+ *
+ * do not call this from the timer callback!
+ */
+ int snd_timer_stop(struct snd_timer_instance *timeri)
+ {
+- struct snd_timer *timer;
+- unsigned long flags;
+- int err;
+-
+- err = _snd_timer_stop(timeri, SNDRV_TIMER_EVENT_STOP);
+- if (err < 0)
+- return err;
+- timer = timeri->timer;
+- if (!timer)
+- return -EINVAL;
+- spin_lock_irqsave(&timer->lock, flags);
+- timeri->cticks = timeri->ticks;
+- timeri->pticks = 0;
+- spin_unlock_irqrestore(&timer->lock, flags);
+- return 0;
++ if (timeri->flags & SNDRV_TIMER_IFLG_SLAVE)
++ return snd_timer_stop_slave(timeri, true);
++ else
++ return snd_timer_stop1(timeri, true);
+ }
+
+ /*
+@@ -592,32 +615,14 @@ int snd_timer_stop(struct snd_timer_instance *timeri)
+ */
+ int snd_timer_continue(struct snd_timer_instance *timeri)
+ {
+- struct snd_timer *timer;
+- int result = -EINVAL;
+- unsigned long flags;
++ /* timer can continue only after pause */
++ if (!(timeri->flags & SNDRV_TIMER_IFLG_PAUSED))
++ return -EINVAL;
+
+- if (timeri == NULL)
+- return result;
+ if (timeri->flags & SNDRV_TIMER_IFLG_SLAVE)
+- return snd_timer_start_slave(timeri);
+- timer = timeri->timer;
+- if (! timer)
+- return -EINVAL;
+- if (timer->card && timer->card->shutdown)
+- return -ENODEV;
+- spin_lock_irqsave(&timer->lock, flags);
+- if (timeri->flags & SNDRV_TIMER_IFLG_RUNNING) {
+- result = -EBUSY;
+- goto unlock;
+- }
+- if (!timeri->cticks)
+- timeri->cticks = 1;
+- timeri->pticks = 0;
+- result = snd_timer_start1(timer, timeri, timer->sticks);
+- unlock:
+- spin_unlock_irqrestore(&timer->lock, flags);
+- snd_timer_notify1(timeri, SNDRV_TIMER_EVENT_CONTINUE);
+- return result;
++ return snd_timer_start_slave(timeri, false);
++ else
++ return snd_timer_start1(timeri, false, 0);
+ }
+
+ /*
+@@ -625,7 +630,10 @@ int snd_timer_continue(struct snd_timer_instance *timeri)
+ */
+ int snd_timer_pause(struct snd_timer_instance * timeri)
+ {
+- return _snd_timer_stop(timeri, SNDRV_TIMER_EVENT_PAUSE);
++ if (timeri->flags & SNDRV_TIMER_IFLG_SLAVE)
++ return snd_timer_stop_slave(timeri, false);
++ else
++ return snd_timer_stop1(timeri, false);
+ }
+
+ /*
+@@ -839,6 +847,7 @@ int snd_timer_new(struct snd_card *card, char *id, struct snd_timer_id *tid,
+ timer->tmr_subdevice = tid->subdevice;
+ if (id)
+ strlcpy(timer->id, id, sizeof(timer->id));
++ timer->sticks = 1;
+ INIT_LIST_HEAD(&timer->device_list);
+ INIT_LIST_HEAD(&timer->open_list_head);
+ INIT_LIST_HEAD(&timer->active_list_head);
+@@ -1827,6 +1836,9 @@ static int snd_timer_user_continue(struct file *file)
+ tu = file->private_data;
+ if (!tu->timeri)
+ return -EBADFD;
++ /* start timer instead of continue if it's not used before */
++ if (!(tu->timeri->flags & SNDRV_TIMER_IFLG_PAUSED))
++ return snd_timer_user_start(file);
+ tu->timeri->lost = 0;
+ return (err = snd_timer_continue(tu->timeri)) < 0 ? err : 0;
+ }
+diff --git a/sound/firewire/fireworks/fireworks.h b/sound/firewire/fireworks/fireworks.h
+index 084d414b228c..b431c34b2d74 100644
+--- a/sound/firewire/fireworks/fireworks.h
++++ b/sound/firewire/fireworks/fireworks.h
+@@ -106,7 +106,6 @@ struct snd_efw {
+ u8 *resp_buf;
+ u8 *pull_ptr;
+ u8 *push_ptr;
+- unsigned int resp_queues;
+ };
+
+ int snd_efw_transaction_cmd(struct fw_unit *unit,
+diff --git a/sound/firewire/fireworks/fireworks_hwdep.c b/sound/firewire/fireworks/fireworks_hwdep.c
+index 33df8655fe81..2e1d9a23920c 100644
+--- a/sound/firewire/fireworks/fireworks_hwdep.c
++++ b/sound/firewire/fireworks/fireworks_hwdep.c
+@@ -25,6 +25,7 @@ hwdep_read_resp_buf(struct snd_efw *efw, char __user *buf, long remained,
+ {
+ unsigned int length, till_end, type;
+ struct snd_efw_transaction *t;
++ u8 *pull_ptr;
+ long count = 0;
+
+ if (remained < sizeof(type) + sizeof(struct snd_efw_transaction))
+@@ -38,8 +39,17 @@ hwdep_read_resp_buf(struct snd_efw *efw, char __user *buf, long remained,
+ buf += sizeof(type);
+
+ /* write into buffer as many responses as possible */
+- while (efw->resp_queues > 0) {
+- t = (struct snd_efw_transaction *)(efw->pull_ptr);
++ spin_lock_irq(&efw->lock);
++
++ /*
++ * When another task reaches here during this task's access to user
++ * space, it picks up current position in buffer and can read the same
++ * series of responses.
++ */
++ pull_ptr = efw->pull_ptr;
++
++ while (efw->push_ptr != pull_ptr) {
++ t = (struct snd_efw_transaction *)(pull_ptr);
+ length = be32_to_cpu(t->length) * sizeof(__be32);
+
+ /* confirm enough space for this response */
+@@ -49,26 +59,39 @@ hwdep_read_resp_buf(struct snd_efw *efw, char __user *buf, long remained,
+ /* copy from ring buffer to user buffer */
+ while (length > 0) {
+ till_end = snd_efw_resp_buf_size -
+- (unsigned int)(efw->pull_ptr - efw->resp_buf);
++ (unsigned int)(pull_ptr - efw->resp_buf);
+ till_end = min_t(unsigned int, length, till_end);
+
+- if (copy_to_user(buf, efw->pull_ptr, till_end))
++ spin_unlock_irq(&efw->lock);
++
++ if (copy_to_user(buf, pull_ptr, till_end))
+ return -EFAULT;
+
+- efw->pull_ptr += till_end;
+- if (efw->pull_ptr >= efw->resp_buf +
+- snd_efw_resp_buf_size)
+- efw->pull_ptr -= snd_efw_resp_buf_size;
++ spin_lock_irq(&efw->lock);
++
++ pull_ptr += till_end;
++ if (pull_ptr >= efw->resp_buf + snd_efw_resp_buf_size)
++ pull_ptr -= snd_efw_resp_buf_size;
+
+ length -= till_end;
+ buf += till_end;
+ count += till_end;
+ remained -= till_end;
+ }
+-
+- efw->resp_queues--;
+ }
+
++ /*
++ * All of tasks can read from the buffer nearly simultaneously, but the
++ * last position for each task is different depending on the length of
++ * given buffer. Here, for simplicity, a position of buffer is set by
++ * the latest task. It's better for a listening application to allow one
++ * thread to read from the buffer. Unless, each task can read different
++ * sequence of responses depending on variation of buffer length.
++ */
++ efw->pull_ptr = pull_ptr;
++
++ spin_unlock_irq(&efw->lock);
++
+ return count;
+ }
+
+@@ -76,14 +99,17 @@ static long
+ hwdep_read_locked(struct snd_efw *efw, char __user *buf, long count,
+ loff_t *offset)
+ {
+- union snd_firewire_event event;
++ union snd_firewire_event event = {
++ .lock_status.type = SNDRV_FIREWIRE_EVENT_LOCK_STATUS,
++ };
+
+- memset(&event, 0, sizeof(event));
++ spin_lock_irq(&efw->lock);
+
+- event.lock_status.type = SNDRV_FIREWIRE_EVENT_LOCK_STATUS;
+ event.lock_status.status = (efw->dev_lock_count > 0);
+ efw->dev_lock_changed = false;
+
++ spin_unlock_irq(&efw->lock);
++
+ count = min_t(long, count, sizeof(event.lock_status));
+
+ if (copy_to_user(buf, &event, count))
+@@ -98,10 +124,15 @@ hwdep_read(struct snd_hwdep *hwdep, char __user *buf, long count,
+ {
+ struct snd_efw *efw = hwdep->private_data;
+ DEFINE_WAIT(wait);
++ bool dev_lock_changed;
++ bool queued;
+
+ spin_lock_irq(&efw->lock);
+
+- while ((!efw->dev_lock_changed) && (efw->resp_queues == 0)) {
++ dev_lock_changed = efw->dev_lock_changed;
++ queued = efw->push_ptr != efw->pull_ptr;
++
++ while (!dev_lock_changed && !queued) {
+ prepare_to_wait(&efw->hwdep_wait, &wait, TASK_INTERRUPTIBLE);
+ spin_unlock_irq(&efw->lock);
+ schedule();
+@@ -109,15 +140,17 @@ hwdep_read(struct snd_hwdep *hwdep, char __user *buf, long count,
+ if (signal_pending(current))
+ return -ERESTARTSYS;
+ spin_lock_irq(&efw->lock);
++ dev_lock_changed = efw->dev_lock_changed;
++ queued = efw->push_ptr != efw->pull_ptr;
+ }
+
+- if (efw->dev_lock_changed)
++ spin_unlock_irq(&efw->lock);
++
++ if (dev_lock_changed)
+ count = hwdep_read_locked(efw, buf, count, offset);
+- else if (efw->resp_queues > 0)
++ else if (queued)
+ count = hwdep_read_resp_buf(efw, buf, count, offset);
+
+- spin_unlock_irq(&efw->lock);
+-
+ return count;
+ }
+
+@@ -160,7 +193,7 @@ hwdep_poll(struct snd_hwdep *hwdep, struct file *file, poll_table *wait)
+ poll_wait(file, &efw->hwdep_wait, wait);
+
+ spin_lock_irq(&efw->lock);
+- if (efw->dev_lock_changed || (efw->resp_queues > 0))
++ if (efw->dev_lock_changed || efw->pull_ptr != efw->push_ptr)
+ events = POLLIN | POLLRDNORM;
+ else
+ events = 0;
+diff --git a/sound/firewire/fireworks/fireworks_proc.c b/sound/firewire/fireworks/fireworks_proc.c
+index 0639dcb13f7d..beb0a0ffee57 100644
+--- a/sound/firewire/fireworks/fireworks_proc.c
++++ b/sound/firewire/fireworks/fireworks_proc.c
+@@ -188,8 +188,8 @@ proc_read_queues_state(struct snd_info_entry *entry,
+ else
+ consumed = (unsigned int)(efw->push_ptr - efw->pull_ptr);
+
+- snd_iprintf(buffer, "%d %d/%d\n",
+- efw->resp_queues, consumed, snd_efw_resp_buf_size);
++ snd_iprintf(buffer, "%d/%d\n",
++ consumed, snd_efw_resp_buf_size);
+ }
+
+ static void
+diff --git a/sound/firewire/fireworks/fireworks_transaction.c b/sound/firewire/fireworks/fireworks_transaction.c
+index 2a85e4209f0b..8e9abbb6b68c 100644
+--- a/sound/firewire/fireworks/fireworks_transaction.c
++++ b/sound/firewire/fireworks/fireworks_transaction.c
+@@ -121,11 +121,11 @@ copy_resp_to_buf(struct snd_efw *efw, void *data, size_t length, int *rcode)
+ size_t capacity, till_end;
+ struct snd_efw_transaction *t;
+
+- spin_lock_irq(&efw->lock);
+-
+ t = (struct snd_efw_transaction *)data;
+ length = min_t(size_t, be32_to_cpu(t->length) * sizeof(u32), length);
+
++ spin_lock_irq(&efw->lock);
++
+ if (efw->push_ptr < efw->pull_ptr)
+ capacity = (unsigned int)(efw->pull_ptr - efw->push_ptr);
+ else
+@@ -155,7 +155,6 @@ copy_resp_to_buf(struct snd_efw *efw, void *data, size_t length, int *rcode)
+ }
+
+ /* for hwdep */
+- efw->resp_queues++;
+ wake_up(&efw->hwdep_wait);
+
+ *rcode = RCODE_COMPLETE;
+diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
+index 7a44d07c797d..5ace1fb54595 100644
+--- a/sound/usb/quirks.c
++++ b/sound/usb/quirks.c
+@@ -1127,6 +1127,7 @@ bool snd_usb_get_sample_rate_quirk(struct snd_usb_audio *chip)
+ case USB_ID(0x04D8, 0xFEEA): /* Benchmark DAC1 Pre */
+ case USB_ID(0x0556, 0x0014): /* Phoenix Audio TMX320VC */
+ case USB_ID(0x074D, 0x3553): /* Outlaw RR2150 (Micronas UAC3553B) */
++ case USB_ID(0x1901, 0x0191): /* GE B850V3 CP2114 audio interface */
+ case USB_ID(0x1de7, 0x0013): /* Phoenix Audio MT202exe */
+ case USB_ID(0x1de7, 0x0014): /* Phoenix Audio TMX320 */
+ case USB_ID(0x1de7, 0x0114): /* Phoenix Audio MT202pcs */
^ permalink raw reply related [flat|nested] 67+ messages in thread
* [gentoo-commits] proj/linux-patches:3.18 commit in: /
@ 2016-11-01 9:36 Alice Ferrazzi
0 siblings, 0 replies; 67+ messages in thread
From: Alice Ferrazzi @ 2016-11-01 9:36 UTC (permalink / raw
To: gentoo-commits
commit: 97a0e1c0517542f965b73dac372a47f9e72d2562
Author: Alice Ferrazzi <alicef <AT> gentoo <DOT> org>
AuthorDate: Tue Nov 1 09:35:09 2016 +0000
Commit: Alice Ferrazzi <alicef <AT> gentoo <DOT> org>
CommitDate: Tue Nov 1 09:35:09 2016 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=97a0e1c0
Linux patch 3.18.44
0000_README | 4 ++
1043_linux-3.18.44.patch | 174 +++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 178 insertions(+)
diff --git a/0000_README b/0000_README
index cc667fc..bfb562d 100644
--- a/0000_README
+++ b/0000_README
@@ -215,6 +215,10 @@ Patch: 1042_linux-3.18.43.patch
From: http://www.kernel.org
Desc: Linux 3.18.43
+Patch: 1043_linux-3.18.44.patch
+From: http://www.kernel.org
+Desc: Linux 3.18.44
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1043_linux-3.18.44.patch b/1043_linux-3.18.44.patch
new file mode 100644
index 0000000..2661d2c
--- /dev/null
+++ b/1043_linux-3.18.44.patch
@@ -0,0 +1,174 @@
+diff --git a/Makefile b/Makefile
+index 28912c341bd8..05b64e6d1456 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 18
+-SUBLEVEL = 43
++SUBLEVEL = 44
+ EXTRAVERSION =
+ NAME = Diseased Newt
+
+diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
+index 88635b301694..69608a4f554b 100644
+--- a/arch/x86/kernel/cpu/common.c
++++ b/arch/x86/kernel/cpu/common.c
+@@ -291,10 +291,9 @@ __setup("nosmap", setup_disable_smap);
+
+ static __always_inline void setup_smap(struct cpuinfo_x86 *c)
+ {
+- unsigned long eflags;
++ unsigned long eflags = native_save_fl();
+
+ /* This should have been cleared long ago */
+- raw_local_save_flags(eflags);
+ BUG_ON(eflags & X86_EFLAGS_AC);
+
+ if (cpu_has(c, X86_FEATURE_SMAP)) {
+diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
+index dfe835d21b15..0fa8fd9adeba 100644
+--- a/drivers/usb/host/xhci-hub.c
++++ b/drivers/usb/host/xhci-hub.c
+@@ -619,8 +619,30 @@ static u32 xhci_get_port_status(struct usb_hcd *hcd,
+ if ((raw_port_status & PORT_RESET) ||
+ !(raw_port_status & PORT_PE))
+ return 0xffffffff;
+- if (time_after_eq(jiffies,
+- bus_state->resume_done[wIndex])) {
++ /* did port event handler already start resume timing? */
++ if (!bus_state->resume_done[wIndex]) {
++ /* If not, maybe we are in a host initated resume? */
++ if (test_bit(wIndex, &bus_state->resuming_ports)) {
++ /* Host initated resume doesn't time the resume
++ * signalling using resume_done[].
++ * It manually sets RESUME state, sleeps 20ms
++ * and sets U0 state. This should probably be
++ * changed, but not right now.
++ */
++ } else {
++ /* port resume was discovered now and here,
++ * start resume timing
++ */
++ unsigned long timeout = jiffies +
++ msecs_to_jiffies(USB_RESUME_TIMEOUT);
++
++ set_bit(wIndex, &bus_state->resuming_ports);
++ bus_state->resume_done[wIndex] = timeout;
++ mod_timer(&hcd->rh_timer, timeout);
++ }
++ /* Has resume been signalled for USB_RESUME_TIME yet? */
++ } else if (time_after_eq(jiffies,
++ bus_state->resume_done[wIndex])) {
+ int time_left;
+
+ xhci_dbg(xhci, "Resume USB2 port %d\n",
+@@ -661,13 +683,24 @@ static u32 xhci_get_port_status(struct usb_hcd *hcd,
+ } else {
+ /*
+ * The resume has been signaling for less than
+- * 20ms. Report the port status as SUSPEND,
+- * let the usbcore check port status again
+- * and clear resume signaling later.
++ * USB_RESUME_TIME. Report the port status as SUSPEND,
++ * let the usbcore check port status again and clear
++ * resume signaling later.
+ */
+ status |= USB_PORT_STAT_SUSPEND;
+ }
+ }
++ /*
++ * Clear stale usb2 resume signalling variables in case port changed
++ * state during resume signalling. For example on error
++ */
++ if ((bus_state->resume_done[wIndex] ||
++ test_bit(wIndex, &bus_state->resuming_ports)) &&
++ (raw_port_status & PORT_PLS_MASK) != XDEV_U3 &&
++ (raw_port_status & PORT_PLS_MASK) != XDEV_RESUME) {
++ bus_state->resume_done[wIndex] = 0;
++ clear_bit(wIndex, &bus_state->resuming_ports);
++ }
+ if ((raw_port_status & PORT_PLS_MASK) == XDEV_U0
+ && (raw_port_status & PORT_POWER)
+ && (bus_state->suspended_ports & (1 << wIndex))) {
+@@ -998,6 +1031,7 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
+ if ((temp & PORT_PE) == 0)
+ goto error;
+
++ set_bit(wIndex, &bus_state->resuming_ports);
+ xhci_set_link_state(xhci, port_array, wIndex,
+ XDEV_RESUME);
+ spin_unlock_irqrestore(&xhci->lock, flags);
+@@ -1005,6 +1039,7 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
+ spin_lock_irqsave(&xhci->lock, flags);
+ xhci_set_link_state(xhci, port_array, wIndex,
+ XDEV_U0);
++ clear_bit(wIndex, &bus_state->resuming_ports);
+ }
+ bus_state->port_c_suspend |= 1 << wIndex;
+
+diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
+index c15dbffe660b..cd88034c7a83 100644
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -1595,7 +1595,8 @@ static void handle_port_status(struct xhci_hcd *xhci,
+ */
+ bogus_port_status = true;
+ goto cleanup;
+- } else {
++ } else if (!test_bit(faked_port_index,
++ &bus_state->resuming_ports)) {
+ xhci_dbg(xhci, "resume HS port %d\n", port_id);
+ bus_state->resume_done[faked_port_index] = jiffies +
+ msecs_to_jiffies(USB_RESUME_TIMEOUT);
+diff --git a/include/linux/mm.h b/include/linux/mm.h
+index 9eef3a1f2291..db853dee1ec5 100644
+--- a/include/linux/mm.h
++++ b/include/linux/mm.h
+@@ -2029,6 +2029,7 @@ static inline struct page *follow_page(struct vm_area_struct *vma,
+ #define FOLL_NUMA 0x200 /* force NUMA hinting page fault */
+ #define FOLL_MIGRATION 0x400 /* wait for page to replace migration entry */
+ #define FOLL_TRIED 0x800 /* a retry, previous pass started an IO */
++#define FOLL_COW 0x4000 /* internal GUP flag */
+
+ typedef int (*pte_fn_t)(pte_t *pte, pgtable_t token, unsigned long addr,
+ void *data);
+diff --git a/mm/gup.c b/mm/gup.c
+index 377a5a796242..3cec4df06e6b 100644
+--- a/mm/gup.c
++++ b/mm/gup.c
+@@ -32,6 +32,16 @@ static struct page *no_page_table(struct vm_area_struct *vma,
+ return NULL;
+ }
+
++/*
++ * FOLL_FORCE can write to even unwritable pte's, but only
++ * after we've gone through a COW cycle and they are dirty.
++ */
++static inline bool can_follow_write_pte(pte_t pte, unsigned int flags)
++{
++ return pte_write(pte) ||
++ ((flags & FOLL_FORCE) && (flags & FOLL_COW) && pte_dirty(pte));
++}
++
+ static struct page *follow_page_pte(struct vm_area_struct *vma,
+ unsigned long address, pmd_t *pmd, unsigned int flags)
+ {
+@@ -66,7 +76,7 @@ retry:
+ }
+ if ((flags & FOLL_NUMA) && pte_numa(pte))
+ goto no_page;
+- if ((flags & FOLL_WRITE) && !pte_write(pte)) {
++ if ((flags & FOLL_WRITE) && !can_follow_write_pte(pte, flags)) {
+ pte_unmap_unlock(ptep, ptl);
+ return NULL;
+ }
+@@ -315,7 +325,7 @@ static int faultin_page(struct task_struct *tsk, struct vm_area_struct *vma,
+ * reCOWed by userspace write).
+ */
+ if ((ret & VM_FAULT_WRITE) && !(vma->vm_flags & VM_WRITE))
+- *flags &= ~FOLL_WRITE;
++ *flags |= FOLL_COW;
+ return 0;
+ }
+
^ permalink raw reply related [flat|nested] 67+ messages in thread
* [gentoo-commits] proj/linux-patches:3.18 commit in: /
@ 2016-11-25 22:57 Mike Pagano
0 siblings, 0 replies; 67+ messages in thread
From: Mike Pagano @ 2016-11-25 22:57 UTC (permalink / raw
To: gentoo-commits
commit: 619d312826a34e59bb3fd59038653308f704a690
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Fri Nov 25 22:57:46 2016 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Fri Nov 25 22:57:46 2016 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=619d3128
Update gentoo kconfig patch adding CHECKPOINT_RESTORE for GENTOO_LINUX_INIT_SYSTEMD. See bug #598623.
4567_distro-Gentoo-Kconfig.patch | 49 +++++++++++++++++++++++++++++++++-------
1 file changed, 41 insertions(+), 8 deletions(-)
diff --git a/4567_distro-Gentoo-Kconfig.patch b/4567_distro-Gentoo-Kconfig.patch
index 690454a..acb0972 100644
--- a/4567_distro-Gentoo-Kconfig.patch
+++ b/4567_distro-Gentoo-Kconfig.patch
@@ -1,5 +1,5 @@
---- a/Kconfig 2014-04-02 09:45:05.389224541 -0400
-+++ b/Kconfig 2014-04-02 09:45:39.269224273 -0400
+--- a/Kconfig 2016-07-01 19:22:17.117439707 -0400
++++ b/Kconfig 2016-07-01 19:21:54.371440596 -0400
@@ -8,4 +8,6 @@ config SRCARCH
string
option env="SRCARCH"
@@ -7,9 +7,9 @@
+source "distro/Kconfig"
+
source "arch/$SRCARCH/Kconfig"
---- a/distro/Kconfig 1969-12-31 19:00:00.000000000 -0500
-+++ b/distro/Kconfig 2015-01-02 13:54:45.589830665 -0500
-@@ -0,0 +1,109 @@
+--- /dev/null 2016-11-15 00:56:18.320838834 -0500
++++ b/distro/Kconfig 2016-11-16 06:24:29.457357409 -0500
+@@ -0,0 +1,142 @@
+menu "Gentoo Linux"
+
+config GENTOO_LINUX
@@ -30,9 +30,10 @@
+
+ depends on GENTOO_LINUX
+ default y if GENTOO_LINUX
-+
++
+ select DEVTMPFS
+ select TMPFS
++ select UNIX
+
+ select MMU
+ select SHMEM
@@ -51,7 +52,32 @@
+ boot process; if not available, it causes sysfs and udev to malfunction.
+
+ To ensure Gentoo Linux boots, it is best to leave this setting enabled;
-+ if you run a custom setup, you could consider whether to disable this.
++ if you run a custom setup, you could consider whether to disable this.
++
++config GENTOO_LINUX_PORTAGE
++ bool "Select options required by Portage features"
++
++ depends on GENTOO_LINUX
++ default y if GENTOO_LINUX
++
++ select CGROUPS
++ select NAMESPACES
++ select IPC_NS
++ select NET_NS
++ select SYSVIPC
++
++ help
++ This enables options required by various Portage FEATURES.
++ Currently this selects:
++
++ CGROUPS (required for FEATURES=cgroup)
++ IPC_NS (required for FEATURES=ipc-sandbox)
++ NET_NS (required for FEATURES=network-sandbox)
++ SYSVIPC (required by IPC_NS)
++
++
++ It is highly recommended that you leave this enabled as these FEATURES
++ are, or will soon be, enabled by default.
+
+menu "Support for init systems, system and service managers"
+ visible if GENTOO_LINUX
@@ -87,17 +113,24 @@
+ select AUTOFS4_FS
+ select BLK_DEV_BSG
+ select CGROUPS
++ select CHECKPOINT_RESTORE
+ select DEVPTS_MULTIPLE_INSTANCES
++ select DMIID
+ select EPOLL
+ select FANOTIFY
+ select FHANDLE
+ select INOTIFY_USER
++ select IPV6
+ select NET
-+ select NET_NS
++ select NET_NS
+ select PROC_FS
++ select SECCOMP
++ select SECCOMP_FILTER
+ select SIGNALFD
+ select SYSFS
+ select TIMERFD
++ select TMPFS_POSIX_ACL
++ select TMPFS_XATTR
+
+ select ANON_INODES
+ select BLOCK
^ permalink raw reply related [flat|nested] 67+ messages in thread
* [gentoo-commits] proj/linux-patches:3.18 commit in: /
@ 2016-11-30 15:42 Mike Pagano
0 siblings, 0 replies; 67+ messages in thread
From: Mike Pagano @ 2016-11-30 15:42 UTC (permalink / raw
To: gentoo-commits
commit: 111437b328d0310b3e4cdc09a811ef99e1b64c5e
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed Nov 30 15:42:27 2016 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed Nov 30 15:42:27 2016 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=111437b3
Linux patch 3.18.45
0000_README | 4 +
1044_linux-3.18.45.patch | 1239 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 1243 insertions(+)
diff --git a/0000_README b/0000_README
index bfb562d..bdec9ea 100644
--- a/0000_README
+++ b/0000_README
@@ -219,6 +219,10 @@ Patch: 1043_linux-3.18.44.patch
From: http://www.kernel.org
Desc: Linux 3.18.44
+Patch: 1044_linux-3.18.45.patch
+From: http://www.kernel.org
+Desc: Linux 3.18.45
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1044_linux-3.18.45.patch b/1044_linux-3.18.45.patch
new file mode 100644
index 0000000..dbe8f9b
--- /dev/null
+++ b/1044_linux-3.18.45.patch
@@ -0,0 +1,1239 @@
+diff --git a/Makefile b/Makefile
+index 05b64e6d1456..de29f33d03a9 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 18
+-SUBLEVEL = 44
++SUBLEVEL = 45
+ EXTRAVERSION =
+ NAME = Diseased Newt
+
+@@ -610,6 +610,8 @@ all: vmlinux
+ include $(srctree)/arch/$(SRCARCH)/Makefile
+
+ KBUILD_CFLAGS += $(call cc-option,-fno-delete-null-pointer-checks,)
++KBUILD_CFLAGS += $(call cc-option,-fno-PIE)
++KBUILD_AFLAGS += $(call cc-option,-fno-PIE)
+
+ ifdef CONFIG_CC_OPTIMIZE_FOR_SIZE
+ KBUILD_CFLAGS += -Os $(call cc-disable-warning,maybe-uninitialized,)
+diff --git a/arch/mips/kvm/emulate.c b/arch/mips/kvm/emulate.c
+index 824be0da92cd..f49289f7fd2a 100644
+--- a/arch/mips/kvm/emulate.c
++++ b/arch/mips/kvm/emulate.c
+@@ -752,15 +752,15 @@ enum emulation_result kvm_mips_emul_eret(struct kvm_vcpu *vcpu)
+ struct mips_coproc *cop0 = vcpu->arch.cop0;
+ enum emulation_result er = EMULATE_DONE;
+
+- if (kvm_read_c0_guest_status(cop0) & ST0_EXL) {
++ if (kvm_read_c0_guest_status(cop0) & ST0_ERL) {
++ kvm_clear_c0_guest_status(cop0, ST0_ERL);
++ vcpu->arch.pc = kvm_read_c0_guest_errorepc(cop0);
++ } else if (kvm_read_c0_guest_status(cop0) & ST0_EXL) {
+ kvm_debug("[%#lx] ERET to %#lx\n", vcpu->arch.pc,
+ kvm_read_c0_guest_epc(cop0));
+ kvm_clear_c0_guest_status(cop0, ST0_EXL);
+ vcpu->arch.pc = kvm_read_c0_guest_epc(cop0);
+
+- } else if (kvm_read_c0_guest_status(cop0) & ST0_ERL) {
+- kvm_clear_c0_guest_status(cop0, ST0_ERL);
+- vcpu->arch.pc = kvm_read_c0_guest_errorepc(cop0);
+ } else {
+ kvm_err("[%#lx] ERET when MIPS_SR_EXL|MIPS_SR_ERL == 0\n",
+ vcpu->arch.pc);
+diff --git a/arch/parisc/kernel/syscall.S b/arch/parisc/kernel/syscall.S
+index 099c23616901..8f13c7facdd7 100644
+--- a/arch/parisc/kernel/syscall.S
++++ b/arch/parisc/kernel/syscall.S
+@@ -106,8 +106,6 @@ linux_gateway_entry:
+ mtsp %r0,%sr4 /* get kernel space into sr4 */
+ mtsp %r0,%sr5 /* get kernel space into sr5 */
+ mtsp %r0,%sr6 /* get kernel space into sr6 */
+- mfsp %sr7,%r1 /* save user sr7 */
+- mtsp %r1,%sr3 /* and store it in sr3 */
+
+ #ifdef CONFIG_64BIT
+ /* for now we can *always* set the W bit on entry to the syscall
+@@ -133,6 +131,14 @@ linux_gateway_entry:
+ depdi 0, 31, 32, %r21
+ 1:
+ #endif
++
++ /* We use a rsm/ssm pair to prevent sr3 from being clobbered
++ * by external interrupts.
++ */
++ mfsp %sr7,%r1 /* save user sr7 */
++ rsm PSW_SM_I, %r0 /* disable interrupts */
++ mtsp %r1,%sr3 /* and store it in sr3 */
++
+ mfctl %cr30,%r1
+ xor %r1,%r30,%r30 /* ye olde xor trick */
+ xor %r1,%r30,%r1
+@@ -147,6 +153,7 @@ linux_gateway_entry:
+ */
+
+ mtsp %r0,%sr7 /* get kernel space into sr7 */
++ ssm PSW_SM_I, %r0 /* enable interrupts */
+ STREGM %r1,FRAME_SIZE(%r30) /* save r1 (usp) here for now */
+ mfctl %cr30,%r1 /* get task ptr in %r1 */
+ LDREG TI_TASK(%r1),%r1
+diff --git a/arch/powerpc/kernel/idle_power7.S b/arch/powerpc/kernel/idle_power7.S
+index 283c603716a0..df448d17641d 100644
+--- a/arch/powerpc/kernel/idle_power7.S
++++ b/arch/powerpc/kernel/idle_power7.S
+@@ -28,7 +28,7 @@
+ std r0,0(r1); \
+ ptesync; \
+ ld r0,0(r1); \
+-1: cmp cr0,r0,r0; \
++1: cmpd cr0,r0,r0; \
+ bne 1b; \
+ IDLE_INST; \
+ b .
+diff --git a/arch/powerpc/mm/copro_fault.c b/arch/powerpc/mm/copro_fault.c
+index 1b5305d4bdab..575b871c3887 100644
+--- a/arch/powerpc/mm/copro_fault.c
++++ b/arch/powerpc/mm/copro_fault.c
+@@ -102,6 +102,8 @@ int copro_calculate_slb(struct mm_struct *mm, u64 ea, struct copro_slb *slb)
+ switch (REGION_ID(ea)) {
+ case USER_REGION_ID:
+ pr_devel("%s: 0x%llx -- USER_REGION_ID\n", __func__, ea);
++ if (mm == NULL)
++ return 1;
+ psize = get_slice_psize(mm, ea);
+ ssize = user_segment_size(ea);
+ vsid = get_vsid(mm->context.id, ea, ssize);
+diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
+index 6e09c1dac2b7..2453a9f20d01 100644
+--- a/drivers/char/virtio_console.c
++++ b/drivers/char/virtio_console.c
+@@ -1532,19 +1532,29 @@ static void remove_port_data(struct port *port)
+ spin_lock_irq(&port->inbuf_lock);
+ /* Remove unused data this port might have received. */
+ discard_port_data(port);
++ spin_unlock_irq(&port->inbuf_lock);
+
+ /* Remove buffers we queued up for the Host to send us data in. */
+- while ((buf = virtqueue_detach_unused_buf(port->in_vq)))
+- free_buf(buf, true);
+- spin_unlock_irq(&port->inbuf_lock);
++ do {
++ spin_lock_irq(&port->inbuf_lock);
++ buf = virtqueue_detach_unused_buf(port->in_vq);
++ spin_unlock_irq(&port->inbuf_lock);
++ if (buf)
++ free_buf(buf, true);
++ } while (buf);
+
+ spin_lock_irq(&port->outvq_lock);
+ reclaim_consumed_buffers(port);
++ spin_unlock_irq(&port->outvq_lock);
+
+ /* Free pending buffers from the out-queue. */
+- while ((buf = virtqueue_detach_unused_buf(port->out_vq)))
+- free_buf(buf, true);
+- spin_unlock_irq(&port->outvq_lock);
++ do {
++ spin_lock_irq(&port->outvq_lock);
++ buf = virtqueue_detach_unused_buf(port->out_vq);
++ spin_unlock_irq(&port->outvq_lock);
++ if (buf)
++ free_buf(buf, true);
++ } while (buf);
+ }
+
+ /*
+diff --git a/drivers/firewire/net.c b/drivers/firewire/net.c
+index 2c68da1ceeee..e7a085acf72d 100644
+--- a/drivers/firewire/net.c
++++ b/drivers/firewire/net.c
+@@ -73,13 +73,13 @@ struct rfc2734_header {
+
+ #define fwnet_get_hdr_lf(h) (((h)->w0 & 0xc0000000) >> 30)
+ #define fwnet_get_hdr_ether_type(h) (((h)->w0 & 0x0000ffff))
+-#define fwnet_get_hdr_dg_size(h) (((h)->w0 & 0x0fff0000) >> 16)
++#define fwnet_get_hdr_dg_size(h) ((((h)->w0 & 0x0fff0000) >> 16) + 1)
+ #define fwnet_get_hdr_fg_off(h) (((h)->w0 & 0x00000fff))
+ #define fwnet_get_hdr_dgl(h) (((h)->w1 & 0xffff0000) >> 16)
+
+-#define fwnet_set_hdr_lf(lf) ((lf) << 30)
++#define fwnet_set_hdr_lf(lf) ((lf) << 30)
+ #define fwnet_set_hdr_ether_type(et) (et)
+-#define fwnet_set_hdr_dg_size(dgs) ((dgs) << 16)
++#define fwnet_set_hdr_dg_size(dgs) (((dgs) - 1) << 16)
+ #define fwnet_set_hdr_fg_off(fgo) (fgo)
+
+ #define fwnet_set_hdr_dgl(dgl) ((dgl) << 16)
+@@ -591,6 +591,9 @@ static int fwnet_incoming_packet(struct fwnet_device *dev, __be32 *buf, int len,
+ int retval;
+ u16 ether_type;
+
++ if (len <= RFC2374_UNFRAG_HDR_SIZE)
++ return 0;
++
+ hdr.w0 = be32_to_cpu(buf[0]);
+ lf = fwnet_get_hdr_lf(&hdr);
+ if (lf == RFC2374_HDR_UNFRAG) {
+@@ -615,7 +618,12 @@ static int fwnet_incoming_packet(struct fwnet_device *dev, __be32 *buf, int len,
+ return fwnet_finish_incoming_packet(net, skb, source_node_id,
+ is_broadcast, ether_type);
+ }
++
+ /* A datagram fragment has been received, now the fun begins. */
++
++ if (len <= RFC2374_FRAG_HDR_SIZE)
++ return 0;
++
+ hdr.w1 = ntohl(buf[1]);
+ buf += 2;
+ len -= RFC2374_FRAG_HDR_SIZE;
+@@ -627,7 +635,10 @@ static int fwnet_incoming_packet(struct fwnet_device *dev, __be32 *buf, int len,
+ fg_off = fwnet_get_hdr_fg_off(&hdr);
+ }
+ datagram_label = fwnet_get_hdr_dgl(&hdr);
+- dg_size = fwnet_get_hdr_dg_size(&hdr); /* ??? + 1 */
++ dg_size = fwnet_get_hdr_dg_size(&hdr);
++
++ if (fg_off + len > dg_size)
++ return 0;
+
+ spin_lock_irqsave(&dev->lock, flags);
+
+@@ -735,6 +746,22 @@ static void fwnet_receive_packet(struct fw_card *card, struct fw_request *r,
+ fw_send_response(card, r, rcode);
+ }
+
++static int gasp_source_id(__be32 *p)
++{
++ return be32_to_cpu(p[0]) >> 16;
++}
++
++static u32 gasp_specifier_id(__be32 *p)
++{
++ return (be32_to_cpu(p[0]) & 0xffff) << 8 |
++ (be32_to_cpu(p[1]) & 0xff000000) >> 24;
++}
++
++static u32 gasp_version(__be32 *p)
++{
++ return be32_to_cpu(p[1]) & 0xffffff;
++}
++
+ static void fwnet_receive_broadcast(struct fw_iso_context *context,
+ u32 cycle, size_t header_length, void *header, void *data)
+ {
+@@ -744,9 +771,6 @@ static void fwnet_receive_broadcast(struct fw_iso_context *context,
+ __be32 *buf_ptr;
+ int retval;
+ u32 length;
+- u16 source_node_id;
+- u32 specifier_id;
+- u32 ver;
+ unsigned long offset;
+ unsigned long flags;
+
+@@ -763,22 +787,17 @@ static void fwnet_receive_broadcast(struct fw_iso_context *context,
+
+ spin_unlock_irqrestore(&dev->lock, flags);
+
+- specifier_id = (be32_to_cpu(buf_ptr[0]) & 0xffff) << 8
+- | (be32_to_cpu(buf_ptr[1]) & 0xff000000) >> 24;
+- ver = be32_to_cpu(buf_ptr[1]) & 0xffffff;
+- source_node_id = be32_to_cpu(buf_ptr[0]) >> 16;
+-
+- if (specifier_id == IANA_SPECIFIER_ID &&
+- (ver == RFC2734_SW_VERSION
++ if (length > IEEE1394_GASP_HDR_SIZE &&
++ gasp_specifier_id(buf_ptr) == IANA_SPECIFIER_ID &&
++ (gasp_version(buf_ptr) == RFC2734_SW_VERSION
+ #if IS_ENABLED(CONFIG_IPV6)
+- || ver == RFC3146_SW_VERSION
++ || gasp_version(buf_ptr) == RFC3146_SW_VERSION
+ #endif
+- )) {
+- buf_ptr += 2;
+- length -= IEEE1394_GASP_HDR_SIZE;
+- fwnet_incoming_packet(dev, buf_ptr, length, source_node_id,
++ ))
++ fwnet_incoming_packet(dev, buf_ptr + 2,
++ length - IEEE1394_GASP_HDR_SIZE,
++ gasp_source_id(buf_ptr),
+ context->card->generation, true);
+- }
+
+ packet.payload_length = dev->rcv_buffer_size;
+ packet.interrupt = 1;
+diff --git a/drivers/gpu/drm/radeon/ni.c b/drivers/gpu/drm/radeon/ni.c
+index a019ba246e39..3e8a0d634420 100644
+--- a/drivers/gpu/drm/radeon/ni.c
++++ b/drivers/gpu/drm/radeon/ni.c
+@@ -1339,9 +1339,7 @@ static void cayman_pcie_gart_fini(struct radeon_device *rdev)
+ void cayman_cp_int_cntl_setup(struct radeon_device *rdev,
+ int ring, u32 cp_int_cntl)
+ {
+- u32 srbm_gfx_cntl = RREG32(SRBM_GFX_CNTL) & ~3;
+-
+- WREG32(SRBM_GFX_CNTL, srbm_gfx_cntl | (ring & 3));
++ WREG32(SRBM_GFX_CNTL, RINGID(ring));
+ WREG32(CP_INT_CNTL, cp_int_cntl);
+ }
+
+diff --git a/drivers/gpu/drm/radeon/r600_dpm.c b/drivers/gpu/drm/radeon/r600_dpm.c
+index 65a0c1c03c69..fdac8d3847dc 100644
+--- a/drivers/gpu/drm/radeon/r600_dpm.c
++++ b/drivers/gpu/drm/radeon/r600_dpm.c
+@@ -156,19 +156,20 @@ u32 r600_dpm_get_vblank_time(struct radeon_device *rdev)
+ struct drm_device *dev = rdev->ddev;
+ struct drm_crtc *crtc;
+ struct radeon_crtc *radeon_crtc;
+- u32 line_time_us, vblank_lines;
++ u32 vblank_in_pixels;
+ u32 vblank_time_us = 0xffffffff; /* if the displays are off, vblank time is max */
+
+ if (rdev->num_crtc && rdev->mode_info.mode_config_initialized) {
+ list_for_each_entry(crtc, &dev->mode_config.crtc_list, head) {
+ radeon_crtc = to_radeon_crtc(crtc);
+ if (crtc->enabled && radeon_crtc->enabled && radeon_crtc->hw_mode.clock) {
+- line_time_us = (radeon_crtc->hw_mode.crtc_htotal * 1000) /
+- radeon_crtc->hw_mode.clock;
+- vblank_lines = radeon_crtc->hw_mode.crtc_vblank_end -
+- radeon_crtc->hw_mode.crtc_vdisplay +
+- (radeon_crtc->v_border * 2);
+- vblank_time_us = vblank_lines * line_time_us;
++ vblank_in_pixels =
++ radeon_crtc->hw_mode.crtc_htotal *
++ (radeon_crtc->hw_mode.crtc_vblank_end -
++ radeon_crtc->hw_mode.crtc_vdisplay +
++ (radeon_crtc->v_border * 2));
++
++ vblank_time_us = vblank_in_pixels * 1000 / radeon_crtc->hw_mode.clock;
+ break;
+ }
+ }
+diff --git a/drivers/gpu/drm/radeon/si_dpm.c b/drivers/gpu/drm/radeon/si_dpm.c
+index c3530caa7ddd..1a75d78a2708 100644
+--- a/drivers/gpu/drm/radeon/si_dpm.c
++++ b/drivers/gpu/drm/radeon/si_dpm.c
+@@ -2945,6 +2945,49 @@ static void si_apply_state_adjust_rules(struct radeon_device *rdev,
+ int i;
+ struct si_dpm_quirk *p = si_dpm_quirk_list;
+
++ /* limit all SI kickers */
++ if (rdev->family == CHIP_PITCAIRN) {
++ if ((rdev->pdev->revision == 0x81) ||
++ (rdev->pdev->device == 0x6810) ||
++ (rdev->pdev->device == 0x6811) ||
++ (rdev->pdev->device == 0x6816) ||
++ (rdev->pdev->device == 0x6817) ||
++ (rdev->pdev->device == 0x6806))
++ max_mclk = 120000;
++ } else if (rdev->family == CHIP_VERDE) {
++ if ((rdev->pdev->revision == 0x81) ||
++ (rdev->pdev->revision == 0x83) ||
++ (rdev->pdev->revision == 0x87) ||
++ (rdev->pdev->device == 0x6820) ||
++ (rdev->pdev->device == 0x6821) ||
++ (rdev->pdev->device == 0x6822) ||
++ (rdev->pdev->device == 0x6823) ||
++ (rdev->pdev->device == 0x682A) ||
++ (rdev->pdev->device == 0x682B)) {
++ max_sclk = 75000;
++ max_mclk = 80000;
++ }
++ } else if (rdev->family == CHIP_OLAND) {
++ if ((rdev->pdev->revision == 0xC7) ||
++ (rdev->pdev->revision == 0x80) ||
++ (rdev->pdev->revision == 0x81) ||
++ (rdev->pdev->revision == 0x83) ||
++ (rdev->pdev->device == 0x6604) ||
++ (rdev->pdev->device == 0x6605)) {
++ max_sclk = 75000;
++ max_mclk = 80000;
++ }
++ } else if (rdev->family == CHIP_HAINAN) {
++ if ((rdev->pdev->revision == 0x81) ||
++ (rdev->pdev->revision == 0x83) ||
++ (rdev->pdev->revision == 0xC3) ||
++ (rdev->pdev->device == 0x6664) ||
++ (rdev->pdev->device == 0x6665) ||
++ (rdev->pdev->device == 0x6667)) {
++ max_sclk = 75000;
++ max_mclk = 80000;
++ }
++ }
+ /* Apply dpm quirks */
+ while (p && p->chip_device != 0) {
+ if (rdev->pdev->vendor == p->chip_vendor &&
+@@ -2957,10 +3000,6 @@ static void si_apply_state_adjust_rules(struct radeon_device *rdev,
+ }
+ ++p;
+ }
+- /* limit mclk on all R7 370 parts for stability */
+- if (rdev->pdev->device == 0x6811 &&
+- rdev->pdev->revision == 0x81)
+- max_mclk = 120000;
+
+ if ((rdev->pm.dpm.new_active_crtc_count > 1) ||
+ ni_dpm_vblank_too_short(rdev))
+diff --git a/drivers/hv/hv_util.c b/drivers/hv/hv_util.c
+index 3b9c9ef0deb8..2d1414d07305 100644
+--- a/drivers/hv/hv_util.c
++++ b/drivers/hv/hv_util.c
+@@ -283,10 +283,14 @@ static void heartbeat_onchannelcallback(void *context)
+ u8 *hbeat_txf_buf = util_heartbeat.recv_buffer;
+ struct icmsg_negotiate *negop = NULL;
+
+- vmbus_recvpacket(channel, hbeat_txf_buf,
+- PAGE_SIZE, &recvlen, &requestid);
++ while (1) {
++
++ vmbus_recvpacket(channel, hbeat_txf_buf,
++ PAGE_SIZE, &recvlen, &requestid);
++
++ if (!recvlen)
++ break;
+
+- if (recvlen > 0) {
+ icmsghdrp = (struct icmsg_hdr *)&hbeat_txf_buf[
+ sizeof(struct vmbuspipe_hdr)];
+
+diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h
+index 89daac119a69..faccb8349647 100644
+--- a/drivers/input/serio/i8042-x86ia64io.h
++++ b/drivers/input/serio/i8042-x86ia64io.h
+@@ -783,6 +783,13 @@ static const struct dmi_system_id __initconst i8042_dmi_kbdreset_table[] = {
+ DMI_MATCH(DMI_PRODUCT_NAME, "P34"),
+ },
+ },
++ {
++ /* Schenker XMG C504 - Elantech touchpad */
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "XMG"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "C504"),
++ },
++ },
+ { }
+ };
+
+diff --git a/drivers/irqchip/irq-gic-v3.c b/drivers/irqchip/irq-gic-v3.c
+index 1242d8a25721..70565fc17ea7 100644
+--- a/drivers/irqchip/irq-gic-v3.c
++++ b/drivers/irqchip/irq-gic-v3.c
+@@ -178,7 +178,7 @@ static void gic_enable_redist(bool enable)
+ return; /* No PM support in this redistributor */
+ }
+
+- while (count--) {
++ while (--count) {
+ val = readl_relaxed(rbase + GICR_WAKER);
+ if (enable ^ (val & GICR_WAKER_ChildrenAsleep))
+ break;
+diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c
+index b2bd1ebf4562..fc93bd80270f 100644
+--- a/drivers/md/dm-table.c
++++ b/drivers/md/dm-table.c
+@@ -691,37 +691,32 @@ int dm_table_add_target(struct dm_table *t, const char *type,
+
+ tgt->type = dm_get_target_type(type);
+ if (!tgt->type) {
+- DMERR("%s: %s: unknown target type", dm_device_name(t->md),
+- type);
++ DMERR("%s: %s: unknown target type", dm_device_name(t->md), type);
+ return -EINVAL;
+ }
+
+ if (dm_target_needs_singleton(tgt->type)) {
+ if (t->num_targets) {
+- DMERR("%s: target type %s must appear alone in table",
+- dm_device_name(t->md), type);
+- return -EINVAL;
++ tgt->error = "singleton target type must appear alone in table";
++ goto bad;
+ }
+ t->singleton = 1;
+ }
+
+ if (dm_target_always_writeable(tgt->type) && !(t->mode & FMODE_WRITE)) {
+- DMERR("%s: target type %s may not be included in read-only tables",
+- dm_device_name(t->md), type);
+- return -EINVAL;
++ tgt->error = "target type may not be included in a read-only table";
++ goto bad;
+ }
+
+ if (t->immutable_target_type) {
+ if (t->immutable_target_type != tgt->type) {
+- DMERR("%s: immutable target type %s cannot be mixed with other target types",
+- dm_device_name(t->md), t->immutable_target_type->name);
+- return -EINVAL;
++ tgt->error = "immutable target type cannot be mixed with other target types";
++ goto bad;
+ }
+ } else if (dm_target_is_immutable(tgt->type)) {
+ if (t->num_targets) {
+- DMERR("%s: immutable target type %s cannot be mixed with other target types",
+- dm_device_name(t->md), tgt->type->name);
+- return -EINVAL;
++ tgt->error = "immutable target type cannot be mixed with other target types";
++ goto bad;
+ }
+ t->immutable_target_type = tgt->type;
+ }
+@@ -736,7 +731,6 @@ int dm_table_add_target(struct dm_table *t, const char *type,
+ */
+ if (!adjoin(t, tgt)) {
+ tgt->error = "Gap in table";
+- r = -EINVAL;
+ goto bad;
+ }
+
+diff --git a/drivers/md/md.c b/drivers/md/md.c
+index 3d2cc7453ec1..a4b0b4e43b40 100644
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -7409,6 +7409,9 @@ void md_do_sync(struct md_thread *thread)
+ break;
+
+ j += sectors;
++ if (j > max_sectors)
++ /* when skipping, extra large numbers can be returned. */
++ j = max_sectors;
+ if (j > 2)
+ mddev->curr_resync = j;
+ mddev->curr_mark_cnt = io_sectors;
+@@ -7468,11 +7471,17 @@ void md_do_sync(struct md_thread *thread)
+ blk_finish_plug(&plug);
+ wait_event(mddev->recovery_wait, !atomic_read(&mddev->recovery_active));
+
++ if (!test_bit(MD_RECOVERY_RESHAPE, &mddev->recovery) &&
++ !test_bit(MD_RECOVERY_INTR, &mddev->recovery) &&
++ mddev->curr_resync > 3) {
++ mddev->curr_resync_completed = mddev->curr_resync;
++ sysfs_notify(&mddev->kobj, NULL, "sync_completed");
++ }
+ /* tell personality that we are finished */
+ mddev->pers->sync_request(mddev, max_sectors, &skipped, 1);
+
+ if (!test_bit(MD_RECOVERY_CHECK, &mddev->recovery) &&
+- mddev->curr_resync > 2) {
++ mddev->curr_resync > 3) {
+ if (test_bit(MD_RECOVERY_SYNC, &mddev->recovery)) {
+ if (test_bit(MD_RECOVERY_INTR, &mddev->recovery)) {
+ if (mddev->curr_resync >= mddev->recovery_cp) {
+diff --git a/drivers/memstick/host/rtsx_usb_ms.c b/drivers/memstick/host/rtsx_usb_ms.c
+index a7282b7d4de8..021e4252ee04 100644
+--- a/drivers/memstick/host/rtsx_usb_ms.c
++++ b/drivers/memstick/host/rtsx_usb_ms.c
+@@ -524,6 +524,7 @@ static void rtsx_usb_ms_handle_req(struct work_struct *work)
+ int rc;
+
+ if (!host->req) {
++ pm_runtime_get_sync(ms_dev(host));
+ do {
+ rc = memstick_next_req(msh, &host->req);
+ dev_dbg(ms_dev(host), "next req %d\n", rc);
+@@ -544,6 +545,7 @@ static void rtsx_usb_ms_handle_req(struct work_struct *work)
+ host->req->error);
+ }
+ } while (!rc);
++ pm_runtime_put(ms_dev(host));
+ }
+
+ }
+@@ -570,6 +572,7 @@ static int rtsx_usb_ms_set_param(struct memstick_host *msh,
+ dev_dbg(ms_dev(host), "%s: param = %d, value = %d\n",
+ __func__, param, value);
+
++ pm_runtime_get_sync(ms_dev(host));
+ mutex_lock(&ucr->dev_mutex);
+
+ err = rtsx_usb_card_exclusive_check(ucr, RTSX_USB_MS_CARD);
+@@ -635,6 +638,7 @@ static int rtsx_usb_ms_set_param(struct memstick_host *msh,
+ }
+ out:
+ mutex_unlock(&ucr->dev_mutex);
++ pm_runtime_put(ms_dev(host));
+
+ /* power-on delay */
+ if (param == MEMSTICK_POWER && value == MEMSTICK_POWER_ON)
+@@ -681,6 +685,7 @@ static int rtsx_usb_detect_ms_card(void *__host)
+ int err;
+
+ for (;;) {
++ pm_runtime_get_sync(ms_dev(host));
+ mutex_lock(&ucr->dev_mutex);
+
+ /* Check pending MS card changes */
+@@ -703,6 +708,7 @@ static int rtsx_usb_detect_ms_card(void *__host)
+ }
+
+ poll_again:
++ pm_runtime_put(ms_dev(host));
+ if (host->eject)
+ break;
+
+diff --git a/drivers/misc/genwqe/card_utils.c b/drivers/misc/genwqe/card_utils.c
+index 1ca94e6fa8fb..e9e6f7d61a71 100644
+--- a/drivers/misc/genwqe/card_utils.c
++++ b/drivers/misc/genwqe/card_utils.c
+@@ -351,17 +351,27 @@ int genwqe_alloc_sync_sgl(struct genwqe_dev *cd, struct genwqe_sgl *sgl,
+ if (copy_from_user(sgl->lpage, user_addr + user_size -
+ sgl->lpage_size, sgl->lpage_size)) {
+ rc = -EFAULT;
+- goto err_out1;
++ goto err_out2;
+ }
+ }
+ return 0;
+
++ err_out2:
++ __genwqe_free_consistent(cd, PAGE_SIZE, sgl->lpage,
++ sgl->lpage_dma_addr);
++ sgl->lpage = NULL;
++ sgl->lpage_dma_addr = 0;
+ err_out1:
+ __genwqe_free_consistent(cd, PAGE_SIZE, sgl->fpage,
+ sgl->fpage_dma_addr);
++ sgl->fpage = NULL;
++ sgl->fpage_dma_addr = 0;
+ err_out:
+ __genwqe_free_consistent(cd, sgl->sgl_size, sgl->sgl,
+ sgl->sgl_dma_addr);
++ sgl->sgl = NULL;
++ sgl->sgl_dma_addr = 0;
++ sgl->sgl_size = 0;
+ return -ENOMEM;
+ }
+
+diff --git a/drivers/misc/mei/hw-txe.c b/drivers/misc/mei/hw-txe.c
+index c11a01a1ec21..2e76fd528c70 100644
+--- a/drivers/misc/mei/hw-txe.c
++++ b/drivers/misc/mei/hw-txe.c
+@@ -973,11 +973,13 @@ static bool mei_txe_check_and_ack_intrs(struct mei_device *dev, bool do_ack)
+ hisr = mei_txe_br_reg_read(hw, HISR_REG);
+
+ aliveness = mei_txe_aliveness_get(dev);
+- if (hhisr & IPC_HHIER_SEC && aliveness)
++ if (hhisr & IPC_HHIER_SEC && aliveness) {
+ ipc_isr = mei_txe_sec_reg_read_silent(hw,
+ SEC_IPC_HOST_INT_STATUS_REG);
+- else
++ } else {
+ ipc_isr = 0;
++ hhisr &= ~IPC_HHIER_SEC;
++ }
+
+ generated = generated ||
+ (hisr & HISR_INT_STS_MSK) ||
+diff --git a/drivers/mmc/card/block.c b/drivers/mmc/card/block.c
+index 4078ebe81c45..dec6b0ec4def 100644
+--- a/drivers/mmc/card/block.c
++++ b/drivers/mmc/card/block.c
+@@ -1657,7 +1657,7 @@ static void mmc_blk_packed_hdr_wrq_prep(struct mmc_queue_req *mqrq,
+ struct mmc_blk_data *md = mq->data;
+ struct mmc_packed *packed = mqrq->packed;
+ bool do_rel_wr, do_data_tag;
+- u32 *packed_cmd_hdr;
++ __le32 *packed_cmd_hdr;
+ u8 hdr_blocks;
+ u8 i = 1;
+
+diff --git a/drivers/mmc/card/queue.h b/drivers/mmc/card/queue.h
+index 99e6521e6169..f42c11293dd8 100644
+--- a/drivers/mmc/card/queue.h
++++ b/drivers/mmc/card/queue.h
+@@ -24,7 +24,7 @@ enum mmc_packed_type {
+
+ struct mmc_packed {
+ struct list_head list;
+- u32 cmd_hdr[1024];
++ __le32 cmd_hdr[1024];
+ unsigned int blocks;
+ u8 nr_entries;
+ u8 retries;
+diff --git a/drivers/mmc/host/rtsx_usb_sdmmc.c b/drivers/mmc/host/rtsx_usb_sdmmc.c
+index 88af827e086b..a9e97a138f3d 100644
+--- a/drivers/mmc/host/rtsx_usb_sdmmc.c
++++ b/drivers/mmc/host/rtsx_usb_sdmmc.c
+@@ -1138,11 +1138,6 @@ static void sdmmc_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
+ dev_dbg(sdmmc_dev(host), "%s\n", __func__);
+ mutex_lock(&ucr->dev_mutex);
+
+- if (rtsx_usb_card_exclusive_check(ucr, RTSX_USB_SD_CARD)) {
+- mutex_unlock(&ucr->dev_mutex);
+- return;
+- }
+-
+ sd_set_power_mode(host, ios->power_mode);
+ sd_set_bus_width(host, ios->bus_width);
+ sd_set_timing(host, ios->timing, &host->ddr_mode);
+@@ -1314,6 +1309,7 @@ static void rtsx_usb_update_led(struct work_struct *work)
+ container_of(work, struct rtsx_usb_sdmmc, led_work);
+ struct rtsx_ucr *ucr = host->ucr;
+
++ pm_runtime_get_sync(sdmmc_dev(host));
+ mutex_lock(&ucr->dev_mutex);
+
+ if (host->led.brightness == LED_OFF)
+@@ -1322,6 +1318,7 @@ static void rtsx_usb_update_led(struct work_struct *work)
+ rtsx_usb_turn_on_led(ucr);
+
+ mutex_unlock(&ucr->dev_mutex);
++ pm_runtime_put(sdmmc_dev(host));
+ }
+ #endif
+
+diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c
+index 8e7605894dfd..388046e71e80 100644
+--- a/drivers/mmc/host/sdhci.c
++++ b/drivers/mmc/host/sdhci.c
+@@ -669,7 +669,7 @@ static u8 sdhci_calc_timeout(struct sdhci_host *host, struct mmc_command *cmd)
+ * host->clock is in Hz. target_timeout is in us.
+ * Hence, us = 1000000 * cycles / Hz. Round up.
+ */
+- val = 1000000 * data->timeout_clks;
++ val = 1000000ULL * data->timeout_clks;
+ if (do_div(val, host->clock))
+ target_timeout++;
+ target_timeout += val;
+diff --git a/drivers/scsi/arcmsr/arcmsr_hba.c b/drivers/scsi/arcmsr/arcmsr_hba.c
+index 0b44fb5ee485..7bded8e3f116 100644
+--- a/drivers/scsi/arcmsr/arcmsr_hba.c
++++ b/drivers/scsi/arcmsr/arcmsr_hba.c
+@@ -2545,18 +2545,9 @@ static int arcmsr_queue_command_lck(struct scsi_cmnd *cmd,
+ struct AdapterControlBlock *acb = (struct AdapterControlBlock *) host->hostdata;
+ struct CommandControlBlock *ccb;
+ int target = cmd->device->id;
+- int lun = cmd->device->lun;
+- uint8_t scsicmd = cmd->cmnd[0];
+ cmd->scsi_done = done;
+ cmd->host_scribble = NULL;
+ cmd->result = 0;
+- if ((scsicmd == SYNCHRONIZE_CACHE) ||(scsicmd == SEND_DIAGNOSTIC)){
+- if(acb->devstate[target][lun] == ARECA_RAID_GONE) {
+- cmd->result = (DID_NO_CONNECT << 16);
+- }
+- cmd->scsi_done(cmd);
+- return 0;
+- }
+ if (target == 16) {
+ /* virtual device for iop message transfer */
+ arcmsr_handle_virtual_command(acb, cmd);
+diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c
+index b1af2987b0c8..1ff0ece87644 100644
+--- a/drivers/scsi/megaraid/megaraid_sas_base.c
++++ b/drivers/scsi/megaraid/megaraid_sas_base.c
+@@ -1614,16 +1614,13 @@ megasas_queue_command(struct Scsi_Host *shost, struct scsi_cmnd *scmd)
+ goto out_done;
+ }
+
+- switch (scmd->cmnd[0]) {
+- case SYNCHRONIZE_CACHE:
+- /*
+- * FW takes care of flush cache on its own
+- * No need to send it down
+- */
++ /*
++ * FW takes care of flush cache on its own for Virtual Disk.
++ * No need to send it down for VD. For JBOD send SYNCHRONIZE_CACHE to FW.
++ */
++ if ((scmd->cmnd[0] == SYNCHRONIZE_CACHE) && MEGASAS_IS_LOGICAL(scmd)) {
+ scmd->result = DID_OK << 16;
+ goto out_done;
+- default:
+- break;
+ }
+
+ if (instance->instancet->build_and_issue_cmd(instance, scmd)) {
+diff --git a/drivers/scsi/scsi_debug.c b/drivers/scsi/scsi_debug.c
+index 238e06f13b8a..dda3a32743b5 100644
+--- a/drivers/scsi/scsi_debug.c
++++ b/drivers/scsi/scsi_debug.c
+@@ -3998,6 +3998,7 @@ static void __exit scsi_debug_exit(void)
+ if (dif_storep)
+ vfree(dif_storep);
+
++ vfree(map_storep);
+ vfree(fake_storep);
+ }
+
+diff --git a/drivers/scsi/scsi_scan.c b/drivers/scsi/scsi_scan.c
+index f49cb534a829..3386e72ba7e4 100644
+--- a/drivers/scsi/scsi_scan.c
++++ b/drivers/scsi/scsi_scan.c
+@@ -1531,12 +1531,12 @@ static int scsi_report_lun_scan(struct scsi_target *starget, int bflags,
+ out_err:
+ kfree(lun_data);
+ out:
+- scsi_device_put(sdev);
+ if (scsi_device_created(sdev))
+ /*
+ * the sdev we used didn't appear in the report luns scan
+ */
+ __scsi_remove_device(sdev);
++ scsi_device_put(sdev);
+ return ret;
+ }
+
+diff --git a/drivers/target/target_core_xcopy.c b/drivers/target/target_core_xcopy.c
+index e9186cdf35e9..01ee1273a6eb 100644
+--- a/drivers/target/target_core_xcopy.c
++++ b/drivers/target/target_core_xcopy.c
+@@ -698,6 +698,7 @@ static int target_xcopy_read_source(
+ rc = target_xcopy_setup_pt_cmd(xpt_cmd, xop, src_dev, &cdb[0],
+ remote_port, true);
+ if (rc < 0) {
++ ec_cmd->scsi_status = xpt_cmd->se_cmd.scsi_status;
+ transport_generic_free_cmd(se_cmd, 0);
+ return rc;
+ }
+@@ -709,6 +710,7 @@ static int target_xcopy_read_source(
+
+ rc = target_xcopy_issue_pt_cmd(xpt_cmd);
+ if (rc < 0) {
++ ec_cmd->scsi_status = xpt_cmd->se_cmd.scsi_status;
+ transport_generic_free_cmd(se_cmd, 0);
+ return rc;
+ }
+@@ -759,6 +761,7 @@ static int target_xcopy_write_destination(
+ remote_port, false);
+ if (rc < 0) {
+ struct se_cmd *src_cmd = &xop->src_pt_cmd->se_cmd;
++ ec_cmd->scsi_status = xpt_cmd->se_cmd.scsi_status;
+ /*
+ * If the failure happened before the t_mem_list hand-off in
+ * target_xcopy_setup_pt_cmd(), Reset memory + clear flag so that
+@@ -774,6 +777,7 @@ static int target_xcopy_write_destination(
+
+ rc = target_xcopy_issue_pt_cmd(xpt_cmd);
+ if (rc < 0) {
++ ec_cmd->scsi_status = xpt_cmd->se_cmd.scsi_status;
+ se_cmd->se_cmd_flags &= ~SCF_PASSTHROUGH_SG_TO_MEM_NOALLOC;
+ transport_generic_free_cmd(se_cmd, 0);
+ return rc;
+@@ -860,9 +864,14 @@ static void target_xcopy_do_work(struct work_struct *work)
+ out:
+ xcopy_pt_undepend_remotedev(xop);
+ kfree(xop);
+-
+- pr_warn("target_xcopy_do_work: Setting X-COPY CHECK_CONDITION -> sending response\n");
+- ec_cmd->scsi_status = SAM_STAT_CHECK_CONDITION;
++ /*
++ * Don't override an error scsi status if it has already been set
++ */
++ if (ec_cmd->scsi_status == SAM_STAT_GOOD) {
++ pr_warn_ratelimited("target_xcopy_do_work: rc: %d, Setting X-COPY"
++ " CHECK_CONDITION -> sending response\n", rc);
++ ec_cmd->scsi_status = SAM_STAT_CHECK_CONDITION;
++ }
+ target_complete_cmd(ec_cmd, SAM_STAT_CHECK_CONDITION);
+ }
+
+diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c
+index 9062636d3154..1a049e4de937 100644
+--- a/drivers/tty/vt/vt.c
++++ b/drivers/tty/vt/vt.c
+@@ -863,10 +863,15 @@ static int vc_do_resize(struct tty_struct *tty, struct vc_data *vc,
+ if (new_cols == vc->vc_cols && new_rows == vc->vc_rows)
+ return 0;
+
++ if (new_screen_size > (4 << 20))
++ return -EINVAL;
+ newscreen = kmalloc(new_screen_size, GFP_USER);
+ if (!newscreen)
+ return -ENOMEM;
+
++ if (vc == sel_cons)
++ clear_selection();
++
+ old_rows = vc->vc_rows;
+ old_row_size = vc->vc_size_row;
+
+diff --git a/drivers/usb/gadget/function/u_ether.c b/drivers/usb/gadget/function/u_ether.c
+index 6e6f87656e7b..2e7d27b4cf89 100644
+--- a/drivers/usb/gadget/function/u_ether.c
++++ b/drivers/usb/gadget/function/u_ether.c
+@@ -591,8 +591,9 @@ static netdev_tx_t eth_start_xmit(struct sk_buff *skb,
+
+ /* throttle high/super speed IRQ rate back slightly */
+ if (gadget_is_dualspeed(dev->gadget))
+- req->no_interrupt = (dev->gadget->speed == USB_SPEED_HIGH ||
+- dev->gadget->speed == USB_SPEED_SUPER)
++ req->no_interrupt = (((dev->gadget->speed == USB_SPEED_HIGH ||
++ dev->gadget->speed == USB_SPEED_SUPER)) &&
++ !list_empty(&dev->tx_reqs))
+ ? ((atomic_read(&dev->tx_qlen) % dev->qmult) != 0)
+ : 0;
+
+diff --git a/drivers/usb/host/ohci-hcd.c b/drivers/usb/host/ohci-hcd.c
+index d664edabf14e..af2412f5abab 100644
+--- a/drivers/usb/host/ohci-hcd.c
++++ b/drivers/usb/host/ohci-hcd.c
+@@ -72,7 +72,7 @@
+ static const char hcd_name [] = "ohci_hcd";
+
+ #define STATECHANGE_DELAY msecs_to_jiffies(300)
+-#define IO_WATCHDOG_DELAY msecs_to_jiffies(250)
++#define IO_WATCHDOG_DELAY msecs_to_jiffies(275)
+
+ #include "ohci.h"
+ #include "pci-quirks.h"
+diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
+index 54caaf87c567..575582e807d3 100644
+--- a/drivers/usb/host/xhci-pci.c
++++ b/drivers/usb/host/xhci-pci.c
+@@ -45,6 +45,7 @@
+
+ #define PCI_DEVICE_ID_INTEL_LYNXPOINT_XHCI 0x8c31
+ #define PCI_DEVICE_ID_INTEL_LYNXPOINT_LP_XHCI 0x9c31
++#define PCI_DEVICE_ID_INTEL_WILDCATPOINT_LP_XHCI 0x9cb1
+ #define PCI_DEVICE_ID_INTEL_CHERRYVIEW_XHCI 0x22b5
+ #define PCI_DEVICE_ID_INTEL_SUNRISEPOINT_H_XHCI 0xa12f
+ #define PCI_DEVICE_ID_INTEL_SUNRISEPOINT_LP_XHCI 0x9d2f
+@@ -147,7 +148,8 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
+ xhci->quirks |= XHCI_SPURIOUS_REBOOT;
+ }
+ if (pdev->vendor == PCI_VENDOR_ID_INTEL &&
+- pdev->device == PCI_DEVICE_ID_INTEL_LYNXPOINT_LP_XHCI) {
++ (pdev->device == PCI_DEVICE_ID_INTEL_LYNXPOINT_LP_XHCI ||
++ pdev->device == PCI_DEVICE_ID_INTEL_WILDCATPOINT_LP_XHCI)) {
+ xhci->quirks |= XHCI_SPURIOUS_REBOOT;
+ xhci->quirks |= XHCI_SPURIOUS_WAKEUP;
+ }
+diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
+index 685a90168d8e..faab1f8ea370 100644
+--- a/drivers/usb/serial/cp210x.c
++++ b/drivers/usb/serial/cp210x.c
+@@ -845,7 +845,9 @@ static int cp210x_tiocmget(struct tty_struct *tty)
+ unsigned int control;
+ int result;
+
+- cp210x_get_config(port, CP210X_GET_MDMSTS, &control, 1);
++ result = cp210x_get_config(port, CP210X_GET_MDMSTS, &control, 1);
++ if (result)
++ return result;
+
+ result = ((control & CONTROL_DTR) ? TIOCM_DTR : 0)
+ |((control & CONTROL_RTS) ? TIOCM_RTS : 0)
+diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
+index 8c48c9d83d48..494167fe6a2c 100644
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -986,7 +986,8 @@ static const struct usb_device_id id_table_combined[] = {
+ /* ekey Devices */
+ { USB_DEVICE(FTDI_VID, FTDI_EKEY_CONV_USB_PID) },
+ /* Infineon Devices */
+- { USB_DEVICE_INTERFACE_NUMBER(INFINEON_VID, INFINEON_TRIBOARD_PID, 1) },
++ { USB_DEVICE_INTERFACE_NUMBER(INFINEON_VID, INFINEON_TRIBOARD_TC1798_PID, 1) },
++ { USB_DEVICE_INTERFACE_NUMBER(INFINEON_VID, INFINEON_TRIBOARD_TC2X7_PID, 1) },
+ /* GE Healthcare devices */
+ { USB_DEVICE(GE_HEALTHCARE_VID, GE_HEALTHCARE_NEMO_TRACKER_PID) },
+ /* Active Research (Actisense) devices */
+diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
+index 48db84f25cc9..db1a9b3a5f38 100644
+--- a/drivers/usb/serial/ftdi_sio_ids.h
++++ b/drivers/usb/serial/ftdi_sio_ids.h
+@@ -626,8 +626,9 @@
+ /*
+ * Infineon Technologies
+ */
+-#define INFINEON_VID 0x058b
+-#define INFINEON_TRIBOARD_PID 0x0028 /* DAS JTAG TriBoard TC1798 V1.0 */
++#define INFINEON_VID 0x058b
++#define INFINEON_TRIBOARD_TC1798_PID 0x0028 /* DAS JTAG TriBoard TC1798 V1.0 */
++#define INFINEON_TRIBOARD_TC2X7_PID 0x0043 /* DAS JTAG TriBoard TC2X7 V1.0 */
+
+ /*
+ * Acton Research Corp.
+diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c
+index d3bf8348e638..a290891ddd84 100644
+--- a/drivers/usb/serial/usb-serial.c
++++ b/drivers/usb/serial/usb-serial.c
+@@ -1061,7 +1061,8 @@ static int usb_serial_probe(struct usb_interface *interface,
+
+ serial->disconnected = 0;
+
+- usb_serial_console_init(serial->port[0]->minor);
++ if (num_ports > 0)
++ usb_serial_console_init(serial->port[0]->minor);
+ exit:
+ module_put(type->driver.owner);
+ return 0;
+diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
+index ccad76a482ca..6f5fe1104ec6 100644
+--- a/fs/btrfs/tree-log.c
++++ b/fs/btrfs/tree-log.c
+@@ -2453,14 +2453,12 @@ static inline void btrfs_remove_all_log_ctxs(struct btrfs_root *root,
+ int index, int error)
+ {
+ struct btrfs_log_ctx *ctx;
++ struct btrfs_log_ctx *safe;
+
+- if (!error) {
+- INIT_LIST_HEAD(&root->log_ctxs[index]);
+- return;
+- }
+-
+- list_for_each_entry(ctx, &root->log_ctxs[index], list)
++ list_for_each_entry_safe(ctx, safe, &root->log_ctxs[index], list) {
++ list_del_init(&ctx->list);
+ ctx->log_ret = error;
++ }
+
+ INIT_LIST_HEAD(&root->log_ctxs[index]);
+ }
+@@ -2690,13 +2688,9 @@ int btrfs_sync_log(struct btrfs_trans_handle *trans,
+ mutex_unlock(&root->log_mutex);
+
+ out_wake_log_root:
+- /*
+- * We needn't get log_mutex here because we are sure all
+- * the other tasks are blocked.
+- */
++ mutex_lock(&log_root_tree->log_mutex);
+ btrfs_remove_all_log_ctxs(log_root_tree, index2, ret);
+
+- mutex_lock(&log_root_tree->log_mutex);
+ log_root_tree->log_transid_committed++;
+ atomic_set(&log_root_tree->log_commit[index2], 0);
+ mutex_unlock(&log_root_tree->log_mutex);
+@@ -2704,10 +2698,8 @@ out_wake_log_root:
+ if (waitqueue_active(&log_root_tree->log_commit_wait[index2]))
+ wake_up(&log_root_tree->log_commit_wait[index2]);
+ out:
+- /* See above. */
+- btrfs_remove_all_log_ctxs(root, index1, ret);
+-
+ mutex_lock(&root->log_mutex);
++ btrfs_remove_all_log_ctxs(root, index1, ret);
+ root->log_transid_committed++;
+ atomic_set(&root->log_commit[index1], 0);
+ mutex_unlock(&root->log_mutex);
+diff --git a/fs/isofs/inode.c b/fs/isofs/inode.c
+index d67a16f2a45d..350f67fb5b9c 100644
+--- a/fs/isofs/inode.c
++++ b/fs/isofs/inode.c
+@@ -690,6 +690,11 @@ static int isofs_fill_super(struct super_block *s, void *data, int silent)
+ pri_bh = NULL;
+
+ root_found:
++ /* We don't support read-write mounts */
++ if (!(s->s_flags & MS_RDONLY)) {
++ error = -EACCES;
++ goto out_freebh;
++ }
+
+ if (joliet_level && (pri == NULL || !opt.rock)) {
+ /* This is the case of Joliet with the norock mount flag.
+@@ -1503,9 +1508,6 @@ struct inode *__isofs_iget(struct super_block *sb,
+ static struct dentry *isofs_mount(struct file_system_type *fs_type,
+ int flags, const char *dev_name, void *data)
+ {
+- /* We don't support read-write mounts */
+- if (!(flags & MS_RDONLY))
+- return ERR_PTR(-EACCES);
+ return mount_bdev(fs_type, flags, dev_name, data, isofs_fill_super);
+ }
+
+diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c
+index ff2f2e6ad311..2abbb2babcae 100644
+--- a/fs/jbd2/transaction.c
++++ b/fs/jbd2/transaction.c
+@@ -1087,6 +1087,7 @@ int jbd2_journal_get_create_access(handle_t *handle, struct buffer_head *bh)
+ JBUFFER_TRACE(jh, "file as BJ_Reserved");
+ spin_lock(&journal->j_list_lock);
+ __jbd2_journal_file_buffer(jh, transaction, BJ_Reserved);
++ spin_unlock(&journal->j_list_lock);
+ } else if (jh->b_transaction == journal->j_committing_transaction) {
+ /* first access by this transaction */
+ jh->b_modified = 0;
+@@ -1094,8 +1095,8 @@ int jbd2_journal_get_create_access(handle_t *handle, struct buffer_head *bh)
+ JBUFFER_TRACE(jh, "set next transaction");
+ spin_lock(&journal->j_list_lock);
+ jh->b_next_transaction = transaction;
++ spin_unlock(&journal->j_list_lock);
+ }
+- spin_unlock(&journal->j_list_lock);
+ jbd_unlock_bh_state(bh);
+
+ /*
+diff --git a/fs/overlayfs/copy_up.c b/fs/overlayfs/copy_up.c
+index 4cb1c10c7706..ca48dff09e19 100644
+--- a/fs/overlayfs/copy_up.c
++++ b/fs/overlayfs/copy_up.c
+@@ -129,6 +129,8 @@ static int ovl_copy_up_data(struct path *old, struct path *new, loff_t len)
+ len -= bytes;
+ }
+
++ if (!error)
++ error = vfs_fsync(new_file, 0);
+ fput(new_file);
+ out_fput:
+ fput(old_file);
+diff --git a/fs/ubifs/xattr.c b/fs/ubifs/xattr.c
+index 5e0a63b1b0d5..ce6c0d4aa48d 100644
+--- a/fs/ubifs/xattr.c
++++ b/fs/ubifs/xattr.c
+@@ -167,6 +167,7 @@ out_cancel:
+ host_ui->xattr_cnt -= 1;
+ host_ui->xattr_size -= CALC_DENT_SIZE(nm->len);
+ host_ui->xattr_size -= CALC_XATTR_BYTES(size);
++ host_ui->xattr_names -= nm->len;
+ mutex_unlock(&host_ui->ui_mutex);
+ out_free:
+ make_bad_inode(inode);
+@@ -514,6 +515,7 @@ out_cancel:
+ host_ui->xattr_cnt += 1;
+ host_ui->xattr_size += CALC_DENT_SIZE(nm->len);
+ host_ui->xattr_size += CALC_XATTR_BYTES(ui->data_len);
++ host_ui->xattr_names += nm->len;
+ mutex_unlock(&host_ui->ui_mutex);
+ ubifs_release_budget(c, &req);
+ make_bad_inode(inode);
+diff --git a/fs/xfs/libxfs/xfs_dquot_buf.c b/fs/xfs/libxfs/xfs_dquot_buf.c
+index c6fba7314e8f..7c45d324880b 100644
+--- a/fs/xfs/libxfs/xfs_dquot_buf.c
++++ b/fs/xfs/libxfs/xfs_dquot_buf.c
+@@ -193,8 +193,7 @@ xfs_dquot_buf_verify_crc(
+ if (mp->m_quotainfo)
+ ndquots = mp->m_quotainfo->qi_dqperchunk;
+ else
+- ndquots = xfs_calc_dquots_per_chunk(
+- XFS_BB_TO_FSB(mp, bp->b_length));
++ ndquots = xfs_calc_dquots_per_chunk(bp->b_length);
+
+ for (i = 0; i < ndquots; i++, d++) {
+ if (!xfs_verify_cksum((char *)d, sizeof(struct xfs_dqblk),
+diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
+index 2a5d388d76a4..ee26711a952a 100644
+--- a/net/ipv4/udp.c
++++ b/net/ipv4/udp.c
+@@ -1252,6 +1252,7 @@ int udp_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
+ int peeked, off = 0;
+ int err;
+ int is_udplite = IS_UDPLITE(sk);
++ bool checksum_valid = false;
+ bool slow;
+
+ if (flags & MSG_ERRQUEUE)
+@@ -1277,11 +1278,12 @@ try_again:
+ */
+
+ if (copied < ulen || UDP_SKB_CB(skb)->partial_cov) {
+- if (udp_lib_checksum_complete(skb))
++ checksum_valid = !udp_lib_checksum_complete(skb);
++ if (!checksum_valid)
+ goto csum_copy_err;
+ }
+
+- if (skb_csum_unnecessary(skb))
++ if (checksum_valid || skb_csum_unnecessary(skb))
+ err = skb_copy_datagram_iovec(skb, sizeof(struct udphdr),
+ msg->msg_iov, copied);
+ else {
+diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
+index 7d0111696190..143e6c758b18 100644
+--- a/net/ipv6/udp.c
++++ b/net/ipv6/udp.c
+@@ -388,6 +388,7 @@ int udpv6_recvmsg(struct kiocb *iocb, struct sock *sk,
+ int peeked, off = 0;
+ int err;
+ int is_udplite = IS_UDPLITE(sk);
++ bool checksum_valid = false;
+ int is_udp4;
+ bool slow;
+
+@@ -419,11 +420,12 @@ try_again:
+ */
+
+ if (copied < ulen || UDP_SKB_CB(skb)->partial_cov) {
+- if (udp_lib_checksum_complete(skb))
++ checksum_valid = !udp_lib_checksum_complete(skb);
++ if (!checksum_valid)
+ goto csum_copy_err;
+ }
+
+- if (skb_csum_unnecessary(skb))
++ if (checksum_valid || skb_csum_unnecessary(skb))
+ err = skb_copy_datagram_iovec(skb, sizeof(struct udphdr),
+ msg->msg_iov, copied);
+ else {
+diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
+index c848d0b38c86..bb6f6ef07566 100644
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -2040,16 +2040,22 @@ ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx)
+ if (!(status->rx_flags & IEEE80211_RX_AMSDU))
+ return RX_CONTINUE;
+
+- if (ieee80211_has_a4(hdr->frame_control) &&
+- rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
+- !rx->sdata->u.vlan.sta)
+- return RX_DROP_UNUSABLE;
++ if (unlikely(ieee80211_has_a4(hdr->frame_control))) {
++ switch (rx->sdata->vif.type) {
++ case NL80211_IFTYPE_AP_VLAN:
++ if (!rx->sdata->u.vlan.sta)
++ return RX_DROP_UNUSABLE;
++ break;
++ case NL80211_IFTYPE_STATION:
++ if (!rx->sdata->u.mgd.use_4addr)
++ return RX_DROP_UNUSABLE;
++ break;
++ default:
++ return RX_DROP_UNUSABLE;
++ }
++ }
+
+- if (is_multicast_ether_addr(hdr->addr1) &&
+- ((rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
+- rx->sdata->u.vlan.sta) ||
+- (rx->sdata->vif.type == NL80211_IFTYPE_STATION &&
+- rx->sdata->u.mgd.use_4addr)))
++ if (is_multicast_ether_addr(hdr->addr1))
+ return RX_DROP_UNUSABLE;
+
+ skb->dev = dev;
+diff --git a/security/keys/proc.c b/security/keys/proc.c
+index 972eeb336b81..9962535ef9ad 100644
+--- a/security/keys/proc.c
++++ b/security/keys/proc.c
+@@ -187,7 +187,7 @@ static int proc_keys_show(struct seq_file *m, void *v)
+ struct timespec now;
+ unsigned long timo;
+ key_ref_t key_ref, skey_ref;
+- char xbuf[12];
++ char xbuf[16];
+ int rc;
+
+ struct keyring_search_context ctx = {
+diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h
+index 17e1fdabd456..0051077a7b9d 100644
+--- a/sound/usb/quirks-table.h
++++ b/sound/usb/quirks-table.h
+@@ -2942,6 +2942,23 @@ AU0828_DEVICE(0x2040, 0x7260, "Hauppauge", "HVR-950Q"),
+ AU0828_DEVICE(0x2040, 0x7213, "Hauppauge", "HVR-950Q"),
+ AU0828_DEVICE(0x2040, 0x7270, "Hauppauge", "HVR-950Q"),
+
++/* Syntek STK1160 */
++{
++ .match_flags = USB_DEVICE_ID_MATCH_DEVICE |
++ USB_DEVICE_ID_MATCH_INT_CLASS |
++ USB_DEVICE_ID_MATCH_INT_SUBCLASS,
++ .idVendor = 0x05e1,
++ .idProduct = 0x0408,
++ .bInterfaceClass = USB_CLASS_AUDIO,
++ .bInterfaceSubClass = USB_SUBCLASS_AUDIOCONTROL,
++ .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) {
++ .vendor_name = "Syntek",
++ .product_name = "STK1160",
++ .ifnum = QUIRK_ANY_INTERFACE,
++ .type = QUIRK_AUDIO_ALIGN_TRANSFER
++ }
++},
++
+ /* Digidesign Mbox */
+ {
+ /* Thanks to Clemens Ladisch <clemens@ladisch.de> */
^ permalink raw reply related [flat|nested] 67+ messages in thread
* [gentoo-commits] proj/linux-patches:3.18 commit in: /
@ 2016-12-09 0:21 Mike Pagano
0 siblings, 0 replies; 67+ messages in thread
From: Mike Pagano @ 2016-12-09 0:21 UTC (permalink / raw
To: gentoo-commits
commit: 87b13d6bac6d00a8642f237b111b7b16150c4342
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Fri Dec 9 00:21:01 2016 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Fri Dec 9 00:21:01 2016 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=87b13d6b
Fix race condition in packet_set_ring. CVE-2016-8655. Bug #601926.
0000_README | 4 ++
1520_fix-race-condition-in-packet-set-ring.patch | 62 ++++++++++++++++++++++++
2 files changed, 66 insertions(+)
diff --git a/0000_README b/0000_README
index bdec9ea..7eda87f 100644
--- a/0000_README
+++ b/0000_README
@@ -231,6 +231,10 @@ Patch: 1510_fs-enable-link-security-restrictions-by-default.patch
From: http://sources.debian.net/src/linux/3.16.7-ckt4-3/debian/patches/debian/fs-enable-link-security-restrictions-by-default.patch/
Desc: Enable link security restrictions by default
+Patch: 1520_fix-race-condition-in-packet-set-ring.patch
+From: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=84ac7260236a49c79eede91617700174c2c19b0c
+Desc: packet: fix race condition in packet_set_ring. CVE-2016-8655. Bug #601926.
+
Patch: 1700_ARM-dts-patch-to-support-popoplug-e02.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=508248
Desc: ARM: dts: Add support for Pogoplug E02.
diff --git a/1520_fix-race-condition-in-packet-set-ring.patch b/1520_fix-race-condition-in-packet-set-ring.patch
new file mode 100644
index 0000000..d85527f
--- /dev/null
+++ b/1520_fix-race-condition-in-packet-set-ring.patch
@@ -0,0 +1,62 @@
+--- a/net/packet/af_packet.c 2016-12-07 18:10:25.785812861 -0500
++++ b/net/packet/af_packet.c 2016-12-07 18:18:45.597933525 -0500
+@@ -3648,19 +3648,25 @@ packet_setsockopt(struct socket *sock, i
+
+ if (optlen != sizeof(val))
+ return -EINVAL;
+- if (po->rx_ring.pg_vec || po->tx_ring.pg_vec)
+- return -EBUSY;
+ if (copy_from_user(&val, optval, sizeof(val)))
+ return -EFAULT;
+ switch (val) {
+ case TPACKET_V1:
+ case TPACKET_V2:
+ case TPACKET_V3:
+- po->tp_version = val;
+- return 0;
++ break;
+ default:
+ return -EINVAL;
+ }
++ lock_sock(sk);
++ if (po->rx_ring.pg_vec || po->tx_ring.pg_vec) {
++ ret = -EBUSY;
++ } else {
++ po->tp_version = val;
++ ret = 0;
++ }
++ release_sock(sk);
++ return ret;
+ }
+ case PACKET_RESERVE:
+ {
+@@ -4164,6 +4170,7 @@ static int packet_set_ring(struct sock *
+ /* Added to avoid minimal code churn */
+ struct tpacket_req *req = &req_u->req;
+
++ lock_sock(sk);
+ /* Opening a Tx-ring is NOT supported in TPACKET_V3 */
+ if (!closing && tx_ring && (po->tp_version > TPACKET_V2)) {
+ net_warn_ratelimited("Tx-ring is not supported.\n");
+@@ -4245,8 +4252,6 @@ static int packet_set_ring(struct sock *
+ goto out;
+ }
+
+- lock_sock(sk);
+-
+ /* Detach socket from network */
+ spin_lock(&po->bind_lock);
+ was_running = po->running;
+@@ -4294,11 +4299,11 @@ static int packet_set_ring(struct sock *
+ if (!tx_ring)
+ prb_shutdown_retire_blk_timer(po, rb_queue);
+ }
+- release_sock(sk);
+
+ if (pg_vec)
+ free_pg_vec(pg_vec, order, req->tp_block_nr);
+ out:
++ release_sock(sk);
+ return err;
+ }
+
^ permalink raw reply related [flat|nested] 67+ messages in thread
* [gentoo-commits] proj/linux-patches:3.18 commit in: /
@ 2017-01-18 21:38 Mike Pagano
0 siblings, 0 replies; 67+ messages in thread
From: Mike Pagano @ 2017-01-18 21:38 UTC (permalink / raw
To: gentoo-commits
commit: 54ad828df23ad0b32ae21e574ae1fe38fd441918
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed Jan 18 21:38:20 2017 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed Jan 18 21:38:20 2017 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=54ad828d
Linux patches 3.18.46 and 3.18.47
0000_README | 8 +
1045_linux-3.18.46.patch | 728 ++++++++++++++++++
1046_linux-3.18.47.patch | 1831 ++++++++++++++++++++++++++++++++++++++++++++++
3 files changed, 2567 insertions(+)
diff --git a/0000_README b/0000_README
index 7eda87f..4efb409 100644
--- a/0000_README
+++ b/0000_README
@@ -223,6 +223,14 @@ Patch: 1044_linux-3.18.45.patch
From: http://www.kernel.org
Desc: Linux 3.18.45
+Patch: 1045_linux-3.18.46.patch
+From: http://www.kernel.org
+Desc: Linux 3.18.46
+
+Patch: 1046_linux-3.18.47.patch
+From: http://www.kernel.org
+Desc: Linux 3.18.47
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1045_linux-3.18.46.patch b/1045_linux-3.18.46.patch
new file mode 100644
index 0000000..d6886bb
--- /dev/null
+++ b/1045_linux-3.18.46.patch
@@ -0,0 +1,728 @@
+diff --git a/Documentation/arm/CCN.txt b/Documentation/arm/CCN.txt
+index 0632b3aad83e..715776f06df6 100644
+--- a/Documentation/arm/CCN.txt
++++ b/Documentation/arm/CCN.txt
+@@ -38,7 +38,7 @@ Example of perf tool use:
+ / # perf list | grep ccn
+ ccn/cycles/ [Kernel PMU event]
+ <...>
+- ccn/xp_valid_flit/ [Kernel PMU event]
++ ccn/xp_valid_flit,xp=?,port=?,vc=?,dir=?/ [Kernel PMU event]
+ <...>
+
+ / # perf stat -C 0 -e ccn/cycles/,ccn/xp_valid_flit,xp=1,port=0,vc=1,dir=1/ \
+diff --git a/Makefile b/Makefile
+index de29f33d03a9..e73fd98d4cfc 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 18
+-SUBLEVEL = 45
++SUBLEVEL = 46
+ EXTRAVERSION =
+ NAME = Diseased Newt
+
+diff --git a/arch/arm/include/asm/dma-mapping.h b/arch/arm/include/asm/dma-mapping.h
+index 85738b200023..260308cd9b83 100644
+--- a/arch/arm/include/asm/dma-mapping.h
++++ b/arch/arm/include/asm/dma-mapping.h
+@@ -117,7 +117,7 @@ static inline dma_addr_t virt_to_dma(struct device *dev, void *addr)
+ /* The ARM override for dma_max_pfn() */
+ static inline unsigned long dma_max_pfn(struct device *dev)
+ {
+- return PHYS_PFN_OFFSET + dma_to_pfn(dev, *dev->dma_mask);
++ return dma_to_pfn(dev, *dev->dma_mask);
+ }
+ #define dma_max_pfn(dev) dma_max_pfn(dev)
+
+diff --git a/arch/x86/include/asm/tlbflush.h b/arch/x86/include/asm/tlbflush.h
+index cd791948b286..7e459b7ee708 100644
+--- a/arch/x86/include/asm/tlbflush.h
++++ b/arch/x86/include/asm/tlbflush.h
+@@ -32,7 +32,7 @@ DECLARE_PER_CPU_SHARED_ALIGNED(struct tlb_state, cpu_tlbstate);
+ /* Initialize cr4 shadow for this CPU. */
+ static inline void cr4_init_shadow(void)
+ {
+- this_cpu_write(cpu_tlbstate.cr4, __read_cr4());
++ this_cpu_write(cpu_tlbstate.cr4, __read_cr4_safe());
+ }
+
+ /* Set in this cpu's CR4. */
+diff --git a/arch/x86/purgatory/Makefile b/arch/x86/purgatory/Makefile
+index f52e033557c9..43653ba4d784 100644
+--- a/arch/x86/purgatory/Makefile
++++ b/arch/x86/purgatory/Makefile
+@@ -12,6 +12,7 @@ targets += purgatory.ro
+
+ KBUILD_CFLAGS := -fno-strict-aliasing -Wall -Wstrict-prototypes -fno-zero-initialized-in-bss -fno-builtin -ffreestanding -c -MD -Os -mcmodel=large
+ KBUILD_CFLAGS += -m$(BITS)
++KBUILD_CFLAGS += $(call cc-option,-fno-PIE)
+
+ $(obj)/purgatory.ro: $(PURGATORY_OBJS) FORCE
+ $(call if_changed,ld)
+diff --git a/drivers/bus/arm-ccn.c b/drivers/bus/arm-ccn.c
+index 27fd0dacad5f..4d523cfe51ce 100644
+--- a/drivers/bus/arm-ccn.c
++++ b/drivers/bus/arm-ccn.c
+@@ -183,6 +183,7 @@ struct arm_ccn {
+ struct arm_ccn_component *xp;
+
+ struct arm_ccn_dt dt;
++ int mn_id;
+ };
+
+
+@@ -322,6 +323,7 @@ struct arm_ccn_pmu_event {
+ static ssize_t arm_ccn_pmu_event_show(struct device *dev,
+ struct device_attribute *attr, char *buf)
+ {
++ struct arm_ccn *ccn = pmu_to_arm_ccn(dev_get_drvdata(dev));
+ struct arm_ccn_pmu_event *event = container_of(attr,
+ struct arm_ccn_pmu_event, attr);
+ ssize_t res;
+@@ -336,6 +338,26 @@ static ssize_t arm_ccn_pmu_event_show(struct device *dev,
+ if (event->mask)
+ res += snprintf(buf + res, PAGE_SIZE - res, ",mask=0x%x",
+ event->mask);
++
++ /* Arguments required by an event */
++ switch (event->type) {
++ case CCN_TYPE_CYCLES:
++ break;
++ case CCN_TYPE_XP:
++ res += snprintf(buf + res, PAGE_SIZE - res,
++ ",xp=?,port=?,vc=?,dir=?");
++ if (event->event == CCN_EVENT_WATCHPOINT)
++ res += snprintf(buf + res, PAGE_SIZE - res,
++ ",cmp_l=?,cmp_h=?,mask=?");
++ break;
++ case CCN_TYPE_MN:
++ res += snprintf(buf + res, PAGE_SIZE - res, ",node=%d", ccn->mn_id);
++ break;
++ default:
++ res += snprintf(buf + res, PAGE_SIZE - res, ",node=?");
++ break;
++ }
++
+ res += snprintf(buf + res, PAGE_SIZE - res, "\n");
+
+ return res;
+@@ -360,9 +382,9 @@ static umode_t arm_ccn_pmu_events_is_visible(struct kobject *kobj,
+ }
+
+ static struct arm_ccn_pmu_event arm_ccn_pmu_events[] = {
+- CCN_EVENT_MN(eobarrier, "dir=0,vc=0,cmp_h=0x1c00", CCN_IDX_MASK_OPCODE),
+- CCN_EVENT_MN(ecbarrier, "dir=0,vc=0,cmp_h=0x1e00", CCN_IDX_MASK_OPCODE),
+- CCN_EVENT_MN(dvmop, "dir=0,vc=0,cmp_h=0x2800", CCN_IDX_MASK_OPCODE),
++ CCN_EVENT_MN(eobarrier, "dir=1,vc=0,cmp_h=0x1c00", CCN_IDX_MASK_OPCODE),
++ CCN_EVENT_MN(ecbarrier, "dir=1,vc=0,cmp_h=0x1e00", CCN_IDX_MASK_OPCODE),
++ CCN_EVENT_MN(dvmop, "dir=1,vc=0,cmp_h=0x2800", CCN_IDX_MASK_OPCODE),
+ CCN_EVENT_HNI(txdatflits, "dir=1,vc=3", CCN_IDX_MASK_ANY),
+ CCN_EVENT_HNI(rxdatflits, "dir=0,vc=3", CCN_IDX_MASK_ANY),
+ CCN_EVENT_HNI(txreqflits, "dir=1,vc=0", CCN_IDX_MASK_ANY),
+@@ -649,6 +671,12 @@ static int arm_ccn_pmu_event_init(struct perf_event *event)
+
+ /* Validate node/xp vs topology */
+ switch (type) {
++ case CCN_TYPE_MN:
++ if (node_xp != ccn->mn_id) {
++ dev_warn(ccn->dev, "Invalid MN ID %d!\n", node_xp);
++ return -EINVAL;
++ }
++ break;
+ case CCN_TYPE_XP:
+ if (node_xp >= ccn->num_xps) {
+ dev_warn(ccn->dev, "Invalid XP ID %d!\n", node_xp);
+@@ -1214,6 +1242,8 @@ static int arm_ccn_init_nodes(struct arm_ccn *ccn, int region,
+
+ switch (type) {
+ case CCN_TYPE_MN:
++ ccn->mn_id = id;
++ return 0;
+ case CCN_TYPE_DT:
+ return 0;
+ case CCN_TYPE_XP:
+diff --git a/drivers/gpu/drm/msm/msm_gem_submit.c b/drivers/gpu/drm/msm/msm_gem_submit.c
+index cd0554f68316..4ff8c334e7c8 100644
+--- a/drivers/gpu/drm/msm/msm_gem_submit.c
++++ b/drivers/gpu/drm/msm/msm_gem_submit.c
+@@ -55,6 +55,14 @@ static struct msm_gem_submit *submit_create(struct drm_device *dev,
+ return submit;
+ }
+
++static inline unsigned long __must_check
++copy_from_user_inatomic(void *to, const void __user *from, unsigned long n)
++{
++ if (access_ok(VERIFY_READ, from, n))
++ return __copy_from_user_inatomic(to, from, n);
++ return -EFAULT;
++}
++
+ static int submit_lookup_objects(struct msm_gem_submit *submit,
+ struct drm_msm_gem_submit *args, struct drm_file *file)
+ {
+@@ -62,6 +70,7 @@ static int submit_lookup_objects(struct msm_gem_submit *submit,
+ int ret = 0;
+
+ spin_lock(&file->table_lock);
++ pagefault_disable();
+
+ for (i = 0; i < args->nr_bos; i++) {
+ struct drm_msm_gem_submit_bo submit_bo;
+@@ -70,10 +79,15 @@ static int submit_lookup_objects(struct msm_gem_submit *submit,
+ void __user *userptr =
+ to_user_ptr(args->bos + (i * sizeof(submit_bo)));
+
+- ret = copy_from_user(&submit_bo, userptr, sizeof(submit_bo));
+- if (ret) {
+- ret = -EFAULT;
+- goto out_unlock;
++ ret = copy_from_user_inatomic(&submit_bo, userptr, sizeof(submit_bo));
++ if (unlikely(ret)) {
++ pagefault_enable();
++ spin_unlock(&file->table_lock);
++ ret = copy_from_user(&submit_bo, userptr, sizeof(submit_bo));
++ if (ret)
++ goto out;
++ spin_lock(&file->table_lock);
++ pagefault_disable();
+ }
+
+ if (submit_bo.flags & ~MSM_SUBMIT_BO_FLAGS) {
+@@ -113,9 +127,12 @@ static int submit_lookup_objects(struct msm_gem_submit *submit,
+ }
+
+ out_unlock:
+- submit->nr_bos = i;
++ pagefault_enable();
+ spin_unlock(&file->table_lock);
+
++out:
++ submit->nr_bos = i;
++
+ return ret;
+ }
+
+diff --git a/drivers/mtd/nand/davinci_nand.c b/drivers/mtd/nand/davinci_nand.c
+index b922c8efcf40..0ba96f9e1aa5 100644
+--- a/drivers/mtd/nand/davinci_nand.c
++++ b/drivers/mtd/nand/davinci_nand.c
+@@ -241,6 +241,9 @@ static void nand_davinci_hwctl_4bit(struct mtd_info *mtd, int mode)
+ unsigned long flags;
+ u32 val;
+
++ /* Reset ECC hardware */
++ davinci_nand_readl(info, NAND_4BIT_ECC1_OFFSET);
++
+ spin_lock_irqsave(&davinci_nand_lock, flags);
+
+ /* Start 4-bit ECC calculation for read/write */
+diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c
+index bcefb375d232..031b6877acf9 100644
+--- a/drivers/net/can/dev.c
++++ b/drivers/net/can/dev.c
+@@ -21,6 +21,7 @@
+ #include <linux/slab.h>
+ #include <linux/netdevice.h>
+ #include <linux/if_arp.h>
++#include <linux/workqueue.h>
+ #include <linux/can.h>
+ #include <linux/can/dev.h>
+ #include <linux/can/skb.h>
+@@ -391,9 +392,8 @@ EXPORT_SYMBOL_GPL(can_free_echo_skb);
+ /*
+ * CAN device restart for bus-off recovery
+ */
+-static void can_restart(unsigned long data)
++static void can_restart(struct net_device *dev)
+ {
+- struct net_device *dev = (struct net_device *)data;
+ struct can_priv *priv = netdev_priv(dev);
+ struct net_device_stats *stats = &dev->stats;
+ struct sk_buff *skb;
+@@ -433,6 +433,14 @@ restart:
+ netdev_err(dev, "Error %d during restart", err);
+ }
+
++static void can_restart_work(struct work_struct *work)
++{
++ struct delayed_work *dwork = to_delayed_work(work);
++ struct can_priv *priv = container_of(dwork, struct can_priv, restart_work);
++
++ can_restart(priv->dev);
++}
++
+ int can_restart_now(struct net_device *dev)
+ {
+ struct can_priv *priv = netdev_priv(dev);
+@@ -446,8 +454,8 @@ int can_restart_now(struct net_device *dev)
+ if (priv->state != CAN_STATE_BUS_OFF)
+ return -EBUSY;
+
+- /* Runs as soon as possible in the timer context */
+- mod_timer(&priv->restart_timer, jiffies);
++ cancel_delayed_work_sync(&priv->restart_work);
++ can_restart(dev);
+
+ return 0;
+ }
+@@ -469,8 +477,8 @@ void can_bus_off(struct net_device *dev)
+ priv->can_stats.bus_off++;
+
+ if (priv->restart_ms)
+- mod_timer(&priv->restart_timer,
+- jiffies + (priv->restart_ms * HZ) / 1000);
++ schedule_delayed_work(&priv->restart_work,
++ msecs_to_jiffies(priv->restart_ms));
+ }
+ EXPORT_SYMBOL_GPL(can_bus_off);
+
+@@ -577,6 +585,7 @@ struct net_device *alloc_candev(int sizeof_priv, unsigned int echo_skb_max)
+ return NULL;
+
+ priv = netdev_priv(dev);
++ priv->dev = dev;
+
+ if (echo_skb_max) {
+ priv->echo_skb_max = echo_skb_max;
+@@ -586,7 +595,7 @@ struct net_device *alloc_candev(int sizeof_priv, unsigned int echo_skb_max)
+
+ priv->state = CAN_STATE_STOPPED;
+
+- init_timer(&priv->restart_timer);
++ INIT_DELAYED_WORK(&priv->restart_work, can_restart_work);
+
+ return dev;
+ }
+@@ -667,8 +676,6 @@ int open_candev(struct net_device *dev)
+ if (!netif_carrier_ok(dev))
+ netif_carrier_on(dev);
+
+- setup_timer(&priv->restart_timer, can_restart, (unsigned long)dev);
+-
+ return 0;
+ }
+ EXPORT_SYMBOL_GPL(open_candev);
+@@ -683,7 +690,7 @@ void close_candev(struct net_device *dev)
+ {
+ struct can_priv *priv = netdev_priv(dev);
+
+- del_timer_sync(&priv->restart_timer);
++ cancel_delayed_work_sync(&priv->restart_work);
+ can_flush_echo_skb(dev);
+ }
+ EXPORT_SYMBOL_GPL(close_candev);
+diff --git a/drivers/scsi/arcmsr/arcmsr_hba.c b/drivers/scsi/arcmsr/arcmsr_hba.c
+index 7bded8e3f116..ce6b16991068 100644
+--- a/drivers/scsi/arcmsr/arcmsr_hba.c
++++ b/drivers/scsi/arcmsr/arcmsr_hba.c
+@@ -2305,7 +2305,8 @@ static int arcmsr_iop_message_xfer(struct AdapterControlBlock *acb,
+ }
+ case ARCMSR_MESSAGE_WRITE_WQBUFFER: {
+ unsigned char *ver_addr;
+- int32_t user_len, cnt2end;
++ uint32_t user_len;
++ int32_t cnt2end;
+ uint8_t *pQbuffer, *ptmpuserbuffer;
+ ver_addr = kmalloc(ARCMSR_API_DATA_BUFLEN, GFP_ATOMIC);
+ if (!ver_addr) {
+@@ -2314,6 +2315,11 @@ static int arcmsr_iop_message_xfer(struct AdapterControlBlock *acb,
+ }
+ ptmpuserbuffer = ver_addr;
+ user_len = pcmdmessagefld->cmdmessage.Length;
++ if (user_len > ARCMSR_API_DATA_BUFLEN) {
++ retvalue = ARCMSR_MESSAGE_FAIL;
++ kfree(ver_addr);
++ goto message_out;
++ }
+ memcpy(ptmpuserbuffer,
+ pcmdmessagefld->messagedatabuffer, user_len);
+ spin_lock_irqsave(&acb->wqbuffer_lock, flags);
+diff --git a/drivers/scsi/megaraid/megaraid_sas.h b/drivers/scsi/megaraid/megaraid_sas.h
+index a49914de4b95..4cf75e01c498 100644
+--- a/drivers/scsi/megaraid/megaraid_sas.h
++++ b/drivers/scsi/megaraid/megaraid_sas.h
+@@ -1823,7 +1823,7 @@ struct megasas_instance_template {
+ };
+
+ #define MEGASAS_IS_LOGICAL(scp) \
+- (scp->device->channel < MEGASAS_MAX_PD_CHANNELS) ? 0 : 1
++ ((scp->device->channel < MEGASAS_MAX_PD_CHANNELS) ? 0 : 1)
+
+ #define MEGASAS_DEV_INDEX(inst, scp) \
+ ((scp->device->channel % 2) * MEGASAS_MAX_DEV_PER_CHANNEL) + \
+diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c
+index dbab798f5caf..015e21edd6bc 100644
+--- a/fs/fuse/dir.c
++++ b/fs/fuse/dir.c
+@@ -1693,9 +1693,10 @@ int fuse_flush_times(struct inode *inode, struct fuse_file *ff)
+ * vmtruncate() doesn't allow for this case, so do the rlimit checking
+ * and the actual truncation by hand.
+ */
+-int fuse_do_setattr(struct inode *inode, struct iattr *attr,
++int fuse_do_setattr(struct dentry *dentry, struct iattr *attr,
+ struct file *file)
+ {
++ struct inode *inode = d_inode(dentry);
+ struct fuse_conn *fc = get_fuse_conn(inode);
+ struct fuse_inode *fi = get_fuse_inode(inode);
+ struct fuse_req *req;
+@@ -1815,9 +1816,9 @@ static int fuse_setattr(struct dentry *entry, struct iattr *attr)
+ return -EACCES;
+
+ if (attr->ia_valid & ATTR_FILE)
+- return fuse_do_setattr(inode, attr, attr->ia_file);
++ return fuse_do_setattr(entry, attr, attr->ia_file);
+ else
+- return fuse_do_setattr(inode, attr, NULL);
++ return fuse_do_setattr(entry, attr, NULL);
+ }
+
+ static int fuse_getattr(struct vfsmount *mnt, struct dentry *entry,
+diff --git a/fs/fuse/file.c b/fs/fuse/file.c
+index 8e2c5ccc09b1..52717269a5ac 100644
+--- a/fs/fuse/file.c
++++ b/fs/fuse/file.c
+@@ -2879,7 +2879,7 @@ static void fuse_do_truncate(struct file *file)
+ attr.ia_file = file;
+ attr.ia_valid |= ATTR_FILE;
+
+- fuse_do_setattr(inode, &attr, file);
++ fuse_do_setattr(file->f_path.dentry, &attr, file);
+ }
+
+ static inline loff_t fuse_round_up(loff_t off)
+diff --git a/fs/fuse/fuse_i.h b/fs/fuse/fuse_i.h
+index e8e47a6ab518..300619ba8591 100644
+--- a/fs/fuse/fuse_i.h
++++ b/fs/fuse/fuse_i.h
+@@ -894,7 +894,7 @@ bool fuse_write_update_size(struct inode *inode, loff_t pos);
+ int fuse_flush_times(struct inode *inode, struct fuse_file *ff);
+ int fuse_write_inode(struct inode *inode, struct writeback_control *wbc);
+
+-int fuse_do_setattr(struct inode *inode, struct iattr *attr,
++int fuse_do_setattr(struct dentry *dentry, struct iattr *attr,
+ struct file *file);
+
+ #endif /* _FS_FUSE_I_H */
+diff --git a/fs/nfsd/nfsproc.c b/fs/nfsd/nfsproc.c
+index b8680738f588..0ce7ce3e48cb 100644
+--- a/fs/nfsd/nfsproc.c
++++ b/fs/nfsd/nfsproc.c
+@@ -59,13 +59,61 @@ static __be32
+ nfsd_proc_setattr(struct svc_rqst *rqstp, struct nfsd_sattrargs *argp,
+ struct nfsd_attrstat *resp)
+ {
++ struct iattr *iap = &argp->attrs;
++ struct svc_fh *fhp;
+ __be32 nfserr;
++
+ dprintk("nfsd: SETATTR %s, valid=%x, size=%ld\n",
+ SVCFH_fmt(&argp->fh),
+ argp->attrs.ia_valid, (long) argp->attrs.ia_size);
+
+- fh_copy(&resp->fh, &argp->fh);
+- nfserr = nfsd_setattr(rqstp, &resp->fh, &argp->attrs,0, (time_t)0);
++ fhp = fh_copy(&resp->fh, &argp->fh);
++
++ /*
++ * NFSv2 does not differentiate between "set-[ac]time-to-now"
++ * which only requires access, and "set-[ac]time-to-X" which
++ * requires ownership.
++ * So if it looks like it might be "set both to the same time which
++ * is close to now", and if inode_change_ok fails, then we
++ * convert to "set to now" instead of "set to explicit time"
++ *
++ * We only call inode_change_ok as the last test as technically
++ * it is not an interface that we should be using.
++ */
++#define BOTH_TIME_SET (ATTR_ATIME_SET | ATTR_MTIME_SET)
++#define MAX_TOUCH_TIME_ERROR (30*60)
++ if ((iap->ia_valid & BOTH_TIME_SET) == BOTH_TIME_SET &&
++ iap->ia_mtime.tv_sec == iap->ia_atime.tv_sec) {
++ /*
++ * Looks probable.
++ *
++ * Now just make sure time is in the right ballpark.
++ * Solaris, at least, doesn't seem to care what the time
++ * request is. We require it be within 30 minutes of now.
++ */
++ time_t delta = iap->ia_atime.tv_sec - get_seconds();
++ struct inode *inode;
++
++ nfserr = fh_verify(rqstp, fhp, 0, NFSD_MAY_NOP);
++ if (nfserr)
++ goto done;
++ inode = d_inode(fhp->fh_dentry);
++
++ if (delta < 0)
++ delta = -delta;
++ if (delta < MAX_TOUCH_TIME_ERROR &&
++ inode_change_ok(inode, iap) != 0) {
++ /*
++ * Turn off ATTR_[AM]TIME_SET but leave ATTR_[AM]TIME.
++ * This will cause notify_change to set these times
++ * to "now"
++ */
++ iap->ia_valid &= ~BOTH_TIME_SET;
++ }
++ }
++
++ nfserr = nfsd_setattr(rqstp, fhp, iap, 0, (time_t)0);
++done:
+ return nfsd_return_attrs(nfserr, resp);
+ }
+
+diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
+index 989129e2d6ea..35cbf570495f 100644
+--- a/fs/nfsd/vfs.c
++++ b/fs/nfsd/vfs.c
+@@ -301,42 +301,6 @@ commit_metadata(struct svc_fh *fhp)
+ static void
+ nfsd_sanitize_attrs(struct inode *inode, struct iattr *iap)
+ {
+- /*
+- * NFSv2 does not differentiate between "set-[ac]time-to-now"
+- * which only requires access, and "set-[ac]time-to-X" which
+- * requires ownership.
+- * So if it looks like it might be "set both to the same time which
+- * is close to now", and if inode_change_ok fails, then we
+- * convert to "set to now" instead of "set to explicit time"
+- *
+- * We only call inode_change_ok as the last test as technically
+- * it is not an interface that we should be using.
+- */
+-#define BOTH_TIME_SET (ATTR_ATIME_SET | ATTR_MTIME_SET)
+-#define MAX_TOUCH_TIME_ERROR (30*60)
+- if ((iap->ia_valid & BOTH_TIME_SET) == BOTH_TIME_SET &&
+- iap->ia_mtime.tv_sec == iap->ia_atime.tv_sec) {
+- /*
+- * Looks probable.
+- *
+- * Now just make sure time is in the right ballpark.
+- * Solaris, at least, doesn't seem to care what the time
+- * request is. We require it be within 30 minutes of now.
+- */
+- time_t delta = iap->ia_atime.tv_sec - get_seconds();
+- if (delta < 0)
+- delta = -delta;
+- if (delta < MAX_TOUCH_TIME_ERROR &&
+- inode_change_ok(inode, iap) != 0) {
+- /*
+- * Turn off ATTR_[AM]TIME_SET but leave ATTR_[AM]TIME.
+- * This will cause notify_change to set these times
+- * to "now"
+- */
+- iap->ia_valid &= ~BOTH_TIME_SET;
+- }
+- }
+-
+ /* sanitize the mode change */
+ if (iap->ia_valid & ATTR_MODE) {
+ iap->ia_mode &= S_IALLUGO;
+diff --git a/include/linux/can/dev.h b/include/linux/can/dev.h
+index 71e37afd7290..49093889362c 100644
+--- a/include/linux/can/dev.h
++++ b/include/linux/can/dev.h
+@@ -31,6 +31,7 @@ enum can_mode {
+ * CAN common private data
+ */
+ struct can_priv {
++ struct net_device *dev;
+ struct can_device_stats can_stats;
+
+ struct can_bittiming bittiming, data_bittiming;
+@@ -46,7 +47,7 @@ struct can_priv {
+ u32 ctrlmode_static; /* static enabled options for driver/hardware */
+
+ int restart_ms;
+- struct timer_list restart_timer;
++ struct delayed_work restart_work;
+
+ int (*do_set_bittiming)(struct net_device *dev);
+ int (*do_set_data_bittiming)(struct net_device *dev);
+diff --git a/include/net/tcp.h b/include/net/tcp.h
+index 4062b4f0d121..7219b8f38cef 100644
+--- a/include/net/tcp.h
++++ b/include/net/tcp.h
+@@ -1431,6 +1431,8 @@ static inline void tcp_check_send_head(struct sock *sk, struct sk_buff *skb_unli
+ {
+ if (sk->sk_send_head == skb_unlinked)
+ sk->sk_send_head = NULL;
++ if (tcp_sk(sk)->highest_sack == skb_unlinked)
++ tcp_sk(sk)->highest_sack = NULL;
+ }
+
+ static inline void tcp_init_send_head(struct sock *sk)
+diff --git a/kernel/cpuset.c b/kernel/cpuset.c
+index 56dc7c1b6300..fe33cb70d89d 100644
+--- a/kernel/cpuset.c
++++ b/kernel/cpuset.c
+@@ -323,8 +323,7 @@ static struct file_system_type cpuset_fs_type = {
+ /*
+ * Return in pmask the portion of a cpusets's cpus_allowed that
+ * are online. If none are online, walk up the cpuset hierarchy
+- * until we find one that does have some online cpus. The top
+- * cpuset always has some cpus online.
++ * until we find one that does have some online cpus.
+ *
+ * One way or another, we guarantee to return some non-empty subset
+ * of cpu_online_mask.
+@@ -333,8 +332,20 @@ static struct file_system_type cpuset_fs_type = {
+ */
+ static void guarantee_online_cpus(struct cpuset *cs, struct cpumask *pmask)
+ {
+- while (!cpumask_intersects(cs->effective_cpus, cpu_online_mask))
++ while (!cpumask_intersects(cs->effective_cpus, cpu_online_mask)) {
+ cs = parent_cs(cs);
++ if (unlikely(!cs)) {
++ /*
++ * The top cpuset doesn't have any online cpu as a
++ * consequence of a race between cpuset_hotplug_work
++ * and cpu hotplug notifier. But we know the top
++ * cpuset's effective_cpus is on its way to to be
++ * identical to cpu_online_mask.
++ */
++ cpumask_copy(pmask, cpu_online_mask);
++ return;
++ }
++ }
+ cpumask_and(pmask, cs->effective_cpus, cpu_online_mask);
+ }
+
+diff --git a/mm/ksm.c b/mm/ksm.c
+index a0ed043a1096..effb699de487 100644
+--- a/mm/ksm.c
++++ b/mm/ksm.c
+@@ -283,7 +283,8 @@ static inline struct rmap_item *alloc_rmap_item(void)
+ {
+ struct rmap_item *rmap_item;
+
+- rmap_item = kmem_cache_zalloc(rmap_item_cache, GFP_KERNEL);
++ rmap_item = kmem_cache_zalloc(rmap_item_cache, GFP_KERNEL |
++ __GFP_NORETRY | __GFP_NOWARN);
+ if (rmap_item)
+ ksm_rmap_items++;
+ return rmap_item;
+diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c
+index 8bbbb5ec468c..bcb3160fefb4 100644
+--- a/net/bluetooth/rfcomm/sock.c
++++ b/net/bluetooth/rfcomm/sock.c
+@@ -334,16 +334,19 @@ static int rfcomm_sock_create(struct net *net, struct socket *sock,
+
+ static int rfcomm_sock_bind(struct socket *sock, struct sockaddr *addr, int addr_len)
+ {
+- struct sockaddr_rc *sa = (struct sockaddr_rc *) addr;
++ struct sockaddr_rc sa;
+ struct sock *sk = sock->sk;
+- int chan = sa->rc_channel;
+- int err = 0;
+-
+- BT_DBG("sk %p %pMR", sk, &sa->rc_bdaddr);
++ int len, err = 0;
+
+ if (!addr || addr->sa_family != AF_BLUETOOTH)
+ return -EINVAL;
+
++ memset(&sa, 0, sizeof(sa));
++ len = min_t(unsigned int, sizeof(sa), addr_len);
++ memcpy(&sa, addr, len);
++
++ BT_DBG("sk %p %pMR", sk, &sa.rc_bdaddr);
++
+ lock_sock(sk);
+
+ if (sk->sk_state != BT_OPEN) {
+@@ -358,12 +361,13 @@ static int rfcomm_sock_bind(struct socket *sock, struct sockaddr *addr, int addr
+
+ write_lock(&rfcomm_sk_list.lock);
+
+- if (chan && __rfcomm_get_listen_sock_by_addr(chan, &sa->rc_bdaddr)) {
++ if (sa.rc_channel &&
++ __rfcomm_get_listen_sock_by_addr(sa.rc_channel, &sa.rc_bdaddr)) {
+ err = -EADDRINUSE;
+ } else {
+ /* Save source address */
+- bacpy(&rfcomm_pi(sk)->src, &sa->rc_bdaddr);
+- rfcomm_pi(sk)->channel = chan;
++ bacpy(&rfcomm_pi(sk)->src, &sa.rc_bdaddr);
++ rfcomm_pi(sk)->channel = sa.rc_channel;
+ sk->sk_state = BT_BOUND;
+ }
+
+diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
+index e73b3fb1a144..abffc1519e4d 100644
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -3281,19 +3281,25 @@ packet_setsockopt(struct socket *sock, int level, int optname, char __user *optv
+
+ if (optlen != sizeof(val))
+ return -EINVAL;
+- if (po->rx_ring.pg_vec || po->tx_ring.pg_vec)
+- return -EBUSY;
+ if (copy_from_user(&val, optval, sizeof(val)))
+ return -EFAULT;
+ switch (val) {
+ case TPACKET_V1:
+ case TPACKET_V2:
+ case TPACKET_V3:
+- po->tp_version = val;
+- return 0;
++ break;
+ default:
+ return -EINVAL;
+ }
++ lock_sock(sk);
++ if (po->rx_ring.pg_vec || po->tx_ring.pg_vec) {
++ ret = -EBUSY;
++ } else {
++ po->tp_version = val;
++ ret = 0;
++ }
++ release_sock(sk);
++ return ret;
+ }
+ case PACKET_RESERVE:
+ {
+@@ -3756,6 +3762,7 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u,
+ /* Added to avoid minimal code churn */
+ struct tpacket_req *req = &req_u->req;
+
++ lock_sock(sk);
+ /* Opening a Tx-ring is NOT supported in TPACKET_V3 */
+ if (!closing && tx_ring && (po->tp_version > TPACKET_V2)) {
+ WARN(1, "Tx-ring is not supported.\n");
+@@ -3837,7 +3844,6 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u,
+ goto out;
+ }
+
+- lock_sock(sk);
+
+ /* Detach socket from network */
+ spin_lock(&po->bind_lock);
+@@ -3886,11 +3892,11 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u,
+ if (!tx_ring)
+ prb_shutdown_retire_blk_timer(po, tx_ring, rb_queue);
+ }
+- release_sock(sk);
+
+ if (pg_vec)
+ free_pg_vec(pg_vec, order, req->tp_block_nr);
+ out:
++ release_sock(sk);
+ return err;
+ }
+
+diff --git a/scripts/gcc-x86_64-has-stack-protector.sh b/scripts/gcc-x86_64-has-stack-protector.sh
+index 973e8c141567..17867e723a51 100755
+--- a/scripts/gcc-x86_64-has-stack-protector.sh
++++ b/scripts/gcc-x86_64-has-stack-protector.sh
+@@ -1,6 +1,6 @@
+ #!/bin/sh
+
+-echo "int foo(void) { char X[200]; return 3; }" | $* -S -x c -c -O0 -mcmodel=kernel -fstack-protector - -o - 2> /dev/null | grep -q "%gs"
++echo "int foo(void) { char X[200]; return 3; }" | $* -S -x c -c -O0 -mcmodel=kernel -fno-PIE -fstack-protector - -o - 2> /dev/null | grep -q "%gs"
+ if [ "$?" -eq "0" ] ; then
+ echo y
+ else
diff --git a/1046_linux-3.18.47.patch b/1046_linux-3.18.47.patch
new file mode 100644
index 0000000..287e7b6
--- /dev/null
+++ b/1046_linux-3.18.47.patch
@@ -0,0 +1,1831 @@
+diff --git a/Documentation/virtual/kvm/api.txt b/Documentation/virtual/kvm/api.txt
+index 702bb2557db8..20e6898d02c9 100644
+--- a/Documentation/virtual/kvm/api.txt
++++ b/Documentation/virtual/kvm/api.txt
+@@ -1919,6 +1919,7 @@ registers, find a list below:
+ PPC | KVM_REG_PPC_TM_VSCR | 32
+ PPC | KVM_REG_PPC_TM_DSCR | 64
+ PPC | KVM_REG_PPC_TM_TAR | 64
++ PPC | KVM_REG_PPC_TM_XER | 64
+ | |
+ MIPS | KVM_REG_MIPS_R0 | 64
+ ...
+diff --git a/Makefile b/Makefile
+index e73fd98d4cfc..9132f73528b3 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 18
+-SUBLEVEL = 46
++SUBLEVEL = 47
+ EXTRAVERSION =
+ NAME = Diseased Newt
+
+diff --git a/arch/arm/xen/enlighten.c b/arch/arm/xen/enlighten.c
+index 0e15f011f9c8..76e2ec624e88 100644
+--- a/arch/arm/xen/enlighten.c
++++ b/arch/arm/xen/enlighten.c
+@@ -295,8 +295,7 @@ static int __init xen_guest_init(void)
+ * for secondary CPUs as they are brought up.
+ * For uniformity we use VCPUOP_register_vcpu_info even on cpu0.
+ */
+- xen_vcpu_info = __alloc_percpu(sizeof(struct vcpu_info),
+- sizeof(struct vcpu_info));
++ xen_vcpu_info = alloc_percpu(struct vcpu_info);
+ if (xen_vcpu_info == NULL)
+ return -ENOMEM;
+
+diff --git a/arch/powerpc/boot/ps3-head.S b/arch/powerpc/boot/ps3-head.S
+index b6fcbaf5027b..3dc44b05fb97 100644
+--- a/arch/powerpc/boot/ps3-head.S
++++ b/arch/powerpc/boot/ps3-head.S
+@@ -57,11 +57,6 @@ __system_reset_overlay:
+ bctr
+
+ 1:
+- /* Save the value at addr zero for a null pointer write check later. */
+-
+- li r4, 0
+- lwz r3, 0(r4)
+-
+ /* Primary delays then goes to _zimage_start in wrapper. */
+
+ or 31, 31, 31 /* db16cyc */
+diff --git a/arch/powerpc/boot/ps3.c b/arch/powerpc/boot/ps3.c
+index 4ec2d86d3c50..a05558a7e51a 100644
+--- a/arch/powerpc/boot/ps3.c
++++ b/arch/powerpc/boot/ps3.c
+@@ -119,13 +119,12 @@ void ps3_copy_vectors(void)
+ flush_cache((void *)0x100, 512);
+ }
+
+-void platform_init(unsigned long null_check)
++void platform_init(void)
+ {
+ const u32 heapsize = 0x1000000 - (u32)_end; /* 16MiB */
+ void *chosen;
+ unsigned long ft_addr;
+ u64 rm_size;
+- unsigned long val;
+
+ console_ops.write = ps3_console_write;
+ platform_ops.exit = ps3_exit;
+@@ -153,11 +152,6 @@ void platform_init(unsigned long null_check)
+
+ printf(" flat tree at 0x%lx\n\r", ft_addr);
+
+- val = *(unsigned long *)0;
+-
+- if (val != null_check)
+- printf("null check failed: %lx != %lx\n\r", val, null_check);
+-
+ ((kernel_entry_t)0)(ft_addr, 0, NULL);
+
+ ps3_exit();
+diff --git a/arch/powerpc/include/asm/kvm_host.h b/arch/powerpc/include/asm/kvm_host.h
+index 047855619cc4..9bb51b9e03c6 100644
+--- a/arch/powerpc/include/asm/kvm_host.h
++++ b/arch/powerpc/include/asm/kvm_host.h
+@@ -537,6 +537,7 @@ struct kvm_vcpu_arch {
+ u64 tfiar;
+
+ u32 cr_tm;
++ u64 xer_tm;
+ u64 lr_tm;
+ u64 ctr_tm;
+ u64 amr_tm;
+diff --git a/arch/powerpc/include/uapi/asm/kvm.h b/arch/powerpc/include/uapi/asm/kvm.h
+index ab4d4732c492..720b71a636c8 100644
+--- a/arch/powerpc/include/uapi/asm/kvm.h
++++ b/arch/powerpc/include/uapi/asm/kvm.h
+@@ -587,6 +587,7 @@ struct kvm_get_htab_header {
+ #define KVM_REG_PPC_TM_VSCR (KVM_REG_PPC_TM | KVM_REG_SIZE_U32 | 0x67)
+ #define KVM_REG_PPC_TM_DSCR (KVM_REG_PPC_TM | KVM_REG_SIZE_U64 | 0x68)
+ #define KVM_REG_PPC_TM_TAR (KVM_REG_PPC_TM | KVM_REG_SIZE_U64 | 0x69)
++#define KVM_REG_PPC_TM_XER (KVM_REG_PPC_TM | KVM_REG_SIZE_U64 | 0x6a)
+
+ /* PPC64 eXternal Interrupt Controller Specification */
+ #define KVM_DEV_XICS_GRP_SOURCES 1 /* 64-bit source attributes */
+diff --git a/arch/powerpc/kernel/asm-offsets.c b/arch/powerpc/kernel/asm-offsets.c
+index 9d7dede2847c..a892c651ac2d 100644
+--- a/arch/powerpc/kernel/asm-offsets.c
++++ b/arch/powerpc/kernel/asm-offsets.c
+@@ -571,6 +571,7 @@ int main(void)
+ DEFINE(VCPU_VRS_TM, offsetof(struct kvm_vcpu, arch.vr_tm.vr));
+ DEFINE(VCPU_VRSAVE_TM, offsetof(struct kvm_vcpu, arch.vrsave_tm));
+ DEFINE(VCPU_CR_TM, offsetof(struct kvm_vcpu, arch.cr_tm));
++ DEFINE(VCPU_XER_TM, offsetof(struct kvm_vcpu, arch.xer_tm));
+ DEFINE(VCPU_LR_TM, offsetof(struct kvm_vcpu, arch.lr_tm));
+ DEFINE(VCPU_CTR_TM, offsetof(struct kvm_vcpu, arch.ctr_tm));
+ DEFINE(VCPU_AMR_TM, offsetof(struct kvm_vcpu, arch.amr_tm));
+diff --git a/arch/powerpc/kvm/book3s_hv.c b/arch/powerpc/kvm/book3s_hv.c
+index e63587d30b70..ed86c263a103 100644
+--- a/arch/powerpc/kvm/book3s_hv.c
++++ b/arch/powerpc/kvm/book3s_hv.c
+@@ -1097,6 +1097,9 @@ static int kvmppc_get_one_reg_hv(struct kvm_vcpu *vcpu, u64 id,
+ case KVM_REG_PPC_TM_CR:
+ *val = get_reg_val(id, vcpu->arch.cr_tm);
+ break;
++ case KVM_REG_PPC_TM_XER:
++ *val = get_reg_val(id, vcpu->arch.xer_tm);
++ break;
+ case KVM_REG_PPC_TM_LR:
+ *val = get_reg_val(id, vcpu->arch.lr_tm);
+ break;
+@@ -1304,6 +1307,9 @@ static int kvmppc_set_one_reg_hv(struct kvm_vcpu *vcpu, u64 id,
+ case KVM_REG_PPC_TM_CR:
+ vcpu->arch.cr_tm = set_reg_val(id, *val);
+ break;
++ case KVM_REG_PPC_TM_XER:
++ vcpu->arch.xer_tm = set_reg_val(id, *val);
++ break;
+ case KVM_REG_PPC_TM_LR:
+ vcpu->arch.lr_tm = set_reg_val(id, *val);
+ break;
+diff --git a/arch/powerpc/kvm/book3s_hv_rmhandlers.S b/arch/powerpc/kvm/book3s_hv_rmhandlers.S
+index 549d28fdc291..791ad037749c 100644
+--- a/arch/powerpc/kvm/book3s_hv_rmhandlers.S
++++ b/arch/powerpc/kvm/book3s_hv_rmhandlers.S
+@@ -2385,11 +2385,13 @@ kvmppc_save_tm:
+ mfctr r7
+ mfspr r8, SPRN_AMR
+ mfspr r10, SPRN_TAR
++ mfxer r11
+ std r5, VCPU_LR_TM(r9)
+ stw r6, VCPU_CR_TM(r9)
+ std r7, VCPU_CTR_TM(r9)
+ std r8, VCPU_AMR_TM(r9)
+ std r10, VCPU_TAR_TM(r9)
++ std r11, VCPU_XER_TM(r9)
+
+ /* Restore r12 as trap number. */
+ lwz r12, VCPU_TRAP(r9)
+@@ -2482,11 +2484,13 @@ kvmppc_restore_tm:
+ ld r7, VCPU_CTR_TM(r4)
+ ld r8, VCPU_AMR_TM(r4)
+ ld r9, VCPU_TAR_TM(r4)
++ ld r10, VCPU_XER_TM(r4)
+ mtlr r5
+ mtcr r6
+ mtctr r7
+ mtspr SPRN_AMR, r8
+ mtspr SPRN_TAR, r9
++ mtxer r10
+
+ /*
+ * Load up PPR and DSCR values but don't put them in the actual SPRs
+diff --git a/block/bsg.c b/block/bsg.c
+index 276e869e686c..fc607692cfe4 100644
+--- a/block/bsg.c
++++ b/block/bsg.c
+@@ -677,6 +677,9 @@ bsg_write(struct file *file, const char __user *buf, size_t count, loff_t *ppos)
+
+ dprintk("%s: write %Zd bytes\n", bd->name, count);
+
++ if (unlikely(segment_eq(get_fs(), KERNEL_DS)))
++ return -EINVAL;
++
+ bsg_set_block(bd, file);
+
+ bytes_written = 0;
+diff --git a/drivers/crypto/caam/caamalg.c b/drivers/crypto/caam/caamalg.c
+index a80ea853701d..50297a23ac6e 100644
+--- a/drivers/crypto/caam/caamalg.c
++++ b/drivers/crypto/caam/caamalg.c
+@@ -597,7 +597,9 @@ static int aead_set_sh_desc(struct crypto_aead *aead)
+
+ /* Will read cryptlen */
+ append_math_add(desc, VARSEQINLEN, SEQINLEN, REG0, CAAM_CMD_SZ);
+- aead_append_src_dst(desc, FIFOLD_TYPE_MSG1OUT2);
++ append_seq_fifo_load(desc, 0, FIFOLD_CLASS_BOTH | KEY_VLF |
++ FIFOLD_TYPE_MSG1OUT2 | FIFOLD_TYPE_LASTBOTH);
++ append_seq_fifo_store(desc, 0, FIFOST_TYPE_MESSAGE_DATA | KEY_VLF);
+
+ /* Write ICV */
+ append_seq_store(desc, ctx->authsize, LDST_CLASS_2_CCB |
+diff --git a/drivers/gpu/drm/ast/ast_main.c b/drivers/gpu/drm/ast/ast_main.c
+index fd5c5f3370f6..e53dbc90fcb6 100644
+--- a/drivers/gpu/drm/ast/ast_main.c
++++ b/drivers/gpu/drm/ast/ast_main.c
+@@ -223,7 +223,8 @@ static int ast_get_dram_info(struct drm_device *dev)
+ ast_write32(ast, 0x10000, 0xfc600309);
+
+ do {
+- ;
++ if (pci_channel_offline(dev->pdev))
++ return -EIO;
+ } while (ast_read32(ast, 0x10000) != 0x01);
+ data = ast_read32(ast, 0x10004);
+
+@@ -429,7 +430,9 @@ int ast_driver_load(struct drm_device *dev, unsigned long flags)
+ ast_detect_chip(dev, &need_post);
+
+ if (ast->chip != AST1180) {
+- ast_get_dram_info(dev);
++ ret = ast_get_dram_info(dev);
++ if (ret)
++ goto out_free;
+ ast->vram_size = ast_get_vram_info(dev);
+ DRM_INFO("dram %d %d %d %08x\n", ast->mclk, ast->dram_type, ast->dram_bus_width, ast->vram_size);
+ }
+diff --git a/drivers/gpu/drm/gma500/psb_drv.c b/drivers/gpu/drm/gma500/psb_drv.c
+index 6ec3a905fdd2..bdba0c11f989 100644
+--- a/drivers/gpu/drm/gma500/psb_drv.c
++++ b/drivers/gpu/drm/gma500/psb_drv.c
+@@ -464,6 +464,9 @@ static const struct file_operations psb_gem_fops = {
+ .open = drm_open,
+ .release = drm_release,
+ .unlocked_ioctl = psb_unlocked_ioctl,
++#ifdef CONFIG_COMPAT
++ .compat_ioctl = drm_compat_ioctl,
++#endif
+ .mmap = drm_gem_mmap,
+ .poll = drm_poll,
+ .read = drm_read,
+diff --git a/drivers/gpu/drm/radeon/si_dpm.c b/drivers/gpu/drm/radeon/si_dpm.c
+index 1a75d78a2708..e684508d5188 100644
+--- a/drivers/gpu/drm/radeon/si_dpm.c
++++ b/drivers/gpu/drm/radeon/si_dpm.c
+@@ -2972,6 +2972,7 @@ static void si_apply_state_adjust_rules(struct radeon_device *rdev,
+ (rdev->pdev->revision == 0x80) ||
+ (rdev->pdev->revision == 0x81) ||
+ (rdev->pdev->revision == 0x83) ||
++ (rdev->pdev->revision == 0x87) ||
+ (rdev->pdev->device == 0x6604) ||
+ (rdev->pdev->device == 0x6605)) {
+ max_sclk = 75000;
+diff --git a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
+index ffb83b5f7e80..6391ed0fe449 100644
+--- a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
++++ b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
+@@ -523,8 +523,11 @@ void ipoib_mcast_join_task(struct work_struct *work)
+ if (!test_bit(IPOIB_MCAST_RUN, &priv->flags))
+ return;
+
+- if (ib_query_port(priv->ca, priv->port, &port_attr) ||
+- port_attr.state != IB_PORT_ACTIVE) {
++ if (ib_query_port(priv->ca, priv->port, &port_attr)) {
++ ipoib_dbg(priv, "ib_query_port() failed\n");
++ return;
++ }
++ if (port_attr.state != IB_PORT_ACTIVE) {
+ ipoib_dbg(priv, "port state is not ACTIVE (state = %d) suspending join task\n",
+ port_attr.state);
+ return;
+diff --git a/drivers/input/misc/drv260x.c b/drivers/input/misc/drv260x.c
+index cab87f5ce6d3..e4b337bf6132 100644
+--- a/drivers/input/misc/drv260x.c
++++ b/drivers/input/misc/drv260x.c
+@@ -597,7 +597,6 @@ static int drv260x_probe(struct i2c_client *client,
+ }
+
+ haptics->input_dev->name = "drv260x:haptics";
+- haptics->input_dev->dev.parent = client->dev.parent;
+ haptics->input_dev->close = drv260x_close;
+ input_set_drvdata(haptics->input_dev, haptics);
+ input_set_capability(haptics->input_dev, EV_FF, FF_RUMBLE);
+diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c
+index b1c2bef46f8d..9c4836f5fea7 100644
+--- a/drivers/md/dm-crypt.c
++++ b/drivers/md/dm-crypt.c
+@@ -1450,12 +1450,15 @@ static int crypt_set_key(struct crypt_config *cc, char *key)
+ if (!cc->key_size && strcmp(key, "-"))
+ goto out;
+
++ /* clear the flag since following operations may invalidate previously valid key */
++ clear_bit(DM_CRYPT_KEY_VALID, &cc->flags);
++
+ if (cc->key_size && crypt_decode_key(cc->key, key, cc->key_size) < 0)
+ goto out;
+
+- set_bit(DM_CRYPT_KEY_VALID, &cc->flags);
+-
+ r = crypt_setkey_allcpus(cc);
++ if (!r)
++ set_bit(DM_CRYPT_KEY_VALID, &cc->flags);
+
+ out:
+ /* Hex key string not needed after here, so wipe it. */
+diff --git a/drivers/md/persistent-data/dm-space-map-metadata.c b/drivers/md/persistent-data/dm-space-map-metadata.c
+index 199c9ccd1f5d..023e9d8e5c83 100644
+--- a/drivers/md/persistent-data/dm-space-map-metadata.c
++++ b/drivers/md/persistent-data/dm-space-map-metadata.c
+@@ -764,17 +764,15 @@ int dm_sm_metadata_create(struct dm_space_map *sm,
+ memcpy(&smm->sm, &bootstrap_ops, sizeof(smm->sm));
+
+ r = sm_ll_new_metadata(&smm->ll, tm);
++ if (!r) {
++ if (nr_blocks > DM_SM_METADATA_MAX_BLOCKS)
++ nr_blocks = DM_SM_METADATA_MAX_BLOCKS;
++ r = sm_ll_extend(&smm->ll, nr_blocks);
++ }
++ memcpy(&smm->sm, &ops, sizeof(smm->sm));
+ if (r)
+ return r;
+
+- if (nr_blocks > DM_SM_METADATA_MAX_BLOCKS)
+- nr_blocks = DM_SM_METADATA_MAX_BLOCKS;
+- r = sm_ll_extend(&smm->ll, nr_blocks);
+- if (r)
+- return r;
+-
+- memcpy(&smm->sm, &ops, sizeof(smm->sm));
+-
+ /*
+ * Now we need to update the newly created data structures with the
+ * allocated blocks that they were built from.
+diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
+index cdd8770de1c2..48096d09fef3 100644
+--- a/drivers/md/raid5.c
++++ b/drivers/md/raid5.c
+@@ -6203,6 +6203,15 @@ static int run(struct mddev *mddev)
+ stripe = (stripe | (stripe-1)) + 1;
+ mddev->queue->limits.discard_alignment = stripe;
+ mddev->queue->limits.discard_granularity = stripe;
++
++ /*
++ * We use 16-bit counter of active stripes in bi_phys_segments
++ * (minus one for over-loaded initialization)
++ */
++ blk_queue_max_hw_sectors(mddev->queue, 0xfffe * STRIPE_SECTORS);
++ blk_queue_max_discard_sectors(mddev->queue,
++ 0xfffe * STRIPE_SECTORS);
++
+ /*
+ * unaligned part of discard request will be ignored, so can't
+ * guarantee discard_zeroes_data
+diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c
+index 388046e71e80..fd033cda0d53 100644
+--- a/drivers/mmc/host/sdhci.c
++++ b/drivers/mmc/host/sdhci.c
+@@ -1988,7 +1988,27 @@ static int sdhci_execute_tuning(struct mmc_host *mmc, u32 opcode)
+ ctrl &= ~SDHCI_CTRL_EXEC_TUNING;
+ sdhci_writew(host, ctrl, SDHCI_HOST_CONTROL2);
+
++ sdhci_do_reset(host, SDHCI_RESET_CMD);
++ sdhci_do_reset(host, SDHCI_RESET_DATA);
++
+ err = -EIO;
++
++ if (cmd.opcode != MMC_SEND_TUNING_BLOCK_HS200)
++ goto out;
++
++ sdhci_writel(host, host->ier, SDHCI_INT_ENABLE);
++ sdhci_writel(host, host->ier, SDHCI_SIGNAL_ENABLE);
++
++ spin_unlock_irqrestore(&host->lock, flags);
++
++ memset(&cmd, 0, sizeof(cmd));
++ cmd.opcode = MMC_STOP_TRANSMISSION;
++ cmd.flags = MMC_RSP_SPI_R1B | MMC_RSP_R1B | MMC_CMD_AC;
++ cmd.busy_timeout = 50;
++ mmc_wait_for_cmd(mmc, &cmd, 0);
++
++ spin_lock_irqsave(&host->lock, flags);
++
+ goto out;
+ }
+
+diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
+index 94ff20e9a8a0..33d83b0d1318 100644
+--- a/drivers/pci/pci.c
++++ b/drivers/pci/pci.c
+@@ -1987,6 +1987,10 @@ bool pci_dev_run_wake(struct pci_dev *dev)
+ if (!dev->pme_support)
+ return false;
+
++ /* PME-capable in principle, but not from the intended sleep state */
++ if (!pci_pme_capable(dev, pci_target_state(dev)))
++ return false;
++
+ while (bus->parent) {
+ struct pci_dev *bridge = bus->self;
+
+diff --git a/drivers/regulator/stw481x-vmmc.c b/drivers/regulator/stw481x-vmmc.c
+index a7e152696a02..f140b42956a4 100644
+--- a/drivers/regulator/stw481x-vmmc.c
++++ b/drivers/regulator/stw481x-vmmc.c
+@@ -47,7 +47,8 @@ static struct regulator_desc vmmc_regulator = {
+ .volt_table = stw481x_vmmc_voltages,
+ .enable_time = 200, /* FIXME: look this up */
+ .enable_reg = STW_CONF1,
+- .enable_mask = STW_CONF1_PDN_VMMC,
++ .enable_mask = STW_CONF1_PDN_VMMC | STW_CONF1_MMC_LS_STATUS,
++ .enable_val = STW_CONF1_PDN_VMMC,
+ .vsel_reg = STW_CONF1,
+ .vsel_mask = STW_CONF1_VMMC_MASK,
+ };
+diff --git a/drivers/s390/char/vmlogrdr.c b/drivers/s390/char/vmlogrdr.c
+index 9bb48d70957c..4d20f7298cb8 100644
+--- a/drivers/s390/char/vmlogrdr.c
++++ b/drivers/s390/char/vmlogrdr.c
+@@ -872,7 +872,7 @@ static int __init vmlogrdr_init(void)
+ goto cleanup;
+
+ for (i=0; i < MAXMINOR; ++i ) {
+- sys_ser[i].buffer = (char *) get_zeroed_page(GFP_KERNEL);
++ sys_ser[i].buffer = (char *) get_zeroed_page(GFP_KERNEL | GFP_DMA);
+ if (!sys_ser[i].buffer) {
+ rc = -ENOMEM;
+ break;
+diff --git a/drivers/scsi/megaraid/megaraid_sas_fusion.c b/drivers/scsi/megaraid/megaraid_sas_fusion.c
+index 554395634592..e37b5e82e068 100644
+--- a/drivers/scsi/megaraid/megaraid_sas_fusion.c
++++ b/drivers/scsi/megaraid/megaraid_sas_fusion.c
+@@ -2508,6 +2508,7 @@ int megasas_wait_for_outstanding_fusion(struct megasas_instance *instance,
+ printk("megaraid_sas: pending commands remain after waiting, "
+ "will reset adapter scsi%d.\n",
+ instance->host->host_no);
++ *convert = 1;
+ retval = 1;
+ }
+ out:
+diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c
+index f4cb7b3e9e23..9bfc6835ff2f 100644
+--- a/drivers/scsi/scsi_sysfs.c
++++ b/drivers/scsi/scsi_sysfs.c
+@@ -1027,10 +1027,6 @@ int scsi_sysfs_add_sdev(struct scsi_device *sdev)
+ struct request_queue *rq = sdev->request_queue;
+ struct scsi_target *starget = sdev->sdev_target;
+
+- error = scsi_device_set_state(sdev, SDEV_RUNNING);
+- if (error)
+- return error;
+-
+ error = scsi_target_add(starget);
+ if (error)
+ return error;
+diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
+index bc09f1d196c9..0becdb6e1ba0 100644
+--- a/drivers/scsi/sg.c
++++ b/drivers/scsi/sg.c
+@@ -592,6 +592,9 @@ sg_write(struct file *filp, const char __user *buf, size_t count, loff_t * ppos)
+ sg_io_hdr_t *hp;
+ unsigned char cmnd[SG_MAX_CDB_SIZE];
+
++ if (unlikely(segment_eq(get_fs(), KERNEL_DS)))
++ return -EINVAL;
++
+ if ((!(sfp = (Sg_fd *) filp->private_data)) || (!(sdp = sfp->parentdp)))
+ return -ENXIO;
+ SCSI_LOG_TIMEOUT(3, sg_printk(KERN_INFO, sdp,
+diff --git a/drivers/ssb/pci.c b/drivers/ssb/pci.c
+index 0f28c08fcb3c..77b551da5728 100644
+--- a/drivers/ssb/pci.c
++++ b/drivers/ssb/pci.c
+@@ -909,6 +909,7 @@ static int ssb_pci_sprom_get(struct ssb_bus *bus,
+ if (err) {
+ ssb_warn("WARNING: Using fallback SPROM failed (err %d)\n",
+ err);
++ goto out_free;
+ } else {
+ ssb_dbg("Using SPROM revision %d provided by platform\n",
+ sprom->revision);
+diff --git a/drivers/staging/comedi/drivers/ni_mio_common.c b/drivers/staging/comedi/drivers/ni_mio_common.c
+index 8400f2fa76bd..04f7a3bd3ddc 100644
+--- a/drivers/staging/comedi/drivers/ni_mio_common.c
++++ b/drivers/staging/comedi/drivers/ni_mio_common.c
+@@ -2105,7 +2105,7 @@ static int ni_ai_insn_read(struct comedi_device *dev,
+ unsigned int *data)
+ {
+ struct ni_private *devpriv = dev->private;
+- unsigned int mask = (s->maxdata + 1) >> 1;
++ unsigned int mask = s->maxdata;
+ int i, n;
+ unsigned signbits;
+ unsigned int d;
+diff --git a/drivers/target/target_core_user.c b/drivers/target/target_core_user.c
+index 9a1b314f6482..90e55b469c1e 100644
+--- a/drivers/target/target_core_user.c
++++ b/drivers/target/target_core_user.c
+@@ -587,8 +587,6 @@ static int tcmu_check_expired_cmd(int id, void *p, void *data)
+ target_complete_cmd(cmd->se_cmd, SAM_STAT_CHECK_CONDITION);
+ cmd->se_cmd = NULL;
+
+- kmem_cache_free(tcmu_cmd_cache, cmd);
+-
+ return 0;
+ }
+
+diff --git a/drivers/thermal/thermal_hwmon.c b/drivers/thermal/thermal_hwmon.c
+index 1967bee4f076..9035fbc5e98d 100644
+--- a/drivers/thermal/thermal_hwmon.c
++++ b/drivers/thermal/thermal_hwmon.c
+@@ -98,7 +98,7 @@ temp_crit_show(struct device *dev, struct device_attribute *attr, char *buf)
+ long temperature;
+ int ret;
+
+- ret = tz->ops->get_trip_temp(tz, 0, &temperature);
++ ret = tz->ops->get_crit_temp(tz, &temperature);
+ if (ret)
+ return ret;
+
+diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
+index f88ee8f3373d..e2f63f5d30cb 100644
+--- a/drivers/usb/class/cdc-acm.c
++++ b/drivers/usb/class/cdc-acm.c
+@@ -1727,6 +1727,7 @@ static const struct usb_device_id acm_ids[] = {
+ { USB_DEVICE(0x20df, 0x0001), /* Simtec Electronics Entropy Key */
+ .driver_info = QUIRK_CONTROL_LINE_STATE, },
+ { USB_DEVICE(0x2184, 0x001c) }, /* GW Instek AFG-2225 */
++ { USB_DEVICE(0x2184, 0x0036) }, /* GW Instek AFG-125 */
+ { USB_DEVICE(0x22b8, 0x6425), /* Motorola MOTOMAGX phones */
+ },
+ /* Motorola H24 HSPA module: */
+diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
+index 464542a046c7..1a3df0f8b891 100644
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -101,6 +101,8 @@ EXPORT_SYMBOL_GPL(ehci_cf_port_reset_rwsem);
+
+ static void hub_release(struct kref *kref);
+ static int usb_reset_and_verify_device(struct usb_device *udev);
++static void hub_usb3_port_prepare_disable(struct usb_hub *hub,
++ struct usb_port *port_dev);
+
+ static inline char *portspeed(struct usb_hub *hub, int portstatus)
+ {
+@@ -882,82 +884,28 @@ static int hub_set_port_link_state(struct usb_hub *hub, int port1,
+ }
+
+ /*
+- * If USB 3.0 ports are placed into the Disabled state, they will no longer
+- * detect any device connects or disconnects. This is generally not what the
+- * USB core wants, since it expects a disabled port to produce a port status
+- * change event when a new device connects.
+- *
+- * Instead, set the link state to Disabled, wait for the link to settle into
+- * that state, clear any change bits, and then put the port into the RxDetect
+- * state.
++ * USB-3 does not have a similar link state as USB-2 that will avoid negotiating
++ * a connection with a plugged-in cable but will signal the host when the cable
++ * is unplugged. Disable remote wake and set link state to U3 for USB-3 devices
+ */
+-static int hub_usb3_port_disable(struct usb_hub *hub, int port1)
+-{
+- int ret;
+- int total_time;
+- u16 portchange, portstatus;
+-
+- if (!hub_is_superspeed(hub->hdev))
+- return -EINVAL;
+-
+- ret = hub_port_status(hub, port1, &portstatus, &portchange);
+- if (ret < 0)
+- return ret;
+-
+- /*
+- * USB controller Advanced Micro Devices, Inc. [AMD] FCH USB XHCI
+- * Controller [1022:7814] will have spurious result making the following
+- * usb 3.0 device hotplugging route to the 2.0 root hub and recognized
+- * as high-speed device if we set the usb 3.0 port link state to
+- * Disabled. Since it's already in USB_SS_PORT_LS_RX_DETECT state, we
+- * check the state here to avoid the bug.
+- */
+- if ((portstatus & USB_PORT_STAT_LINK_STATE) ==
+- USB_SS_PORT_LS_RX_DETECT) {
+- dev_dbg(&hub->ports[port1 - 1]->dev,
+- "Not disabling port; link state is RxDetect\n");
+- return ret;
+- }
+-
+- ret = hub_set_port_link_state(hub, port1, USB_SS_PORT_LS_SS_DISABLED);
+- if (ret)
+- return ret;
+-
+- /* Wait for the link to enter the disabled state. */
+- for (total_time = 0; ; total_time += HUB_DEBOUNCE_STEP) {
+- ret = hub_port_status(hub, port1, &portstatus, &portchange);
+- if (ret < 0)
+- return ret;
+-
+- if ((portstatus & USB_PORT_STAT_LINK_STATE) ==
+- USB_SS_PORT_LS_SS_DISABLED)
+- break;
+- if (total_time >= HUB_DEBOUNCE_TIMEOUT)
+- break;
+- msleep(HUB_DEBOUNCE_STEP);
+- }
+- if (total_time >= HUB_DEBOUNCE_TIMEOUT)
+- dev_warn(&hub->ports[port1 - 1]->dev,
+- "Could not disable after %d ms\n", total_time);
+-
+- return hub_set_port_link_state(hub, port1, USB_SS_PORT_LS_RX_DETECT);
+-}
+-
+ static int hub_port_disable(struct usb_hub *hub, int port1, int set_state)
+ {
+ struct usb_port *port_dev = hub->ports[port1 - 1];
+ struct usb_device *hdev = hub->hdev;
+ int ret = 0;
+
+- if (port_dev->child && set_state)
+- usb_set_device_state(port_dev->child, USB_STATE_NOTATTACHED);
+ if (!hub->error) {
+- if (hub_is_superspeed(hub->hdev))
+- ret = hub_usb3_port_disable(hub, port1);
+- else
++ if (hub_is_superspeed(hub->hdev)) {
++ hub_usb3_port_prepare_disable(hub, port_dev);
++ ret = hub_set_port_link_state(hub, port_dev->portnum,
++ USB_SS_PORT_LS_U3);
++ } else {
+ ret = usb_clear_port_feature(hdev, port1,
+ USB_PORT_FEAT_ENABLE);
++ }
+ }
++ if (port_dev->child && set_state)
++ usb_set_device_state(port_dev->child, USB_STATE_NOTATTACHED);
+ if (ret && ret != -ENODEV)
+ dev_err(&port_dev->dev, "cannot disable (err = %d)\n", ret);
+ return ret;
+@@ -4041,6 +3989,26 @@ void usb_unlocked_enable_lpm(struct usb_device *udev)
+ }
+ EXPORT_SYMBOL_GPL(usb_unlocked_enable_lpm);
+
++/* usb3 devices use U3 for disabled, make sure remote wakeup is disabled */
++static void hub_usb3_port_prepare_disable(struct usb_hub *hub,
++ struct usb_port *port_dev)
++{
++ struct usb_device *udev = port_dev->child;
++ int ret;
++
++ if (udev && udev->port_is_suspended && udev->do_remote_wakeup) {
++ ret = hub_set_port_link_state(hub, port_dev->portnum,
++ USB_SS_PORT_LS_U0);
++ if (!ret) {
++ msleep(USB_RESUME_TIMEOUT);
++ ret = usb_disable_remote_wakeup(udev);
++ }
++ if (ret)
++ dev_warn(&udev->dev,
++ "Port disable: can't disable remote wake\n");
++ udev->do_remote_wakeup = 0;
++ }
++}
+
+ #else /* CONFIG_PM */
+
+@@ -4048,6 +4016,9 @@ EXPORT_SYMBOL_GPL(usb_unlocked_enable_lpm);
+ #define hub_resume NULL
+ #define hub_reset_resume NULL
+
++static inline void hub_usb3_port_prepare_disable(struct usb_hub *hub,
++ struct usb_port *port_dev) { }
++
+ int usb_disable_lpm(struct usb_device *udev)
+ {
+ return 0;
+diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c
+index f6a51fddd5b5..7b2ba34cf5e7 100644
+--- a/drivers/usb/gadget/composite.c
++++ b/drivers/usb/gadget/composite.c
+@@ -143,7 +143,7 @@ int config_ep_by_speed(struct usb_gadget *g,
+
+ ep_found:
+ /* commit results */
+- _ep->maxpacket = usb_endpoint_maxp(chosen_desc);
++ _ep->maxpacket = usb_endpoint_maxp(chosen_desc) & 0x7ff;
+ _ep->desc = chosen_desc;
+ _ep->comp_desc = NULL;
+ _ep->maxburst = 0;
+diff --git a/drivers/usb/host/uhci-pci.c b/drivers/usb/host/uhci-pci.c
+index 940304c33224..02260cfdedb1 100644
+--- a/drivers/usb/host/uhci-pci.c
++++ b/drivers/usb/host/uhci-pci.c
+@@ -129,6 +129,10 @@ static int uhci_pci_init(struct usb_hcd *hcd)
+ if (to_pci_dev(uhci_dev(uhci))->vendor == PCI_VENDOR_ID_HP)
+ uhci->wait_for_hp = 1;
+
++ /* Intel controllers use non-PME wakeup signalling */
++ if (to_pci_dev(uhci_dev(uhci))->vendor == PCI_VENDOR_ID_INTEL)
++ device_set_run_wake(uhci_dev(uhci), 1);
++
+ /* Set up pointers to PCI-specific functions */
+ uhci->reset_hc = uhci_pci_reset_hc;
+ uhci->check_and_reset_hc = uhci_pci_check_and_reset_hc;
+diff --git a/drivers/usb/serial/kl5kusb105.c b/drivers/usb/serial/kl5kusb105.c
+index e020ad28a00c..53c90131764d 100644
+--- a/drivers/usb/serial/kl5kusb105.c
++++ b/drivers/usb/serial/kl5kusb105.c
+@@ -296,7 +296,7 @@ static int klsi_105_open(struct tty_struct *tty, struct usb_serial_port *port)
+ rc = usb_serial_generic_open(tty, port);
+ if (rc) {
+ retval = rc;
+- goto exit;
++ goto err_free_cfg;
+ }
+
+ rc = usb_control_msg(port->serial->dev,
+@@ -315,17 +315,32 @@ static int klsi_105_open(struct tty_struct *tty, struct usb_serial_port *port)
+ dev_dbg(&port->dev, "%s - enabled reading\n", __func__);
+
+ rc = klsi_105_get_line_state(port, &line_state);
+- if (rc >= 0) {
+- spin_lock_irqsave(&priv->lock, flags);
+- priv->line_state = line_state;
+- spin_unlock_irqrestore(&priv->lock, flags);
+- dev_dbg(&port->dev, "%s - read line state 0x%lx\n", __func__, line_state);
+- retval = 0;
+- } else
++ if (rc < 0) {
+ retval = rc;
++ goto err_disable_read;
++ }
++
++ spin_lock_irqsave(&priv->lock, flags);
++ priv->line_state = line_state;
++ spin_unlock_irqrestore(&priv->lock, flags);
++ dev_dbg(&port->dev, "%s - read line state 0x%lx\n", __func__,
++ line_state);
++
++ return 0;
+
+-exit:
++err_disable_read:
++ usb_control_msg(port->serial->dev,
++ usb_sndctrlpipe(port->serial->dev, 0),
++ KL5KUSB105A_SIO_CONFIGURE,
++ USB_TYPE_VENDOR | USB_DIR_OUT,
++ KL5KUSB105A_SIO_CONFIGURE_READ_OFF,
++ 0, /* index */
++ NULL, 0,
++ KLSI_TIMEOUT);
++ usb_serial_generic_close(port);
++err_free_cfg:
+ kfree(cfg);
++
+ return retval;
+ }
+
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index 3814b7bd7d9f..295a00a9c257 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -270,6 +270,8 @@ static void option_instat_callback(struct urb *urb);
+ #define TELIT_PRODUCT_CC864_SINGLE 0x1006
+ #define TELIT_PRODUCT_DE910_DUAL 0x1010
+ #define TELIT_PRODUCT_UE910_V2 0x1012
++#define TELIT_PRODUCT_LE922_USBCFG1 0x1040
++#define TELIT_PRODUCT_LE922_USBCFG2 0x1041
+ #define TELIT_PRODUCT_LE922_USBCFG0 0x1042
+ #define TELIT_PRODUCT_LE922_USBCFG3 0x1043
+ #define TELIT_PRODUCT_LE922_USBCFG5 0x1045
+@@ -1223,6 +1225,10 @@ static const struct usb_device_id option_ids[] = {
+ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_UE910_V2) },
+ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE922_USBCFG0),
+ .driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg0 },
++ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE922_USBCFG1),
++ .driver_info = (kernel_ulong_t)&telit_le910_blacklist },
++ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE922_USBCFG2),
++ .driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg3 },
+ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE922_USBCFG3),
+ .driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg3 },
+ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, TELIT_PRODUCT_LE922_USBCFG5, 0xff),
+@@ -1999,6 +2005,7 @@ static const struct usb_device_id option_ids[] = {
+ { USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x7d02, 0xff, 0x00, 0x00) },
+ { USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x7d03, 0xff, 0x02, 0x01) },
+ { USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x7d03, 0xff, 0x00, 0x00) },
++ { USB_DEVICE_INTERFACE_CLASS(0x2001, 0x7d04, 0xff) }, /* D-Link DWM-158 */
+ { USB_DEVICE_INTERFACE_CLASS(0x2001, 0x7e19, 0xff), /* D-Link DWM-221 B1 */
+ .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
+ { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) }, /* D-Link DWM-152/C1 */
+diff --git a/fs/block_dev.c b/fs/block_dev.c
+index 1d9c9f3754f8..543dcf972120 100644
+--- a/fs/block_dev.c
++++ b/fs/block_dev.c
+@@ -694,7 +694,7 @@ static bool bd_may_claim(struct block_device *bdev, struct block_device *whole,
+ return true; /* already a holder */
+ else if (bdev->bd_holder != NULL)
+ return false; /* held by someone else */
+- else if (bdev->bd_contains == bdev)
++ else if (whole == bdev)
+ return true; /* is a whole device which isn't held */
+
+ else if (whole->bd_holder == bd_may_claim)
+@@ -1727,6 +1727,7 @@ void iterate_bdevs(void (*func)(struct block_device *, void *), void *arg)
+ spin_lock(&inode_sb_list_lock);
+ list_for_each_entry(inode, &blockdev_superblock->s_inodes, i_sb_list) {
+ struct address_space *mapping = inode->i_mapping;
++ struct block_device *bdev;
+
+ spin_lock(&inode->i_lock);
+ if (inode->i_state & (I_FREEING|I_WILL_FREE|I_NEW) ||
+@@ -1747,8 +1748,12 @@ void iterate_bdevs(void (*func)(struct block_device *, void *), void *arg)
+ */
+ iput(old_inode);
+ old_inode = inode;
++ bdev = I_BDEV(inode);
+
+- func(I_BDEV(inode), arg);
++ mutex_lock(&bdev->bd_mutex);
++ if (bdev->bd_openers)
++ func(bdev, arg);
++ mutex_unlock(&bdev->bd_mutex);
+
+ spin_lock(&inode_sb_list_lock);
+ }
+diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
+index 6f5fe1104ec6..001b338abe17 100644
+--- a/fs/btrfs/tree-log.c
++++ b/fs/btrfs/tree-log.c
+@@ -1782,12 +1782,11 @@ static noinline int find_dir_range(struct btrfs_root *root,
+ next:
+ /* check the next slot in the tree to see if it is a valid item */
+ nritems = btrfs_header_nritems(path->nodes[0]);
++ path->slots[0]++;
+ if (path->slots[0] >= nritems) {
+ ret = btrfs_next_leaf(root, path);
+ if (ret)
+ goto out;
+- } else {
+- path->slots[0]++;
+ }
+
+ btrfs_item_key_to_cpu(path->nodes[0], &key, path->slots[0]);
+diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
+index 02a33e529904..2d7026888b53 100644
+--- a/fs/cifs/cifsglob.h
++++ b/fs/cifs/cifsglob.h
+@@ -615,6 +615,8 @@ struct TCP_Server_Info {
+ #ifdef CONFIG_CIFS_SMB2
+ unsigned int max_read;
+ unsigned int max_write;
++ struct delayed_work reconnect; /* reconnect workqueue job */
++ struct mutex reconnect_mutex; /* prevent simultaneous reconnects */
+ #endif /* CONFIG_CIFS_SMB2 */
+ };
+
+@@ -814,6 +816,7 @@ cap_unix(struct cifs_ses *ses)
+ struct cifs_tcon {
+ struct list_head tcon_list;
+ int tc_count;
++ struct list_head rlist; /* reconnect list */
+ struct list_head openFileList;
+ struct cifs_ses *ses; /* pointer to session associated with */
+ char treeName[MAX_TREE_SIZE + 1]; /* UNC name of resource in ASCII */
+diff --git a/fs/cifs/cifsproto.h b/fs/cifs/cifsproto.h
+index 5b868060eab8..26f19549ef35 100644
+--- a/fs/cifs/cifsproto.h
++++ b/fs/cifs/cifsproto.h
+@@ -207,6 +207,9 @@ extern void cifs_add_pending_open_locked(struct cifs_fid *fid,
+ struct tcon_link *tlink,
+ struct cifs_pending_open *open);
+ extern void cifs_del_pending_open(struct cifs_pending_open *open);
++extern void cifs_put_tcp_session(struct TCP_Server_Info *server,
++ int from_reconnect);
++extern void cifs_put_tcon(struct cifs_tcon *tcon);
+
+ #if IS_ENABLED(CONFIG_CIFS_DFS_UPCALL)
+ extern void cifs_dfs_release_automount_timer(void);
+diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
+index 5093710e7660..8770f4de457b 100644
+--- a/fs/cifs/connect.c
++++ b/fs/cifs/connect.c
+@@ -52,6 +52,9 @@
+ #include "nterr.h"
+ #include "rfc1002pdu.h"
+ #include "fscache.h"
++#ifdef CONFIG_CIFS_SMB2
++#include "smb2proto.h"
++#endif
+
+ #define CIFS_PORT 445
+ #define RFC1001_PORT 139
+@@ -2066,8 +2069,8 @@ cifs_find_tcp_session(struct smb_vol *vol)
+ return NULL;
+ }
+
+-static void
+-cifs_put_tcp_session(struct TCP_Server_Info *server)
++void
++cifs_put_tcp_session(struct TCP_Server_Info *server, int from_reconnect)
+ {
+ struct task_struct *task;
+
+@@ -2084,6 +2087,19 @@ cifs_put_tcp_session(struct TCP_Server_Info *server)
+
+ cancel_delayed_work_sync(&server->echo);
+
++#ifdef CONFIG_CIFS_SMB2
++ if (from_reconnect)
++ /*
++ * Avoid deadlock here: reconnect work calls
++ * cifs_put_tcp_session() at its end. Need to be sure
++ * that reconnect work does nothing with server pointer after
++ * that step.
++ */
++ cancel_delayed_work(&server->reconnect);
++ else
++ cancel_delayed_work_sync(&server->reconnect);
++#endif
++
+ spin_lock(&GlobalMid_Lock);
+ server->tcpStatus = CifsExiting;
+ spin_unlock(&GlobalMid_Lock);
+@@ -2148,6 +2164,10 @@ cifs_get_tcp_session(struct smb_vol *volume_info)
+ INIT_LIST_HEAD(&tcp_ses->tcp_ses_list);
+ INIT_LIST_HEAD(&tcp_ses->smb_ses_list);
+ INIT_DELAYED_WORK(&tcp_ses->echo, cifs_echo_request);
++#ifdef CONFIG_CIFS_SMB2
++ INIT_DELAYED_WORK(&tcp_ses->reconnect, smb2_reconnect_server);
++ mutex_init(&tcp_ses->reconnect_mutex);
++#endif
+ memcpy(&tcp_ses->srcaddr, &volume_info->srcaddr,
+ sizeof(tcp_ses->srcaddr));
+ memcpy(&tcp_ses->dstaddr, &volume_info->dstaddr,
+@@ -2300,7 +2320,7 @@ cifs_put_smb_ses(struct cifs_ses *ses)
+ spin_unlock(&cifs_tcp_ses_lock);
+
+ sesInfoFree(ses);
+- cifs_put_tcp_session(server);
++ cifs_put_tcp_session(server, 0);
+ }
+
+ #ifdef CONFIG_KEYS
+@@ -2473,7 +2493,7 @@ cifs_get_smb_ses(struct TCP_Server_Info *server, struct smb_vol *volume_info)
+ mutex_unlock(&ses->session_mutex);
+
+ /* existing SMB ses has a server reference already */
+- cifs_put_tcp_session(server);
++ cifs_put_tcp_session(server, 0);
+ free_xid(xid);
+ return ses;
+ }
+@@ -2563,7 +2583,7 @@ cifs_find_tcon(struct cifs_ses *ses, const char *unc)
+ return NULL;
+ }
+
+-static void
++void
+ cifs_put_tcon(struct cifs_tcon *tcon)
+ {
+ unsigned int xid;
+@@ -3671,7 +3691,7 @@ mount_fail_check:
+ else if (ses)
+ cifs_put_smb_ses(ses);
+ else
+- cifs_put_tcp_session(server);
++ cifs_put_tcp_session(server, 0);
+ bdi_destroy(&cifs_sb->bdi);
+ }
+
+@@ -3976,7 +3996,7 @@ cifs_construct_tcon(struct cifs_sb_info *cifs_sb, kuid_t fsuid)
+ ses = cifs_get_smb_ses(master_tcon->ses->server, vol_info);
+ if (IS_ERR(ses)) {
+ tcon = (struct cifs_tcon *)ses;
+- cifs_put_tcp_session(master_tcon->ses->server);
++ cifs_put_tcp_session(master_tcon->ses->server, 0);
+ goto out;
+ }
+
+diff --git a/fs/cifs/smb2file.c b/fs/cifs/smb2file.c
+index 45992944e238..b87b07504947 100644
+--- a/fs/cifs/smb2file.c
++++ b/fs/cifs/smb2file.c
+@@ -241,7 +241,7 @@ smb2_push_mandatory_locks(struct cifsFileInfo *cfile)
+ * and check it for zero before using.
+ */
+ max_buf = tlink_tcon(cfile->tlink)->ses->server->maxBuf;
+- if (!max_buf) {
++ if (max_buf < sizeof(struct smb2_lock_element)) {
+ free_xid(xid);
+ return -EINVAL;
+ }
+diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
+index d759ecdfa9d6..c39773959a49 100644
+--- a/fs/cifs/smb2pdu.c
++++ b/fs/cifs/smb2pdu.c
+@@ -264,7 +264,7 @@ out:
+ case SMB2_CHANGE_NOTIFY:
+ case SMB2_QUERY_INFO:
+ case SMB2_SET_INFO:
+- return -EAGAIN;
++ rc = -EAGAIN;
+ }
+ unload_nls(nls_codepage);
+ return rc;
+@@ -1612,6 +1612,54 @@ smb2_echo_callback(struct mid_q_entry *mid)
+ add_credits(server, credits_received, CIFS_ECHO_OP);
+ }
+
++void smb2_reconnect_server(struct work_struct *work)
++{
++ struct TCP_Server_Info *server = container_of(work,
++ struct TCP_Server_Info, reconnect.work);
++ struct cifs_ses *ses;
++ struct cifs_tcon *tcon, *tcon2;
++ struct list_head tmp_list;
++ int tcon_exist = false;
++
++ /* Prevent simultaneous reconnects that can corrupt tcon->rlist list */
++ mutex_lock(&server->reconnect_mutex);
++
++ INIT_LIST_HEAD(&tmp_list);
++ cifs_dbg(FYI, "Need negotiate, reconnecting tcons\n");
++
++ spin_lock(&cifs_tcp_ses_lock);
++ list_for_each_entry(ses, &server->smb_ses_list, smb_ses_list) {
++ list_for_each_entry(tcon, &ses->tcon_list, tcon_list) {
++ if (tcon->need_reconnect) {
++ tcon->tc_count++;
++ list_add_tail(&tcon->rlist, &tmp_list);
++ tcon_exist = true;
++ }
++ }
++ }
++ /*
++ * Get the reference to server struct to be sure that the last call of
++ * cifs_put_tcon() in the loop below won't release the server pointer.
++ */
++ if (tcon_exist)
++ server->srv_count++;
++
++ spin_unlock(&cifs_tcp_ses_lock);
++
++ list_for_each_entry_safe(tcon, tcon2, &tmp_list, rlist) {
++ smb2_reconnect(SMB2_ECHO, tcon);
++ list_del_init(&tcon->rlist);
++ cifs_put_tcon(tcon);
++ }
++
++ cifs_dbg(FYI, "Reconnecting tcons finished\n");
++ mutex_unlock(&server->reconnect_mutex);
++
++ /* now we can safely release srv struct */
++ if (tcon_exist)
++ cifs_put_tcp_session(server, 1);
++}
++
+ int
+ SMB2_echo(struct TCP_Server_Info *server)
+ {
+@@ -1624,32 +1672,11 @@ SMB2_echo(struct TCP_Server_Info *server)
+ cifs_dbg(FYI, "In echo request\n");
+
+ if (server->tcpStatus == CifsNeedNegotiate) {
+- struct list_head *tmp, *tmp2;
+- struct cifs_ses *ses;
+- struct cifs_tcon *tcon;
+-
+- cifs_dbg(FYI, "Need negotiate, reconnecting tcons\n");
+- spin_lock(&cifs_tcp_ses_lock);
+- list_for_each(tmp, &server->smb_ses_list) {
+- ses = list_entry(tmp, struct cifs_ses, smb_ses_list);
+- list_for_each(tmp2, &ses->tcon_list) {
+- tcon = list_entry(tmp2, struct cifs_tcon,
+- tcon_list);
+- /* add check for persistent handle reconnect */
+- if (tcon && tcon->need_reconnect) {
+- spin_unlock(&cifs_tcp_ses_lock);
+- rc = smb2_reconnect(SMB2_ECHO, tcon);
+- spin_lock(&cifs_tcp_ses_lock);
+- }
+- }
+- }
+- spin_unlock(&cifs_tcp_ses_lock);
++ /* No need to send echo on newly established connections */
++ queue_delayed_work(cifsiod_wq, &server->reconnect, 0);
++ return rc;
+ }
+
+- /* if no session, renegotiate failed above */
+- if (server->tcpStatus == CifsNeedNegotiate)
+- return -EIO;
+-
+ rc = small_smb2_init(SMB2_ECHO, NULL, (void **)&req);
+ if (rc)
+ return rc;
+diff --git a/fs/cifs/smb2proto.h b/fs/cifs/smb2proto.h
+index 9bc59f9c12fb..0a406ae78129 100644
+--- a/fs/cifs/smb2proto.h
++++ b/fs/cifs/smb2proto.h
+@@ -95,6 +95,7 @@ extern int smb2_open_file(const unsigned int xid,
+ extern int smb2_unlock_range(struct cifsFileInfo *cfile,
+ struct file_lock *flock, const unsigned int xid);
+ extern int smb2_push_mandatory_locks(struct cifsFileInfo *cfile);
++extern void smb2_reconnect_server(struct work_struct *work);
+
+ /*
+ * SMB2 Worker functions - most of protocol specific implementation details
+diff --git a/fs/exec.c b/fs/exec.c
+index b7a5f46181b0..fe9ec45685a5 100644
+--- a/fs/exec.c
++++ b/fs/exec.c
+@@ -19,7 +19,7 @@
+ * current->executable is only used by the procfs. This allows a dispatch
+ * table to check for several different types of binary formats. We keep
+ * trying until we recognize the file or we run out of supported binary
+- * formats.
++ * formats.
+ */
+
+ #include <linux/slab.h>
+@@ -1083,6 +1083,13 @@ int flush_old_exec(struct linux_binprm * bprm)
+ flush_thread();
+ current->personality &= ~bprm->per_clear;
+
++ /*
++ * We have to apply CLOEXEC before we change whether the process is
++ * dumpable (in setup_new_exec) to avoid a race with a process in userspace
++ * trying to access the should-be-closed file descriptors of a process
++ * undergoing exec(2).
++ */
++ do_close_on_exec(current->files);
+ return 0;
+
+ out:
+@@ -1132,7 +1139,6 @@ void setup_new_exec(struct linux_binprm * bprm)
+ group */
+ current->self_exec_id++;
+ flush_signal_handlers(current, 0);
+- do_close_on_exec(current->files);
+ }
+ EXPORT_SYMBOL(setup_new_exec);
+
+diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
+index 6ce71e4e82e5..bd997b3d6a6f 100644
+--- a/fs/ext4/ext4.h
++++ b/fs/ext4/ext4.h
+@@ -233,6 +233,7 @@ struct ext4_io_submit {
+ #define EXT4_MAX_BLOCK_SIZE 65536
+ #define EXT4_MIN_BLOCK_LOG_SIZE 10
+ #define EXT4_MAX_BLOCK_LOG_SIZE 16
++#define EXT4_MAX_CLUSTER_LOG_SIZE 30
+ #ifdef __KERNEL__
+ # define EXT4_BLOCK_SIZE(s) ((s)->s_blocksize)
+ #else
+diff --git a/fs/ext4/inline.c b/fs/ext4/inline.c
+index 3ea62695abce..3968b164df6e 100644
+--- a/fs/ext4/inline.c
++++ b/fs/ext4/inline.c
+@@ -334,8 +334,10 @@ static int ext4_update_inline_data(handle_t *handle, struct inode *inode,
+
+ len -= EXT4_MIN_INLINE_DATA_SIZE;
+ value = kzalloc(len, GFP_NOFS);
+- if (!value)
++ if (!value) {
++ error = -ENOMEM;
+ goto out;
++ }
+
+ error = ext4_xattr_ibody_get(inode, i.name_index, i.name,
+ value, len);
+diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
+index dee06cd428eb..da268894e7c7 100644
+--- a/fs/ext4/mballoc.c
++++ b/fs/ext4/mballoc.c
+@@ -668,7 +668,7 @@ static void ext4_mb_mark_free_simple(struct super_block *sb,
+ ext4_grpblk_t min;
+ ext4_grpblk_t max;
+ ext4_grpblk_t chunk;
+- unsigned short border;
++ unsigned int border;
+
+ BUG_ON(len > EXT4_CLUSTERS_PER_GROUP(sb));
+
+@@ -2254,7 +2254,7 @@ static int ext4_mb_seq_groups_show(struct seq_file *seq, void *v)
+ struct ext4_group_info *grinfo;
+ struct sg {
+ struct ext4_group_info info;
+- ext4_grpblk_t counters[16];
++ ext4_grpblk_t counters[EXT4_MAX_BLOCK_LOG_SIZE + 2];
+ } sg;
+
+ group--;
+diff --git a/fs/ext4/super.c b/fs/ext4/super.c
+index 60964b7d7ffe..a5200023e604 100644
+--- a/fs/ext4/super.c
++++ b/fs/ext4/super.c
+@@ -3325,10 +3325,15 @@ static int count_overhead(struct super_block *sb, ext4_group_t grp,
+ ext4_set_bit(s++, buf);
+ count++;
+ }
+- for (j = ext4_bg_num_gdb(sb, grp); j > 0; j--) {
+- ext4_set_bit(EXT4_B2C(sbi, s++), buf);
+- count++;
++ j = ext4_bg_num_gdb(sb, grp);
++ if (s + j > EXT4_BLOCKS_PER_GROUP(sb)) {
++ ext4_error(sb, "Invalid number of block group "
++ "descriptor blocks: %d", j);
++ j = EXT4_BLOCKS_PER_GROUP(sb) - s;
+ }
++ count += j;
++ for (; j > 0; j--)
++ ext4_set_bit(EXT4_B2C(sbi, s++), buf);
+ }
+ if (!count)
+ return 0;
+@@ -3690,7 +3695,15 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
+ if (blocksize < EXT4_MIN_BLOCK_SIZE ||
+ blocksize > EXT4_MAX_BLOCK_SIZE) {
+ ext4_msg(sb, KERN_ERR,
+- "Unsupported filesystem blocksize %d", blocksize);
++ "Unsupported filesystem blocksize %d (%d log_block_size)",
++ blocksize, le32_to_cpu(es->s_log_block_size));
++ goto failed_mount;
++ }
++ if (le32_to_cpu(es->s_log_block_size) >
++ (EXT4_MAX_BLOCK_LOG_SIZE - EXT4_MIN_BLOCK_LOG_SIZE)) {
++ ext4_msg(sb, KERN_ERR,
++ "Invalid log block size: %u",
++ le32_to_cpu(es->s_log_block_size));
+ goto failed_mount;
+ }
+
+@@ -3766,12 +3779,16 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
+
+ sbi->s_blocks_per_group = le32_to_cpu(es->s_blocks_per_group);
+ sbi->s_inodes_per_group = le32_to_cpu(es->s_inodes_per_group);
+- if (EXT4_INODE_SIZE(sb) == 0 || EXT4_INODES_PER_GROUP(sb) == 0)
+- goto cantfind_ext4;
+
+ sbi->s_inodes_per_block = blocksize / EXT4_INODE_SIZE(sb);
+ if (sbi->s_inodes_per_block == 0)
+ goto cantfind_ext4;
++ if (sbi->s_inodes_per_group < sbi->s_inodes_per_block ||
++ sbi->s_inodes_per_group > blocksize * 8) {
++ ext4_msg(sb, KERN_ERR, "invalid inodes per group: %lu\n",
++ sbi->s_blocks_per_group);
++ goto failed_mount;
++ }
+ sbi->s_itb_per_group = sbi->s_inodes_per_group /
+ sbi->s_inodes_per_block;
+ sbi->s_desc_per_block = blocksize / EXT4_DESC_SIZE(sb);
+@@ -3812,6 +3829,13 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
+ "block size (%d)", clustersize, blocksize);
+ goto failed_mount;
+ }
++ if (le32_to_cpu(es->s_log_cluster_size) >
++ (EXT4_MAX_CLUSTER_LOG_SIZE - EXT4_MIN_BLOCK_LOG_SIZE)) {
++ ext4_msg(sb, KERN_ERR,
++ "Invalid log cluster size: %u",
++ le32_to_cpu(es->s_log_cluster_size));
++ goto failed_mount;
++ }
+ sbi->s_cluster_bits = le32_to_cpu(es->s_log_cluster_size) -
+ le32_to_cpu(es->s_log_block_size);
+ sbi->s_clusters_per_group =
+@@ -3848,13 +3872,6 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
+ }
+ sbi->s_cluster_ratio = clustersize / blocksize;
+
+- if (sbi->s_inodes_per_group > blocksize * 8) {
+- ext4_msg(sb, KERN_ERR,
+- "#inodes per group too big: %lu",
+- sbi->s_inodes_per_group);
+- goto failed_mount;
+- }
+-
+ /* Do we have standard group size of clustersize * 8 blocks ? */
+ if (sbi->s_blocks_per_group == clustersize << 3)
+ set_opt2(sb, STD_GROUP_SIZE);
+diff --git a/fs/f2fs/debug.c b/fs/f2fs/debug.c
+index 0a91ab813a9e..8e53d80c181a 100644
+--- a/fs/f2fs/debug.c
++++ b/fs/f2fs/debug.c
+@@ -295,6 +295,7 @@ static int stat_open(struct inode *inode, struct file *file)
+ }
+
+ static const struct file_operations stat_fops = {
++ .owner = THIS_MODULE,
+ .open = stat_open,
+ .read = seq_read,
+ .llseek = seq_lseek,
+diff --git a/fs/nfs/file.c b/fs/nfs/file.c
+index 2ab6f00dba5b..c85da0fc4593 100644
+--- a/fs/nfs/file.c
++++ b/fs/nfs/file.c
+@@ -410,7 +410,7 @@ static int nfs_write_end(struct file *file, struct address_space *mapping,
+ */
+ if (!PageUptodate(page)) {
+ unsigned pglen = nfs_page_length(page);
+- unsigned end = offset + len;
++ unsigned end = offset + copied;
+
+ if (pglen == 0) {
+ zero_user_segments(page, 0, offset,
+diff --git a/fs/xfs/xfs_log_recover.c b/fs/xfs/xfs_log_recover.c
+index 5942b9fa5681..315f96c88091 100644
+--- a/fs/xfs/xfs_log_recover.c
++++ b/fs/xfs/xfs_log_recover.c
+@@ -3861,6 +3861,7 @@ xlog_recover_clear_agi_bucket(
+ agi->agi_unlinked[bucket] = cpu_to_be32(NULLAGINO);
+ offset = offsetof(xfs_agi_t, agi_unlinked) +
+ (sizeof(xfs_agino_t) * bucket);
++ xfs_trans_buf_set_type(tp, agibp, XFS_BLFT_AGI_BUF);
+ xfs_trans_log_buf(tp, agibp, offset,
+ (offset + sizeof(xfs_agino_t) - 1));
+
+diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
+index 70fde9c5c61d..49ac10f99da0 100644
+--- a/include/linux/netdevice.h
++++ b/include/linux/netdevice.h
+@@ -1888,22 +1888,17 @@ struct napi_gro_cb {
+ /* Number of segments aggregated. */
+ u16 count;
+
+- /* This is non-zero if the packet may be of the same flow. */
+- u8 same_flow;
+-
+- /* Free the skb? */
+- u8 free;
+-#define NAPI_GRO_FREE 1
+-#define NAPI_GRO_FREE_STOLEN_HEAD 2
+-
+ /* jiffies when first packet was created/queued */
+ unsigned long age;
+
+ /* Used in ipv6_gro_receive() and foo-over-udp */
+ u16 proto;
+
+- /* Used in udp_gro_receive */
+- u8 udp_mark:1;
++ /* This is non-zero if the packet may be of the same flow. */
++ u8 same_flow:1;
++
++ /* Used in tunnel GRO receive */
++ u8 encap_mark:1;
+
+ /* GRO checksum is valid */
+ u8 csum_valid:1;
+@@ -1911,9 +1906,16 @@ struct napi_gro_cb {
+ /* Number of checksums via CHECKSUM_UNNECESSARY */
+ u8 csum_cnt:3;
+
++ /* Free the skb? */
++ u8 free:2;
++#define NAPI_GRO_FREE 1
++#define NAPI_GRO_FREE_STOLEN_HEAD 2
++
+ /* Used in foo-over-udp, set in udp[46]_gro_receive */
+ u8 is_ipv6:1;
+
++ /* 7 bit hole */
++
+ /* used to support CHECKSUM_COMPLETE for tunneling protocols */
+ __wsum csum;
+
+diff --git a/include/net/ip.h b/include/net/ip.h
+index d00ebdf14ca4..7f0cd17668ae 100644
+--- a/include/net/ip.h
++++ b/include/net/ip.h
+@@ -233,6 +233,8 @@ static inline int inet_is_local_reserved_port(struct net *net, int port)
+ }
+ #endif
+
++__be32 inet_current_timestamp(void);
++
+ /* From inetpeer.c */
+ extern int inet_peer_threshold;
+ extern int inet_peer_minttl;
+diff --git a/include/rdma/ib_addr.h b/include/rdma/ib_addr.h
+index ce55906b54a0..2ecac2032a3a 100644
+--- a/include/rdma/ib_addr.h
++++ b/include/rdma/ib_addr.h
+@@ -184,10 +184,12 @@ static inline void iboe_addr_get_sgid(struct rdma_dev_addr *dev_addr,
+
+ dev = dev_get_by_index(&init_net, dev_addr->bound_dev_if);
+ if (dev) {
+- ip4 = (struct in_device *)dev->ip_ptr;
+- if (ip4 && ip4->ifa_list && ip4->ifa_list->ifa_address)
++ ip4 = in_dev_get(dev);
++ if (ip4 && ip4->ifa_list && ip4->ifa_list->ifa_address) {
+ ipv6_addr_set_v4mapped(ip4->ifa_list->ifa_address,
+ (struct in6_addr *)gid);
++ in_dev_put(ip4);
++ }
+ dev_put(dev);
+ }
+ }
+diff --git a/kernel/trace/trace_functions_graph.c b/kernel/trace/trace_functions_graph.c
+index 2964333687dc..a88178c9ca5f 100644
+--- a/kernel/trace/trace_functions_graph.c
++++ b/kernel/trace/trace_functions_graph.c
+@@ -877,6 +877,10 @@ print_graph_entry_leaf(struct trace_iterator *iter,
+
+ cpu_data = per_cpu_ptr(data->cpu_data, cpu);
+
++ /* If a graph tracer ignored set_graph_notrace */
++ if (call->depth < -1)
++ call->depth += FTRACE_NOTRACE_DEPTH;
++
+ /*
+ * Comments display at + 1 to depth. Since
+ * this is a leaf function, keep the comments
+@@ -885,7 +889,8 @@ print_graph_entry_leaf(struct trace_iterator *iter,
+ cpu_data->depth = call->depth - 1;
+
+ /* No need to keep this function around for this depth */
+- if (call->depth < FTRACE_RETFUNC_DEPTH)
++ if (call->depth < FTRACE_RETFUNC_DEPTH &&
++ !WARN_ON_ONCE(call->depth < 0))
+ cpu_data->enter_funcs[call->depth] = 0;
+ }
+
+@@ -922,11 +927,16 @@ print_graph_entry_nested(struct trace_iterator *iter,
+ struct fgraph_cpu_data *cpu_data;
+ int cpu = iter->cpu;
+
++ /* If a graph tracer ignored set_graph_notrace */
++ if (call->depth < -1)
++ call->depth += FTRACE_NOTRACE_DEPTH;
++
+ cpu_data = per_cpu_ptr(data->cpu_data, cpu);
+ cpu_data->depth = call->depth;
+
+ /* Save this function pointer to see if the exit matches */
+- if (call->depth < FTRACE_RETFUNC_DEPTH)
++ if (call->depth < FTRACE_RETFUNC_DEPTH &&
++ !WARN_ON_ONCE(call->depth < 0))
+ cpu_data->enter_funcs[call->depth] = call->func;
+ }
+
+@@ -1179,7 +1189,8 @@ print_graph_return(struct ftrace_graph_ret *trace, struct trace_seq *s,
+ */
+ cpu_data->depth = trace->depth - 1;
+
+- if (trace->depth < FTRACE_RETFUNC_DEPTH) {
++ if (trace->depth < FTRACE_RETFUNC_DEPTH &&
++ !WARN_ON_ONCE(trace->depth < 0)) {
+ if (cpu_data->enter_funcs[trace->depth] != trace->func)
+ func_match = 0;
+ cpu_data->enter_funcs[trace->depth] = 0;
+diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c
+index 1519051603ff..0861598c2465 100644
+--- a/net/ceph/messenger.c
++++ b/net/ceph/messenger.c
+@@ -1979,6 +1979,19 @@ static int process_connect(struct ceph_connection *con)
+
+ dout("process_connect on %p tag %d\n", con, (int)con->in_tag);
+
++ if (con->auth_reply_buf) {
++ /*
++ * Any connection that defines ->get_authorizer()
++ * should also define ->verify_authorizer_reply().
++ * See get_connect_authorizer().
++ */
++ ret = con->ops->verify_authorizer_reply(con, 0);
++ if (ret < 0) {
++ con->error_msg = "bad authorize reply";
++ return ret;
++ }
++ }
++
+ switch (con->in_reply.tag) {
+ case CEPH_MSGR_TAG_FEATURES:
+ pr_err("%s%lld %s feature set mismatch,"
+diff --git a/net/core/dev.c b/net/core/dev.c
+index 93612b2e3bbf..2a24197f3a45 100644
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -4020,7 +4020,7 @@ static enum gro_result dev_gro_receive(struct napi_struct *napi, struct sk_buff
+ NAPI_GRO_CB(skb)->same_flow = 0;
+ NAPI_GRO_CB(skb)->flush = 0;
+ NAPI_GRO_CB(skb)->free = 0;
+- NAPI_GRO_CB(skb)->udp_mark = 0;
++ NAPI_GRO_CB(skb)->encap_mark = 0;
+
+ /* Setup for GRO checksum validation */
+ switch (skb->ip_summed) {
+diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
+index 6cf020ea4f46..1a621e1f1864 100644
+--- a/net/ipv4/af_inet.c
++++ b/net/ipv4/af_inet.c
+@@ -1391,6 +1391,45 @@ out:
+ return pp;
+ }
+
++static struct sk_buff **ipip_gro_receive(struct sk_buff **head,
++ struct sk_buff *skb)
++{
++ if (NAPI_GRO_CB(skb)->encap_mark) {
++ NAPI_GRO_CB(skb)->flush = 1;
++ return NULL;
++ }
++
++ NAPI_GRO_CB(skb)->encap_mark = 1;
++
++ return inet_gro_receive(head, skb);
++}
++
++#define SECONDS_PER_DAY 86400
++
++/* inet_current_timestamp - Return IP network timestamp
++ *
++ * Return milliseconds since midnight in network byte order.
++ */
++__be32 inet_current_timestamp(void)
++{
++ u32 secs;
++ u32 msecs;
++ struct timespec64 ts;
++
++ ktime_get_real_ts64(&ts);
++
++ /* Get secs since midnight. */
++ (void)div_u64_rem(ts.tv_sec, SECONDS_PER_DAY, &secs);
++ /* Convert to msecs. */
++ msecs = secs * MSEC_PER_SEC;
++ /* Convert nsec to msec. */
++ msecs += (u32)ts.tv_nsec / NSEC_PER_MSEC;
++
++ /* Convert to network byte order. */
++ return htons(msecs);
++}
++EXPORT_SYMBOL(inet_current_timestamp);
++
+ int inet_recv_error(struct sock *sk, struct msghdr *msg, int len, int *addr_len)
+ {
+ if (sk->sk_family == AF_INET)
+@@ -1433,6 +1472,13 @@ out_unlock:
+ return err;
+ }
+
++static int ipip_gro_complete(struct sk_buff *skb, int nhoff)
++{
++ skb->encapsulation = 1;
++ skb_shinfo(skb)->gso_type |= SKB_GSO_IPIP;
++ return inet_gro_complete(skb, nhoff);
++}
++
+ int inet_ctl_sock_create(struct sock **sk, unsigned short family,
+ unsigned short type, unsigned char protocol,
+ struct net *net)
+@@ -1649,8 +1695,8 @@ static struct packet_offload ip_packet_offload __read_mostly = {
+ static const struct net_offload ipip_offload = {
+ .callbacks = {
+ .gso_segment = inet_gso_segment,
+- .gro_receive = inet_gro_receive,
+- .gro_complete = inet_gro_complete,
++ .gro_receive = ipip_gro_receive,
++ .gro_complete = ipip_gro_complete,
+ },
+ };
+
+diff --git a/net/ipv4/fou.c b/net/ipv4/fou.c
+index 8ce8e82d1abb..f7ae11d47e89 100644
+--- a/net/ipv4/fou.c
++++ b/net/ipv4/fou.c
+@@ -113,6 +113,14 @@ static struct sk_buff **fou_gro_receive(struct sk_buff **head,
+ u8 proto = NAPI_GRO_CB(skb)->proto;
+ const struct net_offload **offloads;
+
++ /* We can clear the encap_mark for FOU as we are essentially doing
++ * one of two possible things. We are either adding an L4 tunnel
++ * header to the outer L3 tunnel header, or we are are simply
++ * treating the GRE tunnel header as though it is a UDP protocol
++ * specific header such as VXLAN or GENEVE.
++ */
++ NAPI_GRO_CB(skb)->encap_mark = 0;
++
+ rcu_read_lock();
+ offloads = NAPI_GRO_CB(skb)->is_ipv6 ? inet6_offloads : inet_offloads;
+ ops = rcu_dereference(offloads[proto]);
+@@ -217,6 +225,14 @@ static struct sk_buff **gue_gro_receive(struct sk_buff **head,
+
+ skb_gro_pull(skb, guehlen);
+
++ /* We can clear the encap_mark for GUE as we are essentially doing
++ * one of two possible things. We are either adding an L4 tunnel
++ * header to the outer L3 tunnel header, or we are are simply
++ * treating the GRE tunnel header as though it is a UDP protocol
++ * specific header such as VXLAN or GENEVE.
++ */
++ NAPI_GRO_CB(skb)->encap_mark = 0;
++
+ /* Adjusted NAPI_GRO_CB(skb)->csum after skb_gro_pull()*/
+ skb_gro_postpull_rcsum(skb, guehdr, guehlen);
+
+diff --git a/net/ipv4/gre_offload.c b/net/ipv4/gre_offload.c
+index abc50b41bc39..cc7b08232e92 100644
+--- a/net/ipv4/gre_offload.c
++++ b/net/ipv4/gre_offload.c
+@@ -128,6 +128,11 @@ static struct sk_buff **gre_gro_receive(struct sk_buff **head,
+ struct packet_offload *ptype;
+ __be16 type;
+
++ if (NAPI_GRO_CB(skb)->encap_mark)
++ goto out;
++
++ NAPI_GRO_CB(skb)->encap_mark = 1;
++
+ off = skb_gro_offset(skb);
+ hlen = off + sizeof(*greh);
+ greh = skb_gro_header_fast(skb, off);
+diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c
+index 5882f584910e..2d6f89070373 100644
+--- a/net/ipv4/icmp.c
++++ b/net/ipv4/icmp.c
+@@ -902,7 +902,6 @@ static void icmp_echo(struct sk_buff *skb)
+ */
+ static void icmp_timestamp(struct sk_buff *skb)
+ {
+- struct timespec tv;
+ struct icmp_bxm icmp_param;
+ /*
+ * Too short.
+@@ -913,9 +912,7 @@ static void icmp_timestamp(struct sk_buff *skb)
+ /*
+ * Fill in the current time as ms since midnight UT:
+ */
+- getnstimeofday(&tv);
+- icmp_param.data.times[1] = htonl((tv.tv_sec % 86400) * MSEC_PER_SEC +
+- tv.tv_nsec / NSEC_PER_MSEC);
++ icmp_param.data.times[1] = inet_current_timestamp();
+ icmp_param.data.times[2] = icmp_param.data.times[1];
+ if (skb_copy_bits(skb, 0, &icmp_param.data.times[0], 4))
+ BUG();
+diff --git a/net/ipv4/ip_options.c b/net/ipv4/ip_options.c
+index 5b3d91be2db0..0e4632e93809 100644
+--- a/net/ipv4/ip_options.c
++++ b/net/ipv4/ip_options.c
+@@ -58,10 +58,9 @@ void ip_options_build(struct sk_buff *skb, struct ip_options *opt,
+ if (opt->ts_needaddr)
+ ip_rt_get_source(iph+opt->ts+iph[opt->ts+2]-9, skb, rt);
+ if (opt->ts_needtime) {
+- struct timespec tv;
+ __be32 midtime;
+- getnstimeofday(&tv);
+- midtime = htonl((tv.tv_sec % 86400) * MSEC_PER_SEC + tv.tv_nsec / NSEC_PER_MSEC);
++
++ midtime = inet_current_timestamp();
+ memcpy(iph+opt->ts+iph[opt->ts+2]-5, &midtime, 4);
+ }
+ return;
+@@ -415,11 +414,10 @@ int ip_options_compile(struct net *net,
+ break;
+ }
+ if (timeptr) {
+- struct timespec tv;
+- u32 midtime;
+- getnstimeofday(&tv);
+- midtime = (tv.tv_sec % 86400) * MSEC_PER_SEC + tv.tv_nsec / NSEC_PER_MSEC;
+- put_unaligned_be32(midtime, timeptr);
++ __be32 midtime;
++
++ midtime = inet_current_timestamp();
++ memcpy(timeptr, &midtime, 4);
+ opt->is_changed = 1;
+ }
+ } else if ((optptr[3]&0xF) != IPOPT_TS_PRESPEC) {
+diff --git a/net/ipv4/udp_offload.c b/net/ipv4/udp_offload.c
+index 6480cea7aa53..e6d05ae1f22e 100644
+--- a/net/ipv4/udp_offload.c
++++ b/net/ipv4/udp_offload.c
+@@ -266,14 +266,14 @@ struct sk_buff **udp_gro_receive(struct sk_buff **head, struct sk_buff *skb,
+ unsigned int off = skb_gro_offset(skb);
+ int flush = 1;
+
+- if (NAPI_GRO_CB(skb)->udp_mark ||
++ if (NAPI_GRO_CB(skb)->encap_mark ||
+ (skb->ip_summed != CHECKSUM_PARTIAL &&
+ NAPI_GRO_CB(skb)->csum_cnt == 0 &&
+ !NAPI_GRO_CB(skb)->csum_valid))
+ goto out;
+
+- /* mark that this skb passed once through the udp gro layer */
+- NAPI_GRO_CB(skb)->udp_mark = 1;
++ /* mark that this skb passed once through the tunnel gro layer */
++ NAPI_GRO_CB(skb)->encap_mark = 1;
+
+ rcu_read_lock();
+ uo_priv = rcu_dereference(udp_offload_base);
+diff --git a/net/ipv6/ip6_offload.c b/net/ipv6/ip6_offload.c
+index 01e12d0d8fcc..f291813c7c0c 100644
+--- a/net/ipv6/ip6_offload.c
++++ b/net/ipv6/ip6_offload.c
+@@ -258,6 +258,19 @@ out:
+ return pp;
+ }
+
++static struct sk_buff **sit_gro_receive(struct sk_buff **head,
++ struct sk_buff *skb)
++{
++ if (NAPI_GRO_CB(skb)->encap_mark) {
++ NAPI_GRO_CB(skb)->flush = 1;
++ return NULL;
++ }
++
++ NAPI_GRO_CB(skb)->encap_mark = 1;
++
++ return ipv6_gro_receive(head, skb);
++}
++
+ static int ipv6_gro_complete(struct sk_buff *skb, int nhoff)
+ {
+ const struct net_offload *ops;
+diff --git a/net/sunrpc/auth_gss/auth_gss.c b/net/sunrpc/auth_gss/auth_gss.c
+index 53ed8d3f8897..81e29f02d28e 100644
+--- a/net/sunrpc/auth_gss/auth_gss.c
++++ b/net/sunrpc/auth_gss/auth_gss.c
+@@ -539,9 +539,13 @@ gss_setup_upcall(struct gss_auth *gss_auth, struct rpc_cred *cred)
+ return gss_new;
+ gss_msg = gss_add_msg(gss_new);
+ if (gss_msg == gss_new) {
+- int res = rpc_queue_upcall(gss_new->pipe, &gss_new->msg);
++ int res;
++ atomic_inc(&gss_msg->count);
++ res = rpc_queue_upcall(gss_new->pipe, &gss_new->msg);
+ if (res) {
+ gss_unhash_msg(gss_new);
++ atomic_dec(&gss_msg->count);
++ gss_release_msg(gss_new);
+ gss_msg = ERR_PTR(res);
+ }
+ } else
+@@ -834,6 +838,7 @@ gss_pipe_destroy_msg(struct rpc_pipe_msg *msg)
+ warn_gssd();
+ gss_release_msg(gss_msg);
+ }
++ gss_release_msg(gss_msg);
+ }
+
+ static void gss_pipe_dentry_destroy(struct dentry *dir,
+diff --git a/scripts/kconfig/nconf.gui.c b/scripts/kconfig/nconf.gui.c
+index 8275f0e55106..4b2f44c20caf 100644
+--- a/scripts/kconfig/nconf.gui.c
++++ b/scripts/kconfig/nconf.gui.c
+@@ -364,12 +364,14 @@ int dialog_inputbox(WINDOW *main_window,
+ WINDOW *prompt_win;
+ WINDOW *form_win;
+ PANEL *panel;
+- int i, x, y;
++ int i, x, y, lines, columns, win_lines, win_cols;
+ int res = -1;
+ int cursor_position = strlen(init);
+ int cursor_form_win;
+ char *result = *resultp;
+
++ getmaxyx(stdscr, lines, columns);
++
+ if (strlen(init)+1 > *result_len) {
+ *result_len = strlen(init)+1;
+ *resultp = result = realloc(result, *result_len);
+@@ -386,14 +388,19 @@ int dialog_inputbox(WINDOW *main_window,
+ if (title)
+ prompt_width = max(prompt_width, strlen(title));
+
++ win_lines = min(prompt_lines+6, lines-2);
++ win_cols = min(prompt_width+7, columns-2);
++ prompt_lines = max(win_lines-6, 0);
++ prompt_width = max(win_cols-7, 0);
++
+ /* place dialog in middle of screen */
+- y = (getmaxy(stdscr)-(prompt_lines+4))/2;
+- x = (getmaxx(stdscr)-(prompt_width+4))/2;
++ y = (lines-win_lines)/2;
++ x = (columns-win_cols)/2;
+
+ strncpy(result, init, *result_len);
+
+ /* create the windows */
+- win = newwin(prompt_lines+6, prompt_width+7, y, x);
++ win = newwin(win_lines, win_cols, y, x);
+ prompt_win = derwin(win, prompt_lines+1, prompt_width, 2, 2);
+ form_win = derwin(win, 1, prompt_width, prompt_lines+3, 2);
+ keypad(form_win, TRUE);
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index ebb8feff0a84..0e4908b6163d 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -5712,6 +5712,9 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = {
+ {0x12, 0x90a60180},
+ {0x14, 0x90170120},
+ {0x21, 0x02211030}),
++ SND_HDA_PIN_QUIRK(0x10ec0255, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
++ {0x1b, 0x01011020},
++ {0x21, 0x02211010}),
+ SND_HDA_PIN_QUIRK(0x10ec0256, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
+ ALC256_STANDARD_PINS,
+ {0x13, 0x40000000}),
+diff --git a/sound/usb/hiface/pcm.c b/sound/usb/hiface/pcm.c
+index 2c44139b4041..33db205dd12b 100644
+--- a/sound/usb/hiface/pcm.c
++++ b/sound/usb/hiface/pcm.c
+@@ -445,6 +445,8 @@ static int hiface_pcm_prepare(struct snd_pcm_substream *alsa_sub)
+
+ mutex_lock(&rt->stream_mutex);
+
++ hiface_pcm_stream_stop(rt);
++
+ sub->dma_off = 0;
+ sub->period_off = 0;
+
+diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
+index 0d7f1ced1d3b..1ceeb9e875a4 100644
+--- a/sound/usb/mixer.c
++++ b/sound/usb/mixer.c
+@@ -916,9 +916,10 @@ static void volume_control_quirks(struct usb_mixer_elem_info *cval,
+ case USB_ID(0x046d, 0x0826): /* HD Webcam c525 */
+ case USB_ID(0x046d, 0x08ca): /* Logitech Quickcam Fusion */
+ case USB_ID(0x046d, 0x0991):
++ case USB_ID(0x046d, 0x09a2): /* QuickCam Communicate Deluxe/S7500 */
+ /* Most audio usb devices lie about volume resolution.
+ * Most Logitech webcams have res = 384.
+- * Proboly there is some logitech magic behind this number --fishor
++ * Probably there is some logitech magic behind this number --fishor
+ */
+ if (!strcmp(kctl->id.name, "Mic Capture Volume")) {
+ usb_audio_info(chip,
^ permalink raw reply related [flat|nested] 67+ messages in thread
* [gentoo-commits] proj/linux-patches:3.18 commit in: /
@ 2017-01-18 21:46 Mike Pagano
0 siblings, 0 replies; 67+ messages in thread
From: Mike Pagano @ 2017-01-18 21:46 UTC (permalink / raw
To: gentoo-commits
commit: 01cda1ddf8ce6fac303a4eb38985d4497b54bda3
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed Jan 18 21:46:15 2017 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed Jan 18 21:46:15 2017 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=01cda1dd
Removal of redundant patch
0000_README | 4 --
1520_fix-race-condition-in-packet-set-ring.patch | 62 ------------------------
2 files changed, 66 deletions(-)
diff --git a/0000_README b/0000_README
index 4efb409..957c01d 100644
--- a/0000_README
+++ b/0000_README
@@ -239,10 +239,6 @@ Patch: 1510_fs-enable-link-security-restrictions-by-default.patch
From: http://sources.debian.net/src/linux/3.16.7-ckt4-3/debian/patches/debian/fs-enable-link-security-restrictions-by-default.patch/
Desc: Enable link security restrictions by default
-Patch: 1520_fix-race-condition-in-packet-set-ring.patch
-From: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=84ac7260236a49c79eede91617700174c2c19b0c
-Desc: packet: fix race condition in packet_set_ring. CVE-2016-8655. Bug #601926.
-
Patch: 1700_ARM-dts-patch-to-support-popoplug-e02.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=508248
Desc: ARM: dts: Add support for Pogoplug E02.
diff --git a/1520_fix-race-condition-in-packet-set-ring.patch b/1520_fix-race-condition-in-packet-set-ring.patch
deleted file mode 100644
index d85527f..0000000
--- a/1520_fix-race-condition-in-packet-set-ring.patch
+++ /dev/null
@@ -1,62 +0,0 @@
---- a/net/packet/af_packet.c 2016-12-07 18:10:25.785812861 -0500
-+++ b/net/packet/af_packet.c 2016-12-07 18:18:45.597933525 -0500
-@@ -3648,19 +3648,25 @@ packet_setsockopt(struct socket *sock, i
-
- if (optlen != sizeof(val))
- return -EINVAL;
-- if (po->rx_ring.pg_vec || po->tx_ring.pg_vec)
-- return -EBUSY;
- if (copy_from_user(&val, optval, sizeof(val)))
- return -EFAULT;
- switch (val) {
- case TPACKET_V1:
- case TPACKET_V2:
- case TPACKET_V3:
-- po->tp_version = val;
-- return 0;
-+ break;
- default:
- return -EINVAL;
- }
-+ lock_sock(sk);
-+ if (po->rx_ring.pg_vec || po->tx_ring.pg_vec) {
-+ ret = -EBUSY;
-+ } else {
-+ po->tp_version = val;
-+ ret = 0;
-+ }
-+ release_sock(sk);
-+ return ret;
- }
- case PACKET_RESERVE:
- {
-@@ -4164,6 +4170,7 @@ static int packet_set_ring(struct sock *
- /* Added to avoid minimal code churn */
- struct tpacket_req *req = &req_u->req;
-
-+ lock_sock(sk);
- /* Opening a Tx-ring is NOT supported in TPACKET_V3 */
- if (!closing && tx_ring && (po->tp_version > TPACKET_V2)) {
- net_warn_ratelimited("Tx-ring is not supported.\n");
-@@ -4245,8 +4252,6 @@ static int packet_set_ring(struct sock *
- goto out;
- }
-
-- lock_sock(sk);
--
- /* Detach socket from network */
- spin_lock(&po->bind_lock);
- was_running = po->running;
-@@ -4294,11 +4299,11 @@ static int packet_set_ring(struct sock *
- if (!tx_ring)
- prb_shutdown_retire_blk_timer(po, rb_queue);
- }
-- release_sock(sk);
-
- if (pg_vec)
- free_pg_vec(pg_vec, order, req->tp_block_nr);
- out:
-+ release_sock(sk);
- return err;
- }
-
^ permalink raw reply related [flat|nested] 67+ messages in thread
* [gentoo-commits] proj/linux-patches:3.18 commit in: /
@ 2017-02-08 11:16 Mike Pagano
0 siblings, 0 replies; 67+ messages in thread
From: Mike Pagano @ 2017-02-08 11:16 UTC (permalink / raw
To: gentoo-commits
commit: 219e6220b29d24e43cc5b8304c8a365bdcb4e4ba
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed Feb 8 11:16:27 2017 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed Feb 8 11:16:27 2017 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=219e6220
Linux patch 3.18.48
0000_README | 4 +
1047_linux-3.18.48.patch | 1219 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 1223 insertions(+)
diff --git a/0000_README b/0000_README
index 957c01d..4676a64 100644
--- a/0000_README
+++ b/0000_README
@@ -231,6 +231,10 @@ Patch: 1046_linux-3.18.47.patch
From: http://www.kernel.org
Desc: Linux 3.18.47
+Patch: 1047_linux-3.18.48.patch
+From: http://www.kernel.org
+Desc: Linux 3.18.48
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1047_linux-3.18.48.patch b/1047_linux-3.18.48.patch
new file mode 100644
index 0000000..7884316
--- /dev/null
+++ b/1047_linux-3.18.48.patch
@@ -0,0 +1,1219 @@
+diff --git a/Documentation/Makefile b/Documentation/Makefile
+index 6883a1b9b351..bc0548201755 100644
+--- a/Documentation/Makefile
++++ b/Documentation/Makefile
+@@ -1,4 +1,4 @@
+-subdir-y := accounting arm auxdisplay blackfin connector \
++subdir-y := accounting auxdisplay blackfin connector \
+ filesystems filesystems ia64 laptops mic misc-devices \
+ networking pcmcia prctl ptp spi timers vDSO video4linux \
+ watchdog
+diff --git a/Documentation/arm/Makefile b/Documentation/arm/Makefile
+deleted file mode 100644
+index 732c77050cff..000000000000
+--- a/Documentation/arm/Makefile
++++ /dev/null
+@@ -1 +0,0 @@
+-subdir-y := SH-Mobile
+diff --git a/Documentation/arm/SH-Mobile/Makefile b/Documentation/arm/SH-Mobile/Makefile
+deleted file mode 100644
+index bca8a7ef6bbe..000000000000
+--- a/Documentation/arm/SH-Mobile/Makefile
++++ /dev/null
+@@ -1,7 +0,0 @@
+-# List of programs to build
+-hostprogs-y := vrl4
+-
+-# Tell kbuild to always build the programs
+-always := $(hostprogs-y)
+-
+-HOSTCFLAGS_vrl4.o += -I$(objtree)/usr/include -I$(srctree)/tools/include
+diff --git a/Documentation/arm/SH-Mobile/vrl4.c b/Documentation/arm/SH-Mobile/vrl4.c
+deleted file mode 100644
+index f4cd8ad4e720..000000000000
+--- a/Documentation/arm/SH-Mobile/vrl4.c
++++ /dev/null
+@@ -1,170 +0,0 @@
+-/*
+- * vrl4 format generator
+- *
+- * Copyright (C) 2010 Simon Horman
+- *
+- * This file is subject to the terms and conditions of the GNU General Public
+- * License. See the file "COPYING" in the main directory of this archive
+- * for more details.
+- */
+-
+-/*
+- * usage: vrl4 < zImage > out
+- * dd if=out of=/dev/sdx bs=512 seek=1 # Write the image to sector 1
+- *
+- * Reads a zImage from stdin and writes a vrl4 image to stdout.
+- * In practice this means writing a padded vrl4 header to stdout followed
+- * by the zImage.
+- *
+- * The padding places the zImage at ALIGN bytes into the output.
+- * The vrl4 uses ALIGN + START_BASE as the start_address.
+- * This is where the mask ROM will jump to after verifying the header.
+- *
+- * The header sets copy_size to min(sizeof(zImage), MAX_BOOT_PROG_LEN) + ALIGN.
+- * That is, the mask ROM will load the padded header (ALIGN bytes)
+- * And then MAX_BOOT_PROG_LEN bytes of the image, or the entire image,
+- * whichever is smaller.
+- *
+- * The zImage is not modified in any way.
+- */
+-
+-#define _BSD_SOURCE
+-#include <endian.h>
+-#include <unistd.h>
+-#include <stdint.h>
+-#include <stdio.h>
+-#include <errno.h>
+-#include <tools/endian.h>
+-
+-struct hdr {
+- uint32_t magic1;
+- uint32_t reserved1;
+- uint32_t magic2;
+- uint32_t reserved2;
+- uint16_t copy_size;
+- uint16_t boot_options;
+- uint32_t reserved3;
+- uint32_t start_address;
+- uint32_t reserved4;
+- uint32_t reserved5;
+- char reserved6[308];
+-};
+-
+-#define DECLARE_HDR(h) \
+- struct hdr (h) = { \
+- .magic1 = htole32(0xea000000), \
+- .reserved1 = htole32(0x56), \
+- .magic2 = htole32(0xe59ff008), \
+- .reserved3 = htole16(0x1) }
+-
+-/* Align to 512 bytes, the MMCIF sector size */
+-#define ALIGN_BITS 9
+-#define ALIGN (1 << ALIGN_BITS)
+-
+-#define START_BASE 0xe55b0000
+-
+-/*
+- * With an alignment of 512 the header uses the first sector.
+- * There is a 128 sector (64kbyte) limit on the data loaded by the mask ROM.
+- * So there are 127 sectors left for the boot programme. But in practice
+- * Only a small portion of a zImage is needed, 16 sectors should be more
+- * than enough.
+- *
+- * Note that this sets how much of the zImage is copied by the mask ROM.
+- * The entire zImage is present after the header and is loaded
+- * by the code in the boot program (which is the first portion of the zImage).
+- */
+-#define MAX_BOOT_PROG_LEN (16 * 512)
+-
+-#define ROUND_UP(x) ((x + ALIGN - 1) & ~(ALIGN - 1))
+-
+-static ssize_t do_read(int fd, void *buf, size_t count)
+-{
+- size_t offset = 0;
+- ssize_t l;
+-
+- while (offset < count) {
+- l = read(fd, buf + offset, count - offset);
+- if (!l)
+- break;
+- if (l < 0) {
+- if (errno == EAGAIN || errno == EWOULDBLOCK)
+- continue;
+- perror("read");
+- return -1;
+- }
+- offset += l;
+- }
+-
+- return offset;
+-}
+-
+-static ssize_t do_write(int fd, const void *buf, size_t count)
+-{
+- size_t offset = 0;
+- ssize_t l;
+-
+- while (offset < count) {
+- l = write(fd, buf + offset, count - offset);
+- if (l < 0) {
+- if (errno == EAGAIN || errno == EWOULDBLOCK)
+- continue;
+- perror("write");
+- return -1;
+- }
+- offset += l;
+- }
+-
+- return offset;
+-}
+-
+-static ssize_t write_zero(int fd, size_t len)
+-{
+- size_t i = len;
+-
+- while (i--) {
+- const char x = 0;
+- if (do_write(fd, &x, 1) < 0)
+- return -1;
+- }
+-
+- return len;
+-}
+-
+-int main(void)
+-{
+- DECLARE_HDR(hdr);
+- char boot_program[MAX_BOOT_PROG_LEN];
+- size_t aligned_hdr_len, alligned_prog_len;
+- ssize_t prog_len;
+-
+- prog_len = do_read(0, boot_program, sizeof(boot_program));
+- if (prog_len <= 0)
+- return -1;
+-
+- aligned_hdr_len = ROUND_UP(sizeof(hdr));
+- hdr.start_address = htole32(START_BASE + aligned_hdr_len);
+- alligned_prog_len = ROUND_UP(prog_len);
+- hdr.copy_size = htole16(aligned_hdr_len + alligned_prog_len);
+-
+- if (do_write(1, &hdr, sizeof(hdr)) < 0)
+- return -1;
+- if (write_zero(1, aligned_hdr_len - sizeof(hdr)) < 0)
+- return -1;
+-
+- if (do_write(1, boot_program, prog_len) < 0)
+- return 1;
+-
+- /* Write out the rest of the kernel */
+- while (1) {
+- prog_len = do_read(0, boot_program, sizeof(boot_program));
+- if (prog_len < 0)
+- return 1;
+- if (prog_len == 0)
+- break;
+- if (do_write(1, boot_program, prog_len) < 0)
+- return 1;
+- }
+-
+- return 0;
+-}
+diff --git a/Documentation/arm/SH-Mobile/zboot-rom-mmcif.txt b/Documentation/arm/SH-Mobile/zboot-rom-mmcif.txt
+deleted file mode 100644
+index efff8ae2713d..000000000000
+--- a/Documentation/arm/SH-Mobile/zboot-rom-mmcif.txt
++++ /dev/null
+@@ -1,29 +0,0 @@
+-ROM-able zImage boot from MMC
+------------------------------
+-
+-An ROM-able zImage compiled with ZBOOT_ROM_MMCIF may be written to MMC and
+-SuperH Mobile ARM will to boot directly from the MMCIF hardware block.
+-
+-This is achieved by the mask ROM loading the first portion of the image into
+-MERAM and then jumping to it. This portion contains loader code which
+-copies the entire image to SDRAM and jumps to it. From there the zImage
+-boot code proceeds as normal, uncompressing the image into its final
+-location and then jumping to it.
+-
+-This code has been tested on an AP4EB board using the developer 1A eMMC
+-boot mode which is configured using the following jumper settings.
+-The board used for testing required a patched mask ROM in order for
+-this mode to function.
+-
+- 8 7 6 5 4 3 2 1
+- x|x|x|x|x| |x|
+-S4 -+-+-+-+-+-+-+-
+- | | | | |x| |x on
+-
+-The zImage must be written to the MMC card at sector 1 (512 bytes) in
+-vrl4 format. A utility vrl4 is supplied to accomplish this.
+-
+-e.g.
+- vrl4 < zImage | dd of=/dev/sdX bs=512 seek=1
+-
+-A dual-voltage MMC 4.0 card was used for testing.
+diff --git a/Documentation/arm/SH-Mobile/zboot-rom-sdhi.txt b/Documentation/arm/SH-Mobile/zboot-rom-sdhi.txt
+deleted file mode 100644
+index 441959846e1a..000000000000
+--- a/Documentation/arm/SH-Mobile/zboot-rom-sdhi.txt
++++ /dev/null
+@@ -1,42 +0,0 @@
+-ROM-able zImage boot from eSD
+------------------------------
+-
+-An ROM-able zImage compiled with ZBOOT_ROM_SDHI may be written to eSD and
+-SuperH Mobile ARM will to boot directly from the SDHI hardware block.
+-
+-This is achieved by the mask ROM loading the first portion of the image into
+-MERAM and then jumping to it. This portion contains loader code which
+-copies the entire image to SDRAM and jumps to it. From there the zImage
+-boot code proceeds as normal, uncompressing the image into its final
+-location and then jumping to it.
+-
+-This code has been tested on an mackerel board using the developer 1A eSD
+-boot mode which is configured using the following jumper settings.
+-
+- 8 7 6 5 4 3 2 1
+- x|x|x|x| |x|x|
+-S4 -+-+-+-+-+-+-+-
+- | | | |x| | |x on
+-
+-The eSD card needs to be present in SDHI slot 1 (CN7).
+-As such S1 and S33 also need to be configured as per
+-the notes in arch/arm/mach-shmobile/board-mackerel.c.
+-
+-A partial zImage must be written to physical partition #1 (boot)
+-of the eSD at sector 0 in vrl4 format. A utility vrl4 is supplied to
+-accomplish this.
+-
+-e.g.
+- vrl4 < zImage | dd of=/dev/sdX bs=512 count=17
+-
+-A full copy of _the same_ zImage should be written to physical partition #1
+-(boot) of the eSD at sector 0. This should _not_ be in vrl4 format.
+-
+- vrl4 < zImage | dd of=/dev/sdX bs=512
+-
+-Note: The commands above assume that the physical partition has been
+-switched. No such facility currently exists in the Linux Kernel.
+-
+-Physical partitions are described in the eSD specification. At the time of
+-writing they are not the same as partitions that are typically configured
+-using fdisk and visible through /proc/partitions
+diff --git a/Documentation/video4linux/v4l2-pci-skeleton.c b/Documentation/video4linux/v4l2-pci-skeleton.c
+index 006721e43b2a..7bd1b975bfd2 100644
+--- a/Documentation/video4linux/v4l2-pci-skeleton.c
++++ b/Documentation/video4linux/v4l2-pci-skeleton.c
+@@ -42,7 +42,6 @@
+ MODULE_DESCRIPTION("V4L2 PCI Skeleton Driver");
+ MODULE_AUTHOR("Hans Verkuil");
+ MODULE_LICENSE("GPL v2");
+-MODULE_DEVICE_TABLE(pci, skeleton_pci_tbl);
+
+ /**
+ * struct skeleton - All internal data for one instance of device
+@@ -95,6 +94,7 @@ static const struct pci_device_id skeleton_pci_tbl[] = {
+ /* { PCI_DEVICE(PCI_VENDOR_ID_, PCI_DEVICE_ID_) }, */
+ { 0, }
+ };
++MODULE_DEVICE_TABLE(pci, skeleton_pci_tbl);
+
+ /*
+ * HDTV: this structure has the capabilities of the HDTV receiver.
+diff --git a/Makefile b/Makefile
+index 9132f73528b3..52d32f6bd7c5 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 18
+-SUBLEVEL = 47
++SUBLEVEL = 48
+ EXTRAVERSION =
+ NAME = Diseased Newt
+
+@@ -610,6 +610,7 @@ all: vmlinux
+ include $(srctree)/arch/$(SRCARCH)/Makefile
+
+ KBUILD_CFLAGS += $(call cc-option,-fno-delete-null-pointer-checks,)
++KBUILD_CFLAGS += $(call cc-disable-warning,frame-address,)
+ KBUILD_CFLAGS += $(call cc-option,-fno-PIE)
+ KBUILD_AFLAGS += $(call cc-option,-fno-PIE)
+
+diff --git a/arch/x86/boot/compressed/misc.h b/arch/x86/boot/compressed/misc.h
+index 24e3e569a13c..124312be129b 100644
+--- a/arch/x86/boot/compressed/misc.h
++++ b/arch/x86/boot/compressed/misc.h
+@@ -2,14 +2,13 @@
+ #define BOOT_COMPRESSED_MISC_H
+
+ /*
+- * we have to be careful, because no indirections are allowed here, and
+- * paravirt_ops is a kind of one. As it will only run in baremetal anyway,
+- * we just keep it from happening
++ * Special hack: we have to be careful, because no indirections are allowed here,
++ * and paravirt_ops is a kind of one. As it will only run in baremetal anyway,
++ * we just keep it from happening. (This list needs to be extended when new
++ * paravirt and debugging variants are added.)
+ */
+ #undef CONFIG_PARAVIRT
+-#ifdef CONFIG_X86_32
+-#define _ASM_X86_DESC_H 1
+-#endif
++#undef CONFIG_PARAVIRT_SPINLOCKS
+
+ #include <linux/linkage.h>
+ #include <linux/screen_info.h>
+diff --git a/arch/x86/xen/mmu.c b/arch/x86/xen/mmu.c
+index a8a1a3d08d4d..039d4e14194d 100644
+--- a/arch/x86/xen/mmu.c
++++ b/arch/x86/xen/mmu.c
+@@ -1147,7 +1147,7 @@ static void __init xen_cleanhighmap(unsigned long vaddr,
+
+ /* NOTE: The loop is more greedy than the cleanup_highmap variant.
+ * We include the PMD passed in on _both_ boundaries. */
+- for (; vaddr <= vaddr_end && (pmd < (level2_kernel_pgt + PAGE_SIZE));
++ for (; vaddr <= vaddr_end && (pmd < (level2_kernel_pgt + PTRS_PER_PMD));
+ pmd++, vaddr += PMD_SIZE) {
+ if (pmd_none(*pmd))
+ continue;
+diff --git a/crypto/algif_hash.c b/crypto/algif_hash.c
+index 434af81b9e33..df99445a899a 100644
+--- a/crypto/algif_hash.c
++++ b/crypto/algif_hash.c
+@@ -283,8 +283,8 @@ unlock_child:
+ return err;
+ }
+
+-static int hash_sendmsg_nokey(struct socket *sock, struct msghdr *msg,
+- size_t size)
++static int hash_sendmsg_nokey(struct kiocb *unused, struct socket *sock,
++ struct msghdr *msg, size_t size)
+ {
+ int err;
+
+@@ -307,8 +307,8 @@ static ssize_t hash_sendpage_nokey(struct socket *sock, struct page *page,
+ return hash_sendpage(sock, page, offset, size, flags);
+ }
+
+-static int hash_recvmsg_nokey(struct socket *sock, struct msghdr *msg,
+- size_t ignored, int flags)
++static int hash_recvmsg_nokey(struct kiocb *unused, struct socket *sock,
++ struct msghdr *msg, size_t ignored, int flags)
+ {
+ int err;
+
+diff --git a/drivers/ata/pata_hpt366.c b/drivers/ata/pata_hpt366.c
+index cbc3de793d1d..0038dc4c06c7 100644
+--- a/drivers/ata/pata_hpt366.c
++++ b/drivers/ata/pata_hpt366.c
+@@ -352,7 +352,7 @@ static int hpt36x_init_one(struct pci_dev *dev, const struct pci_device_id *id)
+ };
+ const struct ata_port_info *ppi[] = { &info_hpt366, NULL };
+
+- void *hpriv = NULL;
++ const void *hpriv = NULL;
+ u32 reg1;
+ int rc;
+
+@@ -383,7 +383,7 @@ static int hpt36x_init_one(struct pci_dev *dev, const struct pci_device_id *id)
+ break;
+ }
+ /* Now kick off ATA set up */
+- return ata_pci_bmdma_init_one(dev, ppi, &hpt36x_sht, hpriv, 0);
++ return ata_pci_bmdma_init_one(dev, ppi, &hpt36x_sht, (void *)hpriv, 0);
+ }
+
+ #ifdef CONFIG_PM_SLEEP
+diff --git a/drivers/atm/iphase.c b/drivers/atm/iphase.c
+index 4217f29a85e0..816087b68ec4 100644
+--- a/drivers/atm/iphase.c
++++ b/drivers/atm/iphase.c
+@@ -1175,7 +1175,7 @@ static int rx_pkt(struct atm_dev *dev)
+ if (!(skb = atm_alloc_charge(vcc, len, GFP_ATOMIC))) {
+ if (vcc->vci < 32)
+ printk("Drop control packets\n");
+- goto out_free_desc;
++ goto out_free_desc;
+ }
+ skb_put(skb,len);
+ // pwang_test
+diff --git a/drivers/block/paride/pg.c b/drivers/block/paride/pg.c
+index 2ce3dfd7e6b9..876d0c3eaf58 100644
+--- a/drivers/block/paride/pg.c
++++ b/drivers/block/paride/pg.c
+@@ -137,7 +137,7 @@
+
+ */
+
+-static bool verbose = 0;
++static int verbose;
+ static int major = PG_MAJOR;
+ static char *name = PG_NAME;
+ static int disable = 0;
+@@ -168,7 +168,7 @@ enum {D_PRT, D_PRO, D_UNI, D_MOD, D_SLV, D_DLY};
+
+ #include <asm/uaccess.h>
+
+-module_param(verbose, bool, 0644);
++module_param(verbose, int, 0644);
+ module_param(major, int, 0);
+ module_param(name, charp, 0);
+ module_param_array(drive0, int, NULL, 0);
+diff --git a/drivers/gpu/drm/i915/i915_debugfs.c b/drivers/gpu/drm/i915/i915_debugfs.c
+index 063b44817e08..ccc17703014e 100644
+--- a/drivers/gpu/drm/i915/i915_debugfs.c
++++ b/drivers/gpu/drm/i915/i915_debugfs.c
+@@ -141,10 +141,11 @@ describe_obj(struct seq_file *m, struct drm_i915_gem_object *obj)
+ obj->madv == I915_MADV_DONTNEED ? " purgeable" : "");
+ if (obj->base.name)
+ seq_printf(m, " (name: %d)", obj->base.name);
+- list_for_each_entry(vma, &obj->vma_list, vma_link)
++ list_for_each_entry(vma, &obj->vma_list, vma_link) {
+ if (vma->pin_count > 0)
+ pin_count++;
+- seq_printf(m, " (pinned x %d)", pin_count);
++ }
++ seq_printf(m, " (pinned x %d)", pin_count);
+ if (obj->pin_display)
+ seq_printf(m, " (display)");
+ if (obj->fence_reg != I915_FENCE_REG_NONE)
+diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
+index 01c7a08a66e1..53d325968e42 100644
+--- a/drivers/hid/hid-input.c
++++ b/drivers/hid/hid-input.c
+@@ -1122,7 +1122,7 @@ void hidinput_hid_event(struct hid_device *hid, struct hid_field *field, struct
+ return;
+
+ /* report the usage code as scancode if the key status has changed */
+- if (usage->type == EV_KEY && !!test_bit(usage->code, input->key) != value)
++ if (usage->type == EV_KEY && (!!test_bit(usage->code, input->key)) != value)
+ input_event(input, EV_MSC, MSC_SCAN, usage->hid);
+
+ input_event(input, usage->type, usage->code, value);
+diff --git a/drivers/media/platform/s3c-camif/camif-capture.c b/drivers/media/platform/s3c-camif/camif-capture.c
+index 4f81b4c9d113..df33e720d664 100644
+--- a/drivers/media/platform/s3c-camif/camif-capture.c
++++ b/drivers/media/platform/s3c-camif/camif-capture.c
+@@ -115,7 +115,7 @@ static int sensor_set_power(struct camif_dev *camif, int on)
+ struct cam_sensor *sensor = &camif->sensor;
+ int err = 0;
+
+- if (!on == camif->sensor.power_count)
++ if (camif->sensor.power_count == !on)
+ err = v4l2_subdev_call(sensor->sd, core, s_power, on);
+ if (!err)
+ sensor->power_count += on ? 1 : -1;
+@@ -131,7 +131,7 @@ static int sensor_set_streaming(struct camif_dev *camif, int on)
+ struct cam_sensor *sensor = &camif->sensor;
+ int err = 0;
+
+- if (!on == camif->sensor.stream_count)
++ if (camif->sensor.stream_count == !on)
+ err = v4l2_subdev_call(sensor->sd, video, s_stream, on);
+ if (!err)
+ sensor->stream_count += on ? 1 : -1;
+diff --git a/drivers/media/v4l2-core/videobuf2-core.c b/drivers/media/v4l2-core/videobuf2-core.c
+index 1d1c4d35a1a6..1c2cc6fee351 100644
+--- a/drivers/media/v4l2-core/videobuf2-core.c
++++ b/drivers/media/v4l2-core/videobuf2-core.c
+@@ -3221,7 +3221,6 @@ EXPORT_SYMBOL_GPL(vb2_thread_start);
+ int vb2_thread_stop(struct vb2_queue *q)
+ {
+ struct vb2_threadio_data *threadio = q->threadio;
+- struct vb2_fileio_data *fileio = q->fileio;
+ int err;
+
+ if (threadio == NULL)
+diff --git a/drivers/mtd/mtd_blkdevs.c b/drivers/mtd/mtd_blkdevs.c
+index 3a69b1e56908..3e3aa17ee3bd 100644
+--- a/drivers/mtd/mtd_blkdevs.c
++++ b/drivers/mtd/mtd_blkdevs.c
+@@ -97,14 +97,13 @@ static int do_blktrans_request(struct mtd_blktrans_ops *tr,
+ if (req->cmd_flags & REQ_DISCARD)
+ return tr->discard(dev, block, nsect);
+
+- switch(rq_data_dir(req)) {
+- case READ:
++ if (rq_data_dir(req) == READ) {
+ for (; nsect > 0; nsect--, block++, buf += tr->blksize)
+ if (tr->readsect(dev, block, buf))
+ return -EIO;
+ rq_flush_dcache_pages(req);
+ return 0;
+- case WRITE:
++ } else {
+ if (!tr->writesect)
+ return -EIO;
+
+@@ -113,9 +112,6 @@ static int do_blktrans_request(struct mtd_blktrans_ops *tr,
+ if (tr->writesect(dev, block, buf))
+ return -EIO;
+ return 0;
+- default:
+- printk(KERN_NOTICE "Unknown request %u\n", rq_data_dir(req));
+- return -EIO;
+ }
+ }
+
+diff --git a/drivers/net/ethernet/dec/tulip/uli526x.c b/drivers/net/ethernet/dec/tulip/uli526x.c
+index 4061f9b22812..19063aceb25d 100644
+--- a/drivers/net/ethernet/dec/tulip/uli526x.c
++++ b/drivers/net/ethernet/dec/tulip/uli526x.c
+@@ -1115,7 +1115,7 @@ static void uli526x_timer(unsigned long data)
+ netif_carrier_off(dev);
+ }
+ }
+- db->init=0;
++ db->init = 0;
+
+ /* Timer active again */
+ db->timer.expires = ULI526X_TIMER_WUT;
+diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c
+index fdd36794c536..1f65817d4674 100644
+--- a/drivers/net/ethernet/emulex/benet/be_main.c
++++ b/drivers/net/ethernet/emulex/benet/be_main.c
+@@ -26,7 +26,6 @@
+ #include <net/vxlan.h>
+
+ MODULE_VERSION(DRV_VER);
+-MODULE_DEVICE_TABLE(pci, be_dev_ids);
+ MODULE_DESCRIPTION(DRV_DESC " " DRV_VER);
+ MODULE_AUTHOR("Emulex Corporation");
+ MODULE_LICENSE("GPL");
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_debugfs.c b/drivers/net/ethernet/intel/i40e/i40e_debugfs.c
+index 7067f4b9159c..2a42ae05cb16 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_debugfs.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_debugfs.c
+@@ -773,7 +773,7 @@ static void i40e_dbg_dump_desc(int cnt, int vsi_seid, int ring_id, int desc_n,
+ {
+ struct i40e_tx_desc *txd;
+ union i40e_rx_desc *rxd;
+- struct i40e_ring ring;
++ struct i40e_ring *ring;
+ struct i40e_vsi *vsi;
+ int i;
+
+@@ -792,29 +792,32 @@ static void i40e_dbg_dump_desc(int cnt, int vsi_seid, int ring_id, int desc_n,
+ vsi_seid);
+ return;
+ }
+- if (is_rx_ring)
+- ring = *vsi->rx_rings[ring_id];
+- else
+- ring = *vsi->tx_rings[ring_id];
++
++ ring = kmemdup(is_rx_ring
++ ? vsi->rx_rings[ring_id] : vsi->tx_rings[ring_id],
++ sizeof(*ring), GFP_KERNEL);
++ if (!ring)
++ return;
++
+ if (cnt == 2) {
+ dev_info(&pf->pdev->dev, "vsi = %02i %s ring = %02i\n",
+ vsi_seid, is_rx_ring ? "rx" : "tx", ring_id);
+- for (i = 0; i < ring.count; i++) {
++ for (i = 0; i < ring->count; i++) {
+ if (!is_rx_ring) {
+- txd = I40E_TX_DESC(&ring, i);
++ txd = I40E_TX_DESC(ring, i);
+ dev_info(&pf->pdev->dev,
+ " d[%03i] = 0x%016llx 0x%016llx\n",
+ i, txd->buffer_addr,
+ txd->cmd_type_offset_bsz);
+ } else if (sizeof(union i40e_rx_desc) ==
+ sizeof(union i40e_16byte_rx_desc)) {
+- rxd = I40E_RX_DESC(&ring, i);
++ rxd = I40E_RX_DESC(ring, i);
+ dev_info(&pf->pdev->dev,
+ " d[%03i] = 0x%016llx 0x%016llx\n",
+ i, rxd->read.pkt_addr,
+ rxd->read.hdr_addr);
+ } else {
+- rxd = I40E_RX_DESC(&ring, i);
++ rxd = I40E_RX_DESC(ring, i);
+ dev_info(&pf->pdev->dev,
+ " d[%03i] = 0x%016llx 0x%016llx 0x%016llx 0x%016llx\n",
+ i, rxd->read.pkt_addr,
+@@ -823,26 +826,26 @@ static void i40e_dbg_dump_desc(int cnt, int vsi_seid, int ring_id, int desc_n,
+ }
+ }
+ } else if (cnt == 3) {
+- if (desc_n >= ring.count || desc_n < 0) {
++ if (desc_n >= ring->count || desc_n < 0) {
+ dev_info(&pf->pdev->dev,
+ "descriptor %d not found\n", desc_n);
+ return;
+ }
+ if (!is_rx_ring) {
+- txd = I40E_TX_DESC(&ring, desc_n);
++ txd = I40E_TX_DESC(ring, desc_n);
+ dev_info(&pf->pdev->dev,
+ "vsi = %02i tx ring = %02i d[%03i] = 0x%016llx 0x%016llx\n",
+ vsi_seid, ring_id, desc_n,
+ txd->buffer_addr, txd->cmd_type_offset_bsz);
+ } else if (sizeof(union i40e_rx_desc) ==
+ sizeof(union i40e_16byte_rx_desc)) {
+- rxd = I40E_RX_DESC(&ring, desc_n);
++ rxd = I40E_RX_DESC(ring, desc_n);
+ dev_info(&pf->pdev->dev,
+ "vsi = %02i rx ring = %02i d[%03i] = 0x%016llx 0x%016llx\n",
+ vsi_seid, ring_id, desc_n,
+ rxd->read.pkt_addr, rxd->read.hdr_addr);
+ } else {
+- rxd = I40E_RX_DESC(&ring, desc_n);
++ rxd = I40E_RX_DESC(ring, desc_n);
+ dev_info(&pf->pdev->dev,
+ "vsi = %02i rx ring = %02i d[%03i] = 0x%016llx 0x%016llx 0x%016llx 0x%016llx\n",
+ vsi_seid, ring_id, desc_n,
+@@ -852,6 +855,7 @@ static void i40e_dbg_dump_desc(int cnt, int vsi_seid, int ring_id, int desc_n,
+ } else {
+ dev_info(&pf->pdev->dev, "dump desc rx/tx <vsi_seid> <ring_id> [<desc_n>]\n");
+ }
++ kfree(ring);
+ }
+
+ /**
+diff --git a/drivers/net/wireless/iwlegacy/3945.c b/drivers/net/wireless/iwlegacy/3945.c
+index 93bdf684babe..ae047ab7a4df 100644
+--- a/drivers/net/wireless/iwlegacy/3945.c
++++ b/drivers/net/wireless/iwlegacy/3945.c
+@@ -1019,12 +1019,13 @@ il3945_hw_txq_ctx_free(struct il_priv *il)
+ int txq_id;
+
+ /* Tx queues */
+- if (il->txq)
++ if (il->txq) {
+ for (txq_id = 0; txq_id < il->hw_params.max_txq_num; txq_id++)
+ if (txq_id == IL39_CMD_QUEUE_NUM)
+ il_cmd_queue_free(il);
+ else
+ il_tx_queue_free(il, txq_id);
++ }
+
+ /* free tx queue structure */
+ il_free_txq_mem(il);
+diff --git a/drivers/scsi/be2iscsi/be_main.c b/drivers/scsi/be2iscsi/be_main.c
+index 3ed37dc28b3c..3e6c36cd19b9 100644
+--- a/drivers/scsi/be2iscsi/be_main.c
++++ b/drivers/scsi/be2iscsi/be_main.c
+@@ -48,7 +48,6 @@ static unsigned int be_iopoll_budget = 10;
+ static unsigned int be_max_phys_size = 64;
+ static unsigned int enable_msix = 1;
+
+-MODULE_DEVICE_TABLE(pci, beiscsi_pci_id_table);
+ MODULE_DESCRIPTION(DRV_DESC " " BUILD_STR);
+ MODULE_VERSION(BUILD_STR);
+ MODULE_AUTHOR("Emulex Corporation");
+@@ -3166,7 +3165,7 @@ be_sgl_create_contiguous(void *virtual_address,
+ {
+ WARN_ON(!virtual_address);
+ WARN_ON(!physical_address);
+- WARN_ON(!length > 0);
++ WARN_ON(!length);
+ WARN_ON(!sgl);
+
+ sgl->va = virtual_address;
+diff --git a/drivers/scsi/bfa/bfa_ioc.c b/drivers/scsi/bfa/bfa_ioc.c
+index 315d6d6dcfc8..4e7104461f09 100644
+--- a/drivers/scsi/bfa/bfa_ioc.c
++++ b/drivers/scsi/bfa/bfa_ioc.c
+@@ -3665,19 +3665,19 @@ bfa_cb_sfp_state_query(struct bfa_sfp_s *sfp)
+ if (sfp->state_query_cbfn)
+ sfp->state_query_cbfn(sfp->state_query_cbarg,
+ sfp->status);
+- sfp->media = NULL;
+- }
++ sfp->media = NULL;
++ }
+
+- if (sfp->portspeed) {
+- sfp->status = bfa_sfp_speed_valid(sfp, sfp->portspeed);
+- if (sfp->state_query_cbfn)
+- sfp->state_query_cbfn(sfp->state_query_cbarg,
+- sfp->status);
+- sfp->portspeed = BFA_PORT_SPEED_UNKNOWN;
+- }
++ if (sfp->portspeed) {
++ sfp->status = bfa_sfp_speed_valid(sfp, sfp->portspeed);
++ if (sfp->state_query_cbfn)
++ sfp->state_query_cbfn(sfp->state_query_cbarg,
++ sfp->status);
++ sfp->portspeed = BFA_PORT_SPEED_UNKNOWN;
++ }
+
+- sfp->state_query_lock = 0;
+- sfp->state_query_cbfn = NULL;
++ sfp->state_query_lock = 0;
++ sfp->state_query_cbfn = NULL;
+ }
+
+ /*
+diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c
+index 9f296dfeeb7f..1c965e0325af 100644
+--- a/drivers/scsi/qla2xxx/qla_target.c
++++ b/drivers/scsi/qla2xxx/qla_target.c
+@@ -3075,11 +3075,10 @@ void qlt_abort_cmd(struct qla_tgt_cmd *cmd)
+ {
+ struct qla_tgt *tgt = cmd->tgt;
+ struct scsi_qla_host *vha = tgt->vha;
+- struct se_cmd *se_cmd = &cmd->se_cmd;
+
+ ql_dbg(ql_dbg_tgt_mgt, vha, 0xf014,
+ "qla_target(%d): terminating exchange for aborted cmd=%p "
+- "(se_cmd=%p, tag=%llu)", vha->vp_idx, cmd, &cmd->se_cmd,
++ "(se_cmd=%p, tag=%d)", vha->vp_idx, cmd, &cmd->se_cmd,
+ cmd->tag);
+
+ cmd->state = QLA_TGT_STATE_ABORTED;
+diff --git a/drivers/spi/spi-dw-mid.c b/drivers/spi/spi-dw-mid.c
+index 1417f96546ce..fc37844ac16e 100644
+--- a/drivers/spi/spi-dw-mid.c
++++ b/drivers/spi/spi-dw-mid.c
+@@ -111,28 +111,11 @@ static void dw_spi_dma_done(void *arg)
+ dw_spi_xfer_done(dws);
+ }
+
+-static int mid_spi_dma_transfer(struct dw_spi *dws, int cs_change)
++static struct dma_async_tx_descriptor *dw_spi_dma_prepare_tx(struct dw_spi *dws)
+ {
+- struct dma_async_tx_descriptor *txdesc, *rxdesc;
+- struct dma_slave_config txconf, rxconf;
+- u16 dma_ctrl = 0;
+-
+- /* 1. setup DMA related registers */
+- if (cs_change) {
+- spi_enable_chip(dws, 0);
+- dw_writew(dws, DW_SPI_DMARDLR, 0xf);
+- dw_writew(dws, DW_SPI_DMATDLR, 0x10);
+- if (dws->tx_dma)
+- dma_ctrl |= SPI_DMA_TDMAE;
+- if (dws->rx_dma)
+- dma_ctrl |= SPI_DMA_RDMAE;
+- dw_writew(dws, DW_SPI_DMACR, dma_ctrl);
+- spi_enable_chip(dws, 1);
+- }
++ struct dma_slave_config txconf;
++ struct dma_async_tx_descriptor *txdesc;
+
+- dws->dma_chan_done = 0;
+-
+- /* 2. Prepare the TX dma transfer */
+ txconf.direction = DMA_MEM_TO_DEV;
+ txconf.dst_addr = dws->dma_addr;
+ txconf.dst_maxburst = LNW_DMA_MSIZE_16;
+@@ -157,7 +140,14 @@ static int mid_spi_dma_transfer(struct dw_spi *dws, int cs_change)
+ txdesc->callback = dw_spi_dma_done;
+ txdesc->callback_param = dws;
+
+- /* 3. Prepare the RX dma transfer */
++ return txdesc;
++}
++
++static struct dma_async_tx_descriptor *dw_spi_dma_prepare_rx(struct dw_spi *dws)
++{
++ struct dma_slave_config rxconf;
++ struct dma_async_tx_descriptor *rxdesc;
++
+ rxconf.direction = DMA_DEV_TO_MEM;
+ rxconf.src_addr = dws->dma_addr;
+ rxconf.src_maxburst = LNW_DMA_MSIZE_16;
+@@ -182,6 +172,43 @@ static int mid_spi_dma_transfer(struct dw_spi *dws, int cs_change)
+ rxdesc->callback = dw_spi_dma_done;
+ rxdesc->callback_param = dws;
+
++ return rxdesc;
++}
++
++static void dw_spi_dma_setup(struct dw_spi *dws)
++{
++ u16 dma_ctrl = 0;
++
++ spi_enable_chip(dws, 0);
++
++ dw_writew(dws, DW_SPI_DMARDLR, 0xf);
++ dw_writew(dws, DW_SPI_DMATDLR, 0x10);
++
++ if (dws->tx_dma)
++ dma_ctrl |= SPI_DMA_TDMAE;
++ if (dws->rx_dma)
++ dma_ctrl |= SPI_DMA_RDMAE;
++ dw_writew(dws, DW_SPI_DMACR, dma_ctrl);
++
++ spi_enable_chip(dws, 1);
++}
++
++static int mid_spi_dma_transfer(struct dw_spi *dws, int cs_change)
++{
++ struct dma_async_tx_descriptor *txdesc, *rxdesc;
++
++ /* 1. setup DMA related registers */
++ if (cs_change)
++ dw_spi_dma_setup(dws);
++
++ dws->dma_chan_done = 0;
++
++ /* 2. Prepare the TX dma transfer */
++ txdesc = dw_spi_dma_prepare_tx(dws);
++
++ /* 3. Prepare the RX dma transfer */
++ rxdesc = dw_spi_dma_prepare_rx(dws);
++
+ /* rx must be started before tx due to spi instinct */
+ dmaengine_submit(rxdesc);
+ dma_async_issue_pending(dws->rxchan);
+diff --git a/drivers/staging/iio/adc/ad7192.c b/drivers/staging/iio/adc/ad7192.c
+index c110a255d4e8..8343a780f63d 100644
+--- a/drivers/staging/iio/adc/ad7192.c
++++ b/drivers/staging/iio/adc/ad7192.c
+@@ -236,7 +236,7 @@ static int ad7192_setup(struct ad7192_state *st,
+ st->mclk = pdata->ext_clk_Hz;
+ else
+ st->mclk = AD7192_INT_FREQ_MHz;
+- break;
++ break;
+ default:
+ ret = -EINVAL;
+ goto out;
+diff --git a/drivers/staging/lustre/lustre/llite/llite_lib.c b/drivers/staging/lustre/lustre/llite/llite_lib.c
+index f4ca7b753021..500af356a033 100644
+--- a/drivers/staging/lustre/lustre/llite/llite_lib.c
++++ b/drivers/staging/lustre/lustre/llite/llite_lib.c
+@@ -1504,7 +1504,7 @@ int ll_setattr_raw(struct dentry *dentry, struct iattr *attr, bool hsm_import)
+
+ if (attr->ia_valid & (ATTR_SIZE |
+ ATTR_ATIME | ATTR_ATIME_SET |
+- ATTR_MTIME | ATTR_MTIME_SET))
++ ATTR_MTIME | ATTR_MTIME_SET)) {
+ /* For truncate and utimes sending attributes to OSTs, setting
+ * mtime/atime to the past will be performed under PW [0:EOF]
+ * extent lock (new_size:EOF for truncate). It may seem
+@@ -1516,6 +1516,7 @@ int ll_setattr_raw(struct dentry *dentry, struct iattr *attr, bool hsm_import)
+ rc = ll_setattr_ost(inode, attr);
+ if (attr->ia_valid & ATTR_SIZE)
+ up_write(&lli->lli_trunc_sem);
++ }
+ out:
+ if (op_data) {
+ if (op_data->op_ioepoch) {
+diff --git a/drivers/staging/rtl8723au/core/rtw_wlan_util.c b/drivers/staging/rtl8723au/core/rtw_wlan_util.c
+index 09c44a55d4a6..34f0de6abac6 100644
+--- a/drivers/staging/rtl8723au/core/rtw_wlan_util.c
++++ b/drivers/staging/rtl8723au/core/rtw_wlan_util.c
+@@ -525,7 +525,7 @@ void WMMOnAssocRsp23a(struct rtw_adapter *padapter)
+ else
+ aSifsTime = 16;
+
+- for (i = 0; i < 4; i++) {
++ for (i = 0; i < 4; i++) {
+ ACI = (pmlmeinfo->WMM_param.ac_param[i].ACI_AIFSN >> 5) & 0x03;
+ ACM = (pmlmeinfo->WMM_param.ac_param[i].ACI_AIFSN >> 4) & 0x01;
+
+diff --git a/drivers/usb/gadget/udc/udc-xilinx.c b/drivers/usb/gadget/udc/udc-xilinx.c
+index ed27e1687a4e..da289786d597 100644
+--- a/drivers/usb/gadget/udc/udc-xilinx.c
++++ b/drivers/usb/gadget/udc/udc-xilinx.c
+@@ -2132,8 +2132,8 @@ static int xudc_probe(struct platform_device *pdev)
+
+ platform_set_drvdata(pdev, udc);
+
+- dev_vdbg(&pdev->dev, "%s at 0x%08X mapped to 0x%08X %s\n",
+- driver_name, (u32)res->start, (u32 __force)udc->addr,
++ dev_vdbg(&pdev->dev, "%s at 0x%08X mapped to %p %s\n",
++ driver_name, (u32)res->start, udc->addr,
+ udc->dma_enabled ? "with DMA" : "without DMA");
+
+ return 0;
+diff --git a/drivers/usb/renesas_usbhs/common.c b/drivers/usb/renesas_usbhs/common.c
+index b3b6813ab270..d51f47892386 100644
+--- a/drivers/usb/renesas_usbhs/common.c
++++ b/drivers/usb/renesas_usbhs/common.c
+@@ -466,7 +466,7 @@ static struct renesas_usbhs_platform_info *usbhs_parse_dt(struct device *dev)
+ return NULL;
+
+ dparam = &info->driver_param;
+- dparam->type = of_id ? (u32)of_id->data : 0;
++ dparam->type = of_id ? (uintptr_t)of_id->data : 0;
+ if (!of_property_read_u32(dev->of_node, "renesas,buswait", &tmp))
+ dparam->buswait_bwait = tmp;
+ gpio = of_get_named_gpio_flags(dev->of_node, "renesas,enable-gpio", 0,
+diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
+index aac0f9ea952a..d94f4d0145a4 100644
+--- a/include/linux/blkdev.h
++++ b/include/linux/blkdev.h
+@@ -616,7 +616,7 @@ static inline void queue_flag_clear(unsigned int flag, struct request_queue *q)
+
+ #define list_entry_rq(ptr) list_entry((ptr), struct request, queuelist)
+
+-#define rq_data_dir(rq) (((rq)->cmd_flags & 1) != 0)
++#define rq_data_dir(rq) ((int)((rq)->cmd_flags & 1))
+
+ /*
+ * Driver can handle struct request, if it either has an old style
+diff --git a/include/linux/module.h b/include/linux/module.h
+index 18edb9660da0..6fc269ce701c 100644
+--- a/include/linux/module.h
++++ b/include/linux/module.h
+@@ -135,7 +135,7 @@ void trim_init_extable(struct module *m);
+ #ifdef MODULE
+ /* Creates an alias so file2alias.c can find device table. */
+ #define MODULE_DEVICE_TABLE(type, name) \
+- extern const struct type##_device_id __mod_##type##__##name##_device_table \
++extern const typeof(name) __mod_##type##__##name##_device_table \
+ __attribute__ ((unused, alias(__stringify(name))))
+ #else /* !MODULE */
+ #define MODULE_DEVICE_TABLE(type, name)
+diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
+index 3b57c6712495..2ff757f2d3a3 100644
+--- a/include/linux/skbuff.h
++++ b/include/linux/skbuff.h
+@@ -188,6 +188,7 @@ struct sk_buff;
+ #else
+ #define MAX_SKB_FRAGS (65536/PAGE_SIZE + 1)
+ #endif
++extern int sysctl_max_skb_frags;
+
+ typedef struct skb_frag_struct skb_frag_t;
+
+diff --git a/include/linux/usb/renesas_usbhs.h b/include/linux/usb/renesas_usbhs.h
+index d5952bb66752..c1209d5b8531 100644
+--- a/include/linux/usb/renesas_usbhs.h
++++ b/include/linux/usb/renesas_usbhs.h
+@@ -153,7 +153,7 @@ struct renesas_usbhs_driver_param {
+ */
+ int pio_dma_border; /* default is 64byte */
+
+- u32 type;
++ uintptr_t type;
+ u32 enable_gpio;
+
+ /*
+diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c
+index 115f149362ba..1fbc1aadb450 100644
+--- a/net/bluetooth/hci_sock.c
++++ b/net/bluetooth/hci_sock.c
+@@ -46,9 +46,9 @@ struct hci_pinfo {
+ unsigned short channel;
+ };
+
+-static inline int hci_test_bit(int nr, void *addr)
++static inline int hci_test_bit(int nr, const void *addr)
+ {
+- return *((__u32 *) addr + (nr >> 5)) & ((__u32) 1 << (nr & 31));
++ return *((const __u32 *) addr + (nr >> 5)) & ((__u32) 1 << (nr & 31));
+ }
+
+ /* Security filter */
+diff --git a/net/bridge/netfilter/nft_reject_bridge.c b/net/bridge/netfilter/nft_reject_bridge.c
+index 48da2c54a69e..6a10b88f3371 100644
+--- a/net/bridge/netfilter/nft_reject_bridge.c
++++ b/net/bridge/netfilter/nft_reject_bridge.c
+@@ -375,6 +375,8 @@ static int nft_reject_bridge_dump(struct sk_buff *skb,
+ if (nla_put_u8(skb, NFTA_REJECT_ICMP_CODE, priv->icmp_code))
+ goto nla_put_failure;
+ break;
++ default:
++ break;
+ }
+
+ return 0;
+diff --git a/net/caif/cfpkt_skbuff.c b/net/caif/cfpkt_skbuff.c
+index 1be0b521ac49..5add8e75759d 100644
+--- a/net/caif/cfpkt_skbuff.c
++++ b/net/caif/cfpkt_skbuff.c
+@@ -286,7 +286,7 @@ int cfpkt_setlen(struct cfpkt *pkt, u16 len)
+ else
+ skb_trim(skb, len);
+
+- return cfpkt_getlen(pkt);
++ return cfpkt_getlen(pkt);
+ }
+
+ /* Need to expand SKB */
+diff --git a/net/core/skbuff.c b/net/core/skbuff.c
+index b2921c0d5608..97549212e9e3 100644
+--- a/net/core/skbuff.c
++++ b/net/core/skbuff.c
+@@ -77,6 +77,8 @@
+
+ struct kmem_cache *skbuff_head_cache __read_mostly;
+ static struct kmem_cache *skbuff_fclone_cache __read_mostly;
++int sysctl_max_skb_frags __read_mostly = MAX_SKB_FRAGS;
++EXPORT_SYMBOL(sysctl_max_skb_frags);
+
+ /**
+ * skb_panic - private function for out-of-line support
+diff --git a/net/core/sysctl_net_core.c b/net/core/sysctl_net_core.c
+index e731c96eac4b..cd386d2fd039 100644
+--- a/net/core/sysctl_net_core.c
++++ b/net/core/sysctl_net_core.c
+@@ -27,6 +27,7 @@ static int one = 1;
+ static int ushort_max = USHRT_MAX;
+ static int min_sndbuf = SOCK_MIN_SNDBUF;
+ static int min_rcvbuf = SOCK_MIN_RCVBUF;
++static int max_skb_frags = MAX_SKB_FRAGS;
+
+ #ifdef CONFIG_RPS
+ static int rps_sock_flow_sysctl(struct ctl_table *table, int write,
+@@ -363,6 +364,15 @@ static struct ctl_table net_core_table[] = {
+ .mode = 0644,
+ .proc_handler = proc_dointvec
+ },
++ {
++ .procname = "max_skb_frags",
++ .data = &sysctl_max_skb_frags,
++ .maxlen = sizeof(int),
++ .mode = 0644,
++ .proc_handler = proc_dointvec_minmax,
++ .extra1 = &one,
++ .extra2 = &max_skb_frags,
++ },
+ { }
+ };
+
+diff --git a/net/ipv4/netfilter/nft_reject_ipv4.c b/net/ipv4/netfilter/nft_reject_ipv4.c
+index ed33299c56d1..95fe37c72b32 100644
+--- a/net/ipv4/netfilter/nft_reject_ipv4.c
++++ b/net/ipv4/netfilter/nft_reject_ipv4.c
+@@ -32,6 +32,8 @@ void nft_reject_ipv4_eval(const struct nft_expr *expr,
+ case NFT_REJECT_TCP_RST:
+ nf_send_reset(pkt->skb, pkt->ops->hooknum);
+ break;
++ default:
++ break;
+ }
+
+ data[NFT_REG_VERDICT].verdict = NF_DROP;
+diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
+index 32b25cc96fff..a21c47289765 100644
+--- a/net/ipv4/tcp.c
++++ b/net/ipv4/tcp.c
+@@ -939,7 +939,7 @@ new_segment:
+
+ i = skb_shinfo(skb)->nr_frags;
+ can_coalesce = skb_can_coalesce(skb, i, page, offset);
+- if (!can_coalesce && i >= MAX_SKB_FRAGS) {
++ if (!can_coalesce && i >= sysctl_max_skb_frags) {
+ tcp_mark_push(tp, skb);
+ goto new_segment;
+ }
+@@ -1225,7 +1225,7 @@ new_segment:
+
+ if (!skb_can_coalesce(skb, i, pfrag->page,
+ pfrag->offset)) {
+- if (i == MAX_SKB_FRAGS || !sg) {
++ if (i == sysctl_max_skb_frags || !sg) {
+ tcp_mark_push(tp, skb);
+ goto new_segment;
+ }
+diff --git a/net/ipv6/ip6_offload.c b/net/ipv6/ip6_offload.c
+index f291813c7c0c..219b9d24b3b3 100644
+--- a/net/ipv6/ip6_offload.c
++++ b/net/ipv6/ip6_offload.c
+@@ -305,7 +305,7 @@ static struct packet_offload ipv6_packet_offload __read_mostly = {
+ static const struct net_offload sit_offload = {
+ .callbacks = {
+ .gso_segment = ipv6_gso_segment,
+- .gro_receive = ipv6_gro_receive,
++ .gro_receive = sit_gro_receive,
+ .gro_complete = ipv6_gro_complete,
+ },
+ };
+diff --git a/net/ipv6/netfilter/nft_reject_ipv6.c b/net/ipv6/netfilter/nft_reject_ipv6.c
+index 0bc19fa87821..367bd4841a0c 100644
+--- a/net/ipv6/netfilter/nft_reject_ipv6.c
++++ b/net/ipv6/netfilter/nft_reject_ipv6.c
+@@ -34,6 +34,8 @@ void nft_reject_ipv6_eval(const struct nft_expr *expr,
+ case NFT_REJECT_TCP_RST:
+ nf_send_reset6(net, pkt->skb, pkt->ops->hooknum);
+ break;
++ default:
++ break;
+ }
+
+ data[NFT_REG_VERDICT].verdict = NF_DROP;
+diff --git a/net/netfilter/nft_compat.c b/net/netfilter/nft_compat.c
+index ff6f35971ea2..ab24224bfa66 100644
+--- a/net/netfilter/nft_compat.c
++++ b/net/netfilter/nft_compat.c
+@@ -277,11 +277,11 @@ static void nft_match_eval(const struct nft_expr *expr,
+ return;
+ }
+
+- switch(ret) {
+- case true:
++ switch (ret ? 1 : 0) {
++ case 1:
+ data[NFT_REG_VERDICT].verdict = NFT_CONTINUE;
+ break;
+- case false:
++ case 0:
+ data[NFT_REG_VERDICT].verdict = NFT_BREAK;
+ break;
+ }
+diff --git a/net/netfilter/nft_ct.c b/net/netfilter/nft_ct.c
+index cc5603016242..18d520e0ca0a 100644
+--- a/net/netfilter/nft_ct.c
++++ b/net/netfilter/nft_ct.c
+@@ -56,6 +56,8 @@ static void nft_ct_get_eval(const struct nft_expr *expr,
+ state = NF_CT_STATE_BIT(ctinfo);
+ dest->data[0] = state;
+ return;
++ default:
++ break;
+ }
+
+ if (ct == NULL)
+@@ -117,6 +119,8 @@ static void nft_ct_get_eval(const struct nft_expr *expr,
+ return;
+ }
+ #endif
++ default:
++ break;
+ }
+
+ tuple = &ct->tuplehash[priv->dir].tuple;
+@@ -141,6 +145,8 @@ static void nft_ct_get_eval(const struct nft_expr *expr,
+ case NFT_CT_PROTO_DST:
+ dest->data[0] = (__force __u16)tuple->dst.u.all;
+ return;
++ default:
++ break;
+ }
+ return;
+ err:
+@@ -172,6 +178,8 @@ static void nft_ct_set_eval(const struct nft_expr *expr,
+ }
+ break;
+ #endif
++ default:
++ break;
+ }
+ }
+
+diff --git a/net/netfilter/nft_reject.c b/net/netfilter/nft_reject.c
+index 57d3e1af5630..0522fc9bfb0a 100644
+--- a/net/netfilter/nft_reject.c
++++ b/net/netfilter/nft_reject.c
+@@ -63,6 +63,8 @@ int nft_reject_dump(struct sk_buff *skb, const struct nft_expr *expr)
+ if (nla_put_u8(skb, NFTA_REJECT_ICMP_CODE, priv->icmp_code))
+ goto nla_put_failure;
+ break;
++ default:
++ break;
+ }
+
+ return 0;
+diff --git a/net/netfilter/nft_reject_inet.c b/net/netfilter/nft_reject_inet.c
+index 7b5f9d58680a..1fb065a77474 100644
+--- a/net/netfilter/nft_reject_inet.c
++++ b/net/netfilter/nft_reject_inet.c
+@@ -105,6 +105,8 @@ static int nft_reject_inet_dump(struct sk_buff *skb,
+ if (nla_put_u8(skb, NFTA_REJECT_ICMP_CODE, priv->icmp_code))
+ goto nla_put_failure;
+ break;
++ default:
++ break;
+ }
+
+ return 0;
+diff --git a/sound/pci/oxygen/oxygen_mixer.c b/sound/pci/oxygen/oxygen_mixer.c
+index 5988e044c519..259bf54a9df0 100644
+--- a/sound/pci/oxygen/oxygen_mixer.c
++++ b/sound/pci/oxygen/oxygen_mixer.c
+@@ -88,7 +88,7 @@ static int dac_mute_put(struct snd_kcontrol *ctl,
+ int changed;
+
+ mutex_lock(&chip->mutex);
+- changed = !value->value.integer.value[0] != chip->dac_mute;
++ changed = (!value->value.integer.value[0]) != chip->dac_mute;
+ if (changed) {
+ chip->dac_mute = !value->value.integer.value[0];
+ chip->model.update_dac_mute(chip);
^ permalink raw reply related [flat|nested] 67+ messages in thread
* [gentoo-commits] proj/linux-patches:3.18 commit in: /
@ 2017-03-02 16:33 Mike Pagano
0 siblings, 0 replies; 67+ messages in thread
From: Mike Pagano @ 2017-03-02 16:33 UTC (permalink / raw
To: gentoo-commits
commit: d1a782c44d9630c3bd20cc835a5254752984dc13
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Sat Feb 18 20:36:37 2017 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Thu Mar 2 16:33:32 2017 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=d1a782c4
For GENTOO_LINUX_INIT_SYSTEMD don't add DMIID for non X86 architectures. See bug #609590.
4567_distro-Gentoo-Kconfig.patch | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/4567_distro-Gentoo-Kconfig.patch b/4567_distro-Gentoo-Kconfig.patch
index acb0972..4a88040 100644
--- a/4567_distro-Gentoo-Kconfig.patch
+++ b/4567_distro-Gentoo-Kconfig.patch
@@ -7,8 +7,8 @@
+source "distro/Kconfig"
+
source "arch/$SRCARCH/Kconfig"
---- /dev/null 2016-11-15 00:56:18.320838834 -0500
-+++ b/distro/Kconfig 2016-11-16 06:24:29.457357409 -0500
+--- /dev/null 2017-02-18 04:25:56.900821893 -0500
++++ b/distro/Kconfig 2017-02-18 10:41:16.512328155 -0500
@@ -0,0 +1,142 @@
+menu "Gentoo Linux"
+
@@ -115,7 +115,7 @@
+ select CGROUPS
+ select CHECKPOINT_RESTORE
+ select DEVPTS_MULTIPLE_INSTANCES
-+ select DMIID
++ select DMIID if X86_32 || X86_64 || X86
+ select EPOLL
+ select FANOTIFY
+ select FHANDLE
^ permalink raw reply related [flat|nested] 67+ messages in thread
* [gentoo-commits] proj/linux-patches:3.18 commit in: /
@ 2017-03-02 16:33 Mike Pagano
0 siblings, 0 replies; 67+ messages in thread
From: Mike Pagano @ 2017-03-02 16:33 UTC (permalink / raw
To: gentoo-commits
commit: 507cd00e6660d01124973a211ab0aba2ea237495
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Thu Mar 2 16:16:08 2017 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Thu Mar 2 16:33:51 2017 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=507cd00e
Enable crypto API for systemd as its required for systemd versions >= 233. See bug #611368.
4567_distro-Gentoo-Kconfig.patch | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/4567_distro-Gentoo-Kconfig.patch b/4567_distro-Gentoo-Kconfig.patch
index 4a88040..5555b8a 100644
--- a/4567_distro-Gentoo-Kconfig.patch
+++ b/4567_distro-Gentoo-Kconfig.patch
@@ -7,9 +7,9 @@
+source "distro/Kconfig"
+
source "arch/$SRCARCH/Kconfig"
---- /dev/null 2017-02-18 04:25:56.900821893 -0500
-+++ b/distro/Kconfig 2017-02-18 10:41:16.512328155 -0500
-@@ -0,0 +1,142 @@
+--- /dev/null 2017-03-02 01:55:04.096566155 -0500
++++ b/distro/Kconfig 2017-03-02 11:12:05.049448255 -0500
+@@ -0,0 +1,145 @@
+menu "Gentoo Linux"
+
+config GENTOO_LINUX
@@ -114,6 +114,9 @@
+ select BLK_DEV_BSG
+ select CGROUPS
+ select CHECKPOINT_RESTORE
++ select CRYPTO_HMAC
++ select CRYPTO_SHA256
++ select CRYPTO_USER_API_HASH
+ select DEVPTS_MULTIPLE_INSTANCES
+ select DMIID if X86_32 || X86_64 || X86
+ select EPOLL
^ permalink raw reply related [flat|nested] 67+ messages in thread
* [gentoo-commits] proj/linux-patches:3.18 commit in: /
@ 2017-04-18 10:20 Mike Pagano
0 siblings, 0 replies; 67+ messages in thread
From: Mike Pagano @ 2017-04-18 10:20 UTC (permalink / raw
To: gentoo-commits
commit: f209e98096e70700cfc4d98580b2f817781c15b6
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Tue Apr 18 10:20:01 2017 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Tue Apr 18 10:20:01 2017 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=f209e980
Linux patch 3.18.49
0000_README | 4 +
1048_linux-3.18.49.patch | 10446 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 10450 insertions(+)
diff --git a/0000_README b/0000_README
index 4676a64..4c41f0b 100644
--- a/0000_README
+++ b/0000_README
@@ -235,6 +235,10 @@ Patch: 1047_linux-3.18.48.patch
From: http://www.kernel.org
Desc: Linux 3.18.48
+Patch: 1048_linux-3.18.49.patch
+From: http://www.kernel.org
+Desc: Linux 3.18.49
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1048_linux-3.18.49.patch b/1048_linux-3.18.49.patch
new file mode 100644
index 0000000..d923bd5
--- /dev/null
+++ b/1048_linux-3.18.49.patch
@@ -0,0 +1,10446 @@
+diff --git a/Documentation/Makefile b/Documentation/Makefile
+index bc0548201755..fc759598c4c9 100644
+--- a/Documentation/Makefile
++++ b/Documentation/Makefile
+@@ -1,4 +1,4 @@
+ subdir-y := accounting auxdisplay blackfin connector \
+- filesystems filesystems ia64 laptops mic misc-devices \
++ filesystems filesystems ia64 laptops misc-devices \
+ networking pcmcia prctl ptp spi timers vDSO video4linux \
+ watchdog
+diff --git a/Documentation/mic/Makefile b/Documentation/mic/Makefile
+deleted file mode 100644
+index a191d453badf..000000000000
+--- a/Documentation/mic/Makefile
++++ /dev/null
+@@ -1 +0,0 @@
+-subdir-y := mpssd
+diff --git a/Documentation/mic/mpssd/.gitignore b/Documentation/mic/mpssd/.gitignore
+deleted file mode 100644
+index 8b7c72f07c92..000000000000
+--- a/Documentation/mic/mpssd/.gitignore
++++ /dev/null
+@@ -1 +0,0 @@
+-mpssd
+diff --git a/Documentation/mic/mpssd/Makefile b/Documentation/mic/mpssd/Makefile
+deleted file mode 100644
+index 0f3156888048..000000000000
+--- a/Documentation/mic/mpssd/Makefile
++++ /dev/null
+@@ -1,19 +0,0 @@
+-# List of programs to build
+-hostprogs-y := mpssd
+-
+-mpssd-objs := mpssd.o sysfs.o
+-
+-# Tell kbuild to always build the programs
+-always := $(hostprogs-y)
+-
+-HOSTCFLAGS += -I$(objtree)/usr/include -I$(srctree)/tools/include
+-
+-ifdef DEBUG
+-HOSTCFLAGS += -DDEBUG=$(DEBUG)
+-endif
+-
+-HOSTLOADLIBES_mpssd := -lpthread
+-
+-install:
+- install mpssd /usr/sbin/mpssd
+- install micctrl /usr/sbin/micctrl
+diff --git a/Documentation/mic/mpssd/micctrl b/Documentation/mic/mpssd/micctrl
+deleted file mode 100755
+index 8f2629b41c5f..000000000000
+--- a/Documentation/mic/mpssd/micctrl
++++ /dev/null
+@@ -1,173 +0,0 @@
+-#!/bin/bash
+-# Intel MIC Platform Software Stack (MPSS)
+-#
+-# Copyright(c) 2013 Intel Corporation.
+-#
+-# This program is free software; you can redistribute it and/or modify
+-# it under the terms of the GNU General Public License, version 2, as
+-# published by the Free Software Foundation.
+-#
+-# This program is distributed in the hope that it will be useful, but
+-# WITHOUT ANY WARRANTY; without even the implied warranty of
+-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+-# General Public License for more details.
+-#
+-# The full GNU General Public License is included in this distribution in
+-# the file called "COPYING".
+-#
+-# Intel MIC User Space Tools.
+-#
+-# micctrl - Controls MIC boot/start/stop.
+-#
+-# chkconfig: 2345 95 05
+-# description: start MPSS stack processing.
+-#
+-### BEGIN INIT INFO
+-# Provides: micctrl
+-### END INIT INFO
+-
+-# Source function library.
+-. /etc/init.d/functions
+-
+-sysfs="/sys/class/mic"
+-
+-_status()
+-{
+- f=$sysfs/$1
+- echo -e $1 state: "`cat $f/state`" shutdown_status: "`cat $f/shutdown_status`"
+-}
+-
+-status()
+-{
+- if [ "`echo $1 | head -c3`" == "mic" ]; then
+- _status $1
+- return $?
+- fi
+- for f in $sysfs/*
+- do
+- _status `basename $f`
+- RETVAL=$?
+- [ $RETVAL -ne 0 ] && return $RETVAL
+- done
+- return 0
+-}
+-
+-_reset()
+-{
+- f=$sysfs/$1
+- echo reset > $f/state
+-}
+-
+-reset()
+-{
+- if [ "`echo $1 | head -c3`" == "mic" ]; then
+- _reset $1
+- return $?
+- fi
+- for f in $sysfs/*
+- do
+- _reset `basename $f`
+- RETVAL=$?
+- [ $RETVAL -ne 0 ] && return $RETVAL
+- done
+- return 0
+-}
+-
+-_boot()
+-{
+- f=$sysfs/$1
+- echo "linux" > $f/bootmode
+- echo "mic/uos.img" > $f/firmware
+- echo "mic/$1.image" > $f/ramdisk
+- echo "boot" > $f/state
+-}
+-
+-boot()
+-{
+- if [ "`echo $1 | head -c3`" == "mic" ]; then
+- _boot $1
+- return $?
+- fi
+- for f in $sysfs/*
+- do
+- _boot `basename $f`
+- RETVAL=$?
+- [ $RETVAL -ne 0 ] && return $RETVAL
+- done
+- return 0
+-}
+-
+-_shutdown()
+-{
+- f=$sysfs/$1
+- echo shutdown > $f/state
+-}
+-
+-shutdown()
+-{
+- if [ "`echo $1 | head -c3`" == "mic" ]; then
+- _shutdown $1
+- return $?
+- fi
+- for f in $sysfs/*
+- do
+- _shutdown `basename $f`
+- RETVAL=$?
+- [ $RETVAL -ne 0 ] && return $RETVAL
+- done
+- return 0
+-}
+-
+-_wait()
+-{
+- f=$sysfs/$1
+- while [ "`cat $f/state`" != "offline" -a "`cat $f/state`" != "online" ]
+- do
+- sleep 1
+- echo -e "Waiting for $1 to go offline"
+- done
+-}
+-
+-wait()
+-{
+- if [ "`echo $1 | head -c3`" == "mic" ]; then
+- _wait $1
+- return $?
+- fi
+- # Wait for the cards to go offline
+- for f in $sysfs/*
+- do
+- _wait `basename $f`
+- RETVAL=$?
+- [ $RETVAL -ne 0 ] && return $RETVAL
+- done
+- return 0
+-}
+-
+-if [ ! -d "$sysfs" ]; then
+- echo -e $"Module unloaded "
+- exit 3
+-fi
+-
+-case $1 in
+- -s)
+- status $2
+- ;;
+- -r)
+- reset $2
+- ;;
+- -b)
+- boot $2
+- ;;
+- -S)
+- shutdown $2
+- ;;
+- -w)
+- wait $2
+- ;;
+- *)
+- echo $"Usage: $0 {-s (status) |-r (reset) |-b (boot) |-S (shutdown) |-w (wait)}"
+- exit 2
+-esac
+-
+-exit $?
+diff --git a/Documentation/mic/mpssd/mpss b/Documentation/mic/mpssd/mpss
+deleted file mode 100755
+index cacbdb0aefb9..000000000000
+--- a/Documentation/mic/mpssd/mpss
++++ /dev/null
+@@ -1,202 +0,0 @@
+-#!/bin/bash
+-# Intel MIC Platform Software Stack (MPSS)
+-#
+-# Copyright(c) 2013 Intel Corporation.
+-#
+-# This program is free software; you can redistribute it and/or modify
+-# it under the terms of the GNU General Public License, version 2, as
+-# published by the Free Software Foundation.
+-#
+-# This program is distributed in the hope that it will be useful, but
+-# WITHOUT ANY WARRANTY; without even the implied warranty of
+-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+-# General Public License for more details.
+-#
+-# The full GNU General Public License is included in this distribution in
+-# the file called "COPYING".
+-#
+-# Intel MIC User Space Tools.
+-#
+-# mpss Start mpssd.
+-#
+-# chkconfig: 2345 95 05
+-# description: start MPSS stack processing.
+-#
+-### BEGIN INIT INFO
+-# Provides: mpss
+-# Required-Start:
+-# Required-Stop:
+-# Short-Description: MPSS stack control
+-# Description: MPSS stack control
+-### END INIT INFO
+-
+-# Source function library.
+-. /etc/init.d/functions
+-
+-exec=/usr/sbin/mpssd
+-sysfs="/sys/class/mic"
+-
+-start()
+-{
+- [ -x $exec ] || exit 5
+-
+- if [ "`ps -e | awk '{print $4}' | grep mpssd | head -1`" = "mpssd" ]; then
+- echo -e $"MPSSD already running! "
+- success
+- echo
+- return 0
+- fi
+-
+- echo -e $"Starting MPSS Stack"
+- echo -e $"Loading MIC_X100_DMA & MIC_HOST Modules"
+-
+- for f in "mic_host" "mic_x100_dma"
+- do
+- modprobe $f
+- RETVAL=$?
+- if [ $RETVAL -ne 0 ]; then
+- failure
+- echo
+- return $RETVAL
+- fi
+- done
+-
+- # Start the daemon
+- echo -n $"Starting MPSSD "
+- $exec
+- RETVAL=$?
+- if [ $RETVAL -ne 0 ]; then
+- failure
+- echo
+- return $RETVAL
+- fi
+- success
+- echo
+-
+- sleep 5
+-
+- # Boot the cards
+- micctrl -b
+-
+- # Wait till ping works
+- for f in $sysfs/*
+- do
+- count=100
+- ipaddr=`cat $f/cmdline`
+- ipaddr=${ipaddr#*address,}
+- ipaddr=`echo $ipaddr | cut -d, -f1 | cut -d\; -f1`
+- while [ $count -ge 0 ]
+- do
+- echo -e "Pinging "`basename $f`" "
+- ping -c 1 $ipaddr &> /dev/null
+- RETVAL=$?
+- if [ $RETVAL -eq 0 ]; then
+- success
+- break
+- fi
+- sleep 1
+- count=`expr $count - 1`
+- done
+- [ $RETVAL -ne 0 ] && failure || success
+- echo
+- done
+- return $RETVAL
+-}
+-
+-stop()
+-{
+- echo -e $"Shutting down MPSS Stack: "
+-
+- # Bail out if module is unloaded
+- if [ ! -d "$sysfs" ]; then
+- echo -n $"Module unloaded "
+- success
+- echo
+- return 0
+- fi
+-
+- # Shut down the cards.
+- micctrl -S
+-
+- # Wait for the cards to go offline
+- for f in $sysfs/*
+- do
+- while [ "`cat $f/state`" != "offline" ]
+- do
+- sleep 1
+- echo -e "Waiting for "`basename $f`" to go offline"
+- done
+- done
+-
+- # Display the status of the cards
+- micctrl -s
+-
+- # Kill MPSSD now
+- echo -n $"Killing MPSSD"
+- killall -9 mpssd 2>/dev/null
+- RETVAL=$?
+- [ $RETVAL -ne 0 ] && failure || success
+- echo
+- return $RETVAL
+-}
+-
+-restart()
+-{
+- stop
+- sleep 5
+- start
+-}
+-
+-status()
+-{
+- micctrl -s
+- if [ "`ps -e | awk '{print $4}' | grep mpssd | head -n 1`" = "mpssd" ]; then
+- echo "mpssd is running"
+- else
+- echo "mpssd is stopped"
+- fi
+- return 0
+-}
+-
+-unload()
+-{
+- if [ ! -d "$sysfs" ]; then
+- echo -n $"No MIC_HOST Module: "
+- success
+- echo
+- return
+- fi
+-
+- stop
+-
+- sleep 5
+- echo -n $"Removing MIC_HOST & MIC_X100_DMA Modules: "
+- modprobe -r mic_host mic_x100_dma
+- RETVAL=$?
+- [ $RETVAL -ne 0 ] && failure || success
+- echo
+- return $RETVAL
+-}
+-
+-case $1 in
+- start)
+- start
+- ;;
+- stop)
+- stop
+- ;;
+- restart)
+- restart
+- ;;
+- status)
+- status
+- ;;
+- unload)
+- unload
+- ;;
+- *)
+- echo $"Usage: $0 {start|stop|restart|status|unload}"
+- exit 2
+-esac
+-
+-exit $?
+diff --git a/Documentation/mic/mpssd/mpssd.c b/Documentation/mic/mpssd/mpssd.c
+deleted file mode 100644
+index 3c5c379fc29d..000000000000
+--- a/Documentation/mic/mpssd/mpssd.c
++++ /dev/null
+@@ -1,1728 +0,0 @@
+-/*
+- * Intel MIC Platform Software Stack (MPSS)
+- *
+- * Copyright(c) 2013 Intel Corporation.
+- *
+- * This program is free software; you can redistribute it and/or modify
+- * it under the terms of the GNU General Public License, version 2, as
+- * published by the Free Software Foundation.
+- *
+- * This program is distributed in the hope that it will be useful, but
+- * WITHOUT ANY WARRANTY; without even the implied warranty of
+- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+- * General Public License for more details.
+- *
+- * The full GNU General Public License is included in this distribution in
+- * the file called "COPYING".
+- *
+- * Intel MIC User Space Tools.
+- */
+-
+-#define _GNU_SOURCE
+-
+-#include <stdlib.h>
+-#include <fcntl.h>
+-#include <getopt.h>
+-#include <assert.h>
+-#include <unistd.h>
+-#include <stdbool.h>
+-#include <signal.h>
+-#include <poll.h>
+-#include <features.h>
+-#include <sys/types.h>
+-#include <sys/stat.h>
+-#include <sys/mman.h>
+-#include <sys/socket.h>
+-#include <linux/virtio_ring.h>
+-#include <linux/virtio_net.h>
+-#include <linux/virtio_console.h>
+-#include <linux/virtio_blk.h>
+-#include <linux/version.h>
+-#include "mpssd.h"
+-#include <linux/mic_ioctl.h>
+-#include <linux/mic_common.h>
+-#include <tools/endian.h>
+-
+-static void init_mic(struct mic_info *mic);
+-
+-static FILE *logfp;
+-static struct mic_info mic_list;
+-
+-#define ARRAY_SIZE(x) (sizeof(x) / sizeof((x)[0]))
+-
+-#define min_t(type, x, y) ({ \
+- type __min1 = (x); \
+- type __min2 = (y); \
+- __min1 < __min2 ? __min1 : __min2; })
+-
+-/* align addr on a size boundary - adjust address up/down if needed */
+-#define _ALIGN_DOWN(addr, size) ((addr)&(~((size)-1)))
+-#define _ALIGN_UP(addr, size) _ALIGN_DOWN(addr + size - 1, size)
+-
+-/* align addr on a size boundary - adjust address up if needed */
+-#define _ALIGN(addr, size) _ALIGN_UP(addr, size)
+-
+-/* to align the pointer to the (next) page boundary */
+-#define PAGE_ALIGN(addr) _ALIGN(addr, PAGE_SIZE)
+-
+-#define ACCESS_ONCE(x) (*(volatile typeof(x) *)&(x))
+-
+-#define GSO_ENABLED 1
+-#define MAX_GSO_SIZE (64 * 1024)
+-#define ETH_H_LEN 14
+-#define MAX_NET_PKT_SIZE (_ALIGN_UP(MAX_GSO_SIZE + ETH_H_LEN, 64))
+-#define MIC_DEVICE_PAGE_END 0x1000
+-
+-#ifndef VIRTIO_NET_HDR_F_DATA_VALID
+-#define VIRTIO_NET_HDR_F_DATA_VALID 2 /* Csum is valid */
+-#endif
+-
+-static struct {
+- struct mic_device_desc dd;
+- struct mic_vqconfig vqconfig[2];
+- __u32 host_features, guest_acknowledgements;
+- struct virtio_console_config cons_config;
+-} virtcons_dev_page = {
+- .dd = {
+- .type = VIRTIO_ID_CONSOLE,
+- .num_vq = ARRAY_SIZE(virtcons_dev_page.vqconfig),
+- .feature_len = sizeof(virtcons_dev_page.host_features),
+- .config_len = sizeof(virtcons_dev_page.cons_config),
+- },
+- .vqconfig[0] = {
+- .num = htole16(MIC_VRING_ENTRIES),
+- },
+- .vqconfig[1] = {
+- .num = htole16(MIC_VRING_ENTRIES),
+- },
+-};
+-
+-static struct {
+- struct mic_device_desc dd;
+- struct mic_vqconfig vqconfig[2];
+- __u32 host_features, guest_acknowledgements;
+- struct virtio_net_config net_config;
+-} virtnet_dev_page = {
+- .dd = {
+- .type = VIRTIO_ID_NET,
+- .num_vq = ARRAY_SIZE(virtnet_dev_page.vqconfig),
+- .feature_len = sizeof(virtnet_dev_page.host_features),
+- .config_len = sizeof(virtnet_dev_page.net_config),
+- },
+- .vqconfig[0] = {
+- .num = htole16(MIC_VRING_ENTRIES),
+- },
+- .vqconfig[1] = {
+- .num = htole16(MIC_VRING_ENTRIES),
+- },
+-#if GSO_ENABLED
+- .host_features = htole32(
+- 1 << VIRTIO_NET_F_CSUM |
+- 1 << VIRTIO_NET_F_GSO |
+- 1 << VIRTIO_NET_F_GUEST_TSO4 |
+- 1 << VIRTIO_NET_F_GUEST_TSO6 |
+- 1 << VIRTIO_NET_F_GUEST_ECN |
+- 1 << VIRTIO_NET_F_GUEST_UFO),
+-#else
+- .host_features = 0,
+-#endif
+-};
+-
+-static const char *mic_config_dir = "/etc/sysconfig/mic";
+-static const char *virtblk_backend = "VIRTBLK_BACKEND";
+-static struct {
+- struct mic_device_desc dd;
+- struct mic_vqconfig vqconfig[1];
+- __u32 host_features, guest_acknowledgements;
+- struct virtio_blk_config blk_config;
+-} virtblk_dev_page = {
+- .dd = {
+- .type = VIRTIO_ID_BLOCK,
+- .num_vq = ARRAY_SIZE(virtblk_dev_page.vqconfig),
+- .feature_len = sizeof(virtblk_dev_page.host_features),
+- .config_len = sizeof(virtblk_dev_page.blk_config),
+- },
+- .vqconfig[0] = {
+- .num = htole16(MIC_VRING_ENTRIES),
+- },
+- .host_features =
+- htole32(1<<VIRTIO_BLK_F_SEG_MAX),
+- .blk_config = {
+- .seg_max = htole32(MIC_VRING_ENTRIES - 2),
+- .capacity = htole64(0),
+- }
+-};
+-
+-static char *myname;
+-
+-static int
+-tap_configure(struct mic_info *mic, char *dev)
+-{
+- pid_t pid;
+- char *ifargv[7];
+- char ipaddr[IFNAMSIZ];
+- int ret = 0;
+-
+- pid = fork();
+- if (pid == 0) {
+- ifargv[0] = "ip";
+- ifargv[1] = "link";
+- ifargv[2] = "set";
+- ifargv[3] = dev;
+- ifargv[4] = "up";
+- ifargv[5] = NULL;
+- mpsslog("Configuring %s\n", dev);
+- ret = execvp("ip", ifargv);
+- if (ret < 0) {
+- mpsslog("%s execvp failed errno %s\n",
+- mic->name, strerror(errno));
+- return ret;
+- }
+- }
+- if (pid < 0) {
+- mpsslog("%s fork failed errno %s\n",
+- mic->name, strerror(errno));
+- return ret;
+- }
+-
+- ret = waitpid(pid, NULL, 0);
+- if (ret < 0) {
+- mpsslog("%s waitpid failed errno %s\n",
+- mic->name, strerror(errno));
+- return ret;
+- }
+-
+- snprintf(ipaddr, IFNAMSIZ, "172.31.%d.254/24", mic->id);
+-
+- pid = fork();
+- if (pid == 0) {
+- ifargv[0] = "ip";
+- ifargv[1] = "addr";
+- ifargv[2] = "add";
+- ifargv[3] = ipaddr;
+- ifargv[4] = "dev";
+- ifargv[5] = dev;
+- ifargv[6] = NULL;
+- mpsslog("Configuring %s ipaddr %s\n", dev, ipaddr);
+- ret = execvp("ip", ifargv);
+- if (ret < 0) {
+- mpsslog("%s execvp failed errno %s\n",
+- mic->name, strerror(errno));
+- return ret;
+- }
+- }
+- if (pid < 0) {
+- mpsslog("%s fork failed errno %s\n",
+- mic->name, strerror(errno));
+- return ret;
+- }
+-
+- ret = waitpid(pid, NULL, 0);
+- if (ret < 0) {
+- mpsslog("%s waitpid failed errno %s\n",
+- mic->name, strerror(errno));
+- return ret;
+- }
+- mpsslog("MIC name %s %s %d DONE!\n",
+- mic->name, __func__, __LINE__);
+- return 0;
+-}
+-
+-static int tun_alloc(struct mic_info *mic, char *dev)
+-{
+- struct ifreq ifr;
+- int fd, err;
+-#if GSO_ENABLED
+- unsigned offload;
+-#endif
+- fd = open("/dev/net/tun", O_RDWR);
+- if (fd < 0) {
+- mpsslog("Could not open /dev/net/tun %s\n", strerror(errno));
+- goto done;
+- }
+-
+- memset(&ifr, 0, sizeof(ifr));
+-
+- ifr.ifr_flags = IFF_TAP | IFF_NO_PI | IFF_VNET_HDR;
+- if (*dev)
+- strncpy(ifr.ifr_name, dev, IFNAMSIZ);
+-
+- err = ioctl(fd, TUNSETIFF, (void *)&ifr);
+- if (err < 0) {
+- mpsslog("%s %s %d TUNSETIFF failed %s\n",
+- mic->name, __func__, __LINE__, strerror(errno));
+- close(fd);
+- return err;
+- }
+-#if GSO_ENABLED
+- offload = TUN_F_CSUM | TUN_F_TSO4 | TUN_F_TSO6 |
+- TUN_F_TSO_ECN | TUN_F_UFO;
+-
+- err = ioctl(fd, TUNSETOFFLOAD, offload);
+- if (err < 0) {
+- mpsslog("%s %s %d TUNSETOFFLOAD failed %s\n",
+- mic->name, __func__, __LINE__, strerror(errno));
+- close(fd);
+- return err;
+- }
+-#endif
+- strcpy(dev, ifr.ifr_name);
+- mpsslog("Created TAP %s\n", dev);
+-done:
+- return fd;
+-}
+-
+-#define NET_FD_VIRTIO_NET 0
+-#define NET_FD_TUN 1
+-#define MAX_NET_FD 2
+-
+-static void set_dp(struct mic_info *mic, int type, void *dp)
+-{
+- switch (type) {
+- case VIRTIO_ID_CONSOLE:
+- mic->mic_console.console_dp = dp;
+- return;
+- case VIRTIO_ID_NET:
+- mic->mic_net.net_dp = dp;
+- return;
+- case VIRTIO_ID_BLOCK:
+- mic->mic_virtblk.block_dp = dp;
+- return;
+- }
+- mpsslog("%s %s %d not found\n", mic->name, __func__, type);
+- assert(0);
+-}
+-
+-static void *get_dp(struct mic_info *mic, int type)
+-{
+- switch (type) {
+- case VIRTIO_ID_CONSOLE:
+- return mic->mic_console.console_dp;
+- case VIRTIO_ID_NET:
+- return mic->mic_net.net_dp;
+- case VIRTIO_ID_BLOCK:
+- return mic->mic_virtblk.block_dp;
+- }
+- mpsslog("%s %s %d not found\n", mic->name, __func__, type);
+- assert(0);
+- return NULL;
+-}
+-
+-static struct mic_device_desc *get_device_desc(struct mic_info *mic, int type)
+-{
+- struct mic_device_desc *d;
+- int i;
+- void *dp = get_dp(mic, type);
+-
+- for (i = sizeof(struct mic_bootparam); i < PAGE_SIZE;
+- i += mic_total_desc_size(d)) {
+- d = dp + i;
+-
+- /* End of list */
+- if (d->type == 0)
+- break;
+-
+- if (d->type == -1)
+- continue;
+-
+- mpsslog("%s %s d-> type %d d %p\n",
+- mic->name, __func__, d->type, d);
+-
+- if (d->type == (__u8)type)
+- return d;
+- }
+- mpsslog("%s %s %d not found\n", mic->name, __func__, type);
+- assert(0);
+- return NULL;
+-}
+-
+-/* See comments in vhost.c for explanation of next_desc() */
+-static unsigned next_desc(struct vring_desc *desc)
+-{
+- unsigned int next;
+-
+- if (!(le16toh(desc->flags) & VRING_DESC_F_NEXT))
+- return -1U;
+- next = le16toh(desc->next);
+- return next;
+-}
+-
+-/* Sum up all the IOVEC length */
+-static ssize_t
+-sum_iovec_len(struct mic_copy_desc *copy)
+-{
+- ssize_t sum = 0;
+- int i;
+-
+- for (i = 0; i < copy->iovcnt; i++)
+- sum += copy->iov[i].iov_len;
+- return sum;
+-}
+-
+-static inline void verify_out_len(struct mic_info *mic,
+- struct mic_copy_desc *copy)
+-{
+- if (copy->out_len != sum_iovec_len(copy)) {
+- mpsslog("%s %s %d BUG copy->out_len 0x%x len 0x%zx\n",
+- mic->name, __func__, __LINE__,
+- copy->out_len, sum_iovec_len(copy));
+- assert(copy->out_len == sum_iovec_len(copy));
+- }
+-}
+-
+-/* Display an iovec */
+-static void
+-disp_iovec(struct mic_info *mic, struct mic_copy_desc *copy,
+- const char *s, int line)
+-{
+- int i;
+-
+- for (i = 0; i < copy->iovcnt; i++)
+- mpsslog("%s %s %d copy->iov[%d] addr %p len 0x%zx\n",
+- mic->name, s, line, i,
+- copy->iov[i].iov_base, copy->iov[i].iov_len);
+-}
+-
+-static inline __u16 read_avail_idx(struct mic_vring *vr)
+-{
+- return ACCESS_ONCE(vr->info->avail_idx);
+-}
+-
+-static inline void txrx_prepare(int type, bool tx, struct mic_vring *vr,
+- struct mic_copy_desc *copy, ssize_t len)
+-{
+- copy->vr_idx = tx ? 0 : 1;
+- copy->update_used = true;
+- if (type == VIRTIO_ID_NET)
+- copy->iov[1].iov_len = len - sizeof(struct virtio_net_hdr);
+- else
+- copy->iov[0].iov_len = len;
+-}
+-
+-/* Central API which triggers the copies */
+-static int
+-mic_virtio_copy(struct mic_info *mic, int fd,
+- struct mic_vring *vr, struct mic_copy_desc *copy)
+-{
+- int ret;
+-
+- ret = ioctl(fd, MIC_VIRTIO_COPY_DESC, copy);
+- if (ret) {
+- mpsslog("%s %s %d errno %s ret %d\n",
+- mic->name, __func__, __LINE__,
+- strerror(errno), ret);
+- }
+- return ret;
+-}
+-
+-/*
+- * This initialization routine requires at least one
+- * vring i.e. vr0. vr1 is optional.
+- */
+-static void *
+-init_vr(struct mic_info *mic, int fd, int type,
+- struct mic_vring *vr0, struct mic_vring *vr1, int num_vq)
+-{
+- int vr_size;
+- char *va;
+-
+- vr_size = PAGE_ALIGN(vring_size(MIC_VRING_ENTRIES,
+- MIC_VIRTIO_RING_ALIGN) + sizeof(struct _mic_vring_info));
+- va = mmap(NULL, MIC_DEVICE_PAGE_END + vr_size * num_vq,
+- PROT_READ, MAP_SHARED, fd, 0);
+- if (MAP_FAILED == va) {
+- mpsslog("%s %s %d mmap failed errno %s\n",
+- mic->name, __func__, __LINE__,
+- strerror(errno));
+- goto done;
+- }
+- set_dp(mic, type, va);
+- vr0->va = (struct mic_vring *)&va[MIC_DEVICE_PAGE_END];
+- vr0->info = vr0->va +
+- vring_size(MIC_VRING_ENTRIES, MIC_VIRTIO_RING_ALIGN);
+- vring_init(&vr0->vr,
+- MIC_VRING_ENTRIES, vr0->va, MIC_VIRTIO_RING_ALIGN);
+- mpsslog("%s %s vr0 %p vr0->info %p vr_size 0x%x vring 0x%x ",
+- __func__, mic->name, vr0->va, vr0->info, vr_size,
+- vring_size(MIC_VRING_ENTRIES, MIC_VIRTIO_RING_ALIGN));
+- mpsslog("magic 0x%x expected 0x%x\n",
+- le32toh(vr0->info->magic), MIC_MAGIC + type);
+- assert(le32toh(vr0->info->magic) == MIC_MAGIC + type);
+- if (vr1) {
+- vr1->va = (struct mic_vring *)
+- &va[MIC_DEVICE_PAGE_END + vr_size];
+- vr1->info = vr1->va + vring_size(MIC_VRING_ENTRIES,
+- MIC_VIRTIO_RING_ALIGN);
+- vring_init(&vr1->vr,
+- MIC_VRING_ENTRIES, vr1->va, MIC_VIRTIO_RING_ALIGN);
+- mpsslog("%s %s vr1 %p vr1->info %p vr_size 0x%x vring 0x%x ",
+- __func__, mic->name, vr1->va, vr1->info, vr_size,
+- vring_size(MIC_VRING_ENTRIES, MIC_VIRTIO_RING_ALIGN));
+- mpsslog("magic 0x%x expected 0x%x\n",
+- le32toh(vr1->info->magic), MIC_MAGIC + type + 1);
+- assert(le32toh(vr1->info->magic) == MIC_MAGIC + type + 1);
+- }
+-done:
+- return va;
+-}
+-
+-static void
+-wait_for_card_driver(struct mic_info *mic, int fd, int type)
+-{
+- struct pollfd pollfd;
+- int err;
+- struct mic_device_desc *desc = get_device_desc(mic, type);
+-
+- pollfd.fd = fd;
+- mpsslog("%s %s Waiting .... desc-> type %d status 0x%x\n",
+- mic->name, __func__, type, desc->status);
+- while (1) {
+- pollfd.events = POLLIN;
+- pollfd.revents = 0;
+- err = poll(&pollfd, 1, -1);
+- if (err < 0) {
+- mpsslog("%s %s poll failed %s\n",
+- mic->name, __func__, strerror(errno));
+- continue;
+- }
+-
+- if (pollfd.revents) {
+- mpsslog("%s %s Waiting... desc-> type %d status 0x%x\n",
+- mic->name, __func__, type, desc->status);
+- if (desc->status & VIRTIO_CONFIG_S_DRIVER_OK) {
+- mpsslog("%s %s poll.revents %d\n",
+- mic->name, __func__, pollfd.revents);
+- mpsslog("%s %s desc-> type %d status 0x%x\n",
+- mic->name, __func__, type,
+- desc->status);
+- break;
+- }
+- }
+- }
+-}
+-
+-/* Spin till we have some descriptors */
+-static void
+-spin_for_descriptors(struct mic_info *mic, struct mic_vring *vr)
+-{
+- __u16 avail_idx = read_avail_idx(vr);
+-
+- while (avail_idx == le16toh(ACCESS_ONCE(vr->vr.avail->idx))) {
+-#ifdef DEBUG
+- mpsslog("%s %s waiting for desc avail %d info_avail %d\n",
+- mic->name, __func__,
+- le16toh(vr->vr.avail->idx), vr->info->avail_idx);
+-#endif
+- sched_yield();
+- }
+-}
+-
+-static void *
+-virtio_net(void *arg)
+-{
+- static __u8 vnet_hdr[2][sizeof(struct virtio_net_hdr)];
+- static __u8 vnet_buf[2][MAX_NET_PKT_SIZE] __attribute__ ((aligned(64)));
+- struct iovec vnet_iov[2][2] = {
+- { { .iov_base = vnet_hdr[0], .iov_len = sizeof(vnet_hdr[0]) },
+- { .iov_base = vnet_buf[0], .iov_len = sizeof(vnet_buf[0]) } },
+- { { .iov_base = vnet_hdr[1], .iov_len = sizeof(vnet_hdr[1]) },
+- { .iov_base = vnet_buf[1], .iov_len = sizeof(vnet_buf[1]) } },
+- };
+- struct iovec *iov0 = vnet_iov[0], *iov1 = vnet_iov[1];
+- struct mic_info *mic = (struct mic_info *)arg;
+- char if_name[IFNAMSIZ];
+- struct pollfd net_poll[MAX_NET_FD];
+- struct mic_vring tx_vr, rx_vr;
+- struct mic_copy_desc copy;
+- struct mic_device_desc *desc;
+- int err;
+-
+- snprintf(if_name, IFNAMSIZ, "mic%d", mic->id);
+- mic->mic_net.tap_fd = tun_alloc(mic, if_name);
+- if (mic->mic_net.tap_fd < 0)
+- goto done;
+-
+- if (tap_configure(mic, if_name))
+- goto done;
+- mpsslog("MIC name %s id %d\n", mic->name, mic->id);
+-
+- net_poll[NET_FD_VIRTIO_NET].fd = mic->mic_net.virtio_net_fd;
+- net_poll[NET_FD_VIRTIO_NET].events = POLLIN;
+- net_poll[NET_FD_TUN].fd = mic->mic_net.tap_fd;
+- net_poll[NET_FD_TUN].events = POLLIN;
+-
+- if (MAP_FAILED == init_vr(mic, mic->mic_net.virtio_net_fd,
+- VIRTIO_ID_NET, &tx_vr, &rx_vr,
+- virtnet_dev_page.dd.num_vq)) {
+- mpsslog("%s init_vr failed %s\n",
+- mic->name, strerror(errno));
+- goto done;
+- }
+-
+- copy.iovcnt = 2;
+- desc = get_device_desc(mic, VIRTIO_ID_NET);
+-
+- while (1) {
+- ssize_t len;
+-
+- net_poll[NET_FD_VIRTIO_NET].revents = 0;
+- net_poll[NET_FD_TUN].revents = 0;
+-
+- /* Start polling for data from tap and virtio net */
+- err = poll(net_poll, 2, -1);
+- if (err < 0) {
+- mpsslog("%s poll failed %s\n",
+- __func__, strerror(errno));
+- continue;
+- }
+- if (!(desc->status & VIRTIO_CONFIG_S_DRIVER_OK))
+- wait_for_card_driver(mic, mic->mic_net.virtio_net_fd,
+- VIRTIO_ID_NET);
+- /*
+- * Check if there is data to be read from TUN and write to
+- * virtio net fd if there is.
+- */
+- if (net_poll[NET_FD_TUN].revents & POLLIN) {
+- copy.iov = iov0;
+- len = readv(net_poll[NET_FD_TUN].fd,
+- copy.iov, copy.iovcnt);
+- if (len > 0) {
+- struct virtio_net_hdr *hdr
+- = (struct virtio_net_hdr *)vnet_hdr[0];
+-
+- /* Disable checksums on the card since we are on
+- a reliable PCIe link */
+- hdr->flags |= VIRTIO_NET_HDR_F_DATA_VALID;
+-#ifdef DEBUG
+- mpsslog("%s %s %d hdr->flags 0x%x ", mic->name,
+- __func__, __LINE__, hdr->flags);
+- mpsslog("copy.out_len %d hdr->gso_type 0x%x\n",
+- copy.out_len, hdr->gso_type);
+-#endif
+-#ifdef DEBUG
+- disp_iovec(mic, copy, __func__, __LINE__);
+- mpsslog("%s %s %d read from tap 0x%lx\n",
+- mic->name, __func__, __LINE__,
+- len);
+-#endif
+- spin_for_descriptors(mic, &tx_vr);
+- txrx_prepare(VIRTIO_ID_NET, 1, &tx_vr, ©,
+- len);
+-
+- err = mic_virtio_copy(mic,
+- mic->mic_net.virtio_net_fd, &tx_vr,
+- ©);
+- if (err < 0) {
+- mpsslog("%s %s %d mic_virtio_copy %s\n",
+- mic->name, __func__, __LINE__,
+- strerror(errno));
+- }
+- if (!err)
+- verify_out_len(mic, ©);
+-#ifdef DEBUG
+- disp_iovec(mic, copy, __func__, __LINE__);
+- mpsslog("%s %s %d wrote to net 0x%lx\n",
+- mic->name, __func__, __LINE__,
+- sum_iovec_len(©));
+-#endif
+- /* Reinitialize IOV for next run */
+- iov0[1].iov_len = MAX_NET_PKT_SIZE;
+- } else if (len < 0) {
+- disp_iovec(mic, ©, __func__, __LINE__);
+- mpsslog("%s %s %d read failed %s ", mic->name,
+- __func__, __LINE__, strerror(errno));
+- mpsslog("cnt %d sum %zd\n",
+- copy.iovcnt, sum_iovec_len(©));
+- }
+- }
+-
+- /*
+- * Check if there is data to be read from virtio net and
+- * write to TUN if there is.
+- */
+- if (net_poll[NET_FD_VIRTIO_NET].revents & POLLIN) {
+- while (rx_vr.info->avail_idx !=
+- le16toh(rx_vr.vr.avail->idx)) {
+- copy.iov = iov1;
+- txrx_prepare(VIRTIO_ID_NET, 0, &rx_vr, ©,
+- MAX_NET_PKT_SIZE
+- + sizeof(struct virtio_net_hdr));
+-
+- err = mic_virtio_copy(mic,
+- mic->mic_net.virtio_net_fd, &rx_vr,
+- ©);
+- if (!err) {
+-#ifdef DEBUG
+- struct virtio_net_hdr *hdr
+- = (struct virtio_net_hdr *)
+- vnet_hdr[1];
+-
+- mpsslog("%s %s %d hdr->flags 0x%x, ",
+- mic->name, __func__, __LINE__,
+- hdr->flags);
+- mpsslog("out_len %d gso_type 0x%x\n",
+- copy.out_len,
+- hdr->gso_type);
+-#endif
+- /* Set the correct output iov_len */
+- iov1[1].iov_len = copy.out_len -
+- sizeof(struct virtio_net_hdr);
+- verify_out_len(mic, ©);
+-#ifdef DEBUG
+- disp_iovec(mic, copy, __func__,
+- __LINE__);
+- mpsslog("%s %s %d ",
+- mic->name, __func__, __LINE__);
+- mpsslog("read from net 0x%lx\n",
+- sum_iovec_len(copy));
+-#endif
+- len = writev(net_poll[NET_FD_TUN].fd,
+- copy.iov, copy.iovcnt);
+- if (len != sum_iovec_len(©)) {
+- mpsslog("Tun write failed %s ",
+- strerror(errno));
+- mpsslog("len 0x%zx ", len);
+- mpsslog("read_len 0x%zx\n",
+- sum_iovec_len(©));
+- } else {
+-#ifdef DEBUG
+- disp_iovec(mic, ©, __func__,
+- __LINE__);
+- mpsslog("%s %s %d ",
+- mic->name, __func__,
+- __LINE__);
+- mpsslog("wrote to tap 0x%lx\n",
+- len);
+-#endif
+- }
+- } else {
+- mpsslog("%s %s %d mic_virtio_copy %s\n",
+- mic->name, __func__, __LINE__,
+- strerror(errno));
+- break;
+- }
+- }
+- }
+- if (net_poll[NET_FD_VIRTIO_NET].revents & POLLERR)
+- mpsslog("%s: %s: POLLERR\n", __func__, mic->name);
+- }
+-done:
+- pthread_exit(NULL);
+-}
+-
+-/* virtio_console */
+-#define VIRTIO_CONSOLE_FD 0
+-#define MONITOR_FD (VIRTIO_CONSOLE_FD + 1)
+-#define MAX_CONSOLE_FD (MONITOR_FD + 1) /* must be the last one + 1 */
+-#define MAX_BUFFER_SIZE PAGE_SIZE
+-
+-static void *
+-virtio_console(void *arg)
+-{
+- static __u8 vcons_buf[2][PAGE_SIZE];
+- struct iovec vcons_iov[2] = {
+- { .iov_base = vcons_buf[0], .iov_len = sizeof(vcons_buf[0]) },
+- { .iov_base = vcons_buf[1], .iov_len = sizeof(vcons_buf[1]) },
+- };
+- struct iovec *iov0 = &vcons_iov[0], *iov1 = &vcons_iov[1];
+- struct mic_info *mic = (struct mic_info *)arg;
+- int err;
+- struct pollfd console_poll[MAX_CONSOLE_FD];
+- int pty_fd;
+- char *pts_name;
+- ssize_t len;
+- struct mic_vring tx_vr, rx_vr;
+- struct mic_copy_desc copy;
+- struct mic_device_desc *desc;
+-
+- pty_fd = posix_openpt(O_RDWR);
+- if (pty_fd < 0) {
+- mpsslog("can't open a pseudoterminal master device: %s\n",
+- strerror(errno));
+- goto _return;
+- }
+- pts_name = ptsname(pty_fd);
+- if (pts_name == NULL) {
+- mpsslog("can't get pts name\n");
+- goto _close_pty;
+- }
+- printf("%s console message goes to %s\n", mic->name, pts_name);
+- mpsslog("%s console message goes to %s\n", mic->name, pts_name);
+- err = grantpt(pty_fd);
+- if (err < 0) {
+- mpsslog("can't grant access: %s %s\n",
+- pts_name, strerror(errno));
+- goto _close_pty;
+- }
+- err = unlockpt(pty_fd);
+- if (err < 0) {
+- mpsslog("can't unlock a pseudoterminal: %s %s\n",
+- pts_name, strerror(errno));
+- goto _close_pty;
+- }
+- console_poll[MONITOR_FD].fd = pty_fd;
+- console_poll[MONITOR_FD].events = POLLIN;
+-
+- console_poll[VIRTIO_CONSOLE_FD].fd = mic->mic_console.virtio_console_fd;
+- console_poll[VIRTIO_CONSOLE_FD].events = POLLIN;
+-
+- if (MAP_FAILED == init_vr(mic, mic->mic_console.virtio_console_fd,
+- VIRTIO_ID_CONSOLE, &tx_vr, &rx_vr,
+- virtcons_dev_page.dd.num_vq)) {
+- mpsslog("%s init_vr failed %s\n",
+- mic->name, strerror(errno));
+- goto _close_pty;
+- }
+-
+- copy.iovcnt = 1;
+- desc = get_device_desc(mic, VIRTIO_ID_CONSOLE);
+-
+- for (;;) {
+- console_poll[MONITOR_FD].revents = 0;
+- console_poll[VIRTIO_CONSOLE_FD].revents = 0;
+- err = poll(console_poll, MAX_CONSOLE_FD, -1);
+- if (err < 0) {
+- mpsslog("%s %d: poll failed: %s\n", __func__, __LINE__,
+- strerror(errno));
+- continue;
+- }
+- if (!(desc->status & VIRTIO_CONFIG_S_DRIVER_OK))
+- wait_for_card_driver(mic,
+- mic->mic_console.virtio_console_fd,
+- VIRTIO_ID_CONSOLE);
+-
+- if (console_poll[MONITOR_FD].revents & POLLIN) {
+- copy.iov = iov0;
+- len = readv(pty_fd, copy.iov, copy.iovcnt);
+- if (len > 0) {
+-#ifdef DEBUG
+- disp_iovec(mic, copy, __func__, __LINE__);
+- mpsslog("%s %s %d read from tap 0x%lx\n",
+- mic->name, __func__, __LINE__,
+- len);
+-#endif
+- spin_for_descriptors(mic, &tx_vr);
+- txrx_prepare(VIRTIO_ID_CONSOLE, 1, &tx_vr,
+- ©, len);
+-
+- err = mic_virtio_copy(mic,
+- mic->mic_console.virtio_console_fd,
+- &tx_vr, ©);
+- if (err < 0) {
+- mpsslog("%s %s %d mic_virtio_copy %s\n",
+- mic->name, __func__, __LINE__,
+- strerror(errno));
+- }
+- if (!err)
+- verify_out_len(mic, ©);
+-#ifdef DEBUG
+- disp_iovec(mic, copy, __func__, __LINE__);
+- mpsslog("%s %s %d wrote to net 0x%lx\n",
+- mic->name, __func__, __LINE__,
+- sum_iovec_len(copy));
+-#endif
+- /* Reinitialize IOV for next run */
+- iov0->iov_len = PAGE_SIZE;
+- } else if (len < 0) {
+- disp_iovec(mic, ©, __func__, __LINE__);
+- mpsslog("%s %s %d read failed %s ",
+- mic->name, __func__, __LINE__,
+- strerror(errno));
+- mpsslog("cnt %d sum %zd\n",
+- copy.iovcnt, sum_iovec_len(©));
+- }
+- }
+-
+- if (console_poll[VIRTIO_CONSOLE_FD].revents & POLLIN) {
+- while (rx_vr.info->avail_idx !=
+- le16toh(rx_vr.vr.avail->idx)) {
+- copy.iov = iov1;
+- txrx_prepare(VIRTIO_ID_CONSOLE, 0, &rx_vr,
+- ©, PAGE_SIZE);
+-
+- err = mic_virtio_copy(mic,
+- mic->mic_console.virtio_console_fd,
+- &rx_vr, ©);
+- if (!err) {
+- /* Set the correct output iov_len */
+- iov1->iov_len = copy.out_len;
+- verify_out_len(mic, ©);
+-#ifdef DEBUG
+- disp_iovec(mic, copy, __func__,
+- __LINE__);
+- mpsslog("%s %s %d ",
+- mic->name, __func__, __LINE__);
+- mpsslog("read from net 0x%lx\n",
+- sum_iovec_len(copy));
+-#endif
+- len = writev(pty_fd,
+- copy.iov, copy.iovcnt);
+- if (len != sum_iovec_len(©)) {
+- mpsslog("Tun write failed %s ",
+- strerror(errno));
+- mpsslog("len 0x%zx ", len);
+- mpsslog("read_len 0x%zx\n",
+- sum_iovec_len(©));
+- } else {
+-#ifdef DEBUG
+- disp_iovec(mic, copy, __func__,
+- __LINE__);
+- mpsslog("%s %s %d ",
+- mic->name, __func__,
+- __LINE__);
+- mpsslog("wrote to tap 0x%lx\n",
+- len);
+-#endif
+- }
+- } else {
+- mpsslog("%s %s %d mic_virtio_copy %s\n",
+- mic->name, __func__, __LINE__,
+- strerror(errno));
+- break;
+- }
+- }
+- }
+- if (console_poll[NET_FD_VIRTIO_NET].revents & POLLERR)
+- mpsslog("%s: %s: POLLERR\n", __func__, mic->name);
+- }
+-_close_pty:
+- close(pty_fd);
+-_return:
+- pthread_exit(NULL);
+-}
+-
+-static void
+-add_virtio_device(struct mic_info *mic, struct mic_device_desc *dd)
+-{
+- char path[PATH_MAX];
+- int fd, err;
+-
+- snprintf(path, PATH_MAX, "/dev/mic%d", mic->id);
+- fd = open(path, O_RDWR);
+- if (fd < 0) {
+- mpsslog("Could not open %s %s\n", path, strerror(errno));
+- return;
+- }
+-
+- err = ioctl(fd, MIC_VIRTIO_ADD_DEVICE, dd);
+- if (err < 0) {
+- mpsslog("Could not add %d %s\n", dd->type, strerror(errno));
+- close(fd);
+- return;
+- }
+- switch (dd->type) {
+- case VIRTIO_ID_NET:
+- mic->mic_net.virtio_net_fd = fd;
+- mpsslog("Added VIRTIO_ID_NET for %s\n", mic->name);
+- break;
+- case VIRTIO_ID_CONSOLE:
+- mic->mic_console.virtio_console_fd = fd;
+- mpsslog("Added VIRTIO_ID_CONSOLE for %s\n", mic->name);
+- break;
+- case VIRTIO_ID_BLOCK:
+- mic->mic_virtblk.virtio_block_fd = fd;
+- mpsslog("Added VIRTIO_ID_BLOCK for %s\n", mic->name);
+- break;
+- }
+-}
+-
+-static bool
+-set_backend_file(struct mic_info *mic)
+-{
+- FILE *config;
+- char buff[PATH_MAX], *line, *evv, *p;
+-
+- snprintf(buff, PATH_MAX, "%s/mpssd%03d.conf", mic_config_dir, mic->id);
+- config = fopen(buff, "r");
+- if (config == NULL)
+- return false;
+- do { /* look for "virtblk_backend=XXXX" */
+- line = fgets(buff, PATH_MAX, config);
+- if (line == NULL)
+- break;
+- if (*line == '#')
+- continue;
+- p = strchr(line, '\n');
+- if (p)
+- *p = '\0';
+- } while (strncmp(line, virtblk_backend, strlen(virtblk_backend)) != 0);
+- fclose(config);
+- if (line == NULL)
+- return false;
+- evv = strchr(line, '=');
+- if (evv == NULL)
+- return false;
+- mic->mic_virtblk.backend_file = malloc(strlen(evv) + 1);
+- if (mic->mic_virtblk.backend_file == NULL) {
+- mpsslog("%s %d can't allocate memory\n", mic->name, mic->id);
+- return false;
+- }
+- strcpy(mic->mic_virtblk.backend_file, evv + 1);
+- return true;
+-}
+-
+-#define SECTOR_SIZE 512
+-static bool
+-set_backend_size(struct mic_info *mic)
+-{
+- mic->mic_virtblk.backend_size = lseek(mic->mic_virtblk.backend, 0,
+- SEEK_END);
+- if (mic->mic_virtblk.backend_size < 0) {
+- mpsslog("%s: can't seek: %s\n",
+- mic->name, mic->mic_virtblk.backend_file);
+- return false;
+- }
+- virtblk_dev_page.blk_config.capacity =
+- mic->mic_virtblk.backend_size / SECTOR_SIZE;
+- if ((mic->mic_virtblk.backend_size % SECTOR_SIZE) != 0)
+- virtblk_dev_page.blk_config.capacity++;
+-
+- virtblk_dev_page.blk_config.capacity =
+- htole64(virtblk_dev_page.blk_config.capacity);
+-
+- return true;
+-}
+-
+-static bool
+-open_backend(struct mic_info *mic)
+-{
+- if (!set_backend_file(mic))
+- goto _error_exit;
+- mic->mic_virtblk.backend = open(mic->mic_virtblk.backend_file, O_RDWR);
+- if (mic->mic_virtblk.backend < 0) {
+- mpsslog("%s: can't open: %s\n", mic->name,
+- mic->mic_virtblk.backend_file);
+- goto _error_free;
+- }
+- if (!set_backend_size(mic))
+- goto _error_close;
+- mic->mic_virtblk.backend_addr = mmap(NULL,
+- mic->mic_virtblk.backend_size,
+- PROT_READ|PROT_WRITE, MAP_SHARED,
+- mic->mic_virtblk.backend, 0L);
+- if (mic->mic_virtblk.backend_addr == MAP_FAILED) {
+- mpsslog("%s: can't map: %s %s\n",
+- mic->name, mic->mic_virtblk.backend_file,
+- strerror(errno));
+- goto _error_close;
+- }
+- return true;
+-
+- _error_close:
+- close(mic->mic_virtblk.backend);
+- _error_free:
+- free(mic->mic_virtblk.backend_file);
+- _error_exit:
+- return false;
+-}
+-
+-static void
+-close_backend(struct mic_info *mic)
+-{
+- munmap(mic->mic_virtblk.backend_addr, mic->mic_virtblk.backend_size);
+- close(mic->mic_virtblk.backend);
+- free(mic->mic_virtblk.backend_file);
+-}
+-
+-static bool
+-start_virtblk(struct mic_info *mic, struct mic_vring *vring)
+-{
+- if (((unsigned long)&virtblk_dev_page.blk_config % 8) != 0) {
+- mpsslog("%s: blk_config is not 8 byte aligned.\n",
+- mic->name);
+- return false;
+- }
+- add_virtio_device(mic, &virtblk_dev_page.dd);
+- if (MAP_FAILED == init_vr(mic, mic->mic_virtblk.virtio_block_fd,
+- VIRTIO_ID_BLOCK, vring, NULL,
+- virtblk_dev_page.dd.num_vq)) {
+- mpsslog("%s init_vr failed %s\n",
+- mic->name, strerror(errno));
+- return false;
+- }
+- return true;
+-}
+-
+-static void
+-stop_virtblk(struct mic_info *mic)
+-{
+- int vr_size, ret;
+-
+- vr_size = PAGE_ALIGN(vring_size(MIC_VRING_ENTRIES,
+- MIC_VIRTIO_RING_ALIGN) + sizeof(struct _mic_vring_info));
+- ret = munmap(mic->mic_virtblk.block_dp,
+- MIC_DEVICE_PAGE_END + vr_size * virtblk_dev_page.dd.num_vq);
+- if (ret < 0)
+- mpsslog("%s munmap errno %d\n", mic->name, errno);
+- close(mic->mic_virtblk.virtio_block_fd);
+-}
+-
+-static __u8
+-header_error_check(struct vring_desc *desc)
+-{
+- if (le32toh(desc->len) != sizeof(struct virtio_blk_outhdr)) {
+- mpsslog("%s() %d: length is not sizeof(virtio_blk_outhd)\n",
+- __func__, __LINE__);
+- return -EIO;
+- }
+- if (!(le16toh(desc->flags) & VRING_DESC_F_NEXT)) {
+- mpsslog("%s() %d: alone\n",
+- __func__, __LINE__);
+- return -EIO;
+- }
+- if (le16toh(desc->flags) & VRING_DESC_F_WRITE) {
+- mpsslog("%s() %d: not read\n",
+- __func__, __LINE__);
+- return -EIO;
+- }
+- return 0;
+-}
+-
+-static int
+-read_header(int fd, struct virtio_blk_outhdr *hdr, __u32 desc_idx)
+-{
+- struct iovec iovec;
+- struct mic_copy_desc copy;
+-
+- iovec.iov_len = sizeof(*hdr);
+- iovec.iov_base = hdr;
+- copy.iov = &iovec;
+- copy.iovcnt = 1;
+- copy.vr_idx = 0; /* only one vring on virtio_block */
+- copy.update_used = false; /* do not update used index */
+- return ioctl(fd, MIC_VIRTIO_COPY_DESC, ©);
+-}
+-
+-static int
+-transfer_blocks(int fd, struct iovec *iovec, __u32 iovcnt)
+-{
+- struct mic_copy_desc copy;
+-
+- copy.iov = iovec;
+- copy.iovcnt = iovcnt;
+- copy.vr_idx = 0; /* only one vring on virtio_block */
+- copy.update_used = false; /* do not update used index */
+- return ioctl(fd, MIC_VIRTIO_COPY_DESC, ©);
+-}
+-
+-static __u8
+-status_error_check(struct vring_desc *desc)
+-{
+- if (le32toh(desc->len) != sizeof(__u8)) {
+- mpsslog("%s() %d: length is not sizeof(status)\n",
+- __func__, __LINE__);
+- return -EIO;
+- }
+- return 0;
+-}
+-
+-static int
+-write_status(int fd, __u8 *status)
+-{
+- struct iovec iovec;
+- struct mic_copy_desc copy;
+-
+- iovec.iov_base = status;
+- iovec.iov_len = sizeof(*status);
+- copy.iov = &iovec;
+- copy.iovcnt = 1;
+- copy.vr_idx = 0; /* only one vring on virtio_block */
+- copy.update_used = true; /* Update used index */
+- return ioctl(fd, MIC_VIRTIO_COPY_DESC, ©);
+-}
+-
+-static void *
+-virtio_block(void *arg)
+-{
+- struct mic_info *mic = (struct mic_info *)arg;
+- int ret;
+- struct pollfd block_poll;
+- struct mic_vring vring;
+- __u16 avail_idx;
+- __u32 desc_idx;
+- struct vring_desc *desc;
+- struct iovec *iovec, *piov;
+- __u8 status;
+- __u32 buffer_desc_idx;
+- struct virtio_blk_outhdr hdr;
+- void *fos;
+-
+- for (;;) { /* forever */
+- if (!open_backend(mic)) { /* No virtblk */
+- for (mic->mic_virtblk.signaled = 0;
+- !mic->mic_virtblk.signaled;)
+- sleep(1);
+- continue;
+- }
+-
+- /* backend file is specified. */
+- if (!start_virtblk(mic, &vring))
+- goto _close_backend;
+- iovec = malloc(sizeof(*iovec) *
+- le32toh(virtblk_dev_page.blk_config.seg_max));
+- if (!iovec) {
+- mpsslog("%s: can't alloc iovec: %s\n",
+- mic->name, strerror(ENOMEM));
+- goto _stop_virtblk;
+- }
+-
+- block_poll.fd = mic->mic_virtblk.virtio_block_fd;
+- block_poll.events = POLLIN;
+- for (mic->mic_virtblk.signaled = 0;
+- !mic->mic_virtblk.signaled;) {
+- block_poll.revents = 0;
+- /* timeout in 1 sec to see signaled */
+- ret = poll(&block_poll, 1, 1000);
+- if (ret < 0) {
+- mpsslog("%s %d: poll failed: %s\n",
+- __func__, __LINE__,
+- strerror(errno));
+- continue;
+- }
+-
+- if (!(block_poll.revents & POLLIN)) {
+-#ifdef DEBUG
+- mpsslog("%s %d: block_poll.revents=0x%x\n",
+- __func__, __LINE__, block_poll.revents);
+-#endif
+- continue;
+- }
+-
+- /* POLLIN */
+- while (vring.info->avail_idx !=
+- le16toh(vring.vr.avail->idx)) {
+- /* read header element */
+- avail_idx =
+- vring.info->avail_idx &
+- (vring.vr.num - 1);
+- desc_idx = le16toh(
+- vring.vr.avail->ring[avail_idx]);
+- desc = &vring.vr.desc[desc_idx];
+-#ifdef DEBUG
+- mpsslog("%s() %d: avail_idx=%d ",
+- __func__, __LINE__,
+- vring.info->avail_idx);
+- mpsslog("vring.vr.num=%d desc=%p\n",
+- vring.vr.num, desc);
+-#endif
+- status = header_error_check(desc);
+- ret = read_header(
+- mic->mic_virtblk.virtio_block_fd,
+- &hdr, desc_idx);
+- if (ret < 0) {
+- mpsslog("%s() %d %s: ret=%d %s\n",
+- __func__, __LINE__,
+- mic->name, ret,
+- strerror(errno));
+- break;
+- }
+- /* buffer element */
+- piov = iovec;
+- status = 0;
+- fos = mic->mic_virtblk.backend_addr +
+- (hdr.sector * SECTOR_SIZE);
+- buffer_desc_idx = next_desc(desc);
+- desc_idx = buffer_desc_idx;
+- for (desc = &vring.vr.desc[buffer_desc_idx];
+- desc->flags & VRING_DESC_F_NEXT;
+- desc_idx = next_desc(desc),
+- desc = &vring.vr.desc[desc_idx]) {
+- piov->iov_len = desc->len;
+- piov->iov_base = fos;
+- piov++;
+- fos += desc->len;
+- }
+- /* Returning NULLs for VIRTIO_BLK_T_GET_ID. */
+- if (hdr.type & ~(VIRTIO_BLK_T_OUT |
+- VIRTIO_BLK_T_GET_ID)) {
+- /*
+- VIRTIO_BLK_T_IN - does not do
+- anything. Probably for documenting.
+- VIRTIO_BLK_T_SCSI_CMD - for
+- virtio_scsi.
+- VIRTIO_BLK_T_FLUSH - turned off in
+- config space.
+- VIRTIO_BLK_T_BARRIER - defined but not
+- used in anywhere.
+- */
+- mpsslog("%s() %d: type %x ",
+- __func__, __LINE__,
+- hdr.type);
+- mpsslog("is not supported\n");
+- status = -ENOTSUP;
+-
+- } else {
+- ret = transfer_blocks(
+- mic->mic_virtblk.virtio_block_fd,
+- iovec,
+- piov - iovec);
+- if (ret < 0 &&
+- status != 0)
+- status = ret;
+- }
+- /* write status and update used pointer */
+- if (status != 0)
+- status = status_error_check(desc);
+- ret = write_status(
+- mic->mic_virtblk.virtio_block_fd,
+- &status);
+-#ifdef DEBUG
+- mpsslog("%s() %d: write status=%d on desc=%p\n",
+- __func__, __LINE__,
+- status, desc);
+-#endif
+- }
+- }
+- free(iovec);
+-_stop_virtblk:
+- stop_virtblk(mic);
+-_close_backend:
+- close_backend(mic);
+- } /* forever */
+-
+- pthread_exit(NULL);
+-}
+-
+-static void
+-reset(struct mic_info *mic)
+-{
+-#define RESET_TIMEOUT 120
+- int i = RESET_TIMEOUT;
+- setsysfs(mic->name, "state", "reset");
+- while (i) {
+- char *state;
+- state = readsysfs(mic->name, "state");
+- if (!state)
+- goto retry;
+- mpsslog("%s: %s %d state %s\n",
+- mic->name, __func__, __LINE__, state);
+-
+- /*
+- * If the shutdown was initiated by OSPM, the state stays
+- * in "suspended" which is also a valid condition for reset.
+- */
+- if ((!strcmp(state, "offline")) ||
+- (!strcmp(state, "suspended"))) {
+- free(state);
+- break;
+- }
+- free(state);
+-retry:
+- sleep(1);
+- i--;
+- }
+-}
+-
+-static int
+-get_mic_shutdown_status(struct mic_info *mic, char *shutdown_status)
+-{
+- if (!strcmp(shutdown_status, "nop"))
+- return MIC_NOP;
+- if (!strcmp(shutdown_status, "crashed"))
+- return MIC_CRASHED;
+- if (!strcmp(shutdown_status, "halted"))
+- return MIC_HALTED;
+- if (!strcmp(shutdown_status, "poweroff"))
+- return MIC_POWER_OFF;
+- if (!strcmp(shutdown_status, "restart"))
+- return MIC_RESTART;
+- mpsslog("%s: BUG invalid status %s\n", mic->name, shutdown_status);
+- /* Invalid state */
+- assert(0);
+-};
+-
+-static int get_mic_state(struct mic_info *mic, char *state)
+-{
+- if (!strcmp(state, "offline"))
+- return MIC_OFFLINE;
+- if (!strcmp(state, "online"))
+- return MIC_ONLINE;
+- if (!strcmp(state, "shutting_down"))
+- return MIC_SHUTTING_DOWN;
+- if (!strcmp(state, "reset_failed"))
+- return MIC_RESET_FAILED;
+- if (!strcmp(state, "suspending"))
+- return MIC_SUSPENDING;
+- if (!strcmp(state, "suspended"))
+- return MIC_SUSPENDED;
+- mpsslog("%s: BUG invalid state %s\n", mic->name, state);
+- /* Invalid state */
+- assert(0);
+-};
+-
+-static void mic_handle_shutdown(struct mic_info *mic)
+-{
+-#define SHUTDOWN_TIMEOUT 60
+- int i = SHUTDOWN_TIMEOUT, ret, stat = 0;
+- char *shutdown_status;
+- while (i) {
+- shutdown_status = readsysfs(mic->name, "shutdown_status");
+- if (!shutdown_status)
+- continue;
+- mpsslog("%s: %s %d shutdown_status %s\n",
+- mic->name, __func__, __LINE__, shutdown_status);
+- switch (get_mic_shutdown_status(mic, shutdown_status)) {
+- case MIC_RESTART:
+- mic->restart = 1;
+- case MIC_HALTED:
+- case MIC_POWER_OFF:
+- case MIC_CRASHED:
+- free(shutdown_status);
+- goto reset;
+- default:
+- break;
+- }
+- free(shutdown_status);
+- sleep(1);
+- i--;
+- }
+-reset:
+- ret = kill(mic->pid, SIGTERM);
+- mpsslog("%s: %s %d kill pid %d ret %d\n",
+- mic->name, __func__, __LINE__,
+- mic->pid, ret);
+- if (!ret) {
+- ret = waitpid(mic->pid, &stat,
+- WIFSIGNALED(stat));
+- mpsslog("%s: %s %d waitpid ret %d pid %d\n",
+- mic->name, __func__, __LINE__,
+- ret, mic->pid);
+- }
+- if (ret == mic->pid)
+- reset(mic);
+-}
+-
+-static void *
+-mic_config(void *arg)
+-{
+- struct mic_info *mic = (struct mic_info *)arg;
+- char *state = NULL;
+- char pathname[PATH_MAX];
+- int fd, ret;
+- struct pollfd ufds[1];
+- char value[4096];
+-
+- snprintf(pathname, PATH_MAX - 1, "%s/%s/%s",
+- MICSYSFSDIR, mic->name, "state");
+-
+- fd = open(pathname, O_RDONLY);
+- if (fd < 0) {
+- mpsslog("%s: opening file %s failed %s\n",
+- mic->name, pathname, strerror(errno));
+- goto error;
+- }
+-
+- do {
+- ret = lseek(fd, 0, SEEK_SET);
+- if (ret < 0) {
+- mpsslog("%s: Failed to seek to file start '%s': %s\n",
+- mic->name, pathname, strerror(errno));
+- goto close_error1;
+- }
+- ret = read(fd, value, sizeof(value));
+- if (ret < 0) {
+- mpsslog("%s: Failed to read sysfs entry '%s': %s\n",
+- mic->name, pathname, strerror(errno));
+- goto close_error1;
+- }
+-retry:
+- state = readsysfs(mic->name, "state");
+- if (!state)
+- goto retry;
+- mpsslog("%s: %s %d state %s\n",
+- mic->name, __func__, __LINE__, state);
+- switch (get_mic_state(mic, state)) {
+- case MIC_SHUTTING_DOWN:
+- mic_handle_shutdown(mic);
+- goto close_error;
+- case MIC_SUSPENDING:
+- mic->boot_on_resume = 1;
+- setsysfs(mic->name, "state", "suspend");
+- mic_handle_shutdown(mic);
+- goto close_error;
+- case MIC_OFFLINE:
+- if (mic->boot_on_resume) {
+- setsysfs(mic->name, "state", "boot");
+- mic->boot_on_resume = 0;
+- }
+- break;
+- default:
+- break;
+- }
+- free(state);
+-
+- ufds[0].fd = fd;
+- ufds[0].events = POLLERR | POLLPRI;
+- ret = poll(ufds, 1, -1);
+- if (ret < 0) {
+- mpsslog("%s: poll failed %s\n",
+- mic->name, strerror(errno));
+- goto close_error1;
+- }
+- } while (1);
+-close_error:
+- free(state);
+-close_error1:
+- close(fd);
+-error:
+- init_mic(mic);
+- pthread_exit(NULL);
+-}
+-
+-static void
+-set_cmdline(struct mic_info *mic)
+-{
+- char buffer[PATH_MAX];
+- int len;
+-
+- len = snprintf(buffer, PATH_MAX,
+- "clocksource=tsc highres=off nohz=off ");
+- len += snprintf(buffer + len, PATH_MAX - len,
+- "cpufreq_on;corec6_off;pc3_off;pc6_off ");
+- len += snprintf(buffer + len, PATH_MAX - len,
+- "ifcfg=static;address,172.31.%d.1;netmask,255.255.255.0",
+- mic->id);
+-
+- setsysfs(mic->name, "cmdline", buffer);
+- mpsslog("%s: Command line: \"%s\"\n", mic->name, buffer);
+- snprintf(buffer, PATH_MAX, "172.31.%d.1", mic->id);
+- mpsslog("%s: IPADDR: \"%s\"\n", mic->name, buffer);
+-}
+-
+-static void
+-set_log_buf_info(struct mic_info *mic)
+-{
+- int fd;
+- off_t len;
+- char system_map[] = "/lib/firmware/mic/System.map";
+- char *map, *temp, log_buf[17] = {'\0'};
+-
+- fd = open(system_map, O_RDONLY);
+- if (fd < 0) {
+- mpsslog("%s: Opening System.map failed: %d\n",
+- mic->name, errno);
+- return;
+- }
+- len = lseek(fd, 0, SEEK_END);
+- if (len < 0) {
+- mpsslog("%s: Reading System.map size failed: %d\n",
+- mic->name, errno);
+- close(fd);
+- return;
+- }
+- map = mmap(NULL, len, PROT_READ, MAP_PRIVATE, fd, 0);
+- if (map == MAP_FAILED) {
+- mpsslog("%s: mmap of System.map failed: %d\n",
+- mic->name, errno);
+- close(fd);
+- return;
+- }
+- temp = strstr(map, "__log_buf");
+- if (!temp) {
+- mpsslog("%s: __log_buf not found: %d\n", mic->name, errno);
+- munmap(map, len);
+- close(fd);
+- return;
+- }
+- strncpy(log_buf, temp - 19, 16);
+- setsysfs(mic->name, "log_buf_addr", log_buf);
+- mpsslog("%s: log_buf_addr: %s\n", mic->name, log_buf);
+- temp = strstr(map, "log_buf_len");
+- if (!temp) {
+- mpsslog("%s: log_buf_len not found: %d\n", mic->name, errno);
+- munmap(map, len);
+- close(fd);
+- return;
+- }
+- strncpy(log_buf, temp - 19, 16);
+- setsysfs(mic->name, "log_buf_len", log_buf);
+- mpsslog("%s: log_buf_len: %s\n", mic->name, log_buf);
+- munmap(map, len);
+- close(fd);
+-}
+-
+-static void init_mic(struct mic_info *mic);
+-
+-static void
+-change_virtblk_backend(int x, siginfo_t *siginfo, void *p)
+-{
+- struct mic_info *mic;
+-
+- for (mic = mic_list.next; mic != NULL; mic = mic->next)
+- mic->mic_virtblk.signaled = 1/* true */;
+-}
+-
+-static void
+-init_mic(struct mic_info *mic)
+-{
+- struct sigaction ignore = {
+- .sa_flags = 0,
+- .sa_handler = SIG_IGN
+- };
+- struct sigaction act = {
+- .sa_flags = SA_SIGINFO,
+- .sa_sigaction = change_virtblk_backend,
+- };
+- char buffer[PATH_MAX];
+- int err;
+-
+- /*
+- * Currently, one virtio block device is supported for each MIC card
+- * at a time. Any user (or test) can send a SIGUSR1 to the MIC daemon.
+- * The signal informs the virtio block backend about a change in the
+- * configuration file which specifies the virtio backend file name on
+- * the host. Virtio block backend then re-reads the configuration file
+- * and switches to the new block device. This signalling mechanism may
+- * not be required once multiple virtio block devices are supported by
+- * the MIC daemon.
+- */
+- sigaction(SIGUSR1, &ignore, NULL);
+-
+- mic->pid = fork();
+- switch (mic->pid) {
+- case 0:
+- set_log_buf_info(mic);
+- set_cmdline(mic);
+- add_virtio_device(mic, &virtcons_dev_page.dd);
+- add_virtio_device(mic, &virtnet_dev_page.dd);
+- err = pthread_create(&mic->mic_console.console_thread, NULL,
+- virtio_console, mic);
+- if (err)
+- mpsslog("%s virtcons pthread_create failed %s\n",
+- mic->name, strerror(err));
+- err = pthread_create(&mic->mic_net.net_thread, NULL,
+- virtio_net, mic);
+- if (err)
+- mpsslog("%s virtnet pthread_create failed %s\n",
+- mic->name, strerror(err));
+- err = pthread_create(&mic->mic_virtblk.block_thread, NULL,
+- virtio_block, mic);
+- if (err)
+- mpsslog("%s virtblk pthread_create failed %s\n",
+- mic->name, strerror(err));
+- sigemptyset(&act.sa_mask);
+- err = sigaction(SIGUSR1, &act, NULL);
+- if (err)
+- mpsslog("%s sigaction SIGUSR1 failed %s\n",
+- mic->name, strerror(errno));
+- while (1)
+- sleep(60);
+- case -1:
+- mpsslog("fork failed MIC name %s id %d errno %d\n",
+- mic->name, mic->id, errno);
+- break;
+- default:
+- if (mic->restart) {
+- snprintf(buffer, PATH_MAX, "boot");
+- setsysfs(mic->name, "state", buffer);
+- mpsslog("%s restarting mic %d\n",
+- mic->name, mic->restart);
+- mic->restart = 0;
+- }
+- pthread_create(&mic->config_thread, NULL, mic_config, mic);
+- }
+-}
+-
+-static void
+-start_daemon(void)
+-{
+- struct mic_info *mic;
+-
+- for (mic = mic_list.next; mic != NULL; mic = mic->next)
+- init_mic(mic);
+-
+- while (1)
+- sleep(60);
+-}
+-
+-static int
+-init_mic_list(void)
+-{
+- struct mic_info *mic = &mic_list;
+- struct dirent *file;
+- DIR *dp;
+- int cnt = 0;
+-
+- dp = opendir(MICSYSFSDIR);
+- if (!dp)
+- return 0;
+-
+- while ((file = readdir(dp)) != NULL) {
+- if (!strncmp(file->d_name, "mic", 3)) {
+- mic->next = calloc(1, sizeof(struct mic_info));
+- if (mic->next) {
+- mic = mic->next;
+- mic->id = atoi(&file->d_name[3]);
+- mic->name = malloc(strlen(file->d_name) + 16);
+- if (mic->name)
+- strcpy(mic->name, file->d_name);
+- mpsslog("MIC name %s id %d\n", mic->name,
+- mic->id);
+- cnt++;
+- }
+- }
+- }
+-
+- closedir(dp);
+- return cnt;
+-}
+-
+-void
+-mpsslog(char *format, ...)
+-{
+- va_list args;
+- char buffer[4096];
+- char ts[52], *ts1;
+- time_t t;
+-
+- if (logfp == NULL)
+- return;
+-
+- va_start(args, format);
+- vsprintf(buffer, format, args);
+- va_end(args);
+-
+- time(&t);
+- ts1 = ctime_r(&t, ts);
+- ts1[strlen(ts1) - 1] = '\0';
+- fprintf(logfp, "%s: %s", ts1, buffer);
+-
+- fflush(logfp);
+-}
+-
+-int
+-main(int argc, char *argv[])
+-{
+- int cnt;
+- pid_t pid;
+-
+- myname = argv[0];
+-
+- logfp = fopen(LOGFILE_NAME, "a+");
+- if (!logfp) {
+- fprintf(stderr, "cannot open logfile '%s'\n", LOGFILE_NAME);
+- exit(1);
+- }
+- pid = fork();
+- switch (pid) {
+- case 0:
+- break;
+- case -1:
+- exit(2);
+- default:
+- exit(0);
+- }
+-
+- mpsslog("MIC Daemon start\n");
+-
+- cnt = init_mic_list();
+- if (cnt == 0) {
+- mpsslog("MIC module not loaded\n");
+- exit(3);
+- }
+- mpsslog("MIC found %d devices\n", cnt);
+-
+- start_daemon();
+-
+- exit(0);
+-}
+diff --git a/Documentation/mic/mpssd/mpssd.h b/Documentation/mic/mpssd/mpssd.h
+deleted file mode 100644
+index f5f18b15d9a0..000000000000
+--- a/Documentation/mic/mpssd/mpssd.h
++++ /dev/null
+@@ -1,102 +0,0 @@
+-/*
+- * Intel MIC Platform Software Stack (MPSS)
+- *
+- * Copyright(c) 2013 Intel Corporation.
+- *
+- * This program is free software; you can redistribute it and/or modify
+- * it under the terms of the GNU General Public License, version 2, as
+- * published by the Free Software Foundation.
+- *
+- * This program is distributed in the hope that it will be useful, but
+- * WITHOUT ANY WARRANTY; without even the implied warranty of
+- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+- * General Public License for more details.
+- *
+- * The full GNU General Public License is included in this distribution in
+- * the file called "COPYING".
+- *
+- * Intel MIC User Space Tools.
+- */
+-#ifndef _MPSSD_H_
+-#define _MPSSD_H_
+-
+-#include <stdio.h>
+-#include <stdlib.h>
+-#include <string.h>
+-#include <fcntl.h>
+-#include <unistd.h>
+-#include <dirent.h>
+-#include <libgen.h>
+-#include <pthread.h>
+-#include <stdarg.h>
+-#include <time.h>
+-#include <errno.h>
+-#include <sys/dir.h>
+-#include <sys/ioctl.h>
+-#include <sys/poll.h>
+-#include <sys/types.h>
+-#include <sys/socket.h>
+-#include <sys/stat.h>
+-#include <sys/types.h>
+-#include <sys/mman.h>
+-#include <sys/utsname.h>
+-#include <sys/wait.h>
+-#include <netinet/in.h>
+-#include <arpa/inet.h>
+-#include <netdb.h>
+-#include <pthread.h>
+-#include <signal.h>
+-#include <limits.h>
+-#include <syslog.h>
+-#include <getopt.h>
+-#include <net/if.h>
+-#include <linux/if_tun.h>
+-#include <linux/if_tun.h>
+-#include <linux/virtio_ids.h>
+-
+-#define MICSYSFSDIR "/sys/class/mic"
+-#define LOGFILE_NAME "/var/log/mpssd"
+-#define PAGE_SIZE 4096
+-
+-struct mic_console_info {
+- pthread_t console_thread;
+- int virtio_console_fd;
+- void *console_dp;
+-};
+-
+-struct mic_net_info {
+- pthread_t net_thread;
+- int virtio_net_fd;
+- int tap_fd;
+- void *net_dp;
+-};
+-
+-struct mic_virtblk_info {
+- pthread_t block_thread;
+- int virtio_block_fd;
+- void *block_dp;
+- volatile sig_atomic_t signaled;
+- char *backend_file;
+- int backend;
+- void *backend_addr;
+- long backend_size;
+-};
+-
+-struct mic_info {
+- int id;
+- char *name;
+- pthread_t config_thread;
+- pid_t pid;
+- struct mic_console_info mic_console;
+- struct mic_net_info mic_net;
+- struct mic_virtblk_info mic_virtblk;
+- int restart;
+- int boot_on_resume;
+- struct mic_info *next;
+-};
+-
+-__attribute__((format(printf, 1, 2)))
+-void mpsslog(char *format, ...);
+-char *readsysfs(char *dir, char *entry);
+-int setsysfs(char *dir, char *entry, char *value);
+-#endif
+diff --git a/Documentation/mic/mpssd/sysfs.c b/Documentation/mic/mpssd/sysfs.c
+deleted file mode 100644
+index 8dd326936083..000000000000
+--- a/Documentation/mic/mpssd/sysfs.c
++++ /dev/null
+@@ -1,102 +0,0 @@
+-/*
+- * Intel MIC Platform Software Stack (MPSS)
+- *
+- * Copyright(c) 2013 Intel Corporation.
+- *
+- * This program is free software; you can redistribute it and/or modify
+- * it under the terms of the GNU General Public License, version 2, as
+- * published by the Free Software Foundation.
+- *
+- * This program is distributed in the hope that it will be useful, but
+- * WITHOUT ANY WARRANTY; without even the implied warranty of
+- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+- * General Public License for more details.
+- *
+- * The full GNU General Public License is included in this distribution in
+- * the file called "COPYING".
+- *
+- * Intel MIC User Space Tools.
+- */
+-
+-#include "mpssd.h"
+-
+-#define PAGE_SIZE 4096
+-
+-char *
+-readsysfs(char *dir, char *entry)
+-{
+- char filename[PATH_MAX];
+- char value[PAGE_SIZE];
+- char *string = NULL;
+- int fd;
+- int len;
+-
+- if (dir == NULL)
+- snprintf(filename, PATH_MAX, "%s/%s", MICSYSFSDIR, entry);
+- else
+- snprintf(filename, PATH_MAX,
+- "%s/%s/%s", MICSYSFSDIR, dir, entry);
+-
+- fd = open(filename, O_RDONLY);
+- if (fd < 0) {
+- mpsslog("Failed to open sysfs entry '%s': %s\n",
+- filename, strerror(errno));
+- return NULL;
+- }
+-
+- len = read(fd, value, sizeof(value));
+- if (len < 0) {
+- mpsslog("Failed to read sysfs entry '%s': %s\n",
+- filename, strerror(errno));
+- goto readsys_ret;
+- }
+- if (len == 0)
+- goto readsys_ret;
+-
+- value[len - 1] = '\0';
+-
+- string = malloc(strlen(value) + 1);
+- if (string)
+- strcpy(string, value);
+-
+-readsys_ret:
+- close(fd);
+- return string;
+-}
+-
+-int
+-setsysfs(char *dir, char *entry, char *value)
+-{
+- char filename[PATH_MAX];
+- char *oldvalue;
+- int fd, ret = 0;
+-
+- if (dir == NULL)
+- snprintf(filename, PATH_MAX, "%s/%s", MICSYSFSDIR, entry);
+- else
+- snprintf(filename, PATH_MAX, "%s/%s/%s",
+- MICSYSFSDIR, dir, entry);
+-
+- oldvalue = readsysfs(dir, entry);
+-
+- fd = open(filename, O_RDWR);
+- if (fd < 0) {
+- ret = errno;
+- mpsslog("Failed to open sysfs entry '%s': %s\n",
+- filename, strerror(errno));
+- goto done;
+- }
+-
+- if (!oldvalue || strcmp(value, oldvalue)) {
+- if (write(fd, value, strlen(value)) < 0) {
+- ret = errno;
+- mpsslog("Failed to write new sysfs entry '%s': %s\n",
+- filename, strerror(errno));
+- }
+- }
+- close(fd);
+-done:
+- if (oldvalue)
+- free(oldvalue);
+- return ret;
+-}
+diff --git a/Documentation/networking/netlink_mmap.txt b/Documentation/networking/netlink_mmap.txt
+deleted file mode 100644
+index c6af4bac5aa8..000000000000
+--- a/Documentation/networking/netlink_mmap.txt
++++ /dev/null
+@@ -1,339 +0,0 @@
+-This file documents how to use memory mapped I/O with netlink.
+-
+-Author: Patrick McHardy <kaber@trash.net>
+-
+-Overview
+---------
+-
+-Memory mapped netlink I/O can be used to increase throughput and decrease
+-overhead of unicast receive and transmit operations. Some netlink subsystems
+-require high throughput, these are mainly the netfilter subsystems
+-nfnetlink_queue and nfnetlink_log, but it can also help speed up large
+-dump operations of f.i. the routing database.
+-
+-Memory mapped netlink I/O used two circular ring buffers for RX and TX which
+-are mapped into the processes address space.
+-
+-The RX ring is used by the kernel to directly construct netlink messages into
+-user-space memory without copying them as done with regular socket I/O,
+-additionally as long as the ring contains messages no recvmsg() or poll()
+-syscalls have to be issued by user-space to get more message.
+-
+-The TX ring is used to process messages directly from user-space memory, the
+-kernel processes all messages contained in the ring using a single sendmsg()
+-call.
+-
+-Usage overview
+---------------
+-
+-In order to use memory mapped netlink I/O, user-space needs three main changes:
+-
+-- ring setup
+-- conversion of the RX path to get messages from the ring instead of recvmsg()
+-- conversion of the TX path to construct messages into the ring
+-
+-Ring setup is done using setsockopt() to provide the ring parameters to the
+-kernel, then a call to mmap() to map the ring into the processes address space:
+-
+-- setsockopt(fd, SOL_NETLINK, NETLINK_RX_RING, ¶ms, sizeof(params));
+-- setsockopt(fd, SOL_NETLINK, NETLINK_TX_RING, ¶ms, sizeof(params));
+-- ring = mmap(NULL, size, PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0)
+-
+-Usage of either ring is optional, but even if only the RX ring is used the
+-mapping still needs to be writable in order to update the frame status after
+-processing.
+-
+-Conversion of the reception path involves calling poll() on the file
+-descriptor, once the socket is readable the frames from the ring are
+-processed in order until no more messages are available, as indicated by
+-a status word in the frame header.
+-
+-On kernel side, in order to make use of memory mapped I/O on receive, the
+-originating netlink subsystem needs to support memory mapped I/O, otherwise
+-it will use an allocated socket buffer as usual and the contents will be
+- copied to the ring on transmission, nullifying most of the performance gains.
+-Dumps of kernel databases automatically support memory mapped I/O.
+-
+-Conversion of the transmit path involves changing message construction to
+-use memory from the TX ring instead of (usually) a buffer declared on the
+-stack and setting up the frame header appropriately. Optionally poll() can
+-be used to wait for free frames in the TX ring.
+-
+-Structured and definitions for using memory mapped I/O are contained in
+-<linux/netlink.h>.
+-
+-RX and TX rings
+-----------------
+-
+-Each ring contains a number of continuous memory blocks, containing frames of
+-fixed size dependent on the parameters used for ring setup.
+-
+-Ring: [ block 0 ]
+- [ frame 0 ]
+- [ frame 1 ]
+- [ block 1 ]
+- [ frame 2 ]
+- [ frame 3 ]
+- ...
+- [ block n ]
+- [ frame 2 * n ]
+- [ frame 2 * n + 1 ]
+-
+-The blocks are only visible to the kernel, from the point of view of user-space
+-the ring just contains the frames in a continuous memory zone.
+-
+-The ring parameters used for setting up the ring are defined as follows:
+-
+-struct nl_mmap_req {
+- unsigned int nm_block_size;
+- unsigned int nm_block_nr;
+- unsigned int nm_frame_size;
+- unsigned int nm_frame_nr;
+-};
+-
+-Frames are grouped into blocks, where each block is a continuous region of memory
+-and holds nm_block_size / nm_frame_size frames. The total number of frames in
+-the ring is nm_frame_nr. The following invariants hold:
+-
+-- frames_per_block = nm_block_size / nm_frame_size
+-
+-- nm_frame_nr = frames_per_block * nm_block_nr
+-
+-Some parameters are constrained, specifically:
+-
+-- nm_block_size must be a multiple of the architectures memory page size.
+- The getpagesize() function can be used to get the page size.
+-
+-- nm_frame_size must be equal or larger to NL_MMAP_HDRLEN, IOW a frame must be
+- able to hold at least the frame header
+-
+-- nm_frame_size must be smaller or equal to nm_block_size
+-
+-- nm_frame_size must be a multiple of NL_MMAP_MSG_ALIGNMENT
+-
+-- nm_frame_nr must equal the actual number of frames as specified above.
+-
+-When the kernel can't allocate physically continuous memory for a ring block,
+-it will fall back to use physically discontinuous memory. This might affect
+-performance negatively, in order to avoid this the nm_frame_size parameter
+-should be chosen to be as small as possible for the required frame size and
+-the number of blocks should be increased instead.
+-
+-Ring frames
+-------------
+-
+-Each frames contain a frame header, consisting of a synchronization word and some
+-meta-data, and the message itself.
+-
+-Frame: [ header message ]
+-
+-The frame header is defined as follows:
+-
+-struct nl_mmap_hdr {
+- unsigned int nm_status;
+- unsigned int nm_len;
+- __u32 nm_group;
+- /* credentials */
+- __u32 nm_pid;
+- __u32 nm_uid;
+- __u32 nm_gid;
+-};
+-
+-- nm_status is used for synchronizing processing between the kernel and user-
+- space and specifies ownership of the frame as well as the operation to perform
+-
+-- nm_len contains the length of the message contained in the data area
+-
+-- nm_group specified the destination multicast group of message
+-
+-- nm_pid, nm_uid and nm_gid contain the netlink pid, UID and GID of the sending
+- process. These values correspond to the data available using SOCK_PASSCRED in
+- the SCM_CREDENTIALS cmsg.
+-
+-The possible values in the status word are:
+-
+-- NL_MMAP_STATUS_UNUSED:
+- RX ring: frame belongs to the kernel and contains no message
+- for user-space. Approriate action is to invoke poll()
+- to wait for new messages.
+-
+- TX ring: frame belongs to user-space and can be used for
+- message construction.
+-
+-- NL_MMAP_STATUS_RESERVED:
+- RX ring only: frame is currently used by the kernel for message
+- construction and contains no valid message yet.
+- Appropriate action is to invoke poll() to wait for
+- new messages.
+-
+-- NL_MMAP_STATUS_VALID:
+- RX ring: frame contains a valid message. Approriate action is
+- to process the message and release the frame back to
+- the kernel by setting the status to
+- NL_MMAP_STATUS_UNUSED or queue the frame by setting the
+- status to NL_MMAP_STATUS_SKIP.
+-
+- TX ring: the frame contains a valid message from user-space to
+- be processed by the kernel. After completing processing
+- the kernel will release the frame back to user-space by
+- setting the status to NL_MMAP_STATUS_UNUSED.
+-
+-- NL_MMAP_STATUS_COPY:
+- RX ring only: a message is ready to be processed but could not be
+- stored in the ring, either because it exceeded the
+- frame size or because the originating subsystem does
+- not support memory mapped I/O. Appropriate action is
+- to invoke recvmsg() to receive the message and release
+- the frame back to the kernel by setting the status to
+- NL_MMAP_STATUS_UNUSED.
+-
+-- NL_MMAP_STATUS_SKIP:
+- RX ring only: user-space queued the message for later processing, but
+- processed some messages following it in the ring. The
+- kernel should skip this frame when looking for unused
+- frames.
+-
+-The data area of a frame begins at a offset of NL_MMAP_HDRLEN relative to the
+-frame header.
+-
+-TX limitations
+---------------
+-
+-Kernel processing usually involves validation of the message received by
+-user-space, then processing its contents. The kernel must assure that
+-userspace is not able to modify the message contents after they have been
+-validated. In order to do so, the message is copied from the ring frame
+-to an allocated buffer if either of these conditions is false:
+-
+-- only a single mapping of the ring exists
+-- the file descriptor is not shared between processes
+-
+-This means that for threaded programs, the kernel will fall back to copying.
+-
+-Example
+--------
+-
+-Ring setup:
+-
+- unsigned int block_size = 16 * getpagesize();
+- struct nl_mmap_req req = {
+- .nm_block_size = block_size,
+- .nm_block_nr = 64,
+- .nm_frame_size = 16384,
+- .nm_frame_nr = 64 * block_size / 16384,
+- };
+- unsigned int ring_size;
+- void *rx_ring, *tx_ring;
+-
+- /* Configure ring parameters */
+- if (setsockopt(fd, SOL_NETLINK, NETLINK_RX_RING, &req, sizeof(req)) < 0)
+- exit(1);
+- if (setsockopt(fd, SOL_NETLINK, NETLINK_TX_RING, &req, sizeof(req)) < 0)
+- exit(1)
+-
+- /* Calculate size of each individual ring */
+- ring_size = req.nm_block_nr * req.nm_block_size;
+-
+- /* Map RX/TX rings. The TX ring is located after the RX ring */
+- rx_ring = mmap(NULL, 2 * ring_size, PROT_READ | PROT_WRITE,
+- MAP_SHARED, fd, 0);
+- if ((long)rx_ring == -1L)
+- exit(1);
+- tx_ring = rx_ring + ring_size:
+-
+-Message reception:
+-
+-This example assumes some ring parameters of the ring setup are available.
+-
+- unsigned int frame_offset = 0;
+- struct nl_mmap_hdr *hdr;
+- struct nlmsghdr *nlh;
+- unsigned char buf[16384];
+- ssize_t len;
+-
+- while (1) {
+- struct pollfd pfds[1];
+-
+- pfds[0].fd = fd;
+- pfds[0].events = POLLIN | POLLERR;
+- pfds[0].revents = 0;
+-
+- if (poll(pfds, 1, -1) < 0 && errno != -EINTR)
+- exit(1);
+-
+- /* Check for errors. Error handling omitted */
+- if (pfds[0].revents & POLLERR)
+- <handle error>
+-
+- /* If no new messages, poll again */
+- if (!(pfds[0].revents & POLLIN))
+- continue;
+-
+- /* Process all frames */
+- while (1) {
+- /* Get next frame header */
+- hdr = rx_ring + frame_offset;
+-
+- if (hdr->nm_status == NL_MMAP_STATUS_VALID) {
+- /* Regular memory mapped frame */
+- nlh = (void *)hdr + NL_MMAP_HDRLEN;
+- len = hdr->nm_len;
+-
+- /* Release empty message immediately. May happen
+- * on error during message construction.
+- */
+- if (len == 0)
+- goto release;
+- } else if (hdr->nm_status == NL_MMAP_STATUS_COPY) {
+- /* Frame queued to socket receive queue */
+- len = recv(fd, buf, sizeof(buf), MSG_DONTWAIT);
+- if (len <= 0)
+- break;
+- nlh = buf;
+- } else
+- /* No more messages to process, continue polling */
+- break;
+-
+- process_msg(nlh);
+-release:
+- /* Release frame back to the kernel */
+- hdr->nm_status = NL_MMAP_STATUS_UNUSED;
+-
+- /* Advance frame offset to next frame */
+- frame_offset = (frame_offset + frame_size) % ring_size;
+- }
+- }
+-
+-Message transmission:
+-
+-This example assumes some ring parameters of the ring setup are available.
+-A single message is constructed and transmitted, to send multiple messages
+-at once they would be constructed in consecutive frames before a final call
+-to sendto().
+-
+- unsigned int frame_offset = 0;
+- struct nl_mmap_hdr *hdr;
+- struct nlmsghdr *nlh;
+- struct sockaddr_nl addr = {
+- .nl_family = AF_NETLINK,
+- };
+-
+- hdr = tx_ring + frame_offset;
+- if (hdr->nm_status != NL_MMAP_STATUS_UNUSED)
+- /* No frame available. Use poll() to avoid. */
+- exit(1);
+-
+- nlh = (void *)hdr + NL_MMAP_HDRLEN;
+-
+- /* Build message */
+- build_message(nlh);
+-
+- /* Fill frame header: length and status need to be set */
+- hdr->nm_len = nlh->nlmsg_len;
+- hdr->nm_status = NL_MMAP_STATUS_VALID;
+-
+- if (sendto(fd, NULL, 0, 0, &addr, sizeof(addr)) < 0)
+- exit(1);
+-
+- /* Advance frame offset to next frame */
+- frame_offset = (frame_offset + frame_size) % ring_size;
+diff --git a/Makefile b/Makefile
+index 52d32f6bd7c5..252070fdf91c 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 18
+-SUBLEVEL = 48
++SUBLEVEL = 49
+ EXTRAVERSION =
+ NAME = Diseased Newt
+
+diff --git a/arch/arm/include/asm/floppy.h b/arch/arm/include/asm/floppy.h
+index f4882553fbb0..85a34cc8316a 100644
+--- a/arch/arm/include/asm/floppy.h
++++ b/arch/arm/include/asm/floppy.h
+@@ -17,7 +17,7 @@
+
+ #define fd_outb(val,port) \
+ do { \
+- if ((port) == FD_DOR) \
++ if ((port) == (u32)FD_DOR) \
+ fd_setdor((val)); \
+ else \
+ outb((val),(port)); \
+diff --git a/arch/mips/configs/ip27_defconfig b/arch/mips/configs/ip27_defconfig
+index 48e16d98b2cc..6ecc67f3736b 100644
+--- a/arch/mips/configs/ip27_defconfig
++++ b/arch/mips/configs/ip27_defconfig
+@@ -206,7 +206,6 @@ CONFIG_MLX4_EN=m
+ # CONFIG_MLX4_DEBUG is not set
+ CONFIG_TEHUTI=m
+ CONFIG_BNX2X=m
+-CONFIG_QLGE=m
+ CONFIG_SFC=m
+ CONFIG_BE2NET=m
+ CONFIG_LIBERTAS_THINFIRM=m
+diff --git a/arch/mips/dec/int-handler.S b/arch/mips/dec/int-handler.S
+index 41a2fa1fa12e..c7953f2aca4f 100644
+--- a/arch/mips/dec/int-handler.S
++++ b/arch/mips/dec/int-handler.S
+@@ -146,7 +146,25 @@
+ /*
+ * Find irq with highest priority
+ */
+- PTR_LA t1,cpu_mask_nr_tbl
++ # open coded PTR_LA t1, cpu_mask_nr_tbl
++#if (_MIPS_SZPTR == 32)
++ # open coded la t1, cpu_mask_nr_tbl
++ lui t1, %hi(cpu_mask_nr_tbl)
++ addiu t1, %lo(cpu_mask_nr_tbl)
++
++#endif
++#if (_MIPS_SZPTR == 64)
++ # open coded dla t1, cpu_mask_nr_tbl
++ .set push
++ .set noat
++ lui t1, %highest(cpu_mask_nr_tbl)
++ lui AT, %hi(cpu_mask_nr_tbl)
++ daddiu t1, t1, %higher(cpu_mask_nr_tbl)
++ daddiu AT, AT, %lo(cpu_mask_nr_tbl)
++ dsll t1, 32
++ daddu t1, t1, AT
++ .set pop
++#endif
+ 1: lw t2,(t1)
+ nop
+ and t2,t0
+@@ -195,7 +213,25 @@
+ /*
+ * Find irq with highest priority
+ */
+- PTR_LA t1,asic_mask_nr_tbl
++ # open coded PTR_LA t1,asic_mask_nr_tbl
++#if (_MIPS_SZPTR == 32)
++ # open coded la t1, asic_mask_nr_tbl
++ lui t1, %hi(asic_mask_nr_tbl)
++ addiu t1, %lo(asic_mask_nr_tbl)
++
++#endif
++#if (_MIPS_SZPTR == 64)
++ # open coded dla t1, asic_mask_nr_tbl
++ .set push
++ .set noat
++ lui t1, %highest(asic_mask_nr_tbl)
++ lui AT, %hi(asic_mask_nr_tbl)
++ daddiu t1, t1, %higher(asic_mask_nr_tbl)
++ daddiu AT, AT, %lo(asic_mask_nr_tbl)
++ dsll t1, 32
++ daddu t1, t1, AT
++ .set pop
++#endif
+ 2: lw t2,(t1)
+ nop
+ and t2,t0
+diff --git a/arch/mips/sgi-ip22/Platform b/arch/mips/sgi-ip22/Platform
+index b7a4b7e04c38..e8f6b3a42a48 100644
+--- a/arch/mips/sgi-ip22/Platform
++++ b/arch/mips/sgi-ip22/Platform
+@@ -25,7 +25,7 @@ endif
+ # Simplified: what IP22 does at 128MB+ in ksegN, IP28 does at 512MB+ in xkphys
+ #
+ ifdef CONFIG_SGI_IP28
+- ifeq ($(call cc-option-yn,-mr10k-cache-barrier=store), n)
++ ifeq ($(call cc-option-yn,-march=r10000 -mr10k-cache-barrier=store), n)
+ $(error gcc doesn't support needed option -mr10k-cache-barrier=store)
+ endif
+ endif
+diff --git a/arch/powerpc/lib/sstep.c b/arch/powerpc/lib/sstep.c
+index 54651fc2d412..51b667316605 100644
+--- a/arch/powerpc/lib/sstep.c
++++ b/arch/powerpc/lib/sstep.c
+@@ -1806,8 +1806,6 @@ int __kprobes emulate_step(struct pt_regs *regs, unsigned int instr)
+ goto instr_done;
+
+ case LARX:
+- if (regs->msr & MSR_LE)
+- return 0;
+ if (op.ea & (size - 1))
+ break; /* can't handle misaligned */
+ err = -EFAULT;
+@@ -1829,8 +1827,6 @@ int __kprobes emulate_step(struct pt_regs *regs, unsigned int instr)
+ goto ldst_done;
+
+ case STCX:
+- if (regs->msr & MSR_LE)
+- return 0;
+ if (op.ea & (size - 1))
+ break; /* can't handle misaligned */
+ err = -EFAULT;
+@@ -1854,8 +1850,6 @@ int __kprobes emulate_step(struct pt_regs *regs, unsigned int instr)
+ goto ldst_done;
+
+ case LOAD:
+- if (regs->msr & MSR_LE)
+- return 0;
+ err = read_mem(®s->gpr[op.reg], op.ea, size, regs);
+ if (!err) {
+ if (op.type & SIGNEXT)
+@@ -1866,8 +1860,6 @@ int __kprobes emulate_step(struct pt_regs *regs, unsigned int instr)
+ goto ldst_done;
+
+ case LOAD_FP:
+- if (regs->msr & MSR_LE)
+- return 0;
+ if (size == 4)
+ err = do_fp_load(op.reg, do_lfs, op.ea, size, regs);
+ else
+@@ -1876,15 +1868,11 @@ int __kprobes emulate_step(struct pt_regs *regs, unsigned int instr)
+
+ #ifdef CONFIG_ALTIVEC
+ case LOAD_VMX:
+- if (regs->msr & MSR_LE)
+- return 0;
+ err = do_vec_load(op.reg, do_lvx, op.ea & ~0xfUL, regs);
+ goto ldst_done;
+ #endif
+ #ifdef CONFIG_VSX
+ case LOAD_VSX:
+- if (regs->msr & MSR_LE)
+- return 0;
+ err = do_vsx_load(op.reg, do_lxvd2x, op.ea, regs);
+ goto ldst_done;
+ #endif
+@@ -1907,8 +1895,6 @@ int __kprobes emulate_step(struct pt_regs *regs, unsigned int instr)
+ goto instr_done;
+
+ case STORE:
+- if (regs->msr & MSR_LE)
+- return 0;
+ if ((op.type & UPDATE) && size == sizeof(long) &&
+ op.reg == 1 && op.update_reg == 1 &&
+ !(regs->msr & MSR_PR) &&
+@@ -1920,8 +1906,6 @@ int __kprobes emulate_step(struct pt_regs *regs, unsigned int instr)
+ goto ldst_done;
+
+ case STORE_FP:
+- if (regs->msr & MSR_LE)
+- return 0;
+ if (size == 4)
+ err = do_fp_store(op.reg, do_stfs, op.ea, size, regs);
+ else
+@@ -1930,15 +1914,11 @@ int __kprobes emulate_step(struct pt_regs *regs, unsigned int instr)
+
+ #ifdef CONFIG_ALTIVEC
+ case STORE_VMX:
+- if (regs->msr & MSR_LE)
+- return 0;
+ err = do_vec_store(op.reg, do_stvx, op.ea & ~0xfUL, regs);
+ goto ldst_done;
+ #endif
+ #ifdef CONFIG_VSX
+ case STORE_VSX:
+- if (regs->msr & MSR_LE)
+- return 0;
+ err = do_vsx_store(op.reg, do_stxvd2x, op.ea, regs);
+ goto ldst_done;
+ #endif
+diff --git a/arch/s390/include/asm/processor.h b/arch/s390/include/asm/processor.h
+index d559bdb03d18..2006b955ea91 100644
+--- a/arch/s390/include/asm/processor.h
++++ b/arch/s390/include/asm/processor.h
+@@ -74,7 +74,8 @@ extern void execve_tail(void);
+
+ #else /* CONFIG_64BIT */
+
+-#define TASK_SIZE_OF(tsk) ((tsk)->mm->context.asce_limit)
++#define TASK_SIZE_OF(tsk) ((tsk)->mm ? \
++ (tsk)->mm->context.asce_limit : TASK_MAX_SIZE)
+ #define TASK_UNMAPPED_BASE (test_thread_flag(TIF_31BIT) ? \
+ (1UL << 30) : (1UL << 41))
+ #define TASK_SIZE TASK_SIZE_OF(current)
+diff --git a/arch/s390/kernel/setup.c b/arch/s390/kernel/setup.c
+index e80d9ff9a56d..ec3b505238cb 100644
+--- a/arch/s390/kernel/setup.c
++++ b/arch/s390/kernel/setup.c
+@@ -822,10 +822,10 @@ static void __init setup_randomness(void)
+ {
+ struct sysinfo_3_2_2 *vmms;
+
+- vmms = (struct sysinfo_3_2_2 *) alloc_page(GFP_KERNEL);
+- if (vmms && stsi(vmms, 3, 2, 2) == 0 && vmms->count)
+- add_device_randomness(&vmms, vmms->count);
+- free_page((unsigned long) vmms);
++ vmms = (struct sysinfo_3_2_2 *) memblock_alloc(PAGE_SIZE, PAGE_SIZE);
++ if (stsi(vmms, 3, 2, 2) == 0 && vmms->count)
++ add_device_randomness(&vmms->vm, sizeof(vmms->vm[0]) * vmms->count);
++ memblock_free((unsigned long) vmms, PAGE_SIZE);
+ }
+
+ /*
+diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c
+index 49e4d64ff74d..0ce029c73ca3 100644
+--- a/arch/s390/kvm/kvm-s390.c
++++ b/arch/s390/kvm/kvm-s390.c
+@@ -207,6 +207,9 @@ int kvm_vm_ioctl_get_dirty_log(struct kvm *kvm,
+ struct kvm_memory_slot *memslot;
+ int is_dirty = 0;
+
++ if (kvm_is_ucontrol(kvm))
++ return -EINVAL;
++
+ mutex_lock(&kvm->slots_lock);
+
+ r = -EINVAL;
+diff --git a/arch/s390/mm/pgtable.c b/arch/s390/mm/pgtable.c
+index 35fde2a24751..d0f59879cdca 100644
+--- a/arch/s390/mm/pgtable.c
++++ b/arch/s390/mm/pgtable.c
+@@ -1358,11 +1358,28 @@ EXPORT_SYMBOL_GPL(s390_enable_skey);
+ */
+ bool gmap_test_and_clear_dirty(unsigned long address, struct gmap *gmap)
+ {
++ pgd_t *pgd;
++ pud_t *pud;
++ pmd_t *pmd;
+ pte_t *pte;
+ spinlock_t *ptl;
+ bool dirty = false;
+
+- pte = get_locked_pte(gmap->mm, address, &ptl);
++ pgd = pgd_offset(gmap->mm, address);
++ pud = pud_alloc(gmap->mm, pgd, address);
++ if (!pud)
++ return false;
++ pmd = pmd_alloc(gmap->mm, pud, address);
++ if (!pmd)
++ return false;
++ /* We can't run guests backed by huge pages, but userspace can
++ * still set them up and then try to migrate them without any
++ * migration support.
++ */
++ if (pmd_large(*pmd))
++ return true;
++
++ pte = pte_alloc_map_lock(gmap->mm, pmd, address, &ptl);
+ if (unlikely(!pte))
+ return false;
+
+diff --git a/arch/x86/crypto/ghash-clmulni-intel_glue.c b/arch/x86/crypto/ghash-clmulni-intel_glue.c
+index de1d72e3ec59..2f5cd2f62a2b 100644
+--- a/arch/x86/crypto/ghash-clmulni-intel_glue.c
++++ b/arch/x86/crypto/ghash-clmulni-intel_glue.c
+@@ -218,6 +218,29 @@ static int ghash_async_final(struct ahash_request *req)
+ }
+ }
+
++static int ghash_async_import(struct ahash_request *req, const void *in)
++{
++ struct ahash_request *cryptd_req = ahash_request_ctx(req);
++ struct shash_desc *desc = cryptd_shash_desc(cryptd_req);
++ struct ghash_desc_ctx *dctx = shash_desc_ctx(desc);
++
++ ghash_async_init(req);
++ memcpy(dctx, in, sizeof(*dctx));
++ return 0;
++
++}
++
++static int ghash_async_export(struct ahash_request *req, void *out)
++{
++ struct ahash_request *cryptd_req = ahash_request_ctx(req);
++ struct shash_desc *desc = cryptd_shash_desc(cryptd_req);
++ struct ghash_desc_ctx *dctx = shash_desc_ctx(desc);
++
++ memcpy(out, dctx, sizeof(*dctx));
++ return 0;
++
++}
++
+ static int ghash_async_digest(struct ahash_request *req)
+ {
+ struct crypto_ahash *tfm = crypto_ahash_reqtfm(req);
+@@ -285,8 +308,11 @@ static struct ahash_alg ghash_async_alg = {
+ .final = ghash_async_final,
+ .setkey = ghash_async_setkey,
+ .digest = ghash_async_digest,
++ .export = ghash_async_export,
++ .import = ghash_async_import,
+ .halg = {
+ .digestsize = GHASH_DIGEST_SIZE,
++ .statesize = sizeof(struct ghash_desc_ctx),
+ .base = {
+ .cra_name = "ghash",
+ .cra_driver_name = "ghash-clmulni",
+diff --git a/arch/x86/include/asm/uaccess.h b/arch/x86/include/asm/uaccess.h
+index 8e046ade1c88..504be087d682 100644
+--- a/arch/x86/include/asm/uaccess.h
++++ b/arch/x86/include/asm/uaccess.h
+@@ -329,7 +329,7 @@ do { \
+ #define __get_user_asm_u64(x, ptr, retval, errret) \
+ __get_user_asm(x, ptr, retval, "q", "", "=r", errret)
+ #define __get_user_asm_ex_u64(x, ptr) \
+- __get_user_asm_ex(x, ptr, "q", "", "=r")
++ __get_user_asm_ex(x, ptr, "q", "", "=&r")
+ #endif
+
+ #define __get_user_size(x, ptr, size, retval, errret) \
+@@ -372,13 +372,13 @@ do { \
+ __chk_user_ptr(ptr); \
+ switch (size) { \
+ case 1: \
+- __get_user_asm_ex(x, ptr, "b", "b", "=q"); \
++ __get_user_asm_ex(x, ptr, "b", "b", "=&q"); \
+ break; \
+ case 2: \
+- __get_user_asm_ex(x, ptr, "w", "w", "=r"); \
++ __get_user_asm_ex(x, ptr, "w", "w", "=&r"); \
+ break; \
+ case 4: \
+- __get_user_asm_ex(x, ptr, "l", "k", "=r"); \
++ __get_user_asm_ex(x, ptr, "l", "k", "=&r"); \
+ break; \
+ case 8: \
+ __get_user_asm_ex_u64(x, ptr); \
+@@ -396,7 +396,7 @@ do { \
+ " jmp 2b\n" \
+ ".previous\n" \
+ _ASM_EXTABLE_EX(1b, 3b) \
+- : ltype(x) : "m" (__m(addr)))
++ : ltype(x) : "m" (__m(addr)), "0" (0))
+
+ #define __put_user_nocheck(x, ptr, size) \
+ ({ \
+diff --git a/arch/xtensa/kernel/setup.c b/arch/xtensa/kernel/setup.c
+index 06370ccea9e9..b70097e7f37a 100644
+--- a/arch/xtensa/kernel/setup.c
++++ b/arch/xtensa/kernel/setup.c
+@@ -133,6 +133,8 @@ static int __init parse_tag_initrd(const bp_tag_t* tag)
+
+ __tagtable(BP_TAG_INITRD, parse_tag_initrd);
+
++#endif /* CONFIG_BLK_DEV_INITRD */
++
+ #ifdef CONFIG_OF
+
+ static int __init parse_tag_fdt(const bp_tag_t *tag)
+@@ -145,8 +147,6 @@ __tagtable(BP_TAG_FDT, parse_tag_fdt);
+
+ #endif /* CONFIG_OF */
+
+-#endif /* CONFIG_BLK_DEV_INITRD */
+-
+ static int __init parse_tag_cmdline(const bp_tag_t* tag)
+ {
+ strlcpy(command_line, (char *)(tag->data), COMMAND_LINE_SIZE);
+diff --git a/crypto/Makefile b/crypto/Makefile
+index 1445b9100c05..ea11cf871ebc 100644
+--- a/crypto/Makefile
++++ b/crypto/Makefile
+@@ -47,6 +47,7 @@ obj-$(CONFIG_CRYPTO_SHA1) += sha1_generic.o
+ obj-$(CONFIG_CRYPTO_SHA256) += sha256_generic.o
+ obj-$(CONFIG_CRYPTO_SHA512) += sha512_generic.o
+ obj-$(CONFIG_CRYPTO_WP512) += wp512.o
++CFLAGS_wp512.o := $(call cc-option,-fno-schedule-insns) # https://gcc.gnu.org/bugzilla/show_bug.cgi?id=79149
+ obj-$(CONFIG_CRYPTO_TGR192) += tgr192.o
+ obj-$(CONFIG_CRYPTO_GF128MUL) += gf128mul.o
+ obj-$(CONFIG_CRYPTO_ECB) += ecb.o
+@@ -68,6 +69,7 @@ obj-$(CONFIG_CRYPTO_BLOWFISH_COMMON) += blowfish_common.o
+ obj-$(CONFIG_CRYPTO_TWOFISH) += twofish_generic.o
+ obj-$(CONFIG_CRYPTO_TWOFISH_COMMON) += twofish_common.o
+ obj-$(CONFIG_CRYPTO_SERPENT) += serpent_generic.o
++CFLAGS_serpent_generic.o := $(call cc-option,-fsched-pressure) # https://gcc.gnu.org/bugzilla/show_bug.cgi?id=79149
+ obj-$(CONFIG_CRYPTO_AES) += aes_generic.o
+ obj-$(CONFIG_CRYPTO_CAMELLIA) += camellia_generic.o
+ obj-$(CONFIG_CRYPTO_CAST_COMMON) += cast_common.o
+diff --git a/crypto/algif_hash.c b/crypto/algif_hash.c
+index df99445a899a..9eb8174aa58c 100644
+--- a/crypto/algif_hash.c
++++ b/crypto/algif_hash.c
+@@ -195,7 +195,7 @@ static int hash_accept(struct socket *sock, struct socket *newsock, int flags)
+ struct alg_sock *ask = alg_sk(sk);
+ struct hash_ctx *ctx = ask->private;
+ struct ahash_request *req = &ctx->req;
+- char state[crypto_ahash_statesize(crypto_ahash_reqtfm(req))];
++ char state[crypto_ahash_statesize(crypto_ahash_reqtfm(req)) ? : 1];
+ struct sock *sk2;
+ struct alg_sock *ask2;
+ struct hash_ctx *ctx2;
+diff --git a/crypto/cryptd.c b/crypto/cryptd.c
+index be367e43ffe8..fb0d140065e2 100644
+--- a/crypto/cryptd.c
++++ b/crypto/cryptd.c
+@@ -606,6 +606,7 @@ static int cryptd_create_hash(struct crypto_template *tmpl, struct rtattr **tb,
+ inst->alg.halg.base.cra_flags = CRYPTO_ALG_ASYNC;
+
+ inst->alg.halg.digestsize = salg->digestsize;
++ inst->alg.halg.statesize = salg->statesize;
+ inst->alg.halg.base.cra_ctxsize = sizeof(struct cryptd_hash_ctx);
+
+ inst->alg.halg.base.cra_init = cryptd_hash_init_tfm;
+diff --git a/crypto/mcryptd.c b/crypto/mcryptd.c
+index a8e870444ea9..02a1c10fa909 100644
+--- a/crypto/mcryptd.c
++++ b/crypto/mcryptd.c
+@@ -505,6 +505,7 @@ static int mcryptd_create_hash(struct crypto_template *tmpl, struct rtattr **tb,
+ inst->alg.halg.base.cra_flags = CRYPTO_ALG_ASYNC;
+
+ inst->alg.halg.digestsize = salg->digestsize;
++ inst->alg.halg.statesize = salg->statesize;
+ inst->alg.halg.base.cra_ctxsize = sizeof(struct mcryptd_hash_ctx);
+
+ inst->alg.halg.base.cra_init = mcryptd_hash_init_tfm;
+diff --git a/drivers/block/drbd/drbd_main.c b/drivers/block/drbd/drbd_main.c
+index 973c185c9cfe..a31b282de8e0 100644
+--- a/drivers/block/drbd/drbd_main.c
++++ b/drivers/block/drbd/drbd_main.c
+@@ -1802,7 +1802,7 @@ int drbd_send(struct drbd_connection *connection, struct socket *sock,
+ * do we need to block DRBD_SIG if sock == &meta.socket ??
+ * otherwise wake_asender() might interrupt some send_*Ack !
+ */
+- rv = kernel_sendmsg(sock, &msg, &iov, 1, size);
++ rv = kernel_sendmsg(sock, &msg, &iov, 1, iov.iov_len);
+ if (rv == -EAGAIN) {
+ if (we_should_drop_the_connection(connection, sock))
+ break;
+diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c
+index 036969223c16..0b4b67b859e2 100644
+--- a/drivers/bluetooth/ath3k.c
++++ b/drivers/bluetooth/ath3k.c
+@@ -94,6 +94,7 @@ static const struct usb_device_id ath3k_table[] = {
+ { USB_DEVICE(0x04CA, 0x300f) },
+ { USB_DEVICE(0x04CA, 0x3010) },
+ { USB_DEVICE(0x04CA, 0x3014) },
++ { USB_DEVICE(0x04CA, 0x3018) },
+ { USB_DEVICE(0x0930, 0x0219) },
+ { USB_DEVICE(0x0930, 0x0220) },
+ { USB_DEVICE(0x0930, 0x0227) },
+@@ -160,6 +161,7 @@ static const struct usb_device_id ath3k_blist_tbl[] = {
+ { USB_DEVICE(0x04ca, 0x300f), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x04ca, 0x3010), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x04ca, 0x3014), .driver_info = BTUSB_ATH3012 },
++ { USB_DEVICE(0x04ca, 0x3018), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x0930, 0x0220), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x0930, 0x0227), .driver_info = BTUSB_ATH3012 },
+diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
+index 2dd73a3e95a2..ce9a00a5c5ca 100644
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -186,6 +186,7 @@ static const struct usb_device_id blacklist_table[] = {
+ { USB_DEVICE(0x04ca, 0x300f), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x04ca, 0x3010), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x04ca, 0x3014), .driver_info = BTUSB_ATH3012 },
++ { USB_DEVICE(0x04ca, 0x3018), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x0930, 0x0220), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x0930, 0x0227), .driver_info = BTUSB_ATH3012 },
+diff --git a/drivers/gpu/drm/ast/ast_post.c b/drivers/gpu/drm/ast/ast_post.c
+index 810c51d92b99..30672a3df8a9 100644
+--- a/drivers/gpu/drm/ast/ast_post.c
++++ b/drivers/gpu/drm/ast/ast_post.c
+@@ -58,13 +58,9 @@ bool ast_is_vga_enabled(struct drm_device *dev)
+ /* TODO 1180 */
+ } else {
+ ch = ast_io_read8(ast, AST_IO_VGA_ENABLE_PORT);
+- if (ch) {
+- ast_open_key(ast);
+- ch = ast_get_index_reg_mask(ast, AST_IO_CRTC_PORT, 0xb6, 0xff);
+- return ch & 0x04;
+- }
++ return !!(ch & 0x01);
+ }
+- return 0;
++ return false;
+ }
+
+ static const u8 extreginfo[] = { 0x0f, 0x04, 0x1c, 0xff };
+@@ -375,8 +371,8 @@ void ast_post_gpu(struct drm_device *dev)
+ pci_write_config_dword(ast->dev->pdev, 0x04, reg);
+
+ ast_enable_vga(dev);
+- ast_enable_mmio(dev);
+ ast_open_key(ast);
++ ast_enable_mmio(dev);
+ ast_set_def_ext_reg(dev);
+
+ if (ast->chip == AST2300 || ast->chip == AST2400)
+@@ -1630,12 +1626,44 @@ static void ast_init_dram_2300(struct drm_device *dev)
+ temp |= 0x73;
+ ast_write32(ast, 0x12008, temp);
+
++ param.dram_freq = 396;
+ param.dram_type = AST_DDR3;
++ temp = ast_mindwm(ast, 0x1e6e2070);
+ if (temp & 0x01000000)
+ param.dram_type = AST_DDR2;
+- param.dram_chipid = ast->dram_type;
+- param.dram_freq = ast->mclk;
+- param.vram_size = ast->vram_size;
++ switch (temp & 0x18000000) {
++ case 0:
++ param.dram_chipid = AST_DRAM_512Mx16;
++ break;
++ default:
++ case 0x08000000:
++ param.dram_chipid = AST_DRAM_1Gx16;
++ break;
++ case 0x10000000:
++ param.dram_chipid = AST_DRAM_2Gx16;
++ break;
++ case 0x18000000:
++ param.dram_chipid = AST_DRAM_4Gx16;
++ break;
++ }
++ switch (temp & 0x0c) {
++ default:
++ case 0x00:
++ param.vram_size = AST_VIDMEM_SIZE_8M;
++ break;
++
++ case 0x04:
++ param.vram_size = AST_VIDMEM_SIZE_16M;
++ break;
++
++ case 0x08:
++ param.vram_size = AST_VIDMEM_SIZE_32M;
++ break;
++
++ case 0x0c:
++ param.vram_size = AST_VIDMEM_SIZE_64M;
++ break;
++ }
+
+ if (param.dram_type == AST_DDR3) {
+ get_ddr3_info(ast, ¶m);
+diff --git a/drivers/gpu/drm/exynos/exynos_drm_core.c b/drivers/gpu/drm/exynos/exynos_drm_core.c
+index 4c9f972eaa07..ba64d23b90a7 100644
+--- a/drivers/gpu/drm/exynos/exynos_drm_core.c
++++ b/drivers/gpu/drm/exynos/exynos_drm_core.c
+@@ -141,7 +141,7 @@ int exynos_drm_subdrv_open(struct drm_device *dev, struct drm_file *file)
+ return 0;
+
+ err:
+- list_for_each_entry_reverse(subdrv, &subdrv->list, list) {
++ list_for_each_entry_continue_reverse(subdrv, &exynos_drm_subdrv_list, list) {
+ if (subdrv->close)
+ subdrv->close(dev, subdrv->dev, file);
+ }
+diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c
+index 7370202c2022..4ca35798b0b2 100644
+--- a/drivers/gpu/drm/ttm/ttm_bo.c
++++ b/drivers/gpu/drm/ttm/ttm_bo.c
+@@ -1617,7 +1617,6 @@ static int ttm_bo_swapout(struct ttm_mem_shrink *shrink)
+ struct ttm_buffer_object *bo;
+ int ret = -EBUSY;
+ int put_count;
+- uint32_t swap_placement = (TTM_PL_FLAG_CACHED | TTM_PL_FLAG_SYSTEM);
+
+ spin_lock(&glob->lru_lock);
+ list_for_each_entry(bo, &glob->swap_lru, swap) {
+@@ -1653,7 +1652,8 @@ static int ttm_bo_swapout(struct ttm_mem_shrink *shrink)
+ if (unlikely(ret != 0))
+ goto out;
+
+- if ((bo->mem.placement & swap_placement) != swap_placement) {
++ if (bo->mem.mem_type != TTM_PL_SYSTEM ||
++ bo->ttm->caching_state != tt_cached) {
+ struct ttm_mem_reg evict_mem;
+
+ evict_mem = bo->mem;
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index 984e43cb83f0..213f616e7a1f 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -168,6 +168,7 @@
+ #define USB_DEVICE_ID_ATEN_4PORTKVM 0x2205
+ #define USB_DEVICE_ID_ATEN_4PORTKVMC 0x2208
+ #define USB_DEVICE_ID_ATEN_CS682 0x2213
++#define USB_DEVICE_ID_ATEN_CS692 0x8021
+
+ #define USB_VENDOR_ID_ATMEL 0x03eb
+ #define USB_DEVICE_ID_ATMEL_MULTITOUCH 0x211c
+diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c
+index f7dd36e4fcb3..999dff00b214 100644
+--- a/drivers/hid/usbhid/hid-quirks.c
++++ b/drivers/hid/usbhid/hid-quirks.c
+@@ -61,6 +61,7 @@ static const struct hid_blacklist {
+ { USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_4PORTKVM, HID_QUIRK_NOGET },
+ { USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_4PORTKVMC, HID_QUIRK_NOGET },
+ { USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_CS682, HID_QUIRK_NOGET },
++ { USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_CS692, HID_QUIRK_NOGET },
+ { USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_FIGHTERSTICK, HID_QUIRK_NOGET },
+ { USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_COMBATSTICK, HID_QUIRK_NOGET },
+ { USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_FLIGHT_SIM_ECLIPSE_YOKE, HID_QUIRK_NOGET },
+diff --git a/drivers/infiniband/ulp/ipoib/ipoib_cm.c b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
+index 933efcea0d03..cdf0a78e0c99 100644
+--- a/drivers/infiniband/ulp/ipoib/ipoib_cm.c
++++ b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
+@@ -1478,12 +1478,14 @@ static ssize_t set_mode(struct device *d, struct device_attribute *attr,
+
+ ret = ipoib_set_mode(dev, buf);
+
+- rtnl_unlock();
+-
+- if (!ret)
+- return count;
++ /* The assumption is that the function ipoib_set_mode returned
++ * with the rtnl held by it, if not the value -EBUSY returned,
++ * then no need to rtnl_unlock
++ */
++ if (ret != -EBUSY)
++ rtnl_unlock();
+
+- return ret;
++ return (!ret || ret == -EBUSY) ? count : ret;
+ }
+
+ static DEVICE_ATTR(mode, S_IWUSR | S_IRUGO, show_mode, set_mode);
+diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c
+index 58b5aa3b6f2d..483ddbd1bdc8 100644
+--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
++++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
+@@ -236,8 +236,7 @@ int ipoib_set_mode(struct net_device *dev, const char *buf)
+ priv->tx_wr.send_flags &= ~IB_SEND_IP_CSUM;
+
+ ipoib_flush_paths(dev);
+- rtnl_lock();
+- return 0;
++ return (!rtnl_trylock()) ? -EBUSY : 0;
+ }
+
+ if (!strcmp(buf, "datagram\n")) {
+@@ -246,8 +245,7 @@ int ipoib_set_mode(struct net_device *dev, const char *buf)
+ dev_set_mtu(dev, min(priv->mcast_mtu, dev->mtu));
+ rtnl_unlock();
+ ipoib_flush_paths(dev);
+- rtnl_lock();
+- return 0;
++ return (!rtnl_trylock()) ? -EBUSY : 0;
+ }
+
+ return -EINVAL;
+diff --git a/drivers/input/serio/gscps2.c b/drivers/input/serio/gscps2.c
+index 8d9ba0c3827c..94ab494a6ade 100644
+--- a/drivers/input/serio/gscps2.c
++++ b/drivers/input/serio/gscps2.c
+@@ -40,7 +40,6 @@
+ MODULE_AUTHOR("Laurent Canet <canetl@esiee.fr>, Thibaut Varene <varenet@parisc-linux.org>, Helge Deller <deller@gmx.de>");
+ MODULE_DESCRIPTION("HP GSC PS2 port driver");
+ MODULE_LICENSE("GPL");
+-MODULE_DEVICE_TABLE(parisc, gscps2_device_tbl);
+
+ #define PFX "gscps2.c: "
+
+@@ -439,6 +438,7 @@ static struct parisc_device_id gscps2_device_tbl[] = {
+ #endif
+ { 0, } /* 0 terminated list */
+ };
++MODULE_DEVICE_TABLE(parisc, gscps2_device_tbl);
+
+ static struct parisc_driver parisc_ps2_driver = {
+ .name = "gsc_ps2",
+diff --git a/drivers/iommu/dmar.c b/drivers/iommu/dmar.c
+index 8a0643ae1fd9..6b78e131f6dd 100644
+--- a/drivers/iommu/dmar.c
++++ b/drivers/iommu/dmar.c
+@@ -317,7 +317,9 @@ static int dmar_pci_bus_notifier(struct notifier_block *nb,
+ struct pci_dev *pdev = to_pci_dev(data);
+ struct dmar_pci_notify_info *info;
+
+- /* Only care about add/remove events for physical functions */
++ /* Only care about add/remove events for physical functions.
++ * For VFs we actually do the lookup based on the corresponding
++ * PF in device_to_iommu() anyway. */
+ if (pdev->is_virtfn)
+ return NOTIFY_DONE;
+ if (action != BUS_NOTIFY_ADD_DEVICE && action != BUS_NOTIFY_DEL_DEVICE)
+diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
+index 3d1fc736a420..1689632e4e92 100644
+--- a/drivers/iommu/intel-iommu.c
++++ b/drivers/iommu/intel-iommu.c
+@@ -696,7 +696,13 @@ static struct intel_iommu *device_to_iommu(struct device *dev, u8 *bus, u8 *devf
+ int i;
+
+ if (dev_is_pci(dev)) {
++ struct pci_dev *pf_pdev;
++
+ pdev = to_pci_dev(dev);
++ /* VFs aren't listed in scope tables; we need to look up
++ * the PF instead to find the IOMMU. */
++ pf_pdev = pci_physfn(pdev);
++ dev = &pf_pdev->dev;
+ segment = pci_domain_nr(pdev->bus);
+ } else if (ACPI_COMPANION(dev))
+ dev = &ACPI_COMPANION(dev)->dev;
+@@ -709,6 +715,13 @@ static struct intel_iommu *device_to_iommu(struct device *dev, u8 *bus, u8 *devf
+ for_each_active_dev_scope(drhd->devices,
+ drhd->devices_cnt, i, tmp) {
+ if (tmp == dev) {
++ /* For a VF use its original BDF# not that of the PF
++ * which we used for the IOMMU lookup. Strictly speaking
++ * we could do this for all PCI devices; we only need to
++ * get the BDF# from the scope table for ACPI matches. */
++ if (pdev->is_virtfn)
++ goto got_pdev;
++
+ *bus = drhd->devices[i].bus;
+ *devfn = drhd->devices[i].devfn;
+ goto out;
+diff --git a/drivers/md/dm.c b/drivers/md/dm.c
+index 042114fbd200..fb07be386287 100644
+--- a/drivers/md/dm.c
++++ b/drivers/md/dm.c
+@@ -1300,11 +1300,62 @@ void dm_accept_partial_bio(struct bio *bio, unsigned n_sectors)
+ }
+ EXPORT_SYMBOL_GPL(dm_accept_partial_bio);
+
++/*
++ * Flush current->bio_list when the target map method blocks.
++ * This fixes deadlocks in snapshot and possibly in other targets.
++ */
++struct dm_offload {
++ struct blk_plug plug;
++ struct blk_plug_cb cb;
++};
++
++static void flush_current_bio_list(struct blk_plug_cb *cb, bool from_schedule)
++{
++ struct dm_offload *o = container_of(cb, struct dm_offload, cb);
++ struct bio_list list;
++ struct bio *bio;
++
++ INIT_LIST_HEAD(&o->cb.list);
++
++ if (unlikely(!current->bio_list))
++ return;
++
++ list = *current->bio_list;
++ bio_list_init(current->bio_list);
++
++ while ((bio = bio_list_pop(&list))) {
++ struct bio_set *bs = bio->bi_pool;
++ if (unlikely(!bs) || bs == fs_bio_set) {
++ bio_list_add(current->bio_list, bio);
++ continue;
++ }
++
++ spin_lock(&bs->rescue_lock);
++ bio_list_add(&bs->rescue_list, bio);
++ queue_work(bs->rescue_workqueue, &bs->rescue_work);
++ spin_unlock(&bs->rescue_lock);
++ }
++}
++
++static void dm_offload_start(struct dm_offload *o)
++{
++ blk_start_plug(&o->plug);
++ o->cb.callback = flush_current_bio_list;
++ list_add(&o->cb.list, ¤t->plug->cb_list);
++}
++
++static void dm_offload_end(struct dm_offload *o)
++{
++ list_del(&o->cb.list);
++ blk_finish_plug(&o->plug);
++}
++
+ static void __map_bio(struct dm_target_io *tio)
+ {
+ int r;
+ sector_t sector;
+ struct mapped_device *md;
++ struct dm_offload o;
+ struct bio *clone = &tio->clone;
+ struct dm_target *ti = tio->ti;
+
+@@ -1317,7 +1368,11 @@ static void __map_bio(struct dm_target_io *tio)
+ */
+ atomic_inc(&tio->io->io_count);
+ sector = clone->bi_iter.bi_sector;
++
++ dm_offload_start(&o);
+ r = ti->type->map(ti, clone);
++ dm_offload_end(&o);
++
+ if (r == DM_MAPIO_REMAPPED) {
+ /* the bio has been remapped so dispatch it */
+
+diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
+index 644f9e576736..3e4def3c2b9f 100644
+--- a/drivers/md/raid10.c
++++ b/drivers/md/raid10.c
+@@ -1171,6 +1171,8 @@ static void __make_request(struct mddev *mddev, struct bio *bio)
+ int max_sectors;
+ int sectors;
+
++ md_write_start(mddev, bio);
++
+ /*
+ * Register the new request and wait if the reconstruction
+ * thread has put up a bar for new requests.
+@@ -1556,8 +1558,6 @@ static void make_request(struct mddev *mddev, struct bio *bio)
+ return;
+ }
+
+- md_write_start(mddev, bio);
+-
+ do {
+
+ /*
+diff --git a/drivers/media/usb/dvb-usb/dib0700_core.c b/drivers/media/usb/dvb-usb/dib0700_core.c
+index 605b090c618b..b128624c56b8 100644
+--- a/drivers/media/usb/dvb-usb/dib0700_core.c
++++ b/drivers/media/usb/dvb-usb/dib0700_core.c
+@@ -680,7 +680,7 @@ static void dib0700_rc_urb_completion(struct urb *purb)
+ struct dvb_usb_device *d = purb->context;
+ struct dib0700_rc_response *poll_reply;
+ enum rc_type protocol;
+- u32 uninitialized_var(keycode);
++ u32 keycode;
+ u8 toggle;
+
+ deb_info("%s()\n", __func__);
+@@ -722,7 +722,8 @@ static void dib0700_rc_urb_completion(struct urb *purb)
+ poll_reply->nec.data == 0x00 &&
+ poll_reply->nec.not_data == 0xff) {
+ poll_reply->data_state = 2;
+- break;
++ rc_repeat(d->rc_dev);
++ goto resubmit;
+ }
+
+ if ((poll_reply->nec.data ^ poll_reply->nec.not_data) != 0xff) {
+diff --git a/drivers/mtd/maps/pmcmsp-flash.c b/drivers/mtd/maps/pmcmsp-flash.c
+index 744ca5cacc9b..cf54420f943d 100644
+--- a/drivers/mtd/maps/pmcmsp-flash.c
++++ b/drivers/mtd/maps/pmcmsp-flash.c
+@@ -139,15 +139,13 @@ static int __init init_msp_flash(void)
+ }
+
+ msp_maps[i].bankwidth = 1;
+- msp_maps[i].name = kmalloc(7, GFP_KERNEL);
++ msp_maps[i].name = kstrndup(flash_name, 7, GFP_KERNEL);
+ if (!msp_maps[i].name) {
+ iounmap(msp_maps[i].virt);
+ kfree(msp_parts[i]);
+ goto cleanup_loop;
+ }
+
+- msp_maps[i].name = strncpy(msp_maps[i].name, flash_name, 7);
+-
+ for (j = 0; j < pcnt; j++) {
+ part_name[5] = '0' + i;
+ part_name[7] = '0' + j;
+diff --git a/drivers/mtd/ubi/fastmap.c b/drivers/mtd/ubi/fastmap.c
+index 9d38605717a0..303f69149439 100644
+--- a/drivers/mtd/ubi/fastmap.c
++++ b/drivers/mtd/ubi/fastmap.c
+@@ -446,10 +446,11 @@ static int scan_pool(struct ubi_device *ubi, struct ubi_attach_info *ai,
+ unsigned long long ec = be64_to_cpu(ech->ec);
+ unmap_peb(ai, pnum);
+ dbg_bld("Adding PEB to free: %i", pnum);
++
+ if (err == UBI_IO_FF_BITFLIPS)
+- add_aeb(ai, free, pnum, ec, 1);
+- else
+- add_aeb(ai, free, pnum, ec, 0);
++ scrub = 1;
++
++ add_aeb(ai, free, pnum, ec, scrub);
+ continue;
+ } else if (err == 0 || err == UBI_IO_BITFLIPS) {
+ dbg_bld("Found non empty PEB:%i in pool", pnum);
+diff --git a/drivers/net/ethernet/mellanox/mlx4/cq.c b/drivers/net/ethernet/mellanox/mlx4/cq.c
+index 56022d647837..f0cab2d3532f 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/cq.c
++++ b/drivers/net/ethernet/mellanox/mlx4/cq.c
+@@ -56,13 +56,19 @@ void mlx4_cq_completion(struct mlx4_dev *dev, u32 cqn)
+ {
+ struct mlx4_cq *cq;
+
++ rcu_read_lock();
+ cq = radix_tree_lookup(&mlx4_priv(dev)->cq_table.tree,
+ cqn & (dev->caps.num_cqs - 1));
++ rcu_read_unlock();
++
+ if (!cq) {
+ mlx4_dbg(dev, "Completion event for bogus CQ %08x\n", cqn);
+ return;
+ }
+
++ /* Acessing the CQ outside of rcu_read_lock is safe, because
++ * the CQ is freed only after interrupt handling is completed.
++ */
+ ++cq->arm_sn;
+
+ cq->comp(cq);
+@@ -73,23 +79,19 @@ void mlx4_cq_event(struct mlx4_dev *dev, u32 cqn, int event_type)
+ struct mlx4_cq_table *cq_table = &mlx4_priv(dev)->cq_table;
+ struct mlx4_cq *cq;
+
+- spin_lock(&cq_table->lock);
+-
++ rcu_read_lock();
+ cq = radix_tree_lookup(&cq_table->tree, cqn & (dev->caps.num_cqs - 1));
+- if (cq)
+- atomic_inc(&cq->refcount);
+-
+- spin_unlock(&cq_table->lock);
++ rcu_read_unlock();
+
+ if (!cq) {
+- mlx4_warn(dev, "Async event for bogus CQ %08x\n", cqn);
++ mlx4_dbg(dev, "Async event for bogus CQ %08x\n", cqn);
+ return;
+ }
+
++ /* Acessing the CQ outside of rcu_read_lock is safe, because
++ * the CQ is freed only after interrupt handling is completed.
++ */
+ cq->event(cq, event_type);
+-
+- if (atomic_dec_and_test(&cq->refcount))
+- complete(&cq->free);
+ }
+
+ static int mlx4_SW2HW_CQ(struct mlx4_dev *dev, struct mlx4_cmd_mailbox *mailbox,
+@@ -256,9 +258,9 @@ int mlx4_cq_alloc(struct mlx4_dev *dev, int nent,
+ if (err)
+ return err;
+
+- spin_lock_irq(&cq_table->lock);
++ spin_lock(&cq_table->lock);
+ err = radix_tree_insert(&cq_table->tree, cq->cqn, cq);
+- spin_unlock_irq(&cq_table->lock);
++ spin_unlock(&cq_table->lock);
+ if (err)
+ goto err_icm;
+
+@@ -297,9 +299,9 @@ int mlx4_cq_alloc(struct mlx4_dev *dev, int nent,
+ return 0;
+
+ err_radix:
+- spin_lock_irq(&cq_table->lock);
++ spin_lock(&cq_table->lock);
+ radix_tree_delete(&cq_table->tree, cq->cqn);
+- spin_unlock_irq(&cq_table->lock);
++ spin_unlock(&cq_table->lock);
+
+ err_icm:
+ mlx4_cq_free_icm(dev, cq->cqn);
+@@ -314,16 +316,16 @@ void mlx4_cq_free(struct mlx4_dev *dev, struct mlx4_cq *cq)
+ struct mlx4_cq_table *cq_table = &priv->cq_table;
+ int err;
+
++ spin_lock(&cq_table->lock);
++ radix_tree_delete(&cq_table->tree, cq->cqn);
++ spin_unlock(&cq_table->lock);
++
+ err = mlx4_HW2SW_CQ(dev, NULL, cq->cqn);
+ if (err)
+ mlx4_warn(dev, "HW2SW_CQ failed (%d) for CQN %06x\n", err, cq->cqn);
+
+ synchronize_irq(priv->eq_table.eq[cq->vector].irq);
+
+- spin_lock_irq(&cq_table->lock);
+- radix_tree_delete(&cq_table->tree, cq->cqn);
+- spin_unlock_irq(&cq_table->lock);
+-
+ if (atomic_dec_and_test(&cq->refcount))
+ complete(&cq->free);
+ wait_for_completion(&cq->free);
+diff --git a/drivers/net/ethernet/mellanox/mlx4/en_rx.c b/drivers/net/ethernet/mellanox/mlx4/en_rx.c
+index 5bbb59dce4d5..c175938d9717 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/en_rx.c
++++ b/drivers/net/ethernet/mellanox/mlx4/en_rx.c
+@@ -438,8 +438,14 @@ int mlx4_en_activate_rx_rings(struct mlx4_en_priv *priv)
+ ring->cqn = priv->rx_cq[ring_ind]->mcq.cqn;
+
+ ring->stride = stride;
+- if (ring->stride <= TXBB_SIZE)
++ if (ring->stride <= TXBB_SIZE) {
++ /* Stamp first unused send wqe */
++ __be32 *ptr = (__be32 *)ring->buf;
++ __be32 stamp = cpu_to_be32(1 << STAMP_SHIFT);
++ *ptr = stamp;
++ /* Move pointer to start of rx section */
+ ring->buf += TXBB_SIZE;
++ }
+
+ ring->log_stride = ffs(ring->stride) - 1;
+ ring->buf_size = ring->size * ring->stride;
+@@ -501,8 +507,11 @@ void mlx4_en_recover_from_oom(struct mlx4_en_priv *priv)
+ return;
+
+ for (ring = 0; ring < priv->rx_ring_num; ring++) {
+- if (mlx4_en_is_ring_empty(priv->rx_ring[ring]))
++ if (mlx4_en_is_ring_empty(priv->rx_ring[ring])) {
++ local_bh_disable();
+ napi_reschedule(&priv->rx_cq[ring]->napi);
++ local_bh_enable();
++ }
+ }
+ }
+
+diff --git a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
+index e57df91bad06..fbb0c02276f9 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
++++ b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
+@@ -2769,6 +2769,9 @@ int mlx4_RST2INIT_QP_wrapper(struct mlx4_dev *dev, int slave,
+ put_res(dev, slave, srqn, RES_SRQ);
+ qp->srq = srq;
+ }
++
++ /* Save param3 for dynamic changes from VST back to VGT */
++ qp->param3 = qpc->param3;
+ put_res(dev, slave, rcqn, RES_CQ);
+ put_res(dev, slave, mtt_base, RES_MTT);
+ res_end_move(dev, slave, RES_QP, qpn);
+@@ -3531,7 +3534,6 @@ int mlx4_INIT2RTR_QP_wrapper(struct mlx4_dev *dev, int slave,
+ int qpn = vhcr->in_modifier & 0x7fffff;
+ struct res_qp *qp;
+ u8 orig_sched_queue;
+- __be32 orig_param3 = qpc->param3;
+ u8 orig_vlan_control = qpc->pri_path.vlan_control;
+ u8 orig_fvl_rx = qpc->pri_path.fvl_rx;
+ u8 orig_pri_path_fl = qpc->pri_path.fl;
+@@ -3572,7 +3574,6 @@ out:
+ */
+ if (!err) {
+ qp->sched_queue = orig_sched_queue;
+- qp->param3 = orig_param3;
+ qp->vlan_control = orig_vlan_control;
+ qp->fvl_rx = orig_fvl_rx;
+ qp->pri_path_fl = orig_pri_path_fl;
+diff --git a/drivers/net/ethernet/smsc/smc91x.c b/drivers/net/ethernet/smsc/smc91x.c
+index 6cc3cf6f17c8..9a289e79e8a7 100644
+--- a/drivers/net/ethernet/smsc/smc91x.c
++++ b/drivers/net/ethernet/smsc/smc91x.c
+@@ -535,7 +535,7 @@ static inline void smc_rcv(struct net_device *dev)
+ #define smc_special_lock(lock, flags) spin_lock_irqsave(lock, flags)
+ #define smc_special_unlock(lock, flags) spin_unlock_irqrestore(lock, flags)
+ #else
+-#define smc_special_trylock(lock, flags) (flags == flags)
++#define smc_special_trylock(lock, flags) ((void)flags, true)
+ #define smc_special_lock(lock, flags) do { flags = 0; } while (0)
+ #define smc_special_unlock(lock, flags) do { flags = 0; } while (0)
+ #endif
+diff --git a/drivers/net/ethernet/ti/cpmac.c b/drivers/net/ethernet/ti/cpmac.c
+index dd9430043536..cf5ce371ec21 100644
+--- a/drivers/net/ethernet/ti/cpmac.c
++++ b/drivers/net/ethernet/ti/cpmac.c
+@@ -1235,7 +1235,7 @@ int cpmac_init(void)
+ goto fail_alloc;
+ }
+
+-#warning FIXME: unhardcode gpio&reset bits
++ /* FIXME: unhardcode gpio&reset bits */
+ ar7_gpio_disable(26);
+ ar7_gpio_disable(27);
+ ar7_device_reset(AR7_RESET_BIT_CPMAC_LO);
+diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
+index 59282dd2d9e0..2dc89582575a 100644
+--- a/drivers/net/vxlan.c
++++ b/drivers/net/vxlan.c
+@@ -2260,7 +2260,7 @@ static int vxlan_validate(struct nlattr *tb[], struct nlattr *data[])
+
+ if (data[IFLA_VXLAN_ID]) {
+ __u32 id = nla_get_u32(data[IFLA_VXLAN_ID]);
+- if (id >= VXLAN_VID_MASK)
++ if (id >= VXLAN_N_VID)
+ return -ERANGE;
+ }
+
+diff --git a/drivers/pwm/core.c b/drivers/pwm/core.c
+index 966497d10c6e..f3c64b38f1d3 100644
+--- a/drivers/pwm/core.c
++++ b/drivers/pwm/core.c
+@@ -293,6 +293,8 @@ int pwmchip_remove(struct pwm_chip *chip)
+ unsigned int i;
+ int ret = 0;
+
++ pwmchip_sysfs_unexport_children(chip);
++
+ mutex_lock(&pwm_lock);
+
+ for (i = 0; i < chip->npwm; i++) {
+diff --git a/drivers/pwm/sysfs.c b/drivers/pwm/sysfs.c
+index 4bd0c639e16d..6c88e1adf637 100644
+--- a/drivers/pwm/sysfs.c
++++ b/drivers/pwm/sysfs.c
+@@ -340,6 +340,24 @@ void pwmchip_sysfs_unexport(struct pwm_chip *chip)
+ }
+ }
+
++void pwmchip_sysfs_unexport_children(struct pwm_chip *chip)
++{
++ struct device *parent;
++ unsigned int i;
++
++ parent = class_find_device(&pwm_class, NULL, chip,
++ pwmchip_sysfs_match);
++ if (!parent)
++ return;
++
++ for (i = 0; i < chip->npwm; i++) {
++ struct pwm_device *pwm = &chip->pwms[i];
++
++ if (test_bit(PWMF_EXPORTED, &pwm->flags))
++ pwm_unexport_child(parent, pwm);
++ }
++}
++
+ static int __init pwm_sysfs_init(void)
+ {
+ return class_register(&pwm_class);
+diff --git a/drivers/s390/cio/qdio_thinint.c b/drivers/s390/cio/qdio_thinint.c
+index 5d06253c2a7a..30e9fbbff051 100644
+--- a/drivers/s390/cio/qdio_thinint.c
++++ b/drivers/s390/cio/qdio_thinint.c
+@@ -147,11 +147,11 @@ static inline void tiqdio_call_inq_handlers(struct qdio_irq *irq)
+ struct qdio_q *q;
+ int i;
+
+- for_each_input_queue(irq, q, i) {
+- if (!references_shared_dsci(irq) &&
+- has_multiple_inq_on_dsci(irq))
+- xchg(q->irq_ptr->dsci, 0);
++ if (!references_shared_dsci(irq) &&
++ has_multiple_inq_on_dsci(irq))
++ xchg(irq->dsci, 0);
+
++ for_each_input_queue(irq, q, i) {
+ if (q->u.in.queue_start_poll) {
+ /* skip if polling is enabled or already in work */
+ if (test_and_set_bit(QDIO_QUEUE_IRQS_DISABLED,
+diff --git a/drivers/scsi/mvsas/mv_sas.c b/drivers/scsi/mvsas/mv_sas.c
+index 89215d44d83f..f054d8dee013 100644
+--- a/drivers/scsi/mvsas/mv_sas.c
++++ b/drivers/scsi/mvsas/mv_sas.c
+@@ -737,8 +737,8 @@ static int mvs_task_prep(struct sas_task *task, struct mvs_info *mvi, int is_tmf
+ mv_dprintk("device %016llx not ready.\n",
+ SAS_ADDR(dev->sas_addr));
+
+- rc = SAS_PHY_DOWN;
+- return rc;
++ rc = SAS_PHY_DOWN;
++ return rc;
+ }
+ tei.port = dev->port->lldd_port;
+ if (tei.port && !tei.port->port_attached && !tmf) {
+diff --git a/drivers/staging/android/ashmem.c b/drivers/staging/android/ashmem.c
+index ad4f5790a76f..658d640022be 100644
+--- a/drivers/staging/android/ashmem.c
++++ b/drivers/staging/android/ashmem.c
+@@ -392,6 +392,7 @@ static int ashmem_mmap(struct file *file, struct vm_area_struct *vma)
+ ret = PTR_ERR(vmfile);
+ goto out;
+ }
++ vmfile->f_mode |= FMODE_LSEEK;
+ asma->file = vmfile;
+ }
+ get_file(asma->file);
+diff --git a/drivers/staging/android/binder.c b/drivers/staging/android/binder.c
+index c69c40d69d5c..2186380a6f51 100644
+--- a/drivers/staging/android/binder.c
++++ b/drivers/staging/android/binder.c
+@@ -998,7 +998,7 @@ static int binder_dec_node(struct binder_node *node, int strong, int internal)
+
+
+ static struct binder_ref *binder_get_ref(struct binder_proc *proc,
+- uint32_t desc)
++ u32 desc, bool need_strong_ref)
+ {
+ struct rb_node *n = proc->refs_by_desc.rb_node;
+ struct binder_ref *ref;
+@@ -1006,12 +1006,16 @@ static struct binder_ref *binder_get_ref(struct binder_proc *proc,
+ while (n) {
+ ref = rb_entry(n, struct binder_ref, rb_node_desc);
+
+- if (desc < ref->desc)
++ if (desc < ref->desc) {
+ n = n->rb_left;
+- else if (desc > ref->desc)
++ } else if (desc > ref->desc) {
+ n = n->rb_right;
+- else
++ } else if (need_strong_ref && !ref->strong) {
++ binder_user_error("tried to use weak ref as strong ref\n");
++ return NULL;
++ } else {
+ return ref;
++ }
+ }
+ return NULL;
+ }
+@@ -1281,7 +1285,10 @@ static void binder_transaction_buffer_release(struct binder_proc *proc,
+ } break;
+ case BINDER_TYPE_HANDLE:
+ case BINDER_TYPE_WEAK_HANDLE: {
+- struct binder_ref *ref = binder_get_ref(proc, fp->handle);
++ struct binder_ref *ref;
++
++ ref = binder_get_ref(proc, fp->handle,
++ fp->type == BINDER_TYPE_HANDLE);
+
+ if (ref == NULL) {
+ pr_err("transaction release %d bad handle %d\n",
+@@ -1375,7 +1382,7 @@ static void binder_transaction(struct binder_proc *proc,
+ if (tr->target.handle) {
+ struct binder_ref *ref;
+
+- ref = binder_get_ref(proc, tr->target.handle);
++ ref = binder_get_ref(proc, tr->target.handle, true);
+ if (ref == NULL) {
+ binder_user_error("%d:%d got transaction to invalid handle\n",
+ proc->pid, thread->pid);
+@@ -1556,7 +1563,9 @@ static void binder_transaction(struct binder_proc *proc,
+ fp->type = BINDER_TYPE_HANDLE;
+ else
+ fp->type = BINDER_TYPE_WEAK_HANDLE;
++ fp->binder = 0;
+ fp->handle = ref->desc;
++ fp->cookie = 0;
+ binder_inc_ref(ref, fp->type == BINDER_TYPE_HANDLE,
+ &thread->todo);
+
+@@ -1568,7 +1577,10 @@ static void binder_transaction(struct binder_proc *proc,
+ } break;
+ case BINDER_TYPE_HANDLE:
+ case BINDER_TYPE_WEAK_HANDLE: {
+- struct binder_ref *ref = binder_get_ref(proc, fp->handle);
++ struct binder_ref *ref;
++
++ ref = binder_get_ref(proc, fp->handle,
++ fp->type == BINDER_TYPE_HANDLE);
+
+ if (ref == NULL) {
+ binder_user_error("%d:%d got transaction with invalid handle, %d\n",
+@@ -1598,7 +1610,9 @@ static void binder_transaction(struct binder_proc *proc,
+ return_error = BR_FAILED_REPLY;
+ goto err_binder_get_ref_for_node_failed;
+ }
++ fp->binder = 0;
+ fp->handle = new_ref->desc;
++ fp->cookie = 0;
+ binder_inc_ref(new_ref, fp->type == BINDER_TYPE_HANDLE, NULL);
+ trace_binder_transaction_ref_to_ref(t, ref,
+ new_ref);
+@@ -1645,6 +1659,7 @@ static void binder_transaction(struct binder_proc *proc,
+ binder_debug(BINDER_DEBUG_TRANSACTION,
+ " fd %d -> %d\n", fp->handle, target_fd);
+ /* TODO: fput? */
++ fp->binder = 0;
+ fp->handle = target_fd;
+ } break;
+
+@@ -1767,7 +1782,9 @@ static int binder_thread_write(struct binder_proc *proc,
+ ref->desc);
+ }
+ } else
+- ref = binder_get_ref(proc, target);
++ ref = binder_get_ref(proc, target,
++ cmd == BC_ACQUIRE ||
++ cmd == BC_RELEASE);
+ if (ref == NULL) {
+ binder_user_error("%d:%d refcount change on invalid ref %d\n",
+ proc->pid, thread->pid, target);
+@@ -1963,7 +1980,7 @@ static int binder_thread_write(struct binder_proc *proc,
+ if (get_user(cookie, (binder_uintptr_t __user *)ptr))
+ return -EFAULT;
+ ptr += sizeof(binder_uintptr_t);
+- ref = binder_get_ref(proc, target);
++ ref = binder_get_ref(proc, target, false);
+ if (ref == NULL) {
+ binder_user_error("%d:%d %s invalid ref %d\n",
+ proc->pid, thread->pid,
+diff --git a/drivers/staging/iio/impedance-analyzer/ad5933.c b/drivers/staging/iio/impedance-analyzer/ad5933.c
+index b6bd609c3655..3559e1d19c3a 100644
+--- a/drivers/staging/iio/impedance-analyzer/ad5933.c
++++ b/drivers/staging/iio/impedance-analyzer/ad5933.c
+@@ -647,6 +647,7 @@ static void ad5933_work(struct work_struct *work)
+ struct iio_dev *indio_dev = i2c_get_clientdata(st->client);
+ signed short buf[2];
+ unsigned char status;
++ int ret;
+
+ mutex_lock(&indio_dev->mlock);
+ if (st->state == AD5933_CTRL_INIT_START_FREQ) {
+@@ -654,19 +655,22 @@ static void ad5933_work(struct work_struct *work)
+ ad5933_cmd(st, AD5933_CTRL_START_SWEEP);
+ st->state = AD5933_CTRL_START_SWEEP;
+ schedule_delayed_work(&st->work, st->poll_time_jiffies);
+- mutex_unlock(&indio_dev->mlock);
+- return;
++ goto out;
+ }
+
+- ad5933_i2c_read(st->client, AD5933_REG_STATUS, 1, &status);
++ ret = ad5933_i2c_read(st->client, AD5933_REG_STATUS, 1, &status);
++ if (ret)
++ goto out;
+
+ if (status & AD5933_STAT_DATA_VALID) {
+ int scan_count = bitmap_weight(indio_dev->active_scan_mask,
+ indio_dev->masklength);
+- ad5933_i2c_read(st->client,
++ ret = ad5933_i2c_read(st->client,
+ test_bit(1, indio_dev->active_scan_mask) ?
+ AD5933_REG_REAL_DATA : AD5933_REG_IMAG_DATA,
+ scan_count * 2, (u8 *)buf);
++ if (ret)
++ goto out;
+
+ if (scan_count == 2) {
+ buf[0] = be16_to_cpu(buf[0]);
+@@ -678,8 +682,7 @@ static void ad5933_work(struct work_struct *work)
+ } else {
+ /* no data available - try again later */
+ schedule_delayed_work(&st->work, st->poll_time_jiffies);
+- mutex_unlock(&indio_dev->mlock);
+- return;
++ goto out;
+ }
+
+ if (status & AD5933_STAT_SWEEP_DONE) {
+@@ -691,7 +694,7 @@ static void ad5933_work(struct work_struct *work)
+ ad5933_cmd(st, AD5933_CTRL_INC_FREQ);
+ schedule_delayed_work(&st->work, st->poll_time_jiffies);
+ }
+-
++out:
+ mutex_unlock(&indio_dev->mlock);
+ }
+
+diff --git a/drivers/staging/nvec/nvec_ps2.c b/drivers/staging/nvec/nvec_ps2.c
+index f56f1db15bad..3f631c067f54 100644
+--- a/drivers/staging/nvec/nvec_ps2.c
++++ b/drivers/staging/nvec/nvec_ps2.c
+@@ -106,13 +106,12 @@ static int nvec_mouse_probe(struct platform_device *pdev)
+ {
+ struct nvec_chip *nvec = dev_get_drvdata(pdev->dev.parent);
+ struct serio *ser_dev;
+- char mouse_reset[] = { NVEC_PS2, SEND_COMMAND, PSMOUSE_RST, 3 };
+
+ ser_dev = devm_kzalloc(&pdev->dev, sizeof(struct serio), GFP_KERNEL);
+ if (ser_dev == NULL)
+ return -ENOMEM;
+
+- ser_dev->id.type = SERIO_PS_PSTHRU;
++ ser_dev->id.type = SERIO_8042;
+ ser_dev->write = ps2_sendcommand;
+ ser_dev->start = ps2_startstreaming;
+ ser_dev->stop = ps2_stopstreaming;
+@@ -127,9 +126,6 @@ static int nvec_mouse_probe(struct platform_device *pdev)
+
+ serio_register_port(ser_dev);
+
+- /* mouse reset */
+- nvec_write_async(nvec, mouse_reset, sizeof(mouse_reset));
+-
+ return 0;
+ }
+
+diff --git a/drivers/tty/n_hdlc.c b/drivers/tty/n_hdlc.c
+index 644ddb841d9f..6d1e2f746ab4 100644
+--- a/drivers/tty/n_hdlc.c
++++ b/drivers/tty/n_hdlc.c
+@@ -114,7 +114,7 @@
+ #define DEFAULT_TX_BUF_COUNT 3
+
+ struct n_hdlc_buf {
+- struct n_hdlc_buf *link;
++ struct list_head list_item;
+ int count;
+ char buf[1];
+ };
+@@ -122,8 +122,7 @@ struct n_hdlc_buf {
+ #define N_HDLC_BUF_SIZE (sizeof(struct n_hdlc_buf) + maxframe)
+
+ struct n_hdlc_buf_list {
+- struct n_hdlc_buf *head;
+- struct n_hdlc_buf *tail;
++ struct list_head list;
+ int count;
+ spinlock_t spinlock;
+ };
+@@ -136,7 +135,6 @@ struct n_hdlc_buf_list {
+ * @backup_tty - TTY to use if tty gets closed
+ * @tbusy - reentrancy flag for tx wakeup code
+ * @woke_up - FIXME: describe this field
+- * @tbuf - currently transmitting tx buffer
+ * @tx_buf_list - list of pending transmit frame buffers
+ * @rx_buf_list - list of received frame buffers
+ * @tx_free_buf_list - list unused transmit frame buffers
+@@ -149,7 +147,6 @@ struct n_hdlc {
+ struct tty_struct *backup_tty;
+ int tbusy;
+ int woke_up;
+- struct n_hdlc_buf *tbuf;
+ struct n_hdlc_buf_list tx_buf_list;
+ struct n_hdlc_buf_list rx_buf_list;
+ struct n_hdlc_buf_list tx_free_buf_list;
+@@ -159,7 +156,8 @@ struct n_hdlc {
+ /*
+ * HDLC buffer list manipulation functions
+ */
+-static void n_hdlc_buf_list_init(struct n_hdlc_buf_list *list);
++static void n_hdlc_buf_return(struct n_hdlc_buf_list *buf_list,
++ struct n_hdlc_buf *buf);
+ static void n_hdlc_buf_put(struct n_hdlc_buf_list *list,
+ struct n_hdlc_buf *buf);
+ static struct n_hdlc_buf *n_hdlc_buf_get(struct n_hdlc_buf_list *list);
+@@ -209,16 +207,9 @@ static void flush_tx_queue(struct tty_struct *tty)
+ {
+ struct n_hdlc *n_hdlc = tty2n_hdlc(tty);
+ struct n_hdlc_buf *buf;
+- unsigned long flags;
+
+ while ((buf = n_hdlc_buf_get(&n_hdlc->tx_buf_list)))
+ n_hdlc_buf_put(&n_hdlc->tx_free_buf_list, buf);
+- spin_lock_irqsave(&n_hdlc->tx_buf_list.spinlock, flags);
+- if (n_hdlc->tbuf) {
+- n_hdlc_buf_put(&n_hdlc->tx_free_buf_list, n_hdlc->tbuf);
+- n_hdlc->tbuf = NULL;
+- }
+- spin_unlock_irqrestore(&n_hdlc->tx_buf_list.spinlock, flags);
+ }
+
+ static struct tty_ldisc_ops n_hdlc_ldisc = {
+@@ -284,7 +275,6 @@ static void n_hdlc_release(struct n_hdlc *n_hdlc)
+ } else
+ break;
+ }
+- kfree(n_hdlc->tbuf);
+ kfree(n_hdlc);
+
+ } /* end of n_hdlc_release() */
+@@ -403,13 +393,7 @@ static void n_hdlc_send_frames(struct n_hdlc *n_hdlc, struct tty_struct *tty)
+ n_hdlc->woke_up = 0;
+ spin_unlock_irqrestore(&n_hdlc->tx_buf_list.spinlock, flags);
+
+- /* get current transmit buffer or get new transmit */
+- /* buffer from list of pending transmit buffers */
+-
+- tbuf = n_hdlc->tbuf;
+- if (!tbuf)
+- tbuf = n_hdlc_buf_get(&n_hdlc->tx_buf_list);
+-
++ tbuf = n_hdlc_buf_get(&n_hdlc->tx_buf_list);
+ while (tbuf) {
+ if (debuglevel >= DEBUG_LEVEL_INFO)
+ printk("%s(%d)sending frame %p, count=%d\n",
+@@ -421,7 +405,7 @@ static void n_hdlc_send_frames(struct n_hdlc *n_hdlc, struct tty_struct *tty)
+
+ /* rollback was possible and has been done */
+ if (actual == -ERESTARTSYS) {
+- n_hdlc->tbuf = tbuf;
++ n_hdlc_buf_return(&n_hdlc->tx_buf_list, tbuf);
+ break;
+ }
+ /* if transmit error, throw frame away by */
+@@ -436,10 +420,7 @@ static void n_hdlc_send_frames(struct n_hdlc *n_hdlc, struct tty_struct *tty)
+
+ /* free current transmit buffer */
+ n_hdlc_buf_put(&n_hdlc->tx_free_buf_list, tbuf);
+-
+- /* this tx buffer is done */
+- n_hdlc->tbuf = NULL;
+-
++
+ /* wait up sleeping writers */
+ wake_up_interruptible(&tty->write_wait);
+
+@@ -449,10 +430,12 @@ static void n_hdlc_send_frames(struct n_hdlc *n_hdlc, struct tty_struct *tty)
+ if (debuglevel >= DEBUG_LEVEL_INFO)
+ printk("%s(%d)frame %p pending\n",
+ __FILE__,__LINE__,tbuf);
+-
+- /* buffer not accepted by driver */
+- /* set this buffer as pending buffer */
+- n_hdlc->tbuf = tbuf;
++
++ /*
++ * the buffer was not accepted by driver,
++ * return it back into tx queue
++ */
++ n_hdlc_buf_return(&n_hdlc->tx_buf_list, tbuf);
+ break;
+ }
+ }
+@@ -750,7 +733,8 @@ static int n_hdlc_tty_ioctl(struct tty_struct *tty, struct file *file,
+ int error = 0;
+ int count;
+ unsigned long flags;
+-
++ struct n_hdlc_buf *buf = NULL;
++
+ if (debuglevel >= DEBUG_LEVEL_INFO)
+ printk("%s(%d)n_hdlc_tty_ioctl() called %d\n",
+ __FILE__,__LINE__,cmd);
+@@ -764,8 +748,10 @@ static int n_hdlc_tty_ioctl(struct tty_struct *tty, struct file *file,
+ /* report count of read data available */
+ /* in next available frame (if any) */
+ spin_lock_irqsave(&n_hdlc->rx_buf_list.spinlock,flags);
+- if (n_hdlc->rx_buf_list.head)
+- count = n_hdlc->rx_buf_list.head->count;
++ buf = list_first_entry_or_null(&n_hdlc->rx_buf_list.list,
++ struct n_hdlc_buf, list_item);
++ if (buf)
++ count = buf->count;
+ else
+ count = 0;
+ spin_unlock_irqrestore(&n_hdlc->rx_buf_list.spinlock,flags);
+@@ -777,8 +763,10 @@ static int n_hdlc_tty_ioctl(struct tty_struct *tty, struct file *file,
+ count = tty_chars_in_buffer(tty);
+ /* add size of next output frame in queue */
+ spin_lock_irqsave(&n_hdlc->tx_buf_list.spinlock,flags);
+- if (n_hdlc->tx_buf_list.head)
+- count += n_hdlc->tx_buf_list.head->count;
++ buf = list_first_entry_or_null(&n_hdlc->tx_buf_list.list,
++ struct n_hdlc_buf, list_item);
++ if (buf)
++ count += buf->count;
+ spin_unlock_irqrestore(&n_hdlc->tx_buf_list.spinlock,flags);
+ error = put_user(count, (int __user *)arg);
+ break;
+@@ -826,14 +814,14 @@ static unsigned int n_hdlc_tty_poll(struct tty_struct *tty, struct file *filp,
+ poll_wait(filp, &tty->write_wait, wait);
+
+ /* set bits for operations that won't block */
+- if (n_hdlc->rx_buf_list.head)
++ if (!list_empty(&n_hdlc->rx_buf_list.list))
+ mask |= POLLIN | POLLRDNORM; /* readable */
+ if (test_bit(TTY_OTHER_CLOSED, &tty->flags))
+ mask |= POLLHUP;
+ if (tty_hung_up_p(filp))
+ mask |= POLLHUP;
+ if (!tty_is_writelocked(tty) &&
+- n_hdlc->tx_free_buf_list.head)
++ !list_empty(&n_hdlc->tx_free_buf_list.list))
+ mask |= POLLOUT | POLLWRNORM; /* writable */
+ }
+ return mask;
+@@ -853,11 +841,16 @@ static struct n_hdlc *n_hdlc_alloc(void)
+ if (!n_hdlc)
+ return NULL;
+
+- n_hdlc_buf_list_init(&n_hdlc->rx_free_buf_list);
+- n_hdlc_buf_list_init(&n_hdlc->tx_free_buf_list);
+- n_hdlc_buf_list_init(&n_hdlc->rx_buf_list);
+- n_hdlc_buf_list_init(&n_hdlc->tx_buf_list);
+-
++ spin_lock_init(&n_hdlc->rx_free_buf_list.spinlock);
++ spin_lock_init(&n_hdlc->tx_free_buf_list.spinlock);
++ spin_lock_init(&n_hdlc->rx_buf_list.spinlock);
++ spin_lock_init(&n_hdlc->tx_buf_list.spinlock);
++
++ INIT_LIST_HEAD(&n_hdlc->rx_free_buf_list.list);
++ INIT_LIST_HEAD(&n_hdlc->tx_free_buf_list.list);
++ INIT_LIST_HEAD(&n_hdlc->rx_buf_list.list);
++ INIT_LIST_HEAD(&n_hdlc->tx_buf_list.list);
++
+ /* allocate free rx buffer list */
+ for(i=0;i<DEFAULT_RX_BUF_COUNT;i++) {
+ buf = kmalloc(N_HDLC_BUF_SIZE, GFP_KERNEL);
+@@ -885,63 +878,65 @@ static struct n_hdlc *n_hdlc_alloc(void)
+ } /* end of n_hdlc_alloc() */
+
+ /**
+- * n_hdlc_buf_list_init - initialize specified HDLC buffer list
+- * @list - pointer to buffer list
++ * n_hdlc_buf_return - put the HDLC buffer after the head of the specified list
++ * @buf_list - pointer to the buffer list
++ * @buf - pointer to the buffer
+ */
+-static void n_hdlc_buf_list_init(struct n_hdlc_buf_list *list)
++static void n_hdlc_buf_return(struct n_hdlc_buf_list *buf_list,
++ struct n_hdlc_buf *buf)
+ {
+- memset(list, 0, sizeof(*list));
+- spin_lock_init(&list->spinlock);
+-} /* end of n_hdlc_buf_list_init() */
++ unsigned long flags;
++
++ spin_lock_irqsave(&buf_list->spinlock, flags);
++
++ list_add(&buf->list_item, &buf_list->list);
++ buf_list->count++;
++
++ spin_unlock_irqrestore(&buf_list->spinlock, flags);
++}
+
+ /**
+ * n_hdlc_buf_put - add specified HDLC buffer to tail of specified list
+- * @list - pointer to buffer list
++ * @buf_list - pointer to buffer list
+ * @buf - pointer to buffer
+ */
+-static void n_hdlc_buf_put(struct n_hdlc_buf_list *list,
++static void n_hdlc_buf_put(struct n_hdlc_buf_list *buf_list,
+ struct n_hdlc_buf *buf)
+ {
+ unsigned long flags;
+- spin_lock_irqsave(&list->spinlock,flags);
+-
+- buf->link=NULL;
+- if (list->tail)
+- list->tail->link = buf;
+- else
+- list->head = buf;
+- list->tail = buf;
+- (list->count)++;
+-
+- spin_unlock_irqrestore(&list->spinlock,flags);
+-
++
++ spin_lock_irqsave(&buf_list->spinlock, flags);
++
++ list_add_tail(&buf->list_item, &buf_list->list);
++ buf_list->count++;
++
++ spin_unlock_irqrestore(&buf_list->spinlock, flags);
+ } /* end of n_hdlc_buf_put() */
+
+ /**
+ * n_hdlc_buf_get - remove and return an HDLC buffer from list
+- * @list - pointer to HDLC buffer list
++ * @buf_list - pointer to HDLC buffer list
+ *
+ * Remove and return an HDLC buffer from the head of the specified HDLC buffer
+ * list.
+ * Returns a pointer to HDLC buffer if available, otherwise %NULL.
+ */
+-static struct n_hdlc_buf* n_hdlc_buf_get(struct n_hdlc_buf_list *list)
++static struct n_hdlc_buf *n_hdlc_buf_get(struct n_hdlc_buf_list *buf_list)
+ {
+ unsigned long flags;
+ struct n_hdlc_buf *buf;
+- spin_lock_irqsave(&list->spinlock,flags);
+-
+- buf = list->head;
++
++ spin_lock_irqsave(&buf_list->spinlock, flags);
++
++ buf = list_first_entry_or_null(&buf_list->list,
++ struct n_hdlc_buf, list_item);
+ if (buf) {
+- list->head = buf->link;
+- (list->count)--;
++ list_del(&buf->list_item);
++ buf_list->count--;
+ }
+- if (!list->head)
+- list->tail = NULL;
+-
+- spin_unlock_irqrestore(&list->spinlock,flags);
++
++ spin_unlock_irqrestore(&buf_list->spinlock, flags);
+ return buf;
+-
+ } /* end of n_hdlc_buf_get() */
+
+ static char hdlc_banner[] __initdata =
+diff --git a/drivers/tty/serial/8250/8250_pci.c b/drivers/tty/serial/8250/8250_pci.c
+index f6e5ef5bac5e..786bc9e6bed9 100644
+--- a/drivers/tty/serial/8250/8250_pci.c
++++ b/drivers/tty/serial/8250/8250_pci.c
+@@ -2743,6 +2743,8 @@ enum pci_board_num_t {
+ pbn_b0_4_1152000_200,
+ pbn_b0_8_1152000_200,
+
++ pbn_b0_4_1250000,
++
+ pbn_b0_2_1843200,
+ pbn_b0_4_1843200,
+
+@@ -2971,6 +2973,13 @@ static struct pciserial_board pci_boards[] = {
+ .uart_offset = 0x200,
+ },
+
++ [pbn_b0_4_1250000] = {
++ .flags = FL_BASE0,
++ .num_ports = 4,
++ .base_baud = 1250000,
++ .uart_offset = 8,
++ },
++
+ [pbn_b0_2_1843200] = {
+ .flags = FL_BASE0,
+ .num_ports = 2,
+@@ -5464,6 +5473,10 @@ static struct pci_device_id serial_pci_tbl[] = {
+ { PCI_DEVICE(0x1c29, 0x1108), .driver_data = pbn_fintek_8 },
+ { PCI_DEVICE(0x1c29, 0x1112), .driver_data = pbn_fintek_12 },
+
++ /* MKS Tenta SCOM-080x serial cards */
++ { PCI_DEVICE(0x1601, 0x0800), .driver_data = pbn_b0_4_1250000 },
++ { PCI_DEVICE(0x1601, 0xa801), .driver_data = pbn_b0_4_1250000 },
++
+ /*
+ * These entries match devices with class COMMUNICATION_SERIAL,
+ * COMMUNICATION_MODEM or COMMUNICATION_MULTISERIAL
+diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c
+index 1a049e4de937..a57f3761ab47 100644
+--- a/drivers/tty/vt/vt.c
++++ b/drivers/tty/vt/vt.c
+@@ -1169,7 +1169,7 @@ static void csi_J(struct vc_data *vc, int vpar)
+ break;
+ case 3: /* erase scroll-back buffer (and whole display) */
+ scr_memsetw(vc->vc_screenbuf, vc->vc_video_erase_char,
+- vc->vc_screenbuf_size >> 1);
++ vc->vc_screenbuf_size);
+ set_origin(vc);
+ if (CON_IS_VISIBLE(vc))
+ update_screen(vc);
+diff --git a/drivers/usb/chipidea/core.c b/drivers/usb/chipidea/core.c
+index 9bdc6bd73432..78f4d70db917 100644
+--- a/drivers/usb/chipidea/core.c
++++ b/drivers/usb/chipidea/core.c
+@@ -594,6 +594,7 @@ static int ci_hdrc_probe(struct platform_device *pdev)
+ return -ENOMEM;
+ }
+
++ spin_lock_init(&ci->lock);
+ ci->dev = dev;
+ ci->platdata = dev_get_platdata(dev);
+ ci->imx28_write_fix = !!(ci->platdata->flags &
+diff --git a/drivers/usb/chipidea/udc.c b/drivers/usb/chipidea/udc.c
+index 7b362870277e..98d5882aa91b 100644
+--- a/drivers/usb/chipidea/udc.c
++++ b/drivers/usb/chipidea/udc.c
+@@ -1798,8 +1798,6 @@ static int udc_start(struct ci_hdrc *ci)
+ struct device *dev = ci->dev;
+ int retval = 0;
+
+- spin_lock_init(&ci->lock);
+-
+ ci->gadget.ops = &usb_gadget_ops;
+ ci->gadget.speed = USB_SPEED_UNKNOWN;
+ ci->gadget.max_speed = USB_SPEED_HIGH;
+diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
+index e2f63f5d30cb..201e9229d323 100644
+--- a/drivers/usb/class/cdc-acm.c
++++ b/drivers/usb/class/cdc-acm.c
+@@ -872,8 +872,6 @@ static int wait_serial_change(struct acm *acm, unsigned long arg)
+ DECLARE_WAITQUEUE(wait, current);
+ struct async_icount old, new;
+
+- if (arg & (TIOCM_DSR | TIOCM_RI | TIOCM_CD ))
+- return -EINVAL;
+ do {
+ spin_lock_irq(&acm->read_lock);
+ old = acm->oldcount;
+diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c
+index 81336acc7040..65e2cec1ca2a 100644
+--- a/drivers/usb/core/config.c
++++ b/drivers/usb/core/config.c
+@@ -208,6 +208,16 @@ static int usb_parse_endpoint(struct device *ddev, int cfgno, int inum,
+
+ /*
+ * Adjust bInterval for quirked devices.
++ */
++ /*
++ * This quirk fixes bIntervals reported in ms.
++ */
++ if (to_usb_device(ddev)->quirks &
++ USB_QUIRK_LINEAR_FRAME_INTR_BINTERVAL) {
++ n = clamp(fls(d->bInterval) + 3, i, j);
++ i = j = n;
++ }
++ /*
+ * This quirk fixes bIntervals reported in
+ * linear microframes.
+ */
+diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c
+index 096bb82c69c4..652e3e558257 100644
+--- a/drivers/usb/core/hcd.c
++++ b/drivers/usb/core/hcd.c
+@@ -498,8 +498,10 @@ static int rh_call_control (struct usb_hcd *hcd, struct urb *urb)
+ */
+ tbuf_size = max_t(u16, sizeof(struct usb_hub_descriptor), wLength);
+ tbuf = kzalloc(tbuf_size, GFP_KERNEL);
+- if (!tbuf)
+- return -ENOMEM;
++ if (!tbuf) {
++ status = -ENOMEM;
++ goto err_alloc;
++ }
+
+ bufp = tbuf;
+
+@@ -702,6 +704,7 @@ error:
+ }
+
+ kfree(tbuf);
++ err_alloc:
+
+ /* any errors get returned through the urb completion */
+ spin_lock_irq(&hcd_root_hub_lock);
+diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
+index 1a3df0f8b891..a3c136b03810 100644
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -2616,8 +2616,15 @@ static int hub_port_wait_reset(struct usb_hub *hub, int port1,
+ if (ret < 0)
+ return ret;
+
+- /* The port state is unknown until the reset completes. */
+- if (!(portstatus & USB_PORT_STAT_RESET))
++ /*
++ * The port state is unknown until the reset completes.
++ *
++ * On top of that, some chips may require additional time
++ * to re-establish a connection after the reset is complete,
++ * so also wait for the connection to be re-established.
++ */
++ if (!(portstatus & USB_PORT_STAT_RESET) &&
++ (portstatus & USB_PORT_STAT_CONNECTION))
+ break;
+
+ /* switch to the long delay after two short delay failures */
+@@ -4168,7 +4175,7 @@ static void hub_set_initial_usb2_lpm_policy(struct usb_device *udev)
+ struct usb_hub *hub = usb_hub_to_struct_hub(udev->parent);
+ int connect_type = USB_PORT_CONNECT_TYPE_UNKNOWN;
+
+- if (!udev->usb2_hw_lpm_capable)
++ if (!udev->usb2_hw_lpm_capable || !udev->bos)
+ return;
+
+ if (hub)
+diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
+index 6c7e47f67dd4..ab12e018de86 100644
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -163,6 +163,14 @@ static const struct usb_device_id usb_quirk_list[] = {
+ /* M-Systems Flash Disk Pioneers */
+ { USB_DEVICE(0x08ec, 0x1000), .driver_info = USB_QUIRK_RESET_RESUME },
+
++ /* Baum Vario Ultra */
++ { USB_DEVICE(0x0904, 0x6101), .driver_info =
++ USB_QUIRK_LINEAR_FRAME_INTR_BINTERVAL },
++ { USB_DEVICE(0x0904, 0x6102), .driver_info =
++ USB_QUIRK_LINEAR_FRAME_INTR_BINTERVAL },
++ { USB_DEVICE(0x0904, 0x6103), .driver_info =
++ USB_QUIRK_LINEAR_FRAME_INTR_BINTERVAL },
++
+ /* Keytouch QWERTY Panel keyboard */
+ { USB_DEVICE(0x0926, 0x3333), .driver_info =
+ USB_QUIRK_CONFIG_INTF_STRINGS },
+diff --git a/drivers/usb/dwc3/gadget.h b/drivers/usb/dwc3/gadget.h
+index 18ae3eaa8b6f..ccd9694f8e36 100644
+--- a/drivers/usb/dwc3/gadget.h
++++ b/drivers/usb/dwc3/gadget.h
+@@ -28,23 +28,23 @@ struct dwc3;
+ #define gadget_to_dwc(g) (container_of(g, struct dwc3, gadget))
+
+ /* DEPCFG parameter 1 */
+-#define DWC3_DEPCFG_INT_NUM(n) ((n) << 0)
++#define DWC3_DEPCFG_INT_NUM(n) (((n) & 0x1f) << 0)
+ #define DWC3_DEPCFG_XFER_COMPLETE_EN (1 << 8)
+ #define DWC3_DEPCFG_XFER_IN_PROGRESS_EN (1 << 9)
+ #define DWC3_DEPCFG_XFER_NOT_READY_EN (1 << 10)
+ #define DWC3_DEPCFG_FIFO_ERROR_EN (1 << 11)
+ #define DWC3_DEPCFG_STREAM_EVENT_EN (1 << 13)
+-#define DWC3_DEPCFG_BINTERVAL_M1(n) ((n) << 16)
++#define DWC3_DEPCFG_BINTERVAL_M1(n) (((n) & 0xff) << 16)
+ #define DWC3_DEPCFG_STREAM_CAPABLE (1 << 24)
+-#define DWC3_DEPCFG_EP_NUMBER(n) ((n) << 25)
++#define DWC3_DEPCFG_EP_NUMBER(n) (((n) & 0x1f) << 25)
+ #define DWC3_DEPCFG_BULK_BASED (1 << 30)
+ #define DWC3_DEPCFG_FIFO_BASED (1 << 31)
+
+ /* DEPCFG parameter 0 */
+-#define DWC3_DEPCFG_EP_TYPE(n) ((n) << 1)
+-#define DWC3_DEPCFG_MAX_PACKET_SIZE(n) ((n) << 3)
+-#define DWC3_DEPCFG_FIFO_NUMBER(n) ((n) << 17)
+-#define DWC3_DEPCFG_BURST_SIZE(n) ((n) << 22)
++#define DWC3_DEPCFG_EP_TYPE(n) (((n) & 0x3) << 1)
++#define DWC3_DEPCFG_MAX_PACKET_SIZE(n) (((n) & 0x7ff) << 3)
++#define DWC3_DEPCFG_FIFO_NUMBER(n) (((n) & 0x1f) << 17)
++#define DWC3_DEPCFG_BURST_SIZE(n) (((n) & 0xf) << 22)
+ #define DWC3_DEPCFG_DATA_SEQ_NUM(n) ((n) << 26)
+ /* This applies for core versions earlier than 1.94a */
+ #define DWC3_DEPCFG_IGN_SEQ_NUM (1 << 31)
+diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
+index ab9b7ac63407..58888b8bd389 100644
+--- a/drivers/usb/gadget/function/f_fs.c
++++ b/drivers/usb/gadget/function/f_fs.c
+@@ -1649,11 +1649,14 @@ static int ffs_func_eps_enable(struct ffs_function *func)
+ spin_lock_irqsave(&func->ffs->eps_lock, flags);
+ do {
+ struct usb_endpoint_descriptor *ds;
++ struct usb_ss_ep_comp_descriptor *comp_desc = NULL;
++ int needs_comp_desc = false;
+ int desc_idx;
+
+- if (ffs->gadget->speed == USB_SPEED_SUPER)
++ if (ffs->gadget->speed == USB_SPEED_SUPER) {
+ desc_idx = 2;
+- else if (ffs->gadget->speed == USB_SPEED_HIGH)
++ needs_comp_desc = true;
++ } else if (ffs->gadget->speed == USB_SPEED_HIGH)
+ desc_idx = 1;
+ else
+ desc_idx = 0;
+@@ -1670,6 +1673,14 @@ static int ffs_func_eps_enable(struct ffs_function *func)
+
+ ep->ep->driver_data = ep;
+ ep->ep->desc = ds;
++
++ comp_desc = (struct usb_ss_ep_comp_descriptor *)(ds +
++ USB_DT_ENDPOINT_SIZE);
++ ep->ep->maxburst = comp_desc->bMaxBurst + 1;
++
++ if (needs_comp_desc)
++ ep->ep->comp_desc = comp_desc;
++
+ ret = usb_ep_enable(ep->ep);
+ if (likely(!ret)) {
+ epfile->ep = ep;
+diff --git a/drivers/usb/gadget/function/f_uvc.c b/drivers/usb/gadget/function/f_uvc.c
+index 945b3bd2ca98..f4a0b25d1810 100644
+--- a/drivers/usb/gadget/function/f_uvc.c
++++ b/drivers/usb/gadget/function/f_uvc.c
+@@ -643,7 +643,7 @@ uvc_function_bind(struct usb_configuration *c, struct usb_function *f)
+ uvc_ss_streaming_comp.bMaxBurst = opts->streaming_maxburst;
+ uvc_ss_streaming_comp.wBytesPerInterval =
+ cpu_to_le16(max_packet_size * max_packet_mult *
+- opts->streaming_maxburst);
++ (opts->streaming_maxburst + 1));
+
+ /* Allocate endpoints. */
+ ep = usb_ep_autoconfig(cdev->gadget, &uvc_control_ep);
+diff --git a/drivers/usb/gadget/function/u_ether.c b/drivers/usb/gadget/function/u_ether.c
+index 2e7d27b4cf89..33011f8ee865 100644
+--- a/drivers/usb/gadget/function/u_ether.c
++++ b/drivers/usb/gadget/function/u_ether.c
+@@ -589,14 +589,6 @@ static netdev_tx_t eth_start_xmit(struct sk_buff *skb,
+
+ req->length = length;
+
+- /* throttle high/super speed IRQ rate back slightly */
+- if (gadget_is_dualspeed(dev->gadget))
+- req->no_interrupt = (((dev->gadget->speed == USB_SPEED_HIGH ||
+- dev->gadget->speed == USB_SPEED_SUPER)) &&
+- !list_empty(&dev->tx_reqs))
+- ? ((atomic_read(&dev->tx_qlen) % dev->qmult) != 0)
+- : 0;
+-
+ retval = usb_ep_queue(in, req, GFP_ATOMIC);
+ switch (retval) {
+ default:
+diff --git a/drivers/usb/gadget/udc/dummy_hcd.c b/drivers/usb/gadget/udc/dummy_hcd.c
+index 81dc5959e36b..53c747fed9d7 100644
+--- a/drivers/usb/gadget/udc/dummy_hcd.c
++++ b/drivers/usb/gadget/udc/dummy_hcd.c
+@@ -972,6 +972,8 @@ static int dummy_udc_probe(struct platform_device *pdev)
+ int rc;
+
+ dum = *((void **)dev_get_platdata(&pdev->dev));
++ /* Clear usb_gadget region for new registration to udc-core */
++ memzero_explicit(&dum->gadget, sizeof(struct usb_gadget));
+ dum->gadget.name = gadget_name;
+ dum->gadget.ops = &dummy_ops;
+ dum->gadget.max_speed = USB_SPEED_SUPER;
+diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c
+index 3dd487872bf1..8788799538eb 100644
+--- a/drivers/usb/host/xhci-plat.c
++++ b/drivers/usb/host/xhci-plat.c
+@@ -189,6 +189,8 @@ static int xhci_plat_remove(struct platform_device *dev)
+ struct xhci_hcd *xhci = hcd_to_xhci(hcd);
+ struct clk *clk = xhci->clk;
+
++ xhci->xhc_state |= XHCI_STATE_REMOVING;
++
+ usb_remove_hcd(xhci->shared_hcd);
+ usb_put_hcd(xhci->shared_hcd);
+
+diff --git a/drivers/usb/misc/idmouse.c b/drivers/usb/misc/idmouse.c
+index 4e38683c653c..6d4e75785710 100644
+--- a/drivers/usb/misc/idmouse.c
++++ b/drivers/usb/misc/idmouse.c
+@@ -346,6 +346,9 @@ static int idmouse_probe(struct usb_interface *interface,
+ if (iface_desc->desc.bInterfaceClass != 0x0A)
+ return -ENODEV;
+
++ if (iface_desc->desc.bNumEndpoints < 1)
++ return -ENODEV;
++
+ /* allocate memory for our device state and initialize it */
+ dev = kzalloc(sizeof(*dev), GFP_KERNEL);
+ if (dev == NULL)
+diff --git a/drivers/usb/misc/iowarrior.c b/drivers/usb/misc/iowarrior.c
+index 1950e87b4219..775690bed4c0 100644
+--- a/drivers/usb/misc/iowarrior.c
++++ b/drivers/usb/misc/iowarrior.c
+@@ -787,12 +787,6 @@ static int iowarrior_probe(struct usb_interface *interface,
+ iface_desc = interface->cur_altsetting;
+ dev->product_id = le16_to_cpu(udev->descriptor.idProduct);
+
+- if (iface_desc->desc.bNumEndpoints < 1) {
+- dev_err(&interface->dev, "Invalid number of endpoints\n");
+- retval = -EINVAL;
+- goto error;
+- }
+-
+ /* set up the endpoint information */
+ for (i = 0; i < iface_desc->desc.bNumEndpoints; ++i) {
+ endpoint = &iface_desc->endpoint[i].desc;
+@@ -803,6 +797,21 @@ static int iowarrior_probe(struct usb_interface *interface,
+ /* this one will match for the IOWarrior56 only */
+ dev->int_out_endpoint = endpoint;
+ }
++
++ if (!dev->int_in_endpoint) {
++ dev_err(&interface->dev, "no interrupt-in endpoint found\n");
++ retval = -ENODEV;
++ goto error;
++ }
++
++ if (dev->product_id == USB_DEVICE_ID_CODEMERCS_IOW56) {
++ if (!dev->int_out_endpoint) {
++ dev_err(&interface->dev, "no interrupt-out endpoint found\n");
++ retval = -ENODEV;
++ goto error;
++ }
++ }
++
+ /* we have to check the report_size often, so remember it in the endianness suitable for our machine */
+ dev->report_size = usb_endpoint_maxp(dev->int_in_endpoint);
+ if ((dev->interface->cur_altsetting->desc.bInterfaceNumber == 0) &&
+diff --git a/drivers/usb/misc/lvstest.c b/drivers/usb/misc/lvstest.c
+index 62cb8cd08403..66e2d036bb37 100644
+--- a/drivers/usb/misc/lvstest.c
++++ b/drivers/usb/misc/lvstest.c
+@@ -370,6 +370,10 @@ static int lvs_rh_probe(struct usb_interface *intf,
+
+ hdev = interface_to_usbdev(intf);
+ desc = intf->cur_altsetting;
++
++ if (desc->desc.bNumEndpoints < 1)
++ return -ENODEV;
++
+ endpoint = &desc->endpoint[0].desc;
+
+ /* valid only for SS root hub */
+diff --git a/drivers/usb/misc/uss720.c b/drivers/usb/misc/uss720.c
+index 40ef40affe83..3cb05eb5f1df 100644
+--- a/drivers/usb/misc/uss720.c
++++ b/drivers/usb/misc/uss720.c
+@@ -715,6 +715,11 @@ static int uss720_probe(struct usb_interface *intf,
+
+ interface = intf->cur_altsetting;
+
++ if (interface->desc.bNumEndpoints < 3) {
++ usb_put_dev(usbdev);
++ return -ENODEV;
++ }
++
+ /*
+ * Allocate parport interface
+ */
+diff --git a/drivers/usb/serial/digi_acceleport.c b/drivers/usb/serial/digi_acceleport.c
+index 3df7b7ec178e..e0b1fe2f60e1 100644
+--- a/drivers/usb/serial/digi_acceleport.c
++++ b/drivers/usb/serial/digi_acceleport.c
+@@ -1483,16 +1483,20 @@ static int digi_read_oob_callback(struct urb *urb)
+ struct usb_serial *serial = port->serial;
+ struct tty_struct *tty;
+ struct digi_port *priv = usb_get_serial_port_data(port);
++ unsigned char *buf = urb->transfer_buffer;
+ int opcode, line, status, val;
+ int i;
+ unsigned int rts;
+
++ if (urb->actual_length < 4)
++ return -1;
++
+ /* handle each oob command */
+- for (i = 0; i < urb->actual_length - 3;) {
+- opcode = ((unsigned char *)urb->transfer_buffer)[i++];
+- line = ((unsigned char *)urb->transfer_buffer)[i++];
+- status = ((unsigned char *)urb->transfer_buffer)[i++];
+- val = ((unsigned char *)urb->transfer_buffer)[i++];
++ for (i = 0; i < urb->actual_length - 3; i += 4) {
++ opcode = buf[i];
++ line = buf[i + 1];
++ status = buf[i + 2];
++ val = buf[i + 3];
+
+ dev_dbg(&port->dev, "digi_read_oob_callback: opcode=%d, line=%d, status=%d, val=%d\n",
+ opcode, line, status, val);
+diff --git a/drivers/usb/serial/io_ti.c b/drivers/usb/serial/io_ti.c
+index ddbb8fe1046d..f6f6960218a7 100644
+--- a/drivers/usb/serial/io_ti.c
++++ b/drivers/usb/serial/io_ti.c
+@@ -1546,6 +1546,12 @@ static void edge_interrupt_callback(struct urb *urb)
+ function = TIUMP_GET_FUNC_FROM_CODE(data[0]);
+ dev_dbg(dev, "%s - port_number %d, function %d, info 0x%x\n", __func__,
+ port_number, function, data[1]);
++
++ if (port_number >= edge_serial->serial->num_ports) {
++ dev_err(dev, "bad port number %d\n", port_number);
++ goto exit;
++ }
++
+ port = edge_serial->serial->port[port_number];
+ edge_port = usb_get_serial_port_data(port);
+ if (!edge_port) {
+@@ -1626,7 +1632,7 @@ static void edge_bulk_in_callback(struct urb *urb)
+
+ port_number = edge_port->port->port_number;
+
+- if (edge_port->lsr_event) {
++ if (urb->actual_length > 0 && edge_port->lsr_event) {
+ edge_port->lsr_event = 0;
+ dev_dbg(dev, "%s ===== Port %u LSR Status = %02x, Data = %02x ======\n",
+ __func__, port_number, edge_port->lsr_mask, *data);
+diff --git a/drivers/usb/serial/omninet.c b/drivers/usb/serial/omninet.c
+index f6c6900bccf0..880bbdba19d2 100644
+--- a/drivers/usb/serial/omninet.c
++++ b/drivers/usb/serial/omninet.c
+@@ -129,12 +129,6 @@ static int omninet_port_remove(struct usb_serial_port *port)
+
+ static int omninet_open(struct tty_struct *tty, struct usb_serial_port *port)
+ {
+- struct usb_serial *serial = port->serial;
+- struct usb_serial_port *wport;
+-
+- wport = serial->port[1];
+- tty_port_tty_set(&wport->port, tty);
+-
+ return usb_serial_generic_open(tty, port);
+ }
+
+diff --git a/drivers/usb/serial/qcserial.c b/drivers/usb/serial/qcserial.c
+index 9dfbea6c1d2c..ae652223fabc 100644
+--- a/drivers/usb/serial/qcserial.c
++++ b/drivers/usb/serial/qcserial.c
+@@ -163,6 +163,8 @@ static const struct usb_device_id id_table[] = {
+ {DEVICE_SWI(0x413c, 0x81a9)}, /* Dell Wireless 5808e Gobi(TM) 4G LTE Mobile Broadband Card */
+ {DEVICE_SWI(0x413c, 0x81b1)}, /* Dell Wireless 5809e Gobi(TM) 4G LTE Mobile Broadband Card */
+ {DEVICE_SWI(0x413c, 0x81b3)}, /* Dell Wireless 5809e Gobi(TM) 4G LTE Mobile Broadband Card (rev3) */
++ {DEVICE_SWI(0x413c, 0x81b5)}, /* Dell Wireless 5811e QDL */
++ {DEVICE_SWI(0x413c, 0x81b6)}, /* Dell Wireless 5811e QDL */
+
+ /* Huawei devices */
+ {DEVICE_HWI(0x03f0, 0x581d)}, /* HP lt4112 LTE/HSPA+ Gobi 4G Modem (Huawei me906e) */
+diff --git a/drivers/usb/serial/safe_serial.c b/drivers/usb/serial/safe_serial.c
+index b2dff0f14743..236ea43f7815 100644
+--- a/drivers/usb/serial/safe_serial.c
++++ b/drivers/usb/serial/safe_serial.c
+@@ -205,6 +205,11 @@ static void safe_process_read_urb(struct urb *urb)
+ if (!safe)
+ goto out;
+
++ if (length < 2) {
++ dev_err(&port->dev, "malformed packet\n");
++ return;
++ }
++
+ fcs = fcs_compute10(data, length, CRC10_INITFCS);
+ if (fcs) {
+ dev_err(&port->dev, "%s - bad CRC %x\n", __func__, fcs);
+diff --git a/drivers/usb/wusbcore/wa-hc.c b/drivers/usb/wusbcore/wa-hc.c
+index 252c7bd9218a..d01496fd27fe 100644
+--- a/drivers/usb/wusbcore/wa-hc.c
++++ b/drivers/usb/wusbcore/wa-hc.c
+@@ -39,6 +39,9 @@ int wa_create(struct wahc *wa, struct usb_interface *iface,
+ int result;
+ struct device *dev = &iface->dev;
+
++ if (iface->cur_altsetting->desc.bNumEndpoints < 3)
++ return -ENODEV;
++
+ result = wa_rpipes_create(wa);
+ if (result < 0)
+ goto error_rpipes_create;
+diff --git a/drivers/video/fbdev/core/fbcmap.c b/drivers/video/fbdev/core/fbcmap.c
+index f89245b8ba8e..68a113594808 100644
+--- a/drivers/video/fbdev/core/fbcmap.c
++++ b/drivers/video/fbdev/core/fbcmap.c
+@@ -163,17 +163,18 @@ void fb_dealloc_cmap(struct fb_cmap *cmap)
+
+ int fb_copy_cmap(const struct fb_cmap *from, struct fb_cmap *to)
+ {
+- int tooff = 0, fromoff = 0;
+- int size;
++ unsigned int tooff = 0, fromoff = 0;
++ size_t size;
+
+ if (to->start > from->start)
+ fromoff = to->start - from->start;
+ else
+ tooff = from->start - to->start;
+- size = to->len - tooff;
+- if (size > (int) (from->len - fromoff))
+- size = from->len - fromoff;
+- if (size <= 0)
++ if (fromoff >= from->len || tooff >= to->len)
++ return -EINVAL;
++
++ size = min_t(size_t, to->len - tooff, from->len - fromoff);
++ if (size == 0)
+ return -EINVAL;
+ size *= sizeof(u16);
+
+@@ -187,17 +188,18 @@ int fb_copy_cmap(const struct fb_cmap *from, struct fb_cmap *to)
+
+ int fb_cmap_to_user(const struct fb_cmap *from, struct fb_cmap_user *to)
+ {
+- int tooff = 0, fromoff = 0;
+- int size;
++ unsigned int tooff = 0, fromoff = 0;
++ size_t size;
+
+ if (to->start > from->start)
+ fromoff = to->start - from->start;
+ else
+ tooff = from->start - to->start;
+- size = to->len - tooff;
+- if (size > (int) (from->len - fromoff))
+- size = from->len - fromoff;
+- if (size <= 0)
++ if (fromoff >= from->len || tooff >= to->len)
++ return -EINVAL;
++
++ size = min_t(size_t, to->len - tooff, from->len - fromoff);
++ if (size == 0)
+ return -EINVAL;
+ size *= sizeof(u16);
+
+diff --git a/fs/coredump.c b/fs/coredump.c
+index 7eb6181184ea..0ad7a30e3107 100644
+--- a/fs/coredump.c
++++ b/fs/coredump.c
+@@ -1,6 +1,7 @@
+ #include <linux/slab.h>
+ #include <linux/file.h>
+ #include <linux/fdtable.h>
++#include <linux/freezer.h>
+ #include <linux/mm.h>
+ #include <linux/stat.h>
+ #include <linux/fcntl.h>
+@@ -393,7 +394,9 @@ static int coredump_wait(int exit_code, struct core_state *core_state)
+ if (core_waiters > 0) {
+ struct core_thread *ptr;
+
++ freezer_do_not_count();
+ wait_for_completion(&core_state->startup);
++ freezer_count();
+ /*
+ * Wait for all the threads to become inactive, so that
+ * all the thread context (extended register state, like
+diff --git a/fs/fat/inode.c b/fs/fat/inode.c
+index 756aead10d96..75b5a159d607 100644
+--- a/fs/fat/inode.c
++++ b/fs/fat/inode.c
+@@ -1266,6 +1266,16 @@ out:
+ return 0;
+ }
+
++static void fat_dummy_inode_init(struct inode *inode)
++{
++ /* Initialize this dummy inode to work as no-op. */
++ MSDOS_I(inode)->mmu_private = 0;
++ MSDOS_I(inode)->i_start = 0;
++ MSDOS_I(inode)->i_logstart = 0;
++ MSDOS_I(inode)->i_attrs = 0;
++ MSDOS_I(inode)->i_pos = 0;
++}
++
+ static int fat_read_root(struct inode *inode)
+ {
+ struct super_block *sb = inode->i_sb;
+@@ -1711,12 +1721,13 @@ int fat_fill_super(struct super_block *sb, void *data, int silent, int isvfat,
+ fat_inode = new_inode(sb);
+ if (!fat_inode)
+ goto out_fail;
+- MSDOS_I(fat_inode)->i_pos = 0;
++ fat_dummy_inode_init(fat_inode);
+ sbi->fat_inode = fat_inode;
+
+ fsinfo_inode = new_inode(sb);
+ if (!fsinfo_inode)
+ goto out_fail;
++ fat_dummy_inode_init(fsinfo_inode);
+ fsinfo_inode->i_ino = MSDOS_FSINFO_INO;
+ sbi->fsinfo_inode = fsinfo_inode;
+ insert_inode_hash(fsinfo_inode);
+diff --git a/fs/xfs/xfs_aops.c b/fs/xfs/xfs_aops.c
+index f5b2453a43b2..5dcd602b2996 100644
+--- a/fs/xfs/xfs_aops.c
++++ b/fs/xfs/xfs_aops.c
+@@ -153,6 +153,12 @@ xfs_setfilesize(
+ rwsem_acquire_read(&VFS_I(ip)->i_sb->s_writers.lock_map[SB_FREEZE_FS-1],
+ 0, 1, _THIS_IP_);
+
++ /* we abort the update if there was an IO error */
++ if (ioend->io_error) {
++ xfs_trans_cancel(tp, 0);
++ return ioend->io_error;
++ }
++
+ xfs_ilock(ip, XFS_ILOCK_EXCL);
+ isize = xfs_new_eof(ip, ioend->io_offset + ioend->io_size);
+ if (!isize) {
+@@ -208,14 +214,17 @@ xfs_end_io(
+ ioend->io_error = -EIO;
+ goto done;
+ }
+- if (ioend->io_error)
+- goto done;
+
+ /*
+ * For unwritten extents we need to issue transactions to convert a
+ * range to normal written extens after the data I/O has finished.
++ * Detecting and handling completion IO errors is done individually
++ * for each case as different cleanup operations need to be performed
++ * on error.
+ */
+ if (ioend->io_type == XFS_IO_UNWRITTEN) {
++ if (ioend->io_error)
++ goto done;
+ error = xfs_iomap_write_unwritten(ip, ioend->io_offset,
+ ioend->io_size);
+ } else if (ioend->io_isdirect && xfs_ioend_is_append(ioend)) {
+diff --git a/include/linux/can/core.h b/include/linux/can/core.h
+index a0875001b13c..df08a41d5be5 100644
+--- a/include/linux/can/core.h
++++ b/include/linux/can/core.h
+@@ -45,10 +45,9 @@ struct can_proto {
+ extern int can_proto_register(const struct can_proto *cp);
+ extern void can_proto_unregister(const struct can_proto *cp);
+
+-extern int can_rx_register(struct net_device *dev, canid_t can_id,
+- canid_t mask,
+- void (*func)(struct sk_buff *, void *),
+- void *data, char *ident);
++int can_rx_register(struct net_device *dev, canid_t can_id, canid_t mask,
++ void (*func)(struct sk_buff *, void *),
++ void *data, char *ident, struct sock *sk);
+
+ extern void can_rx_unregister(struct net_device *dev, canid_t can_id,
+ canid_t mask,
+diff --git a/include/linux/ceph/osdmap.h b/include/linux/ceph/osdmap.h
+index 561ea896c657..e5ea74c354a0 100644
+--- a/include/linux/ceph/osdmap.h
++++ b/include/linux/ceph/osdmap.h
+@@ -49,7 +49,7 @@ static inline bool ceph_can_shift_osds(struct ceph_pg_pool_info *pool)
+ case CEPH_POOL_TYPE_EC:
+ return false;
+ default:
+- BUG_ON(1);
++ BUG();
+ }
+ }
+
+diff --git a/include/linux/lockd/lockd.h b/include/linux/lockd/lockd.h
+index ff82a32871b5..439cde68dda9 100644
+--- a/include/linux/lockd/lockd.h
++++ b/include/linux/lockd/lockd.h
+@@ -351,7 +351,8 @@ static inline int nlm_privileged_requester(const struct svc_rqst *rqstp)
+ static inline int nlm_compare_locks(const struct file_lock *fl1,
+ const struct file_lock *fl2)
+ {
+- return fl1->fl_pid == fl2->fl_pid
++ return file_inode(fl1->fl_file) == file_inode(fl2->fl_file)
++ && fl1->fl_pid == fl2->fl_pid
+ && fl1->fl_owner == fl2->fl_owner
+ && fl1->fl_start == fl2->fl_start
+ && fl1->fl_end == fl2->fl_end
+diff --git a/include/linux/mroute.h b/include/linux/mroute.h
+index 79aaa9fc1a15..d5277fc3ce2e 100644
+--- a/include/linux/mroute.h
++++ b/include/linux/mroute.h
+@@ -103,5 +103,5 @@ struct mfc_cache {
+ struct rtmsg;
+ extern int ipmr_get_route(struct net *net, struct sk_buff *skb,
+ __be32 saddr, __be32 daddr,
+- struct rtmsg *rtm, int nowait);
++ struct rtmsg *rtm, int nowait, u32 portid);
+ #endif
+diff --git a/include/linux/mroute6.h b/include/linux/mroute6.h
+index 66982e764051..f831155dc7d1 100644
+--- a/include/linux/mroute6.h
++++ b/include/linux/mroute6.h
+@@ -115,7 +115,7 @@ struct mfc6_cache {
+
+ struct rtmsg;
+ extern int ip6mr_get_route(struct net *net, struct sk_buff *skb,
+- struct rtmsg *rtm, int nowait);
++ struct rtmsg *rtm, int nowait, u32 portid);
+
+ #ifdef CONFIG_IPV6_MROUTE
+ extern struct sock *mroute6_socket(struct net *net, struct sk_buff *skb);
+diff --git a/include/linux/pwm.h b/include/linux/pwm.h
+index e90628cac8fa..84e526a12def 100644
+--- a/include/linux/pwm.h
++++ b/include/linux/pwm.h
+@@ -299,6 +299,7 @@ static inline void pwm_add_table(struct pwm_lookup *table, size_t num)
+ #ifdef CONFIG_PWM_SYSFS
+ void pwmchip_sysfs_export(struct pwm_chip *chip);
+ void pwmchip_sysfs_unexport(struct pwm_chip *chip);
++void pwmchip_sysfs_unexport_children(struct pwm_chip *chip);
+ #else
+ static inline void pwmchip_sysfs_export(struct pwm_chip *chip)
+ {
+@@ -307,6 +308,10 @@ static inline void pwmchip_sysfs_export(struct pwm_chip *chip)
+ static inline void pwmchip_sysfs_unexport(struct pwm_chip *chip)
+ {
+ }
++
++static inline void pwmchip_sysfs_unexport_children(struct pwm_chip *chip)
++{
++}
+ #endif /* CONFIG_PWM_SYSFS */
+
+ #endif /* __LINUX_PWM_H */
+diff --git a/include/linux/usb/quirks.h b/include/linux/usb/quirks.h
+index 1d0043dc34e4..de2a722fe3cf 100644
+--- a/include/linux/usb/quirks.h
++++ b/include/linux/usb/quirks.h
+@@ -50,4 +50,10 @@
+ /* device can't handle Link Power Management */
+ #define USB_QUIRK_NO_LPM BIT(10)
+
++/*
++ * Device reports its bInterval as linear frames instead of the
++ * USB 2.0 calculation.
++ */
++#define USB_QUIRK_LINEAR_FRAME_INTR_BINTERVAL BIT(11)
++
+ #endif /* __LINUX_USB_QUIRKS_H */
+diff --git a/include/net/cipso_ipv4.h b/include/net/cipso_ipv4.h
+index 3ebb168b9afc..a34b141f125f 100644
+--- a/include/net/cipso_ipv4.h
++++ b/include/net/cipso_ipv4.h
+@@ -309,6 +309,10 @@ static inline int cipso_v4_validate(const struct sk_buff *skb,
+ }
+
+ for (opt_iter = 6; opt_iter < opt_len;) {
++ if (opt_iter + 1 == opt_len) {
++ err_offset = opt_iter;
++ goto out;
++ }
+ tag_len = opt[opt_iter + 1];
+ if ((tag_len == 0) || (tag_len > (opt_len - opt_iter))) {
+ err_offset = opt_iter + 1;
+diff --git a/include/trace/events/syscalls.h b/include/trace/events/syscalls.h
+index 14e49c798135..b35533b94277 100644
+--- a/include/trace/events/syscalls.h
++++ b/include/trace/events/syscalls.h
+@@ -1,5 +1,6 @@
+ #undef TRACE_SYSTEM
+ #define TRACE_SYSTEM raw_syscalls
++#undef TRACE_INCLUDE_FILE
+ #define TRACE_INCLUDE_FILE syscalls
+
+ #if !defined(_TRACE_EVENTS_SYSCALLS_H) || defined(TRACE_HEADER_MULTI_READ)
+diff --git a/include/uapi/linux/netlink.h b/include/uapi/linux/netlink.h
+index 1a85940f8ab7..8a8135c4e99a 100644
+--- a/include/uapi/linux/netlink.h
++++ b/include/uapi/linux/netlink.h
+@@ -106,8 +106,10 @@ struct nlmsgerr {
+ #define NETLINK_PKTINFO 3
+ #define NETLINK_BROADCAST_ERROR 4
+ #define NETLINK_NO_ENOBUFS 5
++#ifndef __KERNEL__
+ #define NETLINK_RX_RING 6
+ #define NETLINK_TX_RING 7
++#endif
+
+ struct nl_pktinfo {
+ __u32 group;
+@@ -130,6 +132,7 @@ struct nl_mmap_hdr {
+ __u32 nm_gid;
+ };
+
++#ifndef __KERNEL__
+ enum nl_mmap_status {
+ NL_MMAP_STATUS_UNUSED,
+ NL_MMAP_STATUS_RESERVED,
+@@ -141,6 +144,7 @@ enum nl_mmap_status {
+ #define NL_MMAP_MSG_ALIGNMENT NLMSG_ALIGNTO
+ #define NL_MMAP_MSG_ALIGN(sz) __ALIGN_KERNEL(sz, NL_MMAP_MSG_ALIGNMENT)
+ #define NL_MMAP_HDRLEN NL_MMAP_MSG_ALIGN(sizeof(struct nl_mmap_hdr))
++#endif
+
+ #define NET_MAJOR 36 /* Major 36 is reserved for networking */
+
+diff --git a/include/uapi/linux/netlink_diag.h b/include/uapi/linux/netlink_diag.h
+index f2159d30d1f5..d79399394b46 100644
+--- a/include/uapi/linux/netlink_diag.h
++++ b/include/uapi/linux/netlink_diag.h
+@@ -48,6 +48,8 @@ enum {
+
+ #define NDIAG_SHOW_MEMINFO 0x00000001 /* show memory info of a socket */
+ #define NDIAG_SHOW_GROUPS 0x00000002 /* show groups of a netlink socket */
++#ifndef __KERNEL__
+ #define NDIAG_SHOW_RING_CFG 0x00000004 /* show ring configuration */
++#endif
+
+ #endif
+diff --git a/include/uapi/linux/packet_diag.h b/include/uapi/linux/packet_diag.h
+index d08c63f3dd6f..0c5d5dd61b6a 100644
+--- a/include/uapi/linux/packet_diag.h
++++ b/include/uapi/linux/packet_diag.h
+@@ -64,7 +64,7 @@ struct packet_diag_mclist {
+ __u32 pdmc_count;
+ __u16 pdmc_type;
+ __u16 pdmc_alen;
+- __u8 pdmc_addr[MAX_ADDR_LEN];
++ __u8 pdmc_addr[32]; /* MAX_ADDR_LEN */
+ };
+
+ struct packet_diag_ring {
+diff --git a/kernel/futex.c b/kernel/futex.c
+index 8874a7b431e4..54ebb63711f4 100644
+--- a/kernel/futex.c
++++ b/kernel/futex.c
+@@ -2567,7 +2567,6 @@ static int futex_wait_requeue_pi(u32 __user *uaddr, unsigned int flags,
+ {
+ struct hrtimer_sleeper timeout, *to = NULL;
+ struct rt_mutex_waiter rt_waiter;
+- struct rt_mutex *pi_mutex = NULL;
+ struct futex_hash_bucket *hb;
+ union futex_key key2 = FUTEX_KEY_INIT;
+ struct futex_q q = futex_q_init;
+@@ -2651,6 +2650,8 @@ static int futex_wait_requeue_pi(u32 __user *uaddr, unsigned int flags,
+ if (q.pi_state && (q.pi_state->owner != current)) {
+ spin_lock(q.lock_ptr);
+ ret = fixup_pi_state_owner(uaddr2, &q, current);
++ if (ret && rt_mutex_owner(&q.pi_state->pi_mutex) == current)
++ rt_mutex_unlock(&q.pi_state->pi_mutex);
+ /*
+ * Drop the reference to the pi state which
+ * the requeue_pi() code acquired for us.
+@@ -2659,6 +2660,8 @@ static int futex_wait_requeue_pi(u32 __user *uaddr, unsigned int flags,
+ spin_unlock(q.lock_ptr);
+ }
+ } else {
++ struct rt_mutex *pi_mutex;
++
+ /*
+ * We have been woken up by futex_unlock_pi(), a timeout, or a
+ * signal. futex_unlock_pi() will not destroy the lock_ptr nor
+@@ -2682,18 +2685,19 @@ static int futex_wait_requeue_pi(u32 __user *uaddr, unsigned int flags,
+ if (res)
+ ret = (res < 0) ? res : 0;
+
++ /*
++ * If fixup_pi_state_owner() faulted and was unable to handle
++ * the fault, unlock the rt_mutex and return the fault to
++ * userspace.
++ */
++ if (ret && rt_mutex_owner(pi_mutex) == current)
++ rt_mutex_unlock(pi_mutex);
++
+ /* Unqueue and drop the lock. */
+ unqueue_me_pi(&q);
+ }
+
+- /*
+- * If fixup_pi_state_owner() faulted and was unable to handle the
+- * fault, unlock the rt_mutex and return the fault to userspace.
+- */
+- if (ret == -EFAULT) {
+- if (pi_mutex && rt_mutex_owner(pi_mutex) == current)
+- rt_mutex_unlock(pi_mutex);
+- } else if (ret == -EINTR) {
++ if (ret == -EINTR) {
+ /*
+ * We've already been requeued, but cannot restart by calling
+ * futex_lock_pi() directly. We could restart this syscall, but
+diff --git a/kernel/padata.c b/kernel/padata.c
+index 161402f0b517..1e3f9772dbd4 100644
+--- a/kernel/padata.c
++++ b/kernel/padata.c
+@@ -189,19 +189,20 @@ static struct padata_priv *padata_get_next(struct parallel_data *pd)
+
+ reorder = &next_queue->reorder;
+
++ spin_lock(&reorder->lock);
+ if (!list_empty(&reorder->list)) {
+ padata = list_entry(reorder->list.next,
+ struct padata_priv, list);
+
+- spin_lock(&reorder->lock);
+ list_del_init(&padata->list);
+ atomic_dec(&pd->reorder_objects);
+- spin_unlock(&reorder->lock);
+
+ pd->processed++;
+
++ spin_unlock(&reorder->lock);
+ goto out;
+ }
++ spin_unlock(&reorder->lock);
+
+ if (__this_cpu_read(pd->pqueue->cpu_index) == next_queue->cpu_index) {
+ padata = ERR_PTR(-ENODATA);
+diff --git a/lib/vsprintf.c b/lib/vsprintf.c
+index ec337f64f52d..3146abf4efc3 100644
+--- a/lib/vsprintf.c
++++ b/lib/vsprintf.c
+@@ -1728,7 +1728,7 @@ int vsnprintf(char *buf, size_t size, const char *fmt, va_list args)
+
+ /* Reject out-of-range values early. Large positive sizes are
+ used for unknown buffer sizes. */
+- if (WARN_ON_ONCE((int) size < 0))
++ if (WARN_ON_ONCE(size > INT_MAX))
+ return 0;
+
+ str = buf;
+diff --git a/mm/swapfile.c b/mm/swapfile.c
+index 8798b2e0ac59..14ae9e3ec728 100644
+--- a/mm/swapfile.c
++++ b/mm/swapfile.c
+@@ -2184,6 +2184,8 @@ static unsigned long read_swap_header(struct swap_info_struct *p,
+ swab32s(&swap_header->info.version);
+ swab32s(&swap_header->info.last_page);
+ swab32s(&swap_header->info.nr_badpages);
++ if (swap_header->info.nr_badpages > MAX_SWAP_BADPAGES)
++ return 0;
+ for (i = 0; i < swap_header->info.nr_badpages; i++)
+ swab32s(&swap_header->info.badpages[i]);
+ }
+diff --git a/net/can/af_can.c b/net/can/af_can.c
+index d6030d6949df..ee6eee7a8b42 100644
+--- a/net/can/af_can.c
++++ b/net/can/af_can.c
+@@ -446,6 +446,7 @@ static struct hlist_head *find_rcv_list(canid_t *can_id, canid_t *mask,
+ * @func: callback function on filter match
+ * @data: returned parameter for callback function
+ * @ident: string for calling module identification
++ * @sk: socket pointer (might be NULL)
+ *
+ * Description:
+ * Invokes the callback function with the received sk_buff and the given
+@@ -469,7 +470,7 @@ static struct hlist_head *find_rcv_list(canid_t *can_id, canid_t *mask,
+ */
+ int can_rx_register(struct net_device *dev, canid_t can_id, canid_t mask,
+ void (*func)(struct sk_buff *, void *), void *data,
+- char *ident)
++ char *ident, struct sock *sk)
+ {
+ struct receiver *r;
+ struct hlist_head *rl;
+@@ -497,6 +498,7 @@ int can_rx_register(struct net_device *dev, canid_t can_id, canid_t mask,
+ r->func = func;
+ r->data = data;
+ r->ident = ident;
++ r->sk = sk;
+
+ hlist_add_head_rcu(&r->list, rl);
+ d->entries++;
+@@ -521,8 +523,11 @@ EXPORT_SYMBOL(can_rx_register);
+ static void can_rx_delete_receiver(struct rcu_head *rp)
+ {
+ struct receiver *r = container_of(rp, struct receiver, rcu);
++ struct sock *sk = r->sk;
+
+ kmem_cache_free(rcv_cache, r);
++ if (sk)
++ sock_put(sk);
+ }
+
+ /**
+@@ -597,8 +602,11 @@ void can_rx_unregister(struct net_device *dev, canid_t can_id, canid_t mask,
+ spin_unlock(&can_rcvlists_lock);
+
+ /* schedule the receiver item for deletion */
+- if (r)
++ if (r) {
++ if (r->sk)
++ sock_hold(r->sk);
+ call_rcu(&r->rcu, can_rx_delete_receiver);
++ }
+ }
+ EXPORT_SYMBOL(can_rx_unregister);
+
+diff --git a/net/can/af_can.h b/net/can/af_can.h
+index fca0fe9fc45a..b86f5129e838 100644
+--- a/net/can/af_can.h
++++ b/net/can/af_can.h
+@@ -50,13 +50,14 @@
+
+ struct receiver {
+ struct hlist_node list;
+- struct rcu_head rcu;
+ canid_t can_id;
+ canid_t mask;
+ unsigned long matches;
+ void (*func)(struct sk_buff *, void *);
+ void *data;
+ char *ident;
++ struct sock *sk;
++ struct rcu_head rcu;
+ };
+
+ #define CAN_SFF_RCV_ARRAY_SZ (1 << CAN_SFF_ID_BITS)
+diff --git a/net/can/bcm.c b/net/can/bcm.c
+index dcb75c0e66c1..51c208f0d3d1 100644
+--- a/net/can/bcm.c
++++ b/net/can/bcm.c
+@@ -1169,7 +1169,7 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
+ err = can_rx_register(dev, op->can_id,
+ REGMASK(op->can_id),
+ bcm_rx_handler, op,
+- "bcm");
++ "bcm", sk);
+
+ op->rx_reg_dev = dev;
+ dev_put(dev);
+@@ -1178,7 +1178,7 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
+ } else
+ err = can_rx_register(NULL, op->can_id,
+ REGMASK(op->can_id),
+- bcm_rx_handler, op, "bcm");
++ bcm_rx_handler, op, "bcm", sk);
+ if (err) {
+ /* this bcm rx op is broken -> remove it */
+ list_del(&op->list);
+diff --git a/net/can/gw.c b/net/can/gw.c
+index 050a2110d43f..d4921582d3bd 100644
+--- a/net/can/gw.c
++++ b/net/can/gw.c
+@@ -441,7 +441,7 @@ static inline int cgw_register_filter(struct cgw_job *gwj)
+ {
+ return can_rx_register(gwj->src.dev, gwj->ccgw.filter.can_id,
+ gwj->ccgw.filter.can_mask, can_can_gw_rcv,
+- gwj, "gw");
++ gwj, "gw", NULL);
+ }
+
+ static inline void cgw_unregister_filter(struct cgw_job *gwj)
+diff --git a/net/can/raw.c b/net/can/raw.c
+index 081e81fd017f..bdca782df701 100644
+--- a/net/can/raw.c
++++ b/net/can/raw.c
+@@ -164,7 +164,7 @@ static int raw_enable_filters(struct net_device *dev, struct sock *sk,
+ for (i = 0; i < count; i++) {
+ err = can_rx_register(dev, filter[i].can_id,
+ filter[i].can_mask,
+- raw_rcv, sk, "raw");
++ raw_rcv, sk, "raw", sk);
+ if (err) {
+ /* clean up successfully registered filters */
+ while (--i >= 0)
+@@ -185,7 +185,7 @@ static int raw_enable_errfilter(struct net_device *dev, struct sock *sk,
+
+ if (err_mask)
+ err = can_rx_register(dev, 0, err_mask | CAN_ERR_FLAG,
+- raw_rcv, sk, "raw");
++ raw_rcv, sk, "raw", sk);
+
+ return err;
+ }
+diff --git a/net/ceph/osdmap.c b/net/ceph/osdmap.c
+index 60441b6a9546..8bb2e0c1cb50 100644
+--- a/net/ceph/osdmap.c
++++ b/net/ceph/osdmap.c
+@@ -1240,7 +1240,6 @@ static int decode_new_up_state_weight(void **p, void *end,
+ if ((map->osd_state[osd] & CEPH_OSD_EXISTS) &&
+ (xorstate & CEPH_OSD_EXISTS)) {
+ pr_info("osd%d does not exist\n", osd);
+- map->osd_weight[osd] = CEPH_OSD_IN;
+ ret = set_primary_affinity(map, osd,
+ CEPH_OSD_DEFAULT_PRIMARY_AFFINITY);
+ if (ret)
+diff --git a/net/core/dev.c b/net/core/dev.c
+index 2a24197f3a45..86bdf6d813f6 100644
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -1611,24 +1611,19 @@ EXPORT_SYMBOL(call_netdevice_notifiers);
+
+ static struct static_key netstamp_needed __read_mostly;
+ #ifdef HAVE_JUMP_LABEL
+-/* We are not allowed to call static_key_slow_dec() from irq context
+- * If net_disable_timestamp() is called from irq context, defer the
+- * static_key_slow_dec() calls.
+- */
+ static atomic_t netstamp_needed_deferred;
+-#endif
+-
+-void net_enable_timestamp(void)
++static void netstamp_clear(struct work_struct *work)
+ {
+-#ifdef HAVE_JUMP_LABEL
+ int deferred = atomic_xchg(&netstamp_needed_deferred, 0);
+
+- if (deferred) {
+- while (--deferred)
+- static_key_slow_dec(&netstamp_needed);
+- return;
+- }
++ while (deferred--)
++ static_key_slow_dec(&netstamp_needed);
++}
++static DECLARE_WORK(netstamp_work, netstamp_clear);
+ #endif
++
++void net_enable_timestamp(void)
++{
+ static_key_slow_inc(&netstamp_needed);
+ }
+ EXPORT_SYMBOL(net_enable_timestamp);
+@@ -1636,12 +1631,12 @@ EXPORT_SYMBOL(net_enable_timestamp);
+ void net_disable_timestamp(void)
+ {
+ #ifdef HAVE_JUMP_LABEL
+- if (in_interrupt()) {
+- atomic_inc(&netstamp_needed_deferred);
+- return;
+- }
+-#endif
++ /* net_disable_timestamp() can be called from non process context */
++ atomic_inc(&netstamp_needed_deferred);
++ schedule_work(&netstamp_work);
++#else
+ static_key_slow_dec(&netstamp_needed);
++#endif
+ }
+ EXPORT_SYMBOL(net_disable_timestamp);
+
+@@ -2746,6 +2741,7 @@ struct sk_buff *validate_xmit_skb_list(struct sk_buff *skb, struct net_device *d
+ }
+ return head;
+ }
++EXPORT_SYMBOL_GPL(validate_xmit_skb_list);
+
+ static void qdisc_pkt_len_init(struct sk_buff *skb)
+ {
+@@ -4898,6 +4894,7 @@ static inline bool netdev_adjacent_is_neigh_list(struct net_device *dev,
+
+ static int __netdev_adjacent_dev_insert(struct net_device *dev,
+ struct net_device *adj_dev,
++ u16 ref_nr,
+ struct list_head *dev_list,
+ void *private, bool master)
+ {
+@@ -4907,7 +4904,7 @@ static int __netdev_adjacent_dev_insert(struct net_device *dev,
+ adj = __netdev_find_adj(dev, adj_dev, dev_list);
+
+ if (adj) {
+- adj->ref_nr++;
++ adj->ref_nr += ref_nr;
+ return 0;
+ }
+
+@@ -4917,7 +4914,7 @@ static int __netdev_adjacent_dev_insert(struct net_device *dev,
+
+ adj->dev = adj_dev;
+ adj->master = master;
+- adj->ref_nr = 1;
++ adj->ref_nr = ref_nr;
+ adj->private = private;
+ dev_hold(adj_dev);
+
+@@ -4956,6 +4953,7 @@ free_adj:
+
+ static void __netdev_adjacent_dev_remove(struct net_device *dev,
+ struct net_device *adj_dev,
++ u16 ref_nr,
+ struct list_head *dev_list)
+ {
+ struct netdev_adjacent *adj;
+@@ -4968,10 +4966,10 @@ static void __netdev_adjacent_dev_remove(struct net_device *dev,
+ BUG();
+ }
+
+- if (adj->ref_nr > 1) {
+- pr_debug("%s to %s ref_nr-- = %d\n", dev->name, adj_dev->name,
+- adj->ref_nr-1);
+- adj->ref_nr--;
++ if (adj->ref_nr > ref_nr) {
++ pr_debug("%s to %s ref_nr-%d = %d\n", dev->name, adj_dev->name,
++ ref_nr, adj->ref_nr-ref_nr);
++ adj->ref_nr -= ref_nr;
+ return;
+ }
+
+@@ -4990,21 +4988,22 @@ static void __netdev_adjacent_dev_remove(struct net_device *dev,
+
+ static int __netdev_adjacent_dev_link_lists(struct net_device *dev,
+ struct net_device *upper_dev,
++ u16 ref_nr,
+ struct list_head *up_list,
+ struct list_head *down_list,
+ void *private, bool master)
+ {
+ int ret;
+
+- ret = __netdev_adjacent_dev_insert(dev, upper_dev, up_list, private,
+- master);
++ ret = __netdev_adjacent_dev_insert(dev, upper_dev, ref_nr, up_list,
++ private, master);
+ if (ret)
+ return ret;
+
+- ret = __netdev_adjacent_dev_insert(upper_dev, dev, down_list, private,
+- false);
++ ret = __netdev_adjacent_dev_insert(upper_dev, dev, ref_nr, down_list,
++ private, false);
+ if (ret) {
+- __netdev_adjacent_dev_remove(dev, upper_dev, up_list);
++ __netdev_adjacent_dev_remove(dev, upper_dev, ref_nr, up_list);
+ return ret;
+ }
+
+@@ -5012,9 +5011,10 @@ static int __netdev_adjacent_dev_link_lists(struct net_device *dev,
+ }
+
+ static int __netdev_adjacent_dev_link(struct net_device *dev,
+- struct net_device *upper_dev)
++ struct net_device *upper_dev,
++ u16 ref_nr)
+ {
+- return __netdev_adjacent_dev_link_lists(dev, upper_dev,
++ return __netdev_adjacent_dev_link_lists(dev, upper_dev, ref_nr,
+ &dev->all_adj_list.upper,
+ &upper_dev->all_adj_list.lower,
+ NULL, false);
+@@ -5022,17 +5022,19 @@ static int __netdev_adjacent_dev_link(struct net_device *dev,
+
+ static void __netdev_adjacent_dev_unlink_lists(struct net_device *dev,
+ struct net_device *upper_dev,
++ u16 ref_nr,
+ struct list_head *up_list,
+ struct list_head *down_list)
+ {
+- __netdev_adjacent_dev_remove(dev, upper_dev, up_list);
+- __netdev_adjacent_dev_remove(upper_dev, dev, down_list);
++ __netdev_adjacent_dev_remove(dev, upper_dev, ref_nr, up_list);
++ __netdev_adjacent_dev_remove(upper_dev, dev, ref_nr, down_list);
+ }
+
+ static void __netdev_adjacent_dev_unlink(struct net_device *dev,
+- struct net_device *upper_dev)
++ struct net_device *upper_dev,
++ u16 ref_nr)
+ {
+- __netdev_adjacent_dev_unlink_lists(dev, upper_dev,
++ __netdev_adjacent_dev_unlink_lists(dev, upper_dev, ref_nr,
+ &dev->all_adj_list.upper,
+ &upper_dev->all_adj_list.lower);
+ }
+@@ -5041,17 +5043,17 @@ static int __netdev_adjacent_dev_link_neighbour(struct net_device *dev,
+ struct net_device *upper_dev,
+ void *private, bool master)
+ {
+- int ret = __netdev_adjacent_dev_link(dev, upper_dev);
++ int ret = __netdev_adjacent_dev_link(dev, upper_dev, 1);
+
+ if (ret)
+ return ret;
+
+- ret = __netdev_adjacent_dev_link_lists(dev, upper_dev,
++ ret = __netdev_adjacent_dev_link_lists(dev, upper_dev, 1,
+ &dev->adj_list.upper,
+ &upper_dev->adj_list.lower,
+ private, master);
+ if (ret) {
+- __netdev_adjacent_dev_unlink(dev, upper_dev);
++ __netdev_adjacent_dev_unlink(dev, upper_dev, 1);
+ return ret;
+ }
+
+@@ -5061,8 +5063,8 @@ static int __netdev_adjacent_dev_link_neighbour(struct net_device *dev,
+ static void __netdev_adjacent_dev_unlink_neighbour(struct net_device *dev,
+ struct net_device *upper_dev)
+ {
+- __netdev_adjacent_dev_unlink(dev, upper_dev);
+- __netdev_adjacent_dev_unlink_lists(dev, upper_dev,
++ __netdev_adjacent_dev_unlink(dev, upper_dev, 1);
++ __netdev_adjacent_dev_unlink_lists(dev, upper_dev, 1,
+ &dev->adj_list.upper,
+ &upper_dev->adj_list.lower);
+ }
+@@ -5103,7 +5105,7 @@ static int __netdev_upper_dev_link(struct net_device *dev,
+ list_for_each_entry(j, &upper_dev->all_adj_list.upper, list) {
+ pr_debug("Interlinking %s with %s, non-neighbour\n",
+ i->dev->name, j->dev->name);
+- ret = __netdev_adjacent_dev_link(i->dev, j->dev);
++ ret = __netdev_adjacent_dev_link(i->dev, j->dev, i->ref_nr);
+ if (ret)
+ goto rollback_mesh;
+ }
+@@ -5113,7 +5115,7 @@ static int __netdev_upper_dev_link(struct net_device *dev,
+ list_for_each_entry(i, &upper_dev->all_adj_list.upper, list) {
+ pr_debug("linking %s's upper device %s with %s\n",
+ upper_dev->name, i->dev->name, dev->name);
+- ret = __netdev_adjacent_dev_link(dev, i->dev);
++ ret = __netdev_adjacent_dev_link(dev, i->dev, i->ref_nr);
+ if (ret)
+ goto rollback_upper_mesh;
+ }
+@@ -5122,7 +5124,7 @@ static int __netdev_upper_dev_link(struct net_device *dev,
+ list_for_each_entry(i, &dev->all_adj_list.lower, list) {
+ pr_debug("linking %s's lower device %s with %s\n", dev->name,
+ i->dev->name, upper_dev->name);
+- ret = __netdev_adjacent_dev_link(i->dev, upper_dev);
++ ret = __netdev_adjacent_dev_link(i->dev, upper_dev, i->ref_nr);
+ if (ret)
+ goto rollback_lower_mesh;
+ }
+@@ -5135,7 +5137,7 @@ rollback_lower_mesh:
+ list_for_each_entry(i, &dev->all_adj_list.lower, list) {
+ if (i == to_i)
+ break;
+- __netdev_adjacent_dev_unlink(i->dev, upper_dev);
++ __netdev_adjacent_dev_unlink(i->dev, upper_dev, i->ref_nr);
+ }
+
+ i = NULL;
+@@ -5145,7 +5147,7 @@ rollback_upper_mesh:
+ list_for_each_entry(i, &upper_dev->all_adj_list.upper, list) {
+ if (i == to_i)
+ break;
+- __netdev_adjacent_dev_unlink(dev, i->dev);
++ __netdev_adjacent_dev_unlink(dev, i->dev, i->ref_nr);
+ }
+
+ i = j = NULL;
+@@ -5157,7 +5159,7 @@ rollback_mesh:
+ list_for_each_entry(j, &upper_dev->all_adj_list.upper, list) {
+ if (i == to_i && j == to_j)
+ break;
+- __netdev_adjacent_dev_unlink(i->dev, j->dev);
++ __netdev_adjacent_dev_unlink(i->dev, j->dev, i->ref_nr);
+ }
+ if (i == to_i)
+ break;
+@@ -5233,16 +5235,16 @@ void netdev_upper_dev_unlink(struct net_device *dev,
+ */
+ list_for_each_entry(i, &dev->all_adj_list.lower, list)
+ list_for_each_entry(j, &upper_dev->all_adj_list.upper, list)
+- __netdev_adjacent_dev_unlink(i->dev, j->dev);
++ __netdev_adjacent_dev_unlink(i->dev, j->dev, i->ref_nr);
+
+ /* remove also the devices itself from lower/upper device
+ * list
+ */
+ list_for_each_entry(i, &dev->all_adj_list.lower, list)
+- __netdev_adjacent_dev_unlink(i->dev, upper_dev);
++ __netdev_adjacent_dev_unlink(i->dev, upper_dev, i->ref_nr);
+
+ list_for_each_entry(i, &upper_dev->all_adj_list.upper, list)
+- __netdev_adjacent_dev_unlink(dev, i->dev);
++ __netdev_adjacent_dev_unlink(dev, i->dev, i->ref_nr);
+
+ call_netdevice_notifiers(NETDEV_CHANGEUPPER, dev);
+ }
+diff --git a/net/core/pktgen.c b/net/core/pktgen.c
+index 4ff3eacc99f5..b3aa63260cab 100644
+--- a/net/core/pktgen.c
++++ b/net/core/pktgen.c
+@@ -211,8 +211,8 @@
+ #define T_REMDEV (1<<3) /* Remove one dev */
+
+ /* If lock -- protects updating of if_list */
+-#define if_lock(t) spin_lock(&(t->if_lock));
+-#define if_unlock(t) spin_unlock(&(t->if_lock));
++#define if_lock(t) mutex_lock(&(t->if_lock));
++#define if_unlock(t) mutex_unlock(&(t->if_lock));
+
+ /* Used to help with determining the pkts on receive */
+ #define PKTGEN_MAGIC 0xbe9be955
+@@ -418,7 +418,7 @@ struct pktgen_net {
+ };
+
+ struct pktgen_thread {
+- spinlock_t if_lock; /* for list of devices */
++ struct mutex if_lock; /* for list of devices */
+ struct list_head if_list; /* All device here */
+ struct list_head th_list;
+ struct task_struct *tsk;
+@@ -1952,11 +1952,13 @@ static void pktgen_change_name(const struct pktgen_net *pn, struct net_device *d
+ {
+ struct pktgen_thread *t;
+
++ mutex_lock(&pktgen_thread_lock);
++
+ list_for_each_entry(t, &pn->pktgen_threads, th_list) {
+ struct pktgen_dev *pkt_dev;
+
+- rcu_read_lock();
+- list_for_each_entry_rcu(pkt_dev, &t->if_list, list) {
++ if_lock(t);
++ list_for_each_entry(pkt_dev, &t->if_list, list) {
+ if (pkt_dev->odev != dev)
+ continue;
+
+@@ -1971,8 +1973,9 @@ static void pktgen_change_name(const struct pktgen_net *pn, struct net_device *d
+ dev->name);
+ break;
+ }
+- rcu_read_unlock();
++ if_unlock(t);
+ }
++ mutex_unlock(&pktgen_thread_lock);
+ }
+
+ static int pktgen_device_event(struct notifier_block *unused,
+@@ -3656,7 +3659,7 @@ static int __net_init pktgen_create_thread(int cpu, struct pktgen_net *pn)
+ return -ENOMEM;
+ }
+
+- spin_lock_init(&t->if_lock);
++ mutex_init(&t->if_lock);
+ t->cpu = cpu;
+
+ INIT_LIST_HEAD(&t->if_list);
+diff --git a/net/core/skbuff.c b/net/core/skbuff.c
+index 97549212e9e3..b2e2a53c2284 100644
+--- a/net/core/skbuff.c
++++ b/net/core/skbuff.c
+@@ -3617,13 +3617,14 @@ void skb_complete_tx_timestamp(struct sk_buff *skb,
+ {
+ struct sock *sk = skb->sk;
+
+- /* take a reference to prevent skb_orphan() from freeing the socket */
+- sock_hold(sk);
+-
+- *skb_hwtstamps(skb) = *hwtstamps;
+- __skb_complete_tx_timestamp(skb, sk, SCM_TSTAMP_SND);
+-
+- sock_put(sk);
++ /* Take a reference to prevent skb_orphan() from freeing the socket,
++ * but only if the socket refcount is not zero.
++ */
++ if (likely(atomic_inc_not_zero(&sk->sk_refcnt))) {
++ *skb_hwtstamps(skb) = *hwtstamps;
++ __skb_complete_tx_timestamp(skb, sk, SCM_TSTAMP_SND);
++ sock_put(sk);
++ }
+ }
+ EXPORT_SYMBOL_GPL(skb_complete_tx_timestamp);
+
+@@ -3661,7 +3662,7 @@ void skb_complete_wifi_ack(struct sk_buff *skb, bool acked)
+ {
+ struct sock *sk = skb->sk;
+ struct sock_exterr_skb *serr;
+- int err;
++ int err = 1;
+
+ skb->wifi_acked_valid = 1;
+ skb->wifi_acked = acked;
+@@ -3671,14 +3672,15 @@ void skb_complete_wifi_ack(struct sk_buff *skb, bool acked)
+ serr->ee.ee_errno = ENOMSG;
+ serr->ee.ee_origin = SO_EE_ORIGIN_TXSTATUS;
+
+- /* take a reference to prevent skb_orphan() from freeing the socket */
+- sock_hold(sk);
+-
+- err = sock_queue_err_skb(sk, skb);
++ /* Take a reference to prevent skb_orphan() from freeing the socket,
++ * but only if the socket refcount is not zero.
++ */
++ if (likely(atomic_inc_not_zero(&sk->sk_refcnt))) {
++ err = sock_queue_err_skb(sk, skb);
++ sock_put(sk);
++ }
+ if (err)
+ kfree_skb(skb);
+-
+- sock_put(sk);
+ }
+ EXPORT_SYMBOL_GPL(skb_complete_wifi_ack);
+
+diff --git a/net/dccp/ccids/ccid2.c b/net/dccp/ccids/ccid2.c
+index f053198e730c..5e3a7302f774 100644
+--- a/net/dccp/ccids/ccid2.c
++++ b/net/dccp/ccids/ccid2.c
+@@ -749,6 +749,7 @@ static void ccid2_hc_tx_exit(struct sock *sk)
+ for (i = 0; i < hc->tx_seqbufc; i++)
+ kfree(hc->tx_seqbuf[i]);
+ hc->tx_seqbufc = 0;
++ dccp_ackvec_parsed_cleanup(&hc->tx_av_chunks);
+ }
+
+ static void ccid2_hc_rx_packet_recv(struct sock *sk, struct sk_buff *skb)
+diff --git a/net/dccp/input.c b/net/dccp/input.c
+index 3c8ec7d4a34e..700440e4fa3b 100644
+--- a/net/dccp/input.c
++++ b/net/dccp/input.c
+@@ -606,7 +606,8 @@ int dccp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
+ if (inet_csk(sk)->icsk_af_ops->conn_request(sk,
+ skb) < 0)
+ return 1;
+- goto discard;
++ consume_skb(skb);
++ return 0;
+ }
+ if (dh->dccph_type == DCCP_PKT_RESET)
+ goto discard;
+diff --git a/net/dccp/ipv4.c b/net/dccp/ipv4.c
+index 6ca645c4b48e..502d9a885329 100644
+--- a/net/dccp/ipv4.c
++++ b/net/dccp/ipv4.c
+@@ -262,7 +262,8 @@ static void dccp_v4_err(struct sk_buff *skb, u32 info)
+
+ switch (type) {
+ case ICMP_REDIRECT:
+- dccp_do_redirect(skb, sk);
++ if (!sock_owned_by_user(sk))
++ dccp_do_redirect(skb, sk);
+ goto out;
+ case ICMP_SOURCE_QUENCH:
+ /* Just silently ignore these. */
+diff --git a/net/dccp/ipv6.c b/net/dccp/ipv6.c
+index 7bcb22317841..ff186dac3e07 100644
+--- a/net/dccp/ipv6.c
++++ b/net/dccp/ipv6.c
+@@ -131,10 +131,12 @@ static void dccp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
+ np = inet6_sk(sk);
+
+ if (type == NDISC_REDIRECT) {
+- struct dst_entry *dst = __sk_dst_check(sk, np->dst_cookie);
++ if (!sock_owned_by_user(sk)) {
++ struct dst_entry *dst = __sk_dst_check(sk, np->dst_cookie);
+
+- if (dst)
+- dst->ops->redirect(dst, sk, skb);
++ if (dst)
++ dst->ops->redirect(dst, sk, skb);
++ }
+ goto out;
+ }
+
+diff --git a/net/dccp/minisocks.c b/net/dccp/minisocks.c
+index b50dc436db1f..e6aaf92e0e1b 100644
+--- a/net/dccp/minisocks.c
++++ b/net/dccp/minisocks.c
+@@ -135,6 +135,7 @@ struct sock *dccp_create_openreq_child(struct sock *sk,
+ /* It is still raw copy of parent, so invalidate
+ * destructor and make plain sk_free() */
+ newsk->sk_destruct = NULL;
++ bh_unlock_sock(newsk);
+ sk_free(newsk);
+ return NULL;
+ }
+diff --git a/net/ipv4/cipso_ipv4.c b/net/ipv4/cipso_ipv4.c
+index bc7c9662a904..e08003d026eb 100644
+--- a/net/ipv4/cipso_ipv4.c
++++ b/net/ipv4/cipso_ipv4.c
+@@ -1655,6 +1655,10 @@ int cipso_v4_validate(const struct sk_buff *skb, unsigned char **option)
+ goto validate_return_locked;
+ }
+
++ if (opt_iter + 1 == opt_len) {
++ err_offset = opt_iter;
++ goto validate_return_locked;
++ }
+ tag_len = tag[1];
+ if (tag_len > (opt_len - opt_iter)) {
+ err_offset = opt_iter + 1;
+diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
+index 046fce012da5..8839b55ea4de 100644
+--- a/net/ipv4/ip_sockglue.c
++++ b/net/ipv4/ip_sockglue.c
+@@ -1066,7 +1066,14 @@ void ipv4_pktinfo_prepare(const struct sock *sk, struct sk_buff *skb)
+ pktinfo->ipi_ifindex = 0;
+ pktinfo->ipi_spec_dst.s_addr = 0;
+ }
+- skb_dst_drop(skb);
++ /* We need to keep the dst for __ip_options_echo()
++ * We could restrict the test to opt.ts_needtime || opt.srr,
++ * but the following is good enough as IP options are not often used.
++ */
++ if (unlikely(IPCB(skb)->opt.optlen))
++ skb_dst_force(skb);
++ else
++ skb_dst_drop(skb);
+ }
+
+ int ip_setsockopt(struct sock *sk, int level,
+diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
+index 1b7f6da99ef4..2348cc87b0bc 100644
+--- a/net/ipv4/ipmr.c
++++ b/net/ipv4/ipmr.c
+@@ -2188,7 +2188,7 @@ static int __ipmr_fill_mroute(struct mr_table *mrt, struct sk_buff *skb,
+
+ int ipmr_get_route(struct net *net, struct sk_buff *skb,
+ __be32 saddr, __be32 daddr,
+- struct rtmsg *rtm, int nowait)
++ struct rtmsg *rtm, int nowait, u32 portid)
+ {
+ struct mfc_cache *cache;
+ struct mr_table *mrt;
+@@ -2233,6 +2233,7 @@ int ipmr_get_route(struct net *net, struct sk_buff *skb,
+ return -ENOMEM;
+ }
+
++ NETLINK_CB(skb2).portid = portid;
+ skb_push(skb2, sizeof(struct iphdr));
+ skb_reset_network_header(skb2);
+ iph = ip_hdr(skb2);
+diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
+index 64f4edb2dbf9..c225b227cc45 100644
+--- a/net/ipv4/ping.c
++++ b/net/ipv4/ping.c
+@@ -644,6 +644,8 @@ static int ping_v4_push_pending_frames(struct sock *sk, struct pingfakehdr *pfh,
+ {
+ struct sk_buff *skb = skb_peek(&sk->sk_write_queue);
+
++ if (!skb)
++ return 0;
+ pfh->wcheck = csum_partial((char *)&pfh->icmph,
+ sizeof(struct icmphdr), pfh->wcheck);
+ pfh->icmph.checksum = csum_fold(pfh->wcheck);
+diff --git a/net/ipv4/route.c b/net/ipv4/route.c
+index 12c5df33c0b7..2fe9459fbe24 100644
+--- a/net/ipv4/route.c
++++ b/net/ipv4/route.c
+@@ -1835,6 +1835,7 @@ int ip_route_input_noref(struct sk_buff *skb, __be32 daddr, __be32 saddr,
+ {
+ int res;
+
++ tos &= IPTOS_RT_MASK;
+ rcu_read_lock();
+
+ /* Multicast recognition logic is moved from route cache to here.
+@@ -2373,7 +2374,8 @@ static int rt_fill_info(struct net *net, __be32 dst, __be32 src,
+ IPV4_DEVCONF_ALL(net, MC_FORWARDING)) {
+ int err = ipmr_get_route(net, skb,
+ fl4->saddr, fl4->daddr,
+- r, nowait);
++ r, nowait, portid);
++
+ if (err <= 0) {
+ if (!nowait) {
+ if (err == 0)
+diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c
+index 633cd34f57ec..3d61bdbae920 100644
+--- a/net/ipv4/sysctl_net_ipv4.c
++++ b/net/ipv4/sysctl_net_ipv4.c
+@@ -103,10 +103,10 @@ static void set_ping_group_range(struct ctl_table *table, kgid_t low, kgid_t hig
+ kgid_t *data = table->data;
+ struct net *net =
+ container_of(table->data, struct net, ipv4.ping_group_range.range);
+- write_seqlock(&net->ipv4.ip_local_ports.lock);
++ write_seqlock_bh(&net->ipv4.ip_local_ports.lock);
+ data[0] = low;
+ data[1] = high;
+- write_sequnlock(&net->ipv4.ip_local_ports.lock);
++ write_sequnlock_bh(&net->ipv4.ip_local_ports.lock);
+ }
+
+ /* Validate changes from /proc interface. */
+diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
+index a21c47289765..daf3b217b1e4 100644
+--- a/net/ipv4/tcp.c
++++ b/net/ipv4/tcp.c
+@@ -775,6 +775,12 @@ ssize_t tcp_splice_read(struct socket *sock, loff_t *ppos,
+ ret = -EAGAIN;
+ break;
+ }
++ /* if __tcp_splice_read() got nothing while we have
++ * an skb in receive queue, we do not want to loop.
++ * This might happen with URG data.
++ */
++ if (!skb_queue_empty(&sk->sk_receive_queue))
++ break;
+ sk_wait_data(sk, &timeo);
+ if (signal_pending(current)) {
+ ret = sock_intr_errno(timeo);
+diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
+index 067baa738001..737186dbbd74 100644
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -2360,10 +2360,9 @@ static void DBGUNDO(struct sock *sk, const char *msg)
+ }
+ #if IS_ENABLED(CONFIG_IPV6)
+ else if (sk->sk_family == AF_INET6) {
+- struct ipv6_pinfo *np = inet6_sk(sk);
+ pr_debug("Undo %s %pI6/%u c%u l%u ss%u/%u p%u\n",
+ msg,
+- &np->daddr, ntohs(inet->inet_dport),
++ &sk->sk_v6_daddr, ntohs(inet->inet_dport),
+ tp->snd_cwnd, tcp_left_out(tp),
+ tp->snd_ssthresh, tp->prior_ssthresh,
+ tp->packets_out);
+diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
+index 5d5390299277..d3d62be2376b 100644
+--- a/net/ipv4/tcp_ipv4.c
++++ b/net/ipv4/tcp_ipv4.c
+@@ -271,10 +271,13 @@ EXPORT_SYMBOL(tcp_v4_connect);
+ */
+ void tcp_v4_mtu_reduced(struct sock *sk)
+ {
+- struct dst_entry *dst;
+ struct inet_sock *inet = inet_sk(sk);
+- u32 mtu = tcp_sk(sk)->mtu_info;
++ struct dst_entry *dst;
++ u32 mtu;
+
++ if ((1 << sk->sk_state) & (TCPF_LISTEN | TCPF_CLOSE))
++ return;
++ mtu = tcp_sk(sk)->mtu_info;
+ dst = inet_csk_update_pmtu(sk, mtu);
+ if (!dst)
+ return;
+@@ -386,7 +389,8 @@ void tcp_v4_err(struct sk_buff *icmp_skb, u32 info)
+
+ switch (type) {
+ case ICMP_REDIRECT:
+- do_redirect(icmp_skb, sk);
++ if (!sock_owned_by_user(sk))
++ do_redirect(icmp_skb, sk);
+ goto out;
+ case ICMP_SOURCE_QUENCH:
+ /* Just silently ignore these. */
+diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
+index af2f64eeb98f..a680177694ec 100644
+--- a/net/ipv4/tcp_output.c
++++ b/net/ipv4/tcp_output.c
+@@ -1869,12 +1869,14 @@ static int tcp_mtu_probe(struct sock *sk)
+ len = 0;
+ tcp_for_write_queue_from_safe(skb, next, sk) {
+ copy = min_t(int, skb->len, probe_size - len);
+- if (nskb->ip_summed)
++ if (nskb->ip_summed) {
+ skb_copy_bits(skb, 0, skb_put(nskb, copy), copy);
+- else
+- nskb->csum = skb_copy_and_csum_bits(skb, 0,
+- skb_put(nskb, copy),
+- copy, nskb->csum);
++ } else {
++ __wsum csum = skb_copy_and_csum_bits(skb, 0,
++ skb_put(nskb, copy),
++ copy, 0);
++ nskb->csum = csum_block_add(nskb->csum, csum, len);
++ }
+
+ if (skb->len <= copy) {
+ /* We've eaten all the data from this skb.
+@@ -2291,9 +2293,11 @@ u32 __tcp_select_window(struct sock *sk)
+ int full_space = min_t(int, tp->window_clamp, allowed_space);
+ int window;
+
+- if (mss > full_space)
++ if (unlikely(mss > full_space)) {
+ mss = full_space;
+-
++ if (mss <= 0)
++ return 0;
++ }
+ if (free_space < (full_space >> 1)) {
+ icsk->icsk_ack.quick = 0;
+
+@@ -2479,7 +2483,8 @@ int __tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb)
+ * copying overhead: fragmentation, tunneling, mangling etc.
+ */
+ if (atomic_read(&sk->sk_wmem_alloc) >
+- min(sk->sk_wmem_queued + (sk->sk_wmem_queued >> 2), sk->sk_sndbuf))
++ min_t(u32, sk->sk_wmem_queued + (sk->sk_wmem_queued >> 2),
++ sk->sk_sndbuf))
+ return -EAGAIN;
+
+ if (skb_still_in_host_queue(sk, skb))
+diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c
+index 9b21ae8b2e31..baec68553e90 100644
+--- a/net/ipv4/tcp_timer.c
++++ b/net/ipv4/tcp_timer.c
+@@ -207,7 +207,8 @@ void tcp_delack_timer_handler(struct sock *sk)
+
+ sk_mem_reclaim_partial(sk);
+
+- if (sk->sk_state == TCP_CLOSE || !(icsk->icsk_ack.pending & ICSK_ACK_TIMER))
++ if (((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN)) ||
++ !(icsk->icsk_ack.pending & ICSK_ACK_TIMER))
+ goto out;
+
+ if (time_after(icsk->icsk_ack.timeout, jiffies)) {
+@@ -486,7 +487,8 @@ void tcp_write_timer_handler(struct sock *sk)
+ struct inet_connection_sock *icsk = inet_csk(sk);
+ int event;
+
+- if (sk->sk_state == TCP_CLOSE || !icsk->icsk_pending)
++ if (((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN)) ||
++ !icsk->icsk_pending)
+ goto out;
+
+ if (time_after(icsk->icsk_timeout, jiffies)) {
+diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
+index 953572c17b3d..4cc14452d5cc 100644
+--- a/net/ipv6/addrconf.c
++++ b/net/ipv6/addrconf.c
+@@ -2695,7 +2695,7 @@ static void init_loopback(struct net_device *dev)
+ * lo device down, release this obsolete dst and
+ * reallocate a new router for ifa.
+ */
+- if (sp_ifa->rt->dst.obsolete > 0) {
++ if (!atomic_read(&sp_ifa->rt->rt6i_ref)) {
+ ip6_rt_put(sp_ifa->rt);
+ sp_ifa->rt = NULL;
+ } else {
+diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
+index 1a93a39b2aab..df3633e20458 100644
+--- a/net/ipv6/ip6_gre.c
++++ b/net/ipv6/ip6_gre.c
+@@ -55,6 +55,7 @@
+ #include <net/ip6_fib.h>
+ #include <net/ip6_route.h>
+ #include <net/ip6_tunnel.h>
++#include <net/gre.h>
+
+
+ static bool log_ecn_error = true;
+@@ -367,35 +368,37 @@ static void ip6gre_tunnel_uninit(struct net_device *dev)
+
+
+ static void ip6gre_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
+- u8 type, u8 code, int offset, __be32 info)
++ u8 type, u8 code, int offset, __be32 info)
+ {
+- const struct ipv6hdr *ipv6h = (const struct ipv6hdr *)skb->data;
+- __be16 *p = (__be16 *)(skb->data + offset);
+- int grehlen = offset + 4;
++ const struct gre_base_hdr *greh;
++ const struct ipv6hdr *ipv6h;
++ int grehlen = sizeof(*greh);
+ struct ip6_tnl *t;
++ int key_off = 0;
+ __be16 flags;
++ __be32 key;
+
+- flags = p[0];
+- if (flags&(GRE_CSUM|GRE_KEY|GRE_SEQ|GRE_ROUTING|GRE_VERSION)) {
+- if (flags&(GRE_VERSION|GRE_ROUTING))
+- return;
+- if (flags&GRE_KEY) {
+- grehlen += 4;
+- if (flags&GRE_CSUM)
+- grehlen += 4;
+- }
++ if (!pskb_may_pull(skb, offset + grehlen))
++ return;
++ greh = (const struct gre_base_hdr *)(skb->data + offset);
++ flags = greh->flags;
++ if (flags & (GRE_VERSION | GRE_ROUTING))
++ return;
++ if (flags & GRE_CSUM)
++ grehlen += 4;
++ if (flags & GRE_KEY) {
++ key_off = grehlen + offset;
++ grehlen += 4;
+ }
+
+- /* If only 8 bytes returned, keyed message will be dropped here */
+- if (!pskb_may_pull(skb, grehlen))
++ if (!pskb_may_pull(skb, offset + grehlen))
+ return;
+ ipv6h = (const struct ipv6hdr *)skb->data;
+- p = (__be16 *)(skb->data + offset);
++ greh = (const struct gre_base_hdr *)(skb->data + offset);
++ key = key_off ? *(__be32 *)(skb->data + key_off) : 0;
+
+ t = ip6gre_tunnel_lookup(skb->dev, &ipv6h->daddr, &ipv6h->saddr,
+- flags & GRE_KEY ?
+- *(((__be32 *)p) + (grehlen / 4) - 1) : 0,
+- p[1]);
++ key, greh->protocol);
+ if (t == NULL)
+ return;
+
+@@ -889,7 +892,6 @@ static int ip6gre_xmit_other(struct sk_buff *skb, struct net_device *dev)
+ encap_limit = t->parms.encap_limit;
+
+ memcpy(&fl6, &t->fl.u.ip6, sizeof(fl6));
+- fl6.flowi6_proto = skb->protocol;
+
+ err = ip6gre_xmit2(skb, dev, 0, &fl6, encap_limit, &mtu);
+
+diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
+index 6987d3cb4163..8afea07e53a2 100644
+--- a/net/ipv6/ip6_tunnel.c
++++ b/net/ipv6/ip6_tunnel.c
+@@ -407,18 +407,19 @@ ip6_tnl_dev_uninit(struct net_device *dev)
+
+ __u16 ip6_tnl_parse_tlv_enc_lim(struct sk_buff *skb, __u8 *raw)
+ {
+- const struct ipv6hdr *ipv6h = (const struct ipv6hdr *) raw;
+- __u8 nexthdr = ipv6h->nexthdr;
+- __u16 off = sizeof(*ipv6h);
++ const struct ipv6hdr *ipv6h = (const struct ipv6hdr *)raw;
++ unsigned int nhoff = raw - skb->data;
++ unsigned int off = nhoff + sizeof(*ipv6h);
++ u8 next, nexthdr = ipv6h->nexthdr;
+
+ while (ipv6_ext_hdr(nexthdr) && nexthdr != NEXTHDR_NONE) {
+- __u16 optlen = 0;
+ struct ipv6_opt_hdr *hdr;
+- if (raw + off + sizeof(*hdr) > skb->data &&
+- !pskb_may_pull(skb, raw - skb->data + off + sizeof (*hdr)))
++ u16 optlen;
++
++ if (!pskb_may_pull(skb, off + sizeof(*hdr)))
+ break;
+
+- hdr = (struct ipv6_opt_hdr *) (raw + off);
++ hdr = (struct ipv6_opt_hdr *)(skb->data + off);
+ if (nexthdr == NEXTHDR_FRAGMENT) {
+ struct frag_hdr *frag_hdr = (struct frag_hdr *) hdr;
+ if (frag_hdr->frag_off)
+@@ -429,20 +430,29 @@ __u16 ip6_tnl_parse_tlv_enc_lim(struct sk_buff *skb, __u8 *raw)
+ } else {
+ optlen = ipv6_optlen(hdr);
+ }
++ /* cache hdr->nexthdr, since pskb_may_pull() might
++ * invalidate hdr
++ */
++ next = hdr->nexthdr;
+ if (nexthdr == NEXTHDR_DEST) {
+- __u16 i = off + 2;
++ u16 i = 2;
++
++ /* Remember : hdr is no longer valid at this point. */
++ if (!pskb_may_pull(skb, off + optlen))
++ break;
++
+ while (1) {
+ struct ipv6_tlv_tnl_enc_lim *tel;
+
+ /* No more room for encapsulation limit */
+- if (i + sizeof (*tel) > off + optlen)
++ if (i + sizeof(*tel) > optlen)
+ break;
+
+- tel = (struct ipv6_tlv_tnl_enc_lim *) &raw[i];
++ tel = (struct ipv6_tlv_tnl_enc_lim *)(skb->data + off + i);
+ /* return index of option if found and valid */
+ if (tel->type == IPV6_TLV_TNL_ENCAP_LIMIT &&
+ tel->length == 1)
+- return i;
++ return i + off - nhoff;
+ /* else jump to next option */
+ if (tel->type)
+ i += tel->length + 2;
+@@ -450,7 +460,7 @@ __u16 ip6_tnl_parse_tlv_enc_lim(struct sk_buff *skb, __u8 *raw)
+ i++;
+ }
+ }
+- nexthdr = hdr->nexthdr;
++ nexthdr = next;
+ off += optlen;
+ }
+ return 0;
+diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c
+index 1d67b37592d1..591e2355cc9e 100644
+--- a/net/ipv6/ip6_vti.c
++++ b/net/ipv6/ip6_vti.c
+@@ -645,6 +645,10 @@ vti6_parm_to_user(struct ip6_tnl_parm2 *u, const struct __ip6_tnl_parm *p)
+ u->link = p->link;
+ u->i_key = p->i_key;
+ u->o_key = p->o_key;
++ if (u->i_key)
++ u->i_flags |= GRE_KEY;
++ if (u->o_key)
++ u->o_flags |= GRE_KEY;
+ u->proto = p->proto;
+
+ memcpy(u->name, p->name, sizeof(u->name));
+diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
+index 4ca7cdd15aad..2b93262d5d5f 100644
+--- a/net/ipv6/ip6mr.c
++++ b/net/ipv6/ip6mr.c
+@@ -2276,8 +2276,8 @@ static int __ip6mr_fill_mroute(struct mr6_table *mrt, struct sk_buff *skb,
+ return 1;
+ }
+
+-int ip6mr_get_route(struct net *net,
+- struct sk_buff *skb, struct rtmsg *rtm, int nowait)
++int ip6mr_get_route(struct net *net, struct sk_buff *skb, struct rtmsg *rtm,
++ int nowait, u32 portid)
+ {
+ int err;
+ struct mr6_table *mrt;
+@@ -2322,6 +2322,7 @@ int ip6mr_get_route(struct net *net,
+ return -ENOMEM;
+ }
+
++ NETLINK_CB(skb2).portid = portid;
+ skb_reset_transport_header(skb2);
+
+ skb_put(skb2, sizeof(struct ipv6hdr));
+diff --git a/net/ipv6/route.c b/net/ipv6/route.c
+index 2d9aca57e7c7..8d3103459b2d 100644
+--- a/net/ipv6/route.c
++++ b/net/ipv6/route.c
+@@ -2612,7 +2612,9 @@ static int rt6_fill_node(struct net *net,
+ if (iif) {
+ #ifdef CONFIG_IPV6_MROUTE
+ if (ipv6_addr_is_multicast(&rt->rt6i_dst.addr)) {
+- int err = ip6mr_get_route(net, skb, rtm, nowait);
++ int err = ip6mr_get_route(net, skb, rtm, nowait,
++ portid);
++
+ if (err <= 0) {
+ if (!nowait) {
+ if (err == 0)
+diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
+index 45eae1e609d6..eb36219f0a3c 100644
+--- a/net/ipv6/sit.c
++++ b/net/ipv6/sit.c
+@@ -1388,6 +1388,7 @@ static int ipip6_tunnel_init(struct net_device *dev)
+ tunnel->dst_cache = alloc_percpu(struct ip_tunnel_dst);
+ if (!tunnel->dst_cache) {
+ free_percpu(dev->tstats);
++ dev->tstats = NULL;
+ return -ENOMEM;
+ }
+
+diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
+index b8e14a5ae0b1..0ade453839c4 100644
+--- a/net/ipv6/tcp_ipv6.c
++++ b/net/ipv6/tcp_ipv6.c
+@@ -389,10 +389,12 @@ static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
+ np = inet6_sk(sk);
+
+ if (type == NDISC_REDIRECT) {
+- struct dst_entry *dst = __sk_dst_check(sk, np->dst_cookie);
++ if (!sock_owned_by_user(sk)) {
++ struct dst_entry *dst = __sk_dst_check(sk, np->dst_cookie);
+
+- if (dst)
+- dst->ops->redirect(dst, sk, skb);
++ if (dst)
++ dst->ops->redirect(dst, sk, skb);
++ }
+ goto out;
+ }
+
+@@ -1049,6 +1051,16 @@ drop:
+ return 0; /* don't send reset */
+ }
+
++static void tcp_v6_restore_cb(struct sk_buff *skb)
++{
++ /* We need to move header back to the beginning if xfrm6_policy_check()
++ * and tcp_v6_fill_cb() are going to be called again.
++ * ip6_datagram_recv_specific_ctl() also expects IP6CB to be there.
++ */
++ memmove(IP6CB(skb), &TCP_SKB_CB(skb)->header.h6,
++ sizeof(struct inet6_skb_parm));
++}
++
+ static struct sock *tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
+ struct request_sock *req,
+ struct dst_entry *dst)
+@@ -1180,8 +1192,10 @@ static struct sock *tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
+ sk_gfp_atomic(sk, GFP_ATOMIC));
+ consume_skb(ireq->pktopts);
+ ireq->pktopts = NULL;
+- if (newnp->pktoptions)
++ if (newnp->pktoptions) {
++ tcp_v6_restore_cb(newnp->pktoptions);
+ skb_set_owner_r(newnp->pktoptions, newsk);
++ }
+ }
+ newnp->opt = NULL;
+ newnp->mcast_oif = tcp_v6_iif(skb);
+@@ -1381,6 +1395,7 @@ ipv6_pktoptions:
+ np->flow_label = ip6_flowlabel(ipv6_hdr(opt_skb));
+ if (ipv6_opt_accepted(sk, opt_skb, &TCP_SKB_CB(opt_skb)->header.h6)) {
+ skb_set_owner_r(opt_skb, sk);
++ tcp_v6_restore_cb(opt_skb);
+ opt_skb = xchg(&np->pktoptions, opt_skb);
+ } else {
+ __kfree_skb(opt_skb);
+@@ -1414,15 +1429,6 @@ static void tcp_v6_fill_cb(struct sk_buff *skb, const struct ipv6hdr *hdr,
+ TCP_SKB_CB(skb)->sacked = 0;
+ }
+
+-static void tcp_v6_restore_cb(struct sk_buff *skb)
+-{
+- /* We need to move header back to the beginning if xfrm6_policy_check()
+- * and tcp_v6_fill_cb() are going to be called again.
+- */
+- memmove(IP6CB(skb), &TCP_SKB_CB(skb)->header.h6,
+- sizeof(struct inet6_skb_parm));
+-}
+-
+ static int tcp_v6_rcv(struct sk_buff *skb)
+ {
+ const struct tcphdr *th;
+diff --git a/net/l2tp/l2tp_core.h b/net/l2tp/l2tp_core.h
+index 68aa9ffd4ae4..e9ec7d2cc357 100644
+--- a/net/l2tp/l2tp_core.h
++++ b/net/l2tp/l2tp_core.h
+@@ -273,6 +273,7 @@ int l2tp_xmit_skb(struct l2tp_session *session, struct sk_buff *skb,
+ int l2tp_nl_register_ops(enum l2tp_pwtype pw_type,
+ const struct l2tp_nl_cmd_ops *ops);
+ void l2tp_nl_unregister_ops(enum l2tp_pwtype pw_type);
++int l2tp_ioctl(struct sock *sk, int cmd, unsigned long arg);
+
+ /* Session reference counts. Incremented when code obtains a reference
+ * to a session.
+diff --git a/net/l2tp/l2tp_ip.c b/net/l2tp/l2tp_ip.c
+index e45d2b77bb42..c2cd3dd7fa67 100644
+--- a/net/l2tp/l2tp_ip.c
++++ b/net/l2tp/l2tp_ip.c
+@@ -11,6 +11,7 @@
+
+ #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
++#include <asm/ioctls.h>
+ #include <linux/icmp.h>
+ #include <linux/module.h>
+ #include <linux/skbuff.h>
+@@ -381,7 +382,7 @@ static int l2tp_ip_backlog_recv(struct sock *sk, struct sk_buff *skb)
+ drop:
+ IP_INC_STATS(sock_net(sk), IPSTATS_MIB_INDISCARDS);
+ kfree_skb(skb);
+- return -1;
++ return 0;
+ }
+
+ /* Userspace will call sendmsg() on the tunnel socket to send L2TP
+@@ -554,6 +555,30 @@ out:
+ return err ? err : copied;
+ }
+
++int l2tp_ioctl(struct sock *sk, int cmd, unsigned long arg)
++{
++ struct sk_buff *skb;
++ int amount;
++
++ switch (cmd) {
++ case SIOCOUTQ:
++ amount = sk_wmem_alloc_get(sk);
++ break;
++ case SIOCINQ:
++ spin_lock_bh(&sk->sk_receive_queue.lock);
++ skb = skb_peek(&sk->sk_receive_queue);
++ amount = skb ? skb->len : 0;
++ spin_unlock_bh(&sk->sk_receive_queue.lock);
++ break;
++
++ default:
++ return -ENOIOCTLCMD;
++ }
++
++ return put_user(amount, (int __user *)arg);
++}
++EXPORT_SYMBOL(l2tp_ioctl);
++
+ static struct proto l2tp_ip_prot = {
+ .name = "L2TP/IP",
+ .owner = THIS_MODULE,
+@@ -562,7 +587,7 @@ static struct proto l2tp_ip_prot = {
+ .bind = l2tp_ip_bind,
+ .connect = l2tp_ip_connect,
+ .disconnect = l2tp_ip_disconnect,
+- .ioctl = udp_ioctl,
++ .ioctl = l2tp_ioctl,
+ .destroy = l2tp_ip_destroy_sock,
+ .setsockopt = ip_setsockopt,
+ .getsockopt = ip_getsockopt,
+diff --git a/net/l2tp/l2tp_ip6.c b/net/l2tp/l2tp_ip6.c
+index b8e469b832df..f5d6fd834303 100644
+--- a/net/l2tp/l2tp_ip6.c
++++ b/net/l2tp/l2tp_ip6.c
+@@ -715,7 +715,7 @@ static struct proto l2tp_ip6_prot = {
+ .bind = l2tp_ip6_bind,
+ .connect = l2tp_ip6_connect,
+ .disconnect = l2tp_ip6_disconnect,
+- .ioctl = udp_ioctl,
++ .ioctl = l2tp_ioctl,
+ .destroy = l2tp_ip6_destroy_sock,
+ .setsockopt = ipv6_setsockopt,
+ .getsockopt = ipv6_getsockopt,
+diff --git a/net/llc/llc_conn.c b/net/llc/llc_conn.c
+index 42dc2e45c921..9c68d0bca046 100644
+--- a/net/llc/llc_conn.c
++++ b/net/llc/llc_conn.c
+@@ -821,7 +821,10 @@ void llc_conn_handler(struct llc_sap *sap, struct sk_buff *skb)
+ * another trick required to cope with how the PROCOM state
+ * machine works. -acme
+ */
++ skb_orphan(skb);
++ sock_hold(sk);
+ skb->sk = sk;
++ skb->destructor = sock_efree;
+ }
+ if (!sock_owned_by_user(sk))
+ llc_conn_rcv(sk, skb);
+diff --git a/net/llc/llc_sap.c b/net/llc/llc_sap.c
+index 06033f6c845f..cdc1b620cbe1 100644
+--- a/net/llc/llc_sap.c
++++ b/net/llc/llc_sap.c
+@@ -290,7 +290,10 @@ static void llc_sap_rcv(struct llc_sap *sap, struct sk_buff *skb,
+
+ ev->type = LLC_SAP_EV_TYPE_PDU;
+ ev->reason = 0;
++ skb_orphan(skb);
++ sock_hold(sk);
+ skb->sk = sk;
++ skb->destructor = sock_efree;
+ llc_sap_state_process(sap, skb);
+ }
+
+diff --git a/net/mac80211/pm.c b/net/mac80211/pm.c
+index 4a95fe3cffbc..3b98c1b4a719 100644
+--- a/net/mac80211/pm.c
++++ b/net/mac80211/pm.c
+@@ -116,6 +116,7 @@ int __ieee80211_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan)
+ break;
+ }
+
++ flush_delayed_work(&sdata->dec_tailroom_needed_wk);
+ drv_remove_interface(local, sdata);
+ }
+
+diff --git a/net/netlink/Kconfig b/net/netlink/Kconfig
+index 2c5e95e9bfbd..5d6e8c05b3d4 100644
+--- a/net/netlink/Kconfig
++++ b/net/netlink/Kconfig
+@@ -2,15 +2,6 @@
+ # Netlink Sockets
+ #
+
+-config NETLINK_MMAP
+- bool "NETLINK: mmaped IO"
+- ---help---
+- This option enables support for memory mapped netlink IO. This
+- reduces overhead by avoiding copying data between kernel- and
+- userspace.
+-
+- If unsure, say N.
+-
+ config NETLINK_DIAG
+ tristate "NETLINK: socket monitoring interface"
+ default n
+diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
+index 15fc0938e1c4..4792e76b7d4a 100644
+--- a/net/netlink/af_netlink.c
++++ b/net/netlink/af_netlink.c
+@@ -234,7 +234,7 @@ static int __netlink_deliver_tap_skb(struct sk_buff *skb,
+
+ dev_hold(dev);
+
+- if (netlink_skb_is_mmaped(skb) || is_vmalloc_addr(skb->head))
++ if (is_vmalloc_addr(skb->head))
+ nskb = netlink_to_full_skb(skb, GFP_ATOMIC);
+ else
+ nskb = skb_clone(skb, GFP_ATOMIC);
+@@ -308,599 +308,8 @@ static void netlink_rcv_wake(struct sock *sk)
+ wake_up_interruptible(&nlk->wait);
+ }
+
+-#ifdef CONFIG_NETLINK_MMAP
+-static bool netlink_rx_is_mmaped(struct sock *sk)
+-{
+- return nlk_sk(sk)->rx_ring.pg_vec != NULL;
+-}
+-
+-static bool netlink_tx_is_mmaped(struct sock *sk)
+-{
+- return nlk_sk(sk)->tx_ring.pg_vec != NULL;
+-}
+-
+-static __pure struct page *pgvec_to_page(const void *addr)
+-{
+- if (is_vmalloc_addr(addr))
+- return vmalloc_to_page(addr);
+- else
+- return virt_to_page(addr);
+-}
+-
+-static void free_pg_vec(void **pg_vec, unsigned int order, unsigned int len)
+-{
+- unsigned int i;
+-
+- for (i = 0; i < len; i++) {
+- if (pg_vec[i] != NULL) {
+- if (is_vmalloc_addr(pg_vec[i]))
+- vfree(pg_vec[i]);
+- else
+- free_pages((unsigned long)pg_vec[i], order);
+- }
+- }
+- kfree(pg_vec);
+-}
+-
+-static void *alloc_one_pg_vec_page(unsigned long order)
+-{
+- void *buffer;
+- gfp_t gfp_flags = GFP_KERNEL | __GFP_COMP | __GFP_ZERO |
+- __GFP_NOWARN | __GFP_NORETRY;
+-
+- buffer = (void *)__get_free_pages(gfp_flags, order);
+- if (buffer != NULL)
+- return buffer;
+-
+- buffer = vzalloc((1 << order) * PAGE_SIZE);
+- if (buffer != NULL)
+- return buffer;
+-
+- gfp_flags &= ~__GFP_NORETRY;
+- return (void *)__get_free_pages(gfp_flags, order);
+-}
+-
+-static void **alloc_pg_vec(struct netlink_sock *nlk,
+- struct nl_mmap_req *req, unsigned int order)
+-{
+- unsigned int block_nr = req->nm_block_nr;
+- unsigned int i;
+- void **pg_vec;
+-
+- pg_vec = kcalloc(block_nr, sizeof(void *), GFP_KERNEL);
+- if (pg_vec == NULL)
+- return NULL;
+-
+- for (i = 0; i < block_nr; i++) {
+- pg_vec[i] = alloc_one_pg_vec_page(order);
+- if (pg_vec[i] == NULL)
+- goto err1;
+- }
+-
+- return pg_vec;
+-err1:
+- free_pg_vec(pg_vec, order, block_nr);
+- return NULL;
+-}
+-
+-
+-static void
+-__netlink_set_ring(struct sock *sk, struct nl_mmap_req *req, bool tx_ring, void **pg_vec,
+- unsigned int order)
+-{
+- struct netlink_sock *nlk = nlk_sk(sk);
+- struct sk_buff_head *queue;
+- struct netlink_ring *ring;
+-
+- queue = tx_ring ? &sk->sk_write_queue : &sk->sk_receive_queue;
+- ring = tx_ring ? &nlk->tx_ring : &nlk->rx_ring;
+-
+- spin_lock_bh(&queue->lock);
+-
+- ring->frame_max = req->nm_frame_nr - 1;
+- ring->head = 0;
+- ring->frame_size = req->nm_frame_size;
+- ring->pg_vec_pages = req->nm_block_size / PAGE_SIZE;
+-
+- swap(ring->pg_vec_len, req->nm_block_nr);
+- swap(ring->pg_vec_order, order);
+- swap(ring->pg_vec, pg_vec);
+-
+- __skb_queue_purge(queue);
+- spin_unlock_bh(&queue->lock);
+-
+- WARN_ON(atomic_read(&nlk->mapped));
+-
+- if (pg_vec)
+- free_pg_vec(pg_vec, order, req->nm_block_nr);
+-}
+-
+-static int netlink_set_ring(struct sock *sk, struct nl_mmap_req *req,
+- bool tx_ring)
+-{
+- struct netlink_sock *nlk = nlk_sk(sk);
+- struct netlink_ring *ring;
+- void **pg_vec = NULL;
+- unsigned int order = 0;
+-
+- ring = tx_ring ? &nlk->tx_ring : &nlk->rx_ring;
+-
+- if (atomic_read(&nlk->mapped))
+- return -EBUSY;
+- if (atomic_read(&ring->pending))
+- return -EBUSY;
+-
+- if (req->nm_block_nr) {
+- if (ring->pg_vec != NULL)
+- return -EBUSY;
+-
+- if ((int)req->nm_block_size <= 0)
+- return -EINVAL;
+- if (!PAGE_ALIGNED(req->nm_block_size))
+- return -EINVAL;
+- if (req->nm_frame_size < NL_MMAP_HDRLEN)
+- return -EINVAL;
+- if (!IS_ALIGNED(req->nm_frame_size, NL_MMAP_MSG_ALIGNMENT))
+- return -EINVAL;
+-
+- ring->frames_per_block = req->nm_block_size /
+- req->nm_frame_size;
+- if (ring->frames_per_block == 0)
+- return -EINVAL;
+- if (ring->frames_per_block * req->nm_block_nr !=
+- req->nm_frame_nr)
+- return -EINVAL;
+-
+- order = get_order(req->nm_block_size);
+- pg_vec = alloc_pg_vec(nlk, req, order);
+- if (pg_vec == NULL)
+- return -ENOMEM;
+- } else {
+- if (req->nm_frame_nr)
+- return -EINVAL;
+- }
+-
+- mutex_lock(&nlk->pg_vec_lock);
+- if (atomic_read(&nlk->mapped) == 0) {
+- __netlink_set_ring(sk, req, tx_ring, pg_vec, order);
+- mutex_unlock(&nlk->pg_vec_lock);
+- return 0;
+- }
+-
+- mutex_unlock(&nlk->pg_vec_lock);
+-
+- if (pg_vec)
+- free_pg_vec(pg_vec, order, req->nm_block_nr);
+-
+- return -EBUSY;
+-}
+-
+-static void netlink_mm_open(struct vm_area_struct *vma)
+-{
+- struct file *file = vma->vm_file;
+- struct socket *sock = file->private_data;
+- struct sock *sk = sock->sk;
+-
+- if (sk)
+- atomic_inc(&nlk_sk(sk)->mapped);
+-}
+-
+-static void netlink_mm_close(struct vm_area_struct *vma)
+-{
+- struct file *file = vma->vm_file;
+- struct socket *sock = file->private_data;
+- struct sock *sk = sock->sk;
+-
+- if (sk)
+- atomic_dec(&nlk_sk(sk)->mapped);
+-}
+-
+-static const struct vm_operations_struct netlink_mmap_ops = {
+- .open = netlink_mm_open,
+- .close = netlink_mm_close,
+-};
+-
+-static int netlink_mmap(struct file *file, struct socket *sock,
+- struct vm_area_struct *vma)
+-{
+- struct sock *sk = sock->sk;
+- struct netlink_sock *nlk = nlk_sk(sk);
+- struct netlink_ring *ring;
+- unsigned long start, size, expected;
+- unsigned int i;
+- int err = -EINVAL;
+-
+- if (vma->vm_pgoff)
+- return -EINVAL;
+-
+- mutex_lock(&nlk->pg_vec_lock);
+-
+- expected = 0;
+- for (ring = &nlk->rx_ring; ring <= &nlk->tx_ring; ring++) {
+- if (ring->pg_vec == NULL)
+- continue;
+- expected += ring->pg_vec_len * ring->pg_vec_pages * PAGE_SIZE;
+- }
+-
+- if (expected == 0)
+- goto out;
+-
+- size = vma->vm_end - vma->vm_start;
+- if (size != expected)
+- goto out;
+-
+- start = vma->vm_start;
+- for (ring = &nlk->rx_ring; ring <= &nlk->tx_ring; ring++) {
+- if (ring->pg_vec == NULL)
+- continue;
+-
+- for (i = 0; i < ring->pg_vec_len; i++) {
+- struct page *page;
+- void *kaddr = ring->pg_vec[i];
+- unsigned int pg_num;
+-
+- for (pg_num = 0; pg_num < ring->pg_vec_pages; pg_num++) {
+- page = pgvec_to_page(kaddr);
+- err = vm_insert_page(vma, start, page);
+- if (err < 0)
+- goto out;
+- start += PAGE_SIZE;
+- kaddr += PAGE_SIZE;
+- }
+- }
+- }
+-
+- atomic_inc(&nlk->mapped);
+- vma->vm_ops = &netlink_mmap_ops;
+- err = 0;
+-out:
+- mutex_unlock(&nlk->pg_vec_lock);
+- return err;
+-}
+-
+-static void netlink_frame_flush_dcache(const struct nl_mmap_hdr *hdr, unsigned int nm_len)
+-{
+-#if ARCH_IMPLEMENTS_FLUSH_DCACHE_PAGE == 1
+- struct page *p_start, *p_end;
+-
+- /* First page is flushed through netlink_{get,set}_status */
+- p_start = pgvec_to_page(hdr + PAGE_SIZE);
+- p_end = pgvec_to_page((void *)hdr + NL_MMAP_HDRLEN + nm_len - 1);
+- while (p_start <= p_end) {
+- flush_dcache_page(p_start);
+- p_start++;
+- }
+-#endif
+-}
+-
+-static enum nl_mmap_status netlink_get_status(const struct nl_mmap_hdr *hdr)
+-{
+- smp_rmb();
+- flush_dcache_page(pgvec_to_page(hdr));
+- return hdr->nm_status;
+-}
+-
+-static void netlink_set_status(struct nl_mmap_hdr *hdr,
+- enum nl_mmap_status status)
+-{
+- smp_mb();
+- hdr->nm_status = status;
+- flush_dcache_page(pgvec_to_page(hdr));
+-}
+-
+-static struct nl_mmap_hdr *
+-__netlink_lookup_frame(const struct netlink_ring *ring, unsigned int pos)
+-{
+- unsigned int pg_vec_pos, frame_off;
+-
+- pg_vec_pos = pos / ring->frames_per_block;
+- frame_off = pos % ring->frames_per_block;
+-
+- return ring->pg_vec[pg_vec_pos] + (frame_off * ring->frame_size);
+-}
+-
+-static struct nl_mmap_hdr *
+-netlink_lookup_frame(const struct netlink_ring *ring, unsigned int pos,
+- enum nl_mmap_status status)
+-{
+- struct nl_mmap_hdr *hdr;
+-
+- hdr = __netlink_lookup_frame(ring, pos);
+- if (netlink_get_status(hdr) != status)
+- return NULL;
+-
+- return hdr;
+-}
+-
+-static struct nl_mmap_hdr *
+-netlink_current_frame(const struct netlink_ring *ring,
+- enum nl_mmap_status status)
+-{
+- return netlink_lookup_frame(ring, ring->head, status);
+-}
+-
+-static struct nl_mmap_hdr *
+-netlink_previous_frame(const struct netlink_ring *ring,
+- enum nl_mmap_status status)
+-{
+- unsigned int prev;
+-
+- prev = ring->head ? ring->head - 1 : ring->frame_max;
+- return netlink_lookup_frame(ring, prev, status);
+-}
+-
+-static void netlink_increment_head(struct netlink_ring *ring)
+-{
+- ring->head = ring->head != ring->frame_max ? ring->head + 1 : 0;
+-}
+-
+-static void netlink_forward_ring(struct netlink_ring *ring)
+-{
+- unsigned int head = ring->head, pos = head;
+- const struct nl_mmap_hdr *hdr;
+-
+- do {
+- hdr = __netlink_lookup_frame(ring, pos);
+- if (hdr->nm_status == NL_MMAP_STATUS_UNUSED)
+- break;
+- if (hdr->nm_status != NL_MMAP_STATUS_SKIP)
+- break;
+- netlink_increment_head(ring);
+- } while (ring->head != head);
+-}
+-
+-static bool netlink_dump_space(struct netlink_sock *nlk)
+-{
+- struct netlink_ring *ring = &nlk->rx_ring;
+- struct nl_mmap_hdr *hdr;
+- unsigned int n;
+-
+- hdr = netlink_current_frame(ring, NL_MMAP_STATUS_UNUSED);
+- if (hdr == NULL)
+- return false;
+-
+- n = ring->head + ring->frame_max / 2;
+- if (n > ring->frame_max)
+- n -= ring->frame_max;
+-
+- hdr = __netlink_lookup_frame(ring, n);
+-
+- return hdr->nm_status == NL_MMAP_STATUS_UNUSED;
+-}
+-
+-static unsigned int netlink_poll(struct file *file, struct socket *sock,
+- poll_table *wait)
+-{
+- struct sock *sk = sock->sk;
+- struct netlink_sock *nlk = nlk_sk(sk);
+- unsigned int mask;
+- int err;
+-
+- if (nlk->rx_ring.pg_vec != NULL) {
+- /* Memory mapped sockets don't call recvmsg(), so flow control
+- * for dumps is performed here. A dump is allowed to continue
+- * if at least half the ring is unused.
+- */
+- while (nlk->cb_running && netlink_dump_space(nlk)) {
+- err = netlink_dump(sk);
+- if (err < 0) {
+- sk->sk_err = -err;
+- sk->sk_error_report(sk);
+- break;
+- }
+- }
+- netlink_rcv_wake(sk);
+- }
+-
+- mask = datagram_poll(file, sock, wait);
+-
+- spin_lock_bh(&sk->sk_receive_queue.lock);
+- if (nlk->rx_ring.pg_vec) {
+- netlink_forward_ring(&nlk->rx_ring);
+- if (!netlink_previous_frame(&nlk->rx_ring, NL_MMAP_STATUS_UNUSED))
+- mask |= POLLIN | POLLRDNORM;
+- }
+- spin_unlock_bh(&sk->sk_receive_queue.lock);
+-
+- spin_lock_bh(&sk->sk_write_queue.lock);
+- if (nlk->tx_ring.pg_vec) {
+- if (netlink_current_frame(&nlk->tx_ring, NL_MMAP_STATUS_UNUSED))
+- mask |= POLLOUT | POLLWRNORM;
+- }
+- spin_unlock_bh(&sk->sk_write_queue.lock);
+-
+- return mask;
+-}
+-
+-static struct nl_mmap_hdr *netlink_mmap_hdr(struct sk_buff *skb)
+-{
+- return (struct nl_mmap_hdr *)(skb->head - NL_MMAP_HDRLEN);
+-}
+-
+-static void netlink_ring_setup_skb(struct sk_buff *skb, struct sock *sk,
+- struct netlink_ring *ring,
+- struct nl_mmap_hdr *hdr)
+-{
+- unsigned int size;
+- void *data;
+-
+- size = ring->frame_size - NL_MMAP_HDRLEN;
+- data = (void *)hdr + NL_MMAP_HDRLEN;
+-
+- skb->head = data;
+- skb->data = data;
+- skb_reset_tail_pointer(skb);
+- skb->end = skb->tail + size;
+- skb->len = 0;
+-
+- skb->destructor = netlink_skb_destructor;
+- NETLINK_CB(skb).flags |= NETLINK_SKB_MMAPED;
+- NETLINK_CB(skb).sk = sk;
+-}
+-
+-static int netlink_mmap_sendmsg(struct sock *sk, struct msghdr *msg,
+- u32 dst_portid, u32 dst_group,
+- struct sock_iocb *siocb)
+-{
+- struct netlink_sock *nlk = nlk_sk(sk);
+- struct netlink_ring *ring;
+- struct nl_mmap_hdr *hdr;
+- struct sk_buff *skb;
+- unsigned int maxlen;
+- int err = 0, len = 0;
+-
+- mutex_lock(&nlk->pg_vec_lock);
+-
+- ring = &nlk->tx_ring;
+- maxlen = ring->frame_size - NL_MMAP_HDRLEN;
+-
+- do {
+- unsigned int nm_len;
+-
+- hdr = netlink_current_frame(ring, NL_MMAP_STATUS_VALID);
+- if (hdr == NULL) {
+- if (!(msg->msg_flags & MSG_DONTWAIT) &&
+- atomic_read(&nlk->tx_ring.pending))
+- schedule();
+- continue;
+- }
+-
+- nm_len = ACCESS_ONCE(hdr->nm_len);
+- if (nm_len > maxlen) {
+- err = -EINVAL;
+- goto out;
+- }
+-
+- netlink_frame_flush_dcache(hdr, nm_len);
+-
+- skb = alloc_skb(nm_len, GFP_KERNEL);
+- if (skb == NULL) {
+- err = -ENOBUFS;
+- goto out;
+- }
+- __skb_put(skb, nm_len);
+- memcpy(skb->data, (void *)hdr + NL_MMAP_HDRLEN, nm_len);
+- netlink_set_status(hdr, NL_MMAP_STATUS_UNUSED);
+-
+- netlink_increment_head(ring);
+-
+- NETLINK_CB(skb).portid = nlk->portid;
+- NETLINK_CB(skb).dst_group = dst_group;
+- NETLINK_CB(skb).creds = siocb->scm->creds;
+-
+- err = security_netlink_send(sk, skb);
+- if (err) {
+- kfree_skb(skb);
+- goto out;
+- }
+-
+- if (unlikely(dst_group)) {
+- atomic_inc(&skb->users);
+- netlink_broadcast(sk, skb, dst_portid, dst_group,
+- GFP_KERNEL);
+- }
+- err = netlink_unicast(sk, skb, dst_portid,
+- msg->msg_flags & MSG_DONTWAIT);
+- if (err < 0)
+- goto out;
+- len += err;
+-
+- } while (hdr != NULL ||
+- (!(msg->msg_flags & MSG_DONTWAIT) &&
+- atomic_read(&nlk->tx_ring.pending)));
+-
+- if (len > 0)
+- err = len;
+-out:
+- mutex_unlock(&nlk->pg_vec_lock);
+- return err;
+-}
+-
+-static void netlink_queue_mmaped_skb(struct sock *sk, struct sk_buff *skb)
+-{
+- struct nl_mmap_hdr *hdr;
+-
+- hdr = netlink_mmap_hdr(skb);
+- hdr->nm_len = skb->len;
+- hdr->nm_group = NETLINK_CB(skb).dst_group;
+- hdr->nm_pid = NETLINK_CB(skb).creds.pid;
+- hdr->nm_uid = from_kuid(sk_user_ns(sk), NETLINK_CB(skb).creds.uid);
+- hdr->nm_gid = from_kgid(sk_user_ns(sk), NETLINK_CB(skb).creds.gid);
+- netlink_frame_flush_dcache(hdr, hdr->nm_len);
+- netlink_set_status(hdr, NL_MMAP_STATUS_VALID);
+-
+- NETLINK_CB(skb).flags |= NETLINK_SKB_DELIVERED;
+- kfree_skb(skb);
+-}
+-
+-static void netlink_ring_set_copied(struct sock *sk, struct sk_buff *skb)
+-{
+- struct netlink_sock *nlk = nlk_sk(sk);
+- struct netlink_ring *ring = &nlk->rx_ring;
+- struct nl_mmap_hdr *hdr;
+-
+- spin_lock_bh(&sk->sk_receive_queue.lock);
+- hdr = netlink_current_frame(ring, NL_MMAP_STATUS_UNUSED);
+- if (hdr == NULL) {
+- spin_unlock_bh(&sk->sk_receive_queue.lock);
+- kfree_skb(skb);
+- netlink_overrun(sk);
+- return;
+- }
+- netlink_increment_head(ring);
+- __skb_queue_tail(&sk->sk_receive_queue, skb);
+- spin_unlock_bh(&sk->sk_receive_queue.lock);
+-
+- hdr->nm_len = skb->len;
+- hdr->nm_group = NETLINK_CB(skb).dst_group;
+- hdr->nm_pid = NETLINK_CB(skb).creds.pid;
+- hdr->nm_uid = from_kuid(sk_user_ns(sk), NETLINK_CB(skb).creds.uid);
+- hdr->nm_gid = from_kgid(sk_user_ns(sk), NETLINK_CB(skb).creds.gid);
+- netlink_set_status(hdr, NL_MMAP_STATUS_COPY);
+-}
+-
+-#else /* CONFIG_NETLINK_MMAP */
+-#define netlink_rx_is_mmaped(sk) false
+-#define netlink_tx_is_mmaped(sk) false
+-#define netlink_mmap sock_no_mmap
+-#define netlink_poll datagram_poll
+-#define netlink_mmap_sendmsg(sk, msg, dst_portid, dst_group, siocb) 0
+-#endif /* CONFIG_NETLINK_MMAP */
+-
+ static void netlink_skb_destructor(struct sk_buff *skb)
+ {
+-#ifdef CONFIG_NETLINK_MMAP
+- struct nl_mmap_hdr *hdr;
+- struct netlink_ring *ring;
+- struct sock *sk;
+-
+- /* If a packet from the kernel to userspace was freed because of an
+- * error without being delivered to userspace, the kernel must reset
+- * the status. In the direction userspace to kernel, the status is
+- * always reset here after the packet was processed and freed.
+- */
+- if (netlink_skb_is_mmaped(skb)) {
+- hdr = netlink_mmap_hdr(skb);
+- sk = NETLINK_CB(skb).sk;
+-
+- if (NETLINK_CB(skb).flags & NETLINK_SKB_TX) {
+- netlink_set_status(hdr, NL_MMAP_STATUS_UNUSED);
+- ring = &nlk_sk(sk)->tx_ring;
+- } else {
+- if (!(NETLINK_CB(skb).flags & NETLINK_SKB_DELIVERED)) {
+- hdr->nm_len = 0;
+- netlink_set_status(hdr, NL_MMAP_STATUS_VALID);
+- }
+- ring = &nlk_sk(sk)->rx_ring;
+- }
+-
+- WARN_ON(atomic_read(&ring->pending) == 0);
+- atomic_dec(&ring->pending);
+- sock_put(sk);
+-
+- skb->head = NULL;
+- }
+-#endif
+ if (is_vmalloc_addr(skb->head)) {
+ if (!skb->cloned ||
+ !atomic_dec_return(&(skb_shinfo(skb)->dataref)))
+@@ -934,18 +343,6 @@ static void netlink_sock_destruct(struct sock *sk)
+ }
+
+ skb_queue_purge(&sk->sk_receive_queue);
+-#ifdef CONFIG_NETLINK_MMAP
+- if (1) {
+- struct nl_mmap_req req;
+-
+- memset(&req, 0, sizeof(req));
+- if (nlk->rx_ring.pg_vec)
+- __netlink_set_ring(sk, &req, false, NULL, 0);
+- memset(&req, 0, sizeof(req));
+- if (nlk->tx_ring.pg_vec)
+- __netlink_set_ring(sk, &req, true, NULL, 0);
+- }
+-#endif /* CONFIG_NETLINK_MMAP */
+
+ if (!sock_flag(sk, SOCK_DEAD)) {
+ printk(KERN_ERR "Freeing alive netlink socket %p\n", sk);
+@@ -1153,9 +550,6 @@ static int __netlink_create(struct net *net, struct socket *sock,
+ mutex_init(nlk->cb_mutex);
+ }
+ init_waitqueue_head(&nlk->wait);
+-#ifdef CONFIG_NETLINK_MMAP
+- mutex_init(&nlk->pg_vec_lock);
+-#endif
+
+ sk->sk_destruct = netlink_sock_destruct;
+ sk->sk_protocol = protocol;
+@@ -1653,9 +1047,8 @@ int netlink_attachskb(struct sock *sk, struct sk_buff *skb,
+
+ nlk = nlk_sk(sk);
+
+- if ((atomic_read(&sk->sk_rmem_alloc) > sk->sk_rcvbuf ||
+- test_bit(NETLINK_CONGESTED, &nlk->state)) &&
+- !netlink_skb_is_mmaped(skb)) {
++ if (atomic_read(&sk->sk_rmem_alloc) > sk->sk_rcvbuf ||
++ test_bit(NETLINK_CONGESTED, &nlk->state)) {
+ DECLARE_WAITQUEUE(wait, current);
+ if (!*timeo) {
+ if (!ssk || netlink_is_kernel(ssk))
+@@ -1693,14 +1086,7 @@ static int __netlink_sendskb(struct sock *sk, struct sk_buff *skb)
+
+ netlink_deliver_tap(skb);
+
+-#ifdef CONFIG_NETLINK_MMAP
+- if (netlink_skb_is_mmaped(skb))
+- netlink_queue_mmaped_skb(sk, skb);
+- else if (netlink_rx_is_mmaped(sk))
+- netlink_ring_set_copied(sk, skb);
+- else
+-#endif /* CONFIG_NETLINK_MMAP */
+- skb_queue_tail(&sk->sk_receive_queue, skb);
++ skb_queue_tail(&sk->sk_receive_queue, skb);
+ sk->sk_data_ready(sk);
+ return len;
+ }
+@@ -1724,9 +1110,6 @@ static struct sk_buff *netlink_trim(struct sk_buff *skb, gfp_t allocation)
+ int delta;
+
+ WARN_ON(skb->sk != NULL);
+- if (netlink_skb_is_mmaped(skb))
+- return skb;
+-
+ delta = skb->end - skb->tail;
+ if (is_vmalloc_addr(skb->head) || delta * 2 < skb->truesize)
+ return skb;
+@@ -1805,66 +1188,6 @@ EXPORT_SYMBOL(netlink_unicast);
+ struct sk_buff *netlink_alloc_skb(struct sock *ssk, unsigned int size,
+ u32 dst_portid, gfp_t gfp_mask)
+ {
+-#ifdef CONFIG_NETLINK_MMAP
+- struct sock *sk = NULL;
+- struct sk_buff *skb;
+- struct netlink_ring *ring;
+- struct nl_mmap_hdr *hdr;
+- unsigned int maxlen;
+-
+- sk = netlink_getsockbyportid(ssk, dst_portid);
+- if (IS_ERR(sk))
+- goto out;
+-
+- ring = &nlk_sk(sk)->rx_ring;
+- /* fast-path without atomic ops for common case: non-mmaped receiver */
+- if (ring->pg_vec == NULL)
+- goto out_put;
+-
+- if (ring->frame_size - NL_MMAP_HDRLEN < size)
+- goto out_put;
+-
+- skb = alloc_skb_head(gfp_mask);
+- if (skb == NULL)
+- goto err1;
+-
+- spin_lock_bh(&sk->sk_receive_queue.lock);
+- /* check again under lock */
+- if (ring->pg_vec == NULL)
+- goto out_free;
+-
+- /* check again under lock */
+- maxlen = ring->frame_size - NL_MMAP_HDRLEN;
+- if (maxlen < size)
+- goto out_free;
+-
+- netlink_forward_ring(ring);
+- hdr = netlink_current_frame(ring, NL_MMAP_STATUS_UNUSED);
+- if (hdr == NULL)
+- goto err2;
+- netlink_ring_setup_skb(skb, sk, ring, hdr);
+- netlink_set_status(hdr, NL_MMAP_STATUS_RESERVED);
+- atomic_inc(&ring->pending);
+- netlink_increment_head(ring);
+-
+- spin_unlock_bh(&sk->sk_receive_queue.lock);
+- return skb;
+-
+-err2:
+- kfree_skb(skb);
+- spin_unlock_bh(&sk->sk_receive_queue.lock);
+- netlink_overrun(sk);
+-err1:
+- sock_put(sk);
+- return NULL;
+-
+-out_free:
+- kfree_skb(skb);
+- spin_unlock_bh(&sk->sk_receive_queue.lock);
+-out_put:
+- sock_put(sk);
+-out:
+-#endif
+ return alloc_skb(size, gfp_mask);
+ }
+ EXPORT_SYMBOL_GPL(netlink_alloc_skb);
+@@ -2126,8 +1449,7 @@ static int netlink_setsockopt(struct socket *sock, int level, int optname,
+ if (level != SOL_NETLINK)
+ return -ENOPROTOOPT;
+
+- if (optname != NETLINK_RX_RING && optname != NETLINK_TX_RING &&
+- optlen >= sizeof(int) &&
++ if (optlen >= sizeof(int) &&
+ get_user(val, (unsigned int __user *)optval))
+ return -EFAULT;
+
+@@ -2180,25 +1502,6 @@ static int netlink_setsockopt(struct socket *sock, int level, int optname,
+ }
+ err = 0;
+ break;
+-#ifdef CONFIG_NETLINK_MMAP
+- case NETLINK_RX_RING:
+- case NETLINK_TX_RING: {
+- struct nl_mmap_req req;
+-
+- /* Rings might consume more memory than queue limits, require
+- * CAP_NET_ADMIN.
+- */
+- if (!capable(CAP_NET_ADMIN))
+- return -EPERM;
+- if (optlen < sizeof(req))
+- return -EINVAL;
+- if (copy_from_user(&req, optval, sizeof(req)))
+- return -EFAULT;
+- err = netlink_set_ring(sk, &req,
+- optname == NETLINK_TX_RING);
+- break;
+- }
+-#endif /* CONFIG_NETLINK_MMAP */
+ default:
+ err = -ENOPROTOOPT;
+ }
+@@ -2311,13 +1614,6 @@ static int netlink_sendmsg(struct kiocb *kiocb, struct socket *sock,
+ goto out;
+ }
+
+- if (netlink_tx_is_mmaped(sk) &&
+- msg->msg_iov->iov_base == NULL) {
+- err = netlink_mmap_sendmsg(sk, msg, dst_portid, dst_group,
+- siocb);
+- goto out;
+- }
+-
+ err = -EMSGSIZE;
+ if (len > sk->sk_sndbuf - 32)
+ goto out;
+@@ -2398,7 +1694,7 @@ static int netlink_recvmsg(struct kiocb *kiocb, struct socket *sock,
+ /* Record the max length of recvmsg() calls for future allocations */
+ nlk->max_recvmsg_len = max(nlk->max_recvmsg_len, len);
+ nlk->max_recvmsg_len = min_t(size_t, nlk->max_recvmsg_len,
+- 16384);
++ SKB_WITH_OVERHEAD(32768));
+
+ copied = data_skb->len;
+ if (len < copied) {
+@@ -2643,8 +1939,7 @@ static int netlink_dump(struct sock *sk)
+ cb = &nlk->cb;
+ alloc_size = max_t(int, cb->min_dump_alloc, NLMSG_GOODSIZE);
+
+- if (!netlink_rx_is_mmaped(sk) &&
+- atomic_read(&sk->sk_rmem_alloc) >= sk->sk_rcvbuf)
++ if (atomic_read(&sk->sk_rmem_alloc) >= sk->sk_rcvbuf)
+ goto errout_skb;
+
+ /* NLMSG_GOODSIZE is small to avoid high order allocations being
+@@ -2656,9 +1951,8 @@ static int netlink_dump(struct sock *sk)
+ skb = netlink_alloc_skb(sk,
+ nlk->max_recvmsg_len,
+ nlk->portid,
+- GFP_KERNEL |
+- __GFP_NOWARN |
+- __GFP_NORETRY);
++ (GFP_KERNEL & ~__GFP_WAIT) |
++ __GFP_NOWARN | __GFP_NORETRY);
+ /* available room should be exact amount to avoid MSG_TRUNC */
+ if (skb)
+ skb_reserve(skb, skb_tailroom(skb) -
+@@ -2666,7 +1960,7 @@ static int netlink_dump(struct sock *sk)
+ }
+ if (!skb)
+ skb = netlink_alloc_skb(sk, alloc_size, nlk->portid,
+- GFP_KERNEL);
++ (GFP_KERNEL & ~__GFP_WAIT));
+ if (!skb)
+ goto errout_skb;
+ netlink_skb_set_owner_r(skb, sk);
+@@ -2722,16 +2016,7 @@ int __netlink_dump_start(struct sock *ssk, struct sk_buff *skb,
+ struct netlink_sock *nlk;
+ int ret;
+
+- /* Memory mapped dump requests need to be copied to avoid looping
+- * on the pending state in netlink_mmap_sendmsg() while the CB hold
+- * a reference to the skb.
+- */
+- if (netlink_skb_is_mmaped(skb)) {
+- skb = skb_copy(skb, GFP_KERNEL);
+- if (skb == NULL)
+- return -ENOBUFS;
+- } else
+- atomic_inc(&skb->users);
++ atomic_inc(&skb->users);
+
+ sk = netlink_lookup(sock_net(ssk), ssk->sk_protocol, NETLINK_CB(skb).portid);
+ if (sk == NULL) {
+@@ -3072,7 +2357,7 @@ static const struct proto_ops netlink_ops = {
+ .socketpair = sock_no_socketpair,
+ .accept = sock_no_accept,
+ .getname = netlink_getname,
+- .poll = netlink_poll,
++ .poll = datagram_poll,
+ .ioctl = sock_no_ioctl,
+ .listen = sock_no_listen,
+ .shutdown = sock_no_shutdown,
+@@ -3080,7 +2365,7 @@ static const struct proto_ops netlink_ops = {
+ .getsockopt = netlink_getsockopt,
+ .sendmsg = netlink_sendmsg,
+ .recvmsg = netlink_recvmsg,
+- .mmap = netlink_mmap,
++ .mmap = sock_no_mmap,
+ .sendpage = sock_no_sendpage,
+ };
+
+diff --git a/net/netlink/af_netlink.h b/net/netlink/af_netlink.h
+index 3951874e715d..c6bd3dd35cb3 100644
+--- a/net/netlink/af_netlink.h
++++ b/net/netlink/af_netlink.h
+@@ -42,12 +42,6 @@ struct netlink_sock {
+ int (*netlink_bind)(int group);
+ void (*netlink_unbind)(int group);
+ struct module *module;
+-#ifdef CONFIG_NETLINK_MMAP
+- struct mutex pg_vec_lock;
+- struct netlink_ring rx_ring;
+- struct netlink_ring tx_ring;
+- atomic_t mapped;
+-#endif /* CONFIG_NETLINK_MMAP */
+
+ struct rhash_head node;
+ };
+@@ -57,15 +51,6 @@ static inline struct netlink_sock *nlk_sk(struct sock *sk)
+ return container_of(sk, struct netlink_sock, sk);
+ }
+
+-static inline bool netlink_skb_is_mmaped(const struct sk_buff *skb)
+-{
+-#ifdef CONFIG_NETLINK_MMAP
+- return NETLINK_CB(skb).flags & NETLINK_SKB_MMAPED;
+-#else
+- return false;
+-#endif /* CONFIG_NETLINK_MMAP */
+-}
+-
+ struct netlink_table {
+ struct rhashtable hash;
+ struct hlist_head mc_list;
+diff --git a/net/netlink/diag.c b/net/netlink/diag.c
+index de8c74a3c061..dd5f2ffd13e6 100644
+--- a/net/netlink/diag.c
++++ b/net/netlink/diag.c
+@@ -8,41 +8,6 @@
+
+ #include "af_netlink.h"
+
+-#ifdef CONFIG_NETLINK_MMAP
+-static int sk_diag_put_ring(struct netlink_ring *ring, int nl_type,
+- struct sk_buff *nlskb)
+-{
+- struct netlink_diag_ring ndr;
+-
+- ndr.ndr_block_size = ring->pg_vec_pages << PAGE_SHIFT;
+- ndr.ndr_block_nr = ring->pg_vec_len;
+- ndr.ndr_frame_size = ring->frame_size;
+- ndr.ndr_frame_nr = ring->frame_max + 1;
+-
+- return nla_put(nlskb, nl_type, sizeof(ndr), &ndr);
+-}
+-
+-static int sk_diag_put_rings_cfg(struct sock *sk, struct sk_buff *nlskb)
+-{
+- struct netlink_sock *nlk = nlk_sk(sk);
+- int ret;
+-
+- mutex_lock(&nlk->pg_vec_lock);
+- ret = sk_diag_put_ring(&nlk->rx_ring, NETLINK_DIAG_RX_RING, nlskb);
+- if (!ret)
+- ret = sk_diag_put_ring(&nlk->tx_ring, NETLINK_DIAG_TX_RING,
+- nlskb);
+- mutex_unlock(&nlk->pg_vec_lock);
+-
+- return ret;
+-}
+-#else
+-static int sk_diag_put_rings_cfg(struct sock *sk, struct sk_buff *nlskb)
+-{
+- return 0;
+-}
+-#endif
+-
+ static int sk_diag_dump_groups(struct sock *sk, struct sk_buff *nlskb)
+ {
+ struct netlink_sock *nlk = nlk_sk(sk);
+@@ -87,10 +52,6 @@ static int sk_diag_fill(struct sock *sk, struct sk_buff *skb,
+ sock_diag_put_meminfo(sk, skb, NETLINK_DIAG_MEMINFO))
+ goto out_nlmsg_trim;
+
+- if ((req->ndiag_show & NDIAG_SHOW_RING_CFG) &&
+- sk_diag_put_rings_cfg(sk, skb))
+- goto out_nlmsg_trim;
+-
+ return nlmsg_end(skb, nlh);
+
+ out_nlmsg_trim:
+diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
+index abffc1519e4d..86b3e2f70a27 100644
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -240,7 +240,7 @@ static void __fanout_link(struct sock *sk, struct packet_sock *po);
+ static int packet_direct_xmit(struct sk_buff *skb)
+ {
+ struct net_device *dev = skb->dev;
+- netdev_features_t features;
++ struct sk_buff *orig_skb = skb;
+ struct netdev_queue *txq;
+ int ret = NETDEV_TX_BUSY;
+
+@@ -248,9 +248,8 @@ static int packet_direct_xmit(struct sk_buff *skb)
+ !netif_carrier_ok(dev)))
+ goto drop;
+
+- features = netif_skb_features(skb);
+- if (skb_needs_linearize(skb, features) &&
+- __skb_linearize(skb))
++ skb = validate_xmit_skb_list(skb, dev);
++ if (skb != orig_skb)
+ goto drop;
+
+ txq = skb_get_tx_queue(dev, skb);
+@@ -270,7 +269,7 @@ static int packet_direct_xmit(struct sk_buff *skb)
+ return ret;
+ drop:
+ atomic_long_inc(&dev->tx_dropped);
+- kfree_skb(skb);
++ kfree_skb_list(skb);
+ return NET_XMIT_DROP;
+ }
+
+@@ -2739,7 +2738,7 @@ static int packet_bind_spkt(struct socket *sock, struct sockaddr *uaddr,
+ int addr_len)
+ {
+ struct sock *sk = sock->sk;
+- char name[15];
++ char name[sizeof(uaddr->sa_data) + 1];
+
+ /*
+ * Check legality
+@@ -2747,7 +2746,11 @@ static int packet_bind_spkt(struct socket *sock, struct sockaddr *uaddr,
+
+ if (addr_len != sizeof(struct sockaddr))
+ return -EINVAL;
+- strlcpy(name, uaddr->sa_data, sizeof(name));
++ /* uaddr->sa_data comes from the userspace, it's not guaranteed to be
++ * zero-terminated.
++ */
++ memcpy(name, uaddr->sa_data, sizeof(uaddr->sa_data));
++ name[sizeof(uaddr->sa_data)] = 0;
+
+ return packet_do_bind(sk, name, 0, pkt_sk(sk)->num);
+ }
+@@ -3552,6 +3555,7 @@ static int packet_notifier(struct notifier_block *this,
+ }
+ if (msg == NETDEV_UNREGISTER) {
+ packet_cached_dev_reset(po);
++ fanout_release(sk);
+ po->ifindex = -1;
+ if (po->prot_hook.dev)
+ dev_put(po->prot_hook.dev);
+@@ -3804,8 +3808,8 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u,
+ if (unlikely(req->tp_block_size & (PAGE_SIZE - 1)))
+ goto out;
+ if (po->tp_version >= TPACKET_V3 &&
+- (int)(req->tp_block_size -
+- BLK_PLUS_PRIV(req_u->req3.tp_sizeof_priv)) <= 0)
++ req->tp_block_size <=
++ BLK_PLUS_PRIV((u64)req_u->req3.tp_sizeof_priv))
+ goto out;
+ if (unlikely(req->tp_frame_size < po->tp_hdrlen +
+ po->tp_reserve))
+diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
+index e6bb98e583fb..690a973b72b5 100644
+--- a/net/sctp/sm_statefuns.c
++++ b/net/sctp/sm_statefuns.c
+@@ -3426,6 +3426,12 @@ sctp_disposition_t sctp_sf_ootb(struct net *net,
+ return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
+ commands);
+
++ /* Report violation if chunk len overflows */
++ ch_end = ((__u8 *)ch) + WORD_ROUND(ntohs(ch->length));
++ if (ch_end > skb_tail_pointer(skb))
++ return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
++ commands);
++
+ /* Now that we know we at least have a chunk header,
+ * do things that are type appropriate.
+ */
+@@ -3457,12 +3463,6 @@ sctp_disposition_t sctp_sf_ootb(struct net *net,
+ }
+ }
+
+- /* Report violation if chunk len overflows */
+- ch_end = ((__u8 *)ch) + WORD_ROUND(ntohs(ch->length));
+- if (ch_end > skb_tail_pointer(skb))
+- return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
+- commands);
+-
+ ch = (sctp_chunkhdr_t *) ch_end;
+ } while (ch_end < skb_tail_pointer(skb));
+
+diff --git a/net/sctp/socket.c b/net/sctp/socket.c
+index 72da7d58ccca..1e557ee4cd65 100644
+--- a/net/sctp/socket.c
++++ b/net/sctp/socket.c
+@@ -4385,7 +4385,7 @@ static int sctp_getsockopt_disable_fragments(struct sock *sk, int len,
+ static int sctp_getsockopt_events(struct sock *sk, int len, char __user *optval,
+ int __user *optlen)
+ {
+- if (len <= 0)
++ if (len == 0)
+ return -EINVAL;
+ if (len > sizeof(struct sctp_event_subscribe))
+ len = sizeof(struct sctp_event_subscribe);
+@@ -5981,6 +5981,9 @@ static int sctp_getsockopt(struct sock *sk, int level, int optname,
+ if (get_user(len, optlen))
+ return -EFAULT;
+
++ if (len < 0)
++ return -EINVAL;
++
+ lock_sock(sk);
+
+ switch (optname) {
+@@ -6962,7 +6965,8 @@ static int sctp_wait_for_sndbuf(struct sctp_association *asoc, long *timeo_p,
+ */
+ release_sock(sk);
+ current_timeo = schedule_timeout(current_timeo);
+- BUG_ON(sk != asoc->base.sk);
++ if (sk != asoc->base.sk)
++ goto do_error;
+ lock_sock(sk);
+
+ *timeo_p = current_timeo;
+diff --git a/net/socket.c b/net/socket.c
+index 7f61789c78ff..e72371710fe3 100644
+--- a/net/socket.c
++++ b/net/socket.c
+@@ -2355,8 +2355,10 @@ int __sys_recvmmsg(int fd, struct mmsghdr __user *mmsg, unsigned int vlen,
+ return err;
+
+ err = sock_error(sock->sk);
+- if (err)
++ if (err) {
++ datagrams = err;
+ goto out_put;
++ }
+
+ entry = mmsg;
+ compat_entry = (struct compat_mmsghdr __user *)mmsg;
+diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
+index 287087b10a7e..7950b4c26651 100644
+--- a/net/unix/af_unix.c
++++ b/net/unix/af_unix.c
+@@ -940,20 +940,32 @@ fail:
+ return NULL;
+ }
+
+-static int unix_mknod(struct dentry *dentry, struct path *path, umode_t mode,
+- struct path *res)
++static int unix_mknod(const char *sun_path, umode_t mode, struct path *res)
+ {
+- int err;
++ struct dentry *dentry;
++ struct path path;
++ int err = 0;
++ /*
++ * Get the parent directory, calculate the hash for last
++ * component.
++ */
++ dentry = kern_path_create(AT_FDCWD, sun_path, &path, 0);
++ err = PTR_ERR(dentry);
++ if (IS_ERR(dentry))
++ return err;
+
+- err = security_path_mknod(path, dentry, mode, 0);
++ /*
++ * All right, let's create it.
++ */
++ err = security_path_mknod(&path, dentry, mode, 0);
+ if (!err) {
+- err = vfs_mknod(d_inode(path->dentry), dentry, mode, 0);
++ err = vfs_mknod(d_inode(path.dentry), dentry, mode, 0);
+ if (!err) {
+- res->mnt = mntget(path->mnt);
++ res->mnt = mntget(path.mnt);
+ res->dentry = dget(dentry);
+ }
+ }
+-
++ done_path_create(&path, dentry);
+ return err;
+ }
+
+@@ -964,12 +976,10 @@ static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
+ struct unix_sock *u = unix_sk(sk);
+ struct sockaddr_un *sunaddr = (struct sockaddr_un *)uaddr;
+ char *sun_path = sunaddr->sun_path;
+- int err, name_err;
++ int err;
+ unsigned int hash;
+ struct unix_address *addr;
+ struct hlist_head *list;
+- struct path path;
+- struct dentry *dentry;
+
+ err = -EINVAL;
+ if (sunaddr->sun_family != AF_UNIX)
+@@ -985,34 +995,14 @@ static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
+ goto out;
+ addr_len = err;
+
+- name_err = 0;
+- dentry = NULL;
+- if (sun_path[0]) {
+- /* Get the parent directory, calculate the hash for last
+- * component.
+- */
+- dentry = kern_path_create(AT_FDCWD, sun_path, &path, 0);
+-
+- if (IS_ERR(dentry)) {
+- /* delay report until after 'already bound' check */
+- name_err = PTR_ERR(dentry);
+- dentry = NULL;
+- }
+- }
+-
+ err = mutex_lock_interruptible(&u->readlock);
+ if (err)
+- goto out_path;
++ goto out;
+
+ err = -EINVAL;
+ if (u->addr)
+ goto out_up;
+
+- if (name_err) {
+- err = name_err == -EEXIST ? -EADDRINUSE : name_err;
+- goto out_up;
+- }
+-
+ err = -ENOMEM;
+ addr = kmalloc(sizeof(*addr)+addr_len, GFP_KERNEL);
+ if (!addr)
+@@ -1023,11 +1013,11 @@ static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
+ addr->hash = hash ^ sk->sk_type;
+ atomic_set(&addr->refcnt, 1);
+
+- if (dentry) {
+- struct path u_path;
++ if (sun_path[0]) {
++ struct path path;
+ umode_t mode = S_IFSOCK |
+ (SOCK_INODE(sock)->i_mode & ~current_umask());
+- err = unix_mknod(dentry, &path, mode, &u_path);
++ err = unix_mknod(sun_path, mode, &path);
+ if (err) {
+ if (err == -EEXIST)
+ err = -EADDRINUSE;
+@@ -1035,9 +1025,9 @@ static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
+ goto out_up;
+ }
+ addr->hash = UNIX_HASH_SIZE;
+- hash = d_backing_inode(dentry)->i_ino & (UNIX_HASH_SIZE - 1);
++ hash = d_backing_inode(path.dentry)->i_ino & (UNIX_HASH_SIZE-1);
+ spin_lock(&unix_table_lock);
+- u->path = u_path;
++ u->path = path;
+ list = &unix_socket_table[hash];
+ } else {
+ spin_lock(&unix_table_lock);
+@@ -1060,10 +1050,6 @@ out_unlock:
+ spin_unlock(&unix_table_lock);
+ out_up:
+ mutex_unlock(&u->readlock);
+-out_path:
+- if (dentry)
+- done_path_create(&path, dentry);
+-
+ out:
+ return err;
+ }
+diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
+index 4769382d9478..64faba06be38 100644
+--- a/net/xfrm/xfrm_policy.c
++++ b/net/xfrm/xfrm_policy.c
+@@ -3004,6 +3004,11 @@ static int __net_init xfrm_net_init(struct net *net)
+ {
+ int rv;
+
++ /* Initialize the per-net locks here */
++ spin_lock_init(&net->xfrm.xfrm_state_lock);
++ rwlock_init(&net->xfrm.xfrm_policy_lock);
++ mutex_init(&net->xfrm.xfrm_cfg_mutex);
++
+ rv = xfrm_statistics_init(net);
+ if (rv < 0)
+ goto out_statistics;
+@@ -3020,11 +3025,6 @@ static int __net_init xfrm_net_init(struct net *net)
+ if (rv < 0)
+ goto out;
+
+- /* Initialize the per-net locks here */
+- spin_lock_init(&net->xfrm.xfrm_state_lock);
+- rwlock_init(&net->xfrm.xfrm_policy_lock);
+- mutex_init(&net->xfrm.xfrm_cfg_mutex);
+-
+ return 0;
+
+ out:
+diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
+index e812e988c111..b8170ae1461e 100644
+--- a/net/xfrm/xfrm_user.c
++++ b/net/xfrm/xfrm_user.c
+@@ -386,7 +386,14 @@ static inline int xfrm_replay_verify_len(struct xfrm_replay_state_esn *replay_es
+ up = nla_data(rp);
+ ulen = xfrm_replay_state_esn_len(up);
+
+- if (nla_len(rp) < ulen || xfrm_replay_state_esn_len(replay_esn) != ulen)
++ /* Check the overall length and the internal bitmap length to avoid
++ * potential overflow. */
++ if (nla_len(rp) < ulen ||
++ xfrm_replay_state_esn_len(replay_esn) != ulen ||
++ replay_esn->bmp_len != up->bmp_len)
++ return -EINVAL;
++
++ if (up->replay_window > up->bmp_len * sizeof(__u32) * 8)
+ return -EINVAL;
+
+ return 0;
+diff --git a/samples/mic/mpssd/.gitignore b/samples/mic/mpssd/.gitignore
+new file mode 100644
+index 000000000000..8b7c72f07c92
+--- /dev/null
++++ b/samples/mic/mpssd/.gitignore
+@@ -0,0 +1 @@
++mpssd
+diff --git a/samples/mic/mpssd/Makefile b/samples/mic/mpssd/Makefile
+new file mode 100644
+index 000000000000..3e3ef91fed6b
+--- /dev/null
++++ b/samples/mic/mpssd/Makefile
+@@ -0,0 +1,27 @@
++ifndef CROSS_COMPILE
++uname_M := $(shell uname -m 2>/dev/null || echo not)
++ARCH ?= $(shell echo $(uname_M) | sed -e s/i.86/x86/ -e s/x86_64/x86/)
++
++ifeq ($(ARCH),x86)
++
++PROGS := mpssd
++CC = $(CROSS_COMPILE)gcc
++CFLAGS := -I../../../usr/include -I../../../tools/include
++
++ifdef DEBUG
++CFLAGS += -DDEBUG=$(DEBUG)
++endif
++
++all: $(PROGS)
++mpssd: mpssd.c sysfs.c
++ $(CC) $(CFLAGS) mpssd.c sysfs.c -o mpssd -lpthread
++
++install:
++ install mpssd /usr/sbin/mpssd
++ install micctrl /usr/sbin/micctrl
++
++clean:
++ rm -fr $(PROGS)
++
++endif
++endif
+diff --git a/samples/mic/mpssd/micctrl b/samples/mic/mpssd/micctrl
+new file mode 100644
+index 000000000000..8f2629b41c5f
+--- /dev/null
++++ b/samples/mic/mpssd/micctrl
+@@ -0,0 +1,173 @@
++#!/bin/bash
++# Intel MIC Platform Software Stack (MPSS)
++#
++# Copyright(c) 2013 Intel Corporation.
++#
++# This program is free software; you can redistribute it and/or modify
++# it under the terms of the GNU General Public License, version 2, as
++# published by the Free Software Foundation.
++#
++# This program is distributed in the hope that it will be useful, but
++# WITHOUT ANY WARRANTY; without even the implied warranty of
++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
++# General Public License for more details.
++#
++# The full GNU General Public License is included in this distribution in
++# the file called "COPYING".
++#
++# Intel MIC User Space Tools.
++#
++# micctrl - Controls MIC boot/start/stop.
++#
++# chkconfig: 2345 95 05
++# description: start MPSS stack processing.
++#
++### BEGIN INIT INFO
++# Provides: micctrl
++### END INIT INFO
++
++# Source function library.
++. /etc/init.d/functions
++
++sysfs="/sys/class/mic"
++
++_status()
++{
++ f=$sysfs/$1
++ echo -e $1 state: "`cat $f/state`" shutdown_status: "`cat $f/shutdown_status`"
++}
++
++status()
++{
++ if [ "`echo $1 | head -c3`" == "mic" ]; then
++ _status $1
++ return $?
++ fi
++ for f in $sysfs/*
++ do
++ _status `basename $f`
++ RETVAL=$?
++ [ $RETVAL -ne 0 ] && return $RETVAL
++ done
++ return 0
++}
++
++_reset()
++{
++ f=$sysfs/$1
++ echo reset > $f/state
++}
++
++reset()
++{
++ if [ "`echo $1 | head -c3`" == "mic" ]; then
++ _reset $1
++ return $?
++ fi
++ for f in $sysfs/*
++ do
++ _reset `basename $f`
++ RETVAL=$?
++ [ $RETVAL -ne 0 ] && return $RETVAL
++ done
++ return 0
++}
++
++_boot()
++{
++ f=$sysfs/$1
++ echo "linux" > $f/bootmode
++ echo "mic/uos.img" > $f/firmware
++ echo "mic/$1.image" > $f/ramdisk
++ echo "boot" > $f/state
++}
++
++boot()
++{
++ if [ "`echo $1 | head -c3`" == "mic" ]; then
++ _boot $1
++ return $?
++ fi
++ for f in $sysfs/*
++ do
++ _boot `basename $f`
++ RETVAL=$?
++ [ $RETVAL -ne 0 ] && return $RETVAL
++ done
++ return 0
++}
++
++_shutdown()
++{
++ f=$sysfs/$1
++ echo shutdown > $f/state
++}
++
++shutdown()
++{
++ if [ "`echo $1 | head -c3`" == "mic" ]; then
++ _shutdown $1
++ return $?
++ fi
++ for f in $sysfs/*
++ do
++ _shutdown `basename $f`
++ RETVAL=$?
++ [ $RETVAL -ne 0 ] && return $RETVAL
++ done
++ return 0
++}
++
++_wait()
++{
++ f=$sysfs/$1
++ while [ "`cat $f/state`" != "offline" -a "`cat $f/state`" != "online" ]
++ do
++ sleep 1
++ echo -e "Waiting for $1 to go offline"
++ done
++}
++
++wait()
++{
++ if [ "`echo $1 | head -c3`" == "mic" ]; then
++ _wait $1
++ return $?
++ fi
++ # Wait for the cards to go offline
++ for f in $sysfs/*
++ do
++ _wait `basename $f`
++ RETVAL=$?
++ [ $RETVAL -ne 0 ] && return $RETVAL
++ done
++ return 0
++}
++
++if [ ! -d "$sysfs" ]; then
++ echo -e $"Module unloaded "
++ exit 3
++fi
++
++case $1 in
++ -s)
++ status $2
++ ;;
++ -r)
++ reset $2
++ ;;
++ -b)
++ boot $2
++ ;;
++ -S)
++ shutdown $2
++ ;;
++ -w)
++ wait $2
++ ;;
++ *)
++ echo $"Usage: $0 {-s (status) |-r (reset) |-b (boot) |-S (shutdown) |-w (wait)}"
++ exit 2
++esac
++
++exit $?
+diff --git a/samples/mic/mpssd/mpss b/samples/mic/mpssd/mpss
+new file mode 100644
+index 000000000000..cacbdb0aefb9
+--- /dev/null
++++ b/samples/mic/mpssd/mpss
+@@ -0,0 +1,202 @@
++#!/bin/bash
++# Intel MIC Platform Software Stack (MPSS)
++#
++# Copyright(c) 2013 Intel Corporation.
++#
++# This program is free software; you can redistribute it and/or modify
++# it under the terms of the GNU General Public License, version 2, as
++# published by the Free Software Foundation.
++#
++# This program is distributed in the hope that it will be useful, but
++# WITHOUT ANY WARRANTY; without even the implied warranty of
++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
++# General Public License for more details.
++#
++# The full GNU General Public License is included in this distribution in
++# the file called "COPYING".
++#
++# Intel MIC User Space Tools.
++#
++# mpss Start mpssd.
++#
++# chkconfig: 2345 95 05
++# description: start MPSS stack processing.
++#
++### BEGIN INIT INFO
++# Provides: mpss
++# Required-Start:
++# Required-Stop:
++# Short-Description: MPSS stack control
++# Description: MPSS stack control
++### END INIT INFO
++
++# Source function library.
++. /etc/init.d/functions
++
++exec=/usr/sbin/mpssd
++sysfs="/sys/class/mic"
++
++start()
++{
++ [ -x $exec ] || exit 5
++
++ if [ "`ps -e | awk '{print $4}' | grep mpssd | head -1`" = "mpssd" ]; then
++ echo -e $"MPSSD already running! "
++ success
++ echo
++ return 0
++ fi
++
++ echo -e $"Starting MPSS Stack"
++ echo -e $"Loading MIC_X100_DMA & MIC_HOST Modules"
++
++ for f in "mic_host" "mic_x100_dma"
++ do
++ modprobe $f
++ RETVAL=$?
++ if [ $RETVAL -ne 0 ]; then
++ failure
++ echo
++ return $RETVAL
++ fi
++ done
++
++ # Start the daemon
++ echo -n $"Starting MPSSD "
++ $exec
++ RETVAL=$?
++ if [ $RETVAL -ne 0 ]; then
++ failure
++ echo
++ return $RETVAL
++ fi
++ success
++ echo
++
++ sleep 5
++
++ # Boot the cards
++ micctrl -b
++
++ # Wait till ping works
++ for f in $sysfs/*
++ do
++ count=100
++ ipaddr=`cat $f/cmdline`
++ ipaddr=${ipaddr#*address,}
++ ipaddr=`echo $ipaddr | cut -d, -f1 | cut -d\; -f1`
++ while [ $count -ge 0 ]
++ do
++ echo -e "Pinging "`basename $f`" "
++ ping -c 1 $ipaddr &> /dev/null
++ RETVAL=$?
++ if [ $RETVAL -eq 0 ]; then
++ success
++ break
++ fi
++ sleep 1
++ count=`expr $count - 1`
++ done
++ [ $RETVAL -ne 0 ] && failure || success
++ echo
++ done
++ return $RETVAL
++}
++
++stop()
++{
++ echo -e $"Shutting down MPSS Stack: "
++
++ # Bail out if module is unloaded
++ if [ ! -d "$sysfs" ]; then
++ echo -n $"Module unloaded "
++ success
++ echo
++ return 0
++ fi
++
++ # Shut down the cards.
++ micctrl -S
++
++ # Wait for the cards to go offline
++ for f in $sysfs/*
++ do
++ while [ "`cat $f/state`" != "offline" ]
++ do
++ sleep 1
++ echo -e "Waiting for "`basename $f`" to go offline"
++ done
++ done
++
++ # Display the status of the cards
++ micctrl -s
++
++ # Kill MPSSD now
++ echo -n $"Killing MPSSD"
++ killall -9 mpssd 2>/dev/null
++ RETVAL=$?
++ [ $RETVAL -ne 0 ] && failure || success
++ echo
++ return $RETVAL
++}
++
++restart()
++{
++ stop
++ sleep 5
++ start
++}
++
++status()
++{
++ micctrl -s
++ if [ "`ps -e | awk '{print $4}' | grep mpssd | head -n 1`" = "mpssd" ]; then
++ echo "mpssd is running"
++ else
++ echo "mpssd is stopped"
++ fi
++ return 0
++}
++
++unload()
++{
++ if [ ! -d "$sysfs" ]; then
++ echo -n $"No MIC_HOST Module: "
++ success
++ echo
++ return
++ fi
++
++ stop
++
++ sleep 5
++ echo -n $"Removing MIC_HOST & MIC_X100_DMA Modules: "
++ modprobe -r mic_host mic_x100_dma
++ RETVAL=$?
++ [ $RETVAL -ne 0 ] && failure || success
++ echo
++ return $RETVAL
++}
++
++case $1 in
++ start)
++ start
++ ;;
++ stop)
++ stop
++ ;;
++ restart)
++ restart
++ ;;
++ status)
++ status
++ ;;
++ unload)
++ unload
++ ;;
++ *)
++ echo $"Usage: $0 {start|stop|restart|status|unload}"
++ exit 2
++esac
++
++exit $?
+diff --git a/samples/mic/mpssd/mpssd.c b/samples/mic/mpssd/mpssd.c
+new file mode 100644
+index 000000000000..3c5c379fc29d
+--- /dev/null
++++ b/samples/mic/mpssd/mpssd.c
+@@ -0,0 +1,1728 @@
++/*
++ * Intel MIC Platform Software Stack (MPSS)
++ *
++ * Copyright(c) 2013 Intel Corporation.
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License, version 2, as
++ * published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful, but
++ * WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
++ * General Public License for more details.
++ *
++ * The full GNU General Public License is included in this distribution in
++ * the file called "COPYING".
++ *
++ * Intel MIC User Space Tools.
++ */
++
++#define _GNU_SOURCE
++
++#include <stdlib.h>
++#include <fcntl.h>
++#include <getopt.h>
++#include <assert.h>
++#include <unistd.h>
++#include <stdbool.h>
++#include <signal.h>
++#include <poll.h>
++#include <features.h>
++#include <sys/types.h>
++#include <sys/stat.h>
++#include <sys/mman.h>
++#include <sys/socket.h>
++#include <linux/virtio_ring.h>
++#include <linux/virtio_net.h>
++#include <linux/virtio_console.h>
++#include <linux/virtio_blk.h>
++#include <linux/version.h>
++#include "mpssd.h"
++#include <linux/mic_ioctl.h>
++#include <linux/mic_common.h>
++#include <tools/endian.h>
++
++static void init_mic(struct mic_info *mic);
++
++static FILE *logfp;
++static struct mic_info mic_list;
++
++#define ARRAY_SIZE(x) (sizeof(x) / sizeof((x)[0]))
++
++#define min_t(type, x, y) ({ \
++ type __min1 = (x); \
++ type __min2 = (y); \
++ __min1 < __min2 ? __min1 : __min2; })
++
++/* align addr on a size boundary - adjust address up/down if needed */
++#define _ALIGN_DOWN(addr, size) ((addr)&(~((size)-1)))
++#define _ALIGN_UP(addr, size) _ALIGN_DOWN(addr + size - 1, size)
++
++/* align addr on a size boundary - adjust address up if needed */
++#define _ALIGN(addr, size) _ALIGN_UP(addr, size)
++
++/* to align the pointer to the (next) page boundary */
++#define PAGE_ALIGN(addr) _ALIGN(addr, PAGE_SIZE)
++
++#define ACCESS_ONCE(x) (*(volatile typeof(x) *)&(x))
++
++#define GSO_ENABLED 1
++#define MAX_GSO_SIZE (64 * 1024)
++#define ETH_H_LEN 14
++#define MAX_NET_PKT_SIZE (_ALIGN_UP(MAX_GSO_SIZE + ETH_H_LEN, 64))
++#define MIC_DEVICE_PAGE_END 0x1000
++
++#ifndef VIRTIO_NET_HDR_F_DATA_VALID
++#define VIRTIO_NET_HDR_F_DATA_VALID 2 /* Csum is valid */
++#endif
++
++static struct {
++ struct mic_device_desc dd;
++ struct mic_vqconfig vqconfig[2];
++ __u32 host_features, guest_acknowledgements;
++ struct virtio_console_config cons_config;
++} virtcons_dev_page = {
++ .dd = {
++ .type = VIRTIO_ID_CONSOLE,
++ .num_vq = ARRAY_SIZE(virtcons_dev_page.vqconfig),
++ .feature_len = sizeof(virtcons_dev_page.host_features),
++ .config_len = sizeof(virtcons_dev_page.cons_config),
++ },
++ .vqconfig[0] = {
++ .num = htole16(MIC_VRING_ENTRIES),
++ },
++ .vqconfig[1] = {
++ .num = htole16(MIC_VRING_ENTRIES),
++ },
++};
++
++static struct {
++ struct mic_device_desc dd;
++ struct mic_vqconfig vqconfig[2];
++ __u32 host_features, guest_acknowledgements;
++ struct virtio_net_config net_config;
++} virtnet_dev_page = {
++ .dd = {
++ .type = VIRTIO_ID_NET,
++ .num_vq = ARRAY_SIZE(virtnet_dev_page.vqconfig),
++ .feature_len = sizeof(virtnet_dev_page.host_features),
++ .config_len = sizeof(virtnet_dev_page.net_config),
++ },
++ .vqconfig[0] = {
++ .num = htole16(MIC_VRING_ENTRIES),
++ },
++ .vqconfig[1] = {
++ .num = htole16(MIC_VRING_ENTRIES),
++ },
++#if GSO_ENABLED
++ .host_features = htole32(
++ 1 << VIRTIO_NET_F_CSUM |
++ 1 << VIRTIO_NET_F_GSO |
++ 1 << VIRTIO_NET_F_GUEST_TSO4 |
++ 1 << VIRTIO_NET_F_GUEST_TSO6 |
++ 1 << VIRTIO_NET_F_GUEST_ECN |
++ 1 << VIRTIO_NET_F_GUEST_UFO),
++#else
++ .host_features = 0,
++#endif
++};
++
++static const char *mic_config_dir = "/etc/sysconfig/mic";
++static const char *virtblk_backend = "VIRTBLK_BACKEND";
++static struct {
++ struct mic_device_desc dd;
++ struct mic_vqconfig vqconfig[1];
++ __u32 host_features, guest_acknowledgements;
++ struct virtio_blk_config blk_config;
++} virtblk_dev_page = {
++ .dd = {
++ .type = VIRTIO_ID_BLOCK,
++ .num_vq = ARRAY_SIZE(virtblk_dev_page.vqconfig),
++ .feature_len = sizeof(virtblk_dev_page.host_features),
++ .config_len = sizeof(virtblk_dev_page.blk_config),
++ },
++ .vqconfig[0] = {
++ .num = htole16(MIC_VRING_ENTRIES),
++ },
++ .host_features =
++ htole32(1<<VIRTIO_BLK_F_SEG_MAX),
++ .blk_config = {
++ .seg_max = htole32(MIC_VRING_ENTRIES - 2),
++ .capacity = htole64(0),
++ }
++};
++
++static char *myname;
++
++static int
++tap_configure(struct mic_info *mic, char *dev)
++{
++ pid_t pid;
++ char *ifargv[7];
++ char ipaddr[IFNAMSIZ];
++ int ret = 0;
++
++ pid = fork();
++ if (pid == 0) {
++ ifargv[0] = "ip";
++ ifargv[1] = "link";
++ ifargv[2] = "set";
++ ifargv[3] = dev;
++ ifargv[4] = "up";
++ ifargv[5] = NULL;
++ mpsslog("Configuring %s\n", dev);
++ ret = execvp("ip", ifargv);
++ if (ret < 0) {
++ mpsslog("%s execvp failed errno %s\n",
++ mic->name, strerror(errno));
++ return ret;
++ }
++ }
++ if (pid < 0) {
++ mpsslog("%s fork failed errno %s\n",
++ mic->name, strerror(errno));
++ return ret;
++ }
++
++ ret = waitpid(pid, NULL, 0);
++ if (ret < 0) {
++ mpsslog("%s waitpid failed errno %s\n",
++ mic->name, strerror(errno));
++ return ret;
++ }
++
++ snprintf(ipaddr, IFNAMSIZ, "172.31.%d.254/24", mic->id);
++
++ pid = fork();
++ if (pid == 0) {
++ ifargv[0] = "ip";
++ ifargv[1] = "addr";
++ ifargv[2] = "add";
++ ifargv[3] = ipaddr;
++ ifargv[4] = "dev";
++ ifargv[5] = dev;
++ ifargv[6] = NULL;
++ mpsslog("Configuring %s ipaddr %s\n", dev, ipaddr);
++ ret = execvp("ip", ifargv);
++ if (ret < 0) {
++ mpsslog("%s execvp failed errno %s\n",
++ mic->name, strerror(errno));
++ return ret;
++ }
++ }
++ if (pid < 0) {
++ mpsslog("%s fork failed errno %s\n",
++ mic->name, strerror(errno));
++ return ret;
++ }
++
++ ret = waitpid(pid, NULL, 0);
++ if (ret < 0) {
++ mpsslog("%s waitpid failed errno %s\n",
++ mic->name, strerror(errno));
++ return ret;
++ }
++ mpsslog("MIC name %s %s %d DONE!\n",
++ mic->name, __func__, __LINE__);
++ return 0;
++}
++
++static int tun_alloc(struct mic_info *mic, char *dev)
++{
++ struct ifreq ifr;
++ int fd, err;
++#if GSO_ENABLED
++ unsigned offload;
++#endif
++ fd = open("/dev/net/tun", O_RDWR);
++ if (fd < 0) {
++ mpsslog("Could not open /dev/net/tun %s\n", strerror(errno));
++ goto done;
++ }
++
++ memset(&ifr, 0, sizeof(ifr));
++
++ ifr.ifr_flags = IFF_TAP | IFF_NO_PI | IFF_VNET_HDR;
++ if (*dev)
++ strncpy(ifr.ifr_name, dev, IFNAMSIZ);
++
++ err = ioctl(fd, TUNSETIFF, (void *)&ifr);
++ if (err < 0) {
++ mpsslog("%s %s %d TUNSETIFF failed %s\n",
++ mic->name, __func__, __LINE__, strerror(errno));
++ close(fd);
++ return err;
++ }
++#if GSO_ENABLED
++ offload = TUN_F_CSUM | TUN_F_TSO4 | TUN_F_TSO6 |
++ TUN_F_TSO_ECN | TUN_F_UFO;
++
++ err = ioctl(fd, TUNSETOFFLOAD, offload);
++ if (err < 0) {
++ mpsslog("%s %s %d TUNSETOFFLOAD failed %s\n",
++ mic->name, __func__, __LINE__, strerror(errno));
++ close(fd);
++ return err;
++ }
++#endif
++ strcpy(dev, ifr.ifr_name);
++ mpsslog("Created TAP %s\n", dev);
++done:
++ return fd;
++}
++
++#define NET_FD_VIRTIO_NET 0
++#define NET_FD_TUN 1
++#define MAX_NET_FD 2
++
++static void set_dp(struct mic_info *mic, int type, void *dp)
++{
++ switch (type) {
++ case VIRTIO_ID_CONSOLE:
++ mic->mic_console.console_dp = dp;
++ return;
++ case VIRTIO_ID_NET:
++ mic->mic_net.net_dp = dp;
++ return;
++ case VIRTIO_ID_BLOCK:
++ mic->mic_virtblk.block_dp = dp;
++ return;
++ }
++ mpsslog("%s %s %d not found\n", mic->name, __func__, type);
++ assert(0);
++}
++
++static void *get_dp(struct mic_info *mic, int type)
++{
++ switch (type) {
++ case VIRTIO_ID_CONSOLE:
++ return mic->mic_console.console_dp;
++ case VIRTIO_ID_NET:
++ return mic->mic_net.net_dp;
++ case VIRTIO_ID_BLOCK:
++ return mic->mic_virtblk.block_dp;
++ }
++ mpsslog("%s %s %d not found\n", mic->name, __func__, type);
++ assert(0);
++ return NULL;
++}
++
++static struct mic_device_desc *get_device_desc(struct mic_info *mic, int type)
++{
++ struct mic_device_desc *d;
++ int i;
++ void *dp = get_dp(mic, type);
++
++ for (i = sizeof(struct mic_bootparam); i < PAGE_SIZE;
++ i += mic_total_desc_size(d)) {
++ d = dp + i;
++
++ /* End of list */
++ if (d->type == 0)
++ break;
++
++ if (d->type == -1)
++ continue;
++
++ mpsslog("%s %s d-> type %d d %p\n",
++ mic->name, __func__, d->type, d);
++
++ if (d->type == (__u8)type)
++ return d;
++ }
++ mpsslog("%s %s %d not found\n", mic->name, __func__, type);
++ assert(0);
++ return NULL;
++}
++
++/* See comments in vhost.c for explanation of next_desc() */
++static unsigned next_desc(struct vring_desc *desc)
++{
++ unsigned int next;
++
++ if (!(le16toh(desc->flags) & VRING_DESC_F_NEXT))
++ return -1U;
++ next = le16toh(desc->next);
++ return next;
++}
++
++/* Sum up all the IOVEC length */
++static ssize_t
++sum_iovec_len(struct mic_copy_desc *copy)
++{
++ ssize_t sum = 0;
++ int i;
++
++ for (i = 0; i < copy->iovcnt; i++)
++ sum += copy->iov[i].iov_len;
++ return sum;
++}
++
++static inline void verify_out_len(struct mic_info *mic,
++ struct mic_copy_desc *copy)
++{
++ if (copy->out_len != sum_iovec_len(copy)) {
++ mpsslog("%s %s %d BUG copy->out_len 0x%x len 0x%zx\n",
++ mic->name, __func__, __LINE__,
++ copy->out_len, sum_iovec_len(copy));
++ assert(copy->out_len == sum_iovec_len(copy));
++ }
++}
++
++/* Display an iovec */
++static void
++disp_iovec(struct mic_info *mic, struct mic_copy_desc *copy,
++ const char *s, int line)
++{
++ int i;
++
++ for (i = 0; i < copy->iovcnt; i++)
++ mpsslog("%s %s %d copy->iov[%d] addr %p len 0x%zx\n",
++ mic->name, s, line, i,
++ copy->iov[i].iov_base, copy->iov[i].iov_len);
++}
++
++static inline __u16 read_avail_idx(struct mic_vring *vr)
++{
++ return ACCESS_ONCE(vr->info->avail_idx);
++}
++
++static inline void txrx_prepare(int type, bool tx, struct mic_vring *vr,
++ struct mic_copy_desc *copy, ssize_t len)
++{
++ copy->vr_idx = tx ? 0 : 1;
++ copy->update_used = true;
++ if (type == VIRTIO_ID_NET)
++ copy->iov[1].iov_len = len - sizeof(struct virtio_net_hdr);
++ else
++ copy->iov[0].iov_len = len;
++}
++
++/* Central API which triggers the copies */
++static int
++mic_virtio_copy(struct mic_info *mic, int fd,
++ struct mic_vring *vr, struct mic_copy_desc *copy)
++{
++ int ret;
++
++ ret = ioctl(fd, MIC_VIRTIO_COPY_DESC, copy);
++ if (ret) {
++ mpsslog("%s %s %d errno %s ret %d\n",
++ mic->name, __func__, __LINE__,
++ strerror(errno), ret);
++ }
++ return ret;
++}
++
++/*
++ * This initialization routine requires at least one
++ * vring i.e. vr0. vr1 is optional.
++ */
++static void *
++init_vr(struct mic_info *mic, int fd, int type,
++ struct mic_vring *vr0, struct mic_vring *vr1, int num_vq)
++{
++ int vr_size;
++ char *va;
++
++ vr_size = PAGE_ALIGN(vring_size(MIC_VRING_ENTRIES,
++ MIC_VIRTIO_RING_ALIGN) + sizeof(struct _mic_vring_info));
++ va = mmap(NULL, MIC_DEVICE_PAGE_END + vr_size * num_vq,
++ PROT_READ, MAP_SHARED, fd, 0);
++ if (MAP_FAILED == va) {
++ mpsslog("%s %s %d mmap failed errno %s\n",
++ mic->name, __func__, __LINE__,
++ strerror(errno));
++ goto done;
++ }
++ set_dp(mic, type, va);
++ vr0->va = (struct mic_vring *)&va[MIC_DEVICE_PAGE_END];
++ vr0->info = vr0->va +
++ vring_size(MIC_VRING_ENTRIES, MIC_VIRTIO_RING_ALIGN);
++ vring_init(&vr0->vr,
++ MIC_VRING_ENTRIES, vr0->va, MIC_VIRTIO_RING_ALIGN);
++ mpsslog("%s %s vr0 %p vr0->info %p vr_size 0x%x vring 0x%x ",
++ __func__, mic->name, vr0->va, vr0->info, vr_size,
++ vring_size(MIC_VRING_ENTRIES, MIC_VIRTIO_RING_ALIGN));
++ mpsslog("magic 0x%x expected 0x%x\n",
++ le32toh(vr0->info->magic), MIC_MAGIC + type);
++ assert(le32toh(vr0->info->magic) == MIC_MAGIC + type);
++ if (vr1) {
++ vr1->va = (struct mic_vring *)
++ &va[MIC_DEVICE_PAGE_END + vr_size];
++ vr1->info = vr1->va + vring_size(MIC_VRING_ENTRIES,
++ MIC_VIRTIO_RING_ALIGN);
++ vring_init(&vr1->vr,
++ MIC_VRING_ENTRIES, vr1->va, MIC_VIRTIO_RING_ALIGN);
++ mpsslog("%s %s vr1 %p vr1->info %p vr_size 0x%x vring 0x%x ",
++ __func__, mic->name, vr1->va, vr1->info, vr_size,
++ vring_size(MIC_VRING_ENTRIES, MIC_VIRTIO_RING_ALIGN));
++ mpsslog("magic 0x%x expected 0x%x\n",
++ le32toh(vr1->info->magic), MIC_MAGIC + type + 1);
++ assert(le32toh(vr1->info->magic) == MIC_MAGIC + type + 1);
++ }
++done:
++ return va;
++}
++
++static void
++wait_for_card_driver(struct mic_info *mic, int fd, int type)
++{
++ struct pollfd pollfd;
++ int err;
++ struct mic_device_desc *desc = get_device_desc(mic, type);
++
++ pollfd.fd = fd;
++ mpsslog("%s %s Waiting .... desc-> type %d status 0x%x\n",
++ mic->name, __func__, type, desc->status);
++ while (1) {
++ pollfd.events = POLLIN;
++ pollfd.revents = 0;
++ err = poll(&pollfd, 1, -1);
++ if (err < 0) {
++ mpsslog("%s %s poll failed %s\n",
++ mic->name, __func__, strerror(errno));
++ continue;
++ }
++
++ if (pollfd.revents) {
++ mpsslog("%s %s Waiting... desc-> type %d status 0x%x\n",
++ mic->name, __func__, type, desc->status);
++ if (desc->status & VIRTIO_CONFIG_S_DRIVER_OK) {
++ mpsslog("%s %s poll.revents %d\n",
++ mic->name, __func__, pollfd.revents);
++ mpsslog("%s %s desc-> type %d status 0x%x\n",
++ mic->name, __func__, type,
++ desc->status);
++ break;
++ }
++ }
++ }
++}
++
++/* Spin till we have some descriptors */
++static void
++spin_for_descriptors(struct mic_info *mic, struct mic_vring *vr)
++{
++ __u16 avail_idx = read_avail_idx(vr);
++
++ while (avail_idx == le16toh(ACCESS_ONCE(vr->vr.avail->idx))) {
++#ifdef DEBUG
++ mpsslog("%s %s waiting for desc avail %d info_avail %d\n",
++ mic->name, __func__,
++ le16toh(vr->vr.avail->idx), vr->info->avail_idx);
++#endif
++ sched_yield();
++ }
++}
++
++static void *
++virtio_net(void *arg)
++{
++ static __u8 vnet_hdr[2][sizeof(struct virtio_net_hdr)];
++ static __u8 vnet_buf[2][MAX_NET_PKT_SIZE] __attribute__ ((aligned(64)));
++ struct iovec vnet_iov[2][2] = {
++ { { .iov_base = vnet_hdr[0], .iov_len = sizeof(vnet_hdr[0]) },
++ { .iov_base = vnet_buf[0], .iov_len = sizeof(vnet_buf[0]) } },
++ { { .iov_base = vnet_hdr[1], .iov_len = sizeof(vnet_hdr[1]) },
++ { .iov_base = vnet_buf[1], .iov_len = sizeof(vnet_buf[1]) } },
++ };
++ struct iovec *iov0 = vnet_iov[0], *iov1 = vnet_iov[1];
++ struct mic_info *mic = (struct mic_info *)arg;
++ char if_name[IFNAMSIZ];
++ struct pollfd net_poll[MAX_NET_FD];
++ struct mic_vring tx_vr, rx_vr;
++ struct mic_copy_desc copy;
++ struct mic_device_desc *desc;
++ int err;
++
++ snprintf(if_name, IFNAMSIZ, "mic%d", mic->id);
++ mic->mic_net.tap_fd = tun_alloc(mic, if_name);
++ if (mic->mic_net.tap_fd < 0)
++ goto done;
++
++ if (tap_configure(mic, if_name))
++ goto done;
++ mpsslog("MIC name %s id %d\n", mic->name, mic->id);
++
++ net_poll[NET_FD_VIRTIO_NET].fd = mic->mic_net.virtio_net_fd;
++ net_poll[NET_FD_VIRTIO_NET].events = POLLIN;
++ net_poll[NET_FD_TUN].fd = mic->mic_net.tap_fd;
++ net_poll[NET_FD_TUN].events = POLLIN;
++
++ if (MAP_FAILED == init_vr(mic, mic->mic_net.virtio_net_fd,
++ VIRTIO_ID_NET, &tx_vr, &rx_vr,
++ virtnet_dev_page.dd.num_vq)) {
++ mpsslog("%s init_vr failed %s\n",
++ mic->name, strerror(errno));
++ goto done;
++ }
++
++ copy.iovcnt = 2;
++ desc = get_device_desc(mic, VIRTIO_ID_NET);
++
++ while (1) {
++ ssize_t len;
++
++ net_poll[NET_FD_VIRTIO_NET].revents = 0;
++ net_poll[NET_FD_TUN].revents = 0;
++
++ /* Start polling for data from tap and virtio net */
++ err = poll(net_poll, 2, -1);
++ if (err < 0) {
++ mpsslog("%s poll failed %s\n",
++ __func__, strerror(errno));
++ continue;
++ }
++ if (!(desc->status & VIRTIO_CONFIG_S_DRIVER_OK))
++ wait_for_card_driver(mic, mic->mic_net.virtio_net_fd,
++ VIRTIO_ID_NET);
++ /*
++ * Check if there is data to be read from TUN and write to
++ * virtio net fd if there is.
++ */
++ if (net_poll[NET_FD_TUN].revents & POLLIN) {
++ copy.iov = iov0;
++ len = readv(net_poll[NET_FD_TUN].fd,
++ copy.iov, copy.iovcnt);
++ if (len > 0) {
++ struct virtio_net_hdr *hdr
++ = (struct virtio_net_hdr *)vnet_hdr[0];
++
++ /* Disable checksums on the card since we are on
++ a reliable PCIe link */
++ hdr->flags |= VIRTIO_NET_HDR_F_DATA_VALID;
++#ifdef DEBUG
++ mpsslog("%s %s %d hdr->flags 0x%x ", mic->name,
++ __func__, __LINE__, hdr->flags);
++ mpsslog("copy.out_len %d hdr->gso_type 0x%x\n",
++ copy.out_len, hdr->gso_type);
++#endif
++#ifdef DEBUG
++ disp_iovec(mic, copy, __func__, __LINE__);
++ mpsslog("%s %s %d read from tap 0x%lx\n",
++ mic->name, __func__, __LINE__,
++ len);
++#endif
++ spin_for_descriptors(mic, &tx_vr);
++ txrx_prepare(VIRTIO_ID_NET, 1, &tx_vr, ©,
++ len);
++
++ err = mic_virtio_copy(mic,
++ mic->mic_net.virtio_net_fd, &tx_vr,
++ ©);
++ if (err < 0) {
++ mpsslog("%s %s %d mic_virtio_copy %s\n",
++ mic->name, __func__, __LINE__,
++ strerror(errno));
++ }
++ if (!err)
++ verify_out_len(mic, ©);
++#ifdef DEBUG
++ disp_iovec(mic, copy, __func__, __LINE__);
++ mpsslog("%s %s %d wrote to net 0x%lx\n",
++ mic->name, __func__, __LINE__,
++ sum_iovec_len(©));
++#endif
++ /* Reinitialize IOV for next run */
++ iov0[1].iov_len = MAX_NET_PKT_SIZE;
++ } else if (len < 0) {
++ disp_iovec(mic, ©, __func__, __LINE__);
++ mpsslog("%s %s %d read failed %s ", mic->name,
++ __func__, __LINE__, strerror(errno));
++ mpsslog("cnt %d sum %zd\n",
++ copy.iovcnt, sum_iovec_len(©));
++ }
++ }
++
++ /*
++ * Check if there is data to be read from virtio net and
++ * write to TUN if there is.
++ */
++ if (net_poll[NET_FD_VIRTIO_NET].revents & POLLIN) {
++ while (rx_vr.info->avail_idx !=
++ le16toh(rx_vr.vr.avail->idx)) {
++ copy.iov = iov1;
++ txrx_prepare(VIRTIO_ID_NET, 0, &rx_vr, ©,
++ MAX_NET_PKT_SIZE
++ + sizeof(struct virtio_net_hdr));
++
++ err = mic_virtio_copy(mic,
++ mic->mic_net.virtio_net_fd, &rx_vr,
++ ©);
++ if (!err) {
++#ifdef DEBUG
++ struct virtio_net_hdr *hdr
++ = (struct virtio_net_hdr *)
++ vnet_hdr[1];
++
++ mpsslog("%s %s %d hdr->flags 0x%x, ",
++ mic->name, __func__, __LINE__,
++ hdr->flags);
++ mpsslog("out_len %d gso_type 0x%x\n",
++ copy.out_len,
++ hdr->gso_type);
++#endif
++ /* Set the correct output iov_len */
++ iov1[1].iov_len = copy.out_len -
++ sizeof(struct virtio_net_hdr);
++ verify_out_len(mic, ©);
++#ifdef DEBUG
++ disp_iovec(mic, copy, __func__,
++ __LINE__);
++ mpsslog("%s %s %d ",
++ mic->name, __func__, __LINE__);
++ mpsslog("read from net 0x%lx\n",
++ sum_iovec_len(copy));
++#endif
++ len = writev(net_poll[NET_FD_TUN].fd,
++ copy.iov, copy.iovcnt);
++ if (len != sum_iovec_len(©)) {
++ mpsslog("Tun write failed %s ",
++ strerror(errno));
++ mpsslog("len 0x%zx ", len);
++ mpsslog("read_len 0x%zx\n",
++ sum_iovec_len(©));
++ } else {
++#ifdef DEBUG
++ disp_iovec(mic, ©, __func__,
++ __LINE__);
++ mpsslog("%s %s %d ",
++ mic->name, __func__,
++ __LINE__);
++ mpsslog("wrote to tap 0x%lx\n",
++ len);
++#endif
++ }
++ } else {
++ mpsslog("%s %s %d mic_virtio_copy %s\n",
++ mic->name, __func__, __LINE__,
++ strerror(errno));
++ break;
++ }
++ }
++ }
++ if (net_poll[NET_FD_VIRTIO_NET].revents & POLLERR)
++ mpsslog("%s: %s: POLLERR\n", __func__, mic->name);
++ }
++done:
++ pthread_exit(NULL);
++}
++
++/* virtio_console */
++#define VIRTIO_CONSOLE_FD 0
++#define MONITOR_FD (VIRTIO_CONSOLE_FD + 1)
++#define MAX_CONSOLE_FD (MONITOR_FD + 1) /* must be the last one + 1 */
++#define MAX_BUFFER_SIZE PAGE_SIZE
++
++static void *
++virtio_console(void *arg)
++{
++ static __u8 vcons_buf[2][PAGE_SIZE];
++ struct iovec vcons_iov[2] = {
++ { .iov_base = vcons_buf[0], .iov_len = sizeof(vcons_buf[0]) },
++ { .iov_base = vcons_buf[1], .iov_len = sizeof(vcons_buf[1]) },
++ };
++ struct iovec *iov0 = &vcons_iov[0], *iov1 = &vcons_iov[1];
++ struct mic_info *mic = (struct mic_info *)arg;
++ int err;
++ struct pollfd console_poll[MAX_CONSOLE_FD];
++ int pty_fd;
++ char *pts_name;
++ ssize_t len;
++ struct mic_vring tx_vr, rx_vr;
++ struct mic_copy_desc copy;
++ struct mic_device_desc *desc;
++
++ pty_fd = posix_openpt(O_RDWR);
++ if (pty_fd < 0) {
++ mpsslog("can't open a pseudoterminal master device: %s\n",
++ strerror(errno));
++ goto _return;
++ }
++ pts_name = ptsname(pty_fd);
++ if (pts_name == NULL) {
++ mpsslog("can't get pts name\n");
++ goto _close_pty;
++ }
++ printf("%s console message goes to %s\n", mic->name, pts_name);
++ mpsslog("%s console message goes to %s\n", mic->name, pts_name);
++ err = grantpt(pty_fd);
++ if (err < 0) {
++ mpsslog("can't grant access: %s %s\n",
++ pts_name, strerror(errno));
++ goto _close_pty;
++ }
++ err = unlockpt(pty_fd);
++ if (err < 0) {
++ mpsslog("can't unlock a pseudoterminal: %s %s\n",
++ pts_name, strerror(errno));
++ goto _close_pty;
++ }
++ console_poll[MONITOR_FD].fd = pty_fd;
++ console_poll[MONITOR_FD].events = POLLIN;
++
++ console_poll[VIRTIO_CONSOLE_FD].fd = mic->mic_console.virtio_console_fd;
++ console_poll[VIRTIO_CONSOLE_FD].events = POLLIN;
++
++ if (MAP_FAILED == init_vr(mic, mic->mic_console.virtio_console_fd,
++ VIRTIO_ID_CONSOLE, &tx_vr, &rx_vr,
++ virtcons_dev_page.dd.num_vq)) {
++ mpsslog("%s init_vr failed %s\n",
++ mic->name, strerror(errno));
++ goto _close_pty;
++ }
++
++ copy.iovcnt = 1;
++ desc = get_device_desc(mic, VIRTIO_ID_CONSOLE);
++
++ for (;;) {
++ console_poll[MONITOR_FD].revents = 0;
++ console_poll[VIRTIO_CONSOLE_FD].revents = 0;
++ err = poll(console_poll, MAX_CONSOLE_FD, -1);
++ if (err < 0) {
++ mpsslog("%s %d: poll failed: %s\n", __func__, __LINE__,
++ strerror(errno));
++ continue;
++ }
++ if (!(desc->status & VIRTIO_CONFIG_S_DRIVER_OK))
++ wait_for_card_driver(mic,
++ mic->mic_console.virtio_console_fd,
++ VIRTIO_ID_CONSOLE);
++
++ if (console_poll[MONITOR_FD].revents & POLLIN) {
++ copy.iov = iov0;
++ len = readv(pty_fd, copy.iov, copy.iovcnt);
++ if (len > 0) {
++#ifdef DEBUG
++ disp_iovec(mic, copy, __func__, __LINE__);
++ mpsslog("%s %s %d read from tap 0x%lx\n",
++ mic->name, __func__, __LINE__,
++ len);
++#endif
++ spin_for_descriptors(mic, &tx_vr);
++ txrx_prepare(VIRTIO_ID_CONSOLE, 1, &tx_vr,
++ ©, len);
++
++ err = mic_virtio_copy(mic,
++ mic->mic_console.virtio_console_fd,
++ &tx_vr, ©);
++ if (err < 0) {
++ mpsslog("%s %s %d mic_virtio_copy %s\n",
++ mic->name, __func__, __LINE__,
++ strerror(errno));
++ }
++ if (!err)
++ verify_out_len(mic, ©);
++#ifdef DEBUG
++ disp_iovec(mic, copy, __func__, __LINE__);
++ mpsslog("%s %s %d wrote to net 0x%lx\n",
++ mic->name, __func__, __LINE__,
++ sum_iovec_len(copy));
++#endif
++ /* Reinitialize IOV for next run */
++ iov0->iov_len = PAGE_SIZE;
++ } else if (len < 0) {
++ disp_iovec(mic, ©, __func__, __LINE__);
++ mpsslog("%s %s %d read failed %s ",
++ mic->name, __func__, __LINE__,
++ strerror(errno));
++ mpsslog("cnt %d sum %zd\n",
++ copy.iovcnt, sum_iovec_len(©));
++ }
++ }
++
++ if (console_poll[VIRTIO_CONSOLE_FD].revents & POLLIN) {
++ while (rx_vr.info->avail_idx !=
++ le16toh(rx_vr.vr.avail->idx)) {
++ copy.iov = iov1;
++ txrx_prepare(VIRTIO_ID_CONSOLE, 0, &rx_vr,
++ ©, PAGE_SIZE);
++
++ err = mic_virtio_copy(mic,
++ mic->mic_console.virtio_console_fd,
++ &rx_vr, ©);
++ if (!err) {
++ /* Set the correct output iov_len */
++ iov1->iov_len = copy.out_len;
++ verify_out_len(mic, ©);
++#ifdef DEBUG
++ disp_iovec(mic, copy, __func__,
++ __LINE__);
++ mpsslog("%s %s %d ",
++ mic->name, __func__, __LINE__);
++ mpsslog("read from net 0x%lx\n",
++ sum_iovec_len(copy));
++#endif
++ len = writev(pty_fd,
++ copy.iov, copy.iovcnt);
++ if (len != sum_iovec_len(©)) {
++ mpsslog("Tun write failed %s ",
++ strerror(errno));
++ mpsslog("len 0x%zx ", len);
++ mpsslog("read_len 0x%zx\n",
++ sum_iovec_len(©));
++ } else {
++#ifdef DEBUG
++ disp_iovec(mic, copy, __func__,
++ __LINE__);
++ mpsslog("%s %s %d ",
++ mic->name, __func__,
++ __LINE__);
++ mpsslog("wrote to tap 0x%lx\n",
++ len);
++#endif
++ }
++ } else {
++ mpsslog("%s %s %d mic_virtio_copy %s\n",
++ mic->name, __func__, __LINE__,
++ strerror(errno));
++ break;
++ }
++ }
++ }
++ if (console_poll[NET_FD_VIRTIO_NET].revents & POLLERR)
++ mpsslog("%s: %s: POLLERR\n", __func__, mic->name);
++ }
++_close_pty:
++ close(pty_fd);
++_return:
++ pthread_exit(NULL);
++}
++
++static void
++add_virtio_device(struct mic_info *mic, struct mic_device_desc *dd)
++{
++ char path[PATH_MAX];
++ int fd, err;
++
++ snprintf(path, PATH_MAX, "/dev/mic%d", mic->id);
++ fd = open(path, O_RDWR);
++ if (fd < 0) {
++ mpsslog("Could not open %s %s\n", path, strerror(errno));
++ return;
++ }
++
++ err = ioctl(fd, MIC_VIRTIO_ADD_DEVICE, dd);
++ if (err < 0) {
++ mpsslog("Could not add %d %s\n", dd->type, strerror(errno));
++ close(fd);
++ return;
++ }
++ switch (dd->type) {
++ case VIRTIO_ID_NET:
++ mic->mic_net.virtio_net_fd = fd;
++ mpsslog("Added VIRTIO_ID_NET for %s\n", mic->name);
++ break;
++ case VIRTIO_ID_CONSOLE:
++ mic->mic_console.virtio_console_fd = fd;
++ mpsslog("Added VIRTIO_ID_CONSOLE for %s\n", mic->name);
++ break;
++ case VIRTIO_ID_BLOCK:
++ mic->mic_virtblk.virtio_block_fd = fd;
++ mpsslog("Added VIRTIO_ID_BLOCK for %s\n", mic->name);
++ break;
++ }
++}
++
++static bool
++set_backend_file(struct mic_info *mic)
++{
++ FILE *config;
++ char buff[PATH_MAX], *line, *evv, *p;
++
++ snprintf(buff, PATH_MAX, "%s/mpssd%03d.conf", mic_config_dir, mic->id);
++ config = fopen(buff, "r");
++ if (config == NULL)
++ return false;
++ do { /* look for "virtblk_backend=XXXX" */
++ line = fgets(buff, PATH_MAX, config);
++ if (line == NULL)
++ break;
++ if (*line == '#')
++ continue;
++ p = strchr(line, '\n');
++ if (p)
++ *p = '\0';
++ } while (strncmp(line, virtblk_backend, strlen(virtblk_backend)) != 0);
++ fclose(config);
++ if (line == NULL)
++ return false;
++ evv = strchr(line, '=');
++ if (evv == NULL)
++ return false;
++ mic->mic_virtblk.backend_file = malloc(strlen(evv) + 1);
++ if (mic->mic_virtblk.backend_file == NULL) {
++ mpsslog("%s %d can't allocate memory\n", mic->name, mic->id);
++ return false;
++ }
++ strcpy(mic->mic_virtblk.backend_file, evv + 1);
++ return true;
++}
++
++#define SECTOR_SIZE 512
++static bool
++set_backend_size(struct mic_info *mic)
++{
++ mic->mic_virtblk.backend_size = lseek(mic->mic_virtblk.backend, 0,
++ SEEK_END);
++ if (mic->mic_virtblk.backend_size < 0) {
++ mpsslog("%s: can't seek: %s\n",
++ mic->name, mic->mic_virtblk.backend_file);
++ return false;
++ }
++ virtblk_dev_page.blk_config.capacity =
++ mic->mic_virtblk.backend_size / SECTOR_SIZE;
++ if ((mic->mic_virtblk.backend_size % SECTOR_SIZE) != 0)
++ virtblk_dev_page.blk_config.capacity++;
++
++ virtblk_dev_page.blk_config.capacity =
++ htole64(virtblk_dev_page.blk_config.capacity);
++
++ return true;
++}
++
++static bool
++open_backend(struct mic_info *mic)
++{
++ if (!set_backend_file(mic))
++ goto _error_exit;
++ mic->mic_virtblk.backend = open(mic->mic_virtblk.backend_file, O_RDWR);
++ if (mic->mic_virtblk.backend < 0) {
++ mpsslog("%s: can't open: %s\n", mic->name,
++ mic->mic_virtblk.backend_file);
++ goto _error_free;
++ }
++ if (!set_backend_size(mic))
++ goto _error_close;
++ mic->mic_virtblk.backend_addr = mmap(NULL,
++ mic->mic_virtblk.backend_size,
++ PROT_READ|PROT_WRITE, MAP_SHARED,
++ mic->mic_virtblk.backend, 0L);
++ if (mic->mic_virtblk.backend_addr == MAP_FAILED) {
++ mpsslog("%s: can't map: %s %s\n",
++ mic->name, mic->mic_virtblk.backend_file,
++ strerror(errno));
++ goto _error_close;
++ }
++ return true;
++
++ _error_close:
++ close(mic->mic_virtblk.backend);
++ _error_free:
++ free(mic->mic_virtblk.backend_file);
++ _error_exit:
++ return false;
++}
++
++static void
++close_backend(struct mic_info *mic)
++{
++ munmap(mic->mic_virtblk.backend_addr, mic->mic_virtblk.backend_size);
++ close(mic->mic_virtblk.backend);
++ free(mic->mic_virtblk.backend_file);
++}
++
++static bool
++start_virtblk(struct mic_info *mic, struct mic_vring *vring)
++{
++ if (((unsigned long)&virtblk_dev_page.blk_config % 8) != 0) {
++ mpsslog("%s: blk_config is not 8 byte aligned.\n",
++ mic->name);
++ return false;
++ }
++ add_virtio_device(mic, &virtblk_dev_page.dd);
++ if (MAP_FAILED == init_vr(mic, mic->mic_virtblk.virtio_block_fd,
++ VIRTIO_ID_BLOCK, vring, NULL,
++ virtblk_dev_page.dd.num_vq)) {
++ mpsslog("%s init_vr failed %s\n",
++ mic->name, strerror(errno));
++ return false;
++ }
++ return true;
++}
++
++static void
++stop_virtblk(struct mic_info *mic)
++{
++ int vr_size, ret;
++
++ vr_size = PAGE_ALIGN(vring_size(MIC_VRING_ENTRIES,
++ MIC_VIRTIO_RING_ALIGN) + sizeof(struct _mic_vring_info));
++ ret = munmap(mic->mic_virtblk.block_dp,
++ MIC_DEVICE_PAGE_END + vr_size * virtblk_dev_page.dd.num_vq);
++ if (ret < 0)
++ mpsslog("%s munmap errno %d\n", mic->name, errno);
++ close(mic->mic_virtblk.virtio_block_fd);
++}
++
++static __u8
++header_error_check(struct vring_desc *desc)
++{
++ if (le32toh(desc->len) != sizeof(struct virtio_blk_outhdr)) {
++ mpsslog("%s() %d: length is not sizeof(virtio_blk_outhd)\n",
++ __func__, __LINE__);
++ return -EIO;
++ }
++ if (!(le16toh(desc->flags) & VRING_DESC_F_NEXT)) {
++ mpsslog("%s() %d: alone\n",
++ __func__, __LINE__);
++ return -EIO;
++ }
++ if (le16toh(desc->flags) & VRING_DESC_F_WRITE) {
++ mpsslog("%s() %d: not read\n",
++ __func__, __LINE__);
++ return -EIO;
++ }
++ return 0;
++}
++
++static int
++read_header(int fd, struct virtio_blk_outhdr *hdr, __u32 desc_idx)
++{
++ struct iovec iovec;
++ struct mic_copy_desc copy;
++
++ iovec.iov_len = sizeof(*hdr);
++ iovec.iov_base = hdr;
++ copy.iov = &iovec;
++ copy.iovcnt = 1;
++ copy.vr_idx = 0; /* only one vring on virtio_block */
++ copy.update_used = false; /* do not update used index */
++ return ioctl(fd, MIC_VIRTIO_COPY_DESC, ©);
++}
++
++static int
++transfer_blocks(int fd, struct iovec *iovec, __u32 iovcnt)
++{
++ struct mic_copy_desc copy;
++
++ copy.iov = iovec;
++ copy.iovcnt = iovcnt;
++ copy.vr_idx = 0; /* only one vring on virtio_block */
++ copy.update_used = false; /* do not update used index */
++ return ioctl(fd, MIC_VIRTIO_COPY_DESC, ©);
++}
++
++static __u8
++status_error_check(struct vring_desc *desc)
++{
++ if (le32toh(desc->len) != sizeof(__u8)) {
++ mpsslog("%s() %d: length is not sizeof(status)\n",
++ __func__, __LINE__);
++ return -EIO;
++ }
++ return 0;
++}
++
++static int
++write_status(int fd, __u8 *status)
++{
++ struct iovec iovec;
++ struct mic_copy_desc copy;
++
++ iovec.iov_base = status;
++ iovec.iov_len = sizeof(*status);
++ copy.iov = &iovec;
++ copy.iovcnt = 1;
++ copy.vr_idx = 0; /* only one vring on virtio_block */
++ copy.update_used = true; /* Update used index */
++ return ioctl(fd, MIC_VIRTIO_COPY_DESC, ©);
++}
++
++static void *
++virtio_block(void *arg)
++{
++ struct mic_info *mic = (struct mic_info *)arg;
++ int ret;
++ struct pollfd block_poll;
++ struct mic_vring vring;
++ __u16 avail_idx;
++ __u32 desc_idx;
++ struct vring_desc *desc;
++ struct iovec *iovec, *piov;
++ __u8 status;
++ __u32 buffer_desc_idx;
++ struct virtio_blk_outhdr hdr;
++ void *fos;
++
++ for (;;) { /* forever */
++ if (!open_backend(mic)) { /* No virtblk */
++ for (mic->mic_virtblk.signaled = 0;
++ !mic->mic_virtblk.signaled;)
++ sleep(1);
++ continue;
++ }
++
++ /* backend file is specified. */
++ if (!start_virtblk(mic, &vring))
++ goto _close_backend;
++ iovec = malloc(sizeof(*iovec) *
++ le32toh(virtblk_dev_page.blk_config.seg_max));
++ if (!iovec) {
++ mpsslog("%s: can't alloc iovec: %s\n",
++ mic->name, strerror(ENOMEM));
++ goto _stop_virtblk;
++ }
++
++ block_poll.fd = mic->mic_virtblk.virtio_block_fd;
++ block_poll.events = POLLIN;
++ for (mic->mic_virtblk.signaled = 0;
++ !mic->mic_virtblk.signaled;) {
++ block_poll.revents = 0;
++ /* timeout in 1 sec to see signaled */
++ ret = poll(&block_poll, 1, 1000);
++ if (ret < 0) {
++ mpsslog("%s %d: poll failed: %s\n",
++ __func__, __LINE__,
++ strerror(errno));
++ continue;
++ }
++
++ if (!(block_poll.revents & POLLIN)) {
++#ifdef DEBUG
++ mpsslog("%s %d: block_poll.revents=0x%x\n",
++ __func__, __LINE__, block_poll.revents);
++#endif
++ continue;
++ }
++
++ /* POLLIN */
++ while (vring.info->avail_idx !=
++ le16toh(vring.vr.avail->idx)) {
++ /* read header element */
++ avail_idx =
++ vring.info->avail_idx &
++ (vring.vr.num - 1);
++ desc_idx = le16toh(
++ vring.vr.avail->ring[avail_idx]);
++ desc = &vring.vr.desc[desc_idx];
++#ifdef DEBUG
++ mpsslog("%s() %d: avail_idx=%d ",
++ __func__, __LINE__,
++ vring.info->avail_idx);
++ mpsslog("vring.vr.num=%d desc=%p\n",
++ vring.vr.num, desc);
++#endif
++ status = header_error_check(desc);
++ ret = read_header(
++ mic->mic_virtblk.virtio_block_fd,
++ &hdr, desc_idx);
++ if (ret < 0) {
++ mpsslog("%s() %d %s: ret=%d %s\n",
++ __func__, __LINE__,
++ mic->name, ret,
++ strerror(errno));
++ break;
++ }
++ /* buffer element */
++ piov = iovec;
++ status = 0;
++ fos = mic->mic_virtblk.backend_addr +
++ (hdr.sector * SECTOR_SIZE);
++ buffer_desc_idx = next_desc(desc);
++ desc_idx = buffer_desc_idx;
++ for (desc = &vring.vr.desc[buffer_desc_idx];
++ desc->flags & VRING_DESC_F_NEXT;
++ desc_idx = next_desc(desc),
++ desc = &vring.vr.desc[desc_idx]) {
++ piov->iov_len = desc->len;
++ piov->iov_base = fos;
++ piov++;
++ fos += desc->len;
++ }
++ /* Returning NULLs for VIRTIO_BLK_T_GET_ID. */
++ if (hdr.type & ~(VIRTIO_BLK_T_OUT |
++ VIRTIO_BLK_T_GET_ID)) {
++ /*
++ VIRTIO_BLK_T_IN - does not do
++ anything. Probably for documenting.
++ VIRTIO_BLK_T_SCSI_CMD - for
++ virtio_scsi.
++ VIRTIO_BLK_T_FLUSH - turned off in
++ config space.
++ VIRTIO_BLK_T_BARRIER - defined but not
++ used in anywhere.
++ */
++ mpsslog("%s() %d: type %x ",
++ __func__, __LINE__,
++ hdr.type);
++ mpsslog("is not supported\n");
++ status = -ENOTSUP;
++
++ } else {
++ ret = transfer_blocks(
++ mic->mic_virtblk.virtio_block_fd,
++ iovec,
++ piov - iovec);
++ if (ret < 0 &&
++ status != 0)
++ status = ret;
++ }
++ /* write status and update used pointer */
++ if (status != 0)
++ status = status_error_check(desc);
++ ret = write_status(
++ mic->mic_virtblk.virtio_block_fd,
++ &status);
++#ifdef DEBUG
++ mpsslog("%s() %d: write status=%d on desc=%p\n",
++ __func__, __LINE__,
++ status, desc);
++#endif
++ }
++ }
++ free(iovec);
++_stop_virtblk:
++ stop_virtblk(mic);
++_close_backend:
++ close_backend(mic);
++ } /* forever */
++
++ pthread_exit(NULL);
++}
++
++static void
++reset(struct mic_info *mic)
++{
++#define RESET_TIMEOUT 120
++ int i = RESET_TIMEOUT;
++ setsysfs(mic->name, "state", "reset");
++ while (i) {
++ char *state;
++ state = readsysfs(mic->name, "state");
++ if (!state)
++ goto retry;
++ mpsslog("%s: %s %d state %s\n",
++ mic->name, __func__, __LINE__, state);
++
++ /*
++ * If the shutdown was initiated by OSPM, the state stays
++ * in "suspended" which is also a valid condition for reset.
++ */
++ if ((!strcmp(state, "offline")) ||
++ (!strcmp(state, "suspended"))) {
++ free(state);
++ break;
++ }
++ free(state);
++retry:
++ sleep(1);
++ i--;
++ }
++}
++
++static int
++get_mic_shutdown_status(struct mic_info *mic, char *shutdown_status)
++{
++ if (!strcmp(shutdown_status, "nop"))
++ return MIC_NOP;
++ if (!strcmp(shutdown_status, "crashed"))
++ return MIC_CRASHED;
++ if (!strcmp(shutdown_status, "halted"))
++ return MIC_HALTED;
++ if (!strcmp(shutdown_status, "poweroff"))
++ return MIC_POWER_OFF;
++ if (!strcmp(shutdown_status, "restart"))
++ return MIC_RESTART;
++ mpsslog("%s: BUG invalid status %s\n", mic->name, shutdown_status);
++ /* Invalid state */
++ assert(0);
++};
++
++static int get_mic_state(struct mic_info *mic, char *state)
++{
++ if (!strcmp(state, "offline"))
++ return MIC_OFFLINE;
++ if (!strcmp(state, "online"))
++ return MIC_ONLINE;
++ if (!strcmp(state, "shutting_down"))
++ return MIC_SHUTTING_DOWN;
++ if (!strcmp(state, "reset_failed"))
++ return MIC_RESET_FAILED;
++ if (!strcmp(state, "suspending"))
++ return MIC_SUSPENDING;
++ if (!strcmp(state, "suspended"))
++ return MIC_SUSPENDED;
++ mpsslog("%s: BUG invalid state %s\n", mic->name, state);
++ /* Invalid state */
++ assert(0);
++};
++
++static void mic_handle_shutdown(struct mic_info *mic)
++{
++#define SHUTDOWN_TIMEOUT 60
++ int i = SHUTDOWN_TIMEOUT, ret, stat = 0;
++ char *shutdown_status;
++ while (i) {
++ shutdown_status = readsysfs(mic->name, "shutdown_status");
++ if (!shutdown_status)
++ continue;
++ mpsslog("%s: %s %d shutdown_status %s\n",
++ mic->name, __func__, __LINE__, shutdown_status);
++ switch (get_mic_shutdown_status(mic, shutdown_status)) {
++ case MIC_RESTART:
++ mic->restart = 1;
++ case MIC_HALTED:
++ case MIC_POWER_OFF:
++ case MIC_CRASHED:
++ free(shutdown_status);
++ goto reset;
++ default:
++ break;
++ }
++ free(shutdown_status);
++ sleep(1);
++ i--;
++ }
++reset:
++ ret = kill(mic->pid, SIGTERM);
++ mpsslog("%s: %s %d kill pid %d ret %d\n",
++ mic->name, __func__, __LINE__,
++ mic->pid, ret);
++ if (!ret) {
++ ret = waitpid(mic->pid, &stat,
++ WIFSIGNALED(stat));
++ mpsslog("%s: %s %d waitpid ret %d pid %d\n",
++ mic->name, __func__, __LINE__,
++ ret, mic->pid);
++ }
++ if (ret == mic->pid)
++ reset(mic);
++}
++
++static void *
++mic_config(void *arg)
++{
++ struct mic_info *mic = (struct mic_info *)arg;
++ char *state = NULL;
++ char pathname[PATH_MAX];
++ int fd, ret;
++ struct pollfd ufds[1];
++ char value[4096];
++
++ snprintf(pathname, PATH_MAX - 1, "%s/%s/%s",
++ MICSYSFSDIR, mic->name, "state");
++
++ fd = open(pathname, O_RDONLY);
++ if (fd < 0) {
++ mpsslog("%s: opening file %s failed %s\n",
++ mic->name, pathname, strerror(errno));
++ goto error;
++ }
++
++ do {
++ ret = lseek(fd, 0, SEEK_SET);
++ if (ret < 0) {
++ mpsslog("%s: Failed to seek to file start '%s': %s\n",
++ mic->name, pathname, strerror(errno));
++ goto close_error1;
++ }
++ ret = read(fd, value, sizeof(value));
++ if (ret < 0) {
++ mpsslog("%s: Failed to read sysfs entry '%s': %s\n",
++ mic->name, pathname, strerror(errno));
++ goto close_error1;
++ }
++retry:
++ state = readsysfs(mic->name, "state");
++ if (!state)
++ goto retry;
++ mpsslog("%s: %s %d state %s\n",
++ mic->name, __func__, __LINE__, state);
++ switch (get_mic_state(mic, state)) {
++ case MIC_SHUTTING_DOWN:
++ mic_handle_shutdown(mic);
++ goto close_error;
++ case MIC_SUSPENDING:
++ mic->boot_on_resume = 1;
++ setsysfs(mic->name, "state", "suspend");
++ mic_handle_shutdown(mic);
++ goto close_error;
++ case MIC_OFFLINE:
++ if (mic->boot_on_resume) {
++ setsysfs(mic->name, "state", "boot");
++ mic->boot_on_resume = 0;
++ }
++ break;
++ default:
++ break;
++ }
++ free(state);
++
++ ufds[0].fd = fd;
++ ufds[0].events = POLLERR | POLLPRI;
++ ret = poll(ufds, 1, -1);
++ if (ret < 0) {
++ mpsslog("%s: poll failed %s\n",
++ mic->name, strerror(errno));
++ goto close_error1;
++ }
++ } while (1);
++close_error:
++ free(state);
++close_error1:
++ close(fd);
++error:
++ init_mic(mic);
++ pthread_exit(NULL);
++}
++
++static void
++set_cmdline(struct mic_info *mic)
++{
++ char buffer[PATH_MAX];
++ int len;
++
++ len = snprintf(buffer, PATH_MAX,
++ "clocksource=tsc highres=off nohz=off ");
++ len += snprintf(buffer + len, PATH_MAX - len,
++ "cpufreq_on;corec6_off;pc3_off;pc6_off ");
++ len += snprintf(buffer + len, PATH_MAX - len,
++ "ifcfg=static;address,172.31.%d.1;netmask,255.255.255.0",
++ mic->id);
++
++ setsysfs(mic->name, "cmdline", buffer);
++ mpsslog("%s: Command line: \"%s\"\n", mic->name, buffer);
++ snprintf(buffer, PATH_MAX, "172.31.%d.1", mic->id);
++ mpsslog("%s: IPADDR: \"%s\"\n", mic->name, buffer);
++}
++
++static void
++set_log_buf_info(struct mic_info *mic)
++{
++ int fd;
++ off_t len;
++ char system_map[] = "/lib/firmware/mic/System.map";
++ char *map, *temp, log_buf[17] = {'\0'};
++
++ fd = open(system_map, O_RDONLY);
++ if (fd < 0) {
++ mpsslog("%s: Opening System.map failed: %d\n",
++ mic->name, errno);
++ return;
++ }
++ len = lseek(fd, 0, SEEK_END);
++ if (len < 0) {
++ mpsslog("%s: Reading System.map size failed: %d\n",
++ mic->name, errno);
++ close(fd);
++ return;
++ }
++ map = mmap(NULL, len, PROT_READ, MAP_PRIVATE, fd, 0);
++ if (map == MAP_FAILED) {
++ mpsslog("%s: mmap of System.map failed: %d\n",
++ mic->name, errno);
++ close(fd);
++ return;
++ }
++ temp = strstr(map, "__log_buf");
++ if (!temp) {
++ mpsslog("%s: __log_buf not found: %d\n", mic->name, errno);
++ munmap(map, len);
++ close(fd);
++ return;
++ }
++ strncpy(log_buf, temp - 19, 16);
++ setsysfs(mic->name, "log_buf_addr", log_buf);
++ mpsslog("%s: log_buf_addr: %s\n", mic->name, log_buf);
++ temp = strstr(map, "log_buf_len");
++ if (!temp) {
++ mpsslog("%s: log_buf_len not found: %d\n", mic->name, errno);
++ munmap(map, len);
++ close(fd);
++ return;
++ }
++ strncpy(log_buf, temp - 19, 16);
++ setsysfs(mic->name, "log_buf_len", log_buf);
++ mpsslog("%s: log_buf_len: %s\n", mic->name, log_buf);
++ munmap(map, len);
++ close(fd);
++}
++
++static void init_mic(struct mic_info *mic);
++
++static void
++change_virtblk_backend(int x, siginfo_t *siginfo, void *p)
++{
++ struct mic_info *mic;
++
++ for (mic = mic_list.next; mic != NULL; mic = mic->next)
++ mic->mic_virtblk.signaled = 1/* true */;
++}
++
++static void
++init_mic(struct mic_info *mic)
++{
++ struct sigaction ignore = {
++ .sa_flags = 0,
++ .sa_handler = SIG_IGN
++ };
++ struct sigaction act = {
++ .sa_flags = SA_SIGINFO,
++ .sa_sigaction = change_virtblk_backend,
++ };
++ char buffer[PATH_MAX];
++ int err;
++
++ /*
++ * Currently, one virtio block device is supported for each MIC card
++ * at a time. Any user (or test) can send a SIGUSR1 to the MIC daemon.
++ * The signal informs the virtio block backend about a change in the
++ * configuration file which specifies the virtio backend file name on
++ * the host. Virtio block backend then re-reads the configuration file
++ * and switches to the new block device. This signalling mechanism may
++ * not be required once multiple virtio block devices are supported by
++ * the MIC daemon.
++ */
++ sigaction(SIGUSR1, &ignore, NULL);
++
++ mic->pid = fork();
++ switch (mic->pid) {
++ case 0:
++ set_log_buf_info(mic);
++ set_cmdline(mic);
++ add_virtio_device(mic, &virtcons_dev_page.dd);
++ add_virtio_device(mic, &virtnet_dev_page.dd);
++ err = pthread_create(&mic->mic_console.console_thread, NULL,
++ virtio_console, mic);
++ if (err)
++ mpsslog("%s virtcons pthread_create failed %s\n",
++ mic->name, strerror(err));
++ err = pthread_create(&mic->mic_net.net_thread, NULL,
++ virtio_net, mic);
++ if (err)
++ mpsslog("%s virtnet pthread_create failed %s\n",
++ mic->name, strerror(err));
++ err = pthread_create(&mic->mic_virtblk.block_thread, NULL,
++ virtio_block, mic);
++ if (err)
++ mpsslog("%s virtblk pthread_create failed %s\n",
++ mic->name, strerror(err));
++ sigemptyset(&act.sa_mask);
++ err = sigaction(SIGUSR1, &act, NULL);
++ if (err)
++ mpsslog("%s sigaction SIGUSR1 failed %s\n",
++ mic->name, strerror(errno));
++ while (1)
++ sleep(60);
++ case -1:
++ mpsslog("fork failed MIC name %s id %d errno %d\n",
++ mic->name, mic->id, errno);
++ break;
++ default:
++ if (mic->restart) {
++ snprintf(buffer, PATH_MAX, "boot");
++ setsysfs(mic->name, "state", buffer);
++ mpsslog("%s restarting mic %d\n",
++ mic->name, mic->restart);
++ mic->restart = 0;
++ }
++ pthread_create(&mic->config_thread, NULL, mic_config, mic);
++ }
++}
++
++static void
++start_daemon(void)
++{
++ struct mic_info *mic;
++
++ for (mic = mic_list.next; mic != NULL; mic = mic->next)
++ init_mic(mic);
++
++ while (1)
++ sleep(60);
++}
++
++static int
++init_mic_list(void)
++{
++ struct mic_info *mic = &mic_list;
++ struct dirent *file;
++ DIR *dp;
++ int cnt = 0;
++
++ dp = opendir(MICSYSFSDIR);
++ if (!dp)
++ return 0;
++
++ while ((file = readdir(dp)) != NULL) {
++ if (!strncmp(file->d_name, "mic", 3)) {
++ mic->next = calloc(1, sizeof(struct mic_info));
++ if (mic->next) {
++ mic = mic->next;
++ mic->id = atoi(&file->d_name[3]);
++ mic->name = malloc(strlen(file->d_name) + 16);
++ if (mic->name)
++ strcpy(mic->name, file->d_name);
++ mpsslog("MIC name %s id %d\n", mic->name,
++ mic->id);
++ cnt++;
++ }
++ }
++ }
++
++ closedir(dp);
++ return cnt;
++}
++
++void
++mpsslog(char *format, ...)
++{
++ va_list args;
++ char buffer[4096];
++ char ts[52], *ts1;
++ time_t t;
++
++ if (logfp == NULL)
++ return;
++
++ va_start(args, format);
++ vsprintf(buffer, format, args);
++ va_end(args);
++
++ time(&t);
++ ts1 = ctime_r(&t, ts);
++ ts1[strlen(ts1) - 1] = '\0';
++ fprintf(logfp, "%s: %s", ts1, buffer);
++
++ fflush(logfp);
++}
++
++int
++main(int argc, char *argv[])
++{
++ int cnt;
++ pid_t pid;
++
++ myname = argv[0];
++
++ logfp = fopen(LOGFILE_NAME, "a+");
++ if (!logfp) {
++ fprintf(stderr, "cannot open logfile '%s'\n", LOGFILE_NAME);
++ exit(1);
++ }
++ pid = fork();
++ switch (pid) {
++ case 0:
++ break;
++ case -1:
++ exit(2);
++ default:
++ exit(0);
++ }
++
++ mpsslog("MIC Daemon start\n");
++
++ cnt = init_mic_list();
++ if (cnt == 0) {
++ mpsslog("MIC module not loaded\n");
++ exit(3);
++ }
++ mpsslog("MIC found %d devices\n", cnt);
++
++ start_daemon();
++
++ exit(0);
++}
+diff --git a/samples/mic/mpssd/mpssd.h b/samples/mic/mpssd/mpssd.h
+new file mode 100644
+index 000000000000..f5f18b15d9a0
+--- /dev/null
++++ b/samples/mic/mpssd/mpssd.h
+@@ -0,0 +1,102 @@
++/*
++ * Intel MIC Platform Software Stack (MPSS)
++ *
++ * Copyright(c) 2013 Intel Corporation.
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License, version 2, as
++ * published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful, but
++ * WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
++ * General Public License for more details.
++ *
++ * The full GNU General Public License is included in this distribution in
++ * the file called "COPYING".
++ *
++ * Intel MIC User Space Tools.
++ */
++#ifndef _MPSSD_H_
++#define _MPSSD_H_
++
++#include <stdio.h>
++#include <stdlib.h>
++#include <string.h>
++#include <fcntl.h>
++#include <unistd.h>
++#include <dirent.h>
++#include <libgen.h>
++#include <pthread.h>
++#include <stdarg.h>
++#include <time.h>
++#include <errno.h>
++#include <sys/dir.h>
++#include <sys/ioctl.h>
++#include <sys/poll.h>
++#include <sys/types.h>
++#include <sys/socket.h>
++#include <sys/stat.h>
++#include <sys/types.h>
++#include <sys/mman.h>
++#include <sys/utsname.h>
++#include <sys/wait.h>
++#include <netinet/in.h>
++#include <arpa/inet.h>
++#include <netdb.h>
++#include <pthread.h>
++#include <signal.h>
++#include <limits.h>
++#include <syslog.h>
++#include <getopt.h>
++#include <net/if.h>
++#include <linux/if_tun.h>
++#include <linux/if_tun.h>
++#include <linux/virtio_ids.h>
++
++#define MICSYSFSDIR "/sys/class/mic"
++#define LOGFILE_NAME "/var/log/mpssd"
++#define PAGE_SIZE 4096
++
++struct mic_console_info {
++ pthread_t console_thread;
++ int virtio_console_fd;
++ void *console_dp;
++};
++
++struct mic_net_info {
++ pthread_t net_thread;
++ int virtio_net_fd;
++ int tap_fd;
++ void *net_dp;
++};
++
++struct mic_virtblk_info {
++ pthread_t block_thread;
++ int virtio_block_fd;
++ void *block_dp;
++ volatile sig_atomic_t signaled;
++ char *backend_file;
++ int backend;
++ void *backend_addr;
++ long backend_size;
++};
++
++struct mic_info {
++ int id;
++ char *name;
++ pthread_t config_thread;
++ pid_t pid;
++ struct mic_console_info mic_console;
++ struct mic_net_info mic_net;
++ struct mic_virtblk_info mic_virtblk;
++ int restart;
++ int boot_on_resume;
++ struct mic_info *next;
++};
++
++__attribute__((format(printf, 1, 2)))
++void mpsslog(char *format, ...);
++char *readsysfs(char *dir, char *entry);
++int setsysfs(char *dir, char *entry, char *value);
++#endif
+diff --git a/samples/mic/mpssd/sysfs.c b/samples/mic/mpssd/sysfs.c
+new file mode 100644
+index 000000000000..8dd326936083
+--- /dev/null
++++ b/samples/mic/mpssd/sysfs.c
+@@ -0,0 +1,102 @@
++/*
++ * Intel MIC Platform Software Stack (MPSS)
++ *
++ * Copyright(c) 2013 Intel Corporation.
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License, version 2, as
++ * published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful, but
++ * WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
++ * General Public License for more details.
++ *
++ * The full GNU General Public License is included in this distribution in
++ * the file called "COPYING".
++ *
++ * Intel MIC User Space Tools.
++ */
++
++#include "mpssd.h"
++
++#define PAGE_SIZE 4096
++
++char *
++readsysfs(char *dir, char *entry)
++{
++ char filename[PATH_MAX];
++ char value[PAGE_SIZE];
++ char *string = NULL;
++ int fd;
++ int len;
++
++ if (dir == NULL)
++ snprintf(filename, PATH_MAX, "%s/%s", MICSYSFSDIR, entry);
++ else
++ snprintf(filename, PATH_MAX,
++ "%s/%s/%s", MICSYSFSDIR, dir, entry);
++
++ fd = open(filename, O_RDONLY);
++ if (fd < 0) {
++ mpsslog("Failed to open sysfs entry '%s': %s\n",
++ filename, strerror(errno));
++ return NULL;
++ }
++
++ len = read(fd, value, sizeof(value));
++ if (len < 0) {
++ mpsslog("Failed to read sysfs entry '%s': %s\n",
++ filename, strerror(errno));
++ goto readsys_ret;
++ }
++ if (len == 0)
++ goto readsys_ret;
++
++ value[len - 1] = '\0';
++
++ string = malloc(strlen(value) + 1);
++ if (string)
++ strcpy(string, value);
++
++readsys_ret:
++ close(fd);
++ return string;
++}
++
++int
++setsysfs(char *dir, char *entry, char *value)
++{
++ char filename[PATH_MAX];
++ char *oldvalue;
++ int fd, ret = 0;
++
++ if (dir == NULL)
++ snprintf(filename, PATH_MAX, "%s/%s", MICSYSFSDIR, entry);
++ else
++ snprintf(filename, PATH_MAX, "%s/%s/%s",
++ MICSYSFSDIR, dir, entry);
++
++ oldvalue = readsysfs(dir, entry);
++
++ fd = open(filename, O_RDWR);
++ if (fd < 0) {
++ ret = errno;
++ mpsslog("Failed to open sysfs entry '%s': %s\n",
++ filename, strerror(errno));
++ goto done;
++ }
++
++ if (!oldvalue || strcmp(value, oldvalue)) {
++ if (write(fd, value, strlen(value)) < 0) {
++ ret = errno;
++ mpsslog("Failed to write new sysfs entry '%s': %s\n",
++ filename, strerror(errno));
++ }
++ }
++ close(fd);
++done:
++ if (oldvalue)
++ free(oldvalue);
++ return ret;
++}
+diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
+index b1e455b47b82..be04b056c1bd 100644
+--- a/security/selinux/hooks.c
++++ b/security/selinux/hooks.c
+@@ -5594,7 +5594,7 @@ static int selinux_setprocattr(struct task_struct *p,
+ return error;
+
+ /* Obtain a SID for the context, if one was specified. */
+- if (size && str[1] && str[1] != '\n') {
++ if (size && str[0] && str[0] != '\n') {
+ if (str[size-1] == '\n') {
+ str[size-1] = 0;
+ size--;
+diff --git a/sound/soc/codecs/cs4270.c b/sound/soc/codecs/cs4270.c
+index e6d4ff9fd992..736c1ea8e31e 100644
+--- a/sound/soc/codecs/cs4270.c
++++ b/sound/soc/codecs/cs4270.c
+@@ -148,11 +148,11 @@ SND_SOC_DAPM_OUTPUT("AOUTR"),
+ };
+
+ static const struct snd_soc_dapm_route cs4270_dapm_routes[] = {
+- { "Capture", NULL, "AINA" },
+- { "Capture", NULL, "AINB" },
++ { "Capture", NULL, "AINL" },
++ { "Capture", NULL, "AINR" },
+
+- { "AOUTA", NULL, "Playback" },
+- { "AOUTB", NULL, "Playback" },
++ { "AOUTL", NULL, "Playback" },
++ { "AOUTR", NULL, "Playback" },
+ };
+
+ /**
+diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h
+index 0051077a7b9d..814a118d2ef6 100644
+--- a/sound/usb/quirks-table.h
++++ b/sound/usb/quirks-table.h
+@@ -2959,6 +2959,23 @@ AU0828_DEVICE(0x2040, 0x7270, "Hauppauge", "HVR-950Q"),
+ }
+ },
+
++/* Syntek STK1160 */
++{
++ .match_flags = USB_DEVICE_ID_MATCH_DEVICE |
++ USB_DEVICE_ID_MATCH_INT_CLASS |
++ USB_DEVICE_ID_MATCH_INT_SUBCLASS,
++ .idVendor = 0x05e1,
++ .idProduct = 0x0408,
++ .bInterfaceClass = USB_CLASS_AUDIO,
++ .bInterfaceSubClass = USB_SUBCLASS_AUDIOCONTROL,
++ .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) {
++ .vendor_name = "Syntek",
++ .product_name = "STK1160",
++ .ifnum = QUIRK_ANY_INTERFACE,
++ .type = QUIRK_AUDIO_ALIGN_TRANSFER
++ }
++},
++
+ /* Digidesign Mbox */
+ {
+ /* Thanks to Clemens Ladisch <clemens@ladisch.de> */
+diff --git a/tools/testing/ktest/ktest.pl b/tools/testing/ktest/ktest.pl
+index dcb1e9ac949c..d9d10f3c8ca3 100755
+--- a/tools/testing/ktest/ktest.pl
++++ b/tools/testing/ktest/ktest.pl
+@@ -2450,7 +2450,7 @@ sub do_run_test {
+ }
+
+ waitpid $child_pid, 0;
+- $child_exit = $?;
++ $child_exit = $? >> 8;
+
+ if (!$bug && $in_bisect) {
+ if (defined($bisect_ret_good)) {
^ permalink raw reply related [flat|nested] 67+ messages in thread
end of thread, other threads:[~2017-04-18 10:20 UTC | newest]
Thread overview: 67+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2017-03-02 16:33 [gentoo-commits] proj/linux-patches:3.18 commit in: / Mike Pagano
-- strict thread matches above, loose matches on Subject: below --
2017-04-18 10:20 Mike Pagano
2017-03-02 16:33 Mike Pagano
2017-02-08 11:16 Mike Pagano
2017-01-18 21:46 Mike Pagano
2017-01-18 21:38 Mike Pagano
2016-12-09 0:21 Mike Pagano
2016-11-30 15:42 Mike Pagano
2016-11-25 22:57 Mike Pagano
2016-11-01 9:36 Alice Ferrazzi
2016-10-12 19:51 Mike Pagano
2016-09-18 12:43 Mike Pagano
2016-08-22 23:27 Mike Pagano
2016-08-10 12:54 Mike Pagano
2016-07-31 15:27 Mike Pagano
2016-07-15 14:46 Mike Pagano
2016-07-13 23:28 Mike Pagano
2016-07-01 20:50 Mike Pagano
2016-06-23 11:44 Mike Pagano
2016-06-08 11:20 Mike Pagano
2016-05-24 12:03 Mike Pagano
2016-05-12 0:10 Mike Pagano
2016-04-20 11:21 Mike Pagano
2016-04-06 11:21 Mike Pagano
2016-03-17 22:50 Mike Pagano
2016-03-05 21:08 Mike Pagano
2016-02-16 16:34 Mike Pagano
2016-01-31 15:36 Mike Pagano
2016-01-20 14:35 Mike Pagano
2015-12-17 17:12 Mike Pagano
2015-11-03 18:39 Mike Pagano
2015-10-30 18:38 Mike Pagano
2015-10-03 17:45 Mike Pagano
2015-09-10 0:15 Mike Pagano
2015-08-21 12:57 Mike Pagano
2015-07-30 12:43 Mike Pagano
2015-07-22 10:13 Mike Pagano
2015-07-10 23:44 Mike Pagano
2015-06-19 15:22 Mike Pagano
2015-05-22 0:48 Mike Pagano
2015-05-13 14:27 Mike Pagano
2015-04-29 17:31 Mike Pagano
2015-04-27 17:18 Mike Pagano
2015-04-05 0:05 Mike Pagano
2015-03-28 19:46 Mike Pagano
2015-03-24 23:19 Mike Pagano
2015-03-21 20:02 Mike Pagano
2015-03-07 14:28 Mike Pagano
2015-02-27 13:26 Mike Pagano
2015-02-14 20:32 Mike Pagano
2015-02-13 1:35 Mike Pagano
2015-02-11 14:35 Mike Pagano
2015-02-07 1:07 Mike Pagano
2015-01-30 11:01 Mike Pagano
2015-01-28 23:56 Anthony G. Basile
2015-01-28 23:55 Anthony G. Basile
2015-01-28 22:18 Anthony G. Basile
2015-01-16 18:31 Mike Pagano
2015-01-16 0:28 Mike Pagano
2015-01-09 13:39 Mike Pagano
2015-01-05 14:39 Mike Pagano
2015-01-04 19:03 Mike Pagano
2015-01-02 19:06 Mike Pagano
2015-01-01 14:15 Mike Pagano
2014-12-16 19:44 Mike Pagano
2014-12-09 20:49 Mike Pagano
2014-11-26 0:36 Mike Pagano
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox