[gentoo-commits] linux-patches r2718 - genpatches-2.6/trunk/3.13

[Mike Pagano (mpagano)]

Author: mpagano
Date: 2014-03-31 17:53:18 +0000 (Mon, 31 Mar 2014)
New Revision: 2718

Added:
   genpatches-2.6/trunk/3.13/1007_linux-3.13.8.patch
Modified:
   genpatches-2.6/trunk/3.13/0000_README
Log:
Linux patch 3.13.8

Modified: genpatches-2.6/trunk/3.13/0000_README
===================================================================
--- genpatches-2.6/trunk/3.13/0000_README	2014-03-31 12:04:13 UTC (rev 2717)
+++ genpatches-2.6/trunk/3.13/0000_README	2014-03-31 17:53:18 UTC (rev 2718)
@@ -70,6 +70,10 @@
 From:   http://www.kernel.org
 Desc:   Linux 3.13.7
 
+Patch:  1007_linux-3.13.8.patch
+From:   http://www.kernel.org
+Desc:   Linux 3.13.8
+
 Patch:  1500_XATTR_USER_PREFIX.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=470644
 Desc:   Support for namespace user.pax.* on tmpfs.

Added: genpatches-2.6/trunk/3.13/1007_linux-3.13.8.patch
===================================================================
--- genpatches-2.6/trunk/3.13/1007_linux-3.13.8.patch	                        (rev 0)
+++ genpatches-2.6/trunk/3.13/1007_linux-3.13.8.patch	2014-03-31 17:53:18 UTC (rev 2718)
@@ -0,0 +1,2669 @@
+diff --git a/Makefile b/Makefile
+index 9f214b4ed73c..4cab13b605c1 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 13
+-SUBLEVEL = 7
++SUBLEVEL = 8
+ EXTRAVERSION =
+ NAME = One Giant Leap for Frogkind
+ 
+diff --git a/arch/arm/mm/init.c b/arch/arm/mm/init.c
+index 3e8f106ee5fe..ac1d883460c7 100644
+--- a/arch/arm/mm/init.c
++++ b/arch/arm/mm/init.c
+@@ -345,10 +345,11 @@ void __init arm_memblock_init(struct meminfo *mi,
+ #endif
+ #ifdef CONFIG_BLK_DEV_INITRD
+ 	/* FDT scan will populate initrd_start */
+-	if (initrd_start) {
++	if (initrd_start && !phys_initrd_size) {
+ 		phys_initrd_start = __virt_to_phys(initrd_start);
+ 		phys_initrd_size = initrd_end - initrd_start;
+ 	}
++	initrd_start = initrd_end = 0;
+ 	if (phys_initrd_size &&
+ 	    !memblock_is_region_memory(phys_initrd_start, phys_initrd_size)) {
+ 		pr_err("INITRD: 0x%08llx+0x%08lx is not a memory region - disabling initrd\n",
+diff --git a/arch/mips/include/asm/syscall.h b/arch/mips/include/asm/syscall.h
+index 81c89132c59d..33e8dbfc1b63 100644
+--- a/arch/mips/include/asm/syscall.h
++++ b/arch/mips/include/asm/syscall.h
+@@ -29,7 +29,7 @@ static inline long syscall_get_nr(struct task_struct *task,
+ static inline unsigned long mips_get_syscall_arg(unsigned long *arg,
+ 	struct task_struct *task, struct pt_regs *regs, unsigned int n)
+ {
+-	unsigned long usp = regs->regs[29];
++	unsigned long usp __maybe_unused = regs->regs[29];
+ 
+ 	switch (n) {
+ 	case 0: case 1: case 2: case 3:
+diff --git a/arch/powerpc/include/asm/eeh.h b/arch/powerpc/include/asm/eeh.h
+index d3e5e9bc8f94..e37db7f2a5fa 100644
+--- a/arch/powerpc/include/asm/eeh.h
++++ b/arch/powerpc/include/asm/eeh.h
+@@ -117,6 +117,16 @@ static inline struct pci_dev *eeh_dev_to_pci_dev(struct eeh_dev *edev)
+ 	return edev ? edev->pdev : NULL;
+ }
+ 
++/* Return values from eeh_ops::next_error */
++enum {
++	EEH_NEXT_ERR_NONE = 0,
++	EEH_NEXT_ERR_INF,
++	EEH_NEXT_ERR_FROZEN_PE,
++	EEH_NEXT_ERR_FENCED_PHB,
++	EEH_NEXT_ERR_DEAD_PHB,
++	EEH_NEXT_ERR_DEAD_IOC
++};
++
+ /*
+  * The struct is used to trace the registered EEH operation
+  * callback functions. Actually, those operation callback
+diff --git a/arch/powerpc/kernel/eeh_driver.c b/arch/powerpc/kernel/eeh_driver.c
+index 36bed5a12750..d3a132c9127c 100644
+--- a/arch/powerpc/kernel/eeh_driver.c
++++ b/arch/powerpc/kernel/eeh_driver.c
+@@ -626,84 +626,90 @@ static void eeh_handle_special_event(void)
+ {
+ 	struct eeh_pe *pe, *phb_pe;
+ 	struct pci_bus *bus;
+-	struct pci_controller *hose, *tmp;
++	struct pci_controller *hose;
+ 	unsigned long flags;
+-	int rc = 0;
++	int rc;
+ 
+-	/*
+-	 * The return value from next_error() has been classified as follows.
+-	 * It might be good to enumerate them. However, next_error() is only
+-	 * supported by PowerNV platform for now. So it would be fine to use
+-	 * integer directly:
+-	 *
+-	 * 4 - Dead IOC           3 - Dead PHB
+-	 * 2 - Fenced PHB         1 - Frozen PE
+-	 * 0 - No error found
+-	 *
+-	 */
+-	rc = eeh_ops->next_error(&pe);
+-	if (rc <= 0)
+-		return;
+ 
+-	switch (rc) {
+-	case 4:
+-		/* Mark all PHBs in dead state */
+-		eeh_serialize_lock(&flags);
+-		list_for_each_entry_safe(hose, tmp,
+-				&hose_list, list_node) {
+-			phb_pe = eeh_phb_pe_get(hose);
+-			if (!phb_pe) continue;
+-
+-			eeh_pe_state_mark(phb_pe,
+-				EEH_PE_ISOLATED | EEH_PE_PHB_DEAD);
++	do {
++		rc = eeh_ops->next_error(&pe);
++
++		switch (rc) {
++		case EEH_NEXT_ERR_DEAD_IOC:
++			/* Mark all PHBs in dead state */
++			eeh_serialize_lock(&flags);
++
++			/* Purge all events */
++			eeh_remove_event(NULL);
++
++			list_for_each_entry(hose, &hose_list, list_node) {
++				phb_pe = eeh_phb_pe_get(hose);
++				if (!phb_pe) continue;
++
++				eeh_pe_state_mark(phb_pe,
++					EEH_PE_ISOLATED | EEH_PE_PHB_DEAD);
++			}
++
++			eeh_serialize_unlock(flags);
++
++			break;
++		case EEH_NEXT_ERR_FROZEN_PE:
++		case EEH_NEXT_ERR_FENCED_PHB:
++		case EEH_NEXT_ERR_DEAD_PHB:
++			/* Mark the PE in fenced state */
++			eeh_serialize_lock(&flags);
++
++			/* Purge all events of the PHB */
++			eeh_remove_event(pe);
++
++			if (rc == EEH_NEXT_ERR_DEAD_PHB)
++				eeh_pe_state_mark(pe,
++					EEH_PE_ISOLATED | EEH_PE_PHB_DEAD);
++			else
++				eeh_pe_state_mark(pe,
++					EEH_PE_ISOLATED | EEH_PE_RECOVERING);
++
++			eeh_serialize_unlock(flags);
++
++			break;
++		case EEH_NEXT_ERR_NONE:
++			return;
++		default:
++			pr_warn("%s: Invalid value %d from next_error()\n",
++				__func__, rc);
++			return;
+ 		}
+-		eeh_serialize_unlock(flags);
+-
+-		/* Purge all events */
+-		eeh_remove_event(NULL);
+-		break;
+-	case 3:
+-	case 2:
+-	case 1:
+-		/* Mark the PE in fenced state */
+-		eeh_serialize_lock(&flags);
+-		if (rc == 3)
+-			eeh_pe_state_mark(pe,
+-				EEH_PE_ISOLATED | EEH_PE_PHB_DEAD);
+-		else
+-			eeh_pe_state_mark(pe,
+-				EEH_PE_ISOLATED | EEH_PE_RECOVERING);
+-		eeh_serialize_unlock(flags);
+-
+-		/* Purge all events of the PHB */
+-		eeh_remove_event(pe);
+-		break;
+-	default:
+-		pr_err("%s: Invalid value %d from next_error()\n",
+-		       __func__, rc);
+-		return;
+-	}
+ 
+-	/*
+-	 * For fenced PHB and frozen PE, it's handled as normal
+-	 * event. We have to remove the affected PHBs for dead
+-	 * PHB and IOC
+-	 */
+-	if (rc == 2 || rc == 1)
+-		eeh_handle_normal_event(pe);
+-	else {
+-		list_for_each_entry_safe(hose, tmp,
+-			&hose_list, list_node) {
+-			phb_pe = eeh_phb_pe_get(hose);
+-			if (!phb_pe || !(phb_pe->state & EEH_PE_PHB_DEAD))
+-				continue;
+-
+-			bus = eeh_pe_bus_get(phb_pe);
+-			/* Notify all devices that they're about to go down. */
+-			eeh_pe_dev_traverse(pe, eeh_report_failure, NULL);
+-			pcibios_remove_pci_devices(bus);
++		/*
++		 * For fenced PHB and frozen PE, it's handled as normal
++		 * event. We have to remove the affected PHBs for dead
++		 * PHB and IOC
++		 */
++		if (rc == EEH_NEXT_ERR_FROZEN_PE ||
++		    rc == EEH_NEXT_ERR_FENCED_PHB) {
++			eeh_handle_normal_event(pe);
++		} else {
++			list_for_each_entry(hose, &hose_list, list_node) {
++				phb_pe = eeh_phb_pe_get(hose);
++				if (!phb_pe ||
++				    !(phb_pe->state & EEH_PE_PHB_DEAD))
++					continue;
++
++				/* Notify all devices to be down */
++				bus = eeh_pe_bus_get(phb_pe);
++				eeh_pe_dev_traverse(pe,
++					eeh_report_failure, NULL);
++				pcibios_remove_pci_devices(bus);
++			}
+ 		}
+-	}
++
++		/*
++		 * If we have detected dead IOC, we needn't proceed
++		 * any more since all PHBs would have been removed
++		 */
++		if (rc == EEH_NEXT_ERR_DEAD_IOC)
++			break;
++	} while (rc != EEH_NEXT_ERR_NONE);
+ }
+ 
+ /**
+diff --git a/arch/powerpc/platforms/powernv/eeh-ioda.c b/arch/powerpc/platforms/powernv/eeh-ioda.c
+index 9fd23ce4a04a..27e5f02a45a0 100644
+--- a/arch/powerpc/platforms/powernv/eeh-ioda.c
++++ b/arch/powerpc/platforms/powernv/eeh-ioda.c
+@@ -114,6 +114,7 @@ DEFINE_SIMPLE_ATTRIBUTE(ioda_eeh_inbB_dbgfs_ops, ioda_eeh_inbB_dbgfs_get,
+ 			ioda_eeh_inbB_dbgfs_set, "0x%llx\n");
+ #endif /* CONFIG_DEBUG_FS */
+ 
++
+ /**
+  * ioda_eeh_post_init - Chip dependent post initialization
+  * @hose: PCI controller
+@@ -221,6 +222,22 @@ static int ioda_eeh_set_option(struct eeh_pe *pe, int option)
+ 	return ret;
+ }
+ 
++static void ioda_eeh_phb_diag(struct pci_controller *hose)
++{
++	struct pnv_phb *phb = hose->private_data;
++	long rc;
++
++	rc = opal_pci_get_phb_diag_data2(phb->opal_id, phb->diag.blob,
++					 PNV_PCI_DIAG_BUF_SIZE);
++	if (rc != OPAL_SUCCESS) {
++		pr_warning("%s: Failed to get diag-data for PHB#%x (%ld)\n",
++			    __func__, hose->global_number, rc);
++		return;
++	}
++
++	pnv_pci_dump_phb_diag_data(hose, phb->diag.blob);
++}
++
+ /**
+  * ioda_eeh_get_state - Retrieve the state of PE
+  * @pe: EEH PE
+@@ -272,6 +289,9 @@ static int ioda_eeh_get_state(struct eeh_pe *pe)
+ 			result |= EEH_STATE_DMA_ACTIVE;
+ 			result |= EEH_STATE_MMIO_ENABLED;
+ 			result |= EEH_STATE_DMA_ENABLED;
++		} else if (!(pe->state & EEH_PE_ISOLATED)) {
++			eeh_pe_state_mark(pe, EEH_PE_ISOLATED);
++			ioda_eeh_phb_diag(hose);
+ 		}
+ 
+ 		return result;
+@@ -315,6 +335,15 @@ static int ioda_eeh_get_state(struct eeh_pe *pe)
+ 			   __func__, fstate, hose->global_number, pe_no);
+ 	}
+ 
++	/* Dump PHB diag-data for frozen PE */
++	if (result != EEH_STATE_NOT_SUPPORT &&
++	    (result & (EEH_STATE_MMIO_ACTIVE | EEH_STATE_DMA_ACTIVE)) !=
++	    (EEH_STATE_MMIO_ACTIVE | EEH_STATE_DMA_ACTIVE) &&
++	    !(pe->state & EEH_PE_ISOLATED)) {
++		eeh_pe_state_mark(pe, EEH_PE_ISOLATED);
++		ioda_eeh_phb_diag(hose);
++	}
++
+ 	return result;
+ }
+ 
+@@ -530,45 +559,6 @@ static int ioda_eeh_reset(struct eeh_pe *pe, int option)
+ }
+ 
+ /**
+- * ioda_eeh_get_log - Retrieve error log
+- * @pe: EEH PE
+- * @severity: Severity level of the log
+- * @drv_log: buffer to store the log
+- * @len: space of the log buffer
+- *
+- * The function is used to retrieve error log from P7IOC.
+- */
+-static int ioda_eeh_get_log(struct eeh_pe *pe, int severity,
+-			    char *drv_log, unsigned long len)
+-{
+-	s64 ret;
+-	unsigned long flags;
+-	struct pci_controller *hose = pe->phb;
+-	struct pnv_phb *phb = hose->private_data;
+-
+-	spin_lock_irqsave(&phb->lock, flags);
+-
+-	ret = opal_pci_get_phb_diag_data2(phb->opal_id,
+-			phb->diag.blob, PNV_PCI_DIAG_BUF_SIZE);
+-	if (ret) {
+-		spin_unlock_irqrestore(&phb->lock, flags);
+-		pr_warning("%s: Can't get log for PHB#%x-PE#%x (%lld)\n",
+-			   __func__, hose->global_number, pe->addr, ret);
+-		return -EIO;
+-	}
+-
+-	/*
+-	 * FIXME: We probably need log the error in somewhere.
+-	 * Lets make it up in future.
+-	 */
+-	/* pr_info("%s", phb->diag.blob); */
+-
+-	spin_unlock_irqrestore(&phb->lock, flags);
+-
+-	return 0;
+-}
+-
+-/**
+  * ioda_eeh_configure_bridge - Configure the PCI bridges for the indicated PE
+  * @pe: EEH PE
+  *
+@@ -649,167 +639,6 @@ static void ioda_eeh_hub_diag(struct pci_controller *hose)
+ 	}
+ }
+ 
+-static void ioda_eeh_p7ioc_phb_diag(struct pci_controller *hose,
+-				    struct OpalIoPhbErrorCommon *common)
+-{
+-	struct OpalIoP7IOCPhbErrorData *data;
+-	int i;
+-
+-	data = (struct OpalIoP7IOCPhbErrorData *)common;
+-
+-	pr_info("P7IOC PHB#%x Diag-data (Version: %d)\n\n",
+-		hose->global_number, common->version);
+-
+-	pr_info("  brdgCtl:              %08x\n", data->brdgCtl);
+-
+-	pr_info("  portStatusReg:        %08x\n", data->portStatusReg);
+-	pr_info("  rootCmplxStatus:      %08x\n", data->rootCmplxStatus);
+-	pr_info("  busAgentStatus:       %08x\n", data->busAgentStatus);
+-
+-	pr_info("  deviceStatus:         %08x\n", data->deviceStatus);
+-	pr_info("  slotStatus:           %08x\n", data->slotStatus);
+-	pr_info("  linkStatus:           %08x\n", data->linkStatus);
+-	pr_info("  devCmdStatus:         %08x\n", data->devCmdStatus);
+-	pr_info("  devSecStatus:         %08x\n", data->devSecStatus);
+-
+-	pr_info("  rootErrorStatus:      %08x\n", data->rootErrorStatus);
+-	pr_info("  uncorrErrorStatus:    %08x\n", data->uncorrErrorStatus);
+-	pr_info("  corrErrorStatus:      %08x\n", data->corrErrorStatus);
+-	pr_info("  tlpHdr1:              %08x\n", data->tlpHdr1);
+-	pr_info("  tlpHdr2:              %08x\n", data->tlpHdr2);
+-	pr_info("  tlpHdr3:              %08x\n", data->tlpHdr3);
+-	pr_info("  tlpHdr4:              %08x\n", data->tlpHdr4);
+-	pr_info("  sourceId:             %08x\n", data->sourceId);
+-
+-	pr_info("  errorClass:           %016llx\n", data->errorClass);
+-	pr_info("  correlator:           %016llx\n", data->correlator);
+-	pr_info("  p7iocPlssr:           %016llx\n", data->p7iocPlssr);
+-	pr_info("  p7iocCsr:             %016llx\n", data->p7iocCsr);
+-	pr_info("  lemFir:               %016llx\n", data->lemFir);
+-	pr_info("  lemErrorMask:         %016llx\n", data->lemErrorMask);
+-	pr_info("  lemWOF:               %016llx\n", data->lemWOF);
+-	pr_info("  phbErrorStatus:       %016llx\n", data->phbErrorStatus);
+-	pr_info("  phbFirstErrorStatus:  %016llx\n", data->phbFirstErrorStatus);
+-	pr_info("  phbErrorLog0:         %016llx\n", data->phbErrorLog0);
+-	pr_info("  phbErrorLog1:         %016llx\n", data->phbErrorLog1);
+-	pr_info("  mmioErrorStatus:      %016llx\n", data->mmioErrorStatus);
+-	pr_info("  mmioFirstErrorStatus: %016llx\n", data->mmioFirstErrorStatus);
+-	pr_info("  mmioErrorLog0:        %016llx\n", data->mmioErrorLog0);
+-	pr_info("  mmioErrorLog1:        %016llx\n", data->mmioErrorLog1);
+-	pr_info("  dma0ErrorStatus:      %016llx\n", data->dma0ErrorStatus);
+-	pr_info("  dma0FirstErrorStatus: %016llx\n", data->dma0FirstErrorStatus);
+-	pr_info("  dma0ErrorLog0:        %016llx\n", data->dma0ErrorLog0);
+-	pr_info("  dma0ErrorLog1:        %016llx\n", data->dma0ErrorLog1);
+-	pr_info("  dma1ErrorStatus:      %016llx\n", data->dma1ErrorStatus);
+-	pr_info("  dma1FirstErrorStatus: %016llx\n", data->dma1FirstErrorStatus);
+-	pr_info("  dma1ErrorLog0:        %016llx\n", data->dma1ErrorLog0);
+-	pr_info("  dma1ErrorLog1:        %016llx\n", data->dma1ErrorLog1);
+-
+-	for (i = 0; i < OPAL_P7IOC_NUM_PEST_REGS; i++) {
+-		if ((data->pestA[i] >> 63) == 0 &&
+-		    (data->pestB[i] >> 63) == 0)
+-			continue;
+-
+-		pr_info("  PE[%3d] PESTA:        %016llx\n", i, data->pestA[i]);
+-		pr_info("          PESTB:        %016llx\n", data->pestB[i]);
+-	}
+-}
+-
+-static void ioda_eeh_phb3_phb_diag(struct pci_controller *hose,
+-				    struct OpalIoPhbErrorCommon *common)
+-{
+-	struct OpalIoPhb3ErrorData *data;
+-	int i;
+-
+-	data = (struct OpalIoPhb3ErrorData*)common;
+-	pr_info("PHB3 PHB#%x Diag-data (Version: %d)\n\n",
+-		hose->global_number, common->version);
+-
+-	pr_info("  brdgCtl:              %08x\n", data->brdgCtl);
+-
+-	pr_info("  portStatusReg:        %08x\n", data->portStatusReg);
+-	pr_info("  rootCmplxStatus:      %08x\n", data->rootCmplxStatus);
+-	pr_info("  busAgentStatus:       %08x\n", data->busAgentStatus);
+-
+-	pr_info("  deviceStatus:         %08x\n", data->deviceStatus);
+-	pr_info("  slotStatus:           %08x\n", data->slotStatus);
+-	pr_info("  linkStatus:           %08x\n", data->linkStatus);
+-	pr_info("  devCmdStatus:         %08x\n", data->devCmdStatus);
+-	pr_info("  devSecStatus:         %08x\n", data->devSecStatus);
+-
+-	pr_info("  rootErrorStatus:      %08x\n", data->rootErrorStatus);
+-	pr_info("  uncorrErrorStatus:    %08x\n", data->uncorrErrorStatus);
+-	pr_info("  corrErrorStatus:      %08x\n", data->corrErrorStatus);
+-	pr_info("  tlpHdr1:              %08x\n", data->tlpHdr1);
+-	pr_info("  tlpHdr2:              %08x\n", data->tlpHdr2);
+-	pr_info("  tlpHdr3:              %08x\n", data->tlpHdr3);
+-	pr_info("  tlpHdr4:              %08x\n", data->tlpHdr4);
+-	pr_info("  sourceId:             %08x\n", data->sourceId);
+-	pr_info("  errorClass:           %016llx\n", data->errorClass);
+-	pr_info("  correlator:           %016llx\n", data->correlator);
+-	pr_info("  nFir:                 %016llx\n", data->nFir);
+-	pr_info("  nFirMask:             %016llx\n", data->nFirMask);
+-	pr_info("  nFirWOF:              %016llx\n", data->nFirWOF);
+-	pr_info("  PhbPlssr:             %016llx\n", data->phbPlssr);
+-	pr_info("  PhbCsr:               %016llx\n", data->phbCsr);
+-	pr_info("  lemFir:               %016llx\n", data->lemFir);
+-	pr_info("  lemErrorMask:         %016llx\n", data->lemErrorMask);
+-	pr_info("  lemWOF:               %016llx\n", data->lemWOF);
+-	pr_info("  phbErrorStatus:       %016llx\n", data->phbErrorStatus);
+-	pr_info("  phbFirstErrorStatus:  %016llx\n", data->phbFirstErrorStatus);
+-	pr_info("  phbErrorLog0:         %016llx\n", data->phbErrorLog0);
+-	pr_info("  phbErrorLog1:         %016llx\n", data->phbErrorLog1);
+-	pr_info("  mmioErrorStatus:      %016llx\n", data->mmioErrorStatus);
+-	pr_info("  mmioFirstErrorStatus: %016llx\n", data->mmioFirstErrorStatus);
+-	pr_info("  mmioErrorLog0:        %016llx\n", data->mmioErrorLog0);
+-	pr_info("  mmioErrorLog1:        %016llx\n", data->mmioErrorLog1);
+-	pr_info("  dma0ErrorStatus:      %016llx\n", data->dma0ErrorStatus);
+-	pr_info("  dma0FirstErrorStatus: %016llx\n", data->dma0FirstErrorStatus);
+-	pr_info("  dma0ErrorLog0:        %016llx\n", data->dma0ErrorLog0);
+-	pr_info("  dma0ErrorLog1:        %016llx\n", data->dma0ErrorLog1);
+-	pr_info("  dma1ErrorStatus:      %016llx\n", data->dma1ErrorStatus);
+-	pr_info("  dma1FirstErrorStatus: %016llx\n", data->dma1FirstErrorStatus);
+-	pr_info("  dma1ErrorLog0:        %016llx\n", data->dma1ErrorLog0);
+-	pr_info("  dma1ErrorLog1:        %016llx\n", data->dma1ErrorLog1);
+-
+-	for (i = 0; i < OPAL_PHB3_NUM_PEST_REGS; i++) {
+-		if ((data->pestA[i] >> 63) == 0 &&
+-		    (data->pestB[i] >> 63) == 0)
+-			continue;
+-
+-		pr_info("  PE[%3d] PESTA:        %016llx\n", i, data->pestA[i]);
+-		pr_info("          PESTB:        %016llx\n", data->pestB[i]);
+-	}
+-}
+-
+-static void ioda_eeh_phb_diag(struct pci_controller *hose)
+-{
+-	struct pnv_phb *phb = hose->private_data;
+-	struct OpalIoPhbErrorCommon *common;
+-	long rc;
+-
+-	rc = opal_pci_get_phb_diag_data2(phb->opal_id, phb->diag.blob,
+-					 PNV_PCI_DIAG_BUF_SIZE);
+-	if (rc != OPAL_SUCCESS) {
+-		pr_warning("%s: Failed to get diag-data for PHB#%x (%ld)\n",
+-			    __func__, hose->global_number, rc);
+-		return;
+-	}
+-
+-	common = (struct OpalIoPhbErrorCommon *)phb->diag.blob;
+-	switch (common->ioType) {
+-	case OPAL_PHB_ERROR_DATA_TYPE_P7IOC:
+-		ioda_eeh_p7ioc_phb_diag(hose, common);
+-		break;
+-	case OPAL_PHB_ERROR_DATA_TYPE_PHB3:
+-		ioda_eeh_phb3_phb_diag(hose, common);
+-		break;
+-	default:
+-		pr_warning("%s: Unrecognized I/O chip %d\n",
+-			   __func__, common->ioType);
+-	}
+-}
+-
+ static int ioda_eeh_get_phb_pe(struct pci_controller *hose,
+ 			       struct eeh_pe **pe)
+ {
+@@ -863,12 +692,12 @@ static int ioda_eeh_get_pe(struct pci_controller *hose,
+  */
+ static int ioda_eeh_next_error(struct eeh_pe **pe)
+ {
+-	struct pci_controller *hose, *tmp;
++	struct pci_controller *hose;
+ 	struct pnv_phb *phb;
+ 	u64 frozen_pe_no;
+ 	u16 err_type, severity;
+ 	long rc;
+-	int ret = 1;
++	int ret = EEH_NEXT_ERR_NONE;
+ 
+ 	/*
+ 	 * While running here, it's safe to purge the event queue.
+@@ -878,7 +707,7 @@ static int ioda_eeh_next_error(struct eeh_pe **pe)
+ 	eeh_remove_event(NULL);
+ 	opal_notifier_update_evt(OPAL_EVENT_PCI_ERROR, 0x0ul);
+ 
+-	list_for_each_entry_safe(hose, tmp, &hose_list, list_node) {
++	list_for_each_entry(hose, &hose_list, list_node) {
+ 		/*
+ 		 * If the subordinate PCI buses of the PHB has been
+ 		 * removed, we needn't take care of it any more.
+@@ -917,19 +746,19 @@ static int ioda_eeh_next_error(struct eeh_pe **pe)
+ 		switch (err_type) {
+ 		case OPAL_EEH_IOC_ERROR:
+ 			if (severity == OPAL_EEH_SEV_IOC_DEAD) {
+-				list_for_each_entry_safe(hose, tmp,
+-						&hose_list, list_node) {
++				list_for_each_entry(hose, &hose_list,
++						    list_node) {
+ 					phb = hose->private_data;
+ 					phb->eeh_state |= PNV_EEH_STATE_REMOVED;
+ 				}
+ 
+ 				pr_err("EEH: dead IOC detected\n");
+-				ret = 4;
+-				goto out;
++				ret = EEH_NEXT_ERR_DEAD_IOC;
+ 			} else if (severity == OPAL_EEH_SEV_INF) {
+ 				pr_info("EEH: IOC informative error "
+ 					"detected\n");
+ 				ioda_eeh_hub_diag(hose);
++				ret = EEH_NEXT_ERR_NONE;
+ 			}
+ 
+ 			break;
+@@ -941,21 +770,20 @@ static int ioda_eeh_next_error(struct eeh_pe **pe)
+ 				pr_err("EEH: dead PHB#%x detected\n",
+ 					hose->global_number);
+ 				phb->eeh_state |= PNV_EEH_STATE_REMOVED;
+-				ret = 3;
+-				goto out;
++				ret = EEH_NEXT_ERR_DEAD_PHB;
+ 			} else if (severity == OPAL_EEH_SEV_PHB_FENCED) {
+ 				if (ioda_eeh_get_phb_pe(hose, pe))
+ 					break;
+ 
+ 				pr_err("EEH: fenced PHB#%x detected\n",
+ 					hose->global_number);
+-				ret = 2;
+-				goto out;
++				ret = EEH_NEXT_ERR_FENCED_PHB;
+ 			} else if (severity == OPAL_EEH_SEV_INF) {
+ 				pr_info("EEH: PHB#%x informative error "
+ 					"detected\n",
+ 					hose->global_number);
+ 				ioda_eeh_phb_diag(hose);
++				ret = EEH_NEXT_ERR_NONE;
+ 			}
+ 
+ 			break;
+@@ -965,13 +793,37 @@ static int ioda_eeh_next_error(struct eeh_pe **pe)
+ 
+ 			pr_err("EEH: Frozen PE#%x on PHB#%x detected\n",
+ 				(*pe)->addr, (*pe)->phb->global_number);
+-			ret = 1;
+-			goto out;
++			ret = EEH_NEXT_ERR_FROZEN_PE;
++			break;
++		default:
++			pr_warn("%s: Unexpected error type %d\n",
++				__func__, err_type);
++		}
++
++		/*
++		 * EEH core will try recover from fenced PHB or
++		 * frozen PE. In the time for frozen PE, EEH core
++		 * enable IO path for that before collecting logs,
++		 * but it ruins the site. So we have to dump the
++		 * log in advance here.
++		 */
++		if ((ret == EEH_NEXT_ERR_FROZEN_PE  ||
++		    ret == EEH_NEXT_ERR_FENCED_PHB) &&
++		    !((*pe)->state & EEH_PE_ISOLATED)) {
++			eeh_pe_state_mark(*pe, EEH_PE_ISOLATED);
++			ioda_eeh_phb_diag(hose);
+ 		}
++
++		/*
++		 * If we have no errors on the specific PHB or only
++		 * informative error there, we continue poking it.
++		 * Otherwise, we need actions to be taken by upper
++		 * layer.
++		 */
++		if (ret > EEH_NEXT_ERR_INF)
++			break;
+ 	}
+ 
+-	ret = 0;
+-out:
+ 	return ret;
+ }
+ 
+@@ -980,7 +832,6 @@ struct pnv_eeh_ops ioda_eeh_ops = {
+ 	.set_option		= ioda_eeh_set_option,
+ 	.get_state		= ioda_eeh_get_state,
+ 	.reset			= ioda_eeh_reset,
+-	.get_log		= ioda_eeh_get_log,
+ 	.configure_bridge	= ioda_eeh_configure_bridge,
+ 	.next_error		= ioda_eeh_next_error
+ };
+diff --git a/arch/powerpc/platforms/powernv/pci.c b/arch/powerpc/platforms/powernv/pci.c
+index 4eb33a9ed532..437bbda26d1d 100644
+--- a/arch/powerpc/platforms/powernv/pci.c
++++ b/arch/powerpc/platforms/powernv/pci.c
+@@ -124,77 +124,187 @@ static void pnv_teardown_msi_irqs(struct pci_dev *pdev)
+ }
+ #endif /* CONFIG_PCI_MSI */
+ 
+-static void pnv_pci_dump_p7ioc_diag_data(struct pnv_phb *phb)
++static void pnv_pci_dump_p7ioc_diag_data(struct pci_controller *hose,
++					 struct OpalIoPhbErrorCommon *common)
+ {
+-	struct OpalIoP7IOCPhbErrorData *data = &phb->diag.p7ioc;
++	struct OpalIoP7IOCPhbErrorData *data;
+ 	int i;
+ 
+-	pr_info("PHB %d diagnostic data:\n", phb->hose->global_number);
+-
+-	pr_info("  brdgCtl              = 0x%08x\n", data->brdgCtl);
+-
+-	pr_info("  portStatusReg        = 0x%08x\n", data->portStatusReg);
+-	pr_info("  rootCmplxStatus      = 0x%08x\n", data->rootCmplxStatus);
+-	pr_info("  busAgentStatus       = 0x%08x\n", data->busAgentStatus);
+-
+-	pr_info("  deviceStatus         = 0x%08x\n", data->deviceStatus);
+-	pr_info("  slotStatus           = 0x%08x\n", data->slotStatus);
+-	pr_info("  linkStatus           = 0x%08x\n", data->linkStatus);
+-	pr_info("  devCmdStatus         = 0x%08x\n", data->devCmdStatus);
+-	pr_info("  devSecStatus         = 0x%08x\n", data->devSecStatus);
+-
+-	pr_info("  rootErrorStatus      = 0x%08x\n", data->rootErrorStatus);
+-	pr_info("  uncorrErrorStatus    = 0x%08x\n", data->uncorrErrorStatus);
+-	pr_info("  corrErrorStatus      = 0x%08x\n", data->corrErrorStatus);
+-	pr_info("  tlpHdr1              = 0x%08x\n", data->tlpHdr1);
+-	pr_info("  tlpHdr2              = 0x%08x\n", data->tlpHdr2);
+-	pr_info("  tlpHdr3              = 0x%08x\n", data->tlpHdr3);
+-	pr_info("  tlpHdr4              = 0x%08x\n", data->tlpHdr4);
+-	pr_info("  sourceId             = 0x%08x\n", data->sourceId);
+-
+-	pr_info("  errorClass           = 0x%016llx\n", data->errorClass);
+-	pr_info("  correlator           = 0x%016llx\n", data->correlator);
+-
+-	pr_info("  p7iocPlssr           = 0x%016llx\n", data->p7iocPlssr);
+-	pr_info("  p7iocCsr             = 0x%016llx\n", data->p7iocCsr);
+-	pr_info("  lemFir               = 0x%016llx\n", data->lemFir);
+-	pr_info("  lemErrorMask         = 0x%016llx\n", data->lemErrorMask);
+-	pr_info("  lemWOF               = 0x%016llx\n", data->lemWOF);
+-	pr_info("  phbErrorStatus       = 0x%016llx\n", data->phbErrorStatus);
+-	pr_info("  phbFirstErrorStatus  = 0x%016llx\n", data->phbFirstErrorStatus);
+-	pr_info("  phbErrorLog0         = 0x%016llx\n", data->phbErrorLog0);
+-	pr_info("  phbErrorLog1         = 0x%016llx\n", data->phbErrorLog1);
+-	pr_info("  mmioErrorStatus      = 0x%016llx\n", data->mmioErrorStatus);
+-	pr_info("  mmioFirstErrorStatus = 0x%016llx\n", data->mmioFirstErrorStatus);
+-	pr_info("  mmioErrorLog0        = 0x%016llx\n", data->mmioErrorLog0);
+-	pr_info("  mmioErrorLog1        = 0x%016llx\n", data->mmioErrorLog1);
+-	pr_info("  dma0ErrorStatus      = 0x%016llx\n", data->dma0ErrorStatus);
+-	pr_info("  dma0FirstErrorStatus = 0x%016llx\n", data->dma0FirstErrorStatus);
+-	pr_info("  dma0ErrorLog0        = 0x%016llx\n", data->dma0ErrorLog0);
+-	pr_info("  dma0ErrorLog1        = 0x%016llx\n", data->dma0ErrorLog1);
+-	pr_info("  dma1ErrorStatus      = 0x%016llx\n", data->dma1ErrorStatus);
+-	pr_info("  dma1FirstErrorStatus = 0x%016llx\n", data->dma1FirstErrorStatus);
+-	pr_info("  dma1ErrorLog0        = 0x%016llx\n", data->dma1ErrorLog0);
+-	pr_info("  dma1ErrorLog1        = 0x%016llx\n", data->dma1ErrorLog1);
++	data = (struct OpalIoP7IOCPhbErrorData *)common;
++	pr_info("P7IOC PHB#%d Diag-data (Version: %d)\n\n",
++		hose->global_number, common->version);
++
++	if (data->brdgCtl)
++		pr_info("  brdgCtl:     %08x\n",
++			data->brdgCtl);
++	if (data->portStatusReg || data->rootCmplxStatus ||
++	    data->busAgentStatus)
++		pr_info("  UtlSts:      %08x %08x %08x\n",
++			data->portStatusReg, data->rootCmplxStatus,
++			data->busAgentStatus);
++	if (data->deviceStatus || data->slotStatus   ||
++	    data->linkStatus   || data->devCmdStatus ||
++	    data->devSecStatus)
++		pr_info("  RootSts:     %08x %08x %08x %08x %08x\n",
++			data->deviceStatus, data->slotStatus,
++			data->linkStatus, data->devCmdStatus,
++			data->devSecStatus);
++	if (data->rootErrorStatus   || data->uncorrErrorStatus ||
++	    data->corrErrorStatus)
++		pr_info("  RootErrSts:  %08x %08x %08x\n",
++			data->rootErrorStatus, data->uncorrErrorStatus,
++			data->corrErrorStatus);
++	if (data->tlpHdr1 || data->tlpHdr2 ||
++	    data->tlpHdr3 || data->tlpHdr4)
++		pr_info("  RootErrLog:  %08x %08x %08x %08x\n",
++			data->tlpHdr1, data->tlpHdr2,
++			data->tlpHdr3, data->tlpHdr4);
++	if (data->sourceId || data->errorClass ||
++	    data->correlator)
++		pr_info("  RootErrLog1: %08x %016llx %016llx\n",
++			data->sourceId, data->errorClass,
++			data->correlator);
++	if (data->p7iocPlssr || data->p7iocCsr)
++		pr_info("  PhbSts:      %016llx %016llx\n",
++			data->p7iocPlssr, data->p7iocCsr);
++	if (data->lemFir || data->lemErrorMask ||
++	    data->lemWOF)
++		pr_info("  Lem:         %016llx %016llx %016llx\n",
++			data->lemFir, data->lemErrorMask,
++			data->lemWOF);
++	if (data->phbErrorStatus || data->phbFirstErrorStatus ||
++	    data->phbErrorLog0   || data->phbErrorLog1)
++		pr_info("  PhbErr:      %016llx %016llx %016llx %016llx\n",
++			data->phbErrorStatus, data->phbFirstErrorStatus,
++			data->phbErrorLog0, data->phbErrorLog1);
++	if (data->mmioErrorStatus || data->mmioFirstErrorStatus ||
++	    data->mmioErrorLog0   || data->mmioErrorLog1)
++		pr_info("  OutErr:      %016llx %016llx %016llx %016llx\n",
++			data->mmioErrorStatus, data->mmioFirstErrorStatus,
++			data->mmioErrorLog0, data->mmioErrorLog1);
++	if (data->dma0ErrorStatus || data->dma0FirstErrorStatus ||
++	    data->dma0ErrorLog0   || data->dma0ErrorLog1)
++		pr_info("  InAErr:      %016llx %016llx %016llx %016llx\n",
++			data->dma0ErrorStatus, data->dma0FirstErrorStatus,
++			data->dma0ErrorLog0, data->dma0ErrorLog1);
++	if (data->dma1ErrorStatus || data->dma1FirstErrorStatus ||
++	    data->dma1ErrorLog0   || data->dma1ErrorLog1)
++		pr_info("  InBErr:      %016llx %016llx %016llx %016llx\n",
++			data->dma1ErrorStatus, data->dma1FirstErrorStatus,
++			data->dma1ErrorLog0, data->dma1ErrorLog1);
+ 
+ 	for (i = 0; i < OPAL_P7IOC_NUM_PEST_REGS; i++) {
+ 		if ((data->pestA[i] >> 63) == 0 &&
+ 		    (data->pestB[i] >> 63) == 0)
+ 			continue;
+-		pr_info("  PE[%3d] PESTA        = 0x%016llx\n", i, data->pestA[i]);
+-		pr_info("          PESTB        = 0x%016llx\n", data->pestB[i]);
++
++		pr_info("  PE[%3d] A/B: %016llx %016llx\n",
++			i, data->pestA[i], data->pestB[i]);
+ 	}
+ }
+ 
+-static void pnv_pci_dump_phb_diag_data(struct pnv_phb *phb)
++static void pnv_pci_dump_phb3_diag_data(struct pci_controller *hose,
++					struct OpalIoPhbErrorCommon *common)
+ {
+-	switch(phb->model) {
+-	case PNV_PHB_MODEL_P7IOC:
+-		pnv_pci_dump_p7ioc_diag_data(phb);
++	struct OpalIoPhb3ErrorData *data;
++	int i;
++
++	data = (struct OpalIoPhb3ErrorData*)common;
++	pr_info("PHB3 PHB#%d Diag-data (Version: %d)\n\n",
++		hose->global_number, common->version);
++	if (data->brdgCtl)
++		pr_info("  brdgCtl:     %08x\n",
++			data->brdgCtl);
++	if (data->portStatusReg || data->rootCmplxStatus ||
++	    data->busAgentStatus)
++		pr_info("  UtlSts:      %08x %08x %08x\n",
++			data->portStatusReg, data->rootCmplxStatus,
++			data->busAgentStatus);
++	if (data->deviceStatus || data->slotStatus   ||
++	    data->linkStatus   || data->devCmdStatus ||
++	    data->devSecStatus)
++		pr_info("  RootSts:     %08x %08x %08x %08x %08x\n",
++			data->deviceStatus, data->slotStatus,
++			data->linkStatus, data->devCmdStatus,
++			data->devSecStatus);
++	if (data->rootErrorStatus || data->uncorrErrorStatus ||
++	    data->corrErrorStatus)
++		pr_info("  RootErrSts:  %08x %08x %08x\n",
++			data->rootErrorStatus, data->uncorrErrorStatus,
++			data->corrErrorStatus);
++	if (data->tlpHdr1 || data->tlpHdr2 ||
++	    data->tlpHdr3 || data->tlpHdr4)
++		pr_info("  RootErrLog:  %08x %08x %08x %08x\n",
++			data->tlpHdr1, data->tlpHdr2,
++			data->tlpHdr3, data->tlpHdr4);
++	if (data->sourceId || data->errorClass ||
++	    data->correlator)
++		pr_info("  RootErrLog1: %08x %016llx %016llx\n",
++			data->sourceId, data->errorClass,
++			data->correlator);
++	if (data->nFir || data->nFirMask ||
++	    data->nFirWOF)
++		pr_info("  nFir:        %016llx %016llx %016llx\n",
++			data->nFir, data->nFirMask,
++			data->nFirWOF);
++	if (data->phbPlssr || data->phbCsr)
++		pr_info("  PhbSts:      %016llx %016llx\n",
++			data->phbPlssr, data->phbCsr);
++	if (data->lemFir || data->lemErrorMask ||
++	    data->lemWOF)
++		pr_info("  Lem:         %016llx %016llx %016llx\n",
++			data->lemFir, data->lemErrorMask,
++			data->lemWOF);
++	if (data->phbErrorStatus || data->phbFirstErrorStatus ||
++	    data->phbErrorLog0   || data->phbErrorLog1)
++		pr_info("  PhbErr:      %016llx %016llx %016llx %016llx\n",
++			data->phbErrorStatus, data->phbFirstErrorStatus,
++			data->phbErrorLog0, data->phbErrorLog1);
++	if (data->mmioErrorStatus || data->mmioFirstErrorStatus ||
++	    data->mmioErrorLog0   || data->mmioErrorLog1)
++		pr_info("  OutErr:      %016llx %016llx %016llx %016llx\n",
++			data->mmioErrorStatus, data->mmioFirstErrorStatus,
++			data->mmioErrorLog0, data->mmioErrorLog1);
++	if (data->dma0ErrorStatus || data->dma0FirstErrorStatus ||
++	    data->dma0ErrorLog0   || data->dma0ErrorLog1)
++		pr_info("  InAErr:      %016llx %016llx %016llx %016llx\n",
++			data->dma0ErrorStatus, data->dma0FirstErrorStatus,
++			data->dma0ErrorLog0, data->dma0ErrorLog1);
++	if (data->dma1ErrorStatus || data->dma1FirstErrorStatus ||
++	    data->dma1ErrorLog0   || data->dma1ErrorLog1)
++		pr_info("  InBErr:      %016llx %016llx %016llx %016llx\n",
++			data->dma1ErrorStatus, data->dma1FirstErrorStatus,
++			data->dma1ErrorLog0, data->dma1ErrorLog1);
++
++	for (i = 0; i < OPAL_PHB3_NUM_PEST_REGS; i++) {
++		if ((data->pestA[i] >> 63) == 0 &&
++		    (data->pestB[i] >> 63) == 0)
++			continue;
++
++		pr_info("  PE[%3d] A/B: %016llx %016llx\n",
++			i, data->pestA[i], data->pestB[i]);
++	}
++}
++
++void pnv_pci_dump_phb_diag_data(struct pci_controller *hose,
++				unsigned char *log_buff)
++{
++	struct OpalIoPhbErrorCommon *common;
++
++	if (!hose || !log_buff)
++		return;
++
++	common = (struct OpalIoPhbErrorCommon *)log_buff;
++	switch (common->ioType) {
++	case OPAL_PHB_ERROR_DATA_TYPE_P7IOC:
++		pnv_pci_dump_p7ioc_diag_data(hose, common);
++		break;
++	case OPAL_PHB_ERROR_DATA_TYPE_PHB3:
++		pnv_pci_dump_phb3_diag_data(hose, common);
+ 		break;
+ 	default:
+-		pr_warning("PCI %d: Can't decode this PHB diag data\n",
+-			   phb->hose->global_number);
++		pr_warn("%s: Unrecognized ioType %d\n",
++			__func__, common->ioType);
+ 	}
+ }
+ 
+@@ -222,7 +332,7 @@ static void pnv_pci_handle_eeh_config(struct pnv_phb *phb, u32 pe_no)
+ 		 * with the normal errors generated when probing empty slots
+ 		 */
+ 		if (has_diag)
+-			pnv_pci_dump_phb_diag_data(phb);
++			pnv_pci_dump_phb_diag_data(phb->hose, phb->diag.blob);
+ 		else
+ 			pr_warning("PCI %d: No diag data available\n",
+ 				   phb->hose->global_number);
+diff --git a/arch/powerpc/platforms/powernv/pci.h b/arch/powerpc/platforms/powernv/pci.h
+index 1ed8d5f40f5a..9365ace1b8a3 100644
+--- a/arch/powerpc/platforms/powernv/pci.h
++++ b/arch/powerpc/platforms/powernv/pci.h
+@@ -177,6 +177,7 @@ struct pnv_phb {
+ 		unsigned char			blob[PNV_PCI_DIAG_BUF_SIZE];
+ 		struct OpalIoP7IOCPhbErrorData	p7ioc;
+ 		struct OpalIoP7IOCErrorData 	hub_diag;
++		struct OpalIoPhb3ErrorData	phb3;
+ 	} diag;
+ 
+ };
+@@ -186,6 +187,8 @@ extern struct pci_ops pnv_pci_ops;
+ extern struct pnv_eeh_ops ioda_eeh_ops;
+ #endif
+ 
++void pnv_pci_dump_phb_diag_data(struct pci_controller *hose,
++				unsigned char *log_buff);
+ int pnv_pci_cfg_read(struct device_node *dn,
+ 		     int where, int size, u32 *val);
+ int pnv_pci_cfg_write(struct device_node *dn,
+diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
+index 40772ef0f2b1..e50425d0f5f7 100644
+--- a/arch/x86/kvm/mmu.c
++++ b/arch/x86/kvm/mmu.c
+@@ -2659,6 +2659,9 @@ static int __direct_map(struct kvm_vcpu *vcpu, gpa_t v, int write,
+ 	int emulate = 0;
+ 	gfn_t pseudo_gfn;
+ 
++	if (!VALID_PAGE(vcpu->arch.mmu.root_hpa))
++		return 0;
++
+ 	for_each_shadow_entry(vcpu, (u64)gfn << PAGE_SHIFT, iterator) {
+ 		if (iterator.level == level) {
+ 			mmu_set_spte(vcpu, iterator.sptep, ACC_ALL,
+@@ -2829,6 +2832,9 @@ static bool fast_page_fault(struct kvm_vcpu *vcpu, gva_t gva, int level,
+ 	bool ret = false;
+ 	u64 spte = 0ull;
+ 
++	if (!VALID_PAGE(vcpu->arch.mmu.root_hpa))
++		return false;
++
+ 	if (!page_fault_can_be_fast(error_code))
+ 		return false;
+ 
+@@ -3224,6 +3230,9 @@ static u64 walk_shadow_page_get_mmio_spte(struct kvm_vcpu *vcpu, u64 addr)
+ 	struct kvm_shadow_walk_iterator iterator;
+ 	u64 spte = 0ull;
+ 
++	if (!VALID_PAGE(vcpu->arch.mmu.root_hpa))
++		return spte;
++
+ 	walk_shadow_page_lockless_begin(vcpu);
+ 	for_each_shadow_entry_lockless(vcpu, addr, iterator, spte)
+ 		if (!is_shadow_present_pte(spte))
+@@ -4510,6 +4519,9 @@ int kvm_mmu_get_spte_hierarchy(struct kvm_vcpu *vcpu, u64 addr, u64 sptes[4])
+ 	u64 spte;
+ 	int nr_sptes = 0;
+ 
++	if (!VALID_PAGE(vcpu->arch.mmu.root_hpa))
++		return nr_sptes;
++
+ 	walk_shadow_page_lockless_begin(vcpu);
+ 	for_each_shadow_entry_lockless(vcpu, addr, iterator, spte) {
+ 		sptes[iterator.level-1] = spte;
+diff --git a/arch/x86/kvm/paging_tmpl.h b/arch/x86/kvm/paging_tmpl.h
+index ad75d77999d0..cba218a2f08d 100644
+--- a/arch/x86/kvm/paging_tmpl.h
++++ b/arch/x86/kvm/paging_tmpl.h
+@@ -569,6 +569,9 @@ static int FNAME(fetch)(struct kvm_vcpu *vcpu, gva_t addr,
+ 	if (FNAME(gpte_changed)(vcpu, gw, top_level))
+ 		goto out_gpte_changed;
+ 
++	if (!VALID_PAGE(vcpu->arch.mmu.root_hpa))
++		goto out_gpte_changed;
++
+ 	for (shadow_walk_init(&it, vcpu, addr);
+ 	     shadow_walk_okay(&it) && it.level > gw->level;
+ 	     shadow_walk_next(&it)) {
+@@ -820,6 +823,11 @@ static void FNAME(invlpg)(struct kvm_vcpu *vcpu, gva_t gva)
+ 	 */
+ 	mmu_topup_memory_caches(vcpu);
+ 
++	if (!VALID_PAGE(vcpu->arch.mmu.root_hpa)) {
++		WARN_ON(1);
++		return;
++	}
++
+ 	spin_lock(&vcpu->kvm->mmu_lock);
+ 	for_each_shadow_entry(vcpu, gva, iterator) {
+ 		level = iterator.level;
+diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
+index dcc4de3ee57a..31c3e8bf1b82 100644
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -7332,8 +7332,8 @@ static void vmx_free_vcpu(struct kvm_vcpu *vcpu)
+ 	struct vcpu_vmx *vmx = to_vmx(vcpu);
+ 
+ 	free_vpid(vmx);
+-	free_nested(vmx);
+ 	free_loaded_vmcs(vmx->loaded_vmcs);
++	free_nested(vmx);
+ 	kfree(vmx->guest_msrs);
+ 	kvm_vcpu_uninit(vcpu);
+ 	kmem_cache_free(kvm_vcpu_cache, vmx);
+diff --git a/arch/x86/net/bpf_jit.S b/arch/x86/net/bpf_jit.S
+index 877b9a1b2152..01495755701b 100644
+--- a/arch/x86/net/bpf_jit.S
++++ b/arch/x86/net/bpf_jit.S
+@@ -140,7 +140,7 @@ bpf_slow_path_byte_msh:
+ 	push	%r9;						\
+ 	push	SKBDATA;					\
+ /* rsi already has offset */					\
+-	mov	$SIZE,%ecx;	/* size */			\
++	mov	$SIZE,%edx;	/* size */			\
+ 	call	bpf_internal_load_pointer_neg_helper;		\
+ 	test	%rax,%rax;					\
+ 	pop	SKBDATA;					\
+diff --git a/drivers/clocksource/vf_pit_timer.c b/drivers/clocksource/vf_pit_timer.c
+index 02821b06a39e..a918bc481c52 100644
+--- a/drivers/clocksource/vf_pit_timer.c
++++ b/drivers/clocksource/vf_pit_timer.c
+@@ -54,7 +54,7 @@ static inline void pit_irq_acknowledge(void)
+ 
+ static u64 pit_read_sched_clock(void)
+ {
+-	return __raw_readl(clksrc_base + PITCVAL);
++	return ~__raw_readl(clksrc_base + PITCVAL);
+ }
+ 
+ static int __init pit_clocksource_init(unsigned long rate)
+diff --git a/drivers/gpu/drm/i915/i915_gem_stolen.c b/drivers/gpu/drm/i915/i915_gem_stolen.c
+index 61c09101ed18..4a699d26ebf3 100644
+--- a/drivers/gpu/drm/i915/i915_gem_stolen.c
++++ b/drivers/gpu/drm/i915/i915_gem_stolen.c
+@@ -201,6 +201,13 @@ int i915_gem_init_stolen(struct drm_device *dev)
+ 	struct drm_i915_private *dev_priv = dev->dev_private;
+ 	int bios_reserved = 0;
+ 
++#ifdef CONFIG_INTEL_IOMMU
++	if (intel_iommu_gfx_mapped) {
++		DRM_INFO("DMAR active, disabling use of stolen memory\n");
++		return 0;
++	}
++#endif
++
+ 	if (dev_priv->gtt.stolen_size == 0)
+ 		return 0;
+ 
+diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
+index a20917789c59..970270432303 100644
+--- a/drivers/gpu/drm/i915/i915_irq.c
++++ b/drivers/gpu/drm/i915/i915_irq.c
+@@ -2760,10 +2760,9 @@ static void ibx_irq_postinstall(struct drm_device *dev)
+ 		return;
+ 
+ 	if (HAS_PCH_IBX(dev)) {
+-		mask = SDE_GMBUS | SDE_AUX_MASK | SDE_TRANSB_FIFO_UNDER |
+-		       SDE_TRANSA_FIFO_UNDER | SDE_POISON;
++		mask = SDE_GMBUS | SDE_AUX_MASK | SDE_POISON;
+ 	} else {
+-		mask = SDE_GMBUS_CPT | SDE_AUX_MASK_CPT | SDE_ERROR_CPT;
++		mask = SDE_GMBUS_CPT | SDE_AUX_MASK_CPT;
+ 
+ 		I915_WRITE(SERR_INT, I915_READ(SERR_INT));
+ 	}
+@@ -2823,20 +2822,19 @@ static int ironlake_irq_postinstall(struct drm_device *dev)
+ 		display_mask = (DE_MASTER_IRQ_CONTROL | DE_GSE_IVB |
+ 				DE_PCH_EVENT_IVB | DE_PLANEC_FLIP_DONE_IVB |
+ 				DE_PLANEB_FLIP_DONE_IVB |
+-				DE_PLANEA_FLIP_DONE_IVB | DE_AUX_CHANNEL_A_IVB |
+-				DE_ERR_INT_IVB);
++				DE_PLANEA_FLIP_DONE_IVB | DE_AUX_CHANNEL_A_IVB);
+ 		extra_mask = (DE_PIPEC_VBLANK_IVB | DE_PIPEB_VBLANK_IVB |
+-			      DE_PIPEA_VBLANK_IVB);
++			      DE_PIPEA_VBLANK_IVB | DE_ERR_INT_IVB);
+ 
+ 		I915_WRITE(GEN7_ERR_INT, I915_READ(GEN7_ERR_INT));
+ 	} else {
+ 		display_mask = (DE_MASTER_IRQ_CONTROL | DE_GSE | DE_PCH_EVENT |
+ 				DE_PLANEA_FLIP_DONE | DE_PLANEB_FLIP_DONE |
+ 				DE_AUX_CHANNEL_A |
+-				DE_PIPEB_FIFO_UNDERRUN | DE_PIPEA_FIFO_UNDERRUN |
+ 				DE_PIPEB_CRC_DONE | DE_PIPEA_CRC_DONE |
+ 				DE_POISON);
+-		extra_mask = DE_PIPEA_VBLANK | DE_PIPEB_VBLANK | DE_PCU_EVENT;
++		extra_mask = DE_PIPEA_VBLANK | DE_PIPEB_VBLANK | DE_PCU_EVENT |
++				DE_PIPEB_FIFO_UNDERRUN | DE_PIPEA_FIFO_UNDERRUN;
+ 	}
+ 
+ 	dev_priv->irq_mask = ~display_mask;
+@@ -2952,9 +2950,9 @@ static void gen8_de_irq_postinstall(struct drm_i915_private *dev_priv)
+ 	struct drm_device *dev = dev_priv->dev;
+ 	uint32_t de_pipe_masked = GEN8_PIPE_FLIP_DONE |
+ 		GEN8_PIPE_CDCLK_CRC_DONE |
+-		GEN8_PIPE_FIFO_UNDERRUN |
+ 		GEN8_DE_PIPE_IRQ_FAULT_ERRORS;
+-	uint32_t de_pipe_enables = de_pipe_masked | GEN8_PIPE_VBLANK;
++	uint32_t de_pipe_enables = de_pipe_masked | GEN8_PIPE_VBLANK |
++		GEN8_PIPE_FIFO_UNDERRUN;
+ 	int pipe;
+ 	dev_priv->de_irq_mask[PIPE_A] = ~de_pipe_masked;
+ 	dev_priv->de_irq_mask[PIPE_B] = ~de_pipe_masked;
+diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
+index 3e1b348de244..6b50a14449a3 100644
+--- a/drivers/gpu/drm/i915/intel_dp.c
++++ b/drivers/gpu/drm/i915/intel_dp.c
+@@ -1634,7 +1634,7 @@ static void intel_edp_psr_enable_source(struct intel_dp *intel_dp)
+ 		val |= EDP_PSR_LINK_DISABLE;
+ 
+ 	I915_WRITE(EDP_PSR_CTL(dev), val |
+-		   IS_BROADWELL(dev) ? 0 : link_entry_time |
++		   (IS_BROADWELL(dev) ? 0 : link_entry_time) |
+ 		   max_sleep_time << EDP_PSR_MAX_SLEEP_TIME_SHIFT |
+ 		   idle_frames << EDP_PSR_IDLE_FRAME_SHIFT |
+ 		   EDP_PSR_ENABLE);
+diff --git a/drivers/hid/hidraw.c b/drivers/hid/hidraw.c
+index 6a6dd5cd7833..d0a0034d1734 100644
+--- a/drivers/hid/hidraw.c
++++ b/drivers/hid/hidraw.c
+@@ -313,13 +313,13 @@ static void drop_ref(struct hidraw *hidraw, int exists_bit)
+ 			hid_hw_close(hidraw->hid);
+ 			wake_up_interruptible(&hidraw->wait);
+ 		}
++		device_destroy(hidraw_class,
++			       MKDEV(hidraw_major, hidraw->minor));
+ 	} else {
+ 		--hidraw->open;
+ 	}
+ 	if (!hidraw->open) {
+ 		if (!hidraw->exist) {
+-			device_destroy(hidraw_class,
+-					MKDEV(hidraw_major, hidraw->minor));
+ 			hidraw_table[hidraw->minor] = NULL;
+ 			kfree(hidraw);
+ 		} else {
+diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c
+index 597e9b8fc18d..ef1cf52f8bb9 100644
+--- a/drivers/input/mouse/elantech.c
++++ b/drivers/input/mouse/elantech.c
+@@ -486,6 +486,7 @@ static void elantech_input_sync_v4(struct psmouse *psmouse)
+ 	unsigned char *packet = psmouse->packet;
+ 
+ 	input_report_key(dev, BTN_LEFT, packet[0] & 0x01);
++	input_report_key(dev, BTN_RIGHT, packet[0] & 0x02);
+ 	input_mt_report_pointer_emulation(dev, true);
+ 	input_sync(dev);
+ }
+@@ -984,6 +985,44 @@ static int elantech_get_resolution_v4(struct psmouse *psmouse,
+ }
+ 
+ /*
++ * Advertise INPUT_PROP_BUTTONPAD for clickpads. The testing of bit 12 in
++ * fw_version for this is based on the following fw_version & caps table:
++ *
++ * Laptop-model:           fw_version:     caps:           buttons:
++ * Acer S3                 0x461f00        10, 13, 0e      clickpad
++ * Acer S7-392             0x581f01        50, 17, 0d      clickpad
++ * Acer V5-131             0x461f02        01, 16, 0c      clickpad
++ * Acer V5-551             0x461f00        ?               clickpad
++ * Asus K53SV              0x450f01        78, 15, 0c      2 hw buttons
++ * Asus G46VW              0x460f02        00, 18, 0c      2 hw buttons
++ * Asus G750JX             0x360f00        00, 16, 0c      2 hw buttons
++ * Asus UX31               0x361f00        20, 15, 0e      clickpad
++ * Asus UX32VD             0x361f02        00, 15, 0e      clickpad
++ * Avatar AVIU-145A2       0x361f00        ?               clickpad
++ * Gigabyte U2442          0x450f01        58, 17, 0c      2 hw buttons
++ * Lenovo L430             0x350f02        b9, 15, 0c      2 hw buttons (*)
++ * Samsung NF210           0x150b00        78, 14, 0a      2 hw buttons
++ * Samsung NP770Z5E        0x575f01        10, 15, 0f      clickpad
++ * Samsung NP700Z5B        0x361f06        21, 15, 0f      clickpad
++ * Samsung NP900X3E-A02    0x575f03        ?               clickpad
++ * Samsung NP-QX410        0x851b00        19, 14, 0c      clickpad
++ * Samsung RC512           0x450f00        08, 15, 0c      2 hw buttons
++ * Samsung RF710           0x450f00        ?               2 hw buttons
++ * System76 Pangolin       0x250f01        ?               2 hw buttons
++ * (*) + 3 trackpoint buttons
++ */
++static void elantech_set_buttonpad_prop(struct psmouse *psmouse)
++{
++	struct input_dev *dev = psmouse->dev;
++	struct elantech_data *etd = psmouse->private;
++
++	if (etd->fw_version & 0x001000) {
++		__set_bit(INPUT_PROP_BUTTONPAD, dev->propbit);
++		__clear_bit(BTN_RIGHT, dev->keybit);
++	}
++}
++
++/*
+  * Set the appropriate event bits for the input subsystem
+  */
+ static int elantech_set_input_params(struct psmouse *psmouse)
+@@ -1026,6 +1065,8 @@ static int elantech_set_input_params(struct psmouse *psmouse)
+ 		__set_bit(INPUT_PROP_SEMI_MT, dev->propbit);
+ 		/* fall through */
+ 	case 3:
++		if (etd->hw_version == 3)
++			elantech_set_buttonpad_prop(psmouse);
+ 		input_set_abs_params(dev, ABS_X, x_min, x_max, 0, 0);
+ 		input_set_abs_params(dev, ABS_Y, y_min, y_max, 0, 0);
+ 		if (etd->reports_pressure) {
+@@ -1047,9 +1088,7 @@ static int elantech_set_input_params(struct psmouse *psmouse)
+ 			 */
+ 			psmouse_warn(psmouse, "couldn't query resolution data.\n");
+ 		}
+-		/* v4 is clickpad, with only one button. */
+-		__set_bit(INPUT_PROP_BUTTONPAD, dev->propbit);
+-		__clear_bit(BTN_RIGHT, dev->keybit);
++		elantech_set_buttonpad_prop(psmouse);
+ 		__set_bit(BTN_TOOL_QUADTAP, dev->keybit);
+ 		/* For X to recognize me as touchpad. */
+ 		input_set_abs_params(dev, ABS_X, x_min, x_max, 0, 0);
+diff --git a/drivers/input/tablet/wacom_sys.c b/drivers/input/tablet/wacom_sys.c
+index 867e7c33ac55..b16ebef5b911 100644
+--- a/drivers/input/tablet/wacom_sys.c
++++ b/drivers/input/tablet/wacom_sys.c
+@@ -304,7 +304,7 @@ static int wacom_parse_hid(struct usb_interface *intf,
+ 	struct usb_device *dev = interface_to_usbdev(intf);
+ 	char limit = 0;
+ 	/* result has to be defined as int for some devices */
+-	int result = 0;
++	int result = 0, touch_max = 0;
+ 	int i = 0, usage = WCM_UNDEFINED, finger = 0, pen = 0;
+ 	unsigned char *report;
+ 
+@@ -351,7 +351,8 @@ static int wacom_parse_hid(struct usb_interface *intf,
+ 				if (usage == WCM_DESKTOP) {
+ 					if (finger) {
+ 						features->device_type = BTN_TOOL_FINGER;
+-
++						/* touch device at least supports one touch point */
++						touch_max = 1;
+ 						switch (features->type) {
+ 						case TABLETPC2FG:
+ 							features->pktlen = WACOM_PKGLEN_TPC2FG;
+@@ -504,6 +505,8 @@ static int wacom_parse_hid(struct usb_interface *intf,
+ 	}
+ 
+  out:
++	if (!features->touch_max && touch_max)
++		features->touch_max = touch_max;
+ 	result = 0;
+ 	kfree(report);
+ 	return result;
+@@ -1194,12 +1197,15 @@ static void wacom_wireless_work(struct work_struct *work)
+ 		wacom_wac1->features.device_type = BTN_TOOL_PEN;
+ 		snprintf(wacom_wac1->name, WACOM_NAME_MAX, "%s (WL) Pen",
+ 			 wacom_wac1->features.name);
++		wacom_wac1->shared->touch_max = wacom_wac1->features.touch_max;
++		wacom_wac1->shared->type = wacom_wac1->features.type;
+ 		error = wacom_register_input(wacom1);
+ 		if (error)
+ 			goto fail;
+ 
+ 		/* Touch interface */
+-		if (wacom_wac1->features.touch_max) {
++		if (wacom_wac1->features.touch_max ||
++		    wacom_wac1->features.type == INTUOSHT) {
+ 			wacom_wac2->features =
+ 				*((struct wacom_features *)id->driver_info);
+ 			wacom_wac2->features.pktlen = WACOM_PKGLEN_BBTOUCH3;
+@@ -1214,6 +1220,10 @@ static void wacom_wireless_work(struct work_struct *work)
+ 			error = wacom_register_input(wacom2);
+ 			if (error)
+ 				goto fail;
++
++			if (wacom_wac1->features.type == INTUOSHT &&
++			    wacom_wac1->features.touch_max)
++				wacom_wac->shared->touch_input = wacom_wac2->input;
+ 		}
+ 
+ 		error = wacom_initialize_battery(wacom);
+@@ -1322,7 +1332,7 @@ static int wacom_probe(struct usb_interface *intf, const struct usb_device_id *i
+ 	 * HID descriptor. If this is the touch interface (wMaxPacketSize
+ 	 * of WACOM_PKGLEN_BBTOUCH3), override the table values.
+ 	 */
+-	if (features->type >= INTUOS5S && features->type <= INTUOSPL) {
++	if (features->type >= INTUOS5S && features->type <= INTUOSHT) {
+ 		if (endpoint->wMaxPacketSize == WACOM_PKGLEN_BBTOUCH3) {
+ 			features->device_type = BTN_TOOL_FINGER;
+ 			features->pktlen = WACOM_PKGLEN_BBTOUCH3;
+@@ -1393,6 +1403,11 @@ static int wacom_probe(struct usb_interface *intf, const struct usb_device_id *i
+ 		}
+ 	}
+ 
++	if (wacom_wac->features.type == INTUOSHT && wacom_wac->features.touch_max) {
++		if (wacom_wac->features.device_type == BTN_TOOL_FINGER)
++			wacom_wac->shared->touch_input = wacom_wac->input;
++	}
++
+ 	return 0;
+ 
+  fail5: wacom_destroy_leds(wacom);
+diff --git a/drivers/input/tablet/wacom_wac.c b/drivers/input/tablet/wacom_wac.c
+index 782c2535f1d8..4cabeaa086cd 100644
+--- a/drivers/input/tablet/wacom_wac.c
++++ b/drivers/input/tablet/wacom_wac.c
+@@ -1176,10 +1176,16 @@ static void wacom_bpt3_touch_msg(struct wacom_wac *wacom, unsigned char *data)
+ static void wacom_bpt3_button_msg(struct wacom_wac *wacom, unsigned char *data)
+ {
+ 	struct input_dev *input = wacom->input;
++	struct wacom_features *features = &wacom->features;
+ 
+-	input_report_key(input, BTN_LEFT, (data[1] & 0x08) != 0);
++	if (features->type == INTUOSHT) {
++		input_report_key(input, BTN_LEFT, (data[1] & 0x02) != 0);
++		input_report_key(input, BTN_BACK, (data[1] & 0x08) != 0);
++	} else {
++		input_report_key(input, BTN_BACK, (data[1] & 0x02) != 0);
++		input_report_key(input, BTN_LEFT, (data[1] & 0x08) != 0);
++	}
+ 	input_report_key(input, BTN_FORWARD, (data[1] & 0x04) != 0);
+-	input_report_key(input, BTN_BACK, (data[1] & 0x02) != 0);
+ 	input_report_key(input, BTN_RIGHT, (data[1] & 0x01) != 0);
+ }
+ 
+@@ -1213,13 +1219,23 @@ static int wacom_bpt3_touch(struct wacom_wac *wacom)
+ 
+ static int wacom_bpt_pen(struct wacom_wac *wacom)
+ {
++	struct wacom_features *features = &wacom->features;
+ 	struct input_dev *input = wacom->input;
+ 	unsigned char *data = wacom->data;
+ 	int prox = 0, x = 0, y = 0, p = 0, d = 0, pen = 0, btn1 = 0, btn2 = 0;
+ 
+-	if (data[0] != 0x02)
++	if (data[0] != WACOM_REPORT_PENABLED && data[0] != WACOM_REPORT_USB)
+ 	    return 0;
+ 
++	if (data[0] == WACOM_REPORT_USB) {
++		if (features->type == INTUOSHT && features->touch_max) {
++			input_report_switch(wacom->shared->touch_input,
++					    SW_MUTE_DEVICE, data[8] & 0x40);
++			input_sync(wacom->shared->touch_input);
++		}
++		return 0;
++	}
++
+ 	prox = (data[1] & 0x20) == 0x20;
+ 
+ 	/*
+@@ -1252,8 +1268,8 @@ static int wacom_bpt_pen(struct wacom_wac *wacom)
+ 		 * touching and applying pressure; do not report negative
+ 		 * distance.
+ 		 */
+-		if (data[8] <= wacom->features.distance_max)
+-			d = wacom->features.distance_max - data[8];
++		if (data[8] <= features->distance_max)
++			d = features->distance_max - data[8];
+ 
+ 		pen = data[1] & 0x01;
+ 		btn1 = data[1] & 0x02;
+@@ -1297,13 +1313,20 @@ static int wacom_wireless_irq(struct wacom_wac *wacom, size_t len)
+ 	unsigned char *data = wacom->data;
+ 	int connected;
+ 
+-	if (len != WACOM_PKGLEN_WIRELESS || data[0] != 0x80)
++	if (len != WACOM_PKGLEN_WIRELESS || data[0] != WACOM_REPORT_WL)
+ 		return 0;
+ 
+ 	connected = data[1] & 0x01;
+ 	if (connected) {
+ 		int pid, battery;
+ 
++		if ((wacom->shared->type == INTUOSHT) &&
++				wacom->shared->touch_max) {
++			input_report_switch(wacom->shared->touch_input,
++					SW_MUTE_DEVICE, data[5] & 0x40);
++			input_sync(wacom->shared->touch_input);
++		}
++
+ 		pid = get_unaligned_be16(&data[6]);
+ 		battery = data[5] & 0x3f;
+ 		if (wacom->pid != pid) {
+@@ -1391,6 +1414,7 @@ void wacom_wac_irq(struct wacom_wac *wacom_wac, size_t len)
+ 		break;
+ 
+ 	case BAMBOO_PT:
++	case INTUOSHT:
+ 		sync = wacom_bpt_irq(wacom_wac, len);
+ 		break;
+ 
+@@ -1459,7 +1483,7 @@ void wacom_setup_device_quirks(struct wacom_features *features)
+ 
+ 	/* these device have multiple inputs */
+ 	if (features->type >= WIRELESS ||
+-	    (features->type >= INTUOS5S && features->type <= INTUOSPL) ||
++	    (features->type >= INTUOS5S && features->type <= INTUOSHT) ||
+ 	    (features->oVid && features->oPid))
+ 		features->quirks |= WACOM_QUIRK_MULTI_INPUT;
+ 
+@@ -1771,33 +1795,50 @@ int wacom_setup_input_capabilities(struct input_dev *input_dev,
+ 		__set_bit(INPUT_PROP_POINTER, input_dev->propbit);
+ 		break;
+ 
++	case INTUOSHT:
++		if (features->touch_max &&
++		    features->device_type == BTN_TOOL_FINGER) {
++			input_dev->evbit[0] |= BIT_MASK(EV_SW);
++			__set_bit(SW_MUTE_DEVICE, input_dev->swbit);
++		}
++		/* fall through */
++
+ 	case BAMBOO_PT:
+ 		__clear_bit(ABS_MISC, input_dev->absbit);
+ 
+-		__set_bit(INPUT_PROP_POINTER, input_dev->propbit);
+-
+ 		if (features->device_type == BTN_TOOL_FINGER) {
+-			unsigned int flags = INPUT_MT_POINTER;
+ 
+ 			__set_bit(BTN_LEFT, input_dev->keybit);
+ 			__set_bit(BTN_FORWARD, input_dev->keybit);
+ 			__set_bit(BTN_BACK, input_dev->keybit);
+ 			__set_bit(BTN_RIGHT, input_dev->keybit);
+ 
+-			if (features->pktlen == WACOM_PKGLEN_BBTOUCH3) {
+-				input_set_abs_params(input_dev,
++			if (features->touch_max) {
++				/* touch interface */
++				unsigned int flags = INPUT_MT_POINTER;
++
++				__set_bit(INPUT_PROP_POINTER, input_dev->propbit);
++				if (features->pktlen == WACOM_PKGLEN_BBTOUCH3) {
++					input_set_abs_params(input_dev,
+ 						     ABS_MT_TOUCH_MAJOR,
+ 						     0, features->x_max, 0, 0);
+-				input_set_abs_params(input_dev,
++					input_set_abs_params(input_dev,
+ 						     ABS_MT_TOUCH_MINOR,
+ 						     0, features->y_max, 0, 0);
++				} else {
++					__set_bit(BTN_TOOL_FINGER, input_dev->keybit);
++					__set_bit(BTN_TOOL_DOUBLETAP, input_dev->keybit);
++					flags = 0;
++				}
++				input_mt_init_slots(input_dev, features->touch_max, flags);
+ 			} else {
+-				__set_bit(BTN_TOOL_FINGER, input_dev->keybit);
+-				__set_bit(BTN_TOOL_DOUBLETAP, input_dev->keybit);
+-				flags = 0;
++				/* buttons/keys only interface */
++				__clear_bit(ABS_X, input_dev->absbit);
++				__clear_bit(ABS_Y, input_dev->absbit);
++				__clear_bit(BTN_TOUCH, input_dev->keybit);
+ 			}
+-			input_mt_init_slots(input_dev, features->touch_max, flags);
+ 		} else if (features->device_type == BTN_TOOL_PEN) {
++			__set_bit(INPUT_PROP_POINTER, input_dev->propbit);
+ 			__set_bit(BTN_TOOL_RUBBER, input_dev->keybit);
+ 			__set_bit(BTN_TOOL_PEN, input_dev->keybit);
+ 			__set_bit(BTN_STYLUS, input_dev->keybit);
+@@ -2200,6 +2241,17 @@ static const struct wacom_features wacom_features_0x300 =
+ static const struct wacom_features wacom_features_0x301 =
+ 	{ "Wacom Bamboo One M",    WACOM_PKGLEN_BBPEN,    21648, 13530, 1023,
+ 	  31, BAMBOO_PT, WACOM_INTUOS_RES, WACOM_INTUOS_RES };
++static const struct wacom_features wacom_features_0x302 =
++	{ "Wacom Intuos PT S",     WACOM_PKGLEN_BBPEN,    15200,  9500, 1023,
++	  31, INTUOSHT, WACOM_INTUOS_RES, WACOM_INTUOS_RES,
++	  .touch_max = 16 };
++static const struct wacom_features wacom_features_0x303 =
++	{ "Wacom Intuos PT M",     WACOM_PKGLEN_BBPEN,    21600, 13500, 1023,
++	  31, INTUOSHT, WACOM_INTUOS_RES, WACOM_INTUOS_RES,
++	  .touch_max = 16 };
++static const struct wacom_features wacom_features_0x30E =
++	{ "Wacom Intuos S",        WACOM_PKGLEN_BBPEN,    15200,  9500, 1023,
++	  31, INTUOSHT, WACOM_INTUOS_RES, WACOM_INTUOS_RES };
+ static const struct wacom_features wacom_features_0x6004 =
+ 	{ "ISD-V4",               WACOM_PKGLEN_GRAPHIRE,  12800,  8000,  255,
+ 	  0, TABLETPC, WACOM_INTUOS_RES, WACOM_INTUOS_RES };
+@@ -2337,6 +2389,9 @@ const struct usb_device_id wacom_ids[] = {
+ 	{ USB_DEVICE_WACOM(0x10F) },
+ 	{ USB_DEVICE_WACOM(0x300) },
+ 	{ USB_DEVICE_WACOM(0x301) },
++	{ USB_DEVICE_DETAILED(0x302, USB_CLASS_HID, 0, 0) },
++	{ USB_DEVICE_DETAILED(0x303, USB_CLASS_HID, 0, 0) },
++	{ USB_DEVICE_DETAILED(0x30E, USB_CLASS_HID, 0, 0) },
+ 	{ USB_DEVICE_WACOM(0x304) },
+ 	{ USB_DEVICE_DETAILED(0x314, USB_CLASS_HID, 0, 0) },
+ 	{ USB_DEVICE_DETAILED(0x315, USB_CLASS_HID, 0, 0) },
+diff --git a/drivers/input/tablet/wacom_wac.h b/drivers/input/tablet/wacom_wac.h
+index fd23a3790605..3600cf705fb1 100644
+--- a/drivers/input/tablet/wacom_wac.h
++++ b/drivers/input/tablet/wacom_wac.h
+@@ -54,6 +54,8 @@
+ #define WACOM_REPORT_TPCST		16
+ #define WACOM_REPORT_TPC1FGE		18
+ #define WACOM_REPORT_24HDT		1
++#define WACOM_REPORT_WL			128
++#define WACOM_REPORT_USB		192
+ 
+ /* device quirks */
+ #define WACOM_QUIRK_MULTI_INPUT		0x0001
+@@ -81,6 +83,7 @@ enum {
+ 	INTUOSPS,
+ 	INTUOSPM,
+ 	INTUOSPL,
++	INTUOSHT,
+ 	WACOM_21UX2,
+ 	WACOM_22HD,
+ 	DTK,
+@@ -129,6 +132,10 @@ struct wacom_features {
+ struct wacom_shared {
+ 	bool stylus_in_proximity;
+ 	bool touch_down;
++	/* for wireless device to access USB interfaces */
++	unsigned touch_max;
++	int type;
++	struct input_dev *touch_input;
+ };
+ 
+ struct wacom_wac {
+diff --git a/drivers/media/pci/cx18/cx18-driver.c b/drivers/media/pci/cx18/cx18-driver.c
+index c1f8cc6f14b2..716bdc57fac6 100644
+--- a/drivers/media/pci/cx18/cx18-driver.c
++++ b/drivers/media/pci/cx18/cx18-driver.c
+@@ -327,13 +327,16 @@ void cx18_read_eeprom(struct cx18 *cx, struct tveeprom *tv)
+ 	struct i2c_client *c;
+ 	u8 eedata[256];
+ 
++	memset(tv, 0, sizeof(*tv));
++
+ 	c = kzalloc(sizeof(*c), GFP_KERNEL);
++	if (!c)
++		return;
+ 
+ 	strlcpy(c->name, "cx18 tveeprom tmp", sizeof(c->name));
+ 	c->adapter = &cx->i2c_adap[0];
+ 	c->addr = 0xa0 >> 1;
+ 
+-	memset(tv, 0, sizeof(*tv));
+ 	if (tveeprom_read(c, eedata, sizeof(eedata)))
+ 		goto ret;
+ 
+diff --git a/drivers/media/usb/dvb-usb/cxusb.c b/drivers/media/usb/dvb-usb/cxusb.c
+index 20e345d9fe8f..a1c641e18362 100644
+--- a/drivers/media/usb/dvb-usb/cxusb.c
++++ b/drivers/media/usb/dvb-usb/cxusb.c
+@@ -149,6 +149,7 @@ static int cxusb_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[],
+ 			  int num)
+ {
+ 	struct dvb_usb_device *d = i2c_get_adapdata(adap);
++	int ret;
+ 	int i;
+ 
+ 	if (mutex_lock_interruptible(&d->i2c_mutex) < 0)
+@@ -173,7 +174,8 @@ static int cxusb_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[],
+ 			if (1 + msg[i].len > sizeof(ibuf)) {
+ 				warn("i2c rd: len=%d is too big!\n",
+ 				     msg[i].len);
+-				return -EOPNOTSUPP;
++				ret = -EOPNOTSUPP;
++				goto unlock;
+ 			}
+ 			obuf[0] = 0;
+ 			obuf[1] = msg[i].len;
+@@ -193,12 +195,14 @@ static int cxusb_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[],
+ 			if (3 + msg[i].len > sizeof(obuf)) {
+ 				warn("i2c wr: len=%d is too big!\n",
+ 				     msg[i].len);
+-				return -EOPNOTSUPP;
++				ret = -EOPNOTSUPP;
++				goto unlock;
+ 			}
+ 			if (1 + msg[i + 1].len > sizeof(ibuf)) {
+ 				warn("i2c rd: len=%d is too big!\n",
+ 				     msg[i + 1].len);
+-				return -EOPNOTSUPP;
++				ret = -EOPNOTSUPP;
++				goto unlock;
+ 			}
+ 			obuf[0] = msg[i].len;
+ 			obuf[1] = msg[i+1].len;
+@@ -223,7 +227,8 @@ static int cxusb_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[],
+ 			if (2 + msg[i].len > sizeof(obuf)) {
+ 				warn("i2c wr: len=%d is too big!\n",
+ 				     msg[i].len);
+-				return -EOPNOTSUPP;
++				ret = -EOPNOTSUPP;
++				goto unlock;
+ 			}
+ 			obuf[0] = msg[i].addr;
+ 			obuf[1] = msg[i].len;
+@@ -237,8 +242,14 @@ static int cxusb_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[],
+ 		}
+ 	}
+ 
++	if (i == num)
++		ret = num;
++	else
++		ret = -EREMOTEIO;
++
++unlock:
+ 	mutex_unlock(&d->i2c_mutex);
+-	return i == num ? num : -EREMOTEIO;
++	return ret;
+ }
+ 
+ static u32 cxusb_i2c_func(struct i2c_adapter *adapter)
+diff --git a/drivers/media/usb/dvb-usb/dw2102.c b/drivers/media/usb/dvb-usb/dw2102.c
+index c1a63b2a6baa..f272ed86d467 100644
+--- a/drivers/media/usb/dvb-usb/dw2102.c
++++ b/drivers/media/usb/dvb-usb/dw2102.c
+@@ -301,6 +301,7 @@ static int dw2102_serit_i2c_transfer(struct i2c_adapter *adap,
+ static int dw2102_earda_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[], int num)
+ {
+ 	struct dvb_usb_device *d = i2c_get_adapdata(adap);
++	int ret;
+ 
+ 	if (!d)
+ 		return -ENODEV;
+@@ -316,7 +317,8 @@ static int dw2102_earda_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg ms
+ 		if (2 + msg[1].len > sizeof(ibuf)) {
+ 			warn("i2c rd: len=%d is too big!\n",
+ 			     msg[1].len);
+-			return -EOPNOTSUPP;
++			ret = -EOPNOTSUPP;
++			goto unlock;
+ 		}
+ 
+ 		obuf[0] = msg[0].addr << 1;
+@@ -340,7 +342,8 @@ static int dw2102_earda_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg ms
+ 			if (2 + msg[0].len > sizeof(obuf)) {
+ 				warn("i2c wr: len=%d is too big!\n",
+ 				     msg[1].len);
+-				return -EOPNOTSUPP;
++				ret = -EOPNOTSUPP;
++				goto unlock;
+ 			}
+ 
+ 			obuf[0] = msg[0].addr << 1;
+@@ -357,7 +360,8 @@ static int dw2102_earda_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg ms
+ 			if (2 + msg[0].len > sizeof(obuf)) {
+ 				warn("i2c wr: len=%d is too big!\n",
+ 				     msg[1].len);
+-				return -EOPNOTSUPP;
++				ret = -EOPNOTSUPP;
++				goto unlock;
+ 			}
+ 
+ 			obuf[0] = msg[0].addr << 1;
+@@ -386,15 +390,17 @@ static int dw2102_earda_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg ms
+ 
+ 		break;
+ 	}
++	ret = num;
+ 
++unlock:
+ 	mutex_unlock(&d->i2c_mutex);
+-	return num;
++	return ret;
+ }
+ 
+ static int dw2104_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[], int num)
+ {
+ 	struct dvb_usb_device *d = i2c_get_adapdata(adap);
+-	int len, i, j;
++	int len, i, j, ret;
+ 
+ 	if (!d)
+ 		return -ENODEV;
+@@ -430,7 +436,8 @@ static int dw2104_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[], i
+ 				if (2 + msg[j].len > sizeof(ibuf)) {
+ 					warn("i2c rd: len=%d is too big!\n",
+ 					     msg[j].len);
+-					return -EOPNOTSUPP;
++					ret = -EOPNOTSUPP;
++					goto unlock;
+ 				}
+ 
+ 				dw210x_op_rw(d->udev, 0xc3,
+@@ -466,7 +473,8 @@ static int dw2104_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[], i
+ 				if (2 + msg[j].len > sizeof(obuf)) {
+ 					warn("i2c wr: len=%d is too big!\n",
+ 					     msg[j].len);
+-					return -EOPNOTSUPP;
++					ret = -EOPNOTSUPP;
++					goto unlock;
+ 				}
+ 
+ 				obuf[0] = msg[j].addr << 1;
+@@ -481,15 +489,18 @@ static int dw2104_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[], i
+ 		}
+ 
+ 	}
++	ret = num;
+ 
++unlock:
+ 	mutex_unlock(&d->i2c_mutex);
+-	return num;
++	return ret;
+ }
+ 
+ static int dw3101_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[],
+ 								int num)
+ {
+ 	struct dvb_usb_device *d = i2c_get_adapdata(adap);
++	int ret;
+ 	int i;
+ 
+ 	if (!d)
+@@ -506,7 +517,8 @@ static int dw3101_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[],
+ 		if (2 + msg[1].len > sizeof(ibuf)) {
+ 			warn("i2c rd: len=%d is too big!\n",
+ 			     msg[1].len);
+-			return -EOPNOTSUPP;
++			ret = -EOPNOTSUPP;
++			goto unlock;
+ 		}
+ 		obuf[0] = msg[0].addr << 1;
+ 		obuf[1] = msg[0].len;
+@@ -530,7 +542,8 @@ static int dw3101_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[],
+ 			if (2 + msg[0].len > sizeof(obuf)) {
+ 				warn("i2c wr: len=%d is too big!\n",
+ 				     msg[0].len);
+-				return -EOPNOTSUPP;
++				ret = -EOPNOTSUPP;
++				goto unlock;
+ 			}
+ 			obuf[0] = msg[0].addr << 1;
+ 			obuf[1] = msg[0].len;
+@@ -556,9 +569,11 @@ static int dw3101_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[],
+ 				msg[i].flags == 0 ? ">>>" : "<<<");
+ 		debug_dump(msg[i].buf, msg[i].len, deb_xfer);
+ 	}
++	ret = num;
+ 
++unlock:
+ 	mutex_unlock(&d->i2c_mutex);
+-	return num;
++	return ret;
+ }
+ 
+ static int s6x0_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[],
+@@ -566,7 +581,7 @@ static int s6x0_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[],
+ {
+ 	struct dvb_usb_device *d = i2c_get_adapdata(adap);
+ 	struct usb_device *udev;
+-	int len, i, j;
++	int len, i, j, ret;
+ 
+ 	if (!d)
+ 		return -ENODEV;
+@@ -618,7 +633,8 @@ static int s6x0_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[],
+ 				if (msg[j].len > sizeof(ibuf)) {
+ 					warn("i2c rd: len=%d is too big!\n",
+ 					     msg[j].len);
+-					return -EOPNOTSUPP;
++					ret = -EOPNOTSUPP;
++					goto unlock;
+ 				}
+ 
+ 				dw210x_op_rw(d->udev, 0x91, 0, 0,
+@@ -652,7 +668,8 @@ static int s6x0_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[],
+ 				if (2 + msg[j].len > sizeof(obuf)) {
+ 					warn("i2c wr: len=%d is too big!\n",
+ 					     msg[j].len);
+-					return -EOPNOTSUPP;
++					ret = -EOPNOTSUPP;
++					goto unlock;
+ 				}
+ 
+ 				obuf[0] = msg[j + 1].len;
+@@ -671,7 +688,8 @@ static int s6x0_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[],
+ 				if (2 + msg[j].len > sizeof(obuf)) {
+ 					warn("i2c wr: len=%d is too big!\n",
+ 					     msg[j].len);
+-					return -EOPNOTSUPP;
++					ret = -EOPNOTSUPP;
++					goto unlock;
+ 				}
+ 				obuf[0] = msg[j].len + 1;
+ 				obuf[1] = (msg[j].addr << 1);
+@@ -685,9 +703,11 @@ static int s6x0_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[],
+ 		}
+ 		}
+ 	}
++	ret = num;
+ 
++unlock:
+ 	mutex_unlock(&d->i2c_mutex);
+-	return num;
++	return ret;
+ }
+ 
+ static int su3000_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[],
+diff --git a/drivers/mmc/card/queue.c b/drivers/mmc/card/queue.c
+index 357bbc54fe4b..3e049c13429c 100644
+--- a/drivers/mmc/card/queue.c
++++ b/drivers/mmc/card/queue.c
+@@ -197,7 +197,7 @@ int mmc_init_queue(struct mmc_queue *mq, struct mmc_card *card,
+ 	struct mmc_queue_req *mqrq_prev = &mq->mqrq[1];
+ 
+ 	if (mmc_dev(host)->dma_mask && *mmc_dev(host)->dma_mask)
+-		limit = dma_max_pfn(mmc_dev(host)) << PAGE_SHIFT;
++		limit = (u64)dma_max_pfn(mmc_dev(host)) << PAGE_SHIFT;
+ 
+ 	mq->card = card;
+ 	mq->queue = blk_init_queue(mmc_request_fn, lock);
+diff --git a/drivers/net/ethernet/intel/e100.c b/drivers/net/ethernet/intel/e100.c
+index cbaba4442d4b..bf7a01ef9a57 100644
+--- a/drivers/net/ethernet/intel/e100.c
++++ b/drivers/net/ethernet/intel/e100.c
+@@ -3034,7 +3034,7 @@ static void __e100_shutdown(struct pci_dev *pdev, bool *enable_wake)
+ 		*enable_wake = false;
+ 	}
+ 
+-	pci_disable_device(pdev);
++	pci_clear_master(pdev);
+ }
+ 
+ static int __e100_power_off(struct pci_dev *pdev, bool wake)
+diff --git a/drivers/net/ethernet/sfc/efx.h b/drivers/net/ethernet/sfc/efx.h
+index b8235ee5d7d7..d9bf88b654ec 100644
+--- a/drivers/net/ethernet/sfc/efx.h
++++ b/drivers/net/ethernet/sfc/efx.h
+@@ -66,6 +66,9 @@ void efx_schedule_slow_fill(struct efx_rx_queue *rx_queue);
+ #define EFX_RXQ_MIN_ENT		128U
+ #define EFX_TXQ_MIN_ENT(efx)	(2 * efx_tx_max_skb_descs(efx))
+ 
++#define EFX_TXQ_MAX_ENT(efx)	(EFX_WORKAROUND_35388(efx) ? \
++				 EFX_MAX_DMAQ_SIZE / 2 : EFX_MAX_DMAQ_SIZE)
++
+ /* Filters */
+ 
+ /**
+diff --git a/drivers/net/ethernet/sfc/ethtool.c b/drivers/net/ethernet/sfc/ethtool.c
+index 1f529fa2edb1..fcfb44e1ba47 100644
+--- a/drivers/net/ethernet/sfc/ethtool.c
++++ b/drivers/net/ethernet/sfc/ethtool.c
+@@ -583,7 +583,7 @@ static void efx_ethtool_get_ringparam(struct net_device *net_dev,
+ 	struct efx_nic *efx = netdev_priv(net_dev);
+ 
+ 	ring->rx_max_pending = EFX_MAX_DMAQ_SIZE;
+-	ring->tx_max_pending = EFX_MAX_DMAQ_SIZE;
++	ring->tx_max_pending = EFX_TXQ_MAX_ENT(efx);
+ 	ring->rx_pending = efx->rxq_entries;
+ 	ring->tx_pending = efx->txq_entries;
+ }
+@@ -596,7 +596,7 @@ static int efx_ethtool_set_ringparam(struct net_device *net_dev,
+ 
+ 	if (ring->rx_mini_pending || ring->rx_jumbo_pending ||
+ 	    ring->rx_pending > EFX_MAX_DMAQ_SIZE ||
+-	    ring->tx_pending > EFX_MAX_DMAQ_SIZE)
++	    ring->tx_pending > EFX_TXQ_MAX_ENT(efx))
+ 		return -EINVAL;
+ 
+ 	if (ring->rx_pending < EFX_RXQ_MIN_ENT) {
+diff --git a/drivers/net/ethernet/ti/davinci_emac.c b/drivers/net/ethernet/ti/davinci_emac.c
+index cd9b164a0434..251430450005 100644
+--- a/drivers/net/ethernet/ti/davinci_emac.c
++++ b/drivers/net/ethernet/ti/davinci_emac.c
+@@ -1532,7 +1532,7 @@ static int emac_dev_open(struct net_device *ndev)
+ 	struct device *emac_dev = &ndev->dev;
+ 	u32 cnt;
+ 	struct resource *res;
+-	int ret;
++	int q, m, ret;
+ 	int i = 0;
+ 	int k = 0;
+ 	struct emac_priv *priv = netdev_priv(ndev);
+@@ -1567,8 +1567,7 @@ static int emac_dev_open(struct net_device *ndev)
+ 
+ 	while ((res = platform_get_resource(priv->pdev, IORESOURCE_IRQ, k))) {
+ 		for (i = res->start; i <= res->end; i++) {
+-			if (devm_request_irq(&priv->pdev->dev, i, emac_irq,
+-					     0, ndev->name, ndev))
++			if (request_irq(i, emac_irq, 0, ndev->name, ndev))
+ 				goto rollback;
+ 		}
+ 		k++;
+@@ -1641,7 +1640,15 @@ static int emac_dev_open(struct net_device *ndev)
+ 
+ rollback:
+ 
+-	dev_err(emac_dev, "DaVinci EMAC: devm_request_irq() failed");
++	dev_err(emac_dev, "DaVinci EMAC: request_irq() failed");
++
++	for (q = k; k >= 0; k--) {
++		for (m = i; m >= res->start; m--)
++			free_irq(m, ndev);
++		res = platform_get_resource(priv->pdev, IORESOURCE_IRQ, k-1);
++		m = res->end;
++	}
++
+ 	ret = -EBUSY;
+ err:
+ 	pm_runtime_put(&priv->pdev->dev);
+@@ -1659,6 +1666,9 @@ err:
+  */
+ static int emac_dev_stop(struct net_device *ndev)
+ {
++	struct resource *res;
++	int i = 0;
++	int irq_num;
+ 	struct emac_priv *priv = netdev_priv(ndev);
+ 	struct device *emac_dev = &ndev->dev;
+ 
+@@ -1674,6 +1684,13 @@ static int emac_dev_stop(struct net_device *ndev)
+ 	if (priv->phydev)
+ 		phy_disconnect(priv->phydev);
+ 
++	/* Free IRQ */
++	while ((res = platform_get_resource(priv->pdev, IORESOURCE_IRQ, i))) {
++		for (irq_num = res->start; irq_num <= res->end; irq_num++)
++			free_irq(irq_num, priv->ndev);
++		i++;
++	}
++
+ 	if (netif_msg_drv(priv))
+ 		dev_notice(emac_dev, "DaVinci EMAC: %s stopped\n", ndev->name);
+ 
+diff --git a/drivers/net/wireless/p54/txrx.c b/drivers/net/wireless/p54/txrx.c
+index f95de0d16216..1de59b0f8fa8 100644
+--- a/drivers/net/wireless/p54/txrx.c
++++ b/drivers/net/wireless/p54/txrx.c
+@@ -587,7 +587,7 @@ static void p54_rx_stats(struct p54_common *priv, struct sk_buff *skb)
+ 	chan = priv->curchan;
+ 	if (chan) {
+ 		struct survey_info *survey = &priv->survey[chan->hw_value];
+-		survey->noise = clamp_t(s8, priv->noise, -128, 127);
++		survey->noise = clamp(priv->noise, -128, 127);
+ 		survey->channel_time = priv->survey_raw.active;
+ 		survey->channel_time_tx = priv->survey_raw.tx;
+ 		survey->channel_time_busy = priv->survey_raw.tx +
+diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
+index 75dffb79ad32..7271299823b7 100644
+--- a/drivers/regulator/core.c
++++ b/drivers/regulator/core.c
+@@ -1908,8 +1908,6 @@ static int _regulator_do_disable(struct regulator_dev *rdev)
+ 
+ 	trace_regulator_disable_complete(rdev_get_name(rdev));
+ 
+-	_notifier_call_chain(rdev, REGULATOR_EVENT_DISABLE,
+-			     NULL);
+ 	return 0;
+ }
+ 
+@@ -1933,6 +1931,8 @@ static int _regulator_disable(struct regulator_dev *rdev)
+ 				rdev_err(rdev, "failed to disable\n");
+ 				return ret;
+ 			}
++			_notifier_call_chain(rdev, REGULATOR_EVENT_DISABLE,
++					NULL);
+ 		}
+ 
+ 		rdev->use_count = 0;
+@@ -1985,20 +1985,16 @@ static int _regulator_force_disable(struct regulator_dev *rdev)
+ {
+ 	int ret = 0;
+ 
+-	/* force disable */
+-	if (rdev->desc->ops->disable) {
+-		/* ah well, who wants to live forever... */
+-		ret = rdev->desc->ops->disable(rdev);
+-		if (ret < 0) {
+-			rdev_err(rdev, "failed to force disable\n");
+-			return ret;
+-		}
+-		/* notify other consumers that power has been forced off */
+-		_notifier_call_chain(rdev, REGULATOR_EVENT_FORCE_DISABLE |
+-			REGULATOR_EVENT_DISABLE, NULL);
++	ret = _regulator_do_disable(rdev);
++	if (ret < 0) {
++		rdev_err(rdev, "failed to force disable\n");
++		return ret;
+ 	}
+ 
+-	return ret;
++	_notifier_call_chain(rdev, REGULATOR_EVENT_FORCE_DISABLE |
++			REGULATOR_EVENT_DISABLE, NULL);
++
++	return 0;
+ }
+ 
+ /**
+@@ -3631,8 +3627,6 @@ int regulator_suspend_finish(void)
+ 
+ 	mutex_lock(&regulator_list_mutex);
+ 	list_for_each_entry(rdev, &regulator_list, list) {
+-		struct regulator_ops *ops = rdev->desc->ops;
+-
+ 		mutex_lock(&rdev->mutex);
+ 		if (rdev->use_count > 0  || rdev->constraints->always_on) {
+ 			error = _regulator_do_enable(rdev);
+@@ -3641,12 +3635,10 @@ int regulator_suspend_finish(void)
+ 		} else {
+ 			if (!have_full_constraints())
+ 				goto unlock;
+-			if (!ops->disable)
+-				goto unlock;
+ 			if (!_regulator_is_enabled(rdev))
+ 				goto unlock;
+ 
+-			error = ops->disable(rdev);
++			error = _regulator_do_disable(rdev);
+ 			if (error)
+ 				ret = error;
+ 		}
+@@ -3820,7 +3812,7 @@ static int __init regulator_init_complete(void)
+ 		ops = rdev->desc->ops;
+ 		c = rdev->constraints;
+ 
+-		if (!ops->disable || (c && c->always_on))
++		if (c && c->always_on)
+ 			continue;
+ 
+ 		mutex_lock(&rdev->mutex);
+@@ -3841,7 +3833,7 @@ static int __init regulator_init_complete(void)
+ 			/* We log since this may kill the system if it
+ 			 * goes wrong. */
+ 			rdev_info(rdev, "disabling\n");
+-			ret = ops->disable(rdev);
++			ret = _regulator_do_disable(rdev);
+ 			if (ret != 0) {
+ 				rdev_err(rdev, "couldn't disable: %d\n", ret);
+ 			}
+diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
+index 7bd7f0d5f050..62ec84b42e31 100644
+--- a/drivers/scsi/scsi_lib.c
++++ b/drivers/scsi/scsi_lib.c
+@@ -1684,7 +1684,7 @@ u64 scsi_calculate_bounce_limit(struct Scsi_Host *shost)
+ 
+ 	host_dev = scsi_get_device(shost);
+ 	if (host_dev && host_dev->dma_mask)
+-		bounce_limit = dma_max_pfn(host_dev) << PAGE_SHIFT;
++		bounce_limit = (u64)dma_max_pfn(host_dev) << PAGE_SHIFT;
+ 
+ 	return bounce_limit;
+ }
+diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
+index 73f5208714a4..1af67a214d33 100644
+--- a/drivers/usb/host/xhci-pci.c
++++ b/drivers/usb/host/xhci-pci.c
+@@ -142,6 +142,11 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
+ 				"QUIRK: Resetting on resume");
+ 		xhci->quirks |= XHCI_TRUST_TX_LENGTH;
+ 	}
++	if (pdev->vendor == PCI_VENDOR_ID_RENESAS &&
++			pdev->device == 0x0015 &&
++			pdev->subsystem_vendor == PCI_VENDOR_ID_SAMSUNG &&
++			pdev->subsystem_device == 0xc0cd)
++		xhci->quirks |= XHCI_RESET_ON_RESUME;
+ 	if (pdev->vendor == PCI_VENDOR_ID_VIA)
+ 		xhci->quirks |= XHCI_RESET_ON_RESUME;
+ }
+diff --git a/fs/nfs/internal.h b/fs/nfs/internal.h
+index fafdddac8271..b46cf5a67329 100644
+--- a/fs/nfs/internal.h
++++ b/fs/nfs/internal.h
+@@ -176,7 +176,8 @@ extern struct nfs_server *nfs4_create_server(
+ extern struct nfs_server *nfs4_create_referral_server(struct nfs_clone_mount *,
+ 						      struct nfs_fh *);
+ extern int nfs4_update_server(struct nfs_server *server, const char *hostname,
+-					struct sockaddr *sap, size_t salen);
++					struct sockaddr *sap, size_t salen,
++					struct net *net);
+ extern void nfs_free_server(struct nfs_server *server);
+ extern struct nfs_server *nfs_clone_server(struct nfs_server *,
+ 					   struct nfs_fh *,
+diff --git a/fs/nfs/nfs4client.c b/fs/nfs/nfs4client.c
+index 4c7a4f4a4da1..cb70bdd7f320 100644
+--- a/fs/nfs/nfs4client.c
++++ b/fs/nfs/nfs4client.c
+@@ -1133,6 +1133,7 @@ static int nfs_probe_destination(struct nfs_server *server)
+  * @hostname: new end-point's hostname
+  * @sap: new end-point's socket address
+  * @salen: size of "sap"
++ * @net: net namespace
+  *
+  * The nfs_server must be quiescent before this function is invoked.
+  * Either its session is drained (NFSv4.1+), or its transport is
+@@ -1141,13 +1142,13 @@ static int nfs_probe_destination(struct nfs_server *server)
+  * Returns zero on success, or a negative errno value.
+  */
+ int nfs4_update_server(struct nfs_server *server, const char *hostname,
+-		       struct sockaddr *sap, size_t salen)
++		       struct sockaddr *sap, size_t salen, struct net *net)
+ {
+ 	struct nfs_client *clp = server->nfs_client;
+ 	struct rpc_clnt *clnt = server->client;
+ 	struct xprt_create xargs = {
+ 		.ident		= clp->cl_proto,
+-		.net		= &init_net,
++		.net		= net,
+ 		.dstaddr	= sap,
+ 		.addrlen	= salen,
+ 		.servername	= hostname,
+@@ -1187,7 +1188,7 @@ int nfs4_update_server(struct nfs_server *server, const char *hostname,
+ 	error = nfs4_set_client(server, hostname, sap, salen, buf,
+ 				clp->cl_rpcclient->cl_auth->au_flavor,
+ 				clp->cl_proto, clnt->cl_timeout,
+-				clp->cl_minorversion, clp->cl_net);
++				clp->cl_minorversion, net);
+ 	nfs_put_client(clp);
+ 	if (error != 0) {
+ 		nfs_server_insert_lists(server);
+diff --git a/fs/nfs/nfs4namespace.c b/fs/nfs/nfs4namespace.c
+index 4e7f05d3e9db..3d5dbf80d46a 100644
+--- a/fs/nfs/nfs4namespace.c
++++ b/fs/nfs/nfs4namespace.c
+@@ -121,9 +121,8 @@ static int nfs4_validate_fspath(struct dentry *dentry,
+ }
+ 
+ static size_t nfs_parse_server_name(char *string, size_t len,
+-		struct sockaddr *sa, size_t salen, struct nfs_server *server)
++		struct sockaddr *sa, size_t salen, struct net *net)
+ {
+-	struct net *net = rpc_net_ns(server->client);
+ 	ssize_t ret;
+ 
+ 	ret = rpc_pton(net, string, len, sa, salen);
+@@ -223,6 +222,7 @@ static struct vfsmount *try_location(struct nfs_clone_mount *mountdata,
+ 				     const struct nfs4_fs_location *location)
+ {
+ 	const size_t addr_bufsize = sizeof(struct sockaddr_storage);
++	struct net *net = rpc_net_ns(NFS_SB(mountdata->sb)->client);
+ 	struct vfsmount *mnt = ERR_PTR(-ENOENT);
+ 	char *mnt_path;
+ 	unsigned int maxbuflen;
+@@ -248,8 +248,7 @@ static struct vfsmount *try_location(struct nfs_clone_mount *mountdata,
+ 			continue;
+ 
+ 		mountdata->addrlen = nfs_parse_server_name(buf->data, buf->len,
+-				mountdata->addr, addr_bufsize,
+-				NFS_SB(mountdata->sb));
++				mountdata->addr, addr_bufsize, net);
+ 		if (mountdata->addrlen == 0)
+ 			continue;
+ 
+@@ -419,6 +418,7 @@ static int nfs4_try_replacing_one_location(struct nfs_server *server,
+ 		const struct nfs4_fs_location *location)
+ {
+ 	const size_t addr_bufsize = sizeof(struct sockaddr_storage);
++	struct net *net = rpc_net_ns(server->client);
+ 	struct sockaddr *sap;
+ 	unsigned int s;
+ 	size_t salen;
+@@ -440,7 +440,7 @@ static int nfs4_try_replacing_one_location(struct nfs_server *server,
+ 			continue;
+ 
+ 		salen = nfs_parse_server_name(buf->data, buf->len,
+-						sap, addr_bufsize, server);
++						sap, addr_bufsize, net);
+ 		if (salen == 0)
+ 			continue;
+ 		rpc_set_port(sap, NFS_PORT);
+@@ -450,7 +450,7 @@ static int nfs4_try_replacing_one_location(struct nfs_server *server,
+ 		if (hostname == NULL)
+ 			break;
+ 
+-		error = nfs4_update_server(server, hostname, sap, salen);
++		error = nfs4_update_server(server, hostname, sap, salen, net);
+ 		kfree(hostname);
+ 		if (error == 0)
+ 			break;
+diff --git a/fs/proc/proc_devtree.c b/fs/proc/proc_devtree.c
+index 70779b2fc209..6b85db037b92 100644
+--- a/fs/proc/proc_devtree.c
++++ b/fs/proc/proc_devtree.c
+@@ -232,6 +232,7 @@ void __init proc_device_tree_init(void)
+ 		return;
+ 	root = of_find_node_by_path("/");
+ 	if (root == NULL) {
++		remove_proc_entry("device-tree", NULL);
+ 		pr_debug("/proc/device-tree: can't find root\n");
+ 		return;
+ 	}
+diff --git a/include/linux/ceph/messenger.h b/include/linux/ceph/messenger.h
+index 7c1420bb1dce..6ade97de7a85 100644
+--- a/include/linux/ceph/messenger.h
++++ b/include/linux/ceph/messenger.h
+@@ -157,7 +157,7 @@ struct ceph_msg {
+ 	bool front_is_vmalloc;
+ 	bool more_to_follow;
+ 	bool needs_out_seq;
+-	int front_max;
++	int front_alloc_len;
+ 	unsigned long ack_stamp;        /* tx: when we were acked */
+ 
+ 	struct ceph_msgpool *pool;
+diff --git a/include/linux/ceph/osd_client.h b/include/linux/ceph/osd_client.h
+index 8f47625a0661..4fb6a8938957 100644
+--- a/include/linux/ceph/osd_client.h
++++ b/include/linux/ceph/osd_client.h
+@@ -138,6 +138,7 @@ struct ceph_osd_request {
+ 	__le64           *r_request_pool;
+ 	void             *r_request_pgid;
+ 	__le32           *r_request_attempts;
++	bool              r_paused;
+ 	struct ceph_eversion *r_request_reassert_version;
+ 
+ 	int               r_result;
+diff --git a/include/linux/ftrace_event.h b/include/linux/ftrace_event.h
+index 8c9b7a1c4138..ac17872d6c1c 100644
+--- a/include/linux/ftrace_event.h
++++ b/include/linux/ftrace_event.h
+@@ -356,10 +356,6 @@ enum {
+ 	FILTER_TRACE_FN,
+ };
+ 
+-#define EVENT_STORAGE_SIZE 128
+-extern struct mutex event_storage_mutex;
+-extern char event_storage[EVENT_STORAGE_SIZE];
+-
+ extern int trace_event_raw_init(struct ftrace_event_call *call);
+ extern int trace_define_field(struct ftrace_event_call *call, const char *type,
+ 			      const char *name, int offset, int size,
+diff --git a/include/trace/ftrace.h b/include/trace/ftrace.h
+index 5c38606613d8..40701fa1b97f 100644
+--- a/include/trace/ftrace.h
++++ b/include/trace/ftrace.h
+@@ -310,15 +310,12 @@ static struct trace_event_functions ftrace_event_type_funcs_##call = {	\
+ #undef __array
+ #define __array(type, item, len)					\
+ 	do {								\
+-		mutex_lock(&event_storage_mutex);			\
++		char *type_str = #type"["__stringify(len)"]";		\
+ 		BUILD_BUG_ON(len > MAX_FILTER_STR_VAL);			\
+-		snprintf(event_storage, sizeof(event_storage),		\
+-			 "%s[%d]", #type, len);				\
+-		ret = trace_define_field(event_call, event_storage, #item, \
++		ret = trace_define_field(event_call, type_str, #item,	\
+ 				 offsetof(typeof(field), item),		\
+ 				 sizeof(field.item),			\
+ 				 is_signed_type(type), FILTER_OTHER);	\
+-		mutex_unlock(&event_storage_mutex);			\
+ 		if (ret)						\
+ 			return ret;					\
+ 	} while (0);
+diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c
+index be7c86bae576..97fb83422c2f 100644
+--- a/kernel/printk/printk.c
++++ b/kernel/printk/printk.c
+@@ -1080,7 +1080,6 @@ static int syslog_print_all(char __user *buf, int size, bool clear)
+ 		next_seq = log_next_seq;
+ 
+ 		len = 0;
+-		prev = 0;
+ 		while (len >= 0 && seq < next_seq) {
+ 			struct printk_log *msg = log_from_idx(idx);
+ 			int textlen;
+@@ -2789,7 +2788,6 @@ bool kmsg_dump_get_buffer(struct kmsg_dumper *dumper, bool syslog,
+ 	next_idx = idx;
+ 
+ 	l = 0;
+-	prev = 0;
+ 	while (seq < dumper->next_seq) {
+ 		struct printk_log *msg = log_from_idx(idx);
+ 
+diff --git a/kernel/stop_machine.c b/kernel/stop_machine.c
+index 84571e09c907..01fbae5b97b7 100644
+--- a/kernel/stop_machine.c
++++ b/kernel/stop_machine.c
+@@ -293,7 +293,7 @@ int stop_two_cpus(unsigned int cpu1, unsigned int cpu2, cpu_stop_fn_t fn, void *
+ 	 */
+ 	smp_call_function_single(min(cpu1, cpu2),
+ 				 &irq_cpu_stop_queue_work,
+-				 &call_args, 0);
++				 &call_args, 1);
+ 	lg_local_unlock(&stop_cpus_lock);
+ 	preempt_enable();
+ 
+diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c
+index 2e58196e41c7..ba983dc41418 100644
+--- a/kernel/trace/trace_events.c
++++ b/kernel/trace/trace_events.c
+@@ -27,12 +27,6 @@
+ 
+ DEFINE_MUTEX(event_mutex);
+ 
+-DEFINE_MUTEX(event_storage_mutex);
+-EXPORT_SYMBOL_GPL(event_storage_mutex);
+-
+-char event_storage[EVENT_STORAGE_SIZE];
+-EXPORT_SYMBOL_GPL(event_storage);
+-
+ LIST_HEAD(ftrace_events);
+ static LIST_HEAD(ftrace_common_fields);
+ 
+diff --git a/kernel/trace/trace_export.c b/kernel/trace/trace_export.c
+index 7c3e3e72e2b6..ee0a5098ac43 100644
+--- a/kernel/trace/trace_export.c
++++ b/kernel/trace/trace_export.c
+@@ -95,15 +95,12 @@ static void __always_unused ____ftrace_check_##name(void)		\
+ #undef __array
+ #define __array(type, item, len)					\
+ 	do {								\
++		char *type_str = #type"["__stringify(len)"]";		\
+ 		BUILD_BUG_ON(len > MAX_FILTER_STR_VAL);			\
+-		mutex_lock(&event_storage_mutex);			\
+-		snprintf(event_storage, sizeof(event_storage),		\
+-			 "%s[%d]", #type, len);				\
+-		ret = trace_define_field(event_call, event_storage, #item, \
++		ret = trace_define_field(event_call, type_str, #item,	\
+ 				 offsetof(typeof(field), item),		\
+ 				 sizeof(field.item),			\
+ 				 is_signed_type(type), filter_type);	\
+-		mutex_unlock(&event_storage_mutex);			\
+ 		if (ret)						\
+ 			return ret;					\
+ 	} while (0);
+diff --git a/lib/fonts/Kconfig b/lib/fonts/Kconfig
+index 4dc1b990aa23..34fd931b54b5 100644
+--- a/lib/fonts/Kconfig
++++ b/lib/fonts/Kconfig
+@@ -9,7 +9,7 @@ if FONT_SUPPORT
+ 
+ config FONTS
+ 	bool "Select compiled-in fonts"
+-	depends on FRAMEBUFFER_CONSOLE
++	depends on FRAMEBUFFER_CONSOLE || STI_CONSOLE
+ 	help
+ 	  Say Y here if you would like to use fonts other than the default
+ 	  your frame buffer console usually use.
+@@ -22,7 +22,7 @@ config FONTS
+ 
+ config FONT_8x8
+ 	bool "VGA 8x8 font" if FONTS
+-	depends on FRAMEBUFFER_CONSOLE
++	depends on FRAMEBUFFER_CONSOLE || STI_CONSOLE
+ 	default y if !SPARC && !FONTS
+ 	help
+ 	  This is the "high resolution" font for the VGA frame buffer (the one
+@@ -45,7 +45,7 @@ config FONT_8x16
+ 
+ config FONT_6x11
+ 	bool "Mac console 6x11 font (not supported by all drivers)" if FONTS
+-	depends on FRAMEBUFFER_CONSOLE
++	depends on FRAMEBUFFER_CONSOLE || STI_CONSOLE
+ 	default y if !SPARC && !FONTS && MAC
+ 	help
+ 	  Small console font with Macintosh-style high-half glyphs.  Some Mac
+diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c
+index 4a5df7b1cc9f..464303f61730 100644
+--- a/net/ceph/messenger.c
++++ b/net/ceph/messenger.c
+@@ -3126,7 +3126,6 @@ struct ceph_msg *ceph_msg_new(int type, int front_len, gfp_t flags,
+ 	INIT_LIST_HEAD(&m->data);
+ 
+ 	/* front */
+-	m->front_max = front_len;
+ 	if (front_len) {
+ 		if (front_len > PAGE_CACHE_SIZE) {
+ 			m->front.iov_base = __vmalloc(front_len, flags,
+@@ -3143,7 +3142,7 @@ struct ceph_msg *ceph_msg_new(int type, int front_len, gfp_t flags,
+ 	} else {
+ 		m->front.iov_base = NULL;
+ 	}
+-	m->front.iov_len = front_len;
++	m->front_alloc_len = m->front.iov_len = front_len;
+ 
+ 	dout("ceph_msg_new %p front %d\n", m, front_len);
+ 	return m;
+@@ -3301,8 +3300,8 @@ EXPORT_SYMBOL(ceph_msg_last_put);
+ 
+ void ceph_msg_dump(struct ceph_msg *msg)
+ {
+-	pr_debug("msg_dump %p (front_max %d length %zd)\n", msg,
+-		 msg->front_max, msg->data_length);
++	pr_debug("msg_dump %p (front_alloc_len %d length %zd)\n", msg,
++		 msg->front_alloc_len, msg->data_length);
+ 	print_hex_dump(KERN_DEBUG, "header: ",
+ 		       DUMP_PREFIX_OFFSET, 16, 1,
+ 		       &msg->hdr, sizeof(msg->hdr), true);
+diff --git a/net/ceph/mon_client.c b/net/ceph/mon_client.c
+index 1fe25cd29d0e..2ac9ef35110b 100644
+--- a/net/ceph/mon_client.c
++++ b/net/ceph/mon_client.c
+@@ -152,7 +152,7 @@ static int __open_session(struct ceph_mon_client *monc)
+ 		/* initiatiate authentication handshake */
+ 		ret = ceph_auth_build_hello(monc->auth,
+ 					    monc->m_auth->front.iov_base,
+-					    monc->m_auth->front_max);
++					    monc->m_auth->front_alloc_len);
+ 		__send_prepared_auth_request(monc, ret);
+ 	} else {
+ 		dout("open_session mon%d already open\n", monc->cur_mon);
+@@ -196,7 +196,7 @@ static void __send_subscribe(struct ceph_mon_client *monc)
+ 		int num;
+ 
+ 		p = msg->front.iov_base;
+-		end = p + msg->front_max;
++		end = p + msg->front_alloc_len;
+ 
+ 		num = 1 + !!monc->want_next_osdmap + !!monc->want_mdsmap;
+ 		ceph_encode_32(&p, num);
+@@ -897,7 +897,7 @@ static void handle_auth_reply(struct ceph_mon_client *monc,
+ 	ret = ceph_handle_auth_reply(monc->auth, msg->front.iov_base,
+ 				     msg->front.iov_len,
+ 				     monc->m_auth->front.iov_base,
+-				     monc->m_auth->front_max);
++				     monc->m_auth->front_alloc_len);
+ 	if (ret < 0) {
+ 		monc->client->auth_err = ret;
+ 		wake_up_all(&monc->client->auth_wq);
+@@ -939,7 +939,7 @@ static int __validate_auth(struct ceph_mon_client *monc)
+ 		return 0;
+ 
+ 	ret = ceph_build_auth(monc->auth, monc->m_auth->front.iov_base,
+-			      monc->m_auth->front_max);
++			      monc->m_auth->front_alloc_len);
+ 	if (ret <= 0)
+ 		return ret; /* either an error, or no need to authenticate */
+ 	__send_prepared_auth_request(monc, ret);
+diff --git a/net/ceph/osd_client.c b/net/ceph/osd_client.c
+index 2b4b32aaa893..e6b2db68b4fa 100644
+--- a/net/ceph/osd_client.c
++++ b/net/ceph/osd_client.c
+@@ -1232,6 +1232,22 @@ void ceph_osdc_set_request_linger(struct ceph_osd_client *osdc,
+ EXPORT_SYMBOL(ceph_osdc_set_request_linger);
+ 
+ /*
++ * Returns whether a request should be blocked from being sent
++ * based on the current osdmap and osd_client settings.
++ *
++ * Caller should hold map_sem for read.
++ */
++static bool __req_should_be_paused(struct ceph_osd_client *osdc,
++				   struct ceph_osd_request *req)
++{
++	bool pauserd = ceph_osdmap_flag(osdc->osdmap, CEPH_OSDMAP_PAUSERD);
++	bool pausewr = ceph_osdmap_flag(osdc->osdmap, CEPH_OSDMAP_PAUSEWR) ||
++		ceph_osdmap_flag(osdc->osdmap, CEPH_OSDMAP_FULL);
++	return (req->r_flags & CEPH_OSD_FLAG_READ && pauserd) ||
++		(req->r_flags & CEPH_OSD_FLAG_WRITE && pausewr);
++}
++
++/*
+  * Pick an osd (the first 'up' osd in the pg), allocate the osd struct
+  * (as needed), and set the request r_osd appropriately.  If there is
+  * no up osd, set r_osd to NULL.  Move the request to the appropriate list
+@@ -1248,6 +1264,7 @@ static int __map_request(struct ceph_osd_client *osdc,
+ 	int acting[CEPH_PG_MAX_SIZE];
+ 	int o = -1, num = 0;
+ 	int err;
++	bool was_paused;
+ 
+ 	dout("map_request %p tid %lld\n", req, req->r_tid);
+ 	err = ceph_calc_ceph_pg(&pgid, req->r_oid, osdc->osdmap,
+@@ -1264,12 +1281,18 @@ static int __map_request(struct ceph_osd_client *osdc,
+ 		num = err;
+ 	}
+ 
++	was_paused = req->r_paused;
++	req->r_paused = __req_should_be_paused(osdc, req);
++	if (was_paused && !req->r_paused)
++		force_resend = 1;
++
+ 	if ((!force_resend &&
+ 	     req->r_osd && req->r_osd->o_osd == o &&
+ 	     req->r_sent >= req->r_osd->o_incarnation &&
+ 	     req->r_num_pg_osds == num &&
+ 	     memcmp(req->r_pg_osds, acting, sizeof(acting[0])*num) == 0) ||
+-	    (req->r_osd == NULL && o == -1))
++	    (req->r_osd == NULL && o == -1) ||
++	    req->r_paused)
+ 		return 0;  /* no change */
+ 
+ 	dout("map_request tid %llu pgid %lld.%x osd%d (was osd%d)\n",
+@@ -1613,14 +1636,17 @@ static void reset_changed_osds(struct ceph_osd_client *osdc)
+  *
+  * Caller should hold map_sem for read.
+  */
+-static void kick_requests(struct ceph_osd_client *osdc, int force_resend)
++static void kick_requests(struct ceph_osd_client *osdc, bool force_resend,
++			  bool force_resend_writes)
+ {
+ 	struct ceph_osd_request *req, *nreq;
+ 	struct rb_node *p;
+ 	int needmap = 0;
+ 	int err;
++	bool force_resend_req;
+ 
+-	dout("kick_requests %s\n", force_resend ? " (force resend)" : "");
++	dout("kick_requests %s %s\n", force_resend ? " (force resend)" : "",
++		force_resend_writes ? " (force resend writes)" : "");
+ 	mutex_lock(&osdc->request_mutex);
+ 	for (p = rb_first(&osdc->requests); p; ) {
+ 		req = rb_entry(p, struct ceph_osd_request, r_node);
+@@ -1645,7 +1671,10 @@ static void kick_requests(struct ceph_osd_client *osdc, int force_resend)
+ 			continue;
+ 		}
+ 
+-		err = __map_request(osdc, req, force_resend);
++		force_resend_req = force_resend ||
++			(force_resend_writes &&
++				req->r_flags & CEPH_OSD_FLAG_WRITE);
++		err = __map_request(osdc, req, force_resend_req);
+ 		if (err < 0)
+ 			continue;  /* error */
+ 		if (req->r_osd == NULL) {
+@@ -1665,7 +1694,8 @@ static void kick_requests(struct ceph_osd_client *osdc, int force_resend)
+ 				 r_linger_item) {
+ 		dout("linger req=%p req->r_osd=%p\n", req, req->r_osd);
+ 
+-		err = __map_request(osdc, req, force_resend);
++		err = __map_request(osdc, req,
++				    force_resend || force_resend_writes);
+ 		dout("__map_request returned %d\n", err);
+ 		if (err == 0)
+ 			continue;  /* no change and no osd was specified */
+@@ -1707,6 +1737,7 @@ void ceph_osdc_handle_map(struct ceph_osd_client *osdc, struct ceph_msg *msg)
+ 	struct ceph_osdmap *newmap = NULL, *oldmap;
+ 	int err;
+ 	struct ceph_fsid fsid;
++	bool was_full;
+ 
+ 	dout("handle_map have %u\n", osdc->osdmap ? osdc->osdmap->epoch : 0);
+ 	p = msg->front.iov_base;
+@@ -1720,6 +1751,8 @@ void ceph_osdc_handle_map(struct ceph_osd_client *osdc, struct ceph_msg *msg)
+ 
+ 	down_write(&osdc->map_sem);
+ 
++	was_full = ceph_osdmap_flag(osdc->osdmap, CEPH_OSDMAP_FULL);
++
+ 	/* incremental maps */
+ 	ceph_decode_32_safe(&p, end, nr_maps, bad);
+ 	dout(" %d inc maps\n", nr_maps);
+@@ -1744,7 +1777,10 @@ void ceph_osdc_handle_map(struct ceph_osd_client *osdc, struct ceph_msg *msg)
+ 				ceph_osdmap_destroy(osdc->osdmap);
+ 				osdc->osdmap = newmap;
+ 			}
+-			kick_requests(osdc, 0);
++			was_full = was_full ||
++				ceph_osdmap_flag(osdc->osdmap,
++						 CEPH_OSDMAP_FULL);
++			kick_requests(osdc, 0, was_full);
+ 		} else {
+ 			dout("ignoring incremental map %u len %d\n",
+ 			     epoch, maplen);
+@@ -1787,7 +1823,10 @@ void ceph_osdc_handle_map(struct ceph_osd_client *osdc, struct ceph_msg *msg)
+ 					skipped_map = 1;
+ 				ceph_osdmap_destroy(oldmap);
+ 			}
+-			kick_requests(osdc, skipped_map);
++			was_full = was_full ||
++				ceph_osdmap_flag(osdc->osdmap,
++						 CEPH_OSDMAP_FULL);
++			kick_requests(osdc, skipped_map, was_full);
+ 		}
+ 		p += maplen;
+ 		nr_maps--;
+@@ -1804,7 +1843,9 @@ done:
+ 	 * we find out when we are no longer full and stop returning
+ 	 * ENOSPC.
+ 	 */
+-	if (ceph_osdmap_flag(osdc->osdmap, CEPH_OSDMAP_FULL))
++	if (ceph_osdmap_flag(osdc->osdmap, CEPH_OSDMAP_FULL) ||
++		ceph_osdmap_flag(osdc->osdmap, CEPH_OSDMAP_PAUSERD) ||
++		ceph_osdmap_flag(osdc->osdmap, CEPH_OSDMAP_PAUSEWR))
+ 		ceph_monc_request_next_osdmap(&osdc->client->monc);
+ 
+ 	mutex_lock(&osdc->request_mutex);
+@@ -2454,7 +2495,7 @@ static struct ceph_msg *get_reply(struct ceph_connection *con,
+ 	struct ceph_osd_client *osdc = osd->o_osdc;
+ 	struct ceph_msg *m;
+ 	struct ceph_osd_request *req;
+-	int front = le32_to_cpu(hdr->front_len);
++	int front_len = le32_to_cpu(hdr->front_len);
+ 	int data_len = le32_to_cpu(hdr->data_len);
+ 	u64 tid;
+ 
+@@ -2474,12 +2515,13 @@ static struct ceph_msg *get_reply(struct ceph_connection *con,
+ 		     req->r_reply, req->r_reply->con);
+ 	ceph_msg_revoke_incoming(req->r_reply);
+ 
+-	if (front > req->r_reply->front.iov_len) {
++	if (front_len > req->r_reply->front_alloc_len) {
+ 		pr_warning("get_reply front %d > preallocated %d (%u#%llu)\n",
+-			   front, (int)req->r_reply->front.iov_len,
++			   front_len, req->r_reply->front_alloc_len,
+ 			   (unsigned int)con->peer_name.type,
+ 			   le64_to_cpu(con->peer_name.num));
+-		m = ceph_msg_new(CEPH_MSG_OSD_OPREPLY, front, GFP_NOFS, false);
++		m = ceph_msg_new(CEPH_MSG_OSD_OPREPLY, front_len, GFP_NOFS,
++				 false);
+ 		if (!m)
+ 			goto out;
+ 		ceph_msg_put(req->r_reply);
+diff --git a/net/sunrpc/auth_gss/auth_gss.c b/net/sunrpc/auth_gss/auth_gss.c
+index a642fd616d3a..1eebf2251b01 100644
+--- a/net/sunrpc/auth_gss/auth_gss.c
++++ b/net/sunrpc/auth_gss/auth_gss.c
+@@ -500,10 +500,12 @@ gss_alloc_msg(struct gss_auth *gss_auth,
+ 	default:
+ 		err = gss_encode_v1_msg(gss_msg, service_name, gss_auth->target_name);
+ 		if (err)
+-			goto err_free_msg;
++			goto err_put_pipe_version;
+ 	};
+ 	kref_get(&gss_auth->kref);
+ 	return gss_msg;
++err_put_pipe_version:
++	put_pipe_version(gss_auth->net);
+ err_free_msg:
+ 	kfree(gss_msg);
+ err:
+diff --git a/scripts/package/builddeb b/scripts/package/builddeb
+index 90e521fde35f..c1bb9be00fa0 100644
+--- a/scripts/package/builddeb
++++ b/scripts/package/builddeb
+@@ -41,9 +41,9 @@ create_package() {
+ 	parisc*)
+ 		debarch=hppa ;;
+ 	mips*)
+-		debarch=mips$(grep -q CPU_LITTLE_ENDIAN=y $KCONFIG_CONFIG && echo el) ;;
++		debarch=mips$(grep -q CPU_LITTLE_ENDIAN=y $KCONFIG_CONFIG && echo el || true) ;;
+ 	arm*)
+-		debarch=arm$(grep -q CONFIG_AEABI=y $KCONFIG_CONFIG && echo el) ;;
++		debarch=arm$(grep -q CONFIG_AEABI=y $KCONFIG_CONFIG && echo el || true) ;;
+ 	*)
+ 		echo "" >&2
+ 		echo "** ** **  WARNING  ** ** **" >&2
+@@ -62,7 +62,7 @@ create_package() {
+ 	fi
+ 
+ 	# Create the package
+-	dpkg-gencontrol -isp $forcearch -p$pname -P"$pdir"
++	dpkg-gencontrol -isp $forcearch -Vkernel:debarch="${debarch:-$(dpkg --print-architecture)}" -p$pname -P"$pdir"
+ 	dpkg --build "$pdir" ..
+ }
+ 
+@@ -288,15 +288,14 @@ mkdir -p "$destdir"
+ (cd $objtree; cp $KCONFIG_CONFIG $destdir/.config) # copy .config manually to be where it's expected to be
+ ln -sf "/usr/src/linux-headers-$version" "$kernel_headers_dir/lib/modules/$version/build"
+ rm -f "$objtree/debian/hdrsrcfiles" "$objtree/debian/hdrobjfiles"
+-arch=$(dpkg --print-architecture)
+ 
+ cat <<EOF >> debian/control
+ 
+ Package: $kernel_headers_packagename
+ Provides: linux-headers, linux-headers-2.6
+-Architecture: $arch
+-Description: Linux kernel headers for $KERNELRELEASE on $arch
+- This package provides kernel header files for $KERNELRELEASE on $arch
++Architecture: any
++Description: Linux kernel headers for $KERNELRELEASE on \${kernel:debarch}
++ This package provides kernel header files for $KERNELRELEASE on \${kernel:debarch}
+  .
+  This is useful for people who need to build external modules
+ EOF
+diff --git a/sound/core/compress_offload.c b/sound/core/compress_offload.c
+index 9d518ac73eea..85fde7e19dd2 100644
+--- a/sound/core/compress_offload.c
++++ b/sound/core/compress_offload.c
+@@ -133,7 +133,7 @@ static int snd_compr_open(struct inode *inode, struct file *f)
+ 		kfree(data);
+ 	}
+ 	snd_card_unref(compr->card);
+-	return 0;
++	return ret;
+ }
+ 
+ static int snd_compr_free(struct inode *inode, struct file *f)
+diff --git a/sound/soc/codecs/max98090.c b/sound/soc/codecs/max98090.c
+index 5f728808eed4..8bddf3f20a5e 100644
+--- a/sound/soc/codecs/max98090.c
++++ b/sound/soc/codecs/max98090.c
+@@ -336,6 +336,7 @@ static bool max98090_readable_register(struct device *dev, unsigned int reg)
+ 	case M98090_REG_RECORD_TDM_SLOT:
+ 	case M98090_REG_SAMPLE_RATE:
+ 	case M98090_REG_DMIC34_BIQUAD_BASE ... M98090_REG_DMIC34_BIQUAD_BASE + 0x0E:
++	case M98090_REG_REVISION_ID:
+ 		return true;
+ 	default:
+ 		return false;
+diff --git a/tools/perf/perf.h b/tools/perf/perf.h
+index b079304bd53d..1e2e5ac52248 100644
+--- a/tools/perf/perf.h
++++ b/tools/perf/perf.h
+@@ -100,8 +100,8 @@
+ 
+ #ifdef __aarch64__
+ #define mb()		asm volatile("dmb ish" ::: "memory")
+-#define wmb()		asm volatile("dmb ishld" ::: "memory")
+-#define rmb()		asm volatile("dmb ishst" ::: "memory")
++#define wmb()		asm volatile("dmb ishst" ::: "memory")
++#define rmb()		asm volatile("dmb ishld" ::: "memory")
+ #define cpu_relax()	asm volatile("yield" ::: "memory")
+ #endif
+