[gentoo-commits] proj/linux-patches:4.14 commit in: /

[Mike Pagano]

commit:     e17f9236d0c06738492d9c80accbb911c2558360
Author:     Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Sat Dec 29 18:53:52 2018 +0000
Commit:     Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Sat Dec 29 18:53:52 2018 +0000
URL:        https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=e17f9236

proj/linux-patches: Linux patch 4.14.91

Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>

 0000_README              |    4 +
 1090_linux-4.14.91.patch | 1437 ++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 1441 insertions(+)

diff --git a/0000_README b/0000_README
index dc7f560..ca6677a 100644
--- a/0000_README
+++ b/0000_README
@@ -403,6 +403,10 @@ Patch:  1089_4.14.90.patch
 From:   http://www.kernel.org
 Desc:   Linux 4.14.90
 
+Patch:  1090.14.91.patch
+From:   http://www.kernel.org
+Desc:   Linux 4.14.91
+
 Patch:  1500_XATTR_USER_PREFIX.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=470644
 Desc:   Support for namespace user.pax.* on tmpfs.

diff --git a/1090_linux-4.14.91.patch b/1090_linux-4.14.91.patch
new file mode 100644
index 0000000..90250d3
--- /dev/null
+++ b/1090_linux-4.14.91.patch
@@ -0,0 +1,1437 @@
+diff --git a/Makefile b/Makefile
+index 280c7193e246..a6fb3b158a19 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 14
+-SUBLEVEL = 90
++SUBLEVEL = 91
+ EXTRAVERSION =
+ NAME = Petit Gorille
+ 
+diff --git a/arch/x86/include/asm/msr-index.h b/arch/x86/include/asm/msr-index.h
+index 62c62d3eb0ff..fed3636dce9a 100644
+--- a/arch/x86/include/asm/msr-index.h
++++ b/arch/x86/include/asm/msr-index.h
+@@ -372,6 +372,7 @@
+ #define MSR_F15H_NB_PERF_CTR		0xc0010241
+ #define MSR_F15H_PTSC			0xc0010280
+ #define MSR_F15H_IC_CFG			0xc0011021
++#define MSR_F15H_EX_CFG			0xc001102c
+ 
+ /* Fam 10h MSRs */
+ #define MSR_FAM10H_MMIO_CONF_BASE	0xc0010058
+diff --git a/arch/x86/kernel/cpu/mtrr/if.c b/arch/x86/kernel/cpu/mtrr/if.c
+index 558444b23923..c2987daa6a6b 100644
+--- a/arch/x86/kernel/cpu/mtrr/if.c
++++ b/arch/x86/kernel/cpu/mtrr/if.c
+@@ -173,6 +173,8 @@ mtrr_ioctl(struct file *file, unsigned int cmd, unsigned long __arg)
+ 	struct mtrr_gentry gentry;
+ 	void __user *arg = (void __user *) __arg;
+ 
++	memset(&gentry, 0, sizeof(gentry));
++
+ 	switch (cmd) {
+ 	case MTRRIOC_ADD_ENTRY:
+ 	case MTRRIOC_SET_ENTRY:
+diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
+index 4353580b659a..8eec37d37c3d 100644
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -10447,6 +10447,8 @@ static void nested_get_vmcs12_pages(struct kvm_vcpu *vcpu,
+ 			kunmap(vmx->nested.pi_desc_page);
+ 			kvm_release_page_dirty(vmx->nested.pi_desc_page);
+ 			vmx->nested.pi_desc_page = NULL;
++			vmx->nested.pi_desc = NULL;
++			vmcs_write64(POSTED_INTR_DESC_ADDR, -1ull);
+ 		}
+ 		page = kvm_vcpu_gpa_to_page(vcpu, vmcs12->posted_intr_desc_addr);
+ 		if (is_error_page(page))
+diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
+index f24329659bea..ac431fa778aa 100644
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -2227,6 +2227,7 @@ int kvm_set_msr_common(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
+ 	case MSR_AMD64_PATCH_LOADER:
+ 	case MSR_AMD64_BU_CFG2:
+ 	case MSR_AMD64_DC_CFG:
++	case MSR_F15H_EX_CFG:
+ 		break;
+ 
+ 	case MSR_IA32_UCODE_REV:
+@@ -2508,6 +2509,7 @@ int kvm_get_msr_common(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
+ 	case MSR_AMD64_BU_CFG2:
+ 	case MSR_IA32_PERF_CTL:
+ 	case MSR_AMD64_DC_CFG:
++	case MSR_F15H_EX_CFG:
+ 		msr_info->data = 0;
+ 		break;
+ 	case MSR_K7_EVNTSEL0 ... MSR_K7_EVNTSEL3:
+diff --git a/block/blk-lib.c b/block/blk-lib.c
+index 2bc544ce3d2e..0bdc77888dc5 100644
+--- a/block/blk-lib.c
++++ b/block/blk-lib.c
+@@ -59,10 +59,18 @@ int __blkdev_issue_discard(struct block_device *bdev, sector_t sector,
+ 		unsigned int req_sects;
+ 		sector_t end_sect, tmp;
+ 
+-		/* Make sure bi_size doesn't overflow */
+-		req_sects = min_t(sector_t, nr_sects, UINT_MAX >> 9);
++		/*
++		 * Issue in chunks of the user defined max discard setting,
++		 * ensuring that bi_size doesn't overflow
++		 */
++		req_sects = min_t(sector_t, nr_sects,
++					q->limits.max_discard_sectors);
++		if (!req_sects)
++			goto fail;
++		if (req_sects > UINT_MAX >> 9)
++			req_sects = UINT_MAX >> 9;
+ 
+-		/**
++		/*
+ 		 * If splitting a request, and the next starting sector would be
+ 		 * misaligned, stop the discard at the previous aligned sector.
+ 		 */
+@@ -96,6 +104,14 @@ int __blkdev_issue_discard(struct block_device *bdev, sector_t sector,
+ 
+ 	*biop = bio;
+ 	return 0;
++
++fail:
++	if (bio) {
++		submit_bio_wait(bio);
++		bio_put(bio);
++	}
++	*biop = NULL;
++	return -EOPNOTSUPP;
+ }
+ EXPORT_SYMBOL(__blkdev_issue_discard);
+ 
+diff --git a/drivers/gpio/gpio-max7301.c b/drivers/gpio/gpio-max7301.c
+index 05813fbf3daf..647dfbbc4e1c 100644
+--- a/drivers/gpio/gpio-max7301.c
++++ b/drivers/gpio/gpio-max7301.c
+@@ -25,7 +25,7 @@ static int max7301_spi_write(struct device *dev, unsigned int reg,
+ 	struct spi_device *spi = to_spi_device(dev);
+ 	u16 word = ((reg & 0x7F) << 8) | (val & 0xFF);
+ 
+-	return spi_write(spi, (const u8 *)&word, sizeof(word));
++	return spi_write_then_read(spi, &word, sizeof(word), NULL, 0);
+ }
+ 
+ /* A read from the MAX7301 means two transfers; here, one message each */
+@@ -37,14 +37,8 @@ static int max7301_spi_read(struct device *dev, unsigned int reg)
+ 	struct spi_device *spi = to_spi_device(dev);
+ 
+ 	word = 0x8000 | (reg << 8);
+-	ret = spi_write(spi, (const u8 *)&word, sizeof(word));
+-	if (ret)
+-		return ret;
+-	/*
+-	 * This relies on the fact, that a transfer with NULL tx_buf shifts out
+-	 * zero bytes (=NOOP for MAX7301)
+-	 */
+-	ret = spi_read(spi, (u8 *)&word, sizeof(word));
++	ret = spi_write_then_read(spi, &word, sizeof(word), &word,
++				  sizeof(word));
+ 	if (ret)
+ 		return ret;
+ 	return word & 0xff;
+diff --git a/drivers/gpio/gpiolib-acpi.c b/drivers/gpio/gpiolib-acpi.c
+index 33d4bd505b5b..57d157e94bd6 100644
+--- a/drivers/gpio/gpiolib-acpi.c
++++ b/drivers/gpio/gpiolib-acpi.c
+@@ -23,11 +23,28 @@
+ 
+ #include "gpiolib.h"
+ 
++/**
++ * struct acpi_gpio_event - ACPI GPIO event handler data
++ *
++ * @node:	  list-entry of the events list of the struct acpi_gpio_chip
++ * @handle:	  handle of ACPI method to execute when the IRQ triggers
++ * @handler:	  irq_handler to pass to request_irq when requesting the IRQ
++ * @pin:	  GPIO pin number on the gpio_chip
++ * @irq:	  Linux IRQ number for the event, for request_ / free_irq
++ * @irqflags:     flags to pass to request_irq when requesting the IRQ
++ * @irq_is_wake:  If the ACPI flags indicate the IRQ is a wakeup source
++ * @is_requested: True if request_irq has been done
++ * @desc:	  gpio_desc for the GPIO pin for this event
++ */
+ struct acpi_gpio_event {
+ 	struct list_head node;
+ 	acpi_handle handle;
++	irq_handler_t handler;
+ 	unsigned int pin;
+ 	unsigned int irq;
++	unsigned long irqflags;
++	bool irq_is_wake;
++	bool irq_requested;
+ 	struct gpio_desc *desc;
+ };
+ 
+@@ -53,10 +70,10 @@ struct acpi_gpio_chip {
+ 
+ /*
+  * For gpiochips which call acpi_gpiochip_request_interrupts() before late_init
+- * (so builtin drivers) we register the ACPI GpioInt event handlers from a
++ * (so builtin drivers) we register the ACPI GpioInt IRQ handlers from a
+  * late_initcall_sync handler, so that other builtin drivers can register their
+  * OpRegions before the event handlers can run.  This list contains gpiochips
+- * for which the acpi_gpiochip_request_interrupts() has been deferred.
++ * for which the acpi_gpiochip_request_irqs() call has been deferred.
+  */
+ static DEFINE_MUTEX(acpi_gpio_deferred_req_irqs_lock);
+ static LIST_HEAD(acpi_gpio_deferred_req_irqs_list);
+@@ -194,8 +211,42 @@ bool acpi_gpio_get_irq_resource(struct acpi_resource *ares,
+ }
+ EXPORT_SYMBOL_GPL(acpi_gpio_get_irq_resource);
+ 
+-static acpi_status acpi_gpiochip_request_interrupt(struct acpi_resource *ares,
+-						   void *context)
++static void acpi_gpiochip_request_irq(struct acpi_gpio_chip *acpi_gpio,
++				      struct acpi_gpio_event *event)
++{
++	int ret, value;
++
++	ret = request_threaded_irq(event->irq, NULL, event->handler,
++				   event->irqflags, "ACPI:Event", event);
++	if (ret) {
++		dev_err(acpi_gpio->chip->parent,
++			"Failed to setup interrupt handler for %d\n",
++			event->irq);
++		return;
++	}
++
++	if (event->irq_is_wake)
++		enable_irq_wake(event->irq);
++
++	event->irq_requested = true;
++
++	/* Make sure we trigger the initial state of edge-triggered IRQs */
++	value = gpiod_get_raw_value_cansleep(event->desc);
++	if (((event->irqflags & IRQF_TRIGGER_RISING) && value == 1) ||
++	    ((event->irqflags & IRQF_TRIGGER_FALLING) && value == 0))
++		event->handler(event->irq, event);
++}
++
++static void acpi_gpiochip_request_irqs(struct acpi_gpio_chip *acpi_gpio)
++{
++	struct acpi_gpio_event *event;
++
++	list_for_each_entry(event, &acpi_gpio->events, node)
++		acpi_gpiochip_request_irq(acpi_gpio, event);
++}
++
++static acpi_status acpi_gpiochip_alloc_event(struct acpi_resource *ares,
++					     void *context)
+ {
+ 	struct acpi_gpio_chip *acpi_gpio = context;
+ 	struct gpio_chip *chip = acpi_gpio->chip;
+@@ -204,8 +255,7 @@ static acpi_status acpi_gpiochip_request_interrupt(struct acpi_resource *ares,
+ 	struct acpi_gpio_event *event;
+ 	irq_handler_t handler = NULL;
+ 	struct gpio_desc *desc;
+-	unsigned long irqflags;
+-	int ret, pin, irq, value;
++	int ret, pin, irq;
+ 
+ 	if (!acpi_gpio_get_irq_resource(ares, &agpio))
+ 		return AE_OK;
+@@ -240,8 +290,6 @@ static acpi_status acpi_gpiochip_request_interrupt(struct acpi_resource *ares,
+ 
+ 	gpiod_direction_input(desc);
+ 
+-	value = gpiod_get_value_cansleep(desc);
+-
+ 	ret = gpiochip_lock_as_irq(chip, pin);
+ 	if (ret) {
+ 		dev_err(chip->parent, "Failed to lock GPIO as interrupt\n");
+@@ -254,64 +302,42 @@ static acpi_status acpi_gpiochip_request_interrupt(struct acpi_resource *ares,
+ 		goto fail_unlock_irq;
+ 	}
+ 
+-	irqflags = IRQF_ONESHOT;
++	event = kzalloc(sizeof(*event), GFP_KERNEL);
++	if (!event)
++		goto fail_unlock_irq;
++
++	event->irqflags = IRQF_ONESHOT;
+ 	if (agpio->triggering == ACPI_LEVEL_SENSITIVE) {
+ 		if (agpio->polarity == ACPI_ACTIVE_HIGH)
+-			irqflags |= IRQF_TRIGGER_HIGH;
++			event->irqflags |= IRQF_TRIGGER_HIGH;
+ 		else
+-			irqflags |= IRQF_TRIGGER_LOW;
++			event->irqflags |= IRQF_TRIGGER_LOW;
+ 	} else {
+ 		switch (agpio->polarity) {
+ 		case ACPI_ACTIVE_HIGH:
+-			irqflags |= IRQF_TRIGGER_RISING;
++			event->irqflags |= IRQF_TRIGGER_RISING;
+ 			break;
+ 		case ACPI_ACTIVE_LOW:
+-			irqflags |= IRQF_TRIGGER_FALLING;
++			event->irqflags |= IRQF_TRIGGER_FALLING;
+ 			break;
+ 		default:
+-			irqflags |= IRQF_TRIGGER_RISING |
+-				    IRQF_TRIGGER_FALLING;
++			event->irqflags |= IRQF_TRIGGER_RISING |
++					   IRQF_TRIGGER_FALLING;
+ 			break;
+ 		}
+ 	}
+ 
+-	event = kzalloc(sizeof(*event), GFP_KERNEL);
+-	if (!event)
+-		goto fail_unlock_irq;
+-
+ 	event->handle = evt_handle;
++	event->handler = handler;
+ 	event->irq = irq;
++	event->irq_is_wake = agpio->wake_capable == ACPI_WAKE_CAPABLE;
+ 	event->pin = pin;
+ 	event->desc = desc;
+ 
+-	ret = request_threaded_irq(event->irq, NULL, handler, irqflags,
+-				   "ACPI:Event", event);
+-	if (ret) {
+-		dev_err(chip->parent,
+-			"Failed to setup interrupt handler for %d\n",
+-			event->irq);
+-		goto fail_free_event;
+-	}
+-
+-	if (agpio->wake_capable == ACPI_WAKE_CAPABLE)
+-		enable_irq_wake(irq);
+-
+ 	list_add_tail(&event->node, &acpi_gpio->events);
+ 
+-	/*
+-	 * Make sure we trigger the initial state of the IRQ when using RISING
+-	 * or FALLING.  Note we run the handlers on late_init, the AML code
+-	 * may refer to OperationRegions from other (builtin) drivers which
+-	 * may be probed after us.
+-	 */
+-	if (((irqflags & IRQF_TRIGGER_RISING) && value == 1) ||
+-	    ((irqflags & IRQF_TRIGGER_FALLING) && value == 0))
+-		handler(event->irq, event);
+-
+ 	return AE_OK;
+ 
+-fail_free_event:
+-	kfree(event);
+ fail_unlock_irq:
+ 	gpiochip_unlock_as_irq(chip, pin);
+ fail_free_desc:
+@@ -348,6 +374,9 @@ void acpi_gpiochip_request_interrupts(struct gpio_chip *chip)
+ 	if (ACPI_FAILURE(status))
+ 		return;
+ 
++	acpi_walk_resources(handle, "_AEI",
++			    acpi_gpiochip_alloc_event, acpi_gpio);
++
+ 	mutex_lock(&acpi_gpio_deferred_req_irqs_lock);
+ 	defer = !acpi_gpio_deferred_req_irqs_done;
+ 	if (defer)
+@@ -358,8 +387,7 @@ void acpi_gpiochip_request_interrupts(struct gpio_chip *chip)
+ 	if (defer)
+ 		return;
+ 
+-	acpi_walk_resources(handle, "_AEI",
+-			    acpi_gpiochip_request_interrupt, acpi_gpio);
++	acpi_gpiochip_request_irqs(acpi_gpio);
+ }
+ EXPORT_SYMBOL_GPL(acpi_gpiochip_request_interrupts);
+ 
+@@ -396,10 +424,13 @@ void acpi_gpiochip_free_interrupts(struct gpio_chip *chip)
+ 	list_for_each_entry_safe_reverse(event, ep, &acpi_gpio->events, node) {
+ 		struct gpio_desc *desc;
+ 
+-		if (irqd_is_wakeup_set(irq_get_irq_data(event->irq)))
+-			disable_irq_wake(event->irq);
++		if (event->irq_requested) {
++			if (event->irq_is_wake)
++				disable_irq_wake(event->irq);
++
++			free_irq(event->irq, event);
++		}
+ 
+-		free_irq(event->irq, event);
+ 		desc = event->desc;
+ 		if (WARN_ON(IS_ERR(desc)))
+ 			continue;
+@@ -1253,23 +1284,16 @@ bool acpi_can_fallback_to_crs(struct acpi_device *adev, const char *con_id)
+ 	return con_id == NULL;
+ }
+ 
+-/* Run deferred acpi_gpiochip_request_interrupts() */
+-static int acpi_gpio_handle_deferred_request_interrupts(void)
++/* Run deferred acpi_gpiochip_request_irqs() */
++static int acpi_gpio_handle_deferred_request_irqs(void)
+ {
+ 	struct acpi_gpio_chip *acpi_gpio, *tmp;
+ 
+ 	mutex_lock(&acpi_gpio_deferred_req_irqs_lock);
+ 	list_for_each_entry_safe(acpi_gpio, tmp,
+ 				 &acpi_gpio_deferred_req_irqs_list,
+-				 deferred_req_irqs_list_entry) {
+-		acpi_handle handle;
+-
+-		handle = ACPI_HANDLE(acpi_gpio->chip->parent);
+-		acpi_walk_resources(handle, "_AEI",
+-				    acpi_gpiochip_request_interrupt, acpi_gpio);
+-
+-		list_del_init(&acpi_gpio->deferred_req_irqs_list_entry);
+-	}
++				 deferred_req_irqs_list_entry)
++		acpi_gpiochip_request_irqs(acpi_gpio);
+ 
+ 	acpi_gpio_deferred_req_irqs_done = true;
+ 	mutex_unlock(&acpi_gpio_deferred_req_irqs_lock);
+@@ -1277,4 +1301,4 @@ static int acpi_gpio_handle_deferred_request_interrupts(void)
+ 	return 0;
+ }
+ /* We must use _sync so that this runs after the first deferred_probe run */
+-late_initcall_sync(acpi_gpio_handle_deferred_request_interrupts);
++late_initcall_sync(acpi_gpio_handle_deferred_request_irqs);
+diff --git a/drivers/gpu/drm/drm_ioctl.c b/drivers/gpu/drm/drm_ioctl.c
+index a9ae6dd2d593..53f319369de5 100644
+--- a/drivers/gpu/drm/drm_ioctl.c
++++ b/drivers/gpu/drm/drm_ioctl.c
+@@ -37,6 +37,7 @@
+ 
+ #include <linux/pci.h>
+ #include <linux/export.h>
++#include <linux/nospec.h>
+ 
+ /**
+  * DOC: getunique and setversion story
+@@ -778,13 +779,17 @@ long drm_ioctl(struct file *filp,
+ 
+ 	if (is_driver_ioctl) {
+ 		/* driver ioctl */
+-		if (nr - DRM_COMMAND_BASE >= dev->driver->num_ioctls)
++		unsigned int index = nr - DRM_COMMAND_BASE;
++
++		if (index >= dev->driver->num_ioctls)
+ 			goto err_i1;
+-		ioctl = &dev->driver->ioctls[nr - DRM_COMMAND_BASE];
++		index = array_index_nospec(index, dev->driver->num_ioctls);
++		ioctl = &dev->driver->ioctls[index];
+ 	} else {
+ 		/* core ioctl */
+ 		if (nr >= DRM_CORE_IOCTL_COUNT)
+ 			goto err_i1;
++		nr = array_index_nospec(nr, DRM_CORE_IOCTL_COUNT);
+ 		ioctl = &drm_ioctls[nr];
+ 	}
+ 
+@@ -866,6 +871,7 @@ bool drm_ioctl_flags(unsigned int nr, unsigned int *flags)
+ 
+ 	if (nr >= DRM_CORE_IOCTL_COUNT)
+ 		return false;
++	nr = array_index_nospec(nr, DRM_CORE_IOCTL_COUNT);
+ 
+ 	*flags = drm_ioctls[nr].flags;
+ 	return true;
+diff --git a/drivers/hv/vmbus_drv.c b/drivers/hv/vmbus_drv.c
+index 2cd134dd94d2..4218a616f1d3 100644
+--- a/drivers/hv/vmbus_drv.c
++++ b/drivers/hv/vmbus_drv.c
+@@ -300,6 +300,8 @@ static ssize_t out_intr_mask_show(struct device *dev,
+ 
+ 	if (!hv_dev->channel)
+ 		return -ENODEV;
++	if (hv_dev->channel->state != CHANNEL_OPENED_STATE)
++		return -EINVAL;
+ 	hv_ringbuffer_get_debuginfo(&hv_dev->channel->outbound, &outbound);
+ 	return sprintf(buf, "%d\n", outbound.current_interrupt_mask);
+ }
+@@ -313,6 +315,8 @@ static ssize_t out_read_index_show(struct device *dev,
+ 
+ 	if (!hv_dev->channel)
+ 		return -ENODEV;
++	if (hv_dev->channel->state != CHANNEL_OPENED_STATE)
++		return -EINVAL;
+ 	hv_ringbuffer_get_debuginfo(&hv_dev->channel->outbound, &outbound);
+ 	return sprintf(buf, "%d\n", outbound.current_read_index);
+ }
+@@ -327,6 +331,8 @@ static ssize_t out_write_index_show(struct device *dev,
+ 
+ 	if (!hv_dev->channel)
+ 		return -ENODEV;
++	if (hv_dev->channel->state != CHANNEL_OPENED_STATE)
++		return -EINVAL;
+ 	hv_ringbuffer_get_debuginfo(&hv_dev->channel->outbound, &outbound);
+ 	return sprintf(buf, "%d\n", outbound.current_write_index);
+ }
+@@ -341,6 +347,8 @@ static ssize_t out_read_bytes_avail_show(struct device *dev,
+ 
+ 	if (!hv_dev->channel)
+ 		return -ENODEV;
++	if (hv_dev->channel->state != CHANNEL_OPENED_STATE)
++		return -EINVAL;
+ 	hv_ringbuffer_get_debuginfo(&hv_dev->channel->outbound, &outbound);
+ 	return sprintf(buf, "%d\n", outbound.bytes_avail_toread);
+ }
+@@ -355,6 +363,8 @@ static ssize_t out_write_bytes_avail_show(struct device *dev,
+ 
+ 	if (!hv_dev->channel)
+ 		return -ENODEV;
++	if (hv_dev->channel->state != CHANNEL_OPENED_STATE)
++		return -EINVAL;
+ 	hv_ringbuffer_get_debuginfo(&hv_dev->channel->outbound, &outbound);
+ 	return sprintf(buf, "%d\n", outbound.bytes_avail_towrite);
+ }
+@@ -368,6 +378,8 @@ static ssize_t in_intr_mask_show(struct device *dev,
+ 
+ 	if (!hv_dev->channel)
+ 		return -ENODEV;
++	if (hv_dev->channel->state != CHANNEL_OPENED_STATE)
++		return -EINVAL;
+ 	hv_ringbuffer_get_debuginfo(&hv_dev->channel->inbound, &inbound);
+ 	return sprintf(buf, "%d\n", inbound.current_interrupt_mask);
+ }
+@@ -381,6 +393,8 @@ static ssize_t in_read_index_show(struct device *dev,
+ 
+ 	if (!hv_dev->channel)
+ 		return -ENODEV;
++	if (hv_dev->channel->state != CHANNEL_OPENED_STATE)
++		return -EINVAL;
+ 	hv_ringbuffer_get_debuginfo(&hv_dev->channel->inbound, &inbound);
+ 	return sprintf(buf, "%d\n", inbound.current_read_index);
+ }
+@@ -394,6 +408,8 @@ static ssize_t in_write_index_show(struct device *dev,
+ 
+ 	if (!hv_dev->channel)
+ 		return -ENODEV;
++	if (hv_dev->channel->state != CHANNEL_OPENED_STATE)
++		return -EINVAL;
+ 	hv_ringbuffer_get_debuginfo(&hv_dev->channel->inbound, &inbound);
+ 	return sprintf(buf, "%d\n", inbound.current_write_index);
+ }
+@@ -408,6 +424,8 @@ static ssize_t in_read_bytes_avail_show(struct device *dev,
+ 
+ 	if (!hv_dev->channel)
+ 		return -ENODEV;
++	if (hv_dev->channel->state != CHANNEL_OPENED_STATE)
++		return -EINVAL;
+ 	hv_ringbuffer_get_debuginfo(&hv_dev->channel->inbound, &inbound);
+ 	return sprintf(buf, "%d\n", inbound.bytes_avail_toread);
+ }
+@@ -422,6 +440,8 @@ static ssize_t in_write_bytes_avail_show(struct device *dev,
+ 
+ 	if (!hv_dev->channel)
+ 		return -ENODEV;
++	if (hv_dev->channel->state != CHANNEL_OPENED_STATE)
++		return -EINVAL;
+ 	hv_ringbuffer_get_debuginfo(&hv_dev->channel->inbound, &inbound);
+ 	return sprintf(buf, "%d\n", inbound.bytes_avail_towrite);
+ }
+diff --git a/drivers/infiniband/ulp/srpt/ib_srpt.c b/drivers/infiniband/ulp/srpt/ib_srpt.c
+index 60105ba77889..47f3f562d86f 100644
+--- a/drivers/infiniband/ulp/srpt/ib_srpt.c
++++ b/drivers/infiniband/ulp/srpt/ib_srpt.c
+@@ -1775,8 +1775,8 @@ static void __srpt_close_all_ch(struct srpt_device *sdev)
+ 
+ 	list_for_each_entry(ch, &sdev->rch_list, list) {
+ 		if (srpt_disconnect_ch(ch) >= 0)
+-			pr_info("Closing channel %s-%d because target %s has been disabled\n",
+-				ch->sess_name, ch->qp->qp_num,
++			pr_info("Closing channel %s because target %s has been disabled\n",
++				ch->sess_name,
+ 				sdev->device->name);
+ 		srpt_close_ch(ch);
+ 	}
+diff --git a/drivers/mmc/core/mmc.c b/drivers/mmc/core/mmc.c
+index bad5c1bf4ed9..814a04e8fdd7 100644
+--- a/drivers/mmc/core/mmc.c
++++ b/drivers/mmc/core/mmc.c
+@@ -30,6 +30,7 @@
+ #include "pwrseq.h"
+ 
+ #define DEFAULT_CMD6_TIMEOUT_MS	500
++#define MIN_CACHE_EN_TIMEOUT_MS 1600
+ 
+ static const unsigned int tran_exp[] = {
+ 	10000,		100000,		1000000,	10000000,
+@@ -526,8 +527,7 @@ static int mmc_decode_ext_csd(struct mmc_card *card, u8 *ext_csd)
+ 			card->cid.year += 16;
+ 
+ 		/* check whether the eMMC card supports BKOPS */
+-		if (!mmc_card_broken_hpi(card) &&
+-		    ext_csd[EXT_CSD_BKOPS_SUPPORT] & 0x1) {
++		if (ext_csd[EXT_CSD_BKOPS_SUPPORT] & 0x1) {
+ 			card->ext_csd.bkops = 1;
+ 			card->ext_csd.man_bkops_en =
+ 					(ext_csd[EXT_CSD_BKOPS_EN] &
+@@ -1755,20 +1755,26 @@ static int mmc_init_card(struct mmc_host *host, u32 ocr,
+ 		if (err) {
+ 			pr_warn("%s: Enabling HPI failed\n",
+ 				mmc_hostname(card->host));
++			card->ext_csd.hpi_en = 0;
+ 			err = 0;
+-		} else
++		} else {
+ 			card->ext_csd.hpi_en = 1;
++		}
+ 	}
+ 
+ 	/*
+-	 * If cache size is higher than 0, this indicates
+-	 * the existence of cache and it can be turned on.
++	 * If cache size is higher than 0, this indicates the existence of cache
++	 * and it can be turned on. Note that some eMMCs from Micron has been
++	 * reported to need ~800 ms timeout, while enabling the cache after
++	 * sudden power failure tests. Let's extend the timeout to a minimum of
++	 * DEFAULT_CACHE_EN_TIMEOUT_MS and do it for all cards.
+ 	 */
+-	if (!mmc_card_broken_hpi(card) &&
+-	    card->ext_csd.cache_size > 0) {
++	if (card->ext_csd.cache_size > 0) {
++		unsigned int timeout_ms = MIN_CACHE_EN_TIMEOUT_MS;
++
++		timeout_ms = max(card->ext_csd.generic_cmd6_time, timeout_ms);
+ 		err = mmc_switch(card, EXT_CSD_CMD_SET_NORMAL,
+-				EXT_CSD_CACHE_CTRL, 1,
+-				card->ext_csd.generic_cmd6_time);
++				EXT_CSD_CACHE_CTRL, 1, timeout_ms);
+ 		if (err && err != -EBADMSG)
+ 			goto free_card;
+ 
+diff --git a/drivers/mmc/host/omap_hsmmc.c b/drivers/mmc/host/omap_hsmmc.c
+index 9e03fada16dc..3f3ff7530b76 100644
+--- a/drivers/mmc/host/omap_hsmmc.c
++++ b/drivers/mmc/host/omap_hsmmc.c
+@@ -2083,7 +2083,6 @@ static int omap_hsmmc_probe(struct platform_device *pdev)
+ 	mmc->max_blk_size = 512;       /* Block Length at max can be 1024 */
+ 	mmc->max_blk_count = 0xFFFF;    /* No. of Blocks is 16 bits */
+ 	mmc->max_req_size = mmc->max_blk_size * mmc->max_blk_count;
+-	mmc->max_seg_size = mmc->max_req_size;
+ 
+ 	mmc->caps |= MMC_CAP_MMC_HIGHSPEED | MMC_CAP_SD_HIGHSPEED |
+ 		     MMC_CAP_WAIT_WHILE_BUSY | MMC_CAP_ERASE | MMC_CAP_CMD23;
+@@ -2113,6 +2112,17 @@ static int omap_hsmmc_probe(struct platform_device *pdev)
+ 		goto err_irq;
+ 	}
+ 
++	/*
++	 * Limit the maximum segment size to the lower of the request size
++	 * and the DMA engine device segment size limits.  In reality, with
++	 * 32-bit transfers, the DMA engine can do longer segments than this
++	 * but there is no way to represent that in the DMA model - if we
++	 * increase this figure here, we get warnings from the DMA API debug.
++	 */
++	mmc->max_seg_size = min3(mmc->max_req_size,
++			dma_get_max_seg_size(host->rx_chan->device->dev),
++			dma_get_max_seg_size(host->tx_chan->device->dev));
++
+ 	/* Request IRQ for MMC operations */
+ 	ret = devm_request_irq(&pdev->dev, host->irq, omap_hsmmc_irq, 0,
+ 			mmc_hostname(mmc), host);
+diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c
+index d7a3379ea668..18a0952f68a8 100644
+--- a/drivers/net/usb/hso.c
++++ b/drivers/net/usb/hso.c
+@@ -2806,6 +2806,12 @@ static int hso_get_config_data(struct usb_interface *interface)
+ 		return -EIO;
+ 	}
+ 
++	/* check if we have a valid interface */
++	if (if_num > 16) {
++		kfree(config_data);
++		return -EINVAL;
++	}
++
+ 	switch (config_data[if_num]) {
+ 	case 0x0:
+ 		result = 0;
+@@ -2876,10 +2882,18 @@ static int hso_probe(struct usb_interface *interface,
+ 
+ 	/* Get the interface/port specification from either driver_info or from
+ 	 * the device itself */
+-	if (id->driver_info)
++	if (id->driver_info) {
++		/* if_num is controlled by the device, driver_info is a 0 terminated
++		 * array. Make sure, the access is in bounds! */
++		for (i = 0; i <= if_num; ++i)
++			if (((u32 *)(id->driver_info))[i] == 0)
++				goto exit;
+ 		port_spec = ((u32 *)(id->driver_info))[if_num];
+-	else
++	} else {
+ 		port_spec = hso_get_config_data(interface);
++		if (port_spec < 0)
++			goto exit;
++	}
+ 
+ 	/* Check if we need to switch to alt interfaces prior to port
+ 	 * configuration */
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
+index cebf0ce76d27..e9e466cae322 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
+@@ -952,6 +952,15 @@ static int iwl_mvm_sar_geo_init(struct iwl_mvm *mvm)
+ 	int ret, i, j;
+ 	u16 cmd_wide_id =  WIDE_ID(PHY_OPS_GROUP, GEO_TX_POWER_LIMIT);
+ 
++	/*
++	 * This command is not supported on earlier firmware versions.
++	 * Unfortunately, we don't have a TLV API flag to rely on, so
++	 * rely on the major version which is in the first byte of
++	 * ucode_ver.
++	 */
++	if (IWL_UCODE_SERIAL(mvm->fw->ucode_ver) < 41)
++		return 0;
++
+ 	ret = iwl_mvm_sar_get_wgds_table(mvm);
+ 	if (ret < 0) {
+ 		IWL_DEBUG_RADIO(mvm,
+diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
+index 4cbc6cb8bf89..0ff247326d6c 100644
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
+@@ -517,6 +517,56 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
+ 	{IWL_PCI_DEVICE(0x24FD, 0x9074, iwl8265_2ac_cfg)},
+ 
+ /* 9000 Series */
++	{IWL_PCI_DEVICE(0x02F0, 0x0030, iwl9560_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0x02F0, 0x0034, iwl9560_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0x02F0, 0x0038, iwl9560_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0x02F0, 0x003C, iwl9560_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0x02F0, 0x0060, iwl9461_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0x02F0, 0x0064, iwl9461_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0x02F0, 0x00A0, iwl9462_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0x02F0, 0x00A4, iwl9462_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0x02F0, 0x0230, iwl9560_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0x02F0, 0x0234, iwl9560_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0x02F0, 0x0238, iwl9560_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0x02F0, 0x023C, iwl9560_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0x02F0, 0x0260, iwl9461_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0x02F0, 0x0264, iwl9461_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0x02F0, 0x02A0, iwl9462_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0x02F0, 0x02A4, iwl9462_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0x02F0, 0x1551, iwl9560_killer_s_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0x02F0, 0x1552, iwl9560_killer_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0x02F0, 0x2030, iwl9560_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0x02F0, 0x2034, iwl9560_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0x02F0, 0x4030, iwl9560_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0x02F0, 0x4034, iwl9560_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0x02F0, 0x40A4, iwl9462_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0x02F0, 0x4234, iwl9560_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0x02F0, 0x42A4, iwl9462_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0x06F0, 0x0030, iwl9560_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0x06F0, 0x0034, iwl9560_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0x06F0, 0x0038, iwl9560_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0x06F0, 0x003C, iwl9560_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0x06F0, 0x0060, iwl9461_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0x06F0, 0x0064, iwl9461_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0x06F0, 0x00A0, iwl9462_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0x06F0, 0x00A4, iwl9462_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0x06F0, 0x0230, iwl9560_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0x06F0, 0x0234, iwl9560_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0x06F0, 0x0238, iwl9560_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0x06F0, 0x023C, iwl9560_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0x06F0, 0x0260, iwl9461_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0x06F0, 0x0264, iwl9461_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0x06F0, 0x02A0, iwl9462_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0x06F0, 0x02A4, iwl9462_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0x06F0, 0x1551, iwl9560_killer_s_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0x06F0, 0x1552, iwl9560_killer_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0x06F0, 0x2030, iwl9560_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0x06F0, 0x2034, iwl9560_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0x06F0, 0x4030, iwl9560_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0x06F0, 0x4034, iwl9560_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0x06F0, 0x40A4, iwl9462_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0x06F0, 0x4234, iwl9560_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0x06F0, 0x42A4, iwl9462_2ac_cfg_soc)},
+ 	{IWL_PCI_DEVICE(0x2526, 0x0010, iwl9260_2ac_cfg)},
+ 	{IWL_PCI_DEVICE(0x2526, 0x0014, iwl9260_2ac_cfg)},
+ 	{IWL_PCI_DEVICE(0x2526, 0x0018, iwl9260_2ac_cfg)},
+diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
+index c7b284587365..39754cc90043 100644
+--- a/drivers/scsi/sd.c
++++ b/drivers/scsi/sd.c
+@@ -133,6 +133,7 @@ static DEFINE_MUTEX(sd_ref_mutex);
+ 
+ static struct kmem_cache *sd_cdb_cache;
+ static mempool_t *sd_cdb_pool;
++static mempool_t *sd_page_pool;
+ 
+ static const char *sd_cache_types[] = {
+ 	"write through", "none", "write back",
+@@ -759,9 +760,10 @@ static int sd_setup_unmap_cmnd(struct scsi_cmnd *cmd)
+ 	unsigned int data_len = 24;
+ 	char *buf;
+ 
+-	rq->special_vec.bv_page = alloc_page(GFP_ATOMIC | __GFP_ZERO);
++	rq->special_vec.bv_page = mempool_alloc(sd_page_pool, GFP_ATOMIC);
+ 	if (!rq->special_vec.bv_page)
+ 		return BLKPREP_DEFER;
++	clear_highpage(rq->special_vec.bv_page);
+ 	rq->special_vec.bv_offset = 0;
+ 	rq->special_vec.bv_len = data_len;
+ 	rq->rq_flags |= RQF_SPECIAL_PAYLOAD;
+@@ -792,9 +794,10 @@ static int sd_setup_write_same16_cmnd(struct scsi_cmnd *cmd, bool unmap)
+ 	u32 nr_sectors = blk_rq_sectors(rq) >> (ilog2(sdp->sector_size) - 9);
+ 	u32 data_len = sdp->sector_size;
+ 
+-	rq->special_vec.bv_page = alloc_page(GFP_ATOMIC | __GFP_ZERO);
++	rq->special_vec.bv_page = mempool_alloc(sd_page_pool, GFP_ATOMIC);
+ 	if (!rq->special_vec.bv_page)
+ 		return BLKPREP_DEFER;
++	clear_highpage(rq->special_vec.bv_page);
+ 	rq->special_vec.bv_offset = 0;
+ 	rq->special_vec.bv_len = data_len;
+ 	rq->rq_flags |= RQF_SPECIAL_PAYLOAD;
+@@ -822,9 +825,10 @@ static int sd_setup_write_same10_cmnd(struct scsi_cmnd *cmd, bool unmap)
+ 	u32 nr_sectors = blk_rq_sectors(rq) >> (ilog2(sdp->sector_size) - 9);
+ 	u32 data_len = sdp->sector_size;
+ 
+-	rq->special_vec.bv_page = alloc_page(GFP_ATOMIC | __GFP_ZERO);
++	rq->special_vec.bv_page = mempool_alloc(sd_page_pool, GFP_ATOMIC);
+ 	if (!rq->special_vec.bv_page)
+ 		return BLKPREP_DEFER;
++	clear_highpage(rq->special_vec.bv_page);
+ 	rq->special_vec.bv_offset = 0;
+ 	rq->special_vec.bv_len = data_len;
+ 	rq->rq_flags |= RQF_SPECIAL_PAYLOAD;
+@@ -1299,7 +1303,7 @@ static void sd_uninit_command(struct scsi_cmnd *SCpnt)
+ 		sd_zbc_write_unlock_zone(SCpnt);
+ 
+ 	if (rq->rq_flags & RQF_SPECIAL_PAYLOAD)
+-		__free_page(rq->special_vec.bv_page);
++		mempool_free(rq->special_vec.bv_page, sd_page_pool);
+ 
+ 	if (SCpnt->cmnd != scsi_req(rq)->cmd) {
+ 		cmnd = SCpnt->cmnd;
+@@ -3655,6 +3659,13 @@ static int __init init_sd(void)
+ 		goto err_out_cache;
+ 	}
+ 
++	sd_page_pool = mempool_create_page_pool(SD_MEMPOOL_SIZE, 0);
++	if (!sd_page_pool) {
++		printk(KERN_ERR "sd: can't init discard page pool\n");
++		err = -ENOMEM;
++		goto err_out_ppool;
++	}
++
+ 	err = scsi_register_driver(&sd_template.gendrv);
+ 	if (err)
+ 		goto err_out_driver;
+@@ -3662,6 +3673,9 @@ static int __init init_sd(void)
+ 	return 0;
+ 
+ err_out_driver:
++	mempool_destroy(sd_page_pool);
++
++err_out_ppool:
+ 	mempool_destroy(sd_cdb_pool);
+ 
+ err_out_cache:
+@@ -3688,6 +3702,7 @@ static void __exit exit_sd(void)
+ 
+ 	scsi_unregister_driver(&sd_template.gendrv);
+ 	mempool_destroy(sd_cdb_pool);
++	mempool_destroy(sd_page_pool);
+ 	kmem_cache_destroy(sd_cdb_cache);
+ 
+ 	class_unregister(&sd_disk_class);
+diff --git a/drivers/spi/spi-imx.c b/drivers/spi/spi-imx.c
+index d51ca243a028..df18d07d544d 100644
+--- a/drivers/spi/spi-imx.c
++++ b/drivers/spi/spi-imx.c
+@@ -72,6 +72,7 @@ struct spi_imx_data;
+ 
+ struct spi_imx_devtype_data {
+ 	void (*intctrl)(struct spi_imx_data *, int);
++	int (*prepare_message)(struct spi_imx_data *, struct spi_message *);
+ 	int (*config)(struct spi_device *);
+ 	void (*trigger)(struct spi_imx_data *);
+ 	int (*rx_available)(struct spi_imx_data *);
+@@ -439,11 +440,12 @@ static void mx51_ecspi_trigger(struct spi_imx_data *spi_imx)
+ 	writel(reg, spi_imx->base + MX51_ECSPI_CTRL);
+ }
+ 
+-static int mx51_ecspi_config(struct spi_device *spi)
++static int mx51_ecspi_prepare_message(struct spi_imx_data *spi_imx,
++				      struct spi_message *msg)
+ {
+-	struct spi_imx_data *spi_imx = spi_master_get_devdata(spi->master);
++	struct spi_device *spi = msg->spi;
+ 	u32 ctrl = MX51_ECSPI_CTRL_ENABLE;
+-	u32 clk = spi_imx->speed_hz, delay, reg;
++	u32 testreg;
+ 	u32 cfg = readl(spi_imx->base + MX51_ECSPI_CONFIG);
+ 
+ 	/*
+@@ -461,14 +463,21 @@ static int mx51_ecspi_config(struct spi_device *spi)
+ 	if (spi->mode & SPI_READY)
+ 		ctrl |= MX51_ECSPI_CTRL_DRCTL(spi_imx->spi_drctl);
+ 
+-	/* set clock speed */
+-	ctrl |= mx51_ecspi_clkdiv(spi_imx, spi_imx->speed_hz, &clk);
+-	spi_imx->spi_bus_clk = clk;
+-
+ 	/* set chip select to use */
+ 	ctrl |= MX51_ECSPI_CTRL_CS(spi->chip_select);
+ 
+-	ctrl |= (spi_imx->bits_per_word - 1) << MX51_ECSPI_CTRL_BL_OFFSET;
++	/*
++	 * The ctrl register must be written first, with the EN bit set other
++	 * registers must not be written to.
++	 */
++	writel(ctrl, spi_imx->base + MX51_ECSPI_CTRL);
++
++	testreg = readl(spi_imx->base + MX51_ECSPI_TESTREG);
++	if (spi->mode & SPI_LOOP)
++		testreg |= MX51_ECSPI_TESTREG_LBC;
++	else
++		testreg &= ~MX51_ECSPI_TESTREG_LBC;
++	writel(testreg, spi_imx->base + MX51_ECSPI_TESTREG);
+ 
+ 	cfg |= MX51_ECSPI_CONFIG_SBBCTRL(spi->chip_select);
+ 
+@@ -484,26 +493,38 @@ static int mx51_ecspi_config(struct spi_device *spi)
+ 		cfg &= ~MX51_ECSPI_CONFIG_SCLKPOL(spi->chip_select);
+ 		cfg &= ~MX51_ECSPI_CONFIG_SCLKCTL(spi->chip_select);
+ 	}
++
+ 	if (spi->mode & SPI_CS_HIGH)
+ 		cfg |= MX51_ECSPI_CONFIG_SSBPOL(spi->chip_select);
+ 	else
+ 		cfg &= ~MX51_ECSPI_CONFIG_SSBPOL(spi->chip_select);
+ 
++	writel(cfg, spi_imx->base + MX51_ECSPI_CONFIG);
++
++	return 0;
++}
++
++static int mx51_ecspi_config(struct spi_device *spi)
++{
++	struct spi_imx_data *spi_imx = spi_master_get_devdata(spi->master);
++	u32 ctrl = readl(spi_imx->base + MX51_ECSPI_CTRL);
++	u32 clk = spi_imx->speed_hz, delay;
++
++	/* Clear BL field and set the right value */
++	ctrl &= ~MX51_ECSPI_CTRL_BL_MASK;
++	ctrl |= (spi_imx->bits_per_word - 1) << MX51_ECSPI_CTRL_BL_OFFSET;
++
++	/* set clock speed */
++	ctrl &= ~(0xf << MX51_ECSPI_CTRL_POSTDIV_OFFSET |
++		  0xf << MX51_ECSPI_CTRL_PREDIV_OFFSET);
++	ctrl |= mx51_ecspi_clkdiv(spi_imx, spi_imx->speed_hz, &clk);
++	spi_imx->spi_bus_clk = clk;
++
+ 	if (spi_imx->usedma)
+ 		ctrl |= MX51_ECSPI_CTRL_SMC;
+ 
+-	/* CTRL register always go first to bring out controller from reset */
+ 	writel(ctrl, spi_imx->base + MX51_ECSPI_CTRL);
+ 
+-	reg = readl(spi_imx->base + MX51_ECSPI_TESTREG);
+-	if (spi->mode & SPI_LOOP)
+-		reg |= MX51_ECSPI_TESTREG_LBC;
+-	else
+-		reg &= ~MX51_ECSPI_TESTREG_LBC;
+-	writel(reg, spi_imx->base + MX51_ECSPI_TESTREG);
+-
+-	writel(cfg, spi_imx->base + MX51_ECSPI_CONFIG);
+-
+ 	/*
+ 	 * Wait until the changes in the configuration register CONFIGREG
+ 	 * propagate into the hardware. It takes exactly one tick of the
+@@ -525,7 +546,6 @@ static int mx51_ecspi_config(struct spi_device *spi)
+ 	 * Configure the DMA register: setup the watermark
+ 	 * and enable DMA request.
+ 	 */
+-
+ 	writel(MX51_ECSPI_DMA_RX_WML(spi_imx->wml) |
+ 		MX51_ECSPI_DMA_TX_WML(spi_imx->wml) |
+ 		MX51_ECSPI_DMA_RXT_WML(spi_imx->wml) |
+@@ -599,6 +619,12 @@ static void mx31_trigger(struct spi_imx_data *spi_imx)
+ 	writel(reg, spi_imx->base + MXC_CSPICTRL);
+ }
+ 
++static int mx31_prepare_message(struct spi_imx_data *spi_imx,
++				struct spi_message *msg)
++{
++	return 0;
++}
++
+ static int mx31_config(struct spi_device *spi)
+ {
+ 	struct spi_imx_data *spi_imx = spi_master_get_devdata(spi->master);
+@@ -695,6 +721,12 @@ static void mx21_trigger(struct spi_imx_data *spi_imx)
+ 	writel(reg, spi_imx->base + MXC_CSPICTRL);
+ }
+ 
++static int mx21_prepare_message(struct spi_imx_data *spi_imx,
++				struct spi_message *msg)
++{
++	return 0;
++}
++
+ static int mx21_config(struct spi_device *spi)
+ {
+ 	struct spi_imx_data *spi_imx = spi_master_get_devdata(spi->master);
+@@ -764,6 +796,12 @@ static void mx1_trigger(struct spi_imx_data *spi_imx)
+ 	writel(reg, spi_imx->base + MXC_CSPICTRL);
+ }
+ 
++static int mx1_prepare_message(struct spi_imx_data *spi_imx,
++			       struct spi_message *msg)
++{
++	return 0;
++}
++
+ static int mx1_config(struct spi_device *spi)
+ {
+ 	struct spi_imx_data *spi_imx = spi_master_get_devdata(spi->master);
+@@ -798,6 +836,7 @@ static void mx1_reset(struct spi_imx_data *spi_imx)
+ 
+ static struct spi_imx_devtype_data imx1_cspi_devtype_data = {
+ 	.intctrl = mx1_intctrl,
++	.prepare_message = mx1_prepare_message,
+ 	.config = mx1_config,
+ 	.trigger = mx1_trigger,
+ 	.rx_available = mx1_rx_available,
+@@ -810,6 +849,7 @@ static struct spi_imx_devtype_data imx1_cspi_devtype_data = {
+ 
+ static struct spi_imx_devtype_data imx21_cspi_devtype_data = {
+ 	.intctrl = mx21_intctrl,
++	.prepare_message = mx21_prepare_message,
+ 	.config = mx21_config,
+ 	.trigger = mx21_trigger,
+ 	.rx_available = mx21_rx_available,
+@@ -823,6 +863,7 @@ static struct spi_imx_devtype_data imx21_cspi_devtype_data = {
+ static struct spi_imx_devtype_data imx27_cspi_devtype_data = {
+ 	/* i.mx27 cspi shares the functions with i.mx21 one */
+ 	.intctrl = mx21_intctrl,
++	.prepare_message = mx21_prepare_message,
+ 	.config = mx21_config,
+ 	.trigger = mx21_trigger,
+ 	.rx_available = mx21_rx_available,
+@@ -835,6 +876,7 @@ static struct spi_imx_devtype_data imx27_cspi_devtype_data = {
+ 
+ static struct spi_imx_devtype_data imx31_cspi_devtype_data = {
+ 	.intctrl = mx31_intctrl,
++	.prepare_message = mx31_prepare_message,
+ 	.config = mx31_config,
+ 	.trigger = mx31_trigger,
+ 	.rx_available = mx31_rx_available,
+@@ -848,6 +890,7 @@ static struct spi_imx_devtype_data imx31_cspi_devtype_data = {
+ static struct spi_imx_devtype_data imx35_cspi_devtype_data = {
+ 	/* i.mx35 and later cspi shares the functions with i.mx31 one */
+ 	.intctrl = mx31_intctrl,
++	.prepare_message = mx31_prepare_message,
+ 	.config = mx31_config,
+ 	.trigger = mx31_trigger,
+ 	.rx_available = mx31_rx_available,
+@@ -860,6 +903,7 @@ static struct spi_imx_devtype_data imx35_cspi_devtype_data = {
+ 
+ static struct spi_imx_devtype_data imx51_ecspi_devtype_data = {
+ 	.intctrl = mx51_ecspi_intctrl,
++	.prepare_message = mx51_ecspi_prepare_message,
+ 	.config = mx51_ecspi_config,
+ 	.trigger = mx51_ecspi_trigger,
+ 	.rx_available = mx51_ecspi_rx_available,
+@@ -872,6 +916,7 @@ static struct spi_imx_devtype_data imx51_ecspi_devtype_data = {
+ 
+ static struct spi_imx_devtype_data imx53_ecspi_devtype_data = {
+ 	.intctrl = mx51_ecspi_intctrl,
++	.prepare_message = mx51_ecspi_prepare_message,
+ 	.config = mx51_ecspi_config,
+ 	.trigger = mx51_ecspi_trigger,
+ 	.rx_available = mx51_ecspi_rx_available,
+@@ -1310,7 +1355,13 @@ spi_imx_prepare_message(struct spi_master *master, struct spi_message *msg)
+ 		return ret;
+ 	}
+ 
+-	return 0;
++	ret = spi_imx->devtype_data->prepare_message(spi_imx, msg);
++	if (ret) {
++		clk_disable(spi_imx->clk_ipg);
++		clk_disable(spi_imx->clk_per);
++	}
++
++	return ret;
+ }
+ 
+ static int
+diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
+index 6b2f6c41e2a9..997ff183c9cb 100644
+--- a/drivers/usb/host/xhci-hub.c
++++ b/drivers/usb/host/xhci-hub.c
+@@ -1512,7 +1512,8 @@ int xhci_bus_suspend(struct usb_hcd *hcd)
+ 		portsc_buf[port_index] = 0;
+ 
+ 		/* Bail out if a USB3 port has a new device in link training */
+-		if ((t1 & PORT_PLS_MASK) == XDEV_POLLING) {
++		if ((hcd->speed >= HCD_USB3) &&
++		    (t1 & PORT_PLS_MASK) == XDEV_POLLING) {
+ 			bus_state->bus_suspended = 0;
+ 			spin_unlock_irqrestore(&xhci->lock, flags);
+ 			xhci_dbg(xhci, "Bus suspend bailout, port in polling\n");
+diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
+index 1ccff2d9dee9..cbc91536e512 100644
+--- a/drivers/usb/host/xhci.h
++++ b/drivers/usb/host/xhci.h
+@@ -1859,6 +1859,8 @@ struct xhci_hcd {
+ 	unsigned		sw_lpm_support:1;
+ 	/* support xHCI 1.0 spec USB2 hardware LPM */
+ 	unsigned		hw_lpm_support:1;
++	/* Broken Suspend flag for SNPS Suspend resume issue */
++	unsigned		broken_suspend:1;
+ 	/* cached usb2 extened protocol capabilites */
+ 	u32                     *ext_caps;
+ 	unsigned int            num_ext_caps;
+@@ -1871,8 +1873,6 @@ struct xhci_hcd {
+ 
+ 	/* platform-specific data -- must come last */
+ 	unsigned long		priv[0] __aligned(sizeof(s64));
+-	/* Broken Suspend flag for SNPS Suspend resume issue */
+-	u8			broken_suspend;
+ };
+ 
+ /* Platform specific overrides to generic XHCI hc_driver ops */
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index 392fddc80c44..988be9ca2b4f 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -1167,6 +1167,10 @@ static const struct usb_device_id option_ids[] = {
+ 	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1213, 0xff) },
+ 	{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1214),
+ 	  .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) | RSVD(3) },
++	{ USB_DEVICE(TELIT_VENDOR_ID, 0x1900),				/* Telit LN940 (QMI) */
++	  .driver_info = NCTRL(0) | RSVD(1) },
++	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1901, 0xff),	/* Telit LN940 (MBIM) */
++	  .driver_info = NCTRL(0) },
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MF622, 0xff, 0xff, 0xff) }, /* ZTE WCDMA products */
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0002, 0xff, 0xff, 0xff),
+ 	  .driver_info = RSVD(1) },
+@@ -1331,6 +1335,7 @@ static const struct usb_device_id option_ids[] = {
+ 	  .driver_info = RSVD(4) },
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0414, 0xff, 0xff, 0xff) },
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0417, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_INTERFACE_CLASS(ZTE_VENDOR_ID, 0x0602, 0xff) },	/* GosunCn ZTE WeLink ME3630 (MBIM mode) */
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1008, 0xff, 0xff, 0xff),
+ 	  .driver_info = RSVD(4) },
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1010, 0xff, 0xff, 0xff),
+@@ -1534,6 +1539,7 @@ static const struct usb_device_id option_ids[] = {
+ 	  .driver_info = RSVD(2) },
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1428, 0xff, 0xff, 0xff),  /* Telewell TW-LTE 4G v2 */
+ 	  .driver_info = RSVD(2) },
++	{ USB_DEVICE_INTERFACE_CLASS(ZTE_VENDOR_ID, 0x1476, 0xff) },	/* GosunCn ZTE WeLink ME3630 (ECM/NCM mode) */
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1533, 0xff, 0xff, 0xff) },
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1534, 0xff, 0xff, 0xff) },
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1535, 0xff, 0xff, 0xff) },
+@@ -1761,6 +1767,7 @@ static const struct usb_device_id option_ids[] = {
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(ALINK_VENDOR_ID, ALINK_PRODUCT_3GU, 0xff, 0xff, 0xff) },
+ 	{ USB_DEVICE(ALINK_VENDOR_ID, SIMCOM_PRODUCT_SIM7100E),
+ 	  .driver_info = RSVD(5) | RSVD(6) },
++	{ USB_DEVICE_INTERFACE_CLASS(0x1e0e, 0x9003, 0xff) },	/* Simcom SIM7500/SIM7600 MBIM mode */
+ 	{ USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_X060S_X200),
+ 	  .driver_info = NCTRL(0) | NCTRL(1) | RSVD(4) },
+ 	{ USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_X220_X500D),
+@@ -1942,7 +1949,14 @@ static const struct usb_device_id option_ids[] = {
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(WETELECOM_VENDOR_ID, WETELECOM_PRODUCT_WMD200, 0xff, 0xff, 0xff) },
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(WETELECOM_VENDOR_ID, WETELECOM_PRODUCT_6802, 0xff, 0xff, 0xff) },
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(WETELECOM_VENDOR_ID, WETELECOM_PRODUCT_WMD300, 0xff, 0xff, 0xff) },
+-	{ USB_DEVICE_AND_INTERFACE_INFO(0x03f0, 0x421d, 0xff, 0xff, 0xff) }, /* HP lt2523 (Novatel E371) */
++	{ USB_DEVICE_AND_INTERFACE_INFO(0x03f0, 0x421d, 0xff, 0xff, 0xff) },	/* HP lt2523 (Novatel E371) */
++	{ USB_DEVICE_AND_INTERFACE_INFO(0x03f0, 0xa31d, 0xff, 0x06, 0x10) },	/* HP lt4132 (Huawei ME906s-158) */
++	{ USB_DEVICE_AND_INTERFACE_INFO(0x03f0, 0xa31d, 0xff, 0x06, 0x12) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(0x03f0, 0xa31d, 0xff, 0x06, 0x13) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(0x03f0, 0xa31d, 0xff, 0x06, 0x14) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(0x03f0, 0xa31d, 0xff, 0x06, 0x1b) },
++	{ USB_DEVICE(0x1508, 0x1001),						/* Fibocom NL668 */
++	  .driver_info = RSVD(4) | RSVD(5) | RSVD(6) },
+ 	{ } /* Terminating entry */
+ };
+ MODULE_DEVICE_TABLE(usb, option_ids);
+diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
+index 69309538ffb8..1581e8668b09 100644
+--- a/fs/cifs/smb2pdu.c
++++ b/fs/cifs/smb2pdu.c
+@@ -2020,14 +2020,14 @@ SMB2_ioctl(const unsigned int xid, struct cifs_tcon *tcon, u64 persistent_fid,
+ 	/* We check for obvious errors in the output buffer length and offset */
+ 	if (*plen == 0)
+ 		goto ioctl_exit; /* server returned no data */
+-	else if (*plen > 0xFF00) {
++	else if (*plen > rsp_iov.iov_len || *plen > 0xFF00) {
+ 		cifs_dbg(VFS, "srv returned invalid ioctl length: %d\n", *plen);
+ 		*plen = 0;
+ 		rc = -EIO;
+ 		goto ioctl_exit;
+ 	}
+ 
+-	if (get_rfc1002_length(rsp) < le32_to_cpu(rsp->OutputOffset) + *plen) {
++	if (get_rfc1002_length(rsp) - *plen < le32_to_cpu(rsp->OutputOffset)) {
+ 		cifs_dbg(VFS, "Malformed ioctl resp: len %d offset %d\n", *plen,
+ 			le32_to_cpu(rsp->OutputOffset));
+ 		*plen = 0;
+diff --git a/fs/proc/proc_sysctl.c b/fs/proc/proc_sysctl.c
+index 82ac5f682b73..f69c545f5868 100644
+--- a/fs/proc/proc_sysctl.c
++++ b/fs/proc/proc_sysctl.c
+@@ -464,7 +464,7 @@ static struct inode *proc_sys_make_inode(struct super_block *sb,
+ 
+ 	inode = new_inode(sb);
+ 	if (!inode)
+-		goto out;
++		return ERR_PTR(-ENOMEM);
+ 
+ 	inode->i_ino = get_next_ino();
+ 
+@@ -474,8 +474,7 @@ static struct inode *proc_sys_make_inode(struct super_block *sb,
+ 	if (unlikely(head->unregistering)) {
+ 		spin_unlock(&sysctl_lock);
+ 		iput(inode);
+-		inode = NULL;
+-		goto out;
++		return ERR_PTR(-ENOENT);
+ 	}
+ 	ei->sysctl = head;
+ 	ei->sysctl_entry = table;
+@@ -500,7 +499,6 @@ static struct inode *proc_sys_make_inode(struct super_block *sb,
+ 	if (root->set_ownership)
+ 		root->set_ownership(head, table, &inode->i_uid, &inode->i_gid);
+ 
+-out:
+ 	return inode;
+ }
+ 
+@@ -549,10 +547,11 @@ static struct dentry *proc_sys_lookup(struct inode *dir, struct dentry *dentry,
+ 			goto out;
+ 	}
+ 
+-	err = ERR_PTR(-ENOMEM);
+ 	inode = proc_sys_make_inode(dir->i_sb, h ? h : head, p);
+-	if (!inode)
++	if (IS_ERR(inode)) {
++		err = ERR_CAST(inode);
+ 		goto out;
++	}
+ 
+ 	err = NULL;
+ 	d_set_d_op(dentry, &proc_sys_dentry_operations);
+@@ -685,7 +684,7 @@ static bool proc_sys_fill_cache(struct file *file,
+ 			return false;
+ 		if (d_in_lookup(child)) {
+ 			inode = proc_sys_make_inode(dir->d_sb, head, table);
+-			if (!inode) {
++			if (IS_ERR(inode)) {
+ 				d_lookup_done(child);
+ 				dput(child);
+ 				return false;
+diff --git a/fs/ubifs/dir.c b/fs/ubifs/dir.c
+index ef820f803176..4e6e32c0c08a 100644
+--- a/fs/ubifs/dir.c
++++ b/fs/ubifs/dir.c
+@@ -1147,8 +1147,7 @@ static int ubifs_symlink(struct inode *dir, struct dentry *dentry,
+ 	struct ubifs_inode *ui;
+ 	struct ubifs_inode *dir_ui = ubifs_inode(dir);
+ 	struct ubifs_info *c = dir->i_sb->s_fs_info;
+-	int err, len = strlen(symname);
+-	int sz_change = CALC_DENT_SIZE(len);
++	int err, sz_change, len = strlen(symname);
+ 	struct fscrypt_str disk_link = FSTR_INIT((char *)symname, len + 1);
+ 	struct fscrypt_symlink_data *sd = NULL;
+ 	struct ubifs_budget_req req = { .new_ino = 1, .new_dent = 1,
+@@ -1189,6 +1188,8 @@ static int ubifs_symlink(struct inode *dir, struct dentry *dentry,
+ 	if (err)
+ 		goto out_budg;
+ 
++	sz_change = CALC_DENT_SIZE(fname_len(&nm));
++
+ 	inode = ubifs_new_inode(c, dir, S_IFLNK | S_IRWXUGO);
+ 	if (IS_ERR(inode)) {
+ 		err = PTR_ERR(inode);
+diff --git a/fs/ubifs/replay.c b/fs/ubifs/replay.c
+index ae5c02f22f3e..d998fbf7de30 100644
+--- a/fs/ubifs/replay.c
++++ b/fs/ubifs/replay.c
+@@ -209,6 +209,38 @@ static int trun_remove_range(struct ubifs_info *c, struct replay_entry *r)
+ 	return ubifs_tnc_remove_range(c, &min_key, &max_key);
+ }
+ 
++/**
++ * inode_still_linked - check whether inode in question will be re-linked.
++ * @c: UBIFS file-system description object
++ * @rino: replay entry to test
++ *
++ * O_TMPFILE files can be re-linked, this means link count goes from 0 to 1.
++ * This case needs special care, otherwise all references to the inode will
++ * be removed upon the first replay entry of an inode with link count 0
++ * is found.
++ */
++static bool inode_still_linked(struct ubifs_info *c, struct replay_entry *rino)
++{
++	struct replay_entry *r;
++
++	ubifs_assert(rino->deletion);
++	ubifs_assert(key_type(c, &rino->key) == UBIFS_INO_KEY);
++
++	/*
++	 * Find the most recent entry for the inode behind @rino and check
++	 * whether it is a deletion.
++	 */
++	list_for_each_entry_reverse(r, &c->replay_list, list) {
++		ubifs_assert(r->sqnum >= rino->sqnum);
++		if (key_inum(c, &r->key) == key_inum(c, &rino->key))
++			return r->deletion == 0;
++
++	}
++
++	ubifs_assert(0);
++	return false;
++}
++
+ /**
+  * apply_replay_entry - apply a replay entry to the TNC.
+  * @c: UBIFS file-system description object
+@@ -239,6 +271,11 @@ static int apply_replay_entry(struct ubifs_info *c, struct replay_entry *r)
+ 			{
+ 				ino_t inum = key_inum(c, &r->key);
+ 
++				if (inode_still_linked(c, r)) {
++					err = 0;
++					break;
++				}
++
+ 				err = ubifs_tnc_remove_ino(c, inum);
+ 				break;
+ 			}
+diff --git a/include/linux/math64.h b/include/linux/math64.h
+index 082de345b73c..3a7a14062668 100644
+--- a/include/linux/math64.h
++++ b/include/linux/math64.h
+@@ -254,4 +254,7 @@ static inline u64 mul_u64_u32_div(u64 a, u32 mul, u32 divisor)
+ }
+ #endif /* mul_u64_u32_div */
+ 
++#define DIV64_U64_ROUND_UP(ll, d)	\
++	({ u64 _tmp = (d); div64_u64((ll) + _tmp - 1, _tmp); })
++
+ #endif /* _LINUX_MATH64_H */
+diff --git a/kernel/panic.c b/kernel/panic.c
+index bdd18afa19a4..32ff6fd30201 100644
+--- a/kernel/panic.c
++++ b/kernel/panic.c
+@@ -14,6 +14,7 @@
+ #include <linux/kmsg_dump.h>
+ #include <linux/kallsyms.h>
+ #include <linux/notifier.h>
++#include <linux/vt_kern.h>
+ #include <linux/module.h>
+ #include <linux/random.h>
+ #include <linux/ftrace.h>
+@@ -230,7 +231,10 @@ void panic(const char *fmt, ...)
+ 	if (_crash_kexec_post_notifiers)
+ 		__crash_kexec(NULL);
+ 
+-	bust_spinlocks(0);
++#ifdef CONFIG_VT
++	unblank_screen();
++#endif
++	console_unblank();
+ 
+ 	/*
+ 	 * We may have ended up stopping the CPU holding the lock (in
+diff --git a/kernel/time/posix-timers.c b/kernel/time/posix-timers.c
+index 55d45fe2cc17..d7e478a430e9 100644
+--- a/kernel/time/posix-timers.c
++++ b/kernel/time/posix-timers.c
+@@ -298,9 +298,6 @@ static void common_hrtimer_rearm(struct k_itimer *timr)
+ {
+ 	struct hrtimer *timer = &timr->it.real.timer;
+ 
+-	if (!timr->it_interval)
+-		return;
+-
+ 	timr->it_overrun += hrtimer_forward(timer, timer->base->get_time(),
+ 					    timr->it_interval);
+ 	hrtimer_restart(timer);
+@@ -326,7 +323,7 @@ void posixtimer_rearm(struct siginfo *info)
+ 	if (!timr)
+ 		return;
+ 
+-	if (timr->it_requeue_pending == info->si_sys_private) {
++	if (timr->it_interval && timr->it_requeue_pending == info->si_sys_private) {
+ 		timr->kclock->timer_rearm(timr);
+ 
+ 		timr->it_active = 1;
+diff --git a/mm/vmscan.c b/mm/vmscan.c
+index be56e2e1931e..9734e62654fa 100644
+--- a/mm/vmscan.c
++++ b/mm/vmscan.c
+@@ -2367,9 +2367,11 @@ out:
+ 			/*
+ 			 * Scan types proportional to swappiness and
+ 			 * their relative recent reclaim efficiency.
++			 * Make sure we don't miss the last page
++			 * because of a round-off error.
+ 			 */
+-			scan = div64_u64(scan * fraction[file],
+-					 denominator);
++			scan = DIV64_U64_ROUND_UP(scan * fraction[file],
++						  denominator);
+ 			break;
+ 		case SCAN_FILE:
+ 		case SCAN_ANON:
+diff --git a/sound/soc/codecs/sta32x.c b/sound/soc/codecs/sta32x.c
+index 5b888476d9ff..b728140c79a9 100644
+--- a/sound/soc/codecs/sta32x.c
++++ b/sound/soc/codecs/sta32x.c
+@@ -879,6 +879,9 @@ static int sta32x_probe(struct snd_soc_codec *codec)
+ 	struct sta32x_priv *sta32x = snd_soc_codec_get_drvdata(codec);
+ 	struct sta32x_platform_data *pdata = sta32x->pdata;
+ 	int i, ret = 0, thermal = 0;
++
++	sta32x->codec = codec;
++
+ 	ret = regulator_bulk_enable(ARRAY_SIZE(sta32x->supplies),
+ 				    sta32x->supplies);
+ 	if (ret != 0) {
+diff --git a/tools/perf/builtin-record.c b/tools/perf/builtin-record.c
+index b205c1340456..5e53cafe6cf9 100644
+--- a/tools/perf/builtin-record.c
++++ b/tools/perf/builtin-record.c
+@@ -800,13 +800,10 @@ static int record__synthesize(struct record *rec, bool tail)
+ 		return 0;
+ 
+ 	if (file->is_pipe) {
+-		err = perf_event__synthesize_features(
+-			tool, session, rec->evlist, process_synthesized_event);
+-		if (err < 0) {
+-			pr_err("Couldn't synthesize features.\n");
+-			return err;
+-		}
+-
++		/*
++		 * We need to synthesize events first, because some
++		 * features works on top of them (on report side).
++		 */
+ 		err = perf_event__synthesize_attrs(tool, session,
+ 						   process_synthesized_event);
+ 		if (err < 0) {
+@@ -814,6 +811,13 @@ static int record__synthesize(struct record *rec, bool tail)
+ 			goto out;
+ 		}
+ 
++		err = perf_event__synthesize_features(tool, session, rec->evlist,
++						      process_synthesized_event);
++		if (err < 0) {
++			pr_err("Couldn't synthesize features.\n");
++			return err;
++		}
++
+ 		if (have_tracepoints(&rec->evlist->entries)) {
+ 			/*
+ 			 * FIXME err <= 0 here actually means that