[gentoo-commits] linux-patches r2714 - genpatches-2.6/trunk/3.12

[Tom Wijsman (tomwij)]

Author: tomwij
Date: 2014-03-26 23:50:15 +0000 (Wed, 26 Mar 2014)
New Revision: 2714

Added:
   genpatches-2.6/trunk/3.12/1014_linux-3.12.15.patch
Modified:
   genpatches-2.6/trunk/3.12/0000_README
Log:
Linux patch 3.12.15.

Modified: genpatches-2.6/trunk/3.12/0000_README
===================================================================
--- genpatches-2.6/trunk/3.12/0000_README	2014-03-24 13:48:24 UTC (rev 2713)
+++ genpatches-2.6/trunk/3.12/0000_README	2014-03-26 23:50:15 UTC (rev 2714)
@@ -98,6 +98,10 @@
 From:   http://www.kernel.org
 Desc:   Linux 3.12.14
 
+Patch:  1014_linux-3.12.15.patch
+From:   http://www.kernel.org
+Desc:   Linux 3.12.15
+
 Patch:  1500_XATTR_USER_PREFIX.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=470644
 Desc:   Support for namespace user.pax.* on tmpfs.

Added: genpatches-2.6/trunk/3.12/1014_linux-3.12.15.patch
===================================================================
--- genpatches-2.6/trunk/3.12/1014_linux-3.12.15.patch	                        (rev 0)
+++ genpatches-2.6/trunk/3.12/1014_linux-3.12.15.patch	2014-03-26 23:50:15 UTC (rev 2714)
@@ -0,0 +1,7386 @@
+diff --git a/Makefile b/Makefile
+index 5d38a5a79b3a..517391a3093e 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 12
+-SUBLEVEL = 14
++SUBLEVEL = 15
+ EXTRAVERSION =
+ NAME = One Giant Leap for Frogkind
+ 
+diff --git a/arch/arm/mach-sa1100/include/mach/collie.h b/arch/arm/mach-sa1100/include/mach/collie.h
+index f33679d2d3ee..50e1d850ee2e 100644
+--- a/arch/arm/mach-sa1100/include/mach/collie.h
++++ b/arch/arm/mach-sa1100/include/mach/collie.h
+@@ -13,6 +13,8 @@
+ #ifndef __ASM_ARCH_COLLIE_H
+ #define __ASM_ARCH_COLLIE_H
+ 
++#include "hardware.h" /* Gives GPIO_MAX */
++
+ extern void locomolcd_power(int on);
+ 
+ #define COLLIE_SCOOP_GPIO_BASE	(GPIO_MAX + 1)
+diff --git a/arch/arm64/include/asm/pgtable.h b/arch/arm64/include/asm/pgtable.h
+index 0b27b6574296..965c28ff7b3b 100644
+--- a/arch/arm64/include/asm/pgtable.h
++++ b/arch/arm64/include/asm/pgtable.h
+@@ -136,10 +136,10 @@ extern struct page *empty_zero_page;
+ /*
+  * The following only work if pte_present(). Undefined behaviour otherwise.
+  */
+-#define pte_present(pte)	(pte_val(pte) & (PTE_VALID | PTE_PROT_NONE))
+-#define pte_dirty(pte)		(pte_val(pte) & PTE_DIRTY)
+-#define pte_young(pte)		(pte_val(pte) & PTE_AF)
+-#define pte_special(pte)	(pte_val(pte) & PTE_SPECIAL)
++#define pte_present(pte)	(!!(pte_val(pte) & (PTE_VALID | PTE_PROT_NONE)))
++#define pte_dirty(pte)		(!!(pte_val(pte) & PTE_DIRTY))
++#define pte_young(pte)		(!!(pte_val(pte) & PTE_AF))
++#define pte_special(pte)	(!!(pte_val(pte) & PTE_SPECIAL))
+ #define pte_write(pte)		(!(pte_val(pte) & PTE_RDONLY))
+ #define pte_exec(pte)		(!(pte_val(pte) & PTE_UXN))
+ 
+diff --git a/arch/mips/include/asm/mipsregs.h b/arch/mips/include/asm/mipsregs.h
+index e0331414c7d6..86479bbf4714 100644
+--- a/arch/mips/include/asm/mipsregs.h
++++ b/arch/mips/include/asm/mipsregs.h
+@@ -14,6 +14,7 @@
+ #define _ASM_MIPSREGS_H
+ 
+ #include <linux/linkage.h>
++#include <linux/types.h>
+ #include <asm/hazards.h>
+ #include <asm/war.h>
+ 
+diff --git a/arch/powerpc/include/asm/ppc_asm.h b/arch/powerpc/include/asm/ppc_asm.h
+index 599545738af3..c2dcfaa51987 100644
+--- a/arch/powerpc/include/asm/ppc_asm.h
++++ b/arch/powerpc/include/asm/ppc_asm.h
+@@ -478,13 +478,6 @@ BEGIN_FTR_SECTION_NESTED(945)						\
+ 	std	ra,TASKTHREADPPR(rb);					\
+ END_FTR_SECTION_NESTED(CPU_FTR_HAS_PPR,CPU_FTR_HAS_PPR,945)
+ 
+-#define RESTORE_PPR(ra, rb)						\
+-BEGIN_FTR_SECTION_NESTED(946)						\
+-	ld	ra,PACACURRENT(r13);					\
+-	ld	rb,TASKTHREADPPR(ra);					\
+-	mtspr	SPRN_PPR,rb;	/* Restore PPR */			\
+-END_FTR_SECTION_NESTED(CPU_FTR_HAS_PPR,CPU_FTR_HAS_PPR,946)
+-
+ #endif
+ 
+ /*
+diff --git a/arch/powerpc/kernel/entry_64.S b/arch/powerpc/kernel/entry_64.S
+index c04cdf70d487..7be37170fda7 100644
+--- a/arch/powerpc/kernel/entry_64.S
++++ b/arch/powerpc/kernel/entry_64.S
+@@ -820,6 +820,12 @@ fast_exception_return:
+ 	andi.	r0,r3,MSR_RI
+ 	beq-	unrecov_restore
+ 
++	/* Load PPR from thread struct before we clear MSR:RI */
++BEGIN_FTR_SECTION
++	ld	r2,PACACURRENT(r13)
++	ld	r2,TASKTHREADPPR(r2)
++END_FTR_SECTION_IFSET(CPU_FTR_HAS_PPR)
++
+ 	/*
+ 	 * Clear RI before restoring r13.  If we are returning to
+ 	 * userspace and we take an exception after restoring r13,
+@@ -840,8 +846,10 @@ fast_exception_return:
+ 	 */
+ 	andi.	r0,r3,MSR_PR
+ 	beq	1f
++BEGIN_FTR_SECTION
++	mtspr	SPRN_PPR,r2	/* Restore PPR */
++END_FTR_SECTION_IFSET(CPU_FTR_HAS_PPR)
+ 	ACCOUNT_CPU_USER_EXIT(r2, r4)
+-	RESTORE_PPR(r2, r4)
+ 	REST_GPR(13, r1)
+ 1:
+ 	mtspr	SPRN_SRR1,r3
+diff --git a/arch/powerpc/kernel/process.c b/arch/powerpc/kernel/process.c
+index 96d2fdf3aa9e..aa75b2beba7d 100644
+--- a/arch/powerpc/kernel/process.c
++++ b/arch/powerpc/kernel/process.c
+@@ -928,6 +928,15 @@ int arch_dup_task_struct(struct task_struct *dst, struct task_struct *src)
+ 	flush_altivec_to_thread(src);
+ 	flush_vsx_to_thread(src);
+ 	flush_spe_to_thread(src);
++	/*
++	 * Flush TM state out so we can copy it.  __switch_to_tm() does this
++	 * flush but it removes the checkpointed state from the current CPU and
++	 * transitions the CPU out of TM mode.  Hence we need to call
++	 * tm_recheckpoint_new_task() (on the same task) to restore the
++	 * checkpointed state back and the TM mode.
++	 */
++	__switch_to_tm(src);
++	tm_recheckpoint_new_task(src);
+ 
+ 	*dst = *src;
+ 
+diff --git a/arch/powerpc/kernel/reloc_64.S b/arch/powerpc/kernel/reloc_64.S
+index b47a0e1ab001..c712ecec13ba 100644
+--- a/arch/powerpc/kernel/reloc_64.S
++++ b/arch/powerpc/kernel/reloc_64.S
+@@ -81,6 +81,7 @@ _GLOBAL(relocate)
+ 
+ 6:	blr
+ 
++.balign 8
+ p_dyn:	.llong	__dynamic_start - 0b
+ p_rela:	.llong	__rela_dyn_start - 0b
+ p_st:	.llong	_stext - 0b
+diff --git a/arch/s390/Kconfig b/arch/s390/Kconfig
+index 7143793859fa..3e01afa21710 100644
+--- a/arch/s390/Kconfig
++++ b/arch/s390/Kconfig
+@@ -100,7 +100,7 @@ config S390
+ 	select GENERIC_CLOCKEVENTS
+ 	select GENERIC_CPU_DEVICES if !SMP
+ 	select GENERIC_SMP_IDLE_THREAD
+-	select GENERIC_TIME_VSYSCALL_OLD
++	select GENERIC_TIME_VSYSCALL
+ 	select HAVE_ALIGNED_STRUCT_PAGE if SLUB
+ 	select HAVE_ARCH_JUMP_LABEL if !MARCH_G5
+ 	select HAVE_ARCH_SECCOMP_FILTER
+diff --git a/arch/s390/appldata/appldata_base.c b/arch/s390/appldata/appldata_base.c
+index 87a22092b68f..6c0281f30d44 100644
+--- a/arch/s390/appldata/appldata_base.c
++++ b/arch/s390/appldata/appldata_base.c
+@@ -527,6 +527,7 @@ static int __init appldata_init(void)
+ {
+ 	int rc;
+ 
++	init_virt_timer(&appldata_timer);
+ 	appldata_timer.function = appldata_timer_function;
+ 	appldata_timer.data = (unsigned long) &appldata_work;
+ 
+diff --git a/arch/s390/include/asm/vdso.h b/arch/s390/include/asm/vdso.h
+index a73eb2e1e918..bc9746a7d47c 100644
+--- a/arch/s390/include/asm/vdso.h
++++ b/arch/s390/include/asm/vdso.h
+@@ -26,8 +26,9 @@ struct vdso_data {
+ 	__u64 wtom_clock_nsec;		/*				0x28 */
+ 	__u32 tz_minuteswest;		/* Minutes west of Greenwich	0x30 */
+ 	__u32 tz_dsttime;		/* Type of dst correction	0x34 */
+-	__u32 ectg_available;
+-	__u32 ntp_mult;			/* NTP adjusted multiplier	0x3C */
++	__u32 ectg_available;		/* ECTG instruction present	0x38 */
++	__u32 tk_mult;			/* Mult. used for xtime_nsec	0x3c */
++	__u32 tk_shift;			/* Shift used for xtime_nsec	0x40 */
+ };
+ 
+ struct vdso_per_cpu_data {
+diff --git a/arch/s390/kernel/asm-offsets.c b/arch/s390/kernel/asm-offsets.c
+index 2416138ebd3e..496116cd65ec 100644
+--- a/arch/s390/kernel/asm-offsets.c
++++ b/arch/s390/kernel/asm-offsets.c
+@@ -65,7 +65,8 @@ int main(void)
+ 	DEFINE(__VDSO_WTOM_NSEC, offsetof(struct vdso_data, wtom_clock_nsec));
+ 	DEFINE(__VDSO_TIMEZONE, offsetof(struct vdso_data, tz_minuteswest));
+ 	DEFINE(__VDSO_ECTG_OK, offsetof(struct vdso_data, ectg_available));
+-	DEFINE(__VDSO_NTP_MULT, offsetof(struct vdso_data, ntp_mult));
++	DEFINE(__VDSO_TK_MULT, offsetof(struct vdso_data, tk_mult));
++	DEFINE(__VDSO_TK_SHIFT, offsetof(struct vdso_data, tk_shift));
+ 	DEFINE(__VDSO_ECTG_BASE, offsetof(struct vdso_per_cpu_data, ectg_timer_base));
+ 	DEFINE(__VDSO_ECTG_USER, offsetof(struct vdso_per_cpu_data, ectg_user_time));
+ 	/* constants used by the vdso */
+diff --git a/arch/s390/kernel/time.c b/arch/s390/kernel/time.c
+index 064c3082ab33..dd95f1631621 100644
+--- a/arch/s390/kernel/time.c
++++ b/arch/s390/kernel/time.c
+@@ -108,20 +108,10 @@ static void fixup_clock_comparator(unsigned long long delta)
+ 	set_clock_comparator(S390_lowcore.clock_comparator);
+ }
+ 
+-static int s390_next_ktime(ktime_t expires,
++static int s390_next_event(unsigned long delta,
+ 			   struct clock_event_device *evt)
+ {
+-	struct timespec ts;
+-	u64 nsecs;
+-
+-	ts.tv_sec = ts.tv_nsec = 0;
+-	monotonic_to_bootbased(&ts);
+-	nsecs = ktime_to_ns(ktime_add(timespec_to_ktime(ts), expires));
+-	do_div(nsecs, 125);
+-	S390_lowcore.clock_comparator = sched_clock_base_cc + (nsecs << 9);
+-	/* Program the maximum value if we have an overflow (== year 2042) */
+-	if (unlikely(S390_lowcore.clock_comparator < sched_clock_base_cc))
+-		S390_lowcore.clock_comparator = -1ULL;
++	S390_lowcore.clock_comparator = get_tod_clock() + delta;
+ 	set_clock_comparator(S390_lowcore.clock_comparator);
+ 	return 0;
+ }
+@@ -146,15 +136,14 @@ void init_cpu_timer(void)
+ 	cpu = smp_processor_id();
+ 	cd = &per_cpu(comparators, cpu);
+ 	cd->name		= "comparator";
+-	cd->features		= CLOCK_EVT_FEAT_ONESHOT |
+-				  CLOCK_EVT_FEAT_KTIME;
++	cd->features		= CLOCK_EVT_FEAT_ONESHOT;
+ 	cd->mult		= 16777;
+ 	cd->shift		= 12;
+ 	cd->min_delta_ns	= 1;
+ 	cd->max_delta_ns	= LONG_MAX;
+ 	cd->rating		= 400;
+ 	cd->cpumask		= cpumask_of(cpu);
+-	cd->set_next_ktime	= s390_next_ktime;
++	cd->set_next_event	= s390_next_event;
+ 	cd->set_mode		= s390_set_mode;
+ 
+ 	clockevents_register_device(cd);
+@@ -221,21 +210,30 @@ struct clocksource * __init clocksource_default_clock(void)
+ 	return &clocksource_tod;
+ }
+ 
+-void update_vsyscall_old(struct timespec *wall_time, struct timespec *wtm,
+-			struct clocksource *clock, u32 mult)
++void update_vsyscall(struct timekeeper *tk)
+ {
+-	if (clock != &clocksource_tod)
++	u64 nsecps;
++
++	if (tk->clock != &clocksource_tod)
+ 		return;
+ 
+ 	/* Make userspace gettimeofday spin until we're done. */
+ 	++vdso_data->tb_update_count;
+ 	smp_wmb();
+-	vdso_data->xtime_tod_stamp = clock->cycle_last;
+-	vdso_data->xtime_clock_sec = wall_time->tv_sec;
+-	vdso_data->xtime_clock_nsec = wall_time->tv_nsec;
+-	vdso_data->wtom_clock_sec = wtm->tv_sec;
+-	vdso_data->wtom_clock_nsec = wtm->tv_nsec;
+-	vdso_data->ntp_mult = mult;
++	vdso_data->xtime_tod_stamp = tk->clock->cycle_last;
++	vdso_data->xtime_clock_sec = tk->xtime_sec;
++	vdso_data->xtime_clock_nsec = tk->xtime_nsec;
++	vdso_data->wtom_clock_sec =
++		tk->xtime_sec + tk->wall_to_monotonic.tv_sec;
++	vdso_data->wtom_clock_nsec = tk->xtime_nsec +
++		+ (tk->wall_to_monotonic.tv_nsec << tk->shift);
++	nsecps = (u64) NSEC_PER_SEC << tk->shift;
++	while (vdso_data->wtom_clock_nsec >= nsecps) {
++		vdso_data->wtom_clock_nsec -= nsecps;
++		vdso_data->wtom_clock_sec++;
++	}
++	vdso_data->tk_mult = tk->mult;
++	vdso_data->tk_shift = tk->shift;
+ 	smp_wmb();
+ 	++vdso_data->tb_update_count;
+ }
+diff --git a/arch/s390/kernel/vdso32/clock_gettime.S b/arch/s390/kernel/vdso32/clock_gettime.S
+index b2224e0b974c..5be8e472f57d 100644
+--- a/arch/s390/kernel/vdso32/clock_gettime.S
++++ b/arch/s390/kernel/vdso32/clock_gettime.S
+@@ -38,25 +38,26 @@ __kernel_clock_gettime:
+ 	sl	%r1,__VDSO_XTIME_STAMP+4(%r5)
+ 	brc	3,2f
+ 	ahi	%r0,-1
+-2:	ms	%r0,__VDSO_NTP_MULT(%r5)	/* cyc2ns(clock,cycle_delta) */
++2:	ms	%r0,__VDSO_TK_MULT(%r5)		/*  * tk->mult */
+ 	lr	%r2,%r0
+-	l	%r0,__VDSO_NTP_MULT(%r5)
++	l	%r0,__VDSO_TK_MULT(%r5)
+ 	ltr	%r1,%r1
+ 	mr	%r0,%r0
+ 	jnm	3f
+-	a	%r0,__VDSO_NTP_MULT(%r5)
++	a	%r0,__VDSO_TK_MULT(%r5)
+ 3:	alr	%r0,%r2
+-	srdl	%r0,12
+-	al	%r0,__VDSO_XTIME_NSEC(%r5)	/*  + xtime */
++	al	%r0,__VDSO_XTIME_NSEC(%r5)	/*  + tk->xtime_nsec */
+ 	al	%r1,__VDSO_XTIME_NSEC+4(%r5)
+ 	brc	12,4f
+ 	ahi	%r0,1
+-4:	l	%r2,__VDSO_XTIME_SEC+4(%r5)
+-	al	%r0,__VDSO_WTOM_NSEC(%r5)	/*  + wall_to_monotonic */
++4:	al	%r0,__VDSO_WTOM_NSEC(%r5)	/*  + wall_to_monotonic.nsec */
+ 	al	%r1,__VDSO_WTOM_NSEC+4(%r5)
+ 	brc	12,5f
+ 	ahi	%r0,1
+-5:	al	%r2,__VDSO_WTOM_SEC+4(%r5)
++5:	l	%r2,__VDSO_TK_SHIFT(%r5)	/* Timekeeper shift */
++	srdl	%r0,0(%r2)			/*  >> tk->shift */
++	l	%r2,__VDSO_XTIME_SEC+4(%r5)
++	al	%r2,__VDSO_WTOM_SEC+4(%r5)
+ 	cl	%r4,__VDSO_UPD_COUNT+4(%r5)	/* check update counter */
+ 	jne	1b
+ 	basr	%r5,0
+@@ -86,20 +87,21 @@ __kernel_clock_gettime:
+ 	sl	%r1,__VDSO_XTIME_STAMP+4(%r5)
+ 	brc	3,12f
+ 	ahi	%r0,-1
+-12:	ms	%r0,__VDSO_NTP_MULT(%r5)	/* cyc2ns(clock,cycle_delta) */
++12:	ms	%r0,__VDSO_TK_MULT(%r5)		/*  * tk->mult */
+ 	lr	%r2,%r0
+-	l	%r0,__VDSO_NTP_MULT(%r5)
++	l	%r0,__VDSO_TK_MULT(%r5)
+ 	ltr	%r1,%r1
+ 	mr	%r0,%r0
+ 	jnm	13f
+-	a	%r0,__VDSO_NTP_MULT(%r5)
++	a	%r0,__VDSO_TK_MULT(%r5)
+ 13:	alr	%r0,%r2
+-	srdl	%r0,12
+-	al	%r0,__VDSO_XTIME_NSEC(%r5)	/*  + xtime */
++	al	%r0,__VDSO_XTIME_NSEC(%r5)	/*  + tk->xtime_nsec */
+ 	al	%r1,__VDSO_XTIME_NSEC+4(%r5)
+ 	brc	12,14f
+ 	ahi	%r0,1
+-14:	l	%r2,__VDSO_XTIME_SEC+4(%r5)
++14:	l	%r2,__VDSO_TK_SHIFT(%r5)	/* Timekeeper shift */
++	srdl	%r0,0(%r2)			/*  >> tk->shift */
++	l	%r2,__VDSO_XTIME_SEC+4(%r5)
+ 	cl	%r4,__VDSO_UPD_COUNT+4(%r5)	/* check update counter */
+ 	jne	11b
+ 	basr	%r5,0
+diff --git a/arch/s390/kernel/vdso32/gettimeofday.S b/arch/s390/kernel/vdso32/gettimeofday.S
+index 2d3633175e3b..fd621a950f7c 100644
+--- a/arch/s390/kernel/vdso32/gettimeofday.S
++++ b/arch/s390/kernel/vdso32/gettimeofday.S
+@@ -35,15 +35,14 @@ __kernel_gettimeofday:
+ 	sl	%r1,__VDSO_XTIME_STAMP+4(%r5)
+ 	brc	3,3f
+ 	ahi	%r0,-1
+-3:	ms	%r0,__VDSO_NTP_MULT(%r5)	/* cyc2ns(clock,cycle_delta) */
++3:	ms	%r0,__VDSO_TK_MULT(%r5)		/*  * tk->mult */
+ 	st	%r0,24(%r15)
+-	l	%r0,__VDSO_NTP_MULT(%r5)
++	l	%r0,__VDSO_TK_MULT(%r5)
+ 	ltr	%r1,%r1
+ 	mr	%r0,%r0
+ 	jnm	4f
+-	a	%r0,__VDSO_NTP_MULT(%r5)
++	a	%r0,__VDSO_TK_MULT(%r5)
+ 4:	al	%r0,24(%r15)
+-	srdl	%r0,12
+ 	al	%r0,__VDSO_XTIME_NSEC(%r5)	/*  + xtime */
+ 	al	%r1,__VDSO_XTIME_NSEC+4(%r5)
+ 	brc	12,5f
+@@ -51,6 +50,8 @@ __kernel_gettimeofday:
+ 5:	mvc	24(4,%r15),__VDSO_XTIME_SEC+4(%r5)
+ 	cl	%r4,__VDSO_UPD_COUNT+4(%r5)	/* check update counter */
+ 	jne	1b
++	l	%r4,__VDSO_TK_SHIFT(%r5)	/* Timekeeper shift */
++	srdl	%r0,0(%r4)			/*  >> tk->shift */
+ 	l	%r4,24(%r15)			/* get tv_sec from stack */
+ 	basr	%r5,0
+ 6:	ltr	%r0,%r0
+diff --git a/arch/s390/kernel/vdso64/clock_gettime.S b/arch/s390/kernel/vdso64/clock_gettime.S
+index d46c95ed5f19..0add1072ba30 100644
+--- a/arch/s390/kernel/vdso64/clock_gettime.S
++++ b/arch/s390/kernel/vdso64/clock_gettime.S
+@@ -34,14 +34,15 @@ __kernel_clock_gettime:
+ 	tmll	%r4,0x0001			/* pending update ? loop */
+ 	jnz	0b
+ 	stck	48(%r15)			/* Store TOD clock */
++	lgf	%r2,__VDSO_TK_SHIFT(%r5)	/* Timekeeper shift */
++	lg	%r0,__VDSO_XTIME_SEC(%r5)	/* tk->xtime_sec */
++	alg	%r0,__VDSO_WTOM_SEC(%r5)	/*  + wall_to_monotonic.sec */
+ 	lg	%r1,48(%r15)
+ 	sg	%r1,__VDSO_XTIME_STAMP(%r5)	/* TOD - cycle_last */
+-	msgf	%r1,__VDSO_NTP_MULT(%r5)	/*  * NTP adjustment */
+-	srlg	%r1,%r1,12			/* cyc2ns(clock,cycle_delta) */
+-	alg	%r1,__VDSO_XTIME_NSEC(%r5)	/*  + xtime */
+-	lg	%r0,__VDSO_XTIME_SEC(%r5)
+-	alg	%r1,__VDSO_WTOM_NSEC(%r5)	/*  + wall_to_monotonic */
+-	alg	%r0,__VDSO_WTOM_SEC(%r5)
++	msgf	%r1,__VDSO_TK_MULT(%r5)		/*  * tk->mult */
++	alg	%r1,__VDSO_XTIME_NSEC(%r5)	/*  + tk->xtime_nsec */
++	alg	%r1,__VDSO_WTOM_NSEC(%r5)	/*  + wall_to_monotonic.nsec */
++	srlg	%r1,%r1,0(%r2)			/*  >> tk->shift */
+ 	clg	%r4,__VDSO_UPD_COUNT(%r5)	/* check update counter */
+ 	jne	0b
+ 	larl	%r5,13f
+@@ -62,12 +63,13 @@ __kernel_clock_gettime:
+ 	tmll	%r4,0x0001			/* pending update ? loop */
+ 	jnz	5b
+ 	stck	48(%r15)			/* Store TOD clock */
++	lgf	%r2,__VDSO_TK_SHIFT(%r5)	/* Timekeeper shift */
+ 	lg	%r1,48(%r15)
+ 	sg	%r1,__VDSO_XTIME_STAMP(%r5)	/* TOD - cycle_last */
+-	msgf	%r1,__VDSO_NTP_MULT(%r5)	/*  * NTP adjustment */
+-	srlg	%r1,%r1,12			/* cyc2ns(clock,cycle_delta) */
+-	alg	%r1,__VDSO_XTIME_NSEC(%r5)	/*  + xtime */
+-	lg	%r0,__VDSO_XTIME_SEC(%r5)
++	msgf	%r1,__VDSO_TK_MULT(%r5)		/*  * tk->mult */
++	alg	%r1,__VDSO_XTIME_NSEC(%r5)	/*  + tk->xtime_nsec */
++	srlg	%r1,%r1,0(%r2)			/*  >> tk->shift */
++	lg	%r0,__VDSO_XTIME_SEC(%r5)	/* tk->xtime_sec */
+ 	clg	%r4,__VDSO_UPD_COUNT(%r5)	/* check update counter */
+ 	jne	5b
+ 	larl	%r5,13f
+diff --git a/arch/s390/kernel/vdso64/gettimeofday.S b/arch/s390/kernel/vdso64/gettimeofday.S
+index 36ee674722ec..d0860d1d0ccc 100644
+--- a/arch/s390/kernel/vdso64/gettimeofday.S
++++ b/arch/s390/kernel/vdso64/gettimeofday.S
+@@ -31,12 +31,13 @@ __kernel_gettimeofday:
+ 	stck	48(%r15)			/* Store TOD clock */
+ 	lg	%r1,48(%r15)
+ 	sg	%r1,__VDSO_XTIME_STAMP(%r5)	/* TOD - cycle_last */
+-	msgf	%r1,__VDSO_NTP_MULT(%r5)	/*  * NTP adjustment */
+-	srlg	%r1,%r1,12			/* cyc2ns(clock,cycle_delta) */
+-	alg	%r1,__VDSO_XTIME_NSEC(%r5)	/*  + xtime.tv_nsec */
+-	lg	%r0,__VDSO_XTIME_SEC(%r5)	/* xtime.tv_sec */
++	msgf	%r1,__VDSO_TK_MULT(%r5)		/*  * tk->mult */
++	alg	%r1,__VDSO_XTIME_NSEC(%r5)	/*  + tk->xtime_nsec */
++	lg	%r0,__VDSO_XTIME_SEC(%r5)	/* tk->xtime_sec */
+ 	clg	%r4,__VDSO_UPD_COUNT(%r5)	/* check update counter */
+ 	jne	0b
++	lgf	%r5,__VDSO_TK_SHIFT(%r5)	/* Timekeeper shift */
++	srlg	%r1,%r1,0(%r5)			/*  >> tk->shift */
+ 	larl	%r5,5f
+ 2:	clg	%r1,0(%r5)
+ 	jl	3f
+diff --git a/arch/x86/include/asm/kdebug.h b/arch/x86/include/asm/kdebug.h
+index 2c37aadcbc35..32ce71375b21 100644
+--- a/arch/x86/include/asm/kdebug.h
++++ b/arch/x86/include/asm/kdebug.h
+@@ -21,7 +21,7 @@ enum die_val {
+ 	DIE_NMIUNKNOWN,
+ };
+ 
+-extern void printk_address(unsigned long address, int reliable);
++extern void printk_address(unsigned long address);
+ extern void die(const char *, struct pt_regs *,long);
+ extern int __must_check __die(const char *, struct pt_regs *, long);
+ extern void show_trace(struct task_struct *t, struct pt_regs *regs,
+diff --git a/arch/x86/kernel/dumpstack.c b/arch/x86/kernel/dumpstack.c
+index deb6421c9e69..d9c12d3022a7 100644
+--- a/arch/x86/kernel/dumpstack.c
++++ b/arch/x86/kernel/dumpstack.c
+@@ -25,12 +25,17 @@ unsigned int code_bytes = 64;
+ int kstack_depth_to_print = 3 * STACKSLOTS_PER_LINE;
+ static int die_counter;
+ 
+-void printk_address(unsigned long address, int reliable)
++static void printk_stack_address(unsigned long address, int reliable)
+ {
+ 	pr_cont(" [<%p>] %s%pB\n",
+ 		(void *)address, reliable ? "" : "? ", (void *)address);
+ }
+ 
++void printk_address(unsigned long address)
++{
++	pr_cont(" [<%p>] %pS\n", (void *)address, (void *)address);
++}
++
+ #ifdef CONFIG_FUNCTION_GRAPH_TRACER
+ static void
+ print_ftrace_graph_addr(unsigned long addr, void *data,
+@@ -151,7 +156,7 @@ static void print_trace_address(void *data, unsigned long addr, int reliable)
+ {
+ 	touch_nmi_watchdog();
+ 	printk(data);
+-	printk_address(addr, reliable);
++	printk_stack_address(addr, reliable);
+ }
+ 
+ static const struct stacktrace_ops print_trace_ops = {
+@@ -281,7 +286,7 @@ int __kprobes __die(const char *str, struct pt_regs *regs, long err)
+ #else
+ 	/* Executive summary in case the oops scrolled away */
+ 	printk(KERN_ALERT "RIP ");
+-	printk_address(regs->ip, 1);
++	printk_address(regs->ip);
+ 	printk(" RSP <%016lx>\n", regs->sp);
+ #endif
+ 	return 0;
+diff --git a/arch/x86/kernel/head_32.S b/arch/x86/kernel/head_32.S
+index 81ba27679f18..f36bd42d6f0c 100644
+--- a/arch/x86/kernel/head_32.S
++++ b/arch/x86/kernel/head_32.S
+@@ -544,6 +544,10 @@ ENDPROC(early_idt_handlers)
+ 	/* This is global to keep gas from relaxing the jumps */
+ ENTRY(early_idt_handler)
+ 	cld
++
++	cmpl $2,(%esp)		# X86_TRAP_NMI
++	je is_nmi		# Ignore NMI
++
+ 	cmpl $2,%ss:early_recursion_flag
+ 	je hlt_loop
+ 	incl %ss:early_recursion_flag
+@@ -594,8 +598,9 @@ ex_entry:
+ 	pop %edx
+ 	pop %ecx
+ 	pop %eax
+-	addl $8,%esp		/* drop vector number and error code */
+ 	decl %ss:early_recursion_flag
++is_nmi:
++	addl $8,%esp		/* drop vector number and error code */
+ 	iret
+ ENDPROC(early_idt_handler)
+ 
+diff --git a/arch/x86/kernel/head_64.S b/arch/x86/kernel/head_64.S
+index e1aabdb314c8..a468c0a65c42 100644
+--- a/arch/x86/kernel/head_64.S
++++ b/arch/x86/kernel/head_64.S
+@@ -343,6 +343,9 @@ early_idt_handlers:
+ ENTRY(early_idt_handler)
+ 	cld
+ 
++	cmpl $2,(%rsp)		# X86_TRAP_NMI
++	je is_nmi		# Ignore NMI
++
+ 	cmpl $2,early_recursion_flag(%rip)
+ 	jz  1f
+ 	incl early_recursion_flag(%rip)
+@@ -405,8 +408,9 @@ ENTRY(early_idt_handler)
+ 	popq %rdx
+ 	popq %rcx
+ 	popq %rax
+-	addq $16,%rsp		# drop vector number and error code
+ 	decl early_recursion_flag(%rip)
++is_nmi:
++	addq $16,%rsp		# drop vector number and error code
+ 	INTERRUPT_RETURN
+ ENDPROC(early_idt_handler)
+ 
+diff --git a/arch/x86/kernel/i387.c b/arch/x86/kernel/i387.c
+index 5d576ab34403..21935afebe19 100644
+--- a/arch/x86/kernel/i387.c
++++ b/arch/x86/kernel/i387.c
+@@ -86,10 +86,19 @@ EXPORT_SYMBOL(__kernel_fpu_begin);
+ 
+ void __kernel_fpu_end(void)
+ {
+-	if (use_eager_fpu())
+-		math_state_restore();
+-	else
++	if (use_eager_fpu()) {
++		/*
++		 * For eager fpu, most the time, tsk_used_math() is true.
++		 * Restore the user math as we are done with the kernel usage.
++		 * At few instances during thread exit, signal handling etc,
++		 * tsk_used_math() is false. Those few places will take proper
++		 * actions, so we don't need to restore the math here.
++		 */
++		if (likely(tsk_used_math(current)))
++			math_state_restore();
++	} else {
+ 		stts();
++	}
+ }
+ EXPORT_SYMBOL(__kernel_fpu_end);
+ 
+diff --git a/arch/x86/kernel/process_64.c b/arch/x86/kernel/process_64.c
+index bb1dc51bab05..8e9fe8dfd37b 100644
+--- a/arch/x86/kernel/process_64.c
++++ b/arch/x86/kernel/process_64.c
+@@ -63,7 +63,7 @@ void __show_regs(struct pt_regs *regs, int all)
+ 	unsigned int ds, cs, es;
+ 
+ 	printk(KERN_DEFAULT "RIP: %04lx:[<%016lx>] ", regs->cs & 0xffff, regs->ip);
+-	printk_address(regs->ip, 1);
++	printk_address(regs->ip);
+ 	printk(KERN_DEFAULT "RSP: %04lx:%016lx  EFLAGS: %08lx\n", regs->ss,
+ 			regs->sp, regs->flags);
+ 	printk(KERN_DEFAULT "RAX: %016lx RBX: %016lx RCX: %016lx\n",
+diff --git a/arch/x86/kernel/quirks.c b/arch/x86/kernel/quirks.c
+index 04ee1e2e4c02..52dbf1e400dc 100644
+--- a/arch/x86/kernel/quirks.c
++++ b/arch/x86/kernel/quirks.c
+@@ -529,7 +529,7 @@ static void quirk_amd_nb_node(struct pci_dev *dev)
+ 		return;
+ 
+ 	pci_read_config_dword(nb_ht, 0x60, &val);
+-	node = val & 7;
++	node = pcibus_to_node(dev->bus) | (val & 7);
+ 	/*
+ 	 * Some hardware may return an invalid node ID,
+ 	 * so check it first:
+diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
+index c0bc80391e40..612c717747dd 100644
+--- a/arch/x86/kvm/svm.c
++++ b/arch/x86/kvm/svm.c
+@@ -2993,10 +2993,8 @@ static int cr8_write_interception(struct vcpu_svm *svm)
+ 	u8 cr8_prev = kvm_get_cr8(&svm->vcpu);
+ 	/* instruction emulation calls kvm_set_cr8() */
+ 	r = cr_interception(svm);
+-	if (irqchip_in_kernel(svm->vcpu.kvm)) {
+-		clr_cr_intercept(svm, INTERCEPT_CR8_WRITE);
++	if (irqchip_in_kernel(svm->vcpu.kvm))
+ 		return r;
+-	}
+ 	if (cr8_prev <= kvm_get_cr8(&svm->vcpu))
+ 		return r;
+ 	kvm_run->exit_reason = KVM_EXIT_SET_TPR;
+@@ -3558,6 +3556,8 @@ static void update_cr8_intercept(struct kvm_vcpu *vcpu, int tpr, int irr)
+ 	if (is_guest_mode(vcpu) && (vcpu->arch.hflags & HF_VINTR_MASK))
+ 		return;
+ 
++	clr_cr_intercept(svm, INTERCEPT_CR8_WRITE);
++
+ 	if (irr == -1)
+ 		return;
+ 
+diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c
+index d8b1ff68dbb9..5b90bbcad9f6 100644
+--- a/arch/x86/mm/fault.c
++++ b/arch/x86/mm/fault.c
+@@ -596,7 +596,7 @@ show_fault_oops(struct pt_regs *regs, unsigned long error_code,
+ 
+ 	printk(KERN_CONT " at %p\n", (void *) address);
+ 	printk(KERN_ALERT "IP:");
+-	printk_address(regs->ip, 1);
++	printk_address(regs->ip);
+ 
+ 	dump_pagetable(address);
+ }
+diff --git a/drivers/acpi/blacklist.c b/drivers/acpi/blacklist.c
+index 9515f18898b2..f37dec579712 100644
+--- a/drivers/acpi/blacklist.c
++++ b/drivers/acpi/blacklist.c
+@@ -297,6 +297,54 @@ static struct dmi_system_id acpi_osi_dmi_table[] __initdata = {
+ 		     DMI_MATCH(DMI_PRODUCT_VERSION, "3259A2G"),
+ 		},
+ 	},
++	{
++	.callback = dmi_disable_osi_win8,
++	.ident = "ThinkPad Edge E530",
++	.matches = {
++		     DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++		     DMI_MATCH(DMI_PRODUCT_VERSION, "3259CTO"),
++		},
++	},
++	{
++	.callback = dmi_disable_osi_win8,
++	.ident = "ThinkPad Edge E530",
++	.matches = {
++		     DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++		     DMI_MATCH(DMI_PRODUCT_VERSION, "3259HJG"),
++		},
++	},
++	{
++	.callback = dmi_disable_osi_win8,
++	.ident = "Acer Aspire V5-573G",
++	.matches = {
++		     DMI_MATCH(DMI_SYS_VENDOR, "Acer Aspire"),
++		     DMI_MATCH(DMI_PRODUCT_VERSION, "V5-573G/Dazzle_HW"),
++		},
++	},
++	{
++	.callback = dmi_disable_osi_win8,
++	.ident = "Acer Aspire V5-572G",
++	.matches = {
++		     DMI_MATCH(DMI_SYS_VENDOR, "Acer Aspire"),
++		     DMI_MATCH(DMI_PRODUCT_VERSION, "V5-572G/Dazzle_CX"),
++		},
++	},
++	{
++	.callback = dmi_disable_osi_win8,
++	.ident = "ThinkPad T431s",
++	.matches = {
++		     DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++		     DMI_MATCH(DMI_PRODUCT_VERSION, "20AACTO1WW"),
++		},
++	},
++	{
++	.callback = dmi_disable_osi_win8,
++	.ident = "ThinkPad T430",
++	.matches = {
++		     DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++		     DMI_MATCH(DMI_PRODUCT_VERSION, "2349D15"),
++		},
++	},
+ 
+ 	/*
+ 	 * BIOS invocation of _OSI(Linux) is almost always a BIOS bug.
+diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c
+index 15986f32009e..3cc0b92e3544 100644
+--- a/drivers/acpi/ec.c
++++ b/drivers/acpi/ec.c
+@@ -70,6 +70,8 @@ enum ec_command {
+ #define ACPI_EC_DELAY		500	/* Wait 500ms max. during EC ops */
+ #define ACPI_EC_UDELAY_GLK	1000	/* Wait 1ms max. to get global lock */
+ #define ACPI_EC_MSI_UDELAY	550	/* Wait 550us for MSI EC */
++#define ACPI_EC_CLEAR_MAX	100	/* Maximum number of events to query
++					 * when trying to clear the EC */
+ 
+ enum {
+ 	EC_FLAGS_QUERY_PENDING,		/* Query is pending */
+@@ -123,6 +125,7 @@ EXPORT_SYMBOL(first_ec);
+ static int EC_FLAGS_MSI; /* Out-of-spec MSI controller */
+ static int EC_FLAGS_VALIDATE_ECDT; /* ASUStec ECDTs need to be validated */
+ static int EC_FLAGS_SKIP_DSDT_SCAN; /* Not all BIOS survive early DSDT scan */
++static int EC_FLAGS_CLEAR_ON_RESUME; /* Needs acpi_ec_clear() on boot/resume */
+ 
+ /* --------------------------------------------------------------------------
+                              Transaction Management
+@@ -468,6 +471,29 @@ acpi_handle ec_get_handle(void)
+ 
+ EXPORT_SYMBOL(ec_get_handle);
+ 
++static int acpi_ec_query_unlocked(struct acpi_ec *ec, u8 *data);
++
++/*
++ * Clears stale _Q events that might have accumulated in the EC.
++ * Run with locked ec mutex.
++ */
++static void acpi_ec_clear(struct acpi_ec *ec)
++{
++	int i, status;
++	u8 value = 0;
++
++	for (i = 0; i < ACPI_EC_CLEAR_MAX; i++) {
++		status = acpi_ec_query_unlocked(ec, &value);
++		if (status || !value)
++			break;
++	}
++
++	if (unlikely(i == ACPI_EC_CLEAR_MAX))
++		pr_warn("Warning: Maximum of %d stale EC events cleared\n", i);
++	else
++		pr_info("%d stale EC events cleared\n", i);
++}
++
+ void acpi_ec_block_transactions(void)
+ {
+ 	struct acpi_ec *ec = first_ec;
+@@ -491,6 +517,10 @@ void acpi_ec_unblock_transactions(void)
+ 	mutex_lock(&ec->mutex);
+ 	/* Allow transactions to be carried out again */
+ 	clear_bit(EC_FLAGS_BLOCKED, &ec->flags);
++
++	if (EC_FLAGS_CLEAR_ON_RESUME)
++		acpi_ec_clear(ec);
++
+ 	mutex_unlock(&ec->mutex);
+ }
+ 
+@@ -848,6 +878,13 @@ static int acpi_ec_add(struct acpi_device *device)
+ 
+ 	/* EC is fully operational, allow queries */
+ 	clear_bit(EC_FLAGS_QUERY_PENDING, &ec->flags);
++
++	/* Clear stale _Q events if hardware might require that */
++	if (EC_FLAGS_CLEAR_ON_RESUME) {
++		mutex_lock(&ec->mutex);
++		acpi_ec_clear(ec);
++		mutex_unlock(&ec->mutex);
++	}
+ 	return ret;
+ }
+ 
+@@ -949,6 +986,30 @@ static int ec_enlarge_storm_threshold(const struct dmi_system_id *id)
+ 	return 0;
+ }
+ 
++/*
++ * On some hardware it is necessary to clear events accumulated by the EC during
++ * sleep. These ECs stop reporting GPEs until they are manually polled, if too
++ * many events are accumulated. (e.g. Samsung Series 5/9 notebooks)
++ *
++ * https://bugzilla.kernel.org/show_bug.cgi?id=44161
++ *
++ * Ideally, the EC should also be instructed NOT to accumulate events during
++ * sleep (which Windows seems to do somehow), but the interface to control this
++ * behaviour is not known at this time.
++ *
++ * Models known to be affected are Samsung 530Uxx/535Uxx/540Uxx/550Pxx/900Xxx,
++ * however it is very likely that other Samsung models are affected.
++ *
++ * On systems which don't accumulate _Q events during sleep, this extra check
++ * should be harmless.
++ */
++static int ec_clear_on_resume(const struct dmi_system_id *id)
++{
++	pr_debug("Detected system needing EC poll on resume.\n");
++	EC_FLAGS_CLEAR_ON_RESUME = 1;
++	return 0;
++}
++
+ static struct dmi_system_id ec_dmi_table[] __initdata = {
+ 	{
+ 	ec_skip_dsdt_scan, "Compal JFL92", {
+@@ -992,6 +1053,9 @@ static struct dmi_system_id ec_dmi_table[] __initdata = {
+ 	ec_validate_ecdt, "ASUS hardware", {
+ 	DMI_MATCH(DMI_SYS_VENDOR, "ASUSTek Computer Inc."),
+ 	DMI_MATCH(DMI_PRODUCT_NAME, "L4R"),}, NULL},
++	{
++	ec_clear_on_resume, "Samsung hardware", {
++	DMI_MATCH(DMI_SYS_VENDOR, "SAMSUNG ELECTRONICS CO., LTD.")}, NULL},
+ 	{},
+ };
+ 
+diff --git a/drivers/acpi/resource.c b/drivers/acpi/resource.c
+index b7201fc6f1e1..0bdacc5e26a3 100644
+--- a/drivers/acpi/resource.c
++++ b/drivers/acpi/resource.c
+@@ -77,18 +77,24 @@ bool acpi_dev_resource_memory(struct acpi_resource *ares, struct resource *res)
+ 	switch (ares->type) {
+ 	case ACPI_RESOURCE_TYPE_MEMORY24:
+ 		memory24 = &ares->data.memory24;
++		if (!memory24->address_length)
++			return false;
+ 		acpi_dev_get_memresource(res, memory24->minimum,
+ 					 memory24->address_length,
+ 					 memory24->write_protect);
+ 		break;
+ 	case ACPI_RESOURCE_TYPE_MEMORY32:
+ 		memory32 = &ares->data.memory32;
++		if (!memory32->address_length)
++			return false;
+ 		acpi_dev_get_memresource(res, memory32->minimum,
+ 					 memory32->address_length,
+ 					 memory32->write_protect);
+ 		break;
+ 	case ACPI_RESOURCE_TYPE_FIXED_MEMORY32:
+ 		fixed_memory32 = &ares->data.fixed_memory32;
++		if (!fixed_memory32->address_length)
++			return false;
+ 		acpi_dev_get_memresource(res, fixed_memory32->address,
+ 					 fixed_memory32->address_length,
+ 					 fixed_memory32->write_protect);
+@@ -144,12 +150,16 @@ bool acpi_dev_resource_io(struct acpi_resource *ares, struct resource *res)
+ 	switch (ares->type) {
+ 	case ACPI_RESOURCE_TYPE_IO:
+ 		io = &ares->data.io;
++		if (!io->address_length)
++			return false;
+ 		acpi_dev_get_ioresource(res, io->minimum,
+ 					io->address_length,
+ 					io->io_decode);
+ 		break;
+ 	case ACPI_RESOURCE_TYPE_FIXED_IO:
+ 		fixed_io = &ares->data.fixed_io;
++		if (!fixed_io->address_length)
++			return false;
+ 		acpi_dev_get_ioresource(res, fixed_io->address,
+ 					fixed_io->address_length,
+ 					ACPI_DECODE_10);
+diff --git a/drivers/acpi/sleep.c b/drivers/acpi/sleep.c
+index 14df30580e15..99e5158456d8 100644
+--- a/drivers/acpi/sleep.c
++++ b/drivers/acpi/sleep.c
+@@ -75,6 +75,17 @@ static int acpi_sleep_prepare(u32 acpi_state)
+ 	return 0;
+ }
+ 
++static bool acpi_sleep_state_supported(u8 sleep_state)
++{
++	acpi_status status;
++	u8 type_a, type_b;
++
++	status = acpi_get_sleep_type_data(sleep_state, &type_a, &type_b);
++	return ACPI_SUCCESS(status) && (!acpi_gbl_reduced_hardware
++		|| (acpi_gbl_FADT.sleep_control.address
++			&& acpi_gbl_FADT.sleep_status.address));
++}
++
+ #ifdef CONFIG_ACPI_SLEEP
+ static u32 acpi_target_sleep_state = ACPI_STATE_S0;
+ 
+@@ -608,15 +619,9 @@ static void acpi_sleep_suspend_setup(void)
+ {
+ 	int i;
+ 
+-	for (i = ACPI_STATE_S1; i < ACPI_STATE_S4; i++) {
+-		acpi_status status;
+-		u8 type_a, type_b;
+-
+-		status = acpi_get_sleep_type_data(i, &type_a, &type_b);
+-		if (ACPI_SUCCESS(status)) {
++	for (i = ACPI_STATE_S1; i < ACPI_STATE_S4; i++)
++		if (acpi_sleep_state_supported(i))
+ 			sleep_states[i] = 1;
+-		}
+-	}
+ 
+ 	suspend_set_ops(old_suspend_ordering ?
+ 		&acpi_suspend_ops_old : &acpi_suspend_ops);
+@@ -747,11 +752,7 @@ static const struct platform_hibernation_ops acpi_hibernation_ops_old = {
+ 
+ static void acpi_sleep_hibernate_setup(void)
+ {
+-	acpi_status status;
+-	u8 type_a, type_b;
+-
+-	status = acpi_get_sleep_type_data(ACPI_STATE_S4, &type_a, &type_b);
+-	if (ACPI_FAILURE(status))
++	if (!acpi_sleep_state_supported(ACPI_STATE_S4))
+ 		return;
+ 
+ 	hibernation_set_ops(old_suspend_ordering ?
+@@ -800,8 +801,6 @@ static void acpi_power_off(void)
+ 
+ int __init acpi_sleep_init(void)
+ {
+-	acpi_status status;
+-	u8 type_a, type_b;
+ 	char supported[ACPI_S_STATE_COUNT * 3 + 1];
+ 	char *pos = supported;
+ 	int i;
+@@ -816,8 +815,7 @@ int __init acpi_sleep_init(void)
+ 	acpi_sleep_suspend_setup();
+ 	acpi_sleep_hibernate_setup();
+ 
+-	status = acpi_get_sleep_type_data(ACPI_STATE_S5, &type_a, &type_b);
+-	if (ACPI_SUCCESS(status)) {
++	if (acpi_sleep_state_supported(ACPI_STATE_S5)) {
+ 		sleep_states[ACPI_STATE_S5] = 1;
+ 		pm_power_off_prepare = acpi_power_off_prepare;
+ 		pm_power_off = acpi_power_off;
+diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
+index f3c361b5c5e5..c5d056e974f1 100644
+--- a/drivers/ata/libata-core.c
++++ b/drivers/ata/libata-core.c
+@@ -4175,6 +4175,7 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
+ 
+ 	/* Seagate Momentus SpinPoint M8 seem to have FPMDA_AA issues */
+ 	{ "ST1000LM024 HN-M101MBB", "2AR10001",	ATA_HORKAGE_BROKEN_FPDMA_AA },
++	{ "ST1000LM024 HN-M101MBB", "2BA30001",	ATA_HORKAGE_BROKEN_FPDMA_AA },
+ 
+ 	/* Blacklist entries taken from Silicon Image 3124/3132
+ 	   Windows driver .inf file - also several Linux problem reports */
+@@ -4224,7 +4225,7 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
+ 
+ 	/* devices that don't properly handle queued TRIM commands */
+ 	{ "Micron_M500*",		NULL,	ATA_HORKAGE_NO_NCQ_TRIM, },
+-	{ "Crucial_CT???M500SSD1",	NULL,	ATA_HORKAGE_NO_NCQ_TRIM, },
++	{ "Crucial_CT???M500SSD*",	NULL,	ATA_HORKAGE_NO_NCQ_TRIM, },
+ 
+ 	/*
+ 	 * Some WD SATA-I drives spin up and down erratically when the link
+diff --git a/drivers/firewire/core-device.c b/drivers/firewire/core-device.c
+index de4aa409abe2..2c6d5e118ac1 100644
+--- a/drivers/firewire/core-device.c
++++ b/drivers/firewire/core-device.c
+@@ -916,7 +916,7 @@ static int lookup_existing_device(struct device *dev, void *data)
+ 		old->config_rom_retries = 0;
+ 		fw_notice(card, "rediscovered device %s\n", dev_name(dev));
+ 
+-		PREPARE_DELAYED_WORK(&old->work, fw_device_update);
++		old->workfn = fw_device_update;
+ 		fw_schedule_device_work(old, 0);
+ 
+ 		if (current_node == card->root_node)
+@@ -1075,7 +1075,7 @@ static void fw_device_init(struct work_struct *work)
+ 	if (atomic_cmpxchg(&device->state,
+ 			   FW_DEVICE_INITIALIZING,
+ 			   FW_DEVICE_RUNNING) == FW_DEVICE_GONE) {
+-		PREPARE_DELAYED_WORK(&device->work, fw_device_shutdown);
++		device->workfn = fw_device_shutdown;
+ 		fw_schedule_device_work(device, SHUTDOWN_DELAY);
+ 	} else {
+ 		fw_notice(card, "created device %s: GUID %08x%08x, S%d00\n",
+@@ -1196,13 +1196,20 @@ static void fw_device_refresh(struct work_struct *work)
+ 		  dev_name(&device->device), fw_rcode_string(ret));
+  gone:
+ 	atomic_set(&device->state, FW_DEVICE_GONE);
+-	PREPARE_DELAYED_WORK(&device->work, fw_device_shutdown);
++	device->workfn = fw_device_shutdown;
+ 	fw_schedule_device_work(device, SHUTDOWN_DELAY);
+  out:
+ 	if (node_id == card->root_node->node_id)
+ 		fw_schedule_bm_work(card, 0);
+ }
+ 
++static void fw_device_workfn(struct work_struct *work)
++{
++	struct fw_device *device = container_of(to_delayed_work(work),
++						struct fw_device, work);
++	device->workfn(work);
++}
++
+ void fw_node_event(struct fw_card *card, struct fw_node *node, int event)
+ {
+ 	struct fw_device *device;
+@@ -1252,7 +1259,8 @@ void fw_node_event(struct fw_card *card, struct fw_node *node, int event)
+ 		 * power-up after getting plugged in.  We schedule the
+ 		 * first config rom scan half a second after bus reset.
+ 		 */
+-		INIT_DELAYED_WORK(&device->work, fw_device_init);
++		device->workfn = fw_device_init;
++		INIT_DELAYED_WORK(&device->work, fw_device_workfn);
+ 		fw_schedule_device_work(device, INITIAL_DELAY);
+ 		break;
+ 
+@@ -1268,7 +1276,7 @@ void fw_node_event(struct fw_card *card, struct fw_node *node, int event)
+ 		if (atomic_cmpxchg(&device->state,
+ 			    FW_DEVICE_RUNNING,
+ 			    FW_DEVICE_INITIALIZING) == FW_DEVICE_RUNNING) {
+-			PREPARE_DELAYED_WORK(&device->work, fw_device_refresh);
++			device->workfn = fw_device_refresh;
+ 			fw_schedule_device_work(device,
+ 				device->is_local ? 0 : INITIAL_DELAY);
+ 		}
+@@ -1283,7 +1291,7 @@ void fw_node_event(struct fw_card *card, struct fw_node *node, int event)
+ 		smp_wmb();  /* update node_id before generation */
+ 		device->generation = card->generation;
+ 		if (atomic_read(&device->state) == FW_DEVICE_RUNNING) {
+-			PREPARE_DELAYED_WORK(&device->work, fw_device_update);
++			device->workfn = fw_device_update;
+ 			fw_schedule_device_work(device, 0);
+ 		}
+ 		break;
+@@ -1308,7 +1316,7 @@ void fw_node_event(struct fw_card *card, struct fw_node *node, int event)
+ 		device = node->data;
+ 		if (atomic_xchg(&device->state,
+ 				FW_DEVICE_GONE) == FW_DEVICE_RUNNING) {
+-			PREPARE_DELAYED_WORK(&device->work, fw_device_shutdown);
++			device->workfn = fw_device_shutdown;
+ 			fw_schedule_device_work(device,
+ 				list_empty(&card->link) ? 0 : SHUTDOWN_DELAY);
+ 		}
+diff --git a/drivers/firewire/net.c b/drivers/firewire/net.c
+index 6b895986dc22..4af0a7bad7f2 100644
+--- a/drivers/firewire/net.c
++++ b/drivers/firewire/net.c
+@@ -929,8 +929,6 @@ static void fwnet_write_complete(struct fw_card *card, int rcode,
+ 	if (rcode == RCODE_COMPLETE) {
+ 		fwnet_transmit_packet_done(ptask);
+ 	} else {
+-		fwnet_transmit_packet_failed(ptask);
+-
+ 		if (printk_timed_ratelimit(&j,  1000) || rcode != last_rcode) {
+ 			dev_err(&ptask->dev->netdev->dev,
+ 				"fwnet_write_complete failed: %x (skipped %d)\n",
+@@ -938,8 +936,10 @@ static void fwnet_write_complete(struct fw_card *card, int rcode,
+ 
+ 			errors_skipped = 0;
+ 			last_rcode = rcode;
+-		} else
++		} else {
+ 			errors_skipped++;
++		}
++		fwnet_transmit_packet_failed(ptask);
+ 	}
+ }
+ 
+diff --git a/drivers/firewire/ohci.c b/drivers/firewire/ohci.c
+index 6aa8a86cb83b..ee805a57b72d 100644
+--- a/drivers/firewire/ohci.c
++++ b/drivers/firewire/ohci.c
+@@ -290,7 +290,6 @@ static char ohci_driver_name[] = KBUILD_MODNAME;
+ #define QUIRK_NO_MSI			0x10
+ #define QUIRK_TI_SLLZ059		0x20
+ #define QUIRK_IR_WAKE			0x40
+-#define QUIRK_PHY_LCTRL_TIMEOUT		0x80
+ 
+ /* In case of multiple matches in ohci_quirks[], only the first one is used. */
+ static const struct {
+@@ -303,10 +302,7 @@ static const struct {
+ 		QUIRK_BE_HEADERS},
+ 
+ 	{PCI_VENDOR_ID_ATT, PCI_DEVICE_ID_AGERE_FW643, 6,
+-		QUIRK_PHY_LCTRL_TIMEOUT | QUIRK_NO_MSI},
+-
+-	{PCI_VENDOR_ID_ATT, PCI_ANY_ID, PCI_ANY_ID,
+-		QUIRK_PHY_LCTRL_TIMEOUT},
++		QUIRK_NO_MSI},
+ 
+ 	{PCI_VENDOR_ID_CREATIVE, PCI_DEVICE_ID_CREATIVE_SB1394, PCI_ANY_ID,
+ 		QUIRK_RESET_PACKET},
+@@ -353,7 +349,6 @@ MODULE_PARM_DESC(quirks, "Chip quirks (default = 0"
+ 	", disable MSI = "		__stringify(QUIRK_NO_MSI)
+ 	", TI SLLZ059 erratum = "	__stringify(QUIRK_TI_SLLZ059)
+ 	", IR wake unreliable = "	__stringify(QUIRK_IR_WAKE)
+-	", phy LCtrl timeout = "	__stringify(QUIRK_PHY_LCTRL_TIMEOUT)
+ 	")");
+ 
+ #define OHCI_PARAM_DEBUG_AT_AR		1
+@@ -2295,9 +2290,6 @@ static int ohci_enable(struct fw_card *card,
+ 	 * TI TSB82AA2 + TSB81BA3(A) cards signal LPS enabled early but
+ 	 * cannot actually use the phy at that time.  These need tens of
+ 	 * millisecods pause between LPS write and first phy access too.
+-	 *
+-	 * But do not wait for 50msec on Agere/LSI cards.  Their phy
+-	 * arbitration state machine may time out during such a long wait.
+ 	 */
+ 
+ 	reg_write(ohci, OHCI1394_HCControlSet,
+@@ -2305,11 +2297,8 @@ static int ohci_enable(struct fw_card *card,
+ 		  OHCI1394_HCControl_postedWriteEnable);
+ 	flush_writes(ohci);
+ 
+-	if (!(ohci->quirks & QUIRK_PHY_LCTRL_TIMEOUT))
++	for (lps = 0, i = 0; !lps && i < 3; i++) {
+ 		msleep(50);
+-
+-	for (lps = 0, i = 0; !lps && i < 150; i++) {
+-		msleep(1);
+ 		lps = reg_read(ohci, OHCI1394_HCControlSet) &
+ 		      OHCI1394_HCControl_LPS;
+ 	}
+diff --git a/drivers/firewire/sbp2.c b/drivers/firewire/sbp2.c
+index 281029daf98c..7aef911fdc71 100644
+--- a/drivers/firewire/sbp2.c
++++ b/drivers/firewire/sbp2.c
+@@ -146,6 +146,7 @@ struct sbp2_logical_unit {
+ 	 */
+ 	int generation;
+ 	int retries;
++	work_func_t workfn;
+ 	struct delayed_work work;
+ 	bool has_sdev;
+ 	bool blocked;
+@@ -864,7 +865,7 @@ static void sbp2_login(struct work_struct *work)
+ 	/* set appropriate retry limit(s) in BUSY_TIMEOUT register */
+ 	sbp2_set_busy_timeout(lu);
+ 
+-	PREPARE_DELAYED_WORK(&lu->work, sbp2_reconnect);
++	lu->workfn = sbp2_reconnect;
+ 	sbp2_agent_reset(lu);
+ 
+ 	/* This was a re-login. */
+@@ -918,7 +919,7 @@ static void sbp2_login(struct work_struct *work)
+ 	 * If a bus reset happened, sbp2_update will have requeued
+ 	 * lu->work already.  Reset the work from reconnect to login.
+ 	 */
+-	PREPARE_DELAYED_WORK(&lu->work, sbp2_login);
++	lu->workfn = sbp2_login;
+ }
+ 
+ static void sbp2_reconnect(struct work_struct *work)
+@@ -952,7 +953,7 @@ static void sbp2_reconnect(struct work_struct *work)
+ 		    lu->retries++ >= 5) {
+ 			dev_err(tgt_dev(tgt), "failed to reconnect\n");
+ 			lu->retries = 0;
+-			PREPARE_DELAYED_WORK(&lu->work, sbp2_login);
++			lu->workfn = sbp2_login;
+ 		}
+ 		sbp2_queue_work(lu, DIV_ROUND_UP(HZ, 5));
+ 
+@@ -972,6 +973,13 @@ static void sbp2_reconnect(struct work_struct *work)
+ 	sbp2_conditionally_unblock(lu);
+ }
+ 
++static void sbp2_lu_workfn(struct work_struct *work)
++{
++	struct sbp2_logical_unit *lu = container_of(to_delayed_work(work),
++						struct sbp2_logical_unit, work);
++	lu->workfn(work);
++}
++
+ static int sbp2_add_logical_unit(struct sbp2_target *tgt, int lun_entry)
+ {
+ 	struct sbp2_logical_unit *lu;
+@@ -998,7 +1006,8 @@ static int sbp2_add_logical_unit(struct sbp2_target *tgt, int lun_entry)
+ 	lu->blocked  = false;
+ 	++tgt->dont_block;
+ 	INIT_LIST_HEAD(&lu->orb_list);
+-	INIT_DELAYED_WORK(&lu->work, sbp2_login);
++	lu->workfn = sbp2_login;
++	INIT_DELAYED_WORK(&lu->work, sbp2_lu_workfn);
+ 
+ 	list_add_tail(&lu->link, &tgt->lu_list);
+ 	return 0;
+diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
+index 2ad27880cd04..2bef0e4cfda8 100644
+--- a/drivers/gpu/drm/i915/i915_drv.c
++++ b/drivers/gpu/drm/i915/i915_drv.c
+@@ -376,7 +376,7 @@ MODULE_DEVICE_TABLE(pci, pciidlist);
+ void intel_detect_pch(struct drm_device *dev)
+ {
+ 	struct drm_i915_private *dev_priv = dev->dev_private;
+-	struct pci_dev *pch;
++	struct pci_dev *pch = NULL;
+ 
+ 	/* In all current cases, num_pipes is equivalent to the PCH_NOP setting
+ 	 * (which really amounts to a PCH but no South Display).
+@@ -397,12 +397,9 @@ void intel_detect_pch(struct drm_device *dev)
+ 	 * all the ISA bridge devices and check for the first match, instead
+ 	 * of only checking the first one.
+ 	 */
+-	pch = pci_get_class(PCI_CLASS_BRIDGE_ISA << 8, NULL);
+-	while (pch) {
+-		struct pci_dev *curr = pch;
++	while ((pch = pci_get_class(PCI_CLASS_BRIDGE_ISA << 8, pch))) {
+ 		if (pch->vendor == PCI_VENDOR_ID_INTEL) {
+-			unsigned short id;
+-			id = pch->device & INTEL_PCH_DEVICE_ID_MASK;
++			unsigned short id = pch->device & INTEL_PCH_DEVICE_ID_MASK;
+ 			dev_priv->pch_id = id;
+ 
+ 			if (id == INTEL_PCH_IBX_DEVICE_ID_TYPE) {
+@@ -428,18 +425,16 @@ void intel_detect_pch(struct drm_device *dev)
+ 				DRM_DEBUG_KMS("Found LynxPoint LP PCH\n");
+ 				WARN_ON(!IS_HASWELL(dev));
+ 				WARN_ON(!IS_ULT(dev));
+-			} else {
+-				goto check_next;
+-			}
+-			pci_dev_put(pch);
++			} else
++				continue;
++
+ 			break;
+ 		}
+-check_next:
+-		pch = pci_get_class(PCI_CLASS_BRIDGE_ISA << 8, curr);
+-		pci_dev_put(curr);
+ 	}
+ 	if (!pch)
+-		DRM_DEBUG_KMS("No PCH found?\n");
++		DRM_DEBUG_KMS("No PCH found.\n");
++
++	pci_dev_put(pch);
+ }
+ 
+ bool i915_semaphore_is_enabled(struct drm_device *dev)
+diff --git a/drivers/gpu/drm/i915/intel_hdmi.c b/drivers/gpu/drm/i915/intel_hdmi.c
+index 4148cc85bf7f..4d302f3dec89 100644
+--- a/drivers/gpu/drm/i915/intel_hdmi.c
++++ b/drivers/gpu/drm/i915/intel_hdmi.c
+@@ -834,7 +834,7 @@ static int hdmi_portclock_limit(struct intel_hdmi *hdmi)
+ {
+ 	struct drm_device *dev = intel_hdmi_to_dev(hdmi);
+ 
+-	if (IS_G4X(dev))
++	if (!hdmi->has_hdmi_sink || IS_G4X(dev))
+ 		return 165000;
+ 	else if (IS_HASWELL(dev))
+ 		return 300000;
+@@ -887,8 +887,8 @@ bool intel_hdmi_compute_config(struct intel_encoder *encoder,
+ 	 * outputs. We also need to check that the higher clock still fits
+ 	 * within limits.
+ 	 */
+-	if (pipe_config->pipe_bpp > 8*3 && clock_12bpc <= portclock_limit
+-	    && HAS_PCH_SPLIT(dev)) {
++	if (pipe_config->pipe_bpp > 8*3 && intel_hdmi->has_hdmi_sink &&
++	    clock_12bpc <= portclock_limit && HAS_PCH_SPLIT(dev)) {
+ 		DRM_DEBUG_KMS("picking bpc to 12 for HDMI output\n");
+ 		desired_bpp = 12*3;
+ 
+diff --git a/drivers/gpu/drm/radeon/atombios_encoders.c b/drivers/gpu/drm/radeon/atombios_encoders.c
+index 5e891b226acf..7bb7074a131f 100644
+--- a/drivers/gpu/drm/radeon/atombios_encoders.c
++++ b/drivers/gpu/drm/radeon/atombios_encoders.c
+@@ -1313,7 +1313,7 @@ atombios_dig_transmitter_setup(struct drm_encoder *encoder, int action, uint8_t
+ 			}
+ 			if (is_dp)
+ 				args.v5.ucLaneNum = dp_lane_count;
+-			else if (radeon_encoder->pixel_clock > 165000)
++			else if (radeon_dig_monitor_is_duallink(encoder, radeon_encoder->pixel_clock))
+ 				args.v5.ucLaneNum = 8;
+ 			else
+ 				args.v5.ucLaneNum = 4;
+diff --git a/drivers/gpu/drm/radeon/cik.c b/drivers/gpu/drm/radeon/cik.c
+index 31f5f0e88328..25370ac56b4b 100644
+--- a/drivers/gpu/drm/radeon/cik.c
++++ b/drivers/gpu/drm/radeon/cik.c
+@@ -3517,8 +3517,11 @@ static void cik_cp_compute_enable(struct radeon_device *rdev, bool enable)
+ {
+ 	if (enable)
+ 		WREG32(CP_MEC_CNTL, 0);
+-	else
++	else {
+ 		WREG32(CP_MEC_CNTL, (MEC_ME1_HALT | MEC_ME2_HALT));
++		rdev->ring[CAYMAN_RING_TYPE_CP1_INDEX].ready = false;
++		rdev->ring[CAYMAN_RING_TYPE_CP2_INDEX].ready = false;
++	}
+ 	udelay(50);
+ }
+ 
+@@ -6995,26 +6998,7 @@ static int cik_startup(struct radeon_device *rdev)
+ 
+ 	cik_mc_program(rdev);
+ 
+-	if (rdev->flags & RADEON_IS_IGP) {
+-		if (!rdev->me_fw || !rdev->pfp_fw || !rdev->ce_fw ||
+-		    !rdev->mec_fw || !rdev->sdma_fw || !rdev->rlc_fw) {
+-			r = cik_init_microcode(rdev);
+-			if (r) {
+-				DRM_ERROR("Failed to load firmware!\n");
+-				return r;
+-			}
+-		}
+-	} else {
+-		if (!rdev->me_fw || !rdev->pfp_fw || !rdev->ce_fw ||
+-		    !rdev->mec_fw || !rdev->sdma_fw || !rdev->rlc_fw ||
+-		    !rdev->mc_fw) {
+-			r = cik_init_microcode(rdev);
+-			if (r) {
+-				DRM_ERROR("Failed to load firmware!\n");
+-				return r;
+-			}
+-		}
+-
++	if (!(rdev->flags & RADEON_IS_IGP)) {
+ 		r = ci_mc_load_microcode(rdev);
+ 		if (r) {
+ 			DRM_ERROR("Failed to load MC firmware!\n");
+@@ -7327,6 +7311,27 @@ int cik_init(struct radeon_device *rdev)
+ 	if (r)
+ 		return r;
+ 
++	if (rdev->flags & RADEON_IS_IGP) {
++		if (!rdev->me_fw || !rdev->pfp_fw || !rdev->ce_fw ||
++		    !rdev->mec_fw || !rdev->sdma_fw || !rdev->rlc_fw) {
++			r = cik_init_microcode(rdev);
++			if (r) {
++				DRM_ERROR("Failed to load firmware!\n");
++				return r;
++			}
++		}
++	} else {
++		if (!rdev->me_fw || !rdev->pfp_fw || !rdev->ce_fw ||
++		    !rdev->mec_fw || !rdev->sdma_fw || !rdev->rlc_fw ||
++		    !rdev->mc_fw) {
++			r = cik_init_microcode(rdev);
++			if (r) {
++				DRM_ERROR("Failed to load firmware!\n");
++				return r;
++			}
++		}
++	}
++
+ 	ring = &rdev->ring[RADEON_RING_TYPE_GFX_INDEX];
+ 	ring->ring_obj = NULL;
+ 	r600_ring_init(rdev, ring, 1024 * 1024);
+diff --git a/drivers/gpu/drm/radeon/cik_sdma.c b/drivers/gpu/drm/radeon/cik_sdma.c
+index aaf7ffce8b5b..d565f4076a23 100644
+--- a/drivers/gpu/drm/radeon/cik_sdma.c
++++ b/drivers/gpu/drm/radeon/cik_sdma.c
+@@ -174,6 +174,8 @@ static void cik_sdma_gfx_stop(struct radeon_device *rdev)
+ 		WREG32(SDMA0_GFX_RB_CNTL + reg_offset, rb_cntl);
+ 		WREG32(SDMA0_GFX_IB_CNTL + reg_offset, 0);
+ 	}
++	rdev->ring[R600_RING_TYPE_DMA_INDEX].ready = false;
++	rdev->ring[CAYMAN_RING_TYPE_DMA1_INDEX].ready = false;
+ }
+ 
+ /**
+@@ -201,6 +203,11 @@ void cik_sdma_enable(struct radeon_device *rdev, bool enable)
+ 	u32 me_cntl, reg_offset;
+ 	int i;
+ 
++	if (enable == false) {
++		cik_sdma_gfx_stop(rdev);
++		cik_sdma_rlc_stop(rdev);
++	}
++
+ 	for (i = 0; i < 2; i++) {
+ 		if (i == 0)
+ 			reg_offset = SDMA0_REGISTER_OFFSET;
+@@ -328,10 +335,6 @@ static int cik_sdma_load_microcode(struct radeon_device *rdev)
+ 	if (!rdev->sdma_fw)
+ 		return -EINVAL;
+ 
+-	/* stop the gfx rings and rlc compute queues */
+-	cik_sdma_gfx_stop(rdev);
+-	cik_sdma_rlc_stop(rdev);
+-
+ 	/* halt the MEs */
+ 	cik_sdma_enable(rdev, false);
+ 
+@@ -400,9 +403,6 @@ int cik_sdma_resume(struct radeon_device *rdev)
+  */
+ void cik_sdma_fini(struct radeon_device *rdev)
+ {
+-	/* stop the gfx rings and rlc compute queues */
+-	cik_sdma_gfx_stop(rdev);
+-	cik_sdma_rlc_stop(rdev);
+ 	/* halt the MEs */
+ 	cik_sdma_enable(rdev, false);
+ 	radeon_ring_fini(rdev, &rdev->ring[R600_RING_TYPE_DMA_INDEX]);
+diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c
+index 5f07d1bfbd76..c429bb9b17b6 100644
+--- a/drivers/gpu/drm/radeon/evergreen.c
++++ b/drivers/gpu/drm/radeon/evergreen.c
+@@ -5061,26 +5061,11 @@ static int evergreen_startup(struct radeon_device *rdev)
+ 	evergreen_mc_program(rdev);
+ 
+ 	if (ASIC_IS_DCE5(rdev)) {
+-		if (!rdev->me_fw || !rdev->pfp_fw || !rdev->rlc_fw || !rdev->mc_fw) {
+-			r = ni_init_microcode(rdev);
+-			if (r) {
+-				DRM_ERROR("Failed to load firmware!\n");
+-				return r;
+-			}
+-		}
+ 		r = ni_mc_load_microcode(rdev);
+ 		if (r) {
+ 			DRM_ERROR("Failed to load MC firmware!\n");
+ 			return r;
+ 		}
+-	} else {
+-		if (!rdev->me_fw || !rdev->pfp_fw || !rdev->rlc_fw) {
+-			r = r600_init_microcode(rdev);
+-			if (r) {
+-				DRM_ERROR("Failed to load firmware!\n");
+-				return r;
+-			}
+-		}
+ 	}
+ 
+ 	if (rdev->flags & RADEON_IS_AGP) {
+@@ -5308,6 +5293,24 @@ int evergreen_init(struct radeon_device *rdev)
+ 	if (r)
+ 		return r;
+ 
++	if (ASIC_IS_DCE5(rdev)) {
++		if (!rdev->me_fw || !rdev->pfp_fw || !rdev->rlc_fw || !rdev->mc_fw) {
++			r = ni_init_microcode(rdev);
++			if (r) {
++				DRM_ERROR("Failed to load firmware!\n");
++				return r;
++			}
++		}
++	} else {
++		if (!rdev->me_fw || !rdev->pfp_fw || !rdev->rlc_fw) {
++			r = r600_init_microcode(rdev);
++			if (r) {
++				DRM_ERROR("Failed to load firmware!\n");
++				return r;
++			}
++		}
++	}
++
+ 	rdev->ring[RADEON_RING_TYPE_GFX_INDEX].ring_obj = NULL;
+ 	r600_ring_init(rdev, &rdev->ring[RADEON_RING_TYPE_GFX_INDEX], 1024 * 1024);
+ 
+diff --git a/drivers/gpu/drm/radeon/evergreen_smc.h b/drivers/gpu/drm/radeon/evergreen_smc.h
+index 76ada8cfe902..3a03ba37d043 100644
+--- a/drivers/gpu/drm/radeon/evergreen_smc.h
++++ b/drivers/gpu/drm/radeon/evergreen_smc.h
+@@ -57,7 +57,7 @@ typedef struct SMC_Evergreen_MCRegisters SMC_Evergreen_MCRegisters;
+ 
+ #define EVERGREEN_SMC_FIRMWARE_HEADER_LOCATION 0x100
+ 
+-#define EVERGREEN_SMC_FIRMWARE_HEADER_softRegisters   0x0
++#define EVERGREEN_SMC_FIRMWARE_HEADER_softRegisters   0x8
+ #define EVERGREEN_SMC_FIRMWARE_HEADER_stateTable      0xC
+ #define EVERGREEN_SMC_FIRMWARE_HEADER_mcRegisterTable 0x20
+ 
+diff --git a/drivers/gpu/drm/radeon/ni.c b/drivers/gpu/drm/radeon/ni.c
+index b2dbd48f7f28..474343adf262 100644
+--- a/drivers/gpu/drm/radeon/ni.c
++++ b/drivers/gpu/drm/radeon/ni.c
+@@ -1881,23 +1881,7 @@ static int cayman_startup(struct radeon_device *rdev)
+ 
+ 	evergreen_mc_program(rdev);
+ 
+-	if (rdev->flags & RADEON_IS_IGP) {
+-		if (!rdev->me_fw || !rdev->pfp_fw || !rdev->rlc_fw) {
+-			r = ni_init_microcode(rdev);
+-			if (r) {
+-				DRM_ERROR("Failed to load firmware!\n");
+-				return r;
+-			}
+-		}
+-	} else {
+-		if (!rdev->me_fw || !rdev->pfp_fw || !rdev->rlc_fw || !rdev->mc_fw) {
+-			r = ni_init_microcode(rdev);
+-			if (r) {
+-				DRM_ERROR("Failed to load firmware!\n");
+-				return r;
+-			}
+-		}
+-
++	if (!(rdev->flags & RADEON_IS_IGP)) {
+ 		r = ni_mc_load_microcode(rdev);
+ 		if (r) {
+ 			DRM_ERROR("Failed to load MC firmware!\n");
+@@ -2148,6 +2132,24 @@ int cayman_init(struct radeon_device *rdev)
+ 	if (r)
+ 		return r;
+ 
++	if (rdev->flags & RADEON_IS_IGP) {
++		if (!rdev->me_fw || !rdev->pfp_fw || !rdev->rlc_fw) {
++			r = ni_init_microcode(rdev);
++			if (r) {
++				DRM_ERROR("Failed to load firmware!\n");
++				return r;
++			}
++		}
++	} else {
++		if (!rdev->me_fw || !rdev->pfp_fw || !rdev->rlc_fw || !rdev->mc_fw) {
++			r = ni_init_microcode(rdev);
++			if (r) {
++				DRM_ERROR("Failed to load firmware!\n");
++				return r;
++			}
++		}
++	}
++
+ 	ring->ring_obj = NULL;
+ 	r600_ring_init(rdev, ring, 1024 * 1024);
+ 
+diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c
+index 67da7e285cde..5af2729f2055 100644
+--- a/drivers/gpu/drm/radeon/r600.c
++++ b/drivers/gpu/drm/radeon/r600.c
+@@ -2726,14 +2726,6 @@ static int r600_startup(struct radeon_device *rdev)
+ 
+ 	r600_mc_program(rdev);
+ 
+-	if (!rdev->me_fw || !rdev->pfp_fw || !rdev->rlc_fw) {
+-		r = r600_init_microcode(rdev);
+-		if (r) {
+-			DRM_ERROR("Failed to load firmware!\n");
+-			return r;
+-		}
+-	}
+-
+ 	if (rdev->flags & RADEON_IS_AGP) {
+ 		r600_agp_enable(rdev);
+ 	} else {
+@@ -2921,6 +2913,14 @@ int r600_init(struct radeon_device *rdev)
+ 	if (r)
+ 		return r;
+ 
++	if (!rdev->me_fw || !rdev->pfp_fw || !rdev->rlc_fw) {
++		r = r600_init_microcode(rdev);
++		if (r) {
++			DRM_ERROR("Failed to load firmware!\n");
++			return r;
++		}
++	}
++
+ 	rdev->ring[RADEON_RING_TYPE_GFX_INDEX].ring_obj = NULL;
+ 	r600_ring_init(rdev, &rdev->ring[RADEON_RING_TYPE_GFX_INDEX], 1024 * 1024);
+ 
+diff --git a/drivers/gpu/drm/radeon/radeon_ttm.c b/drivers/gpu/drm/radeon/radeon_ttm.c
+index 71245d6f34a2..84323c943bfc 100644
+--- a/drivers/gpu/drm/radeon/radeon_ttm.c
++++ b/drivers/gpu/drm/radeon/radeon_ttm.c
+@@ -712,6 +712,9 @@ int radeon_ttm_init(struct radeon_device *rdev)
+ 		DRM_ERROR("Failed initializing VRAM heap.\n");
+ 		return r;
+ 	}
++	/* Change the size here instead of the init above so only lpfn is affected */
++	radeon_ttm_set_active_vram_size(rdev, rdev->mc.visible_vram_size);
++
+ 	r = radeon_bo_create(rdev, 256 * 1024, PAGE_SIZE, true,
+ 			     RADEON_GEM_DOMAIN_VRAM,
+ 			     NULL, &rdev->stollen_vga_memory);
+diff --git a/drivers/gpu/drm/radeon/rv770.c b/drivers/gpu/drm/radeon/rv770.c
+index 99dd9d8fcf72..c4960ad71e5e 100644
+--- a/drivers/gpu/drm/radeon/rv770.c
++++ b/drivers/gpu/drm/radeon/rv770.c
+@@ -1665,14 +1665,6 @@ static int rv770_startup(struct radeon_device *rdev)
+ 
+ 	rv770_mc_program(rdev);
+ 
+-	if (!rdev->me_fw || !rdev->pfp_fw || !rdev->rlc_fw) {
+-		r = r600_init_microcode(rdev);
+-		if (r) {
+-			DRM_ERROR("Failed to load firmware!\n");
+-			return r;
+-		}
+-	}
+-
+ 	if (rdev->flags & RADEON_IS_AGP) {
+ 		rv770_agp_enable(rdev);
+ 	} else {
+@@ -1876,6 +1868,14 @@ int rv770_init(struct radeon_device *rdev)
+ 	if (r)
+ 		return r;
+ 
++	if (!rdev->me_fw || !rdev->pfp_fw || !rdev->rlc_fw) {
++		r = r600_init_microcode(rdev);
++		if (r) {
++			DRM_ERROR("Failed to load firmware!\n");
++			return r;
++		}
++	}
++
+ 	rdev->ring[RADEON_RING_TYPE_GFX_INDEX].ring_obj = NULL;
+ 	r600_ring_init(rdev, &rdev->ring[RADEON_RING_TYPE_GFX_INDEX], 1024 * 1024);
+ 
+diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c
+index 8277ee01a7b4..873e0a608948 100644
+--- a/drivers/gpu/drm/radeon/si.c
++++ b/drivers/gpu/drm/radeon/si.c
+@@ -6387,15 +6387,6 @@ static int si_startup(struct radeon_device *rdev)
+ 
+ 	si_mc_program(rdev);
+ 
+-	if (!rdev->me_fw || !rdev->pfp_fw || !rdev->ce_fw ||
+-	    !rdev->rlc_fw || !rdev->mc_fw) {
+-		r = si_init_microcode(rdev);
+-		if (r) {
+-			DRM_ERROR("Failed to load firmware!\n");
+-			return r;
+-		}
+-	}
+-
+ 	r = si_mc_load_microcode(rdev);
+ 	if (r) {
+ 		DRM_ERROR("Failed to load MC firmware!\n");
+@@ -6663,6 +6654,15 @@ int si_init(struct radeon_device *rdev)
+ 	if (r)
+ 		return r;
+ 
++	if (!rdev->me_fw || !rdev->pfp_fw || !rdev->ce_fw ||
++	    !rdev->rlc_fw || !rdev->mc_fw) {
++		r = si_init_microcode(rdev);
++		if (r) {
++			DRM_ERROR("Failed to load firmware!\n");
++			return r;
++		}
++	}
++
+ 	ring = &rdev->ring[RADEON_RING_TYPE_GFX_INDEX];
+ 	ring->ring_obj = NULL;
+ 	r600_ring_init(rdev, ring, 1024 * 1024);
+diff --git a/drivers/gpu/drm/radeon/si_dpm.c b/drivers/gpu/drm/radeon/si_dpm.c
+index 2332aa1bf93c..83895f2d16c6 100644
+--- a/drivers/gpu/drm/radeon/si_dpm.c
++++ b/drivers/gpu/drm/radeon/si_dpm.c
+@@ -2396,7 +2396,7 @@ static int si_populate_sq_ramping_values(struct radeon_device *rdev,
+ 	if (SISLANDS_DPM2_SQ_RAMP_STI_SIZE > (STI_SIZE_MASK >> STI_SIZE_SHIFT))
+ 		enable_sq_ramping = false;
+ 
+-	if (NISLANDS_DPM2_SQ_RAMP_LTI_RATIO <= (LTI_RATIO_MASK >> LTI_RATIO_SHIFT))
++	if (SISLANDS_DPM2_SQ_RAMP_LTI_RATIO > (LTI_RATIO_MASK >> LTI_RATIO_SHIFT))
+ 		enable_sq_ramping = false;
+ 
+ 	for (i = 0; i < state->performance_level_count; i++) {
+@@ -5409,7 +5409,7 @@ static void si_populate_mc_reg_addresses(struct radeon_device *rdev,
+ 
+ 	for (i = 0, j = 0; j < si_pi->mc_reg_table.last; j++) {
+ 		if (si_pi->mc_reg_table.valid_flag & (1 << j)) {
+-			if (i >= SMC_NISLANDS_MC_REGISTER_ARRAY_SIZE)
++			if (i >= SMC_SISLANDS_MC_REGISTER_ARRAY_SIZE)
+ 				break;
+ 			mc_reg_table->address[i].s0 =
+ 				cpu_to_be16(si_pi->mc_reg_table.mc_reg_address[j].s0);
+diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c
+index 729805322883..acd0fe0c80d2 100644
+--- a/drivers/gpu/drm/ttm/ttm_bo.c
++++ b/drivers/gpu/drm/ttm/ttm_bo.c
+@@ -351,9 +351,11 @@ static int ttm_bo_handle_move_mem(struct ttm_buffer_object *bo,
+ 
+ moved:
+ 	if (bo->evicted) {
+-		ret = bdev->driver->invalidate_caches(bdev, bo->mem.placement);
+-		if (ret)
+-			pr_err("Can not flush read caches\n");
++		if (bdev->driver->invalidate_caches) {
++			ret = bdev->driver->invalidate_caches(bdev, bo->mem.placement);
++			if (ret)
++				pr_err("Can not flush read caches\n");
++		}
+ 		bo->evicted = false;
+ 	}
+ 
+diff --git a/drivers/i2c/busses/Kconfig b/drivers/i2c/busses/Kconfig
+index ff758eded96f..cd30d98ac510 100644
+--- a/drivers/i2c/busses/Kconfig
++++ b/drivers/i2c/busses/Kconfig
+@@ -376,7 +376,7 @@ config I2C_CBUS_GPIO
+ 
+ config I2C_CPM
+ 	tristate "Freescale CPM1 or CPM2 (MPC8xx/826x)"
+-	depends on (CPM1 || CPM2) && OF_I2C
++	depends on CPM1 || CPM2
+ 	help
+ 	  This supports the use of the I2C interface on Freescale
+ 	  processors with CPM1 or CPM2.
+diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c
+index ea7051ee1493..ba93ef85652d 100644
+--- a/drivers/infiniband/ulp/isert/ib_isert.c
++++ b/drivers/infiniband/ulp/isert/ib_isert.c
+@@ -496,8 +496,8 @@ isert_connect_request(struct rdma_cm_id *cma_id, struct rdma_cm_event *event)
+ 	isert_conn->state = ISER_CONN_INIT;
+ 	INIT_LIST_HEAD(&isert_conn->conn_accept_node);
+ 	init_completion(&isert_conn->conn_login_comp);
+-	init_waitqueue_head(&isert_conn->conn_wait);
+-	init_waitqueue_head(&isert_conn->conn_wait_comp_err);
++	init_completion(&isert_conn->conn_wait);
++	init_completion(&isert_conn->conn_wait_comp_err);
+ 	kref_init(&isert_conn->conn_kref);
+ 	kref_get(&isert_conn->conn_kref);
+ 	mutex_init(&isert_conn->conn_mutex);
+@@ -669,11 +669,11 @@ isert_disconnect_work(struct work_struct *work)
+ 
+ 	pr_debug("isert_disconnect_work(): >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\n");
+ 	mutex_lock(&isert_conn->conn_mutex);
+-	isert_conn->state = ISER_CONN_DOWN;
++	if (isert_conn->state == ISER_CONN_UP)
++		isert_conn->state = ISER_CONN_TERMINATING;
+ 
+ 	if (isert_conn->post_recv_buf_count == 0 &&
+ 	    atomic_read(&isert_conn->post_send_buf_count) == 0) {
+-		pr_debug("Calling wake_up(&isert_conn->conn_wait);\n");
+ 		mutex_unlock(&isert_conn->conn_mutex);
+ 		goto wake_up;
+ 	}
+@@ -693,7 +693,7 @@ isert_disconnect_work(struct work_struct *work)
+ 	mutex_unlock(&isert_conn->conn_mutex);
+ 
+ wake_up:
+-	wake_up(&isert_conn->conn_wait);
++	complete(&isert_conn->conn_wait);
+ 	isert_put_conn(isert_conn);
+ }
+ 
+@@ -1427,7 +1427,7 @@ isert_put_cmd(struct isert_cmd *isert_cmd)
+ 	case ISCSI_OP_SCSI_CMD:
+ 		spin_lock_bh(&conn->cmd_lock);
+ 		if (!list_empty(&cmd->i_conn_node))
+-			list_del(&cmd->i_conn_node);
++			list_del_init(&cmd->i_conn_node);
+ 		spin_unlock_bh(&conn->cmd_lock);
+ 
+ 		if (cmd->data_direction == DMA_TO_DEVICE)
+@@ -1439,7 +1439,7 @@ isert_put_cmd(struct isert_cmd *isert_cmd)
+ 	case ISCSI_OP_SCSI_TMFUNC:
+ 		spin_lock_bh(&conn->cmd_lock);
+ 		if (!list_empty(&cmd->i_conn_node))
+-			list_del(&cmd->i_conn_node);
++			list_del_init(&cmd->i_conn_node);
+ 		spin_unlock_bh(&conn->cmd_lock);
+ 
+ 		transport_generic_free_cmd(&cmd->se_cmd, 0);
+@@ -1449,7 +1449,7 @@ isert_put_cmd(struct isert_cmd *isert_cmd)
+ 	case ISCSI_OP_TEXT:
+ 		spin_lock_bh(&conn->cmd_lock);
+ 		if (!list_empty(&cmd->i_conn_node))
+-			list_del(&cmd->i_conn_node);
++			list_del_init(&cmd->i_conn_node);
+ 		spin_unlock_bh(&conn->cmd_lock);
+ 
+ 		/*
+@@ -1512,6 +1512,7 @@ isert_completion_rdma_read(struct iser_tx_desc *tx_desc,
+ 	iscsit_stop_dataout_timer(cmd);
+ 	device->unreg_rdma_mem(isert_cmd, isert_conn);
+ 	cmd->write_data_done = wr->cur_rdma_length;
++	wr->send_wr_num = 0;
+ 
+ 	pr_debug("Cmd: %p RDMA_READ comp calling execute_cmd\n", isert_cmd);
+ 	spin_lock_bh(&cmd->istate_lock);
+@@ -1552,7 +1553,7 @@ isert_do_control_comp(struct work_struct *work)
+ 		pr_debug("Calling iscsit_logout_post_handler >>>>>>>>>>>>>>\n");
+ 		/*
+ 		 * Call atomic_dec(&isert_conn->post_send_buf_count)
+-		 * from isert_free_conn()
++		 * from isert_wait_conn()
+ 		 */
+ 		isert_conn->logout_posted = true;
+ 		iscsit_logout_post_handler(cmd, cmd->conn);
+@@ -1576,6 +1577,7 @@ isert_response_completion(struct iser_tx_desc *tx_desc,
+ 			  struct ib_device *ib_dev)
+ {
+ 	struct iscsi_cmd *cmd = isert_cmd->iscsi_cmd;
++	struct isert_rdma_wr *wr = &isert_cmd->rdma_wr;
+ 
+ 	if (cmd->i_state == ISTATE_SEND_TASKMGTRSP ||
+ 	    cmd->i_state == ISTATE_SEND_LOGOUTRSP ||
+@@ -1587,7 +1589,7 @@ isert_response_completion(struct iser_tx_desc *tx_desc,
+ 		queue_work(isert_comp_wq, &isert_cmd->comp_work);
+ 		return;
+ 	}
+-	atomic_dec(&isert_conn->post_send_buf_count);
++	atomic_sub(wr->send_wr_num + 1, &isert_conn->post_send_buf_count);
+ 
+ 	cmd->i_state = ISTATE_SENT_STATUS;
+ 	isert_completion_put(tx_desc, isert_cmd, ib_dev);
+@@ -1625,7 +1627,7 @@ isert_send_completion(struct iser_tx_desc *tx_desc,
+ 	case ISER_IB_RDMA_READ:
+ 		pr_debug("isert_send_completion: Got ISER_IB_RDMA_READ:\n");
+ 
+-		atomic_dec(&isert_conn->post_send_buf_count);
++		atomic_sub(wr->send_wr_num, &isert_conn->post_send_buf_count);
+ 		isert_completion_rdma_read(tx_desc, isert_cmd);
+ 		break;
+ 	default:
+@@ -1636,31 +1638,39 @@ isert_send_completion(struct iser_tx_desc *tx_desc,
+ }
+ 
+ static void
+-isert_cq_comp_err(struct iser_tx_desc *tx_desc, struct isert_conn *isert_conn)
++isert_cq_tx_comp_err(struct iser_tx_desc *tx_desc, struct isert_conn *isert_conn)
+ {
+ 	struct ib_device *ib_dev = isert_conn->conn_cm_id->device;
++	struct isert_cmd *isert_cmd = tx_desc->isert_cmd;
++
++	if (!isert_cmd)
++		isert_unmap_tx_desc(tx_desc, ib_dev);
++	else
++		isert_completion_put(tx_desc, isert_cmd, ib_dev);
++}
++
++static void
++isert_cq_rx_comp_err(struct isert_conn *isert_conn)
++{
++	struct ib_device *ib_dev = isert_conn->conn_cm_id->device;
++	struct iscsi_conn *conn = isert_conn->conn;
+ 
+-	if (tx_desc) {
+-		struct isert_cmd *isert_cmd = tx_desc->isert_cmd;
++	if (isert_conn->post_recv_buf_count)
++		return;
+ 
+-		if (!isert_cmd)
+-			isert_unmap_tx_desc(tx_desc, ib_dev);
+-		else
+-			isert_completion_put(tx_desc, isert_cmd, ib_dev);
++	if (conn->sess) {
++		target_sess_cmd_list_set_waiting(conn->sess->se_sess);
++		target_wait_for_sess_cmds(conn->sess->se_sess);
+ 	}
+ 
+-	if (isert_conn->post_recv_buf_count == 0 &&
+-	    atomic_read(&isert_conn->post_send_buf_count) == 0) {
+-		pr_debug("isert_cq_comp_err >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\n");
+-		pr_debug("Calling wake_up from isert_cq_comp_err\n");
++	while (atomic_read(&isert_conn->post_send_buf_count))
++		msleep(3000);
+ 
+-		mutex_lock(&isert_conn->conn_mutex);
+-		if (isert_conn->state != ISER_CONN_DOWN)
+-			isert_conn->state = ISER_CONN_TERMINATING;
+-		mutex_unlock(&isert_conn->conn_mutex);
++	mutex_lock(&isert_conn->conn_mutex);
++	isert_conn->state = ISER_CONN_DOWN;
++	mutex_unlock(&isert_conn->conn_mutex);
+ 
+-		wake_up(&isert_conn->conn_wait_comp_err);
+-	}
++	complete(&isert_conn->conn_wait_comp_err);
+ }
+ 
+ static void
+@@ -1685,8 +1695,11 @@ isert_cq_tx_work(struct work_struct *work)
+ 			pr_debug("TX wc.status != IB_WC_SUCCESS >>>>>>>>>>>>>>\n");
+ 			pr_debug("TX wc.status: 0x%08x\n", wc.status);
+ 			pr_debug("TX wc.vendor_err: 0x%08x\n", wc.vendor_err);
+-			atomic_dec(&isert_conn->post_send_buf_count);
+-			isert_cq_comp_err(tx_desc, isert_conn);
++
++			if (wc.wr_id != ISER_FASTREG_LI_WRID) {
++				atomic_dec(&isert_conn->post_send_buf_count);
++				isert_cq_tx_comp_err(tx_desc, isert_conn);
++			}
+ 		}
+ 	}
+ 
+@@ -1729,7 +1742,7 @@ isert_cq_rx_work(struct work_struct *work)
+ 					 wc.vendor_err);
+ 			}
+ 			isert_conn->post_recv_buf_count--;
+-			isert_cq_comp_err(NULL, isert_conn);
++			isert_cq_rx_comp_err(isert_conn);
+ 		}
+ 	}
+ 
+@@ -2151,6 +2164,7 @@ isert_fast_reg_mr(struct fast_reg_descriptor *fr_desc,
+ 
+ 	if (!fr_desc->valid) {
+ 		memset(&inv_wr, 0, sizeof(inv_wr));
++		inv_wr.wr_id = ISER_FASTREG_LI_WRID;
+ 		inv_wr.opcode = IB_WR_LOCAL_INV;
+ 		inv_wr.ex.invalidate_rkey = fr_desc->data_mr->rkey;
+ 		wr = &inv_wr;
+@@ -2161,6 +2175,7 @@ isert_fast_reg_mr(struct fast_reg_descriptor *fr_desc,
+ 
+ 	/* Prepare FASTREG WR */
+ 	memset(&fr_wr, 0, sizeof(fr_wr));
++	fr_wr.wr_id = ISER_FASTREG_LI_WRID;
+ 	fr_wr.opcode = IB_WR_FAST_REG_MR;
+ 	fr_wr.wr.fast_reg.iova_start =
+ 		fr_desc->data_frpl->page_list[0] + page_off;
+@@ -2325,12 +2340,12 @@ isert_put_datain(struct iscsi_conn *conn, struct iscsi_cmd *cmd)
+ 	isert_init_tx_hdrs(isert_conn, &isert_cmd->tx_desc);
+ 	isert_init_send_wr(isert_cmd, &isert_cmd->tx_desc.send_wr);
+ 
+-	atomic_inc(&isert_conn->post_send_buf_count);
++	atomic_add(wr->send_wr_num + 1, &isert_conn->post_send_buf_count);
+ 
+ 	rc = ib_post_send(isert_conn->conn_qp, wr->send_wr, &wr_failed);
+ 	if (rc) {
+ 		pr_warn("ib_post_send() failed for IB_WR_RDMA_WRITE\n");
+-		atomic_dec(&isert_conn->post_send_buf_count);
++		atomic_sub(wr->send_wr_num + 1, &isert_conn->post_send_buf_count);
+ 	}
+ 	pr_debug("Cmd: %p posted RDMA_WRITE + Response for iSER Data READ\n",
+ 		 isert_cmd);
+@@ -2358,12 +2373,12 @@ isert_get_dataout(struct iscsi_conn *conn, struct iscsi_cmd *cmd, bool recovery)
+ 		return rc;
+ 	}
+ 
+-	atomic_inc(&isert_conn->post_send_buf_count);
++	atomic_add(wr->send_wr_num, &isert_conn->post_send_buf_count);
+ 
+ 	rc = ib_post_send(isert_conn->conn_qp, wr->send_wr, &wr_failed);
+ 	if (rc) {
+ 		pr_warn("ib_post_send() failed for IB_WR_RDMA_READ\n");
+-		atomic_dec(&isert_conn->post_send_buf_count);
++		atomic_sub(wr->send_wr_num, &isert_conn->post_send_buf_count);
+ 	}
+ 	pr_debug("Cmd: %p posted RDMA_READ memory for ISER Data WRITE\n",
+ 		 isert_cmd);
+@@ -2650,22 +2665,11 @@ isert_free_np(struct iscsi_np *np)
+ 	kfree(isert_np);
+ }
+ 
+-static int isert_check_state(struct isert_conn *isert_conn, int state)
+-{
+-	int ret;
+-
+-	mutex_lock(&isert_conn->conn_mutex);
+-	ret = (isert_conn->state == state);
+-	mutex_unlock(&isert_conn->conn_mutex);
+-
+-	return ret;
+-}
+-
+-static void isert_free_conn(struct iscsi_conn *conn)
++static void isert_wait_conn(struct iscsi_conn *conn)
+ {
+ 	struct isert_conn *isert_conn = conn->context;
+ 
+-	pr_debug("isert_free_conn: Starting \n");
++	pr_debug("isert_wait_conn: Starting \n");
+ 	/*
+ 	 * Decrement post_send_buf_count for special case when called
+ 	 * from isert_do_control_comp() -> iscsit_logout_post_handler()
+@@ -2675,38 +2679,29 @@ static void isert_free_conn(struct iscsi_conn *conn)
+ 		atomic_dec(&isert_conn->post_send_buf_count);
+ 
+ 	if (isert_conn->conn_cm_id && isert_conn->state != ISER_CONN_DOWN) {
+-		pr_debug("Calling rdma_disconnect from isert_free_conn\n");
++		pr_debug("Calling rdma_disconnect from isert_wait_conn\n");
+ 		rdma_disconnect(isert_conn->conn_cm_id);
+ 	}
+ 	/*
+ 	 * Only wait for conn_wait_comp_err if the isert_conn made it
+ 	 * into full feature phase..
+ 	 */
+-	if (isert_conn->state == ISER_CONN_UP) {
+-		pr_debug("isert_free_conn: Before wait_event comp_err %d\n",
+-			 isert_conn->state);
+-		mutex_unlock(&isert_conn->conn_mutex);
+-
+-		wait_event(isert_conn->conn_wait_comp_err,
+-			  (isert_check_state(isert_conn, ISER_CONN_TERMINATING)));
+-
+-		wait_event(isert_conn->conn_wait,
+-			  (isert_check_state(isert_conn, ISER_CONN_DOWN)));
+-
+-		isert_put_conn(isert_conn);
+-		return;
+-	}
+ 	if (isert_conn->state == ISER_CONN_INIT) {
+ 		mutex_unlock(&isert_conn->conn_mutex);
+-		isert_put_conn(isert_conn);
+ 		return;
+ 	}
+-	pr_debug("isert_free_conn: wait_event conn_wait %d\n",
+-		 isert_conn->state);
++	if (isert_conn->state == ISER_CONN_UP)
++		isert_conn->state = ISER_CONN_TERMINATING;
+ 	mutex_unlock(&isert_conn->conn_mutex);
+ 
+-	wait_event(isert_conn->conn_wait,
+-		  (isert_check_state(isert_conn, ISER_CONN_DOWN)));
++	wait_for_completion(&isert_conn->conn_wait_comp_err);
++
++	wait_for_completion(&isert_conn->conn_wait);
++}
++
++static void isert_free_conn(struct iscsi_conn *conn)
++{
++	struct isert_conn *isert_conn = conn->context;
+ 
+ 	isert_put_conn(isert_conn);
+ }
+@@ -2719,6 +2714,7 @@ static struct iscsit_transport iser_target_transport = {
+ 	.iscsit_setup_np	= isert_setup_np,
+ 	.iscsit_accept_np	= isert_accept_np,
+ 	.iscsit_free_np		= isert_free_np,
++	.iscsit_wait_conn	= isert_wait_conn,
+ 	.iscsit_free_conn	= isert_free_conn,
+ 	.iscsit_get_login_rx	= isert_get_login_rx,
+ 	.iscsit_put_login_tx	= isert_put_login_tx,
+diff --git a/drivers/infiniband/ulp/isert/ib_isert.h b/drivers/infiniband/ulp/isert/ib_isert.h
+index 631f2090f0b8..52f4bf0d1a0f 100644
+--- a/drivers/infiniband/ulp/isert/ib_isert.h
++++ b/drivers/infiniband/ulp/isert/ib_isert.h
+@@ -6,6 +6,7 @@
+ 
+ #define ISERT_RDMA_LISTEN_BACKLOG	10
+ #define ISCSI_ISER_SG_TABLESIZE		256
++#define ISER_FASTREG_LI_WRID		0xffffffffffffffffULL
+ 
+ enum isert_desc_type {
+ 	ISCSI_TX_CONTROL,
+@@ -114,8 +115,8 @@ struct isert_conn {
+ 	struct isert_device	*conn_device;
+ 	struct work_struct	conn_logout_work;
+ 	struct mutex		conn_mutex;
+-	wait_queue_head_t	conn_wait;
+-	wait_queue_head_t	conn_wait_comp_err;
++	struct completion	conn_wait;
++	struct completion	conn_wait_comp_err;
+ 	struct kref		conn_kref;
+ 	struct list_head	conn_frwr_pool;
+ 	int			conn_frwr_pool_size;
+diff --git a/drivers/md/dm-cache-target.c b/drivers/md/dm-cache-target.c
+index ea3e4b4f7e58..6ab68e058a0a 100644
+--- a/drivers/md/dm-cache-target.c
++++ b/drivers/md/dm-cache-target.c
+@@ -867,12 +867,13 @@ static void issue_copy_real(struct dm_cache_migration *mg)
+ 	int r;
+ 	struct dm_io_region o_region, c_region;
+ 	struct cache *cache = mg->cache;
++	sector_t cblock = from_cblock(mg->cblock);
+ 
+ 	o_region.bdev = cache->origin_dev->bdev;
+ 	o_region.count = cache->sectors_per_block;
+ 
+ 	c_region.bdev = cache->cache_dev->bdev;
+-	c_region.sector = from_cblock(mg->cblock) * cache->sectors_per_block;
++	c_region.sector = cblock * cache->sectors_per_block;
+ 	c_region.count = cache->sectors_per_block;
+ 
+ 	if (mg->writeback || mg->demote) {
+@@ -2181,20 +2182,18 @@ static int cache_map(struct dm_target *ti, struct bio *bio)
+ 	bool discarded_block;
+ 	struct dm_bio_prison_cell *cell;
+ 	struct policy_result lookup_result;
+-	struct per_bio_data *pb;
++	struct per_bio_data *pb = init_per_bio_data(bio, pb_data_size);
+ 
+-	if (from_oblock(block) > from_oblock(cache->origin_blocks)) {
++	if (unlikely(from_oblock(block) >= from_oblock(cache->origin_blocks))) {
+ 		/*
+ 		 * This can only occur if the io goes to a partial block at
+ 		 * the end of the origin device.  We don't cache these.
+ 		 * Just remap to the origin and carry on.
+ 		 */
+-		remap_to_origin_clear_discard(cache, bio, block);
++		remap_to_origin(cache, bio);
+ 		return DM_MAPIO_REMAPPED;
+ 	}
+ 
+-	pb = init_per_bio_data(bio, pb_data_size);
+-
+ 	if (bio->bi_rw & (REQ_FLUSH | REQ_FUA | REQ_DISCARD)) {
+ 		defer_bio(cache, bio);
+ 		return DM_MAPIO_SUBMITTED;
+diff --git a/drivers/md/persistent-data/dm-space-map-metadata.c b/drivers/md/persistent-data/dm-space-map-metadata.c
+index afb419e514bf..579b58200bf2 100644
+--- a/drivers/md/persistent-data/dm-space-map-metadata.c
++++ b/drivers/md/persistent-data/dm-space-map-metadata.c
+@@ -91,6 +91,69 @@ struct block_op {
+ 	dm_block_t block;
+ };
+ 
++struct bop_ring_buffer {
++	unsigned begin;
++	unsigned end;
++	struct block_op bops[MAX_RECURSIVE_ALLOCATIONS + 1];
++};
++
++static void brb_init(struct bop_ring_buffer *brb)
++{
++	brb->begin = 0;
++	brb->end = 0;
++}
++
++static bool brb_empty(struct bop_ring_buffer *brb)
++{
++	return brb->begin == brb->end;
++}
++
++static unsigned brb_next(struct bop_ring_buffer *brb, unsigned old)
++{
++	unsigned r = old + 1;
++	return (r >= (sizeof(brb->bops) / sizeof(*brb->bops))) ? 0 : r;
++}
++
++static int brb_push(struct bop_ring_buffer *brb,
++		    enum block_op_type type, dm_block_t b)
++{
++	struct block_op *bop;
++	unsigned next = brb_next(brb, brb->end);
++
++	/*
++	 * We don't allow the last bop to be filled, this way we can
++	 * differentiate between full and empty.
++	 */
++	if (next == brb->begin)
++		return -ENOMEM;
++
++	bop = brb->bops + brb->end;
++	bop->type = type;
++	bop->block = b;
++
++	brb->end = next;
++
++	return 0;
++}
++
++static int brb_pop(struct bop_ring_buffer *brb, struct block_op *result)
++{
++	struct block_op *bop;
++
++	if (brb_empty(brb))
++		return -ENODATA;
++
++	bop = brb->bops + brb->begin;
++	result->type = bop->type;
++	result->block = bop->block;
++
++	brb->begin = brb_next(brb, brb->begin);
++
++	return 0;
++}
++
++/*----------------------------------------------------------------*/
++
+ struct sm_metadata {
+ 	struct dm_space_map sm;
+ 
+@@ -101,25 +164,20 @@ struct sm_metadata {
+ 
+ 	unsigned recursion_count;
+ 	unsigned allocated_this_transaction;
+-	unsigned nr_uncommitted;
+-	struct block_op uncommitted[MAX_RECURSIVE_ALLOCATIONS];
++	struct bop_ring_buffer uncommitted;
+ 
+ 	struct threshold threshold;
+ };
+ 
+ static int add_bop(struct sm_metadata *smm, enum block_op_type type, dm_block_t b)
+ {
+-	struct block_op *op;
++	int r = brb_push(&smm->uncommitted, type, b);
+ 
+-	if (smm->nr_uncommitted == MAX_RECURSIVE_ALLOCATIONS) {
++	if (r) {
+ 		DMERR("too many recursive allocations");
+ 		return -ENOMEM;
+ 	}
+ 
+-	op = smm->uncommitted + smm->nr_uncommitted++;
+-	op->type = type;
+-	op->block = b;
+-
+ 	return 0;
+ }
+ 
+@@ -158,11 +216,17 @@ static int out(struct sm_metadata *smm)
+ 		return -ENOMEM;
+ 	}
+ 
+-	if (smm->recursion_count == 1 && smm->nr_uncommitted) {
+-		while (smm->nr_uncommitted && !r) {
+-			smm->nr_uncommitted--;
+-			r = commit_bop(smm, smm->uncommitted +
+-				       smm->nr_uncommitted);
++	if (smm->recursion_count == 1) {
++		while (!brb_empty(&smm->uncommitted)) {
++			struct block_op bop;
++
++			r = brb_pop(&smm->uncommitted, &bop);
++			if (r) {
++				DMERR("bug in bop ring buffer");
++				break;
++			}
++
++			r = commit_bop(smm, &bop);
+ 			if (r)
+ 				break;
+ 		}
+@@ -217,7 +281,8 @@ static int sm_metadata_get_nr_free(struct dm_space_map *sm, dm_block_t *count)
+ static int sm_metadata_get_count(struct dm_space_map *sm, dm_block_t b,
+ 				 uint32_t *result)
+ {
+-	int r, i;
++	int r;
++	unsigned i;
+ 	struct sm_metadata *smm = container_of(sm, struct sm_metadata, sm);
+ 	unsigned adjustment = 0;
+ 
+@@ -225,8 +290,10 @@ static int sm_metadata_get_count(struct dm_space_map *sm, dm_block_t b,
+ 	 * We may have some uncommitted adjustments to add.  This list
+ 	 * should always be really short.
+ 	 */
+-	for (i = 0; i < smm->nr_uncommitted; i++) {
+-		struct block_op *op = smm->uncommitted + i;
++	for (i = smm->uncommitted.begin;
++	     i != smm->uncommitted.end;
++	     i = brb_next(&smm->uncommitted, i)) {
++		struct block_op *op = smm->uncommitted.bops + i;
+ 
+ 		if (op->block != b)
+ 			continue;
+@@ -254,7 +321,8 @@ static int sm_metadata_get_count(struct dm_space_map *sm, dm_block_t b,
+ static int sm_metadata_count_is_more_than_one(struct dm_space_map *sm,
+ 					      dm_block_t b, int *result)
+ {
+-	int r, i, adjustment = 0;
++	int r, adjustment = 0;
++	unsigned i;
+ 	struct sm_metadata *smm = container_of(sm, struct sm_metadata, sm);
+ 	uint32_t rc;
+ 
+@@ -262,8 +330,11 @@ static int sm_metadata_count_is_more_than_one(struct dm_space_map *sm,
+ 	 * We may have some uncommitted adjustments to add.  This list
+ 	 * should always be really short.
+ 	 */
+-	for (i = 0; i < smm->nr_uncommitted; i++) {
+-		struct block_op *op = smm->uncommitted + i;
++	for (i = smm->uncommitted.begin;
++	     i != smm->uncommitted.end;
++	     i = brb_next(&smm->uncommitted, i)) {
++
++		struct block_op *op = smm->uncommitted.bops + i;
+ 
+ 		if (op->block != b)
+ 			continue;
+@@ -671,7 +742,7 @@ int dm_sm_metadata_create(struct dm_space_map *sm,
+ 	smm->begin = superblock + 1;
+ 	smm->recursion_count = 0;
+ 	smm->allocated_this_transaction = 0;
+-	smm->nr_uncommitted = 0;
++	brb_init(&smm->uncommitted);
+ 	threshold_init(&smm->threshold);
+ 
+ 	memcpy(&smm->sm, &bootstrap_ops, sizeof(smm->sm));
+@@ -713,7 +784,7 @@ int dm_sm_metadata_open(struct dm_space_map *sm,
+ 	smm->begin = 0;
+ 	smm->recursion_count = 0;
+ 	smm->allocated_this_transaction = 0;
+-	smm->nr_uncommitted = 0;
++	brb_init(&smm->uncommitted);
+ 	threshold_init(&smm->threshold);
+ 
+ 	memcpy(&smm->old_ll, &smm->ll, sizeof(smm->old_ll));
+diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c
+index c1c3b132fed5..e381142d636f 100644
+--- a/drivers/net/can/flexcan.c
++++ b/drivers/net/can/flexcan.c
+@@ -144,6 +144,8 @@
+ 
+ #define FLEXCAN_MB_CODE_MASK		(0xf0ffffff)
+ 
++#define FLEXCAN_TIMEOUT_US             (50)
++
+ /*
+  * FLEXCAN hardware feature flags
+  *
+@@ -259,6 +261,22 @@ static inline void flexcan_write(u32 val, void __iomem *addr)
+ }
+ #endif
+ 
++static inline int flexcan_transceiver_enable(const struct flexcan_priv *priv)
++{
++	if (!priv->reg_xceiver)
++		return 0;
++
++	return regulator_enable(priv->reg_xceiver);
++}
++
++static inline int flexcan_transceiver_disable(const struct flexcan_priv *priv)
++{
++	if (!priv->reg_xceiver)
++		return 0;
++
++	return regulator_disable(priv->reg_xceiver);
++}
++
+ static inline int flexcan_has_and_handle_berr(const struct flexcan_priv *priv,
+ 					      u32 reg_esr)
+ {
+@@ -266,26 +284,42 @@ static inline int flexcan_has_and_handle_berr(const struct flexcan_priv *priv,
+ 		(reg_esr & FLEXCAN_ESR_ERR_BUS);
+ }
+ 
+-static inline void flexcan_chip_enable(struct flexcan_priv *priv)
++static int flexcan_chip_enable(struct flexcan_priv *priv)
+ {
+ 	struct flexcan_regs __iomem *regs = priv->base;
++	unsigned int timeout = FLEXCAN_TIMEOUT_US / 10;
+ 	u32 reg;
+ 
+ 	reg = flexcan_read(&regs->mcr);
+ 	reg &= ~FLEXCAN_MCR_MDIS;
+ 	flexcan_write(reg, &regs->mcr);
+ 
+-	udelay(10);
++	while (timeout-- && (flexcan_read(&regs->mcr) & FLEXCAN_MCR_LPM_ACK))
++		usleep_range(10, 20);
++
++	if (flexcan_read(&regs->mcr) & FLEXCAN_MCR_LPM_ACK)
++		return -ETIMEDOUT;
++
++	return 0;
+ }
+ 
+-static inline void flexcan_chip_disable(struct flexcan_priv *priv)
++static int flexcan_chip_disable(struct flexcan_priv *priv)
+ {
+ 	struct flexcan_regs __iomem *regs = priv->base;
++	unsigned int timeout = FLEXCAN_TIMEOUT_US / 10;
+ 	u32 reg;
+ 
+ 	reg = flexcan_read(&regs->mcr);
+ 	reg |= FLEXCAN_MCR_MDIS;
+ 	flexcan_write(reg, &regs->mcr);
++
++	while (timeout-- && !(flexcan_read(&regs->mcr) & FLEXCAN_MCR_LPM_ACK))
++		usleep_range(10, 20);
++
++	if (!(flexcan_read(&regs->mcr) & FLEXCAN_MCR_LPM_ACK))
++		return -ETIMEDOUT;
++
++	return 0;
+ }
+ 
+ static int flexcan_get_berr_counter(const struct net_device *dev,
+@@ -706,7 +740,9 @@ static int flexcan_chip_start(struct net_device *dev)
+ 	u32 reg_mcr, reg_ctrl;
+ 
+ 	/* enable module */
+-	flexcan_chip_enable(priv);
++	err = flexcan_chip_enable(priv);
++	if (err)
++		return err;
+ 
+ 	/* soft reset */
+ 	flexcan_write(FLEXCAN_MCR_SOFTRST, &regs->mcr);
+@@ -785,11 +821,9 @@ static int flexcan_chip_start(struct net_device *dev)
+ 	if (priv->devtype_data->features & FLEXCAN_HAS_V10_FEATURES)
+ 		flexcan_write(0x0, &regs->rxfgmask);
+ 
+-	if (priv->reg_xceiver)	{
+-		err = regulator_enable(priv->reg_xceiver);
+-		if (err)
+-			goto out;
+-	}
++	err = flexcan_transceiver_enable(priv);
++	if (err)
++		goto out;
+ 
+ 	/* synchronize with the can bus */
+ 	reg_mcr = flexcan_read(&regs->mcr);
+@@ -824,16 +858,17 @@ static void flexcan_chip_stop(struct net_device *dev)
+ 	struct flexcan_regs __iomem *regs = priv->base;
+ 	u32 reg;
+ 
+-	/* Disable all interrupts */
+-	flexcan_write(0, &regs->imask1);
+-
+ 	/* Disable + halt module */
+ 	reg = flexcan_read(&regs->mcr);
+ 	reg |= FLEXCAN_MCR_MDIS | FLEXCAN_MCR_HALT;
+ 	flexcan_write(reg, &regs->mcr);
+ 
+-	if (priv->reg_xceiver)
+-		regulator_disable(priv->reg_xceiver);
++	/* Disable all interrupts */
++	flexcan_write(0, &regs->imask1);
++	flexcan_write(priv->reg_ctrl_default & ~FLEXCAN_CTRL_ERR_ALL,
++		      &regs->ctrl);
++
++	flexcan_transceiver_disable(priv);
+ 	priv->can.state = CAN_STATE_STOPPED;
+ 
+ 	return;
+@@ -863,7 +898,7 @@ static int flexcan_open(struct net_device *dev)
+ 	/* start chip and queuing */
+ 	err = flexcan_chip_start(dev);
+ 	if (err)
+-		goto out_close;
++		goto out_free_irq;
+ 
+ 	can_led_event(dev, CAN_LED_EVENT_OPEN);
+ 
+@@ -872,6 +907,8 @@ static int flexcan_open(struct net_device *dev)
+ 
+ 	return 0;
+ 
++ out_free_irq:
++	free_irq(dev->irq, dev);
+  out_close:
+ 	close_candev(dev);
+  out_disable_per:
+@@ -942,12 +979,16 @@ static int register_flexcandev(struct net_device *dev)
+ 		goto out_disable_ipg;
+ 
+ 	/* select "bus clock", chip must be disabled */
+-	flexcan_chip_disable(priv);
++	err = flexcan_chip_disable(priv);
++	if (err)
++		goto out_disable_per;
+ 	reg = flexcan_read(&regs->ctrl);
+ 	reg |= FLEXCAN_CTRL_CLK_SRC;
+ 	flexcan_write(reg, &regs->ctrl);
+ 
+-	flexcan_chip_enable(priv);
++	err = flexcan_chip_enable(priv);
++	if (err)
++		goto out_chip_disable;
+ 
+ 	/* set freeze, halt and activate FIFO, restrict register access */
+ 	reg = flexcan_read(&regs->mcr);
+@@ -964,14 +1005,15 @@ static int register_flexcandev(struct net_device *dev)
+ 	if (!(reg & FLEXCAN_MCR_FEN)) {
+ 		netdev_err(dev, "Could not enable RX FIFO, unsupported core\n");
+ 		err = -ENODEV;
+-		goto out_disable_per;
++		goto out_chip_disable;
+ 	}
+ 
+ 	err = register_candev(dev);
+ 
+- out_disable_per:
+ 	/* disable core and turn off clocks */
++ out_chip_disable:
+ 	flexcan_chip_disable(priv);
++ out_disable_per:
+ 	clk_disable_unprepare(priv->clk_per);
+  out_disable_ipg:
+ 	clk_disable_unprepare(priv->clk_ipg);
+@@ -1101,9 +1143,10 @@ static int flexcan_probe(struct platform_device *pdev)
+ static int flexcan_remove(struct platform_device *pdev)
+ {
+ 	struct net_device *dev = platform_get_drvdata(pdev);
++	struct flexcan_priv *priv = netdev_priv(dev);
+ 
+ 	unregister_flexcandev(dev);
+-
++	netif_napi_del(&priv->napi);
+ 	free_candev(dev);
+ 
+ 	return 0;
+@@ -1114,8 +1157,11 @@ static int flexcan_suspend(struct device *device)
+ {
+ 	struct net_device *dev = dev_get_drvdata(device);
+ 	struct flexcan_priv *priv = netdev_priv(dev);
++	int err;
+ 
+-	flexcan_chip_disable(priv);
++	err = flexcan_chip_disable(priv);
++	if (err)
++		return err;
+ 
+ 	if (netif_running(dev)) {
+ 		netif_stop_queue(dev);
+@@ -1136,9 +1182,7 @@ static int flexcan_resume(struct device *device)
+ 		netif_device_attach(dev);
+ 		netif_start_queue(dev);
+ 	}
+-	flexcan_chip_enable(priv);
+-
+-	return 0;
++	return flexcan_chip_enable(priv);
+ }
+ #endif /* CONFIG_PM_SLEEP */
+ 
+diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
+index c0acf98d1ea5..14a50a11d72e 100644
+--- a/drivers/net/ethernet/broadcom/tg3.c
++++ b/drivers/net/ethernet/broadcom/tg3.c
+@@ -6813,8 +6813,7 @@ static int tg3_rx(struct tg3_napi *tnapi, int budget)
+ 
+ 		work_mask |= opaque_key;
+ 
+-		if ((desc->err_vlan & RXD_ERR_MASK) != 0 &&
+-		    (desc->err_vlan != RXD_ERR_ODD_NIBBLE_RCVD_MII)) {
++		if (desc->err_vlan & RXD_ERR_MASK) {
+ 		drop_it:
+ 			tg3_recycle_rx(tnapi, tpr, opaque_key,
+ 				       desc_idx, *post_ptr);
+diff --git a/drivers/net/ethernet/broadcom/tg3.h b/drivers/net/ethernet/broadcom/tg3.h
+index 70257808aa37..ac50e7c9c2b8 100644
+--- a/drivers/net/ethernet/broadcom/tg3.h
++++ b/drivers/net/ethernet/broadcom/tg3.h
+@@ -2598,7 +2598,11 @@ struct tg3_rx_buffer_desc {
+ #define RXD_ERR_TOO_SMALL		0x00400000
+ #define RXD_ERR_NO_RESOURCES		0x00800000
+ #define RXD_ERR_HUGE_FRAME		0x01000000
+-#define RXD_ERR_MASK			0xffff0000
++
++#define RXD_ERR_MASK	(RXD_ERR_BAD_CRC | RXD_ERR_COLLISION |		\
++			 RXD_ERR_LINK_LOST | RXD_ERR_PHY_DECODE |	\
++			 RXD_ERR_MAC_ABRT | RXD_ERR_TOO_SMALL |		\
++			 RXD_ERR_NO_RESOURCES | RXD_ERR_HUGE_FRAME)
+ 
+ 	u32				reserved;
+ 	u32				opaque;
+diff --git a/drivers/net/ethernet/sfc/ptp.c b/drivers/net/ethernet/sfc/ptp.c
+index 3dd39dcfe36b..a12410381cb1 100644
+--- a/drivers/net/ethernet/sfc/ptp.c
++++ b/drivers/net/ethernet/sfc/ptp.c
+@@ -1360,6 +1360,13 @@ void efx_ptp_event(struct efx_nic *efx, efx_qword_t *ev)
+ 	struct efx_ptp_data *ptp = efx->ptp_data;
+ 	int code = EFX_QWORD_FIELD(*ev, MCDI_EVENT_CODE);
+ 
++	if (!ptp) {
++		if (net_ratelimit())
++			netif_warn(efx, drv, efx->net_dev,
++				   "Received PTP event but PTP not set up\n");
++		return;
++	}
++
+ 	if (!ptp->enabled)
+ 		return;
+ 
+diff --git a/drivers/net/tun.c b/drivers/net/tun.c
+index 7c8343a4f918..10636cbd3807 100644
+--- a/drivers/net/tun.c
++++ b/drivers/net/tun.c
+@@ -1650,7 +1650,9 @@ static int tun_set_iff(struct net *net, struct file *file, struct ifreq *ifr)
+ 				   TUN_USER_FEATURES | NETIF_F_HW_VLAN_CTAG_TX |
+ 				   NETIF_F_HW_VLAN_STAG_TX;
+ 		dev->features = dev->hw_features;
+-		dev->vlan_features = dev->features;
++		dev->vlan_features = dev->features &
++				     ~(NETIF_F_HW_VLAN_CTAG_TX |
++				       NETIF_F_HW_VLAN_STAG_TX);
+ 
+ 		INIT_LIST_HEAD(&tun->disabled);
+ 		err = tun_attach(tun, file, false);
+diff --git a/drivers/net/usb/ax88179_178a.c b/drivers/net/usb/ax88179_178a.c
+index 5e2bac650bd8..3ecb2133dee6 100644
+--- a/drivers/net/usb/ax88179_178a.c
++++ b/drivers/net/usb/ax88179_178a.c
+@@ -1031,20 +1031,12 @@ static int ax88179_bind(struct usbnet *dev, struct usb_interface *intf)
+ 	dev->mii.phy_id = 0x03;
+ 	dev->mii.supports_gmii = 1;
+ 
+-	if (usb_device_no_sg_constraint(dev->udev))
+-		dev->can_dma_sg = 1;
+-
+ 	dev->net->features |= NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM |
+ 			      NETIF_F_RXCSUM;
+ 
+ 	dev->net->hw_features |= NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM |
+ 				 NETIF_F_RXCSUM;
+ 
+-	if (dev->can_dma_sg) {
+-		dev->net->features |= NETIF_F_SG | NETIF_F_TSO;
+-		dev->net->hw_features |= NETIF_F_SG | NETIF_F_TSO;
+-	}
+-
+ 	/* Enable checksum offload */
+ 	*tmp = AX_RXCOE_IP | AX_RXCOE_TCP | AX_RXCOE_UDP |
+ 	       AX_RXCOE_TCPV6 | AX_RXCOE_UDPV6;
+diff --git a/drivers/net/veth.c b/drivers/net/veth.c
+index eee1f19ef1e9..61c4044f644e 100644
+--- a/drivers/net/veth.c
++++ b/drivers/net/veth.c
+@@ -269,7 +269,8 @@ static void veth_setup(struct net_device *dev)
+ 	dev->ethtool_ops = &veth_ethtool_ops;
+ 	dev->features |= NETIF_F_LLTX;
+ 	dev->features |= VETH_FEATURES;
+-	dev->vlan_features = dev->features;
++	dev->vlan_features = dev->features &
++			     ~(NETIF_F_HW_VLAN_CTAG_TX | NETIF_F_HW_VLAN_STAG_TX);
+ 	dev->destructor = veth_dev_free;
+ 
+ 	dev->hw_features = VETH_FEATURES;
+diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
+index 8065066a6230..0232156dade3 100644
+--- a/drivers/net/virtio_net.c
++++ b/drivers/net/virtio_net.c
+@@ -1621,7 +1621,8 @@ static int virtnet_probe(struct virtio_device *vdev)
+ 	/* If we can receive ANY GSO packets, we must allocate large ones. */
+ 	if (virtio_has_feature(vdev, VIRTIO_NET_F_GUEST_TSO4) ||
+ 	    virtio_has_feature(vdev, VIRTIO_NET_F_GUEST_TSO6) ||
+-	    virtio_has_feature(vdev, VIRTIO_NET_F_GUEST_ECN))
++	    virtio_has_feature(vdev, VIRTIO_NET_F_GUEST_ECN) ||
++	    virtio_has_feature(vdev, VIRTIO_NET_F_GUEST_UFO))
+ 		vi->big_packets = true;
+ 
+ 	if (virtio_has_feature(vdev, VIRTIO_NET_F_MRG_RXBUF))
+diff --git a/drivers/net/vmxnet3/vmxnet3_drv.c b/drivers/net/vmxnet3/vmxnet3_drv.c
+index 7e2788c488ed..55d89390b4bc 100644
+--- a/drivers/net/vmxnet3/vmxnet3_drv.c
++++ b/drivers/net/vmxnet3/vmxnet3_drv.c
+@@ -1760,11 +1760,20 @@ vmxnet3_netpoll(struct net_device *netdev)
+ {
+ 	struct vmxnet3_adapter *adapter = netdev_priv(netdev);
+ 
+-	if (adapter->intr.mask_mode == VMXNET3_IMM_ACTIVE)
+-		vmxnet3_disable_all_intrs(adapter);
+-
+-	vmxnet3_do_poll(adapter, adapter->rx_queue[0].rx_ring[0].size);
+-	vmxnet3_enable_all_intrs(adapter);
++	switch (adapter->intr.type) {
++#ifdef CONFIG_PCI_MSI
++	case VMXNET3_IT_MSIX: {
++		int i;
++		for (i = 0; i < adapter->num_rx_queues; i++)
++			vmxnet3_msix_rx(0, &adapter->rx_queue[i]);
++		break;
++	}
++#endif
++	case VMXNET3_IT_MSI:
++	default:
++		vmxnet3_intr(0, adapter->netdev);
++		break;
++	}
+ 
+ }
+ #endif	/* CONFIG_NET_POLL_CONTROLLER */
+diff --git a/drivers/net/wireless/ath/ath9k/ar9462_2p0_initvals.h b/drivers/net/wireless/ath/ath9k/ar9462_2p0_initvals.h
+index 092b9d412e7f..1078fbd7bda2 100644
+--- a/drivers/net/wireless/ath/ath9k/ar9462_2p0_initvals.h
++++ b/drivers/net/wireless/ath/ath9k/ar9462_2p0_initvals.h
+@@ -56,7 +56,7 @@ static const u32 ar9462_2p0_baseband_postamble[][5] = {
+ 	{0x00009e14, 0x37b95d5e, 0x37b9605e, 0x3236605e, 0x32365a5e},
+ 	{0x00009e18, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+ 	{0x00009e1c, 0x0001cf9c, 0x0001cf9c, 0x00021f9c, 0x00021f9c},
+-	{0x00009e20, 0x000003b5, 0x000003b5, 0x000003ce, 0x000003ce},
++	{0x00009e20, 0x000003a5, 0x000003a5, 0x000003a5, 0x000003a5},
+ 	{0x00009e2c, 0x0000001c, 0x0000001c, 0x00000021, 0x00000021},
+ 	{0x00009e3c, 0xcf946220, 0xcf946220, 0xcfd5c782, 0xcfd5c282},
+ 	{0x00009e44, 0x62321e27, 0x62321e27, 0xfe291e27, 0xfe291e27},
+@@ -95,7 +95,7 @@ static const u32 ar9462_2p0_baseband_postamble[][5] = {
+ 	{0x0000ae04, 0x001c0000, 0x001c0000, 0x001c0000, 0x00100000},
+ 	{0x0000ae18, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+ 	{0x0000ae1c, 0x0000019c, 0x0000019c, 0x0000019c, 0x0000019c},
+-	{0x0000ae20, 0x000001b5, 0x000001b5, 0x000001ce, 0x000001ce},
++	{0x0000ae20, 0x000001a6, 0x000001a6, 0x000001aa, 0x000001aa},
+ 	{0x0000b284, 0x00000000, 0x00000000, 0x00000550, 0x00000550},
+ };
+ 
+diff --git a/drivers/net/wireless/ath/ath9k/recv.c b/drivers/net/wireless/ath/ath9k/recv.c
+index a1ab4ff46818..c2fa0e3490c7 100644
+--- a/drivers/net/wireless/ath/ath9k/recv.c
++++ b/drivers/net/wireless/ath/ath9k/recv.c
+@@ -730,11 +730,18 @@ static struct ath_buf *ath_get_next_rx_buf(struct ath_softc *sc,
+ 			return NULL;
+ 
+ 		/*
+-		 * mark descriptor as zero-length and set the 'more'
+-		 * flag to ensure that both buffers get discarded
++		 * Re-check previous descriptor, in case it has been filled
++		 * in the mean time.
+ 		 */
+-		rs->rs_datalen = 0;
+-		rs->rs_more = true;
++		ret = ath9k_hw_rxprocdesc(ah, ds, rs);
++		if (ret == -EINPROGRESS) {
++			/*
++			 * mark descriptor as zero-length and set the 'more'
++			 * flag to ensure that both buffers get discarded
++			 */
++			rs->rs_datalen = 0;
++			rs->rs_more = true;
++		}
+ 	}
+ 
+ 	list_del(&bf->list);
+@@ -1093,32 +1100,32 @@ static int ath9k_rx_skb_preprocess(struct ath_softc *sc,
+ 	struct ath_common *common = ath9k_hw_common(ah);
+ 	struct ieee80211_hdr *hdr;
+ 	bool discard_current = sc->rx.discard_next;
+-	int ret = 0;
+ 
+ 	/*
+ 	 * Discard corrupt descriptors which are marked in
+ 	 * ath_get_next_rx_buf().
+ 	 */
+-	sc->rx.discard_next = rx_stats->rs_more;
+ 	if (discard_current)
+-		return -EINVAL;
++		goto corrupt;
++
++	sc->rx.discard_next = false;
+ 
+ 	/*
+ 	 * Discard zero-length packets.
+ 	 */
+ 	if (!rx_stats->rs_datalen) {
+ 		RX_STAT_INC(rx_len_err);
+-		return -EINVAL;
++		goto corrupt;
+ 	}
+ 
+-        /*
+-         * rs_status follows rs_datalen so if rs_datalen is too large
+-         * we can take a hint that hardware corrupted it, so ignore
+-         * those frames.
+-         */
++	/*
++	 * rs_status follows rs_datalen so if rs_datalen is too large
++	 * we can take a hint that hardware corrupted it, so ignore
++	 * those frames.
++	 */
+ 	if (rx_stats->rs_datalen > (common->rx_bufsize - ah->caps.rx_status_len)) {
+ 		RX_STAT_INC(rx_len_err);
+-		return -EINVAL;
++		goto corrupt;
+ 	}
+ 
+ 	/* Only use status info from the last fragment */
+@@ -1132,10 +1139,8 @@ static int ath9k_rx_skb_preprocess(struct ath_softc *sc,
+ 	 * This is different from the other corrupt descriptor
+ 	 * condition handled above.
+ 	 */
+-	if (rx_stats->rs_status & ATH9K_RXERR_CORRUPT_DESC) {
+-		ret = -EINVAL;
+-		goto exit;
+-	}
++	if (rx_stats->rs_status & ATH9K_RXERR_CORRUPT_DESC)
++		goto corrupt;
+ 
+ 	hdr = (struct ieee80211_hdr *) (skb->data + ah->caps.rx_status_len);
+ 
+@@ -1151,18 +1156,15 @@ static int ath9k_rx_skb_preprocess(struct ath_softc *sc,
+ 		if (ath_process_fft(sc, hdr, rx_stats, rx_status->mactime))
+ 			RX_STAT_INC(rx_spectral);
+ 
+-		ret = -EINVAL;
+-		goto exit;
++		return -EINVAL;
+ 	}
+ 
+ 	/*
+ 	 * everything but the rate is checked here, the rate check is done
+ 	 * separately to avoid doing two lookups for a rate for each frame.
+ 	 */
+-	if (!ath9k_rx_accept(common, hdr, rx_status, rx_stats, decrypt_error)) {
+-		ret = -EINVAL;
+-		goto exit;
+-	}
++	if (!ath9k_rx_accept(common, hdr, rx_status, rx_stats, decrypt_error))
++		return -EINVAL;
+ 
+ 	rx_stats->is_mybeacon = ath9k_is_mybeacon(sc, hdr);
+ 	if (rx_stats->is_mybeacon) {
+@@ -1173,15 +1175,11 @@ static int ath9k_rx_skb_preprocess(struct ath_softc *sc,
+ 	/*
+ 	 * This shouldn't happen, but have a safety check anyway.
+ 	 */
+-	if (WARN_ON(!ah->curchan)) {
+-		ret = -EINVAL;
+-		goto exit;
+-	}
++	if (WARN_ON(!ah->curchan))
++		return -EINVAL;
+ 
+-	if (ath9k_process_rate(common, hw, rx_stats, rx_status)) {
+-		ret =-EINVAL;
+-		goto exit;
+-	}
++	if (ath9k_process_rate(common, hw, rx_stats, rx_status))
++		return -EINVAL;
+ 
+ 	ath9k_process_rssi(common, hw, rx_stats, rx_status);
+ 
+@@ -1196,9 +1194,11 @@ static int ath9k_rx_skb_preprocess(struct ath_softc *sc,
+ 		sc->rx.num_pkts++;
+ #endif
+ 
+-exit:
+-	sc->rx.discard_next = false;
+-	return ret;
++	return 0;
++
++corrupt:
++	sc->rx.discard_next = rx_stats->rs_more;
++	return -EINVAL;
+ }
+ 
+ static void ath9k_rx_skb_postprocess(struct ath_common *common,
+diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
+index 7fe6b5923a9c..ba39178a94ab 100644
+--- a/drivers/net/wireless/ath/ath9k/xmit.c
++++ b/drivers/net/wireless/ath/ath9k/xmit.c
+@@ -1457,14 +1457,16 @@ void ath_tx_aggr_sleep(struct ieee80211_sta *sta, struct ath_softc *sc,
+ 	for (tidno = 0, tid = &an->tid[tidno];
+ 	     tidno < IEEE80211_NUM_TIDS; tidno++, tid++) {
+ 
+-		if (!tid->sched)
+-			continue;
+-
+ 		ac = tid->ac;
+ 		txq = ac->txq;
+ 
+ 		ath_txq_lock(sc, txq);
+ 
++		if (!tid->sched) {
++			ath_txq_unlock(sc, txq);
++			continue;
++		}
++
+ 		buffered = ath_tid_has_buffered(tid);
+ 
+ 		tid->sched = false;
+@@ -2199,14 +2201,15 @@ int ath_tx_start(struct ieee80211_hw *hw, struct sk_buff *skb,
+ 		txq->stopped = true;
+ 	}
+ 
++	if (txctl->an)
++		tid = ath_get_skb_tid(sc, txctl->an, skb);
++
+ 	if (info->flags & IEEE80211_TX_CTL_PS_RESPONSE) {
+ 		ath_txq_unlock(sc, txq);
+ 		txq = sc->tx.uapsdq;
+ 		ath_txq_lock(sc, txq);
+ 	} else if (txctl->an &&
+ 		   ieee80211_is_data_present(hdr->frame_control)) {
+-		tid = ath_get_skb_tid(sc, txctl->an, skb);
+-
+ 		WARN_ON(tid->ac->txq != txctl->txq);
+ 
+ 		if (info->flags & IEEE80211_TX_CTL_CLEAR_PS_FILT)
+diff --git a/drivers/net/wireless/iwlwifi/dvm/mac80211.c b/drivers/net/wireless/iwlwifi/dvm/mac80211.c
+index cae4d3182e33..d6e6405a9b07 100644
+--- a/drivers/net/wireless/iwlwifi/dvm/mac80211.c
++++ b/drivers/net/wireless/iwlwifi/dvm/mac80211.c
+@@ -704,6 +704,24 @@ static int iwlagn_mac_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
+ 	return ret;
+ }
+ 
++static inline bool iwl_enable_rx_ampdu(const struct iwl_cfg *cfg)
++{
++	if (iwlwifi_mod_params.disable_11n & IWL_DISABLE_HT_RXAGG)
++		return false;
++	return true;
++}
++
++static inline bool iwl_enable_tx_ampdu(const struct iwl_cfg *cfg)
++{
++	if (iwlwifi_mod_params.disable_11n & IWL_DISABLE_HT_TXAGG)
++		return false;
++	if (iwlwifi_mod_params.disable_11n & IWL_ENABLE_HT_TXAGG)
++		return true;
++
++	/* disabled by default */
++	return false;
++}
++
+ static int iwlagn_mac_ampdu_action(struct ieee80211_hw *hw,
+ 				   struct ieee80211_vif *vif,
+ 				   enum ieee80211_ampdu_mlme_action action,
+@@ -725,7 +743,7 @@ static int iwlagn_mac_ampdu_action(struct ieee80211_hw *hw,
+ 
+ 	switch (action) {
+ 	case IEEE80211_AMPDU_RX_START:
+-		if (iwlwifi_mod_params.disable_11n & IWL_DISABLE_HT_RXAGG)
++		if (!iwl_enable_rx_ampdu(priv->cfg))
+ 			break;
+ 		IWL_DEBUG_HT(priv, "start Rx\n");
+ 		ret = iwl_sta_rx_agg_start(priv, sta, tid, *ssn);
+@@ -737,7 +755,7 @@ static int iwlagn_mac_ampdu_action(struct ieee80211_hw *hw,
+ 	case IEEE80211_AMPDU_TX_START:
+ 		if (!priv->trans->ops->txq_enable)
+ 			break;
+-		if (iwlwifi_mod_params.disable_11n & IWL_DISABLE_HT_TXAGG)
++		if (!iwl_enable_tx_ampdu(priv->cfg))
+ 			break;
+ 		IWL_DEBUG_HT(priv, "start Tx\n");
+ 		ret = iwlagn_tx_agg_start(priv, vif, sta, tid, ssn);
+diff --git a/drivers/net/wireless/iwlwifi/dvm/sta.c b/drivers/net/wireless/iwlwifi/dvm/sta.c
+index c3c13ce96eb0..e800002d6158 100644
+--- a/drivers/net/wireless/iwlwifi/dvm/sta.c
++++ b/drivers/net/wireless/iwlwifi/dvm/sta.c
+@@ -590,6 +590,7 @@ void iwl_deactivate_station(struct iwl_priv *priv, const u8 sta_id,
+ 			sizeof(priv->tid_data[sta_id][tid]));
+ 
+ 	priv->stations[sta_id].used &= ~IWL_STA_DRIVER_ACTIVE;
++	priv->stations[sta_id].used &= ~IWL_STA_UCODE_INPROGRESS;
+ 
+ 	priv->num_stations--;
+ 
+diff --git a/drivers/net/wireless/iwlwifi/dvm/tx.c b/drivers/net/wireless/iwlwifi/dvm/tx.c
+index 1fef5240e6ad..e219e761f48b 100644
+--- a/drivers/net/wireless/iwlwifi/dvm/tx.c
++++ b/drivers/net/wireless/iwlwifi/dvm/tx.c
+@@ -1291,8 +1291,6 @@ int iwlagn_rx_reply_compressed_ba(struct iwl_priv *priv,
+ 	struct iwl_compressed_ba_resp *ba_resp = (void *)pkt->data;
+ 	struct iwl_ht_agg *agg;
+ 	struct sk_buff_head reclaimed_skbs;
+-	struct ieee80211_tx_info *info;
+-	struct ieee80211_hdr *hdr;
+ 	struct sk_buff *skb;
+ 	int sta_id;
+ 	int tid;
+@@ -1379,22 +1377,28 @@ int iwlagn_rx_reply_compressed_ba(struct iwl_priv *priv,
+ 	freed = 0;
+ 
+ 	skb_queue_walk(&reclaimed_skbs, skb) {
+-		hdr = (struct ieee80211_hdr *)skb->data;
++		struct ieee80211_hdr *hdr = (void *)skb->data;
++		struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+ 
+ 		if (ieee80211_is_data_qos(hdr->frame_control))
+ 			freed++;
+ 		else
+ 			WARN_ON_ONCE(1);
+ 
+-		info = IEEE80211_SKB_CB(skb);
+ 		iwl_trans_free_tx_cmd(priv->trans, info->driver_data[1]);
+ 
++		memset(&info->status, 0, sizeof(info->status));
++		/* Packet was transmitted successfully, failures come as single
++		 * frames because before failing a frame the firmware transmits
++		 * it without aggregation at least once.
++		 */
++		info->flags |= IEEE80211_TX_STAT_ACK;
++
+ 		if (freed == 1) {
+ 			/* this is the first skb we deliver in this batch */
+ 			/* put the rate scaling data there */
+ 			info = IEEE80211_SKB_CB(skb);
+ 			memset(&info->status, 0, sizeof(info->status));
+-			info->flags |= IEEE80211_TX_STAT_ACK;
+ 			info->flags |= IEEE80211_TX_STAT_AMPDU;
+ 			info->status.ampdu_ack_len = ba_resp->txed_2_done;
+ 			info->status.ampdu_len = ba_resp->txed;
+diff --git a/drivers/net/wireless/iwlwifi/iwl-drv.c b/drivers/net/wireless/iwlwifi/iwl-drv.c
+index 99e1da3123c9..2cdbd940575e 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-drv.c
++++ b/drivers/net/wireless/iwlwifi/iwl-drv.c
+@@ -1210,7 +1210,7 @@ module_param_named(swcrypto, iwlwifi_mod_params.sw_crypto, int, S_IRUGO);
+ MODULE_PARM_DESC(swcrypto, "using crypto in software (default 0 [hardware])");
+ module_param_named(11n_disable, iwlwifi_mod_params.disable_11n, uint, S_IRUGO);
+ MODULE_PARM_DESC(11n_disable,
+-	"disable 11n functionality, bitmap: 1: full, 2: agg TX, 4: agg RX");
++	"disable 11n functionality, bitmap: 1: full, 2: disable agg TX, 4: disable agg RX, 8 enable agg TX");
+ module_param_named(amsdu_size_8K, iwlwifi_mod_params.amsdu_size_8K,
+ 		   int, S_IRUGO);
+ MODULE_PARM_DESC(amsdu_size_8K, "enable 8K amsdu size (default 0)");
+diff --git a/drivers/net/wireless/iwlwifi/iwl-modparams.h b/drivers/net/wireless/iwlwifi/iwl-modparams.h
+index a1f580c0c6c6..4c6cff4218cb 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-modparams.h
++++ b/drivers/net/wireless/iwlwifi/iwl-modparams.h
+@@ -79,9 +79,12 @@ enum iwl_power_level {
+ 	IWL_POWER_NUM
+ };
+ 
+-#define IWL_DISABLE_HT_ALL	BIT(0)
+-#define IWL_DISABLE_HT_TXAGG	BIT(1)
+-#define IWL_DISABLE_HT_RXAGG	BIT(2)
++enum iwl_disable_11n {
++	IWL_DISABLE_HT_ALL	 = BIT(0),
++	IWL_DISABLE_HT_TXAGG	 = BIT(1),
++	IWL_DISABLE_HT_RXAGG	 = BIT(2),
++	IWL_ENABLE_HT_TXAGG	 = BIT(3),
++};
+ 
+ /**
+  * struct iwl_mod_params
+@@ -90,7 +93,7 @@ enum iwl_power_level {
+  *
+  * @sw_crypto: using hardware encryption, default = 0
+  * @disable_11n: disable 11n capabilities, default = 0,
+- *	use IWL_DISABLE_HT_* constants
++ *	use IWL_[DIS,EN]ABLE_HT_* constants
+  * @amsdu_size_8K: enable 8K amsdu size, default = 0
+  * @restart_fw: restart firmware, default = 1
+  * @wd_disable: enable stuck queue check, default = 0
+diff --git a/drivers/net/wireless/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
+index 9833cdf6177c..5f6fd44e72f1 100644
+--- a/drivers/net/wireless/iwlwifi/mvm/mac80211.c
++++ b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
+@@ -297,6 +297,24 @@ static void iwl_mvm_mac_tx(struct ieee80211_hw *hw,
+ 	ieee80211_free_txskb(hw, skb);
+ }
+ 
++static inline bool iwl_enable_rx_ampdu(const struct iwl_cfg *cfg)
++{
++	if (iwlwifi_mod_params.disable_11n & IWL_DISABLE_HT_RXAGG)
++		return false;
++	return true;
++}
++
++static inline bool iwl_enable_tx_ampdu(const struct iwl_cfg *cfg)
++{
++	if (iwlwifi_mod_params.disable_11n & IWL_DISABLE_HT_TXAGG)
++		return false;
++	if (iwlwifi_mod_params.disable_11n & IWL_ENABLE_HT_TXAGG)
++		return true;
++
++	/* enabled by default */
++	return true;
++}
++
+ static int iwl_mvm_mac_ampdu_action(struct ieee80211_hw *hw,
+ 				    struct ieee80211_vif *vif,
+ 				    enum ieee80211_ampdu_mlme_action action,
+@@ -316,7 +334,7 @@ static int iwl_mvm_mac_ampdu_action(struct ieee80211_hw *hw,
+ 
+ 	switch (action) {
+ 	case IEEE80211_AMPDU_RX_START:
+-		if (iwlwifi_mod_params.disable_11n & IWL_DISABLE_HT_RXAGG) {
++		if (!iwl_enable_rx_ampdu(mvm->cfg)) {
+ 			ret = -EINVAL;
+ 			break;
+ 		}
+@@ -326,7 +344,7 @@ static int iwl_mvm_mac_ampdu_action(struct ieee80211_hw *hw,
+ 		ret = iwl_mvm_sta_rx_agg(mvm, sta, tid, 0, false);
+ 		break;
+ 	case IEEE80211_AMPDU_TX_START:
+-		if (iwlwifi_mod_params.disable_11n & IWL_DISABLE_HT_TXAGG) {
++		if (!iwl_enable_tx_ampdu(mvm->cfg)) {
+ 			ret = -EINVAL;
+ 			break;
+ 		}
+diff --git a/drivers/net/wireless/iwlwifi/mvm/mvm.h b/drivers/net/wireless/iwlwifi/mvm/mvm.h
+index b0389279cc1e..c86663ebb493 100644
+--- a/drivers/net/wireless/iwlwifi/mvm/mvm.h
++++ b/drivers/net/wireless/iwlwifi/mvm/mvm.h
+@@ -152,7 +152,7 @@ enum iwl_power_scheme {
+ 	IWL_POWER_SCHEME_LP
+ };
+ 
+-#define IWL_CONN_MAX_LISTEN_INTERVAL	70
++#define IWL_CONN_MAX_LISTEN_INTERVAL	10
+ #define IWL_UAPSD_AC_INFO		(IEEE80211_WMM_IE_STA_QOSINFO_AC_VO |\
+ 					 IEEE80211_WMM_IE_STA_QOSINFO_AC_VI |\
+ 					 IEEE80211_WMM_IE_STA_QOSINFO_AC_BK |\
+diff --git a/drivers/net/wireless/iwlwifi/mvm/tx.c b/drivers/net/wireless/iwlwifi/mvm/tx.c
+index e05440d90319..f41add9c8093 100644
+--- a/drivers/net/wireless/iwlwifi/mvm/tx.c
++++ b/drivers/net/wireless/iwlwifi/mvm/tx.c
+@@ -819,16 +819,12 @@ int iwl_mvm_rx_ba_notif(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb,
+ 	struct iwl_mvm_ba_notif *ba_notif = (void *)pkt->data;
+ 	struct sk_buff_head reclaimed_skbs;
+ 	struct iwl_mvm_tid_data *tid_data;
+-	struct ieee80211_tx_info *info;
+ 	struct ieee80211_sta *sta;
+ 	struct iwl_mvm_sta *mvmsta;
+-	struct ieee80211_hdr *hdr;
+ 	struct sk_buff *skb;
+ 	int sta_id, tid, freed;
+-
+ 	/* "flow" corresponds to Tx queue */
+ 	u16 scd_flow = le16_to_cpu(ba_notif->scd_flow);
+-
+ 	/* "ssn" is start of block-ack Tx window, corresponds to index
+ 	 * (in Tx queue's circular buffer) of first TFD/frame in window */
+ 	u16 ba_resp_scd_ssn = le16_to_cpu(ba_notif->scd_ssn);
+@@ -885,22 +881,26 @@ int iwl_mvm_rx_ba_notif(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb,
+ 	freed = 0;
+ 
+ 	skb_queue_walk(&reclaimed_skbs, skb) {
+-		hdr = (struct ieee80211_hdr *)skb->data;
++		struct ieee80211_hdr *hdr = (void *)skb->data;
++		struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+ 
+ 		if (ieee80211_is_data_qos(hdr->frame_control))
+ 			freed++;
+ 		else
+ 			WARN_ON_ONCE(1);
+ 
+-		info = IEEE80211_SKB_CB(skb);
+ 		iwl_trans_free_tx_cmd(mvm->trans, info->driver_data[1]);
+ 
++		memset(&info->status, 0, sizeof(info->status));
++		/* Packet was transmitted successfully, failures come as single
++		 * frames because before failing a frame the firmware transmits
++		 * it without aggregation at least once.
++		 */
++		info->flags |= IEEE80211_TX_STAT_ACK;
++
+ 		if (freed == 1) {
+ 			/* this is the first skb we deliver in this batch */
+ 			/* put the rate scaling data there */
+-			info = IEEE80211_SKB_CB(skb);
+-			memset(&info->status, 0, sizeof(info->status));
+-			info->flags |= IEEE80211_TX_STAT_ACK;
+ 			info->flags |= IEEE80211_TX_STAT_AMPDU;
+ 			info->status.ampdu_ack_len = ba_notif->txed_2_done;
+ 			info->status.ampdu_len = ba_notif->txed;
+diff --git a/drivers/net/wireless/mwifiex/11ac.c b/drivers/net/wireless/mwifiex/11ac.c
+index 5e0eec4d71c7..5d9a8084665d 100644
+--- a/drivers/net/wireless/mwifiex/11ac.c
++++ b/drivers/net/wireless/mwifiex/11ac.c
+@@ -189,8 +189,7 @@ int mwifiex_cmd_append_11ac_tlv(struct mwifiex_private *priv,
+ 		vht_cap->header.len  =
+ 				cpu_to_le16(sizeof(struct ieee80211_vht_cap));
+ 		memcpy((u8 *)vht_cap + sizeof(struct mwifiex_ie_types_header),
+-		       (u8 *)bss_desc->bcn_vht_cap +
+-		       sizeof(struct ieee_types_header),
++		       (u8 *)bss_desc->bcn_vht_cap,
+ 		       le16_to_cpu(vht_cap->header.len));
+ 
+ 		mwifiex_fill_vht_cap_tlv(priv, vht_cap, bss_desc->bss_band);
+diff --git a/drivers/net/wireless/mwifiex/11n.c b/drivers/net/wireless/mwifiex/11n.c
+index 0b803c05cab3..983c10c49658 100644
+--- a/drivers/net/wireless/mwifiex/11n.c
++++ b/drivers/net/wireless/mwifiex/11n.c
+@@ -308,8 +308,7 @@ mwifiex_cmd_append_11n_tlv(struct mwifiex_private *priv,
+ 		ht_cap->header.len =
+ 				cpu_to_le16(sizeof(struct ieee80211_ht_cap));
+ 		memcpy((u8 *) ht_cap + sizeof(struct mwifiex_ie_types_header),
+-		       (u8 *) bss_desc->bcn_ht_cap +
+-		       sizeof(struct ieee_types_header),
++		       (u8 *)bss_desc->bcn_ht_cap,
+ 		       le16_to_cpu(ht_cap->header.len));
+ 
+ 		mwifiex_fill_cap_info(priv, radio_type, ht_cap);
+diff --git a/drivers/net/wireless/mwifiex/pcie.c b/drivers/net/wireless/mwifiex/pcie.c
+index 52da8ee7599a..cb84edcd794b 100644
+--- a/drivers/net/wireless/mwifiex/pcie.c
++++ b/drivers/net/wireless/mwifiex/pcie.c
+@@ -1212,6 +1212,12 @@ static int mwifiex_pcie_process_recv_data(struct mwifiex_adapter *adapter)
+ 		rd_index = card->rxbd_rdptr & reg->rx_mask;
+ 		skb_data = card->rx_buf_list[rd_index];
+ 
++		/* If skb allocation was failed earlier for Rx packet,
++		 * rx_buf_list[rd_index] would have been left with a NULL.
++		 */
++		if (!skb_data)
++			return -ENOMEM;
++
+ 		MWIFIEX_SKB_PACB(skb_data, &buf_pa);
+ 		pci_unmap_single(card->dev, buf_pa, MWIFIEX_RX_DATA_BUF_SIZE,
+ 				 PCI_DMA_FROMDEVICE);
+@@ -1526,6 +1532,14 @@ static int mwifiex_pcie_process_cmd_complete(struct mwifiex_adapter *adapter)
+ 		if (adapter->ps_state == PS_STATE_SLEEP_CFM) {
+ 			mwifiex_process_sleep_confirm_resp(adapter, skb->data,
+ 							   skb->len);
++			mwifiex_pcie_enable_host_int(adapter);
++			if (mwifiex_write_reg(adapter,
++					      PCIE_CPU_INT_EVENT,
++					      CPU_INTR_SLEEP_CFM_DONE)) {
++				dev_warn(adapter->dev,
++					 "Write register failed\n");
++				return -1;
++			}
+ 			while (reg->sleep_cookie && (count++ < 10) &&
+ 			       mwifiex_pcie_ok_to_access_hw(adapter))
+ 				usleep_range(50, 60);
+@@ -1994,23 +2008,9 @@ static void mwifiex_interrupt_status(struct mwifiex_adapter *adapter)
+ 		adapter->int_status |= pcie_ireg;
+ 		spin_unlock_irqrestore(&adapter->int_lock, flags);
+ 
+-		if (pcie_ireg & HOST_INTR_CMD_DONE) {
+-			if ((adapter->ps_state == PS_STATE_SLEEP_CFM) ||
+-			    (adapter->ps_state == PS_STATE_SLEEP)) {
+-				mwifiex_pcie_enable_host_int(adapter);
+-				if (mwifiex_write_reg(adapter,
+-						      PCIE_CPU_INT_EVENT,
+-						      CPU_INTR_SLEEP_CFM_DONE)
+-						      ) {
+-					dev_warn(adapter->dev,
+-						 "Write register failed\n");
+-					return;
+-
+-				}
+-			}
+-		} else if (!adapter->pps_uapsd_mode &&
+-			   adapter->ps_state == PS_STATE_SLEEP &&
+-			   mwifiex_pcie_ok_to_access_hw(adapter)) {
++		if (!adapter->pps_uapsd_mode &&
++		    adapter->ps_state == PS_STATE_SLEEP &&
++		    mwifiex_pcie_ok_to_access_hw(adapter)) {
+ 				/* Potentially for PCIe we could get other
+ 				 * interrupts like shared. Don't change power
+ 				 * state until cookie is set */
+diff --git a/drivers/net/wireless/mwifiex/scan.c b/drivers/net/wireless/mwifiex/scan.c
+index ba48e64673d9..a17d4675ddc0 100644
+--- a/drivers/net/wireless/mwifiex/scan.c
++++ b/drivers/net/wireless/mwifiex/scan.c
+@@ -2101,12 +2101,12 @@ mwifiex_save_curr_bcn(struct mwifiex_private *priv)
+ 			 curr_bss->ht_info_offset);
+ 
+ 	if (curr_bss->bcn_vht_cap)
+-		curr_bss->bcn_ht_cap = (void *)(curr_bss->beacon_buf +
+-						curr_bss->vht_cap_offset);
++		curr_bss->bcn_vht_cap = (void *)(curr_bss->beacon_buf +
++						 curr_bss->vht_cap_offset);
+ 
+ 	if (curr_bss->bcn_vht_oper)
+-		curr_bss->bcn_ht_oper = (void *)(curr_bss->beacon_buf +
+-						 curr_bss->vht_info_offset);
++		curr_bss->bcn_vht_oper = (void *)(curr_bss->beacon_buf +
++						  curr_bss->vht_info_offset);
+ 
+ 	if (curr_bss->bcn_bss_co_2040)
+ 		curr_bss->bcn_bss_co_2040 =
+diff --git a/drivers/net/wireless/mwifiex/usb.c b/drivers/net/wireless/mwifiex/usb.c
+index 1c70b8d09227..9d0b0c442c95 100644
+--- a/drivers/net/wireless/mwifiex/usb.c
++++ b/drivers/net/wireless/mwifiex/usb.c
+@@ -512,13 +512,6 @@ static int mwifiex_usb_resume(struct usb_interface *intf)
+ 						   MWIFIEX_BSS_ROLE_ANY),
+ 				  MWIFIEX_ASYNC_CMD);
+ 
+-#ifdef CONFIG_PM
+-	/* Resume handler may be called due to remote wakeup,
+-	 * force to exit suspend anyway
+-	 */
+-	usb_disable_autosuspend(card->udev);
+-#endif /* CONFIG_PM */
+-
+ 	return 0;
+ }
+ 
+@@ -555,7 +548,6 @@ static struct usb_driver mwifiex_usb_driver = {
+ 	.id_table = mwifiex_usb_table,
+ 	.suspend = mwifiex_usb_suspend,
+ 	.resume = mwifiex_usb_resume,
+-	.supports_autosuspend = 1,
+ };
+ 
+ static int mwifiex_usb_tx_init(struct mwifiex_adapter *adapter)
+diff --git a/drivers/net/wireless/mwifiex/wmm.c b/drivers/net/wireless/mwifiex/wmm.c
+index 95fa3599b407..35f881585962 100644
+--- a/drivers/net/wireless/mwifiex/wmm.c
++++ b/drivers/net/wireless/mwifiex/wmm.c
+@@ -559,7 +559,8 @@ mwifiex_clean_txrx(struct mwifiex_private *priv)
+ 	mwifiex_wmm_delete_all_ralist(priv);
+ 	memcpy(tos_to_tid, ac_to_tid, sizeof(tos_to_tid));
+ 
+-	if (priv->adapter->if_ops.clean_pcie_ring)
++	if (priv->adapter->if_ops.clean_pcie_ring &&
++	    !priv->adapter->surprise_removed)
+ 		priv->adapter->if_ops.clean_pcie_ring(priv->adapter);
+ 	spin_unlock_irqrestore(&priv->wmm.ra_list_spinlock, flags);
+ }
+diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
+index 863bc4bb4806..9fc3f1f4557b 100644
+--- a/drivers/pci/pci.c
++++ b/drivers/pci/pci.c
+@@ -1131,6 +1131,9 @@ static int do_pci_enable_device(struct pci_dev *dev, int bars)
+ 		return err;
+ 	pci_fixup_device(pci_fixup_enable, dev);
+ 
++	if (dev->msi_enabled || dev->msix_enabled)
++		return 0;
++
+ 	pci_read_config_byte(dev, PCI_INTERRUPT_PIN, &pin);
+ 	if (pin) {
+ 		pci_read_config_word(dev, PCI_COMMAND, &cmd);
+@@ -1166,10 +1169,8 @@ static void pci_enable_bridge(struct pci_dev *dev)
+ 	pci_enable_bridge(dev->bus->self);
+ 
+ 	if (pci_is_enabled(dev)) {
+-		if (!dev->is_busmaster) {
+-			dev_warn(&dev->dev, "driver skip pci_set_master, fix it!\n");
++		if (!dev->is_busmaster)
+ 			pci_set_master(dev);
+-		}
+ 		return;
+ 	}
+ 
+diff --git a/drivers/pinctrl/pinctrl-sunxi.c b/drivers/pinctrl/pinctrl-sunxi.c
+index 6ebf3067bde4..b2dcde123e56 100644
+--- a/drivers/pinctrl/pinctrl-sunxi.c
++++ b/drivers/pinctrl/pinctrl-sunxi.c
+@@ -14,6 +14,7 @@
+ #include <linux/clk.h>
+ #include <linux/gpio.h>
+ #include <linux/irqdomain.h>
++#include <linux/irqchip/chained_irq.h>
+ #include <linux/module.h>
+ #include <linux/of.h>
+ #include <linux/of_address.h>
+@@ -665,6 +666,7 @@ static struct irq_chip sunxi_pinctrl_irq_chip = {
+ 
+ static void sunxi_pinctrl_irq_handler(unsigned irq, struct irq_desc *desc)
+ {
++	struct irq_chip *chip = irq_get_chip(irq);
+ 	struct sunxi_pinctrl *pctl = irq_get_handler_data(irq);
+ 	const unsigned long reg = readl(pctl->membase + IRQ_STATUS_REG);
+ 
+@@ -674,10 +676,12 @@ static void sunxi_pinctrl_irq_handler(unsigned irq, struct irq_desc *desc)
+ 	if (reg) {
+ 		int irqoffset;
+ 
++		chained_irq_enter(chip, desc);
+ 		for_each_set_bit(irqoffset, &reg, SUNXI_IRQ_NUMBER) {
+ 			int pin_irq = irq_find_mapping(pctl->domain, irqoffset);
+ 			generic_handle_irq(pin_irq);
+ 		}
++		chained_irq_exit(chip, desc);
+ 	}
+ }
+ 
+diff --git a/drivers/pnp/pnpacpi/rsparser.c b/drivers/pnp/pnpacpi/rsparser.c
+index 167f3d00c916..66977ebf13b3 100644
+--- a/drivers/pnp/pnpacpi/rsparser.c
++++ b/drivers/pnp/pnpacpi/rsparser.c
+@@ -183,9 +183,7 @@ static acpi_status pnpacpi_allocated_resource(struct acpi_resource *res,
+ 	struct resource r = {0};
+ 	int i, flags;
+ 
+-	if (acpi_dev_resource_memory(res, &r)
+-	    || acpi_dev_resource_io(res, &r)
+-	    || acpi_dev_resource_address_space(res, &r)
++	if (acpi_dev_resource_address_space(res, &r)
+ 	    || acpi_dev_resource_ext_address_space(res, &r)) {
+ 		pnp_add_resource(dev, &r);
+ 		return AE_OK;
+@@ -217,6 +215,17 @@ static acpi_status pnpacpi_allocated_resource(struct acpi_resource *res,
+ 	}
+ 
+ 	switch (res->type) {
++	case ACPI_RESOURCE_TYPE_MEMORY24:
++	case ACPI_RESOURCE_TYPE_MEMORY32:
++	case ACPI_RESOURCE_TYPE_FIXED_MEMORY32:
++		if (acpi_dev_resource_memory(res, &r))
++			pnp_add_resource(dev, &r);
++		break;
++	case ACPI_RESOURCE_TYPE_IO:
++	case ACPI_RESOURCE_TYPE_FIXED_IO:
++		if (acpi_dev_resource_io(res, &r))
++			pnp_add_resource(dev, &r);
++		break;
+ 	case ACPI_RESOURCE_TYPE_DMA:
+ 		dma = &res->data.dma;
+ 		if (dma->channel_count > 0 && dma->channels[0] != (u8) -1)
+diff --git a/drivers/rapidio/devices/tsi721.h b/drivers/rapidio/devices/tsi721.h
+index b4b0d83f9ef6..7061ac0ad428 100644
+--- a/drivers/rapidio/devices/tsi721.h
++++ b/drivers/rapidio/devices/tsi721.h
+@@ -678,6 +678,7 @@ struct tsi721_bdma_chan {
+ 	struct list_head	free_list;
+ 	dma_cookie_t		completed_cookie;
+ 	struct tasklet_struct	tasklet;
++	bool			active;
+ };
+ 
+ #endif /* CONFIG_RAPIDIO_DMA_ENGINE */
+diff --git a/drivers/rapidio/devices/tsi721_dma.c b/drivers/rapidio/devices/tsi721_dma.c
+index 502663f5f7c6..91245f5dbe81 100644
+--- a/drivers/rapidio/devices/tsi721_dma.c
++++ b/drivers/rapidio/devices/tsi721_dma.c
+@@ -206,8 +206,8 @@ void tsi721_bdma_handler(struct tsi721_bdma_chan *bdma_chan)
+ {
+ 	/* Disable BDMA channel interrupts */
+ 	iowrite32(0, bdma_chan->regs + TSI721_DMAC_INTE);
+-
+-	tasklet_schedule(&bdma_chan->tasklet);
++	if (bdma_chan->active)
++		tasklet_schedule(&bdma_chan->tasklet);
+ }
+ 
+ #ifdef CONFIG_PCI_MSI
+@@ -562,7 +562,7 @@ static int tsi721_alloc_chan_resources(struct dma_chan *dchan)
+ 	}
+ #endif /* CONFIG_PCI_MSI */
+ 
+-	tasklet_enable(&bdma_chan->tasklet);
++	bdma_chan->active = true;
+ 	tsi721_bdma_interrupt_enable(bdma_chan, 1);
+ 
+ 	return bdma_chan->bd_num - 1;
+@@ -576,9 +576,7 @@ err_out:
+ static void tsi721_free_chan_resources(struct dma_chan *dchan)
+ {
+ 	struct tsi721_bdma_chan *bdma_chan = to_tsi721_chan(dchan);
+-#ifdef CONFIG_PCI_MSI
+ 	struct tsi721_device *priv = to_tsi721(dchan->device);
+-#endif
+ 	LIST_HEAD(list);
+ 
+ 	dev_dbg(dchan->device->dev, "%s: Entry\n", __func__);
+@@ -589,14 +587,25 @@ static void tsi721_free_chan_resources(struct dma_chan *dchan)
+ 	BUG_ON(!list_empty(&bdma_chan->active_list));
+ 	BUG_ON(!list_empty(&bdma_chan->queue));
+ 
+-	tasklet_disable(&bdma_chan->tasklet);
++	tsi721_bdma_interrupt_enable(bdma_chan, 0);
++	bdma_chan->active = false;
++
++#ifdef CONFIG_PCI_MSI
++	if (priv->flags & TSI721_USING_MSIX) {
++		synchronize_irq(priv->msix[TSI721_VECT_DMA0_DONE +
++					   bdma_chan->id].vector);
++		synchronize_irq(priv->msix[TSI721_VECT_DMA0_INT +
++					   bdma_chan->id].vector);
++	} else
++#endif
++	synchronize_irq(priv->pdev->irq);
++
++	tasklet_kill(&bdma_chan->tasklet);
+ 
+ 	spin_lock_bh(&bdma_chan->lock);
+ 	list_splice_init(&bdma_chan->free_list, &list);
+ 	spin_unlock_bh(&bdma_chan->lock);
+ 
+-	tsi721_bdma_interrupt_enable(bdma_chan, 0);
+-
+ #ifdef CONFIG_PCI_MSI
+ 	if (priv->flags & TSI721_USING_MSIX) {
+ 		free_irq(priv->msix[TSI721_VECT_DMA0_DONE +
+@@ -790,6 +799,7 @@ int tsi721_register_dma(struct tsi721_device *priv)
+ 		bdma_chan->dchan.cookie = 1;
+ 		bdma_chan->dchan.chan_id = i;
+ 		bdma_chan->id = i;
++		bdma_chan->active = false;
+ 
+ 		spin_lock_init(&bdma_chan->lock);
+ 
+@@ -799,7 +809,6 @@ int tsi721_register_dma(struct tsi721_device *priv)
+ 
+ 		tasklet_init(&bdma_chan->tasklet, tsi721_dma_tasklet,
+ 			     (unsigned long)bdma_chan);
+-		tasklet_disable(&bdma_chan->tasklet);
+ 		list_add_tail(&bdma_chan->dchan.device_node,
+ 			      &mport->dma.channels);
+ 	}
+diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
+index a01b8b3b70ca..d97fbf4eb65b 100644
+--- a/drivers/regulator/core.c
++++ b/drivers/regulator/core.c
+@@ -923,6 +923,8 @@ static int machine_constraints_voltage(struct regulator_dev *rdev,
+ 	return 0;
+ }
+ 
++static int _regulator_do_enable(struct regulator_dev *rdev);
++
+ /**
+  * set_machine_constraints - sets regulator constraints
+  * @rdev: regulator source
+@@ -979,10 +981,9 @@ static int set_machine_constraints(struct regulator_dev *rdev,
+ 	/* If the constraints say the regulator should be on at this point
+ 	 * and we have control then make sure it is enabled.
+ 	 */
+-	if ((rdev->constraints->always_on || rdev->constraints->boot_on) &&
+-	    ops->enable) {
+-		ret = ops->enable(rdev);
+-		if (ret < 0) {
++	if (rdev->constraints->always_on || rdev->constraints->boot_on) {
++		ret = _regulator_do_enable(rdev);
++		if (ret < 0 && ret != -EINVAL) {
+ 			rdev_err(rdev, "failed to enable\n");
+ 			goto out;
+ 		}
+@@ -3571,9 +3572,8 @@ int regulator_suspend_finish(void)
+ 		struct regulator_ops *ops = rdev->desc->ops;
+ 
+ 		mutex_lock(&rdev->mutex);
+-		if ((rdev->use_count > 0  || rdev->constraints->always_on) &&
+-				ops->enable) {
+-			error = ops->enable(rdev);
++		if (rdev->use_count > 0  || rdev->constraints->always_on) {
++			error = _regulator_do_enable(rdev);
+ 			if (error)
+ 				ret = error;
+ 		} else {
+diff --git a/drivers/s390/char/fs3270.c b/drivers/s390/char/fs3270.c
+index f93cc32eb818..71e974738014 100644
+--- a/drivers/s390/char/fs3270.c
++++ b/drivers/s390/char/fs3270.c
+@@ -564,6 +564,7 @@ static void __exit
+ fs3270_exit(void)
+ {
+ 	raw3270_unregister_notifier(&fs3270_notifier);
++	device_destroy(class3270, MKDEV(IBM_FS3270_MAJOR, 0));
+ 	__unregister_chrdev(IBM_FS3270_MAJOR, 0, 1, "fs3270");
+ }
+ 
+diff --git a/drivers/scsi/isci/host.h b/drivers/scsi/isci/host.h
+index 4911310a38f5..22a9bb1abae1 100644
+--- a/drivers/scsi/isci/host.h
++++ b/drivers/scsi/isci/host.h
+@@ -311,9 +311,8 @@ static inline struct Scsi_Host *to_shost(struct isci_host *ihost)
+ }
+ 
+ #define for_each_isci_host(id, ihost, pdev) \
+-	for (id = 0, ihost = to_pci_info(pdev)->hosts[id]; \
+-	     id < ARRAY_SIZE(to_pci_info(pdev)->hosts) && ihost; \
+-	     ihost = to_pci_info(pdev)->hosts[++id])
++	for (id = 0; id < SCI_MAX_CONTROLLERS && \
++	     (ihost = to_pci_info(pdev)->hosts[id]); id++)
+ 
+ static inline void wait_for_start(struct isci_host *ihost)
+ {
+diff --git a/drivers/scsi/isci/port_config.c b/drivers/scsi/isci/port_config.c
+index 85c77f6b802b..ac879745ef80 100644
+--- a/drivers/scsi/isci/port_config.c
++++ b/drivers/scsi/isci/port_config.c
+@@ -615,13 +615,6 @@ static void sci_apc_agent_link_up(struct isci_host *ihost,
+ 					  SCIC_SDS_APC_WAIT_LINK_UP_NOTIFICATION);
+ 	} else {
+ 		/* the phy is already the part of the port */
+-		u32 port_state = iport->sm.current_state_id;
+-
+-		/* if the PORT'S state is resetting then the link up is from
+-		 * port hard reset in this case, we need to tell the port
+-		 * that link up is recieved
+-		 */
+-		BUG_ON(port_state != SCI_PORT_RESETTING);
+ 		port_agent->phy_ready_mask |= 1 << phy_index;
+ 		sci_port_link_up(iport, iphy);
+ 	}
+diff --git a/drivers/scsi/isci/task.c b/drivers/scsi/isci/task.c
+index 0d30ca849e8f..5d6fda72d659 100644
+--- a/drivers/scsi/isci/task.c
++++ b/drivers/scsi/isci/task.c
+@@ -801,7 +801,7 @@ int isci_task_I_T_nexus_reset(struct domain_device *dev)
+ 		/* XXX: need to cleanup any ireqs targeting this
+ 		 * domain_device
+ 		 */
+-		ret = TMF_RESP_FUNC_COMPLETE;
++		ret = -ENODEV;
+ 		goto out;
+ 	}
+ 
+diff --git a/drivers/scsi/qla2xxx/qla_def.h b/drivers/scsi/qla2xxx/qla_def.h
+index 93db74ef3461..43acfce3a435 100644
+--- a/drivers/scsi/qla2xxx/qla_def.h
++++ b/drivers/scsi/qla2xxx/qla_def.h
+@@ -2993,8 +2993,7 @@ struct qla_hw_data {
+ 				IS_QLA82XX(ha) || IS_QLA83XX(ha) || \
+ 				IS_QLA8044(ha))
+ #define IS_MSIX_NACK_CAPABLE(ha) (IS_QLA81XX(ha) || IS_QLA83XX(ha))
+-#define IS_NOPOLLING_TYPE(ha)	((IS_QLA25XX(ha) || IS_QLA81XX(ha) || \
+-			IS_QLA83XX(ha)) && (ha)->flags.msix_enabled)
++#define IS_NOPOLLING_TYPE(ha)	(IS_QLA81XX(ha) && (ha)->flags.msix_enabled)
+ #define IS_FAC_REQUIRED(ha)	(IS_QLA81XX(ha) || IS_QLA83XX(ha))
+ #define IS_NOCACHE_VPD_TYPE(ha)	(IS_QLA81XX(ha) || IS_QLA83XX(ha))
+ #define IS_ALOGIO_CAPABLE(ha)	(IS_QLA23XX(ha) || IS_FWI2_CAPABLE(ha))
+diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c
+index ff9c86b1a0d8..e32fccd6580c 100644
+--- a/drivers/scsi/qla2xxx/qla_isr.c
++++ b/drivers/scsi/qla2xxx/qla_isr.c
+@@ -2829,6 +2829,7 @@ static int
+ qla24xx_enable_msix(struct qla_hw_data *ha, struct rsp_que *rsp)
+ {
+ #define MIN_MSIX_COUNT	2
++#define ATIO_VECTOR	2
+ 	int i, ret;
+ 	struct msix_entry *entries;
+ 	struct qla_msix_entry *qentry;
+@@ -2885,34 +2886,47 @@ msix_failed:
+ 	}
+ 
+ 	/* Enable MSI-X vectors for the base queue */
+-	for (i = 0; i < ha->msix_count; i++) {
++	for (i = 0; i < 2; i++) {
+ 		qentry = &ha->msix_entries[i];
+-		if (QLA_TGT_MODE_ENABLED() && IS_ATIO_MSIX_CAPABLE(ha)) {
+-			ret = request_irq(qentry->vector,
+-				qla83xx_msix_entries[i].handler,
+-				0, qla83xx_msix_entries[i].name, rsp);
+-		} else if (IS_P3P_TYPE(ha)) {
++		if (IS_P3P_TYPE(ha))
+ 			ret = request_irq(qentry->vector,
+ 				qla82xx_msix_entries[i].handler,
+ 				0, qla82xx_msix_entries[i].name, rsp);
+-		} else {
++		else
+ 			ret = request_irq(qentry->vector,
+ 				msix_entries[i].handler,
+ 				0, msix_entries[i].name, rsp);
+-		}
+-		if (ret) {
+-			ql_log(ql_log_fatal, vha, 0x00cb,
+-			    "MSI-X: unable to register handler -- %x/%d.\n",
+-			    qentry->vector, ret);
+-			qla24xx_disable_msix(ha);
+-			ha->mqenable = 0;
+-			goto msix_out;
+-		}
++		if (ret)
++			goto msix_register_fail;
+ 		qentry->have_irq = 1;
+ 		qentry->rsp = rsp;
+ 		rsp->msix = qentry;
+ 	}
+ 
++	/*
++	 * If target mode is enable, also request the vector for the ATIO
++	 * queue.
++	 */
++	if (QLA_TGT_MODE_ENABLED() && IS_ATIO_MSIX_CAPABLE(ha)) {
++		qentry = &ha->msix_entries[ATIO_VECTOR];
++		ret = request_irq(qentry->vector,
++			qla83xx_msix_entries[ATIO_VECTOR].handler,
++			0, qla83xx_msix_entries[ATIO_VECTOR].name, rsp);
++		qentry->have_irq = 1;
++		qentry->rsp = rsp;
++		rsp->msix = qentry;
++	}
++
++msix_register_fail:
++	if (ret) {
++		ql_log(ql_log_fatal, vha, 0x00cb,
++		    "MSI-X: unable to register handler -- %x/%d.\n",
++		    qentry->vector, ret);
++		qla24xx_disable_msix(ha);
++		ha->mqenable = 0;
++		goto msix_out;
++	}
++
+ 	/* Enable MSI-X vector for response queue update for queue 0 */
+ 	if (IS_QLA83XX(ha)) {
+ 		if (ha->msixbase && ha->mqiobase &&
+diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c
+index 17d740427240..9969fa1ef7c4 100644
+--- a/drivers/scsi/storvsc_drv.c
++++ b/drivers/scsi/storvsc_drv.c
+@@ -1419,6 +1419,9 @@ static void storvsc_device_destroy(struct scsi_device *sdevice)
+ {
+ 	struct stor_mem_pools *memp = sdevice->hostdata;
+ 
++	if (!memp)
++		return;
++
+ 	mempool_destroy(memp->request_mempool);
+ 	kmem_cache_destroy(memp->request_pool);
+ 	kfree(memp);
+diff --git a/drivers/spi/spi-ath79.c b/drivers/spi/spi-ath79.c
+index 37bad952ab38..05dd69212e32 100644
+--- a/drivers/spi/spi-ath79.c
++++ b/drivers/spi/spi-ath79.c
+@@ -132,9 +132,9 @@ static int ath79_spi_setup_cs(struct spi_device *spi)
+ 
+ 		flags = GPIOF_DIR_OUT;
+ 		if (spi->mode & SPI_CS_HIGH)
+-			flags |= GPIOF_INIT_HIGH;
+-		else
+ 			flags |= GPIOF_INIT_LOW;
++		else
++			flags |= GPIOF_INIT_HIGH;
+ 
+ 		status = gpio_request_one(cdata->gpio, flags,
+ 					  dev_name(&spi->dev));
+diff --git a/drivers/spi/spi-coldfire-qspi.c b/drivers/spi/spi-coldfire-qspi.c
+index cc5b75d10c38..524d112d5369 100644
+--- a/drivers/spi/spi-coldfire-qspi.c
++++ b/drivers/spi/spi-coldfire-qspi.c
+@@ -539,7 +539,8 @@ static int mcfqspi_resume(struct device *dev)
+ #ifdef CONFIG_PM_RUNTIME
+ static int mcfqspi_runtime_suspend(struct device *dev)
+ {
+-	struct mcfqspi *mcfqspi = dev_get_drvdata(dev);
++	struct spi_master *master = dev_get_drvdata(dev);
++	struct mcfqspi *mcfqspi = spi_master_get_devdata(master);
+ 
+ 	clk_disable(mcfqspi->clk);
+ 
+@@ -548,7 +549,8 @@ static int mcfqspi_runtime_suspend(struct device *dev)
+ 
+ static int mcfqspi_runtime_resume(struct device *dev)
+ {
+-	struct mcfqspi *mcfqspi = dev_get_drvdata(dev);
++	struct spi_master *master = dev_get_drvdata(dev);
++	struct mcfqspi *mcfqspi = spi_master_get_devdata(master);
+ 
+ 	clk_enable(mcfqspi->clk);
+ 
+diff --git a/drivers/spi/spi-fsl-dspi.c b/drivers/spi/spi-fsl-dspi.c
+index 4e44575bd87a..f1322343d789 100644
+--- a/drivers/spi/spi-fsl-dspi.c
++++ b/drivers/spi/spi-fsl-dspi.c
+@@ -421,7 +421,6 @@ static int dspi_suspend(struct device *dev)
+ 
+ static int dspi_resume(struct device *dev)
+ {
+-
+ 	struct spi_master *master = dev_get_drvdata(dev);
+ 	struct fsl_dspi *dspi = spi_master_get_devdata(master);
+ 
+@@ -505,7 +504,7 @@ static int dspi_probe(struct platform_device *pdev)
+ 	clk_prepare_enable(dspi->clk);
+ 
+ 	init_waitqueue_head(&dspi->waitq);
+-	platform_set_drvdata(pdev, dspi);
++	platform_set_drvdata(pdev, master);
+ 
+ 	ret = spi_bitbang_start(&dspi->bitbang);
+ 	if (ret != 0) {
+@@ -527,7 +526,8 @@ out_master_put:
+ 
+ static int dspi_remove(struct platform_device *pdev)
+ {
+-	struct fsl_dspi *dspi = platform_get_drvdata(pdev);
++	struct spi_master *master = platform_get_drvdata(pdev);
++	struct fsl_dspi *dspi = spi_master_get_devdata(master);
+ 
+ 	/* Disconnect from the SPI framework */
+ 	spi_bitbang_stop(&dspi->bitbang);
+diff --git a/drivers/spi/spi-imx.c b/drivers/spi/spi-imx.c
+index 15323d8bd9cf..941069517423 100644
+--- a/drivers/spi/spi-imx.c
++++ b/drivers/spi/spi-imx.c
+@@ -892,8 +892,8 @@ static int spi_imx_remove(struct platform_device *pdev)
+ 	spi_bitbang_stop(&spi_imx->bitbang);
+ 
+ 	writel(0, spi_imx->base + MXC_CSPICTRL);
+-	clk_disable_unprepare(spi_imx->clk_ipg);
+-	clk_disable_unprepare(spi_imx->clk_per);
++	clk_unprepare(spi_imx->clk_ipg);
++	clk_unprepare(spi_imx->clk_per);
+ 	spi_master_put(master);
+ 
+ 	return 0;
+diff --git a/drivers/staging/zram/zram_drv.c b/drivers/staging/zram/zram_drv.c
+index d7ac040e0dc1..d02088f7dc33 100644
+--- a/drivers/staging/zram/zram_drv.c
++++ b/drivers/staging/zram/zram_drv.c
+@@ -621,6 +621,8 @@ static ssize_t disksize_store(struct device *dev,
+ 
+ 	disksize = PAGE_ALIGN(disksize);
+ 	meta = zram_meta_alloc(disksize);
++	if (!meta)
++		return -ENOMEM;
+ 	down_write(&zram->init_lock);
+ 	if (zram->init_done) {
+ 		up_write(&zram->init_lock);
+diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
+index e12f2aab3c87..b5e574659785 100644
+--- a/drivers/target/iscsi/iscsi_target.c
++++ b/drivers/target/iscsi/iscsi_target.c
+@@ -785,7 +785,7 @@ static void iscsit_ack_from_expstatsn(struct iscsi_conn *conn, u32 exp_statsn)
+ 	spin_unlock_bh(&conn->cmd_lock);
+ 
+ 	list_for_each_entry_safe(cmd, cmd_p, &ack_list, i_conn_node) {
+-		list_del(&cmd->i_conn_node);
++		list_del_init(&cmd->i_conn_node);
+ 		iscsit_free_cmd(cmd, false);
+ 	}
+ }
+@@ -3704,7 +3704,7 @@ iscsit_immediate_queue(struct iscsi_conn *conn, struct iscsi_cmd *cmd, int state
+ 		break;
+ 	case ISTATE_REMOVE:
+ 		spin_lock_bh(&conn->cmd_lock);
+-		list_del(&cmd->i_conn_node);
++		list_del_init(&cmd->i_conn_node);
+ 		spin_unlock_bh(&conn->cmd_lock);
+ 
+ 		iscsit_free_cmd(cmd, false);
+@@ -4149,7 +4149,7 @@ static void iscsit_release_commands_from_conn(struct iscsi_conn *conn)
+ 	spin_lock_bh(&conn->cmd_lock);
+ 	list_for_each_entry_safe(cmd, cmd_tmp, &conn->conn_cmd_list, i_conn_node) {
+ 
+-		list_del(&cmd->i_conn_node);
++		list_del_init(&cmd->i_conn_node);
+ 		spin_unlock_bh(&conn->cmd_lock);
+ 
+ 		iscsit_increment_maxcmdsn(cmd, sess);
+@@ -4194,6 +4194,10 @@ int iscsit_close_connection(
+ 	iscsit_stop_timers_for_cmds(conn);
+ 	iscsit_stop_nopin_response_timer(conn);
+ 	iscsit_stop_nopin_timer(conn);
++
++	if (conn->conn_transport->iscsit_wait_conn)
++		conn->conn_transport->iscsit_wait_conn(conn);
++
+ 	iscsit_free_queue_reqs_for_conn(conn);
+ 
+ 	/*
+diff --git a/drivers/target/iscsi/iscsi_target_erl2.c b/drivers/target/iscsi/iscsi_target_erl2.c
+index 33be1fb1df32..4ca8fd2a70db 100644
+--- a/drivers/target/iscsi/iscsi_target_erl2.c
++++ b/drivers/target/iscsi/iscsi_target_erl2.c
+@@ -138,7 +138,7 @@ void iscsit_free_connection_recovery_entires(struct iscsi_session *sess)
+ 		list_for_each_entry_safe(cmd, cmd_tmp,
+ 				&cr->conn_recovery_cmd_list, i_conn_node) {
+ 
+-			list_del(&cmd->i_conn_node);
++			list_del_init(&cmd->i_conn_node);
+ 			cmd->conn = NULL;
+ 			spin_unlock(&cr->conn_recovery_cmd_lock);
+ 			iscsit_free_cmd(cmd, true);
+@@ -160,7 +160,7 @@ void iscsit_free_connection_recovery_entires(struct iscsi_session *sess)
+ 		list_for_each_entry_safe(cmd, cmd_tmp,
+ 				&cr->conn_recovery_cmd_list, i_conn_node) {
+ 
+-			list_del(&cmd->i_conn_node);
++			list_del_init(&cmd->i_conn_node);
+ 			cmd->conn = NULL;
+ 			spin_unlock(&cr->conn_recovery_cmd_lock);
+ 			iscsit_free_cmd(cmd, true);
+@@ -216,7 +216,7 @@ int iscsit_remove_cmd_from_connection_recovery(
+ 	}
+ 	cr = cmd->cr;
+ 
+-	list_del(&cmd->i_conn_node);
++	list_del_init(&cmd->i_conn_node);
+ 	return --cr->cmd_count;
+ }
+ 
+@@ -297,7 +297,7 @@ int iscsit_discard_unacknowledged_ooo_cmdsns_for_conn(struct iscsi_conn *conn)
+ 		if (!(cmd->cmd_flags & ICF_OOO_CMDSN))
+ 			continue;
+ 
+-		list_del(&cmd->i_conn_node);
++		list_del_init(&cmd->i_conn_node);
+ 
+ 		spin_unlock_bh(&conn->cmd_lock);
+ 		iscsit_free_cmd(cmd, true);
+@@ -335,7 +335,7 @@ int iscsit_prepare_cmds_for_realligance(struct iscsi_conn *conn)
+ 	/*
+ 	 * Only perform connection recovery on ISCSI_OP_SCSI_CMD or
+ 	 * ISCSI_OP_NOOP_OUT opcodes.  For all other opcodes call
+-	 * list_del(&cmd->i_conn_node); to release the command to the
++	 * list_del_init(&cmd->i_conn_node); to release the command to the
+ 	 * session pool and remove it from the connection's list.
+ 	 *
+ 	 * Also stop the DataOUT timer, which will be restarted after
+@@ -351,7 +351,7 @@ int iscsit_prepare_cmds_for_realligance(struct iscsi_conn *conn)
+ 				" CID: %hu\n", cmd->iscsi_opcode,
+ 				cmd->init_task_tag, cmd->cmd_sn, conn->cid);
+ 
+-			list_del(&cmd->i_conn_node);
++			list_del_init(&cmd->i_conn_node);
+ 			spin_unlock_bh(&conn->cmd_lock);
+ 			iscsit_free_cmd(cmd, true);
+ 			spin_lock_bh(&conn->cmd_lock);
+@@ -371,7 +371,7 @@ int iscsit_prepare_cmds_for_realligance(struct iscsi_conn *conn)
+ 		 */
+ 		if (!(cmd->cmd_flags & ICF_OOO_CMDSN) && !cmd->immediate_cmd &&
+ 		     iscsi_sna_gte(cmd->cmd_sn, conn->sess->exp_cmd_sn)) {
+-			list_del(&cmd->i_conn_node);
++			list_del_init(&cmd->i_conn_node);
+ 			spin_unlock_bh(&conn->cmd_lock);
+ 			iscsit_free_cmd(cmd, true);
+ 			spin_lock_bh(&conn->cmd_lock);
+@@ -393,7 +393,7 @@ int iscsit_prepare_cmds_for_realligance(struct iscsi_conn *conn)
+ 
+ 		cmd->sess = conn->sess;
+ 
+-		list_del(&cmd->i_conn_node);
++		list_del_init(&cmd->i_conn_node);
+ 		spin_unlock_bh(&conn->cmd_lock);
+ 
+ 		iscsit_free_all_datain_reqs(cmd);
+diff --git a/drivers/target/iscsi/iscsi_target_tpg.c b/drivers/target/iscsi/iscsi_target_tpg.c
+index 4faeb47fa5e1..3cf77c0b76b4 100644
+--- a/drivers/target/iscsi/iscsi_target_tpg.c
++++ b/drivers/target/iscsi/iscsi_target_tpg.c
+@@ -137,7 +137,7 @@ struct iscsi_portal_group *iscsit_get_tpg_from_np(
+ 	list_for_each_entry(tpg, &tiqn->tiqn_tpg_list, tpg_list) {
+ 
+ 		spin_lock(&tpg->tpg_state_lock);
+-		if (tpg->tpg_state == TPG_STATE_FREE) {
++		if (tpg->tpg_state != TPG_STATE_ACTIVE) {
+ 			spin_unlock(&tpg->tpg_state_lock);
+ 			continue;
+ 		}
+diff --git a/drivers/thermal/x86_pkg_temp_thermal.c b/drivers/thermal/x86_pkg_temp_thermal.c
+index 7722cb9d5a80..72573661a14a 100644
+--- a/drivers/thermal/x86_pkg_temp_thermal.c
++++ b/drivers/thermal/x86_pkg_temp_thermal.c
+@@ -68,6 +68,10 @@ struct phy_dev_entry {
+ 	struct thermal_zone_device *tzone;
+ };
+ 
++static const struct thermal_zone_params pkg_temp_tz_params = {
++	.no_hwmon	= true,
++};
++
+ /* List maintaining number of package instances */
+ static LIST_HEAD(phy_dev_list);
+ static DEFINE_MUTEX(phy_dev_list_mutex);
+@@ -446,7 +450,7 @@ static int pkg_temp_thermal_device_add(unsigned int cpu)
+ 			thres_count,
+ 			(thres_count == MAX_NUMBER_OF_TRIPS) ?
+ 				0x03 : 0x01,
+-			phy_dev_entry, &tzone_ops, NULL, 0, 0);
++			phy_dev_entry, &tzone_ops, &pkg_temp_tz_params, 0, 0);
+ 	if (IS_ERR(phy_dev_entry->tzone)) {
+ 		err = PTR_ERR(phy_dev_entry->tzone);
+ 		goto err_ret_free;
+diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c
+index 548d1996590f..652438325197 100644
+--- a/drivers/usb/core/config.c
++++ b/drivers/usb/core/config.c
+@@ -718,6 +718,10 @@ int usb_get_configuration(struct usb_device *dev)
+ 			result = -ENOMEM;
+ 			goto err;
+ 		}
++
++		if (dev->quirks & USB_QUIRK_DELAY_INIT)
++			msleep(100);
++
+ 		result = usb_get_descriptor(dev, USB_DT_CONFIG, cfgno,
+ 		    bigbuffer, length);
+ 		if (result < 0) {
+diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
+index 01fe36273f3b..1053eb651b2f 100644
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -46,6 +46,10 @@ static const struct usb_device_id usb_quirk_list[] = {
+ 	/* Microsoft LifeCam-VX700 v2.0 */
+ 	{ USB_DEVICE(0x045e, 0x0770), .driver_info = USB_QUIRK_RESET_RESUME },
+ 
++	/* Logitech HD Pro Webcams C920 and C930e */
++	{ USB_DEVICE(0x046d, 0x082d), .driver_info = USB_QUIRK_DELAY_INIT },
++	{ USB_DEVICE(0x046d, 0x0843), .driver_info = USB_QUIRK_DELAY_INIT },
++
+ 	/* Logitech Quickcam Fusion */
+ 	{ USB_DEVICE(0x046d, 0x08c1), .driver_info = USB_QUIRK_RESET_RESUME },
+ 
+diff --git a/drivers/usb/host/ehci-pci.c b/drivers/usb/host/ehci-pci.c
+index 854c2ec7b699..3e86bf4371b3 100644
+--- a/drivers/usb/host/ehci-pci.c
++++ b/drivers/usb/host/ehci-pci.c
+@@ -58,8 +58,6 @@ static int ehci_pci_setup(struct usb_hcd *hcd)
+ {
+ 	struct ehci_hcd		*ehci = hcd_to_ehci(hcd);
+ 	struct pci_dev		*pdev = to_pci_dev(hcd->self.controller);
+-	struct pci_dev		*p_smbus;
+-	u8			rev;
+ 	u32			temp;
+ 	int			retval;
+ 
+@@ -175,22 +173,12 @@ static int ehci_pci_setup(struct usb_hcd *hcd)
+ 		/* SB600 and old version of SB700 have a bug in EHCI controller,
+ 		 * which causes usb devices lose response in some cases.
+ 		 */
+-		if ((pdev->device == 0x4386) || (pdev->device == 0x4396)) {
+-			p_smbus = pci_get_device(PCI_VENDOR_ID_ATI,
+-						 PCI_DEVICE_ID_ATI_SBX00_SMBUS,
+-						 NULL);
+-			if (!p_smbus)
+-				break;
+-			rev = p_smbus->revision;
+-			if ((pdev->device == 0x4386) || (rev == 0x3a)
+-			    || (rev == 0x3b)) {
+-				u8 tmp;
+-				ehci_info(ehci, "applying AMD SB600/SB700 USB "
+-					"freeze workaround\n");
+-				pci_read_config_byte(pdev, 0x53, &tmp);
+-				pci_write_config_byte(pdev, 0x53, tmp | (1<<3));
+-			}
+-			pci_dev_put(p_smbus);
++		if ((pdev->device == 0x4386 || pdev->device == 0x4396) &&
++				usb_amd_hang_symptom_quirk()) {
++			u8 tmp;
++			ehci_info(ehci, "applying AMD SB600/SB700 USB freeze workaround\n");
++			pci_read_config_byte(pdev, 0x53, &tmp);
++			pci_write_config_byte(pdev, 0x53, tmp | (1<<3));
+ 		}
+ 		break;
+ 	case PCI_VENDOR_ID_NETMOS:
+diff --git a/drivers/usb/host/ohci-pci.c b/drivers/usb/host/ohci-pci.c
+index ec337c2bd5e0..659cde1ed1ea 100644
+--- a/drivers/usb/host/ohci-pci.c
++++ b/drivers/usb/host/ohci-pci.c
+@@ -150,28 +150,16 @@ static int ohci_quirk_nec(struct usb_hcd *hcd)
+ static int ohci_quirk_amd700(struct usb_hcd *hcd)
+ {
+ 	struct ohci_hcd *ohci = hcd_to_ohci(hcd);
+-	struct pci_dev *amd_smbus_dev;
+-	u8 rev;
+ 
+ 	if (usb_amd_find_chipset_info())
+ 		ohci->flags |= OHCI_QUIRK_AMD_PLL;
+ 
+-	amd_smbus_dev = pci_get_device(PCI_VENDOR_ID_ATI,
+-			PCI_DEVICE_ID_ATI_SBX00_SMBUS, NULL);
+-	if (!amd_smbus_dev)
+-		return 0;
+-
+-	rev = amd_smbus_dev->revision;
+-
+ 	/* SB800 needs pre-fetch fix */
+-	if ((rev >= 0x40) && (rev <= 0x4f)) {
++	if (usb_amd_prefetch_quirk()) {
+ 		ohci->flags |= OHCI_QUIRK_AMD_PREFETCH;
+ 		ohci_dbg(ohci, "enabled AMD prefetch quirk\n");
+ 	}
+ 
+-	pci_dev_put(amd_smbus_dev);
+-	amd_smbus_dev = NULL;
+-
+ 	return 0;
+ }
+ 
+diff --git a/drivers/usb/host/pci-quirks.c b/drivers/usb/host/pci-quirks.c
+index 08ef2829a7e2..463156d03140 100644
+--- a/drivers/usb/host/pci-quirks.c
++++ b/drivers/usb/host/pci-quirks.c
+@@ -79,11 +79,30 @@
+ #define USB_INTEL_USB3_PSSEN   0xD8
+ #define USB_INTEL_USB3PRM      0xDC
+ 
++/*
++ * amd_chipset_gen values represent AMD different chipset generations
++ */
++enum amd_chipset_gen {
++	NOT_AMD_CHIPSET = 0,
++	AMD_CHIPSET_SB600,
++	AMD_CHIPSET_SB700,
++	AMD_CHIPSET_SB800,
++	AMD_CHIPSET_HUDSON2,
++	AMD_CHIPSET_BOLTON,
++	AMD_CHIPSET_YANGTZE,
++	AMD_CHIPSET_UNKNOWN,
++};
++
++struct amd_chipset_type {
++	enum amd_chipset_gen gen;
++	u8 rev;
++};
++
+ static struct amd_chipset_info {
+ 	struct pci_dev	*nb_dev;
+ 	struct pci_dev	*smbus_dev;
+ 	int nb_type;
+-	int sb_type;
++	struct amd_chipset_type sb_type;
+ 	int isoc_reqs;
+ 	int probe_count;
+ 	int probe_result;
+@@ -91,6 +110,51 @@ static struct amd_chipset_info {
+ 
+ static DEFINE_SPINLOCK(amd_lock);
+ 
++/*
++ * amd_chipset_sb_type_init - initialize amd chipset southbridge type
++ *
++ * AMD FCH/SB generation and revision is identified by SMBus controller
++ * vendor, device and revision IDs.
++ *
++ * Returns: 1 if it is an AMD chipset, 0 otherwise.
++ */
++int amd_chipset_sb_type_init(struct amd_chipset_info *pinfo)
++{
++	u8 rev = 0;
++	pinfo->sb_type.gen = AMD_CHIPSET_UNKNOWN;
++
++	pinfo->smbus_dev = pci_get_device(PCI_VENDOR_ID_ATI,
++			PCI_DEVICE_ID_ATI_SBX00_SMBUS, NULL);
++	if (pinfo->smbus_dev) {
++		rev = pinfo->smbus_dev->revision;
++		if (rev >= 0x10 && rev <= 0x1f)
++			pinfo->sb_type.gen = AMD_CHIPSET_SB600;
++		else if (rev >= 0x30 && rev <= 0x3f)
++			pinfo->sb_type.gen = AMD_CHIPSET_SB700;
++		else if (rev >= 0x40 && rev <= 0x4f)
++			pinfo->sb_type.gen = AMD_CHIPSET_SB800;
++	} else {
++		pinfo->smbus_dev = pci_get_device(PCI_VENDOR_ID_AMD,
++				PCI_DEVICE_ID_AMD_HUDSON2_SMBUS, NULL);
++
++		if (!pinfo->smbus_dev) {
++			pinfo->sb_type.gen = NOT_AMD_CHIPSET;
++			return 0;
++		}
++
++		rev = pinfo->smbus_dev->revision;
++		if (rev >= 0x11 && rev <= 0x14)
++			pinfo->sb_type.gen = AMD_CHIPSET_HUDSON2;
++		else if (rev >= 0x15 && rev <= 0x18)
++			pinfo->sb_type.gen = AMD_CHIPSET_BOLTON;
++		else if (rev >= 0x39 && rev <= 0x3a)
++			pinfo->sb_type.gen = AMD_CHIPSET_YANGTZE;
++	}
++
++	pinfo->sb_type.rev = rev;
++	return 1;
++}
++
+ void sb800_prefetch(struct device *dev, int on)
+ {
+ 	u16 misc;
+@@ -106,7 +170,6 @@ EXPORT_SYMBOL_GPL(sb800_prefetch);
+ 
+ int usb_amd_find_chipset_info(void)
+ {
+-	u8 rev = 0;
+ 	unsigned long flags;
+ 	struct amd_chipset_info info;
+ 	int ret;
+@@ -122,27 +185,17 @@ int usb_amd_find_chipset_info(void)
+ 	memset(&info, 0, sizeof(info));
+ 	spin_unlock_irqrestore(&amd_lock, flags);
+ 
+-	info.smbus_dev = pci_get_device(PCI_VENDOR_ID_ATI, 0x4385, NULL);
+-	if (info.smbus_dev) {
+-		rev = info.smbus_dev->revision;
+-		if (rev >= 0x40)
+-			info.sb_type = 1;
+-		else if (rev >= 0x30 && rev <= 0x3b)
+-			info.sb_type = 3;
+-	} else {
+-		info.smbus_dev = pci_get_device(PCI_VENDOR_ID_AMD,
+-						0x780b, NULL);
+-		if (!info.smbus_dev) {
+-			ret = 0;
+-			goto commit;
+-		}
+-
+-		rev = info.smbus_dev->revision;
+-		if (rev >= 0x11 && rev <= 0x18)
+-			info.sb_type = 2;
++	if (!amd_chipset_sb_type_init(&info)) {
++		ret = 0;
++		goto commit;
+ 	}
+ 
+-	if (info.sb_type == 0) {
++	/* Below chipset generations needn't enable AMD PLL quirk */
++	if (info.sb_type.gen == AMD_CHIPSET_UNKNOWN ||
++			info.sb_type.gen == AMD_CHIPSET_SB600 ||
++			info.sb_type.gen == AMD_CHIPSET_YANGTZE ||
++			(info.sb_type.gen == AMD_CHIPSET_SB700 &&
++			info.sb_type.rev > 0x3b)) {
+ 		if (info.smbus_dev) {
+ 			pci_dev_put(info.smbus_dev);
+ 			info.smbus_dev = NULL;
+@@ -197,6 +250,27 @@ commit:
+ }
+ EXPORT_SYMBOL_GPL(usb_amd_find_chipset_info);
+ 
++bool usb_amd_hang_symptom_quirk(void)
++{
++	u8 rev;
++
++	usb_amd_find_chipset_info();
++	rev = amd_chipset.sb_type.rev;
++	/* SB600 and old version of SB700 have hang symptom bug */
++	return amd_chipset.sb_type.gen == AMD_CHIPSET_SB600 ||
++			(amd_chipset.sb_type.gen == AMD_CHIPSET_SB700 &&
++			 rev >= 0x3a && rev <= 0x3b);
++}
++EXPORT_SYMBOL_GPL(usb_amd_hang_symptom_quirk);
++
++bool usb_amd_prefetch_quirk(void)
++{
++	usb_amd_find_chipset_info();
++	/* SB800 needs pre-fetch fix */
++	return amd_chipset.sb_type.gen == AMD_CHIPSET_SB800;
++}
++EXPORT_SYMBOL_GPL(usb_amd_prefetch_quirk);
++
+ /*
+  * The hardware normally enables the A-link power management feature, which
+  * lets the system lower the power consumption in idle states.
+@@ -229,7 +303,9 @@ static void usb_amd_quirk_pll(int disable)
+ 		}
+ 	}
+ 
+-	if (amd_chipset.sb_type == 1 || amd_chipset.sb_type == 2) {
++	if (amd_chipset.sb_type.gen == AMD_CHIPSET_SB800 ||
++			amd_chipset.sb_type.gen == AMD_CHIPSET_HUDSON2 ||
++			amd_chipset.sb_type.gen == AMD_CHIPSET_BOLTON) {
+ 		outb_p(AB_REG_BAR_LOW, 0xcd6);
+ 		addr_low = inb_p(0xcd7);
+ 		outb_p(AB_REG_BAR_HIGH, 0xcd6);
+@@ -240,7 +316,8 @@ static void usb_amd_quirk_pll(int disable)
+ 		outl_p(0x40, AB_DATA(addr));
+ 		outl_p(0x34, AB_INDX(addr));
+ 		val = inl_p(AB_DATA(addr));
+-	} else if (amd_chipset.sb_type == 3) {
++	} else if (amd_chipset.sb_type.gen == AMD_CHIPSET_SB700 &&
++			amd_chipset.sb_type.rev <= 0x3b) {
+ 		pci_read_config_dword(amd_chipset.smbus_dev,
+ 					AB_REG_BAR_SB700, &addr);
+ 		outl(AX_INDXC, AB_INDX(addr));
+@@ -353,7 +430,7 @@ void usb_amd_dev_put(void)
+ 	amd_chipset.nb_dev = NULL;
+ 	amd_chipset.smbus_dev = NULL;
+ 	amd_chipset.nb_type = 0;
+-	amd_chipset.sb_type = 0;
++	memset(&amd_chipset.sb_type, 0, sizeof(amd_chipset.sb_type));
+ 	amd_chipset.isoc_reqs = 0;
+ 	amd_chipset.probe_result = 0;
+ 
+diff --git a/drivers/usb/host/pci-quirks.h b/drivers/usb/host/pci-quirks.h
+index ed6700d00fe6..638e88f7a28b 100644
+--- a/drivers/usb/host/pci-quirks.h
++++ b/drivers/usb/host/pci-quirks.h
+@@ -5,6 +5,8 @@
+ void uhci_reset_hc(struct pci_dev *pdev, unsigned long base);
+ int uhci_check_and_reset_hc(struct pci_dev *pdev, unsigned long base);
+ int usb_amd_find_chipset_info(void);
++bool usb_amd_hang_symptom_quirk(void);
++bool usb_amd_prefetch_quirk(void);
+ void usb_amd_dev_put(void);
+ void usb_amd_quirk_pll_disable(void);
+ void usb_amd_quirk_pll_enable(void);
+diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
+index 82fb34183a7f..f178f762b543 100644
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -4730,6 +4730,9 @@ int xhci_gen_setup(struct usb_hcd *hcd, xhci_get_quirks_t get_quirks)
+ 	/* Accept arbitrarily long scatter-gather lists */
+ 	hcd->self.sg_tablesize = ~0;
+ 
++	/* support to build packet from discontinuous buffers */
++	hcd->self.no_sg_constraint = 1;
++
+ 	/* XHCI controllers don't stop the ep queue on short packets :| */
+ 	hcd->self.no_stop_on_short = 1;
+ 
+@@ -4754,14 +4757,6 @@ int xhci_gen_setup(struct usb_hcd *hcd, xhci_get_quirks_t get_quirks)
+ 		/* xHCI private pointer was set in xhci_pci_probe for the second
+ 		 * registered roothub.
+ 		 */
+-		xhci = hcd_to_xhci(hcd);
+-		/*
+-		 * Support arbitrarily aligned sg-list entries on hosts without
+-		 * TD fragment rules (which are currently unsupported).
+-		 */
+-		if (xhci->hci_version < 0x100)
+-			hcd->self.no_sg_constraint = 1;
+-
+ 		return 0;
+ 	}
+ 
+@@ -4788,9 +4783,6 @@ int xhci_gen_setup(struct usb_hcd *hcd, xhci_get_quirks_t get_quirks)
+ 	if (xhci->hci_version > 0x96)
+ 		xhci->quirks |= XHCI_SPURIOUS_SUCCESS;
+ 
+-	if (xhci->hci_version < 0x100)
+-		hcd->self.no_sg_constraint = 1;
+-
+ 	/* Make sure the HC is halted. */
+ 	retval = xhci_halt(xhci);
+ 	if (retval)
+diff --git a/drivers/video/efifb.c b/drivers/video/efifb.c
+index 7f9ff75d0db2..fcb950031246 100644
+--- a/drivers/video/efifb.c
++++ b/drivers/video/efifb.c
+@@ -108,8 +108,8 @@ static int efifb_setup(char *options)
+ 			if (!*this_opt) continue;
+ 
+ 			for (i = 0; i < M_UNKNOWN; i++) {
+-				if (!strcmp(this_opt, efifb_dmi_list[i].optname) &&
+-				    efifb_dmi_list[i].base != 0) {
++				if (efifb_dmi_list[i].base != 0 &&
++				    !strcmp(this_opt, efifb_dmi_list[i].optname)) {
+ 					screen_info.lfb_base = efifb_dmi_list[i].base;
+ 					screen_info.lfb_linelength = efifb_dmi_list[i].stride;
+ 					screen_info.lfb_width = efifb_dmi_list[i].width;
+diff --git a/fs/bio-integrity.c b/fs/bio-integrity.c
+index 76273c1d26a6..b5ee393e2e8d 100644
+--- a/fs/bio-integrity.c
++++ b/fs/bio-integrity.c
+@@ -316,7 +316,7 @@ static void bio_integrity_generate(struct bio *bio)
+ 	bix.disk_name = bio->bi_bdev->bd_disk->disk_name;
+ 	bix.sector_size = bi->sector_size;
+ 
+-	bio_for_each_segment(bv, bio, i) {
++	bio_for_each_segment_all(bv, bio, i) {
+ 		void *kaddr = kmap_atomic(bv->bv_page);
+ 		bix.data_buf = kaddr + bv->bv_offset;
+ 		bix.data_size = bv->bv_len;
+diff --git a/fs/eventpoll.c b/fs/eventpoll.c
+index 810c28fb8c3c..d76c9744c774 100644
+--- a/fs/eventpoll.c
++++ b/fs/eventpoll.c
+@@ -41,6 +41,7 @@
+ #include <linux/proc_fs.h>
+ #include <linux/seq_file.h>
+ #include <linux/compat.h>
++#include <linux/rculist.h>
+ 
+ /*
+  * LOCKING:
+@@ -133,8 +134,12 @@ struct nested_calls {
+  * of these on a server and we do not want this to take another cache line.
+  */
+ struct epitem {
+-	/* RB tree node used to link this structure to the eventpoll RB tree */
+-	struct rb_node rbn;
++	union {
++		/* RB tree node links this structure to the eventpoll RB tree */
++		struct rb_node rbn;
++		/* Used to free the struct epitem */
++		struct rcu_head rcu;
++	};
+ 
+ 	/* List header used to link this structure to the eventpoll ready list */
+ 	struct list_head rdllink;
+@@ -580,14 +585,14 @@ static inline void ep_pm_stay_awake_rcu(struct epitem *epi)
+  * @sproc: Pointer to the scan callback.
+  * @priv: Private opaque data passed to the @sproc callback.
+  * @depth: The current depth of recursive f_op->poll calls.
++ * @ep_locked: caller already holds ep->mtx
+  *
+  * Returns: The same integer error code returned by the @sproc callback.
+  */
+ static int ep_scan_ready_list(struct eventpoll *ep,
+ 			      int (*sproc)(struct eventpoll *,
+ 					   struct list_head *, void *),
+-			      void *priv,
+-			      int depth)
++			      void *priv, int depth, bool ep_locked)
+ {
+ 	int error, pwake = 0;
+ 	unsigned long flags;
+@@ -598,7 +603,9 @@ static int ep_scan_ready_list(struct eventpoll *ep,
+ 	 * We need to lock this because we could be hit by
+ 	 * eventpoll_release_file() and epoll_ctl().
+ 	 */
+-	mutex_lock_nested(&ep->mtx, depth);
++
++	if (!ep_locked)
++		mutex_lock_nested(&ep->mtx, depth);
+ 
+ 	/*
+ 	 * Steal the ready list, and re-init the original one to the
+@@ -662,7 +669,8 @@ static int ep_scan_ready_list(struct eventpoll *ep,
+ 	}
+ 	spin_unlock_irqrestore(&ep->lock, flags);
+ 
+-	mutex_unlock(&ep->mtx);
++	if (!ep_locked)
++		mutex_unlock(&ep->mtx);
+ 
+ 	/* We have to call this outside the lock */
+ 	if (pwake)
+@@ -671,6 +679,12 @@ static int ep_scan_ready_list(struct eventpoll *ep,
+ 	return error;
+ }
+ 
++static void epi_rcu_free(struct rcu_head *head)
++{
++	struct epitem *epi = container_of(head, struct epitem, rcu);
++	kmem_cache_free(epi_cache, epi);
++}
++
+ /*
+  * Removes a "struct epitem" from the eventpoll RB tree and deallocates
+  * all the associated resources. Must be called with "mtx" held.
+@@ -692,8 +706,7 @@ static int ep_remove(struct eventpoll *ep, struct epitem *epi)
+ 
+ 	/* Remove the current item from the list of epoll hooks */
+ 	spin_lock(&file->f_lock);
+-	if (ep_is_linked(&epi->fllink))
+-		list_del_init(&epi->fllink);
++	list_del_rcu(&epi->fllink);
+ 	spin_unlock(&file->f_lock);
+ 
+ 	rb_erase(&epi->rbn, &ep->rbr);
+@@ -704,9 +717,14 @@ static int ep_remove(struct eventpoll *ep, struct epitem *epi)
+ 	spin_unlock_irqrestore(&ep->lock, flags);
+ 
+ 	wakeup_source_unregister(ep_wakeup_source(epi));
+-
+-	/* At this point it is safe to free the eventpoll item */
+-	kmem_cache_free(epi_cache, epi);
++	/*
++	 * At this point it is safe to free the eventpoll item. Use the union
++	 * field epi->rcu, since we are trying to minimize the size of
++	 * 'struct epitem'. The 'rbn' field is no longer in use. Protected by
++	 * ep->mtx. The rcu read side, reverse_path_check_proc(), does not make
++	 * use of the rbn field.
++	 */
++	call_rcu(&epi->rcu, epi_rcu_free);
+ 
+ 	atomic_long_dec(&ep->user->epoll_watches);
+ 
+@@ -807,15 +825,34 @@ static int ep_read_events_proc(struct eventpoll *ep, struct list_head *head,
+ 	return 0;
+ }
+ 
++static void ep_ptable_queue_proc(struct file *file, wait_queue_head_t *whead,
++				 poll_table *pt);
++
++struct readyevents_arg {
++	struct eventpoll *ep;
++	bool locked;
++};
++
+ static int ep_poll_readyevents_proc(void *priv, void *cookie, int call_nests)
+ {
+-	return ep_scan_ready_list(priv, ep_read_events_proc, NULL, call_nests + 1);
++	struct readyevents_arg *arg = priv;
++
++	return ep_scan_ready_list(arg->ep, ep_read_events_proc, NULL,
++				  call_nests + 1, arg->locked);
+ }
+ 
+ static unsigned int ep_eventpoll_poll(struct file *file, poll_table *wait)
+ {
+ 	int pollflags;
+ 	struct eventpoll *ep = file->private_data;
++	struct readyevents_arg arg;
++
++	/*
++	 * During ep_insert() we already hold the ep->mtx for the tfile.
++	 * Prevent re-aquisition.
++	 */
++	arg.locked = wait && (wait->_qproc == ep_ptable_queue_proc);
++	arg.ep = ep;
+ 
+ 	/* Insert inside our poll wait queue */
+ 	poll_wait(file, &ep->poll_wait, wait);
+@@ -827,7 +864,7 @@ static unsigned int ep_eventpoll_poll(struct file *file, poll_table *wait)
+ 	 * could re-enter here.
+ 	 */
+ 	pollflags = ep_call_nested(&poll_readywalk_ncalls, EP_MAX_NESTS,
+-				   ep_poll_readyevents_proc, ep, ep, current);
++				   ep_poll_readyevents_proc, &arg, ep, current);
+ 
+ 	return pollflags != -1 ? pollflags : 0;
+ }
+@@ -872,7 +909,6 @@ static const struct file_operations eventpoll_fops = {
+  */
+ void eventpoll_release_file(struct file *file)
+ {
+-	struct list_head *lsthead = &file->f_ep_links;
+ 	struct eventpoll *ep;
+ 	struct epitem *epi;
+ 
+@@ -890,17 +926,12 @@ void eventpoll_release_file(struct file *file)
+ 	 * Besides, ep_remove() acquires the lock, so we can't hold it here.
+ 	 */
+ 	mutex_lock(&epmutex);
+-
+-	while (!list_empty(lsthead)) {
+-		epi = list_first_entry(lsthead, struct epitem, fllink);
+-
++	list_for_each_entry_rcu(epi, &file->f_ep_links, fllink) {
+ 		ep = epi->ep;
+-		list_del_init(&epi->fllink);
+ 		mutex_lock_nested(&ep->mtx, 0);
+ 		ep_remove(ep, epi);
+ 		mutex_unlock(&ep->mtx);
+ 	}
+-
+ 	mutex_unlock(&epmutex);
+ }
+ 
+@@ -1138,7 +1169,9 @@ static int reverse_path_check_proc(void *priv, void *cookie, int call_nests)
+ 	struct file *child_file;
+ 	struct epitem *epi;
+ 
+-	list_for_each_entry(epi, &file->f_ep_links, fllink) {
++	/* CTL_DEL can remove links here, but that can't increase our count */
++	rcu_read_lock();
++	list_for_each_entry_rcu(epi, &file->f_ep_links, fllink) {
+ 		child_file = epi->ep->file;
+ 		if (is_file_epoll(child_file)) {
+ 			if (list_empty(&child_file->f_ep_links)) {
+@@ -1160,6 +1193,7 @@ static int reverse_path_check_proc(void *priv, void *cookie, int call_nests)
+ 				"file is not an ep!\n");
+ 		}
+ 	}
++	rcu_read_unlock();
+ 	return error;
+ }
+ 
+@@ -1231,7 +1265,7 @@ static noinline void ep_destroy_wakeup_source(struct epitem *epi)
+  * Must be called with "mtx" held.
+  */
+ static int ep_insert(struct eventpoll *ep, struct epoll_event *event,
+-		     struct file *tfile, int fd)
++		     struct file *tfile, int fd, int full_check)
+ {
+ 	int error, revents, pwake = 0;
+ 	unsigned long flags;
+@@ -1286,7 +1320,7 @@ static int ep_insert(struct eventpoll *ep, struct epoll_event *event,
+ 
+ 	/* Add the current item to the list of active epoll hook for this file */
+ 	spin_lock(&tfile->f_lock);
+-	list_add_tail(&epi->fllink, &tfile->f_ep_links);
++	list_add_tail_rcu(&epi->fllink, &tfile->f_ep_links);
+ 	spin_unlock(&tfile->f_lock);
+ 
+ 	/*
+@@ -1297,7 +1331,7 @@ static int ep_insert(struct eventpoll *ep, struct epoll_event *event,
+ 
+ 	/* now check if we've created too many backpaths */
+ 	error = -EINVAL;
+-	if (reverse_path_check())
++	if (full_check && reverse_path_check())
+ 		goto error_remove_epi;
+ 
+ 	/* We have to drop the new item inside our item list to keep track of it */
+@@ -1327,8 +1361,7 @@ static int ep_insert(struct eventpoll *ep, struct epoll_event *event,
+ 
+ error_remove_epi:
+ 	spin_lock(&tfile->f_lock);
+-	if (ep_is_linked(&epi->fllink))
+-		list_del_init(&epi->fllink);
++	list_del_rcu(&epi->fllink);
+ 	spin_unlock(&tfile->f_lock);
+ 
+ 	rb_erase(&epi->rbn, &ep->rbr);
+@@ -1521,7 +1554,7 @@ static int ep_send_events(struct eventpoll *ep,
+ 	esed.maxevents = maxevents;
+ 	esed.events = events;
+ 
+-	return ep_scan_ready_list(ep, ep_send_events_proc, &esed, 0);
++	return ep_scan_ready_list(ep, ep_send_events_proc, &esed, 0, false);
+ }
+ 
+ static inline struct timespec ep_set_mstimeout(long ms)
+@@ -1791,11 +1824,12 @@ SYSCALL_DEFINE4(epoll_ctl, int, epfd, int, op, int, fd,
+ 		struct epoll_event __user *, event)
+ {
+ 	int error;
+-	int did_lock_epmutex = 0;
++	int full_check = 0;
+ 	struct fd f, tf;
+ 	struct eventpoll *ep;
+ 	struct epitem *epi;
+ 	struct epoll_event epds;
++	struct eventpoll *tep = NULL;
+ 
+ 	error = -EFAULT;
+ 	if (ep_op_has_event(op) &&
+@@ -1844,27 +1878,37 @@ SYSCALL_DEFINE4(epoll_ctl, int, epfd, int, op, int, fd,
+ 	 * and hang them on the tfile_check_list, so we can check that we
+ 	 * haven't created too many possible wakeup paths.
+ 	 *
+-	 * We need to hold the epmutex across both ep_insert and ep_remove
+-	 * b/c we want to make sure we are looking at a coherent view of
+-	 * epoll network.
++	 * We do not need to take the global 'epumutex' on EPOLL_CTL_ADD when
++	 * the epoll file descriptor is attaching directly to a wakeup source,
++	 * unless the epoll file descriptor is nested. The purpose of taking the
++	 * 'epmutex' on add is to prevent complex toplogies such as loops and
++	 * deep wakeup paths from forming in parallel through multiple
++	 * EPOLL_CTL_ADD operations.
+ 	 */
+-	if (op == EPOLL_CTL_ADD || op == EPOLL_CTL_DEL) {
+-		mutex_lock(&epmutex);
+-		did_lock_epmutex = 1;
+-	}
++	mutex_lock_nested(&ep->mtx, 0);
+ 	if (op == EPOLL_CTL_ADD) {
+-		if (is_file_epoll(tf.file)) {
+-			error = -ELOOP;
+-			if (ep_loop_check(ep, tf.file) != 0) {
+-				clear_tfile_check_list();
+-				goto error_tgt_fput;
++		if (!list_empty(&f.file->f_ep_links) ||
++						is_file_epoll(tf.file)) {
++			full_check = 1;
++			mutex_unlock(&ep->mtx);
++			mutex_lock(&epmutex);
++			if (is_file_epoll(tf.file)) {
++				error = -ELOOP;
++				if (ep_loop_check(ep, tf.file) != 0) {
++					clear_tfile_check_list();
++					goto error_tgt_fput;
++				}
++			} else
++				list_add(&tf.file->f_tfile_llink,
++							&tfile_check_list);
++			mutex_lock_nested(&ep->mtx, 0);
++			if (is_file_epoll(tf.file)) {
++				tep = tf.file->private_data;
++				mutex_lock_nested(&tep->mtx, 1);
+ 			}
+-		} else
+-			list_add(&tf.file->f_tfile_llink, &tfile_check_list);
++		}
+ 	}
+ 
+-	mutex_lock_nested(&ep->mtx, 0);
+-
+ 	/*
+ 	 * Try to lookup the file inside our RB tree, Since we grabbed "mtx"
+ 	 * above, we can be sure to be able to use the item looked up by
+@@ -1877,10 +1921,11 @@ SYSCALL_DEFINE4(epoll_ctl, int, epfd, int, op, int, fd,
+ 	case EPOLL_CTL_ADD:
+ 		if (!epi) {
+ 			epds.events |= POLLERR | POLLHUP;
+-			error = ep_insert(ep, &epds, tf.file, fd);
++			error = ep_insert(ep, &epds, tf.file, fd, full_check);
+ 		} else
+ 			error = -EEXIST;
+-		clear_tfile_check_list();
++		if (full_check)
++			clear_tfile_check_list();
+ 		break;
+ 	case EPOLL_CTL_DEL:
+ 		if (epi)
+@@ -1896,10 +1941,12 @@ SYSCALL_DEFINE4(epoll_ctl, int, epfd, int, op, int, fd,
+ 			error = -ENOENT;
+ 		break;
+ 	}
++	if (tep != NULL)
++		mutex_unlock(&tep->mtx);
+ 	mutex_unlock(&ep->mtx);
+ 
+ error_tgt_fput:
+-	if (did_lock_epmutex)
++	if (full_check)
+ 		mutex_unlock(&epmutex);
+ 
+ 	fdput(tf);
+diff --git a/fs/namei.c b/fs/namei.c
+index 23ac50f4ee40..187cacf1c83c 100644
+--- a/fs/namei.c
++++ b/fs/namei.c
+@@ -3924,6 +3924,7 @@ retry:
+ out_dput:
+ 	done_path_create(&new_path, new_dentry);
+ 	if (retry_estale(error, how)) {
++		path_put(&old_path);
+ 		how |= LOOKUP_REVAL;
+ 		goto retry;
+ 	}
+diff --git a/fs/nfs/delegation.c b/fs/nfs/delegation.c
+index ef792f29f831..5d8ccecf5f5c 100644
+--- a/fs/nfs/delegation.c
++++ b/fs/nfs/delegation.c
+@@ -659,16 +659,19 @@ int nfs_async_inode_return_delegation(struct inode *inode,
+ 
+ 	rcu_read_lock();
+ 	delegation = rcu_dereference(NFS_I(inode)->delegation);
++	if (delegation == NULL)
++		goto out_enoent;
+ 
+-	if (!clp->cl_mvops->match_stateid(&delegation->stateid, stateid)) {
+-		rcu_read_unlock();
+-		return -ENOENT;
+-	}
++	if (!clp->cl_mvops->match_stateid(&delegation->stateid, stateid))
++		goto out_enoent;
+ 	nfs_mark_return_delegation(server, delegation);
+ 	rcu_read_unlock();
+ 
+ 	nfs_delegation_run_state_manager(clp);
+ 	return 0;
++out_enoent:
++	rcu_read_unlock();
++	return -ENOENT;
+ }
+ 
+ static struct inode *
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index d3d7766f55e3..a53651743d4d 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -3972,8 +3972,9 @@ static bool nfs4_stateid_is_current(nfs4_stateid *stateid,
+ {
+ 	nfs4_stateid current_stateid;
+ 
+-	if (nfs4_set_rw_stateid(&current_stateid, ctx, l_ctx, fmode))
+-		return false;
++	/* If the current stateid represents a lost lock, then exit */
++	if (nfs4_set_rw_stateid(&current_stateid, ctx, l_ctx, fmode) == -EIO)
++		return true;
+ 	return nfs4_stateid_match(stateid, &current_stateid);
+ }
+ 
+diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c
+index d71903c6068b..f07941160515 100644
+--- a/fs/ocfs2/file.c
++++ b/fs/ocfs2/file.c
+@@ -2371,8 +2371,8 @@ out_dio:
+ 
+ 	if (((file->f_flags & O_DSYNC) && !direct_io) || IS_SYNC(inode) ||
+ 	    ((file->f_flags & O_DIRECT) && !direct_io)) {
+-		ret = filemap_fdatawrite_range(file->f_mapping, pos,
+-					       pos + count - 1);
++		ret = filemap_fdatawrite_range(file->f_mapping, *ppos,
++					       *ppos + count - 1);
+ 		if (ret < 0)
+ 			written = ret;
+ 
+@@ -2385,8 +2385,8 @@ out_dio:
+ 		}
+ 
+ 		if (!ret)
+-			ret = filemap_fdatawait_range(file->f_mapping, pos,
+-						      pos + count - 1);
++			ret = filemap_fdatawait_range(file->f_mapping, *ppos,
++						      *ppos + count - 1);
+ 	}
+ 
+ 	/*
+diff --git a/fs/ocfs2/quota_global.c b/fs/ocfs2/quota_global.c
+index aaa50611ec66..d7b5108789e2 100644
+--- a/fs/ocfs2/quota_global.c
++++ b/fs/ocfs2/quota_global.c
+@@ -717,6 +717,12 @@ static int ocfs2_release_dquot(struct dquot *dquot)
+ 	 */
+ 	if (status < 0)
+ 		mlog_errno(status);
++	/*
++	 * Clear dq_off so that we search for the structure in quota file next
++	 * time we acquire it. The structure might be deleted and reallocated
++	 * elsewhere by another node while our dquot structure is on freelist.
++	 */
++	dquot->dq_off = 0;
+ 	clear_bit(DQ_ACTIVE_B, &dquot->dq_flags);
+ out_trans:
+ 	ocfs2_commit_trans(osb, handle);
+@@ -756,16 +762,17 @@ static int ocfs2_acquire_dquot(struct dquot *dquot)
+ 	status = ocfs2_lock_global_qf(info, 1);
+ 	if (status < 0)
+ 		goto out;
+-	if (!test_bit(DQ_READ_B, &dquot->dq_flags)) {
+-		status = ocfs2_qinfo_lock(info, 0);
+-		if (status < 0)
+-			goto out_dq;
+-		status = qtree_read_dquot(&info->dqi_gi, dquot);
+-		ocfs2_qinfo_unlock(info, 0);
+-		if (status < 0)
+-			goto out_dq;
+-	}
+-	set_bit(DQ_READ_B, &dquot->dq_flags);
++	status = ocfs2_qinfo_lock(info, 0);
++	if (status < 0)
++		goto out_dq;
++	/*
++	 * We always want to read dquot structure from disk because we don't
++	 * know what happened with it while it was on freelist.
++	 */
++	status = qtree_read_dquot(&info->dqi_gi, dquot);
++	ocfs2_qinfo_unlock(info, 0);
++	if (status < 0)
++		goto out_dq;
+ 
+ 	OCFS2_DQUOT(dquot)->dq_use_count++;
+ 	OCFS2_DQUOT(dquot)->dq_origspace = dquot->dq_dqb.dqb_curspace;
+diff --git a/fs/ocfs2/quota_local.c b/fs/ocfs2/quota_local.c
+index 2e4344be3b96..2001862bf2b1 100644
+--- a/fs/ocfs2/quota_local.c
++++ b/fs/ocfs2/quota_local.c
+@@ -1303,10 +1303,6 @@ int ocfs2_local_release_dquot(handle_t *handle, struct dquot *dquot)
+ 	ocfs2_journal_dirty(handle, od->dq_chunk->qc_headerbh);
+ 
+ out:
+-	/* Clear the read bit so that next time someone uses this
+-	 * dquot he reads fresh info from disk and allocates local
+-	 * dquot structure */
+-	clear_bit(DQ_READ_B, &dquot->dq_flags);
+ 	return status;
+ }
+ 
+diff --git a/fs/proc/base.c b/fs/proc/base.c
+index 1485e38daaa3..c35eaa404933 100644
+--- a/fs/proc/base.c
++++ b/fs/proc/base.c
+@@ -1813,6 +1813,7 @@ static int proc_map_files_get_link(struct dentry *dentry, struct path *path)
+ 	if (rc)
+ 		goto out_mmput;
+ 
++	rc = -ENOENT;
+ 	down_read(&mm->mmap_sem);
+ 	vma = find_exact_vma(mm, vm_start, vm_end);
+ 	if (vma && vma->vm_file) {
+diff --git a/include/linux/blktrace_api.h b/include/linux/blktrace_api.h
+index 7c2e030e72f1..a12f6ed91c84 100644
+--- a/include/linux/blktrace_api.h
++++ b/include/linux/blktrace_api.h
+@@ -5,6 +5,7 @@
+ #include <linux/relay.h>
+ #include <linux/compat.h>
+ #include <uapi/linux/blktrace_api.h>
++#include <linux/list.h>
+ 
+ #if defined(CONFIG_BLK_DEV_IO_TRACE)
+ 
+@@ -23,6 +24,7 @@ struct blk_trace {
+ 	struct dentry *dir;
+ 	struct dentry *dropped_file;
+ 	struct dentry *msg_file;
++	struct list_head running_list;
+ 	atomic_t dropped;
+ };
+ 
+diff --git a/include/linux/firewire.h b/include/linux/firewire.h
+index 5d7782e42b8f..c3683bdf28fe 100644
+--- a/include/linux/firewire.h
++++ b/include/linux/firewire.h
+@@ -200,6 +200,7 @@ struct fw_device {
+ 	unsigned irmc:1;
+ 	unsigned bc_implemented:2;
+ 
++	work_func_t workfn;
+ 	struct delayed_work work;
+ 	struct fw_attribute_group attribute_group;
+ };
+diff --git a/include/linux/mm.h b/include/linux/mm.h
+index fed08c0c543b..648bcb007eba 100644
+--- a/include/linux/mm.h
++++ b/include/linux/mm.h
+@@ -161,7 +161,7 @@ extern unsigned int kobjsize(const void *objp);
+  * Special vmas that are non-mergable, non-mlock()able.
+  * Note: mm/huge_memory.c VM_NO_THP depends on this definition.
+  */
+-#define VM_SPECIAL (VM_IO | VM_DONTEXPAND | VM_PFNMAP)
++#define VM_SPECIAL (VM_IO | VM_DONTEXPAND | VM_PFNMAP | VM_MIXEDMAP)
+ 
+ /*
+  * mapping from the currently active vm_flags protection bits (the
+diff --git a/include/linux/tracepoint.h b/include/linux/tracepoint.h
+index ebeab360d851..0ecc46e7af3d 100644
+--- a/include/linux/tracepoint.h
++++ b/include/linux/tracepoint.h
+@@ -60,6 +60,12 @@ struct tp_module {
+ 	unsigned int num_tracepoints;
+ 	struct tracepoint * const *tracepoints_ptrs;
+ };
++bool trace_module_has_bad_taint(struct module *mod);
++#else
++static inline bool trace_module_has_bad_taint(struct module *mod)
++{
++	return false;
++}
+ #endif /* CONFIG_MODULES */
+ 
+ struct tracepoint_iter {
+diff --git a/include/net/tcp.h b/include/net/tcp.h
+index b1aa324c5e65..51dcc6faa561 100644
+--- a/include/net/tcp.h
++++ b/include/net/tcp.h
+@@ -482,6 +482,24 @@ extern int __cookie_v4_check(const struct iphdr *iph, const struct tcphdr *th,
+ extern struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb, 
+ 				    struct ip_options *opt);
+ #ifdef CONFIG_SYN_COOKIES
++#include <linux/ktime.h>
++
++/* Syncookies use a monotonic timer which increments every 64 seconds.
++ * This counter is used both as a hash input and partially encoded into
++ * the cookie value.  A cookie is only validated further if the delta
++ * between the current counter value and the encoded one is less than this,
++ * i.e. a sent cookie is valid only at most for 128 seconds (or less if
++ * the counter advances immediately after a cookie is generated).
++ */
++#define MAX_SYNCOOKIE_AGE 2
++
++static inline u32 tcp_cookie_time(void)
++{
++	struct timespec now;
++	getnstimeofday(&now);
++	return now.tv_sec >> 6; /* 64 seconds granularity */
++}
++
+ extern u32 __cookie_v4_init_sequence(const struct iphdr *iph,
+ 				     const struct tcphdr *th, u16 *mssp);
+ extern __u32 cookie_v4_init_sequence(struct sock *sk, struct sk_buff *skb, 
+@@ -1303,7 +1321,8 @@ struct tcp_fastopen_request {
+ 	/* Fast Open cookie. Size 0 means a cookie request */
+ 	struct tcp_fastopen_cookie	cookie;
+ 	struct msghdr			*data;  /* data in MSG_FASTOPEN */
+-	u16				copied;	/* queued in tcp_connect() */
++	size_t				size;
++	int				copied;	/* queued in tcp_connect() */
+ };
+ void tcp_free_fastopen_req(struct tcp_sock *tp);
+ 
+diff --git a/include/target/iscsi/iscsi_transport.h b/include/target/iscsi/iscsi_transport.h
+index a12589c4ee92..361bd0f04018 100644
+--- a/include/target/iscsi/iscsi_transport.h
++++ b/include/target/iscsi/iscsi_transport.h
+@@ -12,6 +12,7 @@ struct iscsit_transport {
+ 	int (*iscsit_setup_np)(struct iscsi_np *, struct __kernel_sockaddr_storage *);
+ 	int (*iscsit_accept_np)(struct iscsi_np *, struct iscsi_conn *);
+ 	void (*iscsit_free_np)(struct iscsi_np *);
++	void (*iscsit_wait_conn)(struct iscsi_conn *);
+ 	void (*iscsit_free_conn)(struct iscsi_conn *);
+ 	int (*iscsit_get_login_rx)(struct iscsi_conn *, struct iscsi_login *);
+ 	int (*iscsit_put_login_tx)(struct iscsi_conn *, struct iscsi_login *, u32);
+diff --git a/ipc/msg.c b/ipc/msg.c
+index 558aa91186b6..52770bfde2a5 100644
+--- a/ipc/msg.c
++++ b/ipc/msg.c
+@@ -885,6 +885,8 @@ long do_msgrcv(int msqid, void __user *buf, size_t bufsz, long msgtyp, int msgfl
+ 		return -EINVAL;
+ 
+ 	if (msgflg & MSG_COPY) {
++		if ((msgflg & MSG_EXCEPT) || !(msgflg & IPC_NOWAIT))
++			return -EINVAL;
+ 		copy = prepare_copy(buf, min_t(size_t, bufsz, ns->msg_ctlmax));
+ 		if (IS_ERR(copy))
+ 			return PTR_ERR(copy);
+diff --git a/kernel/cpuset.c b/kernel/cpuset.c
+index 4772034b4b17..5ae9f950e024 100644
+--- a/kernel/cpuset.c
++++ b/kernel/cpuset.c
+@@ -974,12 +974,6 @@ static int update_cpumask(struct cpuset *cs, struct cpuset *trialcs,
+  *    Temporarilly set tasks mems_allowed to target nodes of migration,
+  *    so that the migration code can allocate pages on these nodes.
+  *
+- *    Call holding cpuset_mutex, so current's cpuset won't change
+- *    during this call, as manage_mutex holds off any cpuset_attach()
+- *    calls.  Therefore we don't need to take task_lock around the
+- *    call to guarantee_online_mems(), as we know no one is changing
+- *    our task's cpuset.
+- *
+  *    While the mm_struct we are migrating is typically from some
+  *    other task, the task_struct mems_allowed that we are hacking
+  *    is for our current task, which must allocate new pages for that
+@@ -996,8 +990,10 @@ static void cpuset_migrate_mm(struct mm_struct *mm, const nodemask_t *from,
+ 
+ 	do_migrate_pages(mm, from, to, MPOL_MF_MOVE_ALL);
+ 
++	rcu_read_lock();
+ 	mems_cs = effective_nodemask_cpuset(task_cs(tsk));
+ 	guarantee_online_mems(mems_cs, &tsk->mems_allowed);
++	rcu_read_unlock();
+ }
+ 
+ /*
+@@ -2511,9 +2507,9 @@ int __cpuset_node_allowed_softwall(int node, gfp_t gfp_mask)
+ 
+ 	task_lock(current);
+ 	cs = nearest_hardwall_ancestor(task_cs(current));
++	allowed = node_isset(node, cs->mems_allowed);
+ 	task_unlock(current);
+ 
+-	allowed = node_isset(node, cs->mems_allowed);
+ 	mutex_unlock(&callback_mutex);
+ 	return allowed;
+ }
+diff --git a/kernel/futex.c b/kernel/futex.c
+index 221a58fc62f7..231754863a87 100644
+--- a/kernel/futex.c
++++ b/kernel/futex.c
+@@ -251,6 +251,9 @@ get_futex_key(u32 __user *uaddr, int fshared, union futex_key *key, int rw)
+ 		return -EINVAL;
+ 	address -= key->both.offset;
+ 
++	if (unlikely(!access_ok(rw, uaddr, sizeof(u32))))
++		return -EFAULT;
++
+ 	/*
+ 	 * PROCESS_PRIVATE futexes are fast.
+ 	 * As the mm cannot disappear under us and the 'key' only needs
+@@ -259,8 +262,6 @@ get_futex_key(u32 __user *uaddr, int fshared, union futex_key *key, int rw)
+ 	 *        but access_ok() should be faster than find_vma()
+ 	 */
+ 	if (!fshared) {
+-		if (unlikely(!access_ok(VERIFY_WRITE, uaddr, sizeof(u32))))
+-			return -EFAULT;
+ 		key->private.mm = mm;
+ 		key->private.address = address;
+ 		get_futex_key_refs(key);
+diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
+index 3e59f951d42f..4c84746a840b 100644
+--- a/kernel/irq/manage.c
++++ b/kernel/irq/manage.c
+@@ -802,8 +802,7 @@ static irqreturn_t irq_thread_fn(struct irq_desc *desc,
+ 
+ static void wake_threads_waitq(struct irq_desc *desc)
+ {
+-	if (atomic_dec_and_test(&desc->threads_active) &&
+-	    waitqueue_active(&desc->wait_for_threads))
++	if (atomic_dec_and_test(&desc->threads_active))
+ 		wake_up(&desc->wait_for_threads);
+ }
+ 
+diff --git a/kernel/rcutree.h b/kernel/rcutree.h
+index 5f97eab602cd..52be957c9fe2 100644
+--- a/kernel/rcutree.h
++++ b/kernel/rcutree.h
+@@ -104,6 +104,8 @@ struct rcu_dynticks {
+ 				    /* idle-period nonlazy_posted snapshot. */
+ 	unsigned long last_accelerate;
+ 				    /* Last jiffy CBs were accelerated. */
++	unsigned long last_advance_all;
++				    /* Last jiffy CBs were all advanced. */
+ 	int tick_nohz_enabled_snap; /* Previously seen value from sysfs. */
+ #endif /* #ifdef CONFIG_RCU_FAST_NO_HZ */
+ };
+diff --git a/kernel/rcutree_plugin.h b/kernel/rcutree_plugin.h
+index 130c97b027f2..511e6b47c594 100644
+--- a/kernel/rcutree_plugin.h
++++ b/kernel/rcutree_plugin.h
+@@ -1627,20 +1627,26 @@ module_param(rcu_idle_gp_delay, int, 0644);
+ static int rcu_idle_lazy_gp_delay = RCU_IDLE_LAZY_GP_DELAY;
+ module_param(rcu_idle_lazy_gp_delay, int, 0644);
+ 
+-extern int tick_nohz_enabled;
++extern int tick_nohz_active;
+ 
+ /*
+- * Try to advance callbacks for all flavors of RCU on the current CPU.
+- * Afterwards, if there are any callbacks ready for immediate invocation,
+- * return true.
++ * Try to advance callbacks for all flavors of RCU on the current CPU, but
++ * only if it has been awhile since the last time we did so.  Afterwards,
++ * if there are any callbacks ready for immediate invocation, return true.
+  */
+ static bool rcu_try_advance_all_cbs(void)
+ {
+ 	bool cbs_ready = false;
+ 	struct rcu_data *rdp;
++	struct rcu_dynticks *rdtp = this_cpu_ptr(&rcu_dynticks);
+ 	struct rcu_node *rnp;
+ 	struct rcu_state *rsp;
+ 
++	/* Exit early if we advanced recently. */
++	if (jiffies == rdtp->last_advance_all)
++		return 0;
++	rdtp->last_advance_all = jiffies;
++
+ 	for_each_rcu_flavor(rsp) {
+ 		rdp = this_cpu_ptr(rsp->rda);
+ 		rnp = rdp->mynode;
+@@ -1718,7 +1724,7 @@ static void rcu_prepare_for_idle(int cpu)
+ 	int tne;
+ 
+ 	/* Handle nohz enablement switches conservatively. */
+-	tne = ACCESS_ONCE(tick_nohz_enabled);
++	tne = ACCESS_ONCE(tick_nohz_active);
+ 	if (tne != rdtp->tick_nohz_enabled_snap) {
+ 		if (rcu_cpu_has_callbacks(cpu, NULL))
+ 			invoke_rcu_core(); /* force nohz to see update. */
+@@ -1739,6 +1745,8 @@ static void rcu_prepare_for_idle(int cpu)
+ 	 */
+ 	if (rdtp->all_lazy &&
+ 	    rdtp->nonlazy_posted != rdtp->nonlazy_posted_snap) {
++		rdtp->all_lazy = false;
++		rdtp->nonlazy_posted_snap = rdtp->nonlazy_posted;
+ 		invoke_rcu_core();
+ 		return;
+ 	}
+diff --git a/kernel/sched/core.c b/kernel/sched/core.c
+index ceae65e69a64..a494ace683e3 100644
+--- a/kernel/sched/core.c
++++ b/kernel/sched/core.c
+@@ -5119,10 +5119,13 @@ static void destroy_sched_domains(struct sched_domain *sd, int cpu)
+ DEFINE_PER_CPU(struct sched_domain *, sd_llc);
+ DEFINE_PER_CPU(int, sd_llc_size);
+ DEFINE_PER_CPU(int, sd_llc_id);
++DEFINE_PER_CPU(struct sched_domain *, sd_busy);
++DEFINE_PER_CPU(struct sched_domain *, sd_asym);
+ 
+ static void update_top_cache_domain(int cpu)
+ {
+ 	struct sched_domain *sd;
++	struct sched_domain *busy_sd = NULL;
+ 	int id = cpu;
+ 	int size = 1;
+ 
+@@ -5130,11 +5133,16 @@ static void update_top_cache_domain(int cpu)
+ 	if (sd) {
+ 		id = cpumask_first(sched_domain_span(sd));
+ 		size = cpumask_weight(sched_domain_span(sd));
++		busy_sd = sd->parent; /* sd_busy */
+ 	}
++	rcu_assign_pointer(per_cpu(sd_busy, cpu), busy_sd);
+ 
+ 	rcu_assign_pointer(per_cpu(sd_llc, cpu), sd);
+ 	per_cpu(sd_llc_size, cpu) = size;
+ 	per_cpu(sd_llc_id, cpu) = id;
++
++	sd = highest_flag_domain(cpu, SD_ASYM_PACKING);
++	rcu_assign_pointer(per_cpu(sd_asym, cpu), sd);
+ }
+ 
+ /*
+@@ -5325,6 +5333,7 @@ build_overlap_sched_groups(struct sched_domain *sd, int cpu)
+ 		 * die on a /0 trap.
+ 		 */
+ 		sg->sgp->power = SCHED_POWER_SCALE * cpumask_weight(sg_span);
++		sg->sgp->power_orig = sg->sgp->power;
+ 
+ 		/*
+ 		 * Make sure the first group of this domain contains the
+diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
+index 411732334906..790e2fc808da 100644
+--- a/kernel/sched/fair.c
++++ b/kernel/sched/fair.c
+@@ -5598,16 +5598,16 @@ static inline void nohz_balance_exit_idle(int cpu)
+ static inline void set_cpu_sd_state_busy(void)
+ {
+ 	struct sched_domain *sd;
++	int cpu = smp_processor_id();
+ 
+ 	rcu_read_lock();
+-	sd = rcu_dereference_check_sched_domain(this_rq()->sd);
++	sd = rcu_dereference(per_cpu(sd_busy, cpu));
+ 
+ 	if (!sd || !sd->nohz_idle)
+ 		goto unlock;
+ 	sd->nohz_idle = 0;
+ 
+-	for (; sd; sd = sd->parent)
+-		atomic_inc(&sd->groups->sgp->nr_busy_cpus);
++	atomic_inc(&sd->groups->sgp->nr_busy_cpus);
+ unlock:
+ 	rcu_read_unlock();
+ }
+@@ -5615,16 +5615,16 @@ unlock:
+ void set_cpu_sd_state_idle(void)
+ {
+ 	struct sched_domain *sd;
++	int cpu = smp_processor_id();
+ 
+ 	rcu_read_lock();
+-	sd = rcu_dereference_check_sched_domain(this_rq()->sd);
++	sd = rcu_dereference(per_cpu(sd_busy, cpu));
+ 
+ 	if (!sd || sd->nohz_idle)
+ 		goto unlock;
+ 	sd->nohz_idle = 1;
+ 
+-	for (; sd; sd = sd->parent)
+-		atomic_dec(&sd->groups->sgp->nr_busy_cpus);
++	atomic_dec(&sd->groups->sgp->nr_busy_cpus);
+ unlock:
+ 	rcu_read_unlock();
+ }
+@@ -5807,6 +5807,8 @@ static inline int nohz_kick_needed(struct rq *rq, int cpu)
+ {
+ 	unsigned long now = jiffies;
+ 	struct sched_domain *sd;
++	struct sched_group_power *sgp;
++	int nr_busy;
+ 
+ 	if (unlikely(idle_cpu(cpu)))
+ 		return 0;
+@@ -5832,22 +5834,22 @@ static inline int nohz_kick_needed(struct rq *rq, int cpu)
+ 		goto need_kick;
+ 
+ 	rcu_read_lock();
+-	for_each_domain(cpu, sd) {
+-		struct sched_group *sg = sd->groups;
+-		struct sched_group_power *sgp = sg->sgp;
+-		int nr_busy = atomic_read(&sgp->nr_busy_cpus);
++	sd = rcu_dereference(per_cpu(sd_busy, cpu));
+ 
+-		if (sd->flags & SD_SHARE_PKG_RESOURCES && nr_busy > 1)
+-			goto need_kick_unlock;
++	if (sd) {
++		sgp = sd->groups->sgp;
++		nr_busy = atomic_read(&sgp->nr_busy_cpus);
+ 
+-		if (sd->flags & SD_ASYM_PACKING && nr_busy != sg->group_weight
+-		    && (cpumask_first_and(nohz.idle_cpus_mask,
+-					  sched_domain_span(sd)) < cpu))
++		if (nr_busy > 1)
+ 			goto need_kick_unlock;
+-
+-		if (!(sd->flags & (SD_SHARE_PKG_RESOURCES | SD_ASYM_PACKING)))
+-			break;
+ 	}
++
++	sd = rcu_dereference(per_cpu(sd_asym, cpu));
++
++	if (sd && (cpumask_first_and(nohz.idle_cpus_mask,
++				  sched_domain_span(sd)) < cpu))
++		goto need_kick_unlock;
++
+ 	rcu_read_unlock();
+ 	return 0;
+ 
+@@ -6013,15 +6015,15 @@ static void switched_from_fair(struct rq *rq, struct task_struct *p)
+ 	struct cfs_rq *cfs_rq = cfs_rq_of(se);
+ 
+ 	/*
+-	 * Ensure the task's vruntime is normalized, so that when its
++	 * Ensure the task's vruntime is normalized, so that when it's
+ 	 * switched back to the fair class the enqueue_entity(.flags=0) will
+ 	 * do the right thing.
+ 	 *
+-	 * If it was on_rq, then the dequeue_entity(.flags=0) will already
+-	 * have normalized the vruntime, if it was !on_rq, then only when
++	 * If it's on_rq, then the dequeue_entity(.flags=0) will already
++	 * have normalized the vruntime, if it's !on_rq, then only when
+ 	 * the task is sleeping will it still have non-normalized vruntime.
+ 	 */
+-	if (!se->on_rq && p->state != TASK_RUNNING) {
++	if (!p->on_rq && p->state != TASK_RUNNING) {
+ 		/*
+ 		 * Fix up our vruntime so that the current sleep doesn't
+ 		 * cause 'unlimited' sleep bonus.
+diff --git a/kernel/sched/rt.c b/kernel/sched/rt.c
+index 417b1b3fd7e9..ff04e1a06412 100644
+--- a/kernel/sched/rt.c
++++ b/kernel/sched/rt.c
+@@ -246,8 +246,10 @@ static inline void rt_set_overload(struct rq *rq)
+ 	 * if we should look at the mask. It would be a shame
+ 	 * if we looked at the mask, but the mask was not
+ 	 * updated yet.
++	 *
++	 * Matched by the barrier in pull_rt_task().
+ 	 */
+-	wmb();
++	smp_wmb();
+ 	atomic_inc(&rq->rd->rto_count);
+ }
+ 
+@@ -1227,8 +1229,7 @@ select_task_rq_rt(struct task_struct *p, int sd_flag, int flags)
+ 	 */
+ 	if (curr && unlikely(rt_task(curr)) &&
+ 	    (curr->nr_cpus_allowed < 2 ||
+-	     curr->prio <= p->prio) &&
+-	    (p->nr_cpus_allowed > 1)) {
++	     curr->prio <= p->prio)) {
+ 		int target = find_lowest_rq(p);
+ 
+ 		if (target != -1)
+@@ -1644,6 +1645,12 @@ static int pull_rt_task(struct rq *this_rq)
+ 	if (likely(!rt_overloaded(this_rq)))
+ 		return 0;
+ 
++	/*
++	 * Match the barrier from rt_set_overloaded; this guarantees that if we
++	 * see overloaded we must also see the rto_mask bit.
++	 */
++	smp_rmb();
++
+ 	for_each_cpu(cpu, this_rq->rd->rto_mask) {
+ 		if (this_cpu == cpu)
+ 			continue;
+diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h
+index a6208afd80e7..4f310592b1ba 100644
+--- a/kernel/sched/sched.h
++++ b/kernel/sched/sched.h
+@@ -596,6 +596,8 @@ static inline struct sched_domain *highest_flag_domain(int cpu, int flag)
+ DECLARE_PER_CPU(struct sched_domain *, sd_llc);
+ DECLARE_PER_CPU(int, sd_llc_size);
+ DECLARE_PER_CPU(int, sd_llc_id);
++DECLARE_PER_CPU(struct sched_domain *, sd_busy);
++DECLARE_PER_CPU(struct sched_domain *, sd_asym);
+ 
+ struct sched_group_power {
+ 	atomic_t ref;
+diff --git a/kernel/time/tick-sched.c b/kernel/time/tick-sched.c
+index 3612fc77f834..ea20f7d1ac2c 100644
+--- a/kernel/time/tick-sched.c
++++ b/kernel/time/tick-sched.c
+@@ -361,8 +361,8 @@ void __init tick_nohz_init(void)
+ /*
+  * NO HZ enabled ?
+  */
+-int tick_nohz_enabled __read_mostly  = 1;
+-
++static int tick_nohz_enabled __read_mostly  = 1;
++int tick_nohz_active  __read_mostly;
+ /*
+  * Enable / Disable tickless mode
+  */
+@@ -465,7 +465,7 @@ u64 get_cpu_idle_time_us(int cpu, u64 *last_update_time)
+ 	struct tick_sched *ts = &per_cpu(tick_cpu_sched, cpu);
+ 	ktime_t now, idle;
+ 
+-	if (!tick_nohz_enabled)
++	if (!tick_nohz_active)
+ 		return -1;
+ 
+ 	now = ktime_get();
+@@ -506,7 +506,7 @@ u64 get_cpu_iowait_time_us(int cpu, u64 *last_update_time)
+ 	struct tick_sched *ts = &per_cpu(tick_cpu_sched, cpu);
+ 	ktime_t now, iowait;
+ 
+-	if (!tick_nohz_enabled)
++	if (!tick_nohz_active)
+ 		return -1;
+ 
+ 	now = ktime_get();
+@@ -711,8 +711,10 @@ static bool can_stop_idle_tick(int cpu, struct tick_sched *ts)
+ 		return false;
+ 	}
+ 
+-	if (unlikely(ts->nohz_mode == NOHZ_MODE_INACTIVE))
++	if (unlikely(ts->nohz_mode == NOHZ_MODE_INACTIVE)) {
++		ts->sleep_length = (ktime_t) { .tv64 = NSEC_PER_SEC/HZ };
+ 		return false;
++	}
+ 
+ 	if (need_resched())
+ 		return false;
+@@ -799,11 +801,6 @@ void tick_nohz_idle_enter(void)
+ 	local_irq_disable();
+ 
+ 	ts = &__get_cpu_var(tick_cpu_sched);
+-	/*
+-	 * set ts->inidle unconditionally. even if the system did not
+-	 * switch to nohz mode the cpu frequency governers rely on the
+-	 * update of the idle time accounting in tick_nohz_start_idle().
+-	 */
+ 	ts->inidle = 1;
+ 	__tick_nohz_idle_enter(ts);
+ 
+@@ -973,7 +970,7 @@ static void tick_nohz_switch_to_nohz(void)
+ 	struct tick_sched *ts = &__get_cpu_var(tick_cpu_sched);
+ 	ktime_t next;
+ 
+-	if (!tick_nohz_enabled)
++	if (!tick_nohz_active)
+ 		return;
+ 
+ 	local_irq_disable();
+@@ -981,7 +978,7 @@ static void tick_nohz_switch_to_nohz(void)
+ 		local_irq_enable();
+ 		return;
+ 	}
+-
++	tick_nohz_active = 1;
+ 	ts->nohz_mode = NOHZ_MODE_LOWRES;
+ 
+ 	/*
+@@ -1139,8 +1136,10 @@ void tick_setup_sched_timer(void)
+ 	}
+ 
+ #ifdef CONFIG_NO_HZ_COMMON
+-	if (tick_nohz_enabled)
++	if (tick_nohz_enabled) {
+ 		ts->nohz_mode = NOHZ_MODE_HIGHRES;
++		tick_nohz_active = 1;
++	}
+ #endif
+ }
+ #endif /* HIGH_RES_TIMERS */
+diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c
+index b8b8560bfb95..7f727b34280d 100644
+--- a/kernel/trace/blktrace.c
++++ b/kernel/trace/blktrace.c
+@@ -26,6 +26,7 @@
+ #include <linux/export.h>
+ #include <linux/time.h>
+ #include <linux/uaccess.h>
++#include <linux/list.h>
+ 
+ #include <trace/events/block.h>
+ 
+@@ -38,6 +39,9 @@ static unsigned int blktrace_seq __read_mostly = 1;
+ static struct trace_array *blk_tr;
+ static bool blk_tracer_enabled __read_mostly;
+ 
++static LIST_HEAD(running_trace_list);
++static __cacheline_aligned_in_smp DEFINE_SPINLOCK(running_trace_lock);
++
+ /* Select an alternative, minimalistic output than the original one */
+ #define TRACE_BLK_OPT_CLASSIC	0x1
+ 
+@@ -107,10 +111,18 @@ record_it:
+  * Send out a notify for this process, if we haven't done so since a trace
+  * started
+  */
+-static void trace_note_tsk(struct blk_trace *bt, struct task_struct *tsk)
++static void trace_note_tsk(struct task_struct *tsk)
+ {
++	unsigned long flags;
++	struct blk_trace *bt;
++
+ 	tsk->btrace_seq = blktrace_seq;
+-	trace_note(bt, tsk->pid, BLK_TN_PROCESS, tsk->comm, sizeof(tsk->comm));
++	spin_lock_irqsave(&running_trace_lock, flags);
++	list_for_each_entry(bt, &running_trace_list, running_list) {
++		trace_note(bt, tsk->pid, BLK_TN_PROCESS, tsk->comm,
++			   sizeof(tsk->comm));
++	}
++	spin_unlock_irqrestore(&running_trace_lock, flags);
+ }
+ 
+ static void trace_note_time(struct blk_trace *bt)
+@@ -229,16 +241,15 @@ static void __blk_add_trace(struct blk_trace *bt, sector_t sector, int bytes,
+ 		goto record_it;
+ 	}
+ 
++	if (unlikely(tsk->btrace_seq != blktrace_seq))
++		trace_note_tsk(tsk);
++
+ 	/*
+ 	 * A word about the locking here - we disable interrupts to reserve
+ 	 * some space in the relay per-cpu buffer, to prevent an irq
+ 	 * from coming in and stepping on our toes.
+ 	 */
+ 	local_irq_save(flags);
+-
+-	if (unlikely(tsk->btrace_seq != blktrace_seq))
+-		trace_note_tsk(bt, tsk);
+-
+ 	t = relay_reserve(bt->rchan, sizeof(*t) + pdu_len);
+ 	if (t) {
+ 		sequence = per_cpu_ptr(bt->sequence, cpu);
+@@ -477,6 +488,7 @@ int do_blk_trace_setup(struct request_queue *q, char *name, dev_t dev,
+ 	bt->dir = dir;
+ 	bt->dev = dev;
+ 	atomic_set(&bt->dropped, 0);
++	INIT_LIST_HEAD(&bt->running_list);
+ 
+ 	ret = -EIO;
+ 	bt->dropped_file = debugfs_create_file("dropped", 0444, dir, bt,
+@@ -601,6 +613,9 @@ int blk_trace_startstop(struct request_queue *q, int start)
+ 			blktrace_seq++;
+ 			smp_mb();
+ 			bt->trace_state = Blktrace_running;
++			spin_lock_irq(&running_trace_lock);
++			list_add(&bt->running_list, &running_trace_list);
++			spin_unlock_irq(&running_trace_lock);
+ 
+ 			trace_note_time(bt);
+ 			ret = 0;
+@@ -608,6 +623,9 @@ int blk_trace_startstop(struct request_queue *q, int start)
+ 	} else {
+ 		if (bt->trace_state == Blktrace_running) {
+ 			bt->trace_state = Blktrace_stopped;
++			spin_lock_irq(&running_trace_lock);
++			list_del_init(&bt->running_list);
++			spin_unlock_irq(&running_trace_lock);
+ 			relay_flush(bt->rchan);
+ 			ret = 0;
+ 		}
+@@ -1472,6 +1490,9 @@ static int blk_trace_remove_queue(struct request_queue *q)
+ 	if (atomic_dec_and_test(&blk_probes_ref))
+ 		blk_unregister_tracepoints();
+ 
++	spin_lock_irq(&running_trace_lock);
++	list_del(&bt->running_list);
++	spin_unlock_irq(&running_trace_lock);
+ 	blk_trace_free(bt);
+ 	return 0;
+ }
+diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c
+index 368a4d50cc30..b03b1f897b5e 100644
+--- a/kernel/trace/trace_events.c
++++ b/kernel/trace/trace_events.c
+@@ -1763,6 +1763,16 @@ static void trace_module_add_events(struct module *mod)
+ {
+ 	struct ftrace_event_call **call, **start, **end;
+ 
++	if (!mod->num_trace_events)
++		return;
++
++	/* Don't add infrastructure for mods without tracepoints */
++	if (trace_module_has_bad_taint(mod)) {
++		pr_err("%s: module has bad taint, not creating trace events\n",
++		       mod->name);
++		return;
++	}
++
+ 	start = mod->trace_events;
+ 	end = mod->trace_events + mod->num_trace_events;
+ 
+diff --git a/kernel/tracepoint.c b/kernel/tracepoint.c
+index 29f26540e9c9..031cc5655a51 100644
+--- a/kernel/tracepoint.c
++++ b/kernel/tracepoint.c
+@@ -631,6 +631,11 @@ void tracepoint_iter_reset(struct tracepoint_iter *iter)
+ EXPORT_SYMBOL_GPL(tracepoint_iter_reset);
+ 
+ #ifdef CONFIG_MODULES
++bool trace_module_has_bad_taint(struct module *mod)
++{
++	return mod->taints & ~((1 << TAINT_OOT_MODULE) | (1 << TAINT_CRAP));
++}
++
+ static int tracepoint_module_coming(struct module *mod)
+ {
+ 	struct tp_module *tp_mod, *iter;
+@@ -641,7 +646,7 @@ static int tracepoint_module_coming(struct module *mod)
+ 	 * module headers (for forced load), to make sure we don't cause a crash.
+ 	 * Staging and out-of-tree GPL modules are fine.
+ 	 */
+-	if (mod->taints & ~((1 << TAINT_OOT_MODULE) | (1 << TAINT_CRAP)))
++	if (trace_module_has_bad_taint(mod))
+ 		return 0;
+ 	mutex_lock(&tracepoints_mutex);
+ 	tp_mod = kmalloc(sizeof(struct tp_module), GFP_KERNEL);
+diff --git a/lib/show_mem.c b/lib/show_mem.c
+index b7c72311ad0c..5847a4921b8e 100644
+--- a/lib/show_mem.c
++++ b/lib/show_mem.c
+@@ -12,8 +12,7 @@
+ void show_mem(unsigned int filter)
+ {
+ 	pg_data_t *pgdat;
+-	unsigned long total = 0, reserved = 0, shared = 0,
+-		nonshared = 0, highmem = 0;
++	unsigned long total = 0, reserved = 0, highmem = 0;
+ 
+ 	printk("Mem-Info:\n");
+ 	show_free_areas(filter);
+@@ -22,43 +21,27 @@ void show_mem(unsigned int filter)
+ 		return;
+ 
+ 	for_each_online_pgdat(pgdat) {
+-		unsigned long i, flags;
++		unsigned long flags;
++		int zoneid;
+ 
+ 		pgdat_resize_lock(pgdat, &flags);
+-		for (i = 0; i < pgdat->node_spanned_pages; i++) {
+-			struct page *page;
+-			unsigned long pfn = pgdat->node_start_pfn + i;
+-
+-			if (unlikely(!(i % MAX_ORDER_NR_PAGES)))
+-				touch_nmi_watchdog();
+-
+-			if (!pfn_valid(pfn))
++		for (zoneid = 0; zoneid < MAX_NR_ZONES; zoneid++) {
++			struct zone *zone = &pgdat->node_zones[zoneid];
++			if (!populated_zone(zone))
+ 				continue;
+ 
+-			page = pfn_to_page(pfn);
+-
+-			if (PageHighMem(page))
+-				highmem++;
++			total += zone->present_pages;
++			reserved = zone->present_pages - zone->managed_pages;
+ 
+-			if (PageReserved(page))
+-				reserved++;
+-			else if (page_count(page) == 1)
+-				nonshared++;
+-			else if (page_count(page) > 1)
+-				shared += page_count(page) - 1;
+-
+-			total++;
++			if (is_highmem_idx(zoneid))
++				highmem += zone->present_pages;
+ 		}
+ 		pgdat_resize_unlock(pgdat, &flags);
+ 	}
+ 
+ 	printk("%lu pages RAM\n", total);
+-#ifdef CONFIG_HIGHMEM
+-	printk("%lu pages HighMem\n", highmem);
+-#endif
++	printk("%lu pages HighMem/MovableOnly\n", highmem);
+ 	printk("%lu pages reserved\n", reserved);
+-	printk("%lu pages shared\n", shared);
+-	printk("%lu pages non-shared\n", nonshared);
+ #ifdef CONFIG_QUICKLIST
+ 	printk("%lu pages in pagetable cache\n",
+ 		quicklist_total_size());
+diff --git a/mm/compaction.c b/mm/compaction.c
+index 74ad00908c79..d2c6751879dc 100644
+--- a/mm/compaction.c
++++ b/mm/compaction.c
+@@ -252,7 +252,6 @@ static unsigned long isolate_freepages_block(struct compact_control *cc,
+ {
+ 	int nr_scanned = 0, total_isolated = 0;
+ 	struct page *cursor, *valid_page = NULL;
+-	unsigned long nr_strict_required = end_pfn - blockpfn;
+ 	unsigned long flags;
+ 	bool locked = false;
+ 
+@@ -265,11 +264,12 @@ static unsigned long isolate_freepages_block(struct compact_control *cc,
+ 
+ 		nr_scanned++;
+ 		if (!pfn_valid_within(blockpfn))
+-			continue;
++			goto isolate_fail;
++
+ 		if (!valid_page)
+ 			valid_page = page;
+ 		if (!PageBuddy(page))
+-			continue;
++			goto isolate_fail;
+ 
+ 		/*
+ 		 * The zone lock must be held to isolate freepages.
+@@ -290,12 +290,10 @@ static unsigned long isolate_freepages_block(struct compact_control *cc,
+ 
+ 		/* Recheck this is a buddy page under lock */
+ 		if (!PageBuddy(page))
+-			continue;
++			goto isolate_fail;
+ 
+ 		/* Found a free page, break it into order-0 pages */
+ 		isolated = split_free_page(page);
+-		if (!isolated && strict)
+-			break;
+ 		total_isolated += isolated;
+ 		for (i = 0; i < isolated; i++) {
+ 			list_add(&page->lru, freelist);
+@@ -306,7 +304,15 @@ static unsigned long isolate_freepages_block(struct compact_control *cc,
+ 		if (isolated) {
+ 			blockpfn += isolated - 1;
+ 			cursor += isolated - 1;
++			continue;
+ 		}
++
++isolate_fail:
++		if (strict)
++			break;
++		else
++			continue;
++
+ 	}
+ 
+ 	trace_mm_compaction_isolate_freepages(nr_scanned, total_isolated);
+@@ -316,7 +322,7 @@ static unsigned long isolate_freepages_block(struct compact_control *cc,
+ 	 * pages requested were isolated. If there were any failures, 0 is
+ 	 * returned and CMA will fail.
+ 	 */
+-	if (strict && nr_strict_required > total_isolated)
++	if (strict && blockpfn < end_pfn)
+ 		total_isolated = 0;
+ 
+ 	if (locked)
+diff --git a/mm/huge_memory.c b/mm/huge_memory.c
+index dd7789ce7572..389973fd6bb7 100644
+--- a/mm/huge_memory.c
++++ b/mm/huge_memory.c
+@@ -1897,7 +1897,7 @@ out:
+ 	return ret;
+ }
+ 
+-#define VM_NO_THP (VM_SPECIAL|VM_MIXEDMAP|VM_HUGETLB|VM_SHARED|VM_MAYSHARE)
++#define VM_NO_THP (VM_SPECIAL | VM_HUGETLB | VM_SHARED | VM_MAYSHARE)
+ 
+ int hugepage_madvise(struct vm_area_struct *vma,
+ 		     unsigned long *vm_flags, int advice)
+diff --git a/mm/memcontrol.c b/mm/memcontrol.c
+index 8e7adcba8176..15429b92ff98 100644
+--- a/mm/memcontrol.c
++++ b/mm/memcontrol.c
+@@ -1089,8 +1089,8 @@ skip_node:
+ 	 * skipping css reference should be safe.
+ 	 */
+ 	if (next_css) {
+-		if ((next_css->flags & CSS_ONLINE) &&
+-				(next_css == &root->css || css_tryget(next_css)))
++		if ((next_css == &root->css) ||
++		    ((next_css->flags & CSS_ONLINE) && css_tryget(next_css)))
+ 			return mem_cgroup_from_css(next_css);
+ 
+ 		prev_css = next_css;
+@@ -6346,11 +6346,24 @@ static void mem_cgroup_invalidate_reclaim_iterators(struct mem_cgroup *memcg)
+ static void mem_cgroup_css_offline(struct cgroup_subsys_state *css)
+ {
+ 	struct mem_cgroup *memcg = mem_cgroup_from_css(css);
++	struct cgroup_subsys_state *iter;
+ 
+ 	kmem_cgroup_css_offline(memcg);
+ 
+ 	mem_cgroup_invalidate_reclaim_iterators(memcg);
+-	mem_cgroup_reparent_charges(memcg);
++
++	/*
++	 * This requires that offlining is serialized.  Right now that is
++	 * guaranteed because css_killed_work_fn() holds the cgroup_mutex.
++	 */
++	rcu_read_lock();
++	css_for_each_descendant_post(iter, css) {
++		rcu_read_unlock();
++		mem_cgroup_reparent_charges(mem_cgroup_from_css(iter));
++		rcu_read_lock();
++	}
++	rcu_read_unlock();
++
+ 	mem_cgroup_destroy_all_caches(memcg);
+ 	vmpressure_cleanup(&memcg->vmpressure);
+ }
+diff --git a/mm/page_alloc.c b/mm/page_alloc.c
+index 317ea747d2cd..06f847933eeb 100644
+--- a/mm/page_alloc.c
++++ b/mm/page_alloc.c
+@@ -1217,6 +1217,15 @@ void drain_zone_pages(struct zone *zone, struct per_cpu_pages *pcp)
+ 	}
+ 	local_irq_restore(flags);
+ }
++static bool gfp_thisnode_allocation(gfp_t gfp_mask)
++{
++	return (gfp_mask & GFP_THISNODE) == GFP_THISNODE;
++}
++#else
++static bool gfp_thisnode_allocation(gfp_t gfp_mask)
++{
++	return false;
++}
+ #endif
+ 
+ /*
+@@ -1553,7 +1562,13 @@ again:
+ 					  get_pageblock_migratetype(page));
+ 	}
+ 
+-	__mod_zone_page_state(zone, NR_ALLOC_BATCH, -(1 << order));
++	/*
++	 * NOTE: GFP_THISNODE allocations do not partake in the kswapd
++	 * aging protocol, so they can't be fair.
++	 */
++	if (!gfp_thisnode_allocation(gfp_flags))
++		__mod_zone_page_state(zone, NR_ALLOC_BATCH, -(1 << order));
++
+ 	__count_zone_vm_events(PGALLOC, zone, 1 << order);
+ 	zone_statistics(preferred_zone, zone, gfp_flags);
+ 	local_irq_restore(flags);
+@@ -1925,8 +1940,12 @@ zonelist_scan:
+ 		 * ultimately fall back to remote zones that do not
+ 		 * partake in the fairness round-robin cycle of this
+ 		 * zonelist.
++		 *
++		 * NOTE: GFP_THISNODE allocations do not partake in
++		 * the kswapd aging protocol, so they can't be fair.
+ 		 */
+-		if (alloc_flags & ALLOC_WMARK_LOW) {
++		if ((alloc_flags & ALLOC_WMARK_LOW) &&
++		    !gfp_thisnode_allocation(gfp_mask)) {
+ 			if (zone_page_state(zone, NR_ALLOC_BATCH) <= 0)
+ 				continue;
+ 			if (!zone_local(preferred_zone, zone))
+@@ -2492,8 +2511,7 @@ __alloc_pages_slowpath(gfp_t gfp_mask, unsigned int order,
+ 	 * allowed per node queues are empty and that nodes are
+ 	 * over allocated.
+ 	 */
+-	if (IS_ENABLED(CONFIG_NUMA) &&
+-			(gfp_mask & GFP_THISNODE) == GFP_THISNODE)
++	if (gfp_thisnode_allocation(gfp_mask))
+ 		goto nopage;
+ 
+ restart:
+diff --git a/net/core/neighbour.c b/net/core/neighbour.c
+index 11af243bf92f..467e3e071832 100644
+--- a/net/core/neighbour.c
++++ b/net/core/neighbour.c
+@@ -764,9 +764,6 @@ static void neigh_periodic_work(struct work_struct *work)
+ 	nht = rcu_dereference_protected(tbl->nht,
+ 					lockdep_is_held(&tbl->lock));
+ 
+-	if (atomic_read(&tbl->entries) < tbl->gc_thresh1)
+-		goto out;
+-
+ 	/*
+ 	 *	periodically recompute ReachableTime from random function
+ 	 */
+@@ -779,6 +776,9 @@ static void neigh_periodic_work(struct work_struct *work)
+ 				neigh_rand_reach_time(p->base_reachable_time);
+ 	}
+ 
++	if (atomic_read(&tbl->entries) < tbl->gc_thresh1)
++		goto out;
++
+ 	for (i = 0 ; i < (1 << nht->hash_shift); i++) {
+ 		np = &nht->hash_buckets[i];
+ 
+diff --git a/net/ipv4/ip_tunnel_core.c b/net/ipv4/ip_tunnel_core.c
+index c31e3ad98ef2..ba22cc3a5a53 100644
+--- a/net/ipv4/ip_tunnel_core.c
++++ b/net/ipv4/ip_tunnel_core.c
+@@ -109,7 +109,6 @@ int iptunnel_pull_header(struct sk_buff *skb, int hdr_len, __be16 inner_proto)
+ 	secpath_reset(skb);
+ 	if (!skb->l4_rxhash)
+ 		skb->rxhash = 0;
+-	skb_dst_drop(skb);
+ 	skb->vlan_tci = 0;
+ 	skb_set_queue_mapping(skb, 0);
+ 	skb->pkt_type = PACKET_HOST;
+diff --git a/net/ipv4/syncookies.c b/net/ipv4/syncookies.c
+index 14a15c49129d..15e024105f91 100644
+--- a/net/ipv4/syncookies.c
++++ b/net/ipv4/syncookies.c
+@@ -89,8 +89,7 @@ __u32 cookie_init_timestamp(struct request_sock *req)
+ 
+ 
+ static __u32 secure_tcp_syn_cookie(__be32 saddr, __be32 daddr, __be16 sport,
+-				   __be16 dport, __u32 sseq, __u32 count,
+-				   __u32 data)
++				   __be16 dport, __u32 sseq, __u32 data)
+ {
+ 	/*
+ 	 * Compute the secure sequence number.
+@@ -102,7 +101,7 @@ static __u32 secure_tcp_syn_cookie(__be32 saddr, __be32 daddr, __be16 sport,
+ 	 * As an extra hack, we add a small "data" value that encodes the
+ 	 * MSS into the second hash value.
+ 	 */
+-
++	u32 count = tcp_cookie_time();
+ 	return (cookie_hash(saddr, daddr, sport, dport, 0, 0) +
+ 		sseq + (count << COOKIEBITS) +
+ 		((cookie_hash(saddr, daddr, sport, dport, count, 1) + data)
+@@ -114,22 +113,21 @@ static __u32 secure_tcp_syn_cookie(__be32 saddr, __be32 daddr, __be16 sport,
+  * If the syncookie is bad, the data returned will be out of
+  * range.  This must be checked by the caller.
+  *
+- * The count value used to generate the cookie must be within
+- * "maxdiff" if the current (passed-in) "count".  The return value
+- * is (__u32)-1 if this test fails.
++ * The count value used to generate the cookie must be less than
++ * MAX_SYNCOOKIE_AGE minutes in the past.
++ * The return value (__u32)-1 if this test fails.
+  */
+ static __u32 check_tcp_syn_cookie(__u32 cookie, __be32 saddr, __be32 daddr,
+-				  __be16 sport, __be16 dport, __u32 sseq,
+-				  __u32 count, __u32 maxdiff)
++				  __be16 sport, __be16 dport, __u32 sseq)
+ {
+-	__u32 diff;
++	u32 diff, count = tcp_cookie_time();
+ 
+ 	/* Strip away the layers from the cookie */
+ 	cookie -= cookie_hash(saddr, daddr, sport, dport, 0, 0) + sseq;
+ 
+ 	/* Cookie is now reduced to (count * 2^24) ^ (hash % 2^24) */
+ 	diff = (count - (cookie >> COOKIEBITS)) & ((__u32) - 1 >> COOKIEBITS);
+-	if (diff >= maxdiff)
++	if (diff >= MAX_SYNCOOKIE_AGE)
+ 		return (__u32)-1;
+ 
+ 	return (cookie -
+@@ -138,22 +136,22 @@ static __u32 check_tcp_syn_cookie(__u32 cookie, __be32 saddr, __be32 daddr,
+ }
+ 
+ /*
+- * MSS Values are taken from the 2009 paper
+- * 'Measuring TCP Maximum Segment Size' by S. Alcock and R. Nelson:
+- *  - values 1440 to 1460 accounted for 80% of observed mss values
+- *  - values outside the 536-1460 range are rare (<0.2%).
++ * MSS Values are chosen based on the 2011 paper
++ * 'An Analysis of TCP Maximum Segement Sizes' by S. Alcock and R. Nelson.
++ * Values ..
++ *  .. lower than 536 are rare (< 0.2%)
++ *  .. between 537 and 1299 account for less than < 1.5% of observed values
++ *  .. in the 1300-1349 range account for about 15 to 20% of observed mss values
++ *  .. exceeding 1460 are very rare (< 0.04%)
+  *
+- * Table must be sorted.
++ *  1460 is the single most frequently announced mss value (30 to 46% depending
++ *  on monitor location).  Table must be sorted.
+  */
+ static __u16 const msstab[] = {
+-	64,
+-	512,
+ 	536,
+-	1024,
+-	1440,
++	1300,
++	1440,	/* 1440, 1452: PPPoE */
+ 	1460,
+-	4312,
+-	8960,
+ };
+ 
+ /*
+@@ -173,7 +171,7 @@ u32 __cookie_v4_init_sequence(const struct iphdr *iph, const struct tcphdr *th,
+ 
+ 	return secure_tcp_syn_cookie(iph->saddr, iph->daddr,
+ 				     th->source, th->dest, ntohl(th->seq),
+-				     jiffies / (HZ * 60), mssind);
++				     mssind);
+ }
+ EXPORT_SYMBOL_GPL(__cookie_v4_init_sequence);
+ 
+@@ -189,13 +187,6 @@ __u32 cookie_v4_init_sequence(struct sock *sk, struct sk_buff *skb, __u16 *mssp)
+ }
+ 
+ /*
+- * This (misnamed) value is the age of syncookie which is permitted.
+- * Its ideal value should be dependent on TCP_TIMEOUT_INIT and
+- * sysctl_tcp_retries1. It's a rather complicated formula (exponential
+- * backoff) to compute at runtime so it's currently hardcoded here.
+- */
+-#define COUNTER_TRIES 4
+-/*
+  * Check if a ack sequence number is a valid syncookie.
+  * Return the decoded mss if it is, or 0 if not.
+  */
+@@ -204,9 +195,7 @@ int __cookie_v4_check(const struct iphdr *iph, const struct tcphdr *th,
+ {
+ 	__u32 seq = ntohl(th->seq) - 1;
+ 	__u32 mssind = check_tcp_syn_cookie(cookie, iph->saddr, iph->daddr,
+-					    th->source, th->dest, seq,
+-					    jiffies / (HZ * 60),
+-					    COUNTER_TRIES);
++					    th->source, th->dest, seq);
+ 
+ 	return mssind < ARRAY_SIZE(msstab) ? msstab[mssind] : 0;
+ }
+diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
+index be5246e1d5b6..531ab5721d79 100644
+--- a/net/ipv4/tcp.c
++++ b/net/ipv4/tcp.c
+@@ -1000,7 +1000,8 @@ void tcp_free_fastopen_req(struct tcp_sock *tp)
+ 	}
+ }
+ 
+-static int tcp_sendmsg_fastopen(struct sock *sk, struct msghdr *msg, int *size)
++static int tcp_sendmsg_fastopen(struct sock *sk, struct msghdr *msg,
++				int *copied, size_t size)
+ {
+ 	struct tcp_sock *tp = tcp_sk(sk);
+ 	int err, flags;
+@@ -1015,11 +1016,12 @@ static int tcp_sendmsg_fastopen(struct sock *sk, struct msghdr *msg, int *size)
+ 	if (unlikely(tp->fastopen_req == NULL))
+ 		return -ENOBUFS;
+ 	tp->fastopen_req->data = msg;
++	tp->fastopen_req->size = size;
+ 
+ 	flags = (msg->msg_flags & MSG_DONTWAIT) ? O_NONBLOCK : 0;
+ 	err = __inet_stream_connect(sk->sk_socket, msg->msg_name,
+ 				    msg->msg_namelen, flags);
+-	*size = tp->fastopen_req->copied;
++	*copied = tp->fastopen_req->copied;
+ 	tcp_free_fastopen_req(tp);
+ 	return err;
+ }
+@@ -1039,7 +1041,7 @@ int tcp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
+ 
+ 	flags = msg->msg_flags;
+ 	if (flags & MSG_FASTOPEN) {
+-		err = tcp_sendmsg_fastopen(sk, msg, &copied_syn);
++		err = tcp_sendmsg_fastopen(sk, msg, &copied_syn, size);
+ 		if (err == -EINPROGRESS && copied_syn > 0)
+ 			goto out;
+ 		else if (err)
+diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
+index fb8227a8c004..e088932bcfae 100644
+--- a/net/ipv4/tcp_output.c
++++ b/net/ipv4/tcp_output.c
+@@ -2902,7 +2902,12 @@ static int tcp_send_syn_data(struct sock *sk, struct sk_buff *syn)
+ 	space = __tcp_mtu_to_mss(sk, inet_csk(sk)->icsk_pmtu_cookie) -
+ 		MAX_TCP_OPTION_SPACE;
+ 
+-	syn_data = skb_copy_expand(syn, skb_headroom(syn), space,
++	space = min_t(size_t, space, fo->size);
++
++	/* limit to order-0 allocations */
++	space = min_t(size_t, space, SKB_MAX_HEAD(MAX_TCP_HEADER));
++
++	syn_data = skb_copy_expand(syn, MAX_TCP_HEADER, space,
+ 				   sk->sk_allocation);
+ 	if (syn_data == NULL)
+ 		goto fallback;
+diff --git a/net/ipv6/exthdrs_core.c b/net/ipv6/exthdrs_core.c
+index 140748debc4a..8af3eb57f438 100644
+--- a/net/ipv6/exthdrs_core.c
++++ b/net/ipv6/exthdrs_core.c
+@@ -212,7 +212,7 @@ int ipv6_find_hdr(const struct sk_buff *skb, unsigned int *offset,
+ 		found = (nexthdr == target);
+ 
+ 		if ((!ipv6_ext_hdr(nexthdr)) || nexthdr == NEXTHDR_NONE) {
+-			if (target < 0)
++			if (target < 0 || found)
+ 				break;
+ 			return -ENOENT;
+ 		}
+diff --git a/net/ipv6/syncookies.c b/net/ipv6/syncookies.c
+index bf63ac8a49b9..d703218a653b 100644
+--- a/net/ipv6/syncookies.c
++++ b/net/ipv6/syncookies.c
+@@ -24,26 +24,21 @@
+ #define COOKIEBITS 24	/* Upper bits store count */
+ #define COOKIEMASK (((__u32)1 << COOKIEBITS) - 1)
+ 
+-/* Table must be sorted. */
++/* RFC 2460, Section 8.3:
++ * [ipv6 tcp] MSS must be computed as the maximum packet size minus 60 [..]
++ *
++ * Due to IPV6_MIN_MTU=1280 the lowest possible MSS is 1220, which allows
++ * using higher values than ipv4 tcp syncookies.
++ * The other values are chosen based on ethernet (1500 and 9k MTU), plus
++ * one that accounts for common encap (PPPoe) overhead. Table must be sorted.
++ */
+ static __u16 const msstab[] = {
+-	64,
+-	512,
+-	536,
+-	1280 - 60,
++	1280 - 60, /* IPV6_MIN_MTU - 60 */
+ 	1480 - 60,
+ 	1500 - 60,
+-	4460 - 60,
+ 	9000 - 60,
+ };
+ 
+-/*
+- * This (misnamed) value is the age of syncookie which is permitted.
+- * Its ideal value should be dependent on TCP_TIMEOUT_INIT and
+- * sysctl_tcp_retries1. It's a rather complicated formula (exponential
+- * backoff) to compute at runtime so it's currently hardcoded here.
+- */
+-#define COUNTER_TRIES 4
+-
+ static inline struct sock *get_cookie_sock(struct sock *sk, struct sk_buff *skb,
+ 					   struct request_sock *req,
+ 					   struct dst_entry *dst)
+@@ -86,8 +81,9 @@ static u32 cookie_hash(const struct in6_addr *saddr, const struct in6_addr *dadd
+ static __u32 secure_tcp_syn_cookie(const struct in6_addr *saddr,
+ 				   const struct in6_addr *daddr,
+ 				   __be16 sport, __be16 dport, __u32 sseq,
+-				   __u32 count, __u32 data)
++				   __u32 data)
+ {
++	u32 count = tcp_cookie_time();
+ 	return (cookie_hash(saddr, daddr, sport, dport, 0, 0) +
+ 		sseq + (count << COOKIEBITS) +
+ 		((cookie_hash(saddr, daddr, sport, dport, count, 1) + data)
+@@ -96,15 +92,14 @@ static __u32 secure_tcp_syn_cookie(const struct in6_addr *saddr,
+ 
+ static __u32 check_tcp_syn_cookie(__u32 cookie, const struct in6_addr *saddr,
+ 				  const struct in6_addr *daddr, __be16 sport,
+-				  __be16 dport, __u32 sseq, __u32 count,
+-				  __u32 maxdiff)
++				  __be16 dport, __u32 sseq)
+ {
+-	__u32 diff;
++	__u32 diff, count = tcp_cookie_time();
+ 
+ 	cookie -= cookie_hash(saddr, daddr, sport, dport, 0, 0) + sseq;
+ 
+ 	diff = (count - (cookie >> COOKIEBITS)) & ((__u32) -1 >> COOKIEBITS);
+-	if (diff >= maxdiff)
++	if (diff >= MAX_SYNCOOKIE_AGE)
+ 		return (__u32)-1;
+ 
+ 	return (cookie -
+@@ -125,8 +120,7 @@ u32 __cookie_v6_init_sequence(const struct ipv6hdr *iph,
+ 	*mssp = msstab[mssind];
+ 
+ 	return secure_tcp_syn_cookie(&iph->saddr, &iph->daddr, th->source,
+-				     th->dest, ntohl(th->seq),
+-				     jiffies / (HZ * 60), mssind);
++				     th->dest, ntohl(th->seq), mssind);
+ }
+ EXPORT_SYMBOL_GPL(__cookie_v6_init_sequence);
+ 
+@@ -146,8 +140,7 @@ int __cookie_v6_check(const struct ipv6hdr *iph, const struct tcphdr *th,
+ {
+ 	__u32 seq = ntohl(th->seq) - 1;
+ 	__u32 mssind = check_tcp_syn_cookie(cookie, &iph->saddr, &iph->daddr,
+-					    th->source, th->dest, seq,
+-					    jiffies / (HZ * 60), COUNTER_TRIES);
++					    th->source, th->dest, seq);
+ 
+ 	return mssind < ARRAY_SIZE(msstab) ? msstab[mssind] : 0;
+ }
+diff --git a/net/ipv6/udp_offload.c b/net/ipv6/udp_offload.c
+index 06556d6e1a4d..ab4569df9cef 100644
+--- a/net/ipv6/udp_offload.c
++++ b/net/ipv6/udp_offload.c
+@@ -111,7 +111,7 @@ static struct sk_buff *udp6_ufo_fragment(struct sk_buff *skb,
+ 		fptr = (struct frag_hdr *)(skb_network_header(skb) + unfrag_ip6hlen);
+ 		fptr->nexthdr = nexthdr;
+ 		fptr->reserved = 0;
+-		ipv6_select_ident(fptr, (struct rt6_info *)skb_dst(skb));
++		fptr->identification = skb_shinfo(skb)->ip6_frag_id;
+ 
+ 		/* Fragment the skb. ipv6 header and the remaining fields of the
+ 		 * fragment header are updated in ipv6_gso_segment()
+diff --git a/net/mac80211/mesh_ps.c b/net/mac80211/mesh_ps.c
+index 22290a929b94..641f43219a48 100644
+--- a/net/mac80211/mesh_ps.c
++++ b/net/mac80211/mesh_ps.c
+@@ -36,6 +36,7 @@ static struct sk_buff *mps_qos_null_get(struct sta_info *sta)
+ 				      sdata->vif.addr);
+ 	nullfunc->frame_control = fc;
+ 	nullfunc->duration_id = 0;
++	nullfunc->seq_ctrl = 0;
+ 	/* no address resolution for this frame -> set addr 1 immediately */
+ 	memcpy(nullfunc->addr1, sta->sta.addr, ETH_ALEN);
+ 	memset(skb_put(skb, 2), 0, 2); /* append QoS control field */
+diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
+index 86e4ad56b573..8d7f4abe65ba 100644
+--- a/net/mac80211/mlme.c
++++ b/net/mac80211/mlme.c
+@@ -282,6 +282,7 @@ ieee80211_determine_chantype(struct ieee80211_sub_if_data *sdata,
+ 	switch (vht_oper->chan_width) {
+ 	case IEEE80211_VHT_CHANWIDTH_USE_HT:
+ 		vht_chandef.width = chandef->width;
++		vht_chandef.center_freq1 = chandef->center_freq1;
+ 		break;
+ 	case IEEE80211_VHT_CHANWIDTH_80MHZ:
+ 		vht_chandef.width = NL80211_CHAN_WIDTH_80;
+@@ -331,6 +332,28 @@ ieee80211_determine_chantype(struct ieee80211_sub_if_data *sdata,
+ 	ret = 0;
+ 
+ out:
++	/*
++	 * When tracking the current AP, don't do any further checks if the
++	 * new chandef is identical to the one we're currently using for the
++	 * connection. This keeps us from playing ping-pong with regulatory,
++	 * without it the following can happen (for example):
++	 *  - connect to an AP with 80 MHz, world regdom allows 80 MHz
++	 *  - AP advertises regdom US
++	 *  - CRDA loads regdom US with 80 MHz prohibited (old database)
++	 *  - the code below detects an unsupported channel, downgrades, and
++	 *    we disconnect from the AP in the caller
++	 *  - disconnect causes CRDA to reload world regdomain and the game
++	 *    starts anew.
++	 * (see https://bugzilla.kernel.org/show_bug.cgi?id=70881)
++	 *
++	 * It seems possible that there are still scenarios with CSA or real
++	 * bandwidth changes where a this could happen, but those cases are
++	 * less common and wouldn't completely prevent using the AP.
++	 */
++	if (tracking &&
++	    cfg80211_chandef_identical(chandef, &sdata->vif.bss_conf.chandef))
++		return ret;
++
+ 	/* don't print the message below for VHT mismatch if VHT is disabled */
+ 	if (ret & IEEE80211_STA_DISABLE_VHT)
+ 		vht_chandef = *chandef;
+diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
+index aeb967a0aeed..db41c190e76d 100644
+--- a/net/mac80211/sta_info.c
++++ b/net/mac80211/sta_info.c
+@@ -340,6 +340,7 @@ struct sta_info *sta_info_alloc(struct ieee80211_sub_if_data *sdata,
+ 		return NULL;
+ 
+ 	spin_lock_init(&sta->lock);
++	spin_lock_init(&sta->ps_lock);
+ 	INIT_WORK(&sta->drv_unblock_wk, sta_unblock);
+ 	INIT_WORK(&sta->ampdu_mlme.work, ieee80211_ba_session_work);
+ 	mutex_init(&sta->ampdu_mlme.mtx);
+@@ -1049,6 +1050,8 @@ void ieee80211_sta_ps_deliver_wakeup(struct sta_info *sta)
+ 
+ 	skb_queue_head_init(&pending);
+ 
++	/* sync with ieee80211_tx_h_unicast_ps_buf */
++	spin_lock(&sta->ps_lock);
+ 	/* Send all buffered frames to the station */
+ 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
+ 		int count = skb_queue_len(&pending), tmp;
+@@ -1068,6 +1071,7 @@ void ieee80211_sta_ps_deliver_wakeup(struct sta_info *sta)
+ 	}
+ 
+ 	ieee80211_add_pending_skbs_fn(local, &pending, clear_sta_ps_flags, sta);
++	spin_unlock(&sta->ps_lock);
+ 
+ 	local->total_ps_buffered -= buffered;
+ 
+@@ -1114,6 +1118,7 @@ static void ieee80211_send_null_response(struct ieee80211_sub_if_data *sdata,
+ 	memcpy(nullfunc->addr1, sta->sta.addr, ETH_ALEN);
+ 	memcpy(nullfunc->addr2, sdata->vif.addr, ETH_ALEN);
+ 	memcpy(nullfunc->addr3, sdata->vif.addr, ETH_ALEN);
++	nullfunc->seq_ctrl = 0;
+ 
+ 	skb->priority = tid;
+ 	skb_set_queue_mapping(skb, ieee802_1d_to_ac[tid]);
+diff --git a/net/mac80211/sta_info.h b/net/mac80211/sta_info.h
+index 4208dbd5861f..492d59cbf289 100644
+--- a/net/mac80211/sta_info.h
++++ b/net/mac80211/sta_info.h
+@@ -245,6 +245,7 @@ struct sta_ampdu_mlme {
+  * @drv_unblock_wk: used for driver PS unblocking
+  * @listen_interval: listen interval of this station, when we're acting as AP
+  * @_flags: STA flags, see &enum ieee80211_sta_info_flags, do not use directly
++ * @ps_lock: used for powersave (when mac80211 is the AP) related locking
+  * @ps_tx_buf: buffers (per AC) of frames to transmit to this station
+  *	when it leaves power saving state or polls
+  * @tx_filtered: buffers (per AC) of frames we already tried to
+@@ -328,10 +329,8 @@ struct sta_info {
+ 	/* use the accessors defined below */
+ 	unsigned long _flags;
+ 
+-	/*
+-	 * STA powersave frame queues, no more than the internal
+-	 * locking required.
+-	 */
++	/* STA powersave lock and frame queues */
++	spinlock_t ps_lock;
+ 	struct sk_buff_head ps_tx_buf[IEEE80211_NUM_ACS];
+ 	struct sk_buff_head tx_filtered[IEEE80211_NUM_ACS];
+ 	unsigned long driver_buffered_tids;
+diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
+index 81dca92176c7..d6a47e76efff 100644
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -477,6 +477,20 @@ ieee80211_tx_h_unicast_ps_buf(struct ieee80211_tx_data *tx)
+ 		       sta->sta.addr, sta->sta.aid, ac);
+ 		if (tx->local->total_ps_buffered >= TOTAL_MAX_TX_BUFFER)
+ 			purge_old_ps_buffers(tx->local);
++
++		/* sync with ieee80211_sta_ps_deliver_wakeup */
++		spin_lock(&sta->ps_lock);
++		/*
++		 * STA woke up the meantime and all the frames on ps_tx_buf have
++		 * been queued to pending queue. No reordering can happen, go
++		 * ahead and Tx the packet.
++		 */
++		if (!test_sta_flag(sta, WLAN_STA_PS_STA) &&
++		    !test_sta_flag(sta, WLAN_STA_PS_DRIVER)) {
++			spin_unlock(&sta->ps_lock);
++			return TX_CONTINUE;
++		}
++
+ 		if (skb_queue_len(&sta->ps_tx_buf[ac]) >= STA_MAX_TX_BUFFER) {
+ 			struct sk_buff *old = skb_dequeue(&sta->ps_tx_buf[ac]);
+ 			ps_dbg(tx->sdata,
+@@ -490,6 +504,7 @@ ieee80211_tx_h_unicast_ps_buf(struct ieee80211_tx_data *tx)
+ 		info->control.vif = &tx->sdata->vif;
+ 		info->flags |= IEEE80211_TX_INTFL_NEED_TXPROCESSING;
+ 		skb_queue_tail(&sta->ps_tx_buf[ac], tx->skb);
++		spin_unlock(&sta->ps_lock);
+ 
+ 		if (!timer_pending(&local->sta_cleanup))
+ 			mod_timer(&local->sta_cleanup,
+diff --git a/net/mac80211/wme.c b/net/mac80211/wme.c
+index afba19cb6f87..a282fddf8b00 100644
+--- a/net/mac80211/wme.c
++++ b/net/mac80211/wme.c
+@@ -153,6 +153,11 @@ u16 ieee80211_select_queue(struct ieee80211_sub_if_data *sdata,
+ 		return IEEE80211_AC_BE;
+ 	}
+ 
++	if (skb->protocol == sdata->control_port_protocol) {
++		skb->priority = 7;
++		return ieee80211_downgrade_queue(sdata, skb);
++	}
++
+ 	/* use the data classifier to determine what 802.1d tag the
+ 	 * data frame has */
+ 	skb->priority = cfg80211_classify8021d(skb);
+diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
+index dfe3f36ff2aa..56ebe71cfe13 100644
+--- a/net/sctp/sm_statefuns.c
++++ b/net/sctp/sm_statefuns.c
+@@ -759,6 +759,13 @@ sctp_disposition_t sctp_sf_do_5_1D_ce(struct net *net,
+ 		struct sctp_chunk auth;
+ 		sctp_ierror_t ret;
+ 
++		/* Make sure that we and the peer are AUTH capable */
++		if (!net->sctp.auth_enable || !new_asoc->peer.auth_capable) {
++			kfree_skb(chunk->auth_chunk);
++			sctp_association_free(new_asoc);
++			return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
++		}
++
+ 		/* set-up our fake chunk so that we can process it */
+ 		auth.skb = chunk->auth_chunk;
+ 		auth.asoc = chunk->asoc;
+diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
+index 83a1daa642bb..1d034825fcc3 100644
+--- a/net/sunrpc/xprtsock.c
++++ b/net/sunrpc/xprtsock.c
+@@ -853,6 +853,8 @@ static void xs_close(struct rpc_xprt *xprt)
+ 
+ 	dprintk("RPC:       xs_close xprt %p\n", xprt);
+ 
++	cancel_delayed_work_sync(&transport->connect_worker);
++
+ 	xs_reset_transport(transport);
+ 	xprt->reestablish_timeout = 0;
+ 
+@@ -887,12 +889,8 @@ static void xs_local_destroy(struct rpc_xprt *xprt)
+  */
+ static void xs_destroy(struct rpc_xprt *xprt)
+ {
+-	struct sock_xprt *transport = container_of(xprt, struct sock_xprt, xprt);
+-
+ 	dprintk("RPC:       xs_destroy xprt %p\n", xprt);
+ 
+-	cancel_delayed_work_sync(&transport->connect_worker);
+-
+ 	xs_local_destroy(xprt);
+ }
+ 
+@@ -1834,6 +1832,10 @@ static inline void xs_reclassify_socket(int family, struct socket *sock)
+ }
+ #endif
+ 
++static void xs_dummy_setup_socket(struct work_struct *work)
++{
++}
++
+ static struct socket *xs_create_sock(struct rpc_xprt *xprt,
+ 		struct sock_xprt *transport, int family, int type, int protocol)
+ {
+@@ -2673,6 +2675,9 @@ static struct rpc_xprt *xs_setup_local(struct xprt_create *args)
+ 	xprt->ops = &xs_local_ops;
+ 	xprt->timeout = &xs_local_default_timeout;
+ 
++	INIT_DELAYED_WORK(&transport->connect_worker,
++			xs_dummy_setup_socket);
++
+ 	switch (sun->sun_family) {
+ 	case AF_LOCAL:
+ 		if (sun->sun_path[0] != '/') {
+diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
+index a427623ee574..d7c1ac621a90 100644
+--- a/net/unix/af_unix.c
++++ b/net/unix/af_unix.c
+@@ -161,9 +161,8 @@ static inline void unix_set_secdata(struct scm_cookie *scm, struct sk_buff *skb)
+ 
+ static inline unsigned int unix_hash_fold(__wsum n)
+ {
+-	unsigned int hash = (__force unsigned int)n;
++	unsigned int hash = (__force unsigned int)csum_fold(n);
+ 
+-	hash ^= hash>>16;
+ 	hash ^= hash>>8;
+ 	return hash&(UNIX_HASH_SIZE-1);
+ }
+diff --git a/net/xfrm/xfrm_ipcomp.c b/net/xfrm/xfrm_ipcomp.c
+index 2906d520eea7..3be02b680268 100644
+--- a/net/xfrm/xfrm_ipcomp.c
++++ b/net/xfrm/xfrm_ipcomp.c
+@@ -141,14 +141,14 @@ static int ipcomp_compress(struct xfrm_state *x, struct sk_buff *skb)
+ 	const int plen = skb->len;
+ 	int dlen = IPCOMP_SCRATCH_SIZE;
+ 	u8 *start = skb->data;
+-	const int cpu = get_cpu();
+-	u8 *scratch = *per_cpu_ptr(ipcomp_scratches, cpu);
+-	struct crypto_comp *tfm = *per_cpu_ptr(ipcd->tfms, cpu);
++	struct crypto_comp *tfm;
++	u8 *scratch;
+ 	int err;
+ 
+ 	local_bh_disable();
++	scratch = *this_cpu_ptr(ipcomp_scratches);
++	tfm = *this_cpu_ptr(ipcd->tfms);
+ 	err = crypto_comp_compress(tfm, start, plen, scratch, &dlen);
+-	local_bh_enable();
+ 	if (err)
+ 		goto out;
+ 
+@@ -158,13 +158,13 @@ static int ipcomp_compress(struct xfrm_state *x, struct sk_buff *skb)
+ 	}
+ 
+ 	memcpy(start + sizeof(struct ip_comp_hdr), scratch, dlen);
+-	put_cpu();
++	local_bh_enable();
+ 
+ 	pskb_trim(skb, dlen + sizeof(struct ip_comp_hdr));
+ 	return 0;
+ 
+ out:
+-	put_cpu();
++	local_bh_enable();
+ 	return err;
+ }
+ 
+diff --git a/security/selinux/ss/ebitmap.c b/security/selinux/ss/ebitmap.c
+index 30f119b1d1ec..820313a04d49 100644
+--- a/security/selinux/ss/ebitmap.c
++++ b/security/selinux/ss/ebitmap.c
+@@ -213,7 +213,12 @@ netlbl_import_failure:
+ }
+ #endif /* CONFIG_NETLABEL */
+ 
+-int ebitmap_contains(struct ebitmap *e1, struct ebitmap *e2)
++/*
++ * Check to see if all the bits set in e2 are also set in e1. Optionally,
++ * if last_e2bit is non-zero, the highest set bit in e2 cannot exceed
++ * last_e2bit.
++ */
++int ebitmap_contains(struct ebitmap *e1, struct ebitmap *e2, u32 last_e2bit)
+ {
+ 	struct ebitmap_node *n1, *n2;
+ 	int i;
+@@ -223,14 +228,25 @@ int ebitmap_contains(struct ebitmap *e1, struct ebitmap *e2)
+ 
+ 	n1 = e1->node;
+ 	n2 = e2->node;
++
+ 	while (n1 && n2 && (n1->startbit <= n2->startbit)) {
+ 		if (n1->startbit < n2->startbit) {
+ 			n1 = n1->next;
+ 			continue;
+ 		}
+-		for (i = 0; i < EBITMAP_UNIT_NUMS; i++) {
++		for (i = EBITMAP_UNIT_NUMS - 1; (i >= 0) && !n2->maps[i]; )
++			i--;	/* Skip trailing NULL map entries */
++		if (last_e2bit && (i >= 0)) {
++			u32 lastsetbit = n2->startbit + i * EBITMAP_UNIT_SIZE +
++					 __fls(n2->maps[i]);
++			if (lastsetbit > last_e2bit)
++				return 0;
++		}
++
++		while (i >= 0) {
+ 			if ((n1->maps[i] & n2->maps[i]) != n2->maps[i])
+ 				return 0;
++			i--;
+ 		}
+ 
+ 		n1 = n1->next;
+diff --git a/security/selinux/ss/ebitmap.h b/security/selinux/ss/ebitmap.h
+index 922f8afa89dd..712c8a7b8e8b 100644
+--- a/security/selinux/ss/ebitmap.h
++++ b/security/selinux/ss/ebitmap.h
+@@ -16,7 +16,13 @@
+ 
+ #include <net/netlabel.h>
+ 
+-#define EBITMAP_UNIT_NUMS	((32 - sizeof(void *) - sizeof(u32))	\
++#ifdef CONFIG_64BIT
++#define	EBITMAP_NODE_SIZE	64
++#else
++#define	EBITMAP_NODE_SIZE	32
++#endif
++
++#define EBITMAP_UNIT_NUMS	((EBITMAP_NODE_SIZE-sizeof(void *)-sizeof(u32))\
+ 					/ sizeof(unsigned long))
+ #define EBITMAP_UNIT_SIZE	BITS_PER_LONG
+ #define EBITMAP_SIZE		(EBITMAP_UNIT_NUMS * EBITMAP_UNIT_SIZE)
+@@ -117,7 +123,7 @@ static inline void ebitmap_node_clr_bit(struct ebitmap_node *n,
+ 
+ int ebitmap_cmp(struct ebitmap *e1, struct ebitmap *e2);
+ int ebitmap_cpy(struct ebitmap *dst, struct ebitmap *src);
+-int ebitmap_contains(struct ebitmap *e1, struct ebitmap *e2);
++int ebitmap_contains(struct ebitmap *e1, struct ebitmap *e2, u32 last_e2bit);
+ int ebitmap_get_bit(struct ebitmap *e, unsigned long bit);
+ int ebitmap_set_bit(struct ebitmap *e, unsigned long bit, int value);
+ void ebitmap_destroy(struct ebitmap *e);
+diff --git a/security/selinux/ss/mls.c b/security/selinux/ss/mls.c
+index 40de8d3f208e..c85bc1ec040c 100644
+--- a/security/selinux/ss/mls.c
++++ b/security/selinux/ss/mls.c
+@@ -160,8 +160,6 @@ void mls_sid_to_context(struct context *context,
+ int mls_level_isvalid(struct policydb *p, struct mls_level *l)
+ {
+ 	struct level_datum *levdatum;
+-	struct ebitmap_node *node;
+-	int i;
+ 
+ 	if (!l->sens || l->sens > p->p_levels.nprim)
+ 		return 0;
+@@ -170,19 +168,13 @@ int mls_level_isvalid(struct policydb *p, struct mls_level *l)
+ 	if (!levdatum)
+ 		return 0;
+ 
+-	ebitmap_for_each_positive_bit(&l->cat, node, i) {
+-		if (i > p->p_cats.nprim)
+-			return 0;
+-		if (!ebitmap_get_bit(&levdatum->level->cat, i)) {
+-			/*
+-			 * Category may not be associated with
+-			 * sensitivity.
+-			 */
+-			return 0;
+-		}
+-	}
+-
+-	return 1;
++	/*
++	 * Return 1 iff all the bits set in l->cat are also be set in
++	 * levdatum->level->cat and no bit in l->cat is larger than
++	 * p->p_cats.nprim.
++	 */
++	return ebitmap_contains(&levdatum->level->cat, &l->cat,
++				p->p_cats.nprim);
+ }
+ 
+ int mls_range_isvalid(struct policydb *p, struct mls_range *r)
+diff --git a/security/selinux/ss/mls_types.h b/security/selinux/ss/mls_types.h
+index 03bed52a8052..e93648774137 100644
+--- a/security/selinux/ss/mls_types.h
++++ b/security/selinux/ss/mls_types.h
+@@ -35,7 +35,7 @@ static inline int mls_level_eq(struct mls_level *l1, struct mls_level *l2)
+ static inline int mls_level_dom(struct mls_level *l1, struct mls_level *l2)
+ {
+ 	return ((l1->sens >= l2->sens) &&
+-		ebitmap_contains(&l1->cat, &l2->cat));
++		ebitmap_contains(&l1->cat, &l2->cat, 0));
+ }
+ 
+ #define mls_level_incomp(l1, l2) \
+diff --git a/sound/pci/hda/hda_eld.c b/sound/pci/hda/hda_eld.c
+index d0d7ac1e99d2..f62356c2f54c 100644
+--- a/sound/pci/hda/hda_eld.c
++++ b/sound/pci/hda/hda_eld.c
+@@ -478,10 +478,9 @@ static void hdmi_print_sad_info(int i, struct cea_sad *a,
+ 		snd_iprintf(buffer, "sad%d_profile\t\t%d\n", i, a->profile);
+ }
+ 
+-static void hdmi_print_eld_info(struct snd_info_entry *entry,
+-				struct snd_info_buffer *buffer)
++void snd_hdmi_print_eld_info(struct hdmi_eld *eld,
++			     struct snd_info_buffer *buffer)
+ {
+-	struct hdmi_eld *eld = entry->private_data;
+ 	struct parsed_hdmi_eld *e = &eld->info;
+ 	char buf[SND_PRINT_CHANNEL_ALLOCATION_ADVISED_BUFSIZE];
+ 	int i;
+@@ -500,13 +499,10 @@ static void hdmi_print_eld_info(struct snd_info_entry *entry,
+ 		[4 ... 7] = "reserved"
+ 	};
+ 
+-	mutex_lock(&eld->lock);
+ 	snd_iprintf(buffer, "monitor_present\t\t%d\n", eld->monitor_present);
+ 	snd_iprintf(buffer, "eld_valid\t\t%d\n", eld->eld_valid);
+-	if (!eld->eld_valid) {
+-		mutex_unlock(&eld->lock);
++	if (!eld->eld_valid)
+ 		return;
+-	}
+ 	snd_iprintf(buffer, "monitor_name\t\t%s\n", e->monitor_name);
+ 	snd_iprintf(buffer, "connection_type\t\t%s\n",
+ 				eld_connection_type_names[e->conn_type]);
+@@ -528,13 +524,11 @@ static void hdmi_print_eld_info(struct snd_info_entry *entry,
+ 
+ 	for (i = 0; i < e->sad_count; i++)
+ 		hdmi_print_sad_info(i, e->sad + i, buffer);
+-	mutex_unlock(&eld->lock);
+ }
+ 
+-static void hdmi_write_eld_info(struct snd_info_entry *entry,
+-				struct snd_info_buffer *buffer)
++void snd_hdmi_write_eld_info(struct hdmi_eld *eld,
++			     struct snd_info_buffer *buffer)
+ {
+-	struct hdmi_eld *eld = entry->private_data;
+ 	struct parsed_hdmi_eld *e = &eld->info;
+ 	char line[64];
+ 	char name[64];
+@@ -542,7 +536,6 @@ static void hdmi_write_eld_info(struct snd_info_entry *entry,
+ 	long long val;
+ 	unsigned int n;
+ 
+-	mutex_lock(&eld->lock);
+ 	while (!snd_info_get_line(buffer, line, sizeof(line))) {
+ 		if (sscanf(line, "%s %llx", name, &val) != 2)
+ 			continue;
+@@ -594,38 +587,7 @@ static void hdmi_write_eld_info(struct snd_info_entry *entry,
+ 				e->sad_count = n + 1;
+ 		}
+ 	}
+-	mutex_unlock(&eld->lock);
+-}
+-
+-
+-int snd_hda_eld_proc_new(struct hda_codec *codec, struct hdmi_eld *eld,
+-			 int index)
+-{
+-	char name[32];
+-	struct snd_info_entry *entry;
+-	int err;
+-
+-	snprintf(name, sizeof(name), "eld#%d.%d", codec->addr, index);
+-	err = snd_card_proc_new(codec->bus->card, name, &entry);
+-	if (err < 0)
+-		return err;
+-
+-	snd_info_set_text_ops(entry, eld, hdmi_print_eld_info);
+-	entry->c.text.write = hdmi_write_eld_info;
+-	entry->mode |= S_IWUSR;
+-	eld->proc_entry = entry;
+-
+-	return 0;
+-}
+-
+-void snd_hda_eld_proc_free(struct hda_codec *codec, struct hdmi_eld *eld)
+-{
+-	if (!codec->bus->shutdown && eld->proc_entry) {
+-		snd_device_free(codec->bus->card, eld->proc_entry);
+-		eld->proc_entry = NULL;
+-	}
+ }
+-
+ #endif /* CONFIG_PROC_FS */
+ 
+ /* update PCM info based on ELD */
+diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
+index f7e76619f7c9..ccf5eb6b3d37 100644
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -169,6 +169,7 @@ MODULE_SUPPORTED_DEVICE("{{Intel, ICH6},"
+ 			 "{Intel, PPT},"
+ 			 "{Intel, LPT},"
+ 			 "{Intel, LPT_LP},"
++			 "{Intel, WPT_LP},"
+ 			 "{Intel, HPT},"
+ 			 "{Intel, PBG},"
+ 			 "{Intel, SCH},"
+@@ -568,6 +569,7 @@ enum {
+ 	AZX_DRIVER_ICH,
+ 	AZX_DRIVER_PCH,
+ 	AZX_DRIVER_SCH,
++	AZX_DRIVER_HDMI,
+ 	AZX_DRIVER_ATI,
+ 	AZX_DRIVER_ATIHDMI,
+ 	AZX_DRIVER_ATIHDMI_NS,
+@@ -647,6 +649,7 @@ static char *driver_short_names[] = {
+ 	[AZX_DRIVER_ICH] = "HDA Intel",
+ 	[AZX_DRIVER_PCH] = "HDA Intel PCH",
+ 	[AZX_DRIVER_SCH] = "HDA Intel MID",
++	[AZX_DRIVER_HDMI] = "HDA Intel HDMI",
+ 	[AZX_DRIVER_ATI] = "HDA ATI SB",
+ 	[AZX_DRIVER_ATIHDMI] = "HDA ATI HDMI",
+ 	[AZX_DRIVER_ATIHDMI_NS] = "HDA ATI HDMI",
+@@ -3994,13 +3997,16 @@ static DEFINE_PCI_DEVICE_TABLE(azx_ids) = {
+ 	/* Lynx Point-LP */
+ 	{ PCI_DEVICE(0x8086, 0x9c21),
+ 	  .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_PCH },
++	/* Wildcat Point-LP */
++	{ PCI_DEVICE(0x8086, 0x9ca0),
++	  .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_PCH },
+ 	/* Haswell */
+ 	{ PCI_DEVICE(0x8086, 0x0a0c),
+-	  .driver_data = AZX_DRIVER_SCH | AZX_DCAPS_INTEL_HASWELL },
++	  .driver_data = AZX_DRIVER_HDMI | AZX_DCAPS_INTEL_HASWELL },
+ 	{ PCI_DEVICE(0x8086, 0x0c0c),
+-	  .driver_data = AZX_DRIVER_SCH | AZX_DCAPS_INTEL_HASWELL },
++	  .driver_data = AZX_DRIVER_HDMI | AZX_DCAPS_INTEL_HASWELL },
+ 	{ PCI_DEVICE(0x8086, 0x0d0c),
+-	  .driver_data = AZX_DRIVER_SCH | AZX_DCAPS_INTEL_HASWELL },
++	  .driver_data = AZX_DRIVER_HDMI | AZX_DCAPS_INTEL_HASWELL },
+ 	/* 5 Series/3400 */
+ 	{ PCI_DEVICE(0x8086, 0x3b56),
+ 	  .driver_data = AZX_DRIVER_SCH | AZX_DCAPS_INTEL_PCH_NOPM },
+@@ -4080,6 +4086,22 @@ static DEFINE_PCI_DEVICE_TABLE(azx_ids) = {
+ 	  .driver_data = AZX_DRIVER_ATIHDMI | AZX_DCAPS_PRESET_ATI_HDMI },
+ 	{ PCI_DEVICE(0x1002, 0xaa48),
+ 	  .driver_data = AZX_DRIVER_ATIHDMI | AZX_DCAPS_PRESET_ATI_HDMI },
++	{ PCI_DEVICE(0x1002, 0xaa50),
++	  .driver_data = AZX_DRIVER_ATIHDMI | AZX_DCAPS_PRESET_ATI_HDMI },
++	{ PCI_DEVICE(0x1002, 0xaa58),
++	  .driver_data = AZX_DRIVER_ATIHDMI | AZX_DCAPS_PRESET_ATI_HDMI },
++	{ PCI_DEVICE(0x1002, 0xaa60),
++	  .driver_data = AZX_DRIVER_ATIHDMI | AZX_DCAPS_PRESET_ATI_HDMI },
++	{ PCI_DEVICE(0x1002, 0xaa68),
++	  .driver_data = AZX_DRIVER_ATIHDMI | AZX_DCAPS_PRESET_ATI_HDMI },
++	{ PCI_DEVICE(0x1002, 0xaa80),
++	  .driver_data = AZX_DRIVER_ATIHDMI | AZX_DCAPS_PRESET_ATI_HDMI },
++	{ PCI_DEVICE(0x1002, 0xaa88),
++	  .driver_data = AZX_DRIVER_ATIHDMI | AZX_DCAPS_PRESET_ATI_HDMI },
++	{ PCI_DEVICE(0x1002, 0xaa90),
++	  .driver_data = AZX_DRIVER_ATIHDMI | AZX_DCAPS_PRESET_ATI_HDMI },
++	{ PCI_DEVICE(0x1002, 0xaa98),
++	  .driver_data = AZX_DRIVER_ATIHDMI | AZX_DCAPS_PRESET_ATI_HDMI },
+ 	{ PCI_DEVICE(0x1002, 0x9902),
+ 	  .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI },
+ 	{ PCI_DEVICE(0x1002, 0xaaa0),
+diff --git a/sound/pci/hda/hda_local.h b/sound/pci/hda/hda_local.h
+index 2e7493ef8ee0..040d93324f32 100644
+--- a/sound/pci/hda/hda_local.h
++++ b/sound/pci/hda/hda_local.h
+@@ -751,10 +751,6 @@ struct hdmi_eld {
+ 	int	eld_size;
+ 	char    eld_buffer[ELD_MAX_SIZE];
+ 	struct parsed_hdmi_eld info;
+-	struct mutex lock;
+-#ifdef CONFIG_PROC_FS
+-	struct snd_info_entry *proc_entry;
+-#endif
+ };
+ 
+ int snd_hdmi_get_eld_size(struct hda_codec *codec, hda_nid_t nid);
+@@ -767,20 +763,10 @@ void snd_hdmi_eld_update_pcm_info(struct parsed_hdmi_eld *e,
+ 			      struct hda_pcm_stream *hinfo);
+ 
+ #ifdef CONFIG_PROC_FS
+-int snd_hda_eld_proc_new(struct hda_codec *codec, struct hdmi_eld *eld,
+-			 int index);
+-void snd_hda_eld_proc_free(struct hda_codec *codec, struct hdmi_eld *eld);
+-#else
+-static inline int snd_hda_eld_proc_new(struct hda_codec *codec,
+-				       struct hdmi_eld *eld,
+-				       int index)
+-{
+-	return 0;
+-}
+-static inline void snd_hda_eld_proc_free(struct hda_codec *codec,
+-					 struct hdmi_eld *eld)
+-{
+-}
++void snd_hdmi_print_eld_info(struct hdmi_eld *eld,
++			     struct snd_info_buffer *buffer);
++void snd_hdmi_write_eld_info(struct hdmi_eld *eld,
++			     struct snd_info_buffer *buffer);
+ #endif
+ 
+ #define SND_PRINT_CHANNEL_ALLOCATION_ADVISED_BUFSIZE 80
+diff --git a/sound/pci/hda/patch_analog.c b/sound/pci/hda/patch_analog.c
+index 7fc15814c618..41ebdd8812b1 100644
+--- a/sound/pci/hda/patch_analog.c
++++ b/sound/pci/hda/patch_analog.c
+@@ -1085,6 +1085,7 @@ static int patch_ad1884(struct hda_codec *codec)
+ 	spec = codec->spec;
+ 
+ 	spec->gen.mixer_nid = 0x20;
++	spec->gen.mixer_merge_nid = 0x21;
+ 	spec->gen.beep_nid = 0x10;
+ 	set_beep_amp(spec, 0x10, 0, HDA_OUTPUT);
+ 
+diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
+index 417e0fc2d119..adb374babd18 100644
+--- a/sound/pci/hda/patch_hdmi.c
++++ b/sound/pci/hda/patch_hdmi.c
+@@ -45,6 +45,7 @@ module_param(static_hdmi_pcm, bool, 0644);
+ MODULE_PARM_DESC(static_hdmi_pcm, "Don't restrict PCM parameters per ELD info");
+ 
+ #define is_haswell(codec)  ((codec)->vendor_id == 0x80862807)
++#define is_valleyview(codec) ((codec)->vendor_id == 0x80862882)
+ 
+ struct hdmi_spec_per_cvt {
+ 	hda_nid_t cvt_nid;
+@@ -63,9 +64,11 @@ struct hdmi_spec_per_pin {
+ 	hda_nid_t pin_nid;
+ 	int num_mux_nids;
+ 	hda_nid_t mux_nids[HDA_MAX_CONNECTIONS];
++	hda_nid_t cvt_nid;
+ 
+ 	struct hda_codec *codec;
+ 	struct hdmi_eld sink_eld;
++	struct mutex lock;
+ 	struct delayed_work work;
+ 	struct snd_kcontrol *eld_ctl;
+ 	int repoll_count;
+@@ -75,6 +78,9 @@ struct hdmi_spec_per_pin {
+ 	bool chmap_set;		/* channel-map override by ALSA API? */
+ 	unsigned char chmap[8]; /* ALSA API channel-map */
+ 	char pcm_name[8];	/* filled in build_pcm callbacks */
++#ifdef CONFIG_PROC_FS
++	struct snd_info_entry *proc_entry;
++#endif
+ };
+ 
+ struct hdmi_spec {
+@@ -351,17 +357,19 @@ static int hdmi_eld_ctl_info(struct snd_kcontrol *kcontrol,
+ {
+ 	struct hda_codec *codec = snd_kcontrol_chip(kcontrol);
+ 	struct hdmi_spec *spec = codec->spec;
++	struct hdmi_spec_per_pin *per_pin;
+ 	struct hdmi_eld *eld;
+ 	int pin_idx;
+ 
+ 	uinfo->type = SNDRV_CTL_ELEM_TYPE_BYTES;
+ 
+ 	pin_idx = kcontrol->private_value;
+-	eld = &get_pin(spec, pin_idx)->sink_eld;
++	per_pin = get_pin(spec, pin_idx);
++	eld = &per_pin->sink_eld;
+ 
+-	mutex_lock(&eld->lock);
++	mutex_lock(&per_pin->lock);
+ 	uinfo->count = eld->eld_valid ? eld->eld_size : 0;
+-	mutex_unlock(&eld->lock);
++	mutex_unlock(&per_pin->lock);
+ 
+ 	return 0;
+ }
+@@ -371,15 +379,17 @@ static int hdmi_eld_ctl_get(struct snd_kcontrol *kcontrol,
+ {
+ 	struct hda_codec *codec = snd_kcontrol_chip(kcontrol);
+ 	struct hdmi_spec *spec = codec->spec;
++	struct hdmi_spec_per_pin *per_pin;
+ 	struct hdmi_eld *eld;
+ 	int pin_idx;
+ 
+ 	pin_idx = kcontrol->private_value;
+-	eld = &get_pin(spec, pin_idx)->sink_eld;
++	per_pin = get_pin(spec, pin_idx);
++	eld = &per_pin->sink_eld;
+ 
+-	mutex_lock(&eld->lock);
++	mutex_lock(&per_pin->lock);
+ 	if (eld->eld_size > ARRAY_SIZE(ucontrol->value.bytes.data)) {
+-		mutex_unlock(&eld->lock);
++		mutex_unlock(&per_pin->lock);
+ 		snd_BUG();
+ 		return -EINVAL;
+ 	}
+@@ -389,7 +399,7 @@ static int hdmi_eld_ctl_get(struct snd_kcontrol *kcontrol,
+ 	if (eld->eld_valid)
+ 		memcpy(ucontrol->value.bytes.data, eld->eld_buffer,
+ 		       eld->eld_size);
+-	mutex_unlock(&eld->lock);
++	mutex_unlock(&per_pin->lock);
+ 
+ 	return 0;
+ }
+@@ -490,6 +500,68 @@ static void hdmi_set_channel_count(struct hda_codec *codec,
+ 				    AC_VERB_SET_CVT_CHAN_COUNT, chs - 1);
+ }
+ 
++/*
++ * ELD proc files
++ */
++
++#ifdef CONFIG_PROC_FS
++static void print_eld_info(struct snd_info_entry *entry,
++			   struct snd_info_buffer *buffer)
++{
++	struct hdmi_spec_per_pin *per_pin = entry->private_data;
++
++	mutex_lock(&per_pin->lock);
++	snd_hdmi_print_eld_info(&per_pin->sink_eld, buffer);
++	mutex_unlock(&per_pin->lock);
++}
++
++static void write_eld_info(struct snd_info_entry *entry,
++			   struct snd_info_buffer *buffer)
++{
++	struct hdmi_spec_per_pin *per_pin = entry->private_data;
++
++	mutex_lock(&per_pin->lock);
++	snd_hdmi_write_eld_info(&per_pin->sink_eld, buffer);
++	mutex_unlock(&per_pin->lock);
++}
++
++static int eld_proc_new(struct hdmi_spec_per_pin *per_pin, int index)
++{
++	char name[32];
++	struct hda_codec *codec = per_pin->codec;
++	struct snd_info_entry *entry;
++	int err;
++
++	snprintf(name, sizeof(name), "eld#%d.%d", codec->addr, index);
++	err = snd_card_proc_new(codec->bus->card, name, &entry);
++	if (err < 0)
++		return err;
++
++	snd_info_set_text_ops(entry, per_pin, print_eld_info);
++	entry->c.text.write = write_eld_info;
++	entry->mode |= S_IWUSR;
++	per_pin->proc_entry = entry;
++
++	return 0;
++}
++
++static void eld_proc_free(struct hdmi_spec_per_pin *per_pin)
++{
++	if (!per_pin->codec->bus->shutdown && per_pin->proc_entry) {
++		snd_device_free(per_pin->codec->bus->card, per_pin->proc_entry);
++		per_pin->proc_entry = NULL;
++	}
++}
++#else
++static inline int eld_proc_new(struct hdmi_spec_per_pin *per_pin,
++			       int index)
++{
++	return 0;
++}
++static inline void eld_proc_free(struct hdmi_spec_per_pin *per_pin)
++{
++}
++#endif
+ 
+ /*
+  * Channel mapping routines
+@@ -608,25 +680,35 @@ static void hdmi_std_setup_channel_mapping(struct hda_codec *codec,
+ 				       bool non_pcm,
+ 				       int ca)
+ {
++	struct cea_channel_speaker_allocation *ch_alloc;
+ 	int i;
+ 	int err;
+ 	int order;
+ 	int non_pcm_mapping[8];
+ 
+ 	order = get_channel_allocation_order(ca);
++	ch_alloc = &channel_allocations[order];
+ 
+ 	if (hdmi_channel_mapping[ca][1] == 0) {
+-		for (i = 0; i < channel_allocations[order].channels; i++)
+-			hdmi_channel_mapping[ca][i] = i | (i << 4);
+-		for (; i < 8; i++)
+-			hdmi_channel_mapping[ca][i] = 0xf | (i << 4);
++		int hdmi_slot = 0;
++		/* fill actual channel mappings in ALSA channel (i) order */
++		for (i = 0; i < ch_alloc->channels; i++) {
++			while (!ch_alloc->speakers[7 - hdmi_slot] && !WARN_ON(hdmi_slot >= 8))
++				hdmi_slot++; /* skip zero slots */
++
++			hdmi_channel_mapping[ca][i] = (i << 4) | hdmi_slot++;
++		}
++		/* fill the rest of the slots with ALSA channel 0xf */
++		for (hdmi_slot = 0; hdmi_slot < 8; hdmi_slot++)
++			if (!ch_alloc->speakers[7 - hdmi_slot])
++				hdmi_channel_mapping[ca][i++] = (0xf << 4) | hdmi_slot;
+ 	}
+ 
+ 	if (non_pcm) {
+-		for (i = 0; i < channel_allocations[order].channels; i++)
+-			non_pcm_mapping[i] = i | (i << 4);
++		for (i = 0; i < ch_alloc->channels; i++)
++			non_pcm_mapping[i] = (i << 4) | i;
+ 		for (; i < 8; i++)
+-			non_pcm_mapping[i] = 0xf | (i << 4);
++			non_pcm_mapping[i] = (0xf << 4) | i;
+ 	}
+ 
+ 	for (i = 0; i < 8; i++) {
+@@ -639,25 +721,31 @@ static void hdmi_std_setup_channel_mapping(struct hda_codec *codec,
+ 			break;
+ 		}
+ 	}
+-
+-	hdmi_debug_channel_mapping(codec, pin_nid);
+ }
+ 
+ struct channel_map_table {
+ 	unsigned char map;		/* ALSA API channel map position */
+-	unsigned char cea_slot;		/* CEA slot value */
+ 	int spk_mask;			/* speaker position bit mask */
+ };
+ 
+ static struct channel_map_table map_tables[] = {
+-	{ SNDRV_CHMAP_FL,	0x00,	FL },
+-	{ SNDRV_CHMAP_FR,	0x01,	FR },
+-	{ SNDRV_CHMAP_RL,	0x04,	RL },
+-	{ SNDRV_CHMAP_RR,	0x05,	RR },
+-	{ SNDRV_CHMAP_LFE,	0x02,	LFE },
+-	{ SNDRV_CHMAP_FC,	0x03,	FC },
+-	{ SNDRV_CHMAP_RLC,	0x06,	RLC },
+-	{ SNDRV_CHMAP_RRC,	0x07,	RRC },
++	{ SNDRV_CHMAP_FL,	FL },
++	{ SNDRV_CHMAP_FR,	FR },
++	{ SNDRV_CHMAP_RL,	RL },
++	{ SNDRV_CHMAP_RR,	RR },
++	{ SNDRV_CHMAP_LFE,	LFE },
++	{ SNDRV_CHMAP_FC,	FC },
++	{ SNDRV_CHMAP_RLC,	RLC },
++	{ SNDRV_CHMAP_RRC,	RRC },
++	{ SNDRV_CHMAP_RC,	RC },
++	{ SNDRV_CHMAP_FLC,	FLC },
++	{ SNDRV_CHMAP_FRC,	FRC },
++	{ SNDRV_CHMAP_FLH,	FLH },
++	{ SNDRV_CHMAP_FRH,	FRH },
++	{ SNDRV_CHMAP_FLW,	FLW },
++	{ SNDRV_CHMAP_FRW,	FRW },
++	{ SNDRV_CHMAP_TC,	TC },
++	{ SNDRV_CHMAP_FCH,	FCH },
+ 	{} /* terminator */
+ };
+ 
+@@ -673,25 +761,19 @@ static int to_spk_mask(unsigned char c)
+ }
+ 
+ /* from ALSA API channel position to CEA slot */
+-static int to_cea_slot(unsigned char c)
++static int to_cea_slot(int ordered_ca, unsigned char pos)
+ {
+-	struct channel_map_table *t = map_tables;
+-	for (; t->map; t++) {
+-		if (t->map == c)
+-			return t->cea_slot;
+-	}
+-	return 0x0f;
+-}
++	int mask = to_spk_mask(pos);
++	int i;
+ 
+-/* from CEA slot to ALSA API channel position */
+-static int from_cea_slot(unsigned char c)
+-{
+-	struct channel_map_table *t = map_tables;
+-	for (; t->map; t++) {
+-		if (t->cea_slot == c)
+-			return t->map;
++	if (mask) {
++		for (i = 0; i < 8; i++) {
++			if (channel_allocations[ordered_ca].speakers[7 - i] == mask)
++				return i;
++		}
+ 	}
+-	return 0;
++
++	return -1;
+ }
+ 
+ /* from speaker bit mask to ALSA API channel position */
+@@ -705,6 +787,14 @@ static int spk_to_chmap(int spk)
+ 	return 0;
+ }
+ 
++/* from CEA slot to ALSA API channel position */
++static int from_cea_slot(int ordered_ca, unsigned char slot)
++{
++	int mask = channel_allocations[ordered_ca].speakers[7 - slot];
++
++	return spk_to_chmap(mask);
++}
++
+ /* get the CA index corresponding to the given ALSA API channel map */
+ static int hdmi_manual_channel_allocation(int chs, unsigned char *map)
+ {
+@@ -731,16 +821,27 @@ static int hdmi_manual_channel_allocation(int chs, unsigned char *map)
+ /* set up the channel slots for the given ALSA API channel map */
+ static int hdmi_manual_setup_channel_mapping(struct hda_codec *codec,
+ 					     hda_nid_t pin_nid,
+-					     int chs, unsigned char *map)
++					     int chs, unsigned char *map,
++					     int ca)
+ {
+-	int i;
+-	for (i = 0; i < 8; i++) {
++	int ordered_ca = get_channel_allocation_order(ca);
++	int alsa_pos, hdmi_slot;
++	int assignments[8] = {[0 ... 7] = 0xf};
++
++	for (alsa_pos = 0; alsa_pos < chs; alsa_pos++) {
++
++		hdmi_slot = to_cea_slot(ordered_ca, map[alsa_pos]);
++
++		if (hdmi_slot < 0)
++			continue; /* unassigned channel */
++
++		assignments[hdmi_slot] = alsa_pos;
++	}
++
++	for (hdmi_slot = 0; hdmi_slot < 8; hdmi_slot++) {
+ 		int val, err;
+-		if (i < chs)
+-			val = to_cea_slot(map[i]);
+-		else
+-			val = 0xf;
+-		val |= (i << 4);
++
++		val = (assignments[hdmi_slot] << 4) | hdmi_slot;
+ 		err = snd_hda_codec_write(codec, pin_nid, 0,
+ 					  AC_VERB_SET_HDMI_CHAN_SLOT, val);
+ 		if (err)
+@@ -756,7 +857,7 @@ static void hdmi_setup_fake_chmap(unsigned char *map, int ca)
+ 	int ordered_ca = get_channel_allocation_order(ca);
+ 	for (i = 0; i < 8; i++) {
+ 		if (i < channel_allocations[ordered_ca].channels)
+-			map[i] = from_cea_slot(hdmi_channel_mapping[ca][i] & 0x0f);
++			map[i] = from_cea_slot(ordered_ca, hdmi_channel_mapping[ca][i] & 0x0f);
+ 		else
+ 			map[i] = 0;
+ 	}
+@@ -769,11 +870,13 @@ static void hdmi_setup_channel_mapping(struct hda_codec *codec,
+ {
+ 	if (!non_pcm && chmap_set) {
+ 		hdmi_manual_setup_channel_mapping(codec, pin_nid,
+-						  channels, map);
++						  channels, map, ca);
+ 	} else {
+ 		hdmi_std_setup_channel_mapping(codec, pin_nid, non_pcm, ca);
+ 		hdmi_setup_fake_chmap(map, ca);
+ 	}
++
++	hdmi_debug_channel_mapping(codec, pin_nid);
+ }
+ 
+ /*
+@@ -903,8 +1006,9 @@ static void hdmi_setup_audio_infoframe(struct hda_codec *codec,
+ {
+ 	hda_nid_t pin_nid = per_pin->pin_nid;
+ 	int channels = per_pin->channels;
++	int active_channels;
+ 	struct hdmi_eld *eld;
+-	int ca;
++	int ca, ordered_ca;
+ 	union audio_infoframe ai;
+ 
+ 	if (!channels)
+@@ -926,6 +1030,11 @@ static void hdmi_setup_audio_infoframe(struct hda_codec *codec,
+ 	if (ca < 0)
+ 		ca = 0;
+ 
++	ordered_ca = get_channel_allocation_order(ca);
++	active_channels = channel_allocations[ordered_ca].channels;
++
++	hdmi_set_channel_count(codec, per_pin->cvt_nid, active_channels);
++
+ 	memset(&ai, 0, sizeof(ai));
+ 	if (eld->info.conn_type == 0) { /* HDMI */
+ 		struct hdmi_audio_infoframe *hdmi_ai = &ai.hdmi;
+@@ -933,7 +1042,7 @@ static void hdmi_setup_audio_infoframe(struct hda_codec *codec,
+ 		hdmi_ai->type		= 0x84;
+ 		hdmi_ai->ver		= 0x01;
+ 		hdmi_ai->len		= 0x0a;
+-		hdmi_ai->CC02_CT47	= channels - 1;
++		hdmi_ai->CC02_CT47	= active_channels - 1;
+ 		hdmi_ai->CA		= ca;
+ 		hdmi_checksum_audio_infoframe(hdmi_ai);
+ 	} else if (eld->info.conn_type == 1) { /* DisplayPort */
+@@ -942,7 +1051,7 @@ static void hdmi_setup_audio_infoframe(struct hda_codec *codec,
+ 		dp_ai->type		= 0x84;
+ 		dp_ai->len		= 0x1b;
+ 		dp_ai->ver		= 0x11 << 2;
+-		dp_ai->CC02_CT47	= channels - 1;
++		dp_ai->CC02_CT47	= active_channels - 1;
+ 		dp_ai->CA		= ca;
+ 	} else {
+ 		snd_printd("HDMI: unknown connection type at pin %d\n",
+@@ -966,9 +1075,9 @@ static void hdmi_setup_audio_infoframe(struct hda_codec *codec,
+ 	if (!hdmi_infoframe_uptodate(codec, pin_nid, ai.bytes,
+ 					sizeof(ai))) {
+ 		snd_printdd("hdmi_setup_audio_infoframe: "
+-			    "pin=%d channels=%d\n",
++			    "pin=%d channels=%d ca=0x%02x\n",
+ 			    pin_nid,
+-			    channels);
++			    active_channels, ca);
+ 		hdmi_stop_infoframe_trans(codec, pin_nid);
+ 		hdmi_fill_audio_infoframe(codec, pin_nid,
+ 					    ai.bytes, sizeof(ai));
+@@ -983,7 +1092,7 @@ static void hdmi_setup_audio_infoframe(struct hda_codec *codec,
+  * Unsolicited events
+  */
+ 
+-static void hdmi_present_sense(struct hdmi_spec_per_pin *per_pin, int repoll);
++static bool hdmi_present_sense(struct hdmi_spec_per_pin *per_pin, int repoll);
+ 
+ static void hdmi_intrinsic_event(struct hda_codec *codec, unsigned int res)
+ {
+@@ -1009,8 +1118,8 @@ static void hdmi_intrinsic_event(struct hda_codec *codec, unsigned int res)
+ 	if (pin_idx < 0)
+ 		return;
+ 
+-	hdmi_present_sense(get_pin(spec, pin_idx), 1);
+-	snd_hda_jack_report_sync(codec);
++	if (hdmi_present_sense(get_pin(spec, pin_idx), 1))
++		snd_hda_jack_report_sync(codec);
+ }
+ 
+ static void hdmi_non_intrinsic_event(struct hda_codec *codec, unsigned int res)
+@@ -1160,7 +1269,16 @@ static int hdmi_choose_cvt(struct hda_codec *codec,
+ 	return 0;
+ }
+ 
+-static void haswell_config_cvts(struct hda_codec *codec,
++/* Intel HDMI workaround to fix audio routing issue:
++ * For some Intel display codecs, pins share the same connection list.
++ * So a conveter can be selected by multiple pins and playback on any of these
++ * pins will generate sound on the external display, because audio flows from
++ * the same converter to the display pipeline. Also muting one pin may make
++ * other pins have no sound output.
++ * So this function assures that an assigned converter for a pin is not selected
++ * by any other pins.
++ */
++static void intel_not_share_assigned_cvt(struct hda_codec *codec,
+ 			hda_nid_t pin_nid, int mux_idx)
+ {
+ 	struct hdmi_spec *spec = codec->spec;
+@@ -1231,6 +1349,7 @@ static int hdmi_pcm_open(struct hda_pcm_stream *hinfo,
+ 	per_cvt = get_cvt(spec, cvt_idx);
+ 	/* Claim converter */
+ 	per_cvt->assigned = 1;
++	per_pin->cvt_nid = per_cvt->cvt_nid;
+ 	hinfo->nid = per_cvt->cvt_nid;
+ 
+ 	snd_hda_codec_write_cache(codec, per_pin->pin_nid, 0,
+@@ -1238,8 +1357,8 @@ static int hdmi_pcm_open(struct hda_pcm_stream *hinfo,
+ 			    mux_idx);
+ 
+ 	/* configure unused pins to choose other converters */
+-	if (is_haswell(codec))
+-		haswell_config_cvts(codec, per_pin->pin_nid, mux_idx);
++	if (is_haswell(codec) || is_valleyview(codec))
++		intel_not_share_assigned_cvt(codec, per_pin->pin_nid, mux_idx);
+ 
+ 	snd_hda_spdif_ctls_assign(codec, pin_idx, per_cvt->cvt_nid);
+ 
+@@ -1297,7 +1416,7 @@ static int hdmi_read_pin_conn(struct hda_codec *codec, int pin_idx)
+ 	return 0;
+ }
+ 
+-static void hdmi_present_sense(struct hdmi_spec_per_pin *per_pin, int repoll)
++static bool hdmi_present_sense(struct hdmi_spec_per_pin *per_pin, int repoll)
+ {
+ 	struct hda_codec *codec = per_pin->codec;
+ 	struct hdmi_spec *spec = codec->spec;
+@@ -1312,10 +1431,15 @@ static void hdmi_present_sense(struct hdmi_spec_per_pin *per_pin, int repoll)
+ 	 * specification worked this way. Hence, we just ignore the data in
+ 	 * the unsolicited response to avoid custom WARs.
+ 	 */
+-	int present = snd_hda_pin_sense(codec, pin_nid);
++	int present;
+ 	bool update_eld = false;
+ 	bool eld_changed = false;
++	bool ret;
+ 
++	snd_hda_power_up(codec);
++	present = snd_hda_pin_sense(codec, pin_nid);
++
++	mutex_lock(&per_pin->lock);
+ 	pin_eld->monitor_present = !!(present & AC_PINSENSE_PRESENCE);
+ 	if (pin_eld->monitor_present)
+ 		eld->eld_valid  = !!(present & AC_PINSENSE_ELDV);
+@@ -1345,11 +1469,10 @@ static void hdmi_present_sense(struct hdmi_spec_per_pin *per_pin, int repoll)
+ 			queue_delayed_work(codec->bus->workq,
+ 					   &per_pin->work,
+ 					   msecs_to_jiffies(300));
+-			return;
++			goto unlock;
+ 		}
+ 	}
+ 
+-	mutex_lock(&pin_eld->lock);
+ 	if (pin_eld->eld_valid && !eld->eld_valid) {
+ 		update_eld = true;
+ 		eld_changed = true;
+@@ -1374,12 +1497,19 @@ static void hdmi_present_sense(struct hdmi_spec_per_pin *per_pin, int repoll)
+ 			hdmi_setup_audio_infoframe(codec, per_pin,
+ 						   per_pin->non_pcm);
+ 	}
+-	mutex_unlock(&pin_eld->lock);
+ 
+ 	if (eld_changed)
+ 		snd_ctl_notify(codec->bus->card,
+ 			       SNDRV_CTL_EVENT_MASK_VALUE | SNDRV_CTL_EVENT_MASK_INFO,
+ 			       &per_pin->eld_ctl->id);
++ unlock:
++	if ((codec->vendor_id & 0xffff0000) == 0x10020000)
++		ret = true; /* AMD codecs create ELD by itself */
++	else
++		ret = !repoll || !pin_eld->monitor_present || pin_eld->eld_valid;
++	mutex_unlock(&per_pin->lock);
++	snd_hda_power_down(codec);
++	return ret;
+ }
+ 
+ static void hdmi_repoll_eld(struct work_struct *work)
+@@ -1390,7 +1520,8 @@ static void hdmi_repoll_eld(struct work_struct *work)
+ 	if (per_pin->repoll_count++ > 6)
+ 		per_pin->repoll_count = 0;
+ 
+-	hdmi_present_sense(per_pin, per_pin->repoll_count);
++	if (hdmi_present_sense(per_pin, per_pin->repoll_count))
++		snd_hda_jack_report_sync(per_pin->codec);
+ }
+ 
+ static void intel_haswell_fixup_connect_list(struct hda_codec *codec,
+@@ -1551,12 +1682,12 @@ static int generic_hdmi_playback_pcm_prepare(struct hda_pcm_stream *hinfo,
+ 	int pinctl;
+ 
+ 	non_pcm = check_non_pcm_per_cvt(codec, cvt_nid);
++	mutex_lock(&per_pin->lock);
+ 	per_pin->channels = substream->runtime->channels;
+ 	per_pin->setup = true;
+ 
+-	hdmi_set_channel_count(codec, cvt_nid, substream->runtime->channels);
+-
+ 	hdmi_setup_audio_infoframe(codec, per_pin, non_pcm);
++	mutex_unlock(&per_pin->lock);
+ 
+ 	if (spec->dyn_pin_out) {
+ 		pinctl = snd_hda_codec_read(codec, pin_nid, 0,
+@@ -1611,11 +1742,14 @@ static int hdmi_pcm_close(struct hda_pcm_stream *hinfo,
+ 		}
+ 
+ 		snd_hda_spdif_ctls_unassign(codec, pin_idx);
++
++		mutex_lock(&per_pin->lock);
+ 		per_pin->chmap_set = false;
+ 		memset(per_pin->chmap, 0, sizeof(per_pin->chmap));
+ 
+ 		per_pin->setup = false;
+ 		per_pin->channels = 0;
++		mutex_unlock(&per_pin->lock);
+ 	}
+ 
+ 	return 0;
+@@ -1650,8 +1784,6 @@ static int hdmi_chmap_ctl_tlv(struct snd_kcontrol *kcontrol, int op_flag,
+ 	struct snd_pcm_chmap *info = snd_kcontrol_chip(kcontrol);
+ 	struct hda_codec *codec = info->private_data;
+ 	struct hdmi_spec *spec = codec->spec;
+-	const unsigned int valid_mask =
+-		FL | FR | RL | RR | LFE | FC | RLC | RRC;
+ 	unsigned int __user *dst;
+ 	int chs, count = 0;
+ 
+@@ -1669,8 +1801,6 @@ static int hdmi_chmap_ctl_tlv(struct snd_kcontrol *kcontrol, int op_flag,
+ 			int chs_bytes = chs * 4;
+ 			if (cap->channels != chs)
+ 				continue;
+-			if (cap->spk_mask & ~valid_mask)
+-				continue;
+ 			if (size < 8)
+ 				return -ENOMEM;
+ 			if (put_user(SNDRV_CTL_TLVT_CHMAP_VAR, dst) ||
+@@ -1748,10 +1878,12 @@ static int hdmi_chmap_ctl_put(struct snd_kcontrol *kcontrol,
+ 	ca = hdmi_manual_channel_allocation(ARRAY_SIZE(chmap), chmap);
+ 	if (ca < 0)
+ 		return -EINVAL;
++	mutex_lock(&per_pin->lock);
+ 	per_pin->chmap_set = true;
+ 	memcpy(per_pin->chmap, chmap, sizeof(chmap));
+ 	if (prepared)
+ 		hdmi_setup_audio_infoframe(codec, per_pin, per_pin->non_pcm);
++	mutex_unlock(&per_pin->lock);
+ 
+ 	return 0;
+ }
+@@ -1868,12 +2000,11 @@ static int generic_hdmi_init_per_pins(struct hda_codec *codec)
+ 
+ 	for (pin_idx = 0; pin_idx < spec->num_pins; pin_idx++) {
+ 		struct hdmi_spec_per_pin *per_pin = get_pin(spec, pin_idx);
+-		struct hdmi_eld *eld = &per_pin->sink_eld;
+ 
+ 		per_pin->codec = codec;
+-		mutex_init(&eld->lock);
++		mutex_init(&per_pin->lock);
+ 		INIT_DELAYED_WORK(&per_pin->work, hdmi_repoll_eld);
+-		snd_hda_eld_proc_new(codec, eld, pin_idx);
++		eld_proc_new(per_pin, pin_idx);
+ 	}
+ 	return 0;
+ }
+@@ -1914,10 +2045,9 @@ static void generic_hdmi_free(struct hda_codec *codec)
+ 
+ 	for (pin_idx = 0; pin_idx < spec->num_pins; pin_idx++) {
+ 		struct hdmi_spec_per_pin *per_pin = get_pin(spec, pin_idx);
+-		struct hdmi_eld *eld = &per_pin->sink_eld;
+ 
+ 		cancel_delayed_work(&per_pin->work);
+-		snd_hda_eld_proc_free(codec, eld);
++		eld_proc_free(per_pin);
+ 	}
+ 
+ 	flush_workqueue(codec->bus->workq);
+@@ -2717,6 +2847,7 @@ static const struct hda_codec_preset snd_hda_preset_hdmi[] = {
+ { .id = 0x80862806, .name = "PantherPoint HDMI", .patch = patch_generic_hdmi },
+ { .id = 0x80862807, .name = "Haswell HDMI",	.patch = patch_generic_hdmi },
+ { .id = 0x80862880, .name = "CedarTrail HDMI",	.patch = patch_generic_hdmi },
++{ .id = 0x80862882, .name = "Valleyview2 HDMI",	.patch = patch_generic_hdmi },
+ { .id = 0x808629fb, .name = "Crestline HDMI",	.patch = patch_generic_hdmi },
+ {} /* terminator */
+ };
+@@ -2771,6 +2902,7 @@ MODULE_ALIAS("snd-hda-codec-id:80862805");
+ MODULE_ALIAS("snd-hda-codec-id:80862806");
+ MODULE_ALIAS("snd-hda-codec-id:80862807");
+ MODULE_ALIAS("snd-hda-codec-id:80862880");
++MODULE_ALIAS("snd-hda-codec-id:80862882");
+ MODULE_ALIAS("snd-hda-codec-id:808629fb");
+ 
+ MODULE_LICENSE("GPL");
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 1be437f533a6..deddee9c1565 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -3464,6 +3464,19 @@ static void alc_fixup_headset_mode_no_hp_mic(struct hda_codec *codec,
+ 		alc_fixup_headset_mode(codec, fix, action);
+ }
+ 
++static void alc_no_shutup(struct hda_codec *codec)
++{
++}
++
++static void alc_fixup_no_shutup(struct hda_codec *codec,
++				const struct hda_fixup *fix, int action)
++{
++	if (action == HDA_FIXUP_ACT_PRE_PROBE) {
++		struct alc_spec *spec = codec->spec;
++		spec->shutup = alc_no_shutup;
++	}
++}
++
+ static void alc_fixup_headset_mode_alc668(struct hda_codec *codec,
+ 				const struct hda_fixup *fix, int action)
+ {
+@@ -3674,6 +3687,7 @@ enum {
+ 	ALC269_FIXUP_HP_GPIO_LED,
+ 	ALC269_FIXUP_INV_DMIC,
+ 	ALC269_FIXUP_LENOVO_DOCK,
++	ALC269_FIXUP_NO_SHUTUP,
+ 	ALC286_FIXUP_SONY_MIC_NO_PRESENCE,
+ 	ALC269_FIXUP_PINCFG_NO_HP_TO_LINEOUT,
+ 	ALC269_FIXUP_DELL1_MIC_NO_PRESENCE,
+@@ -3840,6 +3854,10 @@ static const struct hda_fixup alc269_fixups[] = {
+ 		.type = HDA_FIXUP_FUNC,
+ 		.v.func = alc_fixup_inv_dmic_0x12,
+ 	},
++	[ALC269_FIXUP_NO_SHUTUP] = {
++		.type = HDA_FIXUP_FUNC,
++		.v.func = alc_fixup_no_shutup,
++	},
+ 	[ALC269_FIXUP_LENOVO_DOCK] = {
+ 		.type = HDA_FIXUP_PINS,
+ 		.v.pins = (const struct hda_pintbl[]) {
+@@ -4000,6 +4018,7 @@ static const struct hda_fixup alc269_fixups[] = {
+ };
+ 
+ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
++	SND_PCI_QUIRK(0x1025, 0x0283, "Acer TravelMate 8371", ALC269_FIXUP_INV_DMIC),
+ 	SND_PCI_QUIRK(0x1025, 0x029b, "Acer 1810TZ", ALC269_FIXUP_INV_DMIC),
+ 	SND_PCI_QUIRK(0x1025, 0x0349, "Acer AOD260", ALC269_FIXUP_INV_DMIC),
+ 	SND_PCI_QUIRK(0x1025, 0x047c, "Acer AC700", ALC269_FIXUP_ACER_AC700),
+@@ -4089,6 +4108,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ 	SND_PCI_QUIRK(0x17aa, 0x2212, "Thinkpad", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
+ 	SND_PCI_QUIRK(0x17aa, 0x2214, "Thinkpad", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
+ 	SND_PCI_QUIRK(0x17aa, 0x2215, "Thinkpad", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
++	SND_PCI_QUIRK(0x17aa, 0x3978, "IdeaPad Y410P", ALC269_FIXUP_NO_SHUTUP),
+ 	SND_PCI_QUIRK(0x17aa, 0x5013, "Thinkpad", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
+ 	SND_PCI_QUIRK(0x17aa, 0x501a, "Thinkpad", ALC283_FIXUP_INT_MIC),
+ 	SND_PCI_QUIRK(0x17aa, 0x5026, "Thinkpad", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
+diff --git a/sound/pci/oxygen/xonar_dg.c b/sound/pci/oxygen/xonar_dg.c
+index 77acd790ea47..eb7ad7706205 100644
+--- a/sound/pci/oxygen/xonar_dg.c
++++ b/sound/pci/oxygen/xonar_dg.c
+@@ -294,6 +294,16 @@ static int output_switch_put(struct snd_kcontrol *ctl,
+ 		oxygen_write16_masked(chip, OXYGEN_GPIO_DATA,
+ 				      data->output_sel == 1 ? GPIO_HP_REAR : 0,
+ 				      GPIO_HP_REAR);
++		oxygen_write8_masked(chip, OXYGEN_PLAY_ROUTING,
++				     data->output_sel == 0 ?
++				     OXYGEN_PLAY_MUTE01 :
++				     OXYGEN_PLAY_MUTE23 |
++				     OXYGEN_PLAY_MUTE45 |
++				     OXYGEN_PLAY_MUTE67,
++				     OXYGEN_PLAY_MUTE01 |
++				     OXYGEN_PLAY_MUTE23 |
++				     OXYGEN_PLAY_MUTE45 |
++				     OXYGEN_PLAY_MUTE67);
+ 	}
+ 	mutex_unlock(&chip->mutex);
+ 	return changed;
+@@ -596,7 +606,7 @@ struct oxygen_model model_xonar_dg = {
+ 	.model_data_size = sizeof(struct dg),
+ 	.device_config = PLAYBACK_0_TO_I2S |
+ 			 PLAYBACK_1_TO_SPDIF |
+-			 CAPTURE_0_FROM_I2S_2 |
++			 CAPTURE_0_FROM_I2S_1 |
+ 			 CAPTURE_1_FROM_SPDIF,
+ 	.dac_channels_pcm = 6,
+ 	.dac_channels_mixer = 0,
+diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
+index 95558ef4a7a0..be4db47cb2d9 100644
+--- a/sound/usb/mixer.c
++++ b/sound/usb/mixer.c
+@@ -883,6 +883,7 @@ static void volume_control_quirks(struct usb_mixer_elem_info *cval,
+ 		}
+ 		break;
+ 
++	case USB_ID(0x046d, 0x0807): /* Logitech Webcam C500 */
+ 	case USB_ID(0x046d, 0x0808):
+ 	case USB_ID(0x046d, 0x0809):
+ 	case USB_ID(0x046d, 0x081b): /* HD Webcam c310 */